1 /* 2 * SSL/TLS interface functions for OpenSSL 3 * Copyright (c) 2004-2015, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 11 #ifndef CONFIG_SMARTCARD 12 #ifndef OPENSSL_NO_ENGINE 13 #ifndef ANDROID 14 #define OPENSSL_NO_ENGINE 15 #endif 16 #endif 17 #endif 18 19 #include <openssl/ssl.h> 20 #include <openssl/err.h> 21 #include <openssl/pkcs12.h> 22 #include <openssl/x509v3.h> 23 #ifndef OPENSSL_NO_ENGINE 24 #include <openssl/engine.h> 25 #endif /* OPENSSL_NO_ENGINE */ 26 #ifndef OPENSSL_NO_DSA 27 #include <openssl/dsa.h> 28 #endif 29 #ifndef OPENSSL_NO_DH 30 #include <openssl/dh.h> 31 #endif 32 33 #include "common.h" 34 #include "crypto.h" 35 #include "sha1.h" 36 #include "sha256.h" 37 #include "tls.h" 38 39 #if OPENSSL_VERSION_NUMBER < 0x10000000L 40 /* ERR_remove_thread_state replaces ERR_remove_state and the latter is 41 * deprecated. However, OpenSSL 0.9.8 doesn't include 42 * ERR_remove_thread_state. */ 43 #define ERR_remove_thread_state(tid) ERR_remove_state(0) 44 #endif 45 46 #if defined(OPENSSL_IS_BORINGSSL) 47 /* stack_index_t is the return type of OpenSSL's sk_XXX_num() functions. */ 48 typedef size_t stack_index_t; 49 #else 50 typedef int stack_index_t; 51 #endif 52 53 #ifdef SSL_set_tlsext_status_type 54 #ifndef OPENSSL_NO_TLSEXT 55 #define HAVE_OCSP 56 #include <openssl/ocsp.h> 57 #endif /* OPENSSL_NO_TLSEXT */ 58 #endif /* SSL_set_tlsext_status_type */ 59 60 #ifdef ANDROID 61 #include <openssl/pem.h> 62 #include <keystore/keystore_get.h> 63 64 static BIO * BIO_from_keystore(const char *key) 65 { 66 BIO *bio = NULL; 67 uint8_t *value = NULL; 68 int length = keystore_get(key, strlen(key), &value); 69 if (length != -1 && (bio = BIO_new(BIO_s_mem())) != NULL) 70 BIO_write(bio, value, length); 71 free(value); 72 return bio; 73 } 74 #endif /* ANDROID */ 75 76 static int tls_openssl_ref_count = 0; 77 static int tls_ex_idx_session = -1; 78 79 struct tls_context { 80 void (*event_cb)(void *ctx, enum tls_event ev, 81 union tls_event_data *data); 82 void *cb_ctx; 83 int cert_in_cb; 84 char *ocsp_stapling_response; 85 }; 86 87 static struct tls_context *tls_global = NULL; 88 89 90 struct tls_data { 91 SSL_CTX *ssl; 92 unsigned int tls_session_lifetime; 93 }; 94 95 struct tls_connection { 96 struct tls_context *context; 97 SSL_CTX *ssl_ctx; 98 SSL *ssl; 99 BIO *ssl_in, *ssl_out; 100 #ifndef OPENSSL_NO_ENGINE 101 ENGINE *engine; /* functional reference to the engine */ 102 EVP_PKEY *private_key; /* the private key if using engine */ 103 #endif /* OPENSSL_NO_ENGINE */ 104 char *subject_match, *altsubject_match, *suffix_match, *domain_match; 105 int read_alerts, write_alerts, failed; 106 107 tls_session_ticket_cb session_ticket_cb; 108 void *session_ticket_cb_ctx; 109 110 /* SessionTicket received from OpenSSL hello_extension_cb (server) */ 111 u8 *session_ticket; 112 size_t session_ticket_len; 113 114 unsigned int ca_cert_verify:1; 115 unsigned int cert_probe:1; 116 unsigned int server_cert_only:1; 117 unsigned int invalid_hb_used:1; 118 unsigned int success_data:1; 119 120 u8 srv_cert_hash[32]; 121 122 unsigned int flags; 123 124 X509 *peer_cert; 125 X509 *peer_issuer; 126 X509 *peer_issuer_issuer; 127 128 #if OPENSSL_VERSION_NUMBER >= 0x10100000L 129 unsigned char client_random[SSL3_RANDOM_SIZE]; 130 unsigned char server_random[SSL3_RANDOM_SIZE]; 131 #endif 132 }; 133 134 135 static struct tls_context * tls_context_new(const struct tls_config *conf) 136 { 137 struct tls_context *context = os_zalloc(sizeof(*context)); 138 if (context == NULL) 139 return NULL; 140 if (conf) { 141 context->event_cb = conf->event_cb; 142 context->cb_ctx = conf->cb_ctx; 143 context->cert_in_cb = conf->cert_in_cb; 144 } 145 return context; 146 } 147 148 149 #ifdef CONFIG_NO_STDOUT_DEBUG 150 151 static void _tls_show_errors(void) 152 { 153 unsigned long err; 154 155 while ((err = ERR_get_error())) { 156 /* Just ignore the errors, since stdout is disabled */ 157 } 158 } 159 #define tls_show_errors(l, f, t) _tls_show_errors() 160 161 #else /* CONFIG_NO_STDOUT_DEBUG */ 162 163 static void tls_show_errors(int level, const char *func, const char *txt) 164 { 165 unsigned long err; 166 167 wpa_printf(level, "OpenSSL: %s - %s %s", 168 func, txt, ERR_error_string(ERR_get_error(), NULL)); 169 170 while ((err = ERR_get_error())) { 171 wpa_printf(MSG_INFO, "OpenSSL: pending error: %s", 172 ERR_error_string(err, NULL)); 173 } 174 } 175 176 #endif /* CONFIG_NO_STDOUT_DEBUG */ 177 178 179 #ifdef CONFIG_NATIVE_WINDOWS 180 181 /* Windows CryptoAPI and access to certificate stores */ 182 #include <wincrypt.h> 183 184 #ifdef __MINGW32_VERSION 185 /* 186 * MinGW does not yet include all the needed definitions for CryptoAPI, so 187 * define here whatever extra is needed. 188 */ 189 #define CERT_SYSTEM_STORE_CURRENT_USER (1 << 16) 190 #define CERT_STORE_READONLY_FLAG 0x00008000 191 #define CERT_STORE_OPEN_EXISTING_FLAG 0x00004000 192 193 #endif /* __MINGW32_VERSION */ 194 195 196 struct cryptoapi_rsa_data { 197 const CERT_CONTEXT *cert; 198 HCRYPTPROV crypt_prov; 199 DWORD key_spec; 200 BOOL free_crypt_prov; 201 }; 202 203 204 static void cryptoapi_error(const char *msg) 205 { 206 wpa_printf(MSG_INFO, "CryptoAPI: %s; err=%u", 207 msg, (unsigned int) GetLastError()); 208 } 209 210 211 static int cryptoapi_rsa_pub_enc(int flen, const unsigned char *from, 212 unsigned char *to, RSA *rsa, int padding) 213 { 214 wpa_printf(MSG_DEBUG, "%s - not implemented", __func__); 215 return 0; 216 } 217 218 219 static int cryptoapi_rsa_pub_dec(int flen, const unsigned char *from, 220 unsigned char *to, RSA *rsa, int padding) 221 { 222 wpa_printf(MSG_DEBUG, "%s - not implemented", __func__); 223 return 0; 224 } 225 226 227 static int cryptoapi_rsa_priv_enc(int flen, const unsigned char *from, 228 unsigned char *to, RSA *rsa, int padding) 229 { 230 struct cryptoapi_rsa_data *priv = 231 (struct cryptoapi_rsa_data *) rsa->meth->app_data; 232 HCRYPTHASH hash; 233 DWORD hash_size, len, i; 234 unsigned char *buf = NULL; 235 int ret = 0; 236 237 if (priv == NULL) { 238 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, 239 ERR_R_PASSED_NULL_PARAMETER); 240 return 0; 241 } 242 243 if (padding != RSA_PKCS1_PADDING) { 244 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, 245 RSA_R_UNKNOWN_PADDING_TYPE); 246 return 0; 247 } 248 249 if (flen != 16 /* MD5 */ + 20 /* SHA-1 */) { 250 wpa_printf(MSG_INFO, "%s - only MD5-SHA1 hash supported", 251 __func__); 252 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, 253 RSA_R_INVALID_MESSAGE_LENGTH); 254 return 0; 255 } 256 257 if (!CryptCreateHash(priv->crypt_prov, CALG_SSL3_SHAMD5, 0, 0, &hash)) 258 { 259 cryptoapi_error("CryptCreateHash failed"); 260 return 0; 261 } 262 263 len = sizeof(hash_size); 264 if (!CryptGetHashParam(hash, HP_HASHSIZE, (BYTE *) &hash_size, &len, 265 0)) { 266 cryptoapi_error("CryptGetHashParam failed"); 267 goto err; 268 } 269 270 if ((int) hash_size != flen) { 271 wpa_printf(MSG_INFO, "CryptoAPI: Invalid hash size (%u != %d)", 272 (unsigned) hash_size, flen); 273 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, 274 RSA_R_INVALID_MESSAGE_LENGTH); 275 goto err; 276 } 277 if (!CryptSetHashParam(hash, HP_HASHVAL, (BYTE * ) from, 0)) { 278 cryptoapi_error("CryptSetHashParam failed"); 279 goto err; 280 } 281 282 len = RSA_size(rsa); 283 buf = os_malloc(len); 284 if (buf == NULL) { 285 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, ERR_R_MALLOC_FAILURE); 286 goto err; 287 } 288 289 if (!CryptSignHash(hash, priv->key_spec, NULL, 0, buf, &len)) { 290 cryptoapi_error("CryptSignHash failed"); 291 goto err; 292 } 293 294 for (i = 0; i < len; i++) 295 to[i] = buf[len - i - 1]; 296 ret = len; 297 298 err: 299 os_free(buf); 300 CryptDestroyHash(hash); 301 302 return ret; 303 } 304 305 306 static int cryptoapi_rsa_priv_dec(int flen, const unsigned char *from, 307 unsigned char *to, RSA *rsa, int padding) 308 { 309 wpa_printf(MSG_DEBUG, "%s - not implemented", __func__); 310 return 0; 311 } 312 313 314 static void cryptoapi_free_data(struct cryptoapi_rsa_data *priv) 315 { 316 if (priv == NULL) 317 return; 318 if (priv->crypt_prov && priv->free_crypt_prov) 319 CryptReleaseContext(priv->crypt_prov, 0); 320 if (priv->cert) 321 CertFreeCertificateContext(priv->cert); 322 os_free(priv); 323 } 324 325 326 static int cryptoapi_finish(RSA *rsa) 327 { 328 cryptoapi_free_data((struct cryptoapi_rsa_data *) rsa->meth->app_data); 329 os_free((void *) rsa->meth); 330 rsa->meth = NULL; 331 return 1; 332 } 333 334 335 static const CERT_CONTEXT * cryptoapi_find_cert(const char *name, DWORD store) 336 { 337 HCERTSTORE cs; 338 const CERT_CONTEXT *ret = NULL; 339 340 cs = CertOpenStore((LPCSTR) CERT_STORE_PROV_SYSTEM, 0, 0, 341 store | CERT_STORE_OPEN_EXISTING_FLAG | 342 CERT_STORE_READONLY_FLAG, L"MY"); 343 if (cs == NULL) { 344 cryptoapi_error("Failed to open 'My system store'"); 345 return NULL; 346 } 347 348 if (strncmp(name, "cert://", 7) == 0) { 349 unsigned short wbuf[255]; 350 MultiByteToWideChar(CP_ACP, 0, name + 7, -1, wbuf, 255); 351 ret = CertFindCertificateInStore(cs, X509_ASN_ENCODING | 352 PKCS_7_ASN_ENCODING, 353 0, CERT_FIND_SUBJECT_STR, 354 wbuf, NULL); 355 } else if (strncmp(name, "hash://", 7) == 0) { 356 CRYPT_HASH_BLOB blob; 357 int len; 358 const char *hash = name + 7; 359 unsigned char *buf; 360 361 len = os_strlen(hash) / 2; 362 buf = os_malloc(len); 363 if (buf && hexstr2bin(hash, buf, len) == 0) { 364 blob.cbData = len; 365 blob.pbData = buf; 366 ret = CertFindCertificateInStore(cs, 367 X509_ASN_ENCODING | 368 PKCS_7_ASN_ENCODING, 369 0, CERT_FIND_HASH, 370 &blob, NULL); 371 } 372 os_free(buf); 373 } 374 375 CertCloseStore(cs, 0); 376 377 return ret; 378 } 379 380 381 static int tls_cryptoapi_cert(SSL *ssl, const char *name) 382 { 383 X509 *cert = NULL; 384 RSA *rsa = NULL, *pub_rsa; 385 struct cryptoapi_rsa_data *priv; 386 RSA_METHOD *rsa_meth; 387 388 if (name == NULL || 389 (strncmp(name, "cert://", 7) != 0 && 390 strncmp(name, "hash://", 7) != 0)) 391 return -1; 392 393 priv = os_zalloc(sizeof(*priv)); 394 rsa_meth = os_zalloc(sizeof(*rsa_meth)); 395 if (priv == NULL || rsa_meth == NULL) { 396 wpa_printf(MSG_WARNING, "CryptoAPI: Failed to allocate memory " 397 "for CryptoAPI RSA method"); 398 os_free(priv); 399 os_free(rsa_meth); 400 return -1; 401 } 402 403 priv->cert = cryptoapi_find_cert(name, CERT_SYSTEM_STORE_CURRENT_USER); 404 if (priv->cert == NULL) { 405 priv->cert = cryptoapi_find_cert( 406 name, CERT_SYSTEM_STORE_LOCAL_MACHINE); 407 } 408 if (priv->cert == NULL) { 409 wpa_printf(MSG_INFO, "CryptoAPI: Could not find certificate " 410 "'%s'", name); 411 goto err; 412 } 413 414 cert = d2i_X509(NULL, 415 (const unsigned char **) &priv->cert->pbCertEncoded, 416 priv->cert->cbCertEncoded); 417 if (cert == NULL) { 418 wpa_printf(MSG_INFO, "CryptoAPI: Could not process X509 DER " 419 "encoding"); 420 goto err; 421 } 422 423 if (!CryptAcquireCertificatePrivateKey(priv->cert, 424 CRYPT_ACQUIRE_COMPARE_KEY_FLAG, 425 NULL, &priv->crypt_prov, 426 &priv->key_spec, 427 &priv->free_crypt_prov)) { 428 cryptoapi_error("Failed to acquire a private key for the " 429 "certificate"); 430 goto err; 431 } 432 433 rsa_meth->name = "Microsoft CryptoAPI RSA Method"; 434 rsa_meth->rsa_pub_enc = cryptoapi_rsa_pub_enc; 435 rsa_meth->rsa_pub_dec = cryptoapi_rsa_pub_dec; 436 rsa_meth->rsa_priv_enc = cryptoapi_rsa_priv_enc; 437 rsa_meth->rsa_priv_dec = cryptoapi_rsa_priv_dec; 438 rsa_meth->finish = cryptoapi_finish; 439 rsa_meth->flags = RSA_METHOD_FLAG_NO_CHECK; 440 rsa_meth->app_data = (char *) priv; 441 442 rsa = RSA_new(); 443 if (rsa == NULL) { 444 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, 445 ERR_R_MALLOC_FAILURE); 446 goto err; 447 } 448 449 if (!SSL_use_certificate(ssl, cert)) { 450 RSA_free(rsa); 451 rsa = NULL; 452 goto err; 453 } 454 pub_rsa = cert->cert_info->key->pkey->pkey.rsa; 455 X509_free(cert); 456 cert = NULL; 457 458 rsa->n = BN_dup(pub_rsa->n); 459 rsa->e = BN_dup(pub_rsa->e); 460 if (!RSA_set_method(rsa, rsa_meth)) 461 goto err; 462 463 if (!SSL_use_RSAPrivateKey(ssl, rsa)) 464 goto err; 465 RSA_free(rsa); 466 467 return 0; 468 469 err: 470 if (cert) 471 X509_free(cert); 472 if (rsa) 473 RSA_free(rsa); 474 else { 475 os_free(rsa_meth); 476 cryptoapi_free_data(priv); 477 } 478 return -1; 479 } 480 481 482 static int tls_cryptoapi_ca_cert(SSL_CTX *ssl_ctx, SSL *ssl, const char *name) 483 { 484 HCERTSTORE cs; 485 PCCERT_CONTEXT ctx = NULL; 486 X509 *cert; 487 char buf[128]; 488 const char *store; 489 #ifdef UNICODE 490 WCHAR *wstore; 491 #endif /* UNICODE */ 492 493 if (name == NULL || strncmp(name, "cert_store://", 13) != 0) 494 return -1; 495 496 store = name + 13; 497 #ifdef UNICODE 498 wstore = os_malloc((os_strlen(store) + 1) * sizeof(WCHAR)); 499 if (wstore == NULL) 500 return -1; 501 wsprintf(wstore, L"%S", store); 502 cs = CertOpenSystemStore(0, wstore); 503 os_free(wstore); 504 #else /* UNICODE */ 505 cs = CertOpenSystemStore(0, store); 506 #endif /* UNICODE */ 507 if (cs == NULL) { 508 wpa_printf(MSG_DEBUG, "%s: failed to open system cert store " 509 "'%s': error=%d", __func__, store, 510 (int) GetLastError()); 511 return -1; 512 } 513 514 while ((ctx = CertEnumCertificatesInStore(cs, ctx))) { 515 cert = d2i_X509(NULL, 516 (const unsigned char **) &ctx->pbCertEncoded, 517 ctx->cbCertEncoded); 518 if (cert == NULL) { 519 wpa_printf(MSG_INFO, "CryptoAPI: Could not process " 520 "X509 DER encoding for CA cert"); 521 continue; 522 } 523 524 X509_NAME_oneline(X509_get_subject_name(cert), buf, 525 sizeof(buf)); 526 wpa_printf(MSG_DEBUG, "OpenSSL: Loaded CA certificate for " 527 "system certificate store: subject='%s'", buf); 528 529 if (!X509_STORE_add_cert(ssl_ctx->cert_store, cert)) { 530 tls_show_errors(MSG_WARNING, __func__, 531 "Failed to add ca_cert to OpenSSL " 532 "certificate store"); 533 } 534 535 X509_free(cert); 536 } 537 538 if (!CertCloseStore(cs, 0)) { 539 wpa_printf(MSG_DEBUG, "%s: failed to close system cert store " 540 "'%s': error=%d", __func__, name + 13, 541 (int) GetLastError()); 542 } 543 544 return 0; 545 } 546 547 548 #else /* CONFIG_NATIVE_WINDOWS */ 549 550 static int tls_cryptoapi_cert(SSL *ssl, const char *name) 551 { 552 return -1; 553 } 554 555 #endif /* CONFIG_NATIVE_WINDOWS */ 556 557 558 static void ssl_info_cb(const SSL *ssl, int where, int ret) 559 { 560 const char *str; 561 int w; 562 563 wpa_printf(MSG_DEBUG, "SSL: (where=0x%x ret=0x%x)", where, ret); 564 w = where & ~SSL_ST_MASK; 565 if (w & SSL_ST_CONNECT) 566 str = "SSL_connect"; 567 else if (w & SSL_ST_ACCEPT) 568 str = "SSL_accept"; 569 else 570 str = "undefined"; 571 572 if (where & SSL_CB_LOOP) { 573 wpa_printf(MSG_DEBUG, "SSL: %s:%s", 574 str, SSL_state_string_long(ssl)); 575 } else if (where & SSL_CB_ALERT) { 576 struct tls_connection *conn = SSL_get_app_data((SSL *) ssl); 577 wpa_printf(MSG_INFO, "SSL: SSL3 alert: %s:%s:%s", 578 where & SSL_CB_READ ? 