1 /* 2 * HTTP wrapper for libcurl 3 * Copyright (c) 2012-2014, Qualcomm Atheros, Inc. 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 #include <curl/curl.h> 11 #ifdef EAP_TLS_OPENSSL 12 #include <openssl/ssl.h> 13 #include <openssl/asn1.h> 14 #include <openssl/asn1t.h> 15 #include <openssl/x509v3.h> 16 17 #ifdef SSL_set_tlsext_status_type 18 #ifndef OPENSSL_NO_TLSEXT 19 #define HAVE_OCSP 20 #include <openssl/err.h> 21 #include <openssl/ocsp.h> 22 #endif /* OPENSSL_NO_TLSEXT */ 23 #endif /* SSL_set_tlsext_status_type */ 24 #endif /* EAP_TLS_OPENSSL */ 25 26 #include "common.h" 27 #include "xml-utils.h" 28 #include "http-utils.h" 29 #ifdef EAP_TLS_OPENSSL 30 #include "crypto/tls_openssl.h" 31 #endif /* EAP_TLS_OPENSSL */ 32 33 34 #if OPENSSL_VERSION_NUMBER < 0x10100000L 35 static const unsigned char * ASN1_STRING_get0_data(const ASN1_STRING *x) 36 { 37 return ASN1_STRING_data((ASN1_STRING *) x); 38 } 39 #endif /* OpenSSL < 1.1.0 */ 40 41 42 struct http_ctx { 43 void *ctx; 44 struct xml_node_ctx *xml; 45 CURL *curl; 46 struct curl_slist *curl_hdr; 47 char *svc_address; 48 char *svc_ca_fname; 49 char *svc_username; 50 char *svc_password; 51 char *svc_client_cert; 52 char *svc_client_key; 53 char *curl_buf; 54 size_t curl_buf_len; 55 56 int (*cert_cb)(void *ctx, struct http_cert *cert); 57 void *cert_cb_ctx; 58 59 enum { 60 NO_OCSP, OPTIONAL_OCSP, MANDATORY_OCSP 61 } ocsp; 62 X509 *peer_cert; 63 X509 *peer_issuer; 64 X509 *peer_issuer_issuer; 65 66 const char *last_err; 67 }; 68 69 70 static void clear_curl(struct http_ctx *ctx) 71 { 72 if (ctx->curl) { 73 curl_easy_cleanup(ctx->curl); 74 ctx->curl = NULL; 75 } 76 if (ctx->curl_hdr) { 77 curl_slist_free_all(ctx->curl_hdr); 78 ctx->curl_hdr = NULL; 79 } 80 } 81 82 83 static void clone_str(char **dst, const char *src) 84 { 85 os_free(*dst); 86 if (src) 87 *dst = os_strdup(src); 88 else 89 *dst = NULL; 90 } 91 92 93 static void debug_dump(struct http_ctx *ctx, const char *title, 94 const char *buf, size_t len) 95 { 96 char *txt; 97 size_t i; 98 99 for (i = 0; i < len; i++) { 100 if (buf[i] < 32 && buf[i] != '\t' && buf[i] != '\n' && 101 buf[i] != '\r') { 102 wpa_hexdump_ascii(MSG_MSGDUMP, title, buf, len); 103 return; 104 } 105 } 106 107 txt = os_malloc(len + 1); 108 if (txt == NULL) 109 return; 110 os_memcpy(txt, buf, len); 111 txt[len] = '\0'; 112 while (len > 0) { 113 len--; 114 if (txt[len] == '\n' || txt[len] == '\r') 115 txt[len] = '\0'; 116 else 117 break; 118 } 119 wpa_printf(MSG_MSGDUMP, "%s[%s]", title, txt); 120 os_free(txt); 121 } 122 123 124 static int curl_cb_debug(CURL *curl, curl_infotype info, char *buf, size_t len, 125 void *userdata) 126 { 127 struct http_ctx *ctx = userdata; 128 switch (info) { 129 case CURLINFO_TEXT: 130 debug_dump(ctx, "CURLINFO_TEXT", buf, len); 131 break; 132 case CURLINFO_HEADER_IN: 133 debug_dump(ctx, "CURLINFO_HEADER_IN", buf, len); 134 break; 135 case CURLINFO_HEADER_OUT: 136 debug_dump(ctx, "CURLINFO_HEADER_OUT", buf, len); 137 break; 138 case CURLINFO_DATA_IN: 139 debug_dump(ctx, "CURLINFO_DATA_IN", buf, len); 140 break; 141 case CURLINFO_DATA_OUT: 142 debug_dump(ctx, "CURLINFO_DATA_OUT", buf, len); 143 break; 144 case CURLINFO_SSL_DATA_IN: 145 wpa_printf(MSG_DEBUG, "debug - CURLINFO_SSL_DATA_IN - %d", 146 (int) len); 147 break; 148 case CURLINFO_SSL_DATA_OUT: 149 wpa_printf(MSG_DEBUG, "debug - CURLINFO_SSL_DATA_OUT - %d", 150 (int) len); 151 break; 152 case CURLINFO_END: 153 wpa_printf(MSG_DEBUG, "debug - CURLINFO_END - %d", 154 (int) len); 155 break; 156 } 157 return 0; 158 } 159 160 161 static size_t curl_cb_write(void *ptr, size_t size, size_t nmemb, 162 void *userdata) 163 { 164 struct http_ctx *ctx = userdata; 165 char *n; 166 n = os_realloc(ctx->curl_buf, ctx->curl_buf_len + size * nmemb + 1); 167 if (n == NULL) 168 return 0; 169 ctx->curl_buf = n; 170 os_memcpy(n + ctx->curl_buf_len, ptr, size * nmemb); 171 n[ctx->curl_buf_len + size * nmemb] = '\0'; 172 ctx->curl_buf_len += size * nmemb; 173 return size * nmemb; 174 } 175 176 177 #ifdef EAP_TLS_OPENSSL 178 179 static void debug_dump_cert(const char *title, X509 *cert) 180 { 181 BIO *out; 182 char *txt; 183 size_t rlen; 184 185 out = BIO_new(BIO_s_mem()); 186 if (!out) 187 return; 188 189 X509_print_ex(out, cert, XN_FLAG_COMPAT, X509_FLAG_COMPAT); 190 rlen = BIO_ctrl_pending(out); 191 txt = os_malloc(rlen + 1); 192 if (txt) { 193 int res = BIO_read(out, txt, rlen); 194 if (res > 0) { 195 txt[res] = '\0'; 196 wpa_printf(MSG_MSGDUMP, "%s:\n%s", title, txt); 197 } 198 os_free(txt); 199 } 200 BIO_free(out); 201 } 202 203 204 static void add_alt_name_othername(struct http_ctx *ctx, struct http_cert *cert, 205 OTHERNAME *o) 206 { 207 char txt[100]; 208 int res; 209 struct http_othername *on; 210 ASN1_TYPE *val; 211 212 on = os_realloc_array(cert->othername, cert->num_othername + 1, 213 sizeof(struct http_othername)); 214 if (on == NULL) 215 return; 216 cert->othername = on; 217 on = &on[cert->num_othername]; 218 os_memset(on, 0, sizeof(*on)); 219 220 res = OBJ_obj2txt(txt, sizeof(txt), o->type_id, 1); 221 if (res < 0 || res >= (int) sizeof(txt)) 222 return; 223 224 on->oid = os_strdup(txt); 225 if (on->oid == NULL) 226 return; 227 228 val = o->value; 229 on->data = val->value.octet_string->data; 230 on->len = val->value.octet_string->length; 231 232 cert->num_othername++; 233 } 234 235 236 static void add_alt_name_dns(struct http_ctx *ctx, struct http_cert *cert, 237 ASN1_STRING *name) 238 { 239 char *buf; 240 char **n; 241 242 buf = NULL; 243 if (ASN1_STRING_to_UTF8((unsigned char **) &buf, name) < 0) 244 return; 245 246 n = os_realloc_array(cert->dnsname, cert->num_dnsname + 1, 247 sizeof(char *)); 248 if (n == NULL) 249 return; 250 251 cert->dnsname = n; 252 n[cert->num_dnsname] = buf; 253 cert->num_dnsname++; 254 } 255 256 257 static void add_alt_name(struct http_ctx *ctx, struct http_cert *cert, 258 const GENERAL_NAME *name) 259 { 260 switch (name->type) { 261 case GEN_OTHERNAME: 262 add_alt_name_othername(ctx, cert, name->d.otherName); 263 break; 264 case GEN_DNS: 265 add_alt_name_dns(ctx, cert, name->d.dNSName); 266 break; 267 } 268 } 269 270 271 static void add_alt_names(struct http_ctx *ctx, struct http_cert *cert, 272 GENERAL_NAMES *names) 273 { 274 int num, i; 275 276 num = sk_GENERAL_NAME_num(names); 277 for (i = 0; i < num; i++) { 278 const GENERAL_NAME *name; 279 name = sk_GENERAL_NAME_value(names, i); 280 add_alt_name(ctx, cert, name); 281 } 282 } 283 284 285 /* RFC 3709 */ 286 287 typedef struct { 288 X509_ALGOR *hashAlg; 289 ASN1_OCTET_STRING *hashValue; 290 } HashAlgAndValue; 291 292 typedef struct { 293 STACK_OF(HashAlgAndValue) *refStructHash; 294 STACK_OF(ASN1_IA5STRING) *refStructURI; 295 } LogotypeReference; 296 297 typedef struct { 298 ASN1_IA5STRING *mediaType; 299 STACK_OF(HashAlgAndValue) *logotypeHash; 300 STACK_OF(ASN1_IA5STRING) *logotypeURI; 301 } LogotypeDetails; 302 303 typedef struct { 304 int type; 305 union { 306 ASN1_INTEGER *numBits; 307 ASN1_INTEGER *tableSize; 308 } d; 309 } LogotypeImageResolution; 310 311 typedef struct { 312 ASN1_INTEGER *type; /* LogotypeImageType ::= INTEGER */ 313 ASN1_INTEGER *fileSize; 314 ASN1_INTEGER *xSize; 315 ASN1_INTEGER *ySize; 316 LogotypeImageResolution *resolution; 317 ASN1_IA5STRING *language; 318 } LogotypeImageInfo; 319 320 typedef struct { 321 LogotypeDetails *imageDetails; 322 LogotypeImageInfo *imageInfo; 323 } LogotypeImage; 324 325 typedef struct { 326 ASN1_INTEGER *fileSize; 327 ASN1_INTEGER *playTime; 328 ASN1_INTEGER *channels; 329 ASN1_INTEGER *sampleRate; 330 ASN1_IA5STRING *language; 331 } LogotypeAudioInfo; 332 333 typedef struct { 334 LogotypeDetails *audioDetails; 335 LogotypeAudioInfo *audioInfo; 336 } LogotypeAudio; 337 338 typedef struct { 339 STACK_OF(LogotypeImage) *image; 340 STACK_OF(LogotypeAudio) *audio; 341 } LogotypeData; 342 343 typedef struct { 344 int type; 345 union { 346 LogotypeData *direct; 347 LogotypeReference *indirect; 348 } d; 349 } LogotypeInfo; 350 351 typedef struct { 352 ASN1_OBJECT *logotypeType; 353 LogotypeInfo *info; 354 } OtherLogotypeInfo; 355 356 typedef struct { 357 STACK_OF(LogotypeInfo) *communityLogos; 358 LogotypeInfo *issuerLogo; 359 LogotypeInfo *subjectLogo; 360 STACK_OF(OtherLogotypeInfo) *otherLogos; 361 } LogotypeExtn; 362 363 ASN1_SEQUENCE(HashAlgAndValue) = { 364 ASN1_SIMPLE(HashAlgAndValue, hashAlg, X509_ALGOR), 365 ASN1_SIMPLE(HashAlgAndValue, hashValue, ASN1_OCTET_STRING) 366 } ASN1_SEQUENCE_END(HashAlgAndValue); 367 368 ASN1_SEQUENCE(LogotypeReference) = { 369 ASN1_SEQUENCE_OF(LogotypeReference, refStructHash, HashAlgAndValue), 370 ASN1_SEQUENCE_OF(LogotypeReference, refStructURI, ASN1_IA5STRING) 371 } ASN1_SEQUENCE_END(LogotypeReference); 372 373 ASN1_SEQUENCE(LogotypeDetails) = { 374 ASN1_SIMPLE(LogotypeDetails, mediaType, ASN1_IA5STRING), 375 ASN1_SEQUENCE_OF(LogotypeDetails, logotypeHash, HashAlgAndValue), 376 ASN1_SEQUENCE_OF(LogotypeDetails, logotypeURI, ASN1_IA5STRING) 377 } ASN1_SEQUENCE_END(LogotypeDetails); 378 379 ASN1_CHOICE(LogotypeImageResolution) = { 380 ASN1_IMP(LogotypeImageResolution, d.numBits, ASN1_INTEGER, 1), 381 ASN1_IMP(LogotypeImageResolution, d.tableSize, ASN1_INTEGER, 2) 382 } ASN1_CHOICE_END(LogotypeImageResolution); 383 384 ASN1_SEQUENCE(LogotypeImageInfo) = { 385 ASN1_IMP_OPT(LogotypeImageInfo, type, ASN1_INTEGER, 0), 386 ASN1_SIMPLE(LogotypeImageInfo, fileSize, ASN1_INTEGER), 387 ASN1_SIMPLE(LogotypeImageInfo, xSize, ASN1_INTEGER), 388 ASN1_SIMPLE(LogotypeImageInfo, ySize, ASN1_INTEGER), 389 ASN1_OPT(LogotypeImageInfo, resolution, LogotypeImageResolution), 390 ASN1_IMP_OPT(LogotypeImageInfo, language, ASN1_IA5STRING, 4), 391 } ASN1_SEQUENCE_END(LogotypeImageInfo); 392 393 ASN1_SEQUENCE(LogotypeImage) = { 394 ASN1_SIMPLE(LogotypeImage, imageDetails, LogotypeDetails), 395 ASN1_OPT(LogotypeImage, imageInfo, LogotypeImageInfo) 396 } ASN1_SEQUENCE_END(LogotypeImage); 397 398 ASN1_SEQUENCE(LogotypeAudioInfo) = { 399 ASN1_SIMPLE(LogotypeAudioInfo, fileSize, ASN1_INTEGER), 400 ASN1_SIMPLE(LogotypeAudioInfo, playTime, ASN1_INTEGER), 401 ASN1_SIMPLE(LogotypeAudioInfo, channels, ASN1_INTEGER), 402 ASN1_IMP_OPT(LogotypeAudioInfo, sampleRate, ASN1_INTEGER, 3), 403 ASN1_IMP_OPT(LogotypeAudioInfo, language, ASN1_IA5STRING, 4) 404 } ASN1_SEQUENCE_END(LogotypeAudioInfo); 405 406 ASN1_SEQUENCE(LogotypeAudio) = { 407 ASN1_SIMPLE(LogotypeAudio, audioDetails, LogotypeDetails), 408 ASN1_OPT(LogotypeAudio, audioInfo, LogotypeAudioInfo) 409 } ASN1_SEQUENCE_END(LogotypeAudio); 410 411 ASN1_SEQUENCE(LogotypeData) = { 412 ASN1_SEQUENCE_OF_OPT(LogotypeData, image, LogotypeImage), 413 ASN1_IMP_SEQUENCE_OF_OPT(LogotypeData, audio, LogotypeAudio, 1) 414 } ASN1_SEQUENCE_END(LogotypeData); 415 416 ASN1_CHOICE(LogotypeInfo) = { 417 ASN1_IMP(LogotypeInfo, d.direct, LogotypeData, 0), 418 ASN1_IMP(LogotypeInfo, d.indirect, LogotypeReference, 1) 419 } ASN1_CHOICE_END(LogotypeInfo); 420 421 ASN1_SEQUENCE(OtherLogotypeInfo) = { 422 ASN1_SIMPLE(OtherLogotypeInfo, logotypeType, ASN1_OBJECT), 423 ASN1_SIMPLE(OtherLogotypeInfo, info, LogotypeInfo) 424 } ASN1_SEQUENCE_END(OtherLogotypeInfo); 425 426 ASN1_SEQUENCE(LogotypeExtn) = { 427 ASN1_EXP_SEQUENCE_OF_OPT(LogotypeExtn, communityLogos, LogotypeInfo, 0), 428 ASN1_EXP_OPT(LogotypeExtn, issuerLogo, LogotypeInfo, 1), 429 ASN1_EXP_OPT(LogotypeExtn, issuerLogo, LogotypeInfo, 2), 430 ASN1_EXP_SEQUENCE_OF_OPT(LogotypeExtn, otherLogos, OtherLogotypeInfo, 3) 431 } ASN1_SEQUENCE_END(LogotypeExtn); 432 433 IMPLEMENT_ASN1_FUNCTIONS(LogotypeExtn); 434 435 #ifdef OPENSSL_IS_BORINGSSL 436 #define sk_LogotypeInfo_num(st) \ 437 sk_num(CHECKED_CAST(_STACK *, STACK_OF(LogotypeInfo) *, (st))) 438 #define sk_LogotypeInfo_value(st, i) (LogotypeInfo *) \ 439 sk_value(CHECKED_CAST(_STACK *, const STACK_OF(LogotypeInfo) *, (st)), (i)) 440 #define sk_LogotypeImage_num(st) \ 441 sk_num(CHECKED_CAST(_STACK *, STACK_OF(LogotypeImage) *, (st))) 442 #define sk_LogotypeImage_value(st, i) (LogotypeImage *) \ 443 sk_value(CHECKED_CAST(_STACK *, const STACK_OF(LogotypeImage) *, (st)), (i)) 444 #define sk_LogotypeAudio_num(st) \ 445 sk_num(CHECKED_CAST(_STACK *, STACK_OF(LogotypeAudio) *, (st))) 446 #define sk_LogotypeAudio_value(st, i) (LogotypeAudio *) \ 447 sk_value(CHECK_CAST(_STACK *, const STACK_OF(LogotypeAudio) *, (st)), (i)) 448 #define sk_HashAlgAndValue_num(st) \ 449 sk_num(CHECKED_CAST(_STACK *, STACK_OF(HashAlgAndValue) *, (st))) 450 #define sk_HashAlgAndValue_value(st, i) (HashAlgAndValue *) \ 451 sk_value(CHECKED_CAST(_STACK *, const STACK_OF(HashAlgAndValue) *, (st)), (i)) 452 #define sk_ASN1_IA5STRING_num(st) \ 453 sk_num(CHECKED_CAST(_STACK *, STACK_OF(ASN1_IA5STRING) *, (st))) 454 #define sk_ASN1_IA5STRING_value(st, i) (ASN1_IA5STRING *) \ 455 