2 SSL/TLS Initialization Library Wrapper Implementation over OpenSSL.
4 Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR>
5 (C) Copyright 2016 Hewlett Packard Enterprise Development LP<BR>
6 This program and the accompanying materials
7 are licensed and made available under the terms and conditions of the BSD License
8 which accompanies this distribution. The full text of the license may be found at
9 http://opensource.org/licenses/bsd-license.php
11 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
12 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
16 #include "InternalTlsLib.h"
19 Initializes the OpenSSL library.
21 This function registers ciphers and digests used directly and indirectly
22 by SSL/TLS, and initializes the readable error messages.
23 This function must be called before any other action takes places.
33 // Performs initialization of crypto and ssl library, and loads required
37 OPENSSL_INIT_LOAD_SSL_STRINGS
| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
,
42 // Initialize the pseudorandom number generator.
48 Free an allocated SSL_CTX object.
50 @param[in] TlsCtx Pointer to the SSL_CTX object to be released.
64 SSL_CTX_free ((SSL_CTX
*) (TlsCtx
));
69 Creates a new SSL_CTX object as framework to establish TLS/SSL enabled
72 @param[in] MajorVer Major Version of TLS/SSL Protocol.
73 @param[in] MinorVer Minor Version of TLS/SSL Protocol.
75 @return Pointer to an allocated SSL_CTX object.
76 If the creation failed, TlsCtxNew() returns NULL.
89 ProtoVersion
= (MajorVer
<< 8) | MinorVer
;
91 TlsCtx
= SSL_CTX_new (SSLv23_client_method ());
97 // Ensure SSLv3 is disabled
99 SSL_CTX_set_options (TlsCtx
, SSL_OP_NO_SSLv3
);
102 // Treat as minimum accepted versions by setting the minimal bound.
103 // Client can use higher TLS version if server supports it
105 SSL_CTX_set_min_proto_version (TlsCtx
, ProtoVersion
);
107 return (VOID
*) TlsCtx
;
111 Free an allocated TLS object.
113 This function removes the TLS object pointed to by Tls and frees up the
114 allocated memory. If Tls is NULL, nothing is done.
116 @param[in] Tls Pointer to the TLS object to be freed.
125 TLS_CONNECTION
*TlsConn
;
127 TlsConn
= (TLS_CONNECTION
*) Tls
;
128 if (TlsConn
== NULL
) {
133 // Free the internal TLS and BIO objects.
135 if (TlsConn
->Ssl
!= NULL
) {
136 SSL_free (TlsConn
->Ssl
);
139 if (TlsConn
->InBio
!= NULL
) {
140 BIO_free (TlsConn
->InBio
);
143 if (TlsConn
->OutBio
!= NULL
) {
144 BIO_free (TlsConn
->OutBio
);
151 Create a new TLS object for a connection.
153 This function creates a new TLS object for a connection. The new object
154 inherits the setting of the underlying context TlsCtx: connection method,
155 options, verification setting.
157 @param[in] TlsCtx Pointer to the SSL_CTX object.
159 @return Pointer to an allocated SSL object.
160 If the creation failed, TlsNew() returns NULL.
169 TLS_CONNECTION
*TlsConn
;
171 X509_STORE
*X509Store
;
176 // Allocate one new TLS_CONNECTION object
178 TlsConn
= (TLS_CONNECTION
*) OPENSSL_malloc (sizeof (TLS_CONNECTION
));
179 if (TlsConn
== NULL
) {
186 // Create a new SSL Object
188 TlsConn
->Ssl
= SSL_new ((SSL_CTX
*) TlsCtx
);
189 if (TlsConn
->Ssl
== NULL
) {
190 TlsFree ((VOID
*) TlsConn
);
195 // This retains compatibility with previous version of OpenSSL.
197 SSL_set_security_level (TlsConn
->Ssl
, 0);
200 // Initialize the created SSL Object
202 SSL_set_info_callback (TlsConn
->Ssl
, NULL
);
204 TlsConn
->InBio
= NULL
;
207 // Set up Reading BIO for TLS connection
209 TlsConn
->InBio
= BIO_new (BIO_s_mem ());
210 if (TlsConn
->InBio
== NULL
) {
211 TlsFree ((VOID
*) TlsConn
);
216 // Sets the behaviour of memory BIO when it is empty. It will set the
219 BIO_set_mem_eof_return (TlsConn
->InBio
, -1);
221 TlsConn
->OutBio
= NULL
;
224 // Set up Writing BIO for TLS connection
226 TlsConn
->OutBio
= BIO_new (BIO_s_mem ());
227 if (TlsConn
->OutBio
== NULL
) {
228 TlsFree ((VOID
*) TlsConn
);
233 // Sets the behaviour of memory BIO when it is empty. It will set the
236 BIO_set_mem_eof_return (TlsConn
->OutBio
, -1);
238 ASSERT (TlsConn
->Ssl
!= NULL
&& TlsConn
->InBio
!= NULL
&& TlsConn
->OutBio
!= NULL
);
241 // Connects the InBio and OutBio for the read and write operations.
243 SSL_set_bio (TlsConn
->Ssl
, TlsConn
->InBio
, TlsConn
->OutBio
);
246 // Create new X509 store if needed
248 SslCtx
= SSL_get_SSL_CTX (TlsConn
->Ssl
);
249 X509Store
= SSL_CTX_get_cert_store (SslCtx
);
250 if (X509Store
== NULL
) {
251 X509Store
= X509_STORE_new ();
252 if (X509Store
== NULL
) {
253 TlsFree ((VOID
*) TlsConn
);
256 SSL_CTX_set1_verify_cert_store (SslCtx
, X509Store
);
257 X509_STORE_free (X509Store
);
261 // Set X509_STORE flags used in certificate validation
263 X509_STORE_set_flags (
265 X509_V_FLAG_PARTIAL_CHAIN
| X509_V_FLAG_NO_CHECK_TIME
267 return (VOID
*) TlsConn
;