1/* 2 * EAP peer: EAP-TLS/PEAP/TTLS/FAST common functions 3 * Copyright (c) 2004-2019, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9#include "includes.h" 10 11#include "common.h" 12#include "crypto/sha1.h" 13#include "crypto/tls.h" 14#include "eap_i.h" 15#include "eap_tls_common.h" 16#include "eap_config.h" 17 18 19static struct wpabuf * eap_tls_msg_alloc(EapType type, size_t payload_len, 20 u8 code, u8 identifier) 21{ 22 if (type == EAP_UNAUTH_TLS_TYPE) 23 return eap_msg_alloc(EAP_VENDOR_UNAUTH_TLS, 24 EAP_VENDOR_TYPE_UNAUTH_TLS, payload_len, 25 code, identifier); 26 if (type == EAP_WFA_UNAUTH_TLS_TYPE) 27 return eap_msg_alloc(EAP_VENDOR_WFA_NEW, 28 EAP_VENDOR_WFA_UNAUTH_TLS, payload_len, 29 code, identifier); 30 return eap_msg_alloc(EAP_VENDOR_IETF, type, payload_len, code, 31 identifier); 32} 33 34 35static int eap_tls_check_blob(struct eap_sm *sm, const char **name, 36 const u8 **data, size_t *data_len) 37{ 38 const struct wpa_config_blob *blob; 39 40 if (*name == NULL || os_strncmp(*name, "blob://", 7) != 0) 41 return 0; 42 43 blob = eap_get_config_blob(sm, *name + 7); 44 if (blob == NULL) { 45 wpa_printf(MSG_ERROR, "%s: Named configuration blob '%s' not " 46 "found", __func__, *name + 7); 47 return -1; 48 } 49 50 *name = NULL; 51 *data = blob->data; 52 *data_len = blob->len; 53 54 return 0; 55} 56 57 58static void eap_tls_params_flags(struct tls_connection_params *params, 59 const char *txt) 60{ 61 if (txt == NULL) 62 return; 63 if (os_strstr(txt, "tls_allow_md5=1")) 64 params->flags |= TLS_CONN_ALLOW_SIGN_RSA_MD5; 65 if (os_strstr(txt, "tls_disable_time_checks=1")) 66 params->flags |= TLS_CONN_DISABLE_TIME_CHECKS; 67 if (os_strstr(txt, "tls_disable_session_ticket=1")) 68 params->flags |= TLS_CONN_DISABLE_SESSION_TICKET; 69 if (os_strstr(txt, "tls_disable_session_ticket=0")) 70 params->flags &= ~TLS_CONN_DISABLE_SESSION_TICKET; 71 if (os_strstr(txt, "tls_disable_tlsv1_0=1")) 72 params->flags |= TLS_CONN_DISABLE_TLSv1_0; 73 if (os_strstr(txt, "tls_disable_tlsv1_0=0")) { 74 params->flags &= ~TLS_CONN_DISABLE_TLSv1_0; 75 params->flags |= TLS_CONN_ENABLE_TLSv1_0; 76 } 77 if (os_strstr(txt, "tls_disable_tlsv1_1=1")) 78 params->flags |= TLS_CONN_DISABLE_TLSv1_1; 79 if (os_strstr(txt, "tls_disable_tlsv1_1=0")) { 80 params->flags &= ~TLS_CONN_DISABLE_TLSv1_1; 81 params->flags |= TLS_CONN_ENABLE_TLSv1_1; 82 } 83 if (os_strstr(txt, "tls_disable_tlsv1_2=1")) 84 params->flags |= TLS_CONN_DISABLE_TLSv1_2; 85 if (os_strstr(txt, "tls_disable_tlsv1_2=0")) { 86 params->flags &= ~TLS_CONN_DISABLE_TLSv1_2; 87 params->flags |= TLS_CONN_ENABLE_TLSv1_2; 88 } 89 if (os_strstr(txt, "tls_disable_tlsv1_3=1")) 90 params->flags |= TLS_CONN_DISABLE_TLSv1_3; 91 if (os_strstr(txt, "tls_disable_tlsv1_3=0")) 92 params->flags &= ~TLS_CONN_DISABLE_TLSv1_3; 93 if (os_strstr(txt, "tls_ext_cert_check=1")) 94 params->flags |= TLS_CONN_EXT_CERT_CHECK; 95 if (os_strstr(txt, "tls_ext_cert_check=0")) 96 params->flags &= ~TLS_CONN_EXT_CERT_CHECK; 97 if (os_strstr(txt, "tls_suiteb=1")) 98 params->flags |= TLS_CONN_SUITEB; 99 if (os_strstr(txt, "tls_suiteb=0")) 100 params->flags &= ~TLS_CONN_SUITEB; 101 if (os_strstr(txt, "tls_suiteb_no_ecdh=1")) 102 params->flags |= TLS_CONN_SUITEB_NO_ECDH; 103 if (os_strstr(txt, "tls_suiteb_no_ecdh=0")) 104 params->flags &= ~TLS_CONN_SUITEB_NO_ECDH; 105} 106 107 108static void eap_tls_params_from_conf1(struct tls_connection_params *params, 109 struct eap_peer_config *config) 110{ 111 params->ca_cert = config->ca_cert; 112 params->ca_path = config->ca_path; 113 params->client_cert = config->client_cert; 114 params->private_key = config->private_key; 115 params->private_key_passwd = config->private_key_passwd; 116 params->dh_file = config->dh_file; 117 params->subject_match = config->subject_match; 118 params->altsubject_match = config->altsubject_match; 119 params->check_cert_subject = config->check_cert_subject; 120 params->suffix_match = config->domain_suffix_match; 121 params->domain_match = config->domain_match; 122 params->engine = config->engine; 123 params->engine_id = config->engine_id; 124 params->pin = config->pin; 125 params->key_id = config->key_id; 126 params->cert_id = config->cert_id; 127 params->ca_cert_id = config->ca_cert_id; 128 eap_tls_params_flags(params, config->phase1); 129} 130 131 132static void eap_tls_params_from_conf2(struct tls_connection_params *params, 133 struct eap_peer_config *config) 134{ 135 params->ca_cert = config->ca_cert2; 136 params->ca_path = config->ca_path2; 137 params->client_cert = config->client_cert2; 138 params->private_key = config->private_key2; 139 params->private_key_passwd = config->private_key2_passwd; 140 params->dh_file = config->dh_file2; 141 params->subject_match = config->subject_match2; 142 params->altsubject_match = config->altsubject_match2; 143 params->check_cert_subject = config->check_cert_subject2; 144 params->suffix_match = config->domain_suffix_match2; 