2 * TLSv1 client - write handshake message
3 * Copyright (c) 2006-2007, Jouni Malinen <j@w1.fi>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Alternatively, this software may be distributed under the terms of BSD
12 * See README and COPYING for more details.
18 #include "crypto/md5.h"
19 #include "crypto/sha1.h"
20 #include "crypto/tls.h"
22 #include "tlsv1_common.h"
23 #include "tlsv1_record.h"
24 #include "tlsv1_client.h"
25 #include "tlsv1_client_i.h"
28 static size_t tls_client_cert_chain_der_len(struct tlsv1_client *conn)
31 struct x509_certificate *cert;
33 if (conn->cred == NULL)
36 cert = conn->cred->cert;
38 len += 3 + cert->cert_len;
39 if (x509_certificate_self_signed(cert))
41 cert = x509_certificate_get_subject(conn->cred->trusted_certs,
49 u8 * tls_send_client_hello(struct tlsv1_client *conn, size_t *out_len)
51 u8 *hello, *end, *pos, *hs_length, *hs_start, *rhdr;
55 wpa_printf(MSG_DEBUG, "TLSv1: Send ClientHello");
59 WPA_PUT_BE32(conn->client_random, now.sec);
60 if (os_get_random(conn->client_random + 4, TLS_RANDOM_LEN - 4)) {
61 wpa_printf(MSG_ERROR, "TLSv1: Could not generate "
65 wpa_hexdump(MSG_MSGDUMP, "TLSv1: client_random",
66 conn->client_random, TLS_RANDOM_LEN);
68 len = 100 + conn->num_cipher_suites * 2 + conn->client_hello_ext_len;
69 hello = os_malloc(len);
75 pos = rhdr + TLS_RECORD_HEADER_LEN;
77 /* opaque fragment[TLSPlaintext.length] */
81 /* HandshakeType msg_type */
82 *pos++ = TLS_HANDSHAKE_TYPE_CLIENT_HELLO;
83 /* uint24 length (to be filled) */
86 /* body - ClientHello */
87 /* ProtocolVersion client_version */
88 WPA_PUT_BE16(pos, TLS_VERSION);
90 /* Random random: uint32 gmt_unix_time, opaque random_bytes */
91 os_memcpy(pos, conn->client_random, TLS_RANDOM_LEN);
92 pos += TLS_RANDOM_LEN;
93 /* SessionID session_id */
94 *pos++ = conn->session_id_len;
95 os_memcpy(pos, conn->session_id, conn->session_id_len);
96 pos += conn->session_id_len;
97 /* CipherSuite cipher_suites<2..2^16-1> */
98 WPA_PUT_BE16(pos, 2 * conn->num_cipher_suites);
100 for (i = 0; i < conn->num_cipher_suites; i++) {
101 WPA_PUT_BE16(pos, conn->cipher_suites[i]);
104 /* CompressionMethod compression_methods<1..2^8-1> */
106 *pos++ = TLS_COMPRESSION_NULL;
108 if (conn->client_hello_ext) {
109 os_memcpy(pos, conn->client_hello_ext,
110 conn->client_hello_ext_len);
111 pos += conn->client_hello_ext_len;
114 WPA_PUT_BE24(hs_length, pos - hs_length - 3);
115 tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
117 if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
118 rhdr, end - rhdr, pos - hs_start, out_len) < 0) {
119 wpa_printf(MSG_DEBUG, "TLSv1: Failed to create TLS record");
120 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
121 TLS_ALERT_INTERNAL_ERROR);
126 conn->state = SERVER_HELLO;
132 static int tls_write_client_certificate(struct tlsv1_client *conn,
133 u8 **msgpos, u8 *end)
135 u8 *pos, *rhdr, *hs_start, *hs_length, *cert_start;
137 struct x509_certificate *cert;
141 wpa_printf(MSG_DEBUG, "TLSv1: Send Certificate");
143 pos += TLS_RECORD_HEADER_LEN;
145 /* opaque fragment[TLSPlaintext.length] */
149 /* HandshakeType msg_type */
150 *pos++ = TLS_HANDSHAKE_TYPE_CERTIFICATE;
151 /* uint24 length (to be filled) */
154 /* body - Certificate */
155 /* uint24 length (to be filled) */
158 cert = conn->cred ? conn->cred->cert : NULL;
160 if (pos + 3 + cert->cert_len > end) {
161 wpa_printf(MSG_DEBUG, "TLSv1: Not enough buffer space "
162 "for Certificate (cert_len=%lu left=%lu)",
163 (unsigned long) cert->cert_len,
164 (unsigned long) (end - pos));
165 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
166 TLS_ALERT_INTERNAL_ERROR);
169 WPA_PUT_BE24(pos, cert->cert_len);
171 os_memcpy(pos, cert->cert_start, cert->cert_len);
172 pos += cert->cert_len;
174 if (x509_certificate_self_signed(cert))
176 cert = x509_certificate_get_subject(conn->cred->trusted_certs,
179 if (conn->cred == NULL || cert == conn->cred->cert || cert == NULL) {
181 * Client was not configured with all the needed certificates
182 * to form a full certificate chain. The server may fail to
183 * validate the chain unless it is configured with all the
184 * missing CA certificates.
