1/* 2 * EAP peer method: EAP-pwd (RFC 5931) 3 * Copyright (c) 2010, Dan Harkins <dharkins@lounge.org> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9#include "includes.h" 10 11#include "common.h" 12#include "crypto/sha256.h" 13#include "crypto/ms_funcs.h" 14#include "eap_peer/eap_i.h" 15#include "eap_common/eap_pwd_common.h" 16 17 18struct eap_pwd_data { 19 enum { 20 PWD_ID_Req, PWD_Commit_Req, PWD_Confirm_Req, 21 SUCCESS_ON_FRAG_COMPLETION, SUCCESS, FAILURE 22 } state; 23 u8 *id_peer; 24 size_t id_peer_len; 25 u8 *id_server; 26 size_t id_server_len; 27 u8 *password; 28 size_t password_len; 29 int password_hash; 30 u16 group_num; 31 EAP_PWD_group *grp; 32 33 struct wpabuf *inbuf; 34 size_t in_frag_pos; 35 struct wpabuf *outbuf; 36 size_t out_frag_pos; 37 size_t mtu; 38 39 BIGNUM *k; 40 BIGNUM *private_value; 41 BIGNUM *server_scalar; 42 BIGNUM *my_scalar; 43 EC_POINT *my_element; 44 EC_POINT *server_element; 45 46 u8 msk[EAP_MSK_LEN]; 47 u8 emsk[EAP_EMSK_LEN]; 48 u8 session_id[1 + SHA256_MAC_LEN]; 49 50 BN_CTX *bnctx; 51}; 52 53 54#ifndef CONFIG_NO_STDOUT_DEBUG 55static const char * eap_pwd_state_txt(int state) 56{ 57 switch (state) { 58 case PWD_ID_Req: 59 return "PWD-ID-Req"; 60 case PWD_Commit_Req: 61 return "PWD-Commit-Req"; 62 case PWD_Confirm_Req: 63 return "PWD-Confirm-Req"; 64 case SUCCESS_ON_FRAG_COMPLETION: 65 return "SUCCESS_ON_FRAG_COMPLETION"; 66 case SUCCESS: 67 return "SUCCESS"; 68 case FAILURE: 69 return "FAILURE"; 70 default: 71 return "PWD-UNK"; 72 } 73} 74#endif /* CONFIG_NO_STDOUT_DEBUG */ 75 76 77static void eap_pwd_state(struct eap_pwd_data *data, int state) 78{ 79 wpa_printf(MSG_DEBUG, "EAP-PWD: %s -> %s", 80 eap_pwd_state_txt(data->state), eap_pwd_state_txt(state)); 81 data->state = state; 82} 83 84 85static void * eap_pwd_init(struct eap_sm *sm) 86{ 87 struct eap_pwd_data *data; 88 const u8 *identity, *password; 89 size_t identity_len, password_len; 90 int fragment_size; 91 int pwhash; 92 93 password = eap_get_config_password2(sm, &password_len, &pwhash); 94 if (password == NULL) { 95 wpa_printf(MSG_INFO, "EAP-PWD: No password configured!"); 96 return NULL; 97 } 98 99 identity = eap_get_config_identity(sm, &identity_len); 100 if (identity == NULL) { 101 wpa_printf(MSG_INFO, "EAP-PWD: No identity configured!"); 102 return NULL; 103 } 104 105 if ((data = os_zalloc(sizeof(*data))) == NULL) { 106 wpa_printf(MSG_INFO, "EAP-PWD: memory allocation data fail"); 107 return NULL; 108 } 109 110 if ((data->bnctx = BN_CTX_new()) == NULL) { 111 wpa_printf(MSG_INFO, "EAP-PWD: bn context allocation fail"); 112 os_free(data); 113 return NULL; 114 } 115 116 if ((data->id_peer = os_malloc(identity_len)) == NULL) { 117 wpa_printf(MSG_INFO, "EAP-PWD: memory allocation id fail"); 118 BN_CTX_free(data->bnctx); 119 os_free(data); 120 return NULL; 121 } 122 123 os_memcpy(data->id_peer, identity, identity_len); 124 data->id_peer_len = identity_len; 125 126 if ((data->password = os_malloc(password_len)) == NULL) { 127 wpa_printf(MSG_INFO, "EAP-PWD: memory allocation psk fail"); 128 BN_CTX_free(data->bnctx); 129 bin_clear_free(data->id_peer, data->id_peer_len); 130 os_free(data); 131 return NULL; 132 } 133 os_memcpy(data->password, password, password_len); 134 data->password_len = password_len; 135 data->password_hash = pwhash; 136 137 data->out_frag_pos = data->in_frag_pos = 0; 138 data->inbuf = data->outbuf = NULL; 139 fragment_size = eap_get_config_fragment_size(sm); 140 if (fragment_size <= 0) 141 data->mtu = 1020; /* default from RFC 5931 */ 142 else 143 data->mtu = fragment_size; 144 145 data->state = PWD_ID_Req; 146 147 return data; 148} 149 150 151static void eap_pwd_deinit(struct eap_sm *sm, void *priv) 152{ 153 struct eap_pwd_data *data = priv; 154 155 BN_clear_free(data->private_value); 156 BN_clear_free(data->server_scalar); 157 BN_clear_free(data->my_scalar); 158 BN_clear_free(data->k); 159 BN_CTX_free(data->bnctx); 160 EC_POINT_clear_free(data->my_element); 161 EC_POINT_clear_free(data->server_element); 