1  /*
2   * EAP-FAST common helper functions (RFC 4851)
3   * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
4   *
5   * This software may be distributed under the terms of the BSD license.
6   * See README for more details.
7   */
8  
9  #include "includes.h"
10  
11  #include "common.h"
12  #include "crypto/sha1.h"
13  #include "crypto/tls.h"
14  #include "eap_defs.h"
15  #include "eap_tlv_common.h"
16  #include "eap_fast_common.h"
17  
18  
eap_fast_put_tlv_hdr(struct wpabuf * buf,u16 type,u16 len)19  void eap_fast_put_tlv_hdr(struct wpabuf *buf, u16 type, u16 len)
20  {
21  	struct pac_tlv_hdr hdr;
22  	hdr.type = host_to_be16(type);
23  	hdr.len = host_to_be16(len);
24  	wpabuf_put_data(buf, &hdr, sizeof(hdr));
25  }
26  
27  
eap_fast_put_tlv(struct wpabuf * buf,u16 type,const void * data,u16 len)28  void eap_fast_put_tlv(struct wpabuf *buf, u16 type, const void *data,
29  			     u16 len)
30  {
31  	eap_fast_put_tlv_hdr(buf, type, len);
32  	wpabuf_put_data(buf, data, len);
33  }
34  
35  
eap_fast_put_tlv_buf(struct wpabuf * buf,u16 type,const struct wpabuf * data)36  void eap_fast_put_tlv_buf(struct wpabuf *buf, u16 type,
37  				 const struct wpabuf *data)
38  {
39  	eap_fast_put_tlv_hdr(buf, type, wpabuf_len(data));
40  	wpabuf_put_buf(buf, data);
41  }
42  
43  
eap_fast_tlv_eap_payload(struct wpabuf * buf)44  struct wpabuf * eap_fast_tlv_eap_payload(struct wpabuf *buf)
45  {
46  	struct wpabuf *e;
47  
48  	if (buf == NULL)
49  		return NULL;
50  
51  	/* Encapsulate EAP packet in EAP-Payload TLV */
52  	wpa_printf(MSG_DEBUG, "EAP-FAST: Add EAP-Payload TLV");
53  	e = wpabuf_alloc(sizeof(struct pac_tlv_hdr) + wpabuf_len(buf));
54  	if (e == NULL) {
55  		wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to allocate memory "
56  			   "for TLV encapsulation");
57  		wpabuf_free(buf);
58  		return NULL;
59  	}
60  	eap_fast_put_tlv_buf(e,
61  			     EAP_TLV_TYPE_MANDATORY | EAP_TLV_EAP_PAYLOAD_TLV,
62  			     buf);
63  	wpabuf_free(buf);
64  	return e;
65  }
66  
67  
eap_fast_derive_master_secret(const u8 * pac_key,const u8 * server_random,const u8 * client_random,u8 * master_secret)68  void eap_fast_derive_master_secret(const u8 *pac_key, const u8 *server_random,
69  				   const u8 *client_random, u8 *master_secret)
70  {
71  #define TLS_RANDOM_LEN 32
72  #define TLS_MASTER_SECRET_LEN 48
73  	u8 seed[2 * TLS_RANDOM_LEN];
74  
75  	wpa_hexdump(MSG_DEBUG, "EAP-FAST: client_random",
76  		    client_random, TLS_RANDOM_LEN);
77  	wpa_hexdump(MSG_DEBUG, "EAP-FAST: server_random",
78  		    server_random, TLS_RANDOM_LEN);
79  
80  	/*
81  	 * RFC 4851, Section 5.1:
82  	 * master_secret = T-PRF(PAC-Key, "PAC to master secret label hash",
83  	 *                       server_random + client_random, 48)
84  	 */
85  	os_memcpy(seed, server_random, TLS_RANDOM_LEN);
86  	os_memcpy(seed + TLS_RANDOM_LEN, client_random, TLS_RANDOM_LEN);
87  	sha1_t_prf(pac_key, EAP_FAST_PAC_KEY_LEN,
88  		   "PAC to master secret label hash",
89  		   seed, sizeof(seed), master_secret, TLS_MASTER_SECRET_LEN);
90  
91  	wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: master_secret",
92  			master_secret, TLS_MASTER_SECRET_LEN);
93  }
94  
95  
