1 /*
2  * EAP-FAST common helper functions (RFC 4851)
3  * Copyright (c) 2008, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "includes.h"
10 
11 #include "common.h"
12 #include "crypto/sha1.h"
13 #include "crypto/tls.h"
14 #include "eap_defs.h"
15 #include "eap_tlv_common.h"
16 #include "eap_fast_common.h"
17 
18 
eap_fast_put_tlv_hdr(struct wpabuf * buf,u16 type,u16 len)19 void eap_fast_put_tlv_hdr(struct wpabuf *buf, u16 type, u16 len)
20 {
21 	struct pac_tlv_hdr hdr;
22 	hdr.type = host_to_be16(type);
23 	hdr.len = host_to_be16(len);
24 	wpabuf_put_data(buf, &hdr, sizeof(hdr));
25 }
26 
27 
eap_fast_put_tlv(struct wpabuf * buf,u16 type,const void * data,u16 len)28 void eap_fast_put_tlv(struct wpabuf *buf, u16 type, const void *data,
29 			     u16 len)
30 {
31 	eap_fast_put_tlv_hdr(buf, type, len);
32 	wpabuf_put_data(buf, data, len);
33 }
34 
35 
eap_fast_put_tlv_buf(struct wpabuf * buf,u16 type,const struct wpabuf * data)36 void eap_fast_put_tlv_buf(struct wpabuf *buf, u16 type,
37 				 const struct wpabuf *data)
38 {
39 	eap_fast_put_tlv_hdr(buf, type, wpabuf_len(data));
40 	wpabuf_put_buf(buf, data);
41 }
42 
43 
eap_fast_tlv_eap_payload(struct wpabuf * buf)44 struct wpabuf * eap_fast_tlv_eap_payload(struct wpabuf *buf)
45 {
46 	struct wpabuf *e;
47 
48 	if (buf == NULL)
49 		return NULL;
50 
51 	/* Encapsulate EAP packet in EAP-Payload TLV */
52 	wpa_printf(MSG_DEBUG, "EAP-FAST: Add EAP-Payload TLV");
53 	e = wpabuf_alloc(sizeof(struct pac_tlv_hdr) + wpabuf_len(buf));
54 	if (e == NULL) {
55 		wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to allocate memory "
56 			   "for TLV encapsulation");
57 		wpabuf_free(buf);
58 		return NULL;
59 	}
60 	eap_fast_put_tlv_buf(e,
61 			     EAP_TLV_TYPE_MANDATORY | EAP_TLV_EAP_PAYLOAD_TLV,
62 			     buf);
63 	wpabuf_free(buf);
64 	return e;
65 }
66 
67 
eap_fast_derive_master_secret(const u8 * pac_key,const u8 * server_random,const u8 * client_random,u8 * master_secret)68 void eap_fast_derive_master_secret(const u8 *pac_key, const u8 *server_random,
69 				   const u8 *client_random, u8 *master_secret)
70 {
71 #define TLS_RANDOM_LEN 32
72 #define TLS_MASTER_SECRET_LEN 48
73 	u8 seed[2 * TLS_RANDOM_LEN];
74 
75 	wpa_hexdump(MSG_DEBUG, "EAP-FAST: client_random",
76 		    client_random, TLS_RANDOM_LEN);
77 	wpa_hexdump(MSG_DEBUG, "EAP-FAST: server_random",
78 		    server_random, TLS_RANDOM_LEN);
79 
80 	/*
81 	 * RFC 4851, Section 5.1:
82 	 * master_secret = T-PRF(PAC-Key, "PAC to master secret label hash",
83 	 *                       server_random + client_random, 48)
84 	 */
85 	os_memcpy(seed, server_random, TLS_RANDOM_LEN);
86 	os_memcpy(seed + TLS_RANDOM_LEN, client_random, TLS_RANDOM_LEN);
87 	sha1_t_prf(pac_key, EAP_FAST_PAC_KEY_LEN,
88 		   "PAC to master secret label hash",
89 		   seed, sizeof(seed), master_secret, TLS_MASTER_SECRET_LEN);
90 
91 	wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: master_secret",
92 			master_secret, TLS_MASTER_SECRET_LEN);
93 }
94 
95 
