contrib/hostapd/src/tls/tlsv1_client_write.c

   1 /*
   2  * TLSv1 client - write handshake message
   3  * Copyright (c) 2006-2007, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "md5.h"
  19 #include "sha1.h"
  20 #include "x509v3.h"
  21 #include "tls.h"
  22 #include "tlsv1_common.h"
  23 #include "tlsv1_record.h"
  24 #include "tlsv1_client.h"
  25 #include "tlsv1_client_i.h"
  26
  27
  28 static size_t tls_client_cert_chain_der_len(struct tlsv1_client *conn)
  29 {
  30         size_t len = 0;
  31         struct x509_certificate *cert;
  32
  33         if (conn->cred == NULL)
  34                 return 0;
  35
  36         cert = conn->cred->cert;
  37         while (cert) {
  38                 len += 3 + cert->cert_len;
  39                 if (x509_certificate_self_signed(cert))
  40                         break;
  41                 cert = x509_certificate_get_subject(conn->cred->trusted_certs,
  42                                                     &cert->issuer);
  43         }
  44
  45         return len;
  46 }
  47
  48
  49 u8 * tls_send_client_hello(struct tlsv1_client *conn, size_t *out_len)
  50 {
  51         u8 *hello, *end, *pos, *hs_length, *hs_start, *rhdr;
  52         struct os_time now;
  53         size_t len, i;
  54
  55         wpa_printf(MSG_DEBUG, "TLSv1: Send ClientHello");
  56         *out_len = 0;
  57
  58         os_get_time(&now);
  59         WPA_PUT_BE32(conn->client_random, now.sec);
  60         if (os_get_random(conn->client_random + 4, TLS_RANDOM_LEN - 4)) {
  61                 wpa_printf(MSG_ERROR, "TLSv1: Could not generate "
  62                            "client_random");
  63                 return NULL;
  64         }
  65         wpa_hexdump(MSG_MSGDUMP, "TLSv1: client_random",
  66                     conn->client_random, TLS_RANDOM_LEN);
  67
  68         len = 100 + conn->num_cipher_suites * 2 + conn->client_hello_ext_len;
  69         hello = os_malloc(len);
  70         if (hello == NULL)
  71                 return NULL;
  72         end = hello + len;
  73
  74         rhdr = hello;
  75         pos = rhdr + TLS_RECORD_HEADER_LEN;
  76
  77         /* opaque fragment[TLSPlaintext.length] */
  78
  79         /* Handshake */
  80         hs_start = pos;
  81         /* HandshakeType msg_type */
  82         *pos++ = TLS_HANDSHAKE_TYPE_CLIENT_HELLO;
  83         /* uint24 length (to be filled) */
  84         hs_length = pos;
  85         pos += 3;
  86         /* body - ClientHello */
  87         /* ProtocolVersion client_version */
  88         WPA_PUT_BE16(pos, TLS_VERSION);
  89         pos += 2;
  90         /* Random random: uint32 gmt_unix_time, opaque random_bytes */
  91         os_memcpy(pos, conn->client_random, TLS_RANDOM_LEN);
  92         pos += TLS_RANDOM_LEN;
  93         /* SessionID session_id */
  94         *pos++ = conn->session_id_len;
  95         os_memcpy(pos, conn->session_id, conn->session_id_len);
  96         pos += conn->session_id_len;
  97         /* CipherSuite cipher_suites<2..2^16-1> */
  98         WPA_PUT_BE16(pos, 2 * conn->num_cipher_suites);
  99         pos += 2;
 100         for (i = 0; i < conn->num_cipher_suites; i++) {
 101                 WPA_PUT_BE16(pos, conn->cipher_suites[i]);
 102                 pos += 2;
 103         }
 104         /* CompressionMethod compression_methods<1..2^8-1> */
 105         *pos++ = 1;
 106         *pos++ = TLS_COMPRESSION_NULL;
 107
 108         if (conn->client_hello_ext) {
 109                 os_memcpy(pos, conn->client_hello_ext,
 110                           conn->client_hello_ext_len);
 111                 pos += conn->client_hello_ext_len;
 112         }
 113
 114         WPA_PUT_BE24(hs_length, pos - hs_length - 3);
 115         tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
 116
 117         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 118                               rhdr, end - rhdr, pos - hs_start, out_len) < 0) {
 119                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to create TLS record");
 120                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 121                           TLS_ALERT_INTERNAL_ERROR);
 122                 os_free(hello);
 123                 return NULL;
 124         }
 125
 126         conn->state = SERVER_HELLO;
 127
 128         return hello;
 129 }
 130
 131
 132 static int tls_write_client_certificate(struct tlsv1_client *conn,
 133                                         u8 **msgpos, u8 *end)
 134 {
 135         u8 *pos, *rhdr, *hs_start, *hs_length, *cert_start;
 136         size_t rlen;
 137         struct x509_certificate *cert;
