1 /*
2  * TLSv1 client - read handshake message
3  * Copyright (c) 2006-2015, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "includes.h"
10 
11 #include "common.h"
12 #include "crypto/md5.h"
13 #include "crypto/sha1.h"
14 #include "crypto/sha256.h"
15 #include "crypto/tls.h"
16 #include "x509v3.h"
17 #include "tlsv1_common.h"
18 #include "tlsv1_record.h"
19 #include "tlsv1_client.h"
20 #include "tlsv1_client_i.h"
21 
22 static int tls_process_server_key_exchange(struct tlsv1_client *conn, u8 ct,
23 					   const u8 *in_data, size_t *in_len);
24 static int tls_process_certificate_request(struct tlsv1_client *conn, u8 ct,
25 					   const u8 *in_data, size_t *in_len);
26 static int tls_process_server_hello_done(struct tlsv1_client *conn, u8 ct,
27 					 const u8 *in_data, size_t *in_len);
28 
29 
tls_version_disabled(struct tlsv1_client * conn,u16 ver)30 static int tls_version_disabled(struct tlsv1_client *conn, u16 ver)
31 {
32 	return (((conn->flags & TLS_CONN_DISABLE_TLSv1_0) &&
33 		 ver == TLS_VERSION_1) ||
34 		((conn->flags & TLS_CONN_DISABLE_TLSv1_1) &&
35 		 ver == TLS_VERSION_1_1) ||
36 		((conn->flags & TLS_CONN_DISABLE_TLSv1_2) &&
37 		 ver == TLS_VERSION_1_2));
38 }
39 
40 
tls_process_server_hello_extensions(struct tlsv1_client * conn,const u8 * pos,size_t len)41 static int tls_process_server_hello_extensions(struct tlsv1_client *conn,
42 					       const u8 *pos, size_t len)
43 {
44 	const u8 *end = pos + len;
45 
46 	wpa_hexdump(MSG_MSGDUMP, "TLSv1: ServerHello extensions",
47 		    pos, len);
48 	while (pos < end) {
49 		u16 ext, elen;
50 
51 		if (end - pos < 4) {
52 			wpa_printf(MSG_INFO, "TLSv1: Truncated ServerHello extension header");
53 			return -1;
54 		}
55 
56 		ext = WPA_GET_BE16(pos);
57 		pos += 2;
58 		elen = WPA_GET_BE16(pos);
59 		pos += 2;
60 
61 		if (elen > end - pos) {
62 			wpa_printf(MSG_INFO, "TLSv1: Truncated ServerHello extension");
63 			return -1;
64 		}
65 
66 		wpa_printf(MSG_DEBUG, "TLSv1: ServerHello ExtensionType %u",
67 			   ext);
68 		wpa_hexdump(MSG_DEBUG, "TLSv1: ServerHello extension data",
69 			    pos, elen);
70 
71 		pos += elen;
72 	}
73 
74 	return 0;
75 }
76 
77 
tls_process_server_hello(struct tlsv1_client * conn,u8 ct,const u8 * in_data,size_t * in_len)78 static int tls_process_server_hello(struct tlsv1_client *conn, u8 ct,
79 				    const u8 *in_data, size_t *in_len)
80 {
81 	const u8 *pos, *end;
82 	size_t left, len, i;
83 	u16 cipher_suite;
84 	u16 tls_version;
85 
86 	if (ct != TLS_CONTENT_TYPE_HANDSHAKE) {
87 		wpa_printf(MSG_DEBUG, "TLSv1: Expected Handshake; "
88 			   "received content type 0x%x", ct);
89 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
90 			  TLS_ALERT_UNEXPECTED_MESSAGE);
91 		return -1;
92 	}
93 
94 	pos = in_data;
95 	left = *in_len;
96 
97 	if (left < 4)
98 		goto decode_error;
99 
100 	/* HandshakeType msg_type */
101 	if (*pos != TLS_HANDSHAKE_TYPE_SERVER_HELLO) {
102 		wpa_printf(MSG_DEBUG, "TLSv1: Received unexpected handshake "
103 			   "message %d (expected ServerHello)", *pos);
104 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
105 			  TLS_ALERT_UNEXPECTED_MESSAGE);
106 		return -1;
107 	}
108 	wpa_printf(MSG_DEBUG, "TLSv1: Received ServerHello");
109 	pos++;
110 	/* uint24 length */
111 	len = WPA_GET_BE24(pos);
112 	pos += 3;
113 	left -= 4;
114 
115 	if (len > left)
116 		goto decode_error;
117 
118 	/* body - ServerHello */
119 
120 	wpa_hexdump(MSG_MSGDUMP, "TLSv1: ServerHello", pos, len);
121 	end = pos + len;
122 
123 	/* ProtocolVersion server_version */
124 	if (end - pos < 2)
125 		goto decode_error;
126 	tls_version = WPA_GET_BE16(pos);
127 	if (!tls_version_ok(tls_version) ||
128 	    tls_version_disabled(conn, tls_version)) {
129 		wpa_printf(MSG_DEBUG, "TLSv1: Unexpected protocol version in "
130 			   "ServerHello %u.%u", pos[0], pos[1]);
131 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
132 			  TLS_ALERT_PROTOCOL_VERSION);
133 		return -1;
134 	}
135 	pos += 2;
136 
137 	wpa_printf(MSG_DEBUG, "TLSv1: Using TLS v%s",
138 		   tls_version_str(tls_version));
139 	conn->rl.tls_version = tls_version;
140 
141 	/* Random random */
142 	if (end - pos < TLS_RANDOM_LEN)
143 		goto decode_error;
144 
145 	os_memcpy(conn->server_random, pos, TLS_RANDOM_LEN);
146 	pos += TLS_RANDOM_LEN;
147 	wpa_hexdump(MSG_MSGDUMP, "TLSv1: server_random",
148 		    conn->server_random, TLS_RANDOM_LEN);
149 
150 	/* SessionID session_id */
151 	if (end - pos < 1)
152 		goto decode_error;
153 	if (end - pos < 1 + *pos || *pos > TLS_SESSION_ID_MAX_LEN)
154 		goto decode_error;
155 	if (conn->session_id_len && conn->session_id_len == *pos &&
156 	    os_memcmp(conn->session_id, pos + 1, conn->session_id_len) == 0) {
157 		pos += 1 + conn->session_id_len;
158 		wpa_printf(MSG_DEBUG, "TLSv1: Resuming old session");
159 		conn->session_resumed = 1;
160 	} else {
161 		conn->session_id_len = *pos;
162 		pos++;
163 		os_memcpy(conn->session_id, pos, conn->session_id_len);
164 		pos += conn->session_id_len;
165 	}
166 	wpa_hexdump(MSG_MSGDUMP, "TLSv1: session_id",
167 		    conn->session_id, conn->session_id_len);
168 
169 	/* CipherSuite cipher_suite */
170 	if (end - pos < 2)
171 		goto decode_error;
172 	cipher_suite = WPA_GET_BE16(pos);
173 	pos += 2;
174 	for (i = 0; i < conn->num_cipher_suites; i++) {
175 		if (cipher_suite == conn->cipher_suites[i])
176 			break;
177 	}
178 	if (i == conn->num_cipher_suites) {
179 		wpa_printf(MSG_INFO, "TLSv1: Server selected unexpected "
180 			   "cipher suite 0x%04x", cipher_suite);
181 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
182 			  TLS_ALERT_ILLEGAL_PARAMETER);
183 		return -1;
184 	}
185 
186 	if (conn->session_resumed && cipher_suite != conn->prev_cipher_suite) {
187 		wpa_printf(MSG_DEBUG, "TLSv1: Server selected a different "
188 			   "cipher suite for a resumed connection (0x%04x != "
