src/crypto/tls_openssl.c

   1 /*
   2  * SSL/TLS interface functions for OpenSSL
   3  * Copyright (c) 2004-2015, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #ifndef CONFIG_SMARTCARD
  12 #ifndef OPENSSL_NO_ENGINE
  13 #ifndef ANDROID
  14 #define OPENSSL_NO_ENGINE
  15 #endif
  16 #endif
  17 #endif
  18
  19 #include <openssl/ssl.h>
  20 #include <openssl/err.h>
  21 #include <openssl/opensslv.h>
  22 #include <openssl/pkcs12.h>
  23 #include <openssl/x509v3.h>
  24 #ifndef OPENSSL_NO_ENGINE
  25 #include <openssl/engine.h>
  26 #endif /* OPENSSL_NO_ENGINE */
  27 #ifndef OPENSSL_NO_DSA
  28 #include <openssl/dsa.h>
  29 #endif
  30 #ifndef OPENSSL_NO_DH
  31 #include <openssl/dh.h>
  32 #endif
  33
  34 #include "common.h"
  35 #include "crypto.h"
  36 #include "sha1.h"
  37 #include "sha256.h"
  38 #include "tls.h"
  39 #include "tls_openssl.h"
  40
  41 #if !defined(CONFIG_FIPS) &&                             \
  42     (defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) ||   \
  43      defined(EAP_SERVER_FAST))
  44 #define OPENSSL_NEED_EAP_FAST_PRF
  45 #endif
  46
  47 #if defined(OPENSSL_IS_BORINGSSL)
  48 /* stack_index_t is the return type of OpenSSL's sk_XXX_num() functions. */
  49 typedef size_t stack_index_t;
  50 #else
  51 typedef int stack_index_t;
  52 #endif
  53
  54 #ifdef SSL_set_tlsext_status_type
  55 #ifndef OPENSSL_NO_TLSEXT
  56 #define HAVE_OCSP
  57 #include <openssl/ocsp.h>
  58 #endif /* OPENSSL_NO_TLSEXT */
  59 #endif /* SSL_set_tlsext_status_type */
  60
  61 #if (OPENSSL_VERSION_NUMBER < 0x10100000L || \
  62      (defined(LIBRESSL_VERSION_NUMBER) && \
  63       LIBRESSL_VERSION_NUMBER < 0x20700000L)) && \
  64     !defined(BORINGSSL_API_VERSION)
  65 /*
  66  * SSL_get_client_random() and SSL_get_server_random() were added in OpenSSL
  67  * 1.1.0 and newer BoringSSL revisions. Provide compatibility wrappers for
  68  * older versions.
  69  */
  70
  71 static size_t SSL_get_client_random(const SSL *ssl, unsigned char *out,
  72                                     size_t outlen)
  73 {
  74         if (!ssl->s3 || outlen < SSL3_RANDOM_SIZE)
  75                 return 0;
  76         os_memcpy(out, ssl->s3->client_random, SSL3_RANDOM_SIZE);
  77         return SSL3_RANDOM_SIZE;
  78 }
  79
  80
  81 static size_t SSL_get_server_random(const SSL *ssl, unsigned char *out,
  82                                     size_t outlen)
  83 {
  84         if (!ssl->s3 || outlen < SSL3_RANDOM_SIZE)
  85                 return 0;
  86         os_memcpy(out, ssl->s3->server_random, SSL3_RANDOM_SIZE);
  87         return SSL3_RANDOM_SIZE;
  88 }
  89
  90
  91 #ifdef OPENSSL_NEED_EAP_FAST_PRF
  92 static size_t SSL_SESSION_get_master_key(const SSL_SESSION *session,
  93                                          unsigned char *out, size_t outlen)
  94 {
  95         if (!session || session->master_key_length < 0 ||
  96             (size_t) session->master_key_length > outlen)
  97                 return 0;
  98         if ((size_t) session->master_key_length < outlen)
  99                 outlen = session->master_key_length;
 100         os_memcpy(out, session->master_key, outlen);
 101         return outlen;
 102 }
 103 #endif /* OPENSSL_NEED_EAP_FAST_PRF */
 104
 105 #endif
 106
 107 #if OPENSSL_VERSION_NUMBER < 0x10100000L
 108 #ifdef CONFIG_SUITEB
 109 static int RSA_bits(const RSA *r)
 110 {
 111         return BN_num_bits(r->n);
 112 }
 113 #endif /* CONFIG_SUITEB */
 114
 115
 116 static const unsigned char * ASN1_STRING_get0_data(const ASN1_STRING *x)
 117 {
 118         return ASN1_STRING_data((ASN1_STRING *) x);
 119 }
 120 #endif
 121
 122 #ifdef ANDROID
 123 #include <openssl/pem.h>
 124 #include <keystore/keystore_get.h>
 125
 126 static BIO * BIO_from_keystore(const char *key)
 127 {
 128         BIO *bio = NULL;
 129         uint8_t *value = NULL;
 130         int length = keystore_get(key, strlen(key), &value);
 131         if (length != -1 && (bio = BIO_new(BIO_s_mem())) != NULL)
 132                 BIO_write(bio, value, length);
 133         free(value);
 134         return bio;
 135 }
 136
 137
 138 static int tls_add_ca_from_keystore(X509_STORE *ctx, const char *key_alias)
 139 {
 140         BIO *bio = BIO_from_keystore(key_alias);
 141         STACK_OF(X509_INFO) *stack = NULL;
 142         stack_index_t i;
 143
 144         if (bio) {
 145                 stack = PEM_X509_INFO_read_bio(bio, NULL, NULL, NULL);
 146                 BIO_free(bio);
 147         }
 148
 149         if (!stack) {
 150                 wpa_printf(MSG_WARNING, "TLS: Failed to parse certificate: %s",
 151                            key_alias);
 152                 return -1;
 153         }
 154
 155         for (i = 0; i < sk_X509_INFO_num(stack); ++i) {
 156                 X509_INFO *info = sk_X509_INFO_value(stack, i);
 157
 158                 if (info->x509)
 159                         X509_STORE_add_cert(ctx, info->x509);
 160                 if (info->crl)
 161                         X509_STORE_add_crl(ctx, info->crl);
 162         }
 163
 164         sk_X509_INFO_pop_free(stack, X509_INFO_free);
 165
 166         return 0;
 167 }
 168
 169
 170 static int tls_add_ca_from_keystore_encoded(X509_STORE *ctx,
 171                                             const char *encoded_key_alias)
 172 {
 173         int rc = -1;
 174         int len = os_strlen(encoded_key_alias);
 175         unsigned char *decoded_alias;
 176
 177         if (len & 1) {
 178                 wpa_printf(MSG_WARNING, "Invalid hex-encoded alias: %s",
 179                            encoded_key_alias);
 180                 return rc;
 181         }
 182
 183         decoded_alias = os_malloc(len / 2 + 1);
 184         if (decoded_alias) {
 185                 if (!hexstr2bin(encoded_key_alias, decoded_alias, len / 2)) {
 186                         decoded_alias[len / 2] = '\0';
 187                         rc = tls_add_ca_from_keystore(
 188                                 ctx, (const char *) decoded_alias);
 189                 }
 190                 os_free(decoded_alias);
 191         }
 192
 193         return rc;
 194 }
 195
 196 #endif /* ANDROID */
 197
 198 static int tls_openssl_ref_count = 0;
 199 static int tls_ex_idx_session = -1;
 200
 201 struct tls_context {
 202         void (*event_cb)(void *ctx, enum tls_event ev,
 203                          union tls_event_data *data);
 204         void *cb_ctx;
 205         int cert_in_cb;
 206         char *ocsp_stapling_response;
 207 };
 208
 209 static struct tls_context *tls_global = NULL;
 210
 211
 212 struct tls_data {
 213         SSL_CTX *ssl;
 214         unsigned int tls_session_lifetime;
 215 };
 216
 217 struct tls_connection {
 218         struct tls_context *context;
 219         SSL_CTX *ssl_ctx;
 220         SSL *ssl;
 221         BIO *ssl_in, *ssl_out;
 222 #if defined(ANDROID) || !defined(OPENSSL_NO_ENGINE)
 223         ENGINE *engine;        /* functional reference to the engine */
 224         EVP_PKEY *private_key; /* the private key if using engine */
 225 #endif /* OPENSSL_NO_ENGINE */
 226         char *subject_match, *altsubject_match, *suffix_match, *domain_match;
 227         int read_alerts, write_alerts, failed;
 228
 229         tls_session_ticket_cb session_ticket_cb;
 230         void *session_ticket_cb_ctx;
 231
 232         /* SessionTicket received from OpenSSL hello_extension_cb (server) */
 233         u8 *session_ticket;
 234         size_t session_ticket_len;
 235
 236         unsigned int ca_cert_verify:1;
 237         unsigned int cert_probe:1;
 238         unsigned int server_cert_only:1;
 239         unsigned int invalid_hb_used:1;
 240         unsigned int success_data:1;
 241         unsigned int client_hello_generated:1;
 242         unsigned int server:1;
 243
 244         u8 srv_cert_hash[32];
 245
 246         unsigned int flags;
 247
 248         X509 *peer_cert;
 249         X509 *peer_issuer;
 250         X509 *peer_issuer_issuer;
 251
 252         unsigned char client_random[SSL3_RANDOM_SIZE];
 253         unsigned char server_random[SSL3_RANDOM_SIZE];
 254
 255         u16 cipher_suite;
 256         int server_dh_prime_len;
 257 };
 258
 259
 260 static struct tls_context * tls_context_new(const struct tls_config *conf)
 261 {
 262         struct tls_context *context = os_zalloc(sizeof(*context));
 263         if (context == NULL)
 264                 return NULL;
 265         if (conf) {
 266                 context->event_cb = conf->event_cb;
 267                 context->cb_ctx = conf->cb_ctx;
 268                 context->cert_in_cb = conf->cert_in_cb;
 269         }
 270         return context;
 271 }
 272
 273
 274 #ifdef CONFIG_NO_STDOUT_DEBUG
 275
 276 static void _tls_show_errors(void)
 277 {
 278         unsigned long err;
 279
 280         while ((err = ERR_get_error())) {
 281                 /* Just ignore the errors, since stdout is disabled */
 282         }
 283 }
 284 #define tls_show_errors(l, f, t) _tls_show_errors()
 285
 286 #else /* CONFIG_NO_STDOUT_DEBUG */
 287
 288 static void tls_show_errors(int level, const char *func, const char *txt)
 289 {
 290         unsigned long err;
 291
 292         wpa_printf(level, "OpenSSL: %s - %s %s",
 293                    func, txt, ERR_error_string(ERR_get_error(), NULL));
 294
 295         while ((err = ERR_get_error())) {
 296                 wpa_printf(MSG_INFO, "OpenSSL: pending error: %s",
 297                            ERR_error_string(err, NULL));
 298         }
 299 }
 300
 301 #endif /* CONFIG_NO_STDOUT_DEBUG */
 302
 303
 304 #ifdef CONFIG_NATIVE_WINDOWS
 305
 306 /* Windows CryptoAPI and access to certificate stores */
 307 #include <wincrypt.h>
 308
 309 #ifdef __MINGW32_VERSION
 310 /*
 311  * MinGW does not yet include all the needed definitions for CryptoAPI, so
 312  * define here whatever extra is needed.
 313  */
 314 #define CERT_SYSTEM_STORE_CURRENT_USER (1 << 16)
 315 #define CERT_STORE_READONLY_FLAG 0x00008000
 316 #define CERT_STORE_OPEN_EXISTING_FLAG 0x00004000
 317
 318 #endif /* __MINGW32_VERSION */
 319
 320
 321 struct cryptoapi_rsa_data {
 322         const CERT_CONTEXT *cert;
 323         HCRYPTPROV crypt_prov;
 324         DWORD key_spec;
 325         BOOL free_crypt_prov;
 326 };
 327
 328
 329 static void cryptoapi_error(const char *msg)
 330 {
 331         wpa_printf(MSG_INFO, "CryptoAPI: %s; err=%u",
 332                    msg, (unsigned int) GetLastError());
 333 }
 334
 335
 336 static int cryptoapi_rsa_pub_enc(int flen, const unsigned char *from,
 337                                  unsigned char *to, RSA *rsa, int padding)
 338 {
 339         wpa_printf(MSG_DEBUG, "%s - not implemented", __func__);
 340         return 0;
 341 }
 342
 343
 344 static int cryptoapi_rsa_pub_dec(int flen, const unsigned char *from,
 345                                  unsigned char *to, RSA *rsa, int padding)
 346 {
 347         wpa_printf(MSG_DEBUG, "%s - not implemented", __func__);
 348         return 0;
 349 }
 350
 351
 352 static int cryptoapi_rsa_priv_enc(int flen, const unsigned char *from,
 353                                   unsigned char *to, RSA *rsa, int padding)
 354 {
 355         struct cryptoapi_rsa_data *priv =
 356                 (struct cryptoapi_rsa_data *) rsa->meth->app_data;
 357         HCRYPTHASH hash;
 358         DWORD hash_size, len, i;
 359         unsigned char *buf = NULL;
 360         int ret = 0;
 361
 362         if (priv == NULL) {
 363                 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,
 364                        ERR_R_PASSED_NULL_PARAMETER);
 365                 return 0;
 366         }
 367
 368         if (padding != RSA_PKCS1_PADDING) {
 369                 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,
 370                        RSA_R_UNKNOWN_PADDING_TYPE);
 371                 return 0;
 372         }
 373
 374         if (flen != 16 /* MD5 */ + 20 /* SHA-1 */) {
 375                 wpa_printf(MSG_INFO, "%s - only MD5-SHA1 hash supported",
 376                            __func__);
 377                 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,
 378                        RSA_R_INVALID_MESSAGE_LENGTH);
 379                 return 0;
 380         }
 381
 382         if (!CryptCreateHash(priv->crypt_prov, CALG_SSL3_SHAMD5, 0, 0, &hash))
 383         {
 384                 cryptoapi_error("CryptCreateHash failed");
 385                 return 0;
 386         }
 387
 388         len = sizeof(hash_size);
 389         if (!CryptGetHashParam(hash, HP_HASHSIZE, (BYTE *) &hash_size, &len,
 390                                0)) {
 391                 cryptoapi_error("CryptGetHashParam failed");
 392                 goto err;
 393         }
 394
 395         if ((int) hash_size != flen) {
 396                 wpa_printf(MSG_INFO, "CryptoAPI: Invalid hash size (%u != %d)",
 397                            (unsigned) hash_size, flen);
 398                 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT,
 399                        RSA_R_INVALID_MESSAGE_LENGTH);
 400                 goto err;
 401         }
 402         if (!CryptSetHashParam(hash, HP_HASHVAL, (BYTE * ) from, 0)) {
 403                 cryptoapi_error("CryptSetHashParam failed");
 404                 goto err;
 405         }
 406
 407         len = RSA_size(rsa);
 408         buf = os_malloc(len);
 409         if (buf == NULL) {
 410                 RSAerr(RSA_F_RSA_EAY_PRIVATE_ENCRYPT, ERR_R_MALLOC_FAILURE);
 411                 goto err;
 412         }
 413
 414         if (!CryptSignHash(hash, priv->key_spec, NULL, 0, buf, &len)) {
 415                 cryptoapi_error("CryptSignHash failed");
 416                 goto err;
 417         }
 418
 419         for (i = 0; i < len; i++)
 420                 to[i] = buf[len - i - 1];
 421         ret = len;
 422
 423 err:
 424         os_free(buf);
 425         CryptDestroyHash(hash);
 426
 427         return ret;
 428 }
 429
 430
 431 static int cryptoapi_rsa_priv_dec(int flen, const unsigned char *from,
 432                                   unsigned char *to, RSA *rsa, int padding)
 433 {
 434         wpa_printf(MSG_DEBUG, "%s - not implemented", __func__);
 435         return 0;
 436 }
 437
 438
 439 static void cryptoapi_free_data(struct cryptoapi_rsa_data *priv)
 440 {
 441         if (priv == NULL)
 442                 return;
 443         if (priv->crypt_prov && priv->free_crypt_prov)
 444                 CryptReleaseContext(priv->crypt_prov, 0);
 445         if (priv->cert)
 446                 CertFreeCertificateContext(priv->cert);
 447         os_free(priv);
 448 }
 449
 450
 451 static int cryptoapi_finish(RSA *rsa)
 452 {
 453         cryptoapi_free_data((struct cryptoapi_rsa_data *) rsa->meth->app_data);
 454         os_free((void *) rsa->meth);
 455         rsa->meth = NULL;
 456         return 1;
 457 }
 458
 459
 460 static const CERT_CONTEXT * cryptoapi_find_cert(const char *name, DWORD store)
 461 {
 462         HCERTSTORE cs;
 463         const CERT_CONTEXT *ret = NULL;
 464
 465         cs = CertOpenStore((LPCSTR) CERT_STORE_PROV_SYSTEM, 0, 0,
 466                            store | CERT_STORE_OPEN_EXISTING_FLAG |
 467                            CERT_STORE_READONLY_FLAG, L"MY");
 468         if (cs == NULL) {
 469                 cryptoapi_error("Failed to open 'My system store'");
 470                 return NULL;
 471         }
 472
 473         if (strncmp(name, "cert://", 7) == 0) {
 474                 unsigned short wbuf[255];
 475                 MultiByteToWideChar(CP_ACP, 0, name + 7, -1, wbuf, 255);
 476                 ret = CertFindCertificateInStore(cs, X509_ASN_ENCODING |
 477                                                  PKCS_7_ASN_ENCODING,
 478                                                  0, CERT_FIND_SUBJECT_STR,
 479                                                  wbuf, NULL);
 480         } else if (strncmp(name, "hash://", 7) == 0) {
 481                 CRYPT_HASH_BLOB blob;
 482                 int len;
 483                 const char *hash = name + 7;
 484                 unsigned char *buf;
 485
 486                 len = os_strlen(hash) / 2;
 487                 buf = os_malloc(len);
 488                 if (buf && hexstr2bin(hash, buf, len) == 0) {
 489                         blob.cbData = len;
 490                         blob.pbData = buf;
 491                         ret = CertFindCertificateInStore(cs,
 492                                                          X509_ASN_ENCODING |
 493                                                          PKCS_7_ASN_ENCODING,
 494                                                          0, CERT_FIND_HASH,
 495                                                          &blob, NULL);
 496                 }
 497                 os_free(buf);
 498         }
 499
 500         CertCloseStore(cs, 0);
 501
 502         return ret;
 503 }
 504
 505
 506 static int tls_cryptoapi_cert(SSL *ssl, const char *name)
 507 {
 508         X509 *cert = NULL;
 509         RSA *rsa = NULL, *pub_rsa;
 510         struct cryptoapi_rsa_data *priv;
 511         RSA_METHOD *rsa_meth;
 512
 513         if (name == NULL ||
 514             (strncmp(name, "cert://", 7) != 0 &&
 515              strncmp(name, "hash://", 7) != 0))
 516                 return -1;
 517
 518         priv = os_zalloc(sizeof(*priv));
 519         rsa_meth = os_zalloc(sizeof(*rsa_meth));
 520         if (priv == NULL || rsa_meth == NULL) {
 521                 wpa_printf(MSG_WARNING, "CryptoAPI: Failed to allocate memory "
 522                            "for CryptoAPI RSA method");
 523                 os_free(priv);
 524                 os_free(rsa_meth);
 525                 return -1;
 526         }
 527
 528         priv->cert = cryptoapi_find_cert(name, CERT_SYSTEM_STORE_CURRENT_USER);
 529         if (priv->cert == NULL) {
 530                 priv->cert = cryptoapi_find_cert(
 531                         name, CERT_SYSTEM_STORE_LOCAL_MACHINE);
 532         }
 533         if (priv->cert == NULL) {
 534                 wpa_printf(MSG_INFO, "CryptoAPI: Could not find certificate "
 535                            "'%s'", name);
 536                 goto err;
 537         }
 538
 539         cert = d2i_X509(NULL,
 540                         (const unsigned char **) &priv->cert->pbCertEncoded,
 541                         priv->cert->cbCertEncoded);
 542         if (cert == NULL) {
 543                 wpa_printf(MSG_INFO, "CryptoAPI: Could not process X509 DER "
 544                            "encoding");
 545                 goto err;
 546         }
 547
 548         if (!CryptAcquireCertificatePrivateKey(priv->cert,
 549                                                CRYPT_ACQUIRE_COMPARE_KEY_FLAG,
 550                                                NULL, &priv->crypt_prov,
 551                                                &priv->key_spec,
 552                                                &priv->free_crypt_prov)) {
 553                 cryptoapi_error("Failed to acquire a private key for the "
 554                                 "certificate");
 555                 goto err;
 556         }
 557
 558         rsa_meth->name = "Microsoft CryptoAPI RSA Method";
 559         rsa_meth->rsa_pub_enc = cryptoapi_rsa_pub_enc;
 560         rsa_meth->rsa_pub_dec = cryptoapi_rsa_pub_dec;
 561         rsa_meth->rsa_priv_enc = cryptoapi_rsa_priv_enc;
 562         rsa_meth->rsa_priv_dec = cryptoapi_rsa_priv_dec;
 563         rsa_meth->finish = cryptoapi_finish;
 564         rsa_meth->flags = RSA_METHOD_FLAG_NO_CHECK;
 565         rsa_meth->app_data = (char *) priv;
 566
 567         rsa = RSA_new();
 568         if (rsa == NULL) {
 569                 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE,
 570                        ERR_R_MALLOC_FAILURE);
 571                 goto err;
 572         }
 573
 574         if (!SSL_use_certificate(ssl, cert)) {
 575                 RSA_free(rsa);
 576                 rsa = NULL;
 577                 goto err;
 578         }
 579         pub_rsa = cert->cert_info->key->pkey->pkey.rsa;
 580         X509_free(cert);
 581         cert = NULL;
 582
 583         rsa->n = BN_dup(pub_rsa->n);
 584         rsa->e = BN_dup(pub_rsa->e);
 585         if (!RSA_set_method(rsa, rsa_meth))
 586                 goto err;
 587
 588         if (!SSL_use_RSAPrivateKey(ssl, rsa))
 589                 goto err;
 590         RSA_free(rsa);
 591
 592         return 0;
 593
 594 err:
 595         if (cert)
 596                 X509_free(cert);
 597         if (rsa)
 598                 RSA_free(rsa);
 599         else {
 600                 os_free(rsa_meth);
 601                 cryptoapi_free_data(priv);
 602         }
 603         return -1;
 604 }
 605
 606
 607 static int tls_cryptoapi_ca_cert(SSL_CTX *ssl_ctx, SSL *ssl, const char *name)
 608 {
 609         HCERTSTORE cs;
 610         PCCERT_CONTEXT ctx = NULL;
 611         X509 *cert;
 612         char buf[128];
 613         const char *store;
 614 #ifdef UNICODE
 615         WCHAR *wstore;
 616 #endif /* UNICODE */
 617
 618         if (name == NULL || strncmp(name, "cert_store://", 13) != 0)
 619                 return -1;
 620
 621         store = name + 13;
 622 #ifdef UNICODE
 623         wstore = os_malloc((os_strlen(store) + 1) * sizeof(WCHAR));
 624         if (wstore == NULL)
 625                 return -1;
 626         wsprintf(wstore, L"%S", store);
 627         cs = CertOpenSystemStore(0, wstore);
 628         os_free(wstore);
 629 #else /* UNICODE */
 630         cs = CertOpenSystemStore(0, store);
 631 #endif /* UNICODE */
 632         if (cs == NULL) {
 633                 wpa_printf(MSG_DEBUG, "%s: failed to open system cert store "
 634                            "'%s': error=%d", __func__, store,
 635                            (int) GetLastError());
 636                 return -1;
 637         }
 638
 639         while ((ctx = CertEnumCertificatesInStore(cs, ctx))) {
 640                 cert = d2i_X509(NULL,
 641                                 (const unsigned char **) &ctx->pbCertEncoded,
 642                                 ctx->cbCertEncoded);
 643                 if (cert == NULL) {
 644                         wpa_printf(MSG_INFO, "CryptoAPI: Could not process "
 645                                    "X509 DER encoding for CA cert");
 646                         continue;
 647                 }
 648
 649                 X509_NAME_oneline(X509_get_subject_name(cert), buf,
 650                                   sizeof(buf));
 651                 wpa_printf(MSG_DEBUG, "OpenSSL: Loaded CA certificate for "
 652                            "system certificate store: subject='%s'", buf);
 653
 654                 if (!X509_STORE_add_cert(SSL_CTX_get_cert_store(ssl_ctx),
 655                                          cert)) {
 656                         tls_show_errors(MSG_WARNING, __func__,
 657                                         "Failed to add ca_cert to OpenSSL "
 658                                         "certificate store");
 659                 }
 660
 661                 X509_free(cert);
 662         }
 663
 664         if (!CertCloseStore(cs, 0)) {
 665                 wpa_printf(MSG_DEBUG, "%s: failed to close system cert store "
 666                            "'%s': error=%d", __func__, name + 13,
 667                            (int) GetLastError());
 668         }
 669
 670         return 0;
 671 }
 672
 673
 674 #else /* CONFIG_NATIVE_WINDOWS */
 675
 676 static int tls_cryptoapi_cert(SSL *ssl, const char *name)
 677 {
 678         return -1;
 679 }
 680
 681 #endif /* CONFIG_NATIVE_WINDOWS */
 682
 683
 684 static void ssl_info_cb(const SSL *ssl, int where, int ret)
 685 {
 686         const char *str;
 687         int w;
 688
 689         wpa_printf(MSG_DEBUG, "SSL: (where=0x%x ret=0x%x)", where, ret);
 690         w = where & ~SSL_ST_MASK;
 691         if (w & SSL_ST_CONNECT)
 692                 str = "SSL_connect";
 693         else if (w & SSL_ST_ACCEPT)
 694                 str = "SSL_accept";
 695         else
 696                 str = "undefined";
 697
 698         if (where & SSL_CB_LOOP) {
 699                 wpa_printf(MSG_DEBUG, "SSL: %s:%s",
 700                            str, SSL_state_string_long(ssl));
 701         } else if (where & SSL_CB_ALERT) {
 702                 struct tls_connection *conn = SSL_get_app_data((SSL *) ssl);
 703                 wpa_printf(MSG_INFO, "SSL: SSL3 alert: %s:%s:%s",
 704                            where & SSL_CB_READ ?
