24 static size_t tls_server_cert_chain_der_len(struct tlsv1_server *conn)  in tls_server_cert_chain_der_len()  argument
29 	cert = conn->cred ? conn->cred->cert : NULL;  in tls_server_cert_chain_der_len()
34 		cert = x509_certificate_get_subject(conn->cred->trusted_certs,  in tls_server_cert_chain_der_len()
42 static int tls_write_server_hello(struct tlsv1_server *conn,  in tls_write_server_hello()  argument
51 	tlsv1_server_log(conn, "Send ServerHello");  in tls_write_server_hello()
59 	WPA_PUT_BE32(conn->server_random, now.sec);  in tls_write_server_hello()
60 	if (random_get_bytes(conn->server_random + 4, TLS_RANDOM_LEN - 4)) {  in tls_write_server_hello()
66 		    conn->server_random, TLS_RANDOM_LEN);  in tls_write_server_hello()
68 	conn->session_id_len = TLS_SESSION_ID_MAX_LEN;  in tls_write_server_hello()
69 	if (random_get_bytes(conn->session_id, conn->session_id_len)) {  in tls_write_server_hello()
75 		    conn->session_id, conn->session_id_len);  in tls_write_server_hello()
88 	WPA_PUT_BE16(pos, conn->rl.tls_version);  in tls_write_server_hello()
91 	os_memcpy(pos, conn->server_random, TLS_RANDOM_LEN);  in tls_write_server_hello()
94 	*pos++ = conn->session_id_len;  in tls_write_server_hello()
95 	os_memcpy(pos, conn->session_id, conn->session_id_len);  in tls_write_server_hello()
96 	pos += conn->session_id_len;  in tls_write_server_hello()
98 	WPA_PUT_BE16(pos, conn->cipher_suite);  in tls_write_server_hello()
107 	if (conn->status_request) {  in tls_write_server_hello()
117 	if (conn->status_request_v2) {  in tls_write_server_hello()
129 	if (conn->session_ticket && conn->session_ticket_cb) {  in tls_write_server_hello()
130 		int res = conn->session_ticket_cb(  in tls_write_server_hello()
131 			conn->session_ticket_cb_ctx,  in tls_write_server_hello()
132 			conn->session_ticket, conn->session_ticket_len,  in tls_write_server_hello()
133 			conn->client_random, conn->server_random,  in tls_write_server_hello()
134 			conn->master_secret);  in tls_write_server_hello()
136 			tlsv1_server_log(conn, "SessionTicket callback indicated failure");  in tls_write_server_hello()
137 			tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_hello()
141 		conn->use_session_ticket = res;  in tls_write_server_hello()
143 		if (conn->use_session_ticket) {  in tls_write_server_hello()
144 			if (tlsv1_server_derive_keys(conn, NULL, 0) < 0) {  in tls_write_server_hello()
147 				tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_hello()
171 	tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);  in tls_write_server_hello()
173 	if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,  in tls_write_server_hello()
177 		tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_hello()
189 static int tls_write_server_certificate(struct tlsv1_server *conn,  in tls_write_server_certificate()  argument
197 	suite = tls_get_cipher_suite(conn->rl.cipher_suite);  in tls_write_server_certificate()
206 		tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_certificate()
211 	tlsv1_server_log(conn, "Send Certificate");  in tls_write_server_certificate()
228 	cert = conn->cred->cert;  in tls_write_server_certificate()
235 			tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_certificate()
246 		cert = x509_certificate_get_subject(conn->cred->trusted_certs,  in tls_write_server_certificate()
249 	if (cert == conn->cred->cert || cert == NULL) {  in tls_write_server_certificate()
263 	if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,  in tls_write_server_certificate()
267 		tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_certificate()
273 	tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);  in tls_write_server_certificate()
281 static int tls_write_server_certificate_status(struct tlsv1_server *conn,  in tls_write_server_certificate_status()  argument
301 		tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_certificate_status()
306 	tlsv1_server_log(conn, "Send CertificateStatus (multi=%d)", ocsp_multi);  in tls_write_server_certificate_status()
