2 SSL/TLS Initialization Library Wrapper Implementation over OpenSSL.
4 Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR>
5 (C) Copyright 2016 Hewlett Packard Enterprise Development LP<BR>
6 SPDX-License-Identifier: BSD-2-Clause-Patent
10 #include "InternalTlsLib.h"
13 Initializes the OpenSSL library.
15 This function registers ciphers and digests used directly and indirectly
16 by SSL/TLS, and initializes the readable error messages.
17 This function must be called before any other action takes places.
19 @retval TRUE The OpenSSL library has been initialized.
20 @retval FALSE Failed to initialize the OpenSSL library.
32 // Performs initialization of crypto and ssl library, and loads required
35 Ret
= OPENSSL_init_ssl (
36 OPENSSL_INIT_LOAD_SSL_STRINGS
| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
,
44 // Initialize the pseudorandom number generator.
46 return RandomSeed (NULL
, 0);
50 Free an allocated SSL_CTX object.
52 @param[in] TlsCtx Pointer to the SSL_CTX object to be released.
66 SSL_CTX_free ((SSL_CTX
*)(TlsCtx
));
71 Creates a new SSL_CTX object as framework to establish TLS/SSL enabled
74 @param[in] MajorVer Major Version of TLS/SSL Protocol.
75 @param[in] MinorVer Minor Version of TLS/SSL Protocol.
77 @return Pointer to an allocated SSL_CTX object.
78 If the creation failed, TlsCtxNew() returns NULL.
91 ProtoVersion
= (MajorVer
<< 8) | MinorVer
;
93 TlsCtx
= SSL_CTX_new (SSLv23_client_method ());
99 // Ensure SSLv3 is disabled
101 SSL_CTX_set_options (TlsCtx
, SSL_OP_NO_SSLv3
);
104 // Treat as minimum accepted versions by setting the minimal bound.
105 // Client can use higher TLS version if server supports it
107 SSL_CTX_set_min_proto_version (TlsCtx
, ProtoVersion
);
109 return (VOID
*)TlsCtx
;
113 Free an allocated TLS object.
115 This function removes the TLS object pointed to by Tls and frees up the
116 allocated memory. If Tls is NULL, nothing is done.
118 @param[in] Tls Pointer to the TLS object to be freed.
127 TLS_CONNECTION
*TlsConn
;
129 TlsConn
= (TLS_CONNECTION
*)Tls
;
130 if (TlsConn
== NULL
) {
135 // Free the internal TLS and related BIO objects.
137 if (TlsConn
->Ssl
!= NULL
) {
138 SSL_free (TlsConn
->Ssl
);
145 Create a new TLS object for a connection.
147 This function creates a new TLS object for a connection. The new object
148 inherits the setting of the underlying context TlsCtx: connection method,
149 options, verification setting.
151 @param[in] TlsCtx Pointer to the SSL_CTX object.
153 @return Pointer to an allocated SSL object.
154 If the creation failed, TlsNew() returns NULL.
163 TLS_CONNECTION
*TlsConn
;
165 X509_STORE
*X509Store
;
170 // Allocate one new TLS_CONNECTION object
172 TlsConn
= (TLS_CONNECTION
*)OPENSSL_malloc (sizeof (TLS_CONNECTION
));
173 if (TlsConn
== NULL
) {
180 // Create a new SSL Object
182 TlsConn
->Ssl
= SSL_new ((SSL_CTX
*)TlsCtx
);
183 if (TlsConn
->Ssl
== NULL
) {
184 TlsFree ((VOID
*)TlsConn
);
189 // This retains compatibility with previous version of OpenSSL.
191 SSL_set_security_level (TlsConn
->Ssl
, 0);
194 // Initialize the created SSL Object
196 SSL_set_info_callback (TlsConn
->Ssl
, NULL
);
198 TlsConn
->InBio
= NULL
;
201 // Set up Reading BIO for TLS connection
203 TlsConn
->InBio
= BIO_new (BIO_s_mem ());
204 if (TlsConn
->InBio
== NULL
) {
205 TlsFree ((VOID
*)TlsConn
);
210 // Sets the behaviour of memory BIO when it is empty. It will set the
213 BIO_set_mem_eof_return (TlsConn
->InBio
, -1);
215 TlsConn
->OutBio
= NULL
;
218 // Set up Writing BIO for TLS connection
220 TlsConn
->OutBio
= BIO_new (BIO_s_mem ());
221 if (TlsConn
->OutBio
== NULL
) {
222 TlsFree ((VOID
*)TlsConn
);
227 // Sets the behaviour of memory BIO when it is empty. It will set the
230 BIO_set_mem_eof_return (TlsConn
->OutBio
, -1);
232 ASSERT (TlsConn
->Ssl
!= NULL
&& TlsConn
->InBio
!= NULL
&& TlsConn
->OutBio
!= NULL
);
235 // Connects the InBio and OutBio for the read and write operations.
237 SSL_set_bio (TlsConn
->Ssl
, TlsConn
->InBio
, TlsConn
->OutBio
);
240 // Create new X509 store if needed
242 SslCtx
= SSL_get_SSL_CTX (TlsConn
->Ssl
);
243 X509Store
= SSL_CTX_get_cert_store (SslCtx
);
244 if (X509Store
== NULL
) {
245 X509Store
= X509_STORE_new ();
246 if (X509Store
== NULL
) {
247 TlsFree ((VOID
*)TlsConn
);
251 SSL_CTX_set1_verify_cert_store (SslCtx
, X509Store
);
252 X509_STORE_free (X509Store
);
256 // Set X509_STORE flags used in certificate validation
258 X509_STORE_set_flags (
260 X509_V_FLAG_PARTIAL_CHAIN
| X509_V_FLAG_NO_CHECK_TIME
262 return (VOID
*)TlsConn
;