contrib/wpa/src/eap_server/eap_server_pwd.c

   1 /*
   2  * hostapd / EAP-pwd (RFC 5931) server
   3  * Copyright (c) 2010, Dan Harkins <dharkins@lounge.org>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #include "common.h"
  12 #include "crypto/sha256.h"
  13 #include "crypto/ms_funcs.h"
  14 #include "crypto/crypto.h"
  15 #include "eap_server/eap_i.h"
  16 #include "eap_common/eap_pwd_common.h"
  17
  18
  19 struct eap_pwd_data {
  20         enum {
  21                 PWD_ID_Req, PWD_Commit_Req, PWD_Confirm_Req, SUCCESS, FAILURE
  22         } state;
  23         u8 *id_peer;
  24         size_t id_peer_len;
  25         u8 *id_server;
  26         size_t id_server_len;
  27         u8 *password;
  28         size_t password_len;
  29         int password_hash;
  30         u8 *salt;
  31         size_t salt_len;
  32         u32 token;
  33         u16 group_num;
  34         u8 password_prep;
  35         EAP_PWD_group *grp;
  36
  37         struct wpabuf *inbuf;
  38         size_t in_frag_pos;
  39         struct wpabuf *outbuf;
  40         size_t out_frag_pos;
  41         size_t mtu;
  42
  43         struct crypto_bignum *k;
  44         struct crypto_bignum *private_value;
  45         struct crypto_bignum *peer_scalar;
  46         struct crypto_bignum *my_scalar;
  47         struct crypto_ec_point *my_element;
  48         struct crypto_ec_point *peer_element;
  49
  50         u8 my_confirm[SHA256_MAC_LEN];
  51
  52         u8 msk[EAP_MSK_LEN];
  53         u8 emsk[EAP_EMSK_LEN];
  54         u8 session_id[1 + SHA256_MAC_LEN];
  55 };
  56
  57
  58 static const char * eap_pwd_state_txt(int state)
  59 {
  60         switch (state) {
  61         case PWD_ID_Req:
  62                 return "PWD-ID-Req";
  63         case PWD_Commit_Req:
  64                 return "PWD-Commit-Req";
  65         case PWD_Confirm_Req:
  66                 return "PWD-Confirm-Req";
  67         case SUCCESS:
  68                 return "SUCCESS";
  69         case FAILURE:
  70                 return "FAILURE";
  71         default:
  72                 return "PWD-Unk";
  73         }
  74 }
  75
  76
  77 static void eap_pwd_state(struct eap_pwd_data *data, int state)
  78 {
  79         wpa_printf(MSG_DEBUG, "EAP-pwd: %s -> %s",
  80                    eap_pwd_state_txt(data->state), eap_pwd_state_txt(state));
  81         data->state = state;
  82 }
  83
  84
  85 static void * eap_pwd_init(struct eap_sm *sm)
  86 {
  87         struct eap_pwd_data *data;
  88
  89         if (sm->user == NULL || sm->user->password == NULL ||
  90             sm->user->password_len == 0) {
  91                 wpa_printf(MSG_INFO, "EAP-PWD (server): Password is not "
  92                            "configured");
  93                 return NULL;
  94         }
  95
  96         data = os_zalloc(sizeof(*data));
  97         if (data == NULL)
  98                 return NULL;
  99
 100         data->group_num = sm->pwd_group;
 101         wpa_printf(MSG_DEBUG, "EAP-pwd: Selected group number %d",
 102                    data->group_num);
 103         data->state = PWD_ID_Req;
 104
 105         data->id_server = (u8 *) os_strdup("server");
 106         if (data->id_server)
 107                 data->id_server_len = os_strlen((char *) data->id_server);
 108
 109         data->password = os_malloc(sm->user->password_len);
 110         if (data->password == NULL) {
 111                 wpa_printf(MSG_INFO, "EAP-PWD: Memory allocation password "
 112                            "fail");
 113                 bin_clear_free(data->id_server, data->id_server_len);
 114                 os_free(data);
 115                 return NULL;
 116         }
 117         data->password_len = sm->user->password_len;
 118         os_memcpy(data->password, sm->user->password, data->password_len);
 119         data->password_hash = sm->user->password_hash;
 120
 121         data->salt_len = sm->user->salt_len;
 122         if (data->salt_len) {
 123                 data->salt = os_memdup(sm->user->salt, sm->user->salt_len);
 124                 if (!data->salt) {
 125                         wpa_printf(MSG_INFO,
 126                                    "EAP-pwd: Memory allocation of salt failed");
 127                         bin_clear_free(data->id_server, data->id_server_len);
 128                         bin_clear_free(data->password, data->password_len);
 129                         os_free(data);
 130                         return NULL;
 131                 }
 132         }
 133
 134         data->in_frag_pos = data->out_frag_pos = 0;
 135         data->inbuf = data->outbuf = NULL;
 136         /* use default MTU from RFC 5931 if not configured otherwise */
 137         data->mtu = sm->fragment_size > 0 ? sm->fragment_size : 1020;
 138
 139         return data;
 140 }
 141
 142
 143 static void eap_pwd_reset(struct eap_sm *sm, void *priv)
 144 {
 145         struct eap_pwd_data *data = priv;
 146
 147         crypto_bignum_deinit(data->private_value, 1);
 148         crypto_bignum_deinit(data->peer_scalar, 1);
 149         crypto_bignum_deinit(data->my_scalar, 1);
 150         crypto_bignum_deinit(data->k, 1);
 151         crypto_ec_point_deinit(data->my_element, 1);
 152         crypto_ec_point_deinit(data->peer_element, 1);
 153         bin_clear_free(data->id_peer, data->id_peer_len);
 154         bin_clear_free(data->id_server, data->id_server_len);
