src/tls/tlsv1_client_write.c

   1 /*
   2  * TLSv1 client - write handshake message
   3  * Copyright (c) 2006-2015, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #include "common.h"
  12 #include "crypto/md5.h"
  13 #include "crypto/sha1.h"
  14 #include "crypto/sha256.h"
  15 #include "crypto/tls.h"
  16 #include "crypto/random.h"
  17 #include "x509v3.h"
  18 #include "tlsv1_common.h"
  19 #include "tlsv1_record.h"
  20 #include "tlsv1_client.h"
  21 #include "tlsv1_client_i.h"
  22
  23
  24 static size_t tls_client_cert_chain_der_len(struct tlsv1_client *conn)
  25 {
  26         size_t len = 0;
  27         struct x509_certificate *cert;
  28
  29         if (conn->cred == NULL)
  30                 return 0;
  31
  32         cert = conn->cred->cert;
  33         while (cert) {
  34                 len += 3 + cert->cert_len;
  35                 if (x509_certificate_self_signed(cert))
  36                         break;
  37                 cert = x509_certificate_get_subject(conn->cred->trusted_certs,
  38                                                     &cert->issuer);
  39         }
  40
  41         return len;
  42 }
  43
  44
  45 u8 * tls_send_client_hello(struct tlsv1_client *conn, size_t *out_len)
  46 {
  47         u8 *hello, *end, *pos, *hs_length, *hs_start, *rhdr;
  48         struct os_time now;
  49         size_t len, i;
  50         u8 *ext_start;
  51         u16 tls_version = TLS_VERSION;
  52
  53         /* Pick the highest locally enabled TLS version */
  54 #ifdef CONFIG_TLSV12
  55         if ((conn->flags & TLS_CONN_DISABLE_TLSv1_2) &&
  56             tls_version == TLS_VERSION_1_2)
  57                 tls_version = TLS_VERSION_1_1;
  58 #endif /* CONFIG_TLSV12 */
  59 #ifdef CONFIG_TLSV11
  60         if ((conn->flags & TLS_CONN_DISABLE_TLSv1_1) &&
  61             tls_version == TLS_VERSION_1_1)
  62                 tls_version = TLS_VERSION_1;
  63 #endif /* CONFIG_TLSV11 */
  64         if ((conn->flags & TLS_CONN_DISABLE_TLSv1_0) &&
  65             tls_version == TLS_VERSION_1) {
  66                 wpa_printf(MSG_INFO, "TLSv1: No TLS version allowed");
  67                 return NULL;
  68         }
  69
  70         wpa_printf(MSG_DEBUG, "TLSv1: Send ClientHello (ver %s)",
  71                    tls_version_str(tls_version));
  72         *out_len = 0;
  73
  74         os_get_time(&now);
  75         WPA_PUT_BE32(conn->client_random, now.sec);
  76         if (random_get_bytes(conn->client_random + 4, TLS_RANDOM_LEN - 4)) {
  77                 wpa_printf(MSG_ERROR, "TLSv1: Could not generate "
  78                            "client_random");
  79                 return NULL;
  80         }
  81         wpa_hexdump(MSG_MSGDUMP, "TLSv1: client_random",
  82                     conn->client_random, TLS_RANDOM_LEN);
  83
  84         len = 150 + conn->num_cipher_suites * 2 + conn->client_hello_ext_len;
  85         hello = os_malloc(len);
  86         if (hello == NULL)
  87                 return NULL;
  88         end = hello + len;
  89
  90         rhdr = hello;
  91         pos = rhdr + TLS_RECORD_HEADER_LEN;
  92
  93         /* opaque fragment[TLSPlaintext.length] */
  94
  95         /* Handshake */
  96         hs_start = pos;
  97         /* HandshakeType msg_type */
  98         *pos++ = TLS_HANDSHAKE_TYPE_CLIENT_HELLO;
  99         /* uint24 length (to be filled) */
 100         hs_length = pos;
 101         pos += 3;
 102         /* body - ClientHello */
 103         /* ProtocolVersion client_version */
 104         WPA_PUT_BE16(pos, tls_version);
 105         pos += 2;
 106         /* Random random: uint32 gmt_unix_time, opaque random_bytes */
 107         os_memcpy(pos, conn->client_random, TLS_RANDOM_LEN);
 108         pos += TLS_RANDOM_LEN;
 109         /* SessionID session_id */
 110         *pos++ = conn->session_id_len;
 111         os_memcpy(pos, conn->session_id, conn->session_id_len);
 112         pos += conn->session_id_len;
 113         /* CipherSuite cipher_suites<2..2^16-1> */
 114         WPA_PUT_BE16(pos, 2 * conn->num_cipher_suites);
 115         pos += 2;
 116         for (i = 0; i < conn->num_cipher_suites; i++) {
 117                 WPA_PUT_BE16(pos, conn->cipher_suites[i]);
 118                 pos += 2;
 119         }
 120         /* CompressionMethod compression_methods<1..2^8-1> */
 121         *pos++ = 1;
 122         *pos++ = TLS_COMPRESSION_NULL;
 123
 124         /* Extension */
 125         ext_start = pos;
 126         pos += 2;
 127
 128 #ifdef CONFIG_TLSV12
 129         if (conn->rl.tls_version >= TLS_VERSION_1_2) {
 130                 /*
 131                  * Add signature_algorithms extension since we support only
 132                  * SHA256 (and not the default SHA1) with TLSv1.2.