186 wpa_printf(MSG_DEBUG, "TLSv1: Full client certificate chain "
187 "not configured - validation may fail");
189 WPA_PUT_BE24(cert_start, pos - cert_start - 3);
191 WPA_PUT_BE24(hs_length, pos - hs_length - 3);
193 if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
194 rhdr, end - rhdr, pos - hs_start, &rlen) < 0) {
195 wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate a record");
196 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
197 TLS_ALERT_INTERNAL_ERROR);
202 tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
210 static int tlsv1_key_x_anon_dh(struct tlsv1_client *conn, u8 **pos, u8 *end)
212 /* ClientDiffieHellmanPublic */
213 u8 *csecret, *csecret_start, *dh_yc, *shared;
214 size_t csecret_len, dh_yc_len, shared_len;
216 csecret_len = conn->dh_p_len;
217 csecret = os_malloc(csecret_len);
218 if (csecret == NULL) {
219 wpa_printf(MSG_DEBUG, "TLSv1: Failed to allocate "
220 "memory for Yc (Diffie-Hellman)");
221 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
222 TLS_ALERT_INTERNAL_ERROR);
225 if (os_get_random(csecret, csecret_len)) {
226 wpa_printf(MSG_DEBUG, "TLSv1: Failed to get random "
227 "data for Diffie-Hellman");
228 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
229 TLS_ALERT_INTERNAL_ERROR);
234 if (os_memcmp(csecret, conn->dh_p, csecret_len) > 0)
235 csecret[0] = 0; /* make sure Yc < p */
237 csecret_start = csecret;
238 while (csecret_len > 1 && *csecret_start == 0) {
242 wpa_hexdump_key(MSG_DEBUG, "TLSv1: DH client's secret value",
243 csecret_start, csecret_len);
245 /* Yc = g^csecret mod p */
246 dh_yc_len = conn->dh_p_len;
247 dh_yc = os_malloc(dh_yc_len);
249 wpa_printf(MSG_DEBUG, "TLSv1: Failed to allocate "
250 "memory for Diffie-Hellman");
251 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
252 TLS_ALERT_INTERNAL_ERROR);
256 if (crypto_mod_exp(conn->dh_g, conn->dh_g_len,
257 csecret_start, csecret_len,
258 conn->dh_p, conn->dh_p_len,
259 dh_yc, &dh_yc_len)) {
260 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
261 TLS_ALERT_INTERNAL_ERROR);
267 wpa_hexdump(MSG_DEBUG, "TLSv1: DH Yc (client's public value)",
270 WPA_PUT_BE16(*pos, dh_yc_len);
272 if (*pos + dh_yc_len > end) {
273 wpa_printf(MSG_DEBUG, "TLSv1: Not enough room in the "
274 "message buffer for Yc");
275 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
276 TLS_ALERT_INTERNAL_ERROR);
281 os_memcpy(*pos, dh_yc, dh_yc_len);
285 shared_len = conn->dh_p_len;
286 shared = os_malloc(shared_len);
287 if (shared == NULL) {
288 wpa_printf(MSG_DEBUG, "TLSv1: Could not allocate memory for "
290 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
291 TLS_ALERT_INTERNAL_ERROR);
296 /* shared = Ys^csecret mod p */
297 if (crypto_mod_exp(conn->dh_ys, conn->dh_ys_len,
298 csecret_start, csecret_len,
299 conn->dh_p, conn->dh_p_len,
300 shared, &shared_len)) {
301 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
302 TLS_ALERT_INTERNAL_ERROR);
307 wpa_hexdump_key(MSG_DEBUG, "TLSv1: Shared secret from DH key exchange",
310 os_memset(csecret_start, 0, csecret_len);
312 if (tls_derive_keys(conn, shared, shared_len)) {
313 wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive keys");
314 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
315 TLS_ALERT_INTERNAL_ERROR);
319 os_memset(shared, 0, shared_len);
321 tlsv1_client_free_dh(conn);
