src/crypto/tls_openssl.c

   1 /*
   2  * SSL/TLS interface functions for OpenSSL
   3  * Copyright (c) 2004-2015, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #ifndef CONFIG_SMARTCARD
  12 #ifndef OPENSSL_NO_ENGINE
  13 #ifndef ANDROID
  14 #define OPENSSL_NO_ENGINE
  15 #endif
  16 #endif
  17 #endif
  18
  19 #include <openssl/ssl.h>
  20 #include <openssl/err.h>
  21 #include <openssl/pkcs12.h>
  22 #include <openssl/x509v3.h>
  23 #ifndef OPENSSL_NO_ENGINE
  24 #include <openssl/engine.h>
  25 #endif /* OPENSSL_NO_ENGINE */
  26 #ifndef OPENSSL_NO_DSA
  27 #include <openssl/dsa.h>
  28 #endif
  29 #ifndef OPENSSL_NO_DH
  30 #include <openssl/dh.h>
  31 #endif
  32
  33 #ifdef OPENSSL_IS_BORINGSSL
  34 #include <openssl/asn1.h>
  35 #include <openssl/asn1t.h>
  36 #endif /* OPENSSL_IS_BORINGSSL */
  37
  38 #include "common.h"
  39 #include "crypto.h"
  40 #include "sha1.h"
  41 #include "sha256.h"
  42 #include "tls.h"
  43
  44 #if OPENSSL_VERSION_NUMBER < 0x10000000L
  45 /* ERR_remove_thread_state replaces ERR_remove_state and the latter is
  46  * deprecated. However, OpenSSL 0.9.8 doesn't include
  47  * ERR_remove_thread_state. */
  48 #define ERR_remove_thread_state(tid) ERR_remove_state(0)
  49 #endif
  50
  51 #if defined(OPENSSL_IS_BORINGSSL)
  52 /* stack_index_t is the return type of OpenSSL's sk_XXX_num() functions. */
  53 typedef size_t stack_index_t;
  54 #else
  55 typedef int stack_index_t;
  56 #endif
  57
  58 #ifdef SSL_set_tlsext_status_type
  59 #ifndef OPENSSL_NO_TLSEXT
  60 #define HAVE_OCSP
  61 #include <openssl/ocsp.h>
  62 #endif /* OPENSSL_NO_TLSEXT */
  63 #endif /* SSL_set_tlsext_status_type */
  64
  65 #ifdef ANDROID
  66 #include <openssl/pem.h>
  67 #include <keystore/keystore_get.h>
  68
  69 static BIO * BIO_from_keystore(const char *key)
  70 {
  71         BIO *bio = NULL;
  72         uint8_t *value = NULL;
  73         int length = keystore_get(key, strlen(key), &value);
  74         if (length != -1 && (bio = BIO_new(BIO_s_mem())) != NULL)
  75                 BIO_write(bio, value, length);
  76         free(value);
  77         return bio;
  78 }
  79 #endif /* ANDROID */
  80
  81 static int tls_openssl_ref_count = 0;
  82 static int tls_ex_idx_session = -1;
  83
  84 struct tls_context {
  85         void (*event_cb)(void *ctx, enum tls_event ev,
  86                          union tls_event_data *data);
  87         void *cb_ctx;
  88         int cert_in_cb;
  89         char *ocsp_stapling_response;
  90 };
  91
  92 static struct tls_context *tls_global = NULL;
  93
  94
  95 struct tls_data {
  96         SSL_CTX *ssl;
  97         unsigned int tls_session_lifetime;
  98 };
  99
 100 struct tls_connection {
 101         struct tls_context *context;
 102         SSL_CTX *ssl_ctx;
 103         SSL *ssl;
 104         BIO *ssl_in, *ssl_out;
 105 #if defined(ANDROID) || !defined(OPENSSL_NO_ENGINE)
 106         ENGINE *engine;        /* functional reference to the engine */
 107         EVP_PKEY *private_key; /* the private key if using engine */
 108 #endif /* OPENSSL_NO_ENGINE */
 109         char *subject_match, *altsubject_match, *suffix_match, *domain_match;
 110         int read_alerts, write_alerts, failed;
 111
 112         tls_session_ticket_cb session_ticket_cb;
 113         void *session_ticket_cb_ctx;
 114
 115         /* SessionTicket received from OpenSSL hello_extension_cb (server) */
 116         u8 *session_ticket;
 117         size_t session_ticket_len;
 118
 119         unsigned int ca_cert_verify:1;
 120         unsigned int cert_probe:1;
 121         unsigned int server_cert_only:1;
 122         unsigned int invalid_hb_used:1;
 123         unsigned int success_data:1;
 124
 125         u8 srv_cert_hash[32];
 126
 127         unsigned int flags;
 128
 129         X509 *peer_cert;
 130         X509 *peer_issuer;
 131         X509 *peer_issuer_issuer;
 132
 133 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
 134         unsigned char client_random[SSL3_RANDOM_SIZE];
 135         unsigned char server_random[SSL3_RANDOM_SIZE];
 136 #endif
 137 };
 138
 139
 140 static struct tls_context * tls_context_new(const struct tls_config *conf)
 141 {
 142         struct tls_context *context = os_zalloc(sizeof(*context));
 143         if (context == NULL)
 144                 return NULL;
 145         if (conf) {
 146                 context->event_cb = conf->event_cb;
 147                 context->cb_ctx = conf->cb_ctx;
 148                 context->cert_in_cb = conf->cert_in_cb;
 149         }
 150         return context;
 151 }
 152
 153
 154 #ifdef CONFIG_NO_STDOUT_DEBUG
 155
 156 static void _tls_show_errors(void)
 157 {
 158         unsigned long err;
 159
 160         while ((err = ERR_get_error())) {
 161                 /* Just ignore the errors, since stdout is disabled */
 162         }
 163 }
 164 #define tls_show_errors(l, f, t) _tls_show_errors()
 165
 166 #else /* CONFIG_NO_STDOUT_DEBUG */
 167
 168 static void tls_show_errors(int level, const char *func, const char *txt)
 169 {
 170         unsigned long err;
 171
 172         wpa_printf(level, "OpenSSL: %s - %s %s",
 173                    func, txt, ERR_error_string(ERR_get_error(), NULL));
 174
 175         while ((err = ERR_get_error())) {
 176                 wpa_printf(MSG_INFO, "OpenSSL: pending error: %s",
 177                            ERR_error_string(err, NULL));
 178         }
 179 }
 180
 181 #endif /* CONFIG_NO_STDOUT_DEBUG */
 182
 183
 184 #ifdef CONFIG_NATIVE_WINDOWS
 185
 186 /* Windows CryptoAPI and access to certificate stores */
 187 #include <wincrypt.h>
 188
 189 #ifdef __MINGW32_VERSION
 190 /*
 191  * MinGW does not yet include all the needed definitions for CryptoAPI, so
 192  * define here whatever extra is needed.
 193  */
 194 #define CERT_SYSTEM_STORE_CURRENT_USER (1 << 16)
 195 #define CERT_STORE_READONLY_FLAG 0x00008000
 196 #define CERT_STORE_OPEN_EXISTING_FLAG 0x00004000
 197
 198 #endif /* __MINGW32_VERSION */
 199
 200
 201 struct cryptoapi_rsa_data {
 202         const CERT_CONTEXT *cert;
 203         HCRYPTPROV crypt_prov;
 204         DWORD key_spec;
 205         BOOL free_crypt_prov;
 206 };
 207
 208
 209 static void cryptoapi_error(const char *msg)
 210 {
 211         wpa_printf(MSG_INFO, "CryptoAPI: %s; err=%u",
 212                    msg, (unsigned int) GetLastError());
 213 }
 214
 215
 216 static int cryptoapi_rsa_pub_enc(int flen, const unsigned char *from,
 217                                  unsigned char *to, RSA *rsa, int padding)
 218 {
 219         wpa_printf(MSG_DEBUG, "%s - not implemented", __func__);
 220         return 0;
 221 }
 222
 223
 224 static int cryptoapi_rsa_pub_dec(int flen, const unsigned char *from,
 225                                  unsigned char *to, RSA *rsa, int padding)
 226 {
 227         wpa_printf(MSG_DEBUG, "%s - not implemented", __func__);
 228         return 0;
 229 }
 230
 231
 232 static int cryptoapi_rsa_priv_enc(int flen, const unsigned char *from,
 233                                   unsigned char *to, RSA *rsa, int padding)
 234 {
 235         struct cryptoapi_rsa_data *priv =
 236                 (struct cryptoapi_rsa_data *) rsa->meth->app_data;
 237         HCRYPTHASH hash;
 238         DWORD hash_size, len, i;
 239         unsigned char *buf = NULL;
 240         int ret = 0;
 241
 242         if (priv == NULL) {
 243                 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,
 244                        ERR_R_PASSED_NULL_PARAMETER);
 245                 return 0;
 246         }
 247
 248         if (padding != RSA_PKCS1_PADDING) {
 249                 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,
 250                        RSA_R_UNKNOWN_PADDING_TYPE);
 251                 return 0;
 252         }
 253
 254         if (flen != 16 /* MD5 */ + 20 /* SHA-1 */) {
 255                 wpa_printf(MSG_INFO, "%s - only MD5-SHA1 hash supported",
 256                            __func__);
 257                 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,
 258                        RSA_R_INVALID_MESSAGE_LENGTH);
 259                 return 0;
 260         }
 261
 262         if (!CryptCreateHash(priv->crypt_prov, CALG_SSL3_SHAMD5, 0, 0, &hash))
 263         {
 264                 cryptoapi_error("CryptCreateHash failed");
 265                 return 0;
 266         }
 267
 268         len = sizeof(hash_size);
 269         if (!CryptGetHashParam(hash, HP_HASHSIZE, (BYTE *) &hash_size, &len,
 270                                0)) {
 271                 cryptoapi_error("CryptGetHashParam failed");
 272                 goto err;
 273         }
 274
 275         if ((int) hash_size != flen) {
 276                 wpa_printf(MSG_INFO, "CryptoAPI: Invalid hash size (%u != %d)",
 277                            (unsigned) hash_size, flen);
 278                 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,
 279                        RSA_R_INVALID_MESSAGE_LENGTH);
 280                 goto err;
 281         }
 282         if (!CryptSetHashParam(hash, HP_HASHVAL, (BYTE * ) from, 0)) {
 283                 cryptoapi_error("CryptSetHashParam failed");
 284                 goto err;
 285         }
 286
 287         len = RSA_size(rsa);
 288         buf = os_malloc(len);
 289         if (buf == NULL) {
 290                 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, ERR_R_MALLOC_FAILURE);
 291                 goto err;
 292         }
 293
 294         if (!CryptSignHash(hash, priv->key_spec, NULL, 0, buf, &len)) {
 295                 cryptoapi_error("CryptSignHash failed");
 296                 goto err;
 297         }
 298
 299         for (i = 0; i < len; i++)
 300                 to[i] = buf[len - i - 1];
 301         ret = len;
 302
 303 err:
 304         os_free(buf);
 305         CryptDestroyHash(hash);
 306
 307         return ret;
 308 }
 309
 310
 311 static int cryptoapi_rsa_priv_dec(int flen, const unsigned char *from,
 312                                   unsigned char *to, RSA *rsa, int padding)
 313 {
 314         wpa_printf(MSG_DEBUG, "%s - not implemented", __func__);
 315         return 0;
 316 }
 317
 318
 319 static void cryptoapi_free_data(struct cryptoapi_rsa_data *priv)
 320 {
 321         if (priv == NULL)
 322                 return;
 323         if (priv->crypt_prov && priv->free_crypt_prov)
 324                 CryptReleaseContext(priv->crypt_prov, 0);
 325         if (priv->cert)
 326                 CertFreeCertificateContext(priv->cert);
 327         os_free(priv);
 328 }
 329
 330
 331 static int cryptoapi_finish(RSA *rsa)
 332 {
 333         cryptoapi_free_data((struct cryptoapi_rsa_data *) rsa->meth->app_data);
 334         os_free((void *) rsa->meth);
 335         rsa->meth = NULL;
 336         return 1;
 337 }
 338
 339
 340 static const CERT_CONTEXT * cryptoapi_find_cert(const char *name, DWORD store)
 341 {
 342         HCERTSTORE cs;
 343         const CERT_CONTEXT *ret = NULL;
 344
 345         cs = CertOpenStore((LPCSTR) CERT_STORE_PROV_SYSTEM, 0, 0,
 346                            store | CERT_STORE_OPEN_EXISTING_FLAG |
 347                            CERT_STORE_READONLY_FLAG, L"MY");
 348         if (cs == NULL) {
 349                 cryptoapi_error("Failed to open 'My system store'");
 350                 return NULL;
 351         }
 352
 353         if (strncmp(name, "cert://", 7) == 0) {
 354                 unsigned short wbuf[255];
 355                 MultiByteToWideChar(CP_ACP, 0, name + 7, -1, wbuf, 255);
 356                 ret = CertFindCertificateInStore(cs, X509_ASN_ENCODING |
 357                                                  PKCS_7_ASN_ENCODING,
 358                                                  0, CERT_FIND_SUBJECT_STR,
 359                                                  wbuf, NULL);
 360         } else if (strncmp(name, "hash://", 7) == 0) {
 361                 CRYPT_HASH_BLOB blob;
 362                 int len;
 363                 const char *hash = name + 7;
 364                 unsigned char *buf;
 365
 366                 len = os_strlen(hash) / 2;
 367                 buf = os_malloc(len);
 368                 if (buf && hexstr2bin(hash, buf, len) == 0) {
 369                         blob.cbData = len;
 370                         blob.pbData = buf;
 371                         ret = CertFindCertificateInStore(cs,
 372                                                          X509_ASN_ENCODING |
 373                                                          PKCS_7_ASN_ENCODING,
 374                                                          0, CERT_FIND_HASH,
 375                                                          &blob, NULL);
 376                 }
 377                 os_free(buf);
 378         }
 379
 380         CertCloseStore(cs, 0);
 381
 382         return ret;
 383 }
 384
 385
 386 static int tls_cryptoapi_cert(SSL *ssl, const char *name)
 387 {
 388         X509 *cert = NULL;
 389         RSA *rsa = NULL, *pub_rsa;
 390         struct cryptoapi_rsa_data *priv;
 391         RSA_METHOD *rsa_meth;
 392
 393         if (name == NULL ||
 394             (strncmp(name, "cert://", 7) != 0 &&
 395              strncmp(name, "hash://", 7) != 0))
 396                 return -1;
 397
 398         priv = os_zalloc(sizeof(*priv));
 399         rsa_meth = os_zalloc(sizeof(*rsa_meth));
 400         if (priv == NULL || rsa_meth == NULL) {
 401                 wpa_printf(MSG_WARNING, "CryptoAPI: Failed to allocate memory "
 402                            "for CryptoAPI RSA method");
 403                 os_free(priv);
 404                 os_free(rsa_meth);
 405                 return -1;
 406         }
 407
 408         priv->cert = cryptoapi_find_cert(name, CERT_SYSTEM_STORE_CURRENT_USER);
 409         if (priv->cert == NULL) {
 410                 priv->cert = cryptoapi_find_cert(
 411                         name, CERT_SYSTEM_STORE_LOCAL_MACHINE);
 412         }
 413         if (priv->cert == NULL) {
 414                 wpa_printf(MSG_INFO, "CryptoAPI: Could not find certificate "
 415                            "'%s'", name);
 416                 goto err;
 417         }
 418
 419         cert = d2i_X509(NULL,
 420                         (const unsigned char **) &priv->cert->pbCertEncoded,
 421                         priv->cert->cbCertEncoded);
 422         if (cert == NULL) {
 423                 wpa_printf(MSG_INFO, "CryptoAPI: Could not process X509 DER "
 424                            "encoding");
 425                 goto err;
 426         }
 427
 428         if (!CryptAcquireCertificatePrivateKey(priv->cert,
 429                                                CRYPT_ACQUIRE_COMPARE_KEY_FLAG,
 430                                                NULL, &priv->crypt_prov,
 431                                                &priv->key_spec,
 432                                                &priv->free_crypt_prov)) {
 433                 cryptoapi_error("Failed to acquire a private key for the "
 434                                 "certificate");
 435                 goto err;
 436         }
 437
 438         rsa_meth->name = "Microsoft CryptoAPI RSA Method";
 439         rsa_meth->rsa_pub_enc = cryptoapi_rsa_pub_enc;
 440         rsa_meth->rsa_pub_dec = cryptoapi_rsa_pub_dec;
 441         rsa_meth->rsa_priv_enc = cryptoapi_rsa_priv_enc;
 442         rsa_meth->rsa_priv_dec = cryptoapi_rsa_priv_dec;
 443         rsa_meth->finish = cryptoapi_finish;
 444         rsa_meth->flags = RSA_METHOD_FLAG_NO_CHECK;
 445         rsa_meth->app_data = (char *) priv;
 446
 447         rsa = RSA_new();
 448         if (rsa == NULL) {
 449                 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,
 450                        ERR_R_MALLOC_FAILURE);
 451                 goto err;
 452         }
 453
 454         if (!SSL_use_certificate(ssl, cert)) {
 455                 RSA_free(rsa);
 456                 rsa = NULL;
 457                 goto err;
 458         }
 459         pub_rsa = cert->cert_info->key->pkey->pkey.rsa;
 460         X509_free(cert);
 461         cert = NULL;
 462
 463         rsa->n = BN_dup(pub_rsa->n);
 464         rsa->e = BN_dup(pub_rsa->e);
 465         if (!RSA_set_method(rsa, rsa_meth))
 466                 goto err;
 467
 468         if (!SSL_use_RSAPrivateKey(ssl, rsa))
 469                 goto err;
 470         RSA_free(rsa);
 471
 472         return 0;
 473
 474 err:
 475         if (cert)
 476                 X509_free(cert);
 477         if (rsa)
 478                 RSA_free(rsa);
 479         else {
 480                 os_free(rsa_meth);
 481                 cryptoapi_free_data(priv);
 482         }
 483         return -1;
 484 }
 485
 486
 487 static int tls_cryptoapi_ca_cert(SSL_CTX *ssl_ctx, SSL *ssl, const char *name)
 488 {
 489         HCERTSTORE cs;
 490         PCCERT_CONTEXT ctx = NULL;
 491         X509 *cert;
 492         char buf[128];
 493         const char *store;
 494 #ifdef UNICODE
 495         WCHAR *wstore;
 496 #endif /* UNICODE */
 497
 498         if (name == NULL || strncmp(name, "cert_store://", 13) != 0)
 499                 return -1;
 500
 501         store = name + 13;
 502 #ifdef UNICODE
 503         wstore = os_malloc((os_strlen(store) + 1) * sizeof(WCHAR));
 504         if (wstore == NULL)
 505                 return -1;
 506         wsprintf(wstore, L"%S", store);
 507         cs = CertOpenSystemStore(0, wstore);
 508         os_free(wstore);
 509 #else /* UNICODE */
 510         cs = CertOpenSystemStore(0, store);
 511 #endif /* UNICODE */
 512         if (cs == NULL) {
 513                 wpa_printf(MSG_DEBUG, "%s: failed to open system cert store "
 514                            "'%s': error=%d", __func__, store,
 515                            (int) GetLastError());
 516                 return -1;
 517         }
 518
 519         while ((ctx = CertEnumCertificatesInStore(cs, ctx))) {
 520                 cert = d2i_X509(NULL,
 521                                 (const unsigned char **) &ctx->pbCertEncoded,
 522                                 ctx->cbCertEncoded);
 523                 if (cert == NULL) {
 524                         wpa_printf(MSG_INFO, "CryptoAPI: Could not process "
 525                                    "X509 DER encoding for CA cert");
 526                         continue;
 527                 }
 528
 529                 X509_NAME_oneline(X509_get_subject_name(cert), buf,
 530                                   sizeof(buf));
 531                 wpa_printf(MSG_DEBUG, "OpenSSL: Loaded CA certificate for "
 532                            "system certificate store: subject='%s'", buf);
 533
 534                 if (!X509_STORE_add_cert(ssl_ctx->cert_store, cert)) {
 535                         tls_show_errors(MSG_WARNING, __func__,
 536                                         "Failed to add ca_cert to OpenSSL "
 537                                         "certificate store");
 538                 }
 539
 540                 X509_free(cert);
 541         }
 542
 543         if (!CertCloseStore(cs, 0)) {
 544                 wpa_printf(MSG_DEBUG, "%s: failed to close system cert store "
 545                            "'%s': error=%d", __func__, name + 13,
 546                            (int) GetLastError());
 547         }
 548
 549         return 0;
 550 }
 551
 552
 553 #else /* CONFIG_NATIVE_WINDOWS */
 554
 555 static int tls_cryptoapi_cert(SSL *ssl, const char *name)
 556 {
 557         return -1;
 558 }
 559
 560 #endif /* CONFIG_NATIVE_WINDOWS */
 561
 562
 563 static void ssl_info_cb(const SSL *ssl, int where, int ret)
 564 {
 565         const char *str;
 566         int w;
 567
 568         wpa_printf(MSG_DEBUG, "SSL: (where=0x%x ret=0x%x)", where, ret);
 569         w = where & ~SSL_ST_MASK;
 570         if (w & SSL_ST_CONNECT)
 571                 str = "SSL_connect";
 572         else if (w & SSL_ST_ACCEPT)
 573                 str = "SSL_accept";
 574         else
 575                 str = "undefined";
 576
 577         if (where & SSL_CB_LOOP) {
 578                 wpa_printf(MSG_DEBUG, "SSL: %s:%s",
 579                            str, SSL_state_string_long(ssl));
 580         } else if (where & SSL_CB_ALERT) {
 581                 struct tls_connection *conn = SSL_get_app_data((SSL *) ssl);
 582                 wpa_printf(MSG_INFO, "SSL: SSL3 alert: %s:%s:%s",
 583                            where & SSL_CB_READ ?
 584                            "read (remote end reported an error)" :
 585                            "write (local SSL3 detected an error)",
 586                            SSL_alert_type_string_long(ret),
 587                            SSL_alert_desc_string_long(ret));
 588                 if ((ret >> 8) == SSL3_AL_FATAL) {
 589                         if (where & SSL_CB_READ)
 590                                 conn->read_alerts++;
 591                         else
 592                                 conn->write_alerts++;
 593                 }
 594                 if (conn->context->event_cb != NULL) {
 595                         union tls_event_data ev;
 596                         struct tls_context *context = conn->context;
 597                         os_memset(&ev, 0, sizeof(ev));
 598                         ev.alert.is_local = !(where & SSL_CB_READ);
 599                         ev.alert.type = SSL_alert_type_string_long(ret);
 600                         ev.alert.description = SSL_alert_desc_string_long(ret);
 601                         context->event_cb(context->cb_ctx, TLS_ALERT, &ev);
 602                 }
 603         } else if (where & SSL_CB_EXIT && ret <= 0) {
 604                 wpa_printf(MSG_DEBUG, "SSL: %s:%s in %s",
 605                            str, ret == 0 ? "failed" : "error",
 606                            SSL_state_string_long(ssl));
 607         }
 608 }
 609
 610
 611 #ifndef OPENSSL_NO_ENGINE
 612 /**
 613  * tls_engine_load_dynamic_generic - load any openssl engine
 614  * @pre: an array of commands and values that load an engine initialized
 615  *       in the engine specific function
 616  * @post: an array of commands and values that initialize an already loaded
 617  *        engine (or %NULL if not required)
 618  * @id: the engine id of the engine to load (only required if post is not %NULL
 619  *
 620  * This function is a generic function that loads any openssl engine.
 621  *
 622  * Returns: 0 on success, -1 on failure
 623  */
 624 static int tls_engine_load_dynamic_generic(const char *pre[],
 625                                            const char *post[], const char *id)
 626 {
 627         ENGINE *engine;
 628         const char *dynamic_id = "dynamic";
 629
 630         engine = ENGINE_by_id(id);
 631         if (engine) {
 632                 ENGINE_free(engine);
 633                 wpa_printf(MSG_DEBUG, "ENGINE: engine '%s' is already "
 634                            "available", id);
 635                 return 0;
 636         }
 637         ERR_clear_error();
 638
 639         engine = ENGINE_by_id(dynamic_id);
 640         if (engine == NULL) {
 641                 wpa_printf(MSG_INFO, "ENGINE: Can't find engine %s [%s]",
 642                            dynamic_id,
 643                            ERR_error_string(ERR_get_error(), NULL));
 644                 return -1;
 645         }
 646
 647         /* Perform the pre commands. This will load the engine. */
 648         while (pre && pre[0]) {
 649                 wpa_printf(MSG_DEBUG, "ENGINE: '%s' '%s'", pre[0], pre[1]);
 650                 if (ENGINE_ctrl_cmd_string(engine, pre[0], pre[1], 0) == 0) {
 651                         wpa_printf(MSG_INFO, "ENGINE: ctrl cmd_string failed: "
 652                                    "%s %s [%s]", pre[0], pre[1],
 653                                    ERR_error_string(ERR_get_error(), NULL));
 654                         ENGINE_free(engine);
 655                         return -1;
 656                 }
 657                 pre += 2;
 658         }
 659
 660         /*
 661          * Free the reference to the "dynamic" engine. The loaded engine can
 662          * now be looked up using ENGINE_by_id().
