1 /* 2 * SSL/TLS interface functions for OpenSSL 3 * Copyright (c) 2004-2015, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 11 #ifndef CONFIG_SMARTCARD 12 #ifndef OPENSSL_NO_ENGINE 13 #ifndef ANDROID 14 #define OPENSSL_NO_ENGINE 15 #endif 16 #endif 17 #endif 18 19 #include <openssl/ssl.h> 20 #include <openssl/err.h> 21 #include <openssl/opensslv.h> 22 #include <openssl/pkcs12.h> 23 #include <openssl/x509v3.h> 24 #ifndef OPENSSL_NO_ENGINE 25 #include <openssl/engine.h> 26 #endif /* OPENSSL_NO_ENGINE */ 27 #ifndef OPENSSL_NO_DSA 28 #include <openssl/dsa.h> 29 #endif 30 #ifndef OPENSSL_NO_DH 31 #include <openssl/dh.h> 32 #endif 33 34 #include "common.h" 35 #include "crypto.h" 36 #include "sha1.h" 37 #include "sha256.h" 38 #include "tls.h" 39 #include "tls_openssl.h" 40 41 #if !defined(CONFIG_FIPS) && \ 42 (defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || \ 43 defined(EAP_SERVER_FAST)) 44 #define OPENSSL_NEED_EAP_FAST_PRF 45 #endif 46 47 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || \ 48 defined(EAP_SERVER_FAST) || defined(EAP_TEAP) || \ 49 defined(EAP_SERVER_TEAP) 50 #define EAP_FAST_OR_TEAP 51 #endif 52 53 54 #if defined(OPENSSL_IS_BORINGSSL) 55 /* stack_index_t is the return type of OpenSSL's sk_XXX_num() functions. */ 56 typedef size_t stack_index_t; 57 #else 58 typedef int stack_index_t; 59 #endif 60 61 #ifdef SSL_set_tlsext_status_type 62 #ifndef OPENSSL_NO_TLSEXT 63 #define HAVE_OCSP 64 #include <openssl/ocsp.h> 65 #endif /* OPENSSL_NO_TLSEXT */ 66 #endif /* SSL_set_tlsext_status_type */ 67 68 #if (OPENSSL_VERSION_NUMBER < 0x10100000L || \ 69 (defined(LIBRESSL_VERSION_NUMBER) && \ 70 LIBRESSL_VERSION_NUMBER < 0x20700000L)) && \ 71 !defined(BORINGSSL_API_VERSION) 72 /* 73 * SSL_get_client_random() and SSL_get_server_random() were added in OpenSSL 74 * 1.1.0 and newer BoringSSL revisions. Provide compatibility wrappers for 75 * older versions. 76 */ 77 78 static size_t SSL_get_client_random(const SSL *ssl, unsigned char *out, 79 size_t outlen) 80 { 81 if (!ssl->s3 || outlen < SSL3_RANDOM_SIZE) 82 return 0; 83 os_memcpy(out, ssl->s3->client_random, SSL3_RANDOM_SIZE); 84 return SSL3_RANDOM_SIZE; 85 } 86 87 88 static size_t SSL_get_server_random(const SSL *ssl, unsigned char *out, 89 size_t outlen) 90 { 91 if (!ssl->s3 || outlen < SSL3_RANDOM_SIZE) 92 return 0; 93 os_memcpy(out, ssl->s3->server_random, SSL3_RANDOM_SIZE); 94 return SSL3_RANDOM_SIZE; 95 } 96 97 98 #ifdef OPENSSL_NEED_EAP_FAST_PRF 99 static size_t SSL_SESSION_get_master_key(const SSL_SESSION *session, 100 unsigned char *out, size_t outlen) 101 { 102 if (!session || session->master_key_length < 0 || 103 (size_t) session->master_key_length > outlen) 104 return 0; 105 if ((size_t) session->master_key_length < outlen) 106 outlen = session->master_key_length; 107 os_memcpy(out, session->master_key, outlen); 108 return outlen; 109 } 110 #endif /* OPENSSL_NEED_EAP_FAST_PRF */ 111 112 #endif 113 114 #if OPENSSL_VERSION_NUMBER < 0x10100000L || \ 115 (defined(LIBRESSL_VERSION_NUMBER) && \ 116 LIBRESSL_VERSION_NUMBER < 0x20700000L) 117 #ifdef CONFIG_SUITEB 118 static int RSA_bits(const RSA *r) 119 { 120 return BN_num_bits(r->n); 121 } 122 #endif /* CONFIG_SUITEB */ 123 124 125 static const unsigned char * ASN1_STRING_get0_data(const ASN1_STRING *x) 126 { 127 return ASN1_STRING_data((ASN1_STRING *) x); 128 } 129 #endif 130 131 #ifdef ANDROID 132 #include <openssl/pem.h> 133 #include <keystore/keystore_get.h> 134 135 static BIO * BIO_from_keystore(const char *key) 136 { 137 BIO *bio = NULL; 138 uint8_t *value = NULL; 139 int length = keystore_get(key, strlen(key), &value); 140 if (length != -1 && (bio = BIO_new(BIO_s_mem())) != NULL) 141 BIO_write(bio, value, length); 142 free(value); 143 return bio; 144 } 145 146 147 static int tls_add_ca_from_keystore(X509_STORE *ctx, const char *key_alias) 148 { 149 BIO *bio = BIO_from_keystore(key_alias); 150 STACK_OF(X509_INFO) *stack = NULL; 151 stack_index_t i; 152 153 if (bio) { 154 stack = PEM_X509_INFO_read_bio(bio, NULL, NULL, NULL); 155 BIO_free(bio); 156 } 157 158 if (!stack) { 159 wpa_printf(MSG_WARNING, "TLS: Failed to parse certificate: %s", 160 key_alias); 161 return -1; 162 } 163 164 for (i = 0; i < sk_X509_INFO_num(stack); ++i) { 165 X509_INFO *info = sk_X509_INFO_value(stack, i); 166 167 if (info->x509) 168 X509_STORE_add_cert(ctx, info->x509); 169 if (info->crl) 170 X509_STORE_add_crl(ctx, info->crl); 171 } 172 173 sk_X509_INFO_pop_free(stack, X509_INFO_free); 174 175 return 0; 176 } 177 178 179 static int tls_add_ca_from_keystore_encoded(X509_STORE *ctx, 180 const char *encoded_key_alias) 181 { 182 int rc = -1; 183 int len = os_strlen(encoded_key_alias); 184 unsigned char *decoded_alias; 185 186 if (len & 1) { 187 wpa_printf(MSG_WARNING, "Invalid hex-encoded alias: %s", 188 encoded_key_alias); 189 return rc; 190 } 191 192 decoded_alias = os_malloc(len / 2 + 1); 193 if (decoded_alias) { 194 if (!hexstr2bin(encoded_key_alias, decoded_alias, len / 2)) { 195 decoded_alias[len / 2] = '\0'; 196 rc = tls_add_ca_from_keystore( 197 ctx, (const char *) decoded_alias); 198 } 199 os_free(decoded_alias); 200 } 201 202 return rc; 203 } 204 205 #endif /* ANDROID */ 206 207 static int tls_openssl_ref_count = 0; 208 static int tls_ex_idx_session = -1; 209 210 struct tls_context { 211 void (*event_cb)(void *ctx, enum tls_event ev, 212 union tls_event_data *data); 213 void *cb_ctx; 214 int cert_in_cb; 215 char *ocsp_stapling_response; 216 }; 217 218 static struct tls_context *tls_global = NULL; 219 220 221 struct tls_data { 222 SSL_CTX *ssl; 223 unsigned int tls_session_lifetime; 224 int check_crl; 225 int check_crl_strict; 226 char *ca_cert; 227 unsigned int crl_reload_interval; 228 struct os_reltime crl_last_reload; 229 char *check_cert_subject; 230 }; 231 232 struct tls_connection { 233 struct tls_context *context; 234 struct tls_data *data; 235 SSL_CTX *ssl_ctx; 236 SSL *ssl; 237 BIO *ssl_in, *ssl_out; 238 #if defined(ANDROID) || !defined(OPENSSL_NO_ENGINE) 239 ENGINE *engine; /* functional reference to the engine */ 240 EVP_PKEY *private_key; /* the private key if using engine */ 241 #endif /* OPENSSL_NO_ENGINE */ 242 char *subject_match, *altsubject_match, *suffix_match, *domain_match; 243 char *check_cert_subject; 244 int read_alerts, write_alerts, failed; 245 246 tls_session_ticket_cb session_ticket_cb; 247 void *session_ticket_cb_ctx; 248 249 /* SessionTicket received from OpenSSL hello_extension_cb (server) */ 250 u8 *session_ticket; 251 size_t session_ticket_len; 252 253 unsigned int ca_cert_verify:1; 254 unsigned int cert_probe:1; 255 unsigned int server_cert_only:1; 256 unsigned int invalid_hb_used:1; 257 unsigned int success_data:1; 258 unsigned int client_hello_generated:1; 259 unsigned int server:1; 260 261 u8 srv_cert_hash[32]; 262 263 unsigned int flags; 264 265 X509 *peer_cert; 266 X509 *peer_issuer; 267 X509 *peer_issuer_issuer; 268 char *peer_subject; /* peer subject info for authenticated peer */ 269 270 unsigned char client_random[SSL3_RANDOM_SIZE]; 271 unsigned char server_random[SSL3_RANDOM_SIZE]; 272 273 u16 cipher_suite; 274 int server_dh_prime_len; 275 }; 276 277 278 static struct tls_context * tls_context_new(const struct tls_config *conf) 279 { 280 struct tls_context *context = os_zalloc(sizeof(*context)); 281 if (context == NULL) 282 return NULL; 283 if (conf) { 284 context->event_cb = conf->event_cb; 285 context->cb_ctx = conf->cb_ctx; 286 context->cert_in_cb = conf->cert_in_cb; 287 } 288 return context; 289 } 290 291 292 #ifdef CONFIG_NO_STDOUT_DEBUG 293 294 static void _tls_show_errors(void) 295 { 296 unsigned long err; 297 298 while ((err = ERR_get_error())) { 299 /* Just ignore the errors, since stdout is disabled */ 300 } 301 } 302 #define tls_show_errors(l, f, t) _tls_show_errors() 303 304 #else /* CONFIG_NO_STDOUT_DEBUG */ 305 306 static void tls_show_errors(int level, const char *func, const char *txt) 307 { 308 unsigned long err; 309 310 wpa_printf(level, "OpenSSL: %s - %s %s", 311 func, txt, ERR_error_string(ERR_get_error(), NULL)); 312 313 while ((err = ERR_get_error())) { 314 wpa_printf(MSG_INFO, "OpenSSL: pending error: %s", 315 ERR_error_string(err, NULL)); 316 } 317 } 318 319 #endif /* CONFIG_NO_STDOUT_DEBUG */ 320 321 322 static X509_STORE * tls_crl_cert_reload(const char *ca_cert, int check_crl) 323 { 324 int flags; 325 X509_STORE *store; 326 327 store = X509_STORE_new(); 328 if (!store) { 329 wpa_printf(MSG_DEBUG, 330 "OpenSSL: %s - failed to allocate new certificate store", 331 __func__); 332 return NULL; 333 } 334 335 if (ca_cert && X509_STORE_load_locations(store, ca_cert, NULL) != 1) { 336 tls_show_errors(MSG_WARNING, __func__, 337 "Failed to load root certificates"); 338 X509_STORE_free(store); 339 return NULL; 340 } 341 342 flags = check_crl ? X509_V_FLAG_CRL_CHECK : 0; 343 if (check_crl == 2) 344 flags |= X509_V_FLAG_CRL_CHECK_ALL; 345 346 X509_STORE_set_flags(store, flags); 347 348 return store; 349 } 350 351 352 #ifdef CONFIG_NATIVE_WINDOWS 353 354 /* Windows CryptoAPI and access to certificate stores */ 355 #include <wincrypt.h> 356 357 #ifdef __MINGW32_VERSION 358 /* 359 * MinGW does not yet include all the needed definitions for CryptoAPI, so 360 * define here whatever extra is needed. 361 */ 362 #define CERT_SYSTEM_STORE_CURRENT_USER (1 << 16) 363 #define CERT_STORE_READONLY_FLAG 0x00008000 364 #define CERT_STORE_OPEN_EXISTING_FLAG 0x00004000 365 366 #endif /* __MINGW32_VERSION */ 367 368 369 struct cryptoapi_rsa_data { 370 const CERT_CONTEXT *cert; 371 HCRYPTPROV crypt_prov; 372 DWORD key_spec; 373 BOOL free_crypt_prov; 374 }; 375 376 377 static void cryptoapi_error(const char *msg) 378 { 379 wpa_printf(MSG_INFO, "CryptoAPI: %s; err=%u", 380 msg, (unsigned int) GetLastError()); 381 } 382 383 384 static int cryptoapi_rsa_pub_enc(int flen, const unsigned char *from, 385 unsigned char *to, RSA *rsa, int padding) 386 { 387 wpa_printf(MSG_DEBUG, "%s - not implemented", __func__); 388 return 0; 389 } 390 391 392 static int cryptoapi_rsa_pub_dec(int flen, const unsigned char *from, 393 unsigned char *to, RSA *rsa, int padding) 394 { 395 wpa_printf(MSG_DEBUG, "%s - not implemented", __func__); 396 return 0; 397 } 398 399 400 static int cryptoapi_rsa_priv_enc(int flen, const unsigned char *from, 401 unsigned char *to, RSA *rsa, int padding) 402 { 403 struct cryptoapi_rsa_data *priv = 404 (struct cryptoapi_rsa_data *) rsa->meth->app_data; 405 HCRYPTHASH hash; 406 DWORD hash_size, len, i; 407 unsigned char *buf = NULL; 408 int ret = 0; 409 410 if (priv == NULL) { 411 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, 412 ERR_R_PASSED_NULL_PARAMETER); 413 return 0; 414 } 415 416 if (padding != RSA_PKCS1_PADDING) { 417 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, 418 RSA_R_UNKNOWN_PADDING_TYPE); 419 return 0; 420 } 421 422 if (flen != 16 /* MD5 */ + 20 /* SHA-1 */) { 423 wpa_printf(MSG_INFO, "%s - only MD5-SHA1 hash supported", 424 __func__); 425 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, 426 RSA_R_INVALID_MESSAGE_LENGTH); 427 return 0; 428 } 429 430 if (!CryptCreateHash(priv->crypt_prov, CALG_SSL3_SHAMD5, 0, 0, &hash)) 431 { 432 cryptoapi_error("CryptCreateHash failed"); 433 return 0; 434 } 435 436 len = sizeof(hash_size); 437 if (!CryptGetHashParam(hash, HP_HASHSIZE, (BYTE *) &hash_size, &len, 438 0)) { 439 cryptoapi_error("CryptGetHashParam failed"); 440 goto err; 441 } 442 443 if ((int) hash_size != flen) { 444 wpa_printf(MSG_INFO, "CryptoAPI: Invalid hash size (%u != %d)", 445 (unsigned) hash_size, flen); 446 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, 447 RSA_R_INVALID_MESSAGE_LENGTH); 448 goto err; 449 } 450 if (!CryptSetHashParam(hash, HP_HASHVAL, (BYTE * ) from, 0)) { 451 cryptoapi_error("CryptSetHashParam failed"); 452 goto err; 453 } 454 455 len = RSA_size(rsa); 456 buf = os_malloc(len); 457 if (buf == NULL) { 458 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, ERR_R_MALLOC_FAILURE); 459 goto err; 460 } 461 462 if (!CryptSignHash(hash, priv->key_spec, NULL, 0, buf, &len)) { 463 cryptoapi_error("CryptSignHash failed"); 464 goto err; 465 } 466 467 for (i = 0; i < len; i++) 468 to[i] = buf[len - i - 1]; 469 ret = len; 470 471 err: 472 os_free(buf); 473 CryptDestroyHash(hash); 474 475 return ret; 476 } 477 478 479 static int cryptoapi_rsa_priv_dec(int flen, const unsigned char *from, 480 unsigned char *to, RSA *rsa, int padding) 481 { 482 wpa_printf(MSG_DEBUG, "%s - not implemented", __func__); 483 return 0; 484 } 485 486 487 static void cryptoapi_free_data(struct cryptoapi_rsa_data *priv) 488 { 489 if (priv == NULL) 490 return; 491 if (priv->crypt_prov && priv->free_crypt_prov) 492 CryptReleaseContext(priv->crypt_prov, 0); 493 if (priv->cert) 494 CertFreeCertificateContext(priv->cert); 495 os_free(priv); 496 } 497 498 499 static int cryptoapi_finish(RSA *rsa) 500 { 501 cryptoapi_free_data((struct cryptoapi_rsa_data *) rsa->meth->app_data); 502 os_free((void *) rsa->meth); 503 rsa->meth = NULL; 504 return 1; 505 } 506 507 508 static const CERT_CONTEXT * cryptoapi_find_cert(const char *name, DWORD store) 509 { 510 HCERTSTORE cs; 511 const CERT_CONTEXT *ret = NULL; 512 513 cs = CertOpenStore((LPCSTR) CERT_STORE_PROV_SYSTEM, 0, 0, 514 store | CERT_STORE_OPEN_EXISTING_FLAG | 515 CERT_STORE_READONLY_FLAG, L"MY"); 516 if (cs == NULL) { 517 cryptoapi_error("Failed to open 'My system store'"); 518 return NULL; 519 } 520 521 if (strncmp(name, "cert://", 7) == 0) { 522 unsigned short wbuf[255]; 523 MultiByteToWideChar(CP_ACP, 0, name + 7, -1, wbuf, 255); 524 ret = CertFindCertificateInStore(cs, X509_ASN_ENCODING | 525 PKCS_7_ASN_ENCODING, 526 0, CERT_FIND_SUBJECT_STR, 527 wbuf, NULL); 528 } else if (strncmp(name, "hash://", 7) == 0) { 529 CRYPT_HASH_BLOB blob; 530 int len; 531 const char *hash = name + 7; 532 unsigned char *buf; 533 534 len = os_strlen(hash) / 2; 535 buf = os_malloc(len); 536 if (buf && hexstr2bin(hash, buf, len) == 0) { 537 blob.cbData = len; 538 blob.pbData = buf; 539 ret = CertFindCertificateInStore(cs, 540 X509_ASN_ENCODING | 541 PKCS_7_ASN_ENCODING, 542 0, CERT_FIND_HASH, 543 &blob, NULL); 544 } 545 os_free(buf); 546 } 547 548 CertCloseStore(cs, 0); 549 550 return ret; 551 } 552 553 554 static int tls_cryptoapi_cert(SSL *ssl, const char *name) 555 { 556 X509 *cert = NULL; 557 RSA *rsa = NULL, *pub_rsa; 558 struct cryptoapi_rsa_data *priv; 559 RSA_METHOD *rsa_meth; 560 561 if (name == NULL || 562 (strncmp(name, "cert://", 7) != 0 && 563 strncmp(name, "hash://", 7) != 0)) 564 return -1; 565 566 priv = os_zalloc(sizeof(*priv)); 567 rsa_meth = os_zalloc(sizeof(*rsa_meth)); 568 if (priv == NULL || rsa_meth == NULL) { 569 wpa_printf(MSG_WARNING, "CryptoAPI: Failed to allocate memory " 570 "for CryptoAPI RSA method"); 571 os_free(priv); 572 os_free(rsa_meth); 573 return -1; 574 } 575 576 priv->cert = cryptoapi_find_cert(name, CERT_SYSTEM_STORE_CURRENT_USER); 577 if (priv->cert == NULL) { 578 priv->cert = cryptoapi_find_cert( 579 name, CERT_SYSTEM_STORE_LOCAL_MACHINE); 580 } 581 if (priv->cert == NULL) { 582 wpa_printf(MSG_INFO, "CryptoAPI: Could not find certificate " 583 "'%s'", name); 584 goto err; 585 } 586 587 cert = d2i_X509(NULL, 588 (const unsigned char **) &priv->cert->pbCertEncoded, 589 priv->cert->cbCertEncoded); 590 if (cert == NULL) { 591 wpa_printf(MSG_INFO, "CryptoAPI: Could not process X509 DER " 592 "encoding"); 593 goto err; 594 } 595 596 if (!CryptAcquireCertificatePrivateKey(priv->cert, 597 CRYPT_ACQUIRE_COMPARE_KEY_FLAG, 598 NULL, &priv->crypt_prov, 599 &priv->key_spec, 600 &priv->free_crypt_prov)) { 601 cryptoapi_error("Failed to acquire a private key for the " 602 "certificate"); 603 goto err; 604 } 605 606 rsa_meth->name = "Microsoft CryptoAPI RSA Method"; 607 rsa_meth->rsa_pub_enc = cryptoapi_rsa_pub_enc; 608 rsa_meth->rsa_pub_dec = cryptoapi_rsa_pub_dec; 609 rsa_meth->rsa_priv_enc = cryptoapi_rsa_priv_enc; 610 rsa_meth->rsa_priv_dec = cryptoapi_rsa_priv_dec; 611 rsa_meth->finish = cryptoapi_finish; 612 rsa_meth->flags = RSA_METHOD_FLAG_NO_CHECK; 613 rsa_meth->app_data = (char *) priv; 614 615 rsa = RSA_new(); 616 if (rsa == NULL) { 617 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, 618 ERR_R_MALLOC_FAILURE); 619 goto err; 620 } 621 622 if (!SSL_use_certificate(ssl, cert)) { 623 RSA_free(rsa); 624 rsa = NULL; 625 goto err; 626 } 627 pub_rsa = cert->cert_info->key->pkey->pkey.rsa; 628 X509_free(cert); 629 cert = NULL; 630 631 rsa->n = BN_dup(pub_rsa->n); 632 rsa->e = BN_dup(pub_rsa->e); 633 if (!RSA_set_method(rsa, rsa_meth)) 634 goto err; 635 636 if (!SSL_use_RSAPrivateKey(ssl, rsa)) 637 goto err; 638 RSA_free(rsa); 639 640 return 0; 641 642 err: 643 if (cert) 644 X509_free(cert); 645 if (rsa) 646 RSA_free(rsa); 647 else { 648 os_free(rsa_meth); 649 cryptoapi_free_data(priv); 650 } 651 return -1; 652 } 653 654 655 static int tls_cryptoapi_ca_cert(SSL_CTX *ssl_ctx, SSL *ssl, const char *name) 656 { 657 HCERTSTORE cs; 658 PCCERT_CONTEXT ctx = NULL; 659 X509 *cert; 660 char buf[128]; 661 const char *store; 662 #ifdef UNICODE 663 WCHAR *wstore; 664 #endif /* UNICODE */ 665 666 if (name == NULL || strncmp(name, "cert_store://", 13) != 0) 667 return -1; 668 669 store = name + 13; 670 #ifdef UNICODE 671 wstore = os_malloc((os_strlen(store) + 1) * sizeof(WCHAR)); 672 if (wstore == NULL) 673 return -1; 674 wsprintf(wstore, L"%S", store); 675 cs = CertOpenSystemStore(0, wstore); 676 os_free(wstore); 677 #else /* UNICODE */ 678 cs = CertOpenSystemStore(0, store); 679 #endif /* UNICODE */ 680 if (cs == NULL) { 681 wpa_printf(MSG_DEBUG, "%s: failed to open system cert store " 682 "'%s': error=%d", __func__, store, 683 (int) GetLastError()); 684 return -1; 685 } 686 687 while ((ctx = CertEnumCertificatesInStore(cs, ctx))) { 688 cert = d2i_X509(NULL, 689 (const unsigned char **) &ctx->pbCertEncoded, 690 ctx->cbCertEncoded); 691 if (cert == NULL) { 692 wpa_printf(MSG_INFO, "CryptoAPI: Could not process " 693 "X509 DER encoding for CA cert"); 694 continue; 695 } 696 697 X509_NAME_oneline(X509_get_subject_name(cert), buf, 698 sizeof(buf)); 699 wpa_printf(MSG_DEBUG, "OpenSSL: Loaded CA certificate for " 700 "system certificate store: subject='%s'", buf); 701 702 if (!X509_STORE_add_cert(SSL_CTX_get_cert_store(ssl_ctx), 703 cert)) { 704 tls_show_errors(MSG_WARNING, __func__, 705 "Failed to add ca_cert to OpenSSL " 706 "certificate store"); 707 } 708 709 X509_free(cert); 710 } 711 712 if (!CertCloseStore(cs, 0)) { 713 wpa_printf(MSG_DEBUG, "%s: failed to close system cert store " 714 "'%s': error=%d", __func__, name + 13, 715 (int) GetLastError()); 716 } 717 718 return 0; 719 } 720 721 722 #else /* CONFIG_NATIVE_WINDOWS */ 723 724 static int tls_cryptoapi_cert(SSL *ssl, const char *name) 725 { 726 return -1; 727 } 728 729 #endif /* CONFIG_NATIVE_WINDOWS */ 730 731 732 static void ssl_info_cb(const SSL *ssl, int where, int ret) 733 { 734 const char *str; 735 int w; 736 737 wpa_printf(MSG_DEBUG, "SSL: (where=0x%x ret=0x%x)", where, ret); 738 w = where & ~SSL_ST_MASK; 739 if (w & SSL_ST_CONNECT) 740 str = "SSL_connect"; 741 else if (w & SSL_ST_ACCEPT) 742 str = "SSL_accept"; 743 else 744 str = "undefined"; 745 746 if (where & SSL_CB_LOOP) { 747 wpa_printf(MSG_DEBUG, "SSL: %s:%s", 748 str, SSL_state_string_long(ssl)); 749 } else if (where & SSL_CB_ALERT) { 750 struct tls_connection *conn = SSL_get_app_data((SSL *) ssl); 751 wpa_printf(MSG_INFO, "SSL: SSL3 alert: %s:%s:%s", 752 where & SSL_CB_READ ? 753 "read (remote end reported an error)" : 754 "write (local SSL3 detected an error)", 755 SSL_alert_type_string_long(ret), 756 SSL_alert_desc_string_long(ret)); 757 if ((ret >> 8) == SSL3_AL_FATAL) { 758 if (where & SSL_CB_READ) 759 conn->read_alerts++; 760 else 761 conn->write_alerts++; 762 } 763 if (conn->context->event_cb != NULL) { 764 union tls_event_data ev; 765 struct tls_context *context = conn->context; 766 os_memset(&ev, 0, sizeof(ev)); 767 ev.alert.is_local = !(where & SSL_CB_READ); 768 ev.alert.type = SSL_alert_type_string_long(ret); 769 ev.alert.description = SSL_alert_desc_string_long(ret); 770 context->event_cb(context->cb_ctx, TLS_ALERT, &ev); 771 } 772 } else if (where & SSL_CB_EXIT && ret <= 0) { 773 wpa_printf(MSG_DEBUG, "SSL: %s:%s in %s", 774 str, ret == 0 ? "failed" : "error", 775 SSL_state_string_long(ssl)); 776 } 777 } 778 779 780 #ifndef OPENSSL_NO_ENGINE 781 /** 782 * tls_engine_load_dynamic_generic - load any openssl engine 783 * @pre: an array of commands and values that load an engine initialized 784 * in the engine specific function 785 * @post: an array of commands and values that initialize an already loaded 786 * engine (or %NULL if not required) 787 * @id: the engine id of the engine to load (only required if post is not %NULL 788 * 789 * This function is a generic function that loads any openssl engine. 