Skip to content

Commit 3630a05

Browse files
author
Chia-chi Yeh
committedOct 1, 2009
wpa_supplicant: push keystore access to tls_openssl.c.
Since we support certificate chain, doing it in eap_tls_common.c becomes too complicated. To make things simpler, push the logic to tls_openssl.c and use keystore namespace instead.
·
android-sdk-tools_r12android-2.0_r1
1 parent 4866d77 commit 3630a05

File tree

2 files changed

+79
-195
lines changed

2 files changed

+79
-195
lines changed
 

‎eap_tls_common.c

-160
Original file line numberDiff line numberDiff line change
@@ -23,158 +23,6 @@
2323
#include "tls.h"
2424
#include "config.h"
2525

26-
#ifdef ANDROID
27-
#include <openssl/pem.h>
28-
#include <openssl/x509v3.h>
29-
#include <keystore_get.h>
30-
31-
#define PEM_CERT_KEYWORD "CERTIFICATE"
32-
#define PEM_PRIVATEKEY_KEYWORD "PRIVATE KEY"
33-
34-
struct temporal_blobs {
35-
struct temporal_blobs *next;
36-
struct wpa_config_blob *blob;
37-
};
38-
39-
static struct temporal_blobs *ks_blobs = NULL;
40-
41-
/**
42-
* The blob data can not be inserted into config->blobs structure, since the
43-
* protected cert/key may be rewritten to config file. We have to maintain the
44-
* keystore-only blobs.
45-
*/
46-
static int add_temporal_blob(struct wpa_config_blob *blob)
47-
{
48-
struct temporal_blobs *p;
49-
50-
p = (struct temporal_blobs*) malloc(sizeof(struct temporal_blobs));
51-
if (p == NULL) {
52-
return -1;
53-
}
54-
p->next = ks_blobs;
55-
p->blob = blob;
56-
ks_blobs = p;
57-
return 0;
58-
}
59-
60-
static void free_temporal_blobs()
61-
{
62-
struct temporal_blobs *p = ks_blobs;
63-
64-
while (p != NULL) {
65-
struct temporal_blobs *q = p;
66-
p = p->next;
67-
if (q->blob) os_free(q->blob);
68-
os_free(q);
69-
}
70-
ks_blobs = NULL;
71-
}
72-
73-
typedef enum {
74-
PEM_CERTIFICATE,
75-
PEM_PRIVATE_KEY,
76-
DER_FORMAT,
77-
UNKNOWN_CERT_TYPE
78-
} CERT_TYPE;
79-
80-
/**
81-
* Tell the encoding format and type of the certificate/key by examining if
82-
* there is "CERTIFICATE" or "PRIVATE KEY" in the blob. If not, at least we
83-
* can test if the first byte is '0'.
84-
*/
85-
static CERT_TYPE get_blob_type(struct wpa_config_blob *blob)
86-
{
87-
CERT_TYPE type = UNKNOWN_CERT_TYPE;
88-
unsigned char p = blob->data[blob->len - 1];
89-
90-
blob->data[blob->len - 1] = 0;
91-
if (strstr(blob->data, PEM_CERT_KEYWORD) != NULL) {
92-
type = PEM_CERTIFICATE;
93-
} else if (strstr(blob->data, PEM_PRIVATEKEY_KEYWORD) != NULL) {
94-
type = PEM_PRIVATE_KEY;
95-
} else if (blob->data[0] == '0') {
96-
type = DER_FORMAT;
97-
}
98-
blob->data[blob->len - 1] = p;
99-
return type;
100-
}
101-
102-
/**
103-
* convert_PEM_to_DER() provides the converion from PEM format to DER one, since
104-
* original certificate handling does not accept the PEM format for blob data.
105-
* Therefore, we need to convert the data to DER format if it is PEM-format.
106-
*/
107-
static void convert_PEM_to_DER(struct wpa_config_blob *blob)
108-
{
109-
X509 *cert = NULL;
110-
EVP_PKEY *pkey = NULL;
111-
BIO *bp = NULL;
112-
unsigned char *buf = NULL;
113-
int len = 0;
114-
CERT_TYPE type;
115-
116-
if (blob->len < sizeof(PEM_CERT_KEYWORD)) {
117-
return;
118-
}
119-
120-
if (((type = get_blob_type(blob)) != PEM_CERTIFICATE) &&
121-
(type != PEM_PRIVATE_KEY)) {
122-
return;
123-
}
124-
125-
bp = BIO_new(BIO_s_mem());
126-
if (!bp) goto err;
127-
if (!BIO_write(bp, blob->data, blob->len)) goto err;
128-
if (type == PEM_CERTIFICATE) {
129-
if ((cert = PEM_read_bio_X509(bp, NULL, NULL, NULL)) != NULL) {
130-
len = i2d_X509(cert, &buf);
131-
}
132-
} else {
133-
if ((pkey = PEM_read_bio_PrivateKey(bp, NULL, NULL, NULL)) != NULL) {
134-
len = i2d_PrivateKey(pkey, &buf);
135-
}
136-
}
137-
138-
err:
139-
if (bp) BIO_free(bp);
140-
if (cert) X509_free(cert);
141-
if (pkey) EVP_PKEY_free(pkey);
142-
if (buf) {
143-
os_free(blob->data);
144-
blob->data = buf;
145-
blob->len = len;
146-
}
147-
}
148-
149-
struct wpa_config_blob *get_blob_from_keystore(const char *name)
150-
{
151-
char buf[KEYSTORE_MESSAGE_SIZE];
152-
int len = keystore_get(name, buf);
153-
struct wpa_config_blob *blob = NULL;
154-
155-
if (len != -1) {
156-
if ((blob = os_zalloc(sizeof(*blob))) != NULL &&
157-
(blob->data = os_zalloc(len + 1)) != NULL) {
158-
blob->name = os_strdup(name);
159-
memcpy(blob->data, buf, len);
160-
blob->len = len;
161-
} else if (blob) {
162-
os_free(blob);
163-
blob = NULL;
164-
}
165-
}
166-
if (blob) {
167-
// We have to use PEM format here and modify the ca_cert
168-
// handling to support cert. chain for CA certificates.
169-
// Since the original code can not support the CA chain
170-
// from blob data.
171-
if (strstr(name, "CACERT") == NULL) convert_PEM_to_DER(blob);
172-
add_temporal_blob(blob);
173-
}
174-
return blob;
175-
}
176-
#endif
177-
17826
static int eap_tls_check_blob(struct eap_sm *sm, const char **name,
17927
const u8 **data, size_t *data_len)
18028
{
@@ -184,11 +32,6 @@ static int eap_tls_check_blob(struct eap_sm *sm, const char **name,
18432
return 0;
18533

