2 * EAP-TLS/PEAP/TTLS/FAST server common functions
3 * Copyright (c) 2004-2009, Jouni Malinen <j@w1.fi>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Alternatively, this software may be distributed under the terms of BSD
12 * See README and COPYING for more details.
18 #include "crypto/sha1.h"
19 #include "crypto/tls.h"
21 #include "eap_tls_common.h"
24 static void eap_server_tls_free_in_buf(struct eap_ssl_data *data);
27 int eap_server_tls_ssl_init(struct eap_sm *sm, struct eap_ssl_data *data,
31 data->phase2 = sm->init_phase2;
33 data->conn = tls_connection_init(sm->ssl_ctx);
34 if (data->conn == NULL) {
35 wpa_printf(MSG_INFO, "SSL: Failed to initialize new TLS "
40 if (tls_connection_set_verify(sm->ssl_ctx, data->conn, verify_peer)) {
41 wpa_printf(MSG_INFO, "SSL: Failed to configure verification "
42 "of TLS peer certificate");
43 tls_connection_deinit(sm->ssl_ctx, data->conn);
48 data->tls_out_limit = sm->fragment_size > 0 ? sm->fragment_size : 1398;
50 /* Limit the fragment size in the inner TLS authentication
51 * since the outer authentication with EAP-PEAP does not yet
52 * support fragmentation */
53 if (data->tls_out_limit > 100)
54 data->tls_out_limit -= 100;
60 void eap_server_tls_ssl_deinit(struct eap_sm *sm, struct eap_ssl_data *data)
62 tls_connection_deinit(sm->ssl_ctx, data->conn);
63 eap_server_tls_free_in_buf(data);
64 wpabuf_free(data->tls_out);
69 u8 * eap_server_tls_derive_key(struct eap_sm *sm, struct eap_ssl_data *data,
70 char *label, size_t len)
79 if (tls_connection_prf(sm->ssl_ctx, data->conn, label, 0, out, len) ==
83 if (tls_connection_get_keys(sm->ssl_ctx, data->conn, &keys))
86 if (keys.client_random == NULL || keys.server_random == NULL ||
87 keys.master_key == NULL)
90 rnd = os_malloc(keys.client_random_len + keys.server_random_len);
93 os_memcpy(rnd, keys.client_random, keys.client_random_len);
94 os_memcpy(rnd + keys.client_random_len, keys.server_random,
95 keys.server_random_len);
97 if (tls_prf(keys.master_key, keys.master_key_len,
98 label, rnd, keys.client_random_len +
99 keys.server_random_len, out, len))
112 struct wpabuf * eap_server_tls_build_msg(struct eap_ssl_data *data,
113 int eap_type, int version, u8 id)
117 size_t send_len, plen;
119 wpa_printf(MSG_DEBUG, "SSL: Generating Request");
120 if (data->tls_out == NULL) {
121 wpa_printf(MSG_ERROR, "SSL: tls_out NULL in %s", __func__);
126 send_len = wpabuf_len(data->tls_out) - data->tls_out_pos;
127 if (1 + send_len > data->tls_out_limit) {
128 send_len = data->tls_out_limit - 1;
129 flags |= EAP_TLS_FLAGS_MORE_FRAGMENTS;
130 if (data->tls_out_pos == 0) {
131 flags |= EAP_TLS_FLAGS_LENGTH_INCLUDED;
137 if (flags & EAP_TLS_FLAGS_LENGTH_INCLUDED)
140 req = eap_msg_alloc(EAP_VENDOR_IETF, eap_type, plen,
141 EAP_CODE_REQUEST, id);
145 wpabuf_put_u8(req, flags); /* Flags */
146 if (flags & EAP_TLS_FLAGS_LENGTH_INCLUDED)
147 wpabuf_put_be32(req, wpabuf_len(data->tls_out));
149 wpabuf_put_data(req, wpabuf_head_u8(data->tls_out) + data->tls_out_pos,
151 data->tls_out_pos += send_len;
153 if (data->tls_out_pos == wpabuf_len(data->tls_out)) {
154 wpa_printf(MSG_DEBUG, "SSL: Sending out %lu bytes "
155 "(message sent completely)",
156 (unsigned long) send_len);
157 wpabuf_free(data->tls_out);
158 data->tls_out = NULL;
159 data->tls_out_pos = 0;
162 wpa_printf(MSG_DEBUG, "SSL: Sending out %lu bytes "
163 "(%lu more to send)", (unsigned long) send_len,
164 (unsigned long) wpabuf_len(data->tls_out) -
166 data->state = WAIT_FRAG_ACK;
173 struct wpabuf * eap_server_tls_build_ack(u8 id, int eap_type, int version)
177 req = eap_msg_alloc(EAP_VENDOR_IETF, eap_type, 1, EAP_CODE_REQUEST,
181 wpa_printf(MSG_DEBUG, "SSL: Building ACK");
182 wpabuf_put_u8(req, version); /* Flags */
187 static int eap_server_tls_process_cont(struct eap_ssl_data *data,
188 const u8 *buf, size_t len)
190 /* Process continuation of a pending message */
191 if (len > wpabuf_tailroom(data->tls_in)) {
192 wpa_printf(MSG_DEBUG, "SSL: Fragment overflow");
196 wpabuf_put_data(data->tls_in, buf, len);
197 wpa_printf(MSG_DEBUG, "SSL: Received %lu bytes, waiting for %lu "