189 			   "0x%04x)", cipher_suite, conn->prev_cipher_suite);
190 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
191 			  TLS_ALERT_ILLEGAL_PARAMETER);
192 		return -1;
193 	}
194 
195 	if (tlsv1_record_set_cipher_suite(&conn->rl, cipher_suite) < 0) {
196 		wpa_printf(MSG_DEBUG, "TLSv1: Failed to set CipherSuite for "
197 			   "record layer");
198 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
199 			  TLS_ALERT_INTERNAL_ERROR);
200 		return -1;
201 	}
202 
203 	conn->prev_cipher_suite = cipher_suite;
204 
205 	/* CompressionMethod compression_method */
206 	if (end - pos < 1)
207 		goto decode_error;
208 	if (*pos != TLS_COMPRESSION_NULL) {
209 		wpa_printf(MSG_INFO, "TLSv1: Server selected unexpected "
210 			   "compression 0x%02x", *pos);
211 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
212 			  TLS_ALERT_ILLEGAL_PARAMETER);
213 		return -1;
214 	}
215 	pos++;
216 
217 	if (end - pos >= 2) {
218 		u16 ext_len;
219 
220 		ext_len = WPA_GET_BE16(pos);
221 		pos += 2;
222 		if (end - pos < ext_len) {
223 			wpa_printf(MSG_INFO,
224 				   "TLSv1: Invalid ServerHello extension length: %u (left: %u)",
225 				   ext_len, (unsigned int) (end - pos));
226 			goto decode_error;
227 		}
228 
229 		if (tls_process_server_hello_extensions(conn, pos, ext_len))
230 			goto decode_error;
231 		pos += ext_len;
232 	}
233 
234 	if (end != pos) {
235 		wpa_hexdump(MSG_DEBUG, "TLSv1: Unexpected extra data in the "
236 			    "end of ServerHello", pos, end - pos);
237 		goto decode_error;
238 	}
239 
240 	if (conn->session_ticket_included && conn->session_ticket_cb) {
241 		/* TODO: include SessionTicket extension if one was included in
242 		 * ServerHello */
243 		int res = conn->session_ticket_cb(
244 			conn->session_ticket_cb_ctx, NULL, 0,
245 			conn->client_random, conn->server_random,
246 			conn->master_secret);
247 		if (res < 0) {
248 			wpa_printf(MSG_DEBUG, "TLSv1: SessionTicket callback "
249 				   "indicated failure");
250 			tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
251 				  TLS_ALERT_HANDSHAKE_FAILURE);
252 			return -1;
253 		}
254 		conn->use_session_ticket = !!res;
255 	}
256 
257 	if ((conn->session_resumed || conn->use_session_ticket) &&
258 	    tls_derive_keys(conn, NULL, 0)) {
259 		wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive keys");
260 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
261 			  TLS_ALERT_INTERNAL_ERROR);
262 		return -1;
263 	}
264 
265 	*in_len = end - in_data;
266 
267 	conn->state = (conn->session_resumed || conn->use_session_ticket) ?
268 		SERVER_CHANGE_CIPHER_SPEC : SERVER_CERTIFICATE;
269 
270 	return 0;
271 
272 decode_error:
273 	wpa_printf(MSG_DEBUG, "TLSv1: Failed to decode ServerHello");
274 	tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
275 	return -1;
276 }
277 
278 
tls_peer_cert_event(struct tlsv1_client * conn,int depth,struct x509_certificate * cert)279 static void tls_peer_cert_event(struct tlsv1_client *conn, int depth,
280 				struct x509_certificate *cert)
281 {
282 	union tls_event_data ev;
283 	struct wpabuf *cert_buf = NULL;
284 #ifdef CONFIG_SHA256
285 	u8 hash[32];
286 #endif /* CONFIG_SHA256 */
287 	char subject[128];
288 
289 	if (!conn->event_cb)
290 		return;
291 
292 	os_memset(&ev, 0, sizeof(ev));
293 	if ((conn->cred && conn->cred->cert_probe) || conn->cert_in_cb) {
294 		cert_buf = wpabuf_alloc_copy(cert->cert_start,
295 					     cert->cert_len);
296 		ev.peer_cert.cert = cert_buf;
297 	}
298 #ifdef CONFIG_SHA256
299 	if (cert_buf) {
300 		const u8 *addr[1];
301 		size_t len[1];
302 		addr[0] = wpabuf_head(cert_buf);
303 		len[0] = wpabuf_len(cert_buf);
304 		if (sha256_vector(1, addr, len, hash) == 0) {
305 			ev.peer_cert.hash = hash;
306 			ev.peer_cert.hash_len = sizeof(hash);
307 		}
308 	}
309 #endif /* CONFIG_SHA256 */
310 
311 	ev.peer_cert.depth = depth;
312 	x509_name_string(&cert->subject, subject, sizeof(subject));
313 	ev.peer_cert.subject = subject;
314 
315 	if (cert->extensions_present & X509_EXT_CERTIFICATE_POLICY) {
316 		if (cert->certificate_policy & X509_EXT_CERT_POLICY_TOD_STRICT)
317 			ev.peer_cert.tod = 1;
318 		else if (cert->certificate_policy &
319 			 X509_EXT_CERT_POLICY_TOD_TOFU)
320 			ev.peer_cert.tod = 2;
321 	}
322 
323 	conn->event_cb(conn->cb_ctx, TLS_PEER_CERTIFICATE, &ev);
324 	wpabuf_free(cert_buf);
325 }
326 
327 
tls_cert_chain_failure_event(struct tlsv1_client * conn,int depth,struct x509_certificate * cert,enum tls_fail_reason reason,const char * reason_txt)328 static void tls_cert_chain_failure_event(struct tlsv1_client *conn, int depth,
329 					 struct x509_certificate *cert,
330 					 enum tls_fail_reason reason,
331 					 const char *reason_txt)
332 {
333 	struct wpabuf *cert_buf = NULL;
334 	union tls_event_data ev;
335 	char subject[128];
336 
337 	if (!conn->event_cb || !cert)
338 		return;
339 
340 	os_memset(&ev, 0, sizeof(ev));
341 	ev.cert_fail.depth = depth;
342 	x509_name_string(&cert->subject, subject, sizeof(subject));
343 	ev.peer_cert.subject = subject;
344 	ev.cert_fail.reason = reason;
345 	ev.cert_fail.reason_txt = reason_txt;
346 	cert_buf = wpabuf_alloc_copy(cert->cert_start,
347 				     cert->cert_len);
348 	ev.cert_fail.cert = cert_buf;
349 	conn->event_cb(conn->cb_ctx, TLS_CERT_CHAIN_FAILURE, &ev);
350 	wpabuf_free(cert_buf);
351 }
352 
353 
tls_process_certificate(struct tlsv1_client * conn,u8 ct,const u8 * in_data,size_t * in_len)354 static int tls_process_certificate(struct tlsv1_client *conn, u8 ct,
355 				   const u8 *in_data, size_t *in_len)
356 {
357 	const u8 *pos, *end;
358 	size_t left, len, list_len, cert_len, idx;
359 	u8 type;
360 	struct x509_certificate *chain = NULL, *last = NULL, *cert;
361 	int reason;
362 
363 	if (ct != TLS_CONTENT_TYPE_HANDSHAKE) {
364 		wpa_printf(MSG_DEBUG, "TLSv1: Expected Handshake; "
365 			   "received content type 0x%x", ct);
366 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
