contrib/hostapd/src/tls/tlsv1_client_read.c

   1 /*
   2  * TLSv1 client - read handshake message
   3  * Copyright (c) 2006-2007, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "md5.h"
  19 #include "sha1.h"
  20 #include "x509v3.h"
  21 #include "tls.h"
  22 #include "tlsv1_common.h"
  23 #include "tlsv1_record.h"
  24 #include "tlsv1_client.h"
  25 #include "tlsv1_client_i.h"
  26
  27 static int tls_process_server_key_exchange(struct tlsv1_client *conn, u8 ct,
  28                                            const u8 *in_data, size_t *in_len);
  29 static int tls_process_certificate_request(struct tlsv1_client *conn, u8 ct,
  30                                            const u8 *in_data, size_t *in_len);
  31 static int tls_process_server_hello_done(struct tlsv1_client *conn, u8 ct,
  32                                          const u8 *in_data, size_t *in_len);
  33
  34
  35 static int tls_process_server_hello(struct tlsv1_client *conn, u8 ct,
  36                                     const u8 *in_data, size_t *in_len)
  37 {
  38         const u8 *pos, *end;
  39         size_t left, len, i;
  40         u16 cipher_suite;
  41
  42         if (ct != TLS_CONTENT_TYPE_HANDSHAKE) {
  43                 wpa_printf(MSG_DEBUG, "TLSv1: Expected Handshake; "
  44                            "received content type 0x%x", ct);
  45                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
  46                           TLS_ALERT_UNEXPECTED_MESSAGE);
  47                 return -1;
  48         }
  49
  50         pos = in_data;
  51         left = *in_len;
  52
  53         if (left < 4)
  54                 goto decode_error;
  55
  56         /* HandshakeType msg_type */
  57         if (*pos != TLS_HANDSHAKE_TYPE_SERVER_HELLO) {
  58                 wpa_printf(MSG_DEBUG, "TLSv1: Received unexpected handshake "
  59                            "message %d (expected ServerHello)", *pos);
  60                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
  61                           TLS_ALERT_UNEXPECTED_MESSAGE);
  62                 return -1;
  63         }
  64         wpa_printf(MSG_DEBUG, "TLSv1: Received ServerHello");
  65         pos++;
  66         /* uint24 length */
  67         len = WPA_GET_BE24(pos);
  68         pos += 3;
  69         left -= 4;
  70
  71         if (len > left)
  72                 goto decode_error;
  73
  74         /* body - ServerHello */
  75
  76         wpa_hexdump(MSG_MSGDUMP, "TLSv1: ServerHello", pos, len);
  77         end = pos + len;
  78
  79         /* ProtocolVersion server_version */
  80         if (end - pos < 2)
  81                 goto decode_error;
  82         if (WPA_GET_BE16(pos) != TLS_VERSION) {
  83                 wpa_printf(MSG_DEBUG, "TLSv1: Unexpected protocol version in "
  84                            "ServerHello");
  85                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
  86                           TLS_ALERT_PROTOCOL_VERSION);
  87                 return -1;
  88         }
  89         pos += 2;
  90
  91         /* Random random */
  92         if (end - pos < TLS_RANDOM_LEN)
  93                 goto decode_error;
  94
  95         os_memcpy(conn->server_random, pos, TLS_RANDOM_LEN);
  96         pos += TLS_RANDOM_LEN;
  97         wpa_hexdump(MSG_MSGDUMP, "TLSv1: server_random",
  98                     conn->server_random, TLS_RANDOM_LEN);
  99
 100         /* SessionID session_id */
 101         if (end - pos < 1)
 102                 goto decode_error;
 103         if (end - pos < 1 + *pos || *pos > TLS_SESSION_ID_MAX_LEN)
 104                 goto decode_error;
 105         if (conn->session_id_len && conn->session_id_len == *pos &&
 106             os_memcmp(conn->session_id, pos + 1, conn->session_id_len) == 0) {
 107                 pos += 1 + conn->session_id_len;
 108                 wpa_printf(MSG_DEBUG, "TLSv1: Resuming old session");
 109                 conn->session_resumed = 1;
 110         } else {
 111                 conn->session_id_len = *pos;
 112                 pos++;
 113                 os_memcpy(conn->session_id, pos, conn->session_id_len);
 114                 pos += conn->session_id_len;
 115         }
 116         wpa_hexdump(MSG_MSGDUMP, "TLSv1: session_id",
 117                     conn->session_id, conn->session_id_len);
 118
 119         /* CipherSuite cipher_suite */
 120         if (end - pos < 2)
 121                 goto decode_error;
 122         cipher_suite = WPA_GET_BE16(pos);
 123         pos += 2;
 124         for (i = 0; i < conn->num_cipher_suites; i++) {
 125                 if (cipher_suite == conn->cipher_suites[i])
 126                         break;
 127         }
 128         if (i == conn->num_cipher_suites) {
 129                 wpa_printf(MSG_INFO, "TLSv1: Server selected unexpected "
 130                            "cipher suite 0x%04x", cipher_suite);
 131                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 132                           TLS_ALERT_ILLEGAL_PARAMETER);
 133                 return -1;
 134         }
 135
 136         if (conn->session_resumed && cipher_suite != conn->prev_cipher_suite) {
 137                 wpa_printf(MSG_DEBUG, "TLSv1: Server selected a different "
