[PATCH 1/4] crypto: Add PSA-based crypto and TLS backend (CONFIG_TLS=psa)
Chaitanya Tata
chaitanya.mgit at gmail.com
Wed Jul 8 13:18:57 PDT 2026
From: Chaitanya Tata <Chaitanya.Tata at nordicsemi.no>
Add a new crypto/TLS backend selected with CONFIG_TLS=psa that implements
the crypto.h and tls.h interfaces on top of the Arm PSA Crypto API, using
MbedTLS 4.x / TF-PSA-Crypto 1.x as the reference provider. It is intended
for resource-constrained and PSA-based platforms (e.g. Nordic nRF Connect
SDK with Oberon PSA Crypto + CryptoCell, or TF-M) where the primitive
crypto is exposed through PSA rather than a specific library.
The backend is split to make the PSA boundary explicit:
- crypto_psa.c: the portable, PSA-only primitives (hashes, HMAC, AES
ECB/CBC/CTR/GCM/CCM, CMAC, AEAD, KDFs incl. pbkdf2_sha1/256/384, RNG,
cipher context, crypto_hash_*). Any PSA implementation satisfies these.
- crypto_psa_mbedtls.c: the non-PSA half (crypto_bignum_*, crypto_ec_*
point ops, crypto_ecdh_*, EC keys, finite-field DH via mbedtls_mpi, and
DPP/CSR helpers) using the MbedTLS builtin mbedtls_mpi_*/mbedtls_ecp_*
modules, needed by SAE/DPP/PASN/EAP-PWD which the PSA Crypto API does
not cover. This is the only file to change if PSA gains these ops.
- tls_psa.c: TLS and X.509 via mbedtls_ssl_*/mbedtls_x509_* (TLS is not
part of PSA).
MbedTLS 4 removed single-DES, MD4 and DHM and PSA has no equivalents, so
EAP-MSCHAPv2 (DES), the NT-hash (MD4), TKIP/MPPE (RC4) and finite-field DH
(WPS, EAP-PWD-FFC, EAP-IKEv2) use hostap's bundled internal implementations,
selected with CONFIG_INTERNAL_DES/MD4/RC4/DH_GROUP5 and built on this
backend's crypto_mod_exp().
Builds wpa_supplicant and hostapd for WPA2/3 Personal and Enterprise
(SAE, OWE, FILS, DPP, WPS, PASN, SuiteB, EAP-TLS/PEAP/TTLS/MSCHAPv2/
SIM/AKA/PWD). Passes the crypto module tests (MODULE_TESTS) and hwsim
association tests for open/WPA2-PSK/SAE/OWE and EAP-TLS/PEAP/TTLS.
Derived from the Zephyr Project hostap PSA port: the original mbed TLS
wrapper was written by Glenn Strauss; the PSA-based rework was contributed
by NXP (Maochen Wang, Fengming Ye and others) and maintained by Nordic
Semiconductor, with contributions from BayLibre (Valerio Setti).
Signed-off-by: Chaitanya Tata <Chaitanya.Tata at nordicsemi.no>
---
hostapd/Makefile | 83 +
hostapd/defconfig | 4 +
src/crypto/crypto_psa.c | 1491 +++++++++++++++
src/crypto/crypto_psa_mbedtls.c | 2357 ++++++++++++++++++++++++
src/crypto/tls_psa.c | 2999 +++++++++++++++++++++++++++++++
wpa_supplicant/Makefile | 66 +
wpa_supplicant/defconfig | 4 +
7 files changed, 7004 insertions(+)
create mode 100644 src/crypto/crypto_psa.c
create mode 100644 src/crypto/crypto_psa_mbedtls.c
create mode 100644 src/crypto/tls_psa.c
diff --git a/hostapd/Makefile b/hostapd/Makefile
index 6bbadb28b..65a2454ee 100644
--- a/hostapd/Makefile
+++ b/hostapd/Makefile
@@ -750,6 +750,37 @@ LIBS_h += -ldl
endif
endif
+ifeq ($(CONFIG_TLS), psa)
+# PSA crypto backend (reference: MbedTLS 4 / TF-PSA-Crypto). See the matching
+# block in wpa_supplicant/Makefile. Include/library paths come from the build
+# .config (CFLAGS/LIBS).
+CONFIG_CRYPTO=psa
+ifdef TLS_FUNCS
+OBJS += ../src/crypto/tls_psa.o
+endif
+OBJS += ../src/crypto/crypto_psa.o
+OBJS += ../src/crypto/crypto_psa_mbedtls.o
+HOBJS += ../src/crypto/crypto_psa.o
+HOBJS += ../src/crypto/crypto_psa_mbedtls.o
+SOBJS += ../src/crypto/crypto_psa.o
+SOBJS += ../src/crypto/crypto_psa_mbedtls.o
+ifdef NEED_FIPS186_2_PRF
+# See wpa_supplicant/Makefile: internal FIPS 186-2 PRF + SHA-1 transform.
+OBJS += ../src/crypto/fips_prf_internal.o
+OBJS += ../src/crypto/sha1-internal.o
+endif
+NEED_TLS_PRF_SHA256=y
+LIBS += -lmbedtls -lmbedx509 -lmbedcrypto
+LIBS_h += -lmbedx509 -lmbedcrypto
+LIBS_n += -lmbedx509 -lmbedcrypto
+LIBS_s += -lmbedx509 -lmbedcrypto
+ifdef CONFIG_TLS_ADD_DL
+LIBS += -ldl
+LIBS_h += -ldl
+LIBS_s += -ldl
+endif
+endif
+
ifeq ($(CONFIG_TLS), openssl)
CFLAGS += -DCRYPTO_RSA_OAEP_SHA256
CONFIG_CRYPTO=openssl
@@ -959,9 +990,11 @@ endif
ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), wolfssl)
+ifneq ($(CONFIG_TLS), psa)
AESOBJS += ../src/crypto/aes-wrap.o
endif
endif
+endif
ifdef NEED_AES_EAX
AESOBJS += ../src/crypto/aes-eax.o
NEED_AES_CTR=y
@@ -971,38 +1004,46 @@ AESOBJS += ../src/crypto/aes-siv.o
NEED_AES_CTR=y
endif
ifdef NEED_AES_CTR
+ifneq ($(CONFIG_TLS), psa)
AESOBJS += ../src/crypto/aes-ctr.o
endif
+endif
ifdef NEED_AES_ENCBLOCK
AESOBJS += ../src/crypto/aes-encblock.o
endif
ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
ifneq ($(CONFIG_TLS), wolfssl)
+ifneq ($(CONFIG_TLS), psa)
AESOBJS += ../src/crypto/aes-omac1.o
endif
endif
endif
+endif
ifdef NEED_AES_UNWRAP
ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
ifneq ($(CONFIG_TLS), wolfssl)
+ifneq ($(CONFIG_TLS), psa)
NEED_AES_DEC=y
AESOBJS += ../src/crypto/aes-unwrap.o
endif
endif
endif
endif
+endif
ifdef NEED_AES_CBC
NEED_AES_DEC=y
ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
ifneq ($(CONFIG_TLS), wolfssl)
+ifneq ($(CONFIG_TLS), psa)
AESOBJS += ../src/crypto/aes-cbc.o
endif
endif
endif
endif
+endif
ifdef NEED_AES_DEC
ifdef CONFIG_INTERNAL_AES
AESOBJS += ../src/crypto/aes-internal-dec.o
@@ -1017,12 +1058,16 @@ ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
ifneq ($(CONFIG_TLS), gnutls)
ifneq ($(CONFIG_TLS), wolfssl)
+ifneq ($(CONFIG_TLS), psa)
SHA1OBJS += ../src/crypto/sha1.o
endif
endif
endif
endif
+endif
+ifneq ($(CONFIG_TLS), psa)
SHA1OBJS += ../src/crypto/sha1-prf.o
+endif
ifdef CONFIG_INTERNAL_SHA1
SHA1OBJS += ../src/crypto/sha1-internal.o
ifdef NEED_FIPS186_2_PRF
@@ -1031,9 +1076,11 @@ endif
endif
ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), wolfssl)
+ifneq ($(CONFIG_TLS), psa)
SHA1OBJS += ../src/crypto/sha1-pbkdf2.o
endif
endif
+endif
ifdef NEED_T_PRF
SHA1OBJS += ../src/crypto/sha1-tprf.o
endif
@@ -1050,11 +1097,13 @@ ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
ifneq ($(CONFIG_TLS), gnutls)
ifneq ($(CONFIG_TLS), wolfssl)
+ifneq ($(CONFIG_TLS), psa)
OBJS += ../src/crypto/md5.o
endif
endif
endif
endif
+endif
ifdef NEED_MD5
ifdef CONFIG_INTERNAL_MD5
@@ -1107,12 +1156,16 @@ ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
ifneq ($(CONFIG_TLS), gnutls)
ifneq ($(CONFIG_TLS), wolfssl)
+ifneq ($(CONFIG_TLS), psa)
OBJS += ../src/crypto/sha256.o
endif
endif
endif
endif
+endif
+ifneq ($(CONFIG_TLS), psa)
OBJS += ../src/crypto/sha256-prf.o
+endif
ifdef CONFIG_INTERNAL_SHA256
OBJS += ../src/crypto/sha256-internal.o
endif
@@ -1123,40 +1176,54 @@ ifdef NEED_TLS_PRF_SHA384
OBJS += ../src/crypto/sha384-tlsprf.o
endif
ifdef NEED_HMAC_SHA256_KDF
+ifneq ($(CONFIG_TLS), psa)
OBJS += ../src/crypto/sha256-kdf.o
endif
+endif
ifdef NEED_HMAC_SHA384_KDF
+ifneq ($(CONFIG_TLS), psa)
OBJS += ../src/crypto/sha384-kdf.o
endif
+endif
ifdef NEED_HMAC_SHA512_KDF
+ifneq ($(CONFIG_TLS), psa)
OBJS += ../src/crypto/sha512-kdf.o
endif
+endif
ifdef NEED_SHA384
CFLAGS += -DCONFIG_SHA384
ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
ifneq ($(CONFIG_TLS), gnutls)
ifneq ($(CONFIG_TLS), wolfssl)
+ifneq ($(CONFIG_TLS), psa)
OBJS += ../src/crypto/sha384.o
endif
endif
endif
endif
+endif
+ifneq ($(CONFIG_TLS), psa)
OBJS += ../src/crypto/sha384-prf.o
endif
+endif
ifdef NEED_SHA512
CFLAGS += -DCONFIG_SHA512
ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
ifneq ($(CONFIG_TLS), gnutls)
ifneq ($(CONFIG_TLS), wolfssl)
+ifneq ($(CONFIG_TLS), psa)
OBJS += ../src/crypto/sha512.o
endif
endif
endif
endif
+endif
+ifneq ($(CONFIG_TLS), psa)
OBJS += ../src/crypto/sha512-prf.o
endif
+endif
ifdef CONFIG_INTERNAL_SHA384
CFLAGS += -DCONFIG_INTERNAL_SHA384
@@ -1201,11 +1268,13 @@ HOBJS += $(SHA1OBJS)
ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
ifneq ($(CONFIG_TLS), wolfssl)
+ifneq ($(CONFIG_TLS), psa)
HOBJS += ../src/crypto/md5.o
endif
endif
endif
endif
+endif
ifdef CONFIG_RADIUS_SERVER
CFLAGS += -DRADIUS_SERVER
@@ -1415,16 +1484,30 @@ SOBJS += ../src/common/dragonfly.o
SOBJS += $(AESOBJS)
SOBJS += ../src/crypto/sha384.o
SOBJS += ../src/crypto/sha512.o
+ifneq ($(CONFIG_TLS), psa)
SOBJS += ../src/crypto/sha256-prf.o
+endif
+ifneq ($(CONFIG_TLS), psa)
SOBJS += ../src/crypto/sha384-prf.o
+endif
+ifneq ($(CONFIG_TLS), psa)
SOBJS += ../src/crypto/sha512-prf.o
+endif
SOBJS += ../src/crypto/dh_groups.o
+ifneq ($(CONFIG_TLS), psa)
SOBJS += ../src/crypto/sha256-kdf.o
+endif
+ifneq ($(CONFIG_TLS), psa)
SOBJS += ../src/crypto/sha384-kdf.o
+endif
+ifneq ($(CONFIG_TLS), psa)
SOBJS += ../src/crypto/sha512-kdf.o
+endif
SOBJS += ../src/common/wpa_common.o
SOBJS += ../src/crypto/random.o
+ifneq ($(CONFIG_TLS), psa)
SOBJS += ../src/crypto/sha1-prf.o
+endif
SOBJS += ../src/utils/eloop.o
_OBJS_VAR := NOBJS
diff --git a/hostapd/defconfig b/hostapd/defconfig
index 0c6077a7b..c3a5860ad 100644
--- a/hostapd/defconfig
+++ b/hostapd/defconfig
@@ -273,6 +273,10 @@ CONFIG_IPV6=y
# Select TLS implementation
# openssl = OpenSSL (default)
# gnutls = GnuTLS
+# wolfssl = wolfSSL
+# psa = PSA Crypto API primitives with MbedTLS for TLS/X.509 and the
+# bignum/EC-point math not covered by PSA (reference: MbedTLS 4 /
+# TF-PSA-Crypto); suited to resource-constrained/PSA-based platforms
# internal = Internal TLSv1 implementation (experimental)
# linux = Linux kernel AF_ALG and internal TLSv1 implementation (experimental)
# none = Empty template
diff --git a/src/crypto/crypto_psa.c b/src/crypto/crypto_psa.c
new file mode 100644
index 000000000..9ca1a4f8a
--- /dev/null
+++ b/src/crypto/crypto_psa.c
@@ -0,0 +1,1491 @@
+/*
+ * crypto wrapper functions for the PSA Crypto API (reference provider:
+ * MbedTLS 4 / TF-PSA-Crypto)
+ *
+ * Copyright (c) 2022, Glenn Strauss <gstrauss at gluelogic.com>
+ * Copyright (c) 2023-2024, NXP
+ * Copyright (c) 2024-2026, Nordic Semiconductor ASA
+ *
+ * This software may be distributed under the terms of the BSD license.
+ * See README for more details.
+ *
+ * Derived from the Zephyr Project hostap PSA port.
+ */
+
+#include "utils/includes.h"
+#include "utils/common.h"
+
+/*
+ * This backend is PSA-first, but SAE/DPP/PASN and other features need bignum
+ * and EC-point math that the PSA Crypto API does not expose. Those paths fall
+ * back to MbedTLS' builtin (legacy) modules, whose declarations and struct
+ * internals are private in TF-PSA-Crypto 1.x. Opt in to them here.
+ */
+#define MBEDTLS_DECLARE_PRIVATE_IDENTIFIERS
+#define MBEDTLS_ALLOW_PRIVATE_ACCESS
+
+#include <mbedtls/platform_util.h> /* mbedtls_platform_zeroize() */
+#include <mbedtls/asn1.h>
+#include <mbedtls/asn1write.h>
+#include <mbedtls/private/bignum.h>
+
+#include <psa/crypto.h>
+#include <mbedtls/psa_util.h>
+#include <mbedtls/md.h>
+
+#ifndef MBEDTLS_PRIVATE
+#define MBEDTLS_PRIVATE(x) x
+#endif
+
+#define ENTROPY_MIN_PLATFORM 32
+
+/* hostapd/wpa_supplicant provides forced_memzero(),
+ * but prefer mbedtls_platform_zeroize() */
+#define forced_memzero(ptr, sz) mbedtls_platform_zeroize(ptr, sz)
+
+#define IANA_SECP256R1 19
+#define IANA_SECP384R1 20
+#define IANA_SECP521R1 21
+
+#ifdef CONFIG_MBEDTLS_ECDH_LEGACY_CONTEXT
+#define ACCESS_ECDH(S, var) S->MBEDTLS_PRIVATE(var)
+#else
+#define ACCESS_ECDH(S, var) S->MBEDTLS_PRIVATE(ctx).MBEDTLS_PRIVATE(mbed_ecdh).MBEDTLS_PRIVATE(var)
+#endif
+
+#ifndef __has_attribute
+#define __has_attribute(x) 0
+#endif
+
+#ifndef __GNUC_PREREQ
+#define __GNUC_PREREQ(maj, min) 0
+#endif
+
+#ifndef __attribute_cold__
+#if __has_attribute(cold) || __GNUC_PREREQ(4, 3)
+#define __attribute_cold__ __attribute__((__cold__))
+#else
+#define __attribute_cold__
+#endif
+#endif
+
+#ifndef __attribute_noinline__
+#if __has_attribute(noinline) || __GNUC_PREREQ(3, 1)
+#define __attribute_noinline__ __attribute__((__noinline__))
+#else
+#define __attribute_noinline__
+#endif
+#endif
+
+#include "crypto.h"
+#include "aes_wrap.h"
+#include "aes.h"
+#include "md5.h"
+#include "sha1.h"
+#include "sha256.h"
+#include "sha384.h"
+#include "sha512.h"
+
+/*
+ * selective code inclusion based on preprocessor defines
+ *
+ * future: additional code could be wrapped with preprocessor checks if
+ * wpa_supplicant/Makefile and hostap/Makefile were more consistent with
+ * setting preprocessor defines for named groups of functionality
+ */
+
+#if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST) || defined(EAP_TEAP) || \
+ defined(EAP_TEAP_DYNAMIC) || defined(EAP_SERVER_FAST)
+#define CRYPTO_MBEDTLS_SHA1_T_PRF
+#endif
+
+#if !defined(CONFIG_NO_PBKDF2)
+#define CRYPTO_MBEDTLS_PBKDF2_SHA1
+#endif /* pbkdf2_sha1() */
+
+#if defined(EAP_IKEV2) || defined(EAP_IKEV2_DYNAMIC) || defined(EAP_SERVER_IKEV2) /* CONFIG_EAP_IKEV2=y */
+#define CRYPTO_MBEDTLS_CRYPTO_CIPHER
+#endif /* crypto_cipher_*() */
+
+/*
+ * The bignum, finite-field DH, EC-point, ECDH, EC-key and DPP helper groups
+ * (crypto_bignum_*, crypto_dh_*, crypto_ec_*, crypto_ecdh_*, crypto_ec_key_*,
+ * ...) are the non-PSA half of this backend and live in crypto_psa_mbedtls.c.
+ */
+
+__attribute_cold__ void crypto_unload(void)
+{
+ /* Nothing to do */
+}
+
+int hostap_rng_fn(void* ctx, unsigned char* buf, size_t buf_size)
+{
+ if (psa_generate_random(buf, buf_size) != PSA_SUCCESS) {
+ return -1;
+ }
+ return 0;
+}
+
+void *hostap_rng_ctx(void)
+{
+ return NULL;
+}
+
+/*
+ * PSA-based crypto primitive helpers.
+ *
+ * These wrap the PSA Crypto API (psa_*) for the primitives hostap needs and
+ * are the portable core of this backend: any PSA implementation (TF-PSA-Crypto,
+ * Oberon PSA Crypto, a hardware PSA driver, ...) satisfies them without an
+ * MbedTLS-specific dependency.
+ */
+
+#define ASSERT_STATUS(actual, expected) \
+ do { \
+ if ((actual) != (expected)) { \
+ wpa_printf(MSG_ERROR, \
+ "%s:%d PSA status %d (expected %d)", \
+ __func__, __LINE__, \
+ (int) (actual), (int) (expected)); \
+ goto exit; \
+ } \
+ } while (0)
+
+static inline void crypto_psa_set_attributes(psa_key_attributes_t *attributes,
+ u32 type, u32 alg, u32 usage)
+{
+ psa_set_key_type(attributes, type);
+ psa_set_key_algorithm(attributes, alg);
+ psa_set_key_usage_flags(attributes, usage);
+}
+
+static void crypto_psa_get_hash_alg(mbedtls_md_type_t type, psa_algorithm_t *alg,
+ int *block_size)
+{
+ switch (type) {
+ case MBEDTLS_MD_MD5:
+ *alg = PSA_ALG_MD5;
+ break;
+ case MBEDTLS_MD_SHA1:
+ *alg = PSA_ALG_SHA_1;
+ break;
+ case MBEDTLS_MD_SHA224:
+ *alg = PSA_ALG_SHA_224;
+ break;
+ case MBEDTLS_MD_SHA256:
+ *alg = PSA_ALG_SHA_256;
+ break;
+ case MBEDTLS_MD_SHA384:
+ *alg = PSA_ALG_SHA_384;
+ break;
+ case MBEDTLS_MD_SHA512:
+ *alg = PSA_ALG_SHA_512;
+ break;
+ default:
+ *alg = PSA_ALG_NONE;
+ break;
+ }
+ *block_size = PSA_HASH_LENGTH(*alg);
+}
+
+static psa_status_t crypto_psa_cipher_op(psa_cipher_operation_t *operation,
+ const uint8_t *input, size_t input_size,
+ size_t part_size, uint8_t *output,
+ size_t output_size, size_t *output_len)
+{
+ psa_status_t status;
+ size_t bytes_to_write = 0;
+ size_t bytes_written = 0;
+ size_t len = 0;
+
+ *output_len = 0;
+ while (bytes_written != input_size) {
+ bytes_to_write = (input_size - bytes_written > part_size ?
+ part_size : input_size - bytes_written);
+
+ status = psa_cipher_update(operation, input + bytes_written,
+ bytes_to_write, output + *output_len,
+ output_size - *output_len, &len);
+ ASSERT_STATUS(status, PSA_SUCCESS);
+
+ bytes_written += bytes_to_write;
+ *output_len += len;
+ }
+
+ status = psa_cipher_finish(operation, output + *output_len,
+ output_size - *output_len, &len);
+ ASSERT_STATUS(status, PSA_SUCCESS);
+ *output_len += len;
+
+exit:
+ return status;
+}
+
+static int aes_cbc_ctr_psa(const u8 *key, size_t key_len, const u8 *iv,
+ u8 *data, size_t data_len, psa_algorithm_t alg,
+ psa_key_usage_t usage)
+{
+ psa_status_t status;
+ psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
+ mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT;
+ psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT;
+ psa_key_type_t key_type = PSA_KEY_TYPE_AES;
+ size_t out_len = 0;
+ u8 *outbuf;
+
+ outbuf = os_malloc(data_len ? data_len : 1);
+ if (!outbuf)
+ return -1;
+
+ crypto_psa_set_attributes(&attributes, key_type, alg, usage);
+
+ status = psa_import_key(&attributes, key, key_len, &key_id);
+ ASSERT_STATUS(status, PSA_SUCCESS);
+ psa_reset_key_attributes(&attributes);
+
+ if (usage == PSA_KEY_USAGE_ENCRYPT)
+ status = psa_cipher_encrypt_setup(&operation, key_id, alg);
+ else
+ status = psa_cipher_decrypt_setup(&operation, key_id, alg);
+ ASSERT_STATUS(status, PSA_SUCCESS);
+
+ status = psa_cipher_set_iv(&operation, iv,
+ PSA_CIPHER_IV_LENGTH(key_type, alg));
+ ASSERT_STATUS(status, PSA_SUCCESS);
+
+ status = crypto_psa_cipher_op(&operation, data, data_len,
+ PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type),
+ outbuf, data_len, &out_len);
+ ASSERT_STATUS(status, PSA_SUCCESS);
+
+ os_memcpy(data, outbuf, out_len);
+exit:
+ psa_cipher_abort(&operation);
+ if (key_id != MBEDTLS_SVC_KEY_ID_INIT)
+ psa_destroy_key(key_id);
+ bin_clear_free(outbuf, data_len);
+ return status == PSA_SUCCESS ? 0 : -1;
+}
+
+static int aes_128_cbc_encrypt_psa(const u8 *key, const u8 *iv, u8 *data,
+ size_t data_len)
+{
+ return aes_cbc_ctr_psa(key, 16, iv, data, data_len,
+ PSA_ALG_CBC_NO_PADDING, PSA_KEY_USAGE_ENCRYPT);
+}
+
+static int aes_128_cbc_decrypt_psa(const u8 *key, const u8 *iv, u8 *data,
+ size_t data_len)
+{
+ return aes_cbc_ctr_psa(key, 16, iv, data, data_len,
+ PSA_ALG_CBC_NO_PADDING, PSA_KEY_USAGE_DECRYPT);
+}
+
+static int aes_ctr_encrypt_psa(const u8 *key, size_t key_len, const u8 *nonce,
+ u8 *data, size_t data_len)
+{
+ return aes_cbc_ctr_psa(key, key_len, nonce, data, data_len,
+ PSA_ALG_CTR, PSA_KEY_USAGE_ENCRYPT);
+}
+
+static int omac1_aes_vector_psa(const u8 *key, size_t key_len, size_t num_elem,
+ const u8 *addr[], const size_t *len, u8 *mac)
+{
+ psa_status_t status;
+ psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
+ psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT;
+ mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT;
+ psa_algorithm_t alg = PSA_ALG_CMAC;
+ size_t i;
+ size_t out_len = 0;
+
+ if (key_len != 16 && key_len != 24 && key_len != 32)
+ return -1;
+
+ crypto_psa_set_attributes(&attributes, PSA_KEY_TYPE_AES, alg,
+ PSA_KEY_USAGE_SIGN_MESSAGE);
+
+ status = psa_import_key(&attributes, key, key_len, &key_id);
+ ASSERT_STATUS(status, PSA_SUCCESS);
+ psa_reset_key_attributes(&attributes);
+
+ status = psa_mac_sign_setup(&operation, key_id, alg);
+ ASSERT_STATUS(status, PSA_SUCCESS);
+
+ for (i = 0; i < num_elem; i++) {
+ status = psa_mac_update(&operation, addr[i], len[i]);
+ ASSERT_STATUS(status, PSA_SUCCESS);
+ }
+
+ status = psa_mac_sign_finish(&operation, mac,
+ PSA_MAC_LENGTH(PSA_KEY_TYPE_AES,
+ key_len * 8, alg), &out_len);
+ ASSERT_STATUS(status, PSA_SUCCESS);
+
+exit:
+ psa_mac_abort(&operation);
+ if (key_id != MBEDTLS_SVC_KEY_ID_INIT)
+ psa_destroy_key(key_id);
+ return status == PSA_SUCCESS ? 0 : -1;
+}
+
+static int md_vector_psa(size_t num_elem, const u8 *addr[], const size_t *len,
+ u8 *mac, mbedtls_md_type_t md_type)
+{
+ psa_status_t status;
+ psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
+ psa_algorithm_t alg = PSA_ALG_NONE;
+ int block_size;
+ size_t i;
+ size_t out_len = 0;
+
+ crypto_psa_get_hash_alg(md_type, &alg, &block_size);
+ if (alg == PSA_ALG_NONE) {
+ wpa_printf(MSG_ERROR, "md_vector unknown md type %d", md_type);
+ return -1;
+ }
+
+ status = psa_hash_setup(&operation, alg);
+ ASSERT_STATUS(status, PSA_SUCCESS);
+
+ for (i = 0; i < num_elem; i++) {
+ status = psa_hash_update(&operation, addr[i], len[i]);
+ ASSERT_STATUS(status, PSA_SUCCESS);
+ }
+
+ status = psa_hash_finish(&operation, mac, block_size, &out_len);
+ ASSERT_STATUS(status, PSA_SUCCESS);
+
+exit:
+ psa_hash_abort(&operation);
+ return status == PSA_SUCCESS ? 0 : -1;
+}
+
+static int hmac_vector_psa(const u8 *key, size_t key_len, size_t num_elem,
+ const u8 *addr[], const size_t *len, u8 *mac,
+ mbedtls_md_type_t md_type)
+{
+ psa_status_t status;
+ psa_algorithm_t alg = PSA_ALG_NONE;
+ psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
+ psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT;
+ mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT;
+ int block_size;
+ size_t i;
+ size_t out_len = 0;
+
+ crypto_psa_get_hash_alg(md_type, &alg, &block_size);
+ if (alg == PSA_ALG_NONE) {
+ wpa_printf(MSG_ERROR, "hmac_vector unknown md type %d", md_type);
+ return -1;
+ }
+ alg = PSA_ALG_HMAC(alg);
+
+ crypto_psa_set_attributes(&attributes, PSA_KEY_TYPE_HMAC, alg,
+ PSA_KEY_USAGE_SIGN_MESSAGE);
+
+ status = psa_import_key(&attributes, key, key_len, &key_id);
+ ASSERT_STATUS(status, PSA_SUCCESS);
+ psa_reset_key_attributes(&attributes);
+
+ status = psa_mac_sign_setup(&operation, key_id, alg);
+ ASSERT_STATUS(status, PSA_SUCCESS);
+
+ for (i = 0; i < num_elem; i++) {
+ status = psa_mac_update(&operation, addr[i], len[i]);
+ ASSERT_STATUS(status, PSA_SUCCESS);
+ }
+
+ status = psa_mac_sign_finish(&operation, mac,
+ PSA_MAC_LENGTH(PSA_KEY_TYPE_HMAC,
+ key_len * 8, alg), &out_len);
+ ASSERT_STATUS(status, PSA_SUCCESS);
+
+exit:
+ psa_mac_abort(&operation);
+ if (key_id != MBEDTLS_SVC_KEY_ID_INIT)
+ psa_destroy_key(key_id);
+ return status == PSA_SUCCESS ? 0 : -1;
+}
+
+#ifdef CRYPTO_MBEDTLS_PBKDF2_SHA1
+static int pbkdf2_sha1_psa(mbedtls_md_type_t md_alg, const u8 *password,
+ size_t plen, const unsigned char *salt, size_t slen,
+ unsigned int iteration_count, uint32_t key_length,
+ unsigned char *output)
+{
+ psa_status_t status;
+ psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
+ psa_algorithm_t alg = PSA_ALG_NONE;
+ mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT;
+ psa_key_derivation_operation_t operation =
+ PSA_KEY_DERIVATION_OPERATION_INIT;
+ int block_size;
+
+ crypto_psa_get_hash_alg(md_alg, &alg, &block_size);
+ if (alg == PSA_ALG_NONE) {
+ wpa_printf(MSG_ERROR, "pbkdf2 unknown md type %d", md_alg);
+ return -1;
+ }
+
+ psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DERIVE);
+ psa_set_key_lifetime(&attributes, PSA_KEY_LIFETIME_VOLATILE);
+ psa_set_key_algorithm(&attributes, PSA_ALG_PBKDF2_HMAC(alg));
+ psa_set_key_type(&attributes, PSA_KEY_TYPE_PASSWORD);
+ psa_set_key_bits(&attributes, PSA_BYTES_TO_BITS(plen));
+
+ status = psa_import_key(&attributes, password, plen, &key_id);
+ ASSERT_STATUS(status, PSA_SUCCESS);
+
+ status = psa_key_derivation_setup(&operation, PSA_ALG_PBKDF2_HMAC(alg));
+ ASSERT_STATUS(status, PSA_SUCCESS);
+
+ status = psa_key_derivation_input_integer(
+ &operation, PSA_KEY_DERIVATION_INPUT_COST, iteration_count);
+ ASSERT_STATUS(status, PSA_SUCCESS);
+
+ status = psa_key_derivation_input_bytes(
+ &operation, PSA_KEY_DERIVATION_INPUT_SALT, salt, slen);
+ ASSERT_STATUS(status, PSA_SUCCESS);
+
+ status = psa_key_derivation_input_key(
+ &operation, PSA_KEY_DERIVATION_INPUT_PASSWORD, key_id);
+ ASSERT_STATUS(status, PSA_SUCCESS);
+
+ status = psa_key_derivation_output_bytes(&operation, output, key_length);
+ ASSERT_STATUS(status, PSA_SUCCESS);
+
+exit:
+ psa_key_derivation_abort(&operation);
+ psa_destroy_key(key_id);
+ return status == PSA_SUCCESS ? 0 : -1;
+}
+#endif /* CRYPTO_MBEDTLS_PBKDF2_SHA1 */
+
+int crypto_get_random(void *buf, size_t len)
+{
+ return psa_generate_random(buf, len) == PSA_SUCCESS ? 0 : -1;
+}
+
+int crypto_global_init(void)
+{
+ return psa_crypto_init() == PSA_SUCCESS ? 0 : -1;
+}
+
+void crypto_global_deinit(void)
+{
+ mbedtls_psa_crypto_free();
+}
+
+/*
+ * PSA requires psa_crypto_init() before any psa_*() call. hostap only invokes
+ * crypto_global_init() for the internal TLS stack, but this backend needs PSA
+ * ready for all crypto paths (SAE, KDFs, ciphers, module tests, ...), so
+ * initialize it once at load time. psa_crypto_init() is idempotent.
+ */
+static void __attribute__((constructor)) crypto_psa_init_ctor(void)
+{
+ psa_crypto_init();
+}
+
+/*
+ * AES ECB single-block context API. hostap builds aes-gcm.c / aes-ccm.c /
+ * aes-siv.c / aes-eax.c on top of these, so they are needed by GCMP/CCMP,
+ * SuiteB (GCM), FILS (AES-SIV), etc. even though this backend also provides
+ * the higher-level helpers via PSA.
+ */
+struct crypto_psa_aes_ctx {
+ mbedtls_svc_key_id_t key_id;
+ psa_algorithm_t alg;
+};
+
+static void * crypto_psa_aes_init(const u8 *key, size_t len,
+ psa_key_usage_t usage)
+{
+ struct crypto_psa_aes_ctx *ctx;
+ psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
+
+ ctx = os_zalloc(sizeof(*ctx));
+ if (!ctx)
+ return NULL;
+ ctx->alg = PSA_ALG_ECB_NO_PADDING;
+ crypto_psa_set_attributes(&attributes, PSA_KEY_TYPE_AES, ctx->alg,
+ usage);
+ if (psa_import_key(&attributes, key, len, &ctx->key_id) != PSA_SUCCESS) {
+ os_free(ctx);
+ return NULL;
+ }
+ return ctx;
+}
+
+void * aes_encrypt_init(const u8 *key, size_t len)
+{
+ return crypto_psa_aes_init(key, len, PSA_KEY_USAGE_ENCRYPT);
+}
+
+int aes_encrypt(void *ctx, const u8 *plain, u8 *crypt)
+{
+ struct crypto_psa_aes_ctx *c = ctx;
+ size_t out_len = 0;
+
+ return psa_cipher_encrypt(c->key_id, c->alg, plain, 16, crypt, 16,
+ &out_len) == PSA_SUCCESS ? 0 : -1;
+}
+
+void aes_encrypt_deinit(void *ctx)
+{
+ struct crypto_psa_aes_ctx *c = ctx;
+
+ if (!c)
+ return;
+ psa_destroy_key(c->key_id);
+ os_free(c);
+}
+
+void * aes_decrypt_init(const u8 *key, size_t len)
+{
+ return crypto_psa_aes_init(key, len, PSA_KEY_USAGE_DECRYPT);
+}
+
+int aes_decrypt(void *ctx, const u8 *crypt, u8 *plain)
+{
+ struct crypto_psa_aes_ctx *c = ctx;
+ size_t out_len = 0;
+
+ return psa_cipher_decrypt(c->key_id, c->alg, crypt, 16, plain, 16,
+ &out_len) == PSA_SUCCESS ? 0 : -1;
+}
+
+void aes_decrypt_deinit(void *ctx)
+{
+ struct crypto_psa_aes_ctx *c = ctx;
+
+ if (!c)
+ return;
+ psa_destroy_key(c->key_id);
+ os_free(c);
+}
+
+__attribute_noinline__ static int md_vector(
+ size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac, mbedtls_md_type_t md_type)
+{
+ return md_vector_psa(num_elem, addr, len, mac, md_type);
+}
+
+int sha512_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
+{
+ return md_vector(num_elem, addr, len, mac, MBEDTLS_MD_SHA512);
+}
+
+int sha384_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
+{
+ return md_vector(num_elem, addr, len, mac, MBEDTLS_MD_SHA384);
+}
+
+int sha256_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
+{
+ return md_vector(num_elem, addr, len, mac, MBEDTLS_MD_SHA256);
+}
+
+#if defined(PSA_WANT_ALG_SHA_1)
+int sha1_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
+{
+ return md_vector(num_elem, addr, len, mac, MBEDTLS_MD_SHA1);
+}
+#endif
+
+#if defined(PSA_WANT_ALG_MD5)
+int md5_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
+{
+ return md_vector(num_elem, addr, len, mac, MBEDTLS_MD_MD5);
+}
+#endif
+
+#ifdef MBEDTLS_MD4_C
+#include <mbedtls/md4.h>
+int md4_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
+{
+ return md_vector(num_elem, addr, len, mac, MBEDTLS_MD_MD4);
+}
+#endif
+
+/*
+ * Mbed TLS 4 / tf-psa-crypto: legacy mbedtls_md_hmac_* is not available for
+ * these paths; use PSA MAC (psa_mac_*) instead.
