src/tls/tlsv1_common.c - LeafOS-Project/android_external_wpa_supplicant_8 - Gitiles

 /*
  * TLSv1 common routines
  * Copyright (c) 2006-2014, Jouni Malinen <j@w1.fi>
  *
  * This software may be distributed under the terms of the BSD license.
  * See README for more details.
  */

 #include "includes.h"

 #include "common.h"
 #include "crypto/md5.h"
 #include "crypto/sha1.h"
 #include "crypto/sha256.h"
 #include "x509v3.h"
 #include "tlsv1_common.h"


 /*
  * TODO:
  * RFC 2246 Section 9: Mandatory to implement TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
  * Add support for commonly used cipher suites; don't bother with exportable
  * suites.
  */

 static const struct tls_cipher_suite tls_cipher_suites[] = {
 	{ TLS_NULL_WITH_NULL_NULL, TLS_KEY_X_NULL, TLS_CIPHER_NULL,
 	  TLS_HASH_NULL },
 	{ TLS_RSA_WITH_RC4_128_MD5, TLS_KEY_X_RSA, TLS_CIPHER_RC4_128,
 	  TLS_HASH_MD5 },
 	{ TLS_RSA_WITH_RC4_128_SHA, TLS_KEY_X_RSA, TLS_CIPHER_RC4_128,
 	  TLS_HASH_SHA },
 	{ TLS_RSA_WITH_DES_CBC_SHA, TLS_KEY_X_RSA, TLS_CIPHER_DES_CBC,
 	  TLS_HASH_SHA },
 	{ TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_KEY_X_RSA,
 	  TLS_CIPHER_3DES_EDE_CBC, TLS_HASH_SHA },
 	{ TLS_DHE_RSA_WITH_DES_CBC_SHA, TLS_KEY_X_DHE_RSA, TLS_CIPHER_DES_CBC,
 	  TLS_HASH_SHA},
 	{ TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_KEY_X_DHE_RSA,
 	  TLS_CIPHER_3DES_EDE_CBC, TLS_HASH_SHA },
  	{ TLS_DH_anon_WITH_RC4_128_MD5, TLS_KEY_X_DH_anon,
 	  TLS_CIPHER_RC4_128, TLS_HASH_MD5 },
  	{ TLS_DH_anon_WITH_DES_CBC_SHA, TLS_KEY_X_DH_anon,
 	  TLS_CIPHER_DES_CBC, TLS_HASH_SHA },
  	{ TLS_DH_anon_WITH_3DES_EDE_CBC_SHA, TLS_KEY_X_DH_anon,
 	  TLS_CIPHER_3DES_EDE_CBC, TLS_HASH_SHA },
 	{ TLS_RSA_WITH_AES_128_CBC_SHA, TLS_KEY_X_RSA, TLS_CIPHER_AES_128_CBC,
 	  TLS_HASH_SHA },
 	{ TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_KEY_X_DHE_RSA,
 	  TLS_CIPHER_AES_128_CBC, TLS_HASH_SHA },
 	{ TLS_DH_anon_WITH_AES_128_CBC_SHA, TLS_KEY_X_DH_anon,
 	  TLS_CIPHER_AES_128_CBC, TLS_HASH_SHA },
 	{ TLS_RSA_WITH_AES_256_CBC_SHA, TLS_KEY_X_RSA, TLS_CIPHER_AES_256_CBC,
 	  TLS_HASH_SHA },
 	{ TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_KEY_X_DHE_RSA,
 	  TLS_CIPHER_AES_256_CBC, TLS_HASH_SHA },
 	{ TLS_DH_anon_WITH_AES_256_CBC_SHA, TLS_KEY_X_DH_anon,
 	  TLS_CIPHER_AES_256_CBC, TLS_HASH_SHA },
 	{ TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_KEY_X_RSA,
 	  TLS_CIPHER_AES_128_CBC, TLS_HASH_SHA256 },
 	{ TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_KEY_X_RSA,
 	  TLS_CIPHER_AES_256_CBC, TLS_HASH_SHA256 },
 	{ TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_KEY_X_DHE_RSA,
 	  TLS_CIPHER_AES_128_CBC, TLS_HASH_SHA256 },
 	{ TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_KEY_X_DHE_RSA,
 	  TLS_CIPHER_AES_256_CBC, TLS_HASH_SHA256 },
 	{ TLS_DH_anon_WITH_AES_128_CBC_SHA256, TLS_KEY_X_DH_anon,
 	  TLS_CIPHER_AES_128_CBC, TLS_HASH_SHA256 },
 	{ TLS_DH_anon_WITH_AES_256_CBC_SHA256, TLS_KEY_X_DH_anon,
 	  TLS_CIPHER_AES_256_CBC, TLS_HASH_SHA256 }
 };

 #define NUM_TLS_CIPHER_SUITES ARRAY_SIZE(tls_cipher_suites)


