1 /* 2 * SSL/TLS interface functions for OpenSSL 3 * Copyright (c) 2004-2015, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 11 #ifndef CONFIG_SMARTCARD 12 #ifndef OPENSSL_NO_ENGINE 13 #ifndef ANDROID 14 #define OPENSSL_NO_ENGINE 15 #endif 16 #endif 17 #endif 18 19 #include <openssl/ssl.h> 20 #include <openssl/err.h> 21 #include <openssl/opensslv.h> 22 #include <openssl/pkcs12.h> 23 #include <openssl/x509v3.h> 24 #ifndef OPENSSL_NO_ENGINE 25 #include <openssl/engine.h> 26 #endif /* OPENSSL_NO_ENGINE */ 27 #ifndef OPENSSL_NO_DSA 28 #include <openssl/dsa.h> 29 #endif 30 #ifndef OPENSSL_NO_DH 31 #include <openssl/dh.h> 32 #endif 33 34 #include "common.h" 35 #include "crypto.h" 36 #include "sha1.h" 37 #include "sha256.h" 38 #include "tls.h" 39 #include "tls_openssl.h" 40 41 #if !defined(CONFIG_FIPS) && \ 42 (defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || \ 43 defined(EAP_SERVER_FAST)) 44 #define OPENSSL_NEED_EAP_FAST_PRF 45 #endif 46 47 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || \ 48 defined(EAP_SERVER_FAST) || defined(EAP_TEAP) || \ 49 defined(EAP_SERVER_TEAP) 50 #define EAP_FAST_OR_TEAP 51 #endif 52 53 54 #if defined(OPENSSL_IS_BORINGSSL) 55 /* stack_index_t is the return type of OpenSSL's sk_XXX_num() functions. */ 56 typedef size_t stack_index_t; 57 #else 58 typedef int stack_index_t; 59 #endif 60 61 #ifdef SSL_set_tlsext_status_type 62 #ifndef OPENSSL_NO_TLSEXT 63 #define HAVE_OCSP 64 #include <openssl/ocsp.h> 65 #endif /* OPENSSL_NO_TLSEXT */ 66 #endif /* SSL_set_tlsext_status_type */ 67 68 #if (OPENSSL_VERSION_NUMBER < 0x10100000L || \ 69 (defined(LIBRESSL_VERSION_NUMBER) && \ 70 LIBRESSL_VERSION_NUMBER < 0x20700000L)) && \ 71 !defined(BORINGSSL_API_VERSION) 72 /* 73 * SSL_get_client_random() and SSL_get_server_random() were added in OpenSSL 74 * 1.1.0 and newer BoringSSL revisions. Provide compatibility wrappers for 75 * older versions. 76 */ 77 78 static size_t SSL_get_client_random(const SSL *ssl, unsigned char *out, 79 size_t outlen) 80 { 81 if (!ssl->s3 || outlen < SSL3_RANDOM_SIZE) 82 return 0; 83 os_memcpy(out, ssl->s3->client_random, SSL3_RANDOM_SIZE); 84 return SSL3_RANDOM_SIZE; 85 } 86 87 88 static size_t SSL_get_server_random(const SSL *ssl, unsigned char *out, 89 size_t outlen) 90 { 91 if (!ssl->s3 || outlen < SSL3_RANDOM_SIZE) 92 return 0; 93 os_memcpy(out, ssl->s3->server_random, SSL3_RANDOM_SIZE); 94 return SSL3_RANDOM_SIZE; 95 } 96 97 98 #ifdef OPENSSL_NEED_EAP_FAST_PRF 99 static size_t SSL_SESSION_get_master_key(const SSL_SESSION *session, 100 unsigned char *out, size_t outlen) 101 { 102 if (!session || session->master_key_length < 0 || 103 (size_t) session->master_key_length > outlen) 104 return 0; 105 if ((size_t) session->master_key_length < outlen) 106 outlen = session->master_key_length; 107 os_memcpy(out, session->master_key, outlen); 108 return outlen; 109 } 110 #endif /* OPENSSL_NEED_EAP_FAST_PRF */ 111 112 #endif 113 114 #if OPENSSL_VERSION_NUMBER < 0x10100000L || \ 115 (defined(LIBRESSL_VERSION_NUMBER) && \ 116 LIBRESSL_VERSION_NUMBER < 0x20700000L) 117 #ifdef CONFIG_SUITEB 118 static int RSA_bits(const RSA *r) 119 { 120 return BN_num_bits(r->n); 121 } 122 #endif /* CONFIG_SUITEB */ 123 124 125 static const unsigned char * ASN1_STRING_get0_data(const ASN1_STRING *x) 126 { 127 return ASN1_STRING_data((ASN1_STRING *) x); 128 } 129 #endif 130 131 #ifdef ANDROID 132 #include <openssl/pem.h> 133 #include <keystore/keystore_get.h> 134 135 static BIO * BIO_from_keystore(const char *key) 136 { 137 BIO *bio = NULL; 138 uint8_t *value = NULL; 139 int length = keystore_get(key, strlen(key), &value); 140 if (length != -1 && (bio = BIO_new(BIO_s_mem())) != NULL) 141 BIO_write(bio, value, length); 142 free(value); 143 return bio; 144 } 145 146 147 static int tls_add_ca_from_keystore(X509_STORE *ctx, const char *key_alias) 148 { 149 BIO *bio = BIO_from_keystore(key_alias); 150 STACK_OF(X509_INFO) *stack = NULL; 151 stack_index_t i; 152 153 if (bio) { 154 stack = PEM_X509_INFO_read_bio(bio, NULL, NULL, NULL); 155 BIO_free(bio); 156 } 157 158 if (!stack) { 159 wpa_printf(MSG_WARNING, "TLS: Failed to parse certificate: %s", 160 key_alias); 161 return -1; 162 } 163 164 for (i = 0; i < sk_X509_INFO_num(stack); ++i) { 165 X509_INFO *info = sk_X509_INFO_value(stack, i); 166 167 if (info->x509) 168 X509_STORE_add_cert(ctx, info->x509); 169 if (info->crl) 170 X509_STORE_add_crl(ctx, info->crl); 171 } 172 173 sk_X509_INFO_pop_free(stack, X509_INFO_free); 174 175 return 0; 176 } 177 178 179 static int tls_add_ca_from_keystore_encoded(X509_STORE *ctx, 180 const char *encoded_key_alias) 181 { 182 int rc = -1; 183 int len = os_strlen(encoded_key_alias); 184 unsigned char *decoded_alias; 185 186 if (len & 1) { 187 wpa_printf(MSG_WARNING, "Invalid hex-encoded alias: %s", 188 encoded_key_alias); 189 return rc; 190 } 191 192 decoded_alias = os_malloc(len / 2 + 1); 193 if (decoded_alias) { 194 if (!hexstr2bin(encoded_key_alias, decoded_alias, len / 2)) { 195 decoded_alias[len / 2] = '\0'; 196 rc = tls_add_ca_from_keystore( 197 ctx, (const char *) decoded_alias); 198 } 199 os_free(decoded_alias); 200 } 201 202 return rc; 203 } 204 205 #endif /* ANDROID */ 206 207 static int tls_openssl_ref_count = 0; 208 static int tls_ex_idx_session = -1; 209 210 struct tls_context { 211 void (*event_cb)(void *ctx, enum tls_event ev, 212 union tls_event_data *data); 213 void *cb_ctx; 214 int cert_in_cb; 215 char *ocsp_stapling_response; 216 }; 217 218 static struct tls_context *tls_global = NULL; 219 220 221 struct tls_data { 222 SSL_CTX *ssl; 223 unsigned int tls_session_lifetime; 224 int check_crl; 225 int check_crl_strict; 226 char *ca_cert; 227 unsigned int crl_reload_interval; 228 struct os_reltime crl_last_reload; 229 char *check_cert_subject; 230 }; 231 232 struct tls_connection { 233 struct tls_context *context; 234 struct tls_data *data; 235 SSL_CTX *ssl_ctx; 236 SSL *ssl; 237 BIO *ssl_in, *ssl_out; 238 #if defined(ANDROID) || !defined(OPENSSL_NO_ENGINE) 239 ENGINE *engine; /* functional reference to the engine */ 240 EVP_PKEY *private_key; /* the private key if using engine */ 241 #endif /* OPENSSL_NO_ENGINE */ 242 char *subject_match, *altsubject_match, *suffix_match, *domain_match; 243 char *check_cert_subject; 244 int read_alerts, write_alerts, failed; 245 246 tls_session_ticket_cb session_ticket_cb; 247 void *session_ticket_cb_ctx; 248 249 /* SessionTicket received from OpenSSL hello_extension_cb (server) */ 250 u8 *session_ticket; 251 size_t session_ticket_len; 252 253 unsigned int ca_cert_verify:1; 254 unsigned int cert_probe:1; 255 unsigned int server_cert_only:1; 256 unsigned int invalid_hb_used:1; 257 unsigned int success_data:1; 258 unsigned int client_hello_generated:1; 259 unsigned int server:1; 260 261 u8 srv_cert_hash[32]; 262 263 unsigned int flags; 264 265 X509 *peer_cert; 266 X509 *peer_issuer; 267 X509 *peer_issuer_issuer; 268 char *peer_subject; /* peer subject info for authenticated peer */ 269 270 unsigned char client_random[SSL3_RANDOM_SIZE]; 271 unsigned char server_random[SSL3_RANDOM_SIZE]; 272 273 u16 cipher_suite; 274 int server_dh_prime_len; 275 }; 276 277 278 static struct tls_context * tls_context_new(const struct tls_config *conf) 279 { 280 struct tls_context *context = os_zalloc(sizeof(*context)); 281 if (context == NULL) 282 return NULL; 283 if (conf) { 284 context->event_cb = conf->event_cb; 285 context->cb_ctx = conf->cb_ctx; 286 context->cert_in_cb = conf->cert_in_cb; 287 } 288 return context; 289 } 290 291 292 #ifdef CONFIG_NO_STDOUT_DEBUG 293 294 static void _tls_show_errors(void) 295 { 296 unsigned long err; 297 298 while ((err = ERR_get_error())) { 299 /* Just ignore the errors, since stdout is disabled */ 300 } 301 } 302 #define tls_show_errors(l, f, t) _tls_show_errors() 303 304 #else /* CONFIG_NO_STDOUT_DEBUG */ 305 306 static void tls_show_errors(int level, const char *func, const char *txt) 307 { 308 unsigned long err; 309 310 wpa_printf(level, "OpenSSL: %s - %s %s", 311 func, txt, ERR_error_string(ERR_get_error(), NULL)); 312 313 while ((err = ERR_get_error())) { 314 wpa_printf(MSG_INFO, "OpenSSL: pending error: %s", 315 ERR_error_string(err, NULL)); 316 } 317 } 318 319 #endif /* CONFIG_NO_STDOUT_DEBUG */ 320 321 322 static X509_STORE * tls_crl_cert_reload(const char *ca_cert, int check_crl) 323 { 324 int flags; 325 X509_STORE *store; 326 327 store = X509_STORE_new(); 328 if (!store) { 329 wpa_printf(MSG_DEBUG, 330 "OpenSSL: %s - failed to allocate new certificate store", 331 __func__); 332 return NULL; 333 } 334 335 if (ca_cert && X509_STORE_load_locations(store, ca_cert, NULL) != 1) { 336 tls_show_errors(MSG_WARNING, __func__, 337 "Failed to load root certificates"); 338 X509_STORE_free(store); 339 return NULL; 340 } 341 342 flags = check_crl ? X509_V_FLAG_CRL_CHECK : 0; 343 if (check_crl == 2) 344 flags |= X509_V_FLAG_CRL_CHECK_ALL; 345 346 X509_STORE_set_flags(store, flags); 347 348 return store; 349 } 350 351 352 #ifdef CONFIG_NATIVE_WINDOWS 353 354 /* Windows CryptoAPI and access to certificate stores */ 355 #include <wincrypt.h> 356 357 #ifdef __MINGW32_VERSION 358 /* 359 * MinGW does not yet include all the needed definitions for CryptoAPI, so 360 * define here whatever extra is needed. 361 */ 362 #define CERT_SYSTEM_STORE_CURRENT_USER (1 << 16) 363 #define CERT_STORE_READONLY_FLAG 0x00008000 364 #define CERT_STORE_OPEN_EXISTING_FLAG 0x00004000 365 366 #endif /* __MINGW32_VERSION */ 367 368 369 struct cryptoapi_rsa_data { 370 const CERT_CONTEXT *cert; 371 HCRYPTPROV crypt_prov; 372 DWORD key_spec; 373 BOOL free_crypt_prov; 374 }; 375 376 377 static void cryptoapi_error(const char *msg) 378 { 379 wpa_printf(MSG_INFO, "CryptoAPI: %s; err=%u", 380 msg, (unsigned int) GetLastError()); 381 } 382 383 384 static int cryptoapi_rsa_pub_enc(int flen, const unsigned char *from, 385 unsigned char *to, RSA *rsa, int padding) 386 { 387 wpa_printf(MSG_DEBUG, "%s - not implemented", __func__); 388 return 0; 389 } 390 391 392 static int cryptoapi_rsa_pub_dec(int flen, const unsigned char *from, 393 unsigned char *to, RSA *rsa, int padding) 394 { 395 wpa_printf(MSG_DEBUG, "%s - not implemented", __func__); 396 return 0; 397 } 398 399 400 static int cryptoapi_rsa_priv_enc(int flen, const unsigned char *from, 401 unsigned char *to, RSA *rsa, int padding) 402 { 403 struct cryptoapi_rsa_data *priv = 404 (struct cryptoapi_rsa_data *) rsa->meth->app_data; 405 HCRYPTHASH hash; 406 DWORD hash_size, len, i; 407 unsigned char *buf = NULL; 408 int ret = 0; 409 410 if (priv == NULL) { 411 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, 412 ERR_R_PASSED_NULL_PARAMETER); 413 return 0; 414 } 415 416 if (padding != RSA_PKCS1_PADDING) { 417 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, 418 RSA_R_UNKNOWN_PADDING_TYPE); 419 return 0; 420 } 421 422 if (flen != 16 /* MD5 */ + 20 /* SHA-1 */) { 423 wpa_printf(MSG_INFO, "%s - only MD5-SHA1 hash supported", 424 __func__); 425 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, 426 RSA_R_INVALID_MESSAGE_LENGTH); 427 return 0; 428 } 429 430 if (!CryptCreateHash(priv->crypt_prov, CALG_SSL3_SHAMD5, 0, 0, &hash)) 431 { 432 cryptoapi_error("CryptCreateHash failed"); 433 return 0; 434 } 435 436 len = sizeof(hash_size); 437 if (!CryptGetHashParam(hash, HP_HASHSIZE, (BYTE *) &hash_size, &len, 438 0)) { 439 cryptoapi_error("CryptGetHashParam failed"); 440 goto err; 441 } 442 443 if ((int) hash_size != flen) { 444 wpa_printf(MSG_INFO, "CryptoAPI: Invalid hash size (%u != %d)", 445 (unsigned) hash_size, flen); 446 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, 447 RSA_R_INVALID_MESSAGE_LENGTH); 448 goto err; 449 } 450 if (!CryptSetHashParam(hash, HP_HASHVAL, (BYTE * ) from, 0)) { 451 cryptoapi_error("CryptSetHashParam failed"); 452 goto err; 453 } 454 455 len = RSA_size(rsa); 456 buf = os_malloc(len); 457 if (buf == NULL) { 458 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, ERR_R_MALLOC_FAILURE); 459 goto err; 460 } 461 462 if (!CryptSignHash(hash, priv->key_spec, NULL, 0, buf, &len)) { 463 cryptoapi_error("CryptSignHash failed"); 464 goto err; 465 } 466 467 for (i = 0; i < len; i++) 468 to[i] = buf[len - i - 1]; 469 ret = len; 470 471 err: 472 os_free(buf); 473 CryptDestroyHash(hash); 474 475 return ret; 476 } 477 478 479 static int cryptoapi_rsa_priv_dec(int flen, const unsigned char *from, 480 unsigned char *to, RSA *rsa, int padding) 481 { 482 wpa_printf(MSG_DEBUG, "%s - not implemented", __func__); 483 return 0; 484 } 485 486 487 static void cryptoapi_free_data(struct cryptoapi_rsa_data *priv) 488 { 489 if (priv == NULL) 490 return; 491 if (priv->crypt_prov && priv->free_crypt_prov) 492 CryptReleaseContext(priv->crypt_prov, 0); 493 if (priv->cert) 494 CertFreeCertificateContext(priv->cert); 495 os_free(priv); 496 } 497 498 499 static int cryptoapi_finish(RSA *rsa) 500 { 501 cryptoapi_free_data((struct cryptoapi_rsa_data *) rsa->meth->app_data); 502 os_free((void *) rsa->meth); 503 rsa->meth = NULL; 504 return 1; 505 } 506 507 508 static const CERT_CONTEXT * cryptoapi_find_cert(const char *name, DWORD store) 509 { 510 HCERTSTORE cs; 511 const CERT_CONTEXT *ret = NULL; 512 513 cs = CertOpenStore((LPCSTR) CERT_STORE_PROV_SYSTEM, 0, 0, 514 store | CERT_STORE_OPEN_EXISTING_FLAG | 515 CERT_STORE_READONLY_FLAG, L"MY"); 516 if (cs == NULL) { 517 cryptoapi_error("Failed to open 'My system store'"); 518 return NULL; 519 } 520 521 if (strncmp(name, "cert://", 7) == 0) { 522 unsigned short wbuf[255]; 523 MultiByteToWideChar(CP_ACP, 0, name + 7, -1, wbuf, 255); 524 ret = CertFindCertificateInStore(cs, X509_ASN_ENCODING | 525 PKCS_7_ASN_ENCODING, 526 0, CERT_FIND_SUBJECT_STR, 527 wbuf, NULL); 528 } else if (strncmp(name, "hash://", 7) == 0) { 529 CRYPT_HASH_BLOB blob; 530 int len; 531 const char *hash = name + 7; 532 unsigned char *buf; 533 534 len = os_strlen(hash) / 2; 535 buf = os_malloc(len); 536 if (buf && hexstr2bin(hash, buf, len) == 0) { 537 blob.cbData = len; 538 blob.pbData = buf; 539 ret = CertFindCertificateInStore(cs, 540 X509_ASN_ENCODING | 541 PKCS_7_ASN_ENCODING, 542 0, CERT_FIND_HASH, 543 &blob, NULL); 544 } 545 os_free(buf); 546 } 547 548 CertCloseStore(cs, 0); 549 550 return ret; 551 } 552 553 554 static int tls_cryptoapi_cert(SSL *ssl, const char *name) 555 { 556 X509 *cert = NULL; 557 RSA *rsa = NULL, *pub_rsa; 558 struct cryptoapi_rsa_data *priv; 559 RSA_METHOD *rsa_meth; 560 561 if (name == NULL || 562 (strncmp(name, "cert://", 7) != 0 && 563 strncmp(name, "hash://", 7) != 0)) 564 return -1; 565 566 priv = os_zalloc(sizeof(*priv)); 567 rsa_meth = os_zalloc(sizeof(*rsa_meth)); 568 if (priv == NULL || rsa_meth == NULL) { 569 wpa_printf(MSG_WARNING, "CryptoAPI: Failed to allocate memory " 570 "for CryptoAPI RSA method"); 571 os_free(priv); 572 os_free(rsa_meth); 573 return -1; 574 } 575 576 priv->cert = cryptoapi_find_cert(name, CERT_SYSTEM_STORE_CURRENT_USER); 577 if (priv->cert == NULL) { 578 priv->cert = cryptoapi_find_cert( 579 name, CERT_SYSTEM_STORE_LOCAL_MACHINE); 580 } 581 if (priv->cert == NULL) { 582 wpa_printf(MSG_INFO, "CryptoAPI: Could not find certificate " 583 "'%s'", name); 584 goto err; 585 } 586 587 cert = d2i_X509(NULL, 588 (const unsigned char **) &priv->cert->pbCertEncoded, 589 priv->cert->cbCertEncoded); 590 if (cert == NULL) { 591 wpa_printf(MSG_INFO, "CryptoAPI: Could not process X509 DER " 592 "encoding"); 593 goto err; 594 } 595 596 if (!CryptAcquireCertificatePrivateKey(priv->cert, 597 CRYPT_ACQUIRE_COMPARE_KEY_FLAG, 598 NULL, &priv->crypt_prov, 599 &priv->key_spec, 600 &priv->free_crypt_prov)) { 601 cryptoapi_error("Failed to acquire a private key for the " 602 "certificate"); 603 goto err; 604 } 605 606 rsa_meth->name = "Microsoft CryptoAPI RSA Method"; 607 rsa_meth->rsa_pub_enc = cryptoapi_rsa_pub_enc; 608 rsa_meth->rsa_pub_dec = cryptoapi_rsa_pub_dec; 609 rsa_meth->rsa_priv_enc = cryptoapi_rsa_priv_enc; 610 rsa_meth->rsa_priv_dec = cryptoapi_rsa_priv_dec; 611 rsa_meth->finish = cryptoapi_finish; 612 rsa_meth->flags = RSA_METHOD_FLAG_NO_CHECK; 613 rsa_meth->app_data = (char *) priv; 614 615 rsa = RSA_new(); 616 if (rsa == NULL) { 617 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, 618 ERR_R_MALLOC_FAILURE); 619 goto err; 620 } 621 622 if (!SSL_use_certificate(ssl, cert)) { 623 RSA_free(rsa); 624 rsa = NULL; 625 goto err; 626 } 627 pub_rsa = cert->cert_info->key->pkey->pkey.rsa; 628 X509_free(cert); 629 cert = NULL; 630 631 rsa->n = BN_dup(pub_rsa->n); 632 rsa->e = BN_dup(pub_rsa->e); 633 if (!RSA_set_method(rsa, rsa_meth)) 634 goto err; 635 636 if (!SSL_use_RSAPrivateKey(ssl, rsa)) 637 goto err; 638 RSA_free(rsa); 639 640 return 0; 641 642 err: 643 if (cert) 644 X509_free(cert); 645 if (rsa) 646 RSA_free(rsa); 647 else { 648 os_free(rsa_meth); 649 cryptoapi_free_data(priv); 650 } 651 return -1; 652 } 653 654 655 static int tls_cryptoapi_ca_cert(SSL_CTX *ssl_ctx, SSL *ssl, const char *name) 656 { 657 HCERTSTORE cs; 658 PCCERT_CONTEXT ctx = NULL; 659 X509 *cert; 660 char buf[128]; 661 const char *store; 662 #ifdef UNICODE 663 WCHAR *wstore; 664 #endif /* UNICODE */ 665 666 if (name == NULL || strncmp(name, "cert_store://", 13) != 0) 667 return -1; 668 669 store = name + 13; 670 #ifdef UNICODE 671 wstore = os_malloc((os_strlen(store) + 1) * sizeof(WCHAR)); 672 if (wstore == NULL) 673 return -1; 674 wsprintf(wstore, L"%S", store); 675 cs = CertOpenSystemStore(0, wstore); 676 os_free(wstore); 677 #else /* UNICODE */ 678 cs = CertOpenSystemStore(0, store); 679 #endif /* UNICODE */ 680 if (cs == NULL) { 681 wpa_printf(MSG_DEBUG, "%s: failed to open system cert store " 682 "'%s': error=%d", __func__, store, 683 (int) GetLastError()); 684 return -1; 685 } 686 687 while ((ctx = CertEnumCertificatesInStore(cs, ctx))) { 688 cert = d2i_X509(NULL, 689 (const unsigned char **) &ctx->pbCertEncoded, 690 ctx->cbCertEncoded); 691 if (cert == NULL) { 692 wpa_printf(MSG_INFO, "CryptoAPI: Could not process " 693 "X509 DER encoding for CA cert"); 694 continue; 695 } 696 697 X509_NAME_oneline(X509_get_subject_name(cert), buf, 698 sizeof(buf)); 699 wpa_printf(MSG_DEBUG, "OpenSSL: Loaded CA certificate for " 700 "system certificate store: subject='%s'", buf); 701 702 if (!X509_STORE_add_cert(SSL_CTX_get_cert_store(ssl_ctx), 703 cert)) { 704 tls_show_errors(MSG_WARNING, __func__, 705 "Failed to add ca_cert to OpenSSL " 706 "certificate store"); 707 } 708 709 X509_free(cert); 710 } 711 712 if (!CertCloseStore(cs, 0)) { 713 wpa_printf(MSG_DEBUG, "%s: failed to close system cert store " 714 "'%s': error=%d", __func__, name + 13, 715 (int) GetLastError()); 716 } 717 718 return 0; 719 } 720 721 722 #else /* CONFIG_NATIVE_WINDOWS */ 723 724 static int tls_cryptoapi_cert(SSL *ssl, const char *name) 725 { 726 return -1; 727 } 728 729 #endif /* CONFIG_NATIVE_WINDOWS */ 730 731 732 static void ssl_info_cb(const SSL *ssl, int where, int ret) 733 { 734 const char *str; 735 int w; 736 737 wpa_printf(MSG_DEBUG, "SSL: (where=0x%x ret=0x%x)", where, ret); 738 w = where & ~SSL_ST_MASK; 739 if (w & SSL_ST_CONNECT) 740 str = "SSL_connect"; 741 else if (w & SSL_ST_ACCEPT) 742 str = "SSL_accept"; 743 else 744 str = "undefined"; 745 746 if (where & SSL_CB_LOOP) { 747 wpa_printf(MSG_DEBUG, "SSL: %s:%s", 748 str, SSL_state_string_long(ssl)); 749 } else if (where & SSL_CB_ALERT) { 750 struct tls_connection *conn = SSL_get_app_data((SSL *) ssl); 751 wpa_printf(MSG_INFO, "SSL: SSL3 alert: %s:%s:%s", 752 where & SSL_CB_READ ? 753 "read (remote end reported an error)" : 754 "write (local SSL3 detected an error)", 755 SSL_alert_type_string_long(ret), 756 SSL_alert_desc_string_long(ret)); 757 if ((ret >> 8) == SSL3_AL_FATAL) { 758 if (where & SSL_CB_READ) 759 conn->read_alerts++; 760 else 761 conn->write_alerts++; 762 } 763 if (conn->context->event_cb != NULL) { 764 union tls_event_data ev; 765 struct tls_context *context = conn->context; 766 os_memset(&ev, 0, sizeof(ev)); 767 ev.alert.is_local = !(where & SSL_CB_READ); 768 ev.alert.type = SSL_alert_type_string_long(ret); 769 ev.alert.description = SSL_alert_desc_string_long(ret); 770 context->event_cb(context->cb_ctx, TLS_ALERT, &ev); 771 } 772 } else if (where & SSL_CB_EXIT && ret <= 0) { 773 wpa_printf(MSG_DEBUG, "SSL: %s:%s in %s", 774 str, ret == 0 ? "failed" : "error", 775 SSL_state_string_long(ssl)); 776 } 777 } 778 779 780 #ifndef OPENSSL_NO_ENGINE 781 /** 782 * tls_engine_load_dynamic_generic - load any openssl engine 783 * @pre: an array of commands and values that load an engine initialized 784 * in the engine specific function 785 * @post: an array of commands and values that initialize an already loaded 786 * engine (or %NULL if not required) 787 * @id: the engine id of the engine to load (only required if post is not %NULL 788 * 789 * This function is a generic function that loads any openssl engine. 