Skip to content

Commit 1e8b18c

Browse files
author
Mika Leppänen
committed
Added handling for mbed TLS configuration error
Added handling for TLS configuration error, added delete of TLS in case of EAP-TLS error and improved EAP-TLS message handling (fragments and empty EAP-TLS messages on authenticator).
1 parent 4802aae commit 1e8b18c

File tree

7 files changed

+98
-14
lines changed

7 files changed

+98
-14
lines changed

‎source/Security/kmp/kmp_api.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,8 @@ kmp_api_t *kmp_api_create(kmp_service_t *service, kmp_type_e type)
127127
kmp->service = service;
128128
kmp->timer_start_pending = false;
129129

130+
memset(&kmp->sec_prot, 0, sec_size);
131+
130132
kmp->sec_prot.header_size = service->header_size;
131133
kmp->sec_prot.create_conf = kmp_api_sec_prot_create_confirm;
132134
kmp->sec_prot.create_ind = kmp_api_sec_prot_create_indication;

‎source/Security/protocols/eap_tls_sec_prot/auth_eap_tls_sec_prot.c

Lines changed: 32 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,7 @@ static int8_t auth_eap_tls_sec_prot_message_send(sec_prot_t *prot, uint8_t eap_c
8989

9090
static void auth_eap_tls_sec_prot_timer_timeout(sec_prot_t *prot, uint16_t ticks);
9191
static void auth_eap_tls_sec_prot_init_tls(sec_prot_t *prot);
92+
static void auth_eap_tls_sec_prot_delete_tls(sec_prot_t *prot);
9293

9394
static void auth_eap_tls_sec_prot_seq_id_update(sec_prot_t *prot);
9495

@@ -202,7 +203,7 @@ static int8_t auth_eap_tls_sec_prot_message_handle(sec_prot_t *prot)
202203
}
203204

204205
if (!data_ptr || length < 6) {
205-
return EAP_TLS_MSG_ERROR;
206+
return EAP_TLS_MSG_DECODE_ERROR;
206207
}
207208

208209
length -= 5; // EAP fields: code, id, length, type
@@ -266,11 +267,18 @@ static void auth_eap_tls_sec_prot_tls_finished_indication(sec_prot_t *tls_prot,
266267

267268
if (result == SEC_RESULT_OK) {
268269
data->tls_result = EAP_TLS_RESULT_HANDSHAKE_OVER;
270+
} else if (result == SEC_RESULT_CONF_ERROR) {
271+
data->tls_result = EAP_TLS_RESULT_HANDSHAKE_FATAL_ERROR;
269272
} else {
270273
data->tls_result = EAP_TLS_RESULT_HANDSHAKE_FAILED;
271274
}
272275

273276
data->tls_ongoing = false;
277+
278+
if (data->tls_result == EAP_TLS_RESULT_HANDSHAKE_FATAL_ERROR) {
279+
// On fatal error terminate right away
280+
prot->state_machine_call(prot);
281+
}
274282
}
275283

276284
static int8_t auth_eap_tls_sec_prot_tls_send(sec_prot_t *tls_prot, void *pdu, uint16_t size)
@@ -318,6 +326,20 @@ static void auth_eap_tls_sec_prot_init_tls(sec_prot_t *prot)
318326
data->tls_ongoing = true;
319327
}
320328

329+
static void auth_eap_tls_sec_prot_delete_tls(sec_prot_t *prot)
330+
{
331+
eap_tls_sec_prot_int_t *data = eap_tls_sec_prot_get(prot);
332+
// If initialized, TLS terminates on its own
333+
if (data->tls_prot) {
334+
return;
335+
}
336+
337+
sec_prot_t *tls_prot = prot->type_get(prot, SEC_PROT_TYPE_TLS);
338+
if (tls_prot) {
339+
tls_prot->finished_send(tls_prot);
340+
}
341+
}
342+
321343
static void auth_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
322344
{
323345
eap_tls_sec_prot_int_t *data = eap_tls_sec_prot_get(prot);
@@ -399,7 +421,7 @@ static void auth_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
399421
if (data->eap_code == EAP_RESPONSE) {
400422
// Handle EAP response, TLS EAP
401423
result = auth_eap_tls_sec_prot_message_handle(prot);
402-
if (result == EAP_TLS_MSG_ERROR) {
424+
if (result == EAP_TLS_MSG_DECODE_ERROR) {
403425
return;
404426
}
405427
if (result == EAP_TLS_MSG_IDENTITY) {
@@ -433,12 +455,18 @@ static void auth_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
433455
return;
434456
}
435457
} else {
458+
// Call from TLS
459+
if (data->tls_result == EAP_TLS_RESULT_HANDSHAKE_FATAL_ERROR) {
460+
// Send failure
461+
eap_tls_sec_prot_lib_message_free(&data->tls_send);
462+
}
463+
436464
// Call from TLS
437465
data->wait_tls = false;
438466
}
439467

