contrib/wpa/src/tls/tlsv1_server_write.c

   1 /*
   2  * TLSv1 server - write handshake message
   3  * Copyright (c) 2006-2011, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #include "common.h"
  12 #include "crypto/md5.h"
  13 #include "crypto/sha1.h"
  14 #include "crypto/sha256.h"
  15 #include "crypto/tls.h"
  16 #include "crypto/random.h"
  17 #include "x509v3.h"
  18 #include "tlsv1_common.h"
  19 #include "tlsv1_record.h"
  20 #include "tlsv1_server.h"
  21 #include "tlsv1_server_i.h"
  22
  23
  24 static size_t tls_server_cert_chain_der_len(struct tlsv1_server *conn)
  25 {
  26         size_t len = 0;
  27         struct x509_certificate *cert;
  28
  29         cert = conn->cred->cert;
  30         while (cert) {
  31                 len += 3 + cert->cert_len;
  32                 if (x509_certificate_self_signed(cert))
  33                         break;
  34                 cert = x509_certificate_get_subject(conn->cred->trusted_certs,
  35                                                     &cert->issuer);
  36         }
  37
  38         return len;
  39 }
  40
  41
  42 static int tls_write_server_hello(struct tlsv1_server *conn,
  43                                   u8 **msgpos, u8 *end)
  44 {
  45         u8 *pos, *rhdr, *hs_start, *hs_length;
  46         struct os_time now;
  47         size_t rlen;
  48
  49         pos = *msgpos;
  50
  51         wpa_printf(MSG_DEBUG, "TLSv1: Send ServerHello");
  52         rhdr = pos;
  53         pos += TLS_RECORD_HEADER_LEN;
  54
  55         os_get_time(&now);
  56         WPA_PUT_BE32(conn->server_random, now.sec);
  57         if (random_get_bytes(conn->server_random + 4, TLS_RANDOM_LEN - 4)) {
  58                 wpa_printf(MSG_ERROR, "TLSv1: Could not generate "
  59                            "server_random");
  60                 return -1;
  61         }
  62         wpa_hexdump(MSG_MSGDUMP, "TLSv1: server_random",
  63                     conn->server_random, TLS_RANDOM_LEN);
  64
  65         conn->session_id_len = TLS_SESSION_ID_MAX_LEN;
  66         if (random_get_bytes(conn->session_id, conn->session_id_len)) {
  67                 wpa_printf(MSG_ERROR, "TLSv1: Could not generate "
  68                            "session_id");
  69                 return -1;
  70         }
  71         wpa_hexdump(MSG_MSGDUMP, "TLSv1: session_id",
  72                     conn->session_id, conn->session_id_len);
  73
  74         /* opaque fragment[TLSPlaintext.length] */
  75
  76         /* Handshake */
  77         hs_start = pos;
  78         /* HandshakeType msg_type */
  79         *pos++ = TLS_HANDSHAKE_TYPE_SERVER_HELLO;
  80         /* uint24 length (to be filled) */
  81         hs_length = pos;
  82         pos += 3;
  83         /* body - ServerHello */
  84         /* ProtocolVersion server_version */
  85         WPA_PUT_BE16(pos, conn->rl.tls_version);
  86         pos += 2;
  87         /* Random random: uint32 gmt_unix_time, opaque random_bytes */
  88         os_memcpy(pos, conn->server_random, TLS_RANDOM_LEN);
  89         pos += TLS_RANDOM_LEN;
  90         /* SessionID session_id */
  91         *pos++ = conn->session_id_len;
  92         os_memcpy(pos, conn->session_id, conn->session_id_len);
  93         pos += conn->session_id_len;
  94         /* CipherSuite cipher_suite */
  95         WPA_PUT_BE16(pos, conn->cipher_suite);
  96         pos += 2;
  97         /* CompressionMethod compression_method */
  98         *pos++ = TLS_COMPRESSION_NULL;
  99
 100         if (conn->session_ticket && conn->session_ticket_cb) {
 101                 int res = conn->session_ticket_cb(
 102                         conn->session_ticket_cb_ctx,
 103                         conn->session_ticket, conn->session_ticket_len,
 104                         conn->client_random, conn->server_random,
 105                         conn->master_secret);
 106                 if (res < 0) {
 107                         wpa_printf(MSG_DEBUG, "TLSv1: SessionTicket callback "
 108                                    "indicated failure");
 109                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 110                                            TLS_ALERT_HANDSHAKE_FAILURE);
 111                         return -1;
 112                 }
 113                 conn->use_session_ticket = res;
 114
 115                 if (conn->use_session_ticket) {
 116                         if (tlsv1_server_derive_keys(conn, NULL, 0) < 0) {
 117                                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to "
 118                                            "derive keys");
 119                                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 120                                                    TLS_ALERT_INTERNAL_ERROR);
 121                                 return -1;
 122                         }
 123                 }
 124
 125                 /*
 126                  * RFC 4507 specifies that server would include an empty
 127                  * SessionTicket extension in ServerHello and a
 128                  * NewSessionTicket message after the ServerHello. However,
 129                  * EAP-FAST (RFC 4851), i.e., the only user of SessionTicket
 130                  * extension at the moment, does not use such extensions.