790 * 791 * Returns: 0 on success, -1 on failure 792 */ 793 static int tls_engine_load_dynamic_generic(const char *pre[], 794 const char *post[], const char *id) 795 { 796 ENGINE *engine; 797 const char *dynamic_id = "dynamic"; 798 799 engine = ENGINE_by_id(id); 800 if (engine) { 801 wpa_printf(MSG_DEBUG, "ENGINE: engine '%s' is already " 802 "available", id); 803 /* 804 * If it was auto-loaded by ENGINE_by_id() we might still 805 * need to tell it which PKCS#11 module to use in legacy 806 * (non-p11-kit) environments. Do so now; even if it was 807 * properly initialised before, setting it again will be 808 * harmless. 809 */ 810 goto found; 811 } 812 ERR_clear_error(); 813 814 engine = ENGINE_by_id(dynamic_id); 815 if (engine == NULL) { 816 wpa_printf(MSG_INFO, "ENGINE: Can't find engine %s [%s]", 817 dynamic_id, 818 ERR_error_string(ERR_get_error(), NULL)); 819 return -1; 820 } 821 822 /* Perform the pre commands. This will load the engine. */ 823 while (pre && pre[0]) { 824 wpa_printf(MSG_DEBUG, "ENGINE: '%s' '%s'", pre[0], pre[1]); 825 if (ENGINE_ctrl_cmd_string(engine, pre[0], pre[1], 0) == 0) { 826 wpa_printf(MSG_INFO, "ENGINE: ctrl cmd_string failed: " 827 "%s %s [%s]", pre[0], pre[1], 828 ERR_error_string(ERR_get_error(), NULL)); 829 ENGINE_free(engine); 830 return -1; 831 } 832 pre += 2; 833 } 834 835 /* 836 * Free the reference to the "dynamic" engine. The loaded engine can 837 * now be looked up using ENGINE_by_id(). 838 */ 839 ENGINE_free(engine); 840 841 engine = ENGINE_by_id(id); 842 if (engine == NULL) { 843 wpa_printf(MSG_INFO, "ENGINE: Can't find engine %s [%s]", 844 id, ERR_error_string(ERR_get_error(), NULL)); 845 return -1; 846 } 847 found: 848 while (post && post[0]) { 849 wpa_printf(MSG_DEBUG, "ENGINE: '%s' '%s'", post[0], post[1]); 850 if (ENGINE_ctrl_cmd_string(engine, post[0], post[1], 0) == 0) { 851 wpa_printf(MSG_DEBUG, "ENGINE: ctrl cmd_string failed:" 852 " %s %s [%s]", post[0], post[1], 853 ERR_error_string(ERR_get_error(), NULL)); 854 ENGINE_remove(engine); 855 ENGINE_free(engine); 856 return -1; 857 } 858 post += 2; 859 } 860 ENGINE_free(engine); 861 862 return 0; 863 } 864 865 866 /** 867 * tls_engine_load_dynamic_pkcs11 - load the pkcs11 engine provided by opensc 868 * @pkcs11_so_path: pksc11_so_path from the configuration 869 * @pcks11_module_path: pkcs11_module_path from the configuration 870 */ 871 static int tls_engine_load_dynamic_pkcs11(const char *pkcs11_so_path, 872 const char *pkcs11_module_path) 873 { 874 char *engine_id = "pkcs11"; 875 const char *pre_cmd[] = { 876 "SO_PATH", NULL /* pkcs11_so_path */, 877 "ID", NULL /* engine_id */, 878 "LIST_ADD", "1", 879 /* "NO_VCHECK", "1", */ 880 "LOAD", NULL, 881 NULL, NULL 882 }; 883 const char *post_cmd[] = { 884 "MODULE_PATH", NULL /* pkcs11_module_path */, 885 NULL, NULL 886 }; 887 888 if (!pkcs11_so_path) 889 return 0; 890 891 pre_cmd[1] = pkcs11_so_path; 892 pre_cmd[3] = engine_id; 893 if (pkcs11_module_path) 894 post_cmd[1] = pkcs11_module_path; 895 else 896 post_cmd[0] = NULL; 897 898 wpa_printf(MSG_DEBUG, "ENGINE: Loading pkcs11 Engine from %s", 899 pkcs11_so_path); 900 901 return tls_engine_load_dynamic_generic(pre_cmd, post_cmd, engine_id); 902 } 903 904 905 /** 906 * tls_engine_load_dynamic_opensc - load the opensc engine provided by opensc 907 * @opensc_so_path: opensc_so_path from the configuration 908 */ 909 static int tls_engine_load_dynamic_opensc(const char *opensc_so_path) 910 { 911 char *engine_id = "opensc"; 912 const char *pre_cmd[] = { 913 "SO_PATH", NULL /* opensc_so_path */, 914 "ID", NULL /* engine_id */, 915 "LIST_ADD", "1", 916 "LOAD", NULL, 917 NULL, NULL 918 }; 919 920 if (!opensc_so_path) 921 return 0; 922 923 pre_cmd[1] = opensc_so_path; 924 pre_cmd[3] = engine_id; 925 926 wpa_printf(MSG_DEBUG, "ENGINE: Loading OpenSC Engine from %s", 927 opensc_so_path); 928 929 return tls_engine_load_dynamic_generic(pre_cmd, NULL, engine_id); 930 } 931 #endif /* OPENSSL_NO_ENGINE */ 932 933 934 static void remove_session_cb(SSL_CTX *ctx, SSL_SESSION *sess) 935 { 936 struct wpabuf *buf; 937 938 if (tls_ex_idx_session < 0) 939 return; 940 buf = SSL_SESSION_get_ex_data(sess, tls_ex_idx_session); 941 if (!buf) 942 return; 943 wpa_printf(MSG_DEBUG, 944 "OpenSSL: Free application session data %p (sess %p)", 945 buf, sess); 946 wpabuf_free(buf); 947 948 SSL_SESSION_set_ex_data(sess, tls_ex_idx_session, NULL); 949 } 950 951 952 void * tls_init(const struct tls_config *conf) 953 { 954 struct tls_data *data; 955 SSL_CTX *ssl; 956 struct tls_context *context; 957 const char *ciphers; 958 959 if (tls_openssl_ref_count == 0) { 960 tls_global = context = tls_context_new(conf); 961 if (context == NULL) 962 return NULL; 963 #ifdef CONFIG_FIPS 964 #ifdef OPENSSL_FIPS 965 if (conf && conf->fips_mode) { 966 static int fips_enabled = 0; 967 968 if (!fips_enabled && !FIPS_mode_set(1)) { 969 wpa_printf(MSG_ERROR, "Failed to enable FIPS " 970 "mode"); 971 ERR_load_crypto_strings(); 972 ERR_print_errors_fp(stderr); 973 os_free(tls_global); 974 tls_global = NULL; 975 return NULL; 976 } else { 977 wpa_printf(MSG_INFO, "Running in FIPS mode"); 978 fips_enabled = 1; 979 } 980 } 981 #else /* OPENSSL_FIPS */ 982 if (conf && conf->fips_mode) { 983 wpa_printf(MSG_ERROR, "FIPS mode requested, but not " 984 "supported"); 985 os_free(tls_global); 986 tls_global = NULL; 987 return NULL; 988 } 989 #endif /* OPENSSL_FIPS */ 990 #endif /* CONFIG_FIPS */ 991 #if OPENSSL_VERSION_NUMBER < 0x10100000L || \ 992 (defined(LIBRESSL_VERSION_NUMBER) && \ 993 LIBRESSL_VERSION_NUMBER < 0x20700000L) 994 SSL_load_error_strings(); 995 SSL_library_init(); 996 #ifndef OPENSSL_NO_SHA256 997 EVP_add_digest(EVP_sha256()); 998 #endif /* OPENSSL_NO_SHA256 */ 999 /* TODO: if /dev/urandom is available, PRNG is seeded 1000 * automatically. If this is not the case, random data should 1001 * be added here. */ 1002 1003 #ifdef PKCS12_FUNCS 1004 #ifndef OPENSSL_NO_RC2 1005 /* 1006 * 40-bit RC2 is commonly used in PKCS#12 files, so enable it. 1007 * This is enabled by PKCS12_PBE_add() in OpenSSL 0.9.8 1008 * versions, but it looks like OpenSSL 1.0.0 does not do that 1009 * anymore. 1010 */ 1011 EVP_add_cipher(EVP_rc2_40_cbc()); 1012 #endif /* OPENSSL_NO_RC2 */ 1013 PKCS12_PBE_add(); 1014 #endif /* PKCS12_FUNCS */ 1015 #endif /* < 1.1.0 */ 1016 } else { 1017 context = tls_context_new(conf); 1018 if (context == NULL) 1019 return NULL; 1020 } 1021 tls_openssl_ref_count++; 1022 1023 data = os_zalloc(sizeof(*data)); 1024 if (data) 1025 ssl = SSL_CTX_new(SSLv23_method()); 1026 else 1027 ssl = NULL; 1028 if (ssl == NULL) { 1029 tls_openssl_ref_count--; 1030 if (context != tls_global) 1031 os_free(context); 1032 if (tls_openssl_ref_count == 0) { 1033 os_free(tls_global); 1034 tls_global = NULL; 1035 } 1036 os_free(data); 1037 return NULL; 1038 } 1039 data->ssl = ssl; 1040 if (conf) { 1041 data->tls_session_lifetime = conf->tls_session_lifetime; 1042 data->crl_reload_interval = conf->crl_reload_interval; 1043 } 1044 1045 SSL_CTX_set_options(ssl, SSL_OP_NO_SSLv2); 1046 SSL_CTX_set_options(ssl, SSL_OP_NO_SSLv3); 1047 1048 SSL_CTX_set_mode(ssl, SSL_MODE_AUTO_RETRY); 1049 1050 #ifdef SSL_MODE_NO_AUTO_CHAIN 1051 /* Number of deployed use cases assume the default OpenSSL behavior of 1052 * auto chaining the local certificate is in use. BoringSSL removed this 1053 * functionality by default, so we need to restore it here to avoid 1054 * breaking existing use cases. */ 1055 SSL_CTX_clear_mode(ssl, SSL_MODE_NO_AUTO_CHAIN); 1056 #endif /* SSL_MODE_NO_AUTO_CHAIN */ 1057 1058 SSL_CTX_set_info_callback(ssl, ssl_info_cb); 1059 SSL_CTX_set_app_data(ssl, context); 1060 if (data->tls_session_lifetime > 0) { 1061 SSL_CTX_set_quiet_shutdown(ssl, 1); 1062 /* 1063 * Set default context here. In practice, this will be replaced 1064 * by the per-EAP method context in tls_connection_set_verify(). 1065 */ 1066 SSL_CTX_set_session_id_context(ssl, (u8 *) "hostapd", 7); 1067 SSL_CTX_set_session_cache_mode(ssl, SSL_SESS_CACHE_SERVER); 1068 SSL_CTX_set_timeout(ssl, data->tls_session_lifetime); 1069 SSL_CTX_sess_set_remove_cb(ssl, remove_session_cb); 1070 } else { 1071 SSL_CTX_set_session_cache_mode(ssl, SSL_SESS_CACHE_OFF); 1072 } 1073 1074 if (tls_ex_idx_session < 0) { 1075 tls_ex_idx_session = SSL_SESSION_get_ex_new_index( 1076 0, NULL, NULL, NULL, NULL); 1077 if (tls_ex_idx_session < 0) { 1078 tls_deinit(data); 1079 return NULL; 1080 } 1081 } 1082 1083 #ifndef OPENSSL_NO_ENGINE 1084 wpa_printf(MSG_DEBUG, "ENGINE: Loading builtin engines"); 1085 ENGINE_load_builtin_engines(); 1086 1087 if (conf && 1088 (conf->opensc_engine_path || conf->pkcs11_engine_path || 1089 conf->pkcs11_module_path)) { 1090 if (tls_engine_load_dynamic_opensc(conf->opensc_engine_path) || 1091 tls_engine_load_dynamic_pkcs11(conf->pkcs11_engine_path, 1092 conf->pkcs11_module_path)) { 1093 tls_deinit(data); 1094 return NULL; 1095 } 1096 } 1097 #endif /* OPENSSL_NO_ENGINE */ 1098 1099 if (conf && conf->openssl_ciphers) 1100 ciphers = conf->openssl_ciphers; 1101 else 1102 ciphers = TLS_DEFAULT_CIPHERS; 1103 if (SSL_CTX_set_cipher_list(ssl, ciphers) != 1) { 1104 wpa_printf(MSG_ERROR, 1105 "OpenSSL: Failed to set cipher string '%s'", 1106 ciphers); 1107 tls_deinit(data); 1108 return NULL; 1109 } 1110 1111 return data; 1112 } 1113 1114 1115 void tls_deinit(void *ssl_ctx) 1116 { 1117 struct tls_data *data = ssl_ctx; 1118 SSL_CTX *ssl = data->ssl; 1119 struct tls_context *context = SSL_CTX_get_app_data(ssl); 1120 if (context != tls_global) 1121 os_free(context); 1122 if (data->tls_session_lifetime > 0) 1123 SSL_CTX_flush_sessions(ssl, 0); 1124 os_free(data->ca_cert); 1125 SSL_CTX_free(ssl); 1126 1127 tls_openssl_ref_count--; 1128 if (tls_openssl_ref_count == 0) { 1129 #if OPENSSL_VERSION_NUMBER < 0x10100000L || \ 1130 (defined(LIBRESSL_VERSION_NUMBER) && \ 1131 LIBRESSL_VERSION_NUMBER < 0x20700000L) 1132 #ifndef OPENSSL_NO_ENGINE 1133 ENGINE_cleanup(); 1134 #endif /* OPENSSL_NO_ENGINE */ 1135 CRYPTO_cleanup_all_ex_data(); 1136 ERR_remove_thread_state(NULL); 1137 ERR_free_strings(); 1138 EVP_cleanup(); 1139 #endif /* < 1.1.0 */ 1140 os_free(tls_global->ocsp_stapling_response); 1141 tls_global->ocsp_stapling_response = NULL; 1142 os_free(tls_global); 1143 tls_global = NULL; 1144 } 1145 1146 os_free(data->check_cert_subject); 1147 os_free(data); 1148 } 1149 1150 1151 #ifndef OPENSSL_NO_ENGINE 1152 1153 /* Cryptoki return values */ 1154 #define CKR_PIN_INCORRECT 0x000000a0 1155 #define CKR_PIN_INVALID 0x000000a1 1156 #define CKR_PIN_LEN_RANGE 0x000000a2 1157 1158 /* libp11 */ 1159 #define ERR_LIB_PKCS11 ERR_LIB_USER 1160 1161 static int tls_is_pin_error(unsigned int err) 1162 { 1163 return ERR_GET_LIB(err) == ERR_LIB_PKCS11 && 1164 (ERR_GET_REASON(err) == CKR_PIN_INCORRECT || 1165 ERR_GET_REASON(err) == CKR_PIN_INVALID || 1166 ERR_GET_REASON(err) == CKR_PIN_LEN_RANGE); 1167 } 1168 1169 #endif /* OPENSSL_NO_ENGINE */ 1170 1171 1172 #ifdef ANDROID 1173 /* EVP_PKEY_from_keystore comes from system/security/keystore-engine. */ 1174 EVP_PKEY * EVP_PKEY_from_keystore(const char *key_id); 1175 #endif /* ANDROID */ 1176 1177 static int tls_engine_init(struct tls_connection *conn, const char *engine_id, 1178 const char *pin, const char *key_id, 1179 const char *cert_id, const char *ca_cert_id) 1180 { 1181 #if defined(ANDROID) && defined(OPENSSL_IS_BORINGSSL) 1182 #if !defined(OPENSSL_NO_ENGINE) 1183 #error "This code depends on OPENSSL_NO_ENGINE being defined by BoringSSL." 1184 #endif 1185 if (!key_id) 1186 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED; 1187 conn->engine = NULL; 1188 conn->private_key = EVP_PKEY_from_keystore(key_id); 1189 if (!conn->private_key) { 1190 wpa_printf(MSG_ERROR, 1191 "ENGINE: cannot load private key with id '%s' [%s]", 1192 key_id, 1193 ERR_error_string(ERR_get_error(), NULL)); 1194 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED; 1195 } 1196 #endif /* ANDROID && OPENSSL_IS_BORINGSSL */ 1197 1198 #ifndef OPENSSL_NO_ENGINE 1199 int ret = -1; 1200 if (engine_id == NULL) { 1201 wpa_printf(MSG_ERROR, "ENGINE: Engine ID not set"); 1202 return -1; 1203 } 1204 1205 ERR_clear_error(); 1206 #ifdef ANDROID 1207 ENGINE_load_dynamic(); 1208 #endif 1209 conn->engine = ENGINE_by_id(engine_id); 1210 if (!conn->engine) { 1211 wpa_printf(MSG_ERROR, "ENGINE: engine %s not available [%s]", 1212 engine_id, ERR_error_string(ERR_get_error(), NULL)); 1213 goto err; 1214 } 1215 if (ENGINE_init(conn->engine) != 1) { 1216 wpa_printf(MSG_ERROR, "ENGINE: engine init failed " 1217 "(engine: %s) [%s]", engine_id, 1218 ERR_error_string(ERR_get_error(), NULL)); 1219 goto err; 1220 } 1221 wpa_printf(MSG_DEBUG, "ENGINE: engine initialized"); 1222 1223 #ifndef ANDROID 1224 if (pin && ENGINE_ctrl_cmd_string(conn->engine, "PIN", pin, 0) == 0) { 1225 wpa_printf(MSG_ERROR, "ENGINE: cannot set pin [%s]", 1226 ERR_error_string(ERR_get_error(), NULL)); 1227 goto err; 1228 } 1229 #endif 1230 if (key_id) { 1231 /* 1232 * Ensure that the ENGINE does not attempt to use the OpenSSL 1233 * UI system to obtain a PIN, if we didn't provide one. 1234 */ 1235 struct { 1236 const void *password; 1237 const char *prompt_info; 1238 } key_cb = { "", NULL }; 1239 1240 /* load private key first in-case PIN is required for cert */ 1241 conn->private_key = ENGINE_load_private_key(conn->engine, 1242 key_id, NULL, 1243 &key_cb); 1244 if (!conn->private_key) { 1245 unsigned long err = ERR_get_error(); 1246 1247 wpa_printf(MSG_ERROR, 1248 "ENGINE: cannot load private key with id '%s' [%s]", 1249 key_id, 1250 ERR_error_string(err, NULL)); 1251 if (tls_is_pin_error(err)) 1252 ret = TLS_SET_PARAMS_ENGINE_PRV_BAD_PIN; 1253 else 1254 ret = TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED; 1255 goto err; 1256 } 1257 } 1258 1259 /* handle a certificate and/or CA certificate */ 1260 if (cert_id || ca_cert_id) { 1261 const char *cmd_name = "LOAD_CERT_CTRL"; 1262 1263 /* test if the engine supports a LOAD_CERT_CTRL */ 1264 if (!ENGINE_ctrl(conn->engine, ENGINE_CTRL_GET_CMD_FROM_NAME, 1265 0, (void *)cmd_name, NULL)) { 1266 wpa_printf(MSG_ERROR, "ENGINE: engine does not support" 1267 " loading certificates"); 1268 ret = TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED; 1269 goto err; 1270 } 1271 } 1272 1273 return 0; 1274 1275 err: 1276 if (conn->engine) { 1277 ENGINE_free(conn->engine); 1278 conn->engine = NULL; 1279 } 1280 1281 if (conn->private_key) { 1282 EVP_PKEY_free(conn->private_key); 1283 conn->private_key = NULL; 1284 } 1285 1286 return ret; 1287 #else /* OPENSSL_NO_ENGINE */ 1288 return 0; 1289 #endif /* OPENSSL_NO_ENGINE */ 1290 } 1291 1292 1293 static void tls_engine_deinit(struct tls_connection *conn) 1294 { 1295 #if defined(ANDROID) || !defined(OPENSSL_NO_ENGINE) 1296 wpa_printf(MSG_DEBUG, "ENGINE: engine deinit"); 1297 if (conn->private_key) { 1298 EVP_PKEY_free(conn->private_key); 1299 conn->private_key = NULL; 1300 } 1301 if (conn->engine) { 1302 #if !defined(OPENSSL_IS_BORINGSSL) 1303 ENGINE_finish(conn->engine); 1304 #endif /* !OPENSSL_IS_BORINGSSL */ 1305 conn->engine = NULL; 1306 } 1307 #endif /* ANDROID || !OPENSSL_NO_ENGINE */ 1308 } 1309 1310 1311 int tls_get_errors(void *ssl_ctx) 1312 { 1313 int count = 0; 1314 unsigned long err; 1315 1316 while ((err = ERR_get_error())) { 1317 wpa_printf(MSG_INFO, "TLS - SSL error: %s", 1318 ERR_error_string(err, NULL)); 1319 count++; 1320 } 1321 1322 return count; 1323 } 1324 1325 1326 static const char * openssl_content_type(int content_type) 1327 { 1328 switch (content_type) { 1329 case 20: 1330 return "change cipher spec"; 1331 case 21: 1332 return "alert"; 1333 case 22: 1334 return "handshake"; 1335 case 23: 1336 return "application data"; 1337 case 24: 1338 return "heartbeat"; 1339 case 256: 1340 return "TLS header info"; /* pseudo content type */ 1341 case 257: 1342 return "inner content type"; /* pseudo content type */ 1343 default: 1344 return "?"; 1345 } 1346 } 1347 1348 1349 static const char * openssl_handshake_type(int content_type, const u8 *buf, 1350 size_t len) 1351 { 1352 if (content_type == 257 && buf && len == 1) 1353 return openssl_content_type(buf[0]); 1354 if (content_type != 22 || !buf || len == 0) 1355 return ""; 1356 switch (buf[0]) { 1357 case 0: 1358 return "hello request"; 1359 case 1: 1360 return "client hello"; 1361 case 2: 1362 return "server hello"; 1363 case 3: 1364 return "hello verify request"; 1365 case 4: 1366 return "new session ticket"; 1367 case 5: 1368 return "end of early data"; 1369 case 6: 1370 return "hello retry request"; 1371 case 8: 1372 return "encrypted extensions"; 1373 case 11: 1374 return "certificate"; 1375 case 12: 1376 return "server key exchange"; 1377 case 13: 1378 return "certificate request"; 1379 case 14: 1380 return "server hello done"; 1381 case 15: 1382 return "certificate verify"; 1383 case 16: 1384 return "client key exchange"; 1385 case 20: 1386 return "finished"; 1387 case 21: 1388 return "certificate url"; 1389 case 22: 1390 return "certificate status"; 1391 case 23: 1392 return "supplemental data"; 1393 case 24: 1394 return "key update"; 1395 case 254: 1396 return "message hash"; 1397 default: 1398 return "?"; 1399 } 1400 } 1401 1402 1403 #ifdef CONFIG_SUITEB 1404 1405 static void check_server_hello(struct tls_connection *conn, 1406 const u8 *pos, const u8 *end) 1407 { 1408 size_t payload_len, id_len; 1409 1410 /* 1411 * Parse ServerHello to get the selected cipher suite since OpenSSL does 1412 * not make it cleanly available during handshake and we need to know 1413 * whether DHE was selected. 1414 */ 1415 1416 if (end - pos < 3) 1417 return; 1418 payload_len = WPA_GET_BE24(pos); 1419 pos += 3; 1420 1421 if ((size_t) (end - pos) < payload_len) 1422 return; 1423 end = pos + payload_len; 1424 1425 /* Skip Version and Random */ 1426 if (end - pos < 2 + SSL3_RANDOM_SIZE) 1427 return; 1428 pos += 2 + SSL3_RANDOM_SIZE; 1429 1430 /* Skip Session ID */ 1431 if (end - pos < 1) 1432 return; 1433 id_len = *pos++; 1434 if ((size_t) (end - pos) < id_len) 1435 return; 1436 pos += id_len; 1437 1438 if (end - pos < 2) 1439 return; 1440 conn->cipher_suite = WPA_GET_BE16(pos); 1441 wpa_printf(MSG_DEBUG, "OpenSSL: Server selected cipher suite 0x%x", 1442 conn->cipher_suite); 1443 } 1444 1445 1446 static void check_server_key_exchange(SSL *ssl, struct tls_connection *conn, 1447 const u8 *pos, const u8 *end) 1448 { 1449 size_t payload_len; 1450 u16 dh_len; 1451 BIGNUM *p; 1452 int bits; 1453 1454 if (!(conn->flags & TLS_CONN_SUITEB)) 1455 return; 1456 1457 /* DHE is enabled only with DHE-RSA-AES256-GCM-SHA384 */ 1458 if (conn->cipher_suite != 0x9f) 1459 return; 1460 1461 if (end - pos < 3) 1462 return; 1463 payload_len = WPA_GET_BE24(pos); 1464 pos += 3; 1465 1466 if ((size_t) (end - pos) < payload_len) 1467 return; 1468 end = pos + payload_len; 1469 1470 if (end - pos < 2) 1471 return; 1472 dh_len = WPA_GET_BE16(pos); 1473 pos += 2; 1474 1475 if ((size_t) (end - pos) < dh_len) 1476 return; 1477 p = BN_bin2bn(pos, dh_len, NULL); 1478 if (!p) 1479 return; 1480 1481 bits = BN_num_bits(p); 1482 BN_free(p); 1483 1484 conn->server_dh_prime_len = bits; 1485 wpa_printf(MSG_DEBUG, "OpenSSL: Server DH prime length: %d bits", 1486 conn->server_dh_prime_len); 1487 } 1488 1489 #endif /* CONFIG_SUITEB */ 1490 1491 1492 static void tls_msg_cb(int write_p, int version, int content_type, 1493 const void *buf, size_t len, SSL *ssl, void *arg) 1494 { 1495 struct tls_connection *conn = arg; 1496 const u8 *pos = buf; 1497 1498 if (write_p == 2) { 1499 wpa_printf(MSG_DEBUG, 1500 "OpenSSL: session ver=0x%x content_type=%d", 1501 version, content_type); 1502 wpa_hexdump_key(MSG_MSGDUMP, "OpenSSL: Data", buf, len); 1503 return; 1504 } 1505 1506 wpa_printf(MSG_DEBUG, "OpenSSL: %s ver=0x%x content_type=%d (%s/%s)", 1507 write_p ? "TX" : "RX", version, content_type, 1508 openssl_content_type(content_type), 1509 openssl_handshake_type(content_type, buf, len)); 1510 wpa_hexdump_key(MSG_MSGDUMP, "OpenSSL: Message", buf, len); 1511 if (content_type == 24 && len >= 3 && pos[0] == 1) { 1512 size_t payload_len = WPA_GET_BE16(pos + 1); 1513 if (payload_len + 3 > len) { 1514 wpa_printf(MSG_ERROR, "OpenSSL: Heartbeat attack detected"); 1515 conn->invalid_hb_used = 1; 1516 } 1517 } 1518 1519 #ifdef CONFIG_SUITEB 1520 /* 1521 * Need to parse these handshake messages to be able to check DH prime 1522 * length since OpenSSL does not expose the new cipher suite and DH 1523 * parameters during handshake (e.g., for cert_cb() callback). 