mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-22 23:12:32 +00:00
395afc4c58
Release 2.11 has been quite a few new features and fixes since the 2.10 release. The following ChangeLog entries highlight some of the main changes: * Wi-Fi Easy Connect - add support for DPP release 3 - allow Configurator parameters to be provided during config exchange * HE/IEEE 802.11ax/Wi-Fi 6 - various fixes * EHT/IEEE 802.11be/Wi-Fi 7 - add preliminary support * SAE: add support for fetching the password from a RADIUS server * support OpenSSL 3.0 API changes * support background radar detection and CAC with some additional drivers * support RADIUS ACL/PSK check during 4-way handshake (wpa_psk_radius=3) * EAP-SIM/AKA: support IMSI privacy * improve 4-way handshake operations - use Secure=1 in message 3 during PTK rekeying ...and many more Remove upstreamed patches: 023-ndisc_snoop-call-dl_list_del-before-freeing-ipv6-add.patch 030-driver_nl80211-rewrite-neigh-code-to-not-depend-on-l.patch 040-mesh-allow-processing-authentication-frames-in-block.patch 181-driver_nl80211-update-drv-ifindex-on-removing-the-fi.patch 182-nl80211-move-nl80211_put_freq_params-call-outside-of.patch 183-hostapd-cancel-channel_list_update_timeout-in-hostap.patch 210-build-de-duplicate-_DIRS-before-calling-mkdir.patch 253-qos_map_set_without_interworking.patch 751-qos_map_ignore_when_unsupported.patch 800-SAE-Check-for-invalid-Rejected-Groups-element-length.patch 801-SAE-Check-for-invalid-Rejected-Groups-element-length.patch 802-SAE-Reject-invalid-Rejected-Groups-element-in-the-pa.patch Other patches has been updated. Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com> Link: https://github.com/openwrt/openwrt/pull/16338 Signed-off-by: Robert Marko <robimarko@gmail.com>
8052 lines
248 KiB
Diff
8052 lines
248 KiB
Diff
From e16f200dc1d2f69efc78c7c55af0d7b410a981f9 Mon Sep 17 00:00:00 2001
|
|
From: Glenn Strauss <gstrauss@gluelogic.com>
|
|
Date: Tue, 5 Jul 2022 02:49:50 -0400
|
|
Subject: [PATCH 1/7] mbedtls: TLS/crypto option (initial port)
|
|
|
|
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
|
|
---
|
|
hostapd/Makefile | 91 +
|
|
hostapd/defconfig | 15 +-
|
|
src/crypto/crypto_mbedtls.c | 4043 +++++++++++++++++
|
|
src/crypto/tls_mbedtls.c | 3313 ++++++++++++++
|
|
.../build/build-wpa_supplicant-mbedtls.config | 24 +
|
|
tests/hwsim/example-hostapd.config | 4 +
|
|
tests/hwsim/example-wpa_supplicant.config | 4 +
|
|
wpa_supplicant/Makefile | 74 +
|
|
wpa_supplicant/defconfig | 6 +-
|
|
9 files changed, 7571 insertions(+), 3 deletions(-)
|
|
create mode 100644 src/crypto/crypto_mbedtls.c
|
|
create mode 100644 src/crypto/tls_mbedtls.c
|
|
create mode 100644 tests/build/build-wpa_supplicant-mbedtls.config
|
|
|
|
--- a/hostapd/Makefile
|
|
+++ b/hostapd/Makefile
|
|
@@ -757,6 +757,40 @@ endif
|
|
CFLAGS += -DTLS_DEFAULT_CIPHERS=\"$(CONFIG_TLS_DEFAULT_CIPHERS)\"
|
|
endif
|
|
|
|
+ifeq ($(CONFIG_TLS), mbedtls)
|
|
+ifndef CONFIG_CRYPTO
|
|
+CONFIG_CRYPTO=mbedtls
|
|
+endif
|
|
+ifdef TLS_FUNCS
|
|
+OBJS += ../src/crypto/tls_mbedtls.o
|
|
+LIBS += -lmbedtls
|
|
+ifndef CONFIG_DPP
|
|
+LIBS += -lmbedx509
|
|
+endif
|
|
+endif
|
|
+OBJS += ../src/crypto/crypto_$(CONFIG_CRYPTO).o
|
|
+HOBJS += ../src/crypto/crypto_$(CONFIG_CRYPTO).o
|
|
+SOBJS += ../src/crypto/crypto_$(CONFIG_CRYPTO).o
|
|
+ifdef NEED_FIPS186_2_PRF
|
|
+OBJS += ../src/crypto/fips_prf_internal.o
|
|
+SHA1OBJS += ../src/crypto/sha1-internal.o
|
|
+endif
|
|
+ifeq ($(CONFIG_CRYPTO), mbedtls)
|
|
+ifdef CONFIG_DPP
|
|
+LIBS += -lmbedx509
|
|
+LIBS_h += -lmbedx509
|
|
+LIBS_n += -lmbedx509
|
|
+LIBS_s += -lmbedx509
|
|
+endif
|
|
+LIBS += -lmbedcrypto
|
|
+LIBS_h += -lmbedcrypto
|
|
+LIBS_n += -lmbedcrypto
|
|
+LIBS_s += -lmbedcrypto
|
|
+# XXX: create a config option?
|
|
+CFLAGS += -DCRYPTO_RSA_OAEP_SHA256
|
|
+endif
|
|
+endif
|
|
+
|
|
ifeq ($(CONFIG_TLS), gnutls)
|
|
ifndef CONFIG_CRYPTO
|
|
# default to libgcrypt
|
|
@@ -936,9 +970,11 @@ endif
|
|
|
|
ifneq ($(CONFIG_TLS), openssl)
|
|
ifneq ($(CONFIG_TLS), wolfssl)
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
AESOBJS += ../src/crypto/aes-wrap.o
|
|
endif
|
|
endif
|
|
+endif
|
|
ifdef NEED_AES_EAX
|
|
AESOBJS += ../src/crypto/aes-eax.o
|
|
NEED_AES_CTR=y
|
|
@@ -948,38 +984,48 @@ AESOBJS += ../src/crypto/aes-siv.o
|
|
NEED_AES_CTR=y
|
|
endif
|
|
ifdef NEED_AES_CTR
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
AESOBJS += ../src/crypto/aes-ctr.o
|
|
endif
|
|
+endif
|
|
ifdef NEED_AES_ENCBLOCK
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
AESOBJS += ../src/crypto/aes-encblock.o
|
|
endif
|
|
+endif
|
|
ifneq ($(CONFIG_TLS), openssl)
|
|
ifneq ($(CONFIG_TLS), linux)
|
|
ifneq ($(CONFIG_TLS), wolfssl)
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
AESOBJS += ../src/crypto/aes-omac1.o
|
|
endif
|
|
endif
|
|
endif
|
|
+endif
|
|
ifdef NEED_AES_UNWRAP
|
|
ifneq ($(CONFIG_TLS), openssl)
|
|
ifneq ($(CONFIG_TLS), linux)
|
|
ifneq ($(CONFIG_TLS), wolfssl)
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
NEED_AES_DEC=y
|
|
AESOBJS += ../src/crypto/aes-unwrap.o
|
|
endif
|
|
endif
|
|
endif
|
|
endif
|
|
+endif
|
|
ifdef NEED_AES_CBC
|
|
NEED_AES_DEC=y
|
|
ifneq ($(CONFIG_TLS), openssl)
|
|
ifneq ($(CONFIG_TLS), linux)
|
|
ifneq ($(CONFIG_TLS), wolfssl)
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
AESOBJS += ../src/crypto/aes-cbc.o
|
|
endif
|
|
endif
|
|
endif
|
|
endif
|
|
+endif
|
|
ifdef NEED_AES_DEC
|
|
ifdef CONFIG_INTERNAL_AES
|
|
AESOBJS += ../src/crypto/aes-internal-dec.o
|
|
@@ -994,12 +1040,16 @@ ifneq ($(CONFIG_TLS), openssl)
|
|
ifneq ($(CONFIG_TLS), linux)
|
|
ifneq ($(CONFIG_TLS), gnutls)
|
|
ifneq ($(CONFIG_TLS), wolfssl)
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
SHA1OBJS += ../src/crypto/sha1.o
|
|
endif
|
|
endif
|
|
endif
|
|
endif
|
|
+endif
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
SHA1OBJS += ../src/crypto/sha1-prf.o
|
|
+endif
|
|
ifdef CONFIG_INTERNAL_SHA1
|
|
SHA1OBJS += ../src/crypto/sha1-internal.o
|
|
ifdef NEED_FIPS186_2_PRF
|
|
@@ -1008,16 +1058,22 @@ endif
|
|
endif
|
|
ifneq ($(CONFIG_TLS), openssl)
|
|
ifneq ($(CONFIG_TLS), wolfssl)
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
SHA1OBJS += ../src/crypto/sha1-pbkdf2.o
|
|
endif
|
|
endif
|
|
+endif
|
|
ifdef NEED_T_PRF
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
SHA1OBJS += ../src/crypto/sha1-tprf.o
|
|
endif
|
|
+endif
|
|
ifdef NEED_TLS_PRF
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
SHA1OBJS += ../src/crypto/sha1-tlsprf.o
|
|
endif
|
|
endif
|
|
+endif
|
|
|
|
ifdef NEED_SHA1
|
|
OBJS += $(SHA1OBJS)
|
|
@@ -1027,11 +1083,13 @@ ifneq ($(CONFIG_TLS), openssl)
|
|
ifneq ($(CONFIG_TLS), linux)
|
|
ifneq ($(CONFIG_TLS), gnutls)
|
|
ifneq ($(CONFIG_TLS), wolfssl)
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
OBJS += ../src/crypto/md5.o
|
|
endif
|
|
endif
|
|
endif
|
|
endif
|
|
+endif
|
|
|
|
ifdef NEED_MD5
|
|
ifdef CONFIG_INTERNAL_MD5
|
|
@@ -1070,56 +1128,81 @@ ifneq ($(CONFIG_TLS), openssl)
|
|
ifneq ($(CONFIG_TLS), linux)
|
|
ifneq ($(CONFIG_TLS), gnutls)
|
|
ifneq ($(CONFIG_TLS), wolfssl)
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
OBJS += ../src/crypto/sha256.o
|
|
endif
|
|
endif
|
|
endif
|
|
endif
|
|
+endif
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
OBJS += ../src/crypto/sha256-prf.o
|
|
+endif
|
|
ifdef CONFIG_INTERNAL_SHA256
|
|
OBJS += ../src/crypto/sha256-internal.o
|
|
endif
|
|
ifdef NEED_TLS_PRF_SHA256
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
OBJS += ../src/crypto/sha256-tlsprf.o
|
|
endif
|
|
+endif
|
|
ifdef NEED_TLS_PRF_SHA384
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
OBJS += ../src/crypto/sha384-tlsprf.o
|
|
endif
|
|
+endif
|
|
ifdef NEED_HMAC_SHA256_KDF
|
|
+CFLAGS += -DCONFIG_HMAC_SHA256_KDF
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
OBJS += ../src/crypto/sha256-kdf.o
|
|
endif
|
|
+endif
|
|
ifdef NEED_HMAC_SHA384_KDF
|
|
+CFLAGS += -DCONFIG_HMAC_SHA384_KDF
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
OBJS += ../src/crypto/sha384-kdf.o
|
|
endif
|
|
+endif
|
|
ifdef NEED_HMAC_SHA512_KDF
|
|
+CFLAGS += -DCONFIG_HMAC_SHA512_KDF
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
OBJS += ../src/crypto/sha512-kdf.o
|
|
endif
|
|
+endif
|
|
ifdef NEED_SHA384
|
|
CFLAGS += -DCONFIG_SHA384
|
|
ifneq ($(CONFIG_TLS), openssl)
|
|
ifneq ($(CONFIG_TLS), linux)
|
|
ifneq ($(CONFIG_TLS), gnutls)
|
|
ifneq ($(CONFIG_TLS), wolfssl)
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
OBJS += ../src/crypto/sha384.o
|
|
endif
|
|
endif
|
|
endif
|
|
endif
|
|
+endif
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
OBJS += ../src/crypto/sha384-prf.o
|
|
endif
|
|
+endif
|
|
ifdef NEED_SHA512
|
|
CFLAGS += -DCONFIG_SHA512
|
|
ifneq ($(CONFIG_TLS), openssl)
|
|
ifneq ($(CONFIG_TLS), linux)
|
|
ifneq ($(CONFIG_TLS), gnutls)
|
|
ifneq ($(CONFIG_TLS), wolfssl)
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
OBJS += ../src/crypto/sha512.o
|
|
endif
|
|
endif
|
|
endif
|
|
endif
|
|
+endif
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
OBJS += ../src/crypto/sha512-prf.o
|
|
endif
|
|
+endif
|
|
|
|
ifdef CONFIG_INTERNAL_SHA384
|
|
CFLAGS += -DCONFIG_INTERNAL_SHA384
|
|
@@ -1164,11 +1247,13 @@ HOBJS += $(SHA1OBJS)
|
|
ifneq ($(CONFIG_TLS), openssl)
|
|
ifneq ($(CONFIG_TLS), linux)
|
|
ifneq ($(CONFIG_TLS), wolfssl)
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
HOBJS += ../src/crypto/md5.o
|
|
endif
|
|
endif
|
|
endif
|
|
endif
|
|
+endif
|
|
|
|
ifdef CONFIG_RADIUS_SERVER
|
|
CFLAGS += -DRADIUS_SERVER
|
|
@@ -1342,7 +1427,9 @@ NOBJS += ../src/utils/trace.o
|
|
endif
|
|
|
|
HOBJS += hlr_auc_gw.o ../src/utils/common.o ../src/utils/wpa_debug.o ../src/utils/os_$(CONFIG_OS).o ../src/utils/wpabuf.o ../src/crypto/milenage.o
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
HOBJS += ../src/crypto/aes-encblock.o
|
|
+endif
|
|
ifdef CONFIG_INTERNAL_AES
|
|
HOBJS += ../src/crypto/aes-internal.o
|
|
HOBJS += ../src/crypto/aes-internal-enc.o
|
|
@@ -1365,13 +1452,17 @@ SOBJS += ../src/common/sae.o
|
|
SOBJS += ../src/common/sae_pk.o
|
|
SOBJS += ../src/common/dragonfly.o
|
|
SOBJS += $(AESOBJS)
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
SOBJS += ../src/crypto/sha256-prf.o
|
|
SOBJS += ../src/crypto/sha384-prf.o
|
|
SOBJS += ../src/crypto/sha512-prf.o
|
|
+endif
|
|
SOBJS += ../src/crypto/dh_groups.o
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
SOBJS += ../src/crypto/sha256-kdf.o
|
|
SOBJS += ../src/crypto/sha384-kdf.o
|
|
SOBJS += ../src/crypto/sha512-kdf.o
|
|
+endif
|
|
|
|
_OBJS_VAR := NOBJS
|
|
include ../src/objs.mk
|
|
--- a/hostapd/defconfig
|
|
+++ b/hostapd/defconfig
|
|
@@ -6,9 +6,21 @@
|
|
# just setting VARIABLE=n is not disabling that variable.
|
|
#
|
|
# This file is included in Makefile, so variables like CFLAGS and LIBS can also
|
|
-# be modified from here. In most cass, these lines should use += in order not
|
|
+# be modified from here. In most cases, these lines should use += in order not
|
|
# to override previous values of the variables.
|
|
|
|
+
|
|
+# Uncomment following two lines and fix the paths if you have installed TLS
|
|
+# libraries in a non-default location
|
|
+#CFLAGS += -I/usr/local/openssl/include
|
|
+#LIBS += -L/usr/local/openssl/lib
|
|
+
|
|
+# Some Red Hat versions seem to include kerberos header files from OpenSSL, but
|
|
+# the kerberos files are not in the default include path. Following line can be
|
|
+# used to fix build issues on such systems (krb5.h not found).
|
|
+#CFLAGS += -I/usr/include/kerberos
|
|
+
|
|
+
|
|
# Driver interface for Host AP driver
|
|
CONFIG_DRIVER_HOSTAP=y
|
|
|
|
@@ -281,6 +293,7 @@ CONFIG_IPV6=y
|
|
# openssl = OpenSSL (default)
|
|
# gnutls = GnuTLS
|
|
# internal = Internal TLSv1 implementation (experimental)
|
|
+# mbedtls = mbed TLS
|
|
# linux = Linux kernel AF_ALG and internal TLSv1 implementation (experimental)
|
|
# none = Empty template
|
|
#CONFIG_TLS=openssl
|
|
--- /dev/null
|
|
+++ b/src/crypto/crypto_mbedtls.c
|
|
@@ -0,0 +1,4043 @@
|
|
+/*
|
|
+ * crypto wrapper functions for mbed TLS
|
|
+ *
|
|
+ * SPDX-FileCopyrightText: 2022 Glenn Strauss <gstrauss@gluelogic.com>
|
|
+ * SPDX-License-Identifier: BSD-3-Clause
|
|
+ */
|
|
+
|
|
+#include "utils/includes.h"
|
|
+#include "utils/common.h"
|
|
+
|
|
+#include <mbedtls/version.h>
|
|
+#include <mbedtls/entropy.h>
|
|
+#include <mbedtls/ctr_drbg.h>
|
|
+#include <mbedtls/platform_util.h> /* mbedtls_platform_zeroize() */
|
|
+#include <mbedtls/asn1.h>
|
|
+#include <mbedtls/asn1write.h>
|
|
+#include <mbedtls/aes.h>
|
|
+#include <mbedtls/md.h>
|
|
+#include <mbedtls/md5.h>
|
|
+#include <mbedtls/sha1.h>
|
|
+#include <mbedtls/sha256.h>
|
|
+#include <mbedtls/sha512.h>
|
|
+
|
|
+#ifndef MBEDTLS_PRIVATE
|
|
+#define MBEDTLS_PRIVATE(x) x
|
|
+#endif
|
|
+
|
|
+/* hostapd/wpa_supplicant provides forced_memzero(),
|
|
+ * but prefer mbedtls_platform_zeroize() */
|
|
+#define forced_memzero(ptr,sz) mbedtls_platform_zeroize(ptr,sz)
|
|
+
|
|
+#ifndef __has_attribute
|
|
+#define __has_attribute(x) 0
|
|
+#endif
|
|
+
|
|
+#ifndef __GNUC_PREREQ
|
|
+#define __GNUC_PREREQ(maj,min) 0
|
|
+#endif
|
|
+
|
|
+#ifndef __attribute_cold__
|
|
+#if __has_attribute(cold) \
|
|
+ || __GNUC_PREREQ(4,3)
|
|
+#define __attribute_cold__ __attribute__((__cold__))
|
|
+#else
|
|
+#define __attribute_cold__
|
|
+#endif
|
|
+#endif
|
|
+
|
|
+#ifndef __attribute_noinline__
|
|
+#if __has_attribute(noinline) \
|
|
+ || __GNUC_PREREQ(3,1)
|
|
+#define __attribute_noinline__ __attribute__((__noinline__))
|
|
+#else
|
|
+#define __attribute_noinline__
|
|
+#endif
|
|
+#endif
|
|
+
|
|
+#include "crypto.h"
|
|
+#include "aes_wrap.h"
|
|
+#include "aes.h"
|
|
+#include "md5.h"
|
|
+#include "sha1.h"
|
|
+#include "sha256.h"
|
|
+#include "sha384.h"
|
|
+#include "sha512.h"
|
|
+
|
|
+
|
|
+/*
|
|
+ * selective code inclusion based on preprocessor defines
|
|
+ *
|
|
+ * future: additional code could be wrapped with preprocessor checks if
|
|
+ * wpa_supplicant/Makefile and hostap/Makefile were more consistent with
|
|
+ * setting preprocessor defines for named groups of functionality
|
|
+ */
|
|
+
|
|
+#if defined(CONFIG_FIPS)
|
|
+#undef MBEDTLS_MD4_C /* omit md4_vector() */
|
|
+#undef MBEDTLS_MD5_C /* omit md5_vector() hmac_md5_vector() hmac_md5() */
|
|
+#undef MBEDTLS_DES_C /* omit des_encrypt() */
|
|
+#undef MBEDTLS_NIST_KW_C /* omit aes_wrap() aes_unwrap() */
|
|
+#define CRYPTO_MBEDTLS_CONFIG_FIPS
|
|
+#endif
|
|
+
|
|
+#if !defined(CONFIG_FIPS)
|
|
+#if defined(EAP_PWD) \
|
|
+ || defined(EAP_LEAP) || defined(EAP_LEAP_DYNAMIC) \
|
|
+ || defined(EAP_TTLS) || defined(EAP_TTLS_DYNAMIC) \
|
|
+ || defined(EAP_MSCHAPv2) || defined(EAP_MSCHAPv2_DYNAMIC) \
|
|
+ || defined(EAP_SERVER_MSCHAPV2)
|
|
+#ifndef MBEDTLS_MD4_C /* (MD4 not in mbedtls 3.x) */
|
|
+#include "md4-internal.c"/* pull in hostap local implementation */
|
|
+#endif /* md4_vector() */
|
|
+#else
|
|
+#undef MBEDTLS_MD4_C /* omit md4_vector() */
|
|
+#endif
|
|
+#endif
|
|
+
|
|
+#if !defined(CONFIG_NO_RC4) && !defined(CONFIG_NO_WPA)
|
|
+#ifndef MBEDTLS_ARC4_C /* (RC4 not in mbedtls 3.x) */
|
|
+#include "rc4.c" /* pull in hostap local implementation */
|
|
+#endif /* rc4_skip() */
|
|
+#else
|
|
+#undef MBEDTLS_ARC4_C /* omit rc4_skip() */
|
|
+#endif
|
|
+
|
|
+#if defined(CONFIG_MACSEC) \
|
|
+ || defined(CONFIG_NO_RADIUS) \
|
|
+ || defined(CONFIG_IEEE80211R) \
|
|
+ || defined(EAP_SERVER_FAST) \
|
|
+ || defined(EAP_SERVER_TEAP) \
|
|
+ || !defined(CONFIG_NO_WPA)
|
|
+ /* aes_wrap() aes_unwrap() */
|
|
+#else
|
|
+#undef MBEDTLS_NIST_KW_C /* omit aes_wrap() aes_unwrap() */
|
|
+#endif
|
|
+
|
|
+#if !defined(CONFIG_SHA256)
|
|
+#undef MBEDTLS_SHA256_C
|
|
+#endif
|
|
+
|
|
+#if !defined(CONFIG_SHA384) && !defined(CONFIG_SHA512)
|
|
+#undef MBEDTLS_SHA512_C
|
|
+#endif
|
|
+
|
|
+#if defined(CONFIG_HMAC_SHA256_KDF)
|
|
+#define CRYPTO_MBEDTLS_HMAC_KDF_SHA256
|
|
+#endif
|
|
+#if defined(CONFIG_HMAC_SHA384_KDF)
|
|
+#define CRYPTO_MBEDTLS_HMAC_KDF_SHA384
|
|
+#endif
|
|
+#if defined(CONFIG_HMAC_SHA512_KDF)
|
|
+#define CRYPTO_MBEDTLS_HMAC_KDF_SHA512
|
|
+#endif
|
|
+
|
|
+#if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST) \
|
|
+ || defined(EAP_TEAP) || defined(EAP_TEAP_DYNAMIC) || defined(EAP_SERVER_FAST)
|
|
+#define CRYPTO_MBEDTLS_SHA1_T_PRF
|
|
+#endif
|
|
+
|
|
+#if defined(CONFIG_DES)
|
|
+#define CRYPTO_MBEDTLS_DES_ENCRYPT
|
|
+#endif /* des_encrypt() */
|
|
+
|
|
+#if !defined(CONFIG_NO_PBKDF2)
|
|
+#define CRYPTO_MBEDTLS_PBKDF2_SHA1
|
|
+#endif /* pbkdf2_sha1() */
|
|
+
|
|
+#if defined(EAP_IKEV2) \
|
|
+ || defined(EAP_IKEV2_DYNAMIC) \
|
|
+ || defined(EAP_SERVER_IKEV2) /* CONFIG_EAP_IKEV2=y */
|
|
+#define CRYPTO_MBEDTLS_CRYPTO_CIPHER
|
|
+#endif /* crypto_cipher_*() */
|
|
+
|
|
+#if defined(EAP_PWD) || defined(EAP_SERVER_PWD) /* CONFIG_EAP_PWD=y */
|
|
+#define CRYPTO_MBEDTLS_CRYPTO_HASH
|
|
+#endif /* crypto_hash_*() */
|
|
+
|
|
+#if defined(EAP_PWD) || defined(EAP_SERVER_PWD) /* CONFIG_EAP_PWD=y */ \
|
|
+ || defined(CONFIG_SAE) /* CONFIG_SAE=y */
|
|
+#define CRYPTO_MBEDTLS_CRYPTO_BIGNUM
|
|
+#endif /* crypto_bignum_*() */
|
|
+
|
|
+#if defined(EAP_PWD) /* CONFIG_EAP_PWD=y */ \
|
|
+ || defined(EAP_EKE) /* CONFIG_EAP_EKE=y */ \
|
|
+ || defined(EAP_EKE_DYNAMIC) /* CONFIG_EAP_EKE=y */ \
|
|
+ || defined(EAP_SERVER_EKE) /* CONFIG_EAP_EKE=y */ \
|
|
+ || defined(EAP_IKEV2) /* CONFIG_EAP_IKEV2y */ \
|
|
+ || defined(EAP_IKEV2_DYNAMIC)/* CONFIG_EAP_IKEV2=y */ \
|
|
+ || defined(EAP_SERVER_IKEV2) /* CONFIG_EAP_IKEV2=y */ \
|
|
+ || defined(CONFIG_SAE) /* CONFIG_SAE=y */ \
|
|
+ || defined(CONFIG_WPS) /* CONFIG_WPS=y */
|
|
+#define CRYPTO_MBEDTLS_CRYPTO_DH
|
|
+#if defined(CONFIG_WPS_NFC)
|
|
+#define CRYPTO_MBEDTLS_DH5_INIT_FIXED
|
|
+#endif /* dh5_init_fixed() */
|
|
+#endif /* crypto_dh_*() */
|
|
+
|
|
+#if !defined(CONFIG_NO_WPA) /* CONFIG_NO_WPA= */
|
|
+#define CRYPTO_MBEDTLS_CRYPTO_ECDH
|
|
+#endif /* crypto_ecdh_*() */
|
|
+
|
|
+#if defined(CONFIG_ECC)
|
|
+#define CRYPTO_MBEDTLS_CRYPTO_BIGNUM
|
|
+#define CRYPTO_MBEDTLS_CRYPTO_EC
|
|
+#endif /* crypto_ec_*() crypto_ec_key_*() */
|
|
+
|
|
+#if defined(CONFIG_DPP) /* CONFIG_DPP=y */
|
|
+#define CRYPTO_MBEDTLS_CRYPTO_EC_DPP /* extra for DPP */
|
|
+#define CRYPTO_MBEDTLS_CRYPTO_CSR
|
|
+#endif /* crypto_csr_*() */
|
|
+
|
|
+#if defined(CONFIG_DPP3) /* CONFIG_DPP3=y */
|
|
+#define CRYPTO_MBEDTLS_CRYPTO_HPKE
|
|
+#endif
|
|
+
|
|
+#if defined(CONFIG_DPP2) /* CONFIG_DPP2=y */
|
|
+#define CRYPTO_MBEDTLS_CRYPTO_PKCS7
|
|
+#endif /* crypto_pkcs7_*() */
|
|
+
|
|
+#if defined(EAP_SIM) || defined(EAP_SIM_DYNAMIC) || defined(EAP_SERVER_SIM) \
|
|
+ || defined(EAP_AKA) || defined(EAP_AKA_DYNAMIC) || defined(EAP_SERVER_AKA) \
|
|
+ || defined(CONFIG_AP) || defined(HOSTAPD)
|
|
+/* CONFIG_EAP_SIM=y CONFIG_EAP_AKA=y CONFIG_AP=y HOSTAPD */
|
|
+#if defined(CRYPTO_RSA_OAEP_SHA256)
|
|
+#define CRYPTO_MBEDTLS_CRYPTO_RSA
|
|
+#endif
|
|
+#endif /* crypto_rsa_*() */
|
|
+
|
|
+
|
|
+static int ctr_drbg_init_state;
|
|
+static mbedtls_ctr_drbg_context ctr_drbg;
|
|
+static mbedtls_entropy_context entropy;
|
|
+
|
|
+#ifdef CRYPTO_MBEDTLS_CRYPTO_BIGNUM
|
|
+#include <mbedtls/bignum.h>
|
|
+static mbedtls_mpi mpi_sw_A;
|
|
+#endif
|
|
+
|
|
+__attribute_cold__
|
|
+__attribute_noinline__
|
|
+static mbedtls_ctr_drbg_context * ctr_drbg_init(void)
|
|
+{
|
|
+ mbedtls_ctr_drbg_init(&ctr_drbg);
|
|
+ mbedtls_entropy_init(&entropy);
|
|
+ if (mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy,
|
|
+ NULL, 0)) {
|
|
+ wpa_printf(MSG_ERROR, "Init of random number generator failed");
|
|
+ /* XXX: abort? */
|
|
+ }
|
|
+ else
|
|
+ ctr_drbg_init_state = 1;
|
|
+
|
|
+ return &ctr_drbg;
|
|
+}
|
|
+
|
|
+__attribute_cold__
|
|
+void crypto_unload(void)
|
|
+{
|
|
+ if (ctr_drbg_init_state) {
|
|
+ mbedtls_ctr_drbg_free(&ctr_drbg);
|
|
+ mbedtls_entropy_free(&entropy);
|
|
+ #ifdef CRYPTO_MBEDTLS_CRYPTO_BIGNUM
|
|
+ mbedtls_mpi_free(&mpi_sw_A);
|
|
+ #endif
|
|
+ ctr_drbg_init_state = 0;
|
|
+ }
|
|
+}
|
|
+
|
|
+/* init ctr_drbg on first use
|
|
+ * crypto_global_init() and crypto_global_deinit() are not available here
|
|
+ * (available only when CONFIG_TLS=internal, which is not CONFIG_TLS=mbedtls) */
|
|
+mbedtls_ctr_drbg_context * crypto_mbedtls_ctr_drbg(void); /*(not in header)*/
|
|
+inline
|
|
+mbedtls_ctr_drbg_context * crypto_mbedtls_ctr_drbg(void)
|
|
+{
|
|
+ return ctr_drbg_init_state ? &ctr_drbg : ctr_drbg_init();
|
|
+}
|
|
+
|
|
+#ifdef CRYPTO_MBEDTLS_CONFIG_FIPS
|
|
+int crypto_get_random(void *buf, size_t len)
|
|
+{
|
|
+ return mbedtls_ctr_drbg_random(crypto_mbedtls_ctr_drbg(),buf,len) ? -1 : 0;
|
|
+}
|
|
+#endif
|
|
+
|
|
+
|
|
+#if 1
|
|
+
|
|
+/* tradeoff: slightly smaller code size here at cost of slight increase
|
|
+ * in instructions and function calls at runtime versus the expanded
|
|
+ * per-message-digest code that follows in #else (~0.5 kib .text larger) */
|
|
+
|
|
+__attribute_noinline__
|
|
+static int md_vector(size_t num_elem, const u8 *addr[], const size_t *len,
|
|
+ u8 *mac, mbedtls_md_type_t md_type)
|
|
+{
|
|
+ mbedtls_md_context_t ctx;
|
|
+ mbedtls_md_init(&ctx);
|
|
+ if (mbedtls_md_setup(&ctx, mbedtls_md_info_from_type(md_type), 0) != 0){
|
|
+ mbedtls_md_free(&ctx);
|
|
+ return -1;
|
|
+ }
|
|
+ mbedtls_md_starts(&ctx);
|
|
+ for (size_t i = 0; i < num_elem; ++i)
|
|
+ mbedtls_md_update(&ctx, addr[i], len[i]);
|
|
+ mbedtls_md_finish(&ctx, mac);
|
|
+ mbedtls_md_free(&ctx);
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+#ifdef MBEDTLS_SHA512_C
|
|
+int sha512_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
|
|
+{
|
|
+ return md_vector(num_elem, addr, len, mac, MBEDTLS_MD_SHA512);
|
|
+}
|
|
+
|
|
+int sha384_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
|
|
+{
|
|
+ return md_vector(num_elem, addr, len, mac, MBEDTLS_MD_SHA384);
|
|
+}
|
|
+#endif
|
|
+
|
|
+#ifdef MBEDTLS_SHA256_C
|
|
+int sha256_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
|
|
+{
|
|
+ return md_vector(num_elem, addr, len, mac, MBEDTLS_MD_SHA256);
|
|
+}
|
|
+#endif
|
|
+
|
|
+#ifdef MBEDTLS_SHA1_C
|
|
+int sha1_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
|
|
+{
|
|
+ return md_vector(num_elem, addr, len, mac, MBEDTLS_MD_SHA1);
|
|
+}
|
|
+#endif
|
|
+
|
|
+#ifdef MBEDTLS_MD5_C
|
|
+int md5_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
|
|
+{
|
|
+ return md_vector(num_elem, addr, len, mac, MBEDTLS_MD_MD5);
|
|
+}
|
|
+#endif
|
|
+
|
|
+#ifdef MBEDTLS_MD4_C
|
|
+#include <mbedtls/md4.h>
|
|
+int md4_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
|
|
+{
|
|
+ return md_vector(num_elem, addr, len, mac, MBEDTLS_MD_MD4);
|
|
+}
|
|
+#endif
|
|
+
|
|
+#else /* expanded per-message-digest functions */
|
|
+
|
|
+#ifdef MBEDTLS_SHA512_C
|
|
+#include <mbedtls/sha512.h>
|
|
+__attribute_noinline__
|
|
+static int sha384_512_vector(size_t num_elem, const u8 *addr[],
|
|
+ const size_t *len, u8 *mac, int is384)
|
|
+{
|
|
+ struct mbedtls_sha512_context ctx;
|
|
+ mbedtls_sha512_init(&ctx);
|
|
+ #if MBEDTLS_VERSION_MAJOR >= 3
|
|
+ mbedtls_sha512_starts(&ctx, is384);
|
|
+ for (size_t i = 0; i < num_elem; ++i)
|
|
+ mbedtls_sha512_update(&ctx, addr[i], len[i]);
|
|
+ mbedtls_sha512_finish(&ctx, mac);
|
|
+ #else
|
|
+ mbedtls_sha512_starts_ret(&ctx, is384);
|
|
+ for (size_t i = 0; i < num_elem; ++i)
|
|
+ mbedtls_sha512_update_ret(&ctx, addr[i], len[i]);
|
|
+ mbedtls_sha512_finish_ret(&ctx, mac);
|
|
+ #endif
|
|
+ mbedtls_sha512_free(&ctx);
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+int sha512_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
|
|
+{
|
|
+ return sha384_512_vector(num_elem, addr, len, mac, 0);
|
|
+}
|
|
+
|
|
+int sha384_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
|
|
+{
|
|
+ return sha384_512_vector(num_elem, addr, len, mac, 1);
|
|
+}
|
|
+#endif
|
|
+
|
|
+#ifdef MBEDTLS_SHA256_C
|
|
+#include <mbedtls/sha256.h>
|
|
+int sha256_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
|
|
+{
|
|
+ struct mbedtls_sha256_context ctx;
|
|
+ mbedtls_sha256_init(&ctx);
|
|
+ #if MBEDTLS_VERSION_MAJOR >= 3
|
|
+ mbedtls_sha256_starts(&ctx, 0);
|
|
+ for (size_t i = 0; i < num_elem; ++i)
|
|
+ mbedtls_sha256_update(&ctx, addr[i], len[i]);
|
|
+ mbedtls_sha256_finish(&ctx, mac);
|
|
+ #else
|
|
+ mbedtls_sha256_starts_ret(&ctx, 0);
|
|
+ for (size_t i = 0; i < num_elem; ++i)
|
|
+ mbedtls_sha256_update_ret(&ctx, addr[i], len[i]);
|
|
+ mbedtls_sha256_finish_ret(&ctx, mac);
|
|
+ #endif
|
|
+ mbedtls_sha256_free(&ctx);
|
|
+ return 0;
|
|
+}
|
|
+#endif
|
|
+
|
|
+#ifdef MBEDTLS_SHA1_C
|
|
+#include <mbedtls/sha1.h>
|
|
+int sha1_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
|
|
+{
|
|
+ struct mbedtls_sha1_context ctx;
|
|
+ mbedtls_sha1_init(&ctx);
|
|
+ #if MBEDTLS_VERSION_MAJOR >= 3
|
|
+ mbedtls_sha1_starts(&ctx);
|
|
+ for (size_t i = 0; i < num_elem; ++i)
|
|
+ mbedtls_sha1_update(&ctx, addr[i], len[i]);
|
|
+ mbedtls_sha1_finish(&ctx, mac);
|
|
+ #else
|
|
+ mbedtls_sha1_starts_ret(&ctx);
|
|
+ for (size_t i = 0; i < num_elem; ++i)
|
|
+ mbedtls_sha1_update_ret(&ctx, addr[i], len[i]);
|
|
+ mbedtls_sha1_finish_ret(&ctx, mac);
|
|
+ #endif
|
|
+ mbedtls_sha1_free(&ctx);
|
|
+ return 0;
|
|
+}
|
|
+#endif
|
|
+
|
|
+#ifdef MBEDTLS_MD5_C
|
|
+#include <mbedtls/md5.h>
|
|
+int md5_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
|
|
+{
|
|
+ struct mbedtls_md5_context ctx;
|
|
+ mbedtls_md5_init(&ctx);
|
|
+ #if MBEDTLS_VERSION_MAJOR >= 3
|
|
+ mbedtls_md5_starts(&ctx);
|
|
+ for (size_t i = 0; i < num_elem; ++i)
|
|
+ mbedtls_md5_update(&ctx, addr[i], len[i]);
|
|
+ mbedtls_md5_finish(&ctx, mac);
|
|
+ #else
|
|
+ mbedtls_md5_starts_ret(&ctx);
|
|
+ for (size_t i = 0; i < num_elem; ++i)
|
|
+ mbedtls_md5_update_ret(&ctx, addr[i], len[i]);
|
|
+ mbedtls_md5_finish_ret(&ctx, mac);
|
|
+ #endif
|
|
+ mbedtls_md5_free(&ctx);
|
|
+ return 0;
|
|
+}
|
|
+#endif
|
|
+
|
|
+#ifdef MBEDTLS_MD4_C
|
|
+#include <mbedtls/md4.h>
|
|
+int md4_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
|
|
+{
|
|
+ struct mbedtls_md4_context ctx;
|
|
+ mbedtls_md4_init(&ctx);
|
|
+ mbedtls_md4_starts_ret(&ctx);
|
|
+ for (size_t i = 0; i < num_elem; ++i)
|
|
+ mbedtls_md4_update_ret(&ctx, addr[i], len[i]);
|
|
+ mbedtls_md4_finish_ret(&ctx, mac);
|
|
+ mbedtls_md4_free(&ctx);
|
|
+ return 0;
|
|
+}
|
|
+#endif
|
|
+
|
|
+#endif /* expanded per-message-digest functions */
|
|
+
|
|
+
|
|
+__attribute_noinline__
|
|
+static int hmac_vector(const u8 *key, size_t key_len, size_t num_elem,
|
|
+ const u8 *addr[], const size_t *len, u8 *mac,
|
|
+ mbedtls_md_type_t md_type)
|
|
+{
|
|
+ mbedtls_md_context_t ctx;
|
|
+ mbedtls_md_init(&ctx);
|
|
+ if (mbedtls_md_setup(&ctx, mbedtls_md_info_from_type(md_type), 1) != 0){
|
|
+ mbedtls_md_free(&ctx);
|
|
+ return -1;
|
|
+ }
|
|
+ mbedtls_md_hmac_starts(&ctx, key, key_len);
|
|
+ for (size_t i = 0; i < num_elem; ++i)
|
|
+ mbedtls_md_hmac_update(&ctx, addr[i], len[i]);
|
|
+ mbedtls_md_hmac_finish(&ctx, mac);
|
|
+ mbedtls_md_free(&ctx);
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+#ifdef MBEDTLS_SHA512_C
|
|
+int hmac_sha512_vector(const u8 *key, size_t key_len, size_t num_elem,
|
|
+ const u8 *addr[], const size_t *len, u8 *mac)
|
|
+{
|
|
+ return hmac_vector(key, key_len, num_elem, addr, len, mac,
|
|
+ MBEDTLS_MD_SHA512);
|
|
+}
|
|
+
|
|
+int hmac_sha512(const u8 *key, size_t key_len, const u8 *data, size_t data_len,
|
|
+ u8 *mac)
|
|
+{
|
|
+ return hmac_vector(key, key_len, 1, &data, &data_len, mac,
|
|
+ MBEDTLS_MD_SHA512);
|
|
+}
|
|
+
|
|
+int hmac_sha384_vector(const u8 *key, size_t key_len, size_t num_elem,
|
|
+ const u8 *addr[], const size_t *len, u8 *mac)
|
|
+{
|
|
+ return hmac_vector(key, key_len, num_elem, addr, len, mac,
|
|
+ MBEDTLS_MD_SHA384);
|
|
+}
|
|
+
|
|
+int hmac_sha384(const u8 *key, size_t key_len, const u8 *data, size_t data_len,
|
|
+ u8 *mac)
|
|
+{
|
|
+ return hmac_vector(key, key_len, 1, &data, &data_len, mac,
|
|
+ MBEDTLS_MD_SHA384);
|
|
+}
|
|
+#endif
|
|
+
|
|
+#ifdef MBEDTLS_SHA256_C
|
|
+int hmac_sha256_vector(const u8 *key, size_t key_len, size_t num_elem,
|
|
+ const u8 *addr[], const size_t *len, u8 *mac)
|
|
+{
|
|
+ return hmac_vector(key, key_len, num_elem, addr, len, mac,
|
|
+ MBEDTLS_MD_SHA256);
|
|
+}
|
|
+
|
|
+int hmac_sha256(const u8 *key, size_t key_len, const u8 *data, size_t data_len,
|
|
+ u8 *mac)
|
|
+{
|
|
+ return hmac_vector(key, key_len, 1, &data, &data_len, mac,
|
|
+ MBEDTLS_MD_SHA256);
|
|
+}
|
|
+#endif
|
|
+
|
|
+#ifdef MBEDTLS_SHA1_C
|
|
+int hmac_sha1_vector(const u8 *key, size_t key_len, size_t num_elem,
|
|
+ const u8 *addr[], const size_t *len, u8 *mac)
|
|
+{
|
|
+ return hmac_vector(key, key_len, num_elem, addr, len, mac,
|
|
+ MBEDTLS_MD_SHA1);
|
|
+}
|
|
+
|
|
+int hmac_sha1(const u8 *key, size_t key_len, const u8 *data, size_t data_len,
|
|
+ u8 *mac)
|
|
+{
|
|
+ return hmac_vector(key, key_len, 1, &data, &data_len, mac,
|
|
+ MBEDTLS_MD_SHA1);
|
|
+}
|
|
+#endif
|
|
+
|
|
+#ifdef MBEDTLS_MD5_C
|
|
+int hmac_md5_vector(const u8 *key, size_t key_len, size_t num_elem,
|
|
+ const u8 *addr[], const size_t *len, u8 *mac)
|
|
+{
|
|
+ return hmac_vector(key, key_len, num_elem, addr, len, mac,
|
|
+ MBEDTLS_MD_MD5);
|
|
+}
|
|
+
|
|
+int hmac_md5(const u8 *key, size_t key_len, const u8 *data, size_t data_len,
|
|
+ u8 *mac)
|
|
+{
|
|
+ return hmac_vector(key, key_len, 1, &data, &data_len, mac,
|
|
+ MBEDTLS_MD_MD5);
|
|
+}
|
|
+#endif
|
|
+
|
|
+
|
|
+#if defined(MBEDTLS_SHA256_C) || defined(MBEDTLS_SHA512_C)
|
|
+
|
|
+#if defined(CRYPTO_MBEDTLS_HMAC_KDF_SHA256) \
|
|
+ || defined(CRYPTO_MBEDTLS_HMAC_KDF_SHA384) \
|
|
+ || defined(CRYPTO_MBEDTLS_HMAC_KDF_SHA512)
|
|
+
|
|
+#include <mbedtls/hkdf.h>
|
|
+
|
|
+/* sha256-kdf.c sha384-kdf.c sha512-kdf.c */
|
|
+
|
|
+/* HMAC-SHA256 KDF (RFC 5295) and HKDF-Expand(SHA256) (RFC 5869) */
|
|
+/* HMAC-SHA384 KDF (RFC 5295) and HKDF-Expand(SHA384) (RFC 5869) */
|
|
+/* HMAC-SHA512 KDF (RFC 5295) and HKDF-Expand(SHA512) (RFC 5869) */
|
|
+__attribute_noinline__
|
|
+static int hmac_kdf_expand(const u8 *prk, size_t prk_len,
|
|
+ const char *label, const u8 *info, size_t info_len,
|
|
+ u8 *okm, size_t okm_len, mbedtls_md_type_t md_type)
|
|
+{
|
|
+ const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type(md_type);
|
|
+ #ifdef MBEDTLS_HKDF_C
|
|
+ if (label == NULL) /* RFC 5869 HKDF-Expand when (label == NULL) */
|
|
+ return mbedtls_hkdf_expand(md_info, prk, prk_len, info,
|
|
+ info_len, okm, okm_len) ? -1 : 0;
|
|
+ #endif
|
|
+
|
|
+ const size_t mac_len = mbedtls_md_get_size(md_info);
|
|
+ /* okm_len must not exceed 255 times hash len (RFC 5869 Section 2.3) */
|
|
+ if (okm_len > ((mac_len << 8) - mac_len))
|
|
+ return -1;
|
|
+
|
|
+ mbedtls_md_context_t ctx;
|
|
+ mbedtls_md_init(&ctx);
|
|
+ if (mbedtls_md_setup(&ctx, md_info, 1) != 0) {
|
|
+ mbedtls_md_free(&ctx);
|
|
+ return -1;
|
|
+ }
|
|
+ mbedtls_md_hmac_starts(&ctx, prk, prk_len);
|
|
+
|
|
+ u8 iter = 1;
|
|
+ const u8 *addr[4] = { okm, (const u8 *)label, info, &iter };
|
|
+ size_t len[4] = { 0, label ? os_strlen(label)+1 : 0, info_len, 1 };
|
|
+
|
|
+ for (; okm_len >= mac_len; okm_len -= mac_len, ++iter) {
|
|
+ for (size_t i = 0; i < ARRAY_SIZE(addr); ++i)
|
|
+ mbedtls_md_hmac_update(&ctx, addr[i], len[i]);
|
|
+ mbedtls_md_hmac_finish(&ctx, okm);
|
|
+ mbedtls_md_hmac_reset(&ctx);
