Commander1024
cdc9c7335a
Generate exact-hash SDK source overrides without modifying dependencies. Harden SSH allocation and algorithm policy, tighten web authentication cleanup, and add focused host contract tests and documentation.
106 lines
5.2 KiB
C
106 lines
5.2 KiB
C
/* SPDX-License-Identifier: GPL-3.0-only */
|
|
#include "alloc.h"
|
|
#define MBEDTLS_SSL_IS_SERVER 1
|
|
#define MBEDTLS_SSL_IS_CLIENT 0
|
|
#define MBEDTLS_SSL_TRANSPORT_STREAM 0
|
|
#define MBEDTLS_SSL_PRESET_DEFAULT 0
|
|
#define MBEDTLS_SSL_VERIFY_NONE 0
|
|
#define MBEDTLS_SSL_VERIFY_REQUIRED 2
|
|
#define MBEDTLS_SSL_VERSION_TLS1_2 0x303
|
|
#define MBEDTLS_SSL_RENEGOTIATION_DISABLED 0
|
|
#define MBEDTLS_SSL_RENEGOTIATION_ENABLED 1
|
|
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 0xc02b
|
|
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 0xc02c
|
|
#define ESP_ERR_MBEDTLS_SSL_CONFIG_DEFAULTS_FAILED -11
|
|
#define ESP_ERR_MBEDTLS_SSL_SET_HOSTNAME_FAILED -12
|
|
#define ESP_ERR_MBEDTLS_SSL_SETUP_FAILED -13
|
|
#define ESP_INT_EVENT_TRACKER_CAPTURE(...) ((void)0)
|
|
/* TLS_GUARDS */
|
|
typedef int mbedtls_x509_crt;
|
|
typedef int mbedtls_pk_context;
|
|
typedef struct {
|
|
const int *suites;
|
|
int endpoint, min, max, reneg, policy_calls;
|
|
void *userdata;
|
|
} mbedtls_ssl_config;
|
|
typedef struct {
|
|
mbedtls_ssl_config conf;
|
|
int ssl, servercert, serverkey, clientcert, clientkey, error_handle;
|
|
void *cacert_ptr;
|
|
} esp_tls_t;
|
|
typedef struct {
|
|
void *userdata; const char **alpn_protos;
|
|
bool use_secure_element, use_ecdsa_peripheral;
|
|
const unsigned char *cacert_buf, *servercert_buf, *serverkey_buf, *serverkey_password;
|
|
unsigned cacert_bytes, servercert_bytes, serverkey_bytes, serverkey_password_len;
|
|
} esp_tls_cfg_server_t;
|
|
typedef struct {
|
|
bool skip_common_name, use_global_ca_store, use_secure_element, use_ecdsa_peripheral;
|
|
const char *common_name; const char **alpn_protos;
|
|
void *crt_bundle_attach, *ds_data;
|
|
const unsigned char *cacert_buf, *clientcert_buf, *clientkey_buf, *clientkey_password;
|
|
const unsigned char *clientcert_pem_buf, *clientkey_pem_buf;
|
|
unsigned cacert_bytes, clientcert_bytes, clientkey_bytes, clientkey_password_len;
|
|
const int *ciphersuites_list;
|
|
} esp_tls_cfg_t;
|
|
/* SDK_PKI */
|
|
static int defaults_fail, pki_fail;
|
|
static const int default_suites[] = {123, 456, 0};
|
|
static int mbedtls_ssl_config_defaults(mbedtls_ssl_config *c, int endpoint, int transport, int preset) {
|
|
if (defaults_fail) return -1;
|
|
*c = (mbedtls_ssl_config){.suites=default_suites, .endpoint=endpoint,
|
|
.min=11, .max=22, .reneg=1};
|
|
return 0;
|
|
}
|
|
static void mbedtls_ssl_conf_ciphersuites(mbedtls_ssl_config *c, const int *list) { c->suites=list; ++c->policy_calls; }
|
|
static void mbedtls_ssl_conf_min_tls_version(mbedtls_ssl_config *c, int v) { c->min=v; }
