]> git.ipfire.org Git - thirdparty/hostap.git/blame - src/crypto/tls_openssl.c
projects / thirdparty / hostap.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Use char pointers for EAP configuration parameters without length
[thirdparty/hostap.git] / src / crypto / tls_openssl.c
CommitLineData
6fc6879b 1/*
81c85c06 2 * SSL/TLS interface functions for OpenSSL
16bc3b89 3 * Copyright (c) 2004-2015, Jouni Malinen <j@w1.fi>
6fc6879b 4 *
0f3d578e
JM		 5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
6fc6879b
JM		 7 */
8
9#include "includes.h"
10
11#ifndef CONFIG_SMARTCARD
12#ifndef OPENSSL_NO_ENGINE
1176ab6d 13#ifndef ANDROID
6fc6879b
JM		 14#define OPENSSL_NO_ENGINE
15#endif
16#endif
1176ab6d 17#endif
6fc6879b
JM		 18
19#include <openssl/ssl.h>
20#include <openssl/err.h>
e4471338 21#include <openssl/opensslv.h>
6fc6879b
JM		 22#include <openssl/pkcs12.h>
23#include <openssl/x509v3.h>
24#ifndef OPENSSL_NO_ENGINE
25#include <openssl/engine.h>
26#endif /* OPENSSL_NO_ENGINE */
690e543e
JM		 27#ifndef OPENSSL_NO_DSA
28#include <openssl/dsa.h>
29#endif
30#ifndef OPENSSL_NO_DH
31#include <openssl/dh.h>
32#endif
6fc6879b
JM		 33
34#include "common.h"
00468b46 35#include "crypto.h"
fa0e7151 36#include "sha1.h"
16bc3b89 37#include "sha256.h"
6fc6879b 38#include "tls.h"
213e158c 39#include "tls_openssl.h"
6fc6879b 40
1cece2fa
DB		 41#if !defined(CONFIG_FIPS) && \
42 (defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || \
43 defined(EAP_SERVER_FAST))
44#define OPENSSL_NEED_EAP_FAST_PRF
45#endif
46
a8572960
AL		 47#if defined(OPENSSL_IS_BORINGSSL)
48/* stack_index_t is the return type of OpenSSL's sk_XXX_num() functions. */
49typedef size_t stack_index_t;
50#else
51typedef int stack_index_t;
0cf03892
JM		 52#endif
53
080585c0
JM		 54#ifdef SSL_set_tlsext_status_type
55#ifndef OPENSSL_NO_TLSEXT
56#define HAVE_OCSP
57#include <openssl/ocsp.h>
58#endif /* OPENSSL_NO_TLSEXT */
59#endif /* SSL_set_tlsext_status_type */
60
e4471338 61#if (OPENSSL_VERSION_NUMBER < 0x10100000L || \
ba3658cf
BS		 62 (defined(LIBRESSL_VERSION_NUMBER) && \
63 LIBRESSL_VERSION_NUMBER < 0x20700000L)) && \
e4471338 64 !defined(BORINGSSL_API_VERSION)
dea20519
JM		 65/*
66 * SSL_get_client_random() and SSL_get_server_random() were added in OpenSSL
e4471338
DB		 67 * 1.1.0 and newer BoringSSL revisions. Provide compatibility wrappers for
68 * older versions.
dea20519
JM		 69 */
70
71static size_t SSL_get_client_random(const SSL *ssl, unsigned char *out,
72 size_t outlen)
73{
74 if (!ssl->s3 || outlen < SSL3_RANDOM_SIZE)
75 return 0;
76 os_memcpy(out, ssl->s3->client_random, SSL3_RANDOM_SIZE);
77 return SSL3_RANDOM_SIZE;
78}
79
80
81static size_t SSL_get_server_random(const SSL *ssl, unsigned char *out,
82 size_t outlen)
83{
84 if (!ssl->s3 || outlen < SSL3_RANDOM_SIZE)
85 return 0;
86 os_memcpy(out, ssl->s3->server_random, SSL3_RANDOM_SIZE);
87 return SSL3_RANDOM_SIZE;
88}
89
1ebb24bb 90
1cece2fa 91#ifdef OPENSSL_NEED_EAP_FAST_PRF
1ebb24bb
JM		 92static size_t SSL_SESSION_get_master_key(const SSL_SESSION *session,
93 unsigned char *out, size_t outlen)
94{
95 if (!session || session->master_key_length < 0 ||
96 (size_t) session->master_key_length > outlen)
97 return 0;
98 if ((size_t) session->master_key_length < outlen)
99 outlen = session->master_key_length;
100 os_memcpy(out, session->master_key, outlen);
101 return outlen;
102}
1cece2fa 103#endif /* OPENSSL_NEED_EAP_FAST_PRF */
1ebb24bb 104
dea20519
JM		 105#endif
106
837e3658
AU		 107#if OPENSSL_VERSION_NUMBER < 0x10100000L || \
108 (defined(LIBRESSL_VERSION_NUMBER) && \
109 LIBRESSL_VERSION_NUMBER < 0x20700000L)
4eb8cfe0
JM		 110#ifdef CONFIG_SUITEB
111static int RSA_bits(const RSA *r)
112{
113 return BN_num_bits(r->n);
114}
115#endif /* CONFIG_SUITEB */
2ff952a5
JM		 116
117
118static const unsigned char * ASN1_STRING_get0_data(const ASN1_STRING *x)
119{
120 return ASN1_STRING_data((ASN1_STRING *) x);
121}
4eb8cfe0
JM		 122#endif
123
1d415f1f
KR		 124#ifdef ANDROID
125#include <openssl/pem.h>
126#include <keystore/keystore_get.h>
127
128static BIO * BIO_from_keystore(const char *key)
129{
130 BIO *bio = NULL;
131 uint8_t *value = NULL;
132 int length = keystore_get(key, strlen(key), &value);
133 if (length != -1 && (bio = BIO_new(BIO_s_mem())) != NULL)
134 BIO_write(bio, value, length);
135 free(value);
136 return bio;
137}
a8ef133f
RX		 138
139
140static int tls_add_ca_from_keystore(X509_STORE *ctx, const char *key_alias)
141{
142 BIO *bio = BIO_from_keystore(key_alias);
143 STACK_OF(X509_INFO) *stack = NULL;
144 stack_index_t i;
145
146 if (bio) {
147 stack = PEM_X509_INFO_read_bio(bio, NULL, NULL, NULL);
148 BIO_free(bio);
149 }
150
151 if (!stack) {
152 wpa_printf(MSG_WARNING, "TLS: Failed to parse certificate: %s",
153 key_alias);
154 return -1;
155 }
156
157 for (i = 0; i < sk_X509_INFO_num(stack); ++i) {
158 X509_INFO *info = sk_X509_INFO_value(stack, i);
159
160 if (info->x509)
161 X509_STORE_add_cert(ctx, info->x509);
162 if (info->crl)
163 X509_STORE_add_crl(ctx, info->crl);
164 }
165
166 sk_X509_INFO_pop_free(stack, X509_INFO_free);
167
168 return 0;
169}
170
171
172static int tls_add_ca_from_keystore_encoded(X509_STORE *ctx,
173 const char *encoded_key_alias)
174{
175 int rc = -1;
176 int len = os_strlen(encoded_key_alias);
177 unsigned char *decoded_alias;
178
179 if (len & 1) {
180 wpa_printf(MSG_WARNING, "Invalid hex-encoded alias: %s",
181 encoded_key_alias);
182 return rc;
183 }
184
185 decoded_alias = os_malloc(len / 2 + 1);
186 if (decoded_alias) {
187 if (!hexstr2bin(encoded_key_alias, decoded_alias, len / 2)) {
188 decoded_alias[len / 2] = '\0';
189 rc = tls_add_ca_from_keystore(
190 ctx, (const char *) decoded_alias);
191 }
192 os_free(decoded_alias);
193 }
194
195 return rc;
196}
197
1d415f1f
KR		 198#endif /* ANDROID */
199
6fc6879b 200static int tls_openssl_ref_count = 0;
acf36f31 201static int tls_ex_idx_session = -1;
6fc6879b 202
7c0e1e27 203struct tls_context {
00468b46
JM		 204 void (*event_cb)(void *ctx, enum tls_event ev,
205 union tls_event_data *data);
206 void *cb_ctx;
1b414f59 207 int cert_in_cb;
080585c0 208 char *ocsp_stapling_response;
00468b46
JM		 209};
210
7c0e1e27 211static struct tls_context *tls_global = NULL;
00468b46
JM		 212
213
bd9b8b2b
JM		 214struct tls_data {
215 SSL_CTX *ssl;
acf36f31 216 unsigned int tls_session_lifetime;
159a7fbd 217 int check_crl;
dd5d325b 218 int check_crl_strict;
159a7fbd
JB		 219 char *ca_cert;
220 unsigned int crl_reload_interval;
221 struct os_reltime crl_last_reload;
bd9b8b2b
JM		 222};
223
6fc6879b 224struct tls_connection {
7c0e1e27 225 struct tls_context *context;
dd5d325b 226 struct tls_data *data;
68ae4773 227 SSL_CTX *ssl_ctx;
6fc6879b
JM		 228 SSL *ssl;
229 BIO *ssl_in, *ssl_out;
aeeb0bca 230#if defined(ANDROID) || !defined(OPENSSL_NO_ENGINE)
6fc6879b
JM		 231 ENGINE *engine; /* functional reference to the engine */
232 EVP_PKEY *private_key; /* the private key if using engine */
233#endif /* OPENSSL_NO_ENGINE */
cebee30f 234 char *subject_match, *altsubject_match, *suffix_match, *domain_match;
6fc6879b
JM		 235 int read_alerts, write_alerts, failed;
236
237 tls_session_ticket_cb session_ticket_cb;
238 void *session_ticket_cb_ctx;
239
240 /* SessionTicket received from OpenSSL hello_extension_cb (server) */
241 u8 *session_ticket;
242 size_t session_ticket_len;
00468b46 243
8d6399e4
JM		 244 unsigned int ca_cert_verify:1;
245 unsigned int cert_probe:1;
246 unsigned int server_cert_only:1;
bb52293e 247 unsigned int invalid_hb_used:1;
acf36f31 248 unsigned int success_data:1;
4a576c47 249 unsigned int client_hello_generated:1;
53b34578 250 unsigned int server:1;
00468b46
JM		 251
252 u8 srv_cert_hash[32];
235279e7
JM		 253
254 unsigned int flags;
080585c0
JM		 255
256 X509 *peer_cert;
257 X509 *peer_issuer;
6bf61fb2 258 X509 *peer_issuer_issuer;
005c5dcf 259
005c5dcf
JM		 260 unsigned char client_random[SSL3_RANDOM_SIZE];
261 unsigned char server_random[SSL3_RANDOM_SIZE];
1c9663cf
JM		 262
263 u16 cipher_suite;
264 int server_dh_prime_len;
6fc6879b
JM		 265};
266
267
7c0e1e27
PS		 268static struct tls_context * tls_context_new(const struct tls_config *conf)
269{
270 struct tls_context *context = os_zalloc(sizeof(*context));
271 if (context == NULL)
272 return NULL;
273 if (conf) {
274 context->event_cb = conf->event_cb;
275 context->cb_ctx = conf->cb_ctx;
276 context->cert_in_cb = conf->cert_in_cb;
277 }
278 return context;
279}
280
281
6fc6879b
JM		 282#ifdef CONFIG_NO_STDOUT_DEBUG
283
284static void _tls_show_errors(void)
285{
286 unsigned long err;
287
288 while ((err = ERR_get_error())) {
289 /* Just ignore the errors, since stdout is disabled */
290 }
291}
292#define tls_show_errors(l, f, t) _tls_show_errors()
293
294#else /* CONFIG_NO_STDOUT_DEBUG */
295
296static void tls_show_errors(int level, const char *func, const char *txt)
297{
298 unsigned long err;
299
300 wpa_printf(level, "OpenSSL: %s - %s %s",
301 func, txt, ERR_error_string(ERR_get_error(), NULL));
302
303 while ((err = ERR_get_error())) {
304 wpa_printf(MSG_INFO, "OpenSSL: pending error: %s",
305 ERR_error_string(err, NULL));
306 }
307}
308
309#endif /* CONFIG_NO_STDOUT_DEBUG */
310
311
159a7fbd
JB		 312static X509_STORE * tls_crl_cert_reload(const char *ca_cert, int check_crl)
313{
314 int flags;
315 X509_STORE *store;
316
317 store = X509_STORE_new();
318 if (!store) {
319 wpa_printf(MSG_DEBUG,
320 "OpenSSL: %s - failed to allocate new certificate store",
321 __func__);
322 return NULL;
323 }
324
325 if (ca_cert && X509_STORE_load_locations(store, ca_cert, NULL) != 1) {
326 tls_show_errors(MSG_WARNING, __func__,
327 "Failed to load root certificates");
328 X509_STORE_free(store);
329 return NULL;
330 }
331
91205c8e 332 flags = check_crl ? X509_V_FLAG_CRL_CHECK : 0;
159a7fbd
JB		 333 if (check_crl == 2)
334 flags |= X509_V_FLAG_CRL_CHECK_ALL;
335
336 X509_STORE_set_flags(store, flags);
337
338 return store;
339}
340
341
6fc6879b
JM		 342#ifdef CONFIG_NATIVE_WINDOWS
343
344/* Windows CryptoAPI and access to certificate stores */
345#include <wincrypt.h>
346
347#ifdef __MINGW32_VERSION
348/*
349 * MinGW does not yet include all the needed definitions for CryptoAPI, so
350 * define here whatever extra is needed.
351 */
6fc6879b
JM		 352#define CERT_SYSTEM_STORE_CURRENT_USER (1 << 16)
353#define CERT_STORE_READONLY_FLAG 0x00008000
354#define CERT_STORE_OPEN_EXISTING_FLAG 0x00004000
6fc6879b
JM		 355
356#endif /* __MINGW32_VERSION */
357
358
359struct cryptoapi_rsa_data {
360 const CERT_CONTEXT *cert;
361 HCRYPTPROV crypt_prov;
362 DWORD key_spec;
363 BOOL free_crypt_prov;
364};
365
366
367static void cryptoapi_error(const char *msg)
368{
369 wpa_printf(MSG_INFO, "CryptoAPI: %s; err=%u",
370 msg, (unsigned int) GetLastError());
371}
372
373
374static int cryptoapi_rsa_pub_enc(int flen, const unsigned char *from,
375 unsigned char *to, RSA *rsa, int padding)
376{
377 wpa_printf(MSG_DEBUG, "%s - not implemented", __func__);
378 return 0;
379}
380
381
382static int cryptoapi_rsa_pub_dec(int flen, const unsigned char *from,
383 unsigned char *to, RSA *rsa, int padding)
384{
385 wpa_printf(MSG_DEBUG, "%s - not implemented", __func__);
386 return 0;
387}
388
389
390static int cryptoapi_rsa_priv_enc(int flen, const unsigned char *from,
391 unsigned char *to, RSA *rsa, int padding)
392{
393 struct cryptoapi_rsa_data *priv =
394 (struct cryptoapi_rsa_data *) rsa->meth->app_data;
395 HCRYPTHASH hash;
396 DWORD hash_size, len, i;
397 unsigned char *buf = NULL;
398 int ret = 0;
399
400 if (priv == NULL) {
401 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,
402 ERR_R_PASSED_NULL_PARAMETER);
403 return 0;
404 }
405
406 if (padding != RSA_PKCS1_PADDING) {
407 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,
408 RSA_R_UNKNOWN_PADDING_TYPE);
409 return 0;
410 }
411
412 if (flen != 16 /* MD5 */ + 20 /* SHA-1 */) {
413 wpa_printf(MSG_INFO, "%s - only MD5-SHA1 hash supported",
414 __func__);
415 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,
416 RSA_R_INVALID_MESSAGE_LENGTH);
417 return 0;
418 }
419
420 if (!CryptCreateHash(priv->crypt_prov, CALG_SSL3_SHAMD5, 0, 0, &hash))
421 {
422 cryptoapi_error("CryptCreateHash failed");
423 return 0;
424 }
425
426 len = sizeof(hash_size);
427 if (!CryptGetHashParam(hash, HP_HASHSIZE, (BYTE *) &hash_size, &len,
428 0)) {
429 cryptoapi_error("CryptGetHashParam failed");
430 goto err;
431 }
432
433 if ((int) hash_size != flen) {
434 wpa_printf(MSG_INFO, "CryptoAPI: Invalid hash size (%u != %d)",
435 (unsigned) hash_size, flen);
436 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,
437 RSA_R_INVALID_MESSAGE_LENGTH);
438 goto err;
439 }
440 if (!CryptSetHashParam(hash, HP_HASHVAL, (BYTE * ) from, 0)) {
441 cryptoapi_error("CryptSetHashParam failed");
442 goto err;
443 }
444
445 len = RSA_size(rsa);
446 buf = os_malloc(len);
447 if (buf == NULL) {
448 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, ERR_R_MALLOC_FAILURE);
449 goto err;
450 }
451
452 if (!CryptSignHash(hash, priv->key_spec, NULL, 0, buf, &len)) {
453 cryptoapi_error("CryptSignHash failed");
454 goto err;
455 }
456
457 for (i = 0; i < len; i++)
458 to[i] = buf[len - i - 1];
459 ret = len;
460
461err:
462 os_free(buf);
463 CryptDestroyHash(hash);
464
465 return ret;
466}
467
468
469static int cryptoapi_rsa_priv_dec(int flen, const unsigned char *from,
470 unsigned char *to, RSA *rsa, int padding)
471{
472 wpa_printf(MSG_DEBUG, "%s - not implemented", __func__);
473 return 0;
474}
475
476
477static void cryptoapi_free_data(struct cryptoapi_rsa_data *priv)
478{
479 if (priv == NULL)
480 return;
481 if (priv->crypt_prov && priv->free_crypt_prov)
482 CryptReleaseContext(priv->crypt_prov, 0);
483 if (priv->cert)
484 CertFreeCertificateContext(priv->cert);
485 os_free(priv);
486}
487
488
489static int cryptoapi_finish(RSA *rsa)
490{
491 cryptoapi_free_data((struct cryptoapi_rsa_data *) rsa->meth->app_data);
492 os_free((void *) rsa->meth);
493 rsa->meth = NULL;
494 return 1;
495}
496
497
498static const CERT_CONTEXT * cryptoapi_find_cert(const char *name, DWORD store)
499{
500 HCERTSTORE cs;
501 const CERT_CONTEXT *ret = NULL;
502
503 cs = CertOpenStore((LPCSTR) CERT_STORE_PROV_SYSTEM, 0, 0,
504 store | CERT_STORE_OPEN_EXISTING_FLAG |
505 CERT_STORE_READONLY_FLAG, L"MY");
506 if (cs == NULL) {
507 cryptoapi_error("Failed to open 'My system store'");
508 return NULL;
509 }
510
511 if (strncmp(name, "cert://", 7) == 0) {
512 unsigned short wbuf[255];
513 MultiByteToWideChar(CP_ACP, 0, name + 7, -1, wbuf, 255);
514 ret = CertFindCertificateInStore(cs, X509_ASN_ENCODING |
515 PKCS_7_ASN_ENCODING,
516 0, CERT_FIND_SUBJECT_STR,
517 wbuf, NULL);
518 } else if (strncmp(name, "hash://", 7) == 0) {
519 CRYPT_HASH_BLOB blob;
520 int len;
521 const char *hash = name + 7;
522 unsigned char *buf;
523
524 len = os_strlen(hash) / 2;
525 buf = os_malloc(len);
526 if (buf && hexstr2bin(hash, buf, len) == 0) {
527 blob.cbData = len;
528 blob.pbData = buf;
529 ret = CertFindCertificateInStore(cs,
530 X509_ASN_ENCODING |
531 PKCS_7_ASN_ENCODING,
532 0, CERT_FIND_HASH,
533 &blob, NULL);
534 }
535 os_free(buf);
536 }
537
538 CertCloseStore(cs, 0);
539
540 return ret;
541}
542
543
544static int tls_cryptoapi_cert(SSL *ssl, const char *name)
545{
546 X509 *cert = NULL;
547 RSA *rsa = NULL, *pub_rsa;
548 struct cryptoapi_rsa_data *priv;
549 RSA_METHOD *rsa_meth;
550
551 if (name == NULL ||
552 (strncmp(name, "cert://", 7) != 0 &&
553 strncmp(name, "hash://", 7) != 0))
554 return -1;
555
556 priv = os_zalloc(sizeof(*priv));
557 rsa_meth = os_zalloc(sizeof(*rsa_meth));
558 if (priv == NULL || rsa_meth == NULL) {
559 wpa_printf(MSG_WARNING, "CryptoAPI: Failed to allocate memory "
560 "for CryptoAPI RSA method");
561 os_free(priv);
562 os_free(rsa_meth);
563 return -1;
564 }
565
566 priv->cert = cryptoapi_find_cert(name, CERT_SYSTEM_STORE_CURRENT_USER);
567 if (priv->cert == NULL) {
568 priv->cert = cryptoapi_find_cert(
569 name, CERT_SYSTEM_STORE_LOCAL_MACHINE);
570 }
571 if (priv->cert == NULL) {
572 wpa_printf(MSG_INFO, "CryptoAPI: Could not find certificate "
573 "'%s'", name);
574 goto err;
575 }
576
fee31f76
JM		 577 cert = d2i_X509(NULL,
578 (const unsigned char **) &priv->cert->pbCertEncoded,
6fc6879b
JM		 579 priv->cert->cbCertEncoded);
580 if (cert == NULL) {
581 wpa_printf(MSG_INFO, "CryptoAPI: Could not process X509 DER "
582 "encoding");
583 goto err;
584 }
585
6fc6879b
JM		 586 if (!CryptAcquireCertificatePrivateKey(priv->cert,
587 CRYPT_ACQUIRE_COMPARE_KEY_FLAG,
588 NULL, &priv->crypt_prov,
589 &priv->key_spec,
590 &priv->free_crypt_prov)) {
591 cryptoapi_error("Failed to acquire a private key for the "
592 "certificate");
593 goto err;
594 }
595
596 rsa_meth->name = "Microsoft CryptoAPI RSA Method";
597 rsa_meth->rsa_pub_enc = cryptoapi_rsa_pub_enc;
598 rsa_meth->rsa_pub_dec = cryptoapi_rsa_pub_dec;
599 rsa_meth->rsa_priv_enc = cryptoapi_rsa_priv_enc;
600 rsa_meth->rsa_priv_dec = cryptoapi_rsa_priv_dec;
601 rsa_meth->finish = cryptoapi_finish;
602 rsa_meth->flags = RSA_METHOD_FLAG_NO_CHECK;
603 rsa_meth->app_data = (char *) priv;
604
605 rsa = RSA_new();
606 if (rsa == NULL) {
607 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,
608 ERR_R_MALLOC_FAILURE);
609 goto err;
610 }
611
612 if (!SSL_use_certificate(ssl, cert)) {
613 RSA_free(rsa);
614 rsa = NULL;
615 goto err;
616 }
617 pub_rsa = cert->cert_info->key->pkey->pkey.rsa;
618 X509_free(cert);
619 cert = NULL;
620
621 rsa->n = BN_dup(pub_rsa->n);
622 rsa->e = BN_dup(pub_rsa->e);
623 if (!RSA_set_method(rsa, rsa_meth))
624 goto err;
625
626 if (!SSL_use_RSAPrivateKey(ssl, rsa))
627 goto err;
628 RSA_free(rsa);
629
630 return 0;
631
632err:
633 if (cert)
634 X509_free(cert);
635 if (rsa)
636 RSA_free(rsa);
637 else {
638 os_free(rsa_meth);
639 cryptoapi_free_data(priv);
640 }
641 return -1;
642}
643
644
645static int tls_cryptoapi_ca_cert(SSL_CTX *ssl_ctx, SSL *ssl, const char *name)
646{
647 HCERTSTORE cs;
648 PCCERT_CONTEXT ctx = NULL;
649 X509 *cert;
650 char buf[128];
651 const char *store;
652#ifdef UNICODE
653 WCHAR *wstore;
654#endif /* UNICODE */
655
6fc6879b
JM		 656 if (name == NULL || strncmp(name, "cert_store://", 13) != 0)
657 return -1;
658
659 store = name + 13;
660#ifdef UNICODE
661 wstore = os_malloc((os_strlen(store) + 1) * sizeof(WCHAR));
662 if (wstore == NULL)
663 return -1;
664 wsprintf(wstore, L"%S", store);
665 cs = CertOpenSystemStore(0, wstore);
666 os_free(wstore);
667#else /* UNICODE */
668 cs = CertOpenSystemStore(0, store);
669#endif /* UNICODE */
670 if (cs == NULL) {
671 wpa_printf(MSG_DEBUG, "%s: failed to open system cert store "
672 "'%s': error=%d", __func__, store,
673 (int) GetLastError());
674 return -1;
675 }
676
677 while ((ctx = CertEnumCertificatesInStore(cs, ctx))) {
fee31f76
JM		 678 cert = d2i_X509(NULL,
679 (const unsigned char **) &ctx->pbCertEncoded,
6fc6879b
JM		 680 ctx->cbCertEncoded);
681 if (cert == NULL) {
682 wpa_printf(MSG_INFO, "CryptoAPI: Could not process "
683 "X509 DER encoding for CA cert");
684 continue;
685 }
686
687 X509_NAME_oneline(X509_get_subject_name(cert), buf,
688 sizeof(buf));
689 wpa_printf(MSG_DEBUG, "OpenSSL: Loaded CA certificate for "
690 "system certificate store: subject='%s'", buf);
691
f150db6c
DB		 692 if (!X509_STORE_add_cert(SSL_CTX_get_cert_store(ssl_ctx),
693 cert)) {
6fc6879b
JM		 694 tls_show_errors(MSG_WARNING, __func__,
695 "Failed to add ca_cert to OpenSSL "
696 "certificate store");
697 }
698
699 X509_free(cert);
700 }
701
702 if (!CertCloseStore(cs, 0)) {
703 wpa_printf(MSG_DEBUG, "%s: failed to close system cert store "
704 "'%s': error=%d", __func__, name + 13,
705 (int) GetLastError());
706 }
707
708 return 0;
709}
710
711
712#else /* CONFIG_NATIVE_WINDOWS */
713
714static int tls_cryptoapi_cert(SSL *ssl, const char *name)
715{
716 return -1;
717}
718
719#endif /* CONFIG_NATIVE_WINDOWS */
720
721
722static void ssl_info_cb(const SSL *ssl, int where, int ret)
723{
724 const char *str;
725 int w;
726
727 wpa_printf(MSG_DEBUG, "SSL: (where=0x%x ret=0x%x)", where, ret);
728 w = where & ~SSL_ST_MASK;
729 if (w & SSL_ST_CONNECT)
730 str = "SSL_connect";
731 else if (w & SSL_ST_ACCEPT)
732 str = "SSL_accept";
733 else
734 str = "undefined";
735
736 if (where & SSL_CB_LOOP) {
737 wpa_printf(MSG_DEBUG, "SSL: %s:%s",
738 str, SSL_state_string_long(ssl));
739 } else if (where & SSL_CB_ALERT) {
7c0e1e27 740 struct tls_connection *conn = SSL_get_app_data((SSL *) ssl);
6fc6879b
JM		 741 wpa_printf(MSG_INFO, "SSL: SSL3 alert: %s:%s:%s",
742 where & SSL_CB_READ ?
