Commit graph

725 commits

Author SHA1 Message Date
Jouni Malinen
5b97395b3e OpenSSL: crypto_ec_key_get_private_key() using new EVP_PKEY API
Implement crypto_ec_key_get_private_key() without the deprecated EC_KEY
API when using OpenSSL 3.0.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-26 20:51:20 +03:00
Jouni Malinen
177ebfe109 crypto: Convert crypto_ec_key_get_public_key() to return new ec_point
This makes it easier for the crypto library/wrapper to avoid direct
references to internal EC key parameters.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-26 20:51:19 +03:00
Jouni Malinen
26780d92f3 crypto: Convert crypto_ec_key_get_private_key() to return new bignum
This makes it easier for the crypto library/wrapper to avoid direct
references to internal EC key parameters.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-26 20:51:18 +03:00
Jouni Malinen
c9c2c2d9c7 OpenSSL: Fix a memory leak on crypto_hash_init() error path
The EVP_MAC context data needs to be freed on error paths.

Fixes: e31500adea ("OpenSSL: Implement HMAC using the EVP_MAC API")
Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-26 20:51:17 +03:00
Jouni Malinen
6d19dccf94 OpenSSL: Free OSSL_DECODER_CTX in tls_global_dh()
The conversion to the new OpenSSL 3.0 API had forgotten to free the
context structure.

Fixes: bcd299b326 ("OpenSSL: Convert DH/DSA parameter loading to new API")
Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-26 20:51:16 +03:00
Jouni Malinen
4f4479ef9e OpenSSL: crypto_ec_key_parse_{priv,pub}() without EC_KEY API
Avoid using the deprecated EC_KEY API when building these functions with
OpenSSL 3.0.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-26 20:51:15 +03:00
Jouni Malinen
d1652dc7cc OpenSSL: Refuse to accept expired RSA certificate
This is needed for IMSI privacy to avoid trying to use an expired public
key.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-24 00:32:56 +03:00
Jouni Malinen
866e7b7458 OpenSSL: Include rsa.h for OpenSSL 3.0
This is needed to get RSA_PKCS1_OAEP_PADDING.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-22 23:13:28 +03:00
Jouni Malinen
bc99366f9b OpenSSL: Drop security level to 0 with OpenSSL 3.0 when using TLS 1.0/1.1
Commit 9afb68b039 ("OpenSSL: Allow systemwide secpolicy overrides for
TLS version") with commit 58bbcfa31b ("OpenSSL: Update security level
drop for TLS 1.0/1.1 with OpenSSL 3.0") allow this workaround to be
enabled with an explicit network configuration parameter. However, the
default settings are still allowing TLS 1.0 and 1.1 to be negotiated
just to see them fail immediately when using OpenSSL 3.0. This is not
exactly helpful especially when the OpenSSL error message for this
particular case is "internal error" which does not really say anything
about the reason for the error.

It is is a bit inconvenient to update the security policy for this
particular issue based on the negotiated TLS version since that happens
in the middle of processing for the first message from the server.
However, this can be done by using the debug callback for printing out
the received TLS messages during processing.

Drop the OpenSSL security level to 0 if that is the only option to
continue the TLS negotiation, i.e., when TLS 1.0/1.1 are still allowed
in wpa_supplicant default configuration and OpenSSL 3.0 with the
constraint on MD5-SHA1 use.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-22 17:01:35 +03:00
Jouni Malinen
c8e822801d OpenSSL: Fix build with old library versions that do not support TLS 1.3
The OCSP check here is specific to TLS 1.3 and the TLS1_3_VERSION value
is not available in older library versions. Comment this check out from
such cases since it is not applicable with such an old library.

Fixes: 10746875e2 ("OpenSSL: Allow no OCSP response when resuming a session with TLS 1.3")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-05 13:04:13 +03:00
Jouni Malinen
c24e18e5c5 LibreSSL: Fix compilation issue with TLS 1.3 session ticket limit
LibreSSL does not seem have SSL_CTX_set_num_tickets(), so comment out
these not really critical calls when building with that library.