|
|
+ addr[0] = okm;
|
|
+ okm += mac_len;
|
|
+ len[0] = mac_len; /*(include digest in subsequent rounds)*/
|
|
+ }
|
|
+
|
|
+ if (okm_len) {
|
|
+ u8 hash[MBEDTLS_MD_MAX_SIZE];
|
|
+ for (size_t i = 0; i < ARRAY_SIZE(addr); ++i)
|
|
+ mbedtls_md_hmac_update(&ctx, addr[i], len[i]);
|
|
+ mbedtls_md_hmac_finish(&ctx, hash);
|
|
+ os_memcpy(okm, hash, okm_len);
|
|
+ forced_memzero(hash, mac_len);
|
|
+ }
|
|
+
|
|
+ mbedtls_md_free(&ctx);
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+#ifdef MBEDTLS_SHA512_C
|
|
+#ifdef CRYPTO_MBEDTLS_HMAC_KDF_SHA512
|
|
+int hmac_sha512_kdf(const u8 *secret, size_t secret_len,
|
|
+ const char *label, const u8 *seed, size_t seed_len,
|
|
+ u8 *out, size_t outlen)
|
|
+{
|
|
+ return hmac_kdf_expand(secret, secret_len, label, seed, seed_len,
|
|
+ out, outlen, MBEDTLS_MD_SHA512);
|
|
+}
|
|
+#endif
|
|
+
|
|
+#ifdef CRYPTO_MBEDTLS_HMAC_KDF_SHA384
|
|
+int hmac_sha384_kdf(const u8 *secret, size_t secret_len,
|
|
+ const char *label, const u8 *seed, size_t seed_len,
|
|
+ u8 *out, size_t outlen)
|
|
+{
|
|
+ return hmac_kdf_expand(secret, secret_len, label, seed, seed_len,
|
|
+ out, outlen, MBEDTLS_MD_SHA384);
|
|
+}
|
|
+#endif
|
|
+#endif
|
|
+
|
|
+#ifdef MBEDTLS_SHA256_C
|
|
+#ifdef CRYPTO_MBEDTLS_HMAC_KDF_SHA256
|
|
+int hmac_sha256_kdf(const u8 *secret, size_t secret_len,
|
|
+ const char *label, const u8 *seed, size_t seed_len,
|
|
+ u8 *out, size_t outlen)
|
|
+{
|
|
+ return hmac_kdf_expand(secret, secret_len, label, seed, seed_len,
|
|
+ out, outlen, MBEDTLS_MD_SHA256);
|
|
+}
|
|
+#endif
|
|
+#endif
|
|
+
|
|
+#endif /* CRYPTO_MBEDTLS_HMAC_KDF_* */
|
|
+
|
|
+
|
|
+/* sha256-prf.c sha384-prf.c sha512-prf.c */
|
|
+
|
|
+/* hmac_prf_bits - IEEE Std 802.11ac-2013, 11.6.1.7.2 Key derivation function */
|
|
+__attribute_noinline__
|
|
+static int hmac_prf_bits(const u8 *key, size_t key_len, const char *label,
|
|
+ const u8 *data, size_t data_len, u8 *buf,
|
|
+ size_t buf_len_bits, mbedtls_md_type_t md_type)
|
|
+{
|
|
+ mbedtls_md_context_t ctx;
|
|
+ mbedtls_md_init(&ctx);
|
|
+ const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type(md_type);
|
|
+ if (mbedtls_md_setup(&ctx, md_info, 1) != 0) {
|
|
+ mbedtls_md_free(&ctx);
|
|
+ return -1;
|
|
+ }
|
|
+ mbedtls_md_hmac_starts(&ctx, key, key_len);
|
|
+
|
|
+ u16 ctr, n_le = host_to_le16(buf_len_bits);
|
|
+ const u8 * const addr[] = { (u8 *)&ctr,(u8 *)label,data,(u8 *)&n_le };
|
|
+ const size_t len[] = { 2, os_strlen(label), data_len, 2 };
|
|
+ const size_t mac_len = mbedtls_md_get_size(md_info);
|
|
+ size_t buf_len = (buf_len_bits + 7) / 8;
|
|
+ for (ctr = 1; buf_len >= mac_len; buf_len -= mac_len, ++ctr) {
|
|
+ #if __BYTE_ORDER == __BIG_ENDIAN
|
|
+ ctr = host_to_le16(ctr);
|
|
+ #endif
|
|
+ for (size_t i = 0; i < ARRAY_SIZE(addr); ++i)
|
|
+ mbedtls_md_hmac_update(&ctx, addr[i], len[i]);
|
|
+ mbedtls_md_hmac_finish(&ctx, buf);
|
|
+ mbedtls_md_hmac_reset(&ctx);
|
|
+ buf += mac_len;
|
|
+ #if __BYTE_ORDER == __BIG_ENDIAN
|
|
+ ctr = le_to_host16(ctr);
|
|
+ #endif
|
|
+ }
|
|
+
|
|
+ if (buf_len) {
|
|
+ u8 hash[MBEDTLS_MD_MAX_SIZE];
|
|
+ #if __BYTE_ORDER == __BIG_ENDIAN
|
|
+ ctr = host_to_le16(ctr);
|
|
+ #endif
|
|
+ for (size_t i = 0; i < ARRAY_SIZE(addr); ++i)
|
|
+ mbedtls_md_hmac_update(&ctx, addr[i], len[i]);
|
|
+ mbedtls_md_hmac_finish(&ctx, hash);
|
|
+ os_memcpy(buf, hash, buf_len);
|
|
+ buf += buf_len;
|
|
+ forced_memzero(hash, mac_len);
|
|
+ }
|
|
+
|
|
+ /* Mask out unused bits in last octet if it does not use all the bits */
|
|
+ if ((buf_len_bits &= 0x7))
|
|
+ buf[-1] &= (u8)(0xff << (8 - buf_len_bits));
|
|
+
|
|
+ mbedtls_md_free(&ctx);
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+#ifdef MBEDTLS_SHA512_C
|
|
+int sha512_prf(const u8 *key, size_t key_len, const char *label,
|
|
+ const u8 *data, size_t data_len, u8 *buf, size_t buf_len)
|
|
+{
|
|
+ return hmac_prf_bits(key, key_len, label, data, data_len, buf,
|
|
+ buf_len * 8, MBEDTLS_MD_SHA512);
|
|
+}
|
|
+
|
|
+int sha384_prf(const u8 *key, size_t key_len, const char *label,
|
|
+ const u8 *data, size_t data_len, u8 *buf, size_t buf_len)
|
|
+{
|
|
+ return hmac_prf_bits(key, key_len, label, data, data_len, buf,
|
|
+ buf_len * 8, MBEDTLS_MD_SHA384);
|
|
+}
|
|
+#endif
|
|
+
|
|
+#ifdef MBEDTLS_SHA256_C
|
|
+int sha256_prf(const u8 *key, size_t key_len, const char *label,
|
|
+ const u8 *data, size_t data_len, u8 *buf, size_t buf_len)
|
|
+{
|
|
+ return hmac_prf_bits(key, key_len, label, data, data_len, buf,
|
|
+ buf_len * 8, MBEDTLS_MD_SHA256);
|
|
+}
|
|
+
|
|
+int sha256_prf_bits(const u8 *key, size_t key_len, const char *label,
|
|
+ const u8 *data, size_t data_len, u8 *buf,
|
|
+ size_t buf_len_bits)
|
|
+{
|
|
+ return hmac_prf_bits(key, key_len, label, data, data_len, buf,
|
|
+ buf_len_bits, MBEDTLS_MD_SHA256);
|
|
+}
|
|
+#endif
|
|
+
|
|
+#endif /* MBEDTLS_SHA256_C || MBEDTLS_SHA512_C */
|
|
+
|
|
+
|
|
+#ifdef MBEDTLS_SHA1_C
|
|
+
|
|
+/* sha1-prf.c */
|
|
+
|
|
+/* sha1_prf - SHA1-based Pseudo-Random Function (PRF) (IEEE 802.11i, 8.5.1.1) */
|
|
+
|
|
+int sha1_prf(const u8 *key, size_t key_len, const char *label,
|
|
+ const u8 *data, size_t data_len, u8 *buf, size_t buf_len)
|
|
+{
|
|
+ /*(note: algorithm differs from hmac_prf_bits() */
|
|
+ /*(note: smaller code size instead of expanding hmac_sha1_vector()
|
|
+ * as is done in hmac_prf_bits(); not expecting large num of loops) */
|
|
+ u8 counter = 0;
|
|
+ const u8 *addr[] = { (u8 *)label, data, &counter };
|
|
+ const size_t len[] = { os_strlen(label)+1, data_len, 1 };
|
|
+
|
|
+ for (; buf_len >= SHA1_MAC_LEN; buf_len -= SHA1_MAC_LEN, ++counter) {
|
|
+ if (hmac_sha1_vector(key, key_len, 3, addr, len, buf))
|
|
+ return -1;
|
|
+ buf += SHA1_MAC_LEN;
|
|
+ }
|
|
+
|
|
+ if (buf_len) {
|
|
+ u8 hash[SHA1_MAC_LEN];
|
|
+ if (hmac_sha1_vector(key, key_len, 3, addr, len, hash))
|
|
+ return -1;
|
|
+ os_memcpy(buf, hash, buf_len);
|
|
+ forced_memzero(hash, sizeof(hash));
|
|
+ }
|
|
+
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+#ifdef CRYPTO_MBEDTLS_SHA1_T_PRF
|
|
+
|
|
+/* sha1-tprf.c */
|
|
+
|
|
+/* sha1_t_prf - EAP-FAST Pseudo-Random Function (T-PRF) (RFC 4851,Section 5.5)*/
|
|
+
|
|
+int sha1_t_prf(const u8 *key, size_t key_len, const char *label,
|
|
+ const u8 *seed, size_t seed_len, u8 *buf, size_t buf_len)
|
|
+{
|
|
+ /*(note: algorithm differs from hmac_prf_bits() and hmac_kdf() above)*/
|
|
+ /*(note: smaller code size instead of expanding hmac_sha1_vector()
|
|
+ * as is done in hmac_prf_bits(); not expecting large num of loops) */
|
|
+ u8 ctr;
|
|
+ u16 olen = host_to_be16(buf_len);
|
|
+ const u8 *addr[] = { buf, (u8 *)label, seed, (u8 *)&olen, &ctr };
|
|
+ size_t len[] = { 0, os_strlen(label)+1, seed_len, 2, 1 };
|
|
+
|
|
+ for (ctr = 1; buf_len >= SHA1_MAC_LEN; buf_len -= SHA1_MAC_LEN, ++ctr) {
|
|
+ if (hmac_sha1_vector(key, key_len, 5, addr, len, buf))
|
|
+ return -1;
|
|
+ addr[0] = buf;
|
|
+ buf += SHA1_MAC_LEN;
|
|
+ len[0] = SHA1_MAC_LEN; /*(include digest in subsequent rounds)*/
|
|
+ }
|
|
+
|
|
+ if (buf_len) {
|
|
+ u8 hash[SHA1_MAC_LEN];
|
|
+ if (hmac_sha1_vector(key, key_len, 5, addr, len, hash))
|
|
+ return -1;
|
|
+ os_memcpy(buf, hash, buf_len);
|
|
+ forced_memzero(hash, sizeof(hash));
|
|
+ }
|
|
+
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+#endif /* CRYPTO_MBEDTLS_SHA1_T_PRF */
|
|
+
|
|
+#endif /* MBEDTLS_SHA1_C */
|
|
+
|
|
+
|
|
+#ifdef CRYPTO_MBEDTLS_DES_ENCRYPT
|
|
+#ifdef MBEDTLS_DES_C
|
|
+#include <mbedtls/des.h>
|
|
+int des_encrypt(const u8 *clear, const u8 *key, u8 *cypher)
|
|
+{
|
|
+ u8 pkey[8], next, tmp;
|
|
+ int i;
|
|
+
|
|
+ /* Add parity bits to the key */
|
|
+ next = 0;
|
|
+ for (i = 0; i < 7; i++) {
|
|
+ tmp = key[i];
|
|
+ pkey[i] = (tmp >> i) | next | 1;
|
|
+ next = tmp << (7 - i);
|
|
+ }
|
|
+ pkey[i] = next | 1;
|
|
+
|
|
+ mbedtls_des_context des;
|
|
+ mbedtls_des_init(&des);
|
|
+ int ret = mbedtls_des_setkey_enc(&des, pkey)
|
|
+ || mbedtls_des_crypt_ecb(&des, clear, cypher) ? -1 : 0;
|
|
+ mbedtls_des_free(&des);
|
|
+ return ret;
|
|
+}
|
|
+#else
|
|
+#include "des-internal.c"/* pull in hostap local implementation */
|
|
+#endif
|
|
+#endif
|
|
+
|
|
+
|
|
+#ifdef CRYPTO_MBEDTLS_PBKDF2_SHA1
|
|
+/* sha1-pbkdf2.c */
|
|
+#include <mbedtls/pkcs5.h>
|
|
+int pbkdf2_sha1(const char *passphrase, const u8 *ssid, size_t ssid_len,
|
|
+ int iterations, u8 *buf, size_t buflen)
|
|
+{
|
|
+ #if MBEDTLS_VERSION_NUMBER >= 0x03020200 /* mbedtls 3.2.2 */
|
|
+ return mbedtls_pkcs5_pbkdf2_hmac_ext(MBEDTLS_MD_SHA1,
|
|
+ (const u8 *)passphrase, os_strlen(passphrase),
|
|
+ ssid, ssid_len, iterations, 32, buf) ? -1 : 0;
|
|
+ #else
|
|
+ const mbedtls_md_info_t *md_info;
|
|
+ md_info = mbedtls_md_info_from_type(MBEDTLS_MD_SHA1);
|
|
+ if (md_info == NULL)
|
|
+ return -1;
|
|
+ mbedtls_md_context_t ctx;
|
|
+ mbedtls_md_init(&ctx);
|
|
+ int ret = mbedtls_md_setup(&ctx, md_info, 1)
|
|
+ || mbedtls_pkcs5_pbkdf2_hmac(&ctx,
|
|
+ (const u8 *)passphrase, os_strlen(passphrase),
|
|
+ ssid, ssid_len, iterations, 32, buf) ? -1 : 0;
|
|
+ mbedtls_md_free(&ctx);
|
|
+ return ret;
|
|
+ #endif
|
|
+}
|
|
+#endif
|
|
+
|
|
+
|
|
+/*#include "aes.h"*/ /* prototypes also included in "crypto.h" */
|
|
+
|
|
+static void *aes_crypt_init_mode(const u8 *key, size_t len, int mode)
|
|
+{
|
|
+ mbedtls_aes_context *aes = os_malloc(sizeof(*aes));
|
|
+ if (!aes)
|
|
+ return NULL;
|
|
+
|
|
+ mbedtls_aes_init(aes);
|
|
+ if ((mode == MBEDTLS_AES_ENCRYPT
|
|
+ ? mbedtls_aes_setkey_enc(aes, key, len * 8)
|
|
+ : mbedtls_aes_setkey_dec(aes, key, len * 8)) == 0)
|
|
+ return aes;
|
|
+
|
|
+ mbedtls_aes_free(aes);
|
|
+ os_free(aes);
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+void *aes_encrypt_init(const u8 *key, size_t len)
|
|
+{
|
|
+ return aes_crypt_init_mode(key, len, MBEDTLS_AES_ENCRYPT);
|
|
+}
|
|
+
|
|
+int aes_encrypt(void *ctx, const u8 *plain, u8 *crypt)
|
|
+{
|
|
+ return mbedtls_aes_crypt_ecb(ctx, MBEDTLS_AES_ENCRYPT, plain, crypt);
|
|
+}
|
|
+
|
|
+void aes_encrypt_deinit(void *ctx)
|
|
+{
|
|
+ mbedtls_aes_free(ctx);
|
|
+ os_free(ctx);
|
|
+}
|
|
+
|
|
+void *aes_decrypt_init(const u8 *key, size_t len)
|
|
+{
|
|
+ return aes_crypt_init_mode(key, len, MBEDTLS_AES_DECRYPT);
|
|
+}
|
|
+
|
|
+int aes_decrypt(void *ctx, const u8 *crypt, u8 *plain)
|
|
+{
|
|
+ return mbedtls_aes_crypt_ecb(ctx, MBEDTLS_AES_DECRYPT, crypt, plain);
|
|
+}
|
|
+
|
|
+void aes_decrypt_deinit(void *ctx)
|
|
+{
|
|
+ mbedtls_aes_free(ctx);
|
|
+ os_free(ctx);
|
|
+}
|
|
+
|
|
+
|
|
+#include "aes_wrap.h"
|
|
+
|
|
+
|
|
+#ifdef MBEDTLS_NIST_KW_C
|
|
+
|
|
+#include <mbedtls/nist_kw.h>
|
|
+
|
|
+/* aes-wrap.c */
|
|
+int aes_wrap(const u8 *kek, size_t kek_len, int n, const u8 *plain, u8 *cipher)
|
|
+{
|
|
+ mbedtls_nist_kw_context ctx;
|
|
+ mbedtls_nist_kw_init(&ctx);
|
|
+ size_t olen;
|
|
+ int ret = mbedtls_nist_kw_setkey(&ctx, MBEDTLS_CIPHER_ID_AES,
|
|
+ kek, kek_len*8, 1)
|
|
+ || mbedtls_nist_kw_wrap(&ctx, MBEDTLS_KW_MODE_KW, plain, n*8,
|
|
+ cipher, &olen, (n+1)*8) ? -1 : 0;
|
|
+ mbedtls_nist_kw_free(&ctx);
|
|
+ return ret;
|
|
+}
|
|
+
|
|
+/* aes-unwrap.c */
|
|
+int aes_unwrap(const u8 *kek, size_t kek_len, int n, const u8 *cipher, u8 *plain)
|
|
+{
|
|
+ mbedtls_nist_kw_context ctx;
|
|
+ mbedtls_nist_kw_init(&ctx);
|
|
+ size_t olen;
|
|
+ int ret = mbedtls_nist_kw_setkey(&ctx, MBEDTLS_CIPHER_ID_AES,
|
|
+ kek, kek_len*8, 0)
|
|
+ || mbedtls_nist_kw_unwrap(&ctx, MBEDTLS_KW_MODE_KW, cipher,
|
|
+ (n+1)*8, plain, &olen, n*8) ? -1 : 0;
|
|
+ mbedtls_nist_kw_free(&ctx);
|
|
+ return ret;
|
|
+}
|
|
+
|
|
+#else
|
|
+
|
|
+#ifndef CRYPTO_MBEDTLS_CONFIG_FIPS
|
|
+#include "aes-wrap.c" /* pull in hostap local implementation */
|
|
+#include "aes-unwrap.c" /* pull in hostap local implementation */
|
|
+#endif
|
|
+
|
|
+#endif /* MBEDTLS_NIST_KW_C */
|
|
+
|
|
+
|
|
+#ifdef MBEDTLS_CMAC_C
|
|
+
|
|
+/* aes-omac1.c */
|
|
+
|
|
+#include <mbedtls/cmac.h>
|
|
+
|
|
+int omac1_aes_vector(
|
|
+ const u8 *key, size_t key_len, size_t num_elem, const u8 *addr[],
|
|
+ const size_t *len, u8 *mac)
|
|
+{
|
|
+ mbedtls_cipher_type_t cipher_type;
|
|
+ switch (key_len) {
|
|
+ case 16: cipher_type = MBEDTLS_CIPHER_AES_128_ECB; break;
|
|
+ case 24: cipher_type = MBEDTLS_CIPHER_AES_192_ECB; break;
|
|
+ case 32: cipher_type = MBEDTLS_CIPHER_AES_256_ECB; break;
|
|
+ default: return -1;
|
|
+ }
|
|
+ const mbedtls_cipher_info_t *cipher_info;
|
|
+ cipher_info = mbedtls_cipher_info_from_type(cipher_type);
|
|
+ if (cipher_info == NULL)
|
|
+ return -1;
|
|
+
|
|
+ mbedtls_cipher_context_t ctx;
|
|
+ mbedtls_cipher_init(&ctx);
|
|
+ int ret = -1;
|
|
+ if (mbedtls_cipher_setup(&ctx, cipher_info) == 0
|
|
+ && mbedtls_cipher_cmac_starts(&ctx, key, key_len*8) == 0) {
|
|
+ ret = 0;
|
|
+ for (size_t i = 0; i < num_elem && ret == 0; ++i)
|
|
+ ret = mbedtls_cipher_cmac_update(&ctx, addr[i], len[i]);
|
|
+ }
|
|
+ if (ret == 0)
|
|
+ ret = mbedtls_cipher_cmac_finish(&ctx, mac);
|
|
+ mbedtls_cipher_free(&ctx);
|
|
+ return ret ? -1 : 0;
|
|
+}
|
|
+
|
|
+int omac1_aes_128_vector(const u8 *key, size_t num_elem,
|
|
+ const u8 *addr[], const size_t *len,
|
|
+ u8 *mac)
|
|
+{
|
|
+ return omac1_aes_vector(key, 16, num_elem, addr, len, mac);
|
|
+}
|
|
+
|
|
+int omac1_aes_128(const u8 *key, const u8 *data, size_t data_len, u8 *mac)
|
|
+{
|
|
+ return omac1_aes_vector(key, 16, 1, &data, &data_len, mac);
|
|
+}
|
|
+
|
|
+int omac1_aes_256(const u8 *key, const u8 *data, size_t data_len, u8 *mac)
|
|
+{
|
|
+ return omac1_aes_vector(key, 32, 1, &data, &data_len, mac);
|
|
+}
|
|
+
|
|
+#else
|
|
+
|
|
+#include "aes-omac1.c" /* pull in hostap local implementation */
|
|
+
|
|
+#ifndef MBEDTLS_AES_BLOCK_SIZE
|
|
+#define MBEDTLS_AES_BLOCK_SIZE 16
|
|
+#endif
|
|
+
|
|
+#endif /* MBEDTLS_CMAC_C */
|
|
+
|
|
+
|
|
+/* These interfaces can be inefficient when used in loops, as the overhead of
|
|
+ * initialization each call is large for each block input (e.g. 16 bytes) */
|
|
+
|
|
+
|
|
+/* aes-encblock.c */
|
|
+int aes_128_encrypt_block(const u8 *key, const u8 *in, u8 *out)
|
|
+{
|
|
+ mbedtls_aes_context aes;
|
|
+ mbedtls_aes_init(&aes);
|
|
+ int ret = mbedtls_aes_setkey_enc(&aes, key, 128)
|
|
+ || mbedtls_aes_crypt_ecb(&aes, MBEDTLS_AES_ENCRYPT, in, out)
|
|
+ ? -1
|
|
+ : 0;
|
|
+ mbedtls_aes_free(&aes);
|
|
+ return ret;
|
|
+}
|
|
+
|
|
+
|
|
+/* aes-ctr.c */
|
|
+int aes_ctr_encrypt(const u8 *key, size_t key_len, const u8 *nonce,
|
|
+ u8 *data, size_t data_len)
|
|
+{
|
|
+ unsigned char counter[MBEDTLS_AES_BLOCK_SIZE];
|
|
+ unsigned char stream_block[MBEDTLS_AES_BLOCK_SIZE];
|
|
+ os_memcpy(counter, nonce, MBEDTLS_AES_BLOCK_SIZE);/*(must be writable)*/
|
|
+
|
|
+ mbedtls_aes_context ctx;
|
|
+ mbedtls_aes_init(&ctx);
|
|
+ size_t nc_off = 0;
|
|
+ int ret = mbedtls_aes_setkey_enc(&ctx, key, key_len*8)
|
|
+ || mbedtls_aes_crypt_ctr(&ctx, data_len, &nc_off,
|
|
+ counter, stream_block,
|
|
+ data, data) ? -1 : 0;
|
|
+ forced_memzero(stream_block, sizeof(stream_block));
|
|
+ mbedtls_aes_free(&ctx);
|
|
+ return ret;
|
|
+}
|
|
+
|
|
+int aes_128_ctr_encrypt(const u8 *key, const u8 *nonce,
|
|
+ u8 *data, size_t data_len)
|
|
+{
|
|
+ return aes_ctr_encrypt(key, 16, nonce, data, data_len);
|
|
+}
|
|
+
|
|
+
|
|
+/* aes-cbc.c */
|
|
+static int aes_128_cbc_oper(const u8 *key, const u8 *iv,
|
|
+ u8 *data, size_t data_len, int mode)
|
|
+{
|
|
+ unsigned char ivec[MBEDTLS_AES_BLOCK_SIZE];
|
|
+ os_memcpy(ivec, iv, MBEDTLS_AES_BLOCK_SIZE); /*(must be writable)*/
|
|
+
|
|
+ mbedtls_aes_context ctx;
|
|
+ mbedtls_aes_init(&ctx);
|
|
+ int ret = (mode == MBEDTLS_AES_ENCRYPT
|
|
+ ? mbedtls_aes_setkey_enc(&ctx, key, 128)
|
|
+ : mbedtls_aes_setkey_dec(&ctx, key, 128))
|
|
+ || mbedtls_aes_crypt_cbc(&ctx, mode, data_len, ivec, data, data);
|
|
+ mbedtls_aes_free(&ctx);
|
|
+ return ret ? -1 : 0;
|
|
+}
|
|
+
|
|
+int aes_128_cbc_encrypt(const u8 *key, const u8 *iv, u8 *data, size_t data_len)
|
|
+{
|
|
+ return aes_128_cbc_oper(key, iv, data, data_len, MBEDTLS_AES_ENCRYPT);
|
|
+}
|
|
+
|
|
+int aes_128_cbc_decrypt(const u8 *key, const u8 *iv, u8 *data, size_t data_len)
|
|
+{
|
|
+ return aes_128_cbc_oper(key, iv, data, data_len, MBEDTLS_AES_DECRYPT);
|
|
+}
|
|
+
|
|
+
|
|
+/*
|
|
+ * Much of the following is documented in crypto.h as for CONFIG_TLS=internal
|
|
+ * but such comments are not accurate:
|
|
+ *
|
|
+ * "This function is only used with internal TLSv1 implementation
|
|
+ * (CONFIG_TLS=internal). If that is not used, the crypto wrapper does not need
|
|
+ * to implement this."
|
|
+ */
|
|
+
|
|
+
|
|
+#ifdef CRYPTO_MBEDTLS_CRYPTO_CIPHER
|
|
+
|
|
+#include <mbedtls/cipher.h>
|
|
+
|
|
+struct crypto_cipher
|
|
+{
|
|
+ mbedtls_cipher_context_t ctx_enc;
|
|
+ mbedtls_cipher_context_t ctx_dec;
|
|
+};
|
|
+
|
|
+struct crypto_cipher * crypto_cipher_init(enum crypto_cipher_alg alg,
|
|
+ const u8 *iv, const u8 *key,
|
|
+ size_t key_len)
|
|
+{
|
|
+ /* IKEv2 src/eap_common/ikev2_common.c:ikev2_{encr,decr}_encrypt()
|
|
+ * uses one of CRYPTO_CIPHER_ALG_AES or CRYPTO_CIPHER_ALG_3DES */
|
|
+
|
|
+ mbedtls_cipher_type_t cipher_type;
|
|
+ size_t iv_len;
|
|
+ switch (alg) {
|
|
+ #ifdef MBEDTLS_ARC4_C
|
|
+ #if 0
|
|
+ case CRYPTO_CIPHER_ALG_RC4:
|
|
+ cipher_type = MBEDTLS_CIPHER_ARC4_128;
|
|
+ iv_len = 0;
|
|
+ break;
|
|
+ #endif
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_AES_C
|
|
+ case CRYPTO_CIPHER_ALG_AES:
|
|
+ if (key_len == 16) cipher_type = MBEDTLS_CIPHER_AES_128_CTR;
|
|
+ if (key_len == 24) cipher_type = MBEDTLS_CIPHER_AES_192_CTR;
|
|
+ if (key_len == 32) cipher_type = MBEDTLS_CIPHER_AES_256_CTR;
|
|
+ iv_len = 16;
|
|
+ break;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_DES_C
|
|
+ case CRYPTO_CIPHER_ALG_3DES:
|
|
+ cipher_type = MBEDTLS_CIPHER_DES_EDE3_CBC;
|
|
+ iv_len = 8;
|
|
+ break;
|
|
+ #if 0
|
|
+ case CRYPTO_CIPHER_ALG_DES:
|
|
+ cipher_type = MBEDTLS_CIPHER_DES_CBC;
|
|
+ iv_len = 8;
|
|
+ break;
|
|
+ #endif
|
|
+ #endif
|
|
+ default:
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ const mbedtls_cipher_info_t *cipher_info;
|
|
+ cipher_info = mbedtls_cipher_info_from_type(cipher_type);
|
|
+ if (cipher_info == NULL)
|
|
+ return NULL;
|
|
+
|
|
+ key_len *= 8; /* key_bitlen */
|
|
+ #if 0 /*(were key_bitlen not already available)*/
|
|
+ #if MBEDTLS_VERSION_NUMBER >= 0x03010000 /* mbedtls 3.1.0 */
|
|
+ key_len = mbedtls_cipher_info_get_key_bitlen(cipher_info);
|
|
+ #else
|
|
+ key_len = cipher_info->MBEDTLS_PRIVATE(key_bitlen);
|
|
+ #endif
|
|
+ #endif
|
|
+
|
|
+ #if 0 /*(were iv_len not known above, would need MBEDTLS_PRIVATE(iv_size))*/
|
|
+ iv_len = cipher_info->MBEDTLS_PRIVATE(iv_size);
|
|
+ #endif
|
|
+
|
|
+ struct crypto_cipher *ctx = os_malloc(sizeof(*ctx));
|
|
+ if (!ctx)
|
|
+ return NULL;
|
|
+
|
|
+ mbedtls_cipher_init(&ctx->ctx_enc);
|
|
+ mbedtls_cipher_init(&ctx->ctx_dec);
|
|
+ if ( mbedtls_cipher_setup(&ctx->ctx_enc,cipher_info) == 0
|
|
+ && mbedtls_cipher_setup(&ctx->ctx_dec,cipher_info) == 0
|
|
+ && mbedtls_cipher_setkey(&ctx->ctx_enc,key,key_len,MBEDTLS_ENCRYPT) == 0
|
|
+ && mbedtls_cipher_setkey(&ctx->ctx_dec,key,key_len,MBEDTLS_DECRYPT) == 0
|
|
+ && mbedtls_cipher_set_iv(&ctx->ctx_enc,iv,iv_len) == 0
|
|
+ && mbedtls_cipher_set_iv(&ctx->ctx_dec,iv,iv_len) == 0
|
|
+ && mbedtls_cipher_reset(&ctx->ctx_enc) == 0
|
|
+ && mbedtls_cipher_reset(&ctx->ctx_dec) == 0) {
|
|
+ return ctx;
|
|
+ }
|
|
+
|
|
+ mbedtls_cipher_free(&ctx->ctx_enc);
|
|
+ mbedtls_cipher_free(&ctx->ctx_dec);
|
|
+ os_free(ctx);
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+int crypto_cipher_encrypt(struct crypto_cipher *ctx,
|
|
+ const u8 *plain, u8 *crypt, size_t len)
|
|
+{
|
|
+ size_t olen = 0; /*(poor interface above; unknown size of u8 *crypt)*/
|
|
+ return (mbedtls_cipher_update(&ctx->ctx_enc, plain, len, crypt, &olen)
|
|
+ || mbedtls_cipher_finish(&ctx->ctx_enc, crypt + olen, &olen)) ? -1 : 0;
|
|
+}
|
|
+
|
|
+int crypto_cipher_decrypt(struct crypto_cipher *ctx,
|
|
+ const u8 *crypt, u8 *plain, size_t len)
|
|
+{
|
|
+ size_t olen = 0; /*(poor interface above; unknown size of u8 *plain)*/
|
|
+ return (mbedtls_cipher_update(&ctx->ctx_dec, crypt, len, plain, &olen)
|
|
+ || mbedtls_cipher_finish(&ctx->ctx_dec, plain + olen, &olen)) ? -1 : 0;
|
|
+}
|
|
+
|
|
+void crypto_cipher_deinit(struct crypto_cipher *ctx)
|
|
+{
|
|
+ mbedtls_cipher_free(&ctx->ctx_enc);
|
|
+ mbedtls_cipher_free(&ctx->ctx_dec);
|
|
+ os_free(ctx);
|
|
+}
|
|
+
|
|
+#endif /* CRYPTO_MBEDTLS_CRYPTO_CIPHER */
|
|
+
|
|
+
|
|
+#ifdef CRYPTO_MBEDTLS_CRYPTO_HASH
|
|
+
|
|
+struct crypto_hash * crypto_hash_init(enum crypto_hash_alg alg, const u8 *key,
|
|
+ size_t key_len)
|
|
+{
|
|
+ mbedtls_md_type_t md_type;
|
|
+ int is_hmac = 0;
|
|
+
|
|
+ switch (alg) {
|
|
+ #ifdef MBEDTLS_MD5_C
|
|
+ case CRYPTO_HASH_ALG_MD5:
|
|
+ md_type = MBEDTLS_MD_MD5;
|
|
+ break;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_SHA1_C
|
|
+ case CRYPTO_HASH_ALG_SHA1:
|
|
+ md_type = MBEDTLS_MD_SHA1;
|
|
+ break;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_MD5_C
|
|
+ case CRYPTO_HASH_ALG_HMAC_MD5:
|
|
+ md_type = MBEDTLS_MD_MD5;
|
|
+ is_hmac = 1;
|
|
+ break;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_SHA1_C
|
|
+ case CRYPTO_HASH_ALG_HMAC_SHA1:
|
|
+ md_type = MBEDTLS_MD_SHA1;
|
|
+ is_hmac = 1;
|
|
+ break;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_SHA256_C
|
|
+ case CRYPTO_HASH_ALG_SHA256:
|
|
+ md_type = MBEDTLS_MD_SHA256;
|
|
+ break;
|
|
+ case CRYPTO_HASH_ALG_HMAC_SHA256:
|
|
+ md_type = MBEDTLS_MD_SHA256;
|
|
+ is_hmac = 1;
|
|
+ break;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_SHA512_C
|
|
+ case CRYPTO_HASH_ALG_SHA384:
|
|
+ md_type = MBEDTLS_MD_SHA384;
|
|
+ break;
|
|
+ case CRYPTO_HASH_ALG_SHA512:
|
|
+ md_type = MBEDTLS_MD_SHA512;
|
|
+ break;
|
|
+ #endif
|
|
+ default:
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type(md_type);
|
|
+ if (!md_info)
|
|
+ return NULL;
|
|
+
|
|
+ mbedtls_md_context_t *mctx = os_malloc(sizeof(*mctx));
|
|
+ if (mctx == NULL)
|
|
+ return NULL;
|
|
+
|
|
+ mbedtls_md_init(mctx);
|
|
+ if (mbedtls_md_setup(mctx, md_info, is_hmac) != 0) {
|
|
+ os_free(mctx);
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ if (is_hmac)
|
|
+ mbedtls_md_hmac_starts(mctx, key, key_len);
|
|
+ else
|
|
+ mbedtls_md_starts(mctx);
|
|
+ return (struct crypto_hash *)((uintptr_t)mctx | is_hmac);
|
|
+}
|
|
+
|
|
+void crypto_hash_update(struct crypto_hash *ctx, const u8 *data, size_t len)
|
|
+{
|
|
+ mbedtls_md_context_t *mctx = (mbedtls_md_context_t*)((uintptr_t)ctx & ~1uL);
|
|
+ #if 0
|
|
+ /*(mbedtls_md_hmac_update() and mbedtls_md_update()
|
|
+ * make same modifications under the hood in mbedtls)*/
|
|
+ if ((uintptr_t)ctx & 1uL)
|
|
+ mbedtls_md_hmac_update(mctx, data, len);
|
|
+ else
|
|
+ #endif
|
|
+ mbedtls_md_update(mctx, data, len);
|
|
+}
|
|
+
|
|
+int crypto_hash_finish(struct crypto_hash *ctx, u8 *mac, size_t *len)
|
|
+{
|
|
+ mbedtls_md_context_t *mctx = (mbedtls_md_context_t*)((uintptr_t)ctx & ~1uL);
|
|
+ if (mac != NULL && len != NULL) { /*(NULL if caller just freeing context)*/
|
|
+ #if MBEDTLS_VERSION_NUMBER >= 0x03020000 /* mbedtls 3.2.0 */
|
|
+ const mbedtls_md_info_t *md_info = mbedtls_md_info_from_ctx(mctx);
|
|
+ #else
|
|
+ const mbedtls_md_info_t *md_info = mctx->MBEDTLS_PRIVATE(md_info);
|
|
+ #endif
|
|
+ size_t maclen = mbedtls_md_get_size(md_info);
|
|
+ if (*len < maclen) {
|
|
+ *len = maclen;
|
|
+ /*(note: ctx not freed; can call again with larger *len)*/
|
|
+ return -1;
|
|
+ }
|
|
+ *len = maclen;
|
|
+ if ((uintptr_t)ctx & 1uL)
|
|
+ mbedtls_md_hmac_finish(mctx, mac);
|
|
+ else
|
|
+ mbedtls_md_finish(mctx, mac);
|
|
+ }
|
|
+ mbedtls_md_free(mctx);
|
|
+ os_free(mctx);
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+#endif /* CRYPTO_MBEDTLS_CRYPTO_HASH */
|
|
+
|
|
+
|
|
+#ifdef CRYPTO_MBEDTLS_CRYPTO_BIGNUM
|
|
+
|
|
+#include <mbedtls/bignum.h>
|
|
+
|
|
+/* crypto.h bignum interfaces */
|
|
+
|
|
+struct crypto_bignum *crypto_bignum_init(void)
|
|
+{
|
|
+ mbedtls_mpi *bn = os_malloc(sizeof(*bn));
|
|
+ if (bn)
|
|
+ mbedtls_mpi_init(bn);
|
|
+ return (struct crypto_bignum *)bn;
|
|
+}
|
|
+
|
|
+struct crypto_bignum *crypto_bignum_init_set(const u8 *buf, size_t len)
|
|
+{
|
|
+ mbedtls_mpi *bn = os_malloc(sizeof(*bn));
|
|
+ if (bn) {
|
|
+ mbedtls_mpi_init(bn);
|
|
+ if (mbedtls_mpi_read_binary(bn, buf, len) == 0)
|
|
+ return (struct crypto_bignum *)bn;
|
|
+ }
|
|
+
|
|
+ os_free(bn);
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+struct crypto_bignum *crypto_bignum_init_uint(unsigned int val)
|
|
+{
|
|
+ #if 0 /*(hostap use of this interface passes int, not uint)*/
|
|
+ val = host_to_be32(val);
|
|
+ return crypto_bignum_init_set((const u8 *)&val, sizeof(val));
|
|
+ #else
|
|
+ mbedtls_mpi *bn = os_malloc(sizeof(*bn));
|
|
+ if (bn) {
|
|
+ mbedtls_mpi_init(bn);
|
|
+ if (mbedtls_mpi_lset(bn, (int)val) == 0)
|
|
+ return (struct crypto_bignum *)bn;
|
|
+ }
|
|
+
|
|
+ os_free(bn);
|
|
+ return NULL;
|
|
+ #endif
|
|
+}
|
|
+
|
|
+void crypto_bignum_deinit(struct crypto_bignum *n, int clear)
|
|
+{
|
|
+ mbedtls_mpi_free((mbedtls_mpi *)n);
|
|
+ os_free(n);
|
|
+}
|
|
+
|
|
+int crypto_bignum_to_bin(const struct crypto_bignum *a,
|
|
+ u8 *buf, size_t buflen, size_t padlen)
|
|
+{
|
|
+ size_t n = mbedtls_mpi_size((mbedtls_mpi *)a);
|
|
+ if (n < padlen)
|
|
+ n = padlen;
|
|
+ return n > buflen || mbedtls_mpi_write_binary((mbedtls_mpi *)a, buf, n)
|
|
+ ? -1
|
|
+ : (int)(n);
|
|
+}
|
|
+
|
|
+int crypto_bignum_rand(struct crypto_bignum *r, const struct crypto_bignum *m)
|
|
+{
|
|
+ /*assert(r != m);*//* r must not be same as m for mbedtls_mpi_random()*/
|
|
+ #if MBEDTLS_VERSION_NUMBER >= 0x021B0000 /* mbedtls 2.27.0 */
|
|
+ return mbedtls_mpi_random((mbedtls_mpi *)r, 0, (mbedtls_mpi *)m,
|
|
+ mbedtls_ctr_drbg_random,
|
|
+ crypto_mbedtls_ctr_drbg()) ? -1 : 0;
|
|
+ #else
|
|
+ /* (needed by EAP_PWD, SAE, DPP) */
|
|
+ wpa_printf(MSG_ERROR,
|
|
+ "mbedtls 2.27.0 or later required for mbedtls_mpi_random()");
|
|
+ return -1;
|
|
+ #endif
|
|
+}
|
|
+
|
|
+int crypto_bignum_add(const struct crypto_bignum *a,
|
|
+ const struct crypto_bignum *b,
|
|
+ struct crypto_bignum *c)
|
|
+{
|
|
+ return mbedtls_mpi_add_mpi((mbedtls_mpi *)c,
|
|
+ (const mbedtls_mpi *)a,
|
|
+ (const mbedtls_mpi *)b) ? -1 : 0;
|
|
+}
|
|
+
|
|
+int crypto_bignum_mod(const struct crypto_bignum *a,
|
|
+ const struct crypto_bignum *b,
|
|
+ struct crypto_bignum *c)
|
|
+{
|
|
+ return mbedtls_mpi_mod_mpi((mbedtls_mpi *)c,
|
|
+ (const mbedtls_mpi *)a,
|
|
+ (const mbedtls_mpi *)b) ? -1 : 0;
|
|
+}
|
|
+
|
|
+int crypto_bignum_exptmod(const struct crypto_bignum *a,
|
|
+ const struct crypto_bignum *b,
|
|
+ const struct crypto_bignum *c,
|
|
+ struct crypto_bignum *d)
|
|
+{
|
|
+ /* (check if input params match d; d is the result) */
|
|
+ /* (a == d) is ok in current mbedtls implementation */
|
|
+ if (b == d || c == d) { /*(not ok; store result in intermediate)*/
|
|
+ mbedtls_mpi R;
|
|
+ mbedtls_mpi_init(&R);
|
|
+ int rc = mbedtls_mpi_exp_mod(&R,
|
|
+ (const mbedtls_mpi *)a,
|
|
+ (const mbedtls_mpi *)b,
|
|
+ (const mbedtls_mpi *)c,
|
|
+ NULL)
|
|
+ || mbedtls_mpi_copy((mbedtls_mpi *)d, &R) ? -1 : 0;
|
|
+ mbedtls_mpi_free(&R);
|
|
+ return rc;
|
|
+ }
|
|
+ else {
|
|
+ return mbedtls_mpi_exp_mod((mbedtls_mpi *)d,
|
|
+ (const mbedtls_mpi *)a,
|
|
+ (const mbedtls_mpi *)b,
|
|
+ (const mbedtls_mpi *)c,
|
|
+ NULL) ? -1 : 0;
|
|
+ }
|
|
+}
|
|
+
|
|
+int crypto_bignum_inverse(const struct crypto_bignum *a,
|
|
+ const struct crypto_bignum *b,
|
|
+ struct crypto_bignum *c)
|
|
+{
|
|
+ return mbedtls_mpi_inv_mod((mbedtls_mpi *)c,
|
|
+ (const mbedtls_mpi *)a,
|
|
+ (const mbedtls_mpi *)b) ? -1 : 0;
|
|
+}
|
|
+
|
|
+int crypto_bignum_sub(const struct crypto_bignum *a,
|
|
+ const struct crypto_bignum *b,
|
|
+ struct crypto_bignum *c)
|
|
+{
|
|
+ return mbedtls_mpi_sub_mpi((mbedtls_mpi *)c,
|
|
+ (const mbedtls_mpi *)a,
|
|
+ (const mbedtls_mpi *)b) ? -1 : 0;
|
|
+}
|
|
+
|
|
+int crypto_bignum_div(const struct crypto_bignum *a,
|
|
+ const struct crypto_bignum *b,
|
|
+ struct crypto_bignum *c)
|
|
+{
|
|
+ /*(most current use of this crypto.h interface has a == c (result),
|
|
+ * so store result in an intermediate to avoid overwritten input)*/
|
|
+ mbedtls_mpi R;
|
|
+ mbedtls_mpi_init(&R);
|
|
+ int rc = mbedtls_mpi_div_mpi(&R, NULL,
|
|
+ (const mbedtls_mpi *)a,
|
|
+ (const mbedtls_mpi *)b)
|
|
+ || mbedtls_mpi_copy((mbedtls_mpi *)c, &R) ? -1 : 0;
|
|
+ mbedtls_mpi_free(&R);
|
|
+ return rc;
|
|
+}
|
|
+
|
|
+int crypto_bignum_addmod(const struct crypto_bignum *a,
|
|
+ const struct crypto_bignum *b,
|
|
+ const struct crypto_bignum *c,
|
|
+ struct crypto_bignum *d)
|
|
+{
|
|
+ return mbedtls_mpi_add_mpi((mbedtls_mpi *)d,
|
|
+ (const mbedtls_mpi *)a,
|
|
+ (const mbedtls_mpi *)b)
|
|
+ || mbedtls_mpi_mod_mpi((mbedtls_mpi *)d,
|
|
+ (mbedtls_mpi *)d,
|
|
+ (const mbedtls_mpi *)c) ? -1 : 0;
|
|
+}
|
|
+
|
|
+int crypto_bignum_mulmod(const struct crypto_bignum *a,
|
|
+ const struct crypto_bignum *b,
|
|
+ const struct crypto_bignum *c,
|
|
+ struct crypto_bignum *d)
|
|
+{
|
|
+ return mbedtls_mpi_mul_mpi((mbedtls_mpi *)d,
|
|
+ (const mbedtls_mpi *)a,
|
|
+ (const mbedtls_mpi *)b)
|
|
+ || mbedtls_mpi_mod_mpi((mbedtls_mpi *)d,
|
|
+ (mbedtls_mpi *)d,
|
|
+ (const mbedtls_mpi *)c) ? -1 : 0;
|
|
+}
|
|
+
|
|
+int crypto_bignum_sqrmod(const struct crypto_bignum *a,
|
|
+ const struct crypto_bignum *b,
|
|
+ struct crypto_bignum *c)
|
|
+{
|
|
+ #if 1
|
|
+ return crypto_bignum_mulmod(a, a, b, c);
|
|
+ #else
|
|
+ mbedtls_mpi bn;
|
|
+ mbedtls_mpi_init(&bn);
|
|
+ if (mbedtls_mpi_lset(&bn, 2)) /* alt?: mbedtls_mpi_set_bit(&bn, 1) */
|
|
+ return -1;
|
|
+ int ret = mbedtls_mpi_exp_mod((mbedtls_mpi *)c,
|
|
+ (const mbedtls_mpi *)a, &bn,
|
|
+ (const mbedtls_mpi *)b, NULL) ? -1 : 0;
|
|
+ mbedtls_mpi_free(&bn);
|
|
+ return ret;
|
|
+ #endif
|
|
+}
|
|
+
|
|
+int crypto_bignum_rshift(const struct crypto_bignum *a, int n,
|
|
+ struct crypto_bignum *r)
|
|
+{
|
|
+ return mbedtls_mpi_copy((mbedtls_mpi *)r, (const mbedtls_mpi *)a)
|
|
+ || mbedtls_mpi_shift_r((mbedtls_mpi *)r, n) ? -1 : 0;
|
|
+}
|
|
+
|
|
+int crypto_bignum_cmp(const struct crypto_bignum *a,
|
|
+ const struct crypto_bignum *b)
|
|
+{
|
|
+ return mbedtls_mpi_cmp_mpi((const mbedtls_mpi *)a, (const mbedtls_mpi *)b);
|
|
+}
|
|
+
|
|
+int crypto_bignum_is_zero(const struct crypto_bignum *a)
|
|
+{
|
|
+ /* XXX: src/common/sae.c:sswu() contains comment:
|
|
+ * "TODO: Make sure crypto_bignum_is_zero() is constant time"
|
|
+ * Note: mbedtls_mpi_cmp_int() *is not* constant time */
|
|
+ return (mbedtls_mpi_cmp_int((const mbedtls_mpi *)a, 0) == 0);
|
|
+}
|
|
+
|
|
+int crypto_bignum_is_one(const struct crypto_bignum *a)
|
|
+{
|
|
+ return (mbedtls_mpi_cmp_int((const mbedtls_mpi *)a, 1) == 0);
|
|
+}
|
|
+
|
|
+int crypto_bignum_is_odd(const struct crypto_bignum *a)
|
|
+{
|
|
+ return mbedtls_mpi_get_bit((const mbedtls_mpi *)a, 0);
|
|
+}
|
|
+
|
|
+#include "utils/const_time.h"
|
|
+int crypto_bignum_legendre(const struct crypto_bignum *a,
|
|
+ const struct crypto_bignum *p)
|
|
+{
|
|
+ /* Security Note:
|
|
+ * mbedtls_mpi_exp_mod() is not documented to run in constant time,
|
|
+ * though mbedtls/library/bignum.c uses constant_time_internal.h funcs.