eap_fast_derive_key(void * ssl_ctx,struct tls_connection * conn,size_t len)96  u8 * eap_fast_derive_key(void *ssl_ctx, struct tls_connection *conn, size_t len)
97  {
98  	u8 *out;
99  
100  	out = os_malloc(len);
101  	if (out == NULL)
102  		return NULL;
103  
104  	if (tls_connection_get_eap_fast_key(ssl_ctx, conn, out, len)) {
105  		os_free(out);
106  		return NULL;
107  	}
108  
109  	return out;
110  }
111  
112  
eap_fast_derive_eap_msk(const u8 * simck,u8 * msk)113  int eap_fast_derive_eap_msk(const u8 *simck, u8 *msk)
114  {
115  	/*
116  	 * RFC 4851, Section 5.4: EAP Master Session Key Generation
117  	 * MSK = T-PRF(S-IMCK[j], "Session Key Generating Function", 64)
118  	 */
119  
120  	if (sha1_t_prf(simck, EAP_FAST_SIMCK_LEN,
121  		       "Session Key Generating Function", (u8 *) "", 0,
122  		       msk, EAP_FAST_KEY_LEN) < 0)
123  		return -1;
124  	wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Derived key (MSK)",
125  			msk, EAP_FAST_KEY_LEN);
126  	return 0;
127  }
128  
129  
eap_fast_derive_eap_emsk(const u8 * simck,u8 * emsk)130  int eap_fast_derive_eap_emsk(const u8 *simck, u8 *emsk)
131  {
132  	/*
133  	 * RFC 4851, Section 5.4: EAP Master Session Key Genreration
134  	 * EMSK = T-PRF(S-IMCK[j],
135  	 *        "Extended Session Key Generating Function", 64)
136  	 */
137  
138  	if (sha1_t_prf(simck, EAP_FAST_SIMCK_LEN,
139  		       "Extended Session Key Generating Function", (u8 *) "", 0,
140  		       emsk, EAP_EMSK_LEN) < 0)
141  		return -1;
142  	wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Derived key (EMSK)",
143  			emsk, EAP_EMSK_LEN);
144  	return 0;
145  }
146  
147  
eap_fast_parse_tlv(struct eap_fast_tlv_parse * tlv,int tlv_type,u8 * pos,size_t len)148  int eap_fast_parse_tlv(struct eap_fast_tlv_parse *tlv,
149  		       int tlv_type, u8 *pos, size_t len)
150  {
151  	switch (tlv_type) {
152  	case EAP_TLV_EAP_PAYLOAD_TLV:
153  		wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: EAP-Payload TLV",
154  			    pos, len);
155  		if (tlv->eap_payload_tlv) {
156  			wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
157  				   "EAP-Payload TLV in the message");
158  			tlv->iresult = EAP_TLV_RESULT_FAILURE;
159  			return -2;
160  		}
161  		tlv->eap_payload_tlv = pos;
162  		tlv->eap_payload_tlv_len = len;
163  		break;
164  	case EAP_TLV_RESULT_TLV:
165  		wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Result TLV", pos, len);
166  		if (tlv->result) {
167  			wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
168  				   "Result TLV in the message");
169  			tlv->result = EAP_TLV_RESULT_FAILURE;
170  			return -2;
171  		}
172  		if (len < 2) {
173  			wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
174  				   "Result TLV");
175  			tlv->result = EAP_TLV_RESULT_FAILURE;
176  			break;
177  		}
178  		tlv->result = WPA_GET_BE16(pos);
179  		if (tlv->result != EAP_TLV_RESULT_SUCCESS &&
180  		    tlv->result != EAP_TLV_RESULT_FAILURE) {
181  			wpa_printf(MSG_DEBUG, "EAP-FAST: Unknown Result %d",
182  				   tlv->result);
183  			tlv->result = EAP_TLV_RESULT_FAILURE;
184  		}
185  		wpa_printf(MSG_DEBUG, "EAP-FAST: Result: %s",
186  			   tlv->result == EAP_TLV_RESULT_SUCCESS ?
