1 /*
2 * EAP peer method: EAP-PAX (RFC 4746)
3 * Copyright (c) 2005-2008, Jouni Malinen <j@w1.fi>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Alternatively, this software may be distributed under the terms of BSD
10 * license.
11 *
12 * See README and COPYING for more details.
13 */
14
15 #include "includes.h"
16
17 #include "common.h"
18 #include "crypto/random.h"
19 #include "eap_common/eap_pax_common.h"
20 #include "eap_i.h"
21
22 /*
23 * Note: only PAX_STD subprotocol is currently supported
24 *
25 * TODO: Add support with PAX_SEC with the mandatory to implement ciphersuite
26 * (HMAC_SHA1_128, IANA DH Group 14 (2048 bits), RSA-PKCS1-V1_5) and
27 * recommended ciphersuite (HMAC_SHA256_128, IANA DH Group 15 (3072 bits),
28 * RSAES-OAEP).
29 */
30
31 struct eap_pax_data {
32 enum { PAX_INIT, PAX_STD_2_SENT, PAX_DONE } state;
33 u8 mac_id, dh_group_id, public_key_id;
34 union {
35 u8 e[2 * EAP_PAX_RAND_LEN];
36 struct {
37 u8 x[EAP_PAX_RAND_LEN]; /* server rand */
38 u8 y[EAP_PAX_RAND_LEN]; /* client rand */
39 } r;
40 } rand;
41 char *cid;
42 size_t cid_len;
43 u8 ak[EAP_PAX_AK_LEN];
44 u8 mk[EAP_PAX_MK_LEN];
45 u8 ck[EAP_PAX_CK_LEN];
46 u8 ick[EAP_PAX_ICK_LEN];
47 };
48
49
50 static void eap_pax_deinit(struct eap_sm *sm, void *priv);
51
52
eap_pax_init(struct eap_sm * sm)53 static void * eap_pax_init(struct eap_sm *sm)
54 {
55 struct eap_pax_data *data;
56 const u8 *identity, *password;
57 size_t identity_len, password_len;
58
59 identity = eap_get_config_identity(sm, &identity_len);
60 password = eap_get_config_password(sm, &password_len);
61 if (!identity || !password) {
62 wpa_printf(MSG_INFO, "EAP-PAX: CID (nai) or key (password) "
63 "not configured");
64 return NULL;
65 }
66
67 if (password_len != EAP_PAX_AK_LEN) {
68 wpa_printf(MSG_INFO, "EAP-PAX: Invalid PSK length");
69 return NULL;
70 }
71
72 data = os_zalloc(sizeof(*data));
73 if (data == NULL)
74 return NULL;
75 data->state = PAX_INIT;
76
77 data->cid = os_malloc(identity_len);
78 if (data->cid == NULL) {
79 eap_pax_deinit(sm, data);
80 return NULL;
81 }
82 os_memcpy(data->cid, identity, identity_len);
83 data->cid_len = identity_len;
84
85 os_memcpy(data->ak, password, EAP_PAX_AK_LEN);
86
87 return data;
88 }
89
90
eap_pax_deinit(struct eap_sm * sm,void * priv)91 static void eap_pax_deinit(struct eap_sm *sm, void *priv)
92 {
93 struct eap_pax_data *data = priv;
94 os_free(data->cid);
95 os_free(data);
96 }
97
98
eap_pax_alloc_resp(const struct eap_pax_hdr * req,u8 id,u8 op_code,size_t plen)99 static struct wpabuf * eap_pax_alloc_resp(const struct eap_pax_hdr *req,
100 u8 id, u8 op_code, size_t plen)
101 {
102 struct wpabuf *resp;
103 struct eap_pax_hdr *pax;
104
105 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PAX,
106 sizeof(*pax) + plen, EAP_CODE_RESPONSE, id);
107 if (resp == NULL)
108 return NULL;
109
110 pax = wpabuf_put(resp, sizeof(*pax));
111 pax->op_code = op_code;
112 pax->flags = 0;
113 pax->mac_id = req->mac_id;
114 pax->dh_group_id = req->dh_group_id;
115 pax->public_key_id = req->public_key_id;
116
117 return resp;
118 }
119
120
