contrib/wpa/src/eap_server/eap_server_tls_common.c

   1 /*
   2  * EAP-TLS/PEAP/TTLS/FAST server common functions
   3  * Copyright (c) 2004-2009, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #include "common.h"
  12 #include "crypto/sha1.h"
  13 #include "crypto/tls.h"
  14 #include "eap_i.h"
  15 #include "eap_tls_common.h"
  16
  17
  18 static void eap_server_tls_free_in_buf(struct eap_ssl_data *data);
  19
  20
  21 struct wpabuf * eap_tls_msg_alloc(EapType type, size_t payload_len,
  22                                   u8 code, u8 identifier)
  23 {
  24         if (type == EAP_UNAUTH_TLS_TYPE)
  25                 return eap_msg_alloc(EAP_VENDOR_UNAUTH_TLS,
  26                                      EAP_VENDOR_TYPE_UNAUTH_TLS, payload_len,
  27                                      code, identifier);
  28         else if (type == EAP_WFA_UNAUTH_TLS_TYPE)
  29                 return eap_msg_alloc(EAP_VENDOR_WFA_NEW,
  30                                      EAP_VENDOR_WFA_UNAUTH_TLS, payload_len,
  31                                      code, identifier);
  32         return eap_msg_alloc(EAP_VENDOR_IETF, type, payload_len, code,
  33                              identifier);
  34 }
  35
  36
  37 #ifdef CONFIG_TLS_INTERNAL
  38 static void eap_server_tls_log_cb(void *ctx, const char *msg)
  39 {
  40         struct eap_sm *sm = ctx;
  41         eap_log_msg(sm, "TLS: %s", msg);
  42 }
  43 #endif /* CONFIG_TLS_INTERNAL */
  44
  45
  46 int eap_server_tls_ssl_init(struct eap_sm *sm, struct eap_ssl_data *data,
  47                             int verify_peer, int eap_type)
  48 {
  49         u8 session_ctx[8];
  50         unsigned int flags = sm->tls_flags;
  51
  52         if (sm->ssl_ctx == NULL) {
  53                 wpa_printf(MSG_ERROR, "TLS context not initialized - cannot use TLS-based EAP method");
  54                 return -1;
  55         }
  56
  57         data->eap = sm;
  58         data->phase2 = sm->init_phase2;
  59
  60         data->conn = tls_connection_init(sm->ssl_ctx);
  61         if (data->conn == NULL) {
  62                 wpa_printf(MSG_INFO, "SSL: Failed to initialize new TLS "
  63                            "connection");
  64                 return -1;
  65         }
  66
  67 #ifdef CONFIG_TLS_INTERNAL
  68         tls_connection_set_log_cb(data->conn, eap_server_tls_log_cb, sm);
  69 #ifdef CONFIG_TESTING_OPTIONS
  70         tls_connection_set_test_flags(data->conn, sm->tls_test_flags);
  71 #endif /* CONFIG_TESTING_OPTIONS */
  72 #endif /* CONFIG_TLS_INTERNAL */
  73
  74         if (eap_type != EAP_TYPE_FAST)
  75                 flags |= TLS_CONN_DISABLE_SESSION_TICKET;
  76         os_memcpy(session_ctx, "hostapd", 7);
  77         session_ctx[7] = (u8) eap_type;
  78         if (tls_connection_set_verify(sm->ssl_ctx, data->conn, verify_peer,
  79                                       flags, session_ctx,
  80                                       sizeof(session_ctx))) {
  81                 wpa_printf(MSG_INFO, "SSL: Failed to configure verification "
  82                            "of TLS peer certificate");
  83                 tls_connection_deinit(sm->ssl_ctx, data->conn);
  84                 data->conn = NULL;
  85                 return -1;
  86         }
  87
  88         data->tls_out_limit = sm->fragment_size > 0 ? sm->fragment_size : 1398;
  89         if (data->phase2) {
  90                 /* Limit the fragment size in the inner TLS authentication
  91                  * since the outer authentication with EAP-PEAP does not yet
  92                  * support fragmentation */
  93                 if (data->tls_out_limit > 100)
  94                         data->tls_out_limit -= 100;
  95         }
  96         return 0;
  97 }
  98
  99
 100 void eap_server_tls_ssl_deinit(struct eap_sm *sm, struct eap_ssl_data *data)
 101 {
 102         tls_connection_deinit(sm->ssl_ctx, data->conn);
 103         eap_server_tls_free_in_buf(data);
 104         wpabuf_free(data->tls_out);
 105         data->tls_out = NULL;
 106 }
 107
 108
 109 u8 * eap_server_tls_derive_key(struct eap_sm *sm, struct eap_ssl_data *data,
