2018-05-01 20:32:47 +02:00
|
|
|
/*
|
|
|
|
*
|
|
|
|
* Wireless daemon for Linux
|
|
|
|
*
|
|
|
|
* Copyright (C) 2018 Intel Corporation. All rights reserved.
|
|
|
|
*
|
|
|
|
* This library is free software; you can redistribute it and/or
|
|
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
|
|
* License as published by the Free Software Foundation; either
|
|
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
|
|
*
|
|
|
|
* This library is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
|
|
* Lesser General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
|
|
* License along with this library; if not, write to the Free Software
|
|
|
|
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
|
|
|
|
*
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifdef HAVE_CONFIG_H
|
|
|
|
#include <config.h>
|
|
|
|
#endif
|
|
|
|
|
2019-01-10 20:51:10 +01:00
|
|
|
#include <stdio.h>
|
|
|
|
|
2018-05-01 20:32:47 +02:00
|
|
|
#include <ell/ell.h>
|
|
|
|
|
|
|
|
#include "eap.h"
|
2018-06-15 02:57:24 +02:00
|
|
|
#include "eap-private.h"
|
2018-09-01 00:37:54 +02:00
|
|
|
#include "crypto.h"
|
2018-05-01 20:32:47 +02:00
|
|
|
#include "util.h"
|
|
|
|
|
|
|
|
#define EAP_PWD_GROUP_DESC 19
|
|
|
|
#define EAP_PWD_RAND_FN 0x01
|
|
|
|
#define EAP_PWD_PRF 0x01
|
|
|
|
|
|
|
|
/* EAP header + PWD-Exch */
|
|
|
|
#define EAP_PWD_HDR_LEN 6
|
|
|
|
#define EAP_PWD_L_BIT (1 << 7)
|
|
|
|
#define EAP_PWD_M_BIT (1 << 6)
|
|
|
|
|
|
|
|
enum eap_pwd_prep {
|
|
|
|
EAP_PWD_PREP_NONE = 0x00,
|
|
|
|
EAP_PWD_PREP_MS = 0x01,
|
|
|
|
EAP_PWD_PREP_SASL = 0x02
|
|
|
|
};
|
|
|
|
|
|
|
|
enum eap_pwd_exch {
|
|
|
|
EAP_PWD_EXCH_RESERVED = 0,
|
|
|
|
EAP_PWD_EXCH_ID,
|
|
|
|
EAP_PWD_EXCH_COMMIT,
|
|
|
|
EAP_PWD_EXCH_CONFIRM
|
|
|
|
};
|
|
|
|
|
|
|
|
enum eap_pwd_state {
|
|
|
|
EAP_PWD_STATE_INIT = 0,
|
|
|
|
EAP_PWD_STATE_ID,
|
|
|
|
EAP_PWD_STATE_COMMIT,
|
|
|
|
EAP_PWD_STATE_CONFIRM
|
|
|
|
};
|
|
|
|
|
|
|
|
struct eap_pwd_handle {
|
|
|
|
enum eap_pwd_state state;
|
|
|
|
enum eap_pwd_prep prep;
|
|
|
|
char *identity;
|
|
|
|
char *password;
|
2019-01-10 20:51:10 +01:00
|
|
|
const struct l_ecc_curve *curve;
|
|
|
|
struct l_ecc_point *pwe;
|
|
|
|
struct l_ecc_point *element_s;
|
|
|
|
struct l_ecc_point *element_p;
|
2018-05-01 20:32:47 +02:00
|
|
|
uint32_t ciphersuite;
|
2019-01-10 20:51:10 +01:00
|
|
|
struct l_ecc_scalar *scalar_s;
|
|
|
|
struct l_ecc_scalar *scalar_p;
|
|
|
|
struct l_ecc_scalar *p_rand;
|
2018-05-01 20:32:47 +02:00
|
|
|
uint8_t *rx_frag_buf;
|
|
|
|
uint16_t rx_frag_total;
|
|
|
|
uint16_t rx_frag_count;
|
|
|
|
uint8_t *tx_frag_buf;
|
|
|
|
uint8_t *tx_frag_pos;
|
|
|
|
uint16_t tx_frag_remaining;
|
|
|
|
};
|
|
|
|
|
|
|
|
/* RFC 5931, Section 2.5 - Key Derivation Function */
|
|
|
|
static bool kdf(uint8_t *key, size_t key_len, const char *label,
|
|
|
|
size_t label_len, void *out, size_t olen)
|
|
|
|
{
|
|
|
|
struct l_checksum *hmac;
|
|
|
|
struct iovec iov[4];
|
|
|
|
uint16_t ibuf, i = 1;
|
2018-05-03 19:55:45 +02:00
|
|
|
uint16_t L = L_CPU_TO_BE16(olen * 8);
|
|
|
|
size_t len = 0;
|
2018-05-01 20:32:47 +02:00
|
|
|
|
2018-05-03 19:55:45 +02:00
|
|
|
while (len < olen) {
|
2018-05-01 20:32:47 +02:00
|
|
|
int iov_pos = 0;
|
|
|
|
|
|
|
|
hmac = l_checksum_new_hmac(L_CHECKSUM_SHA256, key, key_len);
|
|
|
|
if (!hmac)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
/* PRF(key, K(i - 1) | i | label | L) */
|
|
|
|
if (i > 1) {
|
|
|
|
iov[iov_pos].iov_base = out + len - 32;
|
|
|
|
iov[iov_pos++].iov_len = 32;
|
|
|
|
}
|
|
|
|
|
2018-05-03 19:55:45 +02:00
|
|
|
ibuf = L_CPU_TO_BE16(i);
|
2018-05-01 20:32:47 +02:00
|
|
|
iov[iov_pos].iov_base = (void *) &ibuf;
|
|
|
|
iov[iov_pos++].iov_len = 2;
|
|
|
|
iov[iov_pos].iov_base = (void *)label;
|
