Skip to content

Commit 771f0b5

Browse files
pennampennam
committed
Fix BearSSLClient profile configuration
1 parent 6e3d63e commit 771f0b5

File tree

4 files changed

+109
-78
lines changed

4 files changed

+109
-78
lines changed

‎src/tls/BearSSLClientProfile.c

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
/*
2+
* Copyright (c) 2016 Thomas Pornin <pornin@bolet.org>
3+
*
4+
* Permission is hereby granted, free of charge, to any person obtaining
5+
* a copy of this software and associated documentation files (the
6+
* "Software"), to deal in the Software without restriction, including
7+
* without limitation the rights to use, copy, modify, merge, publish,
8+
* distribute, sublicense, and/or sell copies of the Software, and to
9+
* permit persons to whom the Software is furnished to do so, subject to
10+
* the following conditions:
11+
*
12+
* The above copyright notice and this permission notice shall be
13+
* included in all copies or substantial portions of the Software.
14+
*
15+
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
16+
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
17+
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
18+
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
19+
* BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
20+
* ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
21+
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
22+
* SOFTWARE.
23+
*/
24+
25+
/******************************************************************************
26+
* INCLUDE
27+
******************************************************************************/
28+
29+
#include <AIoTC_Config.h>
30+
#ifdef BOARD_HAS_ECCX08
31+
32+
#include "bearssl/inner.h"
33+
34+
/* see bearssl_ssl.h */
35+
void aiotc_client_profile_init(br_ssl_client_context *cc, br_x509_minimal_context *xc, const br_x509_trust_anchor *trust_anchors, size_t trust_anchors_num)
36+
{
37+
/*
38+
* The "full" profile supports all implemented cipher suites.
39+
*
40+
* Rationale for suite order, from most important to least
41+
* important rule:
42+
*
43+
* -- Don't use 3DES if AES or ChaCha20 is available.
44+
* -- Try to have Forward Secrecy (ECDHE suite) if possible.
45+
* -- When not using Forward Secrecy, ECDH key exchange is
46+
* better than RSA key exchange (slightly more expensive on the
47+
* client, but much cheaper on the server, and it implies smaller
48+
* messages).
49+
* -- ChaCha20+Poly1305 is better than AES/GCM (faster, smaller code).
50+
* -- GCM is better than CBC.
51+
* -- AES-128 is preferred over AES-256 (AES-128 is already
52+
* strong enough, and AES-256 is 40% more expensive).
53+
*/
54+
static const uint16_t suites[] = {
55+
BR_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
56+
};
57+
58+
/*
59+
* Reset client context and set supported versions from TLS-1.0
60+
* to TLS-1.2 (inclusive).
61+
*/
62+
br_ssl_client_zero(cc);
63+
br_ssl_engine_set_versions(&cc->eng, BR_TLS12, BR_TLS12);
64+
65+
/*
66+
* X.509 engine uses SHA-256 to hash certificate DN (for
67+
* comparisons).
68+
*/
69+
br_x509_minimal_init(xc, &br_sha256_vtable, trust_anchors, trust_anchors_num);
70+
71+
/*
72+
* Set suites and asymmetric crypto implementations. We use the
73+
* "i31" code for RSA (it is somewhat faster than the "i32"
74+
* implementation).
75+
* TODO: change that when better implementations are made available.
76+
*/
77+
br_ssl_engine_set_suites(&cc->eng, suites, (sizeof suites) / (sizeof suites[0]));
78+
br_ssl_engine_set_default_ecdsa(&cc->eng);
79+
br_x509_minimal_set_ecdsa(xc, br_ssl_engine_get_ec(&cc->eng), br_ssl_engine_get_ecdsa(&cc->eng));
80+
81+
/*
82+
* Set supported hash functions, for the SSL engine and for the
83+
* X.509 engine.
84+
*/
85+
br_ssl_engine_set_hash(&cc->eng, br_sha256_ID, &br_sha256_vtable);
86+
br_x509_minimal_set_hash(xc, br_sha256_ID, &br_sha256_vtable);
87+
88+
/*
89+
* Link the X.509 engine in the SSL engine.
90+
*/
91+
br_ssl_engine_set_x509(&cc->eng, &xc->vtable);
92+
93+
/*
94+
* Set the PRF implementations.
95+
*/
96+
br_ssl_engine_set_prf_sha256(&cc->eng, &br_tls12_sha256_prf);
97+
98+
/*
99+
* Symmetric encryption. We use the "default" implementations
100+
* (fastest among constant-time implementations).
101+
*/
102+
br_ssl_engine_set_default_aes_gcm(&cc->eng);
103+
}
104+
105+
#endif /* #ifdef BOARD_HAS_ECCX08 */
106+

‎src/tls/BearSSLClientProfile.h

Lines changed: 1 addition & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -32,76 +32,7 @@
3232
#include <AIoTC_Config.h>
3333
#ifdef BOARD_HAS_ECCX08
3434