|
|
+ * Compare to crypto_openssl.c:crypto_bignum_legendre()
|
|
+ * which uses openssl BN_mod_exp_mont_consttime()
|
|
+ * mbedtls/library/ecp.c has further countermeasures to timing attacks,
|
|
+ * (but ecp.c funcs are not used here) */
|
|
+
|
|
+ mbedtls_mpi exp, tmp;
|
|
+ mbedtls_mpi_init(&exp);
|
|
+ mbedtls_mpi_init(&tmp);
|
|
+
|
|
+ /* exp = (p-1) / 2 */
|
|
+ int res;
|
|
+ if (mbedtls_mpi_sub_int(&exp, (const mbedtls_mpi *)p, 1) == 0
|
|
+ && mbedtls_mpi_shift_r(&exp, 1) == 0
|
|
+ && mbedtls_mpi_exp_mod(&tmp, (const mbedtls_mpi *)a, &exp,
|
|
+ (const mbedtls_mpi *)p, NULL) == 0) {
|
|
+ /*(modified from crypto_openssl.c:crypto_bignum_legendre())*/
|
|
+ /* Return 1 if tmp == 1, 0 if tmp == 0, or -1 otherwise. Need
|
|
+ * to use constant time selection to avoid branches here. */
|
|
+ unsigned int mask;
|
|
+ res = -1;
|
|
+ mask = const_time_eq((mbedtls_mpi_cmp_int(&tmp, 1) == 0), 1);
|
|
+ res = const_time_select_int(mask, 1, res);
|
|
+ mask = const_time_eq((mbedtls_mpi_cmp_int(&tmp, 0) == 0), 1);
|
|
+ res = const_time_select_int(mask, 0, res);
|
|
+ } else {
|
|
+ res = -2;
|
|
+ }
|
|
+
|
|
+ mbedtls_mpi_free(&tmp);
|
|
+ mbedtls_mpi_free(&exp);
|
|
+ return res;
|
|
+}
|
|
+
|
|
+#endif /* CRYPTO_MBEDTLS_CRYPTO_BIGNUM */
|
|
+
|
|
+
|
|
+#ifdef CRYPTO_MBEDTLS_CRYPTO_DH
|
|
+
|
|
+/* crypto_internal-modexp.c */
|
|
+
|
|
+#include <mbedtls/bignum.h>
|
|
+#include <mbedtls/dhm.h>
|
|
+
|
|
+#if 0 /* crypto_dh_init() and crypto_dh_derive_secret() prefer to use mbedtls */
|
|
+int crypto_mod_exp(const u8 *base, size_t base_len,
|
|
+ const u8 *power, size_t power_len,
|
|
+ const u8 *modulus, size_t modulus_len,
|
|
+ u8 *result, size_t *result_len)
|
|
+{
|
|
+ mbedtls_mpi bn_base, bn_exp, bn_modulus, bn_result;
|
|
+ mbedtls_mpi_init(&bn_base);
|
|
+ mbedtls_mpi_init(&bn_exp);
|
|
+ mbedtls_mpi_init(&bn_modulus);
|
|
+ mbedtls_mpi_init(&bn_result);
|
|
+
|
|
+ size_t len;
|
|
+ int ret = mbedtls_mpi_read_binary(&bn_base, base, base_len)
|
|
+ || mbedtls_mpi_read_binary(&bn_exp, power, power_len)
|
|
+ || mbedtls_mpi_read_binary(&bn_modulus, modulus, modulus_len)
|
|
+ || mbedtls_mpi_exp_mod(&bn_result,&bn_base,&bn_exp,&bn_modulus,NULL)
|
|
+ || (len = mbedtls_mpi_size(&bn_result)) > *result_len
|
|
+ || mbedtls_mpi_write_binary(&bn_result, result, (*result_len = len))
|
|
+ ? -1
|
|
+ : 0;
|
|
+
|
|
+ mbedtls_mpi_free(&bn_base);
|
|
+ mbedtls_mpi_free(&bn_exp);
|
|
+ mbedtls_mpi_free(&bn_modulus);
|
|
+ mbedtls_mpi_free(&bn_result);
|
|
+ return ret;
|
|
+}
|
|
+#endif
|
|
+
|
|
+static int crypto_mbedtls_dh_set_bin_pg(mbedtls_dhm_context *ctx, u8 generator,
|
|
+ const u8 *prime, size_t prime_len)
|
|
+{
|
|
+ /*(could set these directly in MBEDTLS_PRIVATE members)*/
|
|
+ mbedtls_mpi P, G;
|
|
+ mbedtls_mpi_init(&P);
|
|
+ mbedtls_mpi_init(&G);
|
|
+ int ret = mbedtls_mpi_lset(&G, generator)
|
|
+ || mbedtls_mpi_read_binary(&P, prime, prime_len)
|
|
+ || mbedtls_dhm_set_group(ctx, &P, &G);
|
|
+ mbedtls_mpi_free(&P);
|
|
+ mbedtls_mpi_free(&G);
|
|
+ return ret;
|
|
+}
|
|
+
|
|
+__attribute_noinline__
|
|
+static int crypto_mbedtls_dh_init_public(mbedtls_dhm_context *ctx, u8 generator,
|
|
+ const u8 *prime, size_t prime_len,
|
|
+ u8 *privkey, u8 *pubkey)
|
|
+{
|
|
+ if (crypto_mbedtls_dh_set_bin_pg(ctx, generator, prime, prime_len)
|
|
+ || mbedtls_dhm_make_public(ctx, (int)prime_len, pubkey, prime_len,
|
|
+ mbedtls_ctr_drbg_random,
|
|
+ crypto_mbedtls_ctr_drbg()))
|
|
+ return -1;
|
|
+
|
|
+ /*(enable later when upstream mbedtls interface changes require)*/
|
|
+ #if 0 && MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
|
|
+ mbedtls_mpi X;
|
|
+ mbedtls_mpi_init(&X);
|
|
+ int ret = mbedtls_dhm_get_value(ctx, MBEDTLS_DHM_PARAM_X, &X)
|
|
+ || mbedtls_mpi_write_binary(&X, privkey, prime_len) ? -1 : 0;
|
|
+ mbedtls_mpi_free(&X);
|
|
+ return ret;
|
|
+ #else
|
|
+ return mbedtls_mpi_write_binary(&ctx->MBEDTLS_PRIVATE(X),
|
|
+ privkey, prime_len) ? -1 : 0;
|
|
+ #endif
|
|
+}
|
|
+
|
|
+int crypto_dh_init(u8 generator, const u8 *prime, size_t prime_len, u8 *privkey,
|
|
+ u8 *pubkey)
|
|
+{
|
|
+ #if 0 /*(crypto_dh_init() duplicated (and identical) in crypto_*.c modules)*/
|
|
+ size_t pubkey_len, pad;
|
|
+
|
|
+ if (os_get_random(privkey, prime_len) < 0)
|
|
+ return -1;
|
|
+ if (os_memcmp(privkey, prime, prime_len) > 0) {
|
|
+ /* Make sure private value is smaller than prime */
|
|
+ privkey[0] = 0;
|
|
+ }
|
|
+
|
|
+ pubkey_len = prime_len;
|
|
+ if (crypto_mod_exp(&generator, 1, privkey, prime_len, prime, prime_len,
|
|
+ pubkey, &pubkey_len) < 0)
|
|
+ return -1;
|
|
+ if (pubkey_len < prime_len) {
|
|
+ pad = prime_len - pubkey_len;
|
|
+ os_memmove(pubkey + pad, pubkey, pubkey_len);
|
|
+ os_memset(pubkey, 0, pad);
|
|
+ }
|
|
+
|
|
+ return 0;
|
|
+ #else
|
|
+ /* Prefer to use mbedtls to derive our public/private key, as doing so
|
|
+ * leverages mbedtls to properly format output and to perform blinding*/
|
|
+ mbedtls_dhm_context ctx;
|
|
+ mbedtls_dhm_init(&ctx);
|
|
+ int ret = crypto_mbedtls_dh_init_public(&ctx, generator, prime,
|
|
+ prime_len, privkey, pubkey);
|
|
+ mbedtls_dhm_free(&ctx);
|
|
+ return ret;
|
|
+ #endif
|
|
+}
|
|
+
|
|
+/*(crypto_dh_derive_secret() could be implemented using crypto.h APIs
|
|
+ * instead of being reimplemented in each crypto_*.c)*/
|
|
+int crypto_dh_derive_secret(u8 generator, const u8 *prime, size_t prime_len,
|
|
+ const u8 *order, size_t order_len,
|
|
+ const u8 *privkey, size_t privkey_len,
|
|
+ const u8 *pubkey, size_t pubkey_len,
|
|
+ u8 *secret, size_t *len)
|
|
+{
|
|
+ #if 0
|
|
+ if (pubkey_len > prime_len ||
|
|
+ (pubkey_len == prime_len &&
|
|
+ os_memcmp(pubkey, prime, prime_len) >= 0))
|
|
+ return -1;
|
|
+
|
|
+ int res = 0;
|
|
+ mbedtls_mpi pub;
|
|
+ mbedtls_mpi_init(&pub);
|
|
+ if (mbedtls_mpi_read_binary(&pub, pubkey, pubkey_len)
|
|
+ || mbedtls_mpi_cmp_int(&pub, 1) <= 0) {
|
|
+ res = -1;
|
|
+ } else if (order) {
|
|
+ mbedtls_mpi p, q, tmp;
|
|
+ mbedtls_mpi_init(&p);
|
|
+ mbedtls_mpi_init(&q);
|
|
+ mbedtls_mpi_init(&tmp);
|
|
+
|
|
+ /* verify: pubkey^q == 1 mod p */
|
|
+ res = (mbedtls_mpi_read_binary(&p, prime, prime_len)
|
|
+ || mbedtls_mpi_read_binary(&q, order, order_len)
|
|
+ || mbedtls_mpi_exp_mod(&tmp, &pub, &q, &p, NULL)
|
|
+ || mbedtls_mpi_cmp_int(&tmp, 1) != 0);
|
|
+
|
|
+ mbedtls_mpi_free(&p);
|
|
+ mbedtls_mpi_free(&q);
|
|
+ mbedtls_mpi_free(&tmp);
|
|
+ }
|
|
+ mbedtls_mpi_free(&pub);
|
|
+
|
|
+ return (res == 0)
|
|
+ ? crypto_mod_exp(pubkey, pubkey_len, privkey, privkey_len,
|
|
+ prime, prime_len, secret, len)
|
|
+ : -1;
|
|
+ #else
|
|
+ /* Prefer to use mbedtls to derive DH shared secret, as doing so
|
|
+ * leverages mbedtls to validate params and to perform blinding.
|
|
+ *
|
|
+ * Attempt to reconstitute DH context to derive shared secret
|
|
+ * (due to limitations of the interface, which ought to pass context).
|
|
+ * Force provided G (our private key) into context without validation.
|
|
+ * Regenerating GX (our public key) not needed to derive shared secret.
|
|
+ */
|
|
+ /*(older compilers might not support VLAs)*/
|
|
+ /*unsigned char buf[2+prime_len+2+1+2+pubkey_len];*/
|
|
+ unsigned char buf[2+MBEDTLS_MPI_MAX_SIZE+2+1+2+MBEDTLS_MPI_MAX_SIZE];
|
|
+ unsigned char *p = buf + 2 + prime_len;
|
|
+ if (2+prime_len+2+1+2+pubkey_len > sizeof(buf))
|
|
+ return -1;
|
|
+ WPA_PUT_BE16(buf, prime_len); /*(2-byte big-endian size of prime)*/
|
|
+ p[0] = 0; /*(2-byte big-endian size of generator)*/
|
|
+ p[1] = 1;
|
|
+ p[2] = generator;
|
|
+ WPA_PUT_BE16(p+3, pubkey_len); /*(2-byte big-endian size of pubkey)*/
|
|
+ os_memcpy(p+5, pubkey, pubkey_len);
|
|
+ os_memcpy(buf+2, prime, prime_len);
|
|
+
|
|
+ mbedtls_dhm_context ctx;
|
|
+ mbedtls_dhm_init(&ctx);
|
|
+ p = buf;
|
|
+ int ret = mbedtls_dhm_read_params(&ctx, &p, p+2+prime_len+5+pubkey_len)
|
|
+ || mbedtls_mpi_read_binary(&ctx.MBEDTLS_PRIVATE(X),
|
|
+ privkey, privkey_len)
|
|
+ || mbedtls_dhm_calc_secret(&ctx, secret, *len, len,
|
|
+ mbedtls_ctr_drbg_random,
|
|
+ crypto_mbedtls_ctr_drbg()) ? -1 : 0;
|
|
+ mbedtls_dhm_free(&ctx);
|
|
+ return ret;
|
|
+ #endif
|
|
+}
|
|
+
|
|
+/* dh_group5.c */
|
|
+
|
|
+#include "dh_group5.h"
|
|
+
|
|
+/* RFC3526_PRIME_1536[] and RFC3526_GENERATOR_1536[] from crypto_wolfssl.c */
|
|
+
|
|
+static const unsigned char RFC3526_PRIME_1536[] = {
|
|
+ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xC9, 0x0F, 0xDA, 0xA2,
|
|
+ 0x21, 0x68, 0xC2, 0x34, 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,
|
|
+ 0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74, 0x02, 0x0B, 0xBE, 0xA6,
|
|
+ 0x3B, 0x13, 0x9B, 0x22, 0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD,
|
|
+ 0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B, 0x30, 0x2B, 0x0A, 0x6D,
|
|
+ 0xF2, 0x5F, 0x14, 0x37, 0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45,
|
|
+ 0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6, 0xF4, 0x4C, 0x42, 0xE9,
|
|
+ 0xA6, 0x37, 0xED, 0x6B, 0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED,
|
|
+ 0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5, 0xAE, 0x9F, 0x24, 0x11,
|
|
+ 0x7C, 0x4B, 0x1F, 0xE6, 0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B, 0x3D,
|
|
+ 0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, 0xBF, 0x05, 0x98, 0xDA, 0x48, 0x36,
|
|
+ 0x1C, 0x55, 0xD3, 0x9A, 0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF, 0x5F,
|
|
+ 0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD, 0x96, 0x1C, 0x62, 0xF3, 0x56,
|
|
+ 0x20, 0x85, 0x52, 0xBB, 0x9E, 0xD5, 0x29, 0x07, 0x70, 0x96, 0x96, 0x6D,
|
|
+ 0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98, 0x04, 0xF1, 0x74, 0x6C, 0x08,
|
|
+ 0xCA, 0x23, 0x73, 0x27, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
|
|
+};
|
|
+
|
|
+static const unsigned char RFC3526_GENERATOR_1536[] = {
|
|
+ 0x02
|
|
+};
|
|
+
|
|
+void * dh5_init(struct wpabuf **priv, struct wpabuf **publ)
|
|
+{
|
|
+ const unsigned char * const prime = RFC3526_PRIME_1536;
|
|
+ const size_t prime_len = sizeof(RFC3526_PRIME_1536);
|
|
+ const u8 generator = *RFC3526_GENERATOR_1536;
|
|
+ struct wpabuf *wpubl = NULL, *wpriv = NULL;
|
|
+
|
|
+ mbedtls_dhm_context *ctx = os_malloc(sizeof(*ctx));
|
|
+ if (ctx == NULL)
|
|
+ return NULL;
|
|
+ mbedtls_dhm_init(ctx);
|
|
+
|
|
+ if ( (wpubl = wpabuf_alloc(prime_len))
|
|
+ && (wpriv = wpabuf_alloc(prime_len))
|
|
+ && crypto_mbedtls_dh_init_public(ctx, generator, prime, prime_len,
|
|
+ wpabuf_put(wpriv, prime_len),
|
|
+ wpabuf_put(wpubl, prime_len))==0) {
|
|
+ wpabuf_free(*publ);
|
|
+ wpabuf_clear_free(*priv);
|
|
+ *publ = wpubl;
|
|
+ *priv = wpriv;
|
|
+ return ctx;
|
|
+ }
|
|
+
|
|
+ wpabuf_clear_free(wpriv);
|
|
+ wpabuf_free(wpubl);
|
|
+ mbedtls_dhm_free(ctx);
|
|
+ os_free(ctx);
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+#ifdef CRYPTO_MBEDTLS_DH5_INIT_FIXED
|
|
+void * dh5_init_fixed(const struct wpabuf *priv, const struct wpabuf *publ)
|
|
+{
|
|
+ const unsigned char * const prime = RFC3526_PRIME_1536;
|
|
+ const size_t prime_len = sizeof(RFC3526_PRIME_1536);
|
|
+ const u8 generator = *RFC3526_GENERATOR_1536;
|
|
+
|
|
+ mbedtls_dhm_context *ctx = os_malloc(sizeof(*ctx));
|
|
+ if (ctx == NULL)
|
|
+ return NULL;
|
|
+ mbedtls_dhm_init(ctx);
|
|
+
|
|
+ if (crypto_mbedtls_dh_set_bin_pg(ctx, generator, prime, prime_len)==0
|
|
+ #if 0 /*(ignore; not required to derive shared secret)*/
|
|
+ && mbedtls_mpi_read_binary(&ctx->MBEDTLS_PRIVATE(GX),
|
|
+ wpabuf_head(publ),wpabuf_len(publ))==0
|
|
+ #endif
|
|
+ && mbedtls_mpi_read_binary(&ctx->MBEDTLS_PRIVATE(X),
|
|
+ wpabuf_head(priv),wpabuf_len(priv))==0) {
|
|
+ return ctx;
|
|
+ }
|
|
+
|
|
+ mbedtls_dhm_free(ctx);
|
|
+ os_free(ctx);
|
|
+ return NULL;
|
|
+}
|
|
+#endif
|
|
+
|
|
+struct wpabuf * dh5_derive_shared(void *ctx, const struct wpabuf *peer_public,
|
|
+ const struct wpabuf *own_private)
|
|
+{
|
|
+ /*((mbedtls_dhm_context *)ctx must already contain own_private)*/
|
|
+ /* mbedtls 2.x: prime_len = ctx->len; */
|
|
+ /* mbedtls 3.x: prime_len = mbedtls_dhm_get_len(ctx); */
|
|
+ size_t olen = sizeof(RFC3526_PRIME_1536); /*(sizeof(); prime known)*/
|
|
+ struct wpabuf *buf = wpabuf_alloc(olen);
|
|
+ if (buf == NULL)
|
|
+ return NULL;
|
|
+ if (mbedtls_dhm_read_public((mbedtls_dhm_context *)ctx,
|
|
+ wpabuf_head(peer_public),
|
|
+ wpabuf_len(peer_public)) == 0
|
|
+ && mbedtls_dhm_calc_secret(ctx, wpabuf_mhead(buf), olen, &olen,
|
|
+ mbedtls_ctr_drbg_random,
|
|
+ crypto_mbedtls_ctr_drbg()) == 0) {
|
|
+ wpabuf_put(buf, olen);
|
|
+ return buf;
|
|
+ }
|
|
+
|
|
+ wpabuf_free(buf);
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+void dh5_free(void *ctx)
|
|
+{
|
|
+ mbedtls_dhm_free(ctx);
|
|
+ os_free(ctx);
|
|
+}
|
|
+
|
|
+#endif /* CRYPTO_MBEDTLS_CRYPTO_DH */
|
|
+
|
|
+
|
|
+#if defined(CRYPTO_MBEDTLS_CRYPTO_ECDH) || defined(CRYPTO_MBEDTLS_CRYPTO_EC)
|
|
+
|
|
+#include <mbedtls/ecp.h>
|
|
+
|
|
+#define CRYPTO_EC_pbits(e) (((mbedtls_ecp_group *)(e))->pbits)
|
|
+#define CRYPTO_EC_plen(e) ((((mbedtls_ecp_group *)(e))->pbits+7)>>3)
|
|
+#define CRYPTO_EC_P(e) (&((mbedtls_ecp_group *)(e))->P)
|
|
+#define CRYPTO_EC_N(e) (&((mbedtls_ecp_group *)(e))->N)
|
|
+#define CRYPTO_EC_A(e) (&((mbedtls_ecp_group *)(e))->A)
|
|
+#define CRYPTO_EC_B(e) (&((mbedtls_ecp_group *)(e))->B)
|
|
+#define CRYPTO_EC_G(e) (&((mbedtls_ecp_group *)(e))->G)
|
|
+
|
|
+static mbedtls_ecp_group_id crypto_mbedtls_ecp_group_id_from_ike_id(int group)
|
|
+{
|
|
+ /* https://www.iana.org/assignments/ikev2-parameters/ikev2-parameters.xhtml */
|
|
+ switch (group) {
|
|
+ #ifdef MBEDTLS_ECP_DP_SECP256R1_ENABLED
|
|
+ case 19: return MBEDTLS_ECP_DP_SECP256R1;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_SECP384R1_ENABLED
|
|
+ case 20: return MBEDTLS_ECP_DP_SECP384R1;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_SECP521R1_ENABLED
|
|
+ case 21: return MBEDTLS_ECP_DP_SECP521R1;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_SECP192R1_ENABLED
|
|
+ case 25: return MBEDTLS_ECP_DP_SECP192R1;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_SECP224R1_ENABLED
|
|
+ case 26: return MBEDTLS_ECP_DP_SECP224R1;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_BP256R1_ENABLED
|
|
+ case 28: return MBEDTLS_ECP_DP_BP256R1;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_BP384R1_ENABLED
|
|
+ case 29: return MBEDTLS_ECP_DP_BP384R1;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_BP512R1_ENABLED
|
|
+ case 30: return MBEDTLS_ECP_DP_BP512R1;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_CURVE25519_ENABLED
|
|
+ case 31: return MBEDTLS_ECP_DP_CURVE25519;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_CURVE448_ENABLED
|
|
+ case 32: return MBEDTLS_ECP_DP_CURVE448;
|
|
+ #endif
|
|
+ default: return MBEDTLS_ECP_DP_NONE;
|
|
+ }
|
|
+}
|
|
+
|
|
+#ifdef CRYPTO_MBEDTLS_CRYPTO_EC
|
|
+static int crypto_mbedtls_ike_id_from_ecp_group_id(mbedtls_ecp_group_id grp_id)
|
|
+{
|
|
+ /* https://www.iana.org/assignments/ikev2-parameters/ikev2-parameters.xhtml */
|
|
+ /*(for crypto_ec_key_group())*/
|
|
+ switch (grp_id) {
|
|
+ #ifdef MBEDTLS_ECP_DP_SECP256R1_ENABLED
|
|
+ case MBEDTLS_ECP_DP_SECP256R1: return 19;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_SECP384R1_ENABLED
|
|
+ case MBEDTLS_ECP_DP_SECP384R1: return 20;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_SECP521R1_ENABLED
|
|
+ case MBEDTLS_ECP_DP_SECP521R1: return 21;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_SECP192R1_ENABLED
|
|
+ case MBEDTLS_ECP_DP_SECP192R1: return 25;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_SECP224R1_ENABLED
|
|
+ case MBEDTLS_ECP_DP_SECP224R1: return 26;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_BP256R1_ENABLED
|
|
+ case MBEDTLS_ECP_DP_BP256R1: return 28;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_BP384R1_ENABLED
|
|
+ case MBEDTLS_ECP_DP_BP384R1: return 29;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_BP512R1_ENABLED
|
|
+ case MBEDTLS_ECP_DP_BP512R1: return 30;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_CURVE25519_ENABLED
|
|
+ case MBEDTLS_ECP_DP_CURVE25519: return 31;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_CURVE448_ENABLED
|
|
+ case MBEDTLS_ECP_DP_CURVE448: return 32;
|
|
+ #endif
|
|
+ default: return -1;
|
|
+ }
|
|
+}
|
|
+#endif
|
|
+
|
|
+#endif /* CRYPTO_MBEDTLS_CRYPTO_ECDH || CRYPTO_MBEDTLS_CRYPTO_EC */
|
|
+
|
|
+
|
|
+#if defined(CRYPTO_MBEDTLS_CRYPTO_ECDH) || defined(CRYPTO_MBEDTLS_CRYPTO_EC_DPP)
|
|
+
|
|
+#include <mbedtls/ecp.h>
|
|
+#include <mbedtls/pk.h>
|
|
+
|
|
+static int crypto_mbedtls_keypair_gen(int group, mbedtls_pk_context *pk)
|
|
+{
|
|
+ mbedtls_ecp_group_id grp_id =
|
|
+ crypto_mbedtls_ecp_group_id_from_ike_id(group);
|
|
+ if (grp_id == MBEDTLS_ECP_DP_NONE)
|
|
+ return -1;
|
|
+ const mbedtls_pk_info_t *pk_info =
|
|
+ mbedtls_pk_info_from_type(MBEDTLS_PK_ECKEY);
|
|
+ if (pk_info == NULL)
|
|
+ return -1;
|
|
+ return mbedtls_pk_setup(pk, pk_info)
|
|
+ || mbedtls_ecp_gen_key(grp_id, mbedtls_pk_ec(*pk),
|
|
+ mbedtls_ctr_drbg_random,
|
|
+ crypto_mbedtls_ctr_drbg()) ? -1 : 0;
|
|
+}
|
|
+
|
|
+#endif
|
|
+
|
|
+
|
|
+#ifdef CRYPTO_MBEDTLS_CRYPTO_ECDH
|
|
+
|
|
+#include <mbedtls/ecdh.h>
|
|
+#include <mbedtls/ecdsa.h>
|
|
+#include <mbedtls/ecp.h>
|
|
+#include <mbedtls/pk.h>
|
|
+
|
|
+/* wrap mbedtls_ecdh_context for more future-proof direct access to components
|
|
+ * (mbedtls_ecdh_context internal implementation may change between releases)
|
|
+ *
|
|
+ * If mbedtls_pk_context -- specifically underlying mbedtls_ecp_keypair --
|
|
+ * lifetime were guaranteed to be longer than that of mbedtls_ecdh_context,
|
|
+ * then mbedtls_pk_context or mbedtls_ecp_keypair could be stored in crypto_ecdh
|
|
+ * (or crypto_ec_key could be stored in crypto_ecdh, and crypto_ec_key could
|
|
+ * wrap mbedtls_ecp_keypair and components, to avoid MBEDTLS_PRIVATE access) */
|
|
+struct crypto_ecdh {
|
|
+ mbedtls_ecdh_context ctx;
|
|
+ mbedtls_ecp_group grp;
|
|
+ mbedtls_ecp_point Q;
|
|
+};
|
|
+
|
|
+struct crypto_ecdh * crypto_ecdh_init(int group)
|
|
+{
|
|
+ mbedtls_pk_context pk;
|
|
+ mbedtls_pk_init(&pk);
|
|
+ struct crypto_ecdh *ecdh = crypto_mbedtls_keypair_gen(group, &pk) == 0
|
|
+ ? crypto_ecdh_init2(group, (struct crypto_ec_key *)&pk)
|
|
+ : NULL;
|
|
+ mbedtls_pk_free(&pk);
|
|
+ return ecdh;
|
|
+}
|
|
+
|
|
+struct crypto_ecdh * crypto_ecdh_init2(int group,
|
|
+ struct crypto_ec_key *own_key)
|
|
+{
|
|
+ mbedtls_ecp_group_id grp_id =
|
|
+ crypto_mbedtls_ecp_group_id_from_ike_id(group);
|
|
+ if (grp_id == MBEDTLS_ECP_DP_NONE)
|
|
+ return NULL;
|
|
+ mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)own_key);
|
|
+ struct crypto_ecdh *ecdh = os_malloc(sizeof(*ecdh));
|
|
+ if (ecdh == NULL)
|
|
+ return NULL;
|
|
+ mbedtls_ecdh_init(&ecdh->ctx);
|
|
+ mbedtls_ecp_group_init(&ecdh->grp);
|
|
+ mbedtls_ecp_point_init(&ecdh->Q);
|
|
+ if (mbedtls_ecdh_setup(&ecdh->ctx, grp_id) == 0
|
|
+ && mbedtls_ecdh_get_params(&ecdh->ctx,ecp_kp,MBEDTLS_ECDH_OURS) == 0) {
|
|
+ /* copy grp and Q for later use
|
|
+ * (retrieving this info later is more convoluted
|
|
+ * even if mbedtls_ecdh_make_public() is considered)*/
|
|
+ #if MBEDTLS_VERSION_NUMBER >= 0x03020000 /* mbedtls 3.2.0 */
|
|
+ mbedtls_mpi d;
|
|
+ mbedtls_mpi_init(&d);
|
|
+ if (mbedtls_ecp_export(ecp_kp, &ecdh->grp, &d, &ecdh->Q) == 0) {
|
|
+ mbedtls_mpi_free(&d);
|
|
+ return ecdh;
|
|
+ }
|
|
+ mbedtls_mpi_free(&d);
|
|
+ #else
|
|
+ if (mbedtls_ecp_group_load(&ecdh->grp, grp_id) == 0
|
|
+ && mbedtls_ecp_copy(&ecdh->Q, &ecp_kp->MBEDTLS_PRIVATE(Q)) == 0)
|
|
+ return ecdh;
|
|
+ #endif
|
|
+ }
|
|
+
|
|
+ mbedtls_ecp_point_free(&ecdh->Q);
|
|
+ mbedtls_ecp_group_free(&ecdh->grp);
|
|
+ mbedtls_ecdh_free(&ecdh->ctx);
|
|
+ os_free(ecdh);
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+struct wpabuf * crypto_ecdh_get_pubkey(struct crypto_ecdh *ecdh, int inc_y)
|
|
+{
|
|
+ mbedtls_ecp_group *grp = &ecdh->grp;
|
|
+ size_t len = CRYPTO_EC_plen(grp);
|
|
+ #ifdef MBEDTLS_ECP_MONTGOMERY_ENABLED
|
|
+ /* len */
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED
|
|
+ if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS)
|
|
+ len = inc_y ? len*2+1 : len+1;
|
|
+ #endif
|
|
+ struct wpabuf *buf = wpabuf_alloc(len);
|
|
+ if (buf == NULL)
|
|
+ return NULL;
|
|
+ inc_y = inc_y ? MBEDTLS_ECP_PF_UNCOMPRESSED : MBEDTLS_ECP_PF_COMPRESSED;
|
|
+ if (mbedtls_ecp_point_write_binary(grp, &ecdh->Q, inc_y, &len,
|
|
+ wpabuf_mhead_u8(buf), len) == 0) {
|
|
+ wpabuf_put(buf, len);
|
|
+ return buf;
|
|
+ }
|
|
+
|
|
+ wpabuf_free(buf);
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
|
|
+static int crypto_mbedtls_short_weierstrass_derive_y(mbedtls_ecp_group *grp,
|
|
+ mbedtls_mpi *bn,
|
|
+ int parity_bit)
|
|
+{
|
|
+ /* y^2 = x^3 + ax + b
|
|
+ * sqrt(w) = w^((p+1)/4) mod p (for prime p where p = 3 mod 4) */
|
|
+ mbedtls_mpi *cy2 = (mbedtls_mpi *)
|
|
+ crypto_ec_point_compute_y_sqr((struct crypto_ec *)grp,
|
|
+ (const struct crypto_bignum *)bn); /*x*/
|
|
+ if (cy2 == NULL)
|
|
+ return -1;
|
|
+
|
|
+ /*mbedtls_mpi_free(bn);*/
|
|
+ /*(reuse bn to store result (y))*/
|
|
+
|
|
+ mbedtls_mpi exp;
|
|
+ mbedtls_mpi_init(&exp);
|
|
+ int ret = mbedtls_mpi_get_bit(&grp->P, 0) != 1 /*(p = 3 mod 4)*/
|
|
+ || mbedtls_mpi_get_bit(&grp->P, 1) != 1 /*(p = 3 mod 4)*/
|
|
+ || mbedtls_mpi_add_int(&exp, &grp->P, 1)
|
|
+ || mbedtls_mpi_shift_r(&exp, 2)
|
|
+ || mbedtls_mpi_exp_mod(bn, cy2, &exp, &grp->P, NULL)
|
|
+ || (mbedtls_mpi_get_bit(bn, 0) != parity_bit
|
|
+ && mbedtls_mpi_sub_mpi(bn, &grp->P, bn));
|
|
+ mbedtls_mpi_free(&exp);
|
|
+ mbedtls_mpi_free(cy2);
|
|
+ os_free(cy2);
|
|
+ return ret;
|
|
+}
|
|
+#endif
|
|
+
|
|
+struct wpabuf * crypto_ecdh_set_peerkey(struct crypto_ecdh *ecdh, int inc_y,
|
|
+ const u8 *key, size_t len)
|
|
+{
|
|
+ if (len == 0) /*(invalid peer key)*/
|
|
+ return NULL;
|
|
+
|
|
+ mbedtls_ecp_group *grp = &ecdh->grp;
|
|
+
|
|
+ #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
|
|
+ if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) {
|
|
+ /* add header for mbedtls_ecdh_read_public() */
|
|
+ u8 buf[256];
|
|
+ if (sizeof(buf)-1 < len)
|
|
+ return NULL;
|
|
+ buf[0] = (u8)(len);
|
|
+ os_memcpy(buf+1, key, len);
|
|
+
|
|
+ if (inc_y) {
|
|
+ if (!(len & 1)) { /*(dpp code/tests does not include tag?!?)*/
|
|
+ if (sizeof(buf)-2 < len)
|
|
+ return NULL;
|
|
+ buf[0] = (u8)(1+len);
|
|
+ buf[1] = 0x04;
|
|
+ os_memcpy(buf+2, key, len);
|
|
+ }
|
|
+ len >>= 1; /*(repurpose len to prime_len)*/
|
|
+ }
|
|
+ else if (key[0] == 0x02 || key[0] == 0x03) { /* (inc_y == 0) */
|
|
+ --len; /*(repurpose len to prime_len)*/
|
|
+
|
|
+ /* mbedtls_ecp_point_read_binary() does not currently support
|
|
+ * MBEDTLS_ECP_PF_COMPRESSED format (buf[1] = 0x02 or 0x03)
|
|
+ * (returns MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE) */
|
|
+
|
|
+ /* derive y, amend buf[] with y for UNCOMPRESSED format */
|
|
+ if (sizeof(buf)-2 < len*2 || len == 0)
|
|
+ return NULL;
|
|
+ buf[0] = (u8)(1+len*2);
|
|
+ buf[1] = 0x04;
|
|
+ mbedtls_mpi bn;
|
|
+ mbedtls_mpi_init(&bn);
|
|
+ int ret = mbedtls_mpi_read_binary(&bn, key+1, len)
|
|
+ || crypto_mbedtls_short_weierstrass_derive_y(grp, &bn,
|
|
+ key[0] & 1)
|
|
+ || mbedtls_mpi_write_binary(&bn, buf+2+len, len);
|
|
+ mbedtls_mpi_free(&bn);
|
|
+ if (ret != 0)
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ if (key[0] == 0) /*(repurpose len to prime_len)*/
|
|
+ len = CRYPTO_EC_plen(grp);
|
|
+
|
|
+ if (mbedtls_ecdh_read_public(&ecdh->ctx, buf, buf[0]+1))
|
|
+ return NULL;
|
|
+ }
|
|
+ #endif
|
|
+ #if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
|
|
+ if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_MONTGOMERY) {
|
|
+ if (mbedtls_ecdh_read_public(&ecdh->ctx, key, len))
|
|
+ return NULL;
|
|
+ }
|
|
+ #endif
|
|
+
|
|
+ struct wpabuf *buf = wpabuf_alloc(len);
|
|
+ if (buf == NULL)
|
|
+ return NULL;
|
|
+
|
|
+ if (mbedtls_ecdh_calc_secret(&ecdh->ctx, &len,
|
|
+ wpabuf_mhead(buf), len,
|
|
+ mbedtls_ctr_drbg_random,
|
|
+ crypto_mbedtls_ctr_drbg()) == 0) {
|
|
+ wpabuf_put(buf, len);
|
|
+ return buf;
|
|
+ }
|
|
+
|
|
+ wpabuf_clear_free(buf);
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+void crypto_ecdh_deinit(struct crypto_ecdh *ecdh)
|
|
+{
|
|
+ if (ecdh == NULL)
|
|
+ return;
|
|
+ mbedtls_ecp_point_free(&ecdh->Q);
|
|
+ mbedtls_ecp_group_free(&ecdh->grp);
|
|
+ mbedtls_ecdh_free(&ecdh->ctx);
|
|
+ os_free(ecdh);
|
|
+}
|
|
+
|
|
+size_t crypto_ecdh_prime_len(struct crypto_ecdh *ecdh)
|
|
+{
|
|
+ return CRYPTO_EC_plen(&ecdh->grp);
|
|
+}
|
|
+
|
|
+#endif /* CRYPTO_MBEDTLS_CRYPTO_ECDH */
|
|
+
|
|
+
|
|
+#ifdef CRYPTO_MBEDTLS_CRYPTO_EC
|
|
+
|
|
+#include <mbedtls/ecp.h>
|
|
+
|
|
+struct crypto_ec *crypto_ec_init(int group)
|
|
+{
|
|
+ mbedtls_ecp_group_id grp_id =
|
|
+ crypto_mbedtls_ecp_group_id_from_ike_id(group);
|
|
+ if (grp_id == MBEDTLS_ECP_DP_NONE)
|
|
+ return NULL;
|
|
+ mbedtls_ecp_group *e = os_malloc(sizeof(*e));
|
|
+ if (e == NULL)
|
|
+ return NULL;
|
|
+ mbedtls_ecp_group_init(e);
|
|
+ if (mbedtls_ecp_group_load(e, grp_id) == 0)
|
|
+ return (struct crypto_ec *)e;
|
|
+
|
|
+ mbedtls_ecp_group_free(e);
|
|
+ os_free(e);
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+void crypto_ec_deinit(struct crypto_ec *e)
|
|
+{
|
|
+ mbedtls_ecp_group_free((mbedtls_ecp_group *)e);
|
|
+ os_free(e);
|
|
+}
|
|
+
|
|
+size_t crypto_ec_prime_len(struct crypto_ec *e)
|
|
+{
|
|
+ return CRYPTO_EC_plen(e);
|
|
+}
|
|
+
|
|
+size_t crypto_ec_prime_len_bits(struct crypto_ec *e)
|
|
+{
|
|
+ return CRYPTO_EC_pbits(e);
|
|
+}
|
|
+
|
|
+size_t crypto_ec_order_len(struct crypto_ec *e)
|
|
+{
|
|
+ return (mbedtls_mpi_bitlen(CRYPTO_EC_N(e)) + 7) / 8;
|
|
+}
|
|
+
|
|
+const struct crypto_bignum *crypto_ec_get_prime(struct crypto_ec *e)
|
|
+{
|
|
+ return (const struct crypto_bignum *)CRYPTO_EC_P(e);
|
|
+}
|
|
+
|
|
+const struct crypto_bignum *crypto_ec_get_order(struct crypto_ec *e)
|
|
+{
|
|
+ return (const struct crypto_bignum *)CRYPTO_EC_N(e);
|
|
+}
|
|
+
|
|
+const struct crypto_bignum *crypto_ec_get_a(struct crypto_ec *e)
|
|
+{
|
|
+ static const uint8_t secp256r1_a[] =
|
|
+ {0xff,0xff,0xff,0xff,0x00,0x00,0x00,0x01,
|
|
+ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
|
|
+ 0x00,0x00,0x00,0x00,0xff,0xff,0xff,0xff,
|
|
+ 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc};
|
|
+ static const uint8_t secp384r1_a[] =
|
|
+ {0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
|
|
+ 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
|
|
+ 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
|
|
+ 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,
|
|
+ 0xff,0xff,0xff,0xff,0x00,0x00,0x00,0x00,
|
|
+ 0x00,0x00,0x00,0x00,0xff,0xff,0xff,0xfc};
|
|
+ static const uint8_t secp521r1_a[] =
|
|
+ {0x01,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
|
|
+ 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
|
|
+ 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
|
|
+ 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
|
|
+ 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
|
|
+ 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
|
|
+ 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
|
|
+ 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
|
|
+ 0xff,0xfc};
|
|
+ static const uint8_t secp192r1_a[] =
|
|
+ {0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
|
|
+ 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,
|
|
+ 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfc};
|
|
+ static const uint8_t secp224r1_a[] =
|
|
+ {0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
|
|
+ 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xfe,
|
|
+ 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
|
|
+ 0xff,0xff,0xff,0xfe};
|
|
+
|
|
+ const uint8_t *bin = NULL;
|
|
+ size_t len = 0;
|
|
+
|
|
+ /* (mbedtls groups matching supported sswu_curve_param() IKE groups) */
|
|
+ switch (((mbedtls_ecp_group *)e)->id) {
|
|
+ #ifdef MBEDTLS_ECP_DP_SECP256R1_ENABLED
|
|
+ case MBEDTLS_ECP_DP_SECP256R1:
|
|
+ bin = secp256r1_a;
|
|
+ len = sizeof(secp256r1_a);
|
|
+ break;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_SECP384R1_ENABLED
|
|
+ case MBEDTLS_ECP_DP_SECP384R1:
|
|
+ bin = secp384r1_a;
|
|
+ len = sizeof(secp384r1_a);
|
|
+ break;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_SECP521R1_ENABLED
|
|
+ case MBEDTLS_ECP_DP_SECP521R1:
|
|
+ bin = secp521r1_a;
|
|
+ len = sizeof(secp521r1_a);
|
|
+ break;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_SECP192R1_ENABLED
|
|
+ case MBEDTLS_ECP_DP_SECP192R1:
|
|
+ bin = secp192r1_a;
|
|
+ len = sizeof(secp192r1_a);
|
|
+ break;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_SECP224R1_ENABLED
|
|
+ case MBEDTLS_ECP_DP_SECP224R1:
|
|
+ bin = secp224r1_a;
|
|
+ len = sizeof(secp224r1_a);
|
|
+ break;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_BP256R1_ENABLED
|
|
+ case MBEDTLS_ECP_DP_BP256R1:
|
|
+ return (const struct crypto_bignum *)CRYPTO_EC_A(e);
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_BP384R1_ENABLED
|
|
+ case MBEDTLS_ECP_DP_BP384R1:
|
|
+ return (const struct crypto_bignum *)CRYPTO_EC_A(e);
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_BP512R1_ENABLED
|
|
+ case MBEDTLS_ECP_DP_BP512R1:
|
|
+ return (const struct crypto_bignum *)CRYPTO_EC_A(e);
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_CURVE25519_ENABLED
|
|
+ case MBEDTLS_ECP_DP_CURVE25519:
|
|
+ return (const struct crypto_bignum *)CRYPTO_EC_A(e);
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_DP_CURVE448_ENABLED
|
|
+ case MBEDTLS_ECP_DP_CURVE448:
|
|
+ return (const struct crypto_bignum *)CRYPTO_EC_A(e);
|
|
+ #endif
|
|
+ default:
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ /*(note: not thread-safe; returns file-scoped static storage)*/
|
|
+ if (mbedtls_mpi_read_binary(&mpi_sw_A, bin, len) == 0)
|
|
+ return (const struct crypto_bignum *)&mpi_sw_A;
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+const struct crypto_bignum *crypto_ec_get_b(struct crypto_ec *e)
|
|
+{
|
|
+ return (const struct crypto_bignum *)CRYPTO_EC_B(e);
|
|
+}
|
|
+
|
|
+const struct crypto_ec_point * crypto_ec_get_generator(struct crypto_ec *e)
|
|
+{
|
|
+ return (const struct crypto_ec_point *)CRYPTO_EC_G(e);
|
|
+}
|
|
+
|
|
+struct crypto_ec_point *crypto_ec_point_init(struct crypto_ec *e)
|
|
+{
|
|
+ mbedtls_ecp_point *p = os_malloc(sizeof(*p));
|
|
+ if (p != NULL)
|
|
+ mbedtls_ecp_point_init(p);
|
|
+ return (struct crypto_ec_point *)p;
|
|
+}
|
|
+
|
|
+void crypto_ec_point_deinit(struct crypto_ec_point *p, int clear)
|
|
+{
|
|
+ mbedtls_ecp_point_free((mbedtls_ecp_point *)p);
|
|
+ os_free(p);
|
|
+}
|
|
+
|
|
+int crypto_ec_point_x(struct crypto_ec *e, const struct crypto_ec_point *p,
|
|
+ struct crypto_bignum *x)
|
|
+{
|
|
+ mbedtls_mpi *px = &((mbedtls_ecp_point *)p)->MBEDTLS_PRIVATE(X);
|
|
+ return mbedtls_mpi_copy((mbedtls_mpi *)x, px)
|
|
+ ? -1
|
|
+ : 0;
|
|
+}
|
|
+
|
|
+int crypto_ec_point_to_bin(struct crypto_ec *e,
|
|
+ const struct crypto_ec_point *point, u8 *x, u8 *y)
|
|
+{
|
|
+ /* crypto.h documents crypto_ec_point_to_bin() output is big-endian */
|
|
+ size_t len = CRYPTO_EC_plen(e);
|
|
+ if (x) {
|
|
+ mbedtls_mpi *px = &((mbedtls_ecp_point *)point)->MBEDTLS_PRIVATE(X);
|
|
+ if (mbedtls_mpi_write_binary(px, x, len))
|
|
+ return -1;
|
|
+ }
|
|
+ if (y) {
|
|
+ #if 0 /*(should not be necessary; py mpi should be in initial state)*/
|
|
+ #ifdef MBEDTLS_ECP_MONTGOMERY_ENABLED
|
|
+ if (mbedtls_ecp_get_type((mbedtls_ecp_group *)e)
|
|
+ == MBEDTLS_ECP_TYPE_MONTGOMERY) {
|
|
+ os_memset(y, 0, len);
|
|
+ return 0;
|
|
+ }
|
|
+ #endif
|
|
+ #endif
|
|
+ mbedtls_mpi *py = &((mbedtls_ecp_point *)point)->MBEDTLS_PRIVATE(Y);
|
|
+ if (mbedtls_mpi_write_binary(py, y, len))
|
|
+ return -1;
|
|
+ }
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+struct crypto_ec_point * crypto_ec_point_from_bin(struct crypto_ec *e,
|
|
+ const u8 *val)
|
|
+{
|
|
+ size_t len = CRYPTO_EC_plen(e);
|
|
+ mbedtls_ecp_point *p = os_malloc(sizeof(*p));
|
|
+ u8 buf[1+MBEDTLS_MPI_MAX_SIZE*2];
|
|
+ if (p == NULL)
|
|
+ return NULL;
|
|
+ mbedtls_ecp_point_init(p);
|
|
+
|
|
+ #ifdef MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED
|
|
+ if (mbedtls_ecp_get_type((mbedtls_ecp_group *)e)
|
|
+ == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) {
|
|
+ #if 0 /* prefer alternative to MBEDTLS_PRIVATE() access */
|
|
+ mbedtls_mpi *px = &((mbedtls_ecp_point *)p)->MBEDTLS_PRIVATE(X);
|
|
+ mbedtls_mpi *py = &((mbedtls_ecp_point *)p)->MBEDTLS_PRIVATE(Y);
|
|
+ mbedtls_mpi *pz = &((mbedtls_ecp_point *)p)->MBEDTLS_PRIVATE(Z);
|
|
+
|
|
+ if (mbedtls_mpi_read_binary(px, val, len) == 0
|
|
+ && mbedtls_mpi_read_binary(py, val + len, len) == 0
|
|
+ && mbedtls_mpi_lset(pz, 1) == 0)
|
|
+ return (struct crypto_ec_point *)p;
|
|
+ #else
|
|
+ buf[0] = 0x04;
|
|
+ os_memcpy(buf+1, val, len*2);
|
|
+ if (mbedtls_ecp_point_read_binary((mbedtls_ecp_group *)e, p,
|
|
+ buf, 1+len*2) == 0)
|
|
+ return (struct crypto_ec_point *)p;
|
|
+ #endif
|
|
+ }
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_MONTGOMERY_ENABLED
|
|
+ if (mbedtls_ecp_get_type((mbedtls_ecp_group *)e)
|
|
+ == MBEDTLS_ECP_TYPE_MONTGOMERY) {
|
|
+ /* crypto.h interface documents crypto_ec_point_from_bin()
|
|
+ * val is length: prime_len * 2 and is big-endian
|
|
+ * (Short Weierstrass is assumed by hostap)
|
|
+ * Reverse to little-endian format for Montgomery */
|
|
+ for (unsigned int i = 0; i < len; ++i)
|
|
+ buf[i] = val[len-1-i];
|
|
+ if (mbedtls_ecp_point_read_binary((mbedtls_ecp_group *)e, p,
|
|
+ buf, len) == 0)
|
|
+ return (struct crypto_ec_point *)p;
|
|
+ }
|
|
+ #endif
|
|
+
|
|
+ mbedtls_ecp_point_free(p);
|
|
+ os_free(p);
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+int crypto_ec_point_add(struct crypto_ec *e, const struct crypto_ec_point *a,
|
|
+ const struct crypto_ec_point *b,
|
|
+ struct crypto_ec_point *c)
|
|
+{
|
|
+ /* mbedtls does not provide an mbedtls_ecp_point add function */
|
|
+ mbedtls_mpi one;
|
|
+ mbedtls_mpi_init(&one);
|
|
+ int ret = mbedtls_mpi_lset(&one, 1)
|
|
+ || mbedtls_ecp_muladd(
|
|
+ (mbedtls_ecp_group *)e, (mbedtls_ecp_point *)c,
|
|
+ &one, (const mbedtls_ecp_point *)a,
|
|
+ &one, (const mbedtls_ecp_point *)b) ? -1 : 0;
|
|
+ mbedtls_mpi_free(&one);
|
|
+ return ret;
|
|
+}
|
|
+
|
|
+int crypto_ec_point_mul(struct crypto_ec *e, const struct crypto_ec_point *p,
|
|
+ const struct crypto_bignum *b,
|
|
+ struct crypto_ec_point *res)
|
|
+{
|
|
+ return mbedtls_ecp_mul(
|
|
+ (mbedtls_ecp_group *)e, (mbedtls_ecp_point *)res,
|
|
+ (const mbedtls_mpi *)b, (const mbedtls_ecp_point *)p,
|
|
+ mbedtls_ctr_drbg_random, crypto_mbedtls_ctr_drbg()) ? -1 : 0;
|
|
+}
|
|
+
|
|
+int crypto_ec_point_invert(struct crypto_ec *e, struct crypto_ec_point *p)
|
|
+{
|
|
+ if (mbedtls_ecp_get_type((mbedtls_ecp_group *)e)
|
|
+ == MBEDTLS_ECP_TYPE_MONTGOMERY) {
|
|
+ /* e.g. MBEDTLS_ECP_DP_CURVE25519 and MBEDTLS_ECP_DP_CURVE448 */
|
|
+ wpa_printf(MSG_ERROR,
|
|
+ "%s not implemented for Montgomery curves",__func__);
|
|
+ return -1;
|
|
+ }
|
|
+
|
|
+ /* mbedtls does not provide an mbedtls_ecp_point invert function */
|
|
+ /* below works for Short Weierstrass; incorrect for Montgomery curves */
|
|
+ mbedtls_mpi *py = &((mbedtls_ecp_point *)p)->MBEDTLS_PRIVATE(Y);
|
|
+ return mbedtls_ecp_is_zero((mbedtls_ecp_point *)p) /*point at infinity*/
|
|
+ || mbedtls_mpi_cmp_int(py, 0) == 0 /*point is its own inverse*/
|
|
+ || mbedtls_mpi_sub_abs(py, CRYPTO_EC_P(e), py) == 0 ? 0 : -1;
|
|
+}
|
|
+
|
|
+#ifdef MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED
|
|
+static int
|
|
+crypto_ec_point_y_sqr_weierstrass(mbedtls_ecp_group *e, const mbedtls_mpi *x,
|
|
+ mbedtls_mpi *y2)
|
|
+{
|
|
+ /* MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS y^2 = x^3 + a x + b */
|
|
+
|
|
+ /* Short Weierstrass elliptic curve group w/o A set treated as A = -3 */
|
|
+ /* Attempt to match mbedtls/library/ecp.c:ecp_check_pubkey_sw() behavior
|
|
+ * and elsewhere in mbedtls/library/ecp.c where if A is not set, it is
|
|
+ * treated as if A = -3. */
|
|
+
|
|
+ #if 0
|
|
+ /* y^2 = x^3 + ax + b */
|
|
+ mbedtls_mpi *A = &e->A;
|
|
+ mbedtls_mpi t, A_neg3;
|
|
+ if (&e->A.p == NULL) {
|
|
+ mbedtls_mpi_init(&A_neg3);
|
|
+ if (mbedtls_mpi_lset(&A_neg3, -3) != 0) {
|
|
+ mbedtls_mpi_free(&A_neg3);
|
|
+ return -1;
|
|
+ }
|
|
+ A = &A_neg3;
|
|
+ }
|
|
+ mbedtls_mpi_init(&t);
|
|
+ int ret = /* x^3 */
|
|
+ mbedtls_mpi_lset(&t, 3)
|
|
+ || mbedtls_mpi_exp_mod(y2, x, &t, &e->P, NULL)
|
|
+ /* ax */
|
|
+ || mbedtls_mpi_mul_mpi(y2, y2, A)
|
|
+ || mbedtls_mpi_mod_mpi(&t, &t, &e->P)
|
|
+ /* ax + b */
|
|
+ || mbedtls_mpi_add_mpi(&t, &t, &e->B)
|
|
+ || mbedtls_mpi_mod_mpi(&t, &t, &e->P)
|
|
+ /* x^3 + ax + b */
|
|
+ || mbedtls_mpi_add_mpi(&t, &t, y2) /* ax + b + x^3 */
|
|
+ || mbedtls_mpi_mod_mpi(y2, &t, &e->P);
|
|
+ mbedtls_mpi_free(&t);
|
|
+ if (A == &A_neg3)
|
|
+ mbedtls_mpi_free(&A_neg3);
|
|
+ return ret; /* 0: success, non-zero: failure */
|
|
+ #else
|
|
+ /* y^2 = x^3 + ax + b = (x^2 + a)x + b */
|
|
+ return /* x^2 */
|
|
+ mbedtls_mpi_mul_mpi(y2, x, x)
|
|
+ || mbedtls_mpi_mod_mpi(y2, y2, &e->P)
|
|
+ /* x^2 + a */
|
|
+ || (e->A.MBEDTLS_PRIVATE(p)
|
|
+ ? mbedtls_mpi_add_mpi(y2, y2, &e->A)
|
|
+ : mbedtls_mpi_sub_int(y2, y2, 3))
|
|
+ || mbedtls_mpi_mod_mpi(y2, y2, &e->P)
|
|
+ /* (x^2 + a)x */
|
|
+ || mbedtls_mpi_mul_mpi(y2, y2, x)
|
|
+ || mbedtls_mpi_mod_mpi(y2, y2, &e->P)
|
|
+ /* (x^2 + a)x + b */
|
|
+ || mbedtls_mpi_add_mpi(y2, y2, &e->B)
|
|
+ || mbedtls_mpi_mod_mpi(y2, y2, &e->P);
|
|
+ #endif
|
|
+}
|
|
+#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
|
|
+
|
|
+#if 0 /* not used by hostap */
|
|
+#ifdef MBEDTLS_ECP_MONTGOMERY_ENABLED
|
|
+static int
|
|
+crypto_ec_point_y_sqr_montgomery(mbedtls_ecp_group *e, const mbedtls_mpi *x,
|
|
+ mbedtls_mpi *y2)