 663          */
 664         ENGINE_free(engine);
 665
 666         engine = ENGINE_by_id(id);
 667         if (engine == NULL) {
 668                 wpa_printf(MSG_INFO, "ENGINE: Can't find engine %s [%s]",
 669                            id, ERR_error_string(ERR_get_error(), NULL));
 670                 return -1;
 671         }
 672
 673         while (post && post[0]) {
 674                 wpa_printf(MSG_DEBUG, "ENGINE: '%s' '%s'", post[0], post[1]);
 675                 if (ENGINE_ctrl_cmd_string(engine, post[0], post[1], 0) == 0) {
 676                         wpa_printf(MSG_DEBUG, "ENGINE: ctrl cmd_string failed:"
 677                                 " %s %s [%s]", post[0], post[1],
 678                                    ERR_error_string(ERR_get_error(), NULL));
 679                         ENGINE_remove(engine);
 680                         ENGINE_free(engine);
 681                         return -1;
 682                 }
 683                 post += 2;
 684         }
 685         ENGINE_free(engine);
 686
 687         return 0;
 688 }
 689
 690
 691 /**
 692  * tls_engine_load_dynamic_pkcs11 - load the pkcs11 engine provided by opensc
 693  * @pkcs11_so_path: pksc11_so_path from the configuration
 694  * @pcks11_module_path: pkcs11_module_path from the configuration
 695  */
 696 static int tls_engine_load_dynamic_pkcs11(const char *pkcs11_so_path,
 697                                           const char *pkcs11_module_path)
 698 {
 699         char *engine_id = "pkcs11";
 700         const char *pre_cmd[] = {
 701                 "SO_PATH", NULL /* pkcs11_so_path */,
 702                 "ID", NULL /* engine_id */,
 703                 "LIST_ADD", "1",
 704                 /* "NO_VCHECK", "1", */
 705                 "LOAD", NULL,
 706                 NULL, NULL
 707         };
 708         const char *post_cmd[] = {
 709                 "MODULE_PATH", NULL /* pkcs11_module_path */,
 710                 NULL, NULL
 711         };
 712
 713         if (!pkcs11_so_path)
 714                 return 0;
 715
 716         pre_cmd[1] = pkcs11_so_path;
 717         pre_cmd[3] = engine_id;
 718         if (pkcs11_module_path)
 719                 post_cmd[1] = pkcs11_module_path;
 720         else
 721                 post_cmd[0] = NULL;
 722
 723         wpa_printf(MSG_DEBUG, "ENGINE: Loading pkcs11 Engine from %s",
 724                    pkcs11_so_path);
 725
 726         return tls_engine_load_dynamic_generic(pre_cmd, post_cmd, engine_id);
 727 }
 728
 729
 730 /**
 731  * tls_engine_load_dynamic_opensc - load the opensc engine provided by opensc
 732  * @opensc_so_path: opensc_so_path from the configuration
 733  */
 734 static int tls_engine_load_dynamic_opensc(const char *opensc_so_path)
 735 {
 736         char *engine_id = "opensc";
 737         const char *pre_cmd[] = {
 738                 "SO_PATH", NULL /* opensc_so_path */,
 739                 "ID", NULL /* engine_id */,
 740                 "LIST_ADD", "1",
 741                 "LOAD", NULL,
 742                 NULL, NULL
 743         };
 744
 745         if (!opensc_so_path)
 746                 return 0;
 747
 748         pre_cmd[1] = opensc_so_path;
 749         pre_cmd[3] = engine_id;
 750
 751         wpa_printf(MSG_DEBUG, "ENGINE: Loading OpenSC Engine from %s",
 752                    opensc_so_path);
 753
 754         return tls_engine_load_dynamic_generic(pre_cmd, NULL, engine_id);
 755 }
 756 #endif /* OPENSSL_NO_ENGINE */
 757
 758
 759 static void remove_session_cb(SSL_CTX *ctx, SSL_SESSION *sess)
 760 {
 761         struct wpabuf *buf;
 762
 763         if (tls_ex_idx_session < 0)
 764                 return;
 765         buf = SSL_SESSION_get_ex_data(sess, tls_ex_idx_session);
 766         if (!buf)
 767                 return;
 768         wpa_printf(MSG_DEBUG,
 769                    "OpenSSL: Free application session data %p (sess %p)",
 770                    buf, sess);
 771         wpabuf_free(buf);
 772
 773         SSL_SESSION_set_ex_data(sess, tls_ex_idx_session, NULL);
 774 }
 775
 776
 777 void * tls_init(const struct tls_config *conf)
 778 {
 779         struct tls_data *data;
 780         SSL_CTX *ssl;
 781         struct tls_context *context;
 782         const char *ciphers;
 783
 784         if (tls_openssl_ref_count == 0) {
 785                 tls_global = context = tls_context_new(conf);
 786                 if (context == NULL)
 787                         return NULL;
 788 #ifdef CONFIG_FIPS
 789 #ifdef OPENSSL_FIPS
 790                 if (conf && conf->fips_mode) {
 791                         static int fips_enabled = 0;
 792
 793                         if (!fips_enabled && !FIPS_mode_set(1)) {
 794                                 wpa_printf(MSG_ERROR, "Failed to enable FIPS "
 795                                            "mode");
 796                                 ERR_load_crypto_strings();
 797                                 ERR_print_errors_fp(stderr);
 798                                 os_free(tls_global);
 799                                 tls_global = NULL;
 800                                 return NULL;
 801                         } else {
 802                                 wpa_printf(MSG_INFO, "Running in FIPS mode");
 803                                 fips_enabled = 1;
 804                         }
 805                 }
 806 #else /* OPENSSL_FIPS */
 807                 if (conf && conf->fips_mode) {
 808                         wpa_printf(MSG_ERROR, "FIPS mode requested, but not "
 809                                    "supported");
 810                         os_free(tls_global);
 811                         tls_global = NULL;
 812                         return NULL;
 813                 }
 814 #endif /* OPENSSL_FIPS */
 815 #endif /* CONFIG_FIPS */
 816                 SSL_load_error_strings();
 817                 SSL_library_init();
 818 #ifndef OPENSSL_NO_SHA256
 819                 EVP_add_digest(EVP_sha256());
 820 #endif /* OPENSSL_NO_SHA256 */
 821                 /* TODO: if /dev/urandom is available, PRNG is seeded
 822                  * automatically. If this is not the case, random data should
 823                  * be added here. */
 824
 825 #ifdef PKCS12_FUNCS
 826 #ifndef OPENSSL_NO_RC2
 827                 /*
 828                  * 40-bit RC2 is commonly used in PKCS#12 files, so enable it.
 829                  * This is enabled by PKCS12_PBE_add() in OpenSSL 0.9.8
 830                  * versions, but it looks like OpenSSL 1.0.0 does not do that
 831                  * anymore.
 832                  */
 833                 EVP_add_cipher(EVP_rc2_40_cbc());
 834 #endif /* OPENSSL_NO_RC2 */
 835                 PKCS12_PBE_add();
 836 #endif  /* PKCS12_FUNCS */
 837         } else {
 838                 context = tls_context_new(conf);
 839                 if (context == NULL)
 840                         return NULL;
 841         }
 842         tls_openssl_ref_count++;
 843
 844         data = os_zalloc(sizeof(*data));
 845         if (data)
 846                 ssl = SSL_CTX_new(SSLv23_method());
 847         else
 848                 ssl = NULL;
 849         if (ssl == NULL) {
 850                 tls_openssl_ref_count--;
 851                 if (context != tls_global)
 852                         os_free(context);
 853                 if (tls_openssl_ref_count == 0) {
 854                         os_free(tls_global);
 855                         tls_global = NULL;
 856                 }
 857                 return NULL;
 858         }
 859         data->ssl = ssl;
 860         if (conf)
 861                 data->tls_session_lifetime = conf->tls_session_lifetime;
 862
 863         SSL_CTX_set_options(ssl, SSL_OP_NO_SSLv2);
 864         SSL_CTX_set_options(ssl, SSL_OP_NO_SSLv3);
 865
 866         SSL_CTX_set_info_callback(ssl, ssl_info_cb);
 867         SSL_CTX_set_app_data(ssl, context);
 868         if (data->tls_session_lifetime > 0) {
 869                 SSL_CTX_set_quiet_shutdown(ssl, 1);
 870                 /*
 871                  * Set default context here. In practice, this will be replaced
 872                  * by the per-EAP method context in tls_connection_set_verify().
 873                  */
 874                 SSL_CTX_set_session_id_context(ssl, (u8 *) "hostapd", 7);
 875                 SSL_CTX_set_session_cache_mode(ssl, SSL_SESS_CACHE_SERVER);
 876                 SSL_CTX_set_timeout(ssl, data->tls_session_lifetime);
 877                 SSL_CTX_sess_set_remove_cb(ssl, remove_session_cb);
 878         } else {
 879                 SSL_CTX_set_session_cache_mode(ssl, SSL_SESS_CACHE_OFF);
 880         }
 881
 882         if (tls_ex_idx_session < 0) {
 883                 tls_ex_idx_session = SSL_SESSION_get_ex_new_index(
 884                         0, NULL, NULL, NULL, NULL);
 885                 if (tls_ex_idx_session < 0) {
 886                         tls_deinit(data);
 887                         return NULL;
 888                 }
 889         }
 890
 891 #ifndef OPENSSL_NO_ENGINE
 892         wpa_printf(MSG_DEBUG, "ENGINE: Loading dynamic engine");
 893         ERR_load_ENGINE_strings();
 894         ENGINE_load_dynamic();
 895
 896         if (conf &&
 897             (conf->opensc_engine_path || conf->pkcs11_engine_path ||
 898              conf->pkcs11_module_path)) {
 899                 if (tls_engine_load_dynamic_opensc(conf->opensc_engine_path) ||
 900                     tls_engine_load_dynamic_pkcs11(conf->pkcs11_engine_path,
 901                                                    conf->pkcs11_module_path)) {
 902                         tls_deinit(data);
 903                         return NULL;
 904                 }
 905         }
 906 #endif /* OPENSSL_NO_ENGINE */
 907
 908         if (conf && conf->openssl_ciphers)
 909                 ciphers = conf->openssl_ciphers;
 910         else
 911                 ciphers = "DEFAULT:!EXP:!LOW";
 912         if (SSL_CTX_set_cipher_list(ssl, ciphers) != 1) {
 913                 wpa_printf(MSG_ERROR,
 914                            "OpenSSL: Failed to set cipher string '%s'",
 915                            ciphers);
 916                 tls_deinit(data);
 917                 return NULL;
 918         }
 919
 920         return data;
 921 }
 922
 923
 924 void tls_deinit(void *ssl_ctx)
 925 {
 926         struct tls_data *data = ssl_ctx;
 927         SSL_CTX *ssl = data->ssl;
 928         struct tls_context *context = SSL_CTX_get_app_data(ssl);
 929         if (context != tls_global)
 930                 os_free(context);
 931         if (data->tls_session_lifetime > 0)
 932                 SSL_CTX_flush_sessions(ssl, 0);
 933         SSL_CTX_free(ssl);
 934
 935         tls_openssl_ref_count--;
 936         if (tls_openssl_ref_count == 0) {
 937 #ifndef OPENSSL_NO_ENGINE
 938                 ENGINE_cleanup();
 939 #endif /* OPENSSL_NO_ENGINE */
 940                 CRYPTO_cleanup_all_ex_data();
 941                 ERR_remove_thread_state(NULL);
 942                 ERR_free_strings();
 943                 EVP_cleanup();
 944                 os_free(tls_global->ocsp_stapling_response);
 945                 tls_global->ocsp_stapling_response = NULL;
 946                 os_free(tls_global);
 947                 tls_global = NULL;
 948         }
 949
 950         os_free(data);
 951 }
 952
 953
 954 #ifndef OPENSSL_NO_ENGINE
 955
 956 /* Cryptoki return values */
 957 #define CKR_PIN_INCORRECT 0x000000a0
 958 #define CKR_PIN_INVALID 0x000000a1
 959 #define CKR_PIN_LEN_RANGE 0x000000a2
 960
 961 /* libp11 */
 962 #define ERR_LIB_PKCS11  ERR_LIB_USER
 963
 964 static int tls_is_pin_error(unsigned int err)
 965 {
 966         return ERR_GET_LIB(err) == ERR_LIB_PKCS11 &&
 967                 (ERR_GET_REASON(err) == CKR_PIN_INCORRECT ||
 968                  ERR_GET_REASON(err) == CKR_PIN_INVALID ||
 969                  ERR_GET_REASON(err) == CKR_PIN_LEN_RANGE);
 970 }
 971
 972 #endif /* OPENSSL_NO_ENGINE */
 973
 974
 975 #ifdef ANDROID
 976 /* EVP_PKEY_from_keystore comes from system/security/keystore-engine. */
 977 EVP_PKEY * EVP_PKEY_from_keystore(const char *key_id);
 978 #endif /* ANDROID */
 979
 980 static int tls_engine_init(struct tls_connection *conn, const char *engine_id,
 981                            const char *pin, const char *key_id,
 982                            const char *cert_id, const char *ca_cert_id)
 983 {
 984 #if defined(ANDROID) && defined(OPENSSL_IS_BORINGSSL)
 985 #if !defined(OPENSSL_NO_ENGINE)
 986 #error "This code depends on OPENSSL_NO_ENGINE being defined by BoringSSL."
 987 #endif
 988         if (!key_id)
 989                 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
 990         conn->engine = NULL;
 991         conn->private_key = EVP_PKEY_from_keystore(key_id);
 992         if (!conn->private_key) {
 993                 wpa_printf(MSG_ERROR,
 994                            "ENGINE: cannot load private key with id '%s' [%s]",
 995                            key_id,
 996                            ERR_error_string(ERR_get_error(), NULL));
 997                 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
 998         }
 999 #endif /* ANDROID && OPENSSL_IS_BORINGSSL */
1000
1001 #ifndef OPENSSL_NO_ENGINE
1002         int ret = -1;
1003         if (engine_id == NULL) {
1004                 wpa_printf(MSG_ERROR, "ENGINE: Engine ID not set");
1005                 return -1;
1006         }
1007
1008         ERR_clear_error();
1009 #ifdef ANDROID
1010         ENGINE_load_dynamic();
1011 #endif
1012         conn->engine = ENGINE_by_id(engine_id);
1013         if (!conn->engine) {
1014                 wpa_printf(MSG_ERROR, "ENGINE: engine %s not available [%s]",
1015                            engine_id, ERR_error_string(ERR_get_error(), NULL));
1016                 goto err;
1017         }
1018         if (ENGINE_init(conn->engine) != 1) {
1019                 wpa_printf(MSG_ERROR, "ENGINE: engine init failed "
1020                            "(engine: %s) [%s]", engine_id,
1021                            ERR_error_string(ERR_get_error(), NULL));
1022                 goto err;
1023         }
1024         wpa_printf(MSG_DEBUG, "ENGINE: engine initialized");
1025
1026 #ifndef ANDROID
1027         if (pin && ENGINE_ctrl_cmd_string(conn->engine, "PIN", pin, 0) == 0) {
1028                 wpa_printf(MSG_ERROR, "ENGINE: cannot set pin [%s]",
1029                            ERR_error_string(ERR_get_error(), NULL));
1030                 goto err;
1031         }
1032 #endif
1033         if (key_id) {
1034                 /*
1035                  * Ensure that the ENGINE does not attempt to use the OpenSSL
1036                  * UI system to obtain a PIN, if we didn't provide one.
1037                  */
1038                 struct {
1039                         const void *password;
1040                         const char *prompt_info;
1041                 } key_cb = { "", NULL };
1042
1043                 /* load private key first in-case PIN is required for cert */
1044                 conn->private_key = ENGINE_load_private_key(conn->engine,
1045                                                             key_id, NULL,
1046                                                             &key_cb);
1047                 if (!conn->private_key) {
1048                         unsigned long err = ERR_get_error();
1049
1050                         wpa_printf(MSG_ERROR,
1051                                    "ENGINE: cannot load private key with id '%s' [%s]",
1052                                    key_id,
1053                                    ERR_error_string(err, NULL));
1054                         if (tls_is_pin_error(err))
1055                                 ret = TLS_SET_PARAMS_ENGINE_PRV_BAD_PIN;
1056                         else
1057                                 ret = TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
1058                         goto err;
1059                 }
1060         }
1061
1062         /* handle a certificate and/or CA certificate */
1063         if (cert_id || ca_cert_id) {
1064                 const char *cmd_name = "LOAD_CERT_CTRL";
1065
1066                 /* test if the engine supports a LOAD_CERT_CTRL */
1067                 if (!ENGINE_ctrl(conn->engine, ENGINE_CTRL_GET_CMD_FROM_NAME,
1068                                  0, (void *)cmd_name, NULL)) {
1069                         wpa_printf(MSG_ERROR, "ENGINE: engine does not support"
1070                                    " loading certificates");
1071                         ret = TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
1072                         goto err;
1073                 }
1074         }
1075
1076         return 0;
1077
1078 err:
1079         if (conn->engine) {
1080                 ENGINE_free(conn->engine);
1081                 conn->engine = NULL;
1082         }
1083
1084         if (conn->private_key) {
1085                 EVP_PKEY_free(conn->private_key);
1086                 conn->private_key = NULL;
1087         }
1088
1089         return ret;
1090 #else /* OPENSSL_NO_ENGINE */
1091         return 0;
1092 #endif /* OPENSSL_NO_ENGINE */
1093 }
1094
1095
1096 static void tls_engine_deinit(struct tls_connection *conn)
1097 {
1098 #if defined(ANDROID) || !defined(OPENSSL_NO_ENGINE)
1099         wpa_printf(MSG_DEBUG, "ENGINE: engine deinit");
1100         if (conn->private_key) {
1101                 EVP_PKEY_free(conn->private_key);
1102                 conn->private_key = NULL;
1103         }
1104         if (conn->engine) {
1105 #if !defined(OPENSSL_IS_BORINGSSL)
1106                 ENGINE_finish(conn->engine);
1107 #endif /* !OPENSSL_IS_BORINGSSL */
1108                 conn->engine = NULL;
1109         }
1110 #endif /* ANDROID || !OPENSSL_NO_ENGINE */
1111 }
1112
1113
1114 int tls_get_errors(void *ssl_ctx)
1115 {
1116         int count = 0;
1117         unsigned long err;
1118
1119         while ((err = ERR_get_error())) {
1120                 wpa_printf(MSG_INFO, "TLS - SSL error: %s",
1121                            ERR_error_string(err, NULL));
1122                 count++;
1123         }
1124
1125         return count;
1126 }
1127
1128
1129 static const char * openssl_content_type(int content_type)
1130 {
1131         switch (content_type) {
1132         case 20:
1133                 return "change cipher spec";
1134         case 21:
1135                 return "alert";
1136         case 22:
1137                 return "handshake";
1138         case 23:
1139                 return "application data";
1140         case 24:
1141                 return "heartbeat";
1142         case 256:
1143                 return "TLS header info"; /* pseudo content type */
1144         default:
1145                 return "?";
1146         }
1147 }
1148
1149
1150 static const char * openssl_handshake_type(int content_type, const u8 *buf,
1151                                            size_t len)
1152 {
1153         if (content_type != 22 || !buf || len == 0)
1154                 return "";
1155         switch (buf[0]) {
1156         case 0:
1157                 return "hello request";
1158         case 1:
1159                 return "client hello";
1160         case 2:
1161                 return "server hello";
1162         case 4:
1163                 return "new session ticket";
1164         case 11:
1165                 return "certificate";
1166         case 12:
1167                 return "server key exchange";
1168         case 13:
1169                 return "certificate request";
1170         case 14:
1171                 return "server hello done";
1172         case 15:
1173                 return "certificate verify";
1174         case 16:
1175                 return "client key exchange";
1176         case 20:
1177                 return "finished";
1178         case 21:
1179                 return "certificate url";
1180         case 22:
1181                 return "certificate status";
1182         default:
1183                 return "?";
1184         }
1185 }
1186
1187
1188 static void tls_msg_cb(int write_p, int version, int content_type,
1189                        const void *buf, size_t len, SSL *ssl, void *arg)
1190 {
1191         struct tls_connection *conn = arg;
1192         const u8 *pos = buf;
1193
1194         if (write_p == 2) {
1195                 wpa_printf(MSG_DEBUG,
1196                            "OpenSSL: session ver=0x%x content_type=%d",
1197                            version, content_type);
1198                 wpa_hexdump_key(MSG_MSGDUMP, "OpenSSL: Data", buf, len);
1199                 return;
1200         }
1201
1202         wpa_printf(MSG_DEBUG, "OpenSSL: %s ver=0x%x content_type=%d (%s/%s)",
1203                    write_p ? "TX" : "RX", version, content_type,
1204                    openssl_content_type(content_type),
1205                    openssl_handshake_type(content_type, buf, len));
1206         wpa_hexdump_key(MSG_MSGDUMP, "OpenSSL: Message", buf, len);
1207         if (content_type == 24 && len >= 3 && pos[0] == 1) {
1208                 size_t payload_len = WPA_GET_BE16(pos + 1);
1209                 if (payload_len + 3 > len) {
1210                         wpa_printf(MSG_ERROR, "OpenSSL: Heartbeat attack detected");
1211                         conn->invalid_hb_used = 1;
1212                 }
1213         }
1214 }
1215
1216
1217 struct tls_connection * tls_connection_init(void *ssl_ctx)
1218 {
1219         struct tls_data *data = ssl_ctx;
1220         SSL_CTX *ssl = data->ssl;
1221         struct tls_connection *conn;
1222         long options;
1223         struct tls_context *context = SSL_CTX_get_app_data(ssl);
1224
1225         conn = os_zalloc(sizeof(*conn));
1226         if (conn == NULL)
1227                 return NULL;
1228         conn->ssl_ctx = ssl;
1229         conn->ssl = SSL_new(ssl);
1230         if (conn->ssl == NULL) {
1231                 tls_show_errors(MSG_INFO, __func__,
1232                                 "Failed to initialize new SSL connection");
1233                 os_free(conn);
1234                 return NULL;
1235         }
1236
1237         conn->context = context;
1238         SSL_set_app_data(conn->ssl, conn);
1239         SSL_set_msg_callback(conn->ssl, tls_msg_cb);
1240         SSL_set_msg_callback_arg(conn->ssl, conn);
1241         options = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
1242                 SSL_OP_SINGLE_DH_USE;
1243 #ifdef SSL_OP_NO_COMPRESSION
1244         options |= SSL_OP_NO_COMPRESSION;
1245 #endif /* SSL_OP_NO_COMPRESSION */
1246         SSL_set_options(conn->ssl, options);
1247
1248         conn->ssl_in = BIO_new(BIO_s_mem());
1249         if (!conn->ssl_in) {
1250                 tls_show_errors(MSG_INFO, __func__,
1251                                 "Failed to create a new BIO for ssl_in");
1252                 SSL_free(conn->ssl);
1253                 os_free(conn);
1254                 return NULL;
1255         }
1256
1257         conn->ssl_out = BIO_new(BIO_s_mem());
1258         if (!conn->ssl_out) {
1259                 tls_show_errors(MSG_INFO, __func__,
1260                                 "Failed to create a new BIO for ssl_out");
1261                 SSL_free(conn->ssl);
1262                 BIO_free(conn->ssl_in);
1263                 os_free(conn);
1264                 return NULL;
1265         }
1266
1267         SSL_set_bio(conn->ssl, conn->ssl_in, conn->ssl_out);
1268
1269         return conn;
1270 }
1271
1272
1273 void tls_connection_deinit(void *ssl_ctx, struct tls_connection *conn)
1274 {
1275         if (conn == NULL)
1276                 return;
1277         if (conn->success_data) {
1278                 /*
1279                  * Make sure ssl_clear_bad_session() does not remove this
1280                  * session.
