libeap/src/tls/tlsv1_server.c

   1 /*
   2  * TLS v1.0/v1.1/v1.2 server (RFC 2246, RFC 4346, RFC 5246)
   3  * Copyright (c) 2006-2014, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #include "common.h"
  12 #include "crypto/sha1.h"
  13 #include "crypto/tls.h"
  14 #include "tlsv1_common.h"
  15 #include "tlsv1_record.h"
  16 #include "tlsv1_server.h"
  17 #include "tlsv1_server_i.h"
  18
  19 /* TODO:
  20  * Support for a message fragmented across several records (RFC 2246, 6.2.1)
  21  */
  22
  23
  24 void tlsv1_server_log(struct tlsv1_server *conn, const char *fmt, ...)
  25 {
  26         va_list ap;
  27         char *buf;
  28         int buflen;
  29
  30         va_start(ap, fmt);
  31         buflen = vsnprintf(NULL, 0, fmt, ap) + 1;
  32         va_end(ap);
  33
  34         buf = os_malloc(buflen);
  35         if (buf == NULL)
  36                 return;
  37         va_start(ap, fmt);
  38         vsnprintf(buf, buflen, fmt, ap);
  39         va_end(ap);
  40
  41         wpa_printf(MSG_DEBUG, "TLSv1: %s", buf);
  42         if (conn->log_cb)
  43                 conn->log_cb(conn->log_cb_ctx, buf);
  44
  45         os_free(buf);
  46 }
  47
  48
  49 void tlsv1_server_alert(struct tlsv1_server *conn, u8 level, u8 description)
  50 {
  51         conn->alert_level = level;
  52         conn->alert_description = description;
  53 }
  54
  55
  56 int tlsv1_server_derive_keys(struct tlsv1_server *conn,
  57                              const u8 *pre_master_secret,
  58                              size_t pre_master_secret_len)
  59 {
  60         u8 seed[2 * TLS_RANDOM_LEN];
  61         u8 key_block[TLS_MAX_KEY_BLOCK_LEN];
  62         u8 *pos;
  63         size_t key_block_len;
  64
  65         if (pre_master_secret) {
  66                 wpa_hexdump_key(MSG_MSGDUMP, "TLSv1: pre_master_secret",
  67                                 pre_master_secret, pre_master_secret_len);
  68                 os_memcpy(seed, conn->client_random, TLS_RANDOM_LEN);
  69                 os_memcpy(seed + TLS_RANDOM_LEN, conn->server_random,
  70                           TLS_RANDOM_LEN);
  71                 if (tls_prf(conn->rl.tls_version,
  72                             pre_master_secret, pre_master_secret_len,
  73                             "master secret", seed, 2 * TLS_RANDOM_LEN,
  74                             conn->master_secret, TLS_MASTER_SECRET_LEN)) {
  75                         wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive "
  76                                    "master_secret");
  77                         return -1;
  78                 }
  79                 wpa_hexdump_key(MSG_MSGDUMP, "TLSv1: master_secret",
  80                                 conn->master_secret, TLS_MASTER_SECRET_LEN);
  81         }
  82
  83         os_memcpy(seed, conn->server_random, TLS_RANDOM_LEN);
  84         os_memcpy(seed + TLS_RANDOM_LEN, conn->client_random, TLS_RANDOM_LEN);
  85         key_block_len = 2 * (conn->rl.hash_size + conn->rl.key_material_len +
  86                              conn->rl.iv_size);
  87         if (tls_prf(conn->rl.tls_version,
  88                     conn->master_secret, TLS_MASTER_SECRET_LEN,
  89                     "key expansion", seed, 2 * TLS_RANDOM_LEN,
  90                     key_block, key_block_len)) {
  91                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive key_block");
  92                 return -1;
  93         }
  94         wpa_hexdump_key(MSG_MSGDUMP, "TLSv1: key_block",
  95                         key_block, key_block_len);
  96
  97         pos = key_block;
  98
  99         /* client_write_MAC_secret */
 100         os_memcpy(conn->rl.read_mac_secret, pos, conn->rl.hash_size);
 101         pos += conn->rl.hash_size;
 102         /* server_write_MAC_secret */
 103         os_memcpy(conn->rl.write_mac_secret, pos, conn->rl.hash_size);
 104         pos += conn->rl.hash_size;
 105
 106         /* client_write_key */
 107         os_memcpy(conn->rl.read_key, pos, conn->rl.key_material_len);
 108         pos += conn->rl.key_material_len;
 109         /* server_write_key */
 110         os_memcpy(conn->rl.write_key, pos, conn->rl.key_material_len);
 111         pos += conn->rl.key_material_len;
 112
 113         /* client_write_IV */
 114         os_memcpy(conn->rl.read_iv, pos, conn->rl.iv_size);
 115         pos += conn->rl.iv_size;
 116         /* server_write_IV */
 117         os_memcpy(conn->rl.write_iv, pos, conn->rl.iv_size);
 118         pos += conn->rl.iv_size;
 119
 120         return 0;
 121 }
 122
 123
 124 /**
 125  * tlsv1_server_handshake - Process TLS handshake
 126  * @conn: TLSv1 server connection data from tlsv1_server_init()
 127  * @in_data: Input data from TLS peer
 128  * @in_len: Input data length
 129  * @out_len: Length of the output buffer.
