18d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/* 28d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * TLSv1 client - write handshake message 31b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt * Copyright (c) 2006-2015, Jouni Malinen <j@w1.fi> 48d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * 5c5ec7f57ead87efa365800228aa0b09a12d9e6c4Dmitry Shmidt * This software may be distributed under the terms of the BSD license. 6c5ec7f57ead87efa365800228aa0b09a12d9e6c4Dmitry Shmidt * See README for more details. 78d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 88d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 98d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "includes.h" 108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "common.h" 128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "crypto/md5.h" 138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "crypto/sha1.h" 141f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt#include "crypto/sha256.h" 158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "crypto/tls.h" 168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "crypto/random.h" 178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "x509v3.h" 188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "tlsv1_common.h" 198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "tlsv1_record.h" 208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "tlsv1_client.h" 218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "tlsv1_client_i.h" 228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic size_t tls_client_cert_chain_der_len(struct tlsv1_client *conn) 258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t len = 0; 278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct x509_certificate *cert; 288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (conn->cred == NULL) 308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt cert = conn->cred->cert; 338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt while (cert) { 348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt len += 3 + cert->cert_len; 358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (x509_certificate_self_signed(cert)) 368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt cert = x509_certificate_get_subject(conn->cred->trusted_certs, 388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt &cert->issuer); 398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return len; 428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtu8 * tls_send_client_hello(struct tlsv1_client *conn, size_t *out_len) 468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *hello, *end, *pos, *hs_length, *hs_start, *rhdr; 488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct os_time now; 498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t len, i; 50d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt u8 *ext_start; 51d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt u16 tls_version = TLS_VERSION; 528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 53d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt /* Pick the highest locally enabled TLS version */ 54d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt#ifdef CONFIG_TLSV12 55d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt if ((conn->flags & TLS_CONN_DISABLE_TLSv1_2) && 56d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt tls_version == TLS_VERSION_1_2) 57d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt tls_version = TLS_VERSION_1_1; 58d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt#endif /* CONFIG_TLSV12 */ 59d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt#ifdef CONFIG_TLSV11 60d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt if ((conn->flags & TLS_CONN_DISABLE_TLSv1_1) && 61d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt tls_version == TLS_VERSION_1_1) 62d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt tls_version = TLS_VERSION_1; 63d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt#endif /* CONFIG_TLSV11 */ 64d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt if ((conn->flags & TLS_CONN_DISABLE_TLSv1_0) && 65d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt tls_version == TLS_VERSION_1) { 66d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt wpa_printf(MSG_INFO, "TLSv1: No TLS version allowed"); 67d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt return NULL; 68d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt } 69d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt 70d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Send ClientHello (ver %s)", 71d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt tls_version_str(tls_version)); 728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *out_len = 0; 738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_get_time(&now); 758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE32(conn->client_random, now.sec); 768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (random_get_bytes(conn->client_random + 4, TLS_RANDOM_LEN - 4)) { 778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_ERROR, "TLSv1: Could not generate " 788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "client_random"); 798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump(MSG_MSGDUMP, "TLSv1: client_random", 828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->client_random, TLS_RANDOM_LEN); 838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 84d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt len = 150 + conn->num_cipher_suites * 2 + conn->client_hello_ext_len; 858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hello = os_malloc(len); 868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (hello == NULL) 878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt end = hello + len; 898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt rhdr = hello; 918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = rhdr + TLS_RECORD_HEADER_LEN; 928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* opaque fragment[TLSPlaintext.length] */ 948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Handshake */ 968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hs_start = pos; 978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* HandshakeType msg_type */ 988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = TLS_HANDSHAKE_TYPE_CLIENT_HELLO; 998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* uint24 length (to be filled) */ 1008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hs_length = pos; 1018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 3; 1028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* body - ClientHello */ 1038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* ProtocolVersion client_version */ 104d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt WPA_PUT_BE16(pos, tls_version); 1058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 2; 1068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Random random: uint32 gmt_unix_time, opaque random_bytes */ 1078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(pos, conn->client_random, TLS_RANDOM_LEN); 1088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += TLS_RANDOM_LEN; 1098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* SessionID session_id */ 1108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = conn->session_id_len; 1118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(pos, conn->session_id, conn->session_id_len); 1128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += conn->session_id_len; 1138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* CipherSuite cipher_suites<2..2^16-1> */ 1148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE16(pos, 2 * conn->num_cipher_suites); 1158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 2; 1168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt for (i = 0; i < conn->num_cipher_suites; i++) { 1178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE16(pos, conn->cipher_suites[i]); 1188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 2; 1198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* CompressionMethod compression_methods<1..2^8-1> */ 1218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = 1; 1228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = TLS_COMPRESSION_NULL; 1238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 124d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt /* Extension */ 125d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt ext_start = pos; 126d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt pos += 2; 127d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt 128d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt#ifdef CONFIG_TLSV12 129d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt if (conn->rl.tls_version >= TLS_VERSION_1_2) { 130d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt /* 131d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt * Add signature_algorithms extension since we support only 132d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt * SHA256 (and not the default SHA1) with TLSv1.2. 