TlsInit.c 5.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263
  1. /** @file
  2. SSL/TLS Initialization Library Wrapper Implementation over OpenSSL.
  3. Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR>
  4. (C) Copyright 2016 Hewlett Packard Enterprise Development LP<BR>
  5. SPDX-License-Identifier: BSD-2-Clause-Patent
  6. **/
  7. #include "InternalTlsLib.h"
  8. /**
  9. Initializes the OpenSSL library.
  10. This function registers ciphers and digests used directly and indirectly
  11. by SSL/TLS, and initializes the readable error messages.
  12. This function must be called before any other action takes places.
  13. @retval TRUE The OpenSSL library has been initialized.
  14. @retval FALSE Failed to initialize the OpenSSL library.
  15. **/
  16. BOOLEAN
  17. EFIAPI
  18. TlsInitialize (
  19. VOID
  20. )
  21. {
  22. INTN Ret;
  23. //
  24. // Performs initialization of crypto and ssl library, and loads required
  25. // algorithms.
  26. //
  27. Ret = OPENSSL_init_ssl (
  28. OPENSSL_INIT_LOAD_SSL_STRINGS | OPENSSL_INIT_LOAD_CRYPTO_STRINGS,
  29. NULL
  30. );
  31. if (Ret != 1) {
  32. return FALSE;
  33. }
  34. //
  35. // Initialize the pseudorandom number generator.
  36. //
  37. return RandomSeed (NULL, 0);
  38. }
  39. /**
  40. Free an allocated SSL_CTX object.
  41. @param[in] TlsCtx Pointer to the SSL_CTX object to be released.
  42. **/
  43. VOID
  44. EFIAPI
  45. TlsCtxFree (
  46. IN VOID *TlsCtx
  47. )
  48. {
  49. if (TlsCtx == NULL) {
  50. return;
  51. }
  52. if (TlsCtx != NULL) {
  53. SSL_CTX_free ((SSL_CTX *) (TlsCtx));
  54. }
  55. }
  56. /**
  57. Creates a new SSL_CTX object as framework to establish TLS/SSL enabled
  58. connections.
  59. @param[in] MajorVer Major Version of TLS/SSL Protocol.
  60. @param[in] MinorVer Minor Version of TLS/SSL Protocol.
  61. @return Pointer to an allocated SSL_CTX object.
  62. If the creation failed, TlsCtxNew() returns NULL.
  63. **/
  64. VOID *
  65. EFIAPI
  66. TlsCtxNew (
  67. IN UINT8 MajorVer,
  68. IN UINT8 MinorVer
  69. )
  70. {
  71. SSL_CTX *TlsCtx;
  72. UINT16 ProtoVersion;
  73. ProtoVersion = (MajorVer << 8) | MinorVer;
  74. TlsCtx = SSL_CTX_new (SSLv23_client_method ());
  75. if (TlsCtx == NULL) {
  76. return NULL;
  77. }
  78. //
  79. // Ensure SSLv3 is disabled
  80. //
  81. SSL_CTX_set_options (TlsCtx, SSL_OP_NO_SSLv3);
  82. //
  83. // Treat as minimum accepted versions by setting the minimal bound.
  84. // Client can use higher TLS version if server supports it
  85. //
  86. SSL_CTX_set_min_proto_version (TlsCtx, ProtoVersion);
  87. return (VOID *) TlsCtx;
  88. }
  89. /**
  90. Free an allocated TLS object.
  91. This function removes the TLS object pointed to by Tls and frees up the
  92. allocated memory. If Tls is NULL, nothing is done.
  93. @param[in] Tls Pointer to the TLS object to be freed.
  94. **/
  95. VOID
  96. EFIAPI
  97. TlsFree (
  98. IN VOID *Tls
  99. )
  100. {
  101. TLS_CONNECTION *TlsConn;
  102. TlsConn = (TLS_CONNECTION *) Tls;
  103. if (TlsConn == NULL) {
  104. return;
  105. }
  106. //
  107. // Free the internal TLS and related BIO objects.
