contrib/hostapd/src/eap_common/eap_fast_common.c

   1 /*
   2  * EAP-FAST common helper functions (RFC 4851)
   3  * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #include "common.h"
  12 #include "crypto/sha1.h"
  13 #include "crypto/tls.h"
  14 #include "eap_defs.h"
  15 #include "eap_tlv_common.h"
  16 #include "eap_fast_common.h"
  17
  18
  19 void eap_fast_put_tlv_hdr(struct wpabuf *buf, u16 type, u16 len)
  20 {
  21         struct pac_tlv_hdr hdr;
  22         hdr.type = host_to_be16(type);
  23         hdr.len = host_to_be16(len);
  24         wpabuf_put_data(buf, &hdr, sizeof(hdr));
  25 }
  26
  27
  28 void eap_fast_put_tlv(struct wpabuf *buf, u16 type, const void *data,
  29                              u16 len)
  30 {
  31         eap_fast_put_tlv_hdr(buf, type, len);
  32         wpabuf_put_data(buf, data, len);
  33 }
  34
  35
  36 void eap_fast_put_tlv_buf(struct wpabuf *buf, u16 type,
  37                                  const struct wpabuf *data)
  38 {
  39         eap_fast_put_tlv_hdr(buf, type, wpabuf_len(data));
  40         wpabuf_put_buf(buf, data);
  41 }
  42
  43
  44 struct wpabuf * eap_fast_tlv_eap_payload(struct wpabuf *buf)
  45 {
  46         struct wpabuf *e;
  47
  48         if (buf == NULL)
  49                 return NULL;
  50
  51         /* Encapsulate EAP packet in EAP-Payload TLV */
  52         wpa_printf(MSG_DEBUG, "EAP-FAST: Add EAP-Payload TLV");
  53         e = wpabuf_alloc(sizeof(struct pac_tlv_hdr) + wpabuf_len(buf));
  54         if (e == NULL) {
  55                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to allocate memory "
  56                            "for TLV encapsulation");
  57                 wpabuf_free(buf);
  58                 return NULL;
  59         }
  60         eap_fast_put_tlv_buf(e,
  61                              EAP_TLV_TYPE_MANDATORY | EAP_TLV_EAP_PAYLOAD_TLV,
  62                              buf);
  63         wpabuf_free(buf);
  64         return e;
  65 }
  66
  67
  68 void eap_fast_derive_master_secret(const u8 *pac_key, const u8 *server_random,
  69                                    const u8 *client_random, u8 *master_secret)
  70 {
  71 #define TLS_RANDOM_LEN 32
  72 #define TLS_MASTER_SECRET_LEN 48
  73         u8 seed[2 * TLS_RANDOM_LEN];
  74
  75         wpa_hexdump(MSG_DEBUG, "EAP-FAST: client_random",
  76                     client_random, TLS_RANDOM_LEN);
  77         wpa_hexdump(MSG_DEBUG, "EAP-FAST: server_random",
  78                     server_random, TLS_RANDOM_LEN);
  79
  80         /*
  81          * RFC 4851, Section 5.1:
  82          * master_secret = T-PRF(PAC-Key, "PAC to master secret label hash",
  83          *                       server_random + client_random, 48)
  84          */
  85         os_memcpy(seed, server_random, TLS_RANDOM_LEN);
  86         os_memcpy(seed + TLS_RANDOM_LEN, client_random, TLS_RANDOM_LEN);
  87         sha1_t_prf(pac_key, EAP_FAST_PAC_KEY_LEN,
  88                    "PAC to master secret label hash",
  89                    seed, sizeof(seed), master_secret, TLS_MASTER_SECRET_LEN);
  90
  91         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: master_secret",
  92                         master_secret, TLS_MASTER_SECRET_LEN);
  93 }
  94
  95
  96 u8 * eap_fast_derive_key(void *ssl_ctx, struct tls_connection *conn,
  97                          const char *label, size_t len)
  98 {
  99         struct tls_keys keys;
 100         u8 *rnd = NULL, *out;
 101         int block_size;
 102
 103         block_size = tls_connection_get_keyblock_size(ssl_ctx, conn);
 104         if (block_size < 0)
 105                 return NULL;
 106
 107         out = os_malloc(block_size + len);
 108         if (out == NULL)
 109                 return NULL;
 110
 111         if (tls_connection_prf(ssl_ctx, conn, label, 1, out, block_size + len)
 112             == 0) {
 113                 os_memmove(out, out + block_size, len);
 114                 return out;
 115         }
 116
 117         if (tls_connection_get_keys(ssl_ctx, conn, &keys))
 118                 goto fail;
 119
 120         rnd = os_malloc(keys.client_random_len + keys.server_random_len);
 121         if (rnd == NULL)