145 params->domain_match = config->domain_match2; 146 params->engine = config->engine2; 147 params->engine_id = config->engine2_id; 148 params->pin = config->pin2; 149 params->key_id = config->key2_id; 150 params->cert_id = config->cert2_id; 151 params->ca_cert_id = config->ca_cert2_id; 152 eap_tls_params_flags(params, config->phase2); 153} 154 155 156static int eap_tls_params_from_conf(struct eap_sm *sm, 157 struct eap_ssl_data *data, 158 struct tls_connection_params *params, 159 struct eap_peer_config *config, int phase2) 160{ 161 os_memset(params, 0, sizeof(*params)); 162 if (sm->workaround && data->eap_type != EAP_TYPE_FAST && 163 data->eap_type != EAP_TYPE_TEAP) { 164 /* 165 * Some deployed authentication servers seem to be unable to 166 * handle the TLS Session Ticket extension (they are supposed 167 * to ignore unrecognized TLS extensions, but end up rejecting 168 * the ClientHello instead). As a workaround, disable use of 169 * TLS Sesson Ticket extension for EAP-TLS, EAP-PEAP, and 170 * EAP-TTLS (EAP-FAST uses session ticket, so any server that 171 * supports EAP-FAST does not need this workaround). 172 */ 173 params->flags |= TLS_CONN_DISABLE_SESSION_TICKET; 174 } 175 if (data->eap_type == EAP_TYPE_TEAP) { 176 /* RFC 7170 requires TLS v1.2 or newer to be used with TEAP */ 177 params->flags |= TLS_CONN_DISABLE_TLSv1_0 | 178 TLS_CONN_DISABLE_TLSv1_1; 179 if (config->teap_anon_dh) 180 params->flags |= TLS_CONN_TEAP_ANON_DH; 181 } 182 if (data->eap_type == EAP_TYPE_FAST || 183 data->eap_type == EAP_TYPE_TEAP || 184 data->eap_type == EAP_TYPE_TTLS || 185 data->eap_type == EAP_TYPE_PEAP) { 186 /* The current EAP peer implementation is not yet ready for the 187 * TLS v1.3 changes, so disable this by default for now. */ 188 params->flags |= TLS_CONN_DISABLE_TLSv1_3; 189 } 190 if (data->eap_type == EAP_TYPE_TLS || 191 data->eap_type == EAP_UNAUTH_TLS_TYPE || 192 data->eap_type == EAP_WFA_UNAUTH_TLS_TYPE) { 193 /* While the current EAP-TLS implementation is more or less 194 * complete for TLS v1.3, there has been no interoperability 195 * testing with other implementations, so disable for by default 196 * for now until there has been chance to confirm that no 197 * significant interoperability issues show up with TLS version 198 * update. 199 */ 200 params->flags |= TLS_CONN_DISABLE_TLSv1_3; 201 } 202 if (phase2) { 203 wpa_printf(MSG_DEBUG, "TLS: using phase2 config options"); 204 eap_tls_params_from_conf2(params, config); 205 } else { 206 wpa_printf(MSG_DEBUG, "TLS: using phase1 config options"); 207 eap_tls_params_from_conf1(params, config); 208 if (data->eap_type == EAP_TYPE_FAST) 209 params->flags |= TLS_CONN_EAP_FAST; 210 } 211 212 /* 213 * Use blob data, if available. Otherwise, leave reference to external 214 * file as-is. 215 */ 216 if (eap_tls_check_blob(sm, ¶ms->ca_cert, ¶ms->ca_cert_blob, 217 ¶ms->ca_cert_blob_len) || 218 eap_tls_check_blob(sm, ¶ms->client_cert, 219 ¶ms->client_cert_blob, 220 ¶ms->client_cert_blob_len) || 221 eap_tls_check_blob(sm, ¶ms->private_key, 222 ¶ms->private_key_blob, 223 ¶ms->private_key_blob_len) || 224 eap_tls_check_blob(sm, ¶ms->dh_file, ¶ms->dh_blob, 225 ¶ms->dh_blob_len)) { 226 wpa_printf(MSG_INFO, "SSL: Failed to get configuration blobs"); 227 return -1; 228 } 229 230 params->openssl_ciphers = config->openssl_ciphers; 231 232 sm->ext_cert_check = !!(params->flags & TLS_CONN_EXT_CERT_CHECK); 233 234 if (!phase2) 235 data->client_cert_conf = params->client_cert || 236 params->client_cert_blob || 237 params->private_key || 238 params->private_key_blob; 239 240 return 0; 241} 242 243 244static int eap_tls_init_connection(struct eap_sm *sm, 245 struct eap_ssl_data *data, 246 struct eap_peer_config *config, 247 struct tls_connection_params *params) 248{ 249 int res; 250 251 if (config->ocsp) 252 params->flags |= TLS_CONN_REQUEST_OCSP; 253 if (config->ocsp >= 2) 254 params->flags |= TLS_CONN_REQUIRE_OCSP; 255 if (config->ocsp == 3) 256 params->flags |= TLS_CONN_REQUIRE_OCSP_ALL; 257 data->conn = tls_connection_init(data->ssl_ctx); 258 if (data->conn == NULL) { 259 wpa_printf(MSG_INFO, "SSL: Failed to initialize new TLS " 260 "connection"); 261 return -1; 262 } 263 264 res = tls_connection_set_params(data->ssl_ctx, data->conn, params); 265 if (res == TLS_SET_PARAMS_ENGINE_PRV_BAD_PIN) { 266 /* 267 * At this point with the pkcs11 engine the PIN is wrong. We 268 * reset the PIN in the configuration to be sure to not use it 269 * again and the calling function must request a new one. 270 */ 271 wpa_printf(MSG_INFO, 272 "TLS: Bad PIN provided, requesting a new one"); 273 os_free(config->pin); 274 config->pin = NULL; 275 eap_sm_request_pin(sm); 276 sm->ignore = TRUE; 277 } else if (res == TLS_SET_PARAMS_ENGINE_PRV_INIT_FAILED) { 278 wpa_printf(MSG_INFO, "TLS: Failed to initialize engine"); 279 } else if (res == TLS_SET_PARAMS_ENGINE_PRV_VERIFY_FAILED) { 280 wpa_printf(MSG_INFO, "TLS: Failed to load private key"); 281 sm->ignore = TRUE; 282 } 283 if (res) { 284 wpa_printf(MSG_INFO, "TLS: Failed to set TLS connection " 285 "parameters"); 286 tls_connection_deinit(data->ssl_ctx, data->conn); 287 data->conn = NULL; 288 return -1; 289 } 290 291 return 0; 292} 293 294 295/** 296 * eap_peer_tls_ssl_init - Initialize shared TLS functionality 297 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 298 * @data: Data for TLS processing 299 * @config: Pointer to the network configuration 300 * @eap_type: EAP method used in Phase 1 (EAP_TYPE_TLS/PEAP/TTLS/FAST) 301 * Returns: 0 on success, -1 on failure 302 * 303 * This function is used to initialize shared TLS functionality for EAP-TLS, 304 * EAP-PEAP, EAP-TTLS, and EAP-FAST. 305 */ 306int eap_peer_tls_ssl_init(struct eap_sm *sm, struct eap_ssl_data *data, 307 struct eap_peer_config *config, u8 eap_type) 308{ 309 struct tls_connection_params params; 310 311 if (config == NULL) 312 return -1; 313 314 data->eap = sm; 315 data->eap_type = eap_type; 316 data->phase2 = sm->init_phase2; 317 data->ssl_ctx = sm->init_phase2 && sm->ssl_ctx2 ? sm->ssl_ctx2 : 318 sm->ssl_ctx; 319 if (eap_tls_params_from_conf(sm, data, ¶ms, config, data->phase2) < 320 0) 321 return -1; 322 323 if (eap_tls_init_connection(sm, data, config, ¶ms) < 0) 324 return -1; 325 326 data->tls_out_limit = config->fragment_size; 327 if (data->phase2) { 328 /* Limit the fragment size in the inner TLS authentication 329 * since the outer authentication with EAP-PEAP does not yet 330 * support fragmentation */ 331 if (data->tls_out_limit > 100) 332 data->tls_out_limit -= 100; 333 } 334 335 if (config->phase1 && 336 os_strstr(config->phase1, "include_tls_length=1")) { 337 wpa_printf(MSG_DEBUG, "TLS: Include TLS Message Length in " 338 "unfragmented packets"); 339 data->include_tls_length = 1; 340 } 341 342 return 0; 343} 344 345 346/** 347 * eap_peer_tls_ssl_deinit - Deinitialize shared TLS functionality 348 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 349 * @data: Data for TLS processing 350 * 351 * This function deinitializes shared TLS functionality that was initialized 352 * with eap_peer_tls_ssl_init(). 353 */ 354void eap_peer_tls_ssl_deinit(struct eap_sm *sm, struct eap_ssl_data *data) 355{ 356 tls_connection_deinit(data->ssl_ctx, data->conn); 357 eap_peer_tls_reset_input(data); 358 eap_peer_tls_reset_output(data); 359} 360 361 362/** 363 * eap_peer_tls_derive_key - Derive a key based on TLS session data 364 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 365 * @data: Data for TLS processing 366 * @label: Label string for deriving the keys, e.g., "client EAP encryption" 367 * @context: Optional extra upper-layer context (max len 2^16) 368 * @context_len: The length of the context value 369 * @len: Length of the key material to generate (usually 64 for MSK) 370 * Returns: Pointer to allocated key on success or %NULL on failure 371 * 372 * This function uses TLS-PRF to generate pseudo-random data based on the TLS 373 * session data (client/server random and master key). Each key type may use a 374 * different label to bind the key usage into the generated material. 375 * 376 * The caller is responsible for freeing the returned buffer. 377 * 378 * Note: To provide the RFC 5705 context, the context variable must be non-NULL. 379 */ 380u8 * eap_peer_tls_derive_key(struct eap_sm *sm, struct eap_ssl_data *data, 381 const char *label, const u8 *context, 382 size_t context_len, size_t len) 383{ 384 u8 *out; 385 386 out = os_malloc(len); 387 if (out == NULL) 388 return NULL; 389 390 if (tls_connection_export_key(data->ssl_ctx, data->conn, label, 391 context, context_len, out, len)) { 392 os_free(out); 393 return NULL; 394 } 395 396 return out; 397} 398 399 400/** 401 * eap_peer_tls_derive_session_id - Derive a Session-Id based on TLS data 402 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 403 * @data: Data for TLS processing 404 * @eap_type: EAP method used in Phase 1 (EAP_TYPE_TLS/PEAP/TTLS/FAST) 405 * @len: Pointer to length of the session ID generated 406 * Returns: Pointer to allocated Session-Id on success or %NULL on failure 407 * 408 * This function derive the Session-Id based on the TLS session data 409 * (client/server random and method type). 410 * 411 * The caller is responsible for freeing the returned buffer. 