743 "read (remote end reported an error)" :
744 "write (local SSL3 detected an error)",
745 SSL_alert_type_string_long(ret),
746 SSL_alert_desc_string_long(ret));
747 if ((ret >> 8) == SSL3_AL_FATAL) {
6fc6879b
JM		 748 if (where & SSL_CB_READ)
749 conn->read_alerts++;
750 else
751 conn->write_alerts++;
752 }
7c0e1e27 753 if (conn->context->event_cb != NULL) {
dd7fec1f 754 union tls_event_data ev;
7c0e1e27 755 struct tls_context *context = conn->context;
dd7fec1f
PS		 756 os_memset(&ev, 0, sizeof(ev));
757 ev.alert.is_local = !(where & SSL_CB_READ);
758 ev.alert.type = SSL_alert_type_string_long(ret);
759 ev.alert.description = SSL_alert_desc_string_long(ret);
7c0e1e27 760 context->event_cb(context->cb_ctx, TLS_ALERT, &ev);
dd7fec1f 761 }
6fc6879b
JM		 762 } else if (where & SSL_CB_EXIT && ret <= 0) {
763 wpa_printf(MSG_DEBUG, "SSL: %s:%s in %s",
764 str, ret == 0 ? "failed" : "error",
765 SSL_state_string_long(ssl));
766 }
767}
768
769
770#ifndef OPENSSL_NO_ENGINE
771/**
772 * tls_engine_load_dynamic_generic - load any openssl engine
773 * @pre: an array of commands and values that load an engine initialized
774 * in the engine specific function
775 * @post: an array of commands and values that initialize an already loaded
776 * engine (or %NULL if not required)
777 * @id: the engine id of the engine to load (only required if post is not %NULL
778 *
779 * This function is a generic function that loads any openssl engine.
780 *
781 * Returns: 0 on success, -1 on failure
782 */
783static int tls_engine_load_dynamic_generic(const char *pre[],
784 const char *post[], const char *id)
785{
786 ENGINE *engine;
787 const char *dynamic_id = "dynamic";
788
789 engine = ENGINE_by_id(id);
790 if (engine) {
6fc6879b
JM		 791 wpa_printf(MSG_DEBUG, "ENGINE: engine '%s' is already "
792 "available", id);
c3d7fb7e
DW		 793 /*
794 * If it was auto-loaded by ENGINE_by_id() we might still
795 * need to tell it which PKCS#11 module to use in legacy
796 * (non-p11-kit) environments. Do so now; even if it was
797 * properly initialised before, setting it again will be
798 * harmless.
799 */
800 goto found;
6fc6879b
JM		 801 }
802 ERR_clear_error();
803
804 engine = ENGINE_by_id(dynamic_id);
805 if (engine == NULL) {
806 wpa_printf(MSG_INFO, "ENGINE: Can't find engine %s [%s]",
807 dynamic_id,
808 ERR_error_string(ERR_get_error(), NULL));
809 return -1;
810 }
811
812 /* Perform the pre commands. This will load the engine. */
813 while (pre && pre[0]) {
814 wpa_printf(MSG_DEBUG, "ENGINE: '%s' '%s'", pre[0], pre[1]);
815 if (ENGINE_ctrl_cmd_string(engine, pre[0], pre[1], 0) == 0) {
816 wpa_printf(MSG_INFO, "ENGINE: ctrl cmd_string failed: "
817 "%s %s [%s]", pre[0], pre[1],
818 ERR_error_string(ERR_get_error(), NULL));
819 ENGINE_free(engine);
820 return -1;
821 }
822 pre += 2;
823 }
824
825 /*
826 * Free the reference to the "dynamic" engine. The loaded engine can
827 * now be looked up using ENGINE_by_id().
828 */
829 ENGINE_free(engine);
830
831 engine = ENGINE_by_id(id);
832 if (engine == NULL) {
833 wpa_printf(MSG_INFO, "ENGINE: Can't find engine %s [%s]",
834 id, ERR_error_string(ERR_get_error(), NULL));
835 return -1;
836 }
c3d7fb7e 837 found:
6fc6879b
JM		 838 while (post && post[0]) {
839 wpa_printf(MSG_DEBUG, "ENGINE: '%s' '%s'", post[0], post[1]);
840 if (ENGINE_ctrl_cmd_string(engine, post[0], post[1], 0) == 0) {
841 wpa_printf(MSG_DEBUG, "ENGINE: ctrl cmd_string failed:"
842 " %s %s [%s]", post[0], post[1],
843 ERR_error_string(ERR_get_error(), NULL));
844 ENGINE_remove(engine);
845 ENGINE_free(engine);
846 return -1;
847 }
848 post += 2;
849 }
850 ENGINE_free(engine);
851
852 return 0;
853}
854
855
856/**
857 * tls_engine_load_dynamic_pkcs11 - load the pkcs11 engine provided by opensc
858 * @pkcs11_so_path: pksc11_so_path from the configuration
859 * @pcks11_module_path: pkcs11_module_path from the configuration
860 */
861static int tls_engine_load_dynamic_pkcs11(const char *pkcs11_so_path,
862 const char *pkcs11_module_path)
863{
864 char *engine_id = "pkcs11";
865 const char *pre_cmd[] = {
866 "SO_PATH", NULL /* pkcs11_so_path */,
867 "ID", NULL /* engine_id */,
868 "LIST_ADD", "1",
869 /* "NO_VCHECK", "1", */
870 "LOAD", NULL,
871 NULL, NULL
872 };
873 const char *post_cmd[] = {
874 "MODULE_PATH", NULL /* pkcs11_module_path */,
875 NULL, NULL
876 };
877
5c8ab0d4 878 if (!pkcs11_so_path)
6fc6879b
JM		 879 return 0;
880
881 pre_cmd[1] = pkcs11_so_path;
882 pre_cmd[3] = engine_id;
5c8ab0d4
DW		 883 if (pkcs11_module_path)
884 post_cmd[1] = pkcs11_module_path;
885 else
886 post_cmd[0] = NULL;
6fc6879b
JM		 887
888 wpa_printf(MSG_DEBUG, "ENGINE: Loading pkcs11 Engine from %s",
889 pkcs11_so_path);
890
891 return tls_engine_load_dynamic_generic(pre_cmd, post_cmd, engine_id);
892}
893
894
895/**
896 * tls_engine_load_dynamic_opensc - load the opensc engine provided by opensc
897 * @opensc_so_path: opensc_so_path from the configuration
898 */
899static int tls_engine_load_dynamic_opensc(const char *opensc_so_path)
900{
901 char *engine_id = "opensc";
902 const char *pre_cmd[] = {
903 "SO_PATH", NULL /* opensc_so_path */,
904 "ID", NULL /* engine_id */,
905 "LIST_ADD", "1",
906 "LOAD", NULL,
907 NULL, NULL
908 };
909
910 if (!opensc_so_path)
911 return 0;
912
913 pre_cmd[1] = opensc_so_path;
914 pre_cmd[3] = engine_id;
915
916 wpa_printf(MSG_DEBUG, "ENGINE: Loading OpenSC Engine from %s",
917 opensc_so_path);
918
919 return tls_engine_load_dynamic_generic(pre_cmd, NULL, engine_id);
920}
921#endif /* OPENSSL_NO_ENGINE */
922
923
acf36f31
JM		 924static void remove_session_cb(SSL_CTX *ctx, SSL_SESSION *sess)
925{
926 struct wpabuf *buf;
927
928 if (tls_ex_idx_session < 0)
929 return;
930 buf = SSL_SESSION_get_ex_data(sess, tls_ex_idx_session);
931 if (!buf)
932 return;
933 wpa_printf(MSG_DEBUG,
934 "OpenSSL: Free application session data %p (sess %p)",
935 buf, sess);
936 wpabuf_free(buf);
937
938 SSL_SESSION_set_ex_data(sess, tls_ex_idx_session, NULL);
939}
940
941
6fc6879b
JM		 942void * tls_init(const struct tls_config *conf)
943{
bd9b8b2b 944 struct tls_data *data;
6fc6879b 945 SSL_CTX *ssl;
7c0e1e27 946 struct tls_context *context;
b7328434 947 const char *ciphers;
6fc6879b
JM		 948
949 if (tls_openssl_ref_count == 0) {
7c0e1e27
PS		 950 tls_global = context = tls_context_new(conf);
951 if (context == NULL)
00468b46 952 return NULL;
76f04b38
JM		 953#ifdef CONFIG_FIPS
954#ifdef OPENSSL_FIPS
cf123d7f 955 if (conf && conf->fips_mode) {
4fc53159
JM		 956 static int fips_enabled = 0;
957
958 if (!fips_enabled && !FIPS_mode_set(1)) {
76f04b38
JM		 959 wpa_printf(MSG_ERROR, "Failed to enable FIPS "
960 "mode");
961 ERR_load_crypto_strings();
962 ERR_print_errors_fp(stderr);
b36540db
JM		 963 os_free(tls_global);
964 tls_global = NULL;
76f04b38 965 return NULL;
4fc53159 966 } else {
76f04b38 967 wpa_printf(MSG_INFO, "Running in FIPS mode");
4fc53159
JM		 968 fips_enabled = 1;
969 }
76f04b38
JM		 970 }
971#else /* OPENSSL_FIPS */
cf123d7f 972 if (conf && conf->fips_mode) {
76f04b38
JM		 973 wpa_printf(MSG_ERROR, "FIPS mode requested, but not "
974 "supported");
b36540db
JM		 975 os_free(tls_global);
976 tls_global = NULL;
76f04b38
JM		 977 return NULL;
978 }
979#endif /* OPENSSL_FIPS */
980#endif /* CONFIG_FIPS */
ba3658cf
BS		 981#if OPENSSL_VERSION_NUMBER < 0x10100000L || \
982 (defined(LIBRESSL_VERSION_NUMBER) && \
983 LIBRESSL_VERSION_NUMBER < 0x20700000L)
6fc6879b
JM		 984 SSL_load_error_strings();
985 SSL_library_init();
fee31f76 986#ifndef OPENSSL_NO_SHA256
e1ffdfc1
JM		 987 EVP_add_digest(EVP_sha256());
988#endif /* OPENSSL_NO_SHA256 */
6fc6879b
JM		 989 /* TODO: if /dev/urandom is available, PRNG is seeded
990 * automatically. If this is not the case, random data should
991 * be added here. */
992
993#ifdef PKCS12_FUNCS
1056dad7
JM		 994#ifndef OPENSSL_NO_RC2
995 /*
996 * 40-bit RC2 is commonly used in PKCS#12 files, so enable it.
997 * This is enabled by PKCS12_PBE_add() in OpenSSL 0.9.8
998 * versions, but it looks like OpenSSL 1.0.0 does not do that
999 * anymore.
1000 */
1001 EVP_add_cipher(EVP_rc2_40_cbc());
1002#endif /* OPENSSL_NO_RC2 */
6fc6879b
JM		 1003 PKCS12_PBE_add();
1004#endif /* PKCS12_FUNCS */
29bc76e3 1005#endif /* < 1.1.0 */
7c0e1e27 1006 } else {
7c0e1e27
PS		 1007 context = tls_context_new(conf);
1008 if (context == NULL)
1009 return NULL;
6fc6879b
JM		 1010 }
1011 tls_openssl_ref_count++;
1012
bd9b8b2b
JM		 1013 data = os_zalloc(sizeof(*data));
1014 if (data)
1015 ssl = SSL_CTX_new(SSLv23_method());
1016 else
1017 ssl = NULL;
7c0e1e27
PS		 1018 if (ssl == NULL) {
1019 tls_openssl_ref_count--;
a288da61
JM		 1020 if (context != tls_global)
1021 os_free(context);
7c0e1e27
PS		 1022 if (tls_openssl_ref_count == 0) {
1023 os_free(tls_global);
1024 tls_global = NULL;
7c0e1e27 1025 }
1f1e599b 1026 os_free(data);
6fc6879b 1027 return NULL;
7c0e1e27 1028 }
bd9b8b2b 1029 data->ssl = ssl;
159a7fbd 1030 if (conf) {
acf36f31 1031 data->tls_session_lifetime = conf->tls_session_lifetime;
159a7fbd
JB		 1032 data->crl_reload_interval = conf->crl_reload_interval;
1033 }
6fc6879b 1034
35efa247
JM		 1035 SSL_CTX_set_options(ssl, SSL_OP_NO_SSLv2);
1036 SSL_CTX_set_options(ssl, SSL_OP_NO_SSLv3);
1037
d7f12e4e
JM		 1038#ifdef SSL_MODE_NO_AUTO_CHAIN
1039 /* Number of deployed use cases assume the default OpenSSL behavior of
1040 * auto chaining the local certificate is in use. BoringSSL removed this
1041 * functionality by default, so we need to restore it here to avoid
1042 * breaking existing use cases. */
1043 SSL_CTX_clear_mode(ssl, SSL_MODE_NO_AUTO_CHAIN);
1044#endif /* SSL_MODE_NO_AUTO_CHAIN */
1045
6fc6879b 1046 SSL_CTX_set_info_callback(ssl, ssl_info_cb);
7c0e1e27 1047 SSL_CTX_set_app_data(ssl, context);
acf36f31
JM		 1048 if (data->tls_session_lifetime > 0) {
1049 SSL_CTX_set_quiet_shutdown(ssl, 1);
1050 /*
1051 * Set default context here. In practice, this will be replaced
1052 * by the per-EAP method context in tls_connection_set_verify().
1053 */
1054 SSL_CTX_set_session_id_context(ssl, (u8 *) "hostapd", 7);
1055 SSL_CTX_set_session_cache_mode(ssl, SSL_SESS_CACHE_SERVER);
1056 SSL_CTX_set_timeout(ssl, data->tls_session_lifetime);
1057 SSL_CTX_sess_set_remove_cb(ssl, remove_session_cb);
1058 } else {
1059 SSL_CTX_set_session_cache_mode(ssl, SSL_SESS_CACHE_OFF);
1060 }
1061
1062 if (tls_ex_idx_session < 0) {
1063 tls_ex_idx_session = SSL_SESSION_get_ex_new_index(
1064 0, NULL, NULL, NULL, NULL);
1065 if (tls_ex_idx_session < 0) {
1066 tls_deinit(data);
1067 return NULL;
1068 }
1069 }
6fc6879b
JM		 1070
1071#ifndef OPENSSL_NO_ENGINE
ddda6276 1072 wpa_printf(MSG_DEBUG, "ENGINE: Loading dynamic engine");
373c7969 1073#if OPENSSL_VERSION_NUMBER < 0x10100000L
ddda6276
DW		 1074 ERR_load_ENGINE_strings();
1075 ENGINE_load_dynamic();
373c7969 1076#endif /* OPENSSL_VERSION_NUMBER */
ddda6276 1077
6fc6879b
JM		 1078 if (conf &&
1079 (conf->opensc_engine_path || conf->pkcs11_engine_path ||
1080 conf->pkcs11_module_path)) {
6fc6879b
JM		 1081 if (tls_engine_load_dynamic_opensc(conf->opensc_engine_path) ||
1082 tls_engine_load_dynamic_pkcs11(conf->pkcs11_engine_path,
1083 conf->pkcs11_module_path)) {
bd9b8b2b 1084 tls_deinit(data);
6fc6879b
JM		 1085 return NULL;
1086 }
1087 }
1088#endif /* OPENSSL_NO_ENGINE */
1089
b7328434
JM		 1090 if (conf && conf->openssl_ciphers)
1091 ciphers = conf->openssl_ciphers;
1092 else
2b9891bd 1093 ciphers = TLS_DEFAULT_CIPHERS;
b7328434
JM		 1094 if (SSL_CTX_set_cipher_list(ssl, ciphers) != 1) {
1095 wpa_printf(MSG_ERROR,
1096 "OpenSSL: Failed to set cipher string '%s'",
1097 ciphers);
bd9b8b2b 1098 tls_deinit(data);
b7328434
JM		 1099 return NULL;
1100 }
1101
bd9b8b2b 1102 return data;
6fc6879b
JM		 1103}
1104
1105
1106void tls_deinit(void *ssl_ctx)
1107{
bd9b8b2b
JM		 1108 struct tls_data *data = ssl_ctx;
1109 SSL_CTX *ssl = data->ssl;
7c0e1e27
PS		 1110 struct tls_context *context = SSL_CTX_get_app_data(ssl);
1111 if (context != tls_global)
1112 os_free(context);
acf36f31
JM		 1113 if (data->tls_session_lifetime > 0)
1114 SSL_CTX_flush_sessions(ssl, 0);
159a7fbd 1115 os_free(data->ca_cert);
6fc6879b
JM		 1116 SSL_CTX_free(ssl);
1117
1118 tls_openssl_ref_count--;
1119 if (tls_openssl_ref_count == 0) {
ba3658cf
BS		 1120#if OPENSSL_VERSION_NUMBER < 0x10100000L || \
1121 (defined(LIBRESSL_VERSION_NUMBER) && \
1122 LIBRESSL_VERSION_NUMBER < 0x20700000L)
6fc6879b
JM		 1123#ifndef OPENSSL_NO_ENGINE
1124 ENGINE_cleanup();
1125#endif /* OPENSSL_NO_ENGINE */
1126 CRYPTO_cleanup_all_ex_data();
a8572960 1127 ERR_remove_thread_state(NULL);
6fc6879b
JM		 1128 ERR_free_strings();
1129 EVP_cleanup();
29bc76e3 1130#endif /* < 1.1.0 */
080585c0
JM		 1131 os_free(tls_global->ocsp_stapling_response);
1132 tls_global->ocsp_stapling_response = NULL;
00468b46
JM		 1133 os_free(tls_global);
1134 tls_global = NULL;
6fc6879b 1135 }
bd9b8b2b
JM		 1136
1137 os_free(data);
6fc6879b
JM		 1138}
1139
1140
fd4fb281
MG		 1141#ifndef OPENSSL_NO_ENGINE
1142
1143/* Cryptoki return values */
1144#define CKR_PIN_INCORRECT 0x000000a0
1145#define CKR_PIN_INVALID 0x000000a1
1146#define CKR_PIN_LEN_RANGE 0x000000a2
1147
1148/* libp11 */
1149#define ERR_LIB_PKCS11 ERR_LIB_USER
1150
1151static int tls_is_pin_error(unsigned int err)
1152{
1153 return ERR_GET_LIB(err) == ERR_LIB_PKCS11 &&
1154 (ERR_GET_REASON(err) == CKR_PIN_INCORRECT ||
1155 ERR_GET_REASON(err) == CKR_PIN_INVALID ||
1156 ERR_GET_REASON(err) == CKR_PIN_LEN_RANGE);
1157}
1158
1159#endif /* OPENSSL_NO_ENGINE */
1160
1161
aeeb0bca
AL		 1162#ifdef ANDROID
1163/* EVP_PKEY_from_keystore comes from system/security/keystore-engine. */
1164EVP_PKEY * EVP_PKEY_from_keystore(const char *key_id);
1165#endif /* ANDROID */
1166
6fc6879b 1167static int tls_engine_init(struct tls_connection *conn, const char *engine_id,
e59c91af
DS		 1168 const char *pin, const char *key_id,
1169 const char *cert_id, const char *ca_cert_id)
6fc6879b 1170{
aeeb0bca
AL		 1171#if defined(ANDROID) && defined(OPENSSL_IS_BORINGSSL)
1172#if !defined(OPENSSL_NO_ENGINE)
1173#error "This code depends on OPENSSL_NO_ENGINE being defined by BoringSSL."
1174#endif
1175 if (!key_id)
1176 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
1177 conn->engine = NULL;
1178 conn->private_key = EVP_PKEY_from_keystore(key_id);
1179 if (!conn->private_key) {
1180 wpa_printf(MSG_ERROR,
1181 "ENGINE: cannot load private key with id '%s' [%s]",
1182 key_id,
1183 ERR_error_string(ERR_get_error(), NULL));
1184 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
1185 }
1186#endif /* ANDROID && OPENSSL_IS_BORINGSSL */
1187
6fc6879b
JM		 1188#ifndef OPENSSL_NO_ENGINE
1189 int ret = -1;
1190 if (engine_id == NULL) {
1191 wpa_printf(MSG_ERROR, "ENGINE: Engine ID not set");
1192 return -1;
1193 }
6fc6879b
JM		 1194
1195 ERR_clear_error();
1176ab6d
KR		 1196#ifdef ANDROID
1197 ENGINE_load_dynamic();
1198#endif
6fc6879b
JM		 1199 conn->engine = ENGINE_by_id(engine_id);
1200 if (!conn->engine) {
1201 wpa_printf(MSG_ERROR, "ENGINE: engine %s not available [%s]",
1202 engine_id, ERR_error_string(ERR_get_error(), NULL));
1203 goto err;
1204 }
1205 if (ENGINE_init(conn->engine) != 1) {
1206 wpa_printf(MSG_ERROR, "ENGINE: engine init failed "
1207 "(engine: %s) [%s]", engine_id,
1208 ERR_error_string(ERR_get_error(), NULL));
1209 goto err;
1210 }
1211 wpa_printf(MSG_DEBUG, "ENGINE: engine initialized");
1212
1176ab6d 1213#ifndef ANDROID
a642a52b 1214 if (pin && ENGINE_ctrl_cmd_string(conn->engine, "PIN", pin, 0) == 0) {
6fc6879b
JM		 1215 wpa_printf(MSG_ERROR, "ENGINE: cannot set pin [%s]",
1216 ERR_error_string(ERR_get_error(), NULL));
1217 goto err;
1218 }
1176ab6d 1219#endif
3d268b8d 1220 if (key_id) {
a642a52b
DW		 1221 /*
1222 * Ensure that the ENGINE does not attempt to use the OpenSSL
1223 * UI system to obtain a PIN, if we didn't provide one.
