src/modules/rlm_eap/types/rlm_eap_tls/tls.c

   1 /*
   2  * tls.c
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  *
  20  * Copyright 2001  hereUare Communications, Inc. <raghud@hereuare.com>
  21  * Copyright 2003  Alan DeKok <aland@freeradius.org>
  22  */
  23 #include "eap_tls.h"
  24
  25 tls_session_t *eaptls_new_session(SSL_CTX *ssl_ctx, int client_cert)
  26 {
  27         tls_session_t *state = NULL;
  28         SSL *new_tls = NULL;
  29         int verify_mode = SSL_VERIFY_NONE;
  30
  31         if ((new_tls = SSL_new(ssl_ctx)) == NULL) {
  32                 radlog(L_ERR, "rlm_eap_tls: Error creating new SSL");
  33                 ERR_print_errors_fp(stderr);
  34                 return NULL;
  35         }
  36
  37         /* We use the SSL's "app_data" to indicate a call-back */
  38         SSL_set_app_data(new_tls, NULL);
  39
  40         state = (tls_session_t *)malloc(sizeof(*state));
  41         memset(state, 0, sizeof(*state));
  42         session_init(state);
  43         state->ssl = new_tls;
  44
  45         /*
  46          *      Create & hook the BIOs to handle the dirty side of the
  47          *      SSL.  This is *very important* as we want to handle
  48          *      the transmission part.  Now the only IO interface
  49          *      that SSL is aware of, is our defined BIO buffers.
  50          *
  51          *      This means that all SSL IO is done to/from memory,
  52          *      and we can update those BIOs from the EAP packets we've
  53          *      received.
  54          */
  55         state->into_ssl = BIO_new(BIO_s_mem());
  56         state->from_ssl = BIO_new(BIO_s_mem());
  57         SSL_set_bio(state->ssl, state->into_ssl, state->from_ssl);
  58
  59         /*
  60          *      Add the message callback to identify what type of
  61          *      message/handshake is passed
  62          */
  63         SSL_set_msg_callback(new_tls, cbtls_msg);
  64         SSL_set_msg_callback_arg(new_tls, state);
  65         SSL_set_info_callback(new_tls, cbtls_info);
  66
  67         /*
  68          *      Verify the peer certificate, if asked.
  69          */
  70         if (client_cert) {
  71                 DEBUG2(" rlm_eap_tls: Requiring client certificate");
  72                 verify_mode = SSL_VERIFY_PEER;
  73                 verify_mode |= SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
  74                 verify_mode |= SSL_VERIFY_CLIENT_ONCE;
  75         }
  76         SSL_set_verify(state->ssl, verify_mode, cbtls_verify);
  77
  78         /*
  79          *      In Server mode we only accept.
  80          */
  81         SSL_set_accept_state(state->ssl);
  82
  83         return state;
  84 }
  85
  86 /*
  87  *      Print out some text describing the error.
  88  */
  89 static void int_ssl_check(SSL *s, int ret, const char *text)
  90 {
  91         int e;
  92
  93         ERR_print_errors_fp(stderr);
  94         e = SSL_get_error(s, ret);
  95
  96         switch(e) {
  97                 /*
  98                  *      These seem to be harmless and already "dealt
  99                  *      with" by our non-blocking environment. NB:
 100                  *      "ZERO_RETURN" is the clean "error"
 101                  *      indicating a successfully closed SSL
 102                  *      tunnel. We let this happen because our IO
 103                  *      loop should not appear to have broken on
 104                  *      this condition - and outside the IO loop, the
 105                  *      "shutdown" state is checked.
 106                  *
 107                  *      Don't print anything if we ignore the error.
 108                  */
 109         case SSL_ERROR_NONE:
 110         case SSL_ERROR_WANT_READ:
 111         case SSL_ERROR_WANT_WRITE:
 112         case SSL_ERROR_WANT_X509_LOOKUP:
 113         case SSL_ERROR_ZERO_RETURN:
 114                 return;
 115
 116                 /*
 117                  *      These seem to be indications of a genuine
 118                  *      error that should result in the SSL tunnel
 119                  *      being regarded as "dead".
