~ubuntu-branches/ubuntu/trusty/wpa/trusty

Viewing changes to src/eap_peer/eap_eke.c

Committer: Package Import Robot
Author(s): Mathieu Trudel-Lapierre
Date: 2014-03-04 16:13:24 UTC
mfrom: (1.1.2)
Revision ID: package-import@ubuntu.com-20140304161324-md40gw8imcectbuu

Tags: 2.1-0ubuntu1

* New upstream release (LP: #1099755)
* debian/get-orig-source: update for new git repository for the current
  hostap/wpasupplicant versions.
* Dropped patches due to being applied upstream and included in the current
  source tarball:
  - debian/patches/11_wpa_gui_ftbfs_gcc_4_7.patch
  - debian/patches/13_human_readable_signal.patch
  - debian/patches/git_deinit_p2p_context_on_mgmt_remove_ff1f9c8.patch
  - debian/patches/libnl3-includes.patch
* debian/patches/git_accept_client_cert_from_server.patch: revert the commit:
  "OpenSSL: Do not accept SSL Client certificate for server", which breaks
  many AAA servers that include both client and server EKUs. Cherry-picked
  from hostap git commit b62d5b5.

files added:
.pc/git_accept_client_cert_from_server.patch

.pc/git_accept_client_cert_from_server.patch/src

.pc/git_accept_client_cert_from_server.patch/src/crypto

.pc/git_accept_client_cert_from_server.patch/src/crypto/tls.h

.pc/git_accept_client_cert_from_server.patch/src/crypto/tls_openssl.c

debian/patches/git_accept_client_cert_from_server.patch

hostapd/android.config

hostapd/hlr_auc_gw.txt

hostapd/hostapd.eap_user_sqlite

hostapd/wps-ap-nfc.py

patches/openssl-0.9.8x-tls-extensions.patch

src/ap/acs.c

src/ap/acs.h

src/ap/dfs.c

src/ap/dfs.h

src/ap/eap_user_db.c

src/ap/gas_serv.c

src/ap/gas_serv.h

src/ap/hs20.c

src/ap/hs20.h

src/ap/ieee802_11_vht.c

src/ap/vlan_util.c

src/ap/vlan_util.h

src/ap/wnm_ap.c

src/ap/wnm_ap.h

src/common/qca-vendor.h

src/common/sae.c

src/common/sae.h

src/crypto/aes-ccm.c

src/crypto/aes-gcm.c

src/crypto/sha1-prf.c

src/crypto/sha256-prf.c

src/crypto/sha256-tlsprf.c

src/crypto/sha256_i.h

src/drivers/android_drv.h

src/drivers/driver_openbsd.c

src/drivers/linux_wext.h

src/eap_common/eap_eke_common.c

src/eap_common/eap_eke_common.h

src/eap_peer/eap_eke.c

src/eap_peer/eap_proxy.h

src/eap_peer/eap_proxy_dummy.c

src/eap_server/eap_server_eke.c

src/radius/radius_das.c

src/radius/radius_das.h

src/utils/bitfield.c

src/utils/bitfield.h

src/utils/ext_password.c

src/utils/ext_password.h

src/utils/ext_password_i.h

src/utils/ext_password_test.c

src/wps/wps_attr_parse.h

wpa_supplicant/README-HS20

wpa_supplicant/android.config

wpa_supplicant/autoscan.c

wpa_supplicant/autoscan.h

wpa_supplicant/autoscan_exponential.c

wpa_supplicant/autoscan_periodic.c

wpa_supplicant/doc/docbook/eapol_test.sgml

wpa_supplicant/eap_proxy_dummy.mk

wpa_supplicant/examples/dbus-listen-preq.py

wpa_supplicant/examples/p2p

wpa_supplicant/examples/p2p-nfc.py

wpa_supplicant/examples/p2p/p2p_connect.py

wpa_supplicant/examples/p2p/p2p_disconnect.py

wpa_supplicant/examples/p2p/p2p_find.py

wpa_supplicant/examples/p2p/p2p_flush.py

wpa_supplicant/examples/p2p/p2p_group_add.py

wpa_supplicant/examples/p2p/p2p_invite.py

wpa_supplicant/examples/p2p/p2p_listen.py

wpa_supplicant/examples/p2p/p2p_stop_find.py

wpa_supplicant/examples/wps-ap-cli

wpa_supplicant/examples/wps-nfc.py

wpa_supplicant/hs20_supplicant.c

wpa_supplicant/hs20_supplicant.h

wpa_supplicant/nfc_pw_token.c

wpa_supplicant/systemd/wpa_supplicant-nl80211.service.arg.in

wpa_supplicant/systemd/wpa_supplicant-wired.service.arg.in

wpa_supplicant/systemd/wpa_supplicant.service.arg.in

wpa_supplicant/utils

wpa_supplicant/utils/log2pcap.py

wpa_supplicant/wifi_display.c

wpa_supplicant/wifi_display.h

wpa_supplicant/wnm_sta.c

wpa_supplicant/wnm_sta.h

wpa_supplicant/wpa_supplicant_conf.mk

wpa_supplicant/wpa_supplicant_conf.sh

wpa_supplicant/wpa_supplicant_template.conf

files removed:
.pc/11_wpa_gui_ftbfs_gcc_4_7.patch

.pc/11_wpa_gui_ftbfs_gcc_4_7.patch/wpa_supplicant

.pc/11_wpa_gui_ftbfs_gcc_4_7.patch/wpa_supplicant/wpa_gui-qt4

.pc/11_wpa_gui_ftbfs_gcc_4_7.patch/wpa_supplicant/wpa_gui-qt4/wpagui.cpp

.pc/13_human_readable_signal.patch

.pc/13_human_readable_signal.patch/wpa_supplicant

.pc/13_human_readable_signal.patch/wpa_supplicant/wpa_gui-qt4

.pc/13_human_readable_signal.patch/wpa_supplicant/wpa_gui-qt4/scanresults.cpp

.pc/13_human_readable_signal.patch/wpa_supplicant/wpa_gui-qt4/signalbar.cpp

.pc/13_human_readable_signal.patch/wpa_supplicant/wpa_gui-qt4/signalbar.h

.pc/13_human_readable_signal.patch/wpa_supplicant/wpa_gui-qt4/wpa_gui.pro

.pc/git_deinit_p2p_context_on_mgmt_remove_ff1f9c8.patch

.pc/git_deinit_p2p_context_on_mgmt_remove_ff1f9c8.patch/wpa_supplicant

.pc/git_deinit_p2p_context_on_mgmt_remove_ff1f9c8.patch/wpa_supplicant/p2p_supplicant.c

.pc/git_deinit_p2p_context_on_mgmt_remove_ff1f9c8.patch/wpa_supplicant/wpa_supplicant.c

.pc/git_deinit_p2p_context_on_mgmt_remove_ff1f9c8.patch/wpa_supplicant/wpa_supplicant_i.h