sk_value(CHECKED_CAST(_STACK *, const STACK_OF(ASN1_IA5STRING) *, (st)), (i)) 456 #else /* OPENSSL_IS_BORINGSSL */ 457 #if OPENSSL_VERSION_NUMBER < 0x10100000L 458 #define sk_LogotypeInfo_num(st) SKM_sk_num(LogotypeInfo, (st)) 459 #define sk_LogotypeInfo_value(st, i) SKM_sk_value(LogotypeInfo, (st), (i)) 460 #define sk_LogotypeImage_num(st) SKM_sk_num(LogotypeImage, (st)) 461 #define sk_LogotypeImage_value(st, i) SKM_sk_value(LogotypeImage, (st), (i)) 462 #define sk_LogotypeAudio_num(st) SKM_sk_num(LogotypeAudio, (st)) 463 #define sk_LogotypeAudio_value(st, i) SKM_sk_value(LogotypeAudio, (st), (i)) 464 #define sk_HashAlgAndValue_num(st) SKM_sk_num(HashAlgAndValue, (st)) 465 #define sk_HashAlgAndValue_value(st, i) SKM_sk_value(HashAlgAndValue, (st), (i)) 466 #define sk_ASN1_IA5STRING_num(st) SKM_sk_num(ASN1_IA5STRING, (st)) 467 #define sk_ASN1_IA5STRING_value(st, i) SKM_sk_value(ASN1_IA5STRING, (st), (i)) 468 #else 469 DEFINE_STACK_OF(LogotypeInfo) 470 DEFINE_STACK_OF(LogotypeImage) 471 DEFINE_STACK_OF(LogotypeAudio) 472 DEFINE_STACK_OF(HashAlgAndValue) 473 DEFINE_STACK_OF(ASN1_IA5STRING) 474 #endif 475 #endif /* OPENSSL_IS_BORINGSSL */ 476 477 478 static void add_logo(struct http_ctx *ctx, struct http_cert *hcert, 479 HashAlgAndValue *hash, ASN1_IA5STRING *uri) 480 { 481 char txt[100]; 482 int res, len; 483 struct http_logo *n; 484 485 if (hash == NULL || uri == NULL) 486 return; 487 488 res = OBJ_obj2txt(txt, sizeof(txt), hash->hashAlg->algorithm, 1); 489 if (res < 0 || res >= (int) sizeof(txt)) 490 return; 491 492 n = os_realloc_array(hcert->logo, hcert->num_logo + 1, 493 sizeof(struct http_logo)); 494 if (n == NULL) 495 return; 496 hcert->logo = n; 497 n = &hcert->logo[hcert->num_logo]; 498 os_memset(n, 0, sizeof(*n)); 499 500 n->alg_oid = os_strdup(txt); 501 if (n->alg_oid == NULL) 502 return; 503 504 n->hash_len = ASN1_STRING_length(hash->hashValue); 505 n->hash = os_memdup(ASN1_STRING_get0_data(hash->hashValue), 506 n->hash_len); 507 if (n->hash == NULL) { 508 os_free(n->alg_oid); 509 return; 510 } 511 512 len = ASN1_STRING_length(uri); 513 n->uri = os_malloc(len + 1); 514 if (n->uri == NULL) { 515 os_free(n->alg_oid); 516 os_free(n->hash); 517 return; 518 } 519 os_memcpy(n->uri, ASN1_STRING_get0_data(uri), len); 520 n->uri[len] = '\0'; 521 522 hcert->num_logo++; 523 } 524 525 526 static void add_logo_direct(struct http_ctx *ctx, struct http_cert *hcert, 527 LogotypeData *data) 528 { 529 int i, num; 530 531 if (data->image == NULL) 532 return; 533 534 num = sk_LogotypeImage_num(data->image); 535 for (i = 0; i < num; i++) { 536 LogotypeImage *image; 537 LogotypeDetails *details; 538 int j, hash_num, uri_num; 539 HashAlgAndValue *found_hash = NULL; 540 541 image = sk_LogotypeImage_value(data->image, i); 542 if (image == NULL) 543 continue; 544 545 details = image->imageDetails; 546 if (details == NULL) 547 continue; 548 549 hash_num = sk_HashAlgAndValue_num(details->logotypeHash); 550 for (j = 0; j < hash_num; j++) { 551 HashAlgAndValue *hash; 552 char txt[100]; 553 int res; 554 hash = sk_HashAlgAndValue_value(details->logotypeHash, 555 j); 556 if (hash == NULL) 557 continue; 558 res = OBJ_obj2txt(txt, sizeof(txt), 559 hash->hashAlg->algorithm, 1); 560 if (res < 0 || res >= (int) sizeof(txt)) 561 continue; 562 if (os_strcmp(txt, "2.16.840.1.101.3.4.2.1") == 0) { 563 found_hash = hash; 564 break; 565 } 566 } 567 568 if (!found_hash) { 569 wpa_printf(MSG_DEBUG, "OpenSSL: No SHA256 hash found for the logo"); 570 continue; 571 } 572 573 uri_num = sk_ASN1_IA5STRING_num(details->logotypeURI); 574 for (j = 0; j < uri_num; j++) { 575 ASN1_IA5STRING *uri; 576 uri = sk_ASN1_IA5STRING_value(details->logotypeURI, j); 577 add_logo(ctx, hcert, found_hash, uri); 578 } 579 } 580 } 581 582 583 static void add_logo_indirect(struct http_ctx *ctx, struct http_cert *hcert, 584 LogotypeReference *ref) 585 { 586 int j, hash_num, uri_num; 587 588 hash_num = sk_HashAlgAndValue_num(ref->refStructHash); 589 uri_num = sk_ASN1_IA5STRING_num(ref->refStructURI); 590 if (hash_num != uri_num) { 591 wpa_printf(MSG_INFO, "Unexpected LogotypeReference array size difference %d != %d", 592 hash_num, uri_num); 593 return; 594 } 595 596 for (j = 0; j < hash_num; j++) { 597 HashAlgAndValue *hash; 598 ASN1_IA5STRING *uri; 599 hash = sk_HashAlgAndValue_value(ref->refStructHash, j); 600 uri = sk_ASN1_IA5STRING_value(ref->refStructURI, j); 601 add_logo(ctx, hcert, hash, uri); 602 } 603 } 604 605 606 static void i2r_HashAlgAndValue(HashAlgAndValue *hash, BIO *out, int indent) 607 { 608 int i; 609 const unsigned char *data; 610 611 BIO_printf(out, "%*shashAlg: ", indent, ""); 612 i2a_ASN1_OBJECT(out, hash->hashAlg->algorithm); 613 BIO_printf(out, "\n"); 614 615 BIO_printf(out, "%*shashValue: ", indent, ""); 616 data = hash->hashValue->data; 617 for (i = 0; i < hash->hashValue->length; i++) 618 BIO_printf(out, "%s%02x", i > 0 ? ":" : "", data[i]); 619 BIO_printf(out, "\n"); 620 } 621 622 static void i2r_LogotypeDetails(LogotypeDetails *details, BIO *out, int indent) 623 { 624 int i, num; 625 626 BIO_printf(out, "%*sLogotypeDetails\n", indent, ""); 627 if (details->mediaType) { 628 BIO_printf(out, "%*smediaType: ", indent, ""); 629 ASN1_STRING_print(out, details->mediaType); 630 BIO_printf(out, "\n"); 631 } 632 633 num = details->logotypeHash ? 634 sk_HashAlgAndValue_num(details->logotypeHash) : 0; 635 for (i = 0; i < num; i++) { 636 HashAlgAndValue *hash; 637 hash = sk_HashAlgAndValue_value(details->logotypeHash, i); 638 i2r_HashAlgAndValue(hash, out, indent); 639 } 640 641 num = details->logotypeURI ? 