tlsv1_client_write.c revision d7ff03d48f825360eec2a371e3361306f2fd721b
18d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/* 28d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * TLSv1 client - write handshake message 3818ea489ef32dcdc7c098d8a336d6e1dd8996112Dmitry Shmidt * Copyright (c) 2006-2014, Jouni Malinen <j@w1.fi> 48d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * 5c5ec7f57ead87efa365800228aa0b09a12d9e6c4Dmitry Shmidt * This software may be distributed under the terms of the BSD license. 6c5ec7f57ead87efa365800228aa0b09a12d9e6c4Dmitry Shmidt * See README for more details. 78d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 88d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 98d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "includes.h" 108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "common.h" 128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "crypto/md5.h" 138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "crypto/sha1.h" 141f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt#include "crypto/sha256.h" 158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "crypto/tls.h" 168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "crypto/random.h" 178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "x509v3.h" 188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "tlsv1_common.h" 198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "tlsv1_record.h" 208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "tlsv1_client.h" 218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "tlsv1_client_i.h" 228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic size_t tls_client_cert_chain_der_len(struct tlsv1_client *conn) 258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t len = 0; 278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct x509_certificate *cert; 288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (conn->cred == NULL) 308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt cert = conn->cred->cert; 338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt while (cert) { 348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt len += 3 + cert->cert_len; 358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (x509_certificate_self_signed(cert)) 368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt cert = x509_certificate_get_subject(conn->cred->trusted_certs, 388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt &cert->issuer); 398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return len; 428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtu8 * tls_send_client_hello(struct tlsv1_client *conn, size_t *out_len) 468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *hello, *end, *pos, *hs_length, *hs_start, *rhdr; 488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct os_time now; 498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t len, i; 50d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt u8 *ext_start; 51d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt u16 tls_version = TLS_VERSION; 528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 53d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt /* Pick the highest locally enabled TLS version */ 54d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt#ifdef CONFIG_TLSV12 55d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt if ((conn->flags & TLS_CONN_DISABLE_TLSv1_2) && 56d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt tls_version == TLS_VERSION_1_2) 57d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt tls_version = TLS_VERSION_1_1; 58d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt#endif /* CONFIG_TLSV12 */ 59d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt#ifdef CONFIG_TLSV11 60d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt if ((conn->flags & TLS_CONN_DISABLE_TLSv1_1) && 61d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt tls_version == TLS_VERSION_1_1) 62d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt tls_version = TLS_VERSION_1; 63d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt#endif /* CONFIG_TLSV11 */ 64d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt if ((conn->flags & TLS_CONN_DISABLE_TLSv1_0) && 65d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt tls_version == TLS_VERSION_1) { 66d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt wpa_printf(MSG_INFO, "TLSv1: No TLS version allowed"); 67d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt return NULL; 68d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt } 69d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt 70d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Send ClientHello (ver %s)", 71d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt tls_version_str(tls_version)); 728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *out_len = 0; 738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_get_time(&now); 758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE32(conn->client_random, now.sec); 768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (random_get_bytes(conn->client_random + 4, TLS_RANDOM_LEN - 4)) { 778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_ERROR, "TLSv1: Could not generate " 788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "client_random"); 798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump(MSG_MSGDUMP, "TLSv1: client_random", 828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->client_random, TLS_RANDOM_LEN); 838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 84d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt len = 150 + conn->num_cipher_suites * 2 + conn->client_hello_ext_len; 858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hello = os_malloc(len); 868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (hello == NULL) 878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt end = hello + len; 898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt rhdr = hello; 918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = rhdr + TLS_RECORD_HEADER_LEN; 928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* opaque fragment[TLSPlaintext.length] */ 948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Handshake */ 968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hs_start = pos; 978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* HandshakeType msg_type */ 988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = TLS_HANDSHAKE_TYPE_CLIENT_HELLO; 998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* uint24 length (to be filled) */ 1008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hs_length = pos; 1018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 3; 1028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* body - ClientHello */ 1038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* ProtocolVersion client_version */ 104d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt WPA_PUT_BE16(pos, tls_version); 1058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 2; 1068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Random random: uint32 gmt_unix_time, opaque random_bytes */ 1078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(pos, conn->client_random, TLS_RANDOM_LEN); 1088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += TLS_RANDOM_LEN; 1098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* SessionID session_id */ 1108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = conn->session_id_len; 1118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(pos, conn->session_id, conn->session_id_len); 1128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += conn->session_id_len; 1138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* CipherSuite cipher_suites<2..2^16-1> */ 1148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE16(pos, 2 * conn->num_cipher_suites); 