eap_pax_process_std_1(struct eap_pax_data * data,struct eap_method_ret * ret,u8 id,const struct eap_pax_hdr * req,size_t req_plen)121 static struct wpabuf * eap_pax_process_std_1(struct eap_pax_data *data,
122 struct eap_method_ret *ret, u8 id,
123 const struct eap_pax_hdr *req,
124 size_t req_plen)
125 {
126 struct wpabuf *resp;
127 const u8 *pos;
128 u8 *rpos;
129 size_t left, plen;
130
131 wpa_printf(MSG_DEBUG, "EAP-PAX: PAX_STD-1 (received)");
132
133 if (data->state != PAX_INIT) {
134 wpa_printf(MSG_INFO, "EAP-PAX: PAX_STD-1 received in "
135 "unexpected state (%d) - ignored", data->state);
136 ret->ignore = TRUE;
137 return NULL;
138 }
139
140 if (req->flags & EAP_PAX_FLAGS_CE) {
141 wpa_printf(MSG_INFO, "EAP-PAX: PAX_STD-1 with CE flag set - "
142 "ignored");
143 ret->ignore = TRUE;
144 return NULL;
145 }
146
147 left = req_plen - sizeof(*req);
148
149 if (left < 2 + EAP_PAX_RAND_LEN) {
150 wpa_printf(MSG_INFO, "EAP-PAX: PAX_STD-1 with too short "
151 "payload");
152 ret->ignore = TRUE;
153 return NULL;
154 }
155
156 pos = (const u8 *) (req + 1);
157 if (WPA_GET_BE16(pos) != EAP_PAX_RAND_LEN) {
158 wpa_printf(MSG_INFO, "EAP-PAX: PAX_STD-1 with incorrect A "
159 "length %d (expected %d)",
160 WPA_GET_BE16(pos), EAP_PAX_RAND_LEN);
161 ret->ignore = TRUE;
162 return NULL;
163 }
164
165 pos += 2;
166 left -= 2;
167 os_memcpy(data->rand.r.x, pos, EAP_PAX_RAND_LEN);
168 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: X (server rand)",
169 data->rand.r.x, EAP_PAX_RAND_LEN);
170 pos += EAP_PAX_RAND_LEN;
171 left -= EAP_PAX_RAND_LEN;
172
173 if (left > 0) {
174 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: ignored extra payload",
175 pos, left);
176 }
177
178 if (random_get_bytes(data->rand.r.y, EAP_PAX_RAND_LEN)) {
179 wpa_printf(MSG_ERROR, "EAP-PAX: Failed to get random data");
180 ret->ignore = TRUE;
181 return NULL;
182 }
183 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: Y (client rand)",
184 data->rand.r.y, EAP_PAX_RAND_LEN);
185
186 if (eap_pax_initial_key_derivation(req->mac_id, data->ak, data->rand.e,
187 data->mk, data->ck, data->ick) < 0)
188 {
189 ret->ignore = TRUE;
190 return NULL;
191 }
192
193 wpa_printf(MSG_DEBUG, "EAP-PAX: PAX_STD-2 (sending)");
194
195 plen = 2 + EAP_PAX_RAND_LEN + 2 + data->cid_len + 2 + EAP_PAX_MAC_LEN +
196 EAP_PAX_ICV_LEN;
197 resp = eap_pax_alloc_resp(req, id, EAP_PAX_OP_STD_2, plen);
198 if (resp == NULL)
199 return NULL;
200
201 wpabuf_put_be16(resp, EAP_PAX_RAND_LEN);
202 wpabuf_put_data(resp, data->rand.r.y, EAP_PAX_RAND_LEN);
203 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: B = Y (client rand)",
204 data->rand.r.y, EAP_PAX_RAND_LEN);
205
206 wpabuf_put_be16(resp, data->cid_len);
207 wpabuf_put_data(resp, data->cid, data->cid_len);
208 wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-PAX: CID",
209 (u8 *) data->cid, data->cid_len);
210
211 wpabuf_put_be16(resp, EAP_PAX_MAC_LEN);
212 rpos = wpabuf_put(resp, EAP_PAX_MAC_LEN);
213 eap_pax_mac(req->mac_id, data->ck, EAP_PAX_CK_LEN,
214 data->rand.r.x, EAP_PAX_RAND_LEN,
215 data->rand.r.y, EAP_PAX_RAND_LEN,
216 (u8 *) data->cid, data->cid_len, rpos);
217 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: MAC_CK(A, B, CID)",