 133                  */
 134                 /* ExtensionsType extension_type = signature_algorithms(13) */
 135                 WPA_PUT_BE16(pos, TLS_EXT_SIGNATURE_ALGORITHMS);
 136                 pos += 2;
 137                 /* opaque extension_data<0..2^16-1> length */
 138                 WPA_PUT_BE16(pos, 8);
 139                 pos += 2;
 140                 /* supported_signature_algorithms<2..2^16-2> length */
 141                 WPA_PUT_BE16(pos, 6);
 142                 pos += 2;
 143                 /* supported_signature_algorithms */
 144                 *pos++ = TLS_HASH_ALG_SHA512;
 145                 *pos++ = TLS_SIGN_ALG_RSA;
 146                 *pos++ = TLS_HASH_ALG_SHA384;
 147                 *pos++ = TLS_SIGN_ALG_RSA;
 148                 *pos++ = TLS_HASH_ALG_SHA256;
 149                 *pos++ = TLS_SIGN_ALG_RSA;
 150         }
 151 #endif /* CONFIG_TLSV12 */
 152
 153         if (conn->client_hello_ext) {
 154                 os_memcpy(pos, conn->client_hello_ext,
 155                           conn->client_hello_ext_len);
 156                 pos += conn->client_hello_ext_len;
 157         }
 158
 159         if (conn->flags & TLS_CONN_REQUEST_OCSP) {
 160                 wpa_printf(MSG_DEBUG,
 161                            "TLSv1: Add status_request extension for OCSP stapling");
 162                 /* ExtensionsType extension_type = status_request(5) */
 163                 WPA_PUT_BE16(pos, TLS_EXT_STATUS_REQUEST);
 164                 pos += 2;
 165                 /* opaque extension_data<0..2^16-1> length */
 166                 WPA_PUT_BE16(pos, 5);
 167                 pos += 2;
 168
 169                 /*
 170                  * RFC 6066, 8:
 171                  * struct {
 172                  *     CertificateStatusType status_type;
 173                  *     select (status_type) {
 174                  *         case ocsp: OCSPStatusRequest;
 175                  *     } request;
 176                  * } CertificateStatusRequest;
 177                  *
 178                  * enum { ocsp(1), (255) } CertificateStatusType;
 179                  */
 180                 *pos++ = 1; /* status_type = ocsp(1) */
 181
 182                 /*
 183                  * struct {
 184                  *     ResponderID responder_id_list<0..2^16-1>;
 185                  *     Extensions  request_extensions;
 186                  * } OCSPStatusRequest;
 187                  *
 188                  * opaque ResponderID<1..2^16-1>;
 189                  * opaque Extensions<0..2^16-1>;
 190                  */
 191                 WPA_PUT_BE16(pos, 0); /* responder_id_list(empty) */
 192                 pos += 2;
 193                 WPA_PUT_BE16(pos, 0); /* request_extensions(empty) */
 194                 pos += 2;
 195         }
 196
 197         if (pos == ext_start + 2)
 198                 pos -= 2; /* no extensions */
 199         else
 200                 WPA_PUT_BE16(ext_start, pos - ext_start - 2);
 201
 202         WPA_PUT_BE24(hs_length, pos - hs_length - 3);
 203         tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
 204
 205         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 206                               rhdr, end - rhdr, hs_start, pos - hs_start,
 207                               out_len) < 0) {
 208                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to create TLS record");
 209                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 210                           TLS_ALERT_INTERNAL_ERROR);
 211                 os_free(hello);
 212                 return NULL;
 213         }
 214
 215         conn->state = SERVER_HELLO;
 216
 217         return hello;
 218 }
 219
 220
 221 static int tls_write_client_certificate(struct tlsv1_client *conn,
 222                                         u8 **msgpos, u8 *end)
 223 {
 224         u8 *pos, *rhdr, *hs_start, *hs_length, *cert_start;
 225         size_t rlen;
 226         struct x509_certificate *cert;
 227
 228         pos = *msgpos;
 229         if (TLS_RECORD_HEADER_LEN + 1 + 3 + 3 > end - pos) {
 230                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 231                           TLS_ALERT_INTERNAL_ERROR);
 232                 return -1;
 233         }
 234
 235         wpa_printf(MSG_DEBUG, "TLSv1: Send Certificate");
 236         rhdr = pos;
 237         pos += TLS_RECORD_HEADER_LEN;
 238
 239         /* opaque fragment[TLSPlaintext.length] */
 240
 241         /* Handshake */
 242         hs_start = pos;
 243         /* HandshakeType msg_type */