 155         bin_clear_free(data->password, data->password_len);
 156         bin_clear_free(data->salt, data->salt_len);
 157         if (data->grp) {
 158                 crypto_ec_deinit(data->grp->group);
 159                 crypto_ec_point_deinit(data->grp->pwe, 1);
 160                 os_free(data->grp);
 161         }
 162         wpabuf_free(data->inbuf);
 163         wpabuf_free(data->outbuf);
 164         bin_clear_free(data, sizeof(*data));
 165 }
 166
 167
 168 static void eap_pwd_build_id_req(struct eap_sm *sm, struct eap_pwd_data *data,
 169                                  u8 id)
 170 {
 171         wpa_printf(MSG_DEBUG, "EAP-pwd: ID/Request");
 172         /*
 173          * if we're fragmenting then we already have an id request, just return
 174          */
 175         if (data->out_frag_pos)
 176                 return;
 177
 178         data->outbuf = wpabuf_alloc(sizeof(struct eap_pwd_id) +
 179                                     data->id_server_len);
 180         if (data->outbuf == NULL) {
 181                 eap_pwd_state(data, FAILURE);
 182                 return;
 183         }
 184
 185         if (os_get_random((u8 *) &data->token, sizeof(data->token)) < 0) {
 186                 wpabuf_free(data->outbuf);
 187                 data->outbuf = NULL;
 188                 eap_pwd_state(data, FAILURE);
 189                 return;
 190         }
 191
 192         wpa_hexdump_key(MSG_DEBUG, "EAP-pwd (server): password",
 193                         data->password, data->password_len);
 194         if (data->salt_len)
 195                 wpa_hexdump(MSG_DEBUG, "EAP-pwd (server): salt",
 196                             data->salt, data->salt_len);
 197
 198         /*
 199          * If this is a salted password then figure out how it was hashed
 200          * based on the length.
 201          */
 202         if (data->salt_len) {
 203                 switch (data->password_len) {
 204                 case 20:
 205                         data->password_prep = EAP_PWD_PREP_SSHA1;
 206                         break;
 207                 case 32:
 208                         data->password_prep = EAP_PWD_PREP_SSHA256;
 209                         break;
 210                 case 64:
 211                         data->password_prep = EAP_PWD_PREP_SSHA512;
 212                         break;
 213                 default:
 214                         wpa_printf(MSG_INFO,
 215                                    "EAP-pwd (server): bad size %d for salted password",
 216                                    (int) data->password_len);
 217                         eap_pwd_state(data, FAILURE);
 218                         return;
 219                 }
 220         } else {
 221                 /* Otherwise, figure out whether it's MS hashed or plain */
 222                 data->password_prep = data->password_hash ? EAP_PWD_PREP_MS :
 223                         EAP_PWD_PREP_NONE;
 224         }
 225
 226         wpabuf_put_be16(data->outbuf, data->group_num);
 227         wpabuf_put_u8(data->outbuf, EAP_PWD_DEFAULT_RAND_FUNC);
 228         wpabuf_put_u8(data->outbuf, EAP_PWD_DEFAULT_PRF);
 229         wpabuf_put_data(data->outbuf, &data->token, sizeof(data->token));
 230         wpabuf_put_u8(data->outbuf, data->password_prep);
 231         wpabuf_put_data(data->outbuf, data->id_server, data->id_server_len);
 232 }
 233
 234
 235 static void eap_pwd_build_commit_req(struct eap_sm *sm,
 236                                      struct eap_pwd_data *data, u8 id)
 237 {
 238         struct crypto_bignum *mask = NULL;
 239         u8 *scalar = NULL, *element = NULL;
 240         size_t prime_len, order_len;
 241
 242         wpa_printf(MSG_DEBUG, "EAP-pwd: Commit/Request");
 243         /*
 244          * if we're fragmenting then we already have an commit request, just
 245          * return
 246          */
 247         if (data->out_frag_pos)
 248                 return;
 249
 250         prime_len = crypto_ec_prime_len(data->grp->group);
 251         order_len = crypto_ec_order_len(data->grp->group);
 252
 253         data->private_value = crypto_bignum_init();
 254         data->my_element = crypto_ec_point_init(data->grp->group);
 255         data->my_scalar = crypto_bignum_init();
 256         mask = crypto_bignum_init();
 257         if (!data->private_value || !data->my_element || !data->my_scalar ||
 258             !mask) {
 259                 wpa_printf(MSG_INFO, "EAP-PWD (server): scalar allocation "
 260                            "fail");
 261                 goto fin;
 262         }
 263
 264         if (crypto_bignum_rand(data->private_value,
 265                                crypto_ec_get_order(data->grp->group)) < 0 ||
 266             crypto_bignum_rand(mask,
 267                                crypto_ec_get_order(data->grp->group)) < 0 ||
 268             crypto_bignum_add(data->private_value, mask, data->my_scalar) < 0 ||
 269             crypto_bignum_mod(data->my_scalar,
 270                               crypto_ec_get_order(data->grp->group),
 271                               data->my_scalar) < 0) {
 272                 wpa_printf(MSG_INFO,
 273                            "EAP-pwd (server): unable to get randomness");
 274                 goto fin;
 275         }
 276
 277         if (crypto_ec_point_mul(data->grp->group, data->grp->pwe, mask,