 120                  */
 121         case SSL_ERROR_SYSCALL:
 122                 radlog(L_ERR, "rlm_eap_tls: %s failed in a system call (%d), TLS session fails.",
 123                        text, ret);
 124                 SSL_set_app_data(s, (char *)1);
 125                 return;
 126
 127         case SSL_ERROR_SSL:
 128                 radlog(L_ERR, "rlm_eap_tls: %s failed inside of TLS (%d), TLS session fails.",
 129                        text, ret);
 130                 SSL_set_app_data(s, (char *)1);
 131                 return;
 132
 133         default:
 134                 /*
 135                  *      For any other errors that (a) exist, and (b)
 136                  *      crop up - we need to interpret what to do with
 137                  *      them - so "politely inform" the caller that
 138                  *      the code needs updating here.
 139                  */
 140                 radlog(L_ERR, "rlm_eap_tls: FATAL SSL error ..... %d\n", e);
 141                 break;
 142         }
 143 }
 144
 145 /*
 146  * We are the server, we always get the dirty data
 147  * (Handshake data is also considered as dirty data)
 148  * During handshake, since SSL API handles itself,
 149  * After clean-up, dirty_out will be filled with
 150  * the data required for handshaking. So we check
 151  * if dirty_out is empty then we simply send it back.
 152  * As of now, if handshake is successful, then it is EAP-Success
 153  * or else EAP-failure should be sent
 154  *
 155  * Fill the Bio with the dirty data to clean it
 156  * Get the cleaned data from SSL, if it is not Handshake data
 157  */
 158 int tls_handshake_recv(tls_session_t *ssn)
 159 {
 160         int err;
 161
 162         BIO_write(ssn->into_ssl, ssn->dirty_in.data, ssn->dirty_in.used);
 163         err = SSL_read(ssn->ssl, ssn->clean_out.data,
 164                        sizeof(ssn->clean_out.data));
 165         if (err > 0) {
 166                 ssn->clean_out.used = err;
 167         } else {
 168                 int_ssl_check(ssn->ssl, err, "SSL_read");
 169         }
 170
 171         /* Some Extra STATE information for easy debugging */
 172         if (SSL_is_init_finished(ssn->ssl)) {
 173                 DEBUG2("SSL Connection Established\n");
 174         }
 175         if (SSL_in_init(ssn->ssl)) {
 176                 DEBUG2("In SSL Handshake Phase\n");
 177         }
 178         if (SSL_in_before(ssn->ssl)) {
 179                 DEBUG2("Before SSL Handshake Phase\n");
 180         }
 181         if (SSL_in_accept_init(ssn->ssl)) {
 182                 DEBUG2("In SSL Accept mode \n");
 183         }
 184         if (SSL_in_connect_init(ssn->ssl)) {
 185                 DEBUG2("In SSL Connect mode \n");
 186         }
 187
 188         if (ssn->info.content_type != application_data) {
 189                 err = BIO_read(ssn->from_ssl, ssn->dirty_out.data,
 190                                sizeof(ssn->dirty_out.data));
 191                 if (err > 0) {
 192                         ssn->dirty_out.used = err;
 193                 } else {
 194                         int_ssl_check(ssn->ssl, err, "BIO_read");
 195                         record_init(&ssn->dirty_in);
 196                         return 0;
 197                 }
 198         } else {
 199                 radlog(L_INFO, "rlm_eap_tls: Application Data");
 200                 /* Its clean application data, do whatever we want */
 201                 record_init(&ssn->clean_out);
 202         }
 203
 204         /* We are done with dirty_in, reinitialize it */
 205         record_init(&ssn->dirty_in);
 206         return 1;
 207 }
 208
 209 /*
 210  *      Take clear-text user data, and encrypt it into the output buffer,
 211  *      to send to the client at the other end of the SSL connection.