 138                            "cipher suite for a resumed connection (0x%04x != "
 139                            "0x%04x)", cipher_suite, conn->prev_cipher_suite);
 140                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 141                           TLS_ALERT_ILLEGAL_PARAMETER);
 142                 return -1;
 143         }
 144
 145         if (tlsv1_record_set_cipher_suite(&conn->rl, cipher_suite) < 0) {
 146                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to set CipherSuite for "
 147                            "record layer");
 148                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 149                           TLS_ALERT_INTERNAL_ERROR);
 150                 return -1;
 151         }
 152
 153         conn->prev_cipher_suite = cipher_suite;
 154
 155         /* CompressionMethod compression_method */
 156         if (end - pos < 1)
 157                 goto decode_error;
 158         if (*pos != TLS_COMPRESSION_NULL) {
 159                 wpa_printf(MSG_INFO, "TLSv1: Server selected unexpected "
 160                            "compression 0x%02x", *pos);
 161                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 162                           TLS_ALERT_ILLEGAL_PARAMETER);
 163                 return -1;
 164         }
 165         pos++;
 166
 167         if (end != pos) {
 168                 /* TODO: ServerHello extensions */
 169                 wpa_hexdump(MSG_DEBUG, "TLSv1: Unexpected extra data in the "
 170                             "end of ServerHello", pos, end - pos);
 171                 goto decode_error;
 172         }
 173
 174         if (conn->session_ticket_included && conn->session_ticket_cb) {
 175                 /* TODO: include SessionTicket extension if one was included in
 176                  * ServerHello */
 177                 int res = conn->session_ticket_cb(
 178                         conn->session_ticket_cb_ctx, NULL, 0,
 179                         conn->client_random, conn->server_random,
 180                         conn->master_secret);
 181                 if (res < 0) {
 182                         wpa_printf(MSG_DEBUG, "TLSv1: SessionTicket callback "
 183                                    "indicated failure");
 184                         tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 185                                   TLS_ALERT_HANDSHAKE_FAILURE);
 186                         return -1;
 187                 }
 188                 conn->use_session_ticket = !!res;
 189         }
 190
 191         if ((conn->session_resumed || conn->use_session_ticket) &&
 192             tls_derive_keys(conn, NULL, 0)) {
 193                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive keys");
 194                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 195                           TLS_ALERT_INTERNAL_ERROR);
 196                 return -1;
 197         }
 198
 199         *in_len = end - in_data;
 200
 201         conn->state = (conn->session_resumed || conn->use_session_ticket) ?
 202                 SERVER_CHANGE_CIPHER_SPEC : SERVER_CERTIFICATE;
 203
 204         return 0;
 205
 206 decode_error:
 207         wpa_printf(MSG_DEBUG, "TLSv1: Failed to decode ServerHello");
 208         tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
 209         return -1;
 210 }
 211
 212
 213 static int tls_process_certificate(struct tlsv1_client *conn, u8 ct,
 214                                    const u8 *in_data, size_t *in_len)
 215 {
 216         const u8 *pos, *end;
 217         size_t left, len, list_len, cert_len, idx;
 218         u8 type;
 219         struct x509_certificate *chain = NULL, *last = NULL, *cert;
 220         int reason;
 221
 222         if (ct != TLS_CONTENT_TYPE_HANDSHAKE) {
 223                 wpa_printf(MSG_DEBUG, "TLSv1: Expected Handshake; "
 224                            "received content type 0x%x", ct);
 225                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 226                           TLS_ALERT_UNEXPECTED_MESSAGE);
 227                 return -1;
 228         }
 229
 230         pos = in_data;
 231         left = *in_len;
 232
 233         if (left < 4) {
 234                 wpa_printf(MSG_DEBUG, "TLSv1: Too short Certificate message "
 235                            "(len=%lu)", (unsigned long) left);
 236                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
 237                 return -1;
 238         }
 239
 240         type = *pos++;
 241         len = WPA_GET_BE24(pos);
 242         pos += 3;
 243         left -= 4;
 244
 245         if (len > left) {
 246                 wpa_printf(MSG_DEBUG, "TLSv1: Unexpected Certificate message "
 247                            "length (len=%lu != left=%lu)",
 248                            (unsigned long) len, (unsigned long) left);
 249                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
 250                 return -1;
 251         }
 252
 253         if (type == TLS_HANDSHAKE_TYPE_SERVER_KEY_EXCHANGE)
 254                 return tls_process_server_key_exchange(conn, ct, in_data,
 255                                                        in_len);