133d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt */ 134d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt /* ExtensionsType extension_type = signature_algorithms(13) */ 135d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt WPA_PUT_BE16(pos, TLS_EXT_SIGNATURE_ALGORITHMS); 136d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt pos += 2; 137d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt /* opaque extension_data<0..2^16-1> length */ 138d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt WPA_PUT_BE16(pos, 8); 139d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt pos += 2; 140d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt /* supported_signature_algorithms<2..2^16-2> length */ 141d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt WPA_PUT_BE16(pos, 6); 142d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt pos += 2; 143d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt /* supported_signature_algorithms */ 144d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt *pos++ = TLS_HASH_ALG_SHA512; 145d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt *pos++ = TLS_SIGN_ALG_RSA; 146d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt *pos++ = TLS_HASH_ALG_SHA384; 147d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt *pos++ = TLS_SIGN_ALG_RSA; 148d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt *pos++ = TLS_HASH_ALG_SHA256; 149d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt *pos++ = TLS_SIGN_ALG_RSA; 150d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt } 151d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt#endif /* CONFIG_TLSV12 */ 152d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt 1538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (conn->client_hello_ext) { 1548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(pos, conn->client_hello_ext, 1558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->client_hello_ext_len); 1568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += conn->client_hello_ext_len; 1578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1591b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt if (conn->flags & TLS_CONN_REQUEST_OCSP) { 1601b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt wpa_printf(MSG_DEBUG, 1611b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt "TLSv1: Add status_request extension for OCSP stapling"); 1621b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt /* ExtensionsType extension_type = status_request(5) */ 1631b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt WPA_PUT_BE16(pos, TLS_EXT_STATUS_REQUEST); 1641b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt pos += 2; 1651b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt /* opaque extension_data<0..2^16-1> length */ 1661b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt WPA_PUT_BE16(pos, 5); 1671b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt pos += 2; 1681b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt 1691b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt /* 1701b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt * RFC 6066, 8: 1711b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt * struct { 1721b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt * CertificateStatusType status_type; 1731b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt * select (status_type) { 1741b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt * case ocsp: OCSPStatusRequest; 1751b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt * } request; 1761b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt * } CertificateStatusRequest; 1771b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt * 1781b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt * enum { ocsp(1), (255) } CertificateStatusType; 1791b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt */ 1801b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt *pos++ = 1; /* status_type = ocsp(1) */ 1811b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt 1821b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt /* 1831b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt * struct { 1841b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt * ResponderID responder_id_list<0..2^16-1>; 1851b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt * Extensions request_extensions; 1861b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt * } OCSPStatusRequest; 1871b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt * 1881b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt * opaque ResponderID<1..2^16-1>; 1891b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt * opaque Extensions<0..2^16-1>; 1901b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt */ 1911b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt WPA_PUT_BE16(pos, 0); /* responder_id_list(empty) */ 1921b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt pos += 2; 1931b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt WPA_PUT_BE16(pos, 0); /* request_extensions(empty) */ 1941b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt pos += 2; 195d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt 196d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt wpa_printf(MSG_DEBUG, 197d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt "TLSv1: Add status_request_v2 extension for OCSP stapling"); 198d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt /* ExtensionsType extension_type = status_request_v2(17) */ 199d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt WPA_PUT_BE16(pos, TLS_EXT_STATUS_REQUEST_V2); 200d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt pos += 2; 201d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt /* opaque extension_data<0..2^16-1> length */ 202d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt WPA_PUT_BE16(pos, 7); 203d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt pos += 2; 204d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt 205d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt /* 206d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt * RFC 6961, 2.2: 207d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt * struct { 208d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt * CertificateStatusType status_type; 209d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt * uint16 request_length; 210d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt * select (status_type) { 211d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt * case ocsp: OCSPStatusRequest; 212d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt * case ocsp_multi: OCSPStatusRequest; 213d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt * } request; 214d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt * } CertificateStatusRequestItemV2; 215d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt * 216d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt * enum { ocsp(1), ocsp_multi(2), (255) } CertificateStatusType; 217d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt * 218d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt * struct { 219d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt * CertificateStatusRequestItemV2 220d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt * certificate_status_req_list<1..2^16-1>; 221d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt * } CertificateStatusRequestListV2; 222d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt */ 223d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt 224d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt /* certificate_status_req_list<1..2^16-1> */ 225d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt WPA_PUT_BE16(pos, 5); 226d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt pos += 2; 227d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt 228d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt /* CertificateStatusRequestItemV2 */ 229d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt *pos++ = 2; /* status_type = ocsp_multi(2) */ 230d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt /* OCSPStatusRequest as shown above for v1 */ 231d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt WPA_PUT_BE16(pos, 0); /* responder_id_list(empty) */ 232d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt pos += 2; 233d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt WPA_PUT_BE16(pos, 0); /* request_extensions(empty) */ 234d97138ded63ac5388da3a2b63dea563c8b44c8ecDmitry Shmidt pos += 2; 2351b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt } 2361b46775bb44f06b3cc285481ff5f7a673559ed7dDmitry Shmidt 237d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt if (pos == ext_start + 2) 238d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt pos -= 2; /* no extensions */ 239d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt else 240d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt WPA_PUT_BE16(ext_start, pos - ext_start - 2); 241d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt 2428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE24(hs_length, pos - hs_length - 3); 2438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start); 2448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE, 2461f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt rhdr, end - rhdr, hs_start, pos - hs_start, 2471f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt out_len) < 0) { 2488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to create TLS record"); 2498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 2508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 2518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(hello); 2528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 2538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->state = SERVER_HELLO; 2568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return hello; 2588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 2598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int tls_write_client_certificate(struct tlsv1_client *conn, 2628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 **msgpos, u8 *end) 2638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 2648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *pos, *rhdr, *hs_start, *hs_length, *cert_start; 2658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t rlen; 2668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct x509_certificate *cert; 2678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = *msgpos; 269d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt if (TLS_RECORD_HEADER_LEN + 1 + 3 + 3 > end - pos) { 270d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 271d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 272d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt return -1; 273d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt } 2748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Send Certificate"); 2768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt rhdr = pos; 2778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += TLS_RECORD_HEADER_LEN; 2788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* opaque fragment[TLSPlaintext.length] */ 2808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Handshake */ 2828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hs_start = pos; 2838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* HandshakeType msg_type */ 2848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = TLS_HANDSHAKE_TYPE_CERTIFICATE; 2858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* uint24 length (to be filled) */ 2868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hs_length = pos; 2878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 3; 2888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* body - Certificate */ 2898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* uint24 length (to be filled) */ 2908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt cert_start = pos; 2918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 3; 2928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt cert = conn->cred ? conn->cred->cert : NULL; 2938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt while (cert) { 294d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt if (3 + cert->cert_len > (size_t) (end - pos)) { 2958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Not enough buffer space " 2968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "for Certificate (cert_len=%lu left=%lu)", 2978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt (unsigned long) cert->cert_len, 2988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt (unsigned long) (end - pos)); 2998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 3008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 3018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 3028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE24(pos, cert->cert_len); 3048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 3; 3058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(pos, cert->cert_start, cert->cert_len); 3068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += cert->cert_len; 3078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (x509_certificate_self_signed(cert)) 3098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 3108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt cert = x509_certificate_get_subject(conn->cred->trusted_certs, 3118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt &cert->issuer); 3128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (conn->cred == NULL || cert == conn->cred->cert || cert == NULL) { 3148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* 3158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * Client was not configured with all the needed certificates 3168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * to form a full certificate chain. The server may fail to 3178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * validate the chain unless it is configured with all the 3188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * missing CA certificates. 3198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 3208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Full client certificate chain " 3218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "not configured - validation may fail"); 3228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE24(cert_start, pos - cert_start - 3); 3248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE24(hs_length, pos - hs_length - 3); 3268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE, 3281f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt rhdr, end - rhdr, hs_start, pos - hs_start, 3291f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt &rlen) < 0) { 3308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate a record"); 3318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 3328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 3338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 3348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = rhdr + rlen; 3368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start); 3388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *msgpos = pos; 3408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 3428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 3438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 345818ea489ef32dcdc7c098d8a336d6e1dd8996112Dmitry Shmidtstatic int tlsv1_key_x_dh(struct tlsv1_client *conn, u8 **pos, u8 *end) 3468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 3478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* ClientDiffieHellmanPublic */ 3488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *csecret, *csecret_start, *dh_yc, *shared; 3498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t csecret_len, dh_yc_len, shared_len; 3508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt csecret_len = conn->dh_p_len; 3528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt csecret = os_malloc(csecret_len); 3538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (csecret == NULL) { 3548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to allocate " 3558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "memory for Yc (Diffie-Hellman)"); 3568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 3578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 3588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 3598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (random_get_bytes(csecret, csecret_len)) { 3618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to get random " 3628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "data for Diffie-Hellman"); 3638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 