ligang/vpp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tls: Support for client certificate-key pair

Browse Source 
Type: improvement

Signed-off-by: sarmurug <sarmurug@cisco.com>
Change-Id: Ibbfe827b9c4c603a6fe7cc49970a46bd683194ce
This commit is contained in:
sarmurug
2022-03-29 18:24:44 +05:30
committed by Florin Coras
parent 5760fdfb8c
commit 8f63d38e99
1 changed files with 50 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
src/plugins/tlsopenssl/tls_openssl.c
View File

@@ -627,6 +627,52 @@ openssl_ctx_read (tls_ctx_t *ctx, session_t *ts)
return openssl_ctx_read_dtls (ctx, ts); return openssl_ctx_read_dtls (ctx, ts);
} }
static int
openssl_set_ckpair (SSL *ssl_connection, u32 ckpair_index)
{
app_cert_key_pair_t *ckpair;
BIO *cert_bio;
EVP_PKEY *pkey;
X509 *srvcert;
ckpair = app_cert_key_pair_get_if_valid (ckpair_index);
if (!ckpair)
return -1;
if (!ckpair->cert || !ckpair->key)
{
TLS_DBG (1, "tls cert and/or key not configured");
return -1;
}
/*
* Set the key and cert
*/
cert_bio = BIO_new (BIO_s_mem ());
BIO_write (cert_bio, ckpair->cert, vec_len (ckpair->cert));
srvcert = PEM_read_bio_X509 (cert_bio, NULL, NULL, NULL);
if (!srvcert)
{
clib_warning ("unable to parse certificate");
return -1;
}
SSL_use_certificate (ssl_connection, srvcert);
BIO_free (cert_bio);
cert_bio = BIO_new (BIO_s_mem ());
BIO_write (cert_bio, ckpair->key, vec_len (ckpair->key));
pkey = PEM_read_bio_PrivateKey (cert_bio, NULL, NULL, NULL);
if (!pkey)
{
clib_warning ("unable to parse pkey");
return -1;
}
SSL_use_PrivateKey (ssl_connection, pkey);
BIO_free (cert_bio);
TLS_DBG (1, "TLS client using ckpair index: %d", ckpair_index);
return 0;
}
static int static int
openssl_ctx_init_client (tls_ctx_t * ctx) openssl_ctx_init_client (tls_ctx_t * ctx)
{ {
@@ -694,6 +740,10 @@ openssl_ctx_init_client (tls_ctx_t * ctx)
TLS_DBG (1, "Couldn't set hostname"); TLS_DBG (1, "Couldn't set hostname");
return -1; return -1;
} }
if (openssl_set_ckpair (oc->ssl, ctx->ckpair_index))
{
TLS_DBG (1, "Couldn't set client certificate-key pair");
}
/* /*
* 2. Do the first steps in the handshake. * 2. Do the first steps in the handshake.