 705                            "read (remote end reported an error)" :
 706                            "write (local SSL3 detected an error)",
 707                            SSL_alert_type_string_long(ret),
 708                            SSL_alert_desc_string_long(ret));
 709                 if ((ret >> 8) == SSL3_AL_FATAL) {
 710                         if (where & SSL_CB_READ)
 711                                 conn->read_alerts++;
 712                         else
 713                                 conn->write_alerts++;
 714                 }
 715                 if (conn->context->event_cb != NULL) {
 716                         union tls_event_data ev;
 717                         struct tls_context *context = conn->context;
 718                         os_memset(&ev, 0, sizeof(ev));
 719                         ev.alert.is_local = !(where & SSL_CB_READ);
 720                         ev.alert.type = SSL_alert_type_string_long(ret);
 721                         ev.alert.description = SSL_alert_desc_string_long(ret);
 722                         context->event_cb(context->cb_ctx, TLS_ALERT, &ev);
 723                 }
 724         } else if (where & SSL_CB_EXIT && ret <= 0) {
 725                 wpa_printf(MSG_DEBUG, "SSL: %s:%s in %s",
 726                            str, ret == 0 ? "failed" : "error",
 727                            SSL_state_string_long(ssl));
 728         }
 729 }
 730
 731
 732 #ifndef OPENSSL_NO_ENGINE
 733 /**
 734  * tls_engine_load_dynamic_generic - load any openssl engine
 735  * @pre: an array of commands and values that load an engine initialized
 736  *       in the engine specific function
 737  * @post: an array of commands and values that initialize an already loaded
 738  *        engine (or %NULL if not required)
 739  * @id: the engine id of the engine to load (only required if post is not %NULL
 740  *
 741  * This function is a generic function that loads any openssl engine.
 742  *
 743  * Returns: 0 on success, -1 on failure
 744  */
 745 static int tls_engine_load_dynamic_generic(const char *pre[],
 746                                            const char *post[], const char *id)
 747 {
 748         ENGINE *engine;
 749         const char *dynamic_id = "dynamic";
 750
 751         engine = ENGINE_by_id(id);
 752         if (engine) {
 753                 wpa_printf(MSG_DEBUG, "ENGINE: engine '%s' is already "
 754                            "available", id);
 755                 /*
 756                  * If it was auto-loaded by ENGINE_by_id() we might still
 757                  * need to tell it which PKCS#11 module to use in legacy
 758                  * (non-p11-kit) environments. Do so now; even if it was
 759                  * properly initialised before, setting it again will be
 760                  * harmless.
 761                  */
 762                 goto found;
 763         }
 764         ERR_clear_error();
 765
 766         engine = ENGINE_by_id(dynamic_id);
 767         if (engine == NULL) {
 768                 wpa_printf(MSG_INFO, "ENGINE: Can't find engine %s [%s]",
 769                            dynamic_id,
 770                            ERR_error_string(ERR_get_error(), NULL));
 771                 return -1;
 772         }
 773
 774         /* Perform the pre commands. This will load the engine. */
 775         while (pre && pre[0]) {
 776                 wpa_printf(MSG_DEBUG, "ENGINE: '%s' '%s'", pre[0], pre[1]);
 777                 if (ENGINE_ctrl_cmd_string(engine, pre[0], pre[1], 0) == 0) {
 778                         wpa_printf(MSG_INFO, "ENGINE: ctrl cmd_string failed: "
 779                                    "%s %s [%s]", pre[0], pre[1],
 780                                    ERR_error_string(ERR_get_error(), NULL));
 781                         ENGINE_free(engine);
 782                         return -1;
 783                 }
 784                 pre += 2;
 785         }
 786
 787         /*
 788          * Free the reference to the "dynamic" engine. The loaded engine can
 789          * now be looked up using ENGINE_by_id().
 790          */
 791         ENGINE_free(engine);
 792
 793         engine = ENGINE_by_id(id);
 794         if (engine == NULL) {
 795                 wpa_printf(MSG_INFO, "ENGINE: Can't find engine %s [%s]",
 796                            id, ERR_error_string(ERR_get_error(), NULL));
 797                 return -1;
 798         }
 799  found:
 800         while (post && post[0]) {
 801                 wpa_printf(MSG_DEBUG, "ENGINE: '%s' '%s'", post[0], post[1]);
 802                 if (ENGINE_ctrl_cmd_string(engine, post[0], post[1], 0) == 0) {
 803                         wpa_printf(MSG_DEBUG, "ENGINE: ctrl cmd_string failed:"
 804                                 " %s %s [%s]", post[0], post[1],
 805                                    ERR_error_string(ERR_get_error(), NULL));
 806                         ENGINE_remove(engine);
 807                         ENGINE_free(engine);
 808                         return -1;
 809                 }
 810                 post += 2;
 811         }
 812         ENGINE_free(engine);
 813
 814         return 0;
 815 }
 816
 817
 818 /**
 819  * tls_engine_load_dynamic_pkcs11 - load the pkcs11 engine provided by opensc
 820  * @pkcs11_so_path: pksc11_so_path from the configuration
 821  * @pcks11_module_path: pkcs11_module_path from the configuration
 822  */
 823 static int tls_engine_load_dynamic_pkcs11(const char *pkcs11_so_path,
 824                                           const char *pkcs11_module_path)
 825 {
 826         char *engine_id = "pkcs11";
 827         const char *pre_cmd[] = {
 828                 "SO_PATH", NULL /* pkcs11_so_path */,
 829                 "ID", NULL /* engine_id */,
 830                 "LIST_ADD", "1",
 831                 /* "NO_VCHECK", "1", */
 832                 "LOAD", NULL,
 833                 NULL, NULL
 834         };
 835         const char *post_cmd[] = {
 836                 "MODULE_PATH", NULL /* pkcs11_module_path */,
 837                 NULL, NULL
 838         };
 839
 840         if (!pkcs11_so_path)
 841                 return 0;
 842
 843         pre_cmd[1] = pkcs11_so_path;
 844         pre_cmd[3] = engine_id;
 845         if (pkcs11_module_path)
 846                 post_cmd[1] = pkcs11_module_path;
 847         else
 848                 post_cmd[0] = NULL;
 849
 850         wpa_printf(MSG_DEBUG, "ENGINE: Loading pkcs11 Engine from %s",
 851                    pkcs11_so_path);
 852
 853         return tls_engine_load_dynamic_generic(pre_cmd, post_cmd, engine_id);
 854 }
 855
 856
 857 /**
 858  * tls_engine_load_dynamic_opensc - load the opensc engine provided by opensc
 859  * @opensc_so_path: opensc_so_path from the configuration
 860  */
 861 static int tls_engine_load_dynamic_opensc(const char *opensc_so_path)
 862 {
 863         char *engine_id = "opensc";
 864         const char *pre_cmd[] = {
 865                 "SO_PATH", NULL /* opensc_so_path */,
 866                 "ID", NULL /* engine_id */,
 867                 "LIST_ADD", "1",
 868                 "LOAD", NULL,
 869                 NULL, NULL
 870         };
 871
 872         if (!opensc_so_path)
 873                 return 0;
 874
 875         pre_cmd[1] = opensc_so_path;
 876         pre_cmd[3] = engine_id;
 877
 878         wpa_printf(MSG_DEBUG, "ENGINE: Loading OpenSC Engine from %s",
 879                    opensc_so_path);
 880
 881         return tls_engine_load_dynamic_generic(pre_cmd, NULL, engine_id);
 882 }
 883 #endif /* OPENSSL_NO_ENGINE */
 884
 885
 886 static void remove_session_cb(SSL_CTX *ctx, SSL_SESSION *sess)
 887 {
 888         struct wpabuf *buf;
 889
 890         if (tls_ex_idx_session < 0)
 891                 return;
 892         buf = SSL_SESSION_get_ex_data(sess, tls_ex_idx_session);
 893         if (!buf)
 894                 return;
 895         wpa_printf(MSG_DEBUG,
 896                    "OpenSSL: Free application session data %p (sess %p)",
 897                    buf, sess);
 898         wpabuf_free(buf);
 899
 900         SSL_SESSION_set_ex_data(sess, tls_ex_idx_session, NULL);
 901 }
 902
 903
 904 void * tls_init(const struct tls_config *conf)
 905 {
 906         struct tls_data *data;
 907         SSL_CTX *ssl;
 908         struct tls_context *context;
 909         const char *ciphers;
 910
 911         if (tls_openssl_ref_count == 0) {
 912                 tls_global = context = tls_context_new(conf);
 913                 if (context == NULL)
 914                         return NULL;
 915 #ifdef CONFIG_FIPS
 916 #ifdef OPENSSL_FIPS
 917                 if (conf && conf->fips_mode) {
 918                         static int fips_enabled = 0;
 919
 920                         if (!fips_enabled && !FIPS_mode_set(1)) {
 921                                 wpa_printf(MSG_ERROR, "Failed to enable FIPS "
 922                                            "mode");
 923                                 ERR_load_crypto_strings();
 924                                 ERR_print_errors_fp(stderr);
 925                                 os_free(tls_global);
 926                                 tls_global = NULL;
 927                                 return NULL;
 928                         } else {
 929                                 wpa_printf(MSG_INFO, "Running in FIPS mode");
 930                                 fips_enabled = 1;
 931                         }
 932                 }
 933 #else /* OPENSSL_FIPS */
 934                 if (conf && conf->fips_mode) {
 935                         wpa_printf(MSG_ERROR, "FIPS mode requested, but not "
 936                                    "supported");
 937                         os_free(tls_global);
 938                         tls_global = NULL;
 939                         return NULL;
 940                 }
 941 #endif /* OPENSSL_FIPS */
 942 #endif /* CONFIG_FIPS */
 943 #if OPENSSL_VERSION_NUMBER < 0x10100000L || \
 944         (defined(LIBRESSL_VERSION_NUMBER) && \
 945          LIBRESSL_VERSION_NUMBER < 0x20700000L)
 946                 SSL_load_error_strings();
 947                 SSL_library_init();
 948 #ifndef OPENSSL_NO_SHA256
 949                 EVP_add_digest(EVP_sha256());
 950 #endif /* OPENSSL_NO_SHA256 */
 951                 /* TODO: if /dev/urandom is available, PRNG is seeded
 952                  * automatically. If this is not the case, random data should
 953                  * be added here. */
 954
 955 #ifdef PKCS12_FUNCS
 956 #ifndef OPENSSL_NO_RC2
 957                 /*
 958                  * 40-bit RC2 is commonly used in PKCS#12 files, so enable it.
 959                  * This is enabled by PKCS12_PBE_add() in OpenSSL 0.9.8
 960                  * versions, but it looks like OpenSSL 1.0.0 does not do that
 961                  * anymore.
 962                  */
 963                 EVP_add_cipher(EVP_rc2_40_cbc());
 964 #endif /* OPENSSL_NO_RC2 */
 965                 PKCS12_PBE_add();
 966 #endif  /* PKCS12_FUNCS */
 967 #endif /* < 1.1.0 */
 968         } else {
 969                 context = tls_context_new(conf);
 970                 if (context == NULL)
 971                         return NULL;
 972         }
 973         tls_openssl_ref_count++;
 974
 975         data = os_zalloc(sizeof(*data));
 976         if (data)
 977                 ssl = SSL_CTX_new(SSLv23_method());
 978         else
 979                 ssl = NULL;
 980         if (ssl == NULL) {
 981                 tls_openssl_ref_count--;
 982                 if (context != tls_global)
 983                         os_free(context);
 984                 if (tls_openssl_ref_count == 0) {
 985                         os_free(tls_global);
 986                         tls_global = NULL;
 987                 }
 988                 os_free(data);
 989                 return NULL;
 990         }
 991         data->ssl = ssl;
 992         if (conf)
 993                 data->tls_session_lifetime = conf->tls_session_lifetime;
 994
 995         SSL_CTX_set_options(ssl, SSL_OP_NO_SSLv2);
 996         SSL_CTX_set_options(ssl, SSL_OP_NO_SSLv3);
 997
 998 #ifdef SSL_MODE_NO_AUTO_CHAIN
 999         /* Number of deployed use cases assume the default OpenSSL behavior of
1000          * auto chaining the local certificate is in use. BoringSSL removed this
1001          * functionality by default, so we need to restore it here to avoid
1002          * breaking existing use cases. */
1003         SSL_CTX_clear_mode(ssl, SSL_MODE_NO_AUTO_CHAIN);
1004 #endif /* SSL_MODE_NO_AUTO_CHAIN */
1005
1006         SSL_CTX_set_info_callback(ssl, ssl_info_cb);
1007         SSL_CTX_set_app_data(ssl, context);
1008         if (data->tls_session_lifetime > 0) {
1009                 SSL_CTX_set_quiet_shutdown(ssl, 1);
1010                 /*
1011                  * Set default context here. In practice, this will be replaced
1012                  * by the per-EAP method context in tls_connection_set_verify().
1013                  */
1014                 SSL_CTX_set_session_id_context(ssl, (u8 *) "hostapd", 7);
1015                 SSL_CTX_set_session_cache_mode(ssl, SSL_SESS_CACHE_SERVER);
1016                 SSL_CTX_set_timeout(ssl, data->tls_session_lifetime);
1017                 SSL_CTX_sess_set_remove_cb(ssl, remove_session_cb);
1018         } else {
1019                 SSL_CTX_set_session_cache_mode(ssl, SSL_SESS_CACHE_OFF);
1020         }
1021
1022         if (tls_ex_idx_session < 0) {
1023                 tls_ex_idx_session = SSL_SESSION_get_ex_new_index(
1024                         0, NULL, NULL, NULL, NULL);
1025                 if (tls_ex_idx_session < 0) {
1026                         tls_deinit(data);
1027                         return NULL;
1028                 }
1029         }
1030
1031 #ifndef OPENSSL_NO_ENGINE
1032         wpa_printf(MSG_DEBUG, "ENGINE: Loading dynamic engine");
1033 #if OPENSSL_VERSION_NUMBER < 0x10100000L
1034         ERR_load_ENGINE_strings();
1035         ENGINE_load_dynamic();
1036 #endif /* OPENSSL_VERSION_NUMBER */
1037
1038         if (conf &&
1039             (conf->opensc_engine_path || conf->pkcs11_engine_path ||
1040              conf->pkcs11_module_path)) {
1041                 if (tls_engine_load_dynamic_opensc(conf->opensc_engine_path) ||
1042                     tls_engine_load_dynamic_pkcs11(conf->pkcs11_engine_path,
1043                                                    conf->pkcs11_module_path)) {
1044                         tls_deinit(data);
1045                         return NULL;
1046                 }
1047         }
1048 #endif /* OPENSSL_NO_ENGINE */
1049
1050         if (conf && conf->openssl_ciphers)
1051                 ciphers = conf->openssl_ciphers;
1052         else
1053                 ciphers = TLS_DEFAULT_CIPHERS;
1054         if (SSL_CTX_set_cipher_list(ssl, ciphers) != 1) {
1055                 wpa_printf(MSG_ERROR,
1056                            "OpenSSL: Failed to set cipher string '%s'",
1057                            ciphers);
1058                 tls_deinit(data);
1059                 return NULL;
1060         }
1061
1062         return data;
1063 }
1064
1065
1066 void tls_deinit(void *ssl_ctx)
1067 {
1068         struct tls_data *data = ssl_ctx;
1069         SSL_CTX *ssl = data->ssl;
1070         struct tls_context *context = SSL_CTX_get_app_data(ssl);
1071         if (context != tls_global)
1072                 os_free(context);
1073         if (data->tls_session_lifetime > 0)
1074                 SSL_CTX_flush_sessions(ssl, 0);
1075         SSL_CTX_free(ssl);
1076
1077         tls_openssl_ref_count--;
1078         if (tls_openssl_ref_count == 0) {
1079 #if OPENSSL_VERSION_NUMBER < 0x10100000L || \
1080         (defined(LIBRESSL_VERSION_NUMBER) && \
1081          LIBRESSL_VERSION_NUMBER < 0x20700000L)
1082 #ifndef OPENSSL_NO_ENGINE
1083                 ENGINE_cleanup();
1084 #endif /* OPENSSL_NO_ENGINE */
1085                 CRYPTO_cleanup_all_ex_data();
1086                 ERR_remove_thread_state(NULL);
1087                 ERR_free_strings();
1088                 EVP_cleanup();
1089 #endif /* < 1.1.0 */
1090                 os_free(tls_global->ocsp_stapling_response);
1091                 tls_global->ocsp_stapling_response = NULL;
1092                 os_free(tls_global);
1093                 tls_global = NULL;
1094         }
1095
1096         os_free(data);
1097 }
1098
1099
1100 #ifndef OPENSSL_NO_ENGINE
1101
1102 /* Cryptoki return values */
1103 #define CKR_PIN_INCORRECT 0x000000a0
1104 #define CKR_PIN_INVALID 0x000000a1
1105 #define CKR_PIN_LEN_RANGE 0x000000a2
1106
1107 /* libp11 */
1108 #define ERR_LIB_PKCS11  ERR_LIB_USER
1109
1110 static int tls_is_pin_error(unsigned int err)
1111 {
1112         return ERR_GET_LIB(err) == ERR_LIB_PKCS11 &&
1113                 (ERR_GET_REASON(err) == CKR_PIN_INCORRECT ||
1114                  ERR_GET_REASON(err) == CKR_PIN_INVALID ||
1115                  ERR_GET_REASON(err) == CKR_PIN_LEN_RANGE);
1116 }
1117
1118 #endif /* OPENSSL_NO_ENGINE */
1119
1120
1121 #ifdef ANDROID
1122 /* EVP_PKEY_from_keystore comes from system/security/keystore-engine. */
1123 EVP_PKEY * EVP_PKEY_from_keystore(const char *key_id);
1124 #endif /* ANDROID */
1125
1126 static int tls_engine_init(struct tls_connection *conn, const char *engine_id,
1127                            const char *pin, const char *key_id,
1128                            const char *cert_id, const char *ca_cert_id)
1129 {
1130 #if defined(ANDROID) && defined(OPENSSL_IS_BORINGSSL)
1131 #if !defined(OPENSSL_NO_ENGINE)
1132 #error "This code depends on OPENSSL_NO_ENGINE being defined by BoringSSL."
1133 #endif
1134         if (!key_id)
1135                 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
1136         conn->engine = NULL;
1137         conn->private_key = EVP_PKEY_from_keystore(key_id);
1138         if (!conn->private_key) {
1139                 wpa_printf(MSG_ERROR,
1140                            "ENGINE: cannot load private key with id '%s' [%s]",
1141                            key_id,
1142                            ERR_error_string(ERR_get_error(), NULL));
1143                 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
1144         }
1145 #endif /* ANDROID && OPENSSL_IS_BORINGSSL */
1146
1147 #ifndef OPENSSL_NO_ENGINE
1148         int ret = -1;
1149         if (engine_id == NULL) {
1150                 wpa_printf(MSG_ERROR, "ENGINE: Engine ID not set");
1151                 return -1;
1152         }
1153
1154         ERR_clear_error();
1155 #ifdef ANDROID
1156         ENGINE_load_dynamic();
1157 #endif
1158         conn->engine = ENGINE_by_id(engine_id);
1159         if (!conn->engine) {
1160                 wpa_printf(MSG_ERROR, "ENGINE: engine %s not available [%s]",
1161                            engine_id, ERR_error_string(ERR_get_error(), NULL));
1162                 goto err;
1163         }
1164         if (ENGINE_init(conn->engine) != 1) {
1165                 wpa_printf(MSG_ERROR, "ENGINE: engine init failed "
1166                            "(engine: %s) [%s]", engine_id,
1167                            ERR_error_string(ERR_get_error(), NULL));
1168                 goto err;
1169         }
1170         wpa_printf(MSG_DEBUG, "ENGINE: engine initialized");
1171
1172 #ifndef ANDROID
1173         if (pin && ENGINE_ctrl_cmd_string(conn->engine, "PIN", pin, 0) == 0) {
1174                 wpa_printf(MSG_ERROR, "ENGINE: cannot set pin [%s]",
1175                            ERR_error_string(ERR_get_error(), NULL));
1176                 goto err;
1177         }
1178 #endif
1179         if (key_id) {
1180                 /*
1181                  * Ensure that the ENGINE does not attempt to use the OpenSSL
1182                  * UI system to obtain a PIN, if we didn't provide one.
