contrib/wpa_supplicant/src/tls/tlsv1_server_read.c

   1 /*
   2  * TLSv1 server - read handshake message
   3  * Copyright (c) 2006-2014, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #include "common.h"
  12 #include "crypto/md5.h"
  13 #include "crypto/sha1.h"
  14 #include "crypto/sha256.h"
  15 #include "crypto/tls.h"
  16 #include "x509v3.h"
  17 #include "tlsv1_common.h"
  18 #include "tlsv1_record.h"
  19 #include "tlsv1_server.h"
  20 #include "tlsv1_server_i.h"
  21
  22
  23 static int tls_process_client_key_exchange(struct tlsv1_server *conn, u8 ct,
  24                                            const u8 *in_data, size_t *in_len);
  25 static int tls_process_change_cipher_spec(struct tlsv1_server *conn,
  26                                           u8 ct, const u8 *in_data,
  27                                           size_t *in_len);
  28
  29
  30 static int testing_cipher_suite_filter(struct tlsv1_server *conn, u16 suite)
  31 {
  32 #ifdef CONFIG_TESTING_OPTIONS
  33         if ((conn->test_flags &
  34              (TLS_BREAK_SRV_KEY_X_HASH | TLS_BREAK_SRV_KEY_X_SIGNATURE |
  35               TLS_DHE_PRIME_511B | TLS_DHE_PRIME_767B | TLS_DHE_PRIME_15 |
  36               TLS_DHE_PRIME_58B | TLS_DHE_NON_PRIME)) &&
  37             suite != TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 &&
  38             suite != TLS_DHE_RSA_WITH_AES_256_CBC_SHA &&
  39             suite != TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 &&
  40             suite != TLS_DHE_RSA_WITH_AES_128_CBC_SHA &&
  41             suite != TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA)
  42                 return 1;
  43 #endif /* CONFIG_TESTING_OPTIONS */
  44
  45         return 0;
  46 }
  47
  48
  49 static void tls_process_status_request_item(struct tlsv1_server *conn,
  50                                             const u8 *req, size_t req_len)
  51 {
  52         const u8 *pos, *end;
  53         u8 status_type;
  54
  55         pos = req;
  56         end = req + req_len;
  57
  58         /*
  59          * RFC 6961, 2.2:
  60          * struct {
  61          *   CertificateStatusType status_type;
  62          *   uint16 request_length;
  63          *   select (status_type) {
  64          *     case ocsp: OCSPStatusRequest;
  65          *     case ocsp_multi: OCSPStatusRequest;
  66          *   } request;
  67          * } CertificateStatusRequestItemV2;
  68          *
  69          * enum { ocsp(1), ocsp_multi(2), (255) } CertificateStatusType;
  70          */
  71
  72         if (end - pos < 1)
  73                 return; /* Truncated data */
  74
  75         status_type = *pos++;
  76         wpa_printf(MSG_DEBUG, "TLSv1: CertificateStatusType %u", status_type);
  77         if (status_type != 1 && status_type != 2)
  78                 return; /* Unsupported status type */
  79         /*
  80          * For now, only OCSP stapling is supported, so ignore the specific
  81          * request, if any.
  82          */
  83         wpa_hexdump(MSG_DEBUG, "TLSv1: OCSPStatusRequest", pos, end - pos);
  84
  85         if (status_type == 2)
  86                 conn->status_request_multi = 1;
  87 }
  88
  89
  90 static void tls_process_status_request_v2(struct tlsv1_server *conn,
  91                                           const u8 *ext, size_t ext_len)
  92 {
  93         const u8 *pos, *end;
  94
  95         conn->status_request_v2 = 1;
  96
  97         pos = ext;
  98         end = ext + ext_len;
  99
 100         /*
 101          * RFC 6961, 2.2:
 102          * struct {
 103          *   CertificateStatusRequestItemV2
 104          *                    certificate_status_req_list<1..2^16-1>;
 105          * } CertificateStatusRequestListV2;
 106          */
 107
 108         while (end - pos >= 2) {
 109                 u16 len;
 110
 111                 len = WPA_GET_BE16(pos);
 112                 pos += 2;
 113                 if (len > end - pos)
 114                         break; /* Truncated data */
 115                 tls_process_status_request_item(conn, pos, len);
 116                 pos += len;
 117         }
 118 }
 119
 120
 121 static int tls_process_client_hello(struct tlsv1_server *conn, u8 ct,
 122                                     const u8 *in_data, size_t *in_len)
 123 {
 124         const u8 *pos, *end, *c;
 125         size_t left, len, i, j;
 126         u16 cipher_suite;
 127         u16 num_suites;
 128         int compr_null_found;
 129         u16 ext_type, ext_len;
 130
 131         if (ct != TLS_CONTENT_TYPE_HANDSHAKE) {
 132                 tlsv1_server_log(conn, "Expected Handshake; received content type 0x%x",
 133                                  ct);
 134                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 135                                    TLS_ALERT_UNEXPECTED_MESSAGE);
 136                 return -1;
 137         }
 138
 139         pos = in_data;
 140         left = *in_len;
 141
 142         if (left < 4) {
 143                 tlsv1_server_log(conn,
 144                                  "Truncated handshake message (expected ClientHello)");
 145                 goto decode_error;
 146         }
 147
 148         /* HandshakeType msg_type */
 149         if (*pos != TLS_HANDSHAKE_TYPE_CLIENT_HELLO) {
 150                 tlsv1_server_log(conn, "Received unexpected handshake message %d (expected ClientHello)",
 151                                  *pos);
 152                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 153                                    TLS_ALERT_UNEXPECTED_MESSAGE);
 154                 return -1;
 155         }
 156         tlsv1_server_log(conn, "Received ClientHello");
 157         pos++;
 158         /* uint24 length */
 159         len = WPA_GET_BE24(pos);
 160         pos += 3;
 161         left -= 4;
 162
 163         if (len > left) {
 164                 tlsv1_server_log(conn,
 165                                  "Truncated ClientHello (len=%d left=%d)",
 166                                  (int) len, (int) left);
 167                 goto decode_error;
 168         }
 169
 170         /* body - ClientHello */
 171
 172         wpa_hexdump(MSG_MSGDUMP, "TLSv1: ClientHello", pos, len);
 173         end = pos + len;
 174
 175         /* ProtocolVersion client_version */
 176         if (end - pos < 2) {
 177                 tlsv1_server_log(conn, "Truncated ClientHello/client_version");
 178                 goto decode_error;
 179         }
 180         conn->client_version = WPA_GET_BE16(pos);
 181         tlsv1_server_log(conn, "Client version %d.%d",
 182                          conn->client_version >> 8,
 183                          conn->client_version & 0xff);
 184         if (conn->client_version < TLS_VERSION_1) {
 185                 tlsv1_server_log(conn, "Unexpected protocol version in ClientHello %u.%u",
