1 /*
2 * SSL/TLS interface functions for OpenSSL
3 * Copyright (c) 2004-2015, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "includes.h"
10 #ifdef CONFIG_TESTING_OPTIONS
11 #include <fcntl.h>
12 #endif /* CONFIG_TESTING_OPTIONS */
13
14 #ifndef CONFIG_SMARTCARD
15 #ifndef OPENSSL_NO_ENGINE
16 #ifndef ANDROID
17 #define OPENSSL_NO_ENGINE
18 #endif
19 #endif
20 #endif
21
22 #ifndef OPENSSL_NO_ENGINE
23 /* OpenSSL 3.0 has moved away from the engine API */
24 #define OPENSSL_SUPPRESS_DEPRECATED
25 #include <openssl/engine.h>
26 #endif /* OPENSSL_NO_ENGINE */
27 #include <openssl/ssl.h>
28 #include <openssl/err.h>
29 #include <openssl/opensslv.h>
30 #include <openssl/pkcs12.h>
31 #include <openssl/x509v3.h>
32 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
33 #include <openssl/core_names.h>
34 #include <openssl/decoder.h>
35 #include <openssl/param_build.h>
36 #else /* OpenSSL version >= 3.0 */
37 #ifndef OPENSSL_NO_DSA
38 #include <openssl/dsa.h>
39 #endif
40 #ifndef OPENSSL_NO_DH
41 #include <openssl/dh.h>
42 #endif
43 #endif /* OpenSSL version >= 3.0 */
44
45 #include "common.h"
46 #include "utils/list.h"
47 #include "crypto.h"
48 #include "sha1.h"
49 #include "sha256.h"
50 #include "tls.h"
51 #include "tls_openssl.h"
52 #ifdef CONFIG_OHOS_CERTMGR
53 #include "wpa_evp_key.h"
54 #endif
55
56 #define OH_PREFIX "oh:"
57
58 #if !defined(CONFIG_FIPS) && \
59 (defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || \
60 defined(EAP_SERVER_FAST))
61 #define OPENSSL_NEED_EAP_FAST_PRF
62 #endif
63
64 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || \
65 defined(EAP_SERVER_FAST) || defined(EAP_TEAP) || \
66 defined(EAP_SERVER_TEAP)
67 #define EAP_FAST_OR_TEAP
68 #endif
69
70
71 #if defined(OPENSSL_IS_BORINGSSL)
72 /* stack_index_t is the return type of OpenSSL's sk_XXX_num() functions. */
73 typedef size_t stack_index_t;
74 #else
75 typedef int stack_index_t;
76 #endif
77
78 #ifdef SSL_set_tlsext_status_type
79 #ifndef OPENSSL_NO_TLSEXT
80 #define HAVE_OCSP
81 #include <openssl/ocsp.h>
82 #endif /* OPENSSL_NO_TLSEXT */
83 #endif /* SSL_set_tlsext_status_type */
84
85 #if OPENSSL_VERSION_NUMBER < 0x10100000L && \
86 !defined(BORINGSSL_API_VERSION)
87 /*
88 * SSL_get_client_random() and SSL_get_server_random() were added in OpenSSL
89 * 1.1.0 and newer BoringSSL revisions. Provide compatibility wrappers for
90 * older versions.
91 */
92
SSL_get_client_random(const SSL * ssl,unsigned char * out,size_t outlen)93 static size_t SSL_get_client_random(const SSL *ssl, unsigned char *out,
94 size_t outlen)
95 {
96 if (!ssl->s3 || outlen < SSL3_RANDOM_SIZE)
97 return 0;
98 os_memcpy(out, ssl->s3->client_random, SSL3_RANDOM_SIZE);
99 return SSL3_RANDOM_SIZE;
100 }
101
102
SSL_get_server_random(const SSL * ssl,unsigned char * out,size_t outlen)103 static size_t SSL_get_server_random(const SSL *ssl, unsigned char *out,
104 size_t outlen)
105 {
106 if (!ssl->s3 || outlen < SSL3_RANDOM_SIZE)
107 return 0;
108 os_memcpy(out, ssl->s3->server_random, SSL3_RANDOM_SIZE);
109 return SSL3_RANDOM_SIZE;
110 }
111
112
113 #ifdef OPENSSL_NEED_EAP_FAST_PRF
SSL_SESSION_get_master_key(const SSL_SESSION * session,unsigned char * out,size_t outlen)114 static size_t SSL_SESSION_get_master_key(const SSL_SESSION *session,
115 unsigned char *out, size_t outlen)
116 {
117 if (!session || session->master_key_length < 0 ||
118 (size_t) session->master_key_length > outlen)
119 return 0;
120 if ((size_t) session->master_key_length < outlen)
121 outlen = session->master_key_length;
122 os_memcpy(out, session->master_key, outlen);
123 return outlen;
124 }
125 #endif /* OPENSSL_NEED_EAP_FAST_PRF */
126
127 #endif
128
129 #if OPENSSL_VERSION_NUMBER < 0x10100000L
ASN1_STRING_get0_data(const ASN1_STRING * x)130 static const unsigned char * ASN1_STRING_get0_data(const ASN1_STRING *x)
131 {
132 return ASN1_STRING_data((ASN1_STRING *) x);
133 }
134 #endif
135
136 #ifdef ANDROID
137 #include <openssl/pem.h>
138 #include <keystore/keystore_get.h>
139
BIO_from_keystore(const char * key)140 static BIO * BIO_from_keystore(const char *key)
141 {
142 BIO *bio = NULL;
143 uint8_t *value = NULL;
144 int length = keystore_get(key, strlen(key), &value);
145 if (length != -1 && (bio = BIO_new(BIO_s_mem())) != NULL)
146 BIO_write(bio, value, length);
147 free(value);
148 return bio;
149 }
150
151
tls_add_ca_from_keystore(X509_STORE * ctx,const char * key_alias)152 static int tls_add_ca_from_keystore(X509_STORE *ctx, const char *key_alias)
153 {
154 BIO *bio = BIO_from_keystore(key_alias);
155 STACK_OF(X509_INFO) *stack = NULL;
156 stack_index_t i;
157
158 if (bio) {
159 stack = PEM_X509_INFO_read_bio(bio, NULL, NULL, NULL);
160 BIO_free(bio);
161 }
162
163 if (!stack) {
164 wpa_printf(MSG_WARNING, "TLS: Failed to parse certificate: %s",
165 key_alias);
166 return -1;
167 }
168
169 for (i = 0; i < sk_X509_INFO_num(stack); ++i) {
170 X509_INFO *info = sk_X509_INFO_value(stack, i);
171
172 if (info->x509)
173 X509_STORE_add_cert(ctx, info->x509);
174 if (info->crl)
175 X509_STORE_add_crl(ctx, info->crl);
176 }
177
178 sk_X509_INFO_pop_free(stack, X509_INFO_free);
179
180 return 0;
181 }
182
183
tls_add_ca_from_keystore_encoded(X509_STORE * ctx,const char * encoded_key_alias)184 static int tls_add_ca_from_keystore_encoded(X509_STORE *ctx,
185 const char *encoded_key_alias)
186 {
187 int rc = -1;
188 int len = os_strlen(encoded_key_alias);
189 unsigned char *decoded_alias;
190
191 if (len & 1) {
192 wpa_printf(MSG_WARNING, "Invalid hex-encoded alias: %s",
193 encoded_key_alias);
194 return rc;
195 }
196
197 decoded_alias = os_malloc(len / 2 + 1);
198 if (decoded_alias) {
199 if (!hexstr2bin(encoded_key_alias, decoded_alias, len / 2)) {
200 decoded_alias[len / 2] = '\0';
201 rc = tls_add_ca_from_keystore(
202 ctx, (const char *) decoded_alias);
203 }
204 os_free(decoded_alias);
205 }
206
207 return rc;
208 }
209
210 #endif /* ANDROID */
211
212 static int tls_openssl_ref_count = 0;
213 static int tls_ex_idx_session = -1;
214
215 struct tls_session_data {
216 struct dl_list list;
217 struct wpabuf *buf;
218 };
219
220 struct tls_context {
221 void (*event_cb)(void *ctx, enum tls_event ev,
222 union tls_event_data *data);
223 void *cb_ctx;
224 int cert_in_cb;
225 char *ocsp_stapling_response;
226 struct dl_list sessions; /* struct tls_session_data */
227 };
228
229 static struct tls_context *tls_global = NULL;
230
231
232 struct tls_data {
233 SSL_CTX *ssl;
234 unsigned int tls_session_lifetime;
235 int check_crl;
236 int check_crl_strict;
237 char *ca_cert;
238 unsigned int crl_reload_interval;
239 struct os_reltime crl_last_reload;
240 char *check_cert_subject;
241 char *openssl_ciphers;
242 };
243
244 struct tls_connection {
245 struct tls_context *context;
246 struct tls_data *data;
247 SSL_CTX *ssl_ctx;
248 SSL *ssl;
249 BIO *ssl_in, *ssl_out;
250 #if defined(ANDROID) || !defined(OPENSSL_NO_ENGINE)
251 ENGINE *engine; /* functional reference to the engine */
252 EVP_PKEY *private_key; /* the private key if using engine */
253 #endif /* OPENSSL_NO_ENGINE */
254 char *subject_match, *altsubject_match, *suffix_match, *domain_match;
255 char *check_cert_subject;
256 int read_alerts, write_alerts, failed;
257
258 tls_session_ticket_cb session_ticket_cb;
259 void *session_ticket_cb_ctx;
260
261 /* SessionTicket received from OpenSSL hello_extension_cb (server) */
262 u8 *session_ticket;
263 size_t session_ticket_len;
264
265 unsigned int ca_cert_verify:1;
266 unsigned int cert_probe:1;
267 unsigned int server_cert_only:1;
268 unsigned int invalid_hb_used:1;
269 unsigned int success_data:1;
270 unsigned int client_hello_generated:1;
271 unsigned int server:1;
272
273 u8 srv_cert_hash[32];
274
275 unsigned int flags;
276
277 X509 *peer_cert;
278 X509 *peer_issuer;
279 X509 *peer_issuer_issuer;
280 char *peer_subject; /* peer subject info for authenticated peer */
281
282 unsigned char client_random[SSL3_RANDOM_SIZE];
283 unsigned char server_random[SSL3_RANDOM_SIZE];
284
285 u16 cipher_suite;
286 int server_dh_prime_len;
287 };
288
289
tls_context_new(const struct tls_config * conf)290 static struct tls_context * tls_context_new(const struct tls_config *conf)
291 {
292 struct tls_context *context = os_zalloc(sizeof(*context));
293 if (context == NULL)
294 return NULL;
295 dl_list_init(&context->sessions);
296 if (conf) {
297 context->event_cb = conf->event_cb;
298 context->cb_ctx = conf->cb_ctx;
299 context->cert_in_cb = conf->cert_in_cb;
300 }
301 return context;
302 }
303
304
305 #ifdef CONFIG_NO_STDOUT_DEBUG
306
_tls_show_errors(void)307 static void _tls_show_errors(void)
308 {
309 unsigned long err;
310
311 while ((err = ERR_get_error())) {
312 /* Just ignore the errors, since stdout is disabled */
313 }
314 }
315 #define tls_show_errors(l, f, t) _tls_show_errors()
316
317 #else /* CONFIG_NO_STDOUT_DEBUG */
318
tls_show_errors(int level,const char * func,const char * txt)319 static void tls_show_errors(int level, const char *func, const char *txt)
320 {
321 unsigned long err;
322
323 wpa_printf(level, "OpenSSL: %s - %s %s",
324 func, txt, ERR_error_string(ERR_get_error(), NULL));
325
326 while ((err = ERR_get_error())) {
327 wpa_printf(MSG_INFO, "OpenSSL: pending error: %s",
328 ERR_error_string(err, NULL));
329 }
330 }
331
332 #endif /* CONFIG_NO_STDOUT_DEBUG */
333
334
tls_crl_cert_reload(const char * ca_cert,int check_crl)335 static X509_STORE * tls_crl_cert_reload(const char *ca_cert, int check_crl)
336 {
337 int flags;
338 X509_STORE *store;
339
340 store = X509_STORE_new();
341 if (!store) {
342 wpa_printf(MSG_DEBUG,
343 "OpenSSL: %s - failed to allocate new certificate store",
344 __func__);
345 return NULL;
346 }
347
348 if (ca_cert && X509_STORE_load_locations(store, ca_cert, NULL) != 1) {
349 tls_show_errors(MSG_WARNING, __func__,
350 "Failed to load root certificates");
351 X509_STORE_free(store);
352 return NULL;
353 }
354
355 flags = check_crl ? X509_V_FLAG_CRL_CHECK : 0;
356 if (check_crl == 2)
357 flags |= X509_V_FLAG_CRL_CHECK_ALL;
358
359 X509_STORE_set_flags(store, flags);
360
361 return store;
362 }
363
364
365 #ifdef CONFIG_NATIVE_WINDOWS
366
367 /* Windows CryptoAPI and access to certificate stores */
368 #include <wincrypt.h>
369
370 #ifdef __MINGW32_VERSION
371 /*
372 * MinGW does not yet include all the needed definitions for CryptoAPI, so
373 * define here whatever extra is needed.
374 */
375 #define CERT_SYSTEM_STORE_CURRENT_USER (1 << 16)
376 #define CERT_STORE_READONLY_FLAG 0x00008000
377 #define CERT_STORE_OPEN_EXISTING_FLAG 0x00004000
378
379 #endif /* __MINGW32_VERSION */
380
381
382 struct cryptoapi_rsa_data {
383 const CERT_CONTEXT *cert;
384 HCRYPTPROV crypt_prov;
385 DWORD key_spec;
386 BOOL free_crypt_prov;
387 };
388
389
cryptoapi_error(const char * msg)390 static void cryptoapi_error(const char *msg)
391 {
392 wpa_printf(MSG_INFO, "CryptoAPI: %s; err=%u",
393 msg, (unsigned int) GetLastError());
394 }
395
396
cryptoapi_rsa_pub_enc(int flen,const unsigned char * from,unsigned char * to,RSA * rsa,int padding)397 static int cryptoapi_rsa_pub_enc(int flen, const unsigned char *from,
398 unsigned char *to, RSA *rsa, int padding)
399 {
400 wpa_printf(MSG_DEBUG, "%s - not implemented", __func__);
401 return 0;
402 }
403
404
cryptoapi_rsa_pub_dec(int flen,const unsigned char * from,unsigned char * to,RSA * rsa,int padding)405 static int cryptoapi_rsa_pub_dec(int flen, const unsigned char *from,
406 unsigned char *to, RSA *rsa, int padding)
407 {
408 wpa_printf(MSG_DEBUG, "%s - not implemented", __func__);
409 return 0;
410 }
411
412
cryptoapi_rsa_priv_enc(int flen,const unsigned char * from,unsigned char * to,RSA * rsa,int padding)413 static int cryptoapi_rsa_priv_enc(int flen, const unsigned char *from,
414 unsigned char *to, RSA *rsa, int padding)
415 {
416 struct cryptoapi_rsa_data *priv =
417 (struct cryptoapi_rsa_data *) rsa->meth->app_data;
418 HCRYPTHASH hash;
419 DWORD hash_size, len, i;
420 unsigned char *buf = NULL;
421 int ret = 0;
422
423 if (priv == NULL) {
424 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,
425 ERR_R_PASSED_NULL_PARAMETER);
426 return 0;
427 }
428
429 if (padding != RSA_PKCS1_PADDING) {
430 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,
431 RSA_R_UNKNOWN_PADDING_TYPE);
432 return 0;
433 }
434
435 if (flen != 16 /* MD5 */ + 20 /* SHA-1 */) {
436 wpa_printf(MSG_INFO, "%s - only MD5-SHA1 hash supported",
437 __func__);
438 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,
439 RSA_R_INVALID_MESSAGE_LENGTH);
440 return 0;
441 }
442
443 if (!CryptCreateHash(priv->crypt_prov, CALG_SSL3_SHAMD5, 0, 0, &hash))
444 {
445 cryptoapi_error("CryptCreateHash failed");
446 return 0;
447 }
448
449 len = sizeof(hash_size);
450 if (!CryptGetHashParam(hash, HP_HASHSIZE, (BYTE *) &hash_size, &len,
451 0)) {
452 cryptoapi_error("CryptGetHashParam failed");
453 goto err;
454 }
455
456 if ((int) hash_size != flen) {
457 wpa_printf(MSG_INFO, "CryptoAPI: Invalid hash size (%u != %d)",
458 (unsigned) hash_size, flen);
459 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,
460 RSA_R_INVALID_MESSAGE_LENGTH);
461 goto err;
462 }
463 if (!CryptSetHashParam(hash, HP_HASHVAL, (BYTE * ) from, 0)) {
464 cryptoapi_error("CryptSetHashParam failed");
465 goto err;
466 }
467
468 len = RSA_size(rsa);
469 buf = os_malloc(len);
470 if (buf == NULL) {
471 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, ERR_R_MALLOC_FAILURE);
472 goto err;
473 }
474
475 if (!CryptSignHash(hash, priv->key_spec, NULL, 0, buf, &len)) {
476 cryptoapi_error("CryptSignHash failed");
477 goto err;
478 }
479
480 for (i = 0; i < len; i++)
481 to[i] = buf[len - i - 1];
482 ret = len;
483
484 err:
485 os_free(buf);
486 CryptDestroyHash(hash);
487
488 return ret;
489 }
490
491
cryptoapi_rsa_priv_dec(int flen,const unsigned char * from,unsigned char * to,RSA * rsa,int padding)492 static int cryptoapi_rsa_priv_dec(int flen, const unsigned char *from,
493 unsigned char *to, RSA *rsa, int padding)
494 {
495 wpa_printf(MSG_DEBUG, "%s - not implemented", __func__);
496 return 0;
497 }
498
499
cryptoapi_free_data(struct cryptoapi_rsa_data * priv)500 static void cryptoapi_free_data(struct cryptoapi_rsa_data *priv)
501 {
502 if (priv == NULL)
503 return;
504 if (priv->crypt_prov && priv->free_crypt_prov)
505 CryptReleaseContext(priv->crypt_prov, 0);
506 if (priv->cert)
507 CertFreeCertificateContext(priv->cert);
508 os_free(priv);
509 }
510
511
cryptoapi_finish(RSA * rsa)512 static int cryptoapi_finish(RSA *rsa)
513 {
514 cryptoapi_free_data((struct cryptoapi_rsa_data *) rsa->meth->app_data);
515 os_free((void *) rsa->meth);
516 rsa->meth = NULL;
517 return 1;
518 }
519
520
cryptoapi_find_cert(const char * name,DWORD store)521 static const CERT_CONTEXT * cryptoapi_find_cert(const char *name, DWORD store)
522 {
523 HCERTSTORE cs;
524 const CERT_CONTEXT *ret = NULL;
525
526 cs = CertOpenStore((LPCSTR) CERT_STORE_PROV_SYSTEM, 0, 0,
527 store | CERT_STORE_OPEN_EXISTING_FLAG |
528 CERT_STORE_READONLY_FLAG, L"MY");
529 if (cs == NULL) {
530 cryptoapi_error("Failed to open 'My system store'");
531 return NULL;
532 }
533
534 if (strncmp(name, "cert://", 7) == 0) {
535 unsigned short wbuf[255];
536 MultiByteToWideChar(CP_ACP, 0, name + 7, -1, wbuf, 255);
537 ret = CertFindCertificateInStore(cs, X509_ASN_ENCODING |
538 PKCS_7_ASN_ENCODING,
539 0, CERT_FIND_SUBJECT_STR,
540 wbuf, NULL);
541 } else if (strncmp(name, "hash://", 7) == 0) {
542 CRYPT_HASH_BLOB blob;
543 int len;
544 const char *hash = name + 7;
545 unsigned char *buf;
546
547 len = os_strlen(hash) / 2;
548 buf = os_malloc(len);
549 if (buf && hexstr2bin(hash, buf, len) == 0) {
550 blob.cbData = len;
551 blob.pbData = buf;
552 ret = CertFindCertificateInStore(cs,
553 X509_ASN_ENCODING |
554 PKCS_7_ASN_ENCODING,
555 0, CERT_FIND_HASH,
556 &blob, NULL);
557 }
558 os_free(buf);
559 }
560
561 CertCloseStore(cs, 0);
562
563 return ret;
564 }
565
566
tls_cryptoapi_cert(SSL * ssl,const char * name)567 static int tls_cryptoapi_cert(SSL *ssl, const char *name)
568 {
569 X509 *cert = NULL;
570 RSA *rsa = NULL, *pub_rsa;
571 struct cryptoapi_rsa_data *priv;
572 RSA_METHOD *rsa_meth;
573
574 if (name == NULL ||
575 (strncmp(name, "cert://", 7) != 0 &&
576 strncmp(name, "hash://", 7) != 0))
577 return -1;
578
579 priv = os_zalloc(sizeof(*priv));
580 rsa_meth = os_zalloc(sizeof(*rsa_meth));
581 if (priv == NULL || rsa_meth == NULL) {
582 wpa_printf(MSG_WARNING, "CryptoAPI: Failed to allocate memory "
583 "for CryptoAPI RSA method");
584 os_free(priv);
585 os_free(rsa_meth);
586 return -1;
587 }
588
589 priv->cert = cryptoapi_find_cert(name, CERT_SYSTEM_STORE_CURRENT_USER);
590 if (priv->cert == NULL) {
591 priv->cert = cryptoapi_find_cert(
592 name, CERT_SYSTEM_STORE_LOCAL_MACHINE);
593 }
594 if (priv->cert == NULL) {
595 wpa_printf(MSG_INFO, "CryptoAPI: Could not find certificate "
596 "'%s'", name);
597 goto err;
598 }
599
600 cert = d2i_X509(NULL,
601 (const unsigned char **) &priv->cert->pbCertEncoded,
602 priv->cert->cbCertEncoded);
603 if (cert == NULL) {
604 wpa_printf(MSG_INFO, "CryptoAPI: Could not process X509 DER "
605 "encoding");
606 goto err;
607 }
608
609 if (!CryptAcquireCertificatePrivateKey(priv->cert,
610 CRYPT_ACQUIRE_COMPARE_KEY_FLAG,
611 NULL, &priv->crypt_prov,
612 &priv->key_spec,
613 &priv->free_crypt_prov)) {
614 cryptoapi_error("Failed to acquire a private key for the "
615 "certificate");
616 goto err;
617 }
618
619 rsa_meth->name = "Microsoft CryptoAPI RSA Method";
620 rsa_meth->rsa_pub_enc = cryptoapi_rsa_pub_enc;
621 rsa_meth->rsa_pub_dec = cryptoapi_rsa_pub_dec;
622 rsa_meth->rsa_priv_enc = cryptoapi_rsa_priv_enc;
623 rsa_meth->rsa_priv_dec = cryptoapi_rsa_priv_dec;
624 rsa_meth->finish = cryptoapi_finish;
625 rsa_meth->flags = RSA_METHOD_FLAG_NO_CHECK;
626 rsa_meth->app_data = (char *) priv;
627
628 rsa = RSA_new();
629 if (rsa == NULL) {
630 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,
631 ERR_R_MALLOC_FAILURE);
632 goto err;
633 }
634
635 if (!SSL_use_certificate(ssl, cert)) {
636 RSA_free(rsa);
637 rsa = NULL;
638 goto err;
639 }
640 pub_rsa = cert->cert_info->key->pkey->pkey.rsa;
641 X509_free(cert);
642 cert = NULL;
643
644 rsa->n = BN_dup(pub_rsa->n);
645 rsa->e = BN_dup(pub_rsa->e);
646 if (!RSA_set_method(rsa, rsa_meth))
647 goto err;
648
649 if (!SSL_use_RSAPrivateKey(ssl, rsa))
650 goto err;
651 RSA_free(rsa);
652
653 return 0;
654
655 err:
656 if (cert)
657 X509_free(cert);
658 if (rsa)
659 RSA_free(rsa);
660 else {
661 os_free(rsa_meth);
662 cryptoapi_free_data(priv);
663 }
664 return -1;
665 }
666
667
tls_cryptoapi_ca_cert(SSL_CTX * ssl_ctx,SSL * ssl,const char * name)668 static int tls_cryptoapi_ca_cert(SSL_CTX *ssl_ctx, SSL *ssl, const char *name)
669 {
670 HCERTSTORE cs;
671 PCCERT_CONTEXT ctx = NULL;
672 X509 *cert;
673 char buf[128];
674 const char *store;
675 #ifdef UNICODE
676 WCHAR *wstore;
677 #endif /* UNICODE */
678
679 if (name == NULL || strncmp(name, "cert_store://", 13) != 0)
680 return -1;
681
682 store = name + 13;
683 #ifdef UNICODE
684 wstore = os_malloc((os_strlen(store) + 1) * sizeof(WCHAR));
685 if (wstore == NULL)
686 return -1;
687 wsprintf(wstore, L"%S", store);
688 cs = CertOpenSystemStore(0, wstore);
689 os_free(wstore);
690 #else /* UNICODE */
691 cs = CertOpenSystemStore(0, store);
692 #endif /* UNICODE */
693 if (cs == NULL) {
694 wpa_printf(MSG_DEBUG, "%s: failed to open system cert store "
695 "'%s': error=%d", __func__, store,
696 (int) GetLastError());
697 return -1;
698 }
699
700 while ((ctx = CertEnumCertificatesInStore(cs, ctx))) {
701 cert = d2i_X509(NULL,
702 (const unsigned char **) &ctx->pbCertEncoded,
703 ctx->cbCertEncoded);
704 if (cert == NULL) {
705 wpa_printf(MSG_INFO, "CryptoAPI: Could not process "
706 "X509 DER encoding for CA cert");
707 continue;
708 }
709
710 X509_NAME_oneline(X509_get_subject_name(cert), buf,
711 sizeof(buf));
712 wpa_printf(MSG_DEBUG, "OpenSSL: Loaded CA certificate for "
713 "system certificate store: subject='%s'", buf);
714
715 if (!X509_STORE_add_cert(SSL_CTX_get_cert_store(ssl_ctx),
716 cert)) {
717 tls_show_errors(MSG_WARNING, __func__,
718 "Failed to add ca_cert to OpenSSL "
719 "certificate store");
720 }
721
722 X509_free(cert);
723 }
724
725 if (!CertCloseStore(cs, 0)) {
726 wpa_printf(MSG_DEBUG, "%s: failed to close system cert store "
727 "'%s': error=%d", __func__, name + 13,
728 (int) GetLastError());
729 }
730
731 return 0;
732 }
733
734
735 #else /* CONFIG_NATIVE_WINDOWS */
736
tls_cryptoapi_cert(SSL * ssl,const char * name)737 static int tls_cryptoapi_cert(SSL *ssl, const char *name)
738 {
739 return -1;
740 }
741
742 #endif /* CONFIG_NATIVE_WINDOWS */
743
744
ssl_info_cb(const SSL * ssl,int where,int ret)745 static void ssl_info_cb(const SSL *ssl, int where, int ret)
746 {
747 const char *str;
748 int w;
749
750 wpa_printf(MSG_EXCESSIVE, "SSL: (where=0x%x ret=0x%x)", where, ret);
751 w = where & ~SSL_ST_MASK;
752 if (w & SSL_ST_CONNECT)
753 str = "SSL_connect";
754 else if (w & SSL_ST_ACCEPT)
755 str = "SSL_accept";
756 else
757 str = "undefined";
758
759 if (where & SSL_CB_LOOP) {
760 wpa_printf(MSG_DEBUG, "SSL: %s:%s",
761 str, SSL_state_string_long(ssl));
762 } else if (where & SSL_CB_ALERT) {
763 struct tls_connection *conn = SSL_get_app_data((SSL *) ssl);
764 wpa_printf(MSG_INFO, "SSL: SSL3 alert: %s:%s:%s",
765 where & SSL_CB_READ ?
766 "read (remote end reported an error)" :
767 "write (local SSL3 detected an error)",
768 SSL_alert_type_string_long(ret),
769 SSL_alert_desc_string_long(ret));
770 if ((ret >> 8) == SSL3_AL_FATAL) {
771 if (where & SSL_CB_READ)
772 conn->read_alerts++;
773 else
774 conn->write_alerts++;
775 }
776 if (conn->context->event_cb != NULL) {
777 union tls_event_data ev;
778 struct tls_context *context = conn->context;
779 os_memset(&ev, 0, sizeof(ev));
780 ev.alert.is_local = !(where & SSL_CB_READ);
781 ev.alert.type = SSL_alert_type_string_long(ret);
782 ev.alert.description = SSL_alert_desc_string_long(ret);
783 context->event_cb(context->cb_ctx, TLS_ALERT, &ev);
784 }
785 } else if (where & SSL_CB_EXIT && ret <= 0) {
786 wpa_printf(MSG_DEBUG, "SSL: %s:%s in %s",
787 str, ret == 0 ? "failed" : "error",
788 SSL_state_string_long(ssl));
789 }
790 }
791
792
793 #ifndef OPENSSL_NO_ENGINE
794 /**
795 * tls_engine_load_dynamic_generic - load any openssl engine
796 * @pre: an array of commands and values that load an engine initialized
797 * in the engine specific function
798 * @post: an array of commands and values that initialize an already loaded
799 * engine (or %NULL if not required)
800 * @id: the engine id of the engine to load (only required if post is not %NULL
801 *
802 * This function is a generic function that loads any openssl engine.
803 *
804 * Returns: 0 on success, -1 on failure
805 */
tls_engine_load_dynamic_generic(const char * pre[],const char * post[],const char * id)806 static int tls_engine_load_dynamic_generic(const char *pre[],
807 const char *post[], const char *id)
808 {
809 ENGINE *engine;
810 const char *dynamic_id = "dynamic";
811
812 engine = ENGINE_by_id(id);
813 if (engine) {
814 wpa_printf(MSG_DEBUG, "ENGINE: engine '%s' is already "
815 "available", id);
816 /*
817 * If it was auto-loaded by ENGINE_by_id() we might still
818 * need to tell it which PKCS#11 module to use in legacy
819 * (non-p11-kit) environments. Do so now; even if it was
820 * properly initialised before, setting it again will be
821 * harmless.
