Skip to content

Commit ce72b55

Browse files
author
Juha Heiskanen
authored
Merge pull request ARMmbed#1958 from ARMmbed/tls_conf_err
Added handling for mbed TLS configuration error
2 parents 4802aae + 1e8b18c commit ce72b55

File tree

7 files changed

+98
-14
lines changed

7 files changed

+98
-14
lines changed

‎source/Security/kmp/kmp_api.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,8 @@ kmp_api_t *kmp_api_create(kmp_service_t *service, kmp_type_e type)
127127
kmp->service = service;
128128
kmp->timer_start_pending = false;
129129

130+
memset(&kmp->sec_prot, 0, sec_size);
131+
130132
kmp->sec_prot.header_size = service->header_size;
131133
kmp->sec_prot.create_conf = kmp_api_sec_prot_create_confirm;
132134
kmp->sec_prot.create_ind = kmp_api_sec_prot_create_indication;

‎source/Security/protocols/eap_tls_sec_prot/auth_eap_tls_sec_prot.c

Lines changed: 32 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,7 @@ static int8_t auth_eap_tls_sec_prot_message_send(sec_prot_t *prot, uint8_t eap_c
8989

9090
static void auth_eap_tls_sec_prot_timer_timeout(sec_prot_t *prot, uint16_t ticks);
9191
static void auth_eap_tls_sec_prot_init_tls(sec_prot_t *prot);
92+
static void auth_eap_tls_sec_prot_delete_tls(sec_prot_t *prot);
9293

9394
static void auth_eap_tls_sec_prot_seq_id_update(sec_prot_t *prot);
9495

@@ -202,7 +203,7 @@ static int8_t auth_eap_tls_sec_prot_message_handle(sec_prot_t *prot)
202203
}
203204

204205
if (!data_ptr || length < 6) {
205-
return EAP_TLS_MSG_ERROR;
206+
return EAP_TLS_MSG_DECODE_ERROR;
206207
}
207208

208209
length -= 5; // EAP fields: code, id, length, type
@@ -266,11 +267,18 @@ static void auth_eap_tls_sec_prot_tls_finished_indication(sec_prot_t *tls_prot,
266267

267268
if (result == SEC_RESULT_OK) {
268269
data->tls_result = EAP_TLS_RESULT_HANDSHAKE_OVER;
270+
} else if (result == SEC_RESULT_CONF_ERROR) {
271+
data->tls_result = EAP_TLS_RESULT_HANDSHAKE_FATAL_ERROR;
269272
} else {
270273
data->tls_result = EAP_TLS_RESULT_HANDSHAKE_FAILED;
271274
}
272275

273276
data->tls_ongoing = false;
277+
278+
if (data->tls_result == EAP_TLS_RESULT_HANDSHAKE_FATAL_ERROR) {
279+
// On fatal error terminate right away
280+
prot->state_machine_call(prot);
281+
}
274282
}
275283

276284
static int8_t auth_eap_tls_sec_prot_tls_send(sec_prot_t *tls_prot, void *pdu, uint16_t size)
@@ -318,6 +326,20 @@ static void auth_eap_tls_sec_prot_init_tls(sec_prot_t *prot)
318326
data->tls_ongoing = true;
319327
}
320328

329+
static void auth_eap_tls_sec_prot_delete_tls(sec_prot_t *prot)
330+
{
331+
eap_tls_sec_prot_int_t *data = eap_tls_sec_prot_get(prot);
332+
// If initialized, TLS terminates on its own
333+
if (data->tls_prot) {
334+
return;
335+
}
336+
337+
sec_prot_t *tls_prot = prot->type_get(prot, SEC_PROT_TYPE_TLS);
338+
if (tls_prot) {
339+
tls_prot->finished_send(tls_prot);
340+
}
341+
}
342+
321343
static void auth_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
322344
{
323345
eap_tls_sec_prot_int_t *data = eap_tls_sec_prot_get(prot);
@@ -399,7 +421,7 @@ static void auth_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
399421
if (data->eap_code == EAP_RESPONSE) {
400422
// Handle EAP response, TLS EAP
401423
result = auth_eap_tls_sec_prot_message_handle(prot);
402-
if (result == EAP_TLS_MSG_ERROR) {
424+
if (result == EAP_TLS_MSG_DECODE_ERROR) {
403425
return;
404426
}
405427
if (result == EAP_TLS_MSG_IDENTITY) {
@@ -433,12 +455,18 @@ static void auth_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
433455
return;
434456
}
435457
} else {
458+
// Call from TLS
459+
if (data->tls_result == EAP_TLS_RESULT_HANDSHAKE_FATAL_ERROR) {
460+
// Send failure
461+
eap_tls_sec_prot_lib_message_free(&data->tls_send);
462+
}
463+
436464
// Call from TLS
437465
data->wait_tls = false;
438466
}
439467

