libeap/src/tls/tlsv1_client_write.c

   1 /*
   2  * TLSv1 client - write handshake message
   3  * Copyright (c) 2006-2015, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #include "common.h"
  12 #include "crypto/md5.h"
  13 #include "crypto/sha1.h"
  14 #include "crypto/sha256.h"
  15 #include "crypto/tls.h"
  16 #include "crypto/random.h"
  17 #include "x509v3.h"
  18 #include "tlsv1_common.h"
  19 #include "tlsv1_record.h"
  20 #include "tlsv1_client.h"
  21 #include "tlsv1_client_i.h"
  22
  23
  24 static size_t tls_client_cert_chain_der_len(struct tlsv1_client *conn)
  25 {
  26         size_t len = 0;
  27         struct x509_certificate *cert;
  28
  29         if (conn->cred == NULL)
  30                 return 0;
  31
  32         cert = conn->cred->cert;
  33         while (cert) {
  34                 len += 3 + cert->cert_len;
  35                 if (x509_certificate_self_signed(cert))
  36                         break;
  37                 cert = x509_certificate_get_subject(conn->cred->trusted_certs,
  38                                                     &cert->issuer);
  39         }
  40
  41         return len;
  42 }
  43
  44
  45 u8 * tls_send_client_hello(struct tlsv1_client *conn, size_t *out_len)
  46 {
  47         u8 *hello, *end, *pos, *hs_length, *hs_start, *rhdr;
  48         struct os_time now;
  49         size_t len, i;
  50         u8 *ext_start;
  51         u16 tls_version = TLS_VERSION;
  52
  53         /* Pick the highest locally enabled TLS version */
  54 #ifdef CONFIG_TLSV12
  55         if ((conn->flags & TLS_CONN_DISABLE_TLSv1_2) &&
  56             tls_version == TLS_VERSION_1_2)
  57                 tls_version = TLS_VERSION_1_1;
  58 #endif /* CONFIG_TLSV12 */
  59 #ifdef CONFIG_TLSV11
  60         if ((conn->flags & TLS_CONN_DISABLE_TLSv1_1) &&
  61             tls_version == TLS_VERSION_1_1)
  62                 tls_version = TLS_VERSION_1;
  63 #endif /* CONFIG_TLSV11 */
  64         if ((conn->flags & TLS_CONN_DISABLE_TLSv1_0) &&
  65             tls_version == TLS_VERSION_1) {
  66                 wpa_printf(MSG_INFO, "TLSv1: No TLS version allowed");
  67                 return NULL;
  68         }
  69
  70         wpa_printf(MSG_DEBUG, "TLSv1: Send ClientHello (ver %s)",
  71                    tls_version_str(tls_version));
  72         *out_len = 0;
  73
  74         os_get_time(&now);
  75         WPA_PUT_BE32(conn->client_random, now.sec);
  76         if (random_get_bytes(conn->client_random + 4, TLS_RANDOM_LEN - 4)) {
  77                 wpa_printf(MSG_ERROR, "TLSv1: Could not generate "
  78                            "client_random");
  79                 return NULL;
  80         }
  81         wpa_hexdump(MSG_MSGDUMP, "TLSv1: client_random",
  82                     conn->client_random, TLS_RANDOM_LEN);
  83
  84         len = 150 + conn->num_cipher_suites * 2 + conn->client_hello_ext_len;
  85         hello = os_malloc(len);
  86         if (hello == NULL)
  87                 return NULL;
  88         end = hello + len;
  89
  90         rhdr = hello;
  91         pos = rhdr + TLS_RECORD_HEADER_LEN;
  92
  93         /* opaque fragment[TLSPlaintext.length] */
  94
  95         /* Handshake */
  96         hs_start = pos;
  97         /* HandshakeType msg_type */
  98         *pos++ = TLS_HANDSHAKE_TYPE_CLIENT_HELLO;
  99         /* uint24 length (to be filled) */
 100         hs_length = pos;
 101         pos += 3;
 102         /* body - ClientHello */
 103         /* ProtocolVersion client_version */
 104         WPA_PUT_BE16(pos, tls_version);
 105         pos += 2;
 106         /* Random random: uint32 gmt_unix_time, opaque random_bytes */
 107         os_memcpy(pos, conn->client_random, TLS_RANDOM_LEN);
 108         pos += TLS_RANDOM_LEN;
 109         /* SessionID session_id */
 110         *pos++ = conn->session_id_len;
 111         os_memcpy(pos, conn->session_id, conn->session_id_len);
 112         pos += conn->session_id_len;
 113         /* CipherSuite cipher_suites<2..2^16-1> */
 114         WPA_PUT_BE16(pos, 2 * conn->num_cipher_suites);
 115         pos += 2;
 116         for (i = 0; i < conn->num_cipher_suites; i++) {
 117                 WPA_PUT_BE16(pos, conn->cipher_suites[i]);
 118                 pos += 2;
 119         }
 120         /* CompressionMethod compression_methods<1..2^8-1> */
 121         *pos++ = 1;
 122         *pos++ = TLS_COMPRESSION_NULL;
 123
 124         /* Extension */
 125         ext_start = pos;
 126         pos += 2;
 127
 128 #ifdef CONFIG_TLSV12
 129         if (conn->rl.tls_version >= TLS_VERSION_1_2) {
 130                 /*
 131                  * Add signature_algorithms extension since we support only
 132                  * SHA256 (and not the default SHA1) with TLSv1.2.
