1 /* 2 * EAP peer method: EAP-PAX (RFC 4746) 3 * Copyright (c) 2005-2008, Jouni Malinen <j (at) w1.fi> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 * 9 * Alternatively, this software may be distributed under the terms of BSD 10 * license. 11 * 12 * See README and COPYING for more details. 13 */ 14 15 #include "includes.h" 16 17 #include "common.h" 18 #include "crypto/random.h" 19 #include "eap_common/eap_pax_common.h" 20 #include "eap_i.h" 21 22 /* 23 * Note: only PAX_STD subprotocol is currently supported 24 * 25 * TODO: Add support with PAX_SEC with the mandatory to implement ciphersuite 26 * (HMAC_SHA1_128, IANA DH Group 14 (2048 bits), RSA-PKCS1-V1_5) and 27 * recommended ciphersuite (HMAC_SHA256_128, IANA DH Group 15 (3072 bits), 28 * RSAES-OAEP). 29 */ 30 31 struct eap_pax_data { 32 enum { PAX_INIT, PAX_STD_2_SENT, PAX_DONE } state; 33 u8 mac_id, dh_group_id, public_key_id; 34 union { 35 u8 e[2 * EAP_PAX_RAND_LEN]; 36 struct { 37 u8 x[EAP_PAX_RAND_LEN]; /* server rand */ 38 u8 y[EAP_PAX_RAND_LEN]; /* client rand */ 39 } r; 40 } rand; 41 char *cid; 42 size_t cid_len; 43 u8 ak[EAP_PAX_AK_LEN]; 44 u8 mk[EAP_PAX_MK_LEN]; 45 u8 ck[EAP_PAX_CK_LEN]; 46 u8 ick[EAP_PAX_ICK_LEN]; 47 }; 48 49 50 static void eap_pax_deinit(struct eap_sm *sm, void *priv); 51 52 53 static void * eap_pax_init(struct eap_sm *sm) 54 { 55 struct eap_pax_data *data; 56 const u8 *identity, *password; 57 size_t identity_len, password_len; 58 59 identity = eap_get_config_identity(sm, &identity_len); 60 password = eap_get_config_password(sm, &password_len); 61 if (!identity || !password) { 62 wpa_printf(MSG_INFO, "EAP-PAX: CID (nai) or key (password) " 63 "not configured"); 64 return NULL; 65 } 66 67 if (password_len != EAP_PAX_AK_LEN) { 68 wpa_printf(MSG_INFO, "EAP-PAX: Invalid PSK length"); 69 return NULL; 70 } 71 72 data = os_zalloc(sizeof(*data)); 73 if (data == NULL) 74 return NULL; 75 data->state = PAX_INIT; 76 77 data->cid = os_malloc(identity_len); 78 if (data->cid == NULL) { 79 eap_pax_deinit(sm, data); 80 return NULL; 81 } 82 os_memcpy(data->cid, identity, identity_len); 83 data->cid_len = identity_len; 84 85 os_memcpy(data->ak, password, EAP_PAX_AK_LEN); 86 87 return data; 88 } 89 90 91 static void eap_pax_deinit(struct eap_sm *sm, void *priv) 92 { 93 struct eap_pax_data *data = priv; 94 os_free(data->cid); 95 os_free(data); 96 } 97 98 99 static struct wpabuf * eap_pax_alloc_resp(const struct eap_pax_hdr *req, 100 u8 id, u8 op_code, size_t plen) 101 { 102 struct wpabuf *resp; 103 struct eap_pax_hdr *pax; 104 105 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PAX, 106 sizeof(*pax) + plen, EAP_CODE_RESPONSE, id); 107 if (resp == NULL) 108 return NULL; 109 110 pax = wpabuf_put(resp, sizeof(*pax)); 111 pax->op_code = op_code; 112 pax->flags = 0; 113 pax->mac_id = req->mac_id; 114 pax->dh_group_id = req->dh_group_id; 115 pax->public_key_id = req->public_key_id; 116 117 return resp; 118 } 119 120 121 static struct wpabuf * eap_pax_process_std_1(struct eap_pax_data *data, 122 struct eap_method_ret *ret, u8 id, 123 const struct eap_pax_hdr *req, 124 size_t req_plen) 125 { 126 struct wpabuf *resp; 127 const u8 *pos; 128 u8 *rpos; 129 size_t left, plen; 130 131 wpa_printf(MSG_DEBUG, "EAP-PAX: PAX_STD-1 (received)"); 132 133 if (data->state != PAX_INIT) { 134 wpa_printf(MSG_INFO, "EAP-PAX: PAX_STD-1 received in " 135 "unexpected state (%d) - ignored", data->state); 136 ret->ignore = TRUE; 137 return NULL; 138 } 139 140 if (req->flags & EAP_PAX_FLAGS_CE) { 141 wpa_printf(MSG_INFO, "EAP-PAX: PAX_STD-1 with CE flag set - " 142 "ignored"); 143 ret->ignore = TRUE; 144 return NULL; 145 } 146 147 left = req_plen - sizeof(*req); 148 149 if (left < 2 + EAP_PAX_RAND_LEN) { 150 wpa_printf(MSG_INFO, "EAP-PAX: PAX_STD-1 with too short " 151 "payload"); 152 ret->ignore = TRUE; 153 return NULL; 154 } 155 156 pos = (const u8 *) (req + 1); 157 if (WPA_GET_BE16(pos) != EAP_PAX_RAND_LEN) { 158 wpa_printf(MSG_INFO, "EAP-PAX: PAX_STD-1 with incorrect A " 159 "length %d (expected %d)", 160 WPA_GET_BE16(pos), EAP_PAX_RAND_LEN); 161 ret->ignore = TRUE; 162 return NULL; 163 } 164 165 pos += 2; 166 left -= 2; 167 os_memcpy(data->rand.r.x, pos, EAP_PAX_RAND_LEN); 168 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: X (server rand)", 169 data->rand.r.x, EAP_PAX_RAND_LEN); 170 pos += EAP_PAX_RAND_LEN; 171 left -= EAP_PAX_RAND_LEN; 172 173 if (left > 0) { 174 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: ignored extra payload", 175 pos, left); 176 } 177 178 if (random_get_bytes(data->rand.r.y, EAP_PAX_RAND_LEN)) { 179 wpa_printf(MSG_ERROR, "EAP-PAX: Failed to get random data"); 180 ret->ignore = TRUE; 181 return NULL; 182 } 183 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: Y (client rand)", 184 data->rand.r.y, EAP_PAX_RAND_LEN); 185 186 if (eap_pax_initial_key_derivation(req->mac_id, data->ak, data->rand.e, 187 data->mk, data->ck, data->ick) < 0) 188 { 189 ret->ignore = TRUE; 190 return NULL; 191 } 192 193 wpa_printf(MSG_DEBUG, "EAP-PAX: PAX_STD-2 (sending)"); 194 195 plen = 2 + EAP_PAX_RAND_LEN + 2 + data->cid_len + 2 + EAP_PAX_MAC_LEN + 196 EAP_PAX_ICV_LEN; 197 resp = eap_pax_alloc_resp(req, id, EAP_PAX_OP_STD_2, plen); 198 if (resp == NULL) 199 return NULL; 200 201 wpabuf_put_be16(resp, EAP_PAX_RAND_LEN); 202 wpabuf_put_data(resp, data->rand.r.y, EAP_PAX_RAND_LEN); 203 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: B = Y (client rand)", 204 data->rand.r.y, EAP_PAX_RAND_LEN); 205 206 wpabuf_put_be16(resp, data->cid_len); 207 wpabuf_put_data(resp, data->cid, data->cid_len); 208 wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-PAX: CID", 209 (u8 *) data->cid, data->cid_len); 210 211 wpabuf_put_be16(resp, EAP_PAX_MAC_LEN); 212 rpos = wpabuf_put(resp, EAP_PAX_MAC_LEN); 213 eap_pax_mac(req->mac_id, data->ck, EAP_PAX_CK_LEN, 214 data->rand.r.x, EAP_PAX_RAND_LEN, 215 data->rand.r.y, EAP_PAX_RAND_LEN, 216 (u8 *) data->cid, data->cid_len, rpos); 217 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: MAC_CK(A, B, CID)", 