790 * 791 * Returns: 0 on success, -1 on failure 792 */ 793 static int tls_engine_load_dynamic_generic(const char *pre[], 794 const char *post[], const char *id) 795 { 796 ENGINE *engine; 797 const char *dynamic_id = "dynamic"; 798 799 engine = ENGINE_by_id(id); 800 if (engine) { 801 wpa_printf(MSG_DEBUG, "ENGINE: engine '%s' is already " 802 "available", id); 803 /* 804 * If it was auto-loaded by ENGINE_by_id() we might still 805 * need to tell it which PKCS#11 module to use in legacy 806 * (non-p11-kit) environments. Do so now; even if it was 807 * properly initialised before, setting it again will be 808 * harmless. 809 */ 810 goto found; 811 } 812 ERR_clear_error(); 813 814 engine = ENGINE_by_id(dynamic_id); 815 if (engine == NULL) { 816 wpa_printf(MSG_INFO, "ENGINE: Can't find engine %s [%s]", 817 dynamic_id, 818 ERR_error_string(ERR_get_error(), NULL)); 819 return -1; 820 } 821 822 /* Perform the pre commands. This will load the engine. */ 823 while (pre && pre[0]) { 824 wpa_printf(MSG_DEBUG, "ENGINE: '%s' '%s'", pre[0], pre[1]); 825 if (ENGINE_ctrl_cmd_string(engine, pre[0], pre[1], 0) == 0) { 826 wpa_printf(MSG_INFO, "ENGINE: ctrl cmd_string failed: " 827 "%s %s [%s]", pre[0], pre[1], 828 ERR_error_string(ERR_get_error(), NULL)); 829 ENGINE_free(engine); 830 return -1; 831 } 832 pre += 2; 833 } 834 835 /* 836 * Free the reference to the "dynamic" engine. The loaded engine can 837 * now be looked up using ENGINE_by_id(). 838 */ 839 ENGINE_free(engine); 840 841 engine = ENGINE_by_id(id); 842 if (engine == NULL) { 843 wpa_printf(MSG_INFO, "ENGINE: Can't find engine %s [%s]", 844 id, ERR_error_string(ERR_get_error(), NULL)); 845 return -1; 846 } 847 found: 848 while (post && post[0]) { 849 wpa_printf(MSG_DEBUG, "ENGINE: '%s' '%s'", post[0], post[1]); 850 if (ENGINE_ctrl_cmd_string(engine, post[0], post[1], 0) == 0) { 851 wpa_printf(MSG_DEBUG, "ENGINE: ctrl cmd_string failed:" 852 " %s %s [%s]", post[0], post[1], 853 ERR_error_string(ERR_get_error(), NULL)); 854 ENGINE_remove(engine); 855 ENGINE_free(engine); 856 return -1; 857 } 858 post += 2; 859 } 860 ENGINE_free(engine); 861 862 return 0; 863 } 864 865 866 /** 867 * tls_engine_load_dynamic_pkcs11 - load the pkcs11 engine provided by opensc 868 * @pkcs11_so_path: pksc11_so_path from the configuration 869 * @pcks11_module_path: pkcs11_module_path from the configuration 870 */ 871 static int tls_engine_load_dynamic_pkcs11(const char *pkcs11_so_path, 872 const char *pkcs11_module_path) 873 { 874 char *engine_id = "pkcs11"; 875 const char *pre_cmd[] = { 876 "SO_PATH", NULL /* pkcs11_so_path */, 877 "ID", NULL /* engine_id */, 878 "LIST_ADD", "1", 879 /* "NO_VCHECK", "1", */ 880 "LOAD", NULL, 881 NULL, NULL 882 }; 883 const char *post_cmd[] = { 884 "MODULE_PATH", NULL /* pkcs11_module_path */, 885 NULL, NULL 886 }; 887 888 if (!pkcs11_so_path) 889 return 0; 890 891 pre_cmd[1] = pkcs11_so_path; 892 pre_cmd[3] = engine_id; 893 if (pkcs11_module_path) 894 post_cmd[1] = pkcs11_module_path; 895 else 896 post_cmd[0] = NULL; 897 898 wpa_printf(MSG_DEBUG, "ENGINE: Loading pkcs11 Engine from %s", 899 pkcs11_so_path); 900 901 return tls_engine_load_dynamic_generic(pre_cmd, post_cmd, engine_id); 902 } 903 904 905 /** 906 * tls_engine_load_dynamic_opensc - load the opensc engine provided by opensc 907 * @opensc_so_path: opensc_so_path from the configuration 908 */ 909 static int tls_engine_load_dynamic_opensc(const char *opensc_so_path) 910 { 911 char *engine_id = "opensc"; 912 const char *pre_cmd[] = { 913 "SO_PATH", NULL /* opensc_so_path */, 914 "ID", NULL /* engine_id */, 915 "LIST_ADD", "1", 916 "LOAD", NULL, 917 NULL, NULL 918 }; 919 920 if (!opensc_so_path) 921 return 0; 922 923 pre_cmd[1] = opensc_so_path; 924 pre_cmd[3] = engine_id; 925 926 wpa_printf(MSG_DEBUG, "ENGINE: Loading OpenSC Engine from %s", 927 opensc_so_path); 928 929 return tls_engine_load_dynamic_generic(pre_cmd, NULL, engine_id); 930 } 931 #endif /* OPENSSL_NO_ENGINE */ 932 933 934 static void remove_session_cb(SSL_CTX *ctx, SSL_SESSION *sess) 935 { 936 struct wpabuf *buf; 937 938 if (tls_ex_idx_session < 0) 939 return; 940 buf = SSL_SESSION_get_ex_data(sess, tls_ex_idx_session); 941 if (!buf) 942 return; 943 wpa_printf(MSG_DEBUG, 944 "OpenSSL: Free application session data %p (sess %p)", 945 buf, sess); 946 wpabuf_free(buf); 947 948 SSL_SESSION_set_ex_data(sess, tls_ex_idx_session, NULL); 949 } 950 951 952 void * tls_init(const struct tls_config *conf) 953 { 954 struct tls_data *data; 955 SSL_CTX *ssl; 956 struct tls_context *context; 957 const char *ciphers; 958 959 if (tls_openssl_ref_count == 0) { 960 tls_global = context = tls_context_new(conf); 961 if (context == NULL) 962 return NULL; 963 #ifdef CONFIG_FIPS 964 #ifdef OPENSSL_FIPS 965 if (conf && conf->fips_mode) { 966 static int fips_enabled = 0; 967 968 if (!fips_enabled && !FIPS_mode_set(1)) { 969 wpa_printf(MSG_ERROR, "Failed to enable FIPS " 970 "mode"); 971 ERR_load_crypto_strings(); 972 ERR_print_errors_fp(stderr); 973 os_free(tls_global); 974 tls_global = NULL; 975 return NULL; 976 } else { 977 wpa_printf(MSG_INFO, "Running in FIPS mode"); 978 fips_enabled = 1; 979 } 980 } 981 #else /* OPENSSL_FIPS */ 982 if (conf && conf->fips_mode) { 983 wpa_printf(MSG_ERROR, "FIPS mode requested, but not " 984 "supported"); 985 os_free(tls_global); 986 tls_global = NULL; 987 return NULL; 988 } 989 #endif /* OPENSSL_FIPS */ 990 #endif /* CONFIG_FIPS */ 991 #if OPENSSL_VERSION_NUMBER < 0x10100000L || \ 992 (defined(LIBRESSL_VERSION_NUMBER) && \ 993 LIBRESSL_VERSION_NUMBER < 0x20700000L) 994 SSL_load_error_strings(); 995 SSL_library_init(); 996 #ifndef OPENSSL_NO_SHA256 997 EVP_add_digest(EVP_sha256()); 998 #endif /* OPENSSL_NO_SHA256 */ 999 /* TODO: if /dev/urandom is available, PRNG is seeded 1000 * automatically. If this is not the case, random data should 1001 * be added here. */ 1002 1003 #ifdef PKCS12_FUNCS 1004 #ifndef OPENSSL_NO_RC2 1005 /* 1006 * 40-bit RC2 is commonly used in PKCS#12 files, so enable it. 1007 * This is enabled by PKCS12_PBE_add() in OpenSSL 0.9.8 1008 * versions, but it looks like OpenSSL 1.0.0 does not do that 1009 * anymore. 1010 */ 1011 EVP_add_cipher(EVP_rc2_40_cbc()); 1012 #endif /* OPENSSL_NO_RC2 */ 1013 PKCS12_PBE_add(); 1014 #endif /* PKCS12_FUNCS */ 1015 #endif /* < 1.1.0 */ 1016 } else { 1017 context = tls_context_new(conf); 1018 if (context == NULL) 1019 return NULL; 1020 } 1021 tls_openssl_ref_count++; 1022 1023 data = os_zalloc(sizeof(*data)); 1024 if (data) 1025 ssl = SSL_CTX_new(SSLv23_method()); 1026 else 1027 ssl = NULL; 1028 if (ssl == NULL) { 1029 tls_openssl_ref_count--; 1030 if (context != tls_global) 1031 os_free(context); 1032 if (tls_openssl_ref_count == 0) { 1033 os_free(tls_global); 1034 tls_global = NULL; 1035 } 1036 os_free(data); 1037 return NULL; 1038 } 1039 data->ssl = ssl; 1040 if (conf) { 1041 data->tls_session_lifetime = conf->tls_session_lifetime; 1042 data->crl_reload_interval = conf->crl_reload_interval; 1043 } 1044 1045 SSL_CTX_set_options(ssl, SSL_OP_NO_SSLv2); 1046 SSL_CTX_set_options(ssl, SSL_OP_NO_SSLv3); 1047 1048 SSL_CTX_set_mode(ssl, SSL_MODE_AUTO_RETRY); 1049 1050 #ifdef SSL_MODE_NO_AUTO_CHAIN 1051 /* Number of deployed use cases assume the default OpenSSL behavior of 1052 * auto chaining the local certificate is in use. BoringSSL removed this 1053 * functionality by default, so we need to restore it here to avoid 1054 * breaking existing use cases. */ 1055 SSL_CTX_clear_mode(ssl, SSL_MODE_NO_AUTO_CHAIN); 1056 #endif /* SSL_MODE_NO_AUTO_CHAIN */ 1057 1058 SSL_CTX_set_info_callback(ssl, ssl_info_cb); 1059 SSL_CTX_set_app_data(ssl, context); 1060 if (data->tls_session_lifetime > 0) { 1061 SSL_CTX_set_quiet_shutdown(ssl, 1); 1062 /* 1063 * Set default context here. In practice, this will be replaced 1064 * by the per-EAP method context in tls_connection_set_verify(). 1065 */ 1066 SSL_CTX_set_session_id_context(ssl, (u8 *) "hostapd", 7); 1067 SSL_CTX_set_session_cache_mode(ssl, SSL_SESS_CACHE_SERVER); 1068 SSL_CTX_set_timeout(ssl, data->tls_session_lifetime); 1069 SSL_CTX_sess_set_remove_cb(ssl, remove_session_cb); 1070 } else { 1071 SSL_CTX_set_session_cache_mode(ssl, SSL_SESS_CACHE_OFF); 1072 } 1073 1074 if (tls_ex_idx_session < 0) { 1075 tls_ex_idx_session = SSL_SESSION_get_ex_new_index( 1076 0, NULL, NULL, NULL, NULL); 1077 if (tls_ex_idx_session < 0) { 1078 tls_deinit(data); 1079 return NULL; 1080 } 1081 } 1082 1083 #ifndef OPENSSL_NO_ENGINE 1084 wpa_printf(MSG_DEBUG, "ENGINE: Loading builtin engines"); 1085 ENGINE_load_builtin_engines(); 1086 1087 if (conf && 1088 (conf->opensc_engine_path || conf->pkcs11_engine_path || 1089 conf->pkcs11_module_path)) { 1090 if (tls_engine_load_dynamic_opensc(conf->opensc_engine_path) || 1091 tls_engine_load_dynamic_pkcs11(conf->pkcs11_engine_path, 1092 conf->pkcs11_module_path)) { 1093 tls_deinit(data); 1094 return NULL; 1095 } 1096 } 1097 #endif /* OPENSSL_NO_ENGINE */ 1098 1099 if (conf && conf->openssl_ciphers) 1100 ciphers = conf->openssl_ciphers; 1101 else 1102 ciphers = TLS_DEFAULT_CIPHERS; 1103 if (SSL_CTX_set_cipher_list(ssl, ciphers) != 1) { 1104 wpa_printf(MSG_ERROR, 1105 "OpenSSL: Failed to set cipher string '%s'", 1106 ciphers); 1107 tls_deinit(data); 1108 return NULL; 1109 } 1110 1111 return data; 1112 } 1113 1114 1115 void tls_deinit(void *ssl_ctx) 1116 { 1117 struct tls_data *data = ssl_ctx; 1118 SSL_CTX *ssl = data->ssl; 1119 struct tls_context *context = SSL_CTX_get_app_data(ssl); 1120 if (context != tls_global) 1121 os_free(context); 1122 if (data->tls_session_lifetime > 0) 1123 SSL_CTX_flush_sessions(ssl, 0); 1124 os_free(data->ca_cert); 1125 SSL_CTX_free(ssl); 1126 1127 tls_openssl_ref_count--; 1128 if (tls_openssl_ref_count == 0) { 1129 #if OPENSSL_VERSION_NUMBER < 0x10100000L || \ 1130 (defined(LIBRESSL_VERSION_NUMBER) && \ 1131 LIBRESSL_VERSION_NUMBER < 0x20700000L) 1132 #ifndef OPENSSL_NO_ENGINE 1133 ENGINE_cleanup(); 1134 #endif /* OPENSSL_NO_ENGINE */ 1135 CRYPTO_cleanup_all_ex_data(); 1136 ERR_remove_thread_state(NULL); 1137 ERR_free_strings(); 1138 EVP_cleanup(); 1139 #endif /* < 1.1.0 */ 1140 os_free(tls_global->ocsp_stapling_response); 1141 tls_global->ocsp_stapling_response = NULL; 1142 os_free(tls_global); 1143 tls_global = NULL; 1144 } 1145 1146 os_free(data->check_cert_subject); 1147 os_free(data); 1148 } 1149 1150 1151 #ifndef OPENSSL_NO_ENGINE 1152 1153 /* Cryptoki return values */ 1154 #define CKR_PIN_INCORRECT 0x000000a0 1155 #define CKR_PIN_INVALID 0x000000a1 1156 #define CKR_PIN_LEN_RANGE 0x000000a2 1157 1158 /* libp11 */ 1159 #define ERR_LIB_PKCS11 ERR_LIB_USER 1160 1161 static int tls_is_pin_error(unsigned int err) 1162 { 1163 return ERR_GET_LIB(err) == ERR_LIB_PKCS11 && 1164 (ERR_GET_REASON(err) == CKR_PIN_INCORRECT || 1165 ERR_GET_REASON(err) == CKR_PIN_INVALID || 1166 ERR_GET_REASON(err) == CKR_PIN_LEN_RANGE); 1167 } 1168 1169 #endif /* OPENSSL_NO_ENGINE */ 1170 1171 1172 #ifdef ANDROID 1173 /* EVP_PKEY_from_keystore comes from system/security/keystore-engine. */ 1174 EVP_PKEY * EVP_PKEY_from_keystore(const char *key_id); 1175 #endif /* ANDROID */ 1176 1177 static int tls_engine_init(struct tls_connection *conn, const char *engine_id, 1178 const char *pin, const char *key_id, 1179 const char *cert_id, const char *ca_cert_id) 1180 { 1181 #if defined(ANDROID) && defined(OPENSSL_IS_BORINGSSL) 1182 #if !defined(OPENSSL_NO_ENGINE) 1183 #error "This code depends on OPENSSL_NO_ENGINE being defined by BoringSSL." 1184 #endif 1185 if (!key_id) 1186 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED; 1187 conn->engine = NULL; 1188 conn->private_key = EVP_PKEY_from_keystore(key_id); 1189 if (!conn->private_key) { 1190 wpa_printf(MSG_ERROR, 1191 "ENGINE: cannot load private key with id '%s' [%s]", 1192 key_id, 1193 ERR_error_string(ERR_get_error(), NULL)); 1194 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED; 1195 } 1196 #endif /* ANDROID && OPENSSL_IS_BORINGSSL */ 1197 1198 #ifndef OPENSSL_NO_ENGINE 1199 int ret = -1; 1200 if (engine_id == NULL) { 1201 wpa_printf(MSG_ERROR, "ENGINE: Engine ID not set"); 1202 return -1; 1203 } 1204 1205 ERR_clear_error(); 1206 #ifdef ANDROID 1207 ENGINE_load_dynamic(); 1208 #endif 1209 conn->engine = ENGINE_by_id(engine_id); 1210 if (!conn->engine) { 1211 wpa_printf(MSG_ERROR, "ENGINE: engine %s not available [%s]", 1212 engine_id, ERR_error_string(ERR_get_error(), NULL)); 1213 goto err; 1214 } 1215 if (ENGINE_init(conn->engine) != 1) { 1216 wpa_printf(MSG_ERROR, "ENGINE: engine init failed " 1217 "(engine: %s) [%s]", engine_id, 1218 ERR_error_string(ERR_get_error(), NULL)); 1219 goto err; 1220 } 1221 wpa_printf(MSG_DEBUG, "ENGINE: engine initialized"); 1222 1223 #ifndef ANDROID 1224 if (pin && ENGINE_ctrl_cmd_string(conn->engine, "PIN", pin, 0) == 0) { 1225 wpa_printf(MSG_ERROR, "ENGINE: cannot set pin [%s]", 1226 ERR_error_string(ERR_get_error(), NULL)); 1227 goto err; 1228 } 1229 #endif 1230 if (key_id) { 1231 /* 1232 * Ensure that the ENGINE does not attempt to use the OpenSSL 1233 * UI system to obtain a PIN, if we didn't provide one. 1234 */ 1235 struct { 1236 const void *password; 1237 const char *prompt_info; 1238 } key_cb = { "", NULL }; 1239 1240 /* load private key first in-case PIN is required for cert */ 1241 conn->private_key = ENGINE_load_private_key(conn->engine, 1242 key_id, NULL, 1243 &key_cb); 1244 if (!conn->private_key) { 1245 unsigned long err = ERR_get_error(); 1246 1247 wpa_printf(MSG_ERROR, 1248 "ENGINE: cannot load private key with id '%s' [%s]", 1249 key_id, 1250 ERR_error_string(err, NULL)); 1251 if (tls_is_pin_error(err)) 1252 ret = TLS_SET_PARAMS_ENGINE_PRV_BAD_PIN; 1253 else 1254 ret = TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED; 1255 goto err; 1256 } 1257 } 1258 1259 /* handle a certificate and/or CA certificate */ 1260 if (cert_id || ca_cert_id) { 1261 const char *cmd_name = "LOAD_CERT_CTRL"; 1262 1263 /* test if the engine supports a LOAD_CERT_CTRL */ 1264 if (!ENGINE_ctrl(conn->engine, ENGINE_CTRL_GET_CMD_FROM_NAME, 1265 0, (void *)cmd_name, NULL)) { 1266 wpa_printf(MSG_ERROR, "ENGINE: engine does not support" 1267 " loading certificates"); 1268 ret = TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED; 1269 goto err; 1270 } 1271 } 1272 1273 return 0; 1274 1275 err: 1276 if (conn->engine) { 1277 ENGINE_free(conn->engine); 1278 conn->engine = NULL; 1279 } 1280 1281 if (conn->private_key) { 1282 EVP_PKEY_free(conn->private_key); 1283 conn->private_key = NULL; 1284 } 1285 1286 return ret; 1287 #else /* OPENSSL_NO_ENGINE */ 1288 return 0; 1289 #endif /* OPENSSL_NO_ENGINE */ 1290 } 1291 1292 1293 static void tls_engine_deinit(struct tls_connection *conn) 1294 { 1295 #if defined(ANDROID) || !defined(OPENSSL_NO_ENGINE) 1296 wpa_printf(MSG_DEBUG, "ENGINE: engine deinit"); 1297 if (conn->private_key) { 1298 EVP_PKEY_free(conn->private_key); 1299 conn->private_key = NULL; 1300 } 1301 if (conn->engine) { 1302 #if !defined(OPENSSL_IS_BORINGSSL) 1303 ENGINE_finish(conn->engine); 1304 #endif /* !OPENSSL_IS_BORINGSSL */ 1305 conn->engine = NULL; 1306 } 1307 #endif /* ANDROID || !OPENSSL_NO_ENGINE */ 1308 } 1309 1310 1311 int tls_get_errors(void *ssl_ctx) 1312 { 1313 int count = 0; 1314 unsigned long err; 1315 1316 while ((err = ERR_get_error())) { 1317 wpa_printf(MSG_INFO, "TLS - SSL error: %s", 1318 ERR_error_string(err, NULL)); 1319 count++; 1320 } 1321 1322 return count; 1323 } 1324 1325 1326 static const char * openssl_content_type(int content_type) 1327 { 1328 switch (content_type) { 1329 case 20: 1330 return "change cipher spec"; 1331 case 21: 1332 return "alert"; 1333 case 22: 1334 return "handshake"; 1335 case 23: 1336 return "application data"; 1337 case 24: 1338 return "heartbeat"; 1339 case 256: 1340 return "TLS header info"; /* pseudo content type */ 1341 case 257: 1342 return "inner content type"; /* pseudo content type */ 1343 default: 1344 return "?"; 1345 } 1346 } 1347 1348 1349 static const char * openssl_handshake_type(int content_type, const u8 *buf, 1350 size_t len) 1351 { 1352 if (content_type == 257 && buf && len == 1) 1353 return openssl_content_type(buf[0]); 1354 if (content_type != 22 || !buf || len == 0) 1355 return ""; 1356 switch (buf[0]) { 1357 case 0: 1358 return "hello request"; 1359 case 1: 1360 return "client hello"; 1361 case 2: 1362 return "server hello"; 1363 case 3: 1364 return "hello verify request"; 1365 case 4: 1366 return "new session ticket"; 1367 case 5: 1368 return "end of early data"; 1369 case 6: 1370 return "hello retry request"; 1371 case 8: 1372 return "encrypted extensions"; 1373 case 11: 1374 return "certificate"; 1375 case 12: 1376 return "server key exchange"; 1377 case 13: 1378 return "certificate request"; 1379 case 14: 1380 return "server hello done"; 1381 case 15: 1382 return "certificate verify"; 1383 case 16: 1384 return "client key exchange"; 1385 case 20: 1386 return "finished"; 1387 case 21: 1388 return "certificate url"; 1389 case 22: 1390 return "certificate status"; 1391 case 23: 1392 return "supplemental data"; 1393 case 24: 1394 return "key update"; 1395 case 254: 1396 return "message hash"; 1397 default: 1398 return "?"; 1399 } 1400 } 1401 1402 1403 #ifdef CONFIG_SUITEB 1404 1405 static void check_server_hello(struct tls_connection *conn, 1406 const u8 *pos, const u8 *end) 1407 { 1408 size_t payload_len, id_len; 1409 1410 /* 1411 * Parse ServerHello to get the selected cipher suite since OpenSSL does 1412 * not make it cleanly available during handshake and we need to know 1413 * whether DHE was selected. 1414 */ 1415 1416 if (end - pos < 3) 1417 return; 1418 payload_len = WPA_GET_BE24(pos); 1419 pos += 3; 1420 1421 if ((size_t) (end - pos) < payload_len) 1422 return; 1423 end = pos + payload_len; 1424 1425 /* Skip Version and Random */ 1426 if (end - pos < 2 + SSL3_RANDOM_SIZE) 1427 return; 1428 pos += 2 + SSL3_RANDOM_SIZE; 1429 1430 /* Skip Session ID */ 1431 if (end - pos < 1) 1432 return; 1433 id_len = *pos++; 1434 if ((size_t) (end - pos) < id_len) 1435 return; 1436 pos += id_len; 1437 1438 if (end - pos < 2) 1439 return; 1440 conn->cipher_suite = WPA_GET_BE16(pos); 1441 wpa_printf(MSG_DEBUG, "OpenSSL: Server selected cipher suite 0x%x", 1442 conn->cipher_suite); 1443 } 1444 1445 1446 static void check_server_key_exchange(SSL *ssl, struct tls_connection *conn, 1447 const u8 *pos, const u8 *end) 1448 { 1449 size_t payload_len; 1450 u16 dh_len; 1451 BIGNUM *p; 1452 int bits; 1453 1454 if (!(conn->flags & TLS_CONN_SUITEB)) 1455 return; 1456 1457 /* DHE is enabled only with DHE-RSA-AES256-GCM-SHA384 */ 1458 if (conn->cipher_suite != 0x9f) 1459 return; 1460 1461 if (end - pos < 3) 1462 return; 1463 payload_len = WPA_GET_BE24(pos); 1464 pos += 3; 1465 1466 if ((size_t) (end - pos) < payload_len) 1467 return; 1468 end = pos + payload_len; 1469 1470 if (end - pos < 2) 1471 return; 1472 dh_len = WPA_GET_BE16(pos); 1473 pos += 2; 1474 1475 if ((size_t) (end - pos) < dh_len) 1476 return; 1477 p = BN_bin2bn(pos, dh_len, NULL); 1478 if (!p) 1479 return; 1480 1481 bits = BN_num_bits(p); 1482 BN_free(p); 1483 1484 conn->server_dh_prime_len = bits; 1485 wpa_printf(MSG_DEBUG, "OpenSSL: Server DH prime length: %d bits", 1486 conn->server_dh_prime_len); 1487 } 1488 1489 #endif /* CONFIG_SUITEB */ 1490 1491 1492 static void tls_msg_cb(int write_p, int version, int content_type, 1493 const void *buf, size_t len, SSL *ssl, void *arg) 1494 { 1495 struct tls_connection *conn = arg; 1496 const u8 *pos = buf; 1497 1498 if (write_p == 2) { 1499 wpa_printf(MSG_DEBUG, 1500 "OpenSSL: session ver=0x%x content_type=%d", 1501 version, content_type); 1502 wpa_hexdump_key(MSG_MSGDUMP, "OpenSSL: Data", buf, len); 1503 return; 1504 } 1505 1506 wpa_printf(MSG_DEBUG, "OpenSSL: %s ver=0x%x content_type=%d (%s/%s)", 1507 write_p ? "TX" : "RX", version, content_type, 1508 openssl_content_type(content_type), 1509 openssl_handshake_type(content_type, buf, len)); 1510 wpa_hexdump_key(MSG_MSGDUMP, "OpenSSL: Message", buf, len); 1511 if (content_type == 24 && len >= 3 && pos[0] == 1) { 1512 size_t payload_len = WPA_GET_BE16(pos + 1); 1513 if (payload_len + 3 > len) { 1514 wpa_printf(MSG_ERROR, "OpenSSL: Heartbeat attack detected"); 1515 conn->invalid_hb_used = 1; 1516 } 1517 } 1518 1519 #ifdef CONFIG_SUITEB 1520 /* 1521 * Need to parse these handshake messages to be able to check DH prime 1522 * length since OpenSSL does not expose the new cipher suite and DH 1523 * parameters during handshake (e.g., for cert_cb() callback). 