1 /*
2 * EAP peer method: EAP-pwd (RFC 5931)
3 * Copyright (c) 2010, Dan Harkins <dharkins@lounge.org>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the BSD license.
7 *
8 * Alternatively, this software may be distributed under the terms of the
9 * GNU General Public License version 2 as published by the Free Software
10 * Foundation.
11 *
12 * See README and COPYING for more details.
13 */
14
15 #include "includes.h"
16
17 #include "common.h"
18 #include "eap_peer/eap_i.h"
19 #include "eap_common/eap_pwd_common.h"
20
21
22 struct eap_pwd_data {
23 enum {
24 PWD_ID_Req, PWD_Commit_Req, PWD_Confirm_Req, SUCCESS, FAILURE
25 } state;
26 u8 *id_peer;
27 size_t id_peer_len;
28 u8 *id_server;
29 size_t id_server_len;
30 u8 *password;
31 size_t password_len;
32 u16 group_num;
33 EAP_PWD_group *grp;
34
35 BIGNUM *k;
36 BIGNUM *private_value;
37 BIGNUM *server_scalar;
38 BIGNUM *my_scalar;
39 EC_POINT *my_element;
40 EC_POINT *server_element;
41
42 u8 msk[EAP_MSK_LEN];
43 u8 emsk[EAP_EMSK_LEN];
44
45 BN_CTX *bnctx;
46 };
47
48
49 #ifndef CONFIG_NO_STDOUT_DEBUG
eap_pwd_state_txt(int state)50 static const char * eap_pwd_state_txt(int state)
51 {
52 switch (state) {
53 case PWD_ID_Req:
54 return "PWD-ID-Req";
55 case PWD_Commit_Req:
56 return "PWD-Commit-Req";
57 case PWD_Confirm_Req:
58 return "PWD-Confirm-Req";
59 case SUCCESS:
60 return "SUCCESS";
61 case FAILURE:
62 return "FAILURE";
63 default:
64 return "PWD-UNK";
65 }
66 }
67 #endif /* CONFIG_NO_STDOUT_DEBUG */
68
69
eap_pwd_state(struct eap_pwd_data * data,int state)70 static void eap_pwd_state(struct eap_pwd_data *data, int state)
71 {
72 wpa_printf(MSG_INFO, "EAP-PWD: %s -> %s",
73 eap_pwd_state_txt(data->state), eap_pwd_state_txt(state));
74 data->state = state;
75 }
76
77
eap_pwd_init(struct eap_sm * sm)78 static void * eap_pwd_init(struct eap_sm *sm)
79 {
80 struct eap_pwd_data *data;
81 const u8 *identity, *password;
82 size_t identity_len, password_len;
83
84 password = eap_get_config_password(sm, &password_len);
85 if (password == NULL) {
86 wpa_printf(MSG_INFO, "EAP-PWD: No password configured!");
87 return NULL;
88 }
89
90 identity = eap_get_config_identity(sm, &identity_len);
91 if (identity == NULL) {
92 wpa_printf(MSG_INFO, "EAP-PWD: No identity configured!");
93 return NULL;
94 }
95
96 if ((data = os_zalloc(sizeof(*data))) == NULL) {
97 wpa_printf(MSG_INFO, "EAP-PWD: memory allocation data fail");
98 return NULL;
99 }
100
101 if ((data->bnctx = BN_CTX_new()) == NULL) {
102 wpa_printf(MSG_INFO, "EAP-PWD: bn context allocation fail");
103 os_free(data);
104 return NULL;
105 }
106
107 if ((data->id_peer = os_malloc(identity_len)) == NULL) {
108 wpa_printf(MSG_INFO, "EAP-PWD: memory allocation id fail");
109 BN_CTX_free(data->bnctx);
110 os_free(data);
111 return NULL;
112 }
113
114 os_memcpy(data->id_peer, identity, identity_len);
115 data->id_peer_len = identity_len;
116
117 if ((data->password = os_malloc(password_len)) == NULL) {
118 wpa_printf(MSG_INFO, "EAP-PWD: memory allocation psk fail");
119 BN_CTX_free(data->bnctx);
120 os_free(data->id_peer);
121 os_free(data);
122 return NULL;
123 }
