1 /*
2 * WPA Supplicant / TLS interface functions and an internal TLS implementation
3 * Copyright (c) 2004-2007, Jouni Malinen <j@w1.fi>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Alternatively, this software may be distributed under the terms of BSD
10 * license.
11 *
12 * See README and COPYING for more details.
13 *
14 * This file interface functions for hostapd/wpa_supplicant to use the
15 * integrated TLSv1 implementation.
16 */
17
18 #include "includes.h"
19
20 #include "common.h"
21 #include "tls.h"
22 #include "tls/tlsv1_client.h"
23 #include "tls/tlsv1_server.h"
24
25
26 static int tls_ref_count = 0;
27
28 struct tls_global {
29 int server;
30 struct tlsv1_credentials *server_cred;
31 int check_crl;
32 };
33
34 struct tls_connection {
35 struct tlsv1_client *client;
36 struct tlsv1_server *server;
37 };
38
39
tls_init(const struct tls_config * conf)40 void * tls_init(const struct tls_config *conf)
41 {
42 struct tls_global *global;
43
44 if (tls_ref_count == 0) {
45 #ifdef CONFIG_TLS_INTERNAL_CLIENT
46 if (tlsv1_client_global_init())
47 return NULL;
48 #endif /* CONFIG_TLS_INTERNAL_CLIENT */
49 #ifdef CONFIG_TLS_INTERNAL_SERVER
50 if (tlsv1_server_global_init())
51 return NULL;
52 #endif /* CONFIG_TLS_INTERNAL_SERVER */
53 }
54 tls_ref_count++;
55
56 global = os_zalloc(sizeof(*global));
57 if (global == NULL)
58 return NULL;
59
60 return global;
61 }
62
tls_deinit(void * ssl_ctx)63 void tls_deinit(void *ssl_ctx)
64 {
65 struct tls_global *global = ssl_ctx;
66 tls_ref_count--;
67 if (tls_ref_count == 0) {
68 #ifdef CONFIG_TLS_INTERNAL_CLIENT
69 tlsv1_client_global_deinit();
70 #endif /* CONFIG_TLS_INTERNAL_CLIENT */
71 #ifdef CONFIG_TLS_INTERNAL_SERVER
72 tlsv1_cred_free(global->server_cred);
73 tlsv1_server_global_deinit();
74 #endif /* CONFIG_TLS_INTERNAL_SERVER */
75 }
76 os_free(global);
77 }
78
79
tls_get_errors(void * tls_ctx)80 int tls_get_errors(void *tls_ctx)
81 {
82 return 0;
83 }
84
85
tls_connection_init(void * tls_ctx)86 struct tls_connection * tls_connection_init(void *tls_ctx)
87 {
88 struct tls_connection *conn;
89 struct tls_global *global = tls_ctx;
90
91 conn = os_zalloc(sizeof(*conn));
92 if (conn == NULL)
93 return NULL;
94
95 #ifdef CONFIG_TLS_INTERNAL_CLIENT
96 if (!global->server) {
97 conn->client = tlsv1_client_init();
98 if (conn->client == NULL) {
99 os_free(conn);
100 return NULL;
101 }
102 }
103 #endif /* CONFIG_TLS_INTERNAL_CLIENT */
104 #ifdef CONFIG_TLS_INTERNAL_SERVER
105 if (global->server) {
106 conn->server = tlsv1_server_init(global->server_cred);
107 if (conn->server == NULL) {
108 os_free(conn);
109 return NULL;
110 }
111 }
112 #endif /* CONFIG_TLS_INTERNAL_SERVER */
113
114 return conn;
115 }
116
117
tls_connection_deinit(void * tls_ctx,struct tls_connection * conn)118 void tls_connection_deinit(void *tls_ctx, struct tls_connection *conn)
119 {
120 if (conn == NULL)
121 return;
122 #ifdef CONFIG_TLS_INTERNAL_CLIENT
123 if (conn->client)
124 tlsv1_client_deinit(conn->client);
125 #endif /* CONFIG_TLS_INTERNAL_CLIENT */
126 #ifdef CONFIG_TLS_INTERNAL_SERVER
127 if (conn->server)
128 tlsv1_server_deinit(conn->server);
129 #endif /* CONFIG_TLS_INTERNAL_SERVER */
130 os_free(conn);
131 }
132
133
tls_connection_established(void * tls_ctx,struct tls_connection * conn)134 int tls_connection_established(void *tls_ctx, struct tls_connection *conn)
135 {
136 #ifdef CONFIG_TLS_INTERNAL_CLIENT
137 if (conn->client)
138 return tlsv1_client_established(conn->client);
139 #endif /* CONFIG_TLS_INTERNAL_CLIENT */
