ARMmbed
/
mbed-os
mirror of https://github.com/ARMmbed/mbed-os.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Squashed 'features/nanostack/coap-service/' changes from e5e0c138e6..5aa54b8e62 

5aa54b8e62 Merge pull request #127 from ARMmbed/sync_with_mbedos
6fe78412d2 Follow Mbed OS coding style
2b708be451 trace group defiined for shared_rng
d4c2caca41 more error handling added for ctr and hmac
cace1e9c22 Added missing optimizations based on mbedtls/baremetal.h config
2cc7442ba5 Added new global rng, needed for MbedTLS optimisations
f861157576 Prepare for upcoming MbedTLS changes

git-subtree-dir: features/nanostack/coap-service
git-subtree-split: 5aa54b8e622ec2b44bdf323cc02bd1cfc5ffd904
pull/12754/head
Arto Kinnunen 2020-04-03 14:51:33 +03:00
parent 861558f452
commit 9cb63ab0e4
3 changed files with 93 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

65
source/coap_security_handler.c
View File

@ -30,6 +30,7 @@
#include "mbedtls/entropy.h"
#include "mbedtls/entropy_poll.h"
#include "mbedtls/ctr_drbg.h"
#include "mbedtls/hmac_drbg.h"
#include "mbedtls/ssl_ciphersuites.h"
#include "ns_trace.h"
@ -41,7 +42,20 @@ struct coap_security_s {
mbedtls_ssl_config _conf;
mbedtls_ssl_context _ssl;
mbedtls_ctr_drbg_context _ctr_drbg;
#if defined(MBEDTLS_CTR_DRBG_C)
mbedtls_ctr_drbg_context _drbg;
#define DRBG_INIT mbedtls_ctr_drbg_init
#define DRBG_RANDOM mbedtls_ctr_drbg_random
#define DRBG_FREE mbedtls_ctr_drbg_free
#elif defined(MBEDTLS_HMAC_DRBG_C)
mbedtls_hmac_drbg_context _drbg;
#define DRBG_INIT mbedtls_hmac_drbg_init
#define DRBG_RANDOM mbedtls_hmac_drbg_random
#define DRBG_FREE mbedtls_hmac_drbg_free
#else
#error "CTR or HMAC must be defined for coap_security_handler!"
#endif
mbedtls_entropy_context _entropy;
bool _is_started;
simple_cookie_t _cookie;
@ -68,6 +82,7 @@ struct coap_security_s {
};
#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
const int ECJPAKE_SUITES[] = {
MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8,
@ -75,12 +90,15 @@ const int ECJPAKE_SUITES[] = {
};
#endif
#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
static const int PSK_SUITES[] = {
MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256,
MBEDTLS_TLS_PSK_WITH_AES_256_CCM_8,
MBEDTLS_TLS_PSK_WITH_AES_128_CCM_8,
0
};
#endif /* defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) */
#endif /* !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE) */
#define TRACE_GROUP "CsSh"
@ -110,7 +128,7 @@ static int coap_security_handler_init(coap_security_t *sec)
mbedtls_ssl_init(&sec->_ssl);
mbedtls_ssl_config_init(&sec->_conf);
mbedtls_ctr_drbg_init(&sec->_ctr_drbg);
DRBG_INIT(&sec->_drbg);
mbedtls_entropy_init(&sec->_entropy);
#if defined(MBEDTLS_X509_CRT_PARSE_C)
@ -128,12 +146,22 @@ static int coap_security_handler_init(coap_security_t *sec)
128, entropy_source_type) < 0) {
return -1;
}
if ((mbedtls_ctr_drbg_seed(&sec->_ctr_drbg, mbedtls_entropy_func, &sec->_entropy,
#if defined(MBEDTLS_CTR_DRBG_C)
if ((mbedtls_ctr_drbg_seed(&sec->_drbg, mbedtls_entropy_func, &sec->_entropy,
(const unsigned char *) pers,
strlen(pers))) != 0) {
return -1;
}
#elif defined(MBEDTLS_HMAC_DRBG_C)
if ((mbedtls_hmac_drbg_seed(&sec->_drbg, mbedtls_md_info_from_type(MBEDTLS_MD_SHA256),
mbedtls_entropy_func, &sec->_entropy,
(const unsigned char *) pers,
strlen(pers))) != 0) {
return -1;
}
#else
#error "CTR or HMAC must be defined for coap_security_handler!"
#endif
return 0;
}
@ -156,7 +184,9 @@ static void coap_security_handler_reset(coap_security_t *sec)
#endif
mbedtls_entropy_free(&sec->_entropy);
mbedtls_ctr_drbg_free(&sec->_ctr_drbg);
DRBG_FREE(&sec->_drbg);
mbedtls_ssl_config_free(&sec->_conf);
mbedtls_ssl_free(&sec->_ssl);
#if defined(MBEDTLS_PLATFORM_C)
@ -332,7 +362,9 @@ static int coap_security_handler_configure_keys(coap_security_t *sec, coap_secur
if (0 != mbedtls_ssl_conf_psk(&sec->_conf, keys._priv_key, keys._priv_key_len, keys._cert, keys._cert_len)) {
break;
}
#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
mbedtls_ssl_conf_ciphersuites(&sec->_conf, PSK_SUITES);
#endif /* !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE) */
ret = 0;
#endif
break;
@ -342,7 +374,9 @@ static int coap_security_handler_configure_keys(coap_security_t *sec, coap_secur
if (mbedtls_ssl_set_hs_ecjpake_password(&sec->_ssl, keys._key, keys._key_len) != 0) {
return -1;
}
#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
mbedtls_ssl_conf_ciphersuites(&sec->_conf, ECJPAKE_SUITES);
#endif /* !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE) */
//NOTE: If thread starts supporting PSK in other modes, then this will be needed!
mbedtls_ssl_conf_export_keys_cb(&sec->_conf,
@ -388,17 +422,31 @@ int coap_security_handler_connect_non_blocking(coap_security_t *sec, bool is_ser
mbedtls_ssl_conf_handshake_timeout(&sec->_conf, timeout_min, timeout_max);
}
mbedtls_ssl_conf_rng(&sec->_conf, mbedtls_ctr_drbg_random, &sec->_ctr_drbg);
#if !defined(MBEDTLS_SSL_CONF_RNG)
mbedtls_ssl_conf_rng(&sec->_conf, DRBG_RANDOM, &sec->_drbg);
#endif
if ((mbedtls_ssl_setup(&sec->_ssl, &sec->_conf)) != 0) {
return -1;
}
// Defines MBEDTLS_SSL_CONF_RECV/SEND/RECV_TIMEOUT define global functions which should be the same for all
// callers of mbedtls_ssl_set_bio_ctx and there should be only one ssl context. If these rules don't apply,
// these defines can't be used.
#if !defined(MBEDTLS_SSL_CONF_RECV) && !defined(MBEDTLS_SSL_CONF_SEND) && !defined(MBEDTLS_SSL_CONF_RECV_TIMEOUT)
mbedtls_ssl_set_bio(&sec->_ssl, sec,
f_send, f_recv, NULL);
#else
mbedtls_ssl_set_bio_ctx(&sec->_ssl, sec);
#endif /* !defined(MBEDTLS_SSL_CONF_RECV) && !defined(MBEDTLS_SSL_CONF_SEND) && !defined(MBEDTLS_SSL_CONF_RECV_TIMEOUT) */
// Defines MBEDTLS_SSL_CONF_SET_TIMER/GET_TIMER define global functions which should be the same for all
// callers of mbedtls_ssl_set_timer_cb and there should be only one ssl context. If these rules don't apply,
// these defines can't be used.
#if !defined(MBEDTLS_SSL_CONF_SET_TIMER) && !defined(MBEDTLS_SSL_CONF_GET_TIMER)
mbedtls_ssl_set_timer_cb(&sec->_ssl, sec, set_timer,
get_timer);
#endif /* !defined(MBEDTLS_SSL_CONF_SET_TIMER) && !defined(MBEDTLS_SSL_CONF_GET_TIMER) */
#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
//TODO: Figure out better way!!!
@ -420,8 +468,13 @@ int coap_security_handler_connect_non_blocking(coap_security_t *sec, bool is_ser
&sec->_cookie);
#endif
#if !defined(MBEDTLS_SSL_CONF_MIN_MINOR_VER) || !defined(MBEDTLS_SSL_CONF_MIN_MAJOR_VER)
mbedtls_ssl_conf_min_version(&sec->_conf, MBEDTLS_SSL_MAJOR_VERSION_3, MBEDTLS_SSL_MAJOR_VERSION_3);
#endif /* !defined(MBEDTLS_SSL_CONF_MIN_MINOR_VER) || !defined(MBEDTLS_SSL_CONF_MIN_MAJOR_VER) */
#if !defined(MBEDTLS_SSL_CONF_MAX_MINOR_VER) || !defined(MBEDTLS_SSL_CONF_MAX_MAJOR_VER)
mbedtls_ssl_conf_max_version(&sec->_conf, MBEDTLS_SSL_MAJOR_VERSION_3, MBEDTLS_SSL_MAJOR_VERSION_3);
#endif /* !defined(MBEDTLS_SSL_CONF_MAX_MINOR_VER) || !defined(MBEDTLS_SSL_CONF_MAX_MAJOR_VER) */
sec->_is_started = true;

