1 /* 2 * TLS v1.0/v1.1/v1.2 client (RFC 2246, RFC 4346, RFC 5246) 3 * Copyright (c) 2006-2019, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 11 #include "common.h" 12 #include "crypto/sha1.h" 13 #include "crypto/tls.h" 14 #include "x509v3.h" 15 #include "tlsv1_common.h" 16 #include "tlsv1_record.h" 17 #include "tlsv1_client.h" 18 #include "tlsv1_client_i.h" 19 20 /* TODO: 21 * Support for a message fragmented across several records (RFC 2246, 6.2.1) 22 */ 23 24 25 void tls_alert(struct tlsv1_client *conn, u8 level, u8 description) 26 { 27 conn->alert_level = level; 28 conn->alert_description = description; 29 } 30 31 32 void tlsv1_client_free_dh(struct tlsv1_client *conn) 33 { 34 os_free(conn->dh_p); 35 os_free(conn->dh_g); 36 os_free(conn->dh_ys); 37 conn->dh_p = conn->dh_g = conn->dh_ys = NULL; 38 } 39 40 41 int tls_derive_pre_master_secret(u8 *pre_master_secret) 42 { 43 WPA_PUT_BE16(pre_master_secret, TLS_VERSION); 44 if (os_get_random(pre_master_secret + 2, 45 TLS_PRE_MASTER_SECRET_LEN - 2)) 46 return -1; 47 return 0; 48 } 49 50 51 int tls_derive_keys(struct tlsv1_client *conn, 52 const u8 *pre_master_secret, size_t pre_master_secret_len) 53 { 54 u8 seed[2 * TLS_RANDOM_LEN]; 55 u8 key_block[TLS_MAX_KEY_BLOCK_LEN]; 56 u8 *pos; 57 size_t key_block_len; 58 59 if (pre_master_secret) { 60 wpa_hexdump_key(MSG_MSGDUMP, "TLSv1: pre_master_secret", 61 pre_master_secret, pre_master_secret_len); 62 os_memcpy(seed, conn->client_random, TLS_RANDOM_LEN); 63 os_memcpy(seed + TLS_RANDOM_LEN, conn->server_random, 64 TLS_RANDOM_LEN); 65 if (tls_prf(conn->rl.tls_version, 66 pre_master_secret, pre_master_secret_len, 67 "master secret", seed, 2 * TLS_RANDOM_LEN, 68 conn->master_secret, TLS_MASTER_SECRET_LEN)) { 69 wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive " 70 "master_secret"); 71 return -1; 72 } 73 wpa_hexdump_key(MSG_MSGDUMP, "TLSv1: master_secret", 74 conn->master_secret, TLS_MASTER_SECRET_LEN); 75 } 76 77 os_memcpy(seed, conn->server_random, TLS_RANDOM_LEN); 78 os_memcpy(seed + TLS_RANDOM_LEN, conn->client_random, TLS_RANDOM_LEN); 79 key_block_len = 2 * (conn->rl.hash_size + conn->rl.key_material_len); 80 if (conn->rl.tls_version == TLS_VERSION_1) 81 key_block_len += 2 * conn->rl.iv_size; 82 if (tls_prf(conn->rl.tls_version, 83 conn->master_secret, TLS_MASTER_SECRET_LEN, 84 "key expansion", seed, 2 * TLS_RANDOM_LEN, 85 key_block, key_block_len)) { 86 wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive key_block"); 87 return -1; 88 } 89 wpa_hexdump_key(MSG_MSGDUMP, "TLSv1: key_block", 90 key_block, key_block_len); 91 92 pos = key_block; 93 94 /* client_write_MAC_secret */ 95 os_memcpy(conn->rl.write_mac_secret, pos, conn->rl.hash_size); 96 pos += conn->rl.hash_size; 97 /* server_write_MAC_secret */ 98 os_memcpy(conn->rl.read_mac_secret, pos, conn->rl.hash_size); 99 pos += conn->rl.hash_size; 100 101 /* client_write_key */ 102 os_memcpy(conn->rl.write_key, pos, conn->rl.key_material_len); 103 pos += conn->rl.key_material_len; 104 /* server_write_key */ 105 os_memcpy(conn->rl.read_key, pos, conn->rl.key_material_len); 106 pos += conn->rl.key_material_len; 107 108 if (conn->rl.tls_version == TLS_VERSION_1) { 109 /* client_write_IV */ 110 os_memcpy(conn->rl.write_iv, pos, conn->rl.iv_size); 