src/eap_server/eap_server_tls_common.c

   1 /*
   2  * EAP-TLS/PEAP/TTLS/FAST server common functions
   3  * Copyright (c) 2004-2009, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #include "common.h"
  12 #include "crypto/sha1.h"
  13 #include "crypto/tls.h"
  14 #include "eap_i.h"
  15 #include "eap_tls_common.h"
  16
  17
  18 static void eap_server_tls_free_in_buf(struct eap_ssl_data *data);
  19
  20
  21 struct wpabuf * eap_tls_msg_alloc(EapType type, size_t payload_len,
  22                                   u8 code, u8 identifier)
  23 {
  24         if (type == EAP_UNAUTH_TLS_TYPE)
  25                 return eap_msg_alloc(EAP_VENDOR_UNAUTH_TLS,
  26                                      EAP_VENDOR_TYPE_UNAUTH_TLS, payload_len,
  27                                      code, identifier);
  28         else if (type == EAP_WFA_UNAUTH_TLS_TYPE)
  29                 return eap_msg_alloc(EAP_VENDOR_WFA_NEW,
  30                                      EAP_VENDOR_WFA_UNAUTH_TLS, payload_len,
  31                                      code, identifier);
  32         return eap_msg_alloc(EAP_VENDOR_IETF, type, payload_len, code,
  33                              identifier);
  34 }
  35
  36
  37 #ifdef CONFIG_TLS_INTERNAL
  38 static void eap_server_tls_log_cb(void *ctx, const char *msg)
  39 {
  40         struct eap_sm *sm = ctx;
  41         eap_log_msg(sm, "TLS: %s", msg);
  42 }
  43 #endif /* CONFIG_TLS_INTERNAL */
  44
  45
  46 int eap_server_tls_ssl_init(struct eap_sm *sm, struct eap_ssl_data *data,
  47                             int verify_peer)
  48 {
  49         unsigned int flags = 0;
  50
  51         if (sm->ssl_ctx == NULL) {
  52                 wpa_printf(MSG_ERROR, "TLS context not initialized - cannot use TLS-based EAP method");
  53                 return -1;
  54         }
  55
  56         data->eap = sm;
  57         data->phase2 = sm->init_phase2;
  58
  59         data->conn = tls_connection_init(sm->ssl_ctx);
  60         if (data->conn == NULL) {
  61                 wpa_printf(MSG_INFO, "SSL: Failed to initialize new TLS "
  62                            "connection");
  63                 return -1;
  64         }
  65
  66 #ifdef CONFIG_TLS_INTERNAL
  67         tls_connection_set_log_cb(data->conn, eap_server_tls_log_cb, sm);
  68 #ifdef CONFIG_TESTING_OPTIONS
  69         tls_connection_set_test_flags(data->conn, sm->tls_test_flags);
  70 #endif /* CONFIG_TESTING_OPTIONS */
  71 #endif /* CONFIG_TLS_INTERNAL */
  72
  73         if (tls_connection_set_verify(sm->ssl_ctx, data->conn, verify_peer,
  74                                       flags, NULL, 0)) {
  75                 wpa_printf(MSG_INFO, "SSL: Failed to configure verification "
  76                            "of TLS peer certificate");
  77                 tls_connection_deinit(sm->ssl_ctx, data->conn);
  78                 data->conn = NULL;
  79                 return -1;
  80         }
  81
  82         data->tls_out_limit = sm->fragment_size > 0 ? sm->fragment_size : 1398;
  83         if (data->phase2) {
  84                 /* Limit the fragment size in the inner TLS authentication
  85                  * since the outer authentication with EAP-PEAP does not yet
  86                  * support fragmentation */
  87                 if (data->tls_out_limit > 100)
  88                         data->tls_out_limit -= 100;
  89         }
  90         return 0;
  91 }
  92
  93
  94 void eap_server_tls_ssl_deinit(struct eap_sm *sm, struct eap_ssl_data *data)
  95 {
  96         tls_connection_deinit(sm->ssl_ctx, data->conn);
  97         eap_server_tls_free_in_buf(data);
  98         wpabuf_free(data->tls_out);
  99         data->tls_out = NULL;
 100 }
 101
 102
 103 u8 * eap_server_tls_derive_key(struct eap_sm *sm, struct eap_ssl_data *data,
 104                                char *label, size_t len)
 105 {
 106         u8 *out;
 107
 108         out = os_malloc(len);
 109         if (out == NULL)
 110                 return NULL;
 111
 112         if (tls_connection_prf(sm->ssl_ctx, data->conn, label, 0, 0,
 113                                out, len)) {
 114                 os_free(out);
 115                 return NULL;
 116         }
 117
 118         return out;
 119 }
 120
 121
 122 /**
 123  * eap_server_tls_derive_session_id - Derive a Session-Id based on TLS data
 124  * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
 125  * @data: Data for TLS processing
 126  * @eap_type: EAP method used in Phase 1 (EAP_TYPE_TLS/PEAP/TTLS/FAST)
 127  * @len: Pointer to length of the session ID generated
 128  * Returns: Pointer to allocated Session-Id on success or %NULL on failure
 129  *
 130  * This function derive the Session-Id based on the TLS session data
 131  * (client/server random and method type).