124 os_memcpy(data->password, password, password_len);
125 data->password_len = password_len;
126
127 data->state = PWD_ID_Req;
128
129 return data;
130 }
131
132
eap_pwd_deinit(struct eap_sm * sm,void * priv)133 static void eap_pwd_deinit(struct eap_sm *sm, void *priv)
134 {
135 struct eap_pwd_data *data = priv;
136
137 BN_free(data->private_value);
138 BN_free(data->server_scalar);
139 BN_free(data->my_scalar);
140 BN_free(data->k);
141 BN_CTX_free(data->bnctx);
142 EC_POINT_free(data->my_element);
143 EC_POINT_free(data->server_element);
144 os_free(data->id_peer);
145 os_free(data->id_server);
146 os_free(data->password);
147 if (data->grp) {
148 EC_GROUP_free(data->grp->group);
149 EC_POINT_free(data->grp->pwe);
150 BN_free(data->grp->order);
151 BN_free(data->grp->prime);
152 os_free(data->grp);
153 }
154 os_free(data);
155 }
156
157
eap_pwd_getkey(struct eap_sm * sm,void * priv,size_t * len)158 static u8 * eap_pwd_getkey(struct eap_sm *sm, void *priv, size_t *len)
159 {
160 struct eap_pwd_data *data = priv;
161 u8 *key;
162
163 if (data->state != SUCCESS)
164 return NULL;
165
166 key = os_malloc(EAP_MSK_LEN);
167 if (key == NULL)
168 return NULL;
169
170 os_memcpy(key, data->msk, EAP_MSK_LEN);
171 *len = EAP_MSK_LEN;
172
173 return key;
174 }
175
176
177 static struct wpabuf *
eap_pwd_perform_id_exchange(struct eap_sm * sm,struct eap_pwd_data * data,struct eap_method_ret * ret,const struct wpabuf * reqData,const u8 * payload,size_t payload_len)178 eap_pwd_perform_id_exchange(struct eap_sm *sm, struct eap_pwd_data *data,
179 struct eap_method_ret *ret,
180 const struct wpabuf *reqData,
181 const u8 *payload, size_t payload_len)
182 {
183 struct eap_pwd_id *id;
184 struct wpabuf *resp;
185
186 if (data->state != PWD_ID_Req) {
187 ret->ignore = TRUE;
188 return NULL;
189 }
190
191 if (payload_len < sizeof(struct eap_pwd_id)) {
192 ret->ignore = TRUE;
193 return NULL;
194 }
195
196 id = (struct eap_pwd_id *) payload;
197 data->group_num = be_to_host16(id->group_num);
198 if ((id->random_function != EAP_PWD_DEFAULT_RAND_FUNC) ||
199 (id->prf != EAP_PWD_DEFAULT_PRF)) {
200 ret->ignore = TRUE;
201 return NULL;
202 }
203
204 wpa_printf(MSG_DEBUG, "EAP-PWD (peer): server said group %d",
205 data->group_num);
206
207 data->id_server = os_malloc(payload_len - sizeof(struct eap_pwd_id));
208 if (data->id_server == NULL) {
209 wpa_printf(MSG_INFO, "EAP-PWD: memory allocation id fail");
210 return NULL;
211 }
212 data->id_server_len = payload_len - sizeof(struct eap_pwd_id);
213 os_memcpy(data->id_server, id->identity, data->id_server_len);
214 wpa_hexdump_ascii(MSG_INFO, "EAP-PWD (peer): server sent id of",
215 data->id_server, data->id_server_len);
216
217 if ((data->grp = (EAP_PWD_group *) os_malloc(sizeof(EAP_PWD_group))) ==
218 NULL) {
219 wpa_printf(MSG_INFO, "EAP-PWD: failed to allocate memory for "
220 "group");
221 return NULL;
222 }
223
224 /* compute PWE */
225 if (compute_password_element(data->grp, data->group_num,
226 data->password, data->password_len,
227 data->id_server, data->id_server_len,
228 data->id_peer, data->id_peer_len,
229 id->token)) {