1158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 2; 1168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt for (i = 0; i < conn->num_cipher_suites; i++) { 1178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE16(pos, conn->cipher_suites[i]); 1188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 2; 1198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* CompressionMethod compression_methods<1..2^8-1> */ 1218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = 1; 1228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = TLS_COMPRESSION_NULL; 1238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 124d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt /* Extension */ 125d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt ext_start = pos; 126d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt pos += 2; 127d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt 128d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt#ifdef CONFIG_TLSV12 129d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt if (conn->rl.tls_version >= TLS_VERSION_1_2) { 130d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt /* 131d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt * Add signature_algorithms extension since we support only 132d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt * SHA256 (and not the default SHA1) with TLSv1.2. 133d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt */ 134d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt /* ExtensionsType extension_type = signature_algorithms(13) */ 135d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt WPA_PUT_BE16(pos, TLS_EXT_SIGNATURE_ALGORITHMS); 136d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt pos += 2; 137d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt /* opaque extension_data<0..2^16-1> length */ 138d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt WPA_PUT_BE16(pos, 8); 139d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt pos += 2; 140d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt /* supported_signature_algorithms<2..2^16-2> length */ 141d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt WPA_PUT_BE16(pos, 6); 142d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt pos += 2; 143d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt /* supported_signature_algorithms */ 144d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt *pos++ = TLS_HASH_ALG_SHA512; 145d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt *pos++ = TLS_SIGN_ALG_RSA; 146d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt *pos++ = TLS_HASH_ALG_SHA384; 147d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt *pos++ = TLS_SIGN_ALG_RSA; 148d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt *pos++ = TLS_HASH_ALG_SHA256; 149d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt *pos++ = TLS_SIGN_ALG_RSA; 150d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt } 151d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt#endif /* CONFIG_TLSV12 */ 152d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt 1538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (conn->client_hello_ext) { 1548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(pos, conn->client_hello_ext, 1558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->client_hello_ext_len); 1568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += conn->client_hello_ext_len; 1578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 159d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt if (pos == ext_start + 2) 160d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt pos -= 2; /* no extensions */ 161d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt else 162d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt WPA_PUT_BE16(ext_start, pos - ext_start - 2); 163d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt 1648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE24(hs_length, pos - hs_length - 3); 1658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start); 1668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE, 1681f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt rhdr, end - rhdr, hs_start, pos - hs_start, 1691f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt out_len) < 0) { 1708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to create TLS record"); 1718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 1728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 1738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(hello); 1748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 1758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->state = SERVER_HELLO; 1788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return hello; 1808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 1818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int tls_write_client_certificate(struct tlsv1_client *conn, 1848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 **msgpos, u8 *end) 1858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 1868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *pos, *rhdr, *hs_start, *hs_length, *cert_start; 1878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t rlen; 1888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct x509_certificate *cert; 1898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = *msgpos; 191d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt if (TLS_RECORD_HEADER_LEN + 1 + 3 + 3 > end - pos) { 192d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 193d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 194d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt return -1; 195d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt } 1968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Send Certificate"); 1988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt rhdr = pos; 1998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += TLS_RECORD_HEADER_LEN; 2008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* opaque fragment[TLSPlaintext.length] */ 2028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Handshake */ 2048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hs_start = pos; 2058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* HandshakeType msg_type */ 2068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = TLS_HANDSHAKE_TYPE_CERTIFICATE; 2078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* uint24 length (to be filled) */ 2088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hs_length = pos; 2098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 3; 2108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* body - Certificate */ 2118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* uint24 length (to be filled) */ 2128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt cert_start = pos; 2138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 3; 2148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt cert = conn->cred ? conn->cred->cert : NULL; 2158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt while (cert) { 216d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt if (3 + cert->cert_len > (size_t) (end - pos)) { 2178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Not enough buffer space " 2188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "for Certificate (cert_len=%lu left=%lu)", 2198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt (unsigned long) cert->cert_len, 2208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt (unsigned long) (end - pos)); 2218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 2228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 2238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 2248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE24(pos, cert->cert_len); 2268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 3; 2278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(pos, cert->cert_start, cert->cert_len); 2288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += cert->cert_len; 2298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (x509_certificate_self_signed(cert)) 2318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 2328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt cert = x509_certificate_get_subject(conn->cred->trusted_certs, 2338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt &cert->issuer); 2348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (conn->cred == NULL || cert == conn->cred->cert || cert == NULL) { 2368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* 2378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * Client was not configured with all the needed certificates 2388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * to form a full certificate chain. The server may fail to 2398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * validate the chain unless it is configured with all the 2408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * missing CA certificates. 