Changeset 610:a137913d9f88 in freeDiameter

Timestamp:

Dec 1, 2010, 6:19:54 PM (13 years ago)

Author:

Sebastien Decugis <sdecugis@nict.go.jp>

Branch:

default

Phase:

public

Message:

Added ability to extract the Extended MSK (EMSK) for future use

Location:

extensions/app_diameap

Files:

• diameap_eap.c (modified) (2 diffs)
• diameap_eap.h (modified) (1 diff)
• diameap_plugins.c (modified) (1 diff)
• diameap_server.c (modified) (2 diffs)
• libdiameap.h (modified) (1 diff)
• plugins/eap_tls/eap_tls.c (modified) (2 diffs)

extensions/app_diameap/diameap_eap.c

@@ -444 +444 @@
                         {
                                 /*diameap_ba_PolicyUpdate();*/
-                                eap_i->aaaEapKeyLength = 0;
+                                eap_i->aaaEapMSKLength = 0;
+                                eap_i->aaaEapEMSKLength = 0;
                                 if (eap_sm->selectedMethod->eap_method_getKey)
                                 {
                                         if ((*eap_sm->selectedMethod->eap_method_getKey)(eap_sm,
-                                                        &eap_i->aaaEapKeyData, &eap_i->aaaEapKeyLength))
+                                                        &eap_i->aaaEapMSKData, &eap_i->aaaEapMSKLength,
+                                                        &eap_i->aaaEapEMSKData, &eap_i->aaaEapEMSKLength))
                                         {
                                                 TRACE_DEBUG(INFO,"%s[EAP Protocol] Generating EAP Master Key failed.",DIAMEAP_EXTENSION,eap_sm->selectedMethod->methodname)
-                                                eap_i->aaaEapKeyLength = 0;
+                                                eap_i->aaaEapMSKLength = 0;
+                                                eap_i->aaaEapEMSKLength = 0;
                                                 eap_i->aaaEapKeyAvailable = FALSE;
                                         }
@@ -556 +559 @@
                                 CHECK_FCT(diameap_eap_new(EAP_SUCCESS, (u8) eap_sm->currentId, TYPE_NONE, NULL, 0,&eap_i->aaaEapReqData))
                                 ;
-                                if (eap_i->aaaEapKeyData != NULL)
+                                if (eap_i->aaaEapMSKData != NULL)
                                 {
                                         TRACE_DEBUG(FULL+1,"%s[EAP Protocol] EAP Key available [User: %s].",DIAMEAP_EXTENSION,eap_sm->user.userid);

extensions/app_diameap/diameap_eap.h

@@ -59 +59 @@
         boolean aaaFail;
         struct eap_packet aaaEapReqData;
-        u8 *aaaEapKeyData;
-        int aaaEapKeyLength;
+        u8 *aaaEapMSKData;
+        int aaaEapMSKLength;
+        u8 *aaaEapEMSKData;
+        int aaaEapEMSKLength;
         boolean aaaEapKeyAvailable;
         int aaaMethodTimeout;

extensions/app_diameap/diameap_plugins.c

@@ -329 +329 @@
                 {
                         plugin->eap_method_getKey = (int(*)(struct eap_state_machine *,
-                                        u8**, int*)) dlsym(plugin->handler, registerplugin->getKey);
+                                        u8**, int*,u8**, int*)) dlsym(plugin->handler, registerplugin->getKey);
                         if (plugin->eap_method_getKey == NULL)
                         {

extensions/app_diameap/diameap_server.c

@@ -309 +309 @@
         eap_i->aaaFail = FALSE;
         eap_i->aaaEapReqData.data = NULL;
-        eap_i->aaaEapKeyData = NULL;
+        eap_i->aaaEapMSKData = NULL;
+        eap_i->aaaEapEMSKData = NULL;
         eap_i->aaaEapKeyAvailable = FALSE;
         eap_i->aaaMethodTimeout = 0;
@@ -2957 +2958 @@
         {
                 CHECK_FCT(fd_msg_avp_new(dataobj_eap_master_session_key, 0, &avp));
-                avp_val.os.data = eap_i.aaaEapKeyData;
-                avp_val.os.len = eap_i.aaaEapKeyLength;
+                avp_val.os.data = eap_i.aaaEapMSKData;
+                avp_val.os.len = eap_i.aaaEapMSKLength;
                 CHECK_FCT(fd_msg_avp_setvalue(avp, &avp_val));
                 CHECK_FCT( fd_msg_avp_add( ans, MSG_BRW_LAST_CHILD, avp ) );

extensions/app_diameap/libdiameap.h

@@ -114 +114 @@
                         struct eap_packet eapRespData); /* address of the eap_method_process method */
         boolean (*eap_method_isDone)(struct eap_state_machine *smd); /* address of the eap_method_isDone method */
-        int (*eap_method_getKey)(struct eap_state_machine *smd, u8 ** key,int *keylength); /* address of the eap_method_getKey method */
+        int (*eap_method_getKey)(struct eap_state_machine *smd, u8 ** msk,int *msklength, 
+                        u8 ** emsk,int *emsklength); /* address of the eap_method_getKey method */
         void (*eap_method_unregister)(void); /* (Optional) address of the eap_method_unregister method */
         void (*eap_method_free)(void *); /* (Optional) address of the eap_method_datafree method */

extensions/app_diameap/plugins/eap_tls/eap_tls.c

@@ -50 +50 @@
                 struct eap_packet eapRespData);
 boolean eap_tls_isDone(struct eap_state_machine *smd);
-int eap_tls_getKey(struct eap_state_machine *smd, u8** key, int * keylen);
+int eap_tls_getKey(struct eap_state_machine *smd, u8** msk, int * msklen, u8** emsk, int * emsklen);
 void eap_tls_unregister(void);
 void eap_tls_free(void * data);
@@ -289 +289 @@
 }
 
-int eap_tls_getKey(struct eap_state_machine *smd, u8 ** key, int *keylen)
+int eap_tls_getKey(struct eap_state_machine *smd, u8 ** msk, int *msklen, u8 ** emsk, int *emsklen)
 {
         struct tls_data * data;
+        int len = emsk ? 128 : 64;
         data = (struct tls_data *) smd->methodData;
-        *key = malloc(64);
+        *msk = malloc(len);
         if (gnutls_prf(data->session, strlen("client EAP encryption"),
-                        "client EAP encryption", 0, 0, NULL, 64, (char *) *key)
+                        "client EAP encryption", 0, 0, NULL, len, (char *) *msk)
                         != GNUTLS_E_SUCCESS)
         {
-                free(*key);
-                *key = NULL;
-                *keylen = 0;
+                free(*msk);
+                *msk = NULL;
+                *msklen = 0;
                 return 1;
         }
         else
         {
-                *keylen = 64;
+                *msklen = 64;
+        }
+        if (emsk) {
+                *emsk = malloc(64);
+                memcpy(*emsk, (*msk)+64, 64);
+                memset((*msk)+64, 0, 64);
+                *emsklen = 64;
         }