218 rpos, EAP_PAX_MAC_LEN);
219
220 /* Optional ADE could be added here, if needed */
221
222 rpos = wpabuf_put(resp, EAP_PAX_ICV_LEN);
223 eap_pax_mac(req->mac_id, data->ick, EAP_PAX_ICK_LEN,
224 wpabuf_head(resp), wpabuf_len(resp) - EAP_PAX_ICV_LEN,
225 NULL, 0, NULL, 0, rpos);
226 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: ICV", rpos, EAP_PAX_ICV_LEN);
227
228 data->state = PAX_STD_2_SENT;
229 data->mac_id = req->mac_id;
230 data->dh_group_id = req->dh_group_id;
231 data->public_key_id = req->public_key_id;
232
233 return resp;
234 }
235
236
eap_pax_process_std_3(struct eap_pax_data * data,struct eap_method_ret * ret,u8 id,const struct eap_pax_hdr * req,size_t req_plen)237 static struct wpabuf * eap_pax_process_std_3(struct eap_pax_data *data,
238 struct eap_method_ret *ret, u8 id,
239 const struct eap_pax_hdr *req,
240 size_t req_plen)
241 {
242 struct wpabuf *resp;
243 u8 *rpos, mac[EAP_PAX_MAC_LEN];
244 const u8 *pos;
245 size_t left;
246
247 wpa_printf(MSG_DEBUG, "EAP-PAX: PAX_STD-3 (received)");
248
249 if (data->state != PAX_STD_2_SENT) {
250 wpa_printf(MSG_INFO, "EAP-PAX: PAX_STD-3 received in "
251 "unexpected state (%d) - ignored", data->state);
252 ret->ignore = TRUE;
253 return NULL;
254 }
255
256 if (req->flags & EAP_PAX_FLAGS_CE) {
257 wpa_printf(MSG_INFO, "EAP-PAX: PAX_STD-3 with CE flag set - "
258 "ignored");
259 ret->ignore = TRUE;
260 return NULL;
261 }
262
263 left = req_plen - sizeof(*req);
264
265 if (left < 2 + EAP_PAX_MAC_LEN) {
266 wpa_printf(MSG_INFO, "EAP-PAX: PAX_STD-3 with too short "
267 "payload");
268 ret->ignore = TRUE;
269 return NULL;
270 }
271
272 pos = (const u8 *) (req + 1);
273 if (WPA_GET_BE16(pos) != EAP_PAX_MAC_LEN) {
274 wpa_printf(MSG_INFO, "EAP-PAX: PAX_STD-3 with incorrect "
275 "MAC_CK length %d (expected %d)",
276 WPA_GET_BE16(pos), EAP_PAX_MAC_LEN);
277 ret->ignore = TRUE;
278 return NULL;
279 }
280 pos += 2;
281 left -= 2;
282 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: MAC_CK(B, CID)",
283 pos, EAP_PAX_MAC_LEN);
284 eap_pax_mac(data->mac_id, data->ck, EAP_PAX_CK_LEN,
285 data->rand.r.y, EAP_PAX_RAND_LEN,
286 (u8 *) data->cid, data->cid_len, NULL, 0, mac);
287 if (os_memcmp(pos, mac, EAP_PAX_MAC_LEN) != 0) {
288 wpa_printf(MSG_INFO, "EAP-PAX: Invalid MAC_CK(B, CID) "
289 "received");
290 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: expected MAC_CK(B, CID)",
291 mac, EAP_PAX_MAC_LEN);
292 ret->methodState = METHOD_DONE;
293 ret->decision = DECISION_FAIL;
294 return NULL;
295 }
296
297 pos += EAP_PAX_MAC_LEN;
298 left -= EAP_PAX_MAC_LEN;
299
300 if (left > 0) {
301 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: ignored extra payload",
302 pos, left);
303 }
304
305 wpa_printf(MSG_DEBUG, "EAP-PAX: PAX-ACK (sending)");
306
307 resp = eap_pax_alloc_resp(req, id, EAP_PAX_OP_ACK, EAP_PAX_ICV_LEN);
308 if (resp == NULL)
309 return NULL;
310
311 /* Optional ADE could be added here, if needed */
312
313 rpos = wpabuf_put(resp, EAP_PAX_ICV_LEN);
314 eap_pax_mac(data->mac_id, data->ick, EAP_PAX_ICK_LEN,
315 wpabuf_head(resp), wpabuf_len(resp) - EAP_PAX_ICV_LEN,
316 NULL, 0, NULL, 0, rpos);