|
|
|
iov[iov_pos++].iov_len = label_len;
|
|
|
|
iov[iov_pos].iov_base = &L;
|
|
|
|
iov[iov_pos++].iov_len = 2;
|
|
|
|
|
|
|
|
if (!l_checksum_updatev(hmac, iov, iov_pos))
|
|
|
|
return false;
|
|
|
|
|
|
|
|
l_checksum_get_digest(hmac, out + len, 32);
|
|
|
|
l_checksum_free(hmac);
|
|
|
|
|
|
|
|
len += 32;
|
|
|
|
i++;
|
|
|
|
}
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2018-05-30 22:04:20 +02:00
|
|
|
static bool eap_pwd_reset_state(struct eap_state *eap)
|
|
|
|
{
|
|
|
|
struct eap_pwd_handle *pwd = eap_get_data(eap);
|
|
|
|
|
|
|
|
pwd->state = EAP_PWD_STATE_INIT;
|
|
|
|
|
|
|
|
l_free(pwd->tx_frag_buf);
|
|
|
|
pwd->tx_frag_buf = NULL;
|
|
|
|
pwd->tx_frag_pos = NULL;
|
|
|
|
pwd->tx_frag_remaining = 0;
|
|
|
|
|
|
|
|
l_free(pwd->rx_frag_buf);
|
|
|
|
pwd->rx_frag_buf = NULL;
|
|
|
|
pwd->rx_frag_count = 0;
|
|
|
|
pwd->rx_frag_total = 0;
|
|
|
|
|
|
|
|
pwd->prep = EAP_PWD_PREP_NONE;
|
|
|
|
pwd->ciphersuite = 0;
|
2019-01-10 20:51:10 +01:00
|
|
|
|
|
|
|
l_ecc_point_free(pwd->pwe);
|
|
|
|
pwd->pwe = NULL;
|
|
|
|
l_ecc_point_free(pwd->element_p);
|
|
|
|
pwd->element_p = NULL;
|
|
|
|
l_ecc_point_free(pwd->element_s);
|
|
|
|
pwd->element_s = NULL;
|
|
|
|
l_ecc_scalar_free(pwd->scalar_p);
|
|
|
|
pwd->scalar_p = NULL;
|
|
|
|
l_ecc_scalar_free(pwd->scalar_s);
|
|
|
|
pwd->scalar_s = NULL;
|
|
|
|
l_ecc_scalar_free(pwd->p_rand);
|
|
|
|
pwd->p_rand = NULL;
|
2018-05-30 22:04:20 +02:00
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2018-05-01 20:32:47 +02:00
|
|
|
static void eap_pwd_free(struct eap_state *eap)
|
|
|
|
{
|
|
|
|
struct eap_pwd_handle *pwd = eap_get_data(eap);
|
|
|
|
|
2018-05-30 22:04:20 +02:00
|
|
|
eap_pwd_reset_state(eap);
|
2018-05-01 20:32:47 +02:00
|
|
|
l_free(pwd->identity);
|
|
|
|
l_free(pwd->password);
|
|
|
|
l_free(pwd);
|
|
|
|
|
|
|
|
eap_set_data(eap, NULL);
|
|
|
|
}
|
|
|
|
|
2018-05-03 19:55:45 +02:00
|
|
|
static void eap_pwd_send_response(struct eap_state *eap,
|
|
|
|
uint8_t *pkt, size_t len)
|
2018-05-01 20:32:47 +02:00
|
|
|
{
|
|
|
|
struct eap_pwd_handle *pwd = eap_get_data(eap);
|
|
|
|
size_t mtu = eap_get_mtu(eap);
|
|
|
|
uint8_t frag[mtu];
|
|
|
|
uint8_t *pos = frag;
|
|
|
|
/* first fragment data bytes (mtu - header - Total-Length) */
|
|
|
|
uint16_t send_bytes = mtu - EAP_PWD_HDR_LEN - 2;
|
|
|
|
|
|
|
|
/* packet will fit within mtu */
|
|
|
|
if (len <= mtu) {
|
|
|
|
eap_send_response(eap, EAP_TYPE_PWD, pkt, len);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (pwd->tx_frag_buf) {
|
|
|
|
l_error("already processing fragment, cannot send response");
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* header */
|
|
|
|
memcpy(pos, pkt, 5);
|
|
|
|
pos += 5;
|
|
|
|
/* PWD-Exch, first frag, so L and M are both set */
|
|
|
|
*pos++ = pwd->state | EAP_PWD_L_BIT | EAP_PWD_M_BIT;
|
|
|
|
/* Total-Length */
|
|
|
|
l_put_be16((uint16_t)len, pos);
|
|
|
|
pos += 2;
|
|
|
|
/* copy packet data bytes */
|
|
|
|
memcpy(pos, pkt + EAP_PWD_HDR_LEN, send_bytes);
|
|
|
|
|
|
|
|
pwd->tx_frag_remaining = len - EAP_PWD_HDR_LEN - send_bytes;
|
|
|
|
|
2018-05-04 17:59:43 +02:00
|
|
|
l_info("sending initial fragment, %zu bytes", mtu);
|
2018-05-01 20:32:47 +02:00
|
|
|
|
|
|
|
eap_send_response(eap, EAP_TYPE_PWD, frag, mtu);
|
|
|
|
|
|
|
|
/* alloc/copy remainder of packet to frag buf */
|
|
|
|
pwd->tx_frag_buf = l_malloc(pwd->tx_frag_remaining);
|
|
|
|
|
|
|
|
memcpy(pwd->tx_frag_buf, pkt + EAP_PWD_HDR_LEN + send_bytes,
|
|
|
|
pwd->tx_frag_remaining);
|
|
|
|
|
|
|
|
pwd->tx_frag_pos = pwd->tx_frag_buf;
|
|
|
|
}
|
|
|
|
|
2018-05-03 19:55:45 +02:00
|
|
|
static void eap_pwd_handle_id(struct eap_state *eap,
|
|
|
|
const uint8_t *pkt, size_t len)
|
2018-05-01 20:32:47 +02:00
|
|
|
{
|
|
|
|