140 #ifdef CONFIG_TLS_INTERNAL_SERVER
141 if (conn->server)
142 return tlsv1_server_established(conn->server);
143 #endif /* CONFIG_TLS_INTERNAL_SERVER */
144 return 0;
145 }
146
147
tls_connection_shutdown(void * tls_ctx,struct tls_connection * conn)148 int tls_connection_shutdown(void *tls_ctx, struct tls_connection *conn)
149 {
150 #ifdef CONFIG_TLS_INTERNAL_CLIENT
151 if (conn->client)
152 return tlsv1_client_shutdown(conn->client);
153 #endif /* CONFIG_TLS_INTERNAL_CLIENT */
154 #ifdef CONFIG_TLS_INTERNAL_SERVER
155 if (conn->server)
156 return tlsv1_server_shutdown(conn->server);
157 #endif /* CONFIG_TLS_INTERNAL_SERVER */
158 return -1;
159 }
160
161
tls_connection_set_params(void * tls_ctx,struct tls_connection * conn,const struct tls_connection_params * params)162 int tls_connection_set_params(void *tls_ctx, struct tls_connection *conn,
163 const struct tls_connection_params *params)
164 {
165 #ifdef CONFIG_TLS_INTERNAL_CLIENT
166 struct tlsv1_credentials *cred;
167
168 if (conn->client == NULL)
169 return -1;
170
171 cred = tlsv1_cred_alloc();
172 if (cred == NULL)
173 return -1;
174
175 if (tlsv1_set_ca_cert(cred, params->ca_cert,
176 params->ca_cert_blob, params->ca_cert_blob_len,
177 params->ca_path)) {
178 wpa_printf(MSG_INFO, "TLS: Failed to configure trusted CA "
179 "certificates");
180 tlsv1_cred_free(cred);
181 return -1;
182 }
183
184 if (tlsv1_set_cert(cred, params->client_cert,
185 params->client_cert_blob,
186 params->client_cert_blob_len)) {
187 wpa_printf(MSG_INFO, "TLS: Failed to configure client "
188 "certificate");
189 tlsv1_cred_free(cred);
190 return -1;
191 }
192
193 if (tlsv1_set_private_key(cred, params->private_key,
194 params->private_key_passwd,
195 params->private_key_blob,
196 params->private_key_blob_len)) {
197 wpa_printf(MSG_INFO, "TLS: Failed to load private key");
198 tlsv1_cred_free(cred);
199 return -1;
200 }
201
202 if (tlsv1_set_dhparams(cred, params->dh_file, params->dh_blob,
203 params->dh_blob_len)) {
204 wpa_printf(MSG_INFO, "TLS: Failed to load DH parameters");
205 tlsv1_cred_free(cred);
206 return -1;
207 }
208
209 if (tlsv1_client_set_cred(conn->client, cred) < 0) {
210 tlsv1_cred_free(cred);
211 return -1;
212 }
213
214 return 0;
215 #else /* CONFIG_TLS_INTERNAL_CLIENT */
216 return -1;
217 #endif /* CONFIG_TLS_INTERNAL_CLIENT */
218 }
219
220
tls_global_set_params(void * tls_ctx,const struct tls_connection_params * params)221 int tls_global_set_params(void *tls_ctx,
222 const struct tls_connection_params *params)
223 {
224 #ifdef CONFIG_TLS_INTERNAL_SERVER
225 struct tls_global *global = tls_ctx;
226 struct tlsv1_credentials *cred;
227
228 /* Currently, global parameters are only set when running in server
229 * mode. */
230 global->server = 1;
231 tlsv1_cred_free(global->server_cred);
232 global->server_cred = cred = tlsv1_cred_alloc();
233 if (cred == NULL)
234 return -1;
235
236 if (tlsv1_set_ca_cert(cred, params->ca_cert, params->ca_cert_blob,
237 params->ca_cert_blob_len, params->ca_path)) {
238 wpa_printf(MSG_INFO, "TLS: Failed to configure trusted CA "
239 "certificates");
240 return -1;
241 }
242
243 if (tlsv1_set_cert(cred, params->client_cert, params->client_cert_blob,
244 params->client_cert_blob_len)) {
245 wpa_printf(MSG_INFO, "TLS: Failed to configure server "
246 "certificate");
247 return -1;
248 }
249
250 if (tlsv1_set_private_key(cred, params->private_key,
251 params->private_key_passwd,
252 params->private_key_blob,
253 params->private_key_blob_len)) {