 138
 139         pos = *msgpos;
 140
 141         wpa_printf(MSG_DEBUG, "TLSv1: Send Certificate");
 142         rhdr = pos;
 143         pos += TLS_RECORD_HEADER_LEN;
 144
 145         /* opaque fragment[TLSPlaintext.length] */
 146
 147         /* Handshake */
 148         hs_start = pos;
 149         /* HandshakeType msg_type */
 150         *pos++ = TLS_HANDSHAKE_TYPE_CERTIFICATE;
 151         /* uint24 length (to be filled) */
 152         hs_length = pos;
 153         pos += 3;
 154         /* body - Certificate */
 155         /* uint24 length (to be filled) */
 156         cert_start = pos;
 157         pos += 3;
 158         cert = conn->cred ? conn->cred->cert : NULL;
 159         while (cert) {
 160                 if (pos + 3 + cert->cert_len > end) {
 161                         wpa_printf(MSG_DEBUG, "TLSv1: Not enough buffer space "
 162                                    "for Certificate (cert_len=%lu left=%lu)",
 163                                    (unsigned long) cert->cert_len,
 164                                    (unsigned long) (end - pos));
 165                         tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 166                                   TLS_ALERT_INTERNAL_ERROR);
 167                         return -1;
 168                 }
 169                 WPA_PUT_BE24(pos, cert->cert_len);
 170                 pos += 3;
 171                 os_memcpy(pos, cert->cert_start, cert->cert_len);
 172                 pos += cert->cert_len;
 173
 174                 if (x509_certificate_self_signed(cert))
 175                         break;
 176                 cert = x509_certificate_get_subject(conn->cred->trusted_certs,
 177                                                     &cert->issuer);
 178         }
 179         if (conn->cred == NULL || cert == conn->cred->cert || cert == NULL) {
 180                 /*
 181                  * Client was not configured with all the needed certificates
 182                  * to form a full certificate chain. The server may fail to
 183                  * validate the chain unless it is configured with all the
 184                  * missing CA certificates.
 185                  */
 186                 wpa_printf(MSG_DEBUG, "TLSv1: Full client certificate chain "
 187                            "not configured - validation may fail");
 188         }
 189         WPA_PUT_BE24(cert_start, pos - cert_start - 3);
 190
 191         WPA_PUT_BE24(hs_length, pos - hs_length - 3);
 192
 193         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 194                               rhdr, end - rhdr, pos - hs_start, &rlen) < 0) {
 195                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate a record");
 196                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 197                           TLS_ALERT_INTERNAL_ERROR);
 198                 return -1;
 199         }
 200         pos = rhdr + rlen;
 201
 202         tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
 203
 204         *msgpos = pos;
 205
 206         return 0;
 207 }
 208
 209
 210 static int tlsv1_key_x_anon_dh(struct tlsv1_client *conn, u8 **pos, u8 *end)
 211 {
 212 #ifdef EAP_FAST
 213         /* ClientDiffieHellmanPublic */
 214         u8 *csecret, *csecret_start, *dh_yc, *shared;
 215         size_t csecret_len, dh_yc_len, shared_len;
 216
 217         csecret_len = conn->dh_p_len;
 218         csecret = os_malloc(csecret_len);
 219         if (csecret == NULL) {
 220                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to allocate "
 221                            "memory for Yc (Diffie-Hellman)");
 222                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 223                           TLS_ALERT_INTERNAL_ERROR);
 224                 return -1;
 225         }
 226         if (os_get_random(csecret, csecret_len)) {
 227                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to get random "
 228                            "data for Diffie-Hellman");
 229                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 230                           TLS_ALERT_INTERNAL_ERROR);
 231                 os_free(csecret);
 232                 return -1;
 233         }
 234
 235         if (os_memcmp(csecret, conn->dh_p, csecret_len) > 0)
 236                 csecret[0] = 0; /* make sure Yc < p */
 237
 238         csecret_start = csecret;
 239         while (csecret_len > 1 && *csecret_start == 0) {
 240                 csecret_start++;
 241                 csecret_len--;
 242         }
 243         wpa_hexdump_key(MSG_DEBUG, "TLSv1: DH client's secret value",
