2 * WPA Supplicant / EAP-TLS (RFC 2716)
3 * Copyright (c) 2004-2005, Jouni Malinen <jkmaline@cc.hut.fi>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Alternatively, this software may be distributed under the terms of BSD
12 * See README and COPYING for more details.
21 #include "eap_tls_common.h"
22 #include "wpa_supplicant.h"
23 #include "config_ssid.h"
27 static void eap_tls_deinit(struct eap_sm *sm, void *priv);
31 struct eap_ssl_data ssl;
36 static void * eap_tls_init(struct eap_sm *sm)
38 struct eap_tls_data *data;
39 struct wpa_ssid *config = eap_get_config(sm);
41 ((sm->init_phase2 ? config->private_key2 : config->private_key)
42 == NULL && config->engine == 0)) {
43 wpa_printf(MSG_INFO, "EAP-TLS: Private key not configured");
47 data = malloc(sizeof(*data));
50 memset(data, 0, sizeof(*data));
52 if (eap_tls_ssl_init(sm, &data->ssl, config)) {
53 wpa_printf(MSG_INFO, "EAP-TLS: Failed to initialize SSL.");
54 eap_tls_deinit(sm, data);
56 wpa_printf(MSG_DEBUG, "EAP-TLS: Requesting Smartcard "
58 eap_sm_request_pin(sm, config);
60 } else if (config->private_key && !config->private_key_passwd)
62 wpa_printf(MSG_DEBUG, "EAP-TLS: Requesting private "
64 eap_sm_request_passphrase(sm, config);
74 static void eap_tls_deinit(struct eap_sm *sm, void *priv)
76 struct eap_tls_data *data = priv;
79 eap_tls_ssl_deinit(sm, &data->ssl);
85 static u8 * eap_tls_process(struct eap_sm *sm, void *priv,
86 struct eap_method_ret *ret,
87 const u8 *reqData, size_t reqDataLen,
90 struct wpa_ssid *config = eap_get_config(sm);
91 const struct eap_hdr *req;
96 struct eap_tls_data *data = priv;
98 pos = eap_tls_process_init(sm, &data->ssl, EAP_TYPE_TLS, ret,
99 reqData, reqDataLen, &left, &flags);
102 req = (const struct eap_hdr *) reqData;
103 id = req->identifier;
105 if (flags & EAP_TLS_FLAGS_START) {
106 wpa_printf(MSG_DEBUG, "EAP-TLS: Start");
107 left = 0; /* make sure that this frame is empty, even though it
108 * should always be, anyway */
112 res = eap_tls_process_helper(sm, &data->ssl, EAP_TYPE_TLS, 0, id, pos,
113 left, &resp, respDataLen);
116 wpa_printf(MSG_DEBUG, "EAP-TLS: TLS processing failed");
117 ret->methodState = METHOD_MAY_CONT;
118 ret->decision = DECISION_FAIL;
120 /* This is likely an alert message, so send it instead
121 * of just ACKing the error. */
124 return eap_tls_build_ack(&data->ssl, respDataLen, id,
128 if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) {
129 wpa_printf(MSG_DEBUG, "EAP-TLS: Done");
130 ret->methodState = METHOD_DONE;
131 ret->decision = DECISION_UNCOND_SUCC;
132 free(data->key_data);
133 data->key_data = eap_tls_derive_key(sm, &data->ssl,
134 "client EAP encryption",
136 if (data->key_data) {
137 wpa_hexdump_key(MSG_DEBUG, "EAP-TLS: Derived key",
138 data->key_data, EAP_TLS_KEY_LEN);
140 wpa_printf(MSG_DEBUG, "EAP-TLS: Failed to derive key");
145 return eap_tls_build_ack(&data->ssl, respDataLen, id,
150 /* The TLS handshake failed. So better forget the old PIN.
151 * It may be wrong, we can't be sure but trying the wrong one
152 * again might block it on the card - so better ask the user
162 static Boolean eap_tls_has_reauth_data(struct eap_sm *sm, void *priv)
164 struct eap_tls_data *data = priv;
165 return tls_connection_established(sm->ssl_ctx, data->ssl.conn);
169 static void eap_tls_deinit_for_reauth(struct eap_sm *sm, void *priv)
174 static void * eap_tls_init_for_reauth(struct eap_sm *sm, void *priv)
176 struct eap_tls_data *data = priv;
177 free(data->key_data);
178 data->key_data = NULL;
179 if (eap_tls_reauth_init(sm, &data->ssl)) {
187 static int eap_tls_get_status(struct eap_sm *sm, void *priv, char *buf,
188 size_t buflen, int verbose)
190 struct eap_tls_data *data = priv;
191 return eap_tls_status(sm, &data->ssl, buf, buflen, verbose);
195 static Boolean eap_tls_isKeyAvailable(struct eap_sm *sm, void *priv)
197 struct eap_tls_data *data = priv;
198 return data->key_data != NULL;
202 static u8 * eap_tls_getKey(struct eap_sm *sm, void *priv, size_t *len)
204 struct eap_tls_data *data = priv;
207 if (data->key_data == NULL)
210 key = malloc(EAP_TLS_KEY_LEN);
214 *len = EAP_TLS_KEY_LEN;
215 memcpy(key, data->key_data, EAP_TLS_KEY_LEN);
221 const struct eap_method eap_method_tls =
223 .method = EAP_TYPE_TLS,
225 .init = eap_tls_init,
226 .deinit = eap_tls_deinit,
227 .process = eap_tls_process,
228 .isKeyAvailable = eap_tls_isKeyAvailable,
229 .getKey = eap_tls_getKey,
230 .get_status = eap_tls_get_status,
231 .has_reauth_data = eap_tls_has_reauth_data,
232 .deinit_for_reauth = eap_tls_deinit_for_reauth,
233 .init_for_reauth = eap_tls_init_for_reauth,