1224 */
1225 struct {
1226 const void *password;
1227 const char *prompt_info;
1228 } key_cb = { "", NULL };
1229
3d268b8d
DW		 1230 /* load private key first in-case PIN is required for cert */
1231 conn->private_key = ENGINE_load_private_key(conn->engine,
a642a52b
DW		 1232 key_id, NULL,
1233 &key_cb);
3d268b8d 1234 if (!conn->private_key) {
fd4fb281
MG		 1235 unsigned long err = ERR_get_error();
1236
3d268b8d
DW		 1237 wpa_printf(MSG_ERROR,
1238 "ENGINE: cannot load private key with id '%s' [%s]",
1239 key_id,
fd4fb281
MG		 1240 ERR_error_string(err, NULL));
1241 if (tls_is_pin_error(err))
1242 ret = TLS_SET_PARAMS_ENGINE_PRV_BAD_PIN;
1243 else
1244 ret = TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
3d268b8d
DW		 1245 goto err;
1246 }
6fc6879b 1247 }
e59c91af
DS		 1248
1249 /* handle a certificate and/or CA certificate */
1250 if (cert_id || ca_cert_id) {
1251 const char *cmd_name = "LOAD_CERT_CTRL";
1252
1253 /* test if the engine supports a LOAD_CERT_CTRL */
1254 if (!ENGINE_ctrl(conn->engine, ENGINE_CTRL_GET_CMD_FROM_NAME,
1255 0, (void *)cmd_name, NULL)) {
1256 wpa_printf(MSG_ERROR, "ENGINE: engine does not support"
1257 " loading certificates");
1258 ret = TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
1259 goto err;
1260 }
1261 }
1262
6fc6879b
JM		 1263 return 0;
1264
1265err:
1266 if (conn->engine) {
1267 ENGINE_free(conn->engine);
1268 conn->engine = NULL;
1269 }
1270
1271 if (conn->private_key) {
1272 EVP_PKEY_free(conn->private_key);
1273 conn->private_key = NULL;
1274 }
1275
1276 return ret;
1277#else /* OPENSSL_NO_ENGINE */
1278 return 0;
1279#endif /* OPENSSL_NO_ENGINE */
1280}
1281
1282
1283static void tls_engine_deinit(struct tls_connection *conn)
1284{
aeeb0bca 1285#if defined(ANDROID) || !defined(OPENSSL_NO_ENGINE)
6fc6879b
JM		 1286 wpa_printf(MSG_DEBUG, "ENGINE: engine deinit");
1287 if (conn->private_key) {
1288 EVP_PKEY_free(conn->private_key);
1289 conn->private_key = NULL;
1290 }
1291 if (conn->engine) {
aeeb0bca 1292#if !defined(OPENSSL_IS_BORINGSSL)
6fc6879b 1293 ENGINE_finish(conn->engine);
aeeb0bca 1294#endif /* !OPENSSL_IS_BORINGSSL */
6fc6879b
JM		 1295 conn->engine = NULL;
1296 }
aeeb0bca 1297#endif /* ANDROID || !OPENSSL_NO_ENGINE */
6fc6879b
JM		 1298}
1299
1300
1301int tls_get_errors(void *ssl_ctx)
1302{
1303 int count = 0;
1304 unsigned long err;
1305
1306 while ((err = ERR_get_error())) {
1307 wpa_printf(MSG_INFO, "TLS - SSL error: %s",
1308 ERR_error_string(err, NULL));
1309 count++;
1310 }
1311
1312 return count;
1313}
1314
bb52293e 1315
cbb15497
JM		 1316static const char * openssl_content_type(int content_type)
1317{
1318 switch (content_type) {
1319 case 20:
1320 return "change cipher spec";
1321 case 21:
1322 return "alert";
1323 case 22:
1324 return "handshake";
1325 case 23:
1326 return "application data";
1327 case 24:
1328 return "heartbeat";
1329 case 256:
1330 return "TLS header info"; /* pseudo content type */
1331 default:
1332 return "?";
1333 }
1334}
1335
1336
1337static const char * openssl_handshake_type(int content_type, const u8 *buf,
1338 size_t len)
1339{
1340 if (content_type != 22 || !buf || len == 0)
1341 return "";
1342 switch (buf[0]) {
1343 case 0:
1344 return "hello request";
1345 case 1:
1346 return "client hello";
1347 case 2:
1348 return "server hello";
e5bffe1a
JM		 1349 case 3:
1350 return "hello verify request";
cbb15497
JM		 1351 case 4:
1352 return "new session ticket";
e5bffe1a
JM		 1353 case 5:
1354 return "end of early data";
1355 case 6:
1356 return "hello retry request";
1357 case 8:
1358 return "encrypted extensions";
cbb15497
JM		 1359 case 11:
1360 return "certificate";
1361 case 12:
1362 return "server key exchange";
1363 case 13:
1364 return "certificate request";
1365 case 14:
1366 return "server hello done";
1367 case 15:
1368 return "certificate verify";
1369 case 16:
1370 return "client key exchange";
1371 case 20:
1372 return "finished";
1373 case 21:
1374 return "certificate url";
1375 case 22:
1376 return "certificate status";
e5bffe1a
JM		 1377 case 23:
1378 return "supplemental data";
1379 case 24:
1380 return "key update";
1381 case 254:
1382 return "message hash";
cbb15497
JM		 1383 default:
1384 return "?";
1385 }
1386}
1387
1388
1c9663cf
JM		 1389#ifdef CONFIG_SUITEB
1390
1391static void check_server_hello(struct tls_connection *conn,
1392 const u8 *pos, const u8 *end)
1393{
1394 size_t payload_len, id_len;
1395
1396 /*
1397 * Parse ServerHello to get the selected cipher suite since OpenSSL does
1398 * not make it cleanly available during handshake and we need to know
1399 * whether DHE was selected.
1400 */
1401
1402 if (end - pos < 3)
1403 return;
1404 payload_len = WPA_GET_BE24(pos);
1405 pos += 3;
1406
1407 if ((size_t) (end - pos) < payload_len)
1408 return;
1409 end = pos + payload_len;
1410
1411 /* Skip Version and Random */
1412 if (end - pos < 2 + SSL3_RANDOM_SIZE)
1413 return;
1414 pos += 2 + SSL3_RANDOM_SIZE;
1415
1416 /* Skip Session ID */
1417 if (end - pos < 1)
1418 return;
1419 id_len = *pos++;
1420 if ((size_t) (end - pos) < id_len)
1421 return;
1422 pos += id_len;
1423
1424 if (end - pos < 2)
1425 return;
1426 conn->cipher_suite = WPA_GET_BE16(pos);
1427 wpa_printf(MSG_DEBUG, "OpenSSL: Server selected cipher suite 0x%x",
1428 conn->cipher_suite);
1429}
1430
1431
1432static void check_server_key_exchange(SSL *ssl, struct tls_connection *conn,
1433 const u8 *pos, const u8 *end)
1434{
1435 size_t payload_len;
1436 u16 dh_len;
1437 BIGNUM *p;
1438 int bits;
1439
1440 if (!(conn->flags & TLS_CONN_SUITEB))
1441 return;
1442
1443 /* DHE is enabled only with DHE-RSA-AES256-GCM-SHA384 */
1444 if (conn->cipher_suite != 0x9f)
1445 return;
1446
1447 if (end - pos < 3)
1448 return;
1449 payload_len = WPA_GET_BE24(pos);
1450 pos += 3;
1451
1452 if ((size_t) (end - pos) < payload_len)
1453 return;
1454 end = pos + payload_len;
1455
1456 if (end - pos < 2)
1457 return;
1458 dh_len = WPA_GET_BE16(pos);
1459 pos += 2;
1460
1461 if ((size_t) (end - pos) < dh_len)
1462 return;
1463 p = BN_bin2bn(pos, dh_len, NULL);
1464 if (!p)
1465 return;
1466
1467 bits = BN_num_bits(p);
1468 BN_free(p);
1469
1470 conn->server_dh_prime_len = bits;
1471 wpa_printf(MSG_DEBUG, "OpenSSL: Server DH prime length: %d bits",
1472 conn->server_dh_prime_len);
1473}
1474
1475#endif /* CONFIG_SUITEB */
1476
1477
bb52293e
JM		 1478static void tls_msg_cb(int write_p, int version, int content_type,
1479 const void *buf, size_t len, SSL *ssl, void *arg)
1480{
1481 struct tls_connection *conn = arg;
1482 const u8 *pos = buf;
1483
faf8f293
JM		 1484 if (write_p == 2) {
1485 wpa_printf(MSG_DEBUG,
1486 "OpenSSL: session ver=0x%x content_type=%d",
1487 version, content_type);
1488 wpa_hexdump_key(MSG_MSGDUMP, "OpenSSL: Data", buf, len);
1489 return;
1490 }
1491
cbb15497
JM		 1492 wpa_printf(MSG_DEBUG, "OpenSSL: %s ver=0x%x content_type=%d (%s/%s)",
1493 write_p ? "TX" : "RX", version, content_type,
1494 openssl_content_type(content_type),
1495 openssl_handshake_type(content_type, buf, len));
bb52293e
JM		 1496 wpa_hexdump_key(MSG_MSGDUMP, "OpenSSL: Message", buf, len);
1497 if (content_type == 24 && len >= 3 && pos[0] == 1) {
1498 size_t payload_len = WPA_GET_BE16(pos + 1);
1499 if (payload_len + 3 > len) {
1500 wpa_printf(MSG_ERROR, "OpenSSL: Heartbeat attack detected");
1501 conn->invalid_hb_used = 1;
1502 }
1503 }
1c9663cf
JM		 1504
1505#ifdef CONFIG_SUITEB
1506 /*
1507 * Need to parse these handshake messages to be able to check DH prime
1508 * length since OpenSSL does not expose the new cipher suite and DH
1509 * parameters during handshake (e.g., for cert_cb() callback).
1510 */
1511 if (content_type == 22 && pos && len > 0 && pos[0] == 2)
1512 check_server_hello(conn, pos + 1, pos + len);
1513 if (content_type == 22 && pos && len > 0 && pos[0] == 12)
1514 check_server_key_exchange(ssl, conn, pos + 1, pos + len);
1515#endif /* CONFIG_SUITEB */
bb52293e
JM		 1516}
1517
1518
6a31a31d 1519struct tls_connection * tls_connection_init(void *ssl_ctx)
6fc6879b 1520{
bd9b8b2b
JM		 1521 struct tls_data *data = ssl_ctx;
1522 SSL_CTX *ssl = data->ssl;
6a31a31d 1523 struct tls_connection *conn;
fca25ef4 1524 long options;
159a7fbd
JB		 1525 X509_STORE *new_cert_store;
1526 struct os_reltime now;
6a31a31d 1527 struct tls_context *context = SSL_CTX_get_app_data(ssl);
6fc6879b 1528
159a7fbd
JB		 1529 /* Replace X509 store if it is time to update CRL. */
1530 if (data->crl_reload_interval > 0 && os_get_reltime(&now) == 0 &&
1531 os_reltime_expired(&now, &data->crl_last_reload,
1532 data->crl_reload_interval)) {
1533 wpa_printf(MSG_INFO,
1534 "OpenSSL: Flushing X509 store with ca_cert file");
1535 new_cert_store = tls_crl_cert_reload(data->ca_cert,
1536 data->check_crl);
1537 if (!new_cert_store) {
1538 wpa_printf(MSG_ERROR,
1539 "OpenSSL: Error replacing X509 store with ca_cert file");
1540 } else {
1541 /* Replace old store */
1542 SSL_CTX_set_cert_store(ssl, new_cert_store);
1543 data->crl_last_reload = now;
1544 }
1545 }
1546
6a31a31d
JM		 1547 conn = os_zalloc(sizeof(*conn));
1548 if (conn == NULL)
1549 return NULL;
dd5d325b 1550 conn->data = data;
bd9b8b2b 1551 conn->ssl_ctx = ssl;
6a31a31d
JM		 1552 conn->ssl = SSL_new(ssl);
1553 if (conn->ssl == NULL) {
6fc6879b
JM		 1554 tls_show_errors(MSG_INFO, __func__,
1555 "Failed to initialize new SSL connection");
6a31a31d
JM		 1556 os_free(conn);
1557 return NULL;
6fc6879b
JM		 1558 }
1559
6a31a31d
JM		 1560 conn->context = context;
1561 SSL_set_app_data(conn->ssl, conn);
1562 SSL_set_msg_callback(conn->ssl, tls_msg_cb);
1563 SSL_set_msg_callback_arg(conn->ssl, conn);
fca25ef4
JM		 1564 options = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
1565 SSL_OP_SINGLE_DH_USE;
1566#ifdef SSL_OP_NO_COMPRESSION
1567 options |= SSL_OP_NO_COMPRESSION;
1568#endif /* SSL_OP_NO_COMPRESSION */
6a31a31d 1569 SSL_set_options(conn->ssl, options);
6fc6879b 1570
6a31a31d
JM		 1571 conn->ssl_in = BIO_new(BIO_s_mem());
1572 if (!conn->ssl_in) {
6fc6879b
JM		 1573 tls_show_errors(MSG_INFO, __func__,
1574 "Failed to create a new BIO for ssl_in");
6a31a31d
JM		 1575 SSL_free(conn->ssl);
1576 os_free(conn);
1577 return NULL;
6fc6879b
JM		 1578 }
1579
6a31a31d
JM		 1580 conn->ssl_out = BIO_new(BIO_s_mem());
1581 if (!conn->ssl_out) {
6fc6879b
JM		 1582 tls_show_errors(MSG_INFO, __func__,
1583 "Failed to create a new BIO for ssl_out");
1584 SSL_free(conn->ssl);
6a31a31d 1585 BIO_free(conn->ssl_in);
6fc6879b
JM		 1586 os_free(conn);
1587 return NULL;
1588 }
1589
6a31a31d
JM		 1590 SSL_set_bio(conn->ssl, conn->ssl_in, conn->ssl_out);
1591
6fc6879b
JM		 1592 return conn;
1593}
1594
1595
1596void tls_connection_deinit(void *ssl_ctx, struct tls_connection *conn)
1597{
1598 if (conn == NULL)
1599 return;
acf36f31
JM		 1600 if (conn->success_data) {
1601 /*
1602 * Make sure ssl_clear_bad_session() does not remove this
1603 * session.
1604 */
1605 SSL_set_quiet_shutdown(conn->ssl, 1);
1606 SSL_shutdown(conn->ssl);
1607 }
6fc6879b
JM		 1608 SSL_free(conn->ssl);
1609 tls_engine_deinit(conn);
1610 os_free(conn->subject_match);
1611 os_free(conn->altsubject_match);
01f809c7 1612 os_free(conn->suffix_match);
cebee30f 1613 os_free(conn->domain_match);
6fc6879b
JM		 1614 os_free(conn->session_ticket);
1615 os_free(conn);
1616}
1617
1618
1619int tls_connection_established(void *ssl_ctx, struct tls_connection *conn)
1620{
1621 return conn ? SSL_is_init_finished(conn->ssl) : 0;
1622}
1623
1624
0ec3e77a
JM		 1625char * tls_connection_peer_serial_num(void *tls_ctx,
1626 struct tls_connection *conn)
1627{
1628 ASN1_INTEGER *ser;
1629 char *serial_num;
1630 size_t len;
1631
1632 if (!conn->peer_cert)
1633 return NULL;
1634
1635 ser = X509_get_serialNumber(conn->peer_cert);
1636 if (!ser)
1637 return NULL;
1638
1639 len = ASN1_STRING_length(ser) * 2 + 1;
1640 serial_num = os_malloc(len);
1641 if (!serial_num)
1642 return NULL;
1643 wpa_snprintf_hex_uppercase(serial_num, len,
1644 ASN1_STRING_get0_data(ser),
1645 ASN1_STRING_length(ser));
1646 return serial_num;
1647}
1648
1649
6fc6879b
JM		 1650int tls_connection_shutdown(void *ssl_ctx, struct tls_connection *conn)
1651{
1652 if (conn == NULL)
1653 return -1;
1654
1655 /* Shutdown previous TLS connection without notifying the peer
1656 * because the connection was already terminated in practice
1657 * and "close notify" shutdown alert would confuse AS. */
1658 SSL_set_quiet_shutdown(conn->ssl, 1);
1659 SSL_shutdown(conn->ssl);
a7803b0c 1660 return SSL_clear(conn->ssl) == 1 ? 0 : -1;
6fc6879b
JM		 1661}
1662
1663
1664static int tls_match_altsubject_component(X509 *cert, int type,
1665 const char *value, size_t len)
1666{
1667 GENERAL_NAME *gen;
1668 void *ext;
a8572960
AL		 1669 int found = 0;
1670 stack_index_t i;
6fc6879b
JM		 1671
1672 ext = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL);
1673
1674 for (i = 0; ext && i < sk_GENERAL_NAME_num(ext); i++) {
1675 gen = sk_GENERAL_NAME_value(ext, i);
1676 if (gen->type != type)
1677 continue;
1678 if (os_strlen((char *) gen->d.ia5->data) == len &&
1679 os_memcmp(value, gen->d.ia5->data, len) == 0)
1680 found++;
1681 }
1682
0f096370
JM		 1683 sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free);
1684
6fc6879b
JM		 1685 return found;
1686}
1687
1688
1689static int tls_match_altsubject(X509 *cert, const char *match)
1690{
1691 int type;
1692 const char *pos, *end;
1693 size_t len;
1694
1695 pos = match;
1696 do {
1697 if (os_strncmp(pos, "EMAIL:", 6) == 0) {
1698 type = GEN_EMAIL;
1699 pos += 6;
1700 } else if (os_strncmp(pos, "DNS:", 4) == 0) {
1701 type = GEN_DNS;
1702 pos += 4;
1703 } else if (os_strncmp(pos, "URI:", 4) == 0) {
1704 type = GEN_URI;
1705 pos += 4;
1706 } else {
1707 wpa_printf(MSG_INFO, "TLS: Invalid altSubjectName "
1708 "match '%s'", pos);
1709 return 0;
1710 }
1711 end = os_strchr(pos, ';');
1712 while (end) {
1713 if (os_strncmp(end + 1, "EMAIL:", 6) == 0 ||
1714 os_strncmp(end + 1, "DNS:", 4) == 0 ||
1715 os_strncmp(end + 1, "URI:", 4) == 0)
1716 break;
1717 end = os_strchr(end + 1, ';');
1718 }
1719 if (end)
1720 len = end - pos;
1721 else
1722 len = os_strlen(pos);
1723 if (tls_match_altsubject_component(cert, type, pos, len) > 0)
1724 return 1;
1725 pos = end + 1;
1726 } while (end);
1727
1728 return 0;
1729}
1730
1731
461e3ebe 1732#ifndef CONFIG_NATIVE_WINDOWS
cebee30f
JM		 1733static int domain_suffix_match(const u8 *val, size_t len, const char *match,
1734 int full)
01f809c7
JM		 1735{
1736 size_t i, match_len;
1737
1738 /* Check for embedded nuls that could mess up suffix matching */
1739 for (i = 0; i < len; i++) {
1740 if (val[i] == '\0') {
1741 wpa_printf(MSG_DEBUG, "TLS: Embedded null in a string - reject");
1742 return 0;
1743 }
1744 }
1745
1746 match_len = os_strlen(match);
cebee30f 1747 if (match_len > len || (full && match_len != len))
01f809c7
JM		 1748 return 0;
1749
1750 if (os_strncasecmp((const char *) val + len - match_len, match,
1751 match_len) != 0)
1752 return 0; /* no match */
1753
1754 if (match_len == len)
1755 return 1; /* exact match */
1756
1757 if (val[len - match_len - 1] == '.')
1758 return 1; /* full label match completes suffix match */
1759
1760 wpa_printf(MSG_DEBUG, "TLS: Reject due to incomplete label match");
1761 return 0;
1762}
461e3ebe 1763#endif /* CONFIG_NATIVE_WINDOWS */
01f809c7
JM		 1764
1765
cebee30f 1766static int tls_match_suffix(X509 *cert, const char *match, int full)
01f809c7 1767{
461e3ebe
JM		 1768#ifdef CONFIG_NATIVE_WINDOWS
1769 /* wincrypt.h has conflicting X509_NAME definition */
1770 return -1;
1771#else /* CONFIG_NATIVE_WINDOWS */
01f809c7
JM		 1772 GENERAL_NAME *gen;
1773 void *ext;
1774 int i;
98a1571d 1775 stack_index_t j;
01f809c7
JM		 1776 int dns_name = 0;
1777 X509_NAME *name;
1778
cebee30f
JM		 1779 wpa_printf(MSG_DEBUG, "TLS: Match domain against %s%s",
1780 full ? "": "suffix ", match);
01f809c7
JM		 1781
1782 ext = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL);
1783
98a1571d
JM		 1784 for (j = 0; ext && j < sk_GENERAL_NAME_num(ext); j++) {
1785 gen = sk_GENERAL_NAME_value(ext, j);
01f809c7
JM		 1786 if (gen->type != GEN_DNS)
1787 continue;
1788 dns_name++;
1789 wpa_hexdump_ascii(MSG_DEBUG, "TLS: Certificate dNSName",
1790 gen->d.dNSName->data,
1791 gen->d.dNSName->length);
1792 if (domain_suffix_match(gen->d.dNSName->data,
cebee30f
JM		 1793 gen->d.dNSName->length, match, full) ==
1794 1) {
1795 wpa_printf(MSG_DEBUG, "TLS: %s in dNSName found",
1796 full ? "Match" : "Suffix match");
0f096370 1797 sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free);
01f809c7
JM		 1798 return 1;
1799 }
1800 }
0f096370 1801 sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free);
01f809c7
JM		 1802
1803 if (dns_name) {
1804 wpa_printf(MSG_DEBUG, "TLS: None of the dNSName(s) matched");
1805 return 0;
1806 }
1807
1808 name = X509_get_subject_name(cert);
1809 i = -1;
1810 for (;;) {
1811 X509_NAME_ENTRY *e;
1812 ASN1_STRING *cn;
1813
1814 i = X509_NAME_get_index_by_NID(name, NID_commonName, i);
1815 if (i == -1)
1816 break;
1817 e = X509_NAME_get_entry(name, i);
1818 if (e == NULL)
1819 continue;
1820 cn = X509_NAME_ENTRY_get_data(e);
1821 if (cn == NULL)
1822 continue;
1823 wpa_hexdump_ascii(MSG_DEBUG, "TLS: Certificate commonName",
1824 cn->data, cn->length);
cebee30f
JM		 1825 if (domain_suffix_match(cn->data, cn->length, match, full) == 1)
1826 {
1827 wpa_printf(MSG_DEBUG, "TLS: %s in commonName found",
1828 full ? "Match" : "Suffix match");
01f809c7
JM		 1829 return 1;
1830 }
1831 }
1832
cebee30f
JM		 1833 wpa_printf(MSG_DEBUG, "TLS: No CommonName %smatch found",
1834 full ? "": "suffix ");
01f809c7 1835 return 0;
461e3ebe 1836#endif /* CONFIG_NATIVE_WINDOWS */
01f809c7
JM		 1837}
1838
1839
00468b46
JM		 1840static enum tls_fail_reason openssl_tls_fail_reason(int err)
1841{
1842 switch (err) {
1843 case X509_V_ERR_CERT_REVOKED:
1844 return TLS_FAIL_REVOKED;
1845 case X509_V_ERR_CERT_NOT_YET_VALID:
1846 case X509_V_ERR_CRL_NOT_YET_VALID:
1847 return TLS_FAIL_NOT_YET_VALID;
1848 case X509_V_ERR_CERT_HAS_EXPIRED:
1849 case X509_V_ERR_CRL_HAS_EXPIRED:
1850 return TLS_FAIL_EXPIRED;
1851 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
1852 case X509_V_ERR_UNABLE_TO_GET_CRL:
1853 case X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER:
1854 case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
1855 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
1856 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
1857 case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
1858 case X509_V_ERR_CERT_CHAIN_TOO_LONG:
1859 case X509_V_ERR_PATH_LENGTH_EXCEEDED:
1860 case X509_V_ERR_INVALID_CA:
1861 return TLS_FAIL_UNTRUSTED;
1862 case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
1863 case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
1864 case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY:
1865 case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
1866 case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
1867 case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD:
1868 case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:
1869 case X509_V_ERR_CERT_UNTRUSTED:
1870 case X509_V_ERR_CERT_REJECTED:
1871 return TLS_FAIL_BAD_CERTIFICATE;
1872 default:
1873 return TLS_FAIL_UNSPECIFIED;
1874 }
1875}
1876
1877
1878static struct wpabuf * get_x509_cert(X509 *cert)
1879{
1880 struct wpabuf *buf;
1881 u8 *tmp;
1882
1883 int cert_len = i2d_X509(cert, NULL);
1884 if (cert_len <= 0)
1885 return NULL;
1886
1887 buf = wpabuf_alloc(cert_len);
1888 if (buf == NULL)
1889 return NULL;
1890
1891 tmp = wpabuf_put(buf, cert_len);
1892 i2d_X509(cert, &tmp);
1893 return buf;
1894}
1895
1896
1897static void openssl_tls_fail_event(struct tls_connection *conn,
1898 X509 *err_cert, int err, int depth,
1899 const char *subject, const char *err_str,
1900 enum tls_fail_reason reason)
1901{
1902 union tls_event_data ev;
1903 struct wpabuf *cert = NULL;
7c0e1e27 1904 struct tls_context *context = conn->context;
00468b46 1905
7c0e1e27 1906 if (context->event_cb == NULL)
00468b46
JM		 1907 return;
1908
1909 cert = get_x509_cert(err_cert);
1910 os_memset(&ev, 0, sizeof(ev));
1911 ev.cert_fail.reason = reason != TLS_FAIL_UNSPECIFIED ?
