espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-08-16 23:57:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

[secure-transport] refactor Setup() to separate component setup (#10987)

Browse Source 
This commit updates the `Setup()` method to separate the preparation
of the `mbedtls_ssl_config`, `mbedtls_ssl_cookie_ctx`, and
`mbedtls_ssl_context` components. This allows for decoupling these
components later, for example, to support multiple sessions using the
same configuration.
This commit is contained in:
Abtin Keshavarzian
2024-12-04 12:32:06 -08:00
committed by GitHub
parent bf34ecc704
commit a0f861d78e
1 changed files with 59 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/meshcop/secure_transport.cpp
+59 -44
View File
@@ -256,25 +256,6 @@ exit:
Error SecureTransport::Setup(bool aClient)
{
// We use `kCipherSuites[mCipherSuite]` to look up the cipher
// suites array to pass to `mbedtls_ssl_conf_ciphersuites()`
// associated with `mCipherSuite`. We validate that the `enum`
// values are correct and match the order in the `kCipherSuites[]`
// array.
struct EnumCheck
{
InitEnumValidatorCounter();
ValidateNextEnum(kEcjpakeWithAes128Ccm8);
#if OPENTHREAD_CONFIG_TLS_API_ENABLE && defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
ValidateNextEnum(kPskWithAes128Ccm8);
#endif
#if OPENTHREAD_CONFIG_TLS_API_ENABLE && defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
ValidateNextEnum(kEcdheEcdsaWithAes128Ccm8);
ValidateNextEnum(kEcdheEcdsaWithAes128GcmSha256);
#endif
};
int rval;
OT_ASSERT(mCipherSuite != kUnspecifiedCipherSuite);
@@ -284,23 +265,11 @@ Error SecureTransport::Setup(bool aClient)
SetState(kStateInitializing);
mbedtls_ssl_init(&mSsl);
//- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
// Setup the mbedtls_ssl_config `mConf`.
mbedtls_ssl_config_init(&mConf);
#if OPENTHREAD_CONFIG_TLS_API_ENABLE && defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
if (mExtension != nullptr)
{
mExtension->mEcdheEcdsaInfo.Init();
}
#endif
#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_COOKIE_C)
if (mDatagramTransport)
{
mbedtls_ssl_cookie_init(&mCookieCtx);
}
#endif
rval = mbedtls_ssl_config_defaults(
&mConf, aClient ? MBEDTLS_SSL_IS_CLIENT : MBEDTLS_SSL_IS_SERVER,
mDatagramTransport ? MBEDTLS_SSL_TRANSPORT_DATAGRAM : MBEDTLS_SSL_TRANSPORT_STREAM, MBEDTLS_SSL_PRESET_DEFAULT);
@@ -329,7 +298,28 @@ Error SecureTransport::Setup(bool aClient)
mbedtls_ssl_conf_max_version(&mConf, MBEDTLS_SSL_MAJOR_VERSION_3, MBEDTLS_SSL_MINOR_VERSION_3);
#endif
mbedtls_ssl_conf_ciphersuites(&mConf, kCipherSuites[mCipherSuite]);
{
// We use `kCipherSuites[mCipherSuite]` to look up the cipher
// suites array to pass to `mbedtls_ssl_conf_ciphersuites()`
// associated with `mCipherSuite`. We validate that the `enum`
// values are correct and match the order in the `kCipherSuites[]`
// array.
struct EnumCheck
{
InitEnumValidatorCounter();
ValidateNextEnum(kEcjpakeWithAes128Ccm8);
#if OPENTHREAD_CONFIG_TLS_API_ENABLE && defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
ValidateNextEnum(kPskWithAes128Ccm8);
#endif
#if OPENTHREAD_CONFIG_TLS_API_ENABLE && defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
ValidateNextEnum(kEcdheEcdsaWithAes128Ccm8);
ValidateNextEnum(kEcdheEcdsaWithAes128GcmSha256);
#endif
};
mbedtls_ssl_conf_ciphersuites(&mConf, kCipherSuites[mCipherSuite]);
}
if (mCipherSuite == kEcjpakeWithAes128Ccm8)
{
@@ -347,25 +337,46 @@ Error SecureTransport::Setup(bool aClient)
#endif
}
#if (MBEDTLS_VERSION_NUMBER >= 0x03000000)
mbedtls_ssl_set_export_keys_cb(&mSsl, HandleMbedtlsExportKeys, this);
#else
#if (MBEDTLS_VERSION_NUMBER < 0x03000000)
mbedtls_ssl_conf_export_keys_cb(&mConf, HandleMbedtlsExportKeys, this);
#endif
mbedtls_ssl_conf_handshake_timeout(&mConf, 8000, 60000);
mbedtls_ssl_conf_dbg(&mConf, HandleMbedtlsDebug, this);
#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_COOKIE_C)
if (!aClient && mDatagramTransport)
{
rval = mbedtls_ssl_cookie_setup(&mCookieCtx, Crypto::MbedTls::CryptoSecurePrng, nullptr);
VerifyOrExit(rval == 0);
//- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
// Setup the `Extension` components.
mbedtls_ssl_conf_dtls_cookies(&mConf, mbedtls_ssl_cookie_write, mbedtls_ssl_cookie_check, &mCookieCtx);
#if OPENTHREAD_CONFIG_TLS_API_ENABLE && defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
if (mExtension != nullptr)
{
mExtension->mEcdheEcdsaInfo.Init();
}
#endif
//- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
// Setup the mbedtls_ssl_cookie_ctx `mCookieCtx`.
#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_COOKIE_C)
if (mDatagramTransport)
{
mbedtls_ssl_cookie_init(&mCookieCtx);
if (!aClient)
{
rval = mbedtls_ssl_cookie_setup(&mCookieCtx, Crypto::MbedTls::CryptoSecurePrng, nullptr);
VerifyOrExit(rval == 0);
mbedtls_ssl_conf_dtls_cookies(&mConf, mbedtls_ssl_cookie_write, mbedtls_ssl_cookie_check, &mCookieCtx);
}
}
#endif
//- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
// Setup the mbedtls_ssl_context `mSsl`.
mbedtls_ssl_init(&mSsl);
rval = mbedtls_ssl_setup(&mSsl, &mConf);
VerifyOrExit(rval == 0);
@@ -376,6 +387,10 @@ Error SecureTransport::Setup(bool aClient)
mbedtls_ssl_set_timer_cb(&mSsl, this, HandleMbedtlsSetTimer, HandleMbedtlsGetTimer);
}
#if (MBEDTLS_VERSION_NUMBER >= 0x03000000)
mbedtls_ssl_set_export_keys_cb(&mSsl, HandleMbedtlsExportKeys, this);
#endif
if (mCipherSuite == kEcjpakeWithAes128Ccm8)
{
rval = mbedtls_ssl_set_hs_ecjpake_password(&mSsl, mPsk, mPskLength);