|
|
+{
|
|
+ /* XXX: !!! must be reviewed and audited for correctness !!! */
|
|
+
|
|
+ /* MBEDTLS_ECP_TYPE_MONTGOMERY y^2 = x^3 + a x^2 + x */
|
|
+
|
|
+ /* y^2 = x^3 + a x^2 + x = (x + a)x^2 + x */
|
|
+ mbedtls_mpi x2;
|
|
+ mbedtls_mpi_init(&x2);
|
|
+ int ret = /* x^2 */
|
|
+ mbedtls_mpi_mul_mpi(&x2, x, x)
|
|
+ || mbedtls_mpi_mod_mpi(&x2, &x2, &e->P)
|
|
+ /* x + a */
|
|
+ || mbedtls_mpi_add_mpi(y2, x, &e->A)
|
|
+ || mbedtls_mpi_mod_mpi(y2, y2, &e->P)
|
|
+ /* (x + a)x^2 */
|
|
+ || mbedtls_mpi_mul_mpi(y2, y2, &x2)
|
|
+ || mbedtls_mpi_mod_mpi(y2, y2, &e->P)
|
|
+ /* (x + a)x^2 + x */
|
|
+ || mbedtls_mpi_add_mpi(y2, y2, x)
|
|
+ || mbedtls_mpi_mod_mpi(y2, y2, &e->P);
|
|
+ mbedtls_mpi_free(&x2);
|
|
+ return ret; /* 0: success, non-zero: failure */
|
|
+}
|
|
+#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */
|
|
+#endif
|
|
+
|
|
+struct crypto_bignum *
|
|
+crypto_ec_point_compute_y_sqr(struct crypto_ec *e,
|
|
+ const struct crypto_bignum *x)
|
|
+{
|
|
+ mbedtls_mpi *y2 = os_malloc(sizeof(*y2));
|
|
+ if (y2 == NULL)
|
|
+ return NULL;
|
|
+ mbedtls_mpi_init(y2);
|
|
+
|
|
+ #ifdef MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED
|
|
+ if (mbedtls_ecp_get_type((mbedtls_ecp_group *)e)
|
|
+ == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS
|
|
+ && crypto_ec_point_y_sqr_weierstrass((mbedtls_ecp_group *)e,
|
|
+ (const mbedtls_mpi *)x,
|
|
+ y2) == 0)
|
|
+ return (struct crypto_bignum *)y2;
|
|
+ #endif
|
|
+ #if 0 /* not used by hostap */
|
|
+ #ifdef MBEDTLS_ECP_MONTGOMERY_ENABLED
|
|
+ if (mbedtls_ecp_get_type((mbedtls_ecp_group *)e)
|
|
+ == MBEDTLS_ECP_TYPE_MONTGOMERY
|
|
+ && crypto_ec_point_y_sqr_montgomery((mbedtls_ecp_group *)e,
|
|
+ (const mbedtls_mpi *)x,
|
|
+ y2) == 0)
|
|
+ return (struct crypto_bignum *)y2;
|
|
+ #endif
|
|
+ #endif
|
|
+
|
|
+ mbedtls_mpi_free(y2);
|
|
+ os_free(y2);
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+int crypto_ec_point_is_at_infinity(struct crypto_ec *e,
|
|
+ const struct crypto_ec_point *p)
|
|
+{
|
|
+ return mbedtls_ecp_is_zero((mbedtls_ecp_point *)p);
|
|
+}
|
|
+
|
|
+int crypto_ec_point_is_on_curve(struct crypto_ec *e,
|
|
+ const struct crypto_ec_point *p)
|
|
+{
|
|
+ #if 1
|
|
+ return mbedtls_ecp_check_pubkey((const mbedtls_ecp_group *)e,
|
|
+ (const mbedtls_ecp_point *)p) == 0;
|
|
+ #else
|
|
+ /* compute y^2 mod P and compare to y^2 mod P */
|
|
+ /*(ref: src/eap_common/eap_pwd_common.c:compute_password_element())*/
|
|
+ const mbedtls_mpi *px = &((const mbedtls_ecp_point *)p)->MBEDTLS_PRIVATE(X);
|
|
+ mbedtls_mpi *cy2 = (mbedtls_mpi *)
|
|
+ crypto_ec_point_compute_y_sqr(e, (const struct crypto_bignum *)px);
|
|
+ if (cy2 == NULL)
|
|
+ return 0;
|
|
+
|
|
+ mbedtls_mpi y2;
|
|
+ mbedtls_mpi_init(&y2);
|
|
+ const mbedtls_mpi *py = &((const mbedtls_ecp_point *)p)->MBEDTLS_PRIVATE(Y);
|
|
+ int is_on_curve = mbedtls_mpi_mul_mpi(&y2, py, py) /* y^2 mod P */
|
|
+ || mbedtls_mpi_mod_mpi(&y2, &y2, CRYPTO_EC_P(e))
|
|
+ || mbedtls_mpi_cmp_mpi(&y2, cy2) != 0 ? 0 : 1;
|
|
+
|
|
+ mbedtls_mpi_free(&y2);
|
|
+ mbedtls_mpi_free(cy2);
|
|
+ os_free(cy2);
|
|
+ return is_on_curve;
|
|
+ #endif
|
|
+}
|
|
+
|
|
+int crypto_ec_point_cmp(const struct crypto_ec *e,
|
|
+ const struct crypto_ec_point *a,
|
|
+ const struct crypto_ec_point *b)
|
|
+{
|
|
+ return mbedtls_ecp_point_cmp((const mbedtls_ecp_point *)a,
|
|
+ (const mbedtls_ecp_point *)b);
|
|
+}
|
|
+
|
|
+#if !defined(CONFIG_NO_STDOUT_DEBUG)
|
|
+void crypto_ec_point_debug_print(const struct crypto_ec *e,
|
|
+ const struct crypto_ec_point *p,
|
|
+ const char *title)
|
|
+{
|
|
+ u8 x[MBEDTLS_MPI_MAX_SIZE];
|
|
+ u8 y[MBEDTLS_MPI_MAX_SIZE];
|
|
+ size_t len = CRYPTO_EC_plen(e);
|
|
+ /* crypto_ec_point_to_bin ought to take (const struct crypto_ec *e) */
|
|
+ struct crypto_ec *ee;
|
|
+ *(const struct crypto_ec **)&ee = e; /*(cast away const)*/
|
|
+ if (crypto_ec_point_to_bin(ee, p, x, y) == 0) {
|
|
+ if (title)
|
|
+ wpa_printf(MSG_DEBUG, "%s", title);
|
|
+ wpa_hexdump(MSG_DEBUG, "x:", x, len);
|
|
+ wpa_hexdump(MSG_DEBUG, "y:", y, len);
|
|
+ }
|
|
+}
|
|
+#endif
|
|
+
|
|
+
|
|
+struct crypto_ec_key * crypto_ec_key_parse_priv(const u8 *der, size_t der_len)
|
|
+{
|
|
+ mbedtls_pk_context *ctx = os_malloc(sizeof(*ctx));
|
|
+ if (ctx == NULL)
|
|
+ return NULL;
|
|
+ mbedtls_pk_init(ctx);
|
|
+ #if MBEDTLS_VERSION_NUMBER < 0x03000000 /* mbedtls 3.0.0 */
|
|
+ if (mbedtls_pk_parse_key(ctx, der, der_len, NULL, 0) == 0)
|
|
+ #else
|
|
+ if (mbedtls_pk_parse_key(ctx, der, der_len, NULL, 0,
|
|
+ mbedtls_ctr_drbg_random,
|
|
+ crypto_mbedtls_ctr_drbg()) == 0)
|
|
+ #endif
|
|
+ return (struct crypto_ec_key *)ctx;
|
|
+
|
|
+ mbedtls_pk_free(ctx);
|
|
+ os_free(ctx);
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+#ifdef CRYPTO_MBEDTLS_CRYPTO_HPKE
|
|
+#ifdef CONFIG_MODULE_TESTS
|
|
+/*(for crypto_module_tests.c)*/
|
|
+struct crypto_ec_key * crypto_ec_key_set_priv(int group,
|
|
+ const u8 *raw, size_t raw_len)
|
|
+{
|
|
+ mbedtls_ecp_group_id grp_id =
|
|
+ crypto_mbedtls_ecp_group_id_from_ike_id(group);
|
|
+ if (grp_id == MBEDTLS_ECP_DP_NONE)
|
|
+ return NULL;
|
|
+ const mbedtls_pk_info_t *pk_info =
|
|
+ mbedtls_pk_info_from_type(MBEDTLS_PK_ECKEY);
|
|
+ if (pk_info == NULL)
|
|
+ return NULL;
|
|
+ mbedtls_pk_context *ctx = os_malloc(sizeof(*ctx));
|
|
+ if (ctx == NULL)
|
|
+ return NULL;
|
|
+ mbedtls_pk_init(ctx);
|
|
+ if (mbedtls_pk_setup(ctx, pk_info) == 0
|
|
+ && mbedtls_ecp_read_key(grp_id,mbedtls_pk_ec(*ctx),raw,raw_len) == 0) {
|
|
+ return (struct crypto_ec_key *)ctx;
|
|
+ }
|
|
+
|
|
+ mbedtls_pk_free(ctx);
|
|
+ os_free(ctx);
|
|
+ return NULL;
|
|
+}
|
|
+#endif
|
|
+#endif
|
|
+
|
|
+#include <mbedtls/error.h>
|
|
+#include <mbedtls/oid.h>
|
|
+static int crypto_mbedtls_pk_parse_subpubkey_compressed(mbedtls_pk_context *ctx, const u8 *der, size_t der_len)
|
|
+{
|
|
+ /* The following is modified from:
|
|
+ * mbedtls/library/pkparse.c:mbedtls_pk_parse_subpubkey()
|
|
+ * mbedtls/library/pkparse.c:pk_get_pk_alg()
|
|
+ * mbedtls/library/pkparse.c:pk_use_ecparams()
|
|
+ */
|
|
+ mbedtls_pk_type_t pk_alg = MBEDTLS_PK_NONE;
|
|
+ const mbedtls_pk_info_t *pk_info;
|
|
+ int ret;
|
|
+ size_t len;
|
|
+ const unsigned char *end = der+der_len;
|
|
+ unsigned char *p;
|
|
+ *(const unsigned char **)&p = der;
|
|
+
|
|
+ if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
|
|
+ MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
|
|
+ {
|
|
+ return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, ret ) );
|
|
+ }
|
|
+
|
|
+ end = p + len;
|
|
+
|
|
+ /*
|
|
+ if( ( ret = pk_get_pk_alg( &p, end, &pk_alg, &alg_params ) ) != 0 )
|
|
+ return( ret );
|
|
+ */
|
|
+ mbedtls_asn1_buf alg_oid, params;
|
|
+ memset( ¶ms, 0, sizeof(mbedtls_asn1_buf) );
|
|
+ if( ( ret = mbedtls_asn1_get_alg( &p, end, &alg_oid, ¶ms ) ) != 0 )
|
|
+ return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_ALG, ret ) );
|
|
+ if( mbedtls_oid_get_pk_alg( &alg_oid, &pk_alg ) != 0 )
|
|
+ return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
|
|
+
|
|
+ if( ( ret = mbedtls_asn1_get_bitstring_null( &p, end, &len ) ) != 0 )
|
|
+ return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_PUBKEY, ret ) );
|
|
+
|
|
+ if( p + len != end )
|
|
+ return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_PK_INVALID_PUBKEY,
|
|
+ MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
|
|
+
|
|
+ if( ( pk_info = mbedtls_pk_info_from_type( pk_alg ) ) == NULL )
|
|
+ return( MBEDTLS_ERR_PK_UNKNOWN_PK_ALG );
|
|
+
|
|
+ if( ( ret = mbedtls_pk_setup( ctx, pk_info ) ) != 0 )
|
|
+ return( ret );
|
|
+
|
|
+ /* assume mbedtls_pk_parse_subpubkey(&der, der+der_len, ctx)
|
|
+ * has already run with ctx initialized up to pk_get_ecpubkey(),
|
|
+ * and pk_get_ecpubkey() has returned MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE
|
|
+ *
|
|
+ * mbedtls mbedtls_ecp_point_read_binary()
|
|
+ * does not handle point in COMPRESSED format
|
|
+ *
|
|
+ * (validate assumption that algorithm is EC) */
|
|
+ mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*ctx);
|
|
+ if (ecp_kp == NULL)
|
|
+ return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
|
|
+ mbedtls_ecp_group *ecp_kp_grp = &ecp_kp->MBEDTLS_PRIVATE(grp);
|
|
+ mbedtls_ecp_point *ecp_kp_Q = &ecp_kp->MBEDTLS_PRIVATE(Q);
|
|
+ mbedtls_ecp_group_id grp_id;
|
|
+
|
|
+
|
|
+ /* mbedtls/library/pkparse.c:pk_use_ecparams() */
|
|
+
|
|
+ if( params.tag == MBEDTLS_ASN1_OID )
|
|
+ {
|
|
+ if( mbedtls_oid_get_ec_grp( ¶ms, &grp_id ) != 0 )
|
|
+ return( MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE );
|
|
+ }
|
|
+ else
|
|
+ {
|
|
+#if defined(MBEDTLS_PK_PARSE_EC_EXTENDED)
|
|
+ /*(large code block not copied from mbedtls; unsupported)*/
|
|
+ #if 0
|
|
+ if( ( ret = pk_group_id_from_specified( ¶ms, &grp_id ) ) != 0 )
|
|
+ return( ret );
|
|
+ #endif
|
|
+#endif
|
|
+ return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
|
|
+ }
|
|
+
|
|
+ /*
|
|
+ * grp may already be initialized; if so, make sure IDs match
|
|
+ */
|
|
+ if( ecp_kp_grp->id != MBEDTLS_ECP_DP_NONE && ecp_kp_grp->id != grp_id )
|
|
+ return( MBEDTLS_ERR_PK_KEY_INVALID_FORMAT );
|
|
+
|
|
+ if( ( ret = mbedtls_ecp_group_load( ecp_kp_grp, grp_id ) ) != 0 )
|
|
+ return( ret );
|
|
+
|
|
+
|
|
+ /* (validate assumption that EC point is in COMPRESSED format) */
|
|
+ len = CRYPTO_EC_plen(ecp_kp_grp);
|
|
+ if( mbedtls_ecp_get_type(ecp_kp_grp) != MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS
|
|
+ || (end - p) != 1+len
|
|
+ || (*p != 0x02 && *p != 0x03) )
|
|
+ return( MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE );
|
|
+
|
|
+ /* Instead of calling mbedtls/library/pkparse.c:pk_get_ecpubkey() to call
|
|
+ * mbedtls_ecp_point_read_binary(), manually parse point into ecp_kp_Q */
|
|
+ mbedtls_mpi *X = &ecp_kp_Q->MBEDTLS_PRIVATE(X);
|
|
+ mbedtls_mpi *Y = &ecp_kp_Q->MBEDTLS_PRIVATE(Y);
|
|
+ mbedtls_mpi *Z = &ecp_kp_Q->MBEDTLS_PRIVATE(Z);
|
|
+ ret = mbedtls_mpi_lset(Z, 1);
|
|
+ if (ret != 0)
|
|
+ return( ret );
|
|
+ ret = mbedtls_mpi_read_binary(X, p+1, len);
|
|
+ if (ret != 0)
|
|
+ return( ret );
|
|
+ /* derive Y
|
|
+ * (similar derivation of Y in crypto_mbedtls.c:crypto_ecdh_set_peerkey())*/
|
|
+ ret = mbedtls_mpi_copy(Y, X) /*(Y is used as input and output obj below)*/
|
|
+ || crypto_mbedtls_short_weierstrass_derive_y(ecp_kp_grp, Y, (*p & 1));
|
|
+ if (ret != 0)
|
|
+ return( ret );
|
|
+
|
|
+ return mbedtls_ecp_check_pubkey( ecp_kp_grp, ecp_kp_Q );
|
|
+}
|
|
+
|
|
+struct crypto_ec_key * crypto_ec_key_parse_pub(const u8 *der, size_t der_len)
|
|
+{
|
|
+ mbedtls_pk_context *ctx = os_malloc(sizeof(*ctx));
|
|
+ if (ctx == NULL)
|
|
+ return NULL;
|
|
+ mbedtls_pk_init(ctx);
|
|
+ /*int rc = mbedtls_pk_parse_subpubkey(&der, der+der_len, ctx);*/
|
|
+ int rc = mbedtls_pk_parse_public_key(ctx, der, der_len);
|
|
+ if (rc == 0)
|
|
+ return (struct crypto_ec_key *)ctx;
|
|
+ else if (rc == MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE) {
|
|
+ /* mbedtls mbedtls_ecp_point_read_binary()
|
|
+ * does not handle point in COMPRESSED format; parse internally */
|
|
+ rc = crypto_mbedtls_pk_parse_subpubkey_compressed(ctx,der,der_len);
|
|
+ if (rc == 0)
|
|
+ return (struct crypto_ec_key *)ctx;
|
|
+ }
|
|
+
|
|
+ mbedtls_pk_free(ctx);
|
|
+ os_free(ctx);
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+#ifdef CRYPTO_MBEDTLS_CRYPTO_EC_DPP
|
|
+
|
|
+static struct crypto_ec_key *
|
|
+crypto_ec_key_set_pub_point_for_group(mbedtls_ecp_group_id grp_id,
|
|
+ const mbedtls_ecp_point *pub,
|
|
+ const u8 *buf, size_t len)
|
|
+{
|
|
+ const mbedtls_pk_info_t *pk_info =
|
|
+ mbedtls_pk_info_from_type(MBEDTLS_PK_ECKEY);
|
|
+ if (pk_info == NULL)
|
|
+ return NULL;
|
|
+ mbedtls_pk_context *ctx = os_malloc(sizeof(*ctx));
|
|
+ if (ctx == NULL)
|
|
+ return NULL;
|
|
+ mbedtls_pk_init(ctx);
|
|
+ if (mbedtls_pk_setup(ctx, pk_info) == 0) {
|
|
+ /* (Is private key generation necessary for callers?)
|
|
+ * alt: gen key then overwrite Q
|
|
+ * mbedtls_ecp_gen_key(grp_id, ecp_kp,
|
|
+ * mbedtls_ctr_drbg_random,
|
|
+ * crypto_mbedtls_ctr_drbg()) == 0
|
|
+ */
|
|
+ mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*ctx);
|
|
+ mbedtls_ecp_group *ecp_kp_grp = &ecp_kp->MBEDTLS_PRIVATE(grp);
|
|
+ mbedtls_ecp_point *ecp_kp_Q = &ecp_kp->MBEDTLS_PRIVATE(Q);
|
|
+ mbedtls_mpi *ecp_kp_d = &ecp_kp->MBEDTLS_PRIVATE(d);
|
|
+ if (mbedtls_ecp_group_load(ecp_kp_grp, grp_id) == 0
|
|
+ && (pub
|
|
+ ? mbedtls_ecp_copy(ecp_kp_Q, pub) == 0
|
|
+ : mbedtls_ecp_point_read_binary(ecp_kp_grp, ecp_kp_Q,
|
|
+ buf, len) == 0)
|
|
+ && mbedtls_ecp_gen_privkey(ecp_kp_grp, ecp_kp_d,
|
|
+ mbedtls_ctr_drbg_random,
|
|
+ crypto_mbedtls_ctr_drbg()) == 0){
|
|
+ return (struct crypto_ec_key *)ctx;
|
|
+ }
|
|
+ }
|
|
+
|
|
+ mbedtls_pk_free(ctx);
|
|
+ os_free(ctx);
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+struct crypto_ec_key * crypto_ec_key_set_pub(int group, const u8 *x,
|
|
+ const u8 *y, size_t len)
|
|
+{
|
|
+ mbedtls_ecp_group_id grp_id =
|
|
+ crypto_mbedtls_ecp_group_id_from_ike_id(group);
|
|
+ if (grp_id == MBEDTLS_ECP_DP_NONE)
|
|
+ return NULL;
|
|
+ if (len > MBEDTLS_MPI_MAX_SIZE)
|
|
+ return NULL;
|
|
+ u8 buf[1+MBEDTLS_MPI_MAX_SIZE*2];
|
|
+ buf[0] = 0x04; /* assume x,y for Short Weierstrass */
|
|
+ os_memcpy(buf+1, x, len);
|
|
+ os_memcpy(buf+1+len, y, len);
|
|
+
|
|
+ return crypto_ec_key_set_pub_point_for_group(grp_id,NULL,buf,1+len*2);
|
|
+}
|
|
+
|
|
+struct crypto_ec_key *
|
|
+crypto_ec_key_set_pub_point(struct crypto_ec *e,
|
|
+ const struct crypto_ec_point *pub)
|
|
+{
|
|
+ mbedtls_ecp_group_id grp_id = ((mbedtls_ecp_group *)e)->id;
|
|
+ mbedtls_ecp_point *p = (mbedtls_ecp_point *)pub;
|
|
+ return crypto_ec_key_set_pub_point_for_group(grp_id, p, NULL, 0);
|
|
+}
|
|
+
|
|
+
|
|
+struct crypto_ec_key * crypto_ec_key_gen(int group)
|
|
+{
|
|
+ mbedtls_pk_context *ctx = os_malloc(sizeof(*ctx));
|
|
+ if (ctx == NULL)
|
|
+ return NULL;
|
|
+ mbedtls_pk_init(ctx);
|
|
+ if (crypto_mbedtls_keypair_gen(group, ctx) == 0)
|
|
+ return (struct crypto_ec_key *)ctx;
|
|
+ mbedtls_pk_free(ctx);
|
|
+ os_free(ctx);
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+#endif /* CRYPTO_MBEDTLS_CRYPTO_EC_DPP */
|
|
+
|
|
+void crypto_ec_key_deinit(struct crypto_ec_key *key)
|
|
+{
|
|
+ mbedtls_pk_free((mbedtls_pk_context *)key);
|
|
+ os_free(key);
|
|
+}
|
|
+
|
|
+struct wpabuf * crypto_ec_key_get_subject_public_key(struct crypto_ec_key *key)
|
|
+{
|
|
+ /* (similar to crypto_ec_key_get_pubkey_point(),
|
|
+ * but compressed point format and ASN.1 DER wrapping)*/
|
|
+#ifndef MBEDTLS_PK_ECP_PUB_DER_MAX_BYTES /*(mbedtls/library/pkwrite.h)*/
|
|
+#define MBEDTLS_PK_ECP_PUB_DER_MAX_BYTES ( 30 + 2 * MBEDTLS_ECP_MAX_BYTES )
|
|
+#endif
|
|
+ unsigned char buf[MBEDTLS_PK_ECP_PUB_DER_MAX_BYTES];
|
|
+ int len = mbedtls_pk_write_pubkey_der((mbedtls_pk_context *)key,
|
|
+ buf, sizeof(buf));
|
|
+ if (len < 0)
|
|
+ return NULL;
|
|
+ /* Note: data is written at the end of the buffer! Use the
|
|
+ * return value to determine where you should start
|
|
+ * using the buffer */
|
|
+ unsigned char *p = buf+sizeof(buf)-len;
|
|
+
|
|
+ #ifdef MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED
|
|
+ mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)key);
|
|
+ if (ecp_kp == NULL)
|
|
+ return NULL;
|
|
+ mbedtls_ecp_group *grp = &ecp_kp->MBEDTLS_PRIVATE(grp);
|
|
+ /* Note: sae_pk.c expects pubkey point in compressed format,
|
|
+ * but mbedtls_pk_write_pubkey_der() writes uncompressed format.
|
|
+ * Manually translate format and update lengths in DER format */
|
|
+ if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) {
|
|
+ unsigned char *end = buf+sizeof(buf);
|
|
+ size_t n;
|
|
+ /* SubjectPublicKeyInfo SEQUENCE */
|
|
+ mbedtls_asn1_get_tag(&p, end, &n,
|
|
+ MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
|
|
+ /* algorithm AlgorithmIdentifier */
|
|
+ unsigned char *a = p;
|
|
+ size_t alen;
|
|
+ mbedtls_asn1_get_tag(&p, end, &alen,
|
|
+ MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
|
|
+ p += alen;
|
|
+ alen = (size_t)(p - a);
|
|
+ /* subjectPublicKey BIT STRING */
|
|
+ mbedtls_asn1_get_tag(&p, end, &n, MBEDTLS_ASN1_BIT_STRING);
|
|
+ /* rewrite into compressed point format and rebuild ASN.1 */
|
|
+ p[1] = (buf[sizeof(buf)-1] & 1) ? 0x03 : 0x02;
|
|
+ n = 1 + 1 + (n-2)/2;
|
|
+ len = mbedtls_asn1_write_len(&p, buf, n) + (int)n;
|
|
+ len += mbedtls_asn1_write_tag(&p, buf, MBEDTLS_ASN1_BIT_STRING);
|
|
+ os_memmove(p-alen, a, alen);
|
|
+ len += alen;
|
|
+ p -= alen;
|
|
+ len += mbedtls_asn1_write_len(&p, buf, (size_t)len);
|
|
+ len += mbedtls_asn1_write_tag(&p, buf,
|
|
+ MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
|
|
+ }
|
|
+ #endif
|
|
+ return wpabuf_alloc_copy(p, (size_t)len);
|
|
+}
|
|
+
|
|
+#ifdef CRYPTO_MBEDTLS_CRYPTO_EC_DPP
|
|
+
|
|
+struct wpabuf * crypto_ec_key_get_ecprivate_key(struct crypto_ec_key *key,
|
|
+ bool include_pub)
|
|
+{
|
|
+#ifndef MBEDTLS_PK_ECP_PRV_DER_MAX_BYTES /*(mbedtls/library/pkwrite.h)*/
|
|
+#define MBEDTLS_PK_ECP_PRV_DER_MAX_BYTES ( 29 + 3 * MBEDTLS_ECP_MAX_BYTES )
|
|
+#endif
|
|
+ unsigned char priv[MBEDTLS_PK_ECP_PRV_DER_MAX_BYTES];
|
|
+ int privlen = mbedtls_pk_write_key_der((mbedtls_pk_context *)key,
|
|
+ priv, sizeof(priv));
|
|
+ if (privlen < 0)
|
|
+ return NULL;
|
|
+
|
|
+ struct wpabuf *wbuf;
|
|
+
|
|
+ /* Note: data is written at the end of the buffer! Use the
|
|
+ * return value to determine where you should start
|
|
+ * using the buffer */
|
|
+ /* mbedtls_pk_write_key_der() includes publicKey in DER */
|
|
+ if (include_pub)
|
|
+ wbuf = wpabuf_alloc_copy(priv+sizeof(priv)-privlen, privlen);
|
|
+ else {
|
|
+ /* calculate publicKey offset and skip from end of buffer */
|
|
+ unsigned char *p = priv+sizeof(priv)-privlen;
|
|
+ unsigned char *end = priv+sizeof(priv);
|
|
+ size_t len;
|
|
+ /* ECPrivateKey SEQUENCE */
|
|
+ mbedtls_asn1_get_tag(&p, end, &len,
|
|
+ MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
|
|
+ /* version INTEGER */
|
|
+ unsigned char *v = p;
|
|
+ mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_INTEGER);
|
|
+ p += len;
|
|
+ /* privateKey OCTET STRING */
|
|
+ mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OCTET_STRING);
|
|
+ p += len;
|
|
+ /* parameters ECParameters */
|
|
+ mbedtls_asn1_get_tag(&p, end, &len,
|
|
+ MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED);
|
|
+ p += len;
|
|
+
|
|
+ /* write new SEQUENCE header (we know that it fits in priv[]) */
|
|
+ len = (size_t)(p - v);
|
|
+ p = v;
|
|
+ len += mbedtls_asn1_write_len(&p, priv, len);
|
|
+ len += mbedtls_asn1_write_tag(&p, priv,
|
|
+ MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
|
|
+ wbuf = wpabuf_alloc_copy(p, len);
|
|
+ }
|
|
+
|
|
+ forced_memzero(priv, sizeof(priv));
|
|
+ return wbuf;
|
|
+}
|
|
+
|
|
+struct wpabuf * crypto_ec_key_get_pubkey_point(struct crypto_ec_key *key,
|
|
+ int prefix)
|
|
+{
|
|
+ /*(similarities to crypto_ecdh_get_pubkey(), but different struct)*/
|
|
+ mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)key);
|
|
+ if (ecp_kp == NULL)
|
|
+ return NULL;
|
|
+ mbedtls_ecp_group *grp = &ecp_kp->MBEDTLS_PRIVATE(grp);
|
|
+ size_t len = CRYPTO_EC_plen(grp);
|
|
+ #ifdef MBEDTLS_ECP_MONTGOMERY_ENABLED
|
|
+ /* len */
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED
|
|
+ if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS)
|
|
+ len = len*2+1;
|
|
+ #endif
|
|
+ struct wpabuf *buf = wpabuf_alloc(len);
|
|
+ if (buf == NULL)
|
|
+ return NULL;
|
|
+ mbedtls_ecp_point *ecp_kp_Q = &ecp_kp->MBEDTLS_PRIVATE(Q);
|
|
+ if (mbedtls_ecp_point_write_binary(grp, ecp_kp_Q,
|
|
+ MBEDTLS_ECP_PF_UNCOMPRESSED, &len,
|
|
+ wpabuf_mhead_u8(buf), len) == 0) {
|
|
+ if (!prefix) /* Remove 0x04 prefix if requested */
|
|
+ os_memmove(wpabuf_mhead(buf),wpabuf_mhead(buf)+1,--len);
|
|
+ wpabuf_put(buf, len);
|
|
+ return buf;
|
|
+ }
|
|
+
|
|
+ wpabuf_free(buf);
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+struct crypto_ec_point *
|
|
+crypto_ec_key_get_public_key(struct crypto_ec_key *key)
|
|
+{
|
|
+ mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)key);
|
|
+ if (ecp_kp == NULL)
|
|
+ return NULL;
|
|
+ mbedtls_ecp_point *p = os_malloc(sizeof(*p));
|
|
+ if (p != NULL) {
|
|
+ /*(mbedtls_ecp_export() uses &ecp_kp->MBEDTLS_PRIVATE(grp))*/
|
|
+ mbedtls_ecp_point_init(p);
|
|
+ mbedtls_ecp_point *ecp_kp_Q = &ecp_kp->MBEDTLS_PRIVATE(Q);
|
|
+ if (mbedtls_ecp_copy(p, ecp_kp_Q)) {
|
|
+ mbedtls_ecp_point_free(p);
|
|
+ os_free(p);
|
|
+ p = NULL;
|
|
+ }
|
|
+ }
|
|
+ return (struct crypto_ec_point *)p;
|
|
+}
|
|
+
|
|
+struct crypto_bignum *
|
|
+crypto_ec_key_get_private_key(struct crypto_ec_key *key)
|
|
+{
|
|
+ mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)key);
|
|
+ if (ecp_kp == NULL)
|
|
+ return NULL;
|
|
+ mbedtls_mpi *bn = os_malloc(sizeof(*bn));
|
|
+ if (bn) {
|
|
+ /*(mbedtls_ecp_export() uses &ecp_kp->MBEDTLS_PRIVATE(grp))*/
|
|
+ mbedtls_mpi_init(bn);
|
|
+ mbedtls_mpi *ecp_kp_d = &ecp_kp->MBEDTLS_PRIVATE(d);
|
|
+ if (mbedtls_mpi_copy(bn, ecp_kp_d)) {
|
|
+ mbedtls_mpi_free(bn);
|
|
+ os_free(bn);
|
|
+ bn = NULL;
|
|
+ }
|
|
+ }
|
|
+ return (struct crypto_bignum *)bn;
|
|
+}
|
|
+
|
|
+#endif /* CRYPTO_MBEDTLS_CRYPTO_EC_DPP */
|
|
+
|
|
+static mbedtls_md_type_t crypto_ec_key_sign_md(size_t len)
|
|
+{
|
|
+ /* get mbedtls_md_type_t from length of hash data to be signed */
|
|
+ switch (len) {
|
|
+ case 64: return MBEDTLS_MD_SHA512;
|
|
+ case 48: return MBEDTLS_MD_SHA384;
|
|
+ case 32: return MBEDTLS_MD_SHA256;
|
|
+ case 20: return MBEDTLS_MD_SHA1;
|
|
+ case 16: return MBEDTLS_MD_MD5;
|
|
+ default: return MBEDTLS_MD_NONE;
|
|
+ }
|
|
+}
|
|
+
|
|
+struct wpabuf * crypto_ec_key_sign(struct crypto_ec_key *key, const u8 *data,
|
|
+ size_t len)
|
|
+{
|
|
+ #ifndef MBEDTLS_PK_SIGNATURE_MAX_SIZE /*(defined since mbedtls 2.20.0)*/
|
|
+ #if MBEDTLS_ECDSA_MAX_LEN > MBEDTLS_MPI_MAX_SIZE
|
|
+ #define MBEDTLS_PK_SIGNATURE_MAX_SIZE MBEDTLS_ECDSA_MAX_LEN
|
|
+ #else
|
|
+ #define MBEDTLS_PK_SIGNATURE_MAX_SIZE MBEDTLS_MPI_MAX_SIZE
|
|
+ #endif
|
|
+ #endif
|
|
+ size_t sig_len = MBEDTLS_PK_SIGNATURE_MAX_SIZE;
|
|
+ struct wpabuf *buf = wpabuf_alloc(sig_len);
|
|
+ if (buf == NULL)
|
|
+ return NULL;
|
|
+ if (mbedtls_pk_sign((mbedtls_pk_context *)key,
|
|
+ crypto_ec_key_sign_md(len), data, len,
|
|
+ wpabuf_mhead_u8(buf),
|
|
+ #if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
|
|
+ sig_len,
|
|
+ #endif
|
|
+ &sig_len,
|
|
+ mbedtls_ctr_drbg_random,
|
|
+ crypto_mbedtls_ctr_drbg()) == 0) {
|
|
+ wpabuf_put(buf, sig_len);
|
|
+ return buf;
|
|
+ }
|
|
+
|
|
+ wpabuf_free(buf);
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+#ifdef CRYPTO_MBEDTLS_CRYPTO_EC_DPP
|
|
+struct wpabuf * crypto_ec_key_sign_r_s(struct crypto_ec_key *key,
|
|
+ const u8 *data, size_t len)
|
|
+{
|
|
+ mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)key);
|
|
+ if (ecp_kp == NULL)
|
|
+ return NULL;
|
|
+
|
|
+ size_t sig_len = MBEDTLS_ECDSA_MAX_LEN;
|
|
+ u8 buf[MBEDTLS_ECDSA_MAX_LEN];
|
|
+ if (mbedtls_ecdsa_write_signature(ecp_kp, crypto_ec_key_sign_md(len),
|
|
+ data, len, buf,
|
|
+ #if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
|
|
+ sig_len,
|
|
+ #endif
|
|
+ &sig_len,
|
|
+ mbedtls_ctr_drbg_random,
|
|
+ crypto_mbedtls_ctr_drbg())) {
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ /*(mbedtls_ecdsa_write_signature() writes signature in ASN.1)*/
|
|
+ /* parse ASN.1 to get r and s and lengths */
|
|
+ u8 *p = buf, *r, *s;
|
|
+ u8 *end = p + sig_len;
|
|
+ size_t rlen, slen;
|
|
+ mbedtls_asn1_get_tag(&p, end, &rlen,
|
|
+ MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
|
|
+ mbedtls_asn1_get_tag(&p, end, &rlen, MBEDTLS_ASN1_INTEGER);
|
|
+ r = p;
|
|
+ p += rlen;
|
|
+ mbedtls_asn1_get_tag(&p, end, &slen, MBEDTLS_ASN1_INTEGER);
|
|
+ s = p;
|
|
+
|
|
+ /* write raw r and s into out
|
|
+ * (including removal of leading 0 if added for ASN.1 integer)
|
|
+ * note: DPP caller expects raw r, s each padded to prime len */
|
|
+ mbedtls_ecp_group *ecp_kp_grp = &ecp_kp->MBEDTLS_PRIVATE(grp);
|
|
+ size_t plen = CRYPTO_EC_plen(ecp_kp_grp);
|
|
+ if (rlen > plen) {
|
|
+ r += (rlen - plen);
|
|
+ rlen = plen;
|
|
+ }
|
|
+ if (slen > plen) {
|
|
+ s += (slen - plen);
|
|
+ slen = plen;
|
|
+ }
|
|
+ struct wpabuf *out = wpabuf_alloc(plen*2);
|
|
+ if (out) {
|
|
+ wpabuf_put(out, plen*2);
|
|
+ p = wpabuf_mhead_u8(out);
|
|
+ os_memset(p, 0, plen*2);
|
|
+ os_memcpy(p+plen*1-rlen, r, rlen);
|
|
+ os_memcpy(p+plen*2-slen, s, slen);
|
|
+ }
|
|
+ return out;
|
|
+}
|
|
+#endif /* CRYPTO_MBEDTLS_CRYPTO_EC_DPP */
|
|
+
|
|
+int crypto_ec_key_verify_signature(struct crypto_ec_key *key, const u8 *data,
|
|
+ size_t len, const u8 *sig, size_t sig_len)
|
|
+{
|
|
+ switch (mbedtls_pk_verify((mbedtls_pk_context *)key,
|
|
+ crypto_ec_key_sign_md(len), data, len,
|
|
+ sig, sig_len)) {
|
|
+ case 0:
|
|
+ /*case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:*//* XXX: allow? */
|
|
+ return 1;
|
|
+ case MBEDTLS_ERR_ECP_VERIFY_FAILED:
|
|
+ return 0;
|
|
+ default:
|
|
+ return -1;
|
|
+ }
|
|
+}
|
|
+
|
|
+#ifdef CRYPTO_MBEDTLS_CRYPTO_EC_DPP
|
|
+int crypto_ec_key_verify_signature_r_s(struct crypto_ec_key *key,
|
|
+ const u8 *data, size_t len,
|
|
+ const u8 *r, size_t r_len,
|
|
+ const u8 *s, size_t s_len)
|
|
+{
|
|
+ /* reimplement mbedtls_ecdsa_read_signature() without encoding r and s
|
|
+ * into ASN.1 just for mbedtls_ecdsa_read_signature() to decode ASN.1 */
|
|
+ mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)key);
|
|
+ if (ecp_kp == NULL)
|
|
+ return -1;
|
|
+ mbedtls_ecp_group *ecp_kp_grp = &ecp_kp->MBEDTLS_PRIVATE(grp);
|
|
+ mbedtls_ecp_point *ecp_kp_Q = &ecp_kp->MBEDTLS_PRIVATE(Q);
|
|
+
|
|
+ mbedtls_mpi mpi_r;
|
|
+ mbedtls_mpi mpi_s;
|
|
+ mbedtls_mpi_init(&mpi_r);
|
|
+ mbedtls_mpi_init(&mpi_s);
|
|
+ int ret = mbedtls_mpi_read_binary(&mpi_r, r, r_len)
|
|
+ || mbedtls_mpi_read_binary(&mpi_s, s, s_len) ? -1 : 0;
|
|
+ if (ret == 0) {
|
|
+ ret = mbedtls_ecdsa_verify(ecp_kp_grp, data, len,
|
|
+ ecp_kp_Q, &mpi_r, &mpi_s);
|
|
+ ret = ret ? ret == MBEDTLS_ERR_ECP_BAD_INPUT_DATA ? 0 : -1 : 1;
|
|
+ }
|
|
+ mbedtls_mpi_free(&mpi_r);
|
|
+ mbedtls_mpi_free(&mpi_s);
|
|
+ return ret;
|
|
+}
|
|
+#endif /* CRYPTO_MBEDTLS_CRYPTO_EC_DPP */
|
|
+
|
|
+int crypto_ec_key_group(struct crypto_ec_key *key)
|
|
+{
|
|
+ mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)key);
|
|
+ if (ecp_kp == NULL)
|
|
+ return -1;
|
|
+ mbedtls_ecp_group *ecp_group = &ecp_kp->MBEDTLS_PRIVATE(grp);
|
|
+ return crypto_mbedtls_ike_id_from_ecp_group_id(ecp_group->id);
|
|
+}
|
|
+
|
|
+#ifdef CRYPTO_MBEDTLS_CRYPTO_EC_DPP
|
|
+
|
|
+int crypto_ec_key_cmp(struct crypto_ec_key *key1, struct crypto_ec_key *key2)
|
|
+{
|
|
+#if 0 /*(DPP is passing two public keys; unable to use pk_check_pair())*/
|
|
+ #if MBEDTLS_VERSION_NUMBER < 0x03000000 /* mbedtls 3.0.0 */
|
|
+ return mbedtls_pk_check_pair((const mbedtls_pk_context *)key1,
|
|
+ (const mbedtls_pk_context *)key2) ? -1 : 0;
|
|
+ #else
|
|
+ return mbedtls_pk_check_pair((const mbedtls_pk_context *)key1,
|
|
+ (const mbedtls_pk_context *)key2,
|
|
+ mbedtls_ctr_drbg_random,
|
|
+ crypto_mbedtls_ctr_drbg()) ? -1 : 0;
|
|
+ #endif
|
|
+#else
|
|
+ mbedtls_ecp_keypair *ecp_kp1=mbedtls_pk_ec(*(mbedtls_pk_context *)key1);
|
|
+ mbedtls_ecp_keypair *ecp_kp2=mbedtls_pk_ec(*(mbedtls_pk_context *)key2);
|
|
+ if (ecp_kp1 == NULL || ecp_kp2 == NULL)
|
|
+ return -1;
|
|
+ mbedtls_ecp_group *ecp_kp1_grp = &ecp_kp1->MBEDTLS_PRIVATE(grp);
|
|
+ mbedtls_ecp_group *ecp_kp2_grp = &ecp_kp2->MBEDTLS_PRIVATE(grp);
|
|
+ mbedtls_ecp_point *ecp_kp1_Q = &ecp_kp1->MBEDTLS_PRIVATE(Q);
|
|
+ mbedtls_ecp_point *ecp_kp2_Q = &ecp_kp2->MBEDTLS_PRIVATE(Q);
|
|
+ return ecp_kp1_grp->id != ecp_kp2_grp->id
|
|
+ || mbedtls_ecp_point_cmp(ecp_kp1_Q, ecp_kp2_Q) ? -1 : 0;
|
|
+#endif
|
|
+}
|
|
+
|
|
+void crypto_ec_key_debug_print(const struct crypto_ec_key *key,
|
|
+ const char *title)
|
|
+{
|
|
+ /* TBD: what info is desirable here and in what human readable format?*/
|
|
+ /*(crypto_openssl.c prints a human-readably public key and attributes)*/
|
|
+ #if 0
|
|
+ struct mbedtls_pk_debug_item debug_item;
|
|
+ if (mbedtls_pk_debug((const mbedtls_pk_context *)key, &debug_item))
|
|
+ return;
|
|
+ /* ... */
|
|
+ #endif
|
|
+ wpa_printf(MSG_DEBUG, "%s: %s not implemented", title, __func__);
|
|
+}
|
|
+
|
|
+#endif /* CRYPTO_MBEDTLS_CRYPTO_EC_DPP */
|
|
+
|
|
+#endif /* CRYPTO_MBEDTLS_CRYPTO_EC */
|
|
+
|
|
+
|
|
+#ifdef CRYPTO_MBEDTLS_CRYPTO_CSR
|
|
+
|
|
+#include <mbedtls/x509_csr.h>
|
|
+#include <mbedtls/oid.h>
|
|
+
|
|
+struct crypto_csr * crypto_csr_init(void)
|
|
+{
|
|
+ mbedtls_x509write_csr *csr = os_malloc(sizeof(*csr));
|
|
+ if (csr != NULL)
|
|
+ mbedtls_x509write_csr_init(csr);
|
|
+ return (struct crypto_csr *)csr;
|
|
+}
|
|
+
|
|
+struct crypto_csr * crypto_csr_verify(const struct wpabuf *req)
|
|
+{
|
|
+ /* future: look for alternatives to MBEDTLS_PRIVATE() access */
|
|
+
|
|
+ /* sole caller src/common/dpp_crypto.c:dpp_validate_csr()
|
|
+ * uses (mbedtls_x509_csr *) to obtain CSR_ATTR_CHALLENGE_PASSWORD
|
|
+ * so allocate different object (mbedtls_x509_csr *) and special-case
|
|
+ * object when used in crypto_csr_get_attribute() and when free()d in
|
|
+ * crypto_csr_deinit(). */
|
|
+
|
|
+ mbedtls_x509_csr *csr = os_malloc(sizeof(*csr));
|
|
+ if (csr == NULL)
|
|
+ return NULL;
|
|
+ mbedtls_x509_csr_init(csr);
|
|
+ const mbedtls_md_info_t *md_info;
|
|
+ unsigned char digest[MBEDTLS_MD_MAX_SIZE];
|
|
+ if (mbedtls_x509_csr_parse_der(csr,wpabuf_head(req),wpabuf_len(req))==0
|
|
+ && (md_info=mbedtls_md_info_from_type(csr->MBEDTLS_PRIVATE(sig_md)))
|
|
+ != NULL
|
|
+ && mbedtls_md(md_info, csr->cri.p, csr->cri.len, digest) == 0) {
|
|
+ switch (mbedtls_pk_verify(&csr->pk,csr->MBEDTLS_PRIVATE(sig_md),
|
|
+ digest, mbedtls_md_get_size(md_info),
|
|
+ csr->MBEDTLS_PRIVATE(sig).p,
|
|
+ csr->MBEDTLS_PRIVATE(sig).len)) {
|
|
+ case 0:
|
|
+ /*case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:*//* XXX: allow? */
|
|
+ return (struct crypto_csr *)((uintptr_t)csr | 1uL);
|
|
+ default:
|
|
+ break;
|
|
+ }
|
|
+ }
|
|
+
|
|
+ mbedtls_x509_csr_free(csr);
|
|
+ os_free(csr);
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+void crypto_csr_deinit(struct crypto_csr *csr)
|
|
+{
|
|
+ if ((uintptr_t)csr & 1uL) {
|
|
+ csr = (struct crypto_csr *)((uintptr_t)csr & ~1uL);
|
|
+ mbedtls_x509_csr_free((mbedtls_x509_csr *)csr);
|
|
+ }
|
|
+ else
|
|
+ mbedtls_x509write_csr_free((mbedtls_x509write_csr *)csr);
|
|
+ os_free(csr);
|
|
+}
|
|
+
|
|
+int crypto_csr_set_ec_public_key(struct crypto_csr *csr,
|
|
+ struct crypto_ec_key *key)
|
|
+{
|
|
+ mbedtls_x509write_csr_set_key((mbedtls_x509write_csr *)csr,
|
|
+ (mbedtls_pk_context *)key);
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+int crypto_csr_set_name(struct crypto_csr *csr, enum crypto_csr_name type,
|
|
+ const char *name)
|
|
+{
|
|
+ /* specialized for src/common/dpp_crypto.c */
|
|
+
|
|
+ /* sole caller src/common/dpp_crypto.c:dpp_build_csr()
|
|
+ * calls this function only once, using type == CSR_NAME_CN
|
|
+ * (If called more than once, this code would need to append
|
|
+ * components to the subject name, which we could do by
|
|
+ * appending to (mbedtls_x509write_csr *) private member
|
|
+ * mbedtls_asn1_named_data *MBEDTLS_PRIVATE(subject)) */
|
|
+
|
|
+ const char *label;
|
|
+ switch (type) {
|
|
+ case CSR_NAME_CN: label = "CN="; break;
|
|
+ case CSR_NAME_SN: label = "SN="; break;
|
|
+ case CSR_NAME_C: label = "C="; break;
|
|
+ case CSR_NAME_O: label = "O="; break;
|
|
+ case CSR_NAME_OU: label = "OU="; break;
|
|
+ default: return -1;
|
|
+ }
|
|
+
|
|
+ size_t len = strlen(name);
|
|
+ struct wpabuf *buf = wpabuf_alloc(3+len+1);
|
|
+ if (buf == NULL)
|
|
+ return -1;
|
|
+ wpabuf_put_data(buf, label, strlen(label));
|
|
+ wpabuf_put_data(buf, name, len+1); /*(include trailing '\0')*/
|
|
+ /* Note: 'name' provided is set as given and should be backslash-escaped
|
|
+ * by caller when necessary, e.g. literal ',' which are not separating
|
|
+ * components should be backslash-escaped */
|
|
+
|
|
+ int ret =
|
|
+ mbedtls_x509write_csr_set_subject_name((mbedtls_x509write_csr *)csr,
|
|
+ wpabuf_head(buf)) ? -1 : 0;
|
|
+ wpabuf_free(buf);
|
|
+ return ret;
|
|
+}
|
|
+
|
|
+/* OBJ_pkcs9_challengePassword 1 2 840 113549 1 9 7 */
|
|
+static const char OBJ_pkcs9_challengePassword[] = MBEDTLS_OID_PKCS9 "\x07";
|
|
+
|
|
+int crypto_csr_set_attribute(struct crypto_csr *csr, enum crypto_csr_attr attr,
|
|
+ int attr_type, const u8 *value, size_t len)
|
|
+{
|
|
+ /* specialized for src/common/dpp_crypto.c */
|
|
+ /* sole caller src/common/dpp_crypto.c:dpp_build_csr() passes
|
|
+ * attr == CSR_ATTR_CHALLENGE_PASSWORD
|
|
+ * attr_type == ASN1_TAG_UTF8STRING */
|
|
+
|
|
+ const char *oid;
|
|
+ size_t oid_len;
|
|
+ switch (attr) {
|
|
+ case CSR_ATTR_CHALLENGE_PASSWORD:
|
|
+ oid = OBJ_pkcs9_challengePassword;
|
|
+ oid_len = sizeof(OBJ_pkcs9_challengePassword)-1;
|
|
+ break;
|
|
+ default:
|
|
+ return -1;
|
|
+ }
|
|
+
|
|
+ #if 0 /*(incorrect; sets an extension, not an attribute)*/
|
|
+ return mbedtls_x509write_csr_set_extension((mbedtls_x509write_csr *)csr,
|
|
+ oid, oid_len,
|
|
+ #if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
|
|
+ 0, /*(critical flag)*/
|
|
+ #endif
|
|
+ value, len) ? -1 : 0;
|
|
+ #else
|
|
+ (void)oid;
|
|
+ (void)oid_len;
|
|
+ #endif
|
|
+
|
|
+ /* mbedtls does not currently provide way to set an attribute in a CSR:
|
|
+ * https://github.com/Mbed-TLS/mbedtls/issues/4886 */
|
|
+ wpa_printf(MSG_ERROR,
|
|
+ "mbedtls does not currently support setting challengePassword "
|
|
+ "attribute in CSR");
|
|
+ return -1;
|
|
+}
|
|
+
|
|
+const u8 * mbedtls_x509_csr_attr_oid_value(mbedtls_x509_csr *csr,
|
|
+ const char *oid, size_t oid_len,
|
|
+ size_t *vlen, int *vtype)
|
|
+{
|
|
+ /* Note: mbedtls_x509_csr_parse_der() has parsed and validated CSR,
|
|
+ * so validation checks are not repeated here
|
|
+ *
|
|
+ * It would be nicer if (mbedtls_x509_csr *) had an mbedtls_x509_buf of
|
|
+ * Attributes (or at least a pointer) since mbedtls_x509_csr_parse_der()
|
|
+ * already parsed the rest of CertificationRequestInfo, some of which is
|
|
+ * repeated here to step to Attributes. Since csr->subject_raw.p points
|
|
+ * into csr->cri.p, which points into csr->raw.p, step over version and
|
|
+ * subject of CertificationRequestInfo (SEQUENCE) */
|
|
+ unsigned char *p = csr->subject_raw.p + csr->subject_raw.len;
|
|
+ unsigned char *end = csr->cri.p + csr->cri.len, *ext;
|
|
+ size_t len;
|
|
+
|
|
+ /* step over SubjectPublicKeyInfo */
|
|
+ mbedtls_asn1_get_tag(&p, end, &len,
|
|
+ MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
|
|
+ p += len;
|
|
+
|
|
+ /* Attributes
|
|
+ * { ATTRIBUTE:IOSet } ::= SET OF { SEQUENCE { OID, value } }
|
|
+ */
|
|
+ if (mbedtls_asn1_get_tag(&p, end, &len,
|
|
+ MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_CONTEXT_SPECIFIC) != 0) {
|
|
+ return NULL;
|
|
+ }
|
|
+ while (p < end) {
|
|
+ if (mbedtls_asn1_get_tag(&p, end, &len,
|
|
+ MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE) != 0) {
|
|
+ return NULL;
|
|
+ }
|
|
+ ext = p;
|
|
+ p += len;
|
|
+
|
|
+ if (mbedtls_asn1_get_tag(&ext,end,&len,MBEDTLS_ASN1_OID) != 0)
|
|
+ return NULL;
|
|
+ if (oid_len != len || 0 != memcmp(ext, oid, oid_len))
|
|
+ continue;
|
|
+
|
|
+ /* found oid; return value */
|
|
+ *vtype = *ext++; /* tag */
|
|
+ return (mbedtls_asn1_get_len(&ext,end,vlen) == 0) ? ext : NULL;
|
|
+ }
|
|
+
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+const u8 * crypto_csr_get_attribute(struct crypto_csr *csr,
|
|
+ enum crypto_csr_attr attr,
|
|
+ size_t *len, int *type)
|
|
+{
|
|
+ /* specialized for src/common/dpp_crypto.c */
|
|
+ /* sole caller src/common/dpp_crypto.c:dpp_build_csr() passes
|
|
+ * attr == CSR_ATTR_CHALLENGE_PASSWORD */
|
|
+
|
|
+ const char *oid;
|
|
+ size_t oid_len;
|
|
+ switch (attr) {
|
|
+ case CSR_ATTR_CHALLENGE_PASSWORD:
|
|
+ oid = OBJ_pkcs9_challengePassword;
|
|
+ oid_len = sizeof(OBJ_pkcs9_challengePassword)-1;
|
|
+ break;
|
|
+ default:
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ /* see crypto_csr_verify(); expecting (mbedtls_x509_csr *) tagged |=1 */
|
|
+ if (!((uintptr_t)csr & 1uL))
|
|
+ return NULL;
|
|
+ csr = (struct crypto_csr *)((uintptr_t)csr & ~1uL);
|
|
+
|
|
+ return mbedtls_x509_csr_attr_oid_value((mbedtls_x509_csr *)csr,
|
|
+ oid, oid_len, len, type);
|
|
+}
|
|
+
|
|
+struct wpabuf * crypto_csr_sign(struct crypto_csr *csr,
|
|
+ struct crypto_ec_key *key,
|
|
+ enum crypto_hash_alg algo)
|
|
+{
|
|
+ mbedtls_md_type_t sig_md;
|
|
+ switch (algo) {
|
|
+ #ifdef MBEDTLS_SHA256_C
|
|
+ case CRYPTO_HASH_ALG_SHA256: sig_md = MBEDTLS_MD_SHA256; break;
|
|
+ #endif
|
|
+ #ifdef MBEDTLS_SHA512_C
|
|
+ case CRYPTO_HASH_ALG_SHA384: sig_md = MBEDTLS_MD_SHA384; break;
|
|
+ case CRYPTO_HASH_ALG_SHA512: sig_md = MBEDTLS_MD_SHA512; break;
|
|
+ #endif
|
|
+ default:
|
|
+ return NULL;
|
|
+ }
|
|
+ mbedtls_x509write_csr_set_md_alg((mbedtls_x509write_csr *)csr, sig_md);
|
|
+
|
|
+ #if 0
|
|
+ unsigned char key_usage = MBEDTLS_X509_KU_DIGITAL_SIGNATURE
|
|
+ | MBEDTLS_X509_KU_KEY_CERT_SIGN;
|
|
+ if (mbedtls_x509write_csr_set_key_usage((mbedtls_x509write_csr *)csr,
|
|
+ key_usage))
|
|
+ return NULL;
|
|
+ #endif
|
|
+
|
|
+ #if 0
|
|
+ unsigned char ns_cert_type = MBEDTLS_X509_NS_CERT_TYPE_SSL_CLIENT
|
|
+ | MBEDTLS_X509_NS_CERT_TYPE_EMAIL;
|
|
+ if (mbedtls_x509write_csr_set_ns_cert_type((mbedtls_x509write_csr *)csr,
|
|
+ ns_cert_type))
|
|
+ return NULL;
|
|
+ #endif
|
|
+
|
|
+ #if 0
|
|
+ /* mbedtls does not currently provide way to set an attribute in a CSR:
|
|
+ * https://github.com/Mbed-TLS/mbedtls/issues/4886
|
|
+ * XXX: hwsim dpp_enterprise test fails due to this limitation.