 244                         csecret_start, csecret_len);
 245
 246         /* Yc = g^csecret mod p */
 247         dh_yc_len = conn->dh_p_len;
 248         dh_yc = os_malloc(dh_yc_len);
 249         if (dh_yc == NULL) {
 250                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to allocate "
 251                            "memory for Diffie-Hellman");
 252                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 253                           TLS_ALERT_INTERNAL_ERROR);
 254                 os_free(csecret);
 255                 return -1;
 256         }
 257         if (crypto_mod_exp(conn->dh_g, conn->dh_g_len,
 258                            csecret_start, csecret_len,
 259                            conn->dh_p, conn->dh_p_len,
 260                            dh_yc, &dh_yc_len)) {
 261                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 262                           TLS_ALERT_INTERNAL_ERROR);
 263                 os_free(csecret);
 264                 os_free(dh_yc);
 265                 return -1;
 266         }
 267
 268         wpa_hexdump(MSG_DEBUG, "TLSv1: DH Yc (client's public value)",
 269                     dh_yc, dh_yc_len);
 270
 271         WPA_PUT_BE16(*pos, dh_yc_len);
 272         *pos += 2;
 273         if (*pos + dh_yc_len > end) {
 274                 wpa_printf(MSG_DEBUG, "TLSv1: Not enough room in the "
 275                            "message buffer for Yc");
 276                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 277                           TLS_ALERT_INTERNAL_ERROR);
 278                 os_free(csecret);
 279                 os_free(dh_yc);
 280                 return -1;
 281         }
 282         os_memcpy(*pos, dh_yc, dh_yc_len);
 283         *pos += dh_yc_len;
 284         os_free(dh_yc);
 285
 286         shared_len = conn->dh_p_len;
 287         shared = os_malloc(shared_len);
 288         if (shared == NULL) {
 289                 wpa_printf(MSG_DEBUG, "TLSv1: Could not allocate memory for "
 290                            "DH");
 291                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 292                           TLS_ALERT_INTERNAL_ERROR);
 293                 os_free(csecret);
 294                 return -1;
 295         }
 296
 297         /* shared = Ys^csecret mod p */
 298         if (crypto_mod_exp(conn->dh_ys, conn->dh_ys_len,
 299                            csecret_start, csecret_len,
 300                            conn->dh_p, conn->dh_p_len,
 301                            shared, &shared_len)) {
 302                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 303                           TLS_ALERT_INTERNAL_ERROR);
 304                 os_free(csecret);
 305                 os_free(shared);
 306                 return -1;
 307         }
 308         wpa_hexdump_key(MSG_DEBUG, "TLSv1: Shared secret from DH key exchange",
 309                         shared, shared_len);
 310
 311         os_memset(csecret_start, 0, csecret_len);
 312         os_free(csecret);
 313         if (tls_derive_keys(conn, shared, shared_len)) {
 314                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive keys");
 315                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 316                           TLS_ALERT_INTERNAL_ERROR);
 317                 os_free(shared);
 318                 return -1;
 319         }
 320         os_memset(shared, 0, shared_len);
 321         os_free(shared);
 322         tlsv1_client_free_dh(conn);
 323         return 0;
 324 #else /* EAP_FAST */
 325         tls_alert(conn, TLS_ALERT_LEVEL_FATAL, TLS_ALERT_INTERNAL_ERROR);
 326         return -1;
 327 #endif /* EAP_FAST */
 328 }
 329
 330
 331 static int tlsv1_key_x_rsa(struct tlsv1_client *conn, u8 **pos, u8 *end)
 332 {
 333         u8 pre_master_secret[TLS_PRE_MASTER_SECRET_LEN];
 334         size_t clen;
 335         int res;
 336
 337         if (tls_derive_pre_master_secret(pre_master_secret) < 0 ||
 338             tls_derive_keys(conn, pre_master_secret,
 339                             TLS_PRE_MASTER_SECRET_LEN)) {
 340                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive keys");
 341                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 342                           TLS_ALERT_INTERNAL_ERROR);
 343                 return -1;
 344         }
 345
 346         /* EncryptedPreMasterSecret */
 347         if (conn->server_rsa_key == NULL) {
 348                 wpa_printf(MSG_DEBUG, "TLSv1: No server RSA key to "
 349                            "use for encrypting pre-master secret");