.pc/libnl3-includes.patch

.pc/libnl3-includes.patch/src

.pc/libnl3-includes.patch/src/drivers

.pc/libnl3-includes.patch/src/drivers/drivers.mak

debian/patches/11_wpa_gui_ftbfs_gcc_4_7.patch

debian/patches/13_human_readable_signal.patch

debian/patches/git_deinit_p2p_context_on_mgmt_remove_ff1f9c8.patch

debian/patches/libnl3-includes.patch

hostapd/dump_state.c

hostapd/dump_state.h

src/crypto/md5-non-fips.c

src/drivers/Apple80211.h

src/drivers/MobileApple80211.c

src/drivers/MobileApple80211.h

src/drivers/driver_broadcom.c

src/drivers/driver_iphone.m

src/drivers/driver_osx.m

src/drivers/driver_ralink.c

src/drivers/driver_ralink.h

src/drivers/wireless_copy.h

src/utils/eloop_none.c

src/wps/wps_nfc.c

src/wps/wps_nfc_pn531.c

src/wps/wps_ufd.c

wpa_supplicant/main_symbian.cpp

wpa_supplicant/symbian

wpa_supplicant/symbian/README.symbian

wpa_supplicant/symbian/bld.inf

wpa_supplicant/symbian/wpa_supplicant.mmp

wpa_supplicant/systemd/wpa_supplicant-nl80211@.service.in

wpa_supplicant/systemd/wpa_supplicant-wired@.service.in

wpa_supplicant/systemd/wpa_supplicant@.service.in

wpa_supplicant/wpa_gui

wpa_supplicant/wpa_gui/.gitignore

wpa_supplicant/wpa_gui/eventhistory.ui

wpa_supplicant/wpa_gui/eventhistory.ui.h

wpa_supplicant/wpa_gui/main.cpp

wpa_supplicant/wpa_gui/networkconfig.ui

wpa_supplicant/wpa_gui/networkconfig.ui.h

wpa_supplicant/wpa_gui/scanresults.ui

wpa_supplicant/wpa_gui/scanresults.ui.h

wpa_supplicant/wpa_gui/setup-mingw-cross-compiling

wpa_supplicant/wpa_gui/userdatarequest.ui

wpa_supplicant/wpa_gui/userdatarequest.ui.h

wpa_supplicant/wpa_gui/wpa_gui.pro

wpa_supplicant/wpa_gui/wpagui.ui

wpa_supplicant/wpa_gui/wpagui.ui.h

wpa_supplicant/wpa_gui/wpamsg.h

wpa_supplicant/wpa_supplicant.nsi

wpa_supplicant/xcode

wpa_supplicant/xcode/wpa_supplicant.xcodeproj

wpa_supplicant/xcode/wpa_supplicant.xcodeproj/project.pbxproj

files modified:
.pc/01_use_pkg-config_for_pcsc-lite_module.patch/wpa_supplicant/Makefile

.pc/12_wpa_gui_knotify_support.patch/wpa_supplicant/wpa_gui-qt4/wpagui.cpp

.pc/EAP-TLS-server_fix-TLS-Message-length-validation.patch/src/eap_server/eap_server_tls_common.c