+ */
+struct crypto_hash
+{
+ psa_mac_operation_t mac_op;
+ psa_key_id_t key_id;
+ psa_algorithm_t mac_alg;
+ size_t key_len;
+ psa_status_t status;
+};
+
+static void crypto_hash_psa_abort(struct crypto_hash *ctx)
+{
+ psa_mac_abort(&ctx->mac_op);
+ if (ctx->key_id != PSA_KEY_ID_NULL) {
+ psa_destroy_key(ctx->key_id);
+ ctx->key_id = PSA_KEY_ID_NULL;
+ }
+}
+
+static psa_status_t crypto_hash_md_type_to_hmac_alg(mbedtls_md_type_t md_type,
+ psa_algorithm_t *mac_alg)
+{
+ psa_algorithm_t hash_alg = PSA_ALG_NONE;
+
+ switch (md_type) {
+ case MBEDTLS_MD_MD5:
+ hash_alg = PSA_ALG_MD5;
+ break;
+ case MBEDTLS_MD_SHA1:
+ hash_alg = PSA_ALG_SHA_1;
+ break;
+ case MBEDTLS_MD_SHA256:
+ hash_alg = PSA_ALG_SHA_256;
+ break;
+ case MBEDTLS_MD_SHA384:
+ hash_alg = PSA_ALG_SHA_384;
+ break;
+ case MBEDTLS_MD_SHA512:
+ hash_alg = PSA_ALG_SHA_512;
+ break;
+ default:
+ return PSA_ERROR_NOT_SUPPORTED;
+ }
+
+ *mac_alg = PSA_ALG_HMAC(hash_alg);
+ return PSA_SUCCESS;
+}
+
+struct crypto_hash *crypto_hash_init(enum crypto_hash_alg alg, const u8 *key, size_t key_len)
+{
+ struct crypto_hash *ctx;
+ mbedtls_md_type_t md_type;
+ psa_algorithm_t mac_alg;
+ psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
+ psa_status_t st;
+
+ switch (alg) {
+ case CRYPTO_HASH_ALG_HMAC_MD5:
+ md_type = MBEDTLS_MD_MD5;
+ break;
+ case CRYPTO_HASH_ALG_HMAC_SHA1:
+ md_type = MBEDTLS_MD_SHA1;
+ break;
+ case CRYPTO_HASH_ALG_HMAC_SHA256:
+ md_type = MBEDTLS_MD_SHA256;
+ break;
+ case CRYPTO_HASH_ALG_SHA384:
+ md_type = MBEDTLS_MD_SHA384;
+ break;
+ case CRYPTO_HASH_ALG_SHA512:
+ md_type = MBEDTLS_MD_SHA512;
+ break;
+ default:
+ return NULL;
+ }
+
+ ctx = os_zalloc(sizeof(*ctx));
+ if (ctx == NULL) {
+ return NULL;
+ }
+
+ ctx->mac_op = psa_mac_operation_init();
+ ctx->key_id = PSA_KEY_ID_NULL;
+ ctx->key_len = key_len;
+ ctx->status = PSA_ERROR_GENERIC_ERROR;
+
+ st = crypto_hash_md_type_to_hmac_alg(md_type, &mac_alg);
+ if (st != PSA_SUCCESS) {
+ os_free(ctx);
+ return NULL;
+ }
+ ctx->mac_alg = mac_alg;
+
+ psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_MESSAGE);
+ psa_set_key_lifetime(&attributes, PSA_KEY_LIFETIME_VOLATILE);
+ psa_set_key_algorithm(&attributes, mac_alg);
+ psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC);
+ psa_set_key_bits(&attributes, PSA_BYTES_TO_BITS(key_len));
+
+ st = psa_import_key(&attributes, key, key_len, &ctx->key_id);
+ psa_reset_key_attributes(&attributes);
+ if (st != PSA_SUCCESS) {
+ os_free(ctx);
+ return NULL;
+ }
+
+ st = psa_mac_sign_setup(&ctx->mac_op, ctx->key_id, mac_alg);
+ if (st != PSA_SUCCESS) {
+ crypto_hash_psa_abort(ctx);
+ os_free(ctx);
+ return NULL;
+ }
+
+ ctx->status = PSA_SUCCESS;
+ return ctx;
+}
+
+void crypto_hash_update(struct crypto_hash *ctx, const u8 *data, size_t len)
+{
+ if (ctx == NULL || ctx->status != PSA_SUCCESS) {
+ return;
+ }
+
+ ctx->status = psa_mac_update(&ctx->mac_op, data, len);
+}
+
+int crypto_hash_finish(struct crypto_hash *ctx, u8 *mac, size_t *len)
+{
+ size_t mac_len;
+ size_t out_len = 0;
+
+ if (ctx == NULL) {
+ return -2;
+ }
+
+ if (mac == NULL || len == NULL) {
+ crypto_hash_psa_abort(ctx);
+ bin_clear_free(ctx, sizeof(*ctx));
+ return 0;
+ }
+
+ if (ctx->status != PSA_SUCCESS) {
+ crypto_hash_psa_abort(ctx);
+ bin_clear_free(ctx, sizeof(*ctx));
+ return -2;
+ }
+
+ mac_len = PSA_MAC_LENGTH(PSA_KEY_TYPE_HMAC, PSA_BYTES_TO_BITS(ctx->key_len), ctx->mac_alg);
+ if (*len < mac_len) {
+ *len = mac_len;
+ crypto_hash_psa_abort(ctx);
+ bin_clear_free(ctx, sizeof(*ctx));
+ return -1;
+ }
+
+ ctx->status = psa_mac_sign_finish(&ctx->mac_op, mac, mac_len, &out_len);
+ psa_mac_abort(&ctx->mac_op);
+ if (ctx->key_id != PSA_KEY_ID_NULL) {
+ psa_destroy_key(ctx->key_id);
+ ctx->key_id = PSA_KEY_ID_NULL;
+ }
+
+ *len = out_len;
+ if (ctx->status != PSA_SUCCESS) {
+ bin_clear_free(ctx, sizeof(*ctx));
+ return -2;
+ }
+
+ bin_clear_free(ctx, sizeof(*ctx));
+ return 0;
+}
+
+__attribute_noinline__ static int hmac_vector(const u8 *key,
+ size_t key_len,
+ size_t num_elem,
+ const u8 *addr[],
+ const size_t *len,
+ u8 *mac,
+ mbedtls_md_type_t md_type)
+{
+ return hmac_vector_psa(key, key_len, num_elem, addr, len, mac, md_type);
+}
+
+int hmac_sha512_vector(const u8 *key, size_t key_len, size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
+{
+ return hmac_vector(key, key_len, num_elem, addr, len, mac, MBEDTLS_MD_SHA512);
+}
+
+int hmac_sha512(const u8 *key, size_t key_len, const u8 *data, size_t data_len, u8 *mac)
+{
+ return hmac_vector(key, key_len, 1, &data, &data_len, mac, MBEDTLS_MD_SHA512);
+}
+
+int hmac_sha384_vector(const u8 *key, size_t key_len, size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
+{
+ return hmac_vector(key, key_len, num_elem, addr, len, mac, MBEDTLS_MD_SHA384);
+}
+
+int hmac_sha384(const u8 *key, size_t key_len, const u8 *data, size_t data_len, u8 *mac)
+{
+ return hmac_vector(key, key_len, 1, &data, &data_len, mac, MBEDTLS_MD_SHA384);
+}
+
+int hmac_sha256_vector(const u8 *key, size_t key_len, size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
+{
+ return hmac_vector(key, key_len, num_elem, addr, len, mac, MBEDTLS_MD_SHA256);
+}
+
+int hmac_sha256(const u8 *key, size_t key_len, const u8 *data, size_t data_len, u8 *mac)
+{
+ return hmac_vector(key, key_len, 1, &data, &data_len, mac, MBEDTLS_MD_SHA256);
+}
+
+#if defined(PSA_WANT_ALG_SHA_1)
+int hmac_sha1_vector(const u8 *key, size_t key_len, size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
+{
+ return hmac_vector(key, key_len, num_elem, addr, len, mac, MBEDTLS_MD_SHA1);
+}
+
+int hmac_sha1(const u8 *key, size_t key_len, const u8 *data, size_t data_len, u8 *mac)
+{
+ return hmac_vector(key, key_len, 1, &data, &data_len, mac, MBEDTLS_MD_SHA1);
+}
+#endif
+
+#if defined(PSA_WANT_ALG_MD5)
+int hmac_md5_vector(const u8 *key, size_t key_len, size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
+{
+ return hmac_vector(key, key_len, num_elem, addr, len, mac, MBEDTLS_MD_MD5);
+}
+
+int hmac_md5(const u8 *key, size_t key_len, const u8 *data, size_t data_len, u8 *mac)
+{
+ return hmac_vector(key, key_len, 1, &data, &data_len, mac, MBEDTLS_MD_MD5);
+}
+#endif
+
+#if defined(PSA_WANT_ALG_HKDF)
+#include <psa/crypto.h>
+
+/* Perform "_op_" PSA API call and check if it succeeded. If not return
+ * "_ret_fail_".
+ * Note that operations using "psa_status" can be specified as second argument
+ * like "do_something(psa_status)".
+*/
+#define PSA_CHECK(_op_, _ret_fail_) \
+ do { \
+ psa_status_t psa_status; \
+ psa_status = _op_; \
+ if (psa_status != PSA_SUCCESS) { \
+ return _ret_fail_; \
+ } \
+ } while(0)
+/* sha256-kdf.c sha384-kdf.c sha512-kdf.c */
+
+/* HMAC-SHA256 KDF (RFC 5295) and HKDF-Expand(SHA256) (RFC 5869) */
+/* HMAC-SHA384 KDF (RFC 5295) and HKDF-Expand(SHA384) (RFC 5869) */
+/* HMAC-SHA512 KDF (RFC 5295) and HKDF-Expand(SHA512) (RFC 5869) */
+__attribute_noinline__ static int hmac_kdf_expand(const u8 *prk,
+ size_t prk_len,
+ const char *label,
+ const u8 *info,
+ size_t info_len,
+ u8 *okm,
+ size_t okm_len,
+ mbedtls_md_type_t md_type)
+{
+ if (TEST_FAIL())
+ return -1;
+
+ /* RFC 5869 HKDF-Expand when (label == NULL) */
+ if (label == NULL) {
+ psa_key_derivation_operation_t psa_op = PSA_KEY_DERIVATION_OPERATION_INIT;
+ psa_algorithm_t psa_hash_alg = mbedtls_md_psa_alg_from_type(md_type);
+
+ PSA_CHECK(psa_key_derivation_setup(&psa_op, PSA_ALG_HKDF_EXPAND(psa_hash_alg)), -1);
+ PSA_CHECK(psa_key_derivation_input_bytes(&psa_op, PSA_KEY_DERIVATION_INPUT_SECRET,
+ prk, prk_len), -1);
+ PSA_CHECK(psa_key_derivation_input_bytes(&psa_op, PSA_KEY_DERIVATION_INPUT_INFO,
+ info, info_len), -1);
+ PSA_CHECK(psa_key_derivation_output_bytes(&psa_op, okm, okm_len), -1);
+ PSA_CHECK(psa_key_derivation_abort(&psa_op), -1);
+ return 0;
+ }
+
+ {
+ psa_algorithm_t hash_alg = mbedtls_md_psa_alg_from_type(md_type);
+ const size_t mac_len = PSA_HASH_LENGTH(hash_alg);
+
+ /* okm_len must not exceed 255 times hash len (RFC 5869 Section 2.3) */
+ if (okm_len > ((mac_len << 8) - mac_len)) {
+ return -1;
+ }
+
+ u8 iter = 1;
+ const u8 *addr[4] = {okm, (const u8 *)label, info, &iter};
+ size_t lens[4] = {0, label ? (size_t)os_strlen(label) + 1 : 0, info_len, 1};
+
+ for (; okm_len >= mac_len; okm_len -= mac_len, ++iter) {
+ if (hmac_vector_psa(prk, prk_len, 4, addr, lens, okm, md_type) != 0) {
+ return -1;
+ }
+ addr[0] = okm;
+ okm += mac_len;
+ lens[0] = mac_len; /*(include digest in subsequent rounds)*/
+ }
+
+ if (okm_len) {
+ u8 hash[MBEDTLS_MD_MAX_SIZE];
+
+ if (hmac_vector_psa(prk, prk_len, 4, addr, lens, hash, md_type) != 0) {
+ return -1;
+ }
+ os_memcpy(okm, hash, okm_len);
+ forced_memzero(hash, mac_len);
+ }
+ }
+
+ return 0;
+}
+
+int hmac_sha512_kdf(
+ const u8 *secret, size_t secret_len, const char *label, const u8 *seed, size_t seed_len, u8 *out, size_t outlen)
+{
+ return hmac_kdf_expand(secret, secret_len, label, seed, seed_len, out, outlen, MBEDTLS_MD_SHA512);
+}
+
+int hmac_sha384_kdf(
+ const u8 *secret, size_t secret_len, const char *label, const u8 *seed, size_t seed_len, u8 *out, size_t outlen)
+{
+ return hmac_kdf_expand(secret, secret_len, label, seed, seed_len, out, outlen, MBEDTLS_MD_SHA384);
+}
+
+int hmac_sha256_kdf(
+ const u8 *secret, size_t secret_len, const char *label, const u8 *seed, size_t seed_len, u8 *out, size_t outlen)
+{
+ return hmac_kdf_expand(secret, secret_len, label, seed, seed_len, out, outlen, MBEDTLS_MD_SHA256);
+}
+#endif /* PSA_WANT_ALG_HKDF */
+
+/* sha256-prf.c sha384-prf.c sha512-prf.c */
+
+/* hmac_prf_bits - IEEE Std 802.11ac-2013, 11.6.1.7.2 Key derivation function */
+__attribute_noinline__ static int hmac_prf_bits(const uint8_t *key,
+ size_t key_len,
+ const char *label,
+ const uint8_t *data,
+ size_t data_len,
+ uint8_t *buf,
+ size_t buf_len_bits,
+ psa_algorithm_t alg)
+{
+ psa_status_t status;
+ psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
+ psa_key_id_t key_id = PSA_KEY_ID_NULL;
+ psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT;
+ psa_algorithm_t hash_alg = PSA_ALG_HMAC_GET_HASH(alg);
+ size_t mac_len = PSA_HASH_LENGTH(hash_alg);
+ size_t buf_len = (buf_len_bits + 7) / 8;
+ u16 ctr;
+ u16 n_le = host_to_le16(buf_len_bits);
+ const u8 *const addr[] = {(u8 *)&ctr, (u8 *)label, data, (u8 *)&n_le};
+ const size_t len[] = {2, os_strlen(label), data_len, 2};
+
+ if (TEST_FAIL())
+ return -1;
+
+ /* Import HMAC key into PSA */
+ psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_VERIFY_HASH);
+ psa_set_key_algorithm(&attributes, alg);
+ psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC);
+ psa_set_key_lifetime(&attributes, PSA_KEY_LIFETIME_VOLATILE);
+ status = psa_import_key(&attributes, key, key_len, &key_id);
+ if (status != PSA_SUCCESS) {
+ return -1;
+ }
+
+ /* Generate output in mac_len chunks */
+ for (ctr = 1; buf_len >= mac_len; buf_len -= mac_len, ++ctr) {
+#if __BYTE_ORDER == __BIG_ENDIAN
+ ctr = host_to_le16(ctr);
+#endif
+ status = psa_mac_sign_setup(&operation, key_id, alg);
+ if (status != PSA_SUCCESS) {
+ goto cleanup;
+ }
+
+ /* Update MAC with all input chunks: counter || label || data || length */
+ for (size_t i = 0; i < ARRAY_SIZE(addr); ++i) {
+ status = psa_mac_update(&operation, addr[i], len[i]);
+ if (status != PSA_SUCCESS) {
+ psa_mac_abort(&operation);
+ goto cleanup;
+ }
+ }
+
+ /* Finalize MAC and write to output buffer */
+ size_t mac_output_len;
+ status = psa_mac_sign_finish(&operation, buf, mac_len, &mac_output_len);
+ if (status != PSA_SUCCESS) {
+ psa_mac_abort(&operation);
+ goto cleanup;
+ }
+
+ buf += mac_len;
+#if __BYTE_ORDER == __BIG_ENDIAN
+ ctr = le_to_host16(ctr);
+#endif
+ }
+
+ /* Handle remaining bytes (less than one full MAC length) */
+ if (buf_len) {
+ u8 hash[PSA_MAC_MAX_SIZE];
+ size_t mac_output_len;
+
+#if __BYTE_ORDER == __BIG_ENDIAN
+ ctr = host_to_le16(ctr);
+#endif
+ status = psa_mac_sign_setup(&operation, key_id, alg);
+ if (status != PSA_SUCCESS) {
+ goto cleanup;
+ }
+
+ for (size_t i = 0; i < ARRAY_SIZE(addr); ++i) {
+ status = psa_mac_update(&operation, addr[i], len[i]);
+ if (status != PSA_SUCCESS) {
+ psa_mac_abort(&operation);
+ goto cleanup;
+ }
+ }
+
+ status = psa_mac_sign_finish(&operation, hash, sizeof(hash), &mac_output_len);
+ if (status != PSA_SUCCESS) {
+ psa_mac_abort(&operation);
+ goto cleanup;
+ }
+
+ os_memcpy(buf, hash, buf_len);
+ buf += buf_len;
+ forced_memzero(hash, mac_output_len);
+ }
+
+ /* Mask out unused bits in last octet if needed */
+ if ((buf_len_bits &= 0x7)) {
+ buf[-1] &= (u8)(0xff << (8 - buf_len_bits));
+ }
+
+ psa_destroy_key(key_id);
+ return 0;
+
+cleanup:
+ if (key_id != PSA_KEY_ID_NULL) {
+ psa_destroy_key(key_id);
+ }
+ return -1;
+}
+
+int sha512_prf(
+ const u8 *key, size_t key_len, const char *label, const u8 *data, size_t data_len, u8 *buf, size_t buf_len)
+{
+ return hmac_prf_bits(key, key_len, label, data, data_len, buf, buf_len * 8, PSA_ALG_HMAC(PSA_ALG_SHA_512));
+}
+
+int sha384_prf(
+ const u8 *key, size_t key_len, const char *label, const u8 *data, size_t data_len, u8 *buf, size_t buf_len)
+{
+ return hmac_prf_bits(key, key_len, label, data, data_len, buf, buf_len * 8, PSA_ALG_HMAC(PSA_ALG_SHA_384));
+}
+
+/**
+ * Based on Supplicant internal implementaion of SHA-256. This API
+ * uses PSA APIs instead of Supplicant internal implementation or
+ * mbedtls APIs.
+ */
+static int hmac_prf256(const u8 *key,
+ size_t key_len,
+ const char *label,
+ const u8 *data,
+ size_t data_len,
+ u8 *buf_in,
+ size_t buf_len_bits,
+ mbedtls_md_type_t md_type)
+{
+ unsigned short ctr, n_le = host_to_le16(buf_len_bits);
+ const u8 *addr[] = {(u8 *)&ctr, (u8 *)label, data, (u8 *)&n_le};
+ const size_t len[] = {2, os_strlen(label), data_len, 2};
+ size_t buf_len = (buf_len_bits + 7) / 8;
+ u8 *buf = buf_in;
+
+ for (ctr = 1; buf_len >= SHA256_MAC_LEN; buf_len -= SHA256_MAC_LEN, ++ctr)
+ {
+ if (hmac_sha256_vector(key, key_len, 4, addr, len, buf))
+ return -1;
+ buf += SHA256_MAC_LEN;
+ }
+
+ if (buf_len)
+ {
+ u8 hash[SHA256_MAC_LEN];
+ if (hmac_sha256_vector(key, key_len, 4, addr, len, hash))
+ return -1;
+ os_memcpy(buf, hash, buf_len);
+ forced_memzero(hash, sizeof(hash));
+ }
+
+ /* Mask out unused bits in last octet if it does not use all the bits */
+ if ((buf_len_bits &= 0x7))
+ buf[-1] &= (u8)(0xff << (8 - buf_len_bits));
+
+ return 0;
+}
+
+int sha256_prf(
+ const u8 *key, size_t key_len, const char *label, const u8 *data, size_t data_len, u8 *buf, size_t buf_len)
+{
+ return hmac_prf256(key, key_len, label, data, data_len, buf, buf_len * 8, MBEDTLS_MD_SHA256);
+}
+
+int sha256_prf_bits(
+ const u8 *key, size_t key_len, const char *label, const u8 *data, size_t data_len, u8 *buf, size_t buf_len_bits)
+{
+ return hmac_prf_bits(key, key_len, label, data, data_len, buf, buf_len_bits, PSA_ALG_HMAC(PSA_ALG_SHA_256));
+}
+
+#if defined(PSA_WANT_ALG_SHA_1)
+
+/* sha1-prf.c */
+
+/* sha1_prf - SHA1-based Pseudo-Random Function (PRF) (IEEE 802.11i, 8.5.1.1) */
+
+int sha1_prf(const u8 *key, size_t key_len, const char *label, const u8 *data, size_t data_len, u8 *buf, size_t buf_len)
+{
+ /*(note: algorithm differs from hmac_prf_bits() */
+ /*(note: smaller code size instead of expanding hmac_sha1_vector()
+ * as is done in hmac_prf_bits(); not expecting large num of loops) */
+ u8 counter = 0;
+ const u8 *addr[] = {(u8 *)label, data, &counter};
+ const size_t len[] = {os_strlen(label) + 1, data_len, 1};
+
+ for (; buf_len >= SHA1_MAC_LEN; buf_len -= SHA1_MAC_LEN, ++counter)
+ {
+ if (hmac_sha1_vector(key, key_len, 3, addr, len, buf))
+ return -1;
+ buf += SHA1_MAC_LEN;
+ }
+
+ if (buf_len)
+ {
+ u8 hash[SHA1_MAC_LEN];
+ if (hmac_sha1_vector(key, key_len, 3, addr, len, hash))
+ return -1;
+ os_memcpy(buf, hash, buf_len);
+ forced_memzero(hash, sizeof(hash));
+ }
+
+ return 0;
+}
+
+#ifdef CRYPTO_MBEDTLS_SHA1_T_PRF
+
+/* sha1-tprf.c */
+
+/* sha1_t_prf - EAP-FAST Pseudo-Random Function (T-PRF) (RFC 4851,Section 5.5)*/
+
+int sha1_t_prf(
+ const u8 *key, size_t key_len, const char *label, const u8 *seed, size_t seed_len, u8 *buf, size_t buf_len)
+{
+ /*(note: algorithm differs from hmac_prf_bits() and hmac_kdf() above)*/
+ /*(note: smaller code size instead of expanding hmac_sha1_vector()
+ * as is done in hmac_prf_bits(); not expecting large num of loops) */
+ u8 ctr;
+ u16 olen = host_to_be16(buf_len);
+ const u8 *addr[] = {buf, (u8 *)label, seed, (u8 *)&olen, &ctr};
+ size_t len[] = {0, os_strlen(label) + 1, seed_len, 2, 1};
+
+ for (ctr = 1; buf_len >= SHA1_MAC_LEN; buf_len -= SHA1_MAC_LEN, ++ctr)
+ {
+ if (hmac_sha1_vector(key, key_len, 5, addr, len, buf))
+ return -1;
+ addr[0] = buf;
+ buf += SHA1_MAC_LEN;
+ len[0] = SHA1_MAC_LEN; /*(include digest in subsequent rounds)*/
+ }
+
+ if (buf_len)
+ {
+ u8 hash[SHA1_MAC_LEN];
+ if (hmac_sha1_vector(key, key_len, 5, addr, len, hash))
+ return -1;
+ os_memcpy(buf, hash, buf_len);
+ forced_memzero(hash, sizeof(hash));
+ }
+
+ return 0;
+}
+
+#endif /* CRYPTO_MBEDTLS_SHA1_T_PRF */
+#endif /* PSA_WANT_ALG_SHA_1 */
+
+/*
+ * DES was removed from MbedTLS 4 / TF-PSA-Crypto and PSA has no single-DES
+ * primitive; des_encrypt() (EAP-MSCHAPv2/LEAP) is provided by hostap's own
+ * des-internal.c, which the Makefile keeps compiled for CONFIG_TLS=psa.
+ */
+
+#ifdef CRYPTO_MBEDTLS_PBKDF2_SHA1
+/* sha1-pbkdf2.c */
+int pbkdf2_sha1(const char *passphrase, const u8 *ssid, size_t ssid_len, int iterations, u8 *buf, size_t buflen)
+{
+ return pbkdf2_sha1_psa(MBEDTLS_MD_SHA1, (const u8 *)passphrase,
+ os_strlen(passphrase), ssid, ssid_len,
+ iterations, 32, buf) ? -1: 0;
+}
+
+int pbkdf2_sha256(const char *passphrase, const u8 *salt, size_t salt_len,
+ int iterations, u8 *buf, size_t buflen)
+{
+ return pbkdf2_sha1_psa(MBEDTLS_MD_SHA256, (const u8 *)passphrase,
+ os_strlen(passphrase), salt, salt_len,
+ iterations, buflen, buf) ? -1 : 0;
+}
+
+int pbkdf2_sha384(const char *passphrase, const u8 *salt, size_t salt_len,
+ int iterations, u8 *buf, size_t buflen)
+{
+ return pbkdf2_sha1_psa(MBEDTLS_MD_SHA384, (const u8 *)passphrase,
+ os_strlen(passphrase), salt, salt_len,
+ iterations, buflen, buf) ? -1 : 0;
+}
+#endif
+
+#include "aes_wrap.h"
+
+#ifdef MBEDTLS_NIST_KW_C
+
+#include <mbedtls/nist_kw.h>
+#include <psa/crypto.h>
+
+/* aes-wrap.c */
+int aes_wrap(const u8 *kek, size_t kek_len, int n, const u8 *plain, u8 *cipher)
+{
+ if (TEST_FAIL())
+ return -1;
+
+ psa_key_id_t key_id = PSA_KEY_ID_NULL;
+ psa_key_attributes_t key_attr = PSA_KEY_ATTRIBUTES_INIT;
+ size_t olen;
+ psa_status_t status;
+ int ret;
+
+ psa_set_key_type(&key_attr, PSA_KEY_TYPE_AES);
+ psa_set_key_algorithm(&key_attr, PSA_ALG_ECB_NO_PADDING);
+ psa_set_key_usage_flags(&key_attr, PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT);
+ status = psa_import_key(&key_attr, kek, kek_len, &key_id);
+ if (status != PSA_SUCCESS) {
+ return -1;
+ }
+
+ ret = mbedtls_nist_kw_wrap(key_id, MBEDTLS_KW_MODE_KW, plain, n * 8, cipher, (n + 1) * 8, &olen);
+
+ psa_reset_key_attributes(&key_attr);
+ psa_destroy_key(key_id);
+
+ return (ret != 0) ? -1 : 0;
+}
+
+/* aes-unwrap.c */
+int aes_unwrap(const u8 *kek, size_t kek_len, int n, const u8 *cipher, u8 *plain)
+{
+ if (TEST_FAIL())
+ return -1;
+
+ psa_key_id_t key_id = PSA_KEY_ID_NULL;
+ psa_key_attributes_t key_attr = PSA_KEY_ATTRIBUTES_INIT;
+ size_t olen;
+ psa_status_t status;
+ int ret;
+
+ psa_set_key_type(&key_attr, PSA_KEY_TYPE_AES);
+ psa_set_key_algorithm(&key_attr, PSA_ALG_ECB_NO_PADDING);
+ psa_set_key_usage_flags(&key_attr, PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT);
+ status = psa_import_key(&key_attr, kek, kek_len, &key_id);
+ if (status != PSA_SUCCESS) {
+ return -1;
+ }
+
+ ret = mbedtls_nist_kw_unwrap(key_id, MBEDTLS_KW_MODE_KW, cipher, (n + 1) * 8, plain, n * 8, &olen);
+
+ psa_reset_key_attributes(&key_attr);
+ psa_destroy_key(key_id);
+
+ return (ret != 0) ? -1 : 0;
+}
+#endif /* MBEDTLS_NIST_KW_C */
+
+#if defined(PSA_WANT_ALG_CMAC)
+
+/* aes-omac1.c */
+
+int omac1_aes_vector(const u8 *key, size_t key_len, size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
+{
+ return omac1_aes_vector_psa(key, key_len, num_elem, addr, len, mac);
+}
+
+int omac1_aes_128_vector(const u8 *key, size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
+{
+ return omac1_aes_vector(key, 16, num_elem, addr, len, mac);
+}
+
+int omac1_aes_128(const u8 *key, const u8 *data, size_t data_len, u8 *mac)
+{
+ return omac1_aes_vector(key, 16, 1, &data, &data_len, mac);
+}
+
+int omac1_aes_256(const u8 *key, const u8 *data, size_t data_len, u8 *mac)
+{
+ return omac1_aes_vector(key, 32, 1, &data, &data_len, mac);
+}
+
+#else
+
+//#include "aes-omac1.c" /* pull in hostap local implementation */
+
+#ifndef MBEDTLS_AES_BLOCK_SIZE
+#define MBEDTLS_AES_BLOCK_SIZE 16
+#endif
+
+#endif /* PSA_WANT_ALG_CMAC */
+
+#if defined(PSA_WANT_KEY_TYPE_AES)
+
+/* These interfaces can be inefficient when used in loops, as the overhead of
+ * initialization each call is large for each block input (e.g. 16 bytes) */
+
+/* aes_128_encrypt_block() is provided by hostap's aes-encblock.c on top of the
+ * aes_encrypt_init()/aes_encrypt() ECB context API implemented below. */
+
+/* aes-ctr.c */
+int aes_ctr_encrypt(const u8 *key, size_t key_len, const u8 *nonce, u8 *data, size_t data_len)
+{
+ return aes_ctr_encrypt_psa(key, key_len, nonce, data, data_len);
+}
+
+int aes_128_ctr_encrypt(const u8 *key, const u8 *nonce, u8 *data, size_t data_len)
+{
+ return aes_ctr_encrypt(key, 16, nonce, data, data_len);
+}
+
+#define HOSTAP_AES_ENCRYPT 0
+#define HOSTAP_AES_DECRYPT 1
+
+/* aes-cbc.c */
+static int aes_128_cbc_oper(const u8 *key, const u8 *iv, u8 *data, size_t data_len, int mode)
+{
+ if (mode == HOSTAP_AES_ENCRYPT)
+ return aes_128_cbc_encrypt_psa(key, iv, data, data_len);
+ else
+ return aes_128_cbc_decrypt_psa(key, iv, data, data_len);
+}
+
+int aes_128_cbc_encrypt(const u8 *key, const u8 *iv, u8 *data, size_t data_len)
+{
+ if (TEST_FAIL())
+ return -1;
+
+ return aes_128_cbc_oper(key, iv, data, data_len, HOSTAP_AES_ENCRYPT);
+}
+
+int aes_128_cbc_decrypt(const u8 *key, const u8 *iv, u8 *data, size_t data_len)
+{
+ if (TEST_FAIL())
+ return -1;
+
+ return aes_128_cbc_oper(key, iv, data, data_len, HOSTAP_AES_DECRYPT);
+}
+#endif /* PSA_WANT_KEY_TYPE_AES */
+
+/*
+ * Much of the following is documented in crypto.h as for CONFIG_TLS=internal
+ * but such comments are not accurate:
+ *
+ * "This function is only used with internal TLSv1 implementation
+ * (CONFIG_TLS=internal). If that is not used, the crypto wrapper does not need
+ * to implement this."
+ */
+
+#ifdef CRYPTO_MBEDTLS_CRYPTO_CIPHER
+
+#include <mbedtls/private/cipher.h>
+
+struct crypto_cipher
+{
+ mbedtls_cipher_context_t ctx_enc;
+ mbedtls_cipher_context_t ctx_dec;
+};
+
+struct crypto_cipher *crypto_cipher_init(enum crypto_cipher_alg alg, const u8 *iv, const u8 *key, size_t key_len)
+{
+ /* IKEv2 src/eap_common/ikev2_common.c:ikev2_{encr,decr}_encrypt()
+ * uses one of CRYPTO_CIPHER_ALG_AES or CRYPTO_CIPHER_ALG_3DES */
+
+ mbedtls_cipher_type_t cipher_type;
+ size_t iv_len;
+ switch (alg)
+ {
+#ifdef PSA_WANT_KEY_TYPE_AES
+ case CRYPTO_CIPHER_ALG_AES:
+ if (key_len == 16)
+ cipher_type = MBEDTLS_CIPHER_AES_128_CTR;
+ if (key_len == 24)
+ cipher_type = MBEDTLS_CIPHER_AES_192_CTR;
+ if (key_len == 32)
+ cipher_type = MBEDTLS_CIPHER_AES_256_CTR;
+ iv_len = 16;
+ break;
+#endif
+ default:
+ return NULL;
+ }
+
+ const mbedtls_cipher_info_t *cipher_info;
+ cipher_info = mbedtls_cipher_info_from_type(cipher_type);
+ if (cipher_info == NULL)
+ return NULL;
+
+ key_len *= 8; /* key_bitlen */
+
+ struct crypto_cipher *ctx = os_malloc(sizeof(*ctx));
+ if (!ctx)
+ return NULL;
+
+ mbedtls_cipher_init(&ctx->ctx_enc);
+ mbedtls_cipher_init(&ctx->ctx_dec);
+ if (mbedtls_cipher_setup(&ctx->ctx_enc, cipher_info) == 0 &&
+ mbedtls_cipher_setup(&ctx->ctx_dec, cipher_info) == 0 &&
+ mbedtls_cipher_setkey(&ctx->ctx_enc, key, key_len, MBEDTLS_ENCRYPT) == 0 &&
+ mbedtls_cipher_setkey(&ctx->ctx_dec, key, key_len, MBEDTLS_DECRYPT) == 0 &&
+ mbedtls_cipher_set_iv(&ctx->ctx_enc, iv, iv_len) == 0 &&
+ mbedtls_cipher_set_iv(&ctx->ctx_dec, iv, iv_len) == 0 && mbedtls_cipher_reset(&ctx->ctx_enc) == 0 &&
+ mbedtls_cipher_reset(&ctx->ctx_dec) == 0)
+ {
+ return ctx;
+ }
+
+ mbedtls_cipher_free(&ctx->ctx_enc);
+ mbedtls_cipher_free(&ctx->ctx_dec);
+ os_free(ctx);
+ return NULL;
+}
+
+int crypto_cipher_encrypt(struct crypto_cipher *ctx, const u8 *plain, u8 *crypt, size_t len)
+{
+ size_t olen = 0; /*(poor interface above; unknown size of u8 *crypt)*/
+ return (mbedtls_cipher_update(&ctx->ctx_enc, plain, len, crypt, &olen) ||
+ mbedtls_cipher_finish(&ctx->ctx_enc, crypt + olen, &olen)) ?
+ -1 :
+ 0;
+}
+
+int crypto_cipher_decrypt(struct crypto_cipher *ctx, const u8 *crypt, u8 *plain, size_t len)
+{
+ size_t olen = 0; /*(poor interface above; unknown size of u8 *plain)*/
+ return (mbedtls_cipher_update(&ctx->ctx_dec, crypt, len, plain, &olen) ||
+ mbedtls_cipher_finish(&ctx->ctx_dec, plain + olen, &olen)) ?
+ -1 :
+ 0;
+}
+
+void crypto_cipher_deinit(struct crypto_cipher *ctx)
+{
+ mbedtls_cipher_free(&ctx->ctx_enc);
+ mbedtls_cipher_free(&ctx->ctx_dec);
+ os_free(ctx);
+}
+
+#endif /* CRYPTO_MBEDTLS_CRYPTO_CIPHER */
+
diff --git a/src/crypto/crypto_psa_mbedtls.c b/src/crypto/crypto_psa_mbedtls.c
new file mode 100644
index 000000000..0768bf7d1
--- /dev/null
+++ b/src/crypto/crypto_psa_mbedtls.c
@@ -0,0 +1,2357 @@
+/*
+ * MbedTLS-backed fallback for the PSA crypto backend: bignum, EC-point and
+ * finite-field DH math (and DPP/CSR helpers) that the PSA Crypto API does
+ * not expose. This is the non-portable half of the CONFIG_TLS=psa backend;
+ * the portable, PSA-only primitives live in crypto_psa.c.
+ *
+ * Copyright (c) 2022, Glenn Strauss <gstrauss at gluelogic.com>
+ * Copyright (c) 2023-2024, NXP
+ * Copyright (c) 2024-2026, Nordic Semiconductor ASA
+ *
+ * This software may be distributed under the terms of the BSD license.
+ * See README for more details.
+ *
+ * Derived from the Zephyr Project hostap PSA port.
+ */
+
+#include "utils/includes.h"
+#include "utils/common.h"
+
+/*
+ * SAE/DPP/PASN and finite-field DH need bignum and EC-point math that the PSA
+ * Crypto API does not provide; those come from MbedTLS' builtin (legacy)
+ * modules, whose declarations and struct internals are private in
+ * TF-PSA-Crypto 1.x. Opt in to them here.
+ */
+#define MBEDTLS_DECLARE_PRIVATE_IDENTIFIERS
+#define MBEDTLS_ALLOW_PRIVATE_ACCESS
+
+#include <mbedtls/platform_util.h>
+#include <mbedtls/asn1.h>
+#include <mbedtls/asn1write.h>
+#include <psa/crypto.h>
+#include <mbedtls/psa_util.h>
+
+#ifndef MBEDTLS_PRIVATE
+#define MBEDTLS_PRIVATE(x) x
+#endif
+
+#include "crypto.h"
+
+/* RNG callback shared with crypto_psa.c (PSA-backed). */
+int hostap_rng_fn(void *ctx, unsigned char *buf, size_t buf_size);
+void *hostap_rng_ctx(void);
+
+/*
+ * Selective code inclusion, matching crypto_psa.c: enable the bignum, DH, EC,
+ * ECDH, EC-key and DPP helper groups based on the features that need them.
