1 /* 2 * EAP-FAST common helper functions (RFC 4851) 3 * Copyright (c) 2008, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 11 #include "common.h" 12 #include "crypto/sha1.h" 13 #include "crypto/tls.h" 14 #include "eap_defs.h" 15 #include "eap_tlv_common.h" 16 #include "eap_fast_common.h" 17 18 eap_fast_put_tlv_hdr(struct wpabuf * buf,u16 type,u16 len)19 void eap_fast_put_tlv_hdr(struct wpabuf *buf, u16 type, u16 len) 20 { 21 struct pac_tlv_hdr hdr; 22 hdr.type = host_to_be16(type); 23 hdr.len = host_to_be16(len); 24 wpabuf_put_data(buf, &hdr, sizeof(hdr)); 25 } 26 27 eap_fast_put_tlv(struct wpabuf * buf,u16 type,const void * data,u16 len)28 void eap_fast_put_tlv(struct wpabuf *buf, u16 type, const void *data, 29 u16 len) 30 { 31 eap_fast_put_tlv_hdr(buf, type, len); 32 wpabuf_put_data(buf, data, len); 33 } 34 35 eap_fast_put_tlv_buf(struct wpabuf * buf,u16 type,const struct wpabuf * data)36 void eap_fast_put_tlv_buf(struct wpabuf *buf, u16 type, 37 const struct wpabuf *data) 38 { 39 eap_fast_put_tlv_hdr(buf, type, wpabuf_len(data)); 40 wpabuf_put_buf(buf, data); 41 } 42 43 eap_fast_tlv_eap_payload(struct wpabuf * buf)44 struct wpabuf * eap_fast_tlv_eap_payload(struct wpabuf *buf) 45 { 46 struct wpabuf *e; 47 48 if (buf == NULL) 49 return NULL; 50 51 /* Encapsulate EAP packet in EAP-Payload TLV */ 52 wpa_printf(MSG_DEBUG, "EAP-FAST: Add EAP-Payload TLV"); 53 e = wpabuf_alloc(sizeof(struct pac_tlv_hdr) + wpabuf_len(buf)); 54 if (e == NULL) { 55 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to allocate memory " 56 "for TLV encapsulation"); 57 wpabuf_free(buf); 58 return NULL; 59 } 60 eap_fast_put_tlv_buf(e, 61 EAP_TLV_TYPE_MANDATORY | EAP_TLV_EAP_PAYLOAD_TLV, 62 buf); 63 wpabuf_free(buf); 64 return e; 65 } 66 67 eap_fast_derive_master_secret(const u8 * pac_key,const u8 * server_random,const u8 * client_random,u8 * master_secret)68 void eap_fast_derive_master_secret(const u8 *pac_key, const u8 *server_random, 69 const u8 *client_random, u8 *master_secret) 70 { 71 #define TLS_RANDOM_LEN 32 72 #define TLS_MASTER_SECRET_LEN 48 73 u8 seed[2 * TLS_RANDOM_LEN]; 74 75 wpa_hexdump(MSG_DEBUG, "EAP-FAST: client_random", 76 client_random, TLS_RANDOM_LEN); 77 wpa_hexdump(MSG_DEBUG, "EAP-FAST: server_random", 78 server_random, TLS_RANDOM_LEN); 79 80 /* 81 * RFC 4851, Section 5.1: 82 * master_secret = T-PRF(PAC-Key, "PAC to master secret label hash", 83 * server_random + client_random, 48) 84 */ 85 os_memcpy(seed, server_random, TLS_RANDOM_LEN); 86 os_memcpy(seed + TLS_RANDOM_LEN, client_random, TLS_RANDOM_LEN); 87 sha1_t_prf(pac_key, EAP_FAST_PAC_KEY_LEN, 88 "PAC to master secret label hash", 89 seed, sizeof(seed), master_secret, TLS_MASTER_SECRET_LEN); 90 91 wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: master_secret", 92 