123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480 |
- #include "optiga/dtls/DtlsRecordLayer.h"
- #include "optiga/dtls/AlertProtocol.h"
- #include "optiga/dtls/DtlsFlightHandler.h"
- #ifdef MODULE_ENABLE_DTLS_MUTUAL_AUTH
- #define LENGTH_ALERT_MSG 0x02
- #define OFFSET_ALERT_MSG 0x01
- #define INVALID_OID 0x01
- #define INVALID_PARAM_FIELD 0x03
- #define INVALID_LENGTH_FIELD 0x04
- #define INVALID_PARAMETER_DATA_FIELD 0x05
- #define INTERNAL_PROCESS_ERROR 0x06
- #define INVALID_COMMAND_FIELD 0x0A
- #define COMMAND_OUT_SEQUENCE 0x0B
- #define COMMAND_NOT_AVAILABLE 0x0C
- #define INVALID_HANDSHAKE_MESSAGE 0x21
- #define VERSION_MISMATCH 0x22
- #define INSUFFICIENT_UNSUPPORTED_CIPHERSUITE 0x23
- #define UNSUPPORTED_EXTENSION 0x24
- #define UNSUPPORTED_PARAMETERS 0x25
- #define INVALID_TRUST_ANCHOR 0x26
- #define TRUST_ANCHOR_EXPIRED 0x27
- #define UNSUPPORTED_TRUST_ANCHOR 0x28
- #define INVALID_CERTIFICATE_FORMAT 0x29
- #define UNSUPPORTED_CERTIFICATE_HASHSIGN 0x2A
- #define CERTIFICATE_EXPIRED 0x2B
- #define SIGNATURE_VERIFICATION_FAILURE 0x2C
- typedef enum eAlertLevel_d
- {
-
- eWARNING = 0x01,
-
- eFATAL = 0x02
- }eAlertLevel_d;
- typedef enum eAlertMsg_d
- {
-
- eCLOSE_NOTIFY = 0x00,
-
- eUNEXPECTED_MESSAGE = 0x0A ,
-
- eBAD_RECORD_MAC = 0x14,
-
- eDECRYPTION_FAILURE = 0x15,
-
- eRECORD_OVERFLOW = 0x16,
-
- eDECOMPRESSION_FAILURE = 0x1E,
-
- eHANDSHAKE_FAILURE = 0x28,
-
- eBAD_CERTIFICATE = 0x2A,
-
- eNO_CERTIFICATE = 0x29,
-
- eUNSUPPORTED_CERTIFICATE = 0x2B,
-
- eCERTIFICATE_REVOKED = 0x2C,
-
- eCERTIFICATE_EXPIRED = 0x2D,
-
- eCERTIFICATE_UNKNOWN = 0x2E,
-
- eILLEGAL_PARAMETER = 0x2F,
-
- eUNKNOWN_CA = 0x30,
-
- eACCESS_DENIED = 0x31,
-
- eDECODE_ERROR = 0x32,
-
- eDECRYPT_ERROR = 0x33,
-
- eEXPORT_RESTRICTION = 0x3C,
-
- ePROTOCOL_VERSION = 0x46,
-
- eINSUFFICIENT_SECURITY = 0x47,
-
- eINTERNAL_ERROR = 0x50,
-
- eUSER_CANCELLED = 0x5A,
-
- eNO_RENEGOTIATION = 0x64,
-
- eUNSUPPORTED_EXTENSION = 0x6E
- }eAlertMsg_d;
- _STATIC_H int32_t DtlsAlertErrorMapping(const sbBlob_d* PpsAlertMsg, int32_t* Ppi4ErrorCode);
- #ifndef DISABLE_ALERT
-
- _STATIC_H Void DtlsErrorAlertMapping(int32_t Pi4ErrorCode, sbBlob_d* PpsAlertMsg);
- _STATIC_H Void Alert_FormMsg(int32_t Pi4ErrorCode,sbBlob_d* PpsAlertMsg);
- _STATIC_H Void DtlsErrorAlertMapping(int32_t Pi4ErrorCode, sbBlob_d* PpsAlertMsg)
- {
- do
- {
- if((int32_t)OCP_LIB_NO_RENEGOTIATE == Pi4ErrorCode)
- {
- *PpsAlertMsg->prgbStream = (uint8_t)eWARNING;
- }
- else
- {
- *PpsAlertMsg->prgbStream = (uint8_t)eFATAL;
- }
-
- PpsAlertMsg->wLen = LENGTH_ALERT_MSG;
- switch(Pi4ErrorCode)
- {
- case (int32_t)OCP_RL_ERROR:
- case (int32_t)OCP_FL_MSG_MAXCOUNT:
-
- *(PpsAlertMsg->prgbStream + OFFSET_ALERT_MSG) = (uint8_t)eCLOSE_NOTIFY;
- break;
- case (int32_t)(CMD_DEV_ERROR | INVALID_HANDSHAKE_MESSAGE):