 350                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 351                           TLS_ALERT_INTERNAL_ERROR);
 352                 return -1;
 353         }
 354
 355         /* RSA encrypted value is encoded with PKCS #1 v1.5 block type 2. */
 356         *pos += 2;
 357         clen = end - *pos;
 358         res = crypto_public_key_encrypt_pkcs1_v15(
 359                 conn->server_rsa_key,
 360                 pre_master_secret, TLS_PRE_MASTER_SECRET_LEN,
 361                 *pos, &clen);
 362         os_memset(pre_master_secret, 0, TLS_PRE_MASTER_SECRET_LEN);
 363         if (res < 0) {
 364                 wpa_printf(MSG_DEBUG, "TLSv1: RSA encryption failed");
 365                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 366                           TLS_ALERT_INTERNAL_ERROR);
 367                 return -1;
 368         }
 369         WPA_PUT_BE16(*pos - 2, clen);
 370         wpa_hexdump(MSG_MSGDUMP, "TLSv1: Encrypted pre_master_secret",
 371                     *pos, clen);
 372         *pos += clen;
 373
 374         return 0;
 375 }
 376
 377
 378 static int tls_write_client_key_exchange(struct tlsv1_client *conn,
 379                                          u8 **msgpos, u8 *end)
 380 {
 381         u8 *pos, *rhdr, *hs_start, *hs_length;
 382         size_t rlen;
 383         tls_key_exchange keyx;
 384         const struct tls_cipher_suite *suite;
 385
 386         suite = tls_get_cipher_suite(conn->rl.cipher_suite);
 387         if (suite == NULL)
 388                 keyx = TLS_KEY_X_NULL;
 389         else
 390                 keyx = suite->key_exchange;
 391
 392         pos = *msgpos;
 393
 394         wpa_printf(MSG_DEBUG, "TLSv1: Send ClientKeyExchange");
 395
 396         rhdr = pos;
 397         pos += TLS_RECORD_HEADER_LEN;
 398
 399         /* opaque fragment[TLSPlaintext.length] */
 400
 401         /* Handshake */
 402         hs_start = pos;
 403         /* HandshakeType msg_type */
 404         *pos++ = TLS_HANDSHAKE_TYPE_CLIENT_KEY_EXCHANGE;
 405         /* uint24 length (to be filled) */
 406         hs_length = pos;
 407         pos += 3;
 408         /* body - ClientKeyExchange */
 409         if (keyx == TLS_KEY_X_DH_anon) {
 410                 if (tlsv1_key_x_anon_dh(conn, &pos, end) < 0)
 411                         return -1;
 412         } else {
 413                 if (tlsv1_key_x_rsa(conn, &pos, end) < 0)
 414                         return -1;
 415         }
 416
 417         WPA_PUT_BE24(hs_length, pos - hs_length - 3);
 418
 419         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 420                               rhdr, end - rhdr, pos - hs_start, &rlen) < 0) {
 421                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to create a record");
 422                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 423                           TLS_ALERT_INTERNAL_ERROR);
 424                 return -1;
 425         }
 426         pos = rhdr + rlen;
 427         tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
 428
 429         *msgpos = pos;
 430
 431         return 0;
 432 }
 433
 434
 435 static int tls_write_client_certificate_verify(struct tlsv1_client *conn,
 436                                                u8 **msgpos, u8 *end)
 437 {
 438         u8 *pos, *rhdr, *hs_start, *hs_length, *signed_start;
 439         size_t rlen, hlen, clen;
 440         u8 hash[MD5_MAC_LEN + SHA1_MAC_LEN], *hpos;
 441         enum { SIGN_ALG_RSA, SIGN_ALG_DSA } alg = SIGN_ALG_RSA;
 442
 443         pos = *msgpos;
 444
 445         wpa_printf(MSG_DEBUG, "TLSv1: Send CertificateVerify");
 446         rhdr = pos;
 447         pos += TLS_RECORD_HEADER_LEN;
 448
 449         /* Handshake */
 450         hs_start = pos;
 451         /* HandshakeType msg_type */
 452         *pos++ = TLS_HANDSHAKE_TYPE_CERTIFICATE_VERIFY;
 453         /* uint24 length (to be filled) */
 454         hs_length = pos;
 455         pos += 3;
 456
 457         /*
 458          * RFC 2246: 7.4.3 and 7.4.8:
 459          * Signature signature
 460          *
 461          * RSA:
 462          * digitally-signed struct {
 463          *     opaque md5_hash[16];
 464          *     opaque sha_hash[20];
 465          * };
 466          *
 467          * DSA:
 468          * digitally-signed struct {
 469          *     opaque sha_hash[20];
 470          * };
 471          *
 472          * The hash values are calculated over all handshake messages sent or
 473          * received starting at ClientHello up to, but not including, this
 474          * CertificateVerify message, including the type and length fields of
 475          * the handshake messages.