162 bin_clear_free(data->id_peer, data->id_peer_len); 163 bin_clear_free(data->id_server, data->id_server_len); 164 bin_clear_free(data->password, data->password_len); 165 if (data->grp) { 166 EC_GROUP_free(data->grp->group); 167 EC_POINT_clear_free(data->grp->pwe); 168 BN_clear_free(data->grp->order); 169 BN_clear_free(data->grp->prime); 170 os_free(data->grp); 171 } 172 wpabuf_free(data->inbuf); 173 wpabuf_free(data->outbuf); 174 bin_clear_free(data, sizeof(*data)); 175} 176 177 178static u8 * eap_pwd_getkey(struct eap_sm *sm, void *priv, size_t *len) 179{ 180 struct eap_pwd_data *data = priv; 181 u8 *key; 182 183 if (data->state != SUCCESS) 184 return NULL; 185 186 key = os_memdup(data->msk, EAP_MSK_LEN); 187 if (key == NULL) 188 return NULL; 189 190 *len = EAP_MSK_LEN; 191 192 return key; 193} 194 195 196static u8 * eap_pwd_get_session_id(struct eap_sm *sm, void *priv, size_t *len) 197{ 198 struct eap_pwd_data *data = priv; 199 u8 *id; 200 201 if (data->state != SUCCESS) 202 return NULL; 203 204 id = os_memdup(data->session_id, 1 + SHA256_MAC_LEN); 205 if (id == NULL) 206 return NULL; 207 208 *len = 1 + SHA256_MAC_LEN; 209 210 return id; 211} 212 213 214static void 215eap_pwd_perform_id_exchange(struct eap_sm *sm, struct eap_pwd_data *data, 216 struct eap_method_ret *ret, 217 const struct wpabuf *reqData, 218 const u8 *payload, size_t payload_len) 219{ 220 struct eap_pwd_id *id; 221 const u8 *password; 222 size_t password_len; 223 u8 pwhashhash[16]; 224 int res; 225 226 if (data->state != PWD_ID_Req) { 227 ret->ignore = TRUE; 228 eap_pwd_state(data, FAILURE); 229 return; 230 } 231 232 if (payload_len < sizeof(struct eap_pwd_id)) { 233 ret->ignore = TRUE; 234 eap_pwd_state(data, FAILURE); 235 return; 236 } 237 238 id = (struct eap_pwd_id *) payload; 239 data->group_num = be_to_host16(id->group_num); 240 wpa_printf(MSG_DEBUG, 241 "EAP-PWD: Server EAP-pwd-ID proposal: group=%u random=%u prf=%u prep=%u", 242 data->group_num, id->random_function, id->prf, id->prep); 243 if ((id->random_function != EAP_PWD_DEFAULT_RAND_FUNC) || 244 (id->prf != EAP_PWD_DEFAULT_PRF)) { 245 ret->ignore = TRUE; 246 eap_pwd_state(data, FAILURE); 247 return; 248 } 249 250 if (id->prep != EAP_PWD_PREP_NONE && 251 id->prep != EAP_PWD_PREP_MS) { 252 wpa_printf(MSG_DEBUG, 253 "EAP-PWD: Unsupported password pre-processing technique (Prep=%u)", 254 id->prep); 255 eap_pwd_state(data, FAILURE); 256 return; 257 } 258 259 if (id->prep == EAP_PWD_PREP_NONE && data->password_hash) { 260 wpa_printf(MSG_DEBUG, 261 "EAP-PWD: Unhashed password not available"); 262 eap_pwd_state(data, FAILURE); 263 return; 264 } 265 266 wpa_printf(MSG_DEBUG, "EAP-PWD (peer): using group %d", 267 data->group_num); 268 269 data->id_server = os_malloc(payload_len - sizeof(struct eap_pwd_id)); 270 if (data->id_server == NULL) { 271 wpa_printf(MSG_INFO, "EAP-PWD: memory allocation id fail"); 272 eap_pwd_state(data, FAILURE); 273 return; 274 } 275 data->id_server_len = payload_len - sizeof(struct eap_pwd_id); 276 os_memcpy(data->id_server, id->identity, data->id_server_len); 277 wpa_hexdump_ascii(MSG_INFO, "EAP-PWD (peer): server sent id of", 278 data->id_server, data->id_server_len); 279 280 data->grp = os_zalloc(sizeof(EAP_PWD_group)); 281 if (data->grp == NULL) { 282 wpa_printf(MSG_INFO, "EAP-PWD: failed to allocate memory for " 283 "group"); 284 eap_pwd_state(data, FAILURE); 285 return; 286 } 287 288 if (id->prep == EAP_PWD_PREP_MS) { 289#ifdef CONFIG_FIPS 290 wpa_printf(MSG_ERROR, 291 "EAP-PWD (peer): MS password hash not supported in FIPS mode"); 292 eap_pwd_state(data, FAILURE); 293 return; 294#else /* CONFIG_FIPS */ 295 if (data->password_hash) { 296 res = hash_nt_password_hash(data->password, pwhashhash); 297 } else { 298 u8 pwhash[16]; 299 300 res = nt_password_hash(data->password, 301 data->password_len, pwhash); 302 if (res == 0) 303 res = hash_nt_password_hash(pwhash, pwhashhash); 304 os_memset(pwhash, 0, sizeof(pwhash)); 305 } 306 307 if (res) { 308 