1524 */ 1525 if (content_type == 22 && pos && len > 0 && pos[0] == 2) 1526 check_server_hello(conn, pos + 1, pos + len); 1527 if (content_type == 22 && pos && len > 0 && pos[0] == 12) 1528 check_server_key_exchange(ssl, conn, pos + 1, pos + len); 1529 #endif /* CONFIG_SUITEB */ 1530 } 1531 1532 1533 struct tls_connection * tls_connection_init(void *ssl_ctx) 1534 { 1535 struct tls_data *data = ssl_ctx; 1536 SSL_CTX *ssl = data->ssl; 1537 struct tls_connection *conn; 1538 long options; 1539 X509_STORE *new_cert_store; 1540 struct os_reltime now; 1541 struct tls_context *context = SSL_CTX_get_app_data(ssl); 1542 1543 /* Replace X509 store if it is time to update CRL. */ 1544 if (data->crl_reload_interval > 0 && os_get_reltime(&now) == 0 && 1545 os_reltime_expired(&now, &data->crl_last_reload, 1546 data->crl_reload_interval)) { 1547 wpa_printf(MSG_INFO, 1548 "OpenSSL: Flushing X509 store with ca_cert file"); 1549 new_cert_store = tls_crl_cert_reload(data->ca_cert, 1550 data->check_crl); 1551 if (!new_cert_store) { 1552 wpa_printf(MSG_ERROR, 1553 "OpenSSL: Error replacing X509 store with ca_cert file"); 1554 } else { 1555 /* Replace old store */ 1556 SSL_CTX_set_cert_store(ssl, new_cert_store); 1557 data->crl_last_reload = now; 1558 } 1559 } 1560 1561 conn = os_zalloc(sizeof(*conn)); 1562 if (conn == NULL) 1563 return NULL; 1564 conn->data = data; 1565 conn->ssl_ctx = ssl; 1566 conn->ssl = SSL_new(ssl); 1567 if (conn->ssl == NULL) { 1568 tls_show_errors(MSG_INFO, __func__, 1569 "Failed to initialize new SSL connection"); 1570 os_free(conn); 1571 return NULL; 1572 } 1573 1574 conn->context = context; 1575 SSL_set_app_data(conn->ssl, conn); 1576 SSL_set_msg_callback(conn->ssl, tls_msg_cb); 1577 SSL_set_msg_callback_arg(conn->ssl, conn); 1578 options = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | 1579 SSL_OP_SINGLE_DH_USE; 1580 #ifdef SSL_OP_NO_COMPRESSION 1581 options |= SSL_OP_NO_COMPRESSION; 1582 #endif /* SSL_OP_NO_COMPRESSION */ 1583 SSL_set_options(conn->ssl, options); 1584 #ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT 1585 /* Hopefully there is no need for middlebox compatibility mechanisms 1586 * when going through EAP authentication. */ 1587 SSL_clear_options(conn->ssl, SSL_OP_ENABLE_MIDDLEBOX_COMPAT); 1588 #endif 1589 1590 conn->ssl_in = BIO_new(BIO_s_mem()); 1591 if (!conn->ssl_in) { 1592 tls_show_errors(MSG_INFO, __func__, 1593 "Failed to create a new BIO for ssl_in"); 1594 SSL_free(conn->ssl); 1595 os_free(conn); 1596 return NULL; 1597 } 1598 1599 conn->ssl_out = BIO_new(BIO_s_mem()); 1600 if (!conn->ssl_out) { 1601 tls_show_errors(MSG_INFO, __func__, 1602 "Failed to create a new BIO for ssl_out"); 1603 SSL_free(conn->ssl); 1604 BIO_free(conn->ssl_in); 1605 os_free(conn); 1606 return NULL; 1607 } 1608 1609 SSL_set_bio(conn->ssl, conn->ssl_in, conn->ssl_out); 1610 1611 return conn; 1612 } 1613 1614 1615 void tls_connection_deinit(void *ssl_ctx, struct tls_connection *conn) 1616 { 1617 if (conn == NULL) 1618 return; 1619 if (conn->success_data) { 1620 /* 1621 * Make sure ssl_clear_bad_session() does not remove this 1622 * session. 1623 */ 1624 SSL_set_quiet_shutdown(conn->ssl, 1); 1625 SSL_shutdown(conn->ssl); 1626 } 1627 SSL_free(conn->ssl); 1628 tls_engine_deinit(conn); 1629 os_free(conn->subject_match); 1630 os_free(conn->altsubject_match); 1631 os_free(conn->suffix_match); 1632 os_free(conn->domain_match); 1633 os_free(conn->check_cert_subject); 1634 os_free(conn->session_ticket); 1635 os_free(conn->peer_subject); 1636 os_free(conn); 1637 } 1638 1639 1640 int tls_connection_established(void *ssl_ctx, struct tls_connection *conn) 1641 { 1642 return conn ? SSL_is_init_finished(conn->ssl) : 0; 1643 } 1644 1645 1646 char * tls_connection_peer_serial_num(void *tls_ctx, 1647 struct tls_connection *conn) 1648 { 1649 ASN1_INTEGER *ser; 1650 char *serial_num; 1651 size_t len; 1652 1653 if (!conn->peer_cert) 1654 return NULL; 1655 1656 ser = X509_get_serialNumber(conn->peer_cert); 1657 if (!ser) 1658 return NULL; 1659 1660 len = ASN1_STRING_length(ser) * 2 + 1; 1661 serial_num = os_malloc(len); 1662 if (!serial_num) 1663 return NULL; 1664 wpa_snprintf_hex_uppercase(serial_num, len, 1665 ASN1_STRING_get0_data(ser), 1666 ASN1_STRING_length(ser)); 1667 return serial_num; 1668 } 1669 1670 1671 int tls_connection_shutdown(void *ssl_ctx, struct tls_connection *conn) 1672 { 1673 if (conn == NULL) 1674 return -1; 1675 1676 /* Shutdown previous TLS connection without notifying the peer 1677 * because the connection was already terminated in practice 1678 * and "close notify" shutdown alert would confuse AS. */ 1679 SSL_set_quiet_shutdown(conn->ssl, 1); 1680 SSL_shutdown(conn->ssl); 1681 return SSL_clear(conn->ssl) == 1 ? 0 : -1; 1682 } 1683 1684 1685 static int tls_match_altsubject_component(X509 *cert, int type, 1686 const char *value, size_t len) 1687 { 1688 GENERAL_NAME *gen; 1689 void *ext; 1690 int found = 0; 1691 stack_index_t i; 1692 1693 ext = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL); 1694 1695 for (i = 0; ext && i < sk_GENERAL_NAME_num(ext); i++) { 1696 gen = sk_GENERAL_NAME_value(ext, i); 1697 if (gen->type != type) 1698 continue; 1699 if (os_strlen((char *) gen->d.ia5->data) == len && 1700 os_memcmp(value, gen->d.ia5->data, len) == 0) 1701 found++; 1702 } 1703 1704 sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free); 1705 1706 return found; 1707 } 1708 1709 1710 static int tls_match_altsubject(X509 *cert, const char *match) 1711 { 1712 int type; 1713 const char *pos, *end; 1714 size_t len; 1715 1716 pos = match; 1717 do { 1718 if (os_strncmp(pos, "EMAIL:", 6) == 0) { 1719 type = GEN_EMAIL; 1720 pos += 6; 1721 } else if (os_strncmp(pos, "DNS:", 4) == 0) { 1722 type = GEN_DNS; 1723 pos += 4; 1724 } else if (os_strncmp(pos, "URI:", 4) == 0) { 1725 type = GEN_URI; 1726 pos += 4; 1727 } else { 1728 wpa_printf(MSG_INFO, "TLS: Invalid altSubjectName " 1729 "match '%s'", pos); 1730 return 0; 1731 } 1732 end = os_strchr(pos, ';'); 1733 while (end) { 1734 if (os_strncmp(end + 1, "EMAIL:", 6) == 0 || 1735 os_strncmp(end + 1, "DNS:", 4) == 0 || 1736 os_strncmp(end + 1, "URI:", 4) == 0) 1737 break; 1738 end = os_strchr(end + 1, ';'); 1739 } 1740 if (end) 1741 len = end - pos; 1742 else 1743 len = os_strlen(pos); 1744 if (tls_match_altsubject_component(cert, type, pos, len) > 0) 1745 return 1; 1746 pos = end + 1; 1747 } while (end); 1748 1749 return 0; 1750 } 1751 1752 1753 #ifndef CONFIG_NATIVE_WINDOWS 1754 static int domain_suffix_match(const u8 *val, size_t len, const char *match, 1755 size_t match_len, int full) 1756 { 1757 size_t i; 1758 1759 /* Check for embedded nuls that could mess up suffix matching */ 1760 for (i = 0; i < len; i++) { 1761 if (val[i] == '\0') { 1762 wpa_printf(MSG_DEBUG, "TLS: Embedded null in a string - reject"); 1763 return 0; 1764 } 1765 } 1766 1767 if (match_len > len || (full && match_len != len)) 1768 return 0; 1769 1770 if (os_strncasecmp((const char *) val + len - match_len, match, 1771 match_len) != 0) 1772 return 0; /* no match */ 1773 1774 if (match_len == len) 1775 return 1; /* exact match */ 1776 1777 if (val[len - match_len - 1] == '.') 1778 return 1; /* full label match completes suffix match */ 1779 1780 wpa_printf(MSG_DEBUG, "TLS: Reject due to incomplete label match"); 1781 return 0; 1782 } 1783 #endif /* CONFIG_NATIVE_WINDOWS */ 1784 1785 1786 struct tls_dn_field_order_cnt { 1787 u8 cn; 1788 u8 c; 1789 u8 l; 1790 u8 st; 1791 u8 o; 1792 u8 ou; 1793 u8 email; 1794 }; 1795 1796 1797 static int get_dn_field_index(const struct tls_dn_field_order_cnt *dn_cnt, 1798 int nid) 1799 { 1800 switch (nid) { 1801 case NID_commonName: 1802 return dn_cnt->cn; 1803 case NID_countryName: 1804 return dn_cnt->c; 1805 case NID_localityName: 1806 return dn_cnt->l; 1807 case NID_stateOrProvinceName: 1808 return dn_cnt->st; 1809 case NID_organizationName: 1810 return dn_cnt->o; 1811 case NID_organizationalUnitName: 1812 return dn_cnt->ou; 1813 case NID_pkcs9_emailAddress: 1814 return dn_cnt->email; 1815 default: 1816 wpa_printf(MSG_ERROR, 1817 "TLS: Unknown NID '%d' in check_cert_subject", 1818 nid); 1819 return -1; 1820 } 1821 } 1822 1823 1824 /** 1825 * match_dn_field - Match configuration DN field against Certificate DN field 1826 * @cert: Certificate 1827 * @nid: NID of DN field 1828 * @field: Field name 1829 * @value DN field value which is passed from configuration 1830 * e.g., if configuration have C=US and this argument will point to US. 1831 * @dn_cnt: DN matching context 1832 * Returns: 1 on success and 0 on failure 1833 */ 1834 static int match_dn_field(const X509 *cert, int nid, const char *field, 1835 const char *value, 1836 const struct tls_dn_field_order_cnt *dn_cnt) 1837 { 1838 int i, ret = 0, len, config_dn_field_index, match_index = 0; 1839 X509_NAME *name; 1840 1841 len = os_strlen(value); 1842 name = X509_get_subject_name((X509 *) cert); 1843 1844 /* Assign incremented cnt for every field of DN to check DN field in 1845 * right order */ 1846 config_dn_field_index = get_dn_field_index(dn_cnt, nid); 1847 if (config_dn_field_index < 0) 1848 return 0; 1849 1850 /* Fetch value based on NID */ 1851 for (i = -1; (i = X509_NAME_get_index_by_NID(name, nid, i)) > -1;) { 1852 X509_NAME_ENTRY *e; 1853 ASN1_STRING *cn; 1854 1855 e = X509_NAME_get_entry(name, i); 1856 if (!e) 1857 continue; 1858 1859 cn = X509_NAME_ENTRY_get_data(e); 1860 if (!cn) 1861 continue; 1862 1863 match_index++; 1864 1865 /* check for more than one DN field with same name */ 1866 if (match_index != config_dn_field_index) 1867 continue; 1868 1869 /* Check wildcard at the right end side */ 1870 /* E.g., if OU=develop* mentioned in configuration, allow 'OU' 1871 * of the subject in the client certificate to start with 1872 * 'develop' */ 1873 if (len > 0 && value[len - 1] == '*') { 1874 /* Compare actual certificate DN field value with 1875 * configuration DN field value up to the specified 1876 * length. */ 1877 ret = ASN1_STRING_length(cn) >= len - 1 && 1878 os_memcmp(ASN1_STRING_get0_data(cn), value, 1879 len - 1) == 0; 1880 } else { 1881 /* Compare actual certificate DN field value with 1882 * configuration DN field value */ 1883 ret = ASN1_STRING_length(cn) == len && 1884 os_memcmp(ASN1_STRING_get0_data(cn), value, 1885 len) == 0; 1886 } 1887 if (!ret) { 1888 wpa_printf(MSG_ERROR, 1889 "OpenSSL: Failed to match %s '%s' with certificate DN field value '%s'", 1890 field, value, ASN1_STRING_get0_data(cn)); 1891 } 1892 break; 1893 } 1894 1895 return ret; 1896 } 1897 1898 1899 /** 1900 * get_value_from_field - Get value from DN field 1901 * @cert: Certificate 1902 * @field_str: DN field string which is passed from configuration file (e.g., 1903 * C=US) 1904 * @dn_cnt: DN matching context 1905 * Returns: 1 on success and 0 on failure 1906 */ 1907 static int get_value_from_field(const X509 *cert, char *field_str, 1908 struct tls_dn_field_order_cnt *dn_cnt) 1909 { 1910 int nid; 1911 char *context = NULL, *name, *value; 1912 1913 if (os_strcmp(field_str, "*") == 0) 1914 return 1; /* wildcard matches everything */ 1915 1916 name = str_token(field_str, "=", &context); 1917 if (!name) 1918 return 0; 1919 1920 /* Compare all configured DN fields and assign nid based on that to 1921 * fetch correct value from certificate subject */ 1922 if (os_strcmp(name, "CN") == 0) { 1923 nid = NID_commonName; 1924 dn_cnt->cn++; 1925 } else if(os_strcmp(name, "C") == 0) { 1926 nid = NID_countryName; 1927 dn_cnt->c++; 1928 } else if (os_strcmp(name, "L") == 0) { 1929 nid = NID_localityName; 1930 dn_cnt->l++; 1931 } else if (os_strcmp(name, "ST") == 0) { 1932 nid = NID_stateOrProvinceName; 1933 dn_cnt->st++; 1934 } else if (os_strcmp(name, "O") == 0) { 1935 nid = NID_organizationName; 1936 dn_cnt->o++; 1937 } else if (os_strcmp(name, "OU") == 0) { 1938 nid = NID_organizationalUnitName; 1939 dn_cnt->ou++; 1940 } else if (os_strcmp(name, "emailAddress") == 0) { 1941 nid = NID_pkcs9_emailAddress; 1942 dn_cnt->email++; 1943 } else { 1944 wpa_printf(MSG_ERROR, 1945 "TLS: Unknown field '%s' in check_cert_subject", name); 1946 return 0; 1947 } 1948 1949 value = str_token(field_str, "=", &context); 1950 if (!value) { 1951 wpa_printf(MSG_ERROR, 1952 "TLS: Distinguished Name field '%s' value is not defined in check_cert_subject", 1953 name); 1954 return 0; 1955 } 1956 1957 return match_dn_field(cert, nid, name, value, dn_cnt); 1958 } 1959 1960 1961 /** 1962 * tls_match_dn_field - Match subject DN field with check_cert_subject 1963 * @cert: Certificate 1964 * @match: check_cert_subject string 1965 * Returns: Return 1 on success and 0 on failure 1966 */ 1967 static int tls_match_dn_field(X509 *cert, const char *match) 1968 { 1969 const char *token, *last = NULL; 1970 char field[256]; 1971 struct tls_dn_field_order_cnt dn_cnt; 1972 1973 os_memset(&dn_cnt, 0, sizeof(dn_cnt)); 1974 1975 /* Maximum length of each DN field is 255 characters */ 1976 1977 /* Process each '/' delimited field */ 1978 while ((token = cstr_token(match, "/", &last))) { 1979 if (last - token >= (int) sizeof(field)) { 1980 wpa_printf(MSG_ERROR, 1981 "OpenSSL: Too long DN matching field value in '%s'", 1982 match); 1983 return 0; 1984 } 1985 os_memcpy(field, token, last - token); 1986 field[last - token] = '\0'; 1987 1988 if (!get_value_from_field(cert, field, &dn_cnt)) { 1989 wpa_printf(MSG_DEBUG, "OpenSSL: No match for DN '%s'", 1990 field); 1991 return 0; 1992 } 1993 } 1994 1995 return 1; 1996 } 1997 1998 1999 #ifndef CONFIG_NATIVE_WINDOWS 2000 static int tls_match_suffix_helper(X509 *cert, const char *match, 2001 size_t match_len, int full) 2002 { 2003 GENERAL_NAME *gen; 2004 void *ext; 2005 int i; 2006 stack_index_t j; 2007 int dns_name = 0; 2008 X509_NAME *name; 2009 2010 wpa_printf(MSG_DEBUG, "TLS: Match domain against %s%s", 2011 full ? "": "suffix ", match); 2012 2013 ext = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL); 2014 2015 for (j = 0; ext && j < sk_GENERAL_NAME_num(ext); j++) { 2016 gen = sk_GENERAL_NAME_value(ext, j); 2017 if (gen->type != GEN_DNS) 2018 continue; 2019 dns_name++; 2020 wpa_hexdump_ascii(MSG_DEBUG, "TLS: Certificate dNSName", 2021 gen->d.dNSName->data, 2022 gen->d.dNSName->length); 2023 if (domain_suffix_match(gen->d.dNSName->data, 2024 gen->d.dNSName->length, 2025 match, match_len, full) == 1) { 2026 wpa_printf(MSG_DEBUG, "TLS: %s in dNSName found", 2027 full ? "Match" : "Suffix match"); 2028 sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free); 2029 return 1; 2030 } 2031 } 2032 sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free); 2033 2034 if (dns_name) { 2035 wpa_printf(MSG_DEBUG, "TLS: None of the dNSName(s) matched"); 2036 return 0; 2037 } 2038 2039 name = X509_get_subject_name(cert); 2040 i = -1; 2041 for (;;) { 2042 X509_NAME_ENTRY *e; 2043 ASN1_STRING *cn; 2044 2045 i = X509_NAME_get_index_by_NID(name, NID_commonName, i); 2046 if (i == -1) 2047 break; 2048 e = X509_NAME_get_entry(name, i); 2049 if (e == NULL) 2050 continue; 2051 cn = X509_NAME_ENTRY_get_data(e); 2052 if (cn == NULL) 2053 continue; 2054 wpa_hexdump_ascii(MSG_DEBUG, "TLS: Certificate commonName", 2055 cn->data, cn->length); 2056 if (domain_suffix_match(cn->data, cn->length, 2057 match, match_len, full) == 1) { 2058 wpa_printf(MSG_DEBUG, "TLS: %s in commonName found", 2059 full ? "Match" : "Suffix match"); 2060 return 1; 2061 } 2062 } 2063 2064 wpa_printf(MSG_DEBUG, "TLS: No CommonName %smatch found", 2065 full ? "": "suffix "); 2066 return 0; 2067 } 2068 #endif /* CONFIG_NATIVE_WINDOWS */ 2069 2070 2071 static int tls_match_suffix(X509 *cert, const char *match, int full) 2072 { 2073 #ifdef CONFIG_NATIVE_WINDOWS 2074 /* wincrypt.h has conflicting X509_NAME definition */ 2075 return -1; 2076 #else /* CONFIG_NATIVE_WINDOWS */ 2077 const char *token, *last = NULL; 2078 2079 /* Process each match alternative separately until a match is found */ 2080 while ((token = cstr_token(match, ";", &last))) { 2081 if (tls_match_suffix_helper(cert, token, last - token, full)) 2082 return 1; 2083 } 2084 2085 return 0; 2086 #endif /* CONFIG_NATIVE_WINDOWS */ 2087 } 2088 2089 2090 static enum tls_fail_reason openssl_tls_fail_reason(int err) 2091 { 2092 switch (err) { 2093 case X509_V_ERR_CERT_REVOKED: 2094 return TLS_FAIL_REVOKED; 2095 case X509_V_ERR_CERT_NOT_YET_VALID: 2096 case X509_V_ERR_CRL_NOT_YET_VALID: 2097 return TLS_FAIL_NOT_YET_VALID; 2098 case X509_V_ERR_CERT_HAS_EXPIRED: 2099 case X509_V_ERR_CRL_HAS_EXPIRED: 2100 return TLS_FAIL_EXPIRED; 2101 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT: 2102 case X509_V_ERR_UNABLE_TO_GET_CRL: 2103 case X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER: 2104 case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN: 2105 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY: 2106 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT: 2107 case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE: 2108 case X509_V_ERR_CERT_CHAIN_TOO_LONG: 2109 case X509_V_ERR_PATH_LENGTH_EXCEEDED: 2110 case X509_V_ERR_INVALID_CA: 2111 return TLS_FAIL_UNTRUSTED; 2112 case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE: 2113 case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE: 2114 case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY: 2115 case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD: 2116 case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD: 2117 case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD: 2118 case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD: 2119 case X509_V_ERR_CERT_UNTRUSTED: 2120 case X509_V_ERR_CERT_REJECTED: 2121 return TLS_FAIL_BAD_CERTIFICATE; 2122 default: 2123 return TLS_FAIL_UNSPECIFIED; 2124 } 2125 } 2126 2127 2128 static struct wpabuf * get_x509_cert(X509 *cert) 2129 { 2130 struct wpabuf *buf; 2131 u8 *tmp; 2132 2133 int cert_len = i2d_X509(cert, NULL); 2134 if (cert_len <= 0) 2135 return NULL; 2136 2137 buf = wpabuf_alloc(cert_len); 2138 if (buf == NULL) 2139 return NULL; 2140 2141 tmp = wpabuf_put(buf, cert_len); 2142 i2d_X509(cert, &tmp); 2143 return buf; 2144 } 2145 2146 2147 static void openssl_tls_fail_event(struct tls_connection *conn, 2148 X509 *err_cert, int err, int depth, 2149 const char *subject, const char *err_str, 2150 enum tls_fail_reason reason) 2151 { 2152 union tls_event_data ev; 2153 struct wpabuf *cert = NULL; 2154 struct tls_context *context = conn->context; 2155 2156 if (context->event_cb == NULL) 2157 return; 2158 2159 cert = get_x509_cert(err_cert); 2160 os_memset(&ev, 0, sizeof(ev)); 2161 ev.cert_fail.reason = reason != TLS_FAIL_UNSPECIFIED ? 