struct eap_pwd_handle *pwd = eap_get_data(eap);
|
|
|
|
uint16_t group;
|
|
|
|
uint8_t rand_fn;
|
|
|
|
uint8_t prf;
|
|
|
|
uint32_t token;
|
|
|
|
uint8_t counter = 1;
|
|
|
|
uint8_t resp[15 + strlen(pwd->identity)];
|
|
|
|
uint8_t *pos;
|
2019-01-10 20:51:10 +01:00
|
|
|
uint8_t pwd_seed[32];
|
2019-01-31 19:11:13 +01:00
|
|
|
uint8_t pwd_value[L_ECC_SCALAR_MAX_BYTES]; /* used as X value */
|
|
|
|
size_t nbytes;
|
2018-05-01 20:32:47 +02:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Group desc (2) + Random func (1) + prf (1) + token (4) + prep (1) +
|
|
|
|
* Identity (at least 1 byte)
|
|
|
|
*/
|
|
|
|
if (len < 9) {
|
|
|
|
l_error("bad packet length");
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (pwd->state != EAP_PWD_STATE_INIT) {
|
|
|
|
l_error("received ID request in invalid state");
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
|
|
|
|
pwd->state = EAP_PWD_STATE_ID;
|
|
|
|
|
|
|
|
group = l_get_be16(pkt);
|
2019-01-10 20:51:10 +01:00
|
|
|
|
2019-01-16 20:12:35 +01:00
|
|
|
pwd->curve = l_ecc_curve_get_ike_group(group);
|
2019-01-10 20:51:10 +01:00
|
|
|
if (!pwd->curve) {
|
2018-05-01 20:32:47 +02:00
|
|
|
l_error("group %d not supported", group);
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
|
|
|
|
rand_fn = pkt[2];
|
|
|
|
if (rand_fn != EAP_PWD_RAND_FN) {
|
|
|
|
l_error("rand_fn %d not supported", rand_fn);
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
|
|
|
|
prf = pkt[3];
|
|
|
|
if (prf != EAP_PWD_PRF) {
|
|
|
|
l_error("PRF function %d not supported", prf);
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* RFC 5931 Section 3.2.1
|
|
|
|
* The Group Description, Random Function, and PRF together, and in that
|
|
|
|
* order, comprise the Ciphersuite...
|
|
|
|
*/
|
|
|
|
pwd->ciphersuite = l_get_u32(pkt);
|
|
|
|
token = l_get_u32(pkt + 4);
|
|
|
|
pwd->prep = pkt[8];
|
|
|
|
|
|
|
|
if (pwd->prep != EAP_PWD_PREP_NONE) {
|
|
|
|
/*
|
|
|
|
* TODO: Support other PW prep types
|
|
|
|
*/
|
|
|
|
l_error("prep type %d not currently supported", pwd->prep);
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
|
2019-01-31 19:11:13 +01:00
|
|
|
nbytes = l_ecc_curve_get_scalar_bytes(pwd->curve);
|
|
|
|
|
2018-05-01 20:32:47 +02:00
|
|
|
while (counter < 20) {
|
|
|
|
/* pwd-seed = H(token|peer-ID|server-ID|password|counter) */
|
2019-01-17 21:25:36 +01:00
|
|
|
hkdf_extract(L_CHECKSUM_SHA256, NULL, 0, 5, pwd_seed, &token, 4,
|
2018-11-16 23:22:50 +01:00
|
|
|
pwd->identity, strlen(pwd->identity), pkt + 9,
|
|
|
|
len - 9, pwd->password, strlen(pwd->password),
|
2018-09-01 00:37:54 +02:00
|
|
|
&counter, 1);
|
2018-05-01 20:32:47 +02:00
|
|
|
|
|
|
|
/*
|
|
|
|
* pwd-value = KDF(pwd-seed, "EAP-pwd Hunting And Pecking",
|
|
|
|
* len(p))
|
|
|
|
*/
|
|
|
|
kdf(pwd_seed, 32, "EAP-pwd Hunting And Pecking",
|
|
|
|
strlen("EAP-pwd Hunting And Pecking"),
|
2019-01-31 19:11:13 +01:00
|
|
|
pwd_value, nbytes);
|
2018-05-01 20:32:47 +02:00
|
|
|
|
2019-01-10 20:51:10 +01:00
|
|
|
if (!(pwd_seed[31] & 1))
|
|
|
|
pwd->pwe = l_ecc_point_from_data(pwd->curve,
|
|
|
|
L_ECC_POINT_TYPE_COMPRESSED_BIT1,
|
2019-01-31 19:11:13 +01:00
|
|
|
pwd_value, nbytes);
|
2019-01-10 20:51:10 +01:00
|
|
|
else
|
|
|
|
pwd->pwe = l_ecc_point_from_data(pwd->curve,
|
|
|
|
L_ECC_POINT_TYPE_COMPRESSED_BIT0,
|
2019-01-31 19:11:13 +01:00
|
|
|
pwd_value, nbytes);
|
2018-05-01 20:32:47 +02:00
|
|
|
|
2019-01-10 20:51:10 +01:00
|
|
|
if (pwd->pwe)
|
2018-05-01 20:32:47 +02:00
|
|
|
break;
|
|
|
|
|
|
|
|
counter++;
|
|
|
|
}
|
|
|
|
|
|
|
|
pos = resp + 5; /* header */
|
|
|
|
*pos++ = EAP_PWD_EXCH_ID;
|
|
|
|
l_put_be16(group, pos);
|
|
|
|
pos += 2;
|
|
|
|
*pos++ = rand_fn;
|
|
|
|
*pos++ = prf;
|
|
|
|
l_put_u32(token, pos);
|
|
|
|
pos += 4;
|
|
|
|