 133                  */
 134                 /* ExtensionsType extension_type = signature_algorithms(13) */
 135                 WPA_PUT_BE16(pos, TLS_EXT_SIGNATURE_ALGORITHMS);
 136                 pos += 2;
 137                 /* opaque extension_data<0..2^16-1> length */
 138                 WPA_PUT_BE16(pos, 8);
 139                 pos += 2;
 140                 /* supported_signature_algorithms<2..2^16-2> length */
 141                 WPA_PUT_BE16(pos, 6);
 142                 pos += 2;
 143                 /* supported_signature_algorithms */
 144                 *pos++ = TLS_HASH_ALG_SHA512;
 145                 *pos++ = TLS_SIGN_ALG_RSA;
 146                 *pos++ = TLS_HASH_ALG_SHA384;
 147                 *pos++ = TLS_SIGN_ALG_RSA;
 148                 *pos++ = TLS_HASH_ALG_SHA256;
 149                 *pos++ = TLS_SIGN_ALG_RSA;
 150         }
 151 #endif /* CONFIG_TLSV12 */
 152
 153         if (conn->client_hello_ext) {
 154                 os_memcpy(pos, conn->client_hello_ext,
 155                           conn->client_hello_ext_len);
 156                 pos += conn->client_hello_ext_len;
 157         }
 158
 159         if (conn->flags & TLS_CONN_REQUEST_OCSP) {
 160                 wpa_printf(MSG_DEBUG,
 161                            "TLSv1: Add status_request extension for OCSP stapling");
 162                 /* ExtensionsType extension_type = status_request(5) */
 163                 WPA_PUT_BE16(pos, TLS_EXT_STATUS_REQUEST);
 164                 pos += 2;
 165                 /* opaque extension_data<0..2^16-1> length */
 166                 WPA_PUT_BE16(pos, 5);
 167                 pos += 2;
 168
 169                 /*
 170                  * RFC 6066, 8:
 171                  * struct {
 172                  *     CertificateStatusType status_type;
 173                  *     select (status_type) {
 174                  *         case ocsp: OCSPStatusRequest;
 175                  *     } request;
 176                  * } CertificateStatusRequest;
 177                  *
 178                  * enum { ocsp(1), (255) } CertificateStatusType;
 179                  */
 180                 *pos++ = 1; /* status_type = ocsp(1) */
 181
 182                 /*
 183                  * struct {
 184                  *     ResponderID responder_id_list<0..2^16-1>;
 185                  *     Extensions  request_extensions;
 186                  * } OCSPStatusRequest;
 187                  *
 188                  * opaque ResponderID<1..2^16-1>;
 189                  * opaque Extensions<0..2^16-1>;
 190                  */
 191                 WPA_PUT_BE16(pos, 0); /* responder_id_list(empty) */
 192                 pos += 2;
 193                 WPA_PUT_BE16(pos, 0); /* request_extensions(empty) */
 194                 pos += 2;
 195
 196                 wpa_printf(MSG_DEBUG,
 197                            "TLSv1: Add status_request_v2 extension for OCSP stapling");
 198                 /* ExtensionsType extension_type = status_request_v2(17) */
 199                 WPA_PUT_BE16(pos, TLS_EXT_STATUS_REQUEST_V2);
 200                 pos += 2;
 201                 /* opaque extension_data<0..2^16-1> length */
 202                 WPA_PUT_BE16(pos, 7);
 203                 pos += 2;
 204
 205                 /*
 206                  * RFC 6961, 2.2:
 207                  * struct {
 208                  *     CertificateStatusType status_type;
 209                  *     uint16 request_length;
 210                  *     select (status_type) {
 211                  *         case ocsp: OCSPStatusRequest;
 212                  *         case ocsp_multi: OCSPStatusRequest;
 213                  *     } request;
 214                  * } CertificateStatusRequestItemV2;
 215                  *
 216                  * enum { ocsp(1), ocsp_multi(2), (255) } CertificateStatusType;
 217                  *
 218                  * struct {
 219                  * CertificateStatusRequestItemV2
 220                  *     certificate_status_req_list<1..2^16-1>;
 221                  * } CertificateStatusRequestListV2;
 222                  */
 223
