sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-11-22 00:01:45 -05:00
Code Issues Projects Releases Wiki Activity

Cleaned up the public TLS interface

Browse Source
This commit is contained in:
Martin Willi 2010-02-05 13:39:19 +00:00
parent 84d67ead4e
commit dc9f34be4d
4 changed files with 76 additions and 68 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/charon/plugins/eap_tls/tls/tls.c
View File

@ -134,13 +134,6 @@ METHOD(tls_t, set_version, void,
this->version = version;
}
METHOD(tls_t, change_cipher, void,
private_tls_t *this, bool inbound, signer_t *signer,
crypter_t *crypter, chunk_t iv)
{
this->protection->set_cipher(this->protection, inbound, signer, crypter, iv);
}
METHOD(tls_t, get_eap_msk, chunk_t,
private_tls_t *this)
{
@ -174,7 +167,6 @@ tls_t *tls_create(bool is_server, identification_t *server,
.is_server = _is_server,
.get_version = _get_version,
.set_version = _set_version,
.change_cipher = _change_cipher,
.get_eap_msk = _get_eap_msk,
.destroy = _destroy,
},
@ -196,6 +188,7 @@ tls_t *tls_create(bool is_server, identification_t *server,
this->fragmentation = tls_fragmentation_create(this->handshake);
this->compression = tls_compression_create(this->fragmentation);
this->protection = tls_protection_create(&this->public, this->compression);
this->crypto->set_protection(this->crypto, this->protection);
return &this->public;
}

52
src/charon/plugins/eap_tls/tls/tls.h
View File

@ -27,7 +27,6 @@
typedef enum tls_version_t tls_version_t;
typedef enum tls_content_type_t tls_content_type_t;
typedef enum tls_handshake_type_t tls_handshake_type_t;
typedef enum tls_cipher_suite_t tls_cipher_suite_t;
typedef struct tls_t tls_t;
#include <library.h>
@ -84,46 +83,6 @@ enum tls_handshake_type_t {
*/
extern enum_name_t *tls_handshake_type_names;
enum tls_cipher_suite_t {
TLS_NULL_WITH_NULL_NULL = 0x00,
TLS_RSA_WITH_NULL_MD5 = 0x01,
TLS_RSA_WITH_NULL_SHA = 0x02,
TLS_RSA_WITH_NULL_SHA256 = 0x3B,
TLS_RSA_WITH_RC4_128_MD5 = 0x04,
TLS_RSA_WITH_RC4_128_SHA = 0x05,
TLS_RSA_WITH_3DES_EDE_CBC_SHA = 0x0A,
TLS_RSA_WITH_AES_128_CBC_SHA = 0x2F,
TLS_RSA_WITH_AES_256_CBC_SHA = 0x35,
TLS_RSA_WITH_AES_128_CBC_SHA256 = 0x3C,
TLS_RSA_WITH_AES_256_CBC_SHA256 = 0x3D,
TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA = 0x0D,
TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA = 0x10,
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA = 0x13,
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA = 0x16,
TLS_DH_DSS_WITH_AES_128_CBC_SHA = 0x30,
TLS_DH_RSA_WITH_AES_128_CBC_SHA = 0x31,
TLS_DHE_DSS_WITH_AES_128_CBC_SHA = 0x32,
TLS_DHE_RSA_WITH_AES_128_CBC_SHA = 0x33,
TLS_DH_DSS_WITH_AES_256_CBC_SHA = 0x36,
TLS_DH_RSA_WITH_AES_256_CBC_SHA = 0x37,
TLS_DHE_DSS_WITH_AES_256_CBC_SHA = 0x38,
TLS_DHE_RSA_WITH_AES_256_CBC_SHA = 0x39,
TLS_DH_DSS_WITH_AES_128_CBC_SHA256 = 0x3E,
TLS_DH_RSA_WITH_AES_128_CBC_SHA256 = 0x3F,
TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 = 0x40,
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 = 0x67,
TLS_DH_DSS_WITH_AES_256_CBC_SHA256 = 0x68,
TLS_DH_RSA_WITH_AES_256_CBC_SHA256 = 0x69,
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 = 0x6A,
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 = 0x6B,
TLS_DH_ANON_WITH_RC4_128_MD5 = 0x18,
TLS_DH_ANON_WITH_3DES_EDE_CBC_SHA = 0x1B,
TLS_DH_ANON_WITH_AES_128_CBC_SHA = 0x34,
TLS_DH_ANON_WITH_AES_256_CBC_SHA = 0x3A,
TLS_DH_ANON_WITH_AES_128_CBC_SHA256 = 0x6C,
TLS_DH_ANON_WITH_AES_256_CBC_SHA256 = 0x6D,
};
/**
* A bottom-up driven TLS stack, suitable for EAP implementations.
*/
@ -175,17 +134,6 @@ struct tls_t {
*/
void (*set_version)(tls_t *this, tls_version_t version);
/**
* Change used cipher, including encryption and integrity algorithms.
*
* @param inbound TRUE to use cipher for inbound data, FALSE for outbound
* @param signer new signer to use
* @param crypter new crypter to use
* @param iv initial IV for crypter
*/
void (*change_cipher)(tls_t *this, bool inbound, signer_t *signer,
crypter_t *crypter, chunk_t iv);
/**
* Get the MSK for EAP-TLS.
*

