ssl_ctx->cert_store = X509_STORE_new();	if (ssl_ctx->cert_store == NULL) {		wpa_printf(MSG_DEBUG, "OpenSSL: %s - failed to allocate new "			   "certificate store", __func__);		X509_free(cert);		return -1;	}	if (!X509_STORE_add_cert(ssl_ctx->cert_store, cert)) {		unsigned long err = ERR_peek_error();		tls_show_errors(MSG_WARNING, __func__,				"Failed to add CA certificate from engine "				"to certificate store");		if (ERR_GET_LIB(err) == ERR_LIB_X509 &&		    ERR_GET_REASON(err) == X509_R_CERT_ALREADY_IN_HASH_TABLE) {			wpa_printf(MSG_DEBUG, "OpenSSL: %s - ignoring cert"				   " already in hash table error",				   __func__);		} else {			X509_free(cert);			return -1;		}	}	X509_free(cert);	wpa_printf(MSG_DEBUG, "OpenSSL: %s - added CA certificate from engine "		   "to certificate store", __func__);	SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, tls_verify_cb);	return 0;#else /* OPENSSL_NO_ENGINE */	return -1;#endif /* OPENSSL_NO_ENGINE */}static int tls_connection_engine_private_key(struct tls_connection *conn){#ifndef OPENSSL_NO_ENGINE	if (SSL_use_PrivateKey(conn->ssl, conn->private_key) != 1) {		tls_show_errors(MSG_ERROR, __func__,				"ENGINE: cannot use private key for TLS");		return -1;	}	if (!SSL_check_private_key(conn->ssl)) {		tls_show_errors(MSG_INFO, __func__,				"Private key failed verification");		return -1;	}	return 0;#else /* OPENSSL_NO_ENGINE */	wpa_printf(MSG_ERROR, "SSL: Configuration uses engine, but "		   "engine support was not compiled in");	return -1;#endif /* OPENSSL_NO_ENGINE */}static int tls_connection_private_key(void *_ssl_ctx,				      struct tls_connection *conn,				      const char *private_key,				      const char *private_key_passwd,				      const u8 *private_key_blob,				      size_t private_key_blob_len){	SSL_CTX *ssl_ctx = _ssl_ctx;	char *passwd;	int ok;	if (private_key == NULL && private_key_blob == NULL)		return 0;	if (private_key_passwd) {		passwd = os_strdup(private_key_passwd);		if (passwd == NULL)			return -1;	} else		passwd = NULL;	SSL_CTX_set_default_passwd_cb(ssl_ctx, tls_passwd_cb);	SSL_CTX_set_default_passwd_cb_userdata(ssl_ctx, passwd);	ok = 0;	while (private_key_blob) {		if (SSL_use_PrivateKey_ASN1(EVP_PKEY_RSA, conn->ssl,					    (u8 *) private_key_blob,					    private_key_blob_len) == 1) {			wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_PrivateKey_"				   "ASN1(EVP_PKEY_RSA) --> OK");			ok = 1;			break;		} else {			tls_show_errors(MSG_DEBUG, __func__,					"SSL_use_PrivateKey_ASN1(EVP_PKEY_RSA)"					" failed");		}		if (SSL_use_PrivateKey_ASN1(EVP_PKEY_DSA, conn->ssl,					    (u8 *) private_key_blob,					    private_key_blob_len) == 1) {			wpa_printf(MSG_DEBUG, "OpenSSL: SSL_use_PrivateKey_"				   "ASN1(EVP_PKEY_DSA) --> OK");			ok = 1;			break;		} else {			tls_show_errors(MSG_DEBUG, __func__,					"SSL_use_PrivateKey_ASN1(EVP_PKEY_DSA)"					" failed");		}		if (SSL_use_RSAPrivateKey_ASN1(conn->ssl,					       (u8 *) private_key_blob,					       private_key_blob_len) == 1) {			wpa_printf(MSG_DEBUG, "OpenSSL: "				   "SSL_use_RSAPrivateKey_ASN1 --> OK");			ok = 1;			break;		} else {			tls_show_errors(MSG_DEBUG, __func__,					"SSL_use_RSAPrivateKey_ASN1 failed");		}		if (tls_read_pkcs12_blob(ssl_ctx, conn->ssl, private_key_blob,					 