3648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 3658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(csecret); 3668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 3678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (os_memcmp(csecret, conn->dh_p, csecret_len) > 0) 3708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt csecret[0] = 0; /* make sure Yc < p */ 3718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt csecret_start = csecret; 3738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt while (csecret_len > 1 && *csecret_start == 0) { 3748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt csecret_start++; 3758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt csecret_len--; 3768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump_key(MSG_DEBUG, "TLSv1: DH client's secret value", 3788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt csecret_start, csecret_len); 3798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Yc = g^csecret mod p */ 3818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt dh_yc_len = conn->dh_p_len; 3828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt dh_yc = os_malloc(dh_yc_len); 3838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (dh_yc == NULL) { 3848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to allocate " 3858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "memory for Diffie-Hellman"); 3868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 3878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 3888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(csecret); 3898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 3908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (crypto_mod_exp(conn->dh_g, conn->dh_g_len, 3928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt csecret_start, csecret_len, 3938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->dh_p, conn->dh_p_len, 3948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt dh_yc, &dh_yc_len)) { 3958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 3968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 3978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(csecret); 3988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(dh_yc); 3998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 4008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump(MSG_DEBUG, "TLSv1: DH Yc (client's public value)", 4038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt dh_yc, dh_yc_len); 4048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 405d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt if (end - *pos < 2) { 406d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 407d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 408d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt os_free(csecret); 409d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt os_free(dh_yc); 410d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt return -1; 411d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt } 4128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE16(*pos, dh_yc_len); 4138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos += 2; 414d80a401aed31d06f261efd19223cf55d1a2a8228Dmitry Shmidt if (dh_yc_len > (size_t) (end - *pos)) { 4158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Not enough room in the " 4168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "message buffer for Yc"); 4178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 4188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 4198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(csecret); 4208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(dh_yc); 4218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 4228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(*pos, dh_yc, dh_yc_len); 4248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos += dh_yc_len; 4258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(dh_yc); 4268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt shared_len = conn->dh_p_len; 4288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt shared = os_malloc(shared_len); 4298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (shared == NULL) { 4308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Could not allocate memory for " 4318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "DH"); 4328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 4338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 4348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(csecret); 4358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 4368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* shared = Ys^csecret mod p */ 4398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (crypto_mod_exp(conn->dh_ys, conn->dh_ys_len, 4408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt csecret_start, csecret_len, 4418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->dh_p, conn->dh_p_len, 4428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt shared, &shared_len)) { 4438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 4448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 4458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(csecret); 4468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(shared); 4478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 4488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump_key(MSG_DEBUG, "TLSv1: Shared secret from DH key exchange", 4508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt shared, shared_len); 4518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memset(csecret_start, 0, csecret_len); 4538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(csecret); 4548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tls_derive_keys(conn, shared, shared_len)) { 4558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive keys"); 4568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 4578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 4588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(shared); 4598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 4608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memset(shared, 0, shared_len); 4628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(shared); 4638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tlsv1_client_free_dh(conn); 4648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 4658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 4668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int tlsv1_key_x_rsa(struct tlsv1_client *conn, u8 **pos, u8 *end) 4698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 4708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 pre_master_secret[TLS_PRE_MASTER_SECRET_LEN]; 4718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t clen; 4728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt int res; 4738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tls_derive_pre_master_secret(pre_master_secret) < 0 || 4758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_derive_keys(conn, pre_master_secret, 4768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_PRE_MASTER_SECRET_LEN)) { 4778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive keys"); 4788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 4798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 4808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 4818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* EncryptedPreMasterSecret */ 4848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (conn->server_rsa_key == NULL) { 4858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: No server RSA key to " 4868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "use for encrypting pre-master secret"); 4878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 4888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 4898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 4908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* RSA encrypted value is encoded with PKCS #1 v1.5 block type 2. */ 4938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos += 2; 4948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt clen = end - *pos; 4958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt res = crypto_public_key_encrypt_pkcs1_v15( 4968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->server_rsa_key, 4978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pre_master_secret, TLS_PRE_MASTER_SECRET_LEN, 4988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos, &clen); 4998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memset(pre_master_secret, 0, TLS_PRE_MASTER_SECRET_LEN); 