1183                  */
1184                 struct {
1185                         const void *password;
1186                         const char *prompt_info;
1187                 } key_cb = { "", NULL };
1188
1189                 /* load private key first in-case PIN is required for cert */
1190                 conn->private_key = ENGINE_load_private_key(conn->engine,
1191                                                             key_id, NULL,
1192                                                             &key_cb);
1193                 if (!conn->private_key) {
1194                         unsigned long err = ERR_get_error();
1195
1196                         wpa_printf(MSG_ERROR,
1197                                    "ENGINE: cannot load private key with id '%s' [%s]",
1198                                    key_id,
1199                                    ERR_error_string(err, NULL));
1200                         if (tls_is_pin_error(err))
1201                                 ret = TLS_SET_PARAMS_ENGINE_PRV_BAD_PIN;
1202                         else
1203                                 ret = TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
1204                         goto err;
1205                 }
1206         }
1207
1208         /* handle a certificate and/or CA certificate */
1209         if (cert_id || ca_cert_id) {
1210                 const char *cmd_name = "LOAD_CERT_CTRL";
1211
1212                 /* test if the engine supports a LOAD_CERT_CTRL */
1213                 if (!ENGINE_ctrl(conn->engine, ENGINE_CTRL_GET_CMD_FROM_NAME,
1214                                  0, (void *)cmd_name, NULL)) {
1215                         wpa_printf(MSG_ERROR, "ENGINE: engine does not support"
1216                                    " loading certificates");
1217                         ret = TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
1218                         goto err;
1219                 }
1220         }
1221
1222         return 0;
1223
1224 err:
1225         if (conn->engine) {
1226                 ENGINE_free(conn->engine);
1227                 conn->engine = NULL;
1228         }
1229
1230         if (conn->private_key) {
1231                 EVP_PKEY_free(conn->private_key);
1232                 conn->private_key = NULL;
1233         }
1234
1235         return ret;
1236 #else /* OPENSSL_NO_ENGINE */
1237         return 0;
1238 #endif /* OPENSSL_NO_ENGINE */
1239 }
1240
1241
1242 static void tls_engine_deinit(struct tls_connection *conn)
1243 {
1244 #if defined(ANDROID) || !defined(OPENSSL_NO_ENGINE)
1245         wpa_printf(MSG_DEBUG, "ENGINE: engine deinit");
1246         if (conn->private_key) {
1247                 EVP_PKEY_free(conn->private_key);
1248                 conn->private_key = NULL;
1249         }
1250         if (conn->engine) {
1251 #if !defined(OPENSSL_IS_BORINGSSL)
1252                 ENGINE_finish(conn->engine);
1253 #endif /* !OPENSSL_IS_BORINGSSL */
1254                 conn->engine = NULL;
1255         }
1256 #endif /* ANDROID || !OPENSSL_NO_ENGINE */
1257 }
1258
1259
1260 int tls_get_errors(void *ssl_ctx)
1261 {
1262         int count = 0;
1263         unsigned long err;
1264
1265         while ((err = ERR_get_error())) {
1266                 wpa_printf(MSG_INFO, "TLS - SSL error: %s",
1267                            ERR_error_string(err, NULL));
1268                 count++;
1269         }
1270
1271         return count;
1272 }
1273
1274
1275 static const char * openssl_content_type(int content_type)
1276 {
1277         switch (content_type) {
1278         case 20:
1279                 return "change cipher spec";
1280         case 21:
1281                 return "alert";
1282         case 22:
1283                 return "handshake";
1284         case 23:
1285                 return "application data";
1286         case 24:
1287                 return "heartbeat";
1288         case 256:
1289                 return "TLS header info"; /* pseudo content type */
1290         default:
1291                 return "?";
1292         }
1293 }
1294
1295
1296 static const char * openssl_handshake_type(int content_type, const u8 *buf,
1297                                            size_t len)
1298 {
1299         if (content_type != 22 || !buf || len == 0)
1300                 return "";
1301         switch (buf[0]) {
1302         case 0:
1303                 return "hello request";
1304         case 1:
1305                 return "client hello";
1306         case 2:
1307                 return "server hello";
1308         case 4:
1309                 return "new session ticket";
1310         case 11:
1311                 return "certificate";
1312         case 12:
1313                 return "server key exchange";
1314         case 13:
1315                 return "certificate request";
1316         case 14:
1317                 return "server hello done";
1318         case 15:
1319                 return "certificate verify";
1320         case 16:
1321                 return "client key exchange";
1322         case 20:
1323                 return "finished";
1324         case 21:
1325                 return "certificate url";
1326         case 22:
1327                 return "certificate status";
1328         default:
1329                 return "?";
1330         }
1331 }
1332
1333
1334 #ifdef CONFIG_SUITEB
1335
1336 static void check_server_hello(struct tls_connection *conn,
1337                                const u8 *pos, const u8 *end)
1338 {
1339         size_t payload_len, id_len;
1340
1341         /*
1342          * Parse ServerHello to get the selected cipher suite since OpenSSL does
1343          * not make it cleanly available during handshake and we need to know
1344          * whether DHE was selected.
1345          */
1346
1347         if (end - pos < 3)
1348                 return;
1349         payload_len = WPA_GET_BE24(pos);
1350         pos += 3;
1351
1352         if ((size_t) (end - pos) < payload_len)
1353                 return;
1354         end = pos + payload_len;
1355
1356         /* Skip Version and Random */
1357         if (end - pos < 2 + SSL3_RANDOM_SIZE)
1358                 return;
1359         pos += 2 + SSL3_RANDOM_SIZE;
1360
1361         /* Skip Session ID */
1362         if (end - pos < 1)
1363                 return;
1364         id_len = *pos++;
1365         if ((size_t) (end - pos) < id_len)
1366                 return;
1367         pos += id_len;
1368
1369         if (end - pos < 2)
1370                 return;
1371         conn->cipher_suite = WPA_GET_BE16(pos);
1372         wpa_printf(MSG_DEBUG, "OpenSSL: Server selected cipher suite 0x%x",
1373                    conn->cipher_suite);
1374 }
1375
1376
1377 static void check_server_key_exchange(SSL *ssl, struct tls_connection *conn,
1378                                       const u8 *pos, const u8 *end)
1379 {
1380         size_t payload_len;
1381         u16 dh_len;
1382         BIGNUM *p;
1383         int bits;
1384
1385         if (!(conn->flags & TLS_CONN_SUITEB))
1386                 return;
1387
1388         /* DHE is enabled only with DHE-RSA-AES256-GCM-SHA384 */
1389         if (conn->cipher_suite != 0x9f)
1390                 return;
1391
1392         if (end - pos < 3)
1393                 return;
1394         payload_len = WPA_GET_BE24(pos);
1395         pos += 3;
1396
1397         if ((size_t) (end - pos) < payload_len)
1398                 return;
1399         end = pos + payload_len;
1400
1401         if (end - pos < 2)
1402                 return;
1403         dh_len = WPA_GET_BE16(pos);
1404         pos += 2;
1405
1406         if ((size_t) (end - pos) < dh_len)
1407                 return;
1408         p = BN_bin2bn(pos, dh_len, NULL);
1409         if (!p)
1410                 return;
1411
1412         bits = BN_num_bits(p);
1413         BN_free(p);
1414
1415         conn->server_dh_prime_len = bits;
1416         wpa_printf(MSG_DEBUG, "OpenSSL: Server DH prime length: %d bits",
1417                    conn->server_dh_prime_len);
1418 }
1419
1420 #endif /* CONFIG_SUITEB */
1421
1422
1423 static void tls_msg_cb(int write_p, int version, int content_type,
1424                        const void *buf, size_t len, SSL *ssl, void *arg)
1425 {
1426         struct tls_connection *conn = arg;
1427         const u8 *pos = buf;
1428
1429         if (write_p == 2) {
1430                 wpa_printf(MSG_DEBUG,
1431                            "OpenSSL: session ver=0x%x content_type=%d",
1432                            version, content_type);
1433                 wpa_hexdump_key(MSG_MSGDUMP, "OpenSSL: Data", buf, len);
1434                 return;
1435         }
1436
1437         wpa_printf(MSG_DEBUG, "OpenSSL: %s ver=0x%x content_type=%d (%s/%s)",
1438                    write_p ? "TX" : "RX", version, content_type,
1439                    openssl_content_type(content_type),
1440                    openssl_handshake_type(content_type, buf, len));
1441         wpa_hexdump_key(MSG_MSGDUMP, "OpenSSL: Message", buf, len);
1442         if (content_type == 24 && len >= 3 && pos[0] == 1) {
1443                 size_t payload_len = WPA_GET_BE16(pos + 1);
1444                 if (payload_len + 3 > len) {
1445                         wpa_printf(MSG_ERROR, "OpenSSL: Heartbeat attack detected");
1446                         conn->invalid_hb_used = 1;
1447                 }
1448         }
1449
1450 #ifdef CONFIG_SUITEB
1451         /*
1452          * Need to parse these handshake messages to be able to check DH prime
1453          * length since OpenSSL does not expose the new cipher suite and DH
1454          * parameters during handshake (e.g., for cert_cb() callback).
1455          */
1456         if (content_type == 22 && pos && len > 0 && pos[0] == 2)
1457                 check_server_hello(conn, pos + 1, pos + len);
1458         if (content_type == 22 && pos && len > 0 && pos[0] == 12)
1459                 check_server_key_exchange(ssl, conn, pos + 1, pos + len);
1460 #endif /* CONFIG_SUITEB */
1461 }
1462
1463
1464 struct tls_connection * tls_connection_init(void *ssl_ctx)
1465 {
1466         struct tls_data *data = ssl_ctx;
1467         SSL_CTX *ssl = data->ssl;
1468         struct tls_connection *conn;
1469         long options;
1470         struct tls_context *context = SSL_CTX_get_app_data(ssl);
1471
1472         conn = os_zalloc(sizeof(*conn));
1473         if (conn == NULL)
1474                 return NULL;
1475         conn->ssl_ctx = ssl;
1476         conn->ssl = SSL_new(ssl);
1477         if (conn->ssl == NULL) {
1478                 tls_show_errors(MSG_INFO, __func__,
1479                                 "Failed to initialize new SSL connection");
1480                 os_free(conn);
1481                 return NULL;
1482         }
1483
1484         conn->context = context;
1485         SSL_set_app_data(conn->ssl, conn);
1486         SSL_set_msg_callback(conn->ssl, tls_msg_cb);
1487         SSL_set_msg_callback_arg(conn->ssl, conn);
1488         options = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
1489                 SSL_OP_SINGLE_DH_USE;
1490 #ifdef SSL_OP_NO_COMPRESSION
1491         options |= SSL_OP_NO_COMPRESSION;
1492 #endif /* SSL_OP_NO_COMPRESSION */
1493         SSL_set_options(conn->ssl, options);
1494
1495         conn->ssl_in = BIO_new(BIO_s_mem());
1496         if (!conn->ssl_in) {
1497                 tls_show_errors(MSG_INFO, __func__,
1498                                 "Failed to create a new BIO for ssl_in");
1499                 SSL_free(conn->ssl);
1500                 os_free(conn);
1501                 return NULL;
1502         }
1503
1504         conn->ssl_out = BIO_new(BIO_s_mem());
1505         if (!conn->ssl_out) {
1506                 tls_show_errors(MSG_INFO, __func__,
1507                                 "Failed to create a new BIO for ssl_out");
1508                 SSL_free(conn->ssl);
1509                 BIO_free(conn->ssl_in);
1510                 os_free(conn);
1511                 return NULL;
1512         }
1513
1514         SSL_set_bio(conn->ssl, conn->ssl_in, conn->ssl_out);
1515
1516         return conn;
1517 }
1518
1519
1520 void tls_connection_deinit(void *ssl_ctx, struct tls_connection *conn)
1521 {
1522         if (conn == NULL)
1523                 return;
1524         if (conn->success_data) {
1525                 /*
1526                  * Make sure ssl_clear_bad_session() does not remove this
1527                  * session.
1528                  */
1529                 SSL_set_quiet_shutdown(conn->ssl, 1);
1530                 SSL_shutdown(conn->ssl);
1531         }
1532         SSL_free(conn->ssl);
1533         tls_engine_deinit(conn);
1534         os_free(conn->subject_match);
1535         os_free(conn->altsubject_match);
1536         os_free(conn->suffix_match);
1537         os_free(conn->domain_match);
1538         os_free(conn->session_ticket);
1539         os_free(conn);
1540 }
1541
1542
1543 int tls_connection_established(void *ssl_ctx, struct tls_connection *conn)
1544 {
1545         return conn ? SSL_is_init_finished(conn->ssl) : 0;
1546 }
1547
1548
1549 char * tls_connection_peer_serial_num(void *tls_ctx,
1550                                       struct tls_connection *conn)
1551 {
1552         ASN1_INTEGER *ser;
1553         char *serial_num;
1554         size_t len;
1555
1556         if (!conn->peer_cert)
1557                 return NULL;
1558
1559         ser = X509_get_serialNumber(conn->peer_cert);
1560         if (!ser)
1561                 return NULL;
1562
1563         len = ASN1_STRING_length(ser) * 2 + 1;
1564         serial_num = os_malloc(len);
1565         if (!serial_num)
1566                 return NULL;
1567         wpa_snprintf_hex_uppercase(serial_num, len,
1568                                    ASN1_STRING_get0_data(ser),
1569                                    ASN1_STRING_length(ser));
1570         return serial_num;
1571 }
1572
1573
1574 int tls_connection_shutdown(void *ssl_ctx, struct tls_connection *conn)
1575 {
1576         if (conn == NULL)
1577                 return -1;
1578
1579         /* Shutdown previous TLS connection without notifying the peer
1580          * because the connection was already terminated in practice
1581          * and "close notify" shutdown alert would confuse AS. */
1582         SSL_set_quiet_shutdown(conn->ssl, 1);
1583         SSL_shutdown(conn->ssl);
1584         return SSL_clear(conn->ssl) == 1 ? 0 : -1;
1585 }
1586
1587
1588 static int tls_match_altsubject_component(X509 *cert, int type,
1589                                           const char *value, size_t len)
1590 {
1591         GENERAL_NAME *gen;
1592         void *ext;
1593         int found = 0;
1594         stack_index_t i;
1595
1596         ext = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL);
1597
1598         for (i = 0; ext && i < sk_GENERAL_NAME_num(ext); i++) {
1599                 gen = sk_GENERAL_NAME_value(ext, i);
1600                 if (gen->type != type)
1601                         continue;
1602                 if (os_strlen((char *) gen->d.ia5->data) == len &&
1603                     os_memcmp(value, gen->d.ia5->data, len) == 0)
1604                         found++;
1605         }
1606
1607         sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free);
1608
1609         return found;
1610 }
1611
1612
1613 static int tls_match_altsubject(X509 *cert, const char *match)
1614 {
1615         int type;
1616         const char *pos, *end;
1617         size_t len;
1618
1619         pos = match;
1620         do {
1621                 if (os_strncmp(pos, "EMAIL:", 6) == 0) {
1622                         type = GEN_EMAIL;
1623                         pos += 6;
1624                 } else if (os_strncmp(pos, "DNS:", 4) == 0) {
1625                         type = GEN_DNS;
1626                         pos += 4;
1627                 } else if (os_strncmp(pos, "URI:", 4) == 0) {
1628                         type = GEN_URI;
1629                         pos += 4;
1630                 } else {
1631                         wpa_printf(MSG_INFO, "TLS: Invalid altSubjectName "
1632                                    "match '%s'", pos);
1633                         return 0;
1634                 }
1635                 end = os_strchr(pos, ';');
1636                 while (end) {
1637                         if (os_strncmp(end + 1, "EMAIL:", 6) == 0 ||
1638                             os_strncmp(end + 1, "DNS:", 4) == 0 ||
1639                             os_strncmp(end + 1, "URI:", 4) == 0)
1640                                 break;
1641                         end = os_strchr(end + 1, ';');
1642                 }
1643                 if (end)
1644                         len = end - pos;
1645                 else
1646                         len = os_strlen(pos);
1647                 if (tls_match_altsubject_component(cert, type, pos, len) > 0)
1648                         return 1;
1649                 pos = end + 1;
1650         } while (end);
1651
1652         return 0;
1653 }
1654
1655
1656 #ifndef CONFIG_NATIVE_WINDOWS
1657 static int domain_suffix_match(const u8 *val, size_t len, const char *match,
1658                                int full)
1659 {
1660         size_t i, match_len;
1661
1662         /* Check for embedded nuls that could mess up suffix matching */
1663         for (i = 0; i < len; i++) {
1664                 if (val[i] == '\0') {
1665                         wpa_printf(MSG_DEBUG, "TLS: Embedded null in a string - reject");
1666                         return 0;
1667                 }
1668         }
1669
1670         match_len = os_strlen(match);
1671         if (match_len > len || (full && match_len != len))
1672                 return 0;
1673
1674         if (os_strncasecmp((const char *) val + len - match_len, match,
1675                            match_len) != 0)
1676                 return 0; /* no match */
1677
1678         if (match_len == len)
1679                 return 1; /* exact match */
1680
1681         if (val[len - match_len - 1] == '.')
1682                 return 1; /* full label match completes suffix match */
1683
1684         wpa_printf(MSG_DEBUG, "TLS: Reject due to incomplete label match");
1685         return 0;
1686 }
1687 #endif /* CONFIG_NATIVE_WINDOWS */
1688
1689
1690 static int tls_match_suffix(X509 *cert, const char *match, int full)
1691 {
1692 #ifdef CONFIG_NATIVE_WINDOWS
1693         /* wincrypt.h has conflicting X509_NAME definition */
1694         return -1;
1695 #else /* CONFIG_NATIVE_WINDOWS */
1696         GENERAL_NAME *gen;
1697         void *ext;
1698         int i;
1699         stack_index_t j;
1700         int dns_name = 0;
1701         X509_NAME *name;
1702
1703         wpa_printf(MSG_DEBUG, "TLS: Match domain against %s%s",
1704                    full ? "": "suffix ", match);
1705
1706         ext = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL);
1707
1708         for (j = 0; ext && j < sk_GENERAL_NAME_num(ext); j++) {
1709                 gen = sk_GENERAL_NAME_value(ext, j);
1710                 if (gen->type != GEN_DNS)
1711                         continue;
1712                 dns_name++;
1713                 wpa_hexdump_ascii(MSG_DEBUG, "TLS: Certificate dNSName",
1714                                   gen->d.dNSName->data,
1715                                   gen->d.dNSName->length);
1716                 if (domain_suffix_match(gen->d.dNSName->data,
1717                                         gen->d.dNSName->length, match, full) ==
1718                     1) {
1719                         wpa_printf(MSG_DEBUG, "TLS: %s in dNSName found",
1720                                    full ? "Match" : "Suffix match");
1721                         sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free);
1722                         return 1;
1723                 }
1724         }
1725         sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free);
1726
1727         if (dns_name) {
1728                 wpa_printf(MSG_DEBUG, "TLS: None of the dNSName(s) matched");
1729                 return 0;
1730         }
1731
1732         name = X509_get_subject_name(cert);
1733         i = -1;
1734         for (;;) {
1735                 X509_NAME_ENTRY *e;
1736                 ASN1_STRING *cn;
1737
1738                 i = X509_NAME_get_index_by_NID(name, NID_commonName, i);
1739                 if (i == -1)
1740                         break;
1741                 e = X509_NAME_get_entry(name, i);
1742                 if (e == NULL)
1743                         continue;
1744                 cn = X509_NAME_ENTRY_get_data(e);
1745                 if (cn == NULL)
1746                         continue;
1747                 wpa_hexdump_ascii(MSG_DEBUG, "TLS: Certificate commonName",
1748                                   cn->data, cn->length);
1749                 if (domain_suffix_match(cn->data, cn->length, match, full) == 1)
1750                 {
1751                         wpa_printf(MSG_DEBUG, "TLS: %s in commonName found",
1752                                    full ? "Match" : "Suffix match");
1753                         return 1;
1754                 }
1755         }
1756
1757         wpa_printf(MSG_DEBUG, "TLS: No CommonName %smatch found",
1758                    full ? "": "suffix ");
1759         return 0;
1760 #endif /* CONFIG_NATIVE_WINDOWS */
1761 }
1762
1763
1764 static enum tls_fail_reason openssl_tls_fail_reason(int err)
1765 {
1766         switch (err) {
1767         case X509_V_ERR_CERT_REVOKED:
1768                 return TLS_FAIL_REVOKED;
1769         case X509_V_ERR_CERT_NOT_YET_VALID:
1770         case X509_V_ERR_CRL_NOT_YET_VALID:
1771                 return TLS_FAIL_NOT_YET_VALID;
1772         case X509_V_ERR_CERT_HAS_EXPIRED:
1773         case X509_V_ERR_CRL_HAS_EXPIRED:
1774                 return TLS_FAIL_EXPIRED;
1775         case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
1776         case X509_V_ERR_UNABLE_TO_GET_CRL:
1777         case X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER:
1778         case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
1779         case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
1780         case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
1781         case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
1782         case X509_V_ERR_CERT_CHAIN_TOO_LONG:
1783         case X509_V_ERR_PATH_LENGTH_EXCEEDED:
1784         case X509_V_ERR_INVALID_CA:
1785                 return TLS_FAIL_UNTRUSTED;
1786         case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
1787         case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
1788         case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY:
1789         case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
1790         case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
1791         case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD:
1792         case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:
1793         case X509_V_ERR_CERT_UNTRUSTED:
1794         case X509_V_ERR_CERT_REJECTED:
1795                 return TLS_FAIL_BAD_CERTIFICATE;
1796         default:
1797                 return TLS_FAIL_UNSPECIFIED;
1798         }
1799 }
1800
1801
1802 static struct wpabuf * get_x509_cert(X509 *cert)
1803 {
1804         struct wpabuf *buf;
1805         u8 *tmp;
1806
1807         int cert_len = i2d_X509(cert, NULL);
1808         if (cert_len <= 0)
1809                 return NULL;
1810
1811         buf = wpabuf_alloc(cert_len);
1812         if (buf == NULL)
1813                 return NULL;
1814
1815         tmp = wpabuf_put(buf, cert_len);
1816         i2d_X509(cert, &tmp);
1817         return buf;
1818 }
1819
1820
1821 static void openssl_tls_fail_event(struct tls_connection *conn,
1822                                    X509 *err_cert, int err, int depth,
1823                                    const char *subject, const char *err_str,
1824                                    enum tls_fail_reason reason)
1825 {
1826         union tls_event_data ev;
1827         struct wpabuf *cert = NULL;
1828         struct tls_context *context = conn->context;
1829
1830         if (context->event_cb == NULL)
1831                 return;
1832
1833         cert = get_x509_cert(err_cert);
1834         os_memset(&ev, 0, sizeof(ev));
1835         ev.cert_fail.reason = reason != TLS_FAIL_UNSPECIFIED ?