111 pos += conn->rl.iv_size; 112 /* server_write_IV */ 113 os_memcpy(conn->rl.read_iv, pos, conn->rl.iv_size); 114 } else { 115 /* 116 * Use IV field to set the mask value for TLS v1.1. A fixed 117 * mask of zero is used per the RFC 4346, 6.2.3.2 CBC Block 118 * Cipher option 2a. 119 */ 120 os_memset(conn->rl.write_iv, 0, conn->rl.iv_size); 121 } 122 123 return 0; 124 } 125 126 127 /** 128 * tlsv1_client_handshake - Process TLS handshake 129 * @conn: TLSv1 client connection data from tlsv1_client_init() 130 * @in_data: Input data from TLS peer 131 * @in_len: Input data length 132 * @out_len: Length of the output buffer. 133 * @appl_data: Pointer to application data pointer, or %NULL if dropped 134 * @appl_data_len: Pointer to variable that is set to appl_data length 135 * @need_more_data: Set to 1 if more data would be needed to complete 136 * processing 137 * Returns: Pointer to output data, %NULL on failure 138 */ 139 u8 * tlsv1_client_handshake(struct tlsv1_client *conn, 140 const u8 *in_data, size_t in_len, 141 size_t *out_len, u8 **appl_data, 142 size_t *appl_data_len, int *need_more_data) 143 { 144 const u8 *pos, *end; 145 u8 *msg = NULL, *in_msg = NULL, *in_pos, *in_end, alert, ct; 146 size_t in_msg_len; 147 int no_appl_data; 148 int used; 149 150 if (need_more_data) 151 *need_more_data = 0; 152 153 if (conn->state == CLIENT_HELLO) { 154 if (in_len) 155 return NULL; 156 return tls_send_client_hello(conn, out_len); 157 } 158 159 if (conn->partial_input) { 160 if (wpabuf_resize(&conn->partial_input, in_len) < 0) { 161 wpa_printf(MSG_DEBUG, "TLSv1: Failed to allocate " 162 "memory for pending record"); 163 tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 164 TLS_ALERT_INTERNAL_ERROR); 165 goto failed; 166 } 167 wpabuf_put_data(conn->partial_input, in_data, in_len); 168 in_data = wpabuf_head(conn->partial_input); 169 in_len = wpabuf_len(conn->partial_input); 170 } 171 172 if (in_data == NULL || in_len == 0) 173 return NULL; 174 175 pos = in_data; 176 end = in_data + in_len; 177 in_msg = os_malloc(in_len); 178 if (in_msg == NULL) 179 return NULL; 180 181 /* Each received packet may include multiple records */ 182 while (pos < end) { 183 in_msg_len = in_len; 184 used = tlsv1_record_receive(&conn->rl, pos, end - pos, 185 in_msg, &in_msg_len, &alert); 186 if (used < 0) { 187 wpa_printf(MSG_DEBUG, "TLSv1: Processing received " 188 "record failed"); 189 tls_alert(conn, TLS_ALERT_LEVEL_FATAL, alert); 190 goto failed; 191 } 192 if (used == 0) { 193 struct wpabuf *partial; 194 wpa_printf(MSG_DEBUG, "TLSv1: Need more data"); 195 partial = wpabuf_alloc_copy(pos, end - pos); 196 wpabuf_free(conn->partial_input); 197 conn->partial_input = partial; 198 if (conn->partial_input == NULL) { 199 wpa_printf(MSG_DEBUG, "TLSv1: Failed to " 200 "allocate memory for pending " 201 "record"); 202 tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 203 TLS_ALERT_INTERNAL_ERROR); 204 goto failed; 205 } 206 os_free(in_msg); 207 if (need_more_data) 208 *need_more_data = 1; 209 return NULL; 210 } 211 ct = pos[0]; 212 213 in_pos = in_msg; 214 in_end = in_msg + in_msg_len; 215 216 /* Each received record may include multiple messages of the 217 * same ContentType. */ 218 while (in_pos < in_end) { 