1524 */ 1525 if (content_type == 22 && pos && len > 0 && pos[0] == 2) 1526 check_server_hello(conn, pos + 1, pos + len); 1527 if (content_type == 22 && pos && len > 0 && pos[0] == 12) 1528 check_server_key_exchange(ssl, conn, pos + 1, pos + len); 1529 #endif /* CONFIG_SUITEB */ 1530 } 1531 1532 1533 struct tls_connection * tls_connection_init(void *ssl_ctx) 1534 { 1535 struct tls_data *data = ssl_ctx; 1536 SSL_CTX *ssl = data->ssl; 1537 struct tls_connection *conn; 1538 long options; 1539 X509_STORE *new_cert_store; 1540 struct os_reltime now; 1541 struct tls_context *context = SSL_CTX_get_app_data(ssl); 1542 1543 /* Replace X509 store if it is time to update CRL. */ 1544 if (data->crl_reload_interval > 0 && os_get_reltime(&now) == 0 && 1545 os_reltime_expired(&now, &data->crl_last_reload, 1546 data->crl_reload_interval)) { 1547 wpa_printf(MSG_INFO, 1548 "OpenSSL: Flushing X509 store with ca_cert file"); 1549 new_cert_store = tls_crl_cert_reload(data->ca_cert, 1550 data->check_crl); 1551 if (!new_cert_store) { 1552 wpa_printf(MSG_ERROR, 1553 "OpenSSL: Error replacing X509 store with ca_cert file"); 1554 } else { 1555 /* Replace old store */ 1556 SSL_CTX_set_cert_store(ssl, new_cert_store); 1557 data->crl_last_reload = now; 1558 } 1559 } 1560 1561 conn = os_zalloc(sizeof(*conn)); 1562 if (conn == NULL) 1563 return NULL; 1564 conn->data = data; 1565 conn->ssl_ctx = ssl; 1566 conn->ssl = SSL_new(ssl); 1567 if (conn->ssl == NULL) { 1568 tls_show_errors(MSG_INFO, __func__, 1569 "Failed to initialize new SSL connection"); 1570 os_free(conn); 1571 return NULL; 1572 } 1573 1574 conn->context = context; 1575 SSL_set_app_data(conn->ssl, conn); 1576 SSL_set_msg_callback(conn->ssl, tls_msg_cb); 1577 SSL_set_msg_callback_arg(conn->ssl, conn); 1578 options = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | 1579 SSL_OP_SINGLE_DH_USE; 1580 #ifdef SSL_OP_NO_COMPRESSION 1581 options |= SSL_OP_NO_COMPRESSION; 1582 #endif /* SSL_OP_NO_COMPRESSION */ 1583 SSL_set_options(conn->ssl, options); 1584 #ifdef SSL_OP_ENABLE_MIDDLEBOX_COMPAT 1585 /* Hopefully there is no need for middlebox compatibility mechanisms 1586 * when going through EAP authentication. */ 1587 SSL_clear_options(conn->ssl, SSL_OP_ENABLE_MIDDLEBOX_COMPAT); 1588 #endif 1589 1590 conn->ssl_in = BIO_new(BIO_s_mem()); 1591 if (!conn->ssl_in) { 1592 tls_show_errors(MSG_INFO, __func__, 1593 "Failed to create a new BIO for ssl_in"); 1594 SSL_free(conn->ssl); 1595 os_free(conn); 1596 return NULL; 1597 } 1598 1599 conn->ssl_out = BIO_new(BIO_s_mem()); 1600 if (!conn->ssl_out) { 1601 tls_show_errors(MSG_INFO, __func__, 1602 "Failed to create a new BIO for ssl_out"); 1603 SSL_free(conn->ssl); 1604 BIO_free(conn->ssl_in); 1605 os_free(conn); 1606 return NULL; 1607 } 1608 1609 SSL_set_bio(conn->ssl, conn->ssl_in, conn->ssl_out); 1610 1611 return conn; 1612 } 1613 1614 1615 void tls_connection_deinit(void *ssl_ctx, struct tls_connection *conn) 1616 { 1617 if (conn == NULL) 1618 return; 1619 if (conn->success_data) { 1620 /* 1621 * Make sure ssl_clear_bad_session() does not remove this 1622 * session. 1623 */ 1624 SSL_set_quiet_shutdown(conn->ssl, 1); 1625 SSL_shutdown(conn->ssl); 1626 } 1627 SSL_free(conn->ssl); 1628 tls_engine_deinit(conn); 1629 os_free(conn->subject_match); 1630 os_free(conn->altsubject_match); 1631 os_free(conn->suffix_match); 1632 os_free(conn->domain_match); 1633 os_free(conn->check_cert_subject); 1634 os_free(conn->session_ticket); 1635 os_free(conn->peer_subject); 1636 os_free(conn); 1637 } 1638 1639 1640 int tls_connection_established(void *ssl_ctx, struct tls_connection *conn) 1641 { 1642 return conn ? SSL_is_init_finished(conn->ssl) : 0; 1643 } 1644 1645 1646 char * tls_connection_peer_serial_num(void *tls_ctx, 1647 struct tls_connection *conn) 1648 { 1649 ASN1_INTEGER *ser; 1650 char *serial_num; 1651 size_t len; 1652 1653 if (!conn->peer_cert) 1654 return NULL; 1655 1656 ser = X509_get_serialNumber(conn->peer_cert); 1657 if (!ser) 1658 return NULL; 1659 1660 len = ASN1_STRING_length(ser) * 2 + 1; 1661 serial_num = os_malloc(len); 1662 if (!serial_num) 1663 return NULL; 1664 wpa_snprintf_hex_uppercase(serial_num, len, 1665 ASN1_STRING_get0_data(ser), 1666 ASN1_STRING_length(ser)); 1667 return serial_num; 1668 } 1669 1670 1671 int tls_connection_shutdown(void *ssl_ctx, struct tls_connection *conn) 1672 { 1673 if (conn == NULL) 1674 return -1; 1675 1676 /* Shutdown previous TLS connection without notifying the peer 1677 * because the connection was already terminated in practice 1678 * and "close notify" shutdown alert would confuse AS. */ 1679 SSL_set_quiet_shutdown(conn->ssl, 1); 1680 SSL_shutdown(conn->ssl); 1681 return SSL_clear(conn->ssl) == 1 ? 0 : -1; 1682 } 1683 1684 1685 static int tls_match_altsubject_component(X509 *cert, int type, 1686 const char *value, size_t len) 1687 { 1688 GENERAL_NAME *gen; 1689 void *ext; 1690 int found = 0; 1691 stack_index_t i; 1692 1693 ext = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL); 1694 1695 for (i = 0; ext && i < sk_GENERAL_NAME_num(ext); i++) { 1696 gen = sk_GENERAL_NAME_value(ext, i); 1697 if (gen->type != type) 1698 continue; 1699 if (os_strlen((char *) gen->d.ia5->data) == len && 1700 os_memcmp(value, gen->d.ia5->data, len) == 0) 1701 found++; 1702 } 1703 1704 sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free); 1705 1706 return found; 1707 } 1708 1709 1710 static int tls_match_altsubject(X509 *cert, const char *match) 1711 { 1712 int type; 1713 const char *pos, *end; 1714 size_t len; 1715 1716 pos = match; 1717 do { 1718 if (os_strncmp(pos, "EMAIL:", 6) == 0) { 1719 type = GEN_EMAIL; 1720 pos += 6; 1721 } else if (os_strncmp(pos, "DNS:", 4) == 0) { 1722 type = GEN_DNS; 1723 pos += 4; 1724 } else if (os_strncmp(pos, "URI:", 4) == 0) { 1725 type = GEN_URI; 1726 pos += 4; 1727 } else { 1728 wpa_printf(MSG_INFO, "TLS: Invalid altSubjectName " 1729 "match '%s'", pos); 1730 return 0; 1731 } 1732 end = os_strchr(pos, ';'); 1733 while (end) { 1734 if (os_strncmp(end + 1, "EMAIL:", 6) == 0 || 1735 os_strncmp(end + 1, "DNS:", 4) == 0 || 1736 os_strncmp(end + 1, "URI:", 4) == 0) 1737 break; 1738 end = os_strchr(end + 1, ';'); 1739 } 1740 if (end) 1741 len = end - pos; 1742 else 1743 len = os_strlen(pos); 1744 if (tls_match_altsubject_component(cert, type, pos, len) > 0) 1745 return 1; 1746 pos = end + 1; 1747 } while (end); 1748 1749 return 0; 1750 } 1751 1752 1753 #ifndef CONFIG_NATIVE_WINDOWS 1754 static int domain_suffix_match(const u8 *val, size_t len, const char *match, 1755 size_t match_len, int full) 1756 { 1757 size_t i; 1758 1759 /* Check for embedded nuls that could mess up suffix matching */ 1760 for (i = 0; i < len; i++) { 1761 if (val[i] == '\0') { 1762 wpa_printf(MSG_DEBUG, "TLS: Embedded null in a string - reject"); 1763 return 0; 1764 } 1765 } 1766 1767 if (match_len > len || (full && match_len != len)) 1768 return 0; 1769 1770 if (os_strncasecmp((const char *) val + len - match_len, match, 1771 match_len) != 0) 1772 return 0; /* no match */ 1773 1774 if (match_len == len) 1775 return 1; /* exact match */ 1776 1777 if (val[len - match_len - 1] == '.') 1778 return 1; /* full label match completes suffix match */ 1779 1780 wpa_printf(MSG_DEBUG, "TLS: Reject due to incomplete label match"); 1781 return 0; 1782 } 1783 #endif /* CONFIG_NATIVE_WINDOWS */ 1784 1785 1786 struct tls_dn_field_order_cnt { 1787 u8 cn; 1788 u8 c; 1789 u8 l; 1790 u8 st; 1791 u8 o; 1792 u8 ou; 1793 u8 email; 1794 }; 1795 1796 1797 static int get_dn_field_index(const struct tls_dn_field_order_cnt *dn_cnt, 1798 int nid) 1799 { 1800 switch (nid) { 1801 case NID_commonName: 1802 return dn_cnt->cn; 1803 case NID_countryName: 1804 return dn_cnt->c; 1805 case NID_localityName: 1806 return dn_cnt->l; 1807 case NID_stateOrProvinceName: 1808 return dn_cnt->st; 1809 case NID_organizationName: 1810 return dn_cnt->o; 1811 case NID_organizationalUnitName: 1812 return dn_cnt->ou; 1813 case NID_pkcs9_emailAddress: 1814 return dn_cnt->email; 1815 default: 1816 wpa_printf(MSG_ERROR, 1817 "TLS: Unknown NID '%d' in check_cert_subject", 1818 nid); 1819 return -1; 1820 } 1821 } 1822 1823 1824 /** 1825 * match_dn_field - Match configuration DN field against Certificate DN field 1826 * @cert: Certificate 1827 * @nid: NID of DN field 1828 * @field: Field name 1829 * @value DN field value which is passed from configuration 1830 * e.g., if configuration have C=US and this argument will point to US. 1831 * @dn_cnt: DN matching context 1832 * Returns: 1 on success and 0 on failure 1833 */ 1834 static int match_dn_field(const X509 *cert, int nid, const char *field, 1835 const char *value, 1836 const struct tls_dn_field_order_cnt *dn_cnt) 1837 { 1838 int i, ret = 0, len, config_dn_field_index, match_index = 0; 1839 X509_NAME *name; 1840 1841 len = os_strlen(value); 1842 name = X509_get_subject_name((X509 *) cert); 1843 1844 /* Assign incremented cnt for every field of DN to check DN field in 1845 * right order */ 1846 config_dn_field_index = get_dn_field_index(dn_cnt, nid); 1847 if (config_dn_field_index < 0) 1848 return 0; 1849 1850 /* Fetch value based on NID */ 1851 for (i = -1; (i = X509_NAME_get_index_by_NID(name, nid, i)) > -1;) { 1852 X509_NAME_ENTRY *e; 1853 ASN1_STRING *cn; 1854 1855 e = X509_NAME_get_entry(name, i); 1856 if (!e) 1857 continue; 1858 1859 cn = X509_NAME_ENTRY_get_data(e); 1860 if (!cn) 1861 continue; 1862 1863 match_index++; 1864 1865 /* check for more than one DN field with same name */ 1866 if (match_index != config_dn_field_index) 1867 continue; 1868 1869 /* Check wildcard at the right end side */ 1870 /* E.g., if OU=develop* mentioned in configuration, allow 'OU' 1871 * of the subject in the client certificate to start with 1872 * 'develop' */ 1873 if (len > 0 && value[len - 1] == '*') { 1874 /* Compare actual certificate DN field value with 1875 * configuration DN field value up to the specified 1876 * length. */ 1877 ret = ASN1_STRING_length(cn) >= len - 1 && 1878 os_memcmp(ASN1_STRING_get0_data(cn), value, 1879 len - 1) == 0; 1880 } else { 1881 /* Compare actual certificate DN field value with 1882 * configuration DN field value */ 1883 ret = ASN1_STRING_length(cn) == len && 1884 os_memcmp(ASN1_STRING_get0_data(cn), value, 1885 len) == 0; 1886 } 1887 if (!ret) { 1888 wpa_printf(MSG_ERROR, 1889 "OpenSSL: Failed to match %s '%s' with certificate DN field value '%s'", 1890 field, value, ASN1_STRING_get0_data(cn)); 1891 } 1892 break; 1893 } 1894 1895 return ret; 1896 } 1897 1898 1899 /** 1900 * get_value_from_field - Get value from DN field 1901 * @cert: Certificate 1902 * @field_str: DN field string which is passed from configuration file (e.g., 1903 * C=US) 1904 * @dn_cnt: DN matching context 1905 * Returns: 1 on success and 0 on failure 1906 */ 1907 static int get_value_from_field(const X509 *cert, char *field_str, 1908 struct tls_dn_field_order_cnt *dn_cnt) 1909 { 1910 int nid; 1911 char *context = NULL, *name, *value; 1912 1913 if (os_strcmp(field_str, "*") == 0) 1914 return 1; /* wildcard matches everything */ 1915 1916 name = str_token(field_str, "=", &context); 1917 if (!name) 1918 return 0; 1919 1920 /* Compare all configured DN fields and assign nid based on that to 1921 * fetch correct value from certificate subject */ 1922 if (os_strcmp(name, "CN") == 0) { 1923 nid = NID_commonName; 1924 dn_cnt->cn++; 1925 } else if(os_strcmp(name, "C") == 0) { 1926 nid = NID_countryName; 1927 dn_cnt->c++; 1928 } else if (os_strcmp(name, "L") == 0) { 1929 nid = NID_localityName; 1930 dn_cnt->l++; 1931 } else if (os_strcmp(name, "ST") == 0) { 1932 nid = NID_stateOrProvinceName; 1933 dn_cnt->st++; 1934 } else if (os_strcmp(name, "O") == 0) { 1935 nid = NID_organizationName; 1936 dn_cnt->o++; 1937 } else if (os_strcmp(name, "OU") == 0) { 1938 nid = NID_organizationalUnitName; 1939 dn_cnt->ou++; 1940 } else if (os_strcmp(name, "emailAddress") == 0) { 1941 nid = NID_pkcs9_emailAddress; 1942 dn_cnt->email++; 1943 } else { 1944 wpa_printf(MSG_ERROR, 1945 "TLS: Unknown field '%s' in check_cert_subject", name); 1946 return 0; 1947 } 1948 1949 value = str_token(field_str, "=", &context); 1950 if (!value) { 1951 wpa_printf(MSG_ERROR, 1952 "TLS: Distinguished Name field '%s' value is not defined in check_cert_subject", 1953 name); 1954 return 0; 1955 } 1956 1957 return match_dn_field(cert, nid, name, value, dn_cnt); 1958 } 1959 1960 1961 /** 1962 * tls_match_dn_field - Match subject DN field with check_cert_subject 1963 * @cert: Certificate 1964 * @match: check_cert_subject string 1965 * Returns: Return 1 on success and 0 on failure 1966 */ 1967 static int tls_match_dn_field(X509 *cert, const char *match) 1968 { 1969 const char *token, *last = NULL; 1970 char field[256]; 1971 struct tls_dn_field_order_cnt dn_cnt; 1972 1973 os_memset(&dn_cnt, 0, sizeof(dn_cnt)); 1974 1975 /* Maximum length of each DN field is 255 characters */ 1976 1977 /* Process each '/' delimited field */ 1978 while ((token = cstr_token(match, "/", &last))) { 1979 if (last - token >= (int) sizeof(field)) { 1980 wpa_printf(MSG_ERROR, 1981 "OpenSSL: Too long DN matching field value in '%s'", 1982 match); 1983 return 0; 1984 } 1985 os_memcpy(field, token, last - token); 1986 field[last - token] = '\0'; 1987 1988 if (!get_value_from_field(cert, field, &dn_cnt)) { 1989 wpa_printf(MSG_DEBUG, "OpenSSL: No match for DN '%s'", 1990 field); 1991 return 0; 1992 } 1993 } 1994 1995 return 1; 1996 } 1997 1998 1999 #ifndef CONFIG_NATIVE_WINDOWS 2000 static int tls_match_suffix_helper(X509 *cert, const char *match, 2001 size_t match_len, int full) 2002 { 2003 GENERAL_NAME *gen; 2004 void *ext; 2005 int i; 2006 stack_index_t j; 2007 int dns_name = 0; 2008 X509_NAME *name; 2009 2010 wpa_printf(MSG_DEBUG, "TLS: Match domain against %s%s", 2011 full ? "": "suffix ", match); 2012 2013 ext = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL); 2014 2015 for (j = 0; ext && j < sk_GENERAL_NAME_num(ext); j++) { 2016 gen = sk_GENERAL_NAME_value(ext, j); 2017 if (gen->type != GEN_DNS) 2018 continue; 2019 dns_name++; 2020 wpa_hexdump_ascii(MSG_DEBUG, "TLS: Certificate dNSName", 2021 gen->d.dNSName->data, 2022 gen->d.dNSName->length); 2023 if (domain_suffix_match(gen->d.dNSName->data, 2024 gen->d.dNSName->length, 2025 match, match_len, full) == 1) { 2026 wpa_printf(MSG_DEBUG, "TLS: %s in dNSName found", 2027 full ? "Match" : "Suffix match"); 2028 sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free); 2029 return 1; 2030 } 2031 } 2032 sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free); 2033 2034 if (dns_name) { 2035 wpa_printf(MSG_DEBUG, "TLS: None of the dNSName(s) matched"); 2036 return 0; 2037 } 2038 2039 name = X509_get_subject_name(cert); 2040 i = -1; 2041 for (;;) { 2042 X509_NAME_ENTRY *e; 2043 ASN1_STRING *cn; 2044 2045 i = X509_NAME_get_index_by_NID(name, NID_commonName, i); 2046 if (i == -1) 2047 break; 2048 e = X509_NAME_get_entry(name, i); 2049 if (e == NULL) 2050 continue; 2051 cn = X509_NAME_ENTRY_get_data(e); 2052 if (cn == NULL) 2053 continue; 2054 wpa_hexdump_ascii(MSG_DEBUG, "TLS: Certificate commonName", 2055 cn->data, cn->length); 2056 if (domain_suffix_match(cn->data, cn->length, 2057 match, match_len, full) == 1) { 2058 wpa_printf(MSG_DEBUG, "TLS: %s in commonName found", 2059 full ? "Match" : "Suffix match"); 2060 return 1; 2061 } 2062 } 2063 2064 wpa_printf(MSG_DEBUG, "TLS: No CommonName %smatch found", 2065 full ? "": "suffix "); 2066 return 0; 2067 } 2068 #endif /* CONFIG_NATIVE_WINDOWS */ 2069 2070 2071 static int tls_match_suffix(X509 *cert, const char *match, int full) 2072 { 2073 #ifdef CONFIG_NATIVE_WINDOWS 2074 /* wincrypt.h has conflicting X509_NAME definition */ 2075 return -1; 2076 #else /* CONFIG_NATIVE_WINDOWS */ 2077 const char *token, *last = NULL; 2078 2079 /* Process each match alternative separately until a match is found */ 2080 while ((token = cstr_token(match, ";", &last))) { 2081 if (tls_match_suffix_helper(cert, token, last - token, full)) 2082 return 1; 2083 } 2084 2085 return 0; 2086 #endif /* CONFIG_NATIVE_WINDOWS */ 2087 } 2088 2089 2090 static enum tls_fail_reason openssl_tls_fail_reason(int err) 2091 { 2092 switch (err) { 2093 case X509_V_ERR_CERT_REVOKED: 2094 return TLS_FAIL_REVOKED; 2095 case X509_V_ERR_CERT_NOT_YET_VALID: 2096 case X509_V_ERR_CRL_NOT_YET_VALID: 2097 return TLS_FAIL_NOT_YET_VALID; 2098 case X509_V_ERR_CERT_HAS_EXPIRED: 2099 case X509_V_ERR_CRL_HAS_EXPIRED: 2100 return TLS_FAIL_EXPIRED; 2101 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT: 2102 case X509_V_ERR_UNABLE_TO_GET_CRL: 2103 case X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER: 2104 case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN: 2105 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY: 2106 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT: 2107 case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE: 2108 case X509_V_ERR_CERT_CHAIN_TOO_LONG: 2109 case X509_V_ERR_PATH_LENGTH_EXCEEDED: 2110 case X509_V_ERR_INVALID_CA: 2111 return TLS_FAIL_UNTRUSTED; 2112 case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE: 2113 case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE: 2114 case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY: 2115 case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD: 2116 case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD: 2117 case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD: 2118 case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD: 2119 case X509_V_ERR_CERT_UNTRUSTED: 2120 case X509_V_ERR_CERT_REJECTED: 2121 return TLS_FAIL_BAD_CERTIFICATE; 2122 default: 2123 return TLS_FAIL_UNSPECIFIED; 2124 } 2125 } 2126 2127 2128 static struct wpabuf * get_x509_cert(X509 *cert) 2129 { 2130 struct wpabuf *buf; 2131 u8 *tmp; 2132 2133 int cert_len = i2d_X509(cert, NULL); 2134 if (cert_len <= 0) 2135 return NULL; 2136 2137 buf = wpabuf_alloc(cert_len); 2138 if (buf == NULL) 2139 return NULL; 2140 2141 tmp = wpabuf_put(buf, cert_len); 2142 i2d_X509(cert, &tmp); 2143 return buf; 2144 } 2145 2146 2147 static void openssl_tls_fail_event(struct tls_connection *conn, 2148 X509 *err_cert, int err, int depth, 2149 const char *subject, const char *err_str, 2150 enum tls_fail_reason reason) 2151 { 2152 union tls_event_data ev; 2153 struct wpabuf *cert = NULL; 2154 struct tls_context *context = conn->context; 2155 2156 if (context->event_cb == NULL) 2157 return; 2158 2159 cert = get_x509_cert(err_cert); 2160 os_memset(&ev, 0, sizeof(ev)); 2161 ev.cert_fail.reason = reason != TLS_FAIL_UNSPECIFIED ? 