5008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (res < 0) { 5018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: RSA encryption failed"); 5028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 5038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 5048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 5058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 5068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE16(*pos - 2, clen); 5078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump(MSG_MSGDUMP, "TLSv1: Encrypted pre_master_secret", 5088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos, clen); 5098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos += clen; 5108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 5128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 5138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int tls_write_client_key_exchange(struct tlsv1_client *conn, 5168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 **msgpos, u8 *end) 5178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 5188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *pos, *rhdr, *hs_start, *hs_length; 5198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t rlen; 5208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_key_exchange keyx; 5218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const struct tls_cipher_suite *suite; 5228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt suite = tls_get_cipher_suite(conn->rl.cipher_suite); 5248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (suite == NULL) 5258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt keyx = TLS_KEY_X_NULL; 5268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt else 5278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt keyx = suite->key_exchange; 5288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = *msgpos; 5308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Send ClientKeyExchange"); 5328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt rhdr = pos; 5348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += TLS_RECORD_HEADER_LEN; 5358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* opaque fragment[TLSPlaintext.length] */ 5378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Handshake */ 5398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hs_start = pos; 5408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* HandshakeType msg_type */ 5418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = TLS_HANDSHAKE_TYPE_CLIENT_KEY_EXCHANGE; 5428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* uint24 length (to be filled) */ 5438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hs_length = pos; 5448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 3; 5458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* body - ClientKeyExchange */ 546818ea489ef32dcdc7c098d8a336d6e1dd8996112Dmitry Shmidt if (keyx == TLS_KEY_X_DH_anon || keyx == TLS_KEY_X_DHE_RSA) { 547818ea489ef32dcdc7c098d8a336d6e1dd8996112Dmitry Shmidt if (tlsv1_key_x_dh(conn, &pos, end) < 0) 5488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 5498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } else { 5508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tlsv1_key_x_rsa(conn, &pos, end) < 0) 5518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 5528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 5538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE24(hs_length, pos - hs_length - 3); 5558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE, 5571f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt rhdr, end - rhdr, hs_start, pos - hs_start, 5581f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt &rlen) < 0) { 5598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to create a record"); 5608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 5618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 5628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 5638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 5648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = rhdr + rlen; 5658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start); 5668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *msgpos = pos; 5688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 5708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 5718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int tls_write_client_certificate_verify(struct tlsv1_client *conn, 5748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 **msgpos, u8 *end) 5758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 5768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *pos, *rhdr, *hs_start, *hs_length, *signed_start; 5778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t rlen, hlen, clen; 5781f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt u8 hash[100], *hpos; 5798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = *msgpos; 5818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Send CertificateVerify"); 5838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt rhdr = pos; 5848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += TLS_RECORD_HEADER_LEN; 5858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Handshake */ 5878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hs_start = pos; 5888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* HandshakeType msg_type */ 5898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = TLS_HANDSHAKE_TYPE_CERTIFICATE_VERIFY; 5908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* uint24 length (to be filled) */ 5918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hs_length = pos; 5928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 3; 5938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* 5958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * RFC 2246: 7.4.3 and 7.4.8: 5968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * Signature signature 5978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * 5988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * RSA: 5998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * digitally-signed struct { 6008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * opaque md5_hash[16]; 6018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * opaque sha_hash[20]; 6028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * }; 6038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * 6048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * DSA: 6058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * digitally-signed struct { 6068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * opaque sha_hash[20]; 6078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * }; 6088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * 6098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * The hash values are calculated over all handshake messages sent or 6108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * received starting at ClientHello up to, but not including, this 6118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * CertificateVerify message, including the type and length fields of 6128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * the handshake messages. 6138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 6148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 6158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hpos = hash; 6168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 6171f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt#ifdef CONFIG_TLSV12 6181f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt if (conn->rl.tls_version == TLS_VERSION_1_2) { 6191f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt hlen = SHA256_MAC_LEN; 6201f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt if (conn->verify.sha256_cert == NULL || 6211f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt crypto_hash_finish(conn->verify.sha256_cert, hpos, &hlen) < 6221f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt 0) { 6231f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt conn->verify.sha256_cert = NULL; 6241f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 6251f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 6261f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt return -1; 6271f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt } 6281f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt conn->verify.sha256_cert = NULL; 6291f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt 6301f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt /* 6311f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * RFC 