 224                 /* certificate_status_req_list<1..2^16-1> */
 225                 WPA_PUT_BE16(pos, 5);
 226                 pos += 2;
 227
 228                 /* CertificateStatusRequestItemV2 */
 229                 *pos++ = 2; /* status_type = ocsp_multi(2) */
 230                 /* OCSPStatusRequest as shown above for v1 */
 231                 WPA_PUT_BE16(pos, 0); /* responder_id_list(empty) */
 232                 pos += 2;
 233                 WPA_PUT_BE16(pos, 0); /* request_extensions(empty) */
 234                 pos += 2;
 235         }
 236
 237         if (pos == ext_start + 2)
 238                 pos -= 2; /* no extensions */
 239         else
 240                 WPA_PUT_BE16(ext_start, pos - ext_start - 2);
 241
 242         WPA_PUT_BE24(hs_length, pos - hs_length - 3);
 243         tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
 244
 245         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 246                               rhdr, end - rhdr, hs_start, pos - hs_start,
 247                               out_len) < 0) {
 248                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to create TLS record");
 249                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 250                           TLS_ALERT_INTERNAL_ERROR);
 251                 os_free(hello);
 252                 return NULL;
 253         }
 254
 255         conn->state = SERVER_HELLO;
 256
 257         return hello;
 258 }
 259
 260
 261 static int tls_write_client_certificate(struct tlsv1_client *conn,
 262                                         u8 **msgpos, u8 *end)
 263 {
 264         u8 *pos, *rhdr, *hs_start, *hs_length, *cert_start;
 265         size_t rlen;
 266         struct x509_certificate *cert;
 267
 268         pos = *msgpos;
 269         if (TLS_RECORD_HEADER_LEN + 1 + 3 + 3 > end - pos) {
 270                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 271                           TLS_ALERT_INTERNAL_ERROR);
 272                 return -1;
 273         }
 274
 275         wpa_printf(MSG_DEBUG, "TLSv1: Send Certificate");
 276         rhdr = pos;
 277         pos += TLS_RECORD_HEADER_LEN;
 278
 279         /* opaque fragment[TLSPlaintext.length] */
 280
 281         /* Handshake */
 282         hs_start = pos;
 283         /* HandshakeType msg_type */
 284         *pos++ = TLS_HANDSHAKE_TYPE_CERTIFICATE;
 285         /* uint24 length (to be filled) */
 286         hs_length = pos;
 287         pos += 3;
 288         /* body - Certificate */
 289         /* uint24 length (to be filled) */
 290         cert_start = pos;
 291         pos += 3;
 292         cert = conn->cred ? conn->cred->cert : NULL;
 293         while (cert) {
 294                 if (3 + cert->cert_len > (size_t) (end - pos)) {
 295                         wpa_printf(MSG_DEBUG, "TLSv1: Not enough buffer space "
 296                                    "for Certificate (cert_len=%lu left=%lu)",
 297                                    (unsigned long) cert->cert_len,
 298                                    (unsigned long) (end - pos));
 299                         tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 300                                   TLS_ALERT_INTERNAL_ERROR);
 301                         return -1;
 302                 }
 303                 WPA_PUT_BE24(pos, cert->cert_len);
 304                 pos += 3;
 305                 os_memcpy(pos, cert->cert_start, cert->cert_len);
 306                 pos += cert->cert_len;
 307
 308                 if (x509_certificate_self_signed(cert))
 309                         break;
 310                 cert = x509_certificate_get_subject(conn->cred->trusted_certs,
 311                                                     &cert->issuer);
 312         }
 313         if (conn->cred == NULL || cert == conn->cred->cert || cert == NULL) {
 314                 /*
 315                  * Client was not configured with all the needed certificates
 316                  * to form a full certificate chain. The server may fail to
 317                  * validate the chain unless it is configured with all the
 318                  * missing CA certificates.