579 "read (remote end reported an error)" : 580 "write (local SSL3 detected an error)", 581 SSL_alert_type_string_long(ret), 582 SSL_alert_desc_string_long(ret)); 583 if ((ret >> 8) == SSL3_AL_FATAL) { 584 if (where & SSL_CB_READ) 585 conn->read_alerts++; 586 else 587 conn->write_alerts++; 588 } 589 if (conn->context->event_cb != NULL) { 590 union tls_event_data ev; 591 struct tls_context *context = conn->context; 592 os_memset(&ev, 0, sizeof(ev)); 593 ev.alert.is_local = !(where & SSL_CB_READ); 594 ev.alert.type = SSL_alert_type_string_long(ret); 595 ev.alert.description = SSL_alert_desc_string_long(ret); 596 context->event_cb(context->cb_ctx, TLS_ALERT, &ev); 597 } 598 } else if (where & SSL_CB_EXIT && ret <= 0) { 599 wpa_printf(MSG_DEBUG, "SSL: %s:%s in %s", 600 str, ret == 0 ? "failed" : "error", 601 SSL_state_string_long(ssl)); 602 } 603 } 604 605 606 #ifndef OPENSSL_NO_ENGINE 607 /** 608 * tls_engine_load_dynamic_generic - load any openssl engine 609 * @pre: an array of commands and values that load an engine initialized 610 * in the engine specific function 611 * @post: an array of commands and values that initialize an already loaded 612 * engine (or %NULL if not required) 613 * @id: the engine id of the engine to load (only required if post is not %NULL 614 * 615 * This function is a generic function that loads any openssl engine. 616 * 617 * Returns: 0 on success, -1 on failure 618 */ 619 static int tls_engine_load_dynamic_generic(const char *pre[], 620 const char *post[], const char *id) 621 { 622 ENGINE *engine; 623 const char *dynamic_id = "dynamic"; 624 625 engine = ENGINE_by_id(id); 626 if (engine) { 627 ENGINE_free(engine); 628 wpa_printf(MSG_DEBUG, "ENGINE: engine '%s' is already " 629 "available", id); 630 return 0; 631 } 632 ERR_clear_error(); 633 634 engine = ENGINE_by_id(dynamic_id); 635 if (engine == NULL) { 636 wpa_printf(MSG_INFO, "ENGINE: Can't find engine %s [%s]", 637 dynamic_id, 638 ERR_error_string(ERR_get_error(), NULL)); 639 return -1; 640 } 641 642 /* Perform the pre commands. This will load the engine. */ 643 while (pre && pre[0]) { 644 wpa_printf(MSG_DEBUG, "ENGINE: '%s' '%s'", pre[0], pre[1]); 645 if (ENGINE_ctrl_cmd_string(engine, pre[0], pre[1], 0) == 0) { 646 wpa_printf(MSG_INFO, "ENGINE: ctrl cmd_string failed: " 647 "%s %s [%s]", pre[0], pre[1], 648 ERR_error_string(ERR_get_error(), NULL)); 649 ENGINE_free(engine); 650 return -1; 651 } 652 pre += 2; 653 } 654 655 /* 656 * Free the reference to the "dynamic" engine. The loaded engine can 657 * now be looked up using ENGINE_by_id(). 658 */ 659 ENGINE_free(engine); 660 661 engine = ENGINE_by_id(id); 662 if (engine == NULL) { 663 wpa_printf(MSG_INFO, "ENGINE: Can't find engine %s [%s]", 664 id, ERR_error_string(ERR_get_error(), NULL)); 665 return -1; 666 } 667 668 while (post && post[0]) { 669 wpa_printf(MSG_DEBUG, "ENGINE: '%s' '%s'", post[0], post[1]); 670 if (ENGINE_ctrl_cmd_string(engine, post[0], post[1], 0) == 0) { 671 wpa_printf(MSG_DEBUG, "ENGINE: ctrl cmd_string failed:" 672 " %s %s [%s]", post[0], post[1], 673 ERR_error_string(ERR_get_error(), NULL)); 674 ENGINE_remove(engine); 675 ENGINE_free(engine); 676 return -1; 677 } 678 post += 2; 679 } 680 ENGINE_free(engine); 681 682 return 0; 683 } 684 685 686 /** 687 * tls_engine_load_dynamic_pkcs11 - load the pkcs11 engine provided by opensc 688 * @pkcs11_so_path: pksc11_so_path from the configuration 689 * @pcks11_module_path: pkcs11_module_path from the configuration 690 */ 691 static int tls_engine_load_dynamic_pkcs11(const char *pkcs11_so_path, 692 const char *pkcs11_module_path) 693 { 694 char *engine_id = "pkcs11"; 695 const char *pre_cmd[] = { 696 "SO_PATH", NULL /* pkcs11_so_path */, 697 "ID", NULL /* engine_id */, 698 "LIST_ADD", "1", 699 /* "NO_VCHECK", "1", */ 700 "LOAD", NULL, 701 NULL, NULL 702 }; 703 const char *post_cmd[] = { 704 "MODULE_PATH", NULL /* pkcs11_module_path */, 705 NULL, NULL 706 }; 707 708 if (!pkcs11_so_path) 709 return 0; 710 711 pre_cmd[1] = pkcs11_so_path; 712 pre_cmd[3] = engine_id; 713 if (pkcs11_module_path) 714 post_cmd[1] = pkcs11_module_path; 715 else 716 post_cmd[0] = NULL; 717 718 wpa_printf(MSG_DEBUG, "ENGINE: Loading pkcs11 Engine from %s", 719 pkcs11_so_path); 720 721 return tls_engine_load_dynamic_generic(pre_cmd, post_cmd, engine_id); 722 } 723 724 725 /** 726 * tls_engine_load_dynamic_opensc - load the opensc engine provided by opensc 727 * @opensc_so_path: opensc_so_path from the configuration 728 */ 729 static int tls_engine_load_dynamic_opensc(const char *opensc_so_path) 730 { 731 char *engine_id = "opensc"; 732 const char *pre_cmd[] = { 733 "SO_PATH", NULL /* opensc_so_path */, 734 "ID", NULL /* engine_id */, 735 "LIST_ADD", "1", 736 "LOAD", NULL, 737 NULL, NULL 738 }; 739 740 if (!opensc_so_path) 741 return 0; 742 743 pre_cmd[1] = opensc_so_path; 744 pre_cmd[3] = engine_id; 745 746 wpa_printf(MSG_DEBUG, "ENGINE: Loading OpenSC Engine from %s", 747 opensc_so_path); 748 749 return tls_engine_load_dynamic_generic(pre_cmd, NULL, engine_id); 750 } 751 #endif /* OPENSSL_NO_ENGINE */ 752 753 754 static void remove_session_cb(SSL_CTX *ctx, SSL_SESSION *sess) 755 { 756 struct wpabuf *buf; 757 758 if (tls_ex_idx_session < 0) 759 return; 760 buf = SSL_SESSION_get_ex_data(sess, tls_ex_idx_session); 761 if (!buf) 762 return; 763 wpa_printf(MSG_DEBUG, 764 "OpenSSL: Free application session data %p (sess %p)", 765 buf, sess); 766 wpabuf_free(buf); 767 768 SSL_SESSION_set_ex_data(sess, tls_ex_idx_session, NULL); 769 } 770 771 772 void * tls_init(const struct tls_config *conf) 773 { 774 struct tls_data *data; 775 SSL_CTX *ssl; 776 struct tls_context *context; 777 const char *ciphers; 778 779 if (tls_openssl_ref_count == 0) { 780 tls_global = context = tls_context_new(conf); 781 if (context == NULL) 782 return NULL; 783 #ifdef CONFIG_FIPS 784 #ifdef OPENSSL_FIPS 785 if (conf && conf->fips_mode) { 786 static int fips_enabled = 0; 787 788 if (!fips_enabled && !FIPS_mode_set(1)) { 789 wpa_printf(MSG_ERROR, "Failed to enable FIPS " 790 "mode"); 791 ERR_load_crypto_strings(); 792 ERR_print_errors_fp(stderr); 793 os_free(tls_global); 794 tls_global = NULL; 795 return NULL; 796 } else { 797 wpa_printf(MSG_INFO, "Running in FIPS mode"); 798 fips_enabled = 1; 799 } 800 } 801 #else /* OPENSSL_FIPS */ 802 if (conf && conf->fips_mode) { 803 wpa_printf(MSG_ERROR, "FIPS mode requested, but not " 804 "supported"); 805 os_free(tls_global); 806 tls_global = NULL; 807 return NULL; 808 } 809 #endif /* OPENSSL_FIPS */ 810 #endif /* CONFIG_FIPS */ 811 SSL_load_error_strings(); 812 SSL_library_init(); 813 #ifndef OPENSSL_NO_SHA256 814 EVP_add_digest(EVP_sha256()); 815 #endif /* OPENSSL_NO_SHA256 */ 816 /* TODO: if /dev/urandom is available, PRNG is seeded 817 * automatically. If this is not the case, random data should 818 * be added here. */ 819 820 #ifdef PKCS12_FUNCS 821 #ifndef OPENSSL_NO_RC2 822 /* 823 * 40-bit RC2 is commonly used in PKCS#12 files, so enable it. 824 * This is enabled by PKCS12_PBE_add() in OpenSSL 0.9.8 825 * versions, but it looks like OpenSSL 1.0.0 does not do that 826 * anymore. 827 */ 828 EVP_add_cipher(EVP_rc2_40_cbc()); 829 #endif /* OPENSSL_NO_RC2 */ 830 PKCS12_PBE_add(); 831 #endif /* PKCS12_FUNCS */ 832 } else { 833 context = tls_context_new(conf); 834 if (context == NULL) 835 return NULL; 836 } 837 tls_openssl_ref_count++; 838 839 data = os_zalloc(sizeof(*data)); 840 if (data) 841 ssl = SSL_CTX_new(SSLv23_method()); 842 else 843 ssl = NULL; 844 if (ssl == NULL) { 845 tls_openssl_ref_count--; 846 if (context != tls_global) 847 os_free(context); 848 if (tls_openssl_ref_count == 0) { 849 os_free(tls_global); 850 tls_global = NULL; 851 } 852 return NULL; 853 } 854 data->ssl = ssl; 855 if (conf) 856 data->tls_session_lifetime = conf->tls_session_lifetime; 857 858 SSL_CTX_set_options(ssl, SSL_OP_NO_SSLv2); 859 SSL_CTX_set_options(ssl, SSL_OP_NO_SSLv3); 860 861 SSL_CTX_set_info_callback(ssl, ssl_info_cb); 862 SSL_CTX_set_app_data(ssl, context); 863 if (data->tls_session_lifetime > 0) { 864 SSL_CTX_set_quiet_shutdown(ssl, 1); 865 /* 866 * Set default context here. In practice, this will be replaced 867 * by the per-EAP method context in tls_connection_set_verify(). 868 */ 869 SSL_CTX_set_session_id_context(ssl, (u8 *) "hostapd", 7); 870 SSL_CTX_set_session_cache_mode(ssl, SSL_SESS_CACHE_SERVER); 871 SSL_CTX_set_timeout(ssl, data->tls_session_lifetime); 872 SSL_CTX_sess_set_remove_cb(ssl, remove_session_cb); 873 } else { 874 SSL_CTX_set_session_cache_mode(ssl, SSL_SESS_CACHE_OFF); 875 } 876 877 if (tls_ex_idx_session < 0) { 878 tls_ex_idx_session = SSL_SESSION_get_ex_new_index( 879 0, NULL, NULL, NULL, NULL); 880 if (tls_ex_idx_session < 0) { 881 tls_deinit(data); 882 return NULL; 883 } 884 } 885 886 #ifndef OPENSSL_NO_ENGINE 887 wpa_printf(MSG_DEBUG, "ENGINE: Loading dynamic engine"); 888 ERR_load_ENGINE_strings(); 889 ENGINE_load_dynamic(); 890 891 if (conf && 892 (conf->opensc_engine_path || conf->pkcs11_engine_path || 893 conf->pkcs11_module_path)) { 894 if (tls_engine_load_dynamic_opensc(conf->opensc_engine_path) || 895 tls_engine_load_dynamic_pkcs11(conf->pkcs11_engine_path, 896 conf->pkcs11_module_path)) { 897 tls_deinit(data); 898 return NULL; 899 } 900 } 901 #endif /* OPENSSL_NO_ENGINE */ 902 903 if (conf && conf->openssl_ciphers) 904 ciphers = conf->openssl_ciphers; 905 else 906 ciphers = "DEFAULT:!EXP:!LOW"; 907 if (SSL_CTX_set_cipher_list(ssl, ciphers) != 1) { 908 wpa_printf(MSG_ERROR, 909 "OpenSSL: Failed to set cipher string '%s'", 910 ciphers); 911 tls_deinit(data); 912 return NULL; 913 } 914 915 return data; 916 } 917 918 919 void tls_deinit(void *ssl_ctx) 920 { 921 struct tls_data *data = ssl_ctx; 922 SSL_CTX *ssl = data->ssl; 923 struct tls_context *context = SSL_CTX_get_app_data(ssl); 924 if (context != tls_global) 925 os_free(context); 926 if (data->tls_session_lifetime > 0) 927 SSL_CTX_flush_sessions(ssl, 0); 928 SSL_CTX_free(ssl); 929 930 tls_openssl_ref_count--; 931 if (tls_openssl_ref_count == 0) { 932 #ifndef OPENSSL_NO_ENGINE 933 ENGINE_cleanup(); 934 #endif /* OPENSSL_NO_ENGINE */ 935 CRYPTO_cleanup_all_ex_data(); 936 ERR_remove_thread_state(NULL); 937 ERR_free_strings(); 938 EVP_cleanup(); 939 os_free(tls_global->ocsp_stapling_response); 940 tls_global->ocsp_stapling_response = NULL; 941 os_free(tls_global); 942 tls_global = NULL; 943 } 944 945 os_free(data); 946 } 947 948 949 #ifndef OPENSSL_NO_ENGINE 950 951 /* Cryptoki return values */ 952 #define CKR_PIN_INCORRECT 0x000000a0 953 #define CKR_PIN_INVALID 0x000000a1 954 #define CKR_PIN_LEN_RANGE 0x000000a2 955 956 /* libp11 */ 957 #define ERR_LIB_PKCS11 ERR_LIB_USER 958 959 static int tls_is_pin_error(unsigned int err) 960 { 961 return ERR_GET_LIB(err) == ERR_LIB_PKCS11 && 962 (ERR_GET_REASON(err) == CKR_PIN_INCORRECT || 963 ERR_GET_REASON(err) == CKR_PIN_INVALID || 964 ERR_GET_REASON(err) == CKR_PIN_LEN_RANGE); 965 } 966 967 #endif /* OPENSSL_NO_ENGINE */ 968 969 970 static int tls_engine_init(struct tls_connection *conn, const char *engine_id, 971 const char *pin, const char *key_id, 972 const char *cert_id, const char *ca_cert_id) 973 { 974 #ifndef OPENSSL_NO_ENGINE 975 int ret = -1; 976 if (engine_id == NULL) { 977 wpa_printf(MSG_ERROR, "ENGINE: Engine ID not set"); 978 return -1; 979 } 980 981 ERR_clear_error(); 982 #ifdef ANDROID 983 ENGINE_load_dynamic(); 984 #endif 985 conn->engine = ENGINE_by_id(engine_id); 986 if (!conn->engine) { 987 wpa_printf(MSG_ERROR, "ENGINE: engine %s not available [%s]", 988 engine_id, ERR_error_string(ERR_get_error(), NULL)); 989 goto err; 990 } 991 if (ENGINE_init(conn->engine) != 1) { 992 wpa_printf(MSG_ERROR, "ENGINE: engine init failed " 993 "(engine: %s) [%s]", engine_id, 994 ERR_error_string(ERR_get_error(), NULL)); 995 goto err; 996 } 997 wpa_printf(MSG_DEBUG, "ENGINE: engine initialized"); 998 999 #ifndef ANDROID 1000 if (pin && ENGINE_ctrl_cmd_string(conn->engine, "PIN", pin, 0) == 0) { 1001 wpa_printf(MSG_ERROR, "ENGINE: cannot set pin [%s]", 1002 ERR_error_string(ERR_get_error(), NULL)); 1003 goto err; 1004 } 1005 #endif 1006 if (key_id) { 1007 /* 1008 * Ensure that the ENGINE does not attempt to use the OpenSSL 1009 * UI system to obtain a PIN, if we didn't provide one. 1010 */ 1011 struct { 1012 const void *password; 1013 const char *prompt_info; 1014 } key_cb = { "", NULL }; 1015 1016 /* load private key first in-case PIN is required for cert */ 1017 conn->private_key = ENGINE_load_private_key(conn->engine, 1018 key_id, NULL, 1019 &key_cb); 1020 if (!conn->private_key) { 1021 unsigned long err = ERR_get_error(); 1022 1023 wpa_printf(MSG_ERROR, 1024 "ENGINE: cannot load private key with id '%s' [%s]", 1025 key_id, 1026 ERR_error_string(err, NULL)); 1027 if (tls_is_pin_error(err)) 1028 ret = TLS_SET_PARAMS_ENGINE_PRV_BAD_PIN; 1029 else 1030 ret = TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED; 1031 goto err; 1032 } 1033 } 1034 1035 /* handle a certificate and/or CA certificate */ 1036 if (cert_id || ca_cert_id) { 1037 const char *cmd_name = "LOAD_CERT_CTRL"; 1038 1039 /* test if the engine supports a LOAD_CERT_CTRL */ 1040 if (!ENGINE_ctrl(conn->engine, ENGINE_CTRL_GET_CMD_FROM_NAME, 1041 0, (void *)cmd_name, NULL)) { 1042 wpa_printf(MSG_ERROR, "ENGINE: engine does not support" 1043 " loading certificates"); 1044 ret = TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED; 1045 goto err; 1046 } 1047 } 1048 1049 return 0; 1050 1051 err: 1052 if (conn->engine) { 1053 ENGINE_free(conn->engine); 1054 conn->engine = NULL; 1055 } 1056 1057 if (conn->private_key) { 1058 EVP_PKEY_free(conn->private_key); 1059 conn->private_key = NULL; 1060 } 1061 1062 return ret; 1063 #else /* OPENSSL_NO_ENGINE */ 1064 return 0; 1065 #endif /* OPENSSL_NO_ENGINE */ 1066 } 1067 1068 1069 static void tls_engine_deinit(struct tls_connection *conn) 1070 { 1071 #ifndef OPENSSL_NO_ENGINE 1072 wpa_printf(MSG_DEBUG, "ENGINE: engine deinit"); 1073 if (conn->private_key) { 1074 EVP_PKEY_free(conn->private_key); 1075 conn->private_key = NULL; 1076 } 1077 if (conn->engine) { 1078 ENGINE_finish(conn->engine); 1079 conn->engine = NULL; 1080 } 1081 #endif /* OPENSSL_NO_ENGINE */ 1082 } 1083 1084 1085 int tls_get_errors(void *ssl_ctx) 1086 { 1087 int count = 0; 1088 unsigned long err; 1089 1090 while ((err = ERR_get_error())) { 1091 