412 */ 413u8 * eap_peer_tls_derive_session_id(struct eap_sm *sm, 414 struct eap_ssl_data *data, u8 eap_type, 415 size_t *len) 416{ 417 struct tls_random keys; 418 u8 *out; 419 420 if (eap_type == EAP_TYPE_TLS && data->tls_v13) { 421 u8 *id, *method_id; 422 const u8 context[] = { EAP_TYPE_TLS }; 423 424 /* Session-Id = <EAP-Type> || Method-Id 425 * Method-Id = TLS-Exporter("EXPORTER_EAP_TLS_Method-Id", 426 * Type-Code, 64) 427 */ 428 *len = 1 + 64; 429 id = os_malloc(*len); 430 if (!id) 431 return NULL; 432 method_id = eap_peer_tls_derive_key( 433 sm, data, "EXPORTER_EAP_TLS_Method-Id", context, 1, 64); 434 if (!method_id) { 435 os_free(id); 436 return NULL; 437 } 438 id[0] = eap_type; 439 os_memcpy(id + 1, method_id, 64); 440 os_free(method_id); 441 return id; 442 } 443 444 if (tls_connection_get_random(sm->ssl_ctx, data->conn, &keys) || 445 keys.client_random == NULL || keys.server_random == NULL) 446 return NULL; 447 448 *len = 1 + keys.client_random_len + keys.server_random_len; 449 out = os_malloc(*len); 450 if (out == NULL) 451 return NULL; 452 453 /* Session-Id = EAP type || client.random || server.random */ 454 out[0] = eap_type; 455 os_memcpy(out + 1, keys.client_random, keys.client_random_len); 456 os_memcpy(out + 1 + keys.client_random_len, keys.server_random, 457 keys.server_random_len); 458 459 return out; 460} 461 462 463/** 464 * eap_peer_tls_reassemble_fragment - Reassemble a received fragment 465 * @data: Data for TLS processing 466 * @in_data: Next incoming TLS segment 467 * Returns: 0 on success, 1 if more data is needed for the full message, or 468 * -1 on error 469 */ 470static int eap_peer_tls_reassemble_fragment(struct eap_ssl_data *data, 471 const struct wpabuf *in_data) 472{ 473 size_t tls_in_len, in_len; 474 475 tls_in_len = data->tls_in ? wpabuf_len(data->tls_in) : 0; 476 in_len = in_data ? wpabuf_len(in_data) : 0; 477 478 if (tls_in_len + in_len == 0) { 479 /* No message data received?! */ 480 wpa_printf(MSG_WARNING, "SSL: Invalid reassembly state: " 481 "tls_in_left=%lu tls_in_len=%lu in_len=%lu", 482 (unsigned long) data->tls_in_left, 483 (unsigned long) tls_in_len, 484 (unsigned long) in_len); 485 eap_peer_tls_reset_input(data); 486 return -1; 487 } 488 489 if (tls_in_len + in_len > 65536) { 490 /* 491 * Limit length to avoid rogue servers from causing large 492 * memory allocations. 493 */ 494 wpa_printf(MSG_INFO, "SSL: Too long TLS fragment (size over " 495 "64 kB)"); 496 eap_peer_tls_reset_input(data); 497 return -1; 498 } 499 500 if (in_len > data->tls_in_left) { 501 /* Sender is doing something odd - reject message */ 502 wpa_printf(MSG_INFO, "SSL: more data than TLS message length " 503 "indicated"); 504 eap_peer_tls_reset_input(data); 505 return -1; 506 } 507 508 if (wpabuf_resize(&data->tls_in, in_len) < 0) { 509 wpa_printf(MSG_INFO, "SSL: Could not allocate memory for TLS " 510 "data"); 511 eap_peer_tls_reset_input(data); 512 return -1; 513 } 514 if (in_data) 515 wpabuf_put_buf(data->tls_in, in_data); 516 data->tls_in_left -= in_len; 517 518 if (data->tls_in_left > 0) { 519 wpa_printf(MSG_DEBUG, "SSL: Need %lu bytes more input " 520 "data", (unsigned long) data->tls_in_left); 521 return 1; 522 } 523 524 return 0; 525} 526 527 528/** 529 * eap_peer_tls_data_reassemble - Reassemble TLS data 530 * @data: Data for TLS processing 531 * @in_data: Next incoming TLS segment 532 * @need_more_input: Variable for returning whether more input data is needed 533 * to reassemble this TLS packet 534 * Returns: Pointer to output data, %NULL on error or when more data is needed 535 * for the full message (in which case, *need_more_input is also set to 1). 536 * 537 * This function reassembles TLS fragments. Caller must not free the returned 538 * data buffer since an internal pointer to it is maintained. 539 */ 540static const struct wpabuf * eap_peer_tls_data_reassemble( 541 struct eap_ssl_data *data, const struct wpabuf *in_data, 542 int *need_more_input) 543{ 544 *need_more_input = 0; 545 546 if (data->tls_in_left > wpabuf_len(in_data) || data->tls_in) { 547 /* Message has fragments */ 548 int res = eap_peer_tls_reassemble_fragment(data, in_data); 549 if (res) { 550 if (res == 1) 551 *need_more_input = 1; 552 return NULL; 553 } 554 555 /* Message is now fully reassembled. */ 556 } else { 557 /* No fragments in this message, so just make a copy of it. */ 558 data->tls_in_left = 0; 559 data->tls_in = wpabuf_dup(in_data); 560 if (data->tls_in == NULL) 561 return NULL; 562 } 563 564 return data->tls_in; 565} 566 567 568/** 569 * eap_tls_process_input - Process incoming TLS message 570 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 571 * @data: Data for TLS processing 572 * @in_data: Message received from the server 573 * @out_data: Buffer for returning a pointer to application data (if available) 574 * Returns: 0 on success, 1 if more input data is needed, 2 if application data 575 * is available, -1 on failure 576 */ 577static int eap_tls_process_input(struct eap_sm *sm, struct eap_ssl_data *data, 578 const struct wpabuf *in_data, 579 struct wpabuf **out_data) 580{ 581 const struct wpabuf *msg; 582 int need_more_input; 583 struct wpabuf *appl_data; 584 585 msg = eap_peer_tls_data_reassemble(data, in_data, &need_more_input); 586 if (msg == NULL) 587 return need_more_input ? 