1836                 reason : openssl_tls_fail_reason(err);
1837         ev.cert_fail.depth = depth;
1838         ev.cert_fail.subject = subject;
1839         ev.cert_fail.reason_txt = err_str;
1840         ev.cert_fail.cert = cert;
1841         context->event_cb(context->cb_ctx, TLS_CERT_CHAIN_FAILURE, &ev);
1842         wpabuf_free(cert);
1843 }
1844
1845
1846 static void openssl_tls_cert_event(struct tls_connection *conn,
1847                                    X509 *err_cert, int depth,
1848                                    const char *subject)
1849 {
1850         struct wpabuf *cert = NULL;
1851         union tls_event_data ev;
1852         struct tls_context *context = conn->context;
1853         char *altsubject[TLS_MAX_ALT_SUBJECT];
1854         int alt, num_altsubject = 0;
1855         GENERAL_NAME *gen;
1856         void *ext;
1857         stack_index_t i;
1858         ASN1_INTEGER *ser;
1859         char serial_num[128];
1860 #ifdef CONFIG_SHA256
1861         u8 hash[32];
1862 #endif /* CONFIG_SHA256 */
1863
1864         if (context->event_cb == NULL)
1865                 return;
1866
1867         os_memset(&ev, 0, sizeof(ev));
1868         if (conn->cert_probe || (conn->flags & TLS_CONN_EXT_CERT_CHECK) ||
1869             context->cert_in_cb) {
1870                 cert = get_x509_cert(err_cert);
1871                 ev.peer_cert.cert = cert;
1872         }
1873 #ifdef CONFIG_SHA256
1874         if (cert) {
1875                 const u8 *addr[1];
1876                 size_t len[1];
1877                 addr[0] = wpabuf_head(cert);
1878                 len[0] = wpabuf_len(cert);
1879                 if (sha256_vector(1, addr, len, hash) == 0) {
1880                         ev.peer_cert.hash = hash;
1881                         ev.peer_cert.hash_len = sizeof(hash);
1882                 }
1883         }
1884 #endif /* CONFIG_SHA256 */
1885         ev.peer_cert.depth = depth;
1886         ev.peer_cert.subject = subject;
1887
1888         ser = X509_get_serialNumber(err_cert);
1889         if (ser) {
1890                 wpa_snprintf_hex_uppercase(serial_num, sizeof(serial_num),
1891                                            ASN1_STRING_get0_data(ser),
1892                                            ASN1_STRING_length(ser));
1893                 ev.peer_cert.serial_num = serial_num;
1894         }
1895
1896         ext = X509_get_ext_d2i(err_cert, NID_subject_alt_name, NULL, NULL);
1897         for (i = 0; ext && i < sk_GENERAL_NAME_num(ext); i++) {
1898                 char *pos;
1899
1900                 if (num_altsubject == TLS_MAX_ALT_SUBJECT)
1901                         break;
1902                 gen = sk_GENERAL_NAME_value(ext, i);
1903                 if (gen->type != GEN_EMAIL &&
1904                     gen->type != GEN_DNS &&
1905                     gen->type != GEN_URI)
1906                         continue;
1907
1908                 pos = os_malloc(10 + gen->d.ia5->length + 1);
1909                 if (pos == NULL)
1910                         break;
1911                 altsubject[num_altsubject++] = pos;
1912
1913                 switch (gen->type) {
1914                 case GEN_EMAIL:
1915                         os_memcpy(pos, "EMAIL:", 6);
1916                         pos += 6;
1917                         break;
1918                 case GEN_DNS:
1919                         os_memcpy(pos, "DNS:", 4);
1920                         pos += 4;
1921                         break;
1922                 case GEN_URI:
1923                         os_memcpy(pos, "URI:", 4);
1924                         pos += 4;
1925                         break;
1926                 }
1927
1928                 os_memcpy(pos, gen->d.ia5->data, gen->d.ia5->length);
1929                 pos += gen->d.ia5->length;
1930                 *pos = '\0';
1931         }
1932         sk_GENERAL_NAME_pop_free(ext, GENERAL_NAME_free);
1933
1934         for (alt = 0; alt < num_altsubject; alt++)
1935                 ev.peer_cert.altsubject[alt] = altsubject[alt];
1936         ev.peer_cert.num_altsubject = num_altsubject;
1937
1938         context->event_cb(context->cb_ctx, TLS_PEER_CERTIFICATE, &ev);
1939         wpabuf_free(cert);
1940         for (alt = 0; alt < num_altsubject; alt++)
1941                 os_free(altsubject[alt]);
1942 }
1943
1944
1945 static int tls_verify_cb(int preverify_ok, X509_STORE_CTX *x509_ctx)
1946 {
1947         char buf[256];
1948         X509 *err_cert;
1949         int err, depth;
1950         SSL *ssl;
1951         struct tls_connection *conn;
1952         struct tls_context *context;
1953         char *match, *altmatch, *suffix_match, *domain_match;
1954         const char *err_str;
1955
1956         err_cert = X509_STORE_CTX_get_current_cert(x509_ctx);
1957         if (!err_cert)
1958                 return 0;
1959
1960         err = X509_STORE_CTX_get_error(x509_ctx);
1961         depth = X509_STORE_CTX_get_error_depth(x509_ctx);
1962         ssl = X509_STORE_CTX_get_ex_data(x509_ctx,
1963                                          SSL_get_ex_data_X509_STORE_CTX_idx());
1964         X509_NAME_oneline(X509_get_subject_name(err_cert), buf, sizeof(buf));
1965
1966         conn = SSL_get_app_data(ssl);
1967         if (conn == NULL)
1968                 return 0;
1969
1970         if (depth == 0)
1971                 conn->peer_cert = err_cert;
1972         else if (depth == 1)
1973                 conn->peer_issuer = err_cert;
1974         else if (depth == 2)
1975                 conn->peer_issuer_issuer = err_cert;
1976
1977         context = conn->context;
1978         match = conn->subject_match;
1979         altmatch = conn->altsubject_match;
1980         suffix_match = conn->suffix_match;
1981         domain_match = conn->domain_match;
1982
1983         if (!preverify_ok && !conn->ca_cert_verify)
1984                 preverify_ok = 1;
1985         if (!preverify_ok && depth > 0 && conn->server_cert_only)
1986                 preverify_ok = 1;
1987         if (!preverify_ok && (conn->flags & TLS_CONN_DISABLE_TIME_CHECKS) &&
1988             (err == X509_V_ERR_CERT_HAS_EXPIRED ||
1989              err == X509_V_ERR_CERT_NOT_YET_VALID)) {
1990                 wpa_printf(MSG_DEBUG, "OpenSSL: Ignore certificate validity "
1991                            "time mismatch");
1992                 preverify_ok = 1;
1993         }
1994
1995         err_str = X509_verify_cert_error_string(err);
1996
1997 #ifdef CONFIG_SHA256
1998         /*
1999          * Do not require preverify_ok so we can explicity allow otherwise
2000          * invalid pinned server certificates.
2001          */
2002         if (depth == 0 && conn->server_cert_only) {
2003                 struct wpabuf *cert;
2004                 cert = get_x509_cert(err_cert);
2005                 if (!cert) {
2006                         wpa_printf(MSG_DEBUG, "OpenSSL: Could not fetch "
2007                                    "server certificate data");
2008                         preverify_ok = 0;
2009                 } else {
2010                         u8 hash[32];
2011                         const u8 *addr[1];
2012                         size_t len[1];
2013                         addr[0] = wpabuf_head(cert);
2014                         len[0] = wpabuf_len(cert);
2015                         if (sha256_vector(1, addr, len, hash) < 0 ||
2016                             os_memcmp(conn->srv_cert_hash, hash, 32) != 0) {
2017                                 err_str = "Server certificate mismatch";
2018                                 err = X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN;
2019                                 preverify_ok = 0;
2020                         } else if (!preverify_ok) {
2021                                 /*
2022                                  * Certificate matches pinned certificate, allow
2023                                  * regardless of other problems.
2024                                  */
2025                                 wpa_printf(MSG_DEBUG,
2026                                            "OpenSSL: Ignore validation issues for a pinned server certificate");
2027                                 preverify_ok = 1;
2028                         }
2029                         wpabuf_free(cert);
2030                 }
2031         }
2032 #endif /* CONFIG_SHA256 */
2033
2034         if (!preverify_ok) {
2035                 wpa_printf(MSG_WARNING, "TLS: Certificate verification failed,"
2036                            " error %d (%s) depth %d for '%s'", err, err_str,
2037                            depth, buf);
2038                 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2039                                        err_str, TLS_FAIL_UNSPECIFIED);
2040                 return preverify_ok;
2041         }
2042
2043         wpa_printf(MSG_DEBUG, "TLS: tls_verify_cb - preverify_ok=%d "
2044                    "err=%d (%s) ca_cert_verify=%d depth=%d buf='%s'",
2045                    preverify_ok, err, err_str,
2046                    conn->ca_cert_verify, depth, buf);
2047         if (depth == 0 && match && os_strstr(buf, match) == NULL) {
2048                 wpa_printf(MSG_WARNING, "TLS: Subject '%s' did not "
2049                            "match with '%s'", buf, match);
2050                 preverify_ok = 0;
2051                 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2052                                        "Subject mismatch",
2053                                        TLS_FAIL_SUBJECT_MISMATCH);
2054         } else if (depth == 0 && altmatch &&
2055                    !tls_match_altsubject(err_cert, altmatch)) {
2056                 wpa_printf(MSG_WARNING, "TLS: altSubjectName match "
2057                            "'%s' not found", altmatch);
2058                 preverify_ok = 0;
2059                 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2060                                        "AltSubject mismatch",
2061                                        TLS_FAIL_ALTSUBJECT_MISMATCH);
2062         } else if (depth == 0 && suffix_match &&
2063                    !tls_match_suffix(err_cert, suffix_match, 0)) {
2064                 wpa_printf(MSG_WARNING, "TLS: Domain suffix match '%s' not found",
2065                            suffix_match);
2066                 preverify_ok = 0;
2067                 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2068                                        "Domain suffix mismatch",
2069                                        TLS_FAIL_DOMAIN_SUFFIX_MISMATCH);
2070         } else if (depth == 0 && domain_match &&
2071                    !tls_match_suffix(err_cert, domain_match, 1)) {
2072                 wpa_printf(MSG_WARNING, "TLS: Domain match '%s' not found",
2073                            domain_match);
2074                 preverify_ok = 0;
2075                 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2076                                        "Domain mismatch",
2077                                        TLS_FAIL_DOMAIN_MISMATCH);
2078         } else
2079                 openssl_tls_cert_event(conn, err_cert, depth, buf);
2080
2081         if (conn->cert_probe && preverify_ok && depth == 0) {
2082                 wpa_printf(MSG_DEBUG, "OpenSSL: Reject server certificate "
2083                            "on probe-only run");
2084                 preverify_ok = 0;
2085                 openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2086                                        "Server certificate chain probe",
2087                                        TLS_FAIL_SERVER_CHAIN_PROBE);
2088         }
2089
2090 #ifdef CONFIG_SUITEB
2091         if (conn->flags & TLS_CONN_SUITEB) {
2092                 EVP_PKEY *pk;
2093                 RSA *rsa;
2094                 int len = -1;
2095
2096                 pk = X509_get_pubkey(err_cert);
2097                 if (pk) {
2098                         rsa = EVP_PKEY_get1_RSA(pk);
2099                         if (rsa) {
2100                                 len = RSA_bits(rsa);
2101                                 RSA_free(rsa);
2102                         }
2103                         EVP_PKEY_free(pk);
2104                 }
2105
2106                 if (len >= 0) {
2107                         wpa_printf(MSG_DEBUG,
2108                                    "OpenSSL: RSA modulus size: %d bits", len);
2109                         if (len < 3072) {
2110                                 preverify_ok = 0;
2111                                 openssl_tls_fail_event(
2112                                         conn, err_cert, err,
2113                                         depth, buf,
2114                                         "Insufficient RSA modulus size",
2115                                         TLS_FAIL_INSUFFICIENT_KEY_LEN);
2116                         }
2117                 }
2118         }
2119 #endif /* CONFIG_SUITEB */
2120
2121 #ifdef OPENSSL_IS_BORINGSSL
2122         if (depth == 0 && (conn->flags & TLS_CONN_REQUEST_OCSP) &&
2123             preverify_ok) {
2124                 enum ocsp_result res;
2125
2126                 res = check_ocsp_resp(conn->ssl_ctx, conn->ssl, err_cert,
2127                                       conn->peer_issuer,
2128                                       conn->peer_issuer_issuer);
2129                 if (res == OCSP_REVOKED) {
2130                         preverify_ok = 0;
2131                         openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2132                                                "certificate revoked",
2133                                                TLS_FAIL_REVOKED);
2134                         if (err == X509_V_OK)
2135                                 X509_STORE_CTX_set_error(
2136                                         x509_ctx, X509_V_ERR_CERT_REVOKED);
2137                 } else if (res != OCSP_GOOD &&
2138                            (conn->flags & TLS_CONN_REQUIRE_OCSP)) {
2139                         preverify_ok = 0;
2140                         openssl_tls_fail_event(conn, err_cert, err, depth, buf,
2141                                                "bad certificate status response",
2142                                                TLS_FAIL_UNSPECIFIED);
2143                 }
2144         }
2145 #endif /* OPENSSL_IS_BORINGSSL */
2146
2147         if (depth == 0 && preverify_ok && context->event_cb != NULL)
2148                 context->event_cb(context->cb_ctx,
2149                                   TLS_CERT_CHAIN_SUCCESS, NULL);
2150
2151         return preverify_ok;
2152 }
2153
2154
2155 #ifndef OPENSSL_NO_STDIO
2156 static int tls_load_ca_der(struct tls_data *data, const char *ca_cert)
2157 {
2158         SSL_CTX *ssl_ctx = data->ssl;
2159         X509_LOOKUP *lookup;
2160         int ret = 0;
2161
2162         lookup = X509_STORE_add_lookup(SSL_CTX_get_cert_store(ssl_ctx),
2163                                        X509_LOOKUP_file());
2164         if (lookup == NULL) {
2165                 tls_show_errors(MSG_WARNING, __func__,
2166                                 "Failed add lookup for X509 store");
2167                 return -1;
2168         }
2169
2170         if (!X509_LOOKUP_load_file(lookup, ca_cert, X509_FILETYPE_ASN1)) {
2171                 unsigned long err = ERR_peek_error();
2172                 tls_show_errors(MSG_WARNING, __func__,
2173                                 "Failed load CA in DER format");
2174                 if (ERR_GET_LIB(err) == ERR_LIB_X509 &&
2175                     ERR_GET_REASON(err) == X509_R_CERT_ALREADY_IN_HASH_TABLE) {
2176                         wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring "
2177                                    "cert already in hash table error",
2178                                    __func__);
2179                 } else
2180                         ret = -1;
2181         }
2182
2183         return ret;
2184 }
2185 #endif /* OPENSSL_NO_STDIO */
2186
2187
2188 static int tls_connection_ca_cert(struct tls_data *data,
2189                                   struct tls_connection *conn,
2190                                   const char *ca_cert, const u8 *ca_cert_blob,
2191                                   size_t ca_cert_blob_len, const char *ca_path)
2192 {
2193         SSL_CTX *ssl_ctx = data->ssl;
2194         X509_STORE *store;
2195
2196         /*
2197          * Remove previously configured trusted CA certificates before adding
2198          * new ones.
2199          */
2200         store = X509_STORE_new();
2201         if (store == NULL) {
2202                 wpa_printf(MSG_DEBUG, "OpenSSL: %s - failed to allocate new "
2203                            "certificate store", __func__);
2204                 return -1;
2205         }
2206         SSL_CTX_set_cert_store(ssl_ctx, store);
2207
2208         SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);
2209         conn->ca_cert_verify = 1;
2210
2211         if (ca_cert && os_strncmp(ca_cert, "probe://", 8) == 0) {
2212                 wpa_printf(MSG_DEBUG, "OpenSSL: Probe for server certificate "
2213                            "chain");
2214                 conn->cert_probe = 1;
2215                 conn->ca_cert_verify = 0;
2216                 return 0;
2217         }
2218
2219         if (ca_cert && os_strncmp(ca_cert, "hash://", 7) == 0) {
2220 #ifdef CONFIG_SHA256
2221                 const char *pos = ca_cert + 7;
2222                 if (os_strncmp(pos, "server/sha256/", 14) != 0) {
2223                         wpa_printf(MSG_DEBUG, "OpenSSL: Unsupported ca_cert "
2224                                    "hash value '%s'", ca_cert);
2225                         return -1;
2226                 }
2227                 pos += 14;
2228                 if (os_strlen(pos) != 32 * 2) {
2229                         wpa_printf(MSG_DEBUG, "OpenSSL: Unexpected SHA256 "
2230                                    "hash length in ca_cert '%s'", ca_cert);
2231                         return -1;
2232                 }
2233                 if (hexstr2bin(pos, conn->srv_cert_hash, 32) < 0) {
2234                         wpa_printf(MSG_DEBUG, "OpenSSL: Invalid SHA256 hash "
2235                                    "value in ca_cert '%s'", ca_cert);
2236                         return -1;
2237                 }
2238                 conn->server_cert_only = 1;
2239                 wpa_printf(MSG_DEBUG, "OpenSSL: Checking only server "
2240                            "certificate match");
2241                 return 0;
2242 #else /* CONFIG_SHA256 */
2243                 wpa_printf(MSG_INFO, "No SHA256 included in the build - "
2244                            "cannot validate server certificate hash");
2245                 return -1;
2246 #endif /* CONFIG_SHA256 */
2247         }
2248
2249         if (ca_cert_blob) {
2250                 X509 *cert = d2i_X509(NULL,
2251                                       (const unsigned char **) &ca_cert_blob,
2252                                       ca_cert_blob_len);
2253                 if (cert == NULL) {
2254                         tls_show_errors(MSG_WARNING, __func__,
2255                                         "Failed to parse ca_cert_blob");
2256                         return -1;
2257                 }
2258
2259                 if (!X509_STORE_add_cert(SSL_CTX_get_cert_store(ssl_ctx),
2260                                          cert)) {
2261                         unsigned long err = ERR_peek_error();
2262                         tls_show_errors(MSG_WARNING, __func__,
2263                                         "Failed to add ca_cert_blob to "
2264                                         "certificate store");
2265                         if (ERR_GET_LIB(err) == ERR_LIB_X509 &&
2266                             ERR_GET_REASON(err) ==
2267                             X509_R_CERT_ALREADY_IN_HASH_TABLE) {
2268                                 wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring "
2269                                            "cert already in hash table error",
2270                                            __func__);
2271                         } else {
2272                                 X509_free(cert);
2273                                 return -1;
2274                         }
2275                 }
2276                 X509_free(cert);
2277                 wpa_printf(MSG_DEBUG, "OpenSSL: %s - added ca_cert_blob "
2278                            "to certificate store", __func__);
2279                 return 0;
2280         }
2281
2282 #ifdef ANDROID
2283         /* Single alias */
2284         if (ca_cert && os_strncmp("keystore://", ca_cert, 11) == 0) {
2285                 if (tls_add_ca_from_keystore(SSL_CTX_get_cert_store(ssl_ctx),
2286                                              &ca_cert[11]) < 0)
2287                         return -1;
2288                 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);
2289                 return 0;
2290         }
2291
2292         /* Multiple aliases separated by space */
2293         if (ca_cert && os_strncmp("keystores://", ca_cert, 12) == 0) {
2294                 char *aliases = os_strdup(&ca_cert[12]);
2295                 const char *delim = " ";
2296                 int rc = 0;
2297                 char *savedptr;
2298                 char *alias;
2299
2300                 if (!aliases)
2301                         return -1;
2302                 alias = strtok_r(aliases, delim, &savedptr);
2303                 for (; alias; alias = strtok_r(NULL, delim, &savedptr)) {
2304                         if (tls_add_ca_from_keystore_encoded(
2305                                     SSL_CTX_get_cert_store(ssl_ctx), alias)) {
2306                                 wpa_printf(MSG_WARNING,
2307                                            "OpenSSL: %s - Failed to add ca_cert %s from keystore",
2308                                            __func__, alias);
2309                                 rc = -1;
2310                                 break;
2311                         }
2312                 }
2313                 os_free(aliases);
2314                 if (rc)
2315                         return rc;
2316
2317                 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);
2318                 return 0;
2319         }
2320 #endif /* ANDROID */
2321
2322 #ifdef CONFIG_NATIVE_WINDOWS
2323         if (ca_cert && tls_cryptoapi_ca_cert(ssl_ctx, conn->ssl, ca_cert) ==
2324             0) {
2325                 wpa_printf(MSG_DEBUG, "OpenSSL: Added CA certificates from "
2326                            "system certificate store");
2327                 return 0;
2328         }
2329 #endif /* CONFIG_NATIVE_WINDOWS */
2330
2331         if (ca_cert || ca_path) {
2332 #ifndef OPENSSL_NO_STDIO
2333                 if (SSL_CTX_load_verify_locations(ssl_ctx, ca_cert, ca_path) !=
2334                     1) {
2335                         tls_show_errors(MSG_WARNING, __func__,
2336                                         "Failed to load root certificates");
2337                         if (ca_cert &&
2338                             tls_load_ca_der(data, ca_cert) == 0) {
2339                                 wpa_printf(MSG_DEBUG, "OpenSSL: %s - loaded "
2340                                            "DER format CA certificate",
2341                                            __func__);
2342                         } else
2343                                 return -1;
2344                 } else {
2345                         wpa_printf(MSG_DEBUG, "TLS: Trusted root "
2346                                    "certificate(s) loaded");
2347                         tls_get_errors(data);
2348                 }
2349 #else /* OPENSSL_NO_STDIO */
2350                 wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO",
2351                            __func__);
2352                 return -1;
2353 #endif /* OPENSSL_NO_STDIO */
2354         } else {
2355                 /* No ca_cert configured - do not try to verify server
2356                  * certificate */
2357                 conn->ca_cert_verify = 0;
2358         }
2359
2360         return 0;
2361 }
2362
2363
2364 static int tls_global_ca_cert(struct tls_data *data, const char *ca_cert)
2365 {
2366         SSL_CTX *ssl_ctx = data->ssl;
2367
2368         if (ca_cert) {
2369                 if (SSL_CTX_load_verify_locations(ssl_ctx, ca_cert, NULL) != 1)
2370                 {
2371                         tls_show_errors(MSG_WARNING, __func__,
2372                                         "Failed to load root certificates");
2373                         return -1;
2374                 }
2375
2376                 wpa_printf(MSG_DEBUG, "TLS: Trusted root "
2377                            "certificate(s) loaded");
2378
2379 #ifndef OPENSSL_NO_STDIO
2380                 /* Add the same CAs to the client certificate requests */
2381                 SSL_CTX_set_client_CA_list(ssl_ctx,
2382                                            SSL_load_client_CA_file(ca_cert));
2383 #endif /* OPENSSL_NO_STDIO */
2384         }
2385
2386         return 0;
2387 }
2388
2389
2390 int tls_global_set_verify(void *ssl_ctx, int check_crl)
2391 {
2392         int flags;
2393
2394         if (check_crl) {
2395                 struct tls_data *data = ssl_ctx;
2396                 X509_STORE *cs = SSL_CTX_get_cert_store(data->ssl);
2397                 if (cs == NULL) {
2398                         tls_show_errors(MSG_INFO, __func__, "Failed to get "
2399                                         "certificate store when enabling "
2400                                         "check_crl");
2401                         return -1;
2402                 }
2403                 flags = X509_V_FLAG_CRL_CHECK;
2404                 if (check_crl == 2)
2405                         flags |= X509_V_FLAG_CRL_CHECK_ALL;
2406                 X509_STORE_set_flags(cs, flags);
2407         }
2408         return 0;
2409 }
2410
2411
2412 static int tls_connection_set_subject_match(struct tls_connection *conn,
2413                                             const char *subject_match,
2414                                             const char *altsubject_match,
2415                                             const char *suffix_match,
2416                                             const char *domain_match)
2417 {
2418         os_free(conn->subject_match);
2419         conn->subject_match = NULL;
2420         if (subject_match) {
2421                 conn->subject_match = os_strdup(subject_match);
2422                 if (conn->subject_match == NULL)
2423                         return -1;
2424         }
2425
2426         os_free(conn->altsubject_match);
2427         conn->altsubject_match = NULL;
2428         if (altsubject_match) {
2429                 conn->altsubject_match = os_strdup(altsubject_match);
2430                 if (conn->altsubject_match == NULL)
2431                         return -1;
2432         }
2433
2434         os_free(conn->suffix_match);
2435         conn->suffix_match = NULL;
2436         if (suffix_match) {
2437                 conn->suffix_match = os_strdup(suffix_match);
2438                 if (conn->suffix_match == NULL)
2439                         return -1;
2440         }
2441
2442         os_free(conn->domain_match);
2443         conn->domain_match = NULL;
2444         if (domain_match) {
2445                 conn->domain_match = os_strdup(domain_match);
2446                 if (conn->domain_match == NULL)
2447                         return -1;
2448         }
2449
2450         return 0;
2451 }
2452
2453
2454 #ifdef CONFIG_SUITEB
2455 #if OPENSSL_VERSION_NUMBER >= 0x10002000L
2456 static int suiteb_cert_cb(SSL *ssl, void *arg)
2457 {
2458         struct tls_connection *conn = arg;
2459
2460         /*
2461          * This cert_cb() is not really the best location for doing a
2462          * constraint check for the ServerKeyExchange message, but this seems to
2463          * be the only place where the current OpenSSL sequence can be
2464          * terminated cleanly with an TLS alert going out to the server.