219 in_msg_len = in_end - in_pos; 220 if (tlsv1_client_process_handshake(conn, ct, in_pos, 221 &in_msg_len, 222 appl_data, 223 appl_data_len) < 0) 224 goto failed; 225 in_pos += in_msg_len; 226 } 227 228 pos += used; 229 } 230 231 os_free(in_msg); 232 in_msg = NULL; 233 234 no_appl_data = appl_data == NULL || *appl_data == NULL; 235 msg = tlsv1_client_handshake_write(conn, out_len, no_appl_data); 236 237 failed: 238 os_free(in_msg); 239 if (conn->alert_level) { 240 wpabuf_free(conn->partial_input); 241 conn->partial_input = NULL; 242 conn->state = FAILED; 243 os_free(msg); 244 msg = tlsv1_client_send_alert(conn, conn->alert_level, 245 conn->alert_description, 246 out_len); 247 } else if (msg == NULL) { 248 msg = os_zalloc(1); 249 *out_len = 0; 250 } 251 252 if (need_more_data == NULL || !(*need_more_data)) { 253 wpabuf_free(conn->partial_input); 254 conn->partial_input = NULL; 255 } 256 257 return msg; 258 } 259 260 261 /** 262 * tlsv1_client_encrypt - Encrypt data into TLS tunnel 263 * @conn: TLSv1 client connection data from tlsv1_client_init() 264 * @in_data: Pointer to plaintext data to be encrypted 265 * @in_len: Input buffer length 266 * @out_data: Pointer to output buffer (encrypted TLS data) 267 * @out_len: Maximum out_data length 268 * Returns: Number of bytes written to out_data, -1 on failure 269 * 270 * This function is used after TLS handshake has been completed successfully to 271 * send data in the encrypted tunnel. 272 */ 273 int tlsv1_client_encrypt(struct tlsv1_client *conn, 274 const u8 *in_data, size_t in_len, 275 u8 *out_data, size_t out_len) 276 { 277 size_t rlen; 278 279 wpa_hexdump_key(MSG_MSGDUMP, "TLSv1: Plaintext AppData", 280 in_data, in_len); 281 282 if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_APPLICATION_DATA, 283 out_data, out_len, in_data, in_len, &rlen) < 0) { 284 wpa_printf(MSG_DEBUG, "TLSv1: Failed to create a record"); 285 tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 286 TLS_ALERT_INTERNAL_ERROR); 287 return -1; 288 } 289 290 return rlen; 291 } 292 293 294 /** 295 * tlsv1_client_decrypt - Decrypt data from TLS tunnel 296 * @conn: TLSv1 client connection data from tlsv1_client_init() 297 * @in_data: Pointer to input buffer (encrypted TLS data) 298 * @in_len: Input buffer length 299 * @need_more_data: Set to 1 if more data would be needed to complete 300 * processing 301 * Returns: Decrypted data or %NULL on failure 302 * 303 * This function is used after TLS handshake has been completed successfully to 304 * receive data from the encrypted tunnel. 305 */ 306 struct wpabuf * tlsv1_client_decrypt(struct tlsv1_client *conn, 307 const u8 *in_data, size_t in_len, 308 int *need_more_data) 309 { 310 const u8 *in_end, *pos; 311 int used; 312 u8 alert, *out_pos, ct; 313 size_t olen; 314 struct wpabuf *buf = NULL; 315 316 if (need_more_data) 317 *need_more_data = 0; 318 319 if (conn->partial_input) { 320 if (wpabuf_resize(&conn->partial_input, in_len) < 0) { 321 wpa_printf(MSG_DEBUG, "TLSv1: Failed to allocate " 322 "memory for pending record"); 323 alert = TLS_ALERT_INTERNAL_ERROR; 324 goto fail; 325 } 326 wpabuf_put_data(conn->partial_input, in_data, in_len); 327 in_data = wpabuf_head(conn->partial_input); 328 in_len = wpabuf_len(conn->partial_input); 