2 * WPA Supplicant / EAP-TLS (RFC 2716)
3 * Copyright (c) 2004-2005, Jouni Malinen <jkmaline@cc.hut.fi>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Alternatively, this software may be distributed under the terms of BSD
12 * See README and COPYING for more details.
21 #include "eap_tls_common.h"
22 #include "wpa_supplicant.h"
23 #include "config_ssid.h"
27 static void eap_tls_deinit(struct eap_sm *sm, void *priv);
31 struct eap_ssl_data ssl;
36 static void * eap_tls_init(struct eap_sm *sm)
38 struct eap_tls_data *data;
39 struct wpa_ssid *config = eap_get_config(sm);
41 ((sm->init_phase2 ? config->private_key2 : config->private_key)
42 == NULL && config->engine == 0)) {
43 wpa_printf(MSG_INFO, "EAP-TLS: Private key not configured");
47 data = malloc(sizeof(*data));
50 memset(data, 0, sizeof(*data));
52 if (eap_tls_ssl_init(sm, &data->ssl, config)) {
53 wpa_printf(MSG_INFO, "EAP-TLS: Failed to initialize SSL.");
54 eap_tls_deinit(sm, data);
56 wpa_printf(MSG_DEBUG, "EAP-TLS: Requesting Smartcard "
58 eap_sm_request_pin(sm, config);
60 } else if (config->private_key && !config->private_key_passwd)
62 wpa_printf(MSG_DEBUG, "EAP-TLS: Requesting private "
64 eap_sm_request_passphrase(sm, config);
74 static void eap_tls_deinit(struct eap_sm *sm, void *priv)
76 struct eap_tls_data *data = priv;
79 eap_tls_ssl_deinit(sm, &data->ssl);
85 static u8 * eap_tls_process(struct eap_sm *sm, void *priv,
86 struct eap_method_ret *ret,
87 const u8 *reqData, size_t reqDataLen,
90 struct wpa_ssid *config = eap_get_config(sm);
91 const struct eap_hdr *req;
96 struct eap_tls_data *data = priv;
98 pos = eap_tls_process_init(sm, &data->ssl, EAP_TYPE_TLS, ret,
99 reqData, reqDataLen, &left, &flags);
102 req = (const struct eap_hdr *) reqData;
103 id = req->identifier;
105 if (flags & EAP_TLS_FLAGS_START) {
106 wpa_printf(MSG_DEBUG, "EAP-TLS: Start");
107 left = 0; /* make sure that this frame is empty, even though it
108 * should always be, anyway */
112 res = eap_tls_process_helper(sm, &data->ssl, EAP_TYPE_TLS, 0, id, pos,
113 left, &resp, respDataLen);
116 wpa_printf(MSG_DEBUG, "EAP-TLS: TLS processing failed");
117 ret->methodState = METHOD_MAY_CONT;
118 ret->decision = DECISION_FAIL;
122 * The TLS handshake failed. So better forget the old
123 * PIN. It may be wrong, we can't be sure but trying
124 * the wrong one again might block it on the card - so
125 * better ask the user again.
132 /* This is likely an alert message, so send it instead
133 * of just ACKing the error. */
136 return eap_tls_build_ack(&data->ssl, respDataLen, id,
140 if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) {
141 wpa_printf(MSG_DEBUG, "EAP-TLS: Done");
142 ret->methodState = METHOD_DONE;
143 ret->decision = DECISION_UNCOND_SUCC;
144 free(data->key_data);
145 data->key_data = eap_tls_derive_key(sm, &data->ssl,
146 "client EAP encryption",
148 if (data->key_data) {
149 wpa_hexdump_key(MSG_DEBUG, "EAP-TLS: Derived key",
150 data->key_data, EAP_TLS_KEY_LEN);
152 wpa_printf(MSG_DEBUG, "EAP-TLS: Failed to derive key");
157 return eap_tls_build_ack(&data->ssl, respDataLen, id,
165 static Boolean eap_tls_has_reauth_data(struct eap_sm *sm, void *priv)
167 struct eap_tls_data *data = priv;
168 return tls_connection_established(sm->ssl_ctx, data->ssl.conn);
172 static void eap_tls_deinit_for_reauth(struct eap_sm *sm, void *priv)
177 static void * eap_tls_init_for_reauth(struct eap_sm *sm, void *priv)
179 struct eap_tls_data *data = priv;
180 free(data->key_data);
181 data->key_data = NULL;
182 if (eap_tls_reauth_init(sm, &data->ssl)) {
190 static int eap_tls_get_status(struct eap_sm *sm, void *priv, char *buf,
191 size_t buflen, int verbose)
193 struct eap_tls_data *data = priv;
194 return eap_tls_status(sm, &data->ssl, buf, buflen, verbose);
198 static Boolean eap_tls_isKeyAvailable(struct eap_sm *sm, void *priv)
200 struct eap_tls_data *data = priv;
201 return data->key_data != NULL;
205 static u8 * eap_tls_getKey(struct eap_sm *sm, void *priv, size_t *len)
207 struct eap_tls_data *data = priv;
210 if (data->key_data == NULL)
213 key = malloc(EAP_TLS_KEY_LEN);
217 *len = EAP_TLS_KEY_LEN;
218 memcpy(key, data->key_data, EAP_TLS_KEY_LEN);
224 const struct eap_method eap_method_tls =
226 .method = EAP_TYPE_TLS,
228 .init = eap_tls_init,
229 .deinit = eap_tls_deinit,
230 .process = eap_tls_process,
231 .isKeyAvailable = eap_tls_isKeyAvailable,
232 .getKey = eap_tls_getKey,
233 .get_status = eap_tls_get_status,
234 .has_reauth_data = eap_tls_has_reauth_data,
235 .deinit_for_reauth = eap_tls_deinit_for_reauth,
236 .init_for_reauth = eap_tls_init_for_reauth,