254 wpa_printf(MSG_INFO, "TLS: Failed to load private key");
255 return -1;
256 }
257
258 if (tlsv1_set_dhparams(cred, params->dh_file, params->dh_blob,
259 params->dh_blob_len)) {
260 wpa_printf(MSG_INFO, "TLS: Failed to load DH parameters");
261 return -1;
262 }
263
264 return 0;
265 #else /* CONFIG_TLS_INTERNAL_SERVER */
266 return -1;
267 #endif /* CONFIG_TLS_INTERNAL_SERVER */
268 }
269
270
tls_global_set_verify(void * tls_ctx,int check_crl)271 int tls_global_set_verify(void *tls_ctx, int check_crl)
272 {
273 struct tls_global *global = tls_ctx;
274 global->check_crl = check_crl;
275 return 0;
276 }
277
278
tls_connection_set_verify(void * tls_ctx,struct tls_connection * conn,int verify_peer)279 int tls_connection_set_verify(void *tls_ctx, struct tls_connection *conn,
280 int verify_peer)
281 {
282 #ifdef CONFIG_TLS_INTERNAL_SERVER
283 if (conn->server)
284 return tlsv1_server_set_verify(conn->server, verify_peer);
285 #endif /* CONFIG_TLS_INTERNAL_SERVER */
286 return -1;
287 }
288
289
tls_connection_set_ia(void * tls_ctx,struct tls_connection * conn,int tls_ia)290 int tls_connection_set_ia(void *tls_ctx, struct tls_connection *conn,
291 int tls_ia)
292 {
293 return -1;
294 }
295
296
tls_connection_get_keys(void * tls_ctx,struct tls_connection * conn,struct tls_keys * keys)297 int tls_connection_get_keys(void *tls_ctx, struct tls_connection *conn,
298 struct tls_keys *keys)
299 {
300 #ifdef CONFIG_TLS_INTERNAL_CLIENT
301 if (conn->client)
302 return tlsv1_client_get_keys(conn->client, keys);
303 #endif /* CONFIG_TLS_INTERNAL_CLIENT */
304 #ifdef CONFIG_TLS_INTERNAL_SERVER
305 if (conn->server)
306 return tlsv1_server_get_keys(conn->server, keys);
307 #endif /* CONFIG_TLS_INTERNAL_SERVER */
308 return -1;
309 }
310
311
tls_connection_prf(void * tls_ctx,struct tls_connection * conn,const char * label,int server_random_first,u8 * out,size_t out_len)312 int tls_connection_prf(void *tls_ctx, struct tls_connection *conn,
313 const char *label, int server_random_first,
314 u8 *out, size_t out_len)
315 {
316 #ifdef CONFIG_TLS_INTERNAL_CLIENT
317 if (conn->client) {
318 return tlsv1_client_prf(conn->client, label,
319 server_random_first,
320 out, out_len);
321 }
322 #endif /* CONFIG_TLS_INTERNAL_CLIENT */
323 #ifdef CONFIG_TLS_INTERNAL_SERVER
324 if (conn->server) {
325 return tlsv1_server_prf(conn->server, label,
326 server_random_first,
327 out, out_len);
328 }
329 #endif /* CONFIG_TLS_INTERNAL_SERVER */
330 return -1;
331 }
332
333
tls_connection_handshake(void * tls_ctx,struct tls_connection * conn,const u8 * in_data,size_t in_len,size_t * out_len,u8 ** appl_data,size_t * appl_data_len)334 u8 * tls_connection_handshake(void *tls_ctx, struct tls_connection *conn,
335 const u8 *in_data, size_t in_len,
336 size_t *out_len, u8 **appl_data,
337 size_t *appl_data_len)
338 {
339 #ifdef CONFIG_TLS_INTERNAL_CLIENT
340 if (conn->client == NULL)
341 return NULL;
342
343 if (appl_data)
344 *appl_data = NULL;
345
346 wpa_printf(MSG_DEBUG, "TLS: %s(in_data=%p in_len=%lu)",
347 __func__, in_data, (unsigned long) in_len);
348 return tlsv1_client_handshake(conn->client, in_data, in_len, out_len,
349 appl_data, appl_data_len);
350 #else /* CONFIG_TLS_INTERNAL_CLIENT */
351 return NULL;
352 #endif /* CONFIG_TLS_INTERNAL_CLIENT */
353 }
354
355
tls_connection_server_handshake(void * tls_ctx,struct tls_connection * conn,const u8 * in_data,size_t in_len,size_t * out_len)356 u8 * tls_connection_server_handshake(void *tls_ctx,
357 struct tls_connection *conn,