350 	if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,  in tls_write_server_certificate_status()
354 		tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_certificate_status()
360 	tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);  in tls_write_server_certificate_status()
368 static int tls_write_server_key_exchange(struct tlsv1_server *conn,  in tls_write_server_key_exchange()  argument
380 	suite = tls_get_cipher_suite(conn->rl.cipher_suite);  in tls_write_server_key_exchange()
386 	if (!tls_server_key_exchange_allowed(conn->rl.cipher_suite)) {  in tls_write_server_key_exchange()
397 	if (conn->cred == NULL || conn->cred->dh_p == NULL ||  in tls_write_server_key_exchange()
398 	    conn->cred->dh_g == NULL) {  in tls_write_server_key_exchange()
404 	tlsv1_server_get_dh_p(conn, &dh_p, &dh_p_len);  in tls_write_server_key_exchange()
406 	os_free(conn->dh_secret);  in tls_write_server_key_exchange()
407 	conn->dh_secret_len = dh_p_len;  in tls_write_server_key_exchange()
408 	conn->dh_secret = os_malloc(conn->dh_secret_len);  in tls_write_server_key_exchange()
409 	if (conn->dh_secret == NULL) {  in tls_write_server_key_exchange()
412 		tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_key_exchange()
416 	if (random_get_bytes(conn->dh_secret, conn->dh_secret_len)) {  in tls_write_server_key_exchange()
419 		tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_key_exchange()
421 		os_free(conn->dh_secret);  in tls_write_server_key_exchange()
422 		conn->dh_secret = NULL;  in tls_write_server_key_exchange()
426 	if (os_memcmp(conn->dh_secret, dh_p, conn->dh_secret_len) > 0)  in tls_write_server_key_exchange()
427 		conn->dh_secret[0] = 0; /* make sure secret < p */  in tls_write_server_key_exchange()
429 	pos = conn->dh_secret;  in tls_write_server_key_exchange()
430 	while (pos + 1 < conn->dh_secret + conn->dh_secret_len && *pos == 0)  in tls_write_server_key_exchange()
432 	if (pos != conn->dh_secret) {  in tls_write_server_key_exchange()
433 		os_memmove(conn->dh_secret, pos,  in tls_write_server_key_exchange()
434 			   conn->dh_secret_len - (pos - conn->dh_secret));  in tls_write_server_key_exchange()
435 		conn->dh_secret_len -= pos - conn->dh_secret;  in tls_write_server_key_exchange()
438 			conn->dh_secret, conn->dh_secret_len);  in tls_write_server_key_exchange()
446 		tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_key_exchange()
450 	if (crypto_mod_exp(conn->cred->dh_g, conn->cred->dh_g_len,  in tls_write_server_key_exchange()
451 			   conn->dh_secret, conn->dh_secret_len,  in tls_write_server_key_exchange()
453 		tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_key_exchange()
483 	tlsv1_server_log(conn, "Send ServerKeyExchange");  in tls_write_server_key_exchange()
503 		tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_key_exchange()
514 	if (2 + conn->cred->dh_g_len > (size_t) (end - pos)) {  in tls_write_server_key_exchange()
517 		tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_key_exchange()
522 	WPA_PUT_BE16(pos, conn->cred->dh_g_len);  in tls_write_server_key_exchange()
524 	os_memcpy(pos, conn->cred->dh_g, conn->cred->dh_g_len);  in tls_write_server_key_exchange()
525 	pos += conn->cred->dh_g_len;  in tls_write_server_key_exchange()
531 		tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_key_exchange()
569 		if (conn->rl.tls_version >= TLS_VERSION_1_2) {  in tls_write_server_key_exchange()
572 				conn->rl.tls_version, TLS_HASH_ALG_SHA256,  in tls_write_server_key_exchange()
573 				conn->client_random,  in tls_write_server_key_exchange()
574 				conn->server_random, server_params,  in tls_write_server_key_exchange()
588 				tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_key_exchange()
615 			tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_key_exchange()
621 				conn->rl.tls_version, conn->client_random,  in tls_write_server_key_exchange()
622 				conn->server_random, server_params,  in tls_write_server_key_exchange()
627 			tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_key_exchange()