1281                  */
1282                 SSL_set_quiet_shutdown(conn->ssl, 1);
1283                 SSL_shutdown(conn->ssl);
1284         }
1285         SSL_free(conn->ssl);
1286         tls_engine_deinit(conn);
1287         os_free(conn->subject_match);
1288         os_free(conn->altsubject_match);
1289         os_free(conn->suffix_match);
1290         os_free(conn->domain_match);
1291         os_free(conn->session_ticket);
1292         os_free(conn);
1293 }
1294
1295
1296 int tls_connection_established(void *ssl_ctx, struct tls_connection *conn)
1297 {
1298         return conn ? SSL_is_init_finished(conn->ssl) : 0;
1299 }
1300
1301
1302 int tls_connection_shutdown(void *ssl_ctx, struct tls_connection *conn)
1303 {
1304         if (conn == NULL)
1305                 return -1;
1306
1307         /* Shutdown previous TLS connection without notifying the peer
1308          * because the connection was already terminated in practice
1309          * and "close notify" shutdown alert would confuse AS. */
1310         SSL_set_quiet_shutdown(conn->ssl, 1);
1311         SSL_shutdown(conn->ssl);
1312         return SSL_clear(conn->ssl) == 1 ? 0 : -1;
1313 }
1314
1315
1316 static int tls_match_altsubject_component(X509 *cert, int type,
1317                                           const char *value, size_t len)
1318 {
1319         GENERAL_NAME *gen;
1320         void *ext;
1321         int found = 0;
1322         stack_index_t i;
1323
1324         ext = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL);
1325
1326         for (i = 0; ext && i < sk_GENERAL_NAME_num(ext); i++) {
1327                 gen = sk_GENERAL_NAME_value(ext, i);
1328                 if (gen->type != type)
1329                         continue;
1330                 if (os_strlen((char *) gen->d.ia5->data) == len &&
1331                     os_memcmp(value, gen->d.ia5->data, len) == 0)
1332                         found++;
1333         }
1334
1335         return found;
1336 }
1337
1338
1339 static int tls_match_altsubject(X509 *cert, const char *match)
1340 {
1341         int type;
1342         const char *pos, *end;
1343         size_t len;
1344
1345         pos = match;
1346         do {
1347                 if (os_strncmp(pos, "EMAIL:", 6) == 0) {
1348                         type = GEN_EMAIL;
1349                         pos += 6;
1350                 } else if (os_strncmp(pos, "DNS:", 4) == 0) {
1351                         type = GEN_DNS;
1352                         pos += 4;
1353                 } else if (os_strncmp(pos, "URI:", 4) == 0) {
1354                         type = GEN_URI;
1355                         pos += 4;
1356                 } else {
1357                         wpa_printf(MSG_INFO, "TLS: Invalid altSubjectName "
1358                                    "match '%s'", pos);
1359                         return 0;
1360                 }
1361                 end = os_strchr(pos, ';');
1362                 while (end) {
1363                         if (os_strncmp(end + 1, "EMAIL:", 6) == 0 ||
1364                             os_strncmp(end + 1, "DNS:", 4) == 0 ||
1365                             os_strncmp(end + 1, "URI:", 4) == 0)
1366                                 break;
1367                         end = os_strchr(end + 1, ';');
1368                 }
1369                 if (end)
1370                         len = end - pos;
1371                 else
1372                         len = os_strlen(pos);
1373                 if (tls_match_altsubject_component(cert, type, pos, len) > 0)
1374                         return 1;
1375                 pos = end + 1;
1376         } while (end);
1377
1378         return 0;
1379 }
1380
1381
1382 #ifndef CONFIG_NATIVE_WINDOWS
1383 static int domain_suffix_match(const u8 *val, size_t len, const char *match,
1384                                int full)
1385 {
1386         size_t i, match_len;
1387
1388         /* Check for embedded nuls that could mess up suffix matching */
1389         for (i = 0; i < len; i++) {
1390                 if (val[i] == '\0') {
1391                         wpa_printf(MSG_DEBUG, "TLS: Embedded null in a string - reject");
1392                         return 0;
1393                 }
1394         }
1395
1396         match_len = os_strlen(match);
1397         if (match_len > len || (full && match_len != len))
1398                 return 0;
1399
1400         if (os_strncasecmp((const char *) val + len - match_len, match,
1401                            match_len) != 0)
1402                 return 0; /* no match */
1403
1404         if (match_len == len)
1405                 return 1; /* exact match */
1406
1407         if (val[len - match_len - 1] == '.')
1408                 return 1; /* full label match completes suffix match */
1409
1410         wpa_printf(MSG_DEBUG, "TLS: Reject due to incomplete label match");
1411         return 0;
1412 }
1413 #endif /* CONFIG_NATIVE_WINDOWS */
1414
1415
1416 static int tls_match_suffix(X509 *cert, const char *match, int full)
1417 {
1418 #ifdef CONFIG_NATIVE_WINDOWS
1419         /* wincrypt.h has conflicting X509_NAME definition */
1420         return -1;
1421 #else /* CONFIG_NATIVE_WINDOWS */
1422         GENERAL_NAME *gen;
1423         void *ext;
1424         int i;
1425         stack_index_t j;
1426         int dns_name = 0;
1427         X509_NAME *name;
1428
1429         wpa_printf(MSG_DEBUG, "TLS: Match domain against %s%s",
1430                    full ? "": "suffix ", match);
1431
1432         ext = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL);
1433
1434         for (j = 0; ext && j < sk_GENERAL_NAME_num(ext); j++) {
1435                 gen = sk_GENERAL_NAME_value(ext, j);
1436                 if (gen->type != GEN_DNS)
1437                         continue;
1438                 dns_name++;
1439                 wpa_hexdump_ascii(MSG_DEBUG, "TLS: Certificate dNSName",
1440                                   gen->d.dNSName->data,
1441                                   gen->d.dNSName->length);
1442                 if (domain_suffix_match(gen->d.dNSName->data,
1443                                         gen->d.dNSName->length, match, full) ==
1444                     1) {
1445                         wpa_printf(MSG_DEBUG, "TLS: %s in dNSName found",
1446                                    full ? "Match" : "Suffix match");
1447                         return 1;
1448                 }
1449         }
1450
1451         if (dns_name) {
1452                 wpa_printf(MSG_DEBUG, "TLS: None of the dNSName(s) matched");
1453                 return 0;
1454         }
1455
1456         name = X509_get_subject_name(cert);
1457         i = -1;
1458         for (;;) {
1459                 X509_NAME_ENTRY *e;
1460                 ASN1_STRING *cn;
1461
1462                 i = X509_NAME_get_index_by_NID(name, NID_commonName, i);
1463                 if (i == -1)
1464                         break;
1465                 e = X509_NAME_get_entry(name, i);
1466                 if (e == NULL)
1467                         continue;
1468                 cn = X509_NAME_ENTRY_get_data(e);
1469                 if (cn == NULL)
1470                         continue;
1471                 wpa_hexdump_ascii(MSG_DEBUG, "TLS: Certificate commonName",
1472                                   cn->data, cn->length);
1473                 if (domain_suffix_match(cn->data, cn->length, match, full) == 1)
1474                 {
1475                         wpa_printf(MSG_DEBUG, "TLS: %s in commonName found",
1476                                    full ? "Match" : "Suffix match");
1477                         return 1;
1478                 }
1479         }
1480
1481         wpa_printf(MSG_DEBUG, "TLS: No CommonName %smatch found",
1482                    full ? "": "suffix ");
1483         return 0;
1484 #endif /* CONFIG_NATIVE_WINDOWS */
1485 }
1486
1487
1488 static enum tls_fail_reason openssl_tls_fail_reason(int err)
1489 {
1490         switch (err) {
1491         case X509_V_ERR_CERT_REVOKED:
1492                 return TLS_FAIL_REVOKED;
1493         case X509_V_ERR_CERT_NOT_YET_VALID:
1494         case X509_V_ERR_CRL_NOT_YET_VALID:
1495                 return TLS_FAIL_NOT_YET_VALID;
1496         case X509_V_ERR_CERT_HAS_EXPIRED:
1497         case X509_V_ERR_CRL_HAS_EXPIRED:
1498                 return TLS_FAIL_EXPIRED;
1499         case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
1500         case X509_V_ERR_UNABLE_TO_GET_CRL:
1501         case X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER:
1502         case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
1503         case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
1504         case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
1505         case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
1506         case X509_V_ERR_CERT_CHAIN_TOO_LONG:
1507         case X509_V_ERR_PATH_LENGTH_EXCEEDED:
1508         case X509_V_ERR_INVALID_CA:
1509                 return TLS_FAIL_UNTRUSTED;
1510         case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
1511         case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
1512         case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY:
1513         case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
1514         case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
1515         case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD:
1516         case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:
1517         case X509_V_ERR_CERT_UNTRUSTED:
1518         case X509_V_ERR_CERT_REJECTED:
1519                 return TLS_FAIL_BAD_CERTIFICATE;
1520         default:
1521                 return TLS_FAIL_UNSPECIFIED;
1522         }
1523 }
1524
1525
1526 static struct wpabuf * get_x509_cert(X509 *cert)
1527 {
1528         struct wpabuf *buf;
1529         u8 *tmp;
1530
1531         int cert_len = i2d_X509(cert, NULL);
1532         if (cert_len <= 0)
1533                 return NULL;
1534
1535         buf = wpabuf_alloc(cert_len);
1536         if (buf == NULL)
1537                 return NULL;
1538
1539         tmp = wpabuf_put(buf, cert_len);
1540         i2d_X509(cert, &tmp);
1541         return buf;
1542 }
1543
1544
1545 static void openssl_tls_fail_event(struct tls_connection *conn,
1546                                    X509 *err_cert, int err, int depth,
1547                                    const char *subject, const char *err_str,
1548                                    enum tls_fail_reason reason)
1549 {
1550         union tls_event_data ev;
1551         struct wpabuf *cert = NULL;
1552         struct tls_context *context = conn->context;
1553
1554         if (context->event_cb == NULL)
1555                 return;
1556
1557         cert = get_x509_cert(err_cert);
1558         os_memset(&ev, 0, sizeof(ev));
1559         ev.cert_fail.reason = reason != TLS_FAIL_UNSPECIFIED ?
1560                 reason : openssl_tls_fail_reason(err);
1561         ev.cert_fail.depth = depth;
1562         ev.cert_fail.subject = subject;
1563         ev.cert_fail.reason_txt = err_str;
1564         ev.cert_fail.cert = cert;
1565         context->event_cb(context->cb_ctx, TLS_CERT_CHAIN_FAILURE, &ev);
1566         wpabuf_free(cert);
1567 }
1568
1569
1570 static void openssl_tls_cert_event(struct tls_connection *conn,
1571                                    X509 *err_cert, int depth,
1572                                    const char *subject)
1573 {
1574         struct wpabuf *cert = NULL;
1575         union tls_event_data ev;
1576         struct tls_context *context = conn->context;
1577         char *altsubject[TLS_MAX_ALT_SUBJECT];
1578         int alt, num_altsubject = 0;
1579         GENERAL_NAME *gen;
1580         void *ext;
1581         stack_index_t i;
1582 #ifdef CONFIG_SHA256
1583         u8 hash[32];
1584 #endif /* CONFIG_SHA256 */
1585
1586         if (context->event_cb == NULL)
1587                 return;
1588
1589         os_memset(&ev, 0, sizeof(ev));
1590         if (conn->cert_probe || context->cert_in_cb) {
1591                 cert = get_x509_cert(err_cert);
1592                 ev.peer_cert.cert = cert;
1593         }
1594 #ifdef CONFIG_SHA256
1595         if (cert) {
1596                 const u8 *addr[1];
1597                 size_t len[1];
1598                 addr[0] = wpabuf_head(cert);
1599                 len[0] = wpabuf_len(cert);
1600                 if (sha256_vector(1, addr, len, hash) == 0) {
1601                         ev.peer_cert.hash = hash;
1602                         ev.peer_cert.hash_len = sizeof(hash);
1603                 }
1604         }
1605 #endif /* CONFIG_SHA256 */
1606         ev.peer_cert.depth = depth;
1607         ev.peer_cert.subject = subject;
1608
1609         ext = X509_get_ext_d2i(err_cert, NID_subject_alt_name, NULL, NULL);
1610         for (i = 0; ext && i < sk_GENERAL_NAME_num(ext); i++) {
1611                 char *pos;
1612
1613                 if (num_altsubject == TLS_MAX_ALT_SUBJECT)
1614                         break;
1615                 gen = sk_GENERAL_NAME_value(ext, i);
1616                 if (gen->type != GEN_EMAIL &&
1617                     gen->type != GEN_DNS &&
1618                     gen->type != GEN_URI)
1619                         continue;
1620
1621                 pos = os_malloc(10 + gen->d.ia5->length + 1);
1622                 if (pos == NULL)
1623                         break;
1624                 altsubject[num_altsubject++] = pos;
1625
1626                 switch (gen->type) {
1627                 case GEN_EMAIL:
1628                         os_memcpy(pos, "EMAIL:", 6);
1629                         pos += 6;
1630                         break;
1631                 case GEN_DNS:
1632                         os_memcpy(pos, "DNS:", 4);
1633                         pos += 4;
1634                         break;
1635                 case GEN_URI:
1636                         os_memcpy(pos, "URI:", 4);
1637                         pos += 4;
1638                         break;
1639                 }
1640
1641                 os_memcpy(pos, gen->d.ia5->data, gen->d.ia5->length);
1642                 pos += gen->d.ia5->length;
1643                 *pos = '\0';
1644         }
1645
1646         for (alt = 0; alt < num_altsubject; alt++)
1647                 ev.peer_cert.altsubject[alt] = altsubject[alt];
1648         ev.peer_cert.num_altsubject = num_altsubject;
1649
1650         context->event_cb(context->cb_ctx, TLS_PEER_CERTIFICATE, &ev);
1651         wpabuf_free(cert);
1652         for (alt = 0; alt < num_altsubject; alt++)
1653                 os_free(altsubject[alt]);
1654 }
1655
1656
1657 #ifdef OPENSSL_IS_BORINGSSL
1658
1659 /*
1660  * CertID ::= SEQUENCE {
1661  *     hashAlgorithm      AlgorithmIdentifier,
1662  *     issuerNameHash     OCTET STRING, -- Hash of Issuer's DN
1663  *     issuerKeyHash      OCTET STRING, -- Hash of Issuer's public key
1664  *     serialNumber       CertificateSerialNumber }
1665  */
1666 typedef struct {
1667         X509_ALGOR *hashAlgorithm;
1668         ASN1_OCTET_STRING *issuerNameHash;
1669         ASN1_OCTET_STRING *issuerKeyHash;
1670         ASN1_INTEGER *serialNumber;
1671 } CertID;
1672
1673 /*
1674  * ResponseBytes ::=       SEQUENCE {
1675  *     responseType   OBJECT IDENTIFIER,
1676  *     response       OCTET STRING }
1677  */
1678 typedef struct {
1679         ASN1_OBJECT *responseType;
1680         ASN1_OCTET_STRING *response;
1681 } ResponseBytes;
1682
1683 /*
1684  * OCSPResponse ::= SEQUENCE {
1685  *    responseStatus         OCSPResponseStatus,
1686  *    responseBytes          [0] EXPLICIT ResponseBytes OPTIONAL }
1687  */
1688 typedef struct {
1689         ASN1_ENUMERATED *responseStatus;
1690         ResponseBytes *responseBytes;
1691 } OCSPResponse;
1692
1693 ASN1_SEQUENCE(ResponseBytes) = {
1694         ASN1_SIMPLE(ResponseBytes, responseType, ASN1_OBJECT),
1695         ASN1_SIMPLE(ResponseBytes, response, ASN1_OCTET_STRING)
1696 } ASN1_SEQUENCE_END(ResponseBytes);
1697
1698 ASN1_SEQUENCE(OCSPResponse) = {
1699         ASN1_SIMPLE(OCSPResponse, responseStatus, ASN1_ENUMERATED),
1700         ASN1_EXP_OPT(OCSPResponse, responseBytes, ResponseBytes, 0)
1701 } ASN1_SEQUENCE_END(OCSPResponse);
1702
1703 IMPLEMENT_ASN1_FUNCTIONS(OCSPResponse);
1704
1705 /*
1706  * ResponderID ::= CHOICE {
1707  *    byName               [1] Name,
1708  *    byKey                [2] KeyHash }
1709  */
1710 typedef struct {
1711         int type;
1712         union {
1713                 X509_NAME *byName;
1714                 ASN1_OCTET_STRING *byKey;
1715         } value;
1716 } ResponderID;
1717
1718 /*
1719  * RevokedInfo ::= SEQUENCE {
1720  *     revocationTime              GeneralizedTime,
1721  *     revocationReason    [0]     EXPLICIT CRLReason OPTIONAL }
1722  */
1723 typedef struct {
1724         ASN1_GENERALIZEDTIME *revocationTime;
1725         ASN1_ENUMERATED *revocationReason;
1726 } RevokedInfo;
1727
1728 /*
1729  * CertStatus ::= CHOICE {
1730  *     good        [0]     IMPLICIT NULL,
1731  *     revoked     [1]     IMPLICIT RevokedInfo,
1732  *     unknown     [2]     IMPLICIT UnknownInfo }
1733  */
1734 typedef struct {
1735         int type;
1736         union {
1737                 ASN1_NULL *good;
1738                 RevokedInfo *revoked;
1739                 ASN1_NULL *unknown;
1740         } value;
1741 } CertStatus;
1742
1743 /*
1744  * SingleResponse ::= SEQUENCE {
1745  *    certID                       CertID,
1746  *    certStatus                   CertStatus,
1747  *    thisUpdate                   GeneralizedTime,
1748  *    nextUpdate         [0]       EXPLICIT GeneralizedTime OPTIONAL,
1749  *    singleExtensions   [1]       EXPLICIT Extensions OPTIONAL }
1750  */
1751 typedef struct {
1752         CertID *certID;
1753         CertStatus *certStatus;
1754         ASN1_GENERALIZEDTIME *thisUpdate;
1755         ASN1_GENERALIZEDTIME *nextUpdate;
1756         STACK_OF(X509_EXTENSION) *singleExtensions;
1757 } SingleResponse;
1758
1759 /*
1760  * ResponseData ::= SEQUENCE {
1761  *   version              [0] EXPLICIT Version DEFAULT v1,
1762  *   responderID              ResponderID,
1763  *   producedAt               GeneralizedTime,
1764  *   responses                SEQUENCE OF SingleResponse,
1765  *   responseExtensions   [1] EXPLICIT Extensions OPTIONAL }
1766  */
1767 typedef struct {
1768         ASN1_INTEGER *version;
1769         ResponderID *responderID;
1770         ASN1_GENERALIZEDTIME *producedAt;
1771         STACK_OF(SingleResponse) *responses;
1772         STACK_OF(X509_EXTENSION) *responseExtensions;
1773 } ResponseData;
1774
1775 /*
1776  * BasicOCSPResponse       ::= SEQUENCE {
1777  *   tbsResponseData      ResponseData,
1778  *   signatureAlgorithm   AlgorithmIdentifier,
1779  *   signature            BIT STRING,
1780  *   certs                [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL }
1781  */
1782 typedef struct {
1783         ResponseData *tbsResponseData;
1784         X509_ALGOR *signatureAlgorithm;
1785         ASN1_BIT_STRING *signature;
1786         STACK_OF(X509) *certs;
1787 } BasicOCSPResponse;
1788
1789 ASN1_SEQUENCE(CertID) = {
1790         ASN1_SIMPLE(CertID, hashAlgorithm, X509_ALGOR),
1791         ASN1_SIMPLE(CertID, issuerNameHash, ASN1_OCTET_STRING),
1792         ASN1_SIMPLE(CertID, issuerKeyHash, ASN1_OCTET_STRING),
1793         ASN1_SIMPLE(CertID, serialNumber, ASN1_INTEGER)
1794 } ASN1_SEQUENCE_END(CertID);
1795
1796 ASN1_CHOICE(ResponderID) = {
1797         ASN1_EXP(ResponderID, value.byName, X509_NAME, 1),
1798         ASN1_EXP(ResponderID, value.byKey, ASN1_OCTET_STRING, 2)
1799 } ASN1_CHOICE_END(ResponderID);
1800
1801 ASN1_SEQUENCE(RevokedInfo) = {
1802         ASN1_SIMPLE(RevokedInfo, revocationTime, ASN1_GENERALIZEDTIME),
1803         ASN1_EXP_OPT(RevokedInfo, revocationReason, ASN1_ENUMERATED, 0)
1804 } ASN1_SEQUENCE_END(RevokedInfo);
1805
1806 ASN1_CHOICE(CertStatus) = {
1807         ASN1_IMP(CertStatus, value.good, ASN1_NULL, 0),
1808         ASN1_IMP(CertStatus, value.revoked, RevokedInfo, 1),
1809         ASN1_IMP(CertStatus, value.unknown, ASN1_NULL, 2)
1810 } ASN1_CHOICE_END(CertStatus);
1811
1812 ASN1_SEQUENCE(SingleResponse) = {
1813         ASN1_SIMPLE(SingleResponse, certID, CertID),
1814         ASN1_SIMPLE(SingleResponse, certStatus, CertStatus),
1815         ASN1_SIMPLE(SingleResponse, thisUpdate, ASN1_GENERALIZEDTIME),
1816         ASN1_EXP_OPT(SingleResponse, nextUpdate, ASN1_GENERALIZEDTIME, 0),
1817         ASN1_EXP_SEQUENCE_OF_OPT(SingleResponse, singleExtensions,
1818                                  X509_EXTENSION, 1)
1819 } ASN1_SEQUENCE_END(SingleResponse);
1820
1821 ASN1_SEQUENCE(ResponseData) = {
1822         ASN1_EXP_OPT(ResponseData, version, ASN1_INTEGER, 0),
1823         ASN1_SIMPLE(ResponseData, responderID, ResponderID),
1824         ASN1_SIMPLE(ResponseData, producedAt, ASN1_GENERALIZEDTIME),
1825         ASN1_SEQUENCE_OF(ResponseData, responses, SingleResponse),
1826         ASN1_EXP_SEQUENCE_OF_OPT(ResponseData, responseExtensions,
1827                                  X509_EXTENSION, 1)
1828 } ASN1_SEQUENCE_END(ResponseData);
1829
1830 ASN1_SEQUENCE(BasicOCSPResponse) = {
1831         ASN1_SIMPLE(BasicOCSPResponse, tbsResponseData, ResponseData),
1832         ASN1_SIMPLE(BasicOCSPResponse, signatureAlgorithm, X509_ALGOR),
1833         ASN1_SIMPLE(BasicOCSPResponse, signature, ASN1_BIT_STRING),
1834         ASN1_EXP_SEQUENCE_OF_OPT(BasicOCSPResponse, certs, X509, 0)
1835 } ASN1_SEQUENCE_END(BasicOCSPResponse);
1836
1837 IMPLEMENT_ASN1_FUNCTIONS(BasicOCSPResponse);
1838
1839 #define sk_SingleResponse_num(sk) \
1840 sk_num(CHECKED_CAST(_STACK *, STACK_OF(SingleResponse) *, sk))
1841
1842 #define sk_SingleResponse_value(sk, i) \
1843         ((SingleResponse *)                                             \
1844          sk_value(CHECKED_CAST(_STACK *, STACK_OF(SingleResponse) *, sk), (i)))
1845
1846
1847 static char * mem_bio_to_str(BIO *out)
1848 {
1849         char *txt;
1850         size_t rlen;
1851         int res;
1852
1853         rlen = BIO_ctrl_pending(out);
1854         txt = os_malloc(rlen + 1);
1855         if (!txt) {
1856                 BIO_free(out);
1857                 return NULL;
1858         }
1859
1860         res = BIO_read(out, txt, rlen);
1861         BIO_free(out);
1862         if (res < 0) {
1863                 os_free(txt);
1864                 return NULL;
1865         }
1866
1867         txt[res] = '\0';
1868         return txt;
1869 }
1870
1871
1872 static char * generalizedtime_str(ASN1_GENERALIZEDTIME *t)
1873 {
1874         BIO *out;
1875
1876         out = BIO_new(BIO_s_mem());
1877         if (!out)
1878                 return NULL;
1879
1880         if (!ASN1_GENERALIZEDTIME_print(out, t)) {
1881                 BIO_free(out);
1882                 return NULL;
1883         }
1884
1885         return mem_bio_to_str(out);
1886 }
1887
1888
1889 static char * responderid_str(ResponderID *rid)
1890 {
1891         BIO *out;
1892
1893         out = BIO_new(BIO_s_mem());
1894         if (!out)
1895                 return NULL;
1896
1897         switch (rid->type) {
1898         case 0:
1899                 X509_NAME_print_ex(out, rid->value.byName, 0, XN_FLAG_ONELINE);
1900                 break;
1901         case 1:
1902                 i2a_ASN1_STRING(out, rid->value.byKey, V_ASN1_OCTET_STRING);
1903                 break;
1904         default:
1905                 BIO_free(out);
1906                 return NULL;
1907         }
1908
1909         return mem_bio_to_str(out);
1910 }
1911
1912
1913 static char * octet_string_str(ASN1_OCTET_STRING *o)
1914 {
1915         BIO *out;
1916
1917         out = BIO_new(BIO_s_mem());
1918         if (!out)
1919                 return NULL;
1920
1921         i2a_ASN1_STRING(out, o, V_ASN1_OCTET_STRING);
1922         return mem_bio_to_str(out);
1923 }
1924
1925
1926 static char * integer_str(ASN1_INTEGER *i)
1927 {
1928         BIO *out;
1929
1930         out = BIO_new(BIO_s_mem());
1931         if (!out)
1932                 return NULL;
1933
1934         i2a_ASN1_INTEGER(out, i);
1935         return mem_bio_to_str(out);
1936 }
1937
1938
1939 static char * algor_str(X509_ALGOR *alg)
1940 {
1941         BIO *out;
1942
1943         out = BIO_new(BIO_s_mem());
1944         if (!out)
1945                 return NULL;
1946
1947         i2a_ASN1_OBJECT(out, alg->algorithm);
1948         return mem_bio_to_str(out);
1949 }
1950
1951
1952 static char * extensions_str(const char *title, STACK_OF(X509_EXTENSION) *ext)
1953 {
1954         BIO *out;
1955
1956         if (!ext)
1957                 return NULL;
1958
1959         out = BIO_new(BIO_s_mem());
1960         if (!out)