329 } 330 331 pos = in_data; 332 in_end = in_data + in_len; 333 334 while (pos < in_end) { 335 ct = pos[0]; 336 if (wpabuf_resize(&buf, in_end - pos) < 0) { 337 alert = TLS_ALERT_INTERNAL_ERROR; 338 goto fail; 339 } 340 out_pos = wpabuf_put(buf, 0); 341 olen = wpabuf_tailroom(buf); 342 used = tlsv1_record_receive(&conn->rl, pos, in_end - pos, 343 out_pos, &olen, &alert); 344 if (used < 0) { 345 wpa_printf(MSG_DEBUG, "TLSv1: Record layer processing " 346 "failed"); 347 goto fail; 348 } 349 if (used == 0) { 350 struct wpabuf *partial; 351 wpa_printf(MSG_DEBUG, "TLSv1: Need more data"); 352 partial = wpabuf_alloc_copy(pos, in_end - pos); 353 wpabuf_free(conn->partial_input); 354 conn->partial_input = partial; 355 if (conn->partial_input == NULL) { 356 wpa_printf(MSG_DEBUG, "TLSv1: Failed to " 357 "allocate memory for pending " 358 "record"); 359 alert = TLS_ALERT_INTERNAL_ERROR; 360 goto fail; 361 } 362 if (need_more_data) 363 *need_more_data = 1; 364 return buf; 365 } 366 367 if (ct == TLS_CONTENT_TYPE_ALERT) { 368 if (olen < 2) { 369 wpa_printf(MSG_DEBUG, "TLSv1: Alert " 370 "underflow"); 371 alert = TLS_ALERT_DECODE_ERROR; 372 goto fail; 373 } 374 wpa_printf(MSG_DEBUG, "TLSv1: Received alert %d:%d", 375 out_pos[0], out_pos[1]); 376 if (out_pos[0] == TLS_ALERT_LEVEL_WARNING) { 377 /* Continue processing */ 378 pos += used; 379 continue; 380 } 381 382 alert = out_pos[1]; 383 goto fail; 384 } 385 386 if (ct != TLS_CONTENT_TYPE_APPLICATION_DATA) { 387 wpa_printf(MSG_DEBUG, "TLSv1: Unexpected content type " 388 "0x%x when decrypting application data", 389 pos[0]); 390 alert = TLS_ALERT_UNEXPECTED_MESSAGE; 391 goto fail; 392 } 393 394 wpabuf_put(buf, olen); 395 396 pos += used; 397 } 398 399 wpabuf_free(conn->partial_input); 400 conn->partial_input = NULL; 401 return buf; 402 403 fail: 404 wpabuf_free(buf); 405 wpabuf_free(conn->partial_input); 406 conn->partial_input = NULL; 407 tls_alert(conn, TLS_ALERT_LEVEL_FATAL, alert); 408 return NULL; 409 } 410 411 412 /** 413 * tlsv1_client_global_init - Initialize TLSv1 client 414 * Returns: 0 on success, -1 on failure 415 * 416 * This function must be called before using any other TLSv1 client functions. 417 */ 418 int tlsv1_client_global_init(void) 419 { 420 return crypto_global_init(); 421 } 422 423 424 /** 425 * tlsv1_client_global_deinit - Deinitialize TLSv1 client 426 * 427 * This function can be used to deinitialize the TLSv1 client that was 428 * initialized by calling tlsv1_client_global_init(). No TLSv1 client functions 429 * can be called after this before calling tlsv1_client_global_init() again. 430 */ 431 void tlsv1_client_global_deinit(void) 432 { 433 crypto_global_deinit(); 434 } 435 436 437 /** 438 * tlsv1_client_init - Initialize TLSv1 client connection 439 * Returns: Pointer to TLSv1 client connection data or %NULL on failure 440 */ 441 struct tlsv1_client * tlsv1_client_init(void) 442 { 443 struct tlsv1_client *conn; 444 size_t count; 445 u16 *suites; 446 447 conn = os_zalloc(sizeof(*conn)); 448 if (conn == NULL) 449 return NULL; 450 451 conn->state = CLIENT_HELLO; 452 453 if (tls_verify_hash_init(&conn->verify) < 0) { 454 wpa_printf(MSG_DEBUG, "TLSv1: Failed to initialize verify " 455 "hash"); 456 os_free(conn); 457 