wpa_printf(MSG_INFO, "TLS - SSL error: %s", 1092 ERR_error_string(err, NULL)); 1093 count++; 1094 } 1095 1096 return count; 1097 } 1098 1099 1100 static void tls_msg_cb(int write_p, int version, int content_type, 1101 const void *buf, size_t len, SSL *ssl, void *arg) 1102 { 1103 struct tls_connection *conn = arg; 1104 const u8 *pos = buf; 1105 1106 wpa_printf(MSG_DEBUG, "OpenSSL: %s ver=0x%x content_type=%d", 1107 write_p ? "TX" : "RX", version, content_type); 1108 wpa_hexdump_key(MSG_MSGDUMP, "OpenSSL: Message", buf, len); 1109 if (content_type == 24 && len >= 3 && pos[0] == 1) { 1110 size_t payload_len = WPA_GET_BE16(pos + 1); 1111 if (payload_len + 3 > len) { 1112 wpa_printf(MSG_ERROR, "OpenSSL: Heartbeat attack detected"); 1113 conn->invalid_hb_used = 1; 1114 } 1115 } 1116 } 1117 1118 1119 struct tls_connection * tls_connection_init(void *ssl_ctx) 1120 { 1121 struct tls_data *data = ssl_ctx; 1122 SSL_CTX *ssl = data->ssl; 1123 struct tls_connection *conn; 1124 long options; 1125 struct tls_context *context = SSL_CTX_get_app_data(ssl); 1126 1127 conn = os_zalloc(sizeof(*conn)); 1128 if (conn == NULL) 1129 return NULL; 1130 conn->ssl_ctx = ssl; 1131 conn->ssl = SSL_new(ssl); 1132 if (conn->ssl == NULL) { 1133 tls_show_errors(MSG_INFO, __func__, 1134 "Failed to initialize new SSL connection"); 1135 os_free(conn); 1136 return NULL; 1137 } 1138 1139 conn->context = context; 1140 SSL_set_app_data(conn->ssl, conn); 1141 SSL_set_msg_callback(conn->ssl, tls_msg_cb); 1142 SSL_set_msg_callback_arg(conn->ssl, conn); 1143 options = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | 1144 SSL_OP_SINGLE_DH_USE; 1145 #ifdef SSL_OP_NO_COMPRESSION 1146 options |= SSL_OP_NO_COMPRESSION; 1147 #endif /* SSL_OP_NO_COMPRESSION */ 1148 SSL_set_options(conn->ssl, options); 1149 1150 conn->ssl_in = BIO_new(BIO_s_mem()); 1151 if (!conn->ssl_in) { 1152 tls_show_errors(MSG_INFO, __func__, 1153 "Failed to create a new BIO for ssl_in"); 1154 SSL_free(conn->ssl); 1155 os_free(conn); 1156 return NULL; 1157 } 1158 1159 conn->ssl_out = BIO_new(BIO_s_mem()); 1160 if (!conn->ssl_out) { 1161 tls_show_errors(MSG_INFO, __func__, 1162 "Failed to create a new BIO for ssl_out"); 1163 SSL_free(conn->ssl); 1164 BIO_free(conn->ssl_in); 1165 os_free(conn); 1166 return NULL; 1167 } 1168 1169 SSL_set_bio(conn->ssl, conn->ssl_in, conn->ssl_out); 1170 1171 return conn; 1172 } 1173 1174 1175 void tls_connection_deinit(void *ssl_ctx, struct tls_connection *conn) 1176 { 1177 if (conn == NULL) 1178 return; 1179 if (conn->success_data) { 1180 /* 1181 * Make sure ssl_clear_bad_session() does not remove this 1182 * session. 1183 */ 1184 SSL_set_quiet_shutdown(conn->ssl, 1); 1185 SSL_shutdown(conn->ssl); 1186 } 1187 SSL_free(conn->ssl); 1188 tls_engine_deinit(conn); 1189 os_free(conn->subject_match); 1190 os_free(conn->altsubject_match); 1191 os_free(conn->suffix_match); 1192 os_free(conn->domain_match); 1193 os_free(conn->session_ticket); 1194 os_free(conn); 1195 } 1196 1197 1198 int tls_connection_established(void *ssl_ctx, struct tls_connection *conn) 1199 { 1200 return conn ? SSL_is_init_finished(conn->ssl) : 0; 1201 } 1202 1203 1204 int tls_connection_shutdown(void *ssl_ctx, struct tls_connection *conn) 1205 { 1206 if (conn == NULL) 1207 return -1; 1208 1209 /* Shutdown previous TLS connection without notifying the peer 1210 * because the connection was already terminated in practice 1211 * and "close notify" shutdown alert would confuse AS. */ 1212 SSL_set_quiet_shutdown(conn->ssl, 1); 1213 SSL_shutdown(conn->ssl); 1214 return SSL_clear(conn->ssl) == 1 ? 0 : -1; 1215 } 1216 1217 1218 static int tls_match_altsubject_component(X509 *cert, int type, 1219 const char *value, size_t len) 1220 { 1221 GENERAL_NAME *gen; 1222 void *ext; 1223 int found = 0; 1224 stack_index_t i; 1225 1226 ext = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL); 1227 1228 for (i = 0; ext && i < sk_GENERAL_NAME_num(ext); i++) { 1229 gen = sk_GENERAL_NAME_value(ext, i); 1230 if (gen->type != type) 1231 continue; 1232 if (os_strlen((char *) gen->d.ia5->data) == len && 1233 os_memcmp(value, gen->d.ia5->data, len) == 0) 1234 found++; 1235 } 1236 1237 return found; 1238 } 1239 1240 1241 static int tls_match_altsubject(X509 *cert, const char *match) 1242 { 1243 int type; 1244 const char *pos, *end; 1245 size_t len; 1246 1247 pos = match; 1248 do { 1249 if (os_strncmp(pos, "EMAIL:", 6) == 0) { 1250 type = GEN_EMAIL; 1251 pos += 6; 1252 } else if (os_strncmp(pos, "DNS:", 4) == 0) { 1253 type = GEN_DNS; 1254 pos += 4; 1255 } else if (os_strncmp(pos, "URI:", 4) == 0) { 1256 type = GEN_URI; 1257 pos += 4; 1258 } else { 1259 wpa_printf(MSG_INFO, "TLS: Invalid altSubjectName " 1260 "match '%s'", pos); 1261 return 0; 1262 } 1263 end = os_strchr(pos, ';'); 1264 while (end) { 1265 if (os_strncmp(end + 1, "EMAIL:", 6) == 0 || 1266 os_strncmp(end + 1, "DNS:", 4) == 0 || 1267 os_strncmp(end + 1, "URI:", 4) == 0) 1268 break; 1269 end = os_strchr(end + 1, ';'); 1270 } 1271 if (end) 1272 len = end - pos; 1273 else 1274 len = os_strlen(pos); 1275 if (tls_match_altsubject_component(cert, type, pos, len) > 0) 1276 return 1; 1277 pos = end + 1; 1278 } while (end); 1279 1280 return 0; 1281 } 1282 1283 1284 #ifndef CONFIG_NATIVE_WINDOWS 1285 static int domain_suffix_match(const u8 *val, size_t len, const char *match, 1286 int full) 1287 { 1288 size_t i, match_len; 1289 1290 /* Check for embedded nuls that could mess up suffix matching */ 1291 for (i = 0; i < len; i++) { 1292 if (val[i] == '\0') { 1293 wpa_printf(MSG_DEBUG, "TLS: Embedded null in a string - reject"); 1294 return 0; 1295 } 1296 } 1297 1298 match_len = os_strlen(match); 1299 if (match_len > len || (full && match_len != len)) 1300 return 0; 1301 1302 if (os_strncasecmp((const char *) val + len - match_len, match, 1303 match_len) != 0) 1304 return 0; /* no match */ 1305 1306 if (match_len == len) 1307 return 1; /* exact match */ 1308 1309 if (val[len - match_len - 1] == '.') 1310 return 1; /* full label match completes suffix match */ 1311 1312 wpa_printf(MSG_DEBUG, "TLS: Reject due to incomplete label match"); 1313 return 0; 1314 } 1315 #endif /* CONFIG_NATIVE_WINDOWS */ 1316 1317 1318 static int tls_match_suffix(X509 *cert, const char *match, int full) 1319 { 1320 #ifdef CONFIG_NATIVE_WINDOWS 1321 /* wincrypt.h has conflicting X509_NAME definition */ 1322 return -1; 1323 #else /* CONFIG_NATIVE_WINDOWS */ 1324 GENERAL_NAME *gen; 1325 void *ext; 1326 int i; 1327 stack_index_t j; 1328 int dns_name = 0; 1329 X509_NAME *name; 1330 1331 wpa_printf(MSG_DEBUG, "TLS: Match domain against %s%s", 1332 full ? "": "suffix ", match); 1333 1334 ext = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL); 1335 1336 for (j = 0; ext && j < sk_GENERAL_NAME_num(ext); j++) { 1337 gen = sk_GENERAL_NAME_value(ext, j); 1338 if (gen->type != GEN_DNS) 1339 continue; 1340 dns_name++; 1341 wpa_hexdump_ascii(MSG_DEBUG, "TLS: Certificate dNSName", 1342 gen->d.dNSName->data, 1343 gen->d.dNSName->length); 1344 if (domain_suffix_match(gen->d.dNSName->data, 1345 gen->d.dNSName->length, match, full) == 1346 1) { 1347 wpa_printf(MSG_DEBUG, "TLS: %s in dNSName found", 1348 full ? "Match" : "Suffix match"); 1349 return 1; 1350 } 1351 } 1352 1353 if (dns_name) { 1354 wpa_printf(MSG_DEBUG, "TLS: None of the dNSName(s) matched"); 1355 return 0; 1356 } 1357 1358 name = X509_get_subject_name(cert); 1359 i = -1; 1360 for (;;) { 1361 X509_NAME_ENTRY *e; 1362 ASN1_STRING *cn; 1363 1364 i = X509_NAME_get_index_by_NID(name, NID_commonName, i); 1365 if (i == -1) 1366 break; 1367 e = X509_NAME_get_entry(name, i); 1368 if (e == NULL) 1369 continue; 1370 cn = X509_NAME_ENTRY_get_data(e); 1371 if (cn == NULL) 1372 continue; 1373 wpa_hexdump_ascii(MSG_DEBUG, "TLS: Certificate commonName", 1374 cn->data, cn->length); 1375 if (domain_suffix_match(cn->data, cn->length, match, full) == 1) 1376 { 1377 wpa_printf(MSG_DEBUG, "TLS: %s in commonName found", 1378 full ? "Match" : "Suffix match"); 1379 return 1; 1380 } 1381 } 1382 1383 wpa_printf(MSG_DEBUG, "TLS: No CommonName %smatch found", 1384 full ? "": "suffix "); 1385 return 0; 1386 #endif /* CONFIG_NATIVE_WINDOWS */ 1387 } 1388 1389 1390 static enum tls_fail_reason openssl_tls_fail_reason(int err) 1391 { 1392 switch (err) { 1393 case X509_V_ERR_CERT_REVOKED: 1394 return TLS_FAIL_REVOKED; 1395 case X509_V_ERR_CERT_NOT_YET_VALID: 1396 case X509_V_ERR_CRL_NOT_YET_VALID: 1397 return TLS_FAIL_NOT_YET_VALID; 1398 case X509_V_ERR_CERT_HAS_EXPIRED: 1399 case X509_V_ERR_CRL_HAS_EXPIRED: 1400 return TLS_FAIL_EXPIRED; 1401 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT: 1402 case X509_V_ERR_UNABLE_TO_GET_CRL: 1403 case X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER: 1404 case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN: 1405 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY: 1406 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT: 1407 case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE: 1408 case X509_V_ERR_CERT_CHAIN_TOO_LONG: 1409 case X509_V_ERR_PATH_LENGTH_EXCEEDED: 1410 case X509_V_ERR_INVALID_CA: 1411 return TLS_FAIL_UNTRUSTED; 1412 case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE: 1413 case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE: 1414 case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY: 1415 case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD: 1416 case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD: 1417 case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD: 1418 case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD: 1419 case X509_V_ERR_CERT_UNTRUSTED: 1420 case X509_V_ERR_CERT_REJECTED: 1421 return TLS_FAIL_BAD_CERTIFICATE; 1422 default: 1423 return TLS_FAIL_UNSPECIFIED; 1424 } 1425 } 1426 1427 1428 static struct wpabuf * get_x509_cert(X509 *cert) 1429 { 1430 struct wpabuf *buf; 1431 u8 *tmp; 1432 1433 int cert_len = i2d_X509(cert, NULL); 1434 if (cert_len <= 0) 1435 return NULL; 1436 1437 buf = wpabuf_alloc(cert_len); 1438 if (buf == NULL) 1439 return NULL; 1440 1441 tmp = wpabuf_put(buf, cert_len); 1442 i2d_X509(cert, &tmp); 1443 return buf; 1444 } 1445 1446 1447 static void openssl_tls_fail_event(struct tls_connection *conn, 1448 X509 *err_cert, int err, int depth, 1449 const char *subject, const char *err_str, 1450 enum tls_fail_reason reason) 1451 { 1452 union tls_event_data ev; 1453 struct wpabuf *cert = NULL; 1454 struct tls_context *context = conn->context; 1455 1456 if (context->event_cb == NULL) 1457 return; 1458 1459 cert = get_x509_cert(err_cert); 1460 os_memset(&ev, 0, sizeof(ev)); 1461 ev.cert_fail.reason = reason != TLS_FAIL_UNSPECIFIED ? 1462 reason : openssl_tls_fail_reason(err); 1463 ev.cert_fail.depth = depth; 1464 ev.cert_fail.subject = subject; 1465 ev.cert_fail.reason_txt = err_str; 1466 ev.cert_fail.cert = cert; 1467 context->event_cb(context->cb_ctx, TLS_CERT_CHAIN_FAILURE, &ev); 1468 wpabuf_free(cert); 1469 } 1470 1471 1472 static void openssl_tls_cert_event(struct tls_connection *conn, 1473 X509 *err_cert, int depth, 1474 const char *subject) 1475 { 1476 struct wpabuf *cert = NULL; 1477 union tls_event_data ev; 1478 struct tls_context *context = conn->context; 1479 char *altsubject[TLS_MAX_ALT_SUBJECT]; 1480 int alt, num_altsubject = 0; 1481 GENERAL_NAME *gen; 1482 void *ext; 1483 stack_index_t i; 1484 #ifdef CONFIG_SHA256 1485 u8 hash[32]; 1486 #endif /* CONFIG_SHA256 */ 1487 1488 if (context->event_cb == NULL) 1489 return; 1490 1491 os_memset(&ev, 0, sizeof(ev)); 1492 if (conn->cert_probe || context->cert_in_cb) { 1493 cert = get_x509_cert(err_cert); 1494 ev.peer_cert.cert = cert; 1495 } 1496 #ifdef CONFIG_SHA256 1497 if (cert) { 1498 const u8 *addr[1]; 1499 size_t len[1]; 1500 addr[0] = wpabuf_head(cert); 1501 len[0] = wpabuf_len(cert); 1502 if (sha256_vector(1, addr, len, hash) == 0) { 1503 ev.peer_cert.hash = hash; 1504 ev.peer_cert.hash_len = sizeof(hash); 1505 } 1506 } 1507 #endif /* CONFIG_SHA256 */ 1508 ev.peer_cert.depth = depth; 1509 ev.peer_cert.subject = subject; 1510 1511 ext = X509_get_ext_d2i(err_cert, NID_subject_alt_name, NULL, NULL); 1512 for (i = 0; ext && i < sk_GENERAL_NAME_num(ext); i++) { 1513 char *pos; 1514 1515 if (num_altsubject == TLS_MAX_ALT_SUBJECT) 1516 break; 1517 gen = sk_GENERAL_NAME_value(ext, i); 1518 if (gen->type != GEN_EMAIL && 1519 gen->type != GEN_DNS && 1520 gen->type != GEN_URI) 1521 continue; 1522 1523 pos = os_malloc(10 + gen->d.ia5->length + 1); 1524 if (pos == NULL) 1525 break; 1526 altsubject[num_altsubject++] = pos; 1527 1528 switch (gen->type) { 1529 case GEN_EMAIL: 1530 os_memcpy(pos, "EMAIL:", 6); 1531 pos += 6; 1532 break; 1533 case GEN_DNS: 1534 os_memcpy(pos, "DNS:", 4); 1535 pos += 4; 1536 break; 1537 case GEN_URI: 1538 os_memcpy(pos, "URI:", 4); 1539 pos += 4; 1540 break; 1541 } 1542 1543 os_memcpy(pos, gen->d.ia5->data, gen->d.ia5->length); 1544 pos += gen->d.ia5->length; 1545 *pos = '\0'; 1546 } 1547 1548 for (alt = 0; alt < num_altsubject; alt++) 1549 ev.peer_cert.altsubject[alt] = altsubject[alt]; 1550 ev.peer_cert.num_altsubject = num_altsubject; 1551 1552 context->event_cb(context->cb_ctx, TLS_PEER_CERTIFICATE, &ev); 1553 wpabuf_free(cert); 1554 for (alt = 0; alt < num_altsubject; alt++) 1555 os_free(altsubject[alt]); 1556 } 1557 1558 1559 static int tls_verify_cb(int preverify_ok, X509_STORE_CTX *x509_ctx) 1560 { 1561 char buf[256]; 1562 X509 *err_cert; 1563 int err, depth; 1564 SSL *ssl; 1565 struct tls_connection *conn; 1566 struct tls_context *context; 1567 char *match, *altmatch, *suffix_match, *domain_match; 1568 const char *err_str; 1569 1570 err_cert = X509_STORE_CTX_get_current_cert(x509_ctx); 1571 if (!err_cert) 1572 return 0; 1573 1574 err = X509_STORE_CTX_get_error(x509_ctx); 1575 depth = X509_STORE_CTX_get_error_depth(x509_ctx); 1576 ssl = X509_STORE_CTX_get_ex_data(x509_ctx, 1577 SSL_get_ex_data_X509_STORE_CTX_idx()); 1578 X509_NAME_oneline(X509_get_subject_name(err_cert), buf, sizeof(buf)); 1579 1580 conn = SSL_get_app_data(ssl); 1581 if (conn == NULL) 1582 return 0; 1583 1584 if (depth == 0) 1585 conn->peer_cert = err_cert; 1586 else if (depth == 1) 1587 conn->peer_issuer = err_cert; 1588 else if (depth == 2) 1589 conn->peer_issuer_issuer = err_cert; 1590 1591 context = conn->context; 1592 match = conn->subject_match; 1593 altmatch = conn->altsubject_match; 1594 suffix_match = conn->suffix_match; 1595 domain_match = conn->domain_match; 1596 1597 if (!preverify_ok && !conn->ca_cert_verify) 1598 preverify_ok = 1; 1599 if (!preverify_ok && depth > 0 && conn->server_cert_only) 1600 preverify_ok = 1; 1601 if (!preverify_ok && (conn->flags & TLS_CONN_DISABLE_TIME_CHECKS) && 1602 (err == X509_V_ERR_CERT_HAS_EXPIRED || 1603 err == X509_V_ERR_CERT_NOT_YET_VALID)) { 1604 wpa_printf(MSG_DEBUG, "OpenSSL: Ignore certificate validity " 1605 "time mismatch"); 1606 preverify_ok = 1; 1607 } 1608 1609 err_str = X509_verify_cert_error_string(err); 1610 1611 #ifdef CONFIG_SHA256 1612 /* 1613 * Do not require preverify_ok so we can explicity allow otherwise 1614 * invalid pinned server certificates. 