 110                                const char *label, const u8 *context,
 111                                size_t context_len, size_t len)
 112 {
 113         u8 *out;
 114
 115         out = os_malloc(len);
 116         if (out == NULL)
 117                 return NULL;
 118
 119         if (tls_connection_export_key(sm->ssl_ctx, data->conn, label,
 120                                       context, context_len, out, len)) {
 121                 os_free(out);
 122                 return NULL;
 123         }
 124
 125         return out;
 126 }
 127
 128
 129 /**
 130  * eap_server_tls_derive_session_id - Derive a Session-Id based on TLS data
 131  * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
 132  * @data: Data for TLS processing
 133  * @eap_type: EAP method used in Phase 1 (EAP_TYPE_TLS/PEAP/TTLS/FAST)
 134  * @len: Pointer to length of the session ID generated
 135  * Returns: Pointer to allocated Session-Id on success or %NULL on failure
 136  *
 137  * This function derive the Session-Id based on the TLS session data
 138  * (client/server random and method type).
 139  *
 140  * The caller is responsible for freeing the returned buffer.
 141  */
 142 u8 * eap_server_tls_derive_session_id(struct eap_sm *sm,
 143                                       struct eap_ssl_data *data, u8 eap_type,
 144                                       size_t *len)
 145 {
 146         struct tls_random keys;
 147         u8 *out;
 148         const u8 context[] = { EAP_TYPE_TLS };
 149
 150         if (eap_type == EAP_TYPE_TLS && data->tls_v13) {
 151                 u8 *id, *method_id;
 152
 153                 /* Session-Id = <EAP-Type> || Method-Id
 154                  * Method-Id = TLS-Exporter("EXPORTER_EAP_TLS_Method-Id",
 155                  *                          Type-Code, 64)
 156                  */
 157                 *len = 1 + 64;
 158                 id = os_malloc(*len);
 159                 if (!id)
 160                         return NULL;
 161                 method_id = eap_server_tls_derive_key(
 162                         sm, data, "EXPORTER_EAP_TLS_Method-Id", context, 1, 64);
 163                 if (!method_id) {
 164                         os_free(id);
 165                         return NULL;
 166                 }
 167                 id[0] = eap_type;
 168                 os_memcpy(id + 1, method_id, 64);
 169                 os_free(method_id);
 170                 return id;
 171         }
 172
 173         if (tls_connection_get_random(sm->ssl_ctx, data->conn, &keys))
 174                 return NULL;
 175
 176         if (keys.client_random == NULL || keys.server_random == NULL)
 177                 return NULL;
 178
 179         *len = 1 + keys.client_random_len + keys.server_random_len;
 180         out = os_malloc(*len);
 181         if (out == NULL)
 182                 return NULL;
 183
 184         /* Session-Id = EAP type || client.random || server.random */
 185         out[0] = eap_type;
 186         os_memcpy(out + 1, keys.client_random, keys.client_random_len);
 187         os_memcpy(out + 1 + keys.client_random_len, keys.server_random,
 188                   keys.server_random_len);
 189
 190         return out;
 191 }
 192
 193
 194 struct wpabuf * eap_server_tls_build_msg(struct eap_ssl_data *data,
 195                                          int eap_type, int version, u8 id)
 196 {
 197         struct wpabuf *req;
 198         u8 flags;
 199         size_t send_len, plen;
 200
 201         wpa_printf(MSG_DEBUG, "SSL: Generating Request");
 202         if (data->tls_out == NULL) {
 203                 wpa_printf(MSG_ERROR, "SSL: tls_out NULL in %s", __func__);
 204                 return NULL;
 205         }
 206
 207         flags = version;
 208         send_len = wpabuf_len(data->tls_out) - data->tls_out_pos;
 209         if (1 + send_len > data->tls_out_limit) {
 210                 send_len = data->tls_out_limit - 1;
 211                 flags |= EAP_TLS_FLAGS_MORE_FRAGMENTS;
 212                 if (data->tls_out_pos == 0) {
 213                         flags |= EAP_TLS_FLAGS_LENGTH_INCLUDED;
 214                         send_len -= 4;
 215                 }