230 wpa_printf(MSG_INFO, "EAP-PWD (peer): unable to compute PWE");
231 return NULL;
232 }
233
234 wpa_printf(MSG_INFO, "EAP-PWD (peer): computed %d bit PWE...",
235 BN_num_bits(data->grp->prime));
236
237 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD,
238 1 + sizeof(struct eap_pwd_id) + data->id_peer_len,
239 EAP_CODE_RESPONSE, eap_get_id(reqData));
240 if (resp == NULL)
241 return NULL;
242
243 wpabuf_put_u8(resp, EAP_PWD_OPCODE_ID_EXCH);
244 wpabuf_put_be16(resp, data->group_num);
245 wpabuf_put_u8(resp, EAP_PWD_DEFAULT_RAND_FUNC);
246 wpabuf_put_u8(resp, EAP_PWD_DEFAULT_PRF);
247 wpabuf_put_data(resp, id->token, sizeof(id->token));
248 wpabuf_put_u8(resp, EAP_PWD_PREP_NONE);
249 wpabuf_put_data(resp, data->id_peer, data->id_peer_len);
250
251 eap_pwd_state(data, PWD_Commit_Req);
252
253 return resp;
254 }
255
256
257 static struct wpabuf *
eap_pwd_perform_commit_exchange(struct eap_sm * sm,struct eap_pwd_data * data,struct eap_method_ret * ret,const struct wpabuf * reqData,const u8 * payload,size_t payload_len)258 eap_pwd_perform_commit_exchange(struct eap_sm *sm, struct eap_pwd_data *data,
259 struct eap_method_ret *ret,
260 const struct wpabuf *reqData,
261 const u8 *payload, size_t payload_len)
262 {
263 struct wpabuf *resp = NULL;
264 EC_POINT *K = NULL, *point = NULL;
265 BIGNUM *mask = NULL, *x = NULL, *y = NULL, *cofactor = NULL;
266 u16 offset;
267 u8 *ptr, *scalar = NULL, *element = NULL;
268
269 if (((data->private_value = BN_new()) == NULL) ||
270 ((data->my_element = EC_POINT_new(data->grp->group)) == NULL) ||
271 ((cofactor = BN_new()) == NULL) ||
272 ((data->my_scalar = BN_new()) == NULL) ||
273 ((mask = BN_new()) == NULL)) {
274 wpa_printf(MSG_INFO, "EAP-PWD (peer): scalar allocation fail");
275 goto fin;
276 }
277
278 if (!EC_GROUP_get_cofactor(data->grp->group, cofactor, NULL)) {
279 wpa_printf(MSG_INFO, "EAP-pwd (peer): unable to get cofactor "
280 "for curve");
281 goto fin;
282 }
283
284 BN_rand_range(data->private_value, data->grp->order);
285 BN_rand_range(mask, data->grp->order);
286 BN_add(data->my_scalar, data->private_value, mask);
287 BN_mod(data->my_scalar, data->my_scalar, data->grp->order,
288 data->bnctx);
289
290 if (!EC_POINT_mul(data->grp->group, data->my_element, NULL,
291 data->grp->pwe, mask, data->bnctx)) {
292 wpa_printf(MSG_INFO, "EAP-PWD (peer): element allocation "
293 "fail");
294 eap_pwd_state(data, FAILURE);
295 goto fin;
296 }
297
298 if (!EC_POINT_invert(data->grp->group, data->my_element, data->bnctx))
299 {
300 wpa_printf(MSG_INFO, "EAP-PWD (peer): element inversion fail");
301 goto fin;
302 }
303 BN_free(mask);
304
305 if (((x = BN_new()) == NULL) ||
306 ((y = BN_new()) == NULL)) {
307 wpa_printf(MSG_INFO, "EAP-PWD (peer): point allocation fail");
308 goto fin;
309 }
310
311 /* process the request */
312 if (((data->server_scalar = BN_new()) == NULL) ||
313 ((data->k = BN_new()) == NULL) ||
314 ((K = EC_POINT_new(data->grp->group)) == NULL) ||
315 ((point = EC_POINT_new(data->grp->group)) == NULL) ||
316 ((data->server_element = EC_POINT_new(data->grp->group)) == NULL))
317 {
318 wpa_printf(MSG_INFO, "EAP-PWD (peer): peer data allocation "