358 const u8 *in_data, size_t in_len,
359 size_t *out_len)
360 {
361 #ifdef CONFIG_TLS_INTERNAL_SERVER
362 u8 *out;
363 if (conn->server == NULL)
364 return NULL;
365
366 wpa_printf(MSG_DEBUG, "TLS: %s(in_data=%p in_len=%lu)",
367 __func__, in_data, (unsigned long) in_len);
368 out = tlsv1_server_handshake(conn->server, in_data, in_len, out_len);
369 if (out == NULL && tlsv1_server_established(conn->server)) {
370 out = os_malloc(1);
371 *out_len = 0;
372 }
373 return out;
374 #else /* CONFIG_TLS_INTERNAL_SERVER */
375 return NULL;
376 #endif /* CONFIG_TLS_INTERNAL_SERVER */
377 }
378
379
tls_connection_encrypt(void * tls_ctx,struct tls_connection * conn,const u8 * in_data,size_t in_len,u8 * out_data,size_t out_len)380 int tls_connection_encrypt(void *tls_ctx, struct tls_connection *conn,
381 const u8 *in_data, size_t in_len,
382 u8 *out_data, size_t out_len)
383 {
384 #ifdef CONFIG_TLS_INTERNAL_CLIENT
385 if (conn->client) {
386 return tlsv1_client_encrypt(conn->client, in_data, in_len,
387 out_data, out_len);
388 }
389 #endif /* CONFIG_TLS_INTERNAL_CLIENT */
390 #ifdef CONFIG_TLS_INTERNAL_SERVER
391 if (conn->server) {
392 return tlsv1_server_encrypt(conn->server, in_data, in_len,
393 out_data, out_len);
394 }
395 #endif /* CONFIG_TLS_INTERNAL_SERVER */
396 return -1;
397 }
398
399
tls_connection_decrypt(void * tls_ctx,struct tls_connection * conn,const u8 * in_data,size_t in_len,u8 * out_data,size_t out_len)400 int tls_connection_decrypt(void *tls_ctx, struct tls_connection *conn,
401 const u8 *in_data, size_t in_len,
402 u8 *out_data, size_t out_len)
403 {
404 #ifdef CONFIG_TLS_INTERNAL_CLIENT
405 if (conn->client) {
406 return tlsv1_client_decrypt(conn->client, in_data, in_len,
407 out_data, out_len);
408 }
409 #endif /* CONFIG_TLS_INTERNAL_CLIENT */
410 #ifdef CONFIG_TLS_INTERNAL_SERVER
411 if (conn->server) {
412 return tlsv1_server_decrypt(conn->server, in_data, in_len,
413 out_data, out_len);
414 }
415 #endif /* CONFIG_TLS_INTERNAL_SERVER */
416 return -1;
417 }
418
419
tls_connection_resumed(void * tls_ctx,struct tls_connection * conn)420 int tls_connection_resumed(void *tls_ctx, struct tls_connection *conn)
421 {
422 #ifdef CONFIG_TLS_INTERNAL_CLIENT
423 if (conn->client)
424 return tlsv1_client_resumed(conn->client);
425 #endif /* CONFIG_TLS_INTERNAL_CLIENT */
426 #ifdef CONFIG_TLS_INTERNAL_SERVER
427 if (conn->server)
428 return tlsv1_server_resumed(conn->server);
429 #endif /* CONFIG_TLS_INTERNAL_SERVER */
430 return -1;
431 }
432
433
tls_connection_set_cipher_list(void * tls_ctx,struct tls_connection * conn,u8 * ciphers)434 int tls_connection_set_cipher_list(void *tls_ctx, struct tls_connection *conn,
435 u8 *ciphers)
436 {
437 #ifdef CONFIG_TLS_INTERNAL_CLIENT
438 if (conn->client)
439 return tlsv1_client_set_cipher_list(conn->client, ciphers);
440 #endif /* CONFIG_TLS_INTERNAL_CLIENT */
441 #ifdef CONFIG_TLS_INTERNAL_SERVER
442 if (conn->server)
443 return tlsv1_server_set_cipher_list(conn->server, ciphers);
444 #endif /* CONFIG_TLS_INTERNAL_SERVER */
445 return -1;
446 }
447
448
tls_get_cipher(void * tls_ctx,struct tls_connection * conn,char * buf,size_t buflen)449 int tls_get_cipher(void *tls_ctx, struct tls_connection *conn,
450 char *buf, size_t buflen)
451 {
452 if (conn == NULL)
453 return -1;
454 #ifdef CONFIG_TLS_INTERNAL_CLIENT
455 if (conn->client)
456 return tlsv1_client_get_cipher(conn->client, buf, buflen);
457 #endif /* CONFIG_TLS_INTERNAL_CLIENT */
458 #ifdef CONFIG_TLS_INTERNAL_SERVER