 256         if (type == TLS_HANDSHAKE_TYPE_CERTIFICATE_REQUEST)
 257                 return tls_process_certificate_request(conn, ct, in_data,
 258                                                        in_len);
 259         if (type == TLS_HANDSHAKE_TYPE_SERVER_HELLO_DONE)
 260                 return tls_process_server_hello_done(conn, ct, in_data,
 261                                                      in_len);
 262         if (type != TLS_HANDSHAKE_TYPE_CERTIFICATE) {
 263                 wpa_printf(MSG_DEBUG, "TLSv1: Received unexpected handshake "
 264                            "message %d (expected Certificate/"
 265                            "ServerKeyExchange/CertificateRequest/"
 266                            "ServerHelloDone)", type);
 267                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 268                           TLS_ALERT_UNEXPECTED_MESSAGE);
 269                 return -1;
 270         }
 271
 272         wpa_printf(MSG_DEBUG,
 273                    "TLSv1: Received Certificate (certificate_list len %lu)",
 274                    (unsigned long) len);
 275
 276         /*
 277          * opaque ASN.1Cert<2^24-1>;
 278          *
 279          * struct {
 280          *     ASN.1Cert certificate_list<1..2^24-1>;
 281          * } Certificate;
 282          */
 283
 284         end = pos + len;
 285
 286         if (end - pos < 3) {
 287                 wpa_printf(MSG_DEBUG, "TLSv1: Too short Certificate "
 288                            "(left=%lu)", (unsigned long) left);
 289                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
 290                 return -1;
 291         }
 292
 293         list_len = WPA_GET_BE24(pos);
 294         pos += 3;
 295
 296         if ((size_t) (end - pos) != list_len) {
 297                 wpa_printf(MSG_DEBUG, "TLSv1: Unexpected certificate_list "
 298                            "length (len=%lu left=%lu)",
 299                            (unsigned long) list_len,
 300                            (unsigned long) (end - pos));
 301                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
 302                 return -1;
 303         }
 304
 305         idx = 0;
 306         while (pos < end) {
 307                 if (end - pos < 3) {
 308                         wpa_printf(MSG_DEBUG, "TLSv1: Failed to parse "
 309                                    "certificate_list");
 310                         tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 311                                   TLS_ALERT_DECODE_ERROR);
 312                         x509_certificate_chain_free(chain);
 313                         return -1;
 314                 }
 315
 316                 cert_len = WPA_GET_BE24(pos);
 317                 pos += 3;
 318
 319                 if ((size_t) (end - pos) < cert_len) {
 320                         wpa_printf(MSG_DEBUG, "TLSv1: Unexpected certificate "
 321                                    "length (len=%lu left=%lu)",
 322                                    (unsigned long) cert_len,
 323                                    (unsigned long) (end - pos));
 324                         tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 325                                   TLS_ALERT_DECODE_ERROR);
 326                         x509_certificate_chain_free(chain);
 327                         return -1;
 328                 }
 329
 330                 wpa_printf(MSG_DEBUG, "TLSv1: Certificate %lu (len %lu)",
 331                            (unsigned long) idx, (unsigned long) cert_len);
 332
 333                 if (idx == 0) {
 334                         crypto_public_key_free(conn->server_rsa_key);
 335                         if (tls_parse_cert(pos, cert_len,
 336                                            &conn->server_rsa_key)) {
 337                                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to parse "
 338                                            "the certificate");
 339                                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 340                                           TLS_ALERT_BAD_CERTIFICATE);
 341                                 x509_certificate_chain_free(chain);
 342                                 return -1;
 343                         }
 344                 }
 345
 346                 cert = x509_certificate_parse(pos, cert_len);
 347                 if (cert == NULL) {
 348                         wpa_printf(MSG_DEBUG, "TLSv1: Failed to parse "
 349                                    "the certificate");
 350                         tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 351                                   TLS_ALERT_BAD_CERTIFICATE);
 352                         x509_certificate_chain_free(chain);
 353                         return -1;
 354                 }
 355
 356                 if (last == NULL)
 357                         chain = cert;
 358                 else
 359                         last->next = cert;
 360                 last = cert;
 361
 362                 idx++;
 363                 pos += cert_len;
 364         }
 365
 366         if (conn->cred &&
 367             x509_certificate_chain_validate(conn->cred->trusted_certs, chain,