 static const struct tls_cipher_data tls_ciphers[] = {
 	{ TLS_CIPHER_NULL,         TLS_CIPHER_STREAM,  0,  0,  0,
 	  CRYPTO_CIPHER_NULL },
 	{ TLS_CIPHER_IDEA_CBC,     TLS_CIPHER_BLOCK,  16, 16,  8,
 	  CRYPTO_CIPHER_NULL },
 	{ TLS_CIPHER_RC2_CBC_40,   TLS_CIPHER_BLOCK,   5, 16,  0,
 	  CRYPTO_CIPHER_ALG_RC2 },
 	{ TLS_CIPHER_RC4_40,       TLS_CIPHER_STREAM,  5, 16,  0,
 	  CRYPTO_CIPHER_ALG_RC4 },
 	{ TLS_CIPHER_RC4_128,      TLS_CIPHER_STREAM, 16, 16,  0,
 	  CRYPTO_CIPHER_ALG_RC4 },
 	{ TLS_CIPHER_DES40_CBC,    TLS_CIPHER_BLOCK,   5,  8,  8,
 	  CRYPTO_CIPHER_ALG_DES },
 	{ TLS_CIPHER_DES_CBC,      TLS_CIPHER_BLOCK,   8,  8,  8,
 	  CRYPTO_CIPHER_ALG_DES },
 	{ TLS_CIPHER_3DES_EDE_CBC, TLS_CIPHER_BLOCK,  24, 24,  8,
 	  CRYPTO_CIPHER_ALG_3DES },
 	{ TLS_CIPHER_AES_128_CBC,  TLS_CIPHER_BLOCK,  16, 16, 16,
 	  CRYPTO_CIPHER_ALG_AES },
 	{ TLS_CIPHER_AES_256_CBC,  TLS_CIPHER_BLOCK,  32, 32, 16,
 	  CRYPTO_CIPHER_ALG_AES }
 };

 #define NUM_TLS_CIPHER_DATA ARRAY_SIZE(tls_ciphers)


 /**
  * tls_get_cipher_suite - Get TLS cipher suite
  * @suite: Cipher suite identifier
  * Returns: Pointer to the cipher data or %NULL if not found
  */
 const struct tls_cipher_suite * tls_get_cipher_suite(u16 suite)
 {
 	size_t i;
 	for (i = 0; i < NUM_TLS_CIPHER_SUITES; i++)
 		if (tls_cipher_suites[i].suite == suite)
 			return &tls_cipher_suites[i];
 	return NULL;
 }


 const struct tls_cipher_data * tls_get_cipher_data(tls_cipher cipher)
 {
 	size_t i;
 	for (i = 0; i < NUM_TLS_CIPHER_DATA; i++)
 		if (tls_ciphers[i].cipher == cipher)
 			return &tls_ciphers[i];
 	return NULL;
 }


 int tls_server_key_exchange_allowed(tls_cipher cipher)
 {
 	const struct tls_cipher_suite *suite;

 	/* RFC 2246, Section 7.4.3 */
 	suite = tls_get_cipher_suite(cipher);
 	if (suite == NULL)
 		return 0;

 	switch (suite->key_exchange) {
 	case TLS_KEY_X_DHE_DSS:
 	case TLS_KEY_X_DHE_DSS_EXPORT:
 	case TLS_KEY_X_DHE_RSA:
 	case TLS_KEY_X_DHE_RSA_EXPORT:
 	case TLS_KEY_X_DH_anon_EXPORT:
 	case TLS_KEY_X_DH_anon:
 		return 1;
 	case TLS_KEY_X_RSA_EXPORT:
 		return 1 /* FIX: public key len > 512 bits */;
 	default:
 		return 0;
 	}
 }


 /**
  * tls_parse_cert - Parse DER encoded X.509 certificate and get public key
  * @buf: ASN.1 DER encoded certificate
  * @len: Length of the buffer
  * @pk: Buffer for returning the allocated public key
  * Returns: 0 on success, -1 on failure
  *
  * This functions parses an ASN.1 DER encoded X.509 certificate and retrieves
  * the public key from it. The caller is responsible for freeing the public key
  * by calling crypto_public_key_free().
  */
 int tls_parse_cert(const u8 *buf, size_t len, struct crypto_public_key **pk)
 {
 	struct x509_certificate *cert;

 	wpa_hexdump(MSG_MSGDUMP, "TLSv1: Parse ASN.1 DER certificate",
 		    buf, len);

 	*pk = crypto_public_key_from_cert(buf, len);
 	if (*pk)
 		return 0;

 	cert = x509_certificate_parse(buf, len);
 	if (cert == NULL) {
 		wpa_printf(MSG_DEBUG, "TLSv1: Failed to parse X.509 "
 			   "certificate");
 		return -1;
 	}

 	/* TODO
 	 * verify key usage (must allow encryption)
 	 *
 	 * All certificate profiles, key and cryptographic formats are
 	 * defined by the IETF PKIX working group [PKIX]. When a key
 	 * usage extension is present, the digitalSignature bit must be
 	 * set for the key to be eligible for signing, as described
 	 * above, and the keyEncipherment bit must be present to allow
 	 * encryption, as described above. The keyAgreement bit must be
 	 * set on Diffie-Hellman certificates. (PKIX: RFC 3280)
 	 */

 	*pk = crypto_public_key_import(cert->public_key, cert->public_key_len);
 	x509_certificate_free(cert);

 	if (*pk == NULL) {
 		wpa_printf(MSG_ERROR, "TLSv1: Failed to import "
 			   "server public key");
 		return -1;
 	}

 	return 0;
 }


 int tls_verify_hash_init(struct tls_verify_hash *verify)
 {
 	tls_verify_hash_free(verify);
 	verify->md5_client = crypto_hash_init(CRYPTO_HASH_ALG_MD5, NULL, 0);
 	verify->md5_server = crypto_hash_init(CRYPTO_HASH_ALG_MD5, NULL, 0);
 	verify->md5_cert = crypto_hash_init(CRYPTO_HASH_ALG_MD5, NULL, 0);
 	verify->sha1_client = crypto_hash_init(CRYPTO_HASH_ALG_SHA1, NULL, 0);
 	verify->sha1_server = crypto_hash_init(CRYPTO_HASH_ALG_SHA1, NULL, 0);
 	verify->sha1_cert = crypto_hash_init(CRYPTO_HASH_ALG_SHA1, NULL, 0);
 	if (verify->md5_client == NULL || verify->md5_server == NULL ||
 	    verify->md5_cert == NULL || verify->sha1_client == NULL ||
 	    verify->sha1_server == NULL || verify->sha1_cert == NULL) {
 		tls_verify_hash_free(verify);
 		return -1;
 	}
 #ifdef CONFIG_TLSV12
 	verify->sha256_client = crypto_hash_init(CRYPTO_HASH_ALG_SHA256, NULL,
 						 0);
 	verify->sha256_server = crypto_hash_init(CRYPTO_HASH_ALG_SHA256, NULL,
 						 0);
 	verify->sha256_cert = crypto_hash_init(CRYPTO_HASH_ALG_SHA256, NULL,
 					       0);
 	if (verify->sha256_client == NULL || verify->sha256_server == NULL ||
 	    verify->sha256_cert == NULL) {
 		tls_verify_hash_free(verify);
 		return -1;
 	}
 #endif /* CONFIG_TLSV12 */
 	return 0;
 }