 319                  */
 320                 wpa_printf(MSG_DEBUG, "TLSv1: Full client certificate chain "
 321                            "not configured - validation may fail");
 322         }
 323         WPA_PUT_BE24(cert_start, pos - cert_start - 3);
 324
 325         WPA_PUT_BE24(hs_length, pos - hs_length - 3);
 326
 327         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 328                               rhdr, end - rhdr, hs_start, pos - hs_start,
 329                               &rlen) < 0) {
 330                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate a record");
 331                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 332                           TLS_ALERT_INTERNAL_ERROR);
 333                 return -1;
 334         }
 335         pos = rhdr + rlen;
 336
 337         tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
 338
 339         *msgpos = pos;
 340
 341         return 0;
 342 }
 343
 344
 345 static int tlsv1_key_x_dh(struct tlsv1_client *conn, u8 **pos, u8 *end)
 346 {
 347         /* ClientDiffieHellmanPublic */
 348         u8 *csecret, *csecret_start, *dh_yc, *shared;
 349         size_t csecret_len, dh_yc_len, shared_len;
 350
 351         csecret_len = conn->dh_p_len;
 352         csecret = os_malloc(csecret_len);
 353         if (csecret == NULL) {
 354                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to allocate "
 355                            "memory for Yc (Diffie-Hellman)");
 356                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 357                           TLS_ALERT_INTERNAL_ERROR);
 358                 return -1;
 359         }
 360         if (random_get_bytes(csecret, csecret_len)) {
 361                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to get random "
 362                            "data for Diffie-Hellman");
 363                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 364                           TLS_ALERT_INTERNAL_ERROR);
 365                 os_free(csecret);
 366                 return -1;
 367         }
 368
 369         if (os_memcmp(csecret, conn->dh_p, csecret_len) > 0)
 370                 csecret[0] = 0; /* make sure Yc < p */
 371
 372         csecret_start = csecret;
 373         while (csecret_len > 1 && *csecret_start == 0) {
 374                 csecret_start++;
 375                 csecret_len--;
 376         }
 377         wpa_hexdump_key(MSG_DEBUG, "TLSv1: DH client's secret value",
 378                         csecret_start, csecret_len);
 379
 380         /* Yc = g^csecret mod p */
 381         dh_yc_len = conn->dh_p_len;
 382         dh_yc = os_malloc(dh_yc_len);
 383         if (dh_yc == NULL) {
 384                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to allocate "
 385                            "memory for Diffie-Hellman");
 386                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 387                           TLS_ALERT_INTERNAL_ERROR);
 388                 os_free(csecret);
 389                 return -1;
 390         }
 391         if (crypto_mod_exp(conn->dh_g, conn->dh_g_len,
 392                            csecret_start, csecret_len,
 393                            conn->dh_p, conn->dh_p_len,
 394                            dh_yc, &dh_yc_len)) {
 395                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 396                           TLS_ALERT_INTERNAL_ERROR);
 397                 os_free(csecret);
 398                 os_free(dh_yc);
 399                 return -1;
 400         }
 401
 402         wpa_hexdump(MSG_DEBUG, "TLSv1: DH Yc (client's public value)",
 403                     dh_yc, dh_yc_len);
 404
 405         if (end - *pos < 2) {
 406                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 407                           TLS_ALERT_INTERNAL_ERROR);
 408                 os_free(csecret);
 409                 os_free(dh_yc);
 410                 return -1;
 411         }
 412         WPA_PUT_BE16(*pos, dh_yc_len);
 413         *pos += 2;
 414         if (dh_yc_len > (size_t) (end - *pos)) {
 415                 wpa_printf(MSG_DEBUG, "TLSv1: Not enough room in the "
 416                            "message buffer for Yc");
 417                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 418                           TLS_ALERT_INTERNAL_ERROR);
 419                 os_free(csecret);
 420                 os_free(dh_yc);
 421                 return -1;
 422         }
 423         os_memcpy(*pos, dh_yc, dh_yc_len);
 424         *pos += dh_yc_len;
 425         os_free(dh_yc);
 426
 427         shared_len = conn->dh_p_len;
 428         shared = os_malloc(shared_len);
 429         if (shared == NULL) {
 430                 wpa_printf(MSG_DEBUG, "TLSv1: Could not allocate memory for "
 431                            "DH");
 432                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 433                           TLS_ALERT_INTERNAL_ERROR);
 434                 os_free(csecret);
 435                 return -1;
 436         }
 437
 438         /* shared = Ys^csecret mod p */
 439         if (crypto_mod_exp(conn->dh_ys, conn->dh_ys_len,
 440                            csecret_start, csecret_len,
 441                            conn->dh_p, conn->dh_p_len,
 442                            shared, &shared_len)) {
 443                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 444                           TLS_ALERT_INTERNAL_ERROR);
 445                 os_free(csecret);
 446                 os_free(shared);
 447                 return -1;
 448         }
 449         wpa_hexdump_key(MSG_DEBUG, "TLSv1: Shared secret from DH key exchange",
 450                         shared, shared_len);
 451
 452         os_memset(csecret_start, 0, csecret_len);
 453         os_free(csecret);
 454         if (tls_derive_keys(conn, shared, shared_len)) {
 455                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive keys");