+ */
+#if defined(EAP_PWD) || defined(EAP_SERVER_PWD) || defined(CONFIG_SAE) \
+ || defined(PSA_WANT_ALG_ECDH)
+#define CRYPTO_MBEDTLS_CRYPTO_BIGNUM
+#endif
+
+#if defined(EAP_PWD) || defined(EAP_EKE) || defined(EAP_EKE_DYNAMIC) \
+ || defined(EAP_SERVER_EKE) || defined(EAP_IKEV2) \
+ || defined(EAP_IKEV2_DYNAMIC) || defined(EAP_SERVER_IKEV2) \
+ || defined(CONFIG_SAE) || defined(CONFIG_WPS)
+#define CRYPTO_MBEDTLS_CRYPTO_DH
+#if defined(CONFIG_WPS_NFC)
+#define CRYPTO_MBEDTLS_DH5_INIT_FIXED
+#endif
+#endif
+
+#if defined(PSA_WANT_ALG_ECDH)
+#define CRYPTO_MBEDTLS_CRYPTO_ECDH
+#endif
+
+#if defined(CONFIG_DPP) || defined(CONFIG_SAE_PK) || defined(EAP_PWD) \
+ || defined(EAP_SERVER_PWD) || defined(CONFIG_SAE)
+#define CRYPTO_MBEDTLS_CRYPTO_EC
+#endif
+
+#if defined(CONFIG_DPP)
+#define CRYPTO_MBEDTLS_CRYPTO_EC_DPP
+#define CRYPTO_MBEDTLS_CRYPTO_CSR
+#endif
+
+#if defined(CONFIG_DPP2)
+#define CRYPTO_MBEDTLS_CRYPTO_PKCS7
+#endif
+
+#if defined(CONFIG_DPP3)
+#define CRYPTO_MBEDTLS_CRYPTO_HPKE
+#endif
+
+#ifdef CRYPTO_MBEDTLS_CRYPTO_BIGNUM
+
+#include <mbedtls/private/bignum.h>
+
+/* crypto.h bignum interfaces */
+
+struct crypto_bignum *crypto_bignum_init(void)
+{
+ if (TEST_FAIL())
+ return NULL;
+
+ mbedtls_mpi *bn = os_malloc(sizeof(*bn));
+ if (bn)
+ mbedtls_mpi_init(bn);
+ return (struct crypto_bignum *)bn;
+}
+
+struct crypto_bignum *crypto_bignum_init_set(const u8 *buf, size_t len)
+{
+ if (TEST_FAIL())
+ return NULL;
+
+ mbedtls_mpi *bn = os_malloc(sizeof(*bn));
+ if (bn)
+ {
+ mbedtls_mpi_init(bn);
+ if (mbedtls_mpi_read_binary(bn, buf, len) == 0)
+ return (struct crypto_bignum *)bn;
+ }
+
+ os_free(bn);
+ return NULL;
+}
+
+struct crypto_bignum *crypto_bignum_init_uint(unsigned int val)
+{
+ if (TEST_FAIL())
+ return NULL;
+
+ mbedtls_mpi *bn = os_malloc(sizeof(*bn));
+ if (bn)
+ {
+ mbedtls_mpi_init(bn);
+ if (mbedtls_mpi_lset(bn, (int)val) == 0)
+ return (struct crypto_bignum *)bn;
+ }
+
+ os_free(bn);
+ return NULL;
+}
+
+void crypto_bignum_deinit(struct crypto_bignum *n, int clear)
+{
+ mbedtls_mpi_free((mbedtls_mpi *)n);
+ os_free(n);
+}
+
+int crypto_bignum_to_bin(const struct crypto_bignum *a, u8 *buf, size_t buflen, size_t padlen)
+{
+ if (TEST_FAIL())
+ return -1;
+
+ size_t n = mbedtls_mpi_size((mbedtls_mpi *)a);
+ if (n < padlen)
+ n = padlen;
+ return n > buflen || mbedtls_mpi_write_binary((mbedtls_mpi *)a, buf, n) ? -1 : (int)(n);
+}
+
+int crypto_bignum_rand(struct crypto_bignum *r, const struct crypto_bignum *m)
+{
+ if (TEST_FAIL())
+ return -1;
+
+ /*assert(r != m);*/ /* r must not be same as m for mbedtls_mpi_random()*/
+ return mbedtls_mpi_random((mbedtls_mpi *)r, 0, (mbedtls_mpi *)m, hostap_rng_fn, hostap_rng_ctx()) ?
+ -1 :
+ 0;
+}
+
+int crypto_bignum_add(const struct crypto_bignum *a, const struct crypto_bignum *b, struct crypto_bignum *c)
+{
+ return mbedtls_mpi_add_mpi((mbedtls_mpi *)c, (const mbedtls_mpi *)a, (const mbedtls_mpi *)b) ? -1 : 0;
+}
+
+int crypto_bignum_mod(const struct crypto_bignum *a, const struct crypto_bignum *b, struct crypto_bignum *c)
+{
+ return mbedtls_mpi_mod_mpi((mbedtls_mpi *)c, (const mbedtls_mpi *)a, (const mbedtls_mpi *)b) ? -1 : 0;
+}
+
+int crypto_bignum_exptmod(const struct crypto_bignum *a,
+ const struct crypto_bignum *b,
+ const struct crypto_bignum *c,
+ struct crypto_bignum *d)
+{
+ if (TEST_FAIL())
+ return -1;
+
+ /* (check if input params match d; d is the result) */
+ /* (a == d) is ok in current mbedtls implementation */
+ if (b == d || c == d)
+ { /*(not ok; store result in intermediate)*/
+ mbedtls_mpi R;
+ mbedtls_mpi_init(&R);
+ int rc =
+ mbedtls_mpi_exp_mod(&R, (const mbedtls_mpi *)a, (const mbedtls_mpi *)b, (const mbedtls_mpi *)c, NULL) ||
+ mbedtls_mpi_copy((mbedtls_mpi *)d, &R) ?
+ -1 :
+ 0;
+ mbedtls_mpi_free(&R);
+ return rc;
+ }
+ else
+ {
+ return mbedtls_mpi_exp_mod((mbedtls_mpi *)d, (const mbedtls_mpi *)a, (const mbedtls_mpi *)b,
+ (const mbedtls_mpi *)c, NULL) ?
+ -1 :
+ 0;
+ }
+}
+
+int crypto_bignum_inverse(const struct crypto_bignum *a, const struct crypto_bignum *b, struct crypto_bignum *c)
+{
+ if (TEST_FAIL())
+ return -1;
+
+ return mbedtls_mpi_inv_mod((mbedtls_mpi *)c, (const mbedtls_mpi *)a, (const mbedtls_mpi *)b) ? -1 : 0;
+}
+
+int crypto_bignum_sub(const struct crypto_bignum *a, const struct crypto_bignum *b, struct crypto_bignum *c)
+{
+ if (TEST_FAIL())
+ return -1;
+
+ return mbedtls_mpi_sub_mpi((mbedtls_mpi *)c, (const mbedtls_mpi *)a, (const mbedtls_mpi *)b) ? -1 : 0;
+}
+
+int crypto_bignum_div(const struct crypto_bignum *a, const struct crypto_bignum *b, struct crypto_bignum *c)
+{
+ if (TEST_FAIL())
+ return -1;
+
+ /*(most current use of this crypto.h interface has a == c (result),
+ * so store result in an intermediate to avoid overwritten input)*/
+ mbedtls_mpi R;
+ mbedtls_mpi_init(&R);
+ int rc = mbedtls_mpi_div_mpi(&R, NULL, (const mbedtls_mpi *)a, (const mbedtls_mpi *)b) ||
+ mbedtls_mpi_copy((mbedtls_mpi *)c, &R) ?
+ -1 :
+ 0;
+ mbedtls_mpi_free(&R);
+ return rc;
+}
+
+int crypto_bignum_addmod(const struct crypto_bignum *a,
+ const struct crypto_bignum *b,
+ const struct crypto_bignum *c,
+ struct crypto_bignum *d)
+{
+ if (TEST_FAIL())
+ return -1;
+
+ return mbedtls_mpi_add_mpi((mbedtls_mpi *)d, (const mbedtls_mpi *)a, (const mbedtls_mpi *)b) ||
+ mbedtls_mpi_mod_mpi((mbedtls_mpi *)d, (mbedtls_mpi *)d, (const mbedtls_mpi *)c) ?
+ -1 :
+ 0;
+}
+
+int crypto_bignum_mulmod(const struct crypto_bignum *a,
+ const struct crypto_bignum *b,
+ const struct crypto_bignum *c,
+ struct crypto_bignum *d)
+{
+ if (TEST_FAIL())
+ return -1;
+
+ return mbedtls_mpi_mul_mpi((mbedtls_mpi *)d, (const mbedtls_mpi *)a, (const mbedtls_mpi *)b) ||
+ mbedtls_mpi_mod_mpi((mbedtls_mpi *)d, (mbedtls_mpi *)d, (const mbedtls_mpi *)c) ?
+ -1 :
+ 0;
+}
+
+int crypto_bignum_sqrmod(const struct crypto_bignum *a, const struct crypto_bignum *b, struct crypto_bignum *c)
+{
+ if (TEST_FAIL())
+ return -1;
+
+#if 1
+ return crypto_bignum_mulmod(a, a, b, c);
+#else
+ mbedtls_mpi bn;
+ mbedtls_mpi_init(&bn);
+ if (mbedtls_mpi_lset(&bn, 2)) /* alt?: mbedtls_mpi_set_bit(&bn, 1) */
+ return -1;
+ int ret = mbedtls_mpi_exp_mod((mbedtls_mpi *)c, (const mbedtls_mpi *)a, &bn, (const mbedtls_mpi *)b, NULL) ? -1 : 0;
+ mbedtls_mpi_free(&bn);
+ return ret;
+#endif
+}
+
+int crypto_bignum_rshift(const struct crypto_bignum *a, int n, struct crypto_bignum *r)
+{
+ return mbedtls_mpi_copy((mbedtls_mpi *)r, (const mbedtls_mpi *)a) || mbedtls_mpi_shift_r((mbedtls_mpi *)r, n) ? -1 :
+ 0;
+}
+
+int crypto_bignum_cmp(const struct crypto_bignum *a, const struct crypto_bignum *b)
+{
+ return mbedtls_mpi_cmp_mpi((const mbedtls_mpi *)a, (const mbedtls_mpi *)b);
+}
+
+int crypto_bignum_is_zero(const struct crypto_bignum *a)
+{
+ /* XXX: src/common/sae.c:sswu() contains comment:
+ * "TODO: Make sure crypto_bignum_is_zero() is constant time"
+ * Note: mbedtls_mpi_cmp_int() *is not* constant time */
+ return (mbedtls_mpi_cmp_int((const mbedtls_mpi *)a, 0) == 0);
+}
+
+int crypto_bignum_is_one(const struct crypto_bignum *a)
+{
+ return (mbedtls_mpi_cmp_int((const mbedtls_mpi *)a, 1) == 0);
+}
+
+int crypto_bignum_is_odd(const struct crypto_bignum *a)
+{
+ return mbedtls_mpi_get_bit((const mbedtls_mpi *)a, 0);
+}
+
+#include "utils/const_time.h"
+int crypto_bignum_legendre(const struct crypto_bignum *a, const struct crypto_bignum *p)
+{
+ if (TEST_FAIL())
+ return -2;
+
+ /* Security Note:
+ * mbedtls_mpi_exp_mod() is not documented to run in constant time,
+ * though mbedtls/library/bignum.c uses constant_time_internal.h funcs.
+ * Compare to crypto_openssl.c:crypto_bignum_legendre()
+ * which uses openssl BN_mod_exp_mont_consttime()
+ * mbedtls/library/ecp.c has further countermeasures to timing attacks,
+ * (but ecp.c funcs are not used here) */
+
+ mbedtls_mpi exp, tmp;
+ mbedtls_mpi_init(&exp);
+ mbedtls_mpi_init(&tmp);
+
+ /* exp = (p-1) / 2 */
+ int res;
+ if (mbedtls_mpi_sub_int(&exp, (const mbedtls_mpi *)p, 1) == 0 && mbedtls_mpi_shift_r(&exp, 1) == 0 &&
+ mbedtls_mpi_exp_mod(&tmp, (const mbedtls_mpi *)a, &exp, (const mbedtls_mpi *)p, NULL) == 0)
+ {
+ /*(modified from crypto_openssl.c:crypto_bignum_legendre())*/
+ /* Return 1 if tmp == 1, 0 if tmp == 0, or -1 otherwise. Need
+ * to use constant time selection to avoid branches here. */
+ unsigned int mask;
+ res = -1;
+ mask = const_time_eq((mbedtls_mpi_cmp_int(&tmp, 1) == 0), 1);
+ res = const_time_select_int(mask, 1, res);
+ mask = const_time_eq((mbedtls_mpi_cmp_int(&tmp, 0) == 0), 1);
+ res = const_time_select_int(mask, 0, res);
+ }
+ else
+ {
+ res = -2;
+ }
+
+ mbedtls_mpi_free(&tmp);
+ mbedtls_mpi_free(&exp);
+ return res;
+}
+
+#endif /* CRYPTO_MBEDTLS_CRYPTO_BIGNUM */
+
+#ifdef CRYPTO_MBEDTLS_CRYPTO_DH
+
+/*
+ * Finite-field DH (MODP groups) for WPS, EAP-PWD (FFC), EAP-EKE and EAP-IKEv2.
+ *
+ * MbedTLS 4 / TF-PSA-Crypto removed the DHM module and the PSA Crypto API has
+ * no finite-field DH, so these are implemented over the builtin bignum
+ * (mbedtls_mpi) modular exponentiation. dh_groups.c / dh_group5.c (dh5_*) build
+ * on top of these crypto.h primitives, so hostap's generic DH glue is reused.
+ */
+
+int crypto_mod_exp(const u8 *base, size_t base_len,
+ const u8 *power, size_t power_len,
+ const u8 *modulus, size_t modulus_len,
+ u8 *result, size_t *result_len)
+{
+ mbedtls_mpi bn_base, bn_exp, bn_mod, bn_res;
+ int ret = -1;
+ size_t n;
+
+ mbedtls_mpi_init(&bn_base);
+ mbedtls_mpi_init(&bn_exp);
+ mbedtls_mpi_init(&bn_mod);
+ mbedtls_mpi_init(&bn_res);
+
+ if (mbedtls_mpi_read_binary(&bn_base, base, base_len) ||
+ mbedtls_mpi_read_binary(&bn_exp, power, power_len) ||
+ mbedtls_mpi_read_binary(&bn_mod, modulus, modulus_len) ||
+ mbedtls_mpi_exp_mod(&bn_res, &bn_base, &bn_exp, &bn_mod, NULL))
+ goto done;
+
+ n = mbedtls_mpi_size(&bn_res);
+ if (n > *result_len)
+ goto done;
+ if (mbedtls_mpi_write_binary(&bn_res, result, n))
+ goto done;
+ *result_len = n;
+ ret = 0;
+done:
+ mbedtls_mpi_free(&bn_base);
+ mbedtls_mpi_free(&bn_exp);
+ mbedtls_mpi_free(&bn_mod);
+ mbedtls_mpi_free(&bn_res);
+ return ret;
+}
+
+int crypto_dh_init(u8 generator, const u8 *prime, size_t prime_len,
+ u8 *privkey, u8 *pubkey)
+{
+ size_t pubkey_len, pad;
+
+ if (TEST_FAIL())
+ return -1;
+
+ if (os_get_random(privkey, prime_len) < 0)
+ return -1;
+ if (os_memcmp(privkey, prime, prime_len) > 0)
+ privkey[0] = 0; /* make sure private value is smaller than prime */
+
+ pubkey_len = prime_len;
+ if (crypto_mod_exp(&generator, 1, privkey, prime_len, prime, prime_len,
+ pubkey, &pubkey_len) < 0)
+ return -1;
+ if (pubkey_len < prime_len) {
+ pad = prime_len - pubkey_len;
+ os_memmove(pubkey + pad, pubkey, pubkey_len);
+ os_memset(pubkey, 0, pad);
+ }
+
+ return 0;
+}
+
+int crypto_dh_derive_secret(u8 generator, const u8 *prime, size_t prime_len,
+ const u8 *order, size_t order_len,
+ const u8 *privkey, size_t privkey_len,
+ const u8 *pubkey, size_t pubkey_len,
+ u8 *secret, size_t *len)
+{
+ mbedtls_mpi pub, p;
+ int res = -1;
+
+ mbedtls_mpi_init(&pub);
+ mbedtls_mpi_init(&p);
+
+ /* Reject invalid peer public keys: not in [2, prime - 2] */
+ if (mbedtls_mpi_read_binary(&pub, pubkey, pubkey_len) ||
+ mbedtls_mpi_read_binary(&p, prime, prime_len) ||
+ mbedtls_mpi_cmp_int(&pub, 1) <= 0 ||
+ mbedtls_mpi_cmp_mpi(&pub, &p) >= 0)
+ goto done;
+
+ if (order) {
+ mbedtls_mpi q, tmp;
+
+ /* verify: pubkey^order == 1 mod prime */
+ mbedtls_mpi_init(&q);
+ mbedtls_mpi_init(&tmp);
+ res = mbedtls_mpi_read_binary(&q, order, order_len) ||
+ mbedtls_mpi_exp_mod(&tmp, &pub, &q, &p, NULL) ||
+ mbedtls_mpi_cmp_int(&tmp, 1) != 0;
+ mbedtls_mpi_free(&q);
+ mbedtls_mpi_free(&tmp);
+ if (res) {
+ res = -1;
+ goto done;
+ }
+ }
+
+ res = crypto_mod_exp(pubkey, pubkey_len, privkey, privkey_len,
+ prime, prime_len, secret, len);
+done:
+ mbedtls_mpi_free(&pub);
+ mbedtls_mpi_free(&p);
+ return res;
+}
+
+#endif /* CRYPTO_MBEDTLS_CRYPTO_DH */
+
+#if defined(CRYPTO_MBEDTLS_CRYPTO_ECDH) || defined(CRYPTO_MBEDTLS_CRYPTO_EC)
+
+#include <mbedtls/private/ecp.h>
+
+#define CRYPTO_EC_pbits(e) (((mbedtls_ecp_group *)(e))->pbits)
+#define CRYPTO_EC_plen(e) ((((mbedtls_ecp_group *)(e))->pbits + 7) >> 3)
+#define CRYPTO_EC_P(e) (&((mbedtls_ecp_group *)(e))->P)
+#define CRYPTO_EC_N(e) (&((mbedtls_ecp_group *)(e))->N)
+#define CRYPTO_EC_A(e) (&((mbedtls_ecp_group *)(e))->A)
+#define CRYPTO_EC_B(e) (&((mbedtls_ecp_group *)(e))->B)
+#define CRYPTO_EC_G(e) (&((mbedtls_ecp_group *)(e))->G)
+
+static mbedtls_ecp_group_id crypto_mbedtls_ecp_group_id_from_ike_id(int group)
+{
+ /* https://www.iana.org/assignments/ikev2-parameters/ikev2-parameters.xhtml */
+ switch (group)
+ {
+#ifdef MBEDTLS_ECP_DP_SECP256R1_ENABLED
+ case 19:
+ return MBEDTLS_ECP_DP_SECP256R1;
+#endif
+#ifdef MBEDTLS_ECP_DP_SECP384R1_ENABLED
+ case 20:
+ return MBEDTLS_ECP_DP_SECP384R1;
+#endif
+#ifdef MBEDTLS_ECP_DP_SECP521R1_ENABLED
+ case 21:
+ return MBEDTLS_ECP_DP_SECP521R1;
+#endif
+#ifdef MBEDTLS_ECP_DP_SECP192R1_ENABLED
+ case 25:
+ return MBEDTLS_ECP_DP_SECP192R1;
+#endif
+#ifdef MBEDTLS_ECP_DP_SECP224R1_ENABLED
+ case 26:
+ return MBEDTLS_ECP_DP_SECP224R1;
+#endif
+#ifdef MBEDTLS_ECP_DP_BP256R1_ENABLED
+ case 28:
+ return MBEDTLS_ECP_DP_BP256R1;
+#endif
+#ifdef MBEDTLS_ECP_DP_BP384R1_ENABLED
+ case 29:
+ return MBEDTLS_ECP_DP_BP384R1;
+#endif
+#ifdef MBEDTLS_ECP_DP_BP512R1_ENABLED
+ case 30:
+ return MBEDTLS_ECP_DP_BP512R1;
+#endif
+#ifdef MBEDTLS_ECP_DP_CURVE25519_ENABLED
+ case 31:
+ return MBEDTLS_ECP_DP_CURVE25519;
+#endif
+#ifdef MBEDTLS_ECP_DP_CURVE448_ENABLED
+ case 32:
+ return MBEDTLS_ECP_DP_CURVE448;
+#endif
+ default:
+ return MBEDTLS_ECP_DP_NONE;
+ }
+}
+
+#endif /* CRYPTO_MBEDTLS_CRYPTO_ECDH || CRYPTO_MBEDTLS_CRYPTO_EC */
+
+#ifdef CRYPTO_MBEDTLS_CRYPTO_EC
+static int crypto_mbedtls_ike_id_from_ecp_group_id(mbedtls_ecp_group_id grp_id)
+{
+ /* https://www.iana.org/assignments/ikev2-parameters/ikev2-parameters.xhtml */
+ /*(for crypto_ec_key_group())*/
+ switch (grp_id)
+ {
+#ifdef MBEDTLS_ECP_DP_SECP256R1_ENABLED
+ case MBEDTLS_ECP_DP_SECP256R1:
+ return 19;
+#endif
+#ifdef MBEDTLS_ECP_DP_SECP384R1_ENABLED
+ case MBEDTLS_ECP_DP_SECP384R1:
+ return 20;
+#endif
+#ifdef MBEDTLS_ECP_DP_SECP521R1_ENABLED
+ case MBEDTLS_ECP_DP_SECP521R1:
+ return 21;
+#endif
+#ifdef MBEDTLS_ECP_DP_SECP192R1_ENABLED
+ case MBEDTLS_ECP_DP_SECP192R1:
+ return 25;
+#endif
+#ifdef MBEDTLS_ECP_DP_SECP224R1_ENABLED
+ case MBEDTLS_ECP_DP_SECP224R1:
+ return 26;
+#endif
+#ifdef MBEDTLS_ECP_DP_BP256R1_ENABLED
+ case MBEDTLS_ECP_DP_BP256R1:
+ return 28;
+#endif
+#ifdef MBEDTLS_ECP_DP_BP384R1_ENABLED
+ case MBEDTLS_ECP_DP_BP384R1:
+ return 29;
+#endif
+#ifdef MBEDTLS_ECP_DP_BP512R1_ENABLED
+ case MBEDTLS_ECP_DP_BP512R1:
+ return 30;
+#endif
+#ifdef MBEDTLS_ECP_DP_CURVE25519_ENABLED
+ case MBEDTLS_ECP_DP_CURVE25519:
+ return 31;
+#endif
+#ifdef MBEDTLS_ECP_DP_CURVE448_ENABLED
+ case MBEDTLS_ECP_DP_CURVE448:
+ return 32;
+#endif
+ default:
+ return -1;
+ }
+}
+
+#endif /* CRYPTO_MBEDTLS_CRYPTO_EC */
+
+#if defined(CRYPTO_MBEDTLS_CRYPTO_ECDH) || defined(CRYPTO_MBEDTLS_CRYPTO_EC_DPP)
+
+/*
+ * PSA-focused configuration may omit MBEDTLS_PK_PARSE_C and MBEDTLS_PK_WRITE_C;
+ * mbedtls/pk.h gates parse/write prototypes on those macros. Define them before
+ * the first include of pk.h in this translation unit if not already set.
+ */
+#if !defined(MBEDTLS_PK_PARSE_C)
+#define MBEDTLS_PK_PARSE_C
+#endif
+#if !defined(MBEDTLS_PK_WRITE_C)
+#define MBEDTLS_PK_WRITE_C
+#endif
+
+#include <mbedtls/private/ecp.h>
+#include <mbedtls/pk.h>
+
+/* tf-psa-crypto internal functions */
+psa_ecc_family_t mbedtls_ecc_group_to_psa(mbedtls_ecp_group_id grpid, size_t *bits);
+mbedtls_ecp_group_id mbedtls_ecc_group_from_psa(psa_ecc_family_t family, size_t bits);
+
+static int crypto_mbedtls_keypair_gen(int group, psa_key_id_t *key_id, psa_ecc_family_t *ec_family)
+{
+ mbedtls_ecp_group_id grp_id = crypto_mbedtls_ecp_group_id_from_ike_id(group);
+ size_t key_bits;
+ psa_key_attributes_t key_attr = PSA_KEY_ATTRIBUTES_INIT;
+
+ *key_id = PSA_KEY_ID_NULL;
+
+ *ec_family = mbedtls_ecc_group_to_psa(grp_id, (size_t *) &key_bits);
+ if (*ec_family == 0) {
+ return -1;
+ }
+
+ psa_set_key_type(&key_attr, PSA_KEY_TYPE_ECC_KEY_PAIR(*ec_family));
+ psa_set_key_bits(&key_attr, key_bits);
+ psa_set_key_usage_flags(&key_attr, PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_DERIVE |
+ PSA_KEY_USAGE_COPY |
+ PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_VERIFY_HASH);
+ psa_set_key_algorithm(&key_attr, PSA_ALG_ECDH);
+#if defined(MBEDTLS_PSA_CRYPTO_C)
+ psa_set_key_enrollment_algorithm(&key_attr, PSA_ALG_ECDSA(PSA_ALG_ANY_HASH));
+#endif
+ if (psa_generate_key(&key_attr, key_id) != PSA_SUCCESS) {
+ return -1;
+ }
+
+ return 0;
+}
+
+#endif
+
+#ifdef CRYPTO_MBEDTLS_CRYPTO_ECDH
+
+#include <mbedtls/private/ecdsa.h>
+#include <mbedtls/private/ecp.h>
+#include <mbedtls/pk.h>
+
+struct crypto_ecdh {
+ mbedtls_pk_context our_key;
+ uint8_t peer_key[PSA_KEY_EXPORT_ECC_PUBLIC_KEY_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS)];
+ uint8_t shared_secret[PSA_BITS_TO_BYTES(PSA_VENDOR_ECC_MAX_CURVE_BITS)];
+};
+
+/*
+ * Following map is being used:
+ * struct crypto_ec_key --> mbedtls_pk_context
+ */
+
+struct crypto_ec {
+ mbedtls_ecp_group group;
+};
+
+struct crypto_ecdh *crypto_ecdh_init(int group)
+{
+ struct crypto_ecdh *ecdh = NULL;
+ psa_key_id_t key_id;
+ int ret;
+ psa_ecc_family_t ec_family;
+
+ if (crypto_mbedtls_keypair_gen(group, &key_id, &ec_family) != 0) {
+ return NULL;
+ }
+
+ ecdh = os_calloc(1, sizeof(struct crypto_ecdh));
+ if (ecdh == NULL) {
+ psa_destroy_key(key_id);
+ return NULL;
+ }
+
+ mbedtls_pk_init(&ecdh->our_key);
+ ret = mbedtls_pk_wrap_psa(&ecdh->our_key, key_id);
+ if (ret != 0) {
+ mbedtls_pk_free(&ecdh->our_key);
+ psa_destroy_key(key_id);
+ os_free(ecdh);
+ return NULL;
+ }
+#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
+ ecdh->our_key.MBEDTLS_PRIVATE(ec_family) = ec_family;
+#endif
+ return ecdh;
+}
+
+struct crypto_ecdh *crypto_ecdh_init2(int group, struct crypto_ec_key *own_key)
+{
+ struct crypto_ecdh *ecdh = NULL;
+ mbedtls_pk_context *pk = (mbedtls_pk_context *) own_key;
+ psa_key_id_t orig_key_id;
+ psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
+ psa_status_t status;
+ psa_key_id_t new_key_id;
+ int ret;
+
+ if (pk == NULL) {
+ return NULL;
+ }
+
+ /* Get the original PSA key ID from the pk context */
+ orig_key_id = pk->MBEDTLS_PRIVATE(priv_id);
+ if (mbedtls_svc_key_id_is_null(orig_key_id)) {
+ return NULL;
+ }
+
+ /* Allocate ECDH structure */
+ ecdh = os_calloc(1, sizeof(struct crypto_ecdh));
+ if (ecdh == NULL) {
+ return NULL;
+ }
+
+ status = psa_get_key_attributes(orig_key_id, &attributes);
+ if (status != PSA_SUCCESS) {
+ return NULL;
+ }
+ psa_set_key_lifetime(&attributes, PSA_KEY_LIFETIME_VOLATILE);
+
+ /* Copy the PSA key using psa_copy_key() */
+ status = psa_copy_key(orig_key_id, &attributes, &new_key_id);
+ psa_reset_key_attributes(&attributes);
+
+ if (status != PSA_SUCCESS) {
+ wpa_printf(MSG_ERROR, "%s: Failed to copy key: %d",
+ __FUNCTION__, (int)status);
+ os_free(ecdh);
+ return NULL;
+ }
+
+ /* Initialize the new pk context */
+ mbedtls_pk_init(&ecdh->our_key);
+
+ /* Wrap the new PSA key with pk context */
+ ret = mbedtls_pk_wrap_psa(&ecdh->our_key, new_key_id);
+ if (ret != 0) {
+ wpa_printf(MSG_ERROR, "%s: Failed to wrap PSA key: %d",
+ __FUNCTION__, ret);
+ mbedtls_pk_free(&ecdh->our_key);
+ psa_destroy_key(new_key_id);
+ os_free(ecdh);
+ return NULL;
+ }
+
+ /* Copy public key raw data if available */
+ if (pk->MBEDTLS_PRIVATE(pub_raw_len) > 0 ) {
+ os_memcpy(ecdh->our_key.MBEDTLS_PRIVATE(pub_raw),
+ pk->MBEDTLS_PRIVATE(pub_raw),
+ pk->MBEDTLS_PRIVATE(pub_raw_len));
+ ecdh->our_key.MBEDTLS_PRIVATE(pub_raw_len) = pk->MBEDTLS_PRIVATE(pub_raw_len);
+ }
+
+ /* Copy other key attributes */
+ ecdh->our_key.MBEDTLS_PRIVATE(bits) = pk->MBEDTLS_PRIVATE(bits);
+ ecdh->our_key.MBEDTLS_PRIVATE(psa_type) = pk->MBEDTLS_PRIVATE(psa_type);
+
+#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
+ ecdh->our_key.MBEDTLS_PRIVATE(ec_family) = pk->MBEDTLS_PRIVATE(ec_family);
+#endif
+
+ return ecdh;
+}
+
+struct wpabuf *crypto_ecdh_get_pubkey(struct crypto_ecdh *ecdh, int inc_y)
+{
+ psa_status_t status;
+ uint8_t pubkey_buf[PSA_KEY_EXPORT_ECC_PUBLIC_KEY_MAX_SIZE(256)];
+ size_t pubkey_len = 0;
+ size_t prime_len = 0;
+ struct wpabuf *buf;
+
+ /* Export PSA public key (always in format: 0x04 + X + Y) */
+ status = psa_export_public_key(ecdh->our_key.MBEDTLS_PRIVATE(priv_id), pubkey_buf,
+ sizeof(pubkey_buf), &pubkey_len);
+ if (status != PSA_SUCCESS) {
+ return NULL;
+ }
+
+ prime_len = (pubkey_len - 1) / 2;
+
+ if (inc_y) {
+ /* Uncompressed: copy entire key */
+ buf = wpabuf_alloc_copy(pubkey_buf, pubkey_len);
+ } else {
+ /* Compressed: convert format */
+ buf = wpabuf_alloc(1 + prime_len);
+ if (buf) {
+ uint8_t y_is_odd = pubkey_buf[pubkey_len - 1] & 0x01;
+ wpabuf_put_u8(buf, y_is_odd ? 0x03 : 0x02);
+ wpabuf_put_data(buf, pubkey_buf + 1, prime_len);
+ }
+ }
+
+ return buf;
+}
+
+struct wpabuf *crypto_ecdh_set_peerkey(struct crypto_ecdh *ecdh, int inc_y, const u8 *key, size_t len)
+{
+ struct wpabuf *buf = NULL;
+ psa_status_t status;
+ size_t olen = 0;
+ u8 *peer_key_buf = NULL;
+ size_t peer_key_len = 0;
+ bool need_free = false;
+ size_t key_bits, prime_len;
+ psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
+
+ if (len == 0) {
+ return NULL;
+ }
+
+ /* Get curve information from our key */
+ status = psa_get_key_attributes(ecdh->our_key.MBEDTLS_PRIVATE(priv_id), &attributes);
+ if (status != PSA_SUCCESS) {
+ wpa_printf(MSG_ERROR, "%s: Failed to get key attributes", __FUNCTION__);
+ return NULL;
+ }
+ key_bits = psa_get_key_bits(&attributes);
+ psa_reset_key_attributes(&attributes);
+ prime_len = PSA_BITS_TO_BYTES(key_bits);
+ /* Process the peer's public key based on format */
+ if (inc_y) {
+ /* Uncompressed format: should contain X + Y coordinates */
+ if (key[0] == 0x04 && (len == 1 + 2 * prime_len)) {
+ /* Already in standard uncompressed format: 0x04 + X + Y */
+ peer_key_buf = (u8 *)key;
+ peer_key_len = len;
+ } else if (len == 2 * prime_len) {
+ /* Raw X + Y coordinates without prefix (some DPP implementations)
+ * Need to add 0x04 prefix */
+ peer_key_len = 1 + len;
+ peer_key_buf = os_malloc(peer_key_len);
+ if (!peer_key_buf) {
+ return NULL;
+ }
+ peer_key_buf[0] = 0x04;
+ os_memcpy(peer_key_buf + 1, key, len);
+ need_free = true;
+ } else {
+ wpa_printf(MSG_ERROR, "%s: Invalid uncompressed key length %zu", __FUNCTION__, len);
+ return NULL;
+ }
+ } else {
+ mbedtls_ecp_group_id grp_id;
+ size_t written_len = 0;
+
+ /* Compressed format: 0x02/0x03 + X coordinate only */
+ if (key[0] == 0x02 || key[0] == 0x03) {
+ /* Compressed format with prefix */
+ if (len != 1 + prime_len) {
+ wpa_printf(MSG_ERROR, "%s: Invalid compressed key length %zu", __FUNCTION__, len);
+ return NULL;
+ }
+
+ peer_key_len = 1 + 2 * prime_len;
+ peer_key_buf = os_malloc(peer_key_len);
+ if (!peer_key_buf) {
+ wpa_printf(MSG_ERROR, "%s: Memory allocation failed", __FUNCTION__);
+ return NULL;
+ }
+ need_free = true;
+ peer_key_buf[0] = 0x04;
+
+ /* Copy X coordinate */
+ os_memcpy(peer_key_buf + 1, key + 1, prime_len);
+
+ mbedtls_ecp_group grp;
+ mbedtls_ecp_point point;
+ mbedtls_ecp_group_init(&grp);
+ mbedtls_ecp_point_init(&point);
+
+ /* Load the curve group */
+ grp_id = (key_bits == 256) ? MBEDTLS_ECP_DP_SECP256R1 :
+ (key_bits == 384) ? MBEDTLS_ECP_DP_SECP384R1 :
+ (key_bits == 521) ? MBEDTLS_ECP_DP_SECP521R1 :
+ MBEDTLS_ECP_DP_NONE;
+
+ if (grp_id == MBEDTLS_ECP_DP_NONE) {
+ wpa_printf(MSG_ERROR, "%s: Unsupported curve size %zu bits", __FUNCTION__, key_bits);
+ os_free(peer_key_buf);
+ return NULL;
+ }
+
+ status = mbedtls_ecp_group_load(&grp, grp_id);
+ if (status != 0) {
+ wpa_printf(MSG_ERROR, "%s: Failed to load curve group: %d", __FUNCTION__, status);
+ mbedtls_ecp_point_free(&point);
+ mbedtls_ecp_group_free(&grp);
+ os_free(peer_key_buf);
+ return NULL;
+ }
+
+ /* Read the compressed point and decompress it */
+ status = mbedtls_ecp_point_read_binary(&grp, &point, key, len);
+ if (status != 0) {
+ wpa_printf(MSG_ERROR, "%s: Failed to read compressed point: %d", __FUNCTION__, status);
+ mbedtls_ecp_point_free(&point);
+ mbedtls_ecp_group_free(&grp);
+ os_free(peer_key_buf);
+ return NULL;
+ }
+
+ /* Write the uncompressed point */
+ status = mbedtls_ecp_point_write_binary(&grp, &point,
+ MBEDTLS_ECP_PF_UNCOMPRESSED,
+ &written_len,
+ peer_key_buf,
+ peer_key_len);
+
+ mbedtls_ecp_point_free(&point);
+ mbedtls_ecp_group_free(&grp);
+ if (status != 0) {
+ wpa_printf(MSG_ERROR, "%s: Failed to write uncompressed point: %d", __FUNCTION__, status);
+ os_free(peer_key_buf);
+ return NULL;
+ }
+
+ peer_key_len = written_len;
+ } else {
+ wpa_printf(MSG_ERROR, "%s: Invalid compressed key format", __FUNCTION__);
+ return NULL;
+ }
+ }
+
+ buf = wpabuf_alloc(prime_len);
+ if (!buf) {
+ wpa_printf(MSG_ERROR, "%s: Failed to allocate output buffer", __FUNCTION__);
+ if (need_free)
+ os_free(peer_key_buf);
+ return NULL;
+ }
+
+ /* Perform ECDH key agreement using PSA API */
+ status = psa_raw_key_agreement(
+ PSA_ALG_ECDH,
+ ecdh->our_key.MBEDTLS_PRIVATE(priv_id),
+ peer_key_buf,
+ peer_key_len,
+ wpabuf_mhead_u8(buf),
+ wpabuf_size(buf),
+ &olen
+ );
+
+ if (need_free) {
+ os_free(peer_key_buf);
+ }
+
+ if (status != PSA_SUCCESS) {
+ wpa_printf(MSG_ERROR, "%s: psa_raw_key_agreement failed: %d", __FUNCTION__, status);
+ wpabuf_free(buf);
+ return NULL;
+ }
+
+ wpabuf_put(buf, olen);
+ return buf;
+}
+
+void crypto_ecdh_deinit(struct crypto_ecdh *ecdh)
+{
+ psa_key_id_t key_id;
+ mbedtls_pk_context *pk;
+
+ if (NULL != ecdh)
+ {
+ pk = (mbedtls_pk_context *) &ecdh->our_key;
+ key_id = pk->MBEDTLS_PRIVATE(priv_id);
+ mbedtls_pk_free(&ecdh->our_key);
+ psa_destroy_key(key_id);
+ os_free(ecdh);
+ }
+}
+
+size_t crypto_ecdh_prime_len(struct crypto_ecdh *ecdh)
+{
+ return mbedtls_pk_get_bitlen(&ecdh->our_key);
+}
+
+#endif /* CRYPTO_MBEDTLS_CRYPTO_ECDH */
+
+#if defined(CRYPTO_MBEDTLS_CRYPTO_EC)
+
+/*
+ * PSA-focused configuration may omit MBEDTLS_PK_PARSE_C and MBEDTLS_PK_WRITE_C;
+ * mbedtls/pk.h gates parse/write prototypes on those macros. Define them before
+ * the first include of pk.h in this translation unit if not already set.