1 : -1; 588 589 /* Full TLS message reassembled - continue handshake processing */ 590 if (data->tls_out) { 591 /* This should not happen.. */ 592 wpa_printf(MSG_INFO, "SSL: eap_tls_process_input - pending " 593 "tls_out data even though tls_out_len = 0"); 594 wpabuf_free(data->tls_out); 595 WPA_ASSERT(data->tls_out == NULL); 596 } 597 appl_data = NULL; 598 data->tls_out = tls_connection_handshake(data->ssl_ctx, data->conn, 599 msg, &appl_data); 600 601 eap_peer_tls_reset_input(data); 602 603 if (appl_data && 604 tls_connection_established(data->ssl_ctx, data->conn) && 605 !tls_connection_get_failed(data->ssl_ctx, data->conn)) { 606 wpa_hexdump_buf_key(MSG_MSGDUMP, "SSL: Application data", 607 appl_data); 608 *out_data = appl_data; 609 return 2; 610 } 611 612 wpabuf_free(appl_data); 613 614 return 0; 615} 616 617 618/** 619 * eap_tls_process_output - Process outgoing TLS message 620 * @data: Data for TLS processing 621 * @eap_type: EAP type (EAP_TYPE_TLS, EAP_TYPE_PEAP, ...) 622 * @peap_version: Version number for EAP-PEAP/TTLS 623 * @id: EAP identifier for the response 624 * @ret: Return value to use on success 625 * @out_data: Buffer for returning the allocated output buffer 626 * Returns: ret (0 or 1) on success, -1 on failure 627 */ 628static int eap_tls_process_output(struct eap_ssl_data *data, EapType eap_type, 629 int peap_version, u8 id, int ret, 630 struct wpabuf **out_data) 631{ 632 size_t len; 633 u8 *flags; 634 int more_fragments, length_included; 635 636 if (data->tls_out == NULL) 637 return -1; 638 len = wpabuf_len(data->tls_out) - data->tls_out_pos; 639 wpa_printf(MSG_DEBUG, "SSL: %lu bytes left to be sent out (of total " 640 "%lu bytes)", 641 (unsigned long) len, 642 (unsigned long) wpabuf_len(data->tls_out)); 643 644 /* 645 * Limit outgoing message to the configured maximum size. Fragment 646 * message if needed. 647 */ 648 if (len > data->tls_out_limit) { 649 more_fragments = 1; 650 len = data->tls_out_limit; 651 wpa_printf(MSG_DEBUG, "SSL: sending %lu bytes, more fragments " 652 "will follow", (unsigned long) len); 653 } else 654 more_fragments = 0; 655 656 length_included = data->tls_out_pos == 0 && 657 (wpabuf_len(data->tls_out) > data->tls_out_limit || 658 data->include_tls_length); 659 if (!length_included && 660 eap_type == EAP_TYPE_PEAP && peap_version == 0 && 661 !tls_connection_established(data->eap->ssl_ctx, data->conn)) { 662 /* 663 * Windows Server 2008 NPS really wants to have the TLS Message 664 * length included in phase 0 even for unfragmented frames or 665 * it will get very confused with Compound MAC calculation and 666 * Outer TLVs. 667 */ 668 length_included = 1; 669 } 670 671 *out_data = eap_tls_msg_alloc(eap_type, 1 + length_included * 4 + len, 672 EAP_CODE_RESPONSE, id); 673 if (*out_data == NULL) 674 return -1; 675 676 flags = wpabuf_put(*out_data, 1); 677 *flags = peap_version; 678 if (more_fragments) 679 *flags |= EAP_TLS_FLAGS_MORE_FRAGMENTS; 680 if (length_included) { 681 *flags |= EAP_TLS_FLAGS_LENGTH_INCLUDED; 682 wpabuf_put_be32(*out_data, wpabuf_len(data->tls_out)); 683 } 684 685 wpabuf_put_data(*out_data, 686 wpabuf_head_u8(data->tls_out) + data->tls_out_pos, 687 len); 688 data->tls_out_pos += len; 689 690 if (!more_fragments) 691 eap_peer_tls_reset_output(data); 692 693 return ret; 694} 695 696 697/** 698 * eap_peer_tls_process_helper - Process TLS handshake message 699 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 700 * @data: Data for TLS processing 701 * @eap_type: EAP type (EAP_TYPE_TLS, EAP_TYPE_PEAP, ...) 702 * @peap_version: Version number for EAP-PEAP/TTLS 703 * @id: EAP identifier for the response 704 * @in_data: Message received from the server 705 * @out_data: Buffer for returning a pointer to the response message 706 * Returns: 0 on success, 1 if more input data is needed, 2 if application data 707 * is available, or -1 on failure 708 * 709 * This function can be used to process TLS handshake messages. It reassembles 710 * the received fragments and uses a TLS library to process the messages. The 711 * response data from the TLS library is fragmented to suitable output messages 712 * that the caller can send out. 713 * 714 * out_data is used to return the response message if the return value of this 715 * function is 0, 2, or -1. In case of failure, the message is likely a TLS 716 * alarm message. The caller is responsible for freeing the allocated buffer if 717 * *out_data is not %NULL. 718 * 719 * This function is called for each received TLS message during the TLS 720 * handshake after eap_peer_tls_process_init() call and possible processing of 721 * TLS Flags field. Once the handshake has been completed, i.e., when 722 * tls_connection_established() returns 1, EAP method specific decrypting of 723 * the tunneled data is used. 724 */ 725int eap_peer_tls_process_helper(struct eap_sm *sm, struct eap_ssl_data *data, 726 EapType eap_type, int peap_version, 727 u8 id, const struct wpabuf *in_data, 728 struct wpabuf **out_data) 729{ 730 int ret = 0; 731 732 *out_data = NULL; 733 734 if (data->tls_out && wpabuf_len(data->tls_out) > 0 && 735 wpabuf_len(in_data) > 0) { 736 wpa_printf(MSG_DEBUG, "SSL: Received non-ACK when output " 737 "fragments are waiting to be sent out"); 738 return -1; 739 } 740 741 if (data->tls_out == NULL || wpabuf_len(data->tls_out) == 0) { 742 /* 743 * No more data to send out - expect to receive more data from 744 * the AS. 745 */ 746 int res = eap_tls_process_input(sm, data, in_data, out_data); 747 char buf[20]; 748 749 if (res) { 750 /* 751 * Input processing failed (res = -1) or more data is 752 * needed (res = 1). 