 void tls_verify_hash_add(struct tls_verify_hash *verify, const u8 *buf,
 			 size_t len)
 {
 	if (verify->md5_client && verify->sha1_client) {
 		crypto_hash_update(verify->md5_client, buf, len);
 		crypto_hash_update(verify->sha1_client, buf, len);
 	}
 	if (verify->md5_server && verify->sha1_server) {
 		crypto_hash_update(verify->md5_server, buf, len);
 		crypto_hash_update(verify->sha1_server, buf, len);
 	}
 	if (verify->md5_cert && verify->sha1_cert) {
 		crypto_hash_update(verify->md5_cert, buf, len);
 		crypto_hash_update(verify->sha1_cert, buf, len);
 	}
 #ifdef CONFIG_TLSV12
 	if (verify->sha256_client)
 		crypto_hash_update(verify->sha256_client, buf, len);
 	if (verify->sha256_server)
 		crypto_hash_update(verify->sha256_server, buf, len);
 	if (verify->sha256_cert)
 		crypto_hash_update(verify->sha256_cert, buf, len);
 #endif /* CONFIG_TLSV12 */
 }


 void tls_verify_hash_free(struct tls_verify_hash *verify)
 {
 	crypto_hash_finish(verify->md5_client, NULL, NULL);
 	crypto_hash_finish(verify->md5_server, NULL, NULL);
 	crypto_hash_finish(verify->md5_cert, NULL, NULL);
 	crypto_hash_finish(verify->sha1_client, NULL, NULL);
 	crypto_hash_finish(verify->sha1_server, NULL, NULL);
 	crypto_hash_finish(verify->sha1_cert, NULL, NULL);
 	verify->md5_client = NULL;
 	verify->md5_server = NULL;
 	verify->md5_cert = NULL;
 	verify->sha1_client = NULL;
 	verify->sha1_server = NULL;
 	verify->sha1_cert = NULL;
 #ifdef CONFIG_TLSV12
 	crypto_hash_finish(verify->sha256_client, NULL, NULL);
 	crypto_hash_finish(verify->sha256_server, NULL, NULL);
 	crypto_hash_finish(verify->sha256_cert, NULL, NULL);
 	verify->sha256_client = NULL;
 	verify->sha256_server = NULL;
 	verify->sha256_cert = NULL;
 #endif /* CONFIG_TLSV12 */
 }


 int tls_version_ok(u16 ver)
 {
 	if (ver == TLS_VERSION_1)
 		return 1;
 #ifdef CONFIG_TLSV11
 	if (ver == TLS_VERSION_1_1)
 		return 1;
 #endif /* CONFIG_TLSV11 */
 #ifdef CONFIG_TLSV12
 	if (ver == TLS_VERSION_1_2)
 		return 1;
 #endif /* CONFIG_TLSV12 */

 	return 0;
 }


 const char * tls_version_str(u16 ver)
 {
 	switch (ver) {
 	case TLS_VERSION_1:
 		return "1.0";
 	case TLS_VERSION_1_1:
 		return "1.1";
 	case TLS_VERSION_1_2:
 		return "1.2";
 	}

 	return "?";
 }


 int tls_prf(u16 ver, const u8 *secret, size_t secret_len, const char *label,
 	    const u8 *seed, size_t seed_len, u8 *out, size_t outlen)
 {
 #ifdef CONFIG_TLSV12
 	if (ver >= TLS_VERSION_1_2) {
 		tls_prf_sha256(secret, secret_len, label, seed, seed_len,
 			       out, outlen);
 		return 0;
 	}
 #endif /* CONFIG_TLSV12 */

 	return tls_prf_sha1_md5(secret, secret_len, label, seed, seed_len, out,
 				outlen);
 }


 #ifdef CONFIG_TLSV12
 int tlsv12_key_x_server_params_hash(u16 tls_version, u8 hash_alg,
 				    const u8 *client_random,
 				    const u8 *server_random,
 				    const u8 *server_params,
 				    size_t server_params_len, u8 *hash)
 {
 	size_t hlen;
 	struct crypto_hash *ctx;
 	enum crypto_hash_alg alg;

 	switch (hash_alg) {
 	case TLS_HASH_ALG_SHA256:
 		alg = CRYPTO_HASH_ALG_SHA256;
 		hlen = SHA256_MAC_LEN;
 		break;
 	case TLS_HASH_ALG_SHA384:
 		alg = CRYPTO_HASH_ALG_SHA384;
 		hlen = 48;
 		break;
 	case TLS_HASH_ALG_SHA512:
 		alg = CRYPTO_HASH_ALG_SHA512;
 		hlen = 64;
 		break;
 	default:
 		return -1;
 	}
 	ctx = crypto_hash_init(alg, NULL, 0);
 	if (ctx == NULL)
 		return -1;
 	crypto_hash_update(ctx, client_random, TLS_RANDOM_LEN);
 	crypto_hash_update(ctx, server_random, TLS_RANDOM_LEN);
 	crypto_hash_update(ctx, server_params, server_params_len);
 	if (crypto_hash_finish(ctx, hash, &hlen) < 0)
 		return -1;

