src/modules/rlm_eap/libeap/tls.c

   1 /*
   2  * tls.c
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  *
  20  * Copyright 2001  hereUare Communications, Inc. <raghud@hereuare.com>
  21  * Copyright 2003  Alan DeKok <aland@freeradius.org>
  22  */
  23 #include "eap_tls.h"
  24
  25 /* record */
  26 static void             record_init(record_t *buf);
  27 static void             record_close(record_t *buf);
  28 static unsigned int     record_plus(record_t *buf, const void *ptr,
  29                                     unsigned int size);
  30 static unsigned int     record_minus(record_t *buf, void *ptr,
  31                                      unsigned int size);
  32
  33 tls_session_t *eaptls_new_session(SSL_CTX *ssl_ctx, int client_cert)
  34 {
  35         tls_session_t *state = NULL;
  36         SSL *new_tls = NULL;
  37         int verify_mode = SSL_VERIFY_NONE;
  38
  39         if ((new_tls = SSL_new(ssl_ctx)) == NULL) {
  40                 radlog(L_ERR, "rlm_eap_tls: Error creating new SSL");
  41                 ERR_print_errors_fp(stderr);
  42                 return NULL;
  43         }
  44
  45         /* We use the SSL's "app_data" to indicate a call-back */
  46         SSL_set_app_data(new_tls, NULL);
  47
  48         state = (tls_session_t *)malloc(sizeof(*state));
  49         memset(state, 0, sizeof(*state));
  50         session_init(state);
  51         state->ssl = new_tls;
  52
  53         /*
  54          *      Initialize callbacks
  55          */
  56         state->record_init = record_init;
  57         state->record_close = record_close;
  58         state->record_plus = record_plus;
  59         state->record_minus = record_minus;
  60
  61         /*
  62          *      Create & hook the BIOs to handle the dirty side of the
  63          *      SSL.  This is *very important* as we want to handle
  64          *      the transmission part.  Now the only IO interface
  65          *      that SSL is aware of, is our defined BIO buffers.
  66          *
  67          *      This means that all SSL IO is done to/from memory,
  68          *      and we can update those BIOs from the EAP packets we've
  69          *      received.
  70          */
  71         state->into_ssl = BIO_new(BIO_s_mem());
  72         state->from_ssl = BIO_new(BIO_s_mem());
  73         SSL_set_bio(state->ssl, state->into_ssl, state->from_ssl);
  74
  75         /*
  76          *      Add the message callback to identify what type of
  77          *      message/handshake is passed
  78          */
  79         SSL_set_msg_callback(new_tls, cbtls_msg);
  80         SSL_set_msg_callback_arg(new_tls, state);
  81         SSL_set_info_callback(new_tls, cbtls_info);
  82
  83         /*
  84          *      Verify the peer certificate, if asked.
  85          */
  86         if (client_cert) {
  87                 DEBUG2(" rlm_eap_tls: Requiring client certificate");
  88                 verify_mode = SSL_VERIFY_PEER;
  89                 verify_mode |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
  90                 verify_mode |= SSL_VERIFY_CLIENT_ONCE;
  91         }
  92         SSL_set_verify(state->ssl, verify_mode, cbtls_verify);
  93
  94         /*
  95          *      In Server mode we only accept.
  96          */
  97         SSL_set_accept_state(state->ssl);
  98
  99         return state;
 100 }
 101
 102 /*
 103  *      Print out some text describing the error.
 104  */
 105 static void int_ssl_check(SSL *s, int ret, const char *text)
 106 {
 107         int e;
 108
 109         ERR_print_errors_fp(stderr);
 110         e = SSL_get_error(s, ret);
 111
 112         switch(e) {
 113                 /*
 114                  *      These seem to be harmless and already "dealt
 115                  *      with" by our non-blocking environment. NB:
 116                  *      "ZERO_RETURN" is the clean "error"
 117                  *      indicating a successfully closed SSL
 118                  *      tunnel. We let this happen because our IO
 119                  *      loop should not appear to have broken on
 120                  *      this condition - and outside the IO loop, the
 121                  *      "shutdown" state is checked.
 122                  *
 123                  *      Don't print anything if we ignore the error.