218 rpos, EAP_PAX_MAC_LEN); 219 220 /* Optional ADE could be added here, if needed */ 221 222 rpos = wpabuf_put(resp, EAP_PAX_ICV_LEN); 223 eap_pax_mac(req->mac_id, data->ick, EAP_PAX_ICK_LEN, 224 wpabuf_head(resp), wpabuf_len(resp) - EAP_PAX_ICV_LEN, 225 NULL, 0, NULL, 0, rpos); 226 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: ICV", rpos, EAP_PAX_ICV_LEN); 227 228 data->state = PAX_STD_2_SENT; 229 data->mac_id = req->mac_id; 230 data->dh_group_id = req->dh_group_id; 231 data->public_key_id = req->public_key_id; 232 233 return resp; 234 } 235 236 237 static struct wpabuf * eap_pax_process_std_3(struct eap_pax_data *data, 238 struct eap_method_ret *ret, u8 id, 239 const struct eap_pax_hdr *req, 240 size_t req_plen) 241 { 242 struct wpabuf *resp; 243 u8 *rpos, mac[EAP_PAX_MAC_LEN]; 244 const u8 *pos; 245 size_t left; 246 247 wpa_printf(MSG_DEBUG, "EAP-PAX: PAX_STD-3 (received)"); 248 249 if (data->state != PAX_STD_2_SENT) { 250 wpa_printf(MSG_INFO, "EAP-PAX: PAX_STD-3 received in " 251 "unexpected state (%d) - ignored", data->state); 252 ret->ignore = TRUE; 253 return NULL; 254 } 255 256 if (req->flags & EAP_PAX_FLAGS_CE) { 257 wpa_printf(MSG_INFO, "EAP-PAX: PAX_STD-3 with CE flag set - " 258 "ignored"); 259 ret->ignore = TRUE; 260 return NULL; 261 } 262 263 left = req_plen - sizeof(*req); 264 265 if (left < 2 + EAP_PAX_MAC_LEN) { 266 wpa_printf(MSG_INFO, "EAP-PAX: PAX_STD-3 with too short " 267 "payload"); 268 ret->ignore = TRUE; 269 return NULL; 270 } 271 272 pos = (const u8 *) (req + 1); 273 if (WPA_GET_BE16(pos) != EAP_PAX_MAC_LEN) { 274 wpa_printf(MSG_INFO, "EAP-PAX: PAX_STD-3 with incorrect " 275 "MAC_CK length %d (expected %d)", 276 WPA_GET_BE16(pos), EAP_PAX_MAC_LEN); 277 ret->ignore = TRUE; 278 return NULL; 279 } 280 pos += 2; 281 left -= 2; 282 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: MAC_CK(B, CID)", 283 pos, EAP_PAX_MAC_LEN); 284 eap_pax_mac(data->mac_id, data->ck, EAP_PAX_CK_LEN, 285 data->rand.r.y, EAP_PAX_RAND_LEN, 286 (u8 *) data->cid, data->cid_len, NULL, 0, mac); 287 if (os_memcmp(pos, mac, EAP_PAX_MAC_LEN) != 0) { 288 wpa_printf(MSG_INFO, "EAP-PAX: Invalid MAC_CK(B, CID) " 289 "received"); 290 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: expected MAC_CK(B, CID)", 291 mac, EAP_PAX_MAC_LEN); 292 ret->methodState = METHOD_DONE; 293 ret->decision = DECISION_FAIL; 294 return NULL; 295 } 296 297 pos += EAP_PAX_MAC_LEN; 298 left -= EAP_PAX_MAC_LEN; 299 300 if (left > 0) { 301 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: ignored extra payload", 302 pos, left); 303 } 304 305 wpa_printf(MSG_DEBUG, "EAP-PAX: PAX-ACK (sending)"); 306 307 resp = eap_pax_alloc_resp(req, id, EAP_PAX_OP_ACK, EAP_PAX_ICV_LEN); 308 if (resp == NULL) 309 return NULL; 310 311 /* Optional ADE could be added here, if needed */ 312 313 rpos = wpabuf_put(resp, EAP_PAX_ICV_LEN); 314 eap_pax_mac(data->mac_id, data->ick, EAP_PAX_ICK_LEN, 315 wpabuf_head(resp), wpabuf_len(resp) - EAP_PAX_ICV_LEN, 316 NULL, 0, NULL, 0, rpos); 317 