134689Sbde/* 250476Speter * EAP-FAST common helper functions (RFC 4851) 31573Srgrimes * Copyright (c) 2008, Jouni Malinen <j@w1.fi> 434689Sbde * 534689Sbde * This program is free software; you can redistribute it and/or modify 634689Sbde * it under the terms of the GNU General Public License version 2 as 738752Sbde * published by the Free Software Foundation. 8117675Smarkm * 9117675Smarkm * Alternatively, this software may be distributed under the terms of BSD 1081133Stmm * license. 1159897Sjoe * 1279471Smarkm * See README and COPYING for more details. 1350731Speter */ 14122568Sharti 1559353Skris#include "includes.h" 1641257Sjdp 1782355Smarkm#include "common.h" 1894690Sdes#include "crypto/sha1.h" 1941257Sjdp#include "crypto/tls.h" 2056081Sbde#include "eap_defs.h" 2194690Sdes#include "eap_tlv_common.h" 2234689Sbde#include "eap_fast_common.h" 2334689Sbde 2434689Sbde 25122568Shartivoid eap_fast_put_tlv_hdr(struct wpabuf *buf, u16 type, u16 len) 26126799Sphk{ 27135549Sdes struct pac_tlv_hdr hdr; 28135771Strhodes hdr.type = host_to_be16(type); 29154814Scognet hdr.len = host_to_be16(len); 30141403Sphk wpabuf_put_data(buf, &hdr, sizeof(hdr)); 31153838Sdfr} 32148000Srwatson 33137554Smarkm 34145341Smarcelvoid eap_fast_put_tlv(struct wpabuf *buf, u16 type, const void *data, 35132335Smarcel u16 len) 36137682Stjr{ 3734689Sbde eap_fast_put_tlv_hdr(buf, type, len); 38103436Speter wpabuf_put_data(buf, data, len); 39103436Speter} 4072309Sobrien 4134689Sbde 4272309Sobrienvoid eap_fast_put_tlv_buf(struct wpabuf *buf, u16 type, 4372309Sobrien const struct wpabuf *data) 441573Srgrimes{ 451573Srgrimes eap_fast_put_tlv_hdr(buf, type, wpabuf_len(data)); 46139105Sru wpabuf_put_buf(buf, data); 47119508Sphk} 48121340Sharti 49119508Sphk 50119508Sphkstruct wpabuf * eap_fast_tlv_eap_payload(struct wpabuf *buf) 5153927Speter{ 52135549Sdes struct wpabuf *e; 5353922Speter 5453922Speter if (buf == NULL) 55125123Semax return NULL; 56125123Semax 57125123Semax /* Encapsulate EAP packet in EAP-Payload TLV */ 58125123Semax wpa_printf(MSG_DEBUG, "EAP-FAST: Add EAP-Payload TLV"); 59131768Semax e = wpabuf_alloc(sizeof(struct pac_tlv_hdr) + wpabuf_len(buf)); 60131768Semax if (e == NULL) { 6152228Sbp wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to allocate memory " 6287960Ssheldonh "for TLV encapsulation"); 6334689Sbde wpabuf_free(buf); 6436026Sjb return NULL; 6534689Sbde } 66129237Sbde eap_fast_put_tlv_buf(e, 67139104Sru EAP_TLV_TYPE_MANDATORY | EAP_TLV_EAP_PAYLOAD_TLV, 68151727Sdavidxu buf); 69129236Sbde wpabuf_free(buf); 70129236Sbde return e; 7141912Sdfr} 7241912Sdfr 7341912Sdfr 7441912Sdfrvoid eap_fast_derive_master_secret(const u8 *pac_key, const u8 *server_random, 75129236Sbde const u8 *client_random, u8 *master_secret) 76129236Sbde{ 77129236Sbde#define TLS_RANDOM_LEN 32 78129236Sbde#define TLS_MASTER_SECRET_LEN 48 79129236Sbde u8 seed[2 * TLS_RANDOM_LEN]; 80129236Sbde 81129236Sbde wpa_hexdump(MSG_DEBUG, "EAP-FAST: client_random", 82139113Sru client_random, TLS_RANDOM_LEN); 83129236Sbde wpa_hexdump(MSG_DEBUG, "EAP-FAST: server_random", 84129236Sbde server_random, TLS_RANDOM_LEN); 85129236Sbde 86117950Speter /* 87117950Speter * RFC 4851, Section 5.1: 88117950Speter * master_secret = T-PRF(PAC-Key, "PAC to master secret label hash", 89118694Sdeischen * server_random + client_random, 48) 90118694Sdeischen */ 91150314Simura os_memcpy(seed, server_random, TLS_RANDOM_LEN); 92150314Simura os_memcpy(seed + TLS_RANDOM_LEN, client_random, TLS_RANDOM_LEN); 93150314Simura sha1_t_prf(pac_key, EAP_FAST_PAC_KEY_LEN, 94150314Simura "PAC to master secret label hash", 95139104Sru seed, sizeof(seed), master_secret, TLS_MASTER_SECRET_LEN); 96118675Sdeischen 97117950Speter wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: master_secret", 98117950Speter master_secret, TLS_MASTER_SECRET_LEN); 99144520Sdavidxu} 100144520Sdavidxu 101117797Smtm 102117797Smtmu8 * eap_fast_derive_key(void *ssl_ctx, struct tls_connection *conn, 103132335Smarcel const char *label, size_t len) 104144520Sdavidxu{ 105132335Smarcel struct tls_keys keys; 106132335Smarcel u8 *rnd = NULL, *out; 107129236Sbde int block_size; 108129236Sbde 109129225Scognet block_size = tls_connection_get_keyblock_size(ssl_ctx, conn); 110129225Scognet if (block_size < 0) 111137675Sbz return NULL; 112126799Sphk 113126799Sphk out = os_malloc(block_size + len); 114126799Sphk if (out == NULL) 115141403Sphk return NULL; 116141403Sphk 117141403Sphk if (tls_connection_prf(ssl_ctx, conn, label, 1, out, block_size + len) 118141403Sphk == 0) { 1191573Srgrimes os_memmove(out, out + block_size, len); 120 return out; 121 } 122 123 if (tls_connection_get_keys(ssl_ctx, conn, &keys)) 124 goto fail; 125 126 rnd = os_malloc(keys.client_random_len + keys.server_random_len); 127 if (rnd == NULL) 128 goto fail; 129 130 os_memcpy(rnd, keys.server_random, keys.server_random_len); 131 os_memcpy(rnd + keys.server_random_len, keys.client_random, 132 keys.client_random_len); 133 134 wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: master_secret for key " 135 "expansion", keys.master_key, keys.master_key_len); 136 if (tls_prf(keys.master_key, keys.master_key_len, 137 label, rnd, keys.client_random_len + 138 keys.server_random_len, out, block_size + len)) 139 goto fail; 140 os_free(rnd); 141 os_memmove(out, out + block_size, len); 142 return out; 143 144fail: 145 os_free(rnd); 146 os_free(out); 147 return NULL; 148} 149 150 151void eap_fast_derive_eap_msk(const u8 *simck, u8 *msk) 152{ 153 /* 154 * RFC 4851, Section 5.4: EAP Master Session Key Generation 155 * MSK = T-PRF(S-IMCK[j], "Session Key Generating Function", 64) 156 */ 157 158 sha1_t_prf(simck, EAP_FAST_SIMCK_LEN, 159 "Session Key Generating Function", (u8 *) "", 0, 160 msk, EAP_FAST_KEY_LEN); 161 wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Derived key (MSK)", 162 msk, EAP_FAST_KEY_LEN); 163} 164 165 166void eap_fast_derive_eap_emsk(const u8 *simck, u8 *emsk) 167{ 168 /* 169 * RFC 4851, Section 5.4: EAP Master Session Key Genreration 170 * EMSK = T-PRF(S-IMCK[j], 171 * "Extended Session Key Generating Function", 64) 172 */ 173 174 sha1_t_prf(simck, EAP_FAST_SIMCK_LEN, 175 "Extended Session Key Generating Function", (u8 *) "", 0, 176 emsk, EAP_EMSK_LEN); 177 wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Derived key (EMSK)", 178 emsk, EAP_EMSK_LEN); 179} 180 181 182int eap_fast_parse_tlv(struct eap_fast_tlv_parse *tlv, 183 int tlv_type, u8 *pos, int len) 184{ 185 switch (tlv_type) { 186 case EAP_TLV_EAP_PAYLOAD_TLV: 187 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: EAP-Payload TLV", 188 pos, len); 189 if (tlv->eap_payload_tlv) { 190 wpa_printf(MSG_DEBUG, "EAP-FAST: More than one " 191 "EAP-Payload TLV in the message"); 192 tlv->iresult = EAP_TLV_RESULT_FAILURE; 193 return -2; 194 } 195 tlv->eap_payload_tlv = pos; 196 tlv->eap_payload_tlv_len = len; 197 break; 198 case