 124                  */
 125         case SSL_ERROR_NONE:
 126         case SSL_ERROR_WANT_READ:
 127         case SSL_ERROR_WANT_WRITE:
 128         case SSL_ERROR_WANT_X509_LOOKUP:
 129         case SSL_ERROR_ZERO_RETURN:
 130                 return;
 131
 132                 /*
 133                  *      These seem to be indications of a genuine
 134                  *      error that should result in the SSL tunnel
 135                  *      being regarded as "dead".
 136                  */
 137         case SSL_ERROR_SYSCALL:
 138                 radlog(L_ERR, "rlm_eap_tls: %s failed in a system call (%d), TLS session fails.",
 139                        text, ret);
 140                 SSL_set_app_data(s, (char *)1);
 141                 return;
 142
 143         case SSL_ERROR_SSL:
 144                 radlog(L_ERR, "rlm_eap_tls: %s failed inside of TLS (%d), TLS session fails.",
 145                        text, ret);
 146                 SSL_set_app_data(s, (char *)1);
 147                 return;
 148
 149         default:
 150                 /*
 151                  *      For any other errors that (a) exist, and (b)
 152                  *      crop up - we need to interpret what to do with
 153                  *      them - so "politely inform" the caller that
 154                  *      the code needs updating here.
 155                  */
 156                 radlog(L_ERR, "rlm_eap_tls: FATAL SSL error ..... %d\n", e);
 157                 break;
 158         }
 159 }
 160
 161 /*
 162  * We are the server, we always get the dirty data
 163  * (Handshake data is also considered as dirty data)
 164  * During handshake, since SSL API handles itself,
 165  * After clean-up, dirty_out will be filled with
 166  * the data required for handshaking. So we check
 167  * if dirty_out is empty then we simply send it back.
 168  * As of now, if handshake is successful, then it is EAP-Success
 169  * or else EAP-failure should be sent
 170  *
 171  * Fill the Bio with the dirty data to clean it
 172  * Get the cleaned data from SSL, if it is not Handshake data
 173  */
 174 int tls_handshake_recv(tls_session_t *ssn)
 175 {
 176         int err;
 177
 178         BIO_write(ssn->into_ssl, ssn->dirty_in.data, ssn->dirty_in.used);
 179         err = SSL_read(ssn->ssl, ssn->clean_out.data,
 180                        sizeof(ssn->clean_out.data));
 181         if (err > 0) {
 182                 ssn->clean_out.used = err;
 183         } else {
 184                 int_ssl_check(ssn->ssl, err, "SSL_read");
 185         }
 186
 187         /* Some Extra STATE information for easy debugging */
 188         if (SSL_is_init_finished(ssn->ssl)) {
 189                 DEBUG2("SSL Connection Established\n");
 190         }
 191         if (SSL_in_init(ssn->ssl)) {
 192                 DEBUG2("In SSL Handshake Phase\n");
 193         }
 194         if (SSL_in_before(ssn->ssl)) {
 195                 DEBUG2("Before SSL Handshake Phase\n");
 196         }
 197         if (SSL_in_accept_init(ssn->ssl)) {
 198                 DEBUG2("In SSL Accept mode \n");
 199         }
 200         if (SSL_in_connect_init(ssn->ssl)) {
 201                 DEBUG2("In SSL Connect mode \n");
 202         }
 203
 204         if (ssn->info.content_type != application_data) {
 205                 err = BIO_read(ssn->from_ssl, ssn->dirty_out.data,
 206                                sizeof(ssn->dirty_out.data));
 207                 if (err > 0) {
 208                         ssn->dirty_out.used = err;
 209                 } else {
 210                         int_ssl_check(ssn->ssl, err, "BIO_read");
 211                         record_init(&ssn->dirty_in);
 212                         return 0;
 213                 }
 214         } else {
 215                 radlog(L_INFO, "rlm_eap_tls: Application Data");
 216                 /* Its clean application data, do whatever we want */
 217                 record_init(&ssn->clean_out);
 218         }
 219
 220         /* We are done with dirty_in, reinitialize it */
 221         record_init(&ssn->dirty_in);
 222         return 1;
 223 }
 224
 225 /*
 226  *      Take clear-text user data, and encrypt it into the output buffer,
 227  *      to send to the client at the other end of the SSL connection.
