CryptoPkg/Library/TlsLib/TlsInit.c

   1 /** @file
   2   SSL/TLS Initialization Library Wrapper Implementation over OpenSSL.
   3
   4 Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR>
   5 (C) Copyright 2016 Hewlett Packard Enterprise Development LP<BR>
   6 This program and the accompanying materials
   7 are licensed and made available under the terms and conditions of the BSD License
   8 which accompanies this distribution.  The full text of the license may be found at
   9 http://opensource.org/licenses/bsd-license.php
  10
  11 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  12 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  13
  14 **/
  15
  16 #include "InternalTlsLib.h"
  17
  18 /**
  19   Initializes the OpenSSL library.
  20
  21   This function registers ciphers and digests used directly and indirectly
  22   by SSL/TLS, and initializes the readable error messages.
  23   This function must be called before any other action takes places.
  24
  25 **/
  26 VOID
  27 EFIAPI
  28 TlsInitialize (
  29   VOID
  30   )
  31 {
  32   //
  33   // Performs initialization of crypto and ssl library, and loads required
  34   // algorithms.
  35   //
  36   OPENSSL_init_ssl (
  37     OPENSSL_INIT_LOAD_SSL_STRINGS | OPENSSL_INIT_LOAD_CRYPTO_STRINGS,
  38     NULL
  39     );
  40
  41   //
  42   // Initialize the pseudorandom number generator.
  43   //
  44   RandomSeed (NULL, 0);
  45 }
  46
  47 /**
  48   Free an allocated SSL_CTX object.
  49
  50   @param[in]  TlsCtx    Pointer to the SSL_CTX object to be released.
  51
  52 **/
  53 VOID
  54 EFIAPI
  55 TlsCtxFree (
  56   IN   VOID                  *TlsCtx
  57   )
  58 {
  59   if (TlsCtx == NULL) {
  60     return;
  61   }
  62
  63   if (TlsCtx != NULL) {
  64     SSL_CTX_free ((SSL_CTX *) (TlsCtx));
  65   }
  66 }
  67
  68 /**
  69   Creates a new SSL_CTX object as framework to establish TLS/SSL enabled
  70   connections.
  71
  72   @param[in]  MajorVer    Major Version of TLS/SSL Protocol.
  73   @param[in]  MinorVer    Minor Version of TLS/SSL Protocol.
  74
  75   @return  Pointer to an allocated SSL_CTX object.
  76            If the creation failed, TlsCtxNew() returns NULL.
  77
  78 **/
  79 VOID *
  80 EFIAPI
  81 TlsCtxNew (
  82   IN     UINT8                    MajorVer,
  83   IN     UINT8                    MinorVer
  84   )
  85 {
  86   SSL_CTX  *TlsCtx;
  87   UINT16   ProtoVersion;
  88
  89   ProtoVersion = (MajorVer << 8) | MinorVer;
  90
  91   TlsCtx = SSL_CTX_new (SSLv23_client_method ());
  92   if (TlsCtx == NULL) {
  93     return NULL;
  94   }
  95
  96   //
  97   // Ensure SSLv3 is disabled
  98   //
  99   SSL_CTX_set_options (TlsCtx, SSL_OP_NO_SSLv3);
 100
 101   //
 102   // Treat as minimum accepted versions by setting the minimal bound.
 103   // Client can use higher TLS version if server supports it
 104   //
 105   SSL_CTX_set_min_proto_version (TlsCtx, ProtoVersion);
 106
 107   return (VOID *) TlsCtx;
 108 }
 109
 110 /**
 111   Free an allocated TLS object.
 112
 113   This function removes the TLS object pointed to by Tls and frees up the
 114   allocated memory. If Tls is NULL, nothing is done.
 115
 116   @param[in]  Tls    Pointer to the TLS object to be freed.
 117
 118 **/
 119 VOID
 120 EFIAPI
 121 TlsFree (
 122   IN     VOID                     *Tls
 123   )
 124 {
 125   TLS_CONNECTION  *TlsConn;
 126
 127   TlsConn = (TLS_CONNECTION *) Tls;
 128   if (TlsConn == NULL) {
 129     return;
 130   }
 131
 132   //
 133   // Free the internal TLS and related BIO objects.
