*/
#define UUID_LENGTH (128/8)
/**
+ * @def UUID_STR_SIZE
+ * @brief Size of string representation RFC4122 based UUID.
+ * 32 chars for hex data and 4 '-' symbols.
+ */
+#define UUID_STR_SIZE (36)
+
+/**
* @def MASTER_SECRET_LEN
* @brief TLS master secret length
*/
else
{
unsigned char * lastCert = (unsigned char *)OICMalloc((len + 1) * sizeof(unsigned char));
+ if (lastCert == NULL)
+ {
+ goto exit;
+ }
memcpy(lastCert, buf + pos, len);
lastCert[len] = 0x00;
ret = mbedtls_x509_crt_parse(crt, lastCert, len + 1);
}
#endif
+CAResult_t SetCASecureEndpointUuid(const CAEndpoint_t *peer, const char *uuid)
+{
+ OIC_LOG_V(DEBUG, NET_SSL_TAG, "In %s", __func__);
+ VERIFY_NON_NULL(peer, NET_SSL_TAG, "peer");
+ VERIFY_NON_NULL(peer, NET_SSL_TAG, "uuid");
+
+ oc_mutex_lock(g_sslContextMutex);
+ SslEndPoint_t *sslPeer = GetSslPeer(peer);
+ if (NULL == sslPeer)
+ {
+ OIC_LOG(ERROR, NET_SSL_TAG, "Peer not found");
+ oc_mutex_unlock(g_sslContextMutex);
+ return CA_STATUS_FAILED;
+ }
+
+ OCRandomUuidResult ret = OCConvertStringToUuid(uuid, sslPeer->sep.identity.id);
+ oc_mutex_unlock(g_sslContextMutex);
+
+ if (RAND_UUID_OK != ret)
+ {
+ OIC_LOG(ERROR, NET_SSL_TAG, "Failed to convert uuid");
+ return CA_STATUS_FAILED;
+ }
+
+ OIC_LOG_V(DEBUG, NET_SSL_TAG, "Out %s", __func__);
+
+ return CA_STATUS_OK;
+}
+
/**
* Deletes cached message.
*
OIC_LOG_V(DEBUG, NET_SSL_TAG, "Out %s", __func__);
}
+/**
+ * Check RFC4122 based UUID
+ *
+ * @param uuidString string representation of UUID
+ * @return true for success, otherwise false
+ */
+static bool CheckUuidFormat(const char uuidString[UUID_STR_SIZE])
+{
+ // Indexes of '-' symbols in string representation of UUID
+ static const int dash_idxs[4] = {8,13,18,23};
+
+ VERIFY_NON_NULL_RET(uuidString, NET_SSL_TAG, "uuidString is NULL" , false);
+
+ // Check for '-' symbols
+ for (int i = 0; i < 4; i++)
+ {
+ if (uuidString[dash_idxs[i]] != '-')
+ {
+ return false;
+ }
+ }
+
+ for (int i = 0; i < UUID_STR_SIZE; i++)
+ {
+ // Skip '-' symbols
+ if (i == dash_idxs[0] || i == dash_idxs[1] || i == dash_idxs[2] || i == dash_idxs[3])
+ {
+ continue;
+ }
+
+ if ((uuidString[i] >= 'a' && uuidString[i] <= 'f')
+ || (uuidString[i] >= 'A' && uuidString[i] <= 'F')
+ || (uuidString[i] >= '0' && uuidString[i] <= '9') )
+ {
+ continue;
+ }
+
+ return false;
+ }
+
+ return true;
+}
+
+/**
+ * FindUuid function finds the first entry of RFC4122 based UUID
+ *
+ * @param data pointer to unformatted data
+ * @param size data size
+ *
+ * @return pointer to string representation of the found UUID if success, otherwise NULL
+ */
+static const char* FindUuid(const char* data, size_t size)
+{
+ const char* result = NULL;
+