master_secret, TLS_MASTER_SECRET_LEN); 93 } 94 95 eap_fast_derive_key(void * ssl_ctx,struct tls_connection * conn,size_t len)96 u8 * eap_fast_derive_key(void *ssl_ctx, struct tls_connection *conn, size_t len) 97 { 98 u8 *out; 99 100 out = os_malloc(len); 101 if (out == NULL) 102 return NULL; 103 104 if (tls_connection_get_eap_fast_key(ssl_ctx, conn, out, len)) { 105 os_free(out); 106 return NULL; 107 } 108 109 return out; 110 } 111 112 eap_fast_derive_eap_msk(const u8 * simck,u8 * msk)113 int eap_fast_derive_eap_msk(const u8 *simck, u8 *msk) 114 { 115 /* 116 * RFC 4851, Section 5.4: EAP Master Session Key Generation 117 * MSK = T-PRF(S-IMCK[j], "Session Key Generating Function", 64) 118 */ 119 120 if (sha1_t_prf(simck, EAP_FAST_SIMCK_LEN, 121 "Session Key Generating Function", (u8 *) "", 0, 122 msk, EAP_FAST_KEY_LEN) < 0) 123 return -1; 124 wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Derived key (MSK)", 125 msk, EAP_FAST_KEY_LEN); 126 return 0; 127 } 128 129 eap_fast_derive_eap_emsk(const u8 * simck,u8 * emsk)130 int eap_fast_derive_eap_emsk(const u8 *simck, u8 *emsk) 131 { 132 /* 133 * RFC 4851, Section 5.4: EAP Master Session Key Genreration 134 * EMSK = T-PRF(S-IMCK[j], 135 * "Extended Session Key Generating Function", 64) 136 */ 137 138 if (sha1_t_prf(simck, EAP_FAST_SIMCK_LEN, 139 "Extended Session Key Generating Function", (u8 *) "", 0, 140 emsk, EAP_EMSK_LEN) < 0) 141 return -1; 142 wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Derived key (EMSK)", 143 emsk, EAP_EMSK_LEN); 144 return 0; 145 } 146 147 eap_fast_parse_tlv(struct eap_fast_tlv_parse * tlv,int tlv_type,u8 * pos,size_t len)148 int eap_fast_parse_tlv(struct eap_fast_tlv_parse *tlv, 149 int tlv_type, u8 *pos, size_t len) 150 { 151 switch (tlv_type) { 152 case EAP_TLV_EAP_PAYLOAD_TLV: 153 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: EAP-Payload TLV", 154 pos, len); 155 if (tlv->eap_payload_tlv) { 156 wpa_printf(MSG_DEBUG, "EAP-FAST: More than one " 157 "EAP-Payload TLV in the message"); 158 tlv->iresult = EAP_TLV_RESULT_FAILURE; 159 return -2; 160 } 161 tlv->eap_payload_tlv = pos; 162 tlv->eap_payload_tlv_len = len; 163 break; 164 case EAP_TLV_RESULT_TLV: 165 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Result TLV", pos, len); 166 if (tlv->result) { 167 wpa_printf(MSG_DEBUG, "EAP-FAST: More than one " 168 "Result TLV in the message"); 169 tlv->result = EAP_TLV_RESULT_FAILURE; 170 return -2; 171 } 172 if (len < 2) { 173 wpa_printf(MSG_DEBUG, "EAP-FAST: Too short " 174 "Result TLV"); 175 tlv->result = EAP_TLV_RESULT_FAILURE; 176 break; 177 } 178 tlv->result = WPA_GET_BE16(pos); 179 if (tlv->result != EAP_TLV_RESULT_SUCCESS && 180 tlv->result != EAP_TLV_RESULT_FAILURE) { 181 wpa_printf(MSG_DEBUG, "EAP-FAST: Unknown Result %d", 182 tlv->result); 183 tlv->result = EAP_TLV_RESULT_FAILURE; 184 } 185 wpa_printf(MSG_DEBUG, "EAP-FAST: Result: %s", 186 tlv->result == EAP_TLV_RESULT_SUCCESS ? 