2162 reason : openssl_tls_fail_reason(err); 2163 ev.cert_fail.depth = depth; 2164 ev.cert_fail.subject = subject; 2165 ev.cert_fail.reason_txt = err_str; 2166 ev.cert_fail.cert = cert; 2167 context->event_cb(context->cb_ctx, TLS_CERT_CHAIN_FAILURE, &ev); 2168 wpabuf_free(cert); 2169 } 2170 2171 2172 static int openssl_cert_tod(X509 *cert) 2173 { 2174 CERTIFICATEPOLICIES *ext; 2175 stack_index_t i; 2176 char buf[100]; 2177 int res; 2178 int tod = 0; 2179 2180 ext = X509_get_ext_d2i(cert, NID_certificate_policies, NULL, NULL); 2181 if (!ext) 2182 return 0; 2183 2184 for (i = 0; i < sk_POLICYINFO_num(ext); i++) { 2185 POLICYINFO *policy; 2186 2187 policy = sk_POLICYINFO_value(ext, i); 2188 res = OBJ_obj2txt(buf, sizeof(buf), policy->policyid, 0); 2189 if (res < 0 || (size_t) res >= sizeof(buf)) 2190 continue; 2191 wpa_printf(MSG_DEBUG, "OpenSSL: Certificate Policy %s", buf); 2192 if (os_strcmp(buf, "1.3.6.1.4.1.40808.1.3.1") == 0) 2193 tod = 1; /* TOD-STRICT */ 2194 else if (os_strcmp(buf, "1.3.6.1.4.1.40808.1.3.2") == 0 && !tod) 2195 tod = 2; /* TOD-TOFU */ 2196 } 2197 sk_POLICYINFO_pop_free(ext, POLICYINFO_free); 2198 2199 return tod; 2200 } 2201 2202 2203 static void openssl_tls_cert_event(struct tls_connection *conn, 2204 X509 *err_cert, int depth, 2205 const char *subject) 2206 { 2207 struct wpabuf *cert = NULL; 2208 union tls_event_data ev; 2209 struct tls_context *context = conn->context; 2210 char *altsubject[TLS_MAX_ALT_SUBJECT]; 2211 int alt, num_altsubject = 0; 2212 GENERAL_NAME *gen; 2213 void *ext; 2214 stack_index_t i; 2215 ASN1_INTEGER *ser; 2216 char serial_num[128]; 2217 #ifdef CONFIG_SHA256 2218 u8 hash[32]; 2219 #endif /* CONFIG_SHA256 */ 2220 2221 if (context->event_cb == NULL) 2222 return; 2223 2224 os_memset(&ev, 0, sizeof(ev)); 2225 if (conn->cert_probe || (conn->flags & TLS_CONN_EXT_CERT_CHECK) || 2226 context->cert_in_cb) { 2227 cert = get_x509_cert(err_cert); 2228 ev.peer_cert.cert = cert; 2229 } 2230 #ifdef CONFIG_SHA256 2231 if (cert) { 2232 const u8 *addr[1]; 2233 size_t len[1]; 2234 addr[0] = wpabuf_head(cert); 2235 len[0] = wpabuf_len(cert); 2236 if (sha256_vector(1, addr, len, hash) == 0) { 2237 ev.peer_cert.hash = hash; 2238 ev.peer_cert.hash_len = sizeof(hash); 2239 } 2240 } 2241 #endif /* CONFIG_SHA256 */ 2242 ev.peer_cert.depth = depth; 2243 ev.peer_cert.subject = subject; 2244 2245 ser = X509_get_serialNumber(err_cert); 2246 if (ser) { 2247 wpa_snprintf_hex_uppercase(serial_num, sizeof(serial_num), 2248 ASN1_STRING_get0_data(ser), 2249 ASN1_STRING_length(ser)); 2250 ev.peer_cert.serial_num = serial_num; 2251 } 2252 2253 ext = X509_get_ext_d2i(err_cert, NID_subject_alt_name, NULL, NULL); 2254 for (i = 0; ext && i < sk_GENERAL_NAME_num(ext); i++) { 2255 char *pos; 2256 2257 if (num_altsubject == TLS_MAX_ALT_SUBJECT) 2258 break; 2259 gen = sk_GENERAL_NAME_value(ext, i); 2260 if (gen->type != GEN_EMAIL && 2261 gen->type != GEN_DNS && 2262 gen->type != GEN_URI) 2263 continue; 2264 2265 pos = os_malloc(10 + gen->d.ia5->length + 1); 2266 if (pos == NULL) 2267 break; 2268 altsubject[num_altsubject++] = pos; 2269 2270 switch (gen->type) { 2271 case GEN_EMAIL: 2272 os_memcpy(pos, "EMAIL:", 6); 2273 pos += 6; 2274 break; 2275 case GEN_DNS: 2276 os_memcpy(pos, "DNS:", 4); 2277 pos += 4; 2278 break; 2279 case GEN_URI: 2280 os_memcpy(pos, "URI:", 4); 2281 pos += 4; 2282 break; 2283 } 2284 2285 os_memcpy(pos, gen->d.ia5->data, gen->d.ia5->length); 2286 pos += gen->d.ia5->length; 2287 *pos = '\0'; 2288 } 2289 sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free); 2290 2291 for (alt = 0; alt < num_altsubject; alt++) 2292 ev.peer_cert.altsubject[alt] = altsubject[alt]; 2293 ev.peer_cert.num_altsubject = num_altsubject; 2294 2295 ev.peer_cert.tod = openssl_cert_tod(err_cert); 2296 2297 context->event_cb(context->cb_ctx, TLS_PEER_CERTIFICATE, &ev); 2298 wpabuf_free(cert); 2299 for (alt = 0; alt < num_altsubject; alt++) 2300 os_free(altsubject[alt]); 2301 } 2302 2303 2304 static void debug_print_cert(X509 *cert, const char *title) 2305 { 2306 #ifndef CONFIG_NO_STDOUT_DEBUG 2307 BIO *out; 2308 size_t rlen; 2309 char *txt; 2310 int res; 2311 2312 if (wpa_debug_level > MSG_DEBUG) 2313 return; 2314 2315 out = BIO_new(BIO_s_mem()); 2316 if (!out) 2317 return; 2318 2319 X509_print(out, cert); 2320 rlen = BIO_ctrl_pending(out); 2321 txt = os_malloc(rlen + 1); 2322 if (txt) { 2323 res = BIO_read(out, txt, rlen); 2324 if (res > 0) { 2325 txt[res] = '\0'; 2326 wpa_printf(MSG_DEBUG, "OpenSSL: %s\n%s", title, txt); 2327 } 2328 os_free(txt); 2329 } 2330 2331 BIO_free(out); 2332 #endif /* CONFIG_NO_STDOUT_DEBUG */ 2333 } 2334 2335 2336 static int tls_verify_cb(int preverify_ok, X509_STORE_CTX *x509_ctx) 2337 { 2338 char buf[256]; 2339 X509 *err_cert; 2340 int err, depth; 2341 SSL *ssl; 2342 struct tls_connection *conn; 2343 struct tls_context *context; 2344 char *match, *altmatch, *suffix_match, *domain_match; 2345 const char *check_cert_subject; 2346 const char *err_str; 2347 2348 err_cert = X509_STORE_CTX_get_current_cert(x509_ctx); 2349 if (!err_cert) 2350 return 0; 2351 2352 err = X509_STORE_CTX_get_error(x509_ctx); 2353 depth = X509_STORE_CTX_get_error_depth(x509_ctx); 2354 ssl = X509_STORE_CTX_get_ex_data(x509_ctx, 2355 SSL_get_ex_data_X509_STORE_CTX_idx()); 2356 os_snprintf(buf, sizeof(buf), "Peer certificate - depth %d", depth); 2357 debug_print_cert(err_cert, buf); 2358 X509_NAME_oneline(X509_get_subject_name(err_cert), buf, sizeof(buf)); 2359 2360 conn = SSL_get_app_data(ssl); 2361 if (conn == NULL) 2362 return 0; 2363 2364 if (depth == 0) 2365 conn->peer_cert = err_cert; 2366 else if (depth == 1) 2367 conn->peer_issuer = err_cert; 2368 else if (depth == 2) 2369 conn->peer_issuer_issuer = err_cert; 2370 2371 context = conn->context; 2372 match = conn->subject_match; 2373 altmatch = conn->altsubject_match; 2374 suffix_match = conn->suffix_match; 2375 domain_match = conn->domain_match; 2376 2377 if (!preverify_ok && !conn->ca_cert_verify) 2378 preverify_ok = 1; 2379 if (!preverify_ok && depth > 0 && conn->server_cert_only) 2380 preverify_ok = 1; 2381 if (!preverify_ok && (conn->flags & TLS_CONN_DISABLE_TIME_CHECKS) && 2382 (err == X509_V_ERR_CERT_HAS_EXPIRED || 2383 err == X509_V_ERR_CERT_NOT_YET_VALID)) { 2384 wpa_printf(MSG_DEBUG, "OpenSSL: Ignore certificate validity " 2385 "time mismatch"); 2386 preverify_ok = 1; 2387 } 2388 if (!preverify_ok && !conn->data->check_crl_strict && 2389 (err == X509_V_ERR_CRL_HAS_EXPIRED || 2390 err == X509_V_ERR_CRL_NOT_YET_VALID)) { 2391 wpa_printf(MSG_DEBUG, 2392 "OpenSSL: Ignore certificate validity CRL time mismatch"); 2393 preverify_ok = 1; 2394 } 2395 2396 err_str = X509_verify_cert_error_string(err); 2397 2398 #ifdef CONFIG_SHA256 2399 /* 2400 * Do not require preverify_ok so we can explicity allow otherwise 2401 * invalid pinned server certificates. 2402 */ 2403 if (depth == 0 && conn->server_cert_only) { 2404 struct wpabuf *cert; 2405 cert = get_x509_cert(err_cert); 2406 if (!cert) { 2407 wpa_printf(MSG_DEBUG, "OpenSSL: Could not fetch " 2408 "server certificate data"); 2409 preverify_ok = 0; 2410 } else { 2411 u8 hash[32]; 2412 const u8 *addr[1]; 2413 size_t len[1]; 2414 addr[0] = wpabuf_head(cert); 2415 len[0] = wpabuf_len(cert); 2416 if (sha256_vector(1, addr, len, hash) < 0 || 2417 os_memcmp(conn->srv_cert_hash, hash, 32) != 0) { 2418 err_str = "Server certificate mismatch"; 2419 err = X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN; 2420 preverify_ok = 0; 2421 } else if (!preverify_ok) { 2422 /* 2423 * Certificate matches pinned certificate, allow 2424 * regardless of other problems. 2425 */ 2426 wpa_printf(MSG_DEBUG, 2427 "OpenSSL: Ignore validation issues for a pinned server certificate"); 2428 preverify_ok = 1; 2429 } 2430 wpabuf_free(cert); 2431 } 2432 } 2433 #endif /* CONFIG_SHA256 */ 2434 2435 openssl_tls_cert_event(conn, err_cert, depth, buf); 2436 2437 if (!preverify_ok) { 2438 if (depth > 0) { 2439 /* Send cert event for the peer certificate so that 2440 * the upper layers get information about it even if 2441 * validation of a CA certificate fails. */ 2442 STACK_OF(X509) *chain; 2443 2444 chain = X509_STORE_CTX_get1_chain(x509_ctx); 2445 if (chain && sk_X509_num(chain) > 0) { 2446 char buf2[256]; 2447 X509 *cert; 2448 2449 cert = sk_X509_value(chain, 0); 2450 X509_NAME_oneline(X509_get_subject_name(cert), 2451 buf2, sizeof(buf2)); 2452 2453 openssl_tls_cert_event(conn, cert, 0, buf2); 2454 } 2455 if (chain) 2456 sk_X509_pop_free(chain, X509_free); 2457 } 2458 2459 wpa_printf(MSG_WARNING, "TLS: Certificate verification failed," 2460 " error %d (%s) depth %d for '%s'", err, err_str, 2461 depth, buf); 2462 openssl_tls_fail_event(conn, err_cert, err, depth, buf, 2463 err_str, TLS_FAIL_UNSPECIFIED); 2464 return preverify_ok; 2465 } 2466 2467 wpa_printf(MSG_DEBUG, "TLS: tls_verify_cb - preverify_ok=%d " 2468 "err=%d (%s) ca_cert_verify=%d depth=%d buf='%s'", 2469 preverify_ok, err, err_str, 2470 conn->ca_cert_verify, depth, buf); 2471 check_cert_subject = conn->check_cert_subject; 2472 if (!check_cert_subject) 2473 check_cert_subject = conn->data->check_cert_subject; 2474 if (check_cert_subject) { 2475 if (depth == 0 && 2476 !tls_match_dn_field(err_cert, check_cert_subject)) { 2477 preverify_ok = 0; 2478 openssl_tls_fail_event(conn, err_cert, err, depth, buf, 2479 "Distinguished Name", 2480 TLS_FAIL_DN_MISMATCH); 2481 } 2482 } 2483 if (depth == 0 && match && os_strstr(buf, match) == NULL) { 2484 wpa_printf(MSG_WARNING, "TLS: Subject '%s' did not " 2485 "match with '%s'", buf, match); 2486 preverify_ok = 0; 2487 openssl_tls_fail_event(conn, err_cert, err, depth, buf, 2488 "Subject mismatch", 2489 TLS_FAIL_SUBJECT_MISMATCH); 2490 } else if (depth == 0 && altmatch && 2491 !tls_match_altsubject(err_cert, altmatch)) { 2492 wpa_printf(MSG_WARNING, "TLS: altSubjectName match " 2493 "'%s' not found", altmatch); 2494 preverify_ok = 0; 2495 openssl_tls_fail_event(conn, err_cert, err, depth, buf, 2496 "AltSubject mismatch", 2497 TLS_FAIL_ALTSUBJECT_MISMATCH); 2498 } else if (depth == 0 && suffix_match && 2499 !tls_match_suffix(err_cert, suffix_match, 0)) { 2500 wpa_printf(MSG_WARNING, "TLS: Domain suffix match '%s' not found", 2501 suffix_match); 2502 preverify_ok = 0; 2503 openssl_tls_fail_event(conn, err_cert, err, depth, buf, 2504 "Domain suffix mismatch", 2505 TLS_FAIL_DOMAIN_SUFFIX_MISMATCH); 2506 } else if (depth == 0 && domain_match && 2507 !tls_match_suffix(err_cert, domain_match, 1)) { 2508 wpa_printf(MSG_WARNING, "TLS: Domain match '%s' not found", 2509 domain_match); 2510 preverify_ok = 0; 2511 openssl_tls_fail_event(conn, err_cert, err, depth, buf, 2512 "Domain mismatch", 2513 TLS_FAIL_DOMAIN_MISMATCH); 2514 } 2515 2516 if (conn->cert_probe && preverify_ok && depth == 0) { 2517 wpa_printf(MSG_DEBUG, "OpenSSL: Reject server certificate " 2518 "on probe-only run"); 2519 preverify_ok = 0; 2520 openssl_tls_fail_event(conn, err_cert, err, depth, buf, 2521 "Server certificate chain probe", 2522 TLS_FAIL_SERVER_CHAIN_PROBE); 2523 } 2524 2525 #ifdef CONFIG_SUITEB 2526 if (conn->flags & TLS_CONN_SUITEB) { 2527 EVP_PKEY *pk; 2528 RSA *rsa; 2529 int len = -1; 2530 2531 pk = X509_get_pubkey(err_cert); 2532 if (pk) { 2533 rsa = EVP_PKEY_get1_RSA(pk); 2534 if (rsa) { 2535 len = RSA_bits(rsa); 2536 RSA_free(rsa); 2537 } 2538 EVP_PKEY_free(pk); 2539 } 2540 2541 if (len >= 0) { 2542 wpa_printf(MSG_DEBUG, 2543 "OpenSSL: RSA modulus size: %d bits", len); 2544 if (len < 3072) { 2545 preverify_ok = 0; 2546 openssl_tls_fail_event( 2547 conn, err_cert, err, 2548 depth, buf, 2549 "Insufficient RSA modulus size", 2550 TLS_FAIL_INSUFFICIENT_KEY_LEN); 2551 } 2552 } 2553 } 2554 #endif /* CONFIG_SUITEB */ 2555 2556 #ifdef OPENSSL_IS_BORINGSSL 2557 if (depth == 0 && (conn->flags & TLS_CONN_REQUEST_OCSP) && 2558 preverify_ok) { 2559 enum ocsp_result res; 2560 2561 res = check_ocsp_resp(conn->ssl_ctx, conn->ssl, err_cert, 2562 conn->peer_issuer, 2563 conn->peer_issuer_issuer); 2564 if (res == OCSP_REVOKED) { 2565 preverify_ok = 0; 2566 openssl_tls_fail_event(conn, err_cert, err, depth, buf, 2567 "certificate revoked", 2568 TLS_FAIL_REVOKED); 2569 if (err == X509_V_OK) 2570 X509_STORE_CTX_set_error( 2571 x509_ctx, X509_V_ERR_CERT_REVOKED); 2572 } else if (res != OCSP_GOOD && 2573 (conn->flags & TLS_CONN_REQUIRE_OCSP)) { 2574 preverify_ok = 0; 2575 openssl_tls_fail_event(conn, err_cert, err, depth, buf, 2576 "bad certificate status response", 2577 TLS_FAIL_UNSPECIFIED); 2578 } 2579 } 2580 #endif /* OPENSSL_IS_BORINGSSL */ 2581 2582 if (depth == 0 && preverify_ok && context->event_cb != NULL) 2583 context->event_cb(context->cb_ctx, 2584 TLS_CERT_CHAIN_SUCCESS, NULL); 2585 2586 if (depth == 0 && preverify_ok) { 2587 os_free(conn->peer_subject); 2588 conn->peer_subject = os_strdup(buf); 2589 } 2590 2591 return preverify_ok; 2592 } 2593 2594 2595 #ifndef OPENSSL_NO_STDIO 2596 static int tls_load_ca_der(struct tls_data *data, const char *ca_cert) 2597 { 2598 SSL_CTX *ssl_ctx = data->ssl; 2599 X509_LOOKUP *lookup; 2600 int ret = 0; 2601 2602 lookup = X509_STORE_add_lookup(SSL_CTX_get_cert_store(ssl_ctx), 2603 X509_LOOKUP_file()); 2604 if (lookup == NULL) { 2605 tls_show_errors(MSG_WARNING, __func__, 2606 "Failed add lookup for X509 store"); 2607 return -1; 2608 } 2609 2610 if (!X509_LOOKUP_load_file(lookup, ca_cert, X509_FILETYPE_ASN1)) { 2611 unsigned long err = ERR_peek_error(); 2612 tls_show_errors(MSG_WARNING, __func__, 2613 "Failed load CA in DER format"); 2614 if (ERR_GET_LIB(err) == ERR_LIB_X509 && 2615 ERR_GET_REASON(err) == X509_R_CERT_ALREADY_IN_HASH_TABLE) { 2616 wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring " 2617 "cert already in hash table error", 2618 __func__); 2619 } else 2620 ret = -1; 2621 } 2622 2623 return ret; 2624 } 2625 #endif /* OPENSSL_NO_STDIO */ 2626 2627 2628 static int tls_connection_ca_cert(struct tls_data *data, 2629 struct tls_connection *conn, 2630 const char *ca_cert, const u8 *ca_cert_blob, 2631 size_t ca_cert_blob_len, const char *ca_path) 2632 { 2633 SSL_CTX *ssl_ctx = data->ssl; 2634 X509_STORE *store; 2635 2636 /* 2637 * Remove previously configured trusted CA certificates before adding 2638 * new ones. 2639 */ 2640 store = X509_STORE_new(); 2641 if (store == NULL) { 2642 wpa_printf(MSG_DEBUG, "OpenSSL: %s - failed to allocate new " 2643 "certificate store", __func__); 2644 return -1; 2645 } 2646 SSL_CTX_set_cert_store(ssl_ctx, store); 2647 2648 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb); 2649 conn->ca_cert_verify = 1; 2650 2651 if (ca_cert && os_strncmp(ca_cert, "probe://", 8) == 0) { 2652 wpa_printf(MSG_DEBUG, "OpenSSL: Probe for server certificate " 2653 "chain"); 2654 conn->cert_probe = 1; 2655 conn->ca_cert_verify = 0; 2656 return 0; 2657 } 2658 2659 if (ca_cert && os_strncmp(ca_cert, "hash://", 7) == 0) { 2660 #ifdef CONFIG_SHA256 2661 const char *pos = ca_cert + 7; 2662 if (os_strncmp(pos, "server/sha256/", 14) != 0) { 2663 wpa_printf(MSG_DEBUG, "OpenSSL: Unsupported ca_cert " 2664 "hash value '%s'", ca_cert); 2665 return -1; 2666 } 2667 pos += 14; 2668 if (os_strlen(pos) != 32 * 2) { 2669 wpa_printf(MSG_DEBUG, "OpenSSL: Unexpected SHA256 " 2670 "hash length in ca_cert '%s'", ca_cert); 2671 return -1; 2672 } 2673 if (hexstr2bin(pos, conn->srv_cert_hash, 32) < 0) { 2674 wpa_printf(MSG_DEBUG, "OpenSSL: Invalid SHA256 hash " 2675 "value in ca_cert '%s'", ca_cert); 2676 return -1; 2677 } 2678 conn->server_cert_only = 1; 2679 wpa_printf(MSG_DEBUG, "OpenSSL: Checking only server " 2680 "certificate match"); 2681 return 0; 2682 #else /* CONFIG_SHA256 */ 2683 wpa_printf(MSG_INFO, "No SHA256 included in the build - " 2684 "cannot validate server certificate hash"); 2685 return -1; 2686 #endif /* CONFIG_SHA256 */ 2687 } 2688 2689 if (ca_cert_blob) { 2690 X509 *cert = d2i_X509(NULL, 2691 (const unsigned char **) &ca_cert_blob, 2692 ca_cert_blob_len); 2693 if (cert == NULL) { 2694 BIO *bio = BIO_new_mem_buf(ca_cert_blob, 2695 ca_cert_blob_len); 2696 2697 if (bio) { 2698 cert = PEM_read_bio_X509(bio, NULL, NULL, NULL); 2699 BIO_free(bio); 2700 } 2701 2702 if (!cert) { 2703 tls_show_errors(MSG_WARNING, __func__, 2704 "Failed to parse ca_cert_blob"); 2705 return -1; 2706 } 2707 2708 while (ERR_get_error()) { 2709 /* Ignore errors from DER conversion. */ 2710 } 2711 } 2712 2713 if (!X509_STORE_add_cert(SSL_CTX_get_cert_store(ssl_ctx), 2714 cert)) { 2715 unsigned long err = ERR_peek_error(); 2716 tls_show_errors(MSG_WARNING, __func__, 2717 "Failed to add ca_cert_blob to " 2718 "certificate store"); 2719 if (ERR_GET_LIB(err) == ERR_LIB_X509 && 2720 ERR_GET_REASON(err) == 2721 X509_R_CERT_ALREADY_IN_HASH_TABLE) { 2722 wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring " 2723 "cert already in hash table error", 2724 __func__); 2725 } else { 2726 X509_free(cert); 2727 return -1; 2728 } 2729 } 2730 X509_free(cert); 2731 wpa_printf(MSG_DEBUG, "OpenSSL: %s - added ca_cert_blob " 2732 "to certificate store", __func__); 2733 return 0; 2734 } 2735 2736 #ifdef ANDROID 2737 /* Single alias */ 2738 if (ca_cert && os_strncmp("keystore://", ca_cert, 11) == 0) { 2739 if (tls_add_ca_from_keystore(SSL_CTX_get_cert_store(ssl_ctx), 2740 &ca_cert[11]) < 0) 2741 return -1; 2742 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb); 2743 return 0; 2744 } 2745 2746 /* Multiple aliases separated by space */ 2747 if (ca_cert && os_strncmp("keystores://", ca_cert, 12) == 0) { 2748 char *aliases = os_strdup(&ca_cert[12]); 2749 const char *delim = " "; 2750 int rc = 0; 2751 char *savedptr; 2752 char *alias; 2753 2754 if (!aliases) 2755 return -1; 2756 alias = strtok_r(aliases, delim, &savedptr); 2757 for (; alias; alias = strtok_r(NULL, delim, &savedptr)) { 2758 if (tls_add_ca_from_keystore_encoded( 2759 SSL_CTX_get_cert_store(ssl_ctx), alias)) { 2760 wpa_printf(MSG_WARNING, 2761 "OpenSSL: %s - Failed to add ca_cert %s from keystore", 2762 __func__, alias); 2763 rc = -1; 2764 break; 2765 } 2766 } 2767 os_free(aliases); 2768 if (rc) 2769 return rc; 2770 2771 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb); 2772 return 0; 2773 } 2774 #endif /* ANDROID */ 2775 2776 #ifdef CONFIG_NATIVE_WINDOWS 2777 if (ca_cert && tls_cryptoapi_ca_cert(ssl_ctx, conn->ssl, ca_cert) == 2778 0) { 2779 wpa_printf(MSG_DEBUG, "OpenSSL: Added CA certificates from " 2780 "system certificate store"); 2781 return 0; 2782 } 2783 #endif /* CONFIG_NATIVE_WINDOWS */ 2784 2785 if (ca_cert || ca_path) { 2786 #ifndef OPENSSL_NO_STDIO 2787 if (SSL_CTX_load_verify_locations(ssl_ctx, ca_cert, ca_path) != 2788 1) { 2789 tls_show_errors(MSG_WARNING, __func__, 2790 "Failed to load root certificates"); 2791 if (ca_cert && 2792 tls_load_ca_der(data, ca_cert) == 0) { 2793 wpa_printf(MSG_DEBUG, "OpenSSL: %s - loaded " 2794 "DER format CA certificate", 2795 __func__); 2796 } else 2797 return -1; 2798 } else { 2799 wpa_printf(MSG_DEBUG, "TLS: Trusted root " 2800 "certificate(s) loaded"); 2801 tls_get_errors(data); 2802 } 2803 #else /* OPENSSL_NO_STDIO */ 2804 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", 2805 __func__); 2806 return -1; 2807 #endif /* OPENSSL_NO_STDIO */ 2808 } else { 2809 /* No ca_cert configured - do not try to verify server 2810 * certificate */ 2811 conn->ca_cert_verify = 0; 2812 } 2813 2814 return 0; 2815 } 2816 2817 2818 static int tls_global_ca_cert(struct tls_data *data, const char *ca_cert) 2819 { 2820 SSL_CTX *ssl_ctx = data->ssl; 2821 2822 if (ca_cert) { 2823 if (SSL_CTX_load_verify_locations(ssl_ctx, ca_cert, NULL) != 1) 2824 { 2825 tls_show_errors(MSG_WARNING, __func__, 2826 "Failed to load root certificates"); 2827 return -1; 2828 } 2829 2830 wpa_printf(MSG_DEBUG, "TLS: Trusted root " 2831 "certificate(s) loaded"); 2832 2833 #ifndef OPENSSL_NO_STDIO 2834 /* Add the same CAs to the client certificate requests */ 2835 SSL_CTX_set_client_CA_list(ssl_ctx, 2836 SSL_load_client_CA_file(ca_cert)); 2837 #endif /* OPENSSL_NO_STDIO */ 2838 2839 os_free(data->ca_cert); 2840 data->ca_cert = os_strdup(ca_cert); 2841 } 2842 2843 return 0; 2844 } 2845 2846 2847 int tls_global_set_verify(void *ssl_ctx, int check_crl, int strict) 2848 { 2849 int flags; 2850 2851 if (check_crl) { 2852 struct tls_data *data = ssl_ctx; 2853 X509_STORE *cs = SSL_CTX_get_cert_store(data->ssl); 2854 if (cs == NULL) { 2855 tls_show_errors(MSG_INFO, __func__, "Failed to get " 2856 "certificate store when enabling " 2857 "check_crl"); 2858 return -1; 2859 } 2860 flags = X509_V_FLAG_CRL_CHECK; 2861 if (check_crl == 2) 2862 flags |= X509_V_FLAG_CRL_CHECK_ALL; 2863 X509_STORE_set_flags(cs, flags); 2864 2865 data->check_crl = check_crl; 2866 data->check_crl_strict = strict; 2867 os_get_reltime(&data->crl_last_reload); 2868 } 2869 return 0; 2870 } 2871 2872 2873 static int tls_connection_set_subject_match(struct tls_connection *conn, 2874 const char *subject_match, 2875 const char *altsubject_match, 2876 const char *suffix_match, 2877 const char *domain_match, 2878 const char *check_cert_subject) 2879 { 2880 os_free(conn->subject_match); 2881 conn->subject_match = NULL; 2882 if (subject_match) { 2883 conn->subject_match = os_strdup(subject_match); 2884 if (conn->subject_match == NULL) 2885 return -1; 2886 } 2887 2888 os_free(conn->altsubject_match); 2889 conn->altsubject_match = NULL; 2890 if (altsubject_match) { 2891 conn->altsubject_match = os_strdup(altsubject_match); 2892 if (conn->altsubject_match == NULL) 2893 return -1; 2894 } 2895 2896 os_free(conn->suffix_match); 2897 conn->suffix_match = NULL; 2898 if (suffix_match) { 2899 conn->suffix_match = os_strdup(suffix_match); 2900 if (conn->suffix_match == NULL) 2901 return -1; 2902 } 2903 2904 os_free(conn->domain_match); 2905 conn->domain_match = NULL; 2906 if (domain_match) { 2907 conn->domain_match = os_strdup(domain_match); 2908 if (conn->domain_match == NULL) 2909 return -1; 2910 } 2911 2912 os_free(conn->check_cert_subject); 2913 conn->check_cert_subject = NULL; 2914 if (check_cert_subject) { 2915 conn->check_cert_subject = os_strdup(check_cert_subject); 2916 if (!conn->check_cert_subject) 2917 return -1; 2918 } 2919 2920 return 0; 2921 } 2922 2923 2924 #ifdef CONFIG_SUITEB 2925 #if OPENSSL_VERSION_NUMBER >= 0x10002000L 2926 static int suiteb_cert_cb(SSL *ssl, void *arg) 2927 { 2928 struct tls_connection *conn = arg; 2929 2930 /* 2931 * This cert_cb() is not really the best location for doing a 2932 * constraint check for the ServerKeyExchange message, but this seems to 2933 * be the only place where the current OpenSSL sequence can be 2934 * terminated cleanly with an TLS alert going out to the server. 