31
src/charon/plugins/eap_tls/tls/tls_crypto.c
View File

@ -29,6 +29,11 @@ struct private_tls_crypto_t {
*/
tls_crypto_t public;
/**
* Protection layer
*/
tls_protection_t *protection;
/**
* List of supported/acceptable cipher suites
*/
@ -351,6 +356,12 @@ METHOD(tls_crypto_t, select_cipher_suite, tls_cipher_suite_t,
return 0;
}
METHOD(tls_crypto_t, set_protection, void,
private_tls_crypto_t *this, tls_protection_t *protection)
{
this->protection = protection;
}
METHOD(tls_crypto_t, append_handshake, void,
private_tls_crypto_t *this, tls_handshake_type_t type, chunk_t data)
{
@ -561,15 +572,18 @@ METHOD(tls_crypto_t, derive_secrets, void,
METHOD(tls_crypto_t, change_cipher, void,
private_tls_crypto_t *this, bool inbound)
{
if (inbound)
if (this->protection)
{
this->tls->change_cipher(this->tls, TRUE, this->signer_in,
this->crypter_in, this->iv_in);
}
else
{
this->tls->change_cipher(this->tls, FALSE, this->signer_out,
this->crypter_out, this->iv_out);
if (inbound)
{
this->protection->set_cipher(this->protection, TRUE,
this->signer_in, this->crypter_in, this->iv_in);
}
else
{
this->protection->set_cipher(this->protection, FALSE,
this->signer_out, this->crypter_out, this->iv_out);
}
}
}
@ -618,6 +632,7 @@ tls_crypto_t *tls_crypto_create(tls_t *tls)
.public = {
.get_cipher_suites = _get_cipher_suites,
.select_cipher_suite = _select_cipher_suite,
.set_protection = _set_protection,
.append_handshake = _append_handshake,
.sign_handshake = _sign_handshake,
.calculate_finished = _calculate_finished,

52
src/charon/plugins/eap_tls/tls/tls_crypto.h
View File

@ -22,12 +22,57 @@
#define TLS_CRYPTO_H_
typedef struct tls_crypto_t tls_crypto_t;
typedef enum tls_cipher_suite_t tls_cipher_suite_t;
#include "tls.h"
#include "tls_prf.h"
#include "tls_protection.h"
#include <credentials/keys/private_key.h>
/**
* TLS cipher suites
*/
enum tls_cipher_suite_t {
TLS_NULL_WITH_NULL_NULL = 0x00,
TLS_RSA_WITH_NULL_MD5 = 0x01,
TLS_RSA_WITH_NULL_SHA = 0x02,
TLS_RSA_WITH_NULL_SHA256 = 0x3B,
TLS_RSA_WITH_RC4_128_MD5 = 0x04,
TLS_RSA_WITH_RC4_128_SHA = 0x05,
TLS_RSA_WITH_3DES_EDE_CBC_SHA = 0x0A,
TLS_RSA_WITH_AES_128_CBC_SHA = 0x2F,
TLS_RSA_WITH_AES_256_CBC_SHA = 0x35,
TLS_RSA_WITH_AES_128_CBC_SHA256 = 0x3C,
TLS_RSA_WITH_AES_256_CBC_SHA256 = 0x3D,
TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA = 0x0D,
TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA = 0x10,
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA = 0x13,
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA = 0x16,
TLS_DH_DSS_WITH_AES_128_CBC_SHA = 0x30,
TLS_DH_RSA_WITH_AES_128_CBC_SHA = 0x31,
TLS_DHE_DSS_WITH_AES_128_CBC_SHA = 0x32,
TLS_DHE_RSA_WITH_AES_128_CBC_SHA = 0x33,
TLS_DH_DSS_WITH_AES_256_CBC_SHA = 0x36,
TLS_DH_RSA_WITH_AES_256_CBC_SHA = 0x37,
TLS_DHE_DSS_WITH_AES_256_CBC_SHA = 0x38,
TLS_DHE_RSA_WITH_AES_256_CBC_SHA = 0x39,
TLS_DH_DSS_WITH_AES_128_CBC_SHA256 = 0x3E,
TLS_DH_RSA_WITH_AES_128_CBC_SHA256 = 0x3F,
TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 = 0x40,
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 = 0x67,
TLS_DH_DSS_WITH_AES_256_CBC_SHA256 = 0x68,
TLS_DH_RSA_WITH_AES_256_CBC_SHA256 = 0x69,
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 = 0x6A,
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 = 0x6B,
TLS_DH_ANON_WITH_RC4_128_MD5 = 0x18,
TLS_DH_ANON_WITH_3DES_EDE_CBC_SHA = 0x1B,
TLS_DH_ANON_WITH_AES_128_CBC_SHA = 0x34,
TLS_DH_ANON_WITH_AES_256_CBC_SHA = 0x3A,
TLS_DH_ANON_WITH_AES_128_CBC_SHA256 = 0x6C,
TLS_DH_ANON_WITH_AES_256_CBC_SHA256 = 0x6D,
};
/**
* TLS crypto helper functions.
*/
@ -51,6 +96,13 @@ struct tls_crypto_t {
tls_cipher_suite_t (*select_cipher_suite)(tls_crypto_t *this,
tls_cipher_suite_t *suites, int count);
/**
* Set the protection layer of the TLS stack to control it.
*
* @param protection protection layer to work on
*/
void (*set_protection)(tls_crypto_t *this, tls_protection_t *protection);
/**
* Store exchanged handshake data, used for cryptographic operations.
*