/* ****************************************************************************** * INTERPEAK CONFIGURATION SOURCE FILE * * Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipeap_config.c,v $ $Revision: 1.19 $ * $Source: /home/interpeak/CVSRoot/ipeap/config/ipeap_config.c,v $ * $Author: myakan $ * $State: Exp $ $Locker: $ * * Copyright 2000-2007 Interpeak AB (http://www.interpeak.se). All rights reserved. * Design and implementation by Roger Boden ****************************************************************************** */ /* modification history -------------------- 01i,08jul10,hfc Add secure keyDB support 01h,14may10,hfc EAP configuration consolidation 01g,24dec08,mry Adding EAP-WSC 01f,02apr08,dwb Adding EAP-AKA 01e,28feb08,mry Adding LEAP support 01d,21feb08,mry Adding PEAPv1, GTC support 01c,03jan07,kch Updated CVS revision log entry for Jan 03 code drop. 01b,12dec06,kch Added EAP_INSTALL_CALLBACK_HOOK parameter. 01a,19oct06,kch Integrated to VxWorks build infrastructure. */ /* **************************************************************************** * 1 DESCRIPTION **************************************************************************** */ /* **************************************************************************** * 2 INCLUDE FILES **************************************************************************** */ #ifdef IPCOM_USE_CLIB_PROTO #undef IPCOM_USE_CLIB_PROTO #endif #include "ipeap_config.h" #include #include #include #include #ifdef IPEAP_TLS_COMMON #include #include #include #endif /* IPEAP_TLS_COMMON */ #include "ipeap.h" /* **************************************************************************** * 3 DEFINES **************************************************************************** */ #ifdef IPEAP_USE_DEFAULT_KEY_AND_CERT #define IPEAP_DEFAULT_CERT \ "-----BEGIN CERTIFICATE-----\n" \ "MIIDBzCCAnCgAwIBAgIBCzANBgkqhkiG9w0BAQQFADBxMQswCQYDVQQGEwJTRTES\n" \ "MBAGA1UECBMJU3RvY2tob2xtMRIwEAYDVQQHEwlTdG9ja2hvbG0xEjAQBgNVBAoT\n" \ "CUludGVycGVhazEUMBIGA1UECxMLRGV2ZWxvcG1lbnQxEDAOBgNVBAMTB1Rlc3Qg\n" \ "Q0EwHhcNMDMwOTIyMTEzMzQzWhcNMDgwOTIwMTEzMzQzWjBUMQswCQYDVQQGEwJT\n" \ "RTESMBAGA1UECBMJU3RvY2tob2xtMRIwEAYDVQQKEwlJbnRlcnBlYWsxHTAbBgNV\n" \ "BAMTFGlwd2Vicy5pbnRlcnBlYWsuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB\n" \ "iQKBgQDcRErz2s+oJD1/FqeYXQc/FODeZk/LtrR6RkpwsYnTP+Wgi+TuqlWsIH93\n" \ "bodh6g4bowTEz+Mi7rN5GSXVCMD21ty/edYg8QB6hyfyLqwAhdofippryrPUidnX\n" \ "aDKZwzRCsojKYPxq1OgHNeAKUVprihDxXfRmwaTZMad15xC5LQIDAQABo4HLMIHI\n" \ "MAkGA1UdEwQCMAAwHQYDVR0OBBYEFOghcvw/2RAQaWyf+koKyRT00Ph0MIGbBgNV\n" \ "HSMEgZMwgZCAFKz+iHi8ujH8Efr9gk121K5RXgB5oXWkczBxMQswCQYDVQQGEwJT\n" \ "RTESMBAGA1UECBMJU3RvY2tob2xtMRIwEAYDVQQHEwlTdG9ja2hvbG0xEjAQBgNV\n" \ "BAoTCUludGVycGVhazEUMBIGA1UECxMLRGV2ZWxvcG1lbnQxEDAOBgNVBAMTB1Rl\n" \ "c3QgQ0GCAQAwDQYJKoZIhvcNAQEEBQADgYEA0UCtTFM5ZBMyB9BRtyYtxalEL/Bw\n" \ "ATPRaqAyCou1w2BZaz0HixE6mpyOsDMgK376N7X0O2FEr5MYbZcWgrlKJGeXPghT\n" \ "QIrPM7ImesJyyu+9Qv41lVYOVAbpTBEjnIUm2QvSVjb5r++F3dWwH9S/bhM5Mn/s\n" \ "3iGgfUthSvury/k=\n" \ "-----END CERTIFICATE-----\n" #define IPEAP_DEFAULT_KEY \ "-----BEGIN RSA PRIVATE KEY-----\n" \ "MIICXAIBAAKBgQDcRErz2s+oJD1/FqeYXQc/FODeZk/LtrR6RkpwsYnTP+Wgi+Tu\n" \ "qlWsIH93bodh6g4bowTEz+Mi7rN5GSXVCMD21ty/edYg8QB6hyfyLqwAhdofippr\n" \ "yrPUidnXaDKZwzRCsojKYPxq1OgHNeAKUVprihDxXfRmwaTZMad15xC5LQIDAQAB\n" \ "AoGBAKfRsHmSoNwuoFwP2qkPV9IMCjfoI6vGDEONAnJSEfxNlpp3e3kLdjKqn/NS\n" \ "1vsW5KDR13RMH3Yh/8OoEVb6UGlWd4QSCfyrGwvtV3nNX49YrEOl0mhs8ZL3gVuv\n" \ "pbxLfCwMHvSTxZdQJBSW/V+rOtKMWxmIrX7la8sgtcYyysCBAkEA+mxyo2o397HG\n" \ "temGtL92jAx+uqHF6J4wlZEqyzW5lFhsr48EYnP0O5FgSTHv/e3hD2NiRuux2tfS\n" \ "NBCpOWJ+1QJBAOEr7zDKDEMoZgyogvQVHtIkmbn57a9Bd11S2a82RxCbcY/+OFUQ\n" \ "s67f+Bl60clPot4HvjKfQducPHj6/HV77PkCQFC9anC5rHXWAaVhN6dLG+Onm6x8\n" \ "wBxx9GQku9Fs7vqfT9uClv1POW2DP7IZwbDzY17cwjDviRZwAzv6KzVvRkkCQDoG\n" \ "8XAYUYqpCYtvjbfLDZNIHVmg/9CvRUyGglS13yB3fo+GCwxY7oU9cJlYXmHLpQQk\n" \ "6K3w/q7Sl37x50d7dTkCQCg7yi3+zGDwQClISKus8Sa6phul8TwiJNULQAPrPiBR\n" \ "vsLcvQ/X+J8liQbsKnRvkxjWLZezwRYZXimxtKQPZ2I=\n" \ "-----END RSA PRIVATE KEY-----\n" #define IPEAP_DEFAULT_CA_CERT \ "-----BEGIN CERTIFICATE-----\n" \ "MIIDJzCCApCgAwIBAgIBADANBgkqhkiG9w0BAQQFADBxMQswCQYDVQQGEwJTRTES\n" \ "MBAGA1UECBMJU3RvY2tob2xtMRIwEAYDVQQHEwlTdG9ja2hvbG0xEjAQBgNVBAoT\n" \ "CUludGVycGVhazEUMBIGA1UECxMLRGV2ZWxvcG1lbnQxEDAOBgNVBAMTB1Rlc3Qg\n" \ "Q0EwHhcNMDAxMjEyMTIxODA3WhcNMTAxMjEwMTIxODA3WjBxMQswCQYDVQQGEwJT\n" \ "RTESMBAGA1UECBMJU3RvY2tob2xtMRIwEAYDVQQHEwlTdG9ja2hvbG0xEjAQBgNV\n" \ "BAoTCUludGVycGVhazEUMBIGA1UECxMLRGV2ZWxvcG1lbnQxEDAOBgNVBAMTB1Rl\n" \ "c3QgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANyiExOUr4XXnUbHu8hs\n" \ "xMRmjQCXcQHUMihjt5fQyec5xGFSemf6EOMGpo9lVe2xU4N6FRljS10TEnKLfe7X\n" \ "ThODCNCN1jBZv9oIWoJF4sfNNmjeNjkCs1IphKjipre5I33gtyJ8ZOCSNo6J+HKC\n" \ "VrwwqDbgVK8j5of+cr1zd+CLAgMBAAGjgc4wgcswHQYDVR0OBBYEFKz+iHi8ujH8\n" \ "Efr9gk121K5RXgB5MIGbBgNVHSMEgZMwgZCAFKz+iHi8ujH8Efr9gk121K5RXgB5\n" \ "oXWkczBxMQswCQYDVQQGEwJTRTESMBAGA1UECBMJU3RvY2tob2xtMRIwEAYDVQQH\n" \ "EwlTdG9ja2hvbG0xEjAQBgNVBAoTCUludGVycGVhazEUMBIGA1UECxMLRGV2ZWxv\n" \ "cG1lbnQxEDAOBgNVBAMTB1Rlc3QgQ0GCAQAwDAYDVR0TBAUwAwEB/zANBgkqhkiG\n" \ "9w0BAQQFAAOBgQAMwrGnbzXJl2hTKmBAOxAEIXWAVIW0MadPZLak9VrPVPufwAI1\n" \ "2mJcFlJPhOE1s9DO88bxJZighv7o0V9QdIH4aVr+qanPOmlzgRGXkbbqK8EFHhgQ\n" \ "FqCORRhrlsFdeRnswiZyPeEu3vpvFgN7Oy9Hk8gobIZ1k7Ly4b1BqrpovQ==\n" \ "-----END CERTIFICATE-----\n" #endif /* **************************************************************************** * 4 TYPES **************************************************************************** */ /* **************************************************************************** * 5 EXTERN PROTOTYPES **************************************************************************** */ #ifdef IPEAP_USE_EAP_WSC IP_EXTERN Ipeap_vendor_id ipeap_wsc_vendor_id; #endif /* **************************************************************************** * 