642 sk_ASN1_IA5STRING_num(details->logotypeURI) : 0; 643 for (i = 0; i < num; i++) { 644 ASN1_IA5STRING *uri; 645 uri = sk_ASN1_IA5STRING_value(details->logotypeURI, i); 646 BIO_printf(out, "%*slogotypeURI: ", indent, ""); 647 ASN1_STRING_print(out, uri); 648 BIO_printf(out, "\n"); 649 } 650 } 651 652 static void i2r_LogotypeImageInfo(LogotypeImageInfo *info, BIO *out, int indent) 653 { 654 long val; 655 656 BIO_printf(out, "%*sLogotypeImageInfo\n", indent, ""); 657 if (info->type) { 658 val = ASN1_INTEGER_get(info->type); 659 BIO_printf(out, "%*stype: %ld\n", indent, "", val); 660 } else { 661 BIO_printf(out, "%*stype: default (1)\n", indent, ""); 662 } 663 val = ASN1_INTEGER_get(info->fileSize); 664 BIO_printf(out, "%*sfileSize: %ld\n", indent, "", val); 665 val = ASN1_INTEGER_get(info->xSize); 666 BIO_printf(out, "%*sxSize: %ld\n", indent, "", val); 667 val = ASN1_INTEGER_get(info->ySize); 668 BIO_printf(out, "%*sySize: %ld\n", indent, "", val); 669 if (info->resolution) { 670 BIO_printf(out, "%*sresolution [%d]\n", indent, "", 671 info->resolution->type); 672 switch (info->resolution->type) { 673 case 0: 674 val = ASN1_INTEGER_get(info->resolution->d.numBits); 675 BIO_printf(out, "%*snumBits: %ld\n", indent, "", val); 676 break; 677 case 1: 678 val = ASN1_INTEGER_get(info->resolution->d.tableSize); 679 BIO_printf(out, "%*stableSize: %ld\n", indent, "", val); 680 break; 681 } 682 } 683 if (info->language) { 684 BIO_printf(out, "%*slanguage: ", indent, ""); 685 ASN1_STRING_print(out, info->language); 686 BIO_printf(out, "\n"); 687 } 688 } 689 690 static void i2r_LogotypeImage(LogotypeImage *image, BIO *out, int indent) 691 { 692 BIO_printf(out, "%*sLogotypeImage\n", indent, ""); 693 if (image->imageDetails) { 694 i2r_LogotypeDetails(image->imageDetails, out, indent + 4); 695 } 696 if (image->imageInfo) { 697 i2r_LogotypeImageInfo(image->imageInfo, out, indent + 4); 698 } 699 } 700 701 static void i2r_LogotypeData(LogotypeData *data, const char *title, BIO *out, 702 int indent) 703 { 704 int i, num; 705 706 BIO_printf(out, "%*s%s - LogotypeData\n", indent, "", title); 707 708 num = data->image ? sk_LogotypeImage_num(data->image) : 0; 709 for (i = 0; i < num; i++) { 710 LogotypeImage *image = sk_LogotypeImage_value(data->image, i); 711 i2r_LogotypeImage(image, out, indent + 4); 712 } 713 714 num = data->audio ? sk_LogotypeAudio_num(data->audio) : 0; 715 for (i = 0; i < num; i++) { 716 BIO_printf(out, "%*saudio: TODO\n", indent, ""); 717 } 718 } 719 720 static void i2r_LogotypeReference(LogotypeReference *ref, const char *title, 721 BIO *out, int indent) 722 { 723 int i, hash_num, uri_num; 724 725 BIO_printf(out, "%*s%s - LogotypeReference\n", indent, "", title); 726 727 hash_num = ref->refStructHash ? 728 sk_HashAlgAndValue_num(ref->refStructHash) : 0; 729 uri_num = ref->refStructURI ? 730 sk_ASN1_IA5STRING_num(ref->refStructURI) : 0; 731 if (hash_num != uri_num) { 732 BIO_printf(out, "%*sUnexpected LogotypeReference array size difference %d != %d\n", 733 indent, "", hash_num, uri_num); 734 return; 735 } 736 737 for (i = 0; i < hash_num; i++) { 738 HashAlgAndValue *hash; 739 ASN1_IA5STRING *uri; 740 741 hash = sk_HashAlgAndValue_value(ref->refStructHash, i); 742 i2r_HashAlgAndValue(hash, out, indent); 743 744 uri = sk_ASN1_IA5STRING_value(ref->refStructURI, i); 745 BIO_printf(out, "%*srefStructURI: ", indent, ""); 746 ASN1_STRING_print(out, uri); 747 BIO_printf(out, "\n"); 748 } 749 } 750 751 static void i2r_LogotypeInfo(LogotypeInfo *info, const char *title, BIO *out, 752 int indent) 753 { 754 switch (info->type) { 755 case 0: 756 i2r_LogotypeData(info->d.direct, title, out, indent); 757 break; 758 case 1: 759 i2r_LogotypeReference(info->d.indirect, title, out, indent); 760 break; 761 } 762 } 763 764 static void debug_print_logotypeext(LogotypeExtn *logo) 765 { 766 BIO *out; 767 int i, num; 768 int indent = 0; 769 770 out = BIO_new_fp(stdout, BIO_NOCLOSE); 771 if (out == NULL) 772 return; 773 774 if (logo->communityLogos) { 775 num = sk_LogotypeInfo_num(logo->communityLogos); 776 for (i = 0; i < num; i++) { 777 LogotypeInfo *info; 778 info = sk_LogotypeInfo_value(logo->communityLogos, i); 779 i2r_LogotypeInfo(info, "communityLogo", out, indent); 780 } 781 } 782 783 if (logo->issuerLogo) { 784 i2r_LogotypeInfo(logo->issuerLogo, "issuerLogo", out, indent ); 785 } 786 787 if (logo->subjectLogo) { 788 i2r_LogotypeInfo(logo->subjectLogo, "subjectLogo", out, indent); 789 } 790 791 if (logo->otherLogos) { 792 BIO_printf(out, "%*sotherLogos - TODO\n", indent, ""); 793 } 794 795 BIO_free(out); 796 } 797 798 799 static void add_logotype_ext(struct http_ctx *ctx, struct http_cert *hcert, 800 X509 *cert) 801 { 802 ASN1_OBJECT *obj; 803 int pos; 804 X509_EXTENSION *ext; 805 ASN1_OCTET_STRING *os; 806 LogotypeExtn *logo; 807 const unsigned char *data; 808 int i, num; 809 810 obj = OBJ_txt2obj("1.3.6.1.5.5.7.1.12", 0); 811 if (obj == NULL) 812 return; 813 814 pos = X509_get_ext_by_OBJ(cert, obj, -1); 815 if (pos < 0) { 816 wpa_printf(MSG_INFO, "No logotype extension included"); 817 return; 818 } 819 820 wpa_printf(MSG_INFO, "Parsing logotype extension"); 821 ext = X509_get_ext(cert, pos); 822 if (!ext) { 823 wpa_printf(MSG_INFO, "Could not get logotype extension"); 824 return; 825 } 826 827 os = X509_EXTENSION_get_data(ext); 828 if (os == NULL) { 829 wpa_printf(MSG_INFO, "Could not get logotype extension data"); 830 return; 831 } 832 833 wpa_hexdump(MSG_DEBUG, "logotypeExtn", 834 ASN1_STRING_get0_data(os), ASN1_STRING_length(os)); 835 836 data = ASN1_STRING_get0_data(os); 837 logo = d2i_LogotypeExtn(NULL, &data, ASN1_STRING_length(os)); 838 if (logo == NULL) { 839 wpa_printf(MSG_INFO, "Failed to parse logotypeExtn"); 840 return; 841 } 842 843 if (wpa_debug_level < MSG_INFO) 844 debug_print_logotypeext(logo); 845 846 if (!logo->communityLogos) { 847 wpa_printf(MSG_INFO, "No communityLogos included"); 848 LogotypeExtn_free(logo); 849 return; 850 } 851 852 num = sk_LogotypeInfo_num(logo->communityLogos); 853 for (i = 0; i < num; i++) { 854 LogotypeInfo *info; 855 info = sk_LogotypeInfo_value(logo->communityLogos, i); 856 switch (info->type) { 857 case 0: 858 add_logo_direct(ctx, hcert, info->d.direct); 859 break; 860 case 1: 861 add_logo_indirect(ctx, hcert, info->d.indirect); 862 break; 863 } 864 } 865 866 LogotypeExtn_free(logo); 867 } 868 869 870 static void parse_cert(struct http_ctx *ctx, struct http_cert *hcert, 871 X509 *cert, GENERAL_NAMES **names) 872 { 873 os_memset(hcert, 0, sizeof(*hcert)); 874 875 *names = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL); 876 if (*names) 877 add_alt_names(ctx, hcert, *names); 878 879 add_logotype_ext(ctx, hcert, cert); 880 } 881 882 883 static void parse_cert_free(struct http_cert *hcert, GENERAL_NAMES *names) 884 { 885 unsigned int i; 886 887 for (i = 0; i < hcert->num_dnsname; i++) 888 OPENSSL_free(hcert->dnsname[i]); 889 os_free(hcert->dnsname); 890 891 for (i = 0; i < hcert->num_othername; i++) 892 os_free(hcert->othername[i].oid); 893 os_free(hcert->othername); 894 895 for (i = 0; i < hcert->num_logo; i++) { 896 os_free(hcert->logo[i].alg_oid); 897 os_free(hcert->logo[i].hash); 