319 "fail");
320 goto fin;
321 }
322
323 /* element, x then y, followed by scalar */
324 ptr = (u8 *) payload;
325 BN_bin2bn(ptr, BN_num_bytes(data->grp->prime), x);
326 ptr += BN_num_bytes(data->grp->prime);
327 BN_bin2bn(ptr, BN_num_bytes(data->grp->prime), y);
328 ptr += BN_num_bytes(data->grp->prime);
329 BN_bin2bn(ptr, BN_num_bytes(data->grp->order), data->server_scalar);
330 if (!EC_POINT_set_affine_coordinates_GFp(data->grp->group,
331 data->server_element, x, y,
332 data->bnctx)) {
333 wpa_printf(MSG_INFO, "EAP-PWD (peer): setting peer element "
334 "fail");
335 goto fin;
336 }
337
338 /* check to ensure server's element is not in a small sub-group */
339 if (BN_cmp(cofactor, BN_value_one())) {
340 if (!EC_POINT_mul(data->grp->group, point, NULL,
341 data->server_element, cofactor, NULL)) {
342 wpa_printf(MSG_INFO, "EAP-PWD (peer): cannot multiply "
343 "server element by order!\n");
344 goto fin;
345 }
346 if (EC_POINT_is_at_infinity(data->grp->group, point)) {
347 wpa_printf(MSG_INFO, "EAP-PWD (peer): server element "
348 "is at infinity!\n");
349 goto fin;
350 }
351 }
352
353 /* compute the shared key, k */
354 if ((!EC_POINT_mul(data->grp->group, K, NULL, data->grp->pwe,
355 data->server_scalar, data->bnctx)) ||
356 (!EC_POINT_add(data->grp->group, K, K, data->server_element,
357 data->bnctx)) ||
358 (!EC_POINT_mul(data->grp->group, K, NULL, K, data->private_value,
359 data->bnctx))) {
360 wpa_printf(MSG_INFO, "EAP-PWD (peer): computing shared key "
361 "fail");
362 goto fin;
363 }
364
365 /* ensure that the shared key isn't in a small sub-group */
366 if (BN_cmp(cofactor, BN_value_one())) {
367 if (!EC_POINT_mul(data->grp->group, K, NULL, K, cofactor,
368 NULL)) {
369 wpa_printf(MSG_INFO, "EAP-PWD (peer): cannot multiply "
370 "shared key point by order");
371 goto fin;
372 }
373 }
374
375 /*
376 * This check is strictly speaking just for the case above where
377 * co-factor > 1 but it was suggested that even though this is probably
378 * never going to happen it is a simple and safe check "just to be
379 * sure" so let's be safe.
380 */
381 if (EC_POINT_is_at_infinity(data->grp->group, K)) {
382 wpa_printf(MSG_INFO, "EAP-PWD (peer): shared key point is at "
383 "infinity!\n");
384 goto fin;
385 }
386
387 if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group, K, data->k,
388 NULL, data->bnctx)) {
389 wpa_printf(MSG_INFO, "EAP-PWD (peer): unable to extract "
390 "shared secret from point");
391 goto fin;
392 }
393
394 /* now do the response */
395 if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group,
396 data->my_element, x, y,
397 data->bnctx)) {
398 wpa_printf(MSG_INFO, "EAP-PWD (peer): point assignment fail");
399 goto fin;
400 }
401
402 if (((scalar = os_malloc(BN_num_bytes(data->grp->order))) == NULL) ||
403 ((element = os_malloc(BN_num_bytes(data->grp->prime) * 2)) ==
404 NULL)) {
405 wpa_printf(MSG_INFO, "EAP-PWD (peer): data allocation fail");
406 goto fin;
407 }
408
409 /*
410 * bignums occupy as little memory as possible so one that is
411 * sufficiently smaller than the prime or order might need pre-pending
412 * with zeros.