*pos++ = pwd->prep;
|
|
|
|
memcpy(pos, pwd->identity, strlen(pwd->identity));
|
|
|
|
pos += strlen(pwd->identity);
|
|
|
|
|
|
|
|
eap_pwd_send_response(eap, resp, pos - resp);
|
|
|
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
error:
|
|
|
|
eap_method_error(eap);
|
|
|
|
}
|
|
|
|
|
2018-05-03 19:55:45 +02:00
|
|
|
static void eap_pwd_handle_commit(struct eap_state *eap,
|
|
|
|
const uint8_t *pkt, size_t len)
|
2018-05-01 20:32:47 +02:00
|
|
|
{
|
|
|
|
struct eap_pwd_handle *pwd = eap_get_data(eap);
|
2019-01-31 19:11:13 +01:00
|
|
|
uint8_t resp[L_ECC_POINT_MAX_BYTES + L_ECC_SCALAR_MAX_BYTES + 6];
|
2018-05-01 20:32:47 +02:00
|
|
|
uint8_t *pos;
|
2019-01-10 20:51:10 +01:00
|
|
|
struct l_ecc_scalar *p_mask;
|
|
|
|
struct l_ecc_scalar *order;
|
2019-01-31 19:11:13 +01:00
|
|
|
size_t nbytes = l_ecc_curve_get_scalar_bytes(pwd->curve);
|
2018-05-01 20:32:47 +02:00
|
|
|
|
2019-01-31 19:11:13 +01:00
|
|
|
/* [Element (nbytes * 2)][Scalar (nbytes)] */
|
|
|
|
if (len != nbytes + nbytes * 2) {
|
|
|
|
l_error("bad packet length, expected %zu, got %zu",
|
|
|
|
nbytes + nbytes * 2, len);
|
2018-05-01 20:32:47 +02:00
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (pwd->state != EAP_PWD_STATE_ID) {
|
|
|
|
l_error("received commit request in invalid state");
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
|
|
|
|
pwd->state = EAP_PWD_STATE_COMMIT;
|
|
|
|
|
|
|
|
/*
|
2019-01-31 19:11:13 +01:00
|
|
|
* Commit contains Element_S (nbytes * 2) then Scalar_s (nbytes)
|
2018-05-01 20:32:47 +02:00
|
|
|
*/
|
2019-01-10 20:51:10 +01:00
|
|
|
pwd->element_s = l_ecc_point_from_data(pwd->curve,
|
2019-01-31 19:11:13 +01:00
|
|
|
L_ECC_POINT_TYPE_FULL,
|
|
|
|
pkt, nbytes * 2);
|
2019-01-10 20:51:10 +01:00
|
|
|
if (!pwd->element_s)
|
2018-05-01 20:32:47 +02:00
|
|
|
goto invalid_point;
|
|
|
|
|
2019-01-31 19:41:58 +01:00
|
|
|
pwd->scalar_s = l_ecc_scalar_new(pwd->curve, pkt + nbytes * 2, nbytes);
|
2018-05-01 20:32:47 +02:00
|
|
|
|
2019-01-10 20:51:10 +01:00
|
|
|
pwd->p_rand = l_ecc_scalar_new_random(pwd->curve);
|
|
|
|
p_mask = l_ecc_scalar_new_random(pwd->curve);
|
|
|
|
pwd->scalar_p = l_ecc_scalar_new(pwd->curve, NULL, 0);
|
2018-05-01 20:32:47 +02:00
|
|
|
|
2019-01-10 20:51:10 +01:00
|
|
|
order = l_ecc_curve_get_order(pwd->curve);
|
2018-05-01 20:32:47 +02:00
|
|
|
|
2019-01-10 20:51:10 +01:00
|
|
|
l_ecc_scalar_add(pwd->scalar_p, pwd->p_rand, p_mask, order);
|
2018-05-01 20:32:47 +02:00
|
|
|
|
2019-01-10 20:51:10 +01:00
|
|
|
l_ecc_scalar_free(order);
|
2018-05-01 20:32:47 +02:00
|
|
|
|
2019-01-10 20:51:10 +01:00
|
|
|
pwd->element_p = l_ecc_point_new(pwd->curve);
|
2018-05-01 20:32:47 +02:00
|
|
|
/* p_mask * PWE */
|
2019-01-10 20:51:10 +01:00
|
|
|
l_ecc_point_multiply(pwd->element_p, p_mask, pwd->pwe);
|
2018-05-01 20:32:47 +02:00
|
|
|
|
2019-01-10 20:51:10 +01:00
|
|
|
l_ecc_scalar_free(p_mask);
|
2018-05-01 20:32:47 +02:00
|
|
|
|
|
|
|
/* inv(p_mask * PWE) */
|
2019-01-10 20:51:10 +01:00
|
|
|
l_ecc_point_inverse(pwd->element_p);
|
2018-05-01 20:32:47 +02:00
|
|
|
|
|
|
|
/* send element_p and scalar_p */
|
|
|
|
pos = resp + 5; /* header */
|
|
|
|
*pos++ = EAP_PWD_EXCH_COMMIT;
|
2019-01-31 19:11:13 +01:00
|
|
|
pos += l_ecc_point_get_data(pwd->element_p, pos, nbytes * 2);
|
|
|
|
pos += l_ecc_scalar_get_data(pwd->scalar_p, pos, nbytes);
|
2018-05-01 20:32:47 +02:00
|
|
|
|
|
|
|
eap_pwd_send_response(eap, resp, pos - resp);
|
|
|
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
invalid_point:
|
|
|
|
l_error("invalid point during commit exchange");
|
|
|
|
error:
|
|
|
|
eap_method_error(eap);
|
|
|
|
}
|
|
|
|
|
2019-01-10 20:51:10 +01:00
|
|
|
|
2018-05-03 19:55:45 +02:00
|
|
|
static void eap_pwd_handle_confirm(struct eap_state *eap,
|
|
|
|