6 LOCAL PROTOTYPES **************************************************************************** */ IP_PUBLIC Ip_err ipeap_configure(void); /* **************************************************************************** * 7 DATA **************************************************************************** */ IP_CONST Ipcom_sysvar ipeap_conf_sysvar[] = { #ifdef IPEAP_USE_PRIVACY IP_SYSVAR("ipeap.privacy","1","1"), IP_SYSVAR("ipeap.privacy.retrieve.keydbid","0",ENABLE_ADVANCE_EAP_PRIVACY), #endif IP_SYSVAR("ipeap.identity", "user", EAP_IDENTITY), #ifdef IPEAP_USE_EAP_MD5 IP_SYSVAR("ipeap.md5", "0", EAP_MD5), IP_SYSVAR("ipeap.md5.secret", "this_should_be_secret", EAP_MD5_SECRET), #endif #ifdef IPEAP_USE_EAP_GTC IP_SYSVAR("ipeap.gtc", "0", EAP_GTC), #endif #ifdef IPEAP_USE_EAP_LEAP IP_SYSVAR("ipeap.leap", "0", EAP_LEAP), IP_SYSVAR("ipeap.leap.user", "user", EAP_LEAP_USER_ID), IP_SYSVAR("ipeap.leap.pw", "u$3A$tR0nGp@$$w0Rd", EAP_LEAP_PASSWD), #endif #ifdef IPEAP_USE_EAP_MSCHAPV2 IP_SYSVAR("ipeap.mschapv2", "0" , EAP_MSCHAPV2), IP_SYSVAR("ipeap.mschapv2.user", "user", EAP_MSCHAPV2_USER_ID ), IP_SYSVAR("ipeap.mschapv2.pw", "ch@ng3_Me", EAP_MSCHAPV2_PASSWD ), #endif #ifdef IPEAP_TLS_COMMON IP_SYSVAR("ipeap.tls.key_file", "default", EAP_TLS_KEY_FILE ), IP_SYSVAR("ipeap.tls.cert_file", "default", EAP_TLS_CERT_FILE ), IP_SYSVAR("ipeap.tls.ca_cert_file", "default", EAP_TLS_CA_CERT_FILE ), #endif #ifdef IPEAP_USE_EAP_TLS IP_SYSVAR("ipeap.tls","0", EAP_TLS), #endif #ifdef IPEAP_USE_EAP_TTLS IP_SYSVAR("ipeap.ttls", "0", EAP_TTLS), IP_SYSVAR("ipeap.ttls.phase2", "mschapv2", EAP_TTLS_PHASE2 ), /* mschapv2 | pap */ IP_SYSVAR("ipeap.ttls.user", "user", EAP_TTLS_USER_ID ), IP_SYSVAR("ipeap.ttls.pw", "Ch@ng3_Me", EAP_TTLS_PASSWD ), #endif #ifdef IPEAP_USE_EAP_PEAP IP_SYSVAR("ipeap.peap", "0", EAP_PEAP), IP_SYSVAR("ipeap.peap.min_version", "0", EAP_PEAP_MINVER), IP_SYSVAR("ipeap.peap.max_version", "1", EAP_PEAP_MAXVER), IP_SYSVAR("ipeap.peap.v1.prf_label", "client EAP encryption", EAP_PEAP_V1_PRF_LABEL), #endif #ifdef IPEAP_USE_EAP_SIM IP_SYSVAR("ipeap.sim", "0", EAP_SIM), #endif #ifdef IPEAP_SIM_ENABLE_TEST IP_SYSVAR("ipeap.sim.test","0", EAP_SIM_TEST), #endif #ifdef IPEAP_USE_EAP_AKA IP_SYSVAR("ipeap.aka", "0", EAP_AKA), #endif #ifdef IPEAP_AKA_ENABLE_TEST IP_SYSVAR("ipeap.aka.test", "0", EAP_AKA_TEST), #endif #ifdef IPEAP_USE_EAP_WSC IP_SYSVAR("ipeap.wsc", "0", EAP_WSC), #endif { IP_NULL, IP_NULL } }; #ifdef IPEAP_USE_DEFAULT_KEY_AND_CERT /* *=========================================================================== * ipeap_tmpfile *=========================================================================== * Description: * Parameters: * Returns: * */ IP_STATIC Ip_err ipeap_tmpfile(const char *file, const char *data) { int len = ipcom_strlen(data); int fd; if ((fd = ipcom_fileopen(file, IP_O_RDWR | IP_O_CREAT, IP_S_IRUSR | IP_S_IWUSR)) < 0) return