367 			  TLS_ALERT_UNEXPECTED_MESSAGE);
368 		return -1;
369 	}
370 
371 	pos = in_data;
372 	left = *in_len;
373 
374 	if (left < 4) {
375 		wpa_printf(MSG_DEBUG, "TLSv1: Too short Certificate message "
376 			   "(len=%lu)", (unsigned long) left);
377 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
378 		return -1;
379 	}
380 
381 	type = *pos++;
382 	len = WPA_GET_BE24(pos);
383 	pos += 3;
384 	left -= 4;
385 
386 	if (len > left) {
387 		wpa_printf(MSG_DEBUG, "TLSv1: Unexpected Certificate message "
388 			   "length (len=%lu != left=%lu)",
389 			   (unsigned long) len, (unsigned long) left);
390 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
391 		return -1;
392 	}
393 
394 	if (type == TLS_HANDSHAKE_TYPE_SERVER_KEY_EXCHANGE)
395 		return tls_process_server_key_exchange(conn, ct, in_data,
396 						       in_len);
397 	if (type == TLS_HANDSHAKE_TYPE_CERTIFICATE_REQUEST)
398 		return tls_process_certificate_request(conn, ct, in_data,
399 						       in_len);
400 	if (type == TLS_HANDSHAKE_TYPE_SERVER_HELLO_DONE)
401 		return tls_process_server_hello_done(conn, ct, in_data,
402 						     in_len);
403 	if (type != TLS_HANDSHAKE_TYPE_CERTIFICATE) {
404 		wpa_printf(MSG_DEBUG, "TLSv1: Received unexpected handshake "
405 			   "message %d (expected Certificate/"
406 			   "ServerKeyExchange/CertificateRequest/"
407 			   "ServerHelloDone)", type);
408 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
409 			  TLS_ALERT_UNEXPECTED_MESSAGE);
410 		return -1;
411 	}
412 
413 	wpa_printf(MSG_DEBUG,
414 		   "TLSv1: Received Certificate (certificate_list len %lu)",
415 		   (unsigned long) len);
416 
417 	/*
418 	 * opaque ASN.1Cert<2^24-1>;
419 	 *
420 	 * struct {
421 	 *     ASN.1Cert certificate_list<1..2^24-1>;
422 	 * } Certificate;
423 	 */
424 
425 	end = pos + len;
426 
427 	if (end - pos < 3) {
428 		wpa_printf(MSG_DEBUG, "TLSv1: Too short Certificate "
429 			   "(left=%lu)", (unsigned long) left);
430 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
431 		return -1;
432 	}
433 
434 	list_len = WPA_GET_BE24(pos);
435 	pos += 3;
436 
437 	if ((size_t) (end - pos) != list_len) {
438 		wpa_printf(MSG_DEBUG, "TLSv1: Unexpected certificate_list "
439 			   "length (len=%lu left=%lu)",
440 			   (unsigned long) list_len,
441 			   (unsigned long) (end - pos));
442 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
443 		return -1;
444 	}
445 
446 	idx = 0;
447 	while (pos < end) {
448 		if (end - pos < 3) {
449 			wpa_printf(MSG_DEBUG, "TLSv1: Failed to parse "
450 				   "certificate_list");
451 			tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
452 				  TLS_ALERT_DECODE_ERROR);
453 			x509_certificate_chain_free(chain);
454 			return -1;
455 		}
456 
457 		cert_len = WPA_GET_BE24(pos);
458 		pos += 3;
459 
460 		if ((size_t) (end - pos) < cert_len) {
461 			wpa_printf(MSG_DEBUG, "TLSv1: Unexpected certificate "
462 				   "length (len=%lu left=%lu)",
463 				   (unsigned long) cert_len,
464 				   (unsigned long) (end - pos));
465 			tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
466 				  TLS_ALERT_DECODE_ERROR);
467 			x509_certificate_chain_free(chain);
468 			return -1;
469 		}
470 
471 		wpa_printf(MSG_DEBUG, "TLSv1: Certificate %lu (len %lu)",
472 			   (unsigned long) idx, (unsigned long) cert_len);
473 
474 		if (idx == 0) {
475 			crypto_public_key_free(conn->server_rsa_key);
476 			if (tls_parse_cert(pos, cert_len,
477 					   &conn->server_rsa_key)) {
478 				wpa_printf(MSG_DEBUG, "TLSv1: Failed to parse "
479 					   "the certificate");
480 				tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
481 					  TLS_ALERT_BAD_CERTIFICATE);
482 				x509_certificate_chain_free(chain);
483 				return -1;
484 			}
485 		}
486 
487 		cert = x509_certificate_parse(pos, cert_len);
488 		if (cert == NULL) {
489 			wpa_printf(MSG_DEBUG, "TLSv1: Failed to parse "
490 				   "the certificate");
491 			tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
492 				  TLS_ALERT_BAD_CERTIFICATE);
493 			x509_certificate_chain_free(chain);
494 			return -1;
495 		}
496 
497 		tls_peer_cert_event(conn, idx, cert);
498 
499 		if (last == NULL)
500 			chain = cert;
501 		else
502 			last->next = cert;
503 		last = cert;
504 
505 		idx++;
506 		pos += cert_len;
507 	}
508 
509 	if (conn->cred && conn->cred->server_cert_only && chain) {
510 		u8 hash[SHA256_MAC_LEN];
511 		char buf[128];
512 
513 		wpa_printf(MSG_DEBUG,
514 			   "TLSv1: Validate server certificate hash");
515 		x509_name_string(&chain->subject, buf, sizeof(buf));
516 		wpa_printf(MSG_DEBUG, "TLSv1: 0: %s", buf);
517 		if (sha256_vector(1, &chain->cert_start, &chain->cert_len,
518 				  hash) < 0 ||
519 		    os_memcmp(conn->cred->srv_cert_hash, hash,
520 			      SHA256_MAC_LEN) != 0) {
521 			wpa_printf(MSG_DEBUG,
522 				   "TLSv1: Server certificate hash mismatch");
523 			wpa_hexdump(MSG_MSGDUMP, "TLSv1: SHA256 hash",
524 				    hash, SHA256_MAC_LEN);
525 			if (conn->event_cb) {
526 				union tls_event_data ev;
527 
528 				os_memset(&ev, 0, sizeof(ev));
529 				ev.cert_fail.reason = TLS_FAIL_UNSPECIFIED;
530 				ev.cert_fail.reason_txt =
531 					"Server certificate mismatch";
532 				ev.cert_fail.subject = buf;
533 				conn->event_cb(conn->cb_ctx,
534 					       TLS_CERT_CHAIN_FAILURE, &ev);
535 			}
536 			tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
537 				  TLS_ALERT_BAD_CERTIFICATE);
538 			x509_certificate_chain_free(chain);
539 			return -1;
540 		}
541 	} else if (conn->cred && conn->cred->cert_probe) {
542 		wpa_printf(MSG_DEBUG,
543 			   "TLSv1: Reject server certificate on probe-only run");
544 		if (conn->event_cb) {
545 			union tls_event_data ev;
546 			char buf[128];
547 
548 			os_memset(&ev, 0, sizeof(ev));
549 			ev.cert_fail.reason = TLS_FAIL_SERVER_CHAIN_PROBE;
550 			ev.cert_fail.reason_txt =