 216         }
 217
 218         plen = 1 + send_len;
 219         if (flags & EAP_TLS_FLAGS_LENGTH_INCLUDED)
 220                 plen += 4;
 221
 222         req = eap_tls_msg_alloc(eap_type, plen, EAP_CODE_REQUEST, id);
 223         if (req == NULL)
 224                 return NULL;
 225
 226         wpabuf_put_u8(req, flags); /* Flags */
 227         if (flags & EAP_TLS_FLAGS_LENGTH_INCLUDED)
 228                 wpabuf_put_be32(req, wpabuf_len(data->tls_out));
 229
 230         wpabuf_put_data(req, wpabuf_head_u8(data->tls_out) + data->tls_out_pos,
 231                         send_len);
 232         data->tls_out_pos += send_len;
 233
 234         if (data->tls_out_pos == wpabuf_len(data->tls_out)) {
 235                 wpa_printf(MSG_DEBUG, "SSL: Sending out %lu bytes "
 236                            "(message sent completely)",
 237                            (unsigned long) send_len);
 238                 wpabuf_free(data->tls_out);
 239                 data->tls_out = NULL;
 240                 data->tls_out_pos = 0;
 241                 data->state = MSG;
 242         } else {
 243                 wpa_printf(MSG_DEBUG, "SSL: Sending out %lu bytes "
 244                            "(%lu more to send)", (unsigned long) send_len,
 245                            (unsigned long) wpabuf_len(data->tls_out) -
 246                            data->tls_out_pos);
 247                 data->state = WAIT_FRAG_ACK;
 248         }
 249
 250         return req;
 251 }
 252
 253
 254 struct wpabuf * eap_server_tls_build_ack(u8 id, int eap_type, int version)
 255 {
 256         struct wpabuf *req;
 257
 258         req = eap_tls_msg_alloc(eap_type, 1, EAP_CODE_REQUEST, id);
 259         if (req == NULL)
 260                 return NULL;
 261         wpa_printf(MSG_DEBUG, "SSL: Building ACK");
 262         wpabuf_put_u8(req, version); /* Flags */
 263         return req;
 264 }
 265
 266
 267 static int eap_server_tls_process_cont(struct eap_ssl_data *data,
 268                                        const u8 *buf, size_t len)
 269 {
 270         /* Process continuation of a pending message */
 271         if (len > wpabuf_tailroom(data->tls_in)) {
 272                 wpa_printf(MSG_DEBUG, "SSL: Fragment overflow");
 273                 return -1;
 274         }
 275
 276         wpabuf_put_data(data->tls_in, buf, len);
 277         wpa_printf(MSG_DEBUG, "SSL: Received %lu bytes, waiting for %lu "
 278                    "bytes more", (unsigned long) len,
 279                    (unsigned long) wpabuf_tailroom(data->tls_in));
 280
 281         return 0;
 282 }
 283
 284
 285 static int eap_server_tls_process_fragment(struct eap_ssl_data *data,
 286                                            u8 flags, u32 message_length,
 287                                            const u8 *buf, size_t len)
 288 {
 289         /* Process a fragment that is not the last one of the message */
 290         if (data->tls_in == NULL && !(flags & EAP_TLS_FLAGS_LENGTH_INCLUDED)) {
 291                 wpa_printf(MSG_DEBUG, "SSL: No Message Length field in a "
 292                            "fragmented packet");
 293                 return -1;
 294         }
 295
 296         if (data->tls_in == NULL) {
 297                 /* First fragment of the message */
 298
 299                 /* Limit length to avoid rogue peers from causing large
 300                  * memory allocations. */
 301                 if (message_length > 65536) {
 302                         wpa_printf(MSG_INFO, "SSL: Too long TLS fragment (size"
 303                                    " over 64 kB)");
 304                         return -1;
 305                 }
 306
 307                 if (len > message_length) {
 308                         wpa_printf(MSG_INFO, "SSL: Too much data (%d bytes) in "
 309                                    "first fragment of frame (TLS Message "
 310                                    "Length %d bytes)",
 311                                    (int) len, (int) message_length);
 312                         return -1;
 313                 }
 314
 315                 data->tls_in = wpabuf_alloc(message_length);