const uint8_t *pkt, size_t len)
|
2018-05-01 20:32:47 +02:00
|
|
|
{
|
|
|
|
struct eap_pwd_handle *pwd = eap_get_data(eap);
|
2019-01-10 20:51:10 +01:00
|
|
|
struct l_ecc_point *kp;
|
2018-05-01 20:32:47 +02:00
|
|
|
uint8_t resp[38];
|
|
|
|
uint8_t *pos;
|
2019-01-10 20:51:10 +01:00
|
|
|
uint8_t confirm_s[32];
|
|
|
|
uint8_t confirm_p[32];
|
|
|
|
uint8_t expected_confirm_s[32];
|
2018-05-01 20:32:47 +02:00
|
|
|
uint8_t mk[32];
|
|
|
|
uint8_t msk_emsk[128], session_id[33];
|
2019-01-10 20:51:10 +01:00
|
|
|
/* buffers used for the final hash */
|
|
|
|
uint8_t kpx[L_ECC_SCALAR_MAX_BYTES];
|
|
|
|
uint8_t scalar_s[L_ECC_SCALAR_MAX_BYTES];
|
|
|
|
uint8_t scalar_p[L_ECC_SCALAR_MAX_BYTES];
|
|
|
|
uint8_t element_s[L_ECC_POINT_MAX_BYTES];
|
|
|
|
uint8_t element_p[L_ECC_POINT_MAX_BYTES];
|
|
|
|
ssize_t plen, clen;
|
2018-05-01 20:32:47 +02:00
|
|
|
|
|
|
|
if (len != 32) {
|
|
|
|
l_error("bad packet length");
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (pwd->state != EAP_PWD_STATE_COMMIT) {
|
|
|
|
l_error("received confirm request in invalid state");
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
|
|
|
|
pwd->state = EAP_PWD_STATE_CONFIRM;
|
|
|
|
|
2019-01-10 20:51:10 +01:00
|
|
|
memcpy(confirm_s, pkt, 32);
|
|
|
|
|
|
|
|
kp = l_ecc_point_new(pwd->curve);
|
2018-05-01 20:32:47 +02:00
|
|
|
|
|
|
|
/* compute KP = (p_rand * (Scalar_S * PWE + Element_S)) */
|
2019-01-10 20:51:10 +01:00
|
|
|
l_ecc_point_multiply(kp, pwd->scalar_s, pwd->pwe);
|
|
|
|
|
|
|
|
l_ecc_point_add(kp, kp, pwd->element_s);
|
2018-05-01 20:32:47 +02:00
|
|
|
|
2019-01-10 20:51:10 +01:00
|
|
|
l_ecc_point_multiply(kp, pwd->p_rand, kp);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* We just need to store clen/plen once. Since all these buffers are
|
|
|
|
* created with enough bytes in mind we know these wont fail. Also, all
|
|
|
|
* scalar/point objects were created with the same curve, so it can be
|
|
|
|
* safe to assume the return values will not change from what clen/plen
|
|
|
|
* already are.
|
|
|
|
*/
|
|
|
|
clen = l_ecc_point_get_x(kp, kpx, sizeof(kpx));
|
|
|
|
if (clen < 0)
|
2018-05-01 20:32:47 +02:00
|
|
|
goto invalid_point;
|
|
|
|
|
2019-01-10 20:51:10 +01:00
|
|
|
plen = l_ecc_point_get_data(pwd->element_s, element_s,
|
|
|
|
sizeof(element_s));
|
|
|
|
if (plen < 0)
|
|
|
|
goto invalid_point;
|
2018-05-01 20:32:47 +02:00
|
|
|
|
2019-01-10 20:51:10 +01:00
|
|
|
if (l_ecc_point_get_data(pwd->element_p, element_p,
|
|
|
|
sizeof(element_p)) < 0)
|
2018-05-01 20:32:47 +02:00
|
|
|
goto invalid_point;
|
|
|
|
|
2019-01-10 20:51:10 +01:00
|
|
|
if (l_ecc_scalar_get_data(pwd->scalar_s, scalar_s,
|
|
|
|
sizeof(scalar_s)) < 0)
|
|
|
|
goto invalid_point;
|
2018-05-01 20:32:47 +02:00
|
|
|
|
2019-01-10 20:51:10 +01:00
|
|
|
if (l_ecc_scalar_get_data(pwd->scalar_p, scalar_p,
|
|
|
|
sizeof(scalar_p)) < 0)
|
2018-05-01 20:32:47 +02:00
|
|
|
goto invalid_point;
|
|
|
|
|
2019-01-10 20:51:10 +01:00
|
|
|
l_ecc_point_free(kp);
|
2018-05-01 20:32:47 +02:00
|
|
|
|
|
|
|
/*
|
|
|
|
* compute Confirm_P = H(kp | Element_P | Scalar_P |
|
|
|
|
* Element_S | Scalar_S | Ciphersuite)
|
|
|
|
*/
|
2019-01-17 21:25:36 +01:00
|
|
|
hkdf_extract(L_CHECKSUM_SHA256, NULL, 0, 6, confirm_p, kpx, clen,
|
|
|
|
element_p, plen, scalar_p, clen, element_s,
|
|
|
|
plen, scalar_s, clen, &pwd->ciphersuite, 4);
|
2019-01-10 20:51:10 +01:00
|
|
|
|
2019-01-17 21:25:36 +01:00
|
|
|
hkdf_extract(L_CHECKSUM_SHA256, NULL, 0, 6, expected_confirm_s, kpx,
|
|
|
|
clen, element_s, plen, scalar_s, clen,
|
|
|
|
element_p, plen, scalar_p, clen,
|
|
|
|
&pwd->ciphersuite, 4);
|
2019-01-10 20:51:10 +01:00
|
|
|
|
|
|
|
if (memcmp(confirm_s, expected_confirm_s, 32)) {
|
2018-05-04 17:59:43 +02:00
|
|
|