+ */
+#if !defined(MBEDTLS_PK_PARSE_C)
+#define MBEDTLS_PK_PARSE_C
+#endif
+#if !defined(MBEDTLS_PK_WRITE_C)
+#define MBEDTLS_PK_WRITE_C
+#endif
+
+#include <mbedtls/private/ecp.h>
+#include <mbedtls/pk.h>
+
+/* tf-psa-crypto internal functions */
+psa_ecc_family_t mbedtls_ecc_group_to_psa(mbedtls_ecp_group_id grpid, size_t *bits);
+mbedtls_ecp_group_id mbedtls_ecc_group_from_psa(psa_ecc_family_t family, size_t bits);
+
+/* MPI buffer for crypto_ec_get_a() return value; not thread-safe. */
+static mbedtls_mpi mpi_sw_A;
+
+struct crypto_ec *crypto_ec_init(int group)
+{
+ mbedtls_ecp_group_id grp_id = crypto_mbedtls_ecp_group_id_from_ike_id(group);
+ if (grp_id == MBEDTLS_ECP_DP_NONE)
+ return NULL;
+ mbedtls_ecp_group *e = os_malloc(sizeof(*e));
+ if (e == NULL)
+ return NULL;
+ mbedtls_ecp_group_init(e);
+ if (mbedtls_ecp_group_load(e, grp_id) == 0)
+ return (struct crypto_ec *)e;
+
+ mbedtls_ecp_group_free(e);
+ os_free(e);
+ return NULL;
+}
+
+void crypto_ec_deinit(struct crypto_ec *e)
+{
+ mbedtls_ecp_group_free((mbedtls_ecp_group *)e);
+ os_free(e);
+}
+
+size_t crypto_ec_prime_len(struct crypto_ec *e)
+{
+ return CRYPTO_EC_plen(e);
+}
+
+size_t crypto_ec_prime_len_bits(struct crypto_ec *e)
+{
+ return CRYPTO_EC_pbits(e);
+}
+
+size_t crypto_ec_order_len(struct crypto_ec *e)
+{
+ return (mbedtls_mpi_bitlen(CRYPTO_EC_N(e)) + 7) / 8;
+}
+
+const struct crypto_bignum *crypto_ec_get_prime(struct crypto_ec *e)
+{
+ return (const struct crypto_bignum *)CRYPTO_EC_P(e);
+}
+
+const struct crypto_bignum *crypto_ec_get_order(struct crypto_ec *e)
+{
+ return (const struct crypto_bignum *)CRYPTO_EC_N(e);
+}
+
+const struct crypto_bignum *crypto_ec_get_a(struct crypto_ec *e)
+{
+#ifdef MBEDTLS_ECP_DP_SECP256R1_ENABLED
+ static const uint8_t secp256r1_a[] = {0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfc};
+#endif
+#ifdef MBEDTLS_ECP_DP_SECP384R1_ENABLED
+ static const uint8_t secp384r1_a[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xff, 0xff,
+ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xfc};
+#endif
+#ifdef MBEDTLS_ECP_DP_SECP521R1_ENABLED
+ static const uint8_t secp521r1_a[] = {
+ 0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfc};
+#endif
+#ifdef MBEDTLS_ECP_DP_SECP192R1_ENABLED
+ static const uint8_t secp192r1_a[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfc};
+#endif
+#ifdef MBEDTLS_ECP_DP_SECP224R1_ENABLED
+ static const uint8_t secp224r1_a[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe, 0xff, 0xff, 0xff, 0xff,
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xfe};
+#endif
+
+ const uint8_t *bin = NULL;
+ size_t len = 0;
+
+ /* (mbedtls groups matching supported sswu_curve_param() IKE groups) */
+ switch (((mbedtls_ecp_group *)e)->id)
+ {
+#ifdef MBEDTLS_ECP_DP_SECP256R1_ENABLED
+ case MBEDTLS_ECP_DP_SECP256R1:
+ bin = secp256r1_a;
+ len = sizeof(secp256r1_a);
+ break;
+#endif
+#ifdef MBEDTLS_ECP_DP_SECP384R1_ENABLED
+ case MBEDTLS_ECP_DP_SECP384R1:
+ bin = secp384r1_a;
+ len = sizeof(secp384r1_a);
+ break;
+#endif
+#ifdef MBEDTLS_ECP_DP_SECP521R1_ENABLED
+ case MBEDTLS_ECP_DP_SECP521R1:
+ bin = secp521r1_a;
+ len = sizeof(secp521r1_a);
+ break;
+#endif
+#ifdef MBEDTLS_ECP_DP_SECP192R1_ENABLED
+ case MBEDTLS_ECP_DP_SECP192R1:
+ bin = secp192r1_a;
+ len = sizeof(secp192r1_a);
+ break;
+#endif
+#ifdef MBEDTLS_ECP_DP_SECP224R1_ENABLED
+ case MBEDTLS_ECP_DP_SECP224R1:
+ bin = secp224r1_a;
+ len = sizeof(secp224r1_a);
+ break;
+#endif
+#ifdef MBEDTLS_ECP_DP_BP256R1_ENABLED
+ case MBEDTLS_ECP_DP_BP256R1:
+ return (const struct crypto_bignum *)CRYPTO_EC_A(e);
+#endif
+#ifdef MBEDTLS_ECP_DP_BP384R1_ENABLED
+ case MBEDTLS_ECP_DP_BP384R1:
+ return (const struct crypto_bignum *)CRYPTO_EC_A(e);
+#endif
+#ifdef MBEDTLS_ECP_DP_BP512R1_ENABLED
+ case MBEDTLS_ECP_DP_BP512R1:
+ return (const struct crypto_bignum *)CRYPTO_EC_A(e);
+#endif
+#ifdef MBEDTLS_ECP_DP_CURVE25519_ENABLED
+ case MBEDTLS_ECP_DP_CURVE25519:
+ return (const struct crypto_bignum *)CRYPTO_EC_A(e);
+#endif
+#ifdef MBEDTLS_ECP_DP_CURVE448_ENABLED
+ case MBEDTLS_ECP_DP_CURVE448:
+ return (const struct crypto_bignum *)CRYPTO_EC_A(e);
+#endif
+ default:
+ return NULL;
+ }
+
+ /*(note: not thread-safe; returns file-scoped static storage)*/
+ if (mbedtls_mpi_read_binary(&mpi_sw_A, bin, len) == 0)
+ return (const struct crypto_bignum *)&mpi_sw_A;
+ return NULL;
+}
+
+const struct crypto_bignum *crypto_ec_get_b(struct crypto_ec *e)
+{
+ return (const struct crypto_bignum *)CRYPTO_EC_B(e);
+}
+
+const struct crypto_ec_point *crypto_ec_get_generator(struct crypto_ec *e)
+{
+ return (const struct crypto_ec_point *)CRYPTO_EC_G(e);
+}
+
+struct crypto_ec_point *crypto_ec_point_init(struct crypto_ec *e)
+{
+ if (TEST_FAIL())
+ return NULL;
+
+ mbedtls_ecp_point *p = os_malloc(sizeof(*p));
+ if (p != NULL)
+ mbedtls_ecp_point_init(p);
+ return (struct crypto_ec_point *)p;
+}
+
+void crypto_ec_point_deinit(struct crypto_ec_point *p, int clear)
+{
+ mbedtls_ecp_point_free((mbedtls_ecp_point *)p);
+ os_free(p);
+}
+
+int crypto_ec_point_x(struct crypto_ec *e, const struct crypto_ec_point *p, struct crypto_bignum *x)
+{
+ mbedtls_mpi *px = &((mbedtls_ecp_point *)p)->MBEDTLS_PRIVATE(X);
+ return mbedtls_mpi_copy((mbedtls_mpi *)x, px) ? -1 : 0;
+}
+
+int crypto_ec_point_to_bin(struct crypto_ec *e, const struct crypto_ec_point *point, u8 *x, u8 *y)
+{
+ if (TEST_FAIL())
+ return -1;
+
+ /* crypto.h documents crypto_ec_point_to_bin() output is big-endian */
+ size_t len = CRYPTO_EC_plen(e);
+ if (x)
+ {
+ mbedtls_mpi *px = &((mbedtls_ecp_point *)point)->MBEDTLS_PRIVATE(X);
+ if (mbedtls_mpi_write_binary(px, x, len))
+ return -1;
+ }
+ if (y)
+ {
+ mbedtls_mpi *py = &((mbedtls_ecp_point *)point)->MBEDTLS_PRIVATE(Y);
+ if (mbedtls_mpi_write_binary(py, y, len))
+ return -1;
+ }
+ return 0;
+}
+
+struct crypto_ec_point *crypto_ec_point_from_bin(struct crypto_ec *e, const u8 *val)
+{
+ if (TEST_FAIL())
+ return NULL;
+
+#if !defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) && !defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
+ return NULL;
+#else
+ size_t len = CRYPTO_EC_plen(e);
+ mbedtls_ecp_point *p = os_malloc(sizeof(*p));
+ u8 buf[1 + MBEDTLS_MPI_MAX_SIZE * 2];
+
+ if (p == NULL)
+ return NULL;
+ mbedtls_ecp_point_init(p);
+
+#ifdef MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED
+ if (mbedtls_ecp_get_type((mbedtls_ecp_group *)e) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS)
+ {
+ buf[0] = 0x04;
+ os_memcpy(buf + 1, val, len * 2);
+ if (mbedtls_ecp_point_read_binary((mbedtls_ecp_group *)e, p, buf, 1 + len * 2) == 0)
+ return (struct crypto_ec_point *)p;
+ }
+#endif
+#ifdef MBEDTLS_ECP_MONTGOMERY_ENABLED
+ if (mbedtls_ecp_get_type((mbedtls_ecp_group *)e) == MBEDTLS_ECP_TYPE_MONTGOMERY)
+ {
+ /* crypto.h interface documents crypto_ec_point_from_bin()
+ * val is length: prime_len * 2 and is big-endian
+ * (Short Weierstrass is assumed by hostap)
+ * Reverse to little-endian format for Montgomery */
+ for (unsigned int i = 0; i < len; ++i)
+ buf[i] = val[len - 1 - i];
+ if (mbedtls_ecp_point_read_binary((mbedtls_ecp_group *)e, p, buf, len) == 0)
+ return (struct crypto_ec_point *)p;
+ }
+#endif
+
+ mbedtls_ecp_point_free(p);
+ os_free(p);
+ return NULL;
+#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED || MBEDTLS_ECP_MONTGOMERY_ENABLED */
+}
+
+int crypto_ec_point_add(struct crypto_ec *e,
+ const struct crypto_ec_point *a,
+ const struct crypto_ec_point *b,
+ struct crypto_ec_point *c)
+{
+ if (TEST_FAIL())
+ return -1;
+
+#if !defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED)
+ return -1;
+#else
+ /* mbedtls does not provide an mbedtls_ecp_point add function */
+ mbedtls_mpi one;
+ mbedtls_mpi_init(&one);
+ int ret = mbedtls_mpi_lset(&one, 1) ||
+ mbedtls_ecp_muladd((mbedtls_ecp_group *)e, (mbedtls_ecp_point *)c, &one,
+ (const mbedtls_ecp_point *)a, &one, (const mbedtls_ecp_point *)b) ?
+ -1 :
+ 0;
+
+ mbedtls_mpi_free(&one);
+ return ret;
+#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
+}
+
+int crypto_ec_point_mul(struct crypto_ec *e,
+ const struct crypto_ec_point *p,
+ const struct crypto_bignum *b,
+ struct crypto_ec_point *res)
+{
+ if (TEST_FAIL())
+ return -1;
+
+ return mbedtls_ecp_mul((mbedtls_ecp_group *)e, (mbedtls_ecp_point *)res, (const mbedtls_mpi *)b,
+ (const mbedtls_ecp_point *)p, hostap_rng_fn, hostap_rng_ctx()) ?
+ -1 :
+ 0;
+}
+
+int crypto_ec_point_invert(struct crypto_ec *e, struct crypto_ec_point *p)
+{
+ if (TEST_FAIL())
+ return -1;
+
+ if (mbedtls_ecp_get_type((mbedtls_ecp_group *)e) == MBEDTLS_ECP_TYPE_MONTGOMERY)
+ {
+ /* e.g. MBEDTLS_ECP_DP_CURVE25519 and MBEDTLS_ECP_DP_CURVE448 */
+ wpa_printf(MSG_ERROR, "%s not implemented for Montgomery curves", __func__);
+ return -1;
+ }
+
+ /* mbedtls does not provide an mbedtls_ecp_point invert function */
+ /* below works for Short Weierstrass; incorrect for Montgomery curves */
+ mbedtls_mpi *py = &((mbedtls_ecp_point *)p)->MBEDTLS_PRIVATE(Y);
+ return mbedtls_ecp_is_zero((mbedtls_ecp_point *)p) /*point at infinity*/
+ || mbedtls_mpi_cmp_int(py, 0) == 0 /*point is its own inverse*/
+ || mbedtls_mpi_sub_abs(py, CRYPTO_EC_P(e), py) == 0 ?
+ 0 :
+ -1;
+}
+
+#ifdef MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED
+static int crypto_ec_point_y_sqr_weierstrass(mbedtls_ecp_group *e, const mbedtls_mpi *x, mbedtls_mpi *y2)
+{
+ /* MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS y^2 = x^3 + a x + b */
+
+ /* Short Weierstrass elliptic curve group w/o A set treated as A = -3 */
+ /* Attempt to match mbedtls/library/ecp.c:ecp_check_pubkey_sw() behavior
+ * and elsewhere in mbedtls/library/ecp.c where if A is not set, it is
+ * treated as if A = -3. */
+
+ /* y^2 = x^3 + ax + b = (x^2 + a)x + b */
+ return /* x^2 */
+ mbedtls_mpi_mul_mpi(y2, x, x) ||
+ mbedtls_mpi_mod_mpi(y2, y2, &e->P)
+ /* x^2 + a */
+ || (e->A.MBEDTLS_PRIVATE(p) ? mbedtls_mpi_add_mpi(y2, y2, &e->A) : mbedtls_mpi_sub_int(y2, y2, 3)) ||
+ mbedtls_mpi_mod_mpi(y2, y2, &e->P)
+ /* (x^2 + a)x */
+ || mbedtls_mpi_mul_mpi(y2, y2, x) ||
+ mbedtls_mpi_mod_mpi(y2, y2, &e->P)
+ /* (x^2 + a)x + b */
+ || mbedtls_mpi_add_mpi(y2, y2, &e->B) || mbedtls_mpi_mod_mpi(y2, y2, &e->P);
+}
+#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */
+
+struct crypto_bignum *crypto_ec_point_compute_y_sqr(struct crypto_ec *e, const struct crypto_bignum *x)
+{
+ if (TEST_FAIL())
+ return NULL;
+
+ mbedtls_mpi *y2 = os_malloc(sizeof(*y2));
+ if (y2 == NULL)
+ return NULL;
+ mbedtls_mpi_init(y2);
+
+#ifdef MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED
+ if (mbedtls_ecp_get_type((mbedtls_ecp_group *)e) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS &&
+ crypto_ec_point_y_sqr_weierstrass((mbedtls_ecp_group *)e, (const mbedtls_mpi *)x, y2) == 0)
+ return (struct crypto_bignum *)y2;
+#endif
+
+ mbedtls_mpi_free(y2);
+ os_free(y2);
+ return NULL;
+}
+
+int crypto_ec_point_is_at_infinity(struct crypto_ec *e, const struct crypto_ec_point *p)
+{
+ return mbedtls_ecp_is_zero((mbedtls_ecp_point *)p);
+}
+
+int crypto_ec_point_is_on_curve(struct crypto_ec *e, const struct crypto_ec_point *p)
+{
+ return mbedtls_ecp_check_pubkey((const mbedtls_ecp_group *)e, (const mbedtls_ecp_point *)p) == 0;
+}
+
+int crypto_ec_point_cmp(const struct crypto_ec *e, const struct crypto_ec_point *a, const struct crypto_ec_point *b)
+{
+ return mbedtls_ecp_point_cmp((const mbedtls_ecp_point *)a, (const mbedtls_ecp_point *)b);
+}
+
+#if !defined(CONFIG_NO_STDOUT_DEBUG)
+void crypto_ec_point_debug_print(const struct crypto_ec *e, const struct crypto_ec_point *p, const char *title)
+{
+ u8 x[MBEDTLS_MPI_MAX_SIZE];
+ u8 y[MBEDTLS_MPI_MAX_SIZE];
+ size_t len = CRYPTO_EC_plen(e);
+ /* crypto_ec_point_to_bin ought to take (const struct crypto_ec *e) */
+ struct crypto_ec *ee;
+ *(const struct crypto_ec **)&ee = e; /*(cast away const)*/
+ if (crypto_ec_point_to_bin(ee, p, x, y) == 0)
+ {
+ if (title)
+ wpa_printf(MSG_DEBUG, "%s", title);
+ wpa_hexdump(MSG_DEBUG, "x:", x, len);
+ wpa_hexdump(MSG_DEBUG, "y:", y, len);
+ }
+}
+#else
+void crypto_ec_point_debug_print(const struct crypto_ec *e, const struct crypto_ec_point *p, const char *title)
+{
+ // Fixing linking error undefined reference to `crypto_ec_point_debug_print'
+}
+#endif
+
+struct crypto_ec_key *crypto_ec_key_parse_priv(const u8 *der, size_t der_len)
+{
+ mbedtls_pk_context *pk;
+ uint8_t key[PSA_KEY_EXPORT_ECC_KEY_PAIR_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS)] = { 0 };
+ size_t key_len;
+ psa_key_attributes_t key_attr = PSA_KEY_ATTRIBUTES_INIT;
+ psa_key_type_t key_type;
+ psa_key_bits_t key_bits;
+ psa_key_id_t key_id = PSA_KEY_ID_NULL;
+ psa_ecc_family_t ec_family;
+
+ pk = os_calloc(1, sizeof(mbedtls_pk_context));
+ if (pk == NULL)
+ return NULL;
+
+ mbedtls_pk_init(pk);
+ if (mbedtls_pk_parse_key(pk, der, der_len, NULL, 0) != 0) {
+ mbedtls_pk_free(pk);
+ os_free(pk);
+ return NULL;
+ }
+#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
+ ec_family = pk->MBEDTLS_PRIVATE(ec_family);
+#endif
+ /* By deafult "mbedlts_pk_parse_key()" assigns ECDSA(ANY_HASH) algorithm to the imported
+ * PSA key. We need to change that to ECDH. */
+
+ if (psa_get_key_attributes(pk->MBEDTLS_PRIVATE(priv_id), &key_attr) != PSA_SUCCESS) {
+ mbedtls_pk_free(pk);
+ os_free(pk);
+ return NULL;
+ }
+ if (psa_export_key(pk->MBEDTLS_PRIVATE(priv_id), key, sizeof(key), &key_len) != PSA_SUCCESS) {
+ mbedtls_pk_free(pk);
+ os_free(pk);
+ return NULL;
+ }
+ /* Free the PK context to re-use it below */
+ mbedtls_pk_free(pk);
+ /* Copy key attributes (key type and bits) and set key algorithm and usage. */
+ key_type = psa_get_key_type(&key_attr);
+ key_bits = psa_get_key_bits(&key_attr);
+ psa_reset_key_attributes(&key_attr);
+ key_attr = psa_key_attributes_init();
+ psa_set_key_type(&key_attr, key_type);
+ psa_set_key_bits(&key_attr, key_bits);
+ psa_set_key_algorithm(&key_attr, PSA_ALG_ECDH);
+#if defined(MBEDTLS_PSA_CRYPTO_C)
+ psa_set_key_enrollment_algorithm(&key_attr, PSA_ALG_ECDSA(PSA_ALG_ANY_HASH));
+#endif
+ psa_set_key_usage_flags(&key_attr, PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_DERIVE
+ | PSA_KEY_USAGE_COPY);
+ psa_set_key_lifetime(&key_attr, PSA_KEY_LIFETIME_VOLATILE);
+ if (psa_import_key(&key_attr, key, key_len, &key_id) != PSA_SUCCESS) {
+ os_free(pk);
+ return NULL;
+ }
+
+ mbedtls_pk_init(pk);
+
+ if (mbedtls_pk_wrap_psa(pk, key_id) != 0) {
+ mbedtls_pk_free(pk);
+ psa_destroy_key(key_id);
+ os_free(pk);
+ return NULL;
+ }
+#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
+ pk->MBEDTLS_PRIVATE(ec_family) = ec_family;
+#endif
+ return (struct crypto_ec_key *) pk;
+}
+
+struct crypto_ec_key * crypto_ec_key_set_priv(int group, const u8 *raw, size_t raw_len)
+{
+ mbedtls_pk_context *pk;
+ psa_key_attributes_t key_attr = PSA_KEY_ATTRIBUTES_INIT;
+ psa_key_id_t key_id = PSA_KEY_ID_NULL;
+ psa_ecc_family_t ec_family;
+ size_t key_bits;
+ mbedtls_ecp_group_id ecp_group_id;
+ int ret;
+
+ ecp_group_id = crypto_mbedtls_ecp_group_id_from_ike_id(group);
+ ec_family = mbedtls_ecc_group_to_psa(ecp_group_id, (size_t *) &key_bits);
+ if (ec_family == 0) {
+ return NULL;
+ }
+
+ psa_set_key_type(&key_attr, PSA_KEY_TYPE_ECC_KEY_PAIR(ec_family));
+ psa_set_key_bits(&key_attr, key_bits);
+ psa_set_key_algorithm(&key_attr, PSA_ALG_ECDH);
+#if defined(MBEDTLS_PSA_CRYPTO_C)
+ psa_set_key_enrollment_algorithm(&key_attr, PSA_ALG_ECDSA(PSA_ALG_ANY_HASH));
+#endif
+ psa_set_key_usage_flags(&key_attr, PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_DERIVE
+ | PSA_KEY_USAGE_COPY);
+ if (psa_import_key(&key_attr, raw, raw_len, &key_id) != PSA_SUCCESS) {
+ return NULL;
+ }
+
+ pk = os_calloc(1, sizeof(mbedtls_pk_context));
+ if (pk == NULL) {
+ psa_destroy_key(key_id);
+ return NULL;
+ }
+
+ mbedtls_pk_init(pk);
+ ret = mbedtls_pk_wrap_psa(pk, key_id);
+ if (ret != 0) {
+ mbedtls_pk_free(pk);
+ psa_destroy_key(key_id);
+ os_free(pk);
+ return NULL;
+ }
+
+ return (struct crypto_ec_key *) pk;
+}
+
+struct crypto_ec_key *crypto_ec_key_parse_pub(const u8 *der, size_t der_len)
+{
+ mbedtls_pk_context *pk;
+
+ pk = os_calloc(1, sizeof(mbedtls_pk_context));
+ if (pk == NULL)
+ return NULL;
+
+ mbedtls_pk_init(pk);
+ if (mbedtls_pk_parse_public_key(pk, der, der_len) != 0) {
+ mbedtls_pk_free(pk);
+ os_free(pk);
+ return NULL;
+ }
+
+ return (struct crypto_ec_key *) pk;
+}
+
+#ifdef CRYPTO_MBEDTLS_CRYPTO_EC_DPP
+/* Internal to PK. Defined in "pk_wrap.c" */
+extern const mbedtls_pk_info_t mbedtls_eckey_info;
+
+struct crypto_ec_key *crypto_ec_key_set_pub(int group, const u8 *x, const u8 *y, size_t len)
+{
+ mbedtls_pk_context *pk;
+ mbedtls_ecp_group_id group_id = crypto_mbedtls_ecp_group_id_from_ike_id(group);
+ uint8_t *raw_key_ptr;
+ psa_ecc_family_t ec_family;
+ size_t key_bits;
+
+ ec_family = mbedtls_ecc_group_to_psa(group_id, (size_t *) &key_bits);
+ if (ec_family == 0) {
+ return NULL;
+ }
+
+ /* Ensure data will fit into pk->pub_raw */
+ if ((2 * len + 1) > MBEDTLS_PK_MAX_PUBKEY_RAW_LEN) {
+ return NULL;
+ }
+
+ pk = os_calloc(1, sizeof(mbedtls_pk_context));
+ if (pk == NULL) {
+ return NULL;
+ }
+
+ raw_key_ptr = pk->MBEDTLS_PRIVATE(pub_raw);
+ *raw_key_ptr = 0x04;
+ raw_key_ptr++;
+ pk->MBEDTLS_PRIVATE(pub_raw_len)++;
+ memcpy(raw_key_ptr, x, len);
+ pk->MBEDTLS_PRIVATE(pub_raw_len) += len;
+ raw_key_ptr += len;
+ memcpy(raw_key_ptr, y, len);
+ pk->MBEDTLS_PRIVATE(pub_raw_len) += len;
+#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
+ pk->MBEDTLS_PRIVATE(ec_family) = ec_family;
+#endif
+ pk->MBEDTLS_PRIVATE(bits) = key_bits;
+ pk->MBEDTLS_PRIVATE(pk_info) = &mbedtls_eckey_info;
+
+ return (struct crypto_ec_key *) pk;
+}
+
+struct crypto_ec_key *crypto_ec_key_set_pub_point(struct crypto_ec *e, const struct crypto_ec_point *pub)
+{
+ mbedtls_ecp_group *ecp_group = (mbedtls_ecp_group *) e;
+ mbedtls_ecp_point *ecp_point = (mbedtls_ecp_point *) pub;
+ uint8_t key[PSA_KEY_EXPORT_ECC_PUBLIC_KEY_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS)] = { 0 };
+ uint8_t *x, *y;
+ size_t key_len, coord_len;
+ int crypto_group;
+
+ if (mbedtls_ecp_point_write_binary(ecp_group, ecp_point, MBEDTLS_ECP_PF_UNCOMPRESSED,
+ &key_len, key, sizeof(key)) != 0) {
+ return NULL;
+ }
+
+ coord_len = (key_len - 1) / 2;
+ crypto_group = crypto_mbedtls_ike_id_from_ecp_group_id(ecp_group->id);
+ x = &key[1];
+ y = x + coord_len;
+
+ return crypto_ec_key_set_pub(crypto_group, x, y, coord_len);
+}
+
+struct crypto_ec_key *crypto_ec_key_gen(int group)
+{
+ psa_key_id_t key_id = PSA_KEY_ID_NULL;
+ mbedtls_pk_context *pk;
+ int ret;
+ psa_ecc_family_t ec_family;
+
+ if (crypto_mbedtls_keypair_gen(group, &key_id, &ec_family) != 0) {
+ return NULL;
+ }
+
+ pk = os_malloc(sizeof(mbedtls_pk_context));
+ if (pk == NULL) {
+ psa_destroy_key(key_id);
+ return NULL;
+ }
+
+ mbedtls_pk_init(pk);
+ ret = mbedtls_pk_wrap_psa(pk, key_id);
+ if (ret != 0) {
+ mbedtls_pk_free(pk);
+ psa_destroy_key(key_id);
+ os_free(pk);
+ return NULL;
+ }
+#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
+ pk->MBEDTLS_PRIVATE(ec_family)= ec_family;
+#endif
+ return (struct crypto_ec_key *) pk;
+}
+
+#endif /* CRYPTO_MBEDTLS_CRYPTO_EC_DPP */
+
+void crypto_ec_key_deinit(struct crypto_ec_key *key)
+{
+ mbedtls_pk_context *pk = (mbedtls_pk_context *) key;
+ psa_key_id_t key_id;
+
+ if (NULL != key)
+ {
+ key_id = pk->MBEDTLS_PRIVATE(priv_id);
+ mbedtls_pk_free(pk);
+ psa_destroy_key(key_id);
+ os_free(key);
+ }
+}
+
+/* Internal - from pkwrite.h */
+#define MBEDTLS_PK_ECP_PUB_DER_MAX_BYTES \
+ (29 + PSA_KEY_EXPORT_ECC_PUBLIC_KEY_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS))
+
+struct wpabuf *crypto_ec_key_get_subject_public_key(struct crypto_ec_key *key)
+{
+ mbedtls_pk_context *pk = (mbedtls_pk_context *)key;
+ struct wpabuf *tmp = NULL; /* holds the original DER from mbedtls_pk_write_pubkey_der() */
+ struct wpabuf *out = NULL; /* final DER with compressed point (or original if not applicable) */
+ int der_len;
+
+ tmp = wpabuf_alloc(MBEDTLS_PK_ECP_PUB_DER_MAX_BYTES);
+ if (!tmp)
+ return NULL;
+
+ der_len = mbedtls_pk_write_pubkey_der(pk,
+ wpabuf_mhead(tmp),
+ wpabuf_size(tmp));
+ if (der_len < 0) {
+ wpabuf_free(tmp);
+ return NULL;
+ }
+
+ /* Effective DER lies at the end of the allocated buffer */
+ uint8_t *der = wpabuf_mhead_u8(tmp) + wpabuf_size(tmp) - der_len;
+ uint8_t *end = der + der_len;
+ /* Parse SPKI: SEQUENCE -> AlgorithmIdentifier(TLV) -> BIT STRING(content) */
+ unsigned char *p = der;
+ size_t seq_len, alg_len, bit_len;
+
+ /* SEQUENCE (SubjectPublicKeyInfo) */
+ if (mbedtls_asn1_get_tag(&p, end, &seq_len,
+ MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) {
+ goto fail;
+ }
+ /* AlgorithmIdentifier (remember full TLV region to copy verbatim later) */
+ const uint8_t *alg_tlv_start = p;
+ if (mbedtls_asn1_get_tag(&p, end, &alg_len,
+ MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) {
+ goto fail;
+ }
+ const uint8_t *alg_content = p;
+ p += alg_len;
+ /* Total bytes of the AlgId TLV (tag + len + contents) */
+ size_t alg_tlv_total = (size_t)(alg_content - alg_tlv_start) + alg_len;
+
+ /* subjectPublicKey (BIT STRING) – we only change its contents if uncompressed EC point is present */
+ if (mbedtls_asn1_get_tag(&p, end, &bit_len, MBEDTLS_ASN1_BIT_STRING)) {
+ goto fail;
+ }
+ const uint8_t *bit = p;
+
+ /* Expect: 0x00 | 0x04 | X | Y (uncompressed ECPoint)
+ * If not matching, just return the original DER unchanged.