+ VERIFY_NON_NULL_RET(data, NET_SSL_TAG, "data is NULL" , NULL);
+ if (size < UUID_STR_SIZE)
+ {
+ OIC_LOG(ERROR, NET_SSL_TAG, "Buffer size is too small");
+ return NULL;
+ }
+
+ const char* currentPtr = data;
+ int currentSize = size;
+ while (!result
+ && (currentPtr = (const char*)memchr((const void*)++currentPtr, '-', currentSize - 1))
+ && ((currentSize = (size - (currentPtr - data))) >= (UUID_STR_SIZE - 8)))
+ {
+ if (currentPtr - data >= 8 && CheckUuidFormat(currentPtr - 8))
+ {
+ result = currentPtr - 8;
+ }
+ }
+
+ return result;
+}
+
/* Read data from TLS connection
*/
CAResult_t CAdecryptSsl(const CASecureEndpoint_t *sep, uint8_t *data, uint32_t dataLen)
VERIFY_NON_NULL_RET(sep, NET_SSL_TAG, "endpoint is NULL" , CA_STATUS_INVALID_PARAM);
VERIFY_NON_NULL_RET(data, NET_SSL_TAG, "Param data is NULL" , CA_STATUS_INVALID_PARAM);
+ if (0 == dataLen)
+ {
+ OIC_LOG(ERROR, NET_SSL_TAG, "dataLen is zero");
+ return CA_STATUS_FAILED;
+ }
+
oc_mutex_lock(g_sslContextMutex);
if (NULL == g_caSslContext)
{
if (MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 != selectedCipher &&
MBEDTLS_TLS_ECDH_ANON_WITH_AES_128_CBC_SHA256 != selectedCipher)
{
- char uuid[UUID_LENGTH * 2 + 5] = {0};
- void * uuidPos = NULL;
- void * userIdPos = NULL;
const mbedtls_x509_crt * peerCert = mbedtls_ssl_get_peer_cert(&peer->ssl);
ret = (NULL == peerCert ? -1 : 0);
if (g_CertificateVerificationCallback)
// CA_STATUS_FAILED, MBEDTLS_SSL_ALERT_MSG_NO_CERT);
if (0 == ret)
{
- uuidPos = memmem(peerCert->subject_raw.p, peerCert->subject_raw.len,
- UUID_PREFIX, sizeof(UUID_PREFIX) - 1);
-
- if (NULL != uuidPos)
+ const char* uuidptr = FindUuid((const char*)peerCert->subject_raw.p, peerCert->subject_raw.len);
+ if (uuidptr)
{
- memcpy(uuid, (char*) uuidPos + sizeof(UUID_PREFIX) - 1, UUID_LENGTH * 2 + 4);
+ char uuid[UUID_STR_SIZE + 1] = {0};
+ strncpy(uuid, uuidptr, UUID_STR_SIZE);
+ uuid[UUID_STR_SIZE] = '\0';
OIC_LOG_V(DEBUG, NET_SSL_TAG, "certificate uuid string: %s" , uuid);
ret = OCConvertStringToUuid(uuid, peer->sep.identity.id);
SSL_CHECK_FAIL(peer, ret, "Failed to convert subject", 1,
{
OIC_LOG(WARNING, NET_SSL_TAG, "uuid not found");
}
-
- userIdPos = memmem(peerCert->subject_raw.p, peerCert->subject_raw.len,
- USERID_PREFIX, sizeof(USERID_PREFIX) - 1);
- if (NULL != userIdPos)
- {
- memcpy(uuid, (char*) userIdPos + sizeof(USERID_PREFIX) - 1, UUID_LENGTH * 2 + 4);
- ret = OCConvertStringToUuid(uuid, peer->sep.userId.id);
- SSL_CHECK_FAIL(peer, ret, "Failed to convert subject alt name", 1,
- CA_STATUS_FAILED, MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT);
- }
- else
- {
- OIC_LOG(WARNING, NET_SSL_TAG, "Subject alternative name not found");
- }
}
}