 131                  *
 132                  * TODO: Add support for configuring RFC 4507 behavior and make
 133                  * EAP-FAST disable it.
 134                  */
 135         }
 136
 137         WPA_PUT_BE24(hs_length, pos - hs_length - 3);
 138         tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
 139
 140         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 141                               rhdr, end - rhdr, hs_start, pos - hs_start,
 142                               &rlen) < 0) {
 143                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to create TLS record");
 144                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 145                                    TLS_ALERT_INTERNAL_ERROR);
 146                 return -1;
 147         }
 148         pos = rhdr + rlen;
 149
 150         *msgpos = pos;
 151
 152         return 0;
 153 }
 154
 155
 156 static int tls_write_server_certificate(struct tlsv1_server *conn,
 157                                         u8 **msgpos, u8 *end)
 158 {
 159         u8 *pos, *rhdr, *hs_start, *hs_length, *cert_start;
 160         size_t rlen;
 161         struct x509_certificate *cert;
 162         const struct tls_cipher_suite *suite;
 163
 164         suite = tls_get_cipher_suite(conn->rl.cipher_suite);
 165         if (suite && suite->key_exchange == TLS_KEY_X_DH_anon) {
 166                 wpa_printf(MSG_DEBUG, "TLSv1: Do not send Certificate when "
 167                            "using anonymous DH");
 168                 return 0;
 169         }
 170
 171         pos = *msgpos;
 172
 173         wpa_printf(MSG_DEBUG, "TLSv1: Send Certificate");
 174         rhdr = pos;
 175         pos += TLS_RECORD_HEADER_LEN;
 176
 177         /* opaque fragment[TLSPlaintext.length] */
 178
 179         /* Handshake */
 180         hs_start = pos;
 181         /* HandshakeType msg_type */
 182         *pos++ = TLS_HANDSHAKE_TYPE_CERTIFICATE;
 183         /* uint24 length (to be filled) */
 184         hs_length = pos;
 185         pos += 3;
 186         /* body - Certificate */
 187         /* uint24 length (to be filled) */
 188         cert_start = pos;
 189         pos += 3;
 190         cert = conn->cred->cert;
 191         while (cert) {
 192                 if (pos + 3 + cert->cert_len > end) {
 193                         wpa_printf(MSG_DEBUG, "TLSv1: Not enough buffer space "
 194                                    "for Certificate (cert_len=%lu left=%lu)",
 195                                    (unsigned long) cert->cert_len,
 196                                    (unsigned long) (end - pos));
 197                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 198                                            TLS_ALERT_INTERNAL_ERROR);
 199                         return -1;
 200                 }
 201                 WPA_PUT_BE24(pos, cert->cert_len);
 202                 pos += 3;
 203                 os_memcpy(pos, cert->cert_start, cert->cert_len);
 204                 pos += cert->cert_len;
 205
 206                 if (x509_certificate_self_signed(cert))
 207                         break;
 208                 cert = x509_certificate_get_subject(conn->cred->trusted_certs,
 209                                                     &cert->issuer);
 210         }
 211         if (cert == conn->cred->cert || cert == NULL) {
 212                 /*
 213                  * Server was not configured with all the needed certificates
 214                  * to form a full certificate chain. The client may fail to
 215                  * validate the chain unless it is configured with all the
 216                  * missing CA certificates.