440468
// TLS EAP message to be send
441-
if (data->tls_send.data) {
469+
if (data->tls_send.total_len > 0 || result == EAP_TLS_MSG_MORE_FRAG) {
442470
data->send_pending = false;
443471

444472
// Sends EAP request, TLS EAP, TLS exchange
@@ -473,6 +501,7 @@ static void auth_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
473501
break;
474502

475503
case EAP_TLS_STATE_FINISHED:
504+
auth_eap_tls_sec_prot_delete_tls(prot);
476505
prot->timer_stop(prot);
477506
prot->finished(prot);
478507
break;

‎source/Security/protocols/eap_tls_sec_prot/eap_tls_sec_prot_lib.c

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ int8_t eap_tls_sec_prot_lib_message_handle(uint8_t *data, uint16_t length, bool
8888
// Handles the length field
8989
if (data[0] & EAP_TLS_FRAGMENT_LENGTH) {
9090
if (length < 5) {
91-
return EAP_TLS_MSG_ERROR;
91+
return EAP_TLS_MSG_DECODE_ERROR;
9292
}
9393

9494
uint32_t len = common_read_32_bit(&data[1]);
@@ -100,6 +100,7 @@ int8_t eap_tls_sec_prot_lib_message_handle(uint8_t *data, uint16_t length, bool
100100
length -= 4;
101101
data += 4;
102102
}
103+
result = EAP_TLS_MSG_MORE_FRAG;
103104
} else if (data[0] == 0) {
104105
// Last (or only) fragment or fragment acknowledge. If sending data
105106
// updates acknowledged fragments.
@@ -115,6 +116,12 @@ int8_t eap_tls_sec_prot_lib_message_handle(uint8_t *data, uint16_t length, bool
115116

116117
// TLS data not included
117118
if (length == 0) {
119+
if (new_seq_id && result == EAP_TLS_MSG_CONTINUE) {
120+
// If received only EAP-TLS header fails, and is not start,
121+
// fragment acknowledge or last frame
122+
result = EAP_TLS_MSG_FAIL;
123+
}
124+
118125
return result;
119126
}
120127

‎source/Security/protocols/eap_tls_sec_prot/eap_tls_sec_prot_lib.h

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,15 +34,18 @@ typedef enum {
3434
EAP_TLS_MSG_START,
3535
EAP_TLS_MSG_CONTINUE,
3636
EAP_TLS_MSG_SEND_DONE,
37+
EAP_TLS_MSG_MORE_FRAG,
3738
EAP_TLS_MSG_RECEIVE_DONE,
38-
EAP_TLS_MSG_ERROR
39+
EAP_TLS_MSG_DECODE_ERROR,
40+
EAP_TLS_MSG_FAIL,
3941
} eap_tls_sec_prot_msg_e;
4042

4143
typedef enum {
4244
EAP_TLS_RESULT_NONE = 0,
4345
EAP_TLS_RESULT_ERROR,
4446
EAP_TLS_RESULT_HANDSHAKE_OVER,
45-
EAP_TLS_RESULT_HANDSHAKE_FAILED
47+
EAP_TLS_RESULT_HANDSHAKE_FAILED,
48+
EAP_TLS_RESULT_HANDSHAKE_FATAL_ERROR,
4649
} eap_tls_sec_prot_result_e;
4750

4851
typedef struct {

‎source/Security/protocols/eap_tls_sec_prot/supp_eap_tls_sec_prot.c

Lines changed: 25 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,8 @@ static int8_t supp_eap_tls_sec_prot_message_handle(sec_prot_t *prot);
8888
static int8_t supp_eap_tls_sec_prot_message_send(sec_prot_t *prot, uint8_t eap_code, uint8_t eap_type, uint8_t tls_state);
8989

9090
static void supp_eap_tls_sec_prot_timer_timeout(sec_prot_t *prot, uint16_t ticks);
91+
static void supp_eap_tls_sec_prot_init_tls(sec_prot_t *prot);
92+
static void supp_eap_tls_sec_prot_delete_tls(sec_prot_t *prot);
9193

9294
static void supp_eap_tls_sec_prot_seq_id_update(sec_prot_t *prot);
9395

@@ -198,7 +200,7 @@ static int8_t supp_eap_tls_sec_prot_message_handle(sec_prot_t *prot)
198200
}
199201

