1 /* 2 * EAP peer: EAP-TLS/PEAP/TTLS/FAST common functions 3 * Copyright (c) 2004-2013, Jouni Malinen <j (at) w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 11 #include "common.h" 12 #include "crypto/sha1.h" 13 #include "crypto/tls.h" 14 #include "eap_i.h" 15 #include "eap_tls_common.h" 16 #include "eap_config.h" 17 18 19 static struct wpabuf * eap_tls_msg_alloc(EapType type, size_t payload_len, 20 u8 code, u8 identifier) 21 { 22 if (type == EAP_UNAUTH_TLS_TYPE) 23 return eap_msg_alloc(EAP_VENDOR_UNAUTH_TLS, 24 EAP_VENDOR_TYPE_UNAUTH_TLS, payload_len, 25 code, identifier); 26 if (type == EAP_WFA_UNAUTH_TLS_TYPE) 27 return eap_msg_alloc(EAP_VENDOR_WFA_NEW, 28 EAP_VENDOR_WFA_UNAUTH_TLS, payload_len, 29 code, identifier); 30 return eap_msg_alloc(EAP_VENDOR_IETF, type, payload_len, code, 31 identifier); 32 } 33 34 35 static int eap_tls_check_blob(struct eap_sm *sm, const char **name, 36 const u8 **data, size_t *data_len) 37 { 38 const struct wpa_config_blob *blob; 39 40 if (*name == NULL || os_strncmp(*name, "blob://", 7) != 0) 41 return 0; 42 43 blob = eap_get_config_blob(sm, *name + 7); 44 if (blob == NULL) { 45 wpa_printf(MSG_ERROR, "%s: Named configuration blob '%s' not " 46 "found", __func__, *name + 7); 47 return -1; 48 } 49 50 *name = NULL; 51 *data = blob->data; 52 *data_len = blob->len; 53 54 return 0; 55 } 56 57 58 static void eap_tls_params_flags(struct tls_connection_params *params, 59 const char *txt) 60 { 61 if (txt == NULL) 62 return; 63 if (os_strstr(txt, "tls_allow_md5=1")) 64 params->flags |= TLS_CONN_ALLOW_SIGN_RSA_MD5; 65 if (os_strstr(txt, "tls_disable_time_checks=1")) 66 params->flags |= TLS_CONN_DISABLE_TIME_CHECKS; 67 if (os_strstr(txt, "tls_disable_session_ticket=1")) 68 params->flags |= TLS_CONN_DISABLE_SESSION_TICKET; 69 if (os_strstr(txt, "tls_disable_session_ticket=0")) 70 params->flags &= ~TLS_CONN_DISABLE_SESSION_TICKET; 71 if (os_strstr(txt, "tls_disable_tlsv1_1=1")) 72 params->flags |= TLS_CONN_DISABLE_TLSv1_1; 73 if (os_strstr(txt, "tls_disable_tlsv1_1=0")) 74 params->flags &= ~TLS_CONN_DISABLE_TLSv1_1; 75 if (os_strstr(txt, "tls_disable_tlsv1_2=1")) 76 params->flags |= TLS_CONN_DISABLE_TLSv1_2; 77 if (os_strstr(txt, "tls_disable_tlsv1_2=0")) 78 params->flags &= ~TLS_CONN_DISABLE_TLSv1_2; 79 } 80 81 82 static void eap_tls_params_from_conf1(struct tls_connection_params *params, 83 struct eap_peer_config *config) 84 { 85 params->ca_cert = (char *) config->ca_cert; 86 params->ca_path = (char *) config->ca_path; 87 params->client_cert = (char *) config->client_cert; 88 params->private_key = (char *) config->private_key; 89 params->private_key_passwd = (char *) config->private_key_passwd; 90 params->dh_file = (char *) config->dh_file; 91 params->subject_match = (char *) config->subject_match; 92 params->altsubject_match = (char *) config->altsubject_match; 93 params->suffix_match = config->domain_suffix_match; 94 params->domain_match = config->domain_match; 95 params->engine = config->engine; 96 params->engine_id = config->engine_id; 97 params->pin = config->pin; 98 params->key_id = config->key_id; 99 params->cert_id = config->cert_id; 100 params->ca_cert_id = config->ca_cert_id; 101 eap_tls_params_flags(params, config->phase1); 102 } 103 104 105 static void eap_tls_params_from_conf2(struct tls_connection_params *params, 106 struct eap_peer_config *config) 107 { 108 params->ca_cert = (char *) config->ca_cert2; 109 params->ca_path = (char *) config->ca_path2; 110 params->client_cert = (char *) config->client_cert2; 111 params->private_key = (char *) config->private_key2; 112 params->private_key_passwd = (char *) config->private_key2_passwd; 113 params->dh_file = (char *) config->dh_file2; 114 params->subject_match = (char *) config->subject_match2; 115 params->altsubject_match = (char *) config->altsubject_match2; 116 params->suffix_match = config->domain_suffix_match2; 117 params->domain_match = config->domain_match2; 118 params->engine = config->engine2; 119 params->engine_id = config->engine2_id; 120 params->pin = config->pin2; 121 params->key_id = config->key2_id; 122 params->cert_id = config->cert2_id; 123 params->ca_cert_id = config->ca_cert2_id; 124 eap_tls_params_flags(params, config->phase2); 125 } 126 127 128 static int eap_tls_params_from_conf(struct eap_sm *sm, 129 struct eap_ssl_data *data, 130 struct tls_connection_params *params, 131 struct eap_peer_config *config, int phase2) 132 { 133 os_memset(params, 0, sizeof(*params)); 134 if (sm->workaround && data->eap_type != EAP_TYPE_FAST) { 135 /* 136 * Some deployed authentication servers seem to be unable to 137 * handle the TLS Session Ticket extension (they are supposed 138 * to ignore unrecognized TLS extensions, but end up rejecting 139 * the ClientHello instead). As a workaround, disable use of 140 * TLS Sesson Ticket extension for EAP-TLS, EAP-PEAP, and 141 * EAP-TTLS (EAP-FAST uses session ticket, so any server that 142 * supports EAP-FAST does not need this workaround). 