2 * SSL/TLS interface functions for OpenSSL
3 * Copyright (c) 2004-2015, Jouni Malinen <j@w1.fi>
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
11 #ifndef CONFIG_SMARTCARD
12 #ifndef OPENSSL_NO_ENGINE
14 #define OPENSSL_NO_ENGINE
19 #include <openssl/ssl.h>
20 #include <openssl/err.h>
21 #include <openssl/opensslv.h>
22 #include <openssl/pkcs12.h>
23 #include <openssl/x509v3.h>
24 #ifndef OPENSSL_NO_ENGINE
25 #include <openssl/engine.h>
26 #endif /* OPENSSL_NO_ENGINE */
27 #ifndef OPENSSL_NO_DSA
28 #include <openssl/dsa.h>
31 #include <openssl/dh.h>
39 #include "tls_openssl.h"
41 #if !defined(CONFIG_FIPS) && \
42 (defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || \
43 defined(EAP_SERVER_FAST))
44 #define OPENSSL_NEED_EAP_FAST_PRF
47 #if defined(OPENSSL_IS_BORINGSSL)
48 /* stack_index_t is the return type of OpenSSL's sk_XXX_num() functions. */
49 typedef size_t stack_index_t;
51 typedef int stack_index_t;
54 #ifdef SSL_set_tlsext_status_type
55 #ifndef OPENSSL_NO_TLSEXT
57 #include <openssl/ocsp.h>
58 #endif /* OPENSSL_NO_TLSEXT */
59 #endif /* SSL_set_tlsext_status_type */
61 #if (OPENSSL_VERSION_NUMBER < 0x10100000L || \
62 defined(LIBRESSL_VERSION_NUMBER)) && \
63 !defined(BORINGSSL_API_VERSION)
65 * SSL_get_client_random() and SSL_get_server_random() were added in OpenSSL
66 * 1.1.0 and newer BoringSSL revisions. Provide compatibility wrappers for
70 static size_t SSL_get_client_random(const SSL *ssl, unsigned char *out,
73 if (!ssl->s3 || outlen < SSL3_RANDOM_SIZE)
75 os_memcpy(out, ssl->s3->client_random, SSL3_RANDOM_SIZE);
76 return SSL3_RANDOM_SIZE;
80 static size_t SSL_get_server_random(const SSL *ssl, unsigned char *out,
83 if (!ssl->s3 || outlen < SSL3_RANDOM_SIZE)
85 os_memcpy(out, ssl->s3->server_random, SSL3_RANDOM_SIZE);
86 return SSL3_RANDOM_SIZE;
90 #ifdef OPENSSL_NEED_EAP_FAST_PRF
91 static size_t SSL_SESSION_get_master_key(const SSL_SESSION *session,
92 unsigned char *out, size_t outlen)
94 if (!session || session->master_key_length < 0 ||
95 (size_t) session->master_key_length > outlen)
97 if ((size_t) session->master_key_length < outlen)
98 outlen = session->master_key_length;
99 os_memcpy(out, session->master_key, outlen);
102 #endif /* OPENSSL_NEED_EAP_FAST_PRF */
107 #include <openssl/pem.h>
108 #include <keystore/keystore_get.h>
110 static BIO * BIO_from_keystore(const char *key)
113 uint8_t *value = NULL;
114 int length = keystore_get(key, strlen(key), &value);
115 if (length != -1 && (bio = BIO_new(BIO_s_mem())) != NULL)
116 BIO_write(bio, value, length);
122 static int tls_add_ca_from_keystore(X509_STORE *ctx, const char *key_alias)
124 BIO *bio = BIO_from_keystore(key_alias);
125 STACK_OF(X509_INFO) *stack = NULL;
129 stack = PEM_X509_INFO_read_bio(bio, NULL, NULL, NULL);
134 wpa_printf(MSG_WARNING, "TLS: Failed to parse certificate: %s",
139 for (i = 0; i < sk_X509_INFO_num(stack); ++i) {
140 X509_INFO *info = sk_X509_INFO_value(stack, i);
143 X509_STORE_add_cert(ctx, info->x509);
145 X509_STORE_add_crl(ctx, info->crl);
148 sk_X509_INFO_pop_free(stack, X509_INFO_free);
154 static int tls_add_ca_from_keystore_encoded(X509_STORE *ctx,
155 const char *encoded_key_alias)
158 int len = os_strlen(encoded_key_alias);
159 unsigned char *decoded_alias;
162 wpa_printf(MSG_WARNING, "Invalid hex-encoded alias: %s",
167 decoded_alias = os_malloc(len / 2 + 1);
169 if (!hexstr2bin(encoded_key_alias, decoded_alias, len / 2)) {
170 decoded_alias[len / 2] = '\0';
171 rc = tls_add_ca_from_keystore(
172 ctx, (const char *) decoded_alias);
174 os_free(decoded_alias);
182 static int tls_openssl_ref_count = 0;
183 static int tls_ex_idx_session = -1;
186 void (*event_cb)(void *ctx, enum tls_event ev,
187 union tls_event_data *data);
190 char *ocsp_stapling_response;
193 static struct tls_context *tls_global = NULL;
198 unsigned int tls_session_lifetime;
201 struct tls_connection {
202 struct tls_context *context;
205 BIO *ssl_in, *ssl_out;
206 #if defined(ANDROID) || !defined(OPENSSL_NO_ENGINE)
207 ENGINE *engine; /* functional reference to the engine */
208 EVP_PKEY *private_key; /* the private key if using engine */
209 #endif /* OPENSSL_NO_ENGINE */
210 char *subject_match, *altsubject_match, *suffix_match, *domain_match;
211 int read_alerts, write_alerts, failed;
213 tls_session_ticket_cb session_ticket_cb;
214 void *session_ticket_cb_ctx;
216 /* SessionTicket received from OpenSSL hello_extension_cb (server) */
218 size_t session_ticket_len;
220 unsigned int ca_cert_verify:1;
221 unsigned int cert_probe:1;
222 unsigned int server_cert_only:1;
223 unsigned int invalid_hb_used:1;
224 unsigned int success_data:1;
226 u8 srv_cert_hash[32];
232 X509 *peer_issuer_issuer;
234 unsigned char client_random[SSL3_RANDOM_SIZE];
235 unsigned char server_random[SSL3_RANDOM_SIZE];
237 int (*server_cert_cb)(int ok_so_far, X509* cert, void *ca_ctx);
238 void *server_cert_ctx;
242 static struct tls_context * tls_context_new(const struct tls_config *conf)
244 struct tls_context *context = os_zalloc(sizeof(*context));
248 context->event_cb = conf->event_cb;
249 context->cb_ctx = conf->cb_ctx;
250 context->cert_in_cb = conf->cert_in_cb;
256 #ifdef CONFIG_NO_STDOUT_DEBUG
258 static void _tls_show_errors(void)
262 while ((err = ERR_get_error())) {
263 /* Just ignore the errors, since stdout is disabled */
266 #define tls_show_errors(l, f, t) _tls_show_errors()
268 #else /* CONFIG_NO_STDOUT_DEBUG */
270 static void tls_show_errors(int level, const char *func, const char *txt)
274 wpa_printf(level, "OpenSSL: %s - %s %s",
275 func, txt, ERR_error_string(ERR_get_error(), NULL));
277 while ((err = ERR_get_error())) {
278 wpa_printf(MSG_INFO, "OpenSSL: pending error: %s",
279 ERR_error_string(err, NULL));
283 #endif /* CONFIG_NO_STDOUT_DEBUG */
286 #ifdef CONFIG_NATIVE_WINDOWS
288 /* Windows CryptoAPI and access to certificate stores */
289 #include <wincrypt.h>
291 #ifdef __MINGW32_VERSION
293 * MinGW does not yet include all the needed definitions for CryptoAPI, so
294 * define here whatever extra is needed.
296 #define CERT_SYSTEM_STORE_CURRENT_USER (1 << 16)
297 #define CERT_STORE_READONLY_FLAG 0x00008000
298 #define CERT_STORE_OPEN_EXISTING_FLAG 0x00004000
300 #endif /* __MINGW32_VERSION */
303 struct cryptoapi_rsa_data {
304 const CERT_CONTEXT *cert;
305 HCRYPTPROV crypt_prov;
307 BOOL free_crypt_prov;
311 static void cryptoapi_error(const char *msg)
313 wpa_printf(MSG_INFO, "CryptoAPI: %s; err=%u",
314 msg, (unsigned int) GetLastError());
318 static int cryptoapi_rsa_pub_enc(int flen, const unsigned char *from,
319 unsigned char *to, RSA *rsa, int padding)
321 wpa_printf(MSG_DEBUG, "%s - not implemented", __func__);
326 static int cryptoapi_rsa_pub_dec(int flen, const unsigned char *from,
327 unsigned char *to, RSA *rsa, int padding)
329 wpa_printf(MSG_DEBUG, "%s - not implemented", __func__);
334 static int cryptoapi_rsa_priv_enc(int flen, const unsigned char *from,
335 unsigned char *to, RSA *rsa, int padding)
337 struct cryptoapi_rsa_data *priv =
338 (struct cryptoapi_rsa_data *) rsa->meth->app_data;
340 DWORD hash_size, len, i;
341 unsigned char *buf = NULL;
345 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,
346 ERR_R_PASSED_NULL_PARAMETER);
350 if (padding != RSA_PKCS1_PADDING) {
351 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,
352 RSA_R_UNKNOWN_PADDING_TYPE);
356 if (flen != 16 /* MD5 */ + 20 /* SHA-1 */) {
357 wpa_printf(MSG_INFO, "%s - only MD5-SHA1 hash supported",
359 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,
360 RSA_R_INVALID_MESSAGE_LENGTH);
364 if (!CryptCreateHash(priv->crypt_prov, CALG_SSL3_SHAMD5, 0, 0, &hash))
366 cryptoapi_error("CryptCreateHash failed");
370 len = sizeof(hash_size);
371 if (!CryptGetHashParam(hash, HP_HASHSIZE, (BYTE *) &hash_size, &len,
373 cryptoapi_error("CryptGetHashParam failed");
377 if ((int) hash_size != flen) {
378 wpa_printf(MSG_INFO, "CryptoAPI: Invalid hash size (%u != %d)",
379 (unsigned) hash_size, flen);
380 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,
381 RSA_R_INVALID_MESSAGE_LENGTH);
384 if (!CryptSetHashParam(hash, HP_HASHVAL, (BYTE * ) from, 0)) {
385 cryptoapi_error("CryptSetHashParam failed");
390 buf = os_malloc(len);
392 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, ERR_R_MALLOC_FAILURE);
396 if (!CryptSignHash(hash, priv->key_spec, NULL, 0, buf, &len)) {
397 cryptoapi_error("CryptSignHash failed");
401 for (i = 0; i < len; i++)
402 to[i] = buf[len - i - 1];
407 CryptDestroyHash(hash);
413 static int cryptoapi_rsa_priv_dec(int flen, const unsigned char *from,
414 unsigned char *to, RSA *rsa, int padding)
416 wpa_printf(MSG_DEBUG, "%s - not implemented", __func__);
421 static void cryptoapi_free_data(struct cryptoapi_rsa_data *priv)
425 if (priv->crypt_prov && priv->free_crypt_prov)
426 CryptReleaseContext(priv->crypt_prov, 0);
428 CertFreeCertificateContext(priv->cert);
433 static int cryptoapi_finish(RSA *rsa)
435 cryptoapi_free_data((struct cryptoapi_rsa_data *) rsa->meth->app_data);
436 os_free((void *) rsa->meth);
442 static const CERT_CONTEXT * cryptoapi_find_cert(const char *name, DWORD store)
445 const CERT_CONTEXT *ret = NULL;
447 cs = CertOpenStore((LPCSTR) CERT_STORE_PROV_SYSTEM, 0, 0,
448 store | CERT_STORE_OPEN_EXISTING_FLAG |
449 CERT_STORE_READONLY_FLAG, L"MY");
451 cryptoapi_error("Failed to open 'My system store'");
455 if (strncmp(name, "cert://", 7) == 0) {
456 unsigned short wbuf[255];
457 MultiByteToWideChar(CP_ACP, 0, name + 7, -1, wbuf, 255);
458 ret = CertFindCertificateInStore(cs, X509_ASN_ENCODING |
460 0, CERT_FIND_SUBJECT_STR,
462 } else if (strncmp(name, "hash://", 7) == 0) {
463 CRYPT_HASH_BLOB blob;
465 const char *hash = name + 7;
468 len = os_strlen(hash) / 2;
469 buf = os_malloc(len);
470 if (buf && hexstr2bin(hash, buf, len) == 0) {
473 ret = CertFindCertificateInStore(cs,
482 CertCloseStore(cs, 0);
488 static int tls_cryptoapi_cert(SSL *ssl, const char *name)
491 RSA *rsa = NULL, *pub_rsa;
492 struct cryptoapi_rsa_data *priv;
493 RSA_METHOD *rsa_meth;
496 (strncmp(name, "cert://", 7) != 0 &&
497 strncmp(name, "hash://", 7) != 0))
500 priv = os_zalloc(sizeof(*priv));
501 rsa_meth = os_zalloc(sizeof(*rsa_meth));
502 if (priv == NULL || rsa_meth == NULL) {
503 wpa_printf(MSG_WARNING, "CryptoAPI: Failed to allocate memory "
504 "for CryptoAPI RSA method");
510 priv->cert = cryptoapi_find_cert(name, CERT_SYSTEM_STORE_CURRENT_USER);
511 if (priv->cert == NULL) {
512 priv->cert = cryptoapi_find_cert(
513 name, CERT_SYSTEM_STORE_LOCAL_MACHINE);
515 if (priv->cert == NULL) {
516 wpa_printf(MSG_INFO, "CryptoAPI: Could not find certificate "
521 cert = d2i_X509(NULL,
522 (const unsigned char **) &priv->cert->pbCertEncoded,
523 priv->cert->cbCertEncoded);
525 wpa_printf(MSG_INFO, "CryptoAPI: Could not process X509 DER "
530 if (!CryptAcquireCertificatePrivateKey(priv->cert,
531 CRYPT_ACQUIRE_COMPARE_KEY_FLAG,
532 NULL, &priv->crypt_prov,
534 &priv->free_crypt_prov)) {
535 cryptoapi_error("Failed to acquire a private key for the "
540 rsa_meth->name = "Microsoft CryptoAPI RSA Method";
541 rsa_meth->rsa_pub_enc = cryptoapi_rsa_pub_enc;
542 rsa_meth->rsa_pub_dec = cryptoapi_rsa_pub_dec;
543 rsa_meth->rsa_priv_enc = cryptoapi_rsa_priv_enc;
544 rsa_meth->rsa_priv_dec = cryptoapi_rsa_priv_dec;
545 rsa_meth->finish = cryptoapi_finish;
546 rsa_meth->flags = RSA_METHOD_FLAG_NO_CHECK;
547 rsa_meth->app_data = (char *) priv;
551 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,
552 ERR_R_MALLOC_FAILURE);
556 if (!SSL_use_certificate(ssl, cert)) {
561 pub_rsa = cert->cert_info->key->pkey->pkey.rsa;
565 rsa->n = BN_dup(pub_rsa->n);
566 rsa->e = BN_dup(pub_rsa->e);
567 if (!RSA_set_method(rsa, rsa_meth))
570 if (!SSL_use_RSAPrivateKey(ssl, rsa))
583 cryptoapi_free_data(priv);
589 static int tls_cryptoapi_ca_cert(SSL_CTX *ssl_ctx, SSL *ssl, const char *name)
592 PCCERT_CONTEXT ctx = NULL;
600 if (name == NULL || strncmp(name, "cert_store://", 13) != 0)
605 wstore = os_malloc((os_strlen(store) + 1) * sizeof(WCHAR));
608 wsprintf(wstore, L"%S", store);
609 cs = CertOpenSystemStore(0, wstore);
612 cs = CertOpenSystemStore(0, store);
615 wpa_printf(MSG_DEBUG, "%s: failed to open system cert store "
616 "'%s': error=%d", __func__, store,
617 (int) GetLastError());
621 while ((ctx = CertEnumCertificatesInStore(cs, ctx))) {
622 cert = d2i_X509(NULL,
623 (const unsigned char **) &ctx->pbCertEncoded,
626 wpa_printf(MSG_INFO, "CryptoAPI: Could not process "
627 "X509 DER encoding for CA cert");
631 X509_NAME_oneline(X509_get_subject_name(cert), buf,
633 wpa_printf(MSG_DEBUG, "OpenSSL: Loaded CA certificate for "
634 "system certificate store: subject='%s'", buf);
636 if (!X509_STORE_add_cert(SSL_CTX_get_cert_store(ssl_ctx),
638 tls_show_errors(MSG_WARNING, __func__,
639 "Failed to add ca_cert to OpenSSL "
640 "certificate store");
646 if (!CertCloseStore(cs, 0)) {
647 wpa_printf(MSG_DEBUG, "%s: failed to close system cert store "
648 "'%s': error=%d", __func__, name + 13,
649 (int) GetLastError());
656 #else /* CONFIG_NATIVE_WINDOWS */
658 static int tls_cryptoapi_cert(SSL *ssl, const char *name)
663 #endif /* CONFIG_NATIVE_WINDOWS */
666 static void ssl_info_cb(const SSL *ssl, int where, int ret)
671 wpa_printf(MSG_DEBUG, "SSL: (where=0x%x ret=0x%x)", where, ret);
672 w = where & ~SSL_ST_MASK;
673 if (w & SSL_ST_CONNECT)
675 else if (w & SSL_ST_ACCEPT)
680 if (where & SSL_CB_LOOP) {
681 wpa_printf(MSG_DEBUG, "SSL: %s:%s",
682 str, SSL_state_string_long(ssl));
683 } else if (where & SSL_CB_ALERT) {
684 struct tls_connection *conn = SSL_get_app_data((SSL *) ssl);
685 wpa_printf(MSG_INFO, "SSL: SSL3 alert: %s:%s:%s",
686 where & SSL_CB_READ ?