187 "Success" : "Failure"); 188 break; 189 case EAP_TLV_INTERMEDIATE_RESULT_TLV: 190 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Intermediate Result TLV", 191 pos, len); 192 if (len < 2) { 193 wpa_printf(MSG_DEBUG, "EAP-FAST: Too short " 194 "Intermediate-Result TLV"); 195 tlv->iresult = EAP_TLV_RESULT_FAILURE; 196 break; 197 } 198 if (tlv->iresult) { 199 wpa_printf(MSG_DEBUG, "EAP-FAST: More than one " 200 "Intermediate-Result TLV in the message"); 201 tlv->iresult = EAP_TLV_RESULT_FAILURE; 202 return -2; 203 } 204 tlv->iresult = WPA_GET_BE16(pos); 205 if (tlv->iresult != EAP_TLV_RESULT_SUCCESS && 206 tlv->iresult != EAP_TLV_RESULT_FAILURE) { 207 wpa_printf(MSG_DEBUG, "EAP-FAST: Unknown Intermediate " 208 "Result %d", tlv->iresult); 209 tlv->iresult = EAP_TLV_RESULT_FAILURE; 210 } 211 wpa_printf(MSG_DEBUG, "EAP-FAST: Intermediate Result: %s", 212 tlv->iresult == EAP_TLV_RESULT_SUCCESS ? 213 "Success" : "Failure"); 214 break; 215 case EAP_TLV_CRYPTO_BINDING_TLV: 216 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Crypto-Binding TLV", 217 pos, len); 218 if (tlv->crypto_binding) { 219 wpa_printf(MSG_DEBUG, "EAP-FAST: More than one " 220 "Crypto-Binding TLV in the message"); 221 tlv->iresult = EAP_TLV_RESULT_FAILURE; 222 return -2; 223 } 224 tlv->crypto_binding_len = sizeof(struct eap_tlv_hdr) + len; 225 if (tlv->crypto_binding_len < sizeof(*tlv->crypto_binding)) { 226 wpa_printf(MSG_DEBUG, "EAP-FAST: Too short " 227 "Crypto-Binding TLV"); 228 tlv->iresult = EAP_TLV_RESULT_FAILURE; 229 return -2; 230 } 231 tlv->crypto_binding = (struct eap_tlv_crypto_binding_tlv *) 232 (pos - sizeof(struct eap_tlv_hdr)); 233 break; 234 case EAP_TLV_REQUEST_ACTION_TLV: 235 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Request-Action TLV", 236 pos, len); 237 if (tlv->request_action) { 238 wpa_printf(MSG_DEBUG, "EAP-FAST: More than one " 239 "Request-Action TLV in the message"); 240 tlv->iresult = EAP_TLV_RESULT_FAILURE; 241 return -2; 242 } 243 if (len < 2) { 244 wpa_printf(MSG_DEBUG, "EAP-FAST: Too short " 245 "Request-Action TLV"); 246 tlv->iresult = EAP_TLV_RESULT_FAILURE; 247 break; 248 } 249 tlv->request_action = WPA_GET_BE16(pos); 250 wpa_printf(MSG_DEBUG, "EAP-FAST: Request-Action: %d", 251 tlv->request_action); 252 break; 253 case EAP_TLV_PAC_TLV: 254 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: PAC TLV", pos, len); 255 if (tlv->pac) { 256 wpa_printf(MSG_DEBUG, "EAP-FAST: More than one " 257 "PAC TLV in the message"); 258 tlv->iresult = EAP_TLV_RESULT_FAILURE; 259 return -2; 260 } 261 tlv->pac = pos; 262 tlv->pac_len = len; 263 break; 264 default: 265 /* Unknown TLV */ 266 return -1; 267 } 268 269 return 0; 270 } 271