IPCOM_ERR_FAILED; if(ipcom_filewrite(fd, data, len) != len) { (void)ipcom_fileclose(fd); (void)ipcom_unlink(file); return IPCOM_ERR_FAILED; } (void)ipcom_fileclose(fd); return IPCOM_SUCCESS; } #endif /* IPEAP_USE_DEFAULT_KEY_AND_CERT */ #ifdef IPEAP_TLS_COMMON /**************************************************************************** * * ipeap_tls_cert_verify_example - TLS cert verification example routine * * This is an example implementation of the callback routine to verify * the peer TLS certification. To use this example routine, assign it to * the macro EAP_TLS_CERT_VERIFY_CALLBACK_HOOK. * * NOMANUAL */ IP_INLINE int ipeap_tls_cert_verify_example(int ok, X509_STORE_CTX *ctx) { (void) ctx; return ok; } /**************************************************************************** * * ipeap_load_tls_key_example - TLS key load example routine * * This is an example implementation of the callback routine loads the key * pair to use in SSL/TLS handshakes. To use this example routine, assign * it to the macro EAP_LOAD_TLS_KEY_CALLBACK_HOOK. * * NOMANUAL */ IP_INLINE EVP_PKEY * ipeap_load_tls_key_example (void) { BIO* bio; EVP_PKEY* ret = IP_NULL; char* file; #ifdef IPEAP_USE_PRIVACY char* tls_key_id = IP_NULL; #endif #ifdef IPEAP_USE_DEFAULT_KEY_AND_CERT char tmp_file[32]; #endif char* pfile; #ifdef IPCOM_USE_KEY_DB #ifdef IPEAP_USE_PRIVACY if(ipcom_sysvar_get_as_int("ipeap.privacy", 0)==1 && ipcom_sysvar_get_as_int("ipeap.tls", 0)==1) { if(ipcom_sysvar_get_as_int("ipeap.privacy.retrieve.keydbid", 0)==1) { tls_key_id = ipcom_sysvar_get("ipeap.tls.key_file", IP_NULL, IP_NULL); } if((ret=ipcom_key_db_pkey_get(tls_key_id ? tls_key_id : TLS_KEY_ID))==IP_NULL) { ipcom_printf("ipeap_load_tls_key_example : failed to retrieve " "private key file from secure key db using key id %s \n", tls_key_id? tls_key_id : TLS_KEY_ID); } if(tls_key_id) ipcom_free(tls_key_id); return ret; }else #endif #endif /*IPCOM_USE_KEY_DB*/ file = ipcom_sysvar_get("ipeap.tls.key_file", IP_NULL, 0); if(!file) { ipcom_printf("ipeap_load_tls_key : failed to get " "ipeap.tls.key_file sysvar"); return IP_NULL; } #ifdef IPEAP_USE_DEFAULT_KEY_AND_CERT if(strcmp(file, "default") == 0) { /* Make the file path absolute */ ipcom_snprintf(tmp_file, sizeof(tmp_file), "%stmp_%s", IPCOM_FILE_ROOT, file); (void)ipeap_tmpfile(tmp_file, IPEAP_DEFAULT_KEY); pfile = tmp_file; } else #endif pfile = file; bio = BIO_new(BIO_s_file()); if(!bio) goto cleanup; if(!BIO_read_filename(bio, pfile) ) goto cleanup; ret = PEM_read_bio_PrivateKey(bio, IP_NULL, IP_NULL, IP_NULL); cleanup: if(file) { #ifdef IPEAP_USE_DEFAULT_KEY_AND_CERT if(strcmp(file, "default") == 0) (void)ipcom_unlink(tmp_file); /*lint !e645*/ #endif ipcom_free(file); } if(bio) (void)BIO_free(bio); return ret; } /**************************************************************************** * * ipeap_load_tls_cert_example - X509 certificate load example routine * * This is an example implementation of the callback routine to loads the * X509 certificate to use in SSL/TLS handshakes. To use this example * routine, assign it to the macro EAP_LOAD_TLS_CERT_CALLBACK_HOOK. * * NOMANUAL */ IP_INLINE X509 * ipeap_load_tls_cert_example (void) { BIO* bio; X509* ret = IP_NULL; char* file; #ifdef IPEAP_USE_DEFAULT_KEY_AND_CERT char tmp_file[32]; #endif char* pfile; file = ipcom_sysvar_get("ipeap.tls.cert_file", IP_NULL, 0); if(!file) { ipcom_printf("ipeap_load_tls_cert: " "failed to get ipeap.tls.cert_file sysvar\n"); return IP_NULL; } #ifdef IPEAP_USE_DEFAULT_KEY_AND_CERT if(strcmp(file, "default") == 0) { /* Make the file path absolute */ ipcom_snprintf(tmp_file, sizeof(tmp_file), "%stmp_%s", IPCOM_FILE_ROOT, file); (void)ipeap_tmpfile(tmp_file, IPEAP_DEFAULT_CERT); pfile = tmp_file; } else #endif pfile = file; bio = BIO_new(BIO_s_file()); if(!bio) goto cleanup; if(!BIO_read_filename(bio, pfile) ) goto cleanup; ret = PEM_read_bio_X509(bio, IP_NULL, IP_NULL, IP_NULL); cleanup: if(file) { #ifdef IPEAP_USE_DEFAULT_KEY_AND_CERT if(strcmp(file, "default") == 0) (void)ipcom_unlink(tmp_file); /*lint !e645*/ #endif ipcom_free(file); } if(bio) (void)BIO_free(bio); return ret; } /**************************************************************************** * * ipeap_load_ca_certs_example - X509 CA certificates example routine * * This is an example implementation of the callback routine to loads the * X509 CA certificates to use in SSL/TLS handshakes. To use this example * routine, assign it to the macro EAP_LOAD_CA_CERT_CALLBACK_HOOK. * * NOMANUAL */ IP_INLINE Ip_err ipeap_load_ca_certs_example(X509_STORE *cert_store) { BIO* bio = IP_NULL; X509* ca_cert; Ip_err rc = IPCOM_ERR_FAILED; char* file; char* pfile; #ifdef IPEAP_USE_DEFAULT_KEY_AND_CERT char tmp_file[32]; #endif file = ipcom_sysvar_get("ipeap.tls.ca_cert_file", IP_NULL, 0); if(!file) { ipcom_printf("ipeap_load_tls_ca_certs: " "failed to get ipeap.tls.ca_cert_file sysvar\n"); return IPCOM_ERR_FAILED; } #ifdef IPEAP_USE_DEFAULT_KEY_AND_CERT if(strcmp(file, "default") == 0) { /* Make the file path absolute */ ipcom_snprintf(tmp_file, sizeof(tmp_file), "%stmp_%s", IPCOM_FILE_ROOT, file); (void)ipeap_tmpfile(tmp_file, IPEAP_DEFAULT_CA_CERT); pfile = tmp_file; } else #endif pfile = file; bio = BIO_new(BIO_s_file()); if(!bio) goto cleanup; if(!BIO_read_filename(bio, pfile)) goto cleanup; while(IP_NULL != (ca_cert = PEM_read_bio_X509(bio, IP_NULL, IP_NULL, IP_NULL))) { int ret; ret = X509_STORE_add_cert(cert_store, ca_cert); X509_free(ca_cert); if(!ret) goto cleanup; } rc = IPCOM_SUCCESS; cleanup: if(file) { #ifdef IPEAP_USE_DEFAULT_KEY_AND_CERT if(strcmp(file, "default") == 0) (void)ipcom_unlink(tmp_file); /*lint !e645*/ #endif ipcom_free(file); } if(bio) (void)BIO_free(bio); return rc; } #endif /* INCLUDE_IPEAP_TLS_COMMON */ /* **************************************************************************** * 9 GLOBAL FUNCTIONS **************************************************************************** */ /* **************************************************************************** * 10 PUBLIC FUNCTIONS **************************************************************************** */ /* *=========================================================================== * ipeap_configure *=========================================================================== * Description: * Parameters: * Returns: * */ IP_PUBLIC Ip_err ipeap_configure(void) { (void)ipcom_sysvar_setv(ipeap_conf_sysvar, 0); ipcom_openlog(IP_NULL, 0, IPCOM_LOG_IPEAP); (void)ipcom_setlogmask_on(IPEAP_LOG_LEVEL, IPCOM_LOG_IPEAP); #ifdef IPEAP_USE_EAP_TLS (void)ipeap_mech_type_register(IPEAP_TYPE_TLS, ipeap_tls_suppl_methods_get()); #endif #ifdef IPEAP_USE_EAP_TTLS (void)ipeap_mech_type_register(IPEAP_TYPE_TTLS, ipeap_ttls_suppl_methods_get()); #endif #ifdef IPEAP_USE_EAP_PEAP (void)ipeap_mech_type_register(IPEAP_TYPE_PEAP, ipeap_peap_suppl_methods_get()); #endif #ifdef IPEAP_USE_EAP_SIM (void)ipeap_mech_type_register(IPEAP_TYPE_SIM, ipeap_sim_methods_get()); #endif #ifdef IPEAP_USE_EAP_AKA (void)ipeap_mech_type_register(IPEAP_TYPE_AKA, ipeap_aka_methods_get()); #endif #ifdef IPEAP_USE_EAP_MD5 (void)ipeap_mech_type_register(IPEAP_TYPE_MD5_CHALLENGE, ipeap_md5_methods_get()); #endif #ifdef IPEAP_USE_EAP_MSCHAPV2 (void)ipeap_mech_type_register(IPEAP_TYPE_MSCHAPV2, ipeap_mschapv2_suppl_methods_get()); #endif #ifdef IPEAP_USE_EAP_GTC (void)ipeap_mech_type_register(IPEAP_TYPE_GTC, ipeap_gtc_methods_get()); #endif #ifdef IPEAP_USE_EAP_LEAP (void)ipeap_mech_type_register(IPEAP_TYPE_LEAP, ipeap_leap_methods_get()); #endif #ifdef IPEAP_USE_EAP_WSC (void)ipeap_mech_type_register_expanded(ipeap_wsc_vendor_id, IPEAP_VT_WSC_SIMPLE_CONFIG, ipeap_wsc_methods_get()); #endif return IPCOM_SUCCESS; } #ifdef IPEAP_TLS_COMMON #if EAP_INSTALL_CALLBACK_HOOK == IP_TRUE /* * forward declarations for the user-defined eap callback hooks to satisfy * the compiler. */ int EAP_TLS_CERT_VERIFY_CALLBACK_HOOK (int, X509_STORE_CTX *); EVP_PKEY * EAP_LOAD_TLS_KEY_CALLBACK_HOOK (void); X509 * EAP_LOAD_TLS_CERT_CALLBACK_HOOK (void); Ip_err EAP_LOAD_CA_CERT_CALLBACK_HOOK (X509_STORE *); #else /* * EAP_TLS_CERT_VERIFY_CALLBACK_HOOK, EAP_LOAD_TLS_KEY_CALLBACK_HOOK, * EAP_LOAD_TLS_CERT_CALLBACK_HOOK and EAP_LOAD_CA_CERT_CALLBACK_HOOK * are applicable only if EAP_INSTALL_CALLBACK_HOOK is set to TRUE. * Explicitly re-define these hooks to NULL so that we don't get compiler * errors */ #undef EAP_TLS_CERT_VERIFY_CALLBACK_HOOK #define EAP_TLS_CERT_VERIFY_CALLBACK_HOOK IP_NULL #undef EAP_LOAD_TLS_KEY_CALLBACK_HOOK #define EAP_LOAD_TLS_KEY_CALLBACK_HOOK IP_NULL #undef EAP_LOAD_TLS_CERT_CALLBACK_HOOK #define EAP_LOAD_TLS_CERT_CALLBACK_HOOK IP_NULL #undef EAP_LOAD_CA_CERT_CALLBACK_HOOK #define EAP_LOAD_CA_CERT_CALLBACK_HOOK IP_NULL #endif /* EAP_INSTALL_CALLBACK_HOOK */ /* typedef to make compiler happy... */ typedef int (*ipeap_tls_cert_cb)(int ok, X509_STORE_CTX *ctx); typedef EVP_PKEY * (*ipeap_load_tls_cb)(void); typedef X509 * (*ipeap_load_tls_cert_cb)(void); typedef Ip_err (*ipeap_load_ca_cert_cb)(X509_STORE *cert_store); /**************************************************************************** * ipeap_tls_cert_verify - Verify peer TLS certification * * This function is called once for each certificate in the certificate * chain of the TLS peer. Additional certificate and policy checks can * be implemented in this function. * * .IP * This parameter shows the result of the internal certificate verification * of the SSL library. * .IP * Pointer to the certificate store * .LP * * RETURNS: * \is * \i 1 if the certicate is accepted * \i 0 if the certicate is rejected * \ie * * NOMANUAL */ IP_PUBLIC int ipeap_tls_cert_verify(int ok, X509_STORE_CTX *ctx) { ipeap_tls_cert_cb cert_cb; cert_cb = (EAP_TLS_CERT_VERIFY_CALLBACK_HOOK == NULL) ? ipeap_tls_cert_verify_example : EAP_TLS_CERT_VERIFY_CALLBACK_HOOK; return cert_cb(ok, ctx); } /**************************************************************************** * * ipeap_load_tls_key - Loads the key pair to use in SSL/TLS handshakes * * This function loads the key pair to use in SSL/TLS handshakes. It is * called every time a new EAP-TLS session is initiated. * * RETURNS: Pointer to the key pair, or IP_NULL in case of failure. * * NOMANUAL */ IP_PUBLIC EVP_PKEY *ipeap_load_tls_key (void) { ipeap_load_tls_cb tls_cb; tls_cb = (EAP_LOAD_TLS_KEY_CALLBACK_HOOK == NULL) ? ipeap_load_tls_key_example : EAP_LOAD_TLS_KEY_CALLBACK_HOOK; return tls_cb(); } /**************************************************************************** * * ipeap_load_tls_cert - Loads the X509 certificate * * This function loads the X509 certificate to use in SSL/TLS handshakes. * It is called every time a new EAP-TLS session is initiated. * * RETURNS: Pointer to the certificate, or IP_NULL in case of failure. * * NOMANUAL */ IP_PUBLIC X509 * ipeap_load_tls_cert (void) { ipeap_load_tls_cert_cb tls_cb; tls_cb = (EAP_LOAD_TLS_CERT_CALLBACK_HOOK == NULL) ? ipeap_load_tls_cert_example : EAP_LOAD_TLS_CERT_CALLBACK_HOOK; return tls_cb(); } /**************************************************************************** * ipeap_load_ca_certs - Loads the X509 CA certificates * * This function loads the X509 CA certificates to use in SSL/TLS handshakes. * It is called every time a new EAP-TLS session is initiated. * * .IP * Expects a pointer to the certificate store where the CA certificates * shall be stored. * * RETURNS: * \is * \i IPCOM_SUCCESS if the CA certificates where successfully loaded. * \i IPCOM_ERR_FAILED if failed to load the CA certificates * \ie * * NOMANUAL */ IP_PUBLIC Ip_err ipeap_load_ca_certs(X509_STORE *cert_store) { ipeap_load_ca_cert_cb cert_cb; cert_cb = (EAP_LOAD_CA_CERT_CALLBACK_HOOK == NULL) ? ipeap_load_ca_certs_example : EAP_LOAD_CA_CERT_CALLBACK_HOOK; return cert_cb(cert_store); } #endif /* IPEAP_TLS_COMMON */