 186                                  conn->client_version >> 8,
 187                                  conn->client_version & 0xff);
 188                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 189                                    TLS_ALERT_PROTOCOL_VERSION);
 190                 return -1;
 191         }
 192         pos += 2;
 193
 194         if (TLS_VERSION == TLS_VERSION_1)
 195                 conn->rl.tls_version = TLS_VERSION_1;
 196 #ifdef CONFIG_TLSV12
 197         else if (conn->client_version >= TLS_VERSION_1_2)
 198                 conn->rl.tls_version = TLS_VERSION_1_2;
 199 #endif /* CONFIG_TLSV12 */
 200         else if (conn->client_version > TLS_VERSION_1_1)
 201                 conn->rl.tls_version = TLS_VERSION_1_1;
 202         else
 203                 conn->rl.tls_version = conn->client_version;
 204         tlsv1_server_log(conn, "Using TLS v%s",
 205                          tls_version_str(conn->rl.tls_version));
 206
 207         /* Random random */
 208         if (end - pos < TLS_RANDOM_LEN) {
 209                 tlsv1_server_log(conn, "Truncated ClientHello/client_random");
 210                 goto decode_error;
 211         }
 212
 213         os_memcpy(conn->client_random, pos, TLS_RANDOM_LEN);
 214         pos += TLS_RANDOM_LEN;
 215         wpa_hexdump(MSG_MSGDUMP, "TLSv1: client_random",
 216                     conn->client_random, TLS_RANDOM_LEN);
 217
 218         /* SessionID session_id */
 219         if (end - pos < 1) {
 220                 tlsv1_server_log(conn, "Truncated ClientHello/session_id len");
 221                 goto decode_error;
 222         }
 223         if (end - pos < 1 + *pos || *pos > TLS_SESSION_ID_MAX_LEN) {
 224                 tlsv1_server_log(conn, "Truncated ClientHello/session_id");
 225                 goto decode_error;
 226         }
 227         wpa_hexdump(MSG_MSGDUMP, "TLSv1: client session_id", pos + 1, *pos);
 228         pos += 1 + *pos;
 229         /* TODO: add support for session resumption */
 230
 231         /* CipherSuite cipher_suites<2..2^16-1> */
 232         if (end - pos < 2) {
 233                 tlsv1_server_log(conn,
 234                                  "Truncated ClientHello/cipher_suites len");
 235                 goto decode_error;
 236         }
 237         num_suites = WPA_GET_BE16(pos);
 238         pos += 2;
 239         if (end - pos < num_suites) {
 240                 tlsv1_server_log(conn, "Truncated ClientHello/cipher_suites");
 241                 goto decode_error;
 242         }
 243         wpa_hexdump(MSG_MSGDUMP, "TLSv1: client cipher suites",
 244                     pos, num_suites);
 245         if (num_suites & 1) {
 246                 tlsv1_server_log(conn, "Odd len ClientHello/cipher_suites");
 247                 goto decode_error;
 248         }
 249         num_suites /= 2;
 250
 251         cipher_suite = 0;
 252         for (i = 0; !cipher_suite && i < conn->num_cipher_suites; i++) {
 253                 if (testing_cipher_suite_filter(conn, conn->cipher_suites[i]))
 254                         continue;
 255                 c = pos;
 256                 for (j = 0; j < num_suites; j++) {
 257                         u16 tmp = WPA_GET_BE16(c);
 258                         c += 2;
 259                         if (!cipher_suite && tmp == conn->cipher_suites[i]) {
 260                                 cipher_suite = tmp;
 261                                 break;
 262                         }
 263                 }
 264         }
 265         pos += num_suites * 2;
 266         if (!cipher_suite) {
 267                 tlsv1_server_log(conn, "No supported cipher suite available");
 268                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 269                                    TLS_ALERT_ILLEGAL_PARAMETER);
 270                 return -1;
 271         }
 272
 273         if (tlsv1_record_set_cipher_suite(&conn->rl, cipher_suite) < 0) {
 274                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to set CipherSuite for "
 275                            "record layer");
 276                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 277                                    TLS_ALERT_INTERNAL_ERROR);
 278                 return -1;
 279         }
 280
 281         conn->cipher_suite = cipher_suite;
 282
 283         /* CompressionMethod compression_methods<1..2^8-1> */
 284         if (end - pos < 1) {
 285                 tlsv1_server_log(conn,
 286                                  "Truncated ClientHello/compression_methods len");
 287                 goto decode_error;
 288         }
 289         num_suites = *pos++;
 290         if (end - pos < num_suites) {
 291                 tlsv1_server_log(conn,
 292                                  "Truncated ClientHello/compression_methods");
 293                 goto decode_error;
 294         }
 295         wpa_hexdump(MSG_MSGDUMP, "TLSv1: client compression_methods",
 296                     pos, num_suites);
 297         compr_null_found = 0;
 298         for (i = 0; i < num_suites; i++) {
 299                 if (*pos++ == TLS_COMPRESSION_NULL)
 300                         compr_null_found = 1;
 301         }
 302         if (!compr_null_found) {
 303                 tlsv1_server_log(conn, "Client does not accept NULL compression");
 304                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 305                                    TLS_ALERT_ILLEGAL_PARAMETER);
 306                 return -1;
 307         }
 308
 309         if (end - pos == 1) {
 310                 tlsv1_server_log(conn, "Unexpected extra octet in the end of ClientHello: 0x%02x",
 311                                  *pos);
 312                 goto decode_error;
 313         }
 314
 315         if (end - pos >= 2) {
 316                 /* Extension client_hello_extension_list<0..2^16-1> */
 317                 ext_len = WPA_GET_BE16(pos);
 318                 pos += 2;
 319
 320                 tlsv1_server_log(conn, "%u bytes of ClientHello extensions",
 321                                  ext_len);
 322                 if (end - pos != ext_len) {
 323                         tlsv1_server_log(conn, "Invalid ClientHello extension list length %u (expected %u)",
 324                                          ext_len, (unsigned int) (end - pos));
 325                         goto decode_error;
 326                 }
 327
 328                 /*
 329                  * struct {
 330                  *   ExtensionType extension_type (0..65535)
 331                  *   opaque extension_data<0..2^16-1>
 332                  * } Extension;
 333                  */
 334
 335                 while (pos < end) {
 336                         if (end - pos < 2) {
 337                                 tlsv1_server_log(conn, "Invalid extension_type field");
