From fb11284c77dc0eb544dc6e9bae7ca6c85bdc86ff Mon Sep 17 00:00:00 2001 From: Paul Bartell Date: Tue, 18 Oct 2022 18:04:42 -0700 Subject: [PATCH] Update mbedtls transport implementations for mbedtls v3.2.1 --- .../using_mbedtls/using_mbedtls.c | 61 +++++++++++-------- .../using_mbedtls_pkcs11.c | 44 +++---------- 2 files changed, 44 insertions(+), 61 deletions(-) diff --git a/FreeRTOS-Plus/Source/Application-Protocols/network_transport/using_mbedtls/using_mbedtls.c b/FreeRTOS-Plus/Source/Application-Protocols/network_transport/using_mbedtls/using_mbedtls.c index e4b6d342d4..141b7194fe 100644 --- a/FreeRTOS-Plus/Source/Application-Protocols/network_transport/using_mbedtls/using_mbedtls.c +++ b/FreeRTOS-Plus/Source/Application-Protocols/network_transport/using_mbedtls/using_mbedtls.c @@ -30,12 +30,23 @@ * mbedTLS. */ + #include "logging_levels.h" + +#define LIBRARY_LOG_NAME "MbedtlsTransport" +#define LIBRARY_LOG_LEVEL LOG_INFO + +#include "logging_stack.h" + /* Standard includes. */ #include /* FreeRTOS includes. */ #include "FreeRTOS.h" +/* FreeRTOS+TCP includes. */ +#include "FreeRTOS_IP.h" +#include "FreeRTOS_Sockets.h" + /* TLS transport header. */ #include "using_mbedtls.h" @@ -303,12 +314,19 @@ static int32_t setPrivateKey( SSLContext_t * pSslContext, configASSERT( pSslContext != NULL ); configASSERT( pPrivateKey != NULL ); - /* Setup the client private key. */ - mbedtlsError = mbedtls_pk_parse_key( &( pSslContext->privKey ), - pPrivateKey, - privateKeySize, - NULL, - 0 ); + #if MBEDTLS_VERSION_NUMBER < 0x03000000 + mbedtlsError = mbedtls_pk_parse_key( &( pSslContext->privKey ), + pPrivateKey, + privateKeySize, + NULL, 0 ); + #else + mbedtlsError = mbedtls_pk_parse_key( &( pSslContext->privKey ), + pPrivateKey, + privateKeySize, + NULL, 0, + mbedtls_ctr_drbg_random, + &( pSslContext->ctrDrgbContext ) ); + #endif if( mbedtlsError != 0 ) { @@ -527,8 +545,8 @@ static TlsTransportStatus_t tlsHandshake( NetworkContext_t * pNetworkContext, */ mbedtls_ssl_set_bio( &( pTlsTransportParams->sslContext.context ), ( void * ) pTlsTransportParams->tcpSocket, - MBEDTLS_SSL_SEND, - MBEDTLS_SSL_RECV, + mbedtls_platform_send, + mbedtls_platform_recv, NULL ); } @@ -566,23 +584,15 @@ static TlsTransportStatus_t initMbedtls( mbedtls_entropy_context * pEntropyConte TlsTransportStatus_t returnStatus = TLS_TRANSPORT_SUCCESS; int32_t mbedtlsError = 0; - /* Set the mutex functions for mbed TLS thread safety. */ - mbedtls_threading_set_alt( mbedtls_platform_mutex_init, - mbedtls_platform_mutex_free, - mbedtls_platform_mutex_lock, - mbedtls_platform_mutex_unlock ); + #if defined( MBEDTLS_THREADING_ALT ) + /* Set the mutex functions for mbed TLS thread safety. */ + mbedtls_platform_threading_init(); + #endif /* Initialize contexts for random number generation. */ mbedtls_entropy_init( pEntropyContext ); mbedtls_ctr_drbg_init( pCtrDrgbContext ); - /* Add a strong entropy source. At least one is required. */ - mbedtlsError = mbedtls_entropy_add_source( pEntropyContext, - mbedtls_platform_entropy_poll, - NULL, - 32, - MBEDTLS_ENTROPY_SOURCE_STRONG ); - if( mbedtlsError != 0 ) { LogError( ( "Failed to add entropy source: mbedTLSError= %s : %s.", @@ -696,9 +706,9 @@ TlsTransportStatus_t TLS_FreeRTOS_Connect( NetworkContext_t * pNetworkContext, { sslContextFree( &( pTlsTransportParams->sslContext ) ); - if( pTlsTransportParams->tcpSocket != SOCKETS_INVALID_SOCKET ) + if( pTlsTransportParams->tcpSocket != FREERTOS_INVALID_SOCKET ) { - ( void ) Sockets_Disconnect( pTlsTransportParams->tcpSocket ); + ( void ) FreeRTOS_closesocket( pTlsTransportParams->tcpSocket ); } } } @@ -744,8 +754,8 @@ void TLS_FreeRTOS_Disconnect( NetworkContext_t * pNetworkContext ) else { /* WANT_READ and WANT_WRITE can be ignored. Logging for debugging purposes. */ - LogInfo( ( "(Network connection %p) TLS close-notify sent; ", - "received %s as the TLS status can be ignored for close-notify." + LogInfo( ( "(Network connection %p) TLS close-notify sent; " + "received %s as the TLS status can be ignored for close-notify.", ( tlsStatus == MBEDTLS_ERR_SSL_WANT_READ ) ? "WANT_READ" : "WANT_WRITE", pNetworkContext ) ); } @@ -756,9 +766,6 @@ void TLS_FreeRTOS_Disconnect( NetworkContext_t * pNetworkContext ) /* Free mbed TLS contexts. */ sslContextFree( &( pTlsTransportParams->sslContext ) ); } - - /* Clear the mutex functions for mbed TLS thread safety. */ - mbedtls_threading_free_alt(); } /*-----------------------------------------------------------*/ diff --git a/FreeRTOS-Plus/Source/Application-Protocols/network_transport/using_mbedtls_pkcs11/using_mbedtls_pkcs11.c b/FreeRTOS-Plus/Source/Application-Protocols/network_transport/using_mbedtls_pkcs11/using_mbedtls_pkcs11.c index 4aeb16d8f7..6bd709d68f 100644 --- a/FreeRTOS-Plus/Source/Application-Protocols/network_transport/using_mbedtls_pkcs11/using_mbedtls_pkcs11.c +++ b/FreeRTOS-Plus/Source/Application-Protocols/network_transport/using_mbedtls_pkcs11/using_mbedtls_pkcs11.c @@ -39,6 +39,10 @@ /* FreeRTOS includes. */ #include "FreeRTOS.h" +/* FreeRTOS+TCP includes. */ +#include "FreeRTOS_IP.h" +#include "FreeRTOS_Sockets.h" + /* TLS transport header. */ #include "using_mbedtls_pkcs11.h" @@ -526,25 +530,12 @@ static CK_RV readCertificateIntoContext( SSLContext_t * pSslContext, CK_RV xResult = CKR_OK; CK_ATTRIBUTE xTemplate = { 0 }; CK_OBJECT_HANDLE xCertObj = 0; - size_t labelLength; - char * pcNullTerminator = NULL; - - /* Check for NULL character within pkcs11configMAX_LABEL_LENGTH. */ - pcNullTerminator = memchr( pcLabelName, '\0', pkcs11configMAX_LABEL_LENGTH ); - if( NULL != pcNullTerminator ) - { - labelLength = ( size_t )( pcNullTerminator - pcLabelName ); - } - else - { - /* If NULL character not found set length to pkcs11configMAX_LABEL_LENGTH. */ - labelLength = pkcs11configMAX_LABEL_LENGTH; - } /* Get the handle of the certificate. */ xResult = xFindObjectWithLabelAndClass( pSslContext->xP11Session, pcLabelName, - labelLength, + strnlen( pcLabelName, + pkcs11configMAX_LABEL_LENGTH ), xClass, &xCertObj ); @@ -657,25 +648,11 @@ static CK_RV initializeClientKeys( SSLContext_t * pxCtx, if( CKR_OK == xResult ) { - size_t labelLength; - char * pcNullTerminator = NULL; - - /* Check for NULL character within pkcs11configMAX_LABEL_LENGTH. */ - pcNullTerminator = memchr( pcLabelName, '\0', pkcs11configMAX_LABEL_LENGTH ); - if( NULL != pcNullTerminator ) - { - labelLength = ( size_t )( pcNullTerminator - pcLabelName ); - } - else - { - /* If NULL character not found set length to pkcs11configMAX_LABEL_LENGTH. */ - labelLength = pkcs11configMAX_LABEL_LENGTH; - } - /* Get the handle of the device private key. */ xResult = xFindObjectWithLabelAndClass( pxCtx->xP11Session, pcLabelName, - labelLength, + strnlen( pcLabelName, + pkcs11configMAX_LABEL_LENGTH ), CKO_PRIVATE_KEY, &pxCtx->xP11PrivateKey ); } @@ -924,10 +901,9 @@ TlsTransportStatus_t TLS_FreeRTOS_Connect( NetworkContext_t * pNetworkContext, if( returnStatus != TLS_TRANSPORT_SUCCESS ) { if( ( pNetworkContext != NULL ) && - ( pTlsTransportParams != NULL ) && - ( pTlsTransportParams->tcpSocket != SOCKETS_INVALID_SOCKET ) ) + ( pTlsTransportParams->tcpSocket != FREERTOS_INVALID_SOCKET ) ) { - ( void ) Sockets_Disconnect( pTlsTransportParams->tcpSocket ); + ( void ) FreeRTOS_closesocket( pTlsTransportParams->tcpSocket ); } } else