libeap/src/tls/tlsv1_server_write.c

   1 /*
   2  * TLSv1 server - write handshake message
   3  * Copyright (c) 2006-2014, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #include "common.h"
  12 #include "crypto/md5.h"
  13 #include "crypto/sha1.h"
  14 #include "crypto/sha256.h"
  15 #include "crypto/tls.h"
  16 #include "crypto/random.h"
  17 #include "x509v3.h"
  18 #include "tlsv1_common.h"
  19 #include "tlsv1_record.h"
  20 #include "tlsv1_server.h"
  21 #include "tlsv1_server_i.h"
  22
  23
  24 static size_t tls_server_cert_chain_der_len(struct tlsv1_server *conn)
  25 {
  26         size_t len = 0;
  27         struct x509_certificate *cert;
  28
  29         cert = conn->cred->cert;
  30         while (cert) {
  31                 len += 3 + cert->cert_len;
  32                 if (x509_certificate_self_signed(cert))
  33                         break;
  34                 cert = x509_certificate_get_subject(conn->cred->trusted_certs,
  35                                                     &cert->issuer);
  36         }
  37
  38         return len;
  39 }
  40
  41
  42 static int tls_write_server_hello(struct tlsv1_server *conn,
  43                                   u8 **msgpos, u8 *end)
  44 {
  45         u8 *pos, *rhdr, *hs_start, *hs_length;
  46         struct os_time now;
  47         size_t rlen;
  48
  49         pos = *msgpos;
  50
  51         tlsv1_server_log(conn, "Send ServerHello");
  52         rhdr = pos;
  53         pos += TLS_RECORD_HEADER_LEN;
  54
  55         os_get_time(&now);
  56         WPA_PUT_BE32(conn->server_random, now.sec);
  57         if (random_get_bytes(conn->server_random + 4, TLS_RANDOM_LEN - 4)) {
  58                 wpa_printf(MSG_ERROR, "TLSv1: Could not generate "
  59                            "server_random");
  60                 return -1;
  61         }
  62         wpa_hexdump(MSG_MSGDUMP, "TLSv1: server_random",
  63                     conn->server_random, TLS_RANDOM_LEN);
  64
  65         conn->session_id_len = TLS_SESSION_ID_MAX_LEN;
  66         if (random_get_bytes(conn->session_id, conn->session_id_len)) {
  67                 wpa_printf(MSG_ERROR, "TLSv1: Could not generate "
  68                            "session_id");
  69                 return -1;
  70         }
  71         wpa_hexdump(MSG_MSGDUMP, "TLSv1: session_id",
  72                     conn->session_id, conn->session_id_len);
  73
  74         /* opaque fragment[TLSPlaintext.length] */
  75
  76         /* Handshake */
  77         hs_start = pos;
  78         /* HandshakeType msg_type */
  79         *pos++ = TLS_HANDSHAKE_TYPE_SERVER_HELLO;
  80         /* uint24 length (to be filled) */
  81         hs_length = pos;
  82         pos += 3;
  83         /* body - ServerHello */
  84         /* ProtocolVersion server_version */
  85         WPA_PUT_BE16(pos, conn->rl.tls_version);
  86         pos += 2;
  87         /* Random random: uint32 gmt_unix_time, opaque random_bytes */
  88         os_memcpy(pos, conn->server_random, TLS_RANDOM_LEN);
  89         pos += TLS_RANDOM_LEN;
  90         /* SessionID session_id */
  91         *pos++ = conn->session_id_len;
  92         os_memcpy(pos, conn->session_id, conn->session_id_len);
  93         pos += conn->session_id_len;
  94         /* CipherSuite cipher_suite */
  95         WPA_PUT_BE16(pos, conn->cipher_suite);
  96         pos += 2;
  97         /* CompressionMethod compression_method */
  98         *pos++ = TLS_COMPRESSION_NULL;
  99
 100         if (conn->session_ticket && conn->session_ticket_cb) {
 101                 int res = conn->session_ticket_cb(
 102                         conn->session_ticket_cb_ctx,
 103                         conn->session_ticket, conn->session_ticket_len,
 104                         conn->client_random, conn->server_random,
 105                         conn->master_secret);
 106                 if (res < 0) {
 107                         tlsv1_server_log(conn, "SessionTicket callback indicated failure");
 108                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 109                                            TLS_ALERT_HANDSHAKE_FAILURE);
 110                         return -1;
 111                 }
 112                 conn->use_session_ticket = res;
 113
 114                 if (conn->use_session_ticket) {
 115                         if (tlsv1_server_derive_keys(conn, NULL, 0) < 0) {
 116                                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to "
 117                                            "derive keys");
 118                                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 119                                                    TLS_ALERT_INTERNAL_ERROR);
 120                                 return -1;
 121                         }
 122                 }
 123
 124                 /*
 125                  * RFC 4507 specifies that server would include an empty
 126                  * SessionTicket extension in ServerHello and a
 127                  * NewSessionTicket message after the ServerHello. However,
 128                  * EAP-FAST (RFC 4851), i.e., the only user of SessionTicket
 129                  * extension at the moment, does not use such extensions.