 338                                 goto decode_error;
 339                         }
 340
 341                         ext_type = WPA_GET_BE16(pos);
 342                         pos += 2;
 343
 344                         if (end - pos < 2) {
 345                                 tlsv1_server_log(conn, "Invalid extension_data length field");
 346                                 goto decode_error;
 347                         }
 348
 349                         ext_len = WPA_GET_BE16(pos);
 350                         pos += 2;
 351
 352                         if (end - pos < ext_len) {
 353                                 tlsv1_server_log(conn, "Invalid extension_data field");
 354                                 goto decode_error;
 355                         }
 356
 357                         tlsv1_server_log(conn, "ClientHello Extension type %u",
 358                                          ext_type);
 359                         wpa_hexdump(MSG_MSGDUMP, "TLSv1: ClientHello "
 360                                     "Extension data", pos, ext_len);
 361
 362                         if (ext_type == TLS_EXT_SESSION_TICKET) {
 363                                 os_free(conn->session_ticket);
 364                                 conn->session_ticket = os_malloc(ext_len);
 365                                 if (conn->session_ticket) {
 366                                         os_memcpy(conn->session_ticket, pos,
 367                                                   ext_len);
 368                                         conn->session_ticket_len = ext_len;
 369                                 }
 370                         } else if (ext_type == TLS_EXT_STATUS_REQUEST) {
 371                                 conn->status_request = 1;
 372                         } else if (ext_type == TLS_EXT_STATUS_REQUEST_V2) {
 373                                 tls_process_status_request_v2(conn, pos,
 374                                                               ext_len);
 375                         }
 376
 377                         pos += ext_len;
 378                 }
 379         }
 380
 381         *in_len = end - in_data;
 382
 383         tlsv1_server_log(conn, "ClientHello OK - proceed to ServerHello");
 384         conn->state = SERVER_HELLO;
 385
 386         return 0;
 387
 388 decode_error:
 389         tlsv1_server_log(conn, "Failed to decode ClientHello");
 390         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 391                            TLS_ALERT_DECODE_ERROR);
 392         return -1;
 393 }
 394
 395
 396 static int tls_process_certificate(struct tlsv1_server *conn, u8 ct,
 397                                    const u8 *in_data, size_t *in_len)
 398 {
 399         const u8 *pos, *end;
 400         size_t left, len, list_len, cert_len, idx;
 401         u8 type;
 402         struct x509_certificate *chain = NULL, *last = NULL, *cert;
 403         int reason;
 404
 405         if (ct != TLS_CONTENT_TYPE_HANDSHAKE) {
 406                 tlsv1_server_log(conn, "Expected Handshake; received content type 0x%x",
 407                                  ct);
 408                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 409                                    TLS_ALERT_UNEXPECTED_MESSAGE);
 410                 return -1;
 411         }
 412
 413         pos = in_data;
 414         left = *in_len;
 415
 416         if (left < 4) {
 417                 tlsv1_server_log(conn, "Too short Certificate message (len=%lu)",
 418                                  (unsigned long) left);
 419                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 420                                    TLS_ALERT_DECODE_ERROR);
 421                 return -1;
 422         }
 423
 424         type = *pos++;
 425         len = WPA_GET_BE24(pos);
 426         pos += 3;
 427         left -= 4;
 428
 429         if (len > left) {
 430                 tlsv1_server_log(conn, "Unexpected Certificate message length (len=%lu != left=%lu)",
 431                                  (unsigned long) len, (unsigned long) left);
 432                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 433                                    TLS_ALERT_DECODE_ERROR);
 434                 return -1;
 435         }
 436
 437         if (type == TLS_HANDSHAKE_TYPE_CLIENT_KEY_EXCHANGE) {
 438                 if (conn->verify_peer) {
 439                         tlsv1_server_log(conn, "Client did not include Certificate");
 440                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 441                                            TLS_ALERT_UNEXPECTED_MESSAGE);
 442                         return -1;
 443                 }
 444
 445                 return tls_process_client_key_exchange(conn, ct, in_data,
 446                                                        in_len);
 447         }
 448         if (type != TLS_HANDSHAKE_TYPE_CERTIFICATE) {
 449                 tlsv1_server_log(conn, "Received unexpected handshake message %d (expected Certificate/ClientKeyExchange)",
 450                                  type);
 451                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 452                                    TLS_ALERT_UNEXPECTED_MESSAGE);
 453                 return -1;
 454         }
 455
 456         tlsv1_server_log(conn, "Received Certificate (certificate_list len %lu)",
 457                          (unsigned long) len);
 458
 459         /*
 460          * opaque ASN.1Cert<2^24-1>;
 461          *
 462          * struct {
 463          *     ASN.1Cert certificate_list<1..2^24-1>;
 464          * } Certificate;
 465          */
 466
 467         end = pos + len;
 468
 469         if (end - pos < 3) {
 470                 tlsv1_server_log(conn, "Too short Certificate (left=%lu)",
 471                                  (unsigned long) left);
 472                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 473                                    TLS_ALERT_DECODE_ERROR);
 474                 return -1;
 475         }
 476
 477         list_len = WPA_GET_BE24(pos);
 478         pos += 3;
 479
 480         if ((size_t) (end - pos) != list_len) {
 481                 tlsv1_server_log(conn, "Unexpected certificate_list length (len=%lu left=%lu)",
 482                                  (unsigned long) list_len,
 483                                  (unsigned long) (end - pos));
 484                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 485                                    TLS_ALERT_DECODE_ERROR);
 486                 return -1;
 487         }
 488
 489         idx = 0;
 490         while (pos < end) {
 491                 if (end - pos < 3) {
 492                         tlsv1_server_log(conn, "Failed to parse certificate_list");
 493                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 494                                            TLS_ALERT_DECODE_ERROR);