2162 reason : openssl_tls_fail_reason(err); 2163 ev.cert_fail.depth = depth; 2164 ev.cert_fail.subject = subject; 2165 ev.cert_fail.reason_txt = err_str; 2166 ev.cert_fail.cert = cert; 2167 context->event_cb(context->cb_ctx, TLS_CERT_CHAIN_FAILURE, &ev); 2168 wpabuf_free(cert); 2169 } 2170 2171 2172 static int openssl_cert_tod(X509 *cert) 2173 { 2174 CERTIFICATEPOLICIES *ext; 2175 stack_index_t i; 2176 char buf[100]; 2177 int res; 2178 int tod = 0; 2179 2180 ext = X509_get_ext_d2i(cert, NID_certificate_policies, NULL, NULL); 2181 if (!ext) 2182 return 0; 2183 2184 for (i = 0; i < sk_POLICYINFO_num(ext); i++) { 2185 POLICYINFO *policy; 2186 2187 policy = sk_POLICYINFO_value(ext, i); 2188 res = OBJ_obj2txt(buf, sizeof(buf), policy->policyid, 0); 2189 if (res < 0 || (size_t) res >= sizeof(buf)) 2190 continue; 2191 wpa_printf(MSG_DEBUG, "OpenSSL: Certificate Policy %s", buf); 2192 if (os_strcmp(buf, "1.3.6.1.4.1.40808.1.3.1") == 0) 2193 tod = 1; /* TOD-STRICT */ 2194 else if (os_strcmp(buf, "1.3.6.1.4.1.40808.1.3.2") == 0 && !tod) 2195 tod = 2; /* TOD-TOFU */ 2196 } 2197 sk_POLICYINFO_pop_free(ext, POLICYINFO_free); 2198 2199 return tod; 2200 } 2201 2202 2203 static void openssl_tls_cert_event(struct tls_connection *conn, 2204 X509 *err_cert, int depth, 2205 const char *subject) 2206 { 2207 struct wpabuf *cert = NULL; 2208 union tls_event_data ev; 2209 struct tls_context *context = conn->context; 2210 char *altsubject[TLS_MAX_ALT_SUBJECT]; 2211 int alt, num_altsubject = 0; 2212 GENERAL_NAME *gen; 2213 void *ext; 2214 stack_index_t i; 2215 ASN1_INTEGER *ser; 2216 char serial_num[128]; 2217 #ifdef CONFIG_SHA256 2218 u8 hash[32]; 2219 #endif /* CONFIG_SHA256 */ 2220 2221 if (context->event_cb == NULL) 2222 return; 2223 2224 os_memset(&ev, 0, sizeof(ev)); 2225 if (conn->cert_probe || (conn->flags & TLS_CONN_EXT_CERT_CHECK) || 2226 context->cert_in_cb) { 2227 cert = get_x509_cert(err_cert); 2228 ev.peer_cert.cert = cert; 2229 } 2230 #ifdef CONFIG_SHA256 2231 if (cert) { 2232 const u8 *addr[1]; 2233 size_t len[1]; 2234 addr[0] = wpabuf_head(cert); 2235 len[0] = wpabuf_len(cert); 2236 if (sha256_vector(1, addr, len, hash) == 0) { 2237 ev.peer_cert.hash = hash; 2238 ev.peer_cert.hash_len = sizeof(hash); 2239 } 2240 } 2241 #endif /* CONFIG_SHA256 */ 2242 ev.peer_cert.depth = depth; 2243 ev.peer_cert.subject = subject; 2244 2245 ser = X509_get_serialNumber(err_cert); 2246 if (ser) { 2247 wpa_snprintf_hex_uppercase(serial_num, sizeof(serial_num), 2248 ASN1_STRING_get0_data(ser), 2249 ASN1_STRING_length(ser)); 2250 ev.peer_cert.serial_num = serial_num; 2251 } 2252 2253 ext = X509_get_ext_d2i(err_cert, NID_subject_alt_name, NULL, NULL); 2254 for (i = 0; ext && i < sk_GENERAL_NAME_num(ext); i++) { 2255 char *pos; 2256 2257 if (num_altsubject == TLS_MAX_ALT_SUBJECT) 2258 break; 2259 gen = sk_GENERAL_NAME_value(ext, i); 2260 if (gen->type != GEN_EMAIL && 2261 gen->type != GEN_DNS && 2262 gen->type != GEN_URI) 2263 continue; 2264 2265 pos = os_malloc(10 + gen->d.ia5->length + 1); 2266 if (pos == NULL) 2267 break; 2268 altsubject[num_altsubject++] = pos; 2269 2270 switch (gen->type) { 2271 case GEN_EMAIL: 2272 os_memcpy(pos, "EMAIL:", 6); 2273 pos += 6; 2274 break; 2275 case GEN_DNS: 2276 os_memcpy(pos, "DNS:", 4); 2277 pos += 4; 2278 break; 2279 case GEN_URI: 2280 os_memcpy(pos, "URI:", 4); 2281 pos += 4; 2282 break; 2283 } 2284 2285 os_memcpy(pos, gen->d.ia5->data, gen->d.ia5->length); 2286 pos += gen->d.ia5->length; 2287 *pos = '\0'; 2288 } 2289 sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free); 2290 2291 for (alt = 0; alt < num_altsubject; alt++) 2292 ev.peer_cert.altsubject[alt] = altsubject[alt]; 2293 ev.peer_cert.num_altsubject = num_altsubject; 2294 2295 ev.peer_cert.tod = openssl_cert_tod(err_cert); 2296 2297 context->event_cb(context->cb_ctx, TLS_PEER_CERTIFICATE, &ev); 2298 wpabuf_free(cert); 2299 for (alt = 0; alt < num_altsubject; alt++) 2300 os_free(altsubject[alt]); 2301 } 2302 2303 2304 static void debug_print_cert(X509 *cert, const char *title) 2305 { 2306 #ifndef CONFIG_NO_STDOUT_DEBUG 2307 BIO *out; 2308 size_t rlen; 2309 char *txt; 2310 int res; 2311 2312 if (wpa_debug_level > MSG_DEBUG) 2313 return; 2314 2315 out = BIO_new(BIO_s_mem()); 2316 if (!out) 2317 return; 2318 2319 X509_print(out, cert); 2320 rlen = BIO_ctrl_pending(out); 2321 txt = os_malloc(rlen + 1); 2322 if (txt) { 2323 res = BIO_read(out, txt, rlen); 2324 if (res > 0) { 2325 txt[res] = '\0'; 2326 wpa_printf(MSG_DEBUG, "OpenSSL: %s\n%s", title, txt); 2327 } 2328 os_free(txt); 2329 } 2330 2331 BIO_free(out); 2332 #endif /* CONFIG_NO_STDOUT_DEBUG */ 2333 } 2334 2335 2336 static int tls_verify_cb(int preverify_ok, X509_STORE_CTX *x509_ctx) 2337 { 2338 char buf[256]; 2339 X509 *err_cert; 2340 int err, depth; 2341 SSL *ssl; 2342 struct tls_connection *conn; 2343 struct tls_context *context; 2344 char *match, *altmatch, *suffix_match, *domain_match; 2345 const char *check_cert_subject; 2346 const char *err_str; 2347 2348 err_cert = X509_STORE_CTX_get_current_cert(x509_ctx); 2349 if (!err_cert) 2350 return 0; 2351 2352 err = X509_STORE_CTX_get_error(x509_ctx); 2353 depth = X509_STORE_CTX_get_error_depth(x509_ctx); 2354 ssl = X509_STORE_CTX_get_ex_data(x509_ctx, 2355 SSL_get_ex_data_X509_STORE_CTX_idx()); 2356 os_snprintf(buf, sizeof(buf), "Peer certificate - depth %d", depth); 2357 debug_print_cert(err_cert, buf); 2358 X509_NAME_oneline(X509_get_subject_name(err_cert), buf, sizeof(buf)); 2359 2360 conn = SSL_get_app_data(ssl); 2361 if (conn == NULL) 2362 return 0; 2363 2364 if (depth == 0) 2365 conn->peer_cert = err_cert; 2366 else if (depth == 1) 2367 conn->peer_issuer = err_cert; 2368 else if (depth == 2) 2369 conn->peer_issuer_issuer = err_cert; 2370 2371 context = conn->context; 2372 match = conn->subject_match; 2373 altmatch = conn->altsubject_match; 2374 suffix_match = conn->suffix_match; 2375 domain_match = conn->domain_match; 2376 2377 if (!preverify_ok && !conn->ca_cert_verify) 2378 preverify_ok = 1; 2379 if (!preverify_ok && depth > 0 && conn->server_cert_only) 2380 preverify_ok = 1; 2381 if (!preverify_ok && (conn->flags & TLS_CONN_DISABLE_TIME_CHECKS) && 2382 (err == X509_V_ERR_CERT_HAS_EXPIRED || 2383 err == X509_V_ERR_CERT_NOT_YET_VALID)) { 2384 wpa_printf(MSG_DEBUG, "OpenSSL: Ignore certificate validity " 2385 "time mismatch"); 2386 preverify_ok = 1; 2387 } 2388 if (!preverify_ok && !conn->data->check_crl_strict && 2389 (err == X509_V_ERR_CRL_HAS_EXPIRED || 2390 err == X509_V_ERR_CRL_NOT_YET_VALID)) { 2391 wpa_printf(MSG_DEBUG, 2392 "OpenSSL: Ignore certificate validity CRL time mismatch"); 2393 preverify_ok = 1; 2394 } 2395 2396 err_str = X509_verify_cert_error_string(err); 2397 2398 #ifdef CONFIG_SHA256 2399 /* 2400 * Do not require preverify_ok so we can explicity allow otherwise 2401 * invalid pinned server certificates. 2402 */ 2403 if (depth == 0 && conn->server_cert_only) { 2404 struct wpabuf *cert; 2405 cert = get_x509_cert(err_cert); 2406 if (!cert) { 2407 wpa_printf(MSG_DEBUG, "OpenSSL: Could not fetch " 2408 "server certificate data"); 2409 preverify_ok = 0; 2410 } else { 2411 u8 hash[32]; 2412 const u8 *addr[1]; 2413 size_t len[1]; 2414 addr[0] = wpabuf_head(cert); 2415 len[0] = wpabuf_len(cert); 2416 if (sha256_vector(1, addr, len, hash) < 0 || 2417 os_memcmp(conn->srv_cert_hash, hash, 32) != 0) { 2418 err_str = "Server certificate mismatch"; 2419 err = X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN; 2420 preverify_ok = 0; 2421 } else if (!preverify_ok) { 2422 /* 2423 * Certificate matches pinned certificate, allow 2424 * regardless of other problems. 2425 */ 2426 wpa_printf(MSG_DEBUG, 2427 "OpenSSL: Ignore validation issues for a pinned server certificate"); 2428 preverify_ok = 1; 2429 } 2430 wpabuf_free(cert); 2431 } 2432 } 2433 #endif /* CONFIG_SHA256 */ 2434 2435 openssl_tls_cert_event(conn, err_cert, depth, buf); 2436 2437 if (!preverify_ok) { 2438 if (depth > 0) { 2439 /* Send cert event for the peer certificate so that 2440 * the upper layers get information about it even if 2441 * validation of a CA certificate fails. */ 2442 STACK_OF(X509) *chain; 2443 2444 chain = X509_STORE_CTX_get1_chain(x509_ctx); 2445 if (chain && sk_X509_num(chain) > 0) { 2446 char buf2[256]; 2447 X509 *cert; 2448 2449 cert = sk_X509_value(chain, 0); 2450 X509_NAME_oneline(X509_get_subject_name(cert), 2451 buf2, sizeof(buf2)); 2452 2453 openssl_tls_cert_event(conn, cert, 0, buf2); 2454 } 2455 if (chain) 2456 sk_X509_pop_free(chain, X509_free); 2457 } 2458 2459 wpa_printf(MSG_WARNING, "TLS: Certificate verification failed," 2460 " error %d (%s) depth %d for '%s'", err, err_str, 2461 depth, buf); 2462 openssl_tls_fail_event(conn, err_cert, err, depth, buf, 2463 err_str, TLS_FAIL_UNSPECIFIED); 2464 return preverify_ok; 2465 } 2466 2467 wpa_printf(MSG_DEBUG, "TLS: tls_verify_cb - preverify_ok=%d " 2468 "err=%d (%s) ca_cert_verify=%d depth=%d buf='%s'", 2469 preverify_ok, err, err_str, 2470 conn->ca_cert_verify, depth, buf); 2471 check_cert_subject = conn->check_cert_subject; 2472 if (!check_cert_subject) 2473 check_cert_subject = conn->data->check_cert_subject; 2474 if (check_cert_subject) { 2475 if (depth == 0 && 2476 !tls_match_dn_field(err_cert, check_cert_subject)) { 2477 preverify_ok = 0; 2478 openssl_tls_fail_event(conn, err_cert, err, depth, buf, 2479 "Distinguished Name", 2480 TLS_FAIL_DN_MISMATCH); 2481 } 2482 } 2483 if (depth == 0 && match && os_strstr(buf, match) == NULL) { 2484 wpa_printf(MSG_WARNING, "TLS: Subject '%s' did not " 2485 "match with '%s'", buf, match); 2486 preverify_ok = 0; 2487 openssl_tls_fail_event(conn, err_cert, err, depth, buf, 2488 "Subject mismatch", 2489 TLS_FAIL_SUBJECT_MISMATCH); 2490 } else if (depth == 0 && altmatch && 2491 !tls_match_altsubject(err_cert, altmatch)) { 2492 wpa_printf(MSG_WARNING, "TLS: altSubjectName match " 2493 "'%s' not found", altmatch); 2494 preverify_ok = 0; 2495 openssl_tls_fail_event(conn, err_cert, err, depth, buf, 2496 "AltSubject mismatch", 2497 TLS_FAIL_ALTSUBJECT_MISMATCH); 2498 } else if (depth == 0 && suffix_match && 2499 !tls_match_suffix(err_cert, suffix_match, 0)) { 2500 wpa_printf(MSG_WARNING, "TLS: Domain suffix match '%s' not found", 2501 suffix_match); 2502 preverify_ok = 0; 2503 openssl_tls_fail_event(conn, err_cert, err, depth, buf, 2504 "Domain suffix mismatch", 2505 TLS_FAIL_DOMAIN_SUFFIX_MISMATCH); 2506 } else if (depth == 0 && domain_match && 2507 !tls_match_suffix(err_cert, domain_match, 1)) { 2508 wpa_printf(MSG_WARNING, "TLS: Domain match '%s' not found", 2509 domain_match); 2510 preverify_ok = 0; 2511 openssl_tls_fail_event(conn, err_cert, err, depth, buf, 2512 "Domain mismatch", 2513 TLS_FAIL_DOMAIN_MISMATCH); 2514 } 2515 2516 if (conn->cert_probe && preverify_ok && depth == 0) { 2517 wpa_printf(MSG_DEBUG, "OpenSSL: Reject server certificate " 2518 "on probe-only run"); 2519 preverify_ok = 0; 2520 openssl_tls_fail_event(conn, err_cert, err, depth, buf, 2521 "Server certificate chain probe", 2522 TLS_FAIL_SERVER_CHAIN_PROBE); 2523 } 2524 2525 #ifdef CONFIG_SUITEB 2526 if (conn->flags & TLS_CONN_SUITEB) { 2527 EVP_PKEY *pk; 2528 RSA *rsa; 2529 int len = -1; 2530 2531 pk = X509_get_pubkey(err_cert); 2532 if (pk) { 2533 rsa = EVP_PKEY_get1_RSA(pk); 2534 if (rsa) { 2535 len = RSA_bits(rsa); 2536 RSA_free(rsa); 2537 } 2538 EVP_PKEY_free(pk); 2539 } 2540 2541 if (len >= 0) { 2542 wpa_printf(MSG_DEBUG, 2543 "OpenSSL: RSA modulus size: %d bits", len); 2544 if (len < 3072) { 2545 preverify_ok = 0; 2546 openssl_tls_fail_event( 2547 conn, err_cert, err, 2548 depth, buf, 2549 "Insufficient RSA modulus size", 2550 TLS_FAIL_INSUFFICIENT_KEY_LEN); 2551 } 2552 } 2553 } 2554 #endif /* CONFIG_SUITEB */ 2555 2556 #ifdef OPENSSL_IS_BORINGSSL 2557 if (depth == 0 && (conn->flags & TLS_CONN_REQUEST_OCSP) && 2558 preverify_ok) { 2559 enum ocsp_result res; 2560 2561 res = check_ocsp_resp(conn->ssl_ctx, conn->ssl, err_cert, 2562 conn->peer_issuer, 2563 conn->peer_issuer_issuer); 2564 if (res == OCSP_REVOKED) { 2565 preverify_ok = 0; 2566 openssl_tls_fail_event(conn, err_cert, err, depth, buf, 2567 "certificate revoked", 2568 TLS_FAIL_REVOKED); 2569 if (err == X509_V_OK) 2570 X509_STORE_CTX_set_error( 2571 x509_ctx, X509_V_ERR_CERT_REVOKED); 2572 } else if (res != OCSP_GOOD && 2573 (conn->flags & TLS_CONN_REQUIRE_OCSP)) { 2574 preverify_ok = 0; 2575 openssl_tls_fail_event(conn, err_cert, err, depth, buf, 2576 "bad certificate status response", 2577 TLS_FAIL_UNSPECIFIED); 2578 } 2579 } 2580 #endif /* OPENSSL_IS_BORINGSSL */ 2581 2582 if (depth == 0 && preverify_ok && context->event_cb != NULL) 2583 context->event_cb(context->cb_ctx, 2584 TLS_CERT_CHAIN_SUCCESS, NULL); 2585 2586 if (depth == 0 && preverify_ok) { 2587 os_free(conn->peer_subject); 2588 conn->peer_subject = os_strdup(buf); 2589 } 2590 2591 return preverify_ok; 2592 } 2593 2594 2595 #ifndef OPENSSL_NO_STDIO 2596 static int tls_load_ca_der(struct tls_data *data, const char *ca_cert) 2597 { 2598 SSL_CTX *ssl_ctx = data->ssl; 2599 X509_LOOKUP *lookup; 2600 int ret = 0; 2601 2602 lookup = X509_STORE_add_lookup(SSL_CTX_get_cert_store(ssl_ctx), 2603 X509_LOOKUP_file()); 2604 if (lookup == NULL) { 2605 tls_show_errors(MSG_WARNING, __func__, 2606 "Failed add lookup for X509 store"); 2607 return -1; 2608 } 2609 2610 if (!X509_LOOKUP_load_file(lookup, ca_cert, X509_FILETYPE_ASN1)) { 2611 unsigned long err = ERR_peek_error(); 2612 tls_show_errors(MSG_WARNING, __func__, 2613 "Failed load CA in DER format"); 2614 if (ERR_GET_LIB(err) == ERR_LIB_X509 && 2615 ERR_GET_REASON(err) == X509_R_CERT_ALREADY_IN_HASH_TABLE) { 2616 wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring " 2617 "cert already in hash table error", 2618 __func__); 2619 } else 2620 ret = -1; 2621 } 2622 2623 return ret; 2624 } 2625 #endif /* OPENSSL_NO_STDIO */ 2626 2627 2628 static int tls_connection_ca_cert(struct tls_data *data, 2629 struct tls_connection *conn, 2630 const char *ca_cert, const u8 *ca_cert_blob, 2631 size_t ca_cert_blob_len, const char *ca_path) 2632 { 2633 SSL_CTX *ssl_ctx = data->ssl; 2634 X509_STORE *store; 2635 2636 /* 2637 * Remove previously configured trusted CA certificates before adding 2638 * new ones. 2639 */ 2640 store = X509_STORE_new(); 2641 if (store == NULL) { 2642 wpa_printf(MSG_DEBUG, "OpenSSL: %s - failed to allocate new " 2643 "certificate store", __func__); 2644 return -1; 2645 } 2646 SSL_CTX_set_cert_store(ssl_ctx, store); 2647 2648 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb); 2649 conn->ca_cert_verify = 1; 2650 2651 if (ca_cert && os_strncmp(ca_cert, "probe://", 8) == 0) { 2652 wpa_printf(MSG_DEBUG, "OpenSSL: Probe for server certificate " 2653 "chain"); 2654 conn->cert_probe = 1; 2655 conn->ca_cert_verify = 0; 2656 return 0; 2657 } 2658 2659 if (ca_cert && os_strncmp(ca_cert, "hash://", 7) == 0) { 2660 #ifdef CONFIG_SHA256 2661 const char *pos = ca_cert + 7; 2662 if (os_strncmp(pos, "server/sha256/", 14) != 0) { 2663 wpa_printf(MSG_DEBUG, "OpenSSL: Unsupported ca_cert " 2664 "hash value '%s'", ca_cert); 2665 return -1; 2666 } 2667 pos += 14; 2668 if (os_strlen(pos) != 32 * 2) { 2669 wpa_printf(MSG_DEBUG, "OpenSSL: Unexpected SHA256 " 2670 "hash length in ca_cert '%s'", ca_cert); 2671 return -1; 2672 } 2673 if (hexstr2bin(pos, conn->srv_cert_hash, 32) < 0) { 2674 wpa_printf(MSG_DEBUG, "OpenSSL: Invalid SHA256 hash " 2675 "value in ca_cert '%s'", ca_cert); 2676 return -1; 2677 } 2678 conn->server_cert_only = 1; 2679 wpa_printf(MSG_DEBUG, "OpenSSL: Checking only server " 2680 "certificate match"); 2681 return 0; 2682 #else /* CONFIG_SHA256 */ 2683 wpa_printf(MSG_INFO, "No SHA256 included in the build - " 2684 "cannot validate server certificate hash"); 2685 return -1; 2686 #endif /* CONFIG_SHA256 */ 2687 } 2688 2689 if (ca_cert_blob) { 2690 X509 *cert = d2i_X509(NULL, 2691 (const unsigned char **) &ca_cert_blob, 2692 ca_cert_blob_len); 2693 if (cert == NULL) { 2694 BIO *bio = BIO_new_mem_buf(ca_cert_blob, 2695 ca_cert_blob_len); 2696 2697 if (bio) { 2698 cert = PEM_read_bio_X509(bio, NULL, NULL, NULL); 2699 BIO_free(bio); 2700 } 2701 2702 if (!cert) { 2703 tls_show_errors(MSG_WARNING, __func__, 2704 "Failed to parse ca_cert_blob"); 2705 return -1; 2706 } 2707 2708 while (ERR_get_error()) { 2709 /* Ignore errors from DER conversion. */ 2710 } 2711 } 2712 2713 if (!X509_STORE_add_cert(SSL_CTX_get_cert_store(ssl_ctx), 2714 cert)) { 2715 unsigned long err = ERR_peek_error(); 2716 tls_show_errors(MSG_WARNING, __func__, 2717 "Failed to add ca_cert_blob to " 2718 "certificate store"); 2719 if (ERR_GET_LIB(err) == ERR_LIB_X509 && 2720 ERR_GET_REASON(err) == 2721 X509_R_CERT_ALREADY_IN_HASH_TABLE) { 2722 wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring " 2723 "cert already in hash table error", 2724 __func__); 2725 } else { 2726 X509_free(cert); 2727 return -1; 2728 } 2729 } 2730 X509_free(cert); 2731 wpa_printf(MSG_DEBUG, "OpenSSL: %s - added ca_cert_blob " 2732 "to certificate store", __func__); 2733 return 0; 2734 } 2735 2736 #ifdef ANDROID 2737 /* Single alias */ 2738 if (ca_cert && os_strncmp("keystore://", ca_cert, 11) == 0) { 2739 if (tls_add_ca_from_keystore(SSL_CTX_get_cert_store(ssl_ctx), 2740 &ca_cert[11]) < 0) 2741 return -1; 2742 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb); 2743 return 0; 2744 } 2745 2746 /* Multiple aliases separated by space */ 2747 if (ca_cert && os_strncmp("keystores://", ca_cert, 12) == 0) { 2748 char *aliases = os_strdup(&ca_cert[12]); 2749 const char *delim = " "; 2750 int rc = 0; 2751 char *savedptr; 2752 char *alias; 2753 2754 if (!aliases) 2755 return -1; 2756 alias = strtok_r(aliases, delim, &savedptr); 2757 for (; alias; alias = strtok_r(NULL, delim, &savedptr)) { 2758 if (tls_add_ca_from_keystore_encoded( 2759 SSL_CTX_get_cert_store(ssl_ctx), alias)) { 2760 wpa_printf(MSG_WARNING, 2761 "OpenSSL: %s - Failed to add ca_cert %s from keystore", 2762 __func__, alias); 2763 rc = -1; 2764 break; 2765 } 2766 } 2767 os_free(aliases); 2768 if (rc) 2769 return rc; 2770 2771 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb); 2772 return 0; 2773 } 2774 #endif /* ANDROID */ 2775 2776 #ifdef CONFIG_NATIVE_WINDOWS 2777 if (ca_cert && tls_cryptoapi_ca_cert(ssl_ctx, conn->ssl, ca_cert) == 2778 0) { 2779 wpa_printf(MSG_DEBUG, "OpenSSL: Added CA certificates from " 2780 "system certificate store"); 2781 return 0; 2782 } 2783 #endif /* CONFIG_NATIVE_WINDOWS */ 2784 2785 if (ca_cert || ca_path) { 2786 #ifndef OPENSSL_NO_STDIO 2787 if (SSL_CTX_load_verify_locations(ssl_ctx, ca_cert, ca_path) != 2788 1) { 2789 tls_show_errors(MSG_WARNING, __func__, 2790 "Failed to load root certificates"); 2791 if (ca_cert && 2792 tls_load_ca_der(data, ca_cert) == 0) { 2793 wpa_printf(MSG_DEBUG, "OpenSSL: %s - loaded " 2794 "DER format CA certificate", 2795 __func__); 2796 } else 2797 return -1; 2798 } else { 2799 wpa_printf(MSG_DEBUG, "TLS: Trusted root " 2800 "certificate(s) loaded"); 2801 tls_get_errors(data); 2802 } 2803 #else /* OPENSSL_NO_STDIO */ 2804 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", 2805 __func__); 2806 return -1; 2807 #endif /* OPENSSL_NO_STDIO */ 2808 } else { 2809 /* No ca_cert configured - do not try to verify server 2810 * certificate */ 2811 conn->ca_cert_verify = 0; 2812 } 2813 2814 return 0; 2815 } 2816 2817 2818 static int tls_global_ca_cert(struct tls_data *data, const char *ca_cert) 2819 { 2820 SSL_CTX *ssl_ctx = data->ssl; 2821 2822 if (ca_cert) { 2823 if (SSL_CTX_load_verify_locations(ssl_ctx, ca_cert, NULL) != 1) 2824 { 2825 tls_show_errors(MSG_WARNING, __func__, 2826 "Failed to load root certificates"); 2827 return -1; 2828 } 2829 2830 wpa_printf(MSG_DEBUG, "TLS: Trusted root " 2831 "certificate(s) loaded"); 2832 2833 #ifndef OPENSSL_NO_STDIO 2834 /* Add the same CAs to the client certificate requests */ 2835 SSL_CTX_set_client_CA_list(ssl_ctx, 2836 SSL_load_client_CA_file(ca_cert)); 2837 #endif /* OPENSSL_NO_STDIO */ 2838 2839 os_free(data->ca_cert); 2840 data->ca_cert = os_strdup(ca_cert); 2841 } 2842 2843 return 0; 2844 } 2845 2846 2847 int tls_global_set_verify(void *ssl_ctx, int check_crl, int strict) 2848 { 2849 int flags; 2850 2851 if (check_crl) { 2852 struct tls_data *data = ssl_ctx; 2853 X509_STORE *cs = SSL_CTX_get_cert_store(data->ssl); 2854 if (cs == NULL) { 2855 tls_show_errors(MSG_INFO, __func__, "Failed to get " 2856 "certificate store when enabling " 2857 "check_crl"); 2858 return -1; 2859 } 2860 flags = X509_V_FLAG_CRL_CHECK; 2861 if (check_crl == 2) 2862 flags |= X509_V_FLAG_CRL_CHECK_ALL; 2863 X509_STORE_set_flags(cs, flags); 2864 2865 data->check_crl = check_crl; 2866 data->check_crl_strict = strict; 2867 os_get_reltime(&data->crl_last_reload); 2868 } 2869 return 0; 2870 } 2871 2872 2873 static int tls_connection_set_subject_match(struct tls_connection *conn, 2874 const char *subject_match, 2875 const char *altsubject_match, 2876 const char *suffix_match, 2877 const char *domain_match, 2878 const char *check_cert_subject) 2879 { 2880 os_free(conn->subject_match); 2881 conn->subject_match = NULL; 2882 if (subject_match) { 2883 conn->subject_match = os_strdup(subject_match); 2884 if (conn->subject_match == NULL) 2885 return -1; 2886 } 2887 2888 os_free(conn->altsubject_match); 2889 conn->altsubject_match = NULL; 2890 if (altsubject_match) { 2891 conn->altsubject_match = os_strdup(altsubject_match); 2892 if (conn->altsubject_match == NULL) 2893 return -1; 2894 } 2895 2896 os_free(conn->suffix_match); 2897 conn->suffix_match = NULL; 2898 if (suffix_match) { 2899 conn->suffix_match = os_strdup(suffix_match); 2900 if (conn->suffix_match == NULL) 2901 return -1; 2902 } 2903 2904 os_free(conn->domain_match); 2905 conn->domain_match = NULL; 2906 if (domain_match) { 2907 conn->domain_match = os_strdup(domain_match); 2908 if (conn->domain_match == NULL) 2909 return -1; 2910 } 2911 2912 os_free(conn->check_cert_subject); 2913 conn->check_cert_subject = NULL; 2914 if (check_cert_subject) { 2915 conn->check_cert_subject = os_strdup(check_cert_subject); 2916 if (!conn->check_cert_subject) 2917 return -1; 2918 } 2919 2920 return 0; 2921 } 2922 2923 2924 #ifdef CONFIG_SUITEB 2925 #if OPENSSL_VERSION_NUMBER >= 0x10002000L 2926 static int suiteb_cert_cb(SSL *ssl, void *arg) 2927 { 2928 struct tls_connection *conn = arg; 2929 2930 /* 2931 * This cert_cb() is not really the best location for doing a 2932 * constraint check for the ServerKeyExchange message, but this seems to 2933 * be the only place where the current OpenSSL sequence can be 2934 * terminated cleanly with an TLS alert going out to the server. 