Line data Source code
1 : /*
2 : * EAP-TLS/PEAP/TTLS/FAST server common functions
3 : * Copyright (c) 2004-2009, Jouni Malinen <j@w1.fi>
4 : *
5 : * This software may be distributed under the terms of the BSD license.
6 : * See README for more details.
7 : */
8 :
9 : #include "includes.h"
10 :
11 : #include "common.h"
12 : #include "crypto/sha1.h"
13 : #include "crypto/tls.h"
14 : #include "eap_i.h"
15 : #include "eap_tls_common.h"
16 :
17 :
18 : static void eap_server_tls_free_in_buf(struct eap_ssl_data *data);
19 :
20 :
21 3035 : struct wpabuf * eap_tls_msg_alloc(EapType type, size_t payload_len,
22 : u8 code, u8 identifier)
23 : {
24 3035 : if (type == EAP_UNAUTH_TLS_TYPE)
25 10 : return eap_msg_alloc(EAP_VENDOR_UNAUTH_TLS,
26 : EAP_VENDOR_TYPE_UNAUTH_TLS, payload_len,
27 : code, identifier);
28 3025 : else if (type == EAP_WFA_UNAUTH_TLS_TYPE)
29 10 : return eap_msg_alloc(EAP_VENDOR_WFA_NEW,
30 : EAP_VENDOR_WFA_UNAUTH_TLS, payload_len,
31 : code, identifier);
32 3015 : return eap_msg_alloc(EAP_VENDOR_IETF, type, payload_len, code,
33 : identifier);
34 : }
35 :
36 :
37 : #ifdef CONFIG_TLS_INTERNAL
38 : static void eap_server_tls_log_cb(void *ctx, const char *msg)
39 : {
40 : struct eap_sm *sm = ctx;
41 : eap_log_msg(sm, "TLS: %s", msg);
42 : }
43 : #endif /* CONFIG_TLS_INTERNAL */
44 :
45 :
46 929 : int eap_server_tls_ssl_init(struct eap_sm *sm, struct eap_ssl_data *data,
47 : int verify_peer, int eap_type)
48 : {
49 : u8 session_ctx[8];
50 929 : unsigned int flags = 0;
51 :
52 929 : if (sm->ssl_ctx == NULL) {
53 0 : wpa_printf(MSG_ERROR, "TLS context not initialized - cannot use TLS-based EAP method");
54 0 : return -1;
55 : }
56 :
57 929 : data->eap = sm;
58 929 : data->phase2 = sm->init_phase2;
59 :
60 929 : data->conn = tls_connection_init(sm->ssl_ctx);
61 929 : if (data->conn == NULL) {
62 0 : wpa_printf(MSG_INFO, "SSL: Failed to initialize new TLS "
63 : "connection");
64 0 : return -1;
65 : }
66 :
67 : #ifdef CONFIG_TLS_INTERNAL
68 : tls_connection_set_log_cb(data->conn, eap_server_tls_log_cb, sm);
69 : #ifdef CONFIG_TESTING_OPTIONS
70 : tls_connection_set_test_flags(data->conn, sm->tls_test_flags);
71 : #endif /* CONFIG_TESTING_OPTIONS */
72 : #endif /* CONFIG_TLS_INTERNAL */
73 :
74 929 : if (eap_type != EAP_TYPE_FAST)
75 788 : flags |= TLS_CONN_DISABLE_SESSION_TICKET;
76 929 : os_memcpy(session_ctx, "hostapd", 7);
77 929 : session_ctx[7] = (u8) eap_type;
78 929 : if (tls_connection_set_verify(sm->ssl_ctx, data->conn, verify_peer,
79 : flags, session_ctx,
80 : sizeof(session_ctx))) {
81 0 : wpa_printf(MSG_INFO, "SSL: Failed to configure verification "
82 : "of TLS peer certificate");
83 0 : tls_connection_deinit(sm->ssl_ctx, data->conn);
84 0 : data->conn = NULL;
85 0 : return -1;
86 : }
87 :
88 929 : data->tls_out_limit = sm->fragment_size > 0 ? sm->fragment_size : 1398;
89 929 : if (data->phase2) {
90 : /* Limit the fragment size in the inner TLS authentication
91 : * since the outer authentication with EAP-PEAP does not yet
92 : * support fragmentation */