822 */
823 goto found;
824 }
825 ERR_clear_error();
826
827 engine = ENGINE_by_id(dynamic_id);
828 if (engine == NULL) {
829 wpa_printf(MSG_INFO, "ENGINE: Can't find engine %s [%s]",
830 dynamic_id,
831 ERR_error_string(ERR_get_error(), NULL));
832 return -1;
833 }
834
835 /* Perform the pre commands. This will load the engine. */
836 while (pre && pre[0]) {
837 wpa_printf(MSG_DEBUG, "ENGINE: '%s' '%s'", pre[0], pre[1]);
838 if (ENGINE_ctrl_cmd_string(engine, pre[0], pre[1], 0) == 0) {
839 wpa_printf(MSG_INFO, "ENGINE: ctrl cmd_string failed: "
840 "%s %s [%s]", pre[0], pre[1],
841 ERR_error_string(ERR_get_error(), NULL));
842 ENGINE_free(engine);
843 return -1;
844 }
845 pre += 2;
846 }
847
848 /*
849 * Free the reference to the "dynamic" engine. The loaded engine can
850 * now be looked up using ENGINE_by_id().
851 */
852 ENGINE_free(engine);
853
854 engine = ENGINE_by_id(id);
855 if (engine == NULL) {
856 wpa_printf(MSG_INFO, "ENGINE: Can't find engine %s [%s]",
857 id, ERR_error_string(ERR_get_error(), NULL));
858 return -1;
859 }
860 found:
861 while (post && post[0]) {
862 wpa_printf(MSG_DEBUG, "ENGINE: '%s' '%s'", post[0], post[1]);
863 if (ENGINE_ctrl_cmd_string(engine, post[0], post[1], 0) == 0) {
864 wpa_printf(MSG_DEBUG, "ENGINE: ctrl cmd_string failed:"
865 " %s %s [%s]", post[0], post[1],
866 ERR_error_string(ERR_get_error(), NULL));
867 ENGINE_remove(engine);
868 ENGINE_free(engine);
869 return -1;
870 }
871 post += 2;
872 }
873 ENGINE_free(engine);
874
875 return 0;
876 }
877
878
879 /**
880 * tls_engine_load_dynamic_pkcs11 - load the pkcs11 engine provided by opensc
881 * @pkcs11_so_path: pksc11_so_path from the configuration
882 * @pcks11_module_path: pkcs11_module_path from the configuration
883 */
tls_engine_load_dynamic_pkcs11(const char * pkcs11_so_path,const char * pkcs11_module_path)884 static int tls_engine_load_dynamic_pkcs11(const char *pkcs11_so_path,
885 const char *pkcs11_module_path)
886 {
887 char *engine_id = "pkcs11";
888 const char *pre_cmd[] = {
889 "SO_PATH", NULL /* pkcs11_so_path */,
890 "ID", NULL /* engine_id */,
891 "LIST_ADD", "1",
892 /* "NO_VCHECK", "1", */
893 "LOAD", NULL,
894 NULL, NULL
895 };
896 const char *post_cmd[] = {
897 "MODULE_PATH", NULL /* pkcs11_module_path */,
898 NULL, NULL
899 };
900
901 if (!pkcs11_so_path)
902 return 0;
903
904 pre_cmd[1] = pkcs11_so_path;
905 pre_cmd[3] = engine_id;
906 if (pkcs11_module_path)
907 post_cmd[1] = pkcs11_module_path;
908 else
909 post_cmd[0] = NULL;
910
911 wpa_printf(MSG_DEBUG, "ENGINE: Loading pkcs11 Engine from %s",
912 pkcs11_so_path);
913
914 return tls_engine_load_dynamic_generic(pre_cmd, post_cmd, engine_id);
915 }
916
917
918 /**
919 * tls_engine_load_dynamic_opensc - load the opensc engine provided by opensc
920 * @opensc_so_path: opensc_so_path from the configuration
921 */
tls_engine_load_dynamic_opensc(const char * opensc_so_path)922 static int tls_engine_load_dynamic_opensc(const char *opensc_so_path)
923 {
924 char *engine_id = "opensc";
925 const char *pre_cmd[] = {
926 "SO_PATH", NULL /* opensc_so_path */,
927 "ID", NULL /* engine_id */,
928 "LIST_ADD", "1",
929 "LOAD", NULL,
930 NULL, NULL
931 };
932
933 if (!opensc_so_path)
934 return 0;
935
936 pre_cmd[1] = opensc_so_path;
937 pre_cmd[3] = engine_id;
938
939 wpa_printf(MSG_DEBUG, "ENGINE: Loading OpenSC Engine from %s",
940 opensc_so_path);
941
942 return tls_engine_load_dynamic_generic(pre_cmd, NULL, engine_id);
943 }
944 #endif /* OPENSSL_NO_ENGINE */
945
946
get_session_data(struct tls_context * context,const struct wpabuf * buf)947 static struct tls_session_data * get_session_data(struct tls_context *context,
948 const struct wpabuf *buf)
949 {
950 struct tls_session_data *data;
951
952 dl_list_for_each(data, &context->sessions, struct tls_session_data,
953 list) {
954 if (data->buf == buf)
955 return data;
956 }
957
958 return NULL;
959 }
960
961
remove_session_cb(SSL_CTX * ctx,SSL_SESSION * sess)962 static void remove_session_cb(SSL_CTX *ctx, SSL_SESSION *sess)
963 {
964 struct wpabuf *buf;
965 struct tls_context *context;
966 struct tls_session_data *found;
967
968 wpa_printf(MSG_DEBUG,
969 "OpenSSL: Remove session %p (tls_ex_idx_session=%d)", sess,
970 tls_ex_idx_session);
971
972 if (tls_ex_idx_session < 0)
973 return;
974 buf = SSL_SESSION_get_ex_data(sess, tls_ex_idx_session);
975 if (!buf)
976 return;
977
978 context = SSL_CTX_get_app_data(ctx);
979 SSL_SESSION_set_ex_data(sess, tls_ex_idx_session, NULL);
980 found = get_session_data(context, buf);
981 if (!found) {
982 wpa_printf(MSG_DEBUG,
983 "OpenSSL: Do not free application session data %p (sess %p)",
984 buf, sess);
985 return;
986 }
987
988 dl_list_del(&found->list);
989 os_free(found);
990 wpa_printf(MSG_DEBUG,
991 "OpenSSL: Free application session data %p (sess %p)",
992 buf, sess);
993 wpabuf_free(buf);
994 }
995
996
tls_init(const struct tls_config * conf)997 void * tls_init(const struct tls_config *conf)
998 {
999 struct tls_data *data;
1000 SSL_CTX *ssl;
1001 struct tls_context *context;
1002 const char *ciphers;
1003 #ifndef OPENSSL_NO_ENGINE
1004 #ifdef CONFIG_OPENSC_ENGINE_PATH
1005 char const * const opensc_engine_path = CONFIG_OPENSC_ENGINE_PATH;
1006 #else /* CONFIG_OPENSC_ENGINE_PATH */
1007 char const * const opensc_engine_path =
1008 conf ? conf->opensc_engine_path : NULL;
1009 #endif /* CONFIG_OPENSC_ENGINE_PATH */
1010 #ifdef CONFIG_PKCS11_ENGINE_PATH
1011 char const * const pkcs11_engine_path = CONFIG_PKCS11_ENGINE_PATH;
1012 #else /* CONFIG_PKCS11_ENGINE_PATH */
1013 char const * const pkcs11_engine_path =
1014 conf ? conf->pkcs11_engine_path : NULL;
1015 #endif /* CONFIG_PKCS11_ENGINE_PATH */
1016 #ifdef CONFIG_PKCS11_MODULE_PATH
1017 char const * const pkcs11_module_path = CONFIG_PKCS11_MODULE_PATH;
1018 #else /* CONFIG_PKCS11_MODULE_PATH */
1019 char const * const pkcs11_module_path =
1020 conf ? conf->pkcs11_module_path : NULL;
1021 #endif /* CONFIG_PKCS11_MODULE_PATH */
1022 #endif /* OPENSSL_NO_ENGINE */
1023
1024 if (tls_openssl_ref_count == 0) {
1025 void openssl_load_legacy_provider(void);
1026
1027 openssl_load_legacy_provider();
1028
1029 tls_global = context = tls_context_new(conf);
1030 if (context == NULL)
1031 return NULL;
1032 #ifdef CONFIG_FIPS
1033 #ifdef OPENSSL_FIPS
1034 if (conf && conf->fips_mode) {
1035 static int fips_enabled = 0;
1036
1037 if (!fips_enabled && !FIPS_mode_set(1)) {
1038 wpa_printf(MSG_ERROR, "Failed to enable FIPS "
1039 "mode");
1040 ERR_load_crypto_strings();
1041 ERR_print_errors_fp(stderr);
1042 os_free(tls_global);
1043 tls_global = NULL;
1044 return NULL;
1045 } else {
1046 wpa_printf(MSG_INFO, "Running in FIPS mode");
1047 fips_enabled = 1;
1048 }
1049 }
1050 #else /* OPENSSL_FIPS */
1051 if (conf && conf->fips_mode) {
1052 wpa_printf(MSG_ERROR, "FIPS mode requested, but not "
1053 "supported");
1054 os_free(tls_global);
1055 tls_global = NULL;
1056 return NULL;
1057 }
1058 #endif /* OPENSSL_FIPS */
1059 #endif /* CONFIG_FIPS */
1060 #if OPENSSL_VERSION_NUMBER < 0x10100000L
1061 SSL_load_error_strings();
1062 SSL_library_init();
1063 #ifndef OPENSSL_NO_SHA256
1064 EVP_add_digest(EVP_sha256());
1065 #endif /* OPENSSL_NO_SHA256 */
1066 /* TODO: if /dev/urandom is available, PRNG is seeded
1067 * automatically. If this is not the case, random data should
1068 * be added here. */
1069
1070 #ifdef PKCS12_FUNCS
1071 #ifndef OPENSSL_NO_RC2
1072 /*
1073 * 40-bit RC2 is commonly used in PKCS#12 files, so enable it.
1074 * This is enabled by PKCS12_PBE_add() in OpenSSL 0.9.8
1075 * versions, but it looks like OpenSSL 1.0.0 does not do that
1076 * anymore.
1077 */
1078 EVP_add_cipher(EVP_rc2_40_cbc());
1079 #endif /* OPENSSL_NO_RC2 */
1080 PKCS12_PBE_add();
1081 #endif /* PKCS12_FUNCS */
1082 #endif /* < 1.1.0 */
1083 } else {
1084 context = tls_context_new(conf);
1085 if (context == NULL)
1086 return NULL;
1087 }
1088 tls_openssl_ref_count++;
1089
1090 data = os_zalloc(sizeof(*data));
1091 if (data)
1092 ssl = SSL_CTX_new(SSLv23_method());
1093 else
1094 ssl = NULL;
1095 if (ssl == NULL) {
1096 tls_openssl_ref_count--;
1097 if (context != tls_global)
1098 os_free(context);
1099 if (tls_openssl_ref_count == 0) {
1100 os_free(tls_global);
1101 tls_global = NULL;
1102 }
1103 os_free(data);
1104 return NULL;
1105 }
1106 data->ssl = ssl;
1107 if (conf) {
1108 data->tls_session_lifetime = conf->tls_session_lifetime;
1109 data->crl_reload_interval = conf->crl_reload_interval;
1110 }
1111
1112 SSL_CTX_set_options(ssl, SSL_OP_NO_SSLv2);
1113 SSL_CTX_set_options(ssl, SSL_OP_NO_SSLv3);
1114
1115 SSL_CTX_set_mode(ssl, SSL_MODE_AUTO_RETRY);
1116
1117 #ifdef SSL_MODE_NO_AUTO_CHAIN
1118 /* Number of deployed use cases assume the default OpenSSL behavior of
1119 * auto chaining the local certificate is in use. BoringSSL removed this
1120 * functionality by default, so we need to restore it here to avoid
1121 * breaking existing use cases. */
1122 SSL_CTX_clear_mode(ssl, SSL_MODE_NO_AUTO_CHAIN);
1123 #endif /* SSL_MODE_NO_AUTO_CHAIN */
1124
1125 SSL_CTX_set_info_callback(ssl, ssl_info_cb);
1126 SSL_CTX_set_app_data(ssl, context);
1127 if (data->tls_session_lifetime > 0) {
1128 SSL_CTX_set_quiet_shutdown(ssl, 1);
1129 /*
1130 * Set default context here. In practice, this will be replaced
1131 * by the per-EAP method context in tls_connection_set_verify().
1132 */
1133 SSL_CTX_set_session_id_context(ssl, (u8 *) "hostapd", 7);
1134 SSL_CTX_set_session_cache_mode(ssl, SSL_SESS_CACHE_SERVER);
1135 SSL_CTX_set_timeout(ssl, data->tls_session_lifetime);
1136 SSL_CTX_sess_set_remove_cb(ssl, remove_session_cb);
1137 #if OPENSSL_VERSION_NUMBER >= 0x10101000L && \
1138 !defined(LIBRESSL_VERSION_NUMBER) && \
1139 !defined(OPENSSL_IS_BORINGSSL)
1140 /* One session ticket is sufficient for EAP-TLS */
1141 SSL_CTX_set_num_tickets(ssl, 1);
1142 #endif
1143 } else {
1144 SSL_CTX_set_session_cache_mode(ssl, SSL_SESS_CACHE_OFF);
1145 #if OPENSSL_VERSION_NUMBER >= 0x10101000L && \
1146 !defined(LIBRESSL_VERSION_NUMBER) && \
1147 !defined(OPENSSL_IS_BORINGSSL)
1148 SSL_CTX_set_num_tickets(ssl, 0);
1149 #endif
1150 }
1151
1152 if (tls_ex_idx_session < 0) {
1153 tls_ex_idx_session = SSL_SESSION_get_ex_new_index(
1154 0, NULL, NULL, NULL, NULL);
1155 if (tls_ex_idx_session < 0) {
1156 tls_deinit(data);
1157 return NULL;
1158 }
1159 }
1160
1161 #ifndef OPENSSL_NO_ENGINE
1162 wpa_printf(MSG_DEBUG, "ENGINE: Loading builtin engines");
1163 ENGINE_load_builtin_engines();
1164
1165 if (opensc_engine_path || pkcs11_engine_path || pkcs11_module_path) {
1166 if (tls_engine_load_dynamic_opensc(opensc_engine_path) ||
1167 tls_engine_load_dynamic_pkcs11(pkcs11_engine_path,
1168 pkcs11_module_path)) {
1169 tls_deinit(data);
1170 return NULL;
1171 }
1172 }
1173 #endif /* OPENSSL_NO_ENGINE */
1174
1175 if (conf && conf->openssl_ciphers)
1176 ciphers = conf->openssl_ciphers;
1177 else
1178 ciphers = TLS_DEFAULT_CIPHERS;
1179 if (SSL_CTX_set_cipher_list(ssl, ciphers) != 1) {
1180 wpa_printf(MSG_ERROR,
1181 "OpenSSL: Failed to set cipher string '%s'",
1182 ciphers);
1183 tls_deinit(data);
1184 return NULL;
1185 }
1186
1187 return data;
1188 }
1189
1190
tls_deinit(void * ssl_ctx)1191 void tls_deinit(void *ssl_ctx)
1192 {
1193 wpa_printf(MSG_INFO, "Enter tls_deinit");
1194 struct tls_data *data = ssl_ctx;
1195 SSL_CTX *ssl = data->ssl;
1196 struct tls_context *context = SSL_CTX_get_app_data(ssl);
1197 struct tls_session_data *sess_data;
1198
1199 if (data->tls_session_lifetime > 0) {
1200 wpa_printf(MSG_DEBUG, "OpenSSL: Flush sessions");
1201 SSL_CTX_flush_sessions(ssl, 0);
1202 wpa_printf(MSG_DEBUG, "OpenSSL: Flush sessions - done");
1203 }
1204 while ((sess_data = dl_list_first(&context->sessions,
1205 struct tls_session_data, list))) {
1206 wpa_printf(MSG_DEBUG,
1207 "OpenSSL: Freeing not-flushed session data %p",
1208 sess_data->buf);
1209 wpabuf_free(sess_data->buf);
1210 dl_list_del(&sess_data->list);
1211 os_free(sess_data);
1212 }
1213 if (context != tls_global && context != NULL) {
1214 os_free(context);
1215 context = NULL;
1216 }
1217 os_free(data->ca_cert);
1218 if (ssl) {
1219 SSL_CTX_free(ssl);
1220 ssl = NULL;
1221 }
1222
1223 tls_openssl_ref_count--;
1224 if (tls_openssl_ref_count == 0) {
1225 #if OPENSSL_VERSION_NUMBER < 0x10100000L
1226 #ifndef OPENSSL_NO_ENGINE
1227 ENGINE_cleanup();
1228 #endif /* OPENSSL_NO_ENGINE */
1229 CRYPTO_cleanup_all_ex_data();
1230 ERR_remove_thread_state(NULL);
1231 ERR_free_strings();
1232 EVP_cleanup();
1233 #endif /* < 1.1.0 */
1234 os_free(tls_global->ocsp_stapling_response);
1235 tls_global->ocsp_stapling_response = NULL;
1236 os_free(tls_global);
1237 tls_global = NULL;
1238 }
1239
1240 os_free(data->check_cert_subject);
1241 data->check_cert_subject = NULL;
1242 os_free(data->openssl_ciphers);
1243 os_free(data);
1244 data = NULL;
1245 wpa_printf(MSG_INFO, "Leave tls_deinit");
1246 }
1247
1248
1249 #ifndef OPENSSL_NO_ENGINE
1250
1251 /* Cryptoki return values */
1252 #define CKR_PIN_INCORRECT 0x000000a0
1253 #define CKR_PIN_INVALID 0x000000a1
1254 #define CKR_PIN_LEN_RANGE 0x000000a2
1255
1256 /* libp11 */
1257 #define ERR_LIB_PKCS11 ERR_LIB_USER
1258
tls_is_pin_error(unsigned int err)1259 static int tls_is_pin_error(unsigned int err)
1260 {
1261 return ERR_GET_LIB(err) == ERR_LIB_PKCS11 &&
1262 (ERR_GET_REASON(err) == CKR_PIN_INCORRECT ||
1263 ERR_GET_REASON(err) == CKR_PIN_INVALID ||
1264 ERR_GET_REASON(err) == CKR_PIN_LEN_RANGE);
1265 }
1266
1267 #endif /* OPENSSL_NO_ENGINE */
1268
1269
1270 #ifdef ANDROID
1271 /* EVP_PKEY_from_keystore comes from system/security/keystore-engine. */
1272 EVP_PKEY * EVP_PKEY_from_keystore(const char *key_id);
1273 #endif /* ANDROID */
1274
tls_engine_init(struct tls_connection * conn,const char * engine_id,const char * pin,const char * key_id,const char * cert_id,const char * ca_cert_id)1275 static int tls_engine_init(struct tls_connection *conn, const char *engine_id,
1276 const char *pin, const char *key_id,
1277 const char *cert_id, const char *ca_cert_id)
1278 {
1279 #if defined(ANDROID) && defined(OPENSSL_IS_BORINGSSL)
1280 #if !defined(OPENSSL_NO_ENGINE)
1281 #error "This code depends on OPENSSL_NO_ENGINE being defined by BoringSSL."
1282 #endif
1283 if (!key_id)
1284 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
1285 conn->engine = NULL;
1286 conn->private_key = EVP_PKEY_from_keystore(key_id);
1287 if (!conn->private_key) {
1288 wpa_printf(MSG_ERROR,
1289 "ENGINE: cannot load private key with id '%s' [%s]",
1290 key_id,
1291 ERR_error_string(ERR_get_error(), NULL));
1292 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
1293 }
1294 #endif /* ANDROID && OPENSSL_IS_BORINGSSL */
1295
1296 #ifndef OPENSSL_NO_ENGINE
1297 int ret = -1;
1298 if (engine_id == NULL) {
1299 wpa_printf(MSG_ERROR, "ENGINE: Engine ID not set");
1300 return -1;
1301 }
1302
1303 ERR_clear_error();
1304 #ifdef ANDROID
1305 ENGINE_load_dynamic();
1306 #endif
1307 conn->engine = ENGINE_by_id(engine_id);
1308 if (!conn->engine) {
1309 wpa_printf(MSG_ERROR, "ENGINE: engine %s not available [%s]",
1310 engine_id, ERR_error_string(ERR_get_error(), NULL));
1311 goto err;
1312 }
1313 if (ENGINE_init(conn->engine) != 1) {
1314 wpa_printf(MSG_ERROR, "ENGINE: engine init failed "
1315 "(engine: %s) [%s]", engine_id,
1316 ERR_error_string(ERR_get_error(), NULL));
1317 goto err;
1318 }
1319 wpa_printf(MSG_DEBUG, "ENGINE: engine initialized");
1320
1321 #ifndef ANDROID
1322 if (pin && ENGINE_ctrl_cmd_string(conn->engine, "PIN", pin, 0) == 0) {
1323 wpa_printf(MSG_ERROR, "ENGINE: cannot set pin [%s]",
1324 ERR_error_string(ERR_get_error(), NULL));
1325 goto err;
1326 }
1327 #endif
1328 if (key_id) {
1329 /*
1330 * Ensure that the ENGINE does not attempt to use the OpenSSL
1331 * UI system to obtain a PIN, if we didn't provide one.
1332 */
1333 struct {
1334 const void *password;
1335 const char *prompt_info;
1336 } key_cb = { "", NULL };
1337
1338 /* load private key first in-case PIN is required for cert */
1339 conn->private_key = ENGINE_load_private_key(conn->engine,
1340 key_id, NULL,
1341 &key_cb);
1342 if (!conn->private_key) {
1343 unsigned long err = ERR_get_error();
1344
1345 wpa_printf(MSG_ERROR,
1346 "ENGINE: cannot load private key with id '%s' [%s]",
1347 key_id,
1348 ERR_error_string(err, NULL));
1349 if (tls_is_pin_error(err))
1350 ret = TLS_SET_PARAMS_ENGINE_PRV_BAD_PIN;
1351 else
1352 ret = TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
1353 goto err;
1354 }
1355 }
1356
1357 /* handle a certificate and/or CA certificate */
1358 if (cert_id || ca_cert_id) {
1359 const char *cmd_name = "LOAD_CERT_CTRL";
1360
1361 /* test if the engine supports a LOAD_CERT_CTRL */
1362 if (!ENGINE_ctrl(conn->engine, ENGINE_CTRL_GET_CMD_FROM_NAME,
1363 0, (void *)cmd_name, NULL)) {
1364 wpa_printf(MSG_ERROR, "ENGINE: engine does not support"
1365 " loading certificates");
1366 ret = TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
1367 goto err;
1368 }
1369 }
1370
1371 return 0;
1372
1373 err:
1374 if (conn->engine) {
1375 ENGINE_free(conn->engine);
1376 conn->engine = NULL;
1377 }
1378
1379 if (conn->private_key) {
1380 EVP_PKEY_free(conn->private_key);
1381 conn->private_key = NULL;
1382 }
1383
1384 return ret;
1385 #else /* OPENSSL_NO_ENGINE */
1386 return 0;
1387 #endif /* OPENSSL_NO_ENGINE */
1388 }
1389
1390
tls_engine_deinit(struct tls_connection * conn)1391 static void tls_engine_deinit(struct tls_connection *conn)
1392 {
1393 #if defined(ANDROID) || !defined(OPENSSL_NO_ENGINE)
1394 wpa_printf(MSG_DEBUG, "ENGINE: engine deinit");
1395 if (conn->private_key) {
1396 EVP_PKEY_free(conn->private_key);
1397 conn->private_key = NULL;
1398 }
1399 if (conn->engine) {
1400 #if !defined(OPENSSL_IS_BORINGSSL)
1401 ENGINE_finish(conn->engine);
1402 #endif /* !OPENSSL_IS_BORINGSSL */
1403 conn->engine = NULL;
1404 }
1405 #endif /* ANDROID || !OPENSSL_NO_ENGINE */
1406 }
1407
1408
tls_get_errors(void * ssl_ctx)1409 int tls_get_errors(void *ssl_ctx)
1410 {
1411 int count = 0;
1412 unsigned long err;
1413
1414 while ((err = ERR_get_error())) {
1415 wpa_printf(MSG_INFO, "TLS - SSL error: %s",
1416 ERR_error_string(err, NULL));
1417 count++;
1418 }
1419
1420 return count;
1421 }
1422
1423
openssl_content_type(int content_type)1424 static const char * openssl_content_type(int content_type)
1425 {
1426 switch (content_type) {
1427 case 20:
1428 return "change cipher spec";
1429 case 21:
1430 return "alert";
1431 case 22:
1432 return "handshake";
1433 case 23:
1434 return "application data";
1435 case 24:
1436 return "heartbeat";
1437 case 256:
1438 return "TLS header info"; /* pseudo content type */
1439 case 257:
1440 return "inner content type"; /* pseudo content type */
1441 default:
1442 return "?";
1443 }
1444 }
1445
1446
openssl_handshake_type(int content_type,const u8 * buf,size_t len)1447 static const char * openssl_handshake_type(int content_type, const u8 *buf,
1448 size_t len)
1449 {
1450 if (content_type == 257 && buf && len == 1)
1451 return openssl_content_type(buf[0]);
1452 if (content_type != 22 || !buf || len == 0)
1453 return "";
1454 switch (buf[0]) {
1455 case 0:
1456 return "hello request";
1457 case 1:
1458 return "client hello";
1459 case 2:
1460 return "server hello";
1461 case 3:
1462 return "hello verify request";
1463 case 4:
1464 return "new session ticket";
1465 case 5:
1466 return "end of early data";
1467 case 6:
1468 return "hello retry request";
1469 case 8:
1470 return "encrypted extensions";
1471 case 11:
1472 return "certificate";
1473 case 12:
1474 return "server key exchange";
1475 case 13:
1476 return "certificate request";
1477 case 14:
1478 return "server hello done";
1479 case 15:
1480 return "certificate verify";
1481 case 16:
1482 return "client key exchange";
1483 case 20:
1484 return "finished";
1485 case 21:
1486 return "certificate url";
1487 case 22:
1488 return "certificate status";
1489 case 23:
1490 return "supplemental data";
1491 case 24:
1492 return "key update";
1493 case 254:
1494 return "message hash";
1495 default:
1496 return "?";
1497 }
1498 }
1499
1500
1501 #ifdef CONFIG_SUITEB
1502
check_server_hello(struct tls_connection * conn,const u8 * pos,const u8 * end)1503 static void check_server_hello(struct tls_connection *conn,
1504 const u8 *pos, const u8 *end)
1505 {
1506 size_t payload_len, id_len;
1507
1508 /*
1509 * Parse ServerHello to get the selected cipher suite since OpenSSL does
1510 * not make it cleanly available during handshake and we need to know
1511 * whether DHE was selected.
1512 */
1513
1514 if (end - pos < 3)
1515 return;
1516 payload_len = WPA_GET_BE24(pos);
1517 pos += 3;
1518
1519 if ((size_t) (end - pos) < payload_len)
1520 return;
1521 end = pos + payload_len;
1522
1523 /* Skip Version and Random */
1524 if (end - pos < 2 + SSL3_RANDOM_SIZE)
1525 return;
1526 pos += 2 + SSL3_RANDOM_SIZE;
1527
1528 /* Skip Session ID */
1529 if (end - pos < 1)
1530 return;
1531 id_len = *pos++;
1532 if ((size_t) (end - pos) < id_len)
1533 return;
1534 pos += id_len;
1535
1536 if (end - pos < 2)
1537 return;
1538 conn->cipher_suite = WPA_GET_BE16(pos);
1539 wpa_printf(MSG_DEBUG, "OpenSSL: Server selected cipher suite 0x%x",
1540 conn->cipher_suite);
1541 }
1542
1543
check_server_key_exchange(SSL * ssl,struct tls_connection * conn,const u8 * pos,const u8 * end)1544 static void check_server_key_exchange(SSL *ssl, struct tls_connection *conn,
1545 const u8 *pos, const u8 *end)
1546 {
1547 size_t payload_len;
1548 u16 dh_len;
1549 BIGNUM *p;
1550 int bits;
1551
1552 if (!(conn->flags & TLS_CONN_SUITEB))
1553 return;
1554
1555 /* DHE is enabled only with DHE-RSA-AES256-GCM-SHA384 */
1556 if (conn->cipher_suite != 0x9f)
1557 return;
1558
1559 if (end - pos < 3)
1560 return;
1561 payload_len = WPA_GET_BE24(pos);
1562 pos += 3;
1563
1564 if ((size_t) (end - pos) < payload_len)
1565 return;
1566 end = pos + payload_len;
1567
1568 if (end - pos < 2)
1569 return;
1570 dh_len = WPA_GET_BE16(pos);
1571 pos += 2;
1572
1573 if ((size_t) (end - pos) < dh_len)
1574 return;
1575 p = BN_bin2bn(pos, dh_len, NULL);
1576 if (!p)
1577 return;
1578
1579 bits = BN_num_bits(p);
1580 BN_free(p);
1581
1582 conn->server_dh_prime_len = bits;
1583 wpa_printf(MSG_DEBUG, "OpenSSL: Server DH prime length: %d bits",
1584 conn->server_dh_prime_len);
1585 }
1586
1587 #endif /* CONFIG_SUITEB */
1588
1589
tls_msg_cb(int write_p,int version,int content_type,const void * buf,size_t len,SSL * ssl,void * arg)1590 static void tls_msg_cb(int write_p, int version, int content_type,
1591 const void *buf, size_t len, SSL *ssl, void *arg)
1592 {
1593 struct tls_connection *conn = arg;
1594 const u8 *pos = buf;
1595
1596 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
1597 if ((SSL_version(ssl) == TLS1_VERSION ||
1598 SSL_version(ssl) == TLS1_1_VERSION) &&
1599 SSL_get_security_level(ssl) > 0) {
1600 wpa_printf(MSG_DEBUG,
1601 "OpenSSL: Drop security level to 0 to allow TLS 1.0/1.1 use of MD5-SHA1 signature algorithm");
1602 SSL_set_security_level(ssl, 0);
1603 }
1604 #endif /* OpenSSL version >= 3.0 */
1605 if (write_p == 2) {
1606 wpa_printf(MSG_DEBUG,
1607 "OpenSSL: session ver=0x%x content_type=%d",
1608 version, content_type);
1609 wpa_hexdump_key(MSG_MSGDUMP, "OpenSSL: Data", buf, len);
1610 return;
1611 }
1612
1613 wpa_printf(MSG_EXCESSIVE, "OpenSSL: %s ver=0x%x content_type=%d (%s/%s)",
1614 write_p ? "TX" : "RX", version, content_type,
1615 openssl_content_type(content_type),
1616 openssl_handshake_type(content_type, buf, len));
1617 wpa_hexdump_key(MSG_MSGDUMP, "OpenSSL: Message", buf, len);
1618 if (content_type == 24 && len >= 3 && pos[0] == 1) {
1619 size_t payload_len = WPA_GET_BE16(pos + 1);
1620 if (payload_len + 3 > len) {
1621 wpa_printf(MSG_ERROR, "OpenSSL: Heartbeat attack detected");
1622 conn->invalid_hb_used = 1;
1623 }
1624 }
1625
1626 #ifdef CONFIG_SUITEB
1627 /*
1628 * Need to parse these handshake messages to be able to check DH prime
1629 * length since OpenSSL does not expose the new cipher suite and DH
1630 * parameters during handshake (e.g., for cert_cb() callback).