687 "read (remote end reported an error)" :
688 "write (local SSL3 detected an error)",
689 SSL_alert_type_string_long(ret),
690 SSL_alert_desc_string_long(ret));
691 if ((ret >> 8) == SSL3_AL_FATAL) {
692 if (where & SSL_CB_READ)
695 conn->write_alerts++;
697 if (conn->context->event_cb != NULL) {
698 union tls_event_data ev;
699 struct tls_context *context = conn->context;
700 os_memset(&ev, 0, sizeof(ev));
701 ev.alert.is_local = !(where & SSL_CB_READ);
702 ev.alert.type = SSL_alert_type_string_long(ret);
703 ev.alert.description = SSL_alert_desc_string_long(ret);
704 context->event_cb(context->cb_ctx, TLS_ALERT, &ev);
706 } else if (where & SSL_CB_EXIT && ret <= 0) {
707 wpa_printf(MSG_DEBUG, "SSL: %s:%s in %s",
708 str, ret == 0 ? "failed" : "error",
709 SSL_state_string_long(ssl));
714 #ifndef OPENSSL_NO_ENGINE
716 * tls_engine_load_dynamic_generic - load any openssl engine
717 * @pre: an array of commands and values that load an engine initialized
718 * in the engine specific function
719 * @post: an array of commands and values that initialize an already loaded
720 * engine (or %NULL if not required)
721 * @id: the engine id of the engine to load (only required if post is not %NULL
723 * This function is a generic function that loads any openssl engine.
725 * Returns: 0 on success, -1 on failure
727 static int tls_engine_load_dynamic_generic(const char *pre[],
728 const char *post[], const char *id)
731 const char *dynamic_id = "dynamic";
733 engine = ENGINE_by_id(id);
735 wpa_printf(MSG_DEBUG, "ENGINE: engine '%s' is already "
738 * If it was auto-loaded by ENGINE_by_id() we might still
739 * need to tell it which PKCS#11 module to use in legacy
740 * (non-p11-kit) environments. Do so now; even if it was
741 * properly initialised before, setting it again will be
748 engine = ENGINE_by_id(dynamic_id);
749 if (engine == NULL) {
750 wpa_printf(MSG_INFO, "ENGINE: Can't find engine %s [%s]",
752 ERR_error_string(ERR_get_error(), NULL));
756 /* Perform the pre commands. This will load the engine. */
757 while (pre && pre[0]) {
758 wpa_printf(MSG_DEBUG, "ENGINE: '%s' '%s'", pre[0], pre[1]);
759 if (ENGINE_ctrl_cmd_string(engine, pre[0], pre[1], 0) == 0) {
760 wpa_printf(MSG_INFO, "ENGINE: ctrl cmd_string failed: "
761 "%s %s [%s]", pre[0], pre[1],
762 ERR_error_string(ERR_get_error(), NULL));
770 * Free the reference to the "dynamic" engine. The loaded engine can
771 * now be looked up using ENGINE_by_id().
775 engine = ENGINE_by_id(id);
776 if (engine == NULL) {
777 wpa_printf(MSG_INFO, "ENGINE: Can't find engine %s [%s]",
778 id, ERR_error_string(ERR_get_error(), NULL));
782 while (post && post[0]) {
783 wpa_printf(MSG_DEBUG, "ENGINE: '%s' '%s'", post[0], post[1]);
784 if (ENGINE_ctrl_cmd_string(engine, post[0], post[1], 0) == 0) {
785 wpa_printf(MSG_DEBUG, "ENGINE: ctrl cmd_string failed:"
786 " %s %s [%s]", post[0], post[1],
787 ERR_error_string(ERR_get_error(), NULL));
788 ENGINE_remove(engine);
801 * tls_engine_load_dynamic_pkcs11 - load the pkcs11 engine provided by opensc
802 * @pkcs11_so_path: pksc11_so_path from the configuration
803 * @pcks11_module_path: pkcs11_module_path from the configuration
805 static int tls_engine_load_dynamic_pkcs11(const char *pkcs11_so_path,
806 const char *pkcs11_module_path)
808 char *engine_id = "pkcs11";
809 const char *pre_cmd[] = {
810 "SO_PATH", NULL /* pkcs11_so_path */,
811 "ID", NULL /* engine_id */,
813 /* "NO_VCHECK", "1", */
817 const char *post_cmd[] = {
818 "MODULE_PATH", NULL /* pkcs11_module_path */,
825 pre_cmd[1] = pkcs11_so_path;
826 pre_cmd[3] = engine_id;
827 if (pkcs11_module_path)
828 post_cmd[1] = pkcs11_module_path;
832 wpa_printf(MSG_DEBUG, "ENGINE: Loading pkcs11 Engine from %s",
835 return tls_engine_load_dynamic_generic(pre_cmd, post_cmd, engine_id);
840 * tls_engine_load_dynamic_opensc - load the opensc engine provided by opensc
841 * @opensc_so_path: opensc_so_path from the configuration
843 static int tls_engine_load_dynamic_opensc(const char *opensc_so_path)
845 char *engine_id = "opensc";
846 const char *pre_cmd[] = {
847 "SO_PATH", NULL /* opensc_so_path */,
848 "ID", NULL /* engine_id */,
857 pre_cmd[1] = opensc_so_path;
858 pre_cmd[3] = engine_id;
860 wpa_printf(MSG_DEBUG, "ENGINE: Loading OpenSC Engine from %s",
863 return tls_engine_load_dynamic_generic(pre_cmd, NULL, engine_id);
865 #endif /* OPENSSL_NO_ENGINE */
868 static void remove_session_cb(SSL_CTX *ctx, SSL_SESSION *sess)
872 if (tls_ex_idx_session < 0)
874 buf = SSL_SESSION_get_ex_data(sess, tls_ex_idx_session);
877 wpa_printf(MSG_DEBUG,
878 "OpenSSL: Free application session data %p (sess %p)",
882 SSL_SESSION_set_ex_data(sess, tls_ex_idx_session, NULL);
886 void * tls_init(const struct tls_config *conf)
888 struct tls_data *data;
890 struct tls_context *context;
893 if (tls_openssl_ref_count == 0) {
894 tls_global = context = tls_context_new(conf);
899 if (conf && conf->fips_mode) {
900 static int fips_enabled = 0;
902 if (!fips_enabled && !FIPS_mode_set(1)) {
903 wpa_printf(MSG_ERROR, "Failed to enable FIPS "
905 ERR_load_crypto_strings();
906 ERR_print_errors_fp(stderr);
911 wpa_printf(MSG_INFO, "Running in FIPS mode");
915 #else /* OPENSSL_FIPS */
916 if (conf && conf->fips_mode) {
917 wpa_printf(MSG_ERROR, "FIPS mode requested, but not "
923 #endif /* OPENSSL_FIPS */
924 #endif /* CONFIG_FIPS */
925 #if OPENSSL_VERSION_NUMBER < 0x10100000L
926 SSL_load_error_strings();
928 #ifndef OPENSSL_NO_SHA256
929 EVP_add_digest(EVP_sha256());
930 #endif /* OPENSSL_NO_SHA256 */
931 /* TODO: if /dev/urandom is available, PRNG is seeded
932 * automatically. If this is not the case, random data should
936 #ifndef OPENSSL_NO_RC2
938 * 40-bit RC2 is commonly used in PKCS#12 files, so enable it.
939 * This is enabled by PKCS12_PBE_add() in OpenSSL 0.9.8
940 * versions, but it looks like OpenSSL 1.0.0 does not do that
943 EVP_add_cipher(EVP_rc2_40_cbc());
944 #endif /* OPENSSL_NO_RC2 */
946 #endif /* PKCS12_FUNCS */
949 context = tls_context_new(conf);
953 tls_openssl_ref_count++;
955 data = os_zalloc(sizeof(*data));
957 ssl = SSL_CTX_new(SSLv23_method());
961 tls_openssl_ref_count--;
962 if (context != tls_global)
964 if (tls_openssl_ref_count == 0) {
973 data->tls_session_lifetime = conf->tls_session_lifetime;
975 SSL_CTX_set_options(ssl, SSL_OP_NO_SSLv2);
976 SSL_CTX_set_options(ssl, SSL_OP_NO_SSLv3);
978 SSL_CTX_set_info_callback(ssl, ssl_info_cb);
979 SSL_CTX_set_app_data(ssl, context);
980 if (data->tls_session_lifetime > 0) {
981 SSL_CTX_set_quiet_shutdown(ssl, 1);
983 * Set default context here. In practice, this will be replaced
984 * by the per-EAP method context in tls_connection_set_verify().
986 SSL_CTX_set_session_id_context(ssl, (u8 *) "hostapd", 7);
987 SSL_CTX_set_session_cache_mode(ssl, SSL_SESS_CACHE_SERVER);
988 SSL_CTX_set_timeout(ssl, data->tls_session_lifetime);
989 SSL_CTX_sess_set_remove_cb(ssl, remove_session_cb);
991 SSL_CTX_set_session_cache_mode(ssl, SSL_SESS_CACHE_OFF);
994 if (tls_ex_idx_session < 0) {
995 tls_ex_idx_session = SSL_SESSION_get_ex_new_index(
996 0, NULL, NULL, NULL, NULL);
997 if (tls_ex_idx_session < 0) {
1003 #ifndef OPENSSL_NO_ENGINE
1004 wpa_printf(MSG_DEBUG, "ENGINE: Loading dynamic engine");
1005 ERR_load_ENGINE_strings();
1006 ENGINE_load_dynamic();
1009 (conf->opensc_engine_path || conf->pkcs11_engine_path ||
1010 conf->pkcs11_module_path)) {
1011 if (tls_engine_load_dynamic_opensc(conf->opensc_engine_path) ||
1012 tls_engine_load_dynamic_pkcs11(conf->pkcs11_engine_path,
1013 conf->pkcs11_module_path)) {
1018 #endif /* OPENSSL_NO_ENGINE */
1020 if (conf && conf->openssl_ciphers)
1021 ciphers = conf->openssl_ciphers;
1023 ciphers = "DEFAULT:!EXP:!LOW";
1024 if (SSL_CTX_set_cipher_list(ssl, ciphers) != 1) {
1025 wpa_printf(MSG_ERROR,
1026 "OpenSSL: Failed to set cipher string '%s'",
1036 void tls_deinit(void *ssl_ctx)
1038 struct tls_data *data = ssl_ctx;
1039 SSL_CTX *ssl = data->ssl;
1040 struct tls_context *context = SSL_CTX_get_app_data(ssl);
1041 if (context != tls_global)
1043 if (data->tls_session_lifetime > 0)
1044 SSL_CTX_flush_sessions(ssl, 0);
1047 tls_openssl_ref_count--;
1048 if (tls_openssl_ref_count == 0) {
1049 #if OPENSSL_VERSION_NUMBER < 0x10100000L
1050 // The next four lines, and two more just below, deal with de-initializing
1051 // global state in the OpenSSL engine. We (Moonshot) don't want that, since
1052 // we use OpenSSL elsewhere in our apps (i.e., not only via hostap / libeap.)
1053 //// #ifndef OPENSSL_NO_ENGINE
1054 //// ENGINE_cleanup();
1055 //// #endif /* OPENSSL_NO_ENGINE */
1056 //// CRYPTO_cleanup_all_ex_data();
1057 ERR_remove_thread_state(NULL);
1058 //// ERR_free_strings();
1060 #endif /* < 1.1.0 */
1061 os_free(tls_global->ocsp_stapling_response);
1062 tls_global->ocsp_stapling_response = NULL;
1063 os_free(tls_global);
1071 #ifndef OPENSSL_NO_ENGINE
1073 /* Cryptoki return values */
1074 #define CKR_PIN_INCORRECT 0x000000a0
1075 #define CKR_PIN_INVALID 0x000000a1
1076 #define CKR_PIN_LEN_RANGE 0x000000a2
1079 #define ERR_LIB_PKCS11 ERR_LIB_USER
1081 static int tls_is_pin_error(unsigned int err)
1083 return ERR_GET_LIB(err) == ERR_LIB_PKCS11 &&
1084 (ERR_GET_REASON(err) == CKR_PIN_INCORRECT ||
1085 ERR_GET_REASON(err) == CKR_PIN_INVALID ||
1086 ERR_GET_REASON(err) == CKR_PIN_LEN_RANGE);
1089 #endif /* OPENSSL_NO_ENGINE */
1093 /* EVP_PKEY_from_keystore comes from system/security/keystore-engine. */
1094 EVP_PKEY * EVP_PKEY_from_keystore(const char *key_id);
1095 #endif /* ANDROID */
1097 static int tls_engine_init(struct tls_connection *conn, const char *engine_id,
1098 const char *pin, const char *key_id,
1099 const char *cert_id, const char *ca_cert_id)
1101 #if defined(ANDROID) && defined(OPENSSL_IS_BORINGSSL)
1102 #if !defined(OPENSSL_NO_ENGINE)
1103 #error "This code depends on OPENSSL_NO_ENGINE being defined by BoringSSL."