1961                 return NULL;
1962
1963         if (!X509V3_extensions_print(out, title, ext, 0, 0)) {
1964                 BIO_free(out);
1965                 return NULL;
1966         }
1967         return mem_bio_to_str(out);
1968 }
1969
1970
1971 static int ocsp_resp_valid(ASN1_GENERALIZEDTIME *thisupd,
1972                            ASN1_GENERALIZEDTIME *nextupd)
1973 {
1974         time_t now, tmp;
1975
1976         if (!ASN1_GENERALIZEDTIME_check(thisupd)) {
1977                 wpa_printf(MSG_DEBUG,
1978                            "OpenSSL: Invalid OCSP response thisUpdate");
1979                 return 0;
1980         }
1981
1982         time(&now);
1983         tmp = now + 5 * 60; /* allow five minute clock difference */
1984         if (X509_cmp_time(thisupd, &tmp) > 0) {
1985                 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP response not yet valid");
1986                 return 0;
1987         }
1988
1989         if (!nextupd)
1990                 return 1; /* OK - no limit on response age */
1991
1992         if (!ASN1_GENERALIZEDTIME_check(nextupd)) {
1993                 wpa_printf(MSG_DEBUG,
1994                            "OpenSSL: Invalid OCSP response nextUpdate");
1995                 return 0;
1996         }
1997
1998         tmp = now - 5 * 60; /* allow five minute clock difference */
1999         if (X509_cmp_time(nextupd, &tmp) < 0) {
2000                 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP response expired");
2001                 return 0;
2002         }
2003
2004         if (ASN1_STRING_cmp(nextupd, thisupd) < 0) {
2005                 wpa_printf(MSG_DEBUG,
2006                            "OpenSSL: OCSP response nextUpdate before thisUpdate");
2007                 return 0;
2008         }
2009
2010         /* Both thisUpdate and nextUpdate are valid */
2011         return -1;
2012 }
2013
2014
2015 static int issuer_match(X509 *cert, X509 *issuer, CertID *certid)
2016 {
2017         X509_NAME *iname;
2018         ASN1_BIT_STRING *ikey;
2019         const EVP_MD *dgst;
2020         unsigned int len;
2021         unsigned char md[EVP_MAX_MD_SIZE];
2022         ASN1_OCTET_STRING *hash;
2023         char *txt;
2024
2025         dgst = EVP_get_digestbyobj(certid->hashAlgorithm->algorithm);
2026         if (!dgst) {
2027                 wpa_printf(MSG_DEBUG,
2028                            "OpenSSL: Could not find matching hash algorithm for OCSP");
2029                 return -1;
2030         }
2031
2032         iname = X509_get_issuer_name(cert);
2033         if (!X509_NAME_digest(iname, dgst, md, &len))
2034                 return -1;
2035         hash = ASN1_OCTET_STRING_new();
2036         if (!hash)
2037                 return -1;
2038         if (!ASN1_OCTET_STRING_set(hash, md, len)) {
2039                 ASN1_OCTET_STRING_free(hash);
2040                 return -1;
2041         }
2042
2043         txt = octet_string_str(hash);
2044         if (txt) {
2045                 wpa_printf(MSG_DEBUG, "OpenSSL: calculated issuerNameHash: %s",
2046                            txt);
2047                 os_free(txt);
2048         }
2049
2050         if (ASN1_OCTET_STRING_cmp(certid->issuerNameHash, hash)) {
2051                 ASN1_OCTET_STRING_free(hash);
2052                 return -1;
2053         }
2054
2055         ikey = X509_get0_pubkey_bitstr(issuer);
2056         if (!EVP_Digest(ikey->data, ikey->length, md, &len, dgst, NULL) ||
2057             !ASN1_OCTET_STRING_set(hash, md, len)) {
2058                 ASN1_OCTET_STRING_free(hash);
2059                 return -1;
2060         }
2061
2062         txt = octet_string_str(hash);
2063         if (txt) {
2064                 wpa_printf(MSG_DEBUG, "OpenSSL: calculated issuerKeyHash: %s",
2065                            txt);
2066                 os_free(txt);
2067         }
2068
2069         if (ASN1_OCTET_STRING_cmp(certid->issuerKeyHash, hash)) {
2070                 ASN1_OCTET_STRING_free(hash);
2071                 return -1;
2072         }
2073
2074         ASN1_OCTET_STRING_free(hash);
2075         return 0;
2076 }
2077
2078
2079 static X509 * ocsp_find_signer(STACK_OF(X509) *certs, ResponderID *rid)
2080 {
2081         unsigned int i;
2082         unsigned char hash[SHA_DIGEST_LENGTH];
2083
2084         if (rid->type == 0) {
2085                 /* byName */
2086                 return X509_find_by_subject(certs, rid->value.byName);
2087         }
2088
2089         /* byKey */
2090         if (rid->value.byKey->length != SHA_DIGEST_LENGTH)
2091                 return NULL;
2092         for (i = 0; i < sk_X509_num(certs); i++) {
2093                 X509 *x = sk_X509_value(certs, i);
2094
2095                 X509_pubkey_digest(x, EVP_sha1(), hash, NULL);
2096                 if (os_memcmp(rid->value.byKey->data, hash,
2097                               SHA_DIGEST_LENGTH) == 0)
2098                         return x;
2099         }
2100
2101         return NULL;
2102 }
2103
2104
2105 enum ocsp_result {
2106         OCSP_GOOD, OCSP_REVOKED, OCSP_NO_RESPONSE, OCSP_INVALID
2107 };
2108
2109 static enum ocsp_result check_ocsp_resp(struct tls_connection *conn,
2110                                         X509 *cert, X509 *issuer)
2111 {
2112         const uint8_t *resp_data;
2113         size_t resp_len;
2114         OCSPResponse *resp;
2115         int status;
2116         ResponseBytes *bytes;
2117         const u8 *basic_data;
2118         size_t basic_len;
2119         BasicOCSPResponse *basic;
2120         ResponseData *rd;
2121         char *txt;
2122         int i, num;
2123         unsigned int j, num_resp;
2124         SingleResponse *matching_resp = NULL, *cmp_sresp;
2125         enum ocsp_result result = OCSP_INVALID;
2126         X509_STORE *store;
2127         STACK_OF(X509) *untrusted = NULL, *certs = NULL, *chain = NULL;
2128         X509_STORE_CTX ctx;
2129         X509 *signer, *tmp_cert;
2130         int signer_trusted = 0;
2131         EVP_PKEY *skey;
2132         int ret;
2133         char buf[256];
2134
2135         txt = integer_str(X509_get_serialNumber(cert));
2136         if (txt) {
2137                 wpa_printf(MSG_DEBUG,
2138                            "OpenSSL: Searching OCSP response for peer certificate serialNumber: %s", txt);
2139                 os_free(txt);
2140         }
2141
2142         SSL_get0_ocsp_response(conn->ssl, &resp_data, &resp_len);
2143         if (resp_data == NULL || resp_len == 0) {
2144                 wpa_printf(MSG_DEBUG, "OpenSSL: No OCSP response received");
2145                 return OCSP_NO_RESPONSE;
2146         }
2147
2148         wpa_hexdump(MSG_DEBUG, "OpenSSL: OCSP response", resp_data, resp_len);
2149
2150         resp = d2i_OCSPResponse(NULL, &resp_data, resp_len);
2151         if (!resp) {
2152                 wpa_printf(MSG_INFO, "OpenSSL: Failed to parse OCSPResponse");
2153                 return OCSP_INVALID;
2154         }
2155
2156         status = ASN1_ENUMERATED_get(resp->responseStatus);
2157         if (status != 0) {
2158                 wpa_printf(MSG_INFO, "OpenSSL: OCSP responder error %d",
2159                            status);
2160                 return OCSP_INVALID;
2161         }
2162
2163         bytes = resp->responseBytes;
2164
2165         if (!bytes ||
2166             OBJ_obj2nid(bytes->responseType) != NID_id_pkix_OCSP_basic) {
2167                 wpa_printf(MSG_INFO,
2168                            "OpenSSL: Could not find BasicOCSPResponse");
2169                 return OCSP_INVALID;
2170         }
2171
2172         basic_data = ASN1_STRING_data(bytes->response);
2173         basic_len = ASN1_STRING_length(bytes->response);
2174         wpa_hexdump(MSG_DEBUG, "OpenSSL: BasicOCSPResponse",
2175                     basic_data, basic_len);
2176
2177         basic = d2i_BasicOCSPResponse(NULL, &basic_data, basic_len);
2178         if (!basic) {
2179                 wpa_printf(MSG_INFO,
2180                            "OpenSSL: Could not parse BasicOCSPResponse");
2181                 OCSPResponse_free(resp);
2182                 return OCSP_INVALID;
2183         }
2184
2185         rd = basic->tbsResponseData;
2186
2187         if (basic->certs) {
2188                 untrusted = sk_X509_dup(basic->certs);
2189
2190                 num = sk_X509_num(basic->certs);
2191                 for (i = 0; i < num; i++) {
2192                         X509 *extra_cert;
2193
2194                         extra_cert = sk_X509_value(basic->certs, i);
2195                         X509_NAME_oneline(X509_get_subject_name(extra_cert),
2196                                           buf, sizeof(buf));
2197                         wpa_printf(MSG_DEBUG,
2198                                    "OpenSSL: BasicOCSPResponse cert %s", buf);
2199
2200                         if (!sk_X509_push(untrusted, extra_cert)) {
2201                                 wpa_printf(MSG_DEBUG,
2202                                            "OpenSSL: Could not add certificate to the untrusted stack");
2203                         }
2204                 }
2205         }
2206
2207         store = SSL_CTX_get_cert_store(conn->ssl_ctx);
2208         if (conn->peer_issuer) {
2209                 if (X509_STORE_add_cert(store, conn->peer_issuer) != 1) {
2210                         tls_show_errors(MSG_INFO, __func__,
2211                                         "OpenSSL: Could not add issuer to certificate store");
2212                 }
2213                 certs = sk_X509_new_null();
2214                 if (certs) {
2215                         tmp_cert = X509_dup(conn->peer_issuer);
2216                         if (tmp_cert && !sk_X509_push(certs, tmp_cert)) {
2217                                 tls_show_errors(
2218                                         MSG_INFO, __func__,
2219                                         "OpenSSL: Could not add issuer to OCSP responder trust store");
2220                                 X509_free(tmp_cert);
2221                                 sk_X509_free(certs);
2222                                 certs = NULL;
2223                         }
2224                         if (certs && conn->peer_issuer_issuer) {
2225                                 tmp_cert = X509_dup(conn->peer_issuer_issuer);
2226                                 if (tmp_cert &&
2227                                     !sk_X509_push(certs, tmp_cert)) {
2228                                         tls_show_errors(
2229                                                 MSG_INFO, __func__,
2230                                                 "OpenSSL: Could not add issuer's issuer to OCSP responder trust store");
2231                                         X509_free(tmp_cert);
2232                                 }
2233                         }
2234                 }
2235         }
2236
2237         signer = ocsp_find_signer(certs, rd->responderID);
2238         if (!signer)
2239                 signer = ocsp_find_signer(untrusted, rd->responderID);
2240         else
2241                 signer_trusted = 1;
2242         if (!signer) {
2243                 wpa_printf(MSG_DEBUG,
2244                            "OpenSSL: Could not find OCSP signer certificate");
2245                 goto fail;
2246         }
2247
2248         skey = X509_get_pubkey(signer);
2249         if (!skey) {
2250                 wpa_printf(MSG_DEBUG,
2251                            "OpenSSL: Could not get OCSP signer public key");
2252                 goto fail;
2253         }
2254         if (ASN1_item_verify(ASN1_ITEM_rptr(ResponseData),
2255                              basic->signatureAlgorithm, basic->signature,
2256                              basic->tbsResponseData, skey) <= 0) {
2257                 wpa_printf(MSG_DEBUG,
2258                            "OpenSSL: BasicOCSPResponse signature is invalid");
2259                 goto fail;
2260         }
2261
2262         X509_NAME_oneline(X509_get_subject_name(signer), buf, sizeof(buf));
2263         wpa_printf(MSG_DEBUG,
2264                    "OpenSSL: Found OCSP signer certificate %s and verified BasicOCSPResponse signature",
2265                    buf);
2266
2267         if (!X509_STORE_CTX_init(&ctx, store, signer, untrusted))
2268                 goto fail;
2269         X509_STORE_CTX_set_purpose(&ctx, X509_PURPOSE_OCSP_HELPER);
2270         ret = X509_verify_cert(&ctx);
2271         chain = X509_STORE_CTX_get1_chain(&ctx);
2272         X509_STORE_CTX_cleanup(&ctx);
2273         if (ret <= 0) {
2274                 wpa_printf(MSG_DEBUG,
2275                            "OpenSSL: Could not validate OCSP signer certificate");
2276                 goto fail;
2277         }
2278
2279         if (!chain || sk_X509_num(chain) <= 0) {
2280                 wpa_printf(MSG_DEBUG, "OpenSSL: No OCSP signer chain found");
2281                 goto fail;
2282         }
2283
2284         if (!signer_trusted) {
2285                 X509_check_purpose(signer, -1, 0);
2286                 if ((signer->ex_flags & EXFLAG_XKUSAGE) &&
2287                     (signer->ex_xkusage & XKU_OCSP_SIGN)) {
2288                         wpa_printf(MSG_DEBUG,
2289                                    "OpenSSL: OCSP signer certificate delegation OK");
2290                 } else {
2291                         tmp_cert = sk_X509_value(chain, sk_X509_num(chain) - 1);
2292                         if (X509_check_trust(tmp_cert, NID_OCSP_sign, 0) !=
2293                             X509_TRUST_TRUSTED) {
2294                                 wpa_printf(MSG_DEBUG,
2295                                            "OpenSSL: OCSP signer certificate not trusted");
2296                                 result = OCSP_NO_RESPONSE;
2297                                 goto fail;
2298                         }
2299                 }
2300         }
2301
2302         wpa_printf(MSG_DEBUG, "OpenSSL: OCSP version: %lu",
2303                    ASN1_INTEGER_get(rd->version));
2304
2305         txt = responderid_str(rd->responderID);
2306         if (txt) {
2307                 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP responderID: %s",
2308                            txt);
2309                 os_free(txt);
2310         }
2311
2312         txt = generalizedtime_str(rd->producedAt);
2313         if (txt) {
2314                 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP producedAt: %s",
2315                            txt);
2316                 os_free(txt);
2317         }
2318
2319         num_resp = sk_SingleResponse_num(rd->responses);
2320         if (num_resp == 0) {
2321                 wpa_printf(MSG_DEBUG,
2322                            "OpenSSL: No OCSP SingleResponse within BasicOCSPResponse");
2323                 result = OCSP_NO_RESPONSE;
2324                 goto fail;
2325         }
2326         cmp_sresp = sk_SingleResponse_value(rd->responses, 0);
2327         for (j = 0; j < num_resp; j++) {
2328                 SingleResponse *sresp;
2329                 CertID *cid1, *cid2;
2330
2331                 sresp = sk_SingleResponse_value(rd->responses, j);
2332                 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP SingleResponse %u/%u",
2333                            j + 1, num_resp);
2334
2335                 txt = algor_str(sresp->certID->hashAlgorithm);
2336                 if (txt) {
2337                         wpa_printf(MSG_DEBUG,
2338                                    "OpenSSL: certID hashAlgorithm: %s", txt);
2339                         os_free(txt);
2340                 }
2341
2342                 txt = octet_string_str(sresp->certID->issuerNameHash);
2343                 if (txt) {
2344                         wpa_printf(MSG_DEBUG,
2345                                    "OpenSSL: certID issuerNameHash: %s", txt);
2346                         os_free(txt);
2347                 }
2348
2349                 txt = octet_string_str(sresp->certID->issuerKeyHash);
2350                 if (txt) {
2351                         wpa_printf(MSG_DEBUG,
2352                                    "OpenSSL: certID issuerKeyHash: %s", txt);
2353                         os_free(txt);
2354                 }
2355
2356                 txt = integer_str(sresp->certID->serialNumber);
2357                 if (txt) {
2358                         wpa_printf(MSG_DEBUG,
2359                                    "OpenSSL: certID serialNumber: %s", txt);
2360                         os_free(txt);
2361                 }
2362
2363                 switch (sresp->certStatus->type) {
2364                 case 0:
2365                         wpa_printf(MSG_DEBUG, "OpenSSL: certStatus: good");
2366                         break;
2367                 case 1:
2368                         wpa_printf(MSG_DEBUG, "OpenSSL: certStatus: revoked");
2369                         break;
2370                 default:
2371                         wpa_printf(MSG_DEBUG, "OpenSSL: certStatus: unknown");
2372                         break;
2373                 }
2374
2375                 txt = generalizedtime_str(sresp->thisUpdate);
2376                 if (txt) {
2377                         wpa_printf(MSG_DEBUG, "OpenSSL: thisUpdate: %s", txt);
2378                         os_free(txt);
2379                 }
2380
2381                 if (sresp->nextUpdate) {
2382                         txt = generalizedtime_str(sresp->nextUpdate);
2383                         if (txt) {
2384                                 wpa_printf(MSG_DEBUG, "OpenSSL: nextUpdate: %s",
2385                                            txt);
2386                                 os_free(txt);
2387                         }
2388                 }
2389
2390                 txt = extensions_str("singleExtensions",
2391                                      sresp->singleExtensions);
2392                 if (txt) {
2393                         wpa_printf(MSG_DEBUG, "OpenSSL: %s", txt);
2394                         os_free(txt);
2395                 }
2396
2397                 cid1 = cmp_sresp->certID;
2398                 cid2 = sresp->certID;
2399                 if (j > 0 &&
2400                     (OBJ_cmp(cid1->hashAlgorithm->algorithm,
2401                              cid2->hashAlgorithm->algorithm) != 0 ||
2402                      ASN1_OCTET_STRING_cmp(cid1->issuerNameHash,
2403                                            cid2->issuerNameHash) != 0 ||
2404                      ASN1_OCTET_STRING_cmp(cid1->issuerKeyHash,
2405                                            cid2->issuerKeyHash) != 0)) {
2406                         wpa_printf(MSG_DEBUG,
2407                                    "OpenSSL: Different OCSP response issuer information between SingleResponse values within BasicOCSPResponse");
2408                         goto fail;
2409                 }
2410
2411                 if (!matching_resp && issuer &&
2412                     ASN1_INTEGER_cmp(sresp->certID->serialNumber,
2413                                      X509_get_serialNumber(cert)) == 0 &&
2414                     issuer_match(cert, issuer, sresp->certID) == 0) {
2415                         wpa_printf(MSG_DEBUG,
2416                                    "OpenSSL: This response matches peer certificate");
2417                         matching_resp = sresp;
2418                 }
2419         }
2420
2421         txt = extensions_str("responseExtensions", rd->responseExtensions);
2422         if (txt) {
2423                 wpa_printf(MSG_DEBUG, "OpenSSL: %s", txt);
2424                 os_free(txt);
2425         }
2426
2427         if (!matching_resp) {
2428                 wpa_printf(MSG_DEBUG,
2429                            "OpenSSL: Could not find OCSP response that matches the peer certificate");
2430                 result = OCSP_NO_RESPONSE;
2431                 goto fail;
2432         }
2433
2434         if (!ocsp_resp_valid(matching_resp->thisUpdate,
2435                              matching_resp->nextUpdate)) {
2436                 wpa_printf(MSG_DEBUG,
2437                            "OpenSSL: OCSP response not valid at this time");
2438                 goto fail;
2439         }
2440
2441         if (matching_resp->certStatus->type == 1) {
2442                 wpa_printf(MSG_DEBUG,
2443                            "OpenSSL: OCSP response indicated that the peer certificate has been revoked");
2444                 result = OCSP_REVOKED;
2445                 goto fail;
2446         }
2447
2448         if (matching_resp->certStatus->type != 0) {
2449                 wpa_printf(MSG_DEBUG,
2450                            "OpenSSL: OCSP response did not indicate good status");
2451                 result = OCSP_NO_RESPONSE;
2452                 goto fail;
2453         }
2454
2455         /* OCSP response indicated the certificate is good. */
2456         result = OCSP_GOOD;
2457 fail:
2458         sk_X509_pop_free(chain, X509_free);
2459         sk_X509_free(untrusted);
2460         sk_X509_pop_free(certs, X509_free);
2461         BasicOCSPResponse_free(basic);
2462         OCSPResponse_free(resp);
2463
2464         return result;
2465 }
2466
2467 #endif /* OPENSSL_IS_BORINGSSL */
2468
2469
2470 static int tls_verify_cb(int preverify_ok, X509_STORE_CTX *x509_ctx)
2471 {
2472         char buf[256];
2473         X509 *err_cert;
2474         int err, depth;
2475         SSL *ssl;
2476         struct tls_connection *conn;
2477         struct tls_context *context;
2478         char *match, *altmatch, *suffix_match, *domain_match;
2479         const char *err_str;
2480
2481         err_cert = X509_STORE_CTX_get_current_cert(x509_ctx);
2482         if (!err_cert)
2483                 return 0;
2484
2485         err = X509_STORE_CTX_get_error(x509_ctx);
2486         depth = X509_STORE_CTX_get_error_depth(x509_ctx);
2487         ssl = X509_STORE_CTX_get_ex_data(x509_ctx,
2488                                          SSL_get_ex_data_X509_STORE_CTX_idx());
2489         X509_NAME_oneline(X509_get_subject_name(err_cert), buf, sizeof(buf));
2490
2491         conn = SSL_get_app_data(ssl);
2492         if (conn == NULL)
2493                 return 0;
2494
2495         if (depth == 0)
2496                 conn->peer_cert = err_cert;
2497         else if (depth == 1)
2498                 conn->peer_issuer = err_cert;
2499         else if (depth == 2)
2500                 conn->peer_issuer_issuer = err_cert;
2501
2502         context = conn->context;
2503         match = conn->subject_match;
2504         altmatch = conn->altsubject_match;
2505         suffix_match = conn->suffix_match;
2506         domain_match = conn->domain_match;
2507
2508         if (!preverify_ok && !conn->ca_cert_verify)
2509                 preverify_ok = 1;
2510         if (!preverify_ok && depth > 0 && conn->server_cert_only)
2511                 preverify_ok = 1;
2512         if (!preverify_ok && (conn->flags & TLS_CONN_DISABLE_TIME_CHECKS) &&
2513             (err == X509_V_ERR_CERT_HAS_EXPIRED ||
2514              err == X509_V_ERR_CERT_NOT_YET_VALID)) {
2515                 wpa_printf(MSG_DEBUG, "OpenSSL: Ignore certificate validity "
2516                            "time mismatch");
2517                 preverify_ok = 1;
2518         }
2519
2520         err_str = X509_verify_cert_error_string(err);
2521
2522 #ifdef CONFIG_SHA256
2523         /*
2524          * Do not require preverify_ok so we can explicity allow otherwise
2525          * invalid pinned server certificates.
2526          */
2527         if (depth == 0 && conn->server_cert_only) {
2528                 struct wpabuf *cert;
2529                 cert = get_x509_cert(err_cert);
2530                 if (!cert) {
2531                         wpa_printf(MSG_DEBUG, "OpenSSL: Could not fetch "
2532                                    "server certificate data");
2533                         preverify_ok = 0;
2534                 } else {
2535                         u8 hash[32];
2536                         const u8 *addr[1];
2537                         size_t len[1];
2538                         addr[0] = wpabuf_head(cert);
2539                         len[0] = wpabuf_len(cert);
2540                         if (sha256_vector(1, addr, len, hash) < 0 ||
2541                             os_memcmp(conn->srv_cert_hash, hash, 32) != 0) {
2542                                 err_str = "Server certificate mismatch";
2543                                 err = X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN;
2544                                 preverify_ok = 0;
2545                         } else if (!preverify_ok) {
2546                                 /*
2547                                  * Certificate matches pinned certificate, allow
2548                                  * regardless of other problems.