2465          */
2466
2467         if (!(conn->flags & TLS_CONN_SUITEB))
2468                 return 1;
2469
2470         /* DHE is enabled only with DHE-RSA-AES256-GCM-SHA384 */
2471         if (conn->cipher_suite != 0x9f)
2472                 return 1;
2473
2474         if (conn->server_dh_prime_len >= 3072)
2475                 return 1;
2476
2477         wpa_printf(MSG_DEBUG,
2478                    "OpenSSL: Server DH prime length (%d bits) not sufficient for Suite B RSA - reject handshake",
2479                    conn->server_dh_prime_len);
2480         return 0;
2481 }
2482 #endif /* OPENSSL_VERSION_NUMBER */
2483 #endif /* CONFIG_SUITEB */
2484
2485
2486 static int tls_set_conn_flags(struct tls_connection *conn, unsigned int flags,
2487                               const char *openssl_ciphers)
2488 {
2489         SSL *ssl = conn->ssl;
2490
2491 #ifdef SSL_OP_NO_TICKET
2492         if (flags & TLS_CONN_DISABLE_SESSION_TICKET)
2493                 SSL_set_options(ssl, SSL_OP_NO_TICKET);
2494         else
2495                 SSL_clear_options(ssl, SSL_OP_NO_TICKET);
2496 #endif /* SSL_OP_NO_TICKET */
2497
2498 #ifdef SSL_OP_NO_TLSv1
2499         if (flags & TLS_CONN_DISABLE_TLSv1_0)
2500                 SSL_set_options(ssl, SSL_OP_NO_TLSv1);
2501         else
2502                 SSL_clear_options(ssl, SSL_OP_NO_TLSv1);
2503 #endif /* SSL_OP_NO_TLSv1 */
2504 #ifdef SSL_OP_NO_TLSv1_1
2505         if (flags & TLS_CONN_DISABLE_TLSv1_1)
2506                 SSL_set_options(ssl, SSL_OP_NO_TLSv1_1);
2507         else
2508                 SSL_clear_options(ssl, SSL_OP_NO_TLSv1_1);
2509 #endif /* SSL_OP_NO_TLSv1_1 */
2510 #ifdef SSL_OP_NO_TLSv1_2
2511         if (flags & TLS_CONN_DISABLE_TLSv1_2)
2512                 SSL_set_options(ssl, SSL_OP_NO_TLSv1_2);
2513         else
2514                 SSL_clear_options(ssl, SSL_OP_NO_TLSv1_2);
2515 #endif /* SSL_OP_NO_TLSv1_2 */
2516 #ifdef SSL_OP_NO_TLSv1_3
2517         if (flags & TLS_CONN_DISABLE_TLSv1_3)
2518                 SSL_set_options(ssl, SSL_OP_NO_TLSv1_3);
2519         else
2520                 SSL_clear_options(ssl, SSL_OP_NO_TLSv1_3);
2521 #endif /* SSL_OP_NO_TLSv1_3 */
2522 #ifdef CONFIG_SUITEB
2523 #ifdef OPENSSL_IS_BORINGSSL
2524         /* Start with defaults from BoringSSL */
2525         SSL_CTX_set_verify_algorithm_prefs(conn->ssl_ctx, NULL, 0);
2526 #endif /* OPENSSL_IS_BORINGSSL */
2527 #if OPENSSL_VERSION_NUMBER >= 0x10002000L
2528         if (flags & TLS_CONN_SUITEB_NO_ECDH) {
2529                 const char *ciphers = "DHE-RSA-AES256-GCM-SHA384";
2530
2531                 if (openssl_ciphers) {
2532                         wpa_printf(MSG_DEBUG,
2533                                    "OpenSSL: Override ciphers for Suite B (no ECDH): %s",
2534                                    openssl_ciphers);
2535                         ciphers = openssl_ciphers;
2536                 }
2537                 if (SSL_set_cipher_list(ssl, ciphers) != 1) {
2538                         wpa_printf(MSG_INFO,
2539                                    "OpenSSL: Failed to set Suite B ciphers");
2540                         return -1;
2541                 }
2542         } else if (flags & TLS_CONN_SUITEB) {
2543                 EC_KEY *ecdh;
2544                 const char *ciphers =
2545                         "ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384";
2546                 int nid[1] = { NID_secp384r1 };
2547
2548                 if (openssl_ciphers) {
2549                         wpa_printf(MSG_DEBUG,
2550                                    "OpenSSL: Override ciphers for Suite B: %s",
2551                                    openssl_ciphers);
2552                         ciphers = openssl_ciphers;
2553                 }
2554                 if (SSL_set_cipher_list(ssl, ciphers) != 1) {
2555                         wpa_printf(MSG_INFO,
2556                                    "OpenSSL: Failed to set Suite B ciphers");
2557                         return -1;
2558                 }
2559
2560                 if (SSL_set1_curves(ssl, nid, 1) != 1) {
2561                         wpa_printf(MSG_INFO,
2562                                    "OpenSSL: Failed to set Suite B curves");
2563                         return -1;
2564                 }
2565
2566                 ecdh = EC_KEY_new_by_curve_name(NID_secp384r1);
2567                 if (!ecdh || SSL_set_tmp_ecdh(ssl, ecdh) != 1) {
2568                         EC_KEY_free(ecdh);
2569                         wpa_printf(MSG_INFO,
2570                                    "OpenSSL: Failed to set ECDH parameter");
2571                         return -1;
2572                 }
2573                 EC_KEY_free(ecdh);
2574         }
2575         if (flags & (TLS_CONN_SUITEB | TLS_CONN_SUITEB_NO_ECDH)) {
2576 #ifdef OPENSSL_IS_BORINGSSL
2577                 uint16_t sigalgs[1] = { SSL_SIGN_RSA_PKCS1_SHA384 };
2578
2579                 if (SSL_CTX_set_verify_algorithm_prefs(conn->ssl_ctx, sigalgs,
2580                                                        1) != 1) {
2581                         wpa_printf(MSG_INFO,
2582                                    "OpenSSL: Failed to set Suite B sigalgs");
2583                         return -1;
2584                 }
2585 #else /* OPENSSL_IS_BORINGSSL */
2586                 /* ECDSA+SHA384 if need to add EC support here */
2587                 if (SSL_set1_sigalgs_list(ssl, "RSA+SHA384") != 1) {
2588                         wpa_printf(MSG_INFO,
2589                                    "OpenSSL: Failed to set Suite B sigalgs");
2590                         return -1;
2591                 }
2592 #endif /* OPENSSL_IS_BORINGSSL */
2593
2594                 SSL_set_options(ssl, SSL_OP_NO_TLSv1);
2595                 SSL_set_options(ssl, SSL_OP_NO_TLSv1_1);
2596                 SSL_set_cert_cb(ssl, suiteb_cert_cb, conn);
2597         }
2598 #else /* OPENSSL_VERSION_NUMBER < 0x10002000L */
2599         if (flags & (TLS_CONN_SUITEB | TLS_CONN_SUITEB_NO_ECDH)) {
2600                 wpa_printf(MSG_ERROR,
2601                            "OpenSSL: Suite B RSA case not supported with this OpenSSL version");
2602                 return -1;
2603         }
2604 #endif /* OPENSSL_VERSION_NUMBER */
2605
2606 #ifdef OPENSSL_IS_BORINGSSL
2607         if (openssl_ciphers && os_strcmp(openssl_ciphers, "SUITEB192") == 0) {
2608                 uint16_t sigalgs[1] = { SSL_SIGN_ECDSA_SECP384R1_SHA384 };
2609                 int nid[1] = { NID_secp384r1 };
2610
2611                 if (SSL_set1_curves(ssl, nid, 1) != 1) {
2612                         wpa_printf(MSG_INFO,
2613                                    "OpenSSL: Failed to set Suite B curves");
2614                         return -1;
2615                 }
2616
2617                 if (SSL_CTX_set_verify_algorithm_prefs(conn->ssl_ctx, sigalgs,
2618                                                        1) != 1) {
2619                         wpa_printf(MSG_INFO,
2620                                    "OpenSSL: Failed to set Suite B sigalgs");
2621                         return -1;
2622                 }
2623         }
2624 #endif /* OPENSSL_IS_BORINGSSL */
2625 #endif /* CONFIG_SUITEB */
2626
2627         return 0;
2628 }
2629
2630
2631 int tls_connection_set_verify(void *ssl_ctx, struct tls_connection *conn,
2632                               int verify_peer, unsigned int flags,
2633                               const u8 *session_ctx, size_t session_ctx_len)
2634 {
2635         static int counter = 0;
2636         struct tls_data *data = ssl_ctx;
2637
2638         if (conn == NULL)
2639                 return -1;
2640
2641         if (verify_peer) {
2642                 conn->ca_cert_verify = 1;
2643                 SSL_set_verify(conn->ssl, SSL_VERIFY_PEER |
2644                                SSL_VERIFY_FAIL_IF_NO_PEER_CERT |
2645                                SSL_VERIFY_CLIENT_ONCE, tls_verify_cb);
2646         } else {
2647                 conn->ca_cert_verify = 0;
2648                 SSL_set_verify(conn->ssl, SSL_VERIFY_NONE, NULL);
2649         }
2650
2651         if (tls_set_conn_flags(conn, flags, NULL) < 0)
2652                 return -1;
2653         conn->flags = flags;
2654
2655         SSL_set_accept_state(conn->ssl);
2656
2657         if (data->tls_session_lifetime == 0) {
2658                 /*
2659                  * Set session id context to a unique value to make sure
2660                  * session resumption cannot be used either through session
2661                  * caching or TLS ticket extension.
2662                  */
2663                 counter++;
2664                 SSL_set_session_id_context(conn->ssl,
2665                                            (const unsigned char *) &counter,
2666                                            sizeof(counter));
2667         } else if (session_ctx) {
2668                 SSL_set_session_id_context(conn->ssl, session_ctx,
2669                                            session_ctx_len);
2670         }
2671
2672         return 0;
2673 }
2674
2675
2676 static int tls_connection_client_cert(struct tls_connection *conn,
2677                                       const char *client_cert,
2678                                       const u8 *client_cert_blob,
2679                                       size_t client_cert_blob_len)
2680 {
2681         if (client_cert == NULL && client_cert_blob == NULL)
2682                 return 0;
2683
2684 #ifdef PKCS12_FUNCS
2685 #if OPENSSL_VERSION_NUMBER < 0x10002000L || defined(LIBRESSL_VERSION_NUMBER)
2686         /*
2687          * Clear previously set extra chain certificates, if any, from PKCS#12
2688          * processing in tls_parse_pkcs12() to allow OpenSSL to build a new
2689          * chain properly.
2690          */
2691         SSL_CTX_clear_extra_chain_certs(conn->ssl_ctx);
2692 #endif /* OPENSSL_VERSION_NUMBER < 0x10002000L */
2693 #endif /* PKCS12_FUNCS */
2694
2695         if (client_cert_blob &&
2696             SSL_use_certificate_ASN1(conn->ssl, (u8 *) client_cert_blob,
2697                                      client_cert_blob_len) == 1) {
2698                 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_ASN1 --> "
2699                            "OK");
2700                 return 0;
2701         } else if (client_cert_blob) {
2702                 tls_show_errors(MSG_DEBUG, __func__,
2703                                 "SSL_use_certificate_ASN1 failed");
2704         }
2705
2706         if (client_cert == NULL)
2707                 return -1;
2708
2709 #ifdef ANDROID
2710         if (os_strncmp("keystore://", client_cert, 11) == 0) {
2711                 BIO *bio = BIO_from_keystore(&client_cert[11]);
2712                 X509 *x509 = NULL;
2713                 int ret = -1;
2714                 if (bio) {
2715                         x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
2716                 }
2717                 if (x509) {
2718                         if (SSL_use_certificate(conn->ssl, x509) == 1)
2719                                 ret = 0;
2720                         X509_free(x509);
2721                 }
2722
2723                 /* Read additional certificates into the chain. */
2724                 while (bio) {
2725                         x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
2726                         if (x509) {
2727                                 /* Takes ownership of x509 */
2728                                 SSL_add0_chain_cert(conn->ssl, x509);
2729                         } else {
2730                                 BIO_free(bio);
2731                                 bio = NULL;
2732                         }
2733                 }
2734                 return ret;
2735         }
2736 #endif /* ANDROID */
2737
2738 #ifndef OPENSSL_NO_STDIO
2739         if (SSL_use_certificate_file(conn->ssl, client_cert,
2740                                      SSL_FILETYPE_ASN1) == 1) {
2741                 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_file (DER)"
2742                            " --> OK");
2743                 return 0;
2744         }
2745
2746         if (SSL_use_certificate_file(conn->ssl, client_cert,
2747                                      SSL_FILETYPE_PEM) == 1) {
2748                 ERR_clear_error();
2749                 wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_certificate_file (PEM)"
2750                            " --> OK");
2751                 return 0;
2752         }
2753
2754         tls_show_errors(MSG_DEBUG, __func__,
2755                         "SSL_use_certificate_file failed");
2756 #else /* OPENSSL_NO_STDIO */
2757         wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", __func__);
2758 #endif /* OPENSSL_NO_STDIO */
2759
2760         return -1;
2761 }
2762
2763
2764 static int tls_global_client_cert(struct tls_data *data,
2765                                   const char *client_cert)
2766 {
2767 #ifndef OPENSSL_NO_STDIO
2768         SSL_CTX *ssl_ctx = data->ssl;
2769
2770         if (client_cert == NULL)
2771                 return 0;
2772
2773         if (SSL_CTX_use_certificate_file(ssl_ctx, client_cert,
2774                                          SSL_FILETYPE_ASN1) != 1 &&
2775             SSL_CTX_use_certificate_chain_file(ssl_ctx, client_cert) != 1 &&
2776             SSL_CTX_use_certificate_file(ssl_ctx, client_cert,
2777                                          SSL_FILETYPE_PEM) != 1) {
2778                 tls_show_errors(MSG_INFO, __func__,
2779                                 "Failed to load client certificate");
2780                 return -1;
2781         }
2782         return 0;
2783 #else /* OPENSSL_NO_STDIO */
2784         if (client_cert == NULL)
2785                 return 0;
2786         wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", __func__);
2787         return -1;
2788 #endif /* OPENSSL_NO_STDIO */
2789 }
2790
2791
2792 #ifdef PKCS12_FUNCS
2793 static int tls_parse_pkcs12(struct tls_data *data, SSL *ssl, PKCS12 *p12,
2794                             const char *passwd)
2795 {
2796         EVP_PKEY *pkey;
2797         X509 *cert;
2798         STACK_OF(X509) *certs;
2799         int res = 0;
2800         char buf[256];
2801
2802         pkey = NULL;
2803         cert = NULL;
2804         certs = NULL;
2805         if (!passwd)
2806                 passwd = "";
2807         if (!PKCS12_parse(p12, passwd, &pkey, &cert, &certs)) {
2808                 tls_show_errors(MSG_DEBUG, __func__,
2809                                 "Failed to parse PKCS12 file");
2810                 PKCS12_free(p12);
2811                 return -1;
2812         }
2813         wpa_printf(MSG_DEBUG, "TLS: Successfully parsed PKCS12 data");
2814
2815         if (cert) {
2816                 X509_NAME_oneline(X509_get_subject_name(cert), buf,
2817                                   sizeof(buf));
2818                 wpa_printf(MSG_DEBUG, "TLS: Got certificate from PKCS12: "
2819                            "subject='%s'", buf);
2820                 if (ssl) {
2821                         if (SSL_use_certificate(ssl, cert) != 1)
2822                                 res = -1;
2823                 } else {
2824                         if (SSL_CTX_use_certificate(data->ssl, cert) != 1)
2825                                 res = -1;
2826                 }
2827                 X509_free(cert);
2828         }
2829
2830         if (pkey) {
2831                 wpa_printf(MSG_DEBUG, "TLS: Got private key from PKCS12");
2832                 if (ssl) {
2833                         if (SSL_use_PrivateKey(ssl, pkey) != 1)
2834                                 res = -1;
2835                 } else {
2836                         if (SSL_CTX_use_PrivateKey(data->ssl, pkey) != 1)
2837                                 res = -1;
2838                 }
2839                 EVP_PKEY_free(pkey);
2840         }
2841
2842         if (certs) {
2843 #if OPENSSL_VERSION_NUMBER >= 0x10002000L && !defined(LIBRESSL_VERSION_NUMBER)
2844                 if (ssl)
2845                         SSL_clear_chain_certs(ssl);
2846                 else
2847                         SSL_CTX_clear_chain_certs(data->ssl);
2848                 while ((cert = sk_X509_pop(certs)) != NULL) {
2849                         X509_NAME_oneline(X509_get_subject_name(cert), buf,
2850                                           sizeof(buf));
2851                         wpa_printf(MSG_DEBUG, "TLS: additional certificate"
2852                                    " from PKCS12: subject='%s'", buf);
2853                         if ((ssl && SSL_add1_chain_cert(ssl, cert) != 1) ||
2854                             (!ssl && SSL_CTX_add1_chain_cert(data->ssl,
2855                                                              cert) != 1)) {
2856                                 tls_show_errors(MSG_DEBUG, __func__,
2857                                                 "Failed to add additional certificate");
2858                                 res = -1;
2859                                 X509_free(cert);
2860                                 break;
2861                         }
2862                         X509_free(cert);
2863                 }
2864                 if (!res) {
2865                         /* Try to continue anyway */
2866                 }
2867                 sk_X509_pop_free(certs, X509_free);
2868 #ifndef OPENSSL_IS_BORINGSSL
2869                 if (ssl)
2870                         res = SSL_build_cert_chain(
2871                                 ssl,
2872                                 SSL_BUILD_CHAIN_FLAG_CHECK |
2873                                 SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR);
2874                 else
2875                         res = SSL_CTX_build_cert_chain(
2876                                 data->ssl,
2877                                 SSL_BUILD_CHAIN_FLAG_CHECK |
2878                                 SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR);
2879                 if (!res) {
2880                         tls_show_errors(MSG_DEBUG, __func__,
2881                                         "Failed to build certificate chain");
2882                 } else if (res == 2) {
2883                         wpa_printf(MSG_DEBUG,
2884                                    "TLS: Ignore certificate chain verification error when building chain with PKCS#12 extra certificates");
2885                 }
2886 #endif /* OPENSSL_IS_BORINGSSL */
2887                 /*
2888                  * Try to continue regardless of result since it is possible for
2889                  * the extra certificates not to be required.
2890                  */
2891                 res = 0;
2892 #else /* OPENSSL_VERSION_NUMBER >= 0x10002000L */
2893                 SSL_CTX_clear_extra_chain_certs(data->ssl);
2894                 while ((cert = sk_X509_pop(certs)) != NULL) {
2895                         X509_NAME_oneline(X509_get_subject_name(cert), buf,
2896                                           sizeof(buf));
2897                         wpa_printf(MSG_DEBUG, "TLS: additional certificate"
2898                                    " from PKCS12: subject='%s'", buf);
2899                         /*
2900                          * There is no SSL equivalent for the chain cert - so
2901                          * always add it to the context...