198 "bytes more", (unsigned long) len,
199 (unsigned long) wpabuf_tailroom(data->tls_in));
205 static int eap_server_tls_process_fragment(struct eap_ssl_data *data,
206 u8 flags, u32 message_length,
207 const u8 *buf, size_t len)
209 /* Process a fragment that is not the last one of the message */
210 if (data->tls_in == NULL && !(flags & EAP_TLS_FLAGS_LENGTH_INCLUDED)) {
211 wpa_printf(MSG_DEBUG, "SSL: No Message Length field in a "
212 "fragmented packet");
216 if (data->tls_in == NULL) {
217 /* First fragment of the message */
219 /* Limit length to avoid rogue peers from causing large
220 * memory allocations. */
221 if (message_length > 65536) {
222 wpa_printf(MSG_INFO, "SSL: Too long TLS fragment (size"
227 data->tls_in = wpabuf_alloc(message_length);
228 if (data->tls_in == NULL) {
229 wpa_printf(MSG_DEBUG, "SSL: No memory for message");
232 wpabuf_put_data(data->tls_in, buf, len);
233 wpa_printf(MSG_DEBUG, "SSL: Received %lu bytes in first "
234 "fragment, waiting for %lu bytes more",
236 (unsigned long) wpabuf_tailroom(data->tls_in));
243 int eap_server_tls_phase1(struct eap_sm *sm, struct eap_ssl_data *data)
246 /* This should not happen.. */
247 wpa_printf(MSG_INFO, "SSL: pending tls_out data when "
248 "processing new message");
249 wpabuf_free(data->tls_out);
250 WPA_ASSERT(data->tls_out == NULL);
253 data->tls_out = tls_connection_server_handshake(sm->ssl_ctx,
256 if (data->tls_out == NULL) {
257 wpa_printf(MSG_INFO, "SSL: TLS processing failed");
260 if (tls_connection_get_failed(sm->ssl_ctx, data->conn)) {
261 /* TLS processing has failed - return error */
262 wpa_printf(MSG_DEBUG, "SSL: Failed - tls_out available to "
271 static int eap_server_tls_reassemble(struct eap_ssl_data *data, u8 flags,
272 const u8 **pos, size_t *left)
274 unsigned int tls_msg_len = 0;
275 const u8 *end = *pos + *left;
277 if (flags & EAP_TLS_FLAGS_LENGTH_INCLUDED) {
279 wpa_printf(MSG_INFO, "SSL: Short frame with TLS "
283 tls_msg_len = WPA_GET_BE32(*pos);
284 wpa_printf(MSG_DEBUG, "SSL: TLS Message Length: %d",
290 wpa_printf(MSG_DEBUG, "SSL: Received packet: Flags 0x%x "
291 "Message Length %u", flags, tls_msg_len);
293 if (data->state == WAIT_FRAG_ACK) {
295 wpa_printf(MSG_DEBUG, "SSL: Unexpected payload in "
296 "WAIT_FRAG_ACK state");
299 wpa_printf(MSG_DEBUG, "SSL: Fragment acknowledged");
304 eap_server_tls_process_cont(data, *pos, end - *pos) < 0)
307 if (flags & EAP_TLS_FLAGS_MORE_FRAGMENTS) {
308 if (eap_server_tls_process_fragment(data, flags, tls_msg_len,
309 *pos, end - *pos) < 0)
312 data->state = FRAG_ACK;
316 if (data->state == FRAG_ACK) {
317 wpa_printf(MSG_DEBUG, "SSL: All fragments received");
321 if (data->tls_in == NULL) {
322 /* Wrap unfragmented messages as wpabuf without extra copy */
323 wpabuf_set(&data->tmpbuf, *pos, end - *pos);
324 data->tls_in = &data->tmpbuf;
331 static void eap_server_tls_free_in_buf(struct eap_ssl_data *data)
333 if (data->tls_in != &data->tmpbuf)
334 wpabuf_free(data->tls_in);
339 struct wpabuf * eap_server_tls_encrypt(struct eap_sm *sm,
340 struct eap_ssl_data *data,
341 const struct wpabuf *plain)
345 buf = tls_connection_encrypt(sm->ssl_ctx, data->conn,
348 wpa_printf(MSG_INFO, "SSL: Failed to encrypt Phase 2 data");
356 int eap_server_tls_process(struct eap_sm *sm, struct eap_ssl_data *data,
357 struct wpabuf *respData, void *priv, int eap_type,
358 int (*proc_version)(struct eap_sm *sm, void *priv,
360 void (*proc_msg)(struct eap_sm *sm, void *priv,
361 const struct wpabuf *respData))
368 pos = eap_hdr_validate(EAP_VENDOR_IETF, eap_type, respData, &left);
369 if (pos == NULL || left < 1)
370 return 0; /* Should not happen - frame already validated */
373 wpa_printf(MSG_DEBUG, "SSL: Received packet(len=%lu) - Flags 0x%02x",
374 (unsigned long) wpabuf_len(respData), flags);
377 proc_version(sm, priv, flags & EAP_TLS_VERSION_MASK) < 0)
380 ret = eap_server_tls_reassemble(data, flags, &pos, &left);
388 proc_msg(sm, priv, respData);
390 if (tls_connection_get_write_alerts(sm->ssl_ctx, data->conn) > 1) {
391 wpa_printf(MSG_INFO, "SSL: Locally detected fatal error in "
397 eap_server_tls_free_in_buf(data);