2549                                  */
2550                                 wpa_printf(MSG_DEBUG,
2551                                            "OpenSSL: Ignore validation issues for a pinned server certificate");
2552                                 preverify_ok = 1;
2553                         }
2554                         wpabuf_free(cert);
2555                 }
2556         }
2557 #endif /* CONFIG_SHA256 */
2558
2559         if (!preverify_ok) {
2560                 wpa_printf(MSG_WARNING, "TLS: Certificate verification failed,"
2561                            " error %d (%s) depth %d for '%s'", err, err_str,
2562                            depth, buf);
2563                 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2564                                        err_str, TLS_FAIL_UNSPECIFIED);
2565                 return preverify_ok;
2566         }
2567
2568         wpa_printf(MSG_DEBUG, "TLS: tls_verify_cb - preverify_ok=%d "
2569                    "err=%d (%s) ca_cert_verify=%d depth=%d buf='%s'",
2570                    preverify_ok, err, err_str,
2571                    conn->ca_cert_verify, depth, buf);
2572         if (depth == 0 && match && os_strstr(buf, match) == NULL) {
2573                 wpa_printf(MSG_WARNING, "TLS: Subject '%s' did not "
2574                            "match with '%s'", buf, match);
2575                 preverify_ok = 0;
2576                 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2577                                        "Subject mismatch",
2578                                        TLS_FAIL_SUBJECT_MISMATCH);
2579         } else if (depth == 0 && altmatch &&
2580                    !tls_match_altsubject(err_cert, altmatch)) {
2581                 wpa_printf(MSG_WARNING, "TLS: altSubjectName match "
2582                            "'%s' not found", altmatch);
2583                 preverify_ok = 0;
2584                 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2585                                        "AltSubject mismatch",
2586                                        TLS_FAIL_ALTSUBJECT_MISMATCH);
2587         } else if (depth == 0 && suffix_match &&
2588                    !tls_match_suffix(err_cert, suffix_match, 0)) {
2589                 wpa_printf(MSG_WARNING, "TLS: Domain suffix match '%s' not found",
2590                            suffix_match);
2591                 preverify_ok = 0;
2592                 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2593                                        "Domain suffix mismatch",
2594                                        TLS_FAIL_DOMAIN_SUFFIX_MISMATCH);
2595         } else if (depth == 0 && domain_match &&
2596                    !tls_match_suffix(err_cert, domain_match, 1)) {
2597                 wpa_printf(MSG_WARNING, "TLS: Domain match '%s' not found",
2598                            domain_match);
2599                 preverify_ok = 0;
2600                 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2601                                        "Domain mismatch",
2602                                        TLS_FAIL_DOMAIN_MISMATCH);
2603         } else
2604                 openssl_tls_cert_event(conn, err_cert, depth, buf);
2605
2606         if (conn->cert_probe && preverify_ok && depth == 0) {
2607                 wpa_printf(MSG_DEBUG, "OpenSSL: Reject server certificate "
2608                            "on probe-only run");
2609                 preverify_ok = 0;
2610                 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2611                                        "Server certificate chain probe",
2612                                        TLS_FAIL_SERVER_CHAIN_PROBE);
2613         }
2614
2615 #ifdef OPENSSL_IS_BORINGSSL
2616         if (depth == 0 && (conn->flags & TLS_CONN_REQUEST_OCSP)) {
2617                 enum ocsp_result res;
2618
2619                 res = check_ocsp_resp(conn, err_cert, conn->peer_issuer);
2620                 if (res == OCSP_REVOKED) {
2621                         preverify_ok = 0;
2622                         openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2623                                                "certificate revoked",
2624                                                TLS_FAIL_REVOKED);
2625                         if (err == X509_V_OK)
2626                                 X509_STORE_CTX_set_error(
2627                                         x509_ctx, X509_V_ERR_CERT_REVOKED);
2628                 } else if (res != OCSP_GOOD &&
2629                            (conn->flags & TLS_CONN_REQUIRE_OCSP)) {
2630                         preverify_ok = 0;
2631                         openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2632                                                "bad certificate status response",
2633                                                TLS_FAIL_UNSPECIFIED);
2634                 }
2635         }
2636 #endif /* OPENSSL_IS_BORINGSSL */
2637
2638         if (preverify_ok && context->event_cb != NULL)
2639                 context->event_cb(context->cb_ctx,
2640                                   TLS_CERT_CHAIN_SUCCESS, NULL);
2641
2642         return preverify_ok;
2643 }
2644
2645
2646 #ifndef OPENSSL_NO_STDIO
2647 static int tls_load_ca_der(struct tls_data *data, const char *ca_cert)
2648 {
2649         SSL_CTX *ssl_ctx = data->ssl;
2650         X509_LOOKUP *lookup;
2651         int ret = 0;
2652
2653         lookup = X509_STORE_add_lookup(SSL_CTX_get_cert_store(ssl_ctx),
2654                                        X509_LOOKUP_file());
2655         if (lookup == NULL) {
2656                 tls_show_errors(MSG_WARNING, __func__,
2657                                 "Failed add lookup for X509 store");
2658                 return -1;
2659         }
2660
2661         if (!X509_LOOKUP_load_file(lookup, ca_cert, X509_FILETYPE_ASN1)) {
2662                 unsigned long err = ERR_peek_error();
2663                 tls_show_errors(MSG_WARNING, __func__,
2664                                 "Failed load CA in DER format");
2665                 if (ERR_GET_LIB(err) == ERR_LIB_X509 &&
2666                     ERR_GET_REASON(err) == X509_R_CERT_ALREADY_IN_HASH_TABLE) {
2667                         wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring "
2668                                    "cert already in hash table error",
2669                                    __func__);
2670                 } else
2671                         ret = -1;
2672         }
2673
2674         return ret;
2675 }
2676 #endif /* OPENSSL_NO_STDIO */
2677
2678
2679 static int tls_connection_ca_cert(struct tls_data *data,
2680                                   struct tls_connection *conn,
2681                                   const char *ca_cert, const u8 *ca_cert_blob,
2682                                   size_t ca_cert_blob_len, const char *ca_path)
2683 {
2684         SSL_CTX *ssl_ctx = data->ssl;
2685         X509_STORE *store;
2686
2687         /*
2688          * Remove previously configured trusted CA certificates before adding
2689          * new ones.
2690          */
2691         store = X509_STORE_new();
2692         if (store == NULL) {
2693                 wpa_printf(MSG_DEBUG, "OpenSSL: %s - failed to allocate new "
2694                            "certificate store", __func__);
2695                 return -1;
2696         }
2697         SSL_CTX_set_cert_store(ssl_ctx, store);
2698
2699         SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);
2700         conn->ca_cert_verify = 1;
2701
2702         if (ca_cert && os_strncmp(ca_cert, "probe://", 8) == 0) {
2703                 wpa_printf(MSG_DEBUG, "OpenSSL: Probe for server certificate "
2704                            "chain");
2705                 conn->cert_probe = 1;
2706                 conn->ca_cert_verify = 0;
2707                 return 0;
2708         }
2709
2710         if (ca_cert && os_strncmp(ca_cert, "hash://", 7) == 0) {
2711 #ifdef CONFIG_SHA256
2712                 const char *pos = ca_cert + 7;
2713                 if (os_strncmp(pos, "server/sha256/", 14) != 0) {
2714                         wpa_printf(MSG_DEBUG, "OpenSSL: Unsupported ca_cert "
2715                                    "hash value '%s'", ca_cert);
2716                         return -1;
2717                 }
2718                 pos += 14;
2719                 if (os_strlen(pos) != 32 * 2) {
2720                         wpa_printf(MSG_DEBUG, "OpenSSL: Unexpected SHA256 "
2721                                    "hash length in ca_cert '%s'", ca_cert);
2722                         return -1;
2723                 }
2724                 if (hexstr2bin(pos, conn->srv_cert_hash, 32) < 0) {
2725                         wpa_printf(MSG_DEBUG, "OpenSSL: Invalid SHA256 hash "
2726                                    "value in ca_cert '%s'", ca_cert);
2727                         return -1;
2728                 }
2729                 conn->server_cert_only = 1;
2730                 wpa_printf(MSG_DEBUG, "OpenSSL: Checking only server "
2731                            "certificate match");
2732                 return 0;
2733 #else /* CONFIG_SHA256 */
2734                 wpa_printf(MSG_INFO, "No SHA256 included in the build - "
2735                            "cannot validate server certificate hash");
2736                 return -1;
2737 #endif /* CONFIG_SHA256 */
2738         }
2739
2740         if (ca_cert_blob) {
2741                 X509 *cert = d2i_X509(NULL,
2742                                       (const unsigned char **) &ca_cert_blob,
2743                                       ca_cert_blob_len);
2744                 if (cert == NULL) {
2745                         tls_show_errors(MSG_WARNING, __func__,
2746                                         "Failed to parse ca_cert_blob");
2747                         return -1;
2748                 }
2749
2750                 if (!X509_STORE_add_cert(SSL_CTX_get_cert_store(ssl_ctx),
2751                                          cert)) {
2752                         unsigned long err = ERR_peek_error();
2753                         tls_show_errors(MSG_WARNING, __func__,
2754                                         "Failed to add ca_cert_blob to "
2755                                         "certificate store");
2756                         if (ERR_GET_LIB(err) == ERR_LIB_X509 &&
2757                             ERR_GET_REASON(err) ==
2758                             X509_R_CERT_ALREADY_IN_HASH_TABLE) {
2759                                 wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring "
2760                                            "cert already in hash table error",
2761                                            __func__);
2762                         } else {
2763                                 X509_free(cert);
2764                                 return -1;
2765                         }
2766                 }
2767                 X509_free(cert);
2768                 wpa_printf(MSG_DEBUG, "OpenSSL: %s - added ca_cert_blob "
2769                            "to certificate store", __func__);
2770                 return 0;
2771         }
2772
2773 #ifdef ANDROID
2774         if (ca_cert && os_strncmp("keystore://", ca_cert, 11) == 0) {
2775                 BIO *bio = BIO_from_keystore(&ca_cert[11]);
2776                 STACK_OF(X509_INFO) *stack = NULL;
2777                 stack_index_t i;
2778
2779                 if (bio) {
2780                         stack = PEM_X509_INFO_read_bio(bio, NULL, NULL, NULL);
2781                         BIO_free(bio);
2782                 }
2783                 if (!stack)
2784                         return -1;
2785
2786                 for (i = 0; i < sk_X509_INFO_num(stack); ++i) {
2787                         X509_INFO *info = sk_X509_INFO_value(stack, i);
2788                         if (info->x509) {
2789                                 X509_STORE_add_cert(ssl_ctx->cert_store,
2790                                                     info->x509);
2791                         }
2792                         if (info->crl) {
2793                                 X509_STORE_add_crl(ssl_ctx->cert_store,
2794                                                    info->crl);
2795                         }
2796                 }
2797                 sk_X509_INFO_pop_free(stack, X509_INFO_free);
2798                 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);
2799                 return 0;
2800         }
2801 #endif /* ANDROID */
2802
2803 #ifdef CONFIG_NATIVE_WINDOWS
2804         if (ca_cert && tls_cryptoapi_ca_cert(ssl_ctx, conn->ssl, ca_cert) ==
2805             0) {
2806                 wpa_printf(MSG_DEBUG, "OpenSSL: Added CA certificates from "
2807                            "system certificate store");
2808                 return 0;
2809         }
2810 #endif /* CONFIG_NATIVE_WINDOWS */
2811
2812         if (ca_cert || ca_path) {
2813 #ifndef OPENSSL_NO_STDIO
2814                 if (SSL_CTX_load_verify_locations(ssl_ctx, ca_cert, ca_path) !=
2815                     1) {
2816                         tls_show_errors(MSG_WARNING, __func__,
2817                                         "Failed to load root certificates");
2818                         if (ca_cert &&
2819                             tls_load_ca_der(data, ca_cert) == 0) {
2820                                 wpa_printf(MSG_DEBUG, "OpenSSL: %s - loaded "
2821                                            "DER format CA certificate",
2822                                            __func__);
2823                         } else
2824                                 return -1;
2825                 } else {
2826                         wpa_printf(MSG_DEBUG, "TLS: Trusted root "
2827                                    "certificate(s) loaded");
2828                         tls_get_errors(data);
2829                 }
2830 #else /* OPENSSL_NO_STDIO */
2831                 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO",
2832                            __func__);
2833                 return -1;
2834 #endif /* OPENSSL_NO_STDIO */
2835         } else {
2836                 /* No ca_cert configured - do not try to verify server
2837                  * certificate */
2838                 conn->ca_cert_verify = 0;
2839         }
2840
2841         return 0;
2842 }
2843
2844
2845 static int tls_global_ca_cert(struct tls_data *data, const char *ca_cert)
2846 {
2847         SSL_CTX *ssl_ctx = data->ssl;
2848
2849         if (ca_cert) {
2850                 if (SSL_CTX_load_verify_locations(ssl_ctx, ca_cert, NULL) != 1)
2851                 {
2852                         tls_show_errors(MSG_WARNING, __func__,
2853                                         "Failed to load root certificates");
2854                         return -1;
2855                 }
2856
2857                 wpa_printf(MSG_DEBUG, "TLS: Trusted root "
2858                            "certificate(s) loaded");
2859
2860 #ifndef OPENSSL_NO_STDIO
2861                 /* Add the same CAs to the client certificate requests */
2862                 SSL_CTX_set_client_CA_list(ssl_ctx,
2863                                            SSL_load_client_CA_file(ca_cert));
2864 #endif /* OPENSSL_NO_STDIO */
2865         }
2866
2867         return 0;
2868 }
2869
2870
2871 int tls_global_set_verify(void *ssl_ctx, int check_crl)
2872 {
2873         int flags;
2874
2875         if (check_crl) {
2876                 struct tls_data *data = ssl_ctx;
2877                 X509_STORE *cs = SSL_CTX_get_cert_store(data->ssl);
2878                 if (cs == NULL) {
2879                         tls_show_errors(MSG_INFO, __func__, "Failed to get "
2880                                         "certificate store when enabling "
2881                                         "check_crl");
2882                         return -1;
2883                 }
2884                 flags = X509_V_FLAG_CRL_CHECK;
2885                 if (check_crl == 2)
2886                         flags |= X509_V_FLAG_CRL_CHECK_ALL;
2887                 X509_STORE_set_flags(cs, flags);
2888         }
2889         return 0;
2890 }
2891
2892
2893 static int tls_connection_set_subject_match(struct tls_connection *conn,
2894                                             const char *subject_match,
2895                                             const char *altsubject_match,
2896                                             const char *suffix_match,
2897                                             const char *domain_match)
2898 {
2899         os_free(conn->subject_match);
2900         conn->subject_match = NULL;
2901         if (subject_match) {
2902                 conn->subject_match = os_strdup(subject_match);
2903                 if (conn->subject_match == NULL)
2904                         return -1;
2905         }
2906
2907         os_free(conn->altsubject_match);
2908         conn->altsubject_match = NULL;
2909         if (altsubject_match) {
2910                 conn->altsubject_match = os_strdup(altsubject_match);
2911                 if (conn->altsubject_match == NULL)
2912                         return -1;
2913         }
2914
2915         os_free(conn->suffix_match);
2916         conn->suffix_match = NULL;
2917         if (suffix_match) {
2918                 conn->suffix_match = os_strdup(suffix_match);
2919                 if (conn->suffix_match == NULL)
2920                         return -1;
2921         }
2922
2923         os_free(conn->domain_match);
2924         conn->domain_match = NULL;
2925         if (domain_match) {
2926                 conn->domain_match = os_strdup(domain_match);
2927                 if (conn->domain_match == NULL)
2928                         return -1;
2929         }
2930
2931         return 0;
2932 }
2933
2934
2935 static void tls_set_conn_flags(SSL *ssl, unsigned int flags)
2936 {
2937 #ifdef SSL_OP_NO_TICKET
2938         if (flags & TLS_CONN_DISABLE_SESSION_TICKET)
2939                 SSL_set_options(ssl, SSL_OP_NO_TICKET);
2940 #ifdef SSL_clear_options
2941         else
2942                 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
2943 #endif /* SSL_clear_options */
2944 #endif /* SSL_OP_NO_TICKET */
2945
2946 #ifdef SSL_OP_NO_TLSv1
2947         if (flags & TLS_CONN_DISABLE_TLSv1_0)
2948                 SSL_set_options(ssl, SSL_OP_NO_TLSv1);
2949         else
2950                 SSL_clear_options(ssl, SSL_OP_NO_TLSv1);
2951 #endif /* SSL_OP_NO_TLSv1 */
2952 #ifdef SSL_OP_NO_TLSv1_1
2953         if (flags & TLS_CONN_DISABLE_TLSv1_1)
2954                 SSL_set_options(ssl, SSL_OP_NO_TLSv1_1);
2955         else
2956                 SSL_clear_options(ssl, SSL_OP_NO_TLSv1_1);
2957 #endif /* SSL_OP_NO_TLSv1_1 */
2958 #ifdef SSL_OP_NO_TLSv1_2
2959         if (flags & TLS_CONN_DISABLE_TLSv1_2)
2960                 SSL_set_options(ssl, SSL_OP_NO_TLSv1_2);
2961         else
2962                 SSL_clear_options(ssl, SSL_OP_NO_TLSv1_2);
2963 #endif /* SSL_OP_NO_TLSv1_2 */
2964 }
2965
2966
2967 int tls_connection_set_verify(void *ssl_ctx, struct tls_connection *conn,
2968                               int verify_peer, unsigned int flags,
2969                               const u8 *session_ctx, size_t session_ctx_len)
2970 {
2971         static int counter = 0;
2972         struct tls_data *data = ssl_ctx;
2973
2974         if (conn == NULL)
2975                 return -1;
2976
2977         if (verify_peer) {
2978                 conn->ca_cert_verify = 1;
2979                 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER |
2980                                SSL_VERIFY_FAIL_IF_NO_PEER_CERT |
2981                                SSL_VERIFY_CLIENT_ONCE, tls_verify_cb);
2982         } else {
2983                 conn->ca_cert_verify = 0;
2984                 SSL_set_verify(conn->ssl, SSL_VERIFY_NONE, NULL);
2985         }
2986
2987         tls_set_conn_flags(conn->ssl, flags);
2988         conn->flags = flags;
2989
2990         SSL_set_accept_state(conn->ssl);
2991
2992         if (data->tls_session_lifetime == 0) {
2993                 /*
2994                  * Set session id context to a unique value to make sure
2995                  * session resumption cannot be used either through session
2996                  * caching or TLS ticket extension.
2997                  */
2998                 counter++;
2999                 SSL_set_session_id_context(conn->ssl,
3000                                            (const unsigned char *) &counter,
3001                                            sizeof(counter));
3002         } else if (session_ctx) {
3003                 SSL_set_session_id_context(conn->ssl, session_ctx,
3004                                            session_ctx_len);
3005         }
3006
3007         return 0;
3008 }
3009
3010
3011 static int tls_connection_client_cert(struct tls_connection *conn,
3012                                       const char *client_cert,
3013                                       const u8 *client_cert_blob,
3014                                       size_t client_cert_blob_len)
3015 {
3016         if (client_cert == NULL && client_cert_blob == NULL)
3017                 return 0;
3018
3019         if (client_cert_blob &&
3020             SSL_use_certificate_ASN1(conn->ssl, (u8 *) client_cert_blob,
3021                                      client_cert_blob_len) == 1) {
3022                 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_ASN1 --> "
3023                            "OK");
3024                 return 0;
3025         } else if (client_cert_blob) {
3026                 tls_show_errors(MSG_DEBUG, __func__,
3027                                 "SSL_use_certificate_ASN1 failed");
3028         }
3029
3030         if (client_cert == NULL)
3031                 return -1;
3032
3033 #ifdef ANDROID
3034         if (os_strncmp("keystore://", client_cert, 11) == 0) {
3035                 BIO *bio = BIO_from_keystore(&client_cert[11]);
3036                 X509 *x509 = NULL;
3037                 int ret = -1;
3038                 if (bio) {
3039                         x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
3040                         BIO_free(bio);
3041                 }
3042                 if (x509) {
3043                         if (SSL_use_certificate(conn->ssl, x509) == 1)
3044                                 ret = 0;
3045                         X509_free(x509);
3046                 }
3047                 return ret;
3048         }
3049 #endif /* ANDROID */
3050
3051 #ifndef OPENSSL_NO_STDIO
3052         if (SSL_use_certificate_file(conn->ssl, client_cert,
3053                                      SSL_FILETYPE_ASN1) == 1) {
3054                 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_file (DER)"
3055                            " --> OK");
3056                 return 0;
3057         }
3058
3059         if (SSL_use_certificate_file(conn->ssl, client_cert,
3060                                      SSL_FILETYPE_PEM) == 1) {
3061                 ERR_clear_error();
3062                 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_file (PEM)"
3063                            " --> OK");
3064                 return 0;
3065         }
3066
3067         tls_show_errors(MSG_DEBUG, __func__,
3068                         "SSL_use_certificate_file failed");
3069 #else /* OPENSSL_NO_STDIO */
3070         wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", __func__);
3071 #endif /* OPENSSL_NO_STDIO */
3072
3073         return -1;
3074 }
3075
3076
3077 static int tls_global_client_cert(struct tls_data *data,
3078                                   const char *client_cert)
3079 {
3080 #ifndef OPENSSL_NO_STDIO
3081         SSL_CTX *ssl_ctx = data->ssl;
3082
3083         if (client_cert == NULL)
3084                 return 0;
3085
3086         if (SSL_CTX_use_certificate_file(ssl_ctx, client_cert,
3087                                          SSL_FILETYPE_ASN1) != 1 &&
3088             SSL_CTX_use_certificate_chain_file(ssl_ctx, client_cert) != 1 &&
3089             SSL_CTX_use_certificate_file(ssl_ctx, client_cert,
3090                                          SSL_FILETYPE_PEM) != 1) {
3091                 tls_show_errors(MSG_INFO, __func__,
3092                                 "Failed to load client certificate");
3093                 return -1;
3094         }
3095         return 0;
3096 #else /* OPENSSL_NO_STDIO */
3097         if (client_cert == NULL)
3098                 return 0;
3099         wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", __func__);
3100         return -1;
3101 #endif /* OPENSSL_NO_STDIO */
3102 }
3103
3104
3105 static int tls_passwd_cb(char *buf, int size, int rwflag, void *password)
3106 {
3107         if (password == NULL) {
3108                 return 0;
3109         }
3110         os_strlcpy(buf, (char *) password, size);
3111         return os_strlen(buf);
3112 }
3113
3114
3115 #ifdef PKCS12_FUNCS
3116 static int tls_parse_pkcs12(struct tls_data *data, SSL *ssl, PKCS12 *p12,
3117                             const char *passwd)
3118 {
3119         EVP_PKEY *pkey;
3120         X509 *cert;
3121         STACK_OF(X509) *certs;
3122         int res = 0;
3123         char buf[256];
3124
3125         pkey = NULL;
3126         cert = NULL;
3127         certs = NULL;
3128         if (!passwd)
3129                 passwd = "";
3130         if (!PKCS12_parse(p12, passwd, &pkey, &cert, &certs)) {
3131                 tls_show_errors(MSG_DEBUG, __func__,
3132                                 "Failed to parse PKCS12 file");
3133                 PKCS12_free(p12);
3134                 return -1;
3135         }
3136         wpa_printf(MSG_DEBUG, "TLS: Successfully parsed PKCS12 data");
3137
3138         if (cert) {
3139                 X509_NAME_oneline(X509_get_subject_name(cert), buf,
3140                                   sizeof(buf));
3141                 wpa_printf(MSG_DEBUG, "TLS: Got certificate from PKCS12: "
3142                            "subject='%s'", buf);
3143                 if (ssl) {
3144                         if (SSL_use_certificate(ssl, cert) != 1)
3145                                 res = -1;
3146                 } else {
3147                         if (SSL_CTX_use_certificate(data->ssl, cert) != 1)
3148                                 res = -1;
3149                 }
3150                 X509_free(cert);
3151         }
3152
3153         if (pkey) {
3154                 wpa_printf(MSG_DEBUG, "TLS: Got private key from PKCS12");
3155                 if (ssl) {
3156                         if (SSL_use_PrivateKey(ssl, pkey) != 1)
3157                                 res = -1;
3158                 } else {
3159                         if (SSL_CTX_use_PrivateKey(data->ssl, pkey) != 1)
3160                                 res = -1;
3161                 }
3162                 EVP_PKEY_free(pkey);
3163         }
3164
3165         if (certs) {
3166 #if OPENSSL_VERSION_NUMBER >= 0x10002000L
3167                 SSL_clear_chain_certs(ssl);
3168                 while ((cert = sk_X509_pop(certs)) != NULL) {
3169                         X509_NAME_oneline(X509_get_subject_name(cert), buf,
3170                                           sizeof(buf));
3171                         wpa_printf(MSG_DEBUG, "TLS: additional certificate"
3172                                    " from PKCS12: subject='%s'", buf);
3173                         if (SSL_add1_chain_cert(ssl, cert) != 1) {
3174                                 tls_show_errors(MSG_DEBUG, __func__,
3175                                                 "Failed to add additional certificate");
3176                                 res = -1;
3177                                 break;
3178                         }
3179                 }
3180                 if (!res) {
3181                         /* Try to continue anyway */
3182                 }
3183                 sk_X509_free(certs);
3184 #ifndef OPENSSL_IS_BORINGSSL
3185                 res = SSL_build_cert_chain(ssl,
3186                                            SSL_BUILD_CHAIN_FLAG_CHECK |
3187                                            SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR);
3188                 if (!res) {
3189                         tls_show_errors(MSG_DEBUG, __func__,
3190                                         "Failed to build certificate chain");
3191                 } else if (res == 2) {
3192                         wpa_printf(MSG_DEBUG,
3193                                    "TLS: Ignore certificate chain verification error when building chain with PKCS#12 extra certificates");
3194                 }
3195 #endif /* OPENSSL_IS_BORINGSSL */
3196                 /*
3197                  * Try to continue regardless of result since it is possible for
3198                  * the extra certificates not to be required.