1631 */
1632 if (content_type == 22 && pos && len > 0 && pos[0] == 2)
1633 check_server_hello(conn, pos + 1, pos + len);
1634 if (content_type == 22 && pos && len > 0 && pos[0] == 12)
1635 check_server_key_exchange(ssl, conn, pos + 1, pos + len);
1636 #endif /* CONFIG_SUITEB */
1637 }
1638
1639
1640 #ifdef CONFIG_TESTING_OPTIONS
1641 #if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER)
1642 /*
1643 * By setting the environment variable SSLKEYLOGFILE to a filename keying
1644 * material will be exported that you may use with Wireshark to decode any
1645 * TLS flows. Please see the following for more details:
1646 *
1647 * https://gitlab.com/wireshark/wireshark/-/wikis/TLS#tls-decryption
1648 *
1649 * Example logging sessions are (you should delete the file on each run):
1650 *
1651 * rm -f /tmp/sslkey.log
1652 * env SSLKEYLOGFILE=/tmp/sslkey.log hostapd ...
1653 *
1654 * rm -f /tmp/sslkey.log
1655 * env SSLKEYLOGFILE=/tmp/sslkey.log wpa_supplicant ...
1656 *
1657 * rm -f /tmp/sslkey.log
1658 * env SSLKEYLOGFILE=/tmp/sslkey.log eapol_test ...
1659 */
tls_keylog_cb(const SSL * ssl,const char * line)1660 static void tls_keylog_cb(const SSL *ssl, const char *line)
1661 {
1662 int fd;
1663 const char *filename;
1664 struct iovec iov[2];
1665
1666 filename = getenv("SSLKEYLOGFILE");
1667 if (!filename)
1668 return;
1669
1670 fd = open(filename, O_WRONLY | O_CREAT | O_APPEND, S_IRUSR | S_IWUSR);
1671 if (fd < 0) {
1672 wpa_printf(MSG_ERROR,
1673 "OpenSSL: Failed to open keylog file %s: %s",
1674 filename, strerror(errno));
1675 return;
1676 }
1677
1678 /* Assume less than _POSIX_PIPE_BUF (512) where writes are guaranteed
1679 * to be atomic for O_APPEND. */
1680 iov[0].iov_base = (void *) line;
1681 iov[0].iov_len = os_strlen(line);
1682 iov[1].iov_base = "\n";
1683 iov[1].iov_len = 1;
1684
1685 if (writev(fd, iov, ARRAY_SIZE(iov)) < 01) {
1686 wpa_printf(MSG_DEBUG,
1687 "OpenSSL: Failed to write to keylog file %s: %s",
1688 filename, strerror(errno));
1689 }
1690
1691 close(fd);
1692 }
1693 #endif
1694 #endif /* CONFIG_TESTING_OPTIONS */
1695
1696
tls_connection_init(void * ssl_ctx)1697 struct tls_connection * tls_connection_init(void *ssl_ctx)
1698 {
1699 struct tls_data *data = ssl_ctx;
1700 SSL_CTX *ssl = data->ssl;
1701 struct tls_connection *conn;
1702 long options;
1703 X509_STORE *new_cert_store;
1704 struct os_reltime now;
1705 struct tls_context *context = SSL_CTX_get_app_data(ssl);
1706
1707 /* Replace X509 store if it is time to update CRL. */
1708 if (data->crl_reload_interval > 0 && os_get_reltime(&now) == 0 &&
1709 os_reltime_expired(&now, &data->crl_last_reload,
1710 data->crl_reload_interval)) {
1711 wpa_printf(MSG_INFO,
1712 "OpenSSL: Flushing X509 store with ca_cert file");
1713 new_cert_store = tls_crl_cert_reload(data->ca_cert,
1714 data->check_crl);
1715 if (!new_cert_store) {
1716 wpa_printf(MSG_ERROR,
1717 "OpenSSL: Error replacing X509 store with ca_cert file");
1718 } else {
1719 /* Replace old store */
1720 SSL_CTX_set_cert_store(ssl, new_cert_store);
1721 data->crl_last_reload = now;
1722 }
1723 }
1724
1725 conn = os_zalloc(sizeof(*conn));
1726 if (conn == NULL)
1727 return NULL;
1728 conn->data = data;
1729 conn->ssl_ctx = ssl;
1730 conn->ssl = SSL_new(ssl);
1731 if (conn->ssl == NULL) {
1732 tls_show_errors(MSG_INFO, __func__,
1733 "Failed to initialize new SSL connection");
1734 os_free(conn);
1735 return NULL;
1736 }
1737
1738 conn->context = context;
1739 SSL_set_app_data(conn->ssl, conn);
1740 SSL_set_msg_callback(conn->ssl, tls_msg_cb);
1741 SSL_set_msg_callback_arg(conn->ssl, conn);
1742 options = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
1743 SSL_OP_SINGLE_DH_USE;
1744 #ifdef SSL_OP_NO_COMPRESSION
1745 options |= SSL_OP_NO_COMPRESSION;
1746 #endif /* SSL_OP_NO_COMPRESSION */
1747 SSL_set_options(conn->ssl, options);
1748 #ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT
1749 /* Hopefully there is no need for middlebox compatibility mechanisms
1750 * when going through EAP authentication. */
1751 SSL_clear_options(conn->ssl, SSL_OP_ENABLE_MIDDLEBOX_COMPAT);
1752 #endif
1753
1754 #ifdef CONFIG_TESTING_OPTIONS
1755 #if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER)
1756 /* Set the keylog file if the admin requested it. */
1757 if (getenv("SSLKEYLOGFILE"))
1758 SSL_CTX_set_keylog_callback(conn->ssl_ctx, tls_keylog_cb);
1759 #endif
1760 #endif /* CONFIG_TESTING_OPTIONS */
1761
1762 conn->ssl_in = BIO_new(BIO_s_mem());
1763 if (!conn->ssl_in) {
1764 tls_show_errors(MSG_INFO, __func__,
1765 "Failed to create a new BIO for ssl_in");
1766 SSL_free(conn->ssl);
1767 os_free(conn);
1768 return NULL;
1769 }
1770
1771 conn->ssl_out = BIO_new(BIO_s_mem());
1772 if (!conn->ssl_out) {
1773 tls_show_errors(MSG_INFO, __func__,
1774 "Failed to create a new BIO for ssl_out");
1775 SSL_free(conn->ssl);
1776 BIO_free(conn->ssl_in);
1777 os_free(conn);
1778 return NULL;
1779 }
1780
1781 SSL_set_bio(conn->ssl, conn->ssl_in, conn->ssl_out);
1782
1783 return conn;
1784 }
1785
1786
tls_connection_deinit(void * ssl_ctx,struct tls_connection * conn)1787 void tls_connection_deinit(void *ssl_ctx, struct tls_connection *conn)
1788 {
1789 if (conn == NULL)
1790 return;
1791 if (conn->success_data) {
1792 /*
1793 * Make sure ssl_clear_bad_session() does not remove this
1794 * session.
1795 */
1796 SSL_set_quiet_shutdown(conn->ssl, 1);
1797 SSL_shutdown(conn->ssl);
1798 }
1799 SSL_free(conn->ssl);
1800 tls_engine_deinit(conn);
1801 os_free(conn->subject_match);
1802 os_free(conn->altsubject_match);
1803 os_free(conn->suffix_match);
1804 os_free(conn->domain_match);
1805 os_free(conn->check_cert_subject);
1806 os_free(conn->session_ticket);
1807 os_free(conn->peer_subject);
1808 os_free(conn);
1809 }
1810
1811
tls_connection_established(void * ssl_ctx,struct tls_connection * conn)1812 int tls_connection_established(void *ssl_ctx, struct tls_connection *conn)
1813 {
1814 return conn ? SSL_is_init_finished(conn->ssl) : 0;
1815 }
1816
1817
tls_connection_peer_serial_num(void * tls_ctx,struct tls_connection * conn)1818 char * tls_connection_peer_serial_num(void *tls_ctx,
1819 struct tls_connection *conn)
1820 {
1821 ASN1_INTEGER *ser;
1822 char *serial_num;
1823 size_t len;
1824
1825 if (!conn->peer_cert)
1826 return NULL;
1827
1828 ser = X509_get_serialNumber(conn->peer_cert);
1829 if (!ser)
1830 return NULL;
1831
1832 len = ASN1_STRING_length(ser) * 2 + 1;
1833 serial_num = os_malloc(len);
1834 if (!serial_num)
1835 return NULL;
1836 wpa_snprintf_hex_uppercase(serial_num, len,
1837 ASN1_STRING_get0_data(ser),
1838 ASN1_STRING_length(ser));
1839 return serial_num;
1840 }
1841
1842
tls_connection_shutdown(void * ssl_ctx,struct tls_connection * conn)1843 int tls_connection_shutdown(void *ssl_ctx, struct tls_connection *conn)
1844 {
1845 if (conn == NULL)
1846 return -1;
1847
1848 /* Shutdown previous TLS connection without notifying the peer
1849 * because the connection was already terminated in practice
1850 * and "close notify" shutdown alert would confuse AS. */
1851 SSL_set_quiet_shutdown(conn->ssl, 1);
1852 SSL_shutdown(conn->ssl);
1853 return SSL_clear(conn->ssl) == 1 ? 0 : -1;
1854 }
1855
1856
tls_match_altsubject_component(X509 * cert,int type,const char * value,size_t len)1857 static int tls_match_altsubject_component(X509 *cert, int type,
1858 const char *value, size_t len)
1859 {
1860 GENERAL_NAME *gen;
1861 void *ext;
1862 int found = 0;
1863 stack_index_t i;
1864
1865 ext = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL);
1866
1867 for (i = 0; ext && i < sk_GENERAL_NAME_num(ext); i++) {
1868 gen = sk_GENERAL_NAME_value(ext, i);
1869 if (gen->type != type)
1870 continue;
1871 if (os_strlen((char *) gen->d.ia5->data) == len &&
1872 os_memcmp(value, gen->d.ia5->data, len) == 0)
1873 found++;
1874 }
1875
1876 sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free);
1877
1878 return found;
1879 }
1880
1881
tls_match_altsubject(X509 * cert,const char * match)1882 static int tls_match_altsubject(X509 *cert, const char *match)
1883 {
1884 int type;
1885 const char *pos, *end;
1886 size_t len;
1887
1888 pos = match;
1889 do {
1890 if (os_strncmp(pos, "EMAIL:", 6) == 0) {
1891 type = GEN_EMAIL;
1892 pos += 6;
1893 } else if (os_strncmp(pos, "DNS:", 4) == 0) {
1894 type = GEN_DNS;
1895 pos += 4;
1896 } else if (os_strncmp(pos, "URI:", 4) == 0) {
1897 type = GEN_URI;
1898 pos += 4;
1899 } else {
1900 wpa_printf(MSG_INFO, "TLS: Invalid altSubjectName "
1901 "match '%s'", pos);
1902 return 0;
1903 }
1904 end = os_strchr(pos, ';');
1905 while (end) {
1906 if (os_strncmp(end + 1, "EMAIL:", 6) == 0 ||
1907 os_strncmp(end + 1, "DNS:", 4) == 0 ||
1908 os_strncmp(end + 1, "URI:", 4) == 0)
1909 break;
1910 end = os_strchr(end + 1, ';');
1911 }
1912 if (end)
1913 len = end - pos;
1914 else
1915 len = os_strlen(pos);
1916 if (tls_match_altsubject_component(cert, type, pos, len) > 0)
1917 return 1;
1918 pos = end + 1;
1919 } while (end);
1920
1921 return 0;
1922 }
1923
1924
1925 #ifndef CONFIG_NATIVE_WINDOWS
domain_suffix_match(const u8 * val,size_t len,const char * match,size_t match_len,int full)1926 static int domain_suffix_match(const u8 *val, size_t len, const char *match,
1927 size_t match_len, int full)
1928 {
1929 size_t i;
1930
1931 /* Check for embedded nuls that could mess up suffix matching */
1932 for (i = 0; i < len; i++) {
1933 if (val[i] == '\0') {
1934 wpa_printf(MSG_DEBUG, "TLS: Embedded null in a string - reject");
1935 return 0;
1936 }
1937 }
1938
1939 if (match_len > len || (full && match_len != len))
1940 return 0;
1941
1942 if (os_strncasecmp((const char *) val + len - match_len, match,
1943 match_len) != 0)
1944 return 0; /* no match */
1945
1946 if (match_len == len)
1947 return 1; /* exact match */
1948
1949 if (val[len - match_len - 1] == '.')
1950 return 1; /* full label match completes suffix match */
1951
1952 wpa_printf(MSG_DEBUG, "TLS: Reject due to incomplete label match");
1953 return 0;
1954 }
1955 #endif /* CONFIG_NATIVE_WINDOWS */
1956
1957
1958 struct tls_dn_field_order_cnt {
1959 u8 cn;
1960 u8 c;
1961 u8 l;
1962 u8 st;
1963 u8 o;
1964 u8 ou;
1965 u8 email;
1966 };
1967
1968
get_dn_field_index(const struct tls_dn_field_order_cnt * dn_cnt,int nid)1969 static int get_dn_field_index(const struct tls_dn_field_order_cnt *dn_cnt,
1970 int nid)
1971 {
1972 switch (nid) {
1973 case NID_commonName:
1974 return dn_cnt->cn;
1975 case NID_countryName:
1976 return dn_cnt->c;
1977 case NID_localityName:
1978 return dn_cnt->l;
1979 case NID_stateOrProvinceName:
1980 return dn_cnt->st;
1981 case NID_organizationName:
1982 return dn_cnt->o;
1983 case NID_organizationalUnitName:
1984 return dn_cnt->ou;
1985 case NID_pkcs9_emailAddress:
1986 return dn_cnt->email;
1987 default:
1988 wpa_printf(MSG_ERROR,
1989 "TLS: Unknown NID '%d' in check_cert_subject",
1990 nid);
1991 return -1;
1992 }
1993 }
1994
1995
1996 /**
1997 * match_dn_field - Match configuration DN field against Certificate DN field
1998 * @cert: Certificate
1999 * @nid: NID of DN field
2000 * @field: Field name
2001 * @value DN field value which is passed from configuration
2002 * e.g., if configuration have C=US and this argument will point to US.
2003 * @dn_cnt: DN matching context
2004 * Returns: 1 on success and 0 on failure
2005 */
match_dn_field(const X509 * cert,int nid,const char * field,const char * value,const struct tls_dn_field_order_cnt * dn_cnt)2006 static int match_dn_field(const X509 *cert, int nid, const char *field,
2007 const char *value,
2008 const struct tls_dn_field_order_cnt *dn_cnt)
2009 {
2010 int i, ret = 0, len, config_dn_field_index, match_index = 0;
2011 X509_NAME *name;
2012
2013 len = os_strlen(value);
2014 name = X509_get_subject_name((X509 *) cert);
2015
2016 /* Assign incremented cnt for every field of DN to check DN field in
2017 * right order */
2018 config_dn_field_index = get_dn_field_index(dn_cnt, nid);
2019 if (config_dn_field_index < 0)
2020 return 0;
2021
2022 /* Fetch value based on NID */
2023 for (i = -1; (i = X509_NAME_get_index_by_NID(name, nid, i)) > -1;) {
2024 X509_NAME_ENTRY *e;
2025 ASN1_STRING *cn;
2026
2027 e = X509_NAME_get_entry(name, i);
2028 if (!e)
2029 continue;
2030
2031 cn = X509_NAME_ENTRY_get_data(e);
2032 if (!cn)
2033 continue;
2034
2035 match_index++;
2036
2037 /* check for more than one DN field with same name */
2038 if (match_index != config_dn_field_index)
2039 continue;
2040
2041 /* Check wildcard at the right end side */
2042 /* E.g., if OU=develop* mentioned in configuration, allow 'OU'
2043 * of the subject in the client certificate to start with
2044 * 'develop' */
2045 if (len > 0 && value[len - 1] == '*') {
2046 /* Compare actual certificate DN field value with
2047 * configuration DN field value up to the specified
2048 * length. */
2049 ret = ASN1_STRING_length(cn) >= len - 1 &&
2050 os_memcmp(ASN1_STRING_get0_data(cn), value,
2051 len - 1) == 0;
2052 } else {
2053 /* Compare actual certificate DN field value with
2054 * configuration DN field value */
2055 ret = ASN1_STRING_length(cn) == len &&
2056 os_memcmp(ASN1_STRING_get0_data(cn), value,
2057 len) == 0;
2058 }
2059 if (!ret) {
2060 wpa_printf(MSG_ERROR,
2061 "OpenSSL: Failed to match %s '%s' with certificate DN field value '%s'",
2062 field, value, ASN1_STRING_get0_data(cn));
2063 }
2064 break;
2065 }
2066
2067 return ret;
2068 }
2069
2070
2071 /**
2072 * get_value_from_field - Get value from DN field
2073 * @cert: Certificate
2074 * @field_str: DN field string which is passed from configuration file (e.g.,
2075 * C=US)
2076 * @dn_cnt: DN matching context
2077 * Returns: 1 on success and 0 on failure
2078 */
get_value_from_field(const X509 * cert,char * field_str,struct tls_dn_field_order_cnt * dn_cnt)2079 static int get_value_from_field(const X509 *cert, char *field_str,
2080 struct tls_dn_field_order_cnt *dn_cnt)
2081 {
2082 int nid;
2083 char *context = NULL, *name, *value;
2084
2085 if (os_strcmp(field_str, "*") == 0)
2086 return 1; /* wildcard matches everything */
2087
2088 name = str_token(field_str, "=", &context);
2089 if (!name)
2090 return 0;
2091
2092 /* Compare all configured DN fields and assign nid based on that to
2093 * fetch correct value from certificate subject */
2094 if (os_strcmp(name, "CN") == 0) {
2095 nid = NID_commonName;
2096 dn_cnt->cn++;
2097 } else if(os_strcmp(name, "C") == 0) {
2098 nid = NID_countryName;
2099 dn_cnt->c++;
2100 } else if (os_strcmp(name, "L") == 0) {
2101 nid = NID_localityName;
2102 dn_cnt->l++;
2103 } else if (os_strcmp(name, "ST") == 0) {
2104 nid = NID_stateOrProvinceName;
2105 dn_cnt->st++;
2106 } else if (os_strcmp(name, "O") == 0) {
2107 nid = NID_organizationName;
2108 dn_cnt->o++;
2109 } else if (os_strcmp(name, "OU") == 0) {
2110 nid = NID_organizationalUnitName;
2111 dn_cnt->ou++;
2112 } else if (os_strcmp(name, "emailAddress") == 0) {
2113 nid = NID_pkcs9_emailAddress;
2114 dn_cnt->email++;
2115 } else {
2116 wpa_printf(MSG_ERROR,
2117 "TLS: Unknown field '%s' in check_cert_subject", name);
2118 return 0;
2119 }
2120
2121 value = str_token(field_str, "=", &context);
2122 if (!value) {
2123 wpa_printf(MSG_ERROR,
2124 "TLS: Distinguished Name field '%s' value is not defined in check_cert_subject",
2125 name);
2126 return 0;
2127 }
2128
2129 return match_dn_field(cert, nid, name, value, dn_cnt);
2130 }
2131
2132
2133 /**
2134 * tls_match_dn_field - Match subject DN field with check_cert_subject
2135 * @cert: Certificate
2136 * @match: check_cert_subject string
2137 * Returns: Return 1 on success and 0 on failure
2138 */
tls_match_dn_field(X509 * cert,const char * match)2139 static int tls_match_dn_field(X509 *cert, const char *match)
2140 {
2141 const char *token, *last = NULL;
2142 char field[256];
2143 struct tls_dn_field_order_cnt dn_cnt;
2144
2145 os_memset(&dn_cnt, 0, sizeof(dn_cnt));
2146
2147 /* Maximum length of each DN field is 255 characters */
2148
2149 /* Process each '/' delimited field */
2150 while ((token = cstr_token(match, "/", &last))) {
2151 if (last - token >= (int) sizeof(field)) {
2152 wpa_printf(MSG_ERROR,
2153 "OpenSSL: Too long DN matching field value in '%s'",
2154 match);
2155 return 0;
2156 }
2157 os_memcpy(field, token, last - token);
2158 field[last - token] = '\0';
2159
2160 if (!get_value_from_field(cert, field, &dn_cnt)) {
2161 wpa_printf(MSG_DEBUG, "OpenSSL: No match for DN '%s'",
2162 field);
2163 return 0;
2164 }
2165 }
2166
2167 return 1;
2168 }
2169
2170
2171 #ifndef CONFIG_NATIVE_WINDOWS
tls_match_suffix_helper(X509 * cert,const char * match,size_t match_len,int full)2172 static int tls_match_suffix_helper(X509 *cert, const char *match,
2173 size_t match_len, int full)
2174 {
2175 GENERAL_NAME *gen;
2176 void *ext;
2177 int i;
2178 stack_index_t j;
2179 int dns_name = 0;
2180 X509_NAME *name;
2181
2182 wpa_printf(MSG_DEBUG, "TLS: Match domain against %s%s",
2183 full ? "": "suffix ", match);
2184
2185 ext = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL);
2186
2187 for (j = 0; ext && j < sk_GENERAL_NAME_num(ext); j++) {
2188 gen = sk_GENERAL_NAME_value(ext, j);
2189 if (gen->type != GEN_DNS)
2190 continue;
2191 dns_name++;
2192 wpa_hexdump_ascii(MSG_DEBUG, "TLS: Certificate dNSName",
2193 gen->d.dNSName->data,
2194 gen->d.dNSName->length);
2195 if (domain_suffix_match(gen->d.dNSName->data,
2196 gen->d.dNSName->length,
2197 match, match_len, full) == 1) {
2198 wpa_printf(MSG_DEBUG, "TLS: %s in dNSName found",
2199 full ? "Match" : "Suffix match");
2200 sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free);
2201 return 1;
2202 }
2203 }
2204 sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free);
2205
2206 if (dns_name) {
2207 wpa_printf(MSG_DEBUG, "TLS: None of the dNSName(s) matched");
2208 return 0;
2209 }
2210
2211 name = X509_get_subject_name(cert);
2212 i = -1;
2213 for (;;) {
2214 X509_NAME_ENTRY *e;
2215 ASN1_STRING *cn;
2216
2217 i = X509_NAME_get_index_by_NID(name, NID_commonName, i);
2218 if (i == -1)
2219 break;
2220 e = X509_NAME_get_entry(name, i);
2221 if (e == NULL)
2222 continue;
2223 cn = X509_NAME_ENTRY_get_data(e);
2224 if (cn == NULL)
2225 continue;
2226 wpa_hexdump_ascii(MSG_DEBUG, "TLS: Certificate commonName",
2227 cn->data, cn->length);
2228 if (domain_suffix_match(cn->data, cn->length,
2229 match, match_len, full) == 1) {
2230 wpa_printf(MSG_DEBUG, "TLS: %s in commonName found",
2231 full ? "Match" : "Suffix match");
2232 return 1;
2233 }
2234 }
2235
2236 wpa_printf(MSG_DEBUG, "TLS: No CommonName %smatch found",
2237 full ? "": "suffix ");
2238 return 0;
2239 }
2240 #endif /* CONFIG_NATIVE_WINDOWS */
2241
2242
tls_match_suffix(X509 * cert,const char * match,int full)2243 static int tls_match_suffix(X509 *cert, const char *match, int full)
2244 {
2245 #ifdef CONFIG_NATIVE_WINDOWS
2246 /* wincrypt.h has conflicting X509_NAME definition */
2247 return -1;
2248 #else /* CONFIG_NATIVE_WINDOWS */
2249 const char *token, *last = NULL;
2250
2251 /* Process each match alternative separately until a match is found */
2252 while ((token = cstr_token(match, ";", &last))) {
2253 if (tls_match_suffix_helper(cert, token, last - token, full))
2254 return 1;
2255 }
2256
2257 return 0;
2258 #endif /* CONFIG_NATIVE_WINDOWS */
2259 }
2260
2261
openssl_tls_fail_reason(int err)2262 static enum tls_fail_reason openssl_tls_fail_reason(int err)
2263 {
2264 switch (err) {
2265 case X509_V_ERR_CERT_REVOKED:
2266 return TLS_FAIL_REVOKED;
2267 case X509_V_ERR_CERT_NOT_YET_VALID:
2268 case X509_V_ERR_CRL_NOT_YET_VALID:
2269 return TLS_FAIL_NOT_YET_VALID;
2270 case X509_V_ERR_CERT_HAS_EXPIRED:
2271 case X509_V_ERR_CRL_HAS_EXPIRED:
2272 return TLS_FAIL_EXPIRED;
2273 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
2274 case X509_V_ERR_UNABLE_TO_GET_CRL:
2275 case X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER:
2276 case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
2277 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
2278 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
2279 case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
2280 case X509_V_ERR_CERT_CHAIN_TOO_LONG:
2281 case X509_V_ERR_PATH_LENGTH_EXCEEDED:
2282 case X509_V_ERR_INVALID_CA:
2283 return TLS_FAIL_UNTRUSTED;
2284 case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
2285 case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
2286 case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY:
2287 case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
2288 case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
2289 case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD:
2290 case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:
2291 case X509_V_ERR_CERT_UNTRUSTED:
2292 case X509_V_ERR_CERT_REJECTED:
2293 return TLS_FAIL_BAD_CERTIFICATE;
2294 default:
2295 return TLS_FAIL_UNSPECIFIED;
2296 }
2297 }
2298
2299
get_x509_cert(X509 * cert)2300 static struct wpabuf * get_x509_cert(X509 *cert)
2301 {
2302 struct wpabuf *buf;
2303 u8 *tmp;
2304
2305 int cert_len = i2d_X509(cert, NULL);
2306 if (cert_len <= 0)
2307 return NULL;
2308
2309 buf = wpabuf_alloc(cert_len);
2310 if (buf == NULL)
2311 return NULL;
2312
2313 tmp = wpabuf_put(buf, cert_len);
2314 i2d_X509(cert, &tmp);
2315 return buf;
2316 }
2317
2318
openssl_tls_fail_event(struct tls_connection * conn,X509 * err_cert,int err,int depth,const char * subject,const char * err_str,enum tls_fail_reason reason)2319 static void openssl_tls_fail_event(struct tls_connection *conn,
2320 X509 *err_cert, int err, int depth,
2321 const char *subject, const char *err_str,
2322 enum tls_fail_reason reason)
2323 {
2324 union tls_event_data ev;
2325 struct wpabuf *cert = NULL;
2326 struct tls_context *context = conn->context;
2327
2328 if (context->event_cb == NULL)
2329 return;
2330
2331 cert = get_x509_cert(err_cert);
2332 os_memset(&ev, 0, sizeof(ev));
2333 ev.cert_fail.reason = reason != TLS_FAIL_UNSPECIFIED ?