 368                                             &reason) < 0) {
 369                 int tls_reason;
 370                 wpa_printf(MSG_DEBUG, "TLSv1: Server certificate chain "
 371                            "validation failed (reason=%d)", reason);
 372                 switch (reason) {
 373                 case X509_VALIDATE_BAD_CERTIFICATE:
 374                         tls_reason = TLS_ALERT_BAD_CERTIFICATE;
 375                         break;
 376                 case X509_VALIDATE_UNSUPPORTED_CERTIFICATE:
 377                         tls_reason = TLS_ALERT_UNSUPPORTED_CERTIFICATE;
 378                         break;
 379                 case X509_VALIDATE_CERTIFICATE_REVOKED:
 380                         tls_reason = TLS_ALERT_CERTIFICATE_REVOKED;
 381                         break;
 382                 case X509_VALIDATE_CERTIFICATE_EXPIRED:
 383                         tls_reason = TLS_ALERT_CERTIFICATE_EXPIRED;
 384                         break;
 385                 case X509_VALIDATE_CERTIFICATE_UNKNOWN:
 386                         tls_reason = TLS_ALERT_CERTIFICATE_UNKNOWN;
 387                         break;
 388                 case X509_VALIDATE_UNKNOWN_CA:
 389                         tls_reason = TLS_ALERT_UNKNOWN_CA;
 390                         break;
 391                 default:
 392                         tls_reason = TLS_ALERT_BAD_CERTIFICATE;
 393                         break;
 394                 }
 395                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL, tls_reason);
 396                 x509_certificate_chain_free(chain);
 397                 return -1;
 398         }
 399
 400         x509_certificate_chain_free(chain);
 401
 402         *in_len = end - in_data;
 403
 404         conn->state = SERVER_KEY_EXCHANGE;
 405
 406         return 0;
 407 }
 408
 409
 410 static int tlsv1_process_diffie_hellman(struct tlsv1_client *conn,
 411                                         const u8 *buf, size_t len)
 412 {
 413         const u8 *pos, *end;
 414
 415         tlsv1_client_free_dh(conn);
 416
 417         pos = buf;
 418         end = buf + len;
 419
 420         if (end - pos < 3)
 421                 goto fail;
 422         conn->dh_p_len = WPA_GET_BE16(pos);
 423         pos += 2;
 424         if (conn->dh_p_len == 0 || end - pos < (int) conn->dh_p_len) {
 425                 wpa_printf(MSG_DEBUG, "TLSv1: Invalid dh_p length %lu",
 426                            (unsigned long) conn->dh_p_len);
 427                 goto fail;
 428         }
 429         conn->dh_p = os_malloc(conn->dh_p_len);
 430         if (conn->dh_p == NULL)
 431                 goto fail;
 432         os_memcpy(conn->dh_p, pos, conn->dh_p_len);
 433         pos += conn->dh_p_len;
 434         wpa_hexdump(MSG_DEBUG, "TLSv1: DH p (prime)",
 435                     conn->dh_p, conn->dh_p_len);
 436
 437         if (end - pos < 3)
 438                 goto fail;
 439         conn->dh_g_len = WPA_GET_BE16(pos);
 440         pos += 2;
 441         if (conn->dh_g_len == 0 || end - pos < (int) conn->dh_g_len)
 442                 goto fail;
 443         conn->dh_g = os_malloc(conn->dh_g_len);
 444         if (conn->dh_g == NULL)
 445                 goto fail;
 446         os_memcpy(conn->dh_g, pos, conn->dh_g_len);
 447         pos += conn->dh_g_len;
 448         wpa_hexdump(MSG_DEBUG, "TLSv1: DH g (generator)",
 449                     conn->dh_g, conn->dh_g_len);
 450         if (conn->dh_g_len == 1 && conn->dh_g[0] < 2)
 451                 goto fail;
 452
 453         if (end - pos < 3)
 454                 goto fail;
 455         conn->dh_ys_len = WPA_GET_BE16(pos);
 456         pos += 2;
 457         if (conn->dh_ys_len == 0 || end - pos < (int) conn->dh_ys_len)
 458                 goto fail;
 459         conn->dh_ys = os_malloc(conn->dh_ys_len);
 460         if (conn->dh_ys == NULL)
 461                 goto fail;
 462         os_memcpy(conn->dh_ys, pos, conn->dh_ys_len);
 463         pos += conn->dh_ys_len;
 464         wpa_hexdump(MSG_DEBUG, "TLSv1: DH Ys (server's public value)",
 465                     conn->dh_ys, conn->dh_ys_len);
 466
 467         return 0;
 468
 469 fail:
 470         wpa_printf(MSG_DEBUG, "TLSv1: Processing DH params failed");
 471         tlsv1_client_free_dh(conn);
 472         return -1;
 473 }
 474
 475
 476 static int tls_process_server_key_exchange(struct tlsv1_client *conn, u8 ct,
 477                                            const u8 *in_data, size_t *in_len)
 478 {
 479         const u8 *pos, *end;
 480         size_t left, len;
 481         u8 type;
 482         const struct tls_cipher_suite *suite;
 483
 484         if (ct != TLS_CONTENT_TYPE_HANDSHAKE) {
 485                 wpa_printf(MSG_DEBUG, "TLSv1: Expected Handshake; "
 486                            "received content type 0x%x", ct);
 487                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 488                           TLS_ALERT_UNEXPECTED_MESSAGE);
 489                 return -1;
 490         }
 491
 492         pos = in_data;
 493         left = *in_len;
 494
 495         if (left < 4) {
 496                 wpa_printf(MSG_DEBUG, "TLSv1: Too short ServerKeyExchange "