440468
// TLS EAP message to be send
441-
if (data->tls_send.data) {
469+
if (data->tls_send.total_len > 0 || result == EAP_TLS_MSG_MORE_FRAG) {
442470
data->send_pending = false;
443471

444472
// Sends EAP request, TLS EAP, TLS exchange
@@ -473,6 +501,7 @@ static void auth_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
473501
break;
474502

475503
case EAP_TLS_STATE_FINISHED:
504+
auth_eap_tls_sec_prot_delete_tls(prot);
476505
prot->timer_stop(prot);
477506
prot->finished(prot);
478507
break;

‎source/Security/protocols/eap_tls_sec_prot/eap_tls_sec_prot_lib.c

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ int8_t eap_tls_sec_prot_lib_message_handle(uint8_t *data, uint16_t length, bool
8888
// Handles the length field
8989
if (data[0] & EAP_TLS_FRAGMENT_LENGTH) {
9090
if (length < 5) {
91-
return EAP_TLS_MSG_ERROR;
91+
return EAP_TLS_MSG_DECODE_ERROR;
9292
}
9393

9494
uint32_t len = common_read_32_bit(&data[1]);
@@ -100,6 +100,7 @@ int8_t eap_tls_sec_prot_lib_message_handle(uint8_t *data, uint16_t length, bool
100100
length -= 4;
101101
data += 4;
102102
}
103+
result = EAP_TLS_MSG_MORE_FRAG;
103104
} else if (data[0] == 0) {
104105
// Last (or only) fragment or fragment acknowledge. If sending data
105106
// updates acknowledged fragments.
@@ -115,6 +116,12 @@ int8_t eap_tls_sec_prot_lib_message_handle(uint8_t *data, uint16_t length, bool
115116

116117
// TLS data not included
117118
if (length == 0) {
119+
if (new_seq_id && result == EAP_TLS_MSG_CONTINUE) {
120+
// If received only EAP-TLS header fails, and is not start,
121+
// fragment acknowledge or last frame
122+
result = EAP_TLS_MSG_FAIL;
123+
}
124+
118125
return result;
119126
}
120127

‎source/Security/protocols/eap_tls_sec_prot/eap_tls_sec_prot_lib.h

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,15 +34,18 @@ typedef enum {
3434
EAP_TLS_MSG_START,
3535
EAP_TLS_MSG_CONTINUE,
3636
EAP_TLS_MSG_SEND_DONE,
37+
EAP_TLS_MSG_MORE_FRAG,
3738
EAP_TLS_MSG_RECEIVE_DONE,
38-
EAP_TLS_MSG_ERROR
39+
EAP_TLS_MSG_DECODE_ERROR,
40+
EAP_TLS_MSG_FAIL,
3941
} eap_tls_sec_prot_msg_e;
4042

4143
typedef enum {
4244
EAP_TLS_RESULT_NONE = 0,
4345
EAP_TLS_RESULT_ERROR,
4446
EAP_TLS_RESULT_HANDSHAKE_OVER,
45-
EAP_TLS_RESULT_HANDSHAKE_FAILED
47+
EAP_TLS_RESULT_HANDSHAKE_FAILED,
48+
EAP_TLS_RESULT_HANDSHAKE_FATAL_ERROR,
4649
} eap_tls_sec_prot_result_e;
4750

4851
typedef struct {

‎source/Security/protocols/eap_tls_sec_prot/supp_eap_tls_sec_prot.c

Lines changed: 25 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,8 @@ static int8_t supp_eap_tls_sec_prot_message_handle(sec_prot_t *prot);
8888
static int8_t supp_eap_tls_sec_prot_message_send(sec_prot_t *prot, uint8_t eap_code, uint8_t eap_type, uint8_t tls_state);
8989

9090
static void supp_eap_tls_sec_prot_timer_timeout(sec_prot_t *prot, uint16_t ticks);
91+
static void supp_eap_tls_sec_prot_init_tls(sec_prot_t *prot);
92+
static void supp_eap_tls_sec_prot_delete_tls(sec_prot_t *prot);
9193

9294
static void supp_eap_tls_sec_prot_seq_id_update(sec_prot_t *prot);
9395

@@ -198,7 +200,7 @@ static int8_t supp_eap_tls_sec_prot_message_handle(sec_prot_t *prot)
198200
}
199201