1106 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
1107 conn->engine = NULL;
1108 conn->private_key = EVP_PKEY_from_keystore(key_id);
1109 if (!conn->private_key) {
1110 wpa_printf(MSG_ERROR,
1111 "ENGINE: cannot load private key with id '%s' [%s]",
1113 ERR_error_string(ERR_get_error(), NULL));
1114 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
1116 #endif /* ANDROID && OPENSSL_IS_BORINGSSL */
1118 #ifndef OPENSSL_NO_ENGINE
1120 if (engine_id == NULL) {
1121 wpa_printf(MSG_ERROR, "ENGINE: Engine ID not set");
1127 ENGINE_load_dynamic();
1129 conn->engine = ENGINE_by_id(engine_id);
1130 if (!conn->engine) {
1131 wpa_printf(MSG_ERROR, "ENGINE: engine %s not available [%s]",
1132 engine_id, ERR_error_string(ERR_get_error(), NULL));
1135 if (ENGINE_init(conn->engine) != 1) {
1136 wpa_printf(MSG_ERROR, "ENGINE: engine init failed "
1137 "(engine: %s) [%s]", engine_id,
1138 ERR_error_string(ERR_get_error(), NULL));
1141 wpa_printf(MSG_DEBUG, "ENGINE: engine initialized");
1144 if (pin && ENGINE_ctrl_cmd_string(conn->engine, "PIN", pin, 0) == 0) {
1145 wpa_printf(MSG_ERROR, "ENGINE: cannot set pin [%s]",
1146 ERR_error_string(ERR_get_error(), NULL));
1152 * Ensure that the ENGINE does not attempt to use the OpenSSL
1153 * UI system to obtain a PIN, if we didn't provide one.
1156 const void *password;
1157 const char *prompt_info;
1158 } key_cb = { "", NULL };
1160 /* load private key first in-case PIN is required for cert */
1161 conn->private_key = ENGINE_load_private_key(conn->engine,
1164 if (!conn->private_key) {
1165 unsigned long err = ERR_get_error();
1167 wpa_printf(MSG_ERROR,
1168 "ENGINE: cannot load private key with id '%s' [%s]",
1170 ERR_error_string(err, NULL));
1171 if (tls_is_pin_error(err))
1172 ret = TLS_SET_PARAMS_ENGINE_PRV_BAD_PIN;
1174 ret = TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
1179 /* handle a certificate and/or CA certificate */
1180 if (cert_id || ca_cert_id) {
1181 const char *cmd_name = "LOAD_CERT_CTRL";
1183 /* test if the engine supports a LOAD_CERT_CTRL */
1184 if (!ENGINE_ctrl(conn->engine, ENGINE_CTRL_GET_CMD_FROM_NAME,
1185 0, (void *)cmd_name, NULL)) {
1186 wpa_printf(MSG_ERROR, "ENGINE: engine does not support"
1187 " loading certificates");
1188 ret = TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
1197 ENGINE_free(conn->engine);
1198 conn->engine = NULL;
1201 if (conn->private_key) {
1202 EVP_PKEY_free(conn->private_key);
1203 conn->private_key = NULL;
1207 #else /* OPENSSL_NO_ENGINE */
1209 #endif /* OPENSSL_NO_ENGINE */
1213 static void tls_engine_deinit(struct tls_connection *conn)
1215 #if defined(ANDROID) || !defined(OPENSSL_NO_ENGINE)
1216 wpa_printf(MSG_DEBUG, "ENGINE: engine deinit");
1217 if (conn->private_key) {
1218 EVP_PKEY_free(conn->private_key);
1219 conn->private_key = NULL;
1222 #if !defined(OPENSSL_IS_BORINGSSL)
1223 ENGINE_finish(conn->engine);
1224 #endif /* !OPENSSL_IS_BORINGSSL */
1225 conn->engine = NULL;
1227 #endif /* ANDROID || !OPENSSL_NO_ENGINE */
1231 int tls_get_errors(void *ssl_ctx)
1236 while ((err = ERR_get_error())) {
1237 wpa_printf(MSG_INFO, "TLS - SSL error: %s",
1238 ERR_error_string(err, NULL));
1246 static const char * openssl_content_type(int content_type)
1248 switch (content_type) {
1250 return "change cipher spec";
1256 return "application data";
1260 return "TLS header info"; /* pseudo content type */
1267 static const char * openssl_handshake_type(int content_type, const u8 *buf,
1270 if (content_type != 22 || !buf || len == 0)
1274 return "hello request";
1276 return "client hello";
1278 return "server hello";
1280 return "new session ticket";
1282 return "certificate";
1284 return "server key exchange";
1286 return "certificate request";
1288 return "server hello done";
1290 return "certificate verify";
1292 return "client key exchange";
1296 return "certificate url";
1298 return "certificate status";
1305 static void tls_msg_cb(int write_p, int version, int content_type,
1306 const void *buf, size_t len, SSL *ssl, void *arg)
1308 struct tls_connection *conn = arg;
1309 const u8 *pos = buf;
1312 wpa_printf(MSG_DEBUG,
1313 "OpenSSL: session ver=0x%x content_type=%d",
1314 version, content_type);
1315 wpa_hexdump_key(MSG_MSGDUMP, "OpenSSL: Data", buf, len);
1319 wpa_printf(MSG_DEBUG, "OpenSSL: %s ver=0x%x content_type=%d (%s/%s)",
1320 write_p ? "TX" : "RX", version, content_type,
1321 openssl_content_type(content_type),
1322 openssl_handshake_type(content_type, buf, len));
1323 wpa_hexdump_key(MSG_MSGDUMP, "OpenSSL: Message", buf, len);
1324 if (content_type == 24 && len >= 3 && pos[0] == 1) {
1325 size_t payload_len = WPA_GET_BE16(pos + 1);
1326 if (payload_len + 3 > len) {
1327 wpa_printf(MSG_ERROR, "OpenSSL: Heartbeat attack detected");
1328 conn->invalid_hb_used = 1;
1334 struct tls_connection * tls_connection_init(void *ssl_ctx)
1336 struct tls_data *data = ssl_ctx;
1337 SSL_CTX *ssl = data->ssl;
1338 struct tls_connection *conn;
1340 struct tls_context *context = SSL_CTX_get_app_data(ssl);
1342 conn = os_zalloc(sizeof(*conn));
1345 conn->ssl_ctx = ssl;
1346 conn->ssl = SSL_new(ssl);
1347 if (conn->ssl == NULL) {
1348 tls_show_errors(MSG_INFO, __func__,
1349 "Failed to initialize new SSL connection");
1354 conn->context = context;
1355 SSL_set_app_data(conn->ssl, conn);
1356 SSL_set_msg_callback(conn->ssl, tls_msg_cb);
1357 SSL_set_msg_callback_arg(conn->ssl, conn);
1358 options = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
1359 SSL_OP_SINGLE_DH_USE;
1360 #ifdef SSL_OP_NO_COMPRESSION
1361 options |= SSL_OP_NO_COMPRESSION;
1362 #endif /* SSL_OP_NO_COMPRESSION */
1363 SSL_set_options(conn->ssl, options);
1365 conn->ssl_in = BIO_new(BIO_s_mem());
1366 if (!conn->ssl_in) {
1367 tls_show_errors(MSG_INFO, __func__,
1368 "Failed to create a new BIO for ssl_in");
1369 SSL_free(conn->ssl);
1374 conn->ssl_out = BIO_new(BIO_s_mem());
1375 if (!conn->ssl_out) {
1376 tls_show_errors(MSG_INFO, __func__,
1377 "Failed to create a new BIO for ssl_out");
1378 SSL_free(conn->ssl);
1379 BIO_free(conn->ssl_in);
1384 SSL_set_bio(conn->ssl, conn->ssl_in, conn->ssl_out);
1390 void tls_connection_deinit(void *ssl_ctx, struct tls_connection *conn)
1394 if (conn->success_data) {
1396 * Make sure ssl_clear_bad_session() does not remove this
1399 SSL_set_quiet_shutdown(conn->ssl, 1);
1400 SSL_shutdown(conn->ssl);
1402 SSL_free(conn->ssl);
1403 tls_engine_deinit(conn);
1404 os_free(conn->subject_match);
1405 os_free(conn->altsubject_match);
1406 os_free(conn->suffix_match);
1407 os_free(conn->domain_match);
1408 os_free(conn->session_ticket);
1413 int tls_connection_established(void *ssl_ctx, struct tls_connection *conn)
1415 return conn ? SSL_is_init_finished(conn->ssl) : 0;
1419 int tls_connection_shutdown(void *ssl_ctx, struct tls_connection *conn)
1424 /* Shutdown previous TLS connection without notifying the peer
1425 * because the connection was already terminated in practice
1426 * and "close notify" shutdown alert would confuse AS. */
1427 SSL_set_quiet_shutdown(conn->ssl, 1);
1428 SSL_shutdown(conn->ssl);
1429 return SSL_clear(conn->ssl) == 1 ? 0 : -1;
1433 static int tls_match_altsubject_component(X509 *cert, int type,
1434 const char *value, size_t len)
1441 ext = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL);
1443 for (i = 0; ext && i < sk_GENERAL_NAME_num(ext); i++) {
1444 gen = sk_GENERAL_NAME_value(ext, i);
1445 if (gen->type != type)
1447 if (os_strlen((char *) gen->d.ia5->data) == len &&
1448 os_memcmp(value, gen->d.ia5->data, len) == 0)
1452 sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free);
1458 static int tls_match_altsubject(X509 *cert, const char *match)
1461 const char *pos, *end;
1466 if (os_strncmp(pos, "EMAIL:", 6) == 0) {
1469 } else if (os_strncmp(pos, "DNS:", 4) == 0) {
1472 } else if (os_strncmp(pos, "URI:", 4) == 0) {
1476 wpa_printf(MSG_INFO, "TLS: Invalid altSubjectName "
1480 end = os_strchr(pos, ';');
1482 if (os_strncmp(end + 1, "EMAIL:", 6) == 0 ||
1483 os_strncmp(end + 1, "DNS:", 4) == 0 ||
1484 os_strncmp(end + 1, "URI:", 4) == 0)
1486 end = os_strchr(end + 1, ';');
1491 len = os_strlen(pos);
1492 if (tls_match_altsubject_component(cert, type, pos, len) > 0)
1501 #ifndef CONFIG_NATIVE_WINDOWS
1502 static int domain_suffix_match(const u8 *val, size_t len, const char *match,
1505 size_t i, match_len;
1507 /* Check for embedded nuls that could mess up suffix matching */
1508 for (i = 0; i < len; i++) {
1509 if (val[i] == '\0') {
1510 wpa_printf(MSG_DEBUG, "TLS: Embedded null in a string - reject");
1515 match_len = os_strlen(match);
1516 if (match_len > len || (full && match_len != len))
1519 if (os_strncasecmp((const char *) val + len - match_len, match,
1521 return 0; /* no match */
1523 if (match_len == len)
1524 return 1; /* exact match */
1526 if (val[len - match_len - 1] == '.')
1527 return 1; /* full label match completes suffix match */
1529 wpa_printf(MSG_DEBUG, "TLS: Reject due to incomplete label match");
1532 #endif /* CONFIG_NATIVE_WINDOWS */
1535 static int tls_match_suffix(X509 *cert, const char *match, int full)
1537 #ifdef CONFIG_NATIVE_WINDOWS
1538 /* wincrypt.h has conflicting X509_NAME definition */
1540 #else /* CONFIG_NATIVE_WINDOWS */
1548 wpa_printf(MSG_DEBUG, "TLS: Match domain against %s%s",
1549 full ? "": "suffix ", match);
1551 ext = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL);
1553 for (j = 0; ext && j < sk_GENERAL_NAME_num(ext); j++) {
1554 gen = sk_GENERAL_NAME_value(ext, j);
1555 if (gen->type != GEN_DNS)
1558 wpa_hexdump_ascii(MSG_DEBUG, "TLS: Certificate dNSName",
1559 gen->d.dNSName->data,
1560 gen->d.dNSName->length);
1561 if (domain_suffix_match(gen->d.dNSName->data,
1562 gen->d.dNSName->length, match, full) ==
1564 wpa_printf(MSG_DEBUG, "TLS: %s in dNSName found",
1565 full ? "Match" : "Suffix match");
1566 sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free);
1570 sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free);
1573 wpa_printf(MSG_DEBUG, "TLS: None of the dNSName(s) matched");
1577 name = X509_get_subject_name(cert);
1583 i = X509_NAME_get_index_by_NID(name, NID_commonName, i);
1586 e = X509_NAME_get_entry(name, i);
1589 cn = X509_NAME_ENTRY_get_data(e);
1592 wpa_hexdump_ascii(MSG_DEBUG, "TLS: Certificate commonName",
1593 cn->data, cn->length);
1594 if (domain_suffix_match(cn->data, cn->length, match, full) == 1)
1596 wpa_printf(MSG_DEBUG, "TLS: %s in commonName found",
1597 full ? "Match" : "Suffix match");
1602 wpa_printf(MSG_DEBUG, "TLS: No CommonName %smatch found",
1603 full ? "": "suffix ");
1605 #endif /* CONFIG_NATIVE_WINDOWS */
1609 static enum tls_fail_reason openssl_tls_fail_reason(int err)
1612 case X509_V_ERR_CERT_REVOKED:
1613 return TLS_FAIL_REVOKED;
1614 case X509_V_ERR_CERT_NOT_YET_VALID:
1615 case X509_V_ERR_CRL_NOT_YET_VALID:
1616 return TLS_FAIL_NOT_YET_VALID;
1617 case X509_V_ERR_CERT_HAS_EXPIRED:
1618 case X509_V_ERR_CRL_HAS_EXPIRED:
1619 return TLS_FAIL_EXPIRED;
1620 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
1621 case X509_V_ERR_UNABLE_TO_GET_CRL:
1622 case X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER:
1623 case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
1624 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
1625 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
1626 case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
1627 case X509_V_ERR_CERT_CHAIN_TOO_LONG:
1628 case X509_V_ERR_PATH_LENGTH_EXCEEDED:
1629 case X509_V_ERR_INVALID_CA:
1630 return TLS_FAIL_UNTRUSTED;
1631 case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
1632 case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
1633 case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY:
1634 case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
1635 case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
1636 case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD:
1637 case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:
1638 case X509_V_ERR_CERT_UNTRUSTED:
1639 case X509_V_ERR_CERT_REJECTED:
1640 return TLS_FAIL_BAD_CERTIFICATE;
1642 return TLS_FAIL_UNSPECIFIED;
1647 static struct wpabuf * get_x509_cert(X509 *cert)
1652 int cert_len = i2d_X509(cert, NULL);
1656 buf = wpabuf_alloc(cert_len);
1660 tmp = wpabuf_put(buf, cert_len);
1661 i2d_X509(cert, &tmp);
1666 static void openssl_tls_fail_event(struct tls_connection *conn,
1667 X509 *err_cert, int err, int depth,
1668 const char *subject, const char *err_str,
1669 enum tls_fail_reason reason)
1671 union tls_event_data ev;
1672 struct wpabuf *cert = NULL;
1673 struct tls_context *context = conn->context;
1675 if (context->event_cb == NULL)
1678 cert = get_x509_cert(err_cert);
1679 os_memset(&ev, 0, sizeof(ev));
1680 ev.cert_fail.reason = reason != TLS_FAIL_UNSPECIFIED ?