93 5 : if (data->tls_out_limit > 100)
94 5 : data->tls_out_limit -= 100;
95 : }
96 929 : return 0;
97 : }
98 :
99 :
100 929 : void eap_server_tls_ssl_deinit(struct eap_sm *sm, struct eap_ssl_data *data)
101 : {
102 929 : tls_connection_deinit(sm->ssl_ctx, data->conn);
103 929 : eap_server_tls_free_in_buf(data);
104 929 : wpabuf_free(data->tls_out);
105 929 : data->tls_out = NULL;
106 929 : }
107 :
108 :
109 485 : u8 * eap_server_tls_derive_key(struct eap_sm *sm, struct eap_ssl_data *data,
110 : char *label, size_t len)
111 : {
112 : u8 *out;
113 :
114 485 : out = os_malloc(len);
115 485 : if (out == NULL)
116 0 : return NULL;
117 :
118 485 : if (tls_connection_export_key(sm->ssl_ctx, data->conn, label, out,
119 : len)) {
120 0 : os_free(out);
121 0 : return NULL;
122 : }
123 :
124 485 : return out;
125 : }
126 :
127 :
128 : /**
129 : * eap_server_tls_derive_session_id - Derive a Session-Id based on TLS data
130 : * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
131 : * @data: Data for TLS processing
132 : * @eap_type: EAP method used in Phase 1 (EAP_TYPE_TLS/PEAP/TTLS/FAST)
133 : * @len: Pointer to length of the session ID generated
134 : * Returns: Pointer to allocated Session-Id on success or %NULL on failure
135 : *
136 : * This function derive the Session-Id based on the TLS session data
137 : * (client/server random and method type).
138 : *
139 : * The caller is responsible for freeing the returned buffer.
140 : */
141 359 : u8 * eap_server_tls_derive_session_id(struct eap_sm *sm,
142 : struct eap_ssl_data *data, u8 eap_type,
143 : size_t *len)
144 : {
145 : struct tls_random keys;
146 : u8 *out;
147 :
148 359 : if (tls_connection_get_random(sm->ssl_ctx, data->conn, &keys))
149 0 : return NULL;
150 :
151 359 : if (keys.client_random == NULL || keys.server_random == NULL)
152 0 : return NULL;
153 :
154 359 : *len = 1 + keys.client_random_len + keys.server_random_len;
155 359 : out = os_malloc(*len);
156 359 : if (out == NULL)
157 0 : return NULL;
158 :
159 : /* Session-Id = EAP type || client.random || server.random */
160 359 : out[0] = eap_type;
161 359 : os_memcpy(out + 1, keys.client_random, keys.client_random_len);
162 359 : os_memcpy(out + 1 + keys.client_random_len, keys.server_random,
163 : keys.server_random_len);
164 :
165 359 : return out;
166 : }
167 :
168 :
169 2735 : struct wpabuf * eap_server_tls_build_msg(struct eap_ssl_data *data,
170 : int eap_type, int version, u8 id)
171 : {
172 : struct wpabuf *req;
173 : u8 flags;
174 : size_t send_len, plen;
175 :
176 2735 : wpa_printf(MSG_DEBUG, "SSL: Generating Request");
177 2735 : if (data->tls_out == NULL) {
178 5 : wpa_printf(MSG_ERROR, "SSL: tls_out NULL in %s", __func__);
179 5 : return NULL;
180 : }
181 :
182 2730 : flags = version;
183 2730 : send_len = wpabuf_len(data->tls_out) - data->tls_out_pos;
184 2730 : if (1 + send_len > data->tls_out_limit) {
185 793 : send_len = data->tls_out_limit - 1;
186 793 : flags |= EAP_TLS_FLAGS_MORE_FRAGMENTS;
187 793 : if (data->tls_out_pos == 0) {
188 469 : flags |= EAP_TLS_FLAGS_LENGTH_INCLUDED;