3447, A.2.4 RSASSA-PKCS1-v1_5 6321f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * 6331f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * DigestInfo ::= SEQUENCE { 6341f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * digestAlgorithm DigestAlgorithm, 6351f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * digest OCTET STRING 6361f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * } 6371f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * 6381f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * SHA-256 OID: sha256WithRSAEncryption ::= {pkcs-1 11} 6391f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * 6401f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * DER encoded DigestInfo for SHA256 per RFC 3447: 6411f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * 30 31 30 0d 06 09 60 86 48 01 65 03 04 02 01 05 00 04 20 || 6421f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * H 6431f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt */ 6441f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt os_memmove(hash + 19, hash, hlen); 6451f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt hlen += 19; 6461f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt os_memcpy(hash, "\x30\x31\x30\x0d\x06\x09\x60\x86\x48\x01\x65" 6471f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt "\x03\x04\x02\x01\x05\x00\x04\x20", 19); 6481f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt } else { 6491f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt#endif /* CONFIG_TLSV12 */ 6501f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt 651203eadb9eda41a1dde4a583edb4684319e3f399eDmitry Shmidt hlen = MD5_MAC_LEN; 652203eadb9eda41a1dde4a583edb4684319e3f399eDmitry Shmidt if (conn->verify.md5_cert == NULL || 653203eadb9eda41a1dde4a583edb4684319e3f399eDmitry Shmidt crypto_hash_finish(conn->verify.md5_cert, hpos, &hlen) < 0) { 654203eadb9eda41a1dde4a583edb4684319e3f399eDmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 655203eadb9eda41a1dde4a583edb4684319e3f399eDmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 656203eadb9eda41a1dde4a583edb4684319e3f399eDmitry Shmidt conn->verify.md5_cert = NULL; 657203eadb9eda41a1dde4a583edb4684319e3f399eDmitry Shmidt crypto_hash_finish(conn->verify.sha1_cert, NULL, NULL); 658203eadb9eda41a1dde4a583edb4684319e3f399eDmitry Shmidt conn->verify.sha1_cert = NULL; 659203eadb9eda41a1dde4a583edb4684319e3f399eDmitry Shmidt return -1; 660203eadb9eda41a1dde4a583edb4684319e3f399eDmitry Shmidt } 661203eadb9eda41a1dde4a583edb4684319e3f399eDmitry Shmidt hpos += MD5_MAC_LEN; 6628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 6638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->verify.md5_cert = NULL; 6648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hlen = SHA1_MAC_LEN; 6658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (conn->verify.sha1_cert == NULL || 6668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt crypto_hash_finish(conn->verify.sha1_cert, hpos, &hlen) < 0) { 6678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->verify.sha1_cert = NULL; 6688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 6698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 6708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 6718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 6728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->verify.sha1_cert = NULL; 6738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 674203eadb9eda41a1dde4a583edb4684319e3f399eDmitry Shmidt hlen += MD5_MAC_LEN; 6758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 6761f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt#ifdef CONFIG_TLSV12 6771f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt } 6781f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt#endif /* CONFIG_TLSV12 */ 6791f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt 6808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump(MSG_MSGDUMP, "TLSv1: CertificateVerify hash", hash, hlen); 6818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 6821f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt#ifdef CONFIG_TLSV12 6831f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt if (conn->rl.tls_version >= TLS_VERSION_1_2) { 6841f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt /* 6851f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * RFC 5246, 4.7: 6861f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * TLS v1.2 adds explicit indication of the used signature and 6871f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * hash algorithms. 6881f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * 6891f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * struct { 6901f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * HashAlgorithm hash; 6911f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * SignatureAlgorithm signature; 6921f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt * } SignatureAndHashAlgorithm; 6931f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt */ 6941f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt *pos++ = TLS_HASH_ALG_SHA256; 6951f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt *pos++ = TLS_SIGN_ALG_RSA; 6961f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt } 6971f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt#endif /* CONFIG_TLSV12 */ 6981f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt 6998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* 7008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * RFC 2246, 4.7: 7018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * In digital signing, one-way hash functions are used as input for a 7028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * signing algorithm. A digitally-signed element is encoded as an 7038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * opaque vector <0..2^16-1>, where the length is specified by the 7048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * signing algorithm and key. 7058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * 7068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * In RSA signing, a 36-byte structure of two hashes (one SHA and one 7078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * MD5) is signed (encrypted with the private key). It is encoded with 7088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * PKCS #1 block type 0 or type 1 as described in [PKCS1]. 7098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 7108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt signed_start = pos; /* length to be filled */ 7118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 2; 7128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt clen = end - pos; 7138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (conn->cred == NULL || 7148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt crypto_private_key_sign_pkcs1(conn->cred->key, hash, hlen, 7158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos, &clen) < 0) { 7168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to sign hash (PKCS #1)"); 7178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 7188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 7198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 7208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 7218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE16(signed_start, clen); 7228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += clen; 7248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE24(hs_length, pos - hs_length - 3); 7268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE, 7281f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt rhdr, end - rhdr, hs_start, pos - hs_start, 7291f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt &rlen) < 0) { 7308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate a record"); 7318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 7328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 7338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 7348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 7358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = rhdr + rlen; 7368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start); 7388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *msgpos = pos; 7408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 7428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 7438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int tls_write_client_change_cipher_spec(struct tlsv1_client *conn, 7468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 **msgpos, u8 *end) 7478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 