1912 reason : openssl_tls_fail_reason(err);
1913 ev.cert_fail.depth = depth;
1914 ev.cert_fail.subject = subject;
1915 ev.cert_fail.reason_txt = err_str;
1916 ev.cert_fail.cert = cert;
7c0e1e27 1917 context->event_cb(context->cb_ctx, TLS_CERT_CHAIN_FAILURE, &ev);
00468b46
JM		 1918 wpabuf_free(cert);
1919}
1920
1921
1922static void openssl_tls_cert_event(struct tls_connection *conn,
1923 X509 *err_cert, int depth,
1924 const char *subject)
1925{
1926 struct wpabuf *cert = NULL;
1927 union tls_event_data ev;
7c0e1e27 1928 struct tls_context *context = conn->context;
d07d3fbd
JM		 1929 char *altsubject[TLS_MAX_ALT_SUBJECT];
1930 int alt, num_altsubject = 0;
1931 GENERAL_NAME *gen;
1932 void *ext;
1933 stack_index_t i;
2ff952a5
JM		 1934 ASN1_INTEGER *ser;
1935 char serial_num[128];
00468b46
JM		 1936#ifdef CONFIG_SHA256
1937 u8 hash[32];
1938#endif /* CONFIG_SHA256 */
1939
7c0e1e27 1940 if (context->event_cb == NULL)
00468b46
JM		 1941 return;
1942
1943 os_memset(&ev, 0, sizeof(ev));
3c108b75
JM		 1944 if (conn->cert_probe || (conn->flags & TLS_CONN_EXT_CERT_CHECK) ||
1945 context->cert_in_cb) {
00468b46
JM		 1946 cert = get_x509_cert(err_cert);
1947 ev.peer_cert.cert = cert;
1948 }
1949#ifdef CONFIG_SHA256
1950 if (cert) {
1951 const u8 *addr[1];
1952 size_t len[1];
1953 addr[0] = wpabuf_head(cert);
1954 len[0] = wpabuf_len(cert);
1955 if (sha256_vector(1, addr, len, hash) == 0) {
1956 ev.peer_cert.hash = hash;
1957 ev.peer_cert.hash_len = sizeof(hash);
1958 }
1959 }
1960#endif /* CONFIG_SHA256 */
1961 ev.peer_cert.depth = depth;
1962 ev.peer_cert.subject = subject;
d07d3fbd 1963
2ff952a5
JM		 1964 ser = X509_get_serialNumber(err_cert);
1965 if (ser) {
1966 wpa_snprintf_hex_uppercase(serial_num, sizeof(serial_num),
1967 ASN1_STRING_get0_data(ser),
1968 ASN1_STRING_length(ser));
1969 ev.peer_cert.serial_num = serial_num;
1970 }
1971
d07d3fbd
JM		 1972 ext = X509_get_ext_d2i(err_cert, NID_subject_alt_name, NULL, NULL);
1973 for (i = 0; ext && i < sk_GENERAL_NAME_num(ext); i++) {
1974 char *pos;
1975
1976 if (num_altsubject == TLS_MAX_ALT_SUBJECT)
1977 break;
1978 gen = sk_GENERAL_NAME_value(ext, i);
1979 if (gen->type != GEN_EMAIL &&
1980 gen->type != GEN_DNS &&
1981 gen->type != GEN_URI)
1982 continue;
1983
1984 pos = os_malloc(10 + gen->d.ia5->length + 1);
1985 if (pos == NULL)
1986 break;
1987 altsubject[num_altsubject++] = pos;
1988
1989 switch (gen->type) {
1990 case GEN_EMAIL:
1991 os_memcpy(pos, "EMAIL:", 6);
1992 pos += 6;
1993 break;
1994 case GEN_DNS:
1995 os_memcpy(pos, "DNS:", 4);
1996 pos += 4;
1997 break;
1998 case GEN_URI:
1999 os_memcpy(pos, "URI:", 4);
2000 pos += 4;
2001 break;
2002 }
2003
2004 os_memcpy(pos, gen->d.ia5->data, gen->d.ia5->length);
2005 pos += gen->d.ia5->length;
2006 *pos = '\0';
2007 }
0f096370 2008 sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free);
d07d3fbd
JM		 2009
2010 for (alt = 0; alt < num_altsubject; alt++)
2011 ev.peer_cert.altsubject[alt] = altsubject[alt];
2012 ev.peer_cert.num_altsubject = num_altsubject;
2013
7c0e1e27 2014 context->event_cb(context->cb_ctx, TLS_PEER_CERTIFICATE, &ev);
00468b46 2015 wpabuf_free(cert);
d07d3fbd
JM		 2016 for (alt = 0; alt < num_altsubject; alt++)
2017 os_free(altsubject[alt]);
00468b46
JM		 2018}
2019
2020
6fc6879b
JM		 2021static int tls_verify_cb(int preverify_ok, X509_STORE_CTX *x509_ctx)
2022{
2023 char buf[256];
2024 X509 *err_cert;
2025 int err, depth;
2026 SSL *ssl;
2027 struct tls_connection *conn;
7c0e1e27 2028 struct tls_context *context;
cebee30f 2029 char *match, *altmatch, *suffix_match, *domain_match;
00468b46 2030 const char *err_str;
6fc6879b
JM		 2031
2032 err_cert = X509_STORE_CTX_get_current_cert(x509_ctx);
97efe70b
EL		 2033 if (!err_cert)
2034 return 0;
2035
6fc6879b
JM		 2036 err = X509_STORE_CTX_get_error(x509_ctx);
2037 depth = X509_STORE_CTX_get_error_depth(x509_ctx);
2038 ssl = X509_STORE_CTX_get_ex_data(x509_ctx,
2039 SSL_get_ex_data_X509_STORE_CTX_idx());
2040 X509_NAME_oneline(X509_get_subject_name(err_cert), buf, sizeof(buf));
2041
2042 conn = SSL_get_app_data(ssl);
0bdaa741
JM		 2043 if (conn == NULL)
2044 return 0;
080585c0
JM		 2045
2046 if (depth == 0)
2047 conn->peer_cert = err_cert;
2048 else if (depth == 1)
2049 conn->peer_issuer = err_cert;
6bf61fb2
JM		 2050 else if (depth == 2)
2051 conn->peer_issuer_issuer = err_cert;
080585c0 2052
7c0e1e27 2053 context = conn->context;
0bdaa741
JM		 2054 match = conn->subject_match;
2055 altmatch = conn->altsubject_match;
01f809c7 2056 suffix_match = conn->suffix_match;
cebee30f 2057 domain_match = conn->domain_match;
6fc6879b 2058
00468b46
JM		 2059 if (!preverify_ok && !conn->ca_cert_verify)
2060 preverify_ok = 1;
2061 if (!preverify_ok && depth > 0 && conn->server_cert_only)
2062 preverify_ok = 1;
235279e7
JM		 2063 if (!preverify_ok && (conn->flags & TLS_CONN_DISABLE_TIME_CHECKS) &&
2064 (err == X509_V_ERR_CERT_HAS_EXPIRED ||
2065 err == X509_V_ERR_CERT_NOT_YET_VALID)) {
2066 wpa_printf(MSG_DEBUG, "OpenSSL: Ignore certificate validity "
2067 "time mismatch");
2068 preverify_ok = 1;
2069 }
dd5d325b
SV		 2070 if (!preverify_ok && !conn->data->check_crl_strict &&
2071 (err == X509_V_ERR_CRL_HAS_EXPIRED ||
2072 err == X509_V_ERR_CRL_NOT_YET_VALID)) {
2073 wpa_printf(MSG_DEBUG,
2074 "OpenSSL: Ignore certificate validity CRL time mismatch");
2075 preverify_ok = 1;
2076 }
00468b46
JM		 2077
2078 err_str = X509_verify_cert_error_string(err);
2079
2080#ifdef CONFIG_SHA256
00033a09
RA		 2081 /*
2082 * Do not require preverify_ok so we can explicity allow otherwise
2083 * invalid pinned server certificates.
2084 */
2085 if (depth == 0 && conn->server_cert_only) {
00468b46
JM		 2086 struct wpabuf *cert;
2087 cert = get_x509_cert(err_cert);
2088 if (!cert) {
2089 wpa_printf(MSG_DEBUG, "OpenSSL: Could not fetch "
2090 "server certificate data");
6fc6879b 2091 preverify_ok = 0;
00468b46
JM		 2092 } else {
2093 u8 hash[32];
2094 const u8 *addr[1];
2095 size_t len[1];
2096 addr[0] = wpabuf_head(cert);
2097 len[0] = wpabuf_len(cert);
2098 if (sha256_vector(1, addr, len, hash) < 0 ||
2099 os_memcmp(conn->srv_cert_hash, hash, 32) != 0) {
2100 err_str = "Server certificate mismatch";
2101 err = X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN;
2102 preverify_ok = 0;
00033a09
RA		 2103 } else if (!preverify_ok) {
2104 /*
2105 * Certificate matches pinned certificate, allow
2106 * regardless of other problems.
2107 */
2108 wpa_printf(MSG_DEBUG,
2109 "OpenSSL: Ignore validation issues for a pinned server certificate");
2110 preverify_ok = 1;
00468b46
JM		 2111 }
2112 wpabuf_free(cert);
6fc6879b
JM		 2113 }
2114 }
00468b46
JM		 2115#endif /* CONFIG_SHA256 */
2116
2117 if (!preverify_ok) {
2118 wpa_printf(MSG_WARNING, "TLS: Certificate verification failed,"
2119 " error %d (%s) depth %d for '%s'", err, err_str,
2120 depth, buf);
2121 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2122 err_str, TLS_FAIL_UNSPECIFIED);
2123 return preverify_ok;
2124 }
2125
2126 wpa_printf(MSG_DEBUG, "TLS: tls_verify_cb - preverify_ok=%d "
2127 "err=%d (%s) ca_cert_verify=%d depth=%d buf='%s'",
2128 preverify_ok, err, err_str,
2129 conn->ca_cert_verify, depth, buf);
2130 if (depth == 0 && match && os_strstr(buf, match) == NULL) {
2131 wpa_printf(MSG_WARNING, "TLS: Subject '%s' did not "
2132 "match with '%s'", buf, match);
2133 preverify_ok = 0;
2134 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2135 "Subject mismatch",
2136 TLS_FAIL_SUBJECT_MISMATCH);
2137 } else if (depth == 0 && altmatch &&
2138 !tls_match_altsubject(err_cert, altmatch)) {
2139 wpa_printf(MSG_WARNING, "TLS: altSubjectName match "
2140 "'%s' not found", altmatch);
2141 preverify_ok = 0;
2142 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2143 "AltSubject mismatch",
2144 TLS_FAIL_ALTSUBJECT_MISMATCH);
01f809c7 2145 } else if (depth == 0 && suffix_match &&
cebee30f 2146 !tls_match_suffix(err_cert, suffix_match, 0)) {
01f809c7
JM		 2147 wpa_printf(MSG_WARNING, "TLS: Domain suffix match '%s' not found",
2148 suffix_match);
2149 preverify_ok = 0;
2150 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2151 "Domain suffix mismatch",
2152 TLS_FAIL_DOMAIN_SUFFIX_MISMATCH);
cebee30f
JM		 2153 } else if (depth == 0 && domain_match &&
2154 !tls_match_suffix(err_cert, domain_match, 1)) {
2155 wpa_printf(MSG_WARNING, "TLS: Domain match '%s' not found",
2156 domain_match);
2157 preverify_ok = 0;
2158 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2159 "Domain mismatch",
2160 TLS_FAIL_DOMAIN_MISMATCH);
00468b46
JM		 2161 } else
2162 openssl_tls_cert_event(conn, err_cert, depth, buf);
2163
2164 if (conn->cert_probe && preverify_ok && depth == 0) {
2165 wpa_printf(MSG_DEBUG, "OpenSSL: Reject server certificate "
2166 "on probe-only run");
2167 preverify_ok = 0;
2168 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2169 "Server certificate chain probe",
2170 TLS_FAIL_SERVER_CHAIN_PROBE);
2171 }
6fc6879b 2172
4eb8cfe0
JM		 2173#ifdef CONFIG_SUITEB
2174 if (conn->flags & TLS_CONN_SUITEB) {
2175 EVP_PKEY *pk;
2176 RSA *rsa;
2177 int len = -1;
2178
2179 pk = X509_get_pubkey(err_cert);
2180 if (pk) {
2181 rsa = EVP_PKEY_get1_RSA(pk);
2182 if (rsa) {
2183 len = RSA_bits(rsa);
2184 RSA_free(rsa);
2185 }
2186 EVP_PKEY_free(pk);
2187 }
2188
2189 if (len >= 0) {
2190 wpa_printf(MSG_DEBUG,
2191 "OpenSSL: RSA modulus size: %d bits", len);
2192 if (len < 3072) {
2193 preverify_ok = 0;
2194 openssl_tls_fail_event(
2195 conn, err_cert, err,
2196 depth, buf,
2197 "Insufficient RSA modulus size",
2198 TLS_FAIL_INSUFFICIENT_KEY_LEN);
2199 }
2200 }
2201 }
2202#endif /* CONFIG_SUITEB */
2203
bdee6ca0 2204#ifdef OPENSSL_IS_BORINGSSL
213e158c
JM		 2205 if (depth == 0 && (conn->flags & TLS_CONN_REQUEST_OCSP) &&
2206 preverify_ok) {
bdee6ca0
JM		 2207 enum ocsp_result res;
2208
213e158c
JM		 2209 res = check_ocsp_resp(conn->ssl_ctx, conn->ssl, err_cert,
2210 conn->peer_issuer,
2211 conn->peer_issuer_issuer);
bdee6ca0
JM		 2212 if (res == OCSP_REVOKED) {
2213 preverify_ok = 0;
2214 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2215 "certificate revoked",
2216 TLS_FAIL_REVOKED);
2217 if (err == X509_V_OK)
2218 X509_STORE_CTX_set_error(
2219 x509_ctx, X509_V_ERR_CERT_REVOKED);
2220 } else if (res != OCSP_GOOD &&
2221 (conn->flags & TLS_CONN_REQUIRE_OCSP)) {
2222 preverify_ok = 0;
2223 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2224 "bad certificate status response",
2225 TLS_FAIL_UNSPECIFIED);
2226 }
2227 }
2228#endif /* OPENSSL_IS_BORINGSSL */
2229
3c108b75 2230 if (depth == 0 && preverify_ok && context->event_cb != NULL)
7c0e1e27
PS		 2231 context->event_cb(context->cb_ctx,
2232 TLS_CERT_CHAIN_SUCCESS, NULL);
dd7fec1f 2233
6fc6879b
JM		 2234 return preverify_ok;
2235}
2236
2237
2238#ifndef OPENSSL_NO_STDIO
bd9b8b2b 2239static int tls_load_ca_der(struct tls_data *data, const char *ca_cert)
6fc6879b 2240{
bd9b8b2b 2241 SSL_CTX *ssl_ctx = data->ssl;
6fc6879b
JM		 2242 X509_LOOKUP *lookup;
2243 int ret = 0;
2244
68ae4773 2245 lookup = X509_STORE_add_lookup(SSL_CTX_get_cert_store(ssl_ctx),
6fc6879b
JM		 2246 X509_LOOKUP_file());
2247 if (lookup == NULL) {
2248 tls_show_errors(MSG_WARNING, __func__,
2249 "Failed add lookup for X509 store");
2250 return -1;
2251 }
2252
2253 if (!X509_LOOKUP_load_file(lookup, ca_cert, X509_FILETYPE_ASN1)) {
2254 unsigned long err = ERR_peek_error();
2255 tls_show_errors(MSG_WARNING, __func__,
2256 "Failed load CA in DER format");
2257 if (ERR_GET_LIB(err) == ERR_LIB_X509 &&
2258 ERR_GET_REASON(err) == X509_R_CERT_ALREADY_IN_HASH_TABLE) {
2259 wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring "
2260 "cert already in hash table error",
2261 __func__);
2262 } else
2263 ret = -1;
2264 }
2265
2266 return ret;
2267}
2268#endif /* OPENSSL_NO_STDIO */
2269
2270
bd9b8b2b
JM		 2271static int tls_connection_ca_cert(struct tls_data *data,
2272 struct tls_connection *conn,
6fc6879b
JM		 2273 const char *ca_cert, const u8 *ca_cert_blob,
2274 size_t ca_cert_blob_len, const char *ca_path)
2275{
bd9b8b2b 2276 SSL_CTX *ssl_ctx = data->ssl;
68ae4773 2277 X509_STORE *store;
6fc6879b
JM		 2278
2279 /*
2280 * Remove previously configured trusted CA certificates before adding
2281 * new ones.
2282 */
68ae4773
JM		 2283 store = X509_STORE_new();
2284 if (store == NULL) {
6fc6879b
JM		 2285 wpa_printf(MSG_DEBUG, "OpenSSL: %s - failed to allocate new "
2286 "certificate store", __func__);
2287 return -1;
2288 }
68ae4773 2289 SSL_CTX_set_cert_store(ssl_ctx, store);
6fc6879b 2290
00468b46
JM		 2291 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);
2292 conn->ca_cert_verify = 1;
2293
2294 if (ca_cert && os_strncmp(ca_cert, "probe://", 8) == 0) {
2295 wpa_printf(MSG_DEBUG, "OpenSSL: Probe for server certificate "
2296 "chain");
2297 conn->cert_probe = 1;
2298 conn->ca_cert_verify = 0;
2299 return 0;
2300 }
2301
2302 if (ca_cert && os_strncmp(ca_cert, "hash://", 7) == 0) {
2303#ifdef CONFIG_SHA256
2304 const char *pos = ca_cert + 7;
2305 if (os_strncmp(pos, "server/sha256/", 14) != 0) {
2306 wpa_printf(MSG_DEBUG, "OpenSSL: Unsupported ca_cert "
2307 "hash value '%s'", ca_cert);
2308 return -1;
2309 }
2310 pos += 14;
2311 if (os_strlen(pos) != 32 * 2) {
2312 wpa_printf(MSG_DEBUG, "OpenSSL: Unexpected SHA256 "
2313 "hash length in ca_cert '%s'", ca_cert);
2314 return -1;
2315 }
2316 if (hexstr2bin(pos, conn->srv_cert_hash, 32) < 0) {
2317 wpa_printf(MSG_DEBUG, "OpenSSL: Invalid SHA256 hash "
2318 "value in ca_cert '%s'", ca_cert);
2319 return -1;
2320 }
2321 conn->server_cert_only = 1;
2322 wpa_printf(MSG_DEBUG, "OpenSSL: Checking only server "
2323 "certificate match");
2324 return 0;
2325#else /* CONFIG_SHA256 */
2326 wpa_printf(MSG_INFO, "No SHA256 included in the build - "
2327 "cannot validate server certificate hash");
2328 return -1;
2329#endif /* CONFIG_SHA256 */
2330 }
2331
6fc6879b 2332 if (ca_cert_blob) {
fee31f76
JM		 2333 X509 *cert = d2i_X509(NULL,
2334 (const unsigned char **) &ca_cert_blob,
6fc6879b
JM		 2335 ca_cert_blob_len);
2336 if (cert == NULL) {
2337 tls_show_errors(MSG_WARNING, __func__,
2338 "Failed to parse ca_cert_blob");
2339 return -1;
2340 }
2341
68ae4773
JM		 2342 if (!X509_STORE_add_cert(SSL_CTX_get_cert_store(ssl_ctx),
2343 cert)) {
6fc6879b
JM		 2344 unsigned long err = ERR_peek_error();
2345 tls_show_errors(MSG_WARNING, __func__,
2346 "Failed to add ca_cert_blob to "
2347 "certificate store");
2348 if (ERR_GET_LIB(err) == ERR_LIB_X509 &&
2349 ERR_GET_REASON(err) ==
2350 X509_R_CERT_ALREADY_IN_HASH_TABLE) {
2351 wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring "
2352 "cert already in hash table error",
2353 __func__);
2354 } else {
2355 X509_free(cert);
2356 return -1;
2357 }
2358 }
2359 X509_free(cert);
2360 wpa_printf(MSG_DEBUG, "OpenSSL: %s - added ca_cert_blob "
2361 "to certificate store", __func__);
6fc6879b
JM		 2362 return 0;
2363 }
2364
2a0cd067 2365#ifdef ANDROID
a8ef133f 2366 /* Single alias */
2a0cd067 2367 if (ca_cert && os_strncmp("keystore://", ca_cert, 11) == 0) {
f150db6c 2368 if (tls_add_ca_from_keystore(SSL_CTX_get_cert_store(ssl_ctx),
a8ef133f 2369 &ca_cert[11]) < 0)
2a0cd067 2370 return -1;
a8ef133f
RX		 2371 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);
2372 return 0;
2373 }
2a0cd067 2374
a8ef133f
RX		 2375 /* Multiple aliases separated by space */
2376 if (ca_cert && os_strncmp("keystores://", ca_cert, 12) == 0) {
2377 char *aliases = os_strdup(&ca_cert[12]);
2378 const char *delim = " ";
2379 int rc = 0;
2380 char *savedptr;
2381 char *alias;
2382
2383 if (!aliases)
2384 return -1;
2385 alias = strtok_r(aliases, delim, &savedptr);
2386 for (; alias; alias = strtok_r(NULL, delim, &savedptr)) {
2387 if (tls_add_ca_from_keystore_encoded(
f150db6c 2388 SSL_CTX_get_cert_store(ssl_ctx), alias)) {
a8ef133f
RX		 2389 wpa_printf(MSG_WARNING,
2390 "OpenSSL: %s - Failed to add ca_cert %s from keystore",
2391 __func__, alias);
2392 rc = -1;
2393 break;
2a0cd067
DS		 2394 }
2395 }
a8ef133f
RX		 2396 os_free(aliases);
2397 if (rc)
2398 return rc;
2399
2a0cd067
DS		 2400 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);
2401 return 0;
2402 }
2403#endif /* ANDROID */
2404
6fc6879b
JM		 2405#ifdef CONFIG_NATIVE_WINDOWS
2406 if (ca_cert && tls_cryptoapi_ca_cert(ssl_ctx, conn->ssl, ca_cert) ==
2407 0) {
2408 wpa_printf(MSG_DEBUG, "OpenSSL: Added CA certificates from "
2409 "system certificate store");
6fc6879b
JM		 2410 return 0;
2411 }
2412#endif /* CONFIG_NATIVE_WINDOWS */
2413
2414 if (ca_cert || ca_path) {
2415#ifndef OPENSSL_NO_STDIO
2416 if (SSL_CTX_load_verify_locations(ssl_ctx, ca_cert, ca_path) !=
2417 1) {
2418 tls_show_errors(MSG_WARNING, __func__,
2419 "Failed to load root certificates");
2420 if (ca_cert &&
bd9b8b2b 2421 tls_load_ca_der(data, ca_cert) == 0) {
6fc6879b
JM		 2422 wpa_printf(MSG_DEBUG, "OpenSSL: %s - loaded "
2423 "DER format CA certificate",
2424 __func__);
2425 } else
2426 return -1;
2427 } else {
2428 wpa_printf(MSG_DEBUG, "TLS: Trusted root "
2429 "certificate(s) loaded");
bd9b8b2b 2430 tls_get_errors(data);
6fc6879b 2431 }
6fc6879b
JM		 2432#else /* OPENSSL_NO_STDIO */
2433 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO",
2434 __func__);
2435 return -1;
2436#endif /* OPENSSL_NO_STDIO */
2437 } else {
2438 /* No ca_cert configured - do not try to verify server
2439 * certificate */
00468b46 2440 conn->ca_cert_verify = 0;
6fc6879b
JM		 2441 }
2442
2443 return 0;
2444}
2445
2446
bd9b8b2b 2447static int tls_global_ca_cert(struct tls_data *data, const char *ca_cert)
6fc6879b 2448{
bd9b8b2b
JM		 2449 SSL_CTX *ssl_ctx = data->ssl;
2450
6fc6879b
JM		 2451 if (ca_cert) {
2452 if (SSL_CTX_load_verify_locations(ssl_ctx, ca_cert, NULL) != 1)
2453 {
2454 tls_show_errors(MSG_WARNING, __func__,
2455 "Failed to load root certificates");
2456 return -1;
2457 }
2458
2459 wpa_printf(MSG_DEBUG, "TLS: Trusted root "
2460 "certificate(s) loaded");
2461
2462#ifndef OPENSSL_NO_STDIO
2463 /* Add the same CAs to the client certificate requests */
2464 SSL_CTX_set_client_CA_list(ssl_ctx,
2465 SSL_load_client_CA_file(ca_cert));
2466#endif /* OPENSSL_NO_STDIO */
159a7fbd
JB		 2467
2468 os_free(data->ca_cert);
2469 data->ca_cert = os_strdup(ca_cert);
6fc6879b
JM		 2470 }
2471
2472 return 0;
2473}
2474
2475
dd5d325b 2476int tls_global_set_verify(void *ssl_ctx, int check_crl, int strict)
6fc6879b
JM		 2477{
2478 int flags;
2479
2480 if (check_crl) {
bd9b8b2b
JM		 2481 struct tls_data *data = ssl_ctx;
2482 X509_STORE *cs = SSL_CTX_get_cert_store(data->ssl);
6fc6879b
JM		 2483 if (cs == NULL) {
2484 tls_show_errors(MSG_INFO, __func__, "Failed to get "
2485 "certificate store when enabling "
2486 "check_crl");
2487 return -1;
2488 }
2489 flags = X509_V_FLAG_CRL_CHECK;
2490 if (check_crl == 2)
2491 flags |= X509_V_FLAG_CRL_CHECK_ALL;
2492 X509_STORE_set_flags(cs, flags);
dd5d325b 2493
159a7fbd 2494 data->check_crl = check_crl;
dd5d325b 2495 data->check_crl_strict = strict;
159a7fbd 2496 os_get_reltime(&data->crl_last_reload);
6fc6879b
JM		 2497 }
2498 return 0;
2499}
2500
2501
2502static int tls_connection_set_subject_match(struct tls_connection *conn,
2503 const char *subject_match,
01f809c7 2504 const char *altsubject_match,
cebee30f
JM		 2505 const char *suffix_match,
2506 const char *domain_match)
6fc6879b
JM		 2507{
2508 os_free(conn->subject_match);
2509 conn->subject_match = NULL;
2510 if (subject_match) {
2511 conn->subject_match = os_strdup(subject_match);
2512 if (conn->subject_match == NULL)
2513 return -1;
2514 }
2515
2516 os_free(conn->altsubject_match);
2517 conn->altsubject_match = NULL;
2518 if (altsubject_match) {
2519 conn->altsubject_match = os_strdup(altsubject_match);
2520 if (conn->altsubject_match == NULL)
2521 return -1;
2522 }
2523
01f809c7
JM		 2524 os_free(conn->suffix_match);
2525 conn->suffix_match = NULL;
2526 if (suffix_match) {
2527 conn->suffix_match = os_strdup(suffix_match);
2528 if (conn->suffix_match == NULL)
2529 return -1;
2530 }
2531
cebee30f
JM		 2532 os_free(conn->domain_match);
2533 conn->domain_match = NULL;
2534 if (domain_match) {
2535 conn->domain_match = os_strdup(domain_match);
2536 if (conn->domain_match == NULL)
2537 return -1;
2538 }
2539
6fc6879b
JM		 2540 return 0;
2541}
2542
2543
1c9663cf
JM		 2544#ifdef CONFIG_SUITEB
2545#if OPENSSL_VERSION_NUMBER >= 0x10002000L
2546static int suiteb_cert_cb(SSL *ssl, void *arg)
2547{
2548 struct tls_connection *conn = arg;
2549
2550 /*
2551 * This cert_cb() is not really the best location for doing a
2552 * constraint check for the ServerKeyExchange message, but this seems to
2553 * be the only place where the current OpenSSL sequence can be
2554 * terminated cleanly with an TLS alert going out to the server.
