1 /*
2  * EAP-TLS/PEAP/TTLS/FAST server common functions
3  * Copyright (c) 2004-2009, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "includes.h"
10 
11 #include "common.h"
12 #include "crypto/sha1.h"
13 #include "crypto/tls.h"
14 #include "eap_i.h"
15 #include "eap_tls_common.h"
16 
17 
18 static void eap_server_tls_free_in_buf(struct eap_ssl_data *data);
19 
20 
eap_tls_msg_alloc(EapType type,size_t payload_len,u8 code,u8 identifier)21 struct wpabuf * eap_tls_msg_alloc(EapType type, size_t payload_len,
22 				  u8 code, u8 identifier)
23 {
24 	if (type == EAP_UNAUTH_TLS_TYPE)
25 		return eap_msg_alloc(EAP_VENDOR_UNAUTH_TLS,
26 				     EAP_VENDOR_TYPE_UNAUTH_TLS, payload_len,
27 				     code, identifier);
28 	else if (type == EAP_WFA_UNAUTH_TLS_TYPE)
29 		return eap_msg_alloc(EAP_VENDOR_WFA_NEW,
30 				     EAP_VENDOR_WFA_UNAUTH_TLS, payload_len,
31 				     code, identifier);
32 	return eap_msg_alloc(EAP_VENDOR_IETF, type, payload_len, code,
33 			     identifier);
34 }
35 
36 
37 #ifdef CONFIG_TLS_INTERNAL
eap_server_tls_log_cb(void * ctx,const char * msg)38 static void eap_server_tls_log_cb(void *ctx, const char *msg)
39 {
40 	struct eap_sm *sm = ctx;
41 	eap_log_msg(sm, "TLS: %s", msg);
42 }
43 #endif /* CONFIG_TLS_INTERNAL */
44 
45 
eap_server_tls_ssl_init(struct eap_sm * sm,struct eap_ssl_data * data,int verify_peer)46 int eap_server_tls_ssl_init(struct eap_sm *sm, struct eap_ssl_data *data,
47 			    int verify_peer)
48 {
49 	if (sm->ssl_ctx == NULL) {
50 		wpa_printf(MSG_ERROR, "TLS context not initialized - cannot use TLS-based EAP method");
51 		return -1;
52 	}
53 
54 	data->eap = sm;
55 	data->phase2 = sm->init_phase2;
56 
57 	data->conn = tls_connection_init(sm->ssl_ctx);
58 	if (data->conn == NULL) {
59 		wpa_printf(MSG_INFO, "SSL: Failed to initialize new TLS "
60 			   "connection");
61 		return -1;
62 	}
63 
64 #ifdef CONFIG_TLS_INTERNAL
65 	tls_connection_set_log_cb(data->conn, eap_server_tls_log_cb, sm);
66 #ifdef CONFIG_TESTING_OPTIONS
67 	tls_connection_set_test_flags(data->conn, sm->tls_test_flags);
68 #endif /* CONFIG_TESTING_OPTIONS */
69 #endif /* CONFIG_TLS_INTERNAL */
70 
71 	if (tls_connection_set_verify(sm->ssl_ctx, data->conn, verify_peer)) {
72 		wpa_printf(MSG_INFO, "SSL: Failed to configure verification "
73 			   "of TLS peer certificate");
74 		tls_connection_deinit(sm->ssl_ctx, data->conn);
75 		data->conn = NULL;
76 		return -1;
77 	}
78 
79 	data->tls_out_limit = sm->fragment_size > 0 ? sm->fragment_size : 1398;
80 	if (data->phase2) {
81 		/* Limit the fragment size in the inner TLS authentication
82 		 * since the outer authentication with EAP-PEAP does not yet
83 		 * support fragmentation */
84 		if (data->tls_out_limit > 100)
85 			data->tls_out_limit -= 100;
86 	}
87 	return 0;
88 }
89 
90 
eap_server_tls_ssl_deinit(struct eap_sm * sm,struct eap_ssl_data * data)91 void eap_server_tls_ssl_deinit(struct eap_sm *sm, struct eap_ssl_data *data)
92 {
93 	tls_connection_deinit(sm->ssl_ctx, data->conn);
94 	eap_server_tls_free_in_buf(data);
95 	wpabuf_free(data->tls_out);