2334 reason : openssl_tls_fail_reason(err);
2335 ev.cert_fail.depth = depth;
2336 ev.cert_fail.subject = subject;
2337 ev.cert_fail.reason_txt = err_str;
2338 ev.cert_fail.cert = cert;
2339 context->event_cb(context->cb_ctx, TLS_CERT_CHAIN_FAILURE, &ev);
2340 wpabuf_free(cert);
2341 }
2342
2343
openssl_cert_tod(X509 * cert)2344 static int openssl_cert_tod(X509 *cert)
2345 {
2346 CERTIFICATEPOLICIES *ext;
2347 stack_index_t i;
2348 char buf[100];
2349 int res;
2350 int tod = 0;
2351
2352 ext = X509_get_ext_d2i(cert, NID_certificate_policies, NULL, NULL);
2353 if (!ext)
2354 return 0;
2355
2356 for (i = 0; i < sk_POLICYINFO_num(ext); i++) {
2357 POLICYINFO *policy;
2358
2359 policy = sk_POLICYINFO_value(ext, i);
2360 res = OBJ_obj2txt(buf, sizeof(buf), policy->policyid, 0);
2361 if (res < 0 || (size_t) res >= sizeof(buf))
2362 continue;
2363 wpa_printf(MSG_DEBUG, "OpenSSL: Certificate Policy %s", buf);
2364 if (os_strcmp(buf, "1.3.6.1.4.1.40808.1.3.1") == 0)
2365 tod = 1; /* TOD-STRICT */
2366 else if (os_strcmp(buf, "1.3.6.1.4.1.40808.1.3.2") == 0 && !tod)
2367 tod = 2; /* TOD-TOFU */
2368 }
2369 sk_POLICYINFO_pop_free(ext, POLICYINFO_free);
2370
2371 return tod;
2372 }
2373
2374
openssl_tls_cert_event(struct tls_connection * conn,X509 * err_cert,int depth,const char * subject)2375 static void openssl_tls_cert_event(struct tls_connection *conn,
2376 X509 *err_cert, int depth,
2377 const char *subject)
2378 {
2379 struct wpabuf *cert = NULL;
2380 union tls_event_data ev;
2381 struct tls_context *context = conn->context;
2382 char *altsubject[TLS_MAX_ALT_SUBJECT];
2383 int alt, num_altsubject = 0;
2384 GENERAL_NAME *gen;
2385 void *ext;
2386 stack_index_t i;
2387 ASN1_INTEGER *ser;
2388 char serial_num[128];
2389 #ifdef CONFIG_SHA256
2390 u8 hash[32];
2391 #endif /* CONFIG_SHA256 */
2392
2393 if (context->event_cb == NULL)
2394 return;
2395
2396 os_memset(&ev, 0, sizeof(ev));
2397 if (conn->cert_probe || (conn->flags & TLS_CONN_EXT_CERT_CHECK) ||
2398 context->cert_in_cb) {
2399 cert = get_x509_cert(err_cert);
2400 ev.peer_cert.cert = cert;
2401 }
2402 #ifdef CONFIG_SHA256
2403 if (cert) {
2404 const u8 *addr[1];
2405 size_t len[1];
2406 addr[0] = wpabuf_head(cert);
2407 len[0] = wpabuf_len(cert);
2408 if (sha256_vector(1, addr, len, hash) == 0) {
2409 ev.peer_cert.hash = hash;
2410 ev.peer_cert.hash_len = sizeof(hash);
2411 }
2412 }
2413 #endif /* CONFIG_SHA256 */
2414 ev.peer_cert.depth = depth;
2415 ev.peer_cert.subject = subject;
2416
2417 ser = X509_get_serialNumber(err_cert);
2418 if (ser) {
2419 wpa_snprintf_hex_uppercase(serial_num, sizeof(serial_num),
2420 ASN1_STRING_get0_data(ser),
2421 ASN1_STRING_length(ser));
2422 ev.peer_cert.serial_num = serial_num;
2423 }
2424
2425 ext = X509_get_ext_d2i(err_cert, NID_subject_alt_name, NULL, NULL);
2426 for (i = 0; ext && i < sk_GENERAL_NAME_num(ext); i++) {
2427 char *pos;
2428
2429 if (num_altsubject == TLS_MAX_ALT_SUBJECT)
2430 break;
2431 gen = sk_GENERAL_NAME_value(ext, i);
2432 if (gen->type != GEN_EMAIL &&
2433 gen->type != GEN_DNS &&
2434 gen->type != GEN_URI)
2435 continue;
2436
2437 pos = os_malloc(10 + gen->d.ia5->length + 1);
2438 if (pos == NULL)
2439 break;
2440 altsubject[num_altsubject++] = pos;
2441
2442 switch (gen->type) {
2443 case GEN_EMAIL:
2444 os_memcpy(pos, "EMAIL:", 6);
2445 pos += 6;
2446 break;
2447 case GEN_DNS:
2448 os_memcpy(pos, "DNS:", 4);
2449 pos += 4;
2450 break;
2451 case GEN_URI:
2452 os_memcpy(pos, "URI:", 4);
2453 pos += 4;
2454 break;
2455 }
2456
2457 os_memcpy(pos, gen->d.ia5->data, gen->d.ia5->length);
2458 pos += gen->d.ia5->length;
2459 *pos = '\0';
2460 }
2461 sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free);
2462
2463 for (alt = 0; alt < num_altsubject; alt++)
2464 ev.peer_cert.altsubject[alt] = altsubject[alt];
2465 ev.peer_cert.num_altsubject = num_altsubject;
2466
2467 ev.peer_cert.tod = openssl_cert_tod(err_cert);
2468
2469 context->event_cb(context->cb_ctx, TLS_PEER_CERTIFICATE, &ev);
2470 wpabuf_free(cert);
2471 for (alt = 0; alt < num_altsubject; alt++)
2472 os_free(altsubject[alt]);
2473 }
2474
2475
debug_print_cert(X509 * cert,const char * title)2476 static void debug_print_cert(X509 *cert, const char *title)
2477 {
2478 #ifndef CONFIG_NO_STDOUT_DEBUG
2479 BIO *out;
2480 size_t rlen;
2481 char *txt;
2482 int res;
2483
2484 if (wpa_debug_level > MSG_DEBUG)
2485 return;
2486
2487 out = BIO_new(BIO_s_mem());
2488 if (!out)
2489 return;
2490
2491 X509_print(out, cert);
2492 rlen = BIO_ctrl_pending(out);
2493 txt = os_malloc(rlen + 1);
2494 if (txt) {
2495 res = BIO_read(out, txt, rlen);
2496 if (res > 0) {
2497 txt[res] = '\0';
2498 wpa_printf(MSG_DEBUG, "OpenSSL: %s\n%s", title, txt);
2499 }
2500 os_free(txt);
2501 }
2502
2503 BIO_free(out);
2504 #endif /* CONFIG_NO_STDOUT_DEBUG */
2505 }
2506
2507
tls_verify_cb(int preverify_ok,X509_STORE_CTX * x509_ctx)2508 static int tls_verify_cb(int preverify_ok, X509_STORE_CTX *x509_ctx)
2509 {
2510 char buf[256];
2511 X509 *err_cert;
2512 int err, depth;
2513 SSL *ssl;
2514 struct tls_connection *conn;
2515 struct tls_context *context;
2516 char *match, *altmatch, *suffix_match, *domain_match;
2517 const char *check_cert_subject;
2518 const char *err_str;
2519
2520 err_cert = X509_STORE_CTX_get_current_cert(x509_ctx);
2521 if (!err_cert)
2522 return 0;
2523
2524 err = X509_STORE_CTX_get_error(x509_ctx);
2525 depth = X509_STORE_CTX_get_error_depth(x509_ctx);
2526 ssl = X509_STORE_CTX_get_ex_data(x509_ctx,
2527 SSL_get_ex_data_X509_STORE_CTX_idx());
2528 os_snprintf(buf, sizeof(buf), "Peer certificate - depth %d", depth);
2529 debug_print_cert(err_cert, buf);
2530 X509_NAME_oneline(X509_get_subject_name(err_cert), buf, sizeof(buf));
2531
2532 conn = SSL_get_app_data(ssl);
2533 if (conn == NULL)
2534 return 0;
2535
2536 if (depth == 0)
2537 conn->peer_cert = err_cert;
2538 else if (depth == 1)
2539 conn->peer_issuer = err_cert;
2540 else if (depth == 2)
2541 conn->peer_issuer_issuer = err_cert;
2542
2543 context = conn->context;
2544 match = conn->subject_match;
2545 altmatch = conn->altsubject_match;
2546 suffix_match = conn->suffix_match;
2547 domain_match = conn->domain_match;
2548
2549 if (!preverify_ok && !conn->ca_cert_verify)
2550 preverify_ok = 1;
2551 if (!preverify_ok && depth > 0 && conn->server_cert_only)
2552 preverify_ok = 1;
2553 if (!preverify_ok && (conn->flags & TLS_CONN_DISABLE_TIME_CHECKS) &&
2554 (err == X509_V_ERR_CERT_HAS_EXPIRED ||
2555 err == X509_V_ERR_CERT_NOT_YET_VALID)) {
2556 wpa_printf(MSG_DEBUG, "OpenSSL: Ignore certificate validity "
2557 "time mismatch");
2558 preverify_ok = 1;
2559 }
2560 if (!preverify_ok && !conn->data->check_crl_strict &&
2561 (err == X509_V_ERR_CRL_HAS_EXPIRED ||
2562 err == X509_V_ERR_CRL_NOT_YET_VALID)) {
2563 wpa_printf(MSG_DEBUG,
2564 "OpenSSL: Ignore certificate validity CRL time mismatch");
2565 preverify_ok = 1;
2566 }
2567
2568 err_str = X509_verify_cert_error_string(err);
2569
2570 #ifdef CONFIG_SHA256
2571 /*
2572 * Do not require preverify_ok so we can explicity allow otherwise
2573 * invalid pinned server certificates.
2574 */
2575 if (depth == 0 && conn->server_cert_only) {
2576 struct wpabuf *cert;
2577 cert = get_x509_cert(err_cert);
2578 if (!cert) {
2579 wpa_printf(MSG_DEBUG, "OpenSSL: Could not fetch "
2580 "server certificate data");
2581 preverify_ok = 0;
2582 } else {
2583 u8 hash[32];
2584 const u8 *addr[1];
2585 size_t len[1];
2586 addr[0] = wpabuf_head(cert);
2587 len[0] = wpabuf_len(cert);
2588 if (sha256_vector(1, addr, len, hash) < 0 ||
2589 os_memcmp(conn->srv_cert_hash, hash, 32) != 0) {
2590 err_str = "Server certificate mismatch";
2591 err = X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN;
2592 preverify_ok = 0;
2593 } else if (!preverify_ok) {
2594 /*
2595 * Certificate matches pinned certificate, allow
2596 * regardless of other problems.
2597 */
2598 wpa_printf(MSG_DEBUG,
2599 "OpenSSL: Ignore validation issues for a pinned server certificate");
2600 preverify_ok = 1;
2601 }
2602 wpabuf_free(cert);
2603 }
2604 }
2605 #endif /* CONFIG_SHA256 */
2606
2607 openssl_tls_cert_event(conn, err_cert, depth, buf);
2608
2609 if (!preverify_ok) {
2610 if (depth > 0) {
2611 /* Send cert event for the peer certificate so that
2612 * the upper layers get information about it even if
2613 * validation of a CA certificate fails. */
2614 STACK_OF(X509) *chain;
2615
2616 chain = X509_STORE_CTX_get1_chain(x509_ctx);
2617 if (chain && sk_X509_num(chain) > 0) {
2618 char buf2[256];
2619 X509 *cert;
2620
2621 cert = sk_X509_value(chain, 0);
2622 X509_NAME_oneline(X509_get_subject_name(cert),
2623 buf2, sizeof(buf2));
2624
2625 openssl_tls_cert_event(conn, cert, 0, buf2);
2626 }
2627 if (chain)
2628 sk_X509_pop_free(chain, X509_free);
2629 }
2630
2631 wpa_printf(MSG_WARNING, "TLS: Certificate verification failed,"
2632 " error %d (%s) depth %d for '%s'", err, err_str,
2633 depth, buf);
2634 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2635 err_str, TLS_FAIL_UNSPECIFIED);
2636 return preverify_ok;
2637 }
2638
2639 wpa_printf(MSG_EXCESSIVE, "TLS: tls_verify_cb - preverify_ok=%d "
2640 "err=%d (%s) ca_cert_verify=%d depth=%d buf='%s'",
2641 preverify_ok, err, err_str,
2642 conn->ca_cert_verify, depth, buf);
2643 check_cert_subject = conn->check_cert_subject;
2644 if (!check_cert_subject)
2645 check_cert_subject = conn->data->check_cert_subject;
2646 if (check_cert_subject) {
2647 if (depth == 0 &&
2648 !tls_match_dn_field(err_cert, check_cert_subject)) {
2649 preverify_ok = 0;
2650 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2651 "Distinguished Name",
2652 TLS_FAIL_DN_MISMATCH);
2653 }
2654 }
2655 if (depth == 0 && match && os_strstr(buf, match) == NULL) {
2656 wpa_printf(MSG_WARNING, "TLS: Subject '%s' did not "
2657 "match with '%s'", buf, match);
2658 preverify_ok = 0;
2659 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2660 "Subject mismatch",
2661 TLS_FAIL_SUBJECT_MISMATCH);
2662 } else if (depth == 0 && altmatch &&
2663 !tls_match_altsubject(err_cert, altmatch)) {
2664 wpa_printf(MSG_WARNING, "TLS: altSubjectName match "
2665 "'%s' not found", altmatch);
2666 preverify_ok = 0;
2667 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2668 "AltSubject mismatch",
2669 TLS_FAIL_ALTSUBJECT_MISMATCH);
2670 } else if (depth == 0 && suffix_match &&
2671 !tls_match_suffix(err_cert, suffix_match, 0)) {
2672 wpa_printf(MSG_WARNING, "TLS: Domain suffix match '%s' not found",
2673 suffix_match);
2674 preverify_ok = 0;
2675 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2676 "Domain suffix mismatch",
2677 TLS_FAIL_DOMAIN_SUFFIX_MISMATCH);
2678 } else if (depth == 0 && domain_match &&
2679 !tls_match_suffix(err_cert, domain_match, 1)) {
2680 wpa_printf(MSG_WARNING, "TLS: Domain match '%s' not found",
2681 domain_match);
2682 preverify_ok = 0;
2683 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2684 "Domain mismatch",
2685 TLS_FAIL_DOMAIN_MISMATCH);
2686 }
2687
2688 if (conn->cert_probe && preverify_ok && depth == 0) {
2689 wpa_printf(MSG_DEBUG, "OpenSSL: Reject server certificate "
2690 "on probe-only run");
2691 preverify_ok = 0;
2692 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2693 "Server certificate chain probe",
2694 TLS_FAIL_SERVER_CHAIN_PROBE);
2695 }
2696
2697 #ifdef CONFIG_SUITEB
2698 if (conn->flags & TLS_CONN_SUITEB) {
2699 EVP_PKEY *pk;
2700 int len = -1;
2701
2702 pk = X509_get_pubkey(err_cert);
2703 if (pk) {
2704 len = EVP_PKEY_bits(pk);
2705 EVP_PKEY_free(pk);
2706 }
2707
2708 if (len >= 0) {
2709 wpa_printf(MSG_DEBUG,
2710 "OpenSSL: RSA modulus size: %d bits", len);
2711 if (len < 3072) {
2712 preverify_ok = 0;
2713 openssl_tls_fail_event(
2714 conn, err_cert, err,
2715 depth, buf,
2716 "Insufficient RSA modulus size",
2717 TLS_FAIL_INSUFFICIENT_KEY_LEN);
2718 }
2719 }
2720 }
2721 #endif /* CONFIG_SUITEB */
2722
2723 #ifdef OPENSSL_IS_BORINGSSL
2724 if (depth == 0 && (conn->flags & TLS_CONN_REQUEST_OCSP) &&
2725 preverify_ok) {
2726 enum ocsp_result res;
2727
2728 res = check_ocsp_resp(conn->ssl_ctx, conn->ssl, err_cert,
2729 conn->peer_issuer,
2730 conn->peer_issuer_issuer);
2731 if (res == OCSP_REVOKED) {
2732 preverify_ok = 0;
2733 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2734 "certificate revoked",
2735 TLS_FAIL_REVOKED);
2736 if (err == X509_V_OK)
2737 X509_STORE_CTX_set_error(
2738 x509_ctx, X509_V_ERR_CERT_REVOKED);
2739 } else if (res != OCSP_GOOD &&
2740 (conn->flags & TLS_CONN_REQUIRE_OCSP)) {
2741 preverify_ok = 0;
2742 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2743 "bad certificate status response",
2744 TLS_FAIL_UNSPECIFIED);
2745 }
2746 }
2747 #endif /* OPENSSL_IS_BORINGSSL */
2748
2749 if (depth == 0 && preverify_ok && context->event_cb != NULL)
2750 context->event_cb(context->cb_ctx,
2751 TLS_CERT_CHAIN_SUCCESS, NULL);
2752
2753 if (depth == 0 && preverify_ok) {
2754 os_free(conn->peer_subject);
2755 conn->peer_subject = os_strdup(buf);
2756 }
2757
2758 return preverify_ok;
2759 }
2760
2761
2762 #ifndef OPENSSL_NO_STDIO
tls_load_ca_der(struct tls_data * data,const char * ca_cert)2763 static int tls_load_ca_der(struct tls_data *data, const char *ca_cert)
2764 {
2765 SSL_CTX *ssl_ctx = data->ssl;
2766 X509_LOOKUP *lookup;
2767 int ret = 0;
2768
2769 lookup = X509_STORE_add_lookup(SSL_CTX_get_cert_store(ssl_ctx),
2770 X509_LOOKUP_file());
2771 if (lookup == NULL) {
2772 tls_show_errors(MSG_WARNING, __func__,
2773 "Failed add lookup for X509 store");
2774 return -1;
2775 }
2776
2777 if (!X509_LOOKUP_load_file(lookup, ca_cert, X509_FILETYPE_ASN1)) {
2778 unsigned long err = ERR_peek_error();
2779 tls_show_errors(MSG_WARNING, __func__,
2780 "Failed load CA in DER format");
2781 if (ERR_GET_LIB(err) == ERR_LIB_X509 &&
2782 ERR_GET_REASON(err) == X509_R_CERT_ALREADY_IN_HASH_TABLE) {
2783 wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring "
2784 "cert already in hash table error",
2785 __func__);
2786 } else
2787 ret = -1;
2788 }
2789
2790 return ret;
2791 }
2792 #endif /* OPENSSL_NO_STDIO */
2793
2794
tls_connection_ca_cert(struct tls_data * data,struct tls_connection * conn,const char * ca_cert,const u8 * ca_cert_blob,size_t ca_cert_blob_len,const char * ca_path)2795 static int tls_connection_ca_cert(struct tls_data *data,
2796 struct tls_connection *conn,
2797 const char *ca_cert, const u8 *ca_cert_blob,
2798 size_t ca_cert_blob_len, const char *ca_path)
2799 {
2800 SSL_CTX *ssl_ctx = data->ssl;
2801 X509_STORE *store;
2802
2803 /*
2804 * Remove previously configured trusted CA certificates before adding
2805 * new ones.
2806 */
2807 store = X509_STORE_new();
2808 if (store == NULL) {
2809 wpa_printf(MSG_DEBUG, "OpenSSL: %s - failed to allocate new "
2810 "certificate store", __func__);
2811 return -1;
2812 }
2813 SSL_CTX_set_cert_store(ssl_ctx, store);
2814
2815 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);
2816 conn->ca_cert_verify = 1;
2817
2818 if (ca_cert && os_strncmp(ca_cert, "probe://", 8) == 0) {
2819 wpa_printf(MSG_DEBUG, "OpenSSL: Probe for server certificate "
2820 "chain");
2821 conn->cert_probe = 1;
2822 conn->ca_cert_verify = 0;
2823 return 0;
2824 }
2825
2826 if (ca_cert && os_strncmp(ca_cert, "hash://", 7) == 0) {
2827 #ifdef CONFIG_SHA256
2828 const char *pos = ca_cert + 7;
2829 if (os_strncmp(pos, "server/sha256/", 14) != 0) {
2830 wpa_printf(MSG_DEBUG, "OpenSSL: Unsupported ca_cert "
2831 "hash value '%s'", ca_cert);
2832 return -1;
2833 }
2834 pos += 14;
2835 if (os_strlen(pos) != 32 * 2) {
2836 wpa_printf(MSG_DEBUG, "OpenSSL: Unexpected SHA256 "
2837 "hash length in ca_cert '%s'", ca_cert);
2838 return -1;
2839 }
2840 if (hexstr2bin(pos, conn->srv_cert_hash, 32) < 0) {
2841 wpa_printf(MSG_DEBUG, "OpenSSL: Invalid SHA256 hash "
2842 "value in ca_cert '%s'", ca_cert);
2843 return -1;
2844 }
2845 conn->server_cert_only = 1;
2846 wpa_printf(MSG_DEBUG, "OpenSSL: Checking only server "
2847 "certificate match");
2848 return 0;
2849 #else /* CONFIG_SHA256 */
2850 wpa_printf(MSG_INFO, "No SHA256 included in the build - "
2851 "cannot validate server certificate hash");
2852 return -1;
2853 #endif /* CONFIG_SHA256 */
2854 }
2855
2856 if (ca_cert_blob) {
2857 X509 *cert = d2i_X509(NULL,
2858 (const unsigned char **) &ca_cert_blob,
2859 ca_cert_blob_len);
2860 if (cert == NULL) {
2861 BIO *bio = BIO_new_mem_buf(ca_cert_blob,
2862 ca_cert_blob_len);
2863
2864 if (bio) {
2865 cert = PEM_read_bio_X509(bio, NULL, NULL, NULL);
2866 BIO_free(bio);
2867 }
2868
2869 if (!cert) {
2870 tls_show_errors(MSG_WARNING, __func__,
2871 "Failed to parse ca_cert_blob");
2872 return -1;
2873 }
2874
2875 while (ERR_get_error()) {
2876 /* Ignore errors from DER conversion. */
2877 }
2878 }
2879
2880 if (!X509_STORE_add_cert(SSL_CTX_get_cert_store(ssl_ctx),
2881 cert)) {
2882 unsigned long err = ERR_peek_error();
2883 tls_show_errors(MSG_WARNING, __func__,
2884 "Failed to add ca_cert_blob to "
2885 "certificate store");
2886 if (ERR_GET_LIB(err) == ERR_LIB_X509 &&
2887 ERR_GET_REASON(err) ==
2888 X509_R_CERT_ALREADY_IN_HASH_TABLE) {
2889 wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring "
2890 "cert already in hash table error",
2891 __func__);
2892 } else {
2893 X509_free(cert);
2894 return -1;
2895 }
2896 }
2897 X509_free(cert);
2898 wpa_printf(MSG_DEBUG, "OpenSSL: %s - added ca_cert_blob "
2899 "to certificate store", __func__);
2900 return 0;
2901 }
2902
2903 #ifdef ANDROID
2904 /* Single alias */
2905 if (ca_cert && os_strncmp("keystore://", ca_cert, 11) == 0) {
2906 if (tls_add_ca_from_keystore(SSL_CTX_get_cert_store(ssl_ctx),
2907 &ca_cert[11]) < 0)
2908 return -1;
2909 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);
2910 return 0;
2911 }
2912
2913 /* Multiple aliases separated by space */
2914 if (ca_cert && os_strncmp("keystores://", ca_cert, 12) == 0) {
2915 char *aliases = os_strdup(&ca_cert[12]);
2916 const char *delim = " ";
2917 int rc = 0;
2918 char *savedptr;
2919 char *alias;
2920
2921 if (!aliases)
2922 return -1;
2923 alias = strtok_r(aliases, delim, &savedptr);
2924 for (; alias; alias = strtok_r(NULL, delim, &savedptr)) {
2925 if (tls_add_ca_from_keystore_encoded(
2926 SSL_CTX_get_cert_store(ssl_ctx), alias)) {
2927 wpa_printf(MSG_WARNING,
2928 "OpenSSL: %s - Failed to add ca_cert %s from keystore",
2929 __func__, alias);
2930 rc = -1;
2931 break;
2932 }
2933 }
2934 os_free(aliases);
2935 if (rc)
2936 return rc;
2937
2938 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);
2939 return 0;
2940 }
2941 #endif /* ANDROID */
2942
2943 #ifdef CONFIG_NATIVE_WINDOWS
2944 if (ca_cert && tls_cryptoapi_ca_cert(ssl_ctx, conn->ssl, ca_cert) ==
2945 0) {
2946 wpa_printf(MSG_DEBUG, "OpenSSL: Added CA certificates from "
2947 "system certificate store");
2948 return 0;
2949 }
2950 #endif /* CONFIG_NATIVE_WINDOWS */
2951
2952 if (ca_cert || ca_path) {
2953 #ifndef OPENSSL_NO_STDIO
2954 if (SSL_CTX_load_verify_locations(ssl_ctx, ca_cert, ca_path) !=
2955 1) {
2956 tls_show_errors(MSG_WARNING, __func__,
2957 "Failed to load root certificates");
2958 if (ca_cert &&
2959 tls_load_ca_der(data, ca_cert) == 0) {
2960 wpa_printf(MSG_DEBUG, "OpenSSL: %s - loaded "
2961 "DER format CA certificate",
2962 __func__);
2963 } else
2964 return -1;
2965 } else {
2966 wpa_printf(MSG_DEBUG, "TLS: Trusted root "
2967 "certificate(s) loaded");
2968 tls_get_errors(data);
2969 }
2970 #else /* OPENSSL_NO_STDIO */
2971 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO",
2972 __func__);
2973 return -1;
2974 #endif /* OPENSSL_NO_STDIO */
2975 } else {
2976 /* No ca_cert configured - do not try to verify server
2977 * certificate */
2978 conn->ca_cert_verify = 0;
2979 }
2980
2981 return 0;
2982 }
2983
2984
tls_global_ca_cert(struct tls_data * data,const char * ca_cert)2985 static int tls_global_ca_cert(struct tls_data *data, const char *ca_cert)
2986 {
2987 SSL_CTX *ssl_ctx = data->ssl;
2988
2989 if (ca_cert) {
2990 if (SSL_CTX_load_verify_locations(ssl_ctx, ca_cert, NULL) != 1)
2991 {
2992 tls_show_errors(MSG_WARNING, __func__,
2993 "Failed to load root certificates");
2994 return -1;
2995 }
2996
2997 wpa_printf(MSG_DEBUG, "TLS: Trusted root "
2998 "certificate(s) loaded");
2999
3000 #ifndef OPENSSL_NO_STDIO
3001 /* Add the same CAs to the client certificate requests */
3002 SSL_CTX_set_client_CA_list(ssl_ctx,
3003 SSL_load_client_CA_file(ca_cert));
3004 #endif /* OPENSSL_NO_STDIO */
3005
3006 os_free(data->ca_cert);
3007 data->ca_cert = os_strdup(ca_cert);
3008 }
3009
3010 return 0;
3011 }
3012
3013
tls_global_set_verify(void * ssl_ctx,int check_crl,int strict)3014 int tls_global_set_verify(void *ssl_ctx, int check_crl, int strict)
3015 {
3016 int flags;
3017
3018 if (check_crl) {
3019 struct tls_data *data = ssl_ctx;
3020 X509_STORE *cs = SSL_CTX_get_cert_store(data->ssl);
3021 if (cs == NULL) {
3022 tls_show_errors(MSG_INFO, __func__, "Failed to get "
3023 "certificate store when enabling "
3024 "check_crl");
3025 return -1;
3026 }
3027 flags = X509_V_FLAG_CRL_CHECK;
3028 if (check_crl == 2)
3029 flags |= X509_V_FLAG_CRL_CHECK_ALL;
3030 X509_STORE_set_flags(cs, flags);
3031
3032 data->check_crl = check_crl;
3033 data->check_crl_strict = strict;
3034 os_get_reltime(&data->crl_last_reload);
3035 }
3036 return 0;
3037 }
3038
3039
tls_connection_set_subject_match(struct tls_connection * conn,const char * subject_match,const char * altsubject_match,const char * suffix_match,const char * domain_match,const char * check_cert_subject)3040 static int tls_connection_set_subject_match(struct tls_connection *conn,
3041 const char *subject_match,
3042 const char *altsubject_match,
3043 const char *suffix_match,
3044 const char *domain_match,
3045 const char *check_cert_subject)
3046 {
3047 os_free(conn->subject_match);
3048 conn->subject_match = NULL;
3049 if (subject_match) {
3050 conn->subject_match = os_strdup(subject_match);
3051 if (conn->subject_match == NULL)
3052 return -1;
3053 }
3054
3055 os_free(conn->altsubject_match);
3056 conn->altsubject_match = NULL;
3057 if (altsubject_match) {
3058 conn->altsubject_match = os_strdup(altsubject_match);
3059 if (conn->altsubject_match == NULL)
3060 return -1;
3061 }
3062
3063 os_free(conn->suffix_match);
3064 conn->suffix_match = NULL;
3065 if (suffix_match) {
3066 conn->suffix_match = os_strdup(suffix_match);
3067 if (conn->suffix_match == NULL)
3068 return -1;
3069 }
3070
3071 os_free(conn->domain_match);
3072 conn->domain_match = NULL;
3073 if (domain_match) {
3074 conn->domain_match = os_strdup(domain_match);
3075 if (conn->domain_match == NULL)
3076 return -1;
3077 }
3078
3079 os_free(conn->check_cert_subject);
3080 conn->check_cert_subject = NULL;
3081 if (check_cert_subject) {
3082 conn->check_cert_subject = os_strdup(check_cert_subject);
3083 if (!conn->check_cert_subject)
3084 return -1;
3085 }
3086
3087 return 0;
3088 }
3089
3090
3091 #ifdef CONFIG_SUITEB
suiteb_cert_cb(SSL * ssl,void * arg)3092 static int suiteb_cert_cb(SSL *ssl, void *arg)
3093 {
3094 struct tls_connection *conn = arg;
3095
3096 /*
3097 * This cert_cb() is not really the best location for doing a
3098 * constraint check for the ServerKeyExchange message, but this seems to
3099 * be the only place where the current OpenSSL sequence can be
3100 * terminated cleanly with an TLS alert going out to the server.