 278                                 data->my_element) < 0) {
 279                 wpa_printf(MSG_INFO, "EAP-PWD (server): element allocation "
 280                            "fail");
 281                 eap_pwd_state(data, FAILURE);
 282                 goto fin;
 283         }
 284
 285         if (crypto_ec_point_invert(data->grp->group, data->my_element) < 0) {
 286                 wpa_printf(MSG_INFO, "EAP-PWD (server): element inversion "
 287                            "fail");
 288                 goto fin;
 289         }
 290
 291         scalar = os_malloc(order_len);
 292         element = os_malloc(prime_len * 2);
 293         if (!scalar || !element) {
 294                 wpa_printf(MSG_INFO, "EAP-PWD (server): data allocation fail");
 295                 goto fin;
 296         }
 297
 298         if (crypto_ec_point_to_bin(data->grp->group, data->my_element, element,
 299                                    element + prime_len) < 0) {
 300                 wpa_printf(MSG_INFO, "EAP-PWD (server): point assignment "
 301                            "fail");
 302                 goto fin;
 303         }
 304
 305         crypto_bignum_to_bin(data->my_scalar, scalar, order_len, order_len);
 306
 307         data->outbuf = wpabuf_alloc(2 * prime_len + order_len +
 308                                     (data->salt ? 1 + data->salt_len : 0));
 309         if (data->outbuf == NULL)
 310                 goto fin;
 311
 312         /* If we're doing salted password prep, add the salt */
 313         if (data->salt_len) {
 314                 wpabuf_put_u8(data->outbuf, data->salt_len);
 315                 wpabuf_put_data(data->outbuf, data->salt, data->salt_len);
 316         }
 317
 318         /* We send the element as (x,y) followed by the scalar */
 319         wpabuf_put_data(data->outbuf, element, 2 * prime_len);
 320         wpabuf_put_data(data->outbuf, scalar, order_len);
 321
 322 fin:
 323         crypto_bignum_deinit(mask, 1);
 324         os_free(scalar);
 325         os_free(element);
 326         if (data->outbuf == NULL)
 327                 eap_pwd_state(data, FAILURE);
 328 }
 329
 330
 331 static void eap_pwd_build_confirm_req(struct eap_sm *sm,
 332                                       struct eap_pwd_data *data, u8 id)
 333 {
 334         struct crypto_hash *hash;
 335         u8 conf[SHA256_MAC_LEN], *cruft = NULL, *ptr;
 336         u16 grp;
 337         size_t prime_len, order_len;
 338
 339         wpa_printf(MSG_DEBUG, "EAP-pwd: Confirm/Request");
 340         /*
 341          * if we're fragmenting then we already have an confirm request, just
 342          * return
 343          */
 344         if (data->out_frag_pos)
 345                 return;
 346
 347         prime_len = crypto_ec_prime_len(data->grp->group);
 348         order_len = crypto_ec_order_len(data->grp->group);
 349
 350         /* Each component of the cruft will be at most as big as the prime */
 351         cruft = os_malloc(prime_len * 2);
 352         if (!cruft) {
 353                 wpa_printf(MSG_INFO, "EAP-PWD (server): debug allocation "
 354                            "fail");
 355                 goto fin;
 356         }
 357
 358         /*
 359          * commit is H(k | server_element | server_scalar | peer_element |
 360          *             peer_scalar | ciphersuite)
 361          */
 362         hash = eap_pwd_h_init();
 363         if (hash == NULL)
 364                 goto fin;
 365
 366         /*
 367          * Zero the memory each time because this is mod prime math and some
 368          * value may start with a few zeros and the previous one did not.
 369          *
 370          * First is k
 371          */
 372         crypto_bignum_to_bin(data->k, cruft, prime_len, prime_len);
 373         eap_pwd_h_update(hash, cruft, prime_len);
 374
 375         /* server element: x, y */
 376         if (crypto_ec_point_to_bin(data->grp->group, data->my_element, cruft,
 377                                    cruft + prime_len) < 0) {
 378                 wpa_printf(MSG_INFO, "EAP-PWD (server): confirm point "
 379                            "assignment fail");
 380                 goto fin;
 381         }
 382         eap_pwd_h_update(hash, cruft, prime_len * 2);
 383
 384         /* server scalar */
 385         crypto_bignum_to_bin(data->my_scalar, cruft, order_len, order_len);
 386         eap_pwd_h_update(hash, cruft, order_len);
 387
 388         /* peer element: x, y */
 389         if (crypto_ec_point_to_bin(data->grp->group, data->peer_element, cruft,
 390                                    cruft + prime_len) < 0) {
 391                 wpa_printf(MSG_INFO, "EAP-PWD (server): confirm point "
 392                            "assignment fail");
 393                 goto fin;
 394         }
 395         eap_pwd_h_update(hash, cruft, prime_len * 2);
 396
 397         /* peer scalar */
 398         crypto_bignum_to_bin(data->peer_scalar, cruft, order_len, order_len);
 399         eap_pwd_h_update(hash, cruft, order_len);
 400
 401         /* ciphersuite */
 402         grp = htons(data->group_num);
 403         os_memset(cruft, 0, prime_len);
 404         ptr = cruft;
 405         os_memcpy(ptr, &grp, sizeof(u16));
 406         ptr += sizeof(u16);
 407         *ptr = EAP_PWD_DEFAULT_RAND_FUNC;
 408         ptr += sizeof(u8);
 409         *ptr = EAP_PWD_DEFAULT_PRF;