 476          */
 477
 478         hpos = hash;
 479
 480         if (alg == SIGN_ALG_RSA) {
 481                 hlen = MD5_MAC_LEN;
 482                 if (conn->verify.md5_cert == NULL ||
 483                     crypto_hash_finish(conn->verify.md5_cert, hpos, &hlen) < 0)
 484                 {
 485                         tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 486                                   TLS_ALERT_INTERNAL_ERROR);
 487                         conn->verify.md5_cert = NULL;
 488                         crypto_hash_finish(conn->verify.sha1_cert, NULL, NULL);
 489                         conn->verify.sha1_cert = NULL;
 490                         return -1;
 491                 }
 492                 hpos += MD5_MAC_LEN;
 493         } else
 494                 crypto_hash_finish(conn->verify.md5_cert, NULL, NULL);
 495
 496         conn->verify.md5_cert = NULL;
 497         hlen = SHA1_MAC_LEN;
 498         if (conn->verify.sha1_cert == NULL ||
 499             crypto_hash_finish(conn->verify.sha1_cert, hpos, &hlen) < 0) {
 500                 conn->verify.sha1_cert = NULL;
 501                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 502                           TLS_ALERT_INTERNAL_ERROR);
 503                 return -1;
 504         }
 505         conn->verify.sha1_cert = NULL;
 506
 507         if (alg == SIGN_ALG_RSA)
 508                 hlen += MD5_MAC_LEN;
 509
 510         wpa_hexdump(MSG_MSGDUMP, "TLSv1: CertificateVerify hash", hash, hlen);
 511
 512         /*
 513          * RFC 2246, 4.7:
 514          * In digital signing, one-way hash functions are used as input for a
 515          * signing algorithm. A digitally-signed element is encoded as an
 516          * opaque vector <0..2^16-1>, where the length is specified by the
 517          * signing algorithm and key.
 518          *
 519          * In RSA signing, a 36-byte structure of two hashes (one SHA and one
 520          * MD5) is signed (encrypted with the private key). It is encoded with
 521          * PKCS #1 block type 0 or type 1 as described in [PKCS1].
 522          */
 523         signed_start = pos; /* length to be filled */
 524         pos += 2;
 525         clen = end - pos;
 526         if (conn->cred == NULL ||
 527             crypto_private_key_sign_pkcs1(conn->cred->key, hash, hlen,
 528                                           pos, &clen) < 0) {
 529                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to sign hash (PKCS #1)");
 530                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 531                           TLS_ALERT_INTERNAL_ERROR);
 532                 return -1;
 533         }
 534         WPA_PUT_BE16(signed_start, clen);
 535
 536         pos += clen;
 537
 538         WPA_PUT_BE24(hs_length, pos - hs_length - 3);
 539
 540         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 541                               rhdr, end - rhdr, pos - hs_start, &rlen) < 0) {
 542                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate a record");
 543                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 544                           TLS_ALERT_INTERNAL_ERROR);
 545                 return -1;
 546         }
 547         pos = rhdr + rlen;
 548
 549         tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
 550
 551         *msgpos = pos;
 552
 553         return 0;
 554 }
 555
 556
 557 static int tls_write_client_change_cipher_spec(struct tlsv1_client *conn,
 558                                                u8 **msgpos, u8 *end)
 559 {
 560         u8 *pos, *rhdr;
 561         size_t rlen;
 562
 563         pos = *msgpos;
 564
 565         wpa_printf(MSG_DEBUG, "TLSv1: Send ChangeCipherSpec");
 566         rhdr = pos;
 567         pos += TLS_RECORD_HEADER_LEN;
 568         *pos = TLS_CHANGE_CIPHER_SPEC;
 569         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_CHANGE_CIPHER_SPEC,
 570                               rhdr, end - rhdr, 1, &rlen) < 0) {
 571                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to create a record");
 572                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 573                           TLS_ALERT_INTERNAL_ERROR);