l_error("Confirm_S did not verify");
|
2018-05-01 20:32:47 +02:00
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
|
|
|
|
pos = resp + 5; /* header */
|
|
|
|
*pos++ = EAP_PWD_EXCH_CONFIRM;
|
2019-01-10 20:51:10 +01:00
|
|
|
memcpy(pos, confirm_p, 32);
|
2018-05-01 20:32:47 +02:00
|
|
|
pos += 32;
|
|
|
|
|
|
|
|
/* derive MK = H(kp | Confirm_P | Confirm_S ) */
|
2019-01-17 21:25:36 +01:00
|
|
|
hkdf_extract(L_CHECKSUM_SHA256, NULL, 0, 3, mk, kpx, clen, confirm_p,
|
2019-01-10 20:51:10 +01:00
|
|
|
32, confirm_s, 32);
|
2018-05-01 20:32:47 +02:00
|
|
|
|
|
|
|
eap_pwd_send_response(eap, resp, pos - resp);
|
|
|
|
|
|
|
|
eap_method_success(eap);
|
|
|
|
|
|
|
|
session_id[0] = 52;
|
2019-01-17 21:25:36 +01:00
|
|
|
hkdf_extract(L_CHECKSUM_SHA256, NULL, 0, 3, session_id + 1,
|
|
|
|
&pwd->ciphersuite, 4, scalar_p, clen, scalar_s, clen);
|
2019-01-10 20:51:10 +01:00
|
|
|
|
2018-05-01 20:32:47 +02:00
|
|
|
kdf(mk, 32, (const char *) session_id, 33, msk_emsk, 128);
|
|
|
|
eap_set_key_material(eap, msk_emsk, 64, msk_emsk + 64, 64, NULL, 0);
|
|
|
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
invalid_point:
|
2019-01-10 20:51:10 +01:00
|
|
|
l_ecc_point_free(kp);
|
|
|
|
|
2018-05-01 20:32:47 +02:00
|
|
|
l_error("invalid point during confirm exchange");
|
|
|
|
error:
|
|
|
|
eap_method_error(eap);
|
|
|
|
}
|
|
|
|
|
2018-05-03 19:55:45 +02:00
|
|
|
static void eap_pwd_process(struct eap_state *eap,
|
|
|
|
const uint8_t *pkt, size_t len)
|
2018-05-01 20:32:47 +02:00
|
|
|
{
|
|
|
|
uint8_t pwd_exch = util_bit_field(pkt[0], 0, 6);
|
|
|
|
|
2018-05-03 20:39:54 +02:00
|
|
|
if (len < 1)
|
|
|
|
return;
|
|
|
|
|
2018-05-01 20:32:47 +02:00
|
|
|
switch (pwd_exch) {
|
|
|
|
case EAP_PWD_EXCH_ID:
|
|
|
|
eap_pwd_handle_id(eap, pkt + 1, len - 1);
|
|
|
|
break;
|
|
|
|
case EAP_PWD_EXCH_COMMIT:
|
|
|
|
eap_pwd_handle_commit(eap, pkt + 1, len - 1);
|
|
|
|
break;
|
|
|
|
case EAP_PWD_EXCH_CONFIRM:
|
|
|
|
eap_pwd_handle_confirm(eap, pkt + 1, len - 1);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
static void eap_pwd_send_ack(struct eap_state *eap)
|
|
|
|
{
|
|
|
|
struct eap_pwd_handle *pwd = eap_get_data(eap);
|
|
|
|
uint8_t buf[6];
|
|
|
|
|
|
|
|
buf[5] = pwd->state + 1;
|
|
|
|
|
|
|
|
eap_send_response(eap, EAP_TYPE_PWD, buf, 6);
|
|
|
|
}
|
|
|
|
|
|
|
|
#define FRAG_BYTES(mtu, remaining) \
|
|
|
|
((mtu - EAP_PWD_HDR_LEN) < remaining) ? (mtu - EAP_PWD_HDR_LEN) : \
|
|
|
|
remaining
|
|
|
|
|
|
|
|
static void eap_pwd_handle_request(struct eap_state *eap,
|
2018-05-03 19:55:45 +02:00
|
|
|
const uint8_t *pkt, size_t len)
|
2018-05-01 20:32:47 +02:00
|
|
|
{
|
|
|
|
struct eap_pwd_handle *pwd = eap_get_data(eap);
|
|
|
|
uint8_t len_bit = false;
|
|
|
|
uint8_t more_bit = false;
|
|
|
|
|
|
|
|
/* ACK from tx fragment, send next fragment */
|
|
|
|
if (len == 1 && pwd->tx_frag_buf) {
|
|
|
|
size_t mtu = eap_get_mtu(eap);
|
|
|
|
uint8_t frag[mtu];
|
|
|
|
uint8_t *pos = frag;
|
|
|
|
uint16_t frag_bytes = FRAG_BYTES(mtu, pwd->tx_frag_remaining);
|
|
|
|
|
|
|
|
pos += 5; /* header */
|
|
|
|
*pos = pwd->state;
|
|
|
|
|
|
|
|
/* more fragments coming, set M bit */
|
|
|
|
if (frag_bytes < pwd->tx_frag_remaining)
|
|
|
|
*pos |= EAP_PWD_M_BIT;
|
|
|
|
|
|
|
|
pos++;
|
|
|
|
|
|
|
|
memcpy(pos, pwd->tx_frag_pos, frag_bytes);
|
|
|
|
|
|
|
|
pwd->tx_frag_pos += frag_bytes;
|
|
|
|
pwd->tx_frag_remaining -= frag_bytes;
|
|
|
|
|
|
|
|
l_info("sending fragment, %d bytes",
|
|
|
|
frag_bytes + EAP_PWD_HDR_LEN);
|
|
|
|
|
|
|
|
eap_send_response(eap, EAP_TYPE_PWD, frag,
|
|
|
|
frag_bytes + EAP_PWD_HDR_LEN);
|
|
|
|
|
|
|
|
if (!pwd->tx_frag_remaining) {
|
|
|
|
/* done sending fragments, free */
|
|
|
|
l_free(pwd->tx_frag_buf);
|
|
|
|
pwd->tx_frag_buf = NULL;
|
|
|
|