1615 */ 1616 if (depth == 0 && conn->server_cert_only) { 1617 struct wpabuf *cert; 1618 cert = get_x509_cert(err_cert); 1619 if (!cert) { 1620 wpa_printf(MSG_DEBUG, "OpenSSL: Could not fetch " 1621 "server certificate data"); 1622 preverify_ok = 0; 1623 } else { 1624 u8 hash[32]; 1625 const u8 *addr[1]; 1626 size_t len[1]; 1627 addr[0] = wpabuf_head(cert); 1628 len[0] = wpabuf_len(cert); 1629 if (sha256_vector(1, addr, len, hash) < 0 || 1630 os_memcmp(conn->srv_cert_hash, hash, 32) != 0) { 1631 err_str = "Server certificate mismatch"; 1632 err = X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN; 1633 preverify_ok = 0; 1634 } else if (!preverify_ok) { 1635 /* 1636 * Certificate matches pinned certificate, allow 1637 * regardless of other problems. 1638 */ 1639 wpa_printf(MSG_DEBUG, 1640 "OpenSSL: Ignore validation issues for a pinned server certificate"); 1641 preverify_ok = 1; 1642 } 1643 wpabuf_free(cert); 1644 } 1645 } 1646 #endif /* CONFIG_SHA256 */ 1647 1648 if (!preverify_ok) { 1649 wpa_printf(MSG_WARNING, "TLS: Certificate verification failed," 1650 " error %d (%s) depth %d for '%s'", err, err_str, 1651 depth, buf); 1652 openssl_tls_fail_event(conn, err_cert, err, depth, buf, 1653 err_str, TLS_FAIL_UNSPECIFIED); 1654 return preverify_ok; 1655 } 1656 1657 wpa_printf(MSG_DEBUG, "TLS: tls_verify_cb - preverify_ok=%d " 1658 "err=%d (%s) ca_cert_verify=%d depth=%d buf='%s'", 1659 preverify_ok, err, err_str, 1660 conn->ca_cert_verify, depth, buf); 1661 if (depth == 0 && match && os_strstr(buf, match) == NULL) { 1662 wpa_printf(MSG_WARNING, "TLS: Subject '%s' did not " 1663 "match with '%s'", buf, match); 1664 preverify_ok = 0; 1665 openssl_tls_fail_event(conn, err_cert, err, depth, buf, 1666 "Subject mismatch", 1667 TLS_FAIL_SUBJECT_MISMATCH); 1668 } else if (depth == 0 && altmatch && 1669 !tls_match_altsubject(err_cert, altmatch)) { 1670 wpa_printf(MSG_WARNING, "TLS: altSubjectName match " 1671 "'%s' not found", altmatch); 1672 preverify_ok = 0; 1673 openssl_tls_fail_event(conn, err_cert, err, depth, buf, 1674 "AltSubject mismatch", 1675 TLS_FAIL_ALTSUBJECT_MISMATCH); 1676 } else if (depth == 0 && suffix_match && 1677 !tls_match_suffix(err_cert, suffix_match, 0)) { 1678 wpa_printf(MSG_WARNING, "TLS: Domain suffix match '%s' not found", 1679 suffix_match); 1680 preverify_ok = 0; 1681 openssl_tls_fail_event(conn, err_cert, err, depth, buf, 1682 "Domain suffix mismatch", 1683 TLS_FAIL_DOMAIN_SUFFIX_MISMATCH); 1684 } else if (depth == 0 && domain_match && 1685 !tls_match_suffix(err_cert, domain_match, 1)) { 1686 wpa_printf(MSG_WARNING, "TLS: Domain match '%s' not found", 1687 domain_match); 1688 preverify_ok = 0; 1689 openssl_tls_fail_event(conn, err_cert, err, depth, buf, 1690 "Domain mismatch", 1691 TLS_FAIL_DOMAIN_MISMATCH); 1692 } else 1693 openssl_tls_cert_event(conn, err_cert, depth, buf); 1694 1695 if (conn->cert_probe && preverify_ok && depth == 0) { 1696 wpa_printf(MSG_DEBUG, "OpenSSL: Reject server certificate " 1697 "on probe-only run"); 1698 preverify_ok = 0; 1699 openssl_tls_fail_event(conn, err_cert, err, depth, buf, 1700 "Server certificate chain probe", 1701 TLS_FAIL_SERVER_CHAIN_PROBE); 1702 } 1703 1704 if (preverify_ok && context->event_cb != NULL) 1705 context->event_cb(context->cb_ctx, 1706 TLS_CERT_CHAIN_SUCCESS, NULL); 1707 1708 return preverify_ok; 1709 } 1710 1711 1712 #ifndef OPENSSL_NO_STDIO 1713 static int tls_load_ca_der(struct tls_data *data, const char *ca_cert) 1714 { 1715 SSL_CTX *ssl_ctx = data->ssl; 1716 X509_LOOKUP *lookup; 1717 int ret = 0; 1718 1719 lookup = X509_STORE_add_lookup(SSL_CTX_get_cert_store(ssl_ctx), 1720 X509_LOOKUP_file()); 1721 if (lookup == NULL) { 1722 tls_show_errors(MSG_WARNING, __func__, 1723 "Failed add lookup for X509 store"); 1724 return -1; 1725 } 1726 1727 if (!X509_LOOKUP_load_file(lookup, ca_cert, X509_FILETYPE_ASN1)) { 1728 unsigned long err = ERR_peek_error(); 1729 tls_show_errors(MSG_WARNING, __func__, 1730 "Failed load CA in DER format"); 1731 if (ERR_GET_LIB(err) == ERR_LIB_X509 && 1732 ERR_GET_REASON(err) == X509_R_CERT_ALREADY_IN_HASH_TABLE) { 1733 wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring " 1734 "cert already in hash table error", 1735 __func__); 1736 } else 1737 ret = -1; 1738 } 1739 1740 return ret; 1741 } 1742 #endif /* OPENSSL_NO_STDIO */ 1743 1744 1745 static int tls_connection_ca_cert(struct tls_data *data, 1746 struct tls_connection *conn, 1747 const char *ca_cert, const u8 *ca_cert_blob, 1748 size_t ca_cert_blob_len, const char *ca_path) 1749 { 1750 SSL_CTX *ssl_ctx = data->ssl; 1751 X509_STORE *store; 1752 1753 /* 1754 * Remove previously configured trusted CA certificates before adding 1755 * new ones. 1756 */ 1757 store = X509_STORE_new(); 1758 if (store == NULL) { 1759 wpa_printf(MSG_DEBUG, "OpenSSL: %s - failed to allocate new " 1760 "certificate store", __func__); 1761 return -1; 1762 } 1763 SSL_CTX_set_cert_store(ssl_ctx, store); 1764 1765 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb); 1766 conn->ca_cert_verify = 1; 1767 1768 if (ca_cert && os_strncmp(ca_cert, "probe://", 8) == 0) { 1769 wpa_printf(MSG_DEBUG, "OpenSSL: Probe for server certificate " 1770 "chain"); 1771 conn->cert_probe = 1; 1772 conn->ca_cert_verify = 0; 1773 return 0; 1774 } 1775 1776 if (ca_cert && os_strncmp(ca_cert, "hash://", 7) == 0) { 1777 #ifdef CONFIG_SHA256 1778 const char *pos = ca_cert + 7; 1779 if (os_strncmp(pos, "server/sha256/", 14) != 0) { 1780 wpa_printf(MSG_DEBUG, "OpenSSL: Unsupported ca_cert " 1781 "hash value '%s'", ca_cert); 1782 return -1; 1783 } 1784 pos += 14; 1785 if (os_strlen(pos) != 32 * 2) { 1786 wpa_printf(MSG_DEBUG, "OpenSSL: Unexpected SHA256 " 1787 "hash length in ca_cert '%s'", ca_cert); 1788 return -1; 1789 } 1790 if (hexstr2bin(pos, conn->srv_cert_hash, 32) < 0) { 1791 wpa_printf(MSG_DEBUG, "OpenSSL: Invalid SHA256 hash " 1792 "value in ca_cert '%s'", ca_cert); 1793 return -1; 1794 } 1795 conn->server_cert_only = 1; 1796 wpa_printf(MSG_DEBUG, "OpenSSL: Checking only server " 1797 "certificate match"); 1798 return 0; 1799 #else /* CONFIG_SHA256 */ 1800 wpa_printf(MSG_INFO, "No SHA256 included in the build - " 1801 "cannot validate server certificate hash"); 1802 return -1; 1803 #endif /* CONFIG_SHA256 */ 1804 } 1805 1806 if (ca_cert_blob) { 1807 X509 *cert = d2i_X509(NULL, 1808 (const unsigned char **) &ca_cert_blob, 1809 ca_cert_blob_len); 1810 if (cert == NULL) { 1811 tls_show_errors(MSG_WARNING, __func__, 1812 "Failed to parse ca_cert_blob"); 1813 return -1; 1814 } 1815 1816 if (!X509_STORE_add_cert(SSL_CTX_get_cert_store(ssl_ctx), 1817 cert)) { 1818 unsigned long err = ERR_peek_error(); 1819 tls_show_errors(MSG_WARNING, __func__, 1820 "Failed to add ca_cert_blob to " 1821 "certificate store"); 1822 if (ERR_GET_LIB(err) == ERR_LIB_X509 && 1823 ERR_GET_REASON(err) == 1824 X509_R_CERT_ALREADY_IN_HASH_TABLE) { 1825 wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring " 1826 "cert already in hash table error", 1827 __func__); 1828 } else { 1829 X509_free(cert); 1830 return -1; 1831 } 1832 } 1833 X509_free(cert); 1834 wpa_printf(MSG_DEBUG, "OpenSSL: %s - added ca_cert_blob " 1835 "to certificate store", __func__); 1836 return 0; 1837 } 1838 1839 #ifdef ANDROID 1840 if (ca_cert && os_strncmp("keystore://", ca_cert, 11) == 0) { 1841 BIO *bio = BIO_from_keystore(&ca_cert[11]); 1842 STACK_OF(X509_INFO) *stack = NULL; 1843 stack_index_t i; 1844 1845 if (bio) { 1846 stack = PEM_X509_INFO_read_bio(bio, NULL, NULL, NULL); 1847 BIO_free(bio); 1848 } 1849 if (!stack) 1850 return -1; 1851 1852 for (i = 0; i < sk_X509_INFO_num(stack); ++i) { 1853 X509_INFO *info = sk_X509_INFO_value(stack, i); 1854 if (info->x509) { 1855 X509_STORE_add_cert(ssl_ctx->cert_store, 1856 info->x509); 1857 } 1858 if (info->crl) { 1859 X509_STORE_add_crl(ssl_ctx->cert_store, 1860 info->crl); 1861 } 1862 } 1863 sk_X509_INFO_pop_free(stack, X509_INFO_free); 1864 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb); 1865 return 0; 1866 } 1867 #endif /* ANDROID */ 1868 1869 #ifdef CONFIG_NATIVE_WINDOWS 1870 if (ca_cert && tls_cryptoapi_ca_cert(ssl_ctx, conn->ssl, ca_cert) == 1871 0) { 1872 wpa_printf(MSG_DEBUG, "OpenSSL: Added CA certificates from " 1873 "system certificate store"); 1874 return 0; 1875 } 1876 #endif /* CONFIG_NATIVE_WINDOWS */ 1877 1878 if (ca_cert || ca_path) { 1879 #ifndef OPENSSL_NO_STDIO 1880 if (SSL_CTX_load_verify_locations(ssl_ctx, ca_cert, ca_path) != 1881 1) { 1882 tls_show_errors(MSG_WARNING, __func__, 1883 "Failed to load root certificates"); 1884 if (ca_cert && 1885 tls_load_ca_der(data, ca_cert) == 0) { 1886 wpa_printf(MSG_DEBUG, "OpenSSL: %s - loaded " 1887 "DER format CA certificate", 1888 __func__); 1889 } else 1890 return -1; 1891 } else { 1892 wpa_printf(MSG_DEBUG, "TLS: Trusted root " 1893 "certificate(s) loaded"); 1894 tls_get_errors(data); 1895 } 1896 #else /* OPENSSL_NO_STDIO */ 1897 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", 1898 __func__); 1899 return -1; 1900 #endif /* OPENSSL_NO_STDIO */ 1901 } else { 1902 /* No ca_cert configured - do not try to verify server 1903 * certificate */ 1904 conn->ca_cert_verify = 0; 1905 } 1906 1907 return 0; 1908 } 1909 1910 1911 static int tls_global_ca_cert(struct tls_data *data, const char *ca_cert) 1912 { 1913 SSL_CTX *ssl_ctx = data->ssl; 1914 1915 if (ca_cert) { 1916 if (SSL_CTX_load_verify_locations(ssl_ctx, ca_cert, NULL) != 1) 1917 { 1918 tls_show_errors(MSG_WARNING, __func__, 1919 "Failed to load root certificates"); 1920 return -1; 1921 } 1922 1923 wpa_printf(MSG_DEBUG, "TLS: Trusted root " 1924 "certificate(s) loaded"); 1925 1926 #ifndef OPENSSL_NO_STDIO 1927 /* Add the same CAs to the client certificate requests */ 1928 SSL_CTX_set_client_CA_list(ssl_ctx, 1929 SSL_load_client_CA_file(ca_cert)); 1930 #endif /* OPENSSL_NO_STDIO */ 1931 } 1932 1933 return 0; 1934 } 1935 1936 1937 int tls_global_set_verify(void *ssl_ctx, int check_crl) 1938 { 1939 int flags; 1940 1941 if (check_crl) { 1942 struct tls_data *data = ssl_ctx; 1943 X509_STORE *cs = SSL_CTX_get_cert_store(data->ssl); 1944 if (cs == NULL) { 1945 tls_show_errors(MSG_INFO, __func__, "Failed to get " 1946 "certificate store when enabling " 1947 "check_crl"); 1948 return -1; 1949 } 1950 flags = X509_V_FLAG_CRL_CHECK; 1951 if (check_crl == 2) 1952 flags |= X509_V_FLAG_CRL_CHECK_ALL; 1953 X509_STORE_set_flags(cs, flags); 1954 } 1955 return 0; 1956 } 1957 1958 1959 static int tls_connection_set_subject_match(struct tls_connection *conn, 1960 const char *subject_match, 1961 const char *altsubject_match, 1962 const char *suffix_match, 1963 const char *domain_match) 1964 { 1965 os_free(conn->subject_match); 1966 conn->subject_match = NULL; 1967 if (subject_match) { 1968 conn->subject_match = os_strdup(subject_match); 1969 if (conn->subject_match == NULL) 1970 return -1; 1971 } 1972 1973 os_free(conn->altsubject_match); 1974 conn->altsubject_match = NULL; 1975 if (altsubject_match) { 1976 conn->altsubject_match = os_strdup(altsubject_match); 1977 if (conn->altsubject_match == NULL) 1978 return -1; 1979 } 1980 1981 os_free(conn->suffix_match); 1982 conn->suffix_match = NULL; 1983 if (suffix_match) { 1984 conn->suffix_match = os_strdup(suffix_match); 1985 if (conn->suffix_match == NULL) 1986 return -1; 1987 } 1988 1989 os_free(conn->domain_match); 1990 conn->domain_match = NULL; 1991 if (domain_match) { 1992 conn->domain_match = os_strdup(domain_match); 1993 if (conn->domain_match == NULL) 1994 return -1; 1995 } 1996 1997 return 0; 1998 } 1999 2000 2001 static void tls_set_conn_flags(SSL *ssl, unsigned int flags) 2002 { 2003 #ifdef SSL_OP_NO_TICKET 2004 if (flags & TLS_CONN_DISABLE_SESSION_TICKET) 2005 SSL_set_options(ssl, SSL_OP_NO_TICKET); 2006 #ifdef SSL_clear_options 2007 else 2008 SSL_clear_options(ssl, SSL_OP_NO_TICKET); 2009 #endif /* SSL_clear_options */ 2010 #endif /* SSL_OP_NO_TICKET */ 2011 2012 #ifdef SSL_OP_NO_TLSv1 2013 if (flags & TLS_CONN_DISABLE_TLSv1_0) 2014 SSL_set_options(ssl, SSL_OP_NO_TLSv1); 2015 else 2016 SSL_clear_options(ssl, SSL_OP_NO_TLSv1); 2017 #endif /* SSL_OP_NO_TLSv1 */ 2018 #ifdef SSL_OP_NO_TLSv1_1 2019 if (flags & TLS_CONN_DISABLE_TLSv1_1) 2020 SSL_set_options(ssl, SSL_OP_NO_TLSv1_1); 2021 else 2022 SSL_clear_options(ssl, SSL_OP_NO_TLSv1_1); 2023 #endif /* SSL_OP_NO_TLSv1_1 */ 2024 #ifdef SSL_OP_NO_TLSv1_2 2025 if (flags & TLS_CONN_DISABLE_TLSv1_2) 2026 SSL_set_options(ssl, SSL_OP_NO_TLSv1_2); 2027 else 2028 SSL_clear_options(ssl, SSL_OP_NO_TLSv1_2); 2029 #endif /* SSL_OP_NO_TLSv1_2 */ 2030 } 2031 2032 2033 int tls_connection_set_verify(void *ssl_ctx, struct tls_connection *conn, 2034 int verify_peer, unsigned int flags, 2035 const u8 *session_ctx, size_t session_ctx_len) 2036 { 2037 static int counter = 0; 2038 struct tls_data *data = ssl_ctx; 2039 2040 if (conn == NULL) 2041 return -1; 2042 2043 if (verify_peer) { 2044 conn->ca_cert_verify = 1; 2045 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER | 2046 SSL_VERIFY_FAIL_IF_NO_PEER_CERT | 2047 SSL_VERIFY_CLIENT_ONCE, tls_verify_cb); 2048 } else { 2049 conn->ca_cert_verify = 0; 2050 SSL_set_verify(conn->ssl, SSL_VERIFY_NONE, NULL); 2051 } 2052 2053 tls_set_conn_flags(conn->ssl, flags); 2054 conn->flags = flags; 2055 2056 SSL_set_accept_state(conn->ssl); 2057 2058 if (data->tls_session_lifetime == 0) { 2059 /* 2060 * Set session id context to a unique value to make sure 2061 * session resumption cannot be used either through session 2062 * caching or TLS ticket extension. 