 495                         x509_certificate_chain_free(chain);
 496                         return -1;
 497                 }
 498
 499                 cert_len = WPA_GET_BE24(pos);
 500                 pos += 3;
 501
 502                 if ((size_t) (end - pos) < cert_len) {
 503                         tlsv1_server_log(conn, "Unexpected certificate length (len=%lu left=%lu)",
 504                                          (unsigned long) cert_len,
 505                                          (unsigned long) (end - pos));
 506                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 507                                            TLS_ALERT_DECODE_ERROR);
 508                         x509_certificate_chain_free(chain);
 509                         return -1;
 510                 }
 511
 512                 tlsv1_server_log(conn, "Certificate %lu (len %lu)",
 513                                  (unsigned long) idx, (unsigned long) cert_len);
 514
 515                 if (idx == 0) {
 516                         crypto_public_key_free(conn->client_rsa_key);
 517                         if (tls_parse_cert(pos, cert_len,
 518                                            &conn->client_rsa_key)) {
 519                                 tlsv1_server_log(conn, "Failed to parse the certificate");
 520                                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 521                                                    TLS_ALERT_BAD_CERTIFICATE);
 522                                 x509_certificate_chain_free(chain);
 523                                 return -1;
 524                         }
 525                 }
 526
 527                 cert = x509_certificate_parse(pos, cert_len);
 528                 if (cert == NULL) {
 529                         tlsv1_server_log(conn, "Failed to parse the certificate");
 530                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 531                                            TLS_ALERT_BAD_CERTIFICATE);
 532                         x509_certificate_chain_free(chain);
 533                         return -1;
 534                 }
 535
 536                 if (last == NULL)
 537                         chain = cert;
 538                 else
 539                         last->next = cert;
 540                 last = cert;
 541
 542                 idx++;
 543                 pos += cert_len;
 544         }
 545
 546         if (x509_certificate_chain_validate(conn->cred->trusted_certs, chain,
 547                                             &reason, 0) < 0) {
 548                 int tls_reason;
 549                 tlsv1_server_log(conn, "Server certificate chain validation failed (reason=%d)",
 550                                  reason);
 551                 switch (reason) {
 552                 case X509_VALIDATE_BAD_CERTIFICATE:
 553                         tls_reason = TLS_ALERT_BAD_CERTIFICATE;
 554                         break;
 555                 case X509_VALIDATE_UNSUPPORTED_CERTIFICATE:
 556                         tls_reason = TLS_ALERT_UNSUPPORTED_CERTIFICATE;
 557                         break;
 558                 case X509_VALIDATE_CERTIFICATE_REVOKED:
 559                         tls_reason = TLS_ALERT_CERTIFICATE_REVOKED;
 560                         break;
 561                 case X509_VALIDATE_CERTIFICATE_EXPIRED:
 562                         tls_reason = TLS_ALERT_CERTIFICATE_EXPIRED;
 563                         break;
 564                 case X509_VALIDATE_CERTIFICATE_UNKNOWN:
 565                         tls_reason = TLS_ALERT_CERTIFICATE_UNKNOWN;
 566                         break;
 567                 case X509_VALIDATE_UNKNOWN_CA:
 568                         tls_reason = TLS_ALERT_UNKNOWN_CA;
 569                         break;
 570                 default:
 571                         tls_reason = TLS_ALERT_BAD_CERTIFICATE;
 572                         break;
 573                 }
 574                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL, tls_reason);
 575                 x509_certificate_chain_free(chain);
 576                 return -1;
 577         }
 578
 579         if (chain && (chain->extensions_present & X509_EXT_EXT_KEY_USAGE) &&
 580             !(chain->ext_key_usage &
 581               (X509_EXT_KEY_USAGE_ANY | X509_EXT_KEY_USAGE_CLIENT_AUTH))) {
 582                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 583                                    TLS_ALERT_BAD_CERTIFICATE);
 584                 x509_certificate_chain_free(chain);
 585                 return -1;
 586         }
 587
 588         x509_certificate_chain_free(chain);
 589
 590         *in_len = end - in_data;
 591
 592         conn->state = CLIENT_KEY_EXCHANGE;
 593
 594         return 0;
 595 }
 596
 597
 598 static int tls_process_client_key_exchange_rsa(
 599         struct tlsv1_server *conn, const u8 *pos, const u8 *end)
 600 {
 601         u8 *out;
 602         size_t outlen, outbuflen;
 603         u16 encr_len;
 604         int res;
 605         int use_random = 0;
 606
 607         if (end - pos < 2) {
 608                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 609                                    TLS_ALERT_DECODE_ERROR);
 610                 return -1;
 611         }
 612
 613         encr_len = WPA_GET_BE16(pos);
 614         pos += 2;
 615         if (pos + encr_len > end) {
 616                 tlsv1_server_log(conn, "Invalid ClientKeyExchange format: encr_len=%u left=%u",
 617                                  encr_len, (unsigned int) (end - pos));
 618                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 619                                    TLS_ALERT_DECODE_ERROR);
 620                 return -1;
 621         }
 622
 623         outbuflen = outlen = end - pos;
 624         out = os_malloc(outlen >= TLS_PRE_MASTER_SECRET_LEN ?
 625                         outlen : TLS_PRE_MASTER_SECRET_LEN);
 626         if (out == NULL) {
 627                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 628                                    TLS_ALERT_INTERNAL_ERROR);
 629                 return -1;
 630         }
 631
 632         /*
 633          * struct {
 634          *   ProtocolVersion client_version;
 635          *   opaque random[46];
 636          * } PreMasterSecret;
 637          *
 638          * struct {
 639          *   public-key-encrypted PreMasterSecret pre_master_secret;
 640          * } EncryptedPreMasterSecret;
 641          */
 642
 643         /*
 644          * Note: To avoid Bleichenbacher attack, we do not report decryption or
 645          * parsing errors from EncryptedPreMasterSecret processing to the
 646          * client. Instead, a random pre-master secret is used to force the
 647          * handshake to fail.