 316                 if (data->tls_in == NULL) {
 317                         wpa_printf(MSG_DEBUG, "SSL: No memory for message");
 318                         return -1;
 319                 }
 320                 wpabuf_put_data(data->tls_in, buf, len);
 321                 wpa_printf(MSG_DEBUG, "SSL: Received %lu bytes in first "
 322                            "fragment, waiting for %lu bytes more",
 323                            (unsigned long) len,
 324                            (unsigned long) wpabuf_tailroom(data->tls_in));
 325         }
 326
 327         return 0;
 328 }
 329
 330
 331 int eap_server_tls_phase1(struct eap_sm *sm, struct eap_ssl_data *data)
 332 {
 333         char buf[20];
 334
 335         if (data->tls_out) {
 336                 /* This should not happen.. */
 337                 wpa_printf(MSG_INFO, "SSL: pending tls_out data when "
 338                            "processing new message");
 339                 wpabuf_free(data->tls_out);
 340                 WPA_ASSERT(data->tls_out == NULL);
 341         }
 342
 343         data->tls_out = tls_connection_server_handshake(sm->ssl_ctx,
 344                                                         data->conn,
 345                                                         data->tls_in, NULL);
 346         if (data->tls_out == NULL) {
 347                 wpa_printf(MSG_INFO, "SSL: TLS processing failed");
 348                 return -1;
 349         }
 350         if (tls_connection_get_failed(sm->ssl_ctx, data->conn)) {
 351                 /* TLS processing has failed - return error */
 352                 wpa_printf(MSG_DEBUG, "SSL: Failed - tls_out available to "
 353                            "report error");
 354                 return -1;
 355         }
 356
 357         if (tls_get_version(sm->ssl_ctx, data->conn, buf, sizeof(buf)) == 0) {
 358                 wpa_printf(MSG_DEBUG, "SSL: Using TLS version %s", buf);
 359                 data->tls_v13 = os_strcmp(buf, "TLSv1.3") == 0;
 360         }
 361
 362         if (!sm->serial_num &&
 363             tls_connection_established(sm->ssl_ctx, data->conn))
 364                 sm->serial_num = tls_connection_peer_serial_num(sm->ssl_ctx,
 365                                                                 data->conn);
 366
 367         return 0;
 368 }
 369
 370
 371 static int eap_server_tls_reassemble(struct eap_ssl_data *data, u8 flags,
 372                                      const u8 **pos, size_t *left)
 373 {
 374         unsigned int tls_msg_len = 0;
 375         const u8 *end = *pos + *left;
 376
 377         wpa_hexdump(MSG_MSGDUMP, "SSL: Received data", *pos, *left);
 378
 379         if (flags & EAP_TLS_FLAGS_LENGTH_INCLUDED) {
 380                 if (*left < 4) {
 381                         wpa_printf(MSG_INFO, "SSL: Short frame with TLS "
 382                                    "length");
 383                         return -1;
 384                 }
 385                 tls_msg_len = WPA_GET_BE32(*pos);
 386                 wpa_printf(MSG_DEBUG, "SSL: TLS Message Length: %d",
 387                            tls_msg_len);
 388                 *pos += 4;
 389                 *left -= 4;
 390
 391                 if (*left > tls_msg_len) {
 392                         wpa_printf(MSG_INFO, "SSL: TLS Message Length (%d "
 393                                    "bytes) smaller than this fragment (%d "
 394                                    "bytes)", (int) tls_msg_len, (int) *left);
 395                         return -1;
 396                 }
 397         }
 398
 399         wpa_printf(MSG_DEBUG, "SSL: Received packet: Flags 0x%x "
 400                    "Message Length %u", flags, tls_msg_len);
 401
 402         if (data->state == WAIT_FRAG_ACK) {
 403                 if (*left != 0) {
 404                         wpa_printf(MSG_DEBUG, "SSL: Unexpected payload in "
 405                                    "WAIT_FRAG_ACK state");
 406                         return -1;
 407                 }
 408                 wpa_printf(MSG_DEBUG, "SSL: Fragment acknowledged");
 409                 return 1;
 410         }
 411
 412         if (data->tls_in &&
