Marcel Holtmann
3f3e778719
build: Add support for including fallbacks for missing defines
2019-04-03 18:34:22 +02:00
Andrew Zaborowski
fa7db4be4d
eap,eapol,crypto: Replace uses of memset with explicit_bzero
...
Replace existing uses of memset to clear secrets with explicit_bzero to
make sure it doesn't get optimized away. This has some side effects as
documented in gcc docs but is still recommended.
In eap_secret_info_free make sure we clear both strings in the case of
EAP_SECRET_REMOTE_USER_PASSWORD secrets.
2019-03-21 20:28:14 -05:00
Andrew Zaborowski
5306e37279
eap-tls,eap-peap: Memzero copies of secrets
2019-03-19 10:54:18 -05:00
Andrew Zaborowski
dbd619c231
eap-tls-common: More complete certificate validation
...
In the methods' check_settings do a more complete early check for
possible certificate / private key misconfiguration, including check
that the certificate and the private key are always present or absent
together and that they actually match each other. Do this by encrypting
and decrypting a small buffer because we have no better API for that.
2019-02-08 13:59:32 -06:00
Andrew Zaborowski
8f9408efc7
eap-tls-common: Call the new l_tls_start
2018-12-19 10:05:35 -06:00
Tim Kourt
9d9f8331fa
eap-tls-common: Increase log level for the common warning
2018-12-17 14:07:07 -06:00
Tim Kourt
a98089ed65
eap-tls-common: Add missing data
2018-12-17 14:06:59 -06:00
Andrew Zaborowski
961e6d1480
eap-tls: Replace l_pem_load_certificate() with newer functions
...
Stop using l_pem_load_certificate which has been removed from ell, use
the same functions to load certificate files to validate them as those
used by the TLS implementation itself.
2018-12-17 11:18:42 -06:00
Tim Kourt
fb656ff87a
eap-tls-common: Make databuf private
2018-12-11 17:09:51 -06:00
Andrew Zaborowski
529ae6e683
eap-tls: Check AP identity in tls ready callbck
...
Check that the TLS logic has verified the server is trusted by the CA if
one was configured. This is more of an assert as ell intentionally only
allows empty certificate chains from the peer in server mode (if a CA
certficate is set) although this could be made configurable.
2018-12-10 12:04:56 -06:00
Tim Kourt
84eda62823
eap-tls-common: ACK first fragment with missing M bit
2018-12-05 22:55:02 -06:00
Tim Kourt
4b9970bd99
eap-tls-common: Add comment
2018-12-05 22:26:29 -06:00
Denis Kenzior
94b7a69146
eap-tls-common: Fix typo
2018-12-05 11:55:00 -06:00
Tim Kourt
645b72be06
eap-tls-common: Validate successful loading of keys/certs
2018-12-05 11:33:47 -06:00
Tim Kourt
f1f826ee81
eap-tls-common: Handle packet payload
2018-12-05 11:33:06 -06:00
Tim Kourt
f07119b33a
eap-tls-common: Add tunnel API for send, close
2018-12-04 10:25:24 -06:00
Tim Kourt
6490ecd615
eap-tls-common: Add accessors for variant data and ver
2018-12-04 10:23:49 -06:00
Tim Kourt
663cf9931e
eap-tls-common: Expose PRF
2018-12-04 10:22:00 -06:00
Tim Kourt
8dc9276800
eap-tls-common: Make send empty response func. public
2018-12-04 10:21:28 -06:00
Tim Kourt
779f668ab9
eap-tls-common: Introduce variant data and reset API
2018-12-04 10:19:55 -06:00
Tim Kourt
bb98101bd4
eap-tls-common: Handle response retransmission
2018-12-04 10:19:20 -06:00
Tim Kourt
9df7785fee
eap-tls-common: Add phase 2 failure flag
...
This flag is used by the extensions to signal the failure
during phase 2 execution.
2018-12-04 10:18:53 -06:00
Tim Kourt
c1f791afc4
eap-tls-common: Handle common tunnel ready cb
2018-12-04 10:18:11 -06:00
Tim Kourt
c2d3a84e3a
eap-tls-common: Add method completion flag
...
This flag prevents methods from restarting
2018-12-04 10:16:36 -06:00
Tim Kourt
c35c91ad20
eap-tls-common: Add support for fragmented response
2018-12-04 10:14:39 -06:00
Tim Kourt
718f967d17
eap-tls-common: Add basic send response
2018-12-04 10:13:24 -06:00
Tim Kourt
802891fcc3
eap-tls-common: Add tunneled data handling
2018-12-04 10:04:07 -06:00
Tim Kourt
edfc070d96
eap-tls-common: Add tls tunnel
2018-12-04 10:03:07 -06:00
Tim Kourt
c865eaa141
eap-tls-common: Add support for the fragmented requests
2018-12-03 14:31:16 -06:00
Tim Kourt
36e2252606
eap-tls-common: Add basic request handling
...
This also introduces the version negotiation
2018-12-03 14:31:16 -06:00
Tim Kourt
7aa35bf6c7
eap-tls-common: Introduce eap_tls_variant_ops
...
eap_tls_variant_ops will allow methods such as TTLS, PEAP,
etc. to specify their own handlers for the Phase 2 operations.
2018-12-03 14:31:16 -06:00
Denis Kenzior
e609981b61
eap-tls-common: Update to private key API changes
2018-11-21 11:28:34 -06:00
Tim Kourt
87c411f816
eap-tls-common: Introduce a common tls state and load settings
2018-11-19 17:10:53 -06:00
Tim Kourt
514d442db1
eap-tls-common: Add check for phase one settings
2018-11-19 17:10:53 -06:00
Tim Kourt
410ee2f6b9
eap-tls-common: introduce utility functions for eap-tls
2018-09-21 12:15:25 -05:00