96 	data->tls_out = NULL;
97 }
98 
99 
eap_server_tls_derive_key(struct eap_sm * sm,struct eap_ssl_data * data,char * label,size_t len)100 u8 * eap_server_tls_derive_key(struct eap_sm *sm, struct eap_ssl_data *data,
101 			       char *label, size_t len)
102 {
103 	u8 *out;
104 
105 	out = os_malloc(len);
106 	if (out == NULL)
107 		return NULL;
108 
109 	if (tls_connection_prf(sm->ssl_ctx, data->conn, label, 0, 0,
110 			       out, len)) {
111 		os_free(out);
112 		return NULL;
113 	}
114 
115 	return out;
116 }
117 
118 
119 /**
120  * eap_server_tls_derive_session_id - Derive a Session-Id based on TLS data
121  * @sm: Pointer to EAP state machine allocated with eap_peer_sm_init()
122  * @data: Data for TLS processing
123  * @eap_type: EAP method used in Phase 1 (EAP_TYPE_TLS/PEAP/TTLS/FAST)
124  * @len: Pointer to length of the session ID generated
125  * Returns: Pointer to allocated Session-Id on success or %NULL on failure
126  *
127  * This function derive the Session-Id based on the TLS session data
128  * (client/server random and method type).
129  *
130  * The caller is responsible for freeing the returned buffer.
131  */
eap_server_tls_derive_session_id(struct eap_sm * sm,struct eap_ssl_data * data,u8 eap_type,size_t * len)132 u8 * eap_server_tls_derive_session_id(struct eap_sm *sm,
133 				      struct eap_ssl_data *data, u8 eap_type,
134 				      size_t *len)
135 {
136 	struct tls_keys keys;
137 	u8 *out;
138 
139 	if (tls_connection_get_keys(sm->ssl_ctx, data->conn, &keys))
140 		return NULL;
141 
142 	if (keys.client_random == NULL || keys.server_random == NULL)
143 		return NULL;
144 
145 	*len = 1 + keys.client_random_len + keys.server_random_len;
146 	out = os_malloc(*len);
147 	if (out == NULL)
148 		return NULL;
149 
150 	/* Session-Id = EAP type || client.random || server.random */
151 	out[0] = eap_type;
152 	os_memcpy(out + 1, keys.client_random, keys.client_random_len);
153 	os_memcpy(out + 1 + keys.client_random_len, keys.server_random,
154 		  keys.server_random_len);
155 
156 	return out;
157 }
158 
159 
eap_server_tls_build_msg(struct eap_ssl_data * data,int eap_type,int version,u8 id)160 struct wpabuf * eap_server_tls_build_msg(struct eap_ssl_data *data,
161 					 int eap_type, int version, u8 id)
162 {
163 	struct wpabuf *req;
164 	u8 flags;
165 	size_t send_len, plen;
166 
167 	wpa_printf(MSG_DEBUG, "SSL: Generating Request");
168 	if (data->tls_out == NULL) {
169 		wpa_printf(MSG_ERROR, "SSL: tls_out NULL in %s", __func__);
170 		return NULL;
171 	}
172 
173 	flags = version;
174 	send_len = wpabuf_len(data->tls_out) - data->tls_out_pos;
175 	if (1 + send_len > data->tls_out_limit) {
176 		send_len = data->tls_out_limit - 1;
177 		flags |= EAP_TLS_FLAGS_MORE_FRAGMENTS;
178 		if (data->tls_out_pos == 0) {
179 			flags |= EAP_TLS_FLAGS_LENGTH_INCLUDED;
180 			send_len -= 4;
181 		}
182 	}
183 
184 	plen = 1 + send_len;
185 	if (flags & EAP_TLS_FLAGS_LENGTH_INCLUDED)
186 		plen += 4;
187 
188 	req = eap_tls_msg_alloc(eap_type, plen, EAP_CODE_REQUEST, id);
189 	if (req == NULL)