1681 reason : openssl_tls_fail_reason(err);
1682 ev.cert_fail.depth = depth;
1683 ev.cert_fail.subject = subject;
1684 ev.cert_fail.reason_txt = err_str;
1685 ev.cert_fail.cert = cert;
1686 context->event_cb(context->cb_ctx, TLS_CERT_CHAIN_FAILURE, &ev);
1691 static void openssl_tls_cert_event(struct tls_connection *conn,
1692 X509 *err_cert, int depth,
1693 const char *subject)
1695 struct wpabuf *cert = NULL;
1696 union tls_event_data ev;
1697 struct tls_context *context = conn->context;
1698 char *altsubject[TLS_MAX_ALT_SUBJECT];
1699 int alt, num_altsubject = 0;
1703 #ifdef CONFIG_SHA256
1705 #endif /* CONFIG_SHA256 */
1707 if (context->event_cb == NULL)
1710 os_memset(&ev, 0, sizeof(ev));
1711 if (conn->cert_probe || (conn->flags & TLS_CONN_EXT_CERT_CHECK) ||
1712 context->cert_in_cb) {
1713 cert = get_x509_cert(err_cert);
1714 ev.peer_cert.cert = cert;
1716 #ifdef CONFIG_SHA256
1720 addr[0] = wpabuf_head(cert);
1721 len[0] = wpabuf_len(cert);
1722 if (sha256_vector(1, addr, len, hash) == 0) {
1723 ev.peer_cert.hash = hash;
1724 ev.peer_cert.hash_len = sizeof(hash);
1727 #endif /* CONFIG_SHA256 */
1728 ev.peer_cert.depth = depth;
1729 ev.peer_cert.subject = subject;
1731 ext = X509_get_ext_d2i(err_cert, NID_subject_alt_name, NULL, NULL);
1732 for (i = 0; ext && i < sk_GENERAL_NAME_num(ext); i++) {
1735 if (num_altsubject == TLS_MAX_ALT_SUBJECT)
1737 gen = sk_GENERAL_NAME_value(ext, i);
1738 if (gen->type != GEN_EMAIL &&
1739 gen->type != GEN_DNS &&
1740 gen->type != GEN_URI)
1743 pos = os_malloc(10 + gen->d.ia5->length + 1);
1746 altsubject[num_altsubject++] = pos;
1748 switch (gen->type) {
1750 os_memcpy(pos, "EMAIL:", 6);
1754 os_memcpy(pos, "DNS:", 4);
1758 os_memcpy(pos, "URI:", 4);
1763 os_memcpy(pos, gen->d.ia5->data, gen->d.ia5->length);
1764 pos += gen->d.ia5->length;
1767 sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free);
1769 for (alt = 0; alt < num_altsubject; alt++)
1770 ev.peer_cert.altsubject[alt] = altsubject[alt];
1771 ev.peer_cert.num_altsubject = num_altsubject;
1773 context->event_cb(context->cb_ctx, TLS_PEER_CERTIFICATE, &ev);
1775 for (alt = 0; alt < num_altsubject; alt++)
1776 os_free(altsubject[alt]);
1780 static int tls_verify_cb(int preverify_ok, X509_STORE_CTX *x509_ctx)
1786 struct tls_connection *conn;
1787 struct tls_context *context;
1788 char *match, *altmatch, *suffix_match, *domain_match;
1789 const char *err_str;
1791 err_cert = X509_STORE_CTX_get_current_cert(x509_ctx);
1795 err = X509_STORE_CTX_get_error(x509_ctx);
1796 depth = X509_STORE_CTX_get_error_depth(x509_ctx);
1797 ssl = X509_STORE_CTX_get_ex_data(x509_ctx,
1798 SSL_get_ex_data_X509_STORE_CTX_idx());
1799 X509_NAME_oneline(X509_get_subject_name(err_cert), buf, sizeof(buf));
1801 conn = SSL_get_app_data(ssl);
1806 conn->peer_cert = err_cert;
1807 else if (depth == 1)
1808 conn->peer_issuer = err_cert;
1809 else if (depth == 2)
1810 conn->peer_issuer_issuer = err_cert;
1812 /* wpa_printf(MSG_DEBUG, "TLS: tls_verify_cb(enter) - preverify_ok=%d "
1813 * "err=%d (%s) ca_cert_verify=%d depth=%d buf='%s' server_cert_cb=%p server_cert_only=%d",
1814 * preverify_ok, err, X509_verify_cert_error_string(err),
1815 * conn->ca_cert_verify, depth, buf, conn->server_cert_cb, conn->server_cert_only);
1818 context = conn->context;
1819 match = conn->subject_match;
1820 altmatch = conn->altsubject_match;
1821 suffix_match = conn->suffix_match;
1822 domain_match = conn->domain_match;
1824 if (!preverify_ok && !conn->ca_cert_verify)
1827 if (!preverify_ok && depth > 0 && conn->server_cert_only) {
1828 /* wpa_printf(MSG_DEBUG, "TLS: tls_verify_cb: allowing cert because depth > 0 && conn->server_cert_only\n"); */
1831 if (!preverify_ok && (conn->flags & TLS_CONN_DISABLE_TIME_CHECKS) &&
1832 (err == X509_V_ERR_CERT_HAS_EXPIRED ||
1833 err == X509_V_ERR_CERT_NOT_YET_VALID)) {
1834 wpa_printf(MSG_DEBUG, "OpenSSL: Ignore certificate validity "
1839 err_str = X509_verify_cert_error_string(err);
1841 #ifdef CONFIG_SHA256
1843 if (conn->server_cert_cb) {
1844 preverify_ok = conn->server_cert_cb(preverify_ok, err_cert, conn->server_cert_ctx);
1845 wpa_printf(MSG_DEBUG, "TLS: tls_verify_cb: server_cert_cb returned %d", preverify_ok);
1847 if (conn->server_cert_only) {
1849 * Do not require preverify_ok so we can explicity allow otherwise
1850 * invalid pinned server certificates.
1852 struct wpabuf *cert;
1853 cert = get_x509_cert(err_cert);
1855 wpa_printf(MSG_DEBUG, "OpenSSL: Could not fetch "
1856 "server certificate data");
1862 addr[0] = wpabuf_head(cert);
1863 len[0] = wpabuf_len(cert);
1864 if (sha256_vector(1, addr, len, hash) < 0 ||
1865 os_memcmp(conn->srv_cert_hash, hash, 32) != 0) {
1866 err_str = "Server certificate mismatch";
1867 err = X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN;
1869 } else if (!preverify_ok) {
1871 * Certificate matches pinned certificate, allow
1872 * regardless of other problems.
1874 wpa_printf(MSG_DEBUG,
1875 "tls_verify_cb: OpenSSL: Ignore validation issues for a pinned server certificate");
1882 #endif /* CONFIG_SHA256 */
1884 if (!preverify_ok) {
1885 wpa_printf(MSG_WARNING, "TLS: Certificate verification failed,"
1886 " error %d (%s) depth %d for '%s'", err, err_str,
1888 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
1889 err_str, TLS_FAIL_UNSPECIFIED);
1890 return preverify_ok;
1893 wpa_printf(MSG_DEBUG, "TLS: tls_verify_cb - preverify_ok=%d "
1894 "err=%d (%s) ca_cert_verify=%d depth=%d buf='%s'",
1895 preverify_ok, err, err_str,
1896 conn->ca_cert_verify, depth, buf);
1897 if (depth == 0 && match && os_strstr(buf, match) == NULL) {
1898 wpa_printf(MSG_WARNING, "TLS: Subject '%s' did not "
1899 "match with '%s'", buf, match);
1901 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
1903 TLS_FAIL_SUBJECT_MISMATCH);
1904 } else if (depth == 0 && altmatch &&
1905 !tls_match_altsubject(err_cert, altmatch)) {
1906 wpa_printf(MSG_WARNING, "TLS: altSubjectName match "
1907 "'%s' not found", altmatch);
1909 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
1910 "AltSubject mismatch",
1911 TLS_FAIL_ALTSUBJECT_MISMATCH);
1912 } else if (depth == 0 && suffix_match &&
1913 !tls_match_suffix(err_cert, suffix_match, 0)) {
1914 wpa_printf(MSG_WARNING, "TLS: Domain suffix match '%s' not found",
1917 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
1918 "Domain suffix mismatch",
1919 TLS_FAIL_DOMAIN_SUFFIX_MISMATCH);
1920 } else if (depth == 0 && domain_match &&
1921 !tls_match_suffix(err_cert, domain_match, 1)) {
1922 wpa_printf(MSG_WARNING, "TLS: Domain match '%s' not found",
1925 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
1927 TLS_FAIL_DOMAIN_MISMATCH);
1929 openssl_tls_cert_event(conn, err_cert, depth, buf);
1931 if (conn->cert_probe && preverify_ok && depth == 0) {
1932 wpa_printf(MSG_DEBUG, "OpenSSL: Reject server certificate "
1933 "on probe-only run");
1935 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
1936 "Server certificate chain probe",
1937 TLS_FAIL_SERVER_CHAIN_PROBE);
1940 #ifdef OPENSSL_IS_BORINGSSL
1941 if (depth == 0 && (conn->flags & TLS_CONN_REQUEST_OCSP) &&
1943 enum ocsp_result res;
1945 res = check_ocsp_resp(conn->ssl_ctx, conn->ssl, err_cert,
1947 conn->peer_issuer_issuer);
1948 if (res == OCSP_REVOKED) {
1950 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
1951 "certificate revoked",
1953 if (err == X509_V_OK)
1954 X509_STORE_CTX_set_error(
1955 x509_ctx, X509_V_ERR_CERT_REVOKED);
1956 } else if (res != OCSP_GOOD &&
1957 (conn->flags & TLS_CONN_REQUIRE_OCSP)) {
1959 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
1960 "bad certificate status response",
1961 TLS_FAIL_UNSPECIFIED);
1964 #endif /* OPENSSL_IS_BORINGSSL */
1966 if (depth == 0 && preverify_ok && context->event_cb != NULL)
1967 context->event_cb(context->cb_ctx,
1968 TLS_CERT_CHAIN_SUCCESS, NULL);
1970 return preverify_ok;
1974 #ifndef OPENSSL_NO_STDIO
1975 static int tls_load_ca_der(struct tls_data *data, const char *ca_cert)
1977 SSL_CTX *ssl_ctx = data->ssl;
1978 X509_LOOKUP *lookup;
1981 lookup = X509_STORE_add_lookup(SSL_CTX_get_cert_store(ssl_ctx),
1982 X509_LOOKUP_file());
1983 if (lookup == NULL) {
1984 tls_show_errors(MSG_WARNING, __func__,
1985 "Failed add lookup for X509 store");
1989 if (!X509_LOOKUP_load_file(lookup, ca_cert, X509_FILETYPE_ASN1)) {
1990 unsigned long err = ERR_peek_error();
1991 tls_show_errors(MSG_WARNING, __func__,
1992 "Failed load CA in DER format");
1993 if (ERR_GET_LIB(err) == ERR_LIB_X509 &&
1994 ERR_GET_REASON(err) == X509_R_CERT_ALREADY_IN_HASH_TABLE) {
1995 wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring "
1996 "cert already in hash table error",
2004 #endif /* OPENSSL_NO_STDIO */
2007 static int tls_connection_ca_cert(struct tls_data *data,
2008 struct tls_connection *conn,
2009 const char *ca_cert, const u8 *ca_cert_blob,
2010 size_t ca_cert_blob_len, const char *ca_path,
2011 int (*server_cert_cb)(int ok_so_far, X509* cert, void *ca_ctx),
2012 void *server_cert_ctx)
2014 SSL_CTX *ssl_ctx = data->ssl;
2018 * Remove previously configured trusted CA certificates before adding
2021 store = X509_STORE_new();
2022 if (store == NULL) {
2023 wpa_printf(MSG_DEBUG, "OpenSSL: %s - failed to allocate new "
2024 "certificate store", __func__);
2027 SSL_CTX_set_cert_store(ssl_ctx, store);
2029 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);
2030 conn->ca_cert_verify = 1;
2031 conn->server_cert_cb = server_cert_cb;
2032 conn->server_cert_ctx = server_cert_ctx;
2034 if (ca_cert && os_strncmp(ca_cert, "probe://", 8) == 0) {
2035 wpa_printf(MSG_DEBUG, "OpenSSL: Probe for server certificate "
2037 conn->cert_probe = 1;
2038 conn->ca_cert_verify = 0;
2042 if (ca_cert && os_strncmp(ca_cert, "hash://", 7) == 0) {
2043 #ifdef CONFIG_SHA256
2044 const char *pos = ca_cert + 7;
2045 if (os_strncmp(pos, "server/sha256/", 14) != 0) {
2046 wpa_printf(MSG_DEBUG, "OpenSSL: Unsupported ca_cert "
2047 "hash value '%s'", ca_cert);
2051 if (os_strlen(pos) != 32 * 2) {
2052 wpa_printf(MSG_DEBUG, "OpenSSL: Unexpected SHA256 "
2053 "hash length in ca_cert '%s'", ca_cert);
2056 if (hexstr2bin(pos, conn->srv_cert_hash, 32) < 0) {
2057 wpa_printf(MSG_DEBUG, "OpenSSL: Invalid SHA256 hash "
2058 "value in ca_cert '%s'", ca_cert);
2061 conn->server_cert_only = 1;
2062 wpa_printf(MSG_DEBUG, "OpenSSL: Checking only server "
2063 "certificate match");
2065 #else /* CONFIG_SHA256 */
2066 wpa_printf(MSG_INFO, "No SHA256 included in the build - "
2067 "cannot validate server certificate hash");
2069 #endif /* CONFIG_SHA256 */
2073 X509 *cert = d2i_X509(NULL,
2074 (const unsigned char **) &ca_cert_blob,
2077 tls_show_errors(MSG_WARNING, __func__,
2078 "Failed to parse ca_cert_blob");
2082 if (!X509_STORE_add_cert(SSL_CTX_get_cert_store(ssl_ctx),
2084 unsigned long err = ERR_peek_error();
2085 tls_show_errors(MSG_WARNING, __func__,
2086 "Failed to add ca_cert_blob to "
2087 "certificate store");