635 		if (conn->test_flags & TLS_BREAK_SRV_KEY_X_HASH) {  in tls_write_server_key_exchange()
636 			tlsv1_server_log(conn, "TESTING: Break ServerKeyExchange signed params hash");  in tls_write_server_key_exchange()
656 		if (conn->cred == NULL ||  in tls_write_server_key_exchange()
657 		    crypto_private_key_sign_pkcs1(conn->cred->key, hash, hlen,  in tls_write_server_key_exchange()
660 			tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_key_exchange()
666 		if (conn->test_flags & TLS_BREAK_SRV_KEY_X_SIGNATURE) {  in tls_write_server_key_exchange()
667 			tlsv1_server_log(conn, "TESTING: Break ServerKeyExchange signed params signature");  in tls_write_server_key_exchange()
677 	if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,  in tls_write_server_key_exchange()
681 		tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_key_exchange()
687 	tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);  in tls_write_server_key_exchange()
695 static int tls_write_server_certificate_request(struct tlsv1_server *conn,  in tls_write_server_certificate_request()  argument
701 	if (!conn->verify_peer) {  in tls_write_server_certificate_request()
708 	tlsv1_server_log(conn, "Send CertificateRequest");  in tls_write_server_certificate_request()
743 	if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,  in tls_write_server_certificate_request()
747 		tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_certificate_request()
753 	tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);  in tls_write_server_certificate_request()
761 static int tls_write_server_hello_done(struct tlsv1_server *conn,  in tls_write_server_hello_done()  argument
768 	tlsv1_server_log(conn, "Send ServerHelloDone");  in tls_write_server_hello_done()
781 	if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,  in tls_write_server_hello_done()
785 		tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_hello_done()
790 	tls_verify_hash_add(&conn->verify, payload, pos - payload);  in tls_write_server_hello_done()
798 static int tls_write_server_change_cipher_spec(struct tlsv1_server *conn,  in tls_write_server_change_cipher_spec()  argument
804 	tlsv1_server_log(conn, "Send ChangeCipherSpec");  in tls_write_server_change_cipher_spec()
808 	if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_CHANGE_CIPHER_SPEC,  in tls_write_server_change_cipher_spec()
812 		tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_change_cipher_spec()
817 	if (tlsv1_record_change_write_cipher(&conn->rl) < 0) {  in tls_write_server_change_cipher_spec()
820 		tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_change_cipher_spec()
831 static int tls_write_server_finished(struct tlsv1_server *conn,  in tls_write_server_finished()  argument
841 	tlsv1_server_log(conn, "Send Finished");  in tls_write_server_finished()
846 	if (conn->rl.tls_version >= TLS_VERSION_1_2) {  in tls_write_server_finished()
848 		if (conn->verify.sha256_server == NULL ||  in tls_write_server_finished()
849 		    crypto_hash_finish(conn->verify.sha256_server, hash, &hlen)  in tls_write_server_finished()
851 			conn->verify.sha256_server = NULL;  in tls_write_server_finished()
852 			tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_finished()
856 		conn->verify.sha256_server = NULL;  in tls_write_server_finished()
861 	if (conn->verify.md5_server == NULL ||  in tls_write_server_finished()
862 	    crypto_hash_finish(conn->verify.md5_server, hash, &hlen) < 0) {  in tls_write_server_finished()
863 		tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_finished()
865 		conn->verify.md5_server = NULL;  in tls_write_server_finished()
866 		crypto_hash_finish(conn->verify.sha1_server, NULL, NULL);  in tls_write_server_finished()
867 		conn->verify.sha1_server = NULL;  in tls_write_server_finished()
870 	conn->verify.md5_server = NULL;  in tls_write_server_finished()
872 	if (conn->verify.sha1_server == NULL ||  in tls_write_server_finished()
873 	    crypto_hash_finish(conn->verify.sha1_server, hash + MD5_MAC_LEN,  in tls_write_server_finished()