 	return hlen;
 }
 #endif /* CONFIG_TLSV12 */


 int tls_key_x_server_params_hash(u16 tls_version, const u8 *client_random,
 				 const u8 *server_random,
 				 const u8 *server_params,
 				 size_t server_params_len, u8 *hash, size_t hsz)
 {
 	u8 *hpos;
 	size_t hlen;
 	struct crypto_hash *ctx;

 	hpos = hash;

 	ctx = crypto_hash_init(CRYPTO_HASH_ALG_MD5, NULL, 0);
 	if (ctx == NULL)
 		return -1;
 	crypto_hash_update(ctx, client_random, TLS_RANDOM_LEN);
 	crypto_hash_update(ctx, server_random, TLS_RANDOM_LEN);
 	crypto_hash_update(ctx, server_params, server_params_len);
 	hlen = MD5_MAC_LEN;
 	if (hsz < hlen)
 		return -1;
 	if (crypto_hash_finish(ctx, hash, &hlen) < 0)
 		return -1;
 	hpos += hlen;

 	ctx = crypto_hash_init(CRYPTO_HASH_ALG_SHA1, NULL, 0);
 	if (ctx == NULL)
 		return -1;
 	crypto_hash_update(ctx, client_random, TLS_RANDOM_LEN);
 	crypto_hash_update(ctx, server_random, TLS_RANDOM_LEN);
 	crypto_hash_update(ctx, server_params, server_params_len);
 	hlen = hsz - hlen;
 	if (crypto_hash_finish(ctx, hpos, &hlen) < 0)
 		return -1;
 	hpos += hlen;
 	return hpos - hash;
 }


 int tls_verify_signature(u16 tls_version, struct crypto_public_key *pk,
 			 const u8 *data, size_t data_len,
 			 const u8 *pos, size_t len, u8 *alert)
 {
 	u8 *buf;
 	const u8 *end = pos + len;
 	const u8 *decrypted;
 	u16 slen;
 	size_t buflen;

 	if (end - pos < 2) {
 		*alert = TLS_ALERT_DECODE_ERROR;
 		return -1;
 	}
 	slen = WPA_GET_BE16(pos);
 	pos += 2;
 	if (end - pos < slen) {
 		*alert = TLS_ALERT_DECODE_ERROR;
 		return -1;
 	}
 	if (end - pos > slen) {
 		wpa_hexdump(MSG_MSGDUMP, "Additional data after Signature",
 			    pos + slen, end - pos - slen);
 		end = pos + slen;
 	}

 	wpa_hexdump(MSG_MSGDUMP, "TLSv1: Signature", pos, end - pos);
 	if (pk == NULL) {
 		wpa_printf(MSG_DEBUG, "TLSv1: No public key to verify signature");
 		*alert = TLS_ALERT_INTERNAL_ERROR;
 		return -1;
 	}

 	buflen = end - pos;
 	buf = os_malloc(end - pos);
 	if (buf == NULL) {
 		*alert = TLS_ALERT_INTERNAL_ERROR;
 		return -1;
 	}
 	if (crypto_public_key_decrypt_pkcs1(pk, pos, end - pos, buf, &buflen) <
 	    0) {
 		wpa_printf(MSG_DEBUG, "TLSv1: Failed to decrypt signature");
 		os_free(buf);
 		*alert = TLS_ALERT_DECRYPT_ERROR;
 		return -1;
 	}
 	decrypted = buf;

 	wpa_hexdump_key(MSG_MSGDUMP, "TLSv1: Decrypted Signature",
 			decrypted, buflen);

 #ifdef CONFIG_TLSV12
 	if (tls_version >= TLS_VERSION_1_2) {
 		/*
 		 * RFC 3447, A.2.4 RSASSA-PKCS1-v1_5
 		 *
 		 * DigestInfo ::= SEQUENCE {
 		 *   digestAlgorithm DigestAlgorithm,
 		 *   digest OCTET STRING
 		 * }
 		 *
 		 * SHA-256 OID: sha256WithRSAEncryption ::= {pkcs-1 11}
 		 *
 		 * DER encoded DigestInfo for SHA256 per RFC 3447:
 		 * 30 31 30 0d 06 09 60 86 48 01 65 03 04 02 01 05 00 04 20 ||
 		 * H
 		 */
 		if (buflen >= 19 + 32 &&
 		    os_memcmp(buf, "\x30\x31\x30\x0d\x06\x09\x60\x86\x48\x01"
 			      "\x65\x03\x04\x02\x01\x05\x00\x04\x20", 19) == 0)
 		{
 			wpa_printf(MSG_DEBUG, "TLSv1.2: DigestAlgorithm = SHA-256");
 			decrypted = buf + 19;
 			buflen -= 19;
 		} else if (buflen >= 19 + 48 &&
 		    os_memcmp(buf, "\x30\x41\x30\x0d\x06\x09\x60\x86\x48\x01"
 			      "\x65\x03\x04\x02\x02\x05\x00\x04\x30", 19) == 0)
 		{
 			wpa_printf(MSG_DEBUG, "TLSv1.2: DigestAlgorithm = SHA-384");
 			decrypted = buf + 19;
 			buflen -= 19;
 		} else if (buflen >= 19 + 64 &&
 		    os_memcmp(buf, "\x30\x51\x30\x0d\x06\x09\x60\x86\x48\x01"
 			      "\x65\x03\x04\x02\x03\x05\x00\x04\x40", 19) == 0)
 		{
 			wpa_printf(MSG_DEBUG, "TLSv1.2: DigestAlgorithm = SHA-512");
 			decrypted = buf + 19;
 			buflen -= 19;