200202
if (!data_ptr || length < 6) {
201-
return EAP_TLS_MSG_ERROR;
203+
return EAP_TLS_MSG_DECODE_ERROR;
202204
}
203205

204206
length -= 5; // EAP fields: code, id, length, type
@@ -276,14 +278,17 @@ static void supp_eap_tls_sec_prot_tls_finished_indication(sec_prot_t *tls_prot,
276278

277279
if (result == SEC_RESULT_OK) {
278280
data->tls_result = EAP_TLS_RESULT_HANDSHAKE_OVER;
281+
} else if (result == SEC_RESULT_CONF_ERROR) {
282+
data->tls_result = EAP_TLS_RESULT_HANDSHAKE_FATAL_ERROR;
279283
} else {
284+
// On failure has sent ALERT
280285
data->tls_result = EAP_TLS_RESULT_HANDSHAKE_FAILED;
281286
}
282287

283288
data->tls_ongoing = false;
284289

285-
if (result == SEC_RESULT_OK) {
286-
// On failure has sent ALERT, on success calls state machine to sent empty EAP-TLS message
290+
if (data->tls_result == EAP_TLS_RESULT_HANDSHAKE_OVER || data->tls_result == EAP_TLS_RESULT_HANDSHAKE_FATAL_ERROR) {
291+
// On fatal error and on success calls state machine to sent empty EAP-TLS message
287292
prot->state_machine_call(prot);
288293
}
289294
}
@@ -333,6 +338,20 @@ static void supp_eap_tls_sec_prot_init_tls(sec_prot_t *prot)
333338
data->tls_ongoing = true;
334339
}
335340

341+
static void supp_eap_tls_sec_prot_delete_tls(sec_prot_t *prot)
342+
{
343+
eap_tls_sec_prot_int_t *data = eap_tls_sec_prot_get(prot);
344+
// If initialized, TLS terminates on its own
345+
if (data->tls_prot) {
346+
return;
347+
}
348+
349+
sec_prot_t *tls_prot = prot->type_get(prot, SEC_PROT_TYPE_TLS);
350+
if (tls_prot) {
351+
tls_prot->finished_send(tls_prot);
352+
}
353+
}
354+
336355
static void supp_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
337356
{
338357
eap_tls_sec_prot_int_t *data = eap_tls_sec_prot_get(prot);
@@ -432,7 +451,7 @@ static void supp_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
432451
} else if (data->eap_code == EAP_REQ) {
433452
// EAP request, handle EAP request, TLS EAP
434453
result = supp_eap_tls_sec_prot_message_handle(prot);
435-
if (result == EAP_TLS_MSG_ERROR) {
454+
if (result == EAP_TLS_MSG_DECODE_ERROR) {
436455
return;
437456
}
438457

@@ -454,9 +473,8 @@ static void supp_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
454473
return;
455474
}
456475
} else {
457-
// Call from TLS
458476
data->wait_tls = false;
459-
if (!data->tls_send.data) {
477+
if (!data->tls_send.data || data->tls_result == EAP_TLS_RESULT_HANDSHAKE_FATAL_ERROR) {
460478
// If no more data send response, TLS EAP (empty)
461479
eap_tls_sec_prot_lib_message_allocate(&data->tls_send, TLS_HEAD_LEN, 0);
462480
}
@@ -478,6 +496,7 @@ static void supp_eap_tls_sec_prot_state_machine(sec_prot_t *prot)
478496
break;
479497

480498
case EAP_TLS_STATE_FINISHED:
499+
supp_eap_tls_sec_prot_delete_tls(prot);
481500
prot->timer_stop(prot);
482501
prot->finished(prot);
483502
break;

‎source/Security/protocols/sec_prot.h

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,8 @@ typedef enum {
3131
SEC_RESULT_OK = 0,
3232
SEC_RESULT_ERR_NO_MEM = -1,
3333
SEC_RESULT_TIMEOUT = -2,
34-
SEC_RESULT_ERROR = -3
34+
SEC_RESULT_ERROR = -3,
35+
SEC_RESULT_CONF_ERROR = -4
3536
} sec_prot_result_e;
3637

3738
typedef enum {
@@ -102,6 +103,14 @@ typedef void sec_prot_finished_indication(sec_prot_t *prot, sec_prot_result_e re
102103
*/
103104
typedef void sec_prot_finished(sec_prot_t *prot);
104105