 228  */
 229 int tls_handshake_send(tls_session_t *ssn)
 230 {
 231         int err;
 232
 233         /*
 234          *      If there's un-encrypted data in 'clean_in', then write
 235          *      that data to the SSL session, and then call the BIO function
 236          *      to get that encrypted data from the SSL session, into
 237          *      a buffer which we can then package into an EAP packet.
 238          *
 239          *      Based on Server's logic this clean_in is expected to
 240          *      contain the data to send to the client.
 241          */
 242         if (ssn->clean_in.used > 0) {
 243                 SSL_write(ssn->ssl, ssn->clean_in.data, ssn->clean_in.used);
 244
 245                 /* Get the dirty data from Bio to send it */
 246                 err = BIO_read(ssn->from_ssl, ssn->dirty_out.data,
 247                                sizeof(ssn->dirty_out.data));
 248                 if (err > 0) {
 249                         ssn->dirty_out.used = err;
 250                 } else {
 251                         int_ssl_check(ssn->ssl, err, "handshake_send");
 252                 }
 253         }
 254
 255         record_init(&ssn->clean_in);
 256         return 1;
 257 }
 258
 259 void session_init(tls_session_t *ssn)
 260 {
 261         ssn->ssl = NULL;
 262         ssn->into_ssl = ssn->from_ssl = NULL;
 263         record_init(&ssn->clean_in);
 264         record_init(&ssn->clean_out);
 265         record_init(&ssn->dirty_in);
 266         record_init(&ssn->dirty_out);
 267
 268         memset(&ssn->info, 0, sizeof(ssn->info));
 269
 270         ssn->offset = 0;
 271         ssn->fragment = 0;
 272         ssn->tls_msg_len = 0;
 273         ssn->length_flag = 0;
 274         ssn->opaque = NULL;
 275         ssn->free_opaque = NULL;
 276 }
 277
 278 void session_close(tls_session_t *ssn)
 279 {
 280         if(ssn->ssl)
 281                 SSL_free(ssn->ssl);
 282 #if 0
 283 /*
 284  * WARNING: SSL_free seems to decrement the reference counts already,
 285  *      so doing this might crash the application.
 286  */
 287         if(ssn->into_ssl)
 288                 BIO_free(ssn->into_ssl);
 289         if(ssn->from_ssl)
 290                 BIO_free(ssn->from_ssl);
 291 #endif
 292         record_close(&ssn->clean_in);
 293         record_close(&ssn->clean_out);
 294         record_close(&ssn->dirty_in);
 295         record_close(&ssn->dirty_out);
 296         session_init(ssn);
 297 }
 298
 299 void session_free(void *ssn)
 300 {
 301         tls_session_t *sess = (tls_session_t *)ssn;
 302
 303         if (!ssn) return;
 304
 305         /*
 306          *      Free any opaque TTLS or PEAP data.
 307          */
 308         if ((sess->opaque) && (sess->free_opaque)) {
 309                 sess->free_opaque(sess->opaque);
 310                 sess->opaque = NULL;
 311         }
 312
 313         session_close(sess);
 314
 315         free(sess);
 316 }
 317
 318 static void record_init(record_t *rec)
 319 {
 320         rec->used = 0;
 321 }
 322
 323 static void record_close(record_t *rec)
 324 {
 325         rec->used = 0;
 326 }
 327
 328
 329 /*
 330  *      Copy data to the intermediate buffer, before we send
 331  *      it somewhere.
 332  */
 333 static unsigned int record_plus(record_t *rec, const void *ptr,
 334                                 unsigned int size)
 335 {
 336         unsigned int added = MAX_RECORD_SIZE - rec->used;
 337
 338         if(added > size)
 339                 added = size;
 340         if(added == 0)
 341                 return 0;
 342         memcpy(rec->data + rec->used, ptr, added);
 343         rec->used += added;
 344         return added;
 345 }
 346
 347 /*
 348  *      Take data from the buffer, and give it to the caller.