18634
blob = eap_get_config_blob(sm, *name + 7);
187-
#ifdef ANDROID
188-
if(blob == NULL) {
189-
blob = get_blob_from_keystore(*name + 7);
190-
}
191-
#endif
19235
if (blob == NULL) {
19336
wpa_printf(MSG_ERROR, "%s: Named configuration blob '%s' not "
19437
"found", __func__, *name + 7);
@@ -352,9 +195,6 @@ int eap_tls_ssl_init(struct eap_sm *sm, struct eap_ssl_data *data,
352195
ret = 0;
353196

354197
done:
355-
#ifdef ANDROID
356-
free_temporal_blobs();
357-
#endif
358198
return ret;
359199
}
360200

‎tls_openssl.c

+79-35
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,22 @@
3737
#define OPENSSL_d2i_TYPE unsigned char **
3838
#endif
3939

40+
#ifdef ANDROID
41+
#include <openssl/pem.h>
42+
#include "keystore_get.h"
43+
44+
static BIO *BIO_from_keystore(const char *key)
45+
{
46+
BIO *bio = NULL;
47+
char value[KEYSTORE_MESSAGE_SIZE];
48+
int length = keystore_get(key, value);
49+
if (length != -1 && (bio = BIO_new(BIO_s_mem())) != NULL) {
50+
BIO_write(bio, value, length);
51+
}
52+
return bio;
53+
}
54+
#endif
55+
4056
static int tls_openssl_ref_count = 0;
4157

4258
struct tls_connection {
@@ -1092,35 +1108,6 @@ static int tls_load_ca_der(void *_ssl_ctx, const char *ca_cert)
10921108
}
10931109
#endif /* OPENSSL_NO_STDIO */
10941110