 		} else {
 			wpa_printf(MSG_DEBUG, "TLSv1.2: Unrecognized DigestInfo");
 			os_free(buf);
 			*alert = TLS_ALERT_DECRYPT_ERROR;
 			return -1;
 		}
 	}
 #endif /* CONFIG_TLSV12 */

 	if (buflen != data_len ||
 	    os_memcmp_const(decrypted, data, data_len) != 0) {
 		wpa_printf(MSG_DEBUG, "TLSv1: Invalid Signature in CertificateVerify - did not match calculated hash");
 		os_free(buf);
 		*alert = TLS_ALERT_DECRYPT_ERROR;
 		return -1;
 	}

 	os_free(buf);

 	return 0;
 }
	/*
	* TLSv1 common routines
	* Copyright (c) 2006-2014, Jouni Malinen <j@w1.fi>
	*
	* This software may be distributed under the terms of the BSD license.
	* See README for more details.
	*/

	#include "includes.h"

	#include "common.h"
	#include "crypto/md5.h"
	#include "crypto/sha1.h"
	#include "crypto/sha256.h"
	#include "x509v3.h"
	#include "tlsv1_common.h"


	/*
	* TODO:
	* RFC 2246 Section 9: Mandatory to implement TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
	* Add support for commonly used cipher suites; don't bother with exportable
	* suites.
	*/

	static const struct tls_cipher_suite tls_cipher_suites[] = {
	{ TLS_NULL_WITH_NULL_NULL, TLS_KEY_X_NULL, TLS_CIPHER_NULL,
	TLS_HASH_NULL },
	{ TLS_RSA_WITH_RC4_128_MD5, TLS_KEY_X_RSA, TLS_CIPHER_RC4_128,
	TLS_HASH_MD5 },
	{ TLS_RSA_WITH_RC4_128_SHA, TLS_KEY_X_RSA, TLS_CIPHER_RC4_128,
	TLS_HASH_SHA },
	{ TLS_RSA_WITH_DES_CBC_SHA, TLS_KEY_X_RSA, TLS_CIPHER_DES_CBC,
	TLS_HASH_SHA },
	{ TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_KEY_X_RSA,
	TLS_CIPHER_3DES_EDE_CBC, TLS_HASH_SHA },
	{ TLS_DHE_RSA_WITH_DES_CBC_SHA, TLS_KEY_X_DHE_RSA, TLS_CIPHER_DES_CBC,
	TLS_HASH_SHA},
	{ TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_KEY_X_DHE_RSA,
	TLS_CIPHER_3DES_EDE_CBC, TLS_HASH_SHA },
	{ TLS_DH_anon_WITH_RC4_128_MD5, TLS_KEY_X_DH_anon,
	TLS_CIPHER_RC4_128, TLS_HASH_MD5 },
	{ TLS_DH_anon_WITH_DES_CBC_SHA, TLS_KEY_X_DH_anon,
	TLS_CIPHER_DES_CBC, TLS_HASH_SHA },
	{ TLS_DH_anon_WITH_3DES_EDE_CBC_SHA, TLS_KEY_X_DH_anon,
	TLS_CIPHER_3DES_EDE_CBC, TLS_HASH_SHA },
	{ TLS_RSA_WITH_AES_128_CBC_SHA, TLS_KEY_X_RSA, TLS_CIPHER_AES_128_CBC,
	TLS_HASH_SHA },
	{ TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_KEY_X_DHE_RSA,
	TLS_CIPHER_AES_128_CBC, TLS_HASH_SHA },
	{ TLS_DH_anon_WITH_AES_128_CBC_SHA, TLS_KEY_X_DH_anon,
	TLS_CIPHER_AES_128_CBC, TLS_HASH_SHA },
	{ TLS_RSA_WITH_AES_256_CBC_SHA, TLS_KEY_X_RSA, TLS_CIPHER_AES_256_CBC,
	TLS_HASH_SHA },
	{ TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_KEY_X_DHE_RSA,
	TLS_CIPHER_AES_256_CBC, TLS_HASH_SHA },
	{ TLS_DH_anon_WITH_AES_256_CBC_SHA, TLS_KEY_X_DH_anon,
	TLS_CIPHER_AES_256_CBC, TLS_HASH_SHA },
	{ TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_KEY_X_RSA,
	TLS_CIPHER_AES_128_CBC, TLS_HASH_SHA256 },
	{ TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_KEY_X_RSA,
	TLS_CIPHER_AES_256_CBC, TLS_HASH_SHA256 },
	{ TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_KEY_X_DHE_RSA,
	TLS_CIPHER_AES_128_CBC, TLS_HASH_SHA256 },
	{ TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_KEY_X_DHE_RSA,
	TLS_CIPHER_AES_256_CBC, TLS_HASH_SHA256 },
	{ TLS_DH_anon_WITH_AES_128_CBC_SHA256, TLS_KEY_X_DH_anon,
	TLS_CIPHER_AES_128_CBC, TLS_HASH_SHA256 },
	{ TLS_DH_anon_WITH_AES_256_CBC_SHA256, TLS_KEY_X_DH_anon,
	TLS_CIPHER_AES_256_CBC, TLS_HASH_SHA256 }
	};