 410         ptr += sizeof(u8);
 411         eap_pwd_h_update(hash, cruft, ptr - cruft);
 412
 413         /* all done with the random function */
 414         eap_pwd_h_final(hash, conf);
 415         os_memcpy(data->my_confirm, conf, SHA256_MAC_LEN);
 416
 417         data->outbuf = wpabuf_alloc(SHA256_MAC_LEN);
 418         if (data->outbuf == NULL)
 419                 goto fin;
 420
 421         wpabuf_put_data(data->outbuf, conf, SHA256_MAC_LEN);
 422
 423 fin:
 424         bin_clear_free(cruft, prime_len * 2);
 425         if (data->outbuf == NULL)
 426                 eap_pwd_state(data, FAILURE);
 427 }
 428
 429
 430 static struct wpabuf *
 431 eap_pwd_build_req(struct eap_sm *sm, void *priv, u8 id)
 432 {
 433         struct eap_pwd_data *data = priv;
 434         struct wpabuf *req;
 435         u8 lm_exch;
 436         const u8 *buf;
 437         u16 totlen = 0;
 438         size_t len;
 439
 440         /*
 441          * if we're buffering response fragments then just ACK
 442          */
 443         if (data->in_frag_pos) {
 444                 wpa_printf(MSG_DEBUG, "EAP-pwd: ACKing a fragment!!");
 445                 req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD,
 446                                     EAP_PWD_HDR_SIZE, EAP_CODE_REQUEST, id);
 447                 if (req == NULL) {
 448                         eap_pwd_state(data, FAILURE);
 449                         return NULL;
 450                 }
 451                 switch (data->state) {
 452                 case PWD_ID_Req:
 453                         wpabuf_put_u8(req, EAP_PWD_OPCODE_ID_EXCH);
 454                         break;
 455                 case PWD_Commit_Req:
 456                         wpabuf_put_u8(req, EAP_PWD_OPCODE_COMMIT_EXCH);
 457                         break;
 458                 case PWD_Confirm_Req:
 459                         wpabuf_put_u8(req, EAP_PWD_OPCODE_CONFIRM_EXCH);
 460                         break;
 461                 default:
 462                         eap_pwd_state(data, FAILURE);   /* just to be sure */
 463                         wpabuf_free(req);
 464                         return NULL;
 465                 }
 466                 return req;
 467         }
 468
 469         /*
 470          * build the data portion of a request
 471          */
 472         switch (data->state) {
 473         case PWD_ID_Req:
 474                 eap_pwd_build_id_req(sm, data, id);
 475                 lm_exch = EAP_PWD_OPCODE_ID_EXCH;
 476                 break;
 477         case PWD_Commit_Req:
 478                 eap_pwd_build_commit_req(sm, data, id);
 479                 lm_exch = EAP_PWD_OPCODE_COMMIT_EXCH;
 480                 break;
 481         case PWD_Confirm_Req:
 482                 eap_pwd_build_confirm_req(sm, data, id);
 483                 lm_exch = EAP_PWD_OPCODE_CONFIRM_EXCH;
 484                 break;
 485         default:
 486                 wpa_printf(MSG_INFO, "EAP-pwd: Unknown state %d in build_req",
 487                            data->state);
 488                 eap_pwd_state(data, FAILURE);
 489                 lm_exch = 0;    /* hush now, sweet compiler */
 490                 break;
 491         }
 492
 493         if (data->state == FAILURE)
 494                 return NULL;
 495
 496         /*
 497          * determine whether that data needs to be fragmented
 498          */
 499         len = wpabuf_len(data->outbuf) - data->out_frag_pos;
 500         if ((len + EAP_PWD_HDR_SIZE) > data->mtu) {
 501                 len = data->mtu - EAP_PWD_HDR_SIZE;
 502                 EAP_PWD_SET_MORE_BIT(lm_exch);
 503                 /*
 504                  * if this is the first fragment, need to set the M bit
 505                  * and add the total length to the eap_pwd_hdr
 506                  */
 507                 if (data->out_frag_pos == 0) {
 508                         EAP_PWD_SET_LENGTH_BIT(lm_exch);
 509                         totlen = wpabuf_len(data->outbuf) +
 510                                 EAP_PWD_HDR_SIZE + sizeof(u16);
 511                         len -= sizeof(u16);
 512                         wpa_printf(MSG_DEBUG, "EAP-pwd: Fragmenting output, "
 513                                    "total length = %d", totlen);
 514                 }
 515                 wpa_printf(MSG_DEBUG, "EAP-pwd: Send a %d byte fragment",
 516                            (int) len);
 517         }
 518
 519         /*
 520          * alloc an eap request and populate it with the data
 521          */
 522         req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PWD,
 523                             EAP_PWD_HDR_SIZE + len +
 524                             (totlen ? sizeof(u16) : 0),
 525                             EAP_CODE_REQUEST, id);
 526         if (req == NULL) {
 527                 eap_pwd_state(data, FAILURE);
 528                 return NULL;
 529         }
 530
 531         wpabuf_put_u8(req, lm_exch);
 532         if (EAP_PWD_GET_LENGTH_BIT(lm_exch))
 533                 wpabuf_put_be16(req, totlen);
 534
 535         buf = wpabuf_head_u8(data->outbuf);
 536         wpabuf_put_data(req, buf + data->out_frag_pos, len);
 537         data->out_frag_pos += len;
 538         /*
 539          * either not fragged or last fragment, either way free up the data
 540          */
 541         if (data->out_frag_pos >= wpabuf_len(data->outbuf)) {