317 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: ICV", rpos, EAP_PAX_ICV_LEN);
318
319 data->state = PAX_DONE;
320 ret->methodState = METHOD_DONE;
321 ret->decision = DECISION_UNCOND_SUCC;
322 ret->allowNotifications = FALSE;
323
324 return resp;
325 }
326
327
eap_pax_process(struct eap_sm * sm,void * priv,struct eap_method_ret * ret,const struct wpabuf * reqData)328 static struct wpabuf * eap_pax_process(struct eap_sm *sm, void *priv,
329 struct eap_method_ret *ret,
330 const struct wpabuf *reqData)
331 {
332 struct eap_pax_data *data = priv;
333 const struct eap_pax_hdr *req;
334 struct wpabuf *resp;
335 u8 icvbuf[EAP_PAX_ICV_LEN], id;
336 const u8 *icv, *pos;
337 size_t len;
338 u16 flen, mlen;
339
340 pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_PAX, reqData, &len);
341 if (pos == NULL || len < EAP_PAX_ICV_LEN) {
342 ret->ignore = TRUE;
343 return NULL;
344 }
345 id = eap_get_id(reqData);
346 req = (const struct eap_pax_hdr *) pos;
347 flen = len - EAP_PAX_ICV_LEN;
348 mlen = wpabuf_len(reqData) - EAP_PAX_ICV_LEN;
349
350 wpa_printf(MSG_DEBUG, "EAP-PAX: received frame: op_code 0x%x "
351 "flags 0x%x mac_id 0x%x dh_group_id 0x%x "
352 "public_key_id 0x%x",
353 req->op_code, req->flags, req->mac_id, req->dh_group_id,
354 req->public_key_id);
355 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: received payload",
356 pos, len - EAP_PAX_ICV_LEN);
357
358 if (data->state != PAX_INIT && data->mac_id != req->mac_id) {
359 wpa_printf(MSG_INFO, "EAP-PAX: MAC ID changed during "
360 "authentication (was 0x%d, is 0x%d)",
361 data->mac_id, req->mac_id);
362 ret->ignore = TRUE;
363 return NULL;
364 }
365
366 if (data->state != PAX_INIT && data->dh_group_id != req->dh_group_id) {
367 wpa_printf(MSG_INFO, "EAP-PAX: DH Group ID changed during "
368 "authentication (was 0x%d, is 0x%d)",
369 data->dh_group_id, req->dh_group_id);
370 ret->ignore = TRUE;
371 return NULL;
372 }
373
374 if (data->state != PAX_INIT &&
375 data->public_key_id != req->public_key_id) {
376 wpa_printf(MSG_INFO, "EAP-PAX: Public Key ID changed during "
377 "authentication (was 0x%d, is 0x%d)",
378 data->public_key_id, req->public_key_id);
379 ret->ignore = TRUE;
380 return NULL;
381 }
382
383 /* TODO: add support EAP_PAX_HMAC_SHA256_128 */
384 if (req->mac_id != EAP_PAX_MAC_HMAC_SHA1_128) {
385 wpa_printf(MSG_INFO, "EAP-PAX: Unsupported MAC ID 0x%x",
386 req->mac_id);
387 ret->ignore = TRUE;
388 return NULL;
389 }
390
391 if (req->dh_group_id != EAP_PAX_DH_GROUP_NONE) {
392 wpa_printf(MSG_INFO, "EAP-PAX: Unsupported DH Group ID 0x%x",
393 req->dh_group_id);
394 ret->ignore = TRUE;
395 return NULL;
396 }
397
398 if (req->public_key_id != EAP_PAX_PUBLIC_KEY_NONE) {
399 wpa_printf(MSG_INFO, "EAP-PAX: Unsupported Public Key ID 0x%x",
400 req->public_key_id);
401 ret->ignore = TRUE;
402 return NULL;
403 }
404
405 if (req->flags & EAP_PAX_FLAGS_MF) {
406 /* TODO: add support for reassembling fragments */
407 wpa_printf(MSG_INFO, "EAP-PAX: fragmentation not supported - "
408 "ignored packet");
409 ret->ignore = TRUE;
410 return NULL;
411 }
412
413 icv = pos + len - EAP_PAX_ICV_LEN;