143 */ 144 params->flags |= TLS_CONN_DISABLE_SESSION_TICKET; 145 } 146 if (phase2) { 147 wpa_printf(MSG_DEBUG, "TLS: using phase2 config options"); 148 eap_tls_params_from_conf2(params, config); 149 } else { 150 wpa_printf(MSG_DEBUG, "TLS: using phase1 config options"); 151 eap_tls_params_from_conf1(params, config); 152 if (data->eap_type == EAP_TYPE_FAST) 153 params->flags |= TLS_CONN_EAP_FAST; 154 } 155 156 /* 157 * Use blob data, if available. Otherwise, leave reference to external 158 * file as-is. 159 */ 160 if (eap_tls_check_blob(sm, ¶ms->ca_cert, ¶ms->ca_cert_blob, 161 ¶ms->ca_cert_blob_len) || 162 eap_tls_check_blob(sm, ¶ms->client_cert, 163 ¶ms->client_cert_blob, 164 ¶ms->client_cert_blob_len) || 165 eap_tls_check_blob(sm, ¶ms->private_key, 166 ¶ms->private_key_blob, 167 ¶ms->private_key_blob_len) || 168 eap_tls_check_blob(sm, ¶ms->dh_file, ¶ms->dh_blob, 169 ¶ms->dh_blob_len)) { 170 wpa_printf(MSG_INFO, "SSL: Failed to get configuration blobs"); 171 return -1; 172 } 173 174 params->openssl_ciphers = config->openssl_ciphers; 175 176 return 0; 177 } 178 179 180 static int eap_tls_init_connection(struct eap_sm *sm, 181 struct eap_ssl_data *data, 182 struct eap_peer_config *config, 183 struct tls_connection_params *params) 184 { 185 int res; 186 187 if (config->ocsp) 188 params->flags |= TLS_CONN_REQUEST_OCSP; 189 if (config->ocsp == 2) 190 params->flags |= TLS_CONN_REQUIRE_OCSP; 191 data->conn = tls_connection_init(data->ssl_ctx); 192 if (data->conn == NULL) { 193 wpa_printf(MSG_INFO, "SSL: Failed to initialize new TLS " 194 "connection"); 195 return -1; 196 } 197 198 res = tls_connection_set_params(data->ssl_ctx, data->conn, params); 199 if (res == TLS_SET_PARAMS_ENGINE_PRV_BAD_PIN) { 200 /* 201 * At this point with the pkcs11 engine the PIN is wrong. We 202 * reset the PIN in the configuration to be sure to not use it 203 * again and the calling function must request a new one. 204 */ 205 wpa_printf(MSG_INFO, 206 "TLS: Bad PIN provided, requesting a new one"); 207 os_free(config->pin); 208 config->pin = NULL; 209 eap_sm_request_pin(sm); 210 sm->ignore = TRUE; 211 } else if (res == TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED) { 212 wpa_printf(MSG_INFO, "TLS: Failed to initialize engine"); 213 } else if (res == TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED) { 214 wpa_printf(MSG_INFO, "TLS: Failed to load private key"); 215 sm->ignore = TRUE; 216 } 217 if (res) { 218 wpa_printf(MSG_INFO, "TLS: Failed to set TLS connection " 219 "parameters"); 220 tls_connection_deinit(data->ssl_ctx, data->conn); 221 data->conn = NULL; 222 return -1; 223 } 224 225 return 0; 226 } 227 228 229 /** 230 * eap_peer_tls_ssl_init - Initialize shared TLS functionality 231 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 232 * @data: Data for TLS processing 233 * @config: Pointer to the network configuration 234 * @eap_type: EAP method used in Phase 1 (EAP_TYPE_TLS/PEAP/TTLS/FAST) 235 * Returns: 0 on success, -1 on failure 236 * 237 * This function is used to initialize shared TLS functionality for EAP-TLS, 238 * EAP-PEAP, EAP-TTLS, and EAP-FAST. 239 */ 240 int eap_peer_tls_ssl_init(struct eap_sm *sm, struct eap_ssl_data *data, 241 struct eap_peer_config *config, u8 eap_type) 242 { 243 struct tls_connection_params params; 244 245 if (config == NULL) 246 return -1; 247 248 data->eap = sm; 249 data->eap_type = eap_type; 250 data->phase2 = sm->init_phase2; 251 data->ssl_ctx = sm->init_phase2 && sm->ssl_ctx2 ? sm->ssl_ctx2 : 252 sm->ssl_ctx; 253 if (eap_tls_params_from_conf(sm, data, ¶ms, config, data->phase2) < 254 0) 255 return -1; 256 257 if (eap_tls_init_connection(sm, data, config, ¶ms) < 0) 258 return -1; 259 260 data->tls_out_limit = config->fragment_size; 261 if (data->phase2) { 262 /* Limit the fragment size in the inner TLS authentication 263 * since the outer authentication