3101 */
3102
3103 if (!(conn->flags & TLS_CONN_SUITEB))
3104 return 1;
3105
3106 /* DHE is enabled only with DHE-RSA-AES256-GCM-SHA384 */
3107 if (conn->cipher_suite != 0x9f)
3108 return 1;
3109
3110 if (conn->server_dh_prime_len >= 3072)
3111 return 1;
3112
3113 wpa_printf(MSG_DEBUG,
3114 "OpenSSL: Server DH prime length (%d bits) not sufficient for Suite B RSA - reject handshake",
3115 conn->server_dh_prime_len);
3116 return 0;
3117 }
3118 #endif /* CONFIG_SUITEB */
3119
3120
tls_set_conn_flags(struct tls_connection * conn,unsigned int flags,const char * openssl_ciphers)3121 static int tls_set_conn_flags(struct tls_connection *conn, unsigned int flags,
3122 const char *openssl_ciphers)
3123 {
3124 SSL *ssl = conn->ssl;
3125
3126 #ifdef SSL_OP_NO_TICKET
3127 if (flags & TLS_CONN_DISABLE_SESSION_TICKET)
3128 SSL_set_options(ssl, SSL_OP_NO_TICKET);
3129 else
3130 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
3131 #endif /* SSL_OP_NO_TICKET */
3132
3133 #ifdef SSL_OP_LEGACY_SERVER_CONNECT
3134 if (flags & TLS_CONN_ALLOW_UNSAFE_RENEGOTIATION)
3135 SSL_set_options(ssl, SSL_OP_LEGACY_SERVER_CONNECT);
3136 #endif /* SSL_OP_LEGACY_SERVER_CONNECT */
3137
3138 #ifdef SSL_OP_NO_TLSv1
3139 if (flags & TLS_CONN_DISABLE_TLSv1_0)
3140 SSL_set_options(ssl, SSL_OP_NO_TLSv1);
3141 else
3142 SSL_clear_options(ssl, SSL_OP_NO_TLSv1);
3143 #endif /* SSL_OP_NO_TLSv1 */
3144 #ifdef SSL_OP_NO_TLSv1_1
3145 if (flags & TLS_CONN_DISABLE_TLSv1_1)
3146 SSL_set_options(ssl, SSL_OP_NO_TLSv1_1);
3147 else
3148 SSL_clear_options(ssl, SSL_OP_NO_TLSv1_1);
3149 #endif /* SSL_OP_NO_TLSv1_1 */
3150 #ifdef SSL_OP_NO_TLSv1_2
3151 if (flags & TLS_CONN_DISABLE_TLSv1_2)
3152 SSL_set_options(ssl, SSL_OP_NO_TLSv1_2);
3153 else
3154 SSL_clear_options(ssl, SSL_OP_NO_TLSv1_2);
3155 #endif /* SSL_OP_NO_TLSv1_2 */
3156 #ifdef SSL_OP_NO_TLSv1_3
3157 if (flags & TLS_CONN_DISABLE_TLSv1_3)
3158 SSL_set_options(ssl, SSL_OP_NO_TLSv1_3);
3159 else
3160 SSL_clear_options(ssl, SSL_OP_NO_TLSv1_3);
3161 #endif /* SSL_OP_NO_TLSv1_3 */
3162 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
3163 if (flags & (TLS_CONN_ENABLE_TLSv1_0 |
3164 TLS_CONN_ENABLE_TLSv1_1 |
3165 TLS_CONN_ENABLE_TLSv1_2)) {
3166 int version = 0;
3167
3168 /* Explicit request to enable TLS versions even if needing to
3169 * override systemwide policies. */
3170 if (flags & TLS_CONN_ENABLE_TLSv1_0)
3171 version = TLS1_VERSION;
3172 else if (flags & TLS_CONN_ENABLE_TLSv1_1)
3173 version = TLS1_1_VERSION;
3174 else if (flags & TLS_CONN_ENABLE_TLSv1_2)
3175 version = TLS1_2_VERSION;
3176 if (!version) {
3177 wpa_printf(MSG_DEBUG,
3178 "OpenSSL: Invalid TLS version configuration");
3179 return -1;
3180 }
3181
3182 if (SSL_set_min_proto_version(ssl, version) != 1) {
3183 wpa_printf(MSG_DEBUG,
3184 "OpenSSL: Failed to set minimum TLS version");
3185 return -1;
3186 }
3187 }
3188 #endif /* >= 1.1.0 */
3189 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && \
3190 !defined(LIBRESSL_VERSION_NUMBER) && \
3191 !defined(OPENSSL_IS_BORINGSSL)
3192 {
3193 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
3194 int need_level = 0;
3195 #else
3196 int need_level = 1;
3197 #endif
3198
3199 if ((flags &
3200 (TLS_CONN_ENABLE_TLSv1_0 | TLS_CONN_ENABLE_TLSv1_1)) &&
3201 SSL_get_security_level(ssl) > need_level) {
3202 /*
3203 * Need to drop to security level 1 (or 0 with OpenSSL
3204 * 3.0) to allow TLS versions older than 1.2 to be used
3205 * when explicitly enabled in configuration.
3206 */
3207 SSL_set_security_level(conn->ssl, need_level);
3208 }
3209 }
3210 #endif
3211
3212 if (!openssl_ciphers)
3213 openssl_ciphers = conn->data->openssl_ciphers;
3214
3215 #ifdef CONFIG_SUITEB
3216 #ifdef OPENSSL_IS_BORINGSSL
3217 /* Start with defaults from BoringSSL */
3218 SSL_CTX_set_verify_algorithm_prefs(conn->ssl_ctx, NULL, 0);
3219 #endif /* OPENSSL_IS_BORINGSSL */
3220 if (flags & TLS_CONN_SUITEB_NO_ECDH) {
3221 const char *ciphers = "DHE-RSA-AES256-GCM-SHA384";
3222
3223 if (openssl_ciphers) {
3224 wpa_printf(MSG_DEBUG,
3225 "OpenSSL: Override ciphers for Suite B (no ECDH): %s",
3226 openssl_ciphers);
3227 ciphers = openssl_ciphers;
3228 }
3229 if (SSL_set_cipher_list(ssl, ciphers) != 1) {
3230 wpa_printf(MSG_INFO,
3231 "OpenSSL: Failed to set Suite B ciphers");
3232 return -1;
3233 }
3234 } else if (flags & TLS_CONN_SUITEB) {
3235 #if OPENSSL_VERSION_NUMBER < 0x30000000L
3236 EC_KEY *ecdh;
3237 #endif
3238 const char *ciphers =
3239 "ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384";
3240 int nid[1] = { NID_secp384r1 };
3241
3242 if (openssl_ciphers) {
3243 wpa_printf(MSG_DEBUG,
3244 "OpenSSL: Override ciphers for Suite B: %s",
3245 openssl_ciphers);
3246 ciphers = openssl_ciphers;
3247 }
3248 if (SSL_set_cipher_list(ssl, ciphers) != 1) {
3249 wpa_printf(MSG_INFO,
3250 "OpenSSL: Failed to set Suite B ciphers");
3251 return -1;
3252 }
3253
3254 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
3255 if (SSL_set1_groups(ssl, nid, 1) != 1) {
3256 wpa_printf(MSG_INFO,
3257 "OpenSSL: Failed to set Suite B groups");
3258 return -1;
3259 }
3260
3261 #else
3262 if (SSL_set1_curves(ssl, nid, 1) != 1) {
3263 wpa_printf(MSG_INFO,
3264 "OpenSSL: Failed to set Suite B curves");
3265 return -1;
3266 }
3267
3268 ecdh = EC_KEY_new_by_curve_name(NID_secp384r1);
3269 if (!ecdh || SSL_set_tmp_ecdh(ssl, ecdh) != 1) {
3270 EC_KEY_free(ecdh);
3271 wpa_printf(MSG_INFO,
3272 "OpenSSL: Failed to set ECDH parameter");
3273 return -1;
3274 }
3275 EC_KEY_free(ecdh);
3276 #endif
3277 }
3278 if (flags & (TLS_CONN_SUITEB | TLS_CONN_SUITEB_NO_ECDH)) {
3279 #ifdef OPENSSL_IS_BORINGSSL
3280 uint16_t sigalgs[3] = { SSL_SIGN_RSA_PKCS1_SHA384 };
3281 int num = 1;
3282
3283 if (!(flags & TLS_CONN_DISABLE_TLSv1_3)) {
3284 #ifdef SSL_SIGN_ECDSA_SECP384R1_SHA384
3285 sigalgs[num++] = SSL_SIGN_ECDSA_SECP384R1_SHA384;
3286 #endif
3287 #ifdef SSL_SIGN_RSA_PSS_RSAE_SHA384
3288 sigalgs[num++] = SSL_SIGN_RSA_PSS_RSAE_SHA384;
3289 #endif
3290 }
3291
3292 if (SSL_CTX_set_verify_algorithm_prefs(conn->ssl_ctx, sigalgs,
3293 num) != 1) {
3294 wpa_printf(MSG_INFO,
3295 "OpenSSL: Failed to set Suite B sigalgs");
3296 return -1;
3297 }
3298 #else /* OPENSSL_IS_BORINGSSL */
3299 /* ECDSA+SHA384 if need to add EC support here */
3300 const char *algs = "RSA+SHA384";
3301
3302 if (!(flags & TLS_CONN_DISABLE_TLSv1_3))
3303 algs = "RSA+SHA384:ecdsa_secp384r1_sha384:rsa_pss_rsae_sha384";
3304 if (SSL_set1_sigalgs_list(ssl, algs) != 1) {
3305 wpa_printf(MSG_INFO,
3306 "OpenSSL: Failed to set Suite B sigalgs");
3307 return -1;
3308 }
3309 #endif /* OPENSSL_IS_BORINGSSL */
3310
3311 SSL_set_options(ssl, SSL_OP_NO_TLSv1);
3312 SSL_set_options(ssl, SSL_OP_NO_TLSv1_1);
3313 SSL_set_cert_cb(ssl, suiteb_cert_cb, conn);
3314 }
3315
3316 #ifdef OPENSSL_IS_BORINGSSL
3317 if (openssl_ciphers && os_strcmp(openssl_ciphers, "SUITEB192") == 0) {
3318 uint16_t sigalgs[1] = { SSL_SIGN_ECDSA_SECP384R1_SHA384 };
3319 int nid[1] = { NID_secp384r1 };
3320
3321 if (SSL_set1_curves(ssl, nid, 1) != 1) {
3322 wpa_printf(MSG_INFO,
3323 "OpenSSL: Failed to set Suite B curves");
3324 return -1;
3325 }
3326
3327 if (SSL_CTX_set_verify_algorithm_prefs(conn->ssl_ctx, sigalgs,
3328 1) != 1) {
3329 wpa_printf(MSG_INFO,
3330 "OpenSSL: Failed to set Suite B sigalgs");
3331 return -1;
3332 }
3333 }
3334 #else /* OPENSSL_IS_BORINGSSL */
3335 if (!(flags & (TLS_CONN_SUITEB | TLS_CONN_SUITEB_NO_ECDH)) &&
3336 openssl_ciphers && SSL_set_cipher_list(ssl, openssl_ciphers) != 1) {
3337 wpa_printf(MSG_INFO,
3338 "OpenSSL: Failed to set openssl_ciphers '%s'",
3339 openssl_ciphers);
3340 return -1;
3341 }
3342 #endif /* OPENSSL_IS_BORINGSSL */
3343 #else /* CONFIG_SUITEB */
3344 if (openssl_ciphers && SSL_set_cipher_list(ssl, openssl_ciphers) != 1) {
3345 wpa_printf(MSG_INFO,
3346 "OpenSSL: Failed to set openssl_ciphers '%s'",
3347 openssl_ciphers);
3348 return -1;
3349 }
3350 #endif /* CONFIG_SUITEB */
3351
3352 if (flags & TLS_CONN_TEAP_ANON_DH) {
3353 #ifndef TEAP_DH_ANON_CS
3354 #define TEAP_DH_ANON_CS \
3355 "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:" \
3356 "ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:" \
3357 "ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:" \
3358 "DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:" \
3359 "DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:" \
3360 "DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:" \
3361 "ADH-AES256-GCM-SHA384:ADH-AES128-GCM-SHA256:" \
3362 "ADH-AES256-SHA256:ADH-AES128-SHA256:ADH-AES256-SHA:ADH-AES128-SHA"
3363 #endif
3364 static const char *cs = TEAP_DH_ANON_CS;
3365
3366 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && \
3367 !defined(LIBRESSL_VERSION_NUMBER) && \
3368 !defined(OPENSSL_IS_BORINGSSL)
3369 /*
3370 * Need to drop to security level 0 to allow anonymous
3371 * cipher suites for EAP-TEAP.
3372 */
3373 SSL_set_security_level(conn->ssl, 0);
3374 #endif
3375
3376 wpa_printf(MSG_DEBUG,
3377 "OpenSSL: Enable cipher suites for anonymous EAP-TEAP provisioning: %s",
3378 cs);
3379 if (SSL_set_cipher_list(conn->ssl, cs) != 1) {
3380 tls_show_errors(MSG_INFO, __func__,
3381 "Cipher suite configuration failed");
3382 return -1;
3383 }
3384 }
3385
3386 return 0;
3387 }
3388
3389
tls_connection_set_verify(void * ssl_ctx,struct tls_connection * conn,int verify_peer,unsigned int flags,const u8 * session_ctx,size_t session_ctx_len)3390 int tls_connection_set_verify(void *ssl_ctx, struct tls_connection *conn,
3391 int verify_peer, unsigned int flags,
3392 const u8 *session_ctx, size_t session_ctx_len)
3393 {
3394 static int counter = 0;
3395 struct tls_data *data = ssl_ctx;
3396
3397 if (conn == NULL)
3398 return -1;
3399
3400 if (verify_peer == 2) {
3401 conn->ca_cert_verify = 1;
3402 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER |
3403 SSL_VERIFY_CLIENT_ONCE, tls_verify_cb);
3404 } else if (verify_peer) {
3405 conn->ca_cert_verify = 1;
3406 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER |
3407 SSL_VERIFY_FAIL_IF_NO_PEER_CERT |
3408 SSL_VERIFY_CLIENT_ONCE, tls_verify_cb);
3409 } else {
3410 conn->ca_cert_verify = 0;
3411 SSL_set_verify(conn->ssl, SSL_VERIFY_NONE, NULL);
3412 }
3413
3414 if (tls_set_conn_flags(conn, flags, NULL) < 0)
3415 return -1;
3416 conn->flags = flags;
3417
3418 SSL_set_accept_state(conn->ssl);
3419
3420 if (data->tls_session_lifetime == 0) {
3421 /*
3422 * Set session id context to a unique value to make sure
3423 * session resumption cannot be used either through session
3424 * caching or TLS ticket extension.
3425 */
3426 counter++;
3427 SSL_set_session_id_context(conn->ssl,
3428 (const unsigned char *) &counter,
3429 sizeof(counter));
3430 } else if (session_ctx) {
3431 SSL_set_session_id_context(conn->ssl, session_ctx,
3432 session_ctx_len);
3433 }
3434
3435 return 0;
3436 }
3437
3438
tls_connection_client_cert(struct tls_connection * conn,const char * client_cert,const u8 * client_cert_blob,size_t client_cert_blob_len)3439 static int tls_connection_client_cert(struct tls_connection *conn,
3440 const char *client_cert,
3441 const u8 *client_cert_blob,
3442 size_t client_cert_blob_len)
3443 {
3444 if (client_cert == NULL && client_cert_blob == NULL)
3445 return 0;
3446
3447 #ifdef PKCS12_FUNCS
3448 #ifdef LIBRESSL_VERSION_NUMBER
3449 /*
3450 * Clear previously set extra chain certificates, if any, from PKCS#12
3451 * processing in tls_parse_pkcs12() to allow LibreSSL to build a new
3452 * chain properly.
3453 */
3454 SSL_CTX_clear_extra_chain_certs(conn->ssl_ctx);
3455 #endif /* LIBRESSL_VERSION_NUMBER */
3456 #endif /* PKCS12_FUNCS */
3457
3458 if (client_cert_blob &&
3459 SSL_use_certificate_ASN1(conn->ssl, (u8 *) client_cert_blob,
3460 client_cert_blob_len) == 1) {
3461 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_ASN1 --> "
3462 "OK");
3463 return 0;
3464 } else if (client_cert_blob) {
3465 #if defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x20901000L
3466 tls_show_errors(MSG_DEBUG, __func__,
3467 "SSL_use_certificate_ASN1 failed");
3468 #else
3469 BIO *bio;
3470 X509 *x509;
3471
3472 tls_show_errors(MSG_DEBUG, __func__,
3473 "SSL_use_certificate_ASN1 failed");
3474 bio = BIO_new(BIO_s_mem());
3475 if (!bio)
3476 return -1;
3477 BIO_write(bio, client_cert_blob, client_cert_blob_len);
3478 x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
3479 if (!x509 || SSL_use_certificate(conn->ssl, x509) != 1) {
3480 X509_free(x509);
3481 BIO_free(bio);
3482 return -1;
3483 }
3484 X509_free(x509);
3485 wpa_printf(MSG_DEBUG,
3486 "OpenSSL: Found PEM encoded certificate from blob");
3487 while ((x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL))) {
3488 wpa_printf(MSG_DEBUG,
3489 "OpenSSL: Added an additional certificate into the chain");
3490 SSL_add0_chain_cert(conn->ssl, x509);
3491 }
3492 BIO_free(bio);
3493 return 0;
3494 #endif
3495 }
3496
3497 if (client_cert == NULL)
3498 return -1;
3499
3500 #ifdef ANDROID
3501 if (os_strncmp("keystore://", client_cert, 11) == 0) {
3502 BIO *bio = BIO_from_keystore(&client_cert[11]);
3503 X509 *x509 = NULL;
3504 int ret = -1;
3505 if (bio) {
3506 x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
3507 }
3508 if (x509) {
3509 if (SSL_use_certificate(conn->ssl, x509) == 1)
3510 ret = 0;
3511 X509_free(x509);
3512 }
3513
3514 /* Read additional certificates into the chain. */
3515 while (bio) {
3516 x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
3517 if (x509) {
3518 /* Takes ownership of x509 */
3519 SSL_add0_chain_cert(conn->ssl, x509);
3520 } else {
3521 BIO_free(bio);
3522 bio = NULL;
3523 }
3524 }
3525 return ret;
3526 }
3527 #endif /* ANDROID */
3528
3529 #ifdef CONFIG_OHOS_CERTMGR
3530 if (os_strncmp(OH_PREFIX, client_cert, os_strlen(OH_PREFIX)) == 0) {
3531 int ret = -1;
3532 X509 *x509 = NULL;
3533
3534 struct Credential certificate = { 0 };
3535 certificate.credData.data = (uint8_t *)malloc(MAX_LEN_CERTIFICATE_CHAIN);
3536 if (certificate.credData.data == NULL) {
3537 wpa_printf(MSG_ERROR, "%s malloc certificate.credData.data fail", __func__);
3538 return -1;
3539 }
3540
3541 BIO *bio = BIO_from_cm(&client_cert[0], certificate);
3542
3543 if (!bio) {
3544 wpa_printf(MSG_DEBUG, "tls_connection_client_cert: bio = NULL");
3545 if (certificate.credData.data != NULL) {
3546 free(certificate.credData.data);
3547 }
3548 return -1;
3549 }
3550
3551 x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
3552 if (x509) {
3553 if (SSL_use_certificate(conn->ssl, x509) == 1) {
3554 ret = 0;
3555 }
3556 X509_free(x509);
3557 }
3558
3559 /* Read additional certificates into the chain. */
3560 while (bio) {
3561 x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
3562 if (x509) {
3563 /* Takes ownership of x509 */
3564 SSL_add0_chain_cert(conn->ssl, x509);
3565 } else {
3566 BIO_free(bio);
3567 bio = NULL;
3568 }
3569 }
3570
3571 if (certificate.credData.data != NULL) {
3572 free(certificate.credData.data);
3573 }
3574
3575 return ret;
3576 }
3577 #endif
3578
3579 #ifndef OPENSSL_NO_STDIO
3580 if (SSL_use_certificate_file(conn->ssl, client_cert,
3581 SSL_FILETYPE_ASN1) == 1) {
3582 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_file (DER)"
3583 " --> OK");
3584 return 0;
3585 }
3586
3587 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && \
3588 !defined(LIBRESSL_VERSION_NUMBER) && !defined(OPENSSL_IS_BORINGSSL)
3589 if (SSL_use_certificate_chain_file(conn->ssl, client_cert) == 1) {
3590 ERR_clear_error();
3591 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_chain_file"
3592 " --> OK");
3593 return 0;
3594 }
3595 #else
3596 if (SSL_use_certificate_file(conn->ssl, client_cert,
3597 SSL_FILETYPE_PEM) == 1) {
3598 ERR_clear_error();
3599 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_file (PEM)"
3600 " --> OK");
3601 return 0;
3602 }
3603 #endif
3604
3605 tls_show_errors(MSG_DEBUG, __func__,
3606 "SSL_use_certificate_file failed");
3607 #else /* OPENSSL_NO_STDIO */
3608 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", __func__);
3609 #endif /* OPENSSL_NO_STDIO */
3610
3611 return -1;
3612 }
3613
3614
tls_global_client_cert(struct tls_data * data,const char * client_cert)3615 static int tls_global_client_cert(struct tls_data *data,
3616 const char *client_cert)
3617 {
3618 #ifndef OPENSSL_NO_STDIO
3619 SSL_CTX *ssl_ctx = data->ssl;
3620
3621 if (client_cert == NULL)
3622 return 0;
3623
3624 if (SSL_CTX_use_certificate_file(ssl_ctx, client_cert,
3625 SSL_FILETYPE_ASN1) != 1 &&
3626 SSL_CTX_use_certificate_chain_file(ssl_ctx, client_cert) != 1 &&
3627 SSL_CTX_use_certificate_file(ssl_ctx, client_cert,
3628 SSL_FILETYPE_PEM) != 1) {
3629 tls_show_errors(MSG_INFO, __func__,
3630 "Failed to load client certificate");
3631 return -1;
3632 }
3633 return 0;
3634 #else /* OPENSSL_NO_STDIO */
3635 if (client_cert == NULL)
3636 return 0;
3637 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", __func__);
3638 return -1;
3639 #endif /* OPENSSL_NO_STDIO */
3640 }
3641
3642
3643 #ifdef PKCS12_FUNCS
tls_parse_pkcs12(struct tls_data * data,SSL * ssl,PKCS12 * p12,const char * passwd)3644 static int tls_parse_pkcs12(struct tls_data *data, SSL *ssl, PKCS12 *p12,
3645 const char *passwd)
3646 {
3647 EVP_PKEY *pkey;
3648 X509 *cert;
3649 STACK_OF(X509) *certs;
3650 int res = 0;
3651 char buf[256];
3652
3653 pkey = NULL;
3654 cert = NULL;
3655 certs = NULL;
3656 if (!passwd)
3657 passwd = "";
3658 if (!PKCS12_parse(p12, passwd, &pkey, &cert, &certs)) {
3659 tls_show_errors(MSG_DEBUG, __func__,
3660 "Failed to parse PKCS12 file");
3661 PKCS12_free(p12);
3662 return -1;
3663 }
3664 wpa_printf(MSG_DEBUG, "TLS: Successfully parsed PKCS12 data");
3665
3666 if (cert) {
3667 X509_NAME_oneline(X509_get_subject_name(cert), buf,
3668 sizeof(buf));
3669 wpa_printf(MSG_DEBUG, "TLS: Got certificate from PKCS12: "
3670 "subject='%s'", buf);
3671 if (ssl) {
3672 if (SSL_use_certificate(ssl, cert) != 1)
3673 res = -1;
3674 } else {
3675 if (SSL_CTX_use_certificate(data->ssl, cert) != 1)
3676 res = -1;
3677 }
3678 X509_free(cert);
3679 }
3680
3681 if (pkey) {
3682 wpa_printf(MSG_DEBUG, "TLS: Got private key from PKCS12");
3683 if (ssl) {
3684 if (SSL_use_PrivateKey(ssl, pkey) != 1)
3685 res = -1;
3686 } else {
3687 if (SSL_CTX_use_PrivateKey(data->ssl, pkey) != 1)
3688 res = -1;
3689 }
3690 EVP_PKEY_free(pkey);
3691 }
3692
3693 if (certs) {
3694 #ifndef LIBRESSL_VERSION_NUMBER
3695 if (ssl)
3696 SSL_clear_chain_certs(ssl);
3697 else
3698 SSL_CTX_clear_chain_certs(data->ssl);
3699 while ((cert = sk_X509_pop(certs)) != NULL) {
3700 X509_NAME_oneline(X509_get_subject_name(cert), buf,
3701 sizeof(buf));
3702 wpa_printf(MSG_DEBUG, "TLS: additional certificate"
3703 " from PKCS12: subject='%s'", buf);
3704 if ((ssl && SSL_add1_chain_cert(ssl, cert) != 1) ||
3705 (!ssl && SSL_CTX_add1_chain_cert(data->ssl,
3706 cert) != 1)) {
3707 tls_show_errors(MSG_DEBUG, __func__,
3708 "Failed to add additional certificate");
3709 res = -1;
3710 X509_free(cert);
3711 break;
3712 }
3713 X509_free(cert);
3714 }
3715 if (!res) {
3716 /* Try to continue anyway */
3717 }
3718 sk_X509_pop_free(certs, X509_free);
3719 #ifndef OPENSSL_IS_BORINGSSL
3720 if (ssl)
3721 res = SSL_build_cert_chain(
3722 ssl,
3723 SSL_BUILD_CHAIN_FLAG_CHECK |
3724 SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR);
3725 else
3726 res = SSL_CTX_build_cert_chain(
3727 data->ssl,
3728 SSL_BUILD_CHAIN_FLAG_CHECK |
3729 SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR);
3730 if (!res) {
3731 tls_show_errors(MSG_DEBUG, __func__,
3732 "Failed to build certificate chain");
3733 } else if (res == 2) {
3734 wpa_printf(MSG_DEBUG,
3735 "TLS: Ignore certificate chain verification error when building chain with PKCS#12 extra certificates");
3736 }
3737 #endif /* OPENSSL_IS_BORINGSSL */
3738 /*
3739 * Try to continue regardless of result since it is possible for
3740 * the extra certificates not to be required.
3741 */
3742 res = 0;
3743 #else /* LIBRESSL_VERSION_NUMBER */
3744 SSL_CTX_clear_extra_chain_certs(data->ssl);
3745 while ((cert = sk_X509_pop(certs)) != NULL) {
3746 X509_NAME_oneline(X509_get_subject_name(cert), buf,
3747 sizeof(buf));
3748 wpa_printf(MSG_DEBUG, "TLS: additional certificate"
3749 " from PKCS12: subject='%s'", buf);
3750 /*
3751 * There is no SSL equivalent for the chain cert - so
3752 * always add it to the context...
