arduino/esp8266
1
0
Fork 0
mirror of https://github.com/esp8266/Arduino.git synced 2025-06-17 22:23:10 +03:00
Code Activity

Removed RC4 from the list of negotiated ciphers as browsers don't support it anymore

Browse Source 
git-svn-id: svn://svn.code.sf.net/p/axtls/code/trunk@252 9a5d90b5-6617-0410-8a86-bb477d3ed2e3
This commit is contained in:
cameronrich
2016-06-12 10:51:12 +00:00
committed by Yasuki Ikeuchi
parent ab516f799d
commit 0d6e51aae4
5 changed files with 10 additions and 158 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
crypto/aes.c
View File

@ -1,5 +1,5 @@
/* /*
* Copyright (c) 2007, Cameron Rich * Copyright (c) 2007-2016, Cameron Rich
* *
* All rights reserved. * All rights reserved.
* *
@ -38,9 +38,6 @@
#include "os_port.h" #include "os_port.h"
#include "crypto.h" #include "crypto.h"
/* all commented out in skeleton mode */
#ifndef CONFIG_SSL_SKELETON_MODE
#define rot1(x) (((x) << 24) | ((x) >> 8)) #define rot1(x) (((x) << 24) | ((x) >> 8))
#define rot2(x) (((x) << 16) | ((x) >> 16)) #define rot2(x) (((x) << 16) | ((x) >> 16))
#define rot3(x) (((x) << 8) | ((x) >> 24)) #define rot3(x) (((x) << 8) | ((x) >> 24))
@ -453,5 +450,3 @@ static void AES_decrypt(const AES_CTX *ctx, uint32_t *data)
data[row-1] = tmp[row-1] ^ *(--k); data[row-1] = tmp[row-1] ^ *(--k);
} }
} }
#endif

9
ssl/openssl.c
View File

@ -1,5 +1,5 @@
/* /*
* Copyright (c) 2007, Cameron Rich * Copyright (c) 2007-2016, Cameron Rich
* *
* All rights reserved. * All rights reserved.
* *
@ -49,10 +49,8 @@
static char *key_password = NULL; static char *key_password = NULL;
void *SSLv23_server_method(void) { return NULL; }
void *SSLv3_server_method(void) { return NULL; } void *SSLv3_server_method(void) { return NULL; }
void *TLSv1_server_method(void) { return NULL; } void *TLSv1_server_method(void) { return NULL; }
void *SSLv23_client_method(void) { return NULL; }
void *SSLv3_client_method(void) { return NULL; } void *SSLv3_client_method(void) { return NULL; }
void *TLSv1_client_method(void) { return NULL; } void *TLSv1_client_method(void) { return NULL; }
@ -87,8 +85,7 @@ SSL * SSL_new(SSL_CTX *ssl_ctx)
ssl_func_type = OPENSSL_CTX_ATTR->ssl_func_type; ssl_func_type = OPENSSL_CTX_ATTR->ssl_func_type;
#ifdef CONFIG_SSL_ENABLE_CLIENT #ifdef CONFIG_SSL_ENABLE_CLIENT
if (ssl_func_type == SSLv23_client_method || if (ssl_func_type == SSLv3_client_method ||
ssl_func_type == SSLv3_client_method ||
ssl_func_type == TLSv1_client_method) ssl_func_type == TLSv1_client_method)
{ {
SET_SSL_FLAG(SSL_IS_CLIENT); SET_SSL_FLAG(SSL_IS_CLIENT);
@ -231,8 +228,6 @@ void SSL_CTX_set_client_CA_list(SSL_CTX *ssl_ctx, void *file)
ssl_obj_load(ssl_ctx, SSL_OBJ_X509_CERT, (const char *)file, NULL); ssl_obj_load(ssl_ctx, SSL_OBJ_X509_CERT, (const char *)file, NULL);
} }
void SSLv23_method(void) { }
void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, void *cb) { } void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, void *cb) { }
void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx, void *u) void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx, void *u)