EAP_TLV_RESULT_TLV: 199 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Result TLV", pos, len); 200 if (tlv->result) { 201 wpa_printf(MSG_DEBUG, "EAP-FAST: More than one " 202 "Result TLV in the message"); 203 tlv->result = EAP_TLV_RESULT_FAILURE; 204 return -2; 205 } 206 if (len < 2) { 207 wpa_printf(MSG_DEBUG, "EAP-FAST: Too short " 208 "Result TLV"); 209 tlv->result = EAP_TLV_RESULT_FAILURE; 210 break; 211 } 212 tlv->result = WPA_GET_BE16(pos); 213 if (tlv->result != EAP_TLV_RESULT_SUCCESS && 214 tlv->result != EAP_TLV_RESULT_FAILURE) { 215 wpa_printf(MSG_DEBUG, "EAP-FAST: Unknown Result %d", 216 tlv->result); 217 tlv->result = EAP_TLV_RESULT_FAILURE; 218 } 219 wpa_printf(MSG_DEBUG, "EAP-FAST: Result: %s", 220 tlv->result == EAP_TLV_RESULT_SUCCESS ? 221 "Success" : "Failure"); 222 break; 223 case EAP_TLV_INTERMEDIATE_RESULT_TLV: 224 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Intermediate Result TLV", 225 pos, len); 226 if (len < 2) { 227 wpa_printf(MSG_DEBUG, "EAP-FAST: Too short " 228 "Intermediate-Result TLV"); 229 tlv->iresult = EAP_TLV_RESULT_FAILURE; 230 break; 231 } 232 if (tlv->iresult) { 233 wpa_printf(MSG_DEBUG, "EAP-FAST: More than one " 234 "Intermediate-Result TLV in the message"); 235 tlv->iresult = EAP_TLV_RESULT_FAILURE; 236 return -2; 237 } 238 tlv->iresult = WPA_GET_BE16(pos); 239 if (tlv->iresult != EAP_TLV_RESULT_SUCCESS && 240 tlv->iresult != EAP_TLV_RESULT_FAILURE) { 241 wpa_printf(MSG_DEBUG, "EAP-FAST: Unknown Intermediate " 242 "Result %d", tlv->iresult); 243 tlv->iresult = EAP_TLV_RESULT_FAILURE; 244 } 245 wpa_printf(MSG_DEBUG, "EAP-FAST: Intermediate Result: %s", 246 tlv->iresult == EAP_TLV_RESULT_SUCCESS ? 247 "Success" : "Failure"); 248 break; 249 case EAP_TLV_CRYPTO_BINDING_TLV: 250 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Crypto-Binding TLV", 251 pos, len); 252 if (tlv->crypto_binding) { 253 wpa_printf(MSG_DEBUG, "EAP-FAST: More than one " 254 "Crypto-Binding TLV in the message"); 255 tlv->iresult = EAP_TLV_RESULT_FAILURE; 256 return -2; 257 } 258 tlv->crypto_binding_len = sizeof(struct eap_tlv_hdr) + len; 259 if (tlv->crypto_binding_len < sizeof(*tlv->crypto_binding)) { 260 wpa_printf(MSG_DEBUG, "EAP-FAST: Too short " 261 "Crypto-Binding TLV"); 262 tlv->iresult = EAP_TLV_RESULT_FAILURE; 263 return -2; 264 } 265 tlv->crypto_binding = (struct eap_tlv_crypto_binding_tlv *) 266 (pos - sizeof(struct eap_tlv_hdr)); 267 break; 268 case EAP_TLV_REQUEST_ACTION_TLV: 269 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Request-Action TLV", 270 pos, len); 271 if (tlv->request_action) { 272 wpa_printf(MSG_DEBUG, "EAP-FAST: More than one " 273 "Request-Action TLV in the message"); 274 tlv->iresult = EAP_TLV_RESULT_FAILURE; 275 return -2; 276 } 277 if (len < 2) { 278 wpa_printf(MSG_DEBUG, "EAP-FAST: Too short " 279 "Request-Action TLV"); 280 tlv->iresult = EAP_TLV_RESULT_FAILURE; 281 break; 282 } 283 tlv->request_action = WPA_GET_BE16(pos); 284 wpa_printf(MSG_DEBUG, "EAP-FAST: Request-Action: %d", 285 tlv->request_action); 286 break; 287 case EAP_TLV_PAC_TLV: 288 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: PAC TLV", pos, len); 289 if (tlv->pac) { 290 wpa_printf(MSG_DEBUG, "EAP-FAST: More than one " 291 "PAC TLV in the message"); 292 tlv->iresult = EAP_TLV_RESULT_FAILURE; 293 return -2; 294 } 295 tlv->pac = pos; 296 tlv->pac_len = len; 297 break; 298 default: 299 /* Unknown TLV */ 300 return -1; 301 } 302 303 return 0; 304} 305