2063 */ 2064 counter++; 2065 SSL_set_session_id_context(conn->ssl, 2066 (const unsigned char *) &counter, 2067 sizeof(counter)); 2068 } else if (session_ctx) { 2069 SSL_set_session_id_context(conn->ssl, session_ctx, 2070 session_ctx_len); 2071 } 2072 2073 return 0; 2074 } 2075 2076 2077 static int tls_connection_client_cert(struct tls_connection *conn, 2078 const char *client_cert, 2079 const u8 *client_cert_blob, 2080 size_t client_cert_blob_len) 2081 { 2082 if (client_cert == NULL && client_cert_blob == NULL) 2083 return 0; 2084 2085 if (client_cert_blob && 2086 SSL_use_certificate_ASN1(conn->ssl, (u8 *) client_cert_blob, 2087 client_cert_blob_len) == 1) { 2088 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_ASN1 --> " 2089 "OK"); 2090 return 0; 2091 } else if (client_cert_blob) { 2092 tls_show_errors(MSG_DEBUG, __func__, 2093 "SSL_use_certificate_ASN1 failed"); 2094 } 2095 2096 if (client_cert == NULL) 2097 return -1; 2098 2099 #ifdef ANDROID 2100 if (os_strncmp("keystore://", client_cert, 11) == 0) { 2101 BIO *bio = BIO_from_keystore(&client_cert[11]); 2102 X509 *x509 = NULL; 2103 int ret = -1; 2104 if (bio) { 2105 x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL); 2106 BIO_free(bio); 2107 } 2108 if (x509) { 2109 if (SSL_use_certificate(conn->ssl, x509) == 1) 2110 ret = 0; 2111 X509_free(x509); 2112 } 2113 return ret; 2114 } 2115 #endif /* ANDROID */ 2116 2117 #ifndef OPENSSL_NO_STDIO 2118 if (SSL_use_certificate_file(conn->ssl, client_cert, 2119 SSL_FILETYPE_ASN1) == 1) { 2120 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_file (DER)" 2121 " --> OK"); 2122 return 0; 2123 } 2124 2125 if (SSL_use_certificate_file(conn->ssl, client_cert, 2126 SSL_FILETYPE_PEM) == 1) { 2127 ERR_clear_error(); 2128 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_file (PEM)" 2129 " --> OK"); 2130 return 0; 2131 } 2132 2133 tls_show_errors(MSG_DEBUG, __func__, 2134 "SSL_use_certificate_file failed"); 2135 #else /* OPENSSL_NO_STDIO */ 2136 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", __func__); 2137 #endif /* OPENSSL_NO_STDIO */ 2138 2139 return -1; 2140 } 2141 2142 2143 static int tls_global_client_cert(struct tls_data *data, 2144 const char *client_cert) 2145 { 2146 #ifndef OPENSSL_NO_STDIO 2147 SSL_CTX *ssl_ctx = data->ssl; 2148 2149 if (client_cert == NULL) 2150 return 0; 2151 2152 if (SSL_CTX_use_certificate_file(ssl_ctx, client_cert, 2153 SSL_FILETYPE_ASN1) != 1 && 2154 SSL_CTX_use_certificate_chain_file(ssl_ctx, client_cert) != 1 && 2155 SSL_CTX_use_certificate_file(ssl_ctx, client_cert, 2156 SSL_FILETYPE_PEM) != 1) { 2157 tls_show_errors(MSG_INFO, __func__, 2158 "Failed to load client certificate"); 2159 return -1; 2160 } 2161 return 0; 2162 #else /* OPENSSL_NO_STDIO */ 2163 if (client_cert == NULL) 2164 return 0; 2165 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", __func__); 2166 return -1; 2167 #endif /* OPENSSL_NO_STDIO */ 2168 } 2169 2170 2171 static int tls_passwd_cb(char *buf, int size, int rwflag, void *password) 2172 { 2173 if (password == NULL) { 2174 return 0; 2175 } 2176 os_strlcpy(buf, (char *) password, size); 2177 return os_strlen(buf); 2178 } 2179 2180 2181 #ifdef PKCS12_FUNCS 2182 static int tls_parse_pkcs12(struct tls_data *data, SSL *ssl, PKCS12 *p12, 2183 const char *passwd) 2184 { 2185 EVP_PKEY *pkey; 2186 X509 *cert; 2187 STACK_OF(X509) *certs; 2188 int res = 0; 2189 char buf[256]; 2190 2191 pkey = NULL; 2192 cert = NULL; 2193 certs = NULL; 2194 if (!passwd) 2195 passwd = ""; 2196 if (!PKCS12_parse(p12, passwd, &pkey, &cert, &certs)) { 2197 tls_show_errors(MSG_DEBUG, __func__, 2198 "Failed to parse PKCS12 file"); 2199 PKCS12_free(p12); 2200 return -1; 2201 } 2202 wpa_printf(MSG_DEBUG, "TLS: Successfully parsed PKCS12 data"); 2203 2204 if (cert) { 2205 X509_NAME_oneline(X509_get_subject_name(cert), buf, 2206 sizeof(buf)); 2207 wpa_printf(MSG_DEBUG, "TLS: Got certificate from PKCS12: " 2208 "subject='%s'", buf); 2209 if (ssl) { 2210 if (SSL_use_certificate(ssl, cert) != 1) 2211 res = -1; 2212 } else { 2213 if (SSL_CTX_use_certificate(data->ssl, cert) != 1) 2214 res = -1; 2215 } 2216 X509_free(cert); 2217 } 2218 2219 if (pkey) { 2220 wpa_printf(MSG_DEBUG, "TLS: Got private key from PKCS12"); 2221 if (ssl) { 2222 if (SSL_use_PrivateKey(ssl, pkey) != 1) 2223 res = -1; 2224 } else { 2225 if (SSL_CTX_use_PrivateKey(data->ssl, pkey) != 1) 2226 res = -1; 2227 } 2228 EVP_PKEY_free(pkey); 2229 } 2230 2231 if (certs) { 2232 #if OPENSSL_VERSION_NUMBER >= 0x10002000L 2233 SSL_clear_chain_certs(ssl); 2234 while ((cert = sk_X509_pop(certs)) != NULL) { 2235 X509_NAME_oneline(X509_get_subject_name(cert), buf, 2236 sizeof(buf)); 2237 wpa_printf(MSG_DEBUG, "TLS: additional certificate" 2238 " from PKCS12: subject='%s'", buf); 2239 if (SSL_add1_chain_cert(ssl, cert) != 1) { 2240 tls_show_errors(MSG_DEBUG, __func__, 2241 "Failed to add additional certificate"); 2242 res = -1; 2243 break; 2244 } 2245 } 2246 if (!res) { 2247 /* Try to continue anyway */ 2248 } 2249 sk_X509_free(certs); 2250 #ifndef OPENSSL_IS_BORINGSSL 2251 res = SSL_build_cert_chain(ssl, 2252 SSL_BUILD_CHAIN_FLAG_CHECK | 2253 SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR); 2254 if (!res) { 2255 tls_show_errors(MSG_DEBUG, __func__, 2256 "Failed to build certificate chain"); 2257 } else if (res == 2) { 2258 wpa_printf(MSG_DEBUG, 2259 "TLS: Ignore certificate chain verification error when building chain with PKCS#12 extra certificates"); 2260 } 2261 #endif /* OPENSSL_IS_BORINGSSL */ 2262 /* 2263 * Try to continue regardless of result since it is possible for 2264 * the extra certificates not to be required. 2265 */ 2266 res = 0; 2267 #else /* OPENSSL_VERSION_NUMBER >= 0x10002000L */ 2268 #if OPENSSL_VERSION_NUMBER >= 0x10001000L 2269 SSL_CTX_clear_extra_chain_certs(data->ssl); 2270 #endif /* OPENSSL_VERSION_NUMBER >= 0x10001000L */ 2271 while ((cert = sk_X509_pop(certs)) != NULL) { 2272 X509_NAME_oneline(X509_get_subject_name(cert), buf, 2273 sizeof(buf)); 2274 wpa_printf(MSG_DEBUG, "TLS: additional certificate" 2275 " from PKCS12: subject='%s'", buf); 2276 /* 2277 * There is no SSL equivalent for the chain cert - so 2278 * always add it to the context... 2279 */ 2280 if (SSL_CTX_add_extra_chain_cert(data->ssl, cert) != 1) 2281 { 2282 res = -1; 2283 break; 2284 } 2285 } 2286 sk_X509_free(certs); 2287 #endif /* OPENSSL_VERSION_NUMBER >= 0x10002000L */ 2288 } 2289 2290 PKCS12_free(p12); 2291 2292 if (res < 0) 2293 tls_get_errors(data); 2294 2295 return res; 2296 } 2297 #endif /* PKCS12_FUNCS */ 2298 2299 2300 static int tls_read_pkcs12(struct tls_data *data, SSL *ssl, 2301 const char *private_key, const char *passwd) 2302 { 2303 #ifdef PKCS12_FUNCS 2304 FILE *f; 2305 PKCS12 *p12; 2306 2307 f = fopen(private_key, "rb"); 2308 if (f == NULL) 2309 return -1; 2310 2311 p12 = d2i_PKCS12_fp(f, NULL); 2312 fclose(f); 2313 2314 if (p12 == NULL) { 2315 tls_show_errors(MSG_INFO, __func__, 2316 "Failed to use PKCS#12 file"); 2317 return -1; 2318 } 2319 2320 return tls_parse_pkcs12(data, ssl, p12, passwd); 2321 2322 #else /* PKCS12_FUNCS */ 2323 wpa_printf(MSG_INFO, "TLS: PKCS12 support disabled - cannot read " 2324 "p12/pfx files"); 2325 return -1; 2326 #endif /* PKCS12_FUNCS */ 2327 } 2328 2329 2330 static int tls_read_pkcs12_blob(struct tls_data *data, SSL *ssl, 2331 const u8 *blob, size_t len, const char *passwd) 2332 { 2333 #ifdef PKCS12_FUNCS 2334 PKCS12 *p12; 2335 2336 p12 = d2i_PKCS12(NULL, (const unsigned char **) &blob, len); 2337 if (p12 == NULL) { 2338 tls_show_errors(MSG_INFO, __func__, 2339 "Failed to use PKCS#12 blob"); 2340 return -1; 2341 } 2342 2343 return tls_parse_pkcs12(data, ssl, p12, passwd); 2344 2345 #else /* PKCS12_FUNCS */ 2346 wpa_printf(MSG_INFO, "TLS: PKCS12 support disabled - cannot parse " 2347 "p12/pfx blobs"); 2348 return -1; 2349 #endif /* PKCS12_FUNCS */ 2350 } 2351 2352 2353 #ifndef OPENSSL_NO_ENGINE 2354 static int tls_engine_get_cert(struct tls_connection *conn, 2355 const char *cert_id, 2356 X509 **cert) 2357 { 2358 /* this runs after the private key is loaded so no PIN is required */ 2359 struct { 2360 const char *cert_id; 2361 X509 *cert; 2362 } params; 2363 params.cert_id = cert_id; 2364 params.cert = NULL; 2365 2366 if (!ENGINE_ctrl_cmd(conn->engine, "LOAD_CERT_CTRL", 2367 0, ¶ms, NULL, 1)) { 2368 unsigned long err = ERR_get_error(); 2369 2370 wpa_printf(MSG_ERROR, "ENGINE: cannot load client cert with id" 2371 " '%s' [%s]", cert_id, 2372 ERR_error_string(err, NULL)); 2373 if (tls_is_pin_error(err)) 2374 return TLS_SET_PARAMS_ENGINE_PRV_BAD_PIN; 2375 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED; 2376 } 2377 if (!params.cert) { 2378 wpa_printf(MSG_ERROR, "ENGINE: did not properly cert with id" 2379 " '%s'", cert_id); 2380 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED; 2381 } 2382 *cert = params.cert; 2383 return 0; 2384 } 2385 #endif /* OPENSSL_NO_ENGINE */ 2386 2387 2388 static int tls_connection_engine_client_cert(struct tls_connection *conn, 2389 const char *cert_id) 2390 { 2391 #ifndef OPENSSL_NO_ENGINE 2392 X509 *cert; 2393 2394 if (tls_engine_get_cert(conn, cert_id, &cert)) 2395 return -1; 2396 2397 if (!SSL_use_certificate(conn->ssl, cert)) { 2398 tls_show_errors(MSG_ERROR, __func__, 2399 "SSL_use_certificate failed"); 2400 X509_free(cert); 2401 return -1; 2402 } 2403 X509_free(cert); 2404 wpa_printf(MSG_DEBUG, "ENGINE: SSL_use_certificate --> " 2405 "OK"); 2406 return 0; 2407 2408 #else /* OPENSSL_NO_ENGINE */ 2409 return -1; 2410 #endif /* OPENSSL_NO_ENGINE */ 2411 } 2412 2413 2414 static int tls_connection_engine_ca_cert(struct tls_data *data, 2415 struct tls_connection *conn, 2416 const char *ca_cert_id) 2417 { 2418 #ifndef OPENSSL_NO_ENGINE 2419 X509 *cert; 2420 SSL_CTX *ssl_ctx = data->ssl; 2421 X509_STORE *store; 2422 2423 if (tls_engine_get_cert(conn, ca_cert_id, &cert)) 2424 return -1; 2425 2426 /* start off the same as tls_connection_ca_cert */ 2427 store = X509_STORE_new(); 2428 if (store == NULL) { 2429 wpa_printf(MSG_DEBUG, "OpenSSL: %s - failed to allocate new " 2430 "certificate store", __func__); 2431 X509_free(cert); 2432 return -1; 2433 } 2434 SSL_CTX_set_cert_store(ssl_ctx, store); 2435 if (!X509_STORE_add_cert(store, cert)) { 2436 unsigned long err = ERR_peek_error(); 2437 tls_show_errors(MSG_WARNING, __func__, 2438 "Failed to add CA certificate from engine " 2439 "to certificate store"); 2440 if (ERR_GET_LIB(err) == ERR_LIB_X509 && 2441 ERR_GET_REASON(err) == X509_R_CERT_ALREADY_IN_HASH_TABLE) { 2442 wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring cert" 2443 " already in hash table error", 2444 __func__); 2445 } else { 2446 X509_free(cert); 2447 return -1; 2448 } 2449 } 2450 X509_free(cert); 2451 wpa_printf(MSG_DEBUG, "OpenSSL: %s - added CA certificate from engine " 2452 "to certificate store", __func__); 2453 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb); 2454 conn->ca_cert_verify = 1; 2455 2456 return 0; 2457 2458 #else /* OPENSSL_NO_ENGINE */ 2459 return -1; 2460 #endif /* OPENSSL_NO_ENGINE */ 2461 } 2462 2463 2464 static int tls_connection_engine_private_key(struct tls_connection *conn) 2465 { 2466 #ifndef OPENSSL_NO_ENGINE 2467 if (SSL_use_PrivateKey(conn->ssl, conn->private_key) != 1) { 2468 tls_show_errors(MSG_ERROR, __func__, 2469 "ENGINE: cannot use private key for TLS"); 2470 return -1; 2471 } 2472 if (!SSL_check_private_key(conn->ssl)) { 2473 tls_show_errors(MSG_INFO, __func__, 2474 "Private key failed verification"); 2475 return -1; 2476 } 2477 return 0; 2478 #else /* OPENSSL_NO_ENGINE */ 2479 wpa_printf(MSG_ERROR, "SSL: Configuration uses engine, but " 2480 "engine support was not compiled in"); 2481 return -1; 2482 #endif /* OPENSSL_NO_ENGINE */ 2483 } 2484 2485 2486 static int tls_connection_private_key(struct tls_data *data, 2487 struct tls_connection *conn, 2488 const char *private_key, 2489 const char *private_key_passwd, 2490 const u8 *private_key_blob, 2491 size_t private_key_blob_len) 2492 { 2493 SSL_CTX *ssl_ctx = data->ssl; 2494 char *passwd; 2495 int ok; 2496 2497 if (private_key == NULL && private_key_blob == NULL) 2498 return 0; 2499 2500 if (private_key_passwd) { 2501 passwd = os_strdup(private_key_passwd); 2502 if (passwd == NULL) 2503 return -1; 2504 } else 2505 passwd = NULL; 2506 2507 SSL_CTX_set_default_passwd_cb(ssl_ctx, tls_passwd_cb); 2508 SSL_CTX_set_default_passwd_cb_userdata(ssl_ctx, passwd); 2509 2510 ok = 0; 2511 while (private_key_blob) { 2512 if (SSL_use_PrivateKey_ASN1(EVP_PKEY_RSA, conn->ssl, 2513 (u8 *) private_key_blob, 2514 private_key_blob_len) == 1) { 2515 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_PrivateKey_" 2516 "ASN1(EVP_PKEY_RSA) --> OK"); 2517 ok = 1; 2518 break; 2519 } 2520 2521 if (SSL_use_PrivateKey_ASN1(EVP_PKEY_DSA, conn->ssl, 2522 (u8 *) private_key_blob, 2523 private_key_blob_len) == 1) { 2524 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_PrivateKey_" 2525 "ASN1(EVP_PKEY_DSA) --> OK"); 2526 ok = 1; 2527 break; 2528 } 2529 2530 if (SSL_use_RSAPrivateKey_ASN1(conn->ssl, 2531 (u8 *) private_key_blob, 2532 private_key_blob_len) == 1) { 2533 wpa_printf(MSG_DEBUG, "OpenSSL: " 2534 "SSL_use_RSAPrivateKey_ASN1 --> OK"); 2535 ok = 1; 2536 break; 2537 } 2538 2539 if (tls_read_pkcs12_blob(data, conn->ssl, private_key_blob, 2540 private_key_blob_len, passwd) == 0) { 2541 wpa_printf(MSG_DEBUG, "OpenSSL: PKCS#12 as blob --> " 2542 "OK"); 2543 ok = 1; 2544 break; 2545 } 2546 2547 break; 2548 } 2549 2550 while (!ok && private_key) { 2551 #ifndef OPENSSL_NO_STDIO 2552 if (SSL_use_PrivateKey_file(conn->ssl, private_key, 2553 SSL_FILETYPE_ASN1) == 1) { 2554 wpa_printf(MSG_DEBUG, "OpenSSL: " 2555 "SSL_use_PrivateKey_File (DER) --> OK"); 2556 ok = 1; 2557 break; 2558 } 2559 2560 if (SSL_use_PrivateKey_file(conn->ssl, private_key, 2561 SSL_FILETYPE_PEM) == 1) { 2562 wpa_printf(MSG_DEBUG, "OpenSSL: " 2563 "SSL_use_PrivateKey_File (PEM) --> OK"); 2564 ok = 1; 2565 break; 2566 } 2567 #else /* OPENSSL_NO_STDIO */ 2568 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", 2569 __func__); 2570 #endif /* OPENSSL_NO_STDIO */ 2571 2572 if (tls_read_pkcs12(data, conn->ssl, private_key, passwd) 2573 == 0) { 2574 wpa_printf(MSG_DEBUG, "OpenSSL: Reading PKCS#12 file " 2575 "--> OK"); 2576 ok = 1; 2577 break; 2578 } 2579 2580 if (tls_cryptoapi_cert(conn->ssl, private_key) == 0) { 2581 wpa_printf(MSG_DEBUG, "OpenSSL: Using CryptoAPI to " 2582 "access certificate store --> OK"); 2583 ok = 1; 2584 break; 2585 } 2586 2587 break; 2588 } 2589 2590 if (!ok) { 2591 tls_show_errors(MSG_INFO, __func__, 2592 "Failed to load private key"); 2593 os_free(passwd); 2594 return -1; 2595 } 2596 ERR_clear_error(); 2597 SSL_CTX_set_default_passwd_cb(ssl_ctx, NULL); 2598 os_free(passwd); 2599 2600 if (!SSL_check_private_key(conn->ssl)) { 2601 tls_show_errors(MSG_INFO, __func__, "Private key failed " 2602 "verification"); 2603 return -1; 2604 } 2605 2606 wpa_printf(MSG_DEBUG, "SSL: Private key loaded successfully"); 2607 return 0; 2608 } 2609 2610 2611 static int tls_global_private_key(struct tls_data *data, 2612 const char *private_key, 2613 const char *private_key_passwd) 2614 { 2615 SSL_CTX *ssl_ctx = data->ssl; 2616 char *passwd; 2617 2618 if (private_key == NULL) 2619 return 0; 2620 2621 if (private_key_passwd) { 2622 passwd = os_strdup(private_key_passwd); 2623 if (passwd == NULL) 2624 return -1; 2625 } else 2626 passwd = NULL; 2627 2628 SSL_CTX_set_default_passwd_cb(ssl_ctx, tls_passwd_cb); 2629 SSL_CTX_set_default_passwd_cb_userdata(ssl_ctx, passwd); 2630 if ( 2631 #ifndef OPENSSL_NO_STDIO 2632 SSL_CTX_use_PrivateKey_file(ssl_ctx, private_key, 2633 SSL_FILETYPE_ASN1) != 1 && 2634 SSL_CTX_use_PrivateKey_file(ssl_ctx, private_key, 2635 SSL_FILETYPE_PEM) != 1 && 2636 #endif /* OPENSSL_NO_STDIO */ 2637 tls_read_pkcs12(data, NULL, private_key, passwd)) { 2638 tls_show_errors(MSG_INFO, __func__, 2639 "Failed to load private key"); 2640 os_free(passwd); 2641 ERR_clear_error(); 2642 return -1; 2643 } 2644 os_free(passwd); 2645 ERR_clear_error(); 2646 SSL_CTX_set_default_passwd_cb(ssl_ctx, NULL); 2647 2648 if (!SSL_CTX_check_private_key(ssl_ctx)) { 2649 tls_show_errors(MSG_INFO, __func__, 2650 "Private key failed verification"); 2651 return -1; 2652 } 2653 2654 return 0; 2655 } 2656 2657 2658 static int tls_connection_dh(struct tls_connection *conn, const char *dh_file) 2659 { 2660 #ifdef OPENSSL_NO_DH 2661 if (dh_file == NULL) 2662 return 0; 2663 wpa_printf(MSG_ERROR, "TLS: openssl does not include DH support, but " 2664 "dh_file specified"); 2665 return -1; 2666 #else /* OPENSSL_NO_DH */ 2667 DH *dh; 2668 BIO *bio; 2669 2670 /* TODO: add support for dh_blob */ 2671 if (dh_file == NULL) 2672 return 0; 2673 if (conn == NULL) 2674 return -1; 2675 2676 bio = BIO_new_file(dh_file, "r"); 2677 if (bio == NULL) { 2678 wpa_printf(MSG_INFO, "TLS: Failed to open DH file '%s': %s", 2679 dh_file, ERR_error_string(ERR_get_error(), NULL)); 2680 return -1; 2681 } 2682 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); 2683 BIO_free(bio); 2684 #ifndef OPENSSL_NO_DSA 2685 while (dh == NULL) { 2686 DSA *dsa; 2687 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DH file '%s': %s -" 2688 " trying to parse as DSA params", dh_file, 2689 ERR_error_string(ERR_get_error(), NULL)); 2690 bio = BIO_new_file(dh_file, "r"); 2691 if (bio == NULL) 2692 break; 2693 dsa = PEM_read_bio_DSAparams(bio, NULL, NULL, NULL); 2694 BIO_free(bio); 2695 if (!dsa) { 2696 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DSA file " 2697 "'%s': %s", dh_file, 2698 ERR_error_string(ERR_get_error(), NULL)); 2699 break; 2700 } 2701 2702 wpa_printf(MSG_DEBUG, "TLS: DH file in DSA param format"); 2703 dh = DSA_dup_DH(dsa); 2704 DSA_free(dsa); 2705 if (dh == NULL) { 2706 wpa_printf(MSG_INFO, "TLS: Failed to convert DSA " 2707 "params into DH params"); 2708 break; 2709 } 2710 break; 2711 } 2712 #endif /* !OPENSSL_NO_DSA */ 2713 if (dh == NULL) { 2714 wpa_printf(MSG_INFO, "TLS: Failed to read/parse DH/DSA file " 2715 "'%s'", dh_file); 2716 return -1; 2717 } 2718 2719 if (SSL_set_tmp_dh(conn->ssl, dh) != 1) { 2720 wpa_printf(MSG_INFO, "TLS: Failed to set DH params from '%s': " 2721 "%s", dh_file, 2722 ERR_error_string(ERR_get_error(), NULL)); 2723 DH_free(dh); 2724 return -1; 2725 } 2726 DH_free(dh); 2727 return 0; 2728 #endif /* OPENSSL_NO_DH */ 2729 } 2730 2731 2732 static int tls_global_dh(struct tls_data *data, const char *dh_file) 2733 { 2734 #ifdef OPENSSL_NO_DH 2735 if (dh_file == NULL) 2736 return 0; 2737 wpa_printf(MSG_ERROR, "TLS: openssl does not include DH support, but " 2738 "dh_file specified"); 2739 return -1; 2740 #else /* OPENSSL_NO_DH */ 2741 SSL_CTX *ssl_ctx = data->ssl; 2742 DH *dh; 2743 BIO *bio; 2744 2745 /* TODO: add support for dh_blob */ 2746 if (dh_file == NULL) 2747 return 0; 2748 if (ssl_ctx == NULL) 2749 return -1; 2750 2751 bio = BIO_new_file(dh_file, "r"); 2752 if (bio == NULL) { 2753 wpa_printf(MSG_INFO, "TLS: Failed to open DH file '%s': %s", 2754 dh_file, ERR_error_string(ERR_get_error(), NULL)); 2755 return -1; 2756 } 2757 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); 2758 BIO_free(bio); 2759 #ifndef OPENSSL_NO_DSA 2760 while (dh == NULL) { 2761 DSA *dsa; 2762 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DH file '%s': %s -" 2763 " trying to parse as DSA params", dh_file, 2764 ERR_error_string(ERR_get_error(), NULL)); 2765 bio = BIO_new_file(dh_file, "r"); 2766 if (bio == NULL) 2767 break; 2768 dsa = PEM_read_bio_DSAparams(bio, NULL, NULL, NULL); 2769 BIO_free(bio); 2770 if (!dsa) { 2771 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DSA file " 2772 "'%s': %s", dh_file, 2773 ERR_error_string(ERR_get_error(), NULL)); 2774 break; 2775 } 2776 2777 wpa_printf(MSG_DEBUG, "TLS: DH file in DSA param format"); 2778 dh = DSA_dup_DH(dsa); 2779 DSA_free(dsa); 2780 if (dh == NULL) { 2781 wpa_printf(MSG_INFO, "TLS: Failed to convert DSA " 2782 "params into DH params"); 2783 break; 2784 } 2785 break; 2786 } 2787 #endif /* !OPENSSL_NO_DSA */ 2788 if (dh == NULL) { 2789 wpa_printf(MSG_INFO, "TLS: Failed to read/parse DH/DSA file " 2790 "'%s'", dh_file); 2791 return -1; 2792 } 2793 2794 if (SSL_CTX_set_tmp_dh(ssl_ctx, dh) != 1) { 2795 wpa_printf(MSG_INFO, "TLS: Failed to set DH params from '%s': " 2796 "%s", dh_file, 2797 ERR_error_string(ERR_get_error(), NULL)); 2798 DH_free(dh); 2799 return -1; 2800 } 2801 DH_free(dh); 2802 return 0; 2803 #endif /* OPENSSL_NO_DH */ 2804 } 2805 2806 2807 int tls_connection_get_random(void *ssl_ctx, struct tls_connection *conn, 2808 struct tls_random *keys) 2809 { 2810 SSL *ssl; 2811 2812 if (conn == NULL || keys == NULL) 2813 return -1; 2814 ssl = conn->ssl; 2815 #if OPENSSL_VERSION_NUMBER < 0x10100000L 2816 if (ssl == NULL || ssl->s3 == NULL || ssl->session == NULL) 2817 return -1; 2818 2819 os_memset(keys, 0, sizeof(*keys)); 2820 keys->client_random = ssl->s3->client_random; 2821 keys->client_random_len = SSL3_RANDOM_SIZE; 2822 keys->server_random = ssl->s3->server_random; 2823 keys->server_random_len = SSL3_RANDOM_SIZE; 2824 #else 2825 if (ssl == NULL) 2826 return -1; 2827 2828 os_memset(keys, 0, sizeof(*keys)); 2829 keys->client_random = conn->client_random; 2830 keys->client_random_len = SSL_get_client_random( 2831 ssl, conn->client_random, sizeof(conn->client_random)); 2832 keys->server_random = conn->server_random; 2833 keys->server_random_len = SSL_get_server_random( 2834 ssl, conn->server_random, sizeof(conn->server_random)); 2835 #endif 2836 2837 return 0; 2838 } 2839 2840 2841 #ifndef CONFIG_FIPS 2842 static int openssl_get_keyblock_size(SSL *ssl) 2843 { 2844 #if OPENSSL_VERSION_NUMBER < 0x10100000L 2845 const EVP_CIPHER *c; 2846 const EVP_MD *h; 2847 int md_size; 2848 2849 if (ssl->enc_read_ctx == NULL || ssl->enc_read_ctx->cipher == NULL || 2850 ssl->read_hash == NULL) 2851 return -1; 2852 2853 c = ssl->enc_read_ctx->cipher; 2854 #if OPENSSL_VERSION_NUMBER >= 0x00909000L 2855 h = EVP_MD_CTX_md(ssl->read_hash); 2856 #else 2857 h = ssl->read_hash; 2858 #endif 2859 if (h) 2860 md_size = EVP_MD_size(h); 2861 #if OPENSSL_VERSION_NUMBER >= 0x10000000L 2862 else if (ssl->s3) 2863 md_size = ssl->s3->tmp.new_mac_secret_size; 2864 #endif 2865 else 2866 return -1; 2867 2868 wpa_printf(MSG_DEBUG, "OpenSSL: keyblock size: key_len=%d MD_size=%d " 2869 "IV_len=%d", EVP_CIPHER_key_length(c), md_size, 2870 EVP_CIPHER_iv_length(c)); 2871 return 2 * (EVP_CIPHER_key_length(c) + 2872 md_size + 2873 EVP_CIPHER_iv_length(c)); 2874 #else 2875 const SSL_CIPHER *ssl_cipher; 2876 int cipher, digest; 2877 const EVP_CIPHER *c; 2878 const EVP_MD *h; 2879 2880 ssl_cipher = SSL_get_current_cipher(ssl); 2881 if (!ssl_cipher) 2882 return -1; 2883 cipher = SSL_CIPHER_get_cipher_nid(ssl_cipher); 2884 digest = SSL_CIPHER_get_digest_nid(ssl_cipher); 2885 wpa_printf(MSG_DEBUG, "OpenSSL: cipher nid %d digest nid %d", 2886 cipher, digest); 2887 if (cipher < 0 || digest < 0) 2888 return -1; 2889 c = EVP_get_cipherbynid(cipher); 2890 h = EVP_get_digestbynid(digest); 2891 if (!c || !h) 2892 return -1; 2893 2894 wpa_printf(MSG_DEBUG, 2895 "OpenSSL: keyblock size: key_len=%d MD_size=%d IV_len=%d", 2896 EVP_CIPHER_key_length(c), EVP_MD_size(h), 2897 EVP_CIPHER_iv_length(c)); 2898 return 2 * (EVP_CIPHER_key_length(c) + EVP_MD_size(h) + 2899 EVP_CIPHER_iv_length(c)); 2900 #endif 2901 } 2902 #endif /* CONFIG_FIPS */ 2903 2904 2905 static int openssl_tls_prf(struct tls_connection *conn, 2906 const char *label, int server_random_first, 2907 int skip_keyblock, u8 *out, size_t out_len) 2908 { 2909 #ifdef CONFIG_FIPS 2910 wpa_printf(MSG_ERROR, "OpenSSL: TLS keys cannot be exported in FIPS " 2911 "mode"); 2912 return -1; 2913 #else /* CONFIG_FIPS */ 2914 #if OPENSSL_VERSION_NUMBER < 0x10100000L 2915 SSL *ssl; 2916 u8 *rnd; 2917 int ret = -1; 2918 int skip = 0; 2919 u8 *tmp_out = NULL; 2920 u8 *_out = out; 2921 const char *ver; 2922 2923 /* 2924 * TLS library did not support key generation, so get the needed TLS 2925 * session parameters and use an internal implementation of TLS PRF to 2926 * derive the key. 2927 */ 2928 2929 if (conn == NULL) 2930 return -1; 2931 ssl = conn->ssl; 2932 if (ssl == NULL || ssl->s3 == NULL || ssl->session == NULL || 2933 ssl->session->master_key_length <= 0) 2934 return -1; 2935 ver = SSL_get_version(ssl); 2936 2937 if (skip_keyblock) { 2938 skip = openssl_get_keyblock_size(ssl); 2939 if (skip < 0) 2940 return -1; 2941 tmp_out = os_malloc(skip + out_len); 2942 if (!tmp_out) 2943 return -1; 2944 _out = tmp_out; 2945 } 2946 2947 rnd = os_malloc(2 * SSL3_RANDOM_SIZE); 2948 if (!rnd) { 2949 os_free(tmp_out); 2950 return -1; 2951 } 2952 2953 if (server_random_first) { 2954 os_memcpy(rnd, ssl->s3->server_random, SSL3_RANDOM_SIZE); 2955 os_memcpy(rnd + SSL3_RANDOM_SIZE, ssl->s3->client_random, 2956 SSL3_RANDOM_SIZE); 2957 } else { 2958 os_memcpy(rnd, ssl->s3->client_random, SSL3_RANDOM_SIZE); 2959 os_memcpy(rnd + SSL3_RANDOM_SIZE, ssl->s3->server_random, 2960 SSL3_RANDOM_SIZE); 2961 } 2962 2963 if (os_strcmp(ver, "TLSv1.2") == 0) { 2964 tls_prf_sha256(ssl->session->master_key, 2965 ssl->session->master_key_length, 2966 label, rnd, 2 * SSL3_RANDOM_SIZE, 2967 _out, skip + out_len); 2968 ret = 0; 2969 } else if (tls_prf_sha1_md5(ssl->session->master_key, 2970 ssl->session->master_key_length, 2971 label, rnd, 2 * SSL3_RANDOM_SIZE, 2972 _out, skip + out_len) == 0) { 2973 ret = 0; 2974 } 2975 os_free(rnd); 2976 if (ret == 0 && skip_keyblock) 2977 os_memcpy(out, _out + skip, out_len); 2978 bin_clear_free(tmp_out, skip); 2979 2980 return ret; 2981 #else 2982 SSL *ssl; 2983 SSL_SESSION *sess; 2984 u8 *rnd; 2985 int ret = -1; 2986 int skip = 0; 2987 u8 *tmp_out = NULL; 2988 u8 *_out = out; 2989 unsigned char client_random[SSL3_RANDOM_SIZE]; 2990 unsigned char server_random[SSL3_RANDOM_SIZE]; 2991 unsigned char master_key[64]; 2992 size_t master_key_len; 2993 const char *ver; 2994 2995 /* 2996 * TLS library did not support key generation, so get the needed TLS 2997 * session parameters and use an internal implementation of TLS PRF to 2998 * derive the key. 2999 */ 3000 3001 if (conn == NULL) 3002 return -1; 3003 ssl = conn->ssl; 3004 if (ssl == NULL) 3005 return -1; 3006 ver = SSL_get_version(ssl); 3007 sess = SSL_get_session(ssl); 3008 if (!ver || !sess) 3009 return -1; 3010 3011 if (skip_keyblock) { 3012 skip = openssl_get_keyblock_size(ssl); 3013 if (skip < 0) 3014 return -1; 3015 tmp_out = os_malloc(skip + out_len); 3016 if (!tmp_out) 3017 return -1; 3018 _out = tmp_out; 3019 } 3020 3021 rnd = os_malloc(2 * SSL3_RANDOM_SIZE); 3022 if (!rnd) { 3023 os_free(tmp_out); 3024 return -1; 3025 } 3026 3027 SSL_get_client_random(ssl, client_random, sizeof(client_random)); 3028 SSL_get_server_random(ssl, server_random, sizeof(server_random)); 3029 master_key_len = SSL_SESSION_get_master_key(sess, master_key, 3030 sizeof(master_key)); 3031 3032 if (server_random_first) { 3033 os_memcpy(rnd, server_random, SSL3_RANDOM_SIZE); 3034 os_memcpy(rnd + SSL3_RANDOM_SIZE, client_random, 3035 SSL3_RANDOM_SIZE); 3036 } else { 3037 os_memcpy(rnd, client_random, SSL3_RANDOM_SIZE); 3038 os_memcpy(rnd + SSL3_RANDOM_SIZE, server_random, 3039 SSL3_RANDOM_SIZE); 3040 } 3041 3042 if (os_strcmp(ver, "TLSv1.2") == 0) { 3043 tls_prf_sha256(master_key, master_key_len, 3044 label, rnd, 2 * SSL3_RANDOM_SIZE, 3045 _out, skip + out_len); 3046 ret = 0; 3047 } else if (tls_prf_sha1_md5(master_key, master_key_len, 3048 label, rnd, 2 * SSL3_RANDOM_SIZE, 3049 _out, skip + out_len) == 0) { 3050 ret = 0; 3051 } 3052 os_memset(master_key, 0, sizeof(master_key)); 3053 os_free(rnd); 3054 if (ret == 0 && skip_keyblock) 3055 os_memcpy(out, _out + skip, out_len); 3056 bin_clear_free(tmp_out, skip); 3057 3058 return ret; 3059 #endif 3060 #endif /* CONFIG_FIPS */ 3061 } 3062 3063 3064 int tls_connection_prf(void *tls_ctx, struct tls_connection *conn, 3065 const char *label, int server_random_first, 3066 int skip_keyblock, u8 *out, size_t out_len) 3067 { 3068 #if OPENSSL_VERSION_NUMBER >= 0x10001000L 3069 SSL *ssl; 3070 if (conn == NULL) 3071 return -1; 3072 if (server_random_first || skip_keyblock) 3073 return openssl_tls_prf(conn, label, 3074 server_random_first, skip_keyblock, 3075 out, out_len); 3076 ssl = conn->ssl; 3077 if (SSL_export_keying_material(ssl, out, out_len, label, 3078 os_strlen(label), NULL, 0, 0) == 1) { 3079 wpa_printf(MSG_DEBUG, "OpenSSL: Using internal PRF"); 3080 return 0; 3081 } 3082 #endif 3083 return openssl_tls_prf(conn, label, server_random_first, 3084 skip_keyblock, out, out_len); 3085 } 3086 3087 3088 static struct wpabuf * 3089 openssl_handshake(struct tls_connection *conn, const struct wpabuf *in_data, 3090 int server) 3091 { 3092 int res; 3093 struct wpabuf *out_data; 3094 3095 /* 3096 * Give TLS handshake data from the server (if available) to OpenSSL 3097 * for processing. 3098 */ 3099 if (in_data && wpabuf_len(in_data) > 0 && 3100 BIO_write(conn->ssl_in, wpabuf_head(in_data), wpabuf_len(in_data)) 3101 < 0) { 3102 tls_show_errors(MSG_INFO, __func__, 3103 "Handshake failed - BIO_write"); 3104 return NULL; 3105 } 3106 3107 /* Initiate TLS handshake or continue the existing handshake */ 3108 if (server) 3109 res = SSL_accept(conn->ssl); 3110 else 3111 res = SSL_connect(conn->ssl); 3112 if (res != 1) { 3113 int err = SSL_get_error(conn->ssl, res); 3114 if (err == SSL_ERROR_WANT_READ) 3115 wpa_printf(MSG_DEBUG, "SSL: SSL_connect - want " 3116 "more data"); 3117 else if (err == SSL_ERROR_WANT_WRITE) 3118 wpa_printf(MSG_DEBUG, "SSL: SSL_connect - want to " 3119 "write"); 3120 else { 3121 tls_show_errors(MSG_INFO, __func__, "SSL_connect"); 3122 conn->failed++; 3123 } 3124 } 3125 3126 /* Get the TLS handshake data to be sent to the server */ 3127 res = BIO_ctrl_pending(conn->ssl_out); 3128 wpa_printf(MSG_DEBUG, "SSL: %d bytes pending from ssl_out", res); 3129 out_data = wpabuf_alloc(res); 3130 if (out_data == NULL) { 3131 wpa_printf(MSG_DEBUG, "SSL: Failed to allocate memory for " 3132 "handshake output (%d bytes)", res); 3133 if (BIO_reset(conn->ssl_out) < 0) { 3134 tls_show_errors(MSG_INFO, __func__, 3135 "BIO_reset failed"); 3136 } 3137 return NULL; 3138 } 3139 res = res == 0 ? 