 542                 wpabuf_free(data->outbuf);
 543                 data->outbuf = NULL;
 544                 data->out_frag_pos = 0;
 545         }
 546
 547         return req;
 548 }
 549
 550
 551 static Boolean eap_pwd_check(struct eap_sm *sm, void *priv,
 552                              struct wpabuf *respData)
 553 {
 554         struct eap_pwd_data *data = priv;
 555         const u8 *pos;
 556         size_t len;
 557
 558         pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_PWD, respData, &len);
 559         if (pos == NULL || len < 1) {
 560                 wpa_printf(MSG_INFO, "EAP-pwd: Invalid frame");
 561                 return TRUE;
 562         }
 563
 564         wpa_printf(MSG_DEBUG, "EAP-pwd: Received frame: exch = %d, len = %d",
 565                    EAP_PWD_GET_EXCHANGE(*pos), (int) len);
 566
 567         if (data->state == PWD_ID_Req &&
 568             ((EAP_PWD_GET_EXCHANGE(*pos)) == EAP_PWD_OPCODE_ID_EXCH))
 569                 return FALSE;
 570
 571         if (data->state == PWD_Commit_Req &&
 572             ((EAP_PWD_GET_EXCHANGE(*pos)) == EAP_PWD_OPCODE_COMMIT_EXCH))
 573                 return FALSE;
 574
 575         if (data->state == PWD_Confirm_Req &&
 576             ((EAP_PWD_GET_EXCHANGE(*pos)) == EAP_PWD_OPCODE_CONFIRM_EXCH))
 577                 return FALSE;
 578
 579         wpa_printf(MSG_INFO, "EAP-pwd: Unexpected opcode=%d in state=%d",
 580                    *pos, data->state);
 581
 582         return TRUE;
 583 }
 584
 585
 586 static void eap_pwd_process_id_resp(struct eap_sm *sm,
 587                                     struct eap_pwd_data *data,
 588                                     const u8 *payload, size_t payload_len)
 589 {
 590         struct eap_pwd_id *id;
 591         const u8 *password;
 592         size_t password_len;
 593         u8 pwhashhash[16];
 594         int res;
 595
 596         if (payload_len < sizeof(struct eap_pwd_id)) {
 597                 wpa_printf(MSG_INFO, "EAP-pwd: Invalid ID response");
 598                 return;
 599         }
 600
 601         id = (struct eap_pwd_id *) payload;
 602         if ((data->group_num != be_to_host16(id->group_num)) ||
 603             (id->random_function != EAP_PWD_DEFAULT_RAND_FUNC) ||
 604             (os_memcmp(id->token, (u8 *)&data->token, sizeof(data->token))) ||
 605             (id->prf != EAP_PWD_DEFAULT_PRF) ||
 606             (id->prep != data->password_prep)) {
 607                 wpa_printf(MSG_INFO, "EAP-pwd: peer changed parameters");
 608                 eap_pwd_state(data, FAILURE);
 609                 return;
 610         }
 611         if (data->id_peer || data->grp) {
 612                 wpa_printf(MSG_INFO, "EAP-pwd: data was already allocated");
 613                 return;
 614         }
 615         data->id_peer = os_malloc(payload_len - sizeof(struct eap_pwd_id));
 616         if (data->id_peer == NULL) {
 617                 wpa_printf(MSG_INFO, "EAP-PWD: memory allocation id fail");
 618                 return;
 619         }
 620         data->id_peer_len = payload_len - sizeof(struct eap_pwd_id);
 621         os_memcpy(data->id_peer, id->identity, data->id_peer_len);
 622         wpa_hexdump_ascii(MSG_DEBUG, "EAP-PWD (server): peer sent id of",
 623                           data->id_peer, data->id_peer_len);
 624
 625         data->grp = get_eap_pwd_group(data->group_num);
 626         if (data->grp == NULL) {
 627                 wpa_printf(MSG_INFO, "EAP-PWD: failed to allocate memory for "
 628                            "group");
 629                 return;
 630         }
 631
 632         /*
 633          * If it's PREP_MS then hash the password again, otherwise regardless
 634          * of the prep the client is doing, the password we have is the one to
 635          * use to generate the password element.
 636          */
 637         if (data->password_prep == EAP_PWD_PREP_MS) {
 638                 res = hash_nt_password_hash(data->password, pwhashhash);
 639                 if (res)
 640                         return;
 641                 password = pwhashhash;
 642                 password_len = sizeof(pwhashhash);
 643         } else {
 644                 password = data->password;
 645                 password_len = data->password_len;
 646         }
 647
 648         res = compute_password_element(data->grp, data->group_num,
 649                                        password, password_len,
 650                                        data->id_server, data->id_server_len,
 651                                        data->id_peer, data->id_peer_len,
 652                                        (u8 *) &data->token);
 653         os_memset(pwhashhash, 0, sizeof(pwhashhash));
 654         if (res) {
 655                 wpa_printf(MSG_INFO, "EAP-PWD (server): unable to compute "
 656                            "PWE");
 657                 return;
 658         }
 659         wpa_printf(MSG_DEBUG, "EAP-PWD (server): computed %d bit PWE...",
 660                    (int) crypto_ec_prime_len_bits(data->grp->group));
 661
 662         eap_pwd_state(data, PWD_Commit_Req);
 663 }
 664
 665
 666 static void
 667 eap_pwd_process_commit_resp(struct eap_sm *sm, struct eap_pwd_data *data,
 668                             const u8 *payload, size_t payload_len)
 669 {
 670         const u8 *ptr;
 671         struct crypto_bignum *cofactor = NULL;