 130  * Returns: Pointer to output data, %NULL on failure
 131  */
 132 u8 * tlsv1_server_handshake(struct tlsv1_server *conn,
 133                             const u8 *in_data, size_t in_len,
 134                             size_t *out_len)
 135 {
 136         const u8 *pos, *end;
 137         u8 *msg = NULL, *in_msg, *in_pos, *in_end, alert, ct;
 138         size_t in_msg_len;
 139         int used;
 140
 141         if (in_data == NULL || in_len == 0) {
 142                 wpa_printf(MSG_DEBUG, "TLSv1: No input data to server");
 143                 return NULL;
 144         }
 145
 146         pos = in_data;
 147         end = in_data + in_len;
 148         in_msg = os_malloc(in_len);
 149         if (in_msg == NULL)
 150                 return NULL;
 151
 152         /* Each received packet may include multiple records */
 153         while (pos < end) {
 154                 in_msg_len = in_len;
 155                 used = tlsv1_record_receive(&conn->rl, pos, end - pos,
 156                                             in_msg, &in_msg_len, &alert);
 157                 if (used < 0) {
 158                         wpa_printf(MSG_DEBUG, "TLSv1: Processing received "
 159                                    "record failed");
 160                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL, alert);
 161                         goto failed;
 162                 }
 163                 if (used == 0) {
 164                         /* need more data */
 165                         wpa_printf(MSG_DEBUG, "TLSv1: Partial processing not "
 166                                    "yet supported");
 167                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL, alert);
 168                         goto failed;
 169                 }
 170                 ct = pos[0];
 171
 172                 in_pos = in_msg;
 173                 in_end = in_msg + in_msg_len;
 174
 175                 /* Each received record may include multiple messages of the
 176                  * same ContentType. */
 177                 while (in_pos < in_end) {
 178                         in_msg_len = in_end - in_pos;
 179                         if (tlsv1_server_process_handshake(conn, ct, in_pos,
 180                                                            &in_msg_len) < 0)
 181                                 goto failed;
 182                         in_pos += in_msg_len;
 183                 }
 184
 185                 pos += used;
 186         }
 187
 188         os_free(in_msg);
 189         in_msg = NULL;
 190
 191         msg = tlsv1_server_handshake_write(conn, out_len);
 192
 193 failed:
 194         os_free(in_msg);
 195         if (conn->alert_level) {
 196                 if (conn->state == FAILED) {
 197                         /* Avoid alert loops */
 198                         wpa_printf(MSG_DEBUG, "TLSv1: Drop alert loop");
 199                         os_free(msg);
 200                         return NULL;
 201                 }
 202                 conn->state = FAILED;
 203                 os_free(msg);
 204                 msg = tlsv1_server_send_alert(conn, conn->alert_level,
 205                                               conn->alert_description,
 206                                               out_len);
 207         }
 208
 209         return msg;
 210 }
 211
 212
 213 /**
 214  * tlsv1_server_encrypt - Encrypt data into TLS tunnel
 215  * @conn: TLSv1 server connection data from tlsv1_server_init()
 216  * @in_data: Pointer to plaintext data to be encrypted
 217  * @in_len: Input buffer length
 218  * @out_data: Pointer to output buffer (encrypted TLS data)
 219  * @out_len: Maximum out_data length
 220  * Returns: Number of bytes written to out_data, -1 on failure
 221  *
 222  * This function is used after TLS handshake has been completed successfully to
 223  * send data in the encrypted tunnel.