2088 if (ERR_GET_LIB(err) == ERR_LIB_X509 &&
2089 ERR_GET_REASON(err) ==
2090 X509_R_CERT_ALREADY_IN_HASH_TABLE) {
2091 wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring "
2092 "cert already in hash table error",
2100 wpa_printf(MSG_DEBUG, "OpenSSL: %s - added ca_cert_blob "
2101 "to certificate store", __func__);
2107 if (ca_cert && os_strncmp("keystore://", ca_cert, 11) == 0) {
2108 if (tls_add_ca_from_keystore(SSL_CTX_get_cert_store(ssl_ctx),
2111 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);
2115 /* Multiple aliases separated by space */
2116 if (ca_cert && os_strncmp("keystores://", ca_cert, 12) == 0) {
2117 char *aliases = os_strdup(&ca_cert[12]);
2118 const char *delim = " ";
2125 alias = strtok_r(aliases, delim, &savedptr);
2126 for (; alias; alias = strtok_r(NULL, delim, &savedptr)) {
2127 if (tls_add_ca_from_keystore_encoded(
2128 SSL_CTX_get_cert_store(ssl_ctx), alias)) {
2129 wpa_printf(MSG_WARNING,
2130 "OpenSSL: %s - Failed to add ca_cert %s from keystore",
2140 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);
2143 #endif /* ANDROID */
2145 #ifdef CONFIG_NATIVE_WINDOWS
2146 if (ca_cert && tls_cryptoapi_ca_cert(ssl_ctx, conn->ssl, ca_cert) ==
2148 wpa_printf(MSG_DEBUG, "OpenSSL: Added CA certificates from "
2149 "system certificate store");
2152 #endif /* CONFIG_NATIVE_WINDOWS */
2154 if (ca_cert || ca_path) {
2155 #ifndef OPENSSL_NO_STDIO
2156 if (SSL_CTX_load_verify_locations(ssl_ctx, ca_cert, ca_path) !=
2158 tls_show_errors(MSG_WARNING, __func__,
2159 "Failed to load root certificates");
2161 tls_load_ca_der(data, ca_cert) == 0) {
2162 wpa_printf(MSG_DEBUG, "OpenSSL: %s - loaded "
2163 "DER format CA certificate",
2168 wpa_printf(MSG_DEBUG, "TLS: Trusted root "
2169 "certificate(s) loaded");
2170 tls_get_errors(data);
2172 #else /* OPENSSL_NO_STDIO */
2173 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO",
2176 #endif /* OPENSSL_NO_STDIO */
2178 /* No ca_cert configured - do not try to verify server
2180 conn->ca_cert_verify = 0;
2187 static int tls_global_ca_cert(struct tls_data *data, const char *ca_cert)
2189 SSL_CTX *ssl_ctx = data->ssl;
2192 if (SSL_CTX_load_verify_locations(ssl_ctx, ca_cert, NULL) != 1)
2194 tls_show_errors(MSG_WARNING, __func__,
2195 "Failed to load root certificates");
2199 wpa_printf(MSG_DEBUG, "TLS: Trusted root "
2200 "certificate(s) loaded");
2202 #ifndef OPENSSL_NO_STDIO
2203 /* Add the same CAs to the client certificate requests */
2204 SSL_CTX_set_client_CA_list(ssl_ctx,
2205 SSL_load_client_CA_file(ca_cert));
2206 #endif /* OPENSSL_NO_STDIO */
2213 int tls_global_set_verify(void *ssl_ctx, int check_crl)
2218 struct tls_data *data = ssl_ctx;
2219 X509_STORE *cs = SSL_CTX_get_cert_store(data->ssl);
2221 tls_show_errors(MSG_INFO, __func__, "Failed to get "
2222 "certificate store when enabling "
2226 flags = X509_V_FLAG_CRL_CHECK;
2228 flags |= X509_V_FLAG_CRL_CHECK_ALL;
2229 X509_STORE_set_flags(cs, flags);
2235 static int tls_connection_set_subject_match(struct tls_connection *conn,
2236 const char *subject_match,
2237 const char *altsubject_match,
2238 const char *suffix_match,
2239 const char *domain_match)
2241 os_free(conn->subject_match);
2242 conn->subject_match = NULL;
2243 if (subject_match) {
2244 conn->subject_match = os_strdup(subject_match);
2245 if (conn->subject_match == NULL)
2249 os_free(conn->altsubject_match);
2250 conn->altsubject_match = NULL;
2251 if (altsubject_match) {
2252 conn->altsubject_match = os_strdup(altsubject_match);
2253 if (conn->altsubject_match == NULL)
2257 os_free(conn->suffix_match);
2258 conn->suffix_match = NULL;
2260 conn->suffix_match = os_strdup(suffix_match);
2261 if (conn->suffix_match == NULL)
2265 os_free(conn->domain_match);
2266 conn->domain_match = NULL;
2268 conn->domain_match = os_strdup(domain_match);
2269 if (conn->domain_match == NULL)
2277 static void tls_set_conn_flags(SSL *ssl, unsigned int flags)
2279 #ifdef SSL_OP_NO_TICKET
2280 if (flags & TLS_CONN_DISABLE_SESSION_TICKET)
2281 SSL_set_options(ssl, SSL_OP_NO_TICKET);
2282 #ifdef SSL_clear_options
2284 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
2285 #endif /* SSL_clear_options */
2286 #endif /* SSL_OP_NO_TICKET */
2288 #ifdef SSL_OP_NO_TLSv1
2289 if (flags & TLS_CONN_DISABLE_TLSv1_0)
2290 SSL_set_options(ssl, SSL_OP_NO_TLSv1);
2292 SSL_clear_options(ssl, SSL_OP_NO_TLSv1);
2293 #endif /* SSL_OP_NO_TLSv1 */
2294 #ifdef SSL_OP_NO_TLSv1_1
2295 if (flags & TLS_CONN_DISABLE_TLSv1_1)
2296 SSL_set_options(ssl, SSL_OP_NO_TLSv1_1);
2298 SSL_clear_options(ssl, SSL_OP_NO_TLSv1_1);
2299 #endif /* SSL_OP_NO_TLSv1_1 */
2300 #ifdef SSL_OP_NO_TLSv1_2
2301 if (flags & TLS_CONN_DISABLE_TLSv1_2)
2302 SSL_set_options(ssl, SSL_OP_NO_TLSv1_2);
2304 SSL_clear_options(ssl, SSL_OP_NO_TLSv1_2);
2305 #endif /* SSL_OP_NO_TLSv1_2 */
2309 int tls_connection_set_verify(void *ssl_ctx, struct tls_connection *conn,
2310 int verify_peer, unsigned int flags,
2311 const u8 *session_ctx, size_t session_ctx_len)
2313 static int counter = 0;
2314 struct tls_data *data = ssl_ctx;
2320 conn->ca_cert_verify = 1;
2321 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER |
2322 SSL_VERIFY_FAIL_IF_NO_PEER_CERT |
2323 SSL_VERIFY_CLIENT_ONCE, tls_verify_cb);
2325 conn->ca_cert_verify = 0;
2326 SSL_set_verify(conn->ssl, SSL_VERIFY_NONE, NULL);
2329 tls_set_conn_flags(conn->ssl, flags);
2330 conn->flags = flags;
2332 SSL_set_accept_state(conn->ssl);
2334 if (data->tls_session_lifetime == 0) {
2336 * Set session id context to a unique value to make sure
2337 * session resumption cannot be used either through session
2338 * caching or TLS ticket extension.
2341 SSL_set_session_id_context(conn->ssl,
2342 (const unsigned char *) &counter,
2344 } else if (session_ctx) {
2345 SSL_set_session_id_context(conn->ssl, session_ctx,
2353 static int tls_connection_client_cert(struct tls_connection *conn,
2354 const char *client_cert,
2355 const u8 *client_cert_blob,
2356 size_t client_cert_blob_len)
2358 if (client_cert == NULL && client_cert_blob == NULL)
2362 #if OPENSSL_VERSION_NUMBER < 0x10002000L
2364 * Clear previously set extra chain certificates, if any, from PKCS#12
2365 * processing in tls_parse_pkcs12() to allow OpenSSL to build a new
2368 SSL_CTX_clear_extra_chain_certs(conn->ssl_ctx);
2369 #endif /* OPENSSL_VERSION_NUMBER < 0x10002000L */
2370 #endif /* PKCS12_FUNCS */
2372 if (client_cert_blob &&
2373 SSL_use_certificate_ASN1(conn->ssl, (u8 *) client_cert_blob,
2374 client_cert_blob_len) == 1) {
2375 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_ASN1 --> "
2378 } else if (client_cert_blob) {
2379 tls_show_errors(MSG_DEBUG, __func__,
2380 "SSL_use_certificate_ASN1 failed");
2383 if (client_cert == NULL)
2387 if (os_strncmp("keystore://", client_cert, 11) == 0) {
2388 BIO *bio = BIO_from_keystore(&client_cert[11]);
2392 x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
2396 if (SSL_use_certificate(conn->ssl, x509) == 1)
2402 #endif /* ANDROID */
2404 #ifndef OPENSSL_NO_STDIO
2405 if (SSL_use_certificate_file(conn->ssl, client_cert,
2406 SSL_FILETYPE_ASN1) == 1) {
2407 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_file (DER)"
2412 if (SSL_use_certificate_file(conn->ssl, client_cert,
2413 SSL_FILETYPE_PEM) == 1) {
2415 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_file (PEM)"
2420 tls_show_errors(MSG_DEBUG, __func__,
2421 "SSL_use_certificate_file failed");
2422 #else /* OPENSSL_NO_STDIO */
2423 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", __func__);
2424 #endif /* OPENSSL_NO_STDIO */
2430 static int tls_global_client_cert(struct tls_data *data,
2431 const char *client_cert)
2433 #ifndef OPENSSL_NO_STDIO
2434 SSL_CTX *ssl_ctx = data->ssl;
2436 if (client_cert == NULL)
2439 if (SSL_CTX_use_certificate_file(ssl_ctx, client_cert,
2440 SSL_FILETYPE_ASN1) != 1 &&
2441 SSL_CTX_use_certificate_chain_file(ssl_ctx, client_cert) != 1 &&
2442 SSL_CTX_use_certificate_file(ssl_ctx, client_cert,
2443 SSL_FILETYPE_PEM) != 1) {
2444 tls_show_errors(MSG_INFO, __func__,
2445 "Failed to load client certificate");
2449 #else /* OPENSSL_NO_STDIO */
2450 if (client_cert == NULL)
2452 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", __func__);
2454 #endif /* OPENSSL_NO_STDIO */
2458 static int tls_passwd_cb(char *buf, int size, int rwflag, void *password)
2460 if (password == NULL) {
2463 os_strlcpy(buf, (char *) password, size);
2464 return os_strlen(buf);
2469 static int tls_parse_pkcs12(struct tls_data *data, SSL *ssl, PKCS12 *p12,
2474 STACK_OF(X509) *certs;
2483 if (!PKCS12_parse(p12, passwd, &pkey, &cert, &certs)) {
2484 tls_show_errors(MSG_DEBUG, __func__,
2485 "Failed to parse PKCS12 file");
2489 wpa_printf(MSG_DEBUG, "TLS: Successfully parsed PKCS12 data");
2492 X509_NAME_oneline(X509_get_subject_name(cert), buf,
2494 wpa_printf(MSG_DEBUG, "TLS: Got certificate from PKCS12: "
2495 "subject='%s'", buf);
2497 if (SSL_use_certificate(ssl, cert) != 1)
2500 if (SSL_CTX_use_certificate(data->ssl, cert) != 1)
2507 wpa_printf(MSG_DEBUG, "TLS: Got private key from PKCS12");
2509 if (SSL_use_PrivateKey(ssl, pkey) != 1)
2512 if (SSL_CTX_use_PrivateKey(data->ssl, pkey) != 1)
2515 EVP_PKEY_free(pkey);
2519 #if OPENSSL_VERSION_NUMBER >= 0x10002000L && !defined(LIBRESSL_VERSION_NUMBER)
2521 SSL_clear_chain_certs(ssl);
2523 SSL_CTX_clear_chain_certs(data->ssl);
2524 while ((cert = sk_X509_pop(certs)) != NULL) {
2525 X509_NAME_oneline(X509_get_subject_name(cert), buf,
2527 wpa_printf(MSG_DEBUG, "TLS: additional certificate"
2528 " from PKCS12: subject='%s'", buf);
2529 if ((ssl && SSL_add1_chain_cert(ssl, cert) != 1) ||
2530 (!ssl && SSL_CTX_add1_chain_cert(data->ssl,
2532 tls_show_errors(MSG_DEBUG, __func__,
2533 "Failed to add additional certificate");
2541 /* Try to continue anyway */
2543 sk_X509_pop_free(certs, X509_free);
2544 #ifndef OPENSSL_IS_BORINGSSL
2546 res = SSL_build_cert_chain(
2548 SSL_BUILD_CHAIN_FLAG_CHECK |
2549 SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR);
2551 res = SSL_CTX_build_cert_chain(
2553 SSL_BUILD_CHAIN_FLAG_CHECK |
2554 SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR);
2556 tls_show_errors(MSG_DEBUG, __func__,
2557 "Failed to build certificate chain");
2558 } else if (res == 2) {
2559 wpa_printf(MSG_DEBUG,
2560 "TLS: Ignore certificate chain verification error when building chain with PKCS#12 extra certificates");
2562 #endif /* OPENSSL_IS_BORINGSSL */
2564 * Try to continue regardless of result since it is possible for
2565 * the extra certificates not to be required.
2568 #else /* OPENSSL_VERSION_NUMBER >= 0x10002000L */
2569 SSL_CTX_clear_extra_chain_certs(data->ssl);
2570 while ((cert = sk_X509_pop(certs)) != NULL) {
2571 X509_NAME_oneline(X509_get_subject_name(cert), buf,
2573 wpa_printf(MSG_DEBUG, "TLS: additional certificate"
2574 " from PKCS12: subject='%s'", buf);
2576 * There is no SSL equivalent for the chain cert - so
2577 * always add it to the context...