551 				"Server certificate chain probe";
552 			if (chain) {
553 				x509_name_string(&chain->subject, buf,
554 						 sizeof(buf));
555 				ev.cert_fail.subject = buf;
556 			}
557 			conn->event_cb(conn->cb_ctx, TLS_CERT_CHAIN_FAILURE,
558 				       &ev);
559 		}
560 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
561 			  TLS_ALERT_BAD_CERTIFICATE);
562 		x509_certificate_chain_free(chain);
563 		return -1;
564 	} else if (conn->cred && conn->cred->ca_cert_verify &&
565 		   x509_certificate_chain_validate(
566 			   conn->cred->trusted_certs, chain, &reason,
567 			   !!(conn->flags & TLS_CONN_DISABLE_TIME_CHECKS))
568 		   < 0) {
569 		int tls_reason;
570 		wpa_printf(MSG_DEBUG, "TLSv1: Server certificate chain "
571 			   "validation failed (reason=%d)", reason);
572 		switch (reason) {
573 		case X509_VALIDATE_BAD_CERTIFICATE:
574 			tls_reason = TLS_ALERT_BAD_CERTIFICATE;
575 			tls_cert_chain_failure_event(
576 				conn, 0, chain, TLS_FAIL_BAD_CERTIFICATE,
577 				"bad certificate");
578 			break;
579 		case X509_VALIDATE_UNSUPPORTED_CERTIFICATE:
580 			tls_reason = TLS_ALERT_UNSUPPORTED_CERTIFICATE;
581 			break;
582 		case X509_VALIDATE_CERTIFICATE_REVOKED:
583 			tls_reason = TLS_ALERT_CERTIFICATE_REVOKED;
584 			tls_cert_chain_failure_event(
585 				conn, 0, chain, TLS_FAIL_REVOKED,
586 				"certificate revoked");
587 			break;
588 		case X509_VALIDATE_CERTIFICATE_EXPIRED:
589 			tls_reason = TLS_ALERT_CERTIFICATE_EXPIRED;
590 			tls_cert_chain_failure_event(
591 				conn, 0, chain, TLS_FAIL_EXPIRED,
592 				"certificate has expired or is not yet valid");
593 			break;
594 		case X509_VALIDATE_CERTIFICATE_UNKNOWN:
595 			tls_reason = TLS_ALERT_CERTIFICATE_UNKNOWN;
596 			break;
597 		case X509_VALIDATE_UNKNOWN_CA:
598 			tls_reason = TLS_ALERT_UNKNOWN_CA;
599 			tls_cert_chain_failure_event(
600 				conn, 0, chain, TLS_FAIL_UNTRUSTED,
601 				"unknown CA");
602 			break;
603 		default:
604 			tls_reason = TLS_ALERT_BAD_CERTIFICATE;
605 			break;
606 		}
607 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL, tls_reason);
608 		x509_certificate_chain_free(chain);
609 		return -1;
610 	}
611 
612 	if (conn->cred && !conn->cred->server_cert_only && chain &&
613 	    (chain->extensions_present & X509_EXT_EXT_KEY_USAGE) &&
614 	    !(chain->ext_key_usage &
615 	      (X509_EXT_KEY_USAGE_ANY | X509_EXT_KEY_USAGE_SERVER_AUTH))) {
616 		tls_cert_chain_failure_event(
617 			conn, 0, chain, TLS_FAIL_BAD_CERTIFICATE,
618 			"certificate not allowed for server authentication");
619 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
620 			  TLS_ALERT_BAD_CERTIFICATE);
621 		x509_certificate_chain_free(chain);
622 		return -1;
623 	}
624 
625 	if (conn->flags & TLS_CONN_REQUEST_OCSP) {
626 		x509_certificate_chain_free(conn->server_cert);
627 		conn->server_cert = chain;
628 	} else {
629 		x509_certificate_chain_free(chain);
630 	}
631 
632 	*in_len = end - in_data;
633 
634 	conn->state = SERVER_KEY_EXCHANGE;
635 
636 	return 0;
637 }
638 
639 
count_bits(const u8 * val,size_t len)640 static unsigned int count_bits(const u8 *val, size_t len)
641 {
642 	size_t i;
643 	unsigned int bits;
644 	u8 tmp;
645 
646 	for (i = 0; i < len; i++) {
647 		if (val[i])
648 			break;
649 	}
650 	if (i == len)
651 		return 0;
652 
653 	bits = (len - i - 1) * 8;
654 	tmp = val[i];
655 	while (tmp) {
656 		bits++;
657 		tmp >>= 1;
658 	}
659 
660 	return bits;
661 }
662 
663 
tlsv1_process_diffie_hellman(struct tlsv1_client * conn,const u8 * buf,size_t len,tls_key_exchange key_exchange)664 static int tlsv1_process_diffie_hellman(struct tlsv1_client *conn,
665 					const u8 *buf, size_t len,
666 					tls_key_exchange key_exchange)
667 {
668 	const u8 *pos, *end, *server_params, *server_params_end;
669 	u8 alert;
670 	unsigned int bits;
671 	u16 val;
672 
673 	tlsv1_client_free_dh(conn);
674 
675 	pos = buf;
676 	end = buf + len;
677 
678 	if (end - pos < 3)
679 		goto fail;
680 	server_params = pos;
681 	val = WPA_GET_BE16(pos);
682 	pos += 2;
683 	if (val == 0 || val > (size_t) (end - pos)) {
684 		wpa_printf(MSG_DEBUG, "TLSv1: Invalid dh_p length %u", val);
685 		goto fail;
686 	}
687 	conn->dh_p_len = val;
688 	bits = count_bits(pos, conn->dh_p_len);
689 	if (bits < 768) {
690 		wpa_printf(MSG_INFO, "TLSv1: Reject under 768-bit DH prime (insecure; only %u bits)",
691 			   bits);
692 		wpa_hexdump(MSG_DEBUG, "TLSv1: Rejected DH prime",
693 			    pos, conn->dh_p_len);
694 		goto fail;
695 	}
696 	conn->dh_p = os_memdup(pos, conn->dh_p_len);
697 	if (conn->dh_p == NULL)
698 		goto fail;
699 	pos += conn->dh_p_len;
700 	wpa_hexdump(MSG_DEBUG, "TLSv1: DH p (prime)",
701 		    conn->dh_p, conn->dh_p_len);
702 
703 	if (end - pos < 3)
704 		goto fail;
705 	val = WPA_GET_BE16(pos);
706 	pos += 2;
707 	if (val == 0 || val > (size_t) (end - pos))
708 		goto fail;
709 	conn->dh_g_len = val;
710 	conn->dh_g = os_memdup(pos, conn->dh_g_len);
711 	if (conn->dh_g == NULL)
712 		goto fail;
713 	pos += conn->dh_g_len;
714 	wpa_hexdump(MSG_DEBUG, "TLSv1: DH g (generator)",
715 		    conn->dh_g, conn->dh_g_len);
716 	if (conn->dh_g_len == 1 && conn->dh_g[0] < 2)
717 		goto fail;
718 
719 	if (end - pos < 3)
720 		goto fail;
721 	val = WPA_GET_BE16(pos);
722 	pos += 2;
723 	if (val == 0 || val > (size_t) (end - pos))
724 		goto fail;
725 	conn->dh_ys_len = val;
726 	conn->dh_ys = os_memdup(pos, conn->dh_ys_len);
727 	if (conn->dh_ys == NULL)
728 		goto fail;
729 	pos += conn->dh_ys_len;
730 	wpa_hexdump(MSG_DEBUG, "TLSv1: DH Ys (server's public value)",
731 		    conn->dh_ys, conn->dh_ys_len);
732 	server_params_end = pos;
733 
734 	if (key_exchange == TLS_KEY_X_DHE_RSA) {
735 		u8 hash[64];
736 		int hlen;
737 
738 		if (conn->rl.tls_version == TLS_VERSION_1_2) {
739 #ifdef CONFIG_TLSV12
740 			/*
741 			 * RFC 5246, 4.7:
742 			 * TLS v1.2 adds explicit indication of the used
743 			 * signature and hash algorithms.