return NULL; 458 } 459 460 count = 0; 461 suites = conn->cipher_suites; 462 suites[count++] = TLS_DHE_RSA_WITH_AES_256_CBC_SHA256; 463 suites[count++] = TLS_RSA_WITH_AES_256_CBC_SHA256; 464 suites[count++] = TLS_DHE_RSA_WITH_AES_256_CBC_SHA; 465 suites[count++] = TLS_RSA_WITH_AES_256_CBC_SHA; 466 suites[count++] = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256; 467 suites[count++] = TLS_RSA_WITH_AES_128_CBC_SHA256; 468 suites[count++] = TLS_DHE_RSA_WITH_AES_128_CBC_SHA; 469 suites[count++] = TLS_RSA_WITH_AES_128_CBC_SHA; 470 suites[count++] = TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA; 471 suites[count++] = TLS_RSA_WITH_3DES_EDE_CBC_SHA; 472 suites[count++] = TLS_RSA_WITH_RC4_128_SHA; 473 suites[count++] = TLS_RSA_WITH_RC4_128_MD5; 474 conn->num_cipher_suites = count; 475 476 conn->rl.tls_version = TLS_VERSION; 477 478 return conn; 479 } 480 481 482 /** 483 * tlsv1_client_deinit - Deinitialize TLSv1 client connection 484 * @conn: TLSv1 client connection data from tlsv1_client_init() 485 */ 486 void tlsv1_client_deinit(struct tlsv1_client *conn) 487 { 488 crypto_public_key_free(conn->server_rsa_key); 489 tlsv1_record_set_cipher_suite(&conn->rl, TLS_NULL_WITH_NULL_NULL); 490 tlsv1_record_change_write_cipher(&conn->rl); 491 tlsv1_record_change_read_cipher(&conn->rl); 492 tls_verify_hash_free(&conn->verify); 493 os_free(conn->client_hello_ext); 494 tlsv1_client_free_dh(conn); 495 tlsv1_cred_free(conn->cred); 496 wpabuf_free(conn->partial_input); 497 x509_certificate_chain_free(conn->server_cert); 498 os_free(conn); 499 } 500 501 502 /** 503 * tlsv1_client_established - Check whether connection has been established 504 * @conn: TLSv1 client connection data from tlsv1_client_init() 505 * Returns: 1 if connection is established, 0 if not 506 */ 507 int tlsv1_client_established(struct tlsv1_client *conn) 508 { 509 return conn->state == ESTABLISHED; 510 } 511 512 513 /** 514 * tlsv1_client_prf - Use TLS-PRF to derive keying material 515 * @conn: TLSv1 client connection data from tlsv1_client_init() 516 * @label: Label (e.g., description of the key) for PRF 517 * @context: Optional extra upper-layer context (max len 2^16) 518 * @context_len: The length of the context value 519 * @server_random_first: seed is 0 = client_random|server_random, 520 * 1 = server_random|client_random 521 * @out: Buffer for output data from TLS-PRF 522 * @out_len: Length of the output buffer 523 * Returns: 0 on success, -1 on failure 524 */ 525 int tlsv1_client_prf(struct tlsv1_client *conn, const char *label, 526 const u8 *context, size_t context_len, 527 int server_random_first, u8 *out, size_t out_len) 528 { 529 u8 *seed, *pos; 530 size_t seed_len = 2 * TLS_RANDOM_LEN; 531 int res; 532 533 if (conn->state != ESTABLISHED) 534 return -1; 535 536 if (context_len > 65535) 537 return -1; 538 539 if (context) 540 seed_len += 2 + context_len; 541 542 seed = os_malloc(seed_len); 543 if (!seed) 544 return -1; 545 546 if (server_random_first) { 547 os_memcpy(seed, conn->server_random, TLS_RANDOM_LEN); 548 os_memcpy(seed + TLS_RANDOM_LEN, conn->client_random, 549 TLS_RANDOM_LEN); 550 } else { 551 os_memcpy(seed, conn->client_random, TLS_RANDOM_LEN); 552 os_memcpy(seed + TLS_RANDOM_LEN, conn->server_random, 553 