413 */
414 os_memset(scalar, 0, BN_num_bytes(data->grp->order));
415 os_memset(element, 0, BN_num_bytes(data->grp->prime) * 2);
416 offset = BN_num_bytes(data->grp->order) -
417 BN_num_bytes(data->my_scalar);
418 BN_bn2bin(data->my_scalar, scalar + offset);
419
420 offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(x);
421 BN_bn2bin(x, element + offset);
422 offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(y);
423 BN_bn2bin(y, element + BN_num_bytes(data->grp->prime) + offset);
424
425 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD,
426 sizeof(struct eap_pwd_hdr) +
427 BN_num_bytes(data->grp->order) +
428 (2 * BN_num_bytes(data->grp->prime)),
429 EAP_CODE_RESPONSE, eap_get_id(reqData));
430 if (resp == NULL)
431 goto fin;
432
433 wpabuf_put_u8(resp, EAP_PWD_OPCODE_COMMIT_EXCH);
434
435 /* we send the element as (x,y) follwed by the scalar */
436 wpabuf_put_data(resp, element, (2 * BN_num_bytes(data->grp->prime)));
437 wpabuf_put_data(resp, scalar, BN_num_bytes(data->grp->order));
438
439 fin:
440 os_free(scalar);
441 os_free(element);
442 BN_free(x);
443 BN_free(y);
444 BN_free(cofactor);
445 EC_POINT_free(K);
446 EC_POINT_free(point);
447 if (resp == NULL)
448 eap_pwd_state(data, FAILURE);
449 else
450 eap_pwd_state(data, PWD_Confirm_Req);
451
452 return resp;
453 }
454
455
456 static struct wpabuf *
eap_pwd_perform_confirm_exchange(struct eap_sm * sm,struct eap_pwd_data * data,struct eap_method_ret * ret,const struct wpabuf * reqData,const u8 * payload,size_t payload_len)457 eap_pwd_perform_confirm_exchange(struct eap_sm *sm, struct eap_pwd_data *data,
458 struct eap_method_ret *ret,
459 const struct wpabuf *reqData,
460 const u8 *payload, size_t payload_len)
461 {
462 struct wpabuf *resp = NULL;
463 BIGNUM *x = NULL, *y = NULL;
464 HMAC_CTX ctx;
465 u32 cs;
466 u16 grp;
467 u8 conf[SHA256_DIGEST_LENGTH], *cruft = NULL, *ptr;
468
469 /*
470 * first build up the ciphersuite which is group | random_function |
471 * prf
472 */
473 grp = htons(data->group_num);
474 ptr = (u8 *) &cs;
475 os_memcpy(ptr, &grp, sizeof(u16));
476 ptr += sizeof(u16);
477 *ptr = EAP_PWD_DEFAULT_RAND_FUNC;
478 ptr += sizeof(u8);
479 *ptr = EAP_PWD_DEFAULT_PRF;
480
481 /* each component of the cruft will be at most as big as the prime */
482 if (((cruft = os_malloc(BN_num_bytes(data->grp->prime))) == NULL) ||
483 ((x = BN_new()) == NULL) || ((y = BN_new()) == NULL)) {
484 wpa_printf(MSG_INFO, "EAP-PWD (server): debug allocation "
485 "fail");
486 goto fin;
487 }
488
489 /*
490 * server's commit is H(k | server_element | server_scalar |
491 * peer_element | peer_scalar | ciphersuite)
492 */
493 H_Init(&ctx);
494
495 /*
496 * zero the memory each time because this is mod prime math and some
497 * value may start with a few zeros and the previous one did not.