 122                 goto fail;
 123
 124         os_memcpy(rnd, keys.server_random, keys.server_random_len);
 125         os_memcpy(rnd + keys.server_random_len, keys.client_random,
 126                   keys.client_random_len);
 127
 128         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: master_secret for key "
 129                         "expansion", keys.master_key, keys.master_key_len);
 130         if (tls_prf_sha1_md5(keys.master_key, keys.master_key_len,
 131                              label, rnd, keys.client_random_len +
 132                              keys.server_random_len, out, block_size + len))
 133                 goto fail;
 134         os_free(rnd);
 135         os_memmove(out, out + block_size, len);
 136         return out;
 137
 138 fail:
 139         os_free(rnd);
 140         os_free(out);
 141         return NULL;
 142 }
 143
 144
 145 void eap_fast_derive_eap_msk(const u8 *simck, u8 *msk)
 146 {
 147         /*
 148          * RFC 4851, Section 5.4: EAP Master Session Key Generation
 149          * MSK = T-PRF(S-IMCK[j], "Session Key Generating Function", 64)
 150          */
 151
 152         sha1_t_prf(simck, EAP_FAST_SIMCK_LEN,
 153                    "Session Key Generating Function", (u8 *) "", 0,
 154                    msk, EAP_FAST_KEY_LEN);
 155         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Derived key (MSK)",
 156                         msk, EAP_FAST_KEY_LEN);
 157 }
 158
 159
 160 void eap_fast_derive_eap_emsk(const u8 *simck, u8 *emsk)
 161 {
 162         /*
 163          * RFC 4851, Section 5.4: EAP Master Session Key Genreration
 164          * EMSK = T-PRF(S-IMCK[j],
 165          *        "Extended Session Key Generating Function", 64)
 166          */
 167
 168         sha1_t_prf(simck, EAP_FAST_SIMCK_LEN,
 169                    "Extended Session Key Generating Function", (u8 *) "", 0,
 170                    emsk, EAP_EMSK_LEN);
 171         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Derived key (EMSK)",
 172                         emsk, EAP_EMSK_LEN);
 173 }
 174
 175
 176 int eap_fast_parse_tlv(struct eap_fast_tlv_parse *tlv,
 177                        int tlv_type, u8 *pos, int len)
 178 {
 179         switch (tlv_type) {
 180         case EAP_TLV_EAP_PAYLOAD_TLV:
 181                 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: EAP-Payload TLV",
 182                             pos, len);
 183                 if (tlv->eap_payload_tlv) {
 184                         wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
 185                                    "EAP-Payload TLV in the message");
 186                         tlv->iresult = EAP_TLV_RESULT_FAILURE;
 187                         return -2;
 188                 }
 189                 tlv->eap_payload_tlv = pos;
 190                 tlv->eap_payload_tlv_len = len;
 191                 break;
 192         case EAP_TLV_RESULT_TLV:
 193                 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Result TLV", pos, len);
 194                 if (tlv->result) {
 195                         wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
 196                                    "Result TLV in the message");
 197                         tlv->result = EAP_TLV_RESULT_FAILURE;
 198                         return -2;
 199                 }
 200                 if (len < 2) {
 201                         wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
 202                                    "Result TLV");
 203                         tlv->result = EAP_TLV_RESULT_FAILURE;
 204                         break;
 205                 }
 206                 tlv->result = WPA_GET_BE16(pos);
 207                 if (tlv->result != EAP_TLV_RESULT_SUCCESS &&
 208                     tlv->result != EAP_TLV_RESULT_FAILURE) {
 209                         wpa_printf(MSG_DEBUG, "EAP-FAST: Unknown Result %d",
 210                                    tlv->result);
 211                         tlv->result = EAP_TLV_RESULT_FAILURE;
 212                 }
 213                 wpa_printf(MSG_DEBUG, "EAP-FAST: Result: %s",
 214                            tlv->result == EAP_TLV_RESULT_SUCCESS ?