TLS_RANDOM_LEN); 554 } 555 556 if (context) { 557 pos = seed + 2 * TLS_RANDOM_LEN; 558 WPA_PUT_BE16(pos, context_len); 559 pos += 2; 560 os_memcpy(pos, context, context_len); 561 } 562 563 res = tls_prf(conn->rl.tls_version, 564 conn->master_secret, TLS_MASTER_SECRET_LEN, 565 label, seed, seed_len, out, out_len); 566 os_free(seed); 567 return res; 568 } 569 570 571 /** 572 * tlsv1_client_get_cipher - Get current cipher name 573 * @conn: TLSv1 client connection data from tlsv1_client_init() 574 * @buf: Buffer for the cipher name 575 * @buflen: buf size 576 * Returns: 0 on success, -1 on failure 577 * 578 * Get the name of the currently used cipher. 579 */ 580 int tlsv1_client_get_cipher(struct tlsv1_client *conn, char *buf, 581 size_t buflen) 582 { 583 char *cipher; 584 585 switch (conn->rl.cipher_suite) { 586 case TLS_RSA_WITH_RC4_128_MD5: 587 cipher = "RC4-MD5"; 588 break; 589 case TLS_RSA_WITH_RC4_128_SHA: 590 cipher = "RC4-SHA"; 591 break; 592 case TLS_RSA_WITH_DES_CBC_SHA: 593 cipher = "DES-CBC-SHA"; 594 break; 595 case TLS_RSA_WITH_3DES_EDE_CBC_SHA: 596 cipher = "DES-CBC3-SHA"; 597 break; 598 case TLS_DHE_RSA_WITH_DES_CBC_SHA: 599 cipher = "DHE-RSA-DES-CBC-SHA"; 600 break; 601 case TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA: 602 cipher = "DHE-RSA-DES-CBC3-SHA"; 603 break; 604 case TLS_DH_anon_WITH_RC4_128_MD5: 605 cipher = "ADH-RC4-MD5"; 606 break; 607 case TLS_DH_anon_WITH_DES_CBC_SHA: 608 cipher = "ADH-DES-SHA"; 609 break; 610 case TLS_DH_anon_WITH_3DES_EDE_CBC_SHA: 611 cipher = "ADH-DES-CBC3-SHA"; 612 break; 613 case TLS_RSA_WITH_AES_128_CBC_SHA: 614 cipher = "AES-128-SHA"; 615 break; 616 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA: 617 cipher = "DHE-RSA-AES-128-SHA"; 618 break; 619 case TLS_DH_anon_WITH_AES_128_CBC_SHA: 620 cipher = "ADH-AES-128-SHA"; 621 break; 622 case TLS_RSA_WITH_AES_256_CBC_SHA: 623 cipher = "AES-256-SHA"; 624 break; 625 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA: 626 cipher = "DHE-RSA-AES-256-SHA"; 627 break; 628 case TLS_DH_anon_WITH_AES_256_CBC_SHA: 629 cipher = "ADH-AES-256-SHA"; 630 break; 631 case TLS_RSA_WITH_AES_128_CBC_SHA256: 632 cipher = "AES-128-SHA256"; 633 break; 634 case TLS_RSA_WITH_AES_256_CBC_SHA256: 635 cipher = "AES-256-SHA256"; 636 break; 637 case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256: 638 cipher = "DHE-RSA-AES-128-SHA256"; 639 break; 640 case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256: 641 cipher = "DHE-RSA-AES-256-SHA256"; 642 break; 643 case TLS_DH_anon_WITH_AES_128_CBC_SHA256: 644 cipher = "ADH-AES-128-SHA256"; 645 break; 646 case TLS_DH_anon_WITH_AES_256_CBC_SHA256: 647 cipher = "ADH-AES-256-SHA256"; 648 break; 649 default: 650 return -1; 651 } 652 653 if (os_strlcpy(buf, cipher, buflen) >= buflen) 654 return -1; 655 return 0; 656 } 657 658 659 /** 660 * tlsv1_client_shutdown - Shutdown TLS connection 661 * @conn: TLSv1 client connection data from tlsv1_client_init() 662 * Returns: 0 on success, -1 on failure 663 */ 664 int tlsv1_client_shutdown(struct tlsv1_client *conn) 665 { 666 conn->state = CLIENT_HELLO; 667 668 if (tls_verify_hash_init(&conn->verify) < 0) { 669 wpa_printf(MSG_DEBUG, "TLSv1: Failed to re-initialize verify " 670 "hash"); 671 return -1; 672 } 673 674 