744 			 *
745 			 * struct {
746 			 *   HashAlgorithm hash;
747 			 *   SignatureAlgorithm signature;
748 			 * } SignatureAndHashAlgorithm;
749 			 */
750 			if (end - pos < 2)
751 				goto fail;
752 			if ((pos[0] != TLS_HASH_ALG_SHA256 &&
753 			     pos[0] != TLS_HASH_ALG_SHA384 &&
754 			     pos[0] != TLS_HASH_ALG_SHA512) ||
755 			    pos[1] != TLS_SIGN_ALG_RSA) {
756 				wpa_printf(MSG_DEBUG, "TLSv1.2: Unsupported hash(%u)/signature(%u) algorithm",
757 					   pos[0], pos[1]);
758 				goto fail;
759 			}
760 
761 			hlen = tlsv12_key_x_server_params_hash(
762 				conn->rl.tls_version, pos[0],
763 				conn->client_random,
764 				conn->server_random, server_params,
765 				server_params_end - server_params, hash);
766 			pos += 2;
767 #else /* CONFIG_TLSV12 */
768 			goto fail;
769 #endif /* CONFIG_TLSV12 */
770 		} else {
771 			hlen = tls_key_x_server_params_hash(
772 				conn->rl.tls_version, conn->client_random,
773 				conn->server_random, server_params,
774 				server_params_end - server_params, hash);
775 		}
776 
777 		if (hlen < 0)
778 			goto fail;
779 		wpa_hexdump(MSG_MSGDUMP, "TLSv1: ServerKeyExchange hash",
780 			    hash, hlen);
781 
782 		if (tls_verify_signature(conn->rl.tls_version,
783 					 conn->server_rsa_key,
784 					 hash, hlen, pos, end - pos,
785 					 &alert) < 0)
786 			goto fail;
787 	}
788 
789 	return 0;
790 
791 fail:
792 	wpa_printf(MSG_DEBUG, "TLSv1: Processing DH params failed");
793 	tlsv1_client_free_dh(conn);
794 	return -1;
795 }
796 
797 
798 static enum tls_ocsp_result
tls_process_certificate_status_ocsp_response(struct tlsv1_client * conn,const u8 * pos,size_t len)799 tls_process_certificate_status_ocsp_response(struct tlsv1_client *conn,
800 					     const u8 *pos, size_t len)
801 {
802 	const u8 *end = pos + len;
803 	u32 ocsp_resp_len;
804 
805 	/* opaque OCSPResponse<1..2^24-1>; */
806 	if (end - pos < 3) {
807 		wpa_printf(MSG_INFO, "TLSv1: Too short OCSPResponse");
808 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
809 		return TLS_OCSP_INVALID;
810 	}
811 	ocsp_resp_len = WPA_GET_BE24(pos);
812 	pos += 3;
813 	if (end - pos < ocsp_resp_len) {
814 		wpa_printf(MSG_INFO, "TLSv1: Truncated OCSPResponse");
815 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
816 		return TLS_OCSP_INVALID;
817 	}
818 
819 	return tls_process_ocsp_response(conn, pos, ocsp_resp_len);
820 }
821 
822 
tls_process_certificate_status(struct tlsv1_client * conn,u8 ct,const u8 * in_data,size_t * in_len)823 static int tls_process_certificate_status(struct tlsv1_client *conn, u8 ct,
824 					   const u8 *in_data, size_t *in_len)
825 {
826 	const u8 *pos, *end;
827 	size_t left, len;
828 	u8 type, status_type;
829 	enum tls_ocsp_result res;
830 	struct x509_certificate *cert;
831 	int depth;
832 
833 	if (ct != TLS_CONTENT_TYPE_HANDSHAKE) {
834 		wpa_printf(MSG_DEBUG,
835 			   "TLSv1: Expected Handshake; received content type 0x%x",
836 			   ct);
837 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
838 			  TLS_ALERT_UNEXPECTED_MESSAGE);
839 		return -1;
840 	}
841 
842 	pos = in_data;
843 	left = *in_len;
844 
845 	if (left < 4) {
846 		wpa_printf(MSG_DEBUG,
847 			   "TLSv1: Too short CertificateStatus (left=%lu)",
848 			   (unsigned long) left);
849 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
850 		return -1;
851 	}
852 
853 	type = *pos++;
854 	len = WPA_GET_BE24(pos);
855 	pos += 3;
856 	left -= 4;
857 
858 	if (len > left) {
859 		wpa_printf(MSG_DEBUG,
860 			   "TLSv1: Mismatch in CertificateStatus length (len=%lu != left=%lu)",
861 			   (unsigned long) len, (unsigned long) left);
862 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
863 		return -1;
864 	}
865 
866 	end = pos + len;
867 
868 	if (type != TLS_HANDSHAKE_TYPE_CERTIFICATE_STATUS) {
869 		wpa_printf(MSG_DEBUG,
870 			   "TLSv1: Received unexpected handshake message %d (expected CertificateStatus)",
871 			   type);
872 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
873 			  TLS_ALERT_UNEXPECTED_MESSAGE);
874 		return -1;
875 	}
876 
877 	wpa_printf(MSG_DEBUG, "TLSv1: Received CertificateStatus");
878 
879 	/*
880 	 * struct {
881 	 *     CertificateStatusType status_type;
882 	 *     select (status_type) {
883 	 *         case ocsp: OCSPResponse;
884 	 *         case ocsp_multi: OCSPResponseList;
885 	 *     } response;
886 	 * } CertificateStatus;
887 	 */
888 	if (end - pos < 1) {
889 		wpa_printf(MSG_INFO, "TLSv1: Too short CertificateStatus");
890 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
891 		return -1;
892 	}
893 	status_type = *pos++;
894 	wpa_printf(MSG_DEBUG, "TLSv1: CertificateStatus status_type %u",
895 		   status_type);
896 
897 	if (status_type == 1 /* ocsp */) {
898 		res = tls_process_certificate_status_ocsp_response(
899 			conn, pos, end - pos);
900 	} else if (status_type == 2 /* ocsp_multi */) {
901 		int good = 0, revoked = 0;
902 		u32 resp_len;
903 
904 		res = TLS_OCSP_NO_RESPONSE;
905 
906 		/*
907 		 * opaque OCSPResponse<0..2^24-1>;
908 		 *
909 		 * struct {
910 		 *   OCSPResponse ocsp_response_list<1..2^24-1>;
911 		 * } OCSPResponseList;
912 		 */
913 		if (end - pos < 3) {
914 			wpa_printf(MSG_DEBUG,
915 				   "TLSv1: Truncated OCSPResponseList");
916 			res = TLS_OCSP_INVALID;
917 			goto done;
918 		}
919 		resp_len = WPA_GET_BE24(pos);
920 		pos += 3;
921 		if (end - pos < resp_len) {
922 			wpa_printf(MSG_DEBUG,
923 				   "TLSv1: Truncated OCSPResponseList(len=%u)",
924 				   resp_len);
925 			res = TLS_OCSP_INVALID;
926 			goto done;
927 		}
928 		end = pos + resp_len;
929 
930 		while (end - pos >= 3) {
931 			resp_len = WPA_GET_BE24(pos);
932 			pos += 3;
933 			if (resp_len > end - pos) {
934 				wpa_printf(MSG_DEBUG,
935 					   "TLSv1: Truncated OCSPResponse(len=%u; left=%d) in ocsp_multi",
936 					   resp_len, (int) (end - pos));
937 				res = TLS_OCSP_INVALID;
938 				break;
939 			}
940 			if (!resp_len)
941 				continue; /* Skip an empty response */
942 			res = tls_process_certificate_status_ocsp_response(
943 				conn, pos - 3, resp_len + 3);
944 			if (res == TLS_OCSP_REVOKED)
945 				revoked++;
946 			else if (res == TLS_OCSP_GOOD)
947 				good++;
948 			pos += resp_len;
949 		}
950 
951 		if (revoked)
952 			res = TLS_OCSP_REVOKED;
953 		else if (good)
954 			res = TLS_OCSP_GOOD;
955 	} else {
956 		wpa_printf(MSG_DEBUG,
957 			   "TLSv1: Ignore unsupported CertificateStatus");
958 		goto skip;
959 	}
960 
961 done:
962 	if (res == TLS_OCSP_REVOKED) {
963 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
964 			  TLS_ALERT_CERTIFICATE_REVOKED);
965 		for (cert = conn->server_cert, depth = 0; cert;
966 		     cert = cert->next, depth++) {
967 			if (cert->ocsp_revoked) {
968 				tls_cert_chain_failure_event(
969 					conn, depth, cert, TLS_FAIL_REVOKED,
970 					"certificate revoked");
971 			}
972 		}
973 		return -1;
974 	}
975 
976 	if (conn->flags & TLS_CONN_REQUIRE_OCSP_ALL) {
977 		/*
978 		 * Verify that each certificate on the chain that is not part
979 		 * of the trusted certificates has a good status. If not,
980 		 * terminate handshake.