with EAP-PEAP does not yet 264 * support fragmentation */ 265 if (data->tls_out_limit > 100) 266 data->tls_out_limit -= 100; 267 } 268 269 if (config->phase1 && 270 os_strstr(config->phase1, "include_tls_length=1")) { 271 wpa_printf(MSG_DEBUG, "TLS: Include TLS Message Length in " 272 "unfragmented packets"); 273 data->include_tls_length = 1; 274 } 275 276 return 0; 277 } 278 279 280 /** 281 * eap_peer_tls_ssl_deinit - Deinitialize shared TLS functionality 282 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 283 * @data: Data for TLS processing 284 * 285 * This function deinitializes shared TLS functionality that was initialized 286 * with eap_peer_tls_ssl_init(). 287 */ 288 void eap_peer_tls_ssl_deinit(struct eap_sm *sm, struct eap_ssl_data *data) 289 { 290 tls_connection_deinit(data->ssl_ctx, data->conn); 291 eap_peer_tls_reset_input(data); 292 eap_peer_tls_reset_output(data); 293 } 294 295 296 /** 297 * eap_peer_tls_derive_key - Derive a key based on TLS session data 298 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 299 * @data: Data for TLS processing 300 * @label: Label string for deriving the keys, e.g., "client EAP encryption" 301 * @len: Length of the key material to generate (usually 64 for MSK) 302 * Returns: Pointer to allocated key on success or %NULL on failure 303 * 304 * This function uses TLS-PRF to generate pseudo-random data based on the TLS 305 * session data (client/server random and master key). Each key type may use a 306 * different label to bind the key usage into the generated material. 307 * 308 * The caller is responsible for freeing the returned buffer. 309 */ 310 u8 * eap_peer_tls_derive_key(struct eap_sm *sm, struct eap_ssl_data *data, 311 const char *label, size_t len) 312 { 313 u8 *out; 314 315 out = os_malloc(len); 316 if (out == NULL) 317 return NULL; 318 319 if (tls_connection_prf(data->ssl_ctx, data->conn, label, 0, 0, 320 out, len)) { 321 os_free(out); 322 return NULL; 323 } 324 325 return out; 326 } 327 328 329 /** 330 * eap_peer_tls_derive_session_id - Derive a Session-Id based on TLS data 331 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 332 * @data: Data for TLS processing 333 * @eap_type: EAP method used in Phase 1 (EAP_TYPE_TLS/PEAP/TTLS/FAST) 334 * @len: Pointer to length of the session ID generated 335 * Returns: Pointer to allocated Session-Id on success or %NULL on failure 336 * 337 * This function derive the Session-Id based on the TLS session data 338 * (client/server random and method type). 339 * 340 * The caller is responsible for freeing the returned buffer. 341 */ 342 u8 * eap_peer_tls_derive_session_id(struct eap_sm *sm, 343 struct eap_ssl_data *data, u8 eap_type, 344 size_t *len) 345 { 346 struct tls_keys keys; 347 u8 *out; 348 349 if (tls_connection_get_keys(sm->ssl_ctx, data->conn, &keys)) 350 return NULL; 351 352 if (keys.client_random == NULL || keys.server_random == NULL) 353 return NULL; 354 355 *len = 1 + keys.client_random_len + keys.server_random_len; 356 out = os_malloc(*len); 357 if (out == NULL) 358 return NULL; 359 360 /* Session-Id = EAP type || client.random || server.random */ 361 out[0] = eap_type; 362 os_memcpy(out + 1, keys.client_random, keys.client_random_len); 363 os_memcpy(out + 1 + keys.client_random_len, keys.server_random, 364 keys.server_random_len); 365 366 return out; 367 } 368 369 370 /** 371 * eap_peer_tls_reassemble_fragment - Reassemble a received fragment 372 * @data: Data for TLS processing 373 * @in_data: Next incoming TLS segment 374 * Returns: 0 on success, 1 if more data is needed for the full message, or 375 * -1 on error 376 */ 377 static int eap_peer_tls_reassemble_fragment(struct eap_ssl_data *data, 378 const struct wpabuf *in_data) 379 { 380 size_t tls_in_len, in_len; 381 382 tls_in_len = data->tls_in ? wpabuf_len(data->tls_in) : 0; 383 in_len = in_data ? wpabuf_len(in_data) : 0; 384 385 if (tls_in_len + in_len == 0) { 386 /* No message data received?! */ 387 wpa_printf(MSG_WARNING, "SSL: Invalid reassembly state: " 388 "tls_in_left=%lu tls_in_len=%lu in_len=%lu", 389 (unsigned long) data->tls_in_left, 390 (unsigned long) tls_in_len, 391 (unsigned long) in_len); 392 eap_peer_tls_reset_input(data); 393 return -1; 394 } 395 396 if (tls_in_len + in_len > 65536) { 397 /* 398 * Limit length to avoid rogue servers from causing large 399 * memory allocations. 