875 		conn->verify.sha1_server = NULL;  in tls_write_server_finished()
876 		tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_finished()
880 	conn->verify.sha1_server = NULL;  in tls_write_server_finished()
887 	if (tls_prf(conn->rl.tls_version,  in tls_write_server_finished()
888 		    conn->master_secret, TLS_MASTER_SECRET_LEN,  in tls_write_server_finished()
892 		tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_finished()
899 	if (conn->test_flags & TLS_BREAK_VERIFY_DATA) {  in tls_write_server_finished()
900 		tlsv1_server_log(conn, "TESTING: Break verify_data (server)");  in tls_write_server_finished()
913 	tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);  in tls_write_server_finished()
915 	if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,  in tls_write_server_finished()
919 		tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,  in tls_write_server_finished()
930 static u8 * tls_send_server_hello(struct tlsv1_server *conn, size_t *out_len)  in tls_send_server_hello()  argument
940 	if (conn->status_request_multi &&  in tls_send_server_hello()
941 	    conn->cred->ocsp_stapling_response_multi) {  in tls_send_server_hello()
943 			conn->cred->ocsp_stapling_response_multi,  in tls_send_server_hello()
946 	} else if ((conn->status_request || conn->status_request_v2) &&  in tls_send_server_hello()
947 		   conn->cred->ocsp_stapling_response) {  in tls_send_server_hello()
948 		ocsp_resp = os_readfile(conn->cred->ocsp_stapling_response,  in tls_send_server_hello()
954 	msglen = 1000 + tls_server_cert_chain_der_len(conn) + ocsp_resp_len;  in tls_send_server_hello()
965 	if (tls_write_server_hello(conn, &pos, end) < 0) {  in tls_send_server_hello()
971 	if (conn->use_session_ticket) {  in tls_send_server_hello()
975 		if (tls_write_server_change_cipher_spec(conn, &pos, end) < 0 ||  in tls_send_server_hello()
976 		    tls_write_server_finished(conn, &pos, end) < 0) {  in tls_send_server_hello()
983 		conn->state = CHANGE_CIPHER_SPEC;  in tls_send_server_hello()
989 	if (tls_write_server_certificate(conn, &pos, end) < 0 ||  in tls_send_server_hello()
990 	    tls_write_server_certificate_status(conn, &pos, end, ocsp_multi,  in tls_send_server_hello()
992 	    tls_write_server_key_exchange(conn, &pos, end) < 0 ||  in tls_send_server_hello()
993 	    tls_write_server_certificate_request(conn, &pos, end) < 0 ||  in tls_send_server_hello()
994 	    tls_write_server_hello_done(conn, &pos, end) < 0) {  in tls_send_server_hello()
1003 	conn->state = CLIENT_CERTIFICATE;  in tls_send_server_hello()
1009 static u8 * tls_send_change_cipher_spec(struct tlsv1_server *conn,  in tls_send_change_cipher_spec()  argument
1023 	if (tls_write_server_change_cipher_spec(conn, &pos, end) < 0 ||  in tls_send_change_cipher_spec()
1024 	    tls_write_server_finished(conn, &pos, end) < 0) {  in tls_send_change_cipher_spec()
1031 	tlsv1_server_log(conn, "Handshake completed successfully");  in tls_send_change_cipher_spec()
1032 	conn->state = ESTABLISHED;  in tls_send_change_cipher_spec()
1038 u8 * tlsv1_server_handshake_write(struct tlsv1_server *conn, size_t *out_len)  in tlsv1_server_handshake_write()  argument
1040 	switch (conn->state) {  in tlsv1_server_handshake_write()
1042 		return tls_send_server_hello(conn, out_len);  in tlsv1_server_handshake_write()
1044 		return tls_send_change_cipher_spec(conn, out_len);  in tlsv1_server_handshake_write()
1046 		if (conn->state == ESTABLISHED && conn->use_session_ticket) {  in tlsv1_server_handshake_write()
1050 		tlsv1_server_log(conn, "Unexpected state %d while generating reply",  in tlsv1_server_handshake_write()
1051 				 conn->state);  in tlsv1_server_handshake_write()
1057 u8 * tlsv1_server_send_alert(struct tlsv1_server *conn, u8 level,  in tlsv1_server_send_alert()  argument
1062 	tlsv1_server_log(conn, "Send Alert(%d:%d)", level, description);  in tlsv1_server_send_alert()
1075 	WPA_PUT_BE16(pos, conn->rl.tls_version ? conn->rl.tls_version :  in tlsv1_server_send_alert()