 648          */
 649
 650         if (crypto_private_key_decrypt_pkcs1_v15(conn->cred->key,
 651                                                  pos, encr_len,
 652                                                  out, &outlen) < 0) {
 653                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to decrypt "
 654                            "PreMasterSecret (encr_len=%u outlen=%lu)",
 655                            encr_len, (unsigned long) outlen);
 656                 use_random = 1;
 657         }
 658
 659         if (!use_random && outlen != TLS_PRE_MASTER_SECRET_LEN) {
 660                 tlsv1_server_log(conn, "Unexpected PreMasterSecret length %lu",
 661                                  (unsigned long) outlen);
 662                 use_random = 1;
 663         }
 664
 665         if (!use_random && WPA_GET_BE16(out) != conn->client_version) {
 666                 tlsv1_server_log(conn, "Client version in ClientKeyExchange does not match with version in ClientHello");
 667                 use_random = 1;
 668         }
 669
 670         if (use_random) {
 671                 wpa_printf(MSG_DEBUG, "TLSv1: Using random premaster secret "
 672                            "to avoid revealing information about private key");
 673                 outlen = TLS_PRE_MASTER_SECRET_LEN;
 674                 if (os_get_random(out, outlen)) {
 675                         wpa_printf(MSG_DEBUG, "TLSv1: Failed to get random "
 676                                    "data");
 677                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 678                                            TLS_ALERT_INTERNAL_ERROR);
 679                         os_free(out);
 680                         return -1;
 681                 }
 682         }
 683
 684         res = tlsv1_server_derive_keys(conn, out, outlen);
 685
 686         /* Clear the pre-master secret since it is not needed anymore */
 687         os_memset(out, 0, outbuflen);
 688         os_free(out);
 689
 690         if (res) {
 691                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive keys");
 692                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 693                                    TLS_ALERT_INTERNAL_ERROR);
 694                 return -1;
 695         }
 696
 697         return 0;
 698 }
 699
 700
 701 static int tls_process_client_key_exchange_dh(
 702         struct tlsv1_server *conn, const u8 *pos, const u8 *end)
 703 {
 704         const u8 *dh_yc;
 705         u16 dh_yc_len;
 706         u8 *shared;
 707         size_t shared_len;
 708         int res;
 709         const u8 *dh_p;
 710         size_t dh_p_len;
 711
 712         /*
 713          * struct {
 714          *   select (PublicValueEncoding) {
 715          *     case implicit: struct { };
 716          *     case explicit: opaque dh_Yc<1..2^16-1>;
 717          *   } dh_public;
 718          * } ClientDiffieHellmanPublic;
 719          */
 720
 721         tlsv1_server_log(conn, "ClientDiffieHellmanPublic received");
 722         wpa_hexdump(MSG_MSGDUMP, "TLSv1: ClientDiffieHellmanPublic",
 723                     pos, end - pos);
 724
 725         if (end == pos) {
 726                 wpa_printf(MSG_DEBUG, "TLSv1: Implicit public value encoding "
 727                            "not supported");
 728                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 729                                    TLS_ALERT_INTERNAL_ERROR);
 730                 return -1;
 731         }
 732
 733         if (end - pos < 3) {
 734                 tlsv1_server_log(conn, "Invalid client public value length");
 735                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 736                                    TLS_ALERT_DECODE_ERROR);
 737                 return -1;
 738         }
 739
 740         dh_yc_len = WPA_GET_BE16(pos);
 741         dh_yc = pos + 2;
 742
 743         if (dh_yc_len > end - dh_yc) {
 744                 tlsv1_server_log(conn, "Client public value overflow (length %d)",
 745                                  dh_yc_len);
 746                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 747                                    TLS_ALERT_DECODE_ERROR);
 748                 return -1;
 749         }
 750
 751         wpa_hexdump(MSG_DEBUG, "TLSv1: DH Yc (client's public value)",
 752                     dh_yc, dh_yc_len);
 753
 754         if (conn->cred == NULL || conn->cred->dh_p == NULL ||
 755             conn->dh_secret == NULL) {
 756                 wpa_printf(MSG_DEBUG, "TLSv1: No DH parameters available");
 757                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 758                                    TLS_ALERT_INTERNAL_ERROR);
 759                 return -1;
 760         }
 761
 762         tlsv1_server_get_dh_p(conn, &dh_p, &dh_p_len);
 763
 764         shared_len = dh_p_len;
 765         shared = os_malloc(shared_len);
 766         if (shared == NULL) {
 767                 wpa_printf(MSG_DEBUG, "TLSv1: Could not allocate memory for "
 768                            "DH");
 769                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 770                                    TLS_ALERT_INTERNAL_ERROR);
 771                 return -1;
 772         }
 773
 774         /* shared = Yc^secret mod p */
 775         if (crypto_mod_exp(dh_yc, dh_yc_len, conn->dh_secret,
 776                            conn->dh_secret_len, dh_p, dh_p_len,
 777                            shared, &shared_len)) {
 778                 os_free(shared);
 779                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 780                                    TLS_ALERT_INTERNAL_ERROR);
 781                 return -1;
 782         }
 783         wpa_hexdump_key(MSG_DEBUG, "TLSv1: Shared secret from DH key exchange",
 784                         shared, shared_len);
 785
 786         os_memset(conn->dh_secret, 0, conn->dh_secret_len);
 787         os_free(conn->dh_secret);
 788         conn->dh_secret = NULL;
 789
 790         res = tlsv1_server_derive_keys(conn, shared, shared_len);
 791
 792         /* Clear the pre-master secret since it is not needed anymore */
 793         os_memset(shared, 0, shared_len);
 794         os_free(shared);
 795
 796         if (res) {
 797                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive keys");
 798                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 799                                    TLS_ALERT_INTERNAL_ERROR);
 800                 return -1;
 801         }
 802
 803         return 0;
 804 }
 805
 806
 807 static int tls_process_client_key_exchange(struct tlsv1_server *conn, u8 ct,
 808                                            const u8 *in_data, size_t *in_len)
 809 {
 810         const u8 *pos, *end;
 811         size_t left, len;
 812         u8 type;
 813         tls_key_exchange keyx;
 814         const struct tls_cipher_suite *suite;
 815
 816         if (ct != TLS_CONTENT_TYPE_HANDSHAKE) {
 817                 tlsv1_server_log(conn, "Expected Handshake; received content type 0x%x",
 818                                  ct);
