blob: a9a6f946d8713d9480f631cfae33d53cb05023b1 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
|
/***************************************************************************
* Copyright (c) 2024 Microsoft Corporation
* Copyright (c) 2025-present Eclipse ThreadX Contributors
*
* This program and the accompanying materials are made available under the
* terms of the MIT License which is available at
* https://opensource.org/licenses/MIT.
*
* SPDX-License-Identifier: MIT
**************************************************************************/
/**************************************************************************/
/**************************************************************************/
/** */
/** NetX Secure Component */
/** */
/** Datagram Transport Layer Security (DTLS) */
/** */
/**************************************************************************/
/**************************************************************************/
#define NX_SECURE_SOURCE_CODE
#include "nx_secure_dtls.h"
/**************************************************************************/
/* */
/* FUNCTION RELEASE */
/* */
/* _nx_secure_dtls_server_x509_client_verify_configure PORTABLE C */
/* 6.4.3 */
/* AUTHOR */
/* */
/* Timothy Stapko, Microsoft Corporation */
/* */
/* DESCRIPTION */
/* */
/* This function enables and configures X.509 Client certificate */
/* verification and authentication for a particular DTLS server */
/* instance. The buffer parameter points to space allocated for */
/* incoming certificates from remote clients. It must be large enough */
/* to hold the entire maximum expected certificate chain size times */
/* number of DTLS sessions assigned to the server. The certificate */
/* chain size is the number of certificates in the chain times the */
/* size of each certificate (and control blocks: NX_SECURE_X509_CERT) */
/* Therefore, the buffer size can be determined with the following */
/* formula: */
/* */
/* buffer size = (Number of DTLS sessions) * */
/* (Max. # of expected certs in chain) * */
/* (Max. cert size in bytes + sizeof(NX_SECURE_X509_CERT)) */
/* */
/* INPUT */
/* */
/* server_ptr DTLS server control block */
/* certs_per_session # of certs allocated */
/* certs_buffer Buffer to use for remote certs*/
/* buffer_size Size of buffer */
/* */
/* OUTPUT */
/* */
/* status Completion status */
/* */
/* CALLS */
/* */
/* _nx_secure_tls_session_x509_client_verify_configure */
/* Configure individual session */
/* */
/* CALLED BY */
/* */
/* Application Code */
/* */
/**************************************************************************/
UINT _nx_secure_dtls_server_x509_client_verify_configure(NX_SECURE_DTLS_SERVER *server_ptr, UINT certs_per_session,
UCHAR *certs_buffer, ULONG buffer_size)
{
#ifdef NX_SECURE_ENABLE_DTLS
UINT status;
UINT i;
NX_SECURE_DTLS_SESSION *current_session;
NX_SECURE_TLS_SESSION *tls_session;
UINT per_session_buffer_size;
UINT num_sessions;
UCHAR *session_buffer_ptr;
/* Figure out number of sessions. */
num_sessions = server_ptr->nx_dtls_server_sessions_count;
/* Check sessions buffer size. */
if(num_sessions == 0)
{
return(NX_INVALID_PARAMETERS);
}
/* Calculate the per-session size allocated from the buffer. */
per_session_buffer_size = buffer_size / num_sessions;
/* Get a working pointer for our buffer allocation. */
session_buffer_ptr = certs_buffer;
/* Loop through all sessions. */
for(i = 0; i < num_sessions; ++i)
{
/* Get the current session. */
current_session = &(server_ptr->nx_dtls_server_sessions[i]);
/* Get the internal TLS session instance. */
tls_session = &(current_session -> nx_secure_dtls_tls_session);
/* Enable client certificate verification and allocate buffer space for certificates. */
status = _nx_secure_tls_session_x509_client_verify_configure(tls_session, certs_per_session, session_buffer_ptr, per_session_buffer_size);
if(status != NX_SUCCESS)
{
return(status);
}
/* Advance the buffer pointer to the next session buffer carved from the passed-in buffer. */
session_buffer_ptr += per_session_buffer_size;
}
return(NX_SUCCESS);
#else
NX_PARAMETER_NOT_USED(server_ptr);
NX_PARAMETER_NOT_USED(certs_per_session);
NX_PARAMETER_NOT_USED(certs_buffer);
NX_PARAMETER_NOT_USED(buffer_size);
return(NX_NOT_SUPPORTED);
#endif /* NX_SECURE_ENABLE_DTLS */
}
|