 244         *pos++ = TLS_HANDSHAKE_TYPE_CERTIFICATE;
 245         /* uint24 length (to be filled) */
 246         hs_length = pos;
 247         pos += 3;
 248         /* body - Certificate */
 249         /* uint24 length (to be filled) */
 250         cert_start = pos;
 251         pos += 3;
 252         cert = conn->cred ? conn->cred->cert : NULL;
 253         while (cert) {
 254                 if (3 + cert->cert_len > (size_t) (end - pos)) {
 255                         wpa_printf(MSG_DEBUG, "TLSv1: Not enough buffer space "
 256                                    "for Certificate (cert_len=%lu left=%lu)",
 257                                    (unsigned long) cert->cert_len,
 258                                    (unsigned long) (end - pos));
 259                         tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 260                                   TLS_ALERT_INTERNAL_ERROR);
 261                         return -1;
 262                 }
 263                 WPA_PUT_BE24(pos, cert->cert_len);
 264                 pos += 3;
 265                 os_memcpy(pos, cert->cert_start, cert->cert_len);
 266                 pos += cert->cert_len;
 267
 268                 if (x509_certificate_self_signed(cert))
 269                         break;
 270                 cert = x509_certificate_get_subject(conn->cred->trusted_certs,
 271                                                     &cert->issuer);
 272         }
 273         if (conn->cred == NULL || cert == conn->cred->cert || cert == NULL) {
 274                 /*
 275                  * Client was not configured with all the needed certificates
 276                  * to form a full certificate chain. The server may fail to
 277                  * validate the chain unless it is configured with all the
 278                  * missing CA certificates.
 279                  */
 280                 wpa_printf(MSG_DEBUG, "TLSv1: Full client certificate chain "
 281                            "not configured - validation may fail");
 282         }
 283         WPA_PUT_BE24(cert_start, pos - cert_start - 3);
 284
 285         WPA_PUT_BE24(hs_length, pos - hs_length - 3);
 286
 287         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 288                               rhdr, end - rhdr, hs_start, pos - hs_start,
 289                               &rlen) < 0) {
 290                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate a record");
 291                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 292                           TLS_ALERT_INTERNAL_ERROR);
 293                 return -1;
 294         }
 295         pos = rhdr + rlen;
 296
 297         tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
 298
 299         *msgpos = pos;
 300
 301         return 0;
 302 }
 303
 304
 305 static int tlsv1_key_x_dh(struct tlsv1_client *conn, u8 **pos, u8 *end)
 306 {
 307         /* ClientDiffieHellmanPublic */
 308         u8 *csecret, *csecret_start, *dh_yc, *shared;
 309         size_t csecret_len, dh_yc_len, shared_len;
 310
 311         csecret_len = conn->dh_p_len;
 312         csecret = os_malloc(csecret_len);
 313         if (csecret == NULL) {
 314                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to allocate "
 315                            "memory for Yc (Diffie-Hellman)");
 316                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 317                           TLS_ALERT_INTERNAL_ERROR);
 318                 return -1;
 319         }
 320         if (random_get_bytes(csecret, csecret_len)) {
 321                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to get random "
 322                            "data for Diffie-Hellman");
 323                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 324                           TLS_ALERT_INTERNAL_ERROR);
 325                 os_free(csecret);
 326                 return -1;
 327         }
 328
 329         if (os_memcmp(csecret, conn->dh_p, csecret_len) > 0)
 330                 csecret[0] = 0; /* make sure Yc < p */
 331
 332         csecret_start = csecret;
 333         while (csecret_len > 1 && *csecret_start == 0) {
 334                 csecret_start++;
 335                 csecret_len--;
 336         }
 337         wpa_hexdump_key(MSG_DEBUG, "TLSv1: DH client's secret value",
 338                         csecret_start, csecret_len);
 339
 340         /* Yc = g^csecret mod p */
 341         dh_yc_len = conn->dh_p_len;
 342         dh_yc = os_malloc(dh_yc_len);
 343         if (dh_yc == NULL) {