Fixes: 81e2498889 ("OpenSSL: Limit the number of TLS 1.3 session tickets to one")
Fixes: decac7cd1e ("OpenSSL: Do not send out a TLS 1.3 session ticket if caching disabled")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-05 13:03:59 +03:00
Jouni Malinen
eb5e639856 LibreSSL: Fix compilation issue with RSA-OAEP
EVP_PKEY_CTX_set_rsa_oaep_md() does not seem to be available in
LibreSSL, so for now, comment out this functionality whenever building
with that library.

Fixes: 36b11bbcff ("OpenSSL: RSA-OAEP-SHA-256 encryption/decryption")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-05 13:02:12 +03:00
Sunil Ravi
5d56cf1c71 BoringSSL: Fix compilation error due to TLS 1.3 session tickets
SSL_CTX_set_num_tickets() is not available in boringSSL.
So protect the call to SSL_CTX_set_num_tickets() under
!defined(OPENSSL_IS_BORINGSSL) to fix the compilation error.

Fixes: decac7cd1e ("OpenSSL: Do not send out a TLS 1.3 session ticket if caching disabled")
Fixes: 81e2498889 ("OpenSSL: Limit the number of TLS 1.3 session tickets to one")
Signed-off-by: Sunil Ravi <sunilravi@google.com>
2022-05-05 13:01:33 +03:00
Jouni Malinen
a561d12d24 EAP peer status notification for server not supporting RFC 5746
Add a notification message to indicate reason for TLS handshake failure
due to the server not supporting safe renegotiation (RFC 5746).

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-05 00:21:46 +03:00
Jouni Malinen
566ce69a8d EAP peer: Workaround for servers that do not support safe TLS renegotiation
The TLS protocol design for renegotiation was identified to have a
significant security flaw in 2009 and an extension to secure this design
was published in 2010 (RFC 5746). However, some old RADIUS
authentication servers without support for this are still used commonly.

This is obviously not good from the security view point, but since there
are cases where the user of a network service has no realistic means for
getting the authentication server upgraded, TLS handshake may still need
to be allowed to be able to use the network.

OpenSSL 3.0 disabled the client side workaround by default and this
resulted in issues connection to some networks with insecure
authentication servers. With OpenSSL 3.0, the client is now enforcing
security by refusing to authenticate with such servers. The pre-3.0
behavior of ignoring this issue and leaving security to the server can
now be enabled with a new phase1 parameter allow_unsafe_renegotiation=1.
This should be used only when having to connect to a network that has an
insecure authentication server that cannot be upgraded.

The old (pre-2010) TLS renegotiation mechanism might open security
vulnerabilities if the authentication server were to allow TLS
renegotiation to be initiated. While this is unlikely to cause real
issues with EAP-TLS, there might be cases where use of PEAP or TTLS with
an authentication server that does not support RFC 5746 might result in
a security vulnerability.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-05 00:20:19 +03:00
Jouni Malinen
ccb3206b61 Fix tls_connection_set_success_data() in TLS library wrappers
Some of the TLS library wrappers defined only an empty function for
tls_connection_set_success_data(). That could result in memory leaks in
TLS server cases, so update these to do the minimal thing and free the
provided buffer as unused.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-04 00:05:09 +03:00
Jouni Malinen
decac7cd1e OpenSSL: Do not send out a TLS 1.3 session ticket if caching disabled
Do not provide TLS 1.3 session tickets if session caching is disabled.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-02 18:07:50 +03:00
Jouni Malinen
10746875e2 OpenSSL: Allow no OCSP response when resuming a session with TLS 1.3
TLS 1.3 sends the OCSP response with the server Certificate message.
Since that Certificate message is not sent when resuming a session,
there can be no new OCSP response. Allow this since the OCSP response
was validated when checking the initial certificate exchange.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-02 18:07:43 +03:00
Jouni Malinen
81e2498889 OpenSSL: Limit the number of TLS 1.3 session tickets to one
One session ticket is sufficient for EAP-TLS, so do not bother
generating more than a single session ticket.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-02 17:16:39 +03:00
Alexander Clouter
a8d058c939 OpenSSL: SSLKEYLOGFILE capability to allow Wireshark TLS decoding
A port of the trivial patch I wrote for FreeRADIUS to allow TLS decoding
in Wireshark for hostapd/wpa_supplicant:

df0eb0a884

Signed-off-by: Alexander Clouter <alex@coremem.com>
2022-05-01 18:23:59 +03:00
Juliusz Sosinowicz
23f389068e wolfSSL: Fix OCSP stapling
Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2022-05-01 17:27:04 +03:00
Juliusz Sosinowicz
a2971f8d8e wolfSSL: Allow TLS version 1.3 to be disabled
Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2022-05-01 17:26:59 +03:00
Juliusz Sosinowicz
a40e48fbe1 wolfSSL: Fix TLS 1.3 session handling
Uses the changes to wolfSSL found in
https://github.com/wolfSSL/wolfssl/pull/5078

Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2022-05-01 17:26:52 +03:00
Juliusz Sosinowicz
0c3f68f2a0 wolfSSL: Check for the too-short-password error in pbkdf2_sha1()
This may fail with FIPS builds because the FIPS requirement is that the
password must be at least 14 characters.

Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2022-05-01 17:13:34 +03:00
Juliusz Sosinowicz
013cd694d9 wolfSSL: Fixes for FIPS builds
Some API is not available when using FIPS. We need to allocate memory
and initialize the structs directly.

Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2022-05-01 17:04:16 +03:00
Juliusz Sosinowicz
9d5f8168fc wolfSSL: Register a FIPS callback
Register a callback with wolfCrypt_SetCb_fips to inform the user of
errors in the wolfCrypt FIPS module.

Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2022-05-01 17:03:50 +03:00
Juliusz Sosinowicz
8f36e6c0f4 wolfSSL: Implement crypto_ec_key wrappers
These are needed to support SAEK-PK with the wolfSSL backend.

Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2022-05-01 17:01:34 +03:00
Juliusz Sosinowicz
1f7e10177a wolfSSL: Add missing free calls for wolfSSL structs
In some configurations the wc_Init*() functions may either allocate
memory or other system resources. These resources need to be freed.

Co-authored-by: JacobBarthelmeh <jacob@wolfssl.com>
Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2022-05-01 16:35:36 +03:00
Juliusz Sosinowicz
ec1cd91e72 wolfSSL: Support both DER and PEM blobs
Add support for loading private keys and certificates in both PEM and
DER formats with wolfSSL.

Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2022-05-01 16:34:39 +03:00
Jouni Malinen
36b11bbcff OpenSSL: RSA-OAEP-SHA-256 encryption/decryption
Add new crypto wrappers for performing RSA-OAEP-SHA-256 encryption and
decryption. These are needed for IMSI privacy.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-05-01 16:25:06 +03:00
Jouni Malinen
1e34bc49cd OpenSSL: Track SSL_SESSION ex data separately
It looks like the OpenSSL callbacks for SSL_SESSION can end up calling
the remove callback for multiple SSL_SESSION entries that share the same
ex data. This could result in double freeing the session data on the
server side.

Track the SSL_SESSION ex data in a separate list and free the
allocations only if they are pointing to a valid allocated wpabuf
pointer.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-04-27 20:43:41 +03:00
Jouni Malinen
08d7738bb2 wolfSSL: Speed up crypto_ec_point_compute_y_sqr()
Optimize the calculation by computing (x^2 + a) first to get rid of one
separate multiplication by x.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-23 16:12:49 +03:00
Jouni Malinen
f50d5c9a83 wolfSSL: Fix crypto_ec_point_compute_y_sqr() error case processing
The result (y2) was cleared and freed in error cases, but the pointer
itself was not cleared to NULL, so the error path would have returned a
pointer to freed memory. Fix this by properly clearing the return value
in error cases. In addition, simplify the function to avoid tracking
success case separately.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-23 16:04:49 +03:00
赵军涛
7302aa7614 wolfSSL: Fix the memory leak of crypto_ec_point_compute_y_sqr()
Local variable "t" needs to be cleared whether "calced" is 0 or 1.

Signed-off-by: 赵军涛 <d2014zjt@163.com>
2022-04-23 15:55:06 +03:00
Jouni Malinen
e7dd0fff1d wolfSSL: Use wc_HmacInit() to avoid potential use of uninitialized values
wc_HmacSetKey() seems to initialize everything that is needed for the
actual operation, but at least valgrind is reporting use of
uninitialized values when this was done on a data structure that was not
explicitly cleared.