1095-
#ifdef ANDROID
1096-
static int add_cert_chain_from_blob(X509_STORE *store, char *value, int size)
1097-
{
1098-
int i, ret = -1;
1099-
BIO *bio = NULL;
1100-
STACK_OF(X509_INFO) *stack = NULL;
1101-
1102-
bio = BIO_new(BIO_s_mem());
1103-
if (bio == NULL) goto end;
1104-
BIO_write(bio, value, size);
1105-
stack = PEM_X509_INFO_read_bio(bio, NULL, NULL, NULL);
1106-
if (stack == NULL) goto end;
1107-
for (i = 0; i < sk_X509_INFO_num(stack); ++i) {
1108-
X509_INFO *info = sk_X509_INFO_value(stack, i);
1109-
if (info->x509) {
1110-
X509_STORE_add_cert(store, info->x509);
1111-
}
1112-
if (info->crl) {
1113-
X509_STORE_add_crl(store, info->crl);
1114-
}
1115-
}
1116-
sk_X509_INFO_pop_free(stack, X509_INFO_free);
1117-
ret = 0;
1118-
end:
1119-
if (bio != NULL) BIO_free(bio);
1120-
return ret;
1121-
}
1122-
#endif
1123-
11241111
static int tls_connection_ca_cert(void *_ssl_ctx, struct tls_connection *conn,
11251112
const char *ca_cert, const u8 *ca_cert_blob,
11261113
size_t ca_cert_blob_len, const char *ca_path)
@@ -1138,12 +1125,8 @@ static int tls_connection_ca_cert(void *_ssl_ctx, struct tls_connection *conn,
11381125
"certificate store", __func__);
11391126
return -1;
11401127
}
1128+
11411129
if (ca_cert_blob) {
1142-
#ifdef ANDROID
1143-
return add_cert_chain_from_blob(ssl_ctx->cert_store,
1144-
(char*)ca_cert_blob,
1145-
(int)ca_cert_blob_len);
1146-
#else
11471130
X509 *cert = d2i_X509(NULL, (OPENSSL_d2i_TYPE) &ca_cert_blob,
11481131
ca_cert_blob_len);
11491132
if (cert == NULL) {
@@ -1173,9 +1156,34 @@ static int tls_connection_ca_cert(void *_ssl_ctx, struct tls_connection *conn,
11731156
"to certificate store", __func__);
11741157
SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);
11751158
return 0;
1176-
#endif
11771159
}
11781160

1161+
#ifdef ANDROID
1162+
if (strncmp("keystore://", ca_cert, 11) == 0) {
1163+
BIO *bio = BIO_from_keystore(&ca_cert[11]);
1164+
STACK_OF(X509_INFO) *stack = NULL;
1165+
int i;
1166+
if (bio) {
1167+
stack = PEM_X509_INFO_read_bio(bio, NULL, NULL, NULL);
1168+
BIO_free(bio);
1169+
}
1170+
if (!stack) {
1171+
return -1;
1172+
}
1173+
for (i = 0; i < sk_X509_INFO_num(stack); ++i) {
1174+
X509_INFO *info = sk_X509_INFO_value(stack, i);
1175+
if (info->x509) {
1176+
X509_STORE_add_cert(ssl_ctx->cert_store, info->x509);
1177+
}
1178+
if (info->crl) {
1179+
X509_STORE_add_crl(ssl_ctx->cert_store, info->crl);
1180+
}
1181+
}
1182+
sk_X509_INFO_pop_free(stack, X509_INFO_free);
1183+
SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);
1184+
return 0;
1185+
}
1186+
#endif
11791187

11801188
#ifdef CONFIG_NATIVE_WINDOWS
11811189
if (ca_cert && tls_cryptoapi_ca_cert(ssl_ctx, conn->ssl, ca_cert) ==
@@ -1332,6 +1340,25 @@ static int tls_connection_client_cert(struct tls_connection *conn,
13321340
if (client_cert == NULL)
13331341
return -1;
13341342

1343+
#ifdef ANDROID
1344+
if (strncmp("keystore://", client_cert, 11) == 0) {
1345+
BIO *bio = BIO_from_keystore(&client_cert[11]);
1346+
X509 *x509 = NULL;
1347+
int ret = -1;
1348+
if (bio) {
1349+
x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
1350+
BIO_free(bio);
1351+
}
1352+
if (x509) {
1353+
if (SSL_use_certificate(conn->ssl, x509) == 1) {
1354+
ret = 0;
1355+
}
1356+
X509_free(x509);
1357+
}
1358+
return ret;
1359+
}
1360+
#endif
1361+
13351362
#ifndef OPENSSL_NO_STDIO
13361363
if (SSL_use_certificate_file(conn->ssl, client_cert,
13371364
SSL_FILETYPE_ASN1) == 1) {
@@ -1621,6 +1648,23 @@ static int tls_connection_private_key(void *_ssl_ctx,
16211648
break;
16221649
}
16231650

1651+
#ifdef ANDROID
1652+
if (!ok && private_key && strncmp("keystore://", private_key, 11) == 0) {
1653+
BIO *bio = BIO_from_keystore(&private_key[11]);
1654+
EVP_PKEY *pkey = NULL;
1655+
if (bio) {
1656+
pkey = PEM_read_bio_PrivateKey(bio, NULL, NULL, NULL);
1657+
BIO_free(bio);
1658+
}
1659+
if (pkey) {
1660+
if (SSL_use_PrivateKey(conn->ssl, pkey) == 1) {
1661+
ok = 1;
1662+
}
1663+
EVP_PKEY_free(pkey);
1664+
}
1665+
}
1666+
#endif
1667+
16241668
while (!ok && private_key) {
16251669
#ifndef OPENSSL_NO_STDIO
16261670
if (SSL_use_PrivateKey_file(conn->ssl, private_key,

0 commit comments

Comments
 (0)
Please sign in to comment.