bool TLSEncryption::load_certificate(const char* certificate_buf)
{
if (!certificate_buf) return false;
bool result = false;
#if defined(SSL_LIB_OPENSSL)
X509 *cert = NULL;
EVP_PKEY *pkey = NULL;
BIO *bio_buffer;
//create readonly memory BIO
if (!(bio_buffer = BIO_new_mem_buf((void*)certificate_buf, -1))) return false; //certificate_buf should be null terminated;
//load PEM cert from buffer
if(PEM_read_bio_X509(bio_buffer, &cert, 0, NULL))
{
result = (SSL_CTX_use_certificate(m_ctx, cert) == SSL_SUCCESS);
X509_free(cert);
BIO_reset(bio_buffer);
}
//load PEM private key from buffer
if(result && PEM_read_bio_PrivateKey(bio_buffer, &pkey, 0, NULL))
{
result = (SSL_CTX_use_PrivateKey(m_ctx, pkey) == SSL_SUCCESS);
EVP_PKEY_free(pkey);
}
BIO_free(bio_buffer);
#elif defined(SSL_LIB_CYASSL)
uint certificate_buf_len = strlen(certificate_buf);
if (CyaSSL_CTX_use_certificate_buffer(m_ctx, (const unsigned char*)certificate_buf,
certificate_buf_len, SSL_FILETYPE_PEM) == SSL_SUCCESS) {
result = (CyaSSL_CTX_use_PrivateKey_buffer(m_ctx, (const unsigned char*)certificate_buf,
certificate_buf_len, SSL_FILETYPE_PEM) == SSL_SUCCESS);
}
#endif
return result;
}
static int _tls_session_init_client(tls_session_t *s, int sockfd,
const tls_init_config_t *cfg)
{
int ret;
SSL_METHOD *method;
#if defined(CYASSL_DTLS)
method = DTLSv1_client_method();
#elif !defined(NO_TLS)
method = SSLv23_client_method();
#else
method = SSLv3_client_method();
#endif
s->ctx = SSL_CTX_new(method);
#ifndef NO_PSK
SSL_CTX_set_psk_client_callback(s->ctx, my_psk_client_cb);
#endif
#if defined(CYASSL_SNIFFER) && !defined(HAVE_NTRU) && !defined(HAVE_ECC)
/* don't use EDH, can't sniff tmp keys */
SSL_CTX_set_cipher_list(s->ctx, "AES256-SHA");
#endif
if (cfg->flags & TLS_CHECK_SERVER_CERT) {
ASSERT(cfg->tls.client.ca_cert_size != 0);
/* Load server certificates from buffer */
tls_d("Loading CA certificate file. Size: %d",
cfg->tls.client.ca_cert_size);
ret = CyaSSL_CTX_load_verify_buffer(s->ctx,
cfg->tls.client.ca_cert,
cfg->tls.client.
ca_cert_size,
SSL_FILETYPE_PEM);
if (ret != SSL_SUCCESS) {
tls_e("Unable to load CA certificate");
SSL_CTX_free(s->ctx);
return -WM_FAIL;
}
} else {
tls_d("Disabling certificate check");
SSL_CTX_set_verify(s->ctx, SSL_VERIFY_NONE, 0);
}
if (cfg->flags & TLS_USE_CLIENT_CERT) {
/* The server wants to verify our certificates */
ASSERT(cfg->tls.client.client_cert_size != 0);
ASSERT(cfg->tls.client.client_key_size != 0);
/* Load client certificates and client private keys from
buffer */
tls_d("Loading client certificate buffer. Size: %d",
cfg->tls.client.client_cert_size);
ret = CyaSSL_CTX_use_certificate_buffer(s->ctx,
cfg->tls.client.
client_cert,
cfg->tls.client.
client_cert_size,
SSL_FILETYPE_PEM);
if (ret != SSL_SUCCESS) {
tls_e("Unable to load client certificate");
SSL_CTX_free(s->ctx);
return -WM_FAIL;
}
tls_d("Loading client private key buffer. Size: %d",
cfg->tls.client.client_key_size);
ret = CyaSSL_CTX_use_PrivateKey_buffer(s->ctx,
cfg->tls.client.
client_key,
cfg->tls.client.