 224  */
 225 int tlsv1_server_encrypt(struct tlsv1_server *conn,
 226                          const u8 *in_data, size_t in_len,
 227                          u8 *out_data, size_t out_len)
 228 {
 229         size_t rlen;
 230
 231         wpa_hexdump_key(MSG_MSGDUMP, "TLSv1: Plaintext AppData",
 232                         in_data, in_len);
 233
 234         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_APPLICATION_DATA,
 235                               out_data, out_len, in_data, in_len, &rlen) < 0) {
 236                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to create a record");
 237                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 238                                    TLS_ALERT_INTERNAL_ERROR);
 239                 return -1;
 240         }
 241
 242         return rlen;
 243 }
 244
 245
 246 /**
 247  * tlsv1_server_decrypt - Decrypt data from TLS tunnel
 248  * @conn: TLSv1 server connection data from tlsv1_server_init()
 249  * @in_data: Pointer to input buffer (encrypted TLS data)
 250  * @in_len: Input buffer length
 251  * @out_data: Pointer to output buffer (decrypted data from TLS tunnel)
 252  * @out_len: Maximum out_data length
 253  * Returns: Number of bytes written to out_data, -1 on failure
 254  *
 255  * This function is used after TLS handshake has been completed successfully to
 256  * receive data from the encrypted tunnel.
 257  */
 258 int tlsv1_server_decrypt(struct tlsv1_server *conn,
 259                          const u8 *in_data, size_t in_len,
 260                          u8 *out_data, size_t out_len)
 261 {
 262         const u8 *in_end, *pos;
 263         int used;
 264         u8 alert, *out_end, *out_pos, ct;
 265         size_t olen;
 266
 267         pos = in_data;
 268         in_end = in_data + in_len;
 269         out_pos = out_data;
 270         out_end = out_data + out_len;
 271
 272         while (pos < in_end) {
 273                 ct = pos[0];
 274                 olen = out_end - out_pos;
 275                 used = tlsv1_record_receive(&conn->rl, pos, in_end - pos,
 276                                             out_pos, &olen, &alert);
 277                 if (used < 0) {
 278                         tlsv1_server_log(conn, "Record layer processing failed");
 279                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL, alert);
 280                         return -1;
 281                 }
 282                 if (used == 0) {
 283                         /* need more data */
 284                         wpa_printf(MSG_DEBUG, "TLSv1: Partial processing not "
 285                                    "yet supported");
 286                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL, alert);
 287                         return -1;
 288                 }
 289
 290                 if (ct == TLS_CONTENT_TYPE_ALERT) {
 291                         if (olen < 2) {
 292                                 tlsv1_server_log(conn, "Alert underflow");
 293                                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 294                                                    TLS_ALERT_DECODE_ERROR);
 295                                 return -1;
 296                         }
 297                         tlsv1_server_log(conn, "Received alert %d:%d",
 298                                          out_pos[0], out_pos[1]);
 299                         if (out_pos[0] == TLS_ALERT_LEVEL_WARNING) {
 300                                 /* Continue processing */
 301                                 pos += used;
 302                                 continue;
 303                         }
 304
 305                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 306                                            out_pos[1]);
 307                         return -1;
 308                 }
 309
 310                 if (ct != TLS_CONTENT_TYPE_APPLICATION_DATA) {
 311                         tlsv1_server_log(conn, "Unexpected content type 0x%x",
 312                                          pos[0]);
 313                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 314                                            TLS_ALERT_UNEXPECTED_MESSAGE);
 315                         return -1;
 316                 }
 317
 318 #ifdef CONFIG_TESTING_OPTIONS
 319                 if ((conn->test_flags &
 320                      (TLS_BREAK_VERIFY_DATA | TLS_BREAK_SRV_KEY_X_HASH |
 321                       TLS_BREAK_SRV_KEY_X_SIGNATURE)) &&
 322                     !conn->test_failure_reported) {
 323                         tlsv1_server_log(conn, "TEST-FAILURE: Client ApplData received after invalid handshake");
 324                         conn->test_failure_reported = 1;
 325                 }
 326 #endif /* CONFIG_TESTING_OPTIONS */
 327
 328                 out_pos += olen;
 329                 if (out_pos > out_end) {
 330                         wpa_printf(MSG_DEBUG, "TLSv1: Buffer not large enough "
 331                                    "for processing the received record");
 332                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 333                                            TLS_ALERT_INTERNAL_ERROR);
 334                         return -1;
 335                 }
 336
 337                 pos += used;
 338         }
 339
 340         return out_pos - out_data;
 341 }
 342
 343
 344 /**
 345  * tlsv1_server_global_init - Initialize TLSv1 server
 346  * Returns: 0 on success, -1 on failure
 347  *
 348  * This function must be called before using any other TLSv1 server functions.