|
|
+ *
|
|
+ * Current usage of this function is solely by dpp_build_csr(),
|
|
+ * so as a kludge, might consider custom (struct crypto_csr *)
|
|
+ * containing (mbedtls_x509write_csr *) and a list of attributes
|
|
+ * (i.e. challengePassword). Might have to totally reimplement
|
|
+ * mbedtls_x509write_csr_der(); underlying x509write_csr_der_internal()
|
|
+ * handles signing the CSR. (This is more work that appending an
|
|
+ * Attributes section to end of CSR and adjusting ASN.1 length of CSR.)
|
|
+ */
|
|
+ #endif
|
|
+
|
|
+ unsigned char buf[4096]; /* XXX: large enough? too large? */
|
|
+ int len = mbedtls_x509write_csr_der((mbedtls_x509write_csr *)csr,
|
|
+ buf, sizeof(buf),
|
|
+ mbedtls_ctr_drbg_random,
|
|
+ crypto_mbedtls_ctr_drbg());
|
|
+ if (len < 0)
|
|
+ return NULL;
|
|
+ /* Note: data is written at the end of the buffer! Use the
|
|
+ * return value to determine where you should start
|
|
+ * using the buffer */
|
|
+ return wpabuf_alloc_copy(buf+sizeof(buf)-len, (size_t)len);
|
|
+}
|
|
+
|
|
+#endif /* CRYPTO_MBEDTLS_CRYPTO_CSR */
|
|
+
|
|
+
|
|
+#ifdef CRYPTO_MBEDTLS_CRYPTO_PKCS7
|
|
+
|
|
+#if 0
|
|
+#include <mbedtls/pkcs7.h> /* PKCS7 is not currently supported in mbedtls */
|
|
+#include <mbedtls/pem.h>
|
|
+#endif
|
|
+
|
|
+struct wpabuf * crypto_pkcs7_get_certificates(const struct wpabuf *pkcs7)
|
|
+{
|
|
+ /* PKCS7 is not currently supported in mbedtls */
|
|
+ return NULL;
|
|
+
|
|
+#if 0
|
|
+ /* https://github.com/naynajain/mbedtls-1 branch: development-pkcs7
|
|
+ * (??? potential future contribution to mbedtls ???) */
|
|
+
|
|
+ /* Note: PKCS7 signature *is not* verified by this function.
|
|
+ * The function interface does not provide for passing a certificate */
|
|
+
|
|
+ mbedtls_pkcs7 mpkcs7;
|
|
+ mbedtls_pkcs7_init(&mpkcs7);
|
|
+ int pkcs7_type = mbedtls_pkcs7_parse_der(wpabuf_head(pkcs7),
|
|
+ wpabuf_len(pkcs7),
|
|
+ &mpkcs7);
|
|
+ wpabuf *buf = NULL;
|
|
+ do {
|
|
+ if (pkcs7_type < 0)
|
|
+ break;
|
|
+
|
|
+ /* src/common/dpp.c:dpp_parse_cred_dot1x() interested in certs
|
|
+ * for wpa_supplicant/dpp_supplicant.c:wpas_dpp_add_network()
|
|
+ * (? are adding certificate headers and footers desired ?) */
|
|
+
|
|
+ /* development-pkcs7 branch does not currently provide
|
|
+ * additional interfaces to retrieve the parsed data */
|
|
+
|
|
+ mbedtls_x509_crt *certs =
|
|
+ &mpkcs7.MBEDTLS_PRIVATE(signed_data).MBEDTLS_PRIVATE(certs);
|
|
+ int ncerts =
|
|
+ mpkcs7.MBEDTLS_PRIVATE(signed_data).MBEDTLS_PRIVATE(no_of_certs);
|
|
+
|
|
+ /* allocate buffer for PEM (base64-encoded DER)
|
|
+ * plus header, footer, newlines, and some extra */
|
|
+ buf = wpabuf_alloc((wpabuf_len(pkcs7)+2)/3*4 + ncerts*64);
|
|
+ if (buf == NULL)
|
|
+ break;
|
|
+
|
|
+ #define PEM_BEGIN_CRT "-----BEGIN CERTIFICATE-----\n"
|
|
+ #define PEM_END_CRT "-----END CERTIFICATE-----\n"
|
|
+ size_t olen;
|
|
+ for (int i = 0; i < ncerts; ++i) {
|
|
+ int ret = mbedtls_pem_write_buffer(
|
|
+ PEM_BEGIN_CRT, PEM_END_CRT,
|
|
+ certs[i].raw.p, certs[i].raw.len,
|
|
+ wpabuf_mhead(buf, 0), wpabuf_tailroom(buf),
|
|
+ &olen));
|
|
+ if (ret == 0)
|
|
+ wpabuf_put(buf, olen);
|
|
+ } else {
|
|
+ if (ret == MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL)
|
|
+ ret = wpabuf_resize(
|
|
+ &buf,olen-wpabuf_tailroom(buf));
|
|
+ if (ret == 0) {
|
|
+ --i;/*(adjust loop iterator for retry)*/
|
|
+ continue;
|
|
+ }
|
|
+ wpabuf_free(buf);
|
|
+ buf = NULL;
|
|
+ break;
|
|
+ }
|
|
+ }
|
|
+ } while (0);
|
|
+
|
|
+ mbedtls_pkcs7_free(&mpkcs7);
|
|
+ return buf;
|
|
+#endif
|
|
+}
|
|
+
|
|
+#endif /* CRYPTO_MBEDTLS_CRYPTO_PKCS7 */
|
|
+
|
|
+
|
|
+#ifdef MBEDTLS_ARC4_C
|
|
+#include <mbedtls/arc4.h>
|
|
+int rc4_skip(const u8 *key, size_t keylen, size_t skip,
|
|
+ u8 *data, size_t data_len)
|
|
+{
|
|
+ mbedtls_arc4_context ctx;
|
|
+ mbedtls_arc4_init(&ctx);
|
|
+ mbedtls_arc4_setup(&ctx, key, keylen);
|
|
+
|
|
+ if (skip) {
|
|
+ /*(prefer [16] on ancient hardware with smaller cache lines)*/
|
|
+ unsigned char skip_buf[64]; /*('skip' is generally small)*/
|
|
+ /*os_memset(skip_buf, 0, sizeof(skip_buf));*/ /*(necessary?)*/
|
|
+ size_t len;
|
|
+ do {
|
|
+ len = skip > sizeof(skip_buf) ? sizeof(skip_buf) : skip;
|
|
+ mbedtls_arc4_crypt(&ctx, len, skip_buf, skip_buf);
|
|
+ } while ((skip -= len));
|
|
+ }
|
|
+
|
|
+ int ret = mbedtls_arc4_crypt(&ctx, data_len, data, data);
|
|
+ mbedtls_arc4_free(&ctx);
|
|
+ return ret;
|
|
+}
|
|
+#endif
|
|
+
|
|
+
|
|
+/* duplicated in tls_mbedtls.c:tls_mbedtls_readfile()*/
|
|
+__attribute_noinline__
|
|
+static int crypto_mbedtls_readfile(const char *path, u8 **buf, size_t *n)
|
|
+{
|
|
+ #if 0 /* #ifdef MBEDTLS_FS_IO */
|
|
+ /*(includes +1 for '\0' needed by mbedtls PEM parsing funcs)*/
|
|
+ if (mbedtls_pk_load_file(path, (unsigned char **)buf, n) != 0) {
|
|
+ wpa_printf(MSG_ERROR, "error: mbedtls_pk_load_file %s", path);
|
|
+ return -1;
|
|
+ }
|
|
+ #else
|
|
+ /*(use os_readfile() so that we can use os_free()
|
|
+ *(if we use mbedtls_pk_load_file() above, macros prevent calling free()
|
|
+ * directly #if defined(OS_REJECT_C_LIB_FUNCTIONS) and calling os_free()
|
|
+ * on buf aborts in tests if buf not allocated via os_malloc())*/
|
|
+ *buf = (u8 *)os_readfile(path, n);
|
|
+ if (!*buf) {
|
|
+ wpa_printf(MSG_ERROR, "error: os_readfile %s", path);
|
|
+ return -1;
|
|
+ }
|
|
+ u8 *buf0 = os_realloc(*buf, *n+1);
|
|
+ if (!buf0) {
|
|
+ bin_clear_free(*buf, *n);
|
|
+ *buf = NULL;
|
|
+ return -1;
|
|
+ }
|
|
+ buf0[(*n)++] = '\0';
|
|
+ *buf = buf0;
|
|
+ #endif
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+
|
|
+#ifdef CRYPTO_MBEDTLS_CRYPTO_RSA
|
|
+#ifdef MBEDTLS_RSA_C
|
|
+
|
|
+#include <mbedtls/pk.h>
|
|
+#include <mbedtls/rsa.h>
|
|
+
|
|
+struct crypto_rsa_key * crypto_rsa_key_read(const char *file, bool private_key)
|
|
+{
|
|
+ /* mbedtls_pk_parse_keyfile() and mbedtls_pk_parse_public_keyfile()
|
|
+ * require #ifdef MBEDTLS_FS_IO in mbedtls library. Prefer to use
|
|
+ * crypto_mbedtls_readfile(), which wraps os_readfile() */
|
|
+ u8 *data;
|
|
+ size_t len;
|
|
+ if (crypto_mbedtls_readfile(file, &data, &len) != 0)
|
|
+ return NULL;
|
|
+
|
|
+ mbedtls_pk_context *ctx = os_malloc(sizeof(*ctx));
|
|
+ if (ctx == NULL) {
|
|
+ bin_clear_free(data, len);
|
|
+ return NULL;
|
|
+ }
|
|
+ mbedtls_pk_init(ctx);
|
|
+
|
|
+ int rc;
|
|
+ rc = (private_key
|
|
+ ? mbedtls_pk_parse_key(ctx, data, len, NULL, 0
|
|
+ #if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
|
|
+ ,mbedtls_ctr_drbg_random,
|
|
+ crypto_mbedtls_ctr_drbg()
|
|
+ #endif
|
|
+ )
|
|
+ : mbedtls_pk_parse_public_key(ctx, data, len)) == 0
|
|
+ && mbedtls_pk_can_do(ctx, MBEDTLS_PK_RSA);
|
|
+
|
|
+ bin_clear_free(data, len);
|
|
+
|
|
+ if (rc) {
|
|
+ /* use MBEDTLS_RSA_PKCS_V21 padding for RSAES-OAEP */
|
|
+ /* use MBEDTLS_MD_SHA256 for these hostap interfaces */
|
|
+ #if MBEDTLS_VERSION_NUMBER < 0x03000000 /* mbedtls 3.0.0 */
|
|
+ /*(no return value in mbedtls 2.x)*/
|
|
+ mbedtls_rsa_set_padding(mbedtls_pk_rsa(*ctx),
|
|
+ MBEDTLS_RSA_PKCS_V21,
|
|
+ MBEDTLS_MD_SHA256);
|
|
+ #else
|
|
+ if (mbedtls_rsa_set_padding(mbedtls_pk_rsa(*ctx),
|
|
+ MBEDTLS_RSA_PKCS_V21,
|
|
+ MBEDTLS_MD_SHA256) == 0)
|
|
+ #endif
|
|
+ return (struct crypto_rsa_key *)ctx;
|
|
+ }
|
|
+
|
|
+ mbedtls_pk_free(ctx);
|
|
+ os_free(ctx);
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+struct wpabuf * crypto_rsa_oaep_sha256_encrypt(struct crypto_rsa_key *key,
|
|
+ const struct wpabuf *in)
|
|
+{
|
|
+ mbedtls_rsa_context *pk_rsa = mbedtls_pk_rsa(*(mbedtls_pk_context*)key);
|
|
+ size_t olen = mbedtls_rsa_get_len(pk_rsa);
|
|
+ struct wpabuf *buf = wpabuf_alloc(olen);
|
|
+ if (buf == NULL)
|
|
+ return NULL;
|
|
+
|
|
+ /* mbedtls_pk_encrypt() takes a few more hops to get to same func */
|
|
+ if (mbedtls_rsa_rsaes_oaep_encrypt(pk_rsa,
|
|
+ mbedtls_ctr_drbg_random,
|
|
+ crypto_mbedtls_ctr_drbg(),
|
|
+ #if MBEDTLS_VERSION_NUMBER < 0x03000000 /* mbedtls 3.0.0 */
|
|
+ MBEDTLS_RSA_PRIVATE,
|
|
+ #endif
|
|
+ NULL, 0,
|
|
+ wpabuf_len(in), wpabuf_head(in),
|
|
+ wpabuf_put(buf, olen)) == 0) {
|
|
+ return buf;
|
|
+ }
|
|
+
|
|
+ wpabuf_clear_free(buf);
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+struct wpabuf * crypto_rsa_oaep_sha256_decrypt(struct crypto_rsa_key *key,
|
|
+ const struct wpabuf *in)
|
|
+{
|
|
+ mbedtls_rsa_context *pk_rsa = mbedtls_pk_rsa(*(mbedtls_pk_context*)key);
|
|
+ size_t olen = mbedtls_rsa_get_len(pk_rsa);
|
|
+ struct wpabuf *buf = wpabuf_alloc(olen);
|
|
+ if (buf == NULL)
|
|
+ return NULL;
|
|
+
|
|
+ /* mbedtls_pk_decrypt() takes a few more hops to get to same func */
|
|
+ if (mbedtls_rsa_rsaes_oaep_decrypt(pk_rsa,
|
|
+ mbedtls_ctr_drbg_random,
|
|
+ crypto_mbedtls_ctr_drbg(),
|
|
+ #if MBEDTLS_VERSION_NUMBER < 0x03000000 /* mbedtls 3.0.0 */
|
|
+ MBEDTLS_RSA_PUBLIC,
|
|
+ #endif
|
|
+ NULL, 0, &olen, wpabuf_head(in),
|
|
+ wpabuf_mhead(buf), olen) == 0) {
|
|
+ wpabuf_put(buf, olen);
|
|
+ return buf;
|
|
+ }
|
|
+
|
|
+ wpabuf_clear_free(buf);
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+void crypto_rsa_key_free(struct crypto_rsa_key *key)
|
|
+{
|
|
+ mbedtls_pk_free((mbedtls_pk_context *)key);
|
|
+ os_free(key);
|
|
+}
|
|
+
|
|
+#endif /* MBEDTLS_RSA_C */
|
|
+#endif /* CRYPTO_MBEDTLS_CRYPTO_RSA */
|
|
+
|
|
+#ifdef CRYPTO_MBEDTLS_CRYPTO_HPKE
|
|
+
|
|
+struct wpabuf * hpke_base_seal(enum hpke_kem_id kem_id,
|
|
+ enum hpke_kdf_id kdf_id,
|
|
+ enum hpke_aead_id aead_id,
|
|
+ struct crypto_ec_key *peer_pub,
|
|
+ const u8 *info, size_t info_len,
|
|
+ const u8 *aad, size_t aad_len,
|
|
+ const u8 *pt, size_t pt_len)
|
|
+{
|
|
+ /* not yet implemented */
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+struct wpabuf * hpke_base_open(enum hpke_kem_id kem_id,
|
|
+ enum hpke_kdf_id kdf_id,
|
|
+ enum hpke_aead_id aead_id,
|
|
+ struct crypto_ec_key *own_priv,
|
|
+ const u8 *info, size_t info_len,
|
|
+ const u8 *aad, size_t aad_len,
|
|
+ const u8 *enc_ct, size_t enc_ct_len)
|
|
+{
|
|
+ /* not yet implemented */
|
|
+ return NULL;
|
|
+}
|
|
+
|
|
+#endif
|
|
--- /dev/null
|
|
+++ b/src/crypto/tls_mbedtls.c
|
|
@@ -0,0 +1,3313 @@
|
|
+/*
|
|
+ * SSL/TLS interface functions for mbed TLS
|
|
+ *
|
|
+ * SPDX-FileCopyrightText: 2022 Glenn Strauss <gstrauss@gluelogic.com>
|
|
+ * SPDX-License-Identifier: BSD-3-Clause
|
|
+ *
|
|
+ * This software may be distributed under the terms of the BSD license.
|
|
+ * See README for more details.
|
|
+ *
|
|
+ * template: src/crypto/tls_none.c
|
|
+ * reference: src/crypto/tls_*.c
|
|
+ *
|
|
+ * Known Limitations:
|
|
+ * - no TLSv1.3 (not available in mbedtls 2.x; experimental in mbedtls 3.x)
|
|
+ * - no OCSP (not yet available in mbedtls)
|
|
+ * - mbedtls does not support all certificate encodings used by hwsim tests
|
|
+ * PCKS#5 v1.5
|
|
+ * PCKS#12
|
|
+ * DH DSA
|
|
+ * - EAP-FAST, EAP-TEAP session ticket support not implemented in tls_mbedtls.c
|
|
+ * - mbedtls does not currently provide way to set an attribute in a CSR
|
|
+ * https://github.com/Mbed-TLS/mbedtls/issues/4886
|
|
+ * so tests/hwsim dpp_enterprise tests fail
|
|
+ * - DPP2 not supported
|
|
+ * PKCS#7 parsing is not supported in mbedtls
|
|
+ * See crypto_mbedtls.c:crypto_pkcs7_get_certificates() comments
|
|
+ * - DPP3 not supported
|
|
+ * hpke_base_seal() and hpke_base_seal() not implemented in crypto_mbedtls.c
|
|
+ *
|
|
+ * Status:
|
|
+ * - code written to be compatible with mbedtls 2.x and mbedtls 3.x
|
|
+ * (currently requires mbedtls >= 2.27.0 for mbedtls_mpi_random())
|
|
+ * (currently requires mbedtls >= 2.18.0 for mbedtls_ssl_tls_prf())
|
|
+ * - builds with tests/build/build-wpa_supplicant-mbedtls.config
|
|
+ * - passes all tests/ crypto module tests (incomplete coverage)
|
|
+ * ($ cd tests; make clean; make -j 4 run-tests CONFIG_TLS=mbedtls)
|
|
+ * - passes almost all tests/hwsim tests
|
|
+ * (hwsim tests skipped for missing features)
|
|
+ *
|
|
+ * RFE:
|
|
+ * - EAP-FAST, EAP-TEAP session ticket support not implemented in tls_mbedtls.c
|
|
+ * - client/server session resumption, and/or save client session ticket
|
|
+ */
|
|
+
|
|
+#include "includes.h"
|
|
+#include "common.h"
|
|
+
|
|
+#include <mbedtls/version.h>
|
|
+#include <mbedtls/ctr_drbg.h>
|
|
+#include <mbedtls/error.h>
|
|
+#include <mbedtls/oid.h>
|
|
+#include <mbedtls/pem.h>
|
|
+#include <mbedtls/platform.h> /* mbedtls_calloc() mbedtls_free() */
|
|
+#include <mbedtls/platform_util.h> /* mbedtls_platform_zeroize() */
|
|
+#include <mbedtls/ssl.h>
|
|
+#include <mbedtls/ssl_ticket.h>
|
|
+#include <mbedtls/x509.h>
|
|
+#include <mbedtls/x509_crt.h>
|
|
+
|
|
+#if MBEDTLS_VERSION_NUMBER >= 0x02040000 /* mbedtls 2.4.0 */
|
|
+#include <mbedtls/net_sockets.h>
|
|
+#else
|
|
+#include <mbedtls/net.h>
|
|
+#endif
|
|
+
|
|
+#ifndef MBEDTLS_PRIVATE
|
|
+#define MBEDTLS_PRIVATE(x) x
|
|
+#endif
|
|
+
|
|
+#if MBEDTLS_VERSION_NUMBER < 0x03020000 /* mbedtls 3.2.0 */
|
|
+#define mbedtls_ssl_get_ciphersuite_id_from_ssl(ssl) \
|
|
+ ((ssl)->MBEDTLS_PRIVATE(session) \
|
|
+ ?(ssl)->MBEDTLS_PRIVATE(session)->MBEDTLS_PRIVATE(ciphersuite) \
|
|
+ : 0)
|
|
+#define mbedtls_ssl_ciphersuite_get_name(info) \
|
|
+ (info)->MBEDTLS_PRIVATE(name)
|
|
+#endif
|
|
+
|
|
+#include "crypto.h" /* sha256_vector() */
|
|
+#include "tls.h"
|
|
+
|
|
+#ifndef SHA256_DIGEST_LENGTH
|
|
+#define SHA256_DIGEST_LENGTH 32
|
|
+#endif
|
|
+
|
|
+#ifndef MBEDTLS_EXPKEY_FIXED_SECRET_LEN
|
|
+#define MBEDTLS_EXPKEY_FIXED_SECRET_LEN 48
|
|
+#endif
|
|
+
|
|
+#ifndef MBEDTLS_EXPKEY_RAND_LEN
|
|
+#define MBEDTLS_EXPKEY_RAND_LEN 32
|
|
+#endif
|
|
+
|
|
+#if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
|
|
+static mbedtls_ssl_export_keys_t tls_connection_export_keys_cb;
|
|
+#elif MBEDTLS_VERSION_NUMBER >= 0x02120000 /* mbedtls 2.18.0 */
|
|
+static mbedtls_ssl_export_keys_ext_t tls_connection_export_keys_cb;
|
|
+#else /*(not implemented; return error)*/
|
|
+#define mbedtls_ssl_tls_prf(a,b,c,d,e,f,g,h) (-1)
|
|
+typedef mbedtls_tls_prf_types int;
|
|
+#endif
|
|
+
|
|
+
|
|
+/* hostapd/wpa_supplicant provides forced_memzero(),
|
|
+ * but prefer mbedtls_platform_zeroize() */
|
|
+#define forced_memzero(ptr,sz) mbedtls_platform_zeroize(ptr,sz)
|
|
+
|
|
+
|
|
+#if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST) \
|
|
+ || defined(EAP_TEAP) || defined(EAP_SERVER_TEAP)
|
|
+#ifdef MBEDTLS_SSL_SESSION_TICKETS
|
|
+#ifdef MBEDTLS_SSL_TICKET_C
|
|
+#define TLS_MBEDTLS_SESSION_TICKETS
|
|
+#if defined(EAP_TEAP) || defined(EAP_SERVER_TEAP)
|
|
+#define TLS_MBEDTLS_EAP_TEAP
|
|
+#endif
|
|
+#if !defined(CONFIG_FIPS) /* EAP-FAST keys cannot be exported in FIPS mode */
|
|
+#if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
|
|
+#define TLS_MBEDTLS_EAP_FAST
|
|
+#endif
|
|
+#endif
|
|
+#endif
|
|
+#endif
|
|
+#endif
|
|
+
|
|
+
|
|
+struct tls_conf {
|
|
+ mbedtls_ssl_config conf;
|
|
+
|
|
+ unsigned int verify_peer:1;
|
|
+ unsigned int verify_depth0_only:1;
|
|
+ unsigned int check_crl:2; /*(needs :2 bits for 0, 1, 2)*/
|
|
+ unsigned int check_crl_strict:1; /*(needs :1 bit for 0, 1)*/
|
|
+ unsigned int ca_cert_probe:1;
|
|
+ unsigned int has_ca_cert:1;
|
|
+ unsigned int has_client_cert:1;
|
|
+ unsigned int has_private_key:1;
|
|
+ unsigned int suiteb128:1;
|
|
+ unsigned int suiteb192:1;
|
|
+ mbedtls_x509_crl *crl;
|
|
+ mbedtls_x509_crt ca_cert;
|
|
+ mbedtls_x509_crt client_cert;
|
|
+ mbedtls_pk_context private_key;
|
|
+
|
|
+ uint32_t refcnt;
|
|
+
|
|
+ unsigned int flags;
|
|
+ char *subject_match;
|
|
+ char *altsubject_match;
|
|
+ char *suffix_match;
|
|
+ char *domain_match;
|
|
+ char *check_cert_subject;
|
|
+ u8 ca_cert_hash[SHA256_DIGEST_LENGTH];
|
|
+
|
|
+ int *ciphersuites; /* list of ciphersuite ids for mbedtls_ssl_config */
|
|
+#if MBEDTLS_VERSION_NUMBER < 0x03010000 /* mbedtls 3.1.0 */
|
|
+ mbedtls_ecp_group_id *curves;
|
|
+#else
|
|
+ uint16_t *curves; /* list of curve ids for mbedtls_ssl_config */
|
|
+#endif
|
|
+};
|
|
+
|
|
+
|
|
+struct tls_global {
|
|
+ struct tls_conf *tls_conf;
|
|
+ char *ocsp_stapling_response;
|
|
+ mbedtls_ctr_drbg_context *ctr_drbg; /*(see crypto_mbedtls.c)*/
|
|
+ #ifdef MBEDTLS_SSL_SESSION_TICKETS
|
|
+ mbedtls_ssl_ticket_context ticket_ctx;
|
|
+ #endif
|
|
+ char *ca_cert_file;
|
|
+ struct os_reltime crl_reload_previous;
|
|
+ unsigned int crl_reload_interval;
|
|
+ uint32_t refcnt;
|
|
+ struct tls_config init_conf;
|
|
+};
|
|
+
|
|
+static struct tls_global tls_ctx_global;
|
|
+
|
|
+
|
|
+struct tls_connection {
|
|
+ struct tls_conf *tls_conf;
|
|
+ struct wpabuf *push_buf;
|
|
+ struct wpabuf *pull_buf;
|
|
+ size_t pull_buf_offset;
|
|
+
|
|
+ unsigned int established:1;
|
|
+ unsigned int resumed:1;
|
|
+ unsigned int verify_peer:1;
|
|
+ unsigned int is_server:1;
|
|
+
|
|
+ mbedtls_ssl_context ssl;
|
|
+
|
|
+ mbedtls_tls_prf_types tls_prf_type;
|
|
+ size_t expkey_keyblock_size;
|
|
+ size_t expkey_secret_len;
|
|
+ #if MBEDTLS_VERSION_NUMBER < 0x03000000 /* mbedtls 3.0.0 */
|
|
+ unsigned char expkey_secret[MBEDTLS_EXPKEY_FIXED_SECRET_LEN];
|
|
+ #else
|
|
+ unsigned char expkey_secret[MBEDTLS_MD_MAX_SIZE];
|
|
+ #endif
|
|
+ unsigned char expkey_randbytes[MBEDTLS_EXPKEY_RAND_LEN*2];
|
|
+
|
|
+ int read_alerts, write_alerts, failed;
|
|
+
|
|
+ #ifdef TLS_MBEDTLS_SESSION_TICKETS
|
|
+ tls_session_ticket_cb session_ticket_cb;
|
|
+ void *session_ticket_cb_ctx;
|
|
+ unsigned char *clienthello_session_ticket;
|
|
+ size_t clienthello_session_ticket_len;
|
|
+ #endif
|
|
+ char *peer_subject; /* peer subject info for authenticated peer */
|
|
+ struct wpabuf *success_data;
|
|
+};
|
|
+
|
|
+
|
|
+#ifndef __has_attribute
|
|
+#define __has_attribute(x) 0
|
|
+#endif
|
|
+
|
|
+#ifndef __GNUC_PREREQ
|
|
+#define __GNUC_PREREQ(maj,min) 0
|
|
+#endif
|
|
+
|
|
+#ifndef __attribute_cold__
|
|
+#if __has_attribute(cold) \
|
|
+ || __GNUC_PREREQ(4,3)
|
|
+#define __attribute_cold__ __attribute__((__cold__))
|
|
+#else
|
|
+#define __attribute_cold__
|
|
+#endif
|
|
+#endif
|
|
+
|
|
+#ifndef __attribute_noinline__
|
|
+#if __has_attribute(noinline) \
|
|
+ || __GNUC_PREREQ(3,1)
|
|
+#define __attribute_noinline__ __attribute__((__noinline__))
|
|
+#else
|
|
+#define __attribute_noinline__
|
|
+#endif
|
|
+#endif
|
|
+
|
|
+
|
|
+__attribute_cold__
|
|
+__attribute_noinline__
|
|
+static void emsg(int level, const char * const msg)
|
|
+{
|
|
+ wpa_printf(level, "MTLS: %s", msg);
|
|
+}
|
|
+
|
|
+
|
|
+__attribute_cold__
|
|
+__attribute_noinline__
|
|
+static void emsgrc(int level, const char * const msg, int rc)
|
|
+{
|
|
+ #ifdef MBEDTLS_ERROR_C
|
|
+ /* error logging convenience function that decodes mbedtls result codes */
|
|
+ char buf[256];
|
|
+ mbedtls_strerror(rc, buf, sizeof(buf));
|
|
+ wpa_printf(level, "MTLS: %s: %s (-0x%04x)", msg, buf, -rc);
|
|
+ #else
|
|
+ wpa_printf(level, "MTLS: %s: (-0x%04x)", msg, -rc);
|
|
+ #endif
|
|
+}
|
|
+
|
|
+
|
|
+#define elog(rc, msg) emsgrc(MSG_ERROR, (msg), (rc))
|
|
+#define ilog(rc, msg) emsgrc(MSG_INFO, (msg), (rc))
|
|
+
|
|
+
|
|
+struct tls_conf * tls_conf_init(void *tls_ctx)
|
|
+{
|
|
+ struct tls_conf *tls_conf = os_zalloc(sizeof(*tls_conf));
|
|
+ if (tls_conf == NULL)
|
|
+ return NULL;
|
|
+ tls_conf->refcnt = 1;
|
|
+
|
|
+ mbedtls_ssl_config_init(&tls_conf->conf);
|
|
+ mbedtls_ssl_conf_rng(&tls_conf->conf,
|
|
+ mbedtls_ctr_drbg_random, tls_ctx_global.ctr_drbg);
|
|
+ mbedtls_x509_crt_init(&tls_conf->ca_cert);
|
|
+ mbedtls_x509_crt_init(&tls_conf->client_cert);
|
|
+ mbedtls_pk_init(&tls_conf->private_key);
|
|
+
|
|
+ return tls_conf;
|
|
+}
|
|
+
|
|
+
|
|
+void tls_conf_deinit(struct tls_conf *tls_conf)
|
|
+{
|
|
+ if (tls_conf == NULL || --tls_conf->refcnt != 0)
|
|
+ return;
|
|
+
|
|
+ mbedtls_x509_crt_free(&tls_conf->ca_cert);
|
|
+ mbedtls_x509_crt_free(&tls_conf->client_cert);
|
|
+ if (tls_conf->crl) {
|
|
+ mbedtls_x509_crl_free(tls_conf->crl);
|
|
+ os_free(tls_conf->crl);
|
|
+ }
|
|
+ mbedtls_pk_free(&tls_conf->private_key);
|
|
+ mbedtls_ssl_config_free(&tls_conf->conf);
|
|
+ os_free(tls_conf->curves);
|
|
+ os_free(tls_conf->ciphersuites);
|
|
+ os_free(tls_conf->subject_match);
|
|
+ os_free(tls_conf->altsubject_match);
|
|
+ os_free(tls_conf->suffix_match);
|
|
+ os_free(tls_conf->domain_match);
|
|
+ os_free(tls_conf->check_cert_subject);
|
|
+ os_free(tls_conf);
|
|
+}
|
|
+
|
|
+
|
|
+mbedtls_ctr_drbg_context * crypto_mbedtls_ctr_drbg(void); /*(not in header)*/
|
|
+
|
|
+__attribute_cold__
|
|
+void * tls_init(const struct tls_config *conf)
|
|
+{
|
|
+ /* RFE: review struct tls_config *conf (different from tls_conf) */
|
|
+
|
|
+ if (++tls_ctx_global.refcnt > 1)
|
|
+ return &tls_ctx_global;
|
|
+
|
|
+ tls_ctx_global.ctr_drbg = crypto_mbedtls_ctr_drbg();
|
|
+ #ifdef MBEDTLS_SSL_SESSION_TICKETS
|
|
+ mbedtls_ssl_ticket_init(&tls_ctx_global.ticket_ctx);
|
|
+ mbedtls_ssl_ticket_setup(&tls_ctx_global.ticket_ctx,
|
|
+ mbedtls_ctr_drbg_random,
|
|
+ tls_ctx_global.ctr_drbg,
|
|
+ MBEDTLS_CIPHER_AES_256_GCM,
|
|
+ 43200); /* ticket timeout: 12 hours */
|
|
+ #endif
|
|
+ /* copy struct for future use */
|
|
+ tls_ctx_global.init_conf = *conf;
|
|
+ if (conf->openssl_ciphers)
|
|
+ tls_ctx_global.init_conf.openssl_ciphers =
|
|
+ os_strdup(conf->openssl_ciphers);
|
|
+
|
|
+ tls_ctx_global.crl_reload_interval = conf->crl_reload_interval;
|
|
+ os_get_reltime(&tls_ctx_global.crl_reload_previous);
|
|
+
|
|
+ return &tls_ctx_global;
|
|
+}
|
|
+
|
|
+
|
|
+__attribute_cold__
|
|
+void tls_deinit(void *tls_ctx)
|
|
+{
|
|
+ if (tls_ctx == NULL || --tls_ctx_global.refcnt != 0)
|
|
+ return;
|
|
+
|
|
+ tls_conf_deinit(tls_ctx_global.tls_conf);
|
|
+ os_free(tls_ctx_global.ca_cert_file);
|
|
+ os_free(tls_ctx_global.ocsp_stapling_response);
|
|
+ char *openssl_ciphers; /*(allocated in tls_init())*/
|
|
+ *(const char **)&openssl_ciphers =
|
|
+ tls_ctx_global.init_conf.openssl_ciphers;
|
|
+ os_free(openssl_ciphers);
|
|
+ #ifdef MBEDTLS_SSL_SESSION_TICKETS
|
|
+ mbedtls_ssl_ticket_free(&tls_ctx_global.ticket_ctx);
|
|
+ #endif
|
|
+ os_memset(&tls_ctx_global, 0, sizeof(tls_ctx_global));
|
|
+}
|
|
+
|
|
+
|
|
+int tls_get_errors(void *tls_ctx)
|
|
+{
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+
|
|
+static void tls_connection_deinit_expkey(struct tls_connection *conn)
|
|
+{
|
|
+ conn->tls_prf_type = 0; /* MBEDTLS_SSL_TLS_PRF_NONE; */
|
|
+ conn->expkey_keyblock_size = 0;
|
|
+ conn->expkey_secret_len = 0;
|
|
+ forced_memzero(conn->expkey_secret, sizeof(conn->expkey_secret));
|
|
+ forced_memzero(conn->expkey_randbytes, sizeof(conn->expkey_randbytes));
|
|
+}
|
|
+
|
|
+
|
|
+#ifdef TLS_MBEDTLS_SESSION_TICKETS
|
|
+void tls_connection_deinit_clienthello_session_ticket(struct tls_connection *conn)
|
|
+{
|
|
+ if (conn->clienthello_session_ticket) {
|
|
+ mbedtls_platform_zeroize(conn->clienthello_session_ticket,
|
|
+ conn->clienthello_session_ticket_len);
|
|
+ mbedtls_free(conn->clienthello_session_ticket);
|
|
+ conn->clienthello_session_ticket = NULL;
|
|
+ conn->clienthello_session_ticket_len = 0;
|
|
+ }
|
|
+}
|
|
+#endif
|
|
+
|
|
+
|
|
+void tls_connection_deinit(void *tls_ctx, struct tls_connection *conn)
|
|
+{
|
|
+ if (conn == NULL)
|
|
+ return;
|
|
+
|
|
+ #if 0 /*(good intention, but never sent since we destroy self below)*/
|
|
+ if (conn->established)
|
|
+ mbedtls_ssl_close_notify(&conn->ssl);
|
|
+ #endif
|
|
+
|
|
+ if (conn->tls_prf_type)
|
|
+ tls_connection_deinit_expkey(conn);
|
|
+
|
|
+ #ifdef TLS_MBEDTLS_SESSION_TICKETS
|
|
+ if (conn->clienthello_session_ticket)
|
|
+ tls_connection_deinit_clienthello_session_ticket(conn);
|
|
+ #endif
|
|
+
|
|
+ os_free(conn->peer_subject);
|
|
+ wpabuf_free(conn->success_data);
|
|
+ wpabuf_free(conn->push_buf);
|
|
+ wpabuf_free(conn->pull_buf);
|
|
+ mbedtls_ssl_free(&conn->ssl);
|
|
+ tls_conf_deinit(conn->tls_conf);
|
|
+ os_free(conn);
|
|
+}
|
|
+
|
|
+
|
|
+static void tls_mbedtls_refresh_crl(void);
|
|
+static int tls_mbedtls_ssl_setup(struct tls_connection *conn);
|
|
+
|
|
+struct tls_connection * tls_connection_init(void *tls_ctx)
|
|
+{
|
|
+ struct tls_connection *conn = os_zalloc(sizeof(*conn));
|
|
+ if (conn == NULL)
|
|
+ return NULL;
|
|
+
|
|
+ mbedtls_ssl_init(&conn->ssl);
|
|
+
|
|
+ conn->tls_conf = tls_ctx_global.tls_conf; /*(inherit global conf, if set)*/
|
|
+ if (conn->tls_conf) {
|
|
+ ++conn->tls_conf->refcnt;
|
|
+ /* check for CRL refresh if inheriting from global config */
|
|
+ tls_mbedtls_refresh_crl();
|
|
+
|
|
+ conn->verify_peer = conn->tls_conf->verify_peer;
|
|
+ if (tls_mbedtls_ssl_setup(conn) != 0) {
|
|
+ tls_connection_deinit(&tls_ctx_global, conn);
|
|
+ return NULL;
|
|
+ }
|
|
+ }
|
|
+
|
|
+ return conn;
|
|
+}
|
|
+
|
|
+
|
|
+int tls_connection_established(void *tls_ctx, struct tls_connection *conn)
|
|
+{
|
|
+ return conn ? conn->established : 0;
|
|
+}
|
|
+
|
|
+
|
|
+__attribute_noinline__
|
|
+char * tls_mbedtls_peer_serial_num(const mbedtls_x509_crt *crt, char *serial_num, size_t len)
|
|
+{
|
|
+ /* mbedtls_x509_serial_gets() inefficiently formats to hex separated by
|
|
+ * colons, so generate the hex serial number here. The func
|
|
+ * wpa_snprintf_hex_uppercase() is similarly inefficient. */
|
|
+ size_t i = 0; /* skip leading 0's per Distinguished Encoding Rules (DER) */
|
|
+ while (i < crt->serial.len && crt->serial.p[i] == 0) ++i;
|
|
+ if (i == crt->serial.len) --i;
|
|
+
|
|
+ const unsigned char *s = crt->serial.p + i;
|
|
+ const size_t e = (crt->serial.len - i) * 2;
|
|
+ if (e >= len)
|
|
+ return NULL;
|
|
+ #if 0
|
|
+ wpa_snprintf_hex_uppercase(serial_num, len, s, crt->serial.len-i);
|
|
+ #else
|
|
+ for (i = 0; i < e; i+=2, ++s) {
|
|
+ serial_num[i+0] = "0123456789ABCDEF"[(*s >> 4)];
|
|
+ serial_num[i+1] = "0123456789ABCDEF"[(*s & 0xF)];
|
|
+ }
|
|
+ serial_num[e] = '\0';
|
|
+ #endif
|
|
+ return serial_num;
|
|
+}
|
|
+
|
|
+
|
|
+char * tls_connection_peer_serial_num(void *tls_ctx,
|
|
+ struct tls_connection *conn)
|
|
+{
|
|
+ const mbedtls_x509_crt *crt = mbedtls_ssl_get_peer_cert(&conn->ssl);
|
|
+ if (crt == NULL)
|
|
+ return NULL;
|
|
+ size_t len = crt->serial.len * 2 + 1;
|
|
+ char *serial_num = os_malloc(len);
|
|
+ if (!serial_num)
|
|
+ return NULL;
|
|
+ return tls_mbedtls_peer_serial_num(crt, serial_num, len);
|
|
+}
|
|
+
|
|
+
|
|
+static void tls_pull_buf_reset(struct tls_connection *conn);
|
|
+
|
|
+int tls_connection_shutdown(void *tls_ctx, struct tls_connection *conn)
|
|
+{
|
|
+ /* Note: this function called from eap_peer_tls_reauth_init()
|
|
+ * for session resumption, not for connection shutdown */
|
|
+
|
|
+ if (conn == NULL)
|
|
+ return -1;
|
|
+
|
|
+ tls_pull_buf_reset(conn);
|
|
+ wpabuf_free(conn->push_buf);
|
|
+ conn->push_buf = NULL;
|
|
+ conn->established = 0;
|
|
+ conn->resumed = 0;
|
|
+ if (conn->tls_prf_type)
|
|
+ tls_connection_deinit_expkey(conn);
|
|
+
|
|
+ /* RFE: prepare for session resumption? (see doc in crypto/tls.h) */
|
|
+
|
|
+ return mbedtls_ssl_session_reset(&conn->ssl);
|
|
+}
|
|
+
|
|
+
|
|
+static int tls_wpabuf_resize_put_data(struct wpabuf **buf,
|
|
+ const unsigned char *data, size_t dlen)
|
|
+{
|
|
+ if (wpabuf_resize(buf, dlen) < 0)
|
|
+ return 0;
|
|
+ wpabuf_put_data(*buf, data, dlen);
|
|
+ return 1;
|
|
+}
|
|
+
|
|
+
|
|
+static int tls_pull_buf_append(struct tls_connection *conn,
|
|
+ const struct wpabuf *in_data)
|
|
+{
|
|
+ /*(interface does not lend itself to move semantics)*/
|
|
+ return tls_wpabuf_resize_put_data(&conn->pull_buf,
|
|
+ wpabuf_head(in_data),
|
|
+ wpabuf_len(in_data));
|
|
+}
|
|
+
|
|
+
|
|
+static void tls_pull_buf_reset(struct tls_connection *conn)
|
|
+{
|
|
+ /*(future: might consider reusing conn->pull_buf)*/
|
|
+ wpabuf_free(conn->pull_buf);
|
|
+ conn->pull_buf = NULL;
|
|
+ conn->pull_buf_offset = 0;
|
|
+}
|
|
+
|
|
+
|
|
+__attribute_cold__
|
|
+static void tls_pull_buf_discard(struct tls_connection *conn, const char *func)
|
|
+{
|
|
+ size_t discard = wpabuf_len(conn->pull_buf) - conn->pull_buf_offset;
|
|
+ if (discard)
|
|
+ wpa_printf(MSG_DEBUG,
|
|
+ "%s - %zu bytes remaining in pull_buf; discarding",
|
|
+ func, discard);
|
|
+ tls_pull_buf_reset(conn);
|
|
+}
|
|
+
|
|
+
|
|
+static int tls_pull_func(void *ptr, unsigned char *buf, size_t len)
|
|
+{
|
|
+ struct tls_connection *conn = (struct tls_connection *) ptr;
|
|
+ if (conn->pull_buf == NULL)
|
|
+ return MBEDTLS_ERR_SSL_WANT_READ;
|
|
+ const size_t dlen = wpabuf_len(conn->pull_buf) - conn->pull_buf_offset;
|
|
+ if (dlen == 0)
|
|
+ return MBEDTLS_ERR_SSL_WANT_READ;
|
|
+
|
|
+ if (len > dlen)
|
|
+ len = dlen;
|
|
+ os_memcpy(buf, wpabuf_head(conn->pull_buf)+conn->pull_buf_offset, len);
|
|
+
|
|
+ if (len == dlen) {
|
|
+ tls_pull_buf_reset(conn);
|
|
+ /*wpa_printf(MSG_DEBUG, "%s - emptied pull_buf", __func__);*/
|
|
+ }
|
|
+ else {
|
|
+ conn->pull_buf_offset += len;
|
|
+ /*wpa_printf(MSG_DEBUG, "%s - %zu bytes remaining in pull_buf",
|
|
+ __func__, dlen - len);*/
|
|
+ }
|
|
+ return (int)len;
|
|
+}
|
|
+
|
|
+
|
|
+static int tls_push_func(void *ptr, const unsigned char *buf, size_t len)
|
|
+{
|
|
+ struct tls_connection *conn = (struct tls_connection *) ptr;
|
|
+ return tls_wpabuf_resize_put_data(&conn->push_buf, buf, len)
|
|
+ ? (int)len
|
|
+ : MBEDTLS_ERR_SSL_ALLOC_FAILED;
|
|
+}
|
|
+
|
|
+
|
|
+static int
|
|
+tls_mbedtls_verify_cb (void *arg, mbedtls_x509_crt *crt, int depth, uint32_t *flags);
|
|
+
|
|
+
|
|
+static int tls_mbedtls_ssl_setup(struct tls_connection *conn)
|
|
+{
|
|
+ #if 0
|
|
+ /* mbedtls_ssl_setup() must be called only once */
|
|
+ /* If this func might be called multiple times (e.g. via set_params),
|
|
+ * then we should set a flag in conn that ssl was initialized */
|
|
+ if (conn->ssl_is_init) {
|
|
+ mbedtls_ssl_free(&conn->ssl);
|
|
+ mbedtls_ssl_init(&conn->ssl);
|
|
+ }
|
|
+ #endif
|
|
+
|
|
+ int ret = mbedtls_ssl_setup(&conn->ssl, &conn->tls_conf->conf);
|
|
+ if (ret != 0) {
|
|
+ elog(ret, "mbedtls_ssl_setup");
|
|
+ return -1;
|
|
+ }
|
|
+
|
|
+ mbedtls_ssl_set_bio(&conn->ssl, conn, tls_push_func, tls_pull_func, NULL);
|
|
+ #if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
|
|
+ mbedtls_ssl_set_export_keys_cb(
|
|
+ &conn->ssl, tls_connection_export_keys_cb, conn);
|
|
+ #elif MBEDTLS_VERSION_NUMBER >= 0x02120000 /* mbedtls 2.18.0 */
|
|
+ mbedtls_ssl_conf_export_keys_ext_cb(
|
|
+ &conn->tls_conf->conf, tls_connection_export_keys_cb, conn);
|
|
+ #endif
|
|
+ if (conn->verify_peer)
|
|
+ mbedtls_ssl_set_verify(&conn->ssl, tls_mbedtls_verify_cb, conn);
|
|
+
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+
|
|
+static int tls_mbedtls_data_is_pem(const u8 *data)
|
|
+{
|
|
+ return (NULL != os_strstr((char *)data, "-----"));
|
|
+}
|
|
+
|
|
+
|
|
+static void tls_mbedtls_set_allowed_tls_vers(struct tls_conf *tls_conf,
|
|
+ mbedtls_ssl_config *conf)
|
|
+{
|
|
+ #if !defined(MBEDTLS_SSL_PROTO_TLS1_3)
|
|
+ tls_conf->flags |= TLS_CONN_DISABLE_TLSv1_3;
|
|
+ #endif
|
|
+
|
|
+ /* unconditionally require TLSv1.2+ for TLS_CONN_SUITEB */
|
|
+ if (tls_conf->flags & TLS_CONN_SUITEB) {
|
|
+ tls_conf->flags |= TLS_CONN_DISABLE_TLSv1_0;
|
|
+ tls_conf->flags |= TLS_CONN_DISABLE_TLSv1_1;
|
|
+ }
|
|
+
|
|
+ const unsigned int flags = tls_conf->flags;
|
|
+
|
|
+ /* attempt to map flags to min and max TLS protocol version */
|
|
+
|
|
+ int min = (flags & TLS_CONN_DISABLE_TLSv1_0)
|
|
+ ? (flags & TLS_CONN_DISABLE_TLSv1_1)
|
|
+ ? (flags & TLS_CONN_DISABLE_TLSv1_2)
|
|
+ ? (flags & TLS_CONN_DISABLE_TLSv1_3)
|
|
+ ? 4
|
|
+ : 3
|
|
+ : 2
|
|
+ : 1
|
|
+ : 0;
|
|
+
|
|
+ int max = (flags & TLS_CONN_DISABLE_TLSv1_3)
|
|
+ ? (flags & TLS_CONN_DISABLE_TLSv1_2)
|
|
+ ? (flags & TLS_CONN_DISABLE_TLSv1_1)
|
|
+ ? (flags & TLS_CONN_DISABLE_TLSv1_0)
|
|
+ ? -1
|
|
+ : 0
|
|
+ : 1
|
|
+ : 2
|
|
+ : 3;
|
|
+
|
|
+ if ((flags & TLS_CONN_ENABLE_TLSv1_2) && min > 2) min = 2;
|
|
+ if ((flags & TLS_CONN_ENABLE_TLSv1_1) && min > 1) min = 1;
|
|
+ if ((flags & TLS_CONN_ENABLE_TLSv1_0) && min > 0) min = 0;
|
|
+ if (max < min) {
|
|
+ emsg(MSG_ERROR, "invalid tls_disable_tlsv* params; ignoring");
|
|
+ return;
|
|
+ }
|
|
+ #if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
|
|
+ /* mbed TLS 3.0.0 removes support for protocols < TLSv1.2 */
|
|
+ if (min < 2 || max < 2) {
|
|
+ emsg(MSG_ERROR, "invalid tls_disable_tlsv* params; ignoring");
|
|
+ if (min < 2) min = 2;
|
|
+ if (max < 2) max = 2;
|
|
+ }
|
|
+ #endif
|
|
+
|
|
+ #if MBEDTLS_VERSION_NUMBER >= 0x03020000 /* mbedtls 3.2.0 */
|
|
+ /* MBEDTLS_SSL_VERSION_TLS1_2 = 0x0303 *//*!< (D)TLS 1.2 */
|
|
+ /* MBEDTLS_SSL_VERSION_TLS1_3 = 0x0304 *//*!< (D)TLS 1.3 */
|
|
+ min = (min == 2) ? MBEDTLS_SSL_VERSION_TLS1_2 : MBEDTLS_SSL_VERSION_TLS1_3;
|
|
+ max = (max == 2) ? MBEDTLS_SSL_VERSION_TLS1_2 : MBEDTLS_SSL_VERSION_TLS1_3;
|
|
+ mbedtls_ssl_conf_min_tls_version(conf, min);
|
|
+ mbedtls_ssl_conf_max_tls_version(conf, max);
|
|
+ #else
|
|
+ #ifndef MBEDTLS_SSL_MINOR_VERSION_4
|
|
+ if (min == 3) min = 2;
|
|
+ if (max == 3) max = 2;
|
|
+ #endif
|
|
+ /* MBEDTLS_SSL_MINOR_VERSION_0 0 *//*!< SSL v3.0 */
|
|
+ /* MBEDTLS_SSL_MINOR_VERSION_1 1 *//*!< TLS v1.0 */
|
|
+ /* MBEDTLS_SSL_MINOR_VERSION_2 2 *//*!< TLS v1.1 */
|
|
+ /* MBEDTLS_SSL_MINOR_VERSION_3 3 *//*!< TLS v1.2 */
|
|
+ /* MBEDTLS_SSL_MINOR_VERSION_4 4 *//*!< TLS v1.3 */
|
|
+ mbedtls_ssl_conf_min_version(conf, MBEDTLS_SSL_MAJOR_VERSION_3, min+1);
|
|
+ mbedtls_ssl_conf_max_version(conf, MBEDTLS_SSL_MAJOR_VERSION_3, max+1);
|
|
+ #endif
|
|
+}
|
|
+
|
|
+
|
|
+__attribute_noinline__
|
|
+static int tls_mbedtls_readfile(const char *path, u8 **buf, size_t *n);
|
|
+
|
|
+
|
|
+static int
|
|
+tls_mbedtls_set_dhparams(struct tls_conf *tls_conf, const char *dh_file)
|
|
+{
|
|
+ size_t len;
|
|
+ u8 *data;
|
|
+ if (tls_mbedtls_readfile(dh_file, &data, &len))
|
|
+ return 0;
|
|
+
|
|
+ /* parse only if DH parameters if in PEM format */
|
|
+ if (tls_mbedtls_data_is_pem(data)
|
|
+ && NULL == os_strstr((char *)data, "-----BEGIN DH PARAMETERS-----")) {
|
|
+ if (os_strstr((char *)data, "-----BEGIN DSA PARAMETERS-----"))
|
|
+ wpa_printf(MSG_WARNING, "DSA parameters not handled (%s)", dh_file);
|
|
+ else
|
|
+ wpa_printf(MSG_WARNING, "unexpected DH param content (%s)",dh_file);
|
|
+ forced_memzero(data, len);
|
|
+ os_free(data);
|
|
+ return 0;
|
|
+ }
|
|
+
|
|
+ /* mbedtls_dhm_parse_dhm() expects "-----BEGIN DH PARAMETERS-----" if PEM */
|
|
+ mbedtls_dhm_context dhm;
|
|
+ mbedtls_dhm_init(&dhm);
|
|
+ int rc = mbedtls_dhm_parse_dhm(&dhm, data, len);
|
|
+ if (0 == rc)
|
|
+ rc = mbedtls_ssl_conf_dh_param_ctx(&tls_conf->conf, &dhm);
|
|
+ if (0 != rc)
|
|
+ elog(rc, dh_file);
|
|
+ mbedtls_dhm_free(&dhm);
|
|
+
|
|
+ forced_memzero(data, len);
|
|
+ os_free(data);
|
|
+ return (0 == rc);
|
|
+}
|
|
+
|
|
+
|
|
+/* reference: lighttpd src/mod_mbedtls.c:mod_mbedtls_ssl_append_curve()
|
|
+ * (same author: gstrauss@gluelogic.com; same license: BSD-3-Clause) */
|
|
+#if MBEDTLS_VERSION_NUMBER < 0x03010000 /* mbedtls 3.1.0 */
|
|
+static int
|
|
+tls_mbedtls_append_curve (mbedtls_ecp_group_id *ids, int nids, int idsz, const mbedtls_ecp_group_id id)
|
|
+{
|
|
+ if (1 >= idsz - (nids + 1)) {
|
|
+ emsg(MSG_ERROR, "error: too many curves during list expand");
|
|
+ return -1;
|
|
+ }
|
|
+ ids[++nids] = id;
|
|
+ return nids;
|
|
+}
|
|
+
|
|
+
|
|
+static int
|
|
+tls_mbedtls_set_curves(struct tls_conf *tls_conf, const char *curvelist)
|
|
+{
|
|
+ mbedtls_ecp_group_id ids[512];
|
|
+ int nids = -1;
|
|
+ const int idsz = (int)(sizeof(ids)/sizeof(*ids)-1);
|
|
+ const mbedtls_ecp_curve_info * const curve_info = mbedtls_ecp_curve_list();
|
|
+
|
|
+ for (const char *e = curvelist-1; e; ) {
|
|
+ const char * const n = e+1;
|
|
+ e = os_strchr(n, ':');
|
|
+ size_t len = e ? (size_t)(e - n) : os_strlen(n);
|
|
+ mbedtls_ecp_group_id grp_id = MBEDTLS_ECP_DP_NONE;
|
|
+ switch (len) {
|
|
+ case 5:
|
|
+ if (0 == os_memcmp("P-521", n, 5))
|
|
+ grp_id = MBEDTLS_ECP_DP_SECP521R1;
|
|
+ else if (0 == os_memcmp("P-384", n, 5))
|
|
+ grp_id = MBEDTLS_ECP_DP_SECP384R1;
|
|
+ else if (0 == os_memcmp("P-256", n, 5))
|
|
+ grp_id = MBEDTLS_ECP_DP_SECP256R1;
|
|
+ break;
|
|
+ case 6:
|
|
+ if (0 == os_memcmp("BP-521", n, 6))
|
|
+ grp_id = MBEDTLS_ECP_DP_BP512R1;
|
|
+ else if (0 == os_memcmp("BP-384", n, 6))
|
|
+ grp_id = MBEDTLS_ECP_DP_BP384R1;
|
|
+ else if (0 == os_memcmp("BP-256", n, 6))
|
|
+ grp_id = MBEDTLS_ECP_DP_BP256R1;
|
|
+ break;
|
|
+ default:
|
|
+ break;
|
|
+ }
|
|
+ if (grp_id != MBEDTLS_ECP_DP_NONE) {
|
|
+ nids = tls_mbedtls_append_curve(ids, nids, idsz, grp_id);
|
|
+ if (-1 == nids) return 0;
|
|
+ continue;
|
|
+ }
|
|
+ /* similar to mbedtls_ecp_curve_info_from_name() */
|
|
+ const mbedtls_ecp_curve_info *info;
|
|