 344                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to allocate "
 345                            "memory for Diffie-Hellman");
 346                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 347                           TLS_ALERT_INTERNAL_ERROR);
 348                 os_free(csecret);
 349                 return -1;
 350         }
 351         if (crypto_mod_exp(conn->dh_g, conn->dh_g_len,
 352                            csecret_start, csecret_len,
 353                            conn->dh_p, conn->dh_p_len,
 354                            dh_yc, &dh_yc_len)) {
 355                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 356                           TLS_ALERT_INTERNAL_ERROR);
 357                 os_free(csecret);
 358                 os_free(dh_yc);
 359                 return -1;
 360         }
 361
 362         wpa_hexdump(MSG_DEBUG, "TLSv1: DH Yc (client's public value)",
 363                     dh_yc, dh_yc_len);
 364
 365         if (end - *pos < 2) {
 366                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 367                           TLS_ALERT_INTERNAL_ERROR);
 368                 os_free(csecret);
 369                 os_free(dh_yc);
 370                 return -1;
 371         }
 372         WPA_PUT_BE16(*pos, dh_yc_len);
 373         *pos += 2;
 374         if (dh_yc_len > (size_t) (end - *pos)) {
 375                 wpa_printf(MSG_DEBUG, "TLSv1: Not enough room in the "
 376                            "message buffer for Yc");
 377                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 378                           TLS_ALERT_INTERNAL_ERROR);
 379                 os_free(csecret);
 380                 os_free(dh_yc);
 381                 return -1;
 382         }
 383         os_memcpy(*pos, dh_yc, dh_yc_len);
 384         *pos += dh_yc_len;
 385         os_free(dh_yc);
 386
 387         shared_len = conn->dh_p_len;
 388         shared = os_malloc(shared_len);
 389         if (shared == NULL) {
 390                 wpa_printf(MSG_DEBUG, "TLSv1: Could not allocate memory for "
 391                            "DH");
 392                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 393                           TLS_ALERT_INTERNAL_ERROR);
 394                 os_free(csecret);
 395                 return -1;
 396         }
 397
 398         /* shared = Ys^csecret mod p */
 399         if (crypto_mod_exp(conn->dh_ys, conn->dh_ys_len,
 400                            csecret_start, csecret_len,
 401                            conn->dh_p, conn->dh_p_len,
 402                            shared, &shared_len)) {
 403                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 404                           TLS_ALERT_INTERNAL_ERROR);
 405                 os_free(csecret);
 406                 os_free(shared);
 407                 return -1;
 408         }
 409         wpa_hexdump_key(MSG_DEBUG, "TLSv1: Shared secret from DH key exchange",
 410                         shared, shared_len);
 411
 412         os_memset(csecret_start, 0, csecret_len);
 413         os_free(csecret);
 414         if (tls_derive_keys(conn, shared, shared_len)) {
 415                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive keys");
 416                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 417                           TLS_ALERT_INTERNAL_ERROR);
 418                 os_free(shared);
 419                 return -1;
 420         }
 421         os_memset(shared, 0, shared_len);
 422         os_free(shared);
 423         tlsv1_client_free_dh(conn);
 424         return 0;
 425 }
 426
 427
 428 static int tlsv1_key_x_rsa(struct tlsv1_client *conn, u8 **pos, u8 *end)
 429 {
 430         u8 pre_master_secret[TLS_PRE_MASTER_SECRET_LEN];
 431         size_t clen;
 432         int res;
 433
 434         if (tls_derive_pre_master_secret(pre_master_secret) < 0 ||
 435             tls_derive_keys(conn, pre_master_secret,
 436                             TLS_PRE_MASTER_SECRET_LEN)) {
 437                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive keys");
 438                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 439                           TLS_ALERT_INTERNAL_ERROR);
 440                 return -1;
 441         }
 442
 443         /* EncryptedPreMasterSecret */
 444         if (conn->server_rsa_key == NULL) {
 445                 wpa_printf(MSG_DEBUG, "TLSv1: No server RSA key to "
 446                            "use for encrypting pre-master secret");
 447                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 448                           TLS_ALERT_INTERNAL_ERROR);