3199                  */
3200                 res = 0;
3201 #else /* OPENSSL_VERSION_NUMBER >= 0x10002000L */
3202 #if OPENSSL_VERSION_NUMBER >= 0x10001000L
3203                 SSL_CTX_clear_extra_chain_certs(data->ssl);
3204 #endif /* OPENSSL_VERSION_NUMBER >= 0x10001000L */
3205                 while ((cert = sk_X509_pop(certs)) != NULL) {
3206                         X509_NAME_oneline(X509_get_subject_name(cert), buf,
3207                                           sizeof(buf));
3208                         wpa_printf(MSG_DEBUG, "TLS: additional certificate"
3209                                    " from PKCS12: subject='%s'", buf);
3210                         /*
3211                          * There is no SSL equivalent for the chain cert - so
3212                          * always add it to the context...
3213                          */
3214                         if (SSL_CTX_add_extra_chain_cert(data->ssl, cert) != 1)
3215                         {
3216                                 res = -1;
3217                                 break;
3218                         }
3219                 }
3220                 sk_X509_free(certs);
3221 #endif /* OPENSSL_VERSION_NUMBER >= 0x10002000L */
3222         }
3223
3224         PKCS12_free(p12);
3225
3226         if (res < 0)
3227                 tls_get_errors(data);
3228
3229         return res;
3230 }
3231 #endif  /* PKCS12_FUNCS */
3232
3233
3234 static int tls_read_pkcs12(struct tls_data *data, SSL *ssl,
3235                            const char *private_key, const char *passwd)
3236 {
3237 #ifdef PKCS12_FUNCS
3238         FILE *f;
3239         PKCS12 *p12;
3240
3241         f = fopen(private_key, "rb");
3242         if (f == NULL)
3243                 return -1;
3244
3245         p12 = d2i_PKCS12_fp(f, NULL);
3246         fclose(f);
3247
3248         if (p12 == NULL) {
3249                 tls_show_errors(MSG_INFO, __func__,
3250                                 "Failed to use PKCS#12 file");
3251                 return -1;
3252         }
3253
3254         return tls_parse_pkcs12(data, ssl, p12, passwd);
3255
3256 #else /* PKCS12_FUNCS */
3257         wpa_printf(MSG_INFO, "TLS: PKCS12 support disabled - cannot read "
3258                    "p12/pfx files");
3259         return -1;
3260 #endif  /* PKCS12_FUNCS */
3261 }
3262
3263
3264 static int tls_read_pkcs12_blob(struct tls_data *data, SSL *ssl,
3265                                 const u8 *blob, size_t len, const char *passwd)
3266 {
3267 #ifdef PKCS12_FUNCS
3268         PKCS12 *p12;
3269
3270         p12 = d2i_PKCS12(NULL, (const unsigned char **) &blob, len);
3271         if (p12 == NULL) {
3272                 tls_show_errors(MSG_INFO, __func__,
3273                                 "Failed to use PKCS#12 blob");
3274                 return -1;
3275         }
3276
3277         return tls_parse_pkcs12(data, ssl, p12, passwd);
3278
3279 #else /* PKCS12_FUNCS */
3280         wpa_printf(MSG_INFO, "TLS: PKCS12 support disabled - cannot parse "
3281                    "p12/pfx blobs");
3282         return -1;
3283 #endif  /* PKCS12_FUNCS */
3284 }
3285
3286
3287 #ifndef OPENSSL_NO_ENGINE
3288 static int tls_engine_get_cert(struct tls_connection *conn,
3289                                const char *cert_id,
3290                                X509 **cert)
3291 {
3292         /* this runs after the private key is loaded so no PIN is required */
3293         struct {
3294                 const char *cert_id;
3295                 X509 *cert;
3296         } params;
3297         params.cert_id = cert_id;
3298         params.cert = NULL;
3299
3300         if (!ENGINE_ctrl_cmd(conn->engine, "LOAD_CERT_CTRL",
3301                              0, &params, NULL, 1)) {
3302                 unsigned long err = ERR_get_error();
3303
3304                 wpa_printf(MSG_ERROR, "ENGINE: cannot load client cert with id"
3305                            " '%s' [%s]", cert_id,
3306                            ERR_error_string(err, NULL));
3307                 if (tls_is_pin_error(err))
3308                         return TLS_SET_PARAMS_ENGINE_PRV_BAD_PIN;
3309                 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
3310         }
3311         if (!params.cert) {
3312                 wpa_printf(MSG_ERROR, "ENGINE: did not properly cert with id"
3313                            " '%s'", cert_id);
3314                 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
3315         }
3316         *cert = params.cert;
3317         return 0;
3318 }
3319 #endif /* OPENSSL_NO_ENGINE */
3320
3321
3322 static int tls_connection_engine_client_cert(struct tls_connection *conn,
3323                                              const char *cert_id)
3324 {
3325 #ifndef OPENSSL_NO_ENGINE
3326         X509 *cert;
3327
3328         if (tls_engine_get_cert(conn, cert_id, &cert))
3329                 return -1;
3330
3331         if (!SSL_use_certificate(conn->ssl, cert)) {
3332                 tls_show_errors(MSG_ERROR, __func__,
3333                                 "SSL_use_certificate failed");
3334                 X509_free(cert);
3335                 return -1;
3336         }
3337         X509_free(cert);
3338         wpa_printf(MSG_DEBUG, "ENGINE: SSL_use_certificate --> "
3339                    "OK");
3340         return 0;
3341
3342 #else /* OPENSSL_NO_ENGINE */
3343         return -1;
3344 #endif /* OPENSSL_NO_ENGINE */
3345 }
3346
3347
3348 static int tls_connection_engine_ca_cert(struct tls_data *data,
3349                                          struct tls_connection *conn,
3350                                          const char *ca_cert_id)
3351 {
3352 #ifndef OPENSSL_NO_ENGINE
3353         X509 *cert;
3354         SSL_CTX *ssl_ctx = data->ssl;
3355         X509_STORE *store;
3356
3357         if (tls_engine_get_cert(conn, ca_cert_id, &cert))
3358                 return -1;
3359
3360         /* start off the same as tls_connection_ca_cert */
3361         store = X509_STORE_new();
3362         if (store == NULL) {
3363                 wpa_printf(MSG_DEBUG, "OpenSSL: %s - failed to allocate new "
3364                            "certificate store", __func__);
3365                 X509_free(cert);
3366                 return -1;
3367         }
3368         SSL_CTX_set_cert_store(ssl_ctx, store);
3369         if (!X509_STORE_add_cert(store, cert)) {
3370                 unsigned long err = ERR_peek_error();
3371                 tls_show_errors(MSG_WARNING, __func__,
3372                                 "Failed to add CA certificate from engine "
3373                                 "to certificate store");
3374                 if (ERR_GET_LIB(err) == ERR_LIB_X509 &&
3375                     ERR_GET_REASON(err) == X509_R_CERT_ALREADY_IN_HASH_TABLE) {
3376                         wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring cert"
3377                                    " already in hash table error",
3378                                    __func__);
3379                 } else {
3380                         X509_free(cert);
3381                         return -1;
3382                 }
3383         }
3384         X509_free(cert);
3385         wpa_printf(MSG_DEBUG, "OpenSSL: %s - added CA certificate from engine "
3386                    "to certificate store", __func__);
3387         SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);
3388         conn->ca_cert_verify = 1;
3389
3390         return 0;
3391
3392 #else /* OPENSSL_NO_ENGINE */
3393         return -1;
3394 #endif /* OPENSSL_NO_ENGINE */
3395 }
3396
3397
3398 static int tls_connection_engine_private_key(struct tls_connection *conn)
3399 {
3400 #if defined(ANDROID) || !defined(OPENSSL_NO_ENGINE)
3401         if (SSL_use_PrivateKey(conn->ssl, conn->private_key) != 1) {
3402                 tls_show_errors(MSG_ERROR, __func__,
3403                                 "ENGINE: cannot use private key for TLS");
3404                 return -1;
3405         }
3406         if (!SSL_check_private_key(conn->ssl)) {
3407                 tls_show_errors(MSG_INFO, __func__,
3408                                 "Private key failed verification");
3409                 return -1;
3410         }
3411         return 0;
3412 #else /* OPENSSL_NO_ENGINE */
3413         wpa_printf(MSG_ERROR, "SSL: Configuration uses engine, but "
3414                    "engine support was not compiled in");
3415         return -1;
3416 #endif /* OPENSSL_NO_ENGINE */
3417 }
3418
3419
3420 static int tls_connection_private_key(struct tls_data *data,
3421                                       struct tls_connection *conn,
3422                                       const char *private_key,
3423                                       const char *private_key_passwd,
3424                                       const u8 *private_key_blob,
3425                                       size_t private_key_blob_len)
3426 {
3427         SSL_CTX *ssl_ctx = data->ssl;
3428         char *passwd;
3429         int ok;
3430
3431         if (private_key == NULL && private_key_blob == NULL)
3432                 return 0;
3433
3434         if (private_key_passwd) {
3435                 passwd = os_strdup(private_key_passwd);
3436                 if (passwd == NULL)
3437                         return -1;
3438         } else
3439                 passwd = NULL;
3440
3441         SSL_CTX_set_default_passwd_cb(ssl_ctx, tls_passwd_cb);
3442         SSL_CTX_set_default_passwd_cb_userdata(ssl_ctx, passwd);
3443
3444         ok = 0;
3445         while (private_key_blob) {
3446                 if (SSL_use_PrivateKey_ASN1(EVP_PKEY_RSA, conn->ssl,
3447                                             (u8 *) private_key_blob,
3448                                             private_key_blob_len) == 1) {
3449                         wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_PrivateKey_"
3450                                    "ASN1(EVP_PKEY_RSA) --> OK");
3451                         ok = 1;
3452                         break;
3453                 }
3454
3455                 if (SSL_use_PrivateKey_ASN1(EVP_PKEY_DSA, conn->ssl,
3456                                             (u8 *) private_key_blob,
3457                                             private_key_blob_len) == 1) {
3458                         wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_PrivateKey_"
3459                                    "ASN1(EVP_PKEY_DSA) --> OK");
3460                         ok = 1;
3461                         break;
3462                 }
3463
3464                 if (SSL_use_RSAPrivateKey_ASN1(conn->ssl,
3465                                                (u8 *) private_key_blob,
3466                                                private_key_blob_len) == 1) {
3467                         wpa_printf(MSG_DEBUG, "OpenSSL: "
3468                                    "SSL_use_RSAPrivateKey_ASN1 --> OK");
3469                         ok = 1;
3470                         break;
3471                 }
3472
3473                 if (tls_read_pkcs12_blob(data, conn->ssl, private_key_blob,
3474                                          private_key_blob_len, passwd) == 0) {
3475                         wpa_printf(MSG_DEBUG, "OpenSSL: PKCS#12 as blob --> "
3476                                    "OK");
3477                         ok = 1;
3478                         break;
3479                 }
3480
3481                 break;
3482         }
3483
3484         while (!ok && private_key) {
3485 #ifndef OPENSSL_NO_STDIO
3486                 if (SSL_use_PrivateKey_file(conn->ssl, private_key,
3487                                             SSL_FILETYPE_ASN1) == 1) {
3488                         wpa_printf(MSG_DEBUG, "OpenSSL: "
3489                                    "SSL_use_PrivateKey_File (DER) --> OK");
3490                         ok = 1;
3491                         break;
3492                 }
3493
3494                 if (SSL_use_PrivateKey_file(conn->ssl, private_key,
3495                                             SSL_FILETYPE_PEM) == 1) {
3496                         wpa_printf(MSG_DEBUG, "OpenSSL: "
3497                                    "SSL_use_PrivateKey_File (PEM) --> OK");
3498                         ok = 1;
3499                         break;
3500                 }
3501 #else /* OPENSSL_NO_STDIO */
3502                 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO",
3503                            __func__);
3504 #endif /* OPENSSL_NO_STDIO */
3505
3506                 if (tls_read_pkcs12(data, conn->ssl, private_key, passwd)
3507                     == 0) {
3508                         wpa_printf(MSG_DEBUG, "OpenSSL: Reading PKCS#12 file "
3509                                    "--> OK");
3510                         ok = 1;
3511                         break;
3512                 }
3513
3514                 if (tls_cryptoapi_cert(conn->ssl, private_key) == 0) {
3515                         wpa_printf(MSG_DEBUG, "OpenSSL: Using CryptoAPI to "
3516                                    "access certificate store --> OK");
3517                         ok = 1;
3518                         break;
3519                 }
3520
3521                 break;
3522         }
3523
3524         if (!ok) {
3525                 tls_show_errors(MSG_INFO, __func__,
3526                                 "Failed to load private key");
3527                 os_free(passwd);
3528                 return -1;
3529         }
3530         ERR_clear_error();
3531         SSL_CTX_set_default_passwd_cb(ssl_ctx, NULL);
3532         os_free(passwd);
3533
3534         if (!SSL_check_private_key(conn->ssl)) {
3535                 tls_show_errors(MSG_INFO, __func__, "Private key failed "
3536                                 "verification");
3537                 return -1;
3538         }
3539
3540         wpa_printf(MSG_DEBUG, "SSL: Private key loaded successfully");
3541         return 0;
3542 }
3543
3544
3545 static int tls_global_private_key(struct tls_data *data,
3546                                   const char *private_key,
3547                                   const char *private_key_passwd)
3548 {
3549         SSL_CTX *ssl_ctx = data->ssl;
3550         char *passwd;
3551
3552         if (private_key == NULL)
3553                 return 0;
3554
3555         if (private_key_passwd) {
3556                 passwd = os_strdup(private_key_passwd);
3557                 if (passwd == NULL)
3558                         return -1;
3559         } else
3560                 passwd = NULL;
3561
3562         SSL_CTX_set_default_passwd_cb(ssl_ctx, tls_passwd_cb);
3563         SSL_CTX_set_default_passwd_cb_userdata(ssl_ctx, passwd);
3564         if (
3565 #ifndef OPENSSL_NO_STDIO
3566             SSL_CTX_use_PrivateKey_file(ssl_ctx, private_key,
3567                                         SSL_FILETYPE_ASN1) != 1 &&
3568             SSL_CTX_use_PrivateKey_file(ssl_ctx, private_key,
3569                                         SSL_FILETYPE_PEM) != 1 &&
3570 #endif /* OPENSSL_NO_STDIO */
3571             tls_read_pkcs12(data, NULL, private_key, passwd)) {
3572                 tls_show_errors(MSG_INFO, __func__,
3573                                 "Failed to load private key");
3574                 os_free(passwd);
3575                 ERR_clear_error();
3576                 return -1;
3577         }
3578         os_free(passwd);
3579         ERR_clear_error();
3580         SSL_CTX_set_default_passwd_cb(ssl_ctx, NULL);
3581
3582         if (!SSL_CTX_check_private_key(ssl_ctx)) {
3583                 tls_show_errors(MSG_INFO, __func__,
3584                                 "Private key failed verification");
3585                 return -1;
3586         }
3587
3588         return 0;
3589 }
3590
3591
3592 static int tls_connection_dh(struct tls_connection *conn, const char *dh_file)
3593 {
3594 #ifdef OPENSSL_NO_DH
3595         if (dh_file == NULL)
3596                 return 0;
3597         wpa_printf(MSG_ERROR, "TLS: openssl does not include DH support, but "
3598                    "dh_file specified");
3599         return -1;
3600 #else /* OPENSSL_NO_DH */
3601         DH *dh;
3602         BIO *bio;
3603
3604         /* TODO: add support for dh_blob */
3605         if (dh_file == NULL)
3606                 return 0;
3607         if (conn == NULL)
3608                 return -1;
3609
3610         bio = BIO_new_file(dh_file, "r");
3611         if (bio == NULL) {
3612                 wpa_printf(MSG_INFO, "TLS: Failed to open DH file '%s': %s",
3613                            dh_file, ERR_error_string(ERR_get_error(), NULL));
3614                 return -1;
3615         }
3616         dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
3617         BIO_free(bio);
3618 #ifndef OPENSSL_NO_DSA
3619         while (dh == NULL) {
3620                 DSA *dsa;
3621                 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DH file '%s': %s -"
3622                            " trying to parse as DSA params", dh_file,
3623                            ERR_error_string(ERR_get_error(), NULL));
3624                 bio = BIO_new_file(dh_file, "r");
3625                 if (bio == NULL)
3626                         break;
3627                 dsa = PEM_read_bio_DSAparams(bio, NULL, NULL, NULL);
3628                 BIO_free(bio);
3629                 if (!dsa) {
3630                         wpa_printf(MSG_DEBUG, "TLS: Failed to parse DSA file "
3631                                    "'%s': %s", dh_file,
3632                                    ERR_error_string(ERR_get_error(), NULL));
3633                         break;
3634                 }
3635
3636                 wpa_printf(MSG_DEBUG, "TLS: DH file in DSA param format");
3637                 dh = DSA_dup_DH(dsa);
3638                 DSA_free(dsa);
3639                 if (dh == NULL) {
3640                         wpa_printf(MSG_INFO, "TLS: Failed to convert DSA "
3641                                    "params into DH params");
3642                         break;
3643                 }
3644                 break;
3645         }
3646 #endif /* !OPENSSL_NO_DSA */
3647         if (dh == NULL) {
3648                 wpa_printf(MSG_INFO, "TLS: Failed to read/parse DH/DSA file "
3649                            "'%s'", dh_file);
3650                 return -1;
3651         }
3652
3653         if (SSL_set_tmp_dh(conn->ssl, dh) != 1) {
3654                 wpa_printf(MSG_INFO, "TLS: Failed to set DH params from '%s': "
3655                            "%s", dh_file,
3656                            ERR_error_string(ERR_get_error(), NULL));
3657                 DH_free(dh);
3658                 return -1;
3659         }
3660         DH_free(dh);
3661         return 0;
3662 #endif /* OPENSSL_NO_DH */
3663 }
3664
3665
3666 static int tls_global_dh(struct tls_data *data, const char *dh_file)
3667 {
3668 #ifdef OPENSSL_NO_DH
3669         if (dh_file == NULL)
3670                 return 0;
3671         wpa_printf(MSG_ERROR, "TLS: openssl does not include DH support, but "
3672                    "dh_file specified");
3673         return -1;
3674 #else /* OPENSSL_NO_DH */
3675         SSL_CTX *ssl_ctx = data->ssl;
3676         DH *dh;
3677         BIO *bio;
3678
3679         /* TODO: add support for dh_blob */
3680         if (dh_file == NULL)
3681                 return 0;
3682         if (ssl_ctx == NULL)
3683                 return -1;
3684
3685         bio = BIO_new_file(dh_file, "r");
3686         if (bio == NULL) {
3687                 wpa_printf(MSG_INFO, "TLS: Failed to open DH file '%s': %s",
3688                            dh_file, ERR_error_string(ERR_get_error(), NULL));
3689                 return -1;
3690         }
3691         dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
3692         BIO_free(bio);
3693 #ifndef OPENSSL_NO_DSA
3694         while (dh == NULL) {
3695                 DSA *dsa;
3696                 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DH file '%s': %s -"
3697                            " trying to parse as DSA params", dh_file,
3698                            ERR_error_string(ERR_get_error(), NULL));
3699                 bio = BIO_new_file(dh_file, "r");
3700                 if (bio == NULL)
3701                         break;
3702                 dsa = PEM_read_bio_DSAparams(bio, NULL, NULL, NULL);
3703                 BIO_free(bio);
3704                 if (!dsa) {
3705                         wpa_printf(MSG_DEBUG, "TLS: Failed to parse DSA file "
3706                                    "'%s': %s", dh_file,
3707                                    ERR_error_string(ERR_get_error(), NULL));
3708                         break;
3709                 }
3710
3711                 wpa_printf(MSG_DEBUG, "TLS: DH file in DSA param format");
3712                 dh = DSA_dup_DH(dsa);
3713                 DSA_free(dsa);
3714                 if (dh == NULL) {
3715                         wpa_printf(MSG_INFO, "TLS: Failed to convert DSA "
3716                                    "params into DH params");
3717                         break;
3718                 }
3719                 break;
3720         }
3721 #endif /* !OPENSSL_NO_DSA */
3722         if (dh == NULL) {
3723                 wpa_printf(MSG_INFO, "TLS: Failed to read/parse DH/DSA file "
3724                            "'%s'", dh_file);
3725                 return -1;
3726         }
3727
3728         if (SSL_CTX_set_tmp_dh(ssl_ctx, dh) != 1) {
3729                 wpa_printf(MSG_INFO, "TLS: Failed to set DH params from '%s': "
3730                            "%s", dh_file,
3731                            ERR_error_string(ERR_get_error(), NULL));
3732                 DH_free(dh);
3733                 return -1;
3734         }
3735         DH_free(dh);
3736         return 0;
3737 #endif /* OPENSSL_NO_DH */
3738 }
3739
3740
3741 int tls_connection_get_random(void *ssl_ctx, struct tls_connection *conn,
3742                               struct tls_random *keys)
3743 {
3744         SSL *ssl;
3745
3746         if (conn == NULL || keys == NULL)
3747                 return -1;
3748         ssl = conn->ssl;
3749 #if OPENSSL_VERSION_NUMBER < 0x10100000L
3750         if (ssl == NULL || ssl->s3 == NULL || ssl->session == NULL)
3751                 return -1;
3752
3753         os_memset(keys, 0, sizeof(*keys));
3754         keys->client_random = ssl->s3->client_random;
3755         keys->client_random_len = SSL3_RANDOM_SIZE;
3756         keys->server_random = ssl->s3->server_random;
3757         keys->server_random_len = SSL3_RANDOM_SIZE;
3758 #else
3759         if (ssl == NULL)
3760                 return -1;
3761
3762         os_memset(keys, 0, sizeof(*keys));
3763         keys->client_random = conn->client_random;
3764         keys->client_random_len = SSL_get_client_random(
3765                 ssl, conn->client_random, sizeof(conn->client_random));
3766         keys->server_random = conn->server_random;
3767         keys->server_random_len = SSL_get_server_random(
3768                 ssl, conn->server_random, sizeof(conn->server_random));
3769 #endif
3770
3771         return 0;
3772 }
3773
3774
3775 #ifndef CONFIG_FIPS
3776 static int openssl_get_keyblock_size(SSL *ssl)
3777 {
3778 #if OPENSSL_VERSION_NUMBER < 0x10100000L
3779         const EVP_CIPHER *c;
3780         const EVP_MD *h;
3781         int md_size;
3782
3783         if (ssl->enc_read_ctx == NULL || ssl->enc_read_ctx->cipher == NULL ||
3784             ssl->read_hash == NULL)
3785                 return -1;
3786
3787         c = ssl->enc_read_ctx->cipher;
3788 #if OPENSSL_VERSION_NUMBER >= 0x00909000L
3789         h = EVP_MD_CTX_md(ssl->read_hash);
3790 #else
3791         h = ssl->read_hash;
3792 #endif
3793         if (h)
3794                 md_size = EVP_MD_size(h);
3795 #if OPENSSL_VERSION_NUMBER >= 0x10000000L
3796         else if (ssl->s3)
3797                 md_size = ssl->s3->tmp.new_mac_secret_size;
3798 #endif
3799         else
3800                 return -1;
3801
3802         wpa_printf(MSG_DEBUG, "OpenSSL: keyblock size: key_len=%d MD_size=%d "
3803                    "IV_len=%d", EVP_CIPHER_key_length(c), md_size,
3804                    EVP_CIPHER_iv_length(c));
3805         return 2 * (EVP_CIPHER_key_length(c) +
3806                     md_size +
3807                     EVP_CIPHER_iv_length(c));
3808 #else
3809         const SSL_CIPHER *ssl_cipher;
3810         int cipher, digest;
3811         const EVP_CIPHER *c;
3812         const EVP_MD *h;
3813
3814         ssl_cipher = SSL_get_current_cipher(ssl);
3815         if (!ssl_cipher)
3816                 return -1;
3817         cipher = SSL_CIPHER_get_cipher_nid(ssl_cipher);
3818         digest = SSL_CIPHER_get_digest_nid(ssl_cipher);
3819         wpa_printf(MSG_DEBUG, "OpenSSL: cipher nid %d digest nid %d",
3820                    cipher, digest);
3821         if (cipher < 0 || digest < 0)
3822                 return -1;
3823         c = EVP_get_cipherbynid(cipher);
3824         h = EVP_get_digestbynid(digest);
3825         if (!c || !h)
3826                 return -1;
3827
3828         wpa_printf(MSG_DEBUG,
3829                    "OpenSSL: keyblock size: key_len=%d MD_size=%d IV_len=%d",
3830                    EVP_CIPHER_key_length(c), EVP_MD_size(h),
3831                    EVP_CIPHER_iv_length(c));
3832         return 2 * (EVP_CIPHER_key_length(c) + EVP_MD_size(h) +
3833                     EVP_CIPHER_iv_length(c));
3834 #endif
3835 }
3836 #endif /* CONFIG_FIPS */
3837
3838
3839 static int openssl_tls_prf(struct tls_connection *conn,
3840                            const char *label, int server_random_first,
3841                            int skip_keyblock, u8 *out, size_t out_len)
3842 {
3843 #ifdef CONFIG_FIPS
3844         wpa_printf(MSG_ERROR, "OpenSSL: TLS keys cannot be exported in FIPS "
3845                    "mode");
3846         return -1;
3847 #else /* CONFIG_FIPS */
3848 #if OPENSSL_VERSION_NUMBER < 0x10100000L
3849         SSL *ssl;
3850         u8 *rnd;
3851         int ret = -1;
3852         int skip = 0;
3853         u8 *tmp_out = NULL;
3854         u8 *_out = out;
3855         const char *ver;
3856
3857         /*
3858          * TLS library did not support key generation, so get the needed TLS
3859          * session parameters and use an internal implementation of TLS PRF to
3860          * derive the key.