35-
/* see bearssl_ssl.h */
36-
void aiotc_client_profile_init(br_ssl_client_context *cc, br_x509_minimal_context *xc, const br_x509_trust_anchor *trust_anchors, size_t trust_anchors_num)
37-
{
38-
/*
39-
* The "full" profile supports all implemented cipher suites.
40-
*
41-
* Rationale for suite order, from most important to least
42-
* important rule:
43-
*
44-
* -- Don't use 3DES if AES or ChaCha20 is available.
45-
* -- Try to have Forward Secrecy (ECDHE suite) if possible.
46-
* -- When not using Forward Secrecy, ECDH key exchange is
47-
* better than RSA key exchange (slightly more expensive on the
48-
* client, but much cheaper on the server, and it implies smaller
49-
* messages).
50-
* -- ChaCha20+Poly1305 is better than AES/GCM (faster, smaller code).
51-
* -- GCM is better than CBC.
52-
* -- AES-128 is preferred over AES-256 (AES-128 is already
53-
* strong enough, and AES-256 is 40% more expensive).
54-
*/
55-
static const uint16_t suites[] = {
56-
BR_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
57-
};
58-
59-
/*
60-
* Reset client context and set supported versions from TLS-1.0
61-
* to TLS-1.2 (inclusive).
62-
*/
63-
br_ssl_client_zero(cc);
64-
br_ssl_engine_set_versions(&cc->eng, BR_TLS12, BR_TLS12);
65-
66-
/*
67-
* X.509 engine uses SHA-256 to hash certificate DN (for
68-
* comparisons).
69-
*/
70-
br_x509_minimal_init(xc, &br_sha256_vtable, trust_anchors, trust_anchors_num);
71-
72-
/*
73-
* Set suites and asymmetric crypto implementations. We use the
74-
* "i31" code for RSA (it is somewhat faster than the "i32"
75-
* implementation).
76-
* TODO: change that when better implementations are made available.
77-
*/
78-
br_ssl_engine_set_suites(&cc->eng, suites, (sizeof suites) / (sizeof suites[0]));
79-
br_ssl_engine_set_default_ecdsa(&cc->eng);
80-
br_x509_minimal_set_ecdsa(xc, br_ssl_engine_get_ec(&cc->eng), br_ssl_engine_get_ecdsa(&cc->eng));
81-
82-
/*
83-
* Set supported hash functions, for the SSL engine and for the
84-
* X.509 engine.
85-
*/
86-
br_ssl_engine_set_hash(&cc->eng, br_sha256_ID, &br_sha256_vtable);
87-
br_x509_minimal_set_hash(xc, br_sha256_ID, &br_sha256_vtable);
88-
89-
/*
90-
* Link the X.509 engine in the SSL engine.
91-
*/
92-
br_ssl_engine_set_x509(&cc->eng, &xc->vtable);
93-
94-
/*
95-
* Set the PRF implementations.
96-
*/
97-
br_ssl_engine_set_prf_sha256(&cc->eng, &br_tls12_sha256_prf);
98-
99-
/*
100-
* Symmetric encryption. We use the "default" implementations
101-
* (fastest among constant-time implementations).
102-
*/
103-
br_ssl_engine_set_default_aes_gcm(&cc->eng);
104-
}
35+
extern "C" void aiotc_client_profile_init(br_ssl_client_context *cc, br_x509_minimal_context *xc, const br_x509_trust_anchor *trust_anchors, size_t trust_anchors_num);
10536

10637
#endif /* #ifdef BOARD_HAS_ECCX08 */
10738

‎src/tls/utility/TLSClientMqtt.cpp

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,8 @@
2424

2525
#ifdef BOARD_HAS_ECCX08
2626
#include "tls/BearSSLTrustAnchors.h"
27+
#include "tls/BearSSLClientProfile.h"
2728
extern "C" {
28-
void aiotc_client_profile_init(br_ssl_client_context *cc,
29-
br_x509_minimal_context *xc,
30-
const br_x509_trust_anchor *trust_anchors,
31-
size_t trust_anchors_num);
3229
unsigned long getTime();
3330
}
3431
#endif

‎src/tls/utility/TLSClientOta.cpp

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,8 @@
2424

2525
#ifdef BOARD_HAS_ECCX08
2626
#include "tls/BearSSLTrustAnchors.h"
27+
#include "tls/BearSSLClientProfile.h"
2728
extern "C" {
28-
void aiotc_client_profile_init(br_ssl_client_context *cc,
29-
br_x509_minimal_context *xc,
30-
const br_x509_trust_anchor *trust_anchors,
31-
size_t trust_anchors_num);
3229
unsigned long getTime();
3330
}
3431
#endif

0 commit comments

Comments
 (0)