190 		return NULL;
191 
192 	wpabuf_put_u8(req, flags); /* Flags */
193 	if (flags & EAP_TLS_FLAGS_LENGTH_INCLUDED)
194 		wpabuf_put_be32(req, wpabuf_len(data->tls_out));
195 
196 	wpabuf_put_data(req, wpabuf_head_u8(data->tls_out) + data->tls_out_pos,
197 			send_len);
198 	data->tls_out_pos += send_len;
199 
200 	if (data->tls_out_pos == wpabuf_len(data->tls_out)) {
201 		wpa_printf(MSG_DEBUG, "SSL: Sending out %lu bytes "
202 			   "(message sent completely)",
203 			   (unsigned long) send_len);
204 		wpabuf_free(data->tls_out);
205 		data->tls_out = NULL;
206 		data->tls_out_pos = 0;
207 		data->state = MSG;
208 	} else {
209 		wpa_printf(MSG_DEBUG, "SSL: Sending out %lu bytes "
210 			   "(%lu more to send)", (unsigned long) send_len,
211 			   (unsigned long) wpabuf_len(data->tls_out) -
212 			   data->tls_out_pos);
213 		data->state = WAIT_FRAG_ACK;
214 	}
215 
216 	return req;
217 }
218 
219 
eap_server_tls_build_ack(u8 id,int eap_type,int version)220 struct wpabuf * eap_server_tls_build_ack(u8 id, int eap_type, int version)
221 {
222 	struct wpabuf *req;
223 
224 	req = eap_tls_msg_alloc(eap_type, 1, EAP_CODE_REQUEST, id);
225 	if (req == NULL)
226 		return NULL;
227 	wpa_printf(MSG_DEBUG, "SSL: Building ACK");
228 	wpabuf_put_u8(req, version); /* Flags */
229 	return req;
230 }
231 
232 
eap_server_tls_process_cont(struct eap_ssl_data * data,const u8 * buf,size_t len)233 static int eap_server_tls_process_cont(struct eap_ssl_data *data,
234 				       const u8 *buf, size_t len)
235 {
236 	/* Process continuation of a pending message */
237 	if (len > wpabuf_tailroom(data->tls_in)) {
238 		wpa_printf(MSG_DEBUG, "SSL: Fragment overflow");
239 		return -1;
240 	}
241 
242 	wpabuf_put_data(data->tls_in, buf, len);
243 	wpa_printf(MSG_DEBUG, "SSL: Received %lu bytes, waiting for %lu "
244 		   "bytes more", (unsigned long) len,
245 		   (unsigned long) wpabuf_tailroom(data->tls_in));
246 
247 	return 0;
248 }
249 
250 
eap_server_tls_process_fragment(struct eap_ssl_data * data,u8 flags,u32 message_length,const u8 * buf,size_t len)251 static int eap_server_tls_process_fragment(struct eap_ssl_data *data,
252 					   u8 flags, u32 message_length,
253 					   const u8 *buf, size_t len)
254 {
255 	/* Process a fragment that is not the last one of the message */
256 	if (data->tls_in == NULL && !(flags & EAP_TLS_FLAGS_LENGTH_INCLUDED)) {
257 		wpa_printf(MSG_DEBUG, "SSL: No Message Length field in a "
258 			   "fragmented packet");
259 		return -1;
260 	}
261 
262 	if (data->tls_in == NULL) {
263 		/* First fragment of the message */
264 
265 		/* Limit length to avoid rogue peers from causing large
266 		 * memory allocations. */
267 		if (message_length > 65536) {
268 			wpa_printf(MSG_INFO, "SSL: Too long TLS fragment (size"
269 				   " over 64 kB)");
270 			return -1;
271 		}
272 
273 		if (len > message_length) {
274 			wpa_printf(MSG_INFO, "SSL: Too much data (%d bytes) in "
275 				   "first fragment of frame (TLS Message "
276 				   "Length %d bytes)",
277 				   (int) len, (int) message_length);
278 			return -1;