2935 */ 2936 2937 if (!(conn->flags & TLS_CONN_SUITEB)) 2938 return 1; 2939 2940 /* DHE is enabled only with DHE-RSA-AES256-GCM-SHA384 */ 2941 if (conn->cipher_suite != 0x9f) 2942 return 1; 2943 2944 if (conn->server_dh_prime_len >= 3072) 2945 return 1; 2946 2947 wpa_printf(MSG_DEBUG, 2948 "OpenSSL: Server DH prime length (%d bits) not sufficient for Suite B RSA - reject handshake", 2949 conn->server_dh_prime_len); 2950 return 0; 2951 } 2952 #endif /* OPENSSL_VERSION_NUMBER */ 2953 #endif /* CONFIG_SUITEB */ 2954 2955 2956 static int tls_set_conn_flags(struct tls_connection *conn, unsigned int flags, 2957 const char *openssl_ciphers) 2958 { 2959 SSL *ssl = conn->ssl; 2960 2961 #ifdef SSL_OP_NO_TICKET 2962 if (flags & TLS_CONN_DISABLE_SESSION_TICKET) 2963 SSL_set_options(ssl, SSL_OP_NO_TICKET); 2964 else 2965 SSL_clear_options(ssl, SSL_OP_NO_TICKET); 2966 #endif /* SSL_OP_NO_TICKET */ 2967 2968 #ifdef SSL_OP_NO_TLSv1 2969 if (flags & TLS_CONN_DISABLE_TLSv1_0) 2970 SSL_set_options(ssl, SSL_OP_NO_TLSv1); 2971 else 2972 SSL_clear_options(ssl, SSL_OP_NO_TLSv1); 2973 #endif /* SSL_OP_NO_TLSv1 */ 2974 #ifdef SSL_OP_NO_TLSv1_1 2975 if (flags & TLS_CONN_DISABLE_TLSv1_1) 2976 SSL_set_options(ssl, SSL_OP_NO_TLSv1_1); 2977 else 2978 SSL_clear_options(ssl, SSL_OP_NO_TLSv1_1); 2979 #endif /* SSL_OP_NO_TLSv1_1 */ 2980 #ifdef SSL_OP_NO_TLSv1_2 2981 if (flags & TLS_CONN_DISABLE_TLSv1_2) 2982 SSL_set_options(ssl, SSL_OP_NO_TLSv1_2); 2983 else 2984 SSL_clear_options(ssl, SSL_OP_NO_TLSv1_2); 2985 #endif /* SSL_OP_NO_TLSv1_2 */ 2986 #ifdef SSL_OP_NO_TLSv1_3 2987 if (flags & TLS_CONN_DISABLE_TLSv1_3) 2988 SSL_set_options(ssl, SSL_OP_NO_TLSv1_3); 2989 else 2990 SSL_clear_options(ssl, SSL_OP_NO_TLSv1_3); 2991 #endif /* SSL_OP_NO_TLSv1_3 */ 2992 #if OPENSSL_VERSION_NUMBER >= 0x10100000L 2993 if (flags & (TLS_CONN_ENABLE_TLSv1_0 | 2994 TLS_CONN_ENABLE_TLSv1_1 | 2995 TLS_CONN_ENABLE_TLSv1_2)) { 2996 int version = 0; 2997 2998 /* Explicit request to enable TLS versions even if needing to 2999 * override systemwide policies. */ 3000 if (flags & TLS_CONN_ENABLE_TLSv1_0) 3001 version = TLS1_VERSION; 3002 else if (flags & TLS_CONN_ENABLE_TLSv1_1) 3003 version = TLS1_1_VERSION; 3004 else if (flags & TLS_CONN_ENABLE_TLSv1_2) 3005 version = TLS1_2_VERSION; 3006 if (!version) { 3007 wpa_printf(MSG_DEBUG, 3008 "OpenSSL: Invalid TLS version configuration"); 3009 return -1; 3010 } 3011 3012 if (SSL_set_min_proto_version(ssl, version) != 1) { 3013 wpa_printf(MSG_DEBUG, 3014 "OpenSSL: Failed to set minimum TLS version"); 3015 return -1; 3016 } 3017 } 3018 #endif /* >= 1.1.0 */ 3019 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && \ 3020 !defined(LIBRESSL_VERSION_NUMBER) && \ 3021 !defined(OPENSSL_IS_BORINGSSL) 3022 if ((flags & (TLS_CONN_ENABLE_TLSv1_0 | TLS_CONN_ENABLE_TLSv1_1)) && 3023 SSL_get_security_level(ssl) >= 2) { 3024 /* 3025 * Need to drop to security level 1 to allow TLS versions older 3026 * than 1.2 to be used when explicitly enabled in configuration. 3027 */ 3028 SSL_set_security_level(conn->ssl, 1); 3029 } 3030 #endif 3031 3032 #ifdef CONFIG_SUITEB 3033 #ifdef OPENSSL_IS_BORINGSSL 3034 /* Start with defaults from BoringSSL */ 3035 SSL_CTX_set_verify_algorithm_prefs(conn->ssl_ctx, NULL, 0); 3036 #endif /* OPENSSL_IS_BORINGSSL */ 3037 #if OPENSSL_VERSION_NUMBER >= 0x10002000L 3038 if (flags & TLS_CONN_SUITEB_NO_ECDH) { 3039 const char *ciphers = "DHE-RSA-AES256-GCM-SHA384"; 3040 3041 if (openssl_ciphers) { 3042 wpa_printf(MSG_DEBUG, 3043 "OpenSSL: Override ciphers for Suite B (no ECDH): %s", 3044 openssl_ciphers); 3045 ciphers = openssl_ciphers; 3046 } 3047 if (SSL_set_cipher_list(ssl, ciphers) != 1) { 3048 wpa_printf(MSG_INFO, 3049 "OpenSSL: Failed to set Suite B ciphers"); 3050 return -1; 3051 } 3052 } else if (flags & TLS_CONN_SUITEB) { 3053 EC_KEY *ecdh; 3054 const char *ciphers = 3055 "ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384"; 3056 int nid[1] = { NID_secp384r1 }; 3057 3058 if (openssl_ciphers) { 3059 wpa_printf(MSG_DEBUG, 3060 "OpenSSL: Override ciphers for Suite B: %s", 3061 openssl_ciphers); 3062 ciphers = openssl_ciphers; 3063 } 3064 if (SSL_set_cipher_list(ssl, ciphers) != 1) { 3065 wpa_printf(MSG_INFO, 3066 "OpenSSL: Failed to set Suite B ciphers"); 3067 return -1; 3068 } 3069 3070 if (SSL_set1_curves(ssl, nid, 1) != 1) { 3071 wpa_printf(MSG_INFO, 3072 "OpenSSL: Failed to set Suite B curves"); 3073 return -1; 3074 } 3075 3076 ecdh = EC_KEY_new_by_curve_name(NID_secp384r1); 3077 if (!ecdh || SSL_set_tmp_ecdh(ssl, ecdh) != 1) { 3078 EC_KEY_free(ecdh); 3079 wpa_printf(MSG_INFO, 3080 "OpenSSL: Failed to set ECDH parameter"); 3081 return -1; 3082 } 3083 EC_KEY_free(ecdh); 3084 } 3085 if (flags & (TLS_CONN_SUITEB | TLS_CONN_SUITEB_NO_ECDH)) { 3086 #ifdef OPENSSL_IS_BORINGSSL 3087 uint16_t sigalgs[1] = { SSL_SIGN_RSA_PKCS1_SHA384 }; 3088 3089 if (SSL_CTX_set_verify_algorithm_prefs(conn->ssl_ctx, sigalgs, 3090 1) != 1) { 3091 wpa_printf(MSG_INFO, 3092 "OpenSSL: Failed to set Suite B sigalgs"); 3093 return -1; 3094 } 3095 #else /* OPENSSL_IS_BORINGSSL */ 3096 /* ECDSA+SHA384 if need to add EC support here */ 3097 if (SSL_set1_sigalgs_list(ssl, "RSA+SHA384") != 1) { 3098 wpa_printf(MSG_INFO, 3099 "OpenSSL: Failed to set Suite B sigalgs"); 3100 return -1; 3101 } 3102 #endif /* OPENSSL_IS_BORINGSSL */ 3103 3104 SSL_set_options(ssl, SSL_OP_NO_TLSv1); 3105 SSL_set_options(ssl, SSL_OP_NO_TLSv1_1); 3106 SSL_set_cert_cb(ssl, suiteb_cert_cb, conn); 3107 } 3108 #else /* OPENSSL_VERSION_NUMBER < 0x10002000L */ 3109 if (flags & (TLS_CONN_SUITEB | TLS_CONN_SUITEB_NO_ECDH)) { 3110 wpa_printf(MSG_ERROR, 3111 "OpenSSL: Suite B RSA case not supported with this OpenSSL version"); 3112 return -1; 3113 } 3114 #endif /* OPENSSL_VERSION_NUMBER */ 3115 3116 #ifdef OPENSSL_IS_BORINGSSL 3117 if (openssl_ciphers && os_strcmp(openssl_ciphers, "SUITEB192") == 0) { 3118 uint16_t sigalgs[1] = { SSL_SIGN_ECDSA_SECP384R1_SHA384 }; 3119 int nid[1] = { NID_secp384r1 }; 3120 3121 if (SSL_set1_curves(ssl, nid, 1) != 1) { 3122 wpa_printf(MSG_INFO, 3123 "OpenSSL: Failed to set Suite B curves"); 3124 return -1; 3125 } 3126 3127 if (SSL_CTX_set_verify_algorithm_prefs(conn->ssl_ctx, sigalgs, 3128 1) != 1) { 3129 wpa_printf(MSG_INFO, 3130 "OpenSSL: Failed to set Suite B sigalgs"); 3131 return -1; 3132 } 3133 } 3134 #else /* OPENSSL_IS_BORINGSSL */ 3135 if (!(flags & (TLS_CONN_SUITEB | TLS_CONN_SUITEB_NO_ECDH)) && 3136 openssl_ciphers && SSL_set_cipher_list(ssl, openssl_ciphers) != 1) { 3137 wpa_printf(MSG_INFO, 3138 "OpenSSL: Failed to set openssl_ciphers '%s'", 3139 openssl_ciphers); 3140 return -1; 3141 } 3142 #endif /* OPENSSL_IS_BORINGSSL */ 3143 #else /* CONFIG_SUITEB */ 3144 if (openssl_ciphers && SSL_set_cipher_list(ssl, openssl_ciphers) != 1) { 3145 wpa_printf(MSG_INFO, 3146 "OpenSSL: Failed to set openssl_ciphers '%s'", 3147 openssl_ciphers); 3148 return -1; 3149 } 3150 #endif /* CONFIG_SUITEB */ 3151 3152 if (flags & TLS_CONN_TEAP_ANON_DH) { 3153 #ifndef TEAP_DH_ANON_CS 3154 #define TEAP_DH_ANON_CS \ 3155 "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:" \ 3156 "ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:" \ 3157 "ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:" \ 3158 "DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:" \ 3159 "DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:" \ 3160 "DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:" \ 3161 "ADH-AES256-GCM-SHA384:ADH-AES128-GCM-SHA256:" \ 3162 "ADH-AES256-SHA256:ADH-AES128-SHA256:ADH-AES256-SHA:ADH-AES128-SHA" 3163 #endif 3164 static const char *cs = TEAP_DH_ANON_CS; 3165 3166 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && \ 3167 !defined(LIBRESSL_VERSION_NUMBER) && \ 3168 !defined(OPENSSL_IS_BORINGSSL) 3169 /* 3170 * Need to drop to security level 0 to allow anonymous 3171 * cipher suites for EAP-TEAP. 3172 */ 3173 SSL_set_security_level(conn->ssl, 0); 3174 #endif 3175 3176 wpa_printf(MSG_DEBUG, 3177 "OpenSSL: Enable cipher suites for anonymous EAP-TEAP provisioning: %s", 3178 cs); 3179 if (SSL_set_cipher_list(conn->ssl, cs) != 1) { 3180 tls_show_errors(MSG_INFO, __func__, 3181 "Cipher suite configuration failed"); 3182 return -1; 3183 } 3184 } 3185 3186 return 0; 3187 } 3188 3189 3190 int tls_connection_set_verify(void *ssl_ctx, struct tls_connection *conn, 3191 int verify_peer, unsigned int flags, 3192 const u8 *session_ctx, size_t session_ctx_len) 3193 { 3194 static int counter = 0; 3195 struct tls_data *data = ssl_ctx; 3196 3197 if (conn == NULL) 3198 return -1; 3199 3200 if (verify_peer == 2) { 3201 conn->ca_cert_verify = 1; 3202 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER | 3203 SSL_VERIFY_CLIENT_ONCE, tls_verify_cb); 3204 } else if (verify_peer) { 3205 conn->ca_cert_verify = 1; 3206 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER | 3207 SSL_VERIFY_FAIL_IF_NO_PEER_CERT | 3208 SSL_VERIFY_CLIENT_ONCE, tls_verify_cb); 3209 } else { 3210 conn->ca_cert_verify = 0; 3211 SSL_set_verify(conn->ssl, SSL_VERIFY_NONE, NULL); 3212 } 3213 3214 if (tls_set_conn_flags(conn, flags, NULL) < 0) 3215 return -1; 3216 conn->flags = flags; 3217 3218 SSL_set_accept_state(conn->ssl); 3219 3220 if (data->tls_session_lifetime == 0) { 3221 /* 3222 * Set session id context to a unique value to make sure 3223 * session resumption cannot be used either through session 3224 * caching or TLS ticket extension. 3225 */ 3226 counter++; 3227 SSL_set_session_id_context(conn->ssl, 3228 (const unsigned char *) &counter, 3229 sizeof(counter)); 3230 } else if (session_ctx) { 3231 SSL_set_session_id_context(conn->ssl, session_ctx, 3232 session_ctx_len); 3233 } 3234 3235 return 0; 3236 } 3237 3238 3239 static int tls_connection_client_cert(struct tls_connection *conn, 3240 const char *client_cert, 3241 const u8 *client_cert_blob, 3242 size_t client_cert_blob_len) 3243 { 3244 if (client_cert == NULL && client_cert_blob == NULL) 3245 return 0; 3246 3247 #ifdef PKCS12_FUNCS 3248 #if OPENSSL_VERSION_NUMBER < 0x10002000L || defined(LIBRESSL_VERSION_NUMBER) 3249 /* 3250 * Clear previously set extra chain certificates, if any, from PKCS#12 3251 * processing in tls_parse_pkcs12() to allow OpenSSL to build a new 3252 * chain properly. 3253 */ 3254 SSL_CTX_clear_extra_chain_certs(conn->ssl_ctx); 3255 #endif /* OPENSSL_VERSION_NUMBER < 0x10002000L */ 3256 #endif /* PKCS12_FUNCS */ 3257 3258 if (client_cert_blob && 3259 SSL_use_certificate_ASN1(conn->ssl, (u8 *) client_cert_blob, 3260 client_cert_blob_len) == 1) { 3261 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_ASN1 --> " 3262 "OK"); 3263 return 0; 3264 } else if (client_cert_blob) { 3265 #if defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x20901000L 3266 tls_show_errors(MSG_DEBUG, __func__, 3267 "SSL_use_certificate_ASN1 failed"); 3268 #else 3269 BIO *bio; 3270 X509 *x509; 3271 3272 tls_show_errors(MSG_DEBUG, __func__, 3273 "SSL_use_certificate_ASN1 failed"); 3274 bio = BIO_new(BIO_s_mem()); 3275 if (!bio) 3276 return -1; 3277 BIO_write(bio, client_cert_blob, client_cert_blob_len); 3278 x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL); 3279 if (!x509 || SSL_use_certificate(conn->ssl, x509) != 1) { 3280 X509_free(x509); 3281 BIO_free(bio); 3282 return -1; 3283 } 3284 X509_free(x509); 3285 wpa_printf(MSG_DEBUG, 3286 "OpenSSL: Found PEM encoded certificate from blob"); 3287 while ((x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL))) { 3288 wpa_printf(MSG_DEBUG, 3289 "OpenSSL: Added an additional certificate into the chain"); 3290 SSL_add0_chain_cert(conn->ssl, x509); 3291 } 3292 BIO_free(bio); 3293 return 0; 3294 #endif 3295 } 3296 3297 if (client_cert == NULL) 3298 return -1; 3299 3300 #ifdef ANDROID 3301 if (os_strncmp("keystore://", client_cert, 11) == 0) { 3302 BIO *bio = BIO_from_keystore(&client_cert[11]); 3303 X509 *x509 = NULL; 3304 int ret = -1; 3305 if (bio) { 3306 x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL); 3307 } 3308 if (x509) { 3309 if (SSL_use_certificate(conn->ssl, x509) == 1) 3310 ret = 0; 3311 X509_free(x509); 3312 } 3313 3314 /* Read additional certificates into the chain. */ 3315 while (bio) { 3316 x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL); 3317 if (x509) { 3318 /* Takes ownership of x509 */ 3319 SSL_add0_chain_cert(conn->ssl, x509); 3320 } else { 3321 BIO_free(bio); 3322 bio = NULL; 3323 } 3324 } 3325 return ret; 3326 } 3327 #endif /* ANDROID */ 3328 3329 #ifndef OPENSSL_NO_STDIO 3330 if (SSL_use_certificate_file(conn->ssl, client_cert, 3331 SSL_FILETYPE_ASN1) == 1) { 3332 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_file (DER)" 3333 " --> OK"); 3334 return 0; 3335 } 3336 3337 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && \ 3338 !defined(LIBRESSL_VERSION_NUMBER) && !defined(OPENSSL_IS_BORINGSSL) 3339 if (SSL_use_certificate_chain_file(conn->ssl, client_cert) == 1) { 3340 ERR_clear_error(); 3341 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_chain_file" 3342 " --> OK"); 3343 return 0; 3344 } 3345 #else 3346 if (SSL_use_certificate_file(conn->ssl, client_cert, 3347 SSL_FILETYPE_PEM) == 1) { 3348 ERR_clear_error(); 3349 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_file (PEM)" 3350 " --> OK"); 3351 return 0; 3352 } 3353 #endif 3354 3355 tls_show_errors(MSG_DEBUG, __func__, 3356 "SSL_use_certificate_file failed"); 3357 #else /* OPENSSL_NO_STDIO */ 3358 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", __func__); 3359 #endif /* OPENSSL_NO_STDIO */ 3360 3361 return -1; 3362 } 3363 3364 3365 static int tls_global_client_cert(struct tls_data *data, 3366 const char *client_cert) 3367 { 3368 #ifndef OPENSSL_NO_STDIO 3369 SSL_CTX *ssl_ctx = data->ssl; 3370 3371 if (client_cert == NULL) 3372 return 0; 3373 3374 if (SSL_CTX_use_certificate_file(ssl_ctx, client_cert, 3375 SSL_FILETYPE_ASN1) != 1 && 3376 SSL_CTX_use_certificate_chain_file(ssl_ctx, client_cert) != 1 && 3377 SSL_CTX_use_certificate_file(ssl_ctx, client_cert, 3378 SSL_FILETYPE_PEM) != 1) { 3379 tls_show_errors(MSG_INFO, __func__, 3380 "Failed to load client certificate"); 3381 return -1; 3382 } 3383 return 0; 3384 #else /* OPENSSL_NO_STDIO */ 3385 if (client_cert == NULL) 3386 return 0; 3387 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", __func__); 3388 return -1; 3389 #endif /* OPENSSL_NO_STDIO */ 3390 } 3391 3392 3393 #ifdef PKCS12_FUNCS 3394 static int tls_parse_pkcs12(struct tls_data *data, SSL *ssl, PKCS12 *p12, 3395 const char *passwd) 3396 { 3397 EVP_PKEY *pkey; 3398 X509 *cert; 3399 STACK_OF(X509) *certs; 3400 int res = 0; 3401 char buf[256]; 3402 3403 pkey = NULL; 3404 cert = NULL; 3405 certs = NULL; 3406 if (!passwd) 3407 passwd = ""; 3408 if (!PKCS12_parse(p12, passwd, &pkey, &cert, &certs)) { 3409 tls_show_errors(MSG_DEBUG, __func__, 3410 "Failed to parse PKCS12 file"); 3411 PKCS12_free(p12); 3412 return -1; 3413 } 3414 wpa_printf(MSG_DEBUG, "TLS: Successfully parsed PKCS12 data"); 3415 3416 if (cert) { 3417 X509_NAME_oneline(X509_get_subject_name(cert), buf, 3418 sizeof(buf)); 3419 wpa_printf(MSG_DEBUG, "TLS: Got certificate from PKCS12: " 3420 "subject='%s'", buf); 3421 if (ssl) { 3422 if (SSL_use_certificate(ssl, cert) != 1) 3423 res = -1; 3424 } else { 3425 if (SSL_CTX_use_certificate(data->ssl, cert) != 1) 3426 res = -1; 3427 } 3428 X509_free(cert); 3429 } 3430 3431 if (pkey) { 3432 wpa_printf(MSG_DEBUG, "TLS: Got private key from PKCS12"); 3433 if (ssl) { 3434 if (SSL_use_PrivateKey(ssl, pkey) != 1) 3435 res = -1; 3436 } else { 3437 if (SSL_CTX_use_PrivateKey(data->ssl, pkey) != 1) 3438 res = -1; 3439 } 3440 EVP_PKEY_free(pkey); 3441 } 3442 3443 if (certs) { 3444 #if OPENSSL_VERSION_NUMBER >= 0x10002000L && !defined(LIBRESSL_VERSION_NUMBER) 3445 if (ssl) 3446 SSL_clear_chain_certs(ssl); 3447 else 3448 SSL_CTX_clear_chain_certs(data->ssl); 3449 while ((cert = sk_X509_pop(certs)) != NULL) { 3450 X509_NAME_oneline(X509_get_subject_name(cert), buf, 3451 sizeof(buf)); 3452 wpa_printf(MSG_DEBUG, "TLS: additional certificate" 3453 " from PKCS12: subject='%s'", buf); 3454 if ((ssl && SSL_add1_chain_cert(ssl, cert) != 1) || 3455 (!ssl && SSL_CTX_add1_chain_cert(data->ssl, 3456 cert) != 1)) { 3457 tls_show_errors(MSG_DEBUG, __func__, 3458 "Failed to add additional certificate"); 3459 res = -1; 3460 X509_free(cert); 3461 break; 3462 } 3463 X509_free(cert); 3464 } 3465 if (!res) { 3466 /* Try to continue anyway */ 3467 } 3468 sk_X509_pop_free(certs, X509_free); 3469 #ifndef OPENSSL_IS_BORINGSSL 3470 if (ssl) 3471 res = SSL_build_cert_chain( 3472 ssl, 3473 SSL_BUILD_CHAIN_FLAG_CHECK | 3474 SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR); 3475 else 3476 res = SSL_CTX_build_cert_chain( 3477 data->ssl, 3478 SSL_BUILD_CHAIN_FLAG_CHECK | 3479 SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR); 3480 if (!res) { 3481 tls_show_errors(MSG_DEBUG, __func__, 3482 "Failed to build certificate chain"); 3483 } else if (res == 2) { 3484 wpa_printf(MSG_DEBUG, 3485 "TLS: Ignore certificate chain verification error when building chain with PKCS#12 extra certificates"); 3486 } 3487 #endif /* OPENSSL_IS_BORINGSSL */ 3488 /* 3489 * Try to continue regardless of result since it is possible for 3490 * the extra certificates not to be required. 3491 */ 3492 res = 0; 3493 #else /* OPENSSL_VERSION_NUMBER >= 0x10002000L */ 3494 SSL_CTX_clear_extra_chain_certs(data->ssl); 3495 while ((cert = sk_X509_pop(certs)) != NULL) { 3496 X509_NAME_oneline(X509_get_subject_name(cert), buf, 3497 sizeof(buf)); 3498 wpa_printf(MSG_DEBUG, "TLS: additional certificate" 3499 " from PKCS12: subject='%s'", buf); 3500 /* 3501 * There is no SSL equivalent for the chain cert - so 3502 * always add it to the context... 