tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

CryptoPkg/TlsLib: Update TLS Wrapper to align with OpenSSL changes. 

This patch update the wrapper implementation in TlsLib to align
with the latest OpenSSL-1.1.0xx API changes.

Cc: Ting Ye <ting.ye@intel.com>
Cc: Palmer Thomas <thomas.palmer@hpe.com>
Cc: Jiaxin Wu <jiaxin.wu@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Gary Lin <glin@suse.com>
Cc: Ronald Cron <ronald.cron@arm.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Qin Long <qin.long@intel.com>
Reviewed-by: Wu Jiaxin <jiaxin.wu@intel.com>
Reviewed-by: Ting Ye <ting.ye@intel.com>
This commit is contained in:
Qin Long 2017-03-23 20:53:45 +08:00
parent f56b11d2cd
commit 113581e6f3
3 changed files with 30 additions and 45 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
CryptoPkg/Library/TlsLib/InternalTlsLib.h
View File

@ -1,7 +1,7 @@
/** @file /** @file
Internal include file for TlsLib. Internal include file for TlsLib.
Copyright (c) 2016, Intel Corporation. All rights reserved.<BR> Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR>
This program and the accompanying materials This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License are licensed and made available under the terms and conditions of the BSD License
which accompanies this distribution. The full text of the license may be found at which accompanies this distribution. The full text of the license may be found at
@ -15,6 +15,9 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
#ifndef __INTERNAL_TLS_LIB_H__ #ifndef __INTERNAL_TLS_LIB_H__
#define __INTERNAL_TLS_LIB_H__ #define __INTERNAL_TLS_LIB_H__
#undef _WIN32
#undef _WIN64
#include <Library/BaseCryptLib.h> #include <Library/BaseCryptLib.h>
#include <openssl/ssl.h> #include <openssl/ssl.h>
#include <openssl/bio.h> #include <openssl/bio.h>

21
CryptoPkg/Library/TlsLib/TlsConfig.c
View File

@ -128,24 +128,30 @@ TlsSetVersion (
ProtoVersion = (MajorVer << 8) | MinorVer; ProtoVersion = (MajorVer << 8) | MinorVer;
//
// Bound TLS method to the particular specified version.
//
switch (ProtoVersion) { switch (ProtoVersion) {
case TLS1_VERSION: case TLS1_VERSION:
// //
// TLS 1.0 // TLS 1.0
// //
SSL_set_ssl_method (TlsConn->Ssl, TLSv1_method ()); SSL_set_min_proto_version (TlsConn->Ssl, TLS1_VERSION);
SSL_set_max_proto_version (TlsConn->Ssl, TLS1_VERSION);
break; break;
case TLS1_1_VERSION: case TLS1_1_VERSION:
// //
// TLS 1.1 // TLS 1.1
// //
SSL_set_ssl_method (TlsConn->Ssl, TLSv1_1_method ()); SSL_set_min_proto_version (TlsConn->Ssl, TLS1_1_VERSION);
SSL_set_max_proto_version (TlsConn->Ssl, TLS1_1_VERSION);
break; break;
case TLS1_2_VERSION: case TLS1_2_VERSION:
// //
// TLS 1.2 // TLS 1.2
// //
SSL_set_ssl_method (TlsConn->Ssl, TLSv1_2_method ()); SSL_set_min_proto_version (TlsConn->Ssl, TLS1_2_VERSION);
SSL_set_max_proto_version (TlsConn->Ssl, TLS1_2_VERSION);
break; break;
default: default:
// //
@ -384,8 +390,7 @@ TlsSetSessionId (
return EFI_UNSUPPORTED; return EFI_UNSUPPORTED;
} }
Session->session_id_length = SessionIdLen; SSL_SESSION_set1_id (Session, (const unsigned char *)SessionId, SessionIdLen);
CopyMem (Session->session_id, SessionId, Session->session_id_length);
return EFI_SUCCESS; return EFI_SUCCESS;
} }
@ -847,7 +852,7 @@ TlsGetClientRandom (
return; return;
} }
CopyMem (ClientRandom, TlsConn->Ssl->s3->client_random, SSL3_RANDOM_SIZE); SSL_get_client_random (TlsConn->Ssl, ClientRandom, SSL3_RANDOM_SIZE);
} }
/** /**
@ -876,7 +881,7 @@ TlsGetServerRandom (
return; return;
} }
CopyMem (ServerRandom, TlsConn->Ssl->s3->server_random, SSL3_RANDOM_SIZE); SSL_get_server_random (TlsConn->Ssl, ServerRandom, SSL3_RANDOM_SIZE);
} }
/** /**
@ -916,7 +921,7 @@ TlsGetKeyMaterial (
return EFI_UNSUPPORTED; return EFI_UNSUPPORTED;
} }
CopyMem (KeyMaterial, Session->master_key, Session->master_key_length); SSL_SESSION_get_master_key (Session, KeyMaterial, SSL3_MASTER_SECRET_SIZE);
return EFI_SUCCESS; return EFI_SUCCESS;
} }