3753 */
3754 if (SSL_CTX_add_extra_chain_cert(data->ssl, cert) != 1)
3755 {
3756 X509_free(cert);
3757 res = -1;
3758 break;
3759 }
3760 }
3761 sk_X509_pop_free(certs, X509_free);
3762 #endif /* LIBRSESSL_VERSION_NUMBER */
3763 }
3764
3765 PKCS12_free(p12);
3766
3767 if (res < 0)
3768 tls_get_errors(data);
3769
3770 return res;
3771 }
3772 #endif /* PKCS12_FUNCS */
3773
3774
tls_read_pkcs12(struct tls_data * data,SSL * ssl,const char * private_key,const char * passwd)3775 static int tls_read_pkcs12(struct tls_data *data, SSL *ssl,
3776 const char *private_key, const char *passwd)
3777 {
3778 #ifdef PKCS12_FUNCS
3779 FILE *f;
3780 PKCS12 *p12;
3781
3782 f = fopen(private_key, "rb");
3783 if (f == NULL)
3784 return -1;
3785
3786 p12 = d2i_PKCS12_fp(f, NULL);
3787 fclose(f);
3788
3789 if (p12 == NULL) {
3790 tls_show_errors(MSG_INFO, __func__,
3791 "Failed to use PKCS#12 file");
3792 return -1;
3793 }
3794
3795 return tls_parse_pkcs12(data, ssl, p12, passwd);
3796
3797 #else /* PKCS12_FUNCS */
3798 wpa_printf(MSG_INFO, "TLS: PKCS12 support disabled - cannot read "
3799 "p12/pfx files");
3800 return -1;
3801 #endif /* PKCS12_FUNCS */
3802 }
3803
3804
tls_read_pkcs12_blob(struct tls_data * data,SSL * ssl,const u8 * blob,size_t len,const char * passwd)3805 static int tls_read_pkcs12_blob(struct tls_data *data, SSL *ssl,
3806 const u8 *blob, size_t len, const char *passwd)
3807 {
3808 #ifdef PKCS12_FUNCS
3809 PKCS12 *p12;
3810
3811 p12 = d2i_PKCS12(NULL, (const unsigned char **) &blob, len);
3812 if (p12 == NULL) {
3813 tls_show_errors(MSG_INFO, __func__,
3814 "Failed to use PKCS#12 blob");
3815 return -1;
3816 }
3817
3818 return tls_parse_pkcs12(data, ssl, p12, passwd);
3819
3820 #else /* PKCS12_FUNCS */
3821 wpa_printf(MSG_INFO, "TLS: PKCS12 support disabled - cannot parse "
3822 "p12/pfx blobs");
3823 return -1;
3824 #endif /* PKCS12_FUNCS */
3825 }
3826
3827
3828 #ifndef OPENSSL_NO_ENGINE
tls_engine_get_cert(struct tls_connection * conn,const char * cert_id,X509 ** cert)3829 static int tls_engine_get_cert(struct tls_connection *conn,
3830 const char *cert_id,
3831 X509 **cert)
3832 {
3833 /* this runs after the private key is loaded so no PIN is required */
3834 struct {
3835 const char *cert_id;
3836 X509 *cert;
3837 } params;
3838 params.cert_id = cert_id;
3839 params.cert = NULL;
3840
3841 if (!ENGINE_ctrl_cmd(conn->engine, "LOAD_CERT_CTRL",
3842 0, ¶ms, NULL, 1)) {
3843 unsigned long err = ERR_get_error();
3844
3845 wpa_printf(MSG_ERROR, "ENGINE: cannot load client cert with id"
3846 " '%s' [%s]", cert_id,
3847 ERR_error_string(err, NULL));
3848 if (tls_is_pin_error(err))
3849 return TLS_SET_PARAMS_ENGINE_PRV_BAD_PIN;
3850 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
3851 }
3852 if (!params.cert) {
3853 wpa_printf(MSG_ERROR, "ENGINE: did not properly cert with id"
3854 " '%s'", cert_id);
3855 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
3856 }
3857 *cert = params.cert;
3858 return 0;
3859 }
3860 #endif /* OPENSSL_NO_ENGINE */
3861
3862
tls_connection_engine_client_cert(struct tls_connection * conn,const char * cert_id)3863 static int tls_connection_engine_client_cert(struct tls_connection *conn,
3864 const char *cert_id)
3865 {
3866 #ifndef OPENSSL_NO_ENGINE
3867 X509 *cert;
3868
3869 if (tls_engine_get_cert(conn, cert_id, &cert))
3870 return -1;
3871
3872 if (!SSL_use_certificate(conn->ssl, cert)) {
3873 tls_show_errors(MSG_ERROR, __func__,
3874 "SSL_use_certificate failed");
3875 X509_free(cert);
3876 return -1;
3877 }
3878 X509_free(cert);
3879 wpa_printf(MSG_DEBUG, "ENGINE: SSL_use_certificate --> "
3880 "OK");
3881 return 0;
3882
3883 #else /* OPENSSL_NO_ENGINE */
3884 return -1;
3885 #endif /* OPENSSL_NO_ENGINE */
3886 }
3887
3888
tls_connection_engine_ca_cert(struct tls_data * data,struct tls_connection * conn,const char * ca_cert_id)3889 static int tls_connection_engine_ca_cert(struct tls_data *data,
3890 struct tls_connection *conn,
3891 const char *ca_cert_id)
3892 {
3893 #ifndef OPENSSL_NO_ENGINE
3894 X509 *cert;
3895 SSL_CTX *ssl_ctx = data->ssl;
3896 X509_STORE *store;
3897
3898 if (tls_engine_get_cert(conn, ca_cert_id, &cert))
3899 return -1;
3900
3901 /* start off the same as tls_connection_ca_cert */
3902 store = X509_STORE_new();
3903 if (store == NULL) {
3904 wpa_printf(MSG_DEBUG, "OpenSSL: %s - failed to allocate new "
3905 "certificate store", __func__);
3906 X509_free(cert);
3907 return -1;
3908 }
3909 SSL_CTX_set_cert_store(ssl_ctx, store);
3910 if (!X509_STORE_add_cert(store, cert)) {
3911 unsigned long err = ERR_peek_error();
3912 tls_show_errors(MSG_WARNING, __func__,
3913 "Failed to add CA certificate from engine "
3914 "to certificate store");
3915 if (ERR_GET_LIB(err) == ERR_LIB_X509 &&
3916 ERR_GET_REASON(err) == X509_R_CERT_ALREADY_IN_HASH_TABLE) {
3917 wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring cert"
3918 " already in hash table error",
3919 __func__);
3920 } else {
3921 X509_free(cert);
3922 return -1;
3923 }
3924 }
3925 X509_free(cert);
3926 wpa_printf(MSG_DEBUG, "OpenSSL: %s - added CA certificate from engine "
3927 "to certificate store", __func__);
3928 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);
3929 conn->ca_cert_verify = 1;
3930
3931 return 0;
3932
3933 #else /* OPENSSL_NO_ENGINE */
3934 return -1;
3935 #endif /* OPENSSL_NO_ENGINE */
3936 }
3937
3938
tls_connection_engine_private_key(struct tls_connection * conn)3939 static int tls_connection_engine_private_key(struct tls_connection *conn)
3940 {
3941 #if defined(ANDROID) || !defined(OPENSSL_NO_ENGINE)
3942 if (SSL_use_PrivateKey(conn->ssl, conn->private_key) != 1) {
3943 tls_show_errors(MSG_ERROR, __func__,
3944 "ENGINE: cannot use private key for TLS");
3945 return -1;
3946 }
3947 if (!SSL_check_private_key(conn->ssl)) {
3948 tls_show_errors(MSG_INFO, __func__,
3949 "Private key failed verification");
3950 return -1;
3951 }
3952 return 0;
3953 #else /* OPENSSL_NO_ENGINE */
3954 wpa_printf(MSG_ERROR, "SSL: Configuration uses engine, but "
3955 "engine support was not compiled in");
3956 return -1;
3957 #endif /* OPENSSL_NO_ENGINE */
3958 }
3959
3960
3961 #ifndef OPENSSL_NO_STDIO
tls_passwd_cb(char * buf,int size,int rwflag,void * password)3962 static int tls_passwd_cb(char *buf, int size, int rwflag, void *password)
3963 {
3964 if (!password)
3965 return 0;
3966 os_strlcpy(buf, (const char *) password, size);
3967 return os_strlen(buf);
3968 }
3969 #endif /* OPENSSL_NO_STDIO */
3970
3971
tls_use_private_key_file(struct tls_data * data,SSL * ssl,const char * private_key,const char * private_key_passwd)3972 static int tls_use_private_key_file(struct tls_data *data, SSL *ssl,
3973 const char *private_key,
3974 const char *private_key_passwd)
3975 {
3976 #ifndef OPENSSL_NO_STDIO
3977 BIO *bio;
3978 EVP_PKEY *pkey;
3979 int ret;
3980
3981 /* First try ASN.1 (DER). */
3982 bio = BIO_new_file(private_key, "r");
3983 if (!bio)
3984 return -1;
3985 pkey = d2i_PrivateKey_bio(bio, NULL);
3986 BIO_free(bio);
3987
3988 if (pkey) {
3989 wpa_printf(MSG_DEBUG, "OpenSSL: %s (DER) --> loaded", __func__);
3990 } else {
3991 /* Try PEM with the provided password. */
3992 bio = BIO_new_file(private_key, "r");
3993 if (!bio)
3994 return -1;
3995 pkey = PEM_read_bio_PrivateKey(bio, NULL, tls_passwd_cb,
3996 (void *) private_key_passwd);
3997 BIO_free(bio);
3998 if (!pkey)
3999 return -1;
4000 wpa_printf(MSG_DEBUG, "OpenSSL: %s (PEM) --> loaded", __func__);
4001 /* Clear errors from the previous failed load. */
4002 ERR_clear_error();
4003 }
4004
4005 if (ssl)
4006 ret = SSL_use_PrivateKey(ssl, pkey);
4007 else
4008 ret = SSL_CTX_use_PrivateKey(data->ssl, pkey);
4009
4010 EVP_PKEY_free(pkey);
4011 return ret == 1 ? 0 : -1;
4012 #else /* OPENSSL_NO_STDIO */
4013 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", __func__);
4014 return -1;
4015 #endif /* OPENSSL_NO_STDIO */
4016 }
4017
4018 #ifdef CONFIG_OHOS_CERTMGR
tls_use_cm_key(struct tls_data * data,SSL * ssl,const char * private_key)4019 static int tls_use_cm_key(struct tls_data *data, SSL *ssl, const char *private_key)
4020 {
4021 int ret;
4022 EVP_PKEY *pkey = GET_EVP_PKEY(private_key);
4023 if (pkey == NULL) {
4024 wpa_printf(MSG_DEBUG, "can not get evp pkey");
4025 return -1;
4026 }
4027 if (ssl)
4028 ret = SSL_use_PrivateKey(ssl, pkey);
4029 else
4030 ret = SSL_CTX_use_PrivateKey(data->ssl, pkey);
4031
4032 EVP_PKEY_free(pkey);
4033 return ret == 1 ? 0 : -1;
4034 }
4035 #endif
4036
tls_connection_private_key(struct tls_data * data,struct tls_connection * conn,const char * private_key,const char * private_key_passwd,const u8 * private_key_blob,size_t private_key_blob_len)4037 static int tls_connection_private_key(struct tls_data *data,
4038 struct tls_connection *conn,
4039 const char *private_key,
4040 const char *private_key_passwd,
4041 const u8 *private_key_blob,
4042 size_t private_key_blob_len)
4043 {
4044 BIO *bio;
4045 int ok;
4046
4047 if (private_key == NULL && private_key_blob == NULL)
4048 return 0;
4049
4050 ok = 0;
4051 while (private_key_blob) {
4052 if (SSL_use_PrivateKey_ASN1(EVP_PKEY_RSA, conn->ssl,
4053 (u8 *) private_key_blob,
4054 private_key_blob_len) == 1) {
4055 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_PrivateKey_"
4056 "ASN1(EVP_PKEY_RSA) --> OK");
4057 ok = 1;
4058 break;
4059 }
4060
4061 if (SSL_use_PrivateKey_ASN1(EVP_PKEY_DSA, conn->ssl,
4062 (u8 *) private_key_blob,
4063 private_key_blob_len) == 1) {
4064 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_PrivateKey_"
4065 "ASN1(EVP_PKEY_DSA) --> OK");
4066 ok = 1;
4067 break;
4068 }
4069
4070 #ifndef OPENSSL_NO_EC
4071 if (SSL_use_PrivateKey_ASN1(EVP_PKEY_EC, conn->ssl,
4072 (u8 *) private_key_blob,
4073 private_key_blob_len) == 1) {
4074 wpa_printf(MSG_DEBUG,
4075 "OpenSSL: SSL_use_PrivateKey_ASN1(EVP_PKEY_EC) --> OK");
4076 ok = 1;
4077 break;
4078 }
4079 #endif /* OPENSSL_NO_EC */
4080
4081 #if OPENSSL_VERSION_NUMBER < 0x30000000L
4082 if (SSL_use_RSAPrivateKey_ASN1(conn->ssl,
4083 (u8 *) private_key_blob,
4084 private_key_blob_len) == 1) {
4085 wpa_printf(MSG_DEBUG, "OpenSSL: "
4086 "SSL_use_RSAPrivateKey_ASN1 --> OK");
4087 ok = 1;
4088 break;
4089 }
4090 #endif
4091
4092 bio = BIO_new_mem_buf((u8 *) private_key_blob,
4093 private_key_blob_len);
4094 if (bio) {
4095 EVP_PKEY *pkey;
4096
4097 pkey = PEM_read_bio_PrivateKey(
4098 bio, NULL, tls_passwd_cb,
4099 (void *) private_key_passwd);
4100 if (pkey) {
4101 if (SSL_use_PrivateKey(conn->ssl, pkey) == 1) {
4102 wpa_printf(MSG_DEBUG,
4103 "OpenSSL: SSL_use_PrivateKey --> OK");
4104 ok = 1;
4105 EVP_PKEY_free(pkey);
4106 BIO_free(bio);
4107 break;
4108 }
4109 EVP_PKEY_free(pkey);
4110 }
4111 BIO_free(bio);
4112 }
4113
4114 if (tls_read_pkcs12_blob(data, conn->ssl, private_key_blob,
4115 private_key_blob_len,
4116 private_key_passwd) == 0) {
4117 wpa_printf(MSG_DEBUG, "OpenSSL: PKCS#12 as blob --> "
4118 "OK");
4119 ok = 1;
4120 break;
4121 }
4122
4123 break;
4124 }
4125
4126 while (!ok && private_key) {
4127 #ifdef CONFIG_OHOS_CERTMGR
4128 if (tls_use_cm_key(data, conn->ssl, private_key) == 0) {
4129 ok = 1;
4130 break;
4131 }
4132 #endif
4133 if (tls_use_private_key_file(data, conn->ssl, private_key,
4134 private_key_passwd) == 0) {
4135 ok = 1;
4136 break;
4137 }
4138
4139 if (tls_read_pkcs12(data, conn->ssl, private_key,
4140 private_key_passwd) == 0) {
4141 wpa_printf(MSG_DEBUG, "OpenSSL: Reading PKCS#12 file "
4142 "--> OK");
4143 ok = 1;
4144 break;
4145 }
4146
4147 if (tls_cryptoapi_cert(conn->ssl, private_key) == 0) {
4148 wpa_printf(MSG_DEBUG, "OpenSSL: Using CryptoAPI to "
4149 "access certificate store --> OK");
4150 ok = 1;
4151 break;
4152 }
4153
4154 break;
4155 }
4156
4157 if (!ok) {
4158 tls_show_errors(MSG_INFO, __func__,
4159 "Failed to load private key");
4160 return -1;
4161 }
4162 ERR_clear_error();
4163
4164 if (!SSL_check_private_key(conn->ssl)) {
4165 tls_show_errors(MSG_INFO, __func__, "Private key failed "
4166 "verification");
4167 return -1;
4168 }
4169
4170 wpa_printf(MSG_DEBUG, "SSL: Private key loaded successfully");
4171 return 0;
4172 }
4173
4174
tls_global_private_key(struct tls_data * data,const char * private_key,const char * private_key_passwd)4175 static int tls_global_private_key(struct tls_data *data,
4176 const char *private_key,
4177 const char *private_key_passwd)
4178 {
4179 SSL_CTX *ssl_ctx = data->ssl;
4180
4181 if (private_key == NULL)
4182 return 0;
4183
4184 if (tls_use_private_key_file(data, NULL, private_key,
4185 private_key_passwd) &&
4186 tls_read_pkcs12(data, NULL, private_key, private_key_passwd)) {
4187 tls_show_errors(MSG_INFO, __func__,
4188 "Failed to load private key");
4189 ERR_clear_error();
4190 return -1;
4191 }
4192 ERR_clear_error();
4193
4194 if (!SSL_CTX_check_private_key(ssl_ctx)) {
4195 tls_show_errors(MSG_INFO, __func__,
4196 "Private key failed verification");
4197 return -1;
4198 }
4199
4200 return 0;
4201 }
4202
4203
4204 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
4205 #ifndef OPENSSL_NO_DH
4206 #ifndef OPENSSL_NO_DSA
4207 /* This is needed to replace the deprecated DSA_dup_DH() function */
openssl_dsa_to_dh(EVP_PKEY * dsa)4208 static EVP_PKEY * openssl_dsa_to_dh(EVP_PKEY *dsa)
4209 {
4210 OSSL_PARAM_BLD *bld = NULL;
4211 OSSL_PARAM *params = NULL;
4212 BIGNUM *p = NULL, *q = NULL, *g = NULL;
4213 EVP_PKEY_CTX *ctx = NULL;
4214 EVP_PKEY *pkey = NULL;
4215
4216 if (!EVP_PKEY_get_bn_param(dsa, OSSL_PKEY_PARAM_FFC_P, &p) ||
4217 !EVP_PKEY_get_bn_param(dsa, OSSL_PKEY_PARAM_FFC_Q, &q) ||
4218 !EVP_PKEY_get_bn_param(dsa, OSSL_PKEY_PARAM_FFC_G, &g) ||
4219 !(bld = OSSL_PARAM_BLD_new()) ||
4220 !OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_P, p) ||
4221 !OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_Q, q) ||
4222 !OSSL_PARAM_BLD_push_BN(bld, OSSL_PKEY_PARAM_FFC_G, g) ||
4223 !(params = OSSL_PARAM_BLD_to_param(bld)) ||
4224 !(ctx = EVP_PKEY_CTX_new_from_name(NULL, "DHX", NULL)) ||
4225 EVP_PKEY_fromdata_init(ctx) != 1 ||
4226 EVP_PKEY_fromdata(ctx, &pkey, EVP_PKEY_KEY_PARAMETERS,
4227 params) != 1)
4228 wpa_printf(MSG_INFO,
4229 "TLS: Failed to convert DSA parameters to DH parameters");
4230
4231 EVP_PKEY_CTX_free(ctx);
4232 OSSL_PARAM_free(params);
4233 OSSL_PARAM_BLD_free(bld);
4234 BN_free(p);
4235 BN_free(q);
4236 BN_free(g);
4237 return pkey;
4238 }
4239 #endif /* !OPENSSL_NO_DSA */
4240 #endif /* OPENSSL_NO_DH */
4241 #endif /* OpenSSL version >= 3.0 */
4242
tls_global_dh(struct tls_data * data,const char * dh_file)4243 static int tls_global_dh(struct tls_data *data, const char *dh_file)
4244 {
4245 #ifdef OPENSSL_NO_DH
4246 if (dh_file == NULL)
4247 return 0;
4248 wpa_printf(MSG_ERROR, "TLS: openssl does not include DH support, but "
4249 "dh_file specified");
4250 return -1;
4251 #else /* OPENSSL_NO_DH */
4252 #if OPENSSL_VERSION_NUMBER >= 0x30000000L
4253 SSL_CTX *ssl_ctx = data->ssl;
4254 BIO *bio;
4255 OSSL_DECODER_CTX *ctx = NULL;
4256 EVP_PKEY *pkey = NULL, *tmpkey = NULL;
4257 bool dsa = false;
4258
4259 if (!ssl_ctx)
4260 return -1;
4261 if (!dh_file) {
4262 SSL_CTX_set_dh_auto(ssl_ctx, 1);
4263 return 0;
4264 }
4265
4266 bio = BIO_new_file(dh_file, "r");
4267 if (!bio) {
4268 wpa_printf(MSG_INFO, "TLS: Failed to open DH file '%s': %s",
4269 dh_file, ERR_error_string(ERR_get_error(), NULL));
4270 return -1;
4271 }
4272 ctx = OSSL_DECODER_CTX_new_for_pkey(
4273 &tmpkey, "PEM", NULL, NULL,
4274 OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS, NULL, NULL);
4275 if (!ctx ||
4276 OSSL_DECODER_from_bio(ctx, bio) != 1) {
4277 wpa_printf(MSG_INFO,
4278 "TLS: Failed to decode domain parameters from '%s': %s",
4279 dh_file, ERR_error_string(ERR_get_error(), NULL));
4280 BIO_free(bio);
4281 OSSL_DECODER_CTX_free(ctx);
4282 return -1;
4283 }
4284 OSSL_DECODER_CTX_free(ctx);
4285 BIO_free(bio);
4286
4287 if (!tmpkey) {
4288 wpa_printf(MSG_INFO, "TLS: Failed to load domain parameters");
4289 return -1;
4290 }
4291
4292 #ifndef OPENSSL_NO_DSA
4293 if (EVP_PKEY_is_a(tmpkey, "DSA")) {
4294 pkey = openssl_dsa_to_dh(tmpkey);
4295 EVP_PKEY_free(tmpkey);
4296 if (!pkey)
4297 return -1;
4298 dsa = true;
4299 }
4300 #endif /* !OPENSSL_NO_DSA */
4301 if (!dsa) {
4302 if (EVP_PKEY_is_a(tmpkey, "DH") ||
4303 EVP_PKEY_is_a(tmpkey, "DHX")) {
4304 } else {
4305 wpa_printf(MSG_INFO,
4306 "TLS: No DH parameters found in %s",
4307 dh_file);
4308 EVP_PKEY_free(tmpkey);
4309 return -1;
4310 }
4311 pkey = tmpkey;
4312 tmpkey = NULL;
4313 }
4314
4315 if (SSL_CTX_set0_tmp_dh_pkey(ssl_ctx, pkey) != 1) {
4316 wpa_printf(MSG_INFO,
4317 "TLS: Failed to set DH params from '%s': %s",
4318 dh_file, ERR_error_string(ERR_get_error(), NULL));
4319 EVP_PKEY_free(pkey);
4320 return -1;
4321 }
4322 return 0;
4323 #else /* OpenSSL version >= 3.0 */
4324 SSL_CTX *ssl_ctx = data->ssl;
4325 DH *dh;
4326 BIO *bio;
4327
4328 if (!ssl_ctx)
4329 return -1;
4330 if (!dh_file) {
4331 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(OPENSSL_IS_BORINGSSL)
4332 SSL_CTX_set_dh_auto(ssl_ctx, 1);
4333 #endif
4334 return 0;
4335 }
4336
4337 bio = BIO_new_file(dh_file, "r");
4338 if (bio == NULL) {
4339 wpa_printf(MSG_INFO, "TLS: Failed to open DH file '%s': %s",
4340 dh_file, ERR_error_string(ERR_get_error(), NULL));
4341 return -1;
4342 }
4343 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
4344 BIO_free(bio);
4345 #ifndef OPENSSL_NO_DSA
4346 while (dh == NULL) {
4347 DSA *dsa;
4348 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DH file '%s': %s -"
4349 " trying to parse as DSA params", dh_file,
4350 ERR_error_string(ERR_get_error(), NULL));
4351 bio = BIO_new_file(dh_file, "r");
4352 if (bio == NULL)
4353 break;
4354 dsa = PEM_read_bio_DSAparams(bio, NULL, NULL, NULL);
4355 BIO_free(bio);
4356 if (!dsa) {
4357 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DSA file "
4358 "'%s': %s", dh_file,
4359 ERR_error_string(ERR_get_error(), NULL));
4360 break;
4361 }
4362
4363 wpa_printf(MSG_DEBUG, "TLS: DH file in DSA param format");
4364 dh = DSA_dup_DH(dsa);
4365 DSA_free(dsa);
4366 if (dh == NULL) {
4367 wpa_printf(MSG_INFO, "TLS: Failed to convert DSA "
4368 "params into DH params");
4369 break;
4370 }
4371 break;
4372 }
4373 #endif /* !OPENSSL_NO_DSA */
4374 if (dh == NULL) {
4375 wpa_printf(MSG_INFO, "TLS: Failed to read/parse DH/DSA file "
4376 "'%s'", dh_file);
4377 return -1;
4378 }
4379
4380 if (SSL_CTX_set_tmp_dh(ssl_ctx, dh) != 1) {
4381 wpa_printf(MSG_INFO, "TLS: Failed to set DH params from '%s': "
4382 "%s", dh_file,
4383 ERR_error_string(ERR_get_error(), NULL));
4384 DH_free(dh);
4385 return -1;
4386 }
4387 DH_free(dh);
4388 return 0;
4389 #endif /* OpenSSL version >= 3.0 */
4390 #endif /* OPENSSL_NO_DH */
4391 }
4392
4393
tls_connection_get_random(void * ssl_ctx,struct tls_connection * conn,struct tls_random * keys)4394 int tls_connection_get_random(void *ssl_ctx, struct tls_connection *conn,
4395 struct tls_random *keys)
4396 {
4397 SSL *ssl;
4398
4399 if (conn == NULL || keys == NULL)
4400 return -1;
4401 ssl = conn->ssl;
4402 if (ssl == NULL)
4403 return -1;
4404
4405 os_memset(keys, 0, sizeof(*keys));
4406 keys->client_random = conn->client_random;
4407 keys->client_random_len = SSL_get_client_random(
4408 ssl, conn->client_random, sizeof(conn->client_random));
4409 keys->server_random = conn->server_random;
4410 keys->server_random_len = SSL_get_server_random(
4411 ssl, conn->server_random, sizeof(conn->server_random));
4412
4413 return 0;
4414 }
4415
4416
4417 #ifdef OPENSSL_NEED_EAP_FAST_PRF
openssl_get_keyblock_size(SSL * ssl)4418 static int openssl_get_keyblock_size(SSL *ssl)
4419 {
4420 #if OPENSSL_VERSION_NUMBER < 0x10100000L
4421 const EVP_CIPHER *c;
4422 const EVP_MD *h;
4423 int md_size;
4424
4425 if (ssl->enc_read_ctx == NULL || ssl->enc_read_ctx->cipher == NULL ||
4426 ssl->read_hash == NULL)
4427 return -1;
4428
4429 c = ssl->enc_read_ctx->cipher;
4430 h = EVP_MD_CTX_md(ssl->read_hash);
4431 if (h)
4432 md_size = EVP_MD_size(h);
4433 else if (ssl->s3)
4434 md_size = ssl->s3->tmp.new_mac_secret_size;
4435 else
4436 return -1;
4437
4438 wpa_printf(MSG_DEBUG, "OpenSSL: keyblock size: key_len=%d MD_size=%d "
4439 "IV_len=%d", EVP_CIPHER_key_length(c), md_size,
4440 EVP_CIPHER_iv_length(c));
4441 return 2 * (EVP_CIPHER_key_length(c) +
4442 md_size +
4443 EVP_CIPHER_iv_length(c));
4444 #else
4445 const SSL_CIPHER *ssl_cipher;
4446 int cipher, digest;
4447 const EVP_CIPHER *c;
4448 const EVP_MD *h;
4449 int mac_key_len, enc_key_len, fixed_iv_len;
4450
4451 ssl_cipher = SSL_get_current_cipher(ssl);
4452 if (!ssl_cipher)
4453 return -1;
4454 cipher = SSL_CIPHER_get_cipher_nid(ssl_cipher);
4455 digest = SSL_CIPHER_get_digest_nid(ssl_cipher);
4456 wpa_printf(MSG_DEBUG, "OpenSSL: cipher nid %d digest nid %d",
4457 cipher, digest);
4458 if (cipher < 0 || digest < 0)
4459 return -1;
4460 if (cipher == NID_undef) {
4461 wpa_printf(MSG_DEBUG, "OpenSSL: no cipher in use?!");
4462 return -1;
4463 }
4464 c = EVP_get_cipherbynid(cipher);
4465 if (!c)
4466 return -1;
4467 enc_key_len = EVP_CIPHER_key_length(c);
4468 if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE ||
4469 EVP_CIPHER_mode(c) == EVP_CIPH_CCM_MODE)
4470 fixed_iv_len = 4; /* only part of IV from PRF */
4471 else
4472 fixed_iv_len = EVP_CIPHER_iv_length(c);
4473 if (digest == NID_undef) {
4474 wpa_printf(MSG_DEBUG, "OpenSSL: no digest in use (e.g., AEAD)");
4475 mac_key_len = 0;
4476 } else {
4477 h = EVP_get_digestbynid(digest);
4478 if (!h)
4479 return -1;
4480 mac_key_len = EVP_MD_size(h);
4481 }
4482
4483 wpa_printf(MSG_DEBUG,
4484 "OpenSSL: keyblock size: mac_key_len=%d enc_key_len=%d fixed_iv_len=%d",
4485 mac_key_len, enc_key_len, fixed_iv_len);
4486 return 2 * (mac_key_len + enc_key_len + fixed_iv_len);
4487 #endif
4488 }
4489 #endif /* OPENSSL_NEED_EAP_FAST_PRF */
4490
4491
tls_connection_export_key(void * tls_ctx,struct tls_connection * conn,const char * label,const u8 * context,size_t context_len,u8 * out,size_t out_len)4492 int tls_connection_export_key(void *tls_ctx, struct tls_connection *conn,
4493 const char *label, const u8 *context,
4494 size_t context_len, u8 *out, size_t out_len)
4495 {
4496 if (!conn ||
4497 SSL_export_keying_material(conn->ssl, out, out_len, label,
4498 os_strlen(label), context, context_len,
4499 context != NULL) != 1)
4500 return -1;
4501 return 0;
4502 }
4503
4504
tls_connection_get_eap_fast_key(void * tls_ctx,struct tls_connection * conn,u8 * out,size_t out_len)4505 int tls_connection_get_eap_fast_key(void *tls_ctx, struct tls_connection *conn,
4506 u8 *out, size_t out_len)
4507 {
4508 #ifdef OPENSSL_NEED_EAP_FAST_PRF
4509 SSL *ssl;
4510 SSL_SESSION *sess;
4511 u8 *rnd;
4512 int ret = -1;
4513 int skip = 0;
4514 u8 *tmp_out = NULL;
4515 u8 *_out = out;
4516 unsigned char client_random[SSL3_RANDOM_SIZE];
4517 unsigned char server_random[SSL3_RANDOM_SIZE];
4518 unsigned char master_key[64];
4519 size_t master_key_len;
4520 const char *ver;
4521
4522 /*
4523 * TLS library did not support EAP-FAST key generation, so get the
4524 * needed TLS session parameters and use an internal implementation of
4525 * TLS PRF to derive the key.
4526 */
4527
4528 if (conn == NULL)
4529 return -1;
4530 ssl = conn->ssl;
4531 if (ssl == NULL)
4532 return -1;
4533 ver = SSL_get_version(ssl);
4534 sess = SSL_get_session(ssl);
4535 if (!ver || !sess)
4536 return -1;
4537
4538 skip = openssl_get_keyblock_size(ssl);
4539 if (skip < 0)
4540 return -1;
4541 tmp_out = os_malloc(skip + out_len);
4542 if (!tmp_out)
4543 return -1;
4544 _out = tmp_out;
4545
4546 rnd = os_malloc(2 * SSL3_RANDOM_SIZE);
4547 if (!rnd) {
4548 os_free(tmp_out);
4549 return -1;
4550 }
4551
4552 SSL_get_client_random(ssl, client_random, sizeof(client_random));
4553 SSL_get_server_random(ssl, server_random, sizeof(server_random));
4554 master_key_len = SSL_SESSION_get_master_key(sess, master_key,
4555 sizeof(master_key));
4556
4557 os_memcpy(rnd, server_random, SSL3_RANDOM_SIZE);
4558 os_memcpy(rnd + SSL3_RANDOM_SIZE, client_random, SSL3_RANDOM_SIZE);
4559
4560 if (os_strcmp(ver, "TLSv1.2") == 0) {
4561 tls_prf_sha256(master_key, master_key_len,
4562 "key expansion", rnd, 2 * SSL3_RANDOM_SIZE,
4563 _out, skip + out_len);
4564 ret = 0;
4565 } else if (tls_prf_sha1_md5(master_key, master_key_len,
4566 "key expansion", rnd, 2 * SSL3_RANDOM_SIZE,
4567 _out, skip + out_len) == 0) {
4568 ret = 0;
4569 }
4570 forced_memzero(master_key, sizeof(master_key));
4571 os_free(rnd);
4572 if (ret == 0)
4573 os_memcpy(out, _out + skip, out_len);
4574 bin_clear_free(tmp_out, skip);
4575
4576 return ret;
4577 #else /* OPENSSL_NEED_EAP_FAST_PRF */
4578 wpa_printf(MSG_ERROR,
4579 "OpenSSL: EAP-FAST keys cannot be exported in FIPS mode");
4580 return -1;
4581 #endif /* OPENSSL_NEED_EAP_FAST_PRF */
4582 }
4583
4584
4585 static struct wpabuf *
openssl_handshake(struct tls_connection * conn,const struct wpabuf * in_data)4586 openssl_handshake(struct tls_connection *conn, const struct wpabuf *in_data)
4587 {
4588 struct tls_context *context = conn->context;
4589 int res;
4590 struct wpabuf *out_data;
4591
4592 /*
4593 * Give TLS handshake data from the server (if available) to OpenSSL
4594 * for processing.