 497                            "(Left=%lu)", (unsigned long) left);
 498                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
 499                 return -1;
 500         }
 501
 502         type = *pos++;
 503         len = WPA_GET_BE24(pos);
 504         pos += 3;
 505         left -= 4;
 506
 507         if (len > left) {
 508                 wpa_printf(MSG_DEBUG, "TLSv1: Mismatch in ServerKeyExchange "
 509                            "length (len=%lu != left=%lu)",
 510                            (unsigned long) len, (unsigned long) left);
 511                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
 512                 return -1;
 513         }
 514
 515         end = pos + len;
 516
 517         if (type == TLS_HANDSHAKE_TYPE_CERTIFICATE_REQUEST)
 518                 return tls_process_certificate_request(conn, ct, in_data,
 519                                                        in_len);
 520         if (type == TLS_HANDSHAKE_TYPE_SERVER_HELLO_DONE)
 521                 return tls_process_server_hello_done(conn, ct, in_data,
 522                                                      in_len);
 523         if (type != TLS_HANDSHAKE_TYPE_SERVER_KEY_EXCHANGE) {
 524                 wpa_printf(MSG_DEBUG, "TLSv1: Received unexpected handshake "
 525                            "message %d (expected ServerKeyExchange/"
 526                            "CertificateRequest/ServerHelloDone)", type);
 527                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 528                           TLS_ALERT_UNEXPECTED_MESSAGE);
 529                 return -1;
 530         }
 531
 532         wpa_printf(MSG_DEBUG, "TLSv1: Received ServerKeyExchange");
 533
 534         if (!tls_server_key_exchange_allowed(conn->rl.cipher_suite)) {
 535                 wpa_printf(MSG_DEBUG, "TLSv1: ServerKeyExchange not allowed "
 536                            "with the selected cipher suite");
 537                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 538                           TLS_ALERT_UNEXPECTED_MESSAGE);
 539                 return -1;
 540         }
 541
 542         wpa_hexdump(MSG_DEBUG, "TLSv1: ServerKeyExchange", pos, len);
 543         suite = tls_get_cipher_suite(conn->rl.cipher_suite);
 544         if (suite && suite->key_exchange == TLS_KEY_X_DH_anon) {
 545                 if (tlsv1_process_diffie_hellman(conn, pos, len) < 0) {
 546                         tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 547                                   TLS_ALERT_DECODE_ERROR);
 548                         return -1;
 549                 }
 550         } else {
 551                 wpa_printf(MSG_DEBUG, "TLSv1: UnexpectedServerKeyExchange");
 552                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 553                           TLS_ALERT_UNEXPECTED_MESSAGE);
 554                 return -1;
 555         }
 556
 557         *in_len = end - in_data;
 558
 559         conn->state = SERVER_CERTIFICATE_REQUEST;
 560
 561         return 0;
 562 }
 563
 564
 565 static int tls_process_certificate_request(struct tlsv1_client *conn, u8 ct,
 566                                            const u8 *in_data, size_t *in_len)
 567 {
 568         const u8 *pos, *end;
 569         size_t left, len;
 570         u8 type;
 571
 572         if (ct != TLS_CONTENT_TYPE_HANDSHAKE) {
 573                 wpa_printf(MSG_DEBUG, "TLSv1: Expected Handshake; "
 574                            "received content type 0x%x", ct);
 575                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 576                           TLS_ALERT_UNEXPECTED_MESSAGE);
 577                 return -1;
 578         }
 579
 580         pos = in_data;
 581         left = *in_len;
 582
 583         if (left < 4) {
 584                 wpa_printf(MSG_DEBUG, "TLSv1: Too short CertificateRequest "
 585                            "(left=%lu)", (unsigned long) left);
 586                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
 587                 return -1;
 588         }
 589
 590         type = *pos++;
 591         len = WPA_GET_BE24(pos);
 592         pos += 3;
 593         left -= 4;
 594
 595         if (len > left) {
 596                 wpa_printf(MSG_DEBUG, "TLSv1: Mismatch in CertificateRequest "
 597                            "length (len=%lu != left=%lu)",
 598                            (unsigned long) len, (unsigned long) left);
 599                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
 600                 return -1;
 601         }
 602
 603         end = pos + len;
 604
 605         if (type == TLS_HANDSHAKE_TYPE_SERVER_HELLO_DONE)
 606                 return tls_process_server_hello_done(conn, ct, in_data,
 607                                                      in_len);
 608         if (type != TLS_HANDSHAKE_TYPE_CERTIFICATE_REQUEST) {
 609                 wpa_printf(MSG_DEBUG, "TLSv1: Received unexpected handshake "
 610                            "message %d (expected CertificateRequest/"
 611                            "ServerHelloDone)", type);
 612                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 613                           TLS_ALERT_UNEXPECTED_MESSAGE);
 614                 return -1;
