Add option to be able to disable nonce in OCSP request

[freeradius.git] / src / main / tls.c

diff --git a/src/main/tls.c b/src/main/tls.c
index 10caec4..c975758 100644 (file)
--- a/src/main/tls.c
+++ b/src/main/tls.c
@@ -60,6 +60,51 @@ static unsigned int  record_plus(record_t *buf, const void *ptr,
 static unsigned int    record_minus(record_t *buf, void *ptr,
                                     unsigned int size);
 
+#ifdef PSK_MAX_IDENTITY_LEN
+static unsigned int psk_server_callback(SSL *ssl, const char *identity,
+                                       unsigned char *psk, int max_psk_len)
+{
+       unsigned int psk_len;
+       fr_tls_server_conf_t *conf;
+
+       conf = (fr_tls_server_conf_t *)SSL_get_ex_data(ssl,
+                                                      FR_TLS_EX_INDEX_CONF);
+       if (!conf) return 0;
+
+       /*
+        *      FIXME: Look up the PSK password based on the identity!
+        */
+       if (strcmp(identity, conf->psk_identity) != 0) {
+               return 0;
+       }
+
+       psk_len = strlen(conf->psk_password);
+       if (psk_len > (2 * max_psk_len)) return 0;
+
+       return fr_hex2bin(conf->psk_password, psk, psk_len);
+}
+
+static unsigned int psk_client_callback(SSL *ssl, UNUSED const char *hint,
+                                       char *identity, unsigned int max_identity_len,
+                                       unsigned char *psk, unsigned int max_psk_len)
+{
+       unsigned int psk_len;
+       fr_tls_server_conf_t *conf;
+
+       conf = (fr_tls_server_conf_t *)SSL_get_ex_data(ssl,
+                                                      FR_TLS_EX_INDEX_CONF);
+       if (!conf) return 0;
+
+       psk_len = strlen(conf->psk_password);
+       if (psk_len > (2 * max_psk_len)) return 0;
+
+       strlcpy(identity, conf->psk_identity, max_identity_len);
+
+       return fr_hex2bin(conf->psk_password, psk, psk_len);
+}
+
+#endif
+
 tls_session_t *tls_new_client_session(fr_tls_server_conf_t *conf, int fd)
 {
        int verify_mode;
@@ -734,6 +779,8 @@ static CONF_PARSER ocsp_config[] = {
          offsetof(fr_tls_server_conf_t, ocsp_override_url), NULL, "no"},
        { "url", PW_TYPE_STRING_PTR,
          offsetof(fr_tls_server_conf_t, ocsp_url), NULL, NULL },
+       { "use_nonce", PW_TYPE_BOOLEAN,
+         offsetof(fr_tls_server_conf_t, ocsp_use_nonce), NULL, "yes"},
        { NULL, -1, 0, NULL, NULL }           /* end the list */
 };
 #endif
@@ -761,6 +808,12 @@ static CONF_PARSER tls_server_config[] = {
          offsetof(fr_tls_server_conf_t, ca_file), NULL, NULL },
        { "private_key_password", PW_TYPE_STRING_PTR,
          offsetof(fr_tls_server_conf_t, private_key_password), NULL, NULL },
+#ifdef PSK_MAX_IDENTITY_LEN
+       { "psk_identity", PW_TYPE_STRING_PTR,
+         offsetof(fr_tls_server_conf_t, psk_identity), NULL, NULL },
+       { "psk_hexphrase", PW_TYPE_STRING_PTR,
+         offsetof(fr_tls_server_conf_t, psk_password), NULL, NULL },
+#endif
        { "dh_file", PW_TYPE_STRING_PTR,
          offsetof(fr_tls_server_conf_t, dh_file), NULL, NULL },
        { "random_file", PW_TYPE_STRING_PTR,
@@ -916,8 +969,6 @@ static int generate_eph_rsa_key(SSL_CTX *ctx)
 
 static void cbtls_remove_session(UNUSED SSL_CTX *ctx, SSL_SESSION *sess)
 {
-       int i;
-
        size_t size;
        char buffer[2 * MAX_SESSION_SIZE + 1];
 