200202
if (!data_ptr || length < 6) {
201-
return EAP_TLS_MSG_ERROR;
203+
return EAP_TLS_MSG_DECODE_ERROR;
202204
}
203205

204206
length -= 5; // EAP fields: code, id, length, type
@@ -276,14 +278,17 @@ static void supp_eap_tls_sec_prot_tls_finished_indication(sec_prot_t *tls_prot,
276278

277279
if (result == SEC_RESULT_OK) {
278280
data->tls_result = EAP_TLS_RESULT_HANDSHAKE_OVER;
281+
} else if (result == SEC_RESULT_CONF_ERROR) {
282+
data->tls_result = EAP_TLS_RESULT_HANDSHAKE_FATAL_ERROR;
279283
} else {
284+
// On failure has sent ALERT
280285
data->tls_result = EAP_TLS_RESULT_HANDSHAKE_FAILED;
281286
}
282287

283288
data->tls_ongoing = false;
284289

285-
if (result == SEC_RESULT_OK) {
286-
// On failure has sent ALERT, on success calls state machine to sent empty EAP-TLS message
290+
if (data->tls_result == EAP_TLS_RESULT_HANDSHAKE_OVER || data->tls_result == EAP_TLS_RESULT_HANDSHAKE_FATAL_ERROR) {
291+
// On fatal error and on success calls state machine to sent empty EAP-TLS message
287292
prot->state_machine_call(prot);
288293
}
289294
}
@@ -333,6 +338,20 @@ static void supp_eap_tls_sec_prot_init_tls(sec_prot_t *prot)
333338
data->tls_ongoing = true;
334339
}
335340

341+
static void supp_eap_tls_sec_prot_delete_tls(sec_prot_t *prot)
342+
{
343+
eap_tls_sec_prot_int_t *data = eap_tls_sec_prot_get(prot);
344+
// If initialized, TLS terminates on its own
345+
if (data->tls_prot) {
346+
return;
347+
}
348+
349+
sec_prot_t *tls_prot = prot->type_get(prot, SEC_PROT_TYPE_TLS);
350+
if (tls_prot) {
351+
tls_prot->finished_send(tls_prot);
352+
}
353+
}
354+
336355
static void supp_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
337356
{
338357
eap_tls_sec_prot_int_t *data = eap_tls_sec_prot_get(prot);
@@ -432,7 +451,7 @@ static void supp_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
432451
} else if (data->eap_code == EAP_REQ) {
433452
// EAP request, handle EAP request, TLS EAP
434453
result = supp_eap_tls_sec_prot_message_handle(prot);
435-
if (result == EAP_TLS_MSG_ERROR) {
454+
if (result == EAP_TLS_MSG_DECODE_ERROR) {
436455
return;
437456
}
438457

@@ -454,9 +473,8 @@ static void supp_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
454473
return;
455474
}
456475
} else {
457-
// Call from TLS
458476
data->wait_tls = false;
459-
if (!data->tls_send.data) {
477+
if (!data->tls_send.data || data->tls_result == EAP_TLS_RESULT_HANDSHAKE_FATAL_ERROR) {
460478
// If no more data send response, TLS EAP (empty)
461479
eap_tls_sec_prot_lib_message_allocate(&data->tls_send, TLS_HEAD_LEN, 0);
462480
}
@@ -478,6 +496,7 @@ static void supp_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
478496
break;
479497

480498
case EAP_TLS_STATE_FINISHED:
499+
supp_eap_tls_sec_prot_delete_tls(prot);
481500
prot->timer_stop(prot);
482501
prot->finished(prot);
483502
break;

‎source/Security/protocols/sec_prot.h

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,8 @@ typedef enum {
3131
SEC_RESULT_OK = 0,
3232
SEC_RESULT_ERR_NO_MEM = -1,
3333
SEC_RESULT_TIMEOUT = -2,
34-
SEC_RESULT_ERROR = -3
34+
SEC_RESULT_ERROR = -3,
35+
SEC_RESULT_CONF_ERROR = -4
3536
} sec_prot_result_e;
3637

3738
typedef enum {
@@ -102,6 +103,14 @@ typedef void sec_prot_finished_indication(sec_prot_t *prot, sec_prot_result_e re
102103
*/
103104
typedef void sec_prot_finished(sec_prot_t *prot);
104105