	#define NUM_TLS_CIPHER_SUITES ARRAY_SIZE(tls_cipher_suites)


	static const struct tls_cipher_data tls_ciphers[] = {
	{ TLS_CIPHER_NULL, TLS_CIPHER_STREAM, 0, 0, 0,
	CRYPTO_CIPHER_NULL },
	{ TLS_CIPHER_IDEA_CBC, TLS_CIPHER_BLOCK, 16, 16, 8,
	CRYPTO_CIPHER_NULL },
	{ TLS_CIPHER_RC2_CBC_40, TLS_CIPHER_BLOCK, 5, 16, 0,
	CRYPTO_CIPHER_ALG_RC2 },
	{ TLS_CIPHER_RC4_40, TLS_CIPHER_STREAM, 5, 16, 0,
	CRYPTO_CIPHER_ALG_RC4 },
	{ TLS_CIPHER_RC4_128, TLS_CIPHER_STREAM, 16, 16, 0,
	CRYPTO_CIPHER_ALG_RC4 },
	{ TLS_CIPHER_DES40_CBC, TLS_CIPHER_BLOCK, 5, 8, 8,
	CRYPTO_CIPHER_ALG_DES },
	{ TLS_CIPHER_DES_CBC, TLS_CIPHER_BLOCK, 8, 8, 8,
	CRYPTO_CIPHER_ALG_DES },
	{ TLS_CIPHER_3DES_EDE_CBC, TLS_CIPHER_BLOCK, 24, 24, 8,
	CRYPTO_CIPHER_ALG_3DES },
	{ TLS_CIPHER_AES_128_CBC, TLS_CIPHER_BLOCK, 16, 16, 16,
	CRYPTO_CIPHER_ALG_AES },
	{ TLS_CIPHER_AES_256_CBC, TLS_CIPHER_BLOCK, 32, 32, 16,
	CRYPTO_CIPHER_ALG_AES }
	};

	#define NUM_TLS_CIPHER_DATA ARRAY_SIZE(tls_ciphers)


	/**
	* tls_get_cipher_suite - Get TLS cipher suite
	* @suite: Cipher suite identifier
	* Returns: Pointer to the cipher data or %NULL if not found
	*/
	const struct tls_cipher_suite * tls_get_cipher_suite(u16 suite)
	{
	size_t i;
	for (i = 0; i < NUM_TLS_CIPHER_SUITES; i++)
	if (tls_cipher_suites[i].suite == suite)
	return &tls_cipher_suites[i];
	return NULL;
	}


	const struct tls_cipher_data * tls_get_cipher_data(tls_cipher cipher)
	{
	size_t i;
	for (i = 0; i < NUM_TLS_CIPHER_DATA; i++)
	if (tls_ciphers[i].cipher == cipher)
	return &tls_ciphers[i];
	return NULL;
	}


	int tls_server_key_exchange_allowed(tls_cipher cipher)
	{
	const struct tls_cipher_suite *suite;

	/* RFC 2246, Section 7.4.3 */
	suite = tls_get_cipher_suite(cipher);
	if (suite == NULL)
	return 0;

	switch (suite->key_exchange) {
	case TLS_KEY_X_DHE_DSS:
	case TLS_KEY_X_DHE_DSS_EXPORT:
	case TLS_KEY_X_DHE_RSA:
	case TLS_KEY_X_DHE_RSA_EXPORT:
	case TLS_KEY_X_DH_anon_EXPORT:
	case TLS_KEY_X_DH_anon:
	return 1;
	case TLS_KEY_X_RSA_EXPORT:
	return 1 /* FIX: public key len > 512 bits */;
	default:
	return 0;
	}
	}


	/**
	* tls_parse_cert - Parse DER encoded X.509 certificate and get public key
	* @buf: ASN.1 DER encoded certificate
	* @len: Length of the buffer
	* @pk: Buffer for returning the allocated public key
	* Returns: 0 on success, -1 on failure
	*
	* This functions parses an ASN.1 DER encoded X.509 certificate and retrieves
	* the public key from it. The caller is responsible for freeing the public key
	* by calling crypto_public_key_free().
	*/
	int tls_parse_cert(const u8 buf, size_t len, struct crypto_public_key *pk)
	{
	struct x509_certificate *cert;

	wpa_hexdump(MSG_MSGDUMP, "TLSv1: Parse ASN.1 DER certificate",
	buf, len);

	*pk = crypto_public_key_from_cert(buf, len);
	if (*pk)
	return 0;

	cert = x509_certificate_parse(buf, len);
	if (cert == NULL) {
	wpa_printf(MSG_DEBUG, "TLSv1: Failed to parse X.509 "
	"certificate");
	return -1;
	}

	/* TODO
	* verify key usage (must allow encryption)
	*
	* All certificate profiles, key and cryptographic formats are
	* defined by the IETF PKIX working group [PKIX]. When a key
	* usage extension is present, the digitalSignature bit must be
	* set for the key to be eligible for signing, as described
	* above, and the keyEncipherment bit must be present to allow
	* encryption, as described above. The keyAgreement bit must be
	* set on Diffie-Hellman certificates. (PKIX: RFC 3280)
	*/

	*pk = crypto_public_key_import(cert->public_key, cert->public_key_len);
	x509_certificate_free(cert);

	if (*pk == NULL) {
	wpa_printf(MSG_ERROR, "TLSv1: Failed to import "
	"server public key");
	return -1;
	}

	return 0;
	}


	int tls_verify_hash_init(struct tls_verify_hash *verify)
	{
	tls_verify_hash_free(verify);
	verify->md5_client = crypto_hash_init(CRYPTO_HASH_ALG_MD5, NULL, 0);
	verify->md5_server = crypto_hash_init(CRYPTO_HASH_ALG_MD5, NULL, 0);
	verify->md5_cert = crypto_hash_init(CRYPTO_HASH_ALG_MD5, NULL, 0);
	verify->sha1_client = crypto_hash_init(CRYPTO_HASH_ALG_SHA1, NULL, 0);
	verify->sha1_server = crypto_hash_init(CRYPTO_HASH_ALG_SHA1, NULL, 0);
	verify->sha1_cert = crypto_hash_init(CRYPTO_HASH_ALG_SHA1, NULL, 0);
	if (verify->md5_client == NULL \|\| verify->md5_server == NULL \|\|
	verify->md5_cert == NULL \|\| verify->sha1_client == NULL \|\|
	verify->sha1_server == NULL \|\| verify->sha1_cert == NULL) {
	tls_verify_hash_free(verify);
	return -1;
	}
	#ifdef CONFIG_TLSV12
	verify->sha256_client = crypto_hash_init(CRYPTO_HASH_ALG_SHA256, NULL,
	0);
	verify->sha256_server = crypto_hash_init(CRYPTO_HASH_ALG_SHA256, NULL,
	0);
	verify->sha256_cert = crypto_hash_init(CRYPTO_HASH_ALG_SHA256, NULL,
	0);
	if (verify->sha256_client == NULL \|\| verify->sha256_server == NULL \|\|
	verify->sha256_cert == NULL) {
	tls_verify_hash_free(verify);
	return -1;
	}
	#endif /* CONFIG_TLSV12 */
	return 0;
	}