 217                  */
 218                 wpa_printf(MSG_DEBUG, "TLSv1: Full server certificate chain "
 219                            "not configured - validation may fail");
 220         }
 221         WPA_PUT_BE24(cert_start, pos - cert_start - 3);
 222
 223         WPA_PUT_BE24(hs_length, pos - hs_length - 3);
 224
 225         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 226                               rhdr, end - rhdr, hs_start, pos - hs_start,
 227                               &rlen) < 0) {
 228                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate a record");
 229                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 230                                    TLS_ALERT_INTERNAL_ERROR);
 231                 return -1;
 232         }
 233         pos = rhdr + rlen;
 234
 235         tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
 236
 237         *msgpos = pos;
 238
 239         return 0;
 240 }
 241
 242
 243 static int tls_write_server_key_exchange(struct tlsv1_server *conn,
 244                                          u8 **msgpos, u8 *end)
 245 {
 246         tls_key_exchange keyx;
 247         const struct tls_cipher_suite *suite;
 248         u8 *pos, *rhdr, *hs_start, *hs_length;
 249         size_t rlen;
 250         u8 *dh_ys;
 251         size_t dh_ys_len;
 252
 253         suite = tls_get_cipher_suite(conn->rl.cipher_suite);
 254         if (suite == NULL)
 255                 keyx = TLS_KEY_X_NULL;
 256         else
 257                 keyx = suite->key_exchange;
 258
 259         if (!tls_server_key_exchange_allowed(conn->rl.cipher_suite)) {
 260                 wpa_printf(MSG_DEBUG, "TLSv1: No ServerKeyExchange needed");
 261                 return 0;
 262         }
 263
 264         if (keyx != TLS_KEY_X_DH_anon) {
 265                 /* TODO? */
 266                 wpa_printf(MSG_DEBUG, "TLSv1: ServerKeyExchange not yet "
 267                            "supported with key exchange type %d", keyx);
 268                 return -1;
 269         }
 270
 271         if (conn->cred == NULL || conn->cred->dh_p == NULL ||
 272             conn->cred->dh_g == NULL) {
 273                 wpa_printf(MSG_DEBUG, "TLSv1: No DH parameters available for "
 274                            "ServerKeyExhcange");
 275                 return -1;
 276         }
 277
 278         os_free(conn->dh_secret);
 279         conn->dh_secret_len = conn->cred->dh_p_len;
 280         conn->dh_secret = os_malloc(conn->dh_secret_len);
 281         if (conn->dh_secret == NULL) {
 282                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to allocate "
 283                            "memory for secret (Diffie-Hellman)");
 284                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 285                                    TLS_ALERT_INTERNAL_ERROR);
 286                 return -1;
 287         }
 288         if (random_get_bytes(conn->dh_secret, conn->dh_secret_len)) {
 289                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to get random "
 290                            "data for Diffie-Hellman");
 291                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 292                                    TLS_ALERT_INTERNAL_ERROR);
 293                 os_free(conn->dh_secret);
 294                 conn->dh_secret = NULL;
 295                 return -1;
 296         }
 297
 298         if (os_memcmp(conn->dh_secret, conn->cred->dh_p, conn->dh_secret_len) >
 299             0)
 300                 conn->dh_secret[0] = 0; /* make sure secret < p */
 301
 302         pos = conn->dh_secret;
 303         while (pos + 1 < conn->dh_secret + conn->dh_secret_len && *pos == 0)
 304                 pos++;
 305         if (pos != conn->dh_secret) {
 306                 os_memmove(conn->dh_secret, pos,
 307                            conn->dh_secret_len - (pos - conn->dh_secret));
 308                 conn->dh_secret_len -= pos - conn->dh_secret;
 309         }
 310         wpa_hexdump_key(MSG_DEBUG, "TLSv1: DH server's secret value",
 311                         conn->dh_secret, conn->dh_secret_len);
 312
 313         /* Ys = g^secret mod p */
 314         dh_ys_len = conn->cred->dh_p_len;
 315         dh_ys = os_malloc(dh_ys_len);
 316         if (dh_ys == NULL) {
 317                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to allocate memory for "
 318                            "Diffie-Hellman");