 130                  *
 131                  * TODO: Add support for configuring RFC 4507 behavior and make
 132                  * EAP-FAST disable it.
 133                  */
 134         }
 135
 136         WPA_PUT_BE24(hs_length, pos - hs_length - 3);
 137         tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
 138
 139         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 140                               rhdr, end - rhdr, hs_start, pos - hs_start,
 141                               &rlen) < 0) {
 142                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to create TLS record");
 143                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 144                                    TLS_ALERT_INTERNAL_ERROR);
 145                 return -1;
 146         }
 147         pos = rhdr + rlen;
 148
 149         *msgpos = pos;
 150
 151         return 0;
 152 }
 153
 154
 155 static int tls_write_server_certificate(struct tlsv1_server *conn,
 156                                         u8 **msgpos, u8 *end)
 157 {
 158         u8 *pos, *rhdr, *hs_start, *hs_length, *cert_start;
 159         size_t rlen;
 160         struct x509_certificate *cert;
 161         const struct tls_cipher_suite *suite;
 162
 163         suite = tls_get_cipher_suite(conn->rl.cipher_suite);
 164         if (suite && suite->key_exchange == TLS_KEY_X_DH_anon) {
 165                 wpa_printf(MSG_DEBUG, "TLSv1: Do not send Certificate when "
 166                            "using anonymous DH");
 167                 return 0;
 168         }
 169
 170         pos = *msgpos;
 171
 172         tlsv1_server_log(conn, "Send Certificate");
 173         rhdr = pos;
 174         pos += TLS_RECORD_HEADER_LEN;
 175
 176         /* opaque fragment[TLSPlaintext.length] */
 177
 178         /* Handshake */
 179         hs_start = pos;
 180         /* HandshakeType msg_type */
 181         *pos++ = TLS_HANDSHAKE_TYPE_CERTIFICATE;
 182         /* uint24 length (to be filled) */
 183         hs_length = pos;
 184         pos += 3;
 185         /* body - Certificate */
 186         /* uint24 length (to be filled) */
 187         cert_start = pos;
 188         pos += 3;
 189         cert = conn->cred->cert;
 190         while (cert) {
 191                 if (pos + 3 + cert->cert_len > end) {
 192                         wpa_printf(MSG_DEBUG, "TLSv1: Not enough buffer space "
 193                                    "for Certificate (cert_len=%lu left=%lu)",
 194                                    (unsigned long) cert->cert_len,
 195                                    (unsigned long) (end - pos));
 196                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 197                                            TLS_ALERT_INTERNAL_ERROR);
 198                         return -1;
 199                 }
 200                 WPA_PUT_BE24(pos, cert->cert_len);
 201                 pos += 3;
 202                 os_memcpy(pos, cert->cert_start, cert->cert_len);
 203                 pos += cert->cert_len;
 204
 205                 if (x509_certificate_self_signed(cert))
 206                         break;
 207                 cert = x509_certificate_get_subject(conn->cred->trusted_certs,
 208                                                     &cert->issuer);
 209         }
 210         if (cert == conn->cred->cert || cert == NULL) {
 211                 /*
 212                  * Server was not configured with all the needed certificates
 213                  * to form a full certificate chain. The client may fail to
 214                  * validate the chain unless it is configured with all the
 215                  * missing CA certificates.
