Home | History | Annotate | Download | only in eap_common
      1 /*
      2  * EAP-FAST common helper functions (RFC 4851)
      3  * Copyright (c) 2008, Jouni Malinen <j (at) w1.fi>
      4  *
      5  * This program is free software; you can redistribute it and/or modify
      6  * it under the terms of the GNU General Public License version 2 as
      7  * published by the Free Software Foundation.
      8  *
      9  * Alternatively, this software may be distributed under the terms of BSD
     10  * license.
     11  *
     12  * See README and COPYING for more details.
     13  */
     14 
     15 #include "includes.h"
     16 
     17 #include "common.h"
     18 #include "crypto/sha1.h"
     19 #include "crypto/tls.h"
     20 #include "eap_defs.h"
     21 #include "eap_tlv_common.h"
     22 #include "eap_fast_common.h"
     23 
     24 
     25 void eap_fast_put_tlv_hdr(struct wpabuf *buf, u16 type, u16 len)
     26 {
     27 	struct pac_tlv_hdr hdr;
     28 	hdr.type = host_to_be16(type);
     29 	hdr.len = host_to_be16(len);
     30 	wpabuf_put_data(buf, &hdr, sizeof(hdr));
     31 }
     32 
     33 
     34 void eap_fast_put_tlv(struct wpabuf *buf, u16 type, const void *data,
     35 			     u16 len)
     36 {
     37 	eap_fast_put_tlv_hdr(buf, type, len);
     38 	wpabuf_put_data(buf, data, len);
     39 }
     40 
     41 
     42 void eap_fast_put_tlv_buf(struct wpabuf *buf, u16 type,
     43 				 const struct wpabuf *data)
     44 {
     45 	eap_fast_put_tlv_hdr(buf, type, wpabuf_len(data));
     46 	wpabuf_put_buf(buf, data);
     47 }
     48 
     49 
     50 struct wpabuf * eap_fast_tlv_eap_payload(struct wpabuf *buf)
     51 {
     52 	struct wpabuf *e;
     53 
     54 	if (buf == NULL)
     55 		return NULL;
     56 
     57 	/* Encapsulate EAP packet in EAP-Payload TLV */
     58 	wpa_printf(MSG_DEBUG, "EAP-FAST: Add EAP-Payload TLV");
     59 	e = wpabuf_alloc(sizeof(struct pac_tlv_hdr) + wpabuf_len(buf));
     60 	if (e == NULL) {
     61 		wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to allocate memory "
     62 			   "for TLV encapsulation");
     63 		wpabuf_free(buf);
     64 		return NULL;
     65 	}
     66 	eap_fast_put_tlv_buf(e,
     67 			     EAP_TLV_TYPE_MANDATORY | EAP_TLV_EAP_PAYLOAD_TLV,
     68 			     buf);
     69 	wpabuf_free(buf);
     70 	return e;
     71 }
     72 
     73 
     74 void eap_fast_derive_master_secret(const u8 *pac_key, const u8 *server_random,
     75 				   const u8 *client_random, u8 *master_secret)
     76 {
     77 #define TLS_RANDOM_LEN 32
     78 #define TLS_MASTER_SECRET_LEN 48
     79 	u8 seed[2 * TLS_RANDOM_LEN];
     80 
     81 	wpa_hexdump(MSG_DEBUG, "EAP-FAST: client_random",
     82 		    client_random, TLS_RANDOM_LEN);
     83 	wpa_hexdump(MSG_DEBUG, "EAP-FAST: server_random",
     84 		    server_random, TLS_RANDOM_LEN);
     85 
     86 	/*
     87 	 * RFC 4851, Section 5.1:
     88 	 * master_secret = T-PRF(PAC-Key, "PAC to master secret label hash",
     89 	 *                       server_random + client_random, 48)
     90 	 */
     91 	os_memcpy(seed, server_random, TLS_RANDOM_LEN);
     92 	os_memcpy(seed + TLS_RANDOM_LEN, client_random, TLS_RANDOM_LEN);
     93 	sha1_t_prf(pac_key, EAP_FAST_PAC_KEY_LEN,
     94 		   "PAC to master secret label hash",
     95 		   seed, sizeof(seed), master_secret, TLS_MASTER_SECRET_LEN);
     96 
     97 	wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: master_secret",
     98 			master_secret, TLS_MASTER_SECRET_LEN);
     99 }
    100 
    101 
    102 u8 * eap_fast_derive_key(void *ssl_ctx, struct tls_connection *conn,
    103 			 const char *label, size_t len)
    104 {
    105 	struct tls_keys keys;
    106 	u8 *rnd = NULL, *out;
    107 	int block_size;
    108 
    109 	block_size = tls_connection_get_keyblock_size(ssl_ctx, conn);
    110 	if (block_size < 0)
    111 		return NULL;
    112 
    113 	out = os_malloc(block_size + len);