eap_pwd_state(data, FAILURE); 309 return; 310 } 311 312 password = pwhashhash; 313 password_len = sizeof(pwhashhash); 314#endif /* CONFIG_FIPS */ 315 } else { 316 password = data->password; 317 password_len = data->password_len; 318 } 319 320 /* compute PWE */ 321 res = compute_password_element(data->grp, data->group_num, 322 password, password_len, 323 data->id_server, data->id_server_len, 324 data->id_peer, data->id_peer_len, 325 id->token); 326 os_memset(pwhashhash, 0, sizeof(pwhashhash)); 327 if (res) { 328 wpa_printf(MSG_INFO, "EAP-PWD (peer): unable to compute PWE"); 329 eap_pwd_state(data, FAILURE); 330 return; 331 } 332 333 wpa_printf(MSG_DEBUG, "EAP-PWD (peer): computed %d bit PWE...", 334 BN_num_bits(data->grp->prime)); 335 336 data->outbuf = wpabuf_alloc(sizeof(struct eap_pwd_id) + 337 data->id_peer_len); 338 if (data->outbuf == NULL) { 339 eap_pwd_state(data, FAILURE); 340 return; 341 } 342 wpabuf_put_be16(data->outbuf, data->group_num); 343 wpabuf_put_u8(data->outbuf, EAP_PWD_DEFAULT_RAND_FUNC); 344 wpabuf_put_u8(data->outbuf, EAP_PWD_DEFAULT_PRF); 345 wpabuf_put_data(data->outbuf, id->token, sizeof(id->token)); 346 wpabuf_put_u8(data->outbuf, id->prep); 347 wpabuf_put_data(data->outbuf, data->id_peer, data->id_peer_len); 348 349 eap_pwd_state(data, PWD_Commit_Req); 350} 351 352 353static void 354eap_pwd_perform_commit_exchange(struct eap_sm *sm, struct eap_pwd_data *data, 355 struct eap_method_ret *ret, 356 const struct wpabuf *reqData, 357 const u8 *payload, size_t payload_len) 358{ 359 EC_POINT *K = NULL, *point = NULL; 360 BIGNUM *mask = NULL, *x = NULL, *y = NULL, *cofactor = NULL; 361 u16 offset; 362 u8 *ptr, *scalar = NULL, *element = NULL; 363 size_t prime_len, order_len; 364 365 if (data->state != PWD_Commit_Req) { 366 ret->ignore = TRUE; 367 goto fin; 368 } 369 370 prime_len = BN_num_bytes(data->grp->prime); 371 order_len = BN_num_bytes(data->grp->order); 372 373 if (payload_len != 2 * prime_len + order_len) { 374 wpa_printf(MSG_INFO, 375 "EAP-pwd: Unexpected Commit payload length %u (expected %u)", 376 (unsigned int) payload_len, 377 (unsigned int) (2 * prime_len + order_len)); 378 goto fin; 379 } 380 381 if (((data->private_value = BN_new()) == NULL) || 382 ((data->my_element = EC_POINT_new(data->grp->group)) == NULL) || 383 ((cofactor = BN_new()) == NULL) || 384 ((data->my_scalar = BN_new()) == NULL) || 385 ((mask = BN_new()) == NULL)) { 386 wpa_printf(MSG_INFO, "EAP-PWD (peer): scalar allocation fail"); 387 goto fin; 388 } 389 390 if (!EC_GROUP_get_cofactor(data->grp->group, cofactor, NULL)) { 391 wpa_printf(MSG_INFO, "EAP-pwd (peer): unable to get cofactor " 392 "for curve"); 393 goto fin; 394 } 395 396 if (BN_rand_range(data->private_value, data->grp->order) != 1 || 397 BN_rand_range(mask, data->grp->order) != 1 || 398 BN_add(data->my_scalar, data->private_value, mask) != 1 || 399 BN_mod(data->my_scalar, data->my_scalar, data->grp->order, 400 data->bnctx) != 1) { 401 wpa_printf(MSG_INFO, 402 "EAP-pwd (peer): unable to get randomness"); 403 goto fin; 404 } 405 406 if (!EC_POINT_mul(data->grp->group, data->my_element, NULL, 407 data->grp->pwe, mask, data->bnctx)) { 408 wpa_printf(MSG_INFO, "EAP-PWD (peer): element allocation " 409 "fail"); 410 eap_pwd_state(data, FAILURE); 411 goto fin; 412 } 413 414 if (!EC_POINT_invert(data->grp->group, data->my_element, data->bnctx)) 415 { 416 wpa_printf(MSG_INFO, "EAP-PWD (peer): element inversion fail"); 417 goto fin; 418 } 419 420 if (((x = BN_new()) == NULL) || 421 ((y = BN_new()) == NULL)) { 422 wpa_printf(MSG_INFO, "EAP-PWD (peer): point allocation fail"); 423 goto fin; 424 } 425 426 /* process the request */ 427 if (((data->server_scalar = BN_new()) == NULL) || 428 ((data->k = BN_new()) == NULL) || 429 ((K = EC_POINT_new(data->grp->group)) == NULL) || 430 ((point = EC_POINT_new(data->grp->group)) == NULL) || 431 ((data->server_element = EC_POINT_new(data->grp->group)) == NULL)) 432 { 433 wpa_printf(MSG_INFO, "EAP-PWD (peer): peer data allocation " 434 "fail"); 435 goto fin; 436 } 437 438 /* element, x then y, followed by scalar */ 439 ptr = (u8 *) payload; 440 BN_bin2bn(ptr, BN_num_bytes(data->grp->prime), x); 441 ptr += BN_num_bytes(data->grp->prime); 442 BN_bin2bn(ptr, BN_num_bytes(data->grp->prime), y); 443 ptr += BN_num_bytes(data->grp->prime); 444 BN_bin2bn(ptr, BN_num_bytes(data->grp->order), data->server_scalar); 445 if (!EC_POINT_set_affine_coordinates_GFp(data->grp->group, 446 data->server_element, x, y, 447 data->bnctx)) { 448 wpa_printf(MSG_INFO, "EAP-PWD (peer): setting peer element " 449 "fail"); 450 goto fin; 451 } 452 453 /* check to ensure server's element is not in a small sub-group */ 454 if (BN_cmp(cofactor, BN_value_one())) { 455 if (!EC_POINT_mul(data->grp->group, point, NULL, 456 data->server_element, cofactor, NULL)) { 457 wpa_printf(MSG_INFO, "EAP-PWD (peer): cannot multiply " 458 "server element by order!\n"); 459 goto fin; 460 } 461 if (EC_POINT_is_at_infinity(data->grp->group, point)) { 462 wpa_printf(MSG_INFO, "EAP-PWD (peer): server element " 463 "is at infinity!\n"); 464 goto fin; 465 } 466 } 467 468 /* compute the shared key, k */ 469 if ((!EC_POINT_mul(data->grp->group, K, NULL, data->grp->pwe, 470 data->server_scalar, data->bnctx)) || 471 (!EC_POINT_add(data->grp->group, K, K, data->server_element, 472 data->bnctx)) || 473 (!EC_POINT_mul(data->grp->group, K, NULL, K, data->private_value, 474 data->bnctx))) { 475 wpa_printf(MSG_INFO, "EAP-PWD (peer): computing shared key " 476 "fail"); 477 goto fin; 478 } 479 480 /* ensure that the shared key isn't in a small sub-group */ 481 if (BN_cmp(cofactor, BN_value_one())) { 482 if (!EC_POINT_mul(data->grp->group, K, NULL, K, cofactor, 483 NULL)) { 484 wpa_printf(MSG_INFO, "EAP-PWD (peer): cannot multiply " 485 "shared key point by order"); 486 goto fin; 487 } 488 } 489 490 /* 491 * This check is strictly speaking just for the case above where 492 * co-factor > 1 but it was suggested that even though this is probably 493 * never going to happen it is a simple and safe check "just to be 494 * sure" so let's be safe. 495 */ 496 if (EC_POINT_is_at_infinity(data->grp->group, K)) { 497 wpa_printf(MSG_INFO, "EAP-PWD (peer): shared key point is at " 498 "infinity!\n"); 499 goto fin; 500 } 501 502 if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group, K, data->k, 503 NULL, data->bnctx)) { 504 wpa_printf(MSG_INFO, "EAP-PWD (peer): unable to extract " 505 "shared secret from point"); 506 goto fin; 507 } 508 509 /* now do the response */ 510 if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group, 511 data->my_element, x, y, 512 data->bnctx)) { 513 wpa_printf(MSG_INFO, "EAP-PWD (peer): point assignment fail"); 514 goto fin; 515 } 516 517 if (((scalar = os_malloc(BN_num_bytes(data->grp->order))) == NULL) || 518 ((element = os_malloc(BN_num_bytes(data->grp->prime) * 2)) == 519 NULL)) { 520 wpa_printf(MSG_INFO, "EAP-PWD (peer): data allocation fail"); 521 goto fin; 522 } 523 524 /* 525 * bignums occupy as little memory as possible so one that is 526 * sufficiently smaller than the prime or order might need pre-pending 527 * with zeros. 528 */ 529 os_memset(scalar, 0, BN_num_bytes(data->grp->order)); 530 os_memset(element, 0, BN_num_bytes(data->grp->prime) * 2); 531 offset = BN_num_bytes(data->grp->order) - 532 BN_num_bytes(data->my_scalar); 533 BN_bn2bin(data->my_scalar, scalar + offset); 534 535 offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(x); 536 BN_bn2bin(x, element + offset); 537 offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(y); 538 BN_bn2bin(y, element + BN_num_bytes(data->grp->prime) + offset); 539 540 data->outbuf = wpabuf_alloc(BN_num_bytes(data->grp->order) + 541 2 * BN_num_bytes(data->grp->prime)); 542 if (data->outbuf == NULL) 543 goto fin; 544 545 /* we send the element as (x,y) follwed by the scalar */ 546 wpabuf_put_data(data->outbuf, element, 547 2 * BN_num_bytes(data->grp->prime)); 548 wpabuf_put_data(data->outbuf, scalar, BN_num_bytes(data->grp->order)); 