3503 */ 3504 if (SSL_CTX_add_extra_chain_cert(data->ssl, cert) != 1) 3505 { 3506 X509_free(cert); 3507 res = -1; 3508 break; 3509 } 3510 } 3511 sk_X509_pop_free(certs, X509_free); 3512 #endif /* OPENSSL_VERSION_NUMBER >= 0x10002000L */ 3513 } 3514 3515 PKCS12_free(p12); 3516 3517 if (res < 0) 3518 tls_get_errors(data); 3519 3520 return res; 3521 } 3522 #endif /* PKCS12_FUNCS */ 3523 3524 3525 static int tls_read_pkcs12(struct tls_data *data, SSL *ssl, 3526 const char *private_key, const char *passwd) 3527 { 3528 #ifdef PKCS12_FUNCS 3529 FILE *f; 3530 PKCS12 *p12; 3531 3532 f = fopen(private_key, "rb"); 3533 if (f == NULL) 3534 return -1; 3535 3536 p12 = d2i_PKCS12_fp(f, NULL); 3537 fclose(f); 3538 3539 if (p12 == NULL) { 3540 tls_show_errors(MSG_INFO, __func__, 3541 "Failed to use PKCS#12 file"); 3542 return -1; 3543 } 3544 3545 return tls_parse_pkcs12(data, ssl, p12, passwd); 3546 3547 #else /* PKCS12_FUNCS */ 3548 wpa_printf(MSG_INFO, "TLS: PKCS12 support disabled - cannot read " 3549 "p12/pfx files"); 3550 return -1; 3551 #endif /* PKCS12_FUNCS */ 3552 } 3553 3554 3555 static int tls_read_pkcs12_blob(struct tls_data *data, SSL *ssl, 3556 const u8 *blob, size_t len, const char *passwd) 3557 { 3558 #ifdef PKCS12_FUNCS 3559 PKCS12 *p12; 3560 3561 p12 = d2i_PKCS12(NULL, (const unsigned char **) &blob, len); 3562 if (p12 == NULL) { 3563 tls_show_errors(MSG_INFO, __func__, 3564 "Failed to use PKCS#12 blob"); 3565 return -1; 3566 } 3567 3568 return tls_parse_pkcs12(data, ssl, p12, passwd); 3569 3570 #else /* PKCS12_FUNCS */ 3571 wpa_printf(MSG_INFO, "TLS: PKCS12 support disabled - cannot parse " 3572 "p12/pfx blobs"); 3573 return -1; 3574 #endif /* PKCS12_FUNCS */ 3575 } 3576 3577 3578 #ifndef OPENSSL_NO_ENGINE 3579 static int tls_engine_get_cert(struct tls_connection *conn, 3580 const char *cert_id, 3581 X509 **cert) 3582 { 3583 /* this runs after the private key is loaded so no PIN is required */ 3584 struct { 3585 const char *cert_id; 3586 X509 *cert; 3587 } params; 3588 params.cert_id = cert_id; 3589 params.cert = NULL; 3590 3591 if (!ENGINE_ctrl_cmd(conn->engine, "LOAD_CERT_CTRL", 3592 0, ¶ms, NULL, 1)) { 3593 unsigned long err = ERR_get_error(); 3594 3595 wpa_printf(MSG_ERROR, "ENGINE: cannot load client cert with id" 3596 " '%s' [%s]", cert_id, 3597 ERR_error_string(err, NULL)); 3598 if (tls_is_pin_error(err)) 3599 return TLS_SET_PARAMS_ENGINE_PRV_BAD_PIN; 3600 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED; 3601 } 3602 if (!params.cert) { 3603 wpa_printf(MSG_ERROR, "ENGINE: did not properly cert with id" 3604 " '%s'", cert_id); 3605 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED; 3606 } 3607 *cert = params.cert; 3608 return 0; 3609 } 3610 #endif /* OPENSSL_NO_ENGINE */ 3611 3612 3613 static int tls_connection_engine_client_cert(struct tls_connection *conn, 3614 const char *cert_id) 3615 { 3616 #ifndef OPENSSL_NO_ENGINE 3617 X509 *cert; 3618 3619 if (tls_engine_get_cert(conn, cert_id, &cert)) 3620 return -1; 3621 3622 if (!SSL_use_certificate(conn->ssl, cert)) { 3623 tls_show_errors(MSG_ERROR, __func__, 3624 "SSL_use_certificate failed"); 3625 X509_free(cert); 3626 return -1; 3627 } 3628 X509_free(cert); 3629 wpa_printf(MSG_DEBUG, "ENGINE: SSL_use_certificate --> " 3630 "OK"); 3631 return 0; 3632 3633 #else /* OPENSSL_NO_ENGINE */ 3634 return -1; 3635 #endif /* OPENSSL_NO_ENGINE */ 3636 } 3637 3638 3639 static int tls_connection_engine_ca_cert(struct tls_data *data, 3640 struct tls_connection *conn, 3641 const char *ca_cert_id) 3642 { 3643 #ifndef OPENSSL_NO_ENGINE 3644 X509 *cert; 3645 SSL_CTX *ssl_ctx = data->ssl; 3646 X509_STORE *store; 3647 3648 if (tls_engine_get_cert(conn, ca_cert_id, &cert)) 3649 return -1; 3650 3651 /* start off the same as tls_connection_ca_cert */ 3652 store = X509_STORE_new(); 3653 if (store == NULL) { 3654 wpa_printf(MSG_DEBUG, "OpenSSL: %s - failed to allocate new " 3655 "certificate store", __func__); 3656 X509_free(cert); 3657 return -1; 3658 } 3659 SSL_CTX_set_cert_store(ssl_ctx, store); 3660 if (!X509_STORE_add_cert(store, cert)) { 3661 unsigned long err = ERR_peek_error(); 3662 tls_show_errors(MSG_WARNING, __func__, 3663 "Failed to add CA certificate from engine " 3664 "to certificate store"); 3665 if (ERR_GET_LIB(err) == ERR_LIB_X509 && 3666 ERR_GET_REASON(err) == X509_R_CERT_ALREADY_IN_HASH_TABLE) { 3667 wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring cert" 3668 " already in hash table error", 3669 __func__); 3670 } else { 3671 X509_free(cert); 3672 return -1; 3673 } 3674 } 3675 X509_free(cert); 3676 wpa_printf(MSG_DEBUG, "OpenSSL: %s - added CA certificate from engine " 3677 "to certificate store", __func__); 3678 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb); 3679 conn->ca_cert_verify = 1; 3680 3681 return 0; 3682 3683 #else /* OPENSSL_NO_ENGINE */ 3684 return -1; 3685 #endif /* OPENSSL_NO_ENGINE */ 3686 } 3687 3688 3689 static int tls_connection_engine_private_key(struct tls_connection *conn) 3690 { 3691 #if defined(ANDROID) || !defined(OPENSSL_NO_ENGINE) 3692 if (SSL_use_PrivateKey(conn->ssl, conn->private_key) != 1) { 3693 tls_show_errors(MSG_ERROR, __func__, 3694 "ENGINE: cannot use private key for TLS"); 3695 return -1; 3696 } 3697 if (!SSL_check_private_key(conn->ssl)) { 3698 tls_show_errors(MSG_INFO, __func__, 3699 "Private key failed verification"); 3700 return -1; 3701 } 3702 return 0; 3703 #else /* OPENSSL_NO_ENGINE */ 3704 wpa_printf(MSG_ERROR, "SSL: Configuration uses engine, but " 3705 "engine support was not compiled in"); 3706 return -1; 3707 #endif /* OPENSSL_NO_ENGINE */ 3708 } 3709 3710 3711 #ifndef OPENSSL_NO_STDIO 3712 static int tls_passwd_cb(char *buf, int size, int rwflag, void *password) 3713 { 3714 if (!password) 3715 return 0; 3716 os_strlcpy(buf, (const char *) password, size); 3717 return os_strlen(buf); 3718 } 3719 #endif /* OPENSSL_NO_STDIO */ 3720 3721 3722 static int tls_use_private_key_file(struct tls_data *data, SSL *ssl, 3723 const char *private_key, 3724 const char *private_key_passwd) 3725 { 3726 #ifndef OPENSSL_NO_STDIO 3727 BIO *bio; 3728 EVP_PKEY *pkey; 3729 int ret; 3730 3731 /* First try ASN.1 (DER). */ 3732 bio = BIO_new_file(private_key, "r"); 3733 if (!bio) 3734 return -1; 3735 pkey = d2i_PrivateKey_bio(bio, NULL); 3736 BIO_free(bio); 3737 3738 if (pkey) { 3739 wpa_printf(MSG_DEBUG, "OpenSSL: %s (DER) --> loaded", __func__); 3740 } else { 3741 /* Try PEM with the provided password. */ 3742 bio = BIO_new_file(private_key, "r"); 3743 if (!bio) 3744 return -1; 3745 pkey = PEM_read_bio_PrivateKey(bio, NULL, tls_passwd_cb, 3746 (void *) private_key_passwd); 3747 BIO_free(bio); 3748 if (!pkey) 3749 return -1; 3750 wpa_printf(MSG_DEBUG, "OpenSSL: %s (PEM) --> loaded", __func__); 3751 /* Clear errors from the previous failed load. */ 3752 ERR_clear_error(); 3753 } 3754 3755 if (ssl) 3756 ret = SSL_use_PrivateKey(ssl, pkey); 3757 else 3758 ret = SSL_CTX_use_PrivateKey(data->ssl, pkey); 3759 3760 EVP_PKEY_free(pkey); 3761 return ret == 1 ? 0 : -1; 3762 #else /* OPENSSL_NO_STDIO */ 3763 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", __func__); 3764 return -1; 3765 #endif /* OPENSSL_NO_STDIO */ 3766 } 3767 3768 3769 static int tls_connection_private_key(struct tls_data *data, 3770 struct tls_connection *conn, 3771 const char *private_key, 3772 const char *private_key_passwd, 3773 const u8 *private_key_blob, 3774 size_t private_key_blob_len) 3775 { 3776 int ok; 3777 3778 if (private_key == NULL && private_key_blob == NULL) 3779 return 0; 3780 3781 ok = 0; 3782 while (private_key_blob) { 3783 if (SSL_use_PrivateKey_ASN1(EVP_PKEY_RSA, conn->ssl, 3784 (u8 *) private_key_blob, 3785 private_key_blob_len) == 1) { 3786 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_PrivateKey_" 3787 "ASN1(EVP_PKEY_RSA) --> OK"); 3788 ok = 1; 3789 break; 3790 } 3791 3792 if (SSL_use_PrivateKey_ASN1(EVP_PKEY_DSA, conn->ssl, 3793 (u8 *) private_key_blob, 3794 private_key_blob_len) == 1) { 3795 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_PrivateKey_" 3796 "ASN1(EVP_PKEY_DSA) --> OK"); 3797 ok = 1; 3798 break; 3799 } 3800 3801 #ifndef OPENSSL_NO_EC 3802 if (SSL_use_PrivateKey_ASN1(EVP_PKEY_EC, conn->ssl, 3803 (u8 *) private_key_blob, 3804 private_key_blob_len) == 1) { 3805 wpa_printf(MSG_DEBUG, 3806 "OpenSSL: SSL_use_PrivateKey_ASN1(EVP_PKEY_EC) --> OK"); 3807 ok = 1; 3808 break; 3809 } 3810 #endif /* OPENSSL_NO_EC */ 3811 3812 if (SSL_use_RSAPrivateKey_ASN1(conn->ssl, 3813 (u8 *) private_key_blob, 3814 private_key_blob_len) == 1) { 3815 wpa_printf(MSG_DEBUG, "OpenSSL: " 3816 "SSL_use_RSAPrivateKey_ASN1 --> OK"); 3817 ok = 1; 3818 break; 3819 } 3820 3821 if (tls_read_pkcs12_blob(data, conn->ssl, private_key_blob, 3822 private_key_blob_len, 3823 private_key_passwd) == 0) { 3824 wpa_printf(MSG_DEBUG, "OpenSSL: PKCS#12 as blob --> " 3825 "OK"); 3826 ok = 1; 3827 break; 3828 } 3829 3830 break; 3831 } 3832 3833 while (!ok && private_key) { 3834 if (tls_use_private_key_file(data, conn->ssl, private_key, 3835 private_key_passwd) == 0) { 3836 ok = 1; 3837 break; 3838 } 3839 3840 if (tls_read_pkcs12(data, conn->ssl, private_key, 3841 private_key_passwd) == 0) { 3842 wpa_printf(MSG_DEBUG, "OpenSSL: Reading PKCS#12 file " 3843 "--> OK"); 3844 ok = 1; 3845 break; 3846 } 3847 3848 if (tls_cryptoapi_cert(conn->ssl, private_key) == 0) { 3849 wpa_printf(MSG_DEBUG, "OpenSSL: Using CryptoAPI to " 3850 "access certificate store --> OK"); 3851 ok = 1; 3852 break; 3853 } 3854 3855 break; 3856 } 3857 3858 if (!ok) { 3859 tls_show_errors(MSG_INFO, __func__, 3860 "Failed to load private key"); 3861 return -1; 3862 } 3863 ERR_clear_error(); 3864 3865 if (!SSL_check_private_key(conn->ssl)) { 3866 tls_show_errors(MSG_INFO, __func__, "Private key failed " 3867 "verification"); 3868 return -1; 3869 } 3870 3871 wpa_printf(MSG_DEBUG, "SSL: Private key loaded successfully"); 3872 return 0; 3873 } 3874 3875 3876 static int tls_global_private_key(struct tls_data *data, 3877 const char *private_key, 3878 const char *private_key_passwd) 3879 { 3880 SSL_CTX *ssl_ctx = data->ssl; 3881 3882 if (private_key == NULL) 3883 return 0; 3884 3885 if (tls_use_private_key_file(data, NULL, private_key, 3886 private_key_passwd) && 3887 tls_read_pkcs12(data, NULL, private_key, private_key_passwd)) { 3888 tls_show_errors(MSG_INFO, __func__, 3889 "Failed to load private key"); 3890 ERR_clear_error(); 3891 return -1; 3892 } 3893 ERR_clear_error(); 3894 3895 if (!SSL_CTX_check_private_key(ssl_ctx)) { 3896 tls_show_errors(MSG_INFO, __func__, 3897 "Private key failed verification"); 3898 return -1; 3899 } 3900 3901 return 0; 3902 } 3903 3904 3905 static int tls_connection_dh(struct tls_connection *conn, const char *dh_file) 3906 { 3907 #ifdef OPENSSL_NO_DH 3908 if (dh_file == NULL) 3909 return 0; 3910 wpa_printf(MSG_ERROR, "TLS: openssl does not include DH support, but " 3911 "dh_file specified"); 3912 return -1; 3913 #else /* OPENSSL_NO_DH */ 3914 DH *dh; 3915 BIO *bio; 3916 3917 /* TODO: add support for dh_blob */ 3918 if (dh_file == NULL) 3919 return 0; 3920 if (conn == NULL) 3921 return -1; 3922 3923 bio = BIO_new_file(dh_file, "r"); 3924 if (bio == NULL) { 3925 wpa_printf(MSG_INFO, "TLS: Failed to open DH file '%s': %s", 3926 dh_file, ERR_error_string(ERR_get_error(), NULL)); 3927 return -1; 3928 } 3929 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); 3930 BIO_free(bio); 3931 #ifndef OPENSSL_NO_DSA 3932 while (dh == NULL) { 3933 DSA *dsa; 3934 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DH file '%s': %s -" 3935 " trying to parse as DSA params", dh_file, 3936 ERR_error_string(ERR_get_error(), NULL)); 3937 bio = BIO_new_file(dh_file, "r"); 3938 if (bio == NULL) 3939 break; 3940 dsa = PEM_read_bio_DSAparams(bio, NULL, NULL, NULL); 3941 BIO_free(bio); 3942 if (!dsa) { 3943 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DSA file " 3944 "'%s': %s", dh_file, 3945 ERR_error_string(ERR_get_error(), NULL)); 3946 break; 3947 } 3948 3949 wpa_printf(MSG_DEBUG, "TLS: DH file in DSA param format"); 3950 dh = DSA_dup_DH(dsa); 3951 DSA_free(dsa); 3952 if (dh == NULL) { 3953 wpa_printf(MSG_INFO, "TLS: Failed to convert DSA " 3954 "params into DH params"); 3955 break; 3956 } 3957 break; 3958 } 3959 #endif /* !OPENSSL_NO_DSA */ 3960 if (dh == NULL) { 3961 wpa_printf(MSG_INFO, "TLS: Failed to read/parse DH/DSA file " 3962 "'%s'", dh_file); 3963 return -1; 3964 } 3965 3966 if (SSL_set_tmp_dh(conn->ssl, dh) != 1) { 3967 wpa_printf(MSG_INFO, "TLS: Failed to set DH params from '%s': " 3968 "%s", dh_file, 3969 ERR_error_string(ERR_get_error(), NULL)); 3970 DH_free(dh); 3971 return -1; 3972 } 3973 DH_free(dh); 3974 return 0; 3975 #endif /* OPENSSL_NO_DH */ 3976 } 3977 3978 3979 static int tls_global_dh(struct tls_data *data, const char *dh_file) 3980 { 3981 #ifdef OPENSSL_NO_DH 3982 if (dh_file == NULL) 3983 return 0; 3984 wpa_printf(MSG_ERROR, "TLS: openssl does not include DH support, but " 3985 "dh_file specified"); 3986 return -1; 3987 #else /* OPENSSL_NO_DH */ 3988 SSL_CTX *ssl_ctx = data->ssl; 3989 DH *dh; 3990 BIO *bio; 3991 3992 /* TODO: add support for dh_blob */ 3993 if (dh_file == NULL) 3994 return 0; 3995 if (ssl_ctx == NULL) 3996 return -1; 3997 3998 bio = BIO_new_file(dh_file, "r"); 3999 if (bio == NULL) { 4000 wpa_printf(MSG_INFO, "TLS: Failed to open DH file '%s': %s", 4001 dh_file, ERR_error_string(ERR_get_error(), NULL)); 4002 return -1; 4003 } 4004 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL); 4005 BIO_free(bio); 4006 #ifndef OPENSSL_NO_DSA 4007 while (dh == NULL) { 4008 DSA *dsa; 4009 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DH file '%s': %s -" 4010 " trying to parse as DSA params", dh_file, 4011 ERR_error_string(ERR_get_error(), NULL)); 4012 bio = BIO_new_file(dh_file, "r"); 4013 if (bio == NULL) 4014 break; 4015 dsa = PEM_read_bio_DSAparams(bio, NULL, NULL, NULL); 4016 BIO_free(bio); 4017 if (!dsa) { 4018 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DSA file " 4019 "'%s': %s", dh_file, 4020 ERR_error_string(ERR_get_error(), NULL)); 4021 break; 4022 } 4023 4024 wpa_printf(MSG_DEBUG, "TLS: DH file in DSA param format"); 4025 dh = DSA_dup_DH(dsa); 4026 DSA_free(dsa); 4027 if (dh == NULL) { 4028 wpa_printf(MSG_INFO, "TLS: Failed to convert DSA " 4029 "params into DH params"); 4030 break; 4031 } 4032 break; 4033 } 4034 #endif /* !OPENSSL_NO_DSA */ 4035 if (dh == NULL) { 4036 wpa_printf(MSG_INFO, "TLS: Failed to read/parse DH/DSA file " 4037 "'%s'", dh_file); 4038 return -1; 4039 } 4040 4041 if (SSL_CTX_set_tmp_dh(ssl_ctx, dh) != 1) { 4042 wpa_printf(MSG_INFO, "TLS: Failed to set DH params from '%s': " 4043 "%s", dh_file, 4044 ERR_error_string(ERR_get_error(), NULL)); 4045 DH_free(dh); 4046 return -1; 4047 } 4048 DH_free(dh); 4049 return 0; 4050 #endif /* OPENSSL_NO_DH */ 4051 } 4052 4053 4054 int tls_connection_get_random(void *ssl_ctx, struct tls_connection *conn, 4055 struct tls_random *keys) 4056 { 4057 SSL *ssl; 4058 4059 if (conn == NULL || keys == NULL) 4060 return -1; 4061 ssl = conn->ssl; 4062 if (ssl == NULL) 4063 return -1; 4064 4065 os_memset(keys, 0, sizeof(*keys)); 4066 keys->client_random = conn->client_random; 4067 keys->client_random_len = SSL_get_client_random( 4068 ssl, conn->client_random, sizeof(conn->client_random)); 4069 keys->server_random = conn->server_random; 4070 keys->server_random_len = SSL_get_server_random( 4071 ssl, conn->server_random, sizeof(conn->server_random)); 4072 4073 return 0; 4074 } 4075 4076 4077 #ifdef OPENSSL_NEED_EAP_FAST_PRF 4078 static int openssl_get_keyblock_size(SSL *ssl) 4079 { 4080 #if OPENSSL_VERSION_NUMBER < 0x10100000L || \ 4081 (defined(LIBRESSL_VERSION_NUMBER) && \ 4082 LIBRESSL_VERSION_NUMBER < 0x20700000L) 4083 const EVP_CIPHER *c; 4084 const EVP_MD *h; 4085 int md_size; 4086 4087 if (ssl->enc_read_ctx == NULL || ssl->enc_read_ctx->cipher == NULL || 4088 ssl->read_hash == NULL) 4089 return -1; 4090 4091 c = ssl->enc_read_ctx->cipher; 4092 h = EVP_MD_CTX_md(ssl->read_hash); 4093 if (h) 4094 md_size = EVP_MD_size(h); 4095 else if (ssl->s3) 4096 md_size = ssl->s3->tmp.new_mac_secret_size; 4097 else 4098 return -1; 4099 4100 wpa_printf(MSG_DEBUG, "OpenSSL: keyblock size: key_len=%d MD_size=%d " 4101 "IV_len=%d", EVP_CIPHER_key_length(c), md_size, 4102 EVP_CIPHER_iv_length(c)); 4103 return 2 * (EVP_CIPHER_key_length(c) + 4104 md_size + 4105 EVP_CIPHER_iv_length(c)); 4106 #else 4107 const SSL_CIPHER *ssl_cipher; 4108 int cipher, digest; 4109 const EVP_CIPHER *c; 4110 const EVP_MD *h; 4111 int mac_key_len, enc_key_len, fixed_iv_len; 4112 4113 ssl_cipher = SSL_get_current_cipher(ssl); 4114 if (!ssl_cipher) 4115 return -1; 4116 cipher = SSL_CIPHER_get_cipher_nid(ssl_cipher); 4117 digest = SSL_CIPHER_get_digest_nid(ssl_cipher); 4118 wpa_printf(MSG_DEBUG, "OpenSSL: cipher nid %d digest nid %d", 4119 cipher, digest); 4120 if (cipher < 0 || digest < 0) 4121 return -1; 4122 if (cipher == NID_undef) { 4123 wpa_printf(MSG_DEBUG, "OpenSSL: no cipher in use?!"); 4124 return -1; 4125 } 4126 c = EVP_get_cipherbynid(cipher); 4127 if (!c) 4128 return -1; 4129 enc_key_len = EVP_CIPHER_key_length(c); 4130 if (EVP_CIPHER_mode(c) == EVP_CIPH_GCM_MODE || 4131 EVP_CIPHER_mode(c) == EVP_CIPH_CCM_MODE) 4132 fixed_iv_len = 4; /* only part of IV from PRF */ 4133 else 4134 fixed_iv_len = EVP_CIPHER_iv_length(c); 4135 if (digest == NID_undef) { 4136 wpa_printf(MSG_DEBUG, "OpenSSL: no digest in use (e.g., AEAD)"); 4137 mac_key_len = 0; 4138 } else { 4139 h = EVP_get_digestbynid(digest); 4140 if (!h) 4141 return -1; 4142 mac_key_len = EVP_MD_size(h); 4143 } 4144 4145 wpa_printf(MSG_DEBUG, 4146 "OpenSSL: keyblock size: mac_key_len=%d enc_key_len=%d fixed_iv_len=%d", 4147 mac_key_len, enc_key_len, fixed_iv_len); 4148 return 2 * (mac_key_len + enc_key_len + fixed_iv_len); 4149 #endif 4150 } 4151 #endif /* OPENSSL_NEED_EAP_FAST_PRF */ 4152 4153 4154 int tls_connection_export_key(void *tls_ctx, struct tls_connection *conn, 4155 const char *label, const u8 *context, 4156 size_t context_len, u8 *out, size_t out_len) 4157 { 4158 if (!conn || 4159 SSL_export_keying_material(conn->ssl, out, out_len, label, 4160 os_strlen(label), context, context_len, 4161 context != NULL) != 1) 4162 return -1; 4163 return 0; 4164 } 4165 4166 4167 int tls_connection_get_eap_fast_key(void *tls_ctx, struct tls_connection *conn, 4168 u8 *out, size_t out_len) 4169 { 4170 #ifdef OPENSSL_NEED_EAP_FAST_PRF 4171 SSL *ssl; 4172 SSL_SESSION *sess; 4173 u8 *rnd; 4174 int ret = -1; 4175 int skip = 0; 4176 u8 *tmp_out = NULL; 4177 u8 *_out = out; 4178 unsigned char client_random[SSL3_RANDOM_SIZE]; 4179 unsigned char server_random[SSL3_RANDOM_SIZE]; 4180 unsigned char master_key[64]; 4181 size_t master_key_len; 4182 const char *ver; 4183 4184 /* 4185 * TLS library did not support EAP-FAST key generation, so get the 4186 * needed TLS session parameters and use an internal implementation of 4187 * TLS PRF to derive the key. 4188 */ 4189 4190 if (conn == NULL) 4191 return -1; 4192 ssl = conn->ssl; 4193 if (ssl == NULL) 4194 return -1; 4195 ver = SSL_get_version(ssl); 4196 sess = SSL_get_session(ssl); 4197 if (!ver || !sess) 4198 return -1; 4199 4200 skip = openssl_get_keyblock_size(ssl); 4201 if (skip < 0) 4202 return -1; 4203 tmp_out = os_malloc(skip + out_len); 4204 if (!tmp_out) 4205 return -1; 4206 _out = tmp_out; 4207 4208 rnd = os_malloc(2 * SSL3_RANDOM_SIZE); 4209 if (!rnd) { 4210 os_free(tmp_out); 4211 return -1; 4212 } 4213 4214 SSL_get_client_random(ssl, client_random, sizeof(client_random)); 4215 SSL_get_server_random(ssl, server_random, sizeof(server_random)); 4216 master_key_len = SSL_SESSION_get_master_key(sess, master_key, 4217 sizeof(master_key)); 4218 4219 os_memcpy(rnd, server_random, SSL3_RANDOM_SIZE); 4220 os_memcpy(rnd + SSL3_RANDOM_SIZE, client_random, SSL3_RANDOM_SIZE); 4221 4222 if (os_strcmp(ver, "TLSv1.2") == 0) { 4223 tls_prf_sha256(master_key, master_key_len, 4224 "key expansion", rnd, 2 * SSL3_RANDOM_SIZE, 4225 _out, skip + out_len); 4226 ret = 0; 4227 } else if (tls_prf_sha1_md5(master_key, master_key_len, 4228 "key expansion", rnd, 2 * SSL3_RANDOM_SIZE, 4229 _out, skip + out_len) == 0) { 4230 ret = 0; 4231 } 4232 forced_memzero(master_key, sizeof(master_key)); 4233 os_free(rnd); 4234 if (ret == 0) 4235 os_memcpy(out, _out + skip, out_len); 4236 bin_clear_free(tmp_out, skip); 4237 4238 return ret; 4239 #else /* OPENSSL_NEED_EAP_FAST_PRF */ 4240 wpa_printf(MSG_ERROR, 4241 "OpenSSL: EAP-FAST keys cannot be exported in FIPS mode"); 4242 return -1; 4243 #endif /* OPENSSL_NEED_EAP_FAST_PRF */ 4244 } 4245 4246 4247 static struct wpabuf * 4248 openssl_handshake(struct tls_connection *conn, const struct wpabuf *in_data) 4249 { 4250 int res; 4251 struct wpabuf *out_data; 4252 4253 /* 4254 * Give TLS handshake data from the server (if available) to OpenSSL 4255 * for processing. 4256 */ 4257 if (in_data && wpabuf_len(in_data) > 0 && 4258 BIO_write(conn->ssl_in, wpabuf_head(in_data), wpabuf_len(in_data)) 4259 < 0) { 4260 tls_show_errors(MSG_INFO, __func__, 4261 "Handshake failed - BIO_write"); 4262 return NULL; 4263 } 4264 4265 /* Initiate TLS handshake or continue the existing handshake */ 4266 if (conn->server) 4267 res = SSL_accept(conn->ssl); 4268 else 4269 res = SSL_connect(conn->ssl); 4270 if (res != 1) { 4271 int err = SSL_get_error(conn->ssl, res); 4272 if (err == SSL_ERROR_WANT_READ) 4273 wpa_printf(MSG_DEBUG, "SSL: SSL_connect - want " 4274 "more data"); 4275 else if (err == SSL_ERROR_WANT_WRITE) 4276 wpa_printf(MSG_DEBUG, "SSL: SSL_connect - want to " 4277 "write"); 4278 else { 4279 tls_show_errors(MSG_INFO, __func__, "SSL_connect"); 4280 conn->failed++; 4281 if (!conn->server && !conn->client_hello_generated) { 4282 /* The server would not understand TLS Alert 4283 * before ClientHello, so simply terminate 4284 * handshake on this type of error case caused 4285 * by a likely internal error like no ciphers 4286 * available. */ 4287 wpa_printf(MSG_DEBUG, 4288 "OpenSSL: Could not generate ClientHello"); 4289 conn->write_alerts++; 4290 return NULL; 4291 } 4292 } 4293 } 4294 4295 if (!conn->server && !conn->failed) 4296 conn->client_hello_generated = 1; 4297 4298 #ifdef CONFIG_SUITEB 4299 if ((conn->flags & TLS_CONN_SUITEB) && !conn->server && 4300 os_strncmp(SSL_get_cipher(conn->ssl), "DHE-", 4) == 0 && 4301 conn->server_dh_prime_len < 3072) { 4302 struct tls_context *context = conn->context; 4303 4304 /* 4305 * This should not be reached since earlier cert_cb should have 4306 * terminated the handshake. Keep this check here for extra 4307 * protection if anything goes wrong with the more low-level 4308 * checks based on having to parse the TLS handshake messages. 