 819                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 820                                    TLS_ALERT_UNEXPECTED_MESSAGE);
 821                 return -1;
 822         }
 823
 824         pos = in_data;
 825         left = *in_len;
 826
 827         if (left < 4) {
 828                 tlsv1_server_log(conn, "Too short ClientKeyExchange (Left=%lu)",
 829                                  (unsigned long) left);
 830                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 831                                    TLS_ALERT_DECODE_ERROR);
 832                 return -1;
 833         }
 834
 835         type = *pos++;
 836         len = WPA_GET_BE24(pos);
 837         pos += 3;
 838         left -= 4;
 839
 840         if (len > left) {
 841                 tlsv1_server_log(conn, "Mismatch in ClientKeyExchange length (len=%lu != left=%lu)",
 842                                  (unsigned long) len, (unsigned long) left);
 843                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 844                                    TLS_ALERT_DECODE_ERROR);
 845                 return -1;
 846         }
 847
 848         end = pos + len;
 849
 850         if (type != TLS_HANDSHAKE_TYPE_CLIENT_KEY_EXCHANGE) {
 851                 tlsv1_server_log(conn, "Received unexpected handshake message %d (expected ClientKeyExchange)",
 852                                  type);
 853                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 854                                    TLS_ALERT_UNEXPECTED_MESSAGE);
 855                 return -1;
 856         }
 857
 858         tlsv1_server_log(conn, "Received ClientKeyExchange");
 859
 860         wpa_hexdump(MSG_DEBUG, "TLSv1: ClientKeyExchange", pos, len);
 861
 862         suite = tls_get_cipher_suite(conn->rl.cipher_suite);
 863         if (suite == NULL)
 864                 keyx = TLS_KEY_X_NULL;
 865         else
 866                 keyx = suite->key_exchange;
 867
 868         if ((keyx == TLS_KEY_X_DH_anon || keyx == TLS_KEY_X_DHE_RSA) &&
 869             tls_process_client_key_exchange_dh(conn, pos, end) < 0)
 870                 return -1;
 871
 872         if (keyx != TLS_KEY_X_DH_anon && keyx != TLS_KEY_X_DHE_RSA &&
 873             tls_process_client_key_exchange_rsa(conn, pos, end) < 0)
 874                 return -1;
 875
 876         *in_len = end - in_data;
 877
 878         conn->state = CERTIFICATE_VERIFY;
 879
 880         return 0;
 881 }
 882
 883
 884 static int tls_process_certificate_verify(struct tlsv1_server *conn, u8 ct,
 885                                           const u8 *in_data, size_t *in_len)
 886 {
 887         const u8 *pos, *end;
 888         size_t left, len;
 889         u8 type;
 890         size_t hlen;
 891         u8 hash[MD5_MAC_LEN + SHA1_MAC_LEN], *hpos;
 892         u8 alert;
 893
 894         if (ct == TLS_CONTENT_TYPE_CHANGE_CIPHER_SPEC) {
 895                 if (conn->verify_peer) {
 896                         tlsv1_server_log(conn, "Client did not include CertificateVerify");
 897                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 898                                            TLS_ALERT_UNEXPECTED_MESSAGE);
 899                         return -1;
 900                 }
 901
 902                 return tls_process_change_cipher_spec(conn, ct, in_data,
 903                                                       in_len);
 904         }
 905
 906         if (ct != TLS_CONTENT_TYPE_HANDSHAKE) {
 907                 tlsv1_server_log(conn, "Expected Handshake; received content type 0x%x",
 908                                  ct);
 909                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 910                                    TLS_ALERT_UNEXPECTED_MESSAGE);
 911                 return -1;
 912         }
 913
 914         pos = in_data;
 915         left = *in_len;
 916
 917         if (left < 4) {
 918                 tlsv1_server_log(conn, "Too short CertificateVerify message (len=%lu)",
 919                                  (unsigned long) left);
 920                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 921                                    TLS_ALERT_DECODE_ERROR);
 922                 return -1;
 923         }
 924
 925         type = *pos++;
 926         len = WPA_GET_BE24(pos);
 927         pos += 3;
 928         left -= 4;
 929
 930         if (len > left) {
 931                 tlsv1_server_log(conn, "Unexpected CertificateVerify message length (len=%lu != left=%lu)",
 932                                  (unsigned long) len, (unsigned long) left);
 933                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 934                                    TLS_ALERT_DECODE_ERROR);
 935                 return -1;
 936         }
 937
 938         end = pos + len;
 939
 940         if (type != TLS_HANDSHAKE_TYPE_CERTIFICATE_VERIFY) {
 941                 tlsv1_server_log(conn, "Received unexpected handshake message %d (expected CertificateVerify)",
 942                                  type);
 943                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 944                                    TLS_ALERT_UNEXPECTED_MESSAGE);
 945                 return -1;
 946         }
 947
 948         tlsv1_server_log(conn, "Received CertificateVerify");
 949
 950         /*
 951          * struct {
 952          *   Signature signature;
 953          * } CertificateVerify;
 954          */
 955
 956         hpos = hash;
 957
 958 #ifdef CONFIG_TLSV12
 959         if (conn->rl.tls_version == TLS_VERSION_1_2) {
 960                 /*
 961                  * RFC 5246, 4.7:
 962                  * TLS v1.2 adds explicit indication of the used signature and
 963                  * hash algorithms.
 964                  *
 965                  * struct {
 966                  *   HashAlgorithm hash;
 967                  *   SignatureAlgorithm signature;
 968                  * } SignatureAndHashAlgorithm;
 969                  */
 970                 if (end - pos < 2) {
 971                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 972                                            TLS_ALERT_DECODE_ERROR);
 973                         return -1;
 974                 }
 975                 if (pos[0] != TLS_HASH_ALG_SHA256 ||
 976                     pos[1] != TLS_SIGN_ALG_RSA) {
 977                         wpa_printf(MSG_DEBUG, "TLSv1.2: Unsupported hash(%u)/"
 978                                    "signature(%u) algorithm",
 979                                    pos[0], pos[1]);
 980                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 981                                            TLS_ALERT_INTERNAL_ERROR);
 982                         return -1;
 983                 }
 984                 pos += 2;
 985
 986                 hlen = SHA256_MAC_LEN;
 987                 if (conn->verify.sha256_cert == NULL ||
 988                     crypto_hash_finish(conn->verify.sha256_cert, hpos, &hlen) <
 989                     0) {
 990                         conn->verify.sha256_cert = NULL;
 991                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