+ */
+ if (bit_len < 2 || bit[0] != 0x00) {
+ out = wpabuf_alloc_copy(der, (size_t)der_len);
+ goto done;
+ }
+ if (bit[1] != 0x04) {
+ /* Already compressed (0x02/0x03) or some other format – keep as-is */
+ out = wpabuf_alloc_copy(der, (size_t)der_len);
+ goto done;
+ }
+
+ /* Compute compressed point: 0x02/0x03 || X
+ * - point_len = len of (0x04 || X || Y), NOT including the initial 'unused bits' byte
+ * - coord_len = |X| = |Y|
+ */
+ size_t point_len = bit_len - 1; /* drop unused-bits byte */
+ if (point_len < 1 || ((point_len - 1) % 2) != 0) {
+ /* Not in the expected SEC1 uncompressed format – keep as-is */
+ out = wpabuf_alloc_copy(der, (size_t)der_len);
+ goto done;
+ }
+
+ size_t coord_len = (point_len - 1) / 2;
+ const uint8_t *X = bit + 2; /* 0x00, 0x04, then X */
+ const uint8_t *Y = X + coord_len;
+ /* Choose 0x02 (even Y) or 0x03 (odd Y) by the least significant bit of Y */
+ uint8_t comp_tag = (Y[coord_len - 1] & 1) ? 0x03 : 0x02;
+
+ /* New BIT STRING content size: 0x00 | 0x02/0x03 | X */
+ size_t new_bit_len = 1 + 1 + coord_len;
+
+ /* Rebuild a fresh SPKI with the compressed point using backward ASN.1 writer */
+ uint8_t newbuf[MBEDTLS_PK_ECP_PUB_DER_MAX_BYTES];
+ uint8_t *w = newbuf + sizeof(newbuf);
+ size_t total = 0;
+
+ /* BIT STRING content (compressed) */
+ w -= new_bit_len;
+ w[0] = 0x00; /* number of unused bits */
+ w[1] = comp_tag; /* 0x02 or 0x03 */
+ memcpy(w + 2, X, coord_len);
+ total += new_bit_len;
+
+ /* BIT STRING TL */
+ {
+ int t = mbedtls_asn1_write_len(&w, newbuf, new_bit_len);
+ if (t < 0)
+ goto fail;
+
+ total += (size_t)t;
+ t = mbedtls_asn1_write_tag(&w, newbuf, MBEDTLS_ASN1_BIT_STRING);
+ if (t < 0)
+ goto fail;
+
+ total += (size_t)t;
+ }
+
+ /* Copy AlgorithmIdentifier TLV as-is */
+ w -= alg_tlv_total;
+ memcpy(w, alg_tlv_start, alg_tlv_total);
+ total += alg_tlv_total;
+
+ /* Wrap everything in the outer SEQUENCE (SPKI) */
+ int t = mbedtls_asn1_write_len(&w, newbuf, total);
+ if (t < 0)
+ goto fail;
+
+ total += (size_t)t;
+
+ t = mbedtls_asn1_write_tag(&w, newbuf,
+ MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
+ if (t < 0)
+ goto fail;
+
+ total += (size_t)t;
+
+ out = wpabuf_alloc_copy(w, total);
+done:
+ wpabuf_free(tmp);
+ return out;
+
+fail:
+ wpabuf_free(tmp);
+ return NULL;
+}
+
+#ifdef CRYPTO_MBEDTLS_CRYPTO_EC_DPP
+
+/* Internal - from pkwrite.h */
+#define MBEDTLS_PK_ECP_PRV_DER_MAX_BYTES \
+ (8 + PSA_KEY_EXPORT_ECC_KEY_PAIR_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS) + \
+ 16 + 4 + PSA_KEY_EXPORT_ECC_PUBLIC_KEY_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS))
+
+struct wpabuf *crypto_ec_key_get_ecprivate_key(struct crypto_ec_key *key, bool include_pub)
+{
+ mbedtls_pk_context *pk = (mbedtls_pk_context *) key;
+ struct wpabuf *buf, *buf2;
+ uint8_t *p;
+ int ret;
+
+ buf = wpabuf_alloc(MBEDTLS_PK_ECP_PRV_DER_MAX_BYTES);
+ if (buf == NULL) {
+ return NULL;
+ }
+
+ /* The buffer is written starting from the end! "ret" is the amount of data written. */
+ ret = mbedtls_pk_write_key_der(pk, wpabuf_mhead(buf), wpabuf_size(buf));
+ if (ret < 0) {
+ wpabuf_free(buf);
+ return NULL;
+ }
+
+ p = wpabuf_mhead_u8(buf) + wpabuf_size(buf) - ret;
+
+ buf2 = wpabuf_alloc_copy(p, ret);
+ wpabuf_free(buf);
+
+ return buf2;
+}
+
+struct wpabuf *crypto_ec_key_get_pubkey_point(struct crypto_ec_key *key, int prefix)
+{
+ mbedtls_pk_context *pk = (mbedtls_pk_context *) key;
+ uint8_t *key_ptr = pk->MBEDTLS_PRIVATE(pub_raw);
+ size_t key_len = pk->MBEDTLS_PRIVATE(pub_raw_len);
+ struct wpabuf *buf;
+
+ if (prefix) {
+ buf = wpabuf_alloc_copy(key_ptr, key_len);
+ } else {
+ buf = wpabuf_alloc_copy(key_ptr + 1, key_len - 1);
+ }
+ if (buf == NULL) {
+ return NULL;
+ }
+
+ return buf;
+}
+
+struct crypto_ec_point *crypto_ec_key_get_public_key(struct crypto_ec_key *key)
+{
+ mbedtls_pk_context *pk = (mbedtls_pk_context *) key;
+ uint8_t *key_ptr = pk->MBEDTLS_PRIVATE(pub_raw);
+ size_t key_len = pk->MBEDTLS_PRIVATE(pub_raw_len);
+ mbedtls_ecp_point *ecp_point;
+ mbedtls_ecp_group ecp_group;
+ mbedtls_ecp_group_id ecp_group_id;
+ int ret;
+
+ ecp_group_id = mbedtls_ecc_group_from_psa(pk->MBEDTLS_PRIVATE(ec_family),
+ pk->MBEDTLS_PRIVATE(bits));
+ if (ecp_group_id == 0) {
+ return NULL;
+ }
+
+ ecp_point = os_malloc(sizeof(mbedtls_ecp_point));
+ if (ecp_point == NULL) {
+ return NULL;
+ }
+
+ mbedtls_ecp_point_init(ecp_point);
+ mbedtls_ecp_group_init(&ecp_group);
+ if (mbedtls_ecp_group_load(&ecp_group, ecp_group_id) != 0) {
+ os_free(ecp_point);
+ return NULL;
+ }
+ ret = mbedtls_ecp_point_read_binary(&ecp_group, ecp_point, key_ptr, key_len);
+ mbedtls_ecp_group_free(&ecp_group);
+ if (ret != 0) {
+ os_free(ecp_point);
+ return NULL;
+ }
+
+ return (struct crypto_ec_point *) ecp_point;
+}
+
+struct crypto_bignum *crypto_ec_key_get_private_key(struct crypto_ec_key *key)
+{
+ mbedtls_pk_context *pk = (mbedtls_pk_context *) key;
+ uint8_t priv_key[PSA_KEY_EXPORT_ECC_KEY_PAIR_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS)] = { 0 };
+ size_t priv_key_len;
+ mbedtls_mpi *mpi;
+
+ mpi = os_malloc(sizeof(mbedtls_mpi));
+ if (mpi == NULL) {
+ return NULL;
+ }
+
+ mbedtls_mpi_init(mpi);
+ if (psa_export_key(pk->MBEDTLS_PRIVATE(priv_id), priv_key, sizeof(priv_key), &priv_key_len) != PSA_SUCCESS) {
+ os_free(mpi);
+ return NULL;
+ }
+
+ if (mbedtls_mpi_read_binary(mpi, priv_key, priv_key_len) != 0) {
+ memset(priv_key, 0, sizeof(priv_key));
+ os_free(mpi);
+ return NULL;
+ }
+
+ return (struct crypto_bignum *) mpi;
+}
+
+#endif /* CRYPTO_MBEDTLS_CRYPTO_EC_DPP */
+
+static mbedtls_md_type_t crypto_ec_key_sign_md(size_t len)
+{
+ /* get mbedtls_md_type_t from length of hash data to be signed */
+ switch (len)
+ {
+ case 64:
+ return MBEDTLS_MD_SHA512;
+ case 48:
+ return MBEDTLS_MD_SHA384;
+ case 32:
+ return MBEDTLS_MD_SHA256;
+ case 20:
+ return MBEDTLS_MD_SHA1;
+ case 16:
+ return MBEDTLS_MD_MD5;
+ default:
+ return MBEDTLS_MD_NONE;
+ }
+}
+
+struct wpabuf *crypto_ec_key_sign(struct crypto_ec_key *key, const u8 *data, size_t len)
+{
+ mbedtls_pk_context *pk = (mbedtls_pk_context *) key;
+ mbedtls_md_type_t md_alg = crypto_ec_key_sign_md(len);
+ uint8_t sig[MBEDTLS_PK_SIGNATURE_MAX_SIZE];
+ struct wpabuf *buf;
+ size_t sig_len;
+
+ if (mbedtls_pk_sign(pk, md_alg, data, len, sig, sizeof(sig), &sig_len) != 0) {
+ return NULL;
+ }
+
+ buf = wpabuf_alloc_copy(sig, sig_len);
+ if (buf == NULL) {
+ return NULL;
+ }
+
+ return buf;
+}
+
+#ifdef CRYPTO_MBEDTLS_CRYPTO_EC_DPP
+struct wpabuf *crypto_ec_key_sign_r_s(struct crypto_ec_key *key, const u8 *data, size_t len)
+{
+ mbedtls_pk_context *pk = (mbedtls_pk_context *) key;
+ mbedtls_md_type_t md_alg = crypto_ec_key_sign_md(len);
+ uint8_t sig[MBEDTLS_PK_SIGNATURE_MAX_SIZE];
+ uint8_t sig_raw[MBEDTLS_PK_SIGNATURE_MAX_SIZE];
+ size_t sig_len, sig_raw_len;
+ size_t bits;
+ struct wpabuf *buf;
+
+ if (mbedtls_pk_sign(pk, md_alg, data, len, sig, sizeof(sig), &sig_len) != 0) {
+ return NULL;
+ }
+
+ bits = mbedtls_pk_get_bitlen(pk);
+ if (mbedtls_ecdsa_der_to_raw(bits, sig, sig_len, sig_raw, sizeof(sig_raw), &sig_raw_len) != 0) {
+ return NULL;
+ }
+
+ buf = wpabuf_alloc_copy(sig_raw, sig_raw_len);
+ if (buf == NULL) {
+ return NULL;
+ }
+
+ return buf;
+}
+#endif /* CRYPTO_MBEDTLS_CRYPTO_EC_DPP */
+
+int crypto_ec_key_verify_signature(struct crypto_ec_key *key, const u8 *data, size_t len,
+ const u8 *sig, size_t sig_len)
+{
+ mbedtls_pk_context *pk = (mbedtls_pk_context *) key;
+ mbedtls_md_type_t md_alg = crypto_ec_key_sign_md(len);
+ int ret;
+
+ ret = mbedtls_pk_verify(pk, md_alg, data, len, sig, sig_len);
+ switch (ret) {
+ case 0:
+ return 1;
+ case PSA_ERROR_INVALID_SIGNATURE:
+ return 0;
+ default:
+ return -1;
+ }
+}
+
+#ifdef CRYPTO_MBEDTLS_CRYPTO_EC_DPP
+int crypto_ec_key_verify_signature_r_s(struct crypto_ec_key *key, const u8 *data, size_t len,
+ const u8 *r, size_t r_len, const u8 *s, size_t s_len)
+{
+ mbedtls_pk_context *pk = (mbedtls_pk_context *) key;
+ uint8_t sig[MBEDTLS_PK_SIGNATURE_MAX_SIZE] = { 0 };
+ uint8_t sig_raw[MBEDTLS_PK_SIGNATURE_MAX_SIZE] = { 0 };
+ size_t bits, sig_raw_len, sig_len;
+
+ memcpy(sig_raw, r, r_len);
+ memcpy(sig_raw + r_len, s, s_len);
+ sig_raw_len = r_len + s_len;
+
+ bits = mbedtls_pk_get_bitlen(pk);
+ if (mbedtls_ecdsa_raw_to_der(bits, sig_raw, sig_raw_len, sig, sizeof(sig), &sig_len) != 0) {
+ return -1;
+ }
+
+ return crypto_ec_key_verify_signature(key, data, len, sig, sig_len);
+}
+#endif /* CRYPTO_MBEDTLS_CRYPTO_EC_DPP */
+
+int crypto_ec_key_group(struct crypto_ec_key *key)
+{
+ mbedtls_pk_context *pk = (mbedtls_pk_context *) key;
+ mbedtls_ecp_group_id ecp_group_id;
+
+ ecp_group_id = mbedtls_ecc_group_from_psa(pk->MBEDTLS_PRIVATE(ec_family),
+ pk->MBEDTLS_PRIVATE(bits));
+ return crypto_mbedtls_ike_id_from_ecp_group_id(ecp_group_id);
+}
+
+#ifdef CRYPTO_MBEDTLS_CRYPTO_EC_DPP
+
+int crypto_ec_key_cmp(struct crypto_ec_key *key1, struct crypto_ec_key *key2)
+{
+ mbedtls_pk_context *pk1 = (mbedtls_pk_context *) key1;
+ mbedtls_pk_context *pk2 = (mbedtls_pk_context *) key2;
+
+ if (pk1->MBEDTLS_PRIVATE(pub_raw_len) != pk2->MBEDTLS_PRIVATE(pub_raw_len)) {
+ return -1;
+ }
+
+ if (memcmp(pk1->MBEDTLS_PRIVATE(pub_raw),
+ pk2->MBEDTLS_PRIVATE(pub_raw),
+ pk1->MBEDTLS_PRIVATE(pub_raw_len)) != 0) {
+ return -1;
+ }
+
+ return 0;
+}
+
+void crypto_ec_key_debug_print(const struct crypto_ec_key *key, const char *title)
+{
+ /* TBD: what info is desirable here and in what human readable format?*/
+ /*(crypto_openssl.c prints a human-readably public key and attributes)*/
+ wpa_printf(MSG_DEBUG, "%s: %s not implemented", title, __func__);
+}
+
+#endif /* CRYPTO_MBEDTLS_CRYPTO_EC_DPP */
+
+#endif /* CRYPTO_MBEDTLS_CRYPTO_EC */
+
+#ifdef CRYPTO_MBEDTLS_CRYPTO_CSR
+
+#include <mbedtls/x509_csr.h>
+#include <mbedtls/oid.h>
+
+struct crypto_csr *crypto_csr_init(void)
+{
+ mbedtls_x509write_csr *csr = os_malloc(sizeof(*csr));
+ if (csr != NULL)
+ mbedtls_x509write_csr_init(csr);
+ return (struct crypto_csr *)csr;
+}
+
+struct crypto_csr *crypto_csr_verify(const struct wpabuf *req)
+{
+ /* future: look for alternatives to MBEDTLS_PRIVATE() access */
+
+ /* sole caller src/common/dpp_crypto.c:dpp_validate_csr()
+ * uses (mbedtls_x509_csr *) to obtain CSR_ATTR_CHALLENGE_PASSWORD
+ * so allocate different object (mbedtls_x509_csr *) and special-case
+ * object when used in crypto_csr_get_attribute() and when free()d in
+ * crypto_csr_deinit(). */
+
+ mbedtls_x509_csr *csr = os_malloc(sizeof(*csr));
+ if (csr == NULL)
+ return NULL;
+ mbedtls_x509_csr_init(csr);
+ const mbedtls_md_info_t *md_info;
+ unsigned char digest[MBEDTLS_MD_MAX_SIZE];
+ if (mbedtls_x509_csr_parse_der(csr, wpabuf_head(req), wpabuf_len(req)) == 0 &&
+ (md_info = mbedtls_md_info_from_type(csr->MBEDTLS_PRIVATE(sig_md))) != NULL &&
+ mbedtls_md(md_info, csr->cri.p, csr->cri.len, digest) == 0)
+ {
+ switch (mbedtls_pk_verify(&csr->pk, csr->MBEDTLS_PRIVATE(sig_md), digest, mbedtls_md_get_size(md_info),
+ csr->MBEDTLS_PRIVATE(sig).p, csr->MBEDTLS_PRIVATE(sig).len))
+ {
+ case 0:
+ /*case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:*/ /* XXX: allow? */
+ return (struct crypto_csr *)((uintptr_t)csr | 1uL);
+ default:
+ break;
+ }
+ }
+
+ mbedtls_x509_csr_free(csr);
+ os_free(csr);
+ return NULL;
+}
+
+void crypto_csr_deinit(struct crypto_csr *csr)
+{
+ if ((uintptr_t)csr & 1uL) {
+ csr = (struct crypto_csr *)((uintptr_t)csr & ~1uL);
+ }
+
+ mbedtls_x509_csr *csr_ctx = (mbedtls_x509_csr *) csr;
+ mbedtls_x509_csr_free(csr_ctx);
+ os_free(csr);
+}
+
+int crypto_csr_set_ec_public_key(struct crypto_csr *csr, struct crypto_ec_key *key)
+{
+ mbedtls_x509write_csr_set_key((mbedtls_x509write_csr *) csr, (mbedtls_pk_context *) key);
+
+ return 0;
+}
+
+int crypto_csr_set_name(struct crypto_csr *csr, enum crypto_csr_name type, const char *name)
+{
+ /* specialized for src/common/dpp_crypto.c */
+
+ /* sole caller src/common/dpp_crypto.c:dpp_build_csr()
+ * calls this function only once, using type == CSR_NAME_CN
+ * (If called more than once, this code would need to append
+ * components to the subject name, which we could do by
+ * appending to (mbedtls_x509write_csr *) private member
+ * mbedtls_asn1_named_data *MBEDTLS_PRIVATE(subject)) */
+
+ const char *label;
+ switch (type)
+ {
+ case CSR_NAME_CN:
+ label = "CN=";
+ break;
+ case CSR_NAME_SN:
+ label = "SN=";
+ break;
+ case CSR_NAME_C:
+ label = "C=";
+ break;
+ case CSR_NAME_O:
+ label = "O=";
+ break;
+ case CSR_NAME_OU:
+ label = "OU=";
+ break;
+ default:
+ return -1;
+ }
+
+ size_t len = strlen(name);
+ struct wpabuf *buf = wpabuf_alloc(3 + len + 1);
+ if (buf == NULL)
+ return -1;
+ wpabuf_put_data(buf, label, strlen(label));
+ wpabuf_put_data(buf, name, len + 1); /*(include trailing '\0')*/
+ /* Note: 'name' provided is set as given and should be backslash-escaped
+ * by caller when necessary, e.g. literal ',' which are not separating
+ * components should be backslash-escaped */
+
+ int ret = mbedtls_x509write_csr_set_subject_name((mbedtls_x509write_csr *)csr, wpabuf_head(buf)) ? -1 : 0;
+ wpabuf_free(buf);
+ return ret;
+}
+
+/* OBJ_pkcs9_challengePassword 1 2 840 113549 1 9 7 */
+static const char OBJ_pkcs9_challengePassword[] = MBEDTLS_OID_PKCS9 "\x07";
+
+int crypto_csr_set_attribute(
+ struct crypto_csr *csr, enum crypto_csr_attr attr, int attr_type, const u8 *value, size_t len)
+{
+ /* specialized for src/common/dpp_crypto.c */
+ /* sole caller src/common/dpp_crypto.c:dpp_build_csr() passes
+ * attr == CSR_ATTR_CHALLENGE_PASSWORD
+ * attr_type == ASN1_TAG_UTF8STRING */
+
+ const char *oid;
+ size_t oid_len;
+ switch (attr)
+ {
+ case CSR_ATTR_CHALLENGE_PASSWORD:
+ oid = OBJ_pkcs9_challengePassword;
+ oid_len = sizeof(OBJ_pkcs9_challengePassword) - 1;
+ break;
+ default:
+ return -1;
+ }
+
+ (void)oid;
+ (void)oid_len;
+
+ /* mbedtls does not currently provide way to set an attribute in a CSR:
+ * https://github.com/Mbed-TLS/mbedtls/issues/4886 */
+ wpa_printf(MSG_ERROR,
+ "mbedtls does not currently support setting challengePassword "
+ "attribute in CSR");
+ return -1;
+}
+
+const u8 *mbedtls_x509_csr_attr_oid_value(
+ mbedtls_x509_csr *csr, const char *oid, size_t oid_len, size_t *vlen, int *vtype)
+{
+ /* Note: mbedtls_x509_csr_parse_der() has parsed and validated CSR,
+ * so validation checks are not repeated here
+ *
+ * It would be nicer if (mbedtls_x509_csr *) had an mbedtls_x509_buf of
+ * Attributes (or at least a pointer) since mbedtls_x509_csr_parse_der()
+ * already parsed the rest of CertificationRequestInfo, some of which is
+ * repeated here to step to Attributes. Since csr->subject_raw.p points
+ * into csr->cri.p, which points into csr->raw.p, step over version and
+ * subject of CertificationRequestInfo (SEQUENCE) */
+ unsigned char *p = csr->subject_raw.p + csr->subject_raw.len;
+ unsigned char *end = csr->cri.p + csr->cri.len, *ext;
+ size_t len;
+
+ /* step over SubjectPublicKeyInfo */
+ mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
+ p += len;
+
+ /* Attributes
+ * { ATTRIBUTE:IOSet } ::= SET OF { SEQUENCE { OID, value } }
+ */
+ if (mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_CONTEXT_SPECIFIC) != 0)
+ {
+ return NULL;
+ }
+ while (p < end)
+ {
+ if (mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE) != 0)
+ {
+ return NULL;
+ }
+ ext = p;
+ p += len;
+
+ if (mbedtls_asn1_get_tag(&ext, end, &len, MBEDTLS_ASN1_OID) != 0)
+ return NULL;
+ if (oid_len != len || 0 != memcmp(ext, oid, oid_len))
+ continue;
+
+ /* found oid; return value */
+ *vtype = *ext++; /* tag */
+ return (mbedtls_asn1_get_len(&ext, end, vlen) == 0) ? ext : NULL;
+ }
+
+ return NULL;
+}
+
+const u8 *crypto_csr_get_attribute(struct crypto_csr *csr, enum crypto_csr_attr attr, size_t *len, int *type)
+{
+ /* specialized for src/common/dpp_crypto.c */
+ /* sole caller src/common/dpp_crypto.c:dpp_build_csr() passes
+ * attr == CSR_ATTR_CHALLENGE_PASSWORD */
+
+ const char *oid;
+ size_t oid_len;
+ switch (attr)
+ {
+ case CSR_ATTR_CHALLENGE_PASSWORD:
+ oid = OBJ_pkcs9_challengePassword;
+ oid_len = sizeof(OBJ_pkcs9_challengePassword) - 1;
+ break;
+ default:
+ return NULL;
+ }
+
+ /* see crypto_csr_verify(); expecting (mbedtls_x509_csr *) tagged |=1 */
+ if (!((uintptr_t)csr & 1uL))
+ return NULL;
+ csr = (struct crypto_csr *)((uintptr_t)csr & ~1uL);
+
+ return mbedtls_x509_csr_attr_oid_value((mbedtls_x509_csr *)csr, oid, oid_len, len, type);
+}
+
+struct wpabuf *crypto_csr_sign(struct crypto_csr *csr, struct crypto_ec_key *key, enum crypto_hash_alg algo)
+{
+ mbedtls_md_type_t sig_md;
+ switch (algo)
+ {
+ case CRYPTO_HASH_ALG_SHA256:
+ sig_md = MBEDTLS_MD_SHA256;
+ break;
+ case CRYPTO_HASH_ALG_SHA384:
+ sig_md = MBEDTLS_MD_SHA384;
+ break;
+ case CRYPTO_HASH_ALG_SHA512:
+ sig_md = MBEDTLS_MD_SHA512;
+ break;
+ default:
+ return NULL;
+ }
+ mbedtls_x509write_csr_set_md_alg((mbedtls_x509write_csr *)csr, sig_md);
+
+ unsigned char buf[4096]; /* XXX: large enough? too large? */
+ int len = mbedtls_x509write_csr_der((mbedtls_x509write_csr *)csr, buf, sizeof(buf));
+ if (len < 0)
+ return NULL;
+ /* Note: data is written at the end of the buffer! Use the
+ * return value to determine where you should start
+ * using the buffer */
+ return wpabuf_alloc_copy(buf + sizeof(buf) - len, (size_t)len);
+}
+
+#endif /* CRYPTO_MBEDTLS_CRYPTO_CSR */
+
+#ifdef CRYPTO_MBEDTLS_CRYPTO_PKCS7
+struct wpabuf *crypto_pkcs7_get_certificates(const struct wpabuf *pkcs7)
+{
+ return NULL;
+}
+#endif /* CRYPTO_MBEDTLS_CRYPTO_PKCS7 */
+
+#ifdef CRYPTO_MBEDTLS_CRYPTO_HPKE
+
+struct wpabuf *hpke_base_seal(enum hpke_kem_id kem_id,
+ enum hpke_kdf_id kdf_id,
+ enum hpke_aead_id aead_id,
+ struct crypto_ec_key *peer_pub,
+ const u8 *info,
+ size_t info_len,
+ const u8 *aad,
+ size_t aad_len,
+ const u8 *pt,
+ size_t pt_len)
+{
+ /* not yet implemented */
+ return NULL;
+}
+
+struct wpabuf *hpke_base_open(enum hpke_kem_id kem_id,
+ enum hpke_kdf_id kdf_id,
+ enum hpke_aead_id aead_id,
+ struct crypto_ec_key *own_priv,
+ const u8 *info,
+ size_t info_len,
+ const u8 *aad,
+ size_t aad_len,
+ const u8 *enc_ct,
+ size_t enc_ct_len)
+{
+ /* not yet implemented */
+ return NULL;
+}
+#endif
diff --git a/src/crypto/tls_psa.c b/src/crypto/tls_psa.c
new file mode 100644
index 000000000..57d7610e8
--- /dev/null
+++ b/src/crypto/tls_psa.c
@@ -0,0 +1,2999 @@
+/*
+ * SSL/TLS interface functions for the PSA crypto backend (MbedTLS TLS/X.509)
+ *
+ * Copyright (c) 2022, Glenn Strauss <gstrauss at gluelogic.com>
+ * Copyright (c) 2023-2024, NXP
+ * Copyright (c) 2024-2026, Nordic Semiconductor ASA
+ *
+ * This software may be distributed under the terms of the BSD license.
+ * See README for more details.
+ *
+ * Derived from the Zephyr Project hostap PSA port.
+ *
+ * template: src/crypto/tls_none.c
+ * reference: src/crypto/tls_*.c
+ *
+ * Known Limitations:
+ * - no TLSv1.3 (not available in mbedtls 2.x; experimental in mbedtls 3.x)
+ * - no OCSP (not yet available in mbedtls)
+ * - mbedtls does not support all certificate encodings used by hwsim tests
+ * PCKS#5 v1.5
+ * PCKS#12
+ * DH DSA
+ * - EAP-FAST, EAP-TEAP session ticket support not implemented in tls_mbedtls.c
+ * - mbedtls does not currently provide way to set an attribute in a CSR
+ * https://github.com/Mbed-TLS/mbedtls/issues/4886
+ * so tests/hwsim dpp_enterprise tests fail
+ * - DPP2 not supported
+ * PKCS#7 parsing is not supported in mbedtls
+ * See crypto_mbedtls.c:crypto_pkcs7_get_certificates() comments
+ * - DPP3 not supported
+ * hpke_base_seal() and hpke_base_seal() not implemented in crypto_mbedtls.c
+ *
+ * Status:
+ * - code written to be compatible with mbedtls 2.x and mbedtls 3.x
+ * (currently requires mbedtls >= 2.27.0 for mbedtls_mpi_random())
+ * (currently requires mbedtls >= 2.18.0 for mbedtls_ssl_tls_prf())
+ * - builds with tests/build/build-wpa_supplicant-mbedtls.config
+ * - passes all tests/ crypto module tests (incomplete coverage)
+ * ($ cd tests; make clean; make -j 4 run-tests CONFIG_TLS=mbedtls)
+ * - passes almost all tests/hwsim tests
+ * (hwsim tests skipped for missing features)
+ *
+ * RFE:
+ * - EAP-FAST, EAP-TEAP session ticket support not implemented in tls_mbedtls.c
+ * - client/server session resumption, and/or save client session ticket
+ */
+
+#include "includes.h"
+#include "utils/common.h"
+
+/* A few TLS internals (and the optional EAP-FAST path) poke MbedTLS private
+ * struct fields; opt in to private access. */
+#define MBEDTLS_DECLARE_PRIVATE_IDENTIFIERS
+#define MBEDTLS_ALLOW_PRIVATE_ACCESS
+
+#include <psa/crypto.h>
+#include <mbedtls/build_info.h>
+#include <mbedtls/error.h>
+#include <mbedtls/net_sockets.h> /* MBEDTLS_ERR_NET_* codes */
+#include <mbedtls/oid.h> /* MBEDTLS_OID_AT_* strings (CSR) */
+#include <mbedtls/pem.h>
+#include <mbedtls/platform.h> /* mbedtls_calloc() mbedtls_free() */
+#include <mbedtls/platform_util.h> /* mbedtls_platform_zeroize() */
+#include <mbedtls/ssl.h>
+#include <mbedtls/ssl_ticket.h>
+#include <mbedtls/x509.h>
+#include <mbedtls/x509_crt.h>
+#include <mbedtls/pk.h>
+#include <mbedtls/version.h> /* mbedtls_version_get_string() */
+
+#ifdef MBEDTLS_DEBUG_C
+#define DEBUG_THRESHOLD 4
+#include <mbedtls/debug.h>
+#endif /* MBEDTLS_DEBUG_C */
+
+#include "crypto.h" /* sha256_vector() */
+#include "tls.h"
+
+#ifndef SHA256_DIGEST_LENGTH
+#define SHA256_DIGEST_LENGTH 32
+#endif
+
+#ifndef MBEDTLS_EXPKEY_FIXED_SECRET_LEN
+#define MBEDTLS_EXPKEY_FIXED_SECRET_LEN 48
+#endif
+
+#ifndef MBEDTLS_EXPKEY_RAND_LEN
+#define MBEDTLS_EXPKEY_RAND_LEN 32
+#endif
+
+static mbedtls_ssl_export_keys_t tls_connection_export_keys_cb;
+
+/* hostapd/wpa_supplicant provides forced_memzero(),
+ * but prefer mbedtls_platform_zeroize() */
+#define forced_memzero(ptr, sz) mbedtls_platform_zeroize(ptr, sz)
+
+/* much of fine-grained certificate subject matching (300+ LoC) could probably
+ * be replaced by sending a DN hint with ServerHello Certificate Request, and
+ * then checking the client cert against the DN hint in certificate verify_cb.
+ * Comment out to disable feature and remove ~3k from binary .text segment */
+#define TLS_MBEDTLS_CERT_VERIFY_EXTMATCH
+#define TLS_MBEDTLS_CERT_DISABLE_KEY_USAGE_CHECK
+
+#if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST) || defined(EAP_TEAP) || \
+ defined(EAP_SERVER_TEAP)
+#ifdef MBEDTLS_SSL_SESSION_TICKETS
+#ifdef MBEDTLS_SSL_TICKET_C
+#define TLS_MBEDTLS_SESSION_TICKETS
+#if defined(EAP_TEAP) || defined(EAP_SERVER_TEAP)
+#define TLS_MBEDTLS_EAP_TEAP
+#endif
+#if !defined(CONFIG_FIPS) /* EAP-FAST keys cannot be exported in FIPS mode */
+#if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
+#define TLS_MBEDTLS_EAP_FAST
+#endif
+#endif
+#endif
+#endif
+#endif
+
+struct tls_conf
+{
+ mbedtls_ssl_config conf;
+
+ unsigned int verify_peer : 1;
+ unsigned int verify_depth0_only : 1;
+ unsigned int check_crl : 2; /*(needs :2 bits for 0, 1, 2)*/
+ unsigned int check_crl_strict : 1; /*(needs :1 bit for 0, 1)*/
+ unsigned int ca_cert_probe : 1;
+ unsigned int has_ca_cert : 1;
+ unsigned int has_client_cert : 1;
+ unsigned int has_private_key : 1;
+ unsigned int suiteb128 : 1;
+ unsigned int suiteb192 : 1;
+ mbedtls_x509_crl *crl;
+ mbedtls_x509_crt ca_cert;
+ mbedtls_x509_crt client_cert;
+ mbedtls_pk_context private_key;
+
+ uint32_t refcnt;
+
+ unsigned int flags;
+#ifdef TLS_MBEDTLS_CERT_VERIFY_EXTMATCH
+ char *subject_match;
+ char *altsubject_match;
+ char *suffix_match;
+ char *domain_match;
+ char *check_cert_subject;
+#endif
+ u8 ca_cert_hash[SHA256_DIGEST_LENGTH];
+
+ int *ciphersuites; /* list of ciphersuite ids for mbedtls_ssl_config */
+ uint16_t *curves; /* list of curve ids for mbedtls_ssl_config */
+};
+
+struct tls_global
+{
+ struct tls_conf *tls_conf;
+ char *ocsp_stapling_response;
+#ifdef MBEDTLS_SSL_SESSION_TICKETS
+ mbedtls_ssl_ticket_context ticket_ctx;
+#endif
+ char *ca_cert_file;
+ struct os_reltime crl_reload_previous;
+ unsigned int crl_reload_interval;
+ uint32_t refcnt;
+ struct tls_config init_conf;
+};
+
+static struct tls_global tls_ctx_global;
+
+struct tls_connection
+{
+ struct tls_conf *tls_conf;
+ struct wpabuf *push_buf;
+ struct wpabuf *pull_buf;
+ size_t pull_buf_offset;
+
+ unsigned int established : 1;
+ unsigned int resumed : 1;
+ unsigned int verify_peer : 1;
+ unsigned int is_server : 1;
+
+ mbedtls_ssl_context ssl;
+
+ mbedtls_tls_prf_types tls_prf_type;
+ size_t expkey_keyblock_size;
+ size_t expkey_secret_len;
+ unsigned char expkey_secret[48];
+ unsigned char expkey_randbytes[MBEDTLS_EXPKEY_RAND_LEN * 2];
+
+ int read_alerts, write_alerts, failed;
+
+#ifdef TLS_MBEDTLS_SESSION_TICKETS
+ tls_session_ticket_cb session_ticket_cb;
+ void *session_ticket_cb_ctx;
+ unsigned char *clienthello_session_ticket;
+ size_t clienthello_session_ticket_len;
+#endif
+ char *peer_subject; /* peer subject info for authenticated peer */
+ struct wpabuf *success_data;
+};
+
+#ifndef __has_attribute
+#define __has_attribute(x) 0
+#endif
+
+#ifndef __GNUC_PREREQ
+#define __GNUC_PREREQ(maj, min) 0
+#endif
+
+#ifndef __attribute_cold__
+#if __has_attribute(cold) || __GNUC_PREREQ(4, 3)
+#define __attribute_cold__ __attribute__((__cold__))
+#else
+#define __attribute_cold__
+#endif
+#endif
+
+#ifndef __attribute_noinline__
+#if __has_attribute(noinline) || __GNUC_PREREQ(3, 1)
+#define __attribute_noinline__ __attribute__((__noinline__))
+#else
+#define __attribute_noinline__
+#endif
+#endif
+
+__attribute_cold__ __attribute_noinline__ static void emsg(int level, const char *const msg)
+{
+ wpa_printf(level, "MTLS: %s", msg);
+}
+
+__attribute_cold__ __attribute_noinline__ static void emsgrc(int level, const char *const msg, int rc)
+{
+#ifdef MBEDTLS_ERROR_C
+ /* error logging convenience function that decodes mbedtls result codes */
+ char buf[256];
+ mbedtls_strerror(rc, buf, sizeof(buf));
+ wpa_printf(level, "MTLS: %s: %s (-0x%04x)", msg, buf, -rc);
+#else
+ wpa_printf(level, "MTLS: %s: (-0x%04x)", msg, -rc);
+#endif
+}
+
+#define elog(rc, msg) emsgrc(MSG_ERROR, (msg), (rc))
+#define ilog(rc, msg) emsgrc(MSG_INFO, (msg), (rc))
+
+#ifdef MBEDTLS_DEBUG_C
+static void (*g_f_dbg)(void *, int, const char *, int, const char *);
+
+#ifdef __ICCARM__
+#define PATH_SEPARATOR '\\'
+#else
+#define PATH_SEPARATOR '/'
+#endif /* __ICCARM__ */
+
+/*
+ * This function will return basename of filename i.e.
+ * it will return a pointer to basename in the filename after ignoring '/'.
+ *
+ * e.g. for filename "abc/xyx/some_name.c", this function will return
+ * pointer to basename i.e. "some_name.c"
+ */
+static char *get_basename(char *file_name)
+{
+ char *p = strrchr(file_name, PATH_SEPARATOR);
+ return p ? ++p : file_name;
+}
+
+static void tls_mbedtls_f_dbg(void *ctx, int level, const char *file, int line, const char *str)
+{
+ wpa_printf(MSG_DEBUG, "tls_mbedtls: %s:%04d: |%d| %s",
+ get_basename((char *)file), line, level, str);
+}
+
+void tls_mbedtls_set_debug_cb(mbedtls_ssl_config *conf,
+ int threshold,
+ void (*f_dbg)(void *, int, const char *, int, const char *))
+{
+ if (!conf)
+ {
+ elog(-1, "Invalid SSL configuration context");
+ return;
+ }
+
+ if (!f_dbg && !g_f_dbg)
+ {
+ /**
+ * If 'NULL' dbg function and 'g_f_dbg' has not been set yet,
+ * then set 'g_f_dbg' pointing to global dbg function,
+ * and set it in conf.
+ */
+ g_f_dbg = tls_mbedtls_f_dbg;
+ mbedtls_ssl_conf_dbg(conf, g_f_dbg, NULL);
+ }
+ else if (!f_dbg && g_f_dbg)
+ {
+ /**
+ * If 'NULL' dbg function and already set 'g_f_dbg',
+ * we will not override 'g_f_dbg',
+ * but set it in conf.
+ */
+ mbedtls_ssl_conf_dbg(conf, g_f_dbg, NULL);
+ }
+ else if (f_dbg)
+ {
+ /**
+ * If valid dbg function then set it in conf.