 132  *
 133  * The caller is responsible for freeing the returned buffer.
 134  */
 135 u8 * eap_server_tls_derive_session_id(struct eap_sm *sm,
 136                                       struct eap_ssl_data *data, u8 eap_type,
 137                                       size_t *len)
 138 {
 139         struct tls_random keys;
 140         u8 *out;
 141
 142         if (tls_connection_get_random(sm->ssl_ctx, data->conn, &keys))
 143                 return NULL;
 144
 145         if (keys.client_random == NULL || keys.server_random == NULL)
 146                 return NULL;
 147
 148         *len = 1 + keys.client_random_len + keys.server_random_len;
 149         out = os_malloc(*len);
 150         if (out == NULL)
 151                 return NULL;
 152
 153         /* Session-Id = EAP type || client.random || server.random */
 154         out[0] = eap_type;
 155         os_memcpy(out + 1, keys.client_random, keys.client_random_len);
 156         os_memcpy(out + 1 + keys.client_random_len, keys.server_random,
 157                   keys.server_random_len);
 158
 159         return out;
 160 }
 161
 162
 163 struct wpabuf * eap_server_tls_build_msg(struct eap_ssl_data *data,
 164                                          int eap_type, int version, u8 id)
 165 {
 166         struct wpabuf *req;
 167         u8 flags;
 168         size_t send_len, plen;
 169
 170         wpa_printf(MSG_DEBUG, "SSL: Generating Request");
 171         if (data->tls_out == NULL) {
 172                 wpa_printf(MSG_ERROR, "SSL: tls_out NULL in %s", __func__);
 173                 return NULL;
 174         }
 175
 176         flags = version;
 177         send_len = wpabuf_len(data->tls_out) - data->tls_out_pos;
 178         if (1 + send_len > data->tls_out_limit) {
 179                 send_len = data->tls_out_limit - 1;
 180                 flags |= EAP_TLS_FLAGS_MORE_FRAGMENTS;
 181                 if (data->tls_out_pos == 0) {
 182                         flags |= EAP_TLS_FLAGS_LENGTH_INCLUDED;
 183                         send_len -= 4;
 184                 }
 185         }
 186
 187         plen = 1 + send_len;
 188         if (flags & EAP_TLS_FLAGS_LENGTH_INCLUDED)
 189                 plen += 4;
 190
 191         req = eap_tls_msg_alloc(eap_type, plen, EAP_CODE_REQUEST, id);
 192         if (req == NULL)
 193                 return NULL;
 194
 195         wpabuf_put_u8(req, flags); /* Flags */
 196         if (flags & EAP_TLS_FLAGS_LENGTH_INCLUDED)
 197                 wpabuf_put_be32(req, wpabuf_len(data->tls_out));
 198
 199         wpabuf_put_data(req, wpabuf_head_u8(data->tls_out) + data->tls_out_pos,
 200                         send_len);
 201         data->tls_out_pos += send_len;
 202
 203         if (data->tls_out_pos == wpabuf_len(data->tls_out)) {
 204                 wpa_printf(MSG_DEBUG, "SSL: Sending out %lu bytes "
 205                            "(message sent completely)",
 206                            (unsigned long) send_len);
 207                 wpabuf_free(data->tls_out);
 208                 data->tls_out = NULL;
 209                 data->tls_out_pos = 0;
 210                 data->state = MSG;
 211         } else {
 212                 wpa_printf(MSG_DEBUG, "SSL: Sending out %lu bytes "
 213                            "(%lu more to send)", (unsigned long) send_len,
 214                            (unsigned long) wpabuf_len(data->tls_out) -
 215                            data->tls_out_pos);
 216                 data->state = WAIT_FRAG_ACK;
 217         }
 218
 219         return req;
 220 }
 221
 222
 223 struct wpabuf * eap_server_tls_build_ack(u8 id, int eap_type, int version)
 224 {
 225         struct wpabuf *req;
 226
 227         req = eap_tls_msg_alloc(eap_type, 1, EAP_CODE_REQUEST, id);
 228         if (req == NULL)
 229                 return NULL;
 230         wpa_printf(MSG_DEBUG, "SSL: Building ACK");
 231         wpabuf_put_u8(req, version); /* Flags */
 232         return req;
 233 }
 234
 235
 236 static int eap_server_tls_process_cont(struct eap_ssl_data *data,
 237                                        const u8 *buf, size_t len)
 238 {
 239         /* Process continuation of a pending message */
 240         if (len > wpabuf_tailroom(data->tls_in)) {
 241                 wpa_printf(MSG_DEBUG, "SSL: Fragment overflow");
 242                 return -1;
 243         }
 244
 245         wpabuf_put_data(data->tls_in, buf, len);
 246         wpa_printf(MSG_DEBUG, "SSL: Received %lu bytes, waiting for %lu "
 247                    "bytes more", (unsigned long) len,
 248                    (unsigned long) wpabuf_tailroom(data->tls_in));
 249