private_key_blob_len, passwd) == 0) {			wpa_printf(MSG_DEBUG, "OpenSSL: PKCS#12 as blob --> "				   "OK");			ok = 1;			break;		}		break;	}	while (!ok && private_key) {#ifndef OPENSSL_NO_STDIO		if (SSL_use_PrivateKey_file(conn->ssl, private_key,					    SSL_FILETYPE_ASN1) == 1) {			wpa_printf(MSG_DEBUG, "OpenSSL: "				   "SSL_use_PrivateKey_File (DER) --> OK");			ok = 1;			break;		} else {			tls_show_errors(MSG_DEBUG, __func__,					"SSL_use_PrivateKey_File (DER) "					"failed");		}		if (SSL_use_PrivateKey_file(conn->ssl, private_key,					    SSL_FILETYPE_PEM) == 1) {			wpa_printf(MSG_DEBUG, "OpenSSL: "				   "SSL_use_PrivateKey_File (PEM) --> OK");			ok = 1;			break;		} else {			tls_show_errors(MSG_DEBUG, __func__,					"SSL_use_PrivateKey_File (PEM) "					"failed");		}#else /* OPENSSL_NO_STDIO */		wpa_printf(MSG_DEBUG, "OpenSSL: %s - OPENSSL_NO_STDIO",			   __func__);#endif /* OPENSSL_NO_STDIO */		if (tls_read_pkcs12(ssl_ctx, conn->ssl, private_key, passwd)		    == 0) {			wpa_printf(MSG_DEBUG, "OpenSSL: Reading PKCS#12 file "				   "--> OK");			ok = 1;			break;		}		if (tls_cryptoapi_cert(conn->ssl, private_key) == 0) {			wpa_printf(MSG_DEBUG, "OpenSSL: Using CryptoAPI to "				   "access certificate store --> OK");			ok = 1;			break;		}		break;	}	if (!ok) {		wpa_printf(MSG_INFO, "OpenSSL: Failed to load private key");		os_free(passwd);		ERR_clear_error();		return -1;	}	ERR_clear_error();	SSL_CTX_set_default_passwd_cb(ssl_ctx, NULL);	os_free(passwd);		if (!SSL_check_private_key(conn->ssl)) {		tls_show_errors(MSG_INFO, __func__, "Private key failed "				"verification");		return -1;	}	wpa_printf(MSG_DEBUG, "SSL: Private key loaded successfully");	return 0;}static int tls_global_private_key(SSL_CTX *ssl_ctx, const char *private_key,				  const char *private_key_passwd){	char *passwd;	if (private_key == NULL)		return 0;	if (private_key_passwd) {		passwd = os_strdup(private_key_passwd);		if (passwd == NULL)			return -1;	} else		passwd = NULL;	SSL_CTX_set_default_passwd_cb(ssl_ctx, tls_passwd_cb);	SSL_CTX_set_default_passwd_cb_userdata(ssl_ctx, passwd);	if (#ifndef OPENSSL_NO_STDIO	    SSL_CTX_use_PrivateKey_file(ssl_ctx, private_key,					SSL_FILETYPE_ASN1) != 1 &&	    SSL_CTX_use_PrivateKey_file(ssl_ctx, private_key,					SSL_FILETYPE_PEM) != 1 &&#endif /* OPENSSL_NO_STDIO */	    tls_read_pkcs12(ssl_ctx, NULL, private_key, passwd)) {		tls_show_errors(MSG_INFO, __func__,				"Failed to load private key");		os_free(passwd);		ERR_clear_error();		return -1;	}	os_free(passwd);	ERR_clear_error();	SSL_CTX_set_default_passwd_cb(ssl_ctx, NULL);		if (!SSL_CTX_check_private_key(ssl_ctx)) {		tls_show_errors(MSG_INFO, __func__,				"Private key failed verification");		return -1;	}	return 0;}static int tls_connection_dh(struct tls_connection *conn, const char *dh_file){#ifdef OPENSSL_NO_DH	if (dh_file == NULL)		return 0;	wpa_printf(MSG_ERROR, "TLS: openssl does not include DH support, but "		   "dh_file specified");	return -1;#else /* OPENSSL_NO_DH */	DH *dh;	BIO *bio;	/* TODO: add support for dh_blob */	if (dh_file == NULL)		return 0;	if (conn == NULL)		return -1;	bio = BIO_new_file(dh_file, "r");	if (bio == NULL) {		wpa_printf(MSG_INFO, "TLS: Failed to open DH file '%s': %s",			   