279 		}
280 
281 		data->tls_in = wpabuf_alloc(message_length);
282 		if (data->tls_in == NULL) {
283 			wpa_printf(MSG_DEBUG, "SSL: No memory for message");
284 			return -1;
285 		}
286 		wpabuf_put_data(data->tls_in, buf, len);
287 		wpa_printf(MSG_DEBUG, "SSL: Received %lu bytes in first "
288 			   "fragment, waiting for %lu bytes more",
289 			   (unsigned long) len,
290 			   (unsigned long) wpabuf_tailroom(data->tls_in));
291 	}
292 
293 	return 0;
294 }
295 
296 
eap_server_tls_phase1(struct eap_sm * sm,struct eap_ssl_data * data)297 int eap_server_tls_phase1(struct eap_sm *sm, struct eap_ssl_data *data)
298 {
299 	if (data->tls_out) {
300 		/* This should not happen.. */
301 		wpa_printf(MSG_INFO, "SSL: pending tls_out data when "
302 			   "processing new message");
303 		wpabuf_free(data->tls_out);
304 		WPA_ASSERT(data->tls_out == NULL);
305 	}
306 
307 	data->tls_out = tls_connection_server_handshake(sm->ssl_ctx,
308 							data->conn,
309 							data->tls_in, NULL);
310 	if (data->tls_out == NULL) {
311 		wpa_printf(MSG_INFO, "SSL: TLS processing failed");
312 		return -1;
313 	}
314 	if (tls_connection_get_failed(sm->ssl_ctx, data->conn)) {
315 		/* TLS processing has failed - return error */
316 		wpa_printf(MSG_DEBUG, "SSL: Failed - tls_out available to "
317 			   "report error");
318 		return -1;
319 	}
320 
321 	return 0;
322 }
323 
324 
eap_server_tls_reassemble(struct eap_ssl_data * data,u8 flags,const u8 ** pos,size_t * left)325 static int eap_server_tls_reassemble(struct eap_ssl_data *data, u8 flags,
326 				     const u8 **pos, size_t *left)
327 {
328 	unsigned int tls_msg_len = 0;
329 	const u8 *end = *pos + *left;
330 
331 	if (flags & EAP_TLS_FLAGS_LENGTH_INCLUDED) {
332 		if (*left < 4) {
333 			wpa_printf(MSG_INFO, "SSL: Short frame with TLS "
334 				   "length");
335 			return -1;
336 		}
337 		tls_msg_len = WPA_GET_BE32(*pos);
338 		wpa_printf(MSG_DEBUG, "SSL: TLS Message Length: %d",
339 			   tls_msg_len);
340 		*pos += 4;
341 		*left -= 4;
342 
343 		if (*left > tls_msg_len) {
344 			wpa_printf(MSG_INFO, "SSL: TLS Message Length (%d "
345 				   "bytes) smaller than this fragment (%d "
346 				   "bytes)", (int) tls_msg_len, (int) *left);
347 			return -1;
348 		}
349 	}
350 
351 	wpa_printf(MSG_DEBUG, "SSL: Received packet: Flags 0x%x "
352 		   "Message Length %u", flags, tls_msg_len);
353 
354 	if (data->state == WAIT_FRAG_ACK) {
355 		if (*left != 0) {
356 			wpa_printf(MSG_DEBUG, "SSL: Unexpected payload in "
357 				   "WAIT_FRAG_ACK state");
358 			return -1;
359 		}
360 		wpa_printf(MSG_DEBUG, "SSL: Fragment acknowledged");
361 		return 1;
362 	}
363 
364 	if (data->tls_in &&
365 	    eap_server_tls_process_cont(data, *pos, end - *pos) < 0)
366 		return -1;
367 
368 	if (flags & EAP_TLS_FLAGS_MORE_FRAGMENTS) {
369 		if (eap_server_tls_process_fragment(data, flags, tls_msg_len,
370 						    *pos, end - *pos) < 0)
371 			return -1;
372 
373 		data->state = FRAG_ACK;
374 		return 1;
375 	}
376 
377 	if (data->state == FRAG_ACK) {
378 		wpa_printf(MSG_DEBUG, "SSL: All fragments received");