549 550fin: 551 os_free(scalar); 552 os_free(element); 553 BN_clear_free(x); 554 BN_clear_free(y); 555 BN_clear_free(mask); 556 BN_clear_free(cofactor); 557 EC_POINT_clear_free(K); 558 EC_POINT_clear_free(point); 559 if (data->outbuf == NULL) 560 eap_pwd_state(data, FAILURE); 561 else 562 eap_pwd_state(data, PWD_Confirm_Req); 563} 564 565 566static void 567eap_pwd_perform_confirm_exchange(struct eap_sm *sm, struct eap_pwd_data *data, 568 struct eap_method_ret *ret, 569 const struct wpabuf *reqData, 570 const u8 *payload, size_t payload_len) 571{ 572 BIGNUM *x = NULL, *y = NULL; 573 struct crypto_hash *hash; 574 u32 cs; 575 u16 grp; 576 u8 conf[SHA256_MAC_LEN], *cruft = NULL, *ptr; 577 int offset; 578 579 if (data->state != PWD_Confirm_Req) { 580 ret->ignore = TRUE; 581 goto fin; 582 } 583 584 if (payload_len != SHA256_MAC_LEN) { 585 wpa_printf(MSG_INFO, 586 "EAP-pwd: Unexpected Confirm payload length %u (expected %u)", 587 (unsigned int) payload_len, SHA256_MAC_LEN); 588 goto fin; 589 } 590 591 /* 592 * first build up the ciphersuite which is group | random_function | 593 * prf 594 */ 595 grp = htons(data->group_num); 596 ptr = (u8 *) &cs; 597 os_memcpy(ptr, &grp, sizeof(u16)); 598 ptr += sizeof(u16); 599 *ptr = EAP_PWD_DEFAULT_RAND_FUNC; 600 ptr += sizeof(u8); 601 *ptr = EAP_PWD_DEFAULT_PRF; 602 603 /* each component of the cruft will be at most as big as the prime */ 604 if (((cruft = os_malloc(BN_num_bytes(data->grp->prime))) == NULL) || 605 ((x = BN_new()) == NULL) || ((y = BN_new()) == NULL)) { 606 wpa_printf(MSG_INFO, "EAP-PWD (server): confirm allocation " 607 "fail"); 608 goto fin; 609 } 610 611 /* 612 * server's commit is H(k | server_element | server_scalar | 613 * peer_element | peer_scalar | ciphersuite) 614 */ 615 hash = eap_pwd_h_init(); 616 if (hash == NULL) 617 goto fin; 618 619 /* 620 * zero the memory each time because this is mod prime math and some 621 * value may start with a few zeros and the previous one did not. 622 */ 623 os_memset(cruft, 0, BN_num_bytes(data->grp->prime)); 624 offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(data->k); 625 BN_bn2bin(data->k, cruft + offset); 626 eap_pwd_h_update(hash, cruft, BN_num_bytes(data->grp->prime)); 627 628 /* server element: x, y */ 629 if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group, 630 data->server_element, x, y, 631 data->bnctx)) { 632 wpa_printf(MSG_INFO, "EAP-PWD (server): confirm point " 633 "assignment fail"); 634 goto fin; 635 } 636 os_memset(cruft, 0, BN_num_bytes(data->grp->prime)); 637 offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(x); 638 BN_bn2bin(x, cruft + offset); 639 eap_pwd_h_update(hash, cruft, BN_num_bytes(data->grp->prime)); 640 os_memset(cruft, 0, BN_num_bytes(data->grp->prime)); 641 offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(y); 642 BN_bn2bin(y, cruft + offset); 643 eap_pwd_h_update(hash, cruft, BN_num_bytes(data->grp->prime)); 644 645 /* server scalar */ 646 os_memset(cruft, 0, BN_num_bytes(data->grp->prime)); 647 offset = BN_num_bytes(data->grp->order) - 648 BN_num_bytes(data->server_scalar); 649 BN_bn2bin(data->server_scalar, cruft + offset); 650 eap_pwd_h_update(hash, cruft, BN_num_bytes(data->grp->order)); 651 652 /* my element: x, y */ 653 if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group, 654 data->my_element, x, y, 655 data->bnctx)) { 656 wpa_printf(MSG_INFO, "EAP-PWD (server): confirm point " 657 "assignment fail"); 658 goto fin; 659 } 660 661 os_memset(cruft, 0, BN_num_bytes(data->grp->prime)); 662 offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(x); 663 BN_bn2bin(x, cruft + offset); 664 eap_pwd_h_update(hash, cruft, BN_num_bytes(data->grp->prime)); 665 os_memset(cruft, 0, BN_num_bytes(data->grp->prime)); 666 offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(y); 667 BN_bn2bin(y, cruft + offset); 668 eap_pwd_h_update(hash, cruft, BN_num_bytes(data->grp->prime)); 669 670 /* my scalar */ 671 os_memset(cruft, 0, BN_num_bytes(data->grp->prime)); 