 456                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 457                           TLS_ALERT_INTERNAL_ERROR);
 458                 os_free(shared);
 459                 return -1;
 460         }
 461         os_memset(shared, 0, shared_len);
 462         os_free(shared);
 463         tlsv1_client_free_dh(conn);
 464         return 0;
 465 }
 466
 467
 468 static int tlsv1_key_x_rsa(struct tlsv1_client *conn, u8 **pos, u8 *end)
 469 {
 470         u8 pre_master_secret[TLS_PRE_MASTER_SECRET_LEN];
 471         size_t clen;
 472         int res;
 473
 474         if (tls_derive_pre_master_secret(pre_master_secret) < 0 ||
 475             tls_derive_keys(conn, pre_master_secret,
 476                             TLS_PRE_MASTER_SECRET_LEN)) {
 477                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive keys");
 478                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 479                           TLS_ALERT_INTERNAL_ERROR);
 480                 return -1;
 481         }
 482
 483         /* EncryptedPreMasterSecret */
 484         if (conn->server_rsa_key == NULL) {
 485                 wpa_printf(MSG_DEBUG, "TLSv1: No server RSA key to "
 486                            "use for encrypting pre-master secret");
 487                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 488                           TLS_ALERT_INTERNAL_ERROR);
 489                 return -1;
 490         }
 491
 492         /* RSA encrypted value is encoded with PKCS #1 v1.5 block type 2. */
 493         *pos += 2;
 494         clen = end - *pos;
 495         res = crypto_public_key_encrypt_pkcs1_v15(
 496                 conn->server_rsa_key,
 497                 pre_master_secret, TLS_PRE_MASTER_SECRET_LEN,
 498                 *pos, &clen);
 499         os_memset(pre_master_secret, 0, TLS_PRE_MASTER_SECRET_LEN);
 500         if (res < 0) {
 501                 wpa_printf(MSG_DEBUG, "TLSv1: RSA encryption failed");
 502                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 503                           TLS_ALERT_INTERNAL_ERROR);
 504                 return -1;
 505         }
 506         WPA_PUT_BE16(*pos - 2, clen);
 507         wpa_hexdump(MSG_MSGDUMP, "TLSv1: Encrypted pre_master_secret",
 508                     *pos, clen);
 509         *pos += clen;
 510
 511         return 0;
 512 }
 513
 514
 515 static int tls_write_client_key_exchange(struct tlsv1_client *conn,
 516                                          u8 **msgpos, u8 *end)
 517 {
 518         u8 *pos, *rhdr, *hs_start, *hs_length;
 519         size_t rlen;
 520         tls_key_exchange keyx;
 521         const struct tls_cipher_suite *suite;
 522
 523         suite = tls_get_cipher_suite(conn->rl.cipher_suite);
 524         if (suite == NULL)
 525                 keyx = TLS_KEY_X_NULL;
 526         else
 527                 keyx = suite->key_exchange;
 528
 529         pos = *msgpos;
 530
 531         wpa_printf(MSG_DEBUG, "TLSv1: Send ClientKeyExchange");
 532
 533         rhdr = pos;
 534         pos += TLS_RECORD_HEADER_LEN;
 535
 536         /* opaque fragment[TLSPlaintext.length] */
 537
 538         /* Handshake */
 539         hs_start = pos;
 540         /* HandshakeType msg_type */
 541         *pos++ = TLS_HANDSHAKE_TYPE_CLIENT_KEY_EXCHANGE;
 542         /* uint24 length (to be filled) */
 543         hs_length = pos;
 544         pos += 3;
 545         /* body - ClientKeyExchange */
 546         if (keyx == TLS_KEY_X_DH_anon || keyx == TLS_KEY_X_DHE_RSA) {
 547                 if (tlsv1_key_x_dh(conn, &pos, end) < 0)
 548                         return -1;
 549         } else {
 550                 if (tlsv1_key_x_rsa(conn, &pos, end) < 0)
 551                         return -1;
 552         }
 553
 554         WPA_PUT_BE24(hs_length, pos - hs_length - 3);
 555
 556         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 557                               rhdr, end - rhdr, hs_start, pos - hs_start,
 558                               &rlen) < 0) {
 559                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to create a record");
 560                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 561                           TLS_ALERT_INTERNAL_ERROR);
 562                 return -1;
 563         }
 564         pos = rhdr + rlen;
 565         tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
 566
 567         *msgpos = pos;
 568
 569         return 0;
 570 }
 571
 572
 573 static int tls_write_client_certificate_verify(struct tlsv1_client *conn,
 574                                                u8 **msgpos, u8 *end)
 575 {
 576         u8 *pos, *rhdr, *hs_start, *hs_length, *signed_start;
 577         size_t rlen, hlen, clen;
 578         u8 hash[100], *hpos;
 579
 580         pos = *msgpos;
 581
 582         wpa_printf(MSG_DEBUG, "TLSv1: Send CertificateVerify");
 583         rhdr = pos;
 584         pos += TLS_RECORD_HEADER_LEN;
 585
 586         /* Handshake */
 587         hs_start = pos;
 588         /* HandshakeType msg_type */
 589         *pos++ = TLS_HANDSHAKE_TYPE_CERTIFICATE_VERIFY;
 590         /* uint24 length (to be filled) */
 591         hs_length = pos;
 592         pos += 3;
 593
 594         /*
 595          * RFC 2246: 7.4.3 and 7.4.8:
 596          * Signature signature
 597          *
 598          * RSA:
 599          * digitally-signed struct {
 600          *     opaque md5_hash[16];
 601          *     opaque sha_hash[20];
 602          * };
 603          *
 604          * DSA:
 605          * digitally-signed struct {
 606          *     opaque sha_hash[20];
 607          * };
 608          *
 609          * The hash values are calculated over all handshake messages sent or
 610          * received starting at ClientHello up to, but not including, this
 611          * CertificateVerify message, including the type and length fields of
 612          * the handshake messages.