 574                 return -1;
 575         }
 576
 577         if (tlsv1_record_change_write_cipher(&conn->rl) < 0) {
 578                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to set write cipher for "
 579                            "record layer");
 580                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 581                           TLS_ALERT_INTERNAL_ERROR);
 582                 return -1;
 583         }
 584
 585         *msgpos = rhdr + rlen;
 586
 587         return 0;
 588 }
 589
 590
 591 static int tls_write_client_finished(struct tlsv1_client *conn,
 592                                      u8 **msgpos, u8 *end)
 593 {
 594         u8 *pos, *rhdr, *hs_start, *hs_length;
 595         size_t rlen, hlen;
 596         u8 verify_data[TLS_VERIFY_DATA_LEN];
 597         u8 hash[MD5_MAC_LEN + SHA1_MAC_LEN];
 598
 599         pos = *msgpos;
 600
 601         wpa_printf(MSG_DEBUG, "TLSv1: Send Finished");
 602
 603         /* Encrypted Handshake Message: Finished */
 604
 605         hlen = MD5_MAC_LEN;
 606         if (conn->verify.md5_client == NULL ||
 607             crypto_hash_finish(conn->verify.md5_client, hash, &hlen) < 0) {
 608                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 609                           TLS_ALERT_INTERNAL_ERROR);
 610                 conn->verify.md5_client = NULL;
 611                 crypto_hash_finish(conn->verify.sha1_client, NULL, NULL);
 612                 conn->verify.sha1_client = NULL;
 613                 return -1;
 614         }
 615         conn->verify.md5_client = NULL;
 616         hlen = SHA1_MAC_LEN;
 617         if (conn->verify.sha1_client == NULL ||
 618             crypto_hash_finish(conn->verify.sha1_client, hash + MD5_MAC_LEN,
 619                                &hlen) < 0) {
 620                 conn->verify.sha1_client = NULL;
 621                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 622                           TLS_ALERT_INTERNAL_ERROR);
 623                 return -1;
 624         }
 625         conn->verify.sha1_client = NULL;
 626
 627         if (tls_prf(conn->master_secret, TLS_MASTER_SECRET_LEN,
 628                     "client finished", hash, MD5_MAC_LEN + SHA1_MAC_LEN,
 629                     verify_data, TLS_VERIFY_DATA_LEN)) {
 630                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate verify_data");
 631                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 632                           TLS_ALERT_INTERNAL_ERROR);
 633                 return -1;
 634         }
 635         wpa_hexdump_key(MSG_DEBUG, "TLSv1: verify_data (client)",
 636                         verify_data, TLS_VERIFY_DATA_LEN);
 637
 638         rhdr = pos;
 639         pos += TLS_RECORD_HEADER_LEN;
 640         /* Handshake */
 641         hs_start = pos;
 642         /* HandshakeType msg_type */
 643         *pos++ = TLS_HANDSHAKE_TYPE_FINISHED;
 644         /* uint24 length (to be filled) */
 645         hs_length = pos;
 646         pos += 3;
 647         os_memcpy(pos, verify_data, TLS_VERIFY_DATA_LEN);
 648         pos += TLS_VERIFY_DATA_LEN;
 649         WPA_PUT_BE24(hs_length, pos - hs_length - 3);
 650         tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
 651
 652         if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
 653                               rhdr, end - rhdr, pos - hs_start, &rlen) < 0) {
 654                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to create a record");
 655                 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
 656                           TLS_ALERT_INTERNAL_ERROR);
 657                 return -1;
 658         }
 659
 660         pos = rhdr + rlen;
 661
 662         *msgpos = pos;
 663
 664         return 0;
 665 }
 666
 667
 668 static u8 * tls_send_client_key_exchange(struct tlsv1_client *conn,
 669                                          size_t *out_len)
 670 {
 671         u8 *msg, *end, *pos;
 672         size_t msglen;
 673
 674         *out_len = 0;
 675
 676         msglen = 1000;
 677         if (conn->certificate_requested)