2555 */
2556
2557 if (!(conn->flags & TLS_CONN_SUITEB))
2558 return 1;
2559
2560 /* DHE is enabled only with DHE-RSA-AES256-GCM-SHA384 */
2561 if (conn->cipher_suite != 0x9f)
2562 return 1;
2563
2564 if (conn->server_dh_prime_len >= 3072)
2565 return 1;
2566
2567 wpa_printf(MSG_DEBUG,
2568 "OpenSSL: Server DH prime length (%d bits) not sufficient for Suite B RSA - reject handshake",
2569 conn->server_dh_prime_len);
2570 return 0;
2571}
2572#endif /* OPENSSL_VERSION_NUMBER */
2573#endif /* CONFIG_SUITEB */
2574
2575
a2c442be
JM		 2576static int tls_set_conn_flags(struct tls_connection *conn, unsigned int flags,
2577 const char *openssl_ciphers)
93bc6549 2578{
1c9663cf
JM		 2579 SSL *ssl = conn->ssl;
2580
93bc6549
JM		 2581#ifdef SSL_OP_NO_TICKET
2582 if (flags & TLS_CONN_DISABLE_SESSION_TICKET)
2583 SSL_set_options(ssl, SSL_OP_NO_TICKET);
93bc6549
JM		 2584 else
2585 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
93bc6549
JM		 2586#endif /* SSL_OP_NO_TICKET */
2587
2588#ifdef SSL_OP_NO_TLSv1
2589 if (flags & TLS_CONN_DISABLE_TLSv1_0)
2590 SSL_set_options(ssl, SSL_OP_NO_TLSv1);
2591 else
2592 SSL_clear_options(ssl, SSL_OP_NO_TLSv1);
2593#endif /* SSL_OP_NO_TLSv1 */
2594#ifdef SSL_OP_NO_TLSv1_1
2595 if (flags & TLS_CONN_DISABLE_TLSv1_1)
2596 SSL_set_options(ssl, SSL_OP_NO_TLSv1_1);
2597 else
2598 SSL_clear_options(ssl, SSL_OP_NO_TLSv1_1);
2599#endif /* SSL_OP_NO_TLSv1_1 */
2600#ifdef SSL_OP_NO_TLSv1_2
2601 if (flags & TLS_CONN_DISABLE_TLSv1_2)
2602 SSL_set_options(ssl, SSL_OP_NO_TLSv1_2);
2603 else
2604 SSL_clear_options(ssl, SSL_OP_NO_TLSv1_2);
2605#endif /* SSL_OP_NO_TLSv1_2 */
bbbc7e80
JM		 2606#ifdef SSL_OP_NO_TLSv1_3
2607 if (flags & TLS_CONN_DISABLE_TLSv1_3)
2608 SSL_set_options(ssl, SSL_OP_NO_TLSv1_3);
2609 else
2610 SSL_clear_options(ssl, SSL_OP_NO_TLSv1_3);
2611#endif /* SSL_OP_NO_TLSv1_3 */
cc9c4fec
JM		 2612#if OPENSSL_VERSION_NUMBER >= 0x10100000L
2613 if (flags & (TLS_CONN_ENABLE_TLSv1_0 |
2614 TLS_CONN_ENABLE_TLSv1_1 |
2615 TLS_CONN_ENABLE_TLSv1_2)) {
2616 int version = 0;
2617
2618 /* Explicit request to enable TLS versions even if needing to
2619 * override systemwide policies. */
2620 if (flags & TLS_CONN_ENABLE_TLSv1_0) {
2621 version = TLS1_VERSION;
2622 } else if (flags & TLS_CONN_ENABLE_TLSv1_1) {
2623 if (!(flags & TLS_CONN_DISABLE_TLSv1_0))
2624 version = TLS1_1_VERSION;
2625 } else if (flags & TLS_CONN_ENABLE_TLSv1_2) {
2626 if (!(flags & (TLS_CONN_DISABLE_TLSv1_0 |
2627 TLS_CONN_DISABLE_TLSv1_1)))
2628 version = TLS1_2_VERSION;
2629 }
2630 if (!version) {
2631 wpa_printf(MSG_DEBUG,
2632 "OpenSSL: Invalid TLS version configuration");
2633 return -1;
2634 }
2635
2636 if (SSL_set_min_proto_version(ssl, version) != 1) {
2637 wpa_printf(MSG_DEBUG,
2638 "OpenSSL: Failed to set minimum TLS version");
2639 return -1;
2640 }
2641 }
2642#endif /* >= 1.1.0 */
2643
60ed2f24 2644#ifdef CONFIG_SUITEB
c54cc8bb
JM		 2645#ifdef OPENSSL_IS_BORINGSSL
2646 /* Start with defaults from BoringSSL */
2647 SSL_CTX_set_verify_algorithm_prefs(conn->ssl_ctx, NULL, 0);
2648#endif /* OPENSSL_IS_BORINGSSL */
1c9663cf 2649#if OPENSSL_VERSION_NUMBER >= 0x10002000L
2ed70c75
JM		 2650 if (flags & TLS_CONN_SUITEB_NO_ECDH) {
2651 const char *ciphers = "DHE-RSA-AES256-GCM-SHA384";
2652
a2c442be
JM		 2653 if (openssl_ciphers) {
2654 wpa_printf(MSG_DEBUG,
2655 "OpenSSL: Override ciphers for Suite B (no ECDH): %s",
2656 openssl_ciphers);
2657 ciphers = openssl_ciphers;
2658 }
2ed70c75
JM		 2659 if (SSL_set_cipher_list(ssl, ciphers) != 1) {
2660 wpa_printf(MSG_INFO,
2661 "OpenSSL: Failed to set Suite B ciphers");
2662 return -1;
2663 }
2664 } else if (flags & TLS_CONN_SUITEB) {
60ed2f24
JM		 2665 EC_KEY *ecdh;
2666 const char *ciphers =
2667 "ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384";
35525023 2668 int nid[1] = { NID_secp384r1 };
60ed2f24 2669
a2c442be
JM		 2670 if (openssl_ciphers) {
2671 wpa_printf(MSG_DEBUG,
2672 "OpenSSL: Override ciphers for Suite B: %s",
2673 openssl_ciphers);
2674 ciphers = openssl_ciphers;
2675 }
60ed2f24
JM		 2676 if (SSL_set_cipher_list(ssl, ciphers) != 1) {
2677 wpa_printf(MSG_INFO,
2678 "OpenSSL: Failed to set Suite B ciphers");
2679 return -1;
2680 }
2681
35525023 2682 if (SSL_set1_curves(ssl, nid, 1) != 1) {
60ed2f24
JM		 2683 wpa_printf(MSG_INFO,
2684 "OpenSSL: Failed to set Suite B curves");
2685 return -1;
2686 }
60ed2f24
JM		 2687
2688 ecdh = EC_KEY_new_by_curve_name(NID_secp384r1);
2689 if (!ecdh || SSL_set_tmp_ecdh(ssl, ecdh) != 1) {
2690 EC_KEY_free(ecdh);
2691 wpa_printf(MSG_INFO,
2692 "OpenSSL: Failed to set ECDH parameter");
2693 return -1;
2694 }
2695 EC_KEY_free(ecdh);
2ed70c75
JM		 2696 }
2697 if (flags & (TLS_CONN_SUITEB | TLS_CONN_SUITEB_NO_ECDH)) {
c54cc8bb
JM		 2698#ifdef OPENSSL_IS_BORINGSSL
2699 uint16_t sigalgs[1] = { SSL_SIGN_RSA_PKCS1_SHA384 };
2700
2701 if (SSL_CTX_set_verify_algorithm_prefs(conn->ssl_ctx, sigalgs,
2702 1) != 1) {
2703 wpa_printf(MSG_INFO,
2704 "OpenSSL: Failed to set Suite B sigalgs");
2705 return -1;
2706 }
2707#else /* OPENSSL_IS_BORINGSSL */
2ed70c75
JM		 2708 /* ECDSA+SHA384 if need to add EC support here */
2709 if (SSL_set1_sigalgs_list(ssl, "RSA+SHA384") != 1) {
2710 wpa_printf(MSG_INFO,
2711 "OpenSSL: Failed to set Suite B sigalgs");
2712 return -1;
2713 }
b9dc63c2 2714#endif /* OPENSSL_IS_BORINGSSL */
60ed2f24
JM		 2715
2716 SSL_set_options(ssl, SSL_OP_NO_TLSv1);
2717 SSL_set_options(ssl, SSL_OP_NO_TLSv1_1);
1c9663cf
JM		 2718 SSL_set_cert_cb(ssl, suiteb_cert_cb, conn);
2719 }
2720#else /* OPENSSL_VERSION_NUMBER < 0x10002000L */
2721 if (flags & (TLS_CONN_SUITEB | TLS_CONN_SUITEB_NO_ECDH)) {
2722 wpa_printf(MSG_ERROR,
2723 "OpenSSL: Suite B RSA case not supported with this OpenSSL version");
2724 return -1;
60ed2f24 2725 }
1c9663cf 2726#endif /* OPENSSL_VERSION_NUMBER */
7a47f34b
JM		 2727
2728#ifdef OPENSSL_IS_BORINGSSL
2729 if (openssl_ciphers && os_strcmp(openssl_ciphers, "SUITEB192") == 0) {
aa6de8e6 2730 uint16_t sigalgs[1] = { SSL_SIGN_ECDSA_SECP384R1_SHA384 };
7a47f34b
JM		 2731 int nid[1] = { NID_secp384r1 };
2732
2733 if (SSL_set1_curves(ssl, nid, 1) != 1) {
2734 wpa_printf(MSG_INFO,
2735 "OpenSSL: Failed to set Suite B curves");
2736 return -1;
2737 }
aa6de8e6
JM		 2738
2739 if (SSL_CTX_set_verify_algorithm_prefs(conn->ssl_ctx, sigalgs,
2740 1) != 1) {
2741 wpa_printf(MSG_INFO,
2742 "OpenSSL: Failed to set Suite B sigalgs");
2743 return -1;
2744 }
7a47f34b 2745 }
cc9c4fec
JM		 2746#else /* OPENSSL_IS_BORINGSSL */
2747 if (!(flags & (TLS_CONN_SUITEB | TLS_CONN_SUITEB_NO_ECDH)) &&
2748 openssl_ciphers && SSL_set_cipher_list(ssl, openssl_ciphers) != 1) {
2749 wpa_printf(MSG_INFO,
2750 "OpenSSL: Failed to set openssl_ciphers '%s'",
2751 openssl_ciphers);
2752 return -1;
2753 }
7a47f34b 2754#endif /* OPENSSL_IS_BORINGSSL */
cc9c4fec
JM		 2755#else /* CONFIG_SUITEB */
2756 if (openssl_ciphers && SSL_set_cipher_list(ssl, openssl_ciphers) != 1) {
2757 wpa_printf(MSG_INFO,
2758 "OpenSSL: Failed to set openssl_ciphers '%s'",
2759 openssl_ciphers);
2760 return -1;
2761 }
60ed2f24
JM		 2762#endif /* CONFIG_SUITEB */
2763
2764 return 0;
93bc6549
JM		 2765}
2766
2767
6fc6879b 2768int tls_connection_set_verify(void *ssl_ctx, struct tls_connection *conn,
bfbebd26
JM		 2769 int verify_peer, unsigned int flags,
2770 const u8 *session_ctx, size_t session_ctx_len)
6fc6879b 2771{
bf206cad 2772 static int counter = 0;
acf36f31 2773 struct tls_data *data = ssl_ctx;
bf206cad 2774
6fc6879b
JM		 2775 if (conn == NULL)
2776 return -1;
2777
2778 if (verify_peer) {
00468b46 2779 conn->ca_cert_verify = 1;
6fc6879b
JM		 2780 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER |
2781 SSL_VERIFY_FAIL_IF_NO_PEER_CERT |
2782 SSL_VERIFY_CLIENT_ONCE, tls_verify_cb);
2783 } else {
00468b46 2784 conn->ca_cert_verify = 0;
6fc6879b
JM		 2785 SSL_set_verify(conn->ssl, SSL_VERIFY_NONE, NULL);
2786 }
2787
a2c442be 2788 if (tls_set_conn_flags(conn, flags, NULL) < 0)
60ed2f24 2789 return -1;
93bc6549
JM		 2790 conn->flags = flags;
2791
6fc6879b
JM		 2792 SSL_set_accept_state(conn->ssl);
2793
acf36f31
JM		 2794 if (data->tls_session_lifetime == 0) {
2795 /*
2796 * Set session id context to a unique value to make sure
2797 * session resumption cannot be used either through session
2798 * caching or TLS ticket extension.
2799 */
2800 counter++;
2801 SSL_set_session_id_context(conn->ssl,
2802 (const unsigned char *) &counter,
2803 sizeof(counter));
2804 } else if (session_ctx) {
2805 SSL_set_session_id_context(conn->ssl, session_ctx,
2806 session_ctx_len);
2807 }
bf206cad 2808
6fc6879b
JM		 2809 return 0;
2810}
2811
2812
2813static int tls_connection_client_cert(struct tls_connection *conn,
2814 const char *client_cert,
2815 const u8 *client_cert_blob,
2816 size_t client_cert_blob_len)
2817{
2818 if (client_cert == NULL && client_cert_blob == NULL)
2819 return 0;
2820
21cb63ff 2821#ifdef PKCS12_FUNCS
df426738 2822#if OPENSSL_VERSION_NUMBER < 0x10002000L || defined(LIBRESSL_VERSION_NUMBER)
21cb63ff
JM		 2823 /*
2824 * Clear previously set extra chain certificates, if any, from PKCS#12
2825 * processing in tls_parse_pkcs12() to allow OpenSSL to build a new
2826 * chain properly.
2827 */
2828 SSL_CTX_clear_extra_chain_certs(conn->ssl_ctx);
2829#endif /* OPENSSL_VERSION_NUMBER < 0x10002000L */
2830#endif /* PKCS12_FUNCS */
2831
6fc6879b
JM		 2832 if (client_cert_blob &&
2833 SSL_use_certificate_ASN1(conn->ssl, (u8 *) client_cert_blob,
2834 client_cert_blob_len) == 1) {
2835 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_ASN1 --> "
2836 "OK");
2837 return 0;
2838 } else if (client_cert_blob) {
2839 tls_show_errors(MSG_DEBUG, __func__,
2840 "SSL_use_certificate_ASN1 failed");
2841 }
2842
2843 if (client_cert == NULL)
2844 return -1;
2845
2a0cd067
DS		 2846#ifdef ANDROID
2847 if (os_strncmp("keystore://", client_cert, 11) == 0) {
2848 BIO *bio = BIO_from_keystore(&client_cert[11]);
2849 X509 *x509 = NULL;
2850 int ret = -1;
2851 if (bio) {
2852 x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
2a0cd067
DS		 2853 }
2854 if (x509) {
2855 if (SSL_use_certificate(conn->ssl, x509) == 1)
2856 ret = 0;
2857 X509_free(x509);
2858 }
6d08f23f
PS		 2859
2860 /* Read additional certificates into the chain. */
2861 while (bio) {
2862 x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
2863 if (x509) {
2864 /* Takes ownership of x509 */
2865 SSL_add0_chain_cert(conn->ssl, x509);
2866 } else {
2867 BIO_free(bio);
2868 bio = NULL;
2869 }
2870 }
2a0cd067
DS		 2871 return ret;
2872 }
2873#endif /* ANDROID */
2874
6fc6879b
JM		 2875#ifndef OPENSSL_NO_STDIO
2876 if (SSL_use_certificate_file(conn->ssl, client_cert,
2877 SSL_FILETYPE_ASN1) == 1) {
2878 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_file (DER)"
2879 " --> OK");
2880 return 0;
6fc6879b
JM		 2881 }
2882
67d35396 2883#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
658c3980 2884 if (SSL_use_certificate_chain_file(conn->ssl, client_cert) == 1) {
effab86f 2885 ERR_clear_error();
658c3980 2886 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_chain_file"
6fc6879b
JM		 2887 " --> OK");
2888 return 0;
6fc6879b 2889 }
568e890e
JM		 2890#else
2891 if (SSL_use_certificate_file(conn->ssl, client_cert,
2892 SSL_FILETYPE_PEM) == 1) {
2893 ERR_clear_error();
2894 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_file (PEM)"
2895 " --> OK");
2896 return 0;
2897 }
2898#endif
effab86f
JM		 2899
2900 tls_show_errors(MSG_DEBUG, __func__,
2901 "SSL_use_certificate_file failed");
6fc6879b
JM		 2902#else /* OPENSSL_NO_STDIO */
2903 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", __func__);
2904#endif /* OPENSSL_NO_STDIO */
2905
2906 return -1;
2907}
2908
2909
bd9b8b2b
JM		 2910static int tls_global_client_cert(struct tls_data *data,
2911 const char *client_cert)
6fc6879b
JM		 2912{
2913#ifndef OPENSSL_NO_STDIO
bd9b8b2b
JM		 2914 SSL_CTX *ssl_ctx = data->ssl;
2915
6fc6879b
JM		 2916 if (client_cert == NULL)
2917 return 0;
2918
2919 if (SSL_CTX_use_certificate_file(ssl_ctx, client_cert,
2920 SSL_FILETYPE_ASN1) != 1 &&
65897747 2921 SSL_CTX_use_certificate_chain_file(ssl_ctx, client_cert) != 1 &&
6fc6879b
JM		 2922 SSL_CTX_use_certificate_file(ssl_ctx, client_cert,
2923 SSL_FILETYPE_PEM) != 1) {
2924 tls_show_errors(MSG_INFO, __func__,
2925 "Failed to load client certificate");
2926 return -1;
2927 }
2928 return 0;
2929#else /* OPENSSL_NO_STDIO */
2930 if (client_cert == NULL)
2931 return 0;
2932 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", __func__);
2933 return -1;
2934#endif /* OPENSSL_NO_STDIO */
2935}
2936
2937
6fc6879b 2938#ifdef PKCS12_FUNCS
bd9b8b2b 2939static int tls_parse_pkcs12(struct tls_data *data, SSL *ssl, PKCS12 *p12,
6fc6879b
JM		 2940 const char *passwd)
2941{
2942 EVP_PKEY *pkey;
2943 X509 *cert;
2944 STACK_OF(X509) *certs;
2945 int res = 0;
2946 char buf[256];
2947
2948 pkey = NULL;
2949 cert = NULL;
2950 certs = NULL;
c07e7b43
JM		 2951 if (!passwd)
2952 passwd = "";
6fc6879b
JM		 2953 if (!PKCS12_parse(p12, passwd, &pkey, &cert, &certs)) {
2954 tls_show_errors(MSG_DEBUG, __func__,
2955 "Failed to parse PKCS12 file");
2956 PKCS12_free(p12);
2957 return -1;
2958 }
2959 wpa_printf(MSG_DEBUG, "TLS: Successfully parsed PKCS12 data");
2960
2961 if (cert) {
2962 X509_NAME_oneline(X509_get_subject_name(cert), buf,
2963 sizeof(buf));
2964 wpa_printf(MSG_DEBUG, "TLS: Got certificate from PKCS12: "
2965 "subject='%s'", buf);
2966 if (ssl) {
2967 if (SSL_use_certificate(ssl, cert) != 1)
2968 res = -1;
2969 } else {
bd9b8b2b 2970 if (SSL_CTX_use_certificate(data->ssl, cert) != 1)
6fc6879b
JM		 2971 res = -1;
2972 }
2973 X509_free(cert);
2974 }
2975
2976 if (pkey) {
2977 wpa_printf(MSG_DEBUG, "TLS: Got private key from PKCS12");
2978 if (ssl) {
2979 if (SSL_use_PrivateKey(ssl, pkey) != 1)
2980 res = -1;
2981 } else {
bd9b8b2b 2982 if (SSL_CTX_use_PrivateKey(data->ssl, pkey) != 1)
6fc6879b
JM		 2983 res = -1;
2984 }
2985 EVP_PKEY_free(pkey);
2986 }
2987
2988 if (certs) {
36e82060 2989#if OPENSSL_VERSION_NUMBER >= 0x10002000L && !defined(LIBRESSL_VERSION_NUMBER)
dda091cf
AB		 2990 if (ssl)
2991 SSL_clear_chain_certs(ssl);
2992 else
2993 SSL_CTX_clear_chain_certs(data->ssl);
de2a7b79
JM		 2994 while ((cert = sk_X509_pop(certs)) != NULL) {
2995 X509_NAME_oneline(X509_get_subject_name(cert), buf,
2996 sizeof(buf));
2997 wpa_printf(MSG_DEBUG, "TLS: additional certificate"
2998 " from PKCS12: subject='%s'", buf);
dda091cf
AB		 2999 if ((ssl && SSL_add1_chain_cert(ssl, cert) != 1) ||
3000 (!ssl && SSL_CTX_add1_chain_cert(data->ssl,
3001 cert) != 1)) {
20f331b7
JM		 3002 tls_show_errors(MSG_DEBUG, __func__,
3003 "Failed to add additional certificate");
de2a7b79 3004 res = -1;
8bcf8de8 3005 X509_free(cert);
de2a7b79
JM		 3006 break;
3007 }
8bcf8de8 3008 X509_free(cert);
de2a7b79 3009 }
20f331b7
JM		 3010 if (!res) {
3011 /* Try to continue anyway */
3012 }
8bcf8de8 3013 sk_X509_pop_free(certs, X509_free);
226cdea6 3014#ifndef OPENSSL_IS_BORINGSSL
dda091cf
AB		 3015 if (ssl)
3016 res = SSL_build_cert_chain(
3017 ssl,
3018 SSL_BUILD_CHAIN_FLAG_CHECK |
3019 SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR);
3020 else
3021 res = SSL_CTX_build_cert_chain(
3022 data->ssl,
3023 SSL_BUILD_CHAIN_FLAG_CHECK |
3024 SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR);
de2a7b79
JM		 3025 if (!res) {
3026 tls_show_errors(MSG_DEBUG, __func__,
3027 "Failed to build certificate chain");
3028 } else if (res == 2) {
3029 wpa_printf(MSG_DEBUG,
3030 "TLS: Ignore certificate chain verification error when building chain with PKCS#12 extra certificates");
3031 }
226cdea6 3032#endif /* OPENSSL_IS_BORINGSSL */
de2a7b79
JM		 3033 /*
3034 * Try to continue regardless of result since it is possible for
3035 * the extra certificates not to be required.
3036 */
3037 res = 0;
3038#else /* OPENSSL_VERSION_NUMBER >= 0x10002000L */
bd9b8b2b 3039 SSL_CTX_clear_extra_chain_certs(data->ssl);
6fc6879b
JM		 3040 while ((cert = sk_X509_pop(certs)) != NULL) {
3041 X509_NAME_oneline(X509_get_subject_name(cert), buf,
3042 sizeof(buf));
3043 wpa_printf(MSG_DEBUG, "TLS: additional certificate"
3044 " from PKCS12: subject='%s'", buf);
3045 /*
3046 * There is no SSL equivalent for the chain cert - so
3047 * always add it to the context...