 613          */
 614
 615         hpos = hash;
 616
 617 #ifdef CONFIG_TLSV12
 618         if (conn->rl.tls_version == TLS_VERSION_1_2) {
 619                 hlen = SHA256_MAC_LEN;
 620                 if (conn->verify.sha256_cert == NULL ||
 621                     crypto_hash_finish(conn->verify.sha256_cert, hpos, &hlen) <
 622                     0) {
 623                         conn->verify.sha256_cert = NULL;
 624                         tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 625                                   TLS_ALERT_INTERNAL_ERROR);
 626                         return -1;
 627                 }
 628                 conn->verify.sha256_cert = NULL;
 629
 630                 /*
 631                  * RFC 3447, A.2.4 RSASSA-PKCS1-v1_5
 632                  *
 633                  * DigestInfo ::= SEQUENCE {
 634                  *   digestAlgorithm DigestAlgorithm,
 635                  *   digest OCTET STRING
 636                  * }
 637                  *
 638                  * SHA-256 OID: sha256WithRSAEncryption ::= {pkcs-1 11}
 639                  *
 640                  * DER encoded DigestInfo for SHA256 per RFC 3447:
 641                  * 30 31 30 0d 06 09 60 86 48 01 65 03 04 02 01 05 00 04 20 ||
 642                  * H
 643                  */
 644                 os_memmove(hash + 19, hash, hlen);
 645                 hlen += 19;
 646                 os_memcpy(hash, "\x30\x31\x30\x0d\x06\x09\x60\x86\x48\x01\x65"
 647                           "\x03\x04\x02\x01\x05\x00\x04\x20", 19);
 648         } else {
 649 #endif /* CONFIG_TLSV12 */
 650
 651         hlen = MD5_MAC_LEN;
 652         if (conn->verify.md5_cert == NULL ||
 653             crypto_hash_finish(conn->verify.md5_cert, hpos, &hlen) < 0) {
 654                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 655                           TLS_ALERT_INTERNAL_ERROR);
 656                 conn->verify.md5_cert = NULL;
 657                 crypto_hash_finish(conn->verify.sha1_cert, NULL, NULL);
 658                 conn->verify.sha1_cert = NULL;
 659                 return -1;
 660         }
 661         hpos += MD5_MAC_LEN;
 662
 663         conn->verify.md5_cert = NULL;
 664         hlen = SHA1_MAC_LEN;
 665         if (conn->verify.sha1_cert == NULL ||
 666             crypto_hash_finish(conn->verify.sha1_cert, hpos, &hlen) < 0) {
 667                 conn->verify.sha1_cert = NULL;
 668                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 669                           TLS_ALERT_INTERNAL_ERROR);
 670                 return -1;
 671         }
 672         conn->verify.sha1_cert = NULL;
 673
 674         hlen += MD5_MAC_LEN;
 675
 676 #ifdef CONFIG_TLSV12
 677         }
 678 #endif /* CONFIG_TLSV12 */
 679
 680         wpa_hexdump(MSG_MSGDUMP, "TLSv1: CertificateVerify hash", hash, hlen);
 681
 682 #ifdef CONFIG_TLSV12
 683         if (conn->rl.tls_version >= TLS_VERSION_1_2) {
 684                 /*
 685                  * RFC 5246, 4.7:
 686                  * TLS v1.2 adds explicit indication of the used signature and
 687                  * hash algorithms.
 688                  *
 689                  * struct {
 690                  *   HashAlgorithm hash;
 691                  *   SignatureAlgorithm signature;
 692                  * } SignatureAndHashAlgorithm;
 693                  */
 694                 *pos++ = TLS_HASH_ALG_SHA256;
 695                 *pos++ = TLS_SIGN_ALG_RSA;
 696         }
 697 #endif /* CONFIG_TLSV12 */
 698
 699         /*
 700          * RFC 2246, 4.7:
 701          * In digital signing, one-way hash functions are used as input for a
 702          * signing algorithm. A digitally-signed element is encoded as an
 703          * opaque vector <0..2^16-1>, where the length is specified by the
 704          * signing algorithm and key.
 705          *
 706          * In RSA signing, a 36-byte structure of two hashes (one SHA and one
 707          * MD5) is signed (encrypted with the private key). It is encoded with
 708          * PKCS #1 block type 0 or type 1 as described in [PKCS1].