672 offset = BN_num_bytes(data->grp->order) - 673 BN_num_bytes(data->my_scalar); 674 BN_bn2bin(data->my_scalar, cruft + offset); 675 eap_pwd_h_update(hash, cruft, BN_num_bytes(data->grp->order)); 676 677 /* the ciphersuite */ 678 eap_pwd_h_update(hash, (u8 *) &cs, sizeof(u32)); 679 680 /* random function fin */ 681 eap_pwd_h_final(hash, conf); 682 683 ptr = (u8 *) payload; 684 if (os_memcmp_const(conf, ptr, SHA256_MAC_LEN)) { 685 wpa_printf(MSG_INFO, "EAP-PWD (peer): confirm did not verify"); 686 goto fin; 687 } 688 689 wpa_printf(MSG_DEBUG, "EAP-pwd (peer): confirm verified"); 690 691 /* 692 * compute confirm: 693 * H(k | peer_element | peer_scalar | server_element | server_scalar | 694 * ciphersuite) 695 */ 696 hash = eap_pwd_h_init(); 697 if (hash == NULL) 698 goto fin; 699 700 /* k */ 701 os_memset(cruft, 0, BN_num_bytes(data->grp->prime)); 702 offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(data->k); 703 BN_bn2bin(data->k, cruft + offset); 704 eap_pwd_h_update(hash, cruft, BN_num_bytes(data->grp->prime)); 705 706 /* my element */ 707 if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group, 708 data->my_element, x, y, 709 data->bnctx)) { 710 wpa_printf(MSG_INFO, "EAP-PWD (peer): confirm point " 711 "assignment fail"); 712 goto fin; 713 } 714 os_memset(cruft, 0, BN_num_bytes(data->grp->prime)); 715 offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(x); 716 BN_bn2bin(x, cruft + offset); 717 eap_pwd_h_update(hash, cruft, BN_num_bytes(data->grp->prime)); 718 os_memset(cruft, 0, BN_num_bytes(data->grp->prime)); 719 offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(y); 720 BN_bn2bin(y, cruft + offset); 721 eap_pwd_h_update(hash, cruft, BN_num_bytes(data->grp->prime)); 722 723 /* my scalar */ 724 os_memset(cruft, 0, BN_num_bytes(data->grp->prime)); 725 offset = BN_num_bytes(data->grp->order) - 726 BN_num_bytes(data->my_scalar); 727 BN_bn2bin(data->my_scalar, cruft + offset); 728 eap_pwd_h_update(hash, cruft, BN_num_bytes(data->grp->order)); 729 730 /* server element: x, y */ 731 if (!EC_POINT_get_affine_coordinates_GFp(data->grp->group, 732 data->server_element, x, y, 733 data->bnctx)) { 734 wpa_printf(MSG_INFO, "EAP-PWD (peer): confirm point " 735 "assignment fail"); 736 goto fin; 737 } 738 os_memset(cruft, 0, BN_num_bytes(data->grp->prime)); 739 offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(x); 740 BN_bn2bin(x, cruft + offset); 741 eap_pwd_h_update(hash, cruft, BN_num_bytes(data->grp->prime)); 742 os_memset(cruft, 0, BN_num_bytes(data->grp->prime)); 743 offset = BN_num_bytes(data->grp->prime) - BN_num_bytes(y); 744 BN_bn2bin(y, cruft + offset); 745 eap_pwd_h_update(hash, cruft, BN_num_bytes(data->grp->prime)); 746 747 /* server scalar */ 748 os_memset(cruft, 0, BN_num_bytes(data->grp->prime)); 749 offset = BN_num_bytes(data->grp->order) - 750 BN_num_bytes(data->server_scalar); 751 BN_bn2bin(data->server_scalar, cruft + offset); 752 eap_pwd_h_update(hash, cruft, BN_num_bytes(data->grp->order)); 753 754 /* the ciphersuite */ 755 eap_pwd_h_update(hash, (u8 *) &cs, sizeof(u32)); 756 757 /* all done */ 758 eap_pwd_h_final(hash, conf); 759 760 if (compute_keys(data->grp, data->bnctx, data->k, 761 data->my_scalar, data->server_scalar, conf, ptr, 762 &cs, data->msk, data->emsk, data->session_id) < 0) { 763 wpa_printf(MSG_INFO, "EAP-PWD (peer): unable to compute MSK | " 764 "EMSK"); 765 goto fin; 766 } 767 768 data->outbuf = wpabuf_alloc(SHA256_MAC_LEN); 769 if (data->outbuf == NULL) 770 goto fin; 771 772 wpabuf_put_data(data->outbuf, conf, SHA256_MAC_LEN); 773 774fin: 775 if (data->grp) 776 bin_clear_free(cruft, BN_num_bytes(data->grp->prime)); 777 BN_clear_free(x); 778 BN_clear_free(y); 779 if (data->outbuf == NULL) { 780 ret->methodState = METHOD_DONE; 781 ret->decision = DECISION_FAIL; 782 eap_pwd_state(data, FAILURE); 783 } else { 784 eap_pwd_state(data, SUCCESS_ON_FRAG_COMPLETION); 785 } 786} 787 788 789static struct wpabuf * 790eap_pwd_process(struct eap_sm *sm, void *priv, struct eap_method_ret *ret, 791 const struct wpabuf *reqData) 792{ 793 struct eap_pwd_data *data = priv; 794 struct wpabuf *resp = NULL; 795 const u8 *pos, *buf; 796 size_t len; 797 u16 tot_len = 0; 798 u8 lm_exch; 799 800 pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_PWD, reqData, &len); 801 if ((pos == NULL) || (len < 1)) { 802 wpa_printf(MSG_DEBUG, "EAP-pwd: Got a frame but pos is %s and " 803 "len is %d", 804 pos == NULL ? "NULL" : "not NULL", (int) len); 805 ret->ignore = TRUE; 806 return NULL; 807 } 808 809 ret->ignore = FALSE; 810 ret->methodState = METHOD_MAY_CONT; 811 ret->decision = DECISION_FAIL; 812 ret->allowNotifications = FALSE; 813 814 lm_exch = *pos; 815 pos++; /* skip over the bits and the exch */ 816 len--; 817 818 /* 819 * we're fragmenting so send out the next fragment 820 */ 821 if (data->out_frag_pos) { 822 /* 823 * this should be an ACK 824 */ 825 if (len) 826 wpa_printf(MSG_INFO, "Bad Response! Fragmenting but " 827 "not an ACK"); 828 829 wpa_printf(MSG_DEBUG, "EAP-pwd: Got an ACK for a fragment"); 830 /* 831 * check if there are going to be more fragments 832 */ 833 len = wpabuf_len(data->outbuf) - data->out_frag_pos; 834 if ((len + EAP_PWD_HDR_SIZE) > data->mtu) { 835 len = data->mtu - EAP_PWD_HDR_SIZE; 836 EAP_PWD_SET_MORE_BIT(lm_exch); 837 } 838 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD, 839 EAP_PWD_HDR_SIZE + len, 840 EAP_CODE_RESPONSE, eap_get_id(reqData)); 841 if (resp == NULL) { 842 wpa_printf(MSG_INFO, "Unable to allocate memory for " 843 "next fragment!"); 844 return NULL; 845 } 846 wpabuf_put_u8(resp, lm_exch); 847 buf = wpabuf_head_u8(data->outbuf); 848 wpabuf_put_data(resp, buf + data->out_frag_pos, len); 849 data->out_frag_pos += len; 850 /* 851 * this is the last fragment so get rid of the out buffer 852 */ 853 if (data->out_frag_pos >= wpabuf_len(data->outbuf)) { 854 wpabuf_free(data->outbuf); 855 data->outbuf = NULL; 856 data->out_frag_pos = 0; 857 } 858 wpa_printf(MSG_DEBUG, "EAP-pwd: Send %s fragment of %d bytes", 859 data->out_frag_pos == 0 ? "last" : "next", 860 (int) len); 861 if (data->state == SUCCESS_ON_FRAG_COMPLETION) { 862 ret->methodState = METHOD_DONE; 863 ret->decision = DECISION_UNCOND_SUCC; 864 eap_pwd_state(data, SUCCESS); 865 } 866 return resp; 867 } 868 869 /* 870 * see if this is a fragment that needs buffering 871 * 872 * if it's the first fragment there'll be a length field 873 */ 874 if (EAP_PWD_GET_LENGTH_BIT(lm_exch)) { 875 if (len < 2) { 876 wpa_printf(MSG_DEBUG, 877 "EAP-pwd: Frame too short to contain Total-Length field"); 878 ret->ignore = TRUE; 879 return NULL; 880 } 881 tot_len = WPA_GET_BE16(pos); 882 wpa_printf(MSG_DEBUG, "EAP-pwd: Incoming fragments whose " 883 "total length = %d", tot_len); 884 if (tot_len > 15000) 885 return NULL; 886 if (data->inbuf) { 887 wpa_printf(MSG_DEBUG, 888 "EAP-pwd: Unexpected new fragment start when previous fragment is still in use"); 889 ret->ignore = TRUE; 890 return NULL; 891 } 892 data->inbuf = wpabuf_alloc(tot_len); 893 if (data->inbuf == NULL) { 894 wpa_printf(MSG_INFO, "Out of memory to buffer " 895 "fragments!"); 896 return NULL; 897 } 898 data->in_frag_pos = 0; 899 pos += sizeof(u16); 900 len -= sizeof(u16); 901 } 902 /* 903 * buffer and ACK the fragment 904 */ 905 if (EAP_PWD_GET_MORE_BIT(lm_exch) || data->in_frag_pos) { 906 data->in_frag_pos += len; 907 if (data->in_frag_pos > wpabuf_size(data->inbuf)) { 908 wpa_printf(MSG_INFO, "EAP-pwd: Buffer overflow attack " 909 "detected (%d vs. %d)!", 910 (int) data->in_frag_pos, 911 (int) wpabuf_len(data->inbuf)); 912 wpabuf_free(data->inbuf); 913 data->inbuf = NULL; 914 data->in_frag_pos = 0; 915 return NULL; 916 } 917 wpabuf_put_data(data->inbuf, pos, len); 918 } 919 if (EAP_PWD_GET_MORE_BIT(lm_exch)) { 920 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD, 921 EAP_PWD_HDR_SIZE, 922 EAP_CODE_RESPONSE, eap_get_id(reqData)); 923 if (resp != NULL) 924 wpabuf_put_u8(resp, (EAP_PWD_GET_EXCHANGE(lm_exch))); 925 