client_key_size,
SSL_FILETYPE_PEM);
if (ret != SSL_SUCCESS) {
tls_e("Unable to load client key");
SSL_CTX_free(s->ctx);
return -WM_FAIL;
}
}
s->ssl = SSL_new(s->ctx);
SSL_set_fd(s->ssl, sockfd);
#ifdef CONFIG_WPA2_ENTP
if (cfg->flags & TLS_WPA2_ENTP) {
CyaSSL_SetIOSend(s->ctx, SSLSend);
CyaSSL_SetIORecv(s->ctx, SSLReceive);
}
#endif
#ifdef NON_BLOCKING
tcp_set_nonblocking(&sockfd);
NonBlockingSSL_Connect(s->ssl);
#else
#ifndef CYASSL_CALLBACKS
tls_d("Starting SSL connect");
/* see note at top of README */
if (SSL_connect(s->ssl) != SSL_SUCCESS) {
#ifdef CONFIG_ENABLE_ERROR_LOGS
int err = SSL_get_error(s->ssl, 0);
char buffer[80];
tls_e("err = %d, %s", err, ERR_error_string(err, buffer));
/* if you're getting an error here */
tls_e("SSL_connect failed");
#endif /* CONFIG_ENABLE_ERROR_LOGS */
SSL_free(s->ssl);
SSL_CTX_free(s->ctx);
return -WM_FAIL;
}
#else
timeout.tv_sec = 2;
timeout.tv_usec = 0;
NonBlockingSSL_Connect(s->ssl); /* will keep retrying on timeout */
#endif
#endif
showPeer(s->ssl);
s->session_setup_done = true;
tls_d("SSL Connect success");
#ifdef CONFIG_WPA2_ENTP
if (cfg->flags & TLS_WPA2_ENTP)
return tls_session_success(s);
#endif
return WM_SUCCESS;
}
/*
* ======== tcpHandler ========
* Creates new Task to handle new TCP connections.
*/
Void tcpHandler(UArg arg0, UArg arg1) {
int sockfd;
int ret;
struct sockaddr_in servAddr;
Error_Block eb;
bool flag = true;
bool internal_flag = true;
int nbytes;
char *buffer;
char msg[] = "Hello from TM4C1294XL Connected Launchpad";
CYASSL* ssl = (CYASSL *) arg0;
fdOpenSession(TaskSelf());
CyaSSL_Init();
CYASSL_CTX* ctx = NULL;
ctx = CyaSSL_CTX_new(CyaTLSv1_2_client_method());
if (ctx == 0) {
System_printf("tcpHandler: CyaSSL_CTX_new error.\n");
exitApp(ctx);
}
if (CyaSSL_CTX_load_verify_buffer(ctx, ca_cert_der_2048,
sizeof(ca_cert_der_2048) / sizeof(char), SSL_FILETYPE_ASN1)
!= SSL_SUCCESS) {
System_printf("tcpHandler: Error loading ca_cert_der_2048"
" please check the cyassl/certs_test.h file.\n");
exitApp(ctx);
}
if (CyaSSL_CTX_use_certificate_buffer(ctx, client_cert_der_2048,
sizeof(client_cert_der_2048) / sizeof(char), SSL_FILETYPE_ASN1)
!= SSL_SUCCESS) {
System_printf("tcpHandler: Error loading client_cert_der_2048,"
" please check the cyassl/certs_test.h file.\n");
exitApp(ctx);
}
if (CyaSSL_CTX_use_PrivateKey_buffer(ctx, client_key_der_2048,
sizeof(client_key_der_2048) / sizeof(char), SSL_FILETYPE_ASN1)
!= SSL_SUCCESS) {
System_printf("tcpHandler: Error loading client_key_der_2048,"
" please check the cyassl/certs_test.h file.\n");
exitApp(ctx);
}
/* Init the Error_Block */
Error_init(&eb);
do {
sockfd = socket(AF_INET, SOCK_STREAM, 0);
if (sockfd < 0) {
System_printf("tcpHandler: socket failed\n");
Task_sleep(2000);
continue;
}
memset((char *) &servAddr, 0, sizeof(servAddr));
servAddr.sin_family = AF_INET;
servAddr.sin_port = htons(TCPPORT);
inet_aton(IP_ADDR, &servAddr.sin_addr);
ret = connect(sockfd, (struct sockaddr *) &servAddr, sizeof(servAddr));
if (ret < 0) {
fdClose((SOCKET) sockfd);
Task_sleep(2000);
continue;
}
} while (ret != 0);
if ((ssl = CyaSSL_new(ctx)) == NULL) {
System_printf("tcpHandler: CyaSSL_new error.\n");
exitApp(ctx);
}
CyaSSL_set_fd(ssl, sockfd);
ret = CyaSSL_connect(ssl);
/* Delete "TOP_LINE" and "END_LINE" for debugging. */
/* TOP_LINE
System_printf("looked for: %d.\n", SSL_SUCCESS);
System_printf("return was: %d.\n", ret);
int err;
char err_buffer[80];
err = CyaSSL_get_error(ssl, 0);
System_printf("CyaSSL error: %d\n", err);
System_printf("CyaSSL error string: %s\n", CyaSSL_ERR_error_string(err, err_buffer));
END_LINE */
if (ret == SSL_SUCCESS) {
sockfd = CyaSSL_get_fd(ssl);
/* Get a buffer to receive incoming packets. Use the default heap. */
buffer = Memory_alloc(NULL, TCPPACKETSIZE, 0, &eb);
if (buffer == NULL) {
System_printf("tcpWorker: failed to alloc memory\n");
exitApp(ctx);
}
/* Say hello to the server */
while (flag) {
if (CyaSSL_write(ssl, msg, strlen(msg)) != strlen(msg)) {
ret = CyaSSL_get_error(ssl, 0);
System_printf("Write error: %i.\n", ret);
}
while (internal_flag) {
nbytes = CyaSSL_read(ssl, (char *) buffer, TCPPACKETSIZE);
if (nbytes > 0) {
internal_flag = false;
}
}
/* success */
System_printf("Heard: \"%s\".\n", buffer);
CyaSSL_free(ssl);
fdClose((SOCKET) sockfd);
flag = false;
}
/* Free the buffer back to the heap */
Memory_free(NULL, buffer, TCPPACKETSIZE);
/*
* Since deleteTerminatedTasks is set in the cfg file,
* the Task will be deleted when the idle task runs.