 349  */
 350 static unsigned int record_minus(record_t *rec, void *ptr,
 351                                  unsigned int size)
 352 {
 353         unsigned int taken = rec->used;
 354
 355         if(taken > size)
 356                 taken = size;
 357         if(taken == 0)
 358                 return 0;
 359         if(ptr)
 360                 memcpy(ptr, rec->data, taken);
 361         rec->used -= taken;
 362
 363         /*
 364          *      This is pretty bad...
 365          */
 366         if(rec->used > 0)
 367                 memmove(rec->data, rec->data + taken, rec->used);
 368         return taken;
 369 }
 370
 371 void tls_session_information(tls_session_t *tls_session)
 372 {
 373         const char *str_write_p, *str_version, *str_content_type = "";
 374         const char *str_details1 = "", *str_details2= "";
 375
 376         /*
 377          *      Don't print this out in the normal course of
 378          *      operations.
 379          */
 380         if (debug_flag == 0) {
 381                 return;
 382         }
 383
 384         str_write_p = tls_session->info.origin ? ">>>" : "<<<";
 385
 386         switch (tls_session->info.version)
 387         {
 388         case SSL2_VERSION:
 389                 str_version = "SSL 2.0";
 390                 break;
 391         case SSL3_VERSION:
 392                 str_version = "SSL 3.0 ";
 393                 break;
 394         case TLS1_VERSION:
 395                 str_version = "TLS 1.0 ";
 396                 break;
 397         default:
 398                 str_version = "Unknown TLS version";
 399                 break;
 400         }
 401
 402         if (tls_session->info.version == SSL3_VERSION ||
 403             tls_session->info.version == TLS1_VERSION) {
 404                 switch (tls_session->info.content_type) {
 405                 case SSL3_RT_CHANGE_CIPHER_SPEC:
 406                         str_content_type = "ChangeCipherSpec";
 407                         break;
 408                 case SSL3_RT_ALERT:
 409                         str_content_type = "Alert";
 410                         break;
 411                 case SSL3_RT_HANDSHAKE:
 412                         str_content_type = "Handshake";
 413                         break;
 414                 case SSL3_RT_APPLICATION_DATA:
 415                         str_content_type = "ApplicationData";
 416                         break;
 417                 default:
 418                         str_content_type = "UnknownContentType";
 419                         break;
 420                 }
 421
 422                 if (tls_session->info.content_type == SSL3_RT_ALERT) {
 423                         str_details1 = ", ???";
 424
 425                         if (tls_session->info.record_len == 2) {
 426
 427                                 switch (tls_session->info.alert_level) {
 428                                 case SSL3_AL_WARNING:
 429                                         str_details1 = ", warning";
 430                                         break;
 431                                 case SSL3_AL_FATAL:
 432                                         str_details1 = ", fatal";
 433                                         break;
 434                                 }
 435
 436                                 str_details2 = " ???";
 437                                 switch (tls_session->info.alert_description) {
 438                                 case SSL3_AD_CLOSE_NOTIFY:
 439                                         str_details2 = " close_notify";
 440                                         break;
 441                                 case SSL3_AD_UNEXPECTED_MESSAGE:
 442                                         str_details2 = " unexpected_message";
 443                                         break;
 444                                 case SSL3_AD_BAD_RECORD_MAC:
 445                                         str_details2 = " bad_record_mac";
 446                                         break;
 447                                 case TLS1_AD_DECRYPTION_FAILED:
 448                                         str_details2 = " decryption_failed";
 449                                         break;
 450                                 case TLS1_AD_RECORD_OVERFLOW:
 451                                         str_details2 = " record_overflow";
 452                                         break;
 453                                 case SSL3_AD_DECOMPRESSION_FAILURE:
 454                                         str_details2 = " decompression_failure";
 455                                         break;
 456                                 case SSL3_AD_HANDSHAKE_FAILURE:
 457                                         str_details2 = " handshake_failure";
 458                                         break;
 459                                 case SSL3_AD_BAD_CERTIFICATE:
 460                                         str_details2 = " bad_certificate";
 461                                         break;
 462                                 case SSL3_AD_UNSUPPORTED_CERTIFICATE:
 463                                         str_details2 = " unsupported_certificate";
 464                                         break;
 465                                 case SSL3_AD_CERTIFICATE_REVOKED:
 466                                         str_details2 = " certificate_revoked";
 467                                         break;
 468                                 case SSL3_AD_CERTIFICATE_EXPIRED:
 469                                         str_details2 = " certificate_expired";
 470                                         break;
 471                                 case SSL3_AD_CERTIFICATE_UNKNOWN:
 472                                         str_details2 = " certificate_unknown";
 473                                         break;
 474                                 case SSL3_AD_ILLEGAL_PARAMETER:
 475                                         str_details2 = " illegal_parameter";
 476                                         break;
 477                                 case TLS1_AD_UNKNOWN_CA:
 478                                         str_details2 = " unknown_ca";
 479                                         break;
 480                                 case TLS1_AD_ACCESS_DENIED:
 481                                         str_details2 = " access_denied";
 482                                         break;
 483                                 case TLS1_AD_DECODE_ERROR:
 484                                         str_details2 = " decode_error";
 485                                         break;
 486                                 case TLS1_AD_DECRYPT_ERROR:
 487                                         str_details2 = " decrypt_error";
 488                                         break;
 489                                 case TLS1_AD_EXPORT_RESTRICTION:
 490                                         str_details2 = " export_restriction";
 491                                         break;
 492                                 case TLS1_AD_PROTOCOL_VERSION:
 493                                         str_details2 = " protocol_version";
 494                                         break;
 495                                 case TLS1_AD_INSUFFICIENT_SECURITY:
 496                                         str_details2 = " insufficient_security";
 497                                         break;
 498                                 case TLS1_AD_INTERNAL_ERROR:
 499                                         str_details2 = " internal_error";
 500                                         break;
 501                                 case TLS1_AD_USER_CANCELLED:
 502                                         str_details2 = " user_canceled";
 503                                         break;
 504                                 case TLS1_AD_NO_RENEGOTIATION:
 505                                         str_details2 = " no_renegotiation";
 506                                         break;
 507                                 }
 508                         }
 509                 }
 510
 511                 if (tls_session->info.content_type == SSL3_RT_HANDSHAKE) {
 512                         str_details1 = "???";
 513
 514                         if (tls_session->info.record_len > 0)
 515                         switch (tls_session->info.handshake_type)
 516                         {
 517                         case SSL3_MT_HELLO_REQUEST:
 518                                 str_details1 = ", HelloRequest";
 519                                 break;
 520                         case SSL3_MT_CLIENT_HELLO:
 521                                 str_details1 = ", ClientHello";
 522                                 break;
 523                         case SSL3_MT_SERVER_HELLO:
 524                                 str_details1 = ", ServerHello";
 525                                 break;
 526                         case SSL3_MT_CERTIFICATE:
 527                                 str_details1 = ", Certificate";
 528                                 break;
 529                         case SSL3_MT_SERVER_KEY_EXCHANGE:
 530                                 str_details1 = ", ServerKeyExchange";
 531                                 break;
 532                         case SSL3_MT_CERTIFICATE_REQUEST:
 533                                 str_details1 = ", CertificateRequest";
 534                                 break;
 535                         case SSL3_MT_SERVER_DONE:
 536                                 str_details1 = ", ServerHelloDone";
 537                                 break;
 538                         case SSL3_MT_CERTIFICATE_VERIFY:
 539                                 str_details1 = ", CertificateVerify";
 540                                 break;
 541                         case SSL3_MT_CLIENT_KEY_EXCHANGE:
 542                                 str_details1 = ", ClientKeyExchange";
 543                                 break;
 544                         case SSL3_MT_FINISHED:
 545                                 str_details1 = ", Finished";
 546                                 break;
 547                         }
 548                 }
 549         }
 550
 551         sprintf(tls_session->info.info_description, "%s %s%s [length %04lx]%s%s\n",
 552                 str_write_p, str_version, str_content_type,
 553                 (unsigned long)tls_session->info.record_len, str_details1, str_details2);
 554         DEBUG2("  rlm_eap_tls: %s\n", tls_session->info.info_description);
 555 }