+ for (info = curve_info; info->grp_id != MBEDTLS_ECP_DP_NONE; ++info) {
|
|
+ if (0 == os_strncmp(info->name, n, len) && info->name[len] == '\0')
|
|
+ break;
|
|
+ }
|
|
+ if (info->grp_id == MBEDTLS_ECP_DP_NONE) {
|
|
+ wpa_printf(MSG_ERROR, "MTLS: unrecognized curve: %.*s",(int)len,n);
|
|
+ return 0;
|
|
+ }
|
|
+
|
|
+ nids = tls_mbedtls_append_curve(ids, nids, idsz, info->grp_id);
|
|
+ if (-1 == nids) return 0;
|
|
+ }
|
|
+
|
|
+ /* mod_openssl configures "prime256v1" if curve list not specified,
|
|
+ * but mbedtls provides a list of supported curves if not explicitly set */
|
|
+ if (-1 == nids) return 1; /* empty list; no-op */
|
|
+
|
|
+ ids[++nids] = MBEDTLS_ECP_DP_NONE; /* terminate list */
|
|
+ ++nids;
|
|
+
|
|
+ /* curves list must be persistent for lifetime of mbedtls_ssl_config */
|
|
+ tls_conf->curves = os_malloc(nids * sizeof(mbedtls_ecp_group_id));
|
|
+ if (tls_conf->curves == NULL)
|
|
+ return 0;
|
|
+ os_memcpy(tls_conf->curves, ids, nids * sizeof(mbedtls_ecp_group_id));
|
|
+
|
|
+ mbedtls_ssl_conf_curves(&tls_conf->conf, tls_conf->curves);
|
|
+ return 1;
|
|
+}
|
|
+#else
|
|
+static int
|
|
+tls_mbedtls_append_curve (uint16_t *ids, int nids, int idsz, const uint16_t id)
|
|
+{
|
|
+ if (1 >= idsz - (nids + 1)) {
|
|
+ emsg(MSG_ERROR, "error: too many curves during list expand");
|
|
+ return -1;
|
|
+ }
|
|
+ ids[++nids] = id;
|
|
+ return nids;
|
|
+}
|
|
+
|
|
+
|
|
+static int
|
|
+tls_mbedtls_set_curves(struct tls_conf *tls_conf, const char *curvelist)
|
|
+{
|
|
+ /* TLS Supported Groups (renamed from "EC Named Curve Registry")
|
|
+ * https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
|
|
+ */
|
|
+ uint16_t ids[512];
|
|
+ int nids = -1;
|
|
+ const int idsz = (int)(sizeof(ids)/sizeof(*ids)-1);
|
|
+ const mbedtls_ecp_curve_info * const curve_info = mbedtls_ecp_curve_list();
|
|
+
|
|
+ for (const char *e = curvelist-1; e; ) {
|
|
+ const char * const n = e+1;
|
|
+ e = os_strchr(n, ':');
|
|
+ size_t len = e ? (size_t)(e - n) : os_strlen(n);
|
|
+ uint16_t tls_id = 0;
|
|
+ switch (len) {
|
|
+ case 5:
|
|
+ if (0 == os_memcmp("P-521", n, 5))
|
|
+ tls_id = 25; /* mbedtls_ecp_group_id MBEDTLS_ECP_DP_SECP521R1 */
|
|
+ else if (0 == os_memcmp("P-384", n, 5))
|
|
+ tls_id = 24; /* mbedtls_ecp_group_id MBEDTLS_ECP_DP_SECP384R1 */
|
|
+ else if (0 == os_memcmp("P-256", n, 5))
|
|
+ tls_id = 23; /* mbedtls_ecp_group_id MBEDTLS_ECP_DP_SECP256R1 */
|
|
+ break;
|
|
+ case 6:
|
|
+ if (0 == os_memcmp("BP-521", n, 6))
|
|
+ tls_id = 28; /* mbedtls_ecp_group_id MBEDTLS_ECP_DP_BP512R1 */
|
|
+ else if (0 == os_memcmp("BP-384", n, 6))
|
|
+ tls_id = 27; /* mbedtls_ecp_group_id MBEDTLS_ECP_DP_BP384R1 */
|
|
+ else if (0 == os_memcmp("BP-256", n, 6))
|
|
+ tls_id = 26; /* mbedtls_ecp_group_id MBEDTLS_ECP_DP_BP256R1 */
|
|
+ break;
|
|
+ default:
|
|
+ break;
|
|
+ }
|
|
+ if (tls_id != 0) {
|
|
+ nids = tls_mbedtls_append_curve(ids, nids, idsz, tls_id);
|
|
+ if (-1 == nids) return 0;
|
|
+ continue;
|
|
+ }
|
|
+ /* similar to mbedtls_ecp_curve_info_from_name() */
|
|
+ const mbedtls_ecp_curve_info *info;
|
|
+ for (info = curve_info; info->tls_id != 0; ++info) {
|
|
+ if (0 == os_strncmp(info->name, n, len) && info->name[len] == '\0')
|
|
+ break;
|
|
+ }
|
|
+ if (info->tls_id == 0) {
|
|
+ wpa_printf(MSG_ERROR, "MTLS: unrecognized curve: %.*s",(int)len,n);
|
|
+ return 0;
|
|
+ }
|
|
+
|
|
+ nids = tls_mbedtls_append_curve(ids, nids, idsz, info->tls_id);
|
|
+ if (-1 == nids) return 0;
|
|
+ }
|
|
+
|
|
+ /* mod_openssl configures "prime256v1" if curve list not specified,
|
|
+ * but mbedtls provides a list of supported curves if not explicitly set */
|
|
+ if (-1 == nids) return 1; /* empty list; no-op */
|
|
+
|
|
+ ids[++nids] = 0; /* terminate list */
|
|
+ ++nids;
|
|
+
|
|
+ /* curves list must be persistent for lifetime of mbedtls_ssl_config */
|
|
+ tls_conf->curves = os_malloc(nids * sizeof(uint16_t));
|
|
+ if (tls_conf->curves == NULL)
|
|
+ return 0;
|
|
+ os_memcpy(tls_conf->curves, ids, nids * sizeof(uint16_t));
|
|
+
|
|
+ mbedtls_ssl_conf_groups(&tls_conf->conf, tls_conf->curves);
|
|
+ return 1;
|
|
+}
|
|
+#endif /* MBEDTLS_VERSION_NUMBER >= 0x03010000 */ /* mbedtls 3.1.0 */
|
|
+
|
|
+
|
|
+/* data copied from lighttpd src/mod_mbedtls.c (BSD-3-Clause) */
|
|
+static const int suite_AES_256_ephemeral[] = {
|
|
+ /* All AES-256 ephemeral suites */
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
|
|
+ MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM,
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
|
|
+ MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
|
|
+ MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM_8
|
|
+};
|
|
+
|
|
+/* data copied from lighttpd src/mod_mbedtls.c (BSD-3-Clause) */
|
|
+static const int suite_AES_128_ephemeral[] = {
|
|
+ /* All AES-128 ephemeral suites */
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
|
|
+ MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM,
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
|
|
+ MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
|
|
+ MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM_8
|
|
+};
|
|
+
|
|
+/* data copied from lighttpd src/mod_mbedtls.c (BSD-3-Clause) */
|
|
+/* HIGH cipher list (mapped from openssl list to mbedtls) */
|
|
+static const int suite_HIGH[] = {
|
|
+ MBEDTLS_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
|
|
+ MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM,
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
|
|
+ MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
|
|
+ MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CCM_8,
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384,
|
|
+ MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384,
|
|
+ MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384,
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
|
|
+ MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM,
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
|
|
+ MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
|
|
+ MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CCM_8,
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256,
|
|
+ MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256,
|
|
+ MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256,
|
|
+ MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256,
|
|
+ MBEDTLS_TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256,
|
|
+ MBEDTLS_TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256,
|
|
+ MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384,
|
|
+ MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CCM,
|
|
+ MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384,
|
|
+ MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384,
|
|
+ MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA,
|
|
+ MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA,
|
|
+ MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384,
|
|
+ MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384,
|
|
+ MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CCM_8,
|
|
+ MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384,
|
|
+ MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256,
|
|
+ MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CCM,
|
|
+ MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256,
|
|
+ MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256,
|
|
+ MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA,
|
|
+ MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA,
|
|
+ MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256,
|
|
+ MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256,
|
|
+ MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CCM_8,
|
|
+ MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256,
|
|
+ MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384,
|
|
+ MBEDTLS_TLS_RSA_WITH_AES_256_CCM,
|
|
+ MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256,
|
|
+ MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA,
|
|
+ MBEDTLS_TLS_RSA_WITH_AES_256_CCM_8,
|
|
+ MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256,
|
|
+ MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA,
|
|
+ MBEDTLS_TLS_RSA_WITH_ARIA_256_GCM_SHA384,
|
|
+ MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256,
|
|
+ MBEDTLS_TLS_RSA_WITH_AES_128_CCM,
|
|
+ MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256,
|
|
+ MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA,
|
|
+ MBEDTLS_TLS_RSA_WITH_AES_128_CCM_8,
|
|
+ MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256,
|
|
+ MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA,
|
|
+ MBEDTLS_TLS_RSA_WITH_ARIA_128_GCM_SHA256,
|
|
+ MBEDTLS_TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256,
|
|
+ MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384,
|
|
+ MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384,
|
|
+ MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA,
|
|
+ MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384,
|
|
+ MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384,
|
|
+ MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256,
|
|
+ MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256,
|
|
+ MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA,
|
|
+ MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256,
|
|
+ MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256,
|
|
+ MBEDTLS_TLS_PSK_WITH_CHACHA20_POLY1305_SHA256,
|
|
+ MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384,
|
|
+ MBEDTLS_TLS_PSK_WITH_AES_256_CCM,
|
|
+ MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384,
|
|
+ MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA,
|
|
+ MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384,
|
|
+ MBEDTLS_TLS_PSK_WITH_AES_256_CCM_8,
|
|
+ MBEDTLS_TLS_PSK_WITH_ARIA_256_GCM_SHA384,
|
|
+ MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256,
|
|
+ MBEDTLS_TLS_PSK_WITH_AES_128_CCM,
|
|
+ MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256,
|
|
+ MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA,
|
|
+ MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256,
|
|
+ MBEDTLS_TLS_PSK_WITH_AES_128_CCM_8,
|
|
+ MBEDTLS_TLS_PSK_WITH_ARIA_128_GCM_SHA256
|
|
+};
|
|
+
|
|
+
|
|
+__attribute_noinline__
|
|
+static int
|
|
+tls_mbedtls_append_ciphersuite (int *ids, int nids, int idsz, const int *x, int xsz)
|
|
+{
|
|
+ if (xsz >= idsz - (nids + 1)) {
|
|
+ emsg(MSG_ERROR, "error: too many ciphers during list expand");
|
|
+ return -1;
|
|
+ }
|
|
+
|
|
+ for (int i = 0; i < xsz; ++i)
|
|
+ ids[++nids] = x[i];
|
|
+
|
|
+ return nids;
|
|
+}
|
|
+
|
|
+
|
|
+static int
|
|
+tls_mbedtls_translate_ciphername(int id, char *buf, size_t buflen)
|
|
+{
|
|
+ const mbedtls_ssl_ciphersuite_t *info =
|
|
+ mbedtls_ssl_ciphersuite_from_id(id);
|
|
+ if (info == NULL)
|
|
+ return 0;
|
|
+ const char *name = mbedtls_ssl_ciphersuite_get_name(info);
|
|
+ const size_t len = os_strlen(name);
|
|
+ if (len == 7 && 0 == os_memcmp(name, "unknown", 7))
|
|
+ return 0;
|
|
+ if (len >= buflen)
|
|
+ return 0;
|
|
+ os_strlcpy(buf, name, buflen);
|
|
+
|
|
+ /* attempt to translate mbedtls string to openssl string
|
|
+ * (some heuristics; incomplete) */
|
|
+ size_t i = 0, j = 0;
|
|
+ if (buf[0] == 'T') {
|
|
+ if (os_strncmp(buf, "TLS1-3-", 7) == 0) {
|
|
+ buf[3] = '-';
|
|
+ j = 4; /* remove "1-3" from "TLS1-3-" prefix */
|
|
+ i = 7;
|
|
+ }
|
|
+ else if (os_strncmp(buf, "TLS-", 4) == 0)
|
|
+ i = 4; /* remove "TLS-" prefix */
|
|
+ }
|
|
+ for (; buf[i]; ++i) {
|
|
+ if (buf[i] == '-') {
|
|
+ if (i >= 3) {
|
|
+ if (0 == os_memcmp(buf+i-3, "AES", 3))
|
|
+ continue; /* "AES-" -> "AES" */
|
|
+ }
|
|
+ if (i >= 4) {
|
|
+ if (0 == os_memcmp(buf+i-4, "WITH", 4)) {
|
|
+ j -= 4; /* remove "WITH-" */
|
|
+ continue;
|
|
+ }
|
|
+ }
|
|
+ }
|
|
+ buf[j++] = buf[i];
|
|
+ }
|
|
+ buf[j] = '\0';
|
|
+
|
|
+ return j;
|
|
+}
|
|
+
|
|
+
|
|
+__attribute_noinline__
|
|
+static int
|
|
+tls_mbedtls_set_ciphersuites(struct tls_conf *tls_conf, int *ids, int nids)
|
|
+{
|
|
+ /* ciphersuites list must be persistent for lifetime of mbedtls_ssl_config*/
|
|
+ os_free(tls_conf->ciphersuites);
|
|
+ tls_conf->ciphersuites = os_malloc(nids * sizeof(int));
|
|
+ if (tls_conf->ciphersuites == NULL)
|
|
+ return 0;
|
|
+ os_memcpy(tls_conf->ciphersuites, ids, nids * sizeof(int));
|
|
+ mbedtls_ssl_conf_ciphersuites(&tls_conf->conf, tls_conf->ciphersuites);
|
|
+ return 1;
|
|
+}
|
|
+
|
|
+
|
|
+static int
|
|
+tls_mbedtls_set_ciphers(struct tls_conf *tls_conf, const char *ciphers)
|
|
+{
|
|
+ char buf[64];
|
|
+ int ids[512];
|
|
+ int nids = -1;
|
|
+ const int idsz = (int)(sizeof(ids)/sizeof(*ids)-1);
|
|
+ const char *next;
|
|
+ size_t blen, clen;
|
|
+ do {
|
|
+ next = os_strchr(ciphers, ':');
|
|
+ clen = next ? (size_t)(next - ciphers) : os_strlen(ciphers);
|
|
+ if (!clen)
|
|
+ continue;
|
|
+
|
|
+ /* special-case a select set of openssl group names for hwsim tests */
|
|
+ /* (review; remove excess code if tests are not run for non-OpenSSL?) */
|
|
+ if (clen == 9 && os_memcmp(ciphers, "SUITEB192", 9) == 0) {
|
|
+ static int ssl_preset_suiteb192_ciphersuites[] = {
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
|
|
+ 0
|
|
+ };
|
|
+ return tls_mbedtls_set_ciphersuites(tls_conf,
|
|
+ ssl_preset_suiteb192_ciphersuites,
|
|
+ 2);
|
|
+ }
|
|
+ if (clen == 9 && os_memcmp(ciphers, "SUITEB128", 9) == 0) {
|
|
+ static int ssl_preset_suiteb128_ciphersuites[] = {
|
|
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
|
|
+ 0
|
|
+ };
|
|
+ return tls_mbedtls_set_ciphersuites(tls_conf,
|
|
+ ssl_preset_suiteb128_ciphersuites,
|
|
+ 2);
|
|
+ }
|
|
+ if (clen == 7 && os_memcmp(ciphers, "DEFAULT", 7) == 0)
|
|
+ continue;
|
|
+ if (clen == 6 && os_memcmp(ciphers, "AES128", 6) == 0) {
|
|
+ nids = tls_mbedtls_append_ciphersuite(ids, nids, idsz,
|
|
+ suite_AES_128_ephemeral,
|
|
+ (int)ARRAY_SIZE(suite_AES_128_ephemeral));
|
|
+ if (nids == -1)
|
|
+ return 0;
|
|
+ continue;
|
|
+ }
|
|
+ if (clen == 6 && os_memcmp(ciphers, "AES256", 6) == 0) {
|
|
+ nids = tls_mbedtls_append_ciphersuite(ids, nids, idsz,
|
|
+ suite_AES_256_ephemeral,
|
|
+ (int)ARRAY_SIZE(suite_AES_256_ephemeral));
|
|
+ if (nids == -1)
|
|
+ return 0;
|
|
+ continue;
|
|
+ }
|
|
+ if (clen == 4 && os_memcmp(ciphers, "HIGH", 4) == 0) {
|
|
+ nids = tls_mbedtls_append_ciphersuite(ids, nids, idsz, suite_HIGH,
|
|
+ (int)ARRAY_SIZE(suite_HIGH));
|
|
+ if (nids == -1)
|
|
+ return 0;
|
|
+ continue;
|
|
+ }
|
|
+ /* ignore anonymous cipher group names (?not supported by mbedtls?) */
|
|
+ if (clen == 4 && os_memcmp(ciphers, "!ADH", 4) == 0)
|
|
+ continue;
|
|
+ if (clen == 6 && os_memcmp(ciphers, "-aECDH", 6) == 0)
|
|
+ continue;
|
|
+ if (clen == 7 && os_memcmp(ciphers, "-aECDSA", 7) == 0)
|
|
+ continue;
|
|
+
|
|
+ /* attempt to match mbedtls cipher names
|
|
+ * nb: does not support openssl group names or list manipulation syntax
|
|
+ * (alt: could copy almost 1200 lines (!!!) of lighttpd mod_mbedtls.c
|
|
+ * mod_mbedtls_ssl_conf_ciphersuites() to translate strings)
|
|
+ * note: not efficient to rewrite list for each ciphers entry,
|
|
+ * but this code is expected to run only at startup
|
|
+ */
|
|
+ const int *list = mbedtls_ssl_list_ciphersuites();
|
|
+ for (; *list; ++list) {
|
|
+ blen = tls_mbedtls_translate_ciphername(*list,buf,sizeof(buf));
|
|
+ if (!blen)
|
|
+ continue;
|
|
+
|
|
+ /* matching heuristics additional to translate_ciphername above */
|
|
+ if (blen == clen+4) {
|
|
+ char *cbc = os_strstr(buf, "CBC-");
|
|
+ if (cbc) {
|
|
+ os_memmove(cbc, cbc+4, blen-(cbc+4-buf)+1); /*(w/ '\0')*/
|
|
+ blen -= 4;
|
|
+ }
|
|
+ }
|
|
+ if (blen >= clen && os_memcmp(ciphers, buf, clen) == 0
|
|
+ && (blen == clen
|
|
+ || (blen == clen+7 && os_memcmp(buf+clen, "-SHA256", 7)))) {
|
|
+ if (1 >= idsz - (nids + 1)) {
|
|
+ emsg(MSG_ERROR,
|
|
+ "error: too many ciphers during list expand");
|
|
+ return 0;
|
|
+ }
|
|
+ ids[++nids] = *list;
|
|
+ break;
|
|
+ }
|
|
+ }
|
|
+ if (*list == 0) {
|
|
+ wpa_printf(MSG_ERROR,
|
|
+ "MTLS: unrecognized cipher: %.*s", (int)clen, ciphers);
|
|
+ return 0;
|
|
+ }
|
|
+ } while ((ciphers = next ? next+1 : NULL));
|
|
+
|
|
+ if (-1 == nids) return 1; /* empty list; no-op */
|
|
+
|
|
+ ids[++nids] = 0; /* terminate list */
|
|
+ ++nids;
|
|
+
|
|
+ return tls_mbedtls_set_ciphersuites(tls_conf, ids, nids);
|
|
+}
|
|
+
|
|
+
|
|
+__attribute_noinline__
|
|
+static int tls_mbedtls_set_item(char **config_item, const char *item)
|
|
+{
|
|
+ os_free(*config_item);
|
|
+ *config_item = NULL;
|
|
+ return item ? (*config_item = os_strdup(item)) != NULL : 1;
|
|
+}
|
|
+
|
|
+
|
|
+static int tls_connection_set_subject_match(struct tls_conf *tls_conf,
|
|
+ const struct tls_connection_params *params)
|
|
+{
|
|
+ int rc = 1;
|
|
+ rc &= tls_mbedtls_set_item(&tls_conf->subject_match,
|
|
+ params->subject_match);
|
|
+ rc &= tls_mbedtls_set_item(&tls_conf->altsubject_match,
|
|
+ params->altsubject_match);
|
|
+ rc &= tls_mbedtls_set_item(&tls_conf->suffix_match,
|
|
+ params->suffix_match);
|
|
+ rc &= tls_mbedtls_set_item(&tls_conf->domain_match,
|
|
+ params->domain_match);
|
|
+ rc &= tls_mbedtls_set_item(&tls_conf->check_cert_subject,
|
|
+ params->check_cert_subject);
|
|
+ return rc;
|
|
+}
|
|
+
|
|
+
|
|
+/* duplicated in crypto_mbedtls.c:crypto_mbedtls_readfile()*/
|
|
+__attribute_noinline__
|
|
+static int tls_mbedtls_readfile(const char *path, u8 **buf, size_t *n)
|
|
+{
|
|
+ #if 0 /* #ifdef MBEDTLS_FS_IO */
|
|
+ /*(includes +1 for '\0' needed by mbedtls PEM parsing funcs)*/
|
|
+ if (mbedtls_pk_load_file(path, (unsigned char **)buf, n) != 0) {
|
|
+ wpa_printf(MSG_ERROR, "error: mbedtls_pk_load_file %s", path);
|
|
+ return -1;
|
|
+ }
|
|
+ #else
|
|
+ /*(use os_readfile() so that we can use os_free()
|
|
+ *(if we use mbedtls_pk_load_file() above, macros prevent calling free()
|
|
+ * directly #if defined(OS_REJECT_C_LIB_FUNCTIONS) and calling os_free()
|
|
+ * on buf aborts in tests if buf not allocated via os_malloc())*/
|
|
+ *buf = (u8 *)os_readfile(path, n);
|
|
+ if (!*buf) {
|
|
+ wpa_printf(MSG_ERROR, "error: os_readfile %s", path);
|
|
+ return -1;
|
|
+ }
|
|
+ u8 *buf0 = os_realloc(*buf, *n+1);
|
|
+ if (!buf0) {
|
|
+ bin_clear_free(*buf, *n);
|
|
+ *buf = NULL;
|
|
+ return -1;
|
|
+ }
|
|
+ buf0[(*n)++] = '\0';
|
|
+ *buf = buf0;
|
|
+ #endif
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+
|
|
+static int tls_mbedtls_set_crl(struct tls_conf *tls_conf, const u8 *data, size_t len)
|
|
+{
|
|
+ /* do not use mbedtls_x509_crl_parse() on PEM unless it contains CRL */
|
|
+ if (len && data[len-1] == '\0'
|
|
+ && NULL == os_strstr((const char *)data,"-----BEGIN X509 CRL-----")
|
|
+ && tls_mbedtls_data_is_pem(data))
|
|
+ return 0;
|
|
+
|
|
+ mbedtls_x509_crl crl;
|
|
+ mbedtls_x509_crl_init(&crl);
|
|
+ int rc = mbedtls_x509_crl_parse(&crl, data, len);
|
|
+ if (rc < 0) {
|
|
+ mbedtls_x509_crl_free(&crl);
|
|
+ return rc == MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT ? 0 : rc;
|
|
+ }
|
|
+
|
|
+ mbedtls_x509_crl *crl_new = os_malloc(sizeof(crl));
|
|
+ if (crl_new == NULL) {
|
|
+ mbedtls_x509_crl_free(&crl);
|
|
+ return MBEDTLS_ERR_X509_ALLOC_FAILED;
|
|
+ }
|
|
+ os_memcpy(crl_new, &crl, sizeof(crl));
|
|
+
|
|
+ mbedtls_x509_crl *crl_old = tls_conf->crl;
|
|
+ tls_conf->crl = crl_new;
|
|
+ if (crl_old) {
|
|
+ mbedtls_x509_crl_free(crl_old);
|
|
+ os_free(crl_old);
|
|
+ }
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+
|
|
+static int tls_mbedtls_set_ca(struct tls_conf *tls_conf, u8 *data, size_t len)
|
|
+{
|
|
+ /* load crt struct onto stack and then copy into tls_conf in
|
|
+ * order to preserve existing tls_conf value if error occurs
|
|
+ *
|
|
+ * hostapd is not threaded, or else should allocate memory and swap in
|
|
+ * pointer reduce race condition. (If threaded, would also need to
|
|
+ * keep reference count of use to avoid freeing while still in use.) */
|
|
+
|
|
+ mbedtls_x509_crt crt;
|
|
+ mbedtls_x509_crt_init(&crt);
|
|
+ int rc = mbedtls_x509_crt_parse(&crt, data, len);
|
|
+ if (rc < 0) {
|
|
+ mbedtls_x509_crt_free(&crt);
|
|
+ return rc;
|
|
+ }
|
|
+
|
|
+ mbedtls_x509_crt_free(&tls_conf->ca_cert);
|
|
+ os_memcpy(&tls_conf->ca_cert, &crt, sizeof(crt));
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+
|
|
+static int tls_mbedtls_set_ca_and_crl(struct tls_conf *tls_conf, const char *ca_cert_file)
|
|
+{
|
|
+ size_t len;
|
|
+ u8 *data;
|
|
+ if (tls_mbedtls_readfile(ca_cert_file, &data, &len))
|
|
+ return -1;
|
|
+
|
|
+ int rc;
|
|
+ if (0 == (rc = tls_mbedtls_set_ca(tls_conf, data, len))
|
|
+ && (!tls_mbedtls_data_is_pem(data) /*skip parse for CRL if not PEM*/
|
|
+ || 0 == (rc = tls_mbedtls_set_crl(tls_conf, data, len)))) {
|
|
+ mbedtls_ssl_conf_ca_chain(&tls_conf->conf,
|
|
+ &tls_conf->ca_cert,
|
|
+ tls_conf->crl);
|
|
+ }
|
|
+ else {
|
|
+ elog(rc, __func__);
|
|
+ emsg(MSG_ERROR, ca_cert_file);
|
|
+ }
|
|
+
|
|
+ forced_memzero(data, len);
|
|
+ os_free(data);
|
|
+ return rc;
|
|
+}
|
|
+
|
|
+
|
|
+static void tls_mbedtls_refresh_crl(void)
|
|
+{
|
|
+ /* check for CRL refresh
|
|
+ * continue even if error occurs; continue with previous cert, CRL */
|
|
+ unsigned int crl_reload_interval = tls_ctx_global.crl_reload_interval;
|
|
+ const char *ca_cert_file = tls_ctx_global.ca_cert_file;
|
|
+ if (!crl_reload_interval || !ca_cert_file)
|
|
+ return;
|
|
+
|
|
+ struct os_reltime *previous = &tls_ctx_global.crl_reload_previous;
|
|
+ struct os_reltime now;
|
|
+ if (os_get_reltime(&now) != 0
|
|
+ || !os_reltime_expired(&now, previous, crl_reload_interval))
|
|
+ return;
|
|
+
|
|
+ /* Note: modifying global state is not thread-safe
|
|
+ * if in use by existing connections
|
|
+ *
|
|
+ * src/utils/os.h does not provide a portable stat()
|
|
+ * or else it would be a good idea to check mtime and size,
|
|
+ * and avoid reloading if file has not changed */
|
|
+
|
|
+ if (tls_mbedtls_set_ca_and_crl(tls_ctx_global.tls_conf, ca_cert_file) == 0)
|
|
+ *previous = now;
|
|
+}
|
|
+
|
|
+
|
|
+static int tls_mbedtls_set_ca_cert(struct tls_conf *tls_conf,
|
|
+ const struct tls_connection_params *params)
|
|
+{
|
|
+ if (params->ca_cert) {
|
|
+ if (os_strncmp(params->ca_cert, "probe://", 8) == 0) {
|
|
+ tls_conf->ca_cert_probe = 1;
|
|
+ tls_conf->has_ca_cert = 1;
|
|
+ return 0;
|
|
+ }
|
|
+
|
|
+ if (os_strncmp(params->ca_cert, "hash://", 7) == 0) {
|
|
+ const char *pos = params->ca_cert + 7;
|
|
+ if (os_strncmp(pos, "server/sha256/", 14) != 0) {
|
|
+ emsg(MSG_ERROR, "unsupported ca_cert hash value");
|
|
+ return -1;
|
|
+ }
|
|
+ pos += 14;
|
|
+ if (os_strlen(pos) != SHA256_DIGEST_LENGTH*2) {
|
|
+ emsg(MSG_ERROR, "unexpected ca_cert hash length");
|
|
+ return -1;
|
|
+ }
|
|
+ if (hexstr2bin(pos, tls_conf->ca_cert_hash,
|
|
+ SHA256_DIGEST_LENGTH) < 0) {
|
|
+ emsg(MSG_ERROR, "invalid ca_cert hash value");
|
|
+ return -1;
|
|
+ }
|
|
+ emsg(MSG_DEBUG, "checking only server certificate match");
|
|
+ tls_conf->verify_depth0_only = 1;
|
|
+ tls_conf->has_ca_cert = 1;
|
|
+ return 0;
|
|
+ }
|
|
+
|
|
+ if (tls_mbedtls_set_ca_and_crl(tls_conf, params->ca_cert) != 0)
|
|
+ return -1;
|
|
+ }
|
|
+ if (params->ca_cert_blob) {
|
|
+ size_t len = params->ca_cert_blob_len;
|
|
+ int is_pem = tls_mbedtls_data_is_pem(params->ca_cert_blob);
|
|
+ if (len && params->ca_cert_blob[len-1] != '\0' && is_pem)
|
|
+ ++len; /*(include '\0' in len for PEM)*/
|
|
+ int ret = mbedtls_x509_crt_parse(&tls_conf->ca_cert,
|
|
+ params->ca_cert_blob, len);
|
|
+ if (ret != 0) {
|
|
+ elog(ret, "mbedtls_x509_crt_parse");
|
|
+ return -1;
|
|
+ }
|
|
+ if (is_pem) { /*(ca_cert_blob in DER format contains ca cert only)*/
|
|
+ ret = tls_mbedtls_set_crl(tls_conf, params->ca_cert_blob, len);
|
|
+ if (ret != 0) {
|
|
+ elog(ret, "mbedtls_x509_crl_parse");
|
|
+ return -1;
|
|
+ }
|
|
+ }
|
|
+ }
|
|
+
|
|
+ if (mbedtls_x509_time_is_future(&tls_conf->ca_cert.valid_from)
|
|
+ || mbedtls_x509_time_is_past(&tls_conf->ca_cert.valid_to)) {
|
|
+ emsg(MSG_WARNING, "ca_cert expired or not yet valid");
|
|
+ if (params->ca_cert)
|
|
+ emsg(MSG_WARNING, params->ca_cert);
|
|
+ }
|
|
+
|
|
+ tls_conf->has_ca_cert = 1;
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+
|
|
+static int tls_mbedtls_set_certs(struct tls_conf *tls_conf,
|
|
+ const struct tls_connection_params *params)
|
|
+{
|
|
+ int ret;
|
|
+
|
|
+ if (params->ca_cert || params->ca_cert_blob) {
|
|
+ if (tls_mbedtls_set_ca_cert(tls_conf, params) != 0)
|
|
+ return -1;
|
|
+ }
|
|
+ else if (params->ca_path) {
|
|
+ emsg(MSG_INFO, "ca_path support not implemented");
|
|
+ return -1;
|
|
+ }
|
|
+
|
|
+ if (!tls_conf->has_ca_cert)
|
|
+ mbedtls_ssl_conf_authmode(&tls_conf->conf, MBEDTLS_SSL_VERIFY_NONE);
|
|
+ else {
|
|
+ /* Initial setting: REQUIRED for client, OPTIONAL for server
|
|
+ * (see also tls_connection_set_verify()) */
|
|
+ tls_conf->verify_peer = (tls_ctx_global.tls_conf == NULL);
|
|
+ int authmode = tls_conf->verify_peer
|
|
+ ? MBEDTLS_SSL_VERIFY_REQUIRED
|
|
+ : MBEDTLS_SSL_VERIFY_OPTIONAL;
|
|
+ mbedtls_ssl_conf_authmode(&tls_conf->conf, authmode);
|
|
+ mbedtls_ssl_conf_ca_chain(&tls_conf->conf,
|
|
+ &tls_conf->ca_cert,
|
|
+ tls_conf->crl);
|
|
+
|
|
+ if (!tls_connection_set_subject_match(tls_conf, params))
|
|
+ return -1;
|
|
+ }
|
|
+
|
|
+ if (params->client_cert2) /*(yes, server_cert2 in msg below)*/
|
|
+ emsg(MSG_INFO, "server_cert2 support not implemented");
|
|
+
|
|
+ if (params->client_cert) {
|
|
+ size_t len;
|
|
+ u8 *data;
|
|
+ if (tls_mbedtls_readfile(params->client_cert, &data, &len))
|
|
+ return -1;
|
|
+ ret = mbedtls_x509_crt_parse(&tls_conf->client_cert, data, len);
|
|
+ forced_memzero(data, len);
|
|
+ os_free(data);
|
|
+ }
|
|
+ if (params->client_cert_blob) {
|
|
+ size_t len = params->client_cert_blob_len;
|
|
+ if (len && params->client_cert_blob[len-1] != '\0'
|
|
+ && tls_mbedtls_data_is_pem(params->client_cert_blob))
|
|
+ ++len; /*(include '\0' in len for PEM)*/
|
|
+ ret = mbedtls_x509_crt_parse(&tls_conf->client_cert,
|
|
+ params->client_cert_blob, len);
|
|
+ }
|
|
+ if (params->client_cert || params->client_cert_blob) {
|
|
+ if (ret < 0) {
|
|
+ elog(ret, "mbedtls_x509_crt_parse");
|
|
+ if (params->client_cert)
|
|
+ emsg(MSG_ERROR, params->client_cert);
|
|
+ return -1;
|
|
+ }
|
|
+ if (mbedtls_x509_time_is_future(&tls_conf->client_cert.valid_from)
|
|
+ || mbedtls_x509_time_is_past(&tls_conf->client_cert.valid_to)) {
|
|
+ emsg(MSG_WARNING, "cert expired or not yet valid");
|
|
+ if (params->client_cert)
|
|
+ emsg(MSG_WARNING, params->client_cert);
|
|
+ }
|
|
+ tls_conf->has_client_cert = 1;
|
|
+ }
|
|
+
|
|
+ if (params->private_key || params->private_key_blob) {
|
|
+ size_t len = params->private_key_blob_len;
|
|
+ u8 *data;
|
|
+ *(const u8 **)&data = params->private_key_blob;
|
|
+ if (len && data[len-1] != '\0' && tls_mbedtls_data_is_pem(data))
|
|
+ ++len; /*(include '\0' in len for PEM)*/
|
|
+ if (params->private_key
|
|
+ && tls_mbedtls_readfile(params->private_key, &data, &len)) {
|
|
+ return -1;
|
|
+ }
|
|
+ const char *pwd = params->private_key_passwd;
|
|
+ #if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
|
|
+ ret = mbedtls_pk_parse_key(&tls_conf->private_key,
|
|
+ data, len,
|
|
+ (const unsigned char *)pwd,
|
|
+ pwd ? os_strlen(pwd) : 0,
|
|
+ mbedtls_ctr_drbg_random,
|
|
+ tls_ctx_global.ctr_drbg);
|
|
+ #else
|
|
+ ret = mbedtls_pk_parse_key(&tls_conf->private_key,
|
|
+ data, len,
|
|
+ (const unsigned char *)pwd,
|
|
+ pwd ? os_strlen(pwd) : 0);
|
|
+ #endif
|
|
+ if (params->private_key) {
|
|
+ forced_memzero(data, len);
|
|
+ os_free(data);
|
|
+ }
|
|
+ if (ret < 0) {
|
|
+ elog(ret, "mbedtls_pk_parse_key");
|
|
+ return -1;
|
|
+ }
|
|
+ tls_conf->has_private_key = 1;
|
|
+ }
|
|
+
|
|
+ if (tls_conf->has_client_cert && tls_conf->has_private_key) {
|
|
+ ret = mbedtls_ssl_conf_own_cert(
|
|
+ &tls_conf->conf, &tls_conf->client_cert, &tls_conf->private_key);
|
|
+ if (ret < 0) {
|
|
+ elog(ret, "mbedtls_ssl_conf_own_cert");
|
|
+ return -1;
|
|
+ }
|
|
+ }
|
|
+
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+
|
|
+/* mbedtls_x509_crt_profile_suiteb plus rsa_min_bitlen 2048 */
|
|
+/* (reference: see also mbedtls_x509_crt_profile_next) */
|
|
+/* ??? should permit SHA-512, too, and additional curves ??? */
|
|
+static const mbedtls_x509_crt_profile tls_mbedtls_crt_profile_suiteb128 =
|
|
+{
|
|
+ /* Only SHA-256 and 384 */
|
|
+ MBEDTLS_X509_ID_FLAG( MBEDTLS_MD_SHA256 ) |
|
|
+ MBEDTLS_X509_ID_FLAG( MBEDTLS_MD_SHA384 ),
|
|
+ /* Only ECDSA */
|
|
+ MBEDTLS_X509_ID_FLAG( MBEDTLS_PK_ECDSA ) |
|
|
+ MBEDTLS_X509_ID_FLAG( MBEDTLS_PK_ECKEY ),
|
|
+#if defined(MBEDTLS_ECP_C)
|
|
+ /* Only NIST P-256 and P-384 */
|
|
+ MBEDTLS_X509_ID_FLAG( MBEDTLS_ECP_DP_SECP256R1 ) |
|
|
+ MBEDTLS_X509_ID_FLAG( MBEDTLS_ECP_DP_SECP384R1 ),
|
|
+#else
|
|
+ 0,
|
|
+#endif
|
|
+ 2048,
|
|
+};
|
|
+
|
|
+
|
|
+/* stricter than mbedtls_x509_crt_profile_suiteb */
|
|
+/* (reference: see also mbedtls_x509_crt_profile_next) */
|
|
+/* ??? should permit SHA-512, too, and additional curves ??? */
|
|
+static const mbedtls_x509_crt_profile tls_mbedtls_crt_profile_suiteb192 =
|
|
+{
|
|
+ /* Only SHA-384 */
|
|
+ MBEDTLS_X509_ID_FLAG( MBEDTLS_MD_SHA384 ),
|
|
+ /* Only ECDSA */
|
|
+ MBEDTLS_X509_ID_FLAG( MBEDTLS_PK_ECDSA ) |
|
|
+ MBEDTLS_X509_ID_FLAG( MBEDTLS_PK_ECKEY ),
|
|
+#if defined(MBEDTLS_ECP_C)
|
|
+ /* Only NIST P-384 */
|
|
+ MBEDTLS_X509_ID_FLAG( MBEDTLS_ECP_DP_SECP384R1 ),
|
|
+#else
|
|
+ 0,
|
|
+#endif
|
|
+ 3072,
|
|
+};
|
|
+
|
|
+
|
|
+/* stricter than mbedtls_x509_crt_profile_suiteb except allow any PK alg */
|
|
+/* (reference: see also mbedtls_x509_crt_profile_next) */
|
|
+/* ??? should permit SHA-512, too, and additional curves ??? */
|
|
+static const mbedtls_x509_crt_profile tls_mbedtls_crt_profile_suiteb192_anypk =
|
|
+{
|
|
+ /* Only SHA-384 */
|
|
+ MBEDTLS_X509_ID_FLAG( MBEDTLS_MD_SHA384 ),
|
|
+ 0xFFFFFFF, /* Any PK alg */
|
|
+#if defined(MBEDTLS_ECP_C)
|
|
+ /* Only NIST P-384 */
|
|
+ MBEDTLS_X509_ID_FLAG( MBEDTLS_ECP_DP_SECP384R1 ),
|
|
+#else
|
|
+ 0,
|
|
+#endif
|
|
+ 3072,
|
|
+};
|
|
+
|
|
+
|
|
+static int tls_mbedtls_set_params(struct tls_conf *tls_conf,
|
|
+ const struct tls_connection_params *params)
|
|
+{
|
|
+ tls_conf->flags = params->flags;
|
|
+
|
|
+ if (tls_conf->flags & TLS_CONN_REQUIRE_OCSP_ALL) {
|
|
+ emsg(MSG_INFO, "ocsp=3 not supported");
|
|
+ return -1;
|
|
+ }
|
|
+
|
|
+ if (tls_conf->flags & TLS_CONN_REQUIRE_OCSP) {
|
|
+ emsg(MSG_INFO, "ocsp not supported");
|
|
+ return -1;
|
|
+ }
|
|
+
|
|
+ int suiteb128 = 0;
|
|
+ int suiteb192 = 0;
|
|
+ if (params->openssl_ciphers) {
|
|
+ if (os_strcmp(params->openssl_ciphers, "SUITEB192") == 0) {
|
|
+ suiteb192 = 1;
|
|
+ tls_conf->flags |= TLS_CONN_SUITEB;
|
|
+ }
|
|
+ if (os_strcmp(params->openssl_ciphers, "SUITEB128") == 0) {
|
|
+ suiteb128 = 1;
|
|
+ tls_conf->flags |= TLS_CONN_SUITEB;
|
|
+ }
|
|
+ }
|
|
+
|
|
+ int ret = mbedtls_ssl_config_defaults(
|
|
+ &tls_conf->conf, tls_ctx_global.tls_conf ? MBEDTLS_SSL_IS_SERVER
|
|
+ : MBEDTLS_SSL_IS_CLIENT,
|
|
+ MBEDTLS_SSL_TRANSPORT_STREAM,
|
|
+ (tls_conf->flags & TLS_CONN_SUITEB) ? MBEDTLS_SSL_PRESET_SUITEB
|
|
+ : MBEDTLS_SSL_PRESET_DEFAULT);
|
|
+ if (ret != 0) {
|
|
+ elog(ret, "mbedtls_ssl_config_defaults");
|
|
+ return -1;
|
|
+ }
|
|
+
|
|
+ if (suiteb128) {
|
|
+ mbedtls_ssl_conf_cert_profile(&tls_conf->conf,
|
|
+ &tls_mbedtls_crt_profile_suiteb128);
|
|
+ mbedtls_ssl_conf_dhm_min_bitlen(&tls_conf->conf, 2048);
|
|
+ }
|
|
+ else if (suiteb192) {
|
|
+ mbedtls_ssl_conf_cert_profile(&tls_conf->conf,
|
|
+ &tls_mbedtls_crt_profile_suiteb192);
|
|
+ mbedtls_ssl_conf_dhm_min_bitlen(&tls_conf->conf, 3072);
|
|
+ }
|
|
+ else if (tls_conf->flags & TLS_CONN_SUITEB) {
|
|
+ /* treat as suiteb192 while allowing any PK algorithm */
|
|
+ mbedtls_ssl_conf_cert_profile(&tls_conf->conf,
|
|
+ &tls_mbedtls_crt_profile_suiteb192_anypk);
|
|
+ mbedtls_ssl_conf_dhm_min_bitlen(&tls_conf->conf, 3072);
|
|
+ }
|
|
+
|
|
+ tls_mbedtls_set_allowed_tls_vers(tls_conf, &tls_conf->conf);
|
|
+ ret = tls_mbedtls_set_certs(tls_conf, params);
|
|
+ if (ret != 0)
|
|
+ return -1;
|
|
+
|
|
+ if (params->dh_file
|
|
+ && !tls_mbedtls_set_dhparams(tls_conf, params->dh_file)) {
|
|
+ return -1;
|
|
+ }
|
|
+
|
|
+ if (params->openssl_ecdh_curves
|
|
+ && !tls_mbedtls_set_curves(tls_conf, params->openssl_ecdh_curves)) {
|
|
+ return -1;
|
|
+ }
|
|
+
|
|
+ if (params->openssl_ciphers) {
|
|
+ if (!tls_mbedtls_set_ciphers(tls_conf, params->openssl_ciphers))
|
|
+ return -1;
|
|
+ }
|
|
+ else if (tls_conf->flags & TLS_CONN_SUITEB) {
|
|
+ /* special-case a select set of ciphers for hwsim tests */
|
|
+ if (!tls_mbedtls_set_ciphers(tls_conf,
|
|
+ (tls_conf->flags & TLS_CONN_SUITEB_NO_ECDH)
|
|
+ ? "DHE-RSA-AES256-GCM-SHA384"
|
|
+ : "ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384"))
|
|
+ return -1;
|
|
+ }
|
|
+
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+
|
|
+int tls_connection_set_params(void *tls_ctx, struct tls_connection *conn,
|
|
+ const struct tls_connection_params *params)
|
|
+{
|
|
+ if (conn == NULL || params == NULL)
|
|
+ return -1;
|
|
+
|
|
+ tls_conf_deinit(conn->tls_conf);
|
|
+ struct tls_conf *tls_conf = conn->tls_conf = tls_conf_init(tls_ctx);
|
|
+ if (tls_conf == NULL)
|
|
+ return -1;
|
|
+
|
|
+ if (tls_ctx_global.tls_conf) {
|
|
+ tls_conf->check_crl = tls_ctx_global.tls_conf->check_crl;
|
|
+ tls_conf->check_crl_strict = tls_ctx_global.tls_conf->check_crl_strict;
|
|
+ /*(tls_openssl.c inherits check_cert_subject from global conf)*/
|
|
+ if (tls_ctx_global.tls_conf->check_cert_subject) {
|
|
+ tls_conf->check_cert_subject =
|
|
+ os_strdup(tls_ctx_global.tls_conf->check_cert_subject);
|
|
+ if (tls_conf->check_cert_subject == NULL)
|
|
+ return -1;
|
|
+ }
|
|
+ }
|
|
+
|
|
+ if (tls_mbedtls_set_params(tls_conf, params) != 0)
|
|
+ return -1;
|
|
+ conn->verify_peer = tls_conf->verify_peer;
|
|
+
|
|
+ return tls_mbedtls_ssl_setup(conn);
|
|
+}
|
|
+
|
|
+
|
|
+#ifdef TLS_MBEDTLS_SESSION_TICKETS
|
|
+
|
|
+static int tls_mbedtls_clienthello_session_ticket_prep (struct tls_connection *conn,
|
|
+ const u8 *data, size_t len)
|
|
+{
|
|
+ if (conn->tls_conf->flags & TLS_CONN_DISABLE_SESSION_TICKET)
|
|
+ return -1;
|
|
+ if (conn->clienthello_session_ticket)
|
|
+ tls_connection_deinit_clienthello_session_ticket(conn);
|
|
+ if (len) {
|
|
+ conn->clienthello_session_ticket = mbedtls_calloc(1, len);
|
|
+ if (conn->clienthello_session_ticket == NULL)
|
|
+ return -1;
|
|
+ conn->clienthello_session_ticket_len = len;
|
|
+ os_memcpy(conn->clienthello_session_ticket, data, len);
|
|
+ }
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+
|
|
+static void tls_mbedtls_clienthello_session_ticket_set (struct tls_connection *conn)
|
|
+{
|
|
+ mbedtls_ssl_session *sess = conn->ssl.MBEDTLS_PRIVATE(session_negotiate);
|
|
+ if (sess->MBEDTLS_PRIVATE(ticket)) {
|
|
+ mbedtls_platform_zeroize(sess->MBEDTLS_PRIVATE(ticket),
|
|
+ sess->MBEDTLS_PRIVATE(ticket_len));
|
|
+ mbedtls_free(sess->MBEDTLS_PRIVATE(ticket));
|
|
+ }
|
|
+ sess->MBEDTLS_PRIVATE(ticket) = conn->clienthello_session_ticket;
|
|
+ sess->MBEDTLS_PRIVATE(ticket_len) = conn->clienthello_session_ticket_len;
|
|
+ sess->MBEDTLS_PRIVATE(ticket_lifetime) = 86400;/* XXX: can hint be 0? */
|
|
+
|
|
+ conn->clienthello_session_ticket = NULL;
|
|
+ conn->clienthello_session_ticket_len = 0;
|
|
+}
|
|
+
|
|
+
|
|
+static int tls_mbedtls_ssl_ticket_write(void *p_ticket,
|
|
+ const mbedtls_ssl_session *session,
|
|
+ unsigned char *start,
|
|
+ const unsigned char *end,
|
|
+ size_t *tlen,
|
|
+ uint32_t *lifetime)
|
|
+{
|
|
+ struct tls_connection *conn = p_ticket;
|
|
+ if (conn && conn->session_ticket_cb) {
|
|
+ /* see tls_mbedtls_clienthello_session_ticket_prep() */
|
|
+ /* see tls_mbedtls_clienthello_session_ticket_set() */
|
|
+ return 0;
|
|
+ }
|
|
+
|
|
+ return mbedtls_ssl_ticket_write(&tls_ctx_global.ticket_ctx,
|
|
+ session, start, end, tlen, lifetime);
|
|
+}
|
|
+
|
|
+
|
|
+static int tls_mbedtls_ssl_ticket_parse(void *p_ticket,
|
|
+ mbedtls_ssl_session *session,
|
|
+ unsigned char *buf,
|
|
+ size_t len)
|
|
+{
|
|
+ /* XXX: TODO: not implemented in client;
|
|
+ * mbedtls_ssl_conf_session_tickets_cb() callbacks only for TLS server*/
|
|
+
|
|
+ if (len == 0)
|
|
+ return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
|
|
+
|
|
+ struct tls_connection *conn = p_ticket;
|
|
+ if (conn && conn->session_ticket_cb) {
|
|
+ /* XXX: have random and secret been initialized yet?