2902                          */
2903                         if (SSL_CTX_add_extra_chain_cert(data->ssl, cert) != 1)
2904                         {
2905                                 X509_free(cert);
2906                                 res = -1;
2907                                 break;
2908                         }
2909                 }
2910                 sk_X509_pop_free(certs, X509_free);
2911 #endif /* OPENSSL_VERSION_NUMBER >= 0x10002000L */
2912         }
2913
2914         PKCS12_free(p12);
2915
2916         if (res < 0)
2917                 tls_get_errors(data);
2918
2919         return res;
2920 }
2921 #endif  /* PKCS12_FUNCS */
2922
2923
2924 static int tls_read_pkcs12(struct tls_data *data, SSL *ssl,
2925                            const char *private_key, const char *passwd)
2926 {
2927 #ifdef PKCS12_FUNCS
2928         FILE *f;
2929         PKCS12 *p12;
2930
2931         f = fopen(private_key, "rb");
2932         if (f == NULL)
2933                 return -1;
2934
2935         p12 = d2i_PKCS12_fp(f, NULL);
2936         fclose(f);
2937
2938         if (p12 == NULL) {
2939                 tls_show_errors(MSG_INFO, __func__,
2940                                 "Failed to use PKCS#12 file");
2941                 return -1;
2942         }
2943
2944         return tls_parse_pkcs12(data, ssl, p12, passwd);
2945
2946 #else /* PKCS12_FUNCS */
2947         wpa_printf(MSG_INFO, "TLS: PKCS12 support disabled - cannot read "
2948                    "p12/pfx files");
2949         return -1;
2950 #endif  /* PKCS12_FUNCS */
2951 }
2952
2953
2954 static int tls_read_pkcs12_blob(struct tls_data *data, SSL *ssl,
2955                                 const u8 *blob, size_t len, const char *passwd)
2956 {
2957 #ifdef PKCS12_FUNCS
2958         PKCS12 *p12;
2959
2960         p12 = d2i_PKCS12(NULL, (const unsigned char **) &blob, len);
2961         if (p12 == NULL) {
2962                 tls_show_errors(MSG_INFO, __func__,
2963                                 "Failed to use PKCS#12 blob");
2964                 return -1;
2965         }
2966
2967         return tls_parse_pkcs12(data, ssl, p12, passwd);
2968
2969 #else /* PKCS12_FUNCS */
2970         wpa_printf(MSG_INFO, "TLS: PKCS12 support disabled - cannot parse "
2971                    "p12/pfx blobs");
2972         return -1;
2973 #endif  /* PKCS12_FUNCS */
2974 }
2975
2976
2977 #ifndef OPENSSL_NO_ENGINE
2978 static int tls_engine_get_cert(struct tls_connection *conn,
2979                                const char *cert_id,
2980                                X509 **cert)
2981 {
2982         /* this runs after the private key is loaded so no PIN is required */
2983         struct {
2984                 const char *cert_id;
2985                 X509 *cert;
2986         } params;
2987         params.cert_id = cert_id;
2988         params.cert = NULL;
2989
2990         if (!ENGINE_ctrl_cmd(conn->engine, "LOAD_CERT_CTRL",
2991                              0, &params, NULL, 1)) {
2992                 unsigned long err = ERR_get_error();
2993
2994                 wpa_printf(MSG_ERROR, "ENGINE: cannot load client cert with id"
2995                            " '%s' [%s]", cert_id,
2996                            ERR_error_string(err, NULL));
2997                 if (tls_is_pin_error(err))
2998                         return TLS_SET_PARAMS_ENGINE_PRV_BAD_PIN;
2999                 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
3000         }
3001         if (!params.cert) {
3002                 wpa_printf(MSG_ERROR, "ENGINE: did not properly cert with id"
3003                            " '%s'", cert_id);
3004                 return TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED;
3005         }
3006         *cert = params.cert;
3007         return 0;
3008 }
3009 #endif /* OPENSSL_NO_ENGINE */
3010
3011
3012 static int tls_connection_engine_client_cert(struct tls_connection *conn,
3013                                              const char *cert_id)
3014 {
3015 #ifndef OPENSSL_NO_ENGINE
3016         X509 *cert;
3017
3018         if (tls_engine_get_cert(conn, cert_id, &cert))
3019                 return -1;
3020
3021         if (!SSL_use_certificate(conn->ssl, cert)) {
3022                 tls_show_errors(MSG_ERROR, __func__,
3023                                 "SSL_use_certificate failed");
3024                 X509_free(cert);
3025                 return -1;
3026         }
3027         X509_free(cert);
3028         wpa_printf(MSG_DEBUG, "ENGINE: SSL_use_certificate --> "
3029                    "OK");
3030         return 0;
3031
3032 #else /* OPENSSL_NO_ENGINE */
3033         return -1;
3034 #endif /* OPENSSL_NO_ENGINE */
3035 }
3036
3037
3038 static int tls_connection_engine_ca_cert(struct tls_data *data,
3039                                          struct tls_connection *conn,
3040                                          const char *ca_cert_id)
3041 {
3042 #ifndef OPENSSL_NO_ENGINE
3043         X509 *cert;
3044         SSL_CTX *ssl_ctx = data->ssl;
3045         X509_STORE *store;
3046
3047         if (tls_engine_get_cert(conn, ca_cert_id, &cert))
3048                 return -1;
3049
3050         /* start off the same as tls_connection_ca_cert */
3051         store = X509_STORE_new();
3052         if (store == NULL) {
3053                 wpa_printf(MSG_DEBUG, "OpenSSL: %s - failed to allocate new "
3054                            "certificate store", __func__);
3055                 X509_free(cert);
3056                 return -1;
3057         }
3058         SSL_CTX_set_cert_store(ssl_ctx, store);
3059         if (!X509_STORE_add_cert(store, cert)) {
3060                 unsigned long err = ERR_peek_error();
3061                 tls_show_errors(MSG_WARNING, __func__,
3062                                 "Failed to add CA certificate from engine "
3063                                 "to certificate store");
3064                 if (ERR_GET_LIB(err) == ERR_LIB_X509 &&
3065                     ERR_GET_REASON(err) == X509_R_CERT_ALREADY_IN_HASH_TABLE) {
3066                         wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring cert"
3067                                    " already in hash table error",
3068                                    __func__);
3069                 } else {
3070                         X509_free(cert);
3071                         return -1;
3072                 }
3073         }
3074         X509_free(cert);
3075         wpa_printf(MSG_DEBUG, "OpenSSL: %s - added CA certificate from engine "
3076                    "to certificate store", __func__);
3077         SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);
3078         conn->ca_cert_verify = 1;
3079
3080         return 0;
3081
3082 #else /* OPENSSL_NO_ENGINE */
3083         return -1;
3084 #endif /* OPENSSL_NO_ENGINE */
3085 }
3086
3087
3088 static int tls_connection_engine_private_key(struct tls_connection *conn)
3089 {
3090 #if defined(ANDROID) || !defined(OPENSSL_NO_ENGINE)
3091         if (SSL_use_PrivateKey(conn->ssl, conn->private_key) != 1) {
3092                 tls_show_errors(MSG_ERROR, __func__,
3093                                 "ENGINE: cannot use private key for TLS");
3094                 return -1;
3095         }
3096         if (!SSL_check_private_key(conn->ssl)) {
3097                 tls_show_errors(MSG_INFO, __func__,
3098                                 "Private key failed verification");
3099                 return -1;
3100         }
3101         return 0;
3102 #else /* OPENSSL_NO_ENGINE */
3103         wpa_printf(MSG_ERROR, "SSL: Configuration uses engine, but "
3104                    "engine support was not compiled in");
3105         return -1;
3106 #endif /* OPENSSL_NO_ENGINE */
3107 }
3108
3109
3110 #ifndef OPENSSL_NO_STDIO
3111 static int tls_passwd_cb(char *buf, int size, int rwflag, void *password)
3112 {
3113         if (!password)
3114                 return 0;
3115         os_strlcpy(buf, (const char *) password, size);
3116         return os_strlen(buf);
3117 }
3118 #endif /* OPENSSL_NO_STDIO */
3119
3120
3121 static int tls_use_private_key_file(struct tls_data *data, SSL *ssl,
3122                                     const char *private_key,
3123                                     const char *private_key_passwd)
3124 {
3125 #ifndef OPENSSL_NO_STDIO
3126         BIO *bio;
3127         EVP_PKEY *pkey;
3128         int ret;
3129
3130         /* First try ASN.1 (DER). */
3131         bio = BIO_new_file(private_key, "r");
3132         if (!bio)
3133                 return -1;
3134         pkey = d2i_PrivateKey_bio(bio, NULL);
3135         BIO_free(bio);
3136
3137         if (pkey) {
3138                 wpa_printf(MSG_DEBUG, "OpenSSL: %s (DER) --> loaded", __func__);
3139         } else {
3140                 /* Try PEM with the provided password. */
3141                 bio = BIO_new_file(private_key, "r");
3142                 if (!bio)
3143                         return -1;
3144                 pkey = PEM_read_bio_PrivateKey(bio, NULL, tls_passwd_cb,
3145                                                (void *) private_key_passwd);
3146                 BIO_free(bio);
3147                 if (!pkey)
3148                         return -1;
3149                 wpa_printf(MSG_DEBUG, "OpenSSL: %s (PEM) --> loaded", __func__);
3150                 /* Clear errors from the previous failed load. */
3151                 ERR_clear_error();
3152         }
3153
3154         if (ssl)
3155                 ret = SSL_use_PrivateKey(ssl, pkey);
3156         else
3157                 ret = SSL_CTX_use_PrivateKey(data->ssl, pkey);
3158
3159         EVP_PKEY_free(pkey);
3160         return ret == 1 ? 0 : -1;
3161 #else /* OPENSSL_NO_STDIO */
3162         wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO", __func__);
3163         return -1;
3164 #endif /* OPENSSL_NO_STDIO */
3165 }
3166
3167
3168 static int tls_connection_private_key(struct tls_data *data,
3169                                       struct tls_connection *conn,
3170                                       const char *private_key,
3171                                       const char *private_key_passwd,
3172                                       const u8 *private_key_blob,
3173                                       size_t private_key_blob_len)
3174 {
3175         int ok;
3176
3177         if (private_key == NULL && private_key_blob == NULL)
3178                 return 0;
3179
3180         ok = 0;
3181         while (private_key_blob) {
3182                 if (SSL_use_PrivateKey_ASN1(EVP_PKEY_RSA, conn->ssl,
3183                                             (u8 *) private_key_blob,
3184                                             private_key_blob_len) == 1) {
3185                         wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_PrivateKey_"
3186                                    "ASN1(EVP_PKEY_RSA) --> OK");
3187                         ok = 1;
3188                         break;
3189                 }
3190
3191                 if (SSL_use_PrivateKey_ASN1(EVP_PKEY_DSA, conn->ssl,
3192                                             (u8 *) private_key_blob,
3193                                             private_key_blob_len) == 1) {
3194                         wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_PrivateKey_"
3195                                    "ASN1(EVP_PKEY_DSA) --> OK");
3196                         ok = 1;
3197                         break;
3198                 }
3199
3200                 if (SSL_use_RSAPrivateKey_ASN1(conn->ssl,
3201                                                (u8 *) private_key_blob,
3202                                                private_key_blob_len) == 1) {
3203                         wpa_printf(MSG_DEBUG, "OpenSSL: "
3204                                    "SSL_use_RSAPrivateKey_ASN1 --> OK");
3205                         ok = 1;
3206                         break;
3207                 }
3208
3209                 if (tls_read_pkcs12_blob(data, conn->ssl, private_key_blob,
3210                                          private_key_blob_len,
3211                                          private_key_passwd) == 0) {
3212                         wpa_printf(MSG_DEBUG, "OpenSSL: PKCS#12 as blob --> "
3213                                    "OK");
3214                         ok = 1;
3215                         break;
3216                 }
3217
3218                 break;
3219         }
3220
3221         while (!ok && private_key) {
3222                 if (tls_use_private_key_file(data, conn->ssl, private_key,
3223                                              private_key_passwd) == 0) {
3224                         ok = 1;
3225                         break;
3226                 }
3227
3228                 if (tls_read_pkcs12(data, conn->ssl, private_key,
3229                                     private_key_passwd) == 0) {
3230                         wpa_printf(MSG_DEBUG, "OpenSSL: Reading PKCS#12 file "
3231                                    "--> OK");
3232                         ok = 1;
3233                         break;
3234                 }
3235
3236                 if (tls_cryptoapi_cert(conn->ssl, private_key) == 0) {
3237                         wpa_printf(MSG_DEBUG, "OpenSSL: Using CryptoAPI to "
3238                                    "access certificate store --> OK");
3239                         ok = 1;
3240                         break;
3241                 }
3242
3243                 break;
3244         }
3245
3246         if (!ok) {
3247                 tls_show_errors(MSG_INFO, __func__,
3248                                 "Failed to load private key");
3249                 return -1;
3250         }
3251         ERR_clear_error();
3252
3253         if (!SSL_check_private_key(conn->ssl)) {
3254                 tls_show_errors(MSG_INFO, __func__, "Private key failed "
3255                                 "verification");
3256                 return -1;
3257         }
3258
3259         wpa_printf(MSG_DEBUG, "SSL: Private key loaded successfully");
3260         return 0;
3261 }
3262
3263
3264 static int tls_global_private_key(struct tls_data *data,
3265                                   const char *private_key,
3266                                   const char *private_key_passwd)
3267 {
3268         SSL_CTX *ssl_ctx = data->ssl;
3269
3270         if (private_key == NULL)
3271                 return 0;
3272
3273         if (tls_use_private_key_file(data, NULL, private_key,
3274                                      private_key_passwd) &&
3275             tls_read_pkcs12(data, NULL, private_key, private_key_passwd)) {
3276                 tls_show_errors(MSG_INFO, __func__,
3277                                 "Failed to load private key");
3278                 ERR_clear_error();
3279                 return -1;
3280         }
3281         ERR_clear_error();
3282
3283         if (!SSL_CTX_check_private_key(ssl_ctx)) {
3284                 tls_show_errors(MSG_INFO, __func__,
3285                                 "Private key failed verification");
3286                 return -1;
3287         }
3288
3289         return 0;
3290 }
3291
3292
3293 static int tls_connection_dh(struct tls_connection *conn, const char *dh_file)
3294 {
3295 #ifdef OPENSSL_NO_DH
3296         if (dh_file == NULL)
3297                 return 0;
3298         wpa_printf(MSG_ERROR, "TLS: openssl does not include DH support, but "
3299                    "dh_file specified");
3300         return -1;
3301 #else /* OPENSSL_NO_DH */
3302         DH *dh;
3303         BIO *bio;
3304
3305         /* TODO: add support for dh_blob */
3306         if (dh_file == NULL)
3307                 return 0;
3308         if (conn == NULL)
3309                 return -1;
3310
3311         bio = BIO_new_file(dh_file, "r");
3312         if (bio == NULL) {
3313                 wpa_printf(MSG_INFO, "TLS: Failed to open DH file '%s': %s",
3314                            dh_file, ERR_error_string(ERR_get_error(), NULL));
3315                 return -1;
3316         }
3317         dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
3318         BIO_free(bio);
3319 #ifndef OPENSSL_NO_DSA
3320         while (dh == NULL) {
3321                 DSA *dsa;
3322                 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DH file '%s': %s -"
3323                            " trying to parse as DSA params", dh_file,
3324                            ERR_error_string(ERR_get_error(), NULL));
3325                 bio = BIO_new_file(dh_file, "r");
3326                 if (bio == NULL)
3327                         break;
3328                 dsa = PEM_read_bio_DSAparams(bio, NULL, NULL, NULL);
3329                 BIO_free(bio);
3330                 if (!dsa) {
3331                         wpa_printf(MSG_DEBUG, "TLS: Failed to parse DSA file "
3332                                    "'%s': %s", dh_file,
3333                                    ERR_error_string(ERR_get_error(), NULL));
3334                         break;
3335                 }
3336
3337                 wpa_printf(MSG_DEBUG, "TLS: DH file in DSA param format");
3338                 dh = DSA_dup_DH(dsa);
3339                 DSA_free(dsa);
3340                 if (dh == NULL) {
3341                         wpa_printf(MSG_INFO, "TLS: Failed to convert DSA "
3342                                    "params into DH params");
3343                         break;
3344                 }
3345                 break;
3346         }
3347 #endif /* !OPENSSL_NO_DSA */
3348         if (dh == NULL) {
3349                 wpa_printf(MSG_INFO, "TLS: Failed to read/parse DH/DSA file "
3350                            "'%s'", dh_file);
3351                 return -1;
3352         }
3353
3354         if (SSL_set_tmp_dh(conn->ssl, dh) != 1) {
3355                 wpa_printf(MSG_INFO, "TLS: Failed to set DH params from '%s': "
3356                            "%s", dh_file,
3357                            ERR_error_string(ERR_get_error(), NULL));
3358                 DH_free(dh);
3359                 return -1;
3360         }
3361         DH_free(dh);
3362         return 0;
3363 #endif /* OPENSSL_NO_DH */
3364 }
3365
3366
3367 static int tls_global_dh(struct tls_data *data, const char *dh_file)
3368 {
3369 #ifdef OPENSSL_NO_DH
3370         if (dh_file == NULL)
3371                 return 0;
3372         wpa_printf(MSG_ERROR, "TLS: openssl does not include DH support, but "
3373                    "dh_file specified");
3374         return -1;
3375 #else /* OPENSSL_NO_DH */
3376         SSL_CTX *ssl_ctx = data->ssl;
3377         DH *dh;
3378         BIO *bio;
3379
3380         /* TODO: add support for dh_blob */
3381         if (dh_file == NULL)
3382                 return 0;
3383         if (ssl_ctx == NULL)
3384                 return -1;
3385
3386         bio = BIO_new_file(dh_file, "r");
3387         if (bio == NULL) {
3388                 wpa_printf(MSG_INFO, "TLS: Failed to open DH file '%s': %s",
3389                            dh_file, ERR_error_string(ERR_get_error(), NULL));
3390                 return -1;
3391         }
3392         dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
3393         BIO_free(bio);
3394 #ifndef OPENSSL_NO_DSA
3395         while (dh == NULL) {
3396                 DSA *dsa;
3397                 wpa_printf(MSG_DEBUG, "TLS: Failed to parse DH file '%s': %s -"
3398                            " trying to parse as DSA params", dh_file,
3399                            ERR_error_string(ERR_get_error(), NULL));
3400                 bio = BIO_new_file(dh_file, "r");
3401                 if (bio == NULL)
3402                         break;
3403                 dsa = PEM_read_bio_DSAparams(bio, NULL, NULL, NULL);
3404                 BIO_free(bio);
3405                 if (!dsa) {
3406                         wpa_printf(MSG_DEBUG, "TLS: Failed to parse DSA file "
3407                                    "'%s': %s", dh_file,
3408                                    ERR_error_string(ERR_get_error(), NULL));
3409                         break;
3410                 }
3411
3412                 wpa_printf(MSG_DEBUG, "TLS: DH file in DSA param format");
3413                 dh = DSA_dup_DH(dsa);
3414                 DSA_free(dsa);
3415                 if (dh == NULL) {
3416                         wpa_printf(MSG_INFO, "TLS: Failed to convert DSA "
3417                                    "params into DH params");
3418                         break;
3419                 }
3420                 break;
3421         }
3422 #endif /* !OPENSSL_NO_DSA */
3423         if (dh == NULL) {
3424                 wpa_printf(MSG_INFO, "TLS: Failed to read/parse DH/DSA file "
3425                            "'%s'", dh_file);
3426                 return -1;
3427         }
3428
3429         if (SSL_CTX_set_tmp_dh(ssl_ctx, dh) != 1) {
3430                 wpa_printf(MSG_INFO, "TLS: Failed to set DH params from '%s': "
3431                            "%s", dh_file,
3432                            ERR_error_string(ERR_get_error(), NULL));
3433                 DH_free(dh);
3434                 return -1;
3435         }
3436         DH_free(dh);
3437         return 0;
3438 #endif /* OPENSSL_NO_DH */
3439 }
3440
3441
3442 int tls_connection_get_random(void *ssl_ctx, struct tls_connection *conn,
3443                               struct tls_random *keys)
3444 {
3445         SSL *ssl;
3446
3447         if (conn == NULL || keys == NULL)
3448                 return -1;
3449         ssl = conn->ssl;
3450         if (ssl == NULL)
3451                 return -1;
3452
3453         os_memset(keys, 0, sizeof(*keys));
3454         keys->client_random = conn->client_random;
3455         keys->client_random_len = SSL_get_client_random(
3456                 ssl, conn->client_random, sizeof(conn->client_random));
3457         keys->server_random = conn->server_random;
3458         keys->server_random_len = SSL_get_server_random(
3459                 ssl, conn->server_random, sizeof(conn->server_random));
3460
3461         return 0;
3462 }
3463
3464
3465 #ifdef OPENSSL_NEED_EAP_FAST_PRF
3466 static int openssl_get_keyblock_size(SSL *ssl)
3467 {
3468 #if OPENSSL_VERSION_NUMBER < 0x10100000L || \
3469         (defined(LIBRESSL_VERSION_NUMBER) && \
3470          LIBRESSL_VERSION_NUMBER < 0x20700000L)
3471         const EVP_CIPHER *c;
3472         const EVP_MD *h;
3473         int md_size;
3474
3475         if (ssl->enc_read_ctx == NULL || ssl->enc_read_ctx->cipher == NULL ||
3476             ssl->read_hash == NULL)
3477                 return -1;
3478
3479         c = ssl->enc_read_ctx->cipher;
3480         h = EVP_MD_CTX_md(ssl->read_hash);
3481         if (h)
3482                 md_size = EVP_MD_size(h);
3483         else if (ssl->s3)
3484                 md_size = ssl->s3->tmp.new_mac_secret_size;
3485         else
3486                 return -1;
3487
3488         wpa_printf(MSG_DEBUG, "OpenSSL: keyblock size: key_len=%d MD_size=%d "
3489                    "IV_len=%d", EVP_CIPHER_key_length(c), md_size,
3490                    EVP_CIPHER_iv_length(c));
3491         return 2 * (EVP_CIPHER_key_length(c) +
3492                     md_size +
3493                     EVP_CIPHER_iv_length(c));
3494 #else
3495         const SSL_CIPHER *ssl_cipher;
3496         int cipher, digest;
3497         const EVP_CIPHER *c;
3498         const EVP_MD *h;
3499
3500         ssl_cipher = SSL_get_current_cipher(ssl);
3501         if (!ssl_cipher)
3502                 return -1;
3503         cipher = SSL_CIPHER_get_cipher_nid(ssl_cipher);
3504         digest = SSL_CIPHER_get_digest_nid(ssl_cipher);
3505         wpa_printf(MSG_DEBUG, "OpenSSL: cipher nid %d digest nid %d",
3506                    cipher, digest);
3507         if (cipher < 0 || digest < 0)
3508                 return -1;
3509         c = EVP_get_cipherbynid(cipher);
3510         h = EVP_get_digestbynid(digest);
3511         if (!c || !h)
3512                 return -1;
3513
3514         wpa_printf(MSG_DEBUG,
3515                    "OpenSSL: keyblock size: key_len=%d MD_size=%d IV_len=%d",
3516                    EVP_CIPHER_key_length(c), EVP_MD_size(h),
3517                    EVP_CIPHER_iv_length(c));
3518         return 2 * (EVP_CIPHER_key_length(c) + EVP_MD_size(h) +
3519                     EVP_CIPHER_iv_length(c));
3520 #endif
3521 }
3522 #endif /* OPENSSL_NEED_EAP_FAST_PRF */
3523
3524
3525 int tls_connection_export_key(void *tls_ctx, struct tls_connection *conn,
3526                               const char *label, u8 *out, size_t out_len)
3527 {
3528         if (!conn ||
3529             SSL_export_keying_material(conn->ssl, out, out_len, label,
3530                                        os_strlen(label), NULL, 0, 0) != 1)
3531                 return -1;
3532         return 0;
3533 }
3534
3535
3536 int tls_connection_get_eap_fast_key(void *tls_ctx, struct tls_connection *conn,
3537                                     u8 *out, size_t out_len)
3538 {
3539 #ifdef OPENSSL_NEED_EAP_FAST_PRF
3540         SSL *ssl;
3541         SSL_SESSION *sess;
3542         u8 *rnd;
3543         int ret = -1;
3544         int skip = 0;
3545         u8 *tmp_out = NULL;
3546         u8 *_out = out;
3547         unsigned char client_random[SSL3_RANDOM_SIZE];
3548         unsigned char server_random[SSL3_RANDOM_SIZE];
3549         unsigned char master_key[64];
3550         size_t master_key_len;
3551         const char *ver;
3552
3553         /*
3554          * TLS library did not support EAP-FAST key generation, so get the
3555          * needed TLS session parameters and use an internal implementation of
3556          * TLS PRF to derive the key.