898 os_free(hcert->logo[i].uri); 899 } 900 os_free(hcert->logo); 901 902 sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free); 903 } 904 905 906 static int validate_server_cert(struct http_ctx *ctx, X509 *cert) 907 { 908 GENERAL_NAMES *names; 909 struct http_cert hcert; 910 int ret; 911 912 if (ctx->cert_cb == NULL) { 913 wpa_printf(MSG_DEBUG, "%s: no cert_cb configured", __func__); 914 return 0; 915 } 916 917 if (0) { 918 BIO *out; 919 out = BIO_new_fp(stdout, BIO_NOCLOSE); 920 X509_print_ex(out, cert, XN_FLAG_COMPAT, X509_FLAG_COMPAT); 921 BIO_free(out); 922 } 923 924 parse_cert(ctx, &hcert, cert, &names); 925 ret = ctx->cert_cb(ctx->cert_cb_ctx, &hcert); 926 parse_cert_free(&hcert, names); 927 928 return ret; 929 } 930 931 932 void http_parse_x509_certificate(struct http_ctx *ctx, const char *fname) 933 { 934 BIO *in, *out; 935 X509 *cert; 936 GENERAL_NAMES *names; 937 struct http_cert hcert; 938 unsigned int i; 939 940 in = BIO_new_file(fname, "r"); 941 if (in == NULL) { 942 wpa_printf(MSG_ERROR, "Could not read '%s'", fname); 943 return; 944 } 945 946 cert = d2i_X509_bio(in, NULL); 947 BIO_free(in); 948 949 if (cert == NULL) { 950 wpa_printf(MSG_ERROR, "Could not parse certificate"); 951 return; 952 } 953 954 out = BIO_new_fp(stdout, BIO_NOCLOSE); 955 if (out) { 956 X509_print_ex(out, cert, XN_FLAG_COMPAT, 957 X509_FLAG_COMPAT); 958 BIO_free(out); 959 } 960 961 wpa_printf(MSG_INFO, "Additional parsing information:"); 962 parse_cert(ctx, &hcert, cert, &names); 963 for (i = 0; i < hcert.num_othername; i++) { 964 if (os_strcmp(hcert.othername[i].oid, 965 "1.3.6.1.4.1.40808.1.1.1") == 0) { 966 char *name = os_zalloc(hcert.othername[i].len + 1); 967 if (name) { 968 os_memcpy(name, hcert.othername[i].data, 969 hcert.othername[i].len); 970 wpa_printf(MSG_INFO, 971 "id-wfa-hotspot-friendlyName: %s", 972 name); 973 os_free(name); 974 } 975 wpa_hexdump_ascii(MSG_INFO, 976 "id-wfa-hotspot-friendlyName", 977 hcert.othername[i].data, 978 hcert.othername[i].len); 979 } else { 980 wpa_printf(MSG_INFO, "subjAltName[othername]: oid=%s", 981 hcert.othername[i].oid); 982 wpa_hexdump_ascii(MSG_INFO, "unknown othername", 983 hcert.othername[i].data, 984 hcert.othername[i].len); 985 } 986 } 987 parse_cert_free(&hcert, names); 988 989 X509_free(cert); 990 } 991 992 993 static int curl_cb_ssl_verify(int preverify_ok, X509_STORE_CTX *x509_ctx) 994 { 995 struct http_ctx *ctx; 996 X509 *cert; 997 int err, depth; 998 char buf[256]; 999 X509_NAME *name; 1000 const char *err_str; 1001 SSL *ssl; 1002 SSL_CTX *ssl_ctx; 1003 1004 ssl = X509_STORE_CTX_get_ex_data(x509_ctx, 1005 SSL_get_ex_data_X509_STORE_CTX_idx()); 1006 ssl_ctx = SSL_get_SSL_CTX(ssl); 1007 ctx = SSL_CTX_get_app_data(ssl_ctx); 1008 1009 wpa_printf(MSG_DEBUG, "curl_cb_ssl_verify, preverify_ok: %d", 1010 preverify_ok); 1011 1012 err = X509_STORE_CTX_get_error(x509_ctx); 1013 err_str = X509_verify_cert_error_string(err); 1014 depth = X509_STORE_CTX_get_error_depth(x509_ctx); 1015 cert = X509_STORE_CTX_get_current_cert(x509_ctx); 1016 if (!cert) { 1017 wpa_printf(MSG_INFO, "No server certificate available"); 1018 ctx->last_err = "No server certificate available"; 1019 return 0; 1020 } 1021 1022 if (depth == 0) 1023 ctx->peer_cert = cert; 1024 else if (depth == 1) 1025 ctx->peer_issuer = cert; 1026 else if (depth == 2) 1027 ctx->peer_issuer_issuer = cert; 1028 1029 name = X509_get_subject_name(cert); 1030 X509_NAME_oneline(name, buf, sizeof(buf)); 1031 wpa_printf(MSG_INFO, "Server certificate chain - depth=%d err=%d (%s) subject=%s", 1032 depth, err, err_str, buf); 1033 debug_dump_cert("Server certificate chain - certificate", cert); 1034 1035 if (depth == 0 && preverify_ok && validate_server_cert(ctx, cert) < 0) 1036 return 0; 1037 1038 #ifdef OPENSSL_IS_BORINGSSL 1039 if (depth == 0 && ctx->ocsp != NO_OCSP && preverify_ok) { 1040 enum ocsp_result res; 1041 1042 res = check_ocsp_resp(ssl_ctx, ssl, cert, ctx->peer_issuer, 1043 ctx->peer_issuer_issuer); 1044 if (res == OCSP_REVOKED) { 1045 preverify_ok = 0; 1046 wpa_printf(MSG_INFO, "OCSP: certificate revoked"); 1047 if (err == X509_V_OK) 1048 X509_STORE_CTX_set_error( 1049 x509_ctx, X509_V_ERR_CERT_REVOKED); 1050 } else if (res != OCSP_GOOD && (ctx->ocsp == MANDATORY_OCSP)) { 1051 preverify_ok = 0; 1052 wpa_printf(MSG_INFO, 1053 "OCSP: bad certificate status response"); 1054 } 1055 } 1056 #endif /* OPENSSL_IS_BORINGSSL */ 1057 1058 if (!preverify_ok) 1059 ctx->last_err = "TLS validation failed"; 1060 1061 return preverify_ok; 1062 } 1063 1064 1065 #ifdef HAVE_OCSP 1066 1067 static void ocsp_debug_print_resp(OCSP_RESPONSE *rsp) 1068 { 1069 BIO *out; 1070 size_t rlen; 1071 char *txt; 1072 int res; 1073 1074 out = BIO_new(BIO_s_mem()); 1075 if (!out) 1076 return; 1077 1078 OCSP_RESPONSE_print(out, rsp, 0); 1079 rlen = BIO_ctrl_pending(out); 1080 txt = os_malloc(rlen + 1); 1081 if (!txt) { 1082 BIO_free(out); 1083 return; 1084 } 1085 1086 res = BIO_read(out, txt, rlen); 1087 if (res > 0) { 1088 txt[res] = '\0'; 1089 wpa_printf(MSG_MSGDUMP, "OpenSSL: OCSP Response\n%s", txt); 1090 } 1091 os_free(txt); 1092 BIO_free(out); 1093 } 1094 1095 1096 static void tls_show_errors(const char *func, const char *txt) 1097 { 1098 unsigned long err; 1099 1100 wpa_printf(MSG_DEBUG, "OpenSSL: %s - %s %s", 1101 func, txt, ERR_error_string(ERR_get_error(), NULL)); 1102 1103 while ((err = ERR_get_error())) { 1104 wpa_printf(MSG_DEBUG, "OpenSSL: pending error: %s", 1105 ERR_error_string(err, NULL)); 1106 } 1107 } 1108 1109 1110 static int ocsp_resp_cb(SSL *s, void *arg) 1111 { 1112 struct http_ctx *ctx = arg; 1113 const unsigned char *p; 1114 int len, status, reason, res; 1115 OCSP_RESPONSE *rsp; 1116 OCSP_BASICRESP *basic; 1117 OCSP_CERTID *id; 1118 ASN1_GENERALIZEDTIME *produced_at, *this_update, *next_update; 1119 X509_STORE *store; 1120 STACK_OF(X509) *certs = NULL; 1121 1122 len = SSL_get_tlsext_status_ocsp_resp(s, &p); 1123 if (!p) { 1124 wpa_printf(MSG_DEBUG, "OpenSSL: No OCSP response received"); 1125 if (ctx->ocsp == MANDATORY_OCSP) 1126 ctx->last_err = "No OCSP response received"; 1127 return (ctx->ocsp == MANDATORY_OCSP) ? 