 349  */
 350 int tlsv1_server_global_init(void)
 351 {
 352         return crypto_global_init();
 353 }
 354
 355
 356 /**
 357  * tlsv1_server_global_deinit - Deinitialize TLSv1 server
 358  *
 359  * This function can be used to deinitialize the TLSv1 server that was
 360  * initialized by calling tlsv1_server_global_init(). No TLSv1 server functions
 361  * can be called after this before calling tlsv1_server_global_init() again.
 362  */
 363 void tlsv1_server_global_deinit(void)
 364 {
 365         crypto_global_deinit();
 366 }
 367
 368
 369 /**
 370  * tlsv1_server_init - Initialize TLSv1 server connection
 371  * @cred: Pointer to server credentials from tlsv1_server_cred_alloc()
 372  * Returns: Pointer to TLSv1 server connection data or %NULL on failure
 373  */
 374 struct tlsv1_server * tlsv1_server_init(struct tlsv1_credentials *cred)
 375 {
 376         struct tlsv1_server *conn;
 377         size_t count;
 378         u16 *suites;
 379
 380         conn = os_zalloc(sizeof(*conn));
 381         if (conn == NULL)
 382                 return NULL;
 383
 384         conn->cred = cred;
 385
 386         conn->state = CLIENT_HELLO;
 387
 388         if (tls_verify_hash_init(&conn->verify) < 0) {
 389                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to initialize verify "
 390                            "hash");
 391                 os_free(conn);
 392                 return NULL;
 393         }
 394
 395         count = 0;
 396         suites = conn->cipher_suites;
 397         suites[count++] = TLS_DHE_RSA_WITH_AES_256_CBC_SHA256;
 398         suites[count++] = TLS_RSA_WITH_AES_256_CBC_SHA256;
 399         suites[count++] = TLS_DHE_RSA_WITH_AES_256_CBC_SHA;
 400         suites[count++] = TLS_RSA_WITH_AES_256_CBC_SHA;
 401         suites[count++] = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256;
 402         suites[count++] = TLS_RSA_WITH_AES_128_CBC_SHA256;
 403         suites[count++] = TLS_DHE_RSA_WITH_AES_128_CBC_SHA;
 404         suites[count++] = TLS_RSA_WITH_AES_128_CBC_SHA;
 405         suites[count++] = TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA;
 406         suites[count++] = TLS_RSA_WITH_3DES_EDE_CBC_SHA;
 407         suites[count++] = TLS_RSA_WITH_RC4_128_SHA;
 408         suites[count++] = TLS_RSA_WITH_RC4_128_MD5;
 409         conn->num_cipher_suites = count;
 410
 411         return conn;
 412 }
 413
 414
 415 static void tlsv1_server_clear_data(struct tlsv1_server *conn)
 416 {
 417         tlsv1_record_set_cipher_suite(&conn->rl, TLS_NULL_WITH_NULL_NULL);
 418         tlsv1_record_change_write_cipher(&conn->rl);
 419         tlsv1_record_change_read_cipher(&conn->rl);
 420         tls_verify_hash_free(&conn->verify);
 421
 422         crypto_public_key_free(conn->client_rsa_key);
 423         conn->client_rsa_key = NULL;
 424
 425         os_free(conn->session_ticket);
 426         conn->session_ticket = NULL;
 427         conn->session_ticket_len = 0;
 428         conn->use_session_ticket = 0;
 429
 430         os_free(conn->dh_secret);
 431         conn->dh_secret = NULL;
 432         conn->dh_secret_len = 0;
 433 }
 434
 435
 436 /**
 437  * tlsv1_server_deinit - Deinitialize TLSv1 server connection
 438  * @conn: TLSv1 server connection data from tlsv1_server_init()
 439  */
 440 void tlsv1_server_deinit(struct tlsv1_server *conn)
 441 {
 442         tlsv1_server_clear_data(conn);
 443         os_free(conn);
 444 }
 445
 446
 447 /**
 448  * tlsv1_server_established - Check whether connection has been established
 449  * @conn: TLSv1 server connection data from tlsv1_server_init()
 450  * Returns: 1 if connection is established, 0 if not
 451  */
 452 int tlsv1_server_established(struct tlsv1_server *conn)
 453 {
 454         return conn->state == ESTABLISHED;