106+
/**
107+
* sec_prot_finished_send Security protocol finished send
108+
*
109+
* \param prot protocol
110+
*
111+
*/
112+
typedef void sec_prot_finished_send(sec_prot_t *prot);
113+
105114
/**
106115
* sec_prot_receive receive a message
107116
*
@@ -207,6 +216,7 @@ struct sec_prot_s {
207216
sec_prot_create_indication *create_ind; /**< Create indication */
208217
sec_prot_finished_indication *finished_ind; /**< Finished indication */
209218
sec_prot_finished *finished; /**< Finished i.e. ready to be deleted */
219+
sec_prot_finished_send *finished_send; /**< Send finished */
210220

211221
sec_prot_send *send; /**< Protocol send */
212222
sec_prot_receive *receive; /**< Protocol receive */

‎source/Security/protocols/tls_sec_prot/tls_sec_prot.c

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ static void tls_sec_prot_create_request(sec_prot_t *prot, sec_prot_keys_t *sec_k
7575
static void tls_sec_prot_create_response(sec_prot_t *prot, sec_prot_result_e result);
7676
static void tls_sec_prot_delete(sec_prot_t *prot);
7777
static int8_t tls_sec_prot_receive(sec_prot_t *prot, void *pdu, uint16_t size);
78+
static void tls_sec_prot_finished_send(sec_prot_t *prot);
7879

7980
static void client_tls_sec_prot_state_machine(sec_prot_t *prot);
8081
static void server_tls_sec_prot_state_machine(sec_prot_t *prot);
@@ -130,6 +131,7 @@ static int8_t client_tls_sec_prot_init(sec_prot_t *prot)
130131
prot->delete = tls_sec_prot_delete;
131132
prot->state_machine = client_tls_sec_prot_state_machine;
132133
prot->timer_timeout = tls_sec_prot_timer_timeout;
134+
prot->finished_send = tls_sec_prot_finished_send;
133135

134136
tls_sec_prot_int_t *data = tls_sec_prot_get(prot);
135137

@@ -156,6 +158,7 @@ static int8_t server_tls_sec_prot_init(sec_prot_t *prot)
156158
prot->delete = tls_sec_prot_delete;
157159
prot->state_machine = server_tls_sec_prot_state_machine;
158160
prot->timer_timeout = tls_sec_prot_timer_timeout;
161+
prot->finished_send = tls_sec_prot_finished_send;
159162

160163
tls_sec_prot_int_t *data = tls_sec_prot_get(prot);
161164

@@ -213,6 +216,13 @@ static int8_t tls_sec_prot_receive(sec_prot_t *prot, void *pdu, uint16_t size)
213216
return 0;
214217
}
215218

219+
static void tls_sec_prot_finished_send(sec_prot_t *prot)
220+
{
221+
tls_sec_prot_int_t *data = tls_sec_prot_get(prot);
222+
prot->timer_start(prot);
223+
sec_prot_state_set(prot, &data->common, TLS_STATE_FINISHED);
224+
}
225+
216226
static void tls_sec_prot_timer_timeout(sec_prot_t *prot, uint16_t ticks)
217227
{
218228
tls_sec_prot_int_t *data = tls_sec_prot_get(prot);
@@ -264,7 +274,9 @@ static void client_tls_sec_prot_state_machine(sec_prot_t *prot)
264274

265275
case TLS_STATE_CONFIGURE:
266276
if (tls_sec_prot_tls_configure_and_connect(prot, false) < 0) {
277+
sec_prot_result_set(&data->common, SEC_RESULT_CONF_ERROR);
267278
sec_prot_state_set(prot, &data->common, TLS_STATE_FINISH);
279+
return;
268280
}
269281
sec_prot_state_set(prot, &data->common, TLS_STATE_PROCESS);
270282
prot->state_machine(prot);
@@ -335,7 +347,7 @@ static void server_tls_sec_prot_state_machine(sec_prot_t *prot)
335347
// Wait EAP request, Identity (starts handshake on supplicant)
336348
case TLS_STATE_CLIENT_HELLO:
337349

338-
tr_debug("EAP-TLS start");
350+
tr_debug("TLS start");
339351

340352
prot->timer_start(prot);
341353

@@ -358,7 +370,9 @@ static void server_tls_sec_prot_state_machine(sec_prot_t *prot)
358370

359371
case TLS_STATE_CONFIGURE:
360372
if (tls_sec_prot_tls_configure_and_connect(prot, true) < 0) {
373+
sec_prot_result_set(&data->common, SEC_RESULT_CONF_ERROR);
361374
sec_prot_state_set(prot, &data->common, TLS_STATE_FINISH);
375+
return;
362376
}
363377
sec_prot_state_set(prot, &data->common, TLS_STATE_PROCESS);
364378
prot->state_machine(prot);

0 commit comments

Comments
 (0)