	void tls_verify_hash_add(struct tls_verify_hash verify, const u8 buf,
	size_t len)
	{
	if (verify->md5_client && verify->sha1_client) {
	crypto_hash_update(verify->md5_client, buf, len);
	crypto_hash_update(verify->sha1_client, buf, len);
	}
	if (verify->md5_server && verify->sha1_server) {
	crypto_hash_update(verify->md5_server, buf, len);
	crypto_hash_update(verify->sha1_server, buf, len);
	}
	if (verify->md5_cert && verify->sha1_cert) {
	crypto_hash_update(verify->md5_cert, buf, len);
	crypto_hash_update(verify->sha1_cert, buf, len);
	}
	#ifdef CONFIG_TLSV12
	if (verify->sha256_client)
	crypto_hash_update(verify->sha256_client, buf, len);
	if (verify->sha256_server)
	crypto_hash_update(verify->sha256_server, buf, len);
	if (verify->sha256_cert)
	crypto_hash_update(verify->sha256_cert, buf, len);
	#endif /* CONFIG_TLSV12 */
	}


	void tls_verify_hash_free(struct tls_verify_hash *verify)
	{
	crypto_hash_finish(verify->md5_client, NULL, NULL);
	crypto_hash_finish(verify->md5_server, NULL, NULL);
	crypto_hash_finish(verify->md5_cert, NULL, NULL);
	crypto_hash_finish(verify->sha1_client, NULL, NULL);
	crypto_hash_finish(verify->sha1_server, NULL, NULL);
	crypto_hash_finish(verify->sha1_cert, NULL, NULL);
	verify->md5_client = NULL;
	verify->md5_server = NULL;
	verify->md5_cert = NULL;
	verify->sha1_client = NULL;
	verify->sha1_server = NULL;
	verify->sha1_cert = NULL;
	#ifdef CONFIG_TLSV12
	crypto_hash_finish(verify->sha256_client, NULL, NULL);
	crypto_hash_finish(verify->sha256_server, NULL, NULL);
	crypto_hash_finish(verify->sha256_cert, NULL, NULL);
	verify->sha256_client = NULL;
	verify->sha256_server = NULL;
	verify->sha256_cert = NULL;
	#endif /* CONFIG_TLSV12 */
	}


	int tls_version_ok(u16 ver)
	{
	if (ver == TLS_VERSION_1)
	return 1;
	#ifdef CONFIG_TLSV11
	if (ver == TLS_VERSION_1_1)
	return 1;
	#endif /* CONFIG_TLSV11 */
	#ifdef CONFIG_TLSV12
	if (ver == TLS_VERSION_1_2)
	return 1;
	#endif /* CONFIG_TLSV12 */

	return 0;
	}


	const char * tls_version_str(u16 ver)
	{
	switch (ver) {
	case TLS_VERSION_1:
	return "1.0";
	case TLS_VERSION_1_1:
	return "1.1";
	case TLS_VERSION_1_2:
	return "1.2";
	}

	return "?";
	}


	int tls_prf(u16 ver, const u8 secret, size_t secret_len, const char label,
	const u8 seed, size_t seed_len, u8 out, size_t outlen)
	{
	#ifdef CONFIG_TLSV12
	if (ver >= TLS_VERSION_1_2) {
	tls_prf_sha256(secret, secret_len, label, seed, seed_len,
	out, outlen);
	return 0;
	}
	#endif /* CONFIG_TLSV12 */

	return tls_prf_sha1_md5(secret, secret_len, label, seed, seed_len, out,
	outlen);
	}


	#ifdef CONFIG_TLSV12
	int tlsv12_key_x_server_params_hash(u16 tls_version, u8 hash_alg,
	const u8 *client_random,
	const u8 *server_random,
	const u8 *server_params,
	size_t server_params_len, u8 *hash)
	{
	size_t hlen;
	struct crypto_hash *ctx;
	enum crypto_hash_alg alg;

	switch (hash_alg) {
	case TLS_HASH_ALG_SHA256:
	alg = CRYPTO_HASH_ALG_SHA256;
	hlen = SHA256_MAC_LEN;
	break;
	case TLS_HASH_ALG_SHA384:
	alg = CRYPTO_HASH_ALG_SHA384;
	hlen = 48;
	break;
	case TLS_HASH_ALG_SHA512:
	alg = CRYPTO_HASH_ALG_SHA512;
	hlen = 64;
	break;
	default:
	return -1;
	}
	ctx = crypto_hash_init(alg, NULL, 0);
	if (ctx == NULL)
	return -1;
	crypto_hash_update(ctx, client_random, TLS_RANDOM_LEN);
	crypto_hash_update(ctx, server_random, TLS_RANDOM_LEN);
	crypto_hash_update(ctx, server_params, server_params_len);
	if (crypto_hash_finish(ctx, hash, &hlen) < 0)
	return -1;