|
|
+ * or must keys first be exported?
|
|
+ * EAP-FAST uses all args, EAP-TEAP only uses secret */
|
|
+ struct tls_random data;
|
|
+ if (tls_connection_get_random(NULL, conn, &data) != 0)
|
|
+ return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
|
|
+ int ret =
|
|
+ conn->session_ticket_cb(conn->session_ticket_cb_ctx,
|
|
+ buf, len,
|
|
+ data.client_random,
|
|
+ data.server_random,
|
|
+ conn->expkey_secret);
|
|
+ if (ret == 1) {
|
|
+ conn->resumed = 1;
|
|
+ return 0;
|
|
+ }
|
|
+ emsg(MSG_ERROR, "EAP session ticket ext not implemented");
|
|
+ return MBEDTLS_ERR_SSL_INVALID_MAC;
|
|
+ /*(non-zero return used for mbedtls debug logging)*/
|
|
+ }
|
|
+
|
|
+ /* XXX: TODO always use tls_mbedtls_ssl_ticket_parse() for callback? */
|
|
+ int rc = mbedtls_ssl_ticket_parse(&tls_ctx_global.ticket_ctx,
|
|
+ session, buf, len);
|
|
+ if (conn)
|
|
+ conn->resumed = (rc == 0);
|
|
+ return rc;
|
|
+}
|
|
+
|
|
+#endif /* TLS_MBEDTLS_SESSION_TICKETS */
|
|
+
|
|
+
|
|
+__attribute_cold__
|
|
+int tls_global_set_params(void *tls_ctx,
|
|
+ const struct tls_connection_params *params)
|
|
+{
|
|
+ /* XXX: why might global_set_params be called more than once? */
|
|
+ if (tls_ctx_global.tls_conf)
|
|
+ tls_conf_deinit(tls_ctx_global.tls_conf);
|
|
+ tls_ctx_global.tls_conf = tls_conf_init(tls_ctx);
|
|
+ if (tls_ctx_global.tls_conf == NULL)
|
|
+ return -1;
|
|
+
|
|
+ #ifdef MBEDTLS_SSL_SESSION_TICKETS
|
|
+ #ifdef MBEDTLS_SSL_TICKET_C
|
|
+ if (!(params->flags & TLS_CONN_DISABLE_SESSION_TICKET))
|
|
+ #ifdef TLS_MBEDTLS_SESSION_TICKETS
|
|
+ mbedtls_ssl_conf_session_tickets_cb(&tls_ctx_global.tls_conf->conf,
|
|
+ tls_mbedtls_ssl_ticket_write,
|
|
+ tls_mbedtls_ssl_ticket_parse,
|
|
+ NULL);
|
|
+ #else
|
|
+ mbedtls_ssl_conf_session_tickets_cb(&tls_ctx_global.tls_conf->conf,
|
|
+ mbedtls_ssl_ticket_write,
|
|
+ mbedtls_ssl_ticket_parse,
|
|
+ &tls_ctx_global.ticket_ctx);
|
|
+ #endif
|
|
+ #endif
|
|
+ #endif
|
|
+
|
|
+ os_free(tls_ctx_global.ocsp_stapling_response);
|
|
+ tls_ctx_global.ocsp_stapling_response = NULL;
|
|
+ if (params->ocsp_stapling_response)
|
|
+ tls_ctx_global.ocsp_stapling_response =
|
|
+ os_strdup(params->ocsp_stapling_response);
|
|
+
|
|
+ os_free(tls_ctx_global.ca_cert_file);
|
|
+ tls_ctx_global.ca_cert_file = NULL;
|
|
+ if (params->ca_cert)
|
|
+ tls_ctx_global.ca_cert_file = os_strdup(params->ca_cert);
|
|
+ return tls_mbedtls_set_params(tls_ctx_global.tls_conf, params);
|
|
+}
|
|
+
|
|
+
|
|
+int tls_global_set_verify(void *tls_ctx, int check_crl, int strict)
|
|
+{
|
|
+ tls_ctx_global.tls_conf->check_crl = check_crl;
|
|
+ tls_ctx_global.tls_conf->check_crl_strict = strict; /*(time checks)*/
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+
|
|
+int tls_connection_set_verify(void *tls_ctx, struct tls_connection *conn,
|
|
+ int verify_peer, unsigned int flags,
|
|
+ const u8 *session_ctx, size_t session_ctx_len)
|
|
+{
|
|
+ /*(EAP server-side calls this from eap_server_tls_ssl_init())*/
|
|
+ if (conn == NULL)
|
|
+ return -1;
|
|
+
|
|
+ conn->tls_conf->flags |= flags;/* TODO: reprocess flags, if necessary */
|
|
+
|
|
+ int authmode;
|
|
+ switch (verify_peer) {
|
|
+ case 2: authmode = MBEDTLS_SSL_VERIFY_OPTIONAL; break;/*(eap_teap_init())*/
|
|
+ case 1: authmode = MBEDTLS_SSL_VERIFY_REQUIRED; break;
|
|
+ default: authmode = MBEDTLS_SSL_VERIFY_NONE; break;
|
|
+ }
|
|
+ mbedtls_ssl_set_hs_authmode(&conn->ssl, authmode);
|
|
+
|
|
+ if ((conn->verify_peer = (authmode != MBEDTLS_SSL_VERIFY_NONE)))
|
|
+ mbedtls_ssl_set_verify(&conn->ssl, tls_mbedtls_verify_cb, conn);
|
|
+ else
|
|
+ mbedtls_ssl_set_verify(&conn->ssl, NULL, NULL);
|
|
+
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+
|
|
+#if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
|
|
+static void tls_connection_export_keys_cb(
|
|
+ void *p_expkey, mbedtls_ssl_key_export_type secret_type,
|
|
+ const unsigned char *secret, size_t secret_len,
|
|
+ const unsigned char client_random[MBEDTLS_EXPKEY_RAND_LEN],
|
|
+ const unsigned char server_random[MBEDTLS_EXPKEY_RAND_LEN],
|
|
+ mbedtls_tls_prf_types tls_prf_type)
|
|
+{
|
|
+ struct tls_connection *conn = p_expkey;
|
|
+ conn->tls_prf_type = tls_prf_type;
|
|
+ if (!tls_prf_type)
|
|
+ return;
|
|
+ if (secret_len > sizeof(conn->expkey_secret)) {
|
|
+ emsg(MSG_ERROR, "tls_connection_export_keys_cb secret too long");
|
|
+ conn->tls_prf_type = MBEDTLS_SSL_TLS_PRF_NONE; /* 0 */
|
|
+ return;
|
|
+ }
|
|
+ conn->expkey_secret_len = secret_len;
|
|
+ os_memcpy(conn->expkey_secret, secret, secret_len);
|
|
+ os_memcpy(conn->expkey_randbytes,
|
|
+ client_random, MBEDTLS_EXPKEY_RAND_LEN);
|
|
+ os_memcpy(conn->expkey_randbytes + MBEDTLS_EXPKEY_RAND_LEN,
|
|
+ server_random, MBEDTLS_EXPKEY_RAND_LEN);
|
|
+}
|
|
+#elif MBEDTLS_VERSION_NUMBER >= 0x02120000 /* mbedtls 2.18.0 */
|
|
+static int tls_connection_export_keys_cb(
|
|
+ void *p_expkey,
|
|
+ const unsigned char *ms,
|
|
+ const unsigned char *kb,
|
|
+ size_t maclen,
|
|
+ size_t keylen,
|
|
+ size_t ivlen,
|
|
+ const unsigned char client_random[MBEDTLS_EXPKEY_RAND_LEN],
|
|
+ const unsigned char server_random[MBEDTLS_EXPKEY_RAND_LEN],
|
|
+ mbedtls_tls_prf_types tls_prf_type )
|
|
+{
|
|
+ struct tls_connection *conn = p_expkey;
|
|
+ conn->tls_prf_type = tls_prf_type;
|
|
+ if (!tls_prf_type)
|
|
+ return -1; /*(return value ignored by mbedtls)*/
|
|
+ conn->expkey_keyblock_size = maclen + keylen + ivlen;
|
|
+ conn->expkey_secret_len = MBEDTLS_EXPKEY_FIXED_SECRET_LEN;
|
|
+ os_memcpy(conn->expkey_secret, ms, MBEDTLS_EXPKEY_FIXED_SECRET_LEN);
|
|
+ os_memcpy(conn->expkey_randbytes,
|
|
+ client_random, MBEDTLS_EXPKEY_RAND_LEN);
|
|
+ os_memcpy(conn->expkey_randbytes + MBEDTLS_EXPKEY_RAND_LEN,
|
|
+ server_random, MBEDTLS_EXPKEY_RAND_LEN);
|
|
+ return 0;
|
|
+}
|
|
+#endif
|
|
+
|
|
+
|
|
+int tls_connection_get_random(void *tls_ctx, struct tls_connection *conn,
|
|
+ struct tls_random *data)
|
|
+{
|
|
+ if (!conn || !conn->tls_prf_type)
|
|
+ return -1;
|
|
+ data->client_random = conn->expkey_randbytes;
|
|
+ data->client_random_len = MBEDTLS_EXPKEY_RAND_LEN;
|
|
+ data->server_random = conn->expkey_randbytes + MBEDTLS_EXPKEY_RAND_LEN;
|
|
+ data->server_random_len = MBEDTLS_EXPKEY_RAND_LEN;
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+
|
|
+int tls_connection_export_key(void *tls_ctx, struct tls_connection *conn,
|
|
+ const char *label, const u8 *context,
|
|
+ size_t context_len, u8 *out, size_t out_len)
|
|
+{
|
|
+ /* (EAP-PEAP EAP-TLS EAP-TTLS) */
|
|
+ #if MBEDTLS_VERSION_NUMBER >= 0x02120000 /* mbedtls 2.18.0 */
|
|
+ return (conn && conn->established && conn->tls_prf_type)
|
|
+ ? mbedtls_ssl_tls_prf(conn->tls_prf_type,
|
|
+ conn->expkey_secret, conn->expkey_secret_len, label,
|
|
+ conn->expkey_randbytes,
|
|
+ sizeof(conn->expkey_randbytes), out, out_len)
|
|
+ : -1;
|
|
+ #else
|
|
+ /* not implemented here for mbedtls < 2.18.0 */
|
|
+ return -1;
|
|
+ #endif
|
|
+}
|
|
+
|
|
+
|
|
+#ifdef TLS_MBEDTLS_EAP_FAST
|
|
+
|
|
+#if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
|
|
+/* keyblock size info is not exposed in mbed TLS 3.0.0 */
|
|
+/* extracted from mbedtls library/ssl_tls.c:ssl_tls12_populate_transform() */
|
|
+#include <mbedtls/ssl_ciphersuites.h>
|
|
+#include <mbedtls/cipher.h>
|
|
+static size_t tls_mbedtls_ssl_keyblock_size (mbedtls_ssl_context *ssl)
|
|
+{
|
|
+ #if !defined(MBEDTLS_USE_PSA_CRYPTO) /* XXX: (not extracted for PSA crypto) */
|
|
+ #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
|
|
+ if (mbedtls_ssl_get_version_number(ssl) == MBEDTLS_SSL_VERSION_TLS1_3)
|
|
+ return 0; /* (calculation not extracted) */
|
|
+ #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
|
|
+
|
|
+ int ciphersuite = mbedtls_ssl_get_ciphersuite_id_from_ssl(ssl);
|
|
+ const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
|
|
+ mbedtls_ssl_ciphersuite_from_id(ciphersuite);
|
|
+ if (ciphersuite_info == NULL)
|
|
+ return 0;
|
|
+
|
|
+ const mbedtls_cipher_info_t *cipher_info =
|
|
+ mbedtls_cipher_info_from_type(ciphersuite_info->MBEDTLS_PRIVATE(cipher));
|
|
+ if (cipher_info == NULL)
|
|
+ return 0;
|
|
+
|
|
+ #if MBEDTLS_VERSION_NUMBER >= 0x03010000 /* mbedtls 3.1.0 */
|
|
+ size_t keylen = mbedtls_cipher_info_get_key_bitlen(cipher_info) / 8;
|
|
+ mbedtls_cipher_mode_t mode = mbedtls_cipher_info_get_mode(cipher_info);
|
|
+ #else
|
|
+ size_t keylen = cipher_info->MBEDTLS_PRIVATE(key_bitlen) / 8;
|
|
+ mbedtls_cipher_mode_t mode = cipher_info->MBEDTLS_PRIVATE(mode);
|
|
+ #endif
|
|
+ #if defined(MBEDTLS_GCM_C) || \
|
|
+ defined(MBEDTLS_CCM_C) || \
|
|
+ defined(MBEDTLS_CHACHAPOLY_C)
|
|
+ if (mode == MBEDTLS_MODE_GCM || mode == MBEDTLS_MODE_CCM)
|
|
+ return keylen + 4;
|
|
+ else if (mode == MBEDTLS_MODE_CHACHAPOLY)
|
|
+ return keylen + 12;
|
|
+ else
|
|
+ #endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
|
|
+ #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
|
|
+ {
|
|
+ const mbedtls_md_info_t *md_info =
|
|
+ mbedtls_md_info_from_type(ciphersuite_info->MBEDTLS_PRIVATE(mac));
|
|
+ if (md_info == NULL)
|
|
+ return 0;
|
|
+ size_t mac_key_len = mbedtls_md_get_size(md_info);
|
|
+ size_t ivlen = mbedtls_cipher_info_get_iv_size(cipher_info);
|
|
+ return keylen + mac_key_len + ivlen;
|
|
+ }
|
|
+ #endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
|
|
+ #endif /* !MBEDTLS_USE_PSA_CRYPTO *//* (not extracted for PSA crypto) */
|
|
+ return 0;
|
|
+}
|
|
+#endif /* MBEDTLS_VERSION_NUMBER >= 0x03000000 *//* mbedtls 3.0.0 */
|
|
+
|
|
+
|
|
+int tls_connection_get_eap_fast_key(void *tls_ctx, struct tls_connection *conn,
|
|
+ u8 *out, size_t out_len)
|
|
+{
|
|
+ /* XXX: has export keys callback been run? */
|
|
+ if (!conn || !conn->tls_prf_type)
|
|
+ return -1;
|
|
+
|
|
+ #if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
|
|
+ conn->expkey_keyblock_size = tls_mbedtls_ssl_keyblock_size(&conn->ssl);
|
|
+ if (conn->expkey_keyblock_size == 0)
|
|
+ return -1;
|
|
+ #endif
|
|
+ size_t skip = conn->expkey_keyblock_size * 2;
|
|
+ unsigned char *tmp_out = os_malloc(skip + out_len);
|
|
+ if (!tmp_out)
|
|
+ return -1;
|
|
+
|
|
+ /* server_random and then client_random */
|
|
+ unsigned char seed[MBEDTLS_EXPKEY_RAND_LEN*2];
|
|
+ os_memcpy(seed, conn->expkey_randbytes + MBEDTLS_EXPKEY_RAND_LEN,
|
|
+ MBEDTLS_EXPKEY_RAND_LEN);
|
|
+ os_memcpy(seed + MBEDTLS_EXPKEY_RAND_LEN, conn->expkey_randbytes,
|
|
+ MBEDTLS_EXPKEY_RAND_LEN);
|
|
+
|
|
+ #if MBEDTLS_VERSION_NUMBER >= 0x02120000 /* mbedtls 2.18.0 */
|
|
+ int ret = mbedtls_ssl_tls_prf(conn->tls_prf_type,
|
|
+ conn->expkey_secret, conn->expkey_secret_len,
|
|
+ "key expansion", seed, sizeof(seed),
|
|
+ tmp_out, skip + out_len);
|
|
+ if (ret == 0)
|
|
+ os_memcpy(out, tmp_out + skip, out_len);
|
|
+ #else
|
|
+ int ret = -1; /*(not reached if not impl; return -1 at top of func)*/
|
|
+ #endif
|
|
+
|
|
+ bin_clear_free(tmp_out, skip + out_len);
|
|
+ forced_memzero(seed, sizeof(seed));
|
|
+ return ret;
|
|
+}
|
|
+
|
|
+#endif /* TLS_MBEDTLS_EAP_FAST */
|
|
+
|
|
+
|
|
+__attribute_cold__
|
|
+static void tls_mbedtls_suiteb_handshake_alert (struct tls_connection *conn)
|
|
+{
|
|
+ /* tests/hwsim/test_suite_b.py test_suite_b_192_rsa_insufficient_dh */
|
|
+ if (!(conn->tls_conf->flags & TLS_CONN_SUITEB))
|
|
+ return;
|
|
+ if (tls_ctx_global.tls_conf) /*(is server; want issue event on client)*/
|
|
+ return;
|
|
+ #if 0
|
|
+ /*(info not available on client;
|
|
+ * mbed TLS library enforces dhm min bitlen in ServerKeyExchange)*/
|
|
+ if (MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 ==
|
|
+ #if MBEDTLS_VERSION_NUMBER < 0x03020000 /* mbedtls 3.2.0 */
|
|
+ mbedtls_ssl_get_ciphersuite_id_from_ssl(&conn->ssl)
|
|
+ #else
|
|
+ mbedtls_ssl_get_ciphersuite_id(
|
|
+ mbedtls_ssl_get_ciphersuite(&conn->ssl))
|
|
+ #endif
|
|
+ && mbedtls_mpi_size(&conn->tls_conf->conf.MBEDTLS_PRIVATE(dhm_P))
|
|
+ < 384 /*(3072/8)*/)
|
|
+ #endif
|
|
+ {
|
|
+ struct tls_config *init_conf = &tls_ctx_global.init_conf;
|
|
+ if (init_conf->event_cb) {
|
|
+ union tls_event_data ev;
|
|
+ os_memset(&ev, 0, sizeof(ev));
|
|
+ ev.alert.is_local = 1;
|
|
+ ev.alert.type = "fatal";
|
|
+ /*"internal error" string for tests/hwsim/test_suiteb.py */
|
|
+ ev.alert.description = "internal error: handshake failure";
|
|
+ /*ev.alert.description = "insufficient security";*/
|
|
+ init_conf->event_cb(init_conf->cb_ctx, TLS_ALERT, &ev);
|
|
+ }
|
|
+ }
|
|
+}
|
|
+
|
|
+
|
|
+struct wpabuf * tls_connection_handshake(void *tls_ctx,
|
|
+ struct tls_connection *conn,
|
|
+ const struct wpabuf *in_data,
|
|
+ struct wpabuf **appl_data)
|
|
+{
|
|
+ if (appl_data)
|
|
+ *appl_data = NULL;
|
|
+
|
|
+ if (in_data && wpabuf_len(in_data)) {
|
|
+ /*(unsure why tls_gnutls.c discards buffer contents; skip here)*/
|
|
+ if (conn->pull_buf && 0) /* disable; appears unwise */
|
|
+ tls_pull_buf_discard(conn, __func__);
|
|
+ if (!tls_pull_buf_append(conn, in_data))
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ if (conn->tls_conf == NULL) {
|
|
+ struct tls_connection_params params;
|
|
+ os_memset(¶ms, 0, sizeof(params));
|
|
+ params.openssl_ciphers =
|
|
+ tls_ctx_global.init_conf.openssl_ciphers;
|
|
+ params.flags = tls_ctx_global.tls_conf->flags;
|
|
+ if (tls_connection_set_params(tls_ctx, conn, ¶ms) != 0)
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ if (conn->verify_peer) /*(call here might be redundant; nbd)*/
|
|
+ mbedtls_ssl_set_verify(&conn->ssl, tls_mbedtls_verify_cb, conn);
|
|
+
|
|
+ #ifdef TLS_MBEDTLS_SESSION_TICKETS
|
|
+ if (conn->clienthello_session_ticket)
|
|
+ /*(starting handshake for EAP-FAST and EAP-TEAP)*/
|
|
+ tls_mbedtls_clienthello_session_ticket_set(conn);
|
|
+
|
|
+ /* (not thread-safe due to need to set userdata 'conn' for callback) */
|
|
+ /* (unable to use mbedtls_ssl_set_user_data_p() with mbedtls 3.2.0+
|
|
+ * since ticket write and parse callbacks take (mbedtls_ssl_session *)
|
|
+ * param instead of (mbedtls_ssl_context *) param) */
|
|
+ if (conn->tls_conf->flags & TLS_CONN_DISABLE_SESSION_TICKET)
|
|
+ mbedtls_ssl_conf_session_tickets_cb(&conn->tls_conf->conf,
|
|
+ NULL, NULL, NULL);
|
|
+ else
|
|
+ mbedtls_ssl_conf_session_tickets_cb(&conn->tls_conf->conf,
|
|
+ tls_mbedtls_ssl_ticket_write,
|
|
+ tls_mbedtls_ssl_ticket_parse,
|
|
+ conn);
|
|
+ #endif
|
|
+
|
|
+ #if MBEDTLS_VERSION_NUMBER >= 0x03020000 /* mbedtls 3.2.0 */
|
|
+ int ret = mbedtls_ssl_handshake(&conn->ssl);
|
|
+ #else
|
|
+ int ret = 0;
|
|
+ while (conn->ssl.MBEDTLS_PRIVATE(state) != MBEDTLS_SSL_HANDSHAKE_OVER) {
|
|
+ ret = mbedtls_ssl_handshake_step(&conn->ssl);
|
|
+ if (ret != 0)
|
|
+ break;
|
|
+ }
|
|
+ #endif
|
|
+
|
|
+ #ifdef TLS_MBEDTLS_SESSION_TICKETS
|
|
+ mbedtls_ssl_conf_session_tickets_cb(&conn->tls_conf->conf,
|
|
+ tls_mbedtls_ssl_ticket_write,
|
|
+ tls_mbedtls_ssl_ticket_parse,
|
|
+ NULL);
|
|
+ #endif
|
|
+
|
|
+ switch (ret) {
|
|
+ case 0:
|
|
+ conn->established = 1;
|
|
+ if (conn->push_buf == NULL)
|
|
+ /* Need to return something to get final TLS ACK. */
|
|
+ conn->push_buf = wpabuf_alloc(0);
|
|
+
|
|
+ if (appl_data /*&& conn->pull_buf && wpabuf_len(conn->pull_buf)*/)
|
|
+ *appl_data = NULL; /* RFE: check for application data */
|
|
+ break;
|
|
+ case MBEDTLS_ERR_SSL_WANT_WRITE:
|
|
+ case MBEDTLS_ERR_SSL_WANT_READ:
|
|
+ case MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS:
|
|
+ case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS:
|
|
+ if (tls_ctx_global.tls_conf /*(is server)*/
|
|
+ && conn->established && conn->push_buf == NULL)
|
|
+ /* Need to return something to trigger completion of EAP-TLS. */
|
|
+ conn->push_buf = wpabuf_alloc(0);
|
|
+ break;
|
|
+ default:
|
|
+ ++conn->failed;
|
|
+ switch (ret) {
|
|
+ case MBEDTLS_ERR_SSL_CLIENT_RECONNECT:
|
|
+ case MBEDTLS_ERR_NET_CONN_RESET:
|
|
+ case MBEDTLS_ERR_NET_SEND_FAILED:
|
|
+ ++conn->write_alerts;
|
|
+ break;
|
|
+ #if MBEDTLS_VERSION_NUMBER >= 0x03000000 /* mbedtls 3.0.0 */
|
|
+ case MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE:
|
|
+ #else
|
|
+ case MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE:
|
|
+ #endif
|
|
+ tls_mbedtls_suiteb_handshake_alert(conn);
|
|
+ /* fall through */
|
|
+ case MBEDTLS_ERR_NET_RECV_FAILED:
|
|
+ case MBEDTLS_ERR_SSL_CONN_EOF:
|
|
+ case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY:
|
|
+ case MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE:
|
|
+ ++conn->read_alerts;
|
|
+ break;
|
|
+ default:
|
|
+ break;
|
|
+ }
|
|
+
|
|
+ ilog(ret, "mbedtls_ssl_handshake");
|
|
+ break;
|
|
+ }
|
|
+
|
|
+ struct wpabuf *out_data = conn->push_buf;
|
|
+ conn->push_buf = NULL;
|
|
+ return out_data;
|
|
+}
|
|
+
|
|
+
|
|
+struct wpabuf * tls_connection_server_handshake(void *tls_ctx,
|
|
+ struct tls_connection *conn,
|
|
+ const struct wpabuf *in_data,
|
|
+ struct wpabuf **appl_data)
|
|
+{
|
|
+ conn->is_server = 1;
|
|
+ return tls_connection_handshake(tls_ctx, conn, in_data, appl_data);
|
|
+}
|
|
+
|
|
+
|
|
+struct wpabuf * tls_connection_encrypt(void *tls_ctx,
|
|
+ struct tls_connection *conn,
|
|
+ const struct wpabuf *in_data)
|
|
+{
|
|
+ int res = mbedtls_ssl_write(&conn->ssl,
|
|
+ wpabuf_head_u8(in_data), wpabuf_len(in_data));
|
|
+ if (res < 0) {
|
|
+ elog(res, "mbedtls_ssl_write");
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
+ struct wpabuf *buf = conn->push_buf;
|
|
+ conn->push_buf = NULL;
|
|
+ return buf;
|
|
+}
|
|
+
|
|
+
|
|
+struct wpabuf * tls_connection_decrypt(void *tls_ctx,
|
|
+ struct tls_connection *conn,
|
|
+ const struct wpabuf *in_data)
|
|
+{
|
|
+ int res;
|
|
+ struct wpabuf *out;
|
|
+
|
|
+ /*assert(in_data != NULL);*/
|
|
+ if (!tls_pull_buf_append(conn, in_data))
|
|
+ return NULL;
|
|
+
|
|
+ #if defined(MBEDTLS_ZLIB_SUPPORT) /* removed in mbedtls 3.x */
|
|
+ /* Add extra buffer space to handle the possibility of decrypted
|
|
+ * data being longer than input data due to TLS compression. */
|
|
+ out = wpabuf_alloc((wpabuf_len(in_data) + 500) * 3);
|
|
+ #else /* TLS compression is disabled in mbedtls 3.x */
|
|
+ out = wpabuf_alloc(wpabuf_len(in_data));
|
|
+ #endif
|
|
+ if (out == NULL)
|
|
+ return NULL;
|
|
+
|
|
+ res = mbedtls_ssl_read(&conn->ssl, wpabuf_mhead(out), wpabuf_size(out));
|
|
+ if (res < 0) {
|
|
+ #if 1 /*(seems like a different error if wpabuf_len(in_data) == 0)*/
|
|
+ if (res == MBEDTLS_ERR_SSL_WANT_READ)
|
|
+ return out;
|
|
+ #endif
|
|
+ elog(res, "mbedtls_ssl_read");
|
|
+ wpabuf_free(out);
|
|
+ return NULL;
|
|
+ }
|
|
+ wpabuf_put(out, res);
|
|
+
|
|
+ return out;
|
|
+}
|
|
+
|
|
+
|
|
+int tls_connection_resumed(void *tls_ctx, struct tls_connection *conn)
|
|
+{
|
|
+ /* XXX: might need to detect if session resumed from TLS session ticket
|
|
+ * even if not special session ticket handling for EAP-FAST, EAP-TEAP */
|
|
+ /* (?ssl->handshake->resume during session ticket validation?) */
|
|
+ return conn && conn->resumed;
|
|
+}
|
|
+
|
|
+
|
|
+#ifdef TLS_MBEDTLS_EAP_FAST
|
|
+int tls_connection_set_cipher_list(void *tls_ctx, struct tls_connection *conn,
|
|
+ u8 *ciphers)
|
|
+{
|
|
+ /* ciphers is list of TLS_CIPHER_* from hostap/src/crypto/tls.h */
|
|
+ int ids[7];
|
|
+ const int idsz = (int)sizeof(ids);
|
|
+ int nids = -1, id;
|
|
+ for ( ; *ciphers != TLS_CIPHER_NONE; ++ciphers) {
|
|
+ switch (*ciphers) {
|
|
+ case TLS_CIPHER_RC4_SHA:
|
|
+ #ifdef MBEDTLS_TLS_RSA_WITH_RC4_128_SHA
|
|
+ id = MBEDTLS_TLS_RSA_WITH_RC4_128_SHA;
|
|
+ break;
|
|
+ #else
|
|
+ continue; /*(not supported in mbedtls 3.x; ignore)*/
|
|
+ #endif
|
|
+ case TLS_CIPHER_AES128_SHA:
|
|
+ id = MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA;
|
|
+ break;
|
|
+ case TLS_CIPHER_RSA_DHE_AES128_SHA:
|
|
+ id = MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA;
|
|
+ break;
|
|
+ case TLS_CIPHER_ANON_DH_AES128_SHA:
|
|
+ continue; /*(not supported in mbedtls; ignore)*/
|
|
+ case TLS_CIPHER_RSA_DHE_AES256_SHA:
|
|
+ id = MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA;
|
|
+ break;
|
|
+ case TLS_CIPHER_AES256_SHA:
|
|
+ id = MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA;
|
|
+ break;
|
|
+ default:
|
|
+ return -1; /* should not happen */
|
|
+ }
|
|
+ if (++nids == idsz)
|
|
+ return -1; /* should not happen */
|
|
+ ids[nids] = id;
|
|
+ }
|
|
+ if (nids < 0)
|
|
+ return 0; /* nothing to do */
|
|
+ if (++nids == idsz)
|
|
+ return -1; /* should not happen */
|
|
+ ids[nids] = 0; /* terminate list */
|
|
+ ++nids;
|
|
+
|
|
+ return tls_mbedtls_set_ciphersuites(conn->tls_conf, ids, nids) ? 0 : -1;
|
|
+}
|
|
+#endif
|
|
+
|
|
+
|
|
+int tls_get_version(void *ssl_ctx, struct tls_connection *conn,
|
|
+ char *buf, size_t buflen)
|
|
+{
|
|
+ if (conn == NULL)
|
|
+ return -1;
|
|
+ os_strlcpy(buf, mbedtls_ssl_get_version(&conn->ssl), buflen);
|
|
+ return buf[0] != 'u' ? 0 : -1; /*(-1 if "unknown")*/
|
|
+}
|
|
+
|
|
+
|
|
+#ifdef TLS_MBEDTLS_EAP_TEAP
|
|
+u16 tls_connection_get_cipher_suite(struct tls_connection *conn)
|
|
+{
|
|
+ if (conn == NULL)
|
|
+ return 0;
|
|
+ return (u16)mbedtls_ssl_get_ciphersuite_id_from_ssl(&conn->ssl);
|
|
+}
|
|
+#endif
|
|
+
|
|
+
|
|
+int tls_get_cipher(void *tls_ctx, struct tls_connection *conn,
|
|
+ char *buf, size_t buflen)
|
|
+{
|
|
+ if (conn == NULL)
|
|
+ return -1;
|
|
+ const int id = mbedtls_ssl_get_ciphersuite_id_from_ssl(&conn->ssl);
|
|
+ return tls_mbedtls_translate_ciphername(id, buf, buflen) ? 0 : -1;
|
|
+}
|
|
+
|
|
+
|
|
+#ifdef TLS_MBEDTLS_SESSION_TICKETS
|
|
+
|
|
+int tls_connection_enable_workaround(void *tls_ctx,
|
|
+ struct tls_connection *conn)
|
|
+{
|
|
+ /* (see comment in src/eap_peer/eap_fast.c:eap_fast_init()) */
|
|
+ /* XXX: is there a relevant setting for this in mbed TLS? */
|
|
+ /* (do we even care that much about older CBC ciphers?) */
|
|
+ return 0;
|
|
+}
|
|
+
|
|
+
|
|
+int tls_connection_client_hello_ext(void *tls_ctx, struct tls_connection *conn,
|
|
+ int ext_type, const u8 *data,
|
|
+ size_t data_len)
|
|
+{
|
|
+ /* (EAP-FAST and EAP-TEAP) */
|
|
+ if (ext_type == MBEDTLS_TLS_EXT_SESSION_TICKET) /*(ext_type == 35)*/
|
|
+ return tls_mbedtls_clienthello_session_ticket_prep(conn, data,
|
|
+ data_len);
|
|
+
|
|
+ return -1;
|
|
+}
|
|
+
|
|
+#endif /* TLS_MBEDTLS_SESSION_TICKETS */
|
|
+
|
|
+
|
|
+int tls_connection_get_failed(void *tls_ctx, struct tls_connection *conn)
|
|
+{
|
|
+ return conn ? conn->failed : -1;
|
|
+}
|
|
+
|
|
+
|
|
+int tls_connection_get_read_alerts(void *tls_ctx, struct tls_connection *conn)
|
|
+{
|
|
+ return conn ? conn->read_alerts : -1;
|
|
+}
|
|
+
|
|
+
|
|
+int tls_connection_get_write_alerts(void *tls_ctx,
|
|
+ struct tls_connection *conn)
|
|
+{
|
|
+ return conn ? conn->write_alerts : -1;
|
|
+}
|
|
+
|
|
+
|
|
+#ifdef TLS_MBEDTLS_SESSION_TICKETS
|
|
+int tls_connection_set_session_ticket_cb(
|
|
+ void *tls_ctx, struct tls_connection *conn,
|
|
+ tls_session_ticket_cb cb, void *ctx)
|
|
+{
|
|
+ if (!(conn->tls_conf->flags & TLS_CONN_DISABLE_SESSION_TICKET)) {
|
|
+ /* (EAP-FAST and EAP-TEAP) */
|
|
+ conn->session_ticket_cb = cb;
|
|
+ conn->session_ticket_cb_ctx = ctx;
|
|
+ return 0;
|
|
+ }
|
|
+ return -1;
|
|
+}
|
|
+#endif
|
|
+
|
|
+
|
|
+int tls_get_library_version(char *buf, size_t buf_len)
|
|
+{
|
|
+ #ifndef MBEDTLS_VERSION_C
|
|
+ const char * const ver = "n/a";
|
|
+ #else
|
|
+ char ver[9];
|
|
+ mbedtls_version_get_string(ver);
|
|
+ #endif
|
|
+ return os_snprintf(buf, buf_len,
|
|
+ "mbed TLS build=" MBEDTLS_VERSION_STRING " run=%s", ver);
|
|
+}
|
|
+
|
|
+
|
|
+void tls_connection_set_success_data(struct tls_connection *conn,
|
|
+ struct wpabuf *data)
|
|
+{
|
|
+ wpabuf_free(conn->success_data);
|
|
+ conn->success_data = data;
|
|
+}
|
|
+
|
|
+
|
|
+void tls_connection_set_success_data_resumed(struct tls_connection *conn)
|
|
+{
|
|
+}
|
|
+
|
|
+
|
|
+const struct wpabuf *
|
|
+tls_connection_get_success_data(struct tls_connection *conn)
|
|
+{
|
|
+ return conn->success_data;
|
|
+}
|
|
+
|
|
+
|
|
+void tls_connection_remove_session(struct tls_connection *conn)
|
|
+{
|
|
+}
|
|
+
|
|
+
|
|
+#ifdef TLS_MBEDTLS_EAP_TEAP
|
|
+int tls_get_tls_unique(struct tls_connection *conn, u8 *buf, size_t max_len)
|
|
+{
|
|
+ #if defined(MBEDTLS_SSL_RENEGOTIATION) /* XXX: renegotiation or resumption? */
|
|
+ /* data from TLS handshake Finished message */
|
|
+ size_t verify_len = conn->ssl.MBEDTLS_PRIVATE(verify_data_len);
|
|
+ char *verify_data = (conn->is_server ^ conn->resumed)
|
|
+ ? conn->ssl.MBEDTLS_PRIVATE(peer_verify_data)
|
|
+ : conn->ssl.MBEDTLS_PRIVATE(own_verify_data);
|
|
+ if (verify_len && verify_len <= max_len) {
|
|
+ os_memcpy(buf, verify_data, verify_len);
|
|
+ return (int)verify_len;
|
|
+ }
|
|
+ #endif
|
|
+ return -1;
|
|
+}
|
|
+#endif
|
|
+
|
|
+
|
|
+__attribute_noinline__
|
|
+static void tls_mbedtls_set_peer_subject(struct tls_connection *conn, const mbedtls_x509_crt *crt)
|
|
+{
|
|
+ if (conn->peer_subject)
|
|
+ return;
|
|
+ char buf[MBEDTLS_X509_MAX_DN_NAME_SIZE*2];
|
|
+ int buflen = mbedtls_x509_dn_gets(buf, sizeof(buf), &crt->subject);
|
|
+ if (buflen >= 0 && (conn->peer_subject = os_malloc((size_t)buflen+1)))
|
|
+ os_memcpy(conn->peer_subject, buf, (size_t)buflen+1);
|
|
+}
|
|
+
|
|
+
|
|
+#ifdef TLS_MBEDTLS_EAP_TEAP
|
|
+const char * tls_connection_get_peer_subject(struct tls_connection *conn)
|
|
+{
|
|
+ if (!conn)
|
|
+ return NULL;
|
|
+ if (!conn->peer_subject) { /*(if not set during cert verify)*/
|
|
+ const mbedtls_x509_crt *peer_cert =
|
|
+ mbedtls_ssl_get_peer_cert(&conn->ssl);
|
|
+ if (peer_cert)
|
|
+ tls_mbedtls_set_peer_subject(conn, peer_cert);
|
|
+ }
|
|
+ return conn->peer_subject;
|
|
+}
|
|
+#endif
|
|
+
|
|
+
|
|
+#ifdef TLS_MBEDTLS_EAP_TEAP
|
|
+bool tls_connection_get_own_cert_used(struct tls_connection *conn)
|
|
+{
|
|
+ /* XXX: availability of cert does not necessary mean that client
|
|
+ * received certificate request from server and then sent cert.