 449                 return -1;
 450         }
 451
 452         /* RSA encrypted value is encoded with PKCS #1 v1.5 block type 2. */
 453         *pos += 2;
 454         clen = end - *pos;
 455         res = crypto_public_key_encrypt_pkcs1_v15(
 456                 conn->server_rsa_key,
 457                 pre_master_secret, TLS_PRE_MASTER_SECRET_LEN,
 458                 *pos, &clen);
 459         os_memset(pre_master_secret, 0, TLS_PRE_MASTER_SECRET_LEN);
 460         if (res < 0) {
 461                 wpa_printf(MSG_DEBUG, "TLSv1: RSA encryption failed");
 462                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 463                           TLS_ALERT_INTERNAL_ERROR);
 464                 return -1;
 465         }
 466         WPA_PUT_BE16(*pos - 2, clen);
 467         wpa_hexdump(MSG_MSGDUMP, "TLSv1: Encrypted pre_master_secret",
 468                     *pos, clen);
 469         *pos += clen;
 470
 471         return 0;
 472 }
 473
 474
 475 static int tls_write_client_key_exchange(struct tlsv1_client *conn,
 476                                          u8 **msgpos, u8 *end)
 477 {
 478         u8 *pos, *rhdr, *hs_start, *hs_length;
 479         size_t rlen;
 480         tls_key_exchange keyx;
 481         const struct tls_cipher_suite *suite;
 482
 483         suite = tls_get_cipher_suite(conn->rl.cipher_suite);
 484         if (suite == NULL)
 485                 keyx = TLS_KEY_X_NULL;
 486         else
 487                 keyx = suite->key_exchange;
 488
 489         pos = *msgpos;
 490
 491         wpa_printf(MSG_DEBUG, "TLSv1: Send ClientKeyExchange");
 492
 493         rhdr = pos;
 494         pos += TLS_RECORD_HEADER_LEN;
 495
 496         /* opaque fragment[TLSPlaintext.length] */
 497
 498         /* Handshake */
 499         hs_start = pos;
 500         /* HandshakeType msg_type */
 501         *pos++ = TLS_HANDSHAKE_TYPE_CLIENT_KEY_EXCHANGE;
 502         /* uint24 length (to be filled) */
 503         hs_length = pos;
 504         pos += 3;
 505         /* body - ClientKeyExchange */
 506         if (keyx == TLS_KEY_X_DH_anon || keyx == TLS_KEY_X_DHE_RSA) {
 507                 if (tlsv1_key_x_dh(conn, &pos, end) < 0)
 508                         return -1;
 509         } else {
 510                 if (tlsv1_key_x_rsa(conn, &pos, end) < 0)
 511                         return -1;
 512         }
 513
 514         WPA_PUT_BE24(hs_length, pos - hs_length - 3);
 515
 516         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 517                               rhdr, end - rhdr, hs_start, pos - hs_start,
 518                               &rlen) < 0) {
 519                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to create a record");
 520                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 521                           TLS_ALERT_INTERNAL_ERROR);
 522                 return -1;
 523         }
 524         pos = rhdr + rlen;
 525         tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
 526
 527         *msgpos = pos;
 528
 529         return 0;
 530 }
 531
 532
 533 static int tls_write_client_certificate_verify(struct tlsv1_client *conn,
 534                                                u8 **msgpos, u8 *end)
 535 {
 536         u8 *pos, *rhdr, *hs_start, *hs_length, *signed_start;
 537         size_t rlen, hlen, clen;
 538         u8 hash[100], *hpos;
 539
 540         pos = *msgpos;
 541
 542         wpa_printf(MSG_DEBUG, "TLSv1: Send CertificateVerify");
 543         rhdr = pos;
 544         pos += TLS_RECORD_HEADER_LEN;
 545
 546         /* Handshake */
 547         hs_start = pos;
 548         /* HandshakeType msg_type */
 549         *pos++ = TLS_HANDSHAKE_TYPE_CERTIFICATE_VERIFY;
 550         /* uint24 length (to be filled) */
 551         hs_length = pos;
 552         pos += 3;
 553
 554         /*
 555          * RFC 2246: 7.4.3 and 7.4.8:
 556          * Signature signature
 557          *
 558          * RSA:
 559          * digitally-signed struct {
 560          *     opaque md5_hash[16];
 561          *     opaque sha_hash[20];
 562          * };
 563          *
 564          * DSA:
 565          * digitally-signed struct {
 566          *     opaque sha_hash[20];
 567          * };
 568          *
 569          * The hash values are calculated over all handshake messages sent or
 570          * received starting at ClientHello up to, but not including, this
 571          * CertificateVerify message, including the type and length fields of
 572          * the handshake messages.