tlsv1_record_set_cipher_suite(&conn->rl, TLS_NULL_WITH_NULL_NULL); 675 tlsv1_record_change_write_cipher(&conn->rl); 676 tlsv1_record_change_read_cipher(&conn->rl); 677 678 conn->certificate_requested = 0; 679 crypto_public_key_free(conn->server_rsa_key); 680 conn->server_rsa_key = NULL; 681 conn->session_resumed = 0; 682 683 return 0; 684 } 685 686 687 /** 688 * tlsv1_client_resumed - Was session resumption used 689 * @conn: TLSv1 client connection data from tlsv1_client_init() 690 * Returns: 1 if current session used session resumption, 0 if not 691 */ 692 int tlsv1_client_resumed(struct tlsv1_client *conn) 693 { 694 return !!conn->session_resumed; 695 } 696 697 698 /** 699 * tlsv1_client_hello_ext - Set TLS extension for ClientHello 700 * @conn: TLSv1 client connection data from tlsv1_client_init() 701 * @ext_type: Extension type 702 * @data: Extension payload (%NULL to remove extension) 703 * @data_len: Extension payload length 704 * Returns: 0 on success, -1 on failure 705 */ 706 int tlsv1_client_hello_ext(struct tlsv1_client *conn, int ext_type, 707 const u8 *data, size_t data_len) 708 { 709 u8 *pos; 710 711 conn->session_ticket_included = 0; 712 os_free(conn->client_hello_ext); 713 conn->client_hello_ext = NULL; 714 conn->client_hello_ext_len = 0; 715 716 if (data == NULL || data_len == 0) 717 return 0; 718 719 pos = conn->client_hello_ext = os_malloc(4 + data_len); 720 if (pos == NULL) 721 return -1; 722 723 WPA_PUT_BE16(pos, ext_type); 724 pos += 2; 725 WPA_PUT_BE16(pos, data_len); 726 pos += 2; 727 os_memcpy(pos, data, data_len); 728 conn->client_hello_ext_len = 4 + data_len; 729 730 if (ext_type == TLS_EXT_PAC_OPAQUE) { 731 conn->session_ticket_included = 1; 732 wpa_printf(MSG_DEBUG, "TLSv1: Using session ticket"); 733 } 734 735 return 0; 736 } 737 738 739 /** 740 * tlsv1_client_get_random - Get random data from TLS connection 741 * @conn: TLSv1 client connection data from tlsv1_client_init() 742 * @keys: Structure of random data (filled on success) 743 * Returns: 0 on success, -1 on failure 744 */ 745 int tlsv1_client_get_random(struct tlsv1_client *conn, struct tls_random *keys) 746 { 747 os_memset(keys, 0, sizeof(*keys)); 748 if (conn->state == CLIENT_HELLO) 749 return -1; 750 751 keys->client_random = conn->client_random; 752 keys->client_random_len = TLS_RANDOM_LEN; 753 754 if (conn->state != SERVER_HELLO) { 755 keys->server_random = conn->server_random; 756 keys->server_random_len = TLS_RANDOM_LEN; 757 } 758 759 return 0; 760 } 761 762 763 /** 764 * tlsv1_client_get_keyblock_size - Get TLS key_block size 765 * @conn: TLSv1 client connection data from tlsv1_client_init() 766 * Returns: Size of the key_block for the negotiated cipher suite or -1 on 767 * failure 768 */ 769 int tlsv1_client_get_keyblock_size(struct tlsv1_client *conn) 770 { 771 if (conn->state == CLIENT_HELLO || conn->state == SERVER_HELLO) 772 return -1; 773 774 return 2 * (conn->rl.hash_size + conn->rl.key_material_len + 775 conn->rl.iv_size); 776 } 777 778 779 /** 780 * tlsv1_client_set_cipher_list - Configure acceptable cipher suites 781 * @conn: TLSv1 client connection data from tlsv1_client_init() 782 * @ciphers: Zero (TLS_CIPHER_NONE) terminated list of allowed ciphers 783 * (TLS_CIPHER_*). 