981 		 */
982 		for (cert = conn->server_cert, depth = 0; cert;
983 		     cert = cert->next, depth++) {
984 			if (!cert->ocsp_good) {
985 				tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
986 					  TLS_ALERT_BAD_CERTIFICATE_STATUS_RESPONSE);
987 				tls_cert_chain_failure_event(
988 					conn, depth, cert,
989 					TLS_FAIL_UNSPECIFIED,
990 					"bad certificate status response");
991 				return -1;
992 			}
993 			if (cert->issuer_trusted)
994 				break;
995 		}
996 	}
997 
998 	if ((conn->flags & TLS_CONN_REQUIRE_OCSP) && res != TLS_OCSP_GOOD) {
999 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1000 			  res == TLS_OCSP_INVALID ? TLS_ALERT_DECODE_ERROR :
1001 			  TLS_ALERT_BAD_CERTIFICATE_STATUS_RESPONSE);
1002 		if (conn->server_cert)
1003 			tls_cert_chain_failure_event(
1004 				conn, 0, conn->server_cert,
1005 				TLS_FAIL_UNSPECIFIED,
1006 				"bad certificate status response");
1007 		return -1;
1008 	}
1009 
1010 	conn->ocsp_resp_received = 1;
1011 
1012 skip:
1013 	*in_len = end - in_data;
1014 
1015 	conn->state = SERVER_KEY_EXCHANGE;
1016 
1017 	return 0;
1018 }
1019 
1020 
tls_process_server_key_exchange(struct tlsv1_client * conn,u8 ct,const u8 * in_data,size_t * in_len)1021 static int tls_process_server_key_exchange(struct tlsv1_client *conn, u8 ct,
1022 					   const u8 *in_data, size_t *in_len)
1023 {
1024 	const u8 *pos, *end;
1025 	size_t left, len;
1026 	u8 type;
1027 	const struct tls_cipher_suite *suite;
1028 
1029 	if (ct != TLS_CONTENT_TYPE_HANDSHAKE) {
1030 		wpa_printf(MSG_DEBUG, "TLSv1: Expected Handshake; "
1031 			   "received content type 0x%x", ct);
1032 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1033 			  TLS_ALERT_UNEXPECTED_MESSAGE);
1034 		return -1;
1035 	}
1036 
1037 	pos = in_data;
1038 	left = *in_len;
1039 
1040 	if (left < 4) {
1041 		wpa_printf(MSG_DEBUG, "TLSv1: Too short ServerKeyExchange "
1042 			   "(Left=%lu)", (unsigned long) left);
1043 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
1044 		return -1;
1045 	}
1046 
1047 	type = *pos++;
1048 	len = WPA_GET_BE24(pos);
1049 	pos += 3;
1050 	left -= 4;
1051 
1052 	if (len > left) {
1053 		wpa_printf(MSG_DEBUG, "TLSv1: Mismatch in ServerKeyExchange "
1054 			   "length (len=%lu != left=%lu)",
1055 			   (unsigned long) len, (unsigned long) left);
1056 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
1057 		return -1;
1058 	}
1059 
1060 	end = pos + len;
1061 
1062 	if ((conn->flags & TLS_CONN_REQUEST_OCSP) &&
1063 	    type == TLS_HANDSHAKE_TYPE_CERTIFICATE_STATUS)
1064 		return tls_process_certificate_status(conn, ct, in_data,
1065 						      in_len);
1066 	if (type == TLS_HANDSHAKE_TYPE_CERTIFICATE_REQUEST)
1067 		return tls_process_certificate_request(conn, ct, in_data,
1068 						       in_len);
1069 	if (type == TLS_HANDSHAKE_TYPE_SERVER_HELLO_DONE)
1070 		return tls_process_server_hello_done(conn, ct, in_data,
1071 						     in_len);
1072 	if (type != TLS_HANDSHAKE_TYPE_SERVER_KEY_EXCHANGE) {
1073 		wpa_printf(MSG_DEBUG, "TLSv1: Received unexpected handshake "
1074 			   "message %d (expected ServerKeyExchange/"
1075 			   "CertificateRequest/ServerHelloDone%s)", type,
1076 			   (conn->flags & TLS_CONN_REQUEST_OCSP) ?
1077 			   "/CertificateStatus" : "");
1078 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1079 			  TLS_ALERT_UNEXPECTED_MESSAGE);
1080 		return -1;
1081 	}
1082 
1083 	wpa_printf(MSG_DEBUG, "TLSv1: Received ServerKeyExchange");
1084 
1085 	if (!tls_server_key_exchange_allowed(conn->rl.cipher_suite)) {
1086 		wpa_printf(MSG_DEBUG, "TLSv1: ServerKeyExchange not allowed "
1087 			   "with the selected cipher suite");
1088 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1089 			  TLS_ALERT_UNEXPECTED_MESSAGE);
1090 		return -1;
1091 	}
1092 
1093 	wpa_hexdump(MSG_DEBUG, "TLSv1: ServerKeyExchange", pos, len);
1094 	suite = tls_get_cipher_suite(conn->rl.cipher_suite);
1095 	if (suite && (suite->key_exchange == TLS_KEY_X_DH_anon ||
1096 		      suite->key_exchange == TLS_KEY_X_DHE_RSA)) {
1097 		if (tlsv1_process_diffie_hellman(conn, pos, len,
1098 						 suite->key_exchange) < 0) {
1099 			tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1100 				  TLS_ALERT_DECODE_ERROR);
1101 			return -1;
1102 		}
1103 	} else {
1104 		wpa_printf(MSG_DEBUG, "TLSv1: UnexpectedServerKeyExchange");
1105 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1106 			  TLS_ALERT_UNEXPECTED_MESSAGE);
1107 		return -1;
1108 	}
1109 
1110 	*in_len = end - in_data;
1111 
1112 	conn->state = SERVER_CERTIFICATE_REQUEST;
1113 
1114 	return 0;
1115 }
1116 
1117 
tls_process_certificate_request(struct tlsv1_client * conn,u8 ct,const u8 * in_data,size_t * in_len)1118 static int tls_process_certificate_request(struct tlsv1_client *conn, u8 ct,
1119 					   const u8 *in_data, size_t *in_len)
1120 {
1121 	const u8 *pos, *end;
1122 	size_t left, len;
1123 	u8 type;
1124 
1125 	if (ct != TLS_CONTENT_TYPE_HANDSHAKE) {
1126 		wpa_printf(MSG_DEBUG, "TLSv1: Expected Handshake; "
1127 			   "received content type 0x%x", ct);
1128 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1129 			  TLS_ALERT_UNEXPECTED_MESSAGE);
1130 		return -1;
1131 	}
1132 
1133 	pos = in_data;
1134 	left = *in_len;
1135 
1136 	if (left < 4) {
1137 		wpa_printf(MSG_DEBUG, "TLSv1: Too short CertificateRequest "
1138 			   "(left=%lu)", (unsigned long) left);
1139 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
1140 		return -1;
1141 	}
1142 
1143 	type = *pos++;
1144 	len = WPA_GET_BE24(pos);
1145 	pos += 3;
1146 	left -= 4;
1147 
1148 	if (len > left) {
1149 		wpa_printf(MSG_DEBUG, "TLSv1: Mismatch in CertificateRequest "
1150 			   "length (len=%lu != left=%lu)",
1151 			   (unsigned long) len, (unsigned long) left);
1152 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
1153 		return -1;
1154 	}
1155 
1156 	end = pos + len;
1157 
1158 	if (type == TLS_HANDSHAKE_TYPE_SERVER_HELLO_DONE)
1159 		return tls_process_server_hello_done(conn, ct, in_data,
1160 						     in_len);
1161 	if (type != TLS_HANDSHAKE_TYPE_CERTIFICATE_REQUEST) {
1162 		wpa_printf(MSG_DEBUG, "TLSv1: Received unexpected handshake "
1163 			   "message %d (expected CertificateRequest/"
1164 			   "ServerHelloDone)", type);
1165 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1166 			  TLS_ALERT_UNEXPECTED_MESSAGE);
1167 		return -1;
1168 	}
1169 
1170 	wpa_printf(MSG_DEBUG, "TLSv1: Received CertificateRequest");