 250         return 0;
 251 }
 252
 253
 254 static int eap_server_tls_process_fragment(struct eap_ssl_data *data,
 255                                            u8 flags, u32 message_length,
 256                                            const u8 *buf, size_t len)
 257 {
 258         /* Process a fragment that is not the last one of the message */
 259         if (data->tls_in == NULL && !(flags & EAP_TLS_FLAGS_LENGTH_INCLUDED)) {
 260                 wpa_printf(MSG_DEBUG, "SSL: No Message Length field in a "
 261                            "fragmented packet");
 262                 return -1;
 263         }
 264
 265         if (data->tls_in == NULL) {
 266                 /* First fragment of the message */
 267
 268                 /* Limit length to avoid rogue peers from causing large
 269                  * memory allocations. */
 270                 if (message_length > 65536) {
 271                         wpa_printf(MSG_INFO, "SSL: Too long TLS fragment (size"
 272                                    " over 64 kB)");
 273                         return -1;
 274                 }
 275
 276                 if (len > message_length) {
 277                         wpa_printf(MSG_INFO, "SSL: Too much data (%d bytes) in "
 278                                    "first fragment of frame (TLS Message "
 279                                    "Length %d bytes)",
 280                                    (int) len, (int) message_length);
 281                         return -1;
 282                 }
 283
 284                 data->tls_in = wpabuf_alloc(message_length);
 285                 if (data->tls_in == NULL) {
 286                         wpa_printf(MSG_DEBUG, "SSL: No memory for message");
 287                         return -1;
 288                 }
 289                 wpabuf_put_data(data->tls_in, buf, len);
 290                 wpa_printf(MSG_DEBUG, "SSL: Received %lu bytes in first "
 291                            "fragment, waiting for %lu bytes more",
 292                            (unsigned long) len,
 293                            (unsigned long) wpabuf_tailroom(data->tls_in));
 294         }
 295
 296         return 0;
 297 }
 298
 299
 300 int eap_server_tls_phase1(struct eap_sm *sm, struct eap_ssl_data *data)
 301 {
 302         if (data->tls_out) {
 303                 /* This should not happen.. */
 304                 wpa_printf(MSG_INFO, "SSL: pending tls_out data when "
 305                            "processing new message");
 306                 wpabuf_free(data->tls_out);
 307                 WPA_ASSERT(data->tls_out == NULL);
 308         }
 309
 310         data->tls_out = tls_connection_server_handshake(sm->ssl_ctx,
 311                                                         data->conn,
 312                                                         data->tls_in, NULL);
 313         if (data->tls_out == NULL) {
 314                 wpa_printf(MSG_INFO, "SSL: TLS processing failed");
 315                 return -1;
 316         }
 317         if (tls_connection_get_failed(sm->ssl_ctx, data->conn)) {
 318                 /* TLS processing has failed - return error */
 319                 wpa_printf(MSG_DEBUG, "SSL: Failed - tls_out available to "
 320                            "report error");
 321                 return -1;
 322         }
 323
 324         return 0;
 325 }
 326
 327
 328 static int eap_server_tls_reassemble(struct eap_ssl_data *data, u8 flags,
 329                                      const u8 **pos, size_t *left)
 330 {
 331         unsigned int tls_msg_len = 0;
 332         const u8 *end = *pos + *left;
 333
 334         if (flags & EAP_TLS_FLAGS_LENGTH_INCLUDED) {
 335                 if (*left < 4) {
 336                         wpa_printf(MSG_INFO, "SSL: Short frame with TLS "
 337                                    "length");
 338                         return -1;
 339                 }
 340                 tls_msg_len = WPA_GET_BE32(*pos);
 341                 wpa_printf(MSG_DEBUG, "SSL: TLS Message Length: %d",
 342                            tls_msg_len);
 343                 *pos += 4;
 344                 *left -= 4;
 345
 346                 if (*left > tls_msg_len) {
 347                         wpa_printf(MSG_INFO, "SSL: TLS Message Length (%d "
 348                                    "bytes) smaller than this fragment (%d "
 349                                    "bytes)", (int) tls_msg_len, (int) *left);
 350                         return -1;
 351                 }
 352         }
 353
 354         wpa_printf(MSG_DEBUG, "SSL: Received packet: Flags 0x%x "
 355                    "Message Length %u", flags, tls_msg_len);