Call wc_HmacInit() before wc_HmacSetKey() to avoid any unexpected
behavior from potentially uninitialized values.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-23 15:45:31 +03:00
Jouni Malinen
f7be558d69 OpenSSL: Fix build with BoringSSL
SSL_CTX_set_dh_auto() is not available in BoringSSL even though it
claims to be based on OpenSSL 1.1.1 in OPENSSL_VERSION_NUMBER.

Fixes: ebb3055e13 ("OpenSSL: Generate DH parameters automatically if not set with dh_file")
Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-23 13:05:49 +03:00
Jouni Malinen
6d33ef362e OpenSSL: Remove compatibility options for older versions than 1.0.2
Anything older than OpenSSL 1.0.2 should not be used anymore, so drop
the build compatibility options for those old versions.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-23 13:02:37 +03:00
Jouni Malinen
78c2a4cd07 OpenSSL: Drop compatibility options for LibreSSL older than 2.7
Compilation was failing even with LibreSSL 2.7 versions, so there is no
point in maintaining these old compatibility options for older versions.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-23 12:52:27 +03:00
Jouni Malinen
b062507670 OpenSSL: Implement crypto_ecdh routines without EC_KEY for OpenSSL 3.0
OpenSSL 3.0 has deprecated the low-level EC_KEY functionality, so use
the EVP API (EVP_EC_gen() and EV_PKEY_derive()) for the crypto_ecdh
wrappers.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-23 12:46:17 +03:00
Jouni Malinen
fc96f6802e OpenSSL: Use new name for the EC_POINT set/get coordinate functions
OpenSSL 1.1.1 deprecated the function names with the _GFp postfix, so
move to the new function name. Add backwards compatibility wrappers for
older versions.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-23 11:09:28 +03:00
Jouni Malinen
0d9be88551 wolfSSL: Fix certificate commonName checking
wolfSSL_X509_NAME_get_index_by_NID() uses NID_* to identify the entry.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-18 16:45:42 +03:00
Jouni Malinen
94e0f39d97 wolfSSL: Use wolfSSL_export_keying_material() when available
This is needed to work with TLS 1.3 key derivation. It looks the needed
functionality was added in wolfSSL 4.7.0.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-18 16:27:47 +03:00
Jouni Malinen
c31fc7a64c wolfSSL: Fix crypto_dh_init() and dh5_init()
priv_sz and pub_sz needs to be initialized to the buffer size before the
wc_DhGenerateKeyPair() call. The previous version happened to work in
some cases where a separate handled prime length was used, but not for
the generic case.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-18 11:03:55 +03:00
Jouni Malinen
d7b8c6eef2 wolfSSL: Fix crypto_ecdh_* with ECC_TIMING_RESISTANT
It looks like crypto_ecdh_set_peerkey() had started failing at some
point with a wolfSSL update due to ECC_TIMING_RESISTANT from
--enable-harden requiring RNG to be set.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-04-18 00:54:37 +03:00
Juliusz Sosinowicz
166acab4e6 wolfSSL: TLS session caching
Add support for EAP server to cache TLS sessions (see hostapd
configuration parameter tls_session_lifetime).

Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2022-04-17 22:02:55 +03:00
Juliusz Sosinowicz
12dee16d71 wolfSSL: Add a debug logging callback
Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2022-04-17 22:02:55 +03:00
Juliusz Sosinowicz
a5d190650b wolfSSL: Implement tls_get_tls_unique()
This is needed for EAP-TEAP. This needs wolfSSL 5.0.0 or newer.

Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2022-04-17 22:02:50 +03:00
Juliusz Sosinowicz
a419fef367 wolfSSL: Implement tls_connection_get_cipher_suite()
This is needed for EAP-TEAP.

Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2022-04-17 22:02:41 +03:00
Juliusz Sosinowicz
364876b7da wolfSSL: Implement tls_connection_get_peer_subject()
This is needed for EAP-TEAP server implementation.

Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2022-04-17 22:02:36 +03:00
Juliusz Sosinowicz
d9c7164001 wolfSSL: Implement tls_connection_get_own_cert_used()
This is needed for EAP-TEAP client implementation. This needs wolfSSL
5.0.0 or newer.

Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2022-04-17 22:02:28 +03:00