4309 */ 4310 wpa_printf(MSG_DEBUG, 4311 "OpenSSL: Server DH prime length: %d bits", 4312 conn->server_dh_prime_len); 4313 4314 if (context->event_cb) { 4315 union tls_event_data ev; 4316 4317 os_memset(&ev, 0, sizeof(ev)); 4318 ev.alert.is_local = 1; 4319 ev.alert.type = "fatal"; 4320 ev.alert.description = "insufficient security"; 4321 context->event_cb(context->cb_ctx, TLS_ALERT, &ev); 4322 } 4323 /* 4324 * Could send a TLS Alert to the server, but for now, simply 4325 * terminate handshake. 4326 */ 4327 conn->failed++; 4328 conn->write_alerts++; 4329 return NULL; 4330 } 4331 #endif /* CONFIG_SUITEB */ 4332 4333 /* Get the TLS handshake data to be sent to the server */ 4334 res = BIO_ctrl_pending(conn->ssl_out); 4335 wpa_printf(MSG_DEBUG, "SSL: %d bytes pending from ssl_out", res); 4336 out_data = wpabuf_alloc(res); 4337 if (out_data == NULL) { 4338 wpa_printf(MSG_DEBUG, "SSL: Failed to allocate memory for " 4339 "handshake output (%d bytes)", res); 4340 if (BIO_reset(conn->ssl_out) < 0) { 4341 tls_show_errors(MSG_INFO, __func__, 4342 "BIO_reset failed"); 4343 } 4344 return NULL; 4345 } 4346 res = res == 0 ? 0 : BIO_read(conn->ssl_out, wpabuf_mhead(out_data), 4347 res); 4348 if (res < 0) { 4349 tls_show_errors(MSG_INFO, __func__, 4350 "Handshake failed - BIO_read"); 4351 if (BIO_reset(conn->ssl_out) < 0) { 4352 tls_show_errors(MSG_INFO, __func__, 4353 "BIO_reset failed"); 4354 } 4355 wpabuf_free(out_data); 4356 return NULL; 4357 } 4358 wpabuf_put(out_data, res); 4359 4360 return out_data; 4361 } 4362 4363 4364 static struct wpabuf * 4365 openssl_get_appl_data(struct tls_connection *conn, size_t max_len) 4366 { 4367 struct wpabuf *appl_data; 4368 int res; 4369 4370 appl_data = wpabuf_alloc(max_len + 100); 4371 if (appl_data == NULL) 4372 return NULL; 4373 4374 res = SSL_read(conn->ssl, wpabuf_mhead(appl_data), 4375 wpabuf_size(appl_data)); 4376 if (res < 0) { 4377 int err = SSL_get_error(conn->ssl, res); 4378 if (err == SSL_ERROR_WANT_READ || 4379 err == SSL_ERROR_WANT_WRITE) { 4380 wpa_printf(MSG_DEBUG, "SSL: No Application Data " 4381 "included"); 4382 } else { 4383 tls_show_errors(MSG_INFO, __func__, 4384 "Failed to read possible " 4385 "Application Data"); 4386 } 4387 wpabuf_free(appl_data); 4388 return NULL; 4389 } 4390 4391 wpabuf_put(appl_data, res); 4392 wpa_hexdump_buf_key(MSG_MSGDUMP, "SSL: Application Data in Finished " 4393 "message", appl_data); 4394 4395 return appl_data; 4396 } 4397 4398 4399 static struct wpabuf * 4400 openssl_connection_handshake(struct tls_connection *conn, 4401 const struct wpabuf *in_data, 4402 struct wpabuf **appl_data) 4403 { 4404 struct wpabuf *out_data; 4405 4406 if (appl_data) 4407 *appl_data = NULL; 4408 4409 out_data = openssl_handshake(conn, in_data); 4410 if (out_data == NULL) 4411 return NULL; 4412 if (conn->invalid_hb_used) { 4413 wpa_printf(MSG_INFO, "TLS: Heartbeat attack detected - do not send response"); 4414 wpabuf_free(out_data); 4415 return NULL; 4416 } 4417 4418 if (SSL_is_init_finished(conn->ssl)) { 4419 wpa_printf(MSG_DEBUG, 4420 "OpenSSL: Handshake finished - resumed=%d", 4421 tls_connection_resumed(conn->ssl_ctx, conn)); 4422 if (conn->server) { 4423 char *buf; 4424 size_t buflen = 2000; 4425 4426 buf = os_malloc(buflen); 4427 if (buf) { 4428 if (SSL_get_shared_ciphers(conn->ssl, buf, 4429 buflen)) { 4430 buf[buflen - 1] = '\0'; 4431 wpa_printf(MSG_DEBUG, 4432 "OpenSSL: Shared ciphers: %s", 4433 buf); 4434 } 4435 os_free(buf); 4436 } 4437 } 4438 if (appl_data && in_data) 4439 *appl_data = openssl_get_appl_data(conn, 4440 wpabuf_len(in_data)); 4441 } 4442 4443 if (conn->invalid_hb_used) { 4444 wpa_printf(MSG_INFO, "TLS: Heartbeat attack detected - do not send response"); 4445 if (appl_data) { 4446 wpabuf_free(*appl_data); 4447 *appl_data = NULL; 4448 } 4449 wpabuf_free(out_data); 4450 return NULL; 4451 } 4452 4453 return out_data; 4454 } 4455 4456 4457 struct wpabuf * 4458 tls_connection_handshake(void *ssl_ctx, struct tls_connection *conn, 4459 const struct wpabuf *in_data, 4460 struct wpabuf **appl_data) 4461 { 4462 return openssl_connection_handshake(conn, in_data, appl_data); 4463 } 4464 4465 4466 struct wpabuf * tls_connection_server_handshake(void *tls_ctx, 4467 struct tls_connection *conn, 4468 const struct wpabuf *in_data, 4469 struct wpabuf **appl_data) 4470 { 4471 conn->server = 1; 4472 return openssl_connection_handshake(conn, in_data, appl_data); 4473 } 4474 4475 4476 struct wpabuf * tls_connection_encrypt(void *tls_ctx, 4477 struct tls_connection *conn, 4478 const struct wpabuf *in_data) 4479 { 4480 int res; 4481 struct wpabuf *buf; 4482 4483 if (conn == NULL) 4484 return NULL; 4485 4486 /* Give plaintext data for OpenSSL to encrypt into the TLS tunnel. */ 4487 if ((res = BIO_reset(conn->ssl_in)) < 0 || 4488 (res = BIO_reset(conn->ssl_out)) < 0) { 4489 tls_show_errors(MSG_INFO, __func__, "BIO_reset failed"); 4490 return NULL; 4491 } 4492 res = SSL_write(conn->ssl, wpabuf_head(in_data), wpabuf_len(in_data)); 4493 if (res < 0) { 4494 tls_show_errors(MSG_INFO, __func__, 4495 "Encryption failed - SSL_write"); 4496 return NULL; 4497 } 4498 4499 /* Read encrypted data to be sent to the server */ 4500 buf = wpabuf_alloc(wpabuf_len(in_data) + 300); 4501 if (buf == NULL) 4502 return NULL; 4503 res = BIO_read(conn->ssl_out, wpabuf_mhead(buf), wpabuf_size(buf)); 4504 if (res < 0) { 4505 tls_show_errors(MSG_INFO, __func__, 4506 "Encryption failed - BIO_read"); 4507 wpabuf_free(buf); 4508 return NULL; 4509 } 4510 wpabuf_put(buf, res); 4511 4512 return buf; 4513 } 4514 4515 4516 struct wpabuf * tls_connection_decrypt(void *tls_ctx, 4517 struct tls_connection *conn, 4518 const struct wpabuf *in_data) 4519 { 4520 int res; 4521 struct wpabuf *buf; 4522 4523 /* Give encrypted data from TLS tunnel for OpenSSL to decrypt. */ 4524 res = BIO_write(conn->ssl_in, wpabuf_head(in_data), 4525 wpabuf_len(in_data)); 4526 if (res < 0) { 4527 tls_show_errors(MSG_INFO, __func__, 4528 "Decryption failed - BIO_write"); 4529 return NULL; 4530 } 4531 if (BIO_reset(conn->ssl_out) < 0) { 4532 tls_show_errors(MSG_INFO, __func__, "BIO_reset failed"); 4533 return NULL; 4534 } 4535 4536 /* Read decrypted data for further processing */ 4537 /* 4538 * Even though we try to disable TLS compression, it is possible that 4539 * this cannot be done with all TLS libraries. Add extra buffer space 4540 * to handle the possibility of the decrypted data being longer than 4541 * input data. 4542 */ 4543 buf = wpabuf_alloc((wpabuf_len(in_data) + 500) * 3); 4544 if (buf == NULL) 4545 return NULL; 4546 res = SSL_read(conn->ssl, wpabuf_mhead(buf), wpabuf_size(buf)); 4547 if (res < 0) { 4548 int err = SSL_get_error(conn->ssl, res); 4549 4550 if (err == SSL_ERROR_WANT_READ) { 4551 wpa_printf(MSG_DEBUG, 4552 "SSL: SSL_connect - want more data"); 4553 res = 0; 4554 } else { 4555 tls_show_errors(MSG_INFO, __func__, 4556 "Decryption failed - SSL_read"); 4557 wpabuf_free(buf); 4558 return NULL; 4559 } 4560 } 4561 wpabuf_put(buf, res); 4562 4563 if (conn->invalid_hb_used) { 4564 wpa_printf(MSG_INFO, "TLS: Heartbeat attack detected - do not send response"); 4565 wpabuf_free(buf); 4566 return NULL; 4567 } 4568 4569 return buf; 4570 } 4571 4572 4573 int tls_connection_resumed(void *ssl_ctx, struct tls_connection *conn) 4574 { 4575 return conn ? SSL_session_reused(conn->ssl) : 0; 4576 } 4577 4578 4579 int tls_connection_set_cipher_list(void *tls_ctx, struct tls_connection *conn, 4580 u8 *ciphers) 4581 { 4582 char buf[500], *pos, *end; 4583 u8 *c; 4584 int ret; 4585 4586 if (conn == NULL || conn->ssl == NULL || ciphers == NULL) 4587 return -1; 4588 4589 buf[0] = '\0'; 4590 pos = buf; 4591 end = pos + sizeof(buf); 4592 4593 c = ciphers; 4594 while (*c != TLS_CIPHER_NONE) { 4595 const char *suite; 4596 4597 switch (*c) { 4598 case TLS_CIPHER_RC4_SHA: 4599 suite = "RC4-SHA"; 4600 break; 4601 case TLS_CIPHER_AES128_SHA: 4602 suite = "AES128-SHA"; 4603 break; 4604 case TLS_CIPHER_RSA_DHE_AES128_SHA: 4605 suite = "DHE-RSA-AES128-SHA"; 4606 break; 4607 case TLS_CIPHER_ANON_DH_AES128_SHA: 4608 suite = "ADH-AES128-SHA"; 4609 break; 4610 case TLS_CIPHER_RSA_DHE_AES256_SHA: 4611 suite = "DHE-RSA-AES256-SHA"; 4612 break; 4613 case TLS_CIPHER_AES256_SHA: 4614 suite = "AES256-SHA"; 4615 break; 4616 default: 4617 wpa_printf(MSG_DEBUG, "TLS: Unsupported " 4618 "cipher selection: %d", *c); 4619 return -1; 4620 } 4621 ret = os_snprintf(pos, end - pos, ":%s", suite); 4622 if (os_snprintf_error(end - pos, ret)) 4623 break; 4624 pos += ret; 4625 4626 c++; 4627 } 4628 if (!buf[0]) { 4629 wpa_printf(MSG_DEBUG, "OpenSSL: No ciphers listed"); 4630 return -1; 4631 } 4632 4633 wpa_printf(MSG_DEBUG, "OpenSSL: cipher suites: %s", buf + 1); 4634 4635 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER) 4636 #ifdef EAP_FAST_OR_TEAP 4637 if (os_strstr(buf, ":ADH-")) { 4638 /* 4639 * Need to drop to security level 0 to allow anonymous 4640 * cipher suites for EAP-FAST. 4641 */ 4642 SSL_set_security_level(conn->ssl, 0); 4643 } else if (SSL_get_security_level(conn->ssl) == 0) { 4644 /* Force at least security level 1 */ 4645 SSL_set_security_level(conn->ssl, 1); 4646 } 4647 #endif /* EAP_FAST_OR_TEAP */ 4648 #endif 4649 4650 if (SSL_set_cipher_list(conn->ssl, buf + 1) != 1) { 4651 tls_show_errors(MSG_INFO, __func__, 4652 "Cipher suite configuration failed"); 4653 return -1; 4654 } 4655 4656 return 0; 4657 } 4658 4659 4660 int tls_get_version(void *ssl_ctx, struct tls_connection *conn, 4661 char *buf, size_t buflen) 4662 { 4663 const char *name; 4664 if (conn == NULL || conn->ssl == NULL) 4665 return -1; 4666 4667 name = SSL_get_version(conn->ssl); 4668 if (name == NULL) 4669 return -1; 4670 4671 os_strlcpy(buf, name, buflen); 4672 return 0; 4673 } 4674 4675 4676 int tls_get_cipher(void *ssl_ctx, struct tls_connection *conn, 4677 char *buf, size_t buflen) 4678 { 4679 const char *name; 4680 if (conn == NULL || conn->ssl == NULL) 4681 return -1; 4682 4683 name = SSL_get_cipher(conn->ssl); 4684 if (name == NULL) 4685 return -1; 4686 4687 os_strlcpy(buf, name, buflen); 4688 return 0; 4689 } 4690 4691 4692 int tls_connection_enable_workaround(void *ssl_ctx, 4693 struct tls_connection *conn) 4694 { 4695 SSL_set_options(conn->ssl, SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS); 4696 4697 return 0; 4698 } 4699 4700 4701 #ifdef EAP_FAST_OR_TEAP 4702 /* ClientHello TLS extensions require a patch to openssl, so this function is 4703 * commented out unless explicitly needed for EAP-FAST in order to be able to 4704 * build this file with unmodified openssl. */ 4705 int tls_connection_client_hello_ext(void *ssl_ctx, struct tls_connection *conn, 4706 int ext_type, const u8 *data, 4707 size_t data_len) 4708 { 4709 if (conn == NULL || conn->ssl == NULL || ext_type != 35) 4710 return -1; 4711 4712 if (SSL_set_session_ticket_ext(conn->ssl, (void *) data, 4713 data_len) != 1) 4714 return -1; 4715 4716 return 0; 4717 } 4718 #endif /* EAP_FAST_OR_TEAP */ 4719 4720 4721 int tls_connection_get_failed(void *ssl_ctx, struct tls_connection *conn) 4722 { 4723 if (conn == NULL) 4724 return -1; 4725 return conn->failed; 4726 } 4727 4728 4729 int tls_connection_get_read_alerts(void *ssl_ctx, struct tls_connection *conn) 4730 { 4731 if (conn == NULL) 4732 return -1; 4733 return conn->read_alerts; 4734 } 4735 4736 4737 int tls_connection_get_write_alerts(void *ssl_ctx, struct tls_connection *conn) 4738 { 4739 if (conn == NULL) 4740 return -1; 4741 return conn->write_alerts; 4742 } 4743 4744 4745 #ifdef HAVE_OCSP 4746 4747 static void ocsp_debug_print_resp(OCSP_RESPONSE *rsp) 4748 { 4749 #ifndef CONFIG_NO_STDOUT_DEBUG 4750 BIO *out; 4751 size_t rlen; 4752 char *txt; 4753 int res; 4754 4755 if (wpa_debug_level > MSG_DEBUG) 4756 return; 4757 4758 out = BIO_new(BIO_s_mem()); 4759 if (!out) 4760 return; 4761 4762 OCSP_RESPONSE_print(out, rsp, 0); 4763 rlen = BIO_ctrl_pending(out); 4764 txt = os_malloc(rlen + 1); 4765 if (!txt) { 4766 BIO_free(out); 4767 return; 4768 } 4769 4770 res = BIO_read(out, txt, rlen); 4771 if (res > 0) { 4772 txt[res] = '\0'; 4773 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP Response\n%s", txt); 4774 } 4775 os_free(txt); 4776 BIO_free(out); 4777 #endif /* CONFIG_NO_STDOUT_DEBUG */ 4778 } 4779 4780 4781 static int ocsp_resp_cb(SSL *s, void *arg) 4782 { 4783 struct tls_connection *conn = arg; 4784 const unsigned char *p; 4785 int len, status, reason, res; 4786 OCSP_RESPONSE *rsp; 4787 OCSP_BASICRESP *basic; 4788 OCSP_CERTID *id; 4789 ASN1_GENERALIZEDTIME *produced_at, *this_update, *next_update; 4790 X509_STORE *store; 4791 STACK_OF(X509) *certs = NULL; 4792 4793 len = SSL_get_tlsext_status_ocsp_resp(s, &p); 4794 if (!p) { 4795 wpa_printf(MSG_DEBUG, "OpenSSL: No OCSP response received"); 4796 return (conn->flags & TLS_CONN_REQUIRE_OCSP) ? 0 : 1; 4797 } 4798 4799 wpa_hexdump(MSG_DEBUG, "OpenSSL: OCSP response", p, len); 4800 4801 rsp = d2i_OCSP_RESPONSE(NULL, &p, len); 4802 if (!rsp) { 4803 wpa_printf(MSG_INFO, "OpenSSL: Failed to parse OCSP response"); 4804 return 0; 4805 } 4806 4807 ocsp_debug_print_resp(rsp); 4808 4809 status = OCSP_response_status(rsp); 4810 if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL) { 4811 wpa_printf(MSG_INFO, "OpenSSL: OCSP responder error %d (%s)", 4812 status, OCSP_response_status_str(status)); 4813 return 0; 4814 } 4815 4816 basic = OCSP_response_get1_basic(rsp); 4817 if (!basic) { 4818 wpa_printf(MSG_INFO, "OpenSSL: Could not find BasicOCSPResponse"); 4819 return 0; 4820 } 4821 4822 store = SSL_CTX_get_cert_store(conn->ssl_ctx); 4823 if (conn->peer_issuer) { 4824 debug_print_cert(conn->peer_issuer, "Add OCSP issuer"); 4825 4826 if (X509_STORE_add_cert(store, conn->peer_issuer) != 1) { 4827 tls_show_errors(MSG_INFO, __func__, 4828 "OpenSSL: Could not add issuer to certificate store"); 4829 } 4830 certs = sk_X509_new_null(); 4831 if (certs) { 4832 X509 *cert; 4833 cert = X509_dup(conn->peer_issuer); 4834 if (cert && !sk_X509_push(certs, cert)) { 4835 tls_show_errors( 4836 MSG_INFO, __func__, 4837 "OpenSSL: Could not add issuer to OCSP responder trust store"); 4838 X509_free(cert); 4839 sk_X509_free(certs); 4840 certs = NULL; 4841 } 4842 if (certs && conn->peer_issuer_issuer) { 4843 cert = X509_dup(conn->peer_issuer_issuer); 4844 if (cert && !sk_X509_push(certs, cert)) { 4845 tls_show_errors( 4846 MSG_INFO, __func__, 4847 "OpenSSL: Could not add issuer's issuer to OCSP responder trust store"); 4848 X509_free(cert); 4849 } 4850 } 4851 } 4852 } 4853 4854 status = OCSP_basic_verify(basic, certs, store, OCSP_TRUSTOTHER); 4855 sk_X509_pop_free(certs, X509_free); 4856 if (status <= 0) { 4857 tls_show_errors(MSG_INFO, __func__, 4858 "OpenSSL: OCSP response failed verification"); 4859 OCSP_BASICRESP_free(basic); 4860 OCSP_RESPONSE_free(rsp); 4861 return 0; 4862 } 4863 4864 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP response verification succeeded"); 4865 4866 if (!conn->peer_cert) { 4867 wpa_printf(MSG_DEBUG, "OpenSSL: Peer certificate not available for OCSP status check"); 4868 OCSP_BASICRESP_free(basic); 4869 OCSP_RESPONSE_free(rsp); 4870 return 0; 4871 } 4872 4873 if (!conn->peer_issuer) { 4874 wpa_printf(MSG_DEBUG, "OpenSSL: Peer issuer certificate not available for OCSP status check"); 4875 OCSP_BASICRESP_free(basic); 4876 OCSP_RESPONSE_free(rsp); 4877 return 0; 4878 } 4879 4880 id = OCSP_cert_to_id(EVP_sha256(), conn->peer_cert, conn->peer_issuer); 4881 if (!id) { 4882 wpa_printf(MSG_DEBUG, 4883 "OpenSSL: Could not create OCSP certificate identifier (SHA256)"); 4884 OCSP_BASICRESP_free(basic); 4885 OCSP_RESPONSE_free(rsp); 4886 return 0; 4887 } 4888 4889 res = OCSP_resp_find_status(basic, id, &status, &reason, &produced_at, 4890 &this_update, &next_update); 4891 if (!res) { 4892 OCSP_CERTID_free(id); 4893 id = OCSP_cert_to_id(NULL, conn->peer_cert, conn->peer_issuer); 4894 if (!id) { 4895 wpa_printf(MSG_DEBUG, 4896 "OpenSSL: Could not create OCSP certificate identifier (SHA1)"); 4897 OCSP_BASICRESP_free(basic); 4898 OCSP_RESPONSE_free(rsp); 4899 return 0; 4900 } 4901 4902 res = OCSP_resp_find_status(basic, id, &status, &reason, 4903 &produced_at, &this_update, 4904 &next_update); 4905 } 4906 4907 if (!res) { 4908 wpa_printf(MSG_INFO, "OpenSSL: Could not find current server certificate from OCSP response%s", 4909 (conn->flags & TLS_CONN_REQUIRE_OCSP) ? "" : 4910 " (OCSP not required)"); 4911 OCSP_CERTID_free(id); 4912 OCSP_BASICRESP_free(basic); 4913 OCSP_RESPONSE_free(rsp); 4914 return (conn->flags & TLS_CONN_REQUIRE_OCSP) ? 0 : 1; 4915 } 4916 OCSP_CERTID_free(id); 4917 4918 if (!OCSP_check_validity(this_update, next_update, 5 * 60, -1)) { 4919 tls_show_errors(MSG_INFO, __func__, 4920 "OpenSSL: OCSP status times invalid"); 4921 OCSP_BASICRESP_free(basic); 4922 OCSP_RESPONSE_free(rsp); 4923 return 0; 4924 } 4925 4926 OCSP_BASICRESP_free(basic); 4927 OCSP_RESPONSE_free(rsp); 4928 4929 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status for server certificate: %s", 4930 OCSP_cert_status_str(status)); 4931 4932 if (status == V_OCSP_CERTSTATUS_GOOD) 4933 return 1; 4934 if (status == V_OCSP_CERTSTATUS_REVOKED) 4935 return 0; 4936 if (conn->flags & TLS_CONN_REQUIRE_OCSP) { 4937 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status unknown, but OCSP required"); 4938 return 0; 4939 } 4940 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status unknown, but OCSP was not required, so allow connection to continue"); 4941 return 1; 4942 } 4943 4944 4945 static int ocsp_status_cb(SSL *s, void *arg) 4946 { 4947 char *tmp; 4948 char *resp; 4949 size_t len; 4950 4951 if (tls_global->ocsp_stapling_response == NULL) { 4952 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status callback - no response configured"); 4953 return SSL_TLSEXT_ERR_OK; 4954 } 4955 4956 resp = os_readfile(tls_global->ocsp_stapling_response, &len); 4957 if (resp == NULL) { 4958 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status callback - could not read response file"); 4959 /* TODO: Build OCSPResponse with responseStatus = internalError 4960 */ 4961 return SSL_TLSEXT_ERR_OK; 4962 } 4963 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status callback - send cached response"); 4964 tmp = OPENSSL_malloc(len); 4965 if (tmp == NULL) { 4966 os_free(resp); 4967 return SSL_TLSEXT_ERR_ALERT_FATAL; 4968 } 4969 4970 os_memcpy(tmp, resp, len); 4971 os_free(resp); 4972 SSL_set_tlsext_status_ocsp_resp(s, tmp, len); 4973 4974 return SSL_TLSEXT_ERR_OK; 4975 } 4976 4977 #endif /* HAVE_OCSP */ 4978 4979 4980 static size_t max_str_len(const char **lines) 4981 { 4982 const char **p; 4983 size_t max_len = 0; 4984 4985 for (p = lines; *p; p++) { 4986 size_t len = os_strlen(*p); 4987 4988 if (len > max_len) 4989 max_len = len; 4990 } 4991 4992 return max_len; 4993 } 4994 4995 4996 static int match_lines_in_file(const char *path, const char **lines) 4997 { 4998 FILE *f; 4999 char *buf; 5000 size_t bufsize; 5001 int found = 0, is_linestart = 1; 5002 5003 bufsize = max_str_len(lines) + sizeof("\r\n"); 5004 buf = os_malloc(bufsize); 5005 if (!buf) 5006 return 0; 5007 5008 f = fopen(path, "r"); 5009 if (!f) { 5010 os_free(buf); 5011 return 0; 5012 } 5013 5014 while (!found && fgets(buf, bufsize, f)) { 5015 int is_lineend; 5016 size_t len; 5017 const char **p; 5018 5019 len = strcspn(buf, "\r\n"); 5020 is_lineend = buf[len] != '\0'; 5021 buf[len] = '\0'; 5022 5023 if (is_linestart && is_lineend) { 5024 for (p = lines; !found && *p; p++) 5025 found = os_strcmp(buf, *p) == 0; 5026 } 5027 is_linestart = is_lineend; 5028 } 5029 5030 fclose(f); 5031 bin_clear_free(buf, bufsize); 5032 5033 return found; 5034 } 5035 5036 5037 static int is_tpm2_key(const char *path) 5038 { 5039 /* Check both new and old format of TPM2 PEM guard tag */ 5040 static const char *tpm2_tags[] = { 5041 "-----BEGIN TSS2 PRIVATE KEY-----", 5042 "-----BEGIN TSS2 KEY BLOB-----", 5043 NULL 5044 }; 5045 5046 return match_lines_in_file(path, tpm2_tags); 5047 } 5048 5049 5050 int tls_connection_set_params(void *tls_ctx, struct tls_connection *conn, 5051 const struct tls_connection_params *params) 5052 { 5053 struct tls_data *data = tls_ctx; 5054 int ret; 5055 unsigned long err; 5056 int can_pkcs11 = 0; 5057 const char *key_id = params->key_id; 5058 const char *cert_id = params->cert_id; 5059 const char *ca_cert_id = params->ca_cert_id; 5060 const char *engine_id = params->engine ? params->engine_id : NULL; 5061 const char *ciphers; 5062 5063 if (conn == NULL) 5064 return -1; 5065 5066 if (params->flags & TLS_CONN_REQUIRE_OCSP_ALL) { 5067 wpa_printf(MSG_INFO, 5068 "OpenSSL: ocsp=3 not supported"); 5069 return -1; 5070 } 5071 5072 /* 5073 * If the engine isn't explicitly configured, and any of the 5074 * cert/key fields are actually PKCS#11 URIs, then automatically 5075 * use the PKCS#11 ENGINE. 