  108. //
  109. if (TlsConn->Ssl != NULL) {
  110. SSL_free (TlsConn->Ssl);
  111. }
  112. OPENSSL_free (Tls);
  113. }
  114. /**
  115. Create a new TLS object for a connection.
  116. This function creates a new TLS object for a connection. The new object
  117. inherits the setting of the underlying context TlsCtx: connection method,
  118. options, verification setting.
  119. @param[in] TlsCtx Pointer to the SSL_CTX object.
  120. @return Pointer to an allocated SSL object.
  121. If the creation failed, TlsNew() returns NULL.
  122. **/
  123. VOID *
  124. EFIAPI
  125. TlsNew (
  126. IN VOID *TlsCtx
  127. )
  128. {
  129. TLS_CONNECTION *TlsConn;
  130. SSL_CTX *SslCtx;
  131. X509_STORE *X509Store;
  132. TlsConn = NULL;
  133. //
  134. // Allocate one new TLS_CONNECTION object
  135. //
  136. TlsConn = (TLS_CONNECTION *) OPENSSL_malloc (sizeof (TLS_CONNECTION));
  137. if (TlsConn == NULL) {
  138. return NULL;
  139. }
  140. TlsConn->Ssl = NULL;
  141. //
  142. // Create a new SSL Object
  143. //
  144. TlsConn->Ssl = SSL_new ((SSL_CTX *) TlsCtx);
  145. if (TlsConn->Ssl == NULL) {
  146. TlsFree ((VOID *) TlsConn);
  147. return NULL;
  148. }
  149. //
  150. // This retains compatibility with previous version of OpenSSL.
  151. //
  152. SSL_set_security_level (TlsConn->Ssl, 0);
  153. //
  154. // Initialize the created SSL Object
  155. //
  156. SSL_set_info_callback (TlsConn->Ssl, NULL);
  157. TlsConn->InBio = NULL;
  158. //
  159. // Set up Reading BIO for TLS connection
  160. //
  161. TlsConn->InBio = BIO_new (BIO_s_mem ());
  162. if (TlsConn->InBio == NULL) {
  163. TlsFree ((VOID *) TlsConn);
  164. return NULL;
  165. }
  166. //
  167. // Sets the behaviour of memory BIO when it is empty. It will set the
  168. // read retry flag.
  169. //
  170. BIO_set_mem_eof_return (TlsConn->InBio, -1);
  171. TlsConn->OutBio = NULL;
  172. //
  173. // Set up Writing BIO for TLS connection
  174. //
  175. TlsConn->OutBio = BIO_new (BIO_s_mem ());
  176. if (TlsConn->OutBio == NULL) {
  177. TlsFree ((VOID *) TlsConn);
  178. return NULL;
  179. }
  180. //
  181. // Sets the behaviour of memory BIO when it is empty. It will set the
  182. // write retry flag.
  183. //
  184. BIO_set_mem_eof_return (TlsConn->OutBio, -1);
  185. ASSERT (TlsConn->Ssl != NULL && TlsConn->InBio != NULL && TlsConn->OutBio != NULL);
  186. //
  187. // Connects the InBio and OutBio for the read and write operations.
  188. //
  189. SSL_set_bio (TlsConn->Ssl, TlsConn->InBio, TlsConn->OutBio);
  190. //
  191. // Create new X509 store if needed
  192. //
  193. SslCtx = SSL_get_SSL_CTX (TlsConn->Ssl);
  194. X509Store = SSL_CTX_get_cert_store (SslCtx);
  195. if (X509Store == NULL) {
  196. X509Store = X509_STORE_new ();
  197. if (X509Store == NULL) {
  198. TlsFree ((VOID *) TlsConn);
  199. return NULL;
  200. }
  201. SSL_CTX_set1_verify_cert_store (SslCtx, X509Store);
  202. X509_STORE_free (X509Store);
  203. }
  204. //
  205. // Set X509_STORE flags used in certificate validation
  206. //
  207. X509_STORE_set_flags (
  208. X509Store,
  209. X509_V_FLAG_PARTIAL_CHAIN | X509_V_FLAG_NO_CHECK_TIME
  210. );
  211. return (VOID *) TlsConn;
  212. }