3048 */
bd9b8b2b
JM		 3049 if (SSL_CTX_add_extra_chain_cert(data->ssl, cert) != 1)
3050 {
8bcf8de8 3051 X509_free(cert);
6fc6879b
JM		 3052 res = -1;
3053 break;
3054 }
3055 }
8bcf8de8 3056 sk_X509_pop_free(certs, X509_free);
de2a7b79 3057#endif /* OPENSSL_VERSION_NUMBER >= 0x10002000L */
6fc6879b
JM		 3058 }
3059
3060 PKCS12_free(p12);
3061
3062 if (res < 0)
bd9b8b2b 3063 tls_get_errors(data);
6fc6879b
JM		 3064
3065 return res;
3066}
3067#endif /* PKCS12_FUNCS */
3068
3069
bd9b8b2b
JM		 3070static int tls_read_pkcs12(struct tls_data *data, SSL *ssl,
3071 const char *private_key, const char *passwd)
6fc6879b
JM		 3072{
3073#ifdef PKCS12_FUNCS
3074 FILE *f;
3075 PKCS12 *p12;
3076
3077 f = fopen(private_key, "rb");
3078 if (f == NULL)
3079 return -1;
3080
3081 p12 = d2i_PKCS12_fp(f, NULL);
3082 fclose(f);
3083
3084 if (p12 == NULL) {
3085 tls_show_errors(MSG_INFO, __func__,
3086 "Failed to use PKCS#12 file");
3087 return -1;
3088 }
3089
bd9b8b2b 3090 return tls_parse_pkcs12(data, ssl, p12, passwd);
6fc6879b
JM		 3091
3092#else /* PKCS12_FUNCS */
3093 wpa_printf(MSG_INFO, "TLS: PKCS12 support disabled - cannot read "
3094 "p12/pfx files");
3095 return -1;
3096#endif /* PKCS12_FUNCS */
3097}
3098
3099
bd9b8b2b 3100static int tls_read_pkcs12_blob(struct tls_data *data, SSL *ssl,
6fc6879b
JM		 3101 const u8 *blob, size_t len, const char *passwd)
3102{
3103#ifdef PKCS12_FUNCS
3104 PKCS12 *p12;
3105
fee31f76 3106 p12 = d2i_PKCS12(NULL, (const unsigned char **) &blob, len);
6fc6879b
JM		 3107 if (p12 == NULL) {
3108 tls_show_errors(MSG_INFO, __func__,
3109 "Failed to use PKCS#12 blob");
3110 return -1;
3111 }
3112
bd9b8b2b 3113 return tls_parse_pkcs12(data, ssl, p12, passwd);
6fc6879b
JM		 3114
3115#else /* PKCS12_FUNCS */
3116 wpa_printf(MSG_INFO, "TLS: PKCS12 support disabled - cannot parse "
3117 "p12/pfx blobs");
3118 return -1;
3119#endif /* PKCS12_FUNCS */
3120}
3121
3122
e572cb63 3123#ifndef OPENSSL_NO_ENGINE
e59c91af
DS		 3124static int tls_engine_get_cert(struct tls_connection *conn,
3125 const char *cert_id,
3126 X509 **cert)
3127{
e59c91af
DS		 3128 /* this runs after the private key is loaded so no PIN is required */
3129 struct {
3130 const char *cert_id;
3131 X509 *cert;
3132 } params;
3133 params.cert_id = cert_id;
3134 params.cert = NULL;
3135
3136 if (!ENGINE_ctrl_cmd(conn->engine, "LOAD_CERT_CTRL",
3137 0, &params, NULL, 1)) {
fd4fb281
MG		 3138 unsigned long err = ERR_get_error();
3139
e59c91af
DS		 3140 wpa_printf(MSG_ERROR, "ENGINE: cannot load client cert with id"
3141 " '%s' [%s]", cert_id,
fd4fb281
MG		 3142 ERR_error_string(err, NULL));
3143 if (tls_is_pin_error(err))
3144 return TLS_SET_PARAMS_ENGINE_PRV_BAD_PIN;
e59c91af
DS		 3145 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
3146 }
3147 if (!params.cert) {
3148 wpa_printf(MSG_ERROR, "ENGINE: did not properly cert with id"
3149 " '%s'", cert_id);
3150 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
3151 }
3152 *cert = params.cert;
3153 return 0;
e59c91af 3154}
e572cb63 3155#endif /* OPENSSL_NO_ENGINE */
e59c91af
DS		 3156
3157
3158static int tls_connection_engine_client_cert(struct tls_connection *conn,
3159 const char *cert_id)
3160{
3161#ifndef OPENSSL_NO_ENGINE
3162 X509 *cert;
3163
3164 if (tls_engine_get_cert(conn, cert_id, &cert))
3165 return -1;
3166
3167 if (!SSL_use_certificate(conn->ssl, cert)) {
3168 tls_show_errors(MSG_ERROR, __func__,
3169 "SSL_use_certificate failed");
3170 X509_free(cert);
3171 return -1;
3172 }
3173 X509_free(cert);
3174 wpa_printf(MSG_DEBUG, "ENGINE: SSL_use_certificate --> "
3175 "OK");
3176 return 0;
3177
3178#else /* OPENSSL_NO_ENGINE */
3179 return -1;
3180#endif /* OPENSSL_NO_ENGINE */
3181}
3182
3183
bd9b8b2b 3184static int tls_connection_engine_ca_cert(struct tls_data *data,
e59c91af
DS		 3185 struct tls_connection *conn,
3186 const char *ca_cert_id)
3187{
3188#ifndef OPENSSL_NO_ENGINE
3189 X509 *cert;
bd9b8b2b 3190 SSL_CTX *ssl_ctx = data->ssl;
68ae4773 3191 X509_STORE *store;
e59c91af
DS		 3192
3193 if (tls_engine_get_cert(conn, ca_cert_id, &cert))
3194 return -1;
3195
3196 /* start off the same as tls_connection_ca_cert */
68ae4773
JM		 3197 store = X509_STORE_new();
3198 if (store == NULL) {
e59c91af
DS		 3199 wpa_printf(MSG_DEBUG, "OpenSSL: %s - failed to allocate new "
3200 "certificate store", __func__);
3201 X509_free(cert);
3202 return -1;
3203 }
68ae4773
JM		 3204 SSL_CTX_set_cert_store(ssl_ctx, store);
3205 if (!X509_STORE_add_cert(store, cert)) {
e59c91af
DS		 3206 unsigned long err = ERR_peek_error();
3207 tls_show_errors(MSG_WARNING, __func__,
3208 "Failed to add CA certificate from engine "
3209 "to certificate store");
3210 if (ERR_GET_LIB(err) == ERR_LIB_X509 &&
3211 ERR_GET_REASON(err) == X509_R_CERT_ALREADY_IN_HASH_TABLE) {
3212 wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring cert"
3213 " already in hash table error",
3214 __func__);
3215 } else {
3216 X509_free(cert);
3217 return -1;
3218 }
3219 }
3220 X509_free(cert);
3221 wpa_printf(MSG_DEBUG, "OpenSSL: %s - added CA certificate from engine "
3222 "to certificate store", __func__);
3223 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);
d8858cad
CW		 3224 conn->ca_cert_verify = 1;
3225
e59c91af
DS		 3226 return 0;
3227
3228#else /* OPENSSL_NO_ENGINE */
3229 return -1;
3230#endif /* OPENSSL_NO_ENGINE */
3231}
3232
3233
6fc6879b
JM		 3234static int tls_connection_engine_private_key(struct tls_connection *conn)
3235{
aeeb0bca 3236#if defined(ANDROID) || !defined(OPENSSL_NO_ENGINE)
6fc6879b
JM		 3237 if (SSL_use_PrivateKey(conn->ssl, conn->private_key) != 1) {
3238 tls_show_errors(MSG_ERROR, __func__,
3239 "ENGINE: cannot use private key for TLS");
3240 return -1;
3241 }
3242 if (!SSL_check_private_key(conn->ssl)) {
3243 tls_show_errors(MSG_INFO, __func__,
3244 "Private key failed verification");
3245 return -1;
3246 }
3247 return 0;
3248#else /* OPENSSL_NO_ENGINE */
3249 wpa_printf(MSG_ERROR, "SSL: Configuration uses engine, but "
3250 "engine support was not compiled in");
3251 return -1;
3252#endif /* OPENSSL_NO_ENGINE */
3253}
3254
3255
63942cf0
DB		 3256#ifndef OPENSSL_NO_STDIO
3257static int tls_passwd_cb(char *buf, int size, int rwflag, void *password)
89971d8b 3258{
63942cf0
DB		 3259 if (!password)
3260 return 0;
3261 os_strlcpy(buf, (const char *) password, size);
3262 return os_strlen(buf);
3263}
3264#endif /* OPENSSL_NO_STDIO */
3265
3266
3267static int tls_use_private_key_file(struct tls_data *data, SSL *ssl,
3268 const char *private_key,
3269 const char *private_key_passwd)
3270{
3271#ifndef OPENSSL_NO_STDIO
3272 BIO *bio;
3273 EVP_PKEY *pkey;
3274 int ret;
3275
3276 /* First try ASN.1 (DER). */
3277 bio = BIO_new_file(private_key, "r");
3278 if (!bio)
3279 return -1;
3280 pkey = d2i_PrivateKey_bio(bio, NULL);
3281 BIO_free(bio);
3282
3283 if (pkey) {
3284 wpa_printf(MSG_DEBUG, "OpenSSL: %s (DER) --> loaded", __func__);
3285 } else {
3286 /* Try PEM with the provided password. */
3287 bio = BIO_new_file(private_key, "r");
3288 if (!bio)
3289 return -1;
3290 pkey = PEM_read_bio_PrivateKey(bio, NULL, tls_passwd_cb,
3291 (void *) private_key_passwd);
3292 BIO_free(bio);
3293 if (!pkey)
3294 return -1;
3295 wpa_printf(MSG_DEBUG, "OpenSSL: %s (PEM) --> loaded", __func__);
3296 /* Clear errors from the previous failed load. */
3297 ERR_clear_error();
89971d8b 3298 }
63942cf0
DB		 3299
3300 if (ssl)
3301 ret = SSL_use_PrivateKey(ssl, pkey);
3302 else
3303 ret = SSL_CTX_use_PrivateKey(data->ssl, pkey);
3304
3305 EVP_PKEY_free(pkey);
3306 return ret == 1 ? 0 : -1;
3307#else /* OPENSSL_NO_STDIO */
3308 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", __func__);
3309 return -1;
3310#endif /* OPENSSL_NO_STDIO */
89971d8b
JM		 3311}
3312
3313
bd9b8b2b 3314static int tls_connection_private_key(struct tls_data *data,
6fc6879b
JM		 3315 struct tls_connection *conn,
3316 const char *private_key,
3317 const char *private_key_passwd,
3318 const u8 *private_key_blob,
3319 size_t private_key_blob_len)
3320{
6fc6879b
JM		 3321 int ok;
3322
3323 if (private_key == NULL && private_key_blob == NULL)
3324 return 0;
3325
6fc6879b
JM		 3326 ok = 0;
3327 while (private_key_blob) {
3328 if (SSL_use_PrivateKey_ASN1(EVP_PKEY_RSA, conn->ssl,
3329 (u8 *) private_key_blob,
3330 private_key_blob_len) == 1) {
3331 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_PrivateKey_"
3332 "ASN1(EVP_PKEY_RSA) --> OK");
3333 ok = 1;
3334 break;
6fc6879b
JM		 3335 }
3336
3337 if (SSL_use_PrivateKey_ASN1(EVP_PKEY_DSA, conn->ssl,
3338 (u8 *) private_key_blob,
3339 private_key_blob_len) == 1) {
3340 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_PrivateKey_"
3341 "ASN1(EVP_PKEY_DSA) --> OK");
3342 ok = 1;
3343 break;
6fc6879b
JM		 3344 }
3345
3346 if (SSL_use_RSAPrivateKey_ASN1(conn->ssl,
3347 (u8 *) private_key_blob,
3348 private_key_blob_len) == 1) {
3349 wpa_printf(MSG_DEBUG, "OpenSSL: "
3350 "SSL_use_RSAPrivateKey_ASN1 --> OK");
3351 ok = 1;
3352 break;
6fc6879b
JM		 3353 }
3354
bd9b8b2b 3355 if (tls_read_pkcs12_blob(data, conn->ssl, private_key_blob,
149143e3
DB		 3356 private_key_blob_len,
3357 private_key_passwd) == 0) {
6fc6879b
JM		 3358 wpa_printf(MSG_DEBUG, "OpenSSL: PKCS#12 as blob --> "
3359 "OK");
3360 ok = 1;
3361 break;
3362 }
3363
3364 break;
3365 }
3366
3367 while (!ok && private_key) {
63942cf0
DB		 3368 if (tls_use_private_key_file(data, conn->ssl, private_key,
3369 private_key_passwd) == 0) {
6fc6879b
JM		 3370 ok = 1;
3371 break;
6fc6879b 3372 }
6fc6879b 3373
149143e3
DB		 3374 if (tls_read_pkcs12(data, conn->ssl, private_key,
3375 private_key_passwd) == 0) {
6fc6879b
JM		 3376 wpa_printf(MSG_DEBUG, "OpenSSL: Reading PKCS#12 file "
3377 "--> OK");
3378 ok = 1;
3379 break;
3380 }
3381
3382 if (tls_cryptoapi_cert(conn->ssl, private_key) == 0) {
3383 wpa_printf(MSG_DEBUG, "OpenSSL: Using CryptoAPI to "
3384 "access certificate store --> OK");
3385 ok = 1;
3386 break;
3387 }
3388
3389 break;
3390 }
3391
3392 if (!ok) {
effab86f
JM		 3393 tls_show_errors(MSG_INFO, __func__,
3394 "Failed to load private key");
6fc6879b
JM		 3395 return -1;
3396 }
3397 ERR_clear_error();
55651a4b 3398
6fc6879b
JM		 3399 if (!SSL_check_private_key(conn->ssl)) {
3400 tls_show_errors(MSG_INFO, __func__, "Private key failed "
3401 "verification");
3402 return -1;
3403 }
3404
3405 wpa_printf(MSG_DEBUG, "SSL: Private key loaded successfully");
3406 return 0;
3407}
3408
3409
bd9b8b2b
JM		 3410static int tls_global_private_key(struct tls_data *data,
3411 const char *private_key,
6fc6879b
JM		 3412 const char *private_key_passwd)
3413{
bd9b8b2b 3414 SSL_CTX *ssl_ctx = data->ssl;
6fc6879b
JM		 3415
3416 if (private_key == NULL)
3417 return 0;
3418
63942cf0
DB		 3419 if (tls_use_private_key_file(data, NULL, private_key,
3420 private_key_passwd) &&
149143e3 3421 tls_read_pkcs12(data, NULL, private_key, private_key_passwd)) {
6fc6879b
JM		 3422 tls_show_errors(MSG_INFO, __func__,
3423 "Failed to load private key");
6fc6879b
JM		 3424 ERR_clear_error();
3425 return -1;
3426 }
6fc6879b 3427 ERR_clear_error();
55651a4b 3428
6fc6879b
JM		 3429 if (!SSL_CTX_check_private_key(ssl_ctx)) {
3430 tls_show_errors(MSG_INFO, __func__,
3431 "Private key failed verification");
3432 return -1;
3433 }
3434
3435 return 0;
3436}
3437
3438
3439static int tls_connection_dh(struct tls_connection *conn, const char *dh_file)
3440{
3441#ifdef OPENSSL_NO_DH
3442 if (dh_file == NULL)
3443 return 0;
3444 wpa_printf(MSG_ERROR, "TLS: openssl does not include DH support, but "
3445 "dh_file specified");
3446 return -1;
3447#else /* OPENSSL_NO_DH */
3448 DH *dh;
3449 BIO *bio;
3450
3451 /* TODO: add support for dh_blob */
3452 if (dh_file == NULL)
3453 return 0;
3454 if (conn == NULL)
3455 return -1;
3456
3457 bio = BIO_new_file(dh_file, "r");
3458 if (bio == NULL) {
3459 wpa_printf(MSG_INFO, "TLS: Failed to open DH file '%s': %s",
3460 dh_file, ERR_error_string(ERR_get_error(), NULL));
3461 return -1;
3462 }
3463 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
3464 BIO_free(bio);
3465#ifndef OPENSSL_NO_DSA
3466 while (dh == NULL) {
3467 DSA *dsa;
3468 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DH file '%s': %s -"
3469 " trying to parse as DSA params", dh_file,
3470 ERR_error_string(ERR_get_error(), NULL));
3471 bio = BIO_new_file(dh_file, "r");
3472 if (bio == NULL)
3473 break;
3474 dsa = PEM_read_bio_DSAparams(bio, NULL, NULL, NULL);
3475 BIO_free(bio);
3476 if (!dsa) {
3477 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DSA file "
3478 "'%s': %s", dh_file,
3479 ERR_error_string(ERR_get_error(), NULL));
3480 break;
3481 }
3482
3483 wpa_printf(MSG_DEBUG, "TLS: DH file in DSA param format");
3484 dh = DSA_dup_DH(dsa);
3485 DSA_free(dsa);
3486 if (dh == NULL) {
3487 wpa_printf(MSG_INFO, "TLS: Failed to convert DSA "
3488 "params into DH params");
3489 break;
3490 }
3491 break;
3492 }
3493#endif /* !OPENSSL_NO_DSA */
3494 if (dh == NULL) {
3495 wpa_printf(MSG_INFO, "TLS: Failed to read/parse DH/DSA file "
3496 "'%s'", dh_file);
3497 return -1;
3498 }
3499
3500 if (SSL_set_tmp_dh(conn->ssl, dh) != 1) {
3501 wpa_printf(MSG_INFO, "TLS: Failed to set DH params from '%s': "
3502 "%s", dh_file,
3503 ERR_error_string(ERR_get_error(), NULL));
3504 DH_free(dh);
3505 return -1;
3506 }
3507 DH_free(dh);
3508 return 0;
3509#endif /* OPENSSL_NO_DH */
3510}
3511
3512
bd9b8b2b 3513static int tls_global_dh(struct tls_data *data, const char *dh_file)
6fc6879b
JM		 3514{
3515#ifdef OPENSSL_NO_DH
3516 if (dh_file == NULL)
3517 return 0;
3518 wpa_printf(MSG_ERROR, "TLS: openssl does not include DH support, but "
3519 "dh_file specified");
3520 return -1;
3521#else /* OPENSSL_NO_DH */
bd9b8b2b 3522 SSL_CTX *ssl_ctx = data->ssl;
6fc6879b
JM		 3523 DH *dh;
3524 BIO *bio;
3525
3526 /* TODO: add support for dh_blob */
3527 if (dh_file == NULL)
3528 return 0;
3529 if (ssl_ctx == NULL)
3530 return -1;
3531
3532 bio = BIO_new_file(dh_file, "r");
3533 if (bio == NULL) {
3534 wpa_printf(MSG_INFO, "TLS: Failed to open DH file '%s': %s",
3535 dh_file, ERR_error_string(ERR_get_error(), NULL));
3536 return -1;
3537 }
3538 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
3539 BIO_free(bio);
3540#ifndef OPENSSL_NO_DSA
3541 while (dh == NULL) {
3542 DSA *dsa;
3543 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DH file '%s': %s -"
3544 " trying to parse as DSA params", dh_file,
3545 ERR_error_string(ERR_get_error(), NULL));
3546 bio = BIO_new_file(dh_file, "r");
3547 if (bio == NULL)
3548 break;
3549 dsa = PEM_read_bio_DSAparams(bio, NULL, NULL, NULL);
3550 BIO_free(bio);
3551 if (!dsa) {
3552 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DSA file "
3553 "'%s': %s", dh_file,
3554 ERR_error_string(ERR_get_error(), NULL));
3555 break;
3556 }
3557
3558 wpa_printf(MSG_DEBUG, "TLS: DH file in DSA param format");
3559 dh = DSA_dup_DH(dsa);
3560 DSA_free(dsa);
3561 if (dh == NULL) {
3562 wpa_printf(MSG_INFO, "TLS: Failed to convert DSA "
3563 "params into DH params");
3564 break;
3565 }
3566 break;
3567 }
3568#endif /* !OPENSSL_NO_DSA */
3569 if (dh == NULL) {
3570 wpa_printf(MSG_INFO, "TLS: Failed to read/parse DH/DSA file "
3571 "'%s'", dh_file);
3572 return -1;
3573 }
3574
3575 if (SSL_CTX_set_tmp_dh(ssl_ctx, dh) != 1) {
3576 wpa_printf(MSG_INFO, "TLS: Failed to set DH params from '%s': "
3577 "%s", dh_file,
3578 ERR_error_string(ERR_get_error(), NULL));
3579 DH_free(dh);
3580 return -1;
3581 }
3582 DH_free(dh);
3583 return 0;
3584#endif /* OPENSSL_NO_DH */
3585}
3586
3587
1046db8b
JM		 3588int tls_connection_get_random(void *ssl_ctx, struct tls_connection *conn,
3589 struct tls_random *keys)
6fc6879b
JM		 3590{
3591 SSL *ssl;
3592
3593 if (conn == NULL || keys == NULL)
3594 return -1;
3595 ssl = conn->ssl;
005c5dcf
JM		 3596 if (ssl == NULL)
3597 return -1;
3598
3599 os_memset(keys, 0, sizeof(*keys));
3600 keys->client_random = conn->client_random;
3601 keys->client_random_len = SSL_get_client_random(
3602 ssl, conn->client_random, sizeof(conn->client_random));
3603 keys->server_random = conn->server_random;
3604 keys->server_random_len = SSL_get_server_random(
3605 ssl, conn->server_random, sizeof(conn->server_random));
6fc6879b
JM		 3606
3607 return 0;
3608}
3609
3610
1cece2fa 3611#ifdef OPENSSL_NEED_EAP_FAST_PRF
af851914
JM		 3612static int openssl_get_keyblock_size(SSL *ssl)
3613{
ba3658cf
BS		 3614#if OPENSSL_VERSION_NUMBER < 0x10100000L || \
3615 (defined(LIBRESSL_VERSION_NUMBER) && \
3616 LIBRESSL_VERSION_NUMBER < 0x20700000L)
af851914
JM		 3617 const EVP_CIPHER *c;
3618 const EVP_MD *h;
3619 int md_size;
3620
3621 if (ssl->enc_read_ctx == NULL || ssl->enc_read_ctx->cipher == NULL ||
3622 ssl->read_hash == NULL)
3623 return -1;
3624
3625 c = ssl->enc_read_ctx->cipher;
af851914 3626 h = EVP_MD_CTX_md(ssl->read_hash);
af851914
JM		 3627 if (h)
3628 md_size = EVP_MD_size(h);
af851914
JM		 3629 else if (ssl->s3)
3630 md_size = ssl->s3->tmp.new_mac_secret_size;
af851914
JM		 3631 else
3632 return -1;
3633
3634 wpa_printf(MSG_DEBUG, "OpenSSL: keyblock size: key_len=%d MD_size=%d "
3635 "IV_len=%d", EVP_CIPHER_key_length(c), md_size,
3636 EVP_CIPHER_iv_length(c));
3637 return 2 * (EVP_CIPHER_key_length(c) +
3638 md_size +
3639 EVP_CIPHER_iv_length(c));
3de28506
JM		 3640#else
3641 const SSL_CIPHER *ssl_cipher;
3642 int cipher, digest;
3643 const EVP_CIPHER *c;
3644 const EVP_MD *h;
3645
3646 ssl_cipher = SSL_get_current_cipher(ssl);
3647 if (!ssl_cipher)
3648 return -1;
3649 cipher = SSL_CIPHER_get_cipher_nid(ssl_cipher);
3650 digest = SSL_CIPHER_get_digest_nid(ssl_cipher);
3651 wpa_printf(MSG_DEBUG, "OpenSSL: cipher nid %d digest nid %d",
3652 cipher, digest);
3653 if (cipher < 0 || digest < 0)
3654 return -1;
3655 c = EVP_get_cipherbynid(cipher);
3656 h = EVP_get_digestbynid(digest);
3657 if (!c || !h)
3658 return -1;
3659
3660 wpa_printf(MSG_DEBUG,
3661 "OpenSSL: keyblock size: key_len=%d MD_size=%d IV_len=%d",
3662 EVP_CIPHER_key_length(c), EVP_MD_size(h),
3663 EVP_CIPHER_iv_length(c));
3664 return 2 * (EVP_CIPHER_key_length(c) + EVP_MD_size(h) +
3665 EVP_CIPHER_iv_length(c));
3666#endif
af851914 3667}
1cece2fa 3668#endif /* OPENSSL_NEED_EAP_FAST_PRF */
af851914
JM		 3669
3670
73581707
DB		 3671int tls_connection_export_key(void *tls_ctx, struct tls_connection *conn,
3672 const char *label, u8 *out, size_t out_len)
3673{
3674 if (!conn ||
3675 SSL_export_keying_material(conn->ssl, out, out_len, label,
3676 os_strlen(label), NULL, 0, 0) != 1)
3677 return -1;
3678 return 0;
3679}
3680
3681
3682int tls_connection_get_eap_fast_key(void *tls_ctx, struct tls_connection *conn,
3683 u8 *out, size_t out_len)
fa0e7151 3684{
1cece2fa 3685#ifdef OPENSSL_NEED_EAP_FAST_PRF
3de28506
JM		 3686 SSL *ssl;
3687 SSL_SESSION *sess;
3688 u8 *rnd;
3689 int ret = -1;
3690 int skip = 0;
3691 u8 *tmp_out = NULL;
3692 u8 *_out = out;
3693 unsigned char client_random[SSL3_RANDOM_SIZE];
3694 unsigned char server_random[SSL3_RANDOM_SIZE];
3695 unsigned char master_key[64];
3696 size_t master_key_len;
16bc3b89 3697 const char *ver;
3de28506
JM		 3698
3699 /*
73581707
DB		 3700 * TLS library did not support EAP-FAST key generation, so get the
3701 * needed TLS session parameters and use an internal implementation of
3702 * TLS PRF to derive the key.
3de28506
JM		 3703 */
3704
3705 if (conn == NULL)
3706 return -1;
3707 ssl = conn->ssl;
3708 if (ssl == NULL)
3709 return -1;
16bc3b89 3710 ver = SSL_get_version(ssl);
3de28506 3711 sess = SSL_get_session(ssl);
16bc3b89 3712 if (!ver || !sess)
3de28506
JM		 3713 return -1;
3714
73581707
DB		 3715 skip = openssl_get_keyblock_size(ssl);
3716 if (skip < 0)
3717 return -1;
3718 tmp_out = os_malloc(skip + out_len);
3719 if (!tmp_out)
3720 return -1;
3721 _out = tmp_out;
3de28506
JM		 3722
3723 rnd = os_malloc(2 * SSL3_RANDOM_SIZE);
3724 if (!rnd) {
3725 os_free(tmp_out);
3726 return -1;
3727 }
3728
3729 SSL_get_client_random(ssl, client_random, sizeof(client_random));
3730 SSL_get_server_random(ssl, server_random, sizeof(server_random));
3731 master_key_len = SSL_SESSION_get_master_key(sess, master_key,
3732 sizeof(master_key));
3733
73581707
DB		 3734 os_memcpy(rnd, server_random, SSL3_RANDOM_SIZE);
3735 os_memcpy(rnd + SSL3_RANDOM_SIZE, client_random, SSL3_RANDOM_SIZE);
3de28506 3736
16bc3b89
JM		 3737 if (os_strcmp(ver, "TLSv1.2") == 0) {
3738 tls_prf_sha256(master_key, master_key_len,
73581707 3739 "key expansion", rnd, 2 * SSL3_RANDOM_SIZE,
16bc3b89 3740 _out, skip + out_len);
3de28506 3741 ret = 0;
16bc3b89 3742 } else if (tls_prf_sha1_md5(master_key, master_key_len,
73581707 3743 "key expansion", rnd, 2 * SSL3_RANDOM_SIZE,
16bc3b89
JM		 3744 _out, skip + out_len) == 0) {
3745 ret = 0;
3746 }
3de28506
JM		 3747 os_memset(master_key, 0, sizeof(master_key));
3748 os_free(rnd);
73581707 3749 if (ret == 0)
3de28506
JM		 3750 os_memcpy(out, _out + skip, out_len);
3751 bin_clear_free(tmp_out, skip);
3752
3753 return ret;
1cece2fa
DB		 3754#else /* OPENSSL_NEED_EAP_FAST_PRF */
3755 wpa_printf(MSG_ERROR,
3756 "OpenSSL: EAP-FAST keys cannot be exported in FIPS mode");
3757 return -1;
3758#endif /* OPENSSL_NEED_EAP_FAST_PRF */
fa0e7151
JM		 3759}
3760
3761
81c85c06 3762static struct wpabuf *
53b34578 3763openssl_handshake(struct tls_connection *conn, const struct wpabuf *in_data)
6fc6879b
JM		 3764{
3765 int res;
81c85c06 3766 struct wpabuf *out_data;
6fc6879b
JM		 3767
3768 /*
3769 * Give TLS handshake data from the server (if available) to OpenSSL
3770 * for processing.