eap_fast_derive_key(void * ssl_ctx,struct tls_connection * conn,size_t len)96 u8 * eap_fast_derive_key(void *ssl_ctx, struct tls_connection *conn, size_t len)
97 {
98 	u8 *out;
99 
100 	out = os_malloc(len);
101 	if (out == NULL)
102 		return NULL;
103 
104 	if (tls_connection_get_eap_fast_key(ssl_ctx, conn, out, len)) {
105 		os_free(out);
106 		return NULL;
107 	}
108 
109 	return out;
110 }
111 
112 
eap_fast_derive_eap_msk(const u8 * simck,u8 * msk)113 int eap_fast_derive_eap_msk(const u8 *simck, u8 *msk)
114 {
115 	/*
116 	 * RFC 4851, Section 5.4: EAP Master Session Key Generation
117 	 * MSK = T-PRF(S-IMCK[j], "Session Key Generating Function", 64)
118 	 */
119 
120 	if (sha1_t_prf(simck, EAP_FAST_SIMCK_LEN,
121 		       "Session Key Generating Function", (u8 *) "", 0,
122 		       msk, EAP_FAST_KEY_LEN) < 0)
123 		return -1;
124 	wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Derived key (MSK)",
125 			msk, EAP_FAST_KEY_LEN);
126 	return 0;
127 }
128 
129 
eap_fast_derive_eap_emsk(const u8 * simck,u8 * emsk)130 int eap_fast_derive_eap_emsk(const u8 *simck, u8 *emsk)
131 {
132 	/*
133 	 * RFC 4851, Section 5.4: EAP Master Session Key Genreration
134 	 * EMSK = T-PRF(S-IMCK[j],
135 	 *        "Extended Session Key Generating Function", 64)
136 	 */
137 
138 	if (sha1_t_prf(simck, EAP_FAST_SIMCK_LEN,
139 		       "Extended Session Key Generating Function", (u8 *) "", 0,
140 		       emsk, EAP_EMSK_LEN) < 0)
141 		return -1;
142 	wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Derived key (EMSK)",
143 			emsk, EAP_EMSK_LEN);
144 	return 0;
145 }
146 
147 
eap_fast_parse_tlv(struct eap_fast_tlv_parse * tlv,int tlv_type,u8 * pos,size_t len)148 int eap_fast_parse_tlv(struct eap_fast_tlv_parse *tlv,
149 		       int tlv_type, u8 *pos, size_t len)
150 {
151 	switch (tlv_type) {
152 	case EAP_TLV_EAP_PAYLOAD_TLV:
153 		wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: EAP-Payload TLV",
154 			    pos, len);
155 		if (tlv->eap_payload_tlv) {
156 			wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
157 				   "EAP-Payload TLV in the message");
158 			tlv->iresult = EAP_TLV_RESULT_FAILURE;
159 			return -2;
160 		}
161 		tlv->eap_payload_tlv = pos;
162 		tlv->eap_payload_tlv_len = len;
163 		break;
164 	case EAP_TLV_RESULT_TLV:
165 		wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Result TLV", pos, len);
166 		if (tlv->result) {
167 			wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
168 				   "Result TLV in the message");
169 			tlv->result = EAP_TLV_RESULT_FAILURE;
170 			return -2;
171 		}
172 		if (len < 2) {
173 			wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
174 				   "Result TLV");
175 			tlv->result = EAP_TLV_RESULT_FAILURE;
176 			break;
177 		}
178 		tlv->result = WPA_GET_BE16(pos);
179 		if (tlv->result != EAP_TLV_RESULT_SUCCESS &&
180 		    tlv->result != EAP_TLV_RESULT_FAILURE) {
181 			wpa_printf(MSG_DEBUG, "EAP-FAST: Unknown Result %d",
182 				   tlv->result);
183 			tlv->result = EAP_TLV_RESULT_FAILURE;
184 		}
185 		wpa_printf(MSG_DEBUG, "EAP-FAST: Result: %s",
186 			   tlv->result == EAP_TLV_RESULT_SUCCESS ?