400 */ 401 wpa_printf(MSG_INFO, "SSL: Too long TLS fragment (size over " 402 "64 kB)"); 403 eap_peer_tls_reset_input(data); 404 return -1; 405 } 406 407 if (in_len > data->tls_in_left) { 408 /* Sender is doing something odd - reject message */ 409 wpa_printf(MSG_INFO, "SSL: more data than TLS message length " 410 "indicated"); 411 eap_peer_tls_reset_input(data); 412 return -1; 413 } 414 415 if (wpabuf_resize(&data->tls_in, in_len) < 0) { 416 wpa_printf(MSG_INFO, "SSL: Could not allocate memory for TLS " 417 "data"); 418 eap_peer_tls_reset_input(data); 419 return -1; 420 } 421 if (in_data) 422 wpabuf_put_buf(data->tls_in, in_data); 423 data->tls_in_left -= in_len; 424 425 if (data->tls_in_left > 0) { 426 wpa_printf(MSG_DEBUG, "SSL: Need %lu bytes more input " 427 "data", (unsigned long) data->tls_in_left); 428 return 1; 429 } 430 431 return 0; 432 } 433 434 435 /** 436 * eap_peer_tls_data_reassemble - Reassemble TLS data 437 * @data: Data for TLS processing 438 * @in_data: Next incoming TLS segment 439 * @need_more_input: Variable for returning whether more input data is needed 440 * to reassemble this TLS packet 441 * Returns: Pointer to output data, %NULL on error or when more data is needed 442 * for the full message (in which case, *need_more_input is also set to 1). 443 * 444 * This function reassembles TLS fragments. Caller must not free the returned 445 * data buffer since an internal pointer to it is maintained. 446 */ 447 static const struct wpabuf * eap_peer_tls_data_reassemble( 448 struct eap_ssl_data *data, const struct wpabuf *in_data, 449 int *need_more_input) 450 { 451 *need_more_input = 0; 452 453 if (data->tls_in_left > wpabuf_len(in_data) || data->tls_in) { 454 /* Message has fragments */ 455 int res = eap_peer_tls_reassemble_fragment(data, in_data); 456 if (res) { 457 if (res == 1) 458 *need_more_input = 1; 459 return NULL; 460 } 461 462 /* Message is now fully reassembled. */ 463 } else { 464 /* No fragments in this message, so just make a copy of it. */ 465 data->tls_in_left = 0; 466 data->tls_in = wpabuf_dup(in_data); 467 if (data->tls_in == NULL) 468 return NULL; 469 } 470 471 return data->tls_in; 472 } 473 474 475 /** 476 * eap_tls_process_input - Process incoming TLS message 477 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 478 * @data: Data for TLS processing 479 * @in_data: Message received from the server 480 * @out_data: Buffer for returning a pointer to application data (if available) 481 * Returns: 0 on success, 1 if more input data is needed, 2 if application data 482 * is available, -1 on failure 483 */ 484 static int eap_tls_process_input(struct eap_sm *sm, struct eap_ssl_data *data, 485 const struct wpabuf *in_data, 486 struct wpabuf **out_data) 487 { 488 const struct wpabuf *msg; 489 int need_more_input; 490 struct wpabuf *appl_data; 491 492 msg = eap_peer_tls_data_reassemble(data, in_data, &need_more_input); 493 if (msg == NULL) 494 return need_more_input ? 1 : -1; 495 496 /* Full TLS message reassembled - continue handshake processing */ 497 if (data->tls_out) { 498 /* This should not happen.. */ 499 wpa_printf(MSG_INFO, "SSL: eap_tls_process_input - pending " 500 "tls_out data even though tls_out_len = 0"); 501 wpabuf_free(data->tls_out); 502 WPA_ASSERT(data->tls_out == NULL); 503 } 504 appl_data = NULL; 505 data->tls_out = tls_connection_handshake(data->ssl_ctx, data->conn, 506 msg, &appl_data); 507 508 eap_peer_tls_reset_input(data); 509 510 if (appl_data && 511 tls_connection_established(data->ssl_ctx, data->conn) && 512 !tls_connection_get_failed(data->ssl_ctx, data->conn)) { 513 wpa_hexdump_buf_key(MSG_MSGDUMP, "SSL: Application data", 514 appl_data); 515 *out_data = appl_data; 516 return 2; 517 } 518 519 wpabuf_free(appl_data); 520 521 return 0; 522 } 523 524 525 /** 526 * eap_tls_process_output - Process outgoing TLS message 527 * @data: Data for TLS processing 528 * @eap_type: EAP type (EAP_TYPE_TLS, EAP_TYPE_PEAP, ...) 529 * @peap_version: Version number for EAP-PEAP/TTLS 530 * @id: EAP identifier for the response 531 * @ret: Return value to use on success 532 * @out_data: Buffer for returning the allocated output buffer 533 * Returns: ret (0 or 1) on success, -1 on failure 534 */ 535 static int eap_tls_process_output(struct eap_ssl_data *data, EapType eap_type, 536 int peap_version, u8 id, int ret, 537 struct wpabuf **out_data) 538 { 539 size_t len; 540 u8 *flags; 541 int more_fragments, length_included; 542 543 if (data->tls_out == NULL) 544 return -1; 545 len = wpabuf_len(data->tls_out) - data->tls_out_pos; 546 wpa_printf(MSG_DEBUG, "SSL: %lu bytes left to be sent out (of total " 547 "%lu bytes)", 548 (unsigned long) len, 549 (unsigned long) wpabuf_len(data->tls_out)); 550 551 /* 552 * Limit outgoing message to the configured maximum size. Fragment 553 * message if needed. 