 678                 msglen += tls_client_cert_chain_der_len(conn);
 679
 680         msg = os_malloc(msglen);
 681         if (msg == NULL)
 682                 return NULL;
 683
 684         pos = msg;
 685         end = msg + msglen;
 686
 687         if (conn->certificate_requested) {
 688                 if (tls_write_client_certificate(conn, &pos, end) < 0) {
 689                         os_free(msg);
 690                         return NULL;
 691                 }
 692         }
 693
 694         if (tls_write_client_key_exchange(conn, &pos, end) < 0 ||
 695             (conn->certificate_requested && conn->cred && conn->cred->key &&
 696              tls_write_client_certificate_verify(conn, &pos, end) < 0) ||
 697             tls_write_client_change_cipher_spec(conn, &pos, end) < 0 ||
 698             tls_write_client_finished(conn, &pos, end) < 0) {
 699                 os_free(msg);
 700                 return NULL;
 701         }
 702
 703         *out_len = pos - msg;
 704
 705         conn->state = SERVER_CHANGE_CIPHER_SPEC;
 706
 707         return msg;
 708 }
 709
 710
 711 static u8 * tls_send_change_cipher_spec(struct tlsv1_client *conn,
 712                                         size_t *out_len)
 713 {
 714         u8 *msg, *end, *pos;
 715
 716         *out_len = 0;
 717
 718         msg = os_malloc(1000);
 719         if (msg == NULL)
 720                 return NULL;
 721
 722         pos = msg;
 723         end = msg + 1000;
 724
 725         if (tls_write_client_change_cipher_spec(conn, &pos, end) < 0 ||
 726             tls_write_client_finished(conn, &pos, end) < 0) {
 727                 os_free(msg);
 728                 return NULL;
 729         }
 730
 731         *out_len = pos - msg;
 732
 733         wpa_printf(MSG_DEBUG, "TLSv1: Session resumption completed "
 734                    "successfully");
 735         conn->state = ESTABLISHED;
 736
 737         return msg;
 738 }
 739
 740
 741 u8 * tlsv1_client_handshake_write(struct tlsv1_client *conn, size_t *out_len,
 742                                   int no_appl_data)
 743 {
 744         switch (conn->state) {
 745         case CLIENT_KEY_EXCHANGE:
 746                 return tls_send_client_key_exchange(conn, out_len);
 747         case CHANGE_CIPHER_SPEC:
 748                 return tls_send_change_cipher_spec(conn, out_len);
 749         case ACK_FINISHED:
 750                 wpa_printf(MSG_DEBUG, "TLSv1: Handshake completed "
 751                            "successfully");
 752                 conn->state = ESTABLISHED;
 753                 *out_len = 0;
 754                 if (no_appl_data) {
 755                         /* Need to return something to get final TLS ACK. */
 756                         return os_malloc(1);
 757                 }
 758                 return NULL;
 759         default:
 760                 wpa_printf(MSG_DEBUG, "TLSv1: Unexpected state %d while "
 761                            "generating reply", conn->state);
 762                 return NULL;
 763         }
 764 }
 765
 766
 767 u8 * tlsv1_client_send_alert(struct tlsv1_client *conn, u8 level,
 768                              u8 description, size_t *out_len)
 769 {
 770         u8 *alert, *pos, *length;
 771
 772         wpa_printf(MSG_DEBUG, "TLSv1: Send Alert(%d:%d)", level, description);
 773         *out_len = 0;
 774
 775         alert = os_malloc(10);
 776         if (alert == NULL)
 777                 return NULL;
 778
 779         pos = alert;
 780
 781         /* TLSPlaintext */
 782         /* ContentType type */
 783         *pos++ = TLS_CONTENT_TYPE_ALERT;
 784         /* ProtocolVersion version */
 785         WPA_PUT_BE16(pos, TLS_VERSION);
 786         pos += 2;
 787         /* uint16 length (to be filled) */
 788         length = pos;
 789         pos += 2;
 790         /* opaque fragment[TLSPlaintext.length] */
 791
 792         /* Alert */
 793         /* AlertLevel level */
 794         *pos++ = level;
 795         /* AlertDescription description */
 796         *pos++ = description;
 797
 798         WPA_PUT_BE16(length, pos - length - 2);
 799         *out_len = pos - alert;
 800
 801         return alert;
 802 }