0 : 1; 1128 } 1129 1130 wpa_hexdump(MSG_DEBUG, "OpenSSL: OCSP response", p, len); 1131 1132 rsp = d2i_OCSP_RESPONSE(NULL, &p, len); 1133 if (!rsp) { 1134 wpa_printf(MSG_INFO, "OpenSSL: Failed to parse OCSP response"); 1135 ctx->last_err = "Failed to parse OCSP response"; 1136 return 0; 1137 } 1138 1139 ocsp_debug_print_resp(rsp); 1140 1141 status = OCSP_response_status(rsp); 1142 if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL) { 1143 wpa_printf(MSG_INFO, "OpenSSL: OCSP responder error %d (%s)", 1144 status, OCSP_response_status_str(status)); 1145 ctx->last_err = "OCSP responder error"; 1146 return 0; 1147 } 1148 1149 basic = OCSP_response_get1_basic(rsp); 1150 if (!basic) { 1151 wpa_printf(MSG_INFO, "OpenSSL: Could not find BasicOCSPResponse"); 1152 ctx->last_err = "Could not find BasicOCSPResponse"; 1153 return 0; 1154 } 1155 1156 store = SSL_CTX_get_cert_store(SSL_get_SSL_CTX(s)); 1157 if (ctx->peer_issuer) { 1158 wpa_printf(MSG_DEBUG, "OpenSSL: Add issuer"); 1159 debug_dump_cert("OpenSSL: Issuer certificate", 1160 ctx->peer_issuer); 1161 1162 if (X509_STORE_add_cert(store, ctx->peer_issuer) != 1) { 1163 tls_show_errors(__func__, 1164 "OpenSSL: Could not add issuer to certificate store"); 1165 } 1166 certs = sk_X509_new_null(); 1167 if (certs) { 1168 X509 *cert; 1169 cert = X509_dup(ctx->peer_issuer); 1170 if (cert && !sk_X509_push(certs, cert)) { 1171 tls_show_errors( 1172 __func__, 1173 "OpenSSL: Could not add issuer to OCSP responder trust store"); 1174 X509_free(cert); 1175 sk_X509_free(certs); 1176 certs = NULL; 1177 } 1178 if (certs && ctx->peer_issuer_issuer) { 1179 cert = X509_dup(ctx->peer_issuer_issuer); 1180 if (cert && !sk_X509_push(certs, cert)) { 1181 tls_show_errors( 1182 __func__, 1183 "OpenSSL: Could not add issuer's issuer to OCSP responder trust store"); 1184 X509_free(cert); 1185 } 1186 } 1187 } 1188 } 1189 1190 status = OCSP_basic_verify(basic, certs, store, OCSP_TRUSTOTHER); 1191 sk_X509_pop_free(certs, X509_free); 1192 if (status <= 0) { 1193 tls_show_errors(__func__, 1194 "OpenSSL: OCSP response failed verification"); 1195 OCSP_BASICRESP_free(basic); 1196 OCSP_RESPONSE_free(rsp); 1197 ctx->last_err = "OCSP response failed verification"; 1198 return 0; 1199 } 1200 1201 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP response verification succeeded"); 1202 1203 if (!ctx->peer_cert) { 1204 wpa_printf(MSG_DEBUG, "OpenSSL: Peer certificate not available for OCSP status check"); 1205 OCSP_BASICRESP_free(basic); 1206 OCSP_RESPONSE_free(rsp); 1207 ctx->last_err = "Peer certificate not available for OCSP status check"; 1208 return 0; 1209 } 1210 1211 if (!ctx->peer_issuer) { 1212 wpa_printf(MSG_DEBUG, "OpenSSL: Peer issuer certificate not available for OCSP status check"); 1213 OCSP_BASICRESP_free(basic); 1214 OCSP_RESPONSE_free(rsp); 1215 ctx->last_err = "Peer issuer certificate not available for OCSP status check"; 1216 return 0; 1217 } 1218 1219 id = OCSP_cert_to_id(EVP_sha256(), ctx->peer_cert, ctx->peer_issuer); 1220 if (!id) { 1221 wpa_printf(MSG_DEBUG, 1222 "OpenSSL: Could not create OCSP certificate identifier (SHA256)"); 1223 OCSP_BASICRESP_free(basic); 1224 OCSP_RESPONSE_free(rsp); 1225 ctx->last_err = "Could not create OCSP certificate identifier"; 1226 return 0; 1227 } 1228 1229 res = OCSP_resp_find_status(basic, id, &status, &reason, &produced_at, 1230 &this_update, &next_update); 1231 if (!res) { 1232 id = OCSP_cert_to_id(NULL, ctx->peer_cert, ctx->peer_issuer); 1233 if (!id) { 1234 wpa_printf(MSG_DEBUG, 1235 "OpenSSL: Could not create OCSP certificate identifier (SHA1)"); 1236 OCSP_BASICRESP_free(basic); 1237 OCSP_RESPONSE_free(rsp); 1238 ctx->last_err = 1239 "Could not create OCSP certificate identifier"; 1240 return 0; 1241 } 1242 1243 res = OCSP_resp_find_status(basic, id, &status, &reason, 1244 &produced_at, &this_update, 1245 &next_update); 1246 } 1247 1248 if (!res) { 1249 wpa_printf(MSG_INFO, "OpenSSL: Could not find current server certificate from OCSP response%s", 1250 (ctx->ocsp == MANDATORY_OCSP) ? "" : 1251 " (OCSP not required)"); 1252 OCSP_CERTID_free(id); 1253 OCSP_BASICRESP_free(basic); 1254 OCSP_RESPONSE_free(rsp); 1255 if (ctx->ocsp == MANDATORY_OCSP) 1256 1257 ctx->last_err = "Could not find current server certificate from OCSP response"; 1258 return (ctx->ocsp == MANDATORY_OCSP) ? 0 : 1; 1259 } 1260 OCSP_CERTID_free(id); 1261 1262 if (!OCSP_check_validity(this_update, next_update, 5 * 60, -1)) { 1263 tls_show_errors(__func__, "OpenSSL: OCSP status times invalid"); 1264 OCSP_BASICRESP_free(basic); 1265 OCSP_RESPONSE_free(rsp); 1266 ctx->last_err = "OCSP status times invalid"; 1267 return 0; 1268 } 1269 1270 OCSP_BASICRESP_free(basic); 1271 OCSP_RESPONSE_free(rsp); 1272 1273 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status for server certificate: %s", 1274 OCSP_cert_status_str(status)); 1275 1276 if (status == V_OCSP_CERTSTATUS_GOOD) 1277 return 1; 1278 if (status == V_OCSP_CERTSTATUS_REVOKED) { 1279 ctx->last_err = "Server certificate has been revoked"; 1280 return 0; 1281 } 1282 if (ctx->ocsp == MANDATORY_OCSP) { 1283 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status unknown, but OCSP required"); 1284 ctx->last_err = "OCSP status unknown"; 1285 return 0; 1286 } 1287 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status unknown, but OCSP was not required, so allow connection to continue"); 1288 return 1; 1289 } 1290 1291 1292 #if OPENSSL_VERSION_NUMBER < 0x10100000L 1293 static SSL_METHOD patch_ssl_method; 1294 static const SSL_METHOD *real_ssl_method; 1295 1296 static int curl_patch_ssl_new(SSL *s) 1297 { 1298 SSL_CTX *ssl = SSL_get_SSL_CTX(s); 1299 int ret; 1300 1301 ssl->method = real_ssl_method; 1302 s->method = real_ssl_method; 1303 1304 ret = s->method->ssl_new(s); 1305 SSL_set_tlsext_status_type(s, TLSEXT_STATUSTYPE_ocsp); 1306 1307 return ret; 1308 } 1309 #endif /* OpenSSL < 1.1.0 */ 1310 1311 #endif /* HAVE_OCSP */ 1312 1313 1314 static CURLcode curl_cb_ssl(CURL *curl, void *sslctx, void *parm) 1315 { 1316 struct http_ctx *ctx = parm; 1317 SSL_CTX *ssl = sslctx; 1318 1319 wpa_printf(MSG_DEBUG, "curl_cb_ssl"); 1320 SSL_CTX_set_app_data(ssl, ctx); 1321 SSL_CTX_set_verify(ssl, SSL_VERIFY_PEER, curl_cb_ssl_verify); 1322 1323 #ifdef HAVE_OCSP 1324 if (ctx->ocsp != NO_OCSP) { 1325 SSL_CTX_set_tlsext_status_cb(ssl, ocsp_resp_cb); 1326 SSL_CTX_set_tlsext_status_arg(ssl, ctx); 1327 1328 #if OPENSSL_VERSION_NUMBER < 0x10100000L 1329 /* 1330 * Use a temporary SSL_METHOD to get a callback on SSL_new() 1331 * from libcurl since there is no proper callback registration 1332 * available for this. 1333 */ 1334 os_memset(&patch_ssl_method, 0, sizeof(patch_ssl_method)); 1335 patch_ssl_method.ssl_new = curl_patch_ssl_new; 1336 real_ssl_method = ssl->method; 1337 ssl->method = &patch_ssl_method; 1338 #endif /* OpenSSL < 1.1.0 */ 1339 } 1340 #endif /* HAVE_OCSP */ 1341 1342 return CURLE_OK; 1343 } 1344 1345 #endif /* EAP_TLS_OPENSSL */ 1346 1347 1348 static CURL * setup_curl_post(struct http_ctx *ctx, const char *address, 1349 const char *ca_fname, const char *username, 1350 const char *password, const char *client_cert, 1351 const char *client_key) 1352 { 1353 CURL *curl; 1354 #ifdef EAP_TLS_OPENSSL 1355 const char *extra = " tls=openssl"; 1356 #else /* EAP_TLS_OPENSSL */ 1357 const char *extra = ""; 1358 #endif /* EAP_TLS_OPENSSL */ 1359 1360 wpa_printf(MSG_DEBUG, "Start HTTP client: address=%s ca_fname=%s " 1361 "username=%s%s", address, ca_fname, username, extra); 1362 1363 curl = curl_easy_init(); 1364 if (curl == NULL) 1365 return NULL; 1366 1367 curl_easy_setopt(curl, CURLOPT_URL, address); 1368 curl_easy_setopt(curl, CURLOPT_POST, 1L); 1369 if (ca_fname) { 1370 curl_easy_setopt(curl, CURLOPT_CAINFO, ca_fname); 1371 curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L); 1372 #ifdef EAP_TLS_OPENSSL 1373 curl_easy_setopt(curl, CURLOPT_SSL_CTX_FUNCTION, curl_cb_ssl); 1374 curl_easy_setopt(curl, CURLOPT_SSL_CTX_DATA, ctx); 1375 #if defined(OPENSSL_IS_BORINGSSL) || (OPENSSL_VERSION_NUMBER >= 0x10100000L) 1376 /* For now, using the CURLOPT_SSL_VERIFYSTATUS option only 1377 * with BoringSSL since the OpenSSL specific callback hack to 1378 * enable OCSP is not available with BoringSSL. The OCSP 1379 * implementation within libcurl is not sufficient for the 1380 * Hotspot 2.0 OSU needs, so cannot use this with OpenSSL. 1381 */ 1382 if (ctx->ocsp != NO_OCSP) 1383 curl_easy_setopt(curl, CURLOPT_SSL_VERIFYSTATUS, 1L); 1384 #endif /* OPENSSL_IS_BORINGSSL */ 1385 #endif /* EAP_TLS_OPENSSL */ 1386 } else { 1387 curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); 1388 } 1389 if (client_cert && client_key) { 1390 curl_easy_setopt(curl, CURLOPT_SSLCERT, client_cert); 1391 curl_easy_setopt(curl, CURLOPT_SSLKEY, client_key); 1392 } 1393 /* TODO: use curl_easy_getinfo() with CURLINFO_CERTINFO to fetch 1394 * information about the server certificate */ 1395 curl_easy_setopt(curl, CURLOPT_CERTINFO, 1L); 1396 curl_easy_setopt(curl, CURLOPT_DEBUGFUNCTION, curl_cb_debug); 1397 curl_easy_setopt(curl, CURLOPT_DEBUGDATA, ctx); 1398 curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, curl_cb_write); 1399 curl_easy_setopt(curl, CURLOPT_WRITEDATA, ctx); 1400 curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); 1401 if (username) { 1402 curl_easy_setopt(curl, CURLOPT_HTTPAUTH, CURLAUTH_ANYSAFE); 1403 curl_easy_setopt(curl, CURLOPT_USERNAME, username); 1404 curl_easy_setopt(curl, CURLOPT_PASSWORD, password); 1405 } 1406 1407 return curl; 1408 } 1409 1410 1411 static int post_init_client(struct http_ctx *ctx, const char *address, 1412 const char *ca_fname, const char *username, 1413 const char *password, const char *client_cert, 1414 const char *client_key) 1415 { 1416 char *pos; 1417 int count; 1418 1419 clone_str(&ctx->svc_address, address); 1420 clone_str(&ctx->svc_ca_fname, ca_fname); 1421 clone_str(&ctx->svc_username, username); 1422 clone_str(&ctx->svc_password, password); 1423 clone_str(&ctx->svc_client_cert, client_cert); 1424 clone_str(&ctx->svc_client_key, client_key); 1425 1426 /* 1427 * Workaround for Apache "Hostname 'FOO' provided via SNI and hostname 1428 * 'foo' provided via HTTP are different. 1429 */ 1430 for (count = 0, pos = ctx->svc_address; count < 3 && pos && *pos; 1431 pos++) { 1432 if (*pos == '/') 1433 count++; 1434 *pos = tolower(*pos); 1435 } 1436 1437 ctx->curl = setup_curl_post(ctx, ctx->svc_address, ca_fname, username, 1438 password, client_cert, client_key); 1439 if (ctx->curl == NULL) 1440 return -1; 1441 1442 return 0; 1443 } 1444 1445 1446 int soap_init_client(struct http_ctx *ctx, const char *address, 1447 const char *ca_fname, const char *username, 1448 const char *password, const char *client_cert, 1449 const char *client_key) 1450 { 1451 if (post_init_client(ctx, address, ca_fname, username, password, 1452 client_cert, client_key) < 0) 1453 return -1; 1454 1455 ctx->curl_hdr = curl_slist_append(ctx->curl_hdr, 1456 "Content-Type: application/soap+xml"); 1457 ctx->curl_hdr = curl_slist_append(ctx->curl_hdr, "SOAPAction: "); 1458 ctx->curl_hdr = curl_slist_append(ctx->curl_hdr, "Expect:"); 1459 curl_easy_setopt(ctx->curl, CURLOPT_HTTPHEADER, ctx->curl_hdr); 1460 1461 return 0; 1462 } 1463 1464 1465 int soap_reinit_client(struct http_ctx *ctx) 1466 { 1467 char *address = NULL; 1468 char *ca_fname = NULL; 1469 char *username = NULL; 1470 char *password = NULL; 1471 char *client_cert = NULL; 1472 char *client_key = NULL; 1473 int ret; 1474 1475 clear_curl(ctx); 1476 1477 clone_str(&address, ctx->svc_address); 1478 clone_str(&ca_fname, ctx->svc_ca_fname); 1479 clone_str(&username, ctx->svc_username); 1480 clone_str(&password, ctx->svc_password); 1481 clone_str(&client_cert, ctx->svc_client_cert); 1482 clone_str(&client_key, ctx->svc_client_key); 1483 1484 ret = soap_init_client(ctx, address, ca_fname, username, password, 1485 client_cert, client_key); 1486 os_free(address); 1487 os_free(ca_fname); 1488 str_clear_free(username); 1489 str_clear_free(password); 1490 os_free(client_cert); 1491 os_free(client_key); 1492 return ret; 1493 } 1494 1495 1496 static void free_curl_buf(struct http_ctx *ctx) 1497 { 1498 os_free(ctx->curl_buf); 1499 ctx->curl_buf = NULL; 1500 ctx->curl_buf_len = 0; 1501 } 1502 1503 1504 xml_node_t * soap_send_receive(struct http_ctx *ctx, xml_node_t *node) 1505 { 1506 char *str; 1507 xml_node_t *envelope, *ret, *resp, *n; 1508 CURLcode res; 1509 long http = 0; 1510 1511 ctx->last_err = NULL; 1512 1513 wpa_printf(MSG_DEBUG, "SOAP: Sending message"); 1514 envelope = soap_build_envelope(ctx->xml, node); 1515 str = xml_node_to_str(ctx->xml, envelope); 1516 xml_node_free(ctx->xml, envelope); 1517 wpa_printf(MSG_MSGDUMP, "SOAP[%s]", str); 1518 1519 curl_easy_setopt(ctx->curl, CURLOPT_POSTFIELDS, str); 1520 free_curl_buf(ctx); 1521 1522 res = curl_easy_perform(ctx->curl); 1523 if (res != CURLE_OK) { 1524 if (!ctx->last_err) 1525 ctx->last_err = curl_easy_strerror(res); 1526 