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: ICV", rpos, EAP_PAX_ICV_LEN); 318 319 data->state = PAX_DONE; 320 ret->methodState = METHOD_DONE; 321 ret->decision = DECISION_UNCOND_SUCC; 322 ret->allowNotifications = FALSE; 323 324 return resp; 325 } 326 327 328 static struct wpabuf * eap_pax_process(struct eap_sm *sm, void *priv, 329 struct eap_method_ret *ret, 330 const struct wpabuf *reqData) 331 { 332 struct eap_pax_data *data = priv; 333 const struct eap_pax_hdr *req; 334 struct wpabuf *resp; 335 u8 icvbuf[EAP_PAX_ICV_LEN], id; 336 const u8 *icv, *pos; 337 size_t len; 338 u16 flen, mlen; 339 340 pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_PAX, reqData, &len); 341 if (pos == NULL || len < EAP_PAX_ICV_LEN) { 342 ret->ignore = TRUE; 343 return NULL; 344 } 345 id = eap_get_id(reqData); 346 req = (const struct eap_pax_hdr *) pos; 347 flen = len - EAP_PAX_ICV_LEN; 348 mlen = wpabuf_len(reqData) - EAP_PAX_ICV_LEN; 349 350 wpa_printf(MSG_DEBUG, "EAP-PAX: received frame: op_code 0x%x " 351 "flags 0x%x mac_id 0x%x dh_group_id 0x%x " 352 "public_key_id 0x%x", 353 req->op_code, req->flags, req->mac_id, req->dh_group_id, 354 req->public_key_id); 355 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: received payload", 356 pos, len - EAP_PAX_ICV_LEN); 357 358 if (data->state != PAX_INIT && data->mac_id != req->mac_id) { 359 wpa_printf(MSG_INFO, "EAP-PAX: MAC ID changed during " 360 "authentication (was 0x%d, is 0x%d)", 361 data->mac_id, req->mac_id); 362 ret->ignore = TRUE; 363 return NULL; 364 } 365 366 if (data->state != PAX_INIT && data->dh_group_id != req->dh_group_id) { 367 wpa_printf(MSG_INFO, "EAP-PAX: DH Group ID changed during " 368 "authentication (was 0x%d, is 0x%d)", 369 data->dh_group_id, req->dh_group_id); 370 ret->ignore = TRUE; 371 return NULL; 372 } 373 374 if (data->state != PAX_INIT && 375 data->public_key_id != req->public_key_id) { 376 wpa_printf(MSG_INFO, "EAP-PAX: Public Key ID changed during " 377 "authentication (was 0x%d, is 0x%d)", 378 data->public_key_id, req->public_key_id); 379 ret->ignore = TRUE; 380 return NULL; 381 } 382 383 /* TODO: add support EAP_PAX_HMAC_SHA256_128 */ 384 if (req->mac_id != EAP_PAX_MAC_HMAC_SHA1_128) { 385 wpa_printf(MSG_INFO, "EAP-PAX: Unsupported MAC ID 0x%x", 386 req->mac_id); 387 ret->ignore = TRUE; 388 return NULL; 389 } 390 391 if (req->dh_group_id != EAP_PAX_DH_GROUP_NONE) { 392 wpa_printf(MSG_INFO, "EAP-PAX: Unsupported DH Group ID 0x%x", 393 req->dh_group_id); 394 ret->ignore = TRUE; 395 return NULL; 396 } 397 398 if (req->public_key_id != EAP_PAX_PUBLIC_KEY_NONE) { 399 wpa_printf(MSG_INFO, "EAP-PAX: Unsupported Public Key ID 0x%x", 400 req->public_key_id); 401 ret->ignore = TRUE; 402 return NULL; 403 } 404 405 if (req->flags & EAP_PAX_FLAGS_MF) { 406 /* TODO: add support for reassembling fragments */ 407 wpa_printf(MSG_INFO, "EAP-PAX: fragmentation not supported - " 408 "ignored packet"); 409 ret->ignore = TRUE; 410 return NULL; 411 } 412 413 icv = pos + len - EAP_PAX_ICV_LEN; 