7488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t rlen; 7491f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt u8 payload[1]; 7508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Send ChangeCipherSpec"); 7521f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt 7531f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt payload[0] = TLS_CHANGE_CIPHER_SPEC; 7541f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt 7558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_CHANGE_CIPHER_SPEC, 7561f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt *msgpos, end - *msgpos, payload, sizeof(payload), 7571f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt &rlen) < 0) { 7588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to create a record"); 7598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 7608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 7618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 7628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 7638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tlsv1_record_change_write_cipher(&conn->rl) < 0) { 7658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to set write cipher for " 7668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "record layer"); 7678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 7688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 7698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 7708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 7718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7721f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt *msgpos += rlen; 7738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 7758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 7768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int tls_write_client_finished(struct tlsv1_client *conn, 7798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 **msgpos, u8 *end) 7808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 7811f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt u8 *pos, *hs_start; 7828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t rlen, hlen; 7831f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt u8 verify_data[1 + 3 + TLS_VERIFY_DATA_LEN]; 7848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 hash[MD5_MAC_LEN + SHA1_MAC_LEN]; 7858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Send Finished"); 7878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Encrypted Handshake Message: Finished */ 7898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 7901f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt#ifdef CONFIG_TLSV12 7911f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt if (conn->rl.tls_version >= TLS_VERSION_1_2) { 7921f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt hlen = SHA256_MAC_LEN; 7931f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt if (conn->verify.sha256_client == NULL || 7941f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt crypto_hash_finish(conn->verify.sha256_client, hash, &hlen) 7951f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt < 0) { 7961f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 7971f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 7981f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt conn->verify.sha256_client = NULL; 7991f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt return -1; 8001f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt } 8011f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt conn->verify.sha256_client = NULL; 8021f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt } else { 8031f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt#endif /* CONFIG_TLSV12 */ 8041f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt 8058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hlen = MD5_MAC_LEN; 8068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (conn->verify.md5_client == NULL || 8078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt crypto_hash_finish(conn->verify.md5_client, hash, &hlen) < 0) { 8088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 8098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 8108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->verify.md5_client = NULL; 8118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt crypto_hash_finish(conn->verify.sha1_client, NULL, NULL); 8128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->verify.sha1_client = NULL; 8138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 8148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 8158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->verify.md5_client = NULL; 8168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hlen = SHA1_MAC_LEN; 8178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (conn->verify.sha1_client == NULL || 8188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt crypto_hash_finish(conn->verify.sha1_client, hash + MD5_MAC_LEN, 8198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt &hlen) < 0) { 8208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->verify.sha1_client = NULL; 8218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 8228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 8238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 8248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 8258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->verify.sha1_client = NULL; 8261f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt hlen = MD5_MAC_LEN + SHA1_MAC_LEN; 8271f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt 8281f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt#ifdef CONFIG_TLSV12 8291f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt } 8301f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt#endif /* CONFIG_TLSV12 */ 8318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8321f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt if (tls_prf(conn->rl.tls_version, 8331f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt conn->master_secret, TLS_MASTER_SECRET_LEN, 8341f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt "client finished", hash, hlen, 8351f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt verify_data + 1 + 3, TLS_VERIFY_DATA_LEN)) { 8368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate verify_data"); 8378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 8388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 8398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 8408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 8418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump_key(MSG_DEBUG, "TLSv1: verify_data (client)", 8421f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt verify_data + 1 + 3, TLS_VERIFY_DATA_LEN); 8438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Handshake */ 8451f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt pos = hs_start = verify_data; 8468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* HandshakeType msg_type */ 8478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = TLS_HANDSHAKE_TYPE_FINISHED; 8481f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt /* uint24 length */ 8491f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt WPA_PUT_BE24(pos, TLS_VERIFY_DATA_LEN); 8508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 3; 8511f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt pos += TLS_VERIFY_DATA_LEN; /* verify_data already in place */ 8528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start); 8538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE, 8551f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt *msgpos, end - *msgpos, hs_start, pos - hs_start, 8561f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt &rlen) < 0) { 8578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Failed to create a record"); 8588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_alert(conn, TLS_ALERT_LEVEL_FATAL, 8598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt TLS_ALERT_INTERNAL_ERROR); 8608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 8618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 8628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8631f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt *msgpos += rlen; 8648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return 0; 8668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 8678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic u8 * tls_send_client_key_exchange(struct tlsv1_client *conn, 8708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t *out_len) 