379 		data->state = MSG;
380 	}
381 
382 	if (data->tls_in == NULL) {
383 		/* Wrap unfragmented messages as wpabuf without extra copy */
384 		wpabuf_set(&data->tmpbuf, *pos, end - *pos);
385 		data->tls_in = &data->tmpbuf;
386 	}
387 
388 	return 0;
389 }
390 
391 
eap_server_tls_free_in_buf(struct eap_ssl_data * data)392 static void eap_server_tls_free_in_buf(struct eap_ssl_data *data)
393 {
394 	if (data->tls_in != &data->tmpbuf)
395 		wpabuf_free(data->tls_in);
396 	data->tls_in = NULL;
397 }
398 
399 
eap_server_tls_encrypt(struct eap_sm * sm,struct eap_ssl_data * data,const struct wpabuf * plain)400 struct wpabuf * eap_server_tls_encrypt(struct eap_sm *sm,
401 				       struct eap_ssl_data *data,
402 				       const struct wpabuf *plain)
403 {
404 	struct wpabuf *buf;
405 
406 	buf = tls_connection_encrypt(sm->ssl_ctx, data->conn,
407 				     plain);
408 	if (buf == NULL) {
409 		wpa_printf(MSG_INFO, "SSL: Failed to encrypt Phase 2 data");
410 		return NULL;
411 	}
412 
413 	return buf;
414 }
415 
416 
eap_server_tls_process(struct eap_sm * sm,struct eap_ssl_data * data,struct wpabuf * respData,void * priv,int eap_type,int (* proc_version)(struct eap_sm * sm,void * priv,int peer_version),void (* proc_msg)(struct eap_sm * sm,void * priv,const struct wpabuf * respData))417 int eap_server_tls_process(struct eap_sm *sm, struct eap_ssl_data *data,
418 			   struct wpabuf *respData, void *priv, int eap_type,
419 			   int (*proc_version)(struct eap_sm *sm, void *priv,
420 					       int peer_version),
421 			   void (*proc_msg)(struct eap_sm *sm, void *priv,
422 					    const struct wpabuf *respData))
423 {
424 	const u8 *pos;
425 	u8 flags;
426 	size_t left;
427 	int ret, res = 0;
428 
429 	if (eap_type == EAP_UNAUTH_TLS_TYPE)
430 		pos = eap_hdr_validate(EAP_VENDOR_UNAUTH_TLS,
431 				       EAP_VENDOR_TYPE_UNAUTH_TLS, respData,
432 				       &left);
433 	else if (eap_type == EAP_WFA_UNAUTH_TLS_TYPE)
434 		pos = eap_hdr_validate(EAP_VENDOR_WFA_NEW,
435 				       EAP_VENDOR_WFA_UNAUTH_TLS, respData,
436 				       &left);
437 	else
438 		pos = eap_hdr_validate(EAP_VENDOR_IETF, eap_type, respData,
439 				       &left);
440 	if (pos == NULL || left < 1)
441 		return 0; /* Should not happen - frame already validated */
442 	flags = *pos++;
443 	left--;
444 	wpa_printf(MSG_DEBUG, "SSL: Received packet(len=%lu) - Flags 0x%02x",
445 		   (unsigned long) wpabuf_len(respData), flags);
446 
447 	if (proc_version &&
448 	    proc_version(sm, priv, flags & EAP_TLS_VERSION_MASK) < 0)
449 		return -1;
450 
451 	ret = eap_server_tls_reassemble(data, flags, &pos, &left);
452 	if (ret < 0) {
453 		res = -1;
454 		goto done;
455 	} else if (ret == 1)
456 		return 0;
457 
458 	if (proc_msg)
459 		proc_msg(sm, priv, respData);
460 
461 	if (tls_connection_get_write_alerts(sm->ssl_ctx, data->conn) > 1) {
462 		wpa_printf(MSG_INFO, "SSL: Locally detected fatal error in "
463 			   "TLS processing");
464 		res = -1;
465 	}
466 
467 done:
468 	eap_server_tls_free_in_buf(data);
469 
470 	return res;
471 }
472