 709          */
 710         signed_start = pos; /* length to be filled */
 711         pos += 2;
 712         clen = end - pos;
 713         if (conn->cred == NULL ||
 714             crypto_private_key_sign_pkcs1(conn->cred->key, hash, hlen,
 715                                           pos, &clen) < 0) {
 716                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to sign hash (PKCS #1)");
 717                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 718                           TLS_ALERT_INTERNAL_ERROR);
 719                 return -1;
 720         }
 721         WPA_PUT_BE16(signed_start, clen);
 722
 723         pos += clen;
 724
 725         WPA_PUT_BE24(hs_length, pos - hs_length - 3);
 726
 727         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 728                               rhdr, end - rhdr, hs_start, pos - hs_start,
 729                               &rlen) < 0) {
 730                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate a record");
 731                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 732                           TLS_ALERT_INTERNAL_ERROR);
 733                 return -1;
 734         }
 735         pos = rhdr + rlen;
 736
 737         tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
 738
 739         *msgpos = pos;
 740
 741         return 0;
 742 }
 743
 744
 745 static int tls_write_client_change_cipher_spec(struct tlsv1_client *conn,
 746                                                u8 **msgpos, u8 *end)
 747 {
 748         size_t rlen;
 749         u8 payload[1];
 750
 751         wpa_printf(MSG_DEBUG, "TLSv1: Send ChangeCipherSpec");
 752
 753         payload[0] = TLS_CHANGE_CIPHER_SPEC;
 754
 755         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_CHANGE_CIPHER_SPEC,
 756                               *msgpos, end - *msgpos, payload, sizeof(payload),
 757                               &rlen) < 0) {
 758                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to create a record");
 759                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 760                           TLS_ALERT_INTERNAL_ERROR);
 761                 return -1;
 762         }
 763
 764         if (tlsv1_record_change_write_cipher(&conn->rl) < 0) {
 765                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to set write cipher for "
 766                            "record layer");
 767                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 768                           TLS_ALERT_INTERNAL_ERROR);
 769                 return -1;
 770         }
 771
 772         *msgpos += rlen;
 773
 774         return 0;
 775 }
 776
 777
 778 static int tls_write_client_finished(struct tlsv1_client *conn,
 779                                      u8 **msgpos, u8 *end)
 780 {
 781         u8 *pos, *hs_start;
 782         size_t rlen, hlen;
 783         u8 verify_data[1 + 3 + TLS_VERIFY_DATA_LEN];
 784         u8 hash[MD5_MAC_LEN + SHA1_MAC_LEN];
 785
 786         wpa_printf(MSG_DEBUG, "TLSv1: Send Finished");
 787
 788         /* Encrypted Handshake Message: Finished */
 789
 790 #ifdef CONFIG_TLSV12
 791         if (conn->rl.tls_version >= TLS_VERSION_1_2) {
 792                 hlen = SHA256_MAC_LEN;
 793                 if (conn->verify.sha256_client == NULL ||
 794                     crypto_hash_finish(conn->verify.sha256_client, hash, &hlen)
 795                     < 0) {
 796                         tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 797                                   TLS_ALERT_INTERNAL_ERROR);
 798                         conn->verify.sha256_client = NULL;
 799                         return -1;
 800                 }
 801                 conn->verify.sha256_client = NULL;
 802         } else {
 803 #endif /* CONFIG_TLSV12 */
 804
 805         hlen = MD5_MAC_LEN;
 806         if (conn->verify.md5_client == NULL ||
 807             crypto_hash_finish(conn->verify.md5_client, hash, &hlen) < 0) {
 808                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 809                           TLS_ALERT_INTERNAL_ERROR);
 810                 conn->verify.md5_client = NULL;
 811                 crypto_hash_finish(conn->verify.sha1_client, NULL, NULL);
 812                 conn->verify.sha1_client = NULL;
 813                 return -1;
 814         }
 815         conn->verify.md5_client = NULL;
 816         hlen = SHA1_MAC_LEN;
 817         if (conn->verify.sha1_client == NULL ||
 818             crypto_hash_finish(conn->verify.sha1_client, hash + MD5_MAC_LEN,
 819                                &hlen) < 0) {
 820                 conn->verify.sha1_client = NULL;
 821                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 822                           TLS_ALERT_INTERNAL_ERROR);
 823                 return -1;
 824         }
 825         conn->verify.sha1_client = NULL;
 826         hlen = MD5_MAC_LEN + SHA1_MAC_LEN;
 827
 828 #ifdef CONFIG_TLSV12
 829         }
 830 #endif /* CONFIG_TLSV12 */
 831
 832         if (tls_prf(conn->rl.tls_version,
 833                     conn->master_secret, TLS_MASTER_SECRET_LEN,
 834                     "client finished", hash, hlen,
 835                     verify_data + 1 + 3, TLS_VERIFY_DATA_LEN)) {
 836                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate verify_data");
 837                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 838                           TLS_ALERT_INTERNAL_ERROR);
 839                 return -1;
 840         }
 841         wpa_hexdump_key(MSG_DEBUG, "TLSv1: verify_data (client)",
 842                         verify_data + 1 + 3, TLS_VERIFY_DATA_LEN);