 573          */
 574
 575         hpos = hash;
 576
 577 #ifdef CONFIG_TLSV12
 578         if (conn->rl.tls_version == TLS_VERSION_1_2) {
 579                 hlen = SHA256_MAC_LEN;
 580                 if (conn->verify.sha256_cert == NULL ||
 581                     crypto_hash_finish(conn->verify.sha256_cert, hpos, &hlen) <
 582                     0) {
 583                         conn->verify.sha256_cert = NULL;
 584                         tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 585                                   TLS_ALERT_INTERNAL_ERROR);
 586                         return -1;
 587                 }
 588                 conn->verify.sha256_cert = NULL;
 589
 590                 /*
 591                  * RFC 3447, A.2.4 RSASSA-PKCS1-v1_5
 592                  *
 593                  * DigestInfo ::= SEQUENCE {
 594                  *   digestAlgorithm DigestAlgorithm,
 595                  *   digest OCTET STRING
 596                  * }
 597                  *
 598                  * SHA-256 OID: sha256WithRSAEncryption ::= {pkcs-1 11}
 599                  *
 600                  * DER encoded DigestInfo for SHA256 per RFC 3447:
 601                  * 30 31 30 0d 06 09 60 86 48 01 65 03 04 02 01 05 00 04 20 ||
 602                  * H
 603                  */
 604                 os_memmove(hash + 19, hash, hlen);
 605                 hlen += 19;
 606                 os_memcpy(hash, "\x30\x31\x30\x0d\x06\x09\x60\x86\x48\x01\x65"
 607                           "\x03\x04\x02\x01\x05\x00\x04\x20", 19);
 608         } else {
 609 #endif /* CONFIG_TLSV12 */
 610
 611         hlen = MD5_MAC_LEN;
 612         if (conn->verify.md5_cert == NULL ||
 613             crypto_hash_finish(conn->verify.md5_cert, hpos, &hlen) < 0) {
 614                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 615                           TLS_ALERT_INTERNAL_ERROR);
 616                 conn->verify.md5_cert = NULL;
 617                 crypto_hash_finish(conn->verify.sha1_cert, NULL, NULL);
 618                 conn->verify.sha1_cert = NULL;
 619                 return -1;
 620         }
 621         hpos += MD5_MAC_LEN;
 622
 623         conn->verify.md5_cert = NULL;
 624         hlen = SHA1_MAC_LEN;
 625         if (conn->verify.sha1_cert == NULL ||
 626             crypto_hash_finish(conn->verify.sha1_cert, hpos, &hlen) < 0) {
 627                 conn->verify.sha1_cert = NULL;
 628                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 629                           TLS_ALERT_INTERNAL_ERROR);
 630                 return -1;
 631         }
 632         conn->verify.sha1_cert = NULL;
 633
 634         hlen += MD5_MAC_LEN;
 635
 636 #ifdef CONFIG_TLSV12
 637         }
 638 #endif /* CONFIG_TLSV12 */
 639
 640         wpa_hexdump(MSG_MSGDUMP, "TLSv1: CertificateVerify hash", hash, hlen);
 641
 642 #ifdef CONFIG_TLSV12
 643         if (conn->rl.tls_version >= TLS_VERSION_1_2) {
 644                 /*
 645                  * RFC 5246, 4.7:
 646                  * TLS v1.2 adds explicit indication of the used signature and
 647                  * hash algorithms.
 648                  *
 649                  * struct {
 650                  *   HashAlgorithm hash;
 651                  *   SignatureAlgorithm signature;
 652                  * } SignatureAndHashAlgorithm;
 653                  */
 654                 *pos++ = TLS_HASH_ALG_SHA256;
 655                 *pos++ = TLS_SIGN_ALG_RSA;
 656         }
 657 #endif /* CONFIG_TLSV12 */
 658
 659         /*
 660          * RFC 2246, 4.7:
 661          * In digital signing, one-way hash functions are used as input for a
 662          * signing algorithm. A digitally-signed element is encoded as an
 663          * opaque vector <0..2^16-1>, where the length is specified by the
 664          * signing algorithm and key.
 665          *
 666          * In RSA signing, a 36-byte structure of two hashes (one SHA and one
 667          * MD5) is signed (encrypted with the private key). It is encoded with
 668          * PKCS #1 block type 0 or type 1 as described in [PKCS1].