2935 */ 2936 2937 if (!(conn->flags & TLS_CONN_SUITEB)) 2938 return 1; 2939 2940 /* DHE is enabled only with DHE-RSA-AES256-GCM-SHA384 */ 2941 if (conn->cipher_suite != 0x9f) 2942 return 1; 2943 2944 if (conn->server_dh_prime_len >= 3072) 2945 return 1; 2946 2947 wpa_printf(MSG_DEBUG, 2948 "OpenSSL: Server DH prime length (%d bits) not sufficient for Suite B RSA - reject handshake", 2949 conn->server_dh_prime_len); 2950 return 0; 2951 } 2952 #endif /* OPENSSL_VERSION_NUMBER */ 2953 #endif /* CONFIG_SUITEB */ 2954 2955 2956 static int tls_set_conn_flags(struct tls_connection *conn, unsigned int flags, 2957 const char *openssl_ciphers) 2958 { 2959 SSL *ssl = conn->ssl; 2960 2961 #ifdef SSL_OP_NO_TICKET 2962 if (flags & TLS_CONN_DISABLE_SESSION_TICKET) 2963 SSL_set_options(ssl, SSL_OP_NO_TICKET); 2964 else 2965 SSL_clear_options(ssl, SSL_OP_NO_TICKET); 2966 #endif /* SSL_OP_NO_TICKET */ 2967 2968 #ifdef SSL_OP_NO_TLSv1 2969 if (flags & TLS_CONN_DISABLE_TLSv1_0) 2970 SSL_set_options(ssl, SSL_OP_NO_TLSv1); 2971 else 2972 SSL_clear_options(ssl, SSL_OP_NO_TLSv1); 2973 #endif /* SSL_OP_NO_TLSv1 */ 2974 #ifdef SSL_OP_NO_TLSv1_1 2975 if (flags & TLS_CONN_DISABLE_TLSv1_1) 2976 SSL_set_options(ssl, SSL_OP_NO_TLSv1_1); 2977 else 2978 SSL_clear_options(ssl, SSL_OP_NO_TLSv1_1); 2979 #endif /* SSL_OP_NO_TLSv1_1 */ 2980 #ifdef SSL_OP_NO_TLSv1_2 2981 if (flags & TLS_CONN_DISABLE_TLSv1_2) 2982 SSL_set_options(ssl, SSL_OP_NO_TLSv1_2); 2983 else 2984 SSL_clear_options(ssl, SSL_OP_NO_TLSv1_2); 2985 #endif /* SSL_OP_NO_TLSv1_2 */ 2986 #ifdef SSL_OP_NO_TLSv1_3 2987 if (flags & TLS_CONN_DISABLE_TLSv1_3) 2988 SSL_set_options(ssl, SSL_OP_NO_TLSv1_3); 2989 else 2990 SSL_clear_options(ssl, SSL_OP_NO_TLSv1_3); 2991 #endif /* SSL_OP_NO_TLSv1_3 */ 2992 #if OPENSSL_VERSION_NUMBER >= 0x10100000L 2993 if (flags & (TLS_CONN_ENABLE_TLSv1_0 | 2994 TLS_CONN_ENABLE_TLSv1_1 | 2995 TLS_CONN_ENABLE_TLSv1_2)) { 2996 int version = 0; 2997 2998 /* Explicit request to enable TLS versions even if needing to 2999 * override systemwide policies. */ 3000 if (flags & TLS_CONN_ENABLE_TLSv1_0) 3001 version = TLS1_VERSION; 3002 else if (flags & TLS_CONN_ENABLE_TLSv1_1) 3003 version = TLS1_1_VERSION; 3004 else if (flags & TLS_CONN_ENABLE_TLSv1_2) 3005 version = TLS1_2_VERSION; 3006 if (!version) { 3007 wpa_printf(MSG_DEBUG, 3008 "OpenSSL: Invalid TLS version configuration"); 3009 return -1; 3010 } 3011 3012 if (SSL_set_min_proto_version(ssl, version) != 1) { 3013 wpa_printf(MSG_DEBUG, 3014 "OpenSSL: Failed to set minimum TLS version"); 3015 return -1; 3016 } 3017 } 3018 #endif /* >= 1.1.0 */ 3019 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && \ 3020 !defined(LIBRESSL_VERSION_NUMBER) && \ 3021 !defined(OPENSSL_IS_BORINGSSL) 3022 if ((flags & (TLS_CONN_ENABLE_TLSv1_0 | TLS_CONN_ENABLE_TLSv1_1)) && 3023 SSL_get_security_level(ssl) >= 2) { 3024 /* 3025 * Need to drop to security level 1 to allow TLS versions older 3026 * than 1.2 to be used when explicitly enabled in configuration. 3027 */ 3028 SSL_set_security_level(conn->ssl, 1); 3029 } 3030 #endif 3031 3032 #ifdef CONFIG_SUITEB 3033 #ifdef OPENSSL_IS_BORINGSSL 3034 /* Start with defaults from BoringSSL */ 3035 SSL_CTX_set_verify_algorithm_prefs(conn->ssl_ctx, NULL, 0); 3036 #endif /* OPENSSL_IS_BORINGSSL */ 3037 #if OPENSSL_VERSION_NUMBER >= 0x10002000L 3038 if (flags & TLS_CONN_SUITEB_NO_ECDH) { 3039 const char *ciphers = "DHE-RSA-AES256-GCM-SHA384"; 3040 3041 if (openssl_ciphers) { 3042 wpa_printf(MSG_DEBUG, 3043 "OpenSSL: Override ciphers for Suite B (no ECDH): %s", 3044 openssl_ciphers); 3045 ciphers = openssl_ciphers; 3046 } 3047 if (SSL_set_cipher_list(ssl, ciphers) != 1) { 3048 wpa_printf(MSG_INFO, 3049 "OpenSSL: Failed to set Suite B ciphers"); 3050 return -1; 3051 } 3052 } else if (flags & TLS_CONN_SUITEB) { 3053 EC_KEY *ecdh; 3054 const char *ciphers = 3055 "ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384"; 3056 int nid[1] = { NID_secp384r1 }; 3057 3058 if (openssl_ciphers) { 3059 wpa_printf(MSG_DEBUG, 3060 "OpenSSL: Override ciphers for Suite B: %s", 3061 openssl_ciphers); 3062 ciphers = openssl_ciphers; 3063 } 3064 if (SSL_set_cipher_list(ssl, ciphers) != 1) { 3065 wpa_printf(MSG_INFO, 3066 "OpenSSL: Failed to set Suite B ciphers"); 3067 return -1; 3068 } 3069 3070 if (SSL_set1_curves(ssl, nid, 1) != 1) { 3071 wpa_printf(MSG_INFO, 3072 "OpenSSL: Failed to set Suite B curves"); 3073 return -1; 3074 } 3075 3076 ecdh = EC_KEY_new_by_curve_name(NID_secp384r1); 3077 if (!ecdh || SSL_set_tmp_ecdh(ssl, ecdh) != 1) { 3078 EC_KEY_free(ecdh); 3079 wpa_printf(MSG_INFO, 3080 "OpenSSL: Failed to set ECDH parameter"); 3081 return -1; 3082 } 3083 EC_KEY_free(ecdh); 3084 } 3085 if (flags & (TLS_CONN_SUITEB | TLS_CONN_SUITEB_NO_ECDH)) { 3086 #ifdef OPENSSL_IS_BORINGSSL 3087 uint16_t sigalgs[1] = { SSL_SIGN_RSA_PKCS1_SHA384 }; 3088 3089 if (SSL_CTX_set_verify_algorithm_prefs(conn->ssl_ctx, sigalgs, 3090 1) != 1) { 3091 wpa_printf(MSG_INFO, 3092 "OpenSSL: Failed to set Suite B sigalgs"); 3093 return -1; 3094 } 3095 #else /* OPENSSL_IS_BORINGSSL */ 3096 /* ECDSA+SHA384 if need to add EC support here */ 3097 if (SSL_set1_sigalgs_list(ssl, "RSA+SHA384") != 1) { 3098 wpa_printf(MSG_INFO, 3099 "OpenSSL: Failed to set Suite B sigalgs"); 3100 return -1; 3101 } 3102 #endif /* OPENSSL_IS_BORINGSSL */ 3103 3104 SSL_set_options(ssl, SSL_OP_NO_TLSv1); 3105 SSL_set_options(ssl, SSL_OP_NO_TLSv1_1); 3106 SSL_set_cert_cb(ssl, suiteb_cert_cb, conn); 3107 } 3108 #else /* OPENSSL_VERSION_NUMBER < 0x10002000L */ 3109 if (flags & (TLS_CONN_SUITEB | TLS_CONN_SUITEB_NO_ECDH)) { 3110 wpa_printf(MSG_ERROR, 3111 "OpenSSL: Suite B RSA case not supported with this OpenSSL version"); 3112 return -1; 3113 } 3114 #endif /* OPENSSL_VERSION_NUMBER */ 3115 3116 #ifdef OPENSSL_IS_BORINGSSL 3117 if (openssl_ciphers && os_strcmp(openssl_ciphers, "SUITEB192") == 0) { 3118 uint16_t sigalgs[1] = { SSL_SIGN_ECDSA_SECP384R1_SHA384 }; 3119 int nid[1] = { NID_secp384r1 }; 3120 3121 if (SSL_set1_curves(ssl, nid, 1) != 1) { 3122 wpa_printf(MSG_INFO, 3123 "OpenSSL: Failed to set Suite B curves"); 3124 return -1; 3125 } 3126 3127 if (SSL_CTX_set_verify_algorithm_prefs(conn->ssl_ctx, sigalgs, 3128 1) != 1) { 3129 wpa_printf(MSG_INFO, 3130 "OpenSSL: Failed to set Suite B sigalgs"); 3131 return -1; 3132 } 3133 } 3134 #else /* OPENSSL_IS_BORINGSSL */ 3135 if (!(flags & (TLS_CONN_SUITEB | TLS_CONN_SUITEB_NO_ECDH)) && 3136 openssl_ciphers && SSL_set_cipher_list(ssl, openssl_ciphers) != 1) { 3137 wpa_printf(MSG_INFO, 3138 "OpenSSL: Failed to set openssl_ciphers '%s'", 3139 openssl_ciphers); 3140 return -1; 3141 } 3142 #endif /* OPENSSL_IS_BORINGSSL */ 3143 #else /* CONFIG_SUITEB */ 3144 if (openssl_ciphers && SSL_set_cipher_list(ssl, openssl_ciphers) != 1) { 3145 wpa_printf(MSG_INFO, 3146 "OpenSSL: Failed to set openssl_ciphers '%s'", 3147 openssl_ciphers); 3148 return -1; 3149 } 3150 #endif /* CONFIG_SUITEB */ 3151 3152 if (flags & TLS_CONN_TEAP_ANON_DH) { 3153 #ifndef TEAP_DH_ANON_CS 3154 #define TEAP_DH_ANON_CS \ 3155 "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:" \ 3156 "ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:" \ 3157 "ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:" \ 3158 "DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:" \ 3159 "DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:" \ 3160 "DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:" \ 3161 "ADH-AES256-GCM-SHA384:ADH-AES128-GCM-SHA256:" \ 3162 "ADH-AES256-SHA256:ADH-AES128-SHA256:ADH-AES256-SHA:ADH-AES128-SHA" 3163 #endif 3164 static const char *cs = TEAP_DH_ANON_CS; 3165 3166 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && \ 3167 !defined(LIBRESSL_VERSION_NUMBER) && \ 3168 !defined(OPENSSL_IS_BORINGSSL) 3169 /* 3170 * Need to drop to security level 0 to allow anonymous 3171 * cipher suites for EAP-TEAP. 3172 */ 3173 SSL_set_security_level(conn->ssl, 0); 3174 #endif 3175 3176 wpa_printf(MSG_DEBUG, 3177 "OpenSSL: Enable cipher suites for anonymous EAP-TEAP provisioning: %s", 3178 cs); 3179 if (SSL_set_cipher_list(conn->ssl, cs) != 1) { 3180 tls_show_errors(MSG_INFO, __func__, 3181 "Cipher suite configuration failed"); 3182 return -1; 3183 } 3184 } 3185 3186 return 0; 3187 } 3188 3189 3190 int tls_connection_set_verify(void *ssl_ctx, struct tls_connection *conn, 3191 int verify_peer, unsigned int flags, 3192 const u8 *session_ctx, size_t session_ctx_len) 3193 { 3194 static int counter = 0; 3195 struct tls_data *data = ssl_ctx; 3196 3197 if (conn == NULL) 3198 return -1; 3199 3200 if (verify_peer == 2) { 3201 conn->ca_cert_verify = 1; 3202 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER | 3203 SSL_VERIFY_CLIENT_ONCE, tls_verify_cb); 3204 } else if (verify_peer) { 3205 conn->ca_cert_verify = 1; 3206 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER | 3207 SSL_VERIFY_FAIL_IF_NO_PEER_CERT | 3208 SSL_VERIFY_CLIENT_ONCE, tls_verify_cb); 3209 } else { 3210 conn->ca_cert_verify = 0; 3211 SSL_set_verify(conn->ssl, SSL_VERIFY_NONE, NULL); 3212 } 3213 3214 if (tls_set_conn_flags(conn, flags, NULL) < 0) 3215 return -1; 3216 conn->flags = flags; 3217 3218 SSL_set_accept_state(conn->ssl); 3219 3220 if (data->tls_session_lifetime == 0) { 3221 /* 3222 * Set session id context to a unique value to make sure 3223 * session resumption cannot be used either through session 3224 * caching or TLS ticket extension. 3225 */ 3226 counter++; 3227 SSL_set_session_id_context(conn->ssl, 3228 (const unsigned char *) &counter, 3229 sizeof(counter)); 3230 } else if (session_ctx) { 3231 SSL_set_session_id_context(conn->ssl, session_ctx, 3232 session_ctx_len); 3233 } 3234 3235 return 0; 3236 } 3237 3238 3239 static int tls_connection_client_cert(struct tls_connection *conn, 3240 const char *client_cert, 3241 const u8 *client_cert_blob, 3242 size_t client_cert_blob_len) 3243 { 3244 if (client_cert == NULL && client_cert_blob == NULL) 3245 return 0; 3246 3247 #ifdef PKCS12_FUNCS 3248 #if OPENSSL_VERSION_NUMBER < 0x10002000L || defined(LIBRESSL_VERSION_NUMBER) 3249 /* 3250 * Clear previously set extra chain certificates, if any, from PKCS#12 3251 * processing in tls_parse_pkcs12() to allow OpenSSL to build a new 3252 * chain properly. 3253 */ 3254 SSL_CTX_clear_extra_chain_certs(conn->ssl_ctx); 3255 #endif /* OPENSSL_VERSION_NUMBER < 0x10002000L */ 3256 #endif /* PKCS12_FUNCS */ 3257 3258 if (client_cert_blob && 3259 SSL_use_certificate_ASN1(conn->ssl, (u8 *) client_cert_blob, 3260 client_cert_blob_len) == 1) { 3261 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_ASN1 --> " 3262 "OK"); 3263 return 0; 3264 } else if (client_cert_blob) { 3265 #if defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x20901000L 3266 tls_show_errors(MSG_DEBUG, __func__, 3267 "SSL_use_certificate_ASN1 failed"); 3268 #else 3269 BIO *bio; 3270 X509 *x509; 3271 3272 tls_show_errors(MSG_DEBUG, __func__, 3273 "SSL_use_certificate_ASN1 failed"); 3274 bio = BIO_new(BIO_s_mem()); 3275 if (!bio) 3276 return -1; 3277 BIO_write(bio, client_cert_blob, client_cert_blob_len); 3278 x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL); 3279 if (!x509 || SSL_use_certificate(conn->ssl, x509) != 1) { 3280 X509_free(x509); 3281 BIO_free(bio); 3282 return -1; 3283 } 3284 X509_free(x509); 3285 wpa_printf(MSG_DEBUG, 3286 "OpenSSL: Found PEM encoded certificate from blob"); 3287 while ((x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL))) { 3288 wpa_printf(MSG_DEBUG, 3289 "OpenSSL: Added an additional certificate into the chain"); 3290 SSL_add0_chain_cert(conn->ssl, x509); 3291 } 3292 BIO_free(bio); 3293 return 0; 3294 #endif 3295 } 3296 3297 if (client_cert == NULL) 3298 return -1; 3299 3300 #ifdef ANDROID 3301 if (os_strncmp("keystore://", client_cert, 11) == 0) { 3302 BIO *bio = BIO_from_keystore(&client_cert[11]); 3303 X509 *x509 = NULL; 3304 int ret = -1; 3305 if (bio) { 3306 x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL); 3307 } 3308 if (x509) { 3309 if (SSL_use_certificate(conn->ssl, x509) == 1) 3310 ret = 0; 3311 X509_free(x509); 3312 } 3313 3314 /* Read additional certificates into the chain. */ 3315 while (bio) { 3316 x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL); 3317 if (x509) { 3318 /* Takes ownership of x509 */ 3319 SSL_add0_chain_cert(conn->ssl, x509); 3320 } else { 3321 BIO_free(bio); 3322 bio = NULL; 3323 } 3324 } 3325 return ret; 3326 } 3327 #endif /* ANDROID */ 3328 3329 #ifndef OPENSSL_NO_STDIO 3330 if (SSL_use_certificate_file(conn->ssl, client_cert, 3331 SSL_FILETYPE_ASN1) == 1) { 3332 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_file (DER)" 3333 " --> OK"); 3334 return 0; 3335 } 3336 3337 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && \ 3338 !defined(LIBRESSL_VERSION_NUMBER) && !defined(OPENSSL_IS_BORINGSSL) 3339 if (SSL_use_certificate_chain_file(conn->ssl, client_cert) == 1) { 3340 ERR_clear_error(); 3341 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_chain_file" 3342 " --> OK"); 3343 return 0; 3344 } 3345 #else 3346 if (SSL_use_certificate_file(conn->ssl, client_cert, 3347 SSL_FILETYPE_PEM) == 1) { 3348 ERR_clear_error(); 3349 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_file (PEM)" 3350 " --> OK"); 3351 return 0; 3352 } 3353 #endif 3354 3355 tls_show_errors(MSG_DEBUG, __func__, 3356 "SSL_use_certificate_file failed"); 3357 #else /* OPENSSL_NO_STDIO */ 3358 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", __func__); 3359 #endif /* OPENSSL_NO_STDIO */ 3360 3361 return -1; 3362 } 3363 3364 3365 static int tls_global_client_cert(struct tls_data *data, 3366 const char *client_cert) 3367 { 3368 #ifndef OPENSSL_NO_STDIO 3369 SSL_CTX *ssl_ctx = data->ssl; 3370 3371 if (client_cert == NULL) 3372 return 0; 3373 3374 if (SSL_CTX_use_certificate_file(ssl_ctx, client_cert, 3375 SSL_FILETYPE_ASN1) != 1 && 3376 SSL_CTX_use_certificate_chain_file(ssl_ctx, client_cert) != 1 && 3377 SSL_CTX_use_certificate_file(ssl_ctx, client_cert, 3378 SSL_FILETYPE_PEM) != 1) { 3379 tls_show_errors(MSG_INFO, __func__, 3380 "Failed to load client certificate"); 3381 return -1; 3382 } 3383 return 0; 3384 #else /* OPENSSL_NO_STDIO */ 3385 if (client_cert == NULL) 3386 return 0; 3387 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", __func__); 3388 return -1; 3389 #endif /* OPENSSL_NO_STDIO */ 3390 } 3391 3392 3393 #ifdef PKCS12_FUNCS 3394 static int tls_parse_pkcs12(struct tls_data *data, SSL *ssl, PKCS12 *p12, 3395 const char *passwd) 3396 { 3397 EVP_PKEY *pkey; 3398 X509 *cert; 3399 STACK_OF(X509) *certs; 3400 int res = 0; 3401 char buf[256]; 3402 3403 pkey = NULL; 3404 cert = NULL; 3405 certs = NULL; 3406 if (!passwd) 3407 passwd = ""; 3408 if (!PKCS12_parse(p12, passwd, &pkey, &cert, &certs)) { 3409 tls_show_errors(MSG_DEBUG, __func__, 3410 "Failed to parse PKCS12 file"); 3411 PKCS12_free(p12); 3412 return -1; 3413 } 3414 wpa_printf(MSG_DEBUG, "TLS: Successfully parsed PKCS12 data"); 3415 3416 if (cert) { 3417 X509_NAME_oneline(X509_get_subject_name(cert), buf, 3418 sizeof(buf)); 3419 wpa_printf(MSG_DEBUG, "TLS: Got certificate from PKCS12: " 3420 "subject='%s'", buf); 3421 if (ssl) { 3422 if (SSL_use_certificate(ssl, cert) != 1) 3423 res = -1; 3424 } else { 3425 if (SSL_CTX_use_certificate(data->ssl, cert) != 1) 3426 res = -1; 3427 } 3428 X509_free(cert); 3429 } 3430 3431 if (pkey) { 3432 wpa_printf(MSG_DEBUG, "TLS: Got private key from PKCS12"); 3433 if (ssl) { 3434 if (SSL_use_PrivateKey(ssl, pkey) != 1) 3435 res = -1; 3436 } else { 3437 if (SSL_CTX_use_PrivateKey(data->ssl, pkey) != 1) 3438 res = -1; 3439 } 3440 EVP_PKEY_free(pkey); 3441 } 3442 3443 if (certs) { 3444 #if OPENSSL_VERSION_NUMBER >= 0x10002000L && !defined(LIBRESSL_VERSION_NUMBER) 3445 if (ssl) 3446 SSL_clear_chain_certs(ssl); 3447 else 3448 SSL_CTX_clear_chain_certs(data->ssl); 3449 while ((cert = sk_X509_pop(certs)) != NULL) { 3450 X509_NAME_oneline(X509_get_subject_name(cert), buf, 3451 sizeof(buf)); 3452 wpa_printf(MSG_DEBUG, "TLS: additional certificate" 3453 " from PKCS12: subject='%s'", buf); 3454 if ((ssl && SSL_add1_chain_cert(ssl, cert) != 1) || 3455 (!ssl && SSL_CTX_add1_chain_cert(data->ssl, 3456 cert) != 1)) { 3457 tls_show_errors(MSG_DEBUG, __func__, 3458 "Failed to add additional certificate"); 3459 res = -1; 3460 X509_free(cert); 3461 break; 3462 } 3463 X509_free(cert); 3464 } 3465 if (!res) { 3466 /* Try to continue anyway */ 3467 } 3468 sk_X509_pop_free(certs, X509_free); 3469 #ifndef OPENSSL_IS_BORINGSSL 3470 if (ssl) 3471 res = SSL_build_cert_chain( 3472 ssl, 3473 SSL_BUILD_CHAIN_FLAG_CHECK | 3474 SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR); 3475 else 3476 res = SSL_CTX_build_cert_chain( 3477 data->ssl, 3478 SSL_BUILD_CHAIN_FLAG_CHECK | 3479 SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR); 3480 if (!res) { 3481 tls_show_errors(MSG_DEBUG, __func__, 3482 "Failed to build certificate chain"); 3483 } else if (res == 2) { 3484 wpa_printf(MSG_DEBUG, 3485 "TLS: Ignore certificate chain verification error when building chain with PKCS#12 extra certificates"); 3486 } 3487 #endif /* OPENSSL_IS_BORINGSSL */ 3488 /* 3489 * Try to continue regardless of result since it is possible for 3490 * the extra certificates not to be required. 3491 */ 3492 res = 0; 3493 #else /* OPENSSL_VERSION_NUMBER >= 0x10002000L */ 3494 SSL_CTX_clear_extra_chain_certs(data->ssl); 3495 while ((cert = sk_X509_pop(certs)) != NULL) { 3496 X509_NAME_oneline(X509_get_subject_name(cert), buf, 3497 sizeof(buf)); 3498 wpa_printf(MSG_DEBUG, "TLS: additional certificate" 3499 " from PKCS12: subject='%s'", buf); 3500 /* 3501 * There is no SSL equivalent for the chain cert - so 3502 * always add it to the context... 