+ */
+ mbedtls_ssl_conf_dbg(conf, f_dbg, NULL);
+ }
+ mbedtls_debug_set_threshold(threshold);
+}
+#endif /* MBEDTLS_DEBUG_C */
+
+struct tls_conf *tls_conf_init(void *tls_ctx)
+{
+ struct tls_conf *tls_conf = os_zalloc(sizeof(*tls_conf));
+ if (tls_conf == NULL)
+ return NULL;
+ tls_conf->refcnt = 1;
+
+ mbedtls_ssl_config_init(&tls_conf->conf);
+ mbedtls_x509_crt_init(&tls_conf->ca_cert);
+ mbedtls_x509_crt_init(&tls_conf->client_cert);
+ mbedtls_pk_init(&tls_conf->private_key);
+
+#ifdef MBEDTLS_DEBUG_C
+ tls_mbedtls_set_debug_cb(&tls_conf->conf, DEBUG_THRESHOLD, NULL);
+#endif
+ return tls_conf;
+}
+
+struct tls_conf *tls_conf_deinit(struct tls_conf *tls_conf)
+{
+ if (tls_conf == NULL || --tls_conf->refcnt != 0)
+ return tls_conf;
+
+ mbedtls_x509_crt_free(&tls_conf->ca_cert);
+ mbedtls_x509_crt_free(&tls_conf->client_cert);
+ if (tls_conf->crl)
+ {
+ mbedtls_x509_crl_free(tls_conf->crl);
+ os_free(tls_conf->crl);
+ }
+ mbedtls_pk_free(&tls_conf->private_key);
+ mbedtls_ssl_config_free(&tls_conf->conf);
+ os_free(tls_conf->curves);
+ os_free(tls_conf->ciphersuites);
+#ifdef TLS_MBEDTLS_CERT_VERIFY_EXTMATCH
+ os_free(tls_conf->subject_match);
+ os_free(tls_conf->altsubject_match);
+ os_free(tls_conf->suffix_match);
+ os_free(tls_conf->domain_match);
+ os_free(tls_conf->check_cert_subject);
+#endif
+ os_free(tls_conf);
+ return NULL;
+}
+
+__attribute_cold__ void *tls_init(const struct tls_config *conf)
+{
+ /* RFE: review struct tls_config *conf (different from tls_conf) */
+
+ if (++tls_ctx_global.refcnt > 1)
+ return &tls_ctx_global;
+
+ /* PSA must be initialized before any psa_*() use (RNG, ticket setup,
+ * key derivation). psa_crypto_init() is idempotent. */
+ if (psa_crypto_init() != PSA_SUCCESS) {
+ wpa_printf(MSG_ERROR, "Failed to initialize PSA crypto");
+ tls_ctx_global.refcnt--;
+ return NULL;
+ }
+
+#ifdef MBEDTLS_SSL_SESSION_TICKETS
+ mbedtls_ssl_ticket_init(&tls_ctx_global.ticket_ctx);
+ if (mbedtls_ssl_ticket_setup(&tls_ctx_global.ticket_ctx, PSA_ALG_GCM, PSA_KEY_TYPE_AES, 256,
+ 43200) != 0) /* ticket timeout: 12 hours */
+ {
+ wpa_printf(MSG_ERROR, "Failed to setup SSL ticket context");
+ return NULL;
+ }
+#endif
+ /* copy struct for future use */
+ tls_ctx_global.init_conf = *conf;
+ if (conf->openssl_ciphers)
+ tls_ctx_global.init_conf.openssl_ciphers = os_strdup(conf->openssl_ciphers);
+
+ tls_ctx_global.crl_reload_interval = conf->crl_reload_interval;
+ os_get_reltime(&tls_ctx_global.crl_reload_previous);
+
+ return &tls_ctx_global;
+}
+
+__attribute_cold__ void tls_deinit(void *tls_ctx)
+{
+ if (tls_ctx == NULL)
+ return;
+
+ tls_ctx_global.tls_conf = tls_conf_deinit(tls_ctx_global.tls_conf);
+
+ if (--tls_ctx_global.refcnt != 0)
+ return;
+
+ os_free(tls_ctx_global.ca_cert_file);
+ os_free(tls_ctx_global.ocsp_stapling_response);
+ char *openssl_ciphers; /*(allocated in tls_init())*/
+ *(const char **)&openssl_ciphers = tls_ctx_global.init_conf.openssl_ciphers;
+ os_free(openssl_ciphers);
+#ifdef MBEDTLS_SSL_SESSION_TICKETS
+ mbedtls_ssl_ticket_free(&tls_ctx_global.ticket_ctx);
+#endif
+ os_memset(&tls_ctx_global, 0, sizeof(tls_ctx_global));
+}
+
+int tls_get_errors(void *tls_ctx)
+{
+ return 0;
+}
+
+static void tls_connection_deinit_expkey(struct tls_connection *conn)
+{
+ conn->tls_prf_type = 0; /* MBEDTLS_SSL_TLS_PRF_NONE; */
+ conn->expkey_keyblock_size = 0;
+ conn->expkey_secret_len = 0;
+ forced_memzero(conn->expkey_secret, sizeof(conn->expkey_secret));
+ forced_memzero(conn->expkey_randbytes, sizeof(conn->expkey_randbytes));
+}
+
+#ifdef TLS_MBEDTLS_SESSION_TICKETS
+void tls_connection_deinit_clienthello_session_ticket(struct tls_connection *conn)
+{
+ if (conn->clienthello_session_ticket)
+ {
+ mbedtls_platform_zeroize(conn->clienthello_session_ticket, conn->clienthello_session_ticket_len);
+ mbedtls_free(conn->clienthello_session_ticket);
+ conn->clienthello_session_ticket = NULL;
+ conn->clienthello_session_ticket_len = 0;
+ }
+}
+#endif
+
+void tls_connection_deinit(void *tls_ctx, struct tls_connection *conn)
+{
+ if (conn == NULL)
+ return;
+
+ if (conn->tls_prf_type)
+ tls_connection_deinit_expkey(conn);
+
+#ifdef TLS_MBEDTLS_SESSION_TICKETS
+ if (conn->clienthello_session_ticket)
+ tls_connection_deinit_clienthello_session_ticket(conn);
+#endif
+
+ os_free(conn->peer_subject);
+ wpabuf_free(conn->success_data);
+ wpabuf_free(conn->push_buf);
+ wpabuf_free(conn->pull_buf);
+ mbedtls_ssl_free(&conn->ssl);
+ tls_conf_deinit(conn->tls_conf);
+ os_free(conn);
+}
+
+static void tls_mbedtls_refresh_crl(void);
+static int tls_mbedtls_ssl_setup(struct tls_connection *conn);
+
+struct tls_connection *tls_connection_init(void *tls_ctx)
+{
+ struct tls_connection *conn = os_zalloc(sizeof(*conn));
+ if (conn == NULL)
+ return NULL;
+
+ mbedtls_ssl_init(&conn->ssl);
+
+ conn->tls_conf = tls_ctx_global.tls_conf; /*(inherit global conf, if set)*/
+ if (conn->tls_conf)
+ {
+ ++conn->tls_conf->refcnt;
+ /* check for CRL refresh if inheriting from global config */
+ tls_mbedtls_refresh_crl();
+
+ conn->verify_peer = conn->tls_conf->verify_peer;
+ if (tls_mbedtls_ssl_setup(conn) != 0)
+ {
+ tls_connection_deinit(&tls_ctx_global, conn);
+ return NULL;
+ }
+ }
+
+ return conn;
+}
+
+int tls_connection_established(void *tls_ctx, struct tls_connection *conn)
+{
+ return conn ? conn->established : 0;
+}
+
+__attribute_noinline__ char *tls_mbedtls_peer_serial_num(const mbedtls_x509_crt *crt, char *serial_num, size_t len)
+{
+ /* mbedtls_x509_serial_gets() inefficiently formats to hex separated by
+ * colons, so generate the hex serial number here. The func
+ * wpa_snprintf_hex_uppercase() is similarly inefficient. */
+ size_t i = 0; /* skip leading 0's per Distinguished Encoding Rules (DER) */
+ while (i < crt->serial.len && crt->serial.p[i] == 0)
+ ++i;
+ if (i == crt->serial.len)
+ --i;
+
+ const unsigned char *s = crt->serial.p + i;
+ const size_t e = (crt->serial.len - i) * 2;
+ if (e >= len)
+ return NULL;
+
+ for (i = 0; i < e; i += 2, ++s)
+ {
+ serial_num[i + 0] = "0123456789ABCDEF"[(*s >> 4)];
+ serial_num[i + 1] = "0123456789ABCDEF"[(*s & 0xF)];
+ }
+ serial_num[e] = '\0';
+
+ return serial_num;
+}
+
+char *tls_connection_peer_serial_num(void *tls_ctx, struct tls_connection *conn)
+{
+ const mbedtls_x509_crt *crt = mbedtls_ssl_get_peer_cert(&conn->ssl);
+ if (crt == NULL)
+ return NULL;
+ size_t len = crt->serial.len * 2 + 1;
+ char *serial_num = os_malloc(len);
+ if (!serial_num)
+ return NULL;
+ return tls_mbedtls_peer_serial_num(crt, serial_num, len);
+}
+
+static void tls_pull_buf_reset(struct tls_connection *conn);
+
+int tls_connection_shutdown(void *tls_ctx, struct tls_connection *conn)
+{
+ /* Note: this function called from eap_peer_tls_reauth_init()
+ * for session resumption, not for connection shutdown */
+
+ if (conn == NULL)
+ return -1;
+
+ tls_pull_buf_reset(conn);
+ wpabuf_free(conn->push_buf);
+ conn->push_buf = NULL;
+ conn->established = 0;
+ conn->resumed = 0;
+ if (conn->tls_prf_type)
+ tls_connection_deinit_expkey(conn);
+
+ /* RFE: prepare for session resumption? (see doc in crypto/tls.h) */
+
+ return mbedtls_ssl_session_reset(&conn->ssl);
+}
+
+static int tls_wpabuf_resize_put_data(struct wpabuf **buf, const unsigned char *data, size_t dlen)
+{
+ if (wpabuf_resize(buf, dlen) < 0)
+ return 0;
+ wpabuf_put_data(*buf, data, dlen);
+ return 1;
+}
+
+static int tls_pull_buf_append(struct tls_connection *conn, const struct wpabuf *in_data)
+{
+ /*(interface does not lend itself to move semantics)*/
+ return tls_wpabuf_resize_put_data(&conn->pull_buf, wpabuf_head(in_data), wpabuf_len(in_data));
+}
+
+static void tls_pull_buf_reset(struct tls_connection *conn)
+{
+ /*(future: might consider reusing conn->pull_buf)*/
+ wpabuf_free(conn->pull_buf);
+ conn->pull_buf = NULL;
+ conn->pull_buf_offset = 0;
+}
+
+__attribute_cold__ static void tls_pull_buf_discard(struct tls_connection *conn, const char *func)
+{
+ size_t discard = wpabuf_len(conn->pull_buf) - conn->pull_buf_offset;
+ if (discard)
+ wpa_printf(MSG_DEBUG, "%s - %zu bytes remaining in pull_buf; discarding", func, discard);
+ tls_pull_buf_reset(conn);
+}
+
+static int tls_pull_func(void *ptr, unsigned char *buf, size_t len)
+{
+ struct tls_connection *conn = (struct tls_connection *)ptr;
+ if (conn->pull_buf == NULL)
+ return MBEDTLS_ERR_SSL_WANT_READ;
+ const size_t dlen = wpabuf_len(conn->pull_buf) - conn->pull_buf_offset;
+ if (dlen == 0)
+ return MBEDTLS_ERR_SSL_WANT_READ;
+
+ if (len > dlen)
+ len = dlen;
+ os_memcpy(buf, (u8 *)wpabuf_head(conn->pull_buf) + conn->pull_buf_offset, len);
+
+ if (len == dlen)
+ {
+ tls_pull_buf_reset(conn);
+ /*wpa_printf(MSG_DEBUG, "%s - emptied pull_buf", __func__);*/
+ }
+ else
+ {
+ conn->pull_buf_offset += len;
+ /*wpa_printf(MSG_DEBUG, "%s - %zu bytes remaining in pull_buf",
+ __func__, dlen - len);*/
+ }
+ return (int)len;
+}
+
+static int tls_push_func(void *ptr, const unsigned char *buf, size_t len)
+{
+ struct tls_connection *conn = (struct tls_connection *)ptr;
+ return tls_wpabuf_resize_put_data(&conn->push_buf, buf, len) ? (int)len : MBEDTLS_ERR_SSL_ALLOC_FAILED;
+}
+
+static int tls_mbedtls_verify_cb(void *arg, mbedtls_x509_crt *crt, int depth, uint32_t *flags);
+
+static int tls_mbedtls_ssl_setup(struct tls_connection *conn)
+{
+ int ret = mbedtls_ssl_setup(&conn->ssl, &conn->tls_conf->conf);
+ if (ret != 0)
+ {
+ elog(ret, "mbedtls_ssl_setup");
+ return -1;
+ }
+
+ mbedtls_ssl_set_bio(&conn->ssl, conn, tls_push_func, tls_pull_func, NULL);
+ mbedtls_ssl_set_export_keys_cb(&conn->ssl, tls_connection_export_keys_cb, conn);
+ if (conn->verify_peer)
+ mbedtls_ssl_set_verify(&conn->ssl, tls_mbedtls_verify_cb, conn);
+
+ return 0;
+}
+
+static int tls_mbedtls_data_is_pem(const u8 *data)
+{
+ return (NULL != os_strstr((char *)data, "-----"));
+}
+
+static void tls_mbedtls_set_allowed_tls_vers(struct tls_conf *tls_conf, mbedtls_ssl_config *conf)
+{
+#if !defined(MBEDTLS_SSL_PROTO_TLS1_3)
+ tls_conf->flags |= TLS_CONN_DISABLE_TLSv1_3;
+#endif
+
+ /* unconditionally require TLSv1.2+ for TLS_CONN_SUITEB */
+ if (tls_conf->flags & TLS_CONN_SUITEB)
+ {
+ tls_conf->flags |= TLS_CONN_DISABLE_TLSv1_0;
+ tls_conf->flags |= TLS_CONN_DISABLE_TLSv1_1;
+ }
+
+ const unsigned int flags = tls_conf->flags;
+
+ /* attempt to map flags to min and max TLS protocol version */
+
+ int min = (flags & TLS_CONN_DISABLE_TLSv1_0) ?
+ (flags & TLS_CONN_DISABLE_TLSv1_1) ?
+ (flags & TLS_CONN_DISABLE_TLSv1_2) ? (flags & TLS_CONN_DISABLE_TLSv1_3) ? 4 : 3 : 2 :
+ 1 :
+ 0;
+
+ int max = (flags & TLS_CONN_DISABLE_TLSv1_3) ?
+ (flags & TLS_CONN_DISABLE_TLSv1_2) ?
+ (flags & TLS_CONN_DISABLE_TLSv1_1) ? (flags & TLS_CONN_DISABLE_TLSv1_0) ? -1 : 0 : 1 :
+ 2 :
+ 3;
+
+ if ((flags & TLS_CONN_ENABLE_TLSv1_2) && min > 2)
+ min = 2;
+ if ((flags & TLS_CONN_ENABLE_TLSv1_1) && min > 1)
+ min = 1;
+ if ((flags & TLS_CONN_ENABLE_TLSv1_0) && min > 0)
+ min = 0;
+ if (max < min)
+ {
+ emsg(MSG_ERROR, "invalid tls_disable_tlsv* params; ignoring");
+ return;
+ }
+ /* mbed TLS 3.0.0 removes support for protocols < TLSv1.2 */
+ if (min < 2 || max < 2)
+ {
+ if (min < 2)
+ min = 2;
+ if (max < 2)
+ max = 2;
+ }
+
+ /* MBEDTLS_SSL_VERSION_TLS1_2 = 0x0303 */ /*!< (D)TLS 1.2 */
+ /* MBEDTLS_SSL_VERSION_TLS1_3 = 0x0304 */ /*!< (D)TLS 1.3 */
+ min = (min == 2) ? MBEDTLS_SSL_VERSION_TLS1_2 : MBEDTLS_SSL_VERSION_TLS1_3;
+ max = (max == 2) ? MBEDTLS_SSL_VERSION_TLS1_2 : MBEDTLS_SSL_VERSION_TLS1_3;
+ mbedtls_ssl_conf_min_tls_version(conf, min);
+ mbedtls_ssl_conf_max_tls_version(conf, max);
+}
+
+__attribute_noinline__ static int tls_mbedtls_readfile(const char *path, u8 **buf, size_t *n);
+
+#ifdef MBEDTLS_DHM_C
+/*
+ * Mbed TLS 4.x removes DHE configuration on the SSL stack
+ * (mbedtls_ssl_conf_dh_param_ctx, mbedtls_ssl_conf_dhm_min_bitlen). Custom DH
+ * blobs from the caller cannot be applied; warn and succeed so TLS setup
+ * continues without legacy DHE.
+ */
+static int tls_mbedtls_set_dhparams(struct tls_conf *tls_conf, const struct tls_connection_params *params)
+{
+ (void)tls_conf;
+
+ if (params->dh_file)
+ {
+ wpa_printf(MSG_WARNING,
+ "MTLS: custom DH parameters are not applied with mbed TLS %d",
+ MBEDTLS_VERSION_MAJOR);
+ }
+ return 1;
+}
+#endif
+
+/* reference: lighttpd src/mod_mbedtls.c:mod_mbedtls_ssl_append_curve()
+ * (same author: gstrauss at gluelogic.com; same license: BSD-3-Clause) */
+
+static int tls_mbedtls_append_curve(uint16_t *ids, int nids, int idsz, const uint16_t id)
+{
+ if (1 >= idsz - (nids + 1))
+ {
+ emsg(MSG_ERROR, "error: too many curves during list expand");
+ return -1;
+ }
+ ids[++nids] = id;
+ return nids;
+}
+
+static int tls_mbedtls_set_curves(struct tls_conf *tls_conf, const char *curvelist)
+{
+ /* TLS Supported Groups (renamed from "EC Named Curve Registry")
+ * https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
+ */
+ uint16_t ids[512];
+ int nids = -1;
+ const int idsz = (int)(sizeof(ids) / sizeof(*ids) - 1);
+
+ for (const char *e = curvelist - 1; e;)
+ {
+ const char *const n = e + 1;
+ e = os_strchr(n, ':');
+ size_t len = e ? (size_t)(e - n) : os_strlen(n);
+ uint16_t tls_id = 0;
+ switch (len)
+ {
+ case 5:
+ if (0 == os_memcmp("P-521", n, 5))
+ tls_id = 25; /* mbedtls_ecp_group_id MBEDTLS_ECP_DP_SECP521R1 */
+ else if (0 == os_memcmp("P-384", n, 5))
+ tls_id = 24; /* mbedtls_ecp_group_id MBEDTLS_ECP_DP_SECP384R1 */
+ else if (0 == os_memcmp("P-256", n, 5))
+ tls_id = 23; /* mbedtls_ecp_group_id MBEDTLS_ECP_DP_SECP256R1 */
+ break;
+ case 6:
+ if (0 == os_memcmp("BP-521", n, 6))
+ tls_id = 28; /* mbedtls_ecp_group_id MBEDTLS_ECP_DP_BP512R1 */
+ else if (0 == os_memcmp("BP-384", n, 6))
+ tls_id = 27; /* mbedtls_ecp_group_id MBEDTLS_ECP_DP_BP384R1 */
+ else if (0 == os_memcmp("BP-256", n, 6))
+ tls_id = 26; /* mbedtls_ecp_group_id MBEDTLS_ECP_DP_BP256R1 */
+ break;
+ default:
+ break;
+ }
+ if (tls_id != 0)
+ {
+ nids = tls_mbedtls_append_curve(ids, nids, idsz, tls_id);
+ if (-1 == nids)
+ return 0;
+ continue;
+ }
+ /* Only the named curves handled above are supported; the dynamic
+ * mbedtls_ecp_curve_info table is private in MbedTLS 4 /
+ * TF-PSA-Crypto and is intentionally not used here. */
+ wpa_printf(MSG_ERROR, "MTLS: unrecognized curve: %.*s", (int)len, n);
+ return 0;
+ }
+
+ /* mod_openssl configures "prime256v1" if curve list not specified,
+ * but mbedtls provides a list of supported curves if not explicitly set */
+ if (-1 == nids)
+ return 1; /* empty list; no-op */
+
+ ids[++nids] = 0; /* terminate list */
+ ++nids;
+
+ /* curves list must be persistent for lifetime of mbedtls_ssl_config */
+ tls_conf->curves = os_malloc(nids * sizeof(uint16_t));
+ if (tls_conf->curves == NULL)
+ return 0;
+ os_memcpy(tls_conf->curves, ids, nids * sizeof(uint16_t));
+
+ mbedtls_ssl_conf_groups(&tls_conf->conf, tls_conf->curves);
+ return 1;
+}
+
+
+/* data copied from lighttpd src/mod_mbedtls.c (BSD-3-Clause) */
+static const int suite_AES_256_ephemeral[] = {
+ /* All AES-256 ephemeral suites */
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+ MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM,
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
+ MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+ MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8,
+};
+
+/* data copied from lighttpd src/mod_mbedtls.c (BSD-3-Clause) */
+static const int suite_AES_128_ephemeral[] = {
+ /* All AES-128 ephemeral suites */
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+ MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM,
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
+ MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
+ MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8,
+};
+
+/* data copied from lighttpd src/mod_mbedtls.c (BSD-3-Clause) */
+/* HIGH cipher list (mapped from openssl list to mbedtls) */
+static const int suite_HIGH[] = {MBEDTLS_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+ MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM,
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
+ MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+ MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8,
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384,
+ MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384,
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384,
+ MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384,
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
+ MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM,
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
+ MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
+ MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8,
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256,
+ MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
+ MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256,
+ MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256,
+ MBEDTLS_TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256,
+ MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384,
+ MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA,
+ MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384,
+ MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256,
+ MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA,
+ MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256,
+ MBEDTLS_TLS_PSK_WITH_CHACHA20_POLY1305_SHA256,
+ MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384,
+ MBEDTLS_TLS_PSK_WITH_AES_256_CCM,
+ MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384,
+ MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA,
+ MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384,
+ MBEDTLS_TLS_PSK_WITH_AES_256_CCM_8,
+ MBEDTLS_TLS_PSK_WITH_ARIA_256_GCM_SHA384,
+ MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256,
+ MBEDTLS_TLS_PSK_WITH_AES_128_CCM,
+ MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256,
+ MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA,
+ MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256,
+ MBEDTLS_TLS_PSK_WITH_AES_128_CCM_8,
+ MBEDTLS_TLS_PSK_WITH_ARIA_128_GCM_SHA256};
+
+__attribute_noinline__ static int tls_mbedtls_append_ciphersuite(int *ids, int nids, int idsz, const int *x, int xsz)
+{
+ if (xsz >= idsz - (nids + 1))
+ {
+ emsg(MSG_ERROR, "error: too many ciphers during list expand");
+ return -1;
+ }
+
+ for (int i = 0; i < xsz; ++i)
+ ids[++nids] = x[i];
+
+ return nids;
+}
+
+static int tls_mbedtls_translate_ciphername(int id, char *buf, size_t buflen)
+{
+ const mbedtls_ssl_ciphersuite_t *info = mbedtls_ssl_ciphersuite_from_id(id);
+ if (info == NULL)
+ return 0;
+ const char *name = mbedtls_ssl_ciphersuite_get_name(info);
+ const size_t len = os_strlen(name);
+ if (len == 7 && 0 == os_memcmp(name, "unknown", 7))
+ return 0;
+ if (len >= buflen)
+ return 0;
+ os_strlcpy(buf, name, buflen);
+
+ /* attempt to translate mbedtls string to openssl string
+ * (some heuristics; incomplete) */
+ size_t i = 0, j = 0;
+ if (buf[0] == 'T')
+ {
+ if (os_strncmp(buf, "TLS1-3-", 7) == 0)
+ {
+ buf[3] = '-';
+ j = 4; /* remove "1-3" from "TLS1-3-" prefix */
+ i = 7;
+ }
+ else if (os_strncmp(buf, "TLS-", 4) == 0)
+ i = 4; /* remove "TLS-" prefix */
+ }
+ for (; buf[i]; ++i)
+ {
+ if (buf[i] == '-')
+ {
+ if (i >= 3)
+ {
+ if (0 == os_memcmp(buf + i - 3, "AES", 3))
+ continue; /* "AES-" -> "AES" */
+ }
+ if (i >= 4)
+ {
+ if (0 == os_memcmp(buf + i - 4, "WITH", 4))
+ {
+ j -= 4; /* remove "WITH-" */
+ continue;
+ }
+ }
+ }
+ buf[j++] = buf[i];
+ }
+ buf[j] = '\0';
+
+ return j;
+}
+
+__attribute_noinline__ static int tls_mbedtls_set_ciphersuites(struct tls_conf *tls_conf, int *ids, int nids)
+{
+ /* ciphersuites list must be persistent for lifetime of mbedtls_ssl_config*/
+ os_free(tls_conf->ciphersuites);
+ tls_conf->ciphersuites = os_malloc(nids * sizeof(int));
+ if (tls_conf->ciphersuites == NULL)
+ return 0;
+ os_memcpy(tls_conf->ciphersuites, ids, nids * sizeof(int));
+ mbedtls_ssl_conf_ciphersuites(&tls_conf->conf, tls_conf->ciphersuites);
+ return 1;
+}
+
+static int tls_mbedtls_set_ciphers(struct tls_conf *tls_conf, const char *ciphers)
+{
+ char buf[64];
+ int ids[512];
+ int nids = -1;
+ const int idsz = (int)(sizeof(ids) / sizeof(*ids) - 1);
+ const char *next;
+ size_t blen, clen;
+ do
+ {
+ next = os_strchr(ciphers, ':');
+ clen = next ? (size_t)(next - ciphers) : os_strlen(ciphers);
+ if (!clen)
+ continue;
+
+ /* special-case a select set of openssl group names for hwsim tests */
+ /* (review; remove excess code if tests are not run for non-OpenSSL?) */
+ if (clen == 9 && os_memcmp(ciphers, "SUITEB192", 9) == 0)
+ {
+ static int ssl_preset_suiteb192_ciphersuites[] = {MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, 0};
+ return tls_mbedtls_set_ciphersuites(tls_conf, ssl_preset_suiteb192_ciphersuites, 2);
+ }
+ if (clen == 9 && os_memcmp(ciphers, "SUITEB128", 9) == 0)
+ {
+ static int ssl_preset_suiteb128_ciphersuites[] = {MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, 0};
+ return tls_mbedtls_set_ciphersuites(tls_conf, ssl_preset_suiteb128_ciphersuites, 2);
+ }
+ if (clen == 7 && os_memcmp(ciphers, "DEFAULT", 7) == 0)
+ continue;
+ if (clen == 6 && os_memcmp(ciphers, "AES128", 6) == 0)
+ {
+ nids = tls_mbedtls_append_ciphersuite(ids, nids, idsz, suite_AES_128_ephemeral,
+ (int)ARRAY_SIZE(suite_AES_128_ephemeral));
+ if (nids == -1)
+ return 0;
+ continue;
+ }
+ if (clen == 6 && os_memcmp(ciphers, "AES256", 6) == 0)
+ {
+ nids = tls_mbedtls_append_ciphersuite(ids, nids, idsz, suite_AES_256_ephemeral,
+ (int)ARRAY_SIZE(suite_AES_256_ephemeral));
+ if (nids == -1)
+ return 0;
+ continue;
+ }
+ if (clen == 4 && os_memcmp(ciphers, "HIGH", 4) == 0)
+ {
+ nids = tls_mbedtls_append_ciphersuite(ids, nids, idsz, suite_HIGH, (int)ARRAY_SIZE(suite_HIGH));
+ if (nids == -1)
+ return 0;
+ continue;
+ }
+ /* ignore anonymous cipher group names (?not supported by mbedtls?) */
+ if (clen == 4 && os_memcmp(ciphers, "!ADH", 4) == 0)
+ continue;
+ if (clen == 6 && os_memcmp(ciphers, "-aECDH", 6) == 0)
+ continue;
+ if (clen == 7 && os_memcmp(ciphers, "-aECDSA", 7) == 0)
+ continue;
+
+ /* attempt to match mbedtls cipher names
+ * nb: does not support openssl group names or list manipulation syntax
+ * (alt: could copy almost 1200 lines (!!!) of lighttpd mod_mbedtls.c
+ * mod_mbedtls_ssl_conf_ciphersuites() to translate strings)
+ * note: not efficient to rewrite list for each ciphers entry,
+ * but this code is expected to run only at startup
+ */
+ const int *list = mbedtls_ssl_list_ciphersuites();
+ for (; *list; ++list)
+ {
+ blen = tls_mbedtls_translate_ciphername(*list, buf, sizeof(buf));
+ if (!blen)
+ continue;
+
+ /* matching heuristics additional to translate_ciphername above */
+ if (blen == clen + 4)
+ {
+ char *cbc = os_strstr(buf, "CBC-");
+ if (cbc)
+ {
+ os_memmove(cbc, cbc + 4, blen - (cbc + 4 - buf) + 1); /*(w/ '\0')*/
+ blen -= 4;
+ }
+ }
+ if (blen >= clen && os_memcmp(ciphers, buf, clen) == 0 &&
+ (blen == clen || (blen == clen + 7 && os_memcmp(buf + clen, "-SHA256", 7))))
+ {
+ if (1 >= idsz - (nids + 1))
+ {
+ emsg(MSG_ERROR, "error: too many ciphers during list expand");
+ return 0;
+ }
+ ids[++nids] = *list;
+ break;
+ }
+ }
+ if (*list == 0)
+ {
+ wpa_printf(MSG_ERROR, "MTLS: unrecognized cipher: %.*s", (int)clen, ciphers);
+ return 0;
+ }
+ } while ((ciphers = next ? next + 1 : NULL));
+
+ if (-1 == nids)
+ return 1; /* empty list; no-op */
+
+ ids[++nids] = 0; /* terminate list */
+ ++nids;
+
+ return tls_mbedtls_set_ciphersuites(tls_conf, ids, nids);
+}
+
+#ifdef TLS_MBEDTLS_CERT_VERIFY_EXTMATCH
+
+__attribute_noinline__ static int tls_mbedtls_set_item(char **config_item, const char *item)
+{
+ os_free(*config_item);
+ *config_item = NULL;
+ return item ? (*config_item = os_strdup(item)) != NULL : 1;
+}
+
+static int tls_connection_set_subject_match(struct tls_conf *tls_conf, const struct tls_connection_params *params)
+{
+ int rc = 1;
+ rc &= tls_mbedtls_set_item(&tls_conf->subject_match, params->subject_match);
+ rc &= tls_mbedtls_set_item(&tls_conf->altsubject_match, params->altsubject_match);
+ rc &= tls_mbedtls_set_item(&tls_conf->suffix_match, params->suffix_match);
+ rc &= tls_mbedtls_set_item(&tls_conf->domain_match, params->domain_match);
+ rc &= tls_mbedtls_set_item(&tls_conf->check_cert_subject, params->check_cert_subject);
+ return rc;
+}
+
+#endif /* TLS_MBEDTLS_CERT_VERIFY_EXTMATCH */
+
+/* duplicated in crypto_mbedtls.c:crypto_mbedtls_readfile()*/
+__attribute_noinline__ static int tls_mbedtls_readfile(const char *path, u8 **buf, size_t *n)
+{
+ /*(use os_readfile() so that we can use os_free()
+ *(if we use mbedtls_pk_load_file() above, macros prevent calling free()
+ * directly #if defined(OS_REJECT_C_LIB_FUNCTIONS) and calling os_free()
+ * on buf aborts in tests if buf not allocated via os_malloc())*/
+ *buf = (u8 *)os_readfile(path, n);
+ if (!*buf)
+ {
+ wpa_printf(MSG_ERROR, "error: os_readfile %s", path);
+ return -1;
+ }
+ u8 *buf0 = os_realloc(*buf, *n + 1);
+ if (!buf0)
+ {
+ bin_clear_free(*buf, *n);
+ *buf = NULL;
+ return -1;
+ }
+ buf0[(*n)++] = '\0';
+ *buf = buf0;
+ return 0;
+}
+
+static int tls_mbedtls_set_crl(struct tls_conf *tls_conf, const u8 *data, size_t len)
+{
+ /* do not use mbedtls_x509_crl_parse() on PEM unless it contains CRL */
+ if (len && data[len - 1] == '\0' && NULL == os_strstr((const char *)data, "-----BEGIN X509 CRL-----") &&
+ tls_mbedtls_data_is_pem(data))
+ return 0;
+
+ mbedtls_x509_crl crl;
+ mbedtls_x509_crl_init(&crl);
+ int rc = mbedtls_x509_crl_parse(&crl, data, len);
+ if (rc < 0)
+ {
+ mbedtls_x509_crl_free(&crl);
+ return rc == MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT ? 0 : rc;
+ }
+
+ mbedtls_x509_crl *crl_new = os_malloc(sizeof(crl));
+ if (crl_new == NULL)
+ {
+ mbedtls_x509_crl_free(&crl);
+ return MBEDTLS_ERR_X509_ALLOC_FAILED;
+ }
+ os_memcpy(crl_new, &crl, sizeof(crl));
+
+ mbedtls_x509_crl *crl_old = tls_conf->crl;
+ tls_conf->crl = crl_new;
+ if (crl_old)
+ {
+ mbedtls_x509_crl_free(crl_old);
+ os_free(crl_old);
+ }
+ return 0;
+}
+
+static int tls_mbedtls_set_ca(struct tls_conf *tls_conf, u8 *data, size_t len)
+{
+ /* load crt struct onto stack and then copy into tls_conf in
+ * order to preserve existing tls_conf value if error occurs
+ *
+ * hostapd is not threaded, or else should allocate memory and swap in
+ * pointer reduce race condition. (If threaded, would also need to
+ * keep reference count of use to avoid freeing while still in use.) */
+
+ mbedtls_x509_crt crt;
+ mbedtls_x509_crt_init(&crt);
+ int rc = mbedtls_x509_crt_parse(&crt, data, len);
+ if (rc < 0)
+ {
+ mbedtls_x509_crt_free(&crt);
+ return rc;
+ }
+
+ mbedtls_x509_crt_free(&tls_conf->ca_cert);
+ os_memcpy(&tls_conf->ca_cert, &crt, sizeof(crt));
+ return 0;
+}
+
+static int tls_mbedtls_set_ca_and_crl(struct tls_conf *tls_conf, const char *ca_cert_file)
+{
+ size_t len;
+ u8 *data;
+ if (tls_mbedtls_readfile(ca_cert_file, &data, &len))
+ return -1;
+
+ int rc;
+ if (0 == (rc = tls_mbedtls_set_ca(tls_conf, data, len)) &&
+ (!tls_mbedtls_data_is_pem(data) /*skip parse for CRL if not PEM*/
+ || 0 == (rc = tls_mbedtls_set_crl(tls_conf, data, len))))
+ {
+ mbedtls_ssl_conf_ca_chain(&tls_conf->conf, &tls_conf->ca_cert, tls_conf->crl);
+ }
+ else
+ {
+ elog(rc, __func__);
+ emsg(MSG_ERROR, ca_cert_file);
+ }
+
+ forced_memzero(data, len);
+ os_free(data);
+ return rc;
+}
+
+static void tls_mbedtls_refresh_crl(void)
+{
+ /* check for CRL refresh
+ * continue even if error occurs; continue with previous cert, CRL */
+ unsigned int crl_reload_interval = tls_ctx_global.crl_reload_interval;
+ const char *ca_cert_file = tls_ctx_global.ca_cert_file;
+ if (!crl_reload_interval || !ca_cert_file)
+ return;
+
+ struct os_reltime *previous = &tls_ctx_global.crl_reload_previous;
+ struct os_reltime now;
+ if (os_get_reltime(&now) != 0 || !os_reltime_expired(&now, previous, crl_reload_interval))
+ return;
+
+ /* Note: modifying global state is not thread-safe
+ * if in use by existing connections
+ *
+ * src/utils/os.h does not provide a portable stat()
+ * or else it would be a good idea to check mtime and size,
+ * and avoid reloading if file has not changed */
+
+ if (tls_mbedtls_set_ca_and_crl(tls_ctx_global.tls_conf, ca_cert_file) == 0)
+ *previous = now;
+}
+
+static int tls_mbedtls_set_ca_cert(struct tls_conf *tls_conf, const struct tls_connection_params *params)
+{
+ if (params->ca_cert)
+ {
+ if (os_strncmp(params->ca_cert, "probe://", 8) == 0)
+ {
+ tls_conf->ca_cert_probe = 1;
+ tls_conf->has_ca_cert = 1;
+ return 0;
+ }
+
+ if (os_strncmp(params->ca_cert, "hash://", 7) == 0)
+ {
+ const char *pos = params->ca_cert + 7;
+ if (os_strncmp(pos, "server/sha256/", 14) != 0)
+ {
+ emsg(MSG_ERROR, "unsupported ca_cert hash value");
+ return -1;
+ }
+ pos += 14;
+ if (os_strlen(pos) != SHA256_DIGEST_LENGTH * 2)
+ {
+ emsg(MSG_ERROR, "unexpected ca_cert hash length");
+ return -1;
+ }
+ if (hexstr2bin(pos, tls_conf->ca_cert_hash, SHA256_DIGEST_LENGTH) < 0)
+ {
+ emsg(MSG_ERROR, "invalid ca_cert hash value");
+ return -1;
+ }
+ emsg(MSG_DEBUG, "checking only server certificate match");
+ tls_conf->verify_depth0_only = 1;
+ tls_conf->has_ca_cert = 1;
+ return 0;
+ }
+
+ if (tls_mbedtls_set_ca_and_crl(tls_conf, params->ca_cert) != 0)
+ return -1;
+ }
+ if (params->ca_cert_blob)
+ {
+ size_t len = params->ca_cert_blob_len;
+ int is_pem = tls_mbedtls_data_is_pem(params->ca_cert_blob);
+ int ret = mbedtls_x509_crt_parse(&tls_conf->ca_cert, params->ca_cert_blob, len);
+ if (ret != 0)
+ {
+ elog(ret, "mbedtls_x509_crt_parse");
+ return -1;
+ }
+ if (is_pem)
+ { /*(ca_cert_blob in DER format contains ca cert only)*/
+ ret = tls_mbedtls_set_crl(tls_conf, params->ca_cert_blob, len);
+ if (ret != 0)
+ {
+ elog(ret, "mbedtls_x509_crl_parse");
+ return -1;
+ }
+ }
+ }
+
+ if (mbedtls_x509_time_is_future(&tls_conf->ca_cert.valid_from) ||
+ mbedtls_x509_time_is_past(&tls_conf->ca_cert.valid_to))
+ {
+ emsg(MSG_WARNING, "ca_cert expired or not yet valid");
+ if (params->ca_cert)
+ emsg(MSG_WARNING, params->ca_cert);
+ }
+
+ tls_conf->has_ca_cert = 1;
+ return 0;
+}
+
+static int tls_mbedtls_set_certs(struct tls_conf *tls_conf, const struct tls_connection_params *params)
+{
+ int ret = -1;
+
+ if (params->ca_cert || params->ca_cert_blob)
+ {
+ if (tls_mbedtls_set_ca_cert(tls_conf, params) != 0)
+ return -1;
+ }
+ else if (params->ca_path)
+ {
+ emsg(MSG_INFO, "ca_path support not implemented");
+ return -1;
+ }
+
+ if (!tls_conf->has_ca_cert)
+ mbedtls_ssl_conf_authmode(&tls_conf->conf, MBEDTLS_SSL_VERIFY_NONE);
+ else
+ {
+ /* Initial setting: REQUIRED for client, OPTIONAL for server
+ * (see also tls_connection_set_verify()) */
+ tls_conf->verify_peer = (tls_ctx_global.tls_conf == NULL);
+ int authmode = tls_conf->verify_peer ? MBEDTLS_SSL_VERIFY_REQUIRED : MBEDTLS_SSL_VERIFY_OPTIONAL;
+ mbedtls_ssl_conf_authmode(&tls_conf->conf, authmode);
+ mbedtls_ssl_conf_ca_chain(&tls_conf->conf, &tls_conf->ca_cert, tls_conf->crl);
+
+#ifdef TLS_MBEDTLS_CERT_VERIFY_EXTMATCH
+ if (!tls_connection_set_subject_match(tls_conf, params))
+ return -1;
+#endif
+ }
+
+ if (params->client_cert2) /*(yes, server_cert2 in msg below)*/
+ emsg(MSG_INFO, "server_cert2 support not implemented");
+
+ if (params->client_cert)
+ {
+ size_t len;
+ u8 *data;
+ if (tls_mbedtls_readfile(params->client_cert, &data, &len))
+ return -1;
+ ret = mbedtls_x509_crt_parse(&tls_conf->client_cert, data, len);
+ forced_memzero(data, len);
+ os_free(data);
+ }
+ if (params->client_cert_blob)
+ {
+ size_t len = params->client_cert_blob_len;
+
+ ret = mbedtls_x509_crt_parse(&tls_conf->client_cert, params->client_cert_blob, len);
+ }
+ if (params->client_cert || params->client_cert_blob)
+ {
+ if (ret < 0)
+ {
+ elog(ret, "mbedtls_x509_crt_parse");
+ if (params->client_cert)
+ emsg(MSG_ERROR, params->client_cert);
+ return -1;
+ }
+ if (mbedtls_x509_time_is_future(&tls_conf->client_cert.valid_from) ||
+ mbedtls_x509_time_is_past(&tls_conf->client_cert.valid_to))
+ {
+ emsg(MSG_WARNING, "cert expired or not yet valid");
+ if (params->client_cert)
+ emsg(MSG_WARNING, params->client_cert);
+ }
+ tls_conf->has_client_cert = 1;
+ }
+
+ if (params->private_key || params->private_key_blob)
+ {
+ size_t len = params->private_key_blob_len;
+ u8 *data;
+
+ *(const u8 **)&data = params->private_key_blob;
+ if (params->private_key && tls_mbedtls_readfile(params->private_key, &data, &len))
+ {
+ return -1;
+ }
+ const char *pwd = params->private_key_passwd;
+ ret = mbedtls_pk_parse_key(&tls_conf->private_key, data, len, (const unsigned char *)pwd,
+ pwd ? os_strlen(pwd) : 0);
+ if (params->private_key)
+ {
+ forced_memzero(data, len);
+ os_free(data);
+ }
+ if (ret < 0)
+ {
+ elog(ret, "mbedtls_pk_parse_key");
+ return -1;
+ }
+ tls_conf->has_private_key = 1;
+ }
+
+ if (tls_conf->has_client_cert && tls_conf->has_private_key)
+ {
+ ret = mbedtls_ssl_conf_own_cert(&tls_conf->conf, &tls_conf->client_cert, &tls_conf->private_key);
+ if (ret < 0)
+ {
+ elog(ret, "mbedtls_ssl_conf_own_cert");
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+/* mbedtls_x509_crt_profile_suiteb plus rsa_min_bitlen 2048 */
+/* (reference: see also mbedtls_x509_crt_profile_next) */
+/* ??? should permit SHA-512, too, and additional curves ??? */
+static const mbedtls_x509_crt_profile tls_mbedtls_crt_profile_suiteb128 = {
+ /* Only SHA-256 and 384 */
+ MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA256) | MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA384),
+ /* Only ECDSA and ECKEY */
+ MBEDTLS_X509_ID_FLAG(MBEDTLS_PK_SIGALG_ECDSA) | MBEDTLS_X509_ID_FLAG(MBEDTLS_PK_SIGALG_ECDSA + 1),
+#if defined(MBEDTLS_ECP_C)
+ /* Only NIST P-256 and P-384 */
+ MBEDTLS_X509_ID_FLAG(MBEDTLS_ECP_DP_SECP256R1) | MBEDTLS_X509_ID_FLAG(MBEDTLS_ECP_DP_SECP384R1),
+#else
+ 0,
+#endif
+ 2048,
+};
+
+/* stricter than mbedtls_x509_crt_profile_suiteb */
+/* (reference: see also mbedtls_x509_crt_profile_next) */
+/* ??? should permit SHA-512, too, and additional curves ??? */
+static const mbedtls_x509_crt_profile tls_mbedtls_crt_profile_suiteb192 = {
+ /* Only SHA-384 */
+ MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA384),
+ /* Only ECDSA and ECKEY */
+ MBEDTLS_X509_ID_FLAG(MBEDTLS_PK_SIGALG_ECDSA) | MBEDTLS_X509_ID_FLAG(MBEDTLS_PK_SIGALG_ECDSA + 1),
+#if defined(MBEDTLS_ECP_C)
+ /* Only NIST P-384 */
+ MBEDTLS_X509_ID_FLAG(MBEDTLS_ECP_DP_SECP384R1),
+#else
+ 0,
+#endif
+ 3072,
+};
+
+/* stricter than mbedtls_x509_crt_profile_suiteb except allow any PK alg */
+/* (reference: see also mbedtls_x509_crt_profile_next) */
+/* ??? should permit SHA-512, too, and additional curves ??? */
+static const mbedtls_x509_crt_profile tls_mbedtls_crt_profile_suiteb192_anypk = {
+ /* Only SHA-384 */
+ MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA384),
+ 0xFFFFFFF, /* Any PK alg */
+#if defined(MBEDTLS_ECP_C)
+ /* Only NIST P-384 */
+ MBEDTLS_X509_ID_FLAG(MBEDTLS_ECP_DP_SECP384R1),
+#else
+ 0,
+#endif
+ 3072,
+};
+
+static int tls_mbedtls_set_params(struct tls_conf *tls_conf, const struct tls_connection_params *params)
+{
+ tls_conf->flags = params->flags;
+
+ if (tls_conf->flags & TLS_CONN_REQUIRE_OCSP_ALL)
+ {
+ emsg(MSG_INFO, "ocsp=3 not supported");
+ return -1;
+ }
+
+ if (tls_conf->flags & TLS_CONN_REQUIRE_OCSP)
+ {
+ emsg(MSG_INFO, "ocsp not supported");
+ return -1;
+ }
+
+ int suiteb128 = 0;
+ int suiteb192 = 0;
+ if (params->openssl_ciphers)
+ {
+ if (os_strcmp(params->openssl_ciphers, "SUITEB192") == 0)
+ {
+ suiteb192 = 1;
+ tls_conf->flags |= TLS_CONN_SUITEB;
+ }
+ if (os_strcmp(params->openssl_ciphers, "SUITEB128") == 0)
+ {
+ suiteb128 = 1;
+ tls_conf->flags |= TLS_CONN_SUITEB;
+ }
+ }
+
+ int ret = mbedtls_ssl_config_defaults(
+ &tls_conf->conf, tls_ctx_global.tls_conf ? MBEDTLS_SSL_IS_SERVER : MBEDTLS_SSL_IS_CLIENT,
+ MBEDTLS_SSL_TRANSPORT_STREAM,
+ /* TODO:
+ * Technically suiteb192 rsa3k is wrong, it should be CNSA-RSA3K.