 672         struct crypto_ec_point *K = NULL, *point = NULL;
 673         int res = 0;
 674         size_t prime_len, order_len;
 675
 676         wpa_printf(MSG_DEBUG, "EAP-pwd: Received commit response");
 677
 678         prime_len = crypto_ec_prime_len(data->grp->group);
 679         order_len = crypto_ec_order_len(data->grp->group);
 680
 681         if (payload_len != 2 * prime_len + order_len) {
 682                 wpa_printf(MSG_INFO,
 683                            "EAP-pwd: Unexpected Commit payload length %u (expected %u)",
 684                            (unsigned int) payload_len,
 685                            (unsigned int) (2 * prime_len + order_len));
 686                 goto fin;
 687         }
 688
 689         data->k = crypto_bignum_init();
 690         cofactor = crypto_bignum_init();
 691         point = crypto_ec_point_init(data->grp->group);
 692         K = crypto_ec_point_init(data->grp->group);
 693         if (!data->k || !cofactor || !point || !K) {
 694                 wpa_printf(MSG_INFO, "EAP-PWD (server): peer data allocation "
 695                            "fail");
 696                 goto fin;
 697         }
 698
 699         if (crypto_ec_cofactor(data->grp->group, cofactor) < 0) {
 700                 wpa_printf(MSG_INFO, "EAP-PWD (server): unable to get "
 701                            "cofactor for curve");
 702                 goto fin;
 703         }
 704
 705         /* element, x then y, followed by scalar */
 706         ptr = payload;
 707         data->peer_element = crypto_ec_point_from_bin(data->grp->group, ptr);
 708         if (!data->peer_element) {
 709                 wpa_printf(MSG_INFO, "EAP-PWD (server): setting peer element "
 710                            "fail");
 711                 goto fin;
 712         }
 713         ptr += prime_len * 2;
 714         data->peer_scalar = crypto_bignum_init_set(ptr, order_len);
 715         if (!data->peer_scalar) {
 716                 wpa_printf(MSG_INFO, "EAP-PWD (server): peer data allocation "
 717                            "fail");
 718                 goto fin;
 719         }
 720
 721         /* check to ensure peer's element is not in a small sub-group */
 722         if (!crypto_bignum_is_one(cofactor)) {
 723                 if (crypto_ec_point_mul(data->grp->group, data->peer_element,
 724                                         cofactor, point) != 0) {
 725                         wpa_printf(MSG_INFO, "EAP-PWD (server): cannot "
 726                                    "multiply peer element by order");
 727                         goto fin;
 728                 }
 729                 if (crypto_ec_point_is_at_infinity(data->grp->group, point)) {
 730                         wpa_printf(MSG_INFO, "EAP-PWD (server): peer element "
 731                                    "is at infinity!\n");
 732                         goto fin;
 733                 }
 734         }
 735
 736         /* compute the shared key, k */
 737         if ((crypto_ec_point_mul(data->grp->group, data->grp->pwe,
 738                                  data->peer_scalar, K) < 0) ||
 739             (crypto_ec_point_add(data->grp->group, K, data->peer_element,
 740                                  K) < 0) ||
 741             (crypto_ec_point_mul(data->grp->group, K, data->private_value,
 742                                  K) < 0)) {
 743                 wpa_printf(MSG_INFO, "EAP-PWD (server): computing shared key "
 744                            "fail");
 745                 goto fin;
 746         }
 747
 748         /* ensure that the shared key isn't in a small sub-group */
 749         if (!crypto_bignum_is_one(cofactor)) {
 750                 if (crypto_ec_point_mul(data->grp->group, K, cofactor,
 751                                         K) != 0) {
 752                         wpa_printf(MSG_INFO, "EAP-PWD (server): cannot "
 753                                    "multiply shared key point by order!\n");
 754                         goto fin;
 755                 }
 756         }
 757
 758         /*
 759          * This check is strictly speaking just for the case above where
 760          * co-factor > 1 but it was suggested that even though this is probably
 761          * never going to happen it is a simple and safe check "just to be
 762          * sure" so let's be safe.
 763          */
 764         if (crypto_ec_point_is_at_infinity(data->grp->group, K)) {
 765                 wpa_printf(MSG_INFO, "EAP-PWD (server): shared key point is "
 766                            "at infinity");
 767                 goto fin;
 768         }
 769         if (crypto_ec_point_x(data->grp->group, K, data->k)) {
 770                 wpa_printf(MSG_INFO, "EAP-PWD (server): unable to extract "
 771                            "shared secret from secret point");
 772                 goto fin;
 773         }
 774         res = 1;
 775
 776 fin:
 777         crypto_ec_point_deinit(K, 1);
 778         crypto_ec_point_deinit(point, 1);
 779         crypto_bignum_deinit(cofactor, 1);
 780
 781         if (res)
 782                 eap_pwd_state(data, PWD_Confirm_Req);
 783         else
 784                 eap_pwd_state(data, FAILURE);
 785 }
 786
 787
 788 static void
 789 eap_pwd_process_confirm_resp(struct eap_sm *sm, struct eap_pwd_data *data,
 790                              const u8 *payload, size_t payload_len)