 669          */
 670         signed_start = pos; /* length to be filled */
 671         pos += 2;
 672         clen = end - pos;
 673         if (conn->cred == NULL ||
 674             crypto_private_key_sign_pkcs1(conn->cred->key, hash, hlen,
 675                                           pos, &clen) < 0) {
 676                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to sign hash (PKCS #1)");
 677                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 678                           TLS_ALERT_INTERNAL_ERROR);
 679                 return -1;
 680         }
 681         WPA_PUT_BE16(signed_start, clen);
 682
 683         pos += clen;
 684
 685         WPA_PUT_BE24(hs_length, pos - hs_length - 3);
 686
 687         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 688                               rhdr, end - rhdr, hs_start, pos - hs_start,
 689                               &rlen) < 0) {
 690                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate a record");
 691                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 692                           TLS_ALERT_INTERNAL_ERROR);
 693                 return -1;
 694         }
 695         pos = rhdr + rlen;
 696
 697         tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
 698
 699         *msgpos = pos;
 700
 701         return 0;
 702 }
 703
 704
 705 static int tls_write_client_change_cipher_spec(struct tlsv1_client *conn,
 706                                                u8 **msgpos, u8 *end)
 707 {
 708         size_t rlen;
 709         u8 payload[1];
 710
 711         wpa_printf(MSG_DEBUG, "TLSv1: Send ChangeCipherSpec");
 712
 713         payload[0] = TLS_CHANGE_CIPHER_SPEC;
 714
 715         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_CHANGE_CIPHER_SPEC,
 716                               *msgpos, end - *msgpos, payload, sizeof(payload),
 717                               &rlen) < 0) {
 718                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to create a record");
 719                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 720                           TLS_ALERT_INTERNAL_ERROR);
 721                 return -1;
 722         }
 723
 724         if (tlsv1_record_change_write_cipher(&conn->rl) < 0) {
 725                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to set write cipher for "
 726                            "record layer");
 727                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 728                           TLS_ALERT_INTERNAL_ERROR);
 729                 return -1;
 730         }
 731
 732         *msgpos += rlen;
 733
 734         return 0;
 735 }
 736
 737
 738 static int tls_write_client_finished(struct tlsv1_client *conn,
 739                                      u8 **msgpos, u8 *end)
 740 {
 741         u8 *pos, *hs_start;
 742         size_t rlen, hlen;
 743         u8 verify_data[1 + 3 + TLS_VERIFY_DATA_LEN];
 744         u8 hash[MD5_MAC_LEN + SHA1_MAC_LEN];
 745
 746         wpa_printf(MSG_DEBUG, "TLSv1: Send Finished");
 747
 748         /* Encrypted Handshake Message: Finished */
 749
 750 #ifdef CONFIG_TLSV12
 751         if (conn->rl.tls_version >= TLS_VERSION_1_2) {
 752                 hlen = SHA256_MAC_LEN;
 753                 if (conn->verify.sha256_client == NULL ||
 754                     crypto_hash_finish(conn->verify.sha256_client, hash, &hlen)
 755                     < 0) {
 756                         tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 757                                   TLS_ALERT_INTERNAL_ERROR);
 758                         conn->verify.sha256_client = NULL;
 759                         return -1;
 760                 }
 761                 conn->verify.sha256_client = NULL;
 762         } else {
 763 #endif /* CONFIG_TLSV12 */
 764
 765         hlen = MD5_MAC_LEN;
 766         if (conn->verify.md5_client == NULL ||
 767             crypto_hash_finish(conn->verify.md5_client, hash, &hlen) < 0) {
 768                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 769                           TLS_ALERT_INTERNAL_ERROR);
 770                 conn->verify.md5_client = NULL;
 771                 crypto_hash_finish(conn->verify.sha1_client, NULL, NULL);
 772                 conn->verify.sha1_client = NULL;
 773                 return -1;
 774         }
 775         conn->verify.md5_client = NULL;
 776         hlen = SHA1_MAC_LEN;
 777         if (conn->verify.sha1_client == NULL ||
 778             crypto_hash_finish(conn->verify.sha1_client, hash + MD5_MAC_LEN,
 779                                &hlen) < 0) {
 780                 conn->verify.sha1_client = NULL;
 781                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 782                           TLS_ALERT_INTERNAL_ERROR);
 783                 return -1;
 784         }
 785         conn->verify.sha1_client = NULL;
 786         hlen = MD5_MAC_LEN + SHA1_MAC_LEN;
 787
 788 #ifdef CONFIG_TLSV12
 789         }
 790 #endif /* CONFIG_TLSV12 */
 791
 792         if (tls_prf(conn->rl.tls_version,
 793                     conn->master_secret, TLS_MASTER_SECRET_LEN,
 794                     "client finished", hash, hlen,
 795                     verify_data + 1 + 3, TLS_VERIFY_DATA_LEN)) {
 796                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate verify_data");
 797                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 798                           TLS_ALERT_INTERNAL_ERROR);
 799                 return -1;
 800         }
 801         wpa_hexdump_key(MSG_DEBUG, "TLSv1: verify_data (client)",
 802                         verify_data + 1 + 3, TLS_VERIFY_DATA_LEN);
