Skip to content

Commit 75ce2fd

Browse files
josesimoesjosesimoes
authored
Fix handling of own certificate in SSL context (#3140)
1 parent 6d16358 commit 75ce2fd

File tree

5 files changed

+73
-34
lines changed

5 files changed

+73
-34
lines changed

‎src/HAL/Include/nanoHAL_Network.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -300,10 +300,10 @@ typedef struct __nfpack HAL_Configuration_X509DeviceCertificate
300300
// this is the marker placeholder for this configuration block
301301
uint8_t Marker[4];
302302

303-
// Size of the X509 CA Root certificate bundle
303+
// Size of the X509 device certificate
304304
uint32_t CertificateSize;
305305

306-
// X509 CA Root certificate bundle
306+
// X509 device certificate
307307
uint8_t Certificate[1];
308308

309309
} HAL_Configuration_X509DeviceCertificate;

‎src/PAL/COM/sockets/ssl/MbedTLS/mbedtls.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,8 @@ extern "C"
3434
mbedtls_ssl_config *conf;
3535
mbedtls_ssl_context *ssl;
3636
mbedtls_net_context *server_fd;
37-
mbedtls_x509_crt *x509_crt;
37+
mbedtls_x509_crt *ca_cert;
38+
mbedtls_x509_crt *own_cert;
3839
mbedtls_pk_context *pk;
3940
} mbedTLS_NFContext;
4041

‎src/PAL/COM/sockets/ssl/MbedTLS/ssl_add_cert_auth_internal.cpp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,12 @@ bool ssl_add_cert_auth_internal(int contextHandle, const char *certificate, int
2525
/////////////////////////////////////////////////////////////////////////////////////////////////
2626
// developer notes: //
2727
// this call parses certificates in both string and binary formats //
28-
// when the formart is a string it has to include the terminator otherwise the parse will fail //
28+
// when the format is a string it has to include the terminator otherwise the parse will fail //
2929
/////////////////////////////////////////////////////////////////////////////////////////////////
30-
if (mbedtls_x509_crt_parse(context->x509_crt, (const unsigned char *)certificate, certLength) == 0)
30+
if (mbedtls_x509_crt_parse(context->ca_cert, (const unsigned char *)certificate, certLength) == 0)
3131
{
3232
// add to CA chain
33-
mbedtls_ssl_conf_ca_chain(context->conf, context->x509_crt, NULL);
33+
mbedtls_ssl_conf_ca_chain(context->conf, context->ca_cert, NULL);
3434

3535
// done
3636
return true;

‎src/PAL/COM/sockets/ssl/MbedTLS/ssl_exit_context_internal.cpp‎

Lines changed: 43 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -30,24 +30,58 @@ bool ssl_exit_context_internal(int contextHandle)
3030
mbedtls_ctr_drbg_free(context->ctr_drbg);
3131
mbedtls_entropy_free(context->entropy);
3232
mbedtls_ssl_config_free(context->conf);
33-
mbedtls_x509_crt_free(context->x509_crt);
33+
mbedtls_x509_crt_free(context->ca_cert);
34+
mbedtls_x509_crt_free(context->own_cert);
3435
mbedtls_ssl_free(context->ssl);
3536

3637
// zero memory to wipe any security critical info in RAM
3738
memset(context->ssl, 0, sizeof(mbedtls_ssl_context));
3839

3940
// free memory
40-
if (context->pk != NULL)
41+
if (context->pk)
4142
{
4243
platform_free(context->pk);
4344
}
44-
platform_free(context->server_fd);
45-
platform_free(context->entropy);
46-
platform_free(context->ctr_drbg);
47-
platform_free(context->conf);
48-
platform_free(context->x509_crt);
49-
platform_free(context->ssl);
50-
platform_free(context);
45+
46+
if (context->server_fd)
47+
{
48+
platform_free(context->server_fd);
49+
}
50+
51+
if (context->entropy)
52+
{
53+
platform_free(context->entropy);
54+
}
55+
56+
if (context->ctr_drbg)
57+
{
58+
platform_free(context->ctr_drbg);
59+
}
60+
61+
if (context->conf)
62+
{
63+
platform_free(context->conf);
64+
}
65+
66+
if (context->ca_cert)
67+
{
68+
platform_free(context->ca_cert);
69+
}
70+
71+
if (context->own_cert)
72+
{
73+
platform_free(context->own_cert);
74+
}
75+
76+
if (context->ssl)
77+
{
78+
platform_free(context->ssl);
79+
}
80+
81+
if (context)
82+
{
83+
platform_free(context);
84+
}
5185

5286
memset(&g_SSL_Driver.ContextArray[contextHandle], 0, sizeof(g_SSL_Driver.ContextArray[contextHandle]));
5387

‎src/PAL/COM/sockets/ssl/MbedTLS/ssl_generic_init_internal.cpp‎

Lines changed: 23 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,6 @@ bool ssl_generic_init_internal(
3232
int endpoint = 0;
3333
int ret = 0;
3434

35-
mbedtls_x509_crt *ownCertificate = NULL;
3635
HAL_Configuration_X509CaRootBundle *certStore = NULL;
3736
HAL_Configuration_X509DeviceCertificate *deviceCert = NULL;
3837