498 */
499 os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
500 BN_bn2bin(data->k, cruft);
501 H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
502
503 /* server element: x, y */
504 if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group,
505 data->server_element, x, y,
506 data->bnctx)) {
507 wpa_printf(MSG_INFO, "EAP-PWD (server): confirm point "
508 "assignment fail");
509 goto fin;
510 }
511 os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
512 BN_bn2bin(x, cruft);
513 H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
514 os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
515 BN_bn2bin(y, cruft);
516 H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
517
518 /* server scalar */
519 os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
520 BN_bn2bin(data->server_scalar, cruft);
521 H_Update(&ctx, cruft, BN_num_bytes(data->grp->order));
522
523 /* my element: x, y */
524 if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group,
525 data->my_element, x, y,
526 data->bnctx)) {
527 wpa_printf(MSG_INFO, "EAP-PWD (server): confirm point "
528 "assignment fail");
529 goto fin;
530 }
531
532 os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
533 BN_bn2bin(x, cruft);
534 H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
535 os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
536 BN_bn2bin(y, cruft);
537 H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
538
539 /* my scalar */
540 os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
541 BN_bn2bin(data->my_scalar, cruft);
542 H_Update(&ctx, cruft, BN_num_bytes(data->grp->order));
543
544 /* the ciphersuite */
545 H_Update(&ctx, (u8 *) &cs, sizeof(u32));
546
547 /* random function fin */
548 H_Final(&ctx, conf);
549
550 ptr = (u8 *) payload;
551 if (os_memcmp(conf, ptr, SHA256_DIGEST_LENGTH)) {
552 wpa_printf(MSG_INFO, "EAP-PWD (peer): confirm did not verify");
553 goto fin;
554 }
555
556 wpa_printf(MSG_DEBUG, "EAP-pwd (peer): confirm verified");
557
558 /*
559 * compute confirm:
560 * H(k | peer_element | peer_scalar | server_element | server_scalar |
561 * ciphersuite)
562 */
563 H_Init(&ctx);
564
565 /* k */
566 os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
567 BN_bn2bin(data->k, cruft);
568 H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
569
570 /* my element */
571 if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group,
572 data->my_element, x, y,
573 data->bnctx)) {
574 wpa_printf(MSG_INFO, "EAP-PWD (peer): confirm point "
575 "assignment fail");
576 goto fin;
577 }
578 os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
579 BN_bn2bin(x, cruft);
580 H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
581 os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
582 BN_bn2bin(y, cruft);
583 H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
584
585 /* my scalar */
586 os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
587 BN_bn2bin(data->my_scalar, cruft);
588 H_Update(&ctx, cruft, BN_num_bytes(data->grp->order));
589
590 /* server element: x, y */
591 if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group,
592 data->server_element, x, y,
593 data->bnctx)) {
594 wpa_printf(MSG_INFO, "EAP-PWD (peer): confirm point "
595 "assignment fail");
596 goto fin;
597 }
598 os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
599 BN_bn2bin(x, cruft);
600 H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
601 os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
602 BN_bn2bin(y, cruft);
603 H_Update(&ctx, cruft, BN_num_bytes(data->grp->prime));
604
605 /* server scalar */
606 os_memset(cruft, 0, BN_num_bytes(data->grp->prime));
607 BN_bn2bin(data->server_scalar, cruft);