1171 
1172 	conn->certificate_requested = 1;
1173 
1174 	*in_len = end - in_data;
1175 
1176 	conn->state = SERVER_HELLO_DONE;
1177 
1178 	return 0;
1179 }
1180 
1181 
tls_process_server_hello_done(struct tlsv1_client * conn,u8 ct,const u8 * in_data,size_t * in_len)1182 static int tls_process_server_hello_done(struct tlsv1_client *conn, u8 ct,
1183 					 const u8 *in_data, size_t *in_len)
1184 {
1185 	const u8 *pos, *end;
1186 	size_t left, len;
1187 	u8 type;
1188 
1189 	if (ct != TLS_CONTENT_TYPE_HANDSHAKE) {
1190 		wpa_printf(MSG_DEBUG, "TLSv1: Expected Handshake; "
1191 			   "received content type 0x%x", ct);
1192 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1193 			  TLS_ALERT_UNEXPECTED_MESSAGE);
1194 		return -1;
1195 	}
1196 
1197 	pos = in_data;
1198 	left = *in_len;
1199 
1200 	if (left < 4) {
1201 		wpa_printf(MSG_DEBUG, "TLSv1: Too short ServerHelloDone "
1202 			   "(left=%lu)", (unsigned long) left);
1203 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
1204 		return -1;
1205 	}
1206 
1207 	type = *pos++;
1208 	len = WPA_GET_BE24(pos);
1209 	pos += 3;
1210 	left -= 4;
1211 
1212 	if (len > left) {
1213 		wpa_printf(MSG_DEBUG, "TLSv1: Mismatch in ServerHelloDone "
1214 			   "length (len=%lu != left=%lu)",
1215 			   (unsigned long) len, (unsigned long) left);
1216 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
1217 		return -1;
1218 	}
1219 	end = pos + len;
1220 
1221 	if (type != TLS_HANDSHAKE_TYPE_SERVER_HELLO_DONE) {
1222 		wpa_printf(MSG_DEBUG, "TLSv1: Received unexpected handshake "
1223 			   "message %d (expected ServerHelloDone)", type);
1224 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1225 			  TLS_ALERT_UNEXPECTED_MESSAGE);
1226 		return -1;
1227 	}
1228 
1229 	wpa_printf(MSG_DEBUG, "TLSv1: Received ServerHelloDone");
1230 
1231 	if ((conn->flags & TLS_CONN_REQUIRE_OCSP) &&
1232 	    !conn->ocsp_resp_received) {
1233 		wpa_printf(MSG_INFO,
1234 			   "TLSv1: No OCSP response received - reject handshake");
1235 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1236 			  TLS_ALERT_BAD_CERTIFICATE_STATUS_RESPONSE);
1237 		return -1;
1238 	}
1239 
1240 	*in_len = end - in_data;
1241 
1242 	conn->state = CLIENT_KEY_EXCHANGE;
1243 
1244 	return 0;
1245 }
1246 
1247 
tls_process_server_change_cipher_spec(struct tlsv1_client * conn,u8 ct,const u8 * in_data,size_t * in_len)1248 static int tls_process_server_change_cipher_spec(struct tlsv1_client *conn,
1249 						 u8 ct, const u8 *in_data,
1250 						 size_t *in_len)
1251 {
1252 	const u8 *pos;
1253 	size_t left;
1254 
1255 	if (ct != TLS_CONTENT_TYPE_CHANGE_CIPHER_SPEC) {
1256 		wpa_printf(MSG_DEBUG, "TLSv1: Expected ChangeCipherSpec; "
1257 			   "received content type 0x%x", ct);
1258 		if (conn->use_session_ticket) {
1259 			int res;
1260 			wpa_printf(MSG_DEBUG, "TLSv1: Server may have "
1261 				   "rejected SessionTicket");
1262 			conn->use_session_ticket = 0;
1263 
1264 			/* Notify upper layers that SessionTicket failed */
1265 			res = conn->session_ticket_cb(
1266 				conn->session_ticket_cb_ctx, NULL, 0, NULL,
1267 				NULL, NULL);
1268 			if (res < 0) {
1269 				wpa_printf(MSG_DEBUG, "TLSv1: SessionTicket "
1270 					   "callback indicated failure");
1271 				tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1272 					  TLS_ALERT_HANDSHAKE_FAILURE);
1273 				return -1;
1274 			}
1275 
1276 			conn->state = SERVER_CERTIFICATE;
1277 			return tls_process_certificate(conn, ct, in_data,
1278 						       in_len);
1279 		}
1280 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1281 			  TLS_ALERT_UNEXPECTED_MESSAGE);
1282 		return -1;
1283 	}
1284 
1285 	pos = in_data;
1286 	left = *in_len;
1287 
1288 	if (left < 1) {
1289 		wpa_printf(MSG_DEBUG, "TLSv1: Too short ChangeCipherSpec");
1290 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
1291 		return -1;
1292 	}
1293 
1294 	if (*pos != TLS_CHANGE_CIPHER_SPEC) {
1295 		wpa_printf(MSG_DEBUG, "TLSv1: Expected ChangeCipherSpec; "
1296 			   "received data 0x%x", *pos);
1297 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1298 			  TLS_ALERT_UNEXPECTED_MESSAGE);
1299 		return -1;
1300 	}
1301 
1302 	wpa_printf(MSG_DEBUG, "TLSv1: Received ChangeCipherSpec");
1303 	if (tlsv1_record_change_read_cipher(&conn->rl) < 0) {
1304 		wpa_printf(MSG_DEBUG, "TLSv1: Failed to change read cipher "
1305 			   "for record layer");
1306 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1307 			  TLS_ALERT_INTERNAL_ERROR);
1308 		return -1;
1309 	}
1310 
1311 	*in_len = pos + 1 - in_data;
1312 
1313 	conn->state = SERVER_FINISHED;
1314 
1315 	return 0;
1316 }
1317 
1318 
tls_process_server_finished(struct tlsv1_client * conn,u8 ct,const u8 * in_data,size_t * in_len)1319 static int tls_process_server_finished(struct tlsv1_client *conn, u8 ct,
1320 				       const u8 *in_data, size_t *in_len)
1321 {
1322 	const u8 *pos, *end;
1323 	size_t left, len, hlen;
1324 	u8 verify_data[TLS_VERIFY_DATA_LEN];
1325 	u8 hash[MD5_MAC_LEN + SHA1_MAC_LEN];
1326 
1327 	if (ct != TLS_CONTENT_TYPE_HANDSHAKE) {
1328 		wpa_printf(MSG_DEBUG, "TLSv1: Expected Finished; "
1329 			   "received content type 0x%x", ct);
1330 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1331 			  TLS_ALERT_UNEXPECTED_MESSAGE);
1332 		return -1;
1333 	}
1334 
1335 	pos = in_data;
1336 	left = *in_len;
1337 
1338 	if (left < 4) {
1339 		wpa_printf(MSG_DEBUG, "TLSv1: Too short record (left=%lu) for "
1340 			   "Finished",
1341 			   (unsigned long) left);
1342 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1343 			  TLS_ALERT_DECODE_ERROR);
1344 		return -1;
1345 	}
1346 
1347 	if (pos[0] != TLS_HANDSHAKE_TYPE_FINISHED) {
1348 		wpa_printf(MSG_DEBUG, "TLSv1: Expected Finished; received "
1349 			   "type 0x%x", pos[0]);
1350 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1351 			  TLS_ALERT_UNEXPECTED_MESSAGE);
1352 		return -1;
1353 	}
1354 
1355 	len = WPA_GET_BE24(pos + 1);
1356 
1357 	pos += 4;
1358 	left -= 4;
1359 
1360 	if (len > left) {
1361 		wpa_printf(MSG_DEBUG, "TLSv1: Too short buffer for Finished "
1362 			   "(len=%lu > left=%lu)",
1363 			   (unsigned long) len, (unsigned long) left);
1364 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1365 			  TLS_ALERT_DECODE_ERROR);
1366 		return -1;
1367 	}
1368 	end = pos + len;
1369 	if (len != TLS_VERIFY_DATA_LEN) {
1370 		wpa_printf(MSG_DEBUG, "TLSv1: Unexpected verify_data length "