.pc/applied-patches

.pc/session-ticket.patch/src/crypto/tls_openssl.c

COPYING

README

debian/changelog

debian/get-orig-source

debian/patches/series

hostapd/Android.mk

hostapd/ChangeLog

hostapd/Makefile

hostapd/README

hostapd/README-WPS

hostapd/config_file.c

hostapd/config_file.h

hostapd/ctrl_iface.c

hostapd/ctrl_iface.h

hostapd/defconfig

hostapd/eap_register.c

hostapd/eap_register.h

hostapd/hlr_auc_gw.c

hostapd/hostapd.conf

hostapd/hostapd.eap_user

hostapd/hostapd_cli.c

hostapd/main.c

hostapd/nt_password_hash.c

src/ap/Makefile

src/ap/accounting.c

src/ap/accounting.h

src/ap/ap_config.c

src/ap/ap_config.h

src/ap/ap_drv_ops.c

src/ap/ap_drv_ops.h

src/ap/ap_list.c

src/ap/ap_list.h

src/ap/ap_mlme.c

src/ap/ap_mlme.h

src/ap/authsrv.c

src/ap/authsrv.h

src/ap/beacon.c

src/ap/beacon.h

src/ap/ctrl_iface_ap.c

src/ap/ctrl_iface_ap.h

src/ap/drv_callbacks.c

src/ap/hostapd.c

src/ap/hostapd.h

src/ap/hw_features.c

src/ap/hw_features.h

src/ap/iapp.c

src/ap/iapp.h

src/ap/ieee802_11.c

src/ap/ieee802_11.h

src/ap/ieee802_11_auth.c

src/ap/ieee802_11_auth.h

src/ap/ieee802_11_ht.c

src/ap/ieee802_11_shared.c

src/ap/ieee802_1x.c

src/ap/ieee802_1x.h

src/ap/p2p_hostapd.c

src/ap/p2p_hostapd.h

src/ap/peerkey_auth.c

src/ap/pmksa_cache_auth.c

src/ap/pmksa_cache_auth.h

src/ap/preauth_auth.c

src/ap/preauth_auth.h

src/ap/sta_info.c

src/ap/sta_info.h

src/ap/tkip_countermeasures.c

src/ap/tkip_countermeasures.h

src/ap/utils.c

src/ap/vlan_init.c

src/ap/vlan_init.h

src/ap/wmm.c

src/ap/wmm.h

src/ap/wpa_auth.c

src/ap/wpa_auth.h

src/ap/wpa_auth_ft.c

src/ap/wpa_auth_glue.c

src/ap/wpa_auth_glue.h

src/ap/wpa_auth_i.h

src/ap/wpa_auth_ie.c

src/ap/wpa_auth_ie.h

src/ap/wps_hostapd.c

src/ap/wps_hostapd.h

src/common/Makefile

src/common/defs.h

src/common/eapol_common.h

src/common/gas.c

src/common/gas.h

src/common/ieee802_11_common.c

src/common/ieee802_11_common.h

src/common/ieee802_11_defs.h

src/common/privsep_commands.h

src/common/version.h

src/common/wpa_common.c

src/common/wpa_common.h

src/common/wpa_ctrl.c

src/common/wpa_ctrl.h

src/crypto/Makefile

src/crypto/aes-cbc.c

src/crypto/aes-ctr.c

src/crypto/aes-eax.c

src/crypto/aes-encblock.c

src/crypto/aes-internal-dec.c

src/crypto/aes-internal-enc.c

src/crypto/aes-internal.c

src/crypto/aes-omac1.c

src/crypto/aes-unwrap.c

src/crypto/aes-wrap.c

src/crypto/aes.h

src/crypto/aes_i.h

src/crypto/aes_wrap.h

src/crypto/crypto.h

src/crypto/crypto_cryptoapi.c

src/crypto/crypto_gnutls.c

src/crypto/crypto_internal-cipher.c

src/crypto/crypto_internal-modexp.c

src/crypto/crypto_internal-rsa.c

src/crypto/crypto_internal.c

src/crypto/crypto_libtomcrypt.c

src/crypto/crypto_none.c

src/crypto/crypto_nss.c

src/crypto/crypto_openssl.c

src/crypto/des-internal.c

src/crypto/des_i.h

src/crypto/dh_group5.c

src/crypto/dh_group5.h

src/crypto/dh_groups.c

src/crypto/dh_groups.h

src/crypto/fips_prf_cryptoapi.c

src/crypto/fips_prf_gnutls.c

src/crypto/fips_prf_internal.c

src/crypto/fips_prf_nss.c

src/crypto/fips_prf_openssl.c

src/crypto/md4-internal.c

src/crypto/md5-internal.c

src/crypto/md5.c

src/crypto/md5.h

src/crypto/md5_i.h

src/crypto/milenage.c

src/crypto/milenage.h

src/crypto/ms_funcs.c

src/crypto/ms_funcs.h

src/crypto/random.c

src/crypto/random.h

src/crypto/rc4.c

src/crypto/sha1-internal.c

src/crypto/sha1-pbkdf2.c

src/crypto/sha1-tlsprf.c

src/crypto/sha1-tprf.c

src/crypto/sha1.c

src/crypto/sha1.h

src/crypto/sha1_i.h

src/crypto/sha256-internal.c

src/crypto/sha256.c

src/crypto/sha256.h

src/crypto/tls.h

src/crypto/tls_gnutls.c

src/crypto/tls_internal.c

src/crypto/tls_none.c

src/crypto/tls_nss.c

src/crypto/tls_openssl.c

src/crypto/tls_schannel.c

src/drivers/Makefile

src/drivers/driver.h

src/drivers/driver_atheros.c

src/drivers/driver_bsd.c

src/drivers/driver_common.c

src/drivers/driver_hostap.c

src/drivers/driver_hostap.h

src/drivers/driver_madwifi.c

src/drivers/driver_ndis.c

src/drivers/driver_ndis.h

src/drivers/driver_ndis_.c

src/drivers/driver_nl80211.c

src/drivers/driver_none.c

src/drivers/driver_privsep.c

src/drivers/driver_roboswitch.c

src/drivers/driver_test.c

src/drivers/driver_wext.c

src/drivers/driver_wext.h

src/drivers/driver_wired.c

src/drivers/drivers.c

src/drivers/drivers.mak

src/drivers/drivers.mk

src/drivers/linux_ioctl.c

src/drivers/linux_ioctl.h

src/drivers/ndis_events.c

src/drivers/netlink.c

src/drivers/netlink.h

src/drivers/nl80211_copy.h

src/drivers/priv_netlink.h

src/drivers/rfkill.c

src/drivers/rfkill.h

src/eap_common/Makefile

src/eap_common/chap.c

src/eap_common/chap.h

src/eap_common/eap_common.c

src/eap_common/eap_common.h

src/eap_common/eap_defs.h

src/eap_common/eap_fast_common.c

src/eap_common/eap_fast_common.h

src/eap_common/eap_gpsk_common.c

src/eap_common/eap_gpsk_common.h

src/eap_common/eap_ikev2_common.c

src/eap_common/eap_ikev2_common.h

src/eap_common/eap_pax_common.c

src/eap_common/eap_pax_common.h

src/eap_common/eap_peap_common.c

src/eap_common/eap_peap_common.h

src/eap_common/eap_psk_common.c

src/eap_common/eap_psk_common.h

src/eap_common/eap_pwd_common.c

src/eap_common/eap_pwd_common.h

src/eap_common/eap_sake_common.c

src/eap_common/eap_sake_common.h

src/eap_common/eap_sim_common.c

src/eap_common/eap_sim_common.h

src/eap_common/eap_tlv_common.h

src/eap_common/eap_ttls.h

src/eap_common/eap_wsc_common.c

src/eap_common/eap_wsc_common.h

src/eap_common/ikev2_common.c

src/eap_common/ikev2_common.h

src/eap_peer/Makefile

src/eap_peer/eap.c

src/eap_peer/eap.h

src/eap_peer/eap_aka.c

src/eap_peer/eap_config.h

src/eap_peer/eap_fast.c

src/eap_peer/eap_fast_pac.c

src/eap_peer/eap_fast_pac.h

src/eap_peer/eap_gpsk.c

src/eap_peer/eap_gtc.c

src/eap_peer/eap_i.h

src/eap_peer/eap_ikev2.c

src/eap_peer/eap_leap.c

src/eap_peer/eap_md5.c

src/eap_peer/eap_methods.c

src/eap_peer/eap_methods.h

src/eap_peer/eap_mschapv2.c

src/eap_peer/eap_otp.c

src/eap_peer/eap_pax.c

src/eap_peer/eap_peap.c

src/eap_peer/eap_psk.c

src/eap_peer/eap_pwd.c

src/eap_peer/eap_sake.c

src/eap_peer/eap_sim.c

src/eap_peer/eap_tls.c

src/eap_peer/eap_tls_common.c

src/eap_peer/eap_tls_common.h

src/eap_peer/eap_tnc.c

src/eap_peer/eap_ttls.c

src/eap_peer/eap_vendor_test.c

src/eap_peer/eap_wsc.c

src/eap_peer/ikev2.c

src/eap_peer/ikev2.h

src/eap_peer/mschapv2.c

src/eap_peer/mschapv2.h

src/eap_peer/tncc.c

src/eap_peer/tncc.h

src/eap_server/Makefile

src/eap_server/eap.h

src/eap_server/eap_i.h

src/eap_server/eap_methods.h

src/eap_server/eap_server.c

src/eap_server/eap_server_aka.c

src/eap_server/eap_server_fast.c

src/eap_server/eap_server_gpsk.c

src/eap_server/eap_server_gtc.c

src/eap_server/eap_server_identity.c

src/eap_server/eap_server_ikev2.c

src/eap_server/eap_server_md5.c

src/eap_server/eap_server_methods.c

src/eap_server/eap_server_mschapv2.c

src/eap_server/eap_server_pax.c

src/eap_server/eap_server_peap.c

src/eap_server/eap_server_psk.c

src/eap_server/eap_server_pwd.c

src/eap_server/eap_server_sake.c

src/eap_server/eap_server_sim.c

src/eap_server/eap_server_tls.c

src/eap_server/eap_server_tls_common.c

src/eap_server/eap_server_tnc.c

src/eap_server/eap_server_ttls.c

src/eap_server/eap_server_vendor_test.c

src/eap_server/eap_server_wsc.c

src/eap_server/eap_sim_db.c

src/eap_server/eap_sim_db.h

src/eap_server/eap_tls_common.h

src/eap_server/ikev2.c

src/eap_server/ikev2.h

src/eap_server/tncs.c

src/eap_server/tncs.h

src/eapol_auth/Makefile

src/eapol_auth/eapol_auth_dump.c

src/eapol_auth/eapol_auth_sm.c