3557          */
3558
3559         if (conn == NULL)
3560                 return -1;
3561         ssl = conn->ssl;
3562         if (ssl == NULL)
3563                 return -1;
3564         ver = SSL_get_version(ssl);
3565         sess = SSL_get_session(ssl);
3566         if (!ver || !sess)
3567                 return -1;
3568
3569         skip = openssl_get_keyblock_size(ssl);
3570         if (skip < 0)
3571                 return -1;
3572         tmp_out = os_malloc(skip + out_len);
3573         if (!tmp_out)
3574                 return -1;
3575         _out = tmp_out;
3576
3577         rnd = os_malloc(2 * SSL3_RANDOM_SIZE);
3578         if (!rnd) {
3579                 os_free(tmp_out);
3580                 return -1;
3581         }
3582
3583         SSL_get_client_random(ssl, client_random, sizeof(client_random));
3584         SSL_get_server_random(ssl, server_random, sizeof(server_random));
3585         master_key_len = SSL_SESSION_get_master_key(sess, master_key,
3586                                                     sizeof(master_key));
3587
3588         os_memcpy(rnd, server_random, SSL3_RANDOM_SIZE);
3589         os_memcpy(rnd + SSL3_RANDOM_SIZE, client_random, SSL3_RANDOM_SIZE);
3590
3591         if (os_strcmp(ver, "TLSv1.2") == 0) {
3592                 tls_prf_sha256(master_key, master_key_len,
3593                                "key expansion", rnd, 2 * SSL3_RANDOM_SIZE,
3594                                _out, skip + out_len);
3595                 ret = 0;
3596         } else if (tls_prf_sha1_md5(master_key, master_key_len,
3597                                     "key expansion", rnd, 2 * SSL3_RANDOM_SIZE,
3598                                     _out, skip + out_len) == 0) {
3599                 ret = 0;
3600         }
3601         os_memset(master_key, 0, sizeof(master_key));
3602         os_free(rnd);
3603         if (ret == 0)
3604                 os_memcpy(out, _out + skip, out_len);
3605         bin_clear_free(tmp_out, skip);
3606
3607         return ret;
3608 #else /* OPENSSL_NEED_EAP_FAST_PRF */
3609         wpa_printf(MSG_ERROR,
3610                    "OpenSSL: EAP-FAST keys cannot be exported in FIPS mode");
3611         return -1;
3612 #endif /* OPENSSL_NEED_EAP_FAST_PRF */
3613 }
3614
3615
3616 static struct wpabuf *
3617 openssl_handshake(struct tls_connection *conn, const struct wpabuf *in_data)
3618 {
3619         int res;
3620         struct wpabuf *out_data;
3621
3622         /*
3623          * Give TLS handshake data from the server (if available) to OpenSSL
3624          * for processing.
3625          */
3626         if (in_data && wpabuf_len(in_data) > 0 &&
3627             BIO_write(conn->ssl_in, wpabuf_head(in_data), wpabuf_len(in_data))
3628             < 0) {
3629                 tls_show_errors(MSG_INFO, __func__,
3630                                 "Handshake failed - BIO_write");
3631                 return NULL;
3632         }
3633
3634         /* Initiate TLS handshake or continue the existing handshake */
3635         if (conn->server)
3636                 res = SSL_accept(conn->ssl);
3637         else
3638                 res = SSL_connect(conn->ssl);
3639         if (res != 1) {
3640                 int err = SSL_get_error(conn->ssl, res);
3641                 if (err == SSL_ERROR_WANT_READ)
3642                         wpa_printf(MSG_DEBUG, "SSL: SSL_connect - want "
3643                                    "more data");
3644                 else if (err == SSL_ERROR_WANT_WRITE)
3645                         wpa_printf(MSG_DEBUG, "SSL: SSL_connect - want to "
3646                                    "write");
3647                 else {
3648                         tls_show_errors(MSG_INFO, __func__, "SSL_connect");
3649                         conn->failed++;
3650                         if (!conn->server && !conn->client_hello_generated) {
3651                                 /* The server would not understand TLS Alert
3652                                  * before ClientHello, so simply terminate
3653                                  * handshake on this type of error case caused
3654                                  * by a likely internal error like no ciphers
3655                                  * available. */
3656                                 wpa_printf(MSG_DEBUG,
3657                                            "OpenSSL: Could not generate ClientHello");
3658                                 conn->write_alerts++;
3659                                 return NULL;
3660                         }
3661                 }
3662         }
3663
3664         if (!conn->server && !conn->failed)
3665                 conn->client_hello_generated = 1;
3666
3667 #ifdef CONFIG_SUITEB
3668         if ((conn->flags & TLS_CONN_SUITEB) && !conn->server &&
3669             os_strncmp(SSL_get_cipher(conn->ssl), "DHE-", 4) == 0 &&
3670             conn->server_dh_prime_len < 3072) {
3671                 struct tls_context *context = conn->context;
3672
3673                 /*
3674                  * This should not be reached since earlier cert_cb should have
3675                  * terminated the handshake. Keep this check here for extra
3676                  * protection if anything goes wrong with the more low-level
3677                  * checks based on having to parse the TLS handshake messages.
3678                  */
3679                 wpa_printf(MSG_DEBUG,
3680                            "OpenSSL: Server DH prime length: %d bits",
3681                            conn->server_dh_prime_len);
3682
3683                 if (context->event_cb) {
3684                         union tls_event_data ev;
3685
3686                         os_memset(&ev, 0, sizeof(ev));
3687                         ev.alert.is_local = 1;
3688                         ev.alert.type = "fatal";
3689                         ev.alert.description = "insufficient security";
3690                         context->event_cb(context->cb_ctx, TLS_ALERT, &ev);
3691                 }
3692                 /*
3693                  * Could send a TLS Alert to the server, but for now, simply
3694                  * terminate handshake.
3695                  */
3696                 conn->failed++;
3697                 conn->write_alerts++;
3698                 return NULL;
3699         }
3700 #endif /* CONFIG_SUITEB */
3701
3702         /* Get the TLS handshake data to be sent to the server */
3703         res = BIO_ctrl_pending(conn->ssl_out);
3704         wpa_printf(MSG_DEBUG, "SSL: %d bytes pending from ssl_out", res);
3705         out_data = wpabuf_alloc(res);
3706         if (out_data == NULL) {
3707                 wpa_printf(MSG_DEBUG, "SSL: Failed to allocate memory for "
3708                            "handshake output (%d bytes)", res);
3709                 if (BIO_reset(conn->ssl_out) < 0) {
3710                         tls_show_errors(MSG_INFO, __func__,
3711                                         "BIO_reset failed");
3712                 }
3713                 return NULL;
3714         }
3715         res = res == 0 ? 0 : BIO_read(conn->ssl_out, wpabuf_mhead(out_data),
3716                                       res);
3717         if (res < 0) {
3718                 tls_show_errors(MSG_INFO, __func__,
3719                                 "Handshake failed - BIO_read");
3720                 if (BIO_reset(conn->ssl_out) < 0) {
3721                         tls_show_errors(MSG_INFO, __func__,
3722                                         "BIO_reset failed");
3723                 }
3724                 wpabuf_free(out_data);
3725                 return NULL;
3726         }
3727         wpabuf_put(out_data, res);
3728
3729         return out_data;
3730 }
3731
3732
3733 static struct wpabuf *
3734 openssl_get_appl_data(struct tls_connection *conn, size_t max_len)
3735 {
3736         struct wpabuf *appl_data;
3737         int res;
3738
3739         appl_data = wpabuf_alloc(max_len + 100);
3740         if (appl_data == NULL)
3741                 return NULL;
3742
3743         res = SSL_read(conn->ssl, wpabuf_mhead(appl_data),
3744                        wpabuf_size(appl_data));
3745         if (res < 0) {
3746                 int err = SSL_get_error(conn->ssl, res);
3747                 if (err == SSL_ERROR_WANT_READ ||
3748                     err == SSL_ERROR_WANT_WRITE) {
3749                         wpa_printf(MSG_DEBUG, "SSL: No Application Data "
3750                                    "included");
3751                 } else {
3752                         tls_show_errors(MSG_INFO, __func__,
3753                                         "Failed to read possible "
3754                                         "Application Data");
3755                 }
3756                 wpabuf_free(appl_data);
3757                 return NULL;
3758         }
3759
3760         wpabuf_put(appl_data, res);
3761         wpa_hexdump_buf_key(MSG_MSGDUMP, "SSL: Application Data in Finished "
3762                             "message", appl_data);
3763
3764         return appl_data;
3765 }
3766
3767
3768 static struct wpabuf *
3769 openssl_connection_handshake(struct tls_connection *conn,
3770                              const struct wpabuf *in_data,
3771                              struct wpabuf **appl_data)
3772 {
3773         struct wpabuf *out_data;
3774
3775         if (appl_data)
3776                 *appl_data = NULL;
3777
3778         out_data = openssl_handshake(conn, in_data);
3779         if (out_data == NULL)
3780                 return NULL;
3781         if (conn->invalid_hb_used) {
3782                 wpa_printf(MSG_INFO, "TLS: Heartbeat attack detected - do not send response");
3783                 wpabuf_free(out_data);
3784                 return NULL;
3785         }
3786
3787         if (SSL_is_init_finished(conn->ssl)) {
3788                 wpa_printf(MSG_DEBUG,
3789                            "OpenSSL: Handshake finished - resumed=%d",
3790                            tls_connection_resumed(conn->ssl_ctx, conn));
3791                 if (appl_data && in_data)
3792                         *appl_data = openssl_get_appl_data(conn,
3793                                                            wpabuf_len(in_data));
3794         }
3795
3796         if (conn->invalid_hb_used) {
3797                 wpa_printf(MSG_INFO, "TLS: Heartbeat attack detected - do not send response");
3798                 if (appl_data) {
3799                         wpabuf_free(*appl_data);
3800                         *appl_data = NULL;
3801                 }
3802                 wpabuf_free(out_data);
3803                 return NULL;
3804         }
3805
3806         return out_data;
3807 }
3808
3809
3810 struct wpabuf *
3811 tls_connection_handshake(void *ssl_ctx, struct tls_connection *conn,
3812                          const struct wpabuf *in_data,
3813                          struct wpabuf **appl_data)
3814 {
3815         return openssl_connection_handshake(conn, in_data, appl_data);
3816 }
3817
3818
3819 struct wpabuf * tls_connection_server_handshake(void *tls_ctx,
3820                                                 struct tls_connection *conn,
3821                                                 const struct wpabuf *in_data,
3822                                                 struct wpabuf **appl_data)
3823 {
3824         conn->server = 1;
3825         return openssl_connection_handshake(conn, in_data, appl_data);
3826 }
3827
3828
3829 struct wpabuf * tls_connection_encrypt(void *tls_ctx,
3830                                        struct tls_connection *conn,
3831                                        const struct wpabuf *in_data)
3832 {
3833         int res;
3834         struct wpabuf *buf;
3835
3836         if (conn == NULL)
3837                 return NULL;
3838
3839         /* Give plaintext data for OpenSSL to encrypt into the TLS tunnel. */
3840         if ((res = BIO_reset(conn->ssl_in)) < 0 ||
3841             (res = BIO_reset(conn->ssl_out)) < 0) {
3842                 tls_show_errors(MSG_INFO, __func__, "BIO_reset failed");
3843                 return NULL;
3844         }
3845         res = SSL_write(conn->ssl, wpabuf_head(in_data), wpabuf_len(in_data));
3846         if (res < 0) {
3847                 tls_show_errors(MSG_INFO, __func__,
3848                                 "Encryption failed - SSL_write");
3849                 return NULL;
3850         }
3851
3852         /* Read encrypted data to be sent to the server */
3853         buf = wpabuf_alloc(wpabuf_len(in_data) + 300);
3854         if (buf == NULL)
3855                 return NULL;
3856         res = BIO_read(conn->ssl_out, wpabuf_mhead(buf), wpabuf_size(buf));
3857         if (res < 0) {
3858                 tls_show_errors(MSG_INFO, __func__,
3859                                 "Encryption failed - BIO_read");
3860                 wpabuf_free(buf);
3861                 return NULL;
3862         }
3863         wpabuf_put(buf, res);
3864
3865         return buf;
3866 }
3867
3868
3869 struct wpabuf * tls_connection_decrypt(void *tls_ctx,
3870                                        struct tls_connection *conn,
3871                                        const struct wpabuf *in_data)
3872 {
3873         int res;
3874         struct wpabuf *buf;
3875
3876         /* Give encrypted data from TLS tunnel for OpenSSL to decrypt. */
3877         res = BIO_write(conn->ssl_in, wpabuf_head(in_data),
3878                         wpabuf_len(in_data));
3879         if (res < 0) {
3880                 tls_show_errors(MSG_INFO, __func__,
3881                                 "Decryption failed - BIO_write");
3882                 return NULL;
3883         }
3884         if (BIO_reset(conn->ssl_out) < 0) {
3885                 tls_show_errors(MSG_INFO, __func__, "BIO_reset failed");
3886                 return NULL;
3887         }
3888
3889         /* Read decrypted data for further processing */
3890         /*
3891          * Even though we try to disable TLS compression, it is possible that
3892          * this cannot be done with all TLS libraries. Add extra buffer space
3893          * to handle the possibility of the decrypted data being longer than
3894          * input data.
3895          */
3896         buf = wpabuf_alloc((wpabuf_len(in_data) + 500) * 3);
3897         if (buf == NULL)
3898                 return NULL;
3899         res = SSL_read(conn->ssl, wpabuf_mhead(buf), wpabuf_size(buf));
3900         if (res < 0) {
3901                 tls_show_errors(MSG_INFO, __func__,
3902                                 "Decryption failed - SSL_read");
3903                 wpabuf_free(buf);
3904                 return NULL;
3905         }
3906         wpabuf_put(buf, res);
3907
3908         if (conn->invalid_hb_used) {
3909                 wpa_printf(MSG_INFO, "TLS: Heartbeat attack detected - do not send response");
3910                 wpabuf_free(buf);
3911                 return NULL;
3912         }
3913
3914         return buf;
3915 }
3916
3917
3918 int tls_connection_resumed(void *ssl_ctx, struct tls_connection *conn)
3919 {
3920         return conn ? SSL_session_reused(conn->ssl) : 0;
3921 }
3922
3923
3924 int tls_connection_set_cipher_list(void *tls_ctx, struct tls_connection *conn,
3925                                    u8 *ciphers)
3926 {
3927         char buf[500], *pos, *end;
3928         u8 *c;
3929         int ret;
3930
3931         if (conn == NULL || conn->ssl == NULL || ciphers == NULL)
3932                 return -1;
3933
3934         buf[0] = '\0';
3935         pos = buf;
3936         end = pos + sizeof(buf);
3937
3938         c = ciphers;
3939         while (*c != TLS_CIPHER_NONE) {
3940                 const char *suite;
3941
3942                 switch (*c) {
3943                 case TLS_CIPHER_RC4_SHA:
3944                         suite = "RC4-SHA";
3945                         break;
3946                 case TLS_CIPHER_AES128_SHA:
3947                         suite = "AES128-SHA";
3948                         break;
3949                 case TLS_CIPHER_RSA_DHE_AES128_SHA:
3950                         suite = "DHE-RSA-AES128-SHA";
3951                         break;
3952                 case TLS_CIPHER_ANON_DH_AES128_SHA:
3953                         suite = "ADH-AES128-SHA";
3954                         break;
3955                 case TLS_CIPHER_RSA_DHE_AES256_SHA:
3956                         suite = "DHE-RSA-AES256-SHA";
3957                         break;
3958                 case TLS_CIPHER_AES256_SHA:
3959                         suite = "AES256-SHA";
3960                         break;
3961                 default:
3962                         wpa_printf(MSG_DEBUG, "TLS: Unsupported "
3963                                    "cipher selection: %d", *c);
3964                         return -1;
3965                 }
3966                 ret = os_snprintf(pos, end - pos, ":%s", suite);
3967                 if (os_snprintf_error(end - pos, ret))
3968                         break;
3969                 pos += ret;
3970
3971                 c++;
3972         }
3973
3974         wpa_printf(MSG_DEBUG, "OpenSSL: cipher suites: %s", buf + 1);
3975
3976 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
3977 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
3978         if (os_strstr(buf, ":ADH-")) {
3979                 /*
3980                  * Need to drop to security level 0 to allow anonymous
3981                  * cipher suites for EAP-FAST.
3982                  */
3983                 SSL_set_security_level(conn->ssl, 0);
3984         } else if (SSL_get_security_level(conn->ssl) == 0) {
3985                 /* Force at least security level 1 */
3986                 SSL_set_security_level(conn->ssl, 1);
3987         }
3988 #endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */
3989 #endif
3990
3991         if (SSL_set_cipher_list(conn->ssl, buf + 1) != 1) {
3992                 tls_show_errors(MSG_INFO, __func__,
3993                                 "Cipher suite configuration failed");
3994                 return -1;
3995         }
3996
3997         return 0;
3998 }
3999
4000
4001 int tls_get_version(void *ssl_ctx, struct tls_connection *conn,
4002                     char *buf, size_t buflen)
4003 {
4004         const char *name;
4005         if (conn == NULL || conn->ssl == NULL)
4006                 return -1;
4007
4008         name = SSL_get_version(conn->ssl);
4009         if (name == NULL)
4010                 return -1;
4011
4012         os_strlcpy(buf, name, buflen);
4013         return 0;
4014 }
4015
4016
4017 int tls_get_cipher(void *ssl_ctx, struct tls_connection *conn,
4018                    char *buf, size_t buflen)
4019 {
4020         const char *name;
4021         if (conn == NULL || conn->ssl == NULL)
4022                 return -1;
4023
4024         name = SSL_get_cipher(conn->ssl);
4025         if (name == NULL)
4026                 return -1;
4027
4028         os_strlcpy(buf, name, buflen);
4029         return 0;
4030 }
4031
4032
4033 int tls_connection_enable_workaround(void *ssl_ctx,
4034                                      struct tls_connection *conn)
4035 {
4036         SSL_set_options(conn->ssl, SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS);
4037
4038         return 0;
4039 }
4040
4041
4042 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
4043 /* ClientHello TLS extensions require a patch to openssl, so this function is
4044  * commented out unless explicitly needed for EAP-FAST in order to be able to
4045  * build this file with unmodified openssl. */
4046 int tls_connection_client_hello_ext(void *ssl_ctx, struct tls_connection *conn,
4047                                     int ext_type, const u8 *data,
4048                                     size_t data_len)
4049 {
4050         if (conn == NULL || conn->ssl == NULL || ext_type != 35)
4051                 return -1;
4052
4053         if (SSL_set_session_ticket_ext(conn->ssl, (void *) data,
4054                                        data_len) != 1)
4055                 return -1;
4056
4057         return 0;
4058 }
4059 #endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */
4060
4061
4062 int tls_connection_get_failed(void *ssl_ctx, struct tls_connection *conn)
4063 {
4064         if (conn == NULL)
4065                 return -1;
4066         return conn->failed;
4067 }
4068
4069
4070 int tls_connection_get_read_alerts(void *ssl_ctx, struct tls_connection *conn)
4071 {
4072         if (conn == NULL)
4073                 return -1;
4074         return conn->read_alerts;
4075 }
4076
4077
4078 int tls_connection_get_write_alerts(void *ssl_ctx, struct tls_connection *conn)
4079 {
4080         if (conn == NULL)
4081                 return -1;
4082         return conn->write_alerts;
4083 }
4084
4085
4086 #ifdef HAVE_OCSP
4087
4088 static void ocsp_debug_print_resp(OCSP_RESPONSE *rsp)
4089 {
4090 #ifndef CONFIG_NO_STDOUT_DEBUG
4091         BIO *out;
4092         size_t rlen;
4093         char *txt;
4094         int res;
4095
4096         if (wpa_debug_level > MSG_DEBUG)
4097                 return;
4098
4099         out = BIO_new(BIO_s_mem());
4100         if (!out)
4101                 return;
4102
4103         OCSP_RESPONSE_print(out, rsp, 0);
4104         rlen = BIO_ctrl_pending(out);
4105         txt = os_malloc(rlen + 1);
4106         if (!txt) {
4107                 BIO_free(out);
4108                 return;
4109         }
4110
4111         res = BIO_read(out, txt, rlen);
4112         if (res > 0) {
4113                 txt[res] = '\0';
4114                 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP Response\n%s", txt);
4115         }
4116         os_free(txt);
4117         BIO_free(out);
4118 #endif /* CONFIG_NO_STDOUT_DEBUG */
4119 }
4120
4121
4122 static void debug_print_cert(X509 *cert, const char *title)
4123 {
4124 #ifndef CONFIG_NO_STDOUT_DEBUG
4125         BIO *out;
4126         size_t rlen;
4127         char *txt;
4128         int res;
4129
4130         if (wpa_debug_level > MSG_DEBUG)
4131                 return;
4132
4133         out = BIO_new(BIO_s_mem());
4134         if (!out)
4135                 return;
4136
4137         X509_print(out, cert);
4138         rlen = BIO_ctrl_pending(out);
4139         txt = os_malloc(rlen + 1);
4140         if (!txt) {
4141                 BIO_free(out);
4142                 return;
4143         }
4144
4145         res = BIO_read(out, txt, rlen);
4146         if (res > 0) {
4147                 txt[res] = '\0';
4148                 wpa_printf(MSG_DEBUG, "OpenSSL: %s\n%s", title, txt);
4149         }
4150         os_free(txt);
4151
4152         BIO_free(out);
4153 #endif /* CONFIG_NO_STDOUT_DEBUG */
4154 }
4155
4156
4157 static int ocsp_resp_cb(SSL *s, void *arg)
4158 {
4159         struct tls_connection *conn = arg;
4160         const unsigned char *p;
4161         int len, status, reason, res;
4162         OCSP_RESPONSE *rsp;
4163         OCSP_BASICRESP *basic;
4164         OCSP_CERTID *id;
4165         ASN1_GENERALIZEDTIME *produced_at, *this_update, *next_update;
4166         X509_STORE *store;
4167         STACK_OF(X509) *certs = NULL;
4168
4169         len = SSL_get_tlsext_status_ocsp_resp(s, &p);
4170         if (!p) {
4171                 wpa_printf(MSG_DEBUG, "OpenSSL: No OCSP response received");
4172                 return (conn->flags & TLS_CONN_REQUIRE_OCSP) ? 0 : 1;
4173         }
4174
4175         wpa_hexdump(MSG_DEBUG, "OpenSSL: OCSP response", p, len);
4176
4177         rsp = d2i_OCSP_RESPONSE(NULL, &p, len);
4178         if (!rsp) {
4179                 wpa_printf(MSG_INFO, "OpenSSL: Failed to parse OCSP response");
4180                 return 0;
4181         }
4182
4183         ocsp_debug_print_resp(rsp);
4184
4185         status = OCSP_response_status(rsp);
4186         if (status != OCSP_RESPONSE_STATUS_SUCCESSFUL) {
4187                 wpa_printf(MSG_INFO, "OpenSSL: OCSP responder error %d (%s)",
4188                            status, OCSP_response_status_str(status));
4189                 return 0;
4190         }
4191
4192         basic = OCSP_response_get1_basic(rsp);
4193         if (!basic) {
4194                 wpa_printf(MSG_INFO, "OpenSSL: Could not find BasicOCSPResponse");
4195                 return 0;
4196         }
4197
4198         store = SSL_CTX_get_cert_store(conn->ssl_ctx);
4199         if (conn->peer_issuer) {
4200                 debug_print_cert(conn->peer_issuer, "Add OCSP issuer");
4201
4202                 if (X509_STORE_add_cert(store, conn->peer_issuer) != 1) {
4203                         tls_show_errors(MSG_INFO, __func__,
4204                                         "OpenSSL: Could not add issuer to certificate store");
4205                 }
4206                 certs = sk_X509_new_null();
4207                 if (certs) {
4208                         X509 *cert;
4209                         cert = X509_dup(conn->peer_issuer);
4210                         if (cert && !sk_X509_push(certs, cert)) {
4211                                 tls_show_errors(
4212                                         MSG_INFO, __func__,
4213                                         "OpenSSL: Could not add issuer to OCSP responder trust store");
4214                                 X509_free(cert);
4215                                 sk_X509_free(certs);
4216                                 certs = NULL;
4217                         }
4218                         if (certs && conn->peer_issuer_issuer) {
4219                                 cert = X509_dup(conn->peer_issuer_issuer);
4220                                 if (cert && !sk_X509_push(certs, cert)) {
4221                                         tls_show_errors(
4222                                                 MSG_INFO, __func__,
4223                                                 "OpenSSL: Could not add issuer's issuer to OCSP responder trust store");
4224                                         X509_free(cert);
4225                                 }
4226                         }
4227                 }
4228         }
4229
4230         status = OCSP_basic_verify(basic, certs, store, OCSP_TRUSTOTHER);
4231         sk_X509_pop_free(certs, X509_free);
4232         if (status <= 0) {
4233                 tls_show_errors(MSG_INFO, __func__,
4234                                 "OpenSSL: OCSP response failed verification");
4235                 OCSP_BASICRESP_free(basic);
4236                 OCSP_RESPONSE_free(rsp);
4237                 return 0;
4238         }
4239
4240         wpa_printf(MSG_DEBUG, "OpenSSL: OCSP response verification succeeded");
4241
4242         if (!conn->peer_cert) {
4243                 wpa_printf(MSG_DEBUG, "OpenSSL: Peer certificate not available for OCSP status check");
4244                 OCSP_BASICRESP_free(basic);
4245                 OCSP_RESPONSE_free(rsp);
4246                 return 0;
4247         }
4248
4249         if (!conn->peer_issuer) {
4250                 wpa_printf(MSG_DEBUG, "OpenSSL: Peer issuer certificate not available for OCSP status check");
4251                 OCSP_BASICRESP_free(basic);
4252                 OCSP_RESPONSE_free(rsp);
4253                 return 0;
4254         }
4255
4256         id = OCSP_cert_to_id(EVP_sha256(), conn->peer_cert, conn->peer_issuer);
4257         if (!id) {
4258                 wpa_printf(MSG_DEBUG,
4259                            "OpenSSL: Could not create OCSP certificate identifier (SHA256)");
4260                 OCSP_BASICRESP_free(basic);
4261                 OCSP_RESPONSE_free(rsp);
4262                 return 0;
4263         }
4264
4265         res = OCSP_resp_find_status(basic, id, &status, &reason, &produced_at,
4266                                     &this_update, &next_update);
4267         if (!res) {
4268                 id = OCSP_cert_to_id(NULL, conn->peer_cert, conn->peer_issuer);
4269                 if (!id) {
4270                         wpa_printf(MSG_DEBUG,
4271                                    "OpenSSL: Could not create OCSP certificate identifier (SHA1)");
4272                         OCSP_BASICRESP_free(basic);
4273                         OCSP_RESPONSE_free(rsp);
4274                         return 0;
4275                 }
4276
4277                 res = OCSP_resp_find_status(basic, id, &status, &reason,
4278                                             &produced_at, &this_update,
4279                                             &next_update);
4280         }
4281
4282         if (!res) {
4283                 wpa_printf(MSG_INFO, "OpenSSL: Could not find current server certificate from OCSP response%s",
4284                            (conn->flags & TLS_CONN_REQUIRE_OCSP) ? "" :
4285                            " (OCSP not required)");
4286                 OCSP_CERTID_free(id);
4287                 OCSP_BASICRESP_free(basic);
4288                 OCSP_RESPONSE_free(rsp);
4289                 return (conn->flags & TLS_CONN_REQUIRE_OCSP) ? 0 : 1;
4290         }
4291         OCSP_CERTID_free(id);
4292
4293         if (!OCSP_check_validity(this_update, next_update, 5 * 60, -1)) {
4294                 tls_show_errors(MSG_INFO, __func__,
4295                                 "OpenSSL: OCSP status times invalid");
4296                 OCSP_BASICRESP_free(basic);
4297                 OCSP_RESPONSE_free(rsp);
4298                 return 0;
4299         }
4300
4301         OCSP_BASICRESP_free(basic);
4302         OCSP_RESPONSE_free(rsp);
4303
4304         wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status for server certificate: %s",
4305                    OCSP_cert_status_str(status));
4306
4307         if (status == V_OCSP_CERTSTATUS_GOOD)
4308                 return 1;
4309         if (status == V_OCSP_CERTSTATUS_REVOKED)
4310                 return 0;
4311         if (conn->flags & TLS_CONN_REQUIRE_OCSP) {
4312                 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status unknown, but OCSP required");
4313                 return 0;
4314         }
4315         wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status unknown, but OCSP was not required, so allow connection to continue");
4316         return 1;
4317 }
4318
4319
4320 static int ocsp_status_cb(SSL *s, void *arg)
4321 {
4322         char *tmp;
4323         char *resp;
4324         size_t len;
4325
4326         if (tls_global->ocsp_stapling_response == NULL) {
4327                 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status callback - no response configured");
4328                 return SSL_TLSEXT_ERR_OK;
4329         }
4330
4331         resp = os_readfile(tls_global->ocsp_stapling_response, &len);
4332         if (resp == NULL) {
4333                 wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status callback - could not read response file");
4334                 /* TODO: Build OCSPResponse with responseStatus = internalError
4335                  */
4336                 return SSL_TLSEXT_ERR_OK;
4337         }
4338         wpa_printf(MSG_DEBUG, "OpenSSL: OCSP status callback - send cached response");
4339         tmp = OPENSSL_malloc(len);
4340         if (tmp == NULL) {
4341                 os_free(resp);
4342                 return SSL_TLSEXT_ERR_ALERT_FATAL;
4343         }
4344
4345         os_memcpy(tmp, resp, len);
4346         os_free(resp);
4347         SSL_set_tlsext_status_ocsp_resp(s, tmp, len);
4348
4349         return SSL_TLSEXT_ERR_OK;
4350 }
4351
4352 #endif /* HAVE_OCSP */
4353
4354
4355 int tls_connection_set_params(void *tls_ctx, struct tls_connection *conn,
4356                               const struct tls_connection_params *params)
4357 {
4358         struct tls_data *data = tls_ctx;
4359         int ret;
4360         unsigned long err;
4361         int can_pkcs11 = 0;
4362         const char *key_id = params->key_id;
4363         const char *cert_id = params->cert_id;
4364         const char *ca_cert_id = params->ca_cert_id;
4365         const char *engine_id = params->engine ? params->engine_id : NULL;
4366         const char *ciphers;
4367
4368         if (conn == NULL)
4369                 return -1;
4370
4371         if (params->flags & TLS_CONN_REQUIRE_OCSP_ALL) {
4372                 wpa_printf(MSG_INFO,
4373                            "OpenSSL: ocsp=3 not supported");
4374                 return -1;
4375         }
4376
4377         /*
4378          * If the engine isn't explicitly configured, and any of the
4379          * cert/key fields are actually PKCS#11 URIs, then automatically
4380          * use the PKCS#11 ENGINE.