- case (int32_t)(CMD_DEV_ERROR | UNSUPPORTED_PARAMETERS):
- case (int32_t)(CMD_DEV_ERROR | VERSION_MISMATCH):
- case (int32_t) OCP_FL_HS_ERROR:
-
- *(PpsAlertMsg->prgbStream + OFFSET_ALERT_MSG) = (uint8_t)eILLEGAL_PARAMETER;
- break;
- case (int32_t)OCP_LIB_NO_RENEGOTIATE:
-
- *(PpsAlertMsg->prgbStream + OFFSET_ALERT_MSG) = (uint8_t)eNO_RENEGOTIATION;
- break;
- case (int32_t)(CMD_DEV_ERROR | INSUFFICIENT_UNSUPPORTED_CIPHERSUITE):
-
- *(PpsAlertMsg->prgbStream + OFFSET_ALERT_MSG) = (uint8_t)eINSUFFICIENT_SECURITY;
- break;
- case (int32_t)(CMD_DEV_ERROR | UNSUPPORTED_EXTENSION):
-
- *(PpsAlertMsg->prgbStream + OFFSET_ALERT_MSG) = (uint8_t)eUNSUPPORTED_EXTENSION;
- break;
- case (int32_t)(CMD_DEV_ERROR | INVALID_TRUST_ANCHOR):
-
- *(PpsAlertMsg->prgbStream + OFFSET_ALERT_MSG) = (uint8_t)eUNKNOWN_CA;
- break;
- case (int32_t)(CMD_DEV_ERROR | TRUST_ANCHOR_EXPIRED):
-
- *(PpsAlertMsg->prgbStream + OFFSET_ALERT_MSG) = (uint8_t)eCERTIFICATE_EXPIRED;
- break;
- case (int32_t)(CMD_DEV_ERROR | UNSUPPORTED_TRUST_ANCHOR):
-
- *(PpsAlertMsg->prgbStream + OFFSET_ALERT_MSG) = (uint8_t)eUNSUPPORTED_CERTIFICATE;
- break;
- case (int32_t)(CMD_DEV_ERROR | INVALID_CERTIFICATE_FORMAT):
-
- *(PpsAlertMsg->prgbStream + OFFSET_ALERT_MSG) = (uint8_t)eBAD_CERTIFICATE;
- break;
- case (int32_t)(CMD_DEV_ERROR | UNSUPPORTED_CERTIFICATE_HASHSIGN):
-
- *(PpsAlertMsg->prgbStream + OFFSET_ALERT_MSG) = (uint8_t)eUNSUPPORTED_CERTIFICATE;
- break;
- case (int32_t)(CMD_DEV_ERROR | CERTIFICATE_EXPIRED):
-
- *(PpsAlertMsg->prgbStream + OFFSET_ALERT_MSG) = (uint8_t)eCERTIFICATE_EXPIRED;
- break;
- case (int32_t)(CMD_DEV_ERROR | SIGNATURE_VERIFICATION_FAILURE):
-
- *(PpsAlertMsg->prgbStream + OFFSET_ALERT_MSG) = (uint8_t)eDECRYPT_ERROR;
- break;
- default:
-
-
- *(PpsAlertMsg->prgbStream + OFFSET_ALERT_MSG) = (uint8_t)eINTERNAL_ERROR;
- break;
- }
- }while(0);
- }
- _STATIC_H Void Alert_FormMsg(int32_t Pi4ErrorCode,sbBlob_d* PpsAlertMsg)
- {
-
- DtlsErrorAlertMapping(Pi4ErrorCode,PpsAlertMsg);
- }
- #endif
- _STATIC_H int32_t DtlsAlertErrorMapping(const sbBlob_d* PpsAlertMsg, int32_t* Ppi4ErrorCode)
- {
- int32_t i4Status = (int32_t)OCP_AL_ERROR;
- do
- {
-
- if(eFATAL == (eAlertLevel_d)*PpsAlertMsg->prgbStream)
- {
-
- switch((eAlertMsg_d) *(PpsAlertMsg->prgbStream + OFFSET_ALERT_MSG))
- {
- case eCLOSE_NOTIFY:
- case eUNEXPECTED_MESSAGE:
- case eBAD_RECORD_MAC:
- case eDECRYPTION_FAILURE:
- case eRECORD_OVERFLOW:
- case eDECOMPRESSION_FAILURE:
- case eHANDSHAKE_FAILURE:
- case eBAD_CERTIFICATE:
- case eUNSUPPORTED_CERTIFICATE:
- case eNO_CERTIFICATE:
- case eCERTIFICATE_REVOKED:
- case eCERTIFICATE_EXPIRED:
- case eCERTIFICATE_UNKNOWN:
- case eUSER_CANCELLED:
- case eNO_RENEGOTIATION:
- case eILLEGAL_PARAMETER:
- case eUNKNOWN_CA:
- case eACCESS_DENIED:
- case eDECODE_ERROR:
- case eDECRYPT_ERROR:
- case eEXPORT_RESTRICTION:
- case ePROTOCOL_VERSION:
- case eINSUFFICIENT_SECURITY:
- case eINTERNAL_ERROR:
- case eUNSUPPORTED_EXTENSION:
- {
- *Ppi4ErrorCode = (int32_t)OCP_AL_FATAL_ERROR;
- i4Status = (int32_t)OCP_AL_OK;
- }
- break;
- default:
-
- break;
- }
- }
-
- else if (eWARNING == (eAlertLevel_d)*PpsAlertMsg->prgbStream)
- {
-
- switch((eAlertMsg_d) *(PpsAlertMsg->prgbStream + OFFSET_ALERT_MSG))
- {
- case eBAD_CERTIFICATE:
- case eUNSUPPORTED_CERTIFICATE:
- case eCERTIFICATE_REVOKED:
- case eCERTIFICATE_EXPIRED:
- case eCERTIFICATE_UNKNOWN:
- case eUSER_CANCELLED:
- case eNO_RENEGOTIATION:
- {
- *Ppi4ErrorCode = (int32_t)OCP_AL_WARNING_ERROR;
- i4Status = (int32_t)OCP_AL_OK;
- break;
- }
- default:
-
-
- break;
- }
- }
- }while(0);
- return i4Status;
- }
- #ifndef DISABLE_ALERT
- void Alert_Send(sConfigRL_d *PpsConfigRL,int32_t Pi4ErrorCode)
- {
- int32_t i4Status = (int32_t)OCP_AL_ERROR;
- sbBlob_d sAlertMsg;
- uint8_t bEncFlag = 0;
- uint8_t bFlagIncr = 0;
- uint8_t rgbAlertMsg[LENGTH_ALERT_MSG];
-
- if((NULL != PpsConfigRL) && (NULL != PpsConfigRL->pfSend) && (NULL != PpsConfigRL->sRL.phRLHdl))
- {
- do
- {
- #define PS_RECORDLAYER ((sRecordLayer_d*)PpsConfigRL->sRL.phRLHdl)
- sAlertMsg.prgbStream = rgbAlertMsg;
- sAlertMsg.wLen = LENGTH_ALERT_MSG;
-
- Alert_FormMsg(Pi4ErrorCode, &sAlertMsg);
- PpsConfigRL->sRL.bMemoryAllocated = FALSE;
- PpsConfigRL->sRL.bContentType = CONTENTTYPE_ALERT;
-
- if(((PS_RECORDLAYER->wServerEpoch != PS_RECORDLAYER->wClientNextEpoch) && (*PS_RECORDLAYER->pbDec != 0x01)) ||
- (Pi4ErrorCode == (int32_t)OCP_FL_INT_ERROR) || (Pi4ErrorCode == (int32_t)OCP_FL_HS_ERROR))
- {
- if((PS_RECORDLAYER->bEncDecFlag == ENC_DEC_ENABLED) && (PS_RECORDLAYER->wClientEpoch != PS_RECORDLAYER->wClientNextEpoch))
- {
- bEncFlag = PS_RECORDLAYER->bEncDecFlag;
- PS_RECORDLAYER->bEncDecFlag = ENC_DEC_DISABLED;
- PS_RECORDLAYER->wClientNextEpoch--;
- bFlagIncr = 0x01;
- }
- }
-
- i4Status = PpsConfigRL->pfSend(&PpsConfigRL->sRL, sAlertMsg.prgbStream, sAlertMsg.wLen);
- if(bFlagIncr == 0x01)
- {
- PS_RECORDLAYER->bEncDecFlag = bEncFlag;
- PS_RECORDLAYER->wClientNextEpoch++;
- }
- if(OCP_RL_OK != i4Status)
- {
- break;
- }
- }while(FALSE);
- #undef PS_RECORDLAYER
- }
- }
- #endif
- int32_t Alert_ProcessMsg(const sbBlob_d* PpsAlertMsg,int32_t* Ppi4ErrorCode)
- {
- int32_t i4Status = (int32_t)OCP_AL_ERROR;
- do
- {
- #ifdef ENABLE_NULL_CHECKS
-
- if((NULL == PpsAlertMsg) || (NULL == Ppi4ErrorCode)|| (NULL == PpsAlertMsg->prgbStream))
- {
- i4Status = (int32_t)OCP_AL_NULL_PARAM;
- break;
- }
- #endif
-
- if(LENGTH_ALERT_MSG != PpsAlertMsg->wLen)
- {
- break;
- }
-
- i4Status = DtlsAlertErrorMapping(PpsAlertMsg, Ppi4ErrorCode);
- }while(0);
- return i4Status;
- }
- #endif
|