dh_file, ERR_error_string(ERR_get_error(), NULL));		return -1;	}	dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);	BIO_free(bio);#ifndef OPENSSL_NO_DSA	while (dh == NULL) {		DSA *dsa;		wpa_printf(MSG_DEBUG, "TLS: Failed to parse DH file '%s': %s -"			   " trying to parse as DSA params", dh_file,			   ERR_error_string(ERR_get_error(), NULL));		bio = BIO_new_file(dh_file, "r");		if (bio == NULL)			break;		dsa = PEM_read_bio_DSAparams(bio, NULL, NULL, NULL);		BIO_free(bio);		if (!dsa) {			wpa_printf(MSG_DEBUG, "TLS: Failed to parse DSA file "				   "'%s': %s", dh_file,				   ERR_error_string(ERR_get_error(), NULL));			break;		}		wpa_printf(MSG_DEBUG, "TLS: DH file in DSA param format");		dh = DSA_dup_DH(dsa);		DSA_free(dsa);		if (dh == NULL) {			wpa_printf(MSG_INFO, "TLS: Failed to convert DSA "				   "params into DH params");			break;		}		break;	}#endif /* !OPENSSL_NO_DSA */	if (dh == NULL) {		wpa_printf(MSG_INFO, "TLS: Failed to read/parse DH/DSA file "			   "'%s'", dh_file);		return -1;	}	if (SSL_set_tmp_dh(conn->ssl, dh) != 1) {		wpa_printf(MSG_INFO, "TLS: Failed to set DH params from '%s': "			   "%s", dh_file,			   ERR_error_string(ERR_get_error(), NULL));		DH_free(dh);		return -1;	}	DH_free(dh);	return 0;#endif /* OPENSSL_NO_DH */}static int tls_global_dh(SSL_CTX *ssl_ctx, const char *dh_file){#ifdef OPENSSL_NO_DH	if (dh_file == NULL)		return 0;	wpa_printf(MSG_ERROR, "TLS: openssl does not include DH support, but "		   "dh_file specified");	return -1;#else /* OPENSSL_NO_DH */	DH *dh;	BIO *bio;	/* TODO: add support for dh_blob */	if (dh_file == NULL)		return 0;	if (ssl_ctx == NULL)		return -1;	bio = BIO_new_file(dh_file, "r");	if (bio == NULL) {		wpa_printf(MSG_INFO, "TLS: Failed to open DH file '%s': %s",			   dh_file, ERR_error_string(ERR_get_error(), NULL));		return -1;	}	dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);	BIO_free(bio);#ifndef OPENSSL_NO_DSA	while (dh == NULL) {		DSA *dsa;		wpa_printf(MSG_DEBUG, "TLS: Failed to parse DH file '%s': %s -"			   " trying to parse as DSA params", dh_file,			   ERR_error_string(ERR_get_error(), NULL));		bio = BIO_new_file(dh_file, "r");		if (bio == NULL)			break;		dsa = PEM_read_bio_DSAparams(bio, NULL, NULL, NULL);		BIO_free(bio);		if (!dsa) {			wpa_printf(MSG_DEBUG, "TLS: Failed to parse DSA file "				   "'%s': %s", dh_file,				   ERR_error_string(ERR_get_error(), NULL));			break;		}		wpa_printf(MSG_DEBUG, "TLS: DH file in DSA param format");		dh = DSA_dup_DH(dsa);		DSA_free(dsa);		if (dh == NULL) {			wpa_printf(MSG_INFO, "TLS: Failed to convert DSA "				   "params into DH params");			break;		}		break;	}#endif /* !OPENSSL_NO_DSA */	if (dh == NULL) {		wpa_printf(MSG_INFO, "TLS: Failed to read/parse DH/DSA file "			   "'%s'", dh_file);		return -1;	}	if (SSL_CTX_set_tmp_dh(ssl_ctx, dh) != 1) {		wpa_printf(MSG_INFO, "TLS: Failed to set DH params from '%s': "			   "%s", dh_file,			   ERR_error_string(ERR_get_error(), NULL));		DH_free(dh);		return -1;	}	DH_free(dh);	return 0;#endif /* OPENSSL_NO_DH */}int tls_connection_get_keys(void *ssl_ctx, struct tls_connection *conn,			    struct tls_keys *keys){	SSL *ssl;	if (conn == NULL || keys == NULL)		return -1;	ssl = conn->ssl;	if (ssl == NULL || ssl->s3 == NULL || ssl->session == NULL)		return -1;	os_memset(keys, 0, sizeof(*keys));	keys->master_key = ssl->session->master_key;	keys->master_key_len = ssl->session->master_key_length;	keys->client_random = ssl->s3->client_random;	keys->client_random_len = SSL3_RANDOM_SIZE;	keys->server_random = ssl->s3->server_random;	keys->server_random_len = SSL3_RANDOM_SIZE;	return 0;}int tls_connection_prf(void *tls_ctx, struct tls_connection *conn,		       const char *label, int server_random_first,		       u8 *out, size_t out_len){	return -1;}u8 * tls_connection_handshake(void *ssl_ctx, struct tls_connection *conn,			      const u8 *in_data, size_t in_len,			      size_t *out_len, u8 **appl_data,			      size_t *appl_data_len){	int res;	u8 *out_data;	if (appl_data)		*appl_data = NULL;	/*	 * Give TLS handshake data from the server (if available) to OpenSSL	 * for processing.	 */	if (in_data &&	    BIO_write(conn->ssl_in, in_data, in_len) < 0) {		tls_show_errors(MSG_INFO, __func__,				"Handshake failed - BIO_write");		return NULL;	}	/* Initiate TLS handshake or continue the existing handshake */	res = SSL_connect(conn->ssl);	if (res != 1) {		int err = SSL_get_error(conn->ssl, res);		if (err == SSL_ERROR_WANT_READ)			wpa_printf(MSG_DEBUG, "SSL: SSL_connect - want "				   "more data");		else if (err == SSL_ERROR_WANT_WRITE)			wpa_printf(MSG_DEBUG, "SSL: SSL_connect - want to "				   "write");		else {			tls_show_errors(MSG_INFO, __func__, "SSL_connect");			conn->failed++;		}	}	/* Get the TLS handshake data to be sent to the server */	res = BIO_ctrl_pending(conn->ssl_out);	wpa_printf(MSG_DEBUG, "SSL: %d bytes pending from ssl_out", res);	out_data = os_malloc(res == 0 ? 1 : res);	if (out_data == NULL) {		wpa_printf(MSG_DEBUG, "SSL: Failed to allocate memory for "			   "handshake output (%d bytes)", res);		if (BIO_reset(conn->ssl_out) < 0) {			tls_show_errors(MSG_INFO, __func__,					"BIO_reset failed");		}		*out_len = 0;		return NULL;	}	res = res == 0 ? 0 : BIO_read(conn->ssl_out, out_data, res);	if (res < 0) {		tls_show_errors(MSG_INFO, __func__,				"Handshake failed - BIO_read");		if (BIO_reset(conn->ssl_out) < 0) {			tls_show_errors(MSG_INFO, __func__,					"BIO_reset failed");		}		*out_len = 0;		return NULL;	}	*out_len = res;	if (SSL_is_init_finished(conn->ssl) && appl_data) {		*appl_data = os_malloc(in_len);		if (*appl_data) {			res = SSL_read(conn->ssl, *appl_data, in_len);			if (res < 0) {				tls_show_errors(MSG_INFO, __func__,						"Failed to read possible "						"Application Data");				os_free(*appl_data);				*appl_data = NULL;			} else {				*appl_data_len = res;				wpa_hexdump_key(MSG_MSGDUMP, "SSL: Application"						" Data in Finish message",						*appl_data, *appl_data_len);			}		}	}	return out_data;}u8 * tls_connection_server_handshake(void *ssl_ctx,				     struct tls_connection *conn,				     const u8 *in_data, size_t in_len,				     size_t *out_len){	int res;	u8 *out_data;	/*	 * Give TLS handshake data from the client (if available) to OpenSSL	 * for processing.	 */	if (in_data &&	    BIO_write(conn->ssl_in, in_data, in_len) < 0) {		tls_show_errors(MSG_INFO, __func__,				"Handshake failed - BIO_write");		return NULL;	}	/* Initiate TLS handshake or continue the existing handshake */	res = SSL_accept(conn->ssl);