0 : BIO_read(conn->ssl_out, wpabuf_mhead(out_data), 3140 res); 3141 if (res < 0) { 3142 tls_show_errors(MSG_INFO, __func__, 3143 "Handshake failed - BIO_read"); 3144 if (BIO_reset(conn->ssl_out) < 0) { 3145 tls_show_errors(MSG_INFO, __func__, 3146 "BIO_reset failed"); 3147 } 3148 wpabuf_free(out_data); 3149 return NULL; 3150 } 3151 wpabuf_put(out_data, res); 3152 3153 return out_data; 3154 } 3155 3156 3157 static struct wpabuf * 3158 openssl_get_appl_data(struct tls_connection *conn, size_t max_len) 3159 { 3160 struct wpabuf *appl_data; 3161 int res; 3162 3163 appl_data = wpabuf_alloc(max_len + 100); 3164 if (appl_data == NULL) 3165 return NULL; 3166 3167 res = SSL_read(conn->ssl, wpabuf_mhead(appl_data), 3168 wpabuf_size(appl_data)); 3169 if (res < 0) { 3170 int err = SSL_get_error(conn->ssl, res); 3171 if (err == SSL_ERROR_WANT_READ || 3172 err == SSL_ERROR_WANT_WRITE) { 3173 wpa_printf(MSG_DEBUG, "SSL: No Application Data " 3174 "included"); 3175 } else { 3176 tls_show_errors(MSG_INFO, __func__, 3177 "Failed to read possible " 3178 "Application Data"); 3179 } 3180 wpabuf_free(appl_data); 3181 return NULL; 3182 } 3183 3184 wpabuf_put(appl_data, res); 3185 wpa_hexdump_buf_key(MSG_MSGDUMP, "SSL: Application Data in Finished " 3186 "message", appl_data); 3187 3188 return appl_data; 3189 } 3190 3191 3192 static struct wpabuf * 3193 openssl_connection_handshake(struct tls_connection *conn, 3194 const struct wpabuf *in_data, 3195 struct wpabuf **appl_data, int server) 3196 { 3197 struct wpabuf *out_data; 3198 3199 if (appl_data) 3200 *appl_data = NULL; 3201 3202 out_data = openssl_handshake(conn, in_data, server); 3203 if (out_data == NULL) 3204 return NULL; 3205 if (conn->invalid_hb_used) { 3206 wpa_printf(MSG_INFO, "TLS: Heartbeat attack detected - do not send response"); 3207 wpabuf_free(out_data); 3208 return NULL; 3209 } 3210 3211 if (SSL_is_init_finished(conn->ssl)) { 3212 wpa_printf(MSG_DEBUG, 3213 "OpenSSL: Handshake finished - resumed=%d", 3214 tls_connection_resumed(conn->ssl_ctx, conn)); 3215 if (appl_data && in_data) 3216 *appl_data = openssl_get_appl_data(conn, 3217 wpabuf_len(in_data)); 3218 } 3219 3220 if (conn->invalid_hb_used) { 3221 wpa_printf(MSG_INFO, "TLS: Heartbeat attack detected - do not send response"); 3222 if (appl_data) { 3223 wpabuf_free(*appl_data); 3224 *appl_data = NULL; 3225 } 3226 wpabuf_free(out_data); 3227 return NULL; 3228 } 3229 3230 return out_data; 3231 } 3232 3233 3234 struct wpabuf * 3235 tls_connection_handshake(void *ssl_ctx, struct tls_connection *conn, 3236 const struct wpabuf *in_data, 3237 struct wpabuf **appl_data) 3238 { 3239 return openssl_connection_handshake(conn, in_data, appl_data, 0); 3240 } 3241 3242 3243 struct wpabuf * tls_connection_server_handshake(void *tls_ctx, 3244 struct tls_connection *conn, 3245 const struct wpabuf *in_data, 3246 struct wpabuf **appl_data) 3247 { 3248 return openssl_connection_handshake(conn, in_data, appl_data, 1); 3249 } 3250 3251 3252 struct wpabuf * tls_connection_encrypt(void *tls_ctx, 3253 struct tls_connection *conn, 3254 const struct wpabuf *in_data) 3255 { 3256 int res; 3257 struct wpabuf *buf; 3258 3259 if (conn == NULL) 3260 return NULL; 3261 3262 /* Give plaintext data for OpenSSL to encrypt into the TLS tunnel. */ 3263 if ((res = BIO_reset(conn->ssl_in)) < 0 || 3264 (res = BIO_reset(conn->ssl_out)) < 0) { 3265 tls_show_errors(MSG_INFO, __func__, "BIO_reset failed"); 3266 return NULL; 3267 } 3268 res = SSL_write(conn->ssl, wpabuf_head(in_data), wpabuf_len(in_data)); 3269 if (res < 0) { 3270 tls_show_errors(MSG_INFO, __func__, 3271 "Encryption failed - SSL_write"); 3272 return NULL; 3273 } 3274 3275 /* Read encrypted data to be sent to the server */ 3276 buf = wpabuf_alloc(wpabuf_len(in_data) + 300); 3277 if (buf == NULL) 3278 return NULL; 3279 res = BIO_read(conn->ssl_out, wpabuf_mhead(buf), wpabuf_size(buf)); 3280 if (res < 0) { 3281 tls_show_errors(MSG_INFO, __func__, 3282 "Encryption failed - BIO_read"); 3283 wpabuf_free(buf); 3284 return NULL; 3285 } 3286 wpabuf_put(buf, res); 3287 3288 return buf; 3289 } 3290 3291 3292 struct wpabuf * tls_connection_decrypt(void *tls_ctx, 3293 struct tls_connection *conn, 3294 const struct wpabuf *in_data) 3295 { 3296 int res; 3297 struct wpabuf *buf; 3298 3299 /* Give encrypted data from TLS tunnel for OpenSSL to decrypt. */ 3300 res = BIO_write(conn->ssl_in, wpabuf_head(in_data), 3301 wpabuf_len(in_data)); 3302 if (res < 0) { 3303 tls_show_errors(MSG_INFO, __func__, 3304 "Decryption failed - BIO_write"); 3305 return NULL; 3306 } 3307 if (BIO_reset(conn->ssl_out) < 0) { 3308 tls_show_errors(MSG_INFO, __func__, "BIO_reset failed"); 3309 return NULL; 3310 } 3311 3312 /* Read decrypted data for further processing */ 3313 /* 3314 * Even though we try to disable TLS compression, it is possible that 3315 * this cannot be done with all TLS libraries. Add extra buffer space 3316 * to handle the possibility of the decrypted data being longer than 3317 * input data. 3318 */ 3319 buf = wpabuf_alloc((wpabuf_len(in_data) + 500) * 3); 3320 if (buf == NULL) 3321 return NULL; 3322 res = SSL_read(conn->ssl, wpabuf_mhead(buf), wpabuf_size(buf)); 3323 if (res < 0) { 3324 tls_show_errors(MSG_INFO, __func__, 3325 "Decryption failed - SSL_read"); 3326 wpabuf_free(buf); 3327 return NULL; 3328 } 3329 wpabuf_put(buf, res); 3330 3331 if (conn->invalid_hb_used) { 3332 wpa_printf(MSG_INFO, "TLS: Heartbeat attack detected - do not send response"); 3333 wpabuf_free(buf); 3334 return NULL; 3335 } 3336 3337 return buf; 3338 } 3339 3340 3341 int tls_connection_resumed(void *ssl_ctx, struct tls_connection *conn) 3342 { 3343 #if OPENSSL_VERSION_NUMBER >= 0x10001000L 3344 return conn ? SSL_cache_hit(conn->ssl) : 0; 3345 #else 3346 return conn ? conn->ssl->hit : 0; 3347 #endif 3348 } 3349 3350 3351 int tls_connection_set_cipher_list(void *tls_ctx, struct tls_connection *conn, 3352 u8 *ciphers) 3353 { 3354 char buf[100], *pos, *end; 3355 u8 *c; 3356 int ret; 3357 3358 if (conn == NULL || conn->ssl == NULL || ciphers == NULL) 3359 return -1; 3360 3361 buf[0] = '\0'; 3362 pos = buf; 3363 end = pos + sizeof(buf); 3364 3365 c = ciphers; 3366 while (*c != TLS_CIPHER_NONE) { 3367 const char *suite; 3368 3369 switch (*c) { 3370 case TLS_CIPHER_RC4_SHA: 3371 suite = "RC4-SHA"; 3372 break; 3373 case TLS_CIPHER_AES128_SHA: 3374 suite = "AES128-SHA"; 3375 break; 3376 case TLS_CIPHER_RSA_DHE_AES128_SHA: 3377 suite = "DHE-RSA-AES128-SHA"; 3378 break; 3379 case TLS_CIPHER_ANON_DH_AES128_SHA: 3380 suite = "ADH-AES128-SHA"; 3381 break; 3382 default: 3383 wpa_printf(MSG_DEBUG, "TLS: Unsupported " 3384 "cipher selection: %d", *c); 3385 return -1; 3386 } 3387 ret = os_snprintf(pos, end - pos, ":%s", suite); 3388 if (os_snprintf_error(end - pos, ret)) 3389 break; 3390 pos += ret; 3391 3392 c++; 3393 } 3394 3395 wpa_printf(MSG_DEBUG, "OpenSSL: cipher suites: %s", buf + 1); 3396 3397 #if OPENSSL_VERSION_NUMBER >= 0x10100000L 3398 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST) 3399 if (os_strstr(buf, ":ADH-")) { 3400 /* 3401 * Need to drop to security level 0 to allow anonymous 3402 * cipher suites for EAP-FAST. 3403 */ 3404 SSL_set_security_level(conn->ssl, 0); 3405 } else if (SSL_get_security_level(conn->ssl) == 0) { 3406 /* Force at least security level 1 */ 3407 SSL_set_security_level(conn->ssl, 1); 3408 } 3409 #endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */ 3410 #endif 3411 3412 if (SSL_set_cipher_list(conn->ssl, buf + 1) != 1) { 3413 tls_show_errors(MSG_INFO, __func__, 3414 "Cipher suite configuration failed"); 3415 return -1; 3416 } 3417 3418 return 0; 3419 } 3420 3421 3422 int tls_get_version(void *ssl_ctx, struct tls_connection *conn, 3423 char *buf, size_t buflen) 3424 { 3425 const char *name; 3426 if (conn == NULL || conn->ssl == NULL) 3427 return -1; 3428 3429 name = SSL_get_version(conn->ssl); 3430 if (name == NULL) 3431 return -1; 3432 3433 os_strlcpy(buf, name, buflen); 3434 return 0; 3435 } 3436 3437 3438 int tls_get_cipher(void *ssl_ctx, struct tls_connection *conn, 3439 char *buf, size_t buflen) 3440 { 3441 const char *name; 3442 if (conn == NULL || conn->ssl == NULL) 3443 return -1; 3444 3445 name = SSL_get_cipher(conn->ssl); 3446 if (name == NULL) 3447 return -1; 3448 3449 os_strlcpy(buf, name, buflen); 3450 return 0; 3451 } 3452 3453 3454 int tls_connection_enable_workaround(void *ssl_ctx, 3455 struct tls_connection *conn) 3456 { 3457 SSL_set_options(conn->ssl, SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS); 3458 3459 return 0; 3460 } 3461 3462 3463 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST) 3464 /* ClientHello TLS extensions require a patch to openssl, so this function is 3465 * commented out unless explicitly needed for EAP-FAST in order to be able to 3466 * build this file with unmodified openssl. */ 3467 int tls_connection_client_hello_ext(void *ssl_ctx, struct tls_connection *conn, 3468 int ext_type, const u8 *data, 3469 size_t data_len) 3470 { 3471 if (conn == NULL || conn->ssl == NULL || ext_type != 35) 3472 return -1; 3473 3474 if (SSL_set_session_ticket_ext(conn->ssl, (void *) data, 3475 data_len) != 1) 3476 return -1; 3477 3478 return 0; 3479 } 3480 #endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */ 3481 3482 3483 int tls_connection_get_failed(void *ssl_ctx, struct tls_connection *conn) 3484 { 3485 if (conn == NULL) 3486 return -1; 3487 return conn->failed; 3488 } 3489 3490 3491 int tls_connection_get_read_alerts(void *ssl_ctx, struct tls_connection *conn) 3492 { 3493 if (conn == NULL) 3494 return -1; 3495 return conn->read_alerts; 3496 } 3497 3498 3499 int tls_connection_get_write_alerts(void *ssl_ctx, struct tls_connection *conn) 3500 { 3501 if (conn == NULL) 3502 return -1; 3503 return conn->write_alerts; 3504 } 3505 3506 3507 #ifdef HAVE_OCSP 3508 3509 static void ocsp_debug_print_resp(OCSP_RESPONSE *rsp) 3510 { 3511 #ifndef CONFIG_NO_STDOUT_DEBUG 3512 BIO *out; 3513 size_t rlen; 3514 char *txt; 3515 int res; 3516 3517 if (wpa_debug_level > MSG_DEBUG) 3518 return; 3519 3520 out = BIO_new(BIO_s_mem()); 3521 if (!out) 3522 return; 3523 3524 OCSP_RESPONSE_print(out, rsp, 0); 3525 rlen = BIO_ctrl_pending(out); 3526 txt = os_malloc(rlen + 1); 3527 if (!txt) { 3528 BIO_free(out); 3529 return; 3530 } 3531 3532 res = BIO_read(out, txt, rlen); 3533 if (res > 0) { 3534 txt[res] = '\0'; 3535 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP Response\n%s", txt); 3536 } 3537 os_free(txt); 3538 BIO_free(out); 3539 #endif /* CONFIG_NO_STDOUT_DEBUG */ 3540 } 3541 3542 3543 static void debug_print_cert(X509 *cert, const char *title) 3544 { 3545 #ifndef CONFIG_NO_STDOUT_DEBUG 3546 BIO *out; 3547 size_t rlen; 3548 char *txt; 3549 int res; 3550 3551 if (wpa_debug_level > MSG_DEBUG) 3552 return; 3553 3554 out = BIO_new(BIO_s_mem()); 3555 if (!out) 3556 return; 3557 3558 X509_print(out, cert); 3559 rlen = BIO_ctrl_pending(out); 3560 txt = os_malloc(rlen + 1); 3561 if (!txt) { 3562 BIO_free(out); 3563 return; 3564 } 3565 3566 res = BIO_read(out, txt, rlen); 3567 if (res > 0) { 3568 txt[res] = '\0'; 3569 wpa_printf(MSG_DEBUG, "OpenSSL: %s\n%s", title, txt); 3570 } 3571 os_free(txt); 3572 3573 BIO_free(out); 3574 #endif /* CONFIG_NO_STDOUT_DEBUG */ 3575 } 3576 3577 3578 static int ocsp_resp_cb(SSL *s, void *arg) 3579 { 3580 struct tls_connection *conn = arg; 3581 const unsigned char *p; 3582 int len, status, reason; 3583 OCSP_RESPONSE *rsp; 3584 OCSP_BASICRESP *basic; 3585 OCSP_CERTID *id; 3586 ASN1_GENERALIZEDTIME *produced_at, *this_update, *next_update; 3587 X509_STORE *store; 3588 STACK_OF(X509) *certs = NULL; 3589 3590 len = SSL_get_tlsext_status_ocsp_resp(s, &p); 3591 if (!p) { 3592 wpa_printf(MSG_DEBUG, "OpenSSL: No OCSP response received"); 3593 return (conn->flags & TLS_CONN_REQUIRE_OCSP) ? 0 : 1; 3594 } 3595 3596 wpa_hexdump(MSG_DEBUG, "OpenSSL: OCSP response", p, len); 3597 3598 rsp = d2i_OCSP_RESPONSE(NULL, &p, len); 3599 if (!rsp) { 3600 wpa_printf(MSG_INFO, "OpenSSL: Failed to parse OCSP response"); 3601 return 0; 3602 } 3603 3604 ocsp_debug_print_resp(rsp); 3605 3606 status = OCSP_response_status(rsp); 3607 if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL) { 3608 wpa_printf(MSG_INFO, "OpenSSL: OCSP responder error %d (%s)", 3609 status, OCSP_response_status_str(status)); 3610 return 0; 3611 } 3612 3613 basic = OCSP_response_get1_basic(rsp); 3614 if (!basic) { 3615 wpa_printf(MSG_INFO, "OpenSSL: Could not find BasicOCSPResponse"); 3616 return 0; 3617 } 3618 3619 store = SSL_CTX_get_cert_store(conn->ssl_ctx); 3620 if (conn->peer_issuer) { 3621 debug_print_cert(conn->peer_issuer, "Add OCSP issuer"); 3622 3623 if (X509_STORE_add_cert(store, conn->peer_issuer) != 1) { 3624 tls_show_errors(MSG_INFO, __func__, 3625 "OpenSSL: Could not add issuer to certificate store"); 3626 } 3627 certs = sk_X509_new_null(); 3628 if (certs) { 3629 X509 *cert; 3630 cert = X509_dup(conn->peer_issuer); 3631 if (cert && !sk_X509_push(certs, cert)) { 3632 tls_show_errors( 3633 MSG_INFO, __func__, 3634 "OpenSSL: Could not add issuer to OCSP responder trust store"); 3635 X509_free(cert); 3636 sk_X509_free(certs); 3637 certs = NULL; 3638 } 3639 if (certs && conn->peer_issuer_issuer) { 3640 cert = X509_dup(conn->peer_issuer_issuer); 3641 if (cert && !sk_X509_push(certs, cert)) { 3642 tls_show_errors( 3643 MSG_INFO, __func__, 3644 "OpenSSL: Could not add issuer's issuer to OCSP responder trust store"); 3645 X509_free(cert); 3646 } 3647 } 3648 } 3649 } 3650 3651 status = OCSP_basic_verify(basic, certs, store, OCSP_TRUSTOTHER); 3652 sk_X509_pop_free(certs, X509_free); 3653 if (status <= 0) { 3654 tls_show_errors(MSG_INFO, __func__, 3655 "OpenSSL: OCSP response failed verification"); 3656 OCSP_BASICRESP_free(basic); 3657 OCSP_RESPONSE_free(rsp); 3658 return 0; 3659 } 3660 3661 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP response verification succeeded"); 3662 3663 if (!conn->peer_cert) { 3664 wpa_printf(MSG_DEBUG, "OpenSSL: Peer certificate not available for OCSP status check"); 3665 OCSP_BASICRESP_free(basic); 3666 OCSP_RESPONSE_free(rsp); 3667 return 0; 3668 } 3669 3670 if (!conn->peer_issuer) { 3671 wpa_printf(MSG_DEBUG, "OpenSSL: Peer issuer certificate not available for OCSP status check"); 3672 OCSP_BASICRESP_free(basic); 3673 OCSP_RESPONSE_free(rsp); 3674 return 0; 3675 } 3676 3677 id = OCSP_cert_to_id(NULL, conn->peer_cert, conn->peer_issuer); 3678 if (!id) { 3679 wpa_printf(MSG_DEBUG, "OpenSSL: Could not create OCSP certificate identifier"); 3680 OCSP_BASICRESP_free(basic); 3681 OCSP_RESPONSE_free(rsp); 3682 return 0; 3683 } 3684 3685 if (!OCSP_resp_find_status(basic, id, &status, &reason, &produced_at, 3686 &this_update, &next_update)) { 3687 wpa_printf(MSG_INFO, "OpenSSL: Could not find current server certificate from OCSP response%s", 3688 (conn->flags & TLS_CONN_REQUIRE_OCSP) ? "" : 3689 " (OCSP not required)"); 3690 OCSP_BASICRESP_free(basic); 3691 OCSP_RESPONSE_free(rsp); 3692 return (conn->flags & TLS_CONN_REQUIRE_OCSP) ? 