From nobody Sat Nov 2 12:19:38 2024 Delivered-To: importer@patchew.org Received-SPF: none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) client-ip=198.145.21.10; envelope-from=edk2-devel-bounces@lists.01.org; helo=ml01.01.org; Authentication-Results: mx.zoho.com; spf=none (zoho.com: 198.145.21.10 is neither permitted nor denied by domain of lists.01.org) smtp.mailfrom=edk2-devel-bounces@lists.01.org; Return-Path: Received: from ml01.01.org (ml01.01.org [198.145.21.10]) by mx.zohomail.com with SMTPS id 149027524280139.71762407067445; Thu, 23 Mar 2017 06:20:42 -0700 (PDT) Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id 342BE80485; Thu, 23 Mar 2017 06:20:19 -0700 (PDT) Received: from mga07.intel.com (mga07.intel.com [134.134.136.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id CE87080497 for ; Thu, 23 Mar 2017 06:20:17 -0700 (PDT) Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by orsmga105.jf.intel.com with ESMTP; 23 Mar 2017 06:20:17 -0700 Received: from shwde6388.ccr.corp.intel.com ([10.239.9.17]) by fmsmga002.fm.intel.com with ESMTP; 23 Mar 2017 06:20:15 -0700 X-Original-To: edk2-devel@lists.01.org X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.36,210,1486454400"; d="scan'208";a="1146042264" From: Qin Long To: edk2-devel@lists.01.org Date: Thu, 23 Mar 2017 21:19:32 +0800 Message-Id: <20170323131932.6168-12-qin.long@intel.com> X-Mailer: git-send-email 2.11.1.windows.1 In-Reply-To: <20170323131932.6168-1-qin.long@intel.com> References: <20170323131932.6168-1-qin.long@intel.com> Subject: [edk2] [PATCH v2 11/11] CryptoPkg/TlsLib: Update TLS Wrapper to align with OpenSSL changes. X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: ard.biesheuvel@linaro.org, ting.ye@intel.com, ronald.cron@arm.com, jiaxin.wu@intel.com, glin@suse.com, lersek@redhat.com MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" X-ZohoMail: RSF_4 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" This patch update the wrapper implementation in TlsLib to align with the latest OpenSSL-1.1.0xx API changes. Cc: Ting Ye Cc: Palmer Thomas Cc: Jiaxin Wu Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Gary Lin Cc: Ronald Cron Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Qin Long Reviewed-by: Wu Jiaxin --- CryptoPkg/Library/TlsLib/InternalTlsLib.h | 5 ++- CryptoPkg/Library/TlsLib/TlsConfig.c | 21 ++++++++----- CryptoPkg/Library/TlsLib/TlsInit.c | 51 +++++++++------------------= ---- 3 files changed, 31 insertions(+), 46 deletions(-) diff --git a/CryptoPkg/Library/TlsLib/InternalTlsLib.h b/CryptoPkg/Library/= TlsLib/InternalTlsLib.h index e75146648d..97727361e8 100644 --- a/CryptoPkg/Library/TlsLib/InternalTlsLib.h +++ b/CryptoPkg/Library/TlsLib/InternalTlsLib.h @@ -1,7 +1,7 @@ /** @file Internal include file for TlsLib. =20 -Copyright (c) 2016, Intel Corporation. All rights reserved.
+Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD = License which accompanies this distribution. The full text of the license may be = found at @@ -15,6 +15,9 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER= EXPRESS OR IMPLIED. #ifndef __INTERNAL_TLS_LIB_H__ #define __INTERNAL_TLS_LIB_H__ =20 +#undef _WIN32 +#undef _WIN64 + #include #include #include diff --git a/CryptoPkg/Library/TlsLib/TlsConfig.c b/CryptoPkg/Library/TlsLi= b/TlsConfig.c index f103da4321..43e275d400 100644 --- a/CryptoPkg/Library/TlsLib/TlsConfig.c +++ b/CryptoPkg/Library/TlsLib/TlsConfig.c @@ -128,24 +128,30 @@ TlsSetVersion ( =20 ProtoVersion =3D (MajorVer << 8) | MinorVer; =20 + // + // Bound TLS method to the particular specified version. + // switch (ProtoVersion) { case TLS1_VERSION: // // TLS 1.0 // - SSL_set_ssl_method (TlsConn->Ssl, TLSv1_method ()); + SSL_set_min_proto_version (TlsConn->Ssl, TLS1_VERSION); + SSL_set_max_proto_version (TlsConn->Ssl, TLS1_VERSION); break; case TLS1_1_VERSION: // // TLS 1.1 // - SSL_set_ssl_method (TlsConn->Ssl, TLSv1_1_method ()); + SSL_set_min_proto_version (TlsConn->Ssl, TLS1_1_VERSION); + SSL_set_max_proto_version (TlsConn->Ssl, TLS1_1_VERSION); break; case TLS1_2_VERSION: // // TLS 1.2 // - SSL_set_ssl_method (TlsConn->Ssl, TLSv1_2_method ()); + SSL_set_min_proto_version (TlsConn->Ssl, TLS1_2_VERSION); + SSL_set_max_proto_version (TlsConn->Ssl, TLS1_2_VERSION); break; default: // @@ -384,8 +390,7 @@ TlsSetSessionId ( return EFI_UNSUPPORTED; } =20 - Session->session_id_length =3D SessionIdLen; - CopyMem (Session->session_id, SessionId, Session->session_id_length); + SSL_SESSION_set1_id (Session, (const unsigned char *)SessionId, SessionI= dLen); =20 return EFI_SUCCESS; } @@ -847,7 +852,7 @@ TlsGetClientRandom ( return; } =20 - CopyMem (ClientRandom, TlsConn->Ssl->s3->client_random, SSL3_RANDOM_SIZE= ); + SSL_get_client_random (TlsConn->Ssl, ClientRandom, SSL3_RANDOM_SIZE); } =20 /** @@ -876,7 +881,7 @@ TlsGetServerRandom ( return; } =20 - CopyMem (ServerRandom, TlsConn->Ssl->s3->server_random, SSL3_RANDOM_SIZE= ); + SSL_get_server_random (TlsConn->Ssl, ServerRandom, SSL3_RANDOM_SIZE); } =20 /** @@ -916,7 +921,7 @@ TlsGetKeyMaterial ( return EFI_UNSUPPORTED; } =20 - CopyMem (KeyMaterial, Session->master_key, Session->master_key_length); + SSL_SESSION_get_master_key (Session, KeyMaterial, SSL3_MASTER_SECRET_SIZ= E); =20 return EFI_SUCCESS; } diff --git a/CryptoPkg/Library/TlsLib/TlsInit.c b/CryptoPkg/Library/TlsLib/= TlsInit.c index 6b1fd93ea9..f32148ac9a 100644 --- a/CryptoPkg/Library/TlsLib/TlsInit.c +++ b/CryptoPkg/Library/TlsLib/TlsInit.c @@ -1,7 +1,7 @@ /** @file SSL/TLS Initialization Library Wrapper Implementation over OpenSSL. =20 -Copyright (c) 2016, Intel Corporation. All rights reserved.
+Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.
(C) Copyright 2016 Hewlett Packard Enterprise Development LP
This program and the accompanying materials are licensed and made available under the terms and conditions of the BSD = License @@ -33,14 +33,10 @@ TlsInitialize ( // Performs initialization of crypto and ssl library, and loads required // algorithms. // - SSL_library_init (); - - // - // Loads error strings from both crypto and ssl library. - // - SSL_load_error_strings (); - - /// OpenSSL_add_all_algorithms(); + OPENSSL_init_ssl ( + OPENSSL_INIT_LOAD_SSL_STRINGS | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, + NULL + ); =20 // // Initialize the pseudorandom number generator. @@ -103,34 +99,10 @@ TlsCtxNew ( SSL_CTX_set_options (TlsCtx, SSL_OP_NO_SSLv3); =20 // - // Treat as minimum accepted versions. Client can use higher - // TLS version if server supports it - // - switch (ProtoVersion) { - case TLS1_VERSION: - // - // TLS 1.0 - // - break; - case TLS1_1_VERSION: - // - // TLS 1.1 - // - SSL_CTX_set_options (TlsCtx, SSL_OP_NO_TLSv1); - break; - case TLS1_2_VERSION: - // - // TLS 1.2 - // - SSL_CTX_set_options (TlsCtx, SSL_OP_NO_TLSv1); - SSL_CTX_set_options (TlsCtx, SSL_OP_NO_TLSv1_1); - break; - default: - // - // Unsupported TLS/SSL Protocol Version. - // - break; - } + // Treat as minimum accepted versions by setting the minimal bound. + // Client can use higher TLS version if server supports it + // + SSL_CTX_set_min_proto_version (TlsCtx, ProtoVersion); =20 return (VOID *) TlsCtx; } @@ -220,6 +192,11 @@ TlsNew ( } =20 // + // This retains compatibility with previous version of OpenSSL. + // + SSL_set_security_level (TlsConn->Ssl, 0); + + // // Initialize the created SSL Object // SSL_set_info_callback (TlsConn->Ssl, NULL); --=20 2.11.1.windows.1 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel