2 SSL/TLS Initialization Library Wrapper Implementation over OpenSSL.
4 Copyright (c) 2016, Intel Corporation. All rights reserved.<BR>
5 (C) Copyright 2016 Hewlett Packard Enterprise Development LP<BR>
6 This program and the accompanying materials
7 are licensed and made available under the terms and conditions of the BSD License
8 which accompanies this distribution. The full text of the license may be found at
9 http://opensource.org/licenses/bsd-license.php
11 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
12 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
16 #include "InternalTlsLib.h"
19 Initializes the OpenSSL library.
21 This function registers ciphers and digests used directly and indirectly
22 by SSL/TLS, and initializes the readable error messages.
23 This function must be called before any other action takes places.
33 // Performs initialization of crypto and ssl library, and loads required
39 // Loads error strings from both crypto and ssl library.
41 SSL_load_error_strings ();
43 /// OpenSSL_add_all_algorithms();
46 // Initialize the pseudorandom number generator.
52 Free an allocated SSL_CTX object.
54 @param[in] TlsCtx Pointer to the SSL_CTX object to be released.
68 SSL_CTX_free ((SSL_CTX
*) (TlsCtx
));
73 Creates a new SSL_CTX object as framework to establish TLS/SSL enabled
76 @param[in] MajorVer Major Version of TLS/SSL Protocol.
77 @param[in] MinorVer Minor Version of TLS/SSL Protocol.
79 @return Pointer to an allocated SSL_CTX object.
80 If the creation failed, TlsCtxNew() returns NULL.
93 ProtoVersion
= (MajorVer
<< 8) | MinorVer
;
95 TlsCtx
= SSL_CTX_new (SSLv23_client_method ());
101 // Ensure SSLv3 is disabled
103 SSL_CTX_set_options (TlsCtx
, SSL_OP_NO_SSLv3
);
106 // Treat as minimum accepted versions. Client can use higher
107 // TLS version if server supports it
109 switch (ProtoVersion
) {
119 SSL_CTX_set_options (TlsCtx
, SSL_OP_NO_TLSv1
);
125 SSL_CTX_set_options (TlsCtx
, SSL_OP_NO_TLSv1
);
126 SSL_CTX_set_options (TlsCtx
, SSL_OP_NO_TLSv1_1
);
130 // Unsupported TLS/SSL Protocol Version.
135 return (VOID
*) TlsCtx
;
139 Free an allocated TLS object.
141 This function removes the TLS object pointed to by Tls and frees up the
142 allocated memory. If Tls is NULL, nothing is done.
144 @param[in] Tls Pointer to the TLS object to be freed.
153 TLS_CONNECTION
*TlsConn
;
155 TlsConn
= (TLS_CONNECTION
*) Tls
;
156 if (TlsConn
== NULL
) {
161 // Free the internal TLS and BIO objects.
163 if (TlsConn
->Ssl
!= NULL
) {
164 SSL_free (TlsConn
->Ssl
);
167 if (TlsConn
->InBio
!= NULL
) {
168 BIO_free (TlsConn
->InBio
);
171 if (TlsConn
->OutBio
!= NULL
) {
172 BIO_free (TlsConn
->OutBio
);
179 Create a new TLS object for a connection.
181 This function creates a new TLS object for a connection. The new object
182 inherits the setting of the underlying context TlsCtx: connection method,
183 options, verification setting.
185 @param[in] TlsCtx Pointer to the SSL_CTX object.
187 @return Pointer to an allocated SSL object.
188 If the creation failed, TlsNew() returns NULL.
197 TLS_CONNECTION
*TlsConn
;
199 X509_STORE
*X509Store
;
204 // Allocate one new TLS_CONNECTION object
206 TlsConn
= (TLS_CONNECTION
*) OPENSSL_malloc (sizeof (TLS_CONNECTION
));
207 if (TlsConn
== NULL
) {
214 // Create a new SSL Object
216 TlsConn
->Ssl
= SSL_new ((SSL_CTX
*) TlsCtx
);
217 if (TlsConn
->Ssl
== NULL
) {
218 TlsFree ((VOID
*) TlsConn
);
223 // Initialize the created SSL Object
225 SSL_set_info_callback (TlsConn
->Ssl
, NULL
);
227 TlsConn
->InBio
= NULL
;
230 // Set up Reading BIO for TLS connection
232 TlsConn
->InBio
= BIO_new (BIO_s_mem ());
233 if (TlsConn
->InBio
== NULL
) {
234 TlsFree ((VOID
*) TlsConn
);
239 // Sets the behaviour of memory BIO when it is empty. It will set the
242 BIO_set_mem_eof_return (TlsConn
->InBio
, -1);
244 TlsConn
->OutBio
= NULL
;
247 // Set up Writing BIO for TLS connection
249 TlsConn
->OutBio
= BIO_new (BIO_s_mem ());
250 if (TlsConn
->OutBio
== NULL
) {
251 TlsFree ((VOID
*) TlsConn
);
256 // Sets the behaviour of memory BIO when it is empty. It will set the
259 BIO_set_mem_eof_return (TlsConn
->OutBio
, -1);
261 ASSERT (TlsConn
->Ssl
!= NULL
&& TlsConn
->InBio
!= NULL
&& TlsConn
->OutBio
!= NULL
);
264 // Connects the InBio and OutBio for the read and write operations.
266 SSL_set_bio (TlsConn
->Ssl
, TlsConn
->InBio
, TlsConn
->OutBio
);
269 // Create new X509 store if needed
271 SslCtx
= SSL_get_SSL_CTX (TlsConn
->Ssl
);
272 X509Store
= SSL_CTX_get_cert_store (SslCtx
);
273 if (X509Store
== NULL
) {
274 X509Store
= X509_STORE_new ();
275 if (X509Store
== NULL
) {
276 TlsFree ((VOID
*) TlsConn
);
279 SSL_CTX_set1_verify_cert_store (SslCtx
, X509Store
);
280 X509_STORE_free (X509Store
);
284 // Set X509_STORE flags used in certificate validation
286 X509_STORE_set_flags (
288 X509_V_FLAG_PARTIAL_CHAIN
| X509_V_FLAG_NO_CHECK_TIME
290 return (VOID
*) TlsConn
;