554 */ 555 if (len > data->tls_out_limit) { 556 more_fragments = 1; 557 len = data->tls_out_limit; 558 wpa_printf(MSG_DEBUG, "SSL: sending %lu bytes, more fragments " 559 "will follow", (unsigned long) len); 560 } else 561 more_fragments = 0; 562 563 length_included = data->tls_out_pos == 0 && 564 (wpabuf_len(data->tls_out) > data->tls_out_limit || 565 data->include_tls_length); 566 if (!length_included && 567 eap_type == EAP_TYPE_PEAP && peap_version == 0 && 568 !tls_connection_established(data->eap->ssl_ctx, data->conn)) { 569 /* 570 * Windows Server 2008 NPS really wants to have the TLS Message 571 * length included in phase 0 even for unfragmented frames or 572 * it will get very confused with Compound MAC calculation and 573 * Outer TLVs. 574 */ 575 length_included = 1; 576 } 577 578 *out_data = eap_tls_msg_alloc(eap_type, 1 + length_included * 4 + len, 579 EAP_CODE_RESPONSE, id); 580 if (*out_data == NULL) 581 return -1; 582 583 flags = wpabuf_put(*out_data, 1); 584 *flags = peap_version; 585 if (more_fragments) 586 *flags |= EAP_TLS_FLAGS_MORE_FRAGMENTS; 587 if (length_included) { 588 *flags |= EAP_TLS_FLAGS_LENGTH_INCLUDED; 589 wpabuf_put_be32(*out_data, wpabuf_len(data->tls_out)); 590 } 591 592 wpabuf_put_data(*out_data, 593 wpabuf_head_u8(data->tls_out) + data->tls_out_pos, 594 len); 595 data->tls_out_pos += len; 596 597 if (!more_fragments) 598 eap_peer_tls_reset_output(data); 599 600 return ret; 601 } 602 603 604 /** 605 * eap_peer_tls_process_helper - Process TLS handshake message 606 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 607 * @data: Data for TLS processing 608 * @eap_type: EAP type (EAP_TYPE_TLS, EAP_TYPE_PEAP, ...) 609 * @peap_version: Version number for EAP-PEAP/TTLS 610 * @id: EAP identifier for the response 611 * @in_data: Message received from the server 612 * @out_data: Buffer for returning a pointer to the response message 613 * Returns: 0 on success, 1 if more input data is needed, 2 if application data 614 * is available, or -1 on failure 615 * 616 * This function can be used to process TLS handshake messages. It reassembles 617 * the received fragments and uses a TLS library to process the messages. The 618 * response data from the TLS library is fragmented to suitable output messages 619 * that the caller can send out. 620 * 621 * out_data is used to return the response message if the return value of this 622 * function is 0, 2, or -1. In case of failure, the message is likely a TLS 623 * alarm message. The caller is responsible for freeing the allocated buffer if 624 * *out_data is not %NULL. 625 * 626 * This function is called for each received TLS message during the TLS 627 * handshake after eap_peer_tls_process_init() call and possible processing of 628 * TLS Flags field. Once the handshake has been completed, i.e., when 629 * tls_connection_established() returns 1, EAP method specific decrypting of 630 * the tunneled data is used. 631 */ 632 int eap_peer_tls_process_helper(struct eap_sm *sm, struct eap_ssl_data *data, 633 EapType eap_type, int peap_version, 634 u8 id, const struct wpabuf *in_data, 635 struct wpabuf **out_data) 636 { 637 int ret = 0; 638 639 *out_data = NULL; 640 641 if (data->tls_out && wpabuf_len(data->tls_out) > 0 && 642 wpabuf_len(in_data) > 0) { 643 wpa_printf(MSG_DEBUG, "SSL: Received non-ACK when output " 644 "fragments are waiting to be sent out"); 645 return -1; 646 } 647 648 if (data->tls_out == NULL || wpabuf_len(data->tls_out) == 0) { 649 /* 650 * No more data to send out - expect to receive more data from 651 * the AS. 652 */ 653 int res = eap_tls_process_input(sm, data, in_data, out_data); 654 if (res) { 655 /* 656 * Input processing failed (res = -1) or more data is 657 * needed (res = 1). 658 */ 659 return res; 660 } 661 662 /* 663 * The incoming message has been reassembled and processed. The 664 * response was allocated into data->tls_out buffer. 665 */ 666 } 667 668 if (data->tls_out == NULL) { 669 /* 670 * No outgoing fragments remaining from the previous message 671 * and no new message generated. This indicates an error in TLS 672 * processing. 