pwd->tx_frag_pos = NULL;
|
|
|
|
pwd->tx_frag_remaining = 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (pwd->tx_frag_buf) {
|
|
|
|
l_error("received packet while waiting for ACK!");
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (len < 1) {
|
|
|
|
l_error("packet is too small");
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* set if Total-Length parameter is include (i.e. first fragment) */
|
|
|
|
len_bit = util_is_bit_set(pkt[0], 7);
|
|
|
|
/* set on all but the last fragment */
|
|
|
|
more_bit = util_is_bit_set(pkt[0], 6);
|
|
|
|
|
|
|
|
/* first rx fragment */
|
|
|
|
if (len_bit) {
|
2018-05-03 20:39:54 +02:00
|
|
|
if (len < 3) {
|
|
|
|
l_error("malformed packet");
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2018-05-01 20:32:47 +02:00
|
|
|
/* remove length of Total-Length parameter (2) */
|
|
|
|
pwd->rx_frag_total = l_get_be16(pkt + 1) - 2;
|
|
|
|
pwd->rx_frag_buf = l_malloc(pwd->rx_frag_total);
|
|
|
|
|
|
|
|
/* skip copying Total-Length for easier processing later */
|
|
|
|
pwd->rx_frag_buf[0] = pkt[0];
|
|
|
|
memcpy(pwd->rx_frag_buf + 1, pkt + 3, len - 2);
|
|
|
|
|
|
|
|
pwd->rx_frag_count = len - 2;
|
|
|
|
|
|
|
|
l_info("received first fragment, %d total bytes",
|
|
|
|
pwd->rx_frag_total);
|
|
|
|
|
|
|
|
eap_pwd_send_ack(eap);
|
|
|
|
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* more rx fragments */
|
|
|
|
if (pwd->rx_frag_buf) {
|
|
|
|
/* continue building packet (not including PWD-Exch byte) */
|
|
|
|
memcpy(pwd->rx_frag_buf + pwd->rx_frag_count, pkt + 1, len - 1);
|
|
|
|
pwd->rx_frag_count += (len - 1);
|
|
|
|
|
2018-05-04 17:59:43 +02:00
|
|
|
l_info("received another fragment, %zu bytes", len);
|
2018-05-01 20:32:47 +02:00
|
|
|
|
|
|
|
/* more fragments coming */
|
|
|
|
if (more_bit) {
|
|
|
|
eap_pwd_send_ack(eap);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (pwd->rx_frag_count != pwd->rx_frag_total) {
|
|
|
|
l_error("fragment length mismatch");
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* this was the last fragment, process */
|
|
|
|
eap_pwd_process(eap, pwd->rx_frag_buf, pwd->rx_frag_total);
|
|
|
|
|
|
|
|
l_free(pwd->rx_frag_buf);
|
|
|
|
pwd->rx_frag_buf = NULL;
|
|
|
|
pwd->rx_frag_count = 0;
|
|
|
|
pwd->rx_frag_total = 0;
|
|
|
|
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* no fragmentation, process normally */
|
|
|
|
eap_pwd_process(eap, pkt, len);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int eap_pwd_check_settings(struct l_settings *settings,
|
2018-05-03 19:55:45 +02:00
|
|
|
struct l_queue *secrets,
|
|
|
|
const char *prefix,
|
|
|
|
struct l_queue **out_missing)
|
2018-05-01 20:32:47 +02:00
|
|
|
{
|
|
|
|
const struct eap_secret_info *secret;
|
2018-10-25 20:56:32 +02:00
|
|
|
char identity_key[72];
|
|
|
|
char password_key[72];
|
|
|
|
char password_key_old[72];
|
|
|
|
|
|
|
|
L_AUTO_FREE_VAR(char *, identity);
|
|
|
|
L_AUTO_FREE_VAR(char *, password) = NULL;
|
2018-05-01 20:32:47 +02:00
|
|
|
|
2018-10-25 20:56:32 +02:00
|
|
|
snprintf(identity_key, sizeof(identity_key), "%sIdentity", prefix);
|
|
|
|
snprintf(password_key, sizeof(password_key), "%sPassword", prefix);
|
2018-05-01 20:32:47 +02:00
|
|
|
|
2018-10-25 20:56:32 +02:00
|
|
|
identity = l_settings_get_string(settings, "Security", identity_key);
|
2018-06-14 03:45:23 +02:00
|
|
|
|
2018-05-01 20:32:47 +02:00
|
|
|
if (!identity) {
|
2018-10-25 20:56:32 +02:00
|
|
|
secret = l_queue_find(secrets, eap_secret_info_match,
|
|
|
|
identity_key);
|
|
|
|
if (secret)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
eap_append_secret(out_missing, EAP_SECRET_REMOTE_USER_PASSWORD,
|
|
|
|
identity_key, password_key, NULL,
|
2018-08-09 02:33:16 +02:00
|
|
|
EAP_CACHE_TEMPORARY);
|
2018-05-01 20:32:47 +02:00