 319                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 320                                    TLS_ALERT_INTERNAL_ERROR);
 321                 return -1;
 322         }
 323         if (crypto_mod_exp(conn->cred->dh_g, conn->cred->dh_g_len,
 324                            conn->dh_secret, conn->dh_secret_len,
 325                            conn->cred->dh_p, conn->cred->dh_p_len,
 326                            dh_ys, &dh_ys_len)) {
 327                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 328                                    TLS_ALERT_INTERNAL_ERROR);
 329                 os_free(dh_ys);
 330                 return -1;
 331         }
 332
 333         wpa_hexdump(MSG_DEBUG, "TLSv1: DH Ys (server's public value)",
 334                     dh_ys, dh_ys_len);
 335
 336         /*
 337          * struct {
 338          *    select (KeyExchangeAlgorithm) {
 339          *       case diffie_hellman:
 340          *          ServerDHParams params;
 341          *          Signature signed_params;
 342          *       case rsa:
 343          *          ServerRSAParams params;
 344          *          Signature signed_params;
 345          *    };
 346          * } ServerKeyExchange;
 347          *
 348          * struct {
 349          *    opaque dh_p<1..2^16-1>;
 350          *    opaque dh_g<1..2^16-1>;
 351          *    opaque dh_Ys<1..2^16-1>;
 352          * } ServerDHParams;
 353          */
 354
 355         pos = *msgpos;
 356
 357         wpa_printf(MSG_DEBUG, "TLSv1: Send ServerKeyExchange");
 358         rhdr = pos;
 359         pos += TLS_RECORD_HEADER_LEN;
 360
 361         /* opaque fragment[TLSPlaintext.length] */
 362
 363         /* Handshake */
 364         hs_start = pos;
 365         /* HandshakeType msg_type */
 366         *pos++ = TLS_HANDSHAKE_TYPE_SERVER_KEY_EXCHANGE;
 367         /* uint24 length (to be filled) */
 368         hs_length = pos;
 369         pos += 3;
 370
 371         /* body - ServerDHParams */
 372         /* dh_p */
 373         if (pos + 2 + conn->cred->dh_p_len > end) {
 374                 wpa_printf(MSG_DEBUG, "TLSv1: Not enough buffer space for "
 375                            "dh_p");
 376                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 377                                    TLS_ALERT_INTERNAL_ERROR);
 378                 os_free(dh_ys);
 379                 return -1;
 380         }
 381         WPA_PUT_BE16(pos, conn->cred->dh_p_len);
 382         pos += 2;
 383         os_memcpy(pos, conn->cred->dh_p, conn->cred->dh_p_len);
 384         pos += conn->cred->dh_p_len;
 385
 386         /* dh_g */
 387         if (pos + 2 + conn->cred->dh_g_len > end) {
 388                 wpa_printf(MSG_DEBUG, "TLSv1: Not enough buffer space for "
 389                            "dh_g");
 390                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 391                                    TLS_ALERT_INTERNAL_ERROR);
 392                 os_free(dh_ys);
 393                 return -1;
 394         }
 395         WPA_PUT_BE16(pos, conn->cred->dh_g_len);
 396         pos += 2;
 397         os_memcpy(pos, conn->cred->dh_g, conn->cred->dh_g_len);
 398         pos += conn->cred->dh_g_len;
 399
 400         /* dh_Ys */
 401         if (pos + 2 + dh_ys_len > end) {
 402                 wpa_printf(MSG_DEBUG, "TLSv1: Not enough buffer space for "
 403                            "dh_Ys");
 404                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 405                                    TLS_ALERT_INTERNAL_ERROR);
 406                 os_free(dh_ys);
 407                 return -1;
 408         }
 409         WPA_PUT_BE16(pos, dh_ys_len);
 410         pos += 2;
 411         os_memcpy(pos, dh_ys, dh_ys_len);
 412         pos += dh_ys_len;
 413         os_free(dh_ys);
 414
 415         WPA_PUT_BE24(hs_length, pos - hs_length - 3);
 416
 417         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 418                               rhdr, end - rhdr, hs_start, pos - hs_start,
 419                               &rlen) < 0) {
 420                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate a record");
 421                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 422                                    TLS_ALERT_INTERNAL_ERROR);
 423                 return -1;
 424         }
 425         pos = rhdr + rlen;
 426
 427         tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
 428
 429         *msgpos = pos;
 430