5076 */ 5077 if (!engine_id || os_strcmp(engine_id, "pkcs11") == 0) 5078 can_pkcs11 = 1; 5079 5080 if (!key_id && params->private_key && can_pkcs11 && 5081 os_strncmp(params->private_key, "pkcs11:", 7) == 0) { 5082 can_pkcs11 = 2; 5083 key_id = params->private_key; 5084 } 5085 5086 if (!cert_id && params->client_cert && can_pkcs11 && 5087 os_strncmp(params->client_cert, "pkcs11:", 7) == 0) { 5088 can_pkcs11 = 2; 5089 cert_id = params->client_cert; 5090 } 5091 5092 if (!ca_cert_id && params->ca_cert && can_pkcs11 && 5093 os_strncmp(params->ca_cert, "pkcs11:", 7) == 0) { 5094 can_pkcs11 = 2; 5095 ca_cert_id = params->ca_cert; 5096 } 5097 5098 /* If we need to automatically enable the PKCS#11 ENGINE, do so. */ 5099 if (can_pkcs11 == 2 && !engine_id) 5100 engine_id = "pkcs11"; 5101 5102 /* If private_key points to a TPM2-wrapped key, automatically enable 5103 * tpm2 engine and use it to unwrap the key. */ 5104 if (params->private_key && 5105 (!engine_id || os_strcmp(engine_id, "tpm2") == 0) && 5106 is_tpm2_key(params->private_key)) { 5107 wpa_printf(MSG_DEBUG, "OpenSSL: Found TPM2 wrapped key %s", 5108 params->private_key); 5109 key_id = key_id ? key_id : params->private_key; 5110 engine_id = engine_id ? engine_id : "tpm2"; 5111 } 5112 5113 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST) 5114 #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) 5115 if (params->flags & TLS_CONN_EAP_FAST) { 5116 wpa_printf(MSG_DEBUG, 5117 "OpenSSL: Use TLSv1_method() for EAP-FAST"); 5118 if (SSL_set_ssl_method(conn->ssl, TLSv1_method()) != 1) { 5119 tls_show_errors(MSG_INFO, __func__, 5120 "Failed to set TLSv1_method() for EAP-FAST"); 5121 return -1; 5122 } 5123 } 5124 #endif 5125 #if OPENSSL_VERSION_NUMBER >= 0x10101000L 5126 #ifdef SSL_OP_NO_TLSv1_3 5127 if (params->flags & TLS_CONN_EAP_FAST) { 5128 /* Need to disable TLS v1.3 at least for now since OpenSSL 1.1.1 5129 * refuses to start the handshake with the modified ciphersuite 5130 * list (no TLS v1.3 ciphersuites included) for EAP-FAST. */ 5131 wpa_printf(MSG_DEBUG, "OpenSSL: Disable TLSv1.3 for EAP-FAST"); 5132 SSL_set_options(conn->ssl, SSL_OP_NO_TLSv1_3); 5133 } 5134 #endif /* SSL_OP_NO_TLSv1_3 */ 5135 #endif 5136 #endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */ 5137 5138 while ((err = ERR_get_error())) { 5139 wpa_printf(MSG_INFO, "%s: Clearing pending SSL error: %s", 5140 __func__, ERR_error_string(err, NULL)); 5141 } 5142 5143 if (engine_id) { 5144 wpa_printf(MSG_DEBUG, "SSL: Initializing TLS engine %s", 5145 engine_id); 5146 ret = tls_engine_init(conn, engine_id, params->pin, 5147 key_id, cert_id, ca_cert_id); 5148 if (ret) 5149 return ret; 5150 } 5151 if (tls_connection_set_subject_match(conn, 5152 params->subject_match, 5153 params->altsubject_match, 5154 params->suffix_match, 5155 params->domain_match, 5156 params->check_cert_subject)) 5157 return -1; 5158 5159 if (engine_id && ca_cert_id) { 5160 if (tls_connection_engine_ca_cert(data, conn, ca_cert_id)) 5161 return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED; 5162 } else if (tls_connection_ca_cert(data, conn, params->ca_cert, 5163 params->ca_cert_blob, 5164 params->ca_cert_blob_len, 5165 params->ca_path)) 5166 return -1; 5167 5168 if (engine_id && cert_id) { 5169 if (tls_connection_engine_client_cert(conn, cert_id)) 5170 return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED; 5171 } else if (tls_connection_client_cert(conn, params->client_cert, 5172 params->client_cert_blob, 5173 params->client_cert_blob_len)) 5174 return -1; 5175 5176 if (engine_id && key_id) { 5177 wpa_printf(MSG_DEBUG, "TLS: Using private key from engine"); 5178 if (tls_connection_engine_private_key(conn)) 5179 return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED; 5180 } else if (tls_connection_private_key(data, conn, 5181 params->private_key, 5182 params->private_key_passwd, 5183 params->private_key_blob, 5184 params->private_key_blob_len)) { 5185 wpa_printf(MSG_INFO, "TLS: Failed to load private key '%s'", 5186 params->private_key); 5187 return -1; 5188 } 5189 5190 if (tls_connection_dh(conn, params->dh_file)) { 5191 wpa_printf(MSG_INFO, "TLS: Failed to load DH file '%s'", 5192 params->dh_file); 5193 return -1; 5194 } 5195 5196 ciphers = params->openssl_ciphers; 5197 #ifdef CONFIG_SUITEB 5198 #ifdef OPENSSL_IS_BORINGSSL 5199 if (ciphers && os_strcmp(ciphers, "SUITEB192") == 0) { 5200 /* BoringSSL removed support for SUITEB192, so need to handle 5201 * this with hardcoded ciphersuite and additional checks for 5202 * other parameters. */ 5203 ciphers = "ECDHE-ECDSA-AES256-GCM-SHA384"; 5204 } 5205 #endif /* OPENSSL_IS_BORINGSSL */ 5206 #endif /* CONFIG_SUITEB */ 5207 if (ciphers && SSL_set_cipher_list(conn->ssl, ciphers) != 1) { 5208 wpa_printf(MSG_INFO, 5209 "OpenSSL: Failed to set cipher string '%s'", 5210 ciphers); 5211 return -1; 5212 } 5213 5214 if (!params->openssl_ecdh_curves) { 5215 #ifndef OPENSSL_IS_BORINGSSL 5216 #ifndef OPENSSL_NO_EC 5217 #if (OPENSSL_VERSION_NUMBER >= 0x10002000L) && \ 5218 (OPENSSL_VERSION_NUMBER < 0x10100000L) 5219 if (SSL_set_ecdh_auto(conn->ssl, 1) != 1) { 5220 wpa_printf(MSG_INFO, 5221 "OpenSSL: Failed to set ECDH curves to auto"); 5222 return -1; 5223 } 5224 #endif /* >= 1.0.2 && < 1.1.0 */ 5225 #endif /* OPENSSL_NO_EC */ 5226 #endif /* OPENSSL_IS_BORINGSSL */ 5227 } else if (params->openssl_ecdh_curves[0]) { 5228 #if defined(OPENSSL_IS_BORINGSSL) || (OPENSSL_VERSION_NUMBER < 0x10002000L) 5229 wpa_printf(MSG_INFO, 5230 "OpenSSL: ECDH configuration nnot supported"); 5231 return -1; 5232 #else /* OPENSSL_IS_BORINGSSL || < 1.0.2 */ 5233 #ifndef OPENSSL_NO_EC 5234 if (SSL_set1_curves_list(conn->ssl, 5235 params->openssl_ecdh_curves) != 1) { 5236 wpa_printf(MSG_INFO, 5237 "OpenSSL: Failed to set ECDH curves '%s'", 5238 params->openssl_ecdh_curves); 5239 return -1; 5240 } 5241 #else /* OPENSSL_NO_EC */ 5242 wpa_printf(MSG_INFO, "OpenSSL: ECDH not supported"); 5243 return -1; 5244 #endif /* OPENSSL_NO_EC */ 5245 #endif /* OPENSSL_IS_BORINGSSL */ 5246 } 5247 5248 if (tls_set_conn_flags(conn, params->flags, 5249 params->openssl_ciphers) < 0) 5250 return -1; 5251 5252 #ifdef OPENSSL_IS_BORINGSSL 5253 if (params->flags & TLS_CONN_REQUEST_OCSP) { 5254 SSL_enable_ocsp_stapling(conn->ssl); 5255 } 5256 #else /* OPENSSL_IS_BORINGSSL */ 5257 #ifdef HAVE_OCSP 5258 if (params->flags & TLS_CONN_REQUEST_OCSP) { 5259 SSL_CTX *ssl_ctx = data->ssl; 5260 SSL_set_tlsext_status_type(conn->ssl, TLSEXT_STATUSTYPE_ocsp); 5261 SSL_CTX_set_tlsext_status_cb(ssl_ctx, ocsp_resp_cb); 5262 SSL_CTX_set_tlsext_status_arg(ssl_ctx, conn); 5263 } 5264 #else /* HAVE_OCSP */ 5265 if (params->flags & TLS_CONN_REQUIRE_OCSP) { 5266 wpa_printf(MSG_INFO, 5267 "OpenSSL: No OCSP support included - reject configuration"); 5268 return -1; 5269 } 5270 if (params->flags & TLS_CONN_REQUEST_OCSP) { 5271 wpa_printf(MSG_DEBUG, 5272 "OpenSSL: No OCSP support included - allow optional OCSP case to continue"); 5273 } 5274 #endif /* HAVE_OCSP */ 5275 #endif /* OPENSSL_IS_BORINGSSL */ 5276 5277 conn->flags = params->flags; 5278 5279 tls_get_errors(data); 5280 5281 return 0; 5282 } 5283 5284 5285 static void openssl_debug_dump_cipher_list(SSL_CTX *ssl_ctx) 5286 { 5287 SSL *ssl; 5288 int i; 5289 5290 ssl = SSL_new(ssl_ctx); 5291 if (!ssl) 5292 return; 5293 5294 wpa_printf(MSG_DEBUG, 5295 "OpenSSL: Enabled cipher suites in priority order"); 5296 for (i = 0; ; i++) { 5297 const char *cipher; 5298 5299 cipher = SSL_get_cipher_list(ssl, i); 5300 if (!cipher) 5301 break; 5302 wpa_printf(MSG_DEBUG, "Cipher %d: %s", i, cipher); 5303 } 5304 5305 SSL_free(ssl); 5306 } 5307 5308 5309 #if !defined(LIBRESSL_VERSION_NUMBER) && !defined(BORINGSSL_API_VERSION) 5310 5311 static const char * openssl_pkey_type_str(const EVP_PKEY *pkey) 5312 { 5313 if (!pkey) 5314 return "NULL"; 5315 switch (EVP_PKEY_type(EVP_PKEY_id(pkey))) { 5316 case EVP_PKEY_RSA: 5317 return "RSA"; 5318 case EVP_PKEY_DSA: 5319 return "DSA"; 5320 case EVP_PKEY_DH: 5321 return "DH"; 5322 case EVP_PKEY_EC: 5323 return "EC"; 5324 } 5325 return "?"; 5326 } 5327 5328 5329 static void openssl_debug_dump_certificate(int i, X509 *cert) 5330 { 5331 char buf[256]; 5332 EVP_PKEY *pkey; 5333 ASN1_INTEGER *ser; 5334 char serial_num[128]; 5335 5336 if (!cert) 5337 return; 5338 5339 X509_NAME_oneline(X509_get_subject_name(cert), buf, sizeof(buf)); 5340 5341 ser = X509_get_serialNumber(cert); 5342 if (ser) 5343 wpa_snprintf_hex_uppercase(serial_num, sizeof(serial_num), 5344 ASN1_STRING_get0_data(ser), 5345 ASN1_STRING_length(ser)); 5346 else 5347 serial_num[0] = '\0'; 5348 5349 pkey = X509_get_pubkey(cert); 5350 wpa_printf(MSG_DEBUG, "%d: %s (%s) %s", i, buf, 5351 openssl_pkey_type_str(pkey), serial_num); 5352 EVP_PKEY_free(pkey); 5353 } 5354 5355 5356 static void openssl_debug_dump_certificates(SSL_CTX *ssl_ctx) 5357 { 5358 STACK_OF(X509) *certs; 5359 5360 wpa_printf(MSG_DEBUG, "OpenSSL: Configured certificate chain"); 5361 if (SSL_CTX_get0_chain_certs(ssl_ctx, &certs) == 1) { 5362 int i; 5363 5364 for (i = sk_X509_num(certs); i > 0; i--) 5365 openssl_debug_dump_certificate(i, sk_X509_value(certs, 5366 i - 1)); 5367 } 5368 openssl_debug_dump_certificate(0, SSL_CTX_get0_certificate(ssl_ctx)); 5369 } 5370 5371 #endif 5372 5373 5374 static void openssl_debug_dump_certificate_chains(SSL_CTX *ssl_ctx) 5375 { 5376 #if !defined(LIBRESSL_VERSION_NUMBER) && !defined(BORINGSSL_API_VERSION) 5377 int res; 5378 5379 for (res = SSL_CTX_set_current_cert(ssl_ctx, SSL_CERT_SET_FIRST); 5380 res == 1; 5381 res = SSL_CTX_set_current_cert(ssl_ctx, SSL_CERT_SET_NEXT)) 5382 openssl_debug_dump_certificates(ssl_ctx); 5383 5384 SSL_CTX_set_current_cert(ssl_ctx, SSL_CERT_SET_FIRST); 5385 #endif 5386 } 5387 5388 5389 static void openssl_debug_dump_ctx(SSL_CTX *ssl_ctx) 5390 { 5391 openssl_debug_dump_cipher_list(ssl_ctx); 5392 openssl_debug_dump_certificate_chains(ssl_ctx); 5393 } 5394 5395 5396 int tls_global_set_params(void *tls_ctx, 5397 const struct tls_connection_params *params) 5398 { 5399 struct tls_data *data = tls_ctx; 5400 SSL_CTX *ssl_ctx = data->ssl; 5401 unsigned long err; 5402 5403 while ((err = ERR_get_error())) { 5404 wpa_printf(MSG_INFO, "%s: Clearing pending SSL error: %s", 5405 __func__, ERR_error_string(err, NULL)); 5406 } 5407 5408 os_free(data->check_cert_subject); 5409 data->check_cert_subject = NULL; 5410 if (params->check_cert_subject) { 5411 data->check_cert_subject = 5412 os_strdup(params->check_cert_subject); 5413 if (!data->check_cert_subject) 5414 return -1; 5415 } 5416 5417 if (tls_global_ca_cert(data, params->ca_cert) || 5418 tls_global_client_cert(data, params->client_cert) || 5419 tls_global_private_key(data, params->private_key, 5420 params->private_key_passwd) || 5421 tls_global_client_cert(data, params->client_cert2) || 5422 tls_global_private_key(data, params->private_key2, 5423 params->private_key_passwd2) || 5424 tls_global_dh(data, params->dh_file)) { 5425 wpa_printf(MSG_INFO, "TLS: Failed to set global parameters"); 5426 return -1; 5427 } 5428 5429 if (params->openssl_ciphers && 5430 SSL_CTX_set_cipher_list(ssl_ctx, params->openssl_ciphers) != 1) { 5431 wpa_printf(MSG_INFO, 5432 "OpenSSL: Failed to set cipher string '%s'", 5433 params->openssl_ciphers); 5434 return -1; 5435 } 5436 5437 if (!params->openssl_ecdh_curves) { 5438 #ifndef OPENSSL_IS_BORINGSSL 5439 #ifndef OPENSSL_NO_EC 5440 #if (OPENSSL_VERSION_NUMBER >= 0x10002000L) && \ 5441 (OPENSSL_VERSION_NUMBER < 0x10100000L) 5442 if (SSL_CTX_set_ecdh_auto(ssl_ctx, 1) != 1) { 5443 wpa_printf(MSG_INFO, 5444 "OpenSSL: Failed to set ECDH curves to auto"); 5445 return -1; 5446 } 5447 #endif /* >= 1.0.2 && < 1.1.0 */ 5448 #endif /* OPENSSL_NO_EC */ 5449 #endif /* OPENSSL_IS_BORINGSSL */ 5450 } else if (params->openssl_ecdh_curves[0]) { 5451 #if defined(OPENSSL_IS_BORINGSSL) || (OPENSSL_VERSION_NUMBER < 0x10002000L) 5452 wpa_printf(MSG_INFO, 5453 "OpenSSL: ECDH configuration nnot supported"); 5454 return -1; 5455 #else /* OPENSSL_IS_BORINGSSL || < 1.0.2 */ 5456 #ifndef OPENSSL_NO_EC 5457 #if OPENSSL_VERSION_NUMBER < 0x10100000L 5458 SSL_CTX_set_ecdh_auto(ssl_ctx, 1); 5459 #endif 5460 if (SSL_CTX_set1_curves_list(ssl_ctx, 5461 params->openssl_ecdh_curves) != 5462 1) { 5463 wpa_printf(MSG_INFO, 5464 "OpenSSL: Failed to set ECDH curves '%s'", 5465 params->openssl_ecdh_curves); 5466 return -1; 5467 } 5468 #else /* OPENSSL_NO_EC */ 5469 wpa_printf(MSG_INFO, "OpenSSL: ECDH not supported"); 5470 return -1; 5471 #endif /* OPENSSL_NO_EC */ 5472 #endif /* OPENSSL_IS_BORINGSSL */ 5473 } 5474 5475 #ifdef SSL_OP_NO_TICKET 5476 if (params->flags & TLS_CONN_DISABLE_SESSION_TICKET) 5477 SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_TICKET); 5478 else 5479 SSL_CTX_clear_options(ssl_ctx, SSL_OP_NO_TICKET); 5480 #endif /* SSL_OP_NO_TICKET */ 5481 5482 #ifdef HAVE_OCSP 5483 SSL_CTX_set_tlsext_status_cb(ssl_ctx, ocsp_status_cb); 5484 SSL_CTX_set_tlsext_status_arg(ssl_ctx, ssl_ctx); 5485 os_free(tls_global->ocsp_stapling_response); 5486 if (params->ocsp_stapling_response) 5487 tls_global->ocsp_stapling_response = 5488 os_strdup(params->ocsp_stapling_response); 5489 else 5490 tls_global->ocsp_stapling_response = NULL; 5491 #endif /* HAVE_OCSP */ 5492 5493 openssl_debug_dump_ctx(ssl_ctx); 5494 5495 return 0; 5496 } 5497 5498 5499 #ifdef EAP_FAST_OR_TEAP 5500 /* Pre-shared secred requires a patch to openssl, so this function is 5501 * commented out unless explicitly needed for EAP-FAST in order to be able to 5502 * build this file with unmodified openssl. */ 5503 5504 #if (defined(OPENSSL_IS_BORINGSSL) || OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined(LIBRESSL_VERSION_NUMBER) 5505 static int tls_sess_sec_cb(SSL *s, void *secret, int *secret_len, 5506 STACK_OF(SSL_CIPHER) *peer_ciphers, 5507 const SSL_CIPHER **cipher, void *arg) 5508 #else /* OPENSSL_IS_BORINGSSL */ 5509 static int tls_sess_sec_cb(SSL *s, void *secret, int *secret_len, 5510 STACK_OF(SSL_CIPHER) *peer_ciphers, 5511 SSL_CIPHER **cipher, void *arg) 5512 #endif /* OPENSSL_IS_BORINGSSL */ 5513 { 5514 struct tls_connection *conn = arg; 5515 int ret; 5516 5517 #if OPENSSL_VERSION_NUMBER < 0x10100000L || \ 5518 (defined(LIBRESSL_VERSION_NUMBER) && \ 5519 LIBRESSL_VERSION_NUMBER < 0x20700000L) 5520 if (conn == NULL || conn->session_ticket_cb == NULL) 5521 return 0; 5522 5523 ret = conn->session_ticket_cb(conn->session_ticket_cb_ctx, 5524 conn->session_ticket, 5525 conn->session_ticket_len, 5526 s->s3->client_random, 5527 s->s3->server_random, secret); 5528 #else 5529 unsigned char client_random[SSL3_RANDOM_SIZE]; 5530 unsigned char server_random[SSL3_RANDOM_SIZE]; 5531 5532 if (conn == NULL || conn->session_ticket_cb == NULL) 5533 return 0; 5534 5535 SSL_get_client_random(s, client_random, sizeof(client_random)); 5536 SSL_get_server_random(s, server_random, sizeof(server_random)); 5537 5538 ret = conn->session_ticket_cb(conn->session_ticket_cb_ctx, 5539 conn->session_ticket, 5540 conn->session_ticket_len, 5541 client_random, 5542 server_random, secret); 5543 #endif 5544 5545 os_free(conn->session_ticket); 5546 conn->session_ticket = NULL; 5547 5548 if (ret <= 0) 5549 return 0; 5550 5551 *secret_len = SSL_MAX_MASTER_KEY_LENGTH; 5552 return 1; 5553 } 5554 5555 5556 static int tls_session_ticket_ext_cb(SSL *s, const unsigned char *data, 5557 int len, void *arg) 5558 { 5559 struct tls_connection *conn = arg; 5560 5561 if (conn == NULL || conn->session_ticket_cb == NULL) 5562 return 0; 5563 5564 wpa_printf(MSG_DEBUG, "OpenSSL: %s: length=%d", __func__, len); 5565 5566 os_free(conn->session_ticket); 5567 conn->session_ticket = NULL; 5568 5569 wpa_hexdump(MSG_DEBUG, "OpenSSL: ClientHello SessionTicket " 5570 "extension", data, len); 5571 5572 conn->session_ticket = os_memdup(data, len); 5573 if (conn->session_ticket == NULL) 5574 return 0; 5575 5576 conn->session_ticket_len = len; 5577 5578 return 1; 5579 } 5580 #endif /* EAP_FAST_OR_TEAP */ 5581 5582 5583 int tls_connection_set_session_ticket_cb(void *tls_ctx, 5584 struct tls_connection *conn, 5585 tls_session_ticket_cb cb, 5586 void *ctx) 5587 { 5588 #ifdef EAP_FAST_OR_TEAP 5589 conn->session_ticket_cb = cb; 5590 conn->session_ticket_cb_ctx = ctx; 5591 5592 if (cb) { 5593 if (SSL_set_session_secret_cb(conn->ssl, tls_sess_sec_cb, 5594 conn) != 1) 5595 return -1; 5596 SSL_set_session_ticket_ext_cb(conn->ssl, 5597 tls_session_ticket_ext_cb, conn); 5598 } else { 5599 if (SSL_set_session_secret_cb(conn->ssl, NULL, NULL) != 1) 5600 return -1; 5601 SSL_set_session_ticket_ext_cb(conn->ssl, NULL, NULL); 5602 } 5603 5604 return 0; 5605 #else /* EAP_FAST_OR_TEAP */ 5606 return -1; 5607 #endif /* EAP_FAST_OR_TEAP */ 5608 } 5609 5610 5611 int tls_get_library_version(char *buf, size_t buf_len) 5612 { 5613 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER) 5614 return os_snprintf(buf, buf_len, "OpenSSL build=%s run=%s", 5615 OPENSSL_VERSION_TEXT, 5616 OpenSSL_version(OPENSSL_VERSION)); 5617 #else 5618 return os_snprintf(buf, buf_len, "OpenSSL build=%s run=%s", 5619 OPENSSL_VERSION_TEXT, 5620 SSLeay_version(SSLEAY_VERSION)); 5621 #endif 5622 } 5623 5624 5625 void tls_connection_set_success_data(struct tls_connection *conn, 5626 struct wpabuf *data) 5627 { 5628 SSL_SESSION *sess; 5629 struct wpabuf *old; 5630 5631 if (tls_ex_idx_session < 0) 5632 goto fail; 5633 sess = SSL_get_session(conn->ssl); 5634 if (!sess) 5635 goto fail; 5636 old = SSL_SESSION_get_ex_data(sess, tls_ex_idx_session); 5637 if (old) { 5638 wpa_printf(MSG_DEBUG, "OpenSSL: Replacing old success data %p", 5639 old); 5640 wpabuf_free(old); 5641 } 5642 if (SSL_SESSION_set_ex_data(sess, tls_ex_idx_session, data) != 1) 5643 goto fail; 5644 5645 wpa_printf(MSG_DEBUG, "OpenSSL: Stored success data %p", data); 5646 conn->success_data = 1; 5647 return; 5648 5649 fail: 5650 wpa_printf(MSG_INFO, "OpenSSL: Failed to store success data"); 5651 wpabuf_free(data); 5652 } 5653 5654 5655 void tls_connection_set_success_data_resumed(struct tls_connection *conn) 5656 { 5657 wpa_printf(MSG_DEBUG, 5658 "OpenSSL: Success data accepted for resumed session"); 5659 conn->success_data = 1; 5660 } 5661 5662 5663 const struct wpabuf * 5664 tls_connection_get_success_data(struct tls_connection *conn) 5665 { 5666 SSL_SESSION *sess; 5667 5668 if (tls_ex_idx_session < 0 || 5669 !(sess = SSL_get_session(conn->ssl))) 5670 return NULL; 5671 return SSL_SESSION_get_ex_data(sess, tls_ex_idx_session); 5672 } 5673 5674 5675 void tls_connection_remove_session(struct tls_connection *conn) 5676 { 5677 SSL_SESSION *sess; 5678 5679 sess = SSL_get_session(conn->ssl); 5680 if (!sess) 5681 return; 5682 5683 if (SSL_CTX_remove_session(conn->ssl_ctx, sess) != 1) 5684 wpa_printf(MSG_DEBUG, 5685 "OpenSSL: Session was not cached"); 5686 else 5687 wpa_printf(MSG_DEBUG, 5688 "OpenSSL: Removed cached session to disable session resumption"); 5689 } 5690 5691 5692 int tls_get_tls_unique(struct tls_connection *conn, u8 *buf, size_t max_len) 5693 { 5694 size_t len; 5695 int reused; 5696 5697 reused = SSL_session_reused(conn->ssl); 5698 if ((conn->server && !reused) || (!conn->server && reused)) 5699 len = SSL_get_peer_finished(conn->ssl, buf, max_len); 5700 else 5701 len = SSL_get_finished(conn->ssl, buf, max_len); 5702 5703 if (len == 0 || len > max_len) 5704 return -1; 5705 5706 return len; 5707 } 5708 5709 5710 u16 tls_connection_get_cipher_suite(struct tls_connection *conn) 5711 { 5712 const SSL_CIPHER *cipher; 5713 5714 cipher = SSL_get_current_cipher(conn->ssl); 5715 if (!cipher) 5716 return 0; 5717 #if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER) 5718 return SSL_CIPHER_get_protocol_id(cipher); 5719 #else 5720 return SSL_CIPHER_get_id(cipher) & 0xFFFF; 5721 #endif 5722 } 5723 5724 5725 const char * tls_connection_get_peer_subject(struct tls_connection *conn) 5726 { 5727 if (conn) 5728 return conn->peer_subject; 5729 return NULL; 5730 } 5731 5732 5733 bool tls_connection_get_own_cert_used(struct tls_connection *conn) 5734 { 5735 if (conn) 5736 return SSL_get_certificate(conn->ssl) != NULL; 5737 return false; 5738 } 5739