2 * EAP peer method: EAP-TLS (RFC 2716)
3 * Copyright (c) 2004-2008, 2012, Jouni Malinen <j@w1.fi>
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
12 #include "crypto/tls.h"
14 #include "eap_tls_common.h"
15 #include "eap_config.h"
18 static void eap_tls_deinit(struct eap_sm *sm, void *priv);
22 struct eap_ssl_data ssl;
31 static void * eap_tls_init(struct eap_sm *sm)
33 struct eap_tls_data *data;
34 struct eap_peer_config *config = eap_get_config(sm);
36 ((sm->init_phase2 ? config->private_key2 : config->private_key)
38 (sm->init_phase2 ? config->engine2 : config->engine) == 0)) {
39 wpa_printf(MSG_INFO, "EAP-TLS: Private key not configured");
43 data = os_zalloc(sizeof(*data));
47 data->ssl_ctx = sm->init_phase2 && sm->ssl_ctx2 ? sm->ssl_ctx2 :
50 if (eap_peer_tls_ssl_init(sm, &data->ssl, config, EAP_TYPE_TLS)) {
51 wpa_printf(MSG_INFO, "EAP-TLS: Failed to initialize SSL.");
52 eap_tls_deinit(sm, data);
54 wpa_printf(MSG_DEBUG, "EAP-TLS: Requesting Smartcard "
56 eap_sm_request_pin(sm);
58 } else if (config->private_key && !config->private_key_passwd)
60 wpa_printf(MSG_DEBUG, "EAP-TLS: Requesting private "
62 eap_sm_request_passphrase(sm);
68 data->eap_type = EAP_TYPE_TLS;
75 static void * eap_unauth_tls_init(struct eap_sm *sm)
77 struct eap_tls_data *data;
78 struct eap_peer_config *config = eap_get_config(sm);
80 data = os_zalloc(sizeof(*data));
84 data->ssl_ctx = sm->init_phase2 && sm->ssl_ctx2 ? sm->ssl_ctx2 :
87 if (eap_peer_tls_ssl_init(sm, &data->ssl, config,
88 EAP_UNAUTH_TLS_TYPE)) {
89 wpa_printf(MSG_INFO, "EAP-TLS: Failed to initialize SSL.");
90 eap_tls_deinit(sm, data);
94 data->eap_type = EAP_UNAUTH_TLS_TYPE;
98 #endif /* EAP_UNAUTH_TLS */
102 static void * eap_wfa_unauth_tls_init(struct eap_sm *sm)
104 struct eap_tls_data *data;
105 struct eap_peer_config *config = eap_get_config(sm);
107 data = os_zalloc(sizeof(*data));
111 data->ssl_ctx = sm->init_phase2 && sm->ssl_ctx2 ? sm->ssl_ctx2 :
114 if (eap_peer_tls_ssl_init(sm, &data->ssl, config,
115 EAP_WFA_UNAUTH_TLS_TYPE)) {
116 wpa_printf(MSG_INFO, "EAP-TLS: Failed to initialize SSL.");
117 eap_tls_deinit(sm, data);
121 data->eap_type = EAP_WFA_UNAUTH_TLS_TYPE;
125 #endif /* CONFIG_HS20 */
128 static void eap_tls_free_key(struct eap_tls_data *data)
130 if (data->key_data) {
131 bin_clear_free(data->key_data, EAP_TLS_KEY_LEN + EAP_EMSK_LEN);
132 data->key_data = NULL;
137 static void eap_tls_deinit(struct eap_sm *sm, void *priv)
139 struct eap_tls_data *data = priv;
142 eap_peer_tls_ssl_deinit(sm, &data->ssl);
143 eap_tls_free_key(data);
144 os_free(data->session_id);
149 static struct wpabuf * eap_tls_failure(struct eap_sm *sm,
150 struct eap_tls_data *data,
151 struct eap_method_ret *ret, int res,
152 struct wpabuf *resp, u8 id)
154 wpa_printf(MSG_DEBUG, "EAP-TLS: TLS processing failed");
156 ret->methodState = METHOD_DONE;
157 ret->decision = DECISION_FAIL;
161 * This is likely an alert message, so send it instead of just
167 return eap_peer_tls_build_ack(id, data->eap_type, 0);
171 static void eap_tls_success(struct eap_sm *sm, struct eap_tls_data *data,
172 struct eap_method_ret *ret)
174 wpa_printf(MSG_DEBUG, "EAP-TLS: Done");
176 ret->methodState = METHOD_DONE;
177 ret->decision = DECISION_UNCOND_SUCC;
179 eap_tls_free_key(data);
180 data->key_data = eap_peer_tls_derive_key(sm, &data->ssl,
181 "client EAP encryption",
184 if (data->key_data) {
185 wpa_hexdump_key(MSG_DEBUG, "EAP-TLS: Derived key",
186 data->key_data, EAP_TLS_KEY_LEN);
187 wpa_hexdump_key(MSG_DEBUG, "EAP-TLS: Derived EMSK",
188 data->key_data + EAP_TLS_KEY_LEN,
191 wpa_printf(MSG_INFO, "EAP-TLS: Failed to derive key");
194 os_free(data->session_id);
195 data->session_id = eap_peer_tls_derive_session_id(sm, &data->ssl,
198 if (data->session_id) {
199 wpa_hexdump(MSG_DEBUG, "EAP-TLS: Derived Session-Id",
200 data->session_id, data->id_len);
202 wpa_printf(MSG_ERROR, "EAP-TLS: Failed to derive Session-Id");
207 static struct wpabuf * eap_tls_process(struct eap_sm *sm, void *priv,
208 struct eap_method_ret *ret,
209 const struct wpabuf *reqData)
216 struct eap_tls_data *data = priv;
219 pos = eap_peer_tls_process_init(sm, &data->ssl, data->eap_type, ret,
220 reqData, &left, &flags);
223 id = eap_get_id(reqData);
225 if (flags & EAP_TLS_FLAGS_START) {