49
CryptoPkg/Library/TlsLib/TlsInit.c
View File

@ -1,7 +1,7 @@
/** @file /** @file
SSL/TLS Initialization Library Wrapper Implementation over OpenSSL. SSL/TLS Initialization Library Wrapper Implementation over OpenSSL.
Copyright (c) 2016, Intel Corporation. All rights reserved.<BR> Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR>
(C) Copyright 2016 Hewlett Packard Enterprise Development LP<BR> (C) Copyright 2016 Hewlett Packard Enterprise Development LP<BR>
This program and the accompanying materials This program and the accompanying materials
are licensed and made available under the terms and conditions of the BSD License are licensed and made available under the terms and conditions of the BSD License
@ -33,14 +33,10 @@ TlsInitialize (
// Performs initialization of crypto and ssl library, and loads required // Performs initialization of crypto and ssl library, and loads required
// algorithms. // algorithms.
// //
SSL_library_init (); OPENSSL_init_ssl (
OPENSSL_INIT_LOAD_SSL_STRINGS | OPENSSL_INIT_LOAD_CRYPTO_STRINGS,
// NULL
// Loads error strings from both crypto and ssl library. );
//
SSL_load_error_strings ();
/// OpenSSL_add_all_algorithms();
// //
// Initialize the pseudorandom number generator. // Initialize the pseudorandom number generator.
@ -103,34 +99,10 @@ TlsCtxNew (
SSL_CTX_set_options (TlsCtx, SSL_OP_NO_SSLv3); SSL_CTX_set_options (TlsCtx, SSL_OP_NO_SSLv3);
// //
// Treat as minimum accepted versions. Client can use higher // Treat as minimum accepted versions by setting the minimal bound.
// TLS version if server supports it // Client can use higher TLS version if server supports it
// //
switch (ProtoVersion) { SSL_CTX_set_min_proto_version (TlsCtx, ProtoVersion);
case TLS1_VERSION:
//
// TLS 1.0
//
break;
case TLS1_1_VERSION:
//
// TLS 1.1
//
SSL_CTX_set_options (TlsCtx, SSL_OP_NO_TLSv1);
break;
case TLS1_2_VERSION:
//
// TLS 1.2
//
SSL_CTX_set_options (TlsCtx, SSL_OP_NO_TLSv1);
SSL_CTX_set_options (TlsCtx, SSL_OP_NO_TLSv1_1);
break;
default:
//
// Unsupported TLS/SSL Protocol Version.
//
break;
}
return (VOID *) TlsCtx; return (VOID *) TlsCtx;
} }
@ -219,6 +191,11 @@ TlsNew (
return NULL; return NULL;
} }
//
// This retains compatibility with previous version of OpenSSL.
//
SSL_set_security_level (TlsConn->Ssl, 0);
// //
// Initialize the created SSL Object // Initialize the created SSL Object
// //