187 			   "Success" : "Failure");
188 		break;
189 	case EAP_TLV_INTERMEDIATE_RESULT_TLV:
190 		wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Intermediate Result TLV",
191 			    pos, len);
192 		if (len < 2) {
193 			wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
194 				   "Intermediate-Result TLV");
195 			tlv->iresult = EAP_TLV_RESULT_FAILURE;
196 			break;
197 		}
198 		if (tlv->iresult) {
199 			wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
200 				   "Intermediate-Result TLV in the message");
201 			tlv->iresult = EAP_TLV_RESULT_FAILURE;
202 			return -2;
203 		}
204 		tlv->iresult = WPA_GET_BE16(pos);
205 		if (tlv->iresult != EAP_TLV_RESULT_SUCCESS &&
206 		    tlv->iresult != EAP_TLV_RESULT_FAILURE) {
207 			wpa_printf(MSG_DEBUG, "EAP-FAST: Unknown Intermediate "
208 				   "Result %d", tlv->iresult);
209 			tlv->iresult = EAP_TLV_RESULT_FAILURE;
210 		}
211 		wpa_printf(MSG_DEBUG, "EAP-FAST: Intermediate Result: %s",
212 			   tlv->iresult == EAP_TLV_RESULT_SUCCESS ?
213 			   "Success" : "Failure");
214 		break;
215 	case EAP_TLV_CRYPTO_BINDING_TLV:
216 		wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Crypto-Binding TLV",
217 			    pos, len);
218 		if (tlv->crypto_binding) {
219 			wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
220 				   "Crypto-Binding TLV in the message");
221 			tlv->iresult = EAP_TLV_RESULT_FAILURE;
222 			return -2;
223 		}
224 		tlv->crypto_binding_len = sizeof(struct eap_tlv_hdr) + len;
225 		if (tlv->crypto_binding_len < sizeof(*tlv->crypto_binding)) {
226 			wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
227 				   "Crypto-Binding TLV");
228 			tlv->iresult = EAP_TLV_RESULT_FAILURE;
229 			return -2;
230 		}
231 		tlv->crypto_binding = (struct eap_tlv_crypto_binding_tlv *)
232 			(pos - sizeof(struct eap_tlv_hdr));
233 		break;
234 	case EAP_TLV_REQUEST_ACTION_TLV:
235 		wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Request-Action TLV",
236 			    pos, len);
237 		if (tlv->request_action) {
238 			wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
239 				   "Request-Action TLV in the message");
240 			tlv->iresult = EAP_TLV_RESULT_FAILURE;
241 			return -2;
242 		}
243 		if (len < 2) {
244 			wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
245 				   "Request-Action TLV");
246 			tlv->iresult = EAP_TLV_RESULT_FAILURE;
247 			break;
248 		}
249 		tlv->request_action = WPA_GET_BE16(pos);
250 		wpa_printf(MSG_DEBUG, "EAP-FAST: Request-Action: %d",
251 			   tlv->request_action);
252 		break;
253 	case EAP_TLV_PAC_TLV:
254 		wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: PAC TLV", pos, len);
255 		if (tlv->pac) {
256 			wpa_printf(MSG_DEBUG, "EAP-FAST: More than one "
257 				   "PAC TLV in the message");
258 			tlv->iresult = EAP_TLV_RESULT_FAILURE;
259 			return -2;
260 		}
261 		tlv->pac = pos;
262 		tlv->pac_len = len;
263 		break;
264 	default:
265 		/* Unknown TLV */
266 		return -1;
267 	}
268 
269 	return 0;
270 }
271