2579 if (SSL_CTX_add_extra_chain_cert(data->ssl, cert) != 1)
2586 sk_X509_pop_free(certs, X509_free);
2587 #endif /* OPENSSL_VERSION_NUMBER >= 0x10002000L */
2593 tls_get_errors(data);
2597 #endif /* PKCS12_FUNCS */
2600 static int tls_read_pkcs12(struct tls_data *data, SSL *ssl,
2601 const char *private_key, const char *passwd)
2607 f = fopen(private_key, "rb");
2611 p12 = d2i_PKCS12_fp(f, NULL);
2615 tls_show_errors(MSG_INFO, __func__,
2616 "Failed to use PKCS#12 file");
2620 return tls_parse_pkcs12(data, ssl, p12, passwd);
2622 #else /* PKCS12_FUNCS */
2623 wpa_printf(MSG_INFO, "TLS: PKCS12 support disabled - cannot read "
2626 #endif /* PKCS12_FUNCS */
2630 static int tls_read_pkcs12_blob(struct tls_data *data, SSL *ssl,
2631 const u8 *blob, size_t len, const char *passwd)
2636 p12 = d2i_PKCS12(NULL, (const unsigned char **) &blob, len);
2638 tls_show_errors(MSG_INFO, __func__,
2639 "Failed to use PKCS#12 blob");
2643 return tls_parse_pkcs12(data, ssl, p12, passwd);
2645 #else /* PKCS12_FUNCS */
2646 wpa_printf(MSG_INFO, "TLS: PKCS12 support disabled - cannot parse "
2649 #endif /* PKCS12_FUNCS */
2653 #ifndef OPENSSL_NO_ENGINE
2654 static int tls_engine_get_cert(struct tls_connection *conn,
2655 const char *cert_id,
2658 /* this runs after the private key is loaded so no PIN is required */
2660 const char *cert_id;
2663 params.cert_id = cert_id;
2666 if (!ENGINE_ctrl_cmd(conn->engine, "LOAD_CERT_CTRL",
2667 0, ¶ms, NULL, 1)) {
2668 unsigned long err = ERR_get_error();
2670 wpa_printf(MSG_ERROR, "ENGINE: cannot load client cert with id"
2671 " '%s' [%s]", cert_id,
2672 ERR_error_string(err, NULL));
2673 if (tls_is_pin_error(err))
2674 return TLS_SET_PARAMS_ENGINE_PRV_BAD_PIN;
2675 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
2678 wpa_printf(MSG_ERROR, "ENGINE: did not properly cert with id"
2680 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
2682 *cert = params.cert;
2685 #endif /* OPENSSL_NO_ENGINE */
2688 static int tls_connection_engine_client_cert(struct tls_connection *conn,
2689 const char *cert_id)
2691 #ifndef OPENSSL_NO_ENGINE
2694 if (tls_engine_get_cert(conn, cert_id, &cert))
2697 if (!SSL_use_certificate(conn->ssl, cert)) {
2698 tls_show_errors(MSG_ERROR, __func__,
2699 "SSL_use_certificate failed");
2704 wpa_printf(MSG_DEBUG, "ENGINE: SSL_use_certificate --> "
2708 #else /* OPENSSL_NO_ENGINE */
2710 #endif /* OPENSSL_NO_ENGINE */
2714 static int tls_connection_engine_ca_cert(struct tls_data *data,
2715 struct tls_connection *conn,
2716 const char *ca_cert_id)
2718 #ifndef OPENSSL_NO_ENGINE
2720 SSL_CTX *ssl_ctx = data->ssl;
2723 if (tls_engine_get_cert(conn, ca_cert_id, &cert))
2726 /* start off the same as tls_connection_ca_cert */
2727 store = X509_STORE_new();
2728 if (store == NULL) {
2729 wpa_printf(MSG_DEBUG, "OpenSSL: %s - failed to allocate new "
2730 "certificate store", __func__);
2734 SSL_CTX_set_cert_store(ssl_ctx, store);
2735 if (!X509_STORE_add_cert(store, cert)) {
2736 unsigned long err = ERR_peek_error();
2737 tls_show_errors(MSG_WARNING, __func__,
2738 "Failed to add CA certificate from engine "
2739 "to certificate store");
2740 if (ERR_GET_LIB(err) == ERR_LIB_X509 &&
2741 ERR_GET_REASON(err) == X509_R_CERT_ALREADY_IN_HASH_TABLE) {
2742 wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring cert"
2743 " already in hash table error",
2751 wpa_printf(MSG_DEBUG, "OpenSSL: %s - added CA certificate from engine "
2752 "to certificate store", __func__);
2753 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);
2754 conn->ca_cert_verify = 1;
2758 #else /* OPENSSL_NO_ENGINE */
2760 #endif /* OPENSSL_NO_ENGINE */
2764 static int tls_connection_engine_private_key(struct tls_connection *conn)
2766 #if defined(ANDROID) || !defined(OPENSSL_NO_ENGINE)
2767 if (SSL_use_PrivateKey(conn->ssl, conn->private_key) != 1) {
2768 tls_show_errors(MSG_ERROR, __func__,
2769 "ENGINE: cannot use private key for TLS");
2772 if (!SSL_check_private_key(conn->ssl)) {
2773 tls_show_errors(MSG_INFO, __func__,
2774 "Private key failed verification");
2778 #else /* OPENSSL_NO_ENGINE */
2779 wpa_printf(MSG_ERROR, "SSL: Configuration uses engine, but "
2780 "engine support was not compiled in");
2782 #endif /* OPENSSL_NO_ENGINE */
2786 static int tls_connection_private_key(struct tls_data *data,
2787 struct tls_connection *conn,
2788 const char *private_key,
2789 const char *private_key_passwd,
2790 const u8 *private_key_blob,
2791 size_t private_key_blob_len)
2793 SSL_CTX *ssl_ctx = data->ssl;
2797 if (private_key == NULL && private_key_blob == NULL)
2800 if (private_key_passwd) {
2801 passwd = os_strdup(private_key_passwd);
2807 SSL_CTX_set_default_passwd_cb(ssl_ctx, tls_passwd_cb);
2808 SSL_CTX_set_default_passwd_cb_userdata(ssl_ctx, passwd);
2811 while (private_key_blob) {
2812 if (SSL_use_PrivateKey_ASN1(EVP_PKEY_RSA, conn->ssl,
2813 (u8 *) private_key_blob,
2814 private_key_blob_len) == 1) {
2815 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_PrivateKey_"
2816 "ASN1(EVP_PKEY_RSA) --> OK");
2821 if (SSL_use_PrivateKey_ASN1(EVP_PKEY_DSA, conn->ssl,
2822 (u8 *) private_key_blob,
2823 private_key_blob_len) == 1) {
2824 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_PrivateKey_"
2825 "ASN1(EVP_PKEY_DSA) --> OK");
2830 if (SSL_use_RSAPrivateKey_ASN1(conn->ssl,
2831 (u8 *) private_key_blob,
2832 private_key_blob_len) == 1) {
2833 wpa_printf(MSG_DEBUG, "OpenSSL: "
2834 "SSL_use_RSAPrivateKey_ASN1 --> OK");
2839 if (tls_read_pkcs12_blob(data, conn->ssl, private_key_blob,
2840 private_key_blob_len, passwd) == 0) {
2841 wpa_printf(MSG_DEBUG, "OpenSSL: PKCS#12 as blob --> "
2850 while (!ok && private_key) {
2851 #ifndef OPENSSL_NO_STDIO
2852 if (SSL_use_PrivateKey_file(conn->ssl, private_key,
2853 SSL_FILETYPE_ASN1) == 1) {
2854 wpa_printf(MSG_DEBUG, "OpenSSL: "
2855 "SSL_use_PrivateKey_File (DER) --> OK");
2860 if (SSL_use_PrivateKey_file(conn->ssl, private_key,
2861 SSL_FILETYPE_PEM) == 1) {
2862 wpa_printf(MSG_DEBUG, "OpenSSL: "
2863 "SSL_use_PrivateKey_File (PEM) --> OK");
2867 #else /* OPENSSL_NO_STDIO */
2868 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO",
2870 #endif /* OPENSSL_NO_STDIO */
2872 if (tls_read_pkcs12(data, conn->ssl, private_key, passwd)
2874 wpa_printf(MSG_DEBUG, "OpenSSL: Reading PKCS#12 file "
2880 if (tls_cryptoapi_cert(conn->ssl, private_key) == 0) {
2881 wpa_printf(MSG_DEBUG, "OpenSSL: Using CryptoAPI to "
2882 "access certificate store --> OK");
2891 tls_show_errors(MSG_INFO, __func__,
2892 "Failed to load private key");
2897 SSL_CTX_set_default_passwd_cb(ssl_ctx, NULL);
2900 if (!SSL_check_private_key(conn->ssl)) {
2901 tls_show_errors(MSG_INFO, __func__, "Private key failed "
2906 wpa_printf(MSG_DEBUG, "SSL: Private key loaded successfully");
2911 static int tls_global_private_key(struct tls_data *data,
2912 const char *private_key,
2913 const char *private_key_passwd)
2915 SSL_CTX *ssl_ctx = data->ssl;
2918 if (private_key == NULL)
2921 if (private_key_passwd) {
2922 passwd = os_strdup(private_key_passwd);
2928 SSL_CTX_set_default_passwd_cb(ssl_ctx, tls_passwd_cb);
2929 SSL_CTX_set_default_passwd_cb_userdata(ssl_ctx, passwd);
2931 #ifndef OPENSSL_NO_STDIO
2932 SSL_CTX_use_PrivateKey_file(ssl_ctx, private_key,
2933 SSL_FILETYPE_ASN1) != 1 &&
2934 SSL_CTX_use_PrivateKey_file(ssl_ctx, private_key,
2935 SSL_FILETYPE_PEM) != 1 &&
2936 #endif /* OPENSSL_NO_STDIO */
2937 tls_read_pkcs12(data, NULL, private_key, passwd)) {
2938 tls_show_errors(MSG_INFO, __func__,
2939 "Failed to load private key");
2946 SSL_CTX_set_default_passwd_cb(ssl_ctx, NULL);
2948 if (!SSL_CTX_check_private_key(ssl_ctx)) {
2949 tls_show_errors(MSG_INFO, __func__,
2950 "Private key failed verification");
2958 static int tls_connection_dh(struct tls_connection *conn, const char *dh_file)
2960 #ifdef OPENSSL_NO_DH
2961 if (dh_file == NULL)
2963 wpa_printf(MSG_ERROR, "TLS: openssl does not include DH support, but "
2964 "dh_file specified");
2966 #else /* OPENSSL_NO_DH */
2970 /* TODO: add support for dh_blob */
2971 if (dh_file == NULL)
2976 bio = BIO_new_file(dh_file, "r");
2978 wpa_printf(MSG_INFO, "TLS: Failed to open DH file '%s': %s",
2979 dh_file, ERR_error_string(ERR_get_error(), NULL));
2982 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
2984 #ifndef OPENSSL_NO_DSA
2985 while (dh == NULL) {
2987 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DH file '%s': %s -"
2988 " trying to parse as DSA params", dh_file,
2989 ERR_error_string(ERR_get_error(), NULL));
2990 bio = BIO_new_file(dh_file, "r");
2993 dsa = PEM_read_bio_DSAparams(bio, NULL, NULL, NULL);
2996 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DSA file "
2997 "'%s': %s", dh_file,
2998 ERR_error_string(ERR_get_error(), NULL));
3002 wpa_printf(MSG_DEBUG, "TLS: DH file in DSA param format");
3003 dh = DSA_dup_DH(dsa);
3006 wpa_printf(MSG_INFO, "TLS: Failed to convert DSA "
3007 "params into DH params");
3012 #endif /* !OPENSSL_NO_DSA */
3014 wpa_printf(MSG_INFO, "TLS: Failed to read/parse DH/DSA file "
3019 if (SSL_set_tmp_dh(conn->ssl, dh) != 1) {
3020 wpa_printf(MSG_INFO, "TLS: Failed to set DH params from '%s': "
3022 ERR_error_string(ERR_get_error(), NULL));
3028 #endif /* OPENSSL_NO_DH */
3032 static int tls_global_dh(struct tls_data *data, const char *dh_file)
3034 #ifdef OPENSSL_NO_DH
3035 if (dh_file == NULL)
3037 wpa_printf(MSG_ERROR, "TLS: openssl does not include DH support, but "
3038 "dh_file specified");
3040 #else /* OPENSSL_NO_DH */
3041 SSL_CTX *ssl_ctx = data->ssl;
3045 /* TODO: add support for dh_blob */
3046 if (dh_file == NULL)
3048 if (ssl_ctx == NULL)
3051 bio = BIO_new_file(dh_file, "r");
3053 wpa_printf(MSG_INFO, "TLS: Failed to open DH file '%s': %s",
3054 dh_file, ERR_error_string(ERR_get_error(), NULL));
3057 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
3059 #ifndef OPENSSL_NO_DSA
3060 while (dh == NULL) {
3062 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DH file '%s': %s -"
3063 " trying to parse as DSA params", dh_file,
3064 ERR_error_string(ERR_get_error(), NULL));
3065 bio = BIO_new_file(dh_file, "r");
3068 dsa = PEM_read_bio_DSAparams(bio, NULL, NULL, NULL);
3071 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DSA file "
3072 "'%s': %s", dh_file,
3073 ERR_error_string(ERR_get_error(), NULL));
3077 wpa_printf(MSG_DEBUG, "TLS: DH file in DSA param format");
3078 dh = DSA_dup_DH(dsa);
3081 wpa_printf(MSG_INFO, "TLS: Failed to convert DSA "
3082 "params into DH params");
3087 #endif /* !OPENSSL_NO_DSA */
3089 wpa_printf(MSG_INFO, "TLS: Failed to read/parse DH/DSA file "
3094 if (SSL_CTX_set_tmp_dh(ssl_ctx, dh) != 1) {
3095 wpa_printf(MSG_INFO, "TLS: Failed to set DH params from '%s': "
3097 ERR_error_string(ERR_get_error(), NULL));
3103 #endif /* OPENSSL_NO_DH */
3107 int tls_connection_get_random(void *ssl_ctx, struct tls_connection *conn,
3108 struct tls_random *keys)
3112 if (conn == NULL || keys == NULL)
3118 os_memset(keys, 0, sizeof(*keys));
3119 keys->client_random = conn->client_random;
3120 keys->client_random_len = SSL_get_client_random(
3121 ssl, conn->client_random, sizeof(conn->client_random));
3122 keys->server_random = conn->server_random;
3123 keys->server_random_len = SSL_get_server_random(
3124 ssl, conn->server_random, sizeof(conn->server_random));
3130 #ifdef OPENSSL_NEED_EAP_FAST_PRF
3131 static int openssl_get_keyblock_size(SSL *ssl)
3133 #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
3134 const EVP_CIPHER *c;
3138 if (ssl->enc_read_ctx == NULL || ssl->enc_read_ctx->cipher == NULL ||
3139 ssl->read_hash == NULL)
3142 c = ssl->enc_read_ctx->cipher;
3143 h = EVP_MD_CTX_md(ssl->read_hash);
3145 md_size = EVP_MD_size(h);
3147 md_size = ssl->s3->tmp.new_mac_secret_size;
3151 wpa_printf(MSG_DEBUG, "OpenSSL: keyblock size: key_len=%d MD_size=%d "
3152 "IV_len=%d", EVP_CIPHER_key_length(c), md_size,
3153 EVP_CIPHER_iv_length(c));
3154 return 2 * (EVP_CIPHER_key_length(c) +
3156 EVP_CIPHER_iv_length(c));
3158 const SSL_CIPHER *ssl_cipher;
3160 const EVP_CIPHER *c;
3163 ssl_cipher = SSL_get_current_cipher(ssl);
3166 cipher = SSL_CIPHER_get_cipher_nid(ssl_cipher);
3167 digest = SSL_CIPHER_get_digest_nid(ssl_cipher);
3168 wpa_printf(MSG_DEBUG, "OpenSSL: cipher nid %d digest nid %d",
3170 if (cipher < 0 || digest < 0)
3172 c = EVP_get_cipherbynid(cipher);
3173 h = EVP_get_digestbynid(digest);
3177 wpa_printf(MSG_DEBUG,
3178 "OpenSSL: keyblock size: key_len=%d MD_size=%d IV_len=%d",
3179 EVP_CIPHER_key_length(c), EVP_MD_size(h),
3180 EVP_CIPHER_iv_length(c));
3181 return 2 * (EVP_CIPHER_key_length(c) + EVP_MD_size(h) +
3182 EVP_CIPHER_iv_length(c));
3185 #endif /* OPENSSL_NEED_EAP_FAST_PRF */
3188 int tls_connection_export_key(void *tls_ctx, struct tls_connection *conn,
3189 const char *label, u8 *out, size_t out_len)
3192 SSL_export_keying_material(conn->ssl, out, out_len, label,
3193 os_strlen(label), NULL, 0, 0) != 1)
3199 int tls_connection_get_eap_fast_key(void *tls_ctx, struct tls_connection *conn,
3200 u8 *out, size_t out_len)
3202 #ifdef OPENSSL_NEED_EAP_FAST_PRF
3210 unsigned char client_random[SSL3_RANDOM_SIZE];
3211 unsigned char server_random[SSL3_RANDOM_SIZE];
3212 unsigned char master_key[64];
3213 size_t master_key_len;
3217 * TLS library did not support EAP-FAST key generation, so get the
3218 * needed TLS session parameters and use an internal implementation of
3219 * TLS PRF to derive the key.