 791 {
 792         struct crypto_hash *hash;
 793         u32 cs;
 794         u16 grp;
 795         u8 conf[SHA256_MAC_LEN], *cruft = NULL, *ptr;
 796         size_t prime_len, order_len;
 797
 798         prime_len = crypto_ec_prime_len(data->grp->group);
 799         order_len = crypto_ec_order_len(data->grp->group);
 800
 801         if (payload_len != SHA256_MAC_LEN) {
 802                 wpa_printf(MSG_INFO,
 803                            "EAP-pwd: Unexpected Confirm payload length %u (expected %u)",
 804                            (unsigned int) payload_len, SHA256_MAC_LEN);
 805                 goto fin;
 806         }
 807
 808         /* build up the ciphersuite: group | random_function | prf */
 809         grp = htons(data->group_num);
 810         ptr = (u8 *) &cs;
 811         os_memcpy(ptr, &grp, sizeof(u16));
 812         ptr += sizeof(u16);
 813         *ptr = EAP_PWD_DEFAULT_RAND_FUNC;
 814         ptr += sizeof(u8);
 815         *ptr = EAP_PWD_DEFAULT_PRF;
 816
 817         /* each component of the cruft will be at most as big as the prime */
 818         cruft = os_malloc(prime_len * 2);
 819         if (!cruft) {
 820                 wpa_printf(MSG_INFO, "EAP-PWD (peer): allocation fail");
 821                 goto fin;
 822         }
 823
 824         /*
 825          * commit is H(k | peer_element | peer_scalar | server_element |
 826          *             server_scalar | ciphersuite)
 827          */
 828         hash = eap_pwd_h_init();
 829         if (hash == NULL)
 830                 goto fin;
 831
 832         /* k */
 833         crypto_bignum_to_bin(data->k, cruft, prime_len, prime_len);
 834         eap_pwd_h_update(hash, cruft, prime_len);
 835
 836         /* peer element: x, y */
 837         if (crypto_ec_point_to_bin(data->grp->group, data->peer_element, cruft,
 838                                    cruft + prime_len) < 0) {
 839                 wpa_printf(MSG_INFO, "EAP-PWD (server): confirm point "
 840                            "assignment fail");
 841                 goto fin;
 842         }
 843         eap_pwd_h_update(hash, cruft, prime_len * 2);
 844
 845         /* peer scalar */
 846         crypto_bignum_to_bin(data->peer_scalar, cruft, order_len, order_len);
 847         eap_pwd_h_update(hash, cruft, order_len);
 848
 849         /* server element: x, y */
 850         if (crypto_ec_point_to_bin(data->grp->group, data->my_element, cruft,
 851                                    cruft + prime_len) < 0) {
 852                 wpa_printf(MSG_INFO, "EAP-PWD (server): confirm point "
 853                            "assignment fail");
 854                 goto fin;
 855         }
 856         eap_pwd_h_update(hash, cruft, prime_len * 2);
 857
 858         /* server scalar */
 859         crypto_bignum_to_bin(data->my_scalar, cruft, order_len, order_len);
 860         eap_pwd_h_update(hash, cruft, order_len);
 861
 862         /* ciphersuite */
 863         eap_pwd_h_update(hash, (u8 *) &cs, sizeof(u32));
 864
 865         /* all done */
 866         eap_pwd_h_final(hash, conf);
 867
 868         ptr = (u8 *) payload;
 869         if (os_memcmp_const(conf, ptr, SHA256_MAC_LEN)) {
 870                 wpa_printf(MSG_INFO, "EAP-PWD (server): confirm did not "
 871                            "verify");
 872                 goto fin;
 873         }
 874
 875         wpa_printf(MSG_DEBUG, "EAP-pwd (server): confirm verified");
 876         if (compute_keys(data->grp, data->k,
 877                          data->peer_scalar, data->my_scalar, conf,
 878                          data->my_confirm, &cs, data->msk, data->emsk,
 879                          data->session_id) < 0)
 880                 eap_pwd_state(data, FAILURE);
 881         else
 882                 eap_pwd_state(data, SUCCESS);
 883
 884 fin:
 885         bin_clear_free(cruft, prime_len * 2);
 886 }
 887
 888
 889 static void eap_pwd_process(struct eap_sm *sm, void *priv,
 890                             struct wpabuf *respData)
 891 {
 892         struct eap_pwd_data *data = priv;
 893         const u8 *pos;
 894         size_t len;
 895         u8 lm_exch;
 896         u16 tot_len;
 897
 898         pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_PWD, respData, &len);
 899         if ((pos == NULL) || (len < 1)) {
 900                 wpa_printf(MSG_INFO, "Bad EAP header! pos %s and len = %d",
 901                            (pos == NULL) ? "is NULL" : "is not NULL",
 902                            (int) len);
 903                 return;
 904         }
 905
 906         lm_exch = *pos;
 907         pos++;            /* skip over the bits and the exch */
 908         len--;
 909
 910         /*
 911          * if we're fragmenting then this should be an ACK with no data,
 912          * just return and continue fragmenting in the "build" section above
 913          */
 914         if (data->out_frag_pos) {
 915                 if (len > 1)
 916                         wpa_printf(MSG_INFO, "EAP-pwd: Bad response! "
 917                                    "Fragmenting but not an ACK");
 918                 else
 919                         wpa_printf(MSG_DEBUG, "EAP-pwd: received ACK from "
 920                                    "peer");
 921                 return;
 922         }
 923         /*
 924          * if we're receiving fragmented packets then we need to buffer...