3503 */ 3504 if (SSL_CTX_add_extra_chain_cert(data->ssl, cert) != 1) 3505 { 3506 X509_free(cert); 3507 res = -1; 3508 break; 3509 } 3510 } 3511 sk_X509_pop_free(certs, X509_free); 3512 #endif /* OPENSSL_VERSION_NUMBER >= 0x10002000L */ 3513 } 3514 3515 PKCS12_free(p12); 3516 3517 if (res < 0) 3518 tls_get_errors(data); 3519 3520 return res; 3521 } 3522 #endif /* PKCS12_FUNCS */ 3523 3524 3525 static int tls_read_pkcs12(struct tls_data *data, SSL *ssl, 3526 const char *private_key, const char *passwd) 3527 { 3528 #ifdef PKCS12_FUNCS 3529 FILE *f; 3530 PKCS12 *p12; 3531 3532 f = fopen(private_key, "rb"); 3533 if (f == NULL) 3534 return -1; 3535 3536 p12 = d2i_PKCS12_fp(f, NULL); 3537 fclose(f); 3538 3539 if (p12 == NULL) { 3540 tls_show_errors(MSG_INFO, __func__, 3541 "Failed to use PKCS#12 file"); 3542 return -1; 3543 } 3544 3545 return tls_parse_pkcs12(data, ssl, p12, passwd); 3546 3547 #else /* PKCS12_FUNCS */ 3548 wpa_printf(MSG_INFO, "TLS: PKCS12 support disabled - cannot read " 3549 "p12/pfx files"); 3550 return -1; 3551 #endif /* PKCS12_FUNCS */ 3552 } 3553 3554 3555 static int tls_read_pkcs12_blob(struct tls_data *data, SSL *ssl, 3556 const u8 *blob, size_t len, const char *passwd) 3557 { 3558 #ifdef PKCS12_FUNCS 3559 PKCS12 *p12; 3560 3561 p12 = d2i_PKCS12(NULL, (const unsigned char **) &blob, len); 3562 if (p12 == NULL) { 3563 tls_show_errors(MSG_INFO, __func__, 3564 "Failed to use PKCS#12 blob"); 3565 return -1; 3566 } 3567 3568 return tls_parse_pkcs12(data, ssl, p12, passwd); 3569 3570 #else /* PKCS12_FUNCS */ 3571 wpa_printf(MSG_INFO, "TLS: PKCS12 support disabled - cannot parse " 3572 "p12/pfx blobs"); 3573 return -1; 3574 #endif /* PKCS12_FUNCS */ 3575 } 3576 3577 3578 #ifndef OPENSSL_NO_ENGINE 3579 static int tls_engine_get_cert(struct tls_connection *conn, 3580 const char *cert_id, 3581 X509 **cert) 3582 { 3583 /* this runs after the private key is loaded so no PIN is required */ 3584 struct { 3585 const char *cert_id; 3586 X509 *cert; 3587 } params; 3588 params.cert_id = cert_id; 3589 params.cert = NULL; 3590 3591 if (!ENGINE_ctrl_cmd(conn->engine, "LOAD_CERT_CTRL", 3592 0, ¶ms, NULL, 1)) { 3593 unsigned long err = ERR_get_error(); 3594 3595 wpa_printf(MSG_ERROR, "ENGINE: cannot load client cert with id" 3596 " '%s' [%s]", cert_id, 3597 ERR_error_string(err, NULL)); 3598 if (tls_is_pin_error(err)) 3599 return TLS_SET_PARAMS_ENGINE_PRV_BAD_PIN; 3600 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED; 3601 } 3602 if (!params.cert) { 3603 wpa_printf(MSG_ERROR, "ENGINE: did not properly cert with id" 3604 " '%s'", cert_id); 3605 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED; 3606 } 3607 *cert = params.cert; 3608 return 0; 3609 } 3610 #endif /* OPENSSL_NO_ENGINE */ 3611 3612 3613 static int tls_connection_engine_client_cert(struct tls_connection *conn, 3614 const char *cert_id) 3615 { 3616 #ifndef OPENSSL_NO_ENGINE 3617 X509 *cert; 3618 3619 if (tls_engine_get_cert(conn, cert_id, &cert)) 3620 return -1; 3621 3622 if (!SSL_use_certificate(conn->ssl, cert)) { 3623 tls_show_errors(MSG_ERROR, __func__, 3624 "SSL_use_certificate failed"); 3625 X509_free(cert); 3626 return -1; 3627 } 3628 X509_free(cert); 3629 wpa_printf(MSG_DEBUG, "ENGINE: SSL_use_certificate --> " 3630 "OK"); 3631 return 0; 3632 3633 #else /* OPENSSL_NO_ENGINE */ 3634 return -1; 3635 #endif /* OPENSSL_NO_ENGINE */ 3636 } 3637 3638 3639 static int tls_connection_engine_ca_cert(struct tls_data *data, 3640 struct tls_connection *conn, 3641 const char *ca_cert_id) 3642 { 3643 #ifndef OPENSSL_NO_ENGINE 3644 X509 *cert; 3645 SSL_CTX *ssl_ctx = data->ssl; 3646 X509_STORE *store; 3647 3648 if (tls_engine_get_cert(conn, ca_cert_id, &cert)) 3649 return -1; 3650 3651 /* start off the same as tls_connection_ca_cert */ 3652 store = X509_STORE_new(); 3653 if (store == NULL) { 3654 wpa_printf(MSG_DEBUG, "OpenSSL: %s - failed to allocate new " 3655 "certificate store", __func__); 3656 X509_free(cert); 3657 return -1; 3658 } 3659 SSL_CTX_set_cert_store(ssl_ctx, store); 3660 if (!X509_STORE_add_cert(store, cert)) { 3661 unsigned long err = ERR_peek_error(); 3662 tls_show_errors(MSG_WARNING, __func__, 3663 "Failed to add CA certificate from engine " 3664 "to certificate store"); 3665 if (ERR_GET_LIB(err) == ERR_LIB_X509 && 3666 ERR_GET_REASON(err) == X509_R_CERT_ALREADY_IN_HASH_TABLE) { 3667 wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring cert" 3668 " already in hash table error", 3669 __func__); 3670 } else { 3671 X509_free(cert); 3672 return -1; 3673 } 3674 } 3675 X509_free(cert); 3676 wpa_printf(MSG_DEBUG, "OpenSSL: %s - added CA certificate from engine " 3677 "to certificate store", __func__); 3678 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb); 3679 conn->ca_cert_verify = 1; 3680 3681 return 0; 3682 3683 #else /* OPENSSL_NO_ENGINE */ 3684 return -1; 3685 #endif /* OPENSSL_NO_ENGINE */ 3686 } 3687 3688 3689 static int tls_connection_engine_private_key(struct tls_connection *conn) 3690 { 3691 #if defined(ANDROID) || !defined(OPENSSL_NO_ENGINE) 3692 if (SSL_use_PrivateKey(conn->ssl, conn->private_key) != 1) { 3693 tls_show_errors(MSG_ERROR, __func__, 3694 "ENGINE: cannot use private key for TLS"); 3695 return -1; 3696 } 3697 if (!SSL_check_private_key(conn->ssl)) { 3698 tls_show_errors(MSG_INFO, __func__, 3699 "Private key failed verification"); 3700 return -1; 3701 } 3702 return 0; 3703 #else /* OPENSSL_NO_ENGINE */ 3704 wpa_printf(MSG_ERROR, "SSL: Configuration uses engine, but " 3705 "engine support was not compiled in"); 3706 return -1; 3707 #endif /* OPENSSL_NO_ENGINE */ 3708 } 3709 3710 3711 #ifndef OPENSSL_NO_STDIO 3712 static int tls_passwd_cb(char *buf, int size, int rwflag, void *password) 3713 { 3714 if (!password) 3715 return 0; 3716 os_strlcpy(buf, (const char *) password, size); 3717 return os_strlen(buf); 3718 } 3719 #endif /* OPENSSL_NO_STDIO */ 3720 3721 3722 static int tls_use_private_key_file(struct tls_data *data, SSL *ssl, 3723 const char *private_key, 3724 const char *private_key_passwd) 3725 { 3726 #ifndef OPENSSL_NO_STDIO 3727 BIO *bio; 3728 EVP_PKEY *pkey; 3729 int ret; 3730 3731 /* First try ASN.1 (DER). */ 3732 bio = BIO_new_file(private_key, "r"); 3733 if (!bio) 3734 return -1; 3735 pkey = d2i_PrivateKey_bio(bio, NULL); 3736 BIO_free(bio); 3737 3738 if (pkey) { 3739 wpa_printf(MSG_DEBUG, "OpenSSL: %s (DER) --> loaded", __func__); 3740 } else { 3741 /* Try PEM with the provided password. */ 3742 bio = BIO_new_file(private_key, "r"); 3743 if (!bio) 3744 return -1; 3745 pkey = PEM_read_bio_PrivateKey(bio, NULL, tls_passwd_cb, 3746 (void *) private_key_passwd); 3747 BIO_free(bio); 3748 if (!pkey) 3749 return -1; 3750 wpa_printf(MSG_DEBUG, "OpenSSL: %s (PEM) --> loaded", __func__); 3751 /* Clear errors from the previous failed load. */ 3752 ERR_clear_error(); 3753 } 3754 3755 if (ssl) 3756 ret = SSL_use_PrivateKey(ssl, pkey); 3757 else 3758 ret = SSL_CTX_use_PrivateKey(data->ssl, pkey); 3759 3760 EVP_PKEY_free(pkey); 3761 return ret == 1 ? 0 : -1; 3762 #else /* OPENSSL_NO_STDIO */ 3763 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", __func__); 3764 return -1; 3765 #endif /* OPENSSL_NO_STDIO */ 3766 } 3767 3768 3769 static int tls_connection_private_key(struct tls_data *data, 3770 struct tls_connection *conn, 3771 const char *private_key, 3772 const char *private_key_passwd, 3773 const u8 *private_key_blob, 3774 size_t private_key_blob_len) 3775 { 3776 BIO *bio; 3777 int ok; 3778 3779 if (private_key == NULL && private_key_blob == NULL) 3780 return 0; 3781 3782 ok = 0; 3783 while (private_key_blob) { 3784 if (SSL_use_PrivateKey_ASN1(EVP_PKEY_RSA, conn->ssl, 3785 (u8 *) private_key_blob, 3786 private_key_blob_len) == 1) { 3787 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_PrivateKey_" 3788 "ASN1(EVP_PKEY_RSA) --> OK"); 3789 ok = 1; 3790 break; 3791 } 3792 3793 if (SSL_use_PrivateKey_ASN1(EVP_PKEY_DSA, conn->ssl, 3794 (u8 *) private_key_blob, 3795 private_key_blob_len) == 1) { 3796 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_PrivateKey_" 3797 "ASN1(EVP_PKEY_DSA) --> OK"); 3798 ok = 1; 3799 break; 3800 } 3801 3802 #ifndef OPENSSL_NO_EC 3803 if (SSL_use_PrivateKey_ASN1(EVP_PKEY_EC, conn->ssl, 3804 (u8 *) private_key_blob, 3805 private_key_blob_len) == 1) { 3806 wpa_printf(MSG_DEBUG, 3807 "OpenSSL: SSL_use_PrivateKey_ASN1(EVP_PKEY_EC) --> OK"); 3808 ok = 1; 3809 break; 3810 } 3811 #endif /* OPENSSL_NO_EC */ 3812 3813 if (SSL_use_RSAPrivateKey_ASN1(conn->ssl, 3814 (u8 *) private_key_blob, 3815 private_key_blob_len) == 1) { 3816 wpa_printf(MSG_DEBUG, "OpenSSL: " 3817 "SSL_use_RSAPrivateKey_ASN1 --> OK"); 3818 ok = 1; 3819 break; 3820 } 3821 3822 bio = BIO_new_mem_buf((u8 *) private_key_blob, 3823 private_key_blob_len); 3824 if (bio) { 3825 EVP_PKEY *pkey; 3826 3827 pkey = PEM_read_bio_PrivateKey( 3828 bio, NULL, tls_passwd_cb, 3829 (void *) private_key_passwd); 3830 if (pkey) { 3831 if (SSL_use_PrivateKey(conn->ssl, pkey) == 1) { 3832 wpa_printf(MSG_DEBUG, 3833 "OpenSSL: SSL_use_PrivateKey --> OK"); 3834 ok = 1; 3835 EVP_PKEY_free(pkey); 3836 BIO_free(bio); 3837 break; 3838 } 3839 EVP_PKEY_free(pkey); 3840 } 3841 BIO_free(bio); 3842 } 3843 3844 if (tls_read_pkcs12_blob(data, conn->ssl, private_key_blob, 3845 private_key_blob_len, 3846 private_key_passwd) == 0) { 3847 wpa_printf(MSG_DEBUG, "OpenSSL: PKCS#12 as blob --> " 3848 "OK"); 3849 ok = 1; 3850 break; 3851 } 3852 3853 break; 3854 } 3855 3856 while (!ok && private_key) { 3857 if (tls_use_private_key_file(data, conn->ssl, private_key, 3858 private_key_passwd) == 0) { 3859 ok = 1; 3860 break; 3861 } 3862 3863 if (tls_read_pkcs12(data, conn->ssl, private_key, 3864 private_key_passwd) == 0) { 3865 wpa_printf(MSG_DEBUG, "OpenSSL: Reading PKCS#12 file " 3866 "--> OK"); 3867 ok = 1; 3868 break; 3869 } 3870 3871 if (tls_cryptoapi_cert(conn->ssl, private_key) == 0) { 3872 wpa_printf(MSG_DEBUG, "OpenSSL: Using CryptoAPI to " 3873 "access certificate store --> OK"); 3874 ok = 1; 3875 break; 3876 } 3877 3878 break; 3879 } 3880 3881 if (!ok) { 3882 tls_show_errors(MSG_INFO, __func__, 3883 "Failed to load private key"); 3884 return -1; 3885 } 3886 ERR_clear_error(); 3887 3888 if (!SSL_check_private_key(conn->ssl)) { 3889 tls_show_errors(MSG_INFO, __func__, "Private key failed " 3890 "verification"); 3891 return -1; 3892 } 3893 3894 wpa_printf(MSG_DEBUG, "SSL: Private key loaded successfully"); 3895 return 0; 3896 } 3897 3898 3899 static int tls_global_private_key(struct tls_data *data, 3900 const char *private_key, 3901 const char *private_key_passwd) 3902 { 3903 SSL_CTX *ssl_ctx = data->ssl; 3904 3905 if (private_key == NULL) 3906 return 0; 3907 3908 if (tls_use_private_key_file(data, NULL, private_key, 3909 private_key_passwd) && 3910 tls_read_pkcs12(data, NULL, private_key, private_key_passwd)) { 3911 tls_show_errors(MSG_INFO, __func__, 3912 "Failed to load private key"); 3913 ERR_clear_error(); 3914 return -1; 3915 } 3916 ERR_clear_error(); 3917 3918 if (!SSL_CTX_check_private_key(ssl_ctx)) { 3919 tls_show_errors(MSG_INFO, __func__, 3920 "Private key failed verification"); 3921 return -1; 3922 } 3923 3924 return 0; 3925 } 3926 3927 3928 static int tls_connection_dh(struct tls_connection *conn, const char *dh_file) 3929 { 3930 #ifdef OPENSSL_NO_DH 3931 if (dh_file == NULL) 3932 return 0; 3933 wpa_printf(MSG_ERROR, "TLS: openssl does not include DH support, but " 3934 "dh_file specified"); 3935 return -1; 3936 #else /* OPENSSL_NO_DH */ 3937 DH *dh; 3938 BIO *bio; 3939 3940 /* TODO: add support for dh_blob */ 3941 if (dh_file == NULL) 3942 return 0; 3943 if (conn == NULL) 3944 return -1; 3945 3946 bio = BIO_new_file(dh_file, "r"); 3947 if (bio == NULL) { 3948 wpa_printf(MSG_INFO, "TLS: Failed to open DH file '%s': %s", 3949 dh_file, ERR_error_string(ERR_get_error(), NULL)); 3950 return -1; 3951 } 3952 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); 3953 BIO_free(bio); 3954 #ifndef OPENSSL_NO_DSA 3955 while (dh == NULL) { 3956 DSA *dsa; 3957 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DH file '%s': %s -" 3958 " trying to parse as DSA params", dh_file, 3959 ERR_error_string(ERR_get_error(), NULL)); 3960 bio = BIO_new_file(dh_file, "r"); 3961 if (bio == NULL) 3962 break; 3963 dsa = PEM_read_bio_DSAparams(bio, NULL, NULL, NULL); 3964 BIO_free(bio); 3965 if (!dsa) { 3966 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DSA file " 3967 "'%s': %s", dh_file, 3968 ERR_error_string(ERR_get_error(), NULL)); 3969 break; 3970 } 3971 3972 wpa_printf(MSG_DEBUG, "TLS: DH file in DSA param format"); 3973 dh = DSA_dup_DH(dsa); 3974 DSA_free(dsa); 3975 if (dh == NULL) { 3976 wpa_printf(MSG_INFO, "TLS: Failed to convert DSA " 3977 "params into DH params"); 3978 break; 3979 } 3980 break; 3981 } 3982 #endif /* !OPENSSL_NO_DSA */ 3983 if (dh == NULL) { 3984 wpa_printf(MSG_INFO, "TLS: Failed to read/parse DH/DSA file " 3985 "'%s'", dh_file); 3986 return -1; 3987 } 3988 3989 if (SSL_set_tmp_dh(conn->ssl, dh) != 1) { 3990 wpa_printf(MSG_INFO, "TLS: Failed to set DH params from '%s': " 3991 "%s", dh_file, 3992 ERR_error_string(ERR_get_error(), NULL)); 3993 DH_free(dh); 3994 return -1; 3995 } 3996 DH_free(dh); 3997 return 0; 3998 #endif /* OPENSSL_NO_DH */ 3999 } 4000 4001 4002 static int tls_global_dh(struct tls_data *data, const char *dh_file) 4003 { 4004 #ifdef OPENSSL_NO_DH 4005 if (dh_file == NULL) 4006 return 0; 4007 wpa_printf(MSG_ERROR, "TLS: openssl does not include DH support, but " 4008 "dh_file specified"); 4009 return -1; 4010 #else /* OPENSSL_NO_DH */ 4011 SSL_CTX *ssl_ctx = data->ssl; 4012 DH *dh; 4013 BIO *bio; 4014 4015 /* TODO: add support for dh_blob */ 4016 if (dh_file == NULL) 4017 return 0; 4018 if (ssl_ctx == NULL) 4019 return -1; 4020 4021 bio = BIO_new_file(dh_file, "r"); 4022 if (bio == NULL) { 4023 wpa_printf(MSG_INFO, "TLS: Failed to open DH file '%s': %s", 4024 dh_file, ERR_error_string(ERR_get_error(), NULL)); 4025 return -1; 4026 } 4027 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); 4028 BIO_free(bio); 4029 #ifndef OPENSSL_NO_DSA 4030 while (dh == NULL) { 4031 DSA *dsa; 4032 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DH file '%s': %s -" 4033 " trying to parse as DSA params", dh_file, 4034 ERR_error_string(ERR_get_error(), NULL)); 4035 bio = BIO_new_file(dh_file, "r"); 4036 if (bio == NULL) 4037 break; 4038 dsa = PEM_read_bio_DSAparams(bio, NULL, NULL, NULL); 4039 BIO_free(bio); 4040 if (!dsa) { 4041 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DSA file " 4042 "'%s': %s", dh_file, 4043 ERR_error_string(ERR_get_error(), NULL)); 4044 break; 4045 } 4046 4047 wpa_printf(MSG_DEBUG, "TLS: DH file in DSA param format"); 4048 dh = DSA_dup_DH(dsa); 4049 DSA_free(dsa); 4050 if (dh == NULL) { 4051 wpa_printf(MSG_INFO, "TLS: Failed to convert DSA " 4052 "params into DH params"); 4053 break; 4054 } 4055 break; 4056 } 4057 #endif /* !OPENSSL_NO_DSA */ 4058 if (dh == NULL) { 4059 wpa_printf(MSG_INFO, "TLS: Failed to read/parse DH/DSA file " 4060 "'%s'", dh_file); 4061 return -1; 4062 } 4063 4064 if (SSL_CTX_set_tmp_dh(ssl_ctx, dh) != 1) { 4065 wpa_printf(MSG_INFO, "TLS: Failed to set DH params from '%s': " 4066 "%s", dh_file, 4067 ERR_error_string(ERR_get_error(), NULL)); 4068 DH_free(dh); 4069 return -1; 4070 } 4071 DH_free(dh); 4072 return 0; 4073 #endif /* OPENSSL_NO_DH */ 4074 } 4075 4076 4077 int tls_connection_get_random(void *ssl_ctx, struct tls_connection *conn, 4078 struct tls_random *keys) 4079 { 4080 SSL *ssl; 4081 4082 if (conn == NULL || keys == NULL) 4083 return -1; 4084 ssl = conn->ssl; 4085 if (ssl == NULL) 4086 return -1; 4087 4088 os_memset(keys, 0, sizeof(*keys)); 4089 keys->client_random = conn->client_random; 4090 keys->client_random_len = SSL_get_client_random( 4091 ssl, conn->client_random, sizeof(conn->client_random)); 4092 keys->server_random = conn->server_random; 4093 keys->server_random_len = SSL_get_server_random( 4094 ssl, conn->server_random, sizeof(conn->server_random)); 4095 4096 return 0; 4097 } 4098 4099 4100 #ifdef OPENSSL_NEED_EAP_FAST_PRF 4101 static int openssl_get_keyblock_size(SSL *ssl) 4102 { 4103 #if OPENSSL_VERSION_NUMBER < 0x10100000L || \ 4104 (defined(LIBRESSL_VERSION_NUMBER) && \ 4105 LIBRESSL_VERSION_NUMBER < 0x20700000L) 4106 const EVP_CIPHER *c; 4107 const EVP_MD *h; 4108 int md_size; 4109 4110 if (ssl->enc_read_ctx == NULL || ssl->enc_read_ctx->cipher == NULL || 4111 ssl->read_hash == NULL) 4112 return -1; 4113 4114 c = ssl->enc_read_ctx->cipher; 4115 h = EVP_MD_CTX_md(ssl->read_hash); 4116 if (h) 4117 md_size = EVP_MD_size(h); 4118 else if (ssl->s3) 4119 md_size = ssl->s3->tmp.new_mac_secret_size; 4120 else 4121 return -1; 4122 4123 wpa_printf(MSG_DEBUG, "OpenSSL: keyblock size: key_len=%d MD_size=%d " 4124 "IV_len=%d", EVP_CIPHER_key_length(c), md_size, 4125 EVP_CIPHER_iv_length(c)); 4126 return 2 * (EVP_CIPHER_key_length(c) + 4127 md_size + 4128 EVP_CIPHER_iv_length(c)); 4129 #else 4130 const SSL_CIPHER *ssl_cipher; 4131 int cipher, digest; 4132 const EVP_CIPHER *c; 4133 const EVP_MD *h; 4134 int mac_key_len, enc_key_len, fixed_iv_len; 4135 4136 ssl_cipher = SSL_get_current_cipher(ssl); 4137 if (!ssl_cipher) 4138 return -1; 4139 cipher = SSL_CIPHER_get_cipher_nid(ssl_cipher); 4140 digest = SSL_CIPHER_get_digest_nid(ssl_cipher); 4141 wpa_printf(MSG_DEBUG, "OpenSSL: cipher nid %d digest nid %d", 4142 cipher, digest); 4143 if (cipher < 0 || digest < 0) 4144 return -1; 4145 if (cipher == NID_undef) { 4146 wpa_printf(MSG_DEBUG, "OpenSSL: no cipher in use?!"); 4147 return -1; 4148 } 4149 c = EVP_get_cipherbynid(cipher); 4150 if (!c) 4151 return -1; 4152 enc_key_len = EVP_CIPHER_key_length(c); 4153 if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE || 4154 EVP_CIPHER_mode(c) == EVP_CIPH_CCM_MODE) 4155 fixed_iv_len = 4; /* only part of IV from PRF */ 4156 else 4157 fixed_iv_len = EVP_CIPHER_iv_length(c); 4158 if (digest == NID_undef) { 4159 wpa_printf(MSG_DEBUG, "OpenSSL: no digest in use (e.g., AEAD)"); 4160 mac_key_len = 0; 4161 } else { 4162 h = EVP_get_digestbynid(digest); 4163 if (!h) 4164 return -1; 4165 mac_key_len = EVP_MD_size(h); 4166 } 4167 4168 wpa_printf(MSG_DEBUG, 4169 "OpenSSL: keyblock size: mac_key_len=%d enc_key_len=%d fixed_iv_len=%d", 4170 mac_key_len, enc_key_len, fixed_iv_len); 4171 return 2 * (mac_key_len + enc_key_len + fixed_iv_len); 4172 #endif 4173 } 4174 #endif /* OPENSSL_NEED_EAP_FAST_PRF */ 4175 4176 4177 int tls_connection_export_key(void *tls_ctx, struct tls_connection *conn, 4178 const char *label, const u8 *context, 4179 size_t context_len, u8 *out, size_t out_len) 4180 { 4181 if (!conn || 4182 SSL_export_keying_material(conn->ssl, out, out_len, label, 4183 os_strlen(label), context, context_len, 4184 context != NULL) != 1) 4185 return -1; 4186 return 0; 4187 } 4188 4189 4190 int tls_connection_get_eap_fast_key(void *tls_ctx, struct tls_connection *conn, 4191 u8 *out, size_t out_len) 4192 { 4193 #ifdef OPENSSL_NEED_EAP_FAST_PRF 4194 SSL *ssl; 4195 SSL_SESSION *sess; 4196 u8 *rnd; 4197 int ret = -1; 4198 int skip = 0; 4199 u8 *tmp_out = NULL; 4200 u8 *_out = out; 4201 unsigned char client_random[SSL3_RANDOM_SIZE]; 4202 unsigned char server_random[SSL3_RANDOM_SIZE]; 4203 unsigned char master_key[64]; 4204 size_t master_key_len; 4205 const char *ver; 4206 4207 /* 4208 * TLS library did not support EAP-FAST key generation, so get the 4209 * needed TLS session parameters and use an internal implementation of 4210 * TLS PRF to derive the key. 4211 */ 4212 4213 if (conn == NULL) 4214 return -1; 4215 ssl = conn->ssl; 4216 if (ssl == NULL) 4217 return -1; 4218 ver = SSL_get_version(ssl); 4219 sess = SSL_get_session(ssl); 4220 if (!ver || !sess) 4221 return -1; 4222 4223 skip = openssl_get_keyblock_size(ssl); 4224 if (skip < 0) 4225 return -1; 4226 tmp_out = os_malloc(skip + out_len); 4227 if (!tmp_out) 4228 return -1; 4229 _out = tmp_out; 4230 4231 rnd = os_malloc(2 * SSL3_RANDOM_SIZE); 4232 if (!rnd) { 4233 os_free(tmp_out); 4234 return -1; 4235 } 4236 4237 SSL_get_client_random(ssl, client_random, sizeof(client_random)); 4238 SSL_get_server_random(ssl, server_random, sizeof(server_random)); 4239 master_key_len = SSL_SESSION_get_master_key(sess, master_key, 4240 sizeof(master_key)); 4241 4242 os_memcpy(rnd, server_random, SSL3_RANDOM_SIZE); 4243 os_memcpy(rnd + SSL3_RANDOM_SIZE, client_random, SSL3_RANDOM_SIZE); 4244 4245 if (os_strcmp(ver, "TLSv1.2") == 0) { 4246 tls_prf_sha256(master_key, master_key_len, 4247 "key expansion", rnd, 2 * SSL3_RANDOM_SIZE, 4248 _out, skip + out_len); 4249 ret = 0; 4250 } else if (tls_prf_sha1_md5(master_key, master_key_len, 4251 "key expansion", rnd, 2 * SSL3_RANDOM_SIZE, 4252 _out, skip + out_len) == 0) { 4253 ret = 0; 4254 } 4255 forced_memzero(master_key, sizeof(master_key)); 4256 os_free(rnd); 4257 if (ret == 0) 4258 os_memcpy(out, _out + skip, out_len); 4259 bin_clear_free(tmp_out, skip); 4260 4261 return ret; 4262 #else /* OPENSSL_NEED_EAP_FAST_PRF */ 4263 wpa_printf(MSG_ERROR, 4264 "OpenSSL: EAP-FAST keys cannot be exported in FIPS mode"); 4265 return -1; 4266 #endif /* OPENSSL_NEED_EAP_FAST_PRF */ 4267 } 4268 4269 4270 static struct wpabuf * 4271 openssl_handshake(struct tls_connection *conn, const struct wpabuf *in_data) 4272 { 4273 int res; 4274 struct wpabuf *out_data; 4275 4276 /* 4277 * Give TLS handshake data from the server (if available) to OpenSSL 4278 * for processing. 4279 */ 4280 if (in_data && wpabuf_len(in_data) > 0 && 4281 BIO_write(conn->ssl_in, wpabuf_head(in_data), wpabuf_len(in_data)) 4282 < 0) { 4283 tls_show_errors(MSG_INFO, __func__, 4284 "Handshake failed - BIO_write"); 4285 return NULL; 4286 } 4287 4288 /* Initiate TLS handshake or continue the existing handshake */ 4289 if (conn->server) 4290 res = SSL_accept(conn->ssl); 4291 else 4292 res = SSL_connect(conn->ssl); 4293 if (res != 1) { 4294 int err = SSL_get_error(conn->ssl, res); 4295 if (err == SSL_ERROR_WANT_READ) 4296 wpa_printf(MSG_DEBUG, "SSL: SSL_connect - want " 4297 "more data"); 4298 else if (err == SSL_ERROR_WANT_WRITE) 4299 wpa_printf(MSG_DEBUG, "SSL: SSL_connect - want to " 4300 "write"); 4301 else { 4302 tls_show_errors(MSG_INFO, __func__, "SSL_connect"); 4303 conn->failed++; 4304 if (!conn->server && !conn->client_hello_generated) { 4305 /* The server would not understand TLS Alert 4306 * before ClientHello, so simply terminate 4307 * handshake on this type of error case caused 4308 * by a likely internal error like no ciphers 4309 * available. */ 4310 wpa_printf(MSG_DEBUG, 4311 "OpenSSL: Could not generate ClientHello"); 4312 conn->write_alerts++; 4313 return NULL; 4314 } 4315 } 4316 } 4317 4318 if (!conn->server && !conn->failed) 4319 conn->client_hello_generated = 1; 4320 4321 #ifdef CONFIG_SUITEB 4322 if ((conn->flags & TLS_CONN_SUITEB) && !conn->server && 4323 os_strncmp(SSL_get_cipher(conn->ssl), "DHE-", 4) == 0 && 4324 conn->server_dh_prime_len < 3072) { 4325 struct tls_context *context = conn->context; 4326 4327 /* 4328 * This should not be reached since earlier cert_cb should have 4329 * terminated the handshake. Keep this check here for extra 4330 * protection if anything goes wrong with the more low-level 4331 * checks based on having to parse the TLS handshake messages. 