414 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: ICV", icv, EAP_PAX_ICV_LEN); 415 if (req->op_code == EAP_PAX_OP_STD_1) { 416 eap_pax_mac(req->mac_id, (u8 *) "", 0, 417 wpabuf_head(reqData), mlen, NULL, 0, NULL, 0, 418 icvbuf); 419 } else { 420 eap_pax_mac(req->mac_id, data->ick, EAP_PAX_ICK_LEN, 421 wpabuf_head(reqData), mlen, NULL, 0, NULL, 0, 422 icvbuf); 423 } 424 if (os_memcmp(icv, icvbuf, EAP_PAX_ICV_LEN) != 0) { 425 wpa_printf(MSG_DEBUG, "EAP-PAX: invalid ICV - ignoring the " 426 "message"); 427 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: expected ICV", 428 icvbuf, EAP_PAX_ICV_LEN); 429 ret->ignore = TRUE; 430 return NULL; 431 } 432 433 ret->ignore = FALSE; 434 ret->methodState = METHOD_MAY_CONT; 435 ret->decision = DECISION_FAIL; 436 ret->allowNotifications = TRUE; 437 438 switch (req->op_code) { 439 case EAP_PAX_OP_STD_1: 440 resp = eap_pax_process_std_1(data, ret, id, req, flen); 441 break; 442 case EAP_PAX_OP_STD_3: 443 resp = eap_pax_process_std_3(data, ret, id, req, flen); 444 break; 445 default: 446 wpa_printf(MSG_DEBUG, "EAP-PAX: ignoring message with unknown " 447 "op_code %d", req->op_code); 448 ret->ignore = TRUE; 449 return NULL; 450 } 451 452 if (ret->methodState == METHOD_DONE) { 453 ret->allowNotifications = FALSE; 454 } 455 456 return resp; 457 } 458 459 460 static Boolean eap_pax_isKeyAvailable(struct eap_sm *sm, void *priv) 461 { 462 struct eap_pax_data *data = priv; 463 return data->state == PAX_DONE; 464 } 465 466 467 static u8 * eap_pax_getKey(struct eap_sm *sm, void *priv, size_t *len) 468 { 469 struct eap_pax_data *data = priv; 470 u8 *key; 471 472 if (data->state != PAX_DONE) 473 return NULL; 474 475 key = os_malloc(EAP_MSK_LEN); 476 if (key == NULL) 477 return NULL; 478 479 *len = EAP_MSK_LEN; 480 eap_pax_kdf(data->mac_id, data->mk, EAP_PAX_MK_LEN, 481 "Master Session Key", data->rand.e, 2 * EAP_PAX_RAND_LEN, 482 EAP_MSK_LEN, key); 483 484 return key; 485 } 486 487 488 static u8 * eap_pax_get_emsk(struct eap_sm *sm, void *priv, size_t *len) 489 { 490 struct eap_pax_data *data = priv; 491 u8 *key; 492 493 if (data->state != PAX_DONE) 494 return NULL; 495 496 key = os_malloc(EAP_EMSK_LEN); 497 if (key == NULL) 498 return NULL; 499 500 *len = EAP_EMSK_LEN; 501 eap_pax_kdf(data->mac_id, data->mk, EAP_PAX_MK_LEN, 502 "Extended Master Session Key", 503 data->rand.e, 2 * EAP_PAX_RAND_LEN, 504 EAP_EMSK_LEN, key); 505 506 return key; 507 } 508 509 510 int eap_peer_pax_register(void) 511 { 512 struct eap_method *eap; 513 int ret; 514 515 eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION, 516 EAP_VENDOR_IETF, EAP_TYPE_PAX, "PAX"); 517 if (eap == NULL) 518 return -1; 519 520 eap->init = eap_pax_init; 521 eap->deinit = eap_pax_deinit; 522 eap->process = eap_pax_process; 523 eap->isKeyAvailable = eap_pax_isKeyAvailable; 524 eap->getKey = eap_pax_getKey; 525 eap->get_emsk = eap_pax_get_emsk; 526 527 ret = eap_peer_method_register(eap); 528 if (ret) 529 eap_peer_method_free(eap); 530 return ret; 531 } 532
