Merge tizen_5.0 codes into tizen_4.0

[platform/upstream/iotivity.git] / resource / csdk / connectivity / src / adapter_util / ca_adapter_net_ssl.c

diff --git a/resource/csdk/connectivity/src/adapter_util/ca_adapter_net_ssl.c b/resource/csdk/connectivity/src/adapter_util/ca_adapter_net_ssl.c
index 73831e4..187d23c 100644 (file)
--- a/resource/csdk/connectivity/src/adapter_util/ca_adapter_net_ssl.c
+++ b/resource/csdk/connectivity/src/adapter_util/ca_adapter_net_ssl.c
@@ -36,6 +36,7 @@
 #include "ocrandom.h"
 #include "byte_array.h"
 #include "octhread.h"
+#include "octypes.h"
 #include "timer.h"
 
 
@@ -519,6 +520,11 @@ static CAgetCredentialTypesHandler g_getCredentialTypesCallback = NULL;
 static CAgetPkixInfoHandler g_getPkixInfoCallback = NULL;
 
 /**
+ * Callback to inform in case of client's certificate absence
+ */
+static CertificateVerificationCallback_t g_CertificateVerificationCallback = NULL;
+
+/**
  * @var g_setupPkContextCallback
  *
  * @brief callback to setup PK context handler for H/W based Public Key Infrastructure
@@ -614,6 +620,20 @@ void CAsetCredentialTypesCallback(CAgetCredentialTypesHandler credTypesCallback)
     OIC_LOG_V(DEBUG, NET_SSL_TAG, "Out %s", __func__);
 }
 
+void CAsetCertificateVerificationCallback(CertificateVerificationCallback_t certVerifyStatusCallback)
+{
+    OIC_LOG_V(DEBUG, NET_SSL_TAG, "In %s", __func__);
+    g_CertificateVerificationCallback = certVerifyStatusCallback;
+    OIC_LOG_V(DEBUG, NET_SSL_TAG, "Out %s", __func__);
+}
+
+void CAunsetCertificateVerificationCallback()
+{
+    OIC_LOG_V(DEBUG, NET_SSL_TAG, "In %s", __func__);
+    g_CertificateVerificationCallback = NULL;
+    OIC_LOG_V(DEBUG, NET_SSL_TAG, "Out %s", __func__);
+}
+
 static int GetAdapterIndex(CATransportAdapter_t adapter)
 {
     switch (adapter)
@@ -660,7 +680,7 @@ static int SendCallBack(void * tep, const unsigned char * data, size_t dataLen)
         else if ((size_t)sentLen != dataLen)
         {
             OIC_LOG_V(DEBUG, NET_SSL_TAG,
-                    "Packet was partially sent - total/sent/remained bytes : %zd/%zu/%lu",
+                    "Packet was partially sent - total/sent/remained bytes : %zd/%zu/%zu",
                     sentLen, dataLen, (dataLen - sentLen));
         }
     }
@@ -1410,9 +1430,9 @@ static void RemovePeerFromList(const CAEndpoint_t * endpoint)
                 && (endpoint->port == tep->sep.endpoint.port || CA_ADAPTER_GATT_BTLE == endpoint->adapter))
         {
             u_arraylist_remove(g_caSslContext->peerList, listIndex);
-            DeleteSslEndPoint(tep);
             OIC_LOG_V(INFO, NET_SSL_TAG, "Remove Peer:[%s:%d] for %d adapter",
                     endpoint->addr, endpoint->port, endpoint->adapter);
+            DeleteSslEndPoint(tep);
             OIC_LOG_V(DEBUG, NET_SSL_TAG, "Out %s", __func__);
             return;
         }
@@ -1698,6 +1718,11 @@ static void SetupCipher(mbedtls_ssl_config * config, CATransportAdapter_t adapte
 
     memset(g_cipherSuitesList, 0, sizeof(g_cipherSuitesList));
 
+    if (SSL_CIPHER_MAX < g_caSslContext->cipher)
+    {
+        OIC_LOG(ERROR, NET_SSL_TAG, "Maximum ciphersuite index exceeded");
+    }
+
     // Add the preferred ciphersuite first
     if (SSL_CIPHER_MAX != g_caSslContext->cipher)
     {
@@ -2335,7 +2360,6 @@ CAResult_t CAdecryptSsl(const CASecureEndpoint_t *sep, uint8_t *data, uint32_t d
         return CA_STATUS_FAILED;
     }
 
-
     SslEndPoint_t * peer = GetSslPeer(&sep->endpoint);
     if (NULL == peer)
     {
@@ -2383,15 +2407,14 @@ CAResult_t CAdecryptSsl(const CASecureEndpoint_t *sep, uint8_t *data, uint32_t d
                                                  sizeof(sep->endpoint.addr));
             ret = mbedtls_ssl_handshake_step(&peer->ssl);
         }
-        if (MBEDTLS_SSL_IS_CLIENT == peer->ssl.conf->endpoint)
+        uint32_t flags = mbedtls_ssl_get_verify_result(&peer->ssl);
+        if (0 != flags &&
+           ((MBEDTLS_SSL_IS_CLIENT == peer->ssl.conf->endpoint) ||
+            (MBEDTLS_SSL_IS_SERVER == peer->ssl.conf->endpoint && MBEDTLS_X509_BADCERT_MISSING != flags)))
         {
-            uint32_t flags = mbedtls_ssl_get_verify_result(&peer->ssl);
-            if (0 != flags)
-            {
-                OIC_LOG_BUFFER(ERROR, NET_SSL_TAG, (const uint8_t *) &flags, sizeof(flags));
-                SSL_CHECK_FAIL(peer, flags, "Cert verification failed", 1,
-                                                         CA_STATUS_FAILED, GetAlertCode(flags));
-            }
+            OIC_LOG_BUFFER(ERROR, NET_SSL_TAG, (const uint8_t *) &flags, sizeof(flags));
+            SSL_CHECK_FAIL(peer, flags, "Cert verification failed", 1,
+                                                     CA_STATUS_FAILED, GetAlertCode(flags));
         }
         SSL_CHECK_FAIL(peer, ret, "Handshake error", 1, CA_STATUS_FAILED, MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE);
         if (MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC == peer->ssl.state)
@@ -2422,6 +2445,22 @@ CAResult_t CAdecryptSsl(const CASecureEndpoint_t *sep, uint8_t *data, uint32_t d
                 void * userIdPos = NULL;
                 const mbedtls_x509_crt * peerCert = mbedtls_ssl_get_peer_cert(&peer->ssl);
                 ret = (NULL == peerCert ? -1 : 0);
+                if (g_CertificateVerificationCallback)
+                {
+                    uint32_t flags = mbedtls_ssl_get_verify_result(&peer->ssl);
+                    if (!flags)
+                    {
+                        g_CertificateVerificationCallback(CA_CERTIFICATE_VERIFY_SUCCESS_MUTUAL);
+                    }
+                    else if (MBEDTLS_X509_BADCERT_MISSING == flags)
+                    {
+                        g_CertificateVerificationCallback(CA_CERTIFICATE_VERIFY_NO_CERT);
+                    }
+                    else
+                    {
+                        g_CertificateVerificationCallback(CA_CERTIFICATE_VERIFY_FAILED);
+                    }
+                }
                 //SSL_CHECK_FAIL(peer, ret, "Failed to retrieve cert", 1,
                 //                            CA_STATUS_FAILED, MBEDTLS_SSL_ALERT_MSG_NO_CERT);
                 if (0 == ret)