673 */ 674 eap_peer_tls_reset_output(data); 675 return -1; 676 } 677 678 if (tls_connection_get_failed(data->ssl_ctx, data->conn)) { 679 /* TLS processing has failed - return error */ 680 wpa_printf(MSG_DEBUG, "SSL: Failed - tls_out available to " 681 "report error"); 682 ret = -1; 683 /* TODO: clean pin if engine used? */ 684 } 685 686 if (data->tls_out == NULL || wpabuf_len(data->tls_out) == 0) { 687 /* 688 * TLS negotiation should now be complete since all other cases 689 * needing more data should have been caught above based on 690 * the TLS Message Length field. 691 */ 692 wpa_printf(MSG_DEBUG, "SSL: No data to be sent out"); 693 wpabuf_free(data->tls_out); 694 data->tls_out = NULL; 695 return 1; 696 } 697 698 /* Send the pending message (in fragments, if needed). */ 699 return eap_tls_process_output(data, eap_type, peap_version, id, ret, 700 out_data); 701 } 702 703 704 /** 705 * eap_peer_tls_build_ack - Build a TLS ACK frame 706 * @id: EAP identifier for the response 707 * @eap_type: EAP type (EAP_TYPE_TLS, EAP_TYPE_PEAP, ...) 708 * @peap_version: Version number for EAP-PEAP/TTLS 709 * Returns: Pointer to the allocated ACK frame or %NULL on failure 710 */ 711 struct wpabuf * eap_peer_tls_build_ack(u8 id, EapType eap_type, 712 int peap_version) 713 { 714 struct wpabuf *resp; 715 716 resp = eap_tls_msg_alloc(eap_type, 1, EAP_CODE_RESPONSE, id); 717 if (resp == NULL) 718 return NULL; 719 wpa_printf(MSG_DEBUG, "SSL: Building ACK (type=%d id=%d ver=%d)", 720 (int) eap_type, id, peap_version); 721 wpabuf_put_u8(resp, peap_version); /* Flags */ 722 return resp; 723 } 724 725 726 /** 727 * eap_peer_tls_reauth_init - Re-initialize shared TLS for session resumption 728 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 729 * @data: Data for TLS processing 730 * Returns: 0 on success, -1 on failure 731 */ 732 int eap_peer_tls_reauth_init(struct eap_sm *sm, struct eap_ssl_data *data) 733 { 734 eap_peer_tls_reset_input(data); 735 eap_peer_tls_reset_output(data); 736 return tls_connection_shutdown(data->ssl_ctx, data->conn); 737 } 738 739 740 /** 741 * eap_peer_tls_status - Get TLS status 742 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 743 * @data: Data for TLS processing 744 * @buf: Buffer for status information 745 * @buflen: Maximum buffer length 746 * @verbose: Whether to include verbose status information 747 * Returns: Number of bytes written to buf. 748 */ 749 int eap_peer_tls_status(struct eap_sm *sm, struct eap_ssl_data *data, 750 char *buf, size_t buflen, int verbose) 751 { 752 char name[128]; 753 int len = 0, ret; 754 755 if (tls_get_cipher(data->ssl_ctx, data->conn, name, sizeof(name)) == 0) 756 { 757 ret = os_snprintf(buf + len, buflen - len, 758 "EAP TLS cipher=%s\n" 759 "tls_session_reused=%d\n", 760 name, tls_connection_resumed(data->ssl_ctx, 761 data->conn)); 762 if (os_snprintf_error(buflen - len, ret)) 763 return len; 764 len += ret; 765 } 766 767 return len; 768 } 769 770 771 /** 772 * eap_peer_tls_process_init - Initial validation/processing of EAP requests 773 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 774 * @data: Data for TLS processing 775 * @eap_type: EAP type (EAP_TYPE_TLS, EAP_TYPE_PEAP, ...) 776 * @ret: Return values from EAP request validation and processing 777 * @reqData: EAP request to be processed (eapReqData) 778 * @len: Buffer for returning length of the remaining payload 779 * @flags: Buffer for returning TLS flags 780 * Returns: Pointer to payload after TLS flags and length or %NULL on failure 781 * 782 * This function validates the EAP header and processes the optional TLS 783 * Message Length field. If this is the first fragment of a TLS message, the 784 * TLS reassembly code is initialized to receive the indicated number of bytes. 785 * 786 * EAP-TLS, EAP-PEAP, EAP-TTLS, and EAP-FAST methods are expected to use this 787 * function as the first step in processing received messages. They will need 788 * to process the flags (apart from Message Length Included) that are returned 789 * through the flags pointer and the message payload that will be returned (and 790 * the length is returned through the len pointer). Return values (ret) are set 791 * for continuation of EAP method processing. The caller is responsible for 792 * setting these to indicate completion (either success or failure) based on 793 * the authentication result. 