459 if (conn->server)
460 return tlsv1_server_get_cipher(conn->server, buf, buflen);
461 #endif /* CONFIG_TLS_INTERNAL_SERVER */
462 return -1;
463 }
464
465
tls_connection_enable_workaround(void * tls_ctx,struct tls_connection * conn)466 int tls_connection_enable_workaround(void *tls_ctx,
467 struct tls_connection *conn)
468 {
469 return -1;
470 }
471
472
tls_connection_client_hello_ext(void * tls_ctx,struct tls_connection * conn,int ext_type,const u8 * data,size_t data_len)473 int tls_connection_client_hello_ext(void *tls_ctx, struct tls_connection *conn,
474 int ext_type, const u8 *data,
475 size_t data_len)
476 {
477 #ifdef CONFIG_TLS_INTERNAL_CLIENT
478 if (conn->client) {
479 return tlsv1_client_hello_ext(conn->client, ext_type,
480 data, data_len);
481 }
482 #endif /* CONFIG_TLS_INTERNAL_CLIENT */
483 return -1;
484 }
485
486
tls_connection_get_failed(void * tls_ctx,struct tls_connection * conn)487 int tls_connection_get_failed(void *tls_ctx, struct tls_connection *conn)
488 {
489 return 0;
490 }
491
492
tls_connection_get_read_alerts(void * tls_ctx,struct tls_connection * conn)493 int tls_connection_get_read_alerts(void *tls_ctx, struct tls_connection *conn)
494 {
495 return 0;
496 }
497
498
tls_connection_get_write_alerts(void * tls_ctx,struct tls_connection * conn)499 int tls_connection_get_write_alerts(void *tls_ctx,
500 struct tls_connection *conn)
501 {
502 return 0;
503 }
504
505
tls_connection_get_keyblock_size(void * tls_ctx,struct tls_connection * conn)506 int tls_connection_get_keyblock_size(void *tls_ctx,
507 struct tls_connection *conn)
508 {
509 #ifdef CONFIG_TLS_INTERNAL_CLIENT
510 if (conn->client)
511 return tlsv1_client_get_keyblock_size(conn->client);
512 #endif /* CONFIG_TLS_INTERNAL_CLIENT */
513 #ifdef CONFIG_TLS_INTERNAL_SERVER
514 if (conn->server)
515 return tlsv1_server_get_keyblock_size(conn->server);
516 #endif /* CONFIG_TLS_INTERNAL_SERVER */
517 return -1;
518 }
519
520
tls_capabilities(void * tls_ctx)521 unsigned int tls_capabilities(void *tls_ctx)
522 {
523 return 0;
524 }
525
526
tls_connection_ia_send_phase_finished(void * tls_ctx,struct tls_connection * conn,int final,u8 * out_data,size_t out_len)527 int tls_connection_ia_send_phase_finished(void *tls_ctx,
528 struct tls_connection *conn,
529 int final,
530 u8 *out_data, size_t out_len)
531 {
532 return -1;
533 }
534
535
tls_connection_ia_final_phase_finished(void * tls_ctx,struct tls_connection * conn)536 int tls_connection_ia_final_phase_finished(void *tls_ctx,
537 struct tls_connection *conn)
538 {
539 return -1;
540 }
541
542
tls_connection_ia_permute_inner_secret(void * tls_ctx,struct tls_connection * conn,const u8 * key,size_t key_len)543 int tls_connection_ia_permute_inner_secret(void *tls_ctx,
544 struct tls_connection *conn,
545 const u8 *key, size_t key_len)
546 {
547 return -1;
548 }
549
550
tls_connection_set_session_ticket_cb(void * tls_ctx,struct tls_connection * conn,tls_session_ticket_cb cb,void * ctx)551 int tls_connection_set_session_ticket_cb(void *tls_ctx,
552 struct tls_connection *conn,
553 tls_session_ticket_cb cb,
554 void *ctx)
555 {
556 #ifdef CONFIG_TLS_INTERNAL_CLIENT
557 if (conn->client) {
558 tlsv1_client_set_session_ticket_cb(conn->client, cb, ctx);
559 return 0;
560 }
561 #endif /* CONFIG_TLS_INTERNAL_CLIENT */
562 #ifdef CONFIG_TLS_INTERNAL_SERVER
563 if (conn->server) {
564 tlsv1_server_set_session_ticket_cb(conn->server, cb, ctx);
565 return 0;
566 }
567 #endif /* CONFIG_TLS_INTERNAL_SERVER */
568 return -1;
569 }
570