src/eapol_auth/eapol_auth_sm.h

src/eapol_auth/eapol_auth_sm_i.h

src/eapol_supp/Makefile

src/eapol_supp/eapol_supp_sm.c

src/eapol_supp/eapol_supp_sm.h

src/l2_packet/Makefile

src/l2_packet/l2_packet.h

src/l2_packet/l2_packet_freebsd.c

src/l2_packet/l2_packet_linux.c

src/l2_packet/l2_packet_ndis.c

src/l2_packet/l2_packet_none.c

src/l2_packet/l2_packet_pcap.c

src/l2_packet/l2_packet_privsep.c

src/l2_packet/l2_packet_winpcap.c

src/p2p/Makefile

src/p2p/p2p.c

src/p2p/p2p.h

src/p2p/p2p_build.c

src/p2p/p2p_dev_disc.c

src/p2p/p2p_go_neg.c

src/p2p/p2p_group.c

src/p2p/p2p_i.h

src/p2p/p2p_invitation.c

src/p2p/p2p_parse.c

src/p2p/p2p_pd.c

src/p2p/p2p_sd.c

src/p2p/p2p_utils.c

src/radius/Makefile

src/radius/radius.c

src/radius/radius.h

src/radius/radius_client.c

src/radius/radius_client.h

src/radius/radius_server.c

src/radius/radius_server.h

src/rsn_supp/Makefile

src/rsn_supp/peerkey.c

src/rsn_supp/peerkey.h

src/rsn_supp/pmksa_cache.c

src/rsn_supp/pmksa_cache.h

src/rsn_supp/preauth.c

src/rsn_supp/preauth.h

src/rsn_supp/tdls.c

src/rsn_supp/wpa.c

src/rsn_supp/wpa.h

src/rsn_supp/wpa_ft.c

src/rsn_supp/wpa_i.h

src/rsn_supp/wpa_ie.c

src/rsn_supp/wpa_ie.h

src/tls/Makefile

src/tls/asn1.c

src/tls/asn1.h

src/tls/bignum.c

src/tls/bignum.h

src/tls/libtommath.c

src/tls/pkcs1.c

src/tls/pkcs1.h

src/tls/pkcs5.c

src/tls/pkcs5.h

src/tls/pkcs8.c

src/tls/pkcs8.h

src/tls/rsa.c

src/tls/rsa.h

src/tls/tlsv1_client.c

src/tls/tlsv1_client.h

src/tls/tlsv1_client_i.h

src/tls/tlsv1_client_read.c

src/tls/tlsv1_client_write.c

src/tls/tlsv1_common.c

src/tls/tlsv1_common.h

src/tls/tlsv1_cred.c

src/tls/tlsv1_cred.h

src/tls/tlsv1_record.c

src/tls/tlsv1_record.h

src/tls/tlsv1_server.c

src/tls/tlsv1_server.h

src/tls/tlsv1_server_i.h

src/tls/tlsv1_server_read.c

src/tls/tlsv1_server_write.c

src/tls/x509v3.c

src/tls/x509v3.h

src/utils/Makefile

src/utils/base64.c

src/utils/base64.h

src/utils/build_config.h

src/utils/common.c

src/utils/common.h

src/utils/edit.c

src/utils/edit.h

src/utils/edit_readline.c

src/utils/edit_simple.c

src/utils/eloop.c

src/utils/eloop.h

src/utils/eloop_win.c

src/utils/includes.h

src/utils/ip_addr.c

src/utils/ip_addr.h

src/utils/list.h

src/utils/os.h

src/utils/os_internal.c

src/utils/os_none.c

src/utils/os_unix.c

src/utils/os_win32.c

src/utils/pcsc_funcs.c

src/utils/pcsc_funcs.h

src/utils/radiotap.h

src/utils/state_machine.h

src/utils/trace.c

src/utils/trace.h

src/utils/uuid.c

src/utils/uuid.h

src/utils/wpa_debug.c

src/utils/wpa_debug.h

src/utils/wpabuf.c

src/utils/wpabuf.h

src/wps/Makefile

src/wps/http_client.c

src/wps/http_client.h

src/wps/http_server.c

src/wps/http_server.h

src/wps/httpread.c

src/wps/httpread.h

src/wps/ndef.c

src/wps/wps.c

src/wps/wps.h

src/wps/wps_attr_build.c

src/wps/wps_attr_parse.c

src/wps/wps_attr_process.c

src/wps/wps_common.c

src/wps/wps_defs.h

src/wps/wps_dev_attr.c

src/wps/wps_dev_attr.h

src/wps/wps_enrollee.c

src/wps/wps_er.c

src/wps/wps_er.h

src/wps/wps_er_ssdp.c

src/wps/wps_i.h

src/wps/wps_registrar.c

src/wps/wps_upnp.c

src/wps/wps_upnp_ap.c

src/wps/wps_upnp_i.h

src/wps/wps_upnp_ssdp.c

src/wps/wps_upnp_web.c

src/wps/wps_validate.c

wpa_supplicant/Android.mk

wpa_supplicant/ChangeLog

wpa_supplicant/Makefile

wpa_supplicant/README

wpa_supplicant/README-P2P

wpa_supplicant/README-WPS

wpa_supplicant/README-Windows.txt

wpa_supplicant/ap.c

wpa_supplicant/ap.h

wpa_supplicant/bgscan.c

wpa_supplicant/bgscan.h

wpa_supplicant/bgscan_learn.c

wpa_supplicant/bgscan_simple.c

wpa_supplicant/blacklist.c

wpa_supplicant/blacklist.h

wpa_supplicant/bss.c

wpa_supplicant/bss.h

wpa_supplicant/config.c

wpa_supplicant/config.h

wpa_supplicant/config_file.c

wpa_supplicant/config_none.c

wpa_supplicant/config_ssid.h

wpa_supplicant/config_winreg.c

wpa_supplicant/ctrl_iface.c

wpa_supplicant/ctrl_iface.h

wpa_supplicant/ctrl_iface_named_pipe.c

wpa_supplicant/ctrl_iface_udp.c

wpa_supplicant/ctrl_iface_unix.c

wpa_supplicant/dbus/Makefile

wpa_supplicant/dbus/dbus_common.c

wpa_supplicant/dbus/dbus_common.h

wpa_supplicant/dbus/dbus_common_i.h

wpa_supplicant/dbus/dbus_dict_helpers.c

wpa_supplicant/dbus/dbus_dict_helpers.h

wpa_supplicant/dbus/dbus_new.c

wpa_supplicant/dbus/dbus_new.h

wpa_supplicant/dbus/dbus_new_handlers.c

wpa_supplicant/dbus/dbus_new_handlers.h

wpa_supplicant/dbus/dbus_new_handlers_p2p.c

wpa_supplicant/dbus/dbus_new_handlers_p2p.h

wpa_supplicant/dbus/dbus_new_handlers_wps.c

wpa_supplicant/dbus/dbus_new_helpers.c

wpa_supplicant/dbus/dbus_new_helpers.h

wpa_supplicant/dbus/dbus_new_introspect.c

wpa_supplicant/dbus/dbus_old.c

wpa_supplicant/dbus/dbus_old.h

wpa_supplicant/dbus/dbus_old_handlers.c

wpa_supplicant/dbus/dbus_old_handlers.h

wpa_supplicant/dbus/dbus_old_handlers_wps.c

wpa_supplicant/defconfig

wpa_supplicant/doc/docbook/Makefile

wpa_supplicant/doc/docbook/wpa_background.sgml

wpa_supplicant/doc/docbook/wpa_cli.sgml

wpa_supplicant/doc/docbook/wpa_gui.sgml

wpa_supplicant/doc/docbook/wpa_passphrase.sgml

wpa_supplicant/doc/docbook/wpa_priv.sgml

wpa_supplicant/doc/docbook/wpa_supplicant.sgml

wpa_supplicant/driver_i.h

wpa_supplicant/eap_register.c

wpa_supplicant/eapol_test.c

wpa_supplicant/events.c

wpa_supplicant/examples/p2p-action.sh

wpa_supplicant/gas_query.c

wpa_supplicant/gas_query.h

wpa_supplicant/ibss_rsn.c

wpa_supplicant/ibss_rsn.h

wpa_supplicant/interworking.c

wpa_supplicant/interworking.h

wpa_supplicant/main.c

wpa_supplicant/main_none.c

wpa_supplicant/main_winmain.c

wpa_supplicant/main_winsvc.c

wpa_supplicant/notify.c

wpa_supplicant/notify.h

wpa_supplicant/offchannel.c

wpa_supplicant/offchannel.h

wpa_supplicant/p2p_supplicant.c

wpa_supplicant/p2p_supplicant.h

wpa_supplicant/preauth_test.c

wpa_supplicant/scan.c

wpa_supplicant/scan.h

wpa_supplicant/sme.c

wpa_supplicant/sme.h

wpa_supplicant/tests/test_eap_sim_common.c

wpa_supplicant/tests/test_wpa.c

wpa_supplicant/vs2005/eapol_test/eapol_test.vcproj

wpa_supplicant/vs2005/wpa_passphrase/wpa_passphrase.vcproj

wpa_supplicant/vs2005/wpa_supplicant/wpa_supplicant.vcproj

wpa_supplicant/vs2005/wpasvc/wpasvc.vcproj

wpa_supplicant/win_if_list.c

wpa_supplicant/wpa_cli.c

wpa_supplicant/wpa_gui-qt4/addinterface.cpp

wpa_supplicant/wpa_gui-qt4/addinterface.h

wpa_supplicant/wpa_gui-qt4/eventhistory.cpp

wpa_supplicant/wpa_gui-qt4/eventhistory.h

wpa_supplicant/wpa_gui-qt4/main.cpp

wpa_supplicant/wpa_gui-qt4/networkconfig.cpp

wpa_supplicant/wpa_gui-qt4/networkconfig.h

wpa_supplicant/wpa_gui-qt4/peers.cpp

wpa_supplicant/wpa_gui-qt4/peers.h

wpa_supplicant/wpa_gui-qt4/scanresults.cpp

wpa_supplicant/wpa_gui-qt4/scanresults.h

wpa_supplicant/wpa_gui-qt4/signalbar.cpp

wpa_supplicant/wpa_gui-qt4/signalbar.h

wpa_supplicant/wpa_gui-qt4/stringquery.cpp

wpa_supplicant/wpa_gui-qt4/stringquery.h

wpa_supplicant/wpa_gui-qt4/userdatarequest.cpp

wpa_supplicant/wpa_gui-qt4/userdatarequest.h

wpa_supplicant/wpa_gui-qt4/wpagui.cpp

wpa_supplicant/wpa_gui-qt4/wpagui.h

wpa_supplicant/wpa_gui-qt4/wpamsg.h

wpa_supplicant/wpa_passphrase.c

wpa_supplicant/wpa_priv.c

wpa_supplicant/wpa_supplicant.c

wpa_supplicant/wpa_supplicant.conf

wpa_supplicant/wpa_supplicant_i.h

wpa_supplicant/wpas_glue.c

wpa_supplicant/wpas_glue.h

wpa_supplicant/wps_supplicant.c

wpa_supplicant/wps_supplicant.h

Show diffs side-by-side

added added

removed removed

src/eap_peer/eap_eke.c

* EAP peer method: EAP-EKE (RFC 6124)

* This software may be distributed under the terms of the BSD license.