226 wpa_printf(MSG_DEBUG, "EAP-TLS: Start");
227 left = 0; /* make sure that this frame is empty, even though it
228 * should always be, anyway */
232 wpabuf_set(&msg, pos, left);
233 res = eap_peer_tls_process_helper(sm, &data->ssl, data->eap_type, 0,
237 return eap_tls_failure(sm, data, ret, res, resp, id);
240 if (tls_connection_established(data->ssl_ctx, data->ssl.conn))
241 eap_tls_success(sm, data, ret);
245 return eap_peer_tls_build_ack(id, data->eap_type, 0);
252 static Boolean eap_tls_has_reauth_data(struct eap_sm *sm, void *priv)
254 struct eap_tls_data *data = priv;
255 return tls_connection_established(data->ssl_ctx, data->ssl.conn);
259 static void eap_tls_deinit_for_reauth(struct eap_sm *sm, void *priv)
264 static void * eap_tls_init_for_reauth(struct eap_sm *sm, void *priv)
266 struct eap_tls_data *data = priv;
267 eap_tls_free_key(data);
268 os_free(data->session_id);
269 data->session_id = NULL;
270 if (eap_peer_tls_reauth_init(sm, &data->ssl)) {
278 static int eap_tls_get_status(struct eap_sm *sm, void *priv, char *buf,
279 size_t buflen, int verbose)
281 struct eap_tls_data *data = priv;
282 return eap_peer_tls_status(sm, &data->ssl, buf, buflen, verbose);
286 static Boolean eap_tls_isKeyAvailable(struct eap_sm *sm, void *priv)
288 struct eap_tls_data *data = priv;
289 return data->key_data != NULL;
293 static u8 * eap_tls_getKey(struct eap_sm *sm, void *priv, size_t *len)
295 struct eap_tls_data *data = priv;
298 if (data->key_data == NULL)
301 key = os_malloc(EAP_TLS_KEY_LEN);
305 *len = EAP_TLS_KEY_LEN;
306 os_memcpy(key, data->key_data, EAP_TLS_KEY_LEN);
312 static u8 * eap_tls_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
314 struct eap_tls_data *data = priv;
317 if (data->key_data == NULL)
320 key = os_malloc(EAP_EMSK_LEN);
325 os_memcpy(key, data->key_data + EAP_TLS_KEY_LEN, EAP_EMSK_LEN);
331 static u8 * eap_tls_get_session_id(struct eap_sm *sm, void *priv, size_t *len)
333 struct eap_tls_data *data = priv;
336 if (data->session_id == NULL)
339 id = os_malloc(data->id_len);
344 os_memcpy(id, data->session_id, data->id_len);
350 int eap_peer_tls_register(void)
352 struct eap_method *eap;
355 eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
356 EAP_VENDOR_IETF, EAP_TYPE_TLS, "TLS");
360 eap->init = eap_tls_init;
361 eap->deinit = eap_tls_deinit;
362 eap->process = eap_tls_process;
363 eap->isKeyAvailable = eap_tls_isKeyAvailable;
364 eap->getKey = eap_tls_getKey;
365 eap->getSessionId = eap_tls_get_session_id;
366 eap->get_status = eap_tls_get_status;
367 eap->has_reauth_data = eap_tls_has_reauth_data;
368 eap->deinit_for_reauth = eap_tls_deinit_for_reauth;
369 eap->init_for_reauth = eap_tls_init_for_reauth;
370 eap->get_emsk = eap_tls_get_emsk;
372 ret = eap_peer_method_register(eap);
374 eap_peer_method_free(eap);
379 #ifdef EAP_UNAUTH_TLS
380 int eap_peer_unauth_tls_register(void)
382 struct eap_method *eap;
385 eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
386 EAP_VENDOR_UNAUTH_TLS,
387 EAP_VENDOR_TYPE_UNAUTH_TLS, "UNAUTH-TLS");
391 eap->init = eap_unauth_tls_init;
392 eap->deinit = eap_tls_deinit;
393 eap->process = eap_tls_process;
394 eap->isKeyAvailable = eap_tls_isKeyAvailable;
395 eap->getKey = eap_tls_getKey;
396 eap->get_status = eap_tls_get_status;
397 eap->has_reauth_data = eap_tls_has_reauth_data;
398 eap->deinit_for_reauth = eap_tls_deinit_for_reauth;
399 eap->init_for_reauth = eap_tls_init_for_reauth;
400 eap->get_emsk = eap_tls_get_emsk;
402 ret = eap_peer_method_register(eap);
404 eap_peer_method_free(eap);
407 #endif /* EAP_UNAUTH_TLS */
411 int eap_peer_wfa_unauth_tls_register(void)
413 struct eap_method *eap;
416 eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
418 EAP_VENDOR_WFA_UNAUTH_TLS,
423 eap->init = eap_wfa_unauth_tls_init;
424 eap->deinit = eap_tls_deinit;
425 eap->process = eap_tls_process;
426 eap->isKeyAvailable = eap_tls_isKeyAvailable;
427 eap->getKey = eap_tls_getKey;
428 eap->get_status = eap_tls_get_status;
429 eap->has_reauth_data = eap_tls_has_reauth_data;
430 eap->deinit_for_reauth = eap_tls_deinit_for_reauth;
431 eap->init_for_reauth = eap_tls_init_for_reauth;
432 eap->get_emsk = eap_tls_get_emsk;
434 ret = eap_peer_method_register(eap);
436 eap_peer_method_free(eap);
439 #endif /* CONFIG_HS20 */