 356
 357         if (data->state == WAIT_FRAG_ACK) {
 358                 if (*left != 0) {
 359                         wpa_printf(MSG_DEBUG, "SSL: Unexpected payload in "
 360                                    "WAIT_FRAG_ACK state");
 361                         return -1;
 362                 }
 363                 wpa_printf(MSG_DEBUG, "SSL: Fragment acknowledged");
 364                 return 1;
 365         }
 366
 367         if (data->tls_in &&
 368             eap_server_tls_process_cont(data, *pos, end - *pos) < 0)
 369                 return -1;
 370
 371         if (flags & EAP_TLS_FLAGS_MORE_FRAGMENTS) {
 372                 if (eap_server_tls_process_fragment(data, flags, tls_msg_len,
 373                                                     *pos, end - *pos) < 0)
 374                         return -1;
 375
 376                 data->state = FRAG_ACK;
 377                 return 1;
 378         }
 379
 380         if (data->state == FRAG_ACK) {
 381                 wpa_printf(MSG_DEBUG, "SSL: All fragments received");
 382                 data->state = MSG;
 383         }
 384
 385         if (data->tls_in == NULL) {
 386                 /* Wrap unfragmented messages as wpabuf without extra copy */
 387                 wpabuf_set(&data->tmpbuf, *pos, end - *pos);
 388                 data->tls_in = &data->tmpbuf;
 389         }
 390
 391         return 0;
 392 }
 393
 394
 395 static void eap_server_tls_free_in_buf(struct eap_ssl_data *data)
 396 {
 397         if (data->tls_in != &data->tmpbuf)
 398                 wpabuf_free(data->tls_in);
 399         data->tls_in = NULL;
 400 }
 401
 402
 403 struct wpabuf * eap_server_tls_encrypt(struct eap_sm *sm,
 404                                        struct eap_ssl_data *data,
 405                                        const struct wpabuf *plain)
 406 {
 407         struct wpabuf *buf;
 408
 409         buf = tls_connection_encrypt(sm->ssl_ctx, data->conn,
 410                                      plain);
 411         if (buf == NULL) {
 412                 wpa_printf(MSG_INFO, "SSL: Failed to encrypt Phase 2 data");
 413                 return NULL;
 414         }
 415
 416         return buf;
 417 }
 418
 419
 420 int eap_server_tls_process(struct eap_sm *sm, struct eap_ssl_data *data,
 421                            struct wpabuf *respData, void *priv, int eap_type,
 422                            int (*proc_version)(struct eap_sm *sm, void *priv,
 423                                                int peer_version),
 424                            void (*proc_msg)(struct eap_sm *sm, void *priv,
 425                                             const struct wpabuf *respData))
 426 {
 427         const u8 *pos;
 428         u8 flags;
 429         size_t left;
 430         int ret, res = 0;
 431
 432         if (eap_type == EAP_UNAUTH_TLS_TYPE)
 433                 pos = eap_hdr_validate(EAP_VENDOR_UNAUTH_TLS,
 434                                        EAP_VENDOR_TYPE_UNAUTH_TLS, respData,
 435                                        &left);
 436         else if (eap_type == EAP_WFA_UNAUTH_TLS_TYPE)
 437                 pos = eap_hdr_validate(EAP_VENDOR_WFA_NEW,
 438                                        EAP_VENDOR_WFA_UNAUTH_TLS, respData,
 439                                        &left);
 440         else
 441                 pos = eap_hdr_validate(EAP_VENDOR_IETF, eap_type, respData,
 442                                        &left);
 443         if (pos == NULL || left < 1)
 444                 return 0; /* Should not happen - frame already validated */
 445         flags = *pos++;
 446         left--;
 447         wpa_printf(MSG_DEBUG, "SSL: Received packet(len=%lu) - Flags 0x%02x",
 448                    (unsigned long) wpabuf_len(respData), flags);
 449
 450         if (proc_version &&
 451             proc_version(sm, priv, flags & EAP_TLS_VERSION_MASK) < 0)
 452                 return -1;
 453
 454         ret = eap_server_tls_reassemble(data, flags, &pos, &left);
 455         if (ret < 0) {
 456                 res = -1;
 457                 goto done;
 458         } else if (ret == 1)
 459                 return 0;
 460
 461         if (proc_msg)
 462                 proc_msg(sm, priv, respData);
 463
 464         if (tls_connection_get_write_alerts(sm->ssl_ctx, data->conn) > 1) {
 465                 wpa_printf(MSG_INFO, "SSL: Locally detected fatal error in "
 466                            "TLS processing");
 467                 res = -1;
 468         }
 469
 470 done:
 471         eap_server_tls_free_in_buf(data);
 472
 473         return res;
 474 }