4595 */
4596 if (in_data && wpabuf_len(in_data) > 0 &&
4597 BIO_write(conn->ssl_in, wpabuf_head(in_data), wpabuf_len(in_data))
4598 < 0) {
4599 tls_show_errors(MSG_INFO, __func__,
4600 "Handshake failed - BIO_write");
4601 return NULL;
4602 }
4603
4604 /* Initiate TLS handshake or continue the existing handshake */
4605 if (conn->server)
4606 res = SSL_accept(conn->ssl);
4607 else
4608 res = SSL_connect(conn->ssl);
4609 if (res != 1) {
4610 int err = SSL_get_error(conn->ssl, res);
4611 if (err == SSL_ERROR_WANT_READ)
4612 wpa_printf(MSG_DEBUG, "SSL: SSL_connect - want "
4613 "more data");
4614 else if (err == SSL_ERROR_WANT_WRITE)
4615 wpa_printf(MSG_DEBUG, "SSL: SSL_connect - want to "
4616 "write");
4617 else {
4618 unsigned long error = ERR_peek_last_error();
4619
4620 tls_show_errors(MSG_INFO, __func__, "SSL_connect");
4621
4622 if (context->event_cb &&
4623 ERR_GET_LIB(error) == ERR_LIB_SSL &&
4624 ERR_GET_REASON(error) ==
4625 SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED) {
4626 context->event_cb(
4627 context->cb_ctx,
4628 TLS_UNSAFE_RENEGOTIATION_DISABLED,
4629 NULL);
4630 }
4631 conn->failed++;
4632 if (!conn->server && !conn->client_hello_generated) {
4633 /* The server would not understand TLS Alert
4634 * before ClientHello, so simply terminate
4635 * handshake on this type of error case caused
4636 * by a likely internal error like no ciphers
4637 * available. */
4638 wpa_printf(MSG_DEBUG,
4639 "OpenSSL: Could not generate ClientHello");
4640 conn->write_alerts++;
4641 return NULL;
4642 }
4643 }
4644 }
4645
4646 if (!conn->server && !conn->failed)
4647 conn->client_hello_generated = 1;
4648
4649 #ifdef CONFIG_SUITEB
4650 if ((conn->flags & TLS_CONN_SUITEB) && !conn->server &&
4651 os_strncmp(SSL_get_cipher(conn->ssl), "DHE-", 4) == 0 &&
4652 conn->server_dh_prime_len < 3072) {
4653 /*
4654 * This should not be reached since earlier cert_cb should have
4655 * terminated the handshake. Keep this check here for extra
4656 * protection if anything goes wrong with the more low-level
4657 * checks based on having to parse the TLS handshake messages.
4658 */
4659 wpa_printf(MSG_DEBUG,
4660 "OpenSSL: Server DH prime length: %d bits",
4661 conn->server_dh_prime_len);
4662
4663 if (context->event_cb) {
4664 union tls_event_data ev;
4665
4666 os_memset(&ev, 0, sizeof(ev));
4667 ev.alert.is_local = 1;
4668 ev.alert.type = "fatal";
4669 ev.alert.description = "insufficient security";
4670 context->event_cb(context->cb_ctx, TLS_ALERT, &ev);
4671 }
4672 /*
4673 * Could send a TLS Alert to the server, but for now, simply
4674 * terminate handshake.
4675 */
4676 conn->failed++;
4677 conn->write_alerts++;
4678 return NULL;
4679 }
4680 #endif /* CONFIG_SUITEB */
4681
4682 /* Get the TLS handshake data to be sent to the server */
4683 res = BIO_ctrl_pending(conn->ssl_out);
4684 wpa_printf(MSG_DEBUG, "SSL: %d bytes pending from ssl_out", res);
4685 out_data = wpabuf_alloc(res);
4686 if (out_data == NULL) {
4687 wpa_printf(MSG_DEBUG, "SSL: Failed to allocate memory for "
4688 "handshake output (%d bytes)", res);
4689 if (BIO_reset(conn->ssl_out) < 0) {
4690 tls_show_errors(MSG_INFO, __func__,
4691 "BIO_reset failed");
4692 }
4693 return NULL;
4694 }
4695 res = res == 0 ? 0 : BIO_read(conn->ssl_out, wpabuf_mhead(out_data),
4696 res);
4697 if (res < 0) {
4698 tls_show_errors(MSG_INFO, __func__,
4699 "Handshake failed - BIO_read");
4700 if (BIO_reset(conn->ssl_out) < 0) {
4701 tls_show_errors(MSG_INFO, __func__,
4702 "BIO_reset failed");
4703 }
4704 wpabuf_free(out_data);
4705 return NULL;
4706 }
4707 wpabuf_put(out_data, res);
4708
4709 return out_data;
4710 }
4711
4712
4713 static struct wpabuf *
openssl_get_appl_data(struct tls_connection * conn,size_t max_len)4714 openssl_get_appl_data(struct tls_connection *conn, size_t max_len)
4715 {
4716 struct wpabuf *appl_data;
4717 int res;
4718
4719 appl_data = wpabuf_alloc(max_len + 100);
4720 if (appl_data == NULL)
4721 return NULL;
4722
4723 res = SSL_read(conn->ssl, wpabuf_mhead(appl_data),
4724 wpabuf_size(appl_data));
4725 if (res < 0) {
4726 int err = SSL_get_error(conn->ssl, res);
4727 if (err == SSL_ERROR_WANT_READ ||
4728 err == SSL_ERROR_WANT_WRITE) {
4729 wpa_printf(MSG_DEBUG, "SSL: No Application Data "
4730 "included");
4731 } else {
4732 tls_show_errors(MSG_INFO, __func__,
4733 "Failed to read possible "
4734 "Application Data");
4735 }
4736 wpabuf_free(appl_data);
4737 return NULL;
4738 }
4739
4740 wpabuf_put(appl_data, res);
4741 wpa_hexdump_buf_key(MSG_MSGDUMP, "SSL: Application Data in Finished "
4742 "message", appl_data);
4743
4744 return appl_data;
4745 }
4746
4747
4748 static struct wpabuf *
openssl_connection_handshake(struct tls_connection * conn,const struct wpabuf * in_data,struct wpabuf ** appl_data)4749 openssl_connection_handshake(struct tls_connection *conn,
4750 const struct wpabuf *in_data,
4751 struct wpabuf **appl_data)
4752 {
4753 struct wpabuf *out_data;
4754
4755 if (appl_data)
4756 *appl_data = NULL;
4757
4758 out_data = openssl_handshake(conn, in_data);
4759 if (out_data == NULL)
4760 return NULL;
4761 if (conn->invalid_hb_used) {
4762 wpa_printf(MSG_INFO, "TLS: Heartbeat attack detected - do not send response");
4763 wpabuf_free(out_data);
4764 return NULL;
4765 }
4766
4767 if (SSL_is_init_finished(conn->ssl)) {
4768 wpa_printf(MSG_DEBUG,
4769 "OpenSSL: Handshake finished - resumed=%d",
4770 tls_connection_resumed(conn->ssl_ctx, conn));
4771 if (conn->server) {
4772 char *buf;
4773 size_t buflen = 2000;
4774
4775 buf = os_malloc(buflen);
4776 if (buf) {
4777 if (SSL_get_shared_ciphers(conn->ssl, buf,
4778 buflen)) {
4779 buf[buflen - 1] = '\0';
4780 wpa_printf(MSG_DEBUG,
4781 "OpenSSL: Shared ciphers: %s",
4782 buf);
4783 }
4784 os_free(buf);
4785 }
4786 }
4787 if (appl_data && in_data)
4788 *appl_data = openssl_get_appl_data(conn,
4789 wpabuf_len(in_data));
4790 }
4791
4792 if (conn->invalid_hb_used) {
4793 wpa_printf(MSG_INFO, "TLS: Heartbeat attack detected - do not send response");
4794 if (appl_data) {
4795 wpabuf_free(*appl_data);
4796 *appl_data = NULL;
4797 }
4798 wpabuf_free(out_data);
4799 return NULL;
4800 }
4801
4802 return out_data;
4803 }
4804
4805
4806 struct wpabuf *
tls_connection_handshake(void * ssl_ctx,struct tls_connection * conn,const struct wpabuf * in_data,struct wpabuf ** appl_data)4807 tls_connection_handshake(void *ssl_ctx, struct tls_connection *conn,
4808 const struct wpabuf *in_data,
4809 struct wpabuf **appl_data)
4810 {
4811 return openssl_connection_handshake(conn, in_data, appl_data);
4812 }
4813
4814
tls_connection_server_handshake(void * tls_ctx,struct tls_connection * conn,const struct wpabuf * in_data,struct wpabuf ** appl_data)4815 struct wpabuf * tls_connection_server_handshake(void *tls_ctx,
4816 struct tls_connection *conn,
4817 const struct wpabuf *in_data,
4818 struct wpabuf **appl_data)
4819 {
4820 conn->server = 1;
4821 return openssl_connection_handshake(conn, in_data, appl_data);
4822 }
4823
4824
tls_connection_encrypt(void * tls_ctx,struct tls_connection * conn,const struct wpabuf * in_data)4825 struct wpabuf * tls_connection_encrypt(void *tls_ctx,
4826 struct tls_connection *conn,
4827 const struct wpabuf *in_data)
4828 {
4829 int res;
4830 struct wpabuf *buf;
4831
4832 if (conn == NULL)
4833 return NULL;
4834
4835 /* Give plaintext data for OpenSSL to encrypt into the TLS tunnel. */
4836 if ((res = BIO_reset(conn->ssl_in)) < 0 ||
4837 (res = BIO_reset(conn->ssl_out)) < 0) {
4838 tls_show_errors(MSG_INFO, __func__, "BIO_reset failed");
4839 return NULL;
4840 }
4841 res = SSL_write(conn->ssl, wpabuf_head(in_data), wpabuf_len(in_data));
4842 if (res < 0) {
4843 tls_show_errors(MSG_INFO, __func__,
4844 "Encryption failed - SSL_write");
4845 return NULL;
4846 }
4847
4848 /* Read encrypted data to be sent to the server */
4849 buf = wpabuf_alloc(wpabuf_len(in_data) + 300);
4850 if (buf == NULL)
4851 return NULL;
4852 res = BIO_read(conn->ssl_out, wpabuf_mhead(buf), wpabuf_size(buf));
4853 if (res < 0) {
4854 tls_show_errors(MSG_INFO, __func__,
4855 "Encryption failed - BIO_read");
4856 wpabuf_free(buf);
4857 return NULL;
4858 }
4859 wpabuf_put(buf, res);
4860
4861 return buf;
4862 }
4863
4864
tls_connection_decrypt(void * tls_ctx,struct tls_connection * conn,const struct wpabuf * in_data)4865 struct wpabuf * tls_connection_decrypt(void *tls_ctx,
4866 struct tls_connection *conn,
4867 const struct wpabuf *in_data)
4868 {
4869 int res;
4870 struct wpabuf *buf;
4871
4872 /* Give encrypted data from TLS tunnel for OpenSSL to decrypt. */
4873 res = BIO_write(conn->ssl_in, wpabuf_head(in_data),
4874 wpabuf_len(in_data));
4875 if (res < 0) {
4876 tls_show_errors(MSG_INFO, __func__,
4877 "Decryption failed - BIO_write");
4878 return NULL;
4879 }
4880 if (BIO_reset(conn->ssl_out) < 0) {
4881 tls_show_errors(MSG_INFO, __func__, "BIO_reset failed");
4882 return NULL;
4883 }
4884
4885 /* Read decrypted data for further processing */
4886 /*
4887 * Even though we try to disable TLS compression, it is possible that
4888 * this cannot be done with all TLS libraries. Add extra buffer space
4889 * to handle the possibility of the decrypted data being longer than
4890 * input data.
4891 */
4892 buf = wpabuf_alloc((wpabuf_len(in_data) + 500) * 3);
4893 if (buf == NULL)
4894 return NULL;
4895 res = SSL_read(conn->ssl, wpabuf_mhead(buf), wpabuf_size(buf));
4896 if (res < 0) {
4897 int err = SSL_get_error(conn->ssl, res);
4898
4899 if (err == SSL_ERROR_WANT_READ) {
4900 wpa_printf(MSG_DEBUG,
4901 "SSL: SSL_connect - want more data");
4902 res = 0;
4903 } else {
4904 tls_show_errors(MSG_INFO, __func__,
4905 "Decryption failed - SSL_read");
4906 wpabuf_free(buf);
4907 return NULL;
4908 }
4909 }
4910 wpabuf_put(buf, res);
4911
4912 if (conn->invalid_hb_used) {
4913 wpa_printf(MSG_INFO, "TLS: Heartbeat attack detected - do not send response");
4914 wpabuf_free(buf);
4915 return NULL;
4916 }
4917
4918 return buf;
4919 }
4920
4921
tls_connection_resumed(void * ssl_ctx,struct tls_connection * conn)4922 int tls_connection_resumed(void *ssl_ctx, struct tls_connection *conn)
4923 {
4924 return conn ? SSL_session_reused(conn->ssl) : 0;
4925 }
4926
4927
tls_connection_set_cipher_list(void * tls_ctx,struct tls_connection * conn,u8 * ciphers)4928 int tls_connection_set_cipher_list(void *tls_ctx, struct tls_connection *conn,
4929 u8 *ciphers)
4930 {
4931 char buf[500], *pos, *end;
4932 u8 *c;
4933 int ret;
4934
4935 if (conn == NULL || conn->ssl == NULL || ciphers == NULL)
4936 return -1;
4937
4938 buf[0] = '\0';
4939 pos = buf;
4940 end = pos + sizeof(buf);
4941
4942 c = ciphers;
4943 while (*c != TLS_CIPHER_NONE) {
4944 const char *suite;
4945
4946 switch (*c) {
4947 case TLS_CIPHER_RC4_SHA:
4948 suite = "RC4-SHA";
4949 break;
4950 case TLS_CIPHER_AES128_SHA:
4951 suite = "AES128-SHA";
4952 break;
4953 case TLS_CIPHER_RSA_DHE_AES128_SHA:
4954 suite = "DHE-RSA-AES128-SHA";
4955 break;
4956 case TLS_CIPHER_ANON_DH_AES128_SHA:
4957 suite = "ADH-AES128-SHA";
4958 break;
4959 case TLS_CIPHER_RSA_DHE_AES256_SHA:
4960 suite = "DHE-RSA-AES256-SHA";
4961 break;
4962 case TLS_CIPHER_AES256_SHA:
4963 suite = "AES256-SHA";
4964 break;
4965 default:
4966 wpa_printf(MSG_DEBUG, "TLS: Unsupported "
4967 "cipher selection: %d", *c);
4968 return -1;
4969 }
4970 ret = os_snprintf(pos, end - pos, ":%s", suite);
4971 if (os_snprintf_error(end - pos, ret))
4972 break;
4973 pos += ret;
4974
4975 c++;
4976 }
4977 if (!buf[0]) {
4978 wpa_printf(MSG_DEBUG, "OpenSSL: No ciphers listed");
4979 return -1;
4980 }
4981
4982 wpa_printf(MSG_DEBUG, "OpenSSL: cipher suites: %s", buf + 1);
4983
4984 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
4985 #ifdef EAP_FAST_OR_TEAP
4986 if (os_strstr(buf, ":ADH-")) {
4987 /*
4988 * Need to drop to security level 0 to allow anonymous
4989 * cipher suites for EAP-FAST.
4990 */
4991 SSL_set_security_level(conn->ssl, 0);
4992 } else if (SSL_get_security_level(conn->ssl) == 0) {
4993 /* Force at least security level 1 */
4994 SSL_set_security_level(conn->ssl, 1);
4995 }
4996 #endif /* EAP_FAST_OR_TEAP */
4997 #endif
4998
4999 if (SSL_set_cipher_list(conn->ssl, buf + 1) != 1) {
5000 tls_show_errors(MSG_INFO, __func__,
5001 "Cipher suite configuration failed");
5002 return -1;
5003 }
5004
5005 return 0;
5006 }
5007
5008
tls_get_version(void * ssl_ctx,struct tls_connection * conn,char * buf,size_t buflen)5009 int tls_get_version(void *ssl_ctx, struct tls_connection *conn,
5010 char *buf, size_t buflen)
5011 {
5012 const char *name;
5013 if (conn == NULL || conn->ssl == NULL)
5014 return -1;
5015
5016 name = SSL_get_version(conn->ssl);
5017 if (name == NULL)
5018 return -1;
5019
5020 os_strlcpy(buf, name, buflen);
5021 return 0;
5022 }
5023
5024
tls_get_cipher(void * ssl_ctx,struct tls_connection * conn,char * buf,size_t buflen)5025 int tls_get_cipher(void *ssl_ctx, struct tls_connection *conn,
5026 char *buf, size_t buflen)
5027 {
5028 const char *name;
5029 if (conn == NULL || conn->ssl == NULL)
5030 return -1;
5031
5032 name = SSL_get_cipher(conn->ssl);
5033 if (name == NULL)
5034 return -1;
5035
5036 os_strlcpy(buf, name, buflen);
5037 return 0;
5038 }
5039
5040
tls_connection_enable_workaround(void * ssl_ctx,struct tls_connection * conn)5041 int tls_connection_enable_workaround(void *ssl_ctx,
5042 struct tls_connection *conn)
5043 {
5044 SSL_set_options(conn->ssl, SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS);
5045
5046 return 0;
5047 }
5048
5049
5050 #ifdef EAP_FAST_OR_TEAP
5051 /* ClientHello TLS extensions require a patch to openssl, so this function is
5052 * commented out unless explicitly needed for EAP-FAST in order to be able to
5053 * build this file with unmodified openssl. */
tls_connection_client_hello_ext(void * ssl_ctx,struct tls_connection * conn,int ext_type,const u8 * data,size_t data_len)5054 int tls_connection_client_hello_ext(void *ssl_ctx, struct tls_connection *conn,
5055 int ext_type, const u8 *data,
5056 size_t data_len)
5057 {
5058 if (conn == NULL || conn->ssl == NULL || ext_type != 35)
5059 return -1;
5060
5061 if (SSL_set_session_ticket_ext(conn->ssl, (void *) data,
5062 data_len) != 1)
5063 return -1;
5064
5065 return 0;
5066 }
5067 #endif /* EAP_FAST_OR_TEAP */
5068
5069
tls_connection_get_failed(void * ssl_ctx,struct tls_connection * conn)5070 int tls_connection_get_failed(void *ssl_ctx, struct tls_connection *conn)
5071 {
5072 if (conn == NULL)
5073 return -1;
5074 return conn->failed;
5075 }
5076
5077
tls_connection_get_read_alerts(void * ssl_ctx,struct tls_connection * conn)5078 int tls_connection_get_read_alerts(void *ssl_ctx, struct tls_connection *conn)
5079 {
5080 if (conn == NULL)
5081 return -1;
5082 return conn->read_alerts;
5083 }
5084
5085
tls_connection_get_write_alerts(void * ssl_ctx,struct tls_connection * conn)5086 int tls_connection_get_write_alerts(void *ssl_ctx, struct tls_connection *conn)
5087 {
5088 if (conn == NULL)
5089 return -1;
5090 return conn->write_alerts;
5091 }
5092
5093
5094 #ifdef HAVE_OCSP
5095
ocsp_debug_print_resp(OCSP_RESPONSE * rsp)5096 static void ocsp_debug_print_resp(OCSP_RESPONSE *rsp)
5097 {
5098 #ifndef CONFIG_NO_STDOUT_DEBUG
5099 BIO *out;
5100 size_t rlen;
5101 char *txt;
5102 int res;
5103
5104 if (wpa_debug_level > MSG_DEBUG)
5105 return;
5106
5107 out = BIO_new(BIO_s_mem());
5108 if (!out)
5109 return;
5110
5111 OCSP_RESPONSE_print(out, rsp, 0);
5112 rlen = BIO_ctrl_pending(out);
5113 txt = os_malloc(rlen + 1);
5114 if (!txt) {
5115 BIO_free(out);
5116 return;
5117 }
5118
5119 res = BIO_read(out, txt, rlen);
5120 if (res > 0) {
5121 txt[res] = '\0';
5122 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP Response\n%s", txt);
5123 }
5124 os_free(txt);
5125 BIO_free(out);
5126 #endif /* CONFIG_NO_STDOUT_DEBUG */
5127 }
5128
5129
ocsp_resp_cb(SSL * s,void * arg)5130 static int ocsp_resp_cb(SSL *s, void *arg)
5131 {
5132 struct tls_connection *conn = arg;
5133 const unsigned char *p;
5134 int len, status, reason, res;
5135 OCSP_RESPONSE *rsp;
5136 OCSP_BASICRESP *basic;
5137 OCSP_CERTID *id;
5138 ASN1_GENERALIZEDTIME *produced_at, *this_update, *next_update;
5139 X509_STORE *store;
5140 STACK_OF(X509) *certs = NULL;
5141
5142 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
5143 if (!p) {
5144 #if OPENSSL_VERSION_NUMBER >= 0x10101000L
5145 #if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER >= 0x30400000L
5146 if (SSL_version(s) == TLS1_3_VERSION && SSL_session_reused(s)) {
5147 /* TLS 1.3 sends the OCSP response with the server
5148 * Certificate message. Since that Certificate message
5149 * is not sent when resuming a session, there can be no
5150 * new OCSP response. Allow this since the OCSP response
5151 * was validated when checking the initial certificate
5152 * exchange. */
5153 wpa_printf(MSG_DEBUG,
5154 "OpenSSL: Allow no OCSP response when using TLS 1.3 and a resumed session");
5155 return 1;
5156 }
5157 #endif
5158 #endif
5159 wpa_printf(MSG_DEBUG, "OpenSSL: No OCSP response received");
5160 return (conn->flags & TLS_CONN_REQUIRE_OCSP) ? 0 : 1;
5161 }
5162
5163 wpa_hexdump(MSG_DEBUG, "OpenSSL: OCSP response", p, len);
5164
5165 rsp = d2i_OCSP_RESPONSE(NULL, &p, len);
5166 if (!rsp) {
5167 wpa_printf(MSG_INFO, "OpenSSL: Failed to parse OCSP response");
5168 return 0;
5169 }
5170
5171 ocsp_debug_print_resp(rsp);
5172
5173 status = OCSP_response_status(rsp);
5174 if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL) {
5175 wpa_printf(MSG_INFO, "OpenSSL: OCSP responder error %d (%s)",
5176 status, OCSP_response_status_str(status));
5177 return 0;
5178 }
5179
5180 basic = OCSP_response_get1_basic(rsp);
5181 if (!basic) {
5182 wpa_printf(MSG_INFO, "OpenSSL: Could not find BasicOCSPResponse");
5183 return 0;
5184 }
5185
5186 store = SSL_CTX_get_cert_store(conn->ssl_ctx);
5187 if (conn->peer_issuer) {
5188 debug_print_cert(conn->peer_issuer, "Add OCSP issuer");
5189
5190 if (X509_STORE_add_cert(store, conn->peer_issuer) != 1) {
5191 tls_show_errors(MSG_INFO, __func__,
5192 "OpenSSL: Could not add issuer to certificate store");
5193 }
5194 certs = sk_X509_new_null();
5195 if (certs) {
5196 X509 *cert;
5197 cert = X509_dup(conn->peer_issuer);
5198 if (cert && !sk_X509_push(certs, cert)) {
5199 tls_show_errors(
5200 MSG_INFO, __func__,
5201 "OpenSSL: Could not add issuer to OCSP responder trust store");
5202 X509_free(cert);
5203 sk_X509_free(certs);
5204 certs = NULL;
5205 }
5206 if (certs && conn->peer_issuer_issuer) {
5207 cert = X509_dup(conn->peer_issuer_issuer);
5208 if (cert && !sk_X509_push(certs, cert)) {
5209 tls_show_errors(
5210 MSG_INFO, __func__,
5211 "OpenSSL: Could not add issuer's issuer to OCSP responder trust store");
5212 X509_free(cert);
5213 }
5214 }
5215 }
5216 }
5217
5218 status = OCSP_basic_verify(basic, certs, store, OCSP_TRUSTOTHER);
5219 sk_X509_pop_free(certs, X509_free);
5220 if (status <= 0) {
5221 tls_show_errors(MSG_INFO, __func__,
5222 "OpenSSL: OCSP response failed verification");
5223 OCSP_BASICRESP_free(basic);
5224 OCSP_RESPONSE_free(rsp);
5225 return 0;
5226 }
5227
5228 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP response verification succeeded");
5229
5230 if (!conn->peer_cert) {
5231 wpa_printf(MSG_DEBUG, "OpenSSL: Peer certificate not available for OCSP status check");
5232 OCSP_BASICRESP_free(basic);
5233 OCSP_RESPONSE_free(rsp);
5234 return 0;
5235 }
5236
5237 if (!conn->peer_issuer) {
5238 wpa_printf(MSG_DEBUG, "OpenSSL: Peer issuer certificate not available for OCSP status check");
5239 OCSP_BASICRESP_free(basic);
5240 OCSP_RESPONSE_free(rsp);
5241 return 0;
5242 }
5243
5244 id = OCSP_cert_to_id(EVP_sha256(), conn->peer_cert, conn->peer_issuer);
5245 if (!id) {
5246 wpa_printf(MSG_DEBUG,
5247 "OpenSSL: Could not create OCSP certificate identifier (SHA256)");
5248 OCSP_BASICRESP_free(basic);
5249 OCSP_RESPONSE_free(rsp);
5250 return 0;
5251 }
5252
5253 res = OCSP_resp_find_status(basic, id, &status, &reason, &produced_at,
5254 &this_update, &next_update);
5255 if (!res) {
5256 OCSP_CERTID_free(id);
5257 id = OCSP_cert_to_id(NULL, conn->peer_cert, conn->peer_issuer);
5258 if (!id) {
5259 wpa_printf(MSG_DEBUG,
5260 "OpenSSL: Could not create OCSP certificate identifier (SHA1)");
5261 OCSP_BASICRESP_free(basic);
5262 OCSP_RESPONSE_free(rsp);
5263 return 0;
5264 }
5265
5266 res = OCSP_resp_find_status(basic, id, &status, &reason,
5267 &produced_at, &this_update,
5268 &next_update);
5269 }
5270
5271 if (!res) {
5272 wpa_printf(MSG_INFO, "OpenSSL: Could not find current server certificate from OCSP response%s",
5273 (conn->flags & TLS_CONN_REQUIRE_OCSP) ? "" :
5274 " (OCSP not required)");
5275 OCSP_CERTID_free(id);
5276 OCSP_BASICRESP_free(basic);
5277 OCSP_RESPONSE_free(rsp);
5278 return (conn->flags & TLS_CONN_REQUIRE_OCSP) ? 0 : 1;
5279 }
5280 OCSP_CERTID_free(id);
5281
5282 if (!OCSP_check_validity(this_update, next_update, 5 * 60, -1)) {
5283 tls_show_errors(MSG_INFO, __func__,
5284 "OpenSSL: OCSP status times invalid");
5285 OCSP_BASICRESP_free(basic);
5286 OCSP_RESPONSE_free(rsp);
5287 return 0;
5288 }
5289
5290 OCSP_BASICRESP_free(basic);
5291 OCSP_RESPONSE_free(rsp);
5292
5293 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status for server certificate: %s",
5294 OCSP_cert_status_str(status));
5295
5296 if (status == V_OCSP_CERTSTATUS_GOOD)
5297 return 1;
5298 if (status == V_OCSP_CERTSTATUS_REVOKED)
5299 return 0;
5300 if (conn->flags & TLS_CONN_REQUIRE_OCSP) {
5301 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status unknown, but OCSP required");
5302 return 0;
5303 }
5304 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status unknown, but OCSP was not required, so allow connection to continue");
5305 return 1;
5306 }
5307
5308
ocsp_status_cb(SSL * s,void * arg)5309 static int ocsp_status_cb(SSL *s, void *arg)
5310 {
5311 char *tmp;
5312 char *resp;
5313 size_t len;
5314
5315 if (tls_global->ocsp_stapling_response == NULL) {
5316 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status callback - no response configured");
5317 return SSL_TLSEXT_ERR_OK;
5318 }
5319
5320 resp = os_readfile(tls_global->ocsp_stapling_response, &len);
5321 if (resp == NULL) {
5322 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status callback - could not read response file");
5323 /* TODO: Build OCSPResponse with responseStatus = internalError
5324 */
5325 return SSL_TLSEXT_ERR_OK;
5326 }
5327 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status callback - send cached response");
5328 tmp = OPENSSL_malloc(len);
5329 if (tmp == NULL) {
5330 os_free(resp);
5331 return SSL_TLSEXT_ERR_ALERT_FATAL;
5332 }
5333
5334 os_memcpy(tmp, resp, len);
5335 os_free(resp);
5336 SSL_set_tlsext_status_ocsp_resp(s, tmp, len);
5337
5338 return SSL_TLSEXT_ERR_OK;
5339 }
5340
5341 #endif /* HAVE_OCSP */
5342
5343
max_str_len(const char ** lines)5344 static size_t max_str_len(const char **lines)
5345 {
5346 const char **p;
5347 size_t max_len = 0;
5348
5349 for (p = lines; *p; p++) {
5350 size_t len = os_strlen(*p);
5351
5352 if (len > max_len)
5353 max_len = len;
5354 }
5355
5356 return max_len;
5357 }
5358
5359
match_lines_in_file(const char * path,const char ** lines)5360 static int match_lines_in_file(const char *path, const char **lines)
5361 {
5362 FILE *f;
5363 char *buf;
5364 size_t bufsize;
5365 int found = 0, is_linestart = 1;
5366
5367 bufsize = max_str_len(lines) + sizeof("\r\n");
5368 buf = os_malloc(bufsize);
5369 if (!buf)
5370 return 0;
5371
5372 f = fopen(path, "r");
5373 if (!f) {
5374 os_free(buf);
5375 return 0;
5376 }
5377
5378 while (!found && fgets(buf, bufsize, f)) {
5379 int is_lineend;
5380 size_t len;
5381 const char **p;
5382
5383 len = strcspn(buf, "\r\n");
5384 is_lineend = buf[len] != '\0';
5385 buf[len] = '\0';
5386
5387 if (is_linestart && is_lineend) {
5388 for (p = lines; !found && *p; p++)
5389 found = os_strcmp(buf, *p) == 0;
5390 }
5391 is_linestart = is_lineend;
5392 }
5393
5394 fclose(f);
5395 bin_clear_free(buf, bufsize);
5396
5397 return found;
5398 }
5399
5400
is_tpm2_key(const char * path)5401 static int is_tpm2_key(const char *path)
5402 {
5403 /* Check both new and old format of TPM2 PEM guard tag */
5404 static const char *tpm2_tags[] = {
5405 "-----BEGIN TSS2 PRIVATE KEY-----",
5406 "-----BEGIN TSS2 KEY BLOB-----",
5407 NULL
5408 };
5409
5410 return match_lines_in_file(path, tpm2_tags);
5411 }
5412
5413
tls_connection_set_params(void * tls_ctx,struct tls_connection * conn,const struct tls_connection_params * params)5414 int tls_connection_set_params(void *tls_ctx, struct tls_connection *conn,
5415 const struct tls_connection_params *params)
5416 {
5417 struct tls_data *data = tls_ctx;
5418 int ret;
5419 unsigned long err;
5420 int can_pkcs11 = 0;
5421 const char *key_id = params->key_id;
5422 const char *cert_id = params->cert_id;
5423 const char *ca_cert_id = params->ca_cert_id;
5424 const char *engine_id = params->engine ? params->engine_id : NULL;
5425 const char *ciphers;
5426
5427 if (conn == NULL)
5428 return -1;
5429
5430 if (params->flags & TLS_CONN_REQUIRE_OCSP_ALL) {
5431 wpa_printf(MSG_INFO,
5432 "OpenSSL: ocsp=3 not supported");
5433 return -1;
5434 }
5435
5436 /*
5437 * If the engine isn't explicitly configured, and any of the
5438 * cert/key fields are actually PKCS#11 URIs, then automatically
5439 * use the PKCS#11 ENGINE.