 134   //
 135   if (TlsConn->Ssl != NULL) {
 136     SSL_free (TlsConn->Ssl);
 137   }
 138
 139   OPENSSL_free (Tls);
 140 }
 141
 142 /**
 143   Create a new TLS object for a connection.
 144
 145   This function creates a new TLS object for a connection. The new object
 146   inherits the setting of the underlying context TlsCtx: connection method,
 147   options, verification setting.
 148
 149   @param[in]  TlsCtx    Pointer to the SSL_CTX object.
 150
 151   @return  Pointer to an allocated SSL object.
 152            If the creation failed, TlsNew() returns NULL.
 153
 154 **/
 155 VOID *
 156 EFIAPI
 157 TlsNew (
 158   IN     VOID                     *TlsCtx
 159   )
 160 {
 161   TLS_CONNECTION  *TlsConn;
 162   SSL_CTX         *SslCtx;
 163   X509_STORE      *X509Store;
 164
 165   TlsConn = NULL;
 166
 167   //
 168   // Allocate one new TLS_CONNECTION object
 169   //
 170   TlsConn = (TLS_CONNECTION *) OPENSSL_malloc (sizeof (TLS_CONNECTION));
 171   if (TlsConn == NULL) {
 172     return NULL;
 173   }
 174
 175   TlsConn->Ssl = NULL;
 176
 177   //
 178   // Create a new SSL Object
 179   //
 180   TlsConn->Ssl = SSL_new ((SSL_CTX *) TlsCtx);
 181   if (TlsConn->Ssl == NULL) {
 182     TlsFree ((VOID *) TlsConn);
 183     return NULL;
 184   }
 185
 186   //
 187   // This retains compatibility with previous version of OpenSSL.
 188   //
 189   SSL_set_security_level (TlsConn->Ssl, 0);
 190
 191   //
 192   // Initialize the created SSL Object
 193   //
 194   SSL_set_info_callback (TlsConn->Ssl, NULL);
 195
 196   TlsConn->InBio = NULL;
 197
 198   //
 199   // Set up Reading BIO for TLS connection
 200   //
 201   TlsConn->InBio = BIO_new (BIO_s_mem ());
 202   if (TlsConn->InBio == NULL) {
 203     TlsFree ((VOID *) TlsConn);
 204     return NULL;
 205   }
 206
 207   //
 208   // Sets the behaviour of memory BIO when it is empty. It will set the
 209   // read retry flag.
 210   //
 211   BIO_set_mem_eof_return (TlsConn->InBio, -1);
 212
 213   TlsConn->OutBio = NULL;
 214
 215   //
 216   // Set up Writing BIO for TLS connection
 217   //
 218   TlsConn->OutBio = BIO_new (BIO_s_mem ());
 219   if (TlsConn->OutBio == NULL) {
 220     TlsFree ((VOID *) TlsConn);
 221     return NULL;
 222   }
 223
 224   //
 225   // Sets the behaviour of memory BIO when it is empty. It will set the
 226   // write retry flag.
 227   //
 228   BIO_set_mem_eof_return (TlsConn->OutBio, -1);
 229
 230   ASSERT (TlsConn->Ssl != NULL && TlsConn->InBio != NULL && TlsConn->OutBio != NULL);
 231
 232   //
 233   // Connects the InBio and OutBio for the read and write operations.
 234   //
 235   SSL_set_bio (TlsConn->Ssl, TlsConn->InBio, TlsConn->OutBio);
 236
 237   //
 238   // Create new X509 store if needed
 239   //
 240   SslCtx    = SSL_get_SSL_CTX (TlsConn->Ssl);
 241   X509Store = SSL_CTX_get_cert_store (SslCtx);
 242   if (X509Store == NULL) {
 243     X509Store = X509_STORE_new ();
 244     if (X509Store == NULL) {
 245       TlsFree ((VOID *) TlsConn);
 246       return NULL;
 247     }
 248     SSL_CTX_set1_verify_cert_store (SslCtx, X509Store);
 249     X509_STORE_free (X509Store);
 250   }
 251
 252   //
 253   // Set X509_STORE flags used in certificate validation
 254   //
 255   X509_STORE_set_flags (
 256     X509Store,
 257     X509_V_FLAG_PARTIAL_CHAIN | X509_V_FLAG_NO_CHECK_TIME
 258     );
 259   return (VOID *) TlsConn;
 260 }
 261