 455 }
 456
 457
 458 /**
 459  * tlsv1_server_prf - Use TLS-PRF to derive keying material
 460  * @conn: TLSv1 server connection data from tlsv1_server_init()
 461  * @label: Label (e.g., description of the key) for PRF
 462  * @server_random_first: seed is 0 = client_random|server_random,
 463  * 1 = server_random|client_random
 464  * @out: Buffer for output data from TLS-PRF
 465  * @out_len: Length of the output buffer
 466  * Returns: 0 on success, -1 on failure
 467  */
 468 int tlsv1_server_prf(struct tlsv1_server *conn, const char *label,
 469                      int server_random_first, u8 *out, size_t out_len)
 470 {
 471         u8 seed[2 * TLS_RANDOM_LEN];
 472
 473         if (conn->state != ESTABLISHED)
 474                 return -1;
 475
 476         if (server_random_first) {
 477                 os_memcpy(seed, conn->server_random, TLS_RANDOM_LEN);
 478                 os_memcpy(seed + TLS_RANDOM_LEN, conn->client_random,
 479                           TLS_RANDOM_LEN);
 480         } else {
 481                 os_memcpy(seed, conn->client_random, TLS_RANDOM_LEN);
 482                 os_memcpy(seed + TLS_RANDOM_LEN, conn->server_random,
 483                           TLS_RANDOM_LEN);
 484         }
 485
 486         return tls_prf(conn->rl.tls_version,
 487                        conn->master_secret, TLS_MASTER_SECRET_LEN,
 488                        label, seed, 2 * TLS_RANDOM_LEN, out, out_len);
 489 }
 490
 491
 492 /**
 493  * tlsv1_server_get_cipher - Get current cipher name
 494  * @conn: TLSv1 server connection data from tlsv1_server_init()
 495  * @buf: Buffer for the cipher name
 496  * @buflen: buf size
 497  * Returns: 0 on success, -1 on failure
 498  *
 499  * Get the name of the currently used cipher.
 500  */
 501 int tlsv1_server_get_cipher(struct tlsv1_server *conn, char *buf,
 502                             size_t buflen)
 503 {
 504         char *cipher;
 505
 506         switch (conn->rl.cipher_suite) {
 507         case TLS_RSA_WITH_RC4_128_MD5:
 508                 cipher = "RC4-MD5";
 509                 break;
 510         case TLS_RSA_WITH_RC4_128_SHA:
 511                 cipher = "RC4-SHA";
 512                 break;
 513         case TLS_RSA_WITH_DES_CBC_SHA:
 514                 cipher = "DES-CBC-SHA";
 515                 break;
 516         case TLS_RSA_WITH_3DES_EDE_CBC_SHA:
 517                 cipher = "DES-CBC3-SHA";
 518                 break;
 519         case TLS_DHE_RSA_WITH_DES_CBC_SHA:
 520                 cipher = "DHE-RSA-DES-CBC-SHA";
 521                 break;
 522         case TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA:
 523                 cipher = "DHE-RSA-DES-CBC3-SHA";
 524                 break;
 525         case TLS_DH_anon_WITH_RC4_128_MD5:
 526                 cipher = "ADH-RC4-MD5";
 527                 break;
 528         case TLS_DH_anon_WITH_DES_CBC_SHA:
 529                 cipher = "ADH-DES-SHA";
 530                 break;
 531         case TLS_DH_anon_WITH_3DES_EDE_CBC_SHA:
 532                 cipher = "ADH-DES-CBC3-SHA";
 533                 break;
 534         case TLS_RSA_WITH_AES_128_CBC_SHA:
 535                 cipher = "AES-128-SHA";
 536                 break;
 537         case TLS_DHE_RSA_WITH_AES_128_CBC_SHA:
 538                 cipher = "DHE-RSA-AES-128-SHA";
 539                 break;
 540         case TLS_DH_anon_WITH_AES_128_CBC_SHA:
 541                 cipher = "ADH-AES-128-SHA";
 542                 break;
 543         case TLS_RSA_WITH_AES_256_CBC_SHA:
 544                 cipher = "AES-256-SHA";
 545                 break;
 546         case TLS_DHE_RSA_WITH_AES_256_CBC_SHA:
 547                 cipher = "DHE-RSA-AES-256-SHA";
 548                 break;