 215                            "Success" : "Failure");
 216                 break;
 217         case EAP_TLV_INTERMEDIATE_RESULT_TLV:
 218                 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Intermediate Result TLV",
 219                             pos, len);
 220                 if (len < 2) {
 221                         wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
 222                                    "Intermediate-Result TLV");
 223                         tlv->iresult = EAP_TLV_RESULT_FAILURE;
 224                         break;
 225                 }
 226                 if (tlv->iresult) {
 227                         wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
 228                                    "Intermediate-Result TLV in the message");
 229                         tlv->iresult = EAP_TLV_RESULT_FAILURE;
 230                         return -2;
 231                 }
 232                 tlv->iresult = WPA_GET_BE16(pos);
 233                 if (tlv->iresult != EAP_TLV_RESULT_SUCCESS &&
 234                     tlv->iresult != EAP_TLV_RESULT_FAILURE) {
 235                         wpa_printf(MSG_DEBUG, "EAP-FAST: Unknown Intermediate "
 236                                    "Result %d", tlv->iresult);
 237                         tlv->iresult = EAP_TLV_RESULT_FAILURE;
 238                 }
 239                 wpa_printf(MSG_DEBUG, "EAP-FAST: Intermediate Result: %s",
 240                            tlv->iresult == EAP_TLV_RESULT_SUCCESS ?
 241                            "Success" : "Failure");
 242                 break;
 243         case EAP_TLV_CRYPTO_BINDING_TLV:
 244                 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Crypto-Binding TLV",
 245                             pos, len);
 246                 if (tlv->crypto_binding) {
 247                         wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
 248                                    "Crypto-Binding TLV in the message");
 249                         tlv->iresult = EAP_TLV_RESULT_FAILURE;
 250                         return -2;
 251                 }
 252                 tlv->crypto_binding_len = sizeof(struct eap_tlv_hdr) + len;
 253                 if (tlv->crypto_binding_len < sizeof(*tlv->crypto_binding)) {
 254                         wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
 255                                    "Crypto-Binding TLV");
 256                         tlv->iresult = EAP_TLV_RESULT_FAILURE;
 257                         return -2;
 258                 }
 259                 tlv->crypto_binding = (struct eap_tlv_crypto_binding_tlv *)
 260                         (pos - sizeof(struct eap_tlv_hdr));
 261                 break;
 262         case EAP_TLV_REQUEST_ACTION_TLV:
 263                 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Request-Action TLV",
 264                             pos, len);
 265                 if (tlv->request_action) {
 266                         wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
 267                                    "Request-Action TLV in the message");
 268                         tlv->iresult = EAP_TLV_RESULT_FAILURE;
 269                         return -2;
 270                 }
 271                 if (len < 2) {
 272                         wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
 273                                    "Request-Action TLV");
 274                         tlv->iresult = EAP_TLV_RESULT_FAILURE;
 275                         break;
 276                 }
 277                 tlv->request_action = WPA_GET_BE16(pos);
 278                 wpa_printf(MSG_DEBUG, "EAP-FAST: Request-Action: %d",
 279                            tlv->request_action);
 280                 break;
 281         case EAP_TLV_PAC_TLV:
 282                 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: PAC TLV", pos, len);
 283                 if (tlv->pac) {
 284                         wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
 285                                    "PAC TLV in the message");
 286                         tlv->iresult = EAP_TLV_RESULT_FAILURE;
 287                         return -2;
 288                 }
 289                 tlv->pac = pos;
 290                 tlv->pac_len = len;
 291                 break;
 292         default:
 293                 /* Unknown TLV */
 294                 return -1;
 295         }
 296
 297         return 0;
 298 }