326 static int tlsv1_key_x_rsa(struct tlsv1_client *conn, u8 **pos, u8 *end)
328 u8 pre_master_secret[TLS_PRE_MASTER_SECRET_LEN];
332 if (tls_derive_pre_master_secret(pre_master_secret) < 0 ||
333 tls_derive_keys(conn, pre_master_secret,
334 TLS_PRE_MASTER_SECRET_LEN)) {
335 wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive keys");
336 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
337 TLS_ALERT_INTERNAL_ERROR);
341 /* EncryptedPreMasterSecret */
342 if (conn->server_rsa_key == NULL) {
343 wpa_printf(MSG_DEBUG, "TLSv1: No server RSA key to "
344 "use for encrypting pre-master secret");
345 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
346 TLS_ALERT_INTERNAL_ERROR);
350 /* RSA encrypted value is encoded with PKCS #1 v1.5 block type 2. */
353 res = crypto_public_key_encrypt_pkcs1_v15(
354 conn->server_rsa_key,
355 pre_master_secret, TLS_PRE_MASTER_SECRET_LEN,
357 os_memset(pre_master_secret, 0, TLS_PRE_MASTER_SECRET_LEN);
359 wpa_printf(MSG_DEBUG, "TLSv1: RSA encryption failed");
360 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
361 TLS_ALERT_INTERNAL_ERROR);
364 WPA_PUT_BE16(*pos - 2, clen);
365 wpa_hexdump(MSG_MSGDUMP, "TLSv1: Encrypted pre_master_secret",
373 static int tls_write_client_key_exchange(struct tlsv1_client *conn,
374 u8 **msgpos, u8 *end)
376 u8 *pos, *rhdr, *hs_start, *hs_length;
378 tls_key_exchange keyx;
379 const struct tls_cipher_suite *suite;
381 suite = tls_get_cipher_suite(conn->rl.cipher_suite);
383 keyx = TLS_KEY_X_NULL;
385 keyx = suite->key_exchange;
389 wpa_printf(MSG_DEBUG, "TLSv1: Send ClientKeyExchange");
392 pos += TLS_RECORD_HEADER_LEN;
394 /* opaque fragment[TLSPlaintext.length] */
398 /* HandshakeType msg_type */
399 *pos++ = TLS_HANDSHAKE_TYPE_CLIENT_KEY_EXCHANGE;
400 /* uint24 length (to be filled) */
403 /* body - ClientKeyExchange */
404 if (keyx == TLS_KEY_X_DH_anon) {
405 if (tlsv1_key_x_anon_dh(conn, &pos, end) < 0)
408 if (tlsv1_key_x_rsa(conn, &pos, end) < 0)
412 WPA_PUT_BE24(hs_length, pos - hs_length - 3);
414 if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
415 rhdr, end - rhdr, pos - hs_start, &rlen) < 0) {
416 wpa_printf(MSG_DEBUG, "TLSv1: Failed to create a record");
417 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
418 TLS_ALERT_INTERNAL_ERROR);
422 tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
430 static int tls_write_client_certificate_verify(struct tlsv1_client *conn,
431 u8 **msgpos, u8 *end)
433 u8 *pos, *rhdr, *hs_start, *hs_length, *signed_start;
434 size_t rlen, hlen, clen;
435 u8 hash[MD5_MAC_LEN + SHA1_MAC_LEN], *hpos;
436 enum { SIGN_ALG_RSA, SIGN_ALG_DSA } alg = SIGN_ALG_RSA;
440 wpa_printf(MSG_DEBUG, "TLSv1: Send CertificateVerify");
442 pos += TLS_RECORD_HEADER_LEN;
446 /* HandshakeType msg_type */
447 *pos++ = TLS_HANDSHAKE_TYPE_CERTIFICATE_VERIFY;
448 /* uint24 length (to be filled) */
453 * RFC 2246: 7.4.3 and 7.4.8:
454 * Signature signature
457 * digitally-signed struct {
458 * opaque md5_hash[16];
459 * opaque sha_hash[20];
463 * digitally-signed struct {
464 * opaque sha_hash[20];
467 * The hash values are calculated over all handshake messages sent or
468 * received starting at ClientHello up to, but not including, this
469 * CertificateVerify message, including the type and length fields of
470 * the handshake messages.