 925          *
 926          * the first fragment has a total length
 927          */
 928         if (EAP_PWD_GET_LENGTH_BIT(lm_exch)) {
 929                 if (len < 2) {
 930                         wpa_printf(MSG_DEBUG,
 931                                    "EAP-pwd: Frame too short to contain Total-Length field");
 932                         return;
 933                 }
 934                 tot_len = WPA_GET_BE16(pos);
 935                 wpa_printf(MSG_DEBUG, "EAP-pwd: Incoming fragments, total "
 936                            "length = %d", tot_len);
 937                 if (tot_len > 15000)
 938                         return;
 939                 if (data->inbuf) {
 940                         wpa_printf(MSG_DEBUG,
 941                                    "EAP-pwd: Unexpected new fragment start when previous fragment is still in use");
 942                         return;
 943                 }
 944                 data->inbuf = wpabuf_alloc(tot_len);
 945                 if (data->inbuf == NULL) {
 946                         wpa_printf(MSG_INFO, "EAP-pwd: Out of memory to "
 947                                    "buffer fragments!");
 948                         return;
 949                 }
 950                 data->in_frag_pos = 0;
 951                 pos += sizeof(u16);
 952                 len -= sizeof(u16);
 953         }
 954         /*
 955          * the first and all intermediate fragments have the M bit set
 956          */
 957         if (EAP_PWD_GET_MORE_BIT(lm_exch) || data->in_frag_pos) {
 958                 if ((data->in_frag_pos + len) > wpabuf_size(data->inbuf)) {
 959                         wpa_printf(MSG_DEBUG, "EAP-pwd: Buffer overflow "
 960                                    "attack detected! (%d+%d > %d)",
 961                                    (int) data->in_frag_pos, (int) len,
 962                                    (int) wpabuf_size(data->inbuf));
 963                         eap_pwd_state(data, FAILURE);
 964                         return;
 965                 }
 966                 wpabuf_put_data(data->inbuf, pos, len);
 967                 data->in_frag_pos += len;
 968         }
 969         if (EAP_PWD_GET_MORE_BIT(lm_exch)) {
 970                 wpa_printf(MSG_DEBUG, "EAP-pwd: Got a %d byte fragment",
 971                            (int) len);
 972                 return;
 973         }
 974         /*
 975          * last fragment won't have the M bit set (but we're obviously
 976          * buffering fragments so that's how we know it's the last)
 977          */
 978         if (data->in_frag_pos) {
 979                 pos = wpabuf_head_u8(data->inbuf);
 980                 len = data->in_frag_pos;
 981                 wpa_printf(MSG_DEBUG, "EAP-pwd: Last fragment, %d bytes",
 982                            (int) len);
 983         }
 984         switch (EAP_PWD_GET_EXCHANGE(lm_exch)) {
 985         case EAP_PWD_OPCODE_ID_EXCH:
 986                 eap_pwd_process_id_resp(sm, data, pos, len);
 987                 break;
 988         case EAP_PWD_OPCODE_COMMIT_EXCH:
 989                 eap_pwd_process_commit_resp(sm, data, pos, len);
 990                 break;
 991         case EAP_PWD_OPCODE_CONFIRM_EXCH:
 992                 eap_pwd_process_confirm_resp(sm, data, pos, len);
 993                 break;
 994         }
 995         /*
 996          * if we had been buffering fragments, here's a great place
 997          * to clean up
 998          */
 999         if (data->in_frag_pos) {
1000                 wpabuf_free(data->inbuf);
1001                 data->inbuf = NULL;
1002                 data->in_frag_pos = 0;
1003         }
1004 }
1005
1006
1007 static u8 * eap_pwd_getkey(struct eap_sm *sm, void *priv, size_t *len)
1008 {
1009         struct eap_pwd_data *data = priv;
1010         u8 *key;
1011
1012         if (data->state != SUCCESS)
1013                 return NULL;
1014
1015         key = os_memdup(data->msk, EAP_MSK_LEN);
1016         if (key == NULL)
1017                 return NULL;
1018
1019         *len = EAP_MSK_LEN;
1020
1021         return key;
1022 }
1023
1024
1025 static u8 * eap_pwd_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
1026 {
1027         struct eap_pwd_data *data = priv;
1028         u8 *key;
1029
1030         if (data->state != SUCCESS)
1031                 return NULL;
1032
1033         key = os_memdup(data->emsk, EAP_EMSK_LEN);
1034         if (key == NULL)
1035                 return NULL;
1036
1037         *len = EAP_EMSK_LEN;
1038
1039         return key;
1040 }
1041
1042
1043 static Boolean eap_pwd_is_success(struct eap_sm *sm, void *priv)
1044 {
1045         struct eap_pwd_data *data = priv;
1046         return data->state == SUCCESS;
1047 }
1048
1049
1050 static Boolean eap_pwd_is_done(struct eap_sm *sm, void *priv)
1051 {
1052         struct eap_pwd_data *data = priv;
1053         return (data->state == SUCCESS) || (data->state == FAILURE);
1054 }
1055
1056
1057 static u8 * eap_pwd_get_session_id(struct eap_sm *sm, void *priv, size_t *len)
1058 {
1059         struct eap_pwd_data *data = priv;
1060         u8 *id;
1061
1062         if (data->state != SUCCESS)
1063                 return NULL;
1064
1065         id = os_memdup(data->session_id, 1 + SHA256_MAC_LEN);
1066         if (id == NULL)
1067                 return NULL;
1068
1069         *len = 1 + SHA256_MAC_LEN;
1070
1071         return id;
1072 }
1073
1074
1075 int eap_server_pwd_register(void)
1076 {
1077         struct eap_method *eap;
1078         struct timeval tp;
1079         struct timezone tz;
1080         u32 sr;
1081
1082         sr = 0xdeaddada;
1083         (void) gettimeofday(&tp, &tz);
1084         sr ^= (tp.tv_sec ^ tp.tv_usec);
1085         srandom(sr);
1086
1087         eap = eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION,
1088                                       EAP_VENDOR_IETF, EAP_TYPE_PWD,
1089                                       "PWD");
1090         if (eap == NULL)
1091                 return -1;
1092
1093         eap->init = eap_pwd_init;
1094         eap->reset = eap_pwd_reset;
1095         eap->buildReq = eap_pwd_build_req;
1096         eap->check = eap_pwd_check;
1097         eap->process = eap_pwd_process;
1098         eap->isDone = eap_pwd_is_done;
1099         eap->getKey = eap_pwd_getkey;
1100         eap->get_emsk = eap_pwd_get_emsk;
1101         eap->isSuccess = eap_pwd_is_success;
1102         eap->getSessionId = eap_pwd_get_session_id;
1103
1104         return eap_server_method_register(eap);
1105 }