2017-04-06 03:53:07 +02:00
|
|
|
/** @file
|
|
|
|
|
Internal include file for TlsLib.
|
|
|
|
|
|
|
|
|
|
Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR>
|
|
|
|
|
This program and the accompanying materials
|
|
|
|
|
are licensed and made available under the terms and conditions of the BSD License
|
|
|
|
|
which accompanies this distribution. The full text of the license may be found at
|
|
|
|
|
http://opensource.org/licenses/bsd-license.php
|
|
|
|
|
|
|
|
|
|
THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
|
|
|
|
|
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
|
|
|
|
|
|
|
|
|
|
**/
|
|
|
|
|
|
|
|
|
|
#ifndef __INTERNAL_TLS_LIB_H__
|
|
|
|
|
#define __INTERNAL_TLS_LIB_H__
|
|
|
|
|
|
|
|
|
|
#undef _WIN32
|
|
|
|
|
#undef _WIN64
|
|
|
|
|
|
|
|
|
|
#include <Library/BaseCryptLib.h>
|
2018-03-31 22:25:15 +02:00
|
|
|
#include <Library/BaseMemoryLib.h>
|
|
|
|
|
#include <Library/DebugLib.h>
|
CryptoPkg/TlsLib: rewrite TlsSetCipherList()
Rewrite the TlsSetCipherList() function in order to fix the following
issues:
- Any cipher identifier in CipherId that is not recognized by
TlsGetCipherMapping() will cause the function to return EFI_UNSUPPORTED.
This is a problem because CipherId is an ordered preference list, and a
caller should not get EFI_UNSUPPORTED just because it has an elaborate
CipherId preference list. Instead, we can filter out cipher identifiers
that we don't recognize, as long as we keep the relative order intact.
- CipherString is allocated on the stack, with 500 bytes.
While processing a large CipherId preference list, this room may not be
enough. Although no buffer overflow is possible, CipherString exhaustion
can lead to a failed TLS connection, because any cipher names that don't
fit on CipherString cannot be negotiated.
Compute CipherStringSize first, and allocate CipherString dynamically.
- Finally, the "@STRENGTH" pseudo cipher name is appended to CipherString.
(Assuming there is enough room left in CipherString.) This causes
OpenSSL to sort the cipher list "in order of encryption algorithm key
length".
This is a bad idea. The caller specifically passes an ordered preference
list in CipherId. Therefore TlsSetCipherList() must not ask OpenSSL to
reorder the list, for any reason. Drop "@STRENGTH".
While at it, fix and unify the documentation of the CipherId parameter.
Cc: Jiaxin Wu <jiaxin.wu@intel.com>
Cc: Qin Long <qin.long@intel.com>
Cc: Siyuan Fu <siyuan.fu@intel.com>
Cc: Ting Ye <ting.ye@intel.com>
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=915
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Long Qin <qin.long@intel.com>
Reviewed-by: Jiaxin Wu <jiaxin.wu@intel.com>
2018-03-31 17:33:14 +02:00
|
|
|
#include <Library/MemoryAllocationLib.h>
|
|
|
|
|
#include <Library/SafeIntLib.h>
|
2017-04-06 03:53:07 +02:00
|
|
|
#include <openssl/ssl.h>
|
|
|
|
|
#include <openssl/bio.h>
|
|
|
|
|
#include <openssl/err.h>
|
|
|
|
|
|
|
|
|
|
typedef struct {
|
|
|
|
|
//
|
|
|
|
|
// Main SSL Connection which is created by a server or a client
|
|
|
|
|
// per established connection.
|
|
|
|
|
//
|
|
|
|
|
SSL *Ssl;
|
|
|
|
|
//
|
|
|
|
|
// Memory BIO for the TLS/SSL Reading operations.
|
|
|
|
|
//
|
|
|
|
|
BIO *InBio;
|
|
|
|
|
//
|
|
|
|
|
// Memory BIO for the TLS/SSL Writing operations.
|
|
|
|
|
//
|
|
|
|
|
BIO *OutBio;
|
|
|
|
|
} TLS_CONNECTION;
|
|
|
|
|
|
|
|
|
|
#endif
|
|
|
|
|
|
