Updated to hostap_2_6

[mech_eap.git] / libeap / src / crypto / tls_internal.c

diff --git a/libeap/src/crypto/tls_internal.c b/libeap/src/crypto/tls_internal.c
index 704751d..c7cb5de 100644 (file)
--- a/libeap/src/crypto/tls_internal.c
+++ b/libeap/src/crypto/tls_internal.c
@@ -23,6 +23,11 @@ struct tls_global {
        int server;
        struct tlsv1_credentials *server_cred;
        int check_crl;
+
+       void (*event_cb)(void *ctx, enum tls_event ev,
+                        union tls_event_data *data);
+       void *cb_ctx;
+       int cert_in_cb;
 };
 
 struct tls_connection {
@@ -51,6 +56,11 @@ void * tls_init(const struct tls_config *conf)
        global = os_zalloc(sizeof(*global));
        if (global == NULL)
                return NULL;
+       if (conf) {
+               global->event_cb = conf->event_cb;
+               global->cb_ctx = conf->cb_ctx;
+               global->cert_in_cb = conf->cert_in_cb;
+       }
 
        return global;
 }
@@ -64,10 +74,12 @@ void tls_deinit(void *ssl_ctx)
                tlsv1_client_global_deinit();
 #endif /* CONFIG_TLS_INTERNAL_CLIENT */
 #ifdef CONFIG_TLS_INTERNAL_SERVER
-               tlsv1_cred_free(global->server_cred);
                tlsv1_server_global_deinit();
 #endif /* CONFIG_TLS_INTERNAL_SERVER */
        }
+#ifdef CONFIG_TLS_INTERNAL_SERVER
+       tlsv1_cred_free(global->server_cred);
+#endif /* CONFIG_TLS_INTERNAL_SERVER */
        os_free(global);
 }
 
@@ -95,6 +107,8 @@ struct tls_connection * tls_connection_init(void *tls_ctx)
                        os_free(conn);
                        return NULL;
                }
+               tlsv1_client_set_cb(conn->client, global->event_cb,
+                                   global->cb_ctx, global->cert_in_cb);
        }
 #endif /* CONFIG_TLS_INTERNAL_CLIENT */
 #ifdef CONFIG_TLS_INTERNAL_SERVER
@@ -186,6 +200,12 @@ int tls_connection_set_params(void *tls_ctx, struct tls_connection *conn,
        if (conn->client == NULL)
                return -1;
 
+       if (params->flags & TLS_CONN_EXT_CERT_CHECK) {
+               wpa_printf(MSG_INFO,
+                          "TLS: tls_ext_cert_check=1 not supported");
+               return -1;
+       }
+
        cred = tlsv1_cred_alloc();
        if (cred == NULL)
                return -1;
@@ -259,8 +279,7 @@ int tls_connection_set_params(void *tls_ctx, struct tls_connection *conn,
                return -1;
        }
 
-       tlsv1_client_set_time_checks(
-               conn->client, !(params->flags & TLS_CONN_DISABLE_TIME_CHECKS));
+       tlsv1_client_set_flags(conn->client, params->flags);
 
        return 0;
 #else /* CONFIG_TLS_INTERNAL_CLIENT */
@@ -312,6 +331,13 @@ int tls_global_set_params(void *tls_ctx,
                return -1;
        }
 
+       if (params->ocsp_stapling_response)
+               cred->ocsp_stapling_response =
+                       os_strdup(params->ocsp_stapling_response);
+       if (params->ocsp_stapling_response_multi)
+               cred->ocsp_stapling_response_multi =
+                       os_strdup(params->ocsp_stapling_response_multi);
+
        return 0;
 #else /* CONFIG_TLS_INTERNAL_SERVER */
        return -1;
@@ -368,9 +394,9 @@ static int tls_get_keyblock_size(struct tls_connection *conn)
 }
 
 
-int tls_connection_prf(void *tls_ctx, struct tls_connection *conn,
-                      const char *label, int server_random_first,
-                      int skip_keyblock, u8 *out, size_t out_len)
+static int tls_connection_prf(void *tls_ctx, struct tls_connection *conn,
+                             const char *label, int server_random_first,
+                             int skip_keyblock, u8 *out, size_t out_len)
 {
        int ret = -1, skip = 0;
        u8 *tmp_out = NULL;
@@ -390,14 +416,14 @@ int tls_connection_prf(void *tls_ctx, struct tls_connection *conn,
        if (conn->client) {
                ret = tlsv1_client_prf(conn->client, label,
                                       server_random_first,
-                                      _out, out_len);
+                                      _out, skip + out_len);
        }
 #endif /* CONFIG_TLS_INTERNAL_CLIENT */
 #ifdef CONFIG_TLS_INTERNAL_SERVER
        if (conn->server) {
                ret = tlsv1_server_prf(conn->server, label,
                                       server_random_first,
-                                      _out, out_len);
+                                      _out, skip + out_len);
        }
 #endif /* CONFIG_TLS_INTERNAL_SERVER */
        if (ret == 0 && skip_keyblock)
@@ -408,6 +434,21 @@ int tls_connection_prf(void *tls_ctx, struct tls_connection *conn,
 }
 
 
+int tls_connection_export_key(void *tls_ctx, struct tls_connection *conn,
+                             const char *label, u8 *out, size_t out_len)
+{
+       return tls_connection_prf(tls_ctx, conn, label, 0, 0, out, out_len);
+}
+
+
+int tls_connection_get_eap_fast_key(void *tls_ctx, struct tls_connection *conn,
+                                   u8 *out, size_t out_len)
+{
+       return tls_connection_prf(tls_ctx, conn, "key expansion", 1, 1, out,
+                                 out_len);
+}
+
+
 struct wpabuf * tls_connection_handshake(void *tls_ctx,
                                         struct tls_connection *conn,
                                         const struct wpabuf *in_data,
@@ -621,7 +662,12 @@ int tls_connection_set_cipher_list(void *tls_ctx, struct tls_connection *conn,
 int tls_get_version(void *ssl_ctx, struct tls_connection *conn,
                    char *buf, size_t buflen)
 {
-       /* TODO */
+       if (conn == NULL)
+               return -1;
+#ifdef CONFIG_TLS_INTERNAL_CLIENT
+       if (conn->client)
+               return tlsv1_client_get_version(conn->client, buf, buflen);
+#endif /* CONFIG_TLS_INTERNAL_CLIENT */
        return -1;
 }