32
test/coap-service/unittest/stub/mbedtls_stub.c
View File

@ -248,6 +248,38 @@ int mbedtls_ctr_drbg_random(void *p_rng,
return mbedtls_stub.crt_expected_int;
}
// from hmac_drbg.h
void mbedtls_hmac_drbg_init(mbedtls_hmac_drbg_context *ctx)
{
}
void mbedtls_hmac_drbg_free(mbedtls_hmac_drbg_context *ctx)
{
}
int mbedtls_hmac_drbg_seed(mbedtls_hmac_drbg_context *ctx,
const mbedtls_md_info_t *md_info,
int (*f_entropy)(void *, unsigned char *, size_t),
void *p_entropy,
const unsigned char *custom,
size_t len)
{
return mbedtls_stub.crt_expected_int;
}
int mbedtls_hmac_drbg_random(void *p_rng, unsigned char *output, size_t out_len)
{
return mbedtls_stub.crt_expected_int;
}
// from md.h
const mbedtls_md_info_t *mbedtls_md_info_from_type(mbedtls_md_type_t md_type)
{
return 0;
}
//From x509_crt.h
void mbedtls_x509_crt_init(mbedtls_x509_crt *a)
{

2
test/coap-service/unittest/stub/mbedtls_stub.h
View File

@ -24,11 +24,13 @@
#include "mbedtls/platform.h"
#include "mbedtls/ssl.h"
#include "mbedtls/ctr_drbg.h"
#include "mbedtls/hmac_drbg.h"
#include "mbedtls/x509_crt.h"
#include "mbedtls/sha256.h"
#include "mbedtls/entropy.h"
#include "mbedtls/pk.h"
#include "mbedtls/platform.h"
#include "mbedtls/md.h"
#define HANDSHAKE_FINISHED_VALUE 8888