 431         return 0;
 432 }
 433
 434
 435 static int tls_write_server_certificate_request(struct tlsv1_server *conn,
 436                                                 u8 **msgpos, u8 *end)
 437 {
 438         u8 *pos, *rhdr, *hs_start, *hs_length;
 439         size_t rlen;
 440
 441         if (!conn->verify_peer) {
 442                 wpa_printf(MSG_DEBUG, "TLSv1: No CertificateRequest needed");
 443                 return 0;
 444         }
 445
 446         pos = *msgpos;
 447
 448         wpa_printf(MSG_DEBUG, "TLSv1: Send CertificateRequest");
 449         rhdr = pos;
 450         pos += TLS_RECORD_HEADER_LEN;
 451
 452         /* opaque fragment[TLSPlaintext.length] */
 453
 454         /* Handshake */
 455         hs_start = pos;
 456         /* HandshakeType msg_type */
 457         *pos++ = TLS_HANDSHAKE_TYPE_CERTIFICATE_REQUEST;
 458         /* uint24 length (to be filled) */
 459         hs_length = pos;
 460         pos += 3;
 461         /* body - CertificateRequest */
 462
 463         /*
 464          * enum {
 465          *   rsa_sign(1), dss_sign(2), rsa_fixed_dh(3), dss_fixed_dh(4),
 466          *   (255)
 467          * } ClientCertificateType;
 468          * ClientCertificateType certificate_types<1..2^8-1>
 469          */
 470         *pos++ = 1;
 471         *pos++ = 1; /* rsa_sign */
 472
 473         /*
 474          * opaque DistinguishedName<1..2^16-1>
 475          * DistinguishedName certificate_authorities<3..2^16-1>
 476          */
 477         /* TODO: add support for listing DNs for trusted CAs */
 478         WPA_PUT_BE16(pos, 0);
 479         pos += 2;
 480
 481         WPA_PUT_BE24(hs_length, pos - hs_length - 3);
 482
 483         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 484                               rhdr, end - rhdr, hs_start, pos - hs_start,
 485                               &rlen) < 0) {
 486                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate a record");
 487                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 488                                    TLS_ALERT_INTERNAL_ERROR);
 489                 return -1;
 490         }
 491         pos = rhdr + rlen;
 492
 493         tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
 494
 495         *msgpos = pos;
 496
 497         return 0;
 498 }
 499
 500
 501 static int tls_write_server_hello_done(struct tlsv1_server *conn,
 502                                        u8 **msgpos, u8 *end)
 503 {
 504         u8 *pos;
 505         size_t rlen;
 506         u8 payload[4];
 507
 508         wpa_printf(MSG_DEBUG, "TLSv1: Send ServerHelloDone");
 509
 510         /* opaque fragment[TLSPlaintext.length] */
 511
 512         /* Handshake */
 513         pos = payload;
 514         /* HandshakeType msg_type */
 515         *pos++ = TLS_HANDSHAKE_TYPE_SERVER_HELLO_DONE;
 516         /* uint24 length */
 517         WPA_PUT_BE24(pos, 0);
 518         pos += 3;
 519         /* body - ServerHelloDone (empty) */
 520
 521         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 522                               *msgpos, end - *msgpos, payload, pos - payload,
 523                               &rlen) < 0) {
 524                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate a record");
 525                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 526                                    TLS_ALERT_INTERNAL_ERROR);
 527                 return -1;
 528         }
 529
 530         tls_verify_hash_add(&conn->verify, payload, pos - payload);
 531
 532         *msgpos += rlen;
 533
 534         return 0;
 535 }
 536
 537
 538 static int tls_write_server_change_cipher_spec(struct tlsv1_server *conn,
 539                                                u8 **msgpos, u8 *end)
 540 {
 541         size_t rlen;
 542         u8 payload[1];
 543
 544         wpa_printf(MSG_DEBUG, "TLSv1: Send ChangeCipherSpec");
 545
 546         payload[0] = TLS_CHANGE_CIPHER_SPEC;
 547
 548         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_CHANGE_CIPHER_SPEC,
 549                               *msgpos, end - *msgpos, payload, sizeof(payload),
 550                               &rlen) < 0) {
 551                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to create a record");
 552                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 553                                    TLS_ALERT_INTERNAL_ERROR);
 554                 return -1;
 555         }
 556