3861          */
3862
3863         if (conn == NULL)
3864                 return -1;
3865         ssl = conn->ssl;
3866         if (ssl == NULL || ssl->s3 == NULL || ssl->session == NULL ||
3867             ssl->session->master_key_length <= 0)
3868                 return -1;
3869         ver = SSL_get_version(ssl);
3870
3871         if (skip_keyblock) {
3872                 skip = openssl_get_keyblock_size(ssl);
3873                 if (skip < 0)
3874                         return -1;
3875                 tmp_out = os_malloc(skip + out_len);
3876                 if (!tmp_out)
3877                         return -1;
3878                 _out = tmp_out;
3879         }
3880
3881         rnd = os_malloc(2 * SSL3_RANDOM_SIZE);
3882         if (!rnd) {
3883                 os_free(tmp_out);
3884                 return -1;
3885         }
3886
3887         if (server_random_first) {
3888                 os_memcpy(rnd, ssl->s3->server_random, SSL3_RANDOM_SIZE);
3889                 os_memcpy(rnd + SSL3_RANDOM_SIZE, ssl->s3->client_random,
3890                         SSL3_RANDOM_SIZE);
3891         } else {
3892                 os_memcpy(rnd, ssl->s3->client_random, SSL3_RANDOM_SIZE);
3893                 os_memcpy(rnd + SSL3_RANDOM_SIZE, ssl->s3->server_random,
3894                         SSL3_RANDOM_SIZE);
3895         }
3896
3897         if (os_strcmp(ver, "TLSv1.2") == 0) {
3898                 tls_prf_sha256(ssl->session->master_key,
3899                                ssl->session->master_key_length,
3900                                label, rnd, 2 * SSL3_RANDOM_SIZE,
3901                                _out, skip + out_len);
3902                 ret = 0;
3903         } else if (tls_prf_sha1_md5(ssl->session->master_key,
3904                                     ssl->session->master_key_length,
3905                                     label, rnd, 2 * SSL3_RANDOM_SIZE,
3906                                     _out, skip + out_len) == 0) {
3907                 ret = 0;
3908         }
3909         os_free(rnd);
3910         if (ret == 0 && skip_keyblock)
3911                 os_memcpy(out, _out + skip, out_len);
3912         bin_clear_free(tmp_out, skip);
3913
3914         return ret;
3915 #else
3916         SSL *ssl;
3917         SSL_SESSION *sess;
3918         u8 *rnd;
3919         int ret = -1;
3920         int skip = 0;
3921         u8 *tmp_out = NULL;
3922         u8 *_out = out;
3923         unsigned char client_random[SSL3_RANDOM_SIZE];
3924         unsigned char server_random[SSL3_RANDOM_SIZE];
3925         unsigned char master_key[64];
3926         size_t master_key_len;
3927         const char *ver;
3928
3929         /*
3930          * TLS library did not support key generation, so get the needed TLS
3931          * session parameters and use an internal implementation of TLS PRF to
3932          * derive the key.
3933          */
3934
3935         if (conn == NULL)
3936                 return -1;
3937         ssl = conn->ssl;
3938         if (ssl == NULL)
3939                 return -1;
3940         ver = SSL_get_version(ssl);
3941         sess = SSL_get_session(ssl);
3942         if (!ver || !sess)
3943                 return -1;
3944
3945         if (skip_keyblock) {
3946                 skip = openssl_get_keyblock_size(ssl);
3947                 if (skip < 0)
3948                         return -1;
3949                 tmp_out = os_malloc(skip + out_len);
3950                 if (!tmp_out)
3951                         return -1;
3952                 _out = tmp_out;
3953         }
3954
3955         rnd = os_malloc(2 * SSL3_RANDOM_SIZE);
3956         if (!rnd) {
3957                 os_free(tmp_out);
3958                 return -1;
3959         }
3960
3961         SSL_get_client_random(ssl, client_random, sizeof(client_random));
3962         SSL_get_server_random(ssl, server_random, sizeof(server_random));
3963         master_key_len = SSL_SESSION_get_master_key(sess, master_key,
3964                                                     sizeof(master_key));
3965
3966         if (server_random_first) {
3967                 os_memcpy(rnd, server_random, SSL3_RANDOM_SIZE);
3968                 os_memcpy(rnd + SSL3_RANDOM_SIZE, client_random,
3969                           SSL3_RANDOM_SIZE);
3970         } else {
3971                 os_memcpy(rnd, client_random, SSL3_RANDOM_SIZE);
3972                 os_memcpy(rnd + SSL3_RANDOM_SIZE, server_random,
3973                           SSL3_RANDOM_SIZE);
3974         }
3975
3976         if (os_strcmp(ver, "TLSv1.2") == 0) {
3977                 tls_prf_sha256(master_key, master_key_len,
3978                                label, rnd, 2 * SSL3_RANDOM_SIZE,
3979                                _out, skip + out_len);
3980                 ret = 0;
3981         } else if (tls_prf_sha1_md5(master_key, master_key_len,
3982                                     label, rnd, 2 * SSL3_RANDOM_SIZE,
3983                                     _out, skip + out_len) == 0) {
3984                 ret = 0;
3985         }
3986         os_memset(master_key, 0, sizeof(master_key));
3987         os_free(rnd);
3988         if (ret == 0 && skip_keyblock)
3989                 os_memcpy(out, _out + skip, out_len);
3990         bin_clear_free(tmp_out, skip);
3991
3992         return ret;
3993 #endif
3994 #endif /* CONFIG_FIPS */
3995 }
3996
3997
3998 int tls_connection_prf(void *tls_ctx, struct tls_connection *conn,
3999                        const char *label, int server_random_first,
4000                        int skip_keyblock, u8 *out, size_t out_len)
4001 {
4002 #if OPENSSL_VERSION_NUMBER >= 0x10001000L
4003         SSL *ssl;
4004         if (conn == NULL)
4005                 return -1;
4006         if (server_random_first || skip_keyblock)
4007                 return openssl_tls_prf(conn, label,
4008                                        server_random_first, skip_keyblock,
4009                                        out, out_len);
4010         ssl = conn->ssl;
4011         if (SSL_export_keying_material(ssl, out, out_len, label,
4012                                        os_strlen(label), NULL, 0, 0) == 1) {
4013                 wpa_printf(MSG_DEBUG, "OpenSSL: Using internal PRF");
4014                 return 0;
4015         }
4016 #endif
4017         return openssl_tls_prf(conn, label, server_random_first,
4018                                skip_keyblock, out, out_len);
4019 }
4020
4021
4022 static struct wpabuf *
4023 openssl_handshake(struct tls_connection *conn, const struct wpabuf *in_data,
4024                   int server)
4025 {
4026         int res;
4027         struct wpabuf *out_data;
4028
4029         /*
4030          * Give TLS handshake data from the server (if available) to OpenSSL
4031          * for processing.
4032          */
4033         if (in_data && wpabuf_len(in_data) > 0 &&
4034             BIO_write(conn->ssl_in, wpabuf_head(in_data), wpabuf_len(in_data))
4035             < 0) {
4036                 tls_show_errors(MSG_INFO, __func__,
4037                                 "Handshake failed - BIO_write");
4038                 return NULL;
4039         }
4040
4041         /* Initiate TLS handshake or continue the existing handshake */
4042         if (server)
4043                 res = SSL_accept(conn->ssl);
4044         else
4045                 res = SSL_connect(conn->ssl);
4046         if (res != 1) {
4047                 int err = SSL_get_error(conn->ssl, res);
4048                 if (err == SSL_ERROR_WANT_READ)
4049                         wpa_printf(MSG_DEBUG, "SSL: SSL_connect - want "
4050                                    "more data");
4051                 else if (err == SSL_ERROR_WANT_WRITE)
4052                         wpa_printf(MSG_DEBUG, "SSL: SSL_connect - want to "
4053                                    "write");
4054                 else {
4055                         tls_show_errors(MSG_INFO, __func__, "SSL_connect");
4056                         conn->failed++;
4057                 }
4058         }
4059
4060         /* Get the TLS handshake data to be sent to the server */
4061         res = BIO_ctrl_pending(conn->ssl_out);
4062         wpa_printf(MSG_DEBUG, "SSL: %d bytes pending from ssl_out", res);
4063         out_data = wpabuf_alloc(res);
4064         if (out_data == NULL) {
4065                 wpa_printf(MSG_DEBUG, "SSL: Failed to allocate memory for "
4066                            "handshake output (%d bytes)", res);
4067                 if (BIO_reset(conn->ssl_out) < 0) {
4068                         tls_show_errors(MSG_INFO, __func__,
4069                                         "BIO_reset failed");
4070                 }
4071                 return NULL;
4072         }
4073         res = res == 0 ? 0 : BIO_read(conn->ssl_out, wpabuf_mhead(out_data),
4074                                       res);
4075         if (res < 0) {
4076                 tls_show_errors(MSG_INFO, __func__,
4077                                 "Handshake failed - BIO_read");
4078                 if (BIO_reset(conn->ssl_out) < 0) {
4079                         tls_show_errors(MSG_INFO, __func__,
4080                                         "BIO_reset failed");
4081                 }
4082                 wpabuf_free(out_data);
4083                 return NULL;
4084         }
4085         wpabuf_put(out_data, res);
4086
4087         return out_data;
4088 }
4089
4090
4091 static struct wpabuf *
4092 openssl_get_appl_data(struct tls_connection *conn, size_t max_len)
4093 {
4094         struct wpabuf *appl_data;
4095         int res;
4096
4097         appl_data = wpabuf_alloc(max_len + 100);
4098         if (appl_data == NULL)
4099                 return NULL;
4100
4101         res = SSL_read(conn->ssl, wpabuf_mhead(appl_data),
4102                        wpabuf_size(appl_data));
4103         if (res < 0) {
4104                 int err = SSL_get_error(conn->ssl, res);
4105                 if (err == SSL_ERROR_WANT_READ ||
4106                     err == SSL_ERROR_WANT_WRITE) {
4107                         wpa_printf(MSG_DEBUG, "SSL: No Application Data "
4108                                    "included");
4109                 } else {
4110                         tls_show_errors(MSG_INFO, __func__,
4111                                         "Failed to read possible "
4112                                         "Application Data");
4113                 }
4114                 wpabuf_free(appl_data);
4115                 return NULL;
4116         }
4117
4118         wpabuf_put(appl_data, res);
4119         wpa_hexdump_buf_key(MSG_MSGDUMP, "SSL: Application Data in Finished "
4120                             "message", appl_data);
4121
4122         return appl_data;
4123 }
4124
4125
4126 static struct wpabuf *
4127 openssl_connection_handshake(struct tls_connection *conn,
4128                              const struct wpabuf *in_data,
4129                              struct wpabuf **appl_data, int server)
4130 {
4131         struct wpabuf *out_data;
4132
4133         if (appl_data)
4134                 *appl_data = NULL;
4135
4136         out_data = openssl_handshake(conn, in_data, server);
4137         if (out_data == NULL)
4138                 return NULL;
4139         if (conn->invalid_hb_used) {
4140                 wpa_printf(MSG_INFO, "TLS: Heartbeat attack detected - do not send response");
4141                 wpabuf_free(out_data);
4142                 return NULL;
4143         }
4144
4145         if (SSL_is_init_finished(conn->ssl)) {
4146                 wpa_printf(MSG_DEBUG,
4147                            "OpenSSL: Handshake finished - resumed=%d",
4148                            tls_connection_resumed(conn->ssl_ctx, conn));
4149                 if (appl_data && in_data)
4150                         *appl_data = openssl_get_appl_data(conn,
4151                                                            wpabuf_len(in_data));
4152         }
4153
4154         if (conn->invalid_hb_used) {
4155                 wpa_printf(MSG_INFO, "TLS: Heartbeat attack detected - do not send response");
4156                 if (appl_data) {
4157                         wpabuf_free(*appl_data);
4158                         *appl_data = NULL;
4159                 }
4160                 wpabuf_free(out_data);
4161                 return NULL;
4162         }
4163
4164         return out_data;
4165 }
4166
4167
4168 struct wpabuf *
4169 tls_connection_handshake(void *ssl_ctx, struct tls_connection *conn,
4170                          const struct wpabuf *in_data,
4171                          struct wpabuf **appl_data)
4172 {
4173         return openssl_connection_handshake(conn, in_data, appl_data, 0);
4174 }
4175
4176
4177 struct wpabuf * tls_connection_server_handshake(void *tls_ctx,
4178                                                 struct tls_connection *conn,
4179                                                 const struct wpabuf *in_data,
4180                                                 struct wpabuf **appl_data)
4181 {
4182         return openssl_connection_handshake(conn, in_data, appl_data, 1);
4183 }
4184
4185
4186 struct wpabuf * tls_connection_encrypt(void *tls_ctx,
4187                                        struct tls_connection *conn,
4188                                        const struct wpabuf *in_data)
4189 {
4190         int res;
4191         struct wpabuf *buf;
4192
4193         if (conn == NULL)
4194                 return NULL;
4195
4196         /* Give plaintext data for OpenSSL to encrypt into the TLS tunnel. */
4197         if ((res = BIO_reset(conn->ssl_in)) < 0 ||
4198             (res = BIO_reset(conn->ssl_out)) < 0) {
4199                 tls_show_errors(MSG_INFO, __func__, "BIO_reset failed");
4200                 return NULL;
4201         }
4202         res = SSL_write(conn->ssl, wpabuf_head(in_data), wpabuf_len(in_data));
4203         if (res < 0) {
4204                 tls_show_errors(MSG_INFO, __func__,
4205                                 "Encryption failed - SSL_write");
4206                 return NULL;
4207         }
4208
4209         /* Read encrypted data to be sent to the server */
4210         buf = wpabuf_alloc(wpabuf_len(in_data) + 300);
4211         if (buf == NULL)
4212                 return NULL;
4213         res = BIO_read(conn->ssl_out, wpabuf_mhead(buf), wpabuf_size(buf));
4214         if (res < 0) {
4215                 tls_show_errors(MSG_INFO, __func__,
4216                                 "Encryption failed - BIO_read");
4217                 wpabuf_free(buf);
4218                 return NULL;
4219         }
4220         wpabuf_put(buf, res);
4221
4222         return buf;
4223 }
4224
4225
4226 struct wpabuf * tls_connection_decrypt(void *tls_ctx,
4227                                        struct tls_connection *conn,
4228                                        const struct wpabuf *in_data)
4229 {
4230         int res;
4231         struct wpabuf *buf;
4232
4233         /* Give encrypted data from TLS tunnel for OpenSSL to decrypt. */
4234         res = BIO_write(conn->ssl_in, wpabuf_head(in_data),
4235                         wpabuf_len(in_data));
4236         if (res < 0) {
4237                 tls_show_errors(MSG_INFO, __func__,
4238                                 "Decryption failed - BIO_write");
4239                 return NULL;
4240         }
4241         if (BIO_reset(conn->ssl_out) < 0) {
4242                 tls_show_errors(MSG_INFO, __func__, "BIO_reset failed");
4243                 return NULL;
4244         }
4245
4246         /* Read decrypted data for further processing */
4247         /*
4248          * Even though we try to disable TLS compression, it is possible that
4249          * this cannot be done with all TLS libraries. Add extra buffer space
4250          * to handle the possibility of the decrypted data being longer than
4251          * input data.
4252          */
4253         buf = wpabuf_alloc((wpabuf_len(in_data) + 500) * 3);
4254         if (buf == NULL)
4255                 return NULL;
4256         res = SSL_read(conn->ssl, wpabuf_mhead(buf), wpabuf_size(buf));
4257         if (res < 0) {
4258                 tls_show_errors(MSG_INFO, __func__,
4259                                 "Decryption failed - SSL_read");
4260                 wpabuf_free(buf);
4261                 return NULL;
4262         }
4263         wpabuf_put(buf, res);
4264
4265         if (conn->invalid_hb_used) {
4266                 wpa_printf(MSG_INFO, "TLS: Heartbeat attack detected - do not send response");
4267                 wpabuf_free(buf);
4268                 return NULL;
4269         }
4270
4271         return buf;
4272 }
4273
4274
4275 int tls_connection_resumed(void *ssl_ctx, struct tls_connection *conn)
4276 {
4277 #if OPENSSL_VERSION_NUMBER >= 0x10001000L
4278         return conn ? SSL_cache_hit(conn->ssl) : 0;
4279 #else
4280         return conn ? conn->ssl->hit : 0;
4281 #endif
4282 }
4283
4284
4285 int tls_connection_set_cipher_list(void *tls_ctx, struct tls_connection *conn,
4286                                    u8 *ciphers)
4287 {
4288         char buf[100], *pos, *end;
4289         u8 *c;
4290         int ret;
4291
4292         if (conn == NULL || conn->ssl == NULL || ciphers == NULL)
4293                 return -1;
4294
4295         buf[0] = '\0';
4296         pos = buf;
4297         end = pos + sizeof(buf);
4298
4299         c = ciphers;
4300         while (*c != TLS_CIPHER_NONE) {
4301                 const char *suite;
4302
4303                 switch (*c) {
4304                 case TLS_CIPHER_RC4_SHA:
4305                         suite = "RC4-SHA";
4306                         break;
4307                 case TLS_CIPHER_AES128_SHA:
4308                         suite = "AES128-SHA";
4309                         break;
4310                 case TLS_CIPHER_RSA_DHE_AES128_SHA:
4311                         suite = "DHE-RSA-AES128-SHA";
4312                         break;
4313                 case TLS_CIPHER_ANON_DH_AES128_SHA:
4314                         suite = "ADH-AES128-SHA";
4315                         break;
4316                 default:
4317                         wpa_printf(MSG_DEBUG, "TLS: Unsupported "
4318                                    "cipher selection: %d", *c);
4319                         return -1;
4320                 }
4321                 ret = os_snprintf(pos, end - pos, ":%s", suite);
4322                 if (os_snprintf_error(end - pos, ret))
4323                         break;
4324                 pos += ret;
4325
4326                 c++;
4327         }
4328
4329         wpa_printf(MSG_DEBUG, "OpenSSL: cipher suites: %s", buf + 1);
4330
4331 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
4332 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
4333         if (os_strstr(buf, ":ADH-")) {
4334                 /*
4335                  * Need to drop to security level 0 to allow anonymous
4336                  * cipher suites for EAP-FAST.