794 */ 795 const u8 * eap_peer_tls_process_init(struct eap_sm *sm, 796 struct eap_ssl_data *data, 797 EapType eap_type, 798 struct eap_method_ret *ret, 799 const struct wpabuf *reqData, 800 size_t *len, u8 *flags) 801 { 802 const u8 *pos; 803 size_t left; 804 unsigned int tls_msg_len; 805 806 if (tls_get_errors(data->ssl_ctx)) { 807 wpa_printf(MSG_INFO, "SSL: TLS errors detected"); 808 ret->ignore = TRUE; 809 return NULL; 810 } 811 812 if (eap_type == EAP_UNAUTH_TLS_TYPE) 813 pos = eap_hdr_validate(EAP_VENDOR_UNAUTH_TLS, 814 EAP_VENDOR_TYPE_UNAUTH_TLS, reqData, 815 &left); 816 else if (eap_type == EAP_WFA_UNAUTH_TLS_TYPE) 817 pos = eap_hdr_validate(EAP_VENDOR_WFA_NEW, 818 EAP_VENDOR_WFA_UNAUTH_TLS, reqData, 819 &left); 820 else 821 pos = eap_hdr_validate(EAP_VENDOR_IETF, eap_type, reqData, 822 &left); 823 if (pos == NULL) { 824 ret->ignore = TRUE; 825 return NULL; 826 } 827 if (left == 0) { 828 wpa_printf(MSG_DEBUG, "SSL: Invalid TLS message: no Flags " 829 "octet included"); 830 if (!sm->workaround) { 831 ret->ignore = TRUE; 832 return NULL; 833 } 834 835 wpa_printf(MSG_DEBUG, "SSL: Workaround - assume no Flags " 836 "indicates ACK frame"); 837 *flags = 0; 838 } else { 839 *flags = *pos++; 840 left--; 841 } 842 wpa_printf(MSG_DEBUG, "SSL: Received packet(len=%lu) - " 843 "Flags 0x%02x", (unsigned long) wpabuf_len(reqData), 844 *flags); 845 if (*flags & EAP_TLS_FLAGS_LENGTH_INCLUDED) { 846 if (left < 4) { 847 wpa_printf(MSG_INFO, "SSL: Short frame with TLS " 848 "length"); 849 ret->ignore = TRUE; 850 return NULL; 851 } 852 tls_msg_len = WPA_GET_BE32(pos); 853 wpa_printf(MSG_DEBUG, "SSL: TLS Message Length: %d", 854 tls_msg_len); 855 if (data->tls_in_left == 0) { 856 data->tls_in_total = tls_msg_len; 857 data->tls_in_left = tls_msg_len; 858 wpabuf_free(data->tls_in); 859 data->tls_in = NULL; 860 } 861 pos += 4; 862 left -= 4; 863 864 if (left > tls_msg_len) { 865 wpa_printf(MSG_INFO, "SSL: TLS Message Length (%d " 866 "bytes) smaller than this fragment (%d " 867 "bytes)", (int) tls_msg_len, (int) left); 868 ret->ignore = TRUE; 869 return NULL; 870 } 871 } 872 873 ret->ignore = FALSE; 874 ret->methodState = METHOD_MAY_CONT; 875 ret->decision = DECISION_FAIL; 876 ret->allowNotifications = TRUE; 877 878 *len = left; 879 return pos; 880 } 881 882 883 /** 884 * eap_peer_tls_reset_input - Reset input buffers 885 * @data: Data for TLS processing 886 * 887 * This function frees any allocated memory for input buffers and resets input 888 * state. 889 */ 890 void eap_peer_tls_reset_input(struct eap_ssl_data *data) 891 { 892 data->tls_in_left = data->tls_in_total = 0; 893 wpabuf_free(data->tls_in); 894 data->tls_in = NULL; 895 } 896 897 898 /** 899 * eap_peer_tls_reset_output - Reset output buffers 900 * @data: Data for TLS processing 901 * 902 * This function frees any allocated memory for output buffers and resets 903 * output state. 904 */ 905 void eap_peer_tls_reset_output(struct eap_ssl_data *data) 906 { 907 data->tls_out_pos = 0; 908 wpabuf_free(data->tls_out); 909 data->tls_out = NULL; 910 } 911 912 913 /** 914 * eap_peer_tls_decrypt - Decrypt received phase 2 TLS message 915 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 916 * @data: Data for TLS processing 917 * @in_data: Message received from the server 918 * @in_decrypted: Buffer for returning a pointer to the decrypted message 919 * Returns: 0 on success, 1 if more input data is needed, or -1 on failure 920 */ 921 int eap_peer_tls_decrypt(struct eap_sm *sm, struct eap_ssl_data *data, 922 const struct wpabuf *in_data, 923 struct wpabuf **in_decrypted) 924 { 925 const struct wpabuf *msg; 926 int need_more_input; 927 928 msg = eap_peer_tls_data_reassemble(data, in_data, &need_more_input); 929 if (msg == NULL) 930 return need_more_input ? 1 : -1; 931 932 *in_decrypted = tls_connection_decrypt(data->ssl_ctx, data->conn, msg); 933 eap_peer_tls_reset_input(data); 934 if (*in_decrypted == NULL) { 935 wpa_printf(MSG_INFO, "SSL: Failed to decrypt Phase 2 data"); 936 return -1; 937 } 938 return 0; 939 } 940 941 942 /** 943 * eap_peer_tls_encrypt - Encrypt phase 2 TLS message 944 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 945 * @data: Data for TLS processing 946 * @eap_type: EAP type (EAP_TYPE_TLS, EAP_TYPE_PEAP, ...) 