3227 ver = SSL_get_version(ssl);
3228 sess = SSL_get_session(ssl);
3232 skip = openssl_get_keyblock_size(ssl);
3235 tmp_out = os_malloc(skip + out_len);
3240 rnd = os_malloc(2 * SSL3_RANDOM_SIZE);
3246 SSL_get_client_random(ssl, client_random, sizeof(client_random));
3247 SSL_get_server_random(ssl, server_random, sizeof(server_random));
3248 master_key_len = SSL_SESSION_get_master_key(sess, master_key,
3249 sizeof(master_key));
3251 os_memcpy(rnd, server_random, SSL3_RANDOM_SIZE);
3252 os_memcpy(rnd + SSL3_RANDOM_SIZE, client_random, SSL3_RANDOM_SIZE);
3254 if (os_strcmp(ver, "TLSv1.2") == 0) {
3255 tls_prf_sha256(master_key, master_key_len,
3256 "key expansion", rnd, 2 * SSL3_RANDOM_SIZE,
3257 _out, skip + out_len);
3259 } else if (tls_prf_sha1_md5(master_key, master_key_len,
3260 "key expansion", rnd, 2 * SSL3_RANDOM_SIZE,
3261 _out, skip + out_len) == 0) {
3264 os_memset(master_key, 0, sizeof(master_key));
3267 os_memcpy(out, _out + skip, out_len);
3268 bin_clear_free(tmp_out, skip);
3271 #else /* OPENSSL_NEED_EAP_FAST_PRF */
3272 wpa_printf(MSG_ERROR,
3273 "OpenSSL: EAP-FAST keys cannot be exported in FIPS mode");
3275 #endif /* OPENSSL_NEED_EAP_FAST_PRF */
3279 static struct wpabuf *
3280 openssl_handshake(struct tls_connection *conn, const struct wpabuf *in_data,
3284 struct wpabuf *out_data;
3287 * Give TLS handshake data from the server (if available) to OpenSSL
3290 if (in_data && wpabuf_len(in_data) > 0 &&
3291 BIO_write(conn->ssl_in, wpabuf_head(in_data), wpabuf_len(in_data))
3293 tls_show_errors(MSG_INFO, __func__,
3294 "Handshake failed - BIO_write");
3298 /* Initiate TLS handshake or continue the existing handshake */
3300 res = SSL_accept(conn->ssl);
3302 res = SSL_connect(conn->ssl);
3304 int err = SSL_get_error(conn->ssl, res);
3305 if (err == SSL_ERROR_WANT_READ)
3306 wpa_printf(MSG_DEBUG, "SSL: SSL_connect - want "
3308 else if (err == SSL_ERROR_WANT_WRITE)
3309 wpa_printf(MSG_DEBUG, "SSL: SSL_connect - want to "
3312 tls_show_errors(MSG_INFO, __func__, "SSL_connect");
3317 /* Get the TLS handshake data to be sent to the server */
3318 res = BIO_ctrl_pending(conn->ssl_out);
3319 wpa_printf(MSG_DEBUG, "SSL: %d bytes pending from ssl_out", res);
3320 out_data = wpabuf_alloc(res);
3321 if (out_data == NULL) {
3322 wpa_printf(MSG_DEBUG, "SSL: Failed to allocate memory for "
3323 "handshake output (%d bytes)", res);
3324 if (BIO_reset(conn->ssl_out) < 0) {
3325 tls_show_errors(MSG_INFO, __func__,
3326 "BIO_reset failed");
3330 res = res == 0 ? 0 : BIO_read(conn->ssl_out, wpabuf_mhead(out_data),
3333 tls_show_errors(MSG_INFO, __func__,
3334 "Handshake failed - BIO_read");
3335 if (BIO_reset(conn->ssl_out) < 0) {
3336 tls_show_errors(MSG_INFO, __func__,
3337 "BIO_reset failed");
3339 wpabuf_free(out_data);
3342 wpabuf_put(out_data, res);
3348 static struct wpabuf *
3349 openssl_get_appl_data(struct tls_connection *conn, size_t max_len)
3351 struct wpabuf *appl_data;
3354 appl_data = wpabuf_alloc(max_len + 100);
3355 if (appl_data == NULL)
3358 res = SSL_read(conn->ssl, wpabuf_mhead(appl_data),
3359 wpabuf_size(appl_data));
3361 int err = SSL_get_error(conn->ssl, res);
3362 if (err == SSL_ERROR_WANT_READ ||
3363 err == SSL_ERROR_WANT_WRITE) {
3364 wpa_printf(MSG_DEBUG, "SSL: No Application Data "
3367 tls_show_errors(MSG_INFO, __func__,
3368 "Failed to read possible "
3369 "Application Data");
3371 wpabuf_free(appl_data);
3375 wpabuf_put(appl_data, res);
3376 wpa_hexdump_buf_key(MSG_MSGDUMP, "SSL: Application Data in Finished "
3377 "message", appl_data);
3383 static struct wpabuf *
3384 openssl_connection_handshake(struct tls_connection *conn,
3385 const struct wpabuf *in_data,
3386 struct wpabuf **appl_data, int server)
3388 struct wpabuf *out_data;
3393 out_data = openssl_handshake(conn, in_data, server);
3394 if (out_data == NULL)
3396 if (conn->invalid_hb_used) {
3397 wpa_printf(MSG_INFO, "TLS: Heartbeat attack detected - do not send response");
3398 wpabuf_free(out_data);
3402 if (SSL_is_init_finished(conn->ssl)) {
3403 wpa_printf(MSG_DEBUG,
3404 "OpenSSL: Handshake finished - resumed=%d",
3405 tls_connection_resumed(conn->ssl_ctx, conn));
3406 if (appl_data && in_data)
3407 *appl_data = openssl_get_appl_data(conn,
3408 wpabuf_len(in_data));
3411 if (conn->invalid_hb_used) {
3412 wpa_printf(MSG_INFO, "TLS: Heartbeat attack detected - do not send response");
3414 wpabuf_free(*appl_data);
3417 wpabuf_free(out_data);
3426 tls_connection_handshake(void *ssl_ctx, struct tls_connection *conn,
3427 const struct wpabuf *in_data,
3428 struct wpabuf **appl_data)
3430 return openssl_connection_handshake(conn, in_data, appl_data, 0);
3434 struct wpabuf * tls_connection_server_handshake(void *tls_ctx,
3435 struct tls_connection *conn,
3436 const struct wpabuf *in_data,
3437 struct wpabuf **appl_data)
3439 return openssl_connection_handshake(conn, in_data, appl_data, 1);
3443 struct wpabuf * tls_connection_encrypt(void *tls_ctx,
3444 struct tls_connection *conn,
3445 const struct wpabuf *in_data)
3453 /* Give plaintext data for OpenSSL to encrypt into the TLS tunnel. */
3454 if ((res = BIO_reset(conn->ssl_in)) < 0 ||
3455 (res = BIO_reset(conn->ssl_out)) < 0) {
3456 tls_show_errors(MSG_INFO, __func__, "BIO_reset failed");
3459 res = SSL_write(conn->ssl, wpabuf_head(in_data), wpabuf_len(in_data));
3461 tls_show_errors(MSG_INFO, __func__,
3462 "Encryption failed - SSL_write");
3466 /* Read encrypted data to be sent to the server */
3467 buf = wpabuf_alloc(wpabuf_len(in_data) + 300);
3470 res = BIO_read(conn->ssl_out, wpabuf_mhead(buf), wpabuf_size(buf));
3472 tls_show_errors(MSG_INFO, __func__,
3473 "Encryption failed - BIO_read");
3477 wpabuf_put(buf, res);
3483 struct wpabuf * tls_connection_decrypt(void *tls_ctx,
3484 struct tls_connection *conn,
3485 const struct wpabuf *in_data)
3490 /* Give encrypted data from TLS tunnel for OpenSSL to decrypt. */
3491 res = BIO_write(conn->ssl_in, wpabuf_head(in_data),
3492 wpabuf_len(in_data));
3494 tls_show_errors(MSG_INFO, __func__,
3495 "Decryption failed - BIO_write");
3498 if (BIO_reset(conn->ssl_out) < 0) {
3499 tls_show_errors(MSG_INFO, __func__, "BIO_reset failed");
3503 /* Read decrypted data for further processing */
3505 * Even though we try to disable TLS compression, it is possible that
3506 * this cannot be done with all TLS libraries. Add extra buffer space
3507 * to handle the possibility of the decrypted data being longer than
3510 buf = wpabuf_alloc((wpabuf_len(in_data) + 500) * 3);
3513 res = SSL_read(conn->ssl, wpabuf_mhead(buf), wpabuf_size(buf));
3515 tls_show_errors(MSG_INFO, __func__,
3516 "Decryption failed - SSL_read");
3520 wpabuf_put(buf, res);
3522 if (conn->invalid_hb_used) {
3523 wpa_printf(MSG_INFO, "TLS: Heartbeat attack detected - do not send response");
3532 int tls_connection_resumed(void *ssl_ctx, struct tls_connection *conn)
3534 return conn ? SSL_cache_hit(conn->ssl) : 0;
3538 int tls_connection_set_cipher_list(void *tls_ctx, struct tls_connection *conn,
3541 char buf[500], *pos, *end;
3545 if (conn == NULL || conn->ssl == NULL || ciphers == NULL)
3550 end = pos + sizeof(buf);
3553 while (*c != TLS_CIPHER_NONE) {
3557 case TLS_CIPHER_RC4_SHA:
3560 case TLS_CIPHER_AES128_SHA:
3561 suite = "AES128-SHA";
3563 case TLS_CIPHER_RSA_DHE_AES128_SHA:
3564 suite = "DHE-RSA-AES128-SHA";
3566 case TLS_CIPHER_ANON_DH_AES128_SHA:
3567 suite = "ADH-AES128-SHA";
3569 case TLS_CIPHER_RSA_DHE_AES256_SHA:
3570 suite = "DHE-RSA-AES256-SHA";
3572 case TLS_CIPHER_AES256_SHA:
3573 suite = "AES256-SHA";
3576 wpa_printf(MSG_DEBUG, "TLS: Unsupported "
3577 "cipher selection: %d", *c);
3580 ret = os_snprintf(pos, end - pos, ":%s", suite);
3581 if (os_snprintf_error(end - pos, ret))
3588 wpa_printf(MSG_DEBUG, "OpenSSL: cipher suites: %s", buf + 1);
3590 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
3591 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
3592 if (os_strstr(buf, ":ADH-")) {
3594 * Need to drop to security level 0 to allow anonymous
3595 * cipher suites for EAP-FAST.
3597 SSL_set_security_level(conn->ssl, 0);
3598 } else if (SSL_get_security_level(conn->ssl) == 0) {
3599 /* Force at least security level 1 */
3600 SSL_set_security_level(conn->ssl, 1);
3602 #endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */
3605 if (SSL_set_cipher_list(conn->ssl, buf + 1) != 1) {
3606 tls_show_errors(MSG_INFO, __func__,
3607 "Cipher suite configuration failed");
3615 int tls_get_version(void *ssl_ctx, struct tls_connection *conn,
3616 char *buf, size_t buflen)
3619 if (conn == NULL || conn->ssl == NULL)
3622 name = SSL_get_version(conn->ssl);
3626 os_strlcpy(buf, name, buflen);
3631 int tls_get_cipher(void *ssl_ctx, struct tls_connection *conn,
3632 char *buf, size_t buflen)
3635 if (conn == NULL || conn->ssl == NULL)
3638 name = SSL_get_cipher(conn->ssl);
3642 os_strlcpy(buf, name, buflen);
3647 int tls_connection_enable_workaround(void *ssl_ctx,
3648 struct tls_connection *conn)
3650 SSL_set_options(conn->ssl, SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS);
3656 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
3657 /* ClientHello TLS extensions require a patch to openssl, so this function is
3658 * commented out unless explicitly needed for EAP-FAST in order to be able to
3659 * build this file with unmodified openssl. */
3660 int tls_connection_client_hello_ext(void *ssl_ctx, struct tls_connection *conn,
3661 int ext_type, const u8 *data,
3664 if (conn == NULL || conn->ssl == NULL || ext_type != 35)
3667 if (SSL_set_session_ticket_ext(conn->ssl, (void *) data,
3673 #endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */
3676 int tls_connection_get_failed(void *ssl_ctx, struct tls_connection *conn)
3680 return conn->failed;
3684 int tls_connection_get_read_alerts(void *ssl_ctx, struct tls_connection *conn)
3688 return conn->read_alerts;
3692 int tls_connection_get_write_alerts(void *ssl_ctx, struct tls_connection *conn)
3696 return conn->write_alerts;
3702 static void ocsp_debug_print_resp(OCSP_RESPONSE *rsp)
3704 #ifndef CONFIG_NO_STDOUT_DEBUG
3710 if (wpa_debug_level > MSG_DEBUG)
3713 out = BIO_new(BIO_s_mem());
3717 OCSP_RESPONSE_print(out, rsp, 0);
3718 rlen = BIO_ctrl_pending(out);
3719 txt = os_malloc(rlen + 1);
3725 res = BIO_read(out, txt, rlen);
3728 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP Response\n%s", txt);
3732 #endif /* CONFIG_NO_STDOUT_DEBUG */
3736 static void debug_print_cert(X509 *cert, const char *title)
3738 #ifndef CONFIG_NO_STDOUT_DEBUG
3744 if (wpa_debug_level > MSG_DEBUG)
3747 out = BIO_new(BIO_s_mem());
3751 X509_print(out, cert);
3752 rlen = BIO_ctrl_pending(out);
3753 txt = os_malloc(rlen + 1);
3759 res = BIO_read(out, txt, rlen);
3762 wpa_printf(MSG_DEBUG, "OpenSSL: %s\n%s", title, txt);
3767 #endif /* CONFIG_NO_STDOUT_DEBUG */
3771 static int ocsp_resp_cb(SSL *s, void *arg)
3773 struct tls_connection *conn = arg;
3774 const unsigned char *p;
3775 int len, status, reason;
3777 OCSP_BASICRESP *basic;
3779 ASN1_GENERALIZEDTIME *produced_at, *this_update, *next_update;
3781 STACK_OF(X509) *certs = NULL;
3783 len = SSL_get_tlsext_status_ocsp_resp(s, &p);
3785 wpa_printf(MSG_DEBUG, "OpenSSL: No OCSP response received");
3786 return (conn->flags & TLS_CONN_REQUIRE_OCSP) ? 0 : 1;
3789 wpa_hexdump(MSG_DEBUG, "OpenSSL: OCSP response", p, len);
3791 rsp = d2i_OCSP_RESPONSE(NULL, &p, len);
3793 wpa_printf(MSG_INFO, "OpenSSL: Failed to parse OCSP response");
3797 ocsp_debug_print_resp(rsp);
3799 status = OCSP_response_status(rsp);
3800 if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL) {
3801 wpa_printf(MSG_INFO, "OpenSSL: OCSP responder error %d (%s)",
3802 status, OCSP_response_status_str(status));
3806 basic = OCSP_response_get1_basic(rsp);
3808 wpa_printf(MSG_INFO, "OpenSSL: Could not find BasicOCSPResponse");
3812 store = SSL_CTX_get_cert_store(conn->ssl_ctx);
3813 if (conn->peer_issuer) {
3814 debug_print_cert(conn->peer_issuer, "Add OCSP issuer");
3816 if (X509_STORE_add_cert(store, conn->peer_issuer) != 1) {
3817 tls_show_errors(MSG_INFO, __func__,
3818 "OpenSSL: Could not add issuer to certificate store");
3820 certs = sk_X509_new_null();
3823 cert = X509_dup(conn->peer_issuer);
3824 if (cert && !sk_X509_push(certs, cert)) {
3827 "OpenSSL: Could not add issuer to OCSP responder trust store");
3829 sk_X509_free(certs);
3832 if (certs && conn->peer_issuer_issuer) {
3833 cert = X509_dup(conn->peer_issuer_issuer);
3834 if (cert && !sk_X509_push(certs, cert)) {
3837 "OpenSSL: Could not add issuer's issuer to OCSP responder trust store");
3844 status = OCSP_basic_verify(basic, certs, store, OCSP_TRUSTOTHER);
3845 sk_X509_pop_free(certs, X509_free);
3847 tls_show_errors(MSG_INFO, __func__,
3848 "OpenSSL: OCSP response failed verification");
3849 OCSP_BASICRESP_free(basic);
3850 OCSP_RESPONSE_free(rsp);
3854 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP response verification succeeded");
3856 if (!conn->peer_cert) {
3857 wpa_printf(MSG_DEBUG, "OpenSSL: Peer certificate not available for OCSP status check");
3858 OCSP_BASICRESP_free(basic);
3859 OCSP_RESPONSE_free(rsp);
3863 if (!conn->peer_issuer) {
3864 wpa_printf(MSG_DEBUG, "OpenSSL: Peer issuer certificate not available for OCSP status check");
3865 OCSP_BASICRESP_free(basic);
3866 OCSP_RESPONSE_free(rsp);
3870 id = OCSP_cert_to_id(NULL, conn->peer_cert, conn->peer_issuer);
3872 wpa_printf(MSG_DEBUG, "OpenSSL: Could not create OCSP certificate identifier");
3873 OCSP_BASICRESP_free(basic);
3874 OCSP_RESPONSE_free(rsp);
3878 if (!OCSP_resp_find_status(basic, id, &status, &reason, &produced_at,
3879 &this_update, &next_update)) {
3880 wpa_printf(MSG_INFO, "OpenSSL: Could not find current server certificate from OCSP response%s",
3881 (conn->flags & TLS_CONN_REQUIRE_OCSP) ? "" :
3882 " (OCSP not required)");
3883 OCSP_CERTID_free(id);
3884 OCSP_BASICRESP_free(basic);
3885 OCSP_RESPONSE_free(rsp);
3886 return (conn->flags & TLS_CONN_REQUIRE_OCSP) ? 0 : 1;
3888 OCSP_CERTID_free(id);
3890 if (!OCSP_check_validity(this_update, next_update, 5 * 60, -1)) {
3891 tls_show_errors(MSG_INFO, __func__,
3892 "OpenSSL: OCSP status times invalid");
3893 OCSP_BASICRESP_free(basic);
3894 OCSP_RESPONSE_free(rsp);
3898 OCSP_BASICRESP_free(basic);
3899 OCSP_RESPONSE_free(rsp);
3901 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status for server certificate: %s",
3902 OCSP_cert_status_str(status));
3904 if (status == V_OCSP_CERTSTATUS_GOOD)
3906 if (status == V_OCSP_CERTSTATUS_REVOKED)
3908 if (conn->flags & TLS_CONN_REQUIRE_OCSP) {
3909 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status unknown, but OCSP required");
3912 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status unknown, but OCSP was not required, so allow connection to continue");
3917 static int ocsp_status_cb(SSL *s, void *arg)
3923 if (tls_global->ocsp_stapling_response == NULL) {
3924 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status callback - no response configured");
3925 return SSL_TLSEXT_ERR_OK;
3928 resp = os_readfile(tls_global->ocsp_stapling_response, &len);
3930 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status callback - could not read response file");
3931 /* TODO: Build OCSPResponse with responseStatus = internalError
3933 return SSL_TLSEXT_ERR_OK;
3935 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status callback - send cached response");
3936 tmp = OPENSSL_malloc(len);
3939 return SSL_TLSEXT_ERR_ALERT_FATAL;
3942 os_memcpy(tmp, resp, len);
3944 SSL_set_tlsext_status_ocsp_resp(s, tmp, len);
3946 return SSL_TLSEXT_ERR_OK;
3949 #endif /* HAVE_OCSP */
3952 int tls_connection_set_params(void *tls_ctx, struct tls_connection *conn,
3953 const struct tls_connection_params *params)
3955 struct tls_data *data = tls_ctx;
3959 const char *key_id = params->key_id;
3960 const char *cert_id = params->cert_id;
3961 const char *ca_cert_id = params->ca_cert_id;
3962 const char *engine_id = params->engine ? params->engine_id : NULL;
3967 if (params->flags & TLS_CONN_REQUIRE_OCSP_ALL) {
3968 wpa_printf(MSG_INFO,
3969 "OpenSSL: ocsp=3 not supported");
3974 * If the engine isn't explicitly configured, and any of the
3975 * cert/key fields are actually PKCS#11 URIs, then automatically
3976 * use the PKCS#11 ENGINE.