753 */ 754 return res; 755 } 756 757 /* 758 * The incoming message has been reassembled and processed. The 759 * response was allocated into data->tls_out buffer. 760 */ 761 762 if (tls_get_version(data->ssl_ctx, data->conn, 763 buf, sizeof(buf)) == 0) { 764 wpa_printf(MSG_DEBUG, "SSL: Using TLS version %s", buf); 765 data->tls_v13 = os_strcmp(buf, "TLSv1.3") == 0; 766 } 767 } 768 769 if (data->tls_out == NULL) { 770 /* 771 * No outgoing fragments remaining from the previous message 772 * and no new message generated. This indicates an error in TLS 773 * processing. 774 */ 775 eap_peer_tls_reset_output(data); 776 return -1; 777 } 778 779 if (tls_connection_get_failed(data->ssl_ctx, data->conn)) { 780 /* TLS processing has failed - return error */ 781 wpa_printf(MSG_DEBUG, "SSL: Failed - tls_out available to " 782 "report error (len=%u)", 783 (unsigned int) wpabuf_len(data->tls_out)); 784 ret = -1; 785 /* TODO: clean pin if engine used? */ 786 if (wpabuf_len(data->tls_out) == 0) { 787 wpabuf_free(data->tls_out); 788 data->tls_out = NULL; 789 return -1; 790 } 791 } 792 793 if (wpabuf_len(data->tls_out) == 0) { 794 /* 795 * TLS negotiation should now be complete since all other cases 796 * needing more data should have been caught above based on 797 * the TLS Message Length field. 798 */ 799 wpa_printf(MSG_DEBUG, "SSL: No data to be sent out"); 800 wpabuf_free(data->tls_out); 801 data->tls_out = NULL; 802 return 1; 803 } 804 805 /* Send the pending message (in fragments, if needed). */ 806 return eap_tls_process_output(data, eap_type, peap_version, id, ret, 807 out_data); 808} 809 810 811/** 812 * eap_peer_tls_build_ack - Build a TLS ACK frame 813 * @id: EAP identifier for the response 814 * @eap_type: EAP type (EAP_TYPE_TLS, EAP_TYPE_PEAP, ...) 815 * @peap_version: Version number for EAP-PEAP/TTLS 816 * Returns: Pointer to the allocated ACK frame or %NULL on failure 817 */ 818struct wpabuf * eap_peer_tls_build_ack(u8 id, EapType eap_type, 819 int peap_version) 820{ 821 struct wpabuf *resp; 822 823 resp = eap_tls_msg_alloc(eap_type, 1, EAP_CODE_RESPONSE, id); 824 if (resp == NULL) 825 return NULL; 826 wpa_printf(MSG_DEBUG, "SSL: Building ACK (type=%d id=%d ver=%d)", 827 (int) eap_type, id, peap_version); 828 wpabuf_put_u8(resp, peap_version); /* Flags */ 829 return resp; 830} 831 832 833/** 834 * eap_peer_tls_reauth_init - Re-initialize shared TLS for session resumption 835 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 836 * @data: Data for TLS processing 837 * Returns: 0 on success, -1 on failure 838 */ 839int eap_peer_tls_reauth_init(struct eap_sm *sm, struct eap_ssl_data *data) 840{ 841 eap_peer_tls_reset_input(data); 842 eap_peer_tls_reset_output(data); 843 return tls_connection_shutdown(data->ssl_ctx, data->conn); 844} 845 846 847/** 848 * eap_peer_tls_status - Get TLS status 849 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 850 * @data: Data for TLS processing 851 * @buf: Buffer for status information 852 * @buflen: Maximum buffer length 853 * @verbose: Whether to include verbose status information 854 * Returns: Number of bytes written to buf. 855 */ 856int eap_peer_tls_status(struct eap_sm *sm, struct eap_ssl_data *data, 857 char *buf, size_t buflen, int verbose) 858{ 859 char version[20], name[128]; 860 int len = 0, ret; 861 862 if (tls_get_version(data->ssl_ctx, data->conn, version, 863 sizeof(version)) < 0) 864 version[0] = '\0'; 865 if (tls_get_cipher(data->ssl_ctx, data->conn, name, sizeof(name)) < 0) 866 name[0] = '\0'; 867 868 ret = os_snprintf(buf + len, buflen - len, 869 "eap_tls_version=%s\n" 870 "EAP TLS cipher=%s\n" 871 "tls_session_reused=%d\n", 872 version, name, 873 tls_connection_resumed(data->ssl_ctx, data->conn)); 874 if (os_snprintf_error(buflen - len, ret)) 875 return len; 876 len += ret; 877 878 return len; 879} 880 881 882/** 883 * eap_peer_tls_process_init - Initial validation/processing of EAP requests 884 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 885 * @data: Data for TLS processing 886 * @eap_type: EAP type (EAP_TYPE_TLS, EAP_TYPE_PEAP, ...) 887 * @ret: Return values from EAP request validation and processing 888 * @reqData: EAP request to be processed (eapReqData) 889 * @len: Buffer for returning length of the remaining payload 890 * @flags: Buffer for returning TLS flags 891 * Returns: Pointer to payload after TLS flags and length or %NULL on failure 892 * 893 * This function validates the EAP header and processes the optional TLS 894 * Message Length field. If this is the first fragment of a TLS message, the 895 * TLS reassembly code is initialized to receive the indicated number of bytes. 