4381          */
4382         if (!engine_id || os_strcmp(engine_id, "pkcs11") == 0)
4383                 can_pkcs11 = 1;
4384
4385         if (!key_id && params->private_key && can_pkcs11 &&
4386             os_strncmp(params->private_key, "pkcs11:", 7) == 0) {
4387                 can_pkcs11 = 2;
4388                 key_id = params->private_key;
4389         }
4390
4391         if (!cert_id && params->client_cert && can_pkcs11 &&
4392             os_strncmp(params->client_cert, "pkcs11:", 7) == 0) {
4393                 can_pkcs11 = 2;
4394                 cert_id = params->client_cert;
4395         }
4396
4397         if (!ca_cert_id && params->ca_cert && can_pkcs11 &&
4398             os_strncmp(params->ca_cert, "pkcs11:", 7) == 0) {
4399                 can_pkcs11 = 2;
4400                 ca_cert_id = params->ca_cert;
4401         }
4402
4403         /* If we need to automatically enable the PKCS#11 ENGINE, do so. */
4404         if (can_pkcs11 == 2 && !engine_id)
4405                 engine_id = "pkcs11";
4406
4407 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
4408 #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
4409         if (params->flags & TLS_CONN_EAP_FAST) {
4410                 wpa_printf(MSG_DEBUG,
4411                            "OpenSSL: Use TLSv1_method() for EAP-FAST");
4412                 if (SSL_set_ssl_method(conn->ssl, TLSv1_method()) != 1) {
4413                         tls_show_errors(MSG_INFO, __func__,
4414                                         "Failed to set TLSv1_method() for EAP-FAST");
4415                         return -1;
4416                 }
4417         }
4418 #endif
4419 #if OPENSSL_VERSION_NUMBER >= 0x10101000L
4420 #ifdef SSL_OP_NO_TLSv1_3
4421         if (params->flags & TLS_CONN_EAP_FAST) {
4422                 /* Need to disable TLS v1.3 at least for now since OpenSSL 1.1.1
4423                  * refuses to start the handshake with the modified ciphersuite
4424                  * list (no TLS v1.3 ciphersuites included) for EAP-FAST. */
4425                 wpa_printf(MSG_DEBUG, "OpenSSL: Disable TLSv1.3 for EAP-FAST");
4426                 SSL_set_options(conn->ssl, SSL_OP_NO_TLSv1_3);
4427         }
4428 #endif /* SSL_OP_NO_TLSv1_3 */
4429 #endif
4430 #endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */
4431
4432         while ((err = ERR_get_error())) {
4433                 wpa_printf(MSG_INFO, "%s: Clearing pending SSL error: %s",
4434                            __func__, ERR_error_string(err, NULL));
4435         }
4436
4437         if (engine_id) {
4438                 wpa_printf(MSG_DEBUG, "SSL: Initializing TLS engine");
4439                 ret = tls_engine_init(conn, engine_id, params->pin,
4440                                       key_id, cert_id, ca_cert_id);
4441                 if (ret)
4442                         return ret;
4443         }
4444         if (tls_connection_set_subject_match(conn,
4445                                              params->subject_match,
4446                                              params->altsubject_match,
4447                                              params->suffix_match,
4448                                              params->domain_match))
4449                 return -1;
4450
4451         if (engine_id && ca_cert_id) {
4452                 if (tls_connection_engine_ca_cert(data, conn, ca_cert_id))
4453                         return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED;
4454         } else if (tls_connection_ca_cert(data, conn, params->ca_cert,
4455                                           params->ca_cert_blob,
4456                                           params->ca_cert_blob_len,
4457                                           params->ca_path))
4458                 return -1;
4459
4460         if (engine_id && cert_id) {
4461                 if (tls_connection_engine_client_cert(conn, cert_id))
4462                         return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED;
4463         } else if (tls_connection_client_cert(conn, params->client_cert,
4464                                               params->client_cert_blob,
4465                                               params->client_cert_blob_len))
4466                 return -1;
4467
4468         if (engine_id && key_id) {
4469                 wpa_printf(MSG_DEBUG, "TLS: Using private key from engine");
4470                 if (tls_connection_engine_private_key(conn))
4471                         return TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED;
4472         } else if (tls_connection_private_key(data, conn,
4473                                               params->private_key,
4474                                               params->private_key_passwd,
4475                                               params->private_key_blob,
4476                                               params->private_key_blob_len)) {
4477                 wpa_printf(MSG_INFO, "TLS: Failed to load private key '%s'",
4478                            params->private_key);
4479                 return -1;
4480         }
4481
4482         if (tls_connection_dh(conn, params->dh_file)) {
4483                 wpa_printf(MSG_INFO, "TLS: Failed to load DH file '%s'",
4484                            params->dh_file);
4485                 return -1;
4486         }
4487
4488         ciphers = params->openssl_ciphers;
4489 #ifdef CONFIG_SUITEB
4490 #ifdef OPENSSL_IS_BORINGSSL
4491         if (ciphers && os_strcmp(ciphers, "SUITEB192") == 0) {
4492                 /* BoringSSL removed support for SUITEB192, so need to handle
4493                  * this with hardcoded ciphersuite and additional checks for
4494                  * other parameters. */
4495                 ciphers = "ECDHE-ECDSA-AES256-GCM-SHA384";
4496         }
4497 #endif /* OPENSSL_IS_BORINGSSL */
4498 #endif /* CONFIG_SUITEB */
4499         if (ciphers && SSL_set_cipher_list(conn->ssl, ciphers) != 1) {
4500                 wpa_printf(MSG_INFO,
4501                            "OpenSSL: Failed to set cipher string '%s'",
4502                            ciphers);
4503                 return -1;
4504         }
4505
4506         if (tls_set_conn_flags(conn, params->flags,
4507                                params->openssl_ciphers) < 0)
4508                 return -1;
4509
4510 #ifdef OPENSSL_IS_BORINGSSL
4511         if (params->flags & TLS_CONN_REQUEST_OCSP) {
4512                 SSL_enable_ocsp_stapling(conn->ssl);
4513         }
4514 #else /* OPENSSL_IS_BORINGSSL */
4515 #ifdef HAVE_OCSP
4516         if (params->flags & TLS_CONN_REQUEST_OCSP) {
4517                 SSL_CTX *ssl_ctx = data->ssl;
4518                 SSL_set_tlsext_status_type(conn->ssl, TLSEXT_STATUSTYPE_ocsp);
4519                 SSL_CTX_set_tlsext_status_cb(ssl_ctx, ocsp_resp_cb);
4520                 SSL_CTX_set_tlsext_status_arg(ssl_ctx, conn);
4521         }
4522 #else /* HAVE_OCSP */
4523         if (params->flags & TLS_CONN_REQUIRE_OCSP) {
4524                 wpa_printf(MSG_INFO,
4525                            "OpenSSL: No OCSP support included - reject configuration");
4526                 return -1;
4527         }
4528         if (params->flags & TLS_CONN_REQUEST_OCSP) {
4529                 wpa_printf(MSG_DEBUG,
4530                            "OpenSSL: No OCSP support included - allow optional OCSP case to continue");
4531         }
4532 #endif /* HAVE_OCSP */
4533 #endif /* OPENSSL_IS_BORINGSSL */
4534
4535         conn->flags = params->flags;
4536
4537         tls_get_errors(data);
4538
4539         return 0;
4540 }
4541
4542
4543 int tls_global_set_params(void *tls_ctx,
4544                           const struct tls_connection_params *params)
4545 {
4546         struct tls_data *data = tls_ctx;
4547         SSL_CTX *ssl_ctx = data->ssl;
4548         unsigned long err;
4549
4550         while ((err = ERR_get_error())) {
4551                 wpa_printf(MSG_INFO, "%s: Clearing pending SSL error: %s",
4552                            __func__, ERR_error_string(err, NULL));
4553         }
4554
4555         if (tls_global_ca_cert(data, params->ca_cert) ||
4556             tls_global_client_cert(data, params->client_cert) ||
4557             tls_global_private_key(data, params->private_key,
4558                                    params->private_key_passwd) ||
4559             tls_global_dh(data, params->dh_file)) {
4560                 wpa_printf(MSG_INFO, "TLS: Failed to set global parameters");
4561                 return -1;
4562         }
4563
4564         if (params->openssl_ciphers &&
4565             SSL_CTX_set_cipher_list(ssl_ctx, params->openssl_ciphers) != 1) {
4566                 wpa_printf(MSG_INFO,
4567                            "OpenSSL: Failed to set cipher string '%s'",
4568                            params->openssl_ciphers);
4569                 return -1;
4570         }
4571
4572 #ifdef SSL_OP_NO_TICKET
4573         if (params->flags & TLS_CONN_DISABLE_SESSION_TICKET)
4574                 SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_TICKET);
4575         else
4576                 SSL_CTX_clear_options(ssl_ctx, SSL_OP_NO_TICKET);
4577 #endif /*  SSL_OP_NO_TICKET */
4578
4579 #ifdef HAVE_OCSP
4580         SSL_CTX_set_tlsext_status_cb(ssl_ctx, ocsp_status_cb);
4581         SSL_CTX_set_tlsext_status_arg(ssl_ctx, ssl_ctx);
4582         os_free(tls_global->ocsp_stapling_response);
4583         if (params->ocsp_stapling_response)
4584                 tls_global->ocsp_stapling_response =
4585                         os_strdup(params->ocsp_stapling_response);
4586         else
4587                 tls_global->ocsp_stapling_response = NULL;
4588 #endif /* HAVE_OCSP */
4589
4590         return 0;
4591 }
4592
4593
4594 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
4595 /* Pre-shared secred requires a patch to openssl, so this function is
4596  * commented out unless explicitly needed for EAP-FAST in order to be able to
4597  * build this file with unmodified openssl. */
4598
4599 #if (defined(OPENSSL_IS_BORINGSSL) || OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined(LIBRESSL_VERSION_NUMBER)
4600 static int tls_sess_sec_cb(SSL *s, void *secret, int *secret_len,
4601                            STACK_OF(SSL_CIPHER) *peer_ciphers,
4602                            const SSL_CIPHER **cipher, void *arg)
4603 #else /* OPENSSL_IS_BORINGSSL */
4604 static int tls_sess_sec_cb(SSL *s, void *secret, int *secret_len,
4605                            STACK_OF(SSL_CIPHER) *peer_ciphers,
4606                            SSL_CIPHER **cipher, void *arg)
4607 #endif /* OPENSSL_IS_BORINGSSL */
4608 {
4609         struct tls_connection *conn = arg;
4610         int ret;
4611
4612 #if OPENSSL_VERSION_NUMBER < 0x10100000L || \
4613         (defined(LIBRESSL_VERSION_NUMBER) && \
4614          LIBRESSL_VERSION_NUMBER < 0x20700000L)
4615         if (conn == NULL || conn->session_ticket_cb == NULL)
4616                 return 0;
4617
4618         ret = conn->session_ticket_cb(conn->session_ticket_cb_ctx,
4619                                       conn->session_ticket,
4620                                       conn->session_ticket_len,
4621                                       s->s3->client_random,
4622                                       s->s3->server_random, secret);
4623 #else
4624         unsigned char client_random[SSL3_RANDOM_SIZE];
4625         unsigned char server_random[SSL3_RANDOM_SIZE];
4626
4627         if (conn == NULL || conn->session_ticket_cb == NULL)
4628                 return 0;
4629
4630         SSL_get_client_random(s, client_random, sizeof(client_random));
4631         SSL_get_server_random(s, server_random, sizeof(server_random));
4632
4633         ret = conn->session_ticket_cb(conn->session_ticket_cb_ctx,
4634                                       conn->session_ticket,
4635                                       conn->session_ticket_len,
4636                                       client_random,
4637                                       server_random, secret);
4638 #endif
4639
4640         os_free(conn->session_ticket);
4641         conn->session_ticket = NULL;
4642
4643         if (ret <= 0)
4644                 return 0;
4645
4646         *secret_len = SSL_MAX_MASTER_KEY_LENGTH;
4647         return 1;
4648 }
4649
4650
4651 static int tls_session_ticket_ext_cb(SSL *s, const unsigned char *data,
4652                                      int len, void *arg)
4653 {
4654         struct tls_connection *conn = arg;
4655
4656         if (conn == NULL || conn->session_ticket_cb == NULL)
4657                 return 0;
4658
4659         wpa_printf(MSG_DEBUG, "OpenSSL: %s: length=%d", __func__, len);
4660
4661         os_free(conn->session_ticket);
4662         conn->session_ticket = NULL;
4663
4664         wpa_hexdump(MSG_DEBUG, "OpenSSL: ClientHello SessionTicket "
4665                     "extension", data, len);
4666
4667         conn->session_ticket = os_memdup(data, len);
4668         if (conn->session_ticket == NULL)
4669                 return 0;
4670
4671         conn->session_ticket_len = len;
4672
4673         return 1;
4674 }
4675 #endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */
4676
4677
4678 int tls_connection_set_session_ticket_cb(void *tls_ctx,
4679                                          struct tls_connection *conn,
4680                                          tls_session_ticket_cb cb,
4681                                          void *ctx)
4682 {
4683 #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
4684         conn->session_ticket_cb = cb;
4685         conn->session_ticket_cb_ctx = ctx;
4686
4687         if (cb) {
4688                 if (SSL_set_session_secret_cb(conn->ssl, tls_sess_sec_cb,
4689                                               conn) != 1)
4690                         return -1;
4691                 SSL_set_session_ticket_ext_cb(conn->ssl,
4692                                               tls_session_ticket_ext_cb, conn);
4693         } else {
4694                 if (SSL_set_session_secret_cb(conn->ssl, NULL, NULL) != 1)
4695                         return -1;
4696                 SSL_set_session_ticket_ext_cb(conn->ssl, NULL, NULL);
4697         }
4698
4699         return 0;
4700 #else /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */
4701         return -1;
4702 #endif /* EAP_FAST || EAP_FAST_DYNAMIC || EAP_SERVER_FAST */
4703 }
4704
4705
4706 int tls_get_library_version(char *buf, size_t buf_len)
4707 {
4708 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
4709         return os_snprintf(buf, buf_len, "OpenSSL build=%s run=%s",
4710                            OPENSSL_VERSION_TEXT,
4711                            OpenSSL_version(OPENSSL_VERSION));
4712 #else
4713         return os_snprintf(buf, buf_len, "OpenSSL build=%s run=%s",
4714                            OPENSSL_VERSION_TEXT,
4715                            SSLeay_version(SSLEAY_VERSION));
4716 #endif
4717 }
4718
4719
4720 void tls_connection_set_success_data(struct tls_connection *conn,
4721                                      struct wpabuf *data)
4722 {
4723         SSL_SESSION *sess;
4724         struct wpabuf *old;
4725
4726         if (tls_ex_idx_session < 0)
4727                 goto fail;
4728         sess = SSL_get_session(conn->ssl);
4729         if (!sess)
4730                 goto fail;
4731         old = SSL_SESSION_get_ex_data(sess, tls_ex_idx_session);
4732         if (old) {
4733                 wpa_printf(MSG_DEBUG, "OpenSSL: Replacing old success data %p",
4734                            old);
4735                 wpabuf_free(old);
4736         }
4737         if (SSL_SESSION_set_ex_data(sess, tls_ex_idx_session, data) != 1)
4738                 goto fail;
4739
4740         wpa_printf(MSG_DEBUG, "OpenSSL: Stored success data %p", data);
4741         conn->success_data = 1;
4742         return;
4743
4744 fail:
4745         wpa_printf(MSG_INFO, "OpenSSL: Failed to store success data");
4746         wpabuf_free(data);
4747 }
4748
4749
4750 void tls_connection_set_success_data_resumed(struct tls_connection *conn)
4751 {
4752         wpa_printf(MSG_DEBUG,
4753                    "OpenSSL: Success data accepted for resumed session");
4754         conn->success_data = 1;
4755 }
4756
4757
4758 const struct wpabuf *
4759 tls_connection_get_success_data(struct tls_connection *conn)
4760 {
4761         SSL_SESSION *sess;
4762
4763         if (tls_ex_idx_session < 0 ||
4764             !(sess = SSL_get_session(conn->ssl)))
4765                 return NULL;
4766         return SSL_SESSION_get_ex_data(sess, tls_ex_idx_session);
4767 }
4768
4769
4770 void tls_connection_remove_session(struct tls_connection *conn)
4771 {
4772         SSL_SESSION *sess;
4773
4774         sess = SSL_get_session(conn->ssl);
4775         if (!sess)
4776                 return;
4777
4778         if (SSL_CTX_remove_session(conn->ssl_ctx, sess) != 1)
4779                 wpa_printf(MSG_DEBUG,
4780                            "OpenSSL: Session was not cached");
4781         else
4782                 wpa_printf(MSG_DEBUG,
4783                            "OpenSSL: Removed cached session to disable session resumption");
4784 }