2418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 2428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Full client certificate chain " 2438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "not configured - validation may fail"); 2448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE24(cert_start, pos - cert_start - 3); 2468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE24(hs_length, pos - hs_length - 3); 2488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE, 2501f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt rhdr, end - rhdr, hs_start, pos - hs_start, 2511f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt &rlen) < 0) { 2528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate a record"); 2538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 2548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 2558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 2568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = rhdr + rlen; 2588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start); 2608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *msgpos = pos; 2628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 2648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 2658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 267818ea489ef32dcdc7c098d8a336d6e1dd8996112Dmitry Shmidtstatic int tlsv1_key_x_dh(struct tlsv1_client *conn, u8 **pos, u8 *end) 2688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 2698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* ClientDiffieHellmanPublic */ 2708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *csecret, *csecret_start, *dh_yc, *shared; 2718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t csecret_len, dh_yc_len, shared_len; 2728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt csecret_len = conn->dh_p_len; 2748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt csecret = os_malloc(csecret_len); 2758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (csecret == NULL) { 2768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to allocate " 2778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "memory for Yc (Diffie-Hellman)"); 2788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 2798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 2808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 2818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (random_get_bytes(csecret, csecret_len)) { 2838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to get random " 2848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "data for Diffie-Hellman"); 2858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 2868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 2878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(csecret); 2888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 2898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (os_memcmp(csecret, conn->dh_p, csecret_len) > 0) 2928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt csecret[0] = 0; /* make sure Yc < p */ 2938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt csecret_start = csecret; 2958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt while (csecret_len > 1 && *csecret_start == 0) { 2968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt csecret_start++; 2978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt csecret_len--; 2988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump_key(MSG_DEBUG, "TLSv1: DH client's secret value", 3008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt csecret_start, csecret_len); 3018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Yc = g^csecret mod p */ 3038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt dh_yc_len = conn->dh_p_len; 3048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt dh_yc = os_malloc(dh_yc_len); 3058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (dh_yc == NULL) { 3068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to allocate " 3078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "memory for Diffie-Hellman"); 3088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 3098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 3108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(csecret); 3118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 3128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (crypto_mod_exp(conn->dh_g, conn->dh_g_len, 3148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt csecret_start, csecret_len, 3158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->dh_p, conn->dh_p_len, 3168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt dh_yc, &dh_yc_len)) { 3178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 3188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 3198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(csecret); 3208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(dh_yc); 3218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 3228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump(MSG_DEBUG, "TLSv1: DH Yc (client's public value)", 3258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt dh_yc, dh_yc_len); 3268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 327d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt if (end - *pos < 2) { 328d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 329d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 330d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt os_free(csecret); 331d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt os_free(dh_yc); 332d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt return -1; 333d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt } 3348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE16(*pos, dh_yc_len); 3358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos += 2; 336d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt if (dh_yc_len > (size_t) (end - *pos)) { 3378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Not enough room in the " 3388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "message buffer for Yc"); 3398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 3408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 3418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(csecret); 3428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(dh_yc); 3438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 3448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(*pos, dh_yc, dh_yc_len); 3468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos += dh_yc_len; 3478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(dh_yc); 3488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt shared_len = conn->dh_p_len; 