189 469 : send_len -= 4;
190 : }
191 : }
192 :
193 2730 : plen = 1 + send_len;
194 2730 : if (flags & EAP_TLS_FLAGS_LENGTH_INCLUDED)
195 469 : plen += 4;
196 :
197 2730 : req = eap_tls_msg_alloc(eap_type, plen, EAP_CODE_REQUEST, id);
198 2730 : if (req == NULL)
199 0 : return NULL;
200 :
201 2730 : wpabuf_put_u8(req, flags); /* Flags */
202 2730 : if (flags & EAP_TLS_FLAGS_LENGTH_INCLUDED)
203 469 : wpabuf_put_be32(req, wpabuf_len(data->tls_out));
204 :
205 2730 : wpabuf_put_data(req, wpabuf_head_u8(data->tls_out) + data->tls_out_pos,
206 : send_len);
207 2730 : data->tls_out_pos += send_len;
208 :
209 2730 : if (data->tls_out_pos == wpabuf_len(data->tls_out)) {
210 1937 : wpa_printf(MSG_DEBUG, "SSL: Sending out %lu bytes "
211 : "(message sent completely)",
212 : (unsigned long) send_len);
213 1937 : wpabuf_free(data->tls_out);
214 1937 : data->tls_out = NULL;
215 1937 : data->tls_out_pos = 0;
216 1937 : data->state = MSG;
217 : } else {
218 793 : wpa_printf(MSG_DEBUG, "SSL: Sending out %lu bytes "
219 : "(%lu more to send)", (unsigned long) send_len,
220 793 : (unsigned long) wpabuf_len(data->tls_out) -
221 793 : data->tls_out_pos);
222 793 : data->state = WAIT_FRAG_ACK;
223 : }
224 :
225 2730 : return req;
226 : }
227 :
228 :
229 211 : struct wpabuf * eap_server_tls_build_ack(u8 id, int eap_type, int version)
230 : {
231 : struct wpabuf *req;
232 :
233 211 : req = eap_tls_msg_alloc(eap_type, 1, EAP_CODE_REQUEST, id);
234 211 : if (req == NULL)
235 0 : return NULL;
236 211 : wpa_printf(MSG_DEBUG, "SSL: Building ACK");
237 211 : wpabuf_put_u8(req, version); /* Flags */
238 211 : return req;
239 : }
240 :
241 :
242 208 : static int eap_server_tls_process_cont(struct eap_ssl_data *data,
243 : const u8 *buf, size_t len)
244 : {
245 : /* Process continuation of a pending message */
246 208 : if (len > wpabuf_tailroom(data->tls_in)) {
247 0 : wpa_printf(MSG_DEBUG, "SSL: Fragment overflow");
248 0 : return -1;
249 : }
250 :
251 208 : wpabuf_put_data(data->tls_in, buf, len);
252 208 : wpa_printf(MSG_DEBUG, "SSL: Received %lu bytes, waiting for %lu "
253 : "bytes more", (unsigned long) len,
254 208 : (unsigned long) wpabuf_tailroom(data->tls_in));
255 :
256 208 : return 0;
257 : }
258 :
259 :
260 211 : static int eap_server_tls_process_fragment(struct eap_ssl_data *data,
261 : u8 flags, u32 message_length,
262 : const u8 *buf, size_t len)
263 : {
264 : /* Process a fragment that is not the last one of the message */
265 211 : if (data->tls_in == NULL && !(flags & EAP_TLS_FLAGS_LENGTH_INCLUDED)) {
266 0 : wpa_printf(MSG_DEBUG, "SSL: No Message Length field in a "
267 : "fragmented packet");
268 0 : return -1;
269 : }
270 :
271 211 : if (data->tls_in == NULL) {
272 : /* First fragment of the message */
273 :
274 : /* Limit length to avoid rogue peers from causing large
275 : * memory allocations. */
276 139 : if (message_length > 65536) {
277 0 : wpa_printf(MSG_INFO, "SSL: Too long TLS fragment (size"
278 : " over 64 kB)");
279 0 : return -1;
280 : }
281 :
282 139 : if (len > message_length) {