187  			   "Success" : "Failure");
188  		break;
189  	case EAP_TLV_INTERMEDIATE_RESULT_TLV:
190  		wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Intermediate Result TLV",
191  			    pos, len);
192  		if (len < 2) {
193  			wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
194  				   "Intermediate-Result TLV");
195  			tlv->iresult = EAP_TLV_RESULT_FAILURE;
196  			break;
197  		}
198  		if (tlv->iresult) {
199  			wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
200  				   "Intermediate-Result TLV in the message");
201  			tlv->iresult = EAP_TLV_RESULT_FAILURE;
202  			return -2;
203  		}
204  		tlv->iresult = WPA_GET_BE16(pos);
205  		if (tlv->iresult != EAP_TLV_RESULT_SUCCESS &&
206  		    tlv->iresult != EAP_TLV_RESULT_FAILURE) {
207  			wpa_printf(MSG_DEBUG, "EAP-FAST: Unknown Intermediate "
208  				   "Result %d", tlv->iresult);
209  			tlv->iresult = EAP_TLV_RESULT_FAILURE;
210  		}
211  		wpa_printf(MSG_DEBUG, "EAP-FAST: Intermediate Result: %s",
212  			   tlv->iresult == EAP_TLV_RESULT_SUCCESS ?
213  			   "Success" : "Failure");
214  		break;
215  	case EAP_TLV_CRYPTO_BINDING_TLV:
216  		wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Crypto-Binding TLV",
217  			    pos, len);
218  		if (tlv->crypto_binding) {
219  			wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
220  				   "Crypto-Binding TLV in the message");
221  			tlv->iresult = EAP_TLV_RESULT_FAILURE;
222  			return -2;
223  		}
224  		tlv->crypto_binding_len = sizeof(struct eap_tlv_hdr) + len;
225  		if (tlv->crypto_binding_len < sizeof(*tlv->crypto_binding)) {
226  			wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
227  				   "Crypto-Binding TLV");
228  			tlv->iresult = EAP_TLV_RESULT_FAILURE;
229  			return -2;
230  		}
231  		tlv->crypto_binding = (struct eap_tlv_crypto_binding_tlv *)
232  			(pos - sizeof(struct eap_tlv_hdr));
233  		break;
234  	case EAP_TLV_REQUEST_ACTION_TLV:
235  		wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Request-Action TLV",
236  			    pos, len);
237  		if (tlv->request_action) {
238  			wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
239  				   "Request-Action TLV in the message");
240  			tlv->iresult = EAP_TLV_RESULT_FAILURE;
241  			return -2;
242  		}
243  		if (len < 2) {
244  			wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
245  				   "Request-Action TLV");
246  			tlv->iresult = EAP_TLV_RESULT_FAILURE;
247  			break;
248  		}
249  		tlv->request_action = WPA_GET_BE16(pos);
250  		wpa_printf(MSG_DEBUG, "EAP-FAST: Request-Action: %d",
251  			   tlv->request_action);
252  		break;
253  	case EAP_TLV_PAC_TLV:
254  		wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: PAC TLV", pos, len);
255  		if (tlv->pac) {
256  			wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
257  				   "PAC TLV in the message");
258  			tlv->iresult = EAP_TLV_RESULT_FAILURE;
259  			return -2;
260  		}
261  		tlv->pac = pos;
262  		tlv->pac_len = len;
263  		break;
264  	default:
265  		/* Unknown TLV */
266  		return -1;
267  	}
268  
269  	return 0;
270  }
271