wpa_printf(MSG_DEBUG, "EAP-pwd: ACKing a %d byte fragment", 926 (int) len); 927 return resp; 928 } 929 /* 930 * we're buffering and this is the last fragment 931 */ 932 if (data->in_frag_pos) { 933 wpa_printf(MSG_DEBUG, "EAP-pwd: Last fragment, %d bytes", 934 (int) len); 935 pos = wpabuf_head_u8(data->inbuf); 936 len = data->in_frag_pos; 937 } 938 wpa_printf(MSG_DEBUG, "EAP-pwd: processing frame: exch %d, len %d", 939 EAP_PWD_GET_EXCHANGE(lm_exch), (int) len); 940 941 switch (EAP_PWD_GET_EXCHANGE(lm_exch)) { 942 case EAP_PWD_OPCODE_ID_EXCH: 943 eap_pwd_perform_id_exchange(sm, data, ret, reqData, 944 pos, len); 945 break; 946 case EAP_PWD_OPCODE_COMMIT_EXCH: 947 eap_pwd_perform_commit_exchange(sm, data, ret, reqData, 948 pos, len); 949 break; 950 case EAP_PWD_OPCODE_CONFIRM_EXCH: 951 eap_pwd_perform_confirm_exchange(sm, data, ret, reqData, 952 pos, len); 953 break; 954 default: 955 wpa_printf(MSG_INFO, "EAP-pwd: Ignoring message with unknown " 956 "opcode %d", lm_exch); 957 break; 958 } 959 /* 960 * if we buffered the just processed input now's the time to free it 961 */ 962 if (data->in_frag_pos) { 963 wpabuf_free(data->inbuf); 964 data->inbuf = NULL; 965 data->in_frag_pos = 0; 966 } 967 968 if (data->outbuf == NULL) { 969 ret->methodState = METHOD_DONE; 970 ret->decision = DECISION_FAIL; 971 return NULL; /* generic failure */ 972 } 973 974 /* 975 * we have output! Do we need to fragment it? 976 */ 977 lm_exch = EAP_PWD_GET_EXCHANGE(lm_exch); 978 len = wpabuf_len(data->outbuf); 979 if ((len + EAP_PWD_HDR_SIZE) > data->mtu) { 980 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD, data->mtu, 981 EAP_CODE_RESPONSE, eap_get_id(reqData)); 982 /* 983 * if so it's the first so include a length field 984 */ 985 EAP_PWD_SET_LENGTH_BIT(lm_exch); 986 EAP_PWD_SET_MORE_BIT(lm_exch); 987 tot_len = len; 988 /* 989 * keep the packet at the MTU 990 */ 991 len = data->mtu - EAP_PWD_HDR_SIZE - sizeof(u16); 992 wpa_printf(MSG_DEBUG, "EAP-pwd: Fragmenting output, total " 993 "length = %d", tot_len); 994 } else { 995 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD, 996 EAP_PWD_HDR_SIZE + len, 997 EAP_CODE_RESPONSE, eap_get_id(reqData)); 998 } 999 if (resp == NULL) 1000 return NULL; 1001 1002 wpabuf_put_u8(resp, lm_exch); 1003 if (EAP_PWD_GET_LENGTH_BIT(lm_exch)) { 1004 wpabuf_put_be16(resp, tot_len); 1005 data->out_frag_pos += len; 1006 } 1007 buf = wpabuf_head_u8(data->outbuf); 1008 wpabuf_put_data(resp, buf, len); 1009 /* 1010 * if we're not fragmenting then there's no need to carry this around 1011 */ 1012 if (data->out_frag_pos == 0) { 1013 wpabuf_free(data->outbuf); 1014 data->outbuf = NULL; 1015 data->out_frag_pos = 0; 1016 if (data->state == SUCCESS_ON_FRAG_COMPLETION) { 1017 ret->methodState = METHOD_DONE; 1018 ret->decision = DECISION_UNCOND_SUCC; 1019 eap_pwd_state(data, SUCCESS); 1020 } 1021 } 1022 1023 return resp; 1024} 1025 1026 1027static Boolean eap_pwd_key_available(struct eap_sm *sm, void *priv) 1028{ 1029 struct eap_pwd_data *data = priv; 1030 return data->state == SUCCESS; 1031} 1032 1033 1034static u8 * eap_pwd_get_emsk(struct eap_sm *sm, void *priv, size_t *len) 1035{ 1036 struct eap_pwd_data *data = priv; 1037 u8 *key; 1038 1039 if (data->state != SUCCESS) 1040 return NULL; 1041 1042 if ((key = os_malloc(EAP_EMSK_LEN)) == NULL) 1043 return NULL; 1044 1045 os_memcpy(key, data->emsk, EAP_EMSK_LEN); 1046 *len = EAP_EMSK_LEN; 1047 1048 return key; 1049} 1050 1051 1052int eap_peer_pwd_register(void) 1053{ 1054 struct eap_method *eap; 1055 1056 eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION, 1057 EAP_VENDOR_IETF, EAP_TYPE_PWD, "PWD"); 1058 if (eap == NULL) 1059 return -1; 1060 1061 eap->init = eap_pwd_init; 1062 eap->deinit = eap_pwd_deinit; 1063 eap->process = eap_pwd_process; 1064 eap->isKeyAvailable = eap_pwd_key_available; 1065 eap->getKey = eap_pwd_getkey; 1066 eap->getSessionId = eap_pwd_get_session_id; 1067 eap->get_emsk = eap_pwd_get_emsk; 1068 1069 return eap_peer_method_register(eap); 1070} 1071