 212  */
 213 int tls_handshake_send(tls_session_t *ssn)
 214 {
 215         int err;
 216
 217         /*
 218          *      If there's un-encrypted data in 'clean_in', then write
 219          *      that data to the SSL session, and then call the BIO function
 220          *      to get that encrypted data from the SSL session, into
 221          *      a buffer which we can then package into an EAP packet.
 222          *
 223          *      Based on Server's logic this clean_in is expected to
 224          *      contain the data to send to the client.
 225          */
 226         if (ssn->clean_in.used > 0) {
 227                 SSL_write(ssn->ssl, ssn->clean_in.data, ssn->clean_in.used);
 228
 229                 /* Get the dirty data from Bio to send it */
 230                 err = BIO_read(ssn->from_ssl, ssn->dirty_out.data,
 231                                sizeof(ssn->dirty_out.data));
 232                 if (err > 0) {
 233                         ssn->dirty_out.used = err;
 234                 } else {
 235                         int_ssl_check(ssn->ssl, err, "handshake_send");
 236                 }
 237         }
 238
 239         return 1;
 240 }
 241
 242 void session_init(tls_session_t *ssn)
 243 {
 244         ssn->ssl = NULL;
 245         ssn->into_ssl = ssn->from_ssl = NULL;
 246         record_init(&ssn->clean_in);
 247         record_init(&ssn->clean_out);
 248         record_init(&ssn->dirty_in);
 249         record_init(&ssn->dirty_out);
 250
 251         memset(&ssn->info, 0, sizeof(ssn->info));
 252
 253         ssn->offset = 0;
 254         ssn->fragment = 0;
 255         ssn->tls_msg_len = 0;
 256         ssn->length_flag = 0;
 257         ssn->opaque = NULL;
 258         ssn->free_opaque = NULL;
 259 }
 260
 261 void session_close(tls_session_t *ssn)
 262 {
 263         if(ssn->ssl)
 264                 SSL_free(ssn->ssl);
 265 #if 0
 266 /*
 267  * WARNING: SSL_free seems to decrement the reference counts already,
 268  *      so doing this might crash the application.
 269  */
 270         if(ssn->into_ssl)
 271                 BIO_free(ssn->into_ssl);
 272         if(ssn->from_ssl)
 273                 BIO_free(ssn->from_ssl);
 274 #endif
 275         record_close(&ssn->clean_in);
 276         record_close(&ssn->clean_out);
 277         record_close(&ssn->dirty_in);
 278         record_close(&ssn->dirty_out);
 279         session_init(ssn);
 280 }
 281
 282 void session_free(void *ssn)
 283 {
 284         tls_session_t *sess = (tls_session_t *)ssn;
 285
 286         if (!ssn) return;
 287
 288         /*
 289          *      Free any opaque TTLS or PEAP data.
 290          */
 291         if ((sess->opaque) && (sess->free_opaque)) {
 292                 sess->free_opaque(sess->opaque);
 293                 sess->opaque = NULL;
 294         }
 295
 296         session_close(sess);
 297
 298         free(sess);
 299 }
 300
 301 void record_init(record_t *rec)
 302 {
 303         rec->used = 0;
 304 }
 305
 306 void record_close(record_t *rec)
 307 {
 308         rec->used = 0;
 309 }
 310
 311
 312 /*
 313  *      Copy data to the intermediate buffer, before we send
 314  *      it somewhere.
 315  */
 316 unsigned int record_plus(record_t *rec, const unsigned char *ptr,
 317                          unsigned int size)
 318 {
 319         unsigned int added = MAX_RECORD_SIZE - rec->used;
 320
 321         if(added > size)
 322                 added = size;
 323         if(added == 0)
 324                 return 0;
 325         memcpy(rec->data + rec->used, ptr, added);
 326         rec->used += added;
 327         return added;
 328 }
 329
 330 /*
 331  *      Take data from the buffer, and give it to the caller.
 332  */
 333 unsigned int record_minus(record_t *rec, unsigned char *ptr,
 334                           unsigned int size)
 335 {
 336         unsigned int taken = rec->used;
 337
 338         if(taken > size)
 339                 taken = size;
 340         if(taken == 0)
 341                 return 0;
 342         if(ptr)
 343                 memcpy(ptr, rec->data, taken);
 344         rec->used -= taken;
 345
 346         /*
 347          *      This is pretty bad...