283 0 : wpa_printf(MSG_INFO, "SSL: Too much data (%d bytes) in "
284 : "first fragment of frame (TLS Message "
285 : "Length %d bytes)",
286 : (int) len, (int) message_length);
287 0 : return -1;
288 : }
289 :
290 139 : data->tls_in = wpabuf_alloc(message_length);
291 139 : if (data->tls_in == NULL) {
292 0 : wpa_printf(MSG_DEBUG, "SSL: No memory for message");
293 0 : return -1;
294 : }
295 139 : wpabuf_put_data(data->tls_in, buf, len);
296 139 : wpa_printf(MSG_DEBUG, "SSL: Received %lu bytes in first "
297 : "fragment, waiting for %lu bytes more",
298 : (unsigned long) len,
299 139 : (unsigned long) wpabuf_tailroom(data->tls_in));
300 : }
301 :
302 211 : return 0;
303 : }
304 :
305 :
306 1120 : int eap_server_tls_phase1(struct eap_sm *sm, struct eap_ssl_data *data)
307 : {
308 1120 : if (data->tls_out) {
309 : /* This should not happen.. */
310 0 : wpa_printf(MSG_INFO, "SSL: pending tls_out data when "
311 : "processing new message");
312 0 : wpabuf_free(data->tls_out);
313 : WPA_ASSERT(data->tls_out == NULL);
314 : }
315 :
316 1120 : data->tls_out = tls_connection_server_handshake(sm->ssl_ctx,
317 : data->conn,
318 1120 : data->tls_in, NULL);
319 1120 : if (data->tls_out == NULL) {
320 0 : wpa_printf(MSG_INFO, "SSL: TLS processing failed");
321 0 : return -1;
322 : }
323 1120 : if (tls_connection_get_failed(sm->ssl_ctx, data->conn)) {
324 : /* TLS processing has failed - return error */
325 35 : wpa_printf(MSG_DEBUG, "SSL: Failed - tls_out available to "
326 : "report error");
327 35 : return -1;
328 : }
329 :
330 1085 : return 0;
331 : }
332 :
333 :
334 3425 : static int eap_server_tls_reassemble(struct eap_ssl_data *data, u8 flags,
335 : const u8 **pos, size_t *left)
336 : {
337 3425 : unsigned int tls_msg_len = 0;
338 3425 : const u8 *end = *pos + *left;
339 :
340 3425 : if (flags & EAP_TLS_FLAGS_LENGTH_INCLUDED) {
341 197 : if (*left < 4) {
342 0 : wpa_printf(MSG_INFO, "SSL: Short frame with TLS "
343 : "length");
344 0 : return -1;
345 : }
346 197 : tls_msg_len = WPA_GET_BE32(*pos);
347 197 : wpa_printf(MSG_DEBUG, "SSL: TLS Message Length: %d",
348 : tls_msg_len);
349 197 : *pos += 4;
350 197 : *left -= 4;
351 :
352 197 : if (*left > tls_msg_len) {
353 0 : wpa_printf(MSG_INFO, "SSL: TLS Message Length (%d "
354 : "bytes) smaller than this fragment (%d "
355 0 : "bytes)", (int) tls_msg_len, (int) *left);
356 0 : return -1;
357 : }
358 : }
359 :
360 3425 : wpa_printf(MSG_DEBUG, "SSL: Received packet: Flags 0x%x "
361 : "Message Length %u", flags, tls_msg_len);
362 :
363 3425 : if (data->state == WAIT_FRAG_ACK) {
364 789 : if (*left != 0) {
365 0 : wpa_printf(MSG_DEBUG, "SSL: Unexpected payload in "
366 : "WAIT_FRAG_ACK state");
367 0 : return -1;
368 : }
369 789 : wpa_printf(MSG_DEBUG, "SSL: Fragment acknowledged");
370 789 : return 1;
371 : }
372 :
373 2844 : if (data->tls_in &&
374 208 : eap_server_tls_process_cont(data, *pos, end - *pos) < 0)
375 0 : return -1;
376 :
377 2636 : if (flags & EAP_TLS_FLAGS_MORE_FRAGMENTS) {
378 211 : if (eap_server_tls_process_fragment(data, flags, tls_msg_len,