|
|
+ * ? step handshake in tls_connection_handshake() looking for
|
|
+ * MBEDTLS_SSL_CERTIFICATE_REQUEST ? */
|
|
+ const struct tls_conf * const tls_conf = conn->tls_conf;
|
|
+ return (tls_conf->has_client_cert && tls_conf->has_private_key);
|
|
+}
|
|
+#endif
|
|
+
|
|
+
|
|
+#if defined(CONFIG_FIPS)
|
|
+#define TLS_MBEDTLS_CONFIG_FIPS
|
|
+#endif
|
|
+
|
|
+#if defined(CONFIG_SHA256)
|
|
+#define TLS_MBEDTLS_TLS_PRF_SHA256
|
|
+#endif
|
|
+
|
|
+#if defined(CONFIG_SHA384)
|
|
+#define TLS_MBEDTLS_TLS_PRF_SHA384
|
|
+#endif
|
|
+
|
|
+
|
|
+#ifndef TLS_MBEDTLS_CONFIG_FIPS
|
|
+#if defined(CONFIG_MODULE_TESTS)
|
|
+/* unused with CONFIG_TLS=mbedtls except in crypto_module_tests.c */
|
|
+#if MBEDTLS_VERSION_NUMBER >= 0x02120000 /* mbedtls 2.18.0 */ \
|
|
+ && MBEDTLS_VERSION_NUMBER < 0x03000000 /* mbedtls 3.0.0 */
|
|
+/* sha1-tlsprf.c */
|
|
+#include "sha1.h"
|
|
+int tls_prf_sha1_md5(const u8 *secret, size_t secret_len, const char *label,
|
|
+ const u8 *seed, size_t seed_len, u8 *out, size_t outlen)
|
|
+{
|
|
+ return mbedtls_ssl_tls_prf(MBEDTLS_SSL_TLS_PRF_TLS1,
|
|
+ secret, secret_len, label,
|
|
+ seed, seed_len, out, outlen) ? -1 : 0;
|
|
+}
|
|
+#else
|
|
+#include "sha1-tlsprf.c" /* pull in hostap local implementation */
|
|
+#endif
|
|
+#endif
|
|
+#endif
|
|
+
|
|
+#ifdef TLS_MBEDTLS_TLS_PRF_SHA256
|
|
+/* sha256-tlsprf.c */
|
|
+#if MBEDTLS_VERSION_NUMBER >= 0x02120000 /* mbedtls 2.18.0 */
|
|
+#include "sha256.h"
|
|
+int tls_prf_sha256(const u8 *secret, size_t secret_len, const char *label,
|
|
+ const u8 *seed, size_t seed_len, u8 *out, size_t outlen)
|
|
+{
|
|
+ return mbedtls_ssl_tls_prf(MBEDTLS_SSL_TLS_PRF_SHA256,
|
|
+ secret, secret_len, label,
|
|
+ seed, seed_len, out, outlen) ? -1 : 0;
|
|
+}
|
|
+#else
|
|
+#include "sha256-tlsprf.c" /* pull in hostap local implementation */
|
|
+#endif
|
|
+#endif
|
|
+
|
|
+#ifdef TLS_MBEDTLS_TLS_PRF_SHA384
|
|
+/* sha384-tlsprf.c */
|
|
+#if MBEDTLS_VERSION_NUMBER >= 0x02120000 /* mbedtls 2.18.0 */
|
|
+#include "sha384.h"
|
|
+int tls_prf_sha384(const u8 *secret, size_t secret_len, const char *label,
|
|
+ const u8 *seed, size_t seed_len, u8 *out, size_t outlen)
|
|
+{
|
|
+ return mbedtls_ssl_tls_prf(MBEDTLS_SSL_TLS_PRF_SHA384,
|
|
+ secret, secret_len, label,
|
|
+ seed, seed_len, out, outlen) ? -1 : 0;
|
|
+}
|
|
+#else
|
|
+#include "sha384-tlsprf.c" /* pull in hostap local implementation */
|
|
+#endif
|
|
+#endif
|
|
+
|
|
+
|
|
+#if MBEDTLS_VERSION_NUMBER < 0x03020000 /* mbedtls 3.2.0 */
|
|
+#define mbedtls_x509_crt_has_ext_type(crt, ext_type) \
|
|
+ ((crt)->MBEDTLS_PRIVATE(ext_types) & (ext_type))
|
|
+#endif
|
|
+
|
|
+struct mlist { const char *p; size_t n; };
|
|
+
|
|
+
|
|
+static int
|
|
+tls_mbedtls_match_altsubject(mbedtls_x509_crt *crt, const char *match)
|
|
+{
|
|
+ /* RFE: this could be pre-parsed into structured data at config time */
|
|
+ struct mlist list[256]; /*(much larger than expected)*/
|
|
+ int nlist = 0;
|
|
+ if ( os_strncmp(match, "EMAIL:", 6) != 0
|
|
+ && os_strncmp(match, "DNS:", 4) != 0
|
|
+ && os_strncmp(match, "URI:", 4) != 0 ) {
|
|
+ wpa_printf(MSG_INFO, "MTLS: Invalid altSubjectName match '%s'", match);
|
|
+ return 0;
|
|
+ }
|
|
+ for (const char *s = match, *tok; *s; s = tok ? tok+1 : "") {
|
|
+ do { } while ((tok = os_strchr(s, ';'))
|
|
+ && os_strncmp(tok+1, "EMAIL:", 6) != 0
|
|
+ && os_strncmp(tok+1, "DNS:", 4) != 0
|
|
+ && os_strncmp(tok+1, "URI:", 4) != 0);
|
|
+ list[nlist].p = s;
|
|
+ list[nlist].n = tok ? (size_t)(tok - s) : os_strlen(s);
|
|
+ if (list[nlist].n && ++nlist == sizeof(list)/sizeof(*list)) {
|
|
+ wpa_printf(MSG_INFO, "MTLS: excessive altSubjectName match '%s'",
|
|
+ match);
|
|
+ break; /* truncate huge list and continue */
|
|
+ }
|
|
+ }
|
|
+
|
|
+ if (!mbedtls_x509_crt_has_ext_type(crt, MBEDTLS_X509_EXT_SUBJECT_ALT_NAME))
|
|
+ return 0;
|
|
+
|
|
+ const mbedtls_x509_sequence *cur = &crt->subject_alt_names;
|
|
+ for (; cur != NULL; cur = cur->next) {
|
|
+ const unsigned char san_type = (unsigned char)cur->buf.tag
|
|
+ & MBEDTLS_ASN1_TAG_VALUE_MASK;
|
|
+ char t;
|
|
+ size_t step = 4;
|
|
+ switch (san_type) { /* "EMAIL:" or "DNS:" or "URI:" */
|
|
+ case MBEDTLS_X509_SAN_RFC822_NAME: step = 6; t = 'E'; break;
|
|
+ case MBEDTLS_X509_SAN_DNS_NAME: t = 'D'; break;
|
|
+ case MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER: t = 'U'; break;
|
|
+ default: continue;
|
|
+ }
|
|
+
|
|
+ for (int i = 0; i < nlist; ++i) {
|
|
+ /* step over "EMAIL:" or "DNS:" or "URI:" in list[i].p */
|
|
+ /* Note: v is not '\0'-terminated, but is a known length vlen,
|
|
+ * so okay to pass to os_strncasecmp() even though not z-string */
|
|
+ if (cur->buf.len == list[i].n - step && t == *list[i].p
|
|
+ && 0 == os_strncasecmp((char *)cur->buf.p,
|
|
+ list[i].p+step, cur->buf.len)) {
|
|
+ return 1; /* match */
|
|
+ }
|
|
+ }
|
|
+ }
|
|
+ return 0; /* no match */
|
|
+}
|
|
+
|
|
+
|
|
+static int
|
|
+tls_mbedtls_match_suffix(const char *v, size_t vlen,
|
|
+ const struct mlist *list, int nlist, int full)
|
|
+{
|
|
+ /* Note: v is not '\0'-terminated, but is a known length vlen,
|
|
+ * so okay to pass to os_strncasecmp() even though not z-string */
|
|
+ for (int i = 0; i < nlist; ++i) {
|
|
+ size_t n = list[i].n;
|
|
+ if ((n == vlen || (n < vlen && v[vlen-n-1] == '.' && !full))
|
|
+ && 0 == os_strncasecmp(v+vlen-n, list[i].p, n))
|
|
+ return 1; /* match */
|
|
+ }
|
|
+ return 0; /* no match */
|
|
+}
|
|
+
|
|
+
|
|
+static int
|
|
+tls_mbedtls_match_suffixes(mbedtls_x509_crt *crt, const char *match, int full)
|
|
+{
|
|
+ /* RFE: this could be pre-parsed into structured data at config time */
|
|
+ struct mlist list[256]; /*(much larger than expected)*/
|
|
+ int nlist = 0;
|
|
+ for (const char *s = match, *tok; *s; s = tok ? tok+1 : "") {
|
|
+ tok = os_strchr(s, ';');
|
|
+ list[nlist].p = s;
|
|
+ list[nlist].n = tok ? (size_t)(tok - s) : os_strlen(s);
|
|
+ if (list[nlist].n && ++nlist == sizeof(list)/sizeof(*list)) {
|
|
+ wpa_printf(MSG_INFO, "MTLS: excessive suffix match '%s'", match);
|
|
+ break; /* truncate huge list and continue */
|
|
+ }
|
|
+ }
|
|
+
|
|
+ /* check subjectAltNames */
|
|
+ if (mbedtls_x509_crt_has_ext_type(crt, MBEDTLS_X509_EXT_SUBJECT_ALT_NAME)) {
|
|
+ const mbedtls_x509_sequence *cur = &crt->subject_alt_names;
|
|
+ for (; cur != NULL; cur = cur->next) {
|
|
+ const unsigned char san_type = (unsigned char)cur->buf.tag
|
|
+ & MBEDTLS_ASN1_TAG_VALUE_MASK;
|
|
+ if (san_type == MBEDTLS_X509_SAN_DNS_NAME
|
|
+ && tls_mbedtls_match_suffix((char *)cur->buf.p,
|
|
+ cur->buf.len,
|
|
+ list, nlist, full)) {
|
|
+ return 1; /* match */
|
|
+ }
|
|
+ }
|
|
+ }
|
|
+
|
|
+ /* check subject CN */
|
|
+ const mbedtls_x509_name *name = &crt->subject;
|
|
+ for (; name != NULL; name = name->next) {
|
|
+ if (name->oid.p && MBEDTLS_OID_CMP(MBEDTLS_OID_AT_CN, &name->oid) == 0)
|
|
+ break;
|
|
+ }
|
|
+ if (name && tls_mbedtls_match_suffix((char *)name->val.p, name->val.len,
|
|
+ list, nlist, full)) {
|
|
+ return 1; /* match */
|
|
+ }
|
|
+
|
|
+ return 0; /* no match */
|
|
+}
|
|
+
|
|
+
|
|
+static int
|
|
+tls_mbedtls_match_dn_field(mbedtls_x509_crt *crt, const char *match)
|
|
+{
|
|
+ /* RFE: this could be pre-parsed into structured data at config time */
|
|
+ struct mlistoid { const char *p; size_t n;
|
|
+ const char *oid; size_t olen;
|
|
+ int prefix; };
|
|
+ struct mlistoid list[32]; /*(much larger than expected)*/
|
|
+ int nlist = 0;
|
|
+ for (const char *s = match, *tok, *e; *s; s = tok ? tok+1 : "") {
|
|
+ tok = os_strchr(s, '/');
|
|
+ list[nlist].oid = NULL;
|
|
+ list[nlist].olen = 0;
|
|
+ list[nlist].n = tok ? (size_t)(tok - s) : os_strlen(s);
|
|
+ e = memchr(s, '=', list[nlist].n);
|
|
+ if (e == NULL) {
|
|
+ if (list[nlist].n == 0)
|
|
+ continue; /* skip consecutive, repeated '/' */
|
|
+ if (list[nlist].n == 1 && *s == '*') {
|
|
+ /* special-case "*" to match any OID and value */
|
|
+ s = e = "=*";
|
|
+ list[nlist].n = 2;
|
|
+ list[nlist].oid = "";
|
|
+ }
|
|
+ else {
|
|
+ wpa_printf(MSG_INFO,
|
|
+ "MTLS: invalid check_cert_subject '%s' missing '='",
|
|
+ match);
|
|
+ return 0;
|
|
+ }
|
|
+ }
|
|
+ switch (e - s) {
|
|
+ case 1:
|
|
+ if (*s == 'C') {
|
|
+ list[nlist].oid = MBEDTLS_OID_AT_COUNTRY;
|
|
+ list[nlist].olen = sizeof(MBEDTLS_OID_AT_COUNTRY)-1;
|
|
+ }
|
|
+ else if (*s == 'L') {
|
|
+ list[nlist].oid = MBEDTLS_OID_AT_LOCALITY;
|
|
+ list[nlist].olen = sizeof(MBEDTLS_OID_AT_LOCALITY)-1;
|
|
+ }
|
|
+ else if (*s == 'O') {
|
|
+ list[nlist].oid = MBEDTLS_OID_AT_ORGANIZATION;
|
|
+ list[nlist].olen = sizeof(MBEDTLS_OID_AT_ORGANIZATION)-1;
|
|
+ }
|
|
+ break;
|
|
+ case 2:
|
|
+ if (s[0] == 'C' && s[1] == 'N') {
|
|
+ list[nlist].oid = MBEDTLS_OID_AT_CN;
|
|
+ list[nlist].olen = sizeof(MBEDTLS_OID_AT_CN)-1;
|
|
+ }
|
|
+ else if (s[0] == 'S' && s[1] == 'T') {
|
|
+ list[nlist].oid = MBEDTLS_OID_AT_STATE;
|
|
+ list[nlist].olen = sizeof(MBEDTLS_OID_AT_STATE)-1;
|
|
+ }
|
|
+ else if (s[0] == 'O' && s[1] == 'U') {
|
|
+ list[nlist].oid = MBEDTLS_OID_AT_ORG_UNIT;
|
|
+ list[nlist].olen = sizeof(MBEDTLS_OID_AT_ORG_UNIT)-1;
|
|
+ }
|
|
+ break;
|
|
+ case 12:
|
|
+ if (os_memcmp(s, "emailAddress", 12) == 0) {
|
|
+ list[nlist].oid = MBEDTLS_OID_PKCS9_EMAIL;
|
|
+ list[nlist].olen = sizeof(MBEDTLS_OID_PKCS9_EMAIL)-1;
|
|
+ }
|
|
+ break;
|
|
+ default:
|
|
+ break;
|
|
+ }
|
|
+ if (list[nlist].oid == NULL) {
|
|
+ wpa_printf(MSG_INFO,
|
|
+ "MTLS: Unknown field in check_cert_subject '%s'",
|
|
+ match);
|
|
+ return 0;
|
|
+ }
|
|
+ list[nlist].n -= (size_t)(++e - s);
|
|
+ list[nlist].p = e;
|
|
+ if (list[nlist].n && e[list[nlist].n-1] == '*') {
|
|
+ --list[nlist].n;
|
|
+ list[nlist].prefix = 1;
|
|
+ }
|
|
+ /*(could easily add support for suffix matches if value begins with '*',
|
|
+ * but suffix match is not currently supported by other TLS modules)*/
|
|
+
|
|
+ if (list[nlist].n && ++nlist == sizeof(list)/sizeof(*list)) {
|
|
+ wpa_printf(MSG_INFO,
|
|
+ "MTLS: excessive check_cert_subject match '%s'",
|
|
+ match);
|
|
+ break; /* truncate huge list and continue */
|
|
+ }
|
|
+ }
|
|
+
|
|
+ /* each component in match string must match cert Subject in order listed
|
|
+ * The behavior below preserves ordering but is slightly different than
|
|
+ * the grossly inefficient contortions implemented in tls_openssl.c */
|
|
+ const mbedtls_x509_name *name = &crt->subject;
|
|
+ for (int i = 0; i < nlist; ++i) {
|
|
+ int found = 0;
|
|
+ for (; name != NULL && !found; name = name->next) {
|
|
+ if (!name->oid.p)
|
|
+ continue;
|
|
+ /* special-case "*" to match any OID and value */
|
|
+ if (list[i].olen == 0) {
|
|
+ found = 1;
|
|
+ continue;
|
|
+ }
|
|
+ /* perform equalent of !MBEDTLS_OID_CMP() with oid ptr and len */
|
|
+ if (list[i].olen != name->oid.len
|
|
+ || os_memcmp(list[i].oid, name->oid.p, name->oid.len) != 0)
|
|
+ continue;
|
|
+ /* Note: v is not '\0'-terminated, but is a known length vlen,
|
|
+ * so okay to pass to os_strncasecmp() even though not z-string */
|
|
+ if ((list[i].prefix
|
|
+ ? list[i].n <= name->val.len /* prefix match */
|
|
+ : list[i].n == name->val.len) /* full match */
|
|
+ && 0 == os_strncasecmp((char *)name->val.p,
|
|
+ list[i].p, list[i].n)) {
|
|
+ found = 1;
|
|
+ continue;
|
|
+ }
|
|
+ }
|
|
+ if (!found)
|
|
+ return 0; /* no match */
|
|
+ }
|
|
+ return 1; /* match */
|
|
+}
|
|
+
|
|
+
|
|
+__attribute_cold__
|
|
+static void
|
|
+tls_mbedtls_verify_fail_event (mbedtls_x509_crt *crt, int depth,
|
|
+ const char *errmsg, enum tls_fail_reason reason)
|
|
+{
|
|
+ struct tls_config *init_conf = &tls_ctx_global.init_conf;
|
|
+ if (init_conf->event_cb == NULL)
|
|
+ return;
|
|
+
|
|
+ struct wpabuf *certbuf = wpabuf_alloc_copy(crt->raw.p, crt->raw.len);
|
|
+ char subject[MBEDTLS_X509_MAX_DN_NAME_SIZE*2];
|
|
+ if (mbedtls_x509_dn_gets(subject, sizeof(subject), &crt->subject) < 0)
|
|
+ subject[0] = '\0';
|
|
+ union tls_event_data ev;
|
|
+ os_memset(&ev, 0, sizeof(ev));
|
|
+ ev.cert_fail.reason = reason;
|
|
+ ev.cert_fail.depth = depth;
|
|
+ ev.cert_fail.subject = subject;
|
|
+ ev.cert_fail.reason_txt = errmsg;
|
|
+ ev.cert_fail.cert = certbuf;
|
|
+
|
|
+ init_conf->event_cb(init_conf->cb_ctx, TLS_CERT_CHAIN_FAILURE, &ev);
|
|
+
|
|
+ wpabuf_free(certbuf);
|
|
+}
|
|
+
|
|
+
|
|
+__attribute_noinline__
|
|
+static void
|
|
+tls_mbedtls_verify_cert_event (struct tls_connection *conn,
|
|
+ mbedtls_x509_crt *crt, int depth)
|
|
+{
|
|
+ struct tls_config *init_conf = &tls_ctx_global.init_conf;
|
|
+ if (init_conf->event_cb == NULL)
|
|
+ return;
|
|
+
|
|
+ struct wpabuf *certbuf = NULL;
|
|
+ union tls_event_data ev;
|
|
+ os_memset(&ev, 0, sizeof(ev));
|
|
+
|
|
+ #ifdef MBEDTLS_SHA256_C
|
|
+ u8 hash[SHA256_DIGEST_LENGTH];
|
|
+ const u8 *addr[] = { (u8 *)crt->raw.p };
|
|
+ if (sha256_vector(1, addr, &crt->raw.len, hash) == 0) {
|
|
+ ev.peer_cert.hash = hash;
|
|
+ ev.peer_cert.hash_len = sizeof(hash);
|
|
+ }
|
|
+ #endif
|
|
+ ev.peer_cert.depth = depth;
|
|
+ char subject[MBEDTLS_X509_MAX_DN_NAME_SIZE*2];
|
|
+ if (depth == 0)
|
|
+ ev.peer_cert.subject = conn->peer_subject;
|
|
+ if (ev.peer_cert.subject == NULL) {
|
|
+ ev.peer_cert.subject = subject;
|
|
+ if (mbedtls_x509_dn_gets(subject, sizeof(subject), &crt->subject) < 0)
|
|
+ subject[0] = '\0';
|
|
+ }
|
|
+
|
|
+ char serial_num[128+1];
|
|
+ ev.peer_cert.serial_num =
|
|
+ tls_mbedtls_peer_serial_num(crt, serial_num, sizeof(serial_num));
|
|
+
|
|
+ const mbedtls_x509_sequence *cur;
|
|
+
|
|
+ cur = NULL;
|
|
+ if (mbedtls_x509_crt_has_ext_type(crt, MBEDTLS_X509_EXT_SUBJECT_ALT_NAME))
|
|
+ cur = &crt->subject_alt_names;
|
|
+ for (; cur != NULL; cur = cur->next) {
|
|
+ const unsigned char san_type = (unsigned char)cur->buf.tag
|
|
+ & MBEDTLS_ASN1_TAG_VALUE_MASK;
|
|
+ size_t prelen = 4;
|
|
+ const char *pre;
|
|
+ switch (san_type) {
|
|
+ case MBEDTLS_X509_SAN_RFC822_NAME: prelen = 6; pre = "EMAIL:";break;
|
|
+ case MBEDTLS_X509_SAN_DNS_NAME: pre = "DNS:"; break;
|
|
+ case MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER: pre = "URI:"; break;
|
|
+ default: continue;
|
|
+ }
|
|
+
|
|
+ char *pos = os_malloc(prelen + cur->buf.len + 1);
|
|
+ if (pos == NULL)
|
|
+ break;
|
|
+ ev.peer_cert.altsubject[ev.peer_cert.num_altsubject] = pos;
|
|
+ os_memcpy(pos, pre, prelen);
|
|
+ /* data should be properly backslash-escaped if needed,
|
|
+ * so code below does not re-escape, but does replace CTLs */
|
|
+ /*os_memcpy(pos+prelen, cur->buf.p, cur->buf.len);*/
|
|
+ /*pos[prelen+cur->buf.len] = '\0';*/
|
|
+ pos += prelen;
|
|
+ for (size_t i = 0; i < cur->buf.len; ++i) {
|
|
+ unsigned char c = cur->buf.p[i];
|
|
+ *pos++ = (c >= 32 && c != 127) ? c : '?';
|
|
+ }
|
|
+ *pos = '\0';
|
|
+
|
|
+ if (++ev.peer_cert.num_altsubject == TLS_MAX_ALT_SUBJECT)
|
|
+ break;
|
|
+ }
|
|
+
|
|
+ cur = NULL;
|
|
+ if (mbedtls_x509_crt_has_ext_type(crt, MBEDTLS_X509_EXT_CERTIFICATE_POLICIES))
|
|
+ cur = &crt->certificate_policies;
|
|
+ for (; cur != NULL; cur = cur->next) {
|
|
+ if (cur->buf.len != 11) /* len of OID_TOD_STRICT or OID_TOD_TOFU */
|
|
+ continue;
|
|
+ /* TOD-STRICT "1.3.6.1.4.1.40808.1.3.1" */
|
|
+ /* TOD-TOFU "1.3.6.1.4.1.40808.1.3.2" */
|
|
+ #define OID_TOD_STRICT "\x2b\x06\x01\x04\x01\x82\xbe\x68\x01\x03\x01"
|
|
+ #define OID_TOD_TOFU "\x2b\x06\x01\x04\x01\x82\xbe\x68\x01\x03\x02"
|
|
+ if (os_memcmp(cur->buf.p,
|
|
+ OID_TOD_STRICT, sizeof(OID_TOD_STRICT)-1) == 0) {
|
|
+ ev.peer_cert.tod = 1; /* TOD-STRICT */
|
|
+ break;
|
|
+ }
|
|
+ if (os_memcmp(cur->buf.p,
|
|
+ OID_TOD_TOFU, sizeof(OID_TOD_TOFU)-1) == 0) {
|
|
+ ev.peer_cert.tod = 2; /* TOD-TOFU */
|
|
+ break;
|
|
+ }
|
|
+ }
|
|
+
|
|
+ struct tls_conf *tls_conf = conn->tls_conf;
|
|
+ if (tls_conf->ca_cert_probe || (tls_conf->flags & TLS_CONN_EXT_CERT_CHECK)
|
|
+ || init_conf->cert_in_cb) {
|
|
+ certbuf = wpabuf_alloc_copy(crt->raw.p, crt->raw.len);
|
|
+ ev.peer_cert.cert = certbuf;
|
|
+ }
|
|
+
|
|
+ init_conf->event_cb(init_conf->cb_ctx, TLS_PEER_CERTIFICATE, &ev);
|
|
+
|
|
+ wpabuf_free(certbuf);
|
|
+ char **altsubject;
|
|
+ *(const char ***)&altsubject = ev.peer_cert.altsubject;
|
|
+ for (size_t i = 0; i < ev.peer_cert.num_altsubject; ++i)
|
|
+ os_free(altsubject[i]);
|
|
+}
|
|
+
|
|
+
|
|
+static int
|
|
+tls_mbedtls_verify_cb (void *arg, mbedtls_x509_crt *crt, int depth, uint32_t *flags)
|
|
+{
|
|
+ /* XXX: N.B. verify code not carefully tested besides hwsim tests
|
|
+ *
|
|
+ * RFE: mbedtls_x509_crt_verify_info() and enhance log trace messages
|
|
+ * RFE: review and add support for additional TLS_CONN_* flags
|
|
+ * not handling OCSP (not available in mbedtls)
|
|
+ * ... */
|
|
+
|
|
+ struct tls_connection *conn = (struct tls_connection *)arg;
|
|
+ struct tls_conf *tls_conf = conn->tls_conf;
|
|
+ uint32_t flags_in = *flags;
|
|
+
|
|
+ if (depth > 8) { /*(depth 8 picked as arbitrary limit)*/
|
|
+ emsg(MSG_WARNING, "client cert chain too long");
|
|
+ *flags |= MBEDTLS_X509_BADCERT_OTHER; /* cert chain too long */
|
|
+ tls_mbedtls_verify_fail_event(crt, depth,
|
|
+ "client cert chain too long",
|
|
+ TLS_FAIL_BAD_CERTIFICATE);
|
|
+ }
|
|
+ else if (tls_conf->verify_depth0_only) {
|
|
+ if (depth > 0)
|
|
+ *flags = 0;
|
|
+ else {
|
|
+ #ifdef MBEDTLS_SHA256_C
|
|
+ u8 hash[SHA256_DIGEST_LENGTH];
|
|
+ const u8 *addr[] = { (u8 *)crt->raw.p };
|
|
+ if (sha256_vector(1, addr, &crt->raw.len, hash) < 0
|
|
+ || os_memcmp(tls_conf->ca_cert_hash, hash, sizeof(hash)) != 0) {
|
|
+ *flags |= MBEDTLS_X509_BADCERT_NOT_TRUSTED;
|
|
+ tls_mbedtls_verify_fail_event(crt, depth,
|
|
+ "cert hash mismatch",
|
|
+ TLS_FAIL_UNTRUSTED);
|
|
+ }
|
|
+ else /* hash matches; ignore other issues *except* if revoked)*/
|
|
+ *flags &= MBEDTLS_X509_BADCERT_REVOKED;
|
|
+ #endif
|
|
+ }
|
|
+ }
|
|
+ else if (depth == 0) {
|
|
+ if (!conn->peer_subject)
|
|
+ tls_mbedtls_set_peer_subject(conn, crt);
|
|
+ /*(use same labels to tls_mbedtls_verify_fail_event() as used in
|
|
+ * other TLS modules so that hwsim tests find exact string match)*/
|
|
+ if (!conn->peer_subject) { /* error copying subject string */
|
|
+ *flags |= MBEDTLS_X509_BADCERT_OTHER;
|
|
+ tls_mbedtls_verify_fail_event(crt, depth,
|
|
+ "internal error",
|
|
+ TLS_FAIL_UNSPECIFIED);
|
|
+ }
|
|
+ /*(use os_strstr() for subject match as is done in tls_mbedtls.c
|
|
+ * to follow the same behavior, even though a suffix match would
|
|
+ * make more sense. Also, note that strstr match does not
|
|
+ * normalize whitespace (between components) for comparison)*/
|
|
+ else if (tls_conf->subject_match
|
|
+ && os_strstr(conn->peer_subject,
|
|
+ tls_conf->subject_match) == NULL) {
|
|
+ wpa_printf(MSG_WARNING,
|
|
+ "MTLS: Subject '%s' did not match with '%s'",
|
|
+ conn->peer_subject, tls_conf->subject_match);
|
|
+ *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
|
|
+ tls_mbedtls_verify_fail_event(crt, depth,
|
|
+ "Subject mismatch",
|
|
+ TLS_FAIL_SUBJECT_MISMATCH);
|
|
+ }
|
|
+ if (tls_conf->altsubject_match
|
|
+ && !tls_mbedtls_match_altsubject(crt, tls_conf->altsubject_match)) {
|
|
+ wpa_printf(MSG_WARNING,
|
|
+ "MTLS: altSubjectName match '%s' not found",
|
|
+ tls_conf->altsubject_match);
|
|
+ *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
|
|
+ tls_mbedtls_verify_fail_event(crt, depth,
|
|
+ "AltSubject mismatch",
|
|
+ TLS_FAIL_ALTSUBJECT_MISMATCH);
|
|
+ }
|
|
+ if (tls_conf->suffix_match
|
|
+ && !tls_mbedtls_match_suffixes(crt, tls_conf->suffix_match, 0)) {
|
|
+ wpa_printf(MSG_WARNING,
|
|
+ "MTLS: Domain suffix match '%s' not found",
|
|
+ tls_conf->suffix_match);
|
|
+ *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
|
|
+ tls_mbedtls_verify_fail_event(crt, depth,
|
|
+ "Domain suffix mismatch",
|
|
+ TLS_FAIL_DOMAIN_SUFFIX_MISMATCH);
|
|
+ }
|
|
+ if (tls_conf->domain_match
|
|
+ && !tls_mbedtls_match_suffixes(crt, tls_conf->domain_match, 1)) {
|
|
+ wpa_printf(MSG_WARNING,
|
|
+ "MTLS: Domain match '%s' not found",
|
|
+ tls_conf->domain_match);
|
|
+ *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
|
|
+ tls_mbedtls_verify_fail_event(crt, depth,
|
|
+ "Domain mismatch",
|
|
+ TLS_FAIL_DOMAIN_MISMATCH);
|
|
+ }
|
|
+ if (tls_conf->check_cert_subject
|
|
+ && !tls_mbedtls_match_dn_field(crt, tls_conf->check_cert_subject)) {
|
|
+ *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
|
|
+ tls_mbedtls_verify_fail_event(crt, depth,
|
|
+ "Distinguished Name",
|
|
+ TLS_FAIL_DN_MISMATCH);
|
|
+ }
|
|
+ if (tls_conf->flags & TLS_CONN_SUITEB) {
|
|
+ /* check RSA modulus size (public key bitlen) */
|
|
+ const mbedtls_pk_type_t pk_alg = mbedtls_pk_get_type(&crt->pk);
|
|
+ if ((pk_alg == MBEDTLS_PK_RSA || pk_alg == MBEDTLS_PK_RSASSA_PSS)
|
|
+ && mbedtls_pk_get_bitlen(&crt->pk) < 3072) {
|
|
+ /* hwsim suite_b RSA tests expect 3072
|
|
+ * suite_b_192_rsa_ecdhe_radius_rsa2048_client
|
|
+ * suite_b_192_rsa_dhe_radius_rsa2048_client */
|
|
+ *flags |= MBEDTLS_X509_BADCERT_BAD_KEY;
|
|
+ tls_mbedtls_verify_fail_event(crt, depth,
|
|
+ "Insufficient RSA modulus size",
|
|
+ TLS_FAIL_INSUFFICIENT_KEY_LEN);
|
|
+ }
|
|
+ }
|
|
+ if (tls_conf->check_crl && tls_conf->crl == NULL) {
|
|
+ /* see tests/hwsim test_ap_eap.py ap_wpa2_eap_tls_check_crl */
|
|
+ emsg(MSG_WARNING, "check_crl set but no CRL loaded; reject all?");
|
|
+ *flags |= MBEDTLS_X509_BADCERT_OTHER;
|
|
+ tls_mbedtls_verify_fail_event(crt, depth,
|
|
+ "check_crl set but no CRL loaded; "
|
|
+ "reject all?",
|
|
+ TLS_FAIL_BAD_CERTIFICATE);
|
|
+ }
|
|
+ }
|
|
+ else {
|
|
+ if (tls_conf->check_crl != 2) /* 2 == verify CRLs for all certs */
|
|
+ *flags &= ~MBEDTLS_X509_BADCERT_REVOKED;
|
|
+ }
|
|
+
|
|
+ if (!tls_conf->check_crl_strict) {
|
|
+ *flags &= ~MBEDTLS_X509_BADCRL_EXPIRED;
|
|
+ *flags &= ~MBEDTLS_X509_BADCRL_FUTURE;
|
|
+ }
|
|
+
|
|
+ if (tls_conf->flags & TLS_CONN_DISABLE_TIME_CHECKS) {
|
|
+ *flags &= ~MBEDTLS_X509_BADCERT_EXPIRED;
|
|
+ *flags &= ~MBEDTLS_X509_BADCERT_FUTURE;
|
|
+ }
|
|
+
|
|
+ tls_mbedtls_verify_cert_event(conn, crt, depth);
|
|
+
|
|
+ if (*flags) {
|
|
+ if (*flags & (MBEDTLS_X509_BADCERT_NOT_TRUSTED
|
|
+ |MBEDTLS_X509_BADCERT_CN_MISMATCH
|
|
+ |MBEDTLS_X509_BADCERT_REVOKED)) {
|
|
+ emsg(MSG_WARNING, "client cert not trusted");
|
|
+ }
|
|
+ /* report event if flags set but no additional flags set above */
|
|
+ /* (could translate flags to more detailed TLS_FAIL_* if needed) */
|
|
+ if (!(*flags & ~flags_in)) {
|
|
+ enum tls_fail_reason reason = TLS_FAIL_UNSPECIFIED;
|
|
+ const char *errmsg = "cert verify fail unspecified";
|
|
+ if (*flags & MBEDTLS_X509_BADCERT_NOT_TRUSTED) {
|
|
+ reason = TLS_FAIL_UNTRUSTED;
|
|
+ errmsg = "certificate not trusted";
|
|
+ }
|
|
+ if (*flags & MBEDTLS_X509_BADCERT_REVOKED) {
|
|
+ reason = TLS_FAIL_REVOKED;
|
|
+ errmsg = "certificate has been revoked";
|
|
+ }
|
|
+ if (*flags & MBEDTLS_X509_BADCERT_FUTURE) {
|
|
+ reason = TLS_FAIL_NOT_YET_VALID;
|
|
+ errmsg = "certificate not yet valid";
|
|
+ }
|
|
+ if (*flags & MBEDTLS_X509_BADCERT_EXPIRED) {
|
|
+ reason = TLS_FAIL_EXPIRED;
|
|
+ errmsg = "certificate has expired";
|
|
+ }
|
|
+ if (*flags & MBEDTLS_X509_BADCERT_BAD_MD) {
|
|
+ reason = TLS_FAIL_BAD_CERTIFICATE;
|
|
+ errmsg = "certificate uses insecure algorithm";
|
|
+ }
|
|
+ tls_mbedtls_verify_fail_event(crt, depth, errmsg, reason);
|
|
+ }
|
|
+ #if 0
|
|
+ /* ??? send (again) cert events for all certs in chain ???
|
|
+ * (should already have been called for greater depths) */
|
|
+ /* tls_openssl.c:tls_verify_cb() sends cert events for all certs
|
|
+ * in chain if certificate validation fails, but sends all events
|
|
+ * with depth set to 0 (might be a bug) */
|
|
+ if (depth > 0) {
|
|
+ int pdepth = depth + 1;
|
|
+ for (mbedtls_x509_crt *pcrt; (pcrt = crt->next); ++pdepth) {
|
|
+ tls_mbedtls_verify_cert_event(conn, pcrt, pdepth);
|
|
+ }
|
|
+ }
|
|
+ #endif
|
|
+ /*(do not preserve subject if verification failed but was optional)*/
|
|
+ if (depth == 0 && conn->peer_subject) {
|
|
+ os_free(conn->peer_subject);
|
|
+ conn->peer_subject = NULL;
|
|
+ }
|
|
+ }
|
|
+ else if (depth == 0) {
|
|
+ struct tls_config *init_conf = &tls_ctx_global.init_conf;
|
|
+ if (tls_conf->ca_cert_probe) {
|
|
+ /* reject server certificate on probe-only run */
|
|
+ *flags |= MBEDTLS_X509_BADCERT_OTHER;
|
|
+ tls_mbedtls_verify_fail_event(crt, depth,
|
|
+ "server chain probe",
|
|
+ TLS_FAIL_SERVER_CHAIN_PROBE);
|
|
+ }
|
|
+ else if (init_conf->event_cb) {
|
|
+ /* ??? send event as soon as depth == 0 is verified ???
|
|
+ * What about rest of chain?
|
|
+ * Follows tls_mbedtls.c behavior: */
|
|
+ init_conf->event_cb(init_conf->cb_ctx,
|
|
+ TLS_CERT_CHAIN_SUCCESS, NULL);
|
|
+ }
|
|
+ }
|
|
+
|
|
+ return 0;
|
|
+}
|
|
--- /dev/null
|
|
+++ b/tests/build/build-wpa_supplicant-mbedtls.config
|
|
@@ -0,0 +1,24 @@
|
|
+CONFIG_TLS=mbedtls
|
|
+
|
|
+CONFIG_WPS=y
|
|
+CONFIG_EAP_TLS=y
|
|
+CONFIG_EAP_MSCHAPV2=y
|
|
+
|
|
+CONFIG_EAP_PSK=y
|
|
+CONFIG_EAP_GPSK=y
|
|
+CONFIG_EAP_AKA=y
|
|
+CONFIG_EAP_SIM=y
|
|
+CONFIG_EAP_SAKE=y
|
|
+CONFIG_EAP_PAX=y
|
|
+CONFIG_EAP_FAST=y
|
|
+CONFIG_EAP_IKEV2=y
|
|
+
|
|
+CONFIG_SAE=y
|
|
+CONFIG_FILS=y
|
|
+CONFIG_FILS_SK_PFS=y
|
|
+CONFIG_OWE=y
|
|
+CONFIG_DPP=y
|
|
+CONFIG_SUITEB=y
|
|
+CONFIG_SUITEB192=y
|
|
+
|
|
+CFLAGS += -Werror
|
|
--- a/tests/hwsim/example-hostapd.config
|
|
+++ b/tests/hwsim/example-hostapd.config
|
|
@@ -4,6 +4,7 @@ CONFIG_DRIVER_NONE=y
|
|
CONFIG_DRIVER_NL80211=y
|
|
CONFIG_RSN_PREAUTH=y
|
|
|
|
+#CONFIG_TLS=mbedtls
|
|
#CONFIG_TLS=internal
|
|
#CONFIG_INTERNAL_LIBTOMMATH=y
|
|
#CONFIG_INTERNAL_LIBTOMMATH_FAST=y
|
|
@@ -39,6 +40,9 @@ endif
|
|
ifeq ($(CONFIG_TLS), wolfssl)
|
|
CONFIG_EAP_PWD=y
|
|
endif
|
|
+ifeq ($(CONFIG_TLS), mbedtls)
|
|
+CONFIG_EAP_PWD=y
|
|
+endif
|
|
CONFIG_EAP_EKE=y
|
|
CONFIG_PKCS12=y
|
|
CONFIG_RADIUS_SERVER=y
|
|
--- a/tests/hwsim/example-wpa_supplicant.config
|
|
+++ b/tests/hwsim/example-wpa_supplicant.config
|
|
@@ -2,6 +2,7 @@
|
|
|
|
CONFIG_TLS=openssl
|
|
#CONFIG_TLS=wolfssl
|
|
+#CONFIG_TLS=mbedtls
|
|
#CONFIG_TLS=internal
|
|
#CONFIG_INTERNAL_LIBTOMMATH=y
|
|
#CONFIG_INTERNAL_LIBTOMMATH_FAST=y
|
|
@@ -41,6 +42,9 @@ endif
|
|
ifeq ($(CONFIG_TLS), wolfssl)
|
|
CONFIG_EAP_PWD=y
|
|
endif
|
|
+ifeq ($(CONFIG_TLS), mbedtls)
|
|
+CONFIG_EAP_PWD=y
|
|
+endif
|
|
|
|
CONFIG_USIM_SIMULATOR=y
|
|
CONFIG_SIM_SIMULATOR=y
|
|
--- a/wpa_supplicant/Makefile
|
|
+++ b/wpa_supplicant/Makefile
|
|
@@ -1230,6 +1230,29 @@ endif
|
|
CFLAGS += -DTLS_DEFAULT_CIPHERS=\"$(CONFIG_TLS_DEFAULT_CIPHERS)\"
|
|
endif
|
|
|
|
+ifeq ($(CONFIG_TLS), mbedtls)
|
|
+ifndef CONFIG_CRYPTO
|
|
+CONFIG_CRYPTO=mbedtls
|
|
+endif
|
|
+ifdef TLS_FUNCS
|
|
+OBJS += ../src/crypto/tls_mbedtls.o
|
|
+LIBS += -lmbedtls -lmbedx509
|
|
+endif
|
|
+OBJS += ../src/crypto/crypto_$(CONFIG_CRYPTO).o
|
|
+OBJS_p += ../src/crypto/crypto_$(CONFIG_CRYPTO).o
|
|
+OBJS_priv += ../src/crypto/crypto_$(CONFIG_CRYPTO).o
|
|
+ifdef NEED_FIPS186_2_PRF
|
|
+OBJS += ../src/crypto/fips_prf_internal.o
|
|
+SHA1OBJS += ../src/crypto/sha1-internal.o
|
|
+endif
|
|
+ifeq ($(CONFIG_CRYPTO), mbedtls)
|
|
+LIBS += -lmbedcrypto
|
|
+LIBS_p += -lmbedcrypto
|
|
+# XXX: create a config option?
|
|
+CFLAGS += -DCRYPTO_RSA_OAEP_SHA256
|
|
+endif
|
|
+endif
|
|
+
|
|
ifeq ($(CONFIG_TLS), gnutls)
|
|
ifndef CONFIG_CRYPTO
|
|
# default to libgcrypt
|
|
@@ -1422,9 +1445,11 @@ endif
|
|
|
|
ifneq ($(CONFIG_TLS), openssl)
|
|
ifneq ($(CONFIG_TLS), wolfssl)
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
NEED_INTERNAL_AES_WRAP=y
|
|
endif
|
|
endif
|
|
+endif
|
|
ifdef CONFIG_OPENSSL_INTERNAL_AES_WRAP
|
|
# Seems to be needed at least with BoringSSL
|
|
NEED_INTERNAL_AES_WRAP=y
|
|
@@ -1438,9 +1463,11 @@ endif
|
|
|
|
ifdef NEED_INTERNAL_AES_WRAP
|
|
ifneq ($(CONFIG_TLS), linux)
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
AESOBJS += ../src/crypto/aes-unwrap.o
|
|
endif
|
|
endif
|
|
+endif
|
|
ifdef NEED_AES_EAX
|
|
AESOBJS += ../src/crypto/aes-eax.o
|
|
NEED_AES_CTR=y
|
|
@@ -1450,35 +1477,45 @@ AESOBJS += ../src/crypto/aes-siv.o
|
|
NEED_AES_CTR=y
|
|
endif
|
|
ifdef NEED_AES_CTR
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
AESOBJS += ../src/crypto/aes-ctr.o
|
|
endif
|
|
+endif
|
|
ifdef NEED_AES_ENCBLOCK
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
AESOBJS += ../src/crypto/aes-encblock.o
|
|
endif
|
|
+endif
|
|
NEED_AES_ENC=y
|
|
ifneq ($(CONFIG_TLS), openssl)
|
|
ifneq ($(CONFIG_TLS), linux)
|
|
ifneq ($(CONFIG_TLS), wolfssl)
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
AESOBJS += ../src/crypto/aes-omac1.o
|
|
endif
|
|
endif
|
|
endif
|
|
+endif
|
|
ifdef NEED_AES_WRAP
|
|
NEED_AES_ENC=y
|
|
ifdef NEED_INTERNAL_AES_WRAP
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
AESOBJS += ../src/crypto/aes-wrap.o
|
|
endif
|
|
endif
|
|
+endif
|
|
ifdef NEED_AES_CBC
|
|
NEED_AES_ENC=y
|
|
ifneq ($(CONFIG_TLS), openssl)
|
|
ifneq ($(CONFIG_TLS), linux)
|
|
ifneq ($(CONFIG_TLS), wolfssl)
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
AESOBJS += ../src/crypto/aes-cbc.o
|
|
endif
|
|
endif
|
|
endif
|
|
endif
|
|
+endif
|
|
ifdef NEED_AES_ENC
|
|
ifdef CONFIG_INTERNAL_AES
|
|
AESOBJS += ../src/crypto/aes-internal-enc.o
|
|
@@ -1493,12 +1530,16 @@ ifneq ($(CONFIG_TLS), openssl)
|
|
ifneq ($(CONFIG_TLS), linux)
|
|
ifneq ($(CONFIG_TLS), gnutls)
|
|
ifneq ($(CONFIG_TLS), wolfssl)
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
SHA1OBJS += ../src/crypto/sha1.o
|
|
endif
|
|
endif
|
|
endif
|
|
endif
|
|
+endif
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
SHA1OBJS += ../src/crypto/sha1-prf.o
|
|
+endif
|
|
ifdef CONFIG_INTERNAL_SHA1
|
|
SHA1OBJS += ../src/crypto/sha1-internal.o
|
|
ifdef NEED_FIPS186_2_PRF
|
|
@@ -1510,29 +1551,37 @@ CFLAGS += -DCONFIG_NO_PBKDF2
|
|
else
|
|
ifneq ($(CONFIG_TLS), openssl)
|
|
ifneq ($(CONFIG_TLS), wolfssl)
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
SHA1OBJS += ../src/crypto/sha1-pbkdf2.o
|
|
endif
|
|
endif
|
|
endif
|
|
+endif
|
|
ifdef NEED_T_PRF
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
SHA1OBJS += ../src/crypto/sha1-tprf.o
|
|
endif
|
|
+endif
|
|
ifdef NEED_TLS_PRF
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
SHA1OBJS += ../src/crypto/sha1-tlsprf.o
|
|
endif
|
|
endif
|
|
+endif
|
|
|
|
ifndef CONFIG_FIPS
|
|
ifneq ($(CONFIG_TLS), openssl)
|
|
ifneq ($(CONFIG_TLS), linux)
|
|
ifneq ($(CONFIG_TLS), gnutls)
|
|
ifneq ($(CONFIG_TLS), wolfssl)
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
MD5OBJS += ../src/crypto/md5.o
|
|
endif
|
|
endif
|
|
endif
|
|
endif
|
|
endif
|
|
+endif
|
|
ifdef NEED_MD5
|
|
ifdef CONFIG_INTERNAL_MD5
|
|
MD5OBJS += ../src/crypto/md5-internal.o
|
|
@@ -1587,12 +1636,17 @@ ifneq ($(CONFIG_TLS), openssl)
|
|
ifneq ($(CONFIG_TLS), linux)
|
|
ifneq ($(CONFIG_TLS), gnutls)
|
|
ifneq ($(CONFIG_TLS), wolfssl)
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
SHA256OBJS += ../src/crypto/sha256.o
|
|
endif
|
|
endif
|
|
endif
|
|
endif
|
|
+endif
|
|
+
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
SHA256OBJS += ../src/crypto/sha256-prf.o
|
|
+endif
|
|
ifdef CONFIG_INTERNAL_SHA256
|
|
SHA256OBJS += ../src/crypto/sha256-internal.o
|
|
endif
|
|
@@ -1605,50 +1659,68 @@ CFLAGS += -DCONFIG_INTERNAL_SHA512
|
|
SHA256OBJS += ../src/crypto/sha512-internal.o
|
|
endif
|
|
ifdef NEED_TLS_PRF_SHA256
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
SHA256OBJS += ../src/crypto/sha256-tlsprf.o
|
|
endif
|
|
+endif
|
|
ifdef NEED_TLS_PRF_SHA384
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
SHA256OBJS += ../src/crypto/sha384-tlsprf.o
|
|
endif
|
|
+endif
|
|
ifdef NEED_HMAC_SHA256_KDF
|
|
CFLAGS += -DCONFIG_HMAC_SHA256_KDF
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
OBJS += ../src/crypto/sha256-kdf.o
|
|
endif
|
|
+endif
|
|
ifdef NEED_HMAC_SHA384_KDF
|
|
CFLAGS += -DCONFIG_HMAC_SHA384_KDF
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
OBJS += ../src/crypto/sha384-kdf.o
|
|
endif
|
|
+endif
|
|
ifdef NEED_HMAC_SHA512_KDF
|
|
CFLAGS += -DCONFIG_HMAC_SHA512_KDF
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
OBJS += ../src/crypto/sha512-kdf.o
|
|
endif
|
|
+endif
|
|
OBJS += $(SHA256OBJS)
|
|
ifdef NEED_SHA384
|
|
ifneq ($(CONFIG_TLS), openssl)
|
|
ifneq ($(CONFIG_TLS), linux)
|
|
ifneq ($(CONFIG_TLS), gnutls)
|
|
ifneq ($(CONFIG_TLS), wolfssl)
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
OBJS += ../src/crypto/sha384.o
|
|
endif
|
|
endif
|
|
endif
|
|
endif
|
|
+endif
|
|
CFLAGS += -DCONFIG_SHA384
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
OBJS += ../src/crypto/sha384-prf.o
|
|
endif
|
|
+endif
|
|
ifdef NEED_SHA512
|
|
ifneq ($(CONFIG_TLS), openssl)
|
|
ifneq ($(CONFIG_TLS), linux)
|
|
ifneq ($(CONFIG_TLS), gnutls)
|
|
ifneq ($(CONFIG_TLS), wolfssl)
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
OBJS += ../src/crypto/sha512.o
|
|
endif
|
|
endif
|
|
endif
|
|
endif
|
|
+endif
|
|
CFLAGS += -DCONFIG_SHA512
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
OBJS += ../src/crypto/sha512-prf.o
|
|
endif
|
|
+endif
|
|
|
|
ifdef NEED_ASN1
|
|
OBJS += ../src/tls/asn1.o
|
|
@@ -1823,10 +1895,12 @@ ifdef CONFIG_FIPS
|
|
CFLAGS += -DCONFIG_FIPS
|
|
ifneq ($(CONFIG_TLS), openssl)
|
|
ifneq ($(CONFIG_TLS), wolfssl)
|
|
+ifneq ($(CONFIG_TLS), mbedtls)
|
|
$(error CONFIG_FIPS=y requires CONFIG_TLS=openssl)
|
|
endif
|
|
endif
|
|
endif
|
|
+endif
|
|
|
|
OBJS += $(SHA1OBJS) $(DESOBJS)
|
|
|
|
--- a/wpa_supplicant/defconfig
|
|
+++ b/wpa_supplicant/defconfig
|
|
@@ -10,8 +10,8 @@
|
|
# to override previous values of the variables.
|
|
|
|
|
|
-# Uncomment following two lines and fix the paths if you have installed OpenSSL
|
|
-# or GnuTLS in non-default location
|
|
+# Uncomment following two lines and fix the paths if you have installed TLS
|
|
+# libraries in a non-default location
|
|
#CFLAGS += -I/usr/local/openssl/include
|
|
#LIBS += -L/usr/local/openssl/lib
|
|
|
|
@@ -20,6 +20,7 @@
|
|
# used to fix build issues on such systems (krb5.h not found).
|
|
#CFLAGS += -I/usr/include/kerberos
|
|
|
|
+
|
|
# Driver interface for generic Linux wireless extensions
|
|
# Note: WEXT is deprecated in the current Linux kernel version and no new
|
|
# functionality is added to it. nl80211-based interface is the new
|
|
@@ -329,6 +330,7 @@ CONFIG_BACKEND=file
|
|
# openssl = OpenSSL (default)
|
|
# gnutls = GnuTLS
|
|
# internal = Internal TLSv1 implementation (experimental)
|
|
+# mbedtls = mbed TLS
|
|
# linux = Linux kernel AF_ALG and internal TLSv1 implementation (experimental)
|
|
# none = Empty template
|
|
#CONFIG_TLS=openssl
|