8718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 8728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *msg, *end, *pos; 8738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t msglen; 8748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *out_len = 0; 8768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt msglen = 2000; 8788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (conn->certificate_requested) 8798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt msglen += tls_client_cert_chain_der_len(conn); 8808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt msg = os_malloc(msglen); 8828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (msg == NULL) 8838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 8848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = msg; 8868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt end = msg + msglen; 8878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (conn->certificate_requested) { 8898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tls_write_client_certificate(conn, &pos, end) < 0) { 8908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(msg); 8918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 8928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 8938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 8948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 8958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tls_write_client_key_exchange(conn, &pos, end) < 0 || 8968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt (conn->certificate_requested && conn->cred && conn->cred->key && 8978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_write_client_certificate_verify(conn, &pos, end) < 0) || 8988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_write_client_change_cipher_spec(conn, &pos, end) < 0 || 8998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_write_client_finished(conn, &pos, end) < 0) { 9008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(msg); 9018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 9028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 9038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *out_len = pos - msg; 9058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->state = SERVER_CHANGE_CIPHER_SPEC; 9078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return msg; 9098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 9108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic u8 * tls_send_change_cipher_spec(struct tlsv1_client *conn, 9138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t *out_len) 9148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 9158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *msg, *end, *pos; 9168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *out_len = 0; 9188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt msg = os_malloc(1000); 9208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (msg == NULL) 9218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 9228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = msg; 9248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt end = msg + 1000; 9258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (tls_write_client_change_cipher_spec(conn, &pos, end) < 0 || 9278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt tls_write_client_finished(conn, &pos, end) < 0) { 9288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(msg); 9298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 9308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 9318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *out_len = pos - msg; 9338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Session resumption completed " 9358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "successfully"); 936d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt if (!conn->session_resumed && conn->use_session_ticket) 937d7ff03d48f825360eec2a371e3361306f2fd721bDmitry Shmidt conn->session_resumed = 1; 9388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->state = ESTABLISHED; 9398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return msg; 9418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 9428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtu8 * tlsv1_client_handshake_write(struct tlsv1_client *conn, size_t *out_len, 9458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt int no_appl_data) 9468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 9478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt switch (conn->state) { 9488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case CLIENT_KEY_EXCHANGE: 9498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return tls_send_client_key_exchange(conn, out_len); 9508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case CHANGE_CIPHER_SPEC: 9518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return tls_send_change_cipher_spec(conn, out_len); 9528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case ACK_FINISHED: 9538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Handshake completed " 9548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "successfully"); 9558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt conn->state = ESTABLISHED; 9568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *out_len = 0; 9578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (no_appl_data) { 9588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Need to return something to get final TLS ACK. */ 9598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return os_malloc(1); 9608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 9618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 9628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt default: 9638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Unexpected state %d while " 9648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "generating reply", conn->state); 9658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 9668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 9678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 9688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtu8 * tlsv1_client_send_alert(struct tlsv1_client *conn, u8 level, 9718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 description, size_t *out_len) 9728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 9738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *alert, *pos, *length; 9748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "TLSv1: Send Alert(%d:%d)", level, description); 9768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *out_len = 0; 9778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt alert = os_malloc(10); 9798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (alert == NULL) 9808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 9818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = alert; 9838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* TLSPlaintext */ 9858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* ContentType type */ 9868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = TLS_CONTENT_TYPE_ALERT; 9878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* ProtocolVersion version */ 9881f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt WPA_PUT_BE16(pos, conn->rl.tls_version ? conn->rl.tls_version : 9891f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt TLS_VERSION); 9908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 2; 9918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* uint16 length (to be filled) */ 9928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt length = pos; 9938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 2; 9948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* opaque fragment[TLSPlaintext.length] */ 9958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 9968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Alert */ 9978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* AlertLevel level */ 9988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = level; 9998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* AlertDescription description */ 10008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *pos++ = description; 10018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 10028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE16(length, pos - length - 2); 10038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *out_len = pos - alert; 10048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 10058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return alert; 10068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 1007