    114 	if (out == NULL)
    115 		return NULL;
    116 
    117 	if (tls_connection_prf(ssl_ctx, conn, label, 1, out, block_size + len)
    118 	    == 0) {
    119 		os_memmove(out, out + block_size, len);
    120 		return out;
    121 	}
    122 
    123 	if (tls_connection_get_keys(ssl_ctx, conn, &keys))
    124 		goto fail;
    125 
    126 	rnd = os_malloc(keys.client_random_len + keys.server_random_len);
    127 	if (rnd == NULL)
    128 		goto fail;
    129 
    130 	os_memcpy(rnd, keys.server_random, keys.server_random_len);
    131 	os_memcpy(rnd + keys.server_random_len, keys.client_random,
    132 		  keys.client_random_len);
    133 
    134 	wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: master_secret for key "
    135 			"expansion", keys.master_key, keys.master_key_len);
    136 	if (tls_prf(keys.master_key, keys.master_key_len,
    137 		    label, rnd, keys.client_random_len +
    138 		    keys.server_random_len, out, block_size + len))
    139 		goto fail;
    140 	os_free(rnd);
    141 	os_memmove(out, out + block_size, len);
    142 	return out;
    143 
    144 fail:
    145 	os_free(rnd);
    146 	os_free(out);
    147 	return NULL;
    148 }
    149 
    150 
    151 void eap_fast_derive_eap_msk(const u8 *simck, u8 *msk)
    152 {
    153 	/*
    154 	 * RFC 4851, Section 5.4: EAP Master Session Key Generation
    155 	 * MSK = T-PRF(S-IMCK[j], "Session Key Generating Function", 64)
    156 	 */
    157 
    158 	sha1_t_prf(simck, EAP_FAST_SIMCK_LEN,
    159 		   "Session Key Generating Function", (u8 *) "", 0,
    160 		   msk, EAP_FAST_KEY_LEN);
    161 	wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Derived key (MSK)",
    162 			msk, EAP_FAST_KEY_LEN);
    163 }
    164 
    165 
    166 void eap_fast_derive_eap_emsk(const u8 *simck, u8 *emsk)
    167 {
    168 	/*
    169 	 * RFC 4851, Section 5.4: EAP Master Session Key Genreration
    170 	 * EMSK = T-PRF(S-IMCK[j],
    171 	 *        "Extended Session Key Generating Function", 64)
    172 	 */
    173 
    174 	sha1_t_prf(simck, EAP_FAST_SIMCK_LEN,
    175 		   "Extended Session Key Generating Function", (u8 *) "", 0,
    176 		   emsk, EAP_EMSK_LEN);
    177 	wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Derived key (EMSK)",
    178 			emsk, EAP_EMSK_LEN);
    179 }
    180 
    181 
    182 int eap_fast_parse_tlv(struct eap_fast_tlv_parse *tlv,
    183 		       int tlv_type, u8 *pos, int len)
    184 {
    185 	switch (tlv_type) {
    186 	case EAP_TLV_EAP_PAYLOAD_TLV:
    187 		wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: EAP-Payload TLV",
    188 			    pos, len);
    189 		if (tlv->eap_payload_tlv) {
    190 			wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
    191 				   "EAP-Payload TLV in the message");
    192 			tlv->iresult = EAP_TLV_RESULT_FAILURE;
    193 			return -2;
    194 		}
    195 		tlv->eap_payload_tlv = pos;
    196 		tlv->eap_payload_tlv_len = len;
    197 		break;
    198 	case EAP_TLV_RESULT_TLV:
    199 		wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Result TLV", pos, len);
    200 		if (tlv->result) {
    201 			wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
    202 				   "Result TLV in the message");
    203 			tlv->result = EAP_TLV_RESULT_FAILURE;
    204 			return -2;
    205 		}
    206 		if (len < 2) {
    207 			wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
    208 				   "Result TLV");
    209 			tlv->result = EAP_TLV_RESULT_FAILURE;
    210 			break;
    211 		}
    212 		tlv->result = WPA_GET_BE16(pos);
    213 		if (tlv->result != EAP_TLV_RESULT_SUCCESS &&
    214 		    tlv->result != EAP_TLV_RESULT_FAILURE) {
    215 			wpa_printf(MSG_DEBUG, "EAP-FAST: Unknown Result %d",
    216 				   tlv->result);
    217 			tlv->result = EAP_TLV_RESULT_FAILURE;
    218 		}
    219 		wpa_printf(MSG_DEBUG, "EAP-FAST: Result: %s",
    220 			   tlv->result == EAP_TLV_RESULT_SUCCESS ?
