int ssl_init(struct tp_ssl *ssl, const struct tls_root_ctx *ssl_ctx, int is_server, int is_cwmp)
#else
int ssl_init(struct tp_ssl *ssl, const struct tls_root_ctx *ssl_ctx, int is_server)
#endif /* INCLUDE_HTTP_SSL_MIN_TLS1_2 */
{
int ret = -1;
const char *pers = "tp_ssl";
ssl_log(SSL_DEBUG, "enter %s", __FUNCTION__);
if (NULL == ssl || NULL == ssl_ctx) return -1;
memset(ssl, 0, sizeof(struct tp_ssl));
ssl_init_debug_level();
ssl_init_timeout();
mbedtls_ctr_drbg_init(&ssl->ctr_drbg);
mbedtls_entropy_init(&ssl->entropy);
if ((ret = mbedtls_ctr_drbg_seed(&ssl->ctr_drbg, mbedtls_entropy_func, &ssl->entropy,
(const unsigned char *) pers, strlen(pers))) != 0)
{
ssl_log(SSL_ERROR, "mbedtls_ctr_drbg_seed returned %d\n", ret );
goto exit;
}
/* Initialise SSL config */
mbedtls_ssl_config_init(&ssl->ssl_config);
if ((ret = mbedtls_ssl_config_defaults(&ssl->ssl_config, ssl_ctx->endpoint,
MBEDTLS_SSL_TRANSPORT_STREAM, MBEDTLS_SSL_PRESET_DEFAULT)) != 0)
{
ssl_log(SSL_ERROR, "mbedtls_ssl_config_defaults returned %d\n", ret );
goto exit;
}
mbedtls_ssl_conf_rng(&ssl->ssl_config, mbedtls_ctr_drbg_random, &ssl->ctr_drbg);
mbedtls_ssl_conf_dbg(&ssl->ssl_config, tp_debug, stdout);
mbedtls_ssl_cache_init(&ssl->cache);
mbedtls_ssl_conf_session_cache(&ssl->ssl_config, &ssl->cache,
mbedtls_ssl_cache_get,
mbedtls_ssl_cache_set);
mbedtls_ssl_conf_ciphersuites(&ssl->ssl_config, g_ciphersuite);
mbedtls_ssl_conf_ca_chain(&ssl->ssl_config, ssl_ctx->ca_chain, NULL);
if ((ret = mbedtls_ssl_conf_own_cert(&ssl->ssl_config, ssl_ctx->crt_chain,
ssl_ctx->priv_key)) != 0)
{
ssl_log(SSL_ERROR, "mbedtls_ssl_conf_own_cert returned %d\n", ret );
goto exit;
}
if (!is_server)
{
mbedtls_ssl_conf_verify(&ssl->ssl_config, verify_callback, NULL);
mbedtls_ssl_conf_authmode(&ssl->ssl_config, MBEDTLS_SSL_VERIFY_OPTIONAL);
}
#ifdef INCLUDE_IMDA
mbedtls_ssl_conf_min_version(&ssl->ssl_config, MBEDTLS_SSL_MAJOR_VERSION_3,
MBEDTLS_SSL_MINOR_VERSION_3);
#else
#ifdef INCLUDE_HTTP_SSL_MIN_TLS1_2
if (1 != is_cwmp)
{
mbedtls_ssl_conf_min_version(&ssl->ssl_config, MBEDTLS_SSL_MAJOR_VERSION_3,
MBEDTLS_SSL_MINOR_VERSION_3);
}
else
#endif /* INCLUDE_HTTP_SSL_MIN_TLS1_2 */
{
mbedtls_ssl_conf_min_version(&ssl->ssl_config, MBEDTLS_SSL_MAJOR_VERSION_3,
MBEDTLS_SSL_MINOR_VERSION_1);
}
#endif /* INCLUDE_IMDA */
mbedtls_ssl_conf_max_version(&ssl->ssl_config, MBEDTLS_SSL_MAJOR_VERSION_3,
MBEDTLS_SSL_MINOR_VERSION_3);
/* Initialise SSL context */
ssl->ctx = (mbedtls_ssl_context*)malloc(sizeof(mbedtls_ssl_context));
if (NULL == ssl->ctx) goto exit;
mbedtls_ssl_init(ssl->ctx);
if (mbedtls_ssl_setup(ssl->ctx, &ssl->ssl_config) != 0)
{
ssl_log(SSL_ERROR, "mbedtls_ssl_setup failed");
return -1;
}
if (is_server)
{
ssl->endpoint = MBEDTLS_SSL_IS_SERVER;
}
else
{
if (ssl_ctx->verify_cn)
{
mbedtls_ssl_set_hostname(ssl->ctx, ssl_ctx->verify_cn);
ssl->verify_cn = 1;
}
if (ssl_ctx->verify_time)
{
ssl->verify_time = 1;
}
ssl->endpoint = MBEDTLS_SSL_IS_CLIENT;
}
ssl_init_stream(&ssl->stream);
ret = 0;
exit:
ssl_log(SSL_DEBUG, "leave %s ret=%d", __FUNCTION__, ret);
return ret;
}这里有加载私钥的过程吗
mbedtls是一个开源的、可移植的SSL库，适用于嵌入式系统。它包含单向散列算法（如MD5, SHA）、对称加密算法（如AES, RSA）、伪随机数生成器（依赖AES和SHA-256）、公钥算法（如DHM, ECDH, RSA, ECDSA）以及X509证书支持。此外，还支持SSL/TLS协议，包括SSLv3到TLSv1.2。对于开发者来说，mbedtls提供了丰富的加密和安全功能。
扫一扫
6058
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