947 * @peap_version: Version number for EAP-PEAP/TTLS 948 * @id: EAP identifier for the response 949 * @in_data: Plaintext phase 2 data to encrypt or %NULL to continue fragments 950 * @out_data: Buffer for returning a pointer to the encrypted response message 951 * Returns: 0 on success, -1 on failure 952 */ 953 int eap_peer_tls_encrypt(struct eap_sm *sm, struct eap_ssl_data *data, 954 EapType eap_type, int peap_version, u8 id, 955 const struct wpabuf *in_data, 956 struct wpabuf **out_data) 957 { 958 if (in_data) { 959 eap_peer_tls_reset_output(data); 960 data->tls_out = tls_connection_encrypt(data->ssl_ctx, 961 data->conn, in_data); 962 if (data->tls_out == NULL) { 963 wpa_printf(MSG_INFO, "SSL: Failed to encrypt Phase 2 " 964 "data (in_len=%lu)", 965 (unsigned long) wpabuf_len(in_data)); 966 eap_peer_tls_reset_output(data); 967 return -1; 968 } 969 } 970 971 return eap_tls_process_output(data, eap_type, peap_version, id, 0, 972 out_data); 973 } 974 975 976 /** 977 * eap_peer_select_phase2_methods - Select phase 2 EAP method 978 * @config: Pointer to the network configuration 979 * @prefix: 'phase2' configuration prefix, e.g., "auth=" 980 * @types: Buffer for returning allocated list of allowed EAP methods 981 * @num_types: Buffer for returning number of allocated EAP methods 982 * Returns: 0 on success, -1 on failure 983 * 984 * This function is used to parse EAP method list and select allowed methods 985 * for Phase2 authentication. 986 */ 987 int eap_peer_select_phase2_methods(struct eap_peer_config *config, 988 const char *prefix, 989 struct eap_method_type **types, 990 size_t *num_types) 991 { 992 char *start, *pos, *buf; 993 struct eap_method_type *methods = NULL, *_methods; 994 u32 method; 995 size_t num_methods = 0, prefix_len; 996 997 if (config == NULL || config->phase2 == NULL) 998 goto get_defaults; 999 1000 start = buf = os_strdup(config->phase2); 1001 if (buf == NULL) 1002 return -1; 1003 1004 prefix_len = os_strlen(prefix); 1005 1006 while (start && *start != '\0') { 1007 int vendor; 1008 pos = os_strstr(start, prefix); 1009 if (pos == NULL) 1010 break; 1011 if (start != pos && *(pos - 1) != ' ') { 1012 start = pos + prefix_len; 1013 continue; 1014 } 1015 1016 start = pos + prefix_len; 1017 pos = os_strchr(start, ' '); 1018 if (pos) 1019 *pos++ = '\0'; 1020 method = eap_get_phase2_type(start, &vendor); 1021 if (vendor == EAP_VENDOR_IETF && method == EAP_TYPE_NONE) { 1022 wpa_printf(MSG_ERROR, "TLS: Unsupported Phase2 EAP " 1023 "method '%s'", start); 1024 } else { 1025 num_methods++; 1026 _methods = os_realloc_array(methods, num_methods, 1027 sizeof(*methods)); 1028 if (_methods == NULL) { 1029 os_free(methods); 1030 os_free(buf); 1031 return -1; 1032 } 1033 methods = _methods; 1034 methods[num_methods - 1].vendor = vendor; 1035 methods[num_methods - 1].method = method; 1036 } 1037 1038 start = pos; 1039 } 1040 1041 os_free(buf); 1042 1043 get_defaults: 1044 if (methods == NULL) 1045 methods = eap_get_phase2_types(config, &num_methods); 1046 1047 if (methods == NULL) { 1048 wpa_printf(MSG_ERROR, "TLS: No Phase2 EAP methods available"); 1049 return -1; 1050 } 1051 wpa_hexdump(MSG_DEBUG, "TLS: Phase2 EAP types", 1052 (u8 *) methods, 1053 num_methods * sizeof(struct eap_method_type)); 1054 1055 *types = methods; 1056 *num_types = num_methods; 1057 1058 return 0; 1059 } 1060 1061 1062 /** 1063 * eap_peer_tls_phase2_nak - Generate EAP-Nak for Phase 2 1064 * @types: Buffer for returning allocated list of allowed EAP methods 1065 * @num_types: Buffer for returning number of allocated EAP methods 1066 * @hdr: EAP-Request header (and the following EAP type octet) 1067 * @resp: Buffer for returning the EAP-Nak message 1068 * Returns: 0 on success, -1 on failure 1069 */ 1070 int eap_peer_tls_phase2_nak(struct eap_method_type *types, size_t num_types, 1071 struct eap_hdr *hdr, struct wpabuf **resp) 1072 { 1073 u8 *pos = (u8 *) (hdr + 1); 1074 size_t i; 1075 1076 /* TODO: add support for expanded Nak */ 1077 wpa_printf(MSG_DEBUG, "TLS: Phase 2 Request: Nak type=%d", *pos); 1078 wpa_hexdump(MSG_DEBUG, "TLS: Allowed Phase2 EAP types", 1079 (u8 *) types, num_types * sizeof(struct eap_method_type)); 1080 *resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_NAK, num_types, 1081 EAP_CODE_RESPONSE, hdr->identifier); 1082 if (*resp == NULL) 1083 return -1; 1084 1085 for (i = 0; i < num_types; i++) { 1086 if (types[i].vendor == EAP_VENDOR_IETF && 1087 types[i].method < 256) 1088 wpabuf_put_u8(*resp, types[i].method); 1089 } 1090 1091 eap_update_len(*resp); 1092 1093 return 0; 1094 } 1095