* See README for more details.

#include "includes.h"

#include "common.h"

#include "crypto/random.h"

#include "eap_peer/eap_i.h"

#include "eap_common/eap_eke_common.h"

struct eap_eke_data {

enum {

IDENTITY, COMMIT, CONFIRM, SUCCESS, FAILURE

} state;

u8 msk[EAP_MSK_LEN];

u8 emsk[EAP_EMSK_LEN];

u8 *peerid;

size_t peerid_len;

u8 *serverid;

size_t serverid_len;

u8 dh_priv[EAP_EKE_MAX_DH_LEN];

struct eap_eke_session sess;

u8 nonce_p[EAP_EKE_MAX_NONCE_LEN];

u8 nonce_s[EAP_EKE_MAX_NONCE_LEN];

struct wpabuf *msgs;

u8 dhgroup; /* forced DH group or 0 to allow all supported */

u8 encr; /* forced encryption algorithm or 0 to allow all supported */

u8 prf; /* forced PRF or 0 to allow all supported */

u8 mac; /* forced MAC or 0 to allow all supported */

};

static const char * eap_eke_state_txt(int state)

{

switch (state) {

case IDENTITY:

return "IDENTITY";

case COMMIT:

return "COMMIT";

case CONFIRM:

return "CONFIRM";

case SUCCESS:

return "SUCCESS";

case FAILURE:

return "FAILURE";

default:

return "?";

}

static void eap_eke_state(struct eap_eke_data *data, int state)

{

wpa_printf(MSG_DEBUG, "EAP-EKE: %s -> %s",

eap_eke_state_txt(data->state), eap_eke_state_txt(state));

data->state = state;

}

static void eap_eke_deinit(struct eap_sm *sm, void *priv);

static void * eap_eke_init(struct eap_sm *sm)

{

struct eap_eke_data *data;

const u8 *identity, *password;

size_t identity_len, password_len;

const char *phase1;

password = eap_get_config_password(sm, &password_len);

if (!password) {

wpa_printf(MSG_INFO, "EAP-EKE: No password configured");

return NULL;

}

data = os_zalloc(sizeof(*data));

if (data == NULL)

return NULL;

eap_eke_state(data, IDENTITY);

identity = eap_get_config_identity(sm, &identity_len);

if (identity) {

data->peerid = os_malloc(identity_len);

if (data->peerid == NULL) {

eap_eke_deinit(sm, data);

return NULL;

}

os_memcpy(data->peerid, identity, identity_len);

data->peerid_len = identity_len;

}

phase1 = eap_get_config_phase1(sm);

if (phase1) {

const char *pos;

100

101

pos = os_strstr(phase1, "dhgroup=");

102

if (pos) {

103

data->dhgroup = atoi(pos + 8);

104

wpa_printf(MSG_DEBUG, "EAP-EKE: Forced dhgroup %u",

105

data->dhgroup);

106

}

107

108

pos = os_strstr(phase1, "encr=");

109

if (pos) {

110

data->encr = atoi(pos + 5);

111

wpa_printf(MSG_DEBUG, "EAP-EKE: Forced encr %u",

112

data->encr);

113

}

114

115

pos = os_strstr(phase1, "prf=");

116

if (pos) {

117

data->prf = atoi(pos + 4);

118

wpa_printf(MSG_DEBUG, "EAP-EKE: Forced prf %u",

119

data->prf);

120

}

121

122

pos = os_strstr(phase1, "mac=");

123

if (pos) {

124

data->mac = atoi(pos + 4);

125

wpa_printf(MSG_DEBUG, "EAP-EKE: Forced mac %u",

126

data->mac);

127

}

128

}

129

130

return data;

131

}

132

133

134

static void eap_eke_deinit(struct eap_sm *sm, void *priv)

135

{

136

struct eap_eke_data *data = priv;

137

eap_eke_session_clean(&data->sess);

138

os_free(data->serverid);

139

os_free(data->peerid);

140

wpabuf_free(data->msgs);

141

os_free(data);

142

}

143

144

145

static struct wpabuf * eap_eke_build_msg(struct eap_eke_data *data, int id,

146

size_t length, u8 eke_exch)

147

{

148

struct wpabuf *msg;

149

size_t plen;

150

151

plen = 1 + length;

152

153

msg = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_EKE, plen,

154

EAP_CODE_RESPONSE, id);

155

if (msg == NULL) {

156

wpa_printf(MSG_ERROR, "EAP-EKE: Failed to allocate memory");

157

return NULL;

158

}

159

160

wpabuf_put_u8(msg, eke_exch);

161

162

return msg;

163

}

164

165

166

static int eap_eke_supp_dhgroup(u8 dhgroup)

167

{

168

return dhgroup == EAP_EKE_DHGROUP_EKE_2 ||

169

dhgroup == EAP_EKE_DHGROUP_EKE_5 ||

170

dhgroup == EAP_EKE_DHGROUP_EKE_14 ||

171

dhgroup == EAP_EKE_DHGROUP_EKE_15 ||

172

dhgroup == EAP_EKE_DHGROUP_EKE_16;

173

}

174

175

176

static int eap_eke_supp_encr(u8 encr)

177

{

178

return encr == EAP_EKE_ENCR_AES128_CBC;

179

}

180

181

182

static int eap_eke_supp_prf(u8 prf)

183

{

184

return prf == EAP_EKE_PRF_HMAC_SHA1 ||

185

prf == EAP_EKE_PRF_HMAC_SHA2_256;

186

}

187

188

189

static int eap_eke_supp_mac(u8 mac)

190

{

191

return mac == EAP_EKE_MAC_HMAC_SHA1 ||

192

mac == EAP_EKE_MAC_HMAC_SHA2_256;

193

}

194

195

196

static struct wpabuf * eap_eke_build_fail(struct eap_eke_data *data,

197

struct eap_method_ret *ret,

198

const struct wpabuf *reqData,

199

u32 failure_code)

200

{

201

struct wpabuf *resp;

202

203

wpa_printf(MSG_DEBUG, "EAP-EKE: Sending EAP-EKE-Failure/Response - code=0x%x",

204

failure_code);

205

206

resp = eap_eke_build_msg(data, eap_get_id(reqData), 4, EAP_EKE_FAILURE);

207

if (resp)

208

wpabuf_put_be32(resp, failure_code);

209

210

os_memset(data->dh_priv, 0, sizeof(data->dh_priv));

211

eap_eke_session_clean(&data->sess);

212

213

eap_eke_state(data, FAILURE);

214

ret->methodState = METHOD_DONE;

215

ret->decision = DECISION_FAIL;

216

ret->allowNotifications = FALSE;

217

218

return resp;

219

}

220

221

222

static struct wpabuf * eap_eke_process_id(struct eap_eke_data *data,

223

struct eap_method_ret *ret,

224

const struct wpabuf *reqData,

225

const u8 *payload,

226

size_t payload_len)