 549         case TLS_DH_anon_WITH_AES_256_CBC_SHA:
 550                 cipher = "ADH-AES-256-SHA";
 551                 break;
 552         case TLS_RSA_WITH_AES_128_CBC_SHA256:
 553                 cipher = "AES-128-SHA256";
 554                 break;
 555         case TLS_RSA_WITH_AES_256_CBC_SHA256:
 556                 cipher = "AES-256-SHA256";
 557                 break;
 558         case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256:
 559                 cipher = "DHE-RSA-AES-128-SHA256";
 560                 break;
 561         case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256:
 562                 cipher = "DHE-RSA-AES-256-SHA256";
 563                 break;
 564         case TLS_DH_anon_WITH_AES_128_CBC_SHA256:
 565                 cipher = "ADH-AES-128-SHA256";
 566                 break;
 567         case TLS_DH_anon_WITH_AES_256_CBC_SHA256:
 568                 cipher = "ADH-AES-256-SHA256";
 569                 break;
 570         default:
 571                 return -1;
 572         }
 573
 574         if (os_strlcpy(buf, cipher, buflen) >= buflen)
 575                 return -1;
 576         return 0;
 577 }
 578
 579
 580 /**
 581  * tlsv1_server_shutdown - Shutdown TLS connection
 582  * @conn: TLSv1 server connection data from tlsv1_server_init()
 583  * Returns: 0 on success, -1 on failure
 584  */
 585 int tlsv1_server_shutdown(struct tlsv1_server *conn)
 586 {
 587         conn->state = CLIENT_HELLO;
 588
 589         if (tls_verify_hash_init(&conn->verify) < 0) {
 590                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to re-initialize verify "
 591                            "hash");
 592                 return -1;
 593         }
 594
 595         tlsv1_server_clear_data(conn);
 596
 597         return 0;
 598 }
 599
 600
 601 /**
 602  * tlsv1_server_resumed - Was session resumption used
 603  * @conn: TLSv1 server connection data from tlsv1_server_init()
 604  * Returns: 1 if current session used session resumption, 0 if not
 605  */
 606 int tlsv1_server_resumed(struct tlsv1_server *conn)
 607 {
 608         return 0;
 609 }
 610
 611
 612 /**
 613  * tlsv1_server_get_random - Get random data from TLS connection
 614  * @conn: TLSv1 server connection data from tlsv1_server_init()
 615  * @keys: Structure of random data (filled on success)
 616  * Returns: 0 on success, -1 on failure
 617  */
 618 int tlsv1_server_get_random(struct tlsv1_server *conn, struct tls_random *keys)
 619 {
 620         os_memset(keys, 0, sizeof(*keys));
 621         if (conn->state == CLIENT_HELLO)
 622                 return -1;
 623
 624         keys->client_random = conn->client_random;
 625         keys->client_random_len = TLS_RANDOM_LEN;
 626
 627         if (conn->state != SERVER_HELLO) {
 628                 keys->server_random = conn->server_random;
 629                 keys->server_random_len = TLS_RANDOM_LEN;
 630         }
 631
 632         return 0;
 633 }
 634
 635
 636 /**
 637  * tlsv1_server_get_keyblock_size - Get TLS key_block size
 638  * @conn: TLSv1 server connection data from tlsv1_server_init()
 639  * Returns: Size of the key_block for the negotiated cipher suite or -1 on
 640  * failure
 641  */
 642 int tlsv1_server_get_keyblock_size(struct tlsv1_server *conn)
 643 {
 644         if (conn->state == CLIENT_HELLO || conn->state == SERVER_HELLO)
 645                 return -1;
 646
 647         return 2 * (conn->rl.hash_size + conn->rl.key_material_len +
 648                     conn->rl.iv_size);
 649 }
 650
 651
 652 /**
 653  * tlsv1_server_set_cipher_list - Configure acceptable cipher suites
 654  * @conn: TLSv1 server connection data from tlsv1_server_init()
 655  * @ciphers: Zero (TLS_CIPHER_NONE) terminated list of allowed ciphers
 656  * (TLS_CIPHER_*).
 657  * Returns: 0 on success, -1 on failure
 658  */
 659 int tlsv1_server_set_cipher_list(struct tlsv1_server *conn, u8 *ciphers)
 660 {
 661         size_t count;
 662         u16 *suites;
 663
 664         /* TODO: implement proper configuration of cipher suites */
 665         if (ciphers[0] == TLS_CIPHER_ANON_DH_AES128_SHA) {
 666                 count = 0;
 667                 suites = conn->cipher_suites;
 668                 suites[count++] = TLS_RSA_WITH_AES_256_CBC_SHA;
 669                 suites[count++] = TLS_RSA_WITH_AES_128_CBC_SHA;
 670                 suites[count++] = TLS_RSA_WITH_3DES_EDE_CBC_SHA;
 671                 suites[count++] = TLS_RSA_WITH_RC4_128_SHA;
 672                 suites[count++] = TLS_RSA_WITH_RC4_128_MD5;
 673                 suites[count++] = TLS_DH_anon_WITH_AES_256_CBC_SHA;
 674                 suites[count++] = TLS_DH_anon_WITH_AES_128_CBC_SHA;
 675                 suites[count++] = TLS_DH_anon_WITH_3DES_EDE_CBC_SHA;
 676                 suites[count++] = TLS_DH_anon_WITH_RC4_128_MD5;
 677                 suites[count++] = TLS_DH_anon_WITH_DES_CBC_SHA;
 678                 conn->num_cipher_suites = count;
 679         }
 680
 681         return 0;
 682 }
 683
 684
 685 int tlsv1_server_set_verify(struct tlsv1_server *conn, int verify_peer)
 686 {
 687         conn->verify_peer = verify_peer;
 688         return 0;
 689 }
 690
 691
 692 void tlsv1_server_set_session_ticket_cb(struct tlsv1_server *conn,
 693                                         tlsv1_server_session_ticket_cb cb,
 694                                         void *ctx)
 695 {
 696         wpa_printf(MSG_DEBUG, "TLSv1: SessionTicket callback set %p (ctx %p)",
 697                    cb, ctx);
 698         conn->session_ticket_cb = cb;
 699         conn->session_ticket_cb_ctx = ctx;
 700 }
 701
 702
 703 void tlsv1_server_set_log_cb(struct tlsv1_server *conn,
 704                              void (*cb)(void *ctx, const char *msg), void *ctx)
 705 {
 706         conn->log_cb = cb;
 707         conn->log_cb_ctx = ctx;
 708 }
 709
 710
 711 #ifdef CONFIG_TESTING_OPTIONS
 712 void tlsv1_server_set_test_flags(struct tlsv1_server *conn, u32 flags)
 713 {
 714         conn->test_flags = flags;
 715 }
 716
 717
 718 static const u8 test_tls_prime15[1] = {
 719         15
 720 };
 721
 722 static const u8 test_tls_prime511b[64] = {
 723         0x50, 0xfb, 0xf1, 0xae, 0x01, 0xf1, 0xfe, 0xe6,
 724         0xe1, 0xae, 0xdc, 0x1e, 0xbe, 0xfb, 0x9e, 0x58,
 725         0x9a, 0xd7, 0x54, 0x9d, 0x6b, 0xb3, 0x78, 0xe2,
 726         0x39, 0x7f, 0x30, 0x01, 0x25, 0xa1, 0xf9, 0x7c,
 727         0x55, 0x0e, 0xa1, 0x15, 0xcc, 0x36, 0x34, 0xbb,
 728         0x6c, 0x8b, 0x64, 0x45, 0x15, 0x7f, 0xd3, 0xe7,
 729         0x31, 0xc8, 0x8e, 0x56, 0x8e, 0x95, 0xdc, 0xea,
 730         0x9e, 0xdf, 0xf7, 0x56, 0xdd, 0xb0, 0x34, 0xdb
 731 };
 732
 733 static const u8 test_tls_prime767b[96] = {
 734         0x4c, 0xdc, 0xb8, 0x21, 0x20, 0x9d, 0xe8, 0xa3,
 735         0x53, 0xd9, 0x1c, 0x18, 0xc1, 0x3a, 0x58, 0x67,
 736         0xa7, 0x85, 0xf9, 0x28, 0x9b, 0xce, 0xc0, 0xd1,
 737         0x05, 0x84, 0x61, 0x97, 0xb2, 0x86, 0x1c, 0xd0,
 738         0xd1, 0x96, 0x23, 0x29, 0x8c, 0xc5, 0x30, 0x68,
 739         0x3e, 0xf9, 0x05, 0xba, 0x60, 0xeb, 0xdb, 0xee,
 740         0x2d, 0xdf, 0x84, 0x65, 0x49, 0x87, 0x90, 0x2a,
 741         0xc9, 0x8e, 0x34, 0x63, 0x6d, 0x9a, 0x2d, 0x32,
 742         0x1c, 0x46, 0xd5, 0x4e, 0x20, 0x20, 0x90, 0xac,
 743         0xd5, 0x48, 0x79, 0x99, 0x0c, 0xe6, 0xed, 0xbf,
 744         0x79, 0xc2, 0x47, 0x50, 0x95, 0x38, 0x38, 0xbc,
 745         0xde, 0xb0, 0xd2, 0xe8, 0x97, 0xcb, 0x22, 0xbb
 746 };
 747
 748 static const u8 test_tls_prime58[128] = {