+ * A proper way would be:
+ * introduce a new preset CNSA and add RSA3K in MbedTLS. */
+ MBEDTLS_SSL_PRESET_DEFAULT);
+ if (ret != 0)
+ {
+ elog(ret, "mbedtls_ssl_config_defaults");
+ return -1;
+ }
+
+ if (suiteb128)
+ {
+ mbedtls_ssl_conf_cert_profile(&tls_conf->conf, &tls_mbedtls_crt_profile_suiteb128);
+ }
+ else if (suiteb192)
+ {
+ mbedtls_ssl_conf_cert_profile(&tls_conf->conf, &tls_mbedtls_crt_profile_suiteb192);
+ }
+ else if (tls_conf->flags & TLS_CONN_SUITEB)
+ {
+ /* treat as suiteb192 while allowing any PK algorithm */
+ mbedtls_ssl_conf_cert_profile(&tls_conf->conf, &tls_mbedtls_crt_profile_suiteb192_anypk);
+ }
+
+ tls_mbedtls_set_allowed_tls_vers(tls_conf, &tls_conf->conf);
+ ret = tls_mbedtls_set_certs(tls_conf, params);
+ if (ret != 0)
+ return -1;
+
+#ifdef MBEDTLS_DHM_C
+ if (params->dh_file && !tls_mbedtls_set_dhparams(tls_conf, params))
+ {
+ return -1;
+ }
+#endif
+
+ if (params->openssl_ecdh_curves && !tls_mbedtls_set_curves(tls_conf, params->openssl_ecdh_curves))
+ {
+ return -1;
+ }
+
+ if (params->openssl_ciphers)
+ {
+ if (!tls_mbedtls_set_ciphers(tls_conf, params->openssl_ciphers))
+ return -1;
+ }
+ else if (tls_conf->flags & TLS_CONN_SUITEB)
+ {
+ /* special-case a select set of ciphers for hwsim tests */
+ /* DHE-RSA-AES256-GCM-SHA384 is removed in Mbed TLS 4.0 */
+ if (!tls_mbedtls_set_ciphers(tls_conf, "ECDHE-RSA-AES256-GCM-SHA384"))
+ return -1;
+ }
+
+ return 0;
+}
+
+int tls_connection_set_params(void *tls_ctx, struct tls_connection *conn, const struct tls_connection_params *params)
+{
+ if (conn == NULL || params == NULL)
+ return -1;
+
+ tls_conf_deinit(conn->tls_conf);
+ struct tls_conf *tls_conf = conn->tls_conf = tls_conf_init(tls_ctx);
+ if (tls_conf == NULL)
+ return -1;
+
+ if (tls_ctx_global.tls_conf)
+ {
+ tls_conf->check_crl = tls_ctx_global.tls_conf->check_crl;
+ tls_conf->check_crl_strict = tls_ctx_global.tls_conf->check_crl_strict;
+#ifdef TLS_MBEDTLS_CERT_VERIFY_EXTMATCH
+ /*(tls_openssl.c inherits check_cert_subject from global conf)*/
+ if (tls_ctx_global.tls_conf->check_cert_subject)
+ {
+ tls_conf->check_cert_subject = os_strdup(tls_ctx_global.tls_conf->check_cert_subject);
+ if (tls_conf->check_cert_subject == NULL)
+ return -1;
+ }
+#endif
+ }
+
+ if (tls_mbedtls_set_params(tls_conf, params) != 0)
+ return -1;
+ conn->verify_peer = tls_conf->verify_peer;
+
+ return tls_mbedtls_ssl_setup(conn);
+}
+
+#ifdef TLS_MBEDTLS_SESSION_TICKETS
+
+static int tls_mbedtls_clienthello_session_ticket_prep(struct tls_connection *conn, const u8 *data, size_t len)
+{
+ if (conn->tls_conf->flags & TLS_CONN_DISABLE_SESSION_TICKET)
+ return -1;
+ if (conn->clienthello_session_ticket)
+ tls_connection_deinit_clienthello_session_ticket(conn);
+ if (len)
+ {
+ conn->clienthello_session_ticket = mbedtls_calloc(1, len);
+ if (conn->clienthello_session_ticket == NULL)
+ return -1;
+ conn->clienthello_session_ticket_len = len;
+ os_memcpy(conn->clienthello_session_ticket, data, len);
+ }
+ return 0;
+}
+
+static void tls_mbedtls_clienthello_session_ticket_set(struct tls_connection *conn)
+{
+ mbedtls_ssl_session *sess = conn->ssl.MBEDTLS_PRIVATE(session_negotiate);
+ if (sess->MBEDTLS_PRIVATE(ticket))
+ {
+ mbedtls_platform_zeroize(sess->MBEDTLS_PRIVATE(ticket), sess->MBEDTLS_PRIVATE(ticket_len));
+ mbedtls_free(sess->MBEDTLS_PRIVATE(ticket));
+ }
+ sess->MBEDTLS_PRIVATE(ticket) = conn->clienthello_session_ticket;
+ sess->MBEDTLS_PRIVATE(ticket_len) = conn->clienthello_session_ticket_len;
+ sess->MBEDTLS_PRIVATE(ticket_lifetime) = 86400; /* XXX: can hint be 0? */
+
+ conn->clienthello_session_ticket = NULL;
+ conn->clienthello_session_ticket_len = 0;
+}
+
+static int tls_mbedtls_ssl_ticket_write(void *p_ticket,
+ const mbedtls_ssl_session *session,
+ unsigned char *start,
+ const unsigned char *end,
+ size_t *tlen,
+ uint32_t *lifetime)
+{
+ struct tls_connection *conn = p_ticket;
+ if (conn && conn->session_ticket_cb)
+ {
+ /* see tls_mbedtls_clienthello_session_ticket_prep() */
+ /* see tls_mbedtls_clienthello_session_ticket_set() */
+ *tlen = 0;
+ return 0;
+ }
+
+ return mbedtls_ssl_ticket_write(&tls_ctx_global.ticket_ctx, session, start, end, tlen, lifetime);
+}
+
+static int tls_mbedtls_ssl_ticket_parse(void *p_ticket, mbedtls_ssl_session *session, unsigned char *buf, size_t len)
+{
+ /* XXX: TODO: not implemented in client;
+ * mbedtls_ssl_conf_session_tickets_cb() callbacks only for TLS server*/
+
+ if (len == 0)
+ return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
+
+ struct tls_connection *conn = p_ticket;
+ if (conn && conn->session_ticket_cb)
+ {
+ /* XXX: have random and secret been initialized yet?
+ * or must keys first be exported?
+ * EAP-FAST uses all args, EAP-TEAP only uses secret */
+ struct tls_random data;
+ if (tls_connection_get_random(NULL, conn, &data) != 0)
+ return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
+ int ret = conn->session_ticket_cb(conn->session_ticket_cb_ctx, buf, len, data.client_random, data.server_random,
+ conn->expkey_secret);
+ if (ret == 1)
+ {
+ conn->resumed = 1;
+ return 0;
+ }
+ emsg(MSG_ERROR, "EAP session ticket ext not implemented");
+ return MBEDTLS_ERR_SSL_INVALID_MAC;
+ /*(non-zero return used for mbedtls debug logging)*/
+ }
+
+ /* XXX: TODO always use tls_mbedtls_ssl_ticket_parse() for callback? */
+ int rc = mbedtls_ssl_ticket_parse(&tls_ctx_global.ticket_ctx, session, buf, len);
+ if (conn)
+ conn->resumed = (rc == 0);
+ return rc;
+}
+
+#endif /* TLS_MBEDTLS_SESSION_TICKETS */
+
+__attribute_cold__ int tls_global_set_params(void *tls_ctx, const struct tls_connection_params *params)
+{
+ /* XXX: why might global_set_params be called more than once? */
+ if (tls_ctx_global.tls_conf)
+ tls_conf_deinit(tls_ctx_global.tls_conf);
+ tls_ctx_global.tls_conf = tls_conf_init(tls_ctx);
+ if (tls_ctx_global.tls_conf == NULL)
+ return -1;
+
+#ifdef MBEDTLS_SSL_SESSION_TICKETS
+#ifdef MBEDTLS_SSL_TICKET_C
+ if (!(params->flags & TLS_CONN_DISABLE_SESSION_TICKET))
+#ifdef TLS_MBEDTLS_SESSION_TICKETS
+ mbedtls_ssl_conf_session_tickets_cb(&tls_ctx_global.tls_conf->conf, tls_mbedtls_ssl_ticket_write,
+ tls_mbedtls_ssl_ticket_parse, NULL);
+#else
+ mbedtls_ssl_conf_session_tickets_cb(&tls_ctx_global.tls_conf->conf, mbedtls_ssl_ticket_write,
+ mbedtls_ssl_ticket_parse, &tls_ctx_global.ticket_ctx);
+#endif
+#endif
+#endif
+
+ os_free(tls_ctx_global.ocsp_stapling_response);
+ tls_ctx_global.ocsp_stapling_response = NULL;
+ if (params->ocsp_stapling_response)
+ tls_ctx_global.ocsp_stapling_response = os_strdup(params->ocsp_stapling_response);
+
+ // os_free(tls_ctx_global.ca_cert_file);
+ tls_ctx_global.ca_cert_file = NULL;
+ if (params->ca_cert)
+ tls_ctx_global.ca_cert_file = os_strdup(params->ca_cert);
+ return tls_mbedtls_set_params(tls_ctx_global.tls_conf, params);
+}
+
+int tls_global_set_verify(void *tls_ctx, int check_crl, int strict)
+{
+ tls_ctx_global.tls_conf->check_crl = check_crl;
+ tls_ctx_global.tls_conf->check_crl_strict = strict; /*(time checks)*/
+ return 0;
+}
+
+int tls_connection_set_verify(void *tls_ctx,
+ struct tls_connection *conn,
+ int verify_peer,
+ unsigned int flags,
+ const u8 *session_ctx,
+ size_t session_ctx_len)
+{
+ /*(EAP server-side calls this from eap_server_tls_ssl_init())*/
+ if (conn == NULL)
+ return -1;
+
+ conn->tls_conf->flags |= flags; /* TODO: reprocess flags, if necessary */
+
+ int authmode;
+ switch (verify_peer)
+ {
+ case 2:
+ authmode = MBEDTLS_SSL_VERIFY_OPTIONAL;
+ break; /*(eap_teap_init())*/
+ case 1:
+ authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
+ break;
+ default:
+ authmode = MBEDTLS_SSL_VERIFY_NONE;
+ break;
+ }
+#ifdef MBEDTLS_SSL_SERVER_NAME_INDICATION
+ mbedtls_ssl_set_hs_authmode(&conn->ssl, authmode);
+#endif
+ if ((conn->verify_peer = (authmode != MBEDTLS_SSL_VERIFY_NONE)))
+ mbedtls_ssl_set_verify(&conn->ssl, tls_mbedtls_verify_cb, conn);
+ else
+ mbedtls_ssl_set_verify(&conn->ssl, NULL, NULL);
+
+ return 0;
+}
+
+static void tls_connection_export_keys_cb(void *p_expkey,
+ mbedtls_ssl_key_export_type secret_type,
+ const unsigned char *secret,
+ size_t secret_len,
+ const unsigned char client_random[MBEDTLS_EXPKEY_RAND_LEN],
+ const unsigned char server_random[MBEDTLS_EXPKEY_RAND_LEN],
+ mbedtls_tls_prf_types tls_prf_type)
+{
+ struct tls_connection *conn = p_expkey;
+ conn->tls_prf_type = tls_prf_type;
+
+ /* For TLS 1.3, client_random and server_random are not used in key derivation.
+ * Key export relies on HKDF and exporter_master_secret instead of PRF inputs. */
+ if (!tls_prf_type)
+ return;
+
+ if (secret_len > sizeof(conn->expkey_secret))
+ {
+ emsg(MSG_ERROR, "tls_connection_export_keys_cb secret too long");
+ conn->tls_prf_type = MBEDTLS_SSL_TLS_PRF_NONE; /* 0 */
+ return;
+ }
+
+ conn->expkey_secret_len = secret_len;
+ os_memcpy(conn->expkey_secret, secret, secret_len);
+ os_memcpy(conn->expkey_randbytes, client_random, MBEDTLS_EXPKEY_RAND_LEN);
+ os_memcpy(conn->expkey_randbytes + MBEDTLS_EXPKEY_RAND_LEN, server_random, MBEDTLS_EXPKEY_RAND_LEN);
+}
+
+
+int tls_connection_get_random(void *tls_ctx, struct tls_connection *conn, struct tls_random *data)
+{
+ if (!conn || !conn->tls_prf_type)
+ return -1;
+
+ data->client_random = conn->expkey_randbytes;
+ data->client_random_len = MBEDTLS_EXPKEY_RAND_LEN;
+ data->server_random = conn->expkey_randbytes + MBEDTLS_EXPKEY_RAND_LEN;
+ data->server_random_len = MBEDTLS_EXPKEY_RAND_LEN;
+ return 0;
+}
+
+int tls_connection_export_key(void *tls_ctx,
+ struct tls_connection *conn,
+ const char *label,
+ const u8 *context,
+ size_t context_len,
+ u8 *out,
+ size_t out_len)
+{
+ if (!conn || !conn->established)
+ return -1;
+
+ /* Export keying material using MbedTLS API (supports TLS 1.2 and TLS 1.3) */
+ return mbedtls_ssl_export_keying_material(&conn->ssl,
+ out, out_len,
+ label, os_strlen(label),
+ context, context_len,
+ context_len);
+}
+
+#ifdef TLS_MBEDTLS_EAP_FAST
+
+/* keyblock size info is not exposed in mbed TLS 3.0.0 */
+/* extracted from mbedtls library/ssl_tls.c:ssl_tls12_populate_transform() */
+#include <mbedtls/ssl_ciphersuites.h>
+#include <mbedtls/private/cipher.h>
+static size_t tls_mbedtls_ssl_keyblock_size(mbedtls_ssl_context *ssl)
+{
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
+ if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3)
+ return 0; /* (calculation not extracted) */
+#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
+
+ int ciphersuite = mbedtls_ssl_get_ciphersuite_id_from_ssl(ssl);
+ const mbedtls_ssl_ciphersuite_t *ciphersuite_info = mbedtls_ssl_ciphersuite_from_id(ciphersuite);
+ if (ciphersuite_info == NULL)
+ return 0;
+
+ const mbedtls_cipher_info_t *cipher_info = mbedtls_cipher_info_from_type(ciphersuite_info->MBEDTLS_PRIVATE(cipher));
+ if (cipher_info == NULL)
+ return 0;
+
+ size_t keylen = mbedtls_cipher_info_get_key_bitlen(cipher_info) / 8;
+ mbedtls_cipher_mode_t mode = mbedtls_cipher_info_get_mode(cipher_info);
+#if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
+ if (mode == MBEDTLS_MODE_GCM || mode == MBEDTLS_MODE_CCM)
+ return keylen + 4;
+ else if (mode == MBEDTLS_MODE_CHACHAPOLY)
+ return keylen + 12;
+ else
+#endif /* MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C */
+#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
+ {
+ const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type(ciphersuite_info->MBEDTLS_PRIVATE(mac));
+ if (md_info == NULL)
+ return 0;
+ size_t mac_key_len = mbedtls_md_get_size(md_info);
+ size_t ivlen = mbedtls_cipher_info_get_iv_size(cipher_info);
+ return keylen + mac_key_len + ivlen;
+ }
+#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
+ return 0;
+}
+
+
+int tls_connection_get_eap_fast_key(void *tls_ctx, struct tls_connection *conn, u8 *out, size_t out_len)
+{
+ int ret;
+
+ /* EAP-FAST relies on TLS 1.0/1.2 key block derivation (PRF-based).
+ * TLS 1.3 removed PRF and key block concept, so EAP-FAST cannot operate over TLS 1.3. */
+ if (!conn || !conn->tls_prf_type)
+ return -1;
+
+ conn->expkey_keyblock_size = tls_mbedtls_ssl_keyblock_size(&conn->ssl);
+ if (conn->expkey_keyblock_size == 0)
+ return -1;
+ size_t skip = conn->expkey_keyblock_size * 2;
+ unsigned char *tmp_out = os_malloc(skip + out_len);
+ if (!tmp_out)
+ return -1;
+
+ /* server_random and then client_random */
+ unsigned char seed[MBEDTLS_EXPKEY_RAND_LEN * 2];
+ os_memcpy(seed, conn->expkey_randbytes + MBEDTLS_EXPKEY_RAND_LEN, MBEDTLS_EXPKEY_RAND_LEN);
+ os_memcpy(seed + MBEDTLS_EXPKEY_RAND_LEN, conn->expkey_randbytes, MBEDTLS_EXPKEY_RAND_LEN);
+
+ ret = mbedtls_ssl_tls_prf(conn->tls_prf_type, conn->expkey_secret,
+ conn->expkey_secret_len, "key expansion",
+ seed, sizeof(seed), tmp_out, skip + out_len);
+ if (ret == 0)
+ os_memcpy(out, tmp_out + skip, out_len);
+
+ bin_clear_free(tmp_out, skip + out_len);
+ forced_memzero(seed, sizeof(seed));
+ return ret;
+}
+
+#endif /* TLS_MBEDTLS_EAP_FAST */
+
+__attribute_cold__ static void tls_mbedtls_suiteb_handshake_alert(struct tls_connection *conn)
+{
+ /* tests/hwsim/test_suite_b.py test_suite_b_192_rsa_insufficient_dh */
+ if (!(conn->tls_conf->flags & TLS_CONN_SUITEB))
+ return;
+ if (tls_ctx_global.tls_conf) /*(is server; want issue event on client)*/
+ return;
+
+ struct tls_config *init_conf = &tls_ctx_global.init_conf;
+ if (init_conf->event_cb)
+ {
+ union tls_event_data ev;
+ os_memset(&ev, 0, sizeof(ev));
+ ev.alert.is_local = 1;
+ ev.alert.type = "fatal";
+ /*"internal error" string for tests/hwsim/test_suiteb.py */
+ ev.alert.description = "internal error: handshake failure";
+ /*ev.alert.description = "insufficient security";*/
+ init_conf->event_cb(init_conf->cb_ctx, TLS_ALERT, &ev);
+ }
+}
+
+struct wpabuf *tls_connection_handshake(void *tls_ctx,
+ struct tls_connection *conn,
+ const struct wpabuf *in_data,
+ struct wpabuf **appl_data)
+{
+ if (appl_data)
+ *appl_data = NULL;
+
+ if (in_data && wpabuf_len(in_data))
+ {
+ /*(unsure why tls_gnutls.c discards buffer contents; skip here)*/
+ if (conn->pull_buf && 0) /* disable; appears unwise */
+ tls_pull_buf_discard(conn, __func__);
+ if (!tls_pull_buf_append(conn, in_data))
+ return NULL;
+ }
+
+ if (conn->tls_conf == NULL)
+ {
+ struct tls_connection_params params;
+ os_memset(¶ms, 0, sizeof(params));
+ params.openssl_ciphers = tls_ctx_global.init_conf.openssl_ciphers;
+ params.flags = tls_ctx_global.tls_conf->flags;
+ if (tls_connection_set_params(tls_ctx, conn, ¶ms) != 0)
+ return NULL;
+ }
+
+ if (conn->verify_peer) /*(call here might be redundant; nbd)*/
+ mbedtls_ssl_set_verify(&conn->ssl, tls_mbedtls_verify_cb, conn);
+
+#ifdef TLS_MBEDTLS_SESSION_TICKETS
+ if (conn->clienthello_session_ticket)
+ /*(starting handshake for EAP-FAST and EAP-TEAP)*/
+ tls_mbedtls_clienthello_session_ticket_set(conn);
+
+ /* (not thread-safe due to need to set userdata 'conn' for callback) */
+ /* (unable to use mbedtls_ssl_set_user_data_p() with mbedtls 3.2.0+
+ * since ticket write and parse callbacks take (mbedtls_ssl_session *)
+ * param instead of (mbedtls_ssl_context *) param) */
+ if (conn->tls_conf->flags & TLS_CONN_DISABLE_SESSION_TICKET)
+ mbedtls_ssl_conf_session_tickets_cb(&conn->tls_conf->conf, NULL, NULL, NULL);
+ else
+ mbedtls_ssl_conf_session_tickets_cb(&conn->tls_conf->conf, tls_mbedtls_ssl_ticket_write,
+ tls_mbedtls_ssl_ticket_parse, conn);
+#endif
+ int ret = 0;
+
+ if (conn->tls_conf->domain_match != NULL) {
+ ret = mbedtls_ssl_set_hostname(&conn->ssl, conn->tls_conf->domain_match);
+ if (ret != 0) {
+ wpa_printf(MSG_ERROR, "Failed to set hostname from domain match");
+ return NULL;
+ }
+ } else if (conn->tls_conf->suffix_match != NULL) {
+ ret = mbedtls_ssl_set_hostname(&conn->ssl, conn->tls_conf->suffix_match);
+ if (ret != 0) {
+ wpa_printf(MSG_ERROR, "Failed to set hostname from suffix match");
+ return NULL;
+ }
+ } else {
+ mbedtls_ssl_set_hostname(&conn->ssl, NULL);
+ }
+
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
+ if (conn->ssl.MBEDTLS_PRIVATE(state) == MBEDTLS_SSL_HANDSHAKE_OVER &&
+ conn->ssl.MBEDTLS_PRIVATE(tls_version) == MBEDTLS_SSL_VERSION_TLS1_3)
+ {
+ int res = 0;
+ *appl_data = wpabuf_alloc(wpabuf_len(in_data));
+retry:
+ res = mbedtls_ssl_read(&conn->ssl, wpabuf_mhead(*appl_data), wpabuf_size(*appl_data));
+ if (res < 0)
+ {
+#if defined(MBEDTLS_SSL_SESSION_TICKETS)
+ if (MBEDTLS_ERR_SSL_WANT_READ == res ||
+ MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET == res)
+ {
+ goto retry;
+ }
+#endif
+ wpa_printf(MSG_DEBUG, "%s failed: 0x%x", __func__, res);
+ ret = -1;
+ }
+ else
+ wpabuf_put(*appl_data, res);
+ }
+ else
+#endif
+ ret = mbedtls_ssl_handshake(&conn->ssl);
+
+#ifdef TLS_MBEDTLS_SESSION_TICKETS
+ mbedtls_ssl_conf_session_tickets_cb(&conn->tls_conf->conf, tls_mbedtls_ssl_ticket_write,
+ tls_mbedtls_ssl_ticket_parse, NULL);
+#endif
+
+ switch (ret)
+ {
+ case 0:
+ conn->established = 1;
+ if (conn->push_buf == NULL)
+ /* Need to return something to get final TLS ACK. */
+ conn->push_buf = wpabuf_alloc(0);
+ break;
+ case MBEDTLS_ERR_SSL_WANT_WRITE:
+ case MBEDTLS_ERR_SSL_WANT_READ:
+ case MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS:
+ case MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS:
+ if (tls_ctx_global.tls_conf /*(is server)*/
+ && conn->established && conn->push_buf == NULL)
+ /* Need to return something to trigger completion of EAP-TLS. */
+ conn->push_buf = wpabuf_alloc(0);
+ break;
+ default:
+ ++conn->failed;
+ switch (ret)
+ {
+ case MBEDTLS_ERR_SSL_CLIENT_RECONNECT:
+ case MBEDTLS_ERR_NET_CONN_RESET:
+ case MBEDTLS_ERR_NET_SEND_FAILED:
+ ++conn->write_alerts;
+ break;
+ case MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE:
+ tls_mbedtls_suiteb_handshake_alert(conn);
+ /* fall through */
+ case MBEDTLS_ERR_NET_RECV_FAILED:
+ case MBEDTLS_ERR_SSL_CONN_EOF:
+ case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY:
+ case MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE:
+ ++conn->read_alerts;
+ break;
+ default:
+ break;
+ }
+
+ ilog(ret, "mbedtls_ssl_handshake");
+ break;
+ }
+
+ struct wpabuf *out_data = conn->push_buf;
+ conn->push_buf = NULL;
+ return out_data;
+}
+
+struct wpabuf *tls_connection_server_handshake(void *tls_ctx,
+ struct tls_connection *conn,
+ const struct wpabuf *in_data,
+ struct wpabuf **appl_data)
+{
+ conn->is_server = 1;
+ return tls_connection_handshake(tls_ctx, conn, in_data, appl_data);
+}
+
+struct wpabuf *tls_connection_encrypt(void *tls_ctx, struct tls_connection *conn, const struct wpabuf *in_data)
+{
+ int res = mbedtls_ssl_write(&conn->ssl, wpabuf_head_u8(in_data), wpabuf_len(in_data));
+ if (res < 0)
+ {
+ elog(res, "mbedtls_ssl_write");
+ return NULL;
+ }
+
+ struct wpabuf *buf = conn->push_buf;
+ conn->push_buf = NULL;
+ return buf;
+}
+
+struct wpabuf *tls_connection_decrypt(void *tls_ctx, struct tls_connection *conn, const struct wpabuf *in_data)
+{
+ int res;
+ struct wpabuf *out;
+
+ /*assert(in_data != NULL);*/
+ if (!tls_pull_buf_append(conn, in_data))
+ return NULL;
+
+#if defined(MBEDTLS_ZLIB_SUPPORT) /* removed in mbedtls 3.x */
+ /* Add extra buffer space to handle the possibility of decrypted
+ * data being longer than input data due to TLS compression. */
+ out = wpabuf_alloc((wpabuf_len(in_data) + 500) * 3);
+#else /* TLS compression is disabled in mbedtls 3.x */
+ out = wpabuf_alloc(wpabuf_len(in_data));
+#endif
+ if (out == NULL)
+ return NULL;
+
+ while ((conn->pull_buf) && ((wpabuf_len(conn->pull_buf) - conn->pull_buf_offset) > 0))
+ {
+ res = mbedtls_ssl_read(&conn->ssl, wpabuf_mhead(out), wpabuf_size(out));
+ if (res < 0)
+ {
+ /*(seems like a different error if wpabuf_len(in_data) == 0)*/
+ if (res == MBEDTLS_ERR_SSL_WANT_READ)
+ {
+ return out;
+ }
+ elog(res, "mbedtls_ssl_read");
+ wpabuf_free(out);
+ return NULL;
+ }
+ wpabuf_put(out, res);
+ }
+
+ return out;
+}
+
+int tls_connection_resumed(void *tls_ctx, struct tls_connection *conn)
+{
+ /* XXX: might need to detect if session resumed from TLS session ticket
+ * even if not special session ticket handling for EAP-FAST, EAP-TEAP */
+ /* (?ssl->handshake->resume during session ticket validation?) */
+ return conn && conn->resumed;
+}
+
+#ifdef TLS_MBEDTLS_EAP_FAST
+int tls_connection_set_cipher_list(void *tls_ctx, struct tls_connection *conn, u8 *ciphers)
+{
+ /* ciphers is list of TLS_CIPHER_* from hostap/src/crypto/tls.h */
+ int ids[7];
+ const int idsz = (int)sizeof(ids);
+ int nids = -1, id;
+ for (; *ciphers != TLS_CIPHER_NONE; ++ciphers)
+ {
+ switch (*ciphers)
+ {
+ case TLS_CIPHER_RC4_SHA:
+#ifdef MBEDTLS_TLS_RSA_WITH_RC4_128_SHA
+ id = MBEDTLS_TLS_RSA_WITH_RC4_128_SHA;
+ break;
+#else
+ continue; /*(not supported in mbedtls 3.x; ignore)*/
+#endif
+ case TLS_CIPHER_AES128_SHA:
+ id = MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA;
+ break;
+ case TLS_CIPHER_RSA_DHE_AES128_SHA:
+ id = MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA;
+ break;
+ case TLS_CIPHER_ANON_DH_AES128_SHA:
+ continue; /*(not supported in mbedtls; ignore)*/
+ case TLS_CIPHER_RSA_DHE_AES256_SHA:
+ id = MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA;
+ break;
+ case TLS_CIPHER_AES256_SHA:
+ id = MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA;
+ break;
+ default:
+ return -1; /* should not happen */
+ }
+ if (++nids == idsz)
+ return -1; /* should not happen */
+ ids[nids] = id;
+ }
+ if (nids < 0)
+ return 0; /* nothing to do */
+ if (++nids == idsz)
+ return -1; /* should not happen */
+ ids[nids] = 0; /* terminate list */
+ ++nids;
+
+ return tls_mbedtls_set_ciphersuites(conn->tls_conf, ids, nids) ? 0 : -1;
+}
+#endif
+
+int tls_get_version(void *ssl_ctx, struct tls_connection *conn, char *buf, size_t buflen)
+{
+ if (conn == NULL)
+ return -1;
+ os_strlcpy(buf, mbedtls_ssl_get_version(&conn->ssl), buflen);
+ return buf[0] != 'u' ? 0 : -1; /*(-1 if "unknown")*/
+}
+
+#ifdef TLS_MBEDTLS_EAP_TEAP
+u16 tls_connection_get_cipher_suite(struct tls_connection *conn)
+{
+ if (conn == NULL)
+ return 0;
+ return (u16)mbedtls_ssl_get_ciphersuite_id_from_ssl(&conn->ssl);
+}
+#endif
+
+int tls_get_cipher(void *tls_ctx, struct tls_connection *conn, char *buf, size_t buflen)
+{
+ if (conn == NULL)
+ return -1;
+ const int id = mbedtls_ssl_get_ciphersuite_id_from_ssl(&conn->ssl);
+ return tls_mbedtls_translate_ciphername(id, buf, buflen) ? 0 : -1;
+}
+
+#ifdef TLS_MBEDTLS_SESSION_TICKETS
+
+int tls_connection_enable_workaround(void *tls_ctx, struct tls_connection *conn)
+{
+ /* (see comment in src/eap_peer/eap_fast.c:eap_fast_init()) */
+ /* XXX: is there a relevant setting for this in mbed TLS? */
+ /* (do we even care that much about older CBC ciphers?) */
+ return 0;
+}
+
+int tls_connection_client_hello_ext(
+ void *tls_ctx, struct tls_connection *conn, int ext_type, const u8 *data, size_t data_len)
+{
+ /* (EAP-FAST and EAP-TEAP) */
+ if (ext_type == MBEDTLS_TLS_EXT_SESSION_TICKET) /*(ext_type == 35)*/
+ return tls_mbedtls_clienthello_session_ticket_prep(conn, data, data_len);
+
+ return -1;
+}
+
+#endif /* TLS_MBEDTLS_SESSION_TICKETS */
+
+int tls_connection_get_failed(void *tls_ctx, struct tls_connection *conn)
+{
+ return conn ? conn->failed : -1;
+}
+
+int tls_connection_get_read_alerts(void *tls_ctx, struct tls_connection *conn)
+{
+ return conn ? conn->read_alerts : -1;
+}
+
+int tls_connection_get_write_alerts(void *tls_ctx, struct tls_connection *conn)
+{
+ return conn ? conn->write_alerts : -1;
+}
+
+#ifdef TLS_MBEDTLS_SESSION_TICKETS
+int tls_connection_set_session_ticket_cb(void *tls_ctx,
+ struct tls_connection *conn,
+ tls_session_ticket_cb cb,
+ void *ctx)
+{
+ if (!(conn->tls_conf->flags & TLS_CONN_DISABLE_SESSION_TICKET))
+ {
+ /* (EAP-FAST and EAP-TEAP) */
+ conn->session_ticket_cb = cb;
+ conn->session_ticket_cb_ctx = ctx;
+ return 0;
+ }
+ return -1;
+}
+#endif
+
+int tls_get_library_version(char *buf, size_t buf_len)
+{
+#ifndef MBEDTLS_VERSION_C
+ const char *const ver = "n/a";
+#else
+ const char *ver = mbedtls_version_get_string();
+#endif
+ return os_snprintf(buf, buf_len, "mbed TLS build=" MBEDTLS_VERSION_STRING " run=%s", ver);
+}
+
+void tls_connection_set_success_data(struct tls_connection *conn, struct wpabuf *data)
+{
+ wpabuf_free(conn->success_data);
+ conn->success_data = data;
+}
+
+void tls_connection_set_success_data_resumed(struct tls_connection *conn)
+{
+}
+
+const struct wpabuf *tls_connection_get_success_data(struct tls_connection *conn)
+{
+ return conn->success_data;
+}
+
+void tls_connection_remove_session(struct tls_connection *conn)
+{
+}
+
+#ifdef TLS_MBEDTLS_EAP_TEAP
+int tls_get_tls_unique(struct tls_connection *conn, u8 *buf, size_t max_len)
+{
+#if defined(MBEDTLS_SSL_RENEGOTIATION) /* XXX: renegotiation or resumption? */
+ /* data from TLS handshake Finished message */
+ size_t verify_len = conn->ssl.MBEDTLS_PRIVATE(verify_data_len);
+ char *verify_data = (conn->is_server ^ conn->resumed) ? conn->ssl.MBEDTLS_PRIVATE(peer_verify_data) :
+ conn->ssl.MBEDTLS_PRIVATE(own_verify_data);
+ if (verify_len && verify_len <= max_len)
+ {
+ os_memcpy(buf, verify_data, verify_len);
+ return (int)verify_len;
+ }
+#endif
+ return -1;
+}
+#endif
+
+__attribute_noinline__ static void tls_mbedtls_set_peer_subject(struct tls_connection *conn,
+ const mbedtls_x509_crt *crt)
+{
+ if (conn->peer_subject)
+ return;
+ char buf[MBEDTLS_X509_MAX_DN_NAME_SIZE * 2];
+ int buflen = mbedtls_x509_dn_gets(buf, sizeof(buf), &crt->subject);
+ if (buflen >= 0 && (conn->peer_subject = os_malloc((size_t)buflen + 1)))
+ os_memcpy(conn->peer_subject, buf, (size_t)buflen + 1);
+}
+
+#ifdef TLS_MBEDTLS_EAP_TEAP
+const char *tls_connection_get_peer_subject(struct tls_connection *conn)
+{
+ if (!conn)
+ return NULL;
+ if (!conn->peer_subject)
+ { /*(if not set during cert verify)*/
+ const mbedtls_x509_crt *peer_cert = mbedtls_ssl_get_peer_cert(&conn->ssl);
+ if (peer_cert)
+ tls_mbedtls_set_peer_subject(conn, peer_cert);
+ }
+ return conn->peer_subject;
+}
+#endif
+
+#ifdef TLS_MBEDTLS_EAP_TEAP
+bool tls_connection_get_own_cert_used(struct tls_connection *conn)
+{
+ /* XXX: availability of cert does not necessary mean that client
+ * received certificate request from server and then sent cert.