4337                  */
4338                 SSL_set_security_level(conn->ssl, 0);
4339         } else if (SSL_get_security_level(conn->ssl) == 0) {
4340                 /* Force at least security level 1 */
4341                 SSL_set_security_level(conn->ssl, 1);
4342         }
4343 #endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */
4344 #endif
4345
4346         if (SSL_set_cipher_list(conn->ssl, buf + 1) != 1) {
4347                 tls_show_errors(MSG_INFO, __func__,
4348                                 "Cipher suite configuration failed");
4349                 return -1;
4350         }
4351
4352         return 0;
4353 }
4354
4355
4356 int tls_get_version(void *ssl_ctx, struct tls_connection *conn,
4357                     char *buf, size_t buflen)
4358 {
4359         const char *name;
4360         if (conn == NULL || conn->ssl == NULL)
4361                 return -1;
4362
4363         name = SSL_get_version(conn->ssl);
4364         if (name == NULL)
4365                 return -1;
4366
4367         os_strlcpy(buf, name, buflen);
4368         return 0;
4369 }
4370
4371
4372 int tls_get_cipher(void *ssl_ctx, struct tls_connection *conn,
4373                    char *buf, size_t buflen)
4374 {
4375         const char *name;
4376         if (conn == NULL || conn->ssl == NULL)
4377                 return -1;
4378
4379         name = SSL_get_cipher(conn->ssl);
4380         if (name == NULL)
4381                 return -1;
4382
4383         os_strlcpy(buf, name, buflen);
4384         return 0;
4385 }
4386
4387
4388 int tls_connection_enable_workaround(void *ssl_ctx,
4389                                      struct tls_connection *conn)
4390 {
4391         SSL_set_options(conn->ssl, SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS);
4392
4393         return 0;
4394 }
4395
4396
4397 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
4398 /* ClientHello TLS extensions require a patch to openssl, so this function is
4399  * commented out unless explicitly needed for EAP-FAST in order to be able to
4400  * build this file with unmodified openssl. */
4401 int tls_connection_client_hello_ext(void *ssl_ctx, struct tls_connection *conn,
4402                                     int ext_type, const u8 *data,
4403                                     size_t data_len)
4404 {
4405         if (conn == NULL || conn->ssl == NULL || ext_type != 35)
4406                 return -1;
4407
4408         if (SSL_set_session_ticket_ext(conn->ssl, (void *) data,
4409                                        data_len) != 1)
4410                 return -1;
4411
4412         return 0;
4413 }
4414 #endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */
4415
4416
4417 int tls_connection_get_failed(void *ssl_ctx, struct tls_connection *conn)
4418 {
4419         if (conn == NULL)
4420                 return -1;
4421         return conn->failed;
4422 }
4423
4424
4425 int tls_connection_get_read_alerts(void *ssl_ctx, struct tls_connection *conn)
4426 {
4427         if (conn == NULL)
4428                 return -1;
4429         return conn->read_alerts;
4430 }
4431
4432
4433 int tls_connection_get_write_alerts(void *ssl_ctx, struct tls_connection *conn)
4434 {
4435         if (conn == NULL)
4436                 return -1;
4437         return conn->write_alerts;
4438 }
4439
4440
4441 #ifdef HAVE_OCSP
4442
4443 static void ocsp_debug_print_resp(OCSP_RESPONSE *rsp)
4444 {
4445 #ifndef CONFIG_NO_STDOUT_DEBUG
4446         BIO *out;
4447         size_t rlen;
4448         char *txt;
4449         int res;
4450
4451         if (wpa_debug_level > MSG_DEBUG)
4452                 return;
4453
4454         out = BIO_new(BIO_s_mem());
4455         if (!out)
4456                 return;
4457
4458         OCSP_RESPONSE_print(out, rsp, 0);
4459         rlen = BIO_ctrl_pending(out);
4460         txt = os_malloc(rlen + 1);
4461         if (!txt) {
4462                 BIO_free(out);
4463                 return;
4464         }
4465
4466         res = BIO_read(out, txt, rlen);
4467         if (res > 0) {
4468                 txt[res] = '\0';
4469                 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP Response\n%s", txt);
4470         }
4471         os_free(txt);
4472         BIO_free(out);
4473 #endif /* CONFIG_NO_STDOUT_DEBUG */
4474 }
4475
4476
4477 static void debug_print_cert(X509 *cert, const char *title)
4478 {
4479 #ifndef CONFIG_NO_STDOUT_DEBUG
4480         BIO *out;
4481         size_t rlen;
4482         char *txt;
4483         int res;
4484
4485         if (wpa_debug_level > MSG_DEBUG)
4486                 return;
4487
4488         out = BIO_new(BIO_s_mem());
4489         if (!out)
4490                 return;
4491
4492         X509_print(out, cert);
4493         rlen = BIO_ctrl_pending(out);
4494         txt = os_malloc(rlen + 1);
4495         if (!txt) {
4496                 BIO_free(out);
4497                 return;
4498         }
4499
4500         res = BIO_read(out, txt, rlen);
4501         if (res > 0) {
4502                 txt[res] = '\0';
4503                 wpa_printf(MSG_DEBUG, "OpenSSL: %s\n%s", title, txt);
4504         }
4505         os_free(txt);
4506
4507         BIO_free(out);
4508 #endif /* CONFIG_NO_STDOUT_DEBUG */
4509 }
4510
4511
4512 static int ocsp_resp_cb(SSL *s, void *arg)
4513 {
4514         struct tls_connection *conn = arg;
4515         const unsigned char *p;
4516         int len, status, reason;
4517         OCSP_RESPONSE *rsp;
4518         OCSP_BASICRESP *basic;
4519         OCSP_CERTID *id;
4520         ASN1_GENERALIZEDTIME *produced_at, *this_update, *next_update;
4521         X509_STORE *store;
4522         STACK_OF(X509) *certs = NULL;
4523
4524         len = SSL_get_tlsext_status_ocsp_resp(s, &p);
4525         if (!p) {
4526                 wpa_printf(MSG_DEBUG, "OpenSSL: No OCSP response received");
4527                 return (conn->flags & TLS_CONN_REQUIRE_OCSP) ? 0 : 1;
4528         }
4529
4530         wpa_hexdump(MSG_DEBUG, "OpenSSL: OCSP response", p, len);
4531
4532         rsp = d2i_OCSP_RESPONSE(NULL, &p, len);
4533         if (!rsp) {
4534                 wpa_printf(MSG_INFO, "OpenSSL: Failed to parse OCSP response");
4535                 return 0;
4536         }
4537
4538         ocsp_debug_print_resp(rsp);
4539
4540         status = OCSP_response_status(rsp);
4541         if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL) {
4542                 wpa_printf(MSG_INFO, "OpenSSL: OCSP responder error %d (%s)",
4543                            status, OCSP_response_status_str(status));
4544                 return 0;
4545         }
4546
4547         basic = OCSP_response_get1_basic(rsp);
4548         if (!basic) {
4549                 wpa_printf(MSG_INFO, "OpenSSL: Could not find BasicOCSPResponse");
4550                 return 0;
4551         }
4552
4553         store = SSL_CTX_get_cert_store(conn->ssl_ctx);
4554         if (conn->peer_issuer) {
4555                 debug_print_cert(conn->peer_issuer, "Add OCSP issuer");
4556
4557                 if (X509_STORE_add_cert(store, conn->peer_issuer) != 1) {
4558                         tls_show_errors(MSG_INFO, __func__,
4559                                         "OpenSSL: Could not add issuer to certificate store");
4560                 }
4561                 certs = sk_X509_new_null();
4562                 if (certs) {
4563                         X509 *cert;
4564                         cert = X509_dup(conn->peer_issuer);
4565                         if (cert && !sk_X509_push(certs, cert)) {
4566                                 tls_show_errors(
4567                                         MSG_INFO, __func__,
4568                                         "OpenSSL: Could not add issuer to OCSP responder trust store");
4569                                 X509_free(cert);
4570                                 sk_X509_free(certs);
4571                                 certs = NULL;
4572                         }
4573                         if (certs && conn->peer_issuer_issuer) {
4574                                 cert = X509_dup(conn->peer_issuer_issuer);
4575                                 if (cert && !sk_X509_push(certs, cert)) {
4576                                         tls_show_errors(
4577                                                 MSG_INFO, __func__,
4578                                                 "OpenSSL: Could not add issuer's issuer to OCSP responder trust store");
4579                                         X509_free(cert);
4580                                 }
4581                         }
4582                 }
4583         }
4584
4585         status = OCSP_basic_verify(basic, certs, store, OCSP_TRUSTOTHER);
4586         sk_X509_pop_free(certs, X509_free);
4587         if (status <= 0) {
4588                 tls_show_errors(MSG_INFO, __func__,
4589                                 "OpenSSL: OCSP response failed verification");
4590                 OCSP_BASICRESP_free(basic);
4591                 OCSP_RESPONSE_free(rsp);
4592                 return 0;
4593         }
4594
4595         wpa_printf(MSG_DEBUG, "OpenSSL: OCSP response verification succeeded");
4596
4597         if (!conn->peer_cert) {
4598                 wpa_printf(MSG_DEBUG, "OpenSSL: Peer certificate not available for OCSP status check");
4599                 OCSP_BASICRESP_free(basic);
4600                 OCSP_RESPONSE_free(rsp);
4601                 return 0;
4602         }
4603
4604         if (!conn->peer_issuer) {
4605                 wpa_printf(MSG_DEBUG, "OpenSSL: Peer issuer certificate not available for OCSP status check");
4606                 OCSP_BASICRESP_free(basic);
4607                 OCSP_RESPONSE_free(rsp);
4608                 return 0;
4609         }
4610
4611         id = OCSP_cert_to_id(NULL, conn->peer_cert, conn->peer_issuer);
4612         if (!id) {
4613                 wpa_printf(MSG_DEBUG, "OpenSSL: Could not create OCSP certificate identifier");
4614                 OCSP_BASICRESP_free(basic);
4615                 OCSP_RESPONSE_free(rsp);
4616                 return 0;
4617         }
4618
4619         if (!OCSP_resp_find_status(basic, id, &status, &reason, &produced_at,
4620                                    &this_update, &next_update)) {
4621                 wpa_printf(MSG_INFO, "OpenSSL: Could not find current server certificate from OCSP response%s",
4622                            (conn->flags & TLS_CONN_REQUIRE_OCSP) ? "" :
4623                            " (OCSP not required)");
4624                 OCSP_BASICRESP_free(basic);
4625                 OCSP_RESPONSE_free(rsp);
4626                 return (conn->flags & TLS_CONN_REQUIRE_OCSP) ? 0 : 1;
4627         }
4628
4629         if (!OCSP_check_validity(this_update, next_update, 5 * 60, -1)) {
4630                 tls_show_errors(MSG_INFO, __func__,
4631                                 "OpenSSL: OCSP status times invalid");
4632                 OCSP_BASICRESP_free(basic);
4633                 OCSP_RESPONSE_free(rsp);
4634                 return 0;
4635         }
4636
4637         OCSP_BASICRESP_free(basic);
4638         OCSP_RESPONSE_free(rsp);
4639
4640         wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status for server certificate: %s",
4641                    OCSP_cert_status_str(status));
4642
4643         if (status == V_OCSP_CERTSTATUS_GOOD)
4644                 return 1;
4645         if (status == V_OCSP_CERTSTATUS_REVOKED)
4646                 return 0;
4647         if (conn->flags & TLS_CONN_REQUIRE_OCSP) {
4648                 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status unknown, but OCSP required");
4649                 return 0;
4650         }
4651         wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status unknown, but OCSP was not required, so allow connection to continue");
4652         return 1;
4653 }
4654
4655
4656 static int ocsp_status_cb(SSL *s, void *arg)
4657 {
4658         char *tmp;
4659         char *resp;
4660         size_t len;
4661
4662         if (tls_global->ocsp_stapling_response == NULL) {
4663                 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status callback - no response configured");
4664                 return SSL_TLSEXT_ERR_OK;
4665         }
4666
4667         resp = os_readfile(tls_global->ocsp_stapling_response, &len);
4668         if (resp == NULL) {
4669                 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status callback - could not read response file");
4670                 /* TODO: Build OCSPResponse with responseStatus = internalError
4671                  */
4672                 return SSL_TLSEXT_ERR_OK;
4673         }
4674         wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status callback - send cached response");
4675         tmp = OPENSSL_malloc(len);
4676         if (tmp == NULL) {
4677                 os_free(resp);
4678                 return SSL_TLSEXT_ERR_ALERT_FATAL;
4679         }
4680
4681         os_memcpy(tmp, resp, len);
4682         os_free(resp);
4683         SSL_set_tlsext_status_ocsp_resp(s, tmp, len);
4684
4685         return SSL_TLSEXT_ERR_OK;
4686 }
4687
4688 #endif /* HAVE_OCSP */
4689
4690
4691 int tls_connection_set_params(void *tls_ctx, struct tls_connection *conn,
4692                               const struct tls_connection_params *params)
4693 {
4694         struct tls_data *data = tls_ctx;
4695         int ret;
4696         unsigned long err;
4697         int can_pkcs11 = 0;
4698         const char *key_id = params->key_id;
4699         const char *cert_id = params->cert_id;
4700         const char *ca_cert_id = params->ca_cert_id;
4701         const char *engine_id = params->engine ? params->engine_id : NULL;
4702
4703         if (conn == NULL)
4704                 return -1;
4705
4706         /*
4707          * If the engine isn't explicitly configured, and any of the
4708          * cert/key fields are actually PKCS#11 URIs, then automatically
4709          * use the PKCS#11 ENGINE.
4710          */
4711         if (!engine_id || os_strcmp(engine_id, "pkcs11") == 0)
4712                 can_pkcs11 = 1;
4713
4714         if (!key_id && params->private_key && can_pkcs11 &&
4715             os_strncmp(params->private_key, "pkcs11:", 7) == 0) {
4716                 can_pkcs11 = 2;
4717                 key_id = params->private_key;
4718         }
4719
4720         if (!cert_id && params->client_cert && can_pkcs11 &&
4721             os_strncmp(params->client_cert, "pkcs11:", 7) == 0) {
4722                 can_pkcs11 = 2;
4723                 cert_id = params->client_cert;
4724         }
4725
4726         if (!ca_cert_id && params->ca_cert && can_pkcs11 &&
4727             os_strncmp(params->ca_cert, "pkcs11:", 7) == 0) {
4728                 can_pkcs11 = 2;
4729                 ca_cert_id = params->ca_cert;
4730         }
4731
4732         /* If we need to automatically enable the PKCS#11 ENGINE, do so. */
4733         if (can_pkcs11 == 2 && !engine_id)
4734                 engine_id = "pkcs11";
4735
4736 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
4737 #if OPENSSL_VERSION_NUMBER < 0x10100000L
4738         if (params->flags & TLS_CONN_EAP_FAST) {
4739                 wpa_printf(MSG_DEBUG,
4740                            "OpenSSL: Use TLSv1_method() for EAP-FAST");
4741                 if (SSL_set_ssl_method(conn->ssl, TLSv1_method()) != 1) {
4742                         tls_show_errors(MSG_INFO, __func__,
4743                                         "Failed to set TLSv1_method() for EAP-FAST");
4744                         return -1;
4745                 }
4746         }
4747 #endif
4748 #endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */
4749
4750         while ((err = ERR_get_error())) {
4751                 wpa_printf(MSG_INFO, "%s: Clearing pending SSL error: %s",
4752                            __func__, ERR_error_string(err, NULL));
4753         }
4754
4755         if (engine_id) {
4756                 wpa_printf(MSG_DEBUG, "SSL: Initializing TLS engine");
4757                 ret = tls_engine_init(conn, engine_id, params->pin,
4758                                       key_id, cert_id, ca_cert_id);
4759                 if (ret)
4760                         return ret;
4761         }
4762         if (tls_connection_set_subject_match(conn,
4763                                              params->subject_match,
4764                                              params->altsubject_match,
4765                                              params->suffix_match,
4766                                              params->domain_match))
4767                 return -1;
4768
4769         if (engine_id && ca_cert_id) {
4770                 if (tls_connection_engine_ca_cert(data, conn, ca_cert_id))
4771                         return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED;
4772         } else if (tls_connection_ca_cert(data, conn, params->ca_cert,
4773                                           params->ca_cert_blob,
4774                                           params->ca_cert_blob_len,
4775                                           params->ca_path))
4776                 return -1;
4777
4778         if (engine_id && cert_id) {
4779                 if (tls_connection_engine_client_cert(conn, cert_id))
4780                         return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED;
4781         } else if (tls_connection_client_cert(conn, params->client_cert,
4782                                               params->client_cert_blob,
4783                                               params->client_cert_blob_len))
4784                 return -1;
4785
4786         if (engine_id && key_id) {
4787                 wpa_printf(MSG_DEBUG, "TLS: Using private key from engine");
4788                 if (tls_connection_engine_private_key(conn))
4789                         return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED;
4790         } else if (tls_connection_private_key(data, conn,
4791                                               params->private_key,
4792                                               params->private_key_passwd,
4793                                               params->private_key_blob,
4794                                               params->private_key_blob_len)) {
4795                 wpa_printf(MSG_INFO, "TLS: Failed to load private key '%s'",
4796                            params->private_key);
4797                 return -1;
4798         }
4799
4800         if (tls_connection_dh(conn, params->dh_file)) {
4801                 wpa_printf(MSG_INFO, "TLS: Failed to load DH file '%s'",
4802                            params->dh_file);
4803                 return -1;
4804         }
4805
4806         if (params->openssl_ciphers &&
4807             SSL_set_cipher_list(conn->ssl, params->openssl_ciphers) != 1) {
4808                 wpa_printf(MSG_INFO,
4809                            "OpenSSL: Failed to set cipher string '%s'",
4810                            params->openssl_ciphers);
4811                 return -1;
4812         }
4813
4814         tls_set_conn_flags(conn->ssl, params->flags);
4815
4816 #ifdef OPENSSL_IS_BORINGSSL
4817         if (params->flags & TLS_CONN_REQUEST_OCSP) {
4818                 SSL_enable_ocsp_stapling(conn->ssl);
4819         }
4820 #else /* OPENSSL_IS_BORINGSSL */
4821 #ifdef HAVE_OCSP
4822         if (params->flags & TLS_CONN_REQUEST_OCSP) {
4823                 SSL_CTX *ssl_ctx = data->ssl;
4824                 SSL_set_tlsext_status_type(conn->ssl, TLSEXT_STATUSTYPE_ocsp);
4825                 SSL_CTX_set_tlsext_status_cb(ssl_ctx, ocsp_resp_cb);
4826                 SSL_CTX_set_tlsext_status_arg(ssl_ctx, conn);
4827         }
4828 #else /* HAVE_OCSP */
4829         if (params->flags & TLS_CONN_REQUIRE_OCSP) {
4830                 wpa_printf(MSG_INFO,
4831                            "OpenSSL: No OCSP support included - reject configuration");
4832                 return -1;
4833         }
4834         if (params->flags & TLS_CONN_REQUEST_OCSP) {
4835                 wpa_printf(MSG_DEBUG,
4836                            "OpenSSL: No OCSP support included - allow optional OCSP case to continue");
4837         }
4838 #endif /* HAVE_OCSP */
4839 #endif /* OPENSSL_IS_BORINGSSL */
4840
4841         conn->flags = params->flags;
4842
4843         tls_get_errors(data);
4844
4845         return 0;
4846 }
4847
4848
4849 int tls_global_set_params(void *tls_ctx,
4850                           const struct tls_connection_params *params)
4851 {
4852         struct tls_data *data = tls_ctx;
4853         SSL_CTX *ssl_ctx = data->ssl;
4854         unsigned long err;
4855
4856         while ((err = ERR_get_error())) {
4857                 wpa_printf(MSG_INFO, "%s: Clearing pending SSL error: %s",
4858                            __func__, ERR_error_string(err, NULL));
4859         }
4860
4861         if (tls_global_ca_cert(data, params->ca_cert) ||
4862             tls_global_client_cert(data, params->client_cert) ||
4863             tls_global_private_key(data, params->private_key,
4864                                    params->private_key_passwd) ||
4865             tls_global_dh(data, params->dh_file)) {
4866                 wpa_printf(MSG_INFO, "TLS: Failed to set global parameters");
4867                 return -1;
4868         }
4869
4870         if (params->openssl_ciphers &&
4871             SSL_CTX_set_cipher_list(ssl_ctx, params->openssl_ciphers) != 1) {
4872                 wpa_printf(MSG_INFO,
4873                            "OpenSSL: Failed to set cipher string '%s'",
4874                            params->openssl_ciphers);
4875                 return -1;
4876         }
4877
4878 #ifdef SSL_OP_NO_TICKET
4879         if (params->flags & TLS_CONN_DISABLE_SESSION_TICKET)
4880                 SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_TICKET);
4881 #ifdef SSL_CTX_clear_options
4882         else
4883                 SSL_CTX_clear_options(ssl_ctx, SSL_OP_NO_TICKET);
4884 #endif /* SSL_clear_options */
4885 #endif /*  SSL_OP_NO_TICKET */
4886
4887 #ifdef HAVE_OCSP
4888         SSL_CTX_set_tlsext_status_cb(ssl_ctx, ocsp_status_cb);
4889         SSL_CTX_set_tlsext_status_arg(ssl_ctx, ssl_ctx);
4890         os_free(tls_global->ocsp_stapling_response);
4891         if (params->ocsp_stapling_response)
4892                 tls_global->ocsp_stapling_response =
4893                         os_strdup(params->ocsp_stapling_response);
4894         else
4895                 tls_global->ocsp_stapling_response = NULL;
4896 #endif /* HAVE_OCSP */
4897
4898         return 0;
4899 }
4900
4901
4902 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
4903 /* Pre-shared secred requires a patch to openssl, so this function is
4904  * commented out unless explicitly needed for EAP-FAST in order to be able to
4905  * build this file with unmodified openssl. */
4906
4907 #ifdef OPENSSL_IS_BORINGSSL
4908 static int tls_sess_sec_cb(SSL *s, void *secret, int *secret_len,
4909                            STACK_OF(SSL_CIPHER) *peer_ciphers,
4910                            const SSL_CIPHER **cipher, void *arg)
4911 #else /* OPENSSL_IS_BORINGSSL */
4912 static int tls_sess_sec_cb(SSL *s, void *secret, int *secret_len,
4913                            STACK_OF(SSL_CIPHER) *peer_ciphers,
4914                            SSL_CIPHER **cipher, void *arg)
4915 #endif /* OPENSSL_IS_BORINGSSL */
4916 {
4917         struct tls_connection *conn = arg;
4918         int ret;
4919
4920 #if OPENSSL_VERSION_NUMBER < 0x10100000L
4921         if (conn == NULL || conn->session_ticket_cb == NULL)
4922                 return 0;
4923
4924         ret = conn->session_ticket_cb(conn->session_ticket_cb_ctx,
4925                                       conn->session_ticket,
4926                                       conn->session_ticket_len,
4927                                       s->s3->client_random,
4928                                       s->s3->server_random, secret);
4929 #else
4930         unsigned char client_random[SSL3_RANDOM_SIZE];
4931         unsigned char server_random[SSL3_RANDOM_SIZE];
4932
4933         if (conn == NULL || conn->session_ticket_cb == NULL)
4934                 return 0;
4935
4936         SSL_get_client_random(s, client_random, sizeof(client_random));
4937         SSL_get_server_random(s, server_random, sizeof(server_random));
4938
4939         ret = conn->session_ticket_cb(conn->session_ticket_cb_ctx,
4940                                       conn->session_ticket,
4941                                       conn->session_ticket_len,
4942                                       client_random,
4943                                       server_random, secret);
4944 #endif
4945
4946         os_free(conn->session_ticket);
4947         conn->session_ticket = NULL;
4948
4949         if (ret <= 0)
4950                 return 0;
4951
4952         *secret_len = SSL_MAX_MASTER_KEY_LENGTH;
4953         return 1;
4954 }
4955
4956
4957 static int tls_session_ticket_ext_cb(SSL *s, const unsigned char *data,
4958                                      int len, void *arg)
4959 {
4960         struct tls_connection *conn = arg;
4961
4962         if (conn == NULL || conn->session_ticket_cb == NULL)
4963                 return 0;
4964
4965         wpa_printf(MSG_DEBUG, "OpenSSL: %s: length=%d", __func__, len);
4966
4967         os_free(conn->session_ticket);
4968         conn->session_ticket = NULL;
4969
4970         wpa_hexdump(MSG_DEBUG, "OpenSSL: ClientHello SessionTicket "
4971                     "extension", data, len);
4972
4973         conn->session_ticket = os_malloc(len);
4974         if (conn->session_ticket == NULL)
4975                 return 0;
4976
4977         os_memcpy(conn->session_ticket, data, len);
4978         conn->session_ticket_len = len;
4979
4980         return 1;
4981 }
4982 #endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */
4983
4984
4985 int tls_connection_set_session_ticket_cb(void *tls_ctx,
4986                                          struct tls_connection *conn,
4987                                          tls_session_ticket_cb cb,
4988                                          void *ctx)
4989 {
4990 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
4991         conn->session_ticket_cb = cb;
4992         conn->session_ticket_cb_ctx = ctx;
4993
4994         if (cb) {
4995                 if (SSL_set_session_secret_cb(conn->ssl, tls_sess_sec_cb,
4996                                               conn) != 1)
4997                         return -1;
4998                 SSL_set_session_ticket_ext_cb(conn->ssl,
4999                                               tls_session_ticket_ext_cb, conn);
5000         } else {
5001                 if (SSL_set_session_secret_cb(conn->ssl, NULL, NULL) != 1)
5002                         return -1;
5003                 SSL_set_session_ticket_ext_cb(conn->ssl, NULL, NULL);
5004         }
5005
5006         return 0;
5007 #else /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */
5008         return -1;
5009 #endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */
5010 }
5011
5012
5013 int tls_get_library_version(char *buf, size_t buf_len)
5014 {
5015         return os_snprintf(buf, buf_len, "OpenSSL build=%s run=%s",
5016                            OPENSSL_VERSION_TEXT,
5017                            SSLeay_version(SSLEAY_VERSION));
5018 }
5019
5020
5021 void tls_connection_set_success_data(struct tls_connection *conn,
5022                                      struct wpabuf *data)
5023 {
5024         SSL_SESSION *sess;
5025         struct wpabuf *old;
5026
5027         if (tls_ex_idx_session < 0)
5028                 goto fail;
5029         sess = SSL_get_session(conn->ssl);
5030         if (!sess)
5031                 goto fail;
5032         old = SSL_SESSION_get_ex_data(sess, tls_ex_idx_session);
5033         if (old) {
5034                 wpa_printf(MSG_DEBUG, "OpenSSL: Replacing old success data %p",
5035                            old);
5036                 wpabuf_free(old);
5037         }
5038         if (SSL_SESSION_set_ex_data(sess, tls_ex_idx_session, data) != 1)
5039                 goto fail;
5040
5041         wpa_printf(MSG_DEBUG, "OpenSSL: Stored success data %p", data);
5042         conn->success_data = 1;
5043         return;
5044
5045 fail:
5046         wpa_printf(MSG_INFO, "OpenSSL: Failed to store success data");
5047         wpabuf_free(data);
5048 }
5049
5050
5051 void tls_connection_set_success_data_resumed(struct tls_connection *conn)
5052 {
5053         wpa_printf(MSG_DEBUG,
5054                    "OpenSSL: Success data accepted for resumed session");
5055         conn->success_data = 1;
5056 }
5057
5058
5059 const struct wpabuf *
5060 tls_connection_get_success_data(struct tls_connection *conn)
5061 {
5062         SSL_SESSION *sess;
5063
5064         if (tls_ex_idx_session < 0 ||
5065             !(sess = SSL_get_session(conn->ssl)))
5066                 return NULL;
5067         return SSL_SESSION_get_ex_data(sess, tls_ex_idx_session);
5068 }
5069
5070
5071 void tls_connection_remove_session(struct tls_connection *conn)
5072 {
5073         SSL_SESSION *sess;
5074
5075         sess = SSL_get_session(conn->ssl);
5076         if (!sess)
5077                 return;
5078
5079         if (SSL_CTX_remove_session(conn->ssl_ctx, sess) != 1)
5080                 wpa_printf(MSG_DEBUG,
5081                            "OpenSSL: Session was not cached");
5082         else
5083                 wpa_printf(MSG_DEBUG,
5084                            "OpenSSL: Removed cached session to disable session resumption");
5085 }