 615         }
 616
 617         wpa_printf(MSG_DEBUG, "TLSv1: Received CertificateRequest");
 618
 619         conn->certificate_requested = 1;
 620
 621         *in_len = end - in_data;
 622
 623         conn->state = SERVER_HELLO_DONE;
 624
 625         return 0;
 626 }
 627
 628
 629 static int tls_process_server_hello_done(struct tlsv1_client *conn, u8 ct,
 630                                          const u8 *in_data, size_t *in_len)
 631 {
 632         const u8 *pos, *end;
 633         size_t left, len;
 634         u8 type;
 635
 636         if (ct != TLS_CONTENT_TYPE_HANDSHAKE) {
 637                 wpa_printf(MSG_DEBUG, "TLSv1: Expected Handshake; "
 638                            "received content type 0x%x", ct);
 639                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 640                           TLS_ALERT_UNEXPECTED_MESSAGE);
 641                 return -1;
 642         }
 643
 644         pos = in_data;
 645         left = *in_len;
 646
 647         if (left < 4) {
 648                 wpa_printf(MSG_DEBUG, "TLSv1: Too short ServerHelloDone "
 649                            "(left=%lu)", (unsigned long) left);
 650                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
 651                 return -1;
 652         }
 653
 654         type = *pos++;
 655         len = WPA_GET_BE24(pos);
 656         pos += 3;
 657         left -= 4;
 658
 659         if (len > left) {
 660                 wpa_printf(MSG_DEBUG, "TLSv1: Mismatch in ServerHelloDone "
 661                            "length (len=%lu != left=%lu)",
 662                            (unsigned long) len, (unsigned long) left);
 663                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
 664                 return -1;
 665         }
 666         end = pos + len;
 667
 668         if (type != TLS_HANDSHAKE_TYPE_SERVER_HELLO_DONE) {
 669                 wpa_printf(MSG_DEBUG, "TLSv1: Received unexpected handshake "
 670                            "message %d (expected ServerHelloDone)", type);
 671                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 672                           TLS_ALERT_UNEXPECTED_MESSAGE);
 673                 return -1;
 674         }
 675
 676         wpa_printf(MSG_DEBUG, "TLSv1: Received ServerHelloDone");
 677
 678         *in_len = end - in_data;
 679
 680         conn->state = CLIENT_KEY_EXCHANGE;
 681
 682         return 0;
 683 }
 684
 685
 686 static int tls_process_server_change_cipher_spec(struct tlsv1_client *conn,
 687                                                  u8 ct, const u8 *in_data,
 688                                                  size_t *in_len)
 689 {
 690         const u8 *pos;
 691         size_t left;
 692
 693         if (ct != TLS_CONTENT_TYPE_CHANGE_CIPHER_SPEC) {
 694                 wpa_printf(MSG_DEBUG, "TLSv1: Expected ChangeCipherSpec; "
 695                            "received content type 0x%x", ct);
 696                 if (conn->use_session_ticket) {
 697                         int res;
 698                         wpa_printf(MSG_DEBUG, "TLSv1: Server may have "
 699                                    "rejected SessionTicket");
 700                         conn->use_session_ticket = 0;
 701
 702                         /* Notify upper layers that SessionTicket failed */
 703                         res = conn->session_ticket_cb(
 704                                 conn->session_ticket_cb_ctx, NULL, 0, NULL,
 705                                 NULL, NULL);
 706                         if (res < 0) {
 707                                 wpa_printf(MSG_DEBUG, "TLSv1: SessionTicket "
 708                                            "callback indicated failure");
 709                                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 710                                           TLS_ALERT_HANDSHAKE_FAILURE);
 711                                 return -1;
 712                         }
 713
 714                         conn->state = SERVER_CERTIFICATE;
 715                         return tls_process_certificate(conn, ct, in_data,
 716                                                        in_len);
 717                 }
 718                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 719                           TLS_ALERT_UNEXPECTED_MESSAGE);
 720                 return -1;
 721         }
 722
 723         pos = in_data;
 724         left = *in_len;
 725
 726         if (left < 1) {
 727                 wpa_printf(MSG_DEBUG, "TLSv1: Too short ChangeCipherSpec");
 728                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_DECODE_ERROR);
 729                 return -1;
 730         }
 731
 732         if (*pos != TLS_CHANGE_CIPHER_SPEC) {
 733                 wpa_printf(MSG_DEBUG, "TLSv1: Expected ChangeCipherSpec; "
 734                            "received data 0x%x", *pos);
 735                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 736                           TLS_ALERT_UNEXPECTED_MESSAGE);
 737                 return -1;
 738         }
 739
 740         wpa_printf(MSG_DEBUG, "TLSv1: Received ChangeCipherSpec");
 741         if (tlsv1_record_change_read_cipher(&conn->rl) < 0) {