    221 			   "Success" : "Failure");
    222 		break;
    223 	case EAP_TLV_INTERMEDIATE_RESULT_TLV:
    224 		wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Intermediate Result TLV",
    225 			    pos, len);
    226 		if (len < 2) {
    227 			wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
    228 				   "Intermediate-Result TLV");
    229 			tlv->iresult = EAP_TLV_RESULT_FAILURE;
    230 			break;
    231 		}
    232 		if (tlv->iresult) {
    233 			wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
    234 				   "Intermediate-Result TLV in the message");
    235 			tlv->iresult = EAP_TLV_RESULT_FAILURE;
    236 			return -2;
    237 		}
    238 		tlv->iresult = WPA_GET_BE16(pos);
    239 		if (tlv->iresult != EAP_TLV_RESULT_SUCCESS &&
    240 		    tlv->iresult != EAP_TLV_RESULT_FAILURE) {
    241 			wpa_printf(MSG_DEBUG, "EAP-FAST: Unknown Intermediate "
    242 				   "Result %d", tlv->iresult);
    243 			tlv->iresult = EAP_TLV_RESULT_FAILURE;
    244 		}
    245 		wpa_printf(MSG_DEBUG, "EAP-FAST: Intermediate Result: %s",
    246 			   tlv->iresult == EAP_TLV_RESULT_SUCCESS ?
    247 			   "Success" : "Failure");
    248 		break;
    249 	case EAP_TLV_CRYPTO_BINDING_TLV:
    250 		wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Crypto-Binding TLV",
    251 			    pos, len);
    252 		if (tlv->crypto_binding) {
    253 			wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
    254 				   "Crypto-Binding TLV in the message");
    255 			tlv->iresult = EAP_TLV_RESULT_FAILURE;
    256 			return -2;
    257 		}
    258 		tlv->crypto_binding_len = sizeof(struct eap_tlv_hdr) + len;
    259 		if (tlv->crypto_binding_len < sizeof(*tlv->crypto_binding)) {
    260 			wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
    261 				   "Crypto-Binding TLV");
    262 			tlv->iresult = EAP_TLV_RESULT_FAILURE;
    263 			return -2;
    264 		}
    265 		tlv->crypto_binding = (struct eap_tlv_crypto_binding_tlv *)
    266 			(pos - sizeof(struct eap_tlv_hdr));
    267 		break;
    268 	case EAP_TLV_REQUEST_ACTION_TLV:
    269 		wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Request-Action TLV",
    270 			    pos, len);
    271 		if (tlv->request_action) {
    272 			wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
    273 				   "Request-Action TLV in the message");
    274 			tlv->iresult = EAP_TLV_RESULT_FAILURE;
    275 			return -2;
    276 		}
    277 		if (len < 2) {
    278 			wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
    279 				   "Request-Action TLV");
    280 			tlv->iresult = EAP_TLV_RESULT_FAILURE;
    281 			break;
    282 		}
    283 		tlv->request_action = WPA_GET_BE16(pos);
    284 		wpa_printf(MSG_DEBUG, "EAP-FAST: Request-Action: %d",
    285 			   tlv->request_action);
    286 		break;
    287 	case EAP_TLV_PAC_TLV:
    288 		wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: PAC TLV", pos, len);
    289 		if (tlv->pac) {
    290 			wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
    291 				   "PAC TLV in the message");
    292 			tlv->iresult = EAP_TLV_RESULT_FAILURE;
    293 			return -2;
    294 		}
    295 		tlv->pac = pos;
    296 		tlv->pac_len = len;
    297 		break;
    298 	default:
    299 		/* Unknown TLV */
    300 		return -1;
    301 	}
    302 
    303 	return 0;
    304 }
    305