379 211 : *pos, end - *pos) < 0)
380 0 : return -1;
381 :
382 211 : data->state = FRAG_ACK;
383 211 : return 1;
384 : }
385 :
386 2425 : if (data->state == FRAG_ACK) {
387 136 : wpa_printf(MSG_DEBUG, "SSL: All fragments received");
388 136 : data->state = MSG;
389 : }
390 :
391 2425 : if (data->tls_in == NULL) {
392 : /* Wrap unfragmented messages as wpabuf without extra copy */
393 2289 : wpabuf_set(&data->tmpbuf, *pos, end - *pos);
394 2289 : data->tls_in = &data->tmpbuf;
395 : }
396 :
397 2425 : return 0;
398 : }
399 :
400 :
401 3354 : static void eap_server_tls_free_in_buf(struct eap_ssl_data *data)
402 : {
403 3354 : if (data->tls_in != &data->tmpbuf)
404 1065 : wpabuf_free(data->tls_in);
405 3354 : data->tls_in = NULL;
406 3354 : }
407 :
408 :
409 970 : struct wpabuf * eap_server_tls_encrypt(struct eap_sm *sm,
410 : struct eap_ssl_data *data,
411 : const struct wpabuf *plain)
412 : {
413 : struct wpabuf *buf;
414 :
415 970 : buf = tls_connection_encrypt(sm->ssl_ctx, data->conn,
416 : plain);
417 970 : if (buf == NULL) {
418 0 : wpa_printf(MSG_INFO, "SSL: Failed to encrypt Phase 2 data");
419 0 : return NULL;
420 : }
421 :
422 970 : return buf;
423 : }
424 :
425 :
426 3426 : int eap_server_tls_process(struct eap_sm *sm, struct eap_ssl_data *data,
427 : struct wpabuf *respData, void *priv, int eap_type,
428 : int (*proc_version)(struct eap_sm *sm, void *priv,
429 : int peer_version),
430 : void (*proc_msg)(struct eap_sm *sm, void *priv,
431 : const struct wpabuf *respData))
432 : {
433 : const u8 *pos;
434 : u8 flags;
435 : size_t left;
436 3426 : int ret, res = 0;
437 :
438 3426 : if (eap_type == EAP_UNAUTH_TLS_TYPE)
439 8 : pos = eap_hdr_validate(EAP_VENDOR_UNAUTH_TLS,
440 : EAP_VENDOR_TYPE_UNAUTH_TLS, respData,
441 : &left);
442 3418 : else if (eap_type == EAP_WFA_UNAUTH_TLS_TYPE)
443 8 : pos = eap_hdr_validate(EAP_VENDOR_WFA_NEW,
444 : EAP_VENDOR_WFA_UNAUTH_TLS, respData,
445 : &left);
446 : else
447 3410 : pos = eap_hdr_validate(EAP_VENDOR_IETF, eap_type, respData,
448 : &left);
449 3426 : if (pos == NULL || left < 1)
450 0 : return 0; /* Should not happen - frame already validated */
451 3426 : flags = *pos++;
452 3426 : left--;
453 3426 : wpa_printf(MSG_DEBUG, "SSL: Received packet(len=%lu) - Flags 0x%02x",
454 : (unsigned long) wpabuf_len(respData), flags);
455 :
456 6405 : if (proc_version &&
457 2979 : proc_version(sm, priv, flags & EAP_TLS_VERSION_MASK) < 0)
458 1 : return -1;
459 :
460 3425 : ret = eap_server_tls_reassemble(data, flags, &pos, &left);
461 3425 : if (ret < 0) {
462 0 : res = -1;
463 0 : goto done;
464 3425 : } else if (ret == 1)
465 1000 : return 0;
466 :
467 2425 : if (proc_msg)
468 2425 : proc_msg(sm, priv, respData);
469 :
470 2425 : if (tls_connection_get_write_alerts(sm->ssl_ctx, data->conn) > 1) {
471 0 : wpa_printf(MSG_INFO, "SSL: Locally detected fatal error in "
472 : "TLS processing");
473 0 : res = -1;
474 : }
475 :
476 : done:
477 2425 : eap_server_tls_free_in_buf(data);
478 :
479 2425 : return res;
480 : }
|