1371 			   "in Finished: %lu (expected %d)",
1372 			   (unsigned long) len, TLS_VERIFY_DATA_LEN);
1373 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1374 			  TLS_ALERT_DECODE_ERROR);
1375 		return -1;
1376 	}
1377 	wpa_hexdump(MSG_MSGDUMP, "TLSv1: verify_data in Finished",
1378 		    pos, TLS_VERIFY_DATA_LEN);
1379 
1380 #ifdef CONFIG_TLSV12
1381 	if (conn->rl.tls_version >= TLS_VERSION_1_2) {
1382 		hlen = SHA256_MAC_LEN;
1383 		if (conn->verify.sha256_server == NULL ||
1384 		    crypto_hash_finish(conn->verify.sha256_server, hash, &hlen)
1385 		    < 0) {
1386 			tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1387 				  TLS_ALERT_INTERNAL_ERROR);
1388 			conn->verify.sha256_server = NULL;
1389 			return -1;
1390 		}
1391 		conn->verify.sha256_server = NULL;
1392 	} else {
1393 #endif /* CONFIG_TLSV12 */
1394 
1395 	hlen = MD5_MAC_LEN;
1396 	if (conn->verify.md5_server == NULL ||
1397 	    crypto_hash_finish(conn->verify.md5_server, hash, &hlen) < 0) {
1398 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1399 			  TLS_ALERT_INTERNAL_ERROR);
1400 		conn->verify.md5_server = NULL;
1401 		crypto_hash_finish(conn->verify.sha1_server, NULL, NULL);
1402 		conn->verify.sha1_server = NULL;
1403 		return -1;
1404 	}
1405 	conn->verify.md5_server = NULL;
1406 	hlen = SHA1_MAC_LEN;
1407 	if (conn->verify.sha1_server == NULL ||
1408 	    crypto_hash_finish(conn->verify.sha1_server, hash + MD5_MAC_LEN,
1409 			       &hlen) < 0) {
1410 		conn->verify.sha1_server = NULL;
1411 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1412 			  TLS_ALERT_INTERNAL_ERROR);
1413 		return -1;
1414 	}
1415 	conn->verify.sha1_server = NULL;
1416 	hlen = MD5_MAC_LEN + SHA1_MAC_LEN;
1417 
1418 #ifdef CONFIG_TLSV12
1419 	}
1420 #endif /* CONFIG_TLSV12 */
1421 
1422 	if (tls_prf(conn->rl.tls_version,
1423 		    conn->master_secret, TLS_MASTER_SECRET_LEN,
1424 		    "server finished", hash, hlen,
1425 		    verify_data, TLS_VERIFY_DATA_LEN)) {
1426 		wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive verify_data");
1427 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1428 			  TLS_ALERT_DECRYPT_ERROR);
1429 		return -1;
1430 	}
1431 	wpa_hexdump_key(MSG_DEBUG, "TLSv1: verify_data (server)",
1432 			verify_data, TLS_VERIFY_DATA_LEN);
1433 
1434 	if (os_memcmp_const(pos, verify_data, TLS_VERIFY_DATA_LEN) != 0) {
1435 		wpa_printf(MSG_INFO, "TLSv1: Mismatch in verify_data");
1436 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1437 			  TLS_ALERT_DECRYPT_ERROR);
1438 		return -1;
1439 	}
1440 
1441 	wpa_printf(MSG_DEBUG, "TLSv1: Received Finished");
1442 
1443 	*in_len = end - in_data;
1444 
1445 	conn->state = (conn->session_resumed || conn->use_session_ticket) ?
1446 		CHANGE_CIPHER_SPEC : ACK_FINISHED;
1447 
1448 	return 0;
1449 }
1450 
1451 
tls_process_application_data(struct tlsv1_client * conn,u8 ct,const u8 * in_data,size_t * in_len,u8 ** out_data,size_t * out_len)1452 static int tls_process_application_data(struct tlsv1_client *conn, u8 ct,
1453 					const u8 *in_data, size_t *in_len,
1454 					u8 **out_data, size_t *out_len)
1455 {
1456 	const u8 *pos;
1457 	size_t left;
1458 
1459 	if (ct != TLS_CONTENT_TYPE_APPLICATION_DATA) {
1460 		wpa_printf(MSG_DEBUG, "TLSv1: Expected Application Data; "
1461 			   "received content type 0x%x", ct);
1462 		tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1463 			  TLS_ALERT_UNEXPECTED_MESSAGE);
1464 		return -1;
1465 	}
1466 
1467 	pos = in_data;
1468 	left = *in_len;
1469 
1470 	wpa_hexdump(MSG_DEBUG, "TLSv1: Application Data included in Handshake",
1471 		    pos, left);
1472 
1473 	*out_data = os_malloc(left);
1474 	if (*out_data) {
1475 		os_memcpy(*out_data, pos, left);
1476 		*out_len = left;
1477 	}
1478 
1479 	return 0;
1480 }
1481 
1482 
tlsv1_client_process_handshake(struct tlsv1_client * conn,u8 ct,const u8 * buf,size_t * len,u8 ** out_data,size_t * out_len)1483 int tlsv1_client_process_handshake(struct tlsv1_client *conn, u8 ct,
1484 				   const u8 *buf, size_t *len,
1485 				   u8 **out_data, size_t *out_len)
1486 {
1487 	if (ct == TLS_CONTENT_TYPE_ALERT) {
1488 		if (*len < 2) {
1489 			wpa_printf(MSG_DEBUG, "TLSv1: Alert underflow");
1490 			tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1491 				  TLS_ALERT_DECODE_ERROR);
1492 			return -1;
1493 		}
1494 		wpa_printf(MSG_DEBUG, "TLSv1: Received alert %d:%d",
1495 			   buf[0], buf[1]);
1496 		*len = 2;
1497 		conn->state = FAILED;
1498 		return -1;
1499 	}
1500 
1501 	if (ct == TLS_CONTENT_TYPE_HANDSHAKE && *len >= 4 &&
1502 	    buf[0] == TLS_HANDSHAKE_TYPE_HELLO_REQUEST) {
1503 		size_t hr_len = WPA_GET_BE24(buf + 1);
1504 		if (hr_len > *len - 4) {
1505 			wpa_printf(MSG_DEBUG, "TLSv1: HelloRequest underflow");
1506 			tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
1507 				  TLS_ALERT_DECODE_ERROR);
1508 			return -1;
1509 		}
1510 		wpa_printf(MSG_DEBUG, "TLSv1: Ignored HelloRequest");
1511 		*len = 4 + hr_len;
1512 		return 0;
1513 	}
1514 
1515 	switch (conn->state) {
1516 	case SERVER_HELLO:
1517 		if (tls_process_server_hello(conn, ct, buf, len))
1518 			return -1;
1519 		break;
1520 	case SERVER_CERTIFICATE:
1521 		if (tls_process_certificate(conn, ct, buf, len))
1522 			return -1;
1523 		break;
1524 	case SERVER_KEY_EXCHANGE:
1525 		if (tls_process_server_key_exchange(conn, ct, buf, len))
1526 			return -1;
1527 		break;
1528 	case SERVER_CERTIFICATE_REQUEST:
1529 		if (tls_process_certificate_request(conn, ct, buf, len))
1530 			return -1;
1531 		break;
1532 	case SERVER_HELLO_DONE:
1533 		if (tls_process_server_hello_done(conn, ct, buf, len))
1534 			return -1;
1535 		break;
1536 	case SERVER_CHANGE_CIPHER_SPEC:
1537 		if (tls_process_server_change_cipher_spec(conn, ct, buf, len))
1538 			return -1;
1539 		break;
1540 	case SERVER_FINISHED:
1541 		if (tls_process_server_finished(conn, ct, buf, len))
1542 			return -1;
1543 		break;
1544 	case ACK_FINISHED:
1545 		if (out_data &&
1546 		    tls_process_application_data(conn, ct, buf, len, out_data,
1547 						 out_len))
1548 			return -1;
1549 		break;
1550 	default:
1551 		wpa_printf(MSG_DEBUG, "TLSv1: Unexpected state %d "
1552 			   "while processing received message",
1553 			   conn->state);
1554 		return -1;
1555 	}
1556 
1557 	if (ct == TLS_CONTENT_TYPE_HANDSHAKE)
1558 		tls_verify_hash_add(&conn->verify, buf, *len);
1559 
1560 	return 0;
1561 }
1562