wpa_printf(MSG_ERROR, "curl_easy_perform() failed: %s", 1527 ctx->last_err); 1528 os_free(str); 1529 free_curl_buf(ctx); 1530 return NULL; 1531 } 1532 os_free(str); 1533 1534 curl_easy_getinfo(ctx->curl, CURLINFO_RESPONSE_CODE, &http); 1535 wpa_printf(MSG_DEBUG, "SOAP: Server response code %ld", http); 1536 if (http != 200) { 1537 ctx->last_err = "HTTP download failed"; 1538 wpa_printf(MSG_INFO, "HTTP download failed - code %ld", http); 1539 free_curl_buf(ctx); 1540 return NULL; 1541 } 1542 1543 if (ctx->curl_buf == NULL) 1544 return NULL; 1545 1546 wpa_printf(MSG_MSGDUMP, "Server response:\n%s", ctx->curl_buf); 1547 resp = xml_node_from_buf(ctx->xml, ctx->curl_buf); 1548 free_curl_buf(ctx); 1549 if (resp == NULL) { 1550 wpa_printf(MSG_INFO, "Could not parse SOAP response"); 1551 ctx->last_err = "Could not parse SOAP response"; 1552 return NULL; 1553 } 1554 1555 ret = soap_get_body(ctx->xml, resp); 1556 if (ret == NULL) { 1557 wpa_printf(MSG_INFO, "Could not get SOAP body"); 1558 ctx->last_err = "Could not get SOAP body"; 1559 return NULL; 1560 } 1561 1562 wpa_printf(MSG_DEBUG, "SOAP body localname: '%s'", 1563 xml_node_get_localname(ctx->xml, ret)); 1564 n = xml_node_copy(ctx->xml, ret); 1565 xml_node_free(ctx->xml, resp); 1566 1567 return n; 1568 } 1569 1570 1571 struct http_ctx * http_init_ctx(void *upper_ctx, struct xml_node_ctx *xml_ctx) 1572 { 1573 struct http_ctx *ctx; 1574 1575 ctx = os_zalloc(sizeof(*ctx)); 1576 if (ctx == NULL) 1577 return NULL; 1578 ctx->ctx = upper_ctx; 1579 ctx->xml = xml_ctx; 1580 ctx->ocsp = OPTIONAL_OCSP; 1581 1582 curl_global_init(CURL_GLOBAL_ALL); 1583 1584 return ctx; 1585 } 1586 1587 1588 void http_ocsp_set(struct http_ctx *ctx, int val) 1589 { 1590 if (val == 0) 1591 ctx->ocsp = NO_OCSP; 1592 else if (val == 1) 1593 ctx->ocsp = OPTIONAL_OCSP; 1594 if (val == 2) 1595 ctx->ocsp = MANDATORY_OCSP; 1596 } 1597 1598 1599 void http_deinit_ctx(struct http_ctx *ctx) 1600 { 1601 clear_curl(ctx); 1602 os_free(ctx->curl_buf); 1603 curl_global_cleanup(); 1604 1605 os_free(ctx->svc_address); 1606 os_free(ctx->svc_ca_fname); 1607 str_clear_free(ctx->svc_username); 1608 str_clear_free(ctx->svc_password); 1609 os_free(ctx->svc_client_cert); 1610 os_free(ctx->svc_client_key); 1611 1612 os_free(ctx); 1613 } 1614 1615 1616 int http_download_file(struct http_ctx *ctx, const char *url, 1617 const char *fname, const char *ca_fname) 1618 { 1619 CURL *curl; 1620 FILE *f; 1621 CURLcode res; 1622 long http = 0; 1623 1624 ctx->last_err = NULL; 1625 1626 wpa_printf(MSG_DEBUG, "curl: Download file from %s to %s (ca=%s)", 1627 url, fname, ca_fname); 1628 curl = curl_easy_init(); 1629 if (curl == NULL) 1630 return -1; 1631 1632 f = fopen(fname, "wb"); 1633 if (f == NULL) { 1634 curl_easy_cleanup(curl); 1635 return -1; 1636 } 1637 1638 curl_easy_setopt(curl, CURLOPT_URL, url); 1639 if (ca_fname) { 1640 curl_easy_setopt(curl, CURLOPT_CAINFO, ca_fname); 1641 curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L); 1642 curl_easy_setopt(curl, CURLOPT_CERTINFO, 1L); 1643 } else { 1644 curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); 1645 } 1646 curl_easy_setopt(curl, CURLOPT_DEBUGFUNCTION, curl_cb_debug); 1647 curl_easy_setopt(curl, CURLOPT_DEBUGDATA, ctx); 1648 curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, fwrite); 1649 curl_easy_setopt(curl, CURLOPT_WRITEDATA, f); 1650 curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); 1651 1652 res = curl_easy_perform(curl); 1653 if (res != CURLE_OK) { 1654 if (!ctx->last_err) 1655 ctx->last_err = curl_easy_strerror(res); 1656 wpa_printf(MSG_ERROR, "curl_easy_perform() failed: %s", 1657 ctx->last_err); 1658 curl_easy_cleanup(curl); 1659 fclose(f); 1660 return -1; 1661 } 1662 1663 curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &http); 1664 wpa_printf(MSG_DEBUG, "curl: Server response code %ld", http); 1665 if (http != 200) { 1666 ctx->last_err = "HTTP download failed"; 1667 wpa_printf(MSG_INFO, "HTTP download failed - code %ld", http); 1668 curl_easy_cleanup(curl); 1669 fclose(f); 1670 return -1; 1671 } 1672 1673 curl_easy_cleanup(curl); 1674 fclose(f); 1675 1676 return 0; 1677 } 1678 1679 1680 char * http_post(struct http_ctx *ctx, const char *url, const char *data, 1681 const char *content_type, const char *ext_hdr, 1682 const char *ca_fname, 1683 const char *username, const char *password, 1684 const char *client_cert, const char *client_key, 1685 size_t *resp_len) 1686 { 1687 long http = 0; 1688 CURLcode res; 1689 char *ret; 1690 CURL *curl; 1691 struct curl_slist *curl_hdr = NULL; 1692 1693 ctx->last_err = NULL; 1694 wpa_printf(MSG_DEBUG, "curl: HTTP POST to %s", url); 1695 curl = setup_curl_post(ctx, url, ca_fname, username, password, 1696 client_cert, client_key); 1697 if (curl == NULL) 1698 return NULL; 1699 1700 if (content_type) { 1701 char ct[200]; 1702 snprintf(ct, sizeof(ct), "Content-Type: %s", content_type); 1703 curl_hdr = curl_slist_append(curl_hdr, ct); 1704 } 1705 if (ext_hdr) 1706 curl_hdr = curl_slist_append(curl_hdr, ext_hdr); 1707 curl_easy_setopt(curl, CURLOPT_HTTPHEADER, curl_hdr); 1708 1709 curl_easy_setopt(curl, CURLOPT_POSTFIELDS, data); 1710 free_curl_buf(ctx); 1711 1712 res = curl_easy_perform(curl); 1713 if (res != CURLE_OK) { 1714 if (!ctx->last_err) 1715 ctx->last_err = curl_easy_strerror(res); 1716 wpa_printf(MSG_ERROR, "curl_easy_perform() failed: %s", 1717 ctx->last_err); 1718 free_curl_buf(ctx); 1719 return NULL; 1720 } 1721 1722 curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &http); 1723 wpa_printf(MSG_DEBUG, "curl: Server response code %ld", http); 1724 if (http != 200) { 1725 ctx->last_err = "HTTP POST failed"; 1726 wpa_printf(MSG_INFO, "HTTP POST failed - code %ld", http); 1727 free_curl_buf(ctx); 1728 return NULL; 1729 } 1730 1731 if (ctx->curl_buf == NULL) 1732 return NULL; 1733 1734 ret = ctx->curl_buf; 1735 if (resp_len) 1736 *resp_len = ctx->curl_buf_len; 1737 ctx->curl_buf = NULL; 1738 ctx->curl_buf_len = 0; 1739 1740 wpa_printf(MSG_MSGDUMP, "Server response:\n%s", ret); 1741 1742 return ret; 1743 } 1744 1745 1746 void http_set_cert_cb(struct http_ctx *ctx, 1747 int (*cb)(void *ctx, struct http_cert *cert), 1748 void *cb_ctx) 1749 { 1750 ctx->cert_cb = cb; 1751 ctx->cert_cb_ctx = cb_ctx; 1752 } 1753 1754 1755 const char * http_get_err(struct http_ctx *ctx) 1756 { 1757 return ctx->last_err; 1758 } 1759