 843
 844         /* Handshake */
 845         pos = hs_start = verify_data;
 846         /* HandshakeType msg_type */
 847         *pos++ = TLS_HANDSHAKE_TYPE_FINISHED;
 848         /* uint24 length */
 849         WPA_PUT_BE24(pos, TLS_VERIFY_DATA_LEN);
 850         pos += 3;
 851         pos += TLS_VERIFY_DATA_LEN; /* verify_data already in place */
 852         tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
 853
 854         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 855                               *msgpos, end - *msgpos, hs_start, pos - hs_start,
 856                               &rlen) < 0) {
 857                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to create a record");
 858                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 859                           TLS_ALERT_INTERNAL_ERROR);
 860                 return -1;
 861         }
 862
 863         *msgpos += rlen;
 864
 865         return 0;
 866 }
 867
 868
 869 static u8 * tls_send_client_key_exchange(struct tlsv1_client *conn,
 870                                          size_t *out_len)
 871 {
 872         u8 *msg, *end, *pos;
 873         size_t msglen;
 874
 875         *out_len = 0;
 876
 877         msglen = 2000;
 878         if (conn->certificate_requested)
 879                 msglen += tls_client_cert_chain_der_len(conn);
 880
 881         msg = os_malloc(msglen);
 882         if (msg == NULL)
 883                 return NULL;
 884
 885         pos = msg;
 886         end = msg + msglen;
 887
 888         if (conn->certificate_requested) {
 889                 if (tls_write_client_certificate(conn, &pos, end) < 0) {
 890                         os_free(msg);
 891                         return NULL;
 892                 }
 893         }
 894
 895         if (tls_write_client_key_exchange(conn, &pos, end) < 0 ||
 896             (conn->certificate_requested && conn->cred && conn->cred->key &&
 897              tls_write_client_certificate_verify(conn, &pos, end) < 0) ||
 898             tls_write_client_change_cipher_spec(conn, &pos, end) < 0 ||
 899             tls_write_client_finished(conn, &pos, end) < 0) {
 900                 os_free(msg);
 901                 return NULL;
 902         }
 903
 904         *out_len = pos - msg;
 905
 906         conn->state = SERVER_CHANGE_CIPHER_SPEC;
 907
 908         return msg;
 909 }
 910
 911
 912 static u8 * tls_send_change_cipher_spec(struct tlsv1_client *conn,
 913                                         size_t *out_len)
 914 {
 915         u8 *msg, *end, *pos;
 916
 917         *out_len = 0;
 918
 919         msg = os_malloc(1000);
 920         if (msg == NULL)
 921                 return NULL;
 922
 923         pos = msg;
 924         end = msg + 1000;
 925
 926         if (tls_write_client_change_cipher_spec(conn, &pos, end) < 0 ||
 927             tls_write_client_finished(conn, &pos, end) < 0) {
 928                 os_free(msg);
 929                 return NULL;
 930         }
 931
 932         *out_len = pos - msg;
 933
 934         wpa_printf(MSG_DEBUG, "TLSv1: Session resumption completed "
 935                    "successfully");
 936         if (!conn->session_resumed && conn->use_session_ticket)
 937                 conn->session_resumed = 1;
 938         conn->state = ESTABLISHED;
 939
 940         return msg;
 941 }
 942
 943
 944 u8 * tlsv1_client_handshake_write(struct tlsv1_client *conn, size_t *out_len,
 945                                   int no_appl_data)
 946 {
 947         switch (conn->state) {
 948         case CLIENT_KEY_EXCHANGE:
 949                 return tls_send_client_key_exchange(conn, out_len);
 950         case CHANGE_CIPHER_SPEC:
 951                 return tls_send_change_cipher_spec(conn, out_len);
 952         case ACK_FINISHED:
 953                 wpa_printf(MSG_DEBUG, "TLSv1: Handshake completed "
 954                            "successfully");
 955                 conn->state = ESTABLISHED;
 956                 *out_len = 0;
 957                 if (no_appl_data) {
 958                         /* Need to return something to get final TLS ACK. */
 959                         return os_malloc(1);
 960                 }
 961                 return NULL;
 962         default:
 963                 wpa_printf(MSG_DEBUG, "TLSv1: Unexpected state %d while "
 964                            "generating reply", conn->state);
 965                 return NULL;
 966         }
 967 }
 968
 969
 970 u8 * tlsv1_client_send_alert(struct tlsv1_client *conn, u8 level,
 971                              u8 description, size_t *out_len)
 972 {
 973         u8 *alert, *pos, *length;
 974
 975         wpa_printf(MSG_DEBUG, "TLSv1: Send Alert(%d:%d)", level, description);
 976         *out_len = 0;
 977
 978         alert = os_malloc(10);
 979         if (alert == NULL)
 980                 return NULL;
 981
 982         pos = alert;
 983
 984         /* TLSPlaintext */
 985         /* ContentType type */
 986         *pos++ = TLS_CONTENT_TYPE_ALERT;
 987         /* ProtocolVersion version */
 988         WPA_PUT_BE16(pos, conn->rl.tls_version ? conn->rl.tls_version :
 989                      TLS_VERSION);
 990         pos += 2;
 991         /* uint16 length (to be filled) */
 992         length = pos;
 993         pos += 2;
 994         /* opaque fragment[TLSPlaintext.length] */
 995
 996         /* Alert */
 997         /* AlertLevel level */
 998         *pos++ = level;
 999         /* AlertDescription description */
1000         *pos++ = description;
1001
1002         WPA_PUT_BE16(length, pos - length - 2);
1003         *out_len = pos - alert;
1004
1005         return alert;
1006 }