+ * ? step handshake in tls_connection_handshake() looking for
+ * MBEDTLS_SSL_CERTIFICATE_REQUEST ? */
+ const struct tls_conf *const tls_conf = conn->tls_conf;
+ return (tls_conf->has_client_cert && tls_conf->has_private_key);
+}
+#endif
+
+#if defined(CONFIG_FIPS)
+#define TLS_MBEDTLS_CONFIG_FIPS
+#endif
+
+/*
+ * tls_prf_sha1_md5()/tls_prf_sha256()/tls_prf_sha384() are provided by
+ * hostap's shared sha1-tlsprf.c / sha256-tlsprf.c / sha384-tlsprf.c (kept
+ * compiled for CONFIG_TLS=psa), so they are not reimplemented here.
+ */
+
+#ifdef TLS_MBEDTLS_CERT_VERIFY_EXTMATCH
+
+
+
+struct mlist
+{
+ const char *p;
+ size_t n;
+};
+
+static int tls_mbedtls_match_altsubject(mbedtls_x509_crt *crt, const char *match)
+{
+ /* RFE: this could be pre-parsed into structured data at config time */
+ struct mlist list[256]; /*(much larger than expected)*/
+ int nlist = 0;
+ if (os_strncmp(match, "EMAIL:", 6) != 0 && os_strncmp(match, "DNS:", 4) != 0 && os_strncmp(match, "URI:", 4) != 0)
+ {
+ wpa_printf(MSG_INFO, "MTLS: Invalid altSubjectName match '%s'", match);
+ return 0;
+ }
+ for (const char *s = match, *tok; *s; s = tok ? tok + 1 : "")
+ {
+ do
+ {
+ } while ((tok = os_strchr(s, ';')) && os_strncmp(tok + 1, "EMAIL:", 6) != 0 &&
+ os_strncmp(tok + 1, "DNS:", 4) != 0 && os_strncmp(tok + 1, "URI:", 4) != 0);
+ list[nlist].p = s;
+ list[nlist].n = tok ? (size_t)(tok - s) : os_strlen(s);
+ if (list[nlist].n && ++nlist == sizeof(list) / sizeof(*list))
+ {
+ wpa_printf(MSG_INFO, "MTLS: excessive altSubjectName match '%s'", match);
+ break; /* truncate huge list and continue */
+ }
+ }
+
+ if (!mbedtls_x509_crt_has_ext_type(crt, MBEDTLS_X509_EXT_SUBJECT_ALT_NAME))
+ return 0;
+
+ const mbedtls_x509_sequence *cur = &crt->subject_alt_names;
+ for (; cur != NULL; cur = cur->next)
+ {
+ const unsigned char san_type = (unsigned char)cur->buf.tag & MBEDTLS_ASN1_TAG_VALUE_MASK;
+ char t;
+ size_t step = 4;
+ switch (san_type)
+ { /* "EMAIL:" or "DNS:" or "URI:" */
+ case MBEDTLS_X509_SAN_RFC822_NAME:
+ step = 6;
+ t = 'E';
+ break;
+ case MBEDTLS_X509_SAN_DNS_NAME:
+ t = 'D';
+ break;
+ case MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER:
+ t = 'U';
+ break;
+ default:
+ continue;
+ }
+
+ for (int i = 0; i < nlist; ++i)
+ {
+ /* step over "EMAIL:" or "DNS:" or "URI:" in list[i].p */
+ /* Note: v is not '\0'-terminated, but is a known length vlen,
+ * so okay to pass to os_strncasecmp() even though not z-string */
+ if (cur->buf.len == list[i].n - step && t == *list[i].p &&
+ 0 == os_strncasecmp((char *)cur->buf.p, list[i].p + step, cur->buf.len))
+ {
+ return 1; /* match */
+ }
+ }
+ }
+ return 0; /* no match */
+}
+
+static int tls_mbedtls_match_suffix(const char *v, size_t vlen, const struct mlist *list, int nlist, int full)
+{
+ /* Note: v is not '\0'-terminated, but is a known length vlen,
+ * so okay to pass to os_strncasecmp() even though not z-string */
+ for (int i = 0; i < nlist; ++i)
+ {
+ size_t n = list[i].n;
+ if ((n == vlen || (n < vlen && v[vlen - n - 1] == '.' && !full)) &&
+ 0 == os_strncasecmp(v + vlen - n, list[i].p, n))
+ return 1; /* match */
+ }
+ return 0; /* no match */
+}
+
+static int tls_mbedtls_match_suffixes(mbedtls_x509_crt *crt, const char *match, int full)
+{
+ /* RFE: this could be pre-parsed into structured data at config time */
+ struct mlist list[256]; /*(much larger than expected)*/
+ int nlist = 0;
+ for (const char *s = match, *tok; *s; s = tok ? tok + 1 : "")
+ {
+ tok = os_strchr(s, ';');
+ list[nlist].p = s;
+ list[nlist].n = tok ? (size_t)(tok - s) : os_strlen(s);
+ if (list[nlist].n && ++nlist == sizeof(list) / sizeof(*list))
+ {
+ wpa_printf(MSG_INFO, "MTLS: excessive suffix match '%s'", match);
+ break; /* truncate huge list and continue */
+ }
+ }
+
+ /* check subjectAltNames */
+ if (mbedtls_x509_crt_has_ext_type(crt, MBEDTLS_X509_EXT_SUBJECT_ALT_NAME))
+ {
+ const mbedtls_x509_sequence *cur = &crt->subject_alt_names;
+ for (; cur != NULL; cur = cur->next)
+ {
+ const unsigned char san_type = (unsigned char)cur->buf.tag & MBEDTLS_ASN1_TAG_VALUE_MASK;
+ if (san_type == MBEDTLS_X509_SAN_DNS_NAME &&
+ tls_mbedtls_match_suffix((char *)cur->buf.p, cur->buf.len, list, nlist, full))
+ {
+ return 1; /* match */
+ }
+ }
+ }
+
+ /* check subject CN */
+ const mbedtls_x509_name *name = &crt->subject;
+ for (; name != NULL; name = name->next)
+ {
+ if (name->oid.p && MBEDTLS_OID_CMP(MBEDTLS_OID_AT_CN, &name->oid) == 0)
+ break;
+ }
+ if (name && tls_mbedtls_match_suffix((char *)name->val.p, name->val.len, list, nlist, full))
+ {
+ return 1; /* match */
+ }
+
+ return 0; /* no match */
+}
+
+static int tls_mbedtls_match_dn_field(mbedtls_x509_crt *crt, const char *match)
+{
+ /* RFE: this could be pre-parsed into structured data at config time */
+ struct mlistoid
+ {
+ const char *p;
+ size_t n;
+ const char *oid;
+ size_t olen;
+ int prefix;
+ };
+ struct mlistoid list[32]; /*(much larger than expected)*/
+ int nlist = 0;
+ for (const char *s = match, *tok, *e; *s; s = tok ? tok + 1 : "")
+ {
+ tok = os_strchr(s, '/');
+ list[nlist].oid = NULL;
+ list[nlist].olen = 0;
+ list[nlist].n = tok ? (size_t)(tok - s) : os_strlen(s);
+ e = memchr(s, '=', list[nlist].n);
+ if (e == NULL)
+ {
+ if (list[nlist].n == 0)
+ continue; /* skip consecutive, repeated '/' */
+ if (list[nlist].n == 1 && *s == '*')
+ {
+ /* special-case "*" to match any OID and value */
+ s = e = "=*";
+ list[nlist].n = 2;
+ list[nlist].oid = "";
+ }
+ else
+ {
+ wpa_printf(MSG_INFO, "MTLS: invalid check_cert_subject '%s' missing '='", match);
+ return 0;
+ }
+ }
+ switch (e - s)
+ {
+ case 1:
+ if (*s == 'C')
+ {
+ list[nlist].oid = MBEDTLS_OID_AT_COUNTRY;
+ list[nlist].olen = sizeof(MBEDTLS_OID_AT_COUNTRY) - 1;
+ }
+ else if (*s == 'L')
+ {
+ list[nlist].oid = MBEDTLS_OID_AT_LOCALITY;
+ list[nlist].olen = sizeof(MBEDTLS_OID_AT_LOCALITY) - 1;
+ }
+ else if (*s == 'O')
+ {
+ list[nlist].oid = MBEDTLS_OID_AT_ORGANIZATION;
+ list[nlist].olen = sizeof(MBEDTLS_OID_AT_ORGANIZATION) - 1;
+ }
+ break;
+ case 2:
+ if (s[0] == 'C' && s[1] == 'N')
+ {
+ list[nlist].oid = MBEDTLS_OID_AT_CN;
+ list[nlist].olen = sizeof(MBEDTLS_OID_AT_CN) - 1;
+ }
+ else if (s[0] == 'S' && s[1] == 'T')
+ {
+ list[nlist].oid = MBEDTLS_OID_AT_STATE;
+ list[nlist].olen = sizeof(MBEDTLS_OID_AT_STATE) - 1;
+ }
+ else if (s[0] == 'O' && s[1] == 'U')
+ {
+ list[nlist].oid = MBEDTLS_OID_AT_ORG_UNIT;
+ list[nlist].olen = sizeof(MBEDTLS_OID_AT_ORG_UNIT) - 1;
+ }
+ break;
+ case 12:
+ if (os_memcmp(s, "emailAddress", 12) == 0)
+ {
+ list[nlist].oid = MBEDTLS_OID_PKCS9_EMAIL;
+ list[nlist].olen = sizeof(MBEDTLS_OID_PKCS9_EMAIL) - 1;
+ }
+ break;
+ default:
+ break;
+ }
+ if (list[nlist].oid == NULL)
+ {
+ wpa_printf(MSG_INFO, "MTLS: Unknown field in check_cert_subject '%s'", match);
+ return 0;
+ }
+ list[nlist].n -= (size_t)(++e - s);
+ list[nlist].p = e;
+ if (list[nlist].n && e[list[nlist].n - 1] == '*')
+ {
+ --list[nlist].n;
+ list[nlist].prefix = 1;
+ }
+ /*(could easily add support for suffix matches if value begins with '*',
+ * but suffix match is not currently supported by other TLS modules)*/
+
+ if (list[nlist].n && ++nlist == sizeof(list) / sizeof(*list))
+ {
+ wpa_printf(MSG_INFO, "MTLS: excessive check_cert_subject match '%s'", match);
+ break; /* truncate huge list and continue */
+ }
+ }
+
+ /* each component in match string must match cert Subject in order listed
+ * The behavior below preserves ordering but is slightly different than
+ * the grossly inefficient contortions implemented in tls_openssl.c */
+ const mbedtls_x509_name *name = &crt->subject;
+ for (int i = 0; i < nlist; ++i)
+ {
+ int found = 0;
+ for (; name != NULL && !found; name = name->next)
+ {
+ if (!name->oid.p)
+ continue;
+ /* special-case "*" to match any OID and value */
+ if (list[i].olen == 0)
+ {
+ found = 1;
+ continue;
+ }
+ /* perform equalent of !MBEDTLS_OID_CMP() with oid ptr and len */
+ if (list[i].olen != name->oid.len || os_memcmp(list[i].oid, name->oid.p, name->oid.len) != 0)
+ continue;
+ /* Note: v is not '\0'-terminated, but is a known length vlen,
+ * so okay to pass to os_strncasecmp() even though not z-string */
+ if ((list[i].prefix ? list[i].n <= name->val.len /* prefix match */
+ :
+ list[i].n == name->val.len) /* full match */
+ && 0 == os_strncasecmp((char *)name->val.p, list[i].p, list[i].n))
+ {
+ found = 1;
+ continue;
+ }
+ }
+ if (!found)
+ return 0; /* no match */
+ }
+ return 1; /* match */
+}
+
+#endif /* TLS_MBEDTLS_CERT_VERIFY_EXTMATCH */
+
+__attribute_cold__ static void tls_mbedtls_verify_fail_event(mbedtls_x509_crt *crt,
+ int depth,
+ const char *errmsg,
+ enum tls_fail_reason reason)
+{
+ struct tls_config *init_conf = &tls_ctx_global.init_conf;
+ if (init_conf->event_cb == NULL)
+ return;
+
+ struct wpabuf *certbuf = wpabuf_alloc_copy(crt->raw.p, crt->raw.len);
+ char subject[MBEDTLS_X509_MAX_DN_NAME_SIZE * 2];
+ if (mbedtls_x509_dn_gets(subject, sizeof(subject), &crt->subject) < 0)
+ subject[0] = '\0';
+ union tls_event_data ev;
+ os_memset(&ev, 0, sizeof(ev));
+ ev.cert_fail.reason = reason;
+ ev.cert_fail.depth = depth;
+ ev.cert_fail.subject = subject;
+ ev.cert_fail.reason_txt = errmsg;
+ ev.cert_fail.cert = certbuf;
+
+ init_conf->event_cb(init_conf->cb_ctx, TLS_CERT_CHAIN_FAILURE, &ev);
+
+ wpabuf_free(certbuf);
+}
+
+__attribute_noinline__ static void tls_mbedtls_verify_cert_event(struct tls_connection *conn,
+ mbedtls_x509_crt *crt,
+ int depth)
+{
+ struct tls_config *init_conf = &tls_ctx_global.init_conf;
+ if (init_conf->event_cb == NULL)
+ return;
+
+ struct wpabuf *certbuf = NULL;
+ union tls_event_data ev;
+ os_memset(&ev, 0, sizeof(ev));
+
+#ifdef MBEDTLS_SHA256_C
+ u8 hash[SHA256_DIGEST_LENGTH];
+ const u8 *addr[] = {(u8 *)crt->raw.p};
+ if (sha256_vector(1, addr, &crt->raw.len, hash) == 0)
+ {
+ ev.peer_cert.hash = hash;
+ ev.peer_cert.hash_len = sizeof(hash);
+ }
+#endif
+ ev.peer_cert.depth = depth;
+ char subject[MBEDTLS_X509_MAX_DN_NAME_SIZE * 2];
+ if (depth == 0)
+ ev.peer_cert.subject = conn->peer_subject;
+ if (ev.peer_cert.subject == NULL)
+ {
+ ev.peer_cert.subject = subject;
+ if (mbedtls_x509_dn_gets(subject, sizeof(subject), &crt->subject) < 0)
+ subject[0] = '\0';
+ }
+
+ char serial_num[128 + 1];
+ ev.peer_cert.serial_num = tls_mbedtls_peer_serial_num(crt, serial_num, sizeof(serial_num));
+
+ const mbedtls_x509_sequence *cur;
+
+ cur = NULL;
+ if (mbedtls_x509_crt_has_ext_type(crt, MBEDTLS_X509_EXT_SUBJECT_ALT_NAME))
+ cur = &crt->subject_alt_names;
+ for (; cur != NULL; cur = cur->next)
+ {
+ const unsigned char san_type = (unsigned char)cur->buf.tag & MBEDTLS_ASN1_TAG_VALUE_MASK;
+ size_t prelen = 4;
+ const char *pre;
+ switch (san_type)
+ {
+ case MBEDTLS_X509_SAN_RFC822_NAME:
+ prelen = 6;
+ pre = "EMAIL:";
+ break;
+ case MBEDTLS_X509_SAN_DNS_NAME:
+ pre = "DNS:";
+ break;
+ case MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER:
+ pre = "URI:";
+ break;
+ default:
+ continue;
+ }
+
+ char *pos = os_malloc(prelen + cur->buf.len + 1);
+ if (pos == NULL)
+ break;
+ ev.peer_cert.altsubject[ev.peer_cert.num_altsubject] = pos;
+ os_memcpy(pos, pre, prelen);
+ /* data should be properly backslash-escaped if needed,
+ * so code below does not re-escape, but does replace CTLs */
+ /*os_memcpy(pos+prelen, cur->buf.p, cur->buf.len);*/
+ /*pos[prelen+cur->buf.len] = '\0';*/
+ pos += prelen;
+ for (size_t i = 0; i < cur->buf.len; ++i)
+ {
+ unsigned char c = cur->buf.p[i];
+ *pos++ = (c >= 32 && c != 127) ? c : '?';
+ }
+ *pos = '\0';
+
+ if (++ev.peer_cert.num_altsubject == TLS_MAX_ALT_SUBJECT)
+ break;
+ }
+
+ cur = NULL;
+ if (mbedtls_x509_crt_has_ext_type(crt, MBEDTLS_X509_EXT_CERTIFICATE_POLICIES))
+ cur = &crt->certificate_policies;
+ for (; cur != NULL; cur = cur->next)
+ {
+ if (cur->buf.len != 11) /* len of OID_TOD_STRICT or OID_TOD_TOFU */
+ continue;
+/* TOD-STRICT "1.3.6.1.4.1.40808.1.3.1" */
+/* TOD-TOFU "1.3.6.1.4.1.40808.1.3.2" */
+#define OID_TOD_STRICT "\x2b\x06\x01\x04\x01\x82\xbe\x68\x01\x03\x01"
+#define OID_TOD_TOFU "\x2b\x06\x01\x04\x01\x82\xbe\x68\x01\x03\x02"
+ if (os_memcmp(cur->buf.p, OID_TOD_STRICT, sizeof(OID_TOD_STRICT) - 1) == 0)
+ {
+ ev.peer_cert.tod = 1; /* TOD-STRICT */
+ break;
+ }
+ if (os_memcmp(cur->buf.p, OID_TOD_TOFU, sizeof(OID_TOD_TOFU) - 1) == 0)
+ {
+ ev.peer_cert.tod = 2; /* TOD-TOFU */
+ break;
+ }
+ }
+
+ struct tls_conf *tls_conf = conn->tls_conf;
+ if (tls_conf->ca_cert_probe || (tls_conf->flags & TLS_CONN_EXT_CERT_CHECK) || init_conf->cert_in_cb)
+ {
+ certbuf = wpabuf_alloc_copy(crt->raw.p, crt->raw.len);
+ ev.peer_cert.cert = certbuf;
+ }
+
+ init_conf->event_cb(init_conf->cb_ctx, TLS_PEER_CERTIFICATE, &ev);
+
+ wpabuf_free(certbuf);
+ char **altsubject;
+ *(const char ***)&altsubject = ev.peer_cert.altsubject;
+ for (size_t i = 0; i < ev.peer_cert.num_altsubject; ++i)
+ os_free(altsubject[i]);
+}
+
+static int tls_mbedtls_verify_cb(void *arg, mbedtls_x509_crt *crt, int depth, uint32_t *flags)
+{
+ /* XXX: N.B. verify code not carefully tested besides hwsim tests
+ *
+ * RFE: mbedtls_x509_crt_verify_info() and enhance log trace messages
+ * RFE: review and add support for additional TLS_CONN_* flags
+ * not handling OCSP (not available in mbedtls)
+ * ... */
+
+ struct tls_connection *conn = (struct tls_connection *)arg;
+ struct tls_conf *tls_conf = conn->tls_conf;
+ uint32_t flags_in = *flags;
+
+ /* Clear the MBEDTLS_X509_BADCERT_CN_MISMATCH flag (0x4) to allow
+ * custom certificate verification logic to be applied */
+ if (*flags & MBEDTLS_X509_BADCERT_CN_MISMATCH)
+ *flags &= ~MBEDTLS_X509_BADCERT_CN_MISMATCH;
+
+#if defined(TLS_MBEDTLS_CERT_DISABLE_KEY_USAGE_CHECK)
+ crt->MBEDTLS_PRIVATE(ext_types) &= ~MBEDTLS_X509_EXT_KEY_USAGE;
+ crt->MBEDTLS_PRIVATE(ext_types) &= ~MBEDTLS_X509_EXT_EXTENDED_KEY_USAGE;
+#endif
+
+ if (depth > 8)
+ { /*(depth 8 picked as arbitrary limit)*/
+ emsg(MSG_WARNING, "client cert chain too long");
+ *flags |= MBEDTLS_X509_BADCERT_OTHER; /* cert chain too long */
+ tls_mbedtls_verify_fail_event(crt, depth, "client cert chain too long", TLS_FAIL_BAD_CERTIFICATE);
+ }
+ else if (tls_conf->verify_depth0_only)
+ {
+ if (depth > 0)
+ *flags = 0;
+ else
+ {
+#ifdef MBEDTLS_SHA256_C
+ u8 hash[SHA256_DIGEST_LENGTH];
+ const u8 *addr[] = {(u8 *)crt->raw.p};
+ if (sha256_vector(1, addr, &crt->raw.len, hash) < 0 ||
+ os_memcmp(tls_conf->ca_cert_hash, hash, sizeof(hash)) != 0)
+ {
+ *flags |= MBEDTLS_X509_BADCERT_NOT_TRUSTED;
+ tls_mbedtls_verify_fail_event(crt, depth, "cert hash mismatch", TLS_FAIL_UNTRUSTED);
+ }
+ else /* hash matches; ignore other issues *except* if revoked)*/
+ *flags &= MBEDTLS_X509_BADCERT_REVOKED;
+#endif
+ }
+ }
+ else if (depth == 0)
+ {
+ if (!conn->peer_subject)
+ tls_mbedtls_set_peer_subject(conn, crt);
+ /*(use same labels to tls_mbedtls_verify_fail_event() as used in
+ * other TLS modules so that hwsim tests find exact string match)*/
+ if (!conn->peer_subject)
+ { /* error copying subject string */
+ *flags |= MBEDTLS_X509_BADCERT_OTHER;
+ tls_mbedtls_verify_fail_event(crt, depth, "internal error", TLS_FAIL_UNSPECIFIED);
+ }
+#ifdef TLS_MBEDTLS_CERT_VERIFY_EXTMATCH
+ /*(use os_strstr() for subject match as is done in tls_mbedtls.c
+ * to follow the same behavior, even though a suffix match would
+ * make more sense. Also, note that strstr match does not
+ * normalize whitespace (between components) for comparison)*/
+ else if (tls_conf->subject_match && os_strstr(conn->peer_subject, tls_conf->subject_match) == NULL)
+ {
+ wpa_printf(MSG_WARNING, "MTLS: Subject '%s' did not match with '%s'", conn->peer_subject,
+ tls_conf->subject_match);
+ *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
+ tls_mbedtls_verify_fail_event(crt, depth, "Subject mismatch", TLS_FAIL_SUBJECT_MISMATCH);
+ }
+ if (tls_conf->altsubject_match && !tls_mbedtls_match_altsubject(crt, tls_conf->altsubject_match))
+ {
+ wpa_printf(MSG_WARNING, "MTLS: altSubjectName match '%s' not found", tls_conf->altsubject_match);
+ *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
+ tls_mbedtls_verify_fail_event(crt, depth, "AltSubject mismatch", TLS_FAIL_ALTSUBJECT_MISMATCH);
+ }
+ if (tls_conf->suffix_match && !tls_mbedtls_match_suffixes(crt, tls_conf->suffix_match, 0))
+ {
+ wpa_printf(MSG_WARNING, "MTLS: Domain suffix match '%s' not found", tls_conf->suffix_match);
+ *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
+ tls_mbedtls_verify_fail_event(crt, depth, "Domain suffix mismatch", TLS_FAIL_DOMAIN_SUFFIX_MISMATCH);
+ }
+ if (tls_conf->domain_match && !tls_mbedtls_match_suffixes(crt, tls_conf->domain_match, 1))
+ {
+ wpa_printf(MSG_WARNING, "MTLS: Domain match '%s' not found", tls_conf->domain_match);
+ *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
+ tls_mbedtls_verify_fail_event(crt, depth, "Domain mismatch", TLS_FAIL_DOMAIN_MISMATCH);
+ }
+ if (tls_conf->check_cert_subject && !tls_mbedtls_match_dn_field(crt, tls_conf->check_cert_subject))
+ {
+ *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
+ tls_mbedtls_verify_fail_event(crt, depth, "Distinguished Name", TLS_FAIL_DN_MISMATCH);
+ }
+#endif
+ if (tls_conf->flags & TLS_CONN_SUITEB)
+ {
+ /* check RSA modulus size (public key bitlen) */
+ const psa_key_type_t key_type = mbedtls_pk_get_key_type(&crt->pk);
+ if (PSA_KEY_TYPE_IS_RSA(key_type)
+#ifdef CONFIG_SUITEB192
+ && mbedtls_pk_get_bitlen(&crt->pk) < 3072
+#else
+ && mbedtls_pk_get_bitlen(&crt->pk) < 2048
+#endif
+ )
+ {
+ /* hwsim suite_b RSA tests expect 3072
+ * suite_b_192_rsa_ecdhe_radius_rsa2048_client
+ * suite_b_192_rsa_dhe_radius_rsa2048_client */
+ *flags |= MBEDTLS_X509_BADCERT_BAD_KEY;
+ tls_mbedtls_verify_fail_event(crt, depth, "Insufficient RSA modulus size",
+ TLS_FAIL_INSUFFICIENT_KEY_LEN);
+ }
+ }
+ if (tls_conf->check_crl && tls_conf->crl == NULL)
+ {
+ /* see tests/hwsim test_ap_eap.py ap_wpa2_eap_tls_check_crl */
+ emsg(MSG_WARNING, "check_crl set but no CRL loaded; reject all?");
+ *flags |= MBEDTLS_X509_BADCERT_OTHER;
+ tls_mbedtls_verify_fail_event(crt, depth,
+ "check_crl set but no CRL loaded; "
+ "reject all?",
+ TLS_FAIL_BAD_CERTIFICATE);
+ }
+ }
+ else
+ {
+ if (tls_conf->check_crl != 2) /* 2 == verify CRLs for all certs */
+ *flags &= ~MBEDTLS_X509_BADCERT_REVOKED;
+ }
+
+ if (!tls_conf->check_crl_strict)
+ {
+ *flags &= ~MBEDTLS_X509_BADCRL_EXPIRED;
+ *flags &= ~MBEDTLS_X509_BADCRL_FUTURE;
+ }
+
+ if (tls_conf->flags & TLS_CONN_DISABLE_TIME_CHECKS)
+ {
+ *flags &= ~MBEDTLS_X509_BADCERT_EXPIRED;
+ *flags &= ~MBEDTLS_X509_BADCERT_FUTURE;
+ }
+
+ tls_mbedtls_verify_cert_event(conn, crt, depth);
+
+ if (*flags)
+ {
+ if (*flags &
+ (MBEDTLS_X509_BADCERT_NOT_TRUSTED | MBEDTLS_X509_BADCERT_CN_MISMATCH | MBEDTLS_X509_BADCERT_REVOKED))
+ {
+ emsg(MSG_WARNING, "client cert not trusted");
+ }
+ /* report event if flags set but no additional flags set above */
+ /* (could translate flags to more detailed TLS_FAIL_* if needed) */
+ if (!(*flags & ~flags_in))
+ {
+ enum tls_fail_reason reason = TLS_FAIL_UNSPECIFIED;
+ const char *errmsg = "cert verify fail unspecified";
+ if (*flags & MBEDTLS_X509_BADCERT_NOT_TRUSTED)
+ {
+ reason = TLS_FAIL_UNTRUSTED;
+ errmsg = "certificate not trusted";
+ }
+ if (*flags & MBEDTLS_X509_BADCERT_REVOKED)
+ {
+ reason = TLS_FAIL_REVOKED;
+ errmsg = "certificate has been revoked";
+ }
+ if (*flags & MBEDTLS_X509_BADCERT_FUTURE)
+ {
+ reason = TLS_FAIL_NOT_YET_VALID;
+ errmsg = "certificate not yet valid";
+ }
+ if (*flags & MBEDTLS_X509_BADCERT_EXPIRED)
+ {
+ reason = TLS_FAIL_EXPIRED;
+ errmsg = "certificate has expired";
+ }
+ if (*flags & MBEDTLS_X509_BADCERT_BAD_MD)
+ {
+ reason = TLS_FAIL_BAD_CERTIFICATE;
+ errmsg = "certificate uses insecure algorithm";
+ }
+ tls_mbedtls_verify_fail_event(crt, depth, errmsg, reason);
+ }
+
+ /*(do not preserve subject if verification failed but was optional)*/
+ if (depth == 0 && conn->peer_subject)
+ {
+ os_free(conn->peer_subject);
+ conn->peer_subject = NULL;
+ }
+ }
+ else if (depth == 0)
+ {
+ struct tls_config *init_conf = &tls_ctx_global.init_conf;
+ if (tls_conf->ca_cert_probe)
+ {
+ /* reject server certificate on probe-only run */
+ *flags |= MBEDTLS_X509_BADCERT_OTHER;
+ tls_mbedtls_verify_fail_event(crt, depth, "server chain probe", TLS_FAIL_SERVER_CHAIN_PROBE);
+ }
+ else if (init_conf->event_cb)
+ {
+ /* ??? send event as soon as depth == 0 is verified ???
+ * What about rest of chain?
+ * Follows tls_mbedtls.c behavior: */
+ init_conf->event_cb(init_conf->cb_ctx, TLS_CERT_CHAIN_SUCCESS, NULL);
+ }
+ }
+
+ return 0;
+}
diff --git a/wpa_supplicant/Makefile b/wpa_supplicant/Makefile
index 2b82c42c8..b045a8f64 100644
--- a/wpa_supplicant/Makefile
+++ b/wpa_supplicant/Makefile
@@ -1260,6 +1260,36 @@ LIBS += -lwolfssl -lm
LIBS_p += -lwolfssl -lm
endif
+ifeq ($(CONFIG_TLS), psa)
+# PSA crypto backend: PSA Crypto API primitives (reference: MbedTLS 4 /
+# TF-PSA-Crypto) with MbedTLS providing TLS/X.509 and the bignum/EC-point
+# math the PSA Crypto API does not expose. Include/library paths for the
+# MbedTLS + TF-PSA-Crypto trees are supplied by the build .config (CFLAGS/LIBS).
+ifdef TLS_FUNCS
+OBJS += ../src/crypto/tls_psa.o
+endif
+OBJS += ../src/crypto/crypto_psa.o
+OBJS += ../src/crypto/crypto_psa_mbedtls.o
+OBJS_p += ../src/crypto/crypto_psa.o
+OBJS_p += ../src/crypto/crypto_psa_mbedtls.o
+OBJS_priv += ../src/crypto/crypto_psa.o
+OBJS_priv += ../src/crypto/crypto_psa_mbedtls.o
+ifdef NEED_FIPS186_2_PRF
+# PSA has no raw SHA-1 compression; use hostap's internal FIPS 186-2 PRF, which
+# needs the internal SHA-1 transform (sha1-internal.o provides SHA1Transform;
+# it only defines sha1_vector under CONFIG_CRYPTO_INTERNAL, so no clash here).
+OBJS += ../src/crypto/fips_prf_internal.o
+OBJS += ../src/crypto/sha1-internal.o
+endif
+NEED_TLS_PRF_SHA256=y
+LIBS += -lmbedtls -lmbedx509 -lmbedcrypto
+LIBS_p += -lmbedx509 -lmbedcrypto
+ifdef CONFIG_TLS_ADD_DL
+LIBS += -ldl
+LIBS_p += -ldl
+endif
+endif
+
ifeq ($(CONFIG_TLS), openssl)
CFLAGS += -DCRYPTO_RSA_OAEP_SHA256
ifdef TLS_FUNCS
@@ -1479,9 +1509,11 @@ endif
ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), wolfssl)
+ifneq ($(CONFIG_TLS), psa)
NEED_INTERNAL_AES_WRAP=y
endif
endif
+endif
ifdef CONFIG_OPENSSL_INTERNAL_AES_WRAP
# Seems to be needed at least with BoringSSL
NEED_INTERNAL_AES_WRAP=y
@@ -1507,8 +1539,10 @@ AESOBJS += ../src/crypto/aes-siv.o
NEED_AES_CTR=y
endif
ifdef NEED_AES_CTR
+ifneq ($(CONFIG_TLS), psa)
AESOBJS += ../src/crypto/aes-ctr.o
endif
+endif
ifdef NEED_AES_ENCBLOCK
AESOBJS += ../src/crypto/aes-encblock.o
endif
@@ -1516,10 +1550,12 @@ NEED_AES_ENC=y
ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
ifneq ($(CONFIG_TLS), wolfssl)
+ifneq ($(CONFIG_TLS), psa)
AESOBJS += ../src/crypto/aes-omac1.o
endif
endif
endif
+endif
ifdef NEED_AES_WRAP
NEED_AES_ENC=y
ifdef NEED_INTERNAL_AES_WRAP
@@ -1531,11 +1567,13 @@ NEED_AES_ENC=y
ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
ifneq ($(CONFIG_TLS), wolfssl)
+ifneq ($(CONFIG_TLS), psa)
AESOBJS += ../src/crypto/aes-cbc.o
endif
endif
endif
endif
+endif
ifdef NEED_AES_ENC
ifdef CONFIG_INTERNAL_AES
AESOBJS += ../src/crypto/aes-internal-enc.o
@@ -1550,12 +1588,16 @@ ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
ifneq ($(CONFIG_TLS), gnutls)
ifneq ($(CONFIG_TLS), wolfssl)
+ifneq ($(CONFIG_TLS), psa)
SHA1OBJS += ../src/crypto/sha1.o
endif
endif
endif
endif
+endif
+ifneq ($(CONFIG_TLS), psa)
SHA1OBJS += ../src/crypto/sha1-prf.o
+endif
ifdef CONFIG_INTERNAL_SHA1
SHA1OBJS += ../src/crypto/sha1-internal.o
ifdef NEED_FIPS186_2_PRF
@@ -1567,10 +1609,12 @@ CFLAGS += -DCONFIG_NO_PBKDF2
else
ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), wolfssl)
+ifneq ($(CONFIG_TLS), psa)
SHA1OBJS += ../src/crypto/sha1-pbkdf2.o
endif
endif
endif
+endif
ifdef NEED_T_PRF
SHA1OBJS += ../src/crypto/sha1-tprf.o
endif
@@ -1584,12 +1628,14 @@ ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
ifneq ($(CONFIG_TLS), gnutls)
ifneq ($(CONFIG_TLS), wolfssl)
+ifneq ($(CONFIG_TLS), psa)
MD5OBJS += ../src/crypto/md5.o
endif
endif
endif
endif
endif
+endif
ifdef NEED_MD5
ifdef CONFIG_INTERNAL_MD5
MD5OBJS += ../src/crypto/md5-internal.o
@@ -1644,12 +1690,16 @@ ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
ifneq ($(CONFIG_TLS), gnutls)
ifneq ($(CONFIG_TLS), wolfssl)
+ifneq ($(CONFIG_TLS), psa)
SHA256OBJS += ../src/crypto/sha256.o
endif
endif
endif
endif
+endif
+ifneq ($(CONFIG_TLS), psa)
SHA256OBJS += ../src/crypto/sha256-prf.o
+endif
ifdef CONFIG_INTERNAL_SHA256
SHA256OBJS += ../src/crypto/sha256-internal.o
endif
@@ -1669,43 +1719,57 @@ SHA256OBJS += ../src/crypto/sha384-tlsprf.o
endif
ifdef NEED_HMAC_SHA256_KDF
CFLAGS += -DCONFIG_HMAC_SHA256_KDF
+ifneq ($(CONFIG_TLS), psa)
OBJS += ../src/crypto/sha256-kdf.o
endif
+endif
ifdef NEED_HMAC_SHA384_KDF
CFLAGS += -DCONFIG_HMAC_SHA384_KDF
+ifneq ($(CONFIG_TLS), psa)
OBJS += ../src/crypto/sha384-kdf.o
endif
+endif
ifdef NEED_HMAC_SHA512_KDF
CFLAGS += -DCONFIG_HMAC_SHA512_KDF
+ifneq ($(CONFIG_TLS), psa)
OBJS += ../src/crypto/sha512-kdf.o
endif
+endif
OBJS += $(SHA256OBJS)
ifdef NEED_SHA384
ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
ifneq ($(CONFIG_TLS), gnutls)
ifneq ($(CONFIG_TLS), wolfssl)
+ifneq ($(CONFIG_TLS), psa)
OBJS += ../src/crypto/sha384.o
endif
endif
endif
endif
+endif
CFLAGS += -DCONFIG_SHA384
+ifneq ($(CONFIG_TLS), psa)
OBJS += ../src/crypto/sha384-prf.o
endif
+endif
ifdef NEED_SHA512
ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), linux)
ifneq ($(CONFIG_TLS), gnutls)
ifneq ($(CONFIG_TLS), wolfssl)
+ifneq ($(CONFIG_TLS), psa)
OBJS += ../src/crypto/sha512.o
endif
endif
endif
endif
+endif
CFLAGS += -DCONFIG_SHA512
+ifneq ($(CONFIG_TLS), psa)
OBJS += ../src/crypto/sha512-prf.o
endif
+endif
ifdef NEED_ASN1
OBJS += ../src/tls/asn1.o
@@ -1880,10 +1944,12 @@ ifdef CONFIG_FIPS
CFLAGS += -DCONFIG_FIPS
ifneq ($(CONFIG_TLS), openssl)
ifneq ($(CONFIG_TLS), wolfssl)
+ifneq ($(CONFIG_TLS), psa)
$(error CONFIG_FIPS=y requires CONFIG_TLS=openssl)
endif
endif
endif
+endif
OBJS += $(SHA1OBJS) $(DESOBJS)
diff --git a/wpa_supplicant/defconfig b/wpa_supplicant/defconfig
index bc865ce5f..e47041309 100644
--- a/wpa_supplicant/defconfig
+++ b/wpa_supplicant/defconfig
@@ -328,6 +328,10 @@ CONFIG_BACKEND=file
# Select TLS implementation
# openssl = OpenSSL (default)
# gnutls = GnuTLS
+# wolfssl = wolfSSL
+# psa = PSA Crypto API primitives with MbedTLS for TLS/X.509 and the
+# bignum/EC-point math not covered by PSA (reference: MbedTLS 4 /
+# TF-PSA-Crypto); suited to resource-constrained/PSA-based platforms
# internal = Internal TLSv1 implementation (experimental)
# linux = Linux kernel AF_ALG and internal TLSv1 implementation (experimental)
# none = Empty template
--
2.43.0
More information about the Hostap
mailing list