 348          */
 349         if(rec->used > 0)
 350                 memmove(rec->data, rec->data + taken, rec->used);
 351         return taken;
 352 }
 353
 354 void tls_session_information(tls_session_t *tls_session)
 355 {
 356         const char *str_write_p, *str_version, *str_content_type = "";
 357         const char *str_details1 = "", *str_details2= "";
 358
 359         /*
 360          *      Don't print this out in the normal course of
 361          *      operations.
 362          */
 363         if (debug_flag == 0) {
 364                 return;
 365         }
 366
 367         str_write_p = tls_session->info.origin ? ">>>" : "<<<";
 368
 369         switch (tls_session->info.version)
 370         {
 371         case SSL2_VERSION:
 372                 str_version = "SSL 2.0";
 373                 break;
 374         case SSL3_VERSION:
 375                 str_version = "SSL 3.0 ";
 376                 break;
 377         case TLS1_VERSION:
 378                 str_version = "TLS 1.0 ";
 379                 break;
 380         default:
 381                 str_version = "Unknown TLS version";
 382                 break;
 383         }
 384
 385         if (tls_session->info.version == SSL3_VERSION ||
 386             tls_session->info.version == TLS1_VERSION) {
 387                 switch (tls_session->info.content_type) {
 388                 case SSL3_RT_CHANGE_CIPHER_SPEC:
 389                         str_content_type = "ChangeCipherSpec";
 390                         break;
 391                 case SSL3_RT_ALERT:
 392                         str_content_type = "Alert";
 393                         break;
 394                 case SSL3_RT_HANDSHAKE:
 395                         str_content_type = "Handshake";
 396                         break;
 397                 case SSL3_RT_APPLICATION_DATA:
 398                         str_content_type = "ApplicationData";
 399                         break;
 400                 default:
 401                         str_content_type = "UnknownContentType";
 402                         break;
 403                 }
 404
 405                 if (tls_session->info.content_type == SSL3_RT_ALERT) {
 406                         str_details1 = ", ???";
 407
 408                         if (tls_session->info.record_len == 2) {
 409
 410                                 switch (tls_session->info.alert_level) {
 411                                 case SSL3_AL_WARNING:
 412                                         str_details1 = ", warning";
 413                                         break;
 414                                 case SSL3_AL_FATAL:
 415                                         str_details1 = ", fatal";
 416                                         break;
 417                                 }
 418
 419                                 str_details2 = " ???";
 420                                 switch (tls_session->info.alert_description) {
 421                                 case SSL3_AD_CLOSE_NOTIFY:
 422                                         str_details2 = " close_notify";
 423                                         break;
 424                                 case SSL3_AD_UNEXPECTED_MESSAGE:
 425                                         str_details2 = " unexpected_message";
 426                                         break;
 427                                 case SSL3_AD_BAD_RECORD_MAC:
 428                                         str_details2 = " bad_record_mac";
 429                                         break;
 430                                 case TLS1_AD_DECRYPTION_FAILED:
 431                                         str_details2 = " decryption_failed";
 432                                         break;
 433                                 case TLS1_AD_RECORD_OVERFLOW:
 434                                         str_details2 = " record_overflow";
 435                                         break;
 436                                 case SSL3_AD_DECOMPRESSION_FAILURE:
 437                                         str_details2 = " decompression_failure";
 438                                         break;
 439                                 case SSL3_AD_HANDSHAKE_FAILURE:
 440                                         str_details2 = " handshake_failure";
 441                                         break;
 442                                 case SSL3_AD_BAD_CERTIFICATE:
 443                                         str_details2 = " bad_certificate";
 444                                         break;
 445                                 case SSL3_AD_UNSUPPORTED_CERTIFICATE:
 446                                         str_details2 = " unsupported_certificate";
 447                                         break;
 448                                 case SSL3_AD_CERTIFICATE_REVOKED:
 449                                         str_details2 = " certificate_revoked";
 450                                         break;
 451                                 case SSL3_AD_CERTIFICATE_EXPIRED:
 452                                         str_details2 = " certificate_expired";
 453                                         break;
 454                                 case SSL3_AD_CERTIFICATE_UNKNOWN:
 455                                         str_details2 = " certificate_unknown";
 456                                         break;
 457                                 case SSL3_AD_ILLEGAL_PARAMETER:
 458                                         str_details2 = " illegal_parameter";
 459                                         break;
 460                                 case TLS1_AD_UNKNOWN_CA:
 461                                         str_details2 = " unknown_ca";
 462                                         break;
 463                                 case TLS1_AD_ACCESS_DENIED:
 464                                         str_details2 = " access_denied";
 465                                         break;
 466                                 case TLS1_AD_DECODE_ERROR:
 467                                         str_details2 = " decode_error";
 468                                         break;
 469                                 case TLS1_AD_DECRYPT_ERROR:
 470                                         str_details2 = " decrypt_error";
 471                                         break;
 472                                 case TLS1_AD_EXPORT_RESTRICTION:
 473                                         str_details2 = " export_restriction";
 474                                         break;
 475                                 case TLS1_AD_PROTOCOL_VERSION:
 476                                         str_details2 = " protocol_version";
 477                                         break;
 478                                 case TLS1_AD_INSUFFICIENT_SECURITY:
 479                                         str_details2 = " insufficient_security";
 480                                         break;
 481                                 case TLS1_AD_INTERNAL_ERROR:
 482                                         str_details2 = " internal_error";
 483                                         break;
 484                                 case TLS1_AD_USER_CANCELLED:
 485                                         str_details2 = " user_canceled";
 486                                         break;
 487                                 case TLS1_AD_NO_RENEGOTIATION:
 488                                         str_details2 = " no_renegotiation";
 489                                         break;
 490                                 }
 491                         }
 492                 }
 493
 494                 if (tls_session->info.content_type == SSL3_RT_HANDSHAKE) {
 495                         str_details1 = "???";
 496
 497                         if (tls_session->info.record_len > 0)
 498                         switch (tls_session->info.handshake_type)
 499                         {
 500                         case SSL3_MT_HELLO_REQUEST:
 501                                 str_details1 = ", HelloRequest";
 502                                 break;
 503                         case SSL3_MT_CLIENT_HELLO:
 504                                 str_details1 = ", ClientHello";
 505                                 break;
 506                         case SSL3_MT_SERVER_HELLO:
 507                                 str_details1 = ", ServerHello";
 508                                 break;
 509                         case SSL3_MT_CERTIFICATE:
 510                                 str_details1 = ", Certificate";
 511                                 break;
 512                         case SSL3_MT_SERVER_KEY_EXCHANGE:
 513                                 str_details1 = ", ServerKeyExchange";
 514                                 break;
 515                         case SSL3_MT_CERTIFICATE_REQUEST:
 516                                 str_details1 = ", CertificateRequest";
 517                                 break;
 518                         case SSL3_MT_SERVER_DONE:
 519                                 str_details1 = ", ServerHelloDone";
 520                                 break;
 521                         case SSL3_MT_CERTIFICATE_VERIFY:
 522                                 str_details1 = ", CertificateVerify";
 523                                 break;
 524                         case SSL3_MT_CLIENT_KEY_EXCHANGE:
 525                                 str_details1 = ", ClientKeyExchange";
 526                                 break;
 527                         case SSL3_MT_FINISHED:
 528                                 str_details1 = ", Finished";
 529                                 break;
 530                         }
 531                 }
 532         }
 533
 534         sprintf(tls_session->info.info_description, "%s %s%s [length %04lx]%s%s\n",
 535                 str_write_p, str_version, str_content_type,
 536                 (unsigned long)tls_session->info.record_len, str_details1, str_details2);
 537         DEBUG2("  rlm_eap_tls: %s\n", tls_session->info.info_description);
 538 }