3978 if (!engine_id || os_strcmp(engine_id, "pkcs11") == 0)
3981 if (!key_id && params->private_key && can_pkcs11 &&
3982 os_strncmp(params->private_key, "pkcs11:", 7) == 0) {
3984 key_id = params->private_key;
3987 if (!cert_id && params->client_cert && can_pkcs11 &&
3988 os_strncmp(params->client_cert, "pkcs11:", 7) == 0) {
3990 cert_id = params->client_cert;
3993 if (!ca_cert_id && params->ca_cert && can_pkcs11 &&
3994 os_strncmp(params->ca_cert, "pkcs11:", 7) == 0) {
3996 ca_cert_id = params->ca_cert;
3999 /* If we need to automatically enable the PKCS#11 ENGINE, do so. */
4000 if (can_pkcs11 == 2 && !engine_id)
4001 engine_id = "pkcs11";
4003 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
4004 #if OPENSSL_VERSION_NUMBER < 0x10100000L
4005 if (params->flags & TLS_CONN_EAP_FAST) {
4006 wpa_printf(MSG_DEBUG,
4007 "OpenSSL: Use TLSv1_method() for EAP-FAST");
4008 if (SSL_set_ssl_method(conn->ssl, TLSv1_method()) != 1) {
4009 tls_show_errors(MSG_INFO, __func__,
4010 "Failed to set TLSv1_method() for EAP-FAST");
4015 #endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */
4017 while ((err = ERR_get_error())) {
4018 wpa_printf(MSG_INFO, "%s: Clearing pending SSL error: %s",
4019 __func__, ERR_error_string(err, NULL));
4023 wpa_printf(MSG_DEBUG, "SSL: Initializing TLS engine");
4024 ret = tls_engine_init(conn, engine_id, params->pin,
4025 key_id, cert_id, ca_cert_id);
4029 if (tls_connection_set_subject_match(conn,
4030 params->subject_match,
4031 params->altsubject_match,
4032 params->suffix_match,
4033 params->domain_match))
4036 if (engine_id && ca_cert_id) {
4037 if (tls_connection_engine_ca_cert(data, conn, ca_cert_id))
4038 return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED;
4039 } else if (tls_connection_ca_cert(data, conn, params->ca_cert,
4040 params->ca_cert_blob,
4041 params->ca_cert_blob_len,
4043 params->server_cert_cb,
4044 params->server_cert_ctx))
4047 if (engine_id && cert_id) {
4048 if (tls_connection_engine_client_cert(conn, cert_id))
4049 return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED;
4050 } else if (tls_connection_client_cert(conn, params->client_cert,
4051 params->client_cert_blob,
4052 params->client_cert_blob_len))
4055 if (engine_id && key_id) {
4056 wpa_printf(MSG_DEBUG, "TLS: Using private key from engine");
4057 if (tls_connection_engine_private_key(conn))
4058 return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED;
4059 } else if (tls_connection_private_key(data, conn,
4060 params->private_key,
4061 params->private_key_passwd,
4062 params->private_key_blob,
4063 params->private_key_blob_len)) {
4064 wpa_printf(MSG_INFO, "TLS: Failed to load private key '%s'",
4065 params->private_key);
4069 if (tls_connection_dh(conn, params->dh_file)) {
4070 wpa_printf(MSG_INFO, "TLS: Failed to load DH file '%s'",
4075 if (params->openssl_ciphers &&
4076 SSL_set_cipher_list(conn->ssl, params->openssl_ciphers) != 1) {
4077 wpa_printf(MSG_INFO,
4078 "OpenSSL: Failed to set cipher string '%s'",
4079 params->openssl_ciphers);
4083 tls_set_conn_flags(conn->ssl, params->flags);
4085 #ifdef OPENSSL_IS_BORINGSSL
4086 if (params->flags & TLS_CONN_REQUEST_OCSP) {
4087 SSL_enable_ocsp_stapling(conn->ssl);
4089 #else /* OPENSSL_IS_BORINGSSL */
4091 if (params->flags & TLS_CONN_REQUEST_OCSP) {
4092 SSL_CTX *ssl_ctx = data->ssl;
4093 SSL_set_tlsext_status_type(conn->ssl, TLSEXT_STATUSTYPE_ocsp);
4094 SSL_CTX_set_tlsext_status_cb(ssl_ctx, ocsp_resp_cb);
4095 SSL_CTX_set_tlsext_status_arg(ssl_ctx, conn);
4097 #else /* HAVE_OCSP */
4098 if (params->flags & TLS_CONN_REQUIRE_OCSP) {
4099 wpa_printf(MSG_INFO,
4100 "OpenSSL: No OCSP support included - reject configuration");
4103 if (params->flags & TLS_CONN_REQUEST_OCSP) {
4104 wpa_printf(MSG_DEBUG,
4105 "OpenSSL: No OCSP support included - allow optional OCSP case to continue");
4107 #endif /* HAVE_OCSP */
4108 #endif /* OPENSSL_IS_BORINGSSL */
4110 conn->flags = params->flags;
4112 tls_get_errors(data);
4118 int tls_global_set_params(void *tls_ctx,
4119 const struct tls_connection_params *params)
4121 struct tls_data *data = tls_ctx;
4122 SSL_CTX *ssl_ctx = data->ssl;
4125 while ((err = ERR_get_error())) {
4126 wpa_printf(MSG_INFO, "%s: Clearing pending SSL error: %s",
4127 __func__, ERR_error_string(err, NULL));
4130 if (tls_global_ca_cert(data, params->ca_cert) ||
4131 tls_global_client_cert(data, params->client_cert) ||
4132 tls_global_private_key(data, params->private_key,
4133 params->private_key_passwd) ||
4134 tls_global_dh(data, params->dh_file)) {
4135 wpa_printf(MSG_INFO, "TLS: Failed to set global parameters");
4139 if (params->openssl_ciphers &&
4140 SSL_CTX_set_cipher_list(ssl_ctx, params->openssl_ciphers) != 1) {
4141 wpa_printf(MSG_INFO,
4142 "OpenSSL: Failed to set cipher string '%s'",
4143 params->openssl_ciphers);
4147 #ifdef SSL_OP_NO_TICKET
4148 if (params->flags & TLS_CONN_DISABLE_SESSION_TICKET)
4149 SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_TICKET);
4150 #ifdef SSL_CTX_clear_options
4152 SSL_CTX_clear_options(ssl_ctx, SSL_OP_NO_TICKET);
4153 #endif /* SSL_clear_options */
4154 #endif /* SSL_OP_NO_TICKET */
4157 SSL_CTX_set_tlsext_status_cb(ssl_ctx, ocsp_status_cb);
4158 SSL_CTX_set_tlsext_status_arg(ssl_ctx, ssl_ctx);
4159 os_free(tls_global->ocsp_stapling_response);
4160 if (params->ocsp_stapling_response)
4161 tls_global->ocsp_stapling_response =
4162 os_strdup(params->ocsp_stapling_response);
4164 tls_global->ocsp_stapling_response = NULL;
4165 #endif /* HAVE_OCSP */
4171 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
4172 /* Pre-shared secred requires a patch to openssl, so this function is
4173 * commented out unless explicitly needed for EAP-FAST in order to be able to
4174 * build this file with unmodified openssl. */
4176 #if (defined(OPENSSL_IS_BORINGSSL) || OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined(LIBRESSL_VERSION_NUMBER)
4177 static int tls_sess_sec_cb(SSL *s, void *secret, int *secret_len,
4178 STACK_OF(SSL_CIPHER) *peer_ciphers,
4179 const SSL_CIPHER **cipher, void *arg)
4180 #else /* OPENSSL_IS_BORINGSSL */
4181 static int tls_sess_sec_cb(SSL *s, void *secret, int *secret_len,
4182 STACK_OF(SSL_CIPHER) *peer_ciphers,
4183 SSL_CIPHER **cipher, void *arg)
4184 #endif /* OPENSSL_IS_BORINGSSL */
4186 struct tls_connection *conn = arg;
4189 #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
4190 if (conn == NULL || conn->session_ticket_cb == NULL)
4193 ret = conn->session_ticket_cb(conn->session_ticket_cb_ctx,
4194 conn->session_ticket,
4195 conn->session_ticket_len,
4196 s->s3->client_random,
4197 s->s3->server_random, secret);
4199 unsigned char client_random[SSL3_RANDOM_SIZE];
4200 unsigned char server_random[SSL3_RANDOM_SIZE];
4202 if (conn == NULL || conn->session_ticket_cb == NULL)
4205 SSL_get_client_random(s, client_random, sizeof(client_random));
4206 SSL_get_server_random(s, server_random, sizeof(server_random));
4208 ret = conn->session_ticket_cb(conn->session_ticket_cb_ctx,
4209 conn->session_ticket,
4210 conn->session_ticket_len,
4212 server_random, secret);
4215 os_free(conn->session_ticket);
4216 conn->session_ticket = NULL;
4221 *secret_len = SSL_MAX_MASTER_KEY_LENGTH;
4226 static int tls_session_ticket_ext_cb(SSL *s, const unsigned char *data,
4229 struct tls_connection *conn = arg;
4231 if (conn == NULL || conn->session_ticket_cb == NULL)
4234 wpa_printf(MSG_DEBUG, "OpenSSL: %s: length=%d", __func__, len);
4236 os_free(conn->session_ticket);
4237 conn->session_ticket = NULL;
4239 wpa_hexdump(MSG_DEBUG, "OpenSSL: ClientHello SessionTicket "
4240 "extension", data, len);
4242 conn->session_ticket = os_malloc(len);
4243 if (conn->session_ticket == NULL)
4246 os_memcpy(conn->session_ticket, data, len);
4247 conn->session_ticket_len = len;
4251 #endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */
4254 int tls_connection_set_session_ticket_cb(void *tls_ctx,
4255 struct tls_connection *conn,
4256 tls_session_ticket_cb cb,
4259 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
4260 conn->session_ticket_cb = cb;
4261 conn->session_ticket_cb_ctx = ctx;
4264 if (SSL_set_session_secret_cb(conn->ssl, tls_sess_sec_cb,
4267 SSL_set_session_ticket_ext_cb(conn->ssl,
4268 tls_session_ticket_ext_cb, conn);
4270 if (SSL_set_session_secret_cb(conn->ssl, NULL, NULL) != 1)
4272 SSL_set_session_ticket_ext_cb(conn->ssl, NULL, NULL);
4276 #else /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */
4278 #endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */
4282 int tls_get_library_version(char *buf, size_t buf_len)
4284 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
4285 return os_snprintf(buf, buf_len, "OpenSSL build=%s run=%s",
4286 OPENSSL_VERSION_TEXT,
4287 OpenSSL_version(OPENSSL_VERSION));
4289 return os_snprintf(buf, buf_len, "OpenSSL build=%s run=%s",
4290 OPENSSL_VERSION_TEXT,
4291 SSLeay_version(SSLEAY_VERSION));
4296 void tls_connection_set_success_data(struct tls_connection *conn,
4297 struct wpabuf *data)
4302 if (tls_ex_idx_session < 0)
4304 sess = SSL_get_session(conn->ssl);
4307 old = SSL_SESSION_get_ex_data(sess, tls_ex_idx_session);
4309 wpa_printf(MSG_DEBUG, "OpenSSL: Replacing old success data %p",
4313 if (SSL_SESSION_set_ex_data(sess, tls_ex_idx_session, data) != 1)
4316 wpa_printf(MSG_DEBUG, "OpenSSL: Stored success data %p", data);
4317 conn->success_data = 1;
4321 wpa_printf(MSG_INFO, "OpenSSL: Failed to store success data");
4326 void tls_connection_set_success_data_resumed(struct tls_connection *conn)
4328 wpa_printf(MSG_DEBUG,
4329 "OpenSSL: Success data accepted for resumed session");
4330 conn->success_data = 1;
4334 const struct wpabuf *
4335 tls_connection_get_success_data(struct tls_connection *conn)
4339 if (tls_ex_idx_session < 0 ||
4340 !(sess = SSL_get_session(conn->ssl)))
4342 return SSL_SESSION_get_ex_data(sess, tls_ex_idx_session);
4346 void tls_connection_remove_session(struct tls_connection *conn)
4350 sess = SSL_get_session(conn->ssl);
4354 if (SSL_CTX_remove_session(conn->ssl_ctx, sess) != 1)
4355 wpa_printf(MSG_DEBUG,
4356 "OpenSSL: Session was not cached");
4358 wpa_printf(MSG_DEBUG,
4359 "OpenSSL: Removed cached session to disable session resumption");