784 * Returns: 0 on success, -1 on failure 785 */ 786 int tlsv1_client_set_cipher_list(struct tlsv1_client *conn, u8 *ciphers) 787 { 788 size_t count; 789 u16 *suites; 790 791 /* TODO: implement proper configuration of cipher suites */ 792 if (ciphers[0] == TLS_CIPHER_ANON_DH_AES128_SHA) { 793 count = 0; 794 suites = conn->cipher_suites; 795 suites[count++] = TLS_DH_anon_WITH_AES_256_CBC_SHA256; 796 suites[count++] = TLS_DH_anon_WITH_AES_256_CBC_SHA; 797 suites[count++] = TLS_DH_anon_WITH_AES_128_CBC_SHA256; 798 suites[count++] = TLS_DH_anon_WITH_AES_128_CBC_SHA; 799 suites[count++] = TLS_DH_anon_WITH_3DES_EDE_CBC_SHA; 800 suites[count++] = TLS_DH_anon_WITH_RC4_128_MD5; 801 suites[count++] = TLS_DH_anon_WITH_DES_CBC_SHA; 802 803 /* 804 * Cisco AP (at least 350 and 1200 series) local authentication 805 * server does not know how to search cipher suites from the 806 * list and seem to require that the last entry in the list is 807 * the one that it wants to use. However, TLS specification 808 * requires the list to be in the client preference order. As a 809 * workaround, add anon-DH AES-128-SHA1 again at the end of the 810 * list to allow the Cisco code to find it. 811 */ 812 suites[count++] = TLS_DH_anon_WITH_AES_128_CBC_SHA; 813 conn->num_cipher_suites = count; 814 } 815 816 return 0; 817 } 818 819 820 /** 821 * tlsv1_client_set_cred - Set client credentials 822 * @conn: TLSv1 client connection data from tlsv1_client_init() 823 * @cred: Credentials from tlsv1_cred_alloc() 824 * Returns: 0 on success, -1 on failure 825 * 826 * On success, the client takes ownership of the credentials block and caller 827 * must not free it. On failure, caller is responsible for freeing the 828 * credential block. 829 */ 830 int tlsv1_client_set_cred(struct tlsv1_client *conn, 831 struct tlsv1_credentials *cred) 832 { 833 tlsv1_cred_free(conn->cred); 834 conn->cred = cred; 835 return 0; 836 } 837 838 839 /** 840 * tlsv1_client_set_flags - Set connection flags 841 * @conn: TLSv1 client connection data from tlsv1_client_init() 842 * @flags: TLS_CONN_* bitfield 843 */ 844 void tlsv1_client_set_flags(struct tlsv1_client *conn, unsigned int flags) 845 { 846 conn->flags = flags; 847 } 848 849 850 void tlsv1_client_set_session_ticket_cb(struct tlsv1_client *conn, 851 tlsv1_client_session_ticket_cb cb, 852 void *ctx) 853 { 854 wpa_printf(MSG_DEBUG, "TLSv1: SessionTicket callback set %p (ctx %p)", 855 cb, ctx); 856 conn->session_ticket_cb = cb; 857 conn->session_ticket_cb_ctx = ctx; 858 } 859 860 861 void tlsv1_client_set_cb(struct tlsv1_client *conn, 862 void (*event_cb)(void *ctx, enum tls_event ev, 863 union tls_event_data *data), 864 void *cb_ctx, 865 int cert_in_cb) 866 { 867 conn->event_cb = event_cb; 868 conn->cb_ctx = cb_ctx; 869 conn->cert_in_cb = !!cert_in_cb; 870 } 871 872 873 int tlsv1_client_get_version(struct tlsv1_client *conn, char *buf, 874 size_t buflen) 875 { 876 if (!conn) 877 return -1; 878 switch (conn->rl.tls_version) { 879 case TLS_VERSION_1: 880 os_strlcpy(buf, "TLSv1", buflen); 881 break; 882 case TLS_VERSION_1_1: 883 os_strlcpy(buf, "TLSv1.1", buflen); 884 break; 885 case TLS_VERSION_1_2: 886 os_strlcpy(buf, "TLSv1.2", buflen); 887 break; 888 default: 889 return -1; 890 } 891 892 return 0; 893 } 894