 557         if (tlsv1_record_change_write_cipher(&conn->rl) < 0) {
 558                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to set write cipher for "
 559                            "record layer");
 560                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 561                                    TLS_ALERT_INTERNAL_ERROR);
 562                 return -1;
 563         }
 564
 565         *msgpos += rlen;
 566
 567         return 0;
 568 }
 569
 570
 571 static int tls_write_server_finished(struct tlsv1_server *conn,
 572                                      u8 **msgpos, u8 *end)
 573 {
 574         u8 *pos, *hs_start;
 575         size_t rlen, hlen;
 576         u8 verify_data[1 + 3 + TLS_VERIFY_DATA_LEN];
 577         u8 hash[MD5_MAC_LEN + SHA1_MAC_LEN];
 578
 579         pos = *msgpos;
 580
 581         wpa_printf(MSG_DEBUG, "TLSv1: Send Finished");
 582
 583         /* Encrypted Handshake Message: Finished */
 584
 585 #ifdef CONFIG_TLSV12
 586         if (conn->rl.tls_version >= TLS_VERSION_1_2) {
 587                 hlen = SHA256_MAC_LEN;
 588                 if (conn->verify.sha256_server == NULL ||
 589                     crypto_hash_finish(conn->verify.sha256_server, hash, &hlen)
 590                     < 0) {
 591                         conn->verify.sha256_server = NULL;
 592                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 593                                            TLS_ALERT_INTERNAL_ERROR);
 594                         return -1;
 595                 }
 596                 conn->verify.sha256_server = NULL;
 597         } else {
 598 #endif /* CONFIG_TLSV12 */
 599
 600         hlen = MD5_MAC_LEN;
 601         if (conn->verify.md5_server == NULL ||
 602             crypto_hash_finish(conn->verify.md5_server, hash, &hlen) < 0) {
 603                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 604                                    TLS_ALERT_INTERNAL_ERROR);
 605                 conn->verify.md5_server = NULL;
 606                 crypto_hash_finish(conn->verify.sha1_server, NULL, NULL);
 607                 conn->verify.sha1_server = NULL;
 608                 return -1;
 609         }
 610         conn->verify.md5_server = NULL;
 611         hlen = SHA1_MAC_LEN;
 612         if (conn->verify.sha1_server == NULL ||
 613             crypto_hash_finish(conn->verify.sha1_server, hash + MD5_MAC_LEN,
 614                                &hlen) < 0) {
 615                 conn->verify.sha1_server = NULL;
 616                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 617                                    TLS_ALERT_INTERNAL_ERROR);
 618                 return -1;
 619         }
 620         conn->verify.sha1_server = NULL;
 621         hlen = MD5_MAC_LEN + SHA1_MAC_LEN;
 622
 623 #ifdef CONFIG_TLSV12
 624         }
 625 #endif /* CONFIG_TLSV12 */
 626
 627         if (tls_prf(conn->rl.tls_version,
 628                     conn->master_secret, TLS_MASTER_SECRET_LEN,
 629                     "server finished", hash, hlen,
 630                     verify_data + 1 + 3, TLS_VERIFY_DATA_LEN)) {
 631                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate verify_data");
 632                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 633                                    TLS_ALERT_INTERNAL_ERROR);
 634                 return -1;
 635         }
 636         wpa_hexdump_key(MSG_DEBUG, "TLSv1: verify_data (server)",
 637                         verify_data + 1 + 3, TLS_VERIFY_DATA_LEN);
 638
 639         /* Handshake */
 640         pos = hs_start = verify_data;
 641         /* HandshakeType msg_type */
 642         *pos++ = TLS_HANDSHAKE_TYPE_FINISHED;
 643         /* uint24 length */
 644         WPA_PUT_BE24(pos, TLS_VERIFY_DATA_LEN);
 645         pos += 3;
 646         pos += TLS_VERIFY_DATA_LEN;
 647         tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
 648
 649         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 650                               *msgpos, end - *msgpos, hs_start, pos - hs_start,
 651                               &rlen) < 0) {
 652                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to create a record");
 653                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 654                                    TLS_ALERT_INTERNAL_ERROR);
 655                 return -1;
 656         }
 657
 658         *msgpos += rlen;
 659
 660         return 0;
 661 }
 662
 663
