EAP peer status notification for server not supporting RFC 5746

Add a notification message to indicate reason for TLS handshake failure
due to the server not supporting safe renegotiation (RFC 5746).

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>

diff --git a/src/ap/authsrv.c b/src/ap/authsrv.c
index 516c1da74081fed70ce264a82d612b2505761da5..fd9c96fadc82b2f1ecdda8b63d7c687e4ce6215b 100644 (file)
--- a/src/ap/authsrv.c
+++ b/src/ap/authsrv.c
@@ -169,6 +169,9 @@ static void authsrv_tls_event(void *ctx, enum tls_event ev,
                        wpa_printf(MSG_DEBUG, "authsrv: remote TLS alert: %s",
                                   data->alert.description);
                break;
+       case TLS_UNSAFE_RENEGOTIATION_DISABLED:
+               /* Not applicable to TLS server */
+               break;
        }
 }
 #endif /* EAP_TLS_FUNCS */

diff --git a/src/crypto/tls.h b/src/crypto/tls.h
index 7ea32ee4aec38215c89a959b94b23a1b1613aa26..7a2ee32dfa7f7bdb6d276f8f498d1fbee22dab33 100644 (file)
--- a/src/crypto/tls.h
+++ b/src/crypto/tls.h
@@ -22,7 +22,8 @@ enum tls_event {
        TLS_CERT_CHAIN_SUCCESS,
        TLS_CERT_CHAIN_FAILURE,
        TLS_PEER_CERTIFICATE,
-       TLS_ALERT
+       TLS_ALERT,
+       TLS_UNSAFE_RENEGOTIATION_DISABLED,
 };
 
 /*

diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c
index 0d23f44adbd39cb98ea9808bf52edc1a7eb51e5d..912471ba278e74ab5af385f9f66dbe012af0a98e 100644 (file)
--- a/src/crypto/tls_openssl.c
+++ b/src/crypto/tls_openssl.c
@@ -4443,6 +4443,7 @@ int tls_connection_get_eap_fast_key(void *tls_ctx, struct tls_connection *conn,
 static struct wpabuf *
 openssl_handshake(struct tls_connection *conn, const struct wpabuf *in_data)
 {
+       struct tls_context *context = conn->context;
        int res;
        struct wpabuf *out_data;
 
@@ -4472,7 +4473,19 @@ openssl_handshake(struct tls_connection *conn, const struct wpabuf *in_data)
                        wpa_printf(MSG_DEBUG, "SSL: SSL_connect - want to "
                                   "write");
                else {
+                       unsigned long error = ERR_peek_last_error();
+
                        tls_show_errors(MSG_INFO, __func__, "SSL_connect");
+
+                       if (context->event_cb &&
+                           ERR_GET_LIB(error) == ERR_LIB_SSL &&
+                           ERR_GET_REASON(error) ==
+                           SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED) {
+                               context->event_cb(
+                                       context->cb_ctx,
+                                       TLS_UNSAFE_RENEGOTIATION_DISABLED,
+                                       NULL);
+                       }
                        conn->failed++;
                        if (!conn->server && !conn->client_hello_generated) {
                                /* The server would not understand TLS Alert
@@ -4495,8 +4508,6 @@ openssl_handshake(struct tls_connection *conn, const struct wpabuf *in_data)
        if ((conn->flags & TLS_CONN_SUITEB) && !conn->server &&
            os_strncmp(SSL_get_cipher(conn->ssl), "DHE-", 4) == 0 &&
            conn->server_dh_prime_len < 3072) {
-               struct tls_context *context = conn->context;
-
                /*
                 * This should not be reached since earlier cert_cb should have
                 * terminated the handshake. Keep this check here for extra

diff --git a/src/eap_peer/eap.c b/src/eap_peer/eap.c
index 429b20d3aa3511054073767a87c510820c03c1d5..729388f4f0dccd0b1b5940bdd403eeacbbd18184 100644 (file)
--- a/src/eap_peer/eap.c
+++ b/src/eap_peer/eap.c
@@ -2172,6 +2172,11 @@ static void eap_peer_sm_tls_event(void *ctx, enum tls_event ev,
                        eap_notify_status(sm, "remote TLS alert",
                                          data->alert.description);
                break;
+       case TLS_UNSAFE_RENEGOTIATION_DISABLED:
+               wpa_printf(MSG_INFO,
+                          "TLS handshake failed due to the server not supporting safe renegotiation (RFC 5746); phase1 parameter allow_unsafe_renegotiation=1 can be used to work around this");
+               eap_notify_status(sm, "unsafe server renegotiation", "failure");
+               break;
        }
 
        os_free(hash_hex);