227

{

228

struct wpabuf *resp;

229

unsigned num_prop, i;

230

const u8 *pos, *end;

231

const u8 *prop = NULL;

232

u8 idtype;

233

234

if (data->state != IDENTITY) {

235

return eap_eke_build_fail(data, ret, reqData,

236

EAP_EKE_FAIL_PROTO_ERROR);

237

}

238

239

wpa_printf(MSG_DEBUG, "EAP-EKE: Received EAP-EKE-ID/Request");

240

241

if (payload_len < 2 + 4) {

242

wpa_printf(MSG_DEBUG, "EAP-EKE: Too short ID/Request Data");

243

return eap_eke_build_fail(data, ret, reqData,

244

EAP_EKE_FAIL_PROTO_ERROR);

245

}

246

247

pos = payload;

248

end = payload + payload_len;

249

250

num_prop = *pos++;

251

pos++; /* Ignore Reserved field */

252

253

if (pos + num_prop * 4 > end) {

254

wpa_printf(MSG_DEBUG, "EAP-EKE: Too short ID/Request Data (num_prop=%u)",

255

num_prop);

256

return eap_eke_build_fail(data, ret, reqData,

257

EAP_EKE_FAIL_PROTO_ERROR);

258

}

259

260

for (i = 0; i < num_prop; i++) {

261

const u8 *tmp = pos;

262

263

wpa_printf(MSG_DEBUG, "EAP-EKE: Proposal #%u: dh=%u encr=%u prf=%u mac=%u",

264

i, pos[0], pos[1], pos[2], pos[3]);

265

pos += 4;

266

267

if ((data->dhgroup && data->dhgroup != *tmp) ||

268

!eap_eke_supp_dhgroup(*tmp))

269

continue;

270

tmp++;

271

if ((data->encr && data->encr != *tmp) ||

272

!eap_eke_supp_encr(*tmp))

273

continue;

274

tmp++;

275

if ((data->prf && data->prf != *tmp) ||

276

!eap_eke_supp_prf(*tmp))

277

continue;

278

tmp++;

279

if ((data->mac && data->mac != *tmp) ||

280

!eap_eke_supp_mac(*tmp))

281

continue;

282

283

prop = tmp - 3;

284

if (eap_eke_session_init(&data->sess, prop[0], prop[1], prop[2],

285

prop[3]) < 0) {

286

prop = NULL;

287

continue;

288

}

289

290

wpa_printf(MSG_DEBUG, "EAP-EKE: Selected proposal");

291

break;

292

}

293

294

if (prop == NULL) {

295

wpa_printf(MSG_DEBUG, "EAP-EKE: No acceptable proposal found");

296

return eap_eke_build_fail(data, ret, reqData,

297

EAP_EKE_FAIL_NO_PROPOSAL_CHOSEN);

298

}

299

300

pos += (num_prop - i - 1) * 4;

301

302

if (pos == end) {

303

wpa_printf(MSG_DEBUG, "EAP-EKE: Too short ID/Request Data to include IDType/Identity");

304

return eap_eke_build_fail(data, ret, reqData,

305

EAP_EKE_FAIL_PROTO_ERROR);

306

}

307

308

idtype = *pos++;

309

wpa_printf(MSG_DEBUG, "EAP-EKE: Server IDType %u", idtype);

310

wpa_hexdump_ascii(MSG_DEBUG, "EAP-EKE: Server Identity",

311

pos, end - pos);

312

os_free(data->serverid);

313

data->serverid = os_malloc(end - pos);

314

if (data->serverid == NULL) {

315

return eap_eke_build_fail(data, ret, reqData,

316

EAP_EKE_FAIL_PRIVATE_INTERNAL_ERROR);

317

}

318

os_memcpy(data->serverid, pos, end - pos);

319

data->serverid_len = end - pos;

320

321

wpa_printf(MSG_DEBUG, "EAP-EKE: Sending EAP-EKE-ID/Response");

322

323

resp = eap_eke_build_msg(data, eap_get_id(reqData),

324

2 + 4 + 1 + data->peerid_len,

325

EAP_EKE_ID);

326

if (resp == NULL) {

327

return eap_eke_build_fail(data, ret, reqData,

328

EAP_EKE_FAIL_PRIVATE_INTERNAL_ERROR);

329

}

330

331

wpabuf_put_u8(resp, 1); /* NumProposals */

332

wpabuf_put_u8(resp, 0); /* Reserved */

333

wpabuf_put_data(resp, prop, 4); /* Selected Proposal */

334

wpabuf_put_u8(resp, EAP_EKE_ID_NAI);

335

if (data->peerid)

336

wpabuf_put_data(resp, data->peerid, data->peerid_len);

337

338

wpabuf_free(data->msgs);

339

data->msgs = wpabuf_alloc(wpabuf_len(reqData) + wpabuf_len(resp));

340

if (data->msgs == NULL) {

341

wpabuf_free(resp);

342

return eap_eke_build_fail(data, ret, reqData,

343

EAP_EKE_FAIL_PRIVATE_INTERNAL_ERROR);

344

}

345

wpabuf_put_buf(data->msgs, reqData);

346

wpabuf_put_buf(data->msgs, resp);

347

348

eap_eke_state(data, COMMIT);

349

350

return resp;

351

}

352

353

354

static struct wpabuf * eap_eke_process_commit(struct eap_sm *sm,

355

struct eap_eke_data *data,

356

struct eap_method_ret *ret,

357

const struct wpabuf *reqData,

358

const u8 *payload,

359

size_t payload_len)

360

{

361

struct wpabuf *resp;

362

const u8 *pos, *end, *dhcomp;

363

size_t prot_len;

364

u8 *rpos;

365

u8 key[EAP_EKE_MAX_KEY_LEN];

366

u8 pub[EAP_EKE_MAX_DH_LEN];

367

const u8 *password;

368

size_t password_len;

369

370

if (data->state != COMMIT) {

371

wpa_printf(MSG_DEBUG, "EAP-EKE: EAP-EKE-Commit/Request received in unexpected state (%d)", data->state);

372

return eap_eke_build_fail(data, ret, reqData,

373

EAP_EKE_FAIL_PROTO_ERROR);

374

}

375

376

wpa_printf(MSG_DEBUG, "EAP-EKE: Received EAP-EKE-Commit/Request");

377

378

password = eap_get_config_password(sm, &password_len);

379

if (password == NULL) {

380

wpa_printf(MSG_INFO, "EAP-EKE: No password configured!");

381

return eap_eke_build_fail(data, ret, reqData,

382

EAP_EKE_FAIL_PASSWD_NOT_FOUND);

383

}

384

385

pos = payload;

386

end = payload + payload_len;

387

388

if (pos + data->sess.dhcomp_len > end) {

389

wpa_printf(MSG_DEBUG, "EAP-EKE: Too short EAP-EKE-Commit");

390

return eap_eke_build_fail(data, ret, reqData,

391

EAP_EKE_FAIL_PROTO_ERROR);

392

}

393

394

wpa_hexdump(MSG_DEBUG, "EAP-EKE: DHComponent_S",

395

pos, data->sess.dhcomp_len);

396

dhcomp = pos;

397

pos += data->sess.dhcomp_len;

398

wpa_hexdump(MSG_DEBUG, "EAP-EKE: CBValue", pos, end - pos);

399

400

401

* temp = prf(0+, password)

402

* key = prf+(temp, ID_S | ID_P)

403

404

if (eap_eke_derive_key(&data->sess, password, password_len,

405

data->serverid, data->serverid_len,

406

data->peerid, data->peerid_len, key) < 0) {

407

wpa_printf(MSG_INFO, "EAP-EKE: Failed to derive key");

408

return eap_eke_build_fail(data, ret, reqData,

409

EAP_EKE_FAIL_PRIVATE_INTERNAL_ERROR);