4332 */ 4333 wpa_printf(MSG_DEBUG, 4334 "OpenSSL: Server DH prime length: %d bits", 4335 conn->server_dh_prime_len); 4336 4337 if (context->event_cb) { 4338 union tls_event_data ev; 4339 4340 os_memset(&ev, 0, sizeof(ev)); 4341 ev.alert.is_local = 1; 4342 ev.alert.type = "fatal"; 4343 ev.alert.description = "insufficient security"; 4344 context->event_cb(context->cb_ctx, TLS_ALERT, &ev); 4345 } 4346 /* 4347 * Could send a TLS Alert to the server, but for now, simply 4348 * terminate handshake. 4349 */ 4350 conn->failed++; 4351 conn->write_alerts++; 4352 return NULL; 4353 } 4354 #endif /* CONFIG_SUITEB */ 4355 4356 /* Get the TLS handshake data to be sent to the server */ 4357 res = BIO_ctrl_pending(conn->ssl_out); 4358 wpa_printf(MSG_DEBUG, "SSL: %d bytes pending from ssl_out", res); 4359 out_data = wpabuf_alloc(res); 4360 if (out_data == NULL) { 4361 wpa_printf(MSG_DEBUG, "SSL: Failed to allocate memory for " 4362 "handshake output (%d bytes)", res); 4363 if (BIO_reset(conn->ssl_out) < 0) { 4364 tls_show_errors(MSG_INFO, __func__, 4365 "BIO_reset failed"); 4366 } 4367 return NULL; 4368 } 4369 res = res == 0 ? 0 : BIO_read(conn->ssl_out, wpabuf_mhead(out_data), 4370 res); 4371 if (res < 0) { 4372 tls_show_errors(MSG_INFO, __func__, 4373 "Handshake failed - BIO_read"); 4374 if (BIO_reset(conn->ssl_out) < 0) { 4375 tls_show_errors(MSG_INFO, __func__, 4376 "BIO_reset failed"); 4377 } 4378 wpabuf_free(out_data); 4379 return NULL; 4380 } 4381 wpabuf_put(out_data, res); 4382 4383 return out_data; 4384 } 4385 4386 4387 static struct wpabuf * 4388 openssl_get_appl_data(struct tls_connection *conn, size_t max_len) 4389 { 4390 struct wpabuf *appl_data; 4391 int res; 4392 4393 appl_data = wpabuf_alloc(max_len + 100); 4394 if (appl_data == NULL) 4395 return NULL; 4396 4397 res = SSL_read(conn->ssl, wpabuf_mhead(appl_data), 4398 wpabuf_size(appl_data)); 4399 if (res < 0) { 4400 int err = SSL_get_error(conn->ssl, res); 4401 if (err == SSL_ERROR_WANT_READ || 4402 err == SSL_ERROR_WANT_WRITE) { 4403 wpa_printf(MSG_DEBUG, "SSL: No Application Data " 4404 "included"); 4405 } else { 4406 tls_show_errors(MSG_INFO, __func__, 4407 "Failed to read possible " 4408 "Application Data"); 4409 } 4410 wpabuf_free(appl_data); 4411 return NULL; 4412 } 4413 4414 wpabuf_put(appl_data, res); 4415 wpa_hexdump_buf_key(MSG_MSGDUMP, "SSL: Application Data in Finished " 4416 "message", appl_data); 4417 4418 return appl_data; 4419 } 4420 4421 4422 static struct wpabuf * 4423 openssl_connection_handshake(struct tls_connection *conn, 4424 const struct wpabuf *in_data, 4425 struct wpabuf **appl_data) 4426 { 4427 struct wpabuf *out_data; 4428 4429 if (appl_data) 4430 *appl_data = NULL; 4431 4432 out_data = openssl_handshake(conn, in_data); 4433 if (out_data == NULL) 4434 return NULL; 4435 if (conn->invalid_hb_used) { 4436 wpa_printf(MSG_INFO, "TLS: Heartbeat attack detected - do not send response"); 4437 wpabuf_free(out_data); 4438 return NULL; 4439 } 4440 4441 if (SSL_is_init_finished(conn->ssl)) { 4442 wpa_printf(MSG_DEBUG, 4443 "OpenSSL: Handshake finished - resumed=%d", 4444 tls_connection_resumed(conn->ssl_ctx, conn)); 4445 if (conn->server) { 4446 char *buf; 4447 size_t buflen = 2000; 4448 4449 buf = os_malloc(buflen); 4450 if (buf) { 4451 if (SSL_get_shared_ciphers(conn->ssl, buf, 4452 buflen)) { 4453 buf[buflen - 1] = '\0'; 4454 wpa_printf(MSG_DEBUG, 4455 "OpenSSL: Shared ciphers: %s", 4456 buf); 4457 } 4458 os_free(buf); 4459 } 4460 } 4461 if (appl_data && in_data) 4462 *appl_data = openssl_get_appl_data(conn, 4463 wpabuf_len(in_data)); 4464 } 4465 4466 if (conn->invalid_hb_used) { 4467 wpa_printf(MSG_INFO, "TLS: Heartbeat attack detected - do not send response"); 4468 if (appl_data) { 4469 wpabuf_free(*appl_data); 4470 *appl_data = NULL; 4471 } 4472 wpabuf_free(out_data); 4473 return NULL; 4474 } 4475 4476 return out_data; 4477 } 4478 4479 4480 struct wpabuf * 4481 tls_connection_handshake(void *ssl_ctx, struct tls_connection *conn, 4482 const struct wpabuf *in_data, 4483 struct wpabuf **appl_data) 4484 { 4485 return openssl_connection_handshake(conn, in_data, appl_data); 4486 } 4487 4488 4489 struct wpabuf * tls_connection_server_handshake(void *tls_ctx, 4490 struct tls_connection *conn, 4491 const struct wpabuf *in_data, 4492 struct wpabuf **appl_data) 4493 { 4494 conn->server = 1; 4495 return openssl_connection_handshake(conn, in_data, appl_data); 4496 } 4497 4498 4499 struct wpabuf * tls_connection_encrypt(void *tls_ctx, 4500 struct tls_connection *conn, 4501 const struct wpabuf *in_data) 4502 { 4503 int res; 4504 struct wpabuf *buf; 4505 4506 if (conn == NULL) 4507 return NULL; 4508 4509 /* Give plaintext data for OpenSSL to encrypt into the TLS tunnel. */ 4510 if ((res = BIO_reset(conn->ssl_in)) < 0 || 4511 (res = BIO_reset(conn->ssl_out)) < 0) { 4512 tls_show_errors(MSG_INFO, __func__, "BIO_reset failed"); 4513 return NULL; 4514 } 4515 res = SSL_write(conn->ssl, wpabuf_head(in_data), wpabuf_len(in_data)); 4516 if (res < 0) { 4517 tls_show_errors(MSG_INFO, __func__, 4518 "Encryption failed - SSL_write"); 4519 return NULL; 4520 } 4521 4522 /* Read encrypted data to be sent to the server */ 4523 buf = wpabuf_alloc(wpabuf_len(in_data) + 300); 4524 if (buf == NULL) 4525 return NULL; 4526 res = BIO_read(conn->ssl_out, wpabuf_mhead(buf), wpabuf_size(buf)); 4527 if (res < 0) { 4528 tls_show_errors(MSG_INFO, __func__, 4529 "Encryption failed - BIO_read"); 4530 wpabuf_free(buf); 4531 return NULL; 4532 } 4533 wpabuf_put(buf, res); 4534 4535 return buf; 4536 } 4537 4538 4539 struct wpabuf * tls_connection_decrypt(void *tls_ctx, 4540 struct tls_connection *conn, 4541 const struct wpabuf *in_data) 4542 { 4543 int res; 4544 struct wpabuf *buf; 4545 4546 /* Give encrypted data from TLS tunnel for OpenSSL to decrypt. */ 4547 res = BIO_write(conn->ssl_in, wpabuf_head(in_data), 4548 wpabuf_len(in_data)); 4549 if (res < 0) { 4550 tls_show_errors(MSG_INFO, __func__, 4551 "Decryption failed - BIO_write"); 4552 return NULL; 4553 } 4554 if (BIO_reset(conn->ssl_out) < 0) { 4555 tls_show_errors(MSG_INFO, __func__, "BIO_reset failed"); 4556 return NULL; 4557 } 4558 4559 /* Read decrypted data for further processing */ 4560 /* 4561 * Even though we try to disable TLS compression, it is possible that 4562 * this cannot be done with all TLS libraries. Add extra buffer space 4563 * to handle the possibility of the decrypted data being longer than 4564 * input data. 4565 */ 4566 buf = wpabuf_alloc((wpabuf_len(in_data) + 500) * 3); 4567 if (buf == NULL) 4568 return NULL; 4569 res = SSL_read(conn->ssl, wpabuf_mhead(buf), wpabuf_size(buf)); 4570 if (res < 0) { 4571 int err = SSL_get_error(conn->ssl, res); 4572 4573 if (err == SSL_ERROR_WANT_READ) { 4574 wpa_printf(MSG_DEBUG, 4575 "SSL: SSL_connect - want more data"); 4576 res = 0; 4577 } else { 4578 tls_show_errors(MSG_INFO, __func__, 4579 "Decryption failed - SSL_read"); 4580 wpabuf_free(buf); 4581 return NULL; 4582 } 4583 } 4584 wpabuf_put(buf, res); 4585 4586 if (conn->invalid_hb_used) { 4587 wpa_printf(MSG_INFO, "TLS: Heartbeat attack detected - do not send response"); 4588 wpabuf_free(buf); 4589 return NULL; 4590 } 4591 4592 return buf; 4593 } 4594 4595 4596 int tls_connection_resumed(void *ssl_ctx, struct tls_connection *conn) 4597 { 4598 return conn ? SSL_session_reused(conn->ssl) : 0; 4599 } 4600 4601 4602 int tls_connection_set_cipher_list(void *tls_ctx, struct tls_connection *conn, 4603 u8 *ciphers) 4604 { 4605 char buf[500], *pos, *end; 4606 u8 *c; 4607 int ret; 4608 4609 if (conn == NULL || conn->ssl == NULL || ciphers == NULL) 4610 return -1; 4611 4612 buf[0] = '\0'; 4613 pos = buf; 4614 end = pos + sizeof(buf); 4615 4616 c = ciphers; 4617 while (*c != TLS_CIPHER_NONE) { 4618 const char *suite; 4619 4620 switch (*c) { 4621 case TLS_CIPHER_RC4_SHA: 4622 suite = "RC4-SHA"; 4623 break; 4624 case TLS_CIPHER_AES128_SHA: 4625 suite = "AES128-SHA"; 4626 break; 4627 case TLS_CIPHER_RSA_DHE_AES128_SHA: 4628 suite = "DHE-RSA-AES128-SHA"; 4629 break; 4630 case TLS_CIPHER_ANON_DH_AES128_SHA: 4631 suite = "ADH-AES128-SHA"; 4632 break; 4633 case TLS_CIPHER_RSA_DHE_AES256_SHA: 4634 suite = "DHE-RSA-AES256-SHA"; 4635 break; 4636 case TLS_CIPHER_AES256_SHA: 4637 suite = "AES256-SHA"; 4638 break; 4639 default: 4640 wpa_printf(MSG_DEBUG, "TLS: Unsupported " 4641 "cipher selection: %d", *c); 4642 return -1; 4643 } 4644 ret = os_snprintf(pos, end - pos, ":%s", suite); 4645 if (os_snprintf_error(end - pos, ret)) 4646 break; 4647 pos += ret; 4648 4649 c++; 4650 } 4651 if (!buf[0]) { 4652 wpa_printf(MSG_DEBUG, "OpenSSL: No ciphers listed"); 4653 return -1; 4654 } 4655 4656 wpa_printf(MSG_DEBUG, "OpenSSL: cipher suites: %s", buf + 1); 4657 4658 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER) 4659 #ifdef EAP_FAST_OR_TEAP 4660 if (os_strstr(buf, ":ADH-")) { 4661 /* 4662 * Need to drop to security level 0 to allow anonymous 4663 * cipher suites for EAP-FAST. 4664 */ 4665 SSL_set_security_level(conn->ssl, 0); 4666 } else if (SSL_get_security_level(conn->ssl) == 0) { 4667 /* Force at least security level 1 */ 4668 SSL_set_security_level(conn->ssl, 1); 4669 } 4670 #endif /* EAP_FAST_OR_TEAP */ 4671 #endif 4672 4673 if (SSL_set_cipher_list(conn->ssl, buf + 1) != 1) { 4674 tls_show_errors(MSG_INFO, __func__, 4675 "Cipher suite configuration failed"); 4676 return -1; 4677 } 4678 4679 return 0; 4680 } 4681 4682 4683 int tls_get_version(void *ssl_ctx, struct tls_connection *conn, 4684 char *buf, size_t buflen) 4685 { 4686 const char *name; 4687 if (conn == NULL || conn->ssl == NULL) 4688 return -1; 4689 4690 name = SSL_get_version(conn->ssl); 4691 if (name == NULL) 4692 return -1; 4693 4694 os_strlcpy(buf, name, buflen); 4695 return 0; 4696 } 4697 4698 4699 int tls_get_cipher(void *ssl_ctx, struct tls_connection *conn, 4700 char *buf, size_t buflen) 4701 { 4702 const char *name; 4703 if (conn == NULL || conn->ssl == NULL) 4704 return -1; 4705 4706 name = SSL_get_cipher(conn->ssl); 4707 if (name == NULL) 4708 return -1; 4709 4710 os_strlcpy(buf, name, buflen); 4711 return 0; 4712 } 4713 4714 4715 int tls_connection_enable_workaround(void *ssl_ctx, 4716 struct tls_connection *conn) 4717 { 4718 SSL_set_options(conn->ssl, SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS); 4719 4720 return 0; 4721 } 4722 4723 4724 #ifdef EAP_FAST_OR_TEAP 4725 /* ClientHello TLS extensions require a patch to openssl, so this function is 4726 * commented out unless explicitly needed for EAP-FAST in order to be able to 4727 * build this file with unmodified openssl. */ 4728 int tls_connection_client_hello_ext(void *ssl_ctx, struct tls_connection *conn, 4729 int ext_type, const u8 *data, 4730 size_t data_len) 4731 { 4732 if (conn == NULL || conn->ssl == NULL || ext_type != 35) 4733 return -1; 4734 4735 if (SSL_set_session_ticket_ext(conn->ssl, (void *) data, 4736 data_len) != 1) 4737 return -1; 4738 4739 return 0; 4740 } 4741 #endif /* EAP_FAST_OR_TEAP */ 4742 4743 4744 int tls_connection_get_failed(void *ssl_ctx, struct tls_connection *conn) 4745 { 4746 if (conn == NULL) 4747 return -1; 4748 return conn->failed; 4749 } 4750 4751 4752 int tls_connection_get_read_alerts(void *ssl_ctx, struct tls_connection *conn) 4753 { 4754 if (conn == NULL) 4755 return -1; 4756 return conn->read_alerts; 4757 } 4758 4759 4760 int tls_connection_get_write_alerts(void *ssl_ctx, struct tls_connection *conn) 4761 { 4762 if (conn == NULL) 4763 return -1; 4764 return conn->write_alerts; 4765 } 4766 4767 4768 #ifdef HAVE_OCSP 4769 4770 static void ocsp_debug_print_resp(OCSP_RESPONSE *rsp) 4771 { 4772 #ifndef CONFIG_NO_STDOUT_DEBUG 4773 BIO *out; 4774 size_t rlen; 4775 char *txt; 4776 int res; 4777 4778 if (wpa_debug_level > MSG_DEBUG) 4779 return; 4780 4781 out = BIO_new(BIO_s_mem()); 4782 if (!out) 4783 return; 4784 4785 OCSP_RESPONSE_print(out, rsp, 0); 4786 rlen = BIO_ctrl_pending(out); 4787 txt = os_malloc(rlen + 1); 4788 if (!txt) { 4789 BIO_free(out); 4790 return; 4791 } 4792 4793 res = BIO_read(out, txt, rlen); 4794 if (res > 0) { 4795 txt[res] = '\0'; 4796 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP Response\n%s", txt); 4797 } 4798 os_free(txt); 4799 BIO_free(out); 4800 #endif /* CONFIG_NO_STDOUT_DEBUG */ 4801 } 4802 4803 4804 static int ocsp_resp_cb(SSL *s, void *arg) 4805 { 4806 struct tls_connection *conn = arg; 4807 const unsigned char *p; 4808 int len, status, reason, res; 4809 OCSP_RESPONSE *rsp; 4810 OCSP_BASICRESP *basic; 4811 OCSP_CERTID *id; 4812 ASN1_GENERALIZEDTIME *produced_at, *this_update, *next_update; 4813 X509_STORE *store; 4814 STACK_OF(X509) *certs = NULL; 4815 4816 len = SSL_get_tlsext_status_ocsp_resp(s, &p); 4817 if (!p) { 4818 wpa_printf(MSG_DEBUG, "OpenSSL: No OCSP response received"); 4819 return (conn->flags & TLS_CONN_REQUIRE_OCSP) ? 0 : 1; 4820 } 4821 4822 wpa_hexdump(MSG_DEBUG, "OpenSSL: OCSP response", p, len); 4823 4824 rsp = d2i_OCSP_RESPONSE(NULL, &p, len); 4825 if (!rsp) { 4826 wpa_printf(MSG_INFO, "OpenSSL: Failed to parse OCSP response"); 4827 return 0; 4828 } 4829 4830 ocsp_debug_print_resp(rsp); 4831 4832 status = OCSP_response_status(rsp); 4833 if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL) { 4834 wpa_printf(MSG_INFO, "OpenSSL: OCSP responder error %d (%s)", 4835 status, OCSP_response_status_str(status)); 4836 return 0; 4837 } 4838 4839 basic = OCSP_response_get1_basic(rsp); 4840 if (!basic) { 4841 wpa_printf(MSG_INFO, "OpenSSL: Could not find BasicOCSPResponse"); 4842 return 0; 4843 } 4844 4845 store = SSL_CTX_get_cert_store(conn->ssl_ctx); 4846 if (conn->peer_issuer) { 4847 debug_print_cert(conn->peer_issuer, "Add OCSP issuer"); 4848 4849 if (X509_STORE_add_cert(store, conn->peer_issuer) != 1) { 4850 tls_show_errors(MSG_INFO, __func__, 4851 "OpenSSL: Could not add issuer to certificate store"); 4852 } 4853 certs = sk_X509_new_null(); 4854 if (certs) { 4855 X509 *cert; 4856 cert = X509_dup(conn->peer_issuer); 4857 if (cert && !sk_X509_push(certs, cert)) { 4858 tls_show_errors( 4859 MSG_INFO, __func__, 4860 "OpenSSL: Could not add issuer to OCSP responder trust store"); 4861 X509_free(cert); 4862 sk_X509_free(certs); 4863 certs = NULL; 4864 } 4865 if (certs && conn->peer_issuer_issuer) { 4866 cert = X509_dup(conn->peer_issuer_issuer); 4867 if (cert && !sk_X509_push(certs, cert)) { 4868 tls_show_errors( 4869 MSG_INFO, __func__, 4870 "OpenSSL: Could not add issuer's issuer to OCSP responder trust store"); 4871 X509_free(cert); 4872 } 4873 } 4874 } 4875 } 4876 4877 status = OCSP_basic_verify(basic, certs, store, OCSP_TRUSTOTHER); 4878 sk_X509_pop_free(certs, X509_free); 4879 if (status <= 0) { 4880 tls_show_errors(MSG_INFO, __func__, 4881 "OpenSSL: OCSP response failed verification"); 4882 OCSP_BASICRESP_free(basic); 4883 OCSP_RESPONSE_free(rsp); 4884 return 0; 4885 } 4886 4887 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP response verification succeeded"); 4888 4889 if (!conn->peer_cert) { 4890 wpa_printf(MSG_DEBUG, "OpenSSL: Peer certificate not available for OCSP status check"); 4891 OCSP_BASICRESP_free(basic); 4892 OCSP_RESPONSE_free(rsp); 4893 return 0; 4894 } 4895 4896 if (!conn->peer_issuer) { 4897 wpa_printf(MSG_DEBUG, "OpenSSL: Peer issuer certificate not available for OCSP status check"); 4898 OCSP_BASICRESP_free(basic); 4899 OCSP_RESPONSE_free(rsp); 4900 return 0; 4901 } 4902 4903 id = OCSP_cert_to_id(EVP_sha256(), conn->peer_cert, conn->peer_issuer); 4904 if (!id) { 4905 wpa_printf(MSG_DEBUG, 4906 "OpenSSL: Could not create OCSP certificate identifier (SHA256)"); 4907 OCSP_BASICRESP_free(basic); 4908 OCSP_RESPONSE_free(rsp); 4909 return 0; 4910 } 4911 4912 res = OCSP_resp_find_status(basic, id, &status, &reason, &produced_at, 4913 &this_update, &next_update); 4914 if (!res) { 4915 OCSP_CERTID_free(id); 4916 id = OCSP_cert_to_id(NULL, conn->peer_cert, conn->peer_issuer); 4917 if (!id) { 4918 wpa_printf(MSG_DEBUG, 4919 "OpenSSL: Could not create OCSP certificate identifier (SHA1)"); 4920 OCSP_BASICRESP_free(basic); 4921 OCSP_RESPONSE_free(rsp); 4922 return 0; 4923 } 4924 4925 res = OCSP_resp_find_status(basic, id, &status, &reason, 4926 &produced_at, &this_update, 4927 &next_update); 4928 } 4929 4930 if (!res) { 4931 wpa_printf(MSG_INFO, "OpenSSL: Could not find current server certificate from OCSP response%s", 4932 (conn->flags & TLS_CONN_REQUIRE_OCSP) ? "" : 4933 " (OCSP not required)"); 4934 OCSP_CERTID_free(id); 4935 OCSP_BASICRESP_free(basic); 4936 OCSP_RESPONSE_free(rsp); 4937 return (conn->flags & TLS_CONN_REQUIRE_OCSP) ? 0 : 1; 4938 } 4939 OCSP_CERTID_free(id); 4940 4941 if (!OCSP_check_validity(this_update, next_update, 5 * 60, -1)) { 4942 tls_show_errors(MSG_INFO, __func__, 4943 "OpenSSL: OCSP status times invalid"); 4944 OCSP_BASICRESP_free(basic); 4945 OCSP_RESPONSE_free(rsp); 4946 return 0; 4947 } 4948 4949 OCSP_BASICRESP_free(basic); 4950 OCSP_RESPONSE_free(rsp); 4951 4952 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status for server certificate: %s", 4953 OCSP_cert_status_str(status)); 4954 4955 if (status == V_OCSP_CERTSTATUS_GOOD) 4956 return 1; 4957 if (status == V_OCSP_CERTSTATUS_REVOKED) 4958 return 0; 4959 if (conn->flags & TLS_CONN_REQUIRE_OCSP) { 4960 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status unknown, but OCSP required"); 4961 return 0; 4962 } 4963 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status unknown, but OCSP was not required, so allow connection to continue"); 4964 return 1; 4965 } 4966 4967 4968 static int ocsp_status_cb(SSL *s, void *arg) 4969 { 4970 char *tmp; 4971 char *resp; 4972 size_t len; 4973 4974 if (tls_global->ocsp_stapling_response == NULL) { 4975 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status callback - no response configured"); 4976 return SSL_TLSEXT_ERR_OK; 4977 } 4978 4979 resp = os_readfile(tls_global->ocsp_stapling_response, &len); 4980 if (resp == NULL) { 4981 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status callback - could not read response file"); 4982 /* TODO: Build OCSPResponse with responseStatus = internalError 4983 */ 4984 return SSL_TLSEXT_ERR_OK; 4985 } 4986 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status callback - send cached response"); 4987 tmp = OPENSSL_malloc(len); 4988 if (tmp == NULL) { 4989 os_free(resp); 4990 return SSL_TLSEXT_ERR_ALERT_FATAL; 4991 } 4992 4993 os_memcpy(tmp, resp, len); 4994 os_free(resp); 4995 SSL_set_tlsext_status_ocsp_resp(s, tmp, len); 4996 4997 return SSL_TLSEXT_ERR_OK; 4998 } 4999 5000 #endif /* HAVE_OCSP */ 5001 5002 5003 static size_t max_str_len(const char **lines) 5004 { 5005 const char **p; 5006 size_t max_len = 0; 5007 5008 for (p = lines; *p; p++) { 5009 size_t len = os_strlen(*p); 5010 5011 if (len > max_len) 5012 max_len = len; 5013 } 5014 5015 return max_len; 5016 } 5017 5018 5019 static int match_lines_in_file(const char *path, const char **lines) 5020 { 5021 FILE *f; 5022 char *buf; 5023 size_t bufsize; 5024 int found = 0, is_linestart = 1; 5025 5026 bufsize = max_str_len(lines) + sizeof("\r\n"); 5027 buf = os_malloc(bufsize); 5028 if (!buf) 5029 return 0; 5030 5031 f = fopen(path, "r"); 5032 if (!f) { 5033 os_free(buf); 5034 return 0; 5035 } 5036 5037 while (!found && fgets(buf, bufsize, f)) { 5038 int is_lineend; 5039 size_t len; 5040 const char **p; 5041 5042 len = strcspn(buf, "\r\n"); 5043 is_lineend = buf[len] != '\0'; 5044 buf[len] = '\0'; 5045 5046 if (is_linestart && is_lineend) { 5047 for (p = lines; !found && *p; p++) 5048 found = os_strcmp(buf, *p) == 0; 5049 } 5050 is_linestart = is_lineend; 5051 } 5052 5053 fclose(f); 5054 bin_clear_free(buf, bufsize); 5055 5056 return found; 5057 } 5058 5059 5060 static int is_tpm2_key(const char *path) 5061 { 5062 /* Check both new and old format of TPM2 PEM guard tag */ 5063 static const char *tpm2_tags[] = { 5064 "-----BEGIN TSS2 PRIVATE KEY-----", 5065 "-----BEGIN TSS2 KEY BLOB-----", 5066 NULL 5067 }; 5068 5069 return match_lines_in_file(path, tpm2_tags); 5070 } 5071 5072 5073 int tls_connection_set_params(void *tls_ctx, struct tls_connection *conn, 5074 const struct tls_connection_params *params) 5075 { 5076 struct tls_data *data = tls_ctx; 5077 int ret; 5078 unsigned long err; 5079 int can_pkcs11 = 0; 5080 const char *key_id = params->key_id; 5081 const char *cert_id = params->cert_id; 5082 const char *ca_cert_id = params->ca_cert_id; 5083 const char *engine_id = params->engine ? params->engine_id : NULL; 5084 const char *ciphers; 5085 5086 if (conn == NULL) 5087 return -1; 5088 5089 if (params->flags & TLS_CONN_REQUIRE_OCSP_ALL) { 5090 wpa_printf(MSG_INFO, 5091 "OpenSSL: ocsp=3 not supported"); 5092 return -1; 5093 } 5094 5095 /* 5096 * If the engine isn't explicitly configured, and any of the 5097 * cert/key fields are actually PKCS#11 URIs, then automatically 5098 * use the PKCS#11 ENGINE. 