3771 */
e9690eb7 3772 if (in_data && wpabuf_len(in_data) > 0 &&
81c85c06
JM		 3773 BIO_write(conn->ssl_in, wpabuf_head(in_data), wpabuf_len(in_data))
3774 < 0) {
6fc6879b
JM		 3775 tls_show_errors(MSG_INFO, __func__,
3776 "Handshake failed - BIO_write");
3777 return NULL;
3778 }
3779
3780 /* Initiate TLS handshake or continue the existing handshake */
53b34578 3781 if (conn->server)
81c85c06
JM		 3782 res = SSL_accept(conn->ssl);
3783 else
3784 res = SSL_connect(conn->ssl);
6fc6879b
JM		 3785 if (res != 1) {
3786 int err = SSL_get_error(conn->ssl, res);
3787 if (err == SSL_ERROR_WANT_READ)
3788 wpa_printf(MSG_DEBUG, "SSL: SSL_connect - want "
3789 "more data");
3790 else if (err == SSL_ERROR_WANT_WRITE)
3791 wpa_printf(MSG_DEBUG, "SSL: SSL_connect - want to "
3792 "write");
3793 else {
3794 tls_show_errors(MSG_INFO, __func__, "SSL_connect");
3795 conn->failed++;
53b34578 3796 if (!conn->server && !conn->client_hello_generated) {
4a576c47
JM		 3797 /* The server would not understand TLS Alert
3798 * before ClientHello, so simply terminate
3799 * handshake on this type of error case caused
3800 * by a likely internal error like no ciphers
3801 * available. */
3802 wpa_printf(MSG_DEBUG,
3803 "OpenSSL: Could not generate ClientHello");
3804 conn->write_alerts++;
3805 return NULL;
3806 }
6fc6879b
JM		 3807 }
3808 }
3809
53b34578 3810 if (!conn->server && !conn->failed)
4a576c47
JM		 3811 conn->client_hello_generated = 1;
3812
1c9663cf 3813#ifdef CONFIG_SUITEB
53b34578 3814 if ((conn->flags & TLS_CONN_SUITEB) && !conn->server &&
1c9663cf
JM		 3815 os_strncmp(SSL_get_cipher(conn->ssl), "DHE-", 4) == 0 &&
3816 conn->server_dh_prime_len < 3072) {
3817 struct tls_context *context = conn->context;
3818
3819 /*
3820 * This should not be reached since earlier cert_cb should have
3821 * terminated the handshake. Keep this check here for extra
3822 * protection if anything goes wrong with the more low-level
3823 * checks based on having to parse the TLS handshake messages.
3824 */
3825 wpa_printf(MSG_DEBUG,
3826 "OpenSSL: Server DH prime length: %d bits",
3827 conn->server_dh_prime_len);
3828
3829 if (context->event_cb) {
3830 union tls_event_data ev;
3831
3832 os_memset(&ev, 0, sizeof(ev));
3833 ev.alert.is_local = 1;
3834 ev.alert.type = "fatal";
3835 ev.alert.description = "insufficient security";
3836 context->event_cb(context->cb_ctx, TLS_ALERT, &ev);
3837 }
3838 /*
3839 * Could send a TLS Alert to the server, but for now, simply
3840 * terminate handshake.
3841 */
3842 conn->failed++;
3843 conn->write_alerts++;
3844 return NULL;
3845 }
3846#endif /* CONFIG_SUITEB */
3847
6fc6879b
JM		 3848 /* Get the TLS handshake data to be sent to the server */
3849 res = BIO_ctrl_pending(conn->ssl_out);
3850 wpa_printf(MSG_DEBUG, "SSL: %d bytes pending from ssl_out", res);
81c85c06 3851 out_data = wpabuf_alloc(res);
6fc6879b
JM		 3852 if (out_data == NULL) {
3853 wpa_printf(MSG_DEBUG, "SSL: Failed to allocate memory for "
3854 "handshake output (%d bytes)", res);
3855 if (BIO_reset(conn->ssl_out) < 0) {
3856 tls_show_errors(MSG_INFO, __func__,
3857 "BIO_reset failed");
3858 }
6fc6879b
JM		 3859 return NULL;
3860 }
81c85c06
JM		 3861 res = res == 0 ? 0 : BIO_read(conn->ssl_out, wpabuf_mhead(out_data),
3862 res);
6fc6879b
JM		 3863 if (res < 0) {
3864 tls_show_errors(MSG_INFO, __func__,
3865 "Handshake failed - BIO_read");
3866 if (BIO_reset(conn->ssl_out) < 0) {
3867 tls_show_errors(MSG_INFO, __func__,
3868 "BIO_reset failed");
3869 }
81c85c06 3870 wpabuf_free(out_data);
6fc6879b
JM		 3871 return NULL;
3872 }
81c85c06 3873 wpabuf_put(out_data, res);
6fc6879b
JM		 3874
3875 return out_data;
3876}
3877
3878
81c85c06
JM		 3879static struct wpabuf *
3880openssl_get_appl_data(struct tls_connection *conn, size_t max_len)
6fc6879b 3881{
81c85c06 3882 struct wpabuf *appl_data;
6fc6879b 3883 int res;
6fc6879b 3884
81c85c06
JM		 3885 appl_data = wpabuf_alloc(max_len + 100);
3886 if (appl_data == NULL)
6fc6879b 3887 return NULL;
6fc6879b 3888
81c85c06
JM		 3889 res = SSL_read(conn->ssl, wpabuf_mhead(appl_data),
3890 wpabuf_size(appl_data));
3891 if (res < 0) {
bf206cad 3892 int err = SSL_get_error(conn->ssl, res);
81c85c06
JM		 3893 if (err == SSL_ERROR_WANT_READ ||
3894 err == SSL_ERROR_WANT_WRITE) {
3895 wpa_printf(MSG_DEBUG, "SSL: No Application Data "
3896 "included");
3897 } else {
6fc6879b 3898 tls_show_errors(MSG_INFO, __func__,
81c85c06
JM		 3899 "Failed to read possible "
3900 "Application Data");
6fc6879b 3901 }
81c85c06 3902 wpabuf_free(appl_data);
6fc6879b
JM		 3903 return NULL;
3904 }
81c85c06
JM		 3905
3906 wpabuf_put(appl_data, res);
3907 wpa_hexdump_buf_key(MSG_MSGDUMP, "SSL: Application Data in Finished "
3908 "message", appl_data);
3909
3910 return appl_data;
3911}
3912
3913
3914static struct wpabuf *
3915openssl_connection_handshake(struct tls_connection *conn,
3916 const struct wpabuf *in_data,
53b34578 3917 struct wpabuf **appl_data)
81c85c06
JM		 3918{
3919 struct wpabuf *out_data;
3920
3921 if (appl_data)
3922 *appl_data = NULL;
3923
53b34578 3924 out_data = openssl_handshake(conn, in_data);
81c85c06 3925 if (out_data == NULL)
6fc6879b 3926 return NULL;
bb52293e
JM		 3927 if (conn->invalid_hb_used) {
3928 wpa_printf(MSG_INFO, "TLS: Heartbeat attack detected - do not send response");
3929 wpabuf_free(out_data);
3930 return NULL;
3931 }
81c85c06 3932
a89beee5
JM		 3933 if (SSL_is_init_finished(conn->ssl)) {
3934 wpa_printf(MSG_DEBUG,
3935 "OpenSSL: Handshake finished - resumed=%d",
3936 tls_connection_resumed(conn->ssl_ctx, conn));
3937 if (appl_data && in_data)
3938 *appl_data = openssl_get_appl_data(conn,
3939 wpabuf_len(in_data));
3940 }
81c85c06 3941
bb52293e
JM		 3942 if (conn->invalid_hb_used) {
3943 wpa_printf(MSG_INFO, "TLS: Heartbeat attack detected - do not send response");
3944 if (appl_data) {
3945 wpabuf_free(*appl_data);
3946 *appl_data = NULL;
3947 }
3948 wpabuf_free(out_data);
3949 return NULL;
3950 }
3951
6fc6879b
JM		 3952 return out_data;
3953}
3954
3955
81c85c06
JM		 3956struct wpabuf *
3957tls_connection_handshake(void *ssl_ctx, struct tls_connection *conn,
3958 const struct wpabuf *in_data,
3959 struct wpabuf **appl_data)
3960{
53b34578 3961 return openssl_connection_handshake(conn, in_data, appl_data);
81c85c06
JM		 3962}
3963
3964
3965struct wpabuf * tls_connection_server_handshake(void *tls_ctx,
3966 struct tls_connection *conn,
3967 const struct wpabuf *in_data,
3968 struct wpabuf **appl_data)
3969{
53b34578
JM		 3970 conn->server = 1;
3971 return openssl_connection_handshake(conn, in_data, appl_data);
81c85c06
JM		 3972}
3973
3974
3975struct wpabuf * tls_connection_encrypt(void *tls_ctx,
3976 struct tls_connection *conn,
3977 const struct wpabuf *in_data)
6fc6879b
JM		 3978{
3979 int res;
81c85c06 3980 struct wpabuf *buf;
6fc6879b
JM		 3981
3982 if (conn == NULL)
81c85c06 3983 return NULL;
6fc6879b
JM		 3984
3985 /* Give plaintext data for OpenSSL to encrypt into the TLS tunnel. */
3986 if ((res = BIO_reset(conn->ssl_in)) < 0 ||
3987 (res = BIO_reset(conn->ssl_out)) < 0) {
3988 tls_show_errors(MSG_INFO, __func__, "BIO_reset failed");
81c85c06 3989 return NULL;
6fc6879b 3990 }
81c85c06 3991 res = SSL_write(conn->ssl, wpabuf_head(in_data), wpabuf_len(in_data));
6fc6879b
JM		 3992 if (res < 0) {
3993 tls_show_errors(MSG_INFO, __func__,
3994 "Encryption failed - SSL_write");
81c85c06 3995 return NULL;
6fc6879b
JM		 3996 }
3997
3998 /* Read encrypted data to be sent to the server */
81c85c06
JM		 3999 buf = wpabuf_alloc(wpabuf_len(in_data) + 300);
4000 if (buf == NULL)
4001 return NULL;
4002 res = BIO_read(conn->ssl_out, wpabuf_mhead(buf), wpabuf_size(buf));
6fc6879b
JM		 4003 if (res < 0) {
4004 tls_show_errors(MSG_INFO, __func__,
4005 "Encryption failed - BIO_read");
81c85c06
JM		 4006 wpabuf_free(buf);
4007 return NULL;
6fc6879b 4008 }
81c85c06 4009 wpabuf_put(buf, res);
6fc6879b 4010
81c85c06 4011 return buf;
6fc6879b
JM		 4012}
4013
4014
81c85c06
JM		 4015struct wpabuf * tls_connection_decrypt(void *tls_ctx,
4016 struct tls_connection *conn,
4017 const struct wpabuf *in_data)
6fc6879b
JM		 4018{
4019 int res;
81c85c06 4020 struct wpabuf *buf;
6fc6879b
JM		 4021
4022 /* Give encrypted data from TLS tunnel for OpenSSL to decrypt. */
81c85c06
JM		 4023 res = BIO_write(conn->ssl_in, wpabuf_head(in_data),
4024 wpabuf_len(in_data));
6fc6879b
JM		 4025 if (res < 0) {
4026 tls_show_errors(MSG_INFO, __func__,
4027 "Decryption failed - BIO_write");
81c85c06 4028 return NULL;
6fc6879b
JM		 4029 }
4030 if (BIO_reset(conn->ssl_out) < 0) {
4031 tls_show_errors(MSG_INFO, __func__, "BIO_reset failed");
81c85c06 4032 return NULL;
6fc6879b
JM		 4033 }
4034
4035 /* Read decrypted data for further processing */
81c85c06
JM		 4036 /*
4037 * Even though we try to disable TLS compression, it is possible that
4038 * this cannot be done with all TLS libraries. Add extra buffer space
4039 * to handle the possibility of the decrypted data being longer than
4040 * input data.
4041 */
4042 buf = wpabuf_alloc((wpabuf_len(in_data) + 500) * 3);
4043 if (buf == NULL)
4044 return NULL;
4045 res = SSL_read(conn->ssl, wpabuf_mhead(buf), wpabuf_size(buf));
6fc6879b
JM		 4046 if (res < 0) {
4047 tls_show_errors(MSG_INFO, __func__,
4048 "Decryption failed - SSL_read");
a86a7316 4049 wpabuf_free(buf);
81c85c06 4050 return NULL;
6fc6879b 4051 }
81c85c06 4052 wpabuf_put(buf, res);
6fc6879b 4053
bb52293e
JM		 4054 if (conn->invalid_hb_used) {
4055 wpa_printf(MSG_INFO, "TLS: Heartbeat attack detected - do not send response");
4056 wpabuf_free(buf);
4057 return NULL;
4058 }
4059
81c85c06 4060 return buf;
6fc6879b
JM		 4061}
4062
4063
4064int tls_connection_resumed(void *ssl_ctx, struct tls_connection *conn)
4065{
373c7969 4066 return conn ? SSL_session_reused(conn->ssl) : 0;
6fc6879b
JM		 4067}
4068
4069
4070int tls_connection_set_cipher_list(void *tls_ctx, struct tls_connection *conn,
4071 u8 *ciphers)
4072{
750f5d99 4073 char buf[500], *pos, *end;
6fc6879b
JM		 4074 u8 *c;
4075 int ret;
4076
4077 if (conn == NULL || conn->ssl == NULL || ciphers == NULL)
4078 return -1;
4079
4080 buf[0] = '\0';
4081 pos = buf;
4082 end = pos + sizeof(buf);
4083
4084 c = ciphers;
4085 while (*c != TLS_CIPHER_NONE) {
4086 const char *suite;
4087
4088 switch (*c) {
4089 case TLS_CIPHER_RC4_SHA:
4090 suite = "RC4-SHA";
4091 break;
4092 case TLS_CIPHER_AES128_SHA:
4093 suite = "AES128-SHA";
4094 break;
4095 case TLS_CIPHER_RSA_DHE_AES128_SHA:
4096 suite = "DHE-RSA-AES128-SHA";
4097 break;
4098 case TLS_CIPHER_ANON_DH_AES128_SHA:
4099 suite = "ADH-AES128-SHA";
4100 break;
750f5d99
JM		 4101 case TLS_CIPHER_RSA_DHE_AES256_SHA:
4102 suite = "DHE-RSA-AES256-SHA";
4103 break;
4104 case TLS_CIPHER_AES256_SHA:
4105 suite = "AES256-SHA";
4106 break;
6fc6879b
JM		 4107 default:
4108 wpa_printf(MSG_DEBUG, "TLS: Unsupported "
4109 "cipher selection: %d", *c);
4110 return -1;
4111 }
4112 ret = os_snprintf(pos, end - pos, ":%s", suite);
d85e1fc8 4113 if (os_snprintf_error(end - pos, ret))
6fc6879b
JM		 4114 break;
4115 pos += ret;
4116
4117 c++;
4118 }
4119
4120 wpa_printf(MSG_DEBUG, "OpenSSL: cipher suites: %s", buf + 1);
4121
36e82060 4122#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
c34cd668
JM		 4123#if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
4124 if (os_strstr(buf, ":ADH-")) {
4125 /*
4126 * Need to drop to security level 0 to allow anonymous
4127 * cipher suites for EAP-FAST.
4128 */
4129 SSL_set_security_level(conn->ssl, 0);
4130 } else if (SSL_get_security_level(conn->ssl) == 0) {
4131 /* Force at least security level 1 */
4132 SSL_set_security_level(conn->ssl, 1);
4133 }
4134#endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */
4135#endif
4136
6fc6879b
JM		 4137 if (SSL_set_cipher_list(conn->ssl, buf + 1) != 1) {
4138 tls_show_errors(MSG_INFO, __func__,
4139 "Cipher suite configuration failed");
4140 return -1;
4141 }
4142
4143 return 0;
4144}
4145
4146
fe1bf329
JM		 4147int tls_get_version(void *ssl_ctx, struct tls_connection *conn,
4148 char *buf, size_t buflen)
4149{
4150 const char *name;
4151 if (conn == NULL || conn->ssl == NULL)
4152 return -1;
4153
4154 name = SSL_get_version(conn->ssl);
4155 if (name == NULL)
4156 return -1;
4157
4158 os_strlcpy(buf, name, buflen);
4159 return 0;
4160}
4161
4162
6fc6879b
JM		 4163int tls_get_cipher(void *ssl_ctx, struct tls_connection *conn,
4164 char *buf, size_t buflen)
4165{
4166 const char *name;
4167 if (conn == NULL || conn->ssl == NULL)
4168 return -1;
4169
4170 name = SSL_get_cipher(conn->ssl);
4171 if (name == NULL)
4172 return -1;
4173
4174 os_strlcpy(buf, name, buflen);
4175 return 0;
4176}
4177
4178
4179int tls_connection_enable_workaround(void *ssl_ctx,
4180 struct tls_connection *conn)
4181{
4182 SSL_set_options(conn->ssl, SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS);
4183
4184 return 0;
4185}
4186
4187
1e5839e0 4188#if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
6fc6879b
JM		 4189/* ClientHello TLS extensions require a patch to openssl, so this function is
4190 * commented out unless explicitly needed for EAP-FAST in order to be able to
4191 * build this file with unmodified openssl. */
4192int tls_connection_client_hello_ext(void *ssl_ctx, struct tls_connection *conn,
4193 int ext_type, const u8 *data,
4194 size_t data_len)
4195{
0cf03892 4196 if (conn == NULL || conn->ssl == NULL || ext_type != 35)
6fc6879b
JM		 4197 return -1;
4198
0cf03892
JM		 4199 if (SSL_set_session_ticket_ext(conn->ssl, (void *) data,
4200 data_len) != 1)
4201 return -1;
6fc6879b
JM		 4202
4203 return 0;
4204}
1e5839e0 4205#endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */
6fc6879b
JM		 4206
4207
4208int tls_connection_get_failed(void *ssl_ctx, struct tls_connection *conn)
4209{
4210 if (conn == NULL)
4211 return -1;
4212 return conn->failed;
4213}
4214
4215
4216int tls_connection_get_read_alerts(void *ssl_ctx, struct tls_connection *conn)
4217{
4218 if (conn == NULL)
4219 return -1;
4220 return conn->read_alerts;
4221}
4222
4223
4224int tls_connection_get_write_alerts(void *ssl_ctx, struct tls_connection *conn)
4225{
4226 if (conn == NULL)
4227 return -1;
4228 return conn->write_alerts;
4229}
4230
4231
080585c0
JM		 4232#ifdef HAVE_OCSP
4233
4234static void ocsp_debug_print_resp(OCSP_RESPONSE *rsp)
4235{
4236#ifndef CONFIG_NO_STDOUT_DEBUG
080585c0
JM		 4237 BIO *out;
4238 size_t rlen;
4239 char *txt;
4240 int res;
4241
4242 if (wpa_debug_level > MSG_DEBUG)
4243 return;
4244
4245 out = BIO_new(BIO_s_mem());
4246 if (!out)
4247 return;
4248
4249 OCSP_RESPONSE_print(out, rsp, 0);
4250 rlen = BIO_ctrl_pending(out);
4251 txt = os_malloc(rlen + 1);
4252 if (!txt) {
4253 BIO_free(out);
4254 return;
4255 }
4256
4257 res = BIO_read(out, txt, rlen);
4258 if (res > 0) {
4259 txt[res] = '\0';
4260 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP Response\n%s", txt);
4261 }
4262 os_free(txt);
4263 BIO_free(out);
4264#endif /* CONFIG_NO_STDOUT_DEBUG */
4265}
4266
4267
4eb3b76b
JM		 4268static void debug_print_cert(X509 *cert, const char *title)
4269{
4270#ifndef CONFIG_NO_STDOUT_DEBUG
4271 BIO *out;
4272 size_t rlen;
4273 char *txt;
4274 int res;
4275
4276 if (wpa_debug_level > MSG_DEBUG)
4277 return;
4278
4279 out = BIO_new(BIO_s_mem());
4280 if (!out)
4281 return;
4282
4283 X509_print(out, cert);
4284 rlen = BIO_ctrl_pending(out);
4285 txt = os_malloc(rlen + 1);
4286 if (!txt) {
4287 BIO_free(out);
4288 return;
4289 }
4290
4291 res = BIO_read(out, txt, rlen);
4292 if (res > 0) {
4293 txt[res] = '\0';
4294 wpa_printf(MSG_DEBUG, "OpenSSL: %s\n%s", title, txt);
4295 }
4296 os_free(txt);
4297
4298 BIO_free(out);
4299#endif /* CONFIG_NO_STDOUT_DEBUG */
4300}
4301
4302
080585c0
JM		 4303static int ocsp_resp_cb(SSL *s, void *arg)
4304{
4305 struct tls_connection *conn = arg;
4306 const unsigned char *p;
85cff4b0 4307 int len, status, reason, res;
080585c0
JM		 4308 OCSP_RESPONSE *rsp;
4309 OCSP_BASICRESP *basic;
4310 OCSP_CERTID *id;
4311 ASN1_GENERALIZEDTIME *produced_at, *this_update, *next_update;
6bf61fb2
JM		 4312 X509_STORE *store;
4313 STACK_OF(X509) *certs = NULL;
080585c0
JM		 4314
4315 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
4316 if (!p) {
4317 wpa_printf(MSG_DEBUG, "OpenSSL: No OCSP response received");
4318 return (conn->flags & TLS_CONN_REQUIRE_OCSP) ? 0 : 1;
4319 }
4320
4321 wpa_hexdump(MSG_DEBUG, "OpenSSL: OCSP response", p, len);
4322
4323 rsp = d2i_OCSP_RESPONSE(NULL, &p, len);
4324 if (!rsp) {
4325 wpa_printf(MSG_INFO, "OpenSSL: Failed to parse OCSP response");
4326 return 0;
4327 }
4328
4329 ocsp_debug_print_resp(rsp);
4330
4331 status = OCSP_response_status(rsp);
4332 if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL) {
4333 wpa_printf(MSG_INFO, "OpenSSL: OCSP responder error %d (%s)",
4334 status, OCSP_response_status_str(status));
4335 return 0;
4336 }
4337
4338 basic = OCSP_response_get1_basic(rsp);
4339 if (!basic) {
4340 wpa_printf(MSG_INFO, "OpenSSL: Could not find BasicOCSPResponse");
4341 return 0;
4342 }
4343
68ae4773 4344 store = SSL_CTX_get_cert_store(conn->ssl_ctx);
6bf61fb2 4345 if (conn->peer_issuer) {
4eb3b76b 4346 debug_print_cert(conn->peer_issuer, "Add OCSP issuer");
6bf61fb2
JM		 4347
4348 if (X509_STORE_add_cert(store, conn->peer_issuer) != 1) {
4349 tls_show_errors(MSG_INFO, __func__,
58d405fc 4350 "OpenSSL: Could not add issuer to certificate store");
6bf61fb2
JM		 4351 }
4352 certs = sk_X509_new_null();
4353 if (certs) {
4354 X509 *cert;
4355 cert = X509_dup(conn->peer_issuer);
4356 if (cert && !sk_X509_push(certs, cert)) {
4357 tls_show_errors(
4358 MSG_INFO, __func__,
58d405fc 4359 "OpenSSL: Could not add issuer to OCSP responder trust store");
6bf61fb2
JM		 4360 X509_free(cert);
4361 sk_X509_free(certs);
4362 certs = NULL;
4363 }
710dfb4e 4364 if (certs && conn->peer_issuer_issuer) {
6bf61fb2
JM		 4365 cert = X509_dup(conn->peer_issuer_issuer);
4366 if (cert && !sk_X509_push(certs, cert)) {
4367 tls_show_errors(
4368 MSG_INFO, __func__,
58d405fc 4369 "OpenSSL: Could not add issuer's issuer to OCSP responder trust store");
6bf61fb2
JM		 4370 X509_free(cert);
4371 }
4372 }
4373 }
4374 }
4375
4376 status = OCSP_basic_verify(basic, certs, store, OCSP_TRUSTOTHER);
4377 sk_X509_pop_free(certs, X509_free);
080585c0
JM		 4378 if (status <= 0) {
4379 tls_show_errors(MSG_INFO, __func__,
4380 "OpenSSL: OCSP response failed verification");
4381 OCSP_BASICRESP_free(basic);
4382 OCSP_RESPONSE_free(rsp);
4383 return 0;
4384 }
4385
4386 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP response verification succeeded");
4387
762c92a4
JM		 4388 if (!conn->peer_cert) {
4389 wpa_printf(MSG_DEBUG, "OpenSSL: Peer certificate not available for OCSP status check");
4390 OCSP_BASICRESP_free(basic);
4391 OCSP_RESPONSE_free(rsp);
4392 return 0;
4393 }
4394
4395 if (!conn->peer_issuer) {
4396 wpa_printf(MSG_DEBUG, "OpenSSL: Peer issuer certificate not available for OCSP status check");
080585c0
JM		 4397 OCSP_BASICRESP_free(basic);
4398 OCSP_RESPONSE_free(rsp);
4399 return 0;
4400 }
4401
85cff4b0 4402 id = OCSP_cert_to_id(EVP_sha256(), conn->peer_cert, conn->peer_issuer);
080585c0 4403 if (!id) {
85cff4b0
JM		 4404 wpa_printf(MSG_DEBUG,
4405 "OpenSSL: Could not create OCSP certificate identifier (SHA256)");
080585c0
JM		 4406 OCSP_BASICRESP_free(basic);
4407 OCSP_RESPONSE_free(rsp);
4408 return 0;
4409 }
4410
85cff4b0
JM		 4411 res = OCSP_resp_find_status(basic, id, &status, &reason, &produced_at,
4412 &this_update, &next_update);
4413 if (!res) {
4414 id = OCSP_cert_to_id(NULL, conn->peer_cert, conn->peer_issuer);
4415 if (!id) {
4416 wpa_printf(MSG_DEBUG,
4417 "OpenSSL: Could not create OCSP certificate identifier (SHA1)");
4418 OCSP_BASICRESP_free(basic);
4419 OCSP_RESPONSE_free(rsp);
4420 return 0;
4421 }
4422
4423 res = OCSP_resp_find_status(basic, id, &status, &reason,
4424 &produced_at, &this_update,
4425 &next_update);
4426 }
4427
4428 if (!res) {
080585c0
JM		 4429 wpa_printf(MSG_INFO, "OpenSSL: Could not find current server certificate from OCSP response%s",
4430 (conn->flags & TLS_CONN_REQUIRE_OCSP) ? "" :
4431 " (OCSP not required)");
d9a0f697 4432 OCSP_CERTID_free(id);
080585c0
JM		 4433 OCSP_BASICRESP_free(basic);
4434 OCSP_RESPONSE_free(rsp);
4435 return (conn->flags & TLS_CONN_REQUIRE_OCSP) ? 0 : 1;
4436 }
d9a0f697 4437 OCSP_CERTID_free(id);
080585c0
JM		 4438
4439 if (!OCSP_check_validity(this_update, next_update, 5 * 60, -1)) {
4440 tls_show_errors(MSG_INFO, __func__,
4441 "OpenSSL: OCSP status times invalid");
4442 OCSP_BASICRESP_free(basic);
4443 OCSP_RESPONSE_free(rsp);
4444 return 0;
4445 }
4446
4447 OCSP_BASICRESP_free(basic);
4448 OCSP_RESPONSE_free(rsp);
4449
4450 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status for server certificate: %s",
4451 OCSP_cert_status_str(status));
4452
4453 if (status == V_OCSP_CERTSTATUS_GOOD)
4454 return 1;
4455 if (status == V_OCSP_CERTSTATUS_REVOKED)
4456 return 0;
4457 if (conn->flags & TLS_CONN_REQUIRE_OCSP) {
4458 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status unknown, but OCSP required");
4459 return 0;
4460 }
be7963b3 4461 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status unknown, but OCSP was not required, so allow connection to continue");
080585c0
JM		 4462 return 1;
4463}
4464
4465
4466static int ocsp_status_cb(SSL *s, void *arg)
4467{
4468 char *tmp;
4469 char *resp;
4470 size_t len;
4471
4472 if (tls_global->ocsp_stapling_response == NULL) {
4473 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status callback - no response configured");
4474 return SSL_TLSEXT_ERR_OK;
4475 }
4476
4477 resp = os_readfile(tls_global->ocsp_stapling_response, &len);
4478 if (resp == NULL) {
4479 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status callback - could not read response file");
4480 /* TODO: Build OCSPResponse with responseStatus = internalError
4481 */
4482 return SSL_TLSEXT_ERR_OK;
4483 }
4484 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status callback - send cached response");
4485 tmp = OPENSSL_malloc(len);
4486 if (tmp == NULL) {
4487 os_free(resp);
4488 return SSL_TLSEXT_ERR_ALERT_FATAL;
4489 }
4490
4491 os_memcpy(tmp, resp, len);
4492 os_free(resp);
4493 SSL_set_tlsext_status_ocsp_resp(s, tmp, len);
4494
4495 return SSL_TLSEXT_ERR_OK;
4496}
4497
4498#endif /* HAVE_OCSP */
4499
4500
6fc6879b
JM		 4501int tls_connection_set_params(void *tls_ctx, struct tls_connection *conn,
4502 const struct tls_connection_params *params)
4503{
bd9b8b2b 4504 struct tls_data *data = tls_ctx;
6fc6879b
JM		 4505 int ret;
4506 unsigned long err;
96955192 4507 int can_pkcs11 = 0;
01b0d1d5
DW		 4508 const char *key_id = params->key_id;
4509 const char *cert_id = params->cert_id;
4510 const char *ca_cert_id = params->ca_cert_id;
96955192 4511 const char *engine_id = params->engine ? params->engine_id : NULL;
7a47f34b 4512 const char *ciphers;
6fc6879b
JM		 4513
4514 if (conn == NULL)
4515 return -1;
4516
d6b536f7
JM		 4517 if (params->flags & TLS_CONN_REQUIRE_OCSP_ALL) {
4518 wpa_printf(MSG_INFO,
4519 "OpenSSL: ocsp=3 not supported");
4520 return -1;
4521 }
4522
01b0d1d5 4523 /*
96955192
DW		 4524 * If the engine isn't explicitly configured, and any of the
4525 * cert/key fields are actually PKCS#11 URIs, then automatically
4526 * use the PKCS#11 ENGINE.