@@ -1025,7 +1076,9 @@ static int ocsp_check(X509_STORE *store, X509 *issuer_cert, X509 *client_cert,
        certid = OCSP_cert_to_id(NULL, client_cert, issuer_cert);
        req = OCSP_REQUEST_new();
        OCSP_request_add0_id(req, certid);
-       OCSP_request_add1_nonce(req, NULL, 8);
+       if(conf->ocsp_use_nonce) {
+               OCSP_request_add1_nonce(req, NULL, 8);
+       }
 
        /*
         * Send OCSP Request and get OCSP Response
@@ -1064,7 +1117,7 @@ static int ocsp_check(X509_STORE *store, X509 *issuer_cert, X509 *client_cert,
                goto ocsp_end;
        }
        bresp = OCSP_response_get1_basic(resp);
-       if(OCSP_check_nonce(req, bresp)!=1) {
+       if(conf->ocsp_use_nonce && OCSP_check_nonce(req, bresp)!=1) {
                radlog(L_ERR, "Error: OCSP response has wrong nonce value");
                goto ocsp_end;
        }
@@ -1586,7 +1639,7 @@ static void sess_free_vps(UNUSED void *parent, void *data_ptr,
  *     - Load the Private key & the certificate
  *     - Set the Context options & Verify options
  */
-static SSL_CTX *init_tls_ctx(fr_tls_server_conf_t *conf)
+static SSL_CTX *init_tls_ctx(fr_tls_server_conf_t *conf, int client)
 {
        const SSL_METHOD *meth;
        SSL_CTX *ctx;
@@ -1674,6 +1727,51 @@ static SSL_CTX *init_tls_ctx(fr_tls_server_conf_t *conf)
                SSL_CTX_set_default_passwd_cb(ctx, cbtls_password);
        }
 
+#ifdef PSK_MAX_IDENTITY_LEN
+       if ((conf->psk_identity && !conf->psk_password) ||
+           (!conf->psk_identity && conf->psk_password) ||
+           (conf->psk_identity && !*conf->psk_identity) ||
+           (conf->psk_password && !*conf->psk_password)) {
+               radlog(L_ERR, "Invalid PSK Configuration: psk_identity or psk_password are empty");
+               return NULL;
+       }
+
+       if (conf->psk_identity) {
+               size_t psk_len, hex_len;
+               char buffer[PSK_MAX_PSK_LEN];
+
+               if (conf->certificate_file ||
+                   conf->private_key_password || conf->private_key_file ||
+                   conf->ca_file || conf->ca_path) {
+                       radlog(L_ERR, "When PSKs are used, No certificate configuration is permitted");
+                       return NULL;
+               }
+
+               if (client) {
+                       SSL_CTX_set_psk_client_callback(ctx,
+                                                       psk_client_callback);
+               } else {
+                       SSL_CTX_set_psk_server_callback(ctx,
+                                                       psk_server_callback);
+               }
+
+               psk_len = strlen(conf->psk_password);
+               if (strlen(conf->psk_password) > (2 * PSK_MAX_PSK_LEN)) {
+                       radlog(L_ERR, "psk_hexphrase is too long (max %d)",
+                              PSK_MAX_PSK_LEN);
+                       return NULL;                        
+               }
+
+               hex_len = fr_hex2bin(conf->psk_password, buffer, psk_len);
+               if (psk_len != (2 * hex_len)) {
+                       radlog(L_ERR, "psk_hexphrase is not all hex");
+                       return NULL;                        
+               }
+
+               goto post_ca;
+       }
+#endif
+
        /*
         *      Load our keys and certificates
         *
@@ -1728,6 +1826,10 @@ load_ca:
                }
        }
 
+#ifdef PSK_MAX_IDENTITY_LEN
+post_ca:
+#endif
+
        /*
         *      Set ctx_options
         */
@@ -1963,7 +2065,7 @@ fr_tls_server_conf_t *tls_server_conf_parse(CONF_SECTION *cs)
        /*
         *      Initialize TLS
         */
-       conf->ctx = init_tls_ctx(conf);
+       conf->ctx = init_tls_ctx(conf, 0);
        if (conf->ctx == NULL) {
                goto error;
        }
@@ -2026,7 +2128,7 @@ fr_tls_server_conf_t *tls_client_conf_parse(CONF_SECTION *cs)
        /*
         *      Initialize TLS
         */
-       conf->ctx = init_tls_ctx(conf);
+       conf->ctx = init_tls_ctx(conf, 1);
        if (conf->ctx == NULL) {
                goto error;
        }