3508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt shared = os_malloc(shared_len); 3518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (shared == NULL) { 3528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Could not allocate memory for " 3538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "DH"); 3548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 3558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 3568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(csecret); 3578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 3588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* shared = Ys^csecret mod p */ 3618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (crypto_mod_exp(conn->dh_ys, conn->dh_ys_len, 3628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt csecret_start, csecret_len, 3638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->dh_p, conn->dh_p_len, 3648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt shared, &shared_len)) { 3658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 3668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 3678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(csecret); 3688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(shared); 3698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 3708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump_key(MSG_DEBUG, "TLSv1: Shared secret from DH key exchange", 3728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt shared, shared_len); 3738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memset(csecret_start, 0, csecret_len); 3758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(csecret); 3768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tls_derive_keys(conn, shared, shared_len)) { 3778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive keys"); 3788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 3798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 3808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(shared); 3818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 3828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memset(shared, 0, shared_len); 3848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(shared); 3858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tlsv1_client_free_dh(conn); 3868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 3878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 3888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int tlsv1_key_x_rsa(struct tlsv1_client *conn, u8 **pos, u8 *end) 3918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 3928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 pre_master_secret[TLS_PRE_MASTER_SECRET_LEN]; 3938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t clen; 3948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt int res; 3958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tls_derive_pre_master_secret(pre_master_secret) < 0 || 3978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_derive_keys(conn, pre_master_secret, 3988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_PRE_MASTER_SECRET_LEN)) { 3998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive keys"); 4008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 4018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 4028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 4038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* EncryptedPreMasterSecret */ 4068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (conn->server_rsa_key == NULL) { 4078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: No server RSA key to " 4088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "use for encrypting pre-master secret"); 4098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 4108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 4118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 4128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* RSA encrypted value is encoded with PKCS #1 v1.5 block type 2. */ 4158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos += 2; 4168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt clen = end - *pos; 4178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt res = crypto_public_key_encrypt_pkcs1_v15( 4188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->server_rsa_key, 4198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pre_master_secret, TLS_PRE_MASTER_SECRET_LEN, 4208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos, &clen); 4218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memset(pre_master_secret, 0, TLS_PRE_MASTER_SECRET_LEN); 4228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (res < 0) { 4238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: RSA encryption failed"); 4248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 4258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 4268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 4278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE16(*pos - 2, clen); 4298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump(MSG_MSGDUMP, "TLSv1: Encrypted pre_master_secret", 4308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos, clen); 4318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos += clen; 4328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 4348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 4358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int tls_write_client_key_exchange(struct tlsv1_client *conn, 4388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 **msgpos, u8 *end) 4398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 4408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *pos, *rhdr, *hs_start, *hs_length; 4418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t rlen; 4428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_key_exchange keyx; 4438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const struct tls_cipher_suite *suite; 4448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt suite = tls_get_cipher_suite(conn->rl.cipher_suite); 4468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (suite == NULL) 4478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt keyx = TLS_KEY_X_NULL; 4488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt else 4498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt keyx = suite->key_exchange; 4508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = *msgpos; 4528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Send ClientKeyExchange"); 4548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt rhdr = pos; 4568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += TLS_RECORD_HEADER_LEN; 4578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* opaque fragment[TLSPlaintext.length] */ 4598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Handshake */ 4618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hs_start = pos; 4628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* HandshakeType msg_type */ 4638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = TLS_HANDSHAKE_TYPE_CLIENT_KEY_EXCHANGE; 4648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* uint24 length (to be filled) */ 4658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hs_length = pos; 4668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 3; 4678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* body - ClientKeyExchange */ 468818ea489ef32dcdc7c098d8a336d6e1dd8996112Dmitry Shmidt if (keyx == TLS_KEY_X_DH_anon || keyx == TLS_KEY_X_DHE_RSA) { 469818ea489ef32dcdc7c098d8a336d6e1dd8996112Dmitry Shmidt if (tlsv1_key_x_dh(conn, &pos, end) < 0) 4708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 4718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } else { 4728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tlsv1_key_x_rsa(conn, &pos, end) < 0) 