 749         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 750         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 751         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 752         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 753         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 754         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 755         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 756         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 757         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 758         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 759         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 760         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 761         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 762         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 763         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 764         0x03, 0xc1, 0xba, 0xc8, 0x25, 0xbe, 0x2d, 0xf3
 765 };
 766
 767 static const u8 test_tls_non_prime[] = {
 768         /*
 769          * This is not a prime and the value has the following factors:
 770          * 13736783488716579923 * 16254860191773456563 * 18229434976173670763 *
 771          * 11112313018289079419 * 10260802278580253339 * 12394009491575311499 *
 772          * 12419059668711064739 * 14317973192687985827 * 10498605410533203179 *
 773          * 16338688760390249003 * 11128963991123878883 * 12990532258280301419 *
 774          * 3
 775          */
 776         0x0C, 0x8C, 0x36, 0x9C, 0x6F, 0x71, 0x2E, 0xA7,
 777         0xAB, 0x32, 0xD3, 0x0F, 0x68, 0x3D, 0xB2, 0x6D,
 778         0x81, 0xDD, 0xC4, 0x84, 0x0D, 0x9C, 0x6E, 0x36,
 779         0x29, 0x70, 0xF3, 0x1E, 0x9A, 0x42, 0x0B, 0x67,
 780         0x82, 0x6B, 0xB1, 0xF2, 0xAF, 0x55, 0x28, 0xE7,
 781         0xDB, 0x67, 0x6C, 0xF7, 0x6B, 0xAC, 0xAC, 0xE5,
 782         0xF7, 0x9F, 0xD4, 0x63, 0x55, 0x70, 0x32, 0x7C,
 783         0x70, 0xFB, 0xAF, 0xB8, 0xEB, 0x37, 0xCF, 0x3F,
 784         0xFE, 0x94, 0x73, 0xF9, 0x7A, 0xC7, 0x12, 0x2E,
 785         0x9B, 0xB4, 0x7D, 0x08, 0x60, 0x83, 0x43, 0x52,
 786         0x83, 0x1E, 0xA5, 0xFC, 0xFA, 0x87, 0x12, 0xF4,
 787         0x64, 0xE2, 0xCE, 0x71, 0x17, 0x72, 0xB6, 0xAB
 788 };
 789
 790 #endif /* CONFIG_TESTING_OPTIONS */
 791
 792
 793 void tlsv1_server_get_dh_p(struct tlsv1_server *conn, const u8 **dh_p,
 794                            size_t *dh_p_len)
 795 {
 796         *dh_p = conn->cred->dh_p;
 797         *dh_p_len = conn->cred->dh_p_len;
 798
 799 #ifdef CONFIG_TESTING_OPTIONS
 800         if (conn->test_flags & TLS_DHE_PRIME_511B) {
 801                 tlsv1_server_log(conn, "TESTING: Use short 511-bit prime with DHE");
 802                 *dh_p = test_tls_prime511b;
 803                 *dh_p_len = sizeof(test_tls_prime511b);
 804         } else if (conn->test_flags & TLS_DHE_PRIME_767B) {
 805                 tlsv1_server_log(conn, "TESTING: Use short 767-bit prime with DHE");
 806                 *dh_p = test_tls_prime767b;
 807                 *dh_p_len = sizeof(test_tls_prime767b);
 808         } else if (conn->test_flags & TLS_DHE_PRIME_15) {
 809                 tlsv1_server_log(conn, "TESTING: Use bogus 15 \"prime\" with DHE");
 810                 *dh_p = test_tls_prime15;
 811                 *dh_p_len = sizeof(test_tls_prime15);
 812         } else if (conn->test_flags & TLS_DHE_PRIME_58B) {
 813                 tlsv1_server_log(conn, "TESTING: Use short 58-bit prime in long container with DHE");
 814                 *dh_p = test_tls_prime58;
 815                 *dh_p_len = sizeof(test_tls_prime58);
 816         } else if (conn->test_flags & TLS_DHE_NON_PRIME) {
 817                 tlsv1_server_log(conn, "TESTING: Use claim non-prime as the DHE prime");
 818                 *dh_p = test_tls_non_prime;
 819                 *dh_p_len = sizeof(test_tls_non_prime);
 820         }
 821 #endif /* CONFIG_TESTING_OPTIONS */
 822 }