01b0d1d5 4527 */
96955192
DW		 4528 if (!engine_id || os_strcmp(engine_id, "pkcs11") == 0)
4529 can_pkcs11 = 1;
4530
4531 if (!key_id && params->private_key && can_pkcs11 &&
4532 os_strncmp(params->private_key, "pkcs11:", 7) == 0) {
4533 can_pkcs11 = 2;
01b0d1d5 4534 key_id = params->private_key;
96955192 4535 }
01b0d1d5 4536
96955192
DW		 4537 if (!cert_id && params->client_cert && can_pkcs11 &&
4538 os_strncmp(params->client_cert, "pkcs11:", 7) == 0) {
4539 can_pkcs11 = 2;
01b0d1d5 4540 cert_id = params->client_cert;
96955192 4541 }
01b0d1d5 4542
96955192
DW		 4543 if (!ca_cert_id && params->ca_cert && can_pkcs11 &&
4544 os_strncmp(params->ca_cert, "pkcs11:", 7) == 0) {
4545 can_pkcs11 = 2;
01b0d1d5 4546 ca_cert_id = params->ca_cert;
96955192
DW		 4547 }
4548
4549 /* If we need to automatically enable the PKCS#11 ENGINE, do so. */
4550 if (can_pkcs11 == 2 && !engine_id)
4551 engine_id = "pkcs11";
01b0d1d5 4552
0f56057c 4553#if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
b70d508c 4554#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
6a31a31d
JM		 4555 if (params->flags & TLS_CONN_EAP_FAST) {
4556 wpa_printf(MSG_DEBUG,
4557 "OpenSSL: Use TLSv1_method() for EAP-FAST");
4558 if (SSL_set_ssl_method(conn->ssl, TLSv1_method()) != 1) {
4559 tls_show_errors(MSG_INFO, __func__,
4560 "Failed to set TLSv1_method() for EAP-FAST");
4561 return -1;
4562 }
4563 }
06836013 4564#endif
b2e4074c 4565#if OPENSSL_VERSION_NUMBER >= 0x10101000L
dee566d9 4566#ifdef SSL_OP_NO_TLSv1_3
b2e4074c
JM		 4567 if (params->flags & TLS_CONN_EAP_FAST) {
4568 /* Need to disable TLS v1.3 at least for now since OpenSSL 1.1.1
4569 * refuses to start the handshake with the modified ciphersuite
4570 * list (no TLS v1.3 ciphersuites included) for EAP-FAST. */
4571 wpa_printf(MSG_DEBUG, "OpenSSL: Disable TLSv1.3 for EAP-FAST");
4572 SSL_set_options(conn->ssl, SSL_OP_NO_TLSv1_3);
4573 }
dee566d9 4574#endif /* SSL_OP_NO_TLSv1_3 */
b2e4074c 4575#endif
0f56057c 4576#endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */
d4913c58 4577
6fc6879b
JM		 4578 while ((err = ERR_get_error())) {
4579 wpa_printf(MSG_INFO, "%s: Clearing pending SSL error: %s",
4580 __func__, ERR_error_string(err, NULL));
4581 }
4582
96955192 4583 if (engine_id) {
e59c91af 4584 wpa_printf(MSG_DEBUG, "SSL: Initializing TLS engine");
96955192 4585 ret = tls_engine_init(conn, engine_id, params->pin,
01b0d1d5 4586 key_id, cert_id, ca_cert_id);
e59c91af
DS		 4587 if (ret)
4588 return ret;
4589 }
6fc6879b
JM		 4590 if (tls_connection_set_subject_match(conn,
4591 params->subject_match,
01f809c7 4592 params->altsubject_match,
cebee30f
JM		 4593 params->suffix_match,
4594 params->domain_match))
6fc6879b 4595 return -1;
e59c91af 4596
96955192 4597 if (engine_id && ca_cert_id) {
bd9b8b2b 4598 if (tls_connection_engine_ca_cert(data, conn, ca_cert_id))
e59c91af 4599 return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED;
bd9b8b2b 4600 } else if (tls_connection_ca_cert(data, conn, params->ca_cert,
e59c91af
DS		 4601 params->ca_cert_blob,
4602 params->ca_cert_blob_len,
4603 params->ca_path))
6fc6879b 4604 return -1;
e59c91af 4605
96955192 4606 if (engine_id && cert_id) {
01b0d1d5 4607 if (tls_connection_engine_client_cert(conn, cert_id))
e59c91af
DS		 4608 return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED;
4609 } else if (tls_connection_client_cert(conn, params->client_cert,
4610 params->client_cert_blob,
4611 params->client_cert_blob_len))
6fc6879b
JM		 4612 return -1;
4613
96955192 4614 if (engine_id && key_id) {
e59c91af 4615 wpa_printf(MSG_DEBUG, "TLS: Using private key from engine");
6fc6879b
JM		 4616 if (tls_connection_engine_private_key(conn))
4617 return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED;
bd9b8b2b 4618 } else if (tls_connection_private_key(data, conn,
6fc6879b
JM		 4619 params->private_key,
4620 params->private_key_passwd,
4621 params->private_key_blob,
4622 params->private_key_blob_len)) {
4623 wpa_printf(MSG_INFO, "TLS: Failed to load private key '%s'",
4624 params->private_key);
4625 return -1;
4626 }
4627
4628 if (tls_connection_dh(conn, params->dh_file)) {
4629 wpa_printf(MSG_INFO, "TLS: Failed to load DH file '%s'",
4630 params->dh_file);
4631 return -1;
4632 }
4633
7a47f34b
JM		 4634 ciphers = params->openssl_ciphers;
4635#ifdef CONFIG_SUITEB
4636#ifdef OPENSSL_IS_BORINGSSL
4637 if (ciphers && os_strcmp(ciphers, "SUITEB192") == 0) {
4638 /* BoringSSL removed support for SUITEB192, so need to handle
4639 * this with hardcoded ciphersuite and additional checks for
4640 * other parameters. */
4641 ciphers = "ECDHE-ECDSA-AES256-GCM-SHA384";
4642 }
4643#endif /* OPENSSL_IS_BORINGSSL */
4644#endif /* CONFIG_SUITEB */
4645 if (ciphers && SSL_set_cipher_list(conn->ssl, ciphers) != 1) {
b7328434
JM		 4646 wpa_printf(MSG_INFO,
4647 "OpenSSL: Failed to set cipher string '%s'",
7a47f34b 4648 ciphers);
b7328434
JM		 4649 return -1;
4650 }
4651
0521c6eb
HV		 4652 if (!params->openssl_ecdh_curves) {
4653#ifndef OPENSSL_IS_BORINGSSL
4654#ifndef OPENSSL_NO_EC
4655#if (OPENSSL_VERSION_NUMBER >= 0x10002000L) && \
4656 (OPENSSL_VERSION_NUMBER < 0x10100000L)
4657 if (SSL_set_ecdh_auto(conn->ssl, 1) != 1) {
4658 wpa_printf(MSG_INFO,
4659 "OpenSSL: Failed to set ECDH curves to auto");
4660 return -1;
4661 }
4662#endif /* >= 1.0.2 && < 1.1.0 */
4663#endif /* OPENSSL_NO_EC */
4664#endif /* OPENSSL_IS_BORINGSSL */
4665 } else if (params->openssl_ecdh_curves[0]) {
4666#if defined(OPENSSL_IS_BORINGSSL) || (OPENSSL_VERSION_NUMBER < 0x10002000L)
4667 wpa_printf(MSG_INFO,
4668 "OpenSSL: ECDH configuration nnot supported");
4669 return -1;
4670#else /* OPENSSL_IS_BORINGSSL || < 1.0.2 */
4671#ifndef OPENSSL_NO_EC
4672 if (SSL_set1_curves_list(conn->ssl,
4673 params->openssl_ecdh_curves) != 1) {
4674 wpa_printf(MSG_INFO,
4675 "OpenSSL: Failed to set ECDH curves '%s'",
4676 params->openssl_ecdh_curves);
4677 return -1;
4678 }
4679#else /* OPENSSL_NO_EC */
4680 wpa_printf(MSG_INFO, "OpenSSL: ECDH not supported");
4681 return -1;
4682#endif /* OPENSSL_NO_EC */
4683#endif /* OPENSSL_IS_BORINGSSL */
4684 }
4685
a2c442be
JM		 4686 if (tls_set_conn_flags(conn, params->flags,
4687 params->openssl_ciphers) < 0)
60ed2f24 4688 return -1;
e9a6f183 4689
bdee6ca0
JM		 4690#ifdef OPENSSL_IS_BORINGSSL
4691 if (params->flags & TLS_CONN_REQUEST_OCSP) {
4692 SSL_enable_ocsp_stapling(conn->ssl);
4693 }
4694#else /* OPENSSL_IS_BORINGSSL */
080585c0
JM		 4695#ifdef HAVE_OCSP
4696 if (params->flags & TLS_CONN_REQUEST_OCSP) {
bd9b8b2b 4697 SSL_CTX *ssl_ctx = data->ssl;
080585c0
JM		 4698 SSL_set_tlsext_status_type(conn->ssl, TLSEXT_STATUSTYPE_ocsp);
4699 SSL_CTX_set_tlsext_status_cb(ssl_ctx, ocsp_resp_cb);
4700 SSL_CTX_set_tlsext_status_arg(ssl_ctx, conn);
4701 }
355a5c8e
JM		 4702#else /* HAVE_OCSP */
4703 if (params->flags & TLS_CONN_REQUIRE_OCSP) {
4704 wpa_printf(MSG_INFO,
4705 "OpenSSL: No OCSP support included - reject configuration");
4706 return -1;
4707 }
4708 if (params->flags & TLS_CONN_REQUEST_OCSP) {
4709 wpa_printf(MSG_DEBUG,
4710 "OpenSSL: No OCSP support included - allow optional OCSP case to continue");
4711 }
080585c0 4712#endif /* HAVE_OCSP */
bdee6ca0 4713#endif /* OPENSSL_IS_BORINGSSL */
080585c0 4714
235279e7
JM		 4715 conn->flags = params->flags;
4716
bd9b8b2b 4717 tls_get_errors(data);
6fc6879b
JM		 4718
4719 return 0;
4720}
4721
4722
4723int tls_global_set_params(void *tls_ctx,
4724 const struct tls_connection_params *params)
4725{
bd9b8b2b
JM		 4726 struct tls_data *data = tls_ctx;
4727 SSL_CTX *ssl_ctx = data->ssl;
6fc6879b
JM		 4728 unsigned long err;
4729
4730 while ((err = ERR_get_error())) {
4731 wpa_printf(MSG_INFO, "%s: Clearing pending SSL error: %s",
4732 __func__, ERR_error_string(err, NULL));
4733 }
4734
bd9b8b2b
JM		 4735 if (tls_global_ca_cert(data, params->ca_cert) ||
4736 tls_global_client_cert(data, params->client_cert) ||
4737 tls_global_private_key(data, params->private_key,
f24b9797 4738 params->private_key_passwd) ||
bd9b8b2b 4739 tls_global_dh(data, params->dh_file)) {
f24b9797 4740 wpa_printf(MSG_INFO, "TLS: Failed to set global parameters");
6fc6879b
JM		 4741 return -1;
4742 }
4743
b7328434
JM		 4744 if (params->openssl_ciphers &&
4745 SSL_CTX_set_cipher_list(ssl_ctx, params->openssl_ciphers) != 1) {
4746 wpa_printf(MSG_INFO,
4747 "OpenSSL: Failed to set cipher string '%s'",
4748 params->openssl_ciphers);
4749 return -1;
4750 }
4751
0521c6eb
HV		 4752 if (!params->openssl_ecdh_curves) {
4753#ifndef OPENSSL_IS_BORINGSSL
4754#ifndef OPENSSL_NO_EC
4755#if (OPENSSL_VERSION_NUMBER >= 0x10002000L) && \
4756 (OPENSSL_VERSION_NUMBER < 0x10100000L)
4757 if (SSL_CTX_set_ecdh_auto(ssl_ctx, 1) != 1) {
4758 wpa_printf(MSG_INFO,
4759 "OpenSSL: Failed to set ECDH curves to auto");
4760 return -1;
4761 }
4762#endif /* >= 1.0.2 && < 1.1.0 */
4763#endif /* OPENSSL_NO_EC */
4764#endif /* OPENSSL_IS_BORINGSSL */
4765 } else if (params->openssl_ecdh_curves[0]) {
4766#if defined(OPENSSL_IS_BORINGSSL) || (OPENSSL_VERSION_NUMBER < 0x10002000L)
4767 wpa_printf(MSG_INFO,
4768 "OpenSSL: ECDH configuration nnot supported");
4769 return -1;
4770#else /* OPENSSL_IS_BORINGSSL || < 1.0.2 */
4771#ifndef OPENSSL_NO_EC
4772 if (SSL_CTX_set1_curves_list(ssl_ctx,
4773 params->openssl_ecdh_curves) !=
4774 1) {
4775 wpa_printf(MSG_INFO,
4776 "OpenSSL: Failed to set ECDH curves '%s'",
4777 params->openssl_ecdh_curves);
4778 return -1;
4779 }
4780#else /* OPENSSL_NO_EC */
4781 wpa_printf(MSG_INFO, "OpenSSL: ECDH not supported");
4782 return -1;
4783#endif /* OPENSSL_NO_EC */
4784#endif /* OPENSSL_IS_BORINGSSL */
4785 }
4786
e866f39f
JM		 4787#ifdef SSL_OP_NO_TICKET
4788 if (params->flags & TLS_CONN_DISABLE_SESSION_TICKET)
4789 SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_TICKET);
4790 else
4791 SSL_CTX_clear_options(ssl_ctx, SSL_OP_NO_TICKET);
4792#endif /* SSL_OP_NO_TICKET */
4793
080585c0
JM		 4794#ifdef HAVE_OCSP
4795 SSL_CTX_set_tlsext_status_cb(ssl_ctx, ocsp_status_cb);
4796 SSL_CTX_set_tlsext_status_arg(ssl_ctx, ssl_ctx);
4797 os_free(tls_global->ocsp_stapling_response);
4798 if (params->ocsp_stapling_response)
4799 tls_global->ocsp_stapling_response =
4800 os_strdup(params->ocsp_stapling_response);
4801 else
4802 tls_global->ocsp_stapling_response = NULL;
4803#endif /* HAVE_OCSP */
4804
6fc6879b
JM		 4805 return 0;
4806}
4807
4808
1e5839e0 4809#if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
6fc6879b
JM		 4810/* Pre-shared secred requires a patch to openssl, so this function is
4811 * commented out unless explicitly needed for EAP-FAST in order to be able to
4812 * build this file with unmodified openssl. */
4813
587b0457 4814#if (defined(OPENSSL_IS_BORINGSSL) || OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined(LIBRESSL_VERSION_NUMBER)
a8572960
AL		 4815static int tls_sess_sec_cb(SSL *s, void *secret, int *secret_len,
4816 STACK_OF(SSL_CIPHER) *peer_ciphers,
4817 const SSL_CIPHER **cipher, void *arg)
4818#else /* OPENSSL_IS_BORINGSSL */
6fc6879b
JM		 4819static int tls_sess_sec_cb(SSL *s, void *secret, int *secret_len,
4820 STACK_OF(SSL_CIPHER) *peer_ciphers,
4821 SSL_CIPHER **cipher, void *arg)
a8572960 4822#endif /* OPENSSL_IS_BORINGSSL */
6fc6879b
JM		 4823{
4824 struct tls_connection *conn = arg;
4825 int ret;
4826
ba3658cf
BS		 4827#if OPENSSL_VERSION_NUMBER < 0x10100000L || \
4828 (defined(LIBRESSL_VERSION_NUMBER) && \
4829 LIBRESSL_VERSION_NUMBER < 0x20700000L)
6fc6879b
JM		 4830 if (conn == NULL || conn->session_ticket_cb == NULL)
4831 return 0;
4832
4833 ret = conn->session_ticket_cb(conn->session_ticket_cb_ctx,
4834 conn->session_ticket,
4835 conn->session_ticket_len,
4836 s->s3->client_random,
4837 s->s3->server_random, secret);
4d2a1b4f
JM		 4838#else
4839 unsigned char client_random[SSL3_RANDOM_SIZE];
4840 unsigned char server_random[SSL3_RANDOM_SIZE];
4841
4842 if (conn == NULL || conn->session_ticket_cb == NULL)
4843 return 0;
4844
4845 SSL_get_client_random(s, client_random, sizeof(client_random));
4846 SSL_get_server_random(s, server_random, sizeof(server_random));
4847
4848 ret = conn->session_ticket_cb(conn->session_ticket_cb_ctx,
4849 conn->session_ticket,
4850 conn->session_ticket_len,
4851 client_random,
4852 server_random, secret);
4853#endif
4854
6fc6879b
JM		 4855 os_free(conn->session_ticket);
4856 conn->session_ticket = NULL;
4857
4858 if (ret <= 0)
4859 return 0;
4860
4861 *secret_len = SSL_MAX_MASTER_KEY_LENGTH;
4862 return 1;
4863}
4864
4865
0cf03892
JM		 4866static int tls_session_ticket_ext_cb(SSL *s, const unsigned char *data,
4867 int len, void *arg)
4868{
4869 struct tls_connection *conn = arg;
4870
4871 if (conn == NULL || conn->session_ticket_cb == NULL)
4872 return 0;
4873
4874 wpa_printf(MSG_DEBUG, "OpenSSL: %s: length=%d", __func__, len);
4875
4876 os_free(conn->session_ticket);
4877 conn->session_ticket = NULL;
4878
4879 wpa_hexdump(MSG_DEBUG, "OpenSSL: ClientHello SessionTicket "
4880 "extension", data, len);
4881
a1f11e34 4882 conn->session_ticket = os_memdup(data, len);
0cf03892
JM		 4883 if (conn->session_ticket == NULL)
4884 return 0;
4885
0cf03892
JM		 4886 conn->session_ticket_len = len;
4887
4888 return 1;
4889}
1e5839e0 4890#endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */
6fc6879b
JM		 4891
4892
4893int tls_connection_set_session_ticket_cb(void *tls_ctx,
4894 struct tls_connection *conn,
4895 tls_session_ticket_cb cb,
4896 void *ctx)
4897{
1e5839e0 4898#if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
6fc6879b
JM		 4899 conn->session_ticket_cb = cb;
4900 conn->session_ticket_cb_ctx = ctx;
4901
4902 if (cb) {
4903 if (SSL_set_session_secret_cb(conn->ssl, tls_sess_sec_cb,
4904 conn) != 1)
4905 return -1;
0cf03892
JM		 4906 SSL_set_session_ticket_ext_cb(conn->ssl,
4907 tls_session_ticket_ext_cb, conn);
6fc6879b
JM		 4908 } else {
4909 if (SSL_set_session_secret_cb(conn->ssl, NULL, NULL) != 1)
4910 return -1;
0cf03892 4911 SSL_set_session_ticket_ext_cb(conn->ssl, NULL, NULL);
6fc6879b
JM		 4912 }
4913
4914 return 0;
1e5839e0 4915#else /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */
6fc6879b 4916 return -1;
1e5839e0 4917#endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */
6fc6879b 4918}
a1651451
JM		 4919
4920
4921int tls_get_library_version(char *buf, size_t buf_len)
4922{
587b0457 4923#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
b34c623c
JM		 4924 return os_snprintf(buf, buf_len, "OpenSSL build=%s run=%s",
4925 OPENSSL_VERSION_TEXT,
4926 OpenSSL_version(OPENSSL_VERSION));
4927#else
a1651451
JM		 4928 return os_snprintf(buf, buf_len, "OpenSSL build=%s run=%s",
4929 OPENSSL_VERSION_TEXT,
4930 SSLeay_version(SSLEAY_VERSION));
b34c623c 4931#endif
a1651451 4932}
b3b8085a
JM		 4933
4934
4935void tls_connection_set_success_data(struct tls_connection *conn,
4936 struct wpabuf *data)
4937{
acf36f31
JM		 4938 SSL_SESSION *sess;
4939 struct wpabuf *old;
4940
4941 if (tls_ex_idx_session < 0)
4942 goto fail;
4943 sess = SSL_get_session(conn->ssl);
4944 if (!sess)
4945 goto fail;
4946 old = SSL_SESSION_get_ex_data(sess, tls_ex_idx_session);
4947 if (old) {
4948 wpa_printf(MSG_DEBUG, "OpenSSL: Replacing old success data %p",
4949 old);
4950 wpabuf_free(old);
4951 }
4952 if (SSL_SESSION_set_ex_data(sess, tls_ex_idx_session, data) != 1)
4953 goto fail;
4954
4955 wpa_printf(MSG_DEBUG, "OpenSSL: Stored success data %p", data);
4956 conn->success_data = 1;
4957 return;
4958
4959fail:
4960 wpa_printf(MSG_INFO, "OpenSSL: Failed to store success data");
4961 wpabuf_free(data);
b3b8085a
JM		 4962}
4963
4964
4965void tls_connection_set_success_data_resumed(struct tls_connection *conn)
4966{
acf36f31
JM		 4967 wpa_printf(MSG_DEBUG,
4968 "OpenSSL: Success data accepted for resumed session");
4969 conn->success_data = 1;
b3b8085a
JM		 4970}
4971
4972
4973const struct wpabuf *
4974tls_connection_get_success_data(struct tls_connection *conn)
4975{
acf36f31
JM		 4976 SSL_SESSION *sess;
4977
4978 if (tls_ex_idx_session < 0 ||
4979 !(sess = SSL_get_session(conn->ssl)))
4980 return NULL;
4981 return SSL_SESSION_get_ex_data(sess, tls_ex_idx_session);
b3b8085a
JM		 4982}
4983
4984
4985void tls_connection_remove_session(struct tls_connection *conn)
4986{
acf36f31
JM		 4987 SSL_SESSION *sess;
4988
4989 sess = SSL_get_session(conn->ssl);
4990 if (!sess)
4991 return;
4992
4993 if (SSL_CTX_remove_session(conn->ssl_ctx, sess) != 1)
4994 wpa_printf(MSG_DEBUG,
4995 "OpenSSL: Session was not cached");
4996 else
4997 wpa_printf(MSG_DEBUG,
4998 "OpenSSL: Removed cached session to disable session resumption");
b3b8085a 4999}
Unnamed repository; edit this file 'description' to name the repository.