106+
/**
107+
* sec_prot_finished_send Security protocol finished send
108+
*
109+
* \param prot protocol
110+
*
111+
*/
112+
typedef void sec_prot_finished_send(sec_prot_t *prot);
113+
105114
/**
106115
* sec_prot_receive receive a message
107116
*
@@ -207,6 +216,7 @@ struct sec_prot_s {
207216
sec_prot_create_indication *create_ind; /**< Create indication */
208217
sec_prot_finished_indication *finished_ind; /**< Finished indication */
209218
sec_prot_finished *finished; /**< Finished i.e. ready to be deleted */
219+
sec_prot_finished_send *finished_send; /**< Send finished */
210220

211221
sec_prot_send *send; /**< Protocol send */
212222
sec_prot_receive *receive; /**< Protocol receive */

‎source/Security/protocols/tls_sec_prot/tls_sec_prot.c

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ static void tls_sec_prot_create_request(sec_prot_t *prot, sec_prot_keys_t *sec_k
7575
static void tls_sec_prot_create_response(sec_prot_t *prot, sec_prot_result_e result);
7676
static void tls_sec_prot_delete(sec_prot_t *prot);
7777
static int8_t tls_sec_prot_receive(sec_prot_t *prot, void *pdu, uint16_t size);
78+
static void tls_sec_prot_finished_send(sec_prot_t *prot);
7879

7980
static void client_tls_sec_prot_state_machine(sec_prot_t *prot);
8081
static void server_tls_sec_prot_state_machine(sec_prot_t *prot);
@@ -130,6 +131,7 @@ static int8_t client_tls_sec_prot_init(sec_prot_t *prot)
130131
prot->delete = tls_sec_prot_delete;
131132
prot->state_machine = client_tls_sec_prot_state_machine;
132133
prot->timer_timeout = tls_sec_prot_timer_timeout;
134+
prot->finished_send = tls_sec_prot_finished_send;
133135

134136
tls_sec_prot_int_t *data = tls_sec_prot_get(prot);
135137

@@ -156,6 +158,7 @@ static int8_t server_tls_sec_prot_init(sec_prot_t *prot)
156158
prot->delete = tls_sec_prot_delete;
157159
prot->state_machine = server_tls_sec_prot_state_machine;
158160
prot->timer_timeout = tls_sec_prot_timer_timeout;
161+
prot->finished_send = tls_sec_prot_finished_send;
159162

160163
tls_sec_prot_int_t *data = tls_sec_prot_get(prot);
161164

@@ -213,6 +216,13 @@ static int8_t tls_sec_prot_receive(sec_prot_t *prot, void *pdu, uint16_t size)
213216
return 0;
214217
}
215218

219+
static void tls_sec_prot_finished_send(sec_prot_t *prot)
220+
{
221+
tls_sec_prot_int_t *data = tls_sec_prot_get(prot);
222+
prot->timer_start(prot);
223+
sec_prot_state_set(prot, &data->common, TLS_STATE_FINISHED);
224+
}
225+
216226
static void tls_sec_prot_timer_timeout(sec_prot_t *prot, uint16_t ticks)
217227
{
218228
tls_sec_prot_int_t *data = tls_sec_prot_get(prot);
@@ -264,7 +274,9 @@ static void client_tls_sec_prot_state_machine(sec_prot_t *prot)
264274

265275
case TLS_STATE_CONFIGURE:
266276
if (tls_sec_prot_tls_configure_and_connect(prot, false) < 0) {
277+
sec_prot_result_set(&data->common, SEC_RESULT_CONF_ERROR);
267278
sec_prot_state_set(prot, &data->common, TLS_STATE_FINISH);
279+
return;
268280
}
269281
sec_prot_state_set(prot, &data->common, TLS_STATE_PROCESS);
270282
prot->state_machine(prot);
@@ -335,7 +347,7 @@ static void server_tls_sec_prot_state_machine(sec_prot_t *prot)
335347
// Wait EAP request, Identity (starts handshake on supplicant)
336348
case TLS_STATE_CLIENT_HELLO:
337349

338-
tr_debug("EAP-TLS start");
350+
tr_debug("TLS start");
339351

340352
prot->timer_start(prot);
341353

@@ -358,7 +370,9 @@ static void server_tls_sec_prot_state_machine(sec_prot_t *prot)
358370

359371
case TLS_STATE_CONFIGURE:
360372
if (tls_sec_prot_tls_configure_and_connect(prot, true) < 0) {
373+
sec_prot_result_set(&data->common, SEC_RESULT_CONF_ERROR);
361374
sec_prot_state_set(prot, &data->common, TLS_STATE_FINISH);
375+
return;
362376
}
363377
sec_prot_state_set(prot, &data->common, TLS_STATE_PROCESS);
364378
prot->state_machine(prot);

0 commit comments

Comments
 (0)