0 : 1; 3693 } 3694 3695 if (!OCSP_check_validity(this_update, next_update, 5 * 60, -1)) { 3696 tls_show_errors(MSG_INFO, __func__, 3697 "OpenSSL: OCSP status times invalid"); 3698 OCSP_BASICRESP_free(basic); 3699 OCSP_RESPONSE_free(rsp); 3700 return 0; 3701 } 3702 3703 OCSP_BASICRESP_free(basic); 3704 OCSP_RESPONSE_free(rsp); 3705 3706 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status for server certificate: %s", 3707 OCSP_cert_status_str(status)); 3708 3709 if (status == V_OCSP_CERTSTATUS_GOOD) 3710 return 1; 3711 if (status == V_OCSP_CERTSTATUS_REVOKED) 3712 return 0; 3713 if (conn->flags & TLS_CONN_REQUIRE_OCSP) { 3714 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status unknown, but OCSP required"); 3715 return 0; 3716 } 3717 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status unknown, but OCSP was not required, so allow connection to continue"); 3718 return 1; 3719 } 3720 3721 3722 static int ocsp_status_cb(SSL *s, void *arg) 3723 { 3724 char *tmp; 3725 char *resp; 3726 size_t len; 3727 3728 if (tls_global->ocsp_stapling_response == NULL) { 3729 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status callback - no response configured"); 3730 return SSL_TLSEXT_ERR_OK; 3731 } 3732 3733 resp = os_readfile(tls_global->ocsp_stapling_response, &len); 3734 if (resp == NULL) { 3735 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status callback - could not read response file"); 3736 /* TODO: Build OCSPResponse with responseStatus = internalError 3737 */ 3738 return SSL_TLSEXT_ERR_OK; 3739 } 3740 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status callback - send cached response"); 3741 tmp = OPENSSL_malloc(len); 3742 if (tmp == NULL) { 3743 os_free(resp); 3744 return SSL_TLSEXT_ERR_ALERT_FATAL; 3745 } 3746 3747 os_memcpy(tmp, resp, len); 3748 os_free(resp); 3749 SSL_set_tlsext_status_ocsp_resp(s, tmp, len); 3750 3751 return SSL_TLSEXT_ERR_OK; 3752 } 3753 3754 #endif /* HAVE_OCSP */ 3755 3756 3757 int tls_connection_set_params(void *tls_ctx, struct tls_connection *conn, 3758 const struct tls_connection_params *params) 3759 { 3760 struct tls_data *data = tls_ctx; 3761 int ret; 3762 unsigned long err; 3763 int can_pkcs11 = 0; 3764 const char *key_id = params->key_id; 3765 const char *cert_id = params->cert_id; 3766 const char *ca_cert_id = params->ca_cert_id; 3767 const char *engine_id = params->engine ? params->engine_id : NULL; 3768 3769 if (conn == NULL) 3770 return -1; 3771 3772 /* 3773 * If the engine isn't explicitly configured, and any of the 3774 * cert/key fields are actually PKCS#11 URIs, then automatically 3775 * use the PKCS#11 ENGINE. 3776 */ 3777 if (!engine_id || os_strcmp(engine_id, "pkcs11") == 0) 3778 can_pkcs11 = 1; 3779 3780 if (!key_id && params->private_key && can_pkcs11 && 3781 os_strncmp(params->private_key, "pkcs11:", 7) == 0) { 3782 can_pkcs11 = 2; 3783 key_id = params->private_key; 3784 } 3785 3786 if (!cert_id && params->client_cert && can_pkcs11 && 3787 os_strncmp(params->client_cert, "pkcs11:", 7) == 0) { 3788 can_pkcs11 = 2; 3789 cert_id = params->client_cert; 3790 } 3791 3792 if (!ca_cert_id && params->ca_cert && can_pkcs11 && 3793 os_strncmp(params->ca_cert, "pkcs11:", 7) == 0) { 3794 can_pkcs11 = 2; 3795 ca_cert_id = params->ca_cert; 3796 } 3797 3798 /* If we need to automatically enable the PKCS#11 ENGINE, do so. */ 3799 if (can_pkcs11 == 2 && !engine_id) 3800 engine_id = "pkcs11"; 3801 3802 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST) 3803 #if OPENSSL_VERSION_NUMBER < 0x10100000L 3804 if (params->flags & TLS_CONN_EAP_FAST) { 3805 wpa_printf(MSG_DEBUG, 3806 "OpenSSL: Use TLSv1_method() for EAP-FAST"); 3807 if (SSL_set_ssl_method(conn->ssl, TLSv1_method()) != 1) { 3808 tls_show_errors(MSG_INFO, __func__, 3809 "Failed to set TLSv1_method() for EAP-FAST"); 3810 return -1; 3811 } 3812 } 3813 #endif 3814 #endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */ 3815 3816 while ((err = ERR_get_error())) { 3817 wpa_printf(MSG_INFO, "%s: Clearing pending SSL error: %s", 3818 __func__, ERR_error_string(err, NULL)); 3819 } 3820 3821 if (engine_id) { 3822 wpa_printf(MSG_DEBUG, "SSL: Initializing TLS engine"); 3823 ret = tls_engine_init(conn, engine_id, params->pin, 3824 key_id, cert_id, ca_cert_id); 3825 if (ret) 3826 return ret; 3827 } 3828 if (tls_connection_set_subject_match(conn, 3829 params->subject_match, 3830 params->altsubject_match, 3831 params->suffix_match, 3832 params->domain_match)) 3833 return -1; 3834 3835 if (engine_id && ca_cert_id) { 3836 if (tls_connection_engine_ca_cert(data, conn, ca_cert_id)) 3837 return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED; 3838 } else if (tls_connection_ca_cert(data, conn, params->ca_cert, 3839 params->ca_cert_blob, 3840 params->ca_cert_blob_len, 3841 params->ca_path)) 3842 return -1; 3843 3844 if (engine_id && cert_id) { 3845 if (tls_connection_engine_client_cert(conn, cert_id)) 3846 return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED; 3847 } else if (tls_connection_client_cert(conn, params->client_cert, 3848 params->client_cert_blob, 3849 params->client_cert_blob_len)) 3850 return -1; 3851 3852 if (engine_id && key_id) { 3853 wpa_printf(MSG_DEBUG, "TLS: Using private key from engine"); 3854 if (tls_connection_engine_private_key(conn)) 3855 return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED; 3856 } else if (tls_connection_private_key(data, conn, 3857 params->private_key, 3858 params->private_key_passwd, 3859 params->private_key_blob, 3860 params->private_key_blob_len)) { 3861 wpa_printf(MSG_INFO, "TLS: Failed to load private key '%s'", 3862 params->private_key); 3863 return -1; 3864 } 3865 3866 if (tls_connection_dh(conn, params->dh_file)) { 3867 wpa_printf(MSG_INFO, "TLS: Failed to load DH file '%s'", 3868 params->dh_file); 3869 return -1; 3870 } 3871 3872 if (params->openssl_ciphers && 3873 SSL_set_cipher_list(conn->ssl, params->openssl_ciphers) != 1) { 3874 wpa_printf(MSG_INFO, 3875 "OpenSSL: Failed to set cipher string '%s'", 3876 params->openssl_ciphers); 3877 return -1; 3878 } 3879 3880 tls_set_conn_flags(conn->ssl, params->flags); 3881 3882 #ifdef HAVE_OCSP 3883 if (params->flags & TLS_CONN_REQUEST_OCSP) { 3884 SSL_CTX *ssl_ctx = data->ssl; 3885 SSL_set_tlsext_status_type(conn->ssl, TLSEXT_STATUSTYPE_ocsp); 3886 SSL_CTX_set_tlsext_status_cb(ssl_ctx, ocsp_resp_cb); 3887 SSL_CTX_set_tlsext_status_arg(ssl_ctx, conn); 3888 } 3889 #else /* HAVE_OCSP */ 3890 if (params->flags & TLS_CONN_REQUIRE_OCSP) { 3891 wpa_printf(MSG_INFO, 3892 "OpenSSL: No OCSP support included - reject configuration"); 3893 return -1; 3894 } 3895 if (params->flags & TLS_CONN_REQUEST_OCSP) { 3896 wpa_printf(MSG_DEBUG, 3897 "OpenSSL: No OCSP support included - allow optional OCSP case to continue"); 3898 } 3899 #endif /* HAVE_OCSP */ 3900 3901 conn->flags = params->flags; 3902 3903 tls_get_errors(data); 3904 3905 return 0; 3906 } 3907 3908 3909 int tls_global_set_params(void *tls_ctx, 3910 const struct tls_connection_params *params) 3911 { 3912 struct tls_data *data = tls_ctx; 3913 SSL_CTX *ssl_ctx = data->ssl; 3914 unsigned long err; 3915 3916 while ((err = ERR_get_error())) { 3917 wpa_printf(MSG_INFO, "%s: Clearing pending SSL error: %s", 3918 __func__, ERR_error_string(err, NULL)); 3919 } 3920 3921 if (tls_global_ca_cert(data, params->ca_cert) || 3922 tls_global_client_cert(data, params->client_cert) || 3923 tls_global_private_key(data, params->private_key, 3924 params->private_key_passwd) || 3925 tls_global_dh(data, params->dh_file)) { 3926 wpa_printf(MSG_INFO, "TLS: Failed to set global parameters"); 3927 return -1; 3928 } 3929 3930 if (params->openssl_ciphers && 3931 SSL_CTX_set_cipher_list(ssl_ctx, params->openssl_ciphers) != 1) { 3932 wpa_printf(MSG_INFO, 3933 "OpenSSL: Failed to set cipher string '%s'", 3934 params->openssl_ciphers); 3935 return -1; 3936 } 3937 3938 #ifdef SSL_OP_NO_TICKET 3939 if (params->flags & TLS_CONN_DISABLE_SESSION_TICKET) 3940 SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_TICKET); 3941 #ifdef SSL_CTX_clear_options 3942 else 3943 SSL_CTX_clear_options(ssl_ctx, SSL_OP_NO_TICKET); 3944 #endif /* SSL_clear_options */ 3945 #endif /* SSL_OP_NO_TICKET */ 3946 3947 #ifdef HAVE_OCSP 3948 SSL_CTX_set_tlsext_status_cb(ssl_ctx, ocsp_status_cb); 3949 SSL_CTX_set_tlsext_status_arg(ssl_ctx, ssl_ctx); 3950 os_free(tls_global->ocsp_stapling_response); 3951 if (params->ocsp_stapling_response) 3952 tls_global->ocsp_stapling_response = 3953 os_strdup(params->ocsp_stapling_response); 3954 else 3955 tls_global->ocsp_stapling_response = NULL; 3956 #endif /* HAVE_OCSP */ 3957 3958 return 0; 3959 } 3960 3961 3962 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST) 3963 /* Pre-shared secred requires a patch to openssl, so this function is 3964 * commented out unless explicitly needed for EAP-FAST in order to be able to 3965 * build this file with unmodified openssl. */ 3966 3967 #ifdef OPENSSL_IS_BORINGSSL 3968 static int tls_sess_sec_cb(SSL *s, void *secret, int *secret_len, 3969 STACK_OF(SSL_CIPHER) *peer_ciphers, 3970 const SSL_CIPHER **cipher, void *arg) 3971 #else /* OPENSSL_IS_BORINGSSL */ 3972 static int tls_sess_sec_cb(SSL *s, void *secret, int *secret_len, 3973 STACK_OF(SSL_CIPHER) *peer_ciphers, 3974 SSL_CIPHER **cipher, void *arg) 3975 #endif /* OPENSSL_IS_BORINGSSL */ 3976 { 3977 struct tls_connection *conn = arg; 3978 int ret; 3979 3980 #if OPENSSL_VERSION_NUMBER < 0x10100000L 3981 if (conn == NULL || conn->session_ticket_cb == NULL) 3982 return 0; 3983 3984 ret = conn->session_ticket_cb(conn->session_ticket_cb_ctx, 3985 conn->session_ticket, 3986 conn->session_ticket_len, 3987 s->s3->client_random, 3988 s->s3->server_random, secret); 3989 #else 3990 unsigned char client_random[SSL3_RANDOM_SIZE]; 3991 unsigned char server_random[SSL3_RANDOM_SIZE]; 3992 3993 if (conn == NULL || conn->session_ticket_cb == NULL) 3994 return 0; 3995 3996 SSL_get_client_random(s, client_random, sizeof(client_random)); 3997 SSL_get_server_random(s, server_random, sizeof(server_random)); 3998 3999 ret = conn->session_ticket_cb(conn->session_ticket_cb_ctx, 4000 conn->session_ticket, 4001 conn->session_ticket_len, 4002 client_random, 4003 server_random, secret); 4004 #endif 4005 4006 os_free(conn->session_ticket); 4007 conn->session_ticket = NULL; 4008 4009 if (ret <= 0) 4010 return 0; 4011 4012 *secret_len = SSL_MAX_MASTER_KEY_LENGTH; 4013 return 1; 4014 } 4015 4016 4017 static int tls_session_ticket_ext_cb(SSL *s, const unsigned char *data, 4018 int len, void *arg) 4019 { 4020 struct tls_connection *conn = arg; 4021 4022 if (conn == NULL || conn->session_ticket_cb == NULL) 4023 return 0; 4024 4025 wpa_printf(MSG_DEBUG, "OpenSSL: %s: length=%d", __func__, len); 4026 4027 os_free(conn->session_ticket); 4028 conn->session_ticket = NULL; 4029 4030 wpa_hexdump(MSG_DEBUG, "OpenSSL: ClientHello SessionTicket " 4031 "extension", data, len); 4032 4033 conn->session_ticket = os_malloc(len); 4034 if (conn->session_ticket == NULL) 4035 return 0; 4036 4037 os_memcpy(conn->session_ticket, data, len); 4038 conn->session_ticket_len = len; 4039 4040 return 1; 4041 } 4042 #endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */ 4043 4044 4045 int tls_connection_set_session_ticket_cb(void *tls_ctx, 4046 struct tls_connection *conn, 4047 tls_session_ticket_cb cb, 4048 void *ctx) 4049 { 4050 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST) 4051 conn->session_ticket_cb = cb; 4052 conn->session_ticket_cb_ctx = ctx; 4053 4054 if (cb) { 4055 if (SSL_set_session_secret_cb(conn->ssl, tls_sess_sec_cb, 4056 conn) != 1) 4057 return -1; 4058 SSL_set_session_ticket_ext_cb(conn->ssl, 4059 tls_session_ticket_ext_cb, conn); 4060 } else { 4061 if (SSL_set_session_secret_cb(conn->ssl, NULL, NULL) != 1) 4062 return -1; 4063 SSL_set_session_ticket_ext_cb(conn->ssl, NULL, NULL); 4064 } 4065 4066 return 0; 4067 #else /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */ 4068 return -1; 4069 #endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */ 4070 } 4071 4072 4073 int tls_get_library_version(char *buf, size_t buf_len) 4074 { 4075 return os_snprintf(buf, buf_len, "OpenSSL build=%s run=%s", 4076 OPENSSL_VERSION_TEXT, 4077 SSLeay_version(SSLEAY_VERSION)); 4078 } 4079 4080 4081 void tls_connection_set_success_data(struct tls_connection *conn, 4082 struct wpabuf *data) 4083 { 4084 SSL_SESSION *sess; 4085 struct wpabuf *old; 4086 4087 if (tls_ex_idx_session < 0) 4088 goto fail; 4089 sess = SSL_get_session(conn->ssl); 4090 if (!sess) 4091 goto fail; 4092 old = SSL_SESSION_get_ex_data(sess, tls_ex_idx_session); 4093 if (old) { 4094 wpa_printf(MSG_DEBUG, "OpenSSL: Replacing old success data %p", 4095 old); 4096 wpabuf_free(old); 4097 } 4098 if (SSL_SESSION_set_ex_data(sess, tls_ex_idx_session, data) != 1) 4099 goto fail; 4100 4101 wpa_printf(MSG_DEBUG, "OpenSSL: Stored success data %p", data); 4102 conn->success_data = 1; 4103 return; 4104 4105 fail: 4106 wpa_printf(MSG_INFO, "OpenSSL: Failed to store success data"); 4107 wpabuf_free(data); 4108 } 4109 4110 4111 void tls_connection_set_success_data_resumed(struct tls_connection *conn) 4112 { 4113 wpa_printf(MSG_DEBUG, 4114 "OpenSSL: Success data accepted for resumed session"); 4115 conn->success_data = 1; 4116 } 4117 4118 4119 const struct wpabuf * 4120 tls_connection_get_success_data(struct tls_connection *conn) 4121 { 4122 SSL_SESSION *sess; 4123 4124 if (tls_ex_idx_session < 0 || 4125 !(sess = SSL_get_session(conn->ssl))) 4126 return NULL; 4127 return SSL_SESSION_get_ex_data(sess, tls_ex_idx_session); 4128 } 4129 4130 4131 void tls_connection_remove_session(struct tls_connection *conn) 4132 { 4133 SSL_SESSION *sess; 4134 4135 sess = SSL_get_session(conn->ssl); 4136 if (!sess) 4137 return; 4138 4139 if (SSL_CTX_remove_session(conn->ssl_ctx, sess) != 1) 4140 wpa_printf(MSG_DEBUG, 4141 "OpenSSL: Session was not cached"); 4142 else 4143 wpa_printf(MSG_DEBUG, 4144 "OpenSSL: Removed cached session to disable session resumption"); 4145 } 4146