475 if (alg == SIGN_ALG_RSA) {
477 if (conn->verify.md5_cert == NULL ||
478 crypto_hash_finish(conn->verify.md5_cert, hpos, &hlen) < 0)
480 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
481 TLS_ALERT_INTERNAL_ERROR);
482 conn->verify.md5_cert = NULL;
483 crypto_hash_finish(conn->verify.sha1_cert, NULL, NULL);
484 conn->verify.sha1_cert = NULL;
489 crypto_hash_finish(conn->verify.md5_cert, NULL, NULL);
491 conn->verify.md5_cert = NULL;
493 if (conn->verify.sha1_cert == NULL ||
494 crypto_hash_finish(conn->verify.sha1_cert, hpos, &hlen) < 0) {
495 conn->verify.sha1_cert = NULL;
496 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
497 TLS_ALERT_INTERNAL_ERROR);
500 conn->verify.sha1_cert = NULL;
502 if (alg == SIGN_ALG_RSA)
505 wpa_hexdump(MSG_MSGDUMP, "TLSv1: CertificateVerify hash", hash, hlen);
509 * In digital signing, one-way hash functions are used as input for a
510 * signing algorithm. A digitally-signed element is encoded as an
511 * opaque vector <0..2^16-1>, where the length is specified by the
512 * signing algorithm and key.
514 * In RSA signing, a 36-byte structure of two hashes (one SHA and one
515 * MD5) is signed (encrypted with the private key). It is encoded with
516 * PKCS #1 block type 0 or type 1 as described in [PKCS1].
518 signed_start = pos; /* length to be filled */
521 if (conn->cred == NULL ||
522 crypto_private_key_sign_pkcs1(conn->cred->key, hash, hlen,
524 wpa_printf(MSG_DEBUG, "TLSv1: Failed to sign hash (PKCS #1)");
525 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
526 TLS_ALERT_INTERNAL_ERROR);
529 WPA_PUT_BE16(signed_start, clen);
533 WPA_PUT_BE24(hs_length, pos - hs_length - 3);
535 if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
536 rhdr, end - rhdr, pos - hs_start, &rlen) < 0) {
537 wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate a record");
538 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
539 TLS_ALERT_INTERNAL_ERROR);
544 tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
552 static int tls_write_client_change_cipher_spec(struct tlsv1_client *conn,
553 u8 **msgpos, u8 *end)
560 wpa_printf(MSG_DEBUG, "TLSv1: Send ChangeCipherSpec");
562 pos += TLS_RECORD_HEADER_LEN;
563 *pos = TLS_CHANGE_CIPHER_SPEC;
564 if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_CHANGE_CIPHER_SPEC,
565 rhdr, end - rhdr, 1, &rlen) < 0) {
566 wpa_printf(MSG_DEBUG, "TLSv1: Failed to create a record");
567 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
568 TLS_ALERT_INTERNAL_ERROR);
572 if (tlsv1_record_change_write_cipher(&conn->rl) < 0) {
573 wpa_printf(MSG_DEBUG, "TLSv1: Failed to set write cipher for "
575 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
576 TLS_ALERT_INTERNAL_ERROR);
580 *msgpos = rhdr + rlen;
586 static int tls_write_client_finished(struct tlsv1_client *conn,
587 u8 **msgpos, u8 *end)
589 u8 *pos, *rhdr, *hs_start, *hs_length;
591 u8 verify_data[TLS_VERIFY_DATA_LEN];
592 u8 hash[MD5_MAC_LEN + SHA1_MAC_LEN];
596 wpa_printf(MSG_DEBUG, "TLSv1: Send Finished");
598 /* Encrypted Handshake Message: Finished */
601 if (conn->verify.md5_client == NULL ||
602 crypto_hash_finish(conn->verify.md5_client, hash, &hlen) < 0) {
603 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
604 TLS_ALERT_INTERNAL_ERROR);
605 conn->verify.md5_client = NULL;
606 crypto_hash_finish(conn->verify.sha1_client, NULL, NULL);
607 conn->verify.sha1_client = NULL;
610 conn->verify.md5_client = NULL;