5440 */
5441 if (!engine_id || os_strcmp(engine_id, "pkcs11") == 0)
5442 can_pkcs11 = 1;
5443
5444 if (!key_id && params->private_key && can_pkcs11 &&
5445 os_strncmp(params->private_key, "pkcs11:", 7) == 0) {
5446 can_pkcs11 = 2;
5447 key_id = params->private_key;
5448 }
5449
5450 if (!cert_id && params->client_cert && can_pkcs11 &&
5451 os_strncmp(params->client_cert, "pkcs11:", 7) == 0) {
5452 can_pkcs11 = 2;
5453 cert_id = params->client_cert;
5454 }
5455
5456 if (!ca_cert_id && params->ca_cert && can_pkcs11 &&
5457 os_strncmp(params->ca_cert, "pkcs11:", 7) == 0) {
5458 can_pkcs11 = 2;
5459 ca_cert_id = params->ca_cert;
5460 }
5461
5462 /* If we need to automatically enable the PKCS#11 ENGINE, do so. */
5463 if (can_pkcs11 == 2 && !engine_id)
5464 engine_id = "pkcs11";
5465
5466 /* If private_key points to a TPM2-wrapped key, automatically enable
5467 * tpm2 engine and use it to unwrap the key. */
5468 if (params->private_key &&
5469 (!engine_id || os_strcmp(engine_id, "tpm2") == 0) &&
5470 is_tpm2_key(params->private_key)) {
5471 wpa_printf(MSG_DEBUG, "OpenSSL: Found TPM2 wrapped key %s",
5472 params->private_key);
5473 key_id = key_id ? key_id : params->private_key;
5474 engine_id = engine_id ? engine_id : "tpm2";
5475 }
5476
5477 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
5478 #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
5479 if (params->flags & TLS_CONN_EAP_FAST) {
5480 wpa_printf(MSG_DEBUG,
5481 "OpenSSL: Use TLSv1_method() for EAP-FAST");
5482 if (SSL_set_ssl_method(conn->ssl, TLSv1_method()) != 1) {
5483 tls_show_errors(MSG_INFO, __func__,
5484 "Failed to set TLSv1_method() for EAP-FAST");
5485 return -1;
5486 }
5487 }
5488 #endif
5489 #if OPENSSL_VERSION_NUMBER >= 0x10101000L
5490 #ifdef SSL_OP_NO_TLSv1_3
5491 if (params->flags & TLS_CONN_EAP_FAST) {
5492 /* Need to disable TLS v1.3 at least for now since OpenSSL 1.1.1
5493 * refuses to start the handshake with the modified ciphersuite
5494 * list (no TLS v1.3 ciphersuites included) for EAP-FAST. */
5495 wpa_printf(MSG_DEBUG, "OpenSSL: Disable TLSv1.3 for EAP-FAST");
5496 SSL_set_options(conn->ssl, SSL_OP_NO_TLSv1_3);
5497 }
5498 #endif /* SSL_OP_NO_TLSv1_3 */
5499 #endif
5500 #endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */
5501
5502 while ((err = ERR_get_error())) {
5503 wpa_printf(MSG_INFO, "%s: Clearing pending SSL error: %s",
5504 __func__, ERR_error_string(err, NULL));
5505 }
5506
5507 if (tls_set_conn_flags(conn, params->flags,
5508 params->openssl_ciphers) < 0)
5509 return -1;
5510
5511 if (engine_id) {
5512 wpa_printf(MSG_DEBUG, "SSL: Initializing TLS engine %s",
5513 engine_id);
5514 ret = tls_engine_init(conn, engine_id, params->pin,
5515 key_id, cert_id, ca_cert_id);
5516 if (ret)
5517 return ret;
5518 }
5519 if (tls_connection_set_subject_match(conn,
5520 params->subject_match,
5521 params->altsubject_match,
5522 params->suffix_match,
5523 params->domain_match,
5524 params->check_cert_subject))
5525 return -1;
5526
5527 if (engine_id && ca_cert_id) {
5528 if (tls_connection_engine_ca_cert(data, conn, ca_cert_id))
5529 return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED;
5530 } else if (tls_connection_ca_cert(data, conn, params->ca_cert,
5531 params->ca_cert_blob,
5532 params->ca_cert_blob_len,
5533 params->ca_path))
5534 return -1;
5535
5536 if (engine_id && cert_id) {
5537 if (tls_connection_engine_client_cert(conn, cert_id))
5538 return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED;
5539 } else if (tls_connection_client_cert(conn, params->client_cert,
5540 params->client_cert_blob,
5541 params->client_cert_blob_len))
5542 return -1;
5543
5544 if (engine_id && key_id) {
5545 wpa_printf(MSG_DEBUG, "TLS: Using private key from engine");
5546 if (tls_connection_engine_private_key(conn))
5547 return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED;
5548 } else if (tls_connection_private_key(data, conn,
5549 params->private_key,
5550 params->private_key_passwd,
5551 params->private_key_blob,
5552 params->private_key_blob_len)) {
5553 wpa_printf(MSG_INFO, "TLS: Failed to load private key '%s'",
5554 params->private_key);
5555 return -1;
5556 }
5557
5558 ciphers = params->openssl_ciphers;
5559 #ifdef CONFIG_SUITEB
5560 #ifdef OPENSSL_IS_BORINGSSL
5561 if (ciphers && os_strcmp(ciphers, "SUITEB192") == 0) {
5562 /* BoringSSL removed support for SUITEB192, so need to handle
5563 * this with hardcoded ciphersuite and additional checks for
5564 * other parameters. */
5565 ciphers = "ECDHE-ECDSA-AES256-GCM-SHA384";
5566 }
5567 #endif /* OPENSSL_IS_BORINGSSL */
5568 #endif /* CONFIG_SUITEB */
5569 if (ciphers && SSL_set_cipher_list(conn->ssl, ciphers) != 1) {
5570 wpa_printf(MSG_INFO,
5571 "OpenSSL: Failed to set cipher string '%s'",
5572 ciphers);
5573 return -1;
5574 }
5575
5576 if (!params->openssl_ecdh_curves) {
5577 #ifndef OPENSSL_IS_BORINGSSL
5578 #ifndef OPENSSL_NO_EC
5579 #if OPENSSL_VERSION_NUMBER < 0x10100000L
5580 if (SSL_set_ecdh_auto(conn->ssl, 1) != 1) {
5581 wpa_printf(MSG_INFO,
5582 "OpenSSL: Failed to set ECDH curves to auto");
5583 return -1;
5584 }
5585 #endif /* < 1.1.0 */
5586 #endif /* OPENSSL_NO_EC */
5587 #endif /* OPENSSL_IS_BORINGSSL */
5588 } else if (params->openssl_ecdh_curves[0]) {
5589 #ifdef OPENSSL_IS_BORINGSSL
5590 wpa_printf(MSG_INFO,
5591 "OpenSSL: ECDH configuration not supported");
5592 return -1;
5593 #else /* !OPENSSL_IS_BORINGSSL */
5594 #ifndef OPENSSL_NO_EC
5595 if (SSL_set1_curves_list(conn->ssl,
5596 params->openssl_ecdh_curves) != 1) {
5597 wpa_printf(MSG_INFO,
5598 "OpenSSL: Failed to set ECDH curves '%s'",
5599 params->openssl_ecdh_curves);
5600 return -1;
5601 }
5602 #else /* OPENSSL_NO_EC */
5603 wpa_printf(MSG_INFO, "OpenSSL: ECDH not supported");
5604 return -1;
5605 #endif /* OPENSSL_NO_EC */
5606 #endif /* OPENSSL_IS_BORINGSSL */
5607 }
5608
5609 #ifdef OPENSSL_IS_BORINGSSL
5610 if (params->flags & TLS_CONN_REQUEST_OCSP) {
5611 SSL_enable_ocsp_stapling(conn->ssl);
5612 }
5613 #else /* OPENSSL_IS_BORINGSSL */
5614 #ifdef HAVE_OCSP
5615 if (params->flags & TLS_CONN_REQUEST_OCSP) {
5616 SSL_CTX *ssl_ctx = data->ssl;
5617 SSL_set_tlsext_status_type(conn->ssl, TLSEXT_STATUSTYPE_ocsp);
5618 SSL_CTX_set_tlsext_status_cb(ssl_ctx, ocsp_resp_cb);
5619 SSL_CTX_set_tlsext_status_arg(ssl_ctx, conn);
5620 }
5621 #else /* HAVE_OCSP */
5622 if (params->flags & TLS_CONN_REQUIRE_OCSP) {
5623 wpa_printf(MSG_INFO,
5624 "OpenSSL: No OCSP support included - reject configuration");
5625 return -1;
5626 }
5627 if (params->flags & TLS_CONN_REQUEST_OCSP) {
5628 wpa_printf(MSG_DEBUG,
5629 "OpenSSL: No OCSP support included - allow optional OCSP case to continue");
5630 }
5631 #endif /* HAVE_OCSP */
5632 #endif /* OPENSSL_IS_BORINGSSL */
5633
5634 conn->flags = params->flags;
5635
5636 tls_get_errors(data);
5637
5638 return 0;
5639 }
5640
5641
openssl_debug_dump_cipher_list(SSL_CTX * ssl_ctx)5642 static void openssl_debug_dump_cipher_list(SSL_CTX *ssl_ctx)
5643 {
5644 SSL *ssl;
5645 int i;
5646
5647 ssl = SSL_new(ssl_ctx);
5648 if (!ssl)
5649 return;
5650
5651 wpa_printf(MSG_DEBUG,
5652 "OpenSSL: Enabled cipher suites in priority order");
5653 for (i = 0; ; i++) {
5654 const char *cipher;
5655
5656 cipher = SSL_get_cipher_list(ssl, i);
5657 if (!cipher)
5658 break;
5659 wpa_printf(MSG_DEBUG, "Cipher %d: %s", i, cipher);
5660 }
5661
5662 SSL_free(ssl);
5663 }
5664
5665
5666 #if !defined(LIBRESSL_VERSION_NUMBER) && !defined(BORINGSSL_API_VERSION)
5667
openssl_pkey_type_str(const EVP_PKEY * pkey)5668 static const char * openssl_pkey_type_str(const EVP_PKEY *pkey)
5669 {
5670 if (!pkey)
5671 return "NULL";
5672 switch (EVP_PKEY_type(EVP_PKEY_id(pkey))) {
5673 case EVP_PKEY_RSA:
5674 return "RSA";
5675 case EVP_PKEY_DSA:
5676 return "DSA";
5677 case EVP_PKEY_DH:
5678 return "DH";
5679 case EVP_PKEY_EC:
5680 return "EC";
5681 default:
5682 return "?";
5683 }
5684 }
5685
5686
openssl_debug_dump_certificate(int i,X509 * cert)5687 static void openssl_debug_dump_certificate(int i, X509 *cert)
5688 {
5689 char buf[256];
5690 EVP_PKEY *pkey;
5691 ASN1_INTEGER *ser;
5692 char serial_num[128];
5693
5694 if (!cert)
5695 return;
5696
5697 X509_NAME_oneline(X509_get_subject_name(cert), buf, sizeof(buf));
5698
5699 ser = X509_get_serialNumber(cert);
5700 if (ser)
5701 wpa_snprintf_hex_uppercase(serial_num, sizeof(serial_num),
5702 ASN1_STRING_get0_data(ser),
5703 ASN1_STRING_length(ser));
5704 else
5705 serial_num[0] = '\0';
5706
5707 pkey = X509_get_pubkey(cert);
5708 wpa_printf(MSG_DEBUG, "%d: %s (%s) %s", i, buf,
5709 openssl_pkey_type_str(pkey), serial_num);
5710 EVP_PKEY_free(pkey);
5711 }
5712
5713
openssl_debug_dump_certificates(SSL_CTX * ssl_ctx)5714 static void openssl_debug_dump_certificates(SSL_CTX *ssl_ctx)
5715 {
5716 STACK_OF(X509) *certs;
5717
5718 wpa_printf(MSG_DEBUG, "OpenSSL: Configured certificate chain");
5719 if (SSL_CTX_get0_chain_certs(ssl_ctx, &certs) == 1) {
5720 int i;
5721
5722 for (i = sk_X509_num(certs); i > 0; i--)
5723 openssl_debug_dump_certificate(i, sk_X509_value(certs,
5724 i - 1));
5725 }
5726 openssl_debug_dump_certificate(0, SSL_CTX_get0_certificate(ssl_ctx));
5727 }
5728
5729 #endif
5730
5731
openssl_debug_dump_certificate_chains(SSL_CTX * ssl_ctx)5732 static void openssl_debug_dump_certificate_chains(SSL_CTX *ssl_ctx)
5733 {
5734 #if !defined(LIBRESSL_VERSION_NUMBER) && !defined(BORINGSSL_API_VERSION)
5735 int res;
5736
5737 for (res = SSL_CTX_set_current_cert(ssl_ctx, SSL_CERT_SET_FIRST);
5738 res == 1;
5739 res = SSL_CTX_set_current_cert(ssl_ctx, SSL_CERT_SET_NEXT))
5740 openssl_debug_dump_certificates(ssl_ctx);
5741
5742 SSL_CTX_set_current_cert(ssl_ctx, SSL_CERT_SET_FIRST);
5743 #endif
5744 }
5745
5746
openssl_debug_dump_ctx(SSL_CTX * ssl_ctx)5747 static void openssl_debug_dump_ctx(SSL_CTX *ssl_ctx)
5748 {
5749 openssl_debug_dump_cipher_list(ssl_ctx);
5750 openssl_debug_dump_certificate_chains(ssl_ctx);
5751 }
5752
5753
tls_global_set_params(void * tls_ctx,const struct tls_connection_params * params)5754 int tls_global_set_params(void *tls_ctx,
5755 const struct tls_connection_params *params)
5756 {
5757 struct tls_data *data = tls_ctx;
5758 SSL_CTX *ssl_ctx = data->ssl;
5759 unsigned long err;
5760
5761 while ((err = ERR_get_error())) {
5762 wpa_printf(MSG_INFO, "%s: Clearing pending SSL error: %s",
5763 __func__, ERR_error_string(err, NULL));
5764 }
5765
5766 os_free(data->check_cert_subject);
5767 data->check_cert_subject = NULL;
5768 if (params->check_cert_subject) {
5769 data->check_cert_subject =
5770 os_strdup(params->check_cert_subject);
5771 if (!data->check_cert_subject)
5772 return -1;
5773 }
5774
5775 if (tls_global_ca_cert(data, params->ca_cert) ||
5776 tls_global_client_cert(data, params->client_cert) ||
5777 tls_global_private_key(data, params->private_key,
5778 params->private_key_passwd) ||
5779 tls_global_client_cert(data, params->client_cert2) ||
5780 tls_global_private_key(data, params->private_key2,
5781 params->private_key_passwd2) ||
5782 tls_global_dh(data, params->dh_file)) {
5783 wpa_printf(MSG_INFO, "TLS: Failed to set global parameters");
5784 return -1;
5785 }
5786
5787 os_free(data->openssl_ciphers);
5788 if (params->openssl_ciphers) {
5789 data->openssl_ciphers = os_strdup(params->openssl_ciphers);
5790 if (!data->openssl_ciphers)
5791 return -1;
5792 } else {
5793 data->openssl_ciphers = NULL;
5794 }
5795 if (params->openssl_ciphers &&
5796 SSL_CTX_set_cipher_list(ssl_ctx, params->openssl_ciphers) != 1) {
5797 wpa_printf(MSG_INFO,
5798 "OpenSSL: Failed to set cipher string '%s'",
5799 params->openssl_ciphers);
5800 return -1;
5801 }
5802
5803 if (!params->openssl_ecdh_curves) {
5804 #ifndef OPENSSL_IS_BORINGSSL
5805 #ifndef OPENSSL_NO_EC
5806 #if OPENSSL_VERSION_NUMBER < 0x10100000L
5807 if (SSL_CTX_set_ecdh_auto(ssl_ctx, 1) != 1) {
5808 wpa_printf(MSG_INFO,
5809 "OpenSSL: Failed to set ECDH curves to auto");
5810 return -1;
5811 }
5812 #endif /* < 1.1.0 */
5813 #endif /* OPENSSL_NO_EC */
5814 #endif /* OPENSSL_IS_BORINGSSL */
5815 } else if (params->openssl_ecdh_curves[0]) {
5816 #ifdef OPENSSL_IS_BORINGSSL
5817 wpa_printf(MSG_INFO,
5818 "OpenSSL: ECDH configuration not supported");
5819 return -1;
5820 #else /* !OPENSSL_IS_BORINGSSL */
5821 #ifndef OPENSSL_NO_EC
5822 #if OPENSSL_VERSION_NUMBER < 0x10100000L
5823 SSL_CTX_set_ecdh_auto(ssl_ctx, 1);
5824 #endif
5825 if (SSL_CTX_set1_curves_list(ssl_ctx,
5826 params->openssl_ecdh_curves) !=
5827 1) {
5828 wpa_printf(MSG_INFO,
5829 "OpenSSL: Failed to set ECDH curves '%s'",
5830 params->openssl_ecdh_curves);
5831 return -1;
5832 }
5833 #else /* OPENSSL_NO_EC */
5834 wpa_printf(MSG_INFO, "OpenSSL: ECDH not supported");
5835 return -1;
5836 #endif /* OPENSSL_NO_EC */
5837 #endif /* OPENSSL_IS_BORINGSSL */
5838 }
5839
5840 #ifdef SSL_OP_NO_TICKET
5841 if (params->flags & TLS_CONN_DISABLE_SESSION_TICKET)
5842 SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_TICKET);
5843 else
5844 SSL_CTX_clear_options(ssl_ctx, SSL_OP_NO_TICKET);
5845 #endif /* SSL_OP_NO_TICKET */
5846
5847 #ifdef HAVE_OCSP
5848 SSL_CTX_set_tlsext_status_cb(ssl_ctx, ocsp_status_cb);
5849 SSL_CTX_set_tlsext_status_arg(ssl_ctx, ssl_ctx);
5850 os_free(tls_global->ocsp_stapling_response);
5851 if (params->ocsp_stapling_response)
5852 tls_global->ocsp_stapling_response =
5853 os_strdup(params->ocsp_stapling_response);
5854 else
5855 tls_global->ocsp_stapling_response = NULL;
5856 #endif /* HAVE_OCSP */
5857
5858 openssl_debug_dump_ctx(ssl_ctx);
5859
5860 return 0;
5861 }
5862
5863
5864 #ifdef EAP_FAST_OR_TEAP
5865 /* Pre-shared secred requires a patch to openssl, so this function is
5866 * commented out unless explicitly needed for EAP-FAST in order to be able to
5867 * build this file with unmodified openssl. */
5868
5869 #if (defined(OPENSSL_IS_BORINGSSL) || OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined(LIBRESSL_VERSION_NUMBER)
tls_sess_sec_cb(SSL * s,void * secret,int * secret_len,STACK_OF (SSL_CIPHER)* peer_ciphers,const SSL_CIPHER ** cipher,void * arg)5870 static int tls_sess_sec_cb(SSL *s, void *secret, int *secret_len,
5871 STACK_OF(SSL_CIPHER) *peer_ciphers,
5872 const SSL_CIPHER **cipher, void *arg)
5873 #else /* OPENSSL_IS_BORINGSSL */
5874 static int tls_sess_sec_cb(SSL *s, void *secret, int *secret_len,
5875 STACK_OF(SSL_CIPHER) *peer_ciphers,
5876 SSL_CIPHER **cipher, void *arg)
5877 #endif /* OPENSSL_IS_BORINGSSL */
5878 {
5879 struct tls_connection *conn = arg;
5880 int ret;
5881
5882 #if OPENSSL_VERSION_NUMBER < 0x10100000L
5883 if (conn == NULL || conn->session_ticket_cb == NULL)
5884 return 0;
5885
5886 ret = conn->session_ticket_cb(conn->session_ticket_cb_ctx,
5887 conn->session_ticket,
5888 conn->session_ticket_len,
5889 s->s3->client_random,
5890 s->s3->server_random, secret);
5891 #else
5892 unsigned char client_random[SSL3_RANDOM_SIZE];
5893 unsigned char server_random[SSL3_RANDOM_SIZE];
5894
5895 if (conn == NULL || conn->session_ticket_cb == NULL)
5896 return 0;
5897
5898 SSL_get_client_random(s, client_random, sizeof(client_random));
5899 SSL_get_server_random(s, server_random, sizeof(server_random));
5900
5901 ret = conn->session_ticket_cb(conn->session_ticket_cb_ctx,
5902 conn->session_ticket,
5903 conn->session_ticket_len,
5904 client_random,
5905 server_random, secret);
5906 #endif
5907
5908 os_free(conn->session_ticket);
5909 conn->session_ticket = NULL;
5910
5911 if (ret <= 0)
5912 return 0;
5913
5914 *secret_len = SSL_MAX_MASTER_KEY_LENGTH;
5915 return 1;
5916 }
5917
5918
tls_session_ticket_ext_cb(SSL * s,const unsigned char * data,int len,void * arg)5919 static int tls_session_ticket_ext_cb(SSL *s, const unsigned char *data,
5920 int len, void *arg)
5921 {
5922 struct tls_connection *conn = arg;
5923
5924 if (conn == NULL || conn->session_ticket_cb == NULL)
5925 return 0;
5926
5927 wpa_printf(MSG_DEBUG, "OpenSSL: %s: length=%d", __func__, len);
5928
5929 os_free(conn->session_ticket);
5930 conn->session_ticket = NULL;
5931
5932 wpa_hexdump(MSG_DEBUG, "OpenSSL: ClientHello SessionTicket "
5933 "extension", data, len);
5934
5935 conn->session_ticket = os_memdup(data, len);
5936 if (conn->session_ticket == NULL)
5937 return 0;
5938
5939 conn->session_ticket_len = len;
5940
5941 return 1;
5942 }
5943 #endif /* EAP_FAST_OR_TEAP */
5944
5945
tls_connection_set_session_ticket_cb(void * tls_ctx,struct tls_connection * conn,tls_session_ticket_cb cb,void * ctx)5946 int tls_connection_set_session_ticket_cb(void *tls_ctx,
5947 struct tls_connection *conn,
5948 tls_session_ticket_cb cb,
5949 void *ctx)
5950 {
5951 #ifdef EAP_FAST_OR_TEAP
5952 conn->session_ticket_cb = cb;
5953 conn->session_ticket_cb_ctx = ctx;
5954
5955 if (cb) {
5956 if (SSL_set_session_secret_cb(conn->ssl, tls_sess_sec_cb,
5957 conn) != 1)
5958 return -1;
5959 SSL_set_session_ticket_ext_cb(conn->ssl,
5960 tls_session_ticket_ext_cb, conn);
5961 } else {
5962 if (SSL_set_session_secret_cb(conn->ssl, NULL, NULL) != 1)
5963 return -1;
5964 SSL_set_session_ticket_ext_cb(conn->ssl, NULL, NULL);
5965 }
5966
5967 return 0;
5968 #else /* EAP_FAST_OR_TEAP */
5969 return -1;
5970 #endif /* EAP_FAST_OR_TEAP */
5971 }
5972
5973
tls_get_library_version(char * buf,size_t buf_len)5974 int tls_get_library_version(char *buf, size_t buf_len)
5975 {
5976 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
5977 return os_snprintf(buf, buf_len, "OpenSSL build=%s run=%s",
5978 OPENSSL_VERSION_TEXT,
5979 OpenSSL_version(OPENSSL_VERSION));
5980 #else
5981 return os_snprintf(buf, buf_len, "OpenSSL build=%s run=%s",
5982 OPENSSL_VERSION_TEXT,
5983 SSLeay_version(SSLEAY_VERSION));
5984 #endif
5985 }
5986
5987
tls_connection_set_success_data(struct tls_connection * conn,struct wpabuf * data)5988 void tls_connection_set_success_data(struct tls_connection *conn,
5989 struct wpabuf *data)
5990 {
5991 SSL_SESSION *sess;
5992 struct wpabuf *old;
5993 struct tls_session_data *sess_data = NULL;
5994
5995 if (tls_ex_idx_session < 0)
5996 goto fail;
5997 sess = SSL_get_session(conn->ssl);
5998 if (!sess)
5999 goto fail;
6000 old = SSL_SESSION_get_ex_data(sess, tls_ex_idx_session);
6001 if (old) {
6002 struct tls_session_data *found;
6003
6004 found = get_session_data(conn->context, old);
6005 wpa_printf(MSG_DEBUG,
6006 "OpenSSL: Replacing old success data %p (sess %p)%s",
6007 old, sess, found ? "" : " (not freeing)");
6008 if (found) {
6009 dl_list_del(&found->list);
6010 os_free(found);
6011 wpabuf_free(old);
6012 }
6013 }
6014
6015 sess_data = os_zalloc(sizeof(*sess_data));
6016 if (!sess_data ||
6017 SSL_SESSION_set_ex_data(sess, tls_ex_idx_session, data) != 1)
6018 goto fail;
6019
6020 sess_data->buf = data;
6021 dl_list_add(&conn->context->sessions, &sess_data->list);
6022 wpa_printf(MSG_DEBUG, "OpenSSL: Stored success data %p (sess %p)",
6023 data, sess);
6024 conn->success_data = 1;
6025 return;
6026
6027 fail:
6028 wpa_printf(MSG_INFO, "OpenSSL: Failed to store success data");
6029 wpabuf_free(data);
6030 os_free(sess_data);
6031 }
6032
6033
tls_connection_set_success_data_resumed(struct tls_connection * conn)6034 void tls_connection_set_success_data_resumed(struct tls_connection *conn)
6035 {
6036 wpa_printf(MSG_DEBUG,
6037 "OpenSSL: Success data accepted for resumed session");
6038 conn->success_data = 1;
6039 }
6040
6041
6042 const struct wpabuf *
tls_connection_get_success_data(struct tls_connection * conn)6043 tls_connection_get_success_data(struct tls_connection *conn)
6044 {
6045 SSL_SESSION *sess;
6046
6047 if (tls_ex_idx_session < 0 ||
6048 !(sess = SSL_get_session(conn->ssl)))
6049 return NULL;
6050 return SSL_SESSION_get_ex_data(sess, tls_ex_idx_session);
6051 }
6052
6053
tls_connection_remove_session(struct tls_connection * conn)6054 void tls_connection_remove_session(struct tls_connection *conn)
6055 {
6056 SSL_SESSION *sess;
6057
6058 sess = SSL_get_session(conn->ssl);
6059 if (!sess)
6060 return;
6061
6062 if (SSL_CTX_remove_session(conn->ssl_ctx, sess) != 1)
6063 wpa_printf(MSG_DEBUG,
6064 "OpenSSL: Session was not cached");
6065 else
6066 wpa_printf(MSG_DEBUG,
6067 "OpenSSL: Removed cached session to disable session resumption");
6068 }
6069
6070
tls_get_tls_unique(struct tls_connection * conn,u8 * buf,size_t max_len)6071 int tls_get_tls_unique(struct tls_connection *conn, u8 *buf, size_t max_len)
6072 {
6073 size_t len;
6074 int reused;
6075
6076 reused = SSL_session_reused(conn->ssl);
6077 if ((conn->server && !reused) || (!conn->server && reused))
6078 len = SSL_get_peer_finished(conn->ssl, buf, max_len);
6079 else
6080 len = SSL_get_finished(conn->ssl, buf, max_len);
6081
6082 if (len == 0 || len > max_len)
6083 return -1;
6084
6085 return len;
6086 }
6087
6088
tls_connection_get_cipher_suite(struct tls_connection * conn)6089 u16 tls_connection_get_cipher_suite(struct tls_connection *conn)
6090 {
6091 const SSL_CIPHER *cipher;
6092
6093 cipher = SSL_get_current_cipher(conn->ssl);
6094 if (!cipher)
6095 return 0;
6096 #if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER)
6097 return SSL_CIPHER_get_protocol_id(cipher);
6098 #else
6099 return SSL_CIPHER_get_id(cipher) & 0xFFFF;
6100 #endif
6101 }
6102
6103
tls_connection_get_peer_subject(struct tls_connection * conn)6104 const char * tls_connection_get_peer_subject(struct tls_connection *conn)
6105 {
6106 if (conn)
6107 return conn->peer_subject;
6108 return NULL;
6109 }
6110
6111
tls_connection_get_own_cert_used(struct tls_connection * conn)6112 bool tls_connection_get_own_cert_used(struct tls_connection *conn)
6113 {
6114 if (conn)
6115 return SSL_get_certificate(conn->ssl) != NULL;
6116 return false;
6117 }
6118