410

}

411

412

413

* y_p = g ^ x_p (mod p)

414

* x_p = random number 2 .. p-1

415

416

if (eap_eke_dh_init(data->sess.dhgroup, data->dh_priv, pub) < 0) {

417

wpa_printf(MSG_INFO, "EAP-EKE: Failed to initialize DH");

418

os_memset(key, 0, sizeof(key));

419

return eap_eke_build_fail(data, ret, reqData,

420

EAP_EKE_FAIL_PRIVATE_INTERNAL_ERROR);

421

}

422

423

if (eap_eke_shared_secret(&data->sess, key, data->dh_priv, dhcomp) < 0)

424

{

425

wpa_printf(MSG_INFO, "EAP-EKE: Failed to derive shared secret");

426

os_memset(key, 0, sizeof(key));

427

return eap_eke_build_fail(data, ret, reqData,

428

EAP_EKE_FAIL_PRIVATE_INTERNAL_ERROR);

429

}

430

431

if (eap_eke_derive_ke_ki(&data->sess,

432

data->serverid, data->serverid_len,

433

data->peerid, data->peerid_len) < 0) {

434

wpa_printf(MSG_INFO, "EAP-EKE: Failed to derive Ke/Ki");

435

os_memset(key, 0, sizeof(key));

436

return eap_eke_build_fail(data, ret, reqData,

437

EAP_EKE_FAIL_PRIVATE_INTERNAL_ERROR);

438

}

439

440

wpa_printf(MSG_DEBUG, "EAP-EKE: Sending EAP-EKE-Commit/Response");

441

442

resp = eap_eke_build_msg(data, eap_get_id(reqData),

443

data->sess.dhcomp_len + data->sess.pnonce_len,

444

EAP_EKE_COMMIT);

445

if (resp == NULL) {

446

os_memset(key, 0, sizeof(key));

447

return eap_eke_build_fail(data, ret, reqData,

448

EAP_EKE_FAIL_PRIVATE_INTERNAL_ERROR);

449

}

450

451

/* DHComponent_P = Encr(key, y_p) */

452

rpos = wpabuf_put(resp, data->sess.dhcomp_len);

453

if (eap_eke_dhcomp(&data->sess, key, pub, rpos) < 0) {

454

wpa_printf(MSG_INFO, "EAP-EKE: Failed to build DHComponent_S");

455

os_memset(key, 0, sizeof(key));

456

return eap_eke_build_fail(data, ret, reqData,

457

EAP_EKE_FAIL_PRIVATE_INTERNAL_ERROR);

458

}

459

os_memset(key, 0, sizeof(key));

460

461

wpa_hexdump(MSG_DEBUG, "EAP-EKE: DHComponent_P",

462

rpos, data->sess.dhcomp_len);

463

464

if (random_get_bytes(data->nonce_p, data->sess.nonce_len)) {

465

wpabuf_free(resp);

466

return eap_eke_build_fail(data, ret, reqData,

467

EAP_EKE_FAIL_PRIVATE_INTERNAL_ERROR);

468

}

469

wpa_hexdump_key(MSG_DEBUG, "EAP-EKE: Nonce_P",

470

data->nonce_p, data->sess.nonce_len);

471

prot_len = wpabuf_tailroom(resp);

472

if (eap_eke_prot(&data->sess, data->nonce_p, data->sess.nonce_len,

473

wpabuf_put(resp, 0), &prot_len) < 0) {

474

wpabuf_free(resp);

475

return eap_eke_build_fail(data, ret, reqData,

476

EAP_EKE_FAIL_PRIVATE_INTERNAL_ERROR);

477

}

478

wpa_hexdump(MSG_DEBUG, "EAP-EKE: PNonce_P",

479

wpabuf_put(resp, 0), prot_len);

480

wpabuf_put(resp, prot_len);

481

482

/* TODO: CBValue */

483

484

if (wpabuf_resize(&data->msgs, wpabuf_len(reqData) + wpabuf_len(resp))

485

< 0) {

486

wpabuf_free(resp);

487

return eap_eke_build_fail(data, ret, reqData,

488

EAP_EKE_FAIL_PRIVATE_INTERNAL_ERROR);

489

}

490

wpabuf_put_buf(data->msgs, reqData);

491

wpabuf_put_buf(data->msgs, resp);

492

493

eap_eke_state(data, CONFIRM);

494

495

return resp;

496

}

497

498

499

static struct wpabuf * eap_eke_process_confirm(struct eap_eke_data *data,

500

struct eap_method_ret *ret,

501

const struct wpabuf *reqData,

502

const u8 *payload,

503

size_t payload_len)

504

{

505

struct wpabuf *resp;

506

const u8 *pos, *end;

507

size_t prot_len;

508

u8 nonces[2 * EAP_EKE_MAX_NONCE_LEN];

509

u8 auth_s[EAP_EKE_MAX_HASH_LEN];

510

size_t decrypt_len;

511

u8 *auth;

512

513

if (data->state != CONFIRM) {

514

wpa_printf(MSG_DEBUG, "EAP-EKE: EAP-EKE-Confirm/Request received in unexpected state (%d)",

515

data->state);

516

return eap_eke_build_fail(data, ret, reqData,

517

EAP_EKE_FAIL_PROTO_ERROR);

518

}

519

520

wpa_printf(MSG_DEBUG, "EAP-EKE: Received EAP-EKE-Confirm/Request");

521

522

pos = payload;

523

end = payload + payload_len;

524

525

if (pos + data->sess.pnonce_ps_len + data->sess.prf_len > end) {

526

wpa_printf(MSG_DEBUG, "EAP-EKE: Too short EAP-EKE-Commit");

527

return eap_eke_build_fail(data, ret, reqData,

528

EAP_EKE_FAIL_PROTO_ERROR);

529

}

530

531

decrypt_len = sizeof(nonces);

532

if (eap_eke_decrypt_prot(&data->sess, pos, data->sess.pnonce_ps_len,

533

nonces, &decrypt_len) < 0) {

534

wpa_printf(MSG_INFO, "EAP-EKE: Failed to decrypt PNonce_PS");

535

return eap_eke_build_fail(data, ret, reqData,

536

EAP_EKE_FAIL_AUTHENTICATION_FAIL);

537

}

538

if (decrypt_len != (size_t) 2 * data->sess.nonce_len) {

539

wpa_printf(MSG_INFO, "EAP-EKE: PNonce_PS protected data length does not match length of Nonce_P and Nonce_S");

540

return eap_eke_build_fail(data, ret, reqData,

541

EAP_EKE_FAIL_AUTHENTICATION_FAIL);

542

}

543

wpa_hexdump_key(MSG_DEBUG, "EAP-EKE: Received Nonce_P | Nonce_S",

544

nonces, 2 * data->sess.nonce_len);

545

if (os_memcmp(data->nonce_p, nonces, data->sess.nonce_len) != 0) {

546

wpa_printf(MSG_INFO, "EAP-EKE: Received Nonce_P does not match trnsmitted Nonce_P");

547

return eap_eke_build_fail(data, ret, reqData,

548

EAP_EKE_FAIL_AUTHENTICATION_FAIL);

549

}

550

551

os_memcpy(data->nonce_s, nonces + data->sess.nonce_len,

552

data->sess.nonce_len);

553

wpa_hexdump_key(MSG_DEBUG, "EAP-EKE: Nonce_S",

554

data->nonce_s, data->sess.nonce_len);

555

556

if (eap_eke_derive_ka(&data->sess, data->serverid, data->serverid_len,

557

data->peerid, data->peerid_len,

558

data->nonce_p, data->nonce_s) < 0) {

559

return eap_eke_build_fail(data, ret, reqData,

560

EAP_EKE_FAIL_PRIVATE_INTERNAL_ERROR);

561

}

562

563

if (eap_eke_auth(&data->sess, "EAP-EKE server", data->msgs, auth_s) < 0)

564

{

565

return eap_eke_build_fail(data, ret, reqData,

566

EAP_EKE_FAIL_PRIVATE_INTERNAL_ERROR);

567

}

568

wpa_hexdump(MSG_DEBUG, "EAP-EKE: Auth_S", auth_s, data->sess.prf_len);

569

if (os_memcmp(auth_s, pos + data->sess.pnonce_ps_len,

570

data->sess.prf_len) != 0) {

571

wpa_printf(MSG_INFO, "EAP-EKE: Auth_S does not match");

572

return eap_eke_build_fail(data, ret, reqData,

573

EAP_EKE_FAIL_AUTHENTICATION_FAIL);

574

}

575

576

wpa_printf(MSG_DEBUG, "EAP-EKE: Sending EAP-EKE-Confirm/Response");

577

578

resp = eap_eke_build_msg(data, eap_get_id(reqData),

579

data->sess.pnonce_len + data->sess.prf_len,

580

EAP_EKE_CONFIRM);

581

if (resp == NULL) {

582

return eap_eke_build_fail(data, ret, reqData,

583

EAP_EKE_FAIL_PRIVATE_INTERNAL_ERROR);

584

}

585

586

prot_len = wpabuf_tailroom(resp);

587

if (eap_eke_prot(&data->sess, data->nonce_s, data->sess.nonce_len,

588

wpabuf_put(resp, 0), &prot_len) < 0) {

589

wpabuf_free(resp);

590

return eap_eke_build_fail(data, ret, reqData,

591

EAP_EKE_FAIL_PRIVATE_INTERNAL_ERROR);

592

}

593

wpabuf_put(resp, prot_len);

594

595

auth = wpabuf_put(resp, data->sess.prf_len);

596

if (eap_eke_auth(&data->sess, "EAP-EKE peer", data->msgs, auth) < 0) {

597

wpabuf_free(resp);

598

return eap_eke_build_fail(data, ret, reqData,

599

EAP_EKE_FAIL_PRIVATE_INTERNAL_ERROR);

600

}

601

wpa_hexdump(MSG_DEBUG, "EAP-EKE: Auth_P", auth, data->sess.prf_len);

602

603

if (eap_eke_derive_msk(&data->sess, data->serverid, data->serverid_len,

604

data->peerid, data->peerid_len,

605

data->nonce_s, data->nonce_p,

606

data->msk, data->emsk) < 0) {

607

wpa_printf(MSG_INFO, "EAP-EKE: Failed to derive MSK/EMSK");

608

wpabuf_free(resp);

609

return eap_eke_build_fail(data, ret, reqData,

610

EAP_EKE_FAIL_PRIVATE_INTERNAL_ERROR);

611

}

612

613

os_memset(data->dh_priv, 0, sizeof(data->dh_priv));

614

eap_eke_session_clean(&data->sess);

615

616

eap_eke_state(data, SUCCESS);

617

ret->methodState = METHOD_MAY_CONT;

618

ret->decision = DECISION_COND_SUCC;

619

ret->allowNotifications = FALSE;

620

621

return resp;

622

}

623

624

625

static struct wpabuf * eap_eke_process_failure(struct eap_eke_data *data,

626

struct eap_method_ret *ret,

627

const struct wpabuf *reqData,

628

const u8 *payload,

629

size_t payload_len)

630

{

631

wpa_printf(MSG_DEBUG, "EAP-EKE: Received EAP-EKE-Failure/Request");

632

633

if (payload_len < 4) {

634

wpa_printf(MSG_DEBUG, "EAP-EKE: Too short EAP-EKE-Failure");

635

} else {

636

u32 code;

637

code = WPA_GET_BE32(payload);

638

wpa_printf(MSG_INFO, "EAP-EKE: Failure-Code 0x%x", code);

639

}

640

641

return eap_eke_build_fail(data, ret, reqData, EAP_EKE_FAIL_NO_ERROR);

642

}

643

644

645

static struct wpabuf * eap_eke_process(struct eap_sm *sm, void *priv,

646

struct eap_method_ret *ret,

647

const struct wpabuf *reqData)

648

{

649

struct eap_eke_data *data = priv;

650

struct wpabuf *resp;

651

const u8 *pos, *end;

652

size_t len;

653

u8 eke_exch;

654

655

pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_EKE, reqData, &len);

656

if (pos == NULL || len < 1) {

657

ret->ignore = TRUE;

658

return NULL;

659

}

660

661

end = pos + len;

662

eke_exch = *pos++;

663

664

wpa_printf(MSG_DEBUG, "EAP-EKE: Received frame: exch %d", eke_exch);

665

wpa_hexdump(MSG_DEBUG, "EAP-EKE: Received Data", pos, end - pos);

666

667

ret->ignore = FALSE;

668

ret->methodState = METHOD_MAY_CONT;

669

ret->decision = DECISION_FAIL;

670

ret->allowNotifications = TRUE;

671

672

switch (eke_exch) {

673

case EAP_EKE_ID:

674

resp = eap_eke_process_id(data, ret, reqData, pos, end - pos);

675

break;

676

case EAP_EKE_COMMIT:

677

resp = eap_eke_process_commit(sm, data, ret, reqData,

678

pos, end - pos);

679

break;

680

case EAP_EKE_CONFIRM:

681

resp = eap_eke_process_confirm(data, ret, reqData,

682

pos, end - pos);

683

break;

684

case EAP_EKE_FAILURE:

685

resp = eap_eke_process_failure(data, ret, reqData,

686

pos, end - pos);

687

break;

688

default:

689

wpa_printf(MSG_DEBUG, "EAP-EKE: Ignoring message with unknown EKE-Exch %d", eke_exch);

690

ret->ignore = TRUE;

691

return NULL;

692

}

693

694

if (ret->methodState == METHOD_DONE)

695

ret->allowNotifications = FALSE;

696

697

return resp;

698

}

699

700

701

static Boolean eap_eke_isKeyAvailable(struct eap_sm *sm, void *priv)

702

{

703

struct eap_eke_data *data = priv;

704

return data->state == SUCCESS;

705

}

706

707

708

static u8 * eap_eke_getKey(struct eap_sm *sm, void *priv, size_t *len)

709

{

710

struct eap_eke_data *data = priv;

711

u8 *key;

712

713

if (data->state != SUCCESS)

714

return NULL;

715

716

key = os_malloc(EAP_MSK_LEN);

717

if (key == NULL)

718

return NULL;

719

os_memcpy(key, data->msk, EAP_MSK_LEN);

720

*len = EAP_MSK_LEN;

721

722

return key;

723

}

724

725

726

static u8 * eap_eke_get_emsk(struct eap_sm *sm, void *priv, size_t *len)

727

{

728

struct eap_eke_data *data = priv;

729

u8 *key;

730

731

if (data->state != SUCCESS)

732

return NULL;

733

734

key = os_malloc(EAP_EMSK_LEN);

735

if (key == NULL)

736

return NULL;

737

os_memcpy(key, data->emsk, EAP_EMSK_LEN);

738

*len = EAP_EMSK_LEN;

739

740

return key;

741

}

742

743

744

int eap_peer_eke_register(void)

745

{

746

struct eap_method *eap;

747

int ret;

748

749

eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,

750

EAP_VENDOR_IETF, EAP_TYPE_EKE, "EKE");

751

if (eap == NULL)

752

return -1;

753

754

eap->init = eap_eke_init;

755

eap->deinit = eap_eke_deinit;

756

eap->process = eap_eke_process;

757

eap->isKeyAvailable = eap_eke_isKeyAvailable;

758

eap->getKey = eap_eke_getKey;

759

eap->get_emsk = eap_eke_get_emsk;

760

761

ret = eap_peer_method_register(eap);

762

if (ret)

763

eap_peer_method_free(eap);

764

return ret;

765

}

Older »