 664 static u8 * tls_send_server_hello(struct tlsv1_server *conn, size_t *out_len)
 665 {
 666         u8 *msg, *end, *pos;
 667         size_t msglen;
 668
 669         *out_len = 0;
 670
 671         msglen = 1000 + tls_server_cert_chain_der_len(conn);
 672
 673         msg = os_malloc(msglen);
 674         if (msg == NULL)
 675                 return NULL;
 676
 677         pos = msg;
 678         end = msg + msglen;
 679
 680         if (tls_write_server_hello(conn, &pos, end) < 0) {
 681                 os_free(msg);
 682                 return NULL;
 683         }
 684
 685         if (conn->use_session_ticket) {
 686                 /* Abbreviated handshake using session ticket; RFC 4507 */
 687                 if (tls_write_server_change_cipher_spec(conn, &pos, end) < 0 ||
 688                     tls_write_server_finished(conn, &pos, end) < 0) {
 689                         os_free(msg);
 690                         return NULL;
 691                 }
 692
 693                 *out_len = pos - msg;
 694
 695                 conn->state = CHANGE_CIPHER_SPEC;
 696
 697                 return msg;
 698         }
 699
 700         /* Full handshake */
 701         if (tls_write_server_certificate(conn, &pos, end) < 0 ||
 702             tls_write_server_key_exchange(conn, &pos, end) < 0 ||
 703             tls_write_server_certificate_request(conn, &pos, end) < 0 ||
 704             tls_write_server_hello_done(conn, &pos, end) < 0) {
 705                 os_free(msg);
 706                 return NULL;
 707         }
 708
 709         *out_len = pos - msg;
 710
 711         conn->state = CLIENT_CERTIFICATE;
 712
 713         return msg;
 714 }
 715
 716
 717 static u8 * tls_send_change_cipher_spec(struct tlsv1_server *conn,
 718                                         size_t *out_len)
 719 {
 720         u8 *msg, *end, *pos;
 721
 722         *out_len = 0;
 723
 724         msg = os_malloc(1000);
 725         if (msg == NULL)
 726                 return NULL;
 727
 728         pos = msg;
 729         end = msg + 1000;
 730
 731         if (tls_write_server_change_cipher_spec(conn, &pos, end) < 0 ||
 732             tls_write_server_finished(conn, &pos, end) < 0) {
 733                 os_free(msg);
 734                 return NULL;
 735         }
 736
 737         *out_len = pos - msg;
 738
 739         wpa_printf(MSG_DEBUG, "TLSv1: Handshake completed successfully");
 740         conn->state = ESTABLISHED;
 741
 742         return msg;
 743 }
 744
 745
 746 u8 * tlsv1_server_handshake_write(struct tlsv1_server *conn, size_t *out_len)
 747 {
 748         switch (conn->state) {
 749         case SERVER_HELLO:
 750                 return tls_send_server_hello(conn, out_len);
 751         case SERVER_CHANGE_CIPHER_SPEC:
 752                 return tls_send_change_cipher_spec(conn, out_len);
 753         default:
 754                 if (conn->state == ESTABLISHED && conn->use_session_ticket) {
 755                         /* Abbreviated handshake was already completed. */
 756                         return NULL;
 757                 }
 758                 wpa_printf(MSG_DEBUG, "TLSv1: Unexpected state %d while "
 759                            "generating reply", conn->state);
 760                 return NULL;
 761         }
 762 }
 763
 764
 765 u8 * tlsv1_server_send_alert(struct tlsv1_server *conn, u8 level,
 766                              u8 description, size_t *out_len)
 767 {
 768         u8 *alert, *pos, *length;
 769
 770         wpa_printf(MSG_DEBUG, "TLSv1: Send Alert(%d:%d)", level, description);
 771         *out_len = 0;
 772
 773         alert = os_malloc(10);
 774         if (alert == NULL)
 775                 return NULL;
 776
 777         pos = alert;
 778
 779         /* TLSPlaintext */
 780         /* ContentType type */
 781         *pos++ = TLS_CONTENT_TYPE_ALERT;
 782         /* ProtocolVersion version */
 783         WPA_PUT_BE16(pos, conn->rl.tls_version ? conn->rl.tls_version :
 784                      TLS_VERSION);
 785         pos += 2;
 786         /* uint16 length (to be filled) */
 787         length = pos;
 788         pos += 2;
 789         /* opaque fragment[TLSPlaintext.length] */
 790
 791         /* Alert */
 792         /* AlertLevel level */
 793         *pos++ = level;
 794         /* AlertDescription description */
 795         *pos++ = description;
 796
 797         WPA_PUT_BE16(length, pos - length - 2);
 798         *out_len = pos - alert;
 799
 800         return alert;
 801 }