*/
exitApp(ctx);
} else {
CyaSSL_free(ssl);
fdClose((SOCKET) sockfd);
System_printf("CyaSSL_connect failed.\n");
fdCloseSession(TaskSelf());
exitApp(ctx);
}
}
static int _tls_session_init_server(tls_session_t *s,
const tls_init_config_t *cfg)
{
int r;
SSL_METHOD *method = 0;
ASSERT(cfg->tls.server.server_cert != NULL);
ASSERT(cfg->tls.server.server_key != NULL);
#if defined(CYASSL_DTLS)
method = DTLSv1_server_method();
#elif !defined(NO_TLS)
method = SSLv23_server_method();
#else
method = SSLv3_server_method();
#endif
s->ctx = SSL_CTX_new(method);
#ifndef NO_PSK
/* do PSK */
SSL_CTX_set_psk_server_callback(s->ctx, my_psk_server_cb);
SSL_CTX_use_psk_identity_hint(s->ctx, "cyassl server");
SSL_CTX_set_cipher_list(s->ctx, "PSK-AES256-CBC-SHA");
#else
if (cfg->flags & TLS_CHECK_CLIENT_CERT) {
/* not using PSK, verify peer with certs */
SSL_CTX_set_verify(s->ctx, SSL_VERIFY_PEER |
SSL_VERIFY_FAIL_IF_NO_PEER_CERT, 0);
} else {
SSL_CTX_set_verify(s->ctx, SSL_VERIFY_NONE, 0);
}
#endif
#ifdef OPENSSL_EXTRA
SSL_CTX_set_default_passwd_cb(s->ctx, PasswordCallBack);
#endif
#ifndef NO_FILESYSTEM
/* for client auth */
if (SSL_CTX_load_verify_locations(s->ctx, cliCert, 0) != SSL_SUCCESS)
err_sys("can't load ca file, Please run from CyaSSL home dir");
#ifdef HAVE_ECC
if (SSL_CTX_use_certificate_file(s->ctx, eccCert, SSL_FILETYPE_PEM)
!= SSL_SUCCESS)
err_sys("can't load server ecc cert file, "
"Please run from CyaSSL home dir");
if (SSL_CTX_use_PrivateKey_file(s->ctx, eccKey, SSL_FILETYPE_PEM)
!= SSL_SUCCESS)
err_sys("can't load server ecc key file, "
"Please run from CyaSSL home dir");
#elif HAVE_NTRU
if (SSL_CTX_use_certificate_file(s->ctx, ntruCert, SSL_FILETYPE_PEM)
!= SSL_SUCCESS)
err_sys("can't load ntru cert file, "
"Please run from CyaSSL home dir");
if (CyaSSL_CTX_use_NTRUPrivateKey_file(s->ctx, ntruKey)
!= SSL_SUCCESS)
err_sys("can't load ntru key file, "
"Please run from CyaSSL home dir");
#else /* normal */
if (SSL_CTX_use_certificate_file(s->ctx, svrCert, SSL_FILETYPE_PEM)
!= SSL_SUCCESS)
err_sys("can't load server cert chain file, "
"Please run from CyaSSL home dir");
if (SSL_CTX_use_PrivateKey_file(s->ctx, svrKey, SSL_FILETYPE_PEM)
!= SSL_SUCCESS)
err_sys("can't load server key file, "
"Please run from CyaSSL home dir");
#endif /* NTRU */
#else
tls_d("Loading certificates");
if (cfg->tls.server.client_cert) {
r = CyaSSL_CTX_load_verify_buffer(s->ctx,
cfg->tls.server.client_cert,
cfg->tls.
server.client_cert_size,
SSL_FILETYPE_PEM);
if (r != SSL_SUCCESS) {
tls_e("Server loading client cert failed: %d", r);
SSL_CTX_free(s->ctx);
return -WM_FAIL;
}
} else {
tls_d("Server mode: Client cert not given");
}
r = CyaSSL_CTX_use_certificate_buffer(s->ctx,
cfg->tls.server.server_cert,
cfg->tls.server.server_cert_size,
SSL_FILETYPE_PEM);
if (r != SSL_SUCCESS) {
tls_e("Server loading server cert failed: %d", r);
SSL_CTX_free(s->ctx);
return -WM_FAIL;
}
r = CyaSSL_CTX_use_PrivateKey_buffer(s->ctx, cfg->tls.server.server_key,
cfg->tls.server.server_key_size,
SSL_FILETYPE_PEM);
if (r != SSL_SUCCESS) {
tls_e("Server loading server private key failed: %d", r);
SSL_CTX_free(s->ctx);
return -WM_FAIL;
}
#endif /* NO_FILESYSTEM */
s->ssl = SSL_new(s->ctx);
return WM_SUCCESS;
}