 992                                            TLS_ALERT_INTERNAL_ERROR);
 993                         return -1;
 994                 }
 995                 conn->verify.sha256_cert = NULL;
 996         } else {
 997 #endif /* CONFIG_TLSV12 */
 998
 999         hlen = MD5_MAC_LEN;
1000         if (conn->verify.md5_cert == NULL ||
1001             crypto_hash_finish(conn->verify.md5_cert, hpos, &hlen) < 0) {
1002                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
1003                                    TLS_ALERT_INTERNAL_ERROR);
1004                 conn->verify.md5_cert = NULL;
1005                 crypto_hash_finish(conn->verify.sha1_cert, NULL, NULL);
1006                 conn->verify.sha1_cert = NULL;
1007                 return -1;
1008         }
1009         hpos += MD5_MAC_LEN;
1010
1011         conn->verify.md5_cert = NULL;
1012         hlen = SHA1_MAC_LEN;
1013         if (conn->verify.sha1_cert == NULL ||
1014             crypto_hash_finish(conn->verify.sha1_cert, hpos, &hlen) < 0) {
1015                 conn->verify.sha1_cert = NULL;
1016                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
1017                                    TLS_ALERT_INTERNAL_ERROR);
1018                 return -1;
1019         }
1020         conn->verify.sha1_cert = NULL;
1021
1022         hlen += MD5_MAC_LEN;
1023
1024 #ifdef CONFIG_TLSV12
1025         }
1026 #endif /* CONFIG_TLSV12 */
1027
1028         wpa_hexdump(MSG_MSGDUMP, "TLSv1: CertificateVerify hash", hash, hlen);
1029
1030         if (tls_verify_signature(conn->rl.tls_version, conn->client_rsa_key,
1031                                  hash, hlen, pos, end - pos, &alert) < 0) {
1032                 tlsv1_server_log(conn, "Invalid Signature in CertificateVerify");
1033                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL, alert);
1034                 return -1;
1035         }
1036
1037         *in_len = end - in_data;
1038
1039         conn->state = CHANGE_CIPHER_SPEC;
1040
1041         return 0;
1042 }
1043
1044
1045 static int tls_process_change_cipher_spec(struct tlsv1_server *conn,
1046                                           u8 ct, const u8 *in_data,
1047                                           size_t *in_len)
1048 {
1049         const u8 *pos;
1050         size_t left;
1051
1052         if (ct != TLS_CONTENT_TYPE_CHANGE_CIPHER_SPEC) {
1053                 tlsv1_server_log(conn, "Expected ChangeCipherSpec; received content type 0x%x",
1054                                  ct);
1055                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
1056                                    TLS_ALERT_UNEXPECTED_MESSAGE);
1057                 return -1;
1058         }
1059
1060         pos = in_data;
1061         left = *in_len;
1062
1063         if (left < 1) {
1064                 tlsv1_server_log(conn, "Too short ChangeCipherSpec");
1065                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
1066                                    TLS_ALERT_DECODE_ERROR);
1067                 return -1;
1068         }
1069
1070         if (*pos != TLS_CHANGE_CIPHER_SPEC) {
1071                 tlsv1_server_log(conn, "Expected ChangeCipherSpec; received data 0x%x",
1072                                  *pos);
1073                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
1074                                    TLS_ALERT_UNEXPECTED_MESSAGE);
1075                 return -1;
1076         }
1077
1078         tlsv1_server_log(conn, "Received ChangeCipherSpec");
1079         if (tlsv1_record_change_read_cipher(&conn->rl) < 0) {
1080                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to change read cipher "
1081                            "for record layer");
1082                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
1083                                    TLS_ALERT_INTERNAL_ERROR);
1084                 return -1;
1085         }
1086
1087         *in_len = pos + 1 - in_data;
1088
1089         conn->state = CLIENT_FINISHED;
1090
1091         return 0;
1092 }
1093
1094
1095 static int tls_process_client_finished(struct tlsv1_server *conn, u8 ct,
1096                                        const u8 *in_data, size_t *in_len)
1097 {
1098         const u8 *pos, *end;
1099         size_t left, len, hlen;
1100         u8 verify_data[TLS_VERIFY_DATA_LEN];
1101         u8 hash[MD5_MAC_LEN + SHA1_MAC_LEN];
1102
1103 #ifdef CONFIG_TESTING_OPTIONS
1104         if ((conn->test_flags &
1105              (TLS_BREAK_SRV_KEY_X_HASH | TLS_BREAK_SRV_KEY_X_SIGNATURE)) &&
1106             !conn->test_failure_reported) {
1107                 tlsv1_server_log(conn, "TEST-FAILURE: Client Finished received after invalid ServerKeyExchange");
1108                 conn->test_failure_reported = 1;
1109         }
1110
1111         if ((conn->test_flags & TLS_DHE_PRIME_15) &&
1112             !conn->test_failure_reported) {
1113                 tlsv1_server_log(conn, "TEST-FAILURE: Client Finished received after bogus DHE \"prime\" 15");
1114                 conn->test_failure_reported = 1;
1115         }
1116
1117         if ((conn->test_flags & TLS_DHE_PRIME_58B) &&
1118             !conn->test_failure_reported) {
1119                 tlsv1_server_log(conn, "TEST-FAILURE: Client Finished received after short 58-bit DHE prime in long container");
1120                 conn->test_failure_reported = 1;
1121         }
1122
1123         if ((conn->test_flags & TLS_DHE_PRIME_511B) &&
1124             !conn->test_failure_reported) {
1125                 tlsv1_server_log(conn, "TEST-WARNING: Client Finished received after short 511-bit DHE prime (insecure)");
1126                 conn->test_failure_reported = 1;
1127         }
1128
1129         if ((conn->test_flags & TLS_DHE_PRIME_767B) &&
1130             !conn->test_failure_reported) {
1131                 tlsv1_server_log(conn, "TEST-NOTE: Client Finished received after 767-bit DHE prime (relatively insecure)");
1132                 conn->test_failure_reported = 1;
1133         }
1134
1135         if ((conn->test_flags & TLS_DHE_NON_PRIME) &&
1136             !conn->test_failure_reported) {
1137                 tlsv1_server_log(conn, "TEST-NOTE: Client Finished received after non-prime claimed as DHE prime");
1138                 conn->test_failure_reported = 1;
1139         }
1140 #endif /* CONFIG_TESTING_OPTIONS */
1141
1142         if (ct != TLS_CONTENT_TYPE_HANDSHAKE) {
1143                 tlsv1_server_log(conn, "Expected Finished; received content type 0x%x",
1144                                  ct);
1145                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
1146                                    TLS_ALERT_UNEXPECTED_MESSAGE);
1147                 return -1;
1148         }
1149
1150         pos = in_data;
1151         left = *in_len;
1152
1153         if (left < 4) {
1154                 tlsv1_server_log(conn, "Too short record (left=%lu) forFinished",
1155                                  (unsigned long) left);
1156                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
1157                                    TLS_ALERT_DECODE_ERROR);