414 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: ICV", icv, EAP_PAX_ICV_LEN);
415 if (req->op_code == EAP_PAX_OP_STD_1) {
416 eap_pax_mac(req->mac_id, (u8 *) "", 0,
417 wpabuf_head(reqData), mlen, NULL, 0, NULL, 0,
418 icvbuf);
419 } else {
420 eap_pax_mac(req->mac_id, data->ick, EAP_PAX_ICK_LEN,
421 wpabuf_head(reqData), mlen, NULL, 0, NULL, 0,
422 icvbuf);
423 }
424 if (os_memcmp(icv, icvbuf, EAP_PAX_ICV_LEN) != 0) {
425 wpa_printf(MSG_DEBUG, "EAP-PAX: invalid ICV - ignoring the "
426 "message");
427 wpa_hexdump(MSG_MSGDUMP, "EAP-PAX: expected ICV",
428 icvbuf, EAP_PAX_ICV_LEN);
429 ret->ignore = TRUE;
430 return NULL;
431 }
432
433 ret->ignore = FALSE;
434 ret->methodState = METHOD_MAY_CONT;
435 ret->decision = DECISION_FAIL;
436 ret->allowNotifications = TRUE;
437
438 switch (req->op_code) {
439 case EAP_PAX_OP_STD_1:
440 resp = eap_pax_process_std_1(data, ret, id, req, flen);
441 break;
442 case EAP_PAX_OP_STD_3:
443 resp = eap_pax_process_std_3(data, ret, id, req, flen);
444 break;
445 default:
446 wpa_printf(MSG_DEBUG, "EAP-PAX: ignoring message with unknown "
447 "op_code %d", req->op_code);
448 ret->ignore = TRUE;
449 return NULL;
450 }
451
452 if (ret->methodState == METHOD_DONE) {
453 ret->allowNotifications = FALSE;
454 }
455
456 return resp;
457 }
458
459
eap_pax_isKeyAvailable(struct eap_sm * sm,void * priv)460 static Boolean eap_pax_isKeyAvailable(struct eap_sm *sm, void *priv)
461 {
462 struct eap_pax_data *data = priv;
463 return data->state == PAX_DONE;
464 }
465
466
eap_pax_getKey(struct eap_sm * sm,void * priv,size_t * len)467 static u8 * eap_pax_getKey(struct eap_sm *sm, void *priv, size_t *len)
468 {
469 struct eap_pax_data *data = priv;
470 u8 *key;
471
472 if (data->state != PAX_DONE)
473 return NULL;
474
475 key = os_malloc(EAP_MSK_LEN);
476 if (key == NULL)
477 return NULL;
478
479 *len = EAP_MSK_LEN;
480 eap_pax_kdf(data->mac_id, data->mk, EAP_PAX_MK_LEN,
481 "Master Session Key", data->rand.e, 2 * EAP_PAX_RAND_LEN,
482 EAP_MSK_LEN, key);
483
484 return key;
485 }
486
487
eap_pax_get_emsk(struct eap_sm * sm,void * priv,size_t * len)488 static u8 * eap_pax_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
489 {
490 struct eap_pax_data *data = priv;
491 u8 *key;
492
493 if (data->state != PAX_DONE)
494 return NULL;
495
496 key = os_malloc(EAP_EMSK_LEN);
497 if (key == NULL)
498 return NULL;
499
500 *len = EAP_EMSK_LEN;
501 eap_pax_kdf(data->mac_id, data->mk, EAP_PAX_MK_LEN,
502 "Extended Master Session Key",
503 data->rand.e, 2 * EAP_PAX_RAND_LEN,
504 EAP_EMSK_LEN, key);
505
506 return key;
507 }
508
509
eap_peer_pax_register(void)510 int eap_peer_pax_register(void)
511 {
512 struct eap_method *eap;
513 int ret;
514
515 eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
516 EAP_VENDOR_IETF, EAP_TYPE_PAX, "PAX");
517 if (eap == NULL)
518 return -1;
519
520 eap->init = eap_pax_init;
521 eap->deinit = eap_pax_deinit;
522 eap->process = eap_pax_process;
523 eap->isKeyAvailable = eap_pax_isKeyAvailable;
524 eap->getKey = eap_pax_getKey;
525 eap->get_emsk = eap_pax_get_emsk;
526
527 ret = eap_peer_method_register(eap);
528 if (ret)
529 eap_peer_method_free(eap);
530 return ret;
531 }
532