896 * 897 * EAP-TLS, EAP-PEAP, EAP-TTLS, and EAP-FAST methods are expected to use this 898 * function as the first step in processing received messages. They will need 899 * to process the flags (apart from Message Length Included) that are returned 900 * through the flags pointer and the message payload that will be returned (and 901 * the length is returned through the len pointer). Return values (ret) are set 902 * for continuation of EAP method processing. The caller is responsible for 903 * setting these to indicate completion (either success or failure) based on 904 * the authentication result. 905 */ 906const u8 * eap_peer_tls_process_init(struct eap_sm *sm, 907 struct eap_ssl_data *data, 908 EapType eap_type, 909 struct eap_method_ret *ret, 910 const struct wpabuf *reqData, 911 size_t *len, u8 *flags) 912{ 913 const u8 *pos; 914 size_t left; 915 unsigned int tls_msg_len; 916 917 if (tls_get_errors(data->ssl_ctx)) { 918 wpa_printf(MSG_INFO, "SSL: TLS errors detected"); 919 ret->ignore = TRUE; 920 return NULL; 921 } 922 923 if (eap_type == EAP_UNAUTH_TLS_TYPE) 924 pos = eap_hdr_validate(EAP_VENDOR_UNAUTH_TLS, 925 EAP_VENDOR_TYPE_UNAUTH_TLS, reqData, 926 &left); 927 else if (eap_type == EAP_WFA_UNAUTH_TLS_TYPE) 928 pos = eap_hdr_validate(EAP_VENDOR_WFA_NEW, 929 EAP_VENDOR_WFA_UNAUTH_TLS, reqData, 930 &left); 931 else 932 pos = eap_hdr_validate(EAP_VENDOR_IETF, eap_type, reqData, 933 &left); 934 if (pos == NULL) { 935 ret->ignore = TRUE; 936 return NULL; 937 } 938 if (left == 0) { 939 wpa_printf(MSG_DEBUG, "SSL: Invalid TLS message: no Flags " 940 "octet included"); 941 if (!sm->workaround) { 942 ret->ignore = TRUE; 943 return NULL; 944 } 945 946 wpa_printf(MSG_DEBUG, "SSL: Workaround - assume no Flags " 947 "indicates ACK frame"); 948 *flags = 0; 949 } else { 950 *flags = *pos++; 951 left--; 952 } 953 wpa_printf(MSG_DEBUG, "SSL: Received packet(len=%lu) - " 954 "Flags 0x%02x", (unsigned long) wpabuf_len(reqData), 955 *flags); 956 if (*flags & EAP_TLS_FLAGS_LENGTH_INCLUDED) { 957 if (left < 4) { 958 wpa_printf(MSG_INFO, "SSL: Short frame with TLS " 959 "length"); 960 ret->ignore = TRUE; 961 return NULL; 962 } 963 tls_msg_len = WPA_GET_BE32(pos); 964 wpa_printf(MSG_DEBUG, "SSL: TLS Message Length: %d", 965 tls_msg_len); 966 if (data->tls_in_left == 0) { 967 data->tls_in_total = tls_msg_len; 968 data->tls_in_left = tls_msg_len; 969 wpabuf_free(data->tls_in); 970 data->tls_in = NULL; 971 } 972 pos += 4; 973 left -= 4; 974 975 if (left > tls_msg_len) { 976 wpa_printf(MSG_INFO, "SSL: TLS Message Length (%d " 977 "bytes) smaller than this fragment (%d " 978 "bytes)", (int) tls_msg_len, (int) left); 979 ret->ignore = TRUE; 980 return NULL; 981 } 982 } 983 984 ret->ignore = FALSE; 985 ret->methodState = METHOD_MAY_CONT; 986 ret->decision = DECISION_FAIL; 987 ret->allowNotifications = TRUE; 988 989 *len = left; 990 return pos; 991} 992 993 994/** 995 * eap_peer_tls_reset_input - Reset input buffers 996 * @data: Data for TLS processing 997 * 998 * This function frees any allocated memory for input buffers and resets input 999 * state. 1000 */ 1001void eap_peer_tls_reset_input(struct eap_ssl_data *data) 1002{ 1003 data->tls_in_left = data->tls_in_total = 0; 1004 wpabuf_free(data->tls_in); 1005 data->tls_in = NULL; 1006} 1007 1008 1009/** 1010 * eap_peer_tls_reset_output - Reset output buffers 1011 * @data: Data for TLS processing 1012 * 1013 * This function frees any allocated memory for output buffers and resets 1014 * output state. 1015 */ 1016void eap_peer_tls_reset_output(struct eap_ssl_data *data) 1017{ 1018 data->tls_out_pos = 0; 1019 wpabuf_free(data->tls_out); 1020 data->tls_out = NULL; 1021} 1022 1023 1024/** 1025 * eap_peer_tls_decrypt - Decrypt received phase 2 TLS message 1026 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1027 * @data: Data for TLS processing 1028 * @in_data: Message received from the server 1029 * @in_decrypted: Buffer for returning a pointer to the decrypted message 1030 * Returns: 0 on success, 1 if more input data is needed, or -1 on failure 1031 */ 1032int eap_peer_tls_decrypt(struct eap_sm *sm, struct eap_ssl_data *data, 1033 const struct wpabuf *in_data, 1034 struct wpabuf **in_decrypted) 1035{ 1036 const struct wpabuf *msg; 1037 int need_more_input; 1038 1039 msg = eap_peer_tls_data_reassemble(data, in_data, &need_more_input); 1040 if (msg == NULL) 1041 return need_more_input ? 1 : -1; 1042 1043 *in_decrypted = tls_connection_decrypt(data->ssl_ctx, data->conn, msg); 1044 eap_peer_tls_reset_input(data); 1045 if (*in_decrypted == NULL) { 1046 wpa_printf(MSG_INFO, "SSL: Failed to decrypt Phase 2 data"); 1047 return -1; 1048 } 1049 return 0; 1050} 1051 1052 1053/** 1054 * eap_peer_tls_encrypt - Encrypt phase 2 TLS message 1055 * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init() 1056 * @data: Data for TLS processing 1057 * @eap_type: EAP type (EAP_TYPE_TLS, EAP_TYPE_PEAP, ...) 