1158                 return -1;
1159         }
1160
1161         if (pos[0] != TLS_HANDSHAKE_TYPE_FINISHED) {
1162                 wpa_printf(MSG_DEBUG, "TLSv1: Expected Finished; received "
1163                            "type 0x%x", pos[0]);
1164                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
1165                                    TLS_ALERT_UNEXPECTED_MESSAGE);
1166                 return -1;
1167         }
1168
1169         len = WPA_GET_BE24(pos + 1);
1170
1171         pos += 4;
1172         left -= 4;
1173
1174         if (len > left) {
1175                 tlsv1_server_log(conn, "Too short buffer for Finished (len=%lu > left=%lu)",
1176                                  (unsigned long) len, (unsigned long) left);
1177                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
1178                                    TLS_ALERT_DECODE_ERROR);
1179                 return -1;
1180         }
1181         end = pos + len;
1182         if (len != TLS_VERIFY_DATA_LEN) {
1183                 tlsv1_server_log(conn, "Unexpected verify_data length in Finished: %lu (expected %d)",
1184                                  (unsigned long) len, TLS_VERIFY_DATA_LEN);
1185                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
1186                                    TLS_ALERT_DECODE_ERROR);
1187                 return -1;
1188         }
1189         wpa_hexdump(MSG_MSGDUMP, "TLSv1: verify_data in Finished",
1190                     pos, TLS_VERIFY_DATA_LEN);
1191
1192 #ifdef CONFIG_TLSV12
1193         if (conn->rl.tls_version >= TLS_VERSION_1_2) {
1194                 hlen = SHA256_MAC_LEN;
1195                 if (conn->verify.sha256_client == NULL ||
1196                     crypto_hash_finish(conn->verify.sha256_client, hash, &hlen)
1197                     < 0) {
1198                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
1199                                            TLS_ALERT_INTERNAL_ERROR);
1200                         conn->verify.sha256_client = NULL;
1201                         return -1;
1202                 }
1203                 conn->verify.sha256_client = NULL;
1204         } else {
1205 #endif /* CONFIG_TLSV12 */
1206
1207         hlen = MD5_MAC_LEN;
1208         if (conn->verify.md5_client == NULL ||
1209             crypto_hash_finish(conn->verify.md5_client, hash, &hlen) < 0) {
1210                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
1211                                    TLS_ALERT_INTERNAL_ERROR);
1212                 conn->verify.md5_client = NULL;
1213                 crypto_hash_finish(conn->verify.sha1_client, NULL, NULL);
1214                 conn->verify.sha1_client = NULL;
1215                 return -1;
1216         }
1217         conn->verify.md5_client = NULL;
1218         hlen = SHA1_MAC_LEN;
1219         if (conn->verify.sha1_client == NULL ||
1220             crypto_hash_finish(conn->verify.sha1_client, hash + MD5_MAC_LEN,
1221                                &hlen) < 0) {
1222                 conn->verify.sha1_client = NULL;
1223                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
1224                                    TLS_ALERT_INTERNAL_ERROR);
1225                 return -1;
1226         }
1227         conn->verify.sha1_client = NULL;
1228         hlen = MD5_MAC_LEN + SHA1_MAC_LEN;
1229
1230 #ifdef CONFIG_TLSV12
1231         }
1232 #endif /* CONFIG_TLSV12 */
1233
1234         if (tls_prf(conn->rl.tls_version,
1235                     conn->master_secret, TLS_MASTER_SECRET_LEN,
1236                     "client finished", hash, hlen,
1237                     verify_data, TLS_VERIFY_DATA_LEN)) {
1238                 wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive verify_data");
1239                 tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
1240                                    TLS_ALERT_DECRYPT_ERROR);
1241                 return -1;
1242         }
1243         wpa_hexdump_key(MSG_DEBUG, "TLSv1: verify_data (client)",
1244                         verify_data, TLS_VERIFY_DATA_LEN);
1245
1246         if (os_memcmp_const(pos, verify_data, TLS_VERIFY_DATA_LEN) != 0) {
1247                 tlsv1_server_log(conn, "Mismatch in verify_data");
1248                 conn->state = FAILED;
1249                 return -1;
1250         }
1251
1252         tlsv1_server_log(conn, "Received Finished");
1253
1254         *in_len = end - in_data;
1255
1256         if (conn->use_session_ticket) {
1257                 /* Abbreviated handshake using session ticket; RFC 4507 */
1258                 tlsv1_server_log(conn, "Abbreviated handshake completed successfully");
1259                 conn->state = ESTABLISHED;
1260         } else {
1261                 /* Full handshake */
1262                 conn->state = SERVER_CHANGE_CIPHER_SPEC;
1263         }
1264
1265         return 0;
1266 }
1267
1268
1269 int tlsv1_server_process_handshake(struct tlsv1_server *conn, u8 ct,
1270                                    const u8 *buf, size_t *len)
1271 {
1272         if (ct == TLS_CONTENT_TYPE_ALERT) {
1273                 if (*len < 2) {
1274                         tlsv1_server_log(conn, "Alert underflow");
1275                         tlsv1_server_alert(conn, TLS_ALERT_LEVEL_FATAL,
1276                                            TLS_ALERT_DECODE_ERROR);
1277                         return -1;
1278                 }
1279                 tlsv1_server_log(conn, "Received alert %d:%d", buf[0], buf[1]);
1280                 *len = 2;
1281                 conn->state = FAILED;
1282                 return -1;
1283         }
1284
1285         switch (conn->state) {
1286         case CLIENT_HELLO:
1287                 if (tls_process_client_hello(conn, ct, buf, len))
1288                         return -1;
1289                 break;
1290         case CLIENT_CERTIFICATE:
1291                 if (tls_process_certificate(conn, ct, buf, len))
1292                         return -1;
1293                 break;
1294         case CLIENT_KEY_EXCHANGE:
1295                 if (tls_process_client_key_exchange(conn, ct, buf, len))
1296                         return -1;
1297                 break;
1298         case CERTIFICATE_VERIFY:
1299                 if (tls_process_certificate_verify(conn, ct, buf, len))
1300                         return -1;
1301                 break;
1302         case CHANGE_CIPHER_SPEC:
1303                 if (tls_process_change_cipher_spec(conn, ct, buf, len))
1304                         return -1;
1305                 break;
1306         case CLIENT_FINISHED:
1307                 if (tls_process_client_finished(conn, ct, buf, len))
1308                         return -1;
1309                 break;
1310         default:
1311                 tlsv1_server_log(conn, "Unexpected state %d while processing received message",
1312                                  conn->state);
1313                 return -1;
1314         }
1315
1316         if (ct == TLS_CONTENT_TYPE_HANDSHAKE)
1317                 tls_verify_hash_add(&conn->verify, buf, *len);
1318
1319         return 0;
1320 }