5099 */ 5100 if (!engine_id || os_strcmp(engine_id, "pkcs11") == 0) 5101 can_pkcs11 = 1; 5102 5103 if (!key_id && params->private_key && can_pkcs11 && 5104 os_strncmp(params->private_key, "pkcs11:", 7) == 0) { 5105 can_pkcs11 = 2; 5106 key_id = params->private_key; 5107 } 5108 5109 if (!cert_id && params->client_cert && can_pkcs11 && 5110 os_strncmp(params->client_cert, "pkcs11:", 7) == 0) { 5111 can_pkcs11 = 2; 5112 cert_id = params->client_cert; 5113 } 5114 5115 if (!ca_cert_id && params->ca_cert && can_pkcs11 && 5116 os_strncmp(params->ca_cert, "pkcs11:", 7) == 0) { 5117 can_pkcs11 = 2; 5118 ca_cert_id = params->ca_cert; 5119 } 5120 5121 /* If we need to automatically enable the PKCS#11 ENGINE, do so. */ 5122 if (can_pkcs11 == 2 && !engine_id) 5123 engine_id = "pkcs11"; 5124 5125 /* If private_key points to a TPM2-wrapped key, automatically enable 5126 * tpm2 engine and use it to unwrap the key. */ 5127 if (params->private_key && 5128 (!engine_id || os_strcmp(engine_id, "tpm2") == 0) && 5129 is_tpm2_key(params->private_key)) { 5130 wpa_printf(MSG_DEBUG, "OpenSSL: Found TPM2 wrapped key %s", 5131 params->private_key); 5132 key_id = key_id ? key_id : params->private_key; 5133 engine_id = engine_id ? engine_id : "tpm2"; 5134 } 5135 5136 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST) 5137 #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) 5138 if (params->flags & TLS_CONN_EAP_FAST) { 5139 wpa_printf(MSG_DEBUG, 5140 "OpenSSL: Use TLSv1_method() for EAP-FAST"); 5141 if (SSL_set_ssl_method(conn->ssl, TLSv1_method()) != 1) { 5142 tls_show_errors(MSG_INFO, __func__, 5143 "Failed to set TLSv1_method() for EAP-FAST"); 5144 return -1; 5145 } 5146 } 5147 #endif 5148 #if OPENSSL_VERSION_NUMBER >= 0x10101000L 5149 #ifdef SSL_OP_NO_TLSv1_3 5150 if (params->flags & TLS_CONN_EAP_FAST) { 5151 /* Need to disable TLS v1.3 at least for now since OpenSSL 1.1.1 5152 * refuses to start the handshake with the modified ciphersuite 5153 * list (no TLS v1.3 ciphersuites included) for EAP-FAST. */ 5154 wpa_printf(MSG_DEBUG, "OpenSSL: Disable TLSv1.3 for EAP-FAST"); 5155 SSL_set_options(conn->ssl, SSL_OP_NO_TLSv1_3); 5156 } 5157 #endif /* SSL_OP_NO_TLSv1_3 */ 5158 #endif 5159 #endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */ 5160 5161 while ((err = ERR_get_error())) { 5162 wpa_printf(MSG_INFO, "%s: Clearing pending SSL error: %s", 5163 __func__, ERR_error_string(err, NULL)); 5164 } 5165 5166 if (engine_id) { 5167 wpa_printf(MSG_DEBUG, "SSL: Initializing TLS engine %s", 5168 engine_id); 5169 ret = tls_engine_init(conn, engine_id, params->pin, 5170 key_id, cert_id, ca_cert_id); 5171 if (ret) 5172 return ret; 5173 } 5174 if (tls_connection_set_subject_match(conn, 5175 params->subject_match, 5176 params->altsubject_match, 5177 params->suffix_match, 5178 params->domain_match, 5179 params->check_cert_subject)) 5180 return -1; 5181 5182 if (engine_id && ca_cert_id) { 5183 if (tls_connection_engine_ca_cert(data, conn, ca_cert_id)) 5184 return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED; 5185 } else if (tls_connection_ca_cert(data, conn, params->ca_cert, 5186 params->ca_cert_blob, 5187 params->ca_cert_blob_len, 5188 params->ca_path)) 5189 return -1; 5190 5191 if (engine_id && cert_id) { 5192 if (tls_connection_engine_client_cert(conn, cert_id)) 5193 return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED; 5194 } else if (tls_connection_client_cert(conn, params->client_cert, 5195 params->client_cert_blob, 5196 params->client_cert_blob_len)) 5197 return -1; 5198 5199 if (engine_id && key_id) { 5200 wpa_printf(MSG_DEBUG, "TLS: Using private key from engine"); 5201 if (tls_connection_engine_private_key(conn)) 5202 return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED; 5203 } else if (tls_connection_private_key(data, conn, 5204 params->private_key, 5205 params->private_key_passwd, 5206 params->private_key_blob, 5207 params->private_key_blob_len)) { 5208 wpa_printf(MSG_INFO, "TLS: Failed to load private key '%s'", 5209 params->private_key); 5210 return -1; 5211 } 5212 5213 if (tls_connection_dh(conn, params->dh_file)) { 5214 wpa_printf(MSG_INFO, "TLS: Failed to load DH file '%s'", 5215 params->dh_file); 5216 return -1; 5217 } 5218 5219 ciphers = params->openssl_ciphers; 5220 #ifdef CONFIG_SUITEB 5221 #ifdef OPENSSL_IS_BORINGSSL 5222 if (ciphers && os_strcmp(ciphers, "SUITEB192") == 0) { 5223 /* BoringSSL removed support for SUITEB192, so need to handle 5224 * this with hardcoded ciphersuite and additional checks for 5225 * other parameters. */ 5226 ciphers = "ECDHE-ECDSA-AES256-GCM-SHA384"; 5227 } 5228 #endif /* OPENSSL_IS_BORINGSSL */ 5229 #endif /* CONFIG_SUITEB */ 5230 if (ciphers && SSL_set_cipher_list(conn->ssl, ciphers) != 1) { 5231 wpa_printf(MSG_INFO, 5232 "OpenSSL: Failed to set cipher string '%s'", 5233 ciphers); 5234 return -1; 5235 } 5236 5237 if (!params->openssl_ecdh_curves) { 5238 #ifndef OPENSSL_IS_BORINGSSL 5239 #ifndef OPENSSL_NO_EC 5240 #if (OPENSSL_VERSION_NUMBER >= 0x10002000L) && \ 5241 (OPENSSL_VERSION_NUMBER < 0x10100000L) 5242 if (SSL_set_ecdh_auto(conn->ssl, 1) != 1) { 5243 wpa_printf(MSG_INFO, 5244 "OpenSSL: Failed to set ECDH curves to auto"); 5245 return -1; 5246 } 5247 #endif /* >= 1.0.2 && < 1.1.0 */ 5248 #endif /* OPENSSL_NO_EC */ 5249 #endif /* OPENSSL_IS_BORINGSSL */ 5250 } else if (params->openssl_ecdh_curves[0]) { 5251 #if defined(OPENSSL_IS_BORINGSSL) || (OPENSSL_VERSION_NUMBER < 0x10002000L) 5252 wpa_printf(MSG_INFO, 5253 "OpenSSL: ECDH configuration nnot supported"); 5254 return -1; 5255 #else /* OPENSSL_IS_BORINGSSL || < 1.0.2 */ 5256 #ifndef OPENSSL_NO_EC 5257 if (SSL_set1_curves_list(conn->ssl, 5258 params->openssl_ecdh_curves) != 1) { 5259 wpa_printf(MSG_INFO, 5260 "OpenSSL: Failed to set ECDH curves '%s'", 5261 params->openssl_ecdh_curves); 5262 return -1; 5263 } 5264 #else /* OPENSSL_NO_EC */ 5265 wpa_printf(MSG_INFO, "OpenSSL: ECDH not supported"); 5266 return -1; 5267 #endif /* OPENSSL_NO_EC */ 5268 #endif /* OPENSSL_IS_BORINGSSL */ 5269 } 5270 5271 if (tls_set_conn_flags(conn, params->flags, 5272 params->openssl_ciphers) < 0) 5273 return -1; 5274 5275 #ifdef OPENSSL_IS_BORINGSSL 5276 if (params->flags & TLS_CONN_REQUEST_OCSP) { 5277 SSL_enable_ocsp_stapling(conn->ssl); 5278 } 5279 #else /* OPENSSL_IS_BORINGSSL */ 5280 #ifdef HAVE_OCSP 5281 if (params->flags & TLS_CONN_REQUEST_OCSP) { 5282 SSL_CTX *ssl_ctx = data->ssl; 5283 SSL_set_tlsext_status_type(conn->ssl, TLSEXT_STATUSTYPE_ocsp); 5284 SSL_CTX_set_tlsext_status_cb(ssl_ctx, ocsp_resp_cb); 5285 SSL_CTX_set_tlsext_status_arg(ssl_ctx, conn); 5286 } 5287 #else /* HAVE_OCSP */ 5288 if (params->flags & TLS_CONN_REQUIRE_OCSP) { 5289 wpa_printf(MSG_INFO, 5290 "OpenSSL: No OCSP support included - reject configuration"); 5291 return -1; 5292 } 5293 if (params->flags & TLS_CONN_REQUEST_OCSP) { 5294 wpa_printf(MSG_DEBUG, 5295 "OpenSSL: No OCSP support included - allow optional OCSP case to continue"); 5296 } 5297 #endif /* HAVE_OCSP */ 5298 #endif /* OPENSSL_IS_BORINGSSL */ 5299 5300 conn->flags = params->flags; 5301 5302 tls_get_errors(data); 5303 5304 return 0; 5305 } 5306 5307 5308 static void openssl_debug_dump_cipher_list(SSL_CTX *ssl_ctx) 5309 { 5310 SSL *ssl; 5311 int i; 5312 5313 ssl = SSL_new(ssl_ctx); 5314 if (!ssl) 5315 return; 5316 5317 wpa_printf(MSG_DEBUG, 5318 "OpenSSL: Enabled cipher suites in priority order"); 5319 for (i = 0; ; i++) { 5320 const char *cipher; 5321 5322 cipher = SSL_get_cipher_list(ssl, i); 5323 if (!cipher) 5324 break; 5325 wpa_printf(MSG_DEBUG, "Cipher %d: %s", i, cipher); 5326 } 5327 5328 SSL_free(ssl); 5329 } 5330 5331 5332 #if !defined(LIBRESSL_VERSION_NUMBER) && !defined(BORINGSSL_API_VERSION) 5333 5334 static const char * openssl_pkey_type_str(const EVP_PKEY *pkey) 5335 { 5336 if (!pkey) 5337 return "NULL"; 5338 switch (EVP_PKEY_type(EVP_PKEY_id(pkey))) { 5339 case EVP_PKEY_RSA: 5340 return "RSA"; 5341 case EVP_PKEY_DSA: 5342 return "DSA"; 5343 case EVP_PKEY_DH: 5344 return "DH"; 5345 case EVP_PKEY_EC: 5346 return "EC"; 5347 } 5348 return "?"; 5349 } 5350 5351 5352 static void openssl_debug_dump_certificate(int i, X509 *cert) 5353 { 5354 char buf[256]; 5355 EVP_PKEY *pkey; 5356 ASN1_INTEGER *ser; 5357 char serial_num[128]; 5358 5359 if (!cert) 5360 return; 5361 5362 X509_NAME_oneline(X509_get_subject_name(cert), buf, sizeof(buf)); 5363 5364 ser = X509_get_serialNumber(cert); 5365 if (ser) 5366 wpa_snprintf_hex_uppercase(serial_num, sizeof(serial_num), 5367 ASN1_STRING_get0_data(ser), 5368 ASN1_STRING_length(ser)); 5369 else 5370 serial_num[0] = '\0'; 5371 5372 pkey = X509_get_pubkey(cert); 5373 wpa_printf(MSG_DEBUG, "%d: %s (%s) %s", i, buf, 5374 openssl_pkey_type_str(pkey), serial_num); 5375 EVP_PKEY_free(pkey); 5376 } 5377 5378 5379 static void openssl_debug_dump_certificates(SSL_CTX *ssl_ctx) 5380 { 5381 STACK_OF(X509) *certs; 5382 5383 wpa_printf(MSG_DEBUG, "OpenSSL: Configured certificate chain"); 5384 if (SSL_CTX_get0_chain_certs(ssl_ctx, &certs) == 1) { 5385 int i; 5386 5387 for (i = sk_X509_num(certs); i > 0; i--) 5388 openssl_debug_dump_certificate(i, sk_X509_value(certs, 5389 i - 1)); 5390 } 5391 openssl_debug_dump_certificate(0, SSL_CTX_get0_certificate(ssl_ctx)); 5392 } 5393 5394 #endif 5395 5396 5397 static void openssl_debug_dump_certificate_chains(SSL_CTX *ssl_ctx) 5398 { 5399 #if !defined(LIBRESSL_VERSION_NUMBER) && !defined(BORINGSSL_API_VERSION) 5400 int res; 5401 5402 for (res = SSL_CTX_set_current_cert(ssl_ctx, SSL_CERT_SET_FIRST); 5403 res == 1; 5404 res = SSL_CTX_set_current_cert(ssl_ctx, SSL_CERT_SET_NEXT)) 5405 openssl_debug_dump_certificates(ssl_ctx); 5406 5407 SSL_CTX_set_current_cert(ssl_ctx, SSL_CERT_SET_FIRST); 5408 #endif 5409 } 5410 5411 5412 static void openssl_debug_dump_ctx(SSL_CTX *ssl_ctx) 5413 { 5414 openssl_debug_dump_cipher_list(ssl_ctx); 5415 openssl_debug_dump_certificate_chains(ssl_ctx); 5416 } 5417 5418 5419 int tls_global_set_params(void *tls_ctx, 5420 const struct tls_connection_params *params) 5421 { 5422 struct tls_data *data = tls_ctx; 5423 SSL_CTX *ssl_ctx = data->ssl; 5424 unsigned long err; 5425 5426 while ((err = ERR_get_error())) { 5427 wpa_printf(MSG_INFO, "%s: Clearing pending SSL error: %s", 5428 __func__, ERR_error_string(err, NULL)); 5429 } 5430 5431 os_free(data->check_cert_subject); 5432 data->check_cert_subject = NULL; 5433 if (params->check_cert_subject) { 5434 data->check_cert_subject = 5435 os_strdup(params->check_cert_subject); 5436 if (!data->check_cert_subject) 5437 return -1; 5438 } 5439 5440 if (tls_global_ca_cert(data, params->ca_cert) || 5441 tls_global_client_cert(data, params->client_cert) || 5442 tls_global_private_key(data, params->private_key, 5443 params->private_key_passwd) || 5444 tls_global_client_cert(data, params->client_cert2) || 5445 tls_global_private_key(data, params->private_key2, 5446 params->private_key_passwd2) || 5447 tls_global_dh(data, params->dh_file)) { 5448 wpa_printf(MSG_INFO, "TLS: Failed to set global parameters"); 5449 return -1; 5450 } 5451 5452 if (params->openssl_ciphers && 5453 SSL_CTX_set_cipher_list(ssl_ctx, params->openssl_ciphers) != 1) { 5454 wpa_printf(MSG_INFO, 5455 "OpenSSL: Failed to set cipher string '%s'", 5456 params->openssl_ciphers); 5457 return -1; 5458 } 5459 5460 if (!params->openssl_ecdh_curves) { 5461 #ifndef OPENSSL_IS_BORINGSSL 5462 #ifndef OPENSSL_NO_EC 5463 #if (OPENSSL_VERSION_NUMBER >= 0x10002000L) && \ 5464 (OPENSSL_VERSION_NUMBER < 0x10100000L) 5465 if (SSL_CTX_set_ecdh_auto(ssl_ctx, 1) != 1) { 5466 wpa_printf(MSG_INFO, 5467 "OpenSSL: Failed to set ECDH curves to auto"); 5468 return -1; 5469 } 5470 #endif /* >= 1.0.2 && < 1.1.0 */ 5471 #endif /* OPENSSL_NO_EC */ 5472 #endif /* OPENSSL_IS_BORINGSSL */ 5473 } else if (params->openssl_ecdh_curves[0]) { 5474 #if defined(OPENSSL_IS_BORINGSSL) || (OPENSSL_VERSION_NUMBER < 0x10002000L) 5475 wpa_printf(MSG_INFO, 5476 "OpenSSL: ECDH configuration nnot supported"); 5477 return -1; 5478 #else /* OPENSSL_IS_BORINGSSL || < 1.0.2 */ 5479 #ifndef OPENSSL_NO_EC 5480 #if OPENSSL_VERSION_NUMBER < 0x10100000L 5481 SSL_CTX_set_ecdh_auto(ssl_ctx, 1); 5482 #endif 5483 if (SSL_CTX_set1_curves_list(ssl_ctx, 5484 params->openssl_ecdh_curves) != 5485 1) { 5486 wpa_printf(MSG_INFO, 5487 "OpenSSL: Failed to set ECDH curves '%s'", 5488 params->openssl_ecdh_curves); 5489 return -1; 5490 } 5491 #else /* OPENSSL_NO_EC */ 5492 wpa_printf(MSG_INFO, "OpenSSL: ECDH not supported"); 5493 return -1; 5494 #endif /* OPENSSL_NO_EC */ 5495 #endif /* OPENSSL_IS_BORINGSSL */ 5496 } 5497 5498 #ifdef SSL_OP_NO_TICKET 5499 if (params->flags & TLS_CONN_DISABLE_SESSION_TICKET) 5500 SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_TICKET); 5501 else 5502 SSL_CTX_clear_options(ssl_ctx, SSL_OP_NO_TICKET); 5503 #endif /* SSL_OP_NO_TICKET */ 5504 5505 #ifdef HAVE_OCSP 5506 SSL_CTX_set_tlsext_status_cb(ssl_ctx, ocsp_status_cb); 5507 SSL_CTX_set_tlsext_status_arg(ssl_ctx, ssl_ctx); 5508 os_free(tls_global->ocsp_stapling_response); 5509 if (params->ocsp_stapling_response) 5510 tls_global->ocsp_stapling_response = 5511 os_strdup(params->ocsp_stapling_response); 5512 else 5513 tls_global->ocsp_stapling_response = NULL; 5514 #endif /* HAVE_OCSP */ 5515 5516 openssl_debug_dump_ctx(ssl_ctx); 5517 5518 return 0; 5519 } 5520 5521 5522 #ifdef EAP_FAST_OR_TEAP 5523 /* Pre-shared secred requires a patch to openssl, so this function is 5524 * commented out unless explicitly needed for EAP-FAST in order to be able to 5525 * build this file with unmodified openssl. */ 5526 5527 #if (defined(OPENSSL_IS_BORINGSSL) || OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined(LIBRESSL_VERSION_NUMBER) 5528 static int tls_sess_sec_cb(SSL *s, void *secret, int *secret_len, 5529 STACK_OF(SSL_CIPHER) *peer_ciphers, 5530 const SSL_CIPHER **cipher, void *arg) 5531 #else /* OPENSSL_IS_BORINGSSL */ 5532 static int tls_sess_sec_cb(SSL *s, void *secret, int *secret_len, 5533 STACK_OF(SSL_CIPHER) *peer_ciphers, 5534 SSL_CIPHER **cipher, void *arg) 5535 #endif /* OPENSSL_IS_BORINGSSL */ 5536 { 5537 struct tls_connection *conn = arg; 5538 int ret; 5539 5540 #if OPENSSL_VERSION_NUMBER < 0x10100000L || \ 5541 (defined(LIBRESSL_VERSION_NUMBER) && \ 5542 LIBRESSL_VERSION_NUMBER < 0x20700000L) 5543 if (conn == NULL || conn->session_ticket_cb == NULL) 5544 return 0; 5545 5546 ret = conn->session_ticket_cb(conn->session_ticket_cb_ctx, 5547 conn->session_ticket, 5548 conn->session_ticket_len, 5549 s->s3->client_random, 5550 s->s3->server_random, secret); 5551 #else 5552 unsigned char client_random[SSL3_RANDOM_SIZE]; 5553 unsigned char server_random[SSL3_RANDOM_SIZE]; 5554 5555 if (conn == NULL || conn->session_ticket_cb == NULL) 5556 return 0; 5557 5558 SSL_get_client_random(s, client_random, sizeof(client_random)); 5559 SSL_get_server_random(s, server_random, sizeof(server_random)); 5560 5561 ret = conn->session_ticket_cb(conn->session_ticket_cb_ctx, 5562 conn->session_ticket, 5563 conn->session_ticket_len, 5564 client_random, 5565 server_random, secret); 5566 #endif 5567 5568 os_free(conn->session_ticket); 5569 conn->session_ticket = NULL; 5570 5571 if (ret <= 0) 5572 return 0; 5573 5574 *secret_len = SSL_MAX_MASTER_KEY_LENGTH; 5575 return 1; 5576 } 5577 5578 5579 static int tls_session_ticket_ext_cb(SSL *s, const unsigned char *data, 5580 int len, void *arg) 5581 { 5582 struct tls_connection *conn = arg; 5583 5584 if (conn == NULL || conn->session_ticket_cb == NULL) 5585 return 0; 5586 5587 wpa_printf(MSG_DEBUG, "OpenSSL: %s: length=%d", __func__, len); 5588 5589 os_free(conn->session_ticket); 5590 conn->session_ticket = NULL; 5591 5592 wpa_hexdump(MSG_DEBUG, "OpenSSL: ClientHello SessionTicket " 5593 "extension", data, len); 5594 5595 conn->session_ticket = os_memdup(data, len); 5596 if (conn->session_ticket == NULL) 5597 return 0; 5598 5599 conn->session_ticket_len = len; 5600 5601 return 1; 5602 } 5603 #endif /* EAP_FAST_OR_TEAP */ 5604 5605 5606 int tls_connection_set_session_ticket_cb(void *tls_ctx, 5607 struct tls_connection *conn, 5608 tls_session_ticket_cb cb, 5609 void *ctx) 5610 { 5611 #ifdef EAP_FAST_OR_TEAP 5612 conn->session_ticket_cb = cb; 5613 conn->session_ticket_cb_ctx = ctx; 5614 5615 if (cb) { 5616 if (SSL_set_session_secret_cb(conn->ssl, tls_sess_sec_cb, 5617 conn) != 1) 5618 return -1; 5619 SSL_set_session_ticket_ext_cb(conn->ssl, 5620 tls_session_ticket_ext_cb, conn); 5621 } else { 5622 if (SSL_set_session_secret_cb(conn->ssl, NULL, NULL) != 1) 5623 return -1; 5624 SSL_set_session_ticket_ext_cb(conn->ssl, NULL, NULL); 5625 } 5626 5627 return 0; 5628 #else /* EAP_FAST_OR_TEAP */ 5629 return -1; 5630 #endif /* EAP_FAST_OR_TEAP */ 5631 } 5632 5633 5634 int tls_get_library_version(char *buf, size_t buf_len) 5635 { 5636 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER) 5637 return os_snprintf(buf, buf_len, "OpenSSL build=%s run=%s", 5638 OPENSSL_VERSION_TEXT, 5639 OpenSSL_version(OPENSSL_VERSION)); 5640 #else 5641 return os_snprintf(buf, buf_len, "OpenSSL build=%s run=%s", 5642 OPENSSL_VERSION_TEXT, 5643 SSLeay_version(SSLEAY_VERSION)); 5644 #endif 5645 } 5646 5647 5648 void tls_connection_set_success_data(struct tls_connection *conn, 5649 struct wpabuf *data) 5650 { 5651 SSL_SESSION *sess; 5652 struct wpabuf *old; 5653 5654 if (tls_ex_idx_session < 0) 5655 goto fail; 5656 sess = SSL_get_session(conn->ssl); 5657 if (!sess) 5658 goto fail; 5659 old = SSL_SESSION_get_ex_data(sess, tls_ex_idx_session); 5660 if (old) { 5661 wpa_printf(MSG_DEBUG, "OpenSSL: Replacing old success data %p", 5662 old); 5663 wpabuf_free(old); 5664 } 5665 if (SSL_SESSION_set_ex_data(sess, tls_ex_idx_session, data) != 1) 5666 goto fail; 5667 5668 wpa_printf(MSG_DEBUG, "OpenSSL: Stored success data %p", data); 5669 conn->success_data = 1; 5670 return; 5671 5672 fail: 5673 wpa_printf(MSG_INFO, "OpenSSL: Failed to store success data"); 5674 wpabuf_free(data); 5675 } 5676 5677 5678 void tls_connection_set_success_data_resumed(struct tls_connection *conn) 5679 { 5680 wpa_printf(MSG_DEBUG, 5681 "OpenSSL: Success data accepted for resumed session"); 5682 conn->success_data = 1; 5683 } 5684 5685 5686 const struct wpabuf * 5687 tls_connection_get_success_data(struct tls_connection *conn) 5688 { 5689 SSL_SESSION *sess; 5690 5691 if (tls_ex_idx_session < 0 || 5692 !(sess = SSL_get_session(conn->ssl))) 5693 return NULL; 5694 return SSL_SESSION_get_ex_data(sess, tls_ex_idx_session); 5695 } 5696 5697 5698 void tls_connection_remove_session(struct tls_connection *conn) 5699 { 5700 SSL_SESSION *sess; 5701 5702 sess = SSL_get_session(conn->ssl); 5703 if (!sess) 5704 return; 5705 5706 if (SSL_CTX_remove_session(conn->ssl_ctx, sess) != 1) 5707 wpa_printf(MSG_DEBUG, 5708 "OpenSSL: Session was not cached"); 5709 else 5710 wpa_printf(MSG_DEBUG, 5711 "OpenSSL: Removed cached session to disable session resumption"); 5712 } 5713 5714 5715 int tls_get_tls_unique(struct tls_connection *conn, u8 *buf, size_t max_len) 5716 { 5717 size_t len; 5718 int reused; 5719 5720 reused = SSL_session_reused(conn->ssl); 5721 if ((conn->server && !reused) || (!conn->server && reused)) 5722 len = SSL_get_peer_finished(conn->ssl, buf, max_len); 5723 else 5724 len = SSL_get_finished(conn->ssl, buf, max_len); 5725 5726 if (len == 0 || len > max_len) 5727 return -1; 5728 5729 return len; 5730 } 5731 5732 5733 u16 tls_connection_get_cipher_suite(struct tls_connection *conn) 5734 { 5735 const SSL_CIPHER *cipher; 5736 5737 cipher = SSL_get_current_cipher(conn->ssl); 5738 if (!cipher) 5739 return 0; 5740 #if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER) 5741 return SSL_CIPHER_get_protocol_id(cipher); 5742 #else 5743 return SSL_CIPHER_get_id(cipher) & 0xFFFF; 5744 #endif 5745 } 5746 5747 5748 const char * tls_connection_get_peer_subject(struct tls_connection *conn) 5749 { 5750 if (conn) 5751 return conn->peer_subject; 5752 return NULL; 5753 } 5754 5755 5756 bool tls_connection_get_own_cert_used(struct tls_connection *conn) 5757 { 5758 if (conn) 5759 return SSL_get_certificate(conn->ssl) != NULL; 5760 return false; 5761 } 5762