1058 * @peap_version: Version number for EAP-PEAP/TTLS 1059 * @id: EAP identifier for the response 1060 * @in_data: Plaintext phase 2 data to encrypt or %NULL to continue fragments 1061 * @out_data: Buffer for returning a pointer to the encrypted response message 1062 * Returns: 0 on success, -1 on failure 1063 */ 1064int eap_peer_tls_encrypt(struct eap_sm *sm, struct eap_ssl_data *data, 1065 EapType eap_type, int peap_version, u8 id, 1066 const struct wpabuf *in_data, 1067 struct wpabuf **out_data) 1068{ 1069 if (in_data) { 1070 eap_peer_tls_reset_output(data); 1071 data->tls_out = tls_connection_encrypt(data->ssl_ctx, 1072 data->conn, in_data); 1073 if (data->tls_out == NULL) { 1074 wpa_printf(MSG_INFO, "SSL: Failed to encrypt Phase 2 " 1075 "data (in_len=%lu)", 1076 (unsigned long) wpabuf_len(in_data)); 1077 eap_peer_tls_reset_output(data); 1078 return -1; 1079 } 1080 } 1081 1082 return eap_tls_process_output(data, eap_type, peap_version, id, 0, 1083 out_data); 1084} 1085 1086 1087/** 1088 * eap_peer_select_phase2_methods - Select phase 2 EAP method 1089 * @config: Pointer to the network configuration 1090 * @prefix: 'phase2' configuration prefix, e.g., "auth=" 1091 * @types: Buffer for returning allocated list of allowed EAP methods 1092 * @num_types: Buffer for returning number of allocated EAP methods 1093 * Returns: 0 on success, -1 on failure 1094 * 1095 * This function is used to parse EAP method list and select allowed methods 1096 * for Phase2 authentication. 1097 */ 1098int eap_peer_select_phase2_methods(struct eap_peer_config *config, 1099 const char *prefix, 1100 struct eap_method_type **types, 1101 size_t *num_types) 1102{ 1103 char *start, *pos, *buf; 1104 struct eap_method_type *methods = NULL, *_methods; 1105 u32 method; 1106 size_t num_methods = 0, prefix_len; 1107 1108 if (config == NULL || config->phase2 == NULL) 1109 goto get_defaults; 1110 1111 start = buf = os_strdup(config->phase2); 1112 if (buf == NULL) 1113 return -1; 1114 1115 prefix_len = os_strlen(prefix); 1116 1117 while (start && *start != '\0') { 1118 int vendor; 1119 pos = os_strstr(start, prefix); 1120 if (pos == NULL) 1121 break; 1122 if (start != pos && *(pos - 1) != ' ') { 1123 start = pos + prefix_len; 1124 continue; 1125 } 1126 1127 start = pos + prefix_len; 1128 pos = os_strchr(start, ' '); 1129 if (pos) 1130 *pos++ = '\0'; 1131 method = eap_get_phase2_type(start, &vendor); 1132 if (vendor == EAP_VENDOR_IETF && method == EAP_TYPE_NONE) { 1133 wpa_printf(MSG_ERROR, "TLS: Unsupported Phase2 EAP " 1134 "method '%s'", start); 1135 os_free(methods); 1136 os_free(buf); 1137 return -1; 1138 } else { 1139 num_methods++; 1140 _methods = os_realloc_array(methods, num_methods, 1141 sizeof(*methods)); 1142 if (_methods == NULL) { 1143 os_free(methods); 1144 os_free(buf); 1145 return -1; 1146 } 1147 methods = _methods; 1148 methods[num_methods - 1].vendor = vendor; 1149 methods[num_methods - 1].method = method; 1150 } 1151 1152 start = pos; 1153 } 1154 1155 os_free(buf); 1156 1157get_defaults: 1158 if (methods == NULL) 1159 methods = eap_get_phase2_types(config, &num_methods); 1160 1161 if (methods == NULL) { 1162 wpa_printf(MSG_ERROR, "TLS: No Phase2 EAP methods available"); 1163 return -1; 1164 } 1165 wpa_hexdump(MSG_DEBUG, "TLS: Phase2 EAP types", 1166 (u8 *) methods, 1167 num_methods * sizeof(struct eap_method_type)); 1168 1169 *types = methods; 1170 *num_types = num_methods; 1171 1172 return 0; 1173} 1174 1175 1176/** 1177 * eap_peer_tls_phase2_nak - Generate EAP-Nak for Phase 2 1178 * @types: Buffer for returning allocated list of allowed EAP methods 1179 * @num_types: Buffer for returning number of allocated EAP methods 1180 * @hdr: EAP-Request header (and the following EAP type octet) 1181 * @resp: Buffer for returning the EAP-Nak message 1182 * Returns: 0 on success, -1 on failure 1183 */ 1184int eap_peer_tls_phase2_nak(struct eap_method_type *types, size_t num_types, 1185 struct eap_hdr *hdr, struct wpabuf **resp) 1186{ 1187 u8 *pos = (u8 *) (hdr + 1); 1188 size_t i; 1189 1190 /* TODO: add support for expanded Nak */ 1191 wpa_printf(MSG_DEBUG, "TLS: Phase 2 Request: Nak type=%d", *pos); 1192 wpa_hexdump(MSG_DEBUG, "TLS: Allowed Phase2 EAP types", 1193 (u8 *) types, num_types * sizeof(struct eap_method_type)); 1194 *resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_NAK, num_types, 1195 EAP_CODE_RESPONSE, hdr->identifier); 1196 if (*resp == NULL) 1197 return -1; 1198 1199 for (i = 0; i < num_types; i++) { 1200 if (types[i].vendor == EAP_VENDOR_IETF && 1201 types[i].method < 256) 1202 wpabuf_put_u8(*resp, types[i].method); 1203 } 1204 1205 eap_update_len(*resp); 1206 1207 return 0; 1208} 1209