608 H_Update(&ctx, cruft, BN_num_bytes(data->grp->order));
609
610 /* the ciphersuite */
611 H_Update(&ctx, (u8 *) &cs, sizeof(u32));
612
613 /* all done */
614 H_Final(&ctx, conf);
615
616 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD,
617 sizeof(struct eap_pwd_hdr) + SHA256_DIGEST_LENGTH,
618 EAP_CODE_RESPONSE, eap_get_id(reqData));
619 if (resp == NULL)
620 goto fin;
621
622 wpabuf_put_u8(resp, EAP_PWD_OPCODE_CONFIRM_EXCH);
623 wpabuf_put_data(resp, conf, SHA256_DIGEST_LENGTH);
624
625 if (compute_keys(data->grp, data->bnctx, data->k,
626 data->my_scalar, data->server_scalar, conf, ptr,
627 &cs, data->msk, data->emsk) < 0) {
628 wpa_printf(MSG_INFO, "EAP-PWD (peer): unable to compute MSK | "
629 "EMSK");
630 goto fin;
631 }
632
633 fin:
634 os_free(cruft);
635 BN_free(x);
636 BN_free(y);
637 ret->methodState = METHOD_DONE;
638 if (resp == NULL) {
639 ret->decision = DECISION_FAIL;
640 eap_pwd_state(data, FAILURE);
641 } else {
642 ret->decision = DECISION_UNCOND_SUCC;
643 eap_pwd_state(data, SUCCESS);
644 }
645
646 return resp;
647 }
648
649
650 static struct wpabuf *
eap_pwd_process(struct eap_sm * sm,void * priv,struct eap_method_ret * ret,const struct wpabuf * reqData)651 eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret,
652 const struct wpabuf *reqData)
653 {
654 struct eap_pwd_data *data = priv;
655 struct wpabuf *resp = NULL;
656 const u8 *pos;
657 size_t len;
658 u8 exch;
659
660 pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_PWD, reqData, &len);
661 if ((pos == NULL) || (len < 1)) {
662 ret->ignore = TRUE;
663 return NULL;
664 }
665
666 wpa_printf(MSG_INFO, "EAP-pwd: Received frame: opcode %d", *pos);
667
668 ret->ignore = FALSE;
669 ret->methodState = METHOD_MAY_CONT;
670 ret->decision = DECISION_FAIL;
671 ret->allowNotifications = FALSE;
672
673 exch = *pos & 0x3f;
674 switch (exch) {
675 case EAP_PWD_OPCODE_ID_EXCH:
676 resp = eap_pwd_perform_id_exchange(sm, data, ret, reqData,
677 pos + 1, len - 1);
678 break;
679 case EAP_PWD_OPCODE_COMMIT_EXCH:
680 resp = eap_pwd_perform_commit_exchange(sm, data, ret, reqData,
681 pos + 1, len - 1);
682 break;
683 case EAP_PWD_OPCODE_CONFIRM_EXCH:
684 resp = eap_pwd_perform_confirm_exchange(sm, data, ret, reqData,
685 pos + 1, len - 1);
686 break;
687 default:
688 wpa_printf(MSG_INFO, "EAP-pwd: Ignoring message with unknown "
689 "opcode %d", exch);
690 break;
691 }
692
693 return resp;
694 }
695
696
eap_pwd_key_available(struct eap_sm * sm,void * priv)697 static Boolean eap_pwd_key_available(struct eap_sm *sm, void *priv)
698 {
699 struct eap_pwd_data *data = priv;
700 return data->state == SUCCESS;
701 }
702
703
eap_pwd_get_emsk(struct eap_sm * sm,void * priv,size_t * len)704 static u8 * eap_pwd_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
705 {
706 struct eap_pwd_data *data = priv;
707 u8 *key;
708
709 if (data->state != SUCCESS)
710 return NULL;
711
712 if ((key = os_malloc(EAP_EMSK_LEN)) == NULL)
713 return NULL;
714
715 os_memcpy(key, data->emsk, EAP_EMSK_LEN);
716 *len = EAP_EMSK_LEN;
717
718 return key;
719 }
720
721
eap_peer_pwd_register(void)722 int eap_peer_pwd_register(void)
723 {
724 struct eap_method *eap;
725 int ret;
726
727 EVP_add_digest(EVP_sha256());
728 eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
729 EAP_VENDOR_IETF, EAP_TYPE_PWD, "PWD");
730 if (eap == NULL)
731 return -1;
732
733 eap->init = eap_pwd_init;
734 eap->deinit = eap_pwd_deinit;
735 eap->process = eap_pwd_process;
736 eap->isKeyAvailable = eap_pwd_key_available;
737 eap->getKey = eap_pwd_getkey;
738 eap->get_emsk = eap_pwd_get_emsk;
739
740 ret = eap_peer_method_register(eap);
741 if (ret)
742 eap_peer_method_free(eap);
743 return ret;
744 }
745