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2018-10-25 20:56:32 +02:00
|
|
|
password = l_settings_get_string(settings, "Security", password_key);
|
|
|
|
|
2018-05-01 20:32:47 +02:00
|
|
|
if (!password) {
|
2018-10-25 20:56:32 +02:00
|
|
|
snprintf(password_key_old, sizeof(password_key_old),
|
|
|
|
"%sPWD-Password", prefix);
|
|
|
|
password = l_settings_get_string(settings, "Security",
|
|
|
|
password_key_old);
|
2018-10-25 21:52:10 +02:00
|
|
|
if (password) {
|
|
|
|
l_warn("Setting '%s' is deprecated, use '%s' instead",
|
|
|
|
password_key_old, password_key);
|
2018-10-25 20:56:32 +02:00
|
|
|
return 0;
|
2018-10-25 21:52:10 +02:00
|
|
|
}
|
2018-10-25 20:56:32 +02:00
|
|
|
|
|
|
|
secret = l_queue_find(secrets, eap_secret_info_match,
|
|
|
|
password_key);
|
|
|
|
if (secret)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
eap_append_secret(out_missing, EAP_SECRET_REMOTE_PASSWORD,
|
|
|
|
password_key, NULL, identity,
|
2018-08-09 02:33:16 +02:00
|
|
|
EAP_CACHE_TEMPORARY);
|
2018-05-01 20:32:47 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static bool eap_pwd_load_settings(struct eap_state *eap,
|
|
|
|
struct l_settings *settings,
|
|
|
|
const char *prefix)
|
|
|
|
{
|
|
|
|
struct eap_pwd_handle *pwd;
|
2018-10-25 20:56:32 +02:00
|
|
|
char setting_key[72];
|
2018-05-01 20:32:47 +02:00
|
|
|
|
|
|
|
pwd = l_new(struct eap_pwd_handle, 1);
|
|
|
|
|
|
|
|
pwd->state = EAP_PWD_STATE_INIT;
|
|
|
|
|
2018-10-25 20:56:32 +02:00
|
|
|
snprintf(setting_key, sizeof(setting_key), "%sIdentity", prefix);
|
|
|
|
pwd->identity = l_settings_get_string(settings, "Security",
|
|
|
|
setting_key);
|
2018-05-01 20:32:47 +02:00
|
|
|
|
|
|
|
if (!pwd->identity) {
|
2018-10-25 20:56:32 +02:00
|
|
|
l_error("'%s' setting is missing", setting_key);
|
2018-05-03 19:55:57 +02:00
|
|
|
goto error;
|
2018-05-01 20:32:47 +02:00
|
|
|
}
|
|
|
|
|
2018-10-25 20:56:32 +02:00
|
|
|
snprintf(setting_key, sizeof(setting_key), "%sPassword", prefix);
|
|
|
|
pwd->password = l_settings_get_string(settings, "Security",
|
|
|
|
setting_key);
|
2018-05-01 20:32:47 +02:00
|
|
|
|
|
|
|
if (!pwd->password) {
|
2018-10-25 20:56:32 +02:00
|
|
|
snprintf(setting_key, sizeof(setting_key), "%sPWD-Password",
|
|
|
|
prefix);
|
|
|
|
pwd->password = l_settings_get_string(settings, "Security",
|
|
|
|
setting_key);
|
|
|
|
|
|
|
|
if (!pwd->password) {
|
|
|
|
snprintf(setting_key, sizeof(setting_key), "%sPassword",
|
|
|
|
prefix);
|
|
|
|
l_error("'%s' setting is missing", setting_key);
|
|
|
|
goto error;
|
|
|
|
}
|
2018-05-01 20:32:47 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
eap_set_data(eap, pwd);
|
|
|
|
|
|
|
|
return true;
|
2018-05-03 19:55:57 +02:00
|
|
|
|
|
|
|
error:
|
|
|
|
l_free(pwd->identity);
|
|
|
|
l_free(pwd->password);
|
|
|
|
l_free(pwd);
|
2018-10-25 20:56:32 +02:00
|
|
|
|
2018-05-03 19:55:57 +02:00
|
|
|
return false;
|
2018-05-01 20:32:47 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
static struct eap_method eap_pwd = {
|
|
|
|
.request_type = EAP_TYPE_PWD,
|
|
|
|
.exports_msk = true,
|
|
|
|
.name = "PWD",
|
|
|
|
.free = eap_pwd_free,
|
|
|
|
.handle_request = eap_pwd_handle_request,
|
|
|
|
.check_settings = eap_pwd_check_settings,
|
|
|
|
.load_settings = eap_pwd_load_settings,
|
2018-05-30 22:04:20 +02:00
|
|
|
.reset_state = eap_pwd_reset_state,
|
2018-05-01 20:32:47 +02:00
|
|
|
};
|
|
|
|
|
|
|
|
static int eap_pwd_init(void)
|
|
|
|
{
|
|
|
|
l_debug("");
|
|
|
|
return eap_register_method(&eap_pwd);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void eap_pwd_exit(void)
|
|
|
|
{
|
|
|
|
l_debug("");
|
|
|
|
eap_unregister_method(&eap_pwd);
|
|
|
|
}
|
|
|
|
|
|
|
|
EAP_METHOD_BUILTIN(eap_pwd, eap_pwd_init, eap_pwd_exit)
|