|
|
static void mbedtls_ssl_conf_max_tls_version(mbedtls_ssl_config *c, int v) { c->max=v; }
|
|
static void mbedtls_ssl_conf_renegotiation(mbedtls_ssl_config *c, int v) { c->reneg=v; }
|
|
static void mbedtls_ssl_conf_set_user_data_p(mbedtls_ssl_config *c, void *p) { c->userdata=p; }
|
|
static void mbedtls_ssl_conf_authmode(mbedtls_ssl_config *c, int mode) {}
|
|
static void mbedtls_ssl_conf_ca_chain(mbedtls_ssl_config *c, void *p, void *q) {}
|
|
static int mbedtls_ssl_set_hostname(void *ssl, const char *host) { return 0; }
|
|
static void mbedtls_print_error_msg(int e) {}
|
|
static int set_ca_cert(esp_tls_t *tls, const unsigned char *cert, size_t n) { return 0; }
|
|
static int set_global_ca_store(esp_tls_t *tls) { return 0; }
|
|
static void check_policy(mbedtls_ssl_config *c) {
|
|
assert(c->endpoint == MBEDTLS_SSL_IS_SERVER && c->policy_calls == 1);
|
|
assert(c->suites[0] == 0xc02b && c->suites[1] == 0xc02c && c->suites[2] == 0);
|
|
assert(c->min == 0x303 && c->max == 0x303);
|
|
#ifdef MBEDTLS_SSL_RENEGOTIATION
|
|
assert(c->reneg == 0);
|
|
#endif
|
|
}
|
|
static int set_pki_context(esp_tls_t *tls, esp_tls_pki_t *pki) {
|
|
if (tls->conf.endpoint == MBEDTLS_SSL_IS_SERVER) check_policy(&tls->conf);
|
|
return pki_fail ? -1 : 0;
|
|
}
|
|
/* SDK_FUNCTIONS */
|
|
int main(void) {
|
|
static const unsigned char cert[] = {1}, key[] = {2};
|
|
esp_tls_cfg_server_t cfg = {.servercert_buf=cert, .serverkey_buf=key, .userdata=&cfg};
|
|
esp_tls_t server = {0}, second = {0}, client = {0};
|
|
defaults_fail = 1;
|
|
assert(set_server_config(&cfg, &server) == ESP_ERR_MBEDTLS_SSL_CONFIG_DEFAULTS_FAILED);
|
|
assert(!server.conf.policy_calls && !server.conf.suites);
|
|
defaults_fail = 0;
|
|
assert(set_server_config(&cfg, &server) == 0); check_policy(&server.conf);
|
|
assert(server.conf.userdata == &cfg);
|
|
assert(set_server_config(&cfg, &second) == 0); check_policy(&second.conf);
|
|
assert(server.conf.suites == second.conf.suites); /* retained static lifetime */
|
|
esp_tls_cfg_t ccfg = {.skip_common_name=true, .use_global_ca_store=true};
|
|
assert(set_client_config("host", 4, &ccfg, &client) == 0);
|
|
assert(client.conf.suites == default_suites && !client.conf.policy_calls);
|
|
assert(client.conf.min == 11 && client.conf.max == 22 && client.conf.reneg == 1);
|
|
static const int custom[] = {999, 0}; ccfg.ciphersuites_list = custom;
|
|
assert(set_client_config("host", 4, &ccfg, &client) == 0);
|
|
assert(client.conf.suites == custom && client.conf.policy_calls == 1);
|
|
check_policy(&server.conf);
|
|
pki_fail = 1;
|
|
assert(set_server_config(&cfg, &second) != 0); check_policy(&second.conf);
|
|
pki_fail = 0; cfg.serverkey_buf = NULL;
|
|
assert(set_server_config(&cfg, &second) == ESP_ERR_INVALID_STATE);
|
|
assert(!live);
|
|
puts("TLS server-only allowlist/version/renegotiation/config-failure/client isolation PASS");
|
|
}
|