75
ssl/tls1.c
View File

@ -59,41 +59,19 @@ static int increase_bm_data_size(SSL *ssl, size_t size);
* The server will pick the cipher based on the order that the order that the * The server will pick the cipher based on the order that the order that the
* ciphers are listed. This order is defined at compile time. * ciphers are listed. This order is defined at compile time.
*/ */
#ifdef CONFIG_SSL_SKELETON_MODE
const uint8_t ssl_prot_prefs[NUM_PROTOCOLS] =
{ SSL_RC4_128_SHA };
#else
static void session_free(SSL_SESSION *ssl_sessions[], int sess_index); static void session_free(SSL_SESSION *ssl_sessions[], int sess_index);
const uint8_t ssl_prot_prefs[NUM_PROTOCOLS] = const uint8_t ssl_prot_prefs[NUM_PROTOCOLS] =
#ifdef CONFIG_SSL_PROT_LOW /* low security, fast speed */ #ifdef CONFIG_SSL_PROT_LOW /* same as medium for now */
{ SSL_AES128_SHA, SSL_AES256_SHA}; { SSL_AES128_SHA, SSL_AES256_SHA };
#elif CONFIG_SSL_PROT_MEDIUM /* medium security, medium speed */ #elif CONFIG_SSL_PROT_MEDIUM /* medium security, medium speed */
{ SSL_AES128_SHA, SSL_AES256_SHA}; { SSL_AES128_SHA, SSL_AES256_SHA };
#else /* CONFIG_SSL_PROT_HIGH */ /* high security, low speed */ #else /* CONFIG_SSL_PROT_HIGH */ /* high security, low speed */
{ SSL_AES256_SHA, SSL_AES128_SHA}; { SSL_AES256_SHA, SSL_AES128_SHA };
#endif #endif
#endif /* CONFIG_SSL_SKELETON_MODE */
/** /**
* The cipher map containing all the essentials for each cipher. * The cipher map containing all the essentials for each cipher.
*/ */
#ifdef CONFIG_SSL_SKELETON_MODE
static const cipher_info_t cipher_info[NUM_PROTOCOLS] =
{
{ /* RC4-SHA */
SSL_RC4_128_SHA, /* RC4-SHA */
16, /* key size */
0, /* iv size */
2*(SHA1_SIZE+16), /* key block size */
0, /* no padding */
SHA1_SIZE, /* digest size */
hmac_sha1, /* hmac algorithm */
(crypt_func)RC4_crypt, /* encrypt */
(crypt_func)RC4_crypt /* decrypt */
},
};
#else
static const cipher_info_t cipher_info[NUM_PROTOCOLS] = static const cipher_info_t cipher_info[NUM_PROTOCOLS] =
{ {
{ /* AES128-SHA */ { /* AES128-SHA */
@ -117,9 +95,8 @@ static const cipher_info_t cipher_info[NUM_PROTOCOLS] =
hmac_sha1, /* hmac algorithm */ hmac_sha1, /* hmac algorithm */
(crypt_func)AES_cbc_encrypt, /* encrypt */ (crypt_func)AES_cbc_encrypt, /* encrypt */
(crypt_func)AES_cbc_decrypt /* decrypt */ (crypt_func)AES_cbc_decrypt /* decrypt */
} },
}; };
#endif
static void prf(const uint8_t *sec, int sec_len, uint8_t *seed, int seed_len, static void prf(const uint8_t *sec, int sec_len, uint8_t *seed, int seed_len,
uint8_t *out, int olen); uint8_t *out, int olen);
@ -908,7 +885,6 @@ static void *crypt_new(SSL *ssl, uint8_t *key, uint8_t *iv, int is_decrypt, void
{ {
switch (ssl->cipher) switch (ssl->cipher)
{ {
#ifndef CONFIG_SSL_SKELETON_MODE
case SSL_AES128_SHA: case SSL_AES128_SHA:
{ {
AES_CTX *aes_ctx; AES_CTX *aes_ctx;
@ -943,20 +919,6 @@ static void *crypt_new(SSL *ssl, uint8_t *key, uint8_t *iv, int is_decrypt, void
return (void *)aes_ctx; return (void *)aes_ctx;
} }
case SSL_RC4_128_MD5:
#endif
case SSL_RC4_128_SHA:
{
RC4_CTX* rc4_ctx;
if (cached)
rc4_ctx = (RC4_CTX*) cached;
else
rc4_ctx = (RC4_CTX*) malloc(sizeof(RC4_CTX));
RC4_setup(rc4_ctx, key, 16);
return (void *)rc4_ctx;
}
} }
return NULL; /* its all gone wrong */ return NULL; /* its all gone wrong */
@ -1177,7 +1139,6 @@ static int set_key_block(SSL *ssl, int is_write)
memcpy(server_key, q, ciph_info->key_size); memcpy(server_key, q, ciph_info->key_size);
q += ciph_info->key_size; q += ciph_info->key_size;
#ifndef CONFIG_SSL_SKELETON_MODE
if (ciph_info->iv_size) /* RC4 has no IV, AES does */ if (ciph_info->iv_size) /* RC4 has no IV, AES does */
{ {
memcpy(client_iv, q, ciph_info->iv_size); memcpy(client_iv, q, ciph_info->iv_size);
@ -1185,7 +1146,6 @@ static int set_key_block(SSL *ssl, int is_write)
memcpy(server_iv, q, ciph_info->iv_size); memcpy(server_iv, q, ciph_info->iv_size);
q += ciph_info->iv_size; q += ciph_info->iv_size;
} }
#endif
// free(is_write ? ssl->encrypt_ctx : ssl->decrypt_ctx); // free(is_write ? ssl->encrypt_ctx : ssl->decrypt_ctx);
@ -1261,31 +1221,8 @@ int basic_read(SSL *ssl, uint8_t **in_data)
/* check for sslv2 "client hello" */ /* check for sslv2 "client hello" */
if (buf[0] & 0x80 && buf[2] == 1) if (buf[0] & 0x80 && buf[2] == 1)
{ {
#ifdef CONFIG_SSL_ENABLE_V23_HANDSHAKE
uint8_t version = (buf[3] << 4) + buf[4];
DISPLAY_BYTES(ssl, "ssl2 record", buf, 5);
/* should be v3.1 (TLSv1) or better */
ssl->version = ssl->client_version = version;
if (version > SSL_PROTOCOL_VERSION_MAX)
{
/* use client's version */
ssl->version = SSL_PROTOCOL_VERSION_MAX;
}
else if (version < SSL_PROTOCOL_MIN_VERSION)
{
ret = SSL_ERROR_INVALID_VERSION;
ssl_display_error(ret);
return ret;
}
add_packet(ssl, &buf[2], 3);
ret = process_sslv23_client_hello(ssl);
#else
printf("Error: no SSLv23 handshaking allowed\n"); TTY_FLUSH(); printf("Error: no SSLv23 handshaking allowed\n"); TTY_FLUSH();
ret = SSL_ERROR_NOT_SUPPORTED; ret = SSL_ERROR_NOT_SUPPORTED;
#endif
goto error; /* not an error - just get out of here */ goto error; /* not an error - just get out of here */
} }