@@ -64,6 +63,7 @@ bool ssl_generic_init_internal(
6463
memset(context, 0, sizeof(mbedTLS_NFContext));
6564

6665
// allocate memory for net context
66+
// this needs to be freed in ssl_exit_context_internal
6767
context->server_fd = (mbedtls_net_context *)platform_malloc(sizeof(mbedtls_net_context));
6868
if (context->server_fd == NULL)
6969
{
@@ -130,12 +130,12 @@ bool ssl_generic_init_internal(
130130

131131
// create and init X509 CRT
132132
// this needs to be freed in ssl_exit_context_internal
133-
context->x509_crt = (mbedtls_x509_crt *)platform_malloc(sizeof(mbedtls_x509_crt));
134-
if (context->x509_crt == NULL)
133+
context->ca_cert = (mbedtls_x509_crt *)platform_malloc(sizeof(mbedtls_x509_crt));
134+
if (context->ca_cert == NULL)
135135
{
136136
goto error;
137137
}
138-
mbedtls_x509_crt_init(context->x509_crt);
138+
mbedtls_x509_crt_init(context->ca_cert);
139139

140140
// TODO: review if we can add some instance-unique data to the custom argument below
141141
if (mbedtls_ctr_drbg_seed(context->ctr_drbg, mbedtls_entropy_func, context->entropy, NULL, 0) != 0)
@@ -207,11 +207,12 @@ bool ssl_generic_init_internal(
207207
// when the format is a string it has to include the terminator otherwise the parse will fail //
208208
/////////////////////////////////////////////////////////////////////////////////////////////////
209209
mbedtls_x509_crt_parse(
210-
context->x509_crt,
210+
context->ca_cert,
211211
(const unsigned char *)certStore->Certificate,
212212
certStore->CertificateSize);
213213

214214
platform_free(certStore);
215+
certStore = NULL;
215216
}
216217
}
217218

@@ -260,21 +261,22 @@ bool ssl_generic_init_internal(
260261
}
261262

262263
// parse certificate
263-
ownCertificate = (mbedtls_x509_crt *)platform_malloc(sizeof(mbedtls_x509_crt));
264-
if (ownCertificate == NULL)
264+
// this needs to be freed in ssl_exit_context_internal
265+
context->own_cert = (mbedtls_x509_crt *)platform_malloc(sizeof(mbedtls_x509_crt));
266+
if (context->own_cert == NULL)
265267
{
266268
goto error;
267269
}
268270

269-
mbedtls_x509_crt_init(ownCertificate);
271+
mbedtls_x509_crt_init(context->own_cert);
270272

271-
if (mbedtls_x509_crt_parse(ownCertificate, (const unsigned char *)certificate, certLength))
273+
if (mbedtls_x509_crt_parse(context->own_cert, (const unsigned char *)certificate, certLength))
272274
{
273275
// failed parsing own certificate failed
274276
goto error;
275277
}
276278

277-
if (mbedtls_ssl_conf_own_cert(context->conf, ownCertificate, context->pk))
279+
if (mbedtls_ssl_conf_own_cert(context->conf, context->own_cert, context->pk))
278280
{
279281
// configuring own certificate failed
280282
goto error;
@@ -284,6 +286,7 @@ bool ssl_generic_init_internal(
284286
if (deviceCert)
285287
{
286288
platform_free(deviceCert);
289+
deviceCert = NULL;
287290
}
288291
}
289292
else
@@ -294,7 +297,7 @@ bool ssl_generic_init_internal(
294297
context->pk = NULL;
295298
}
296299

297-
mbedtls_ssl_conf_ca_chain(context->conf, context->x509_crt, NULL);
300+
mbedtls_ssl_conf_ca_chain(context->conf, context->ca_cert, NULL);
298301

299302
psa_crypto_init();
300303

@@ -343,7 +346,8 @@ bool ssl_generic_init_internal(
343346

344347
mbedtls_ctr_drbg_free(context->ctr_drbg);
345348
mbedtls_entropy_free(context->entropy);
346-
mbedtls_x509_crt_free(context->x509_crt);
349+
mbedtls_x509_crt_free(context->ca_cert);
350+
mbedtls_x509_crt_free(context->own_cert);
347351
mbedtls_ssl_config_free(context->conf);
348352
mbedtls_ssl_free(context->ssl);
349353

@@ -373,21 +377,21 @@ bool ssl_generic_init_internal(
373377
platform_free(context->server_fd);
374378
}
375379

376-
if (context->x509_crt)
380+
if (context->ca_cert)
377381
{
378-
platform_free(context->x509_crt);
382+
platform_free(context->ca_cert);
379383
}
380384

381-
if (context->pk)
385+
if (context->own_cert)
382386
{
383-
platform_free(context->pk);
387+
platform_free(context->own_cert);
384388
}
385389

386-
if (ownCertificate)
390+
if (context->pk)
387391
{
388-
mbedtls_x509_crt_free(ownCertificate);
389-
platform_free(ownCertificate);
392+
platform_free(context->pk);
390393
}
394+
391395
if (context)
392396
{
393397
platform_free(context);

0 commit comments

Comments
 (0)