 803
 804         /* Handshake */
 805         pos = hs_start = verify_data;
 806         /* HandshakeType msg_type */
 807         *pos++ = TLS_HANDSHAKE_TYPE_FINISHED;
 808         /* uint24 length */
 809         WPA_PUT_BE24(pos, TLS_VERIFY_DATA_LEN);
 810         pos += 3;
 811         pos += TLS_VERIFY_DATA_LEN; /* verify_data already in place */
 812         tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
 813
 814         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 815                               *msgpos, end - *msgpos, hs_start, pos - hs_start,
 816                               &rlen) < 0) {
 817                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to create a record");
 818                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 819                           TLS_ALERT_INTERNAL_ERROR);
 820                 return -1;
 821         }
 822
 823         *msgpos += rlen;
 824
 825         return 0;
 826 }
 827
 828
 829 static u8 * tls_send_client_key_exchange(struct tlsv1_client *conn,
 830                                          size_t *out_len)
 831 {
 832         u8 *msg, *end, *pos;
 833         size_t msglen;
 834
 835         *out_len = 0;
 836
 837         msglen = 2000;
 838         if (conn->certificate_requested)
 839                 msglen += tls_client_cert_chain_der_len(conn);
 840
 841         msg = os_malloc(msglen);
 842         if (msg == NULL)
 843                 return NULL;
 844
 845         pos = msg;
 846         end = msg + msglen;
 847
 848         if (conn->certificate_requested) {
 849                 if (tls_write_client_certificate(conn, &pos, end) < 0) {
 850                         os_free(msg);
 851                         return NULL;
 852                 }
 853         }
 854
 855         if (tls_write_client_key_exchange(conn, &pos, end) < 0 ||
 856             (conn->certificate_requested && conn->cred && conn->cred->key &&
 857              tls_write_client_certificate_verify(conn, &pos, end) < 0) ||
 858             tls_write_client_change_cipher_spec(conn, &pos, end) < 0 ||
 859             tls_write_client_finished(conn, &pos, end) < 0) {
 860                 os_free(msg);
 861                 return NULL;
 862         }
 863
 864         *out_len = pos - msg;
 865
 866         conn->state = SERVER_CHANGE_CIPHER_SPEC;
 867
 868         return msg;
 869 }
 870
 871
 872 static u8 * tls_send_change_cipher_spec(struct tlsv1_client *conn,
 873                                         size_t *out_len)
 874 {
 875         u8 *msg, *end, *pos;
 876
 877         *out_len = 0;
 878
 879         msg = os_malloc(1000);
 880         if (msg == NULL)
 881                 return NULL;
 882
 883         pos = msg;
 884         end = msg + 1000;
 885
 886         if (tls_write_client_change_cipher_spec(conn, &pos, end) < 0 ||
 887             tls_write_client_finished(conn, &pos, end) < 0) {
 888                 os_free(msg);
 889                 return NULL;
 890         }
 891
 892         *out_len = pos - msg;
 893
 894         wpa_printf(MSG_DEBUG, "TLSv1: Session resumption completed "
 895                    "successfully");
 896         if (!conn->session_resumed && conn->use_session_ticket)
 897                 conn->session_resumed = 1;
 898         conn->state = ESTABLISHED;
 899
 900         return msg;
 901 }
 902
 903
 904 u8 * tlsv1_client_handshake_write(struct tlsv1_client *conn, size_t *out_len,
 905                                   int no_appl_data)
 906 {
 907         switch (conn->state) {
 908         case CLIENT_KEY_EXCHANGE:
 909                 return tls_send_client_key_exchange(conn, out_len);
 910         case CHANGE_CIPHER_SPEC:
 911                 return tls_send_change_cipher_spec(conn, out_len);
 912         case ACK_FINISHED:
 913                 wpa_printf(MSG_DEBUG, "TLSv1: Handshake completed "
 914                            "successfully");
 915                 conn->state = ESTABLISHED;
 916                 *out_len = 0;
 917                 if (no_appl_data) {
 918                         /* Need to return something to get final TLS ACK. */
 919                         return os_malloc(1);
 920                 }
 921                 return NULL;
 922         default:
 923                 wpa_printf(MSG_DEBUG, "TLSv1: Unexpected state %d while "
 924                            "generating reply", conn->state);
 925                 return NULL;
 926         }
 927 }
 928
 929
 930 u8 * tlsv1_client_send_alert(struct tlsv1_client *conn, u8 level,
 931                              u8 description, size_t *out_len)
 932 {
 933         u8 *alert, *pos, *length;
 934
 935         wpa_printf(MSG_DEBUG, "TLSv1: Send Alert(%d:%d)", level, description);
 936         *out_len = 0;
 937
 938         alert = os_malloc(10);
 939         if (alert == NULL)
 940                 return NULL;
 941
 942         pos = alert;
 943
 944         /* TLSPlaintext */
 945         /* ContentType type */
 946         *pos++ = TLS_CONTENT_TYPE_ALERT;
 947         /* ProtocolVersion version */
 948         WPA_PUT_BE16(pos, conn->rl.tls_version ? conn->rl.tls_version :
 949                      TLS_VERSION);
 950         pos += 2;
 951         /* uint16 length (to be filled) */
 952         length = pos;
 953         pos += 2;
 954         /* opaque fragment[TLSPlaintext.length] */
 955
 956         /* Alert */
 957         /* AlertLevel level */
 958         *pos++ = level;
 959         /* AlertDescription description */
 960         *pos++ = description;
 961
 962         WPA_PUT_BE16(length, pos - length - 2);
 963         *out_len = pos - alert;
 964
 965         return alert;
 966 }