4
ssl/tls1.h
View File

@ -79,11 +79,7 @@ extern "C" {
#define RT_EXTRA 1024 #define RT_EXTRA 1024
#define BM_RECORD_OFFSET 5 #define BM_RECORD_OFFSET 5
#ifdef CONFIG_SSL_SKELETON_MODE
#define NUM_PROTOCOLS 1
#else
#define NUM_PROTOCOLS 2 #define NUM_PROTOCOLS 2
#endif
#define PARANOIA_CHECK(A, B) if (A < B) { \ #define PARANOIA_CHECK(A, B) if (A < B) { \
ret = SSL_ERROR_INVALID_HANDSHAKE; goto error; } ret = SSL_ERROR_INVALID_HANDSHAKE; goto error; }

73
ssl/tls1_svr.c
View File

@ -1,5 +1,5 @@
/* /*
* Copyright (c) 2007, Cameron Rich * Copyright (c) 2007-2016, Cameron Rich
* *
* All rights reserved. * All rights reserved.
* *
@ -178,77 +178,6 @@ error:
return ret; return ret;
} }
#ifdef CONFIG_SSL_ENABLE_V23_HANDSHAKE
/*
* Some browsers use a hybrid SSLv2 "client hello"
*/
int process_sslv23_client_hello(SSL *ssl)
{
uint8_t *buf = ssl->bm_data;
int bytes_needed = ((buf[0] & 0x7f) << 8) + buf[1];
int ret = SSL_OK;
/* we have already read 3 extra bytes so far */
int read_len = SOCKET_READ(ssl->client_fd, buf, bytes_needed-3);
int cs_len = buf[1];
int id_len = buf[3];
int ch_len = buf[5];
int i, j, offset = 8; /* start at first cipher */
int random_offset = 0;
DISPLAY_BYTES(ssl, "received %d bytes", buf, read_len, read_len);
/* connection has gone, so die */
if (read_len < 0)
{
return SSL_ERROR_CONN_LOST;
}
add_packet(ssl, buf, read_len);
/* now work out what cipher suite we are going to use */
for (j = 0; j < NUM_PROTOCOLS; j++)
{
for (i = 0; i < cs_len; i += 3)
{
if (ssl_prot_prefs[j] == buf[offset+i])
{
ssl->cipher = ssl_prot_prefs[j];
goto server_hello;
}
}
}
/* ouch! protocol is not supported */
ret = SSL_ERROR_NO_CIPHER;
goto error;
server_hello:
/* get the session id */
offset += cs_len - 2; /* we've gone 2 bytes past the end */
#ifndef CONFIG_SSL_SKELETON_MODE
ssl->session = ssl_session_update(ssl->ssl_ctx->num_sessions,
ssl->ssl_ctx->ssl_sessions, ssl, id_len ? &buf[offset] : NULL);
#endif
/* get the client random data */
offset += id_len;
/* random can be anywhere between 16 and 32 bytes long - so it is padded
* with 0's to the left */
if (ch_len == 0x10)
{
random_offset += 0x10;
}
memcpy(&ssl->dc->client_random[random_offset], &buf[offset], ch_len);
ret = send_server_hello_sequence(ssl);
error:
return ret;
}
#endif
/* /*
* Send the entire server hello sequence * Send the entire server hello sequence
*/ */