 742                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to change read cipher "
 743                            "for record layer");
 744                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 745                           TLS_ALERT_INTERNAL_ERROR);
 746                 return -1;
 747         }
 748
 749         *in_len = pos + 1 - in_data;
 750
 751         conn->state = SERVER_FINISHED;
 752
 753         return 0;
 754 }
 755
 756
 757 static int tls_process_server_finished(struct tlsv1_client *conn, u8 ct,
 758                                        const u8 *in_data, size_t *in_len)
 759 {
 760         const u8 *pos, *end;
 761         size_t left, len, hlen;
 762         u8 verify_data[TLS_VERIFY_DATA_LEN];
 763         u8 hash[MD5_MAC_LEN + SHA1_MAC_LEN];
 764
 765         if (ct != TLS_CONTENT_TYPE_HANDSHAKE) {
 766                 wpa_printf(MSG_DEBUG, "TLSv1: Expected Finished; "
 767                            "received content type 0x%x", ct);
 768                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 769                           TLS_ALERT_UNEXPECTED_MESSAGE);
 770                 return -1;
 771         }
 772
 773         pos = in_data;
 774         left = *in_len;
 775
 776         if (left < 4) {
 777                 wpa_printf(MSG_DEBUG, "TLSv1: Too short record (left=%lu) for "
 778                            "Finished",
 779                            (unsigned long) left);
 780                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 781                           TLS_ALERT_DECODE_ERROR);
 782                 return -1;
 783         }
 784
 785         if (pos[0] != TLS_HANDSHAKE_TYPE_FINISHED) {
 786                 wpa_printf(MSG_DEBUG, "TLSv1: Expected Finished; received "
 787                            "type 0x%x", pos[0]);
 788                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 789                           TLS_ALERT_UNEXPECTED_MESSAGE);
 790                 return -1;
 791         }
 792
 793         len = WPA_GET_BE24(pos + 1);
 794
 795         pos += 4;
 796         left -= 4;
 797
 798         if (len > left) {
 799                 wpa_printf(MSG_DEBUG, "TLSv1: Too short buffer for Finished "
 800                            "(len=%lu > left=%lu)",
 801                            (unsigned long) len, (unsigned long) left);
 802                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 803                           TLS_ALERT_DECODE_ERROR);
 804                 return -1;
 805         }
 806         end = pos + len;
 807         if (len != TLS_VERIFY_DATA_LEN) {
 808                 wpa_printf(MSG_DEBUG, "TLSv1: Unexpected verify_data length "
 809                            "in Finished: %lu (expected %d)",
 810                            (unsigned long) len, TLS_VERIFY_DATA_LEN);
 811                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 812                           TLS_ALERT_DECODE_ERROR);
 813                 return -1;
 814         }
 815         wpa_hexdump(MSG_MSGDUMP, "TLSv1: verify_data in Finished",
 816                     pos, TLS_VERIFY_DATA_LEN);
 817
 818         hlen = MD5_MAC_LEN;
 819         if (conn->verify.md5_server == NULL ||
 820             crypto_hash_finish(conn->verify.md5_server, hash, &hlen) < 0) {
 821                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 822                           TLS_ALERT_INTERNAL_ERROR);
 823                 conn->verify.md5_server = NULL;
 824                 crypto_hash_finish(conn->verify.sha1_server, NULL, NULL);
 825                 conn->verify.sha1_server = NULL;
 826                 return -1;
 827         }
 828         conn->verify.md5_server = NULL;
 829         hlen = SHA1_MAC_LEN;
 830         if (conn->verify.sha1_server == NULL ||
 831             crypto_hash_finish(conn->verify.sha1_server, hash + MD5_MAC_LEN,
 832                                &hlen) < 0) {
 833                 conn->verify.sha1_server = NULL;
 834                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 835                           TLS_ALERT_INTERNAL_ERROR);
 836                 return -1;
 837         }
 838         conn->verify.sha1_server = NULL;
 839
 840         if (tls_prf(conn->master_secret, TLS_MASTER_SECRET_LEN,
 841                     "server finished", hash, MD5_MAC_LEN + SHA1_MAC_LEN,
 842                     verify_data, TLS_VERIFY_DATA_LEN)) {
 843                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive verify_data");
 844                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 845                           TLS_ALERT_DECRYPT_ERROR);
 846                 return -1;
 847         }
 848         wpa_hexdump_key(MSG_DEBUG, "TLSv1: verify_data (server)",
 849                         verify_data, TLS_VERIFY_DATA_LEN);
 850
 851         if (os_memcmp(pos, verify_data, TLS_VERIFY_DATA_LEN) != 0) {
 852                 wpa_printf(MSG_INFO, "TLSv1: Mismatch in verify_data");
 853                 return -1;
 854         }
 855
 856         wpa_printf(MSG_DEBUG, "TLSv1: Received Finished");
 857
 858         *in_len = end - in_data;
 859
 860         conn->state = (conn->session_resumed || conn->use_session_ticket) ?