	return hlen;
	}
	#endif /* CONFIG_TLSV12 */


	int tls_key_x_server_params_hash(u16 tls_version, const u8 *client_random,
	const u8 *server_random,
	const u8 *server_params,
	size_t server_params_len, u8 *hash, size_t hsz)
	{
	u8 *hpos;
	size_t hlen;
	struct crypto_hash *ctx;

	hpos = hash;

	ctx = crypto_hash_init(CRYPTO_HASH_ALG_MD5, NULL, 0);
	if (ctx == NULL)
	return -1;
	crypto_hash_update(ctx, client_random, TLS_RANDOM_LEN);
	crypto_hash_update(ctx, server_random, TLS_RANDOM_LEN);
	crypto_hash_update(ctx, server_params, server_params_len);
	hlen = MD5_MAC_LEN;
	if (hsz < hlen)
	return -1;
	if (crypto_hash_finish(ctx, hash, &hlen) < 0)
	return -1;
	hpos += hlen;

	ctx = crypto_hash_init(CRYPTO_HASH_ALG_SHA1, NULL, 0);
	if (ctx == NULL)
	return -1;
	crypto_hash_update(ctx, client_random, TLS_RANDOM_LEN);
	crypto_hash_update(ctx, server_random, TLS_RANDOM_LEN);
	crypto_hash_update(ctx, server_params, server_params_len);
	hlen = hsz - hlen;
	if (crypto_hash_finish(ctx, hpos, &hlen) < 0)
	return -1;
	hpos += hlen;
	return hpos - hash;
	}


	int tls_verify_signature(u16 tls_version, struct crypto_public_key *pk,
	const u8 *data, size_t data_len,
	const u8 pos, size_t len, u8 alert)
	{
	u8 *buf;
	const u8 *end = pos + len;
	const u8 *decrypted;
	u16 slen;
	size_t buflen;

	if (end - pos < 2) {
	*alert = TLS_ALERT_DECODE_ERROR;
	return -1;
	}
	slen = WPA_GET_BE16(pos);
	pos += 2;
	if (end - pos < slen) {
	*alert = TLS_ALERT_DECODE_ERROR;
	return -1;
	}
	if (end - pos > slen) {
	wpa_hexdump(MSG_MSGDUMP, "Additional data after Signature",
	pos + slen, end - pos - slen);
	end = pos + slen;
	}

	wpa_hexdump(MSG_MSGDUMP, "TLSv1: Signature", pos, end - pos);
	if (pk == NULL) {
	wpa_printf(MSG_DEBUG, "TLSv1: No public key to verify signature");
	*alert = TLS_ALERT_INTERNAL_ERROR;
	return -1;
	}

	buflen = end - pos;
	buf = os_malloc(end - pos);
	if (buf == NULL) {
	*alert = TLS_ALERT_INTERNAL_ERROR;
	return -1;
	}
	if (crypto_public_key_decrypt_pkcs1(pk, pos, end - pos, buf, &buflen) <
	0) {
	wpa_printf(MSG_DEBUG, "TLSv1: Failed to decrypt signature");
	os_free(buf);
	*alert = TLS_ALERT_DECRYPT_ERROR;
	return -1;
	}
	decrypted = buf;

	wpa_hexdump_key(MSG_MSGDUMP, "TLSv1: Decrypted Signature",
	decrypted, buflen);

	#ifdef CONFIG_TLSV12
	if (tls_version >= TLS_VERSION_1_2) {
	/*
	* RFC 3447, A.2.4 RSASSA-PKCS1-v1_5
	*
	* DigestInfo ::= SEQUENCE {
	* digestAlgorithm DigestAlgorithm,
	* digest OCTET STRING
	* }
	*
	* SHA-256 OID: sha256WithRSAEncryption ::= {pkcs-1 11}
	*
	* DER encoded DigestInfo for SHA256 per RFC 3447:
	* 30 31 30 0d 06 09 60 86 48 01 65 03 04 02 01 05 00 04 20 \|\|
	* H
	*/
	if (buflen >= 19 + 32 &&
	os_memcmp(buf, "\x30\x31\x30\x0d\x06\x09\x60\x86\x48\x01"
	"\x65\x03\x04\x02\x01\x05\x00\x04\x20", 19) == 0)
	{
	wpa_printf(MSG_DEBUG, "TLSv1.2: DigestAlgorithm = SHA-256");
	decrypted = buf + 19;
	buflen -= 19;
	} else if (buflen >= 19 + 48 &&
	os_memcmp(buf, "\x30\x41\x30\x0d\x06\x09\x60\x86\x48\x01"
	"\x65\x03\x04\x02\x02\x05\x00\x04\x30", 19) == 0)
	{
	wpa_printf(MSG_DEBUG, "TLSv1.2: DigestAlgorithm = SHA-384");
	decrypted = buf + 19;
	buflen -= 19;
	} else if (buflen >= 19 + 64 &&
	os_memcmp(buf, "\x30\x51\x30\x0d\x06\x09\x60\x86\x48\x01"
	"\x65\x03\x04\x02\x03\x05\x00\x04\x40", 19) == 0)
	{
	wpa_printf(MSG_DEBUG, "TLSv1.2: DigestAlgorithm = SHA-512");
	decrypted = buf + 19;
	buflen -= 19;

	} else {
	wpa_printf(MSG_DEBUG, "TLSv1.2: Unrecognized DigestInfo");
	os_free(buf);
	*alert = TLS_ALERT_DECRYPT_ERROR;
	return -1;
	}
	}
	#endif /* CONFIG_TLSV12 */

	if (buflen != data_len \|\|
	os_memcmp_const(decrypted, data, data_len) != 0) {
	wpa_printf(MSG_DEBUG, "TLSv1: Invalid Signature in CertificateVerify - did not match calculated hash");
	os_free(buf);
	*alert = TLS_ALERT_DECRYPT_ERROR;
	return -1;
	}

	os_free(buf);

	return 0;
	}