612 if (conn->verify.sha1_client == NULL ||
613 crypto_hash_finish(conn->verify.sha1_client, hash + MD5_MAC_LEN,
615 conn->verify.sha1_client = NULL;
616 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
617 TLS_ALERT_INTERNAL_ERROR);
620 conn->verify.sha1_client = NULL;
622 if (tls_prf(conn->master_secret, TLS_MASTER_SECRET_LEN,
623 "client finished", hash, MD5_MAC_LEN + SHA1_MAC_LEN,
624 verify_data, TLS_VERIFY_DATA_LEN)) {
625 wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate verify_data");
626 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
627 TLS_ALERT_INTERNAL_ERROR);
630 wpa_hexdump_key(MSG_DEBUG, "TLSv1: verify_data (client)",
631 verify_data, TLS_VERIFY_DATA_LEN);
634 pos += TLS_RECORD_HEADER_LEN;
637 /* HandshakeType msg_type */
638 *pos++ = TLS_HANDSHAKE_TYPE_FINISHED;
639 /* uint24 length (to be filled) */
642 os_memcpy(pos, verify_data, TLS_VERIFY_DATA_LEN);
643 pos += TLS_VERIFY_DATA_LEN;
644 WPA_PUT_BE24(hs_length, pos - hs_length - 3);
645 tls_verify_hash_add(&conn->verify, hs_start, pos - hs_start);
647 if (tlsv1_record_send(&conn->rl, TLS_CONTENT_TYPE_HANDSHAKE,
648 rhdr, end - rhdr, pos - hs_start, &rlen) < 0) {
649 wpa_printf(MSG_DEBUG, "TLSv1: Failed to create a record");
650 tls_alert(conn, TLS_ALERT_LEVEL_FATAL,
651 TLS_ALERT_INTERNAL_ERROR);
663 static u8 * tls_send_client_key_exchange(struct tlsv1_client *conn,
672 if (conn->certificate_requested)
673 msglen += tls_client_cert_chain_der_len(conn);
675 msg = os_malloc(msglen);
682 if (conn->certificate_requested) {
683 if (tls_write_client_certificate(conn, &pos, end) < 0) {
689 if (tls_write_client_key_exchange(conn, &pos, end) < 0 ||
690 (conn->certificate_requested && conn->cred && conn->cred->key &&
691 tls_write_client_certificate_verify(conn, &pos, end) < 0) ||
692 tls_write_client_change_cipher_spec(conn, &pos, end) < 0 ||
693 tls_write_client_finished(conn, &pos, end) < 0) {
698 *out_len = pos - msg;
700 conn->state = SERVER_CHANGE_CIPHER_SPEC;
706 static u8 * tls_send_change_cipher_spec(struct tlsv1_client *conn,
713 msg = os_malloc(1000);
720 if (tls_write_client_change_cipher_spec(conn, &pos, end) < 0 ||
721 tls_write_client_finished(conn, &pos, end) < 0) {
726 *out_len = pos - msg;
728 wpa_printf(MSG_DEBUG, "TLSv1: Session resumption completed "
730 conn->state = ESTABLISHED;
736 u8 * tlsv1_client_handshake_write(struct tlsv1_client *conn, size_t *out_len,
739 switch (conn->state) {
740 case CLIENT_KEY_EXCHANGE:
741 return tls_send_client_key_exchange(conn, out_len);
742 case CHANGE_CIPHER_SPEC:
743 return tls_send_change_cipher_spec(conn, out_len);
745 wpa_printf(MSG_DEBUG, "TLSv1: Handshake completed "
747 conn->state = ESTABLISHED;
750 /* Need to return something to get final TLS ACK. */
755 wpa_printf(MSG_DEBUG, "TLSv1: Unexpected state %d while "
756 "generating reply", conn->state);
762 u8 * tlsv1_client_send_alert(struct tlsv1_client *conn, u8 level,
763 u8 description, size_t *out_len)
765 u8 *alert, *pos, *length;
767 wpa_printf(MSG_DEBUG, "TLSv1: Send Alert(%d:%d)", level, description);
770 alert = os_malloc(10);
777 /* ContentType type */
778 *pos++ = TLS_CONTENT_TYPE_ALERT;
779 /* ProtocolVersion version */
780 WPA_PUT_BE16(pos, TLS_VERSION);
782 /* uint16 length (to be filled) */
785 /* opaque fragment[TLSPlaintext.length] */
788 /* AlertLevel level */
790 /* AlertDescription description */
791 *pos++ = description;
793 WPA_PUT_BE16(length, pos - length - 2);
794 *out_len = pos - alert;