 861                 CHANGE_CIPHER_SPEC : ACK_FINISHED;
 862
 863         return 0;
 864 }
 865
 866
 867 static int tls_process_application_data(struct tlsv1_client *conn, u8 ct,
 868                                         const u8 *in_data, size_t *in_len,
 869                                         u8 **out_data, size_t *out_len)
 870 {
 871         const u8 *pos;
 872         size_t left;
 873
 874         if (ct != TLS_CONTENT_TYPE_APPLICATION_DATA) {
 875                 wpa_printf(MSG_DEBUG, "TLSv1: Expected Application Data; "
 876                            "received content type 0x%x", ct);
 877                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 878                           TLS_ALERT_UNEXPECTED_MESSAGE);
 879                 return -1;
 880         }
 881
 882         pos = in_data;
 883         left = *in_len;
 884
 885         wpa_hexdump(MSG_DEBUG, "TLSv1: Application Data included in Handshake",
 886                     pos, left);
 887
 888         *out_data = os_malloc(left);
 889         if (*out_data) {
 890                 os_memcpy(*out_data, pos, left);
 891                 *out_len = left;
 892         }
 893
 894         return 0;
 895 }
 896
 897
 898 int tlsv1_client_process_handshake(struct tlsv1_client *conn, u8 ct,
 899                                    const u8 *buf, size_t *len,
 900                                    u8 **out_data, size_t *out_len)
 901 {
 902         if (ct == TLS_CONTENT_TYPE_ALERT) {
 903                 if (*len < 2) {
 904                         wpa_printf(MSG_DEBUG, "TLSv1: Alert underflow");
 905                         tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 906                                   TLS_ALERT_DECODE_ERROR);
 907                         return -1;
 908                 }
 909                 wpa_printf(MSG_DEBUG, "TLSv1: Received alert %d:%d",
 910                            buf[0], buf[1]);
 911                 *len = 2;
 912                 conn->state = FAILED;
 913                 return -1;
 914         }
 915
 916         if (ct == TLS_CONTENT_TYPE_HANDSHAKE && *len >= 4 &&
 917             buf[0] == TLS_HANDSHAKE_TYPE_HELLO_REQUEST) {
 918                 size_t hr_len = WPA_GET_BE24(buf + 1);
 919                 if (hr_len > *len - 4) {
 920                         wpa_printf(MSG_DEBUG, "TLSv1: HelloRequest underflow");
 921                         tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 922                                   TLS_ALERT_DECODE_ERROR);
 923                         return -1;
 924                 }
 925                 wpa_printf(MSG_DEBUG, "TLSv1: Ignored HelloRequest");
 926                 *len = 4 + hr_len;
 927                 return 0;
 928         }
 929
 930         switch (conn->state) {
 931         case SERVER_HELLO:
 932                 if (tls_process_server_hello(conn, ct, buf, len))
 933                         return -1;
 934                 break;
 935         case SERVER_CERTIFICATE:
 936                 if (tls_process_certificate(conn, ct, buf, len))
 937                         return -1;
 938                 break;
 939         case SERVER_KEY_EXCHANGE:
 940                 if (tls_process_server_key_exchange(conn, ct, buf, len))
 941                         return -1;
 942                 break;
 943         case SERVER_CERTIFICATE_REQUEST:
 944                 if (tls_process_certificate_request(conn, ct, buf, len))
 945                         return -1;
 946                 break;
 947         case SERVER_HELLO_DONE:
 948                 if (tls_process_server_hello_done(conn, ct, buf, len))
 949                         return -1;
 950                 break;
 951         case SERVER_CHANGE_CIPHER_SPEC:
 952                 if (tls_process_server_change_cipher_spec(conn, ct, buf, len))
 953                         return -1;
 954                 break;
 955         case SERVER_FINISHED:
 956                 if (tls_process_server_finished(conn, ct, buf, len))
 957                         return -1;
 958                 break;
 959         case ACK_FINISHED:
 960                 if (out_data &&
 961                     tls_process_application_data(conn, ct, buf, len, out_data,
 962                                                  out_len))
 963                         return -1;
 964                 break;
 965         default:
 966                 wpa_printf(MSG_DEBUG, "TLSv1: Unexpected state %d "
 967                            "while processing received message",
 968                            conn->state);
 969                 return -1;
 970         }
 971
 972         if (ct == TLS_CONTENT_TYPE_HANDSHAKE)
 973                 tls_verify_hash_add(&conn->verify, buf, *len);
 974
 975         return 0;
 976 }