4738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 4748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE24(hs_length, pos - hs_length - 3); 4778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE, 4791f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt rhdr, end - rhdr, hs_start, pos - hs_start, 4801f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt &rlen) < 0) { 4818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to create a record"); 4828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 4838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 4848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 4858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = rhdr + rlen; 4878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start); 4888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *msgpos = pos; 4908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 4928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 4938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int tls_write_client_certificate_verify(struct tlsv1_client *conn, 4968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 **msgpos, u8 *end) 4978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 4988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *pos, *rhdr, *hs_start, *hs_length, *signed_start; 4998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t rlen, hlen, clen; 5001f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt u8 hash[100], *hpos; 5018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = *msgpos; 5038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Send CertificateVerify"); 5058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt rhdr = pos; 5068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += TLS_RECORD_HEADER_LEN; 5078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Handshake */ 5098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hs_start = pos; 5108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* HandshakeType msg_type */ 5118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = TLS_HANDSHAKE_TYPE_CERTIFICATE_VERIFY; 5128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* uint24 length (to be filled) */ 5138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hs_length = pos; 5148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 3; 5158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* 5178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * RFC 2246: 7.4.3 and 7.4.8: 5188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * Signature signature 5198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * 5208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * RSA: 5218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * digitally-signed struct { 5228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * opaque md5_hash[16]; 5238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * opaque sha_hash[20]; 5248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * }; 5258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * 5268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * DSA: 5278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * digitally-signed struct { 5288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * opaque sha_hash[20]; 5298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * }; 5308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * 5318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * The hash values are calculated over all handshake messages sent or 5328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * received starting at ClientHello up to, but not including, this 5338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * CertificateVerify message, including the type and length fields of 5348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * the handshake messages. 5358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 5368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hpos = hash; 5388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5391f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt#ifdef CONFIG_TLSV12 5401f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt if (conn->rl.tls_version == TLS_VERSION_1_2) { 5411f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt hlen = SHA256_MAC_LEN; 5421f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt if (conn->verify.sha256_cert == NULL || 5431f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt crypto_hash_finish(conn->verify.sha256_cert, hpos, &hlen) < 5441f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt 0) { 5451f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt conn->verify.sha256_cert = NULL; 5461f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 5471f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 5481f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt return -1; 5491f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt } 5501f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt conn->verify.sha256_cert = NULL; 5511f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt 5521f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt /* 5531f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * RFC 3447, A.2.4 RSASSA-PKCS1-v1_5 5541f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * 5551f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * DigestInfo ::= SEQUENCE { 5561f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * digestAlgorithm DigestAlgorithm, 5571f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * digest OCTET STRING 5581f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * } 5591f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * 5601f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * SHA-256 OID: sha256WithRSAEncryption ::= {pkcs-1 11} 5611f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * 5621f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * DER encoded DigestInfo for SHA256 per RFC 3447: 5631f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * 30 31 30 0d 06 09 60 86 48 01 65 03 04 02 01 05 00 04 20 || 5641f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * H 5651f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt */ 5661f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt os_memmove(hash + 19, hash, hlen); 5671f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt hlen += 19; 5681f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt os_memcpy(hash, "\x30\x31\x30\x0d\x06\x09\x60\x86\x48\x01\x65" 5691f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt "\x03\x04\x02\x01\x05\x00\x04\x20", 19); 5701f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt } else { 5711f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt#endif /* CONFIG_TLSV12 */ 5721f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt 573203eadb9eda41a1dde4a583edb4684319e3f399eDmitry Shmidt hlen = MD5_MAC_LEN; 574203eadb9eda41a1dde4a583edb4684319e3f399eDmitry Shmidt if (conn->verify.md5_cert == NULL || 575203eadb9eda41a1dde4a583edb4684319e3f399eDmitry Shmidt crypto_hash_finish(conn->verify.md5_cert, hpos, &hlen) < 0) { 576203eadb9eda41a1dde4a583edb4684319e3f399eDmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 577203eadb9eda41a1dde4a583edb4684319e3f399eDmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 578203eadb9eda41a1dde4a583edb4684319e3f399eDmitry Shmidt conn->verify.md5_cert = NULL; 579203eadb9eda41a1dde4a583edb4684319e3f399eDmitry Shmidt crypto_hash_finish(conn->verify.sha1_cert, NULL, NULL); 580203eadb9eda41a1dde4a583edb4684319e3f399eDmitry Shmidt conn->verify.sha1_cert = NULL; 581203eadb9eda41a1dde4a583edb4684319e3f399eDmitry Shmidt return -1; 582203eadb9eda41a1dde4a583edb4684319e3f399eDmitry Shmidt } 583203eadb9eda41a1dde4a583edb4684319e3f399eDmitry Shmidt hpos += MD5_MAC_LEN; 5848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->verify.md5_cert = NULL; 5868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hlen = SHA1_MAC_LEN; 5878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (conn->verify.sha1_cert == NULL || 5888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt crypto_hash_finish(conn->verify.sha1_cert, hpos, &hlen) < 0) { 5898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->verify.sha1_cert = NULL; 5908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 5918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 5928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 5938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 5948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->verify.sha1_cert = NULL; 5958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 596203eadb9eda41a1dde4a583edb4684319e3f399eDmitry Shmidt hlen += MD5_MAC_LEN; 5978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5981f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt#ifdef CONFIG_TLSV12 5991f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt } 6001f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt#endif /* CONFIG_TLSV12 */ 6011f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt 6028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump(MSG_MSGDUMP, "TLSv1: CertificateVerify hash", hash, hlen); 6038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 6041f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt#ifdef CONFIG_TLSV12 6051f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt if (conn->rl.tls_version >= TLS_VERSION_1_2) { 6061f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt /* 6071f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * RFC 5246, 4.7: 6081f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * TLS v1.2 adds explicit indication of the used signature and 6091f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * hash algorithms. 6101f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * 6111f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * struct { 6121f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * HashAlgorithm hash; 6131f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * SignatureAlgorithm signature; 6141f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * } SignatureAndHashAlgorithm; 6151f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt */ 6161f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt *pos++ = TLS_HASH_ALG_SHA256; 6171f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt *pos++ = TLS_SIGN_ALG_RSA; 6181f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt } 6191f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt#endif /* CONFIG_TLSV12 */ 6201f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt 6218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* 6228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * RFC 2246, 4.7: 6238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * In digital signing, one-way hash functions are used as input for a 6248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * signing algorithm. A digitally-signed element is encoded as an 6258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * opaque vector <0..2^16-1>, where the length is specified by the 6268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * signing algorithm and key. 6278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * 6288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * In RSA signing, a 36-byte structure of two hashes (one SHA and one 6298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * MD5) is signed (encrypted with the private key). It is encoded with 6308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * PKCS #1 block type 0 or type 1 as described in [PKCS1]. 6318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 6328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt signed_start = pos; /* length to be filled */ 6338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 2; 6348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt clen = end - pos; 6358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (conn->cred == NULL || 6368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt crypto_private_key_sign_pkcs1(conn->cred->key, hash, hlen, 6378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos, &clen) < 0) { 6388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to sign hash (PKCS #1)"); 6398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 6408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 6418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 6428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 6438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE16(signed_start, clen); 6448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 6458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += clen; 6468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 6478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE24(hs_length, pos - hs_length - 3); 6488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 6498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE, 6501f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt rhdr, end - rhdr, hs_start, pos - hs_start, 6511f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt &rlen) < 0) { 6528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate a record"); 6538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 6548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 6558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 6568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 6578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = rhdr + rlen; 6588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 6598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start); 6608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 6618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *msgpos = pos; 6628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 6638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 6648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 6658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 6668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 6678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int tls_write_client_change_cipher_spec(struct tlsv1_client *conn, 6688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 **msgpos, u8 *end) 6698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 6708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t rlen; 6711f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt u8 payload[1]; 6728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 6738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Send ChangeCipherSpec"); 6741f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt 6751f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt payload[0] = TLS_CHANGE_CIPHER_SPEC; 6761f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt 6778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_CHANGE_CIPHER_SPEC, 6781f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt *msgpos, end - *msgpos, payload, sizeof(payload), 6791f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt &rlen) < 0) { 6808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to create a record"); 6818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 6828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 6838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 6848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 6858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 6868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tlsv1_record_change_write_cipher(&conn->rl) < 0) { 6878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to set write cipher for " 6888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "record layer"); 6898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 6908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 6918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 6928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 6938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 6941f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt *msgpos += rlen; 6958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 6968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 6978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 6988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 6998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int tls_write_client_finished(struct tlsv1_client *conn, 7018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 **msgpos, u8 *end) 7028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 7031f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt u8 *pos, *hs_start; 7048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t rlen, hlen; 7051f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt u8 verify_data[1 + 3 + TLS_VERIFY_DATA_LEN]; 7068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 hash[MD5_MAC_LEN + SHA1_MAC_LEN]; 7078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Send Finished"); 7098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Encrypted Handshake Message: Finished */ 7118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7121f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt#ifdef CONFIG_TLSV12 7131f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt if (conn->rl.tls_version >= TLS_VERSION_1_2) { 7141f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt hlen = SHA256_MAC_LEN; 7151f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt if (conn->verify.sha256_client == NULL || 7161f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt crypto_hash_finish(conn->verify.sha256_client, hash, &hlen) 7171f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt < 0) { 7181f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 7191f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 7201f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt conn->verify.sha256_client = NULL; 7211f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt return -1; 7221f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt } 7231f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt conn->verify.sha256_client = NULL; 7241f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt } else { 7251f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt#endif /* CONFIG_TLSV12 */ 7261f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt 7278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hlen = MD5_MAC_LEN; 7288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (conn->verify.md5_client == NULL || 7298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt crypto_hash_finish(conn->verify.md5_client, hash, &hlen) < 0) { 7308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 7318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 7328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->verify.md5_client = NULL; 7338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt crypto_hash_finish(conn->verify.sha1_client, NULL, NULL); 7348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->verify.sha1_client = NULL; 7358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 7368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 7378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->verify.md5_client = NULL; 7388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hlen = SHA1_MAC_LEN; 7398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (conn->verify.sha1_client == NULL || 7408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt crypto_hash_finish(conn->verify.sha1_client, hash + MD5_MAC_LEN, 7418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt &hlen) < 0) { 7428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->verify.sha1_client = NULL; 7438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 7448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 7458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 7468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 7478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->verify.sha1_client = NULL; 7481f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt hlen = MD5_MAC_LEN + SHA1_MAC_LEN; 7491f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt 7501f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt#ifdef CONFIG_TLSV12 7511f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt } 7521f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt#endif /* CONFIG_TLSV12 */ 7538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7541f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt if (tls_prf(conn->rl.tls_version, 7551f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt conn->master_secret, TLS_MASTER_SECRET_LEN, 7561f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt "client finished", hash, hlen, 7571f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt verify_data + 1 + 3, TLS_VERIFY_DATA_LEN)) { 7588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate verify_data"); 7598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 7608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 7618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 7628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 7638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump_key(MSG_DEBUG, "TLSv1: verify_data (client)", 7641f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt verify_data + 1 + 3, TLS_VERIFY_DATA_LEN); 7658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Handshake */ 7671f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt pos = hs_start = verify_data; 7688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* HandshakeType msg_type */ 7698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = TLS_HANDSHAKE_TYPE_FINISHED; 7701f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt /* uint24 length */ 7711f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt WPA_PUT_BE24(pos, TLS_VERIFY_DATA_LEN); 7728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 3; 7731f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt pos += TLS_VERIFY_DATA_LEN; /* verify_data already in place */ 7748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start); 7758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE, 7771f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt *msgpos, end - *msgpos, hs_start, pos - hs_start, 7781f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt &rlen) < 0) { 7798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to create a record"); 7808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 7818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 7828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 7838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 7848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7851f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt *msgpos += rlen; 7868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 7888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 7898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic u8 * tls_send_client_key_exchange(struct tlsv1_client *conn, 7928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t *out_len) 7938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 7948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *msg, *end, *pos; 7958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t msglen; 7968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *out_len = 0; 7988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt msglen = 2000; 8008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (conn->certificate_requested) 8018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt msglen += tls_client_cert_chain_der_len(conn); 8028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt msg = os_malloc(msglen); 8048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (msg == NULL) 8058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 8068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = msg; 8088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt end = msg + msglen; 8098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (conn->certificate_requested) { 8118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tls_write_client_certificate(conn, &pos, end) < 0) { 8128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(msg); 8138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 8148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 8158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 8168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tls_write_client_key_exchange(conn, &pos, end) < 0 || 8188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt (conn->certificate_requested && conn->cred && conn->cred->key && 8198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_write_client_certificate_verify(conn, &pos, end) < 0) || 8208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_write_client_change_cipher_spec(conn, &pos, end) < 0 || 8218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_write_client_finished(conn, &pos, end) < 0) { 8228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(msg); 8238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 8248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 8258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *out_len = pos - msg; 8278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->state = SERVER_CHANGE_CIPHER_SPEC; 8298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return msg; 8318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 8328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic u8 * tls_send_change_cipher_spec(struct tlsv1_client *conn, 8358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t *out_len) 8368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 8378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *msg, *end, *pos; 8388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *out_len = 0; 8408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt msg = os_malloc(1000); 8428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (msg == NULL) 8438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 8448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = msg; 8468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt end = msg + 1000; 8478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tls_write_client_change_cipher_spec(conn, &pos, end) < 0 || 8498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_write_client_finished(conn, &pos, end) < 0) { 8508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(msg); 8518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 8528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 8538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *out_len = pos - msg; 8558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Session resumption completed " 8578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "successfully"); 858d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt if (!conn->session_resumed && conn->use_session_ticket) 859d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt conn->session_resumed = 1; 8608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->state = ESTABLISHED; 8618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return msg; 8638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 8648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtu8 * tlsv1_client_handshake_write(struct tlsv1_client *conn, size_t *out_len, 8678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt int no_appl_data) 8688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 8698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt switch (conn->state) { 8708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case CLIENT_KEY_EXCHANGE: 8718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return tls_send_client_key_exchange(conn, out_len); 8728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case CHANGE_CIPHER_SPEC: 8738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return tls_send_change_cipher_spec(conn, out_len); 8748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case ACK_FINISHED: 8758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Handshake completed " 8768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "successfully"); 8778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->state = ESTABLISHED; 8788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *out_len = 0; 8798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (no_appl_data) { 8808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Need to return something to get final TLS ACK. */ 8818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return os_malloc(1); 8828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 8838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 8848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt default: 8858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Unexpected state %d while " 8868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "generating reply", conn->state); 8878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 8888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 8898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 8908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtu8 * tlsv1_client_send_alert(struct tlsv1_client *conn, u8 level, 8938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 description, size_t *out_len) 8948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 8958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *alert, *pos, *length; 8968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Send Alert(%d:%d)", level, description); 8988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *out_len = 0; 8998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt alert = os_malloc(10); 9018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (alert == NULL) 9028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 9038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = alert; 9058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* TLSPlaintext */ 9078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* ContentType type */ 9088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = TLS_CONTENT_TYPE_ALERT; 9098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* ProtocolVersion version */ 9101f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt WPA_PUT_BE16(pos, conn->rl.tls_version ? conn->rl.tls_version : 9111f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt TLS_VERSION); 9128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 2; 9138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* uint16 length (to be filled) */ 9148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt length = pos; 9158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 2; 9168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* opaque fragment[TLSPlaintext.length] */ 9178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Alert */ 9198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* AlertLevel level */ 9208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = level; 9218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* AlertDescription description */ 9228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = description; 9238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE16(length, pos - length - 2); 9258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *out_len = pos - alert; 9268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return alert; 9288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 929