 413             eap_server_tls_process_cont(data, *pos, end - *pos) < 0)
 414                 return -1;
 415
 416         if (flags & EAP_TLS_FLAGS_MORE_FRAGMENTS) {
 417                 if (eap_server_tls_process_fragment(data, flags, tls_msg_len,
 418                                                     *pos, end - *pos) < 0)
 419                         return -1;
 420
 421                 data->state = FRAG_ACK;
 422                 return 1;
 423         }
 424
 425         if (data->state == FRAG_ACK) {
 426                 wpa_printf(MSG_DEBUG, "SSL: All fragments received");
 427                 data->state = MSG;
 428         }
 429
 430         if (data->tls_in == NULL) {
 431                 /* Wrap unfragmented messages as wpabuf without extra copy */
 432                 wpabuf_set(&data->tmpbuf, *pos, end - *pos);
 433                 data->tls_in = &data->tmpbuf;
 434         }
 435
 436         return 0;
 437 }
 438
 439
 440 static void eap_server_tls_free_in_buf(struct eap_ssl_data *data)
 441 {
 442         if (data->tls_in != &data->tmpbuf)
 443                 wpabuf_free(data->tls_in);
 444         data->tls_in = NULL;
 445 }
 446
 447
 448 struct wpabuf * eap_server_tls_encrypt(struct eap_sm *sm,
 449                                        struct eap_ssl_data *data,
 450                                        const struct wpabuf *plain)
 451 {
 452         struct wpabuf *buf;
 453
 454         buf = tls_connection_encrypt(sm->ssl_ctx, data->conn,
 455                                      plain);
 456         if (buf == NULL) {
 457                 wpa_printf(MSG_INFO, "SSL: Failed to encrypt Phase 2 data");
 458                 return NULL;
 459         }
 460
 461         return buf;
 462 }
 463
 464
 465 int eap_server_tls_process(struct eap_sm *sm, struct eap_ssl_data *data,
 466                            struct wpabuf *respData, void *priv, int eap_type,
 467                            int (*proc_version)(struct eap_sm *sm, void *priv,
 468                                                int peer_version),
 469                            void (*proc_msg)(struct eap_sm *sm, void *priv,
 470                                             const struct wpabuf *respData))
 471 {
 472         const u8 *pos;
 473         u8 flags;
 474         size_t left;
 475         int ret, res = 0;
 476
 477         if (eap_type == EAP_UNAUTH_TLS_TYPE)
 478                 pos = eap_hdr_validate(EAP_VENDOR_UNAUTH_TLS,
 479                                        EAP_VENDOR_TYPE_UNAUTH_TLS, respData,
 480                                        &left);
 481         else if (eap_type == EAP_WFA_UNAUTH_TLS_TYPE)
 482                 pos = eap_hdr_validate(EAP_VENDOR_WFA_NEW,
 483                                        EAP_VENDOR_WFA_UNAUTH_TLS, respData,
 484                                        &left);
 485         else
 486                 pos = eap_hdr_validate(EAP_VENDOR_IETF, eap_type, respData,
 487                                        &left);
 488         if (pos == NULL || left < 1)
 489                 return 0; /* Should not happen - frame already validated */
 490         flags = *pos++;
 491         left--;
 492         wpa_printf(MSG_DEBUG, "SSL: Received packet(len=%lu) - Flags 0x%02x",
 493                    (unsigned long) wpabuf_len(respData), flags);
 494
 495         if (proc_version &&
 496             proc_version(sm, priv, flags & EAP_TLS_VERSION_MASK) < 0)
 497                 return -1;
 498
 499         ret = eap_server_tls_reassemble(data, flags, &pos, &left);
 500         if (ret < 0) {
 501                 res = -1;
 502                 goto done;
 503         } else if (ret == 1)
 504                 return 0;
 505
 506         if (proc_msg)
 507                 proc_msg(sm, priv, respData);
 508
 509         if (tls_connection_get_write_alerts(sm->ssl_ctx, data->conn) > 1) {
 510                 wpa_printf(MSG_INFO, "SSL: Locally detected fatal error in "
 511                            "TLS processing");
 512                 res = -1;
 513         }
 514
 515 done:
 516         eap_server_tls_free_in_buf(data);
 517
 518         return res;
 519 }