 216                  */
 217                 wpa_printf(MSG_DEBUG, "TLSv1: Full server certificate chain "
 218                            "not configured - validation may fail");
 219         }
 220         WPA_PUT_BE24(cert_start, pos - cert_start - 3);
 221
 222         WPA_PUT_BE24(hs_length, pos - hs_length - 3);
 223
 224         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 225                               rhdr, end - rhdr, hs_start, pos - hs_start,
 226                               &rlen) < 0) {
 227                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate a record");
 228                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 229                                    TLS_ALERT_INTERNAL_ERROR);
 230                 return -1;
 231         }
 232         pos = rhdr + rlen;
 233
 234         tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
 235
 236         *msgpos = pos;
 237
 238         return 0;
 239 }
 240
 241
 242 static int tls_write_server_key_exchange(struct tlsv1_server *conn,
 243                                          u8 **msgpos, u8 *end)
 244 {
 245         tls_key_exchange keyx;
 246         const struct tls_cipher_suite *suite;
 247         u8 *pos, *rhdr, *hs_start, *hs_length, *server_params;
 248         size_t rlen;
 249         u8 *dh_ys;
 250         size_t dh_ys_len;
 251         const u8 *dh_p;
 252         size_t dh_p_len;
 253
 254         suite = tls_get_cipher_suite(conn->rl.cipher_suite);
 255         if (suite == NULL)
 256                 keyx = TLS_KEY_X_NULL;
 257         else
 258                 keyx = suite->key_exchange;
 259
 260         if (!tls_server_key_exchange_allowed(conn->rl.cipher_suite)) {
 261                 wpa_printf(MSG_DEBUG, "TLSv1: No ServerKeyExchange needed");
 262                 return 0;
 263         }
 264
 265         if (keyx != TLS_KEY_X_DH_anon && keyx != TLS_KEY_X_DHE_RSA) {
 266                 wpa_printf(MSG_DEBUG, "TLSv1: ServerKeyExchange not yet "
 267                            "supported with key exchange type %d", keyx);
 268                 return -1;
 269         }
 270
 271         if (conn->cred == NULL || conn->cred->dh_p == NULL ||
 272             conn->cred->dh_g == NULL) {
 273                 wpa_printf(MSG_DEBUG, "TLSv1: No DH parameters available for "
 274                            "ServerKeyExhcange");
 275                 return -1;
 276         }
 277
 278         tlsv1_server_get_dh_p(conn, &dh_p, &dh_p_len);
 279
 280         os_free(conn->dh_secret);
 281         conn->dh_secret_len = dh_p_len;
 282         conn->dh_secret = os_malloc(conn->dh_secret_len);
 283         if (conn->dh_secret == NULL) {
 284                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to allocate "
 285                            "memory for secret (Diffie-Hellman)");
 286                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 287                                    TLS_ALERT_INTERNAL_ERROR);
 288                 return -1;
 289         }
 290         if (random_get_bytes(conn->dh_secret, conn->dh_secret_len)) {
 291                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to get random "
 292                            "data for Diffie-Hellman");
 293                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 294                                    TLS_ALERT_INTERNAL_ERROR);
 295                 os_free(conn->dh_secret);
 296                 conn->dh_secret = NULL;
 297                 return -1;
 298         }
 299
 300         if (os_memcmp(conn->dh_secret, dh_p, conn->dh_secret_len) > 0)
 301                 conn->dh_secret[0] = 0; /* make sure secret < p */
 302
 303         pos = conn->dh_secret;
 304         while (pos + 1 < conn->dh_secret + conn->dh_secret_len && *pos == 0)
 305                 pos++;
 306         if (pos != conn->dh_secret) {
 307                 os_memmove(conn->dh_secret, pos,
 308                            conn->dh_secret_len - (pos - conn->dh_secret));
 309                 conn->dh_secret_len -= pos - conn->dh_secret;
 310         }
 311         wpa_hexdump_key(MSG_DEBUG, "TLSv1: DH server's secret value",
 312                         conn->dh_secret, conn->dh_secret_len);
 313
 314         /* Ys = g^secret mod p */
 315         dh_ys_len = dh_p_len;
 316         dh_ys = os_malloc(dh_ys_len);
 317         if (dh_ys == NULL) {
 318                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to allocate memory for "
 319                            "Diffie-Hellman");
 320                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 321                                    TLS_ALERT_INTERNAL_ERROR);
 322                 return -1;
 323         }
 324         if (crypto_mod_exp(conn->cred->dh_g, conn->cred->dh_g_len,
 325                            conn->dh_secret, conn->dh_secret_len,
 326                            dh_p, dh_p_len, dh_ys, &dh_ys_len)) {
 327                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 328                                    TLS_ALERT_INTERNAL_ERROR);
 329                 os_free(dh_ys);
 330                 return -1;
 331         }
 332
 333         wpa_hexdump(MSG_DEBUG, "TLSv1: DH Ys (server's public value)",
 334                     dh_ys, dh_ys_len);
 335
 336         /*
 337          * struct {
 338          *    select (KeyExchangeAlgorithm) {
 339          *       case diffie_hellman:
 340          *          ServerDHParams params;
 341          *          Signature signed_params;
 342          *       case rsa:
 343          *          ServerRSAParams params;
 344          *          Signature signed_params;
 345          *    };
 346          * } ServerKeyExchange;
 347          *
 348          * struct {
 349          *    opaque dh_p<1..2^16-1>;
 350          *    opaque dh_g<1..2^16-1>;
 351          *    opaque dh_Ys<1..2^16-1>;
 352          * } ServerDHParams;
 353          */
 354
 355         pos = *msgpos;
 356
 357         tlsv1_server_log(conn, "Send ServerKeyExchange");
 358         rhdr = pos;
 359         pos += TLS_RECORD_HEADER_LEN;
 360
 361         /* opaque fragment[TLSPlaintext.length] */
 362
 363         /* Handshake */
 364         hs_start = pos;
 365         /* HandshakeType msg_type */
 366         *pos++ = TLS_HANDSHAKE_TYPE_SERVER_KEY_EXCHANGE;
 367         /* uint24 length (to be filled) */
 368         hs_length = pos;
 369         pos += 3;
 370
 371         /* body - ServerDHParams */
 372         server_params = pos;
 373         /* dh_p */
 374         if (pos + 2 + dh_p_len > end) {
 375                 wpa_printf(MSG_DEBUG, "TLSv1: Not enough buffer space for "
 376                            "dh_p");
 377                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 378                                    TLS_ALERT_INTERNAL_ERROR);
 379                 os_free(dh_ys);
 380                 return -1;
 381         }
 382         WPA_PUT_BE16(pos, dh_p_len);
 383         pos += 2;
 384         os_memcpy(pos, dh_p, dh_p_len);
 385         pos += dh_p_len;
 386
 387         /* dh_g */
 388         if (pos + 2 + conn->cred->dh_g_len > end) {
 389                 wpa_printf(MSG_DEBUG, "TLSv1: Not enough buffer space for "
 390                            "dh_g");
 391                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 392                                    TLS_ALERT_INTERNAL_ERROR);
 393                 os_free(dh_ys);
 394                 return -1;
 395         }
 396         WPA_PUT_BE16(pos, conn->cred->dh_g_len);
 397         pos += 2;
 398         os_memcpy(pos, conn->cred->dh_g, conn->cred->dh_g_len);
 399         pos += conn->cred->dh_g_len;
 400
 401         /* dh_Ys */
 402         if (pos + 2 + dh_ys_len > end) {
 403                 wpa_printf(MSG_DEBUG, "TLSv1: Not enough buffer space for "
 404                            "dh_Ys");
 405                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 406                                    TLS_ALERT_INTERNAL_ERROR);
 407                 os_free(dh_ys);
 408                 return -1;
 409         }
 410         WPA_PUT_BE16(pos, dh_ys_len);
 411         pos += 2;
 412         os_memcpy(pos, dh_ys, dh_ys_len);
 413         pos += dh_ys_len;
 414         os_free(dh_ys);
 415
 416         /*
 417          * select (SignatureAlgorithm)
 418          * {   case anonymous: struct { };
 419          *     case rsa:
 420          *         digitally-signed struct {
 421          *             opaque md5_hash[16];
 422          *             opaque sha_hash[20];
 423          *         };
 424          *     case dsa:
 425          *         digitally-signed struct {
 426          *             opaque sha_hash[20];
 427          *         };
 428          * } Signature;
 429          *
 430          * md5_hash
 431          *     MD5(ClientHello.random + ServerHello.random + ServerParams);
 432          *
 433          * sha_hash
 434          *     SHA(ClientHello.random + ServerHello.random + ServerParams);
 435          */
 436
 437         if (keyx == TLS_KEY_X_DHE_RSA) {
 438                 u8 hash[100];
 439                 u8 *signed_start;
 440                 size_t clen;
 441                 int hlen;
 442
 443                 if (conn->rl.tls_version >= TLS_VERSION_1_2) {
 444 #ifdef CONFIG_TLSV12
 445                         hlen = tlsv12_key_x_server_params_hash(
 446                                 conn->rl.tls_version, conn->client_random,
 447                                 conn->server_random, server_params,
 448                                 pos - server_params, hash + 19);
 449
 450                         /*
 451                          * RFC 5246, 4.7:
 452                          * TLS v1.2 adds explicit indication of the used
 453                          * signature and hash algorithms.
 454                          *
 455                          * struct {
 456                          *   HashAlgorithm hash;
 457                          *   SignatureAlgorithm signature;
 458                          * } SignatureAndHashAlgorithm;
 459                          */
 460                         if (hlen < 0 || pos + 2 > end) {
 461                                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 462                                                    TLS_ALERT_INTERNAL_ERROR);
 463                                 return -1;
 464                         }
 465                         *pos++ = TLS_HASH_ALG_SHA256;
 466                         *pos++ = TLS_SIGN_ALG_RSA;
 467
 468                         /*
 469                          * RFC 3447, A.2.4 RSASSA-PKCS1-v1_5
 470                          *
 471                          * DigestInfo ::= SEQUENCE {
 472                          *   digestAlgorithm DigestAlgorithm,
 473                          *   digest OCTET STRING
 474                          * }
 475                          *
 476                          * SHA-256 OID: sha256WithRSAEncryption ::= {pkcs-1 11}
 477                          *
 478                          * DER encoded DigestInfo for SHA256 per RFC 3447:
 479                          * 30 31 30 0d 06 09 60 86 48 01 65 03 04 02 01 05 00
 480                          * 04 20 || H
 481                          */
 482                         hlen += 19;
 483                         os_memcpy(hash,
 484                                   "\x30\x31\x30\x0d\x06\x09\x60\x86\x48\x01\x65"
 485                                   "\x03\x04\x02\x01\x05\x00\x04\x20", 19);
 486
 487 #else /* CONFIG_TLSV12 */
 488                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 489                                            TLS_ALERT_INTERNAL_ERROR);
 490                         return -1;
 491 #endif /* CONFIG_TLSV12 */
 492                 } else {
 493                         hlen = tls_key_x_server_params_hash(
 494                                 conn->rl.tls_version, conn->client_random,
 495                                 conn->server_random, server_params,
 496                                 pos - server_params, hash);
 497                 }
 498
 499                 if (hlen < 0) {
 500                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 501                                            TLS_ALERT_INTERNAL_ERROR);
 502                         return -1;
 503                 }
 504
 505                 wpa_hexdump(MSG_MSGDUMP, "TLS: ServerKeyExchange signed_params hash",
 506                             hash, hlen);
 507 #ifdef CONFIG_TESTING_OPTIONS
 508                 if (conn->test_flags & TLS_BREAK_SRV_KEY_X_HASH) {
 509                         tlsv1_server_log(conn, "TESTING: Break ServerKeyExchange signed params hash");
 510                         hash[hlen - 1] ^= 0x80;
 511                 }
 512 #endif /* CONFIG_TESTING_OPTIONS */
 513
 514                 /*
 515                  * RFC 2246, 4.7:
 516                  * In digital signing, one-way hash functions are used as input
 517                  * for a signing algorithm. A digitally-signed element is
 518                  * encoded as an opaque vector <0..2^16-1>, where the length is
 519                  * specified by the signing algorithm and key.
 520                  *
 521                  * In RSA signing, a 36-byte structure of two hashes (one SHA
 522                  * and one MD5) is signed (encrypted with the private key). It
 523                  * is encoded with PKCS #1 block type 0 or type 1 as described
 524                  * in [PKCS1].
 525                  */
 526                 signed_start = pos; /* length to be filled */
 527                 pos += 2;
 528                 clen = end - pos;
 529                 if (conn->cred == NULL ||
 530                     crypto_private_key_sign_pkcs1(conn->cred->key, hash, hlen,
 531                                                   pos, &clen) < 0) {
 532                         wpa_printf(MSG_DEBUG, "TLSv1: Failed to sign hash (PKCS #1)");
 533                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 534                                            TLS_ALERT_INTERNAL_ERROR);
 535                         return -1;
 536                 }
 537                 WPA_PUT_BE16(signed_start, clen);
 538 #ifdef CONFIG_TESTING_OPTIONS
 539                 if (conn->test_flags & TLS_BREAK_SRV_KEY_X_SIGNATURE) {
 540                         tlsv1_server_log(conn, "TESTING: Break ServerKeyExchange signed params signature");
 541                         pos[clen - 1] ^= 0x80;
 542                 }
 543 #endif /* CONFIG_TESTING_OPTIONS */
 544
 545                 pos += clen;
 546         }
 547
 548         WPA_PUT_BE24(hs_length, pos - hs_length - 3);
 549
 550         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 551                               rhdr, end - rhdr, hs_start, pos - hs_start,
 552                               &rlen) < 0) {
 553                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate a record");
 554                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 555                                    TLS_ALERT_INTERNAL_ERROR);
 556                 return -1;
 557         }
 558         pos = rhdr + rlen;
 559
 560         tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
 561
 562         *msgpos = pos;
 563
 564         return 0;
 565 }
 566
 567
 568 static int tls_write_server_certificate_request(struct tlsv1_server *conn,
 569                                                 u8 **msgpos, u8 *end)
 570 {
 571         u8 *pos, *rhdr, *hs_start, *hs_length;
 572         size_t rlen;
 573
 574         if (!conn->verify_peer) {
 575                 wpa_printf(MSG_DEBUG, "TLSv1: No CertificateRequest needed");
 576                 return 0;
 577         }
 578
 579         pos = *msgpos;
 580
 581         tlsv1_server_log(conn, "Send CertificateRequest");
 582         rhdr = pos;
 583         pos += TLS_RECORD_HEADER_LEN;
 584
 585         /* opaque fragment[TLSPlaintext.length] */
 586
 587         /* Handshake */
 588         hs_start = pos;
 589         /* HandshakeType msg_type */
 590         *pos++ = TLS_HANDSHAKE_TYPE_CERTIFICATE_REQUEST;
 591         /* uint24 length (to be filled) */
 592         hs_length = pos;
 593         pos += 3;
 594         /* body - CertificateRequest */
 595
 596         /*
 597          * enum {
 598          *   rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
 599          *   (255)
 600          * } ClientCertificateType;
 601          * ClientCertificateType certificate_types<1..2^8-1>
 602          */
 603         *pos++ = 1;
 604         *pos++ = 1; /* rsa_sign */
 605
 606         /*
 607          * opaque DistinguishedName<1..2^16-1>
 608          * DistinguishedName certificate_authorities<3..2^16-1>
 609          */
 610         /* TODO: add support for listing DNs for trusted CAs */
 611         WPA_PUT_BE16(pos, 0);
 612         pos += 2;
 613
 614         WPA_PUT_BE24(hs_length, pos - hs_length - 3);
 615
 616         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 617                               rhdr, end - rhdr, hs_start, pos - hs_start,
 618                               &rlen) < 0) {
 619                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate a record");
 620                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 621                                    TLS_ALERT_INTERNAL_ERROR);
 622                 return -1;
 623         }
 624         pos = rhdr + rlen;
 625
 626         tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
 627
 628         *msgpos = pos;
 629
 630         return 0;
 631 }
 632
 633
 634 static int tls_write_server_hello_done(struct tlsv1_server *conn,
 635                                        u8 **msgpos, u8 *end)
 636 {
 637         u8 *pos;
 638         size_t rlen;
 639         u8 payload[4];
 640
 641         tlsv1_server_log(conn, "Send ServerHelloDone");
 642
 643         /* opaque fragment[TLSPlaintext.length] */
 644
 645         /* Handshake */
 646         pos = payload;
 647         /* HandshakeType msg_type */
 648         *pos++ = TLS_HANDSHAKE_TYPE_SERVER_HELLO_DONE;
 649         /* uint24 length */
 650         WPA_PUT_BE24(pos, 0);
 651         pos += 3;
 652         /* body - ServerHelloDone (empty) */
 653
 654         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 655                               *msgpos, end - *msgpos, payload, pos - payload,
 656                               &rlen) < 0) {
 657                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate a record");
 658                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 659                                    TLS_ALERT_INTERNAL_ERROR);
 660                 return -1;
 661         }
 662
 663         tls_verify_hash_add(&conn->verify, payload, pos - payload);
 664
 665         *msgpos += rlen;
 666
 667         return 0;
 668 }
 669
 670
 671 static int tls_write_server_change_cipher_spec(struct tlsv1_server *conn,
 672                                                u8 **msgpos, u8 *end)
 673 {
 674         size_t rlen;
 675         u8 payload[1];
 676
 677         tlsv1_server_log(conn, "Send ChangeCipherSpec");
 678
 679         payload[0] = TLS_CHANGE_CIPHER_SPEC;
 680
 681         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_CHANGE_CIPHER_SPEC,
 682                               *msgpos, end - *msgpos, payload, sizeof(payload),
 683                               &rlen) < 0) {
 684                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to create a record");
 685                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 686                                    TLS_ALERT_INTERNAL_ERROR);
 687                 return -1;
 688         }
 689
 690         if (tlsv1_record_change_write_cipher(&conn->rl) < 0) {
 691                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to set write cipher for "
 692                            "record layer");
 693                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 694                                    TLS_ALERT_INTERNAL_ERROR);
 695                 return -1;
 696         }
 697
 698         *msgpos += rlen;
 699
 700         return 0;
 701 }
 702
 703
 704 static int tls_write_server_finished(struct tlsv1_server *conn,
 705                                      u8 **msgpos, u8 *end)
 706 {
 707         u8 *pos, *hs_start;
 708         size_t rlen, hlen;
 709         u8 verify_data[1 + 3 + TLS_VERIFY_DATA_LEN];
 710         u8 hash[MD5_MAC_LEN + SHA1_MAC_LEN];
 711
 712         pos = *msgpos;
 713
 714         tlsv1_server_log(conn, "Send Finished");
 715
 716         /* Encrypted Handshake Message: Finished */
 717
 718 #ifdef CONFIG_TLSV12
 719         if (conn->rl.tls_version >= TLS_VERSION_1_2) {
 720                 hlen = SHA256_MAC_LEN;
 721                 if (conn->verify.sha256_server == NULL ||
 722                     crypto_hash_finish(conn->verify.sha256_server, hash, &hlen)
 723                     < 0) {
 724                         conn->verify.sha256_server = NULL;
 725                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 726                                            TLS_ALERT_INTERNAL_ERROR);
 727                         return -1;
 728                 }
 729                 conn->verify.sha256_server = NULL;
 730         } else {
 731 #endif /* CONFIG_TLSV12 */
 732
 733         hlen = MD5_MAC_LEN;
 734         if (conn->verify.md5_server == NULL ||
 735             crypto_hash_finish(conn->verify.md5_server, hash, &hlen) < 0) {
 736                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 737                                    TLS_ALERT_INTERNAL_ERROR);
 738                 conn->verify.md5_server = NULL;
 739                 crypto_hash_finish(conn->verify.sha1_server, NULL, NULL);
 740                 conn->verify.sha1_server = NULL;
 741                 return -1;
 742         }
 743         conn->verify.md5_server = NULL;
 744         hlen = SHA1_MAC_LEN;
 745         if (conn->verify.sha1_server == NULL ||
 746             crypto_hash_finish(conn->verify.sha1_server, hash + MD5_MAC_LEN,
 747                                &hlen) < 0) {
 748                 conn->verify.sha1_server = NULL;
 749                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 750                                    TLS_ALERT_INTERNAL_ERROR);
 751                 return -1;
 752         }
 753         conn->verify.sha1_server = NULL;
 754         hlen = MD5_MAC_LEN + SHA1_MAC_LEN;
 755
 756 #ifdef CONFIG_TLSV12
 757         }
 758 #endif /* CONFIG_TLSV12 */
 759
 760         if (tls_prf(conn->rl.tls_version,
 761                     conn->master_secret, TLS_MASTER_SECRET_LEN,
 762                     "server finished", hash, hlen,
 763                     verify_data + 1 + 3, TLS_VERIFY_DATA_LEN)) {
 764                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate verify_data");
 765                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 766                                    TLS_ALERT_INTERNAL_ERROR);
 767                 return -1;
 768         }
 769         wpa_hexdump_key(MSG_DEBUG, "TLSv1: verify_data (server)",
 770                         verify_data + 1 + 3, TLS_VERIFY_DATA_LEN);
 771 #ifdef CONFIG_TESTING_OPTIONS
 772         if (conn->test_flags & TLS_BREAK_VERIFY_DATA) {
 773                 tlsv1_server_log(conn, "TESTING: Break verify_data (server)");
 774                 verify_data[1 + 3 + 1] ^= 0x80;
 775         }
 776 #endif /* CONFIG_TESTING_OPTIONS */
 777
 778         /* Handshake */
 779         pos = hs_start = verify_data;
 780         /* HandshakeType msg_type */
 781         *pos++ = TLS_HANDSHAKE_TYPE_FINISHED;
 782         /* uint24 length */
 783         WPA_PUT_BE24(pos, TLS_VERIFY_DATA_LEN);
 784         pos += 3;
 785         pos += TLS_VERIFY_DATA_LEN;
 786         tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
 787
 788         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 789                               *msgpos, end - *msgpos, hs_start, pos - hs_start,
 790                               &rlen) < 0) {
 791                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to create a record");
 792                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 793                                    TLS_ALERT_INTERNAL_ERROR);
 794                 return -1;
 795         }
 796
 797         *msgpos += rlen;
 798
 799         return 0;
 800 }
 801
 802
 803 static u8 * tls_send_server_hello(struct tlsv1_server *conn, size_t *out_len)
 804 {
 805         u8 *msg, *end, *pos;
 806         size_t msglen;
 807
 808         *out_len = 0;
 809
 810         msglen = 1000 + tls_server_cert_chain_der_len(conn);
 811
 812         msg = os_malloc(msglen);
 813         if (msg == NULL)
 814                 return NULL;
 815
 816         pos = msg;
 817         end = msg + msglen;
 818
 819         if (tls_write_server_hello(conn, &pos, end) < 0) {
 820                 os_free(msg);
 821                 return NULL;
 822         }
 823
 824         if (conn->use_session_ticket) {
 825                 /* Abbreviated handshake using session ticket; RFC 4507 */
 826                 if (tls_write_server_change_cipher_spec(conn, &pos, end) < 0 ||
 827                     tls_write_server_finished(conn, &pos, end) < 0) {
 828                         os_free(msg);
 829                         return NULL;
 830                 }
 831
 832                 *out_len = pos - msg;
 833
 834                 conn->state = CHANGE_CIPHER_SPEC;
 835
 836                 return msg;
 837         }
 838
 839         /* Full handshake */
 840         if (tls_write_server_certificate(conn, &pos, end) < 0 ||
 841             tls_write_server_key_exchange(conn, &pos, end) < 0 ||
 842             tls_write_server_certificate_request(conn, &pos, end) < 0 ||
 843             tls_write_server_hello_done(conn, &pos, end) < 0) {
 844                 os_free(msg);
 845                 return NULL;
 846         }
 847
 848         *out_len = pos - msg;
 849
 850         conn->state = CLIENT_CERTIFICATE;
 851
 852         return msg;
 853 }
 854
 855
 856 static u8 * tls_send_change_cipher_spec(struct tlsv1_server *conn,
 857                                         size_t *out_len)
 858 {
 859         u8 *msg, *end, *pos;
 860
 861         *out_len = 0;
 862
 863         msg = os_malloc(1000);
 864         if (msg == NULL)
 865                 return NULL;
 866
 867         pos = msg;
 868         end = msg + 1000;
 869
 870         if (tls_write_server_change_cipher_spec(conn, &pos, end) < 0 ||
 871             tls_write_server_finished(conn, &pos, end) < 0) {
 872                 os_free(msg);
 873                 return NULL;
 874         }
 875
 876         *out_len = pos - msg;
 877
 878         tlsv1_server_log(conn, "Handshake completed successfully");
 879         conn->state = ESTABLISHED;
 880
 881         return msg;
 882 }
 883
 884
 885 u8 * tlsv1_server_handshake_write(struct tlsv1_server *conn, size_t *out_len)
 886 {
 887         switch (conn->state) {
 888         case SERVER_HELLO:
 889                 return tls_send_server_hello(conn, out_len);
 890         case SERVER_CHANGE_CIPHER_SPEC:
 891                 return tls_send_change_cipher_spec(conn, out_len);
 892         default:
 893                 if (conn->state == ESTABLISHED && conn->use_session_ticket) {
 894                         /* Abbreviated handshake was already completed. */
 895                         return NULL;
 896                 }
 897                 tlsv1_server_log(conn, "Unexpected state %d while generating reply",
 898                                  conn->state);
 899                 return NULL;
 900         }
 901 }
 902
 903
 904 u8 * tlsv1_server_send_alert(struct tlsv1_server *conn, u8 level,
 905                              u8 description, size_t *out_len)
 906 {
 907         u8 *alert, *pos, *length;
 908
 909         tlsv1_server_log(conn, "Send Alert(%d:%d)", level, description);
 910         *out_len = 0;
 911
 912         alert = os_malloc(10);
 913         if (alert == NULL)
 914                 return NULL;
 915
 916         pos = alert;
 917
 918         /* TLSPlaintext */
 919         /* ContentType type */
 920         *pos++ = TLS_CONTENT_TYPE_ALERT;
 921         /* ProtocolVersion version */
 922         WPA_PUT_BE16(pos, conn->rl.tls_version ? conn->rl.tls_version :
 923                      TLS_VERSION);
 924         pos += 2;
 925         /* uint16 length (to be filled) */
 926         length = pos;
 927         pos += 2;
 928         /* opaque fragment[TLSPlaintext.length] */
 929
 930         /* Alert */
 931         /* AlertLevel level */
 932         *pos++ = level;
 933         /* AlertDescription description */
 934         *pos++ = description;
 935
 936         WPA_PUT_BE16(length, pos - length - 2);
 937         *out_len = pos - alert;
 938
 939         return alert;
 940 }