src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c

   1 /*
   2  * eap_fast.c  contains the interfaces that are called from the main handler
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  *   Copyright 2016 Alan DeKok <aland@freeradius.org>
  21  *   Copyright 2016 The FreeRADIUS server project
  22  */
  23
  24 RCSID("$Id$")
  25
  26 #include "eap_fast.h"
  27 #include "eap_fast_crypto.h"
  28 #include <freeradius-devel/sha1.h>
  29 #include <openssl/ssl.h>
  30 #include <openssl/rand.h>
  31
  32 #define RANDFILL(x) do { rad_assert(sizeof(x) % sizeof(uint32_t) == 0); for (size_t i = 0; i < sizeof(x); i += sizeof(uint32_t)) *((uint32_t *)&x[i]) = fr_rand(); } while(0)
  33
  34 /*
  35  * Copyright (c) 2002-2016, Jouni Malinen <j@w1.fi> and contributors
  36  * All Rights Reserved.
  37  *
  38  * These programs are licensed under the BSD license (the one with
  39  * advertisement clause removed).
  40  *
  41  * this function shamelessly stolen from from hostap:src/crypto/tls_openssl.c
  42  */
  43 static int openssl_get_keyblock_size(REQUEST *request, SSL *ssl)
  44 {
  45         const EVP_CIPHER *c;
  46         const EVP_MD *h;
  47 #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
  48         int md_size;
  49
  50         if (ssl->enc_read_ctx == NULL || ssl->enc_read_ctx->cipher == NULL ||
  51             ssl->read_hash == NULL)
  52                 return -1;
  53
  54         c = ssl->enc_read_ctx->cipher;
  55         h = EVP_MD_CTX_md(ssl->read_hash);
  56         if (h)
  57                 md_size = EVP_MD_size(h);
  58         else if (ssl->s3)
  59                 md_size = ssl->s3->tmp.new_mac_secret_size;
  60         else
  61                 return -1;
  62
  63         RDEBUG2("OpenSSL: keyblock size: key_len=%d MD_size=%d "
  64                    "IV_len=%d", EVP_CIPHER_key_length(c), md_size,
  65                    EVP_CIPHER_iv_length(c));
  66         return 2 * (EVP_CIPHER_key_length(c) +
  67                     md_size +
  68                     EVP_CIPHER_iv_length(c));
  69 #else
  70         const SSL_CIPHER *ssl_cipher;
  71         int cipher, digest;
  72
  73         ssl_cipher = SSL_get_current_cipher(ssl);
  74         if (!ssl_cipher)
  75                 return -1;
  76         cipher = SSL_CIPHER_get_cipher_nid(ssl_cipher);
  77         digest = SSL_CIPHER_get_digest_nid(ssl_cipher);
  78         RDEBUG2("OpenSSL: cipher nid %d digest nid %d", cipher, digest);
  79         if (cipher < 0 || digest < 0)
  80                 return -1;
  81         c = EVP_get_cipherbynid(cipher);
  82         h = EVP_get_digestbynid(digest);
  83         if (!c || !h)
  84                 return -1;
  85
  86         RDEBUG2("OpenSSL: keyblock size: key_len=%d MD_size=%d IV_len=%d",
  87                    EVP_CIPHER_key_length(c), EVP_MD_size(h),
  88                    EVP_CIPHER_iv_length(c));
  89         return 2 * (EVP_CIPHER_key_length(c) + EVP_MD_size(h) +
  90                     EVP_CIPHER_iv_length(c));
  91 #endif
  92 }
  93
  94 /**
  95  * RFC 4851 section 5.1 - EAP-FAST Authentication Phase 1: Key Derivations
  96  */
  97 static void eap_fast_init_keys(REQUEST *request, tls_session_t *tls_session)
  98 {
  99         eap_fast_tunnel_t *t = tls_session->opaque;
 100         uint8_t *buf;
 101         uint8_t *scratch;
 102         size_t ksize;
 103
 104         RDEBUG2("Deriving EAP-FAST keys");
 105
 106         rad_assert(t->simck == NULL);
 107
 108         ksize = openssl_get_keyblock_size(request, tls_session->ssl);
 109         rad_assert(ksize > 0);
 110         buf = talloc_size(request, ksize + sizeof(*t->keyblock));
 111         scratch = talloc_size(request, ksize + sizeof(*t->keyblock));
 112
 113         t->keyblock = talloc(request, eap_fast_keyblock_t);
 114
 115         eap_fast_tls_gen_challenge(tls_session->ssl, buf, scratch, ksize + sizeof(*t->keyblock), "key expansion");
 116         memcpy(t->keyblock, &buf[ksize], sizeof(*t->keyblock));
 117         memset(buf, 0, ksize + sizeof(*t->keyblock));
 118
 119         t->simck = talloc_size(request, EAP_FAST_SIMCK_LEN);
 120         memcpy(t->simck, t->keyblock, EAP_FAST_SKS_LEN);        /* S-IMCK[0] = session_key_seed */
 121
 122         t->cmk = talloc_size(request, EAP_FAST_CMK_LEN);        /* note that CMK[0] is not defined */
 123         t->imckc = 0;
 124
 125         talloc_free(buf);
 126         talloc_free(scratch);
 127 }
 128
 129 /**
 130  * RFC 4851 section 5.2 - Intermediate Compound Key Derivations
 131  */
 132 static void eap_fast_update_icmk(REQUEST *request, tls_session_t *tls_session, uint8_t *msk)
 133 {
 134         eap_fast_tunnel_t *t = tls_session->opaque;
 135         uint8_t imck[EAP_FAST_SIMCK_LEN + EAP_FAST_CMK_LEN];
 136
 137         RDEBUG2("Updating ICMK");
 138
 139         T_PRF(t->simck, EAP_FAST_SIMCK_LEN, "Inner Methods Compound Keys", msk, 32, imck, sizeof(imck));
 140
 141         memcpy(t->simck, imck, EAP_FAST_SIMCK_LEN);
 142         memcpy(t->cmk, &imck[EAP_FAST_SIMCK_LEN], EAP_FAST_CMK_LEN);
 143         t->imckc++;
 144
 145         /*
 146          * Calculate MSK/EMSK at the same time as they are coupled to ICMK
 147          *
 148          * RFC 4851 section 5.4 - EAP Master Session Key Generation
 149          */
 150         t->msk = talloc_size(request, EAP_FAST_KEY_LEN);
 151         T_PRF(t->simck, EAP_FAST_SIMCK_LEN, "Session Key Generating Function", NULL, 0, t->msk, EAP_FAST_KEY_LEN);
 152
 153         t->emsk = talloc_size(request, EAP_EMSK_LEN);
 154         T_PRF(t->simck, EAP_FAST_SIMCK_LEN, "Extended Session Key Generating Function", NULL, 0, t->emsk, EAP_EMSK_LEN);
 155 }
 156
 157 void eap_fast_tlv_append(tls_session_t *tls_session, int tlv, bool mandatory, int length, const void *data)
 158 {
 159         uint16_t hdr[2];
 160
 161         hdr[0] = (mandatory) ? htons(tlv | EAP_FAST_TLV_MANDATORY) : htons(tlv);
 162         hdr[1] = htons(length);
 163
 164         tls_session->record_plus(&tls_session->clean_in, &hdr, 4);
 165         tls_session->record_plus(&tls_session->clean_in, data, length);
 166 }
 167
 168 static void eap_fast_send_error(tls_session_t *tls_session, int error)
 169 {
 170         uint32_t value;
 171         value = htonl(error);
 172
 173         eap_fast_tlv_append(tls_session, EAP_FAST_TLV_ERROR, true, sizeof(value), &value);
 174 }
 175
 176 static void eap_fast_append_result(tls_session_t *tls_session, PW_CODE code)
 177 {
 178         eap_fast_tunnel_t *t = (eap_fast_tunnel_t *) tls_session->opaque;
 179
 180         int type = (t->result_final)
 181                         ? EAP_FAST_TLV_RESULT
 182                         : EAP_FAST_TLV_INTERMED_RESULT;
 183
 184         uint16_t state = (code == PW_CODE_ACCESS_REJECT)
 185                         ? EAP_FAST_TLV_RESULT_FAILURE
 186                         : EAP_FAST_TLV_RESULT_SUCCESS;
 187         state = htons(state);
 188
 189         eap_fast_tlv_append(tls_session, type, true, sizeof(state), &state);
 190 }
 191
 192 static void eap_fast_send_identity_request(REQUEST *request, tls_session_t *tls_session, eap_handler_t *eap_session)
 193 {
 194         eap_packet_raw_t eap_packet;
 195
 196         RDEBUG("Sending EAP-Identity");
 197
 198         eap_packet.code = PW_EAP_REQUEST;
 199         eap_packet.id = eap_session->eap_ds->response->id + 1;
 200         eap_packet.length[0] = 0;
 201         eap_packet.length[1] = EAP_HEADER_LEN + 1;
 202         eap_packet.data[0] = PW_EAP_IDENTITY;
 203
 204         eap_fast_tlv_append(tls_session, EAP_FAST_TLV_EAP_PAYLOAD, true, sizeof(eap_packet), &eap_packet);
 205 }
 206
 207 static void eap_fast_send_pac_tunnel(REQUEST *request, tls_session_t *tls_session)
 208 {
 209         eap_fast_tunnel_t                       *t = tls_session->opaque;
 210         eap_fast_pac_t                          pac;
 211         eap_fast_attr_pac_opaque_plaintext_t    opaque_plaintext;
 212         int                                     alen, dlen;
 213
 214         memset(&pac, 0, sizeof(pac));
 215         memset(&opaque_plaintext, 0, sizeof(opaque_plaintext));
 216
 217         RDEBUG("Sending Tunnel PAC");
 218
 219         pac.key.hdr.type = htons(EAP_FAST_TLV_MANDATORY | PAC_INFO_PAC_KEY);
 220         pac.key.hdr.length = htons(sizeof(pac.key.data));
 221         rad_assert(sizeof(pac.key.data) % sizeof(uint32_t) == 0);
 222         RANDFILL(pac.key.data);
 223
 224         pac.info.lifetime.hdr.type = htons(PAC_INFO_PAC_LIFETIME);
 225         pac.info.lifetime.hdr.length = htons(sizeof(pac.info.lifetime.data));
 226         pac.info.lifetime.data = htonl(time(NULL) + t->pac_lifetime);
 227
 228         pac.info.a_id.hdr.type = htons(EAP_FAST_TLV_MANDATORY | PAC_INFO_A_ID);
 229         pac.info.a_id.hdr.length = htons(sizeof(pac.info.a_id.data));
 230         memcpy(pac.info.a_id.data, t->a_id, sizeof(pac.info.a_id.data));
 231
 232         pac.info.a_id_info.hdr.type = htons(PAC_INFO_A_ID_INFO);
 233         pac.info.a_id_info.hdr.length = htons(sizeof(pac.info.a_id_info.data));
 234         #define MIN(a,b) (((a)>(b)) ? (b) : (a))
 235         alen = MIN(talloc_array_length(t->authority_identity) - 1, sizeof(pac.info.a_id_info.data));
 236         memcpy(pac.info.a_id_info.data, t->authority_identity, alen);
 237
 238         pac.info.type.hdr.type = htons(EAP_FAST_TLV_MANDATORY | PAC_INFO_PAC_TYPE);
 239         pac.info.type.hdr.length = htons(sizeof(pac.info.type.data));
 240         pac.info.type.data = htons(PAC_TYPE_TUNNEL);
 241
 242         pac.info.hdr.type = htons(EAP_FAST_TLV_MANDATORY | PAC_INFO_PAC_INFO);
 243         pac.info.hdr.length = htons(sizeof(pac.info.lifetime)
 244                                 + sizeof(pac.info.a_id)
 245                                 + sizeof(pac.info.a_id_info)
 246                                 + sizeof(pac.info.type));
 247
 248         memcpy(&opaque_plaintext.type, &pac.info.type, sizeof(opaque_plaintext.type));
 249         memcpy(&opaque_plaintext.lifetime, &pac.info.lifetime, sizeof(opaque_plaintext.lifetime));
 250         memcpy(&opaque_plaintext.key, &pac.key, sizeof(opaque_plaintext.key));
 251
 252
 253         rad_assert(PAC_A_ID_LENGTH <= EVP_GCM_TLS_TAG_LEN);
 254         memcpy(pac.opaque.aad, t->a_id, PAC_A_ID_LENGTH);
 255         rad_assert(RAND_bytes(pac.opaque.iv, sizeof(pac.opaque.iv)) != 0);
 256         dlen = eap_fast_encrypt((unsigned const char *)&opaque_plaintext, sizeof(opaque_plaintext),
 257                                     t->a_id, PAC_A_ID_LENGTH, t->pac_opaque_key, pac.opaque.iv,
 258                                     pac.opaque.data, pac.opaque.tag);
 259
 260         pac.opaque.hdr.type = htons(EAP_FAST_TLV_MANDATORY | PAC_INFO_PAC_OPAQUE);
 261         pac.opaque.hdr.length = htons(sizeof(pac.opaque) - sizeof(pac.opaque.hdr) - sizeof(pac.opaque.data) + dlen);
 262
 263         eap_fast_tlv_append(tls_session, EAP_FAST_TLV_MANDATORY | EAP_FAST_TLV_PAC, true,
 264                             sizeof(pac) - sizeof(pac.opaque.data) + dlen, &pac);
 265 }
 266
 267 static void eap_fast_append_crypto_binding(REQUEST *request, tls_session_t *tls_session)
 268 {
 269         eap_fast_tunnel_t               *t = tls_session->opaque;
 270         eap_tlv_crypto_binding_tlv_t    binding;
 271     memset(&binding, 0, sizeof(eap_tlv_crypto_binding_tlv_t));
 272         const int                       len = sizeof(binding) - (&binding.reserved - (uint8_t *)&binding);
 273
 274         RDEBUG("Sending Cryptobinding");
 275
 276         binding.tlv_type = htons(EAP_FAST_TLV_MANDATORY | EAP_FAST_TLV_CRYPTO_BINDING);
 277         binding.length = htons(len);
 278         binding.version = EAP_FAST_VERSION;
 279         binding.received_version = EAP_FAST_VERSION;    /* FIXME use the clients value */
 280         binding.subtype = EAP_FAST_TLV_CRYPTO_BINDING_SUBTYPE_REQUEST;
 281
 282         rad_assert(sizeof(binding.nonce) % sizeof(uint32_t) == 0);
 283         RANDFILL(binding.nonce);
 284         binding.nonce[sizeof(binding.nonce) - 1] &= ~0x01; /* RFC 4851 section 4.2.8 */
 285
 286
 287         fr_hmac_sha1(binding.compound_mac, (uint8_t *)&binding, sizeof(binding), t->cmk, EAP_FAST_CMK_LEN);
 288
 289         eap_fast_tlv_append(tls_session, EAP_FAST_TLV_CRYPTO_BINDING, true, len, &binding.reserved);
 290 }
 291
 292 static int eap_fast_verify(REQUEST *request, tls_session_t *tls_session, uint8_t const *data, unsigned int data_len)
 293 {
 294         uint16_t attr;
 295         uint16_t length;
 296         unsigned int remaining = data_len;
 297         int     total = 0;
 298         int     num[EAP_FAST_TLV_MAX] = {0};
 299         eap_fast_tunnel_t *t = (eap_fast_tunnel_t *) tls_session->opaque;
 300         uint32_t present = 0;
 301
 302         rad_assert(sizeof(present) * 8 > EAP_FAST_TLV_MAX);
 303
 304         while (remaining > 0) {
 305                 if (remaining < 4) {
 306                         RDEBUG2("EAP-FAST TLV is too small (%u) to contain a EAP-FAST TLV header", remaining);
 307                         return 0;
 308                 }
 309
 310                 memcpy(&attr, data, sizeof(attr));
 311                 attr = ntohs(attr) & EAP_FAST_TLV_TYPE;
 312
 313                 switch (attr) {
 314                 case EAP_FAST_TLV_RESULT:
 315                 case EAP_FAST_TLV_NAK:
 316                 case EAP_FAST_TLV_ERROR:
 317                 case EAP_FAST_TLV_VENDOR_SPECIFIC:
 318                 case EAP_FAST_TLV_EAP_PAYLOAD:
 319                 case EAP_FAST_TLV_INTERMED_RESULT:
 320                 case EAP_FAST_TLV_PAC:
 321                 case EAP_FAST_TLV_CRYPTO_BINDING:
 322                         num[attr]++;
 323                         present |= 1 << attr;
 324
 325                         if (num[EAP_FAST_TLV_EAP_PAYLOAD] > 1) {
 326                                 RDEBUG("Too many EAP-Payload TLVs");
 327 unexpected:
 328                                 for (int i = 0; i < EAP_FAST_TLV_MAX; i++)
 329                                         if (present & (1 << i))
 330                                                 RDEBUG(" - attribute %d is present", i);
 331                                 eap_fast_send_error(tls_session, EAP_FAST_ERR_UNEXPECTED_TLV);
 332                                 return 0;
 333                         }
 334
 335                         if (num[EAP_FAST_TLV_INTERMED_RESULT] > 1) {
 336                                 RDEBUG("Too many Intermediate-Result TLVs");
 337                                 goto unexpected;
 338                         }
 339                         break;
 340                 default:
 341                         if ((data[0] & 0x80) != 0) {
 342                                 RDEBUG("Unknown mandatory TLV %02x", attr);
 343                                 goto unexpected;
 344                         }
 345
 346                         num[0]++;
 347                 }
 348
 349                 total++;
 350
 351                 memcpy(&length, data + 2, sizeof(length));
 352                 length = ntohs(length);
 353
 354                 data += 4;
 355                 remaining -= 4;
 356
 357                 if (length > remaining) {
 358                         RDEBUG2("EAP-FAST TLV %u is longer than room remaining in the packet (%u > %u).", attr,
 359                                 length, remaining);
 360                         return 0;
 361                 }
 362
 363                 /*
 364                  * If the rest of the TLVs are larger than
 365                  * this attribute, continue.
 366                  *
 367                  * Otherwise, if the attribute over-flows the end
 368                  * of the TLCs, die.
 369                  */
 370                 if (remaining < length) {
 371                         RDEBUG2("EAP-FAST TLV overflows packet!");
 372                         return 0;
 373                 }
 374
 375                 /*
 376                  * If there's an error, we bail out of the
 377                  * authentication process before allocating
 378                  * memory.
 379                  */
 380                 if ((attr == EAP_FAST_TLV_INTERMED_RESULT) || (attr == EAP_FAST_TLV_RESULT)) {
 381                         uint16_t status;
 382
 383                         if (length < 2) {
 384                                 RDEBUG("EAP-FAST TLV %u is too short.  Expected 2, got %d.", attr, length);
 385                                 return 0;
 386                         }
 387
 388                         memcpy(&status, data, 2);
 389                         status = ntohs(status);
 390
 391                         if (status == EAP_FAST_TLV_RESULT_FAILURE) {
 392                                 RDEBUG("EAP-FAST TLV %u indicates failure.  Rejecting request.", attr);
 393                                 return 0;
 394                         }
 395
 396                         if (status != EAP_FAST_TLV_RESULT_SUCCESS) {
 397                                 RDEBUG("EAP-FAST TLV %u contains unknown value.  Rejecting request.", attr);
 398                                 goto unexpected;
 399                         }
 400                 }
 401
 402                 /*
 403                  * remaining > length, continue.
 404                  */
 405                 remaining -= length;
 406                 data += length;
 407         }
 408
 409         /*
 410          * Check if the peer mixed & matched TLVs.
 411          */
 412         if ((num[EAP_FAST_TLV_NAK] > 0) && (num[EAP_FAST_TLV_NAK] != total)) {
 413                 RDEBUG("NAK TLV sent with non-NAK TLVs.  Rejecting request.");
 414                 goto unexpected;
 415         }
 416
 417         if (num[EAP_FAST_TLV_INTERMED_RESULT] > 0 && num[EAP_FAST_TLV_RESULT]) {
 418                 RDEBUG("NAK TLV sent with non-NAK TLVs.  Rejecting request.");
 419                 goto unexpected;
 420         }
 421
 422         /*
 423          * Check mandatory or not mandatory TLVs.
 424          */
 425         switch (t->stage) {
 426         case TLS_SESSION_HANDSHAKE:
 427                 if (present) {
 428                         RDEBUG("Unexpected TLVs in TLS Session Handshake stage");
 429                         goto unexpected;
 430                 }
 431                 break;
 432         case AUTHENTICATION:
 433                 if (present != 1 << EAP_FAST_TLV_EAP_PAYLOAD) {
 434                         RDEBUG("Unexpected TLVs in authentication stage");
 435                         goto unexpected;
 436                 }
 437                 break;
 438         case CRYPTOBIND_CHECK:
 439         {
 440                 uint32_t bits = (t->result_final)
 441                                 ? 1 << EAP_FAST_TLV_RESULT
 442                                 : 1 << EAP_FAST_TLV_INTERMED_RESULT;
 443                 if (present & ~(bits | (1 << EAP_FAST_TLV_CRYPTO_BINDING) | (1 << EAP_FAST_TLV_PAC))) {
 444                         RDEBUG("Unexpected TLVs in cryptobind checking stage");
 445                         goto unexpected;
 446                 }
 447                 break;
 448         }
 449         case PROVISIONING:
 450                 if (present & ~((1 << EAP_FAST_TLV_PAC) | (1 << EAP_FAST_TLV_RESULT))) {
 451                         RDEBUG("Unexpected TLVs in provisioning stage");
 452                         goto unexpected;
 453                 }
 454                 break;
 455         case COMPLETE:
 456                 if (present) {
 457                         RDEBUG("Unexpected TLVs in complete stage");
 458                         goto unexpected;
 459                 }
 460                 break;
 461         default:
 462                 RDEBUG("Unexpected stage %d", t->stage);
 463                 return 0;
 464         }
 465
 466         /*
 467          * We got this far.  It looks OK.
 468          */
 469         return 1;
 470 }
 471
 472 static ssize_t eap_fast_decode_vp(TALLOC_CTX *request, DICT_ATTR const *parent,
 473                                     uint8_t const *data, size_t const attr_len, VALUE_PAIR **out)
 474 {
 475         int8_t                  tag = TAG_NONE;
 476         VALUE_PAIR              *vp;
 477         uint8_t const           *p = data;
 478
 479         /*
 480          *      FIXME: Attrlen can be larger than 253 for extended attrs!
 481          */
 482         if (!parent || !out ) {
 483                 RERROR("eap_fast_decode_vp: Invalid arguments");
 484                 return -1;
 485         }
 486
 487         /*
 488          *      Silently ignore zero-length attributes.
 489          */
 490         if (attr_len == 0) return 0;
 491
 492         /*
 493          *      And now that we've verified the basic type
 494          *      information, decode the actual p.
 495          */
 496         vp = fr_pair_afrom_da(request, parent);
 497         if (!vp) return -1;
 498
 499         vp->vp_length = attr_len;
 500         vp->tag = tag;
 501
 502         switch (parent->type) {
 503         case PW_TYPE_STRING:
 504                 fr_pair_value_bstrncpy(vp, p, attr_len);
 505                 break;
 506
 507         case PW_TYPE_OCTETS:
 508                 fr_pair_value_memcpy(vp, p, attr_len);
 509                 break;
 510
 511         case PW_TYPE_ABINARY:
 512                 if (vp->vp_length > sizeof(vp->vp_filter)) {
 513                         vp->vp_length = sizeof(vp->vp_filter);
 514                 }
 515                 memcpy(vp->vp_filter, p, vp->vp_length);
 516                 break;
 517
 518         case PW_TYPE_BYTE:
 519                 vp->vp_byte = p[0];
 520                 break;
 521
 522         case PW_TYPE_SHORT:
 523                 vp->vp_short = (p[0] << 8) | p[1];
 524                 break;
 525
 526         case PW_TYPE_INTEGER:
 527                 memcpy(&vp->vp_integer, p, 4);
 528                 vp->vp_integer = ntohl(vp->vp_integer);
 529                 break;
 530
 531         case PW_TYPE_INTEGER64:
 532                 memcpy(&vp->vp_integer64, p, 8);
 533                 vp->vp_integer64 = ntohll(vp->vp_integer64);
 534                 break;
 535
 536         case PW_TYPE_DATE:
 537                 memcpy(&vp->vp_date, p, 4);
 538                 vp->vp_date = ntohl(vp->vp_date);
 539                 break;
 540
 541         case PW_TYPE_ETHERNET:
 542                 memcpy(vp->vp_ether, p, 6);
 543                 break;
 544
 545         case PW_TYPE_IPV4_ADDR:
 546                 memcpy(&vp->vp_ipaddr, p, 4);
 547                 break;
 548
 549         case PW_TYPE_IFID:
 550                 memcpy(vp->vp_ifid, p, 8);
 551                 break;
 552
 553         case PW_TYPE_IPV6_ADDR:
 554                 memcpy(&vp->vp_ipv6addr, p, 16);
 555                 break;
 556
 557         case PW_TYPE_IPV6_PREFIX:
 558                 /*
 559                  *      FIXME: double-check that
 560                  *      (vp->vp_octets[1] >> 3) matches vp->vp_length + 2
 561                  */
 562                 memcpy(vp->vp_ipv6prefix, p, vp->vp_length);
 563                 if (vp->vp_length < 18) {
 564                         memset(((uint8_t *)vp->vp_ipv6prefix) + vp->vp_length, 0,
 565                                18 - vp->vp_length);
 566                 }
 567                 break;
 568
 569         case PW_TYPE_IPV4_PREFIX:
 570                 /* FIXME: do the same double-check as for IPv6Prefix */
 571                 memcpy(vp->vp_ipv4prefix, p, vp->vp_length);
 572
 573                 /*
 574                  *      /32 means "keep all bits".  Otherwise, mask
 575                  *      them out.
 576                  */
 577                 if ((p[1] & 0x3f) > 32) {
 578                         uint32_t addr, mask;
 579
 580                         memcpy(&addr, vp->vp_octets + 2, sizeof(addr));
 581                         mask = 1;
 582                         mask <<= (32 - (p[1] & 0x3f));
 583                         mask--;
 584                         mask = ~mask;
 585                         mask = htonl(mask);
 586                         addr &= mask;
 587                         memcpy(vp->vp_ipv4prefix + 2, &addr, sizeof(addr));
 588                 }
 589                 break;
 590
 591         case PW_TYPE_SIGNED:    /* overloaded with vp_integer */
 592                 memcpy(&vp->vp_integer, p, 4);
 593                 vp->vp_integer = ntohl(vp->vp_integer);
 594                 break;
 595
 596         default:
 597                 RERROR("eap_fast_decode_vp: type %d Internal sanity check  %d ", parent->type, __LINE__);
 598                 fr_pair_list_free(&vp);
 599                 return -1;
 600         }
 601         vp->type = VT_DATA;
 602     *out = vp;
 603         return attr_len;
 604 }
 605
 606
 607 VALUE_PAIR *eap_fast_fast2vp(REQUEST *request, SSL *ssl, uint8_t const *data, size_t data_len,
 608                              DICT_ATTR const *fast_da, vp_cursor_t *out)
 609 {
 610         uint16_t        attr;
 611         uint16_t        length;
 612         size_t          data_left = data_len;
 613         VALUE_PAIR      *first = NULL;
 614         VALUE_PAIR      *vp = NULL;
 615         DICT_ATTR const *da;
 616
 617         if (!fast_da)
 618                 fast_da = dict_attrbyvalue(PW_EAP_FAST_TLV, 0);
 619         rad_assert(fast_da != NULL);
 620
 621         if (!out) {
 622                 out = talloc(request, vp_cursor_t);
 623                 rad_assert(out != NULL);
 624                 fr_cursor_init(out, &first);
 625         }
 626
 627         /*
 628          * Decode the TLVs
 629          */
 630         while (data_left > 0) {
 631                 ssize_t decoded;
 632
 633                 /* FIXME do something with mandatory */
 634
 635                 memcpy(&attr, data, sizeof(attr));
 636                 attr = ntohs(attr) & EAP_FAST_TLV_TYPE;
 637
 638                 memcpy(&length, data + 2, sizeof(length));
 639                 length = ntohs(length);
 640
 641                 data += 4;
 642                 data_left -= 4;
 643
 644                 /*
 645                  * Look up the TLV.
 646                  *
 647                  * For now, if it doesn't exist, ignore it.
 648                  */
 649                 da = dict_attrbyparent(fast_da, attr, fast_da->vendor);
 650                 if (!da) {
 651                         RDEBUG("eap_fast_fast2vp: no sub attribute found %s attr: %u vendor: %u",
 652                                         fast_da->name, attr, fast_da->vendor);
 653                         goto next_attr;
 654                 }
 655                 if (da->type == PW_TYPE_TLV) {
 656                         eap_fast_fast2vp(request, ssl, data, length, da, out);
 657                         goto next_attr;
 658                 }
 659                 decoded = eap_fast_decode_vp(request, da, data, length, &vp);
 660                 if (decoded < 0) {
 661                         RERROR("Failed decoding %s: %s", da->name, fr_strerror());
 662                         goto next_attr;
 663                 }
 664
 665                 fr_cursor_merge(out, vp);
 666
 667         next_attr:
 668                 while (fr_cursor_next(out)) {
 669                         /* nothing */
 670                 }
 671
 672                 data += length;
 673                 data_left -= length;
 674         }
 675
 676         /*
 677          * We got this far.  It looks OK.
 678          */
 679         return first;
 680 }
 681
 682
 683 static void eap_vp2fast(tls_session_t *tls_session, VALUE_PAIR *first)
 684 {
 685         VALUE_PAIR      *vp;
 686         vp_cursor_t     cursor;
 687
 688         for (vp = fr_cursor_init(&cursor, &first); vp; vp = fr_cursor_next(&cursor))
 689         {
 690                 if (vp->da->vendor != 0 && vp->da->attr != PW_EAP_MESSAGE) continue;
 691
 692                 eap_fast_tlv_append(tls_session, EAP_FAST_TLV_EAP_PAYLOAD, true, vp->vp_length, vp->vp_octets);
 693         }
 694 }
 695
 696
 697 /*
 698  * Use a reply packet to determine what to do.
 699  */
 700 static rlm_rcode_t CC_HINT(nonnull) process_reply( eap_handler_t *eap_session,
 701                                                   tls_session_t *tls_session,
 702                                                   REQUEST *request, RADIUS_PACKET *reply)
 703 {
 704         rlm_rcode_t                     rcode = RLM_MODULE_REJECT;
 705         VALUE_PAIR                      *vp, *tunnel_vps = NULL;
 706         vp_cursor_t                     cursor;
 707         vp_cursor_t                     to_tunnel;
 708
 709         eap_fast_tunnel_t       *t = tls_session->opaque;
 710
 711         rad_assert(eap_session->request == request);
 712
 713         /*
 714          * If the response packet was Access-Accept, then
 715          * we're OK.  If not, die horribly.
 716          *
 717          * FIXME: Take MS-CHAP2-Success attribute, and
 718          * tunnel it back to the client, to authenticate
 719          * ourselves to the client.
 720          *
 721          * FIXME: If we have an Access-Challenge, then
 722          * the Reply-Message is tunneled back to the client.
 723          *
 724          * FIXME: If we have an EAP-Message, then that message
 725          * must be tunneled back to the client.
 726          *
 727          * FIXME: If we have an Access-Challenge with a State
 728          * attribute, then do we tunnel that to the client, or
 729          * keep track of it ourselves?
 730          *
 731          * FIXME: EAP-Messages can only start with 'identity',
 732          * NOT 'eap start', so we should check for that....
 733          */
 734         switch (reply->code) {
 735         case PW_CODE_ACCESS_ACCEPT:
 736                 RDEBUG("Got tunneled Access-Accept");
 737                 fr_cursor_init(&to_tunnel, &tunnel_vps);
 738                 rcode = RLM_MODULE_OK;
 739
 740                 for (vp = fr_cursor_init(&cursor, &reply->vps); vp; vp = fr_cursor_next(&cursor)) {
 741                         switch (vp->da->vendor) {
 742                         case VENDORPEC_MICROSOFT:
 743                                 /* FIXME must be a better way to capture/re-derive this later for ISK */
 744                 switch(vp->da->attr) {
 745                 case PW_MSCHAP_MPPE_SEND_KEY:
 746                                         memcpy(t->isk.mppe_send, vp->vp_octets, CHAP_VALUE_LENGTH);
 747                     break;
 748
 749                 case PW_MSCHAP_MPPE_RECV_KEY:
 750                                         memcpy(t->isk.mppe_recv, vp->vp_octets, CHAP_VALUE_LENGTH);
 751                     break;
 752
 753                 case PW_MSCHAP2_SUCCESS:
 754                                         RDEBUG("Got %s, tunneling it to the client in a challenge", vp->da->name);
 755                                         rcode = RLM_MODULE_HANDLED;
 756                     if (t->use_tunneled_reply) {
 757                         t->authenticated = true;
 758                         /*
 759                          *      Clean up the tunneled reply.
 760                          */
 761                         fr_pair_delete_by_num(&reply->vps, PW_PROXY_STATE, 0, TAG_ANY);
 762                         fr_pair_delete_by_num(&reply->vps, PW_EAP_MESSAGE, 0, TAG_ANY);
 763                         fr_pair_delete_by_num(&reply->vps, PW_MESSAGE_AUTHENTICATOR, 0, TAG_ANY);
 764
 765                         /*
 766                          *      Delete MPPE keys & encryption policy.  We don't
 767                          *      want these here.
 768                          */
 769                         fr_pair_delete_by_num(&reply->vps, 7, VENDORPEC_MICROSOFT, TAG_ANY);
 770                         fr_pair_delete_by_num(&reply->vps, 8, VENDORPEC_MICROSOFT, TAG_ANY);
 771                         fr_pair_delete_by_num(&reply->vps, 16, VENDORPEC_MICROSOFT, TAG_ANY);
 772                         fr_pair_delete_by_num(&reply->vps, 17, VENDORPEC_MICROSOFT, TAG_ANY);
 773
 774                         fr_pair_list_free(&t->accept_vps); /* for proxying MS-CHAP2 */
 775                         fr_pair_list_mcopy_by_num(t, &t->accept_vps, &reply->vps, 0, 0, TAG_ANY);
 776                         rad_assert(!reply->vps);
 777                     }
 778                     break;
 779
 780                 default:
 781                     break;
 782                                 }
 783                                 break;
 784
 785                         default:
 786                                 break;
 787                         }
 788                 }
 789                 break;
 790
 791         case PW_CODE_ACCESS_REJECT:
 792                 RDEBUG("Got tunneled Access-Reject");
 793                 rcode = RLM_MODULE_REJECT;
 794                 break;
 795
 796         /*
 797          * Handle Access-Challenge, but only if we
 798          * send tunneled reply data.  This is because
 799          * an Access-Challenge means that we MUST tunnel
 800          * a Reply-Message to the client.
 801          */
 802         case PW_CODE_ACCESS_CHALLENGE:
 803                 RDEBUG("Got tunneled Access-Challenge");
 804
 805                 /*
 806                  *      Keep the State attribute, if necessary.
 807                  *
 808                  *      Get rid of the old State, too.
 809                  */
 810                 fr_pair_list_free(&t->state);
 811                 fr_pair_list_mcopy_by_num(t, &t->state, &reply->vps, PW_STATE, 0, TAG_ANY);
 812
 813                 /*
 814                  *      We should really be a bit smarter about this,
 815                  *      and move over only those attributes which
 816                  *      are relevant to the authentication request,
 817                  *      but that's a lot more work, and this "dumb"
 818                  *      method works in 99.9% of the situations.
 819                  */
 820                 vp = NULL;
 821                 fr_pair_list_mcopy_by_num(t, &vp, &reply->vps, PW_EAP_MESSAGE, 0, TAG_ANY);
 822
 823                 /*
 824                  *      There MUST be a Reply-Message in the challenge,
 825                  *      which we tunnel back to the client.
 826                  *
 827                  *      If there isn't one in the reply VP's, then
 828                  *      we MUST create one, with an empty string as
 829                  *      it's value.
 830                  */
 831                 fr_pair_list_mcopy_by_num(t, &vp, &reply->vps, PW_REPLY_MESSAGE, 0, TAG_ANY);
 832
 833                 rcode = RLM_MODULE_HANDLED;
 834                 break;
 835
 836         default:
 837                 RDEBUG("Unknown RADIUS packet type %d: rejecting tunneled user", reply->code);
 838                 rcode = RLM_MODULE_INVALID;
 839                 break;
 840         }
 841
 842
 843         /*
 844          * Pack any tunnelled VPs and send them back
 845          * to the supplicant.
 846          */
 847         if (tunnel_vps) {
 848                 RDEBUG("Sending tunneled reply attributes");
 849                 rdebug_pair_list(L_DBG_LVL_2, request, tunnel_vps, NULL);
 850
 851                 eap_vp2fast(tls_session, tunnel_vps);
 852                 fr_pair_list_free(&tunnel_vps);
 853         }
 854
 855         return rcode;
 856 }
 857
 858 static PW_CODE eap_fast_eap_payload(REQUEST *request, eap_handler_t *eap_session,
 859                                     tls_session_t *tls_session, VALUE_PAIR *tlv_eap_payload)
 860 {
 861         PW_CODE                 code = PW_CODE_ACCESS_REJECT;
 862         rlm_rcode_t             rcode;
 863         VALUE_PAIR              *vp;
 864         eap_fast_tunnel_t       *t;
 865         REQUEST                 *fake;
 866
 867         RDEBUG("Processing received EAP Payload");
 868
 869         /*
 870          * Allocate a fake REQUEST structure.
 871          */
 872         fake = request_alloc_fake(request);
 873         rad_assert(!fake->packet->vps);
 874
 875         t = (eap_fast_tunnel_t *) tls_session->opaque;
 876
 877         /*
 878          * Add the tunneled attributes to the fake request.
 879          */
 880
 881         fake->packet->vps = fr_pair_afrom_num(fake->packet, PW_EAP_MESSAGE, 0);
 882         fr_pair_value_memcpy(fake->packet->vps, tlv_eap_payload->vp_octets, tlv_eap_payload->vp_length);
 883
 884         RDEBUG("Got tunneled request");
 885         rdebug_pair_list(L_DBG_LVL_1, request, fake->packet->vps, NULL);
 886
 887         /*
 888          * Tell the request that it's a fake one.
 889          */
 890         fr_pair_make(fake->packet, &fake->packet->vps, "Freeradius-Proxied-To", "127.0.0.1", T_OP_EQ);
 891
 892         /*
 893          * Update other items in the REQUEST data structure.
 894          */
 895         fake->username = fr_pair_find_by_num(fake->packet->vps, PW_USER_NAME, 0, TAG_ANY);
 896         fake->password = fr_pair_find_by_num(fake->packet->vps, PW_USER_PASSWORD, 0, TAG_ANY);
 897
 898         /*
 899          * No User-Name, try to create one from stored data.
 900          */
 901         if (!fake->username) {
 902                 /*
 903                  * No User-Name in the stored data, look for
 904                  * an EAP-Identity, and pull it out of there.
 905                  */
 906                 if (!t->username) {
 907                         vp = fr_pair_find_by_num(fake->packet->vps, PW_EAP_MESSAGE, 0, TAG_ANY);
 908                         if (vp &&
 909                             (vp->vp_length >= EAP_HEADER_LEN + 2) &&
 910                             (vp->vp_strvalue[0] == PW_EAP_RESPONSE) &&
 911                             (vp->vp_strvalue[EAP_HEADER_LEN] == PW_EAP_IDENTITY) &&
 912                             (vp->vp_strvalue[EAP_HEADER_LEN + 1] != 0)) {
 913                                 /*
 914                                  * Create & remember a User-Name
 915                                  */
 916                                 t->username = fr_pair_make(t, NULL, "User-Name", NULL, T_OP_EQ);
 917                                 rad_assert(t->username != NULL);
 918
 919                                 fr_pair_value_bstrncpy(t->username, vp->vp_octets + 5, vp->vp_length - 5);
 920
 921                                 RDEBUG("Got tunneled identity of %s", t->username->vp_strvalue);
 922                         } else {
 923                                 /*
 924                                  * Don't reject the request outright,
 925                                  * as it's permitted to do EAP without
 926                                  * user-name.
 927                                  */
 928                                 RWDEBUG2("No EAP-Identity found to start EAP conversation");
 929                         }
 930                 } /* else there WAS a t->username */
 931
 932                 if (t->username) {
 933                         vp = fr_pair_list_copy(fake->packet, t->username);
 934                         fr_pair_add(&fake->packet->vps, vp);
 935                         fake->username = fr_pair_find_by_num(fake->packet->vps, 0, PW_USER_NAME, TAG_ANY);
 936                 }
 937         } /* else the request ALREADY had a User-Name */
 938
 939         if (t->stage == AUTHENTICATION) {       /* FIXME do this only for MSCHAPv2 */
 940                 VALUE_PAIR *tvp;
 941
 942                 tvp = fr_pair_afrom_num(fake->packet, 0, PW_EAP_TYPE);
 943                 tvp->vp_integer = t->default_provisioning_method;
 944                 fr_pair_add(&fake->config, tvp);
 945
 946                 /*
 947                  * RFC 5422 section 3.2.3 - Authenticating Using EAP-FAST-MSCHAPv2
 948                  */
 949                 if (t->mode == EAP_FAST_PROVISIONING_ANON) {
 950                         tvp = fr_pair_afrom_num(fake->packet, VENDORPEC_MICROSOFT, PW_MSCHAP_CHALLENGE);
 951                         fr_pair_value_memcpy(tvp, t->keyblock->server_challenge, CHAP_VALUE_LENGTH);
 952                         fr_pair_add(&fake->config, tvp);
 953
 954                         tvp = fr_pair_afrom_num(fake->packet, 0, PW_MS_CHAP_PEER_CHALLENGE);
 955                         fr_pair_value_memcpy(tvp, t->keyblock->client_challenge, CHAP_VALUE_LENGTH);
 956                         fr_pair_add(&fake->config, tvp);
 957                 }
 958         }
 959
 960         /*
 961          * Call authentication recursively, which will
 962          * do PAP, CHAP, MS-CHAP, etc.
 963          */
 964         rad_virtual_server(fake);
 965
 966         /*
 967          * Decide what to do with the reply.
 968          */
 969         switch (fake->reply->code) {
 970         case 0:                 /* No reply code, must be proxied... */
 971 #ifdef WITH_PROXY
 972                 vp = fr_pair_find_by_num(fake->config, PW_PROXY_TO_REALM, 0, TAG_ANY);
 973                 if (vp) {
 974                         int                     ret;
 975                         eap_tunnel_data_t       *tunnel;
 976
 977                         RDEBUG("Tunneled authentication will be proxied to %s", vp->vp_strvalue);
 978
 979                         /*
 980                          * Tell the original request that it's going
 981                          * to be proxied.
 982                          */
 983                         fr_pair_list_mcopy_by_num(request, &request->config, &fake->config, PW_PROXY_TO_REALM, 0,
 984                                                    TAG_ANY);
 985
 986                         /*
 987                          * Seed the proxy packet with the
 988                          * tunneled request.
 989                          */
 990                         rad_assert(!request->proxy);
 991
 992                         request->proxy = talloc_steal(request, fake->packet);
 993
 994                         memset(&request->proxy->src_ipaddr, 0,
 995                                sizeof(request->proxy->src_ipaddr));
 996                         memset(&request->proxy->src_ipaddr, 0,
 997                                sizeof(request->proxy->src_ipaddr));
 998                         request->proxy->src_port = 0;
 999                         request->proxy->dst_port = 0;
1000                         fake->packet = NULL;
1001                         rad_free(&fake->reply);
1002                         fake->reply = NULL;
1003
1004                         /*
1005                          * Set up the callbacks for the tunnel
1006                          */
1007                         tunnel = talloc_zero(request, eap_tunnel_data_t);
1008                         tunnel->tls_session = tls_session;
1009
1010                         /*
1011                          * Associate the callback with the request.
1012                          */
1013                         ret = request_data_add(request, request->proxy, REQUEST_DATA_EAP_TUNNEL_CALLBACK,
1014                                                tunnel, false);
1015                         rad_assert(ret == 0);
1016
1017                         /*
1018                          * rlm_eap.c has taken care of associating
1019                          * the eap_session with the fake request.
1020                          *
1021                          * So we associate the fake request with
1022                          * this request.
1023                          */
1024                         ret = request_data_add(request, request->proxy, REQUEST_DATA_EAP_MSCHAP_TUNNEL_CALLBACK,
1025                                                fake, true);
1026                         rad_assert(ret == 0);
1027
1028                         fake = NULL;
1029
1030                         /*
1031                          * Didn't authenticate the packet, but
1032                          * we're proxying it.
1033                          */
1034                         code = PW_CODE_STATUS_CLIENT;
1035
1036                 } else
1037 #endif  /* WITH_PROXY */
1038                   {
1039                           RDEBUG("No tunneled reply was found, and the request was not proxied: rejecting the user.");
1040                           code = PW_CODE_ACCESS_REJECT;
1041                   }
1042                 break;
1043
1044         default:
1045                 /*
1046                  * Returns RLM_MODULE_FOO, and we want to return PW_FOO
1047                  */
1048                 rcode = process_reply(eap_session, tls_session, request, fake->reply);
1049                 switch (rcode) {
1050                 case RLM_MODULE_REJECT:
1051                         code = PW_CODE_ACCESS_REJECT;
1052                         break;
1053
1054                 case RLM_MODULE_HANDLED:
1055                         code = PW_CODE_ACCESS_CHALLENGE;
1056                         break;
1057
1058                 case RLM_MODULE_OK:
1059                         code = PW_CODE_ACCESS_ACCEPT;
1060                         break;
1061
1062                 default:
1063                         code = PW_CODE_ACCESS_REJECT;
1064                         break;
1065                 }
1066                 break;
1067         }
1068
1069         talloc_free(fake);
1070
1071         return code;
1072 }
1073
1074 static PW_CODE eap_fast_crypto_binding(REQUEST *request, UNUSED eap_handler_t *eap_session,
1075                                        tls_session_t *tls_session, eap_tlv_crypto_binding_tlv_t *binding)
1076 {
1077         uint8_t                 cmac[sizeof(binding->compound_mac)];
1078         eap_fast_tunnel_t       *t = tls_session->opaque;
1079
1080         memcpy(cmac, binding->compound_mac, sizeof(cmac));
1081         memset(binding->compound_mac, 0, sizeof(binding->compound_mac));
1082
1083
1084         fr_hmac_sha1(binding->compound_mac, (uint8_t *)binding, sizeof(*binding), t->cmk, EAP_FAST_CMK_LEN);
1085         if (memcmp(binding->compound_mac, cmac, sizeof(cmac))) {
1086                 RDEBUG2("Crypto-Binding TLV mis-match");
1087                 return PW_CODE_ACCESS_REJECT;
1088         }
1089
1090         return PW_CODE_ACCESS_ACCEPT;
1091 }
1092
1093 static PW_CODE eap_fast_process_tlvs(REQUEST *request, eap_handler_t *eap_session,
1094                                      tls_session_t *tls_session, VALUE_PAIR *fast_vps)
1095 {
1096         eap_fast_tunnel_t               *t = (eap_fast_tunnel_t *) tls_session->opaque;
1097         VALUE_PAIR                      *vp;
1098         vp_cursor_t                     cursor;
1099         eap_tlv_crypto_binding_tlv_t    *binding = NULL;
1100
1101         for (vp = fr_cursor_init(&cursor, &fast_vps); vp; vp = fr_cursor_next(&cursor)) {
1102                 PW_CODE code = PW_CODE_ACCESS_REJECT;
1103                 char *value;
1104         DICT_ATTR * parent = dict_parent(vp->da->attr, vp->da->vendor);
1105
1106                 switch (parent->attr) {
1107                 case PW_EAP_FAST_TLV:
1108                         switch (vp->da->attr) {
1109                         case EAP_FAST_TLV_EAP_PAYLOAD:
1110                                 code = eap_fast_eap_payload(request, eap_session, tls_session, vp);
1111                                 if (code == PW_CODE_ACCESS_ACCEPT)
1112                                         t->stage = CRYPTOBIND_CHECK;
1113                                 break;
1114                         case EAP_FAST_TLV_RESULT:
1115                         case EAP_FAST_TLV_INTERMED_RESULT:
1116                                 code = PW_CODE_ACCESS_ACCEPT;
1117                                 t->stage = PROVISIONING;
1118                                 break;
1119                         default:
1120                                 value = vp_aprints_value(request->packet, vp, '"');
1121                                 RDEBUG2("ignoring unknown %s", value);
1122                                 talloc_free(value);
1123                                 continue;
1124                         }
1125                         break;
1126                 case EAP_FAST_TLV_CRYPTO_BINDING:
1127                         if (!binding) {
1128                                 binding = talloc_zero(request->packet, eap_tlv_crypto_binding_tlv_t);
1129                                 binding->tlv_type = htons(EAP_FAST_TLV_MANDATORY | EAP_FAST_TLV_CRYPTO_BINDING);
1130                                 binding->length = htons(sizeof(*binding) - 2 * sizeof(uint16_t));
1131                         }
1132                         /*
1133                          * fr_radius_encode_pair() does not work for structures
1134                          */
1135                         switch (vp->da->attr) {
1136                         case 1: /* PW_EAP_FAST_CRYPTO_BINDING_RESERVED */
1137                                 binding->reserved = vp->vp_integer;
1138                                 break;
1139                         case 2: /* PW_EAP_FAST_CRYPTO_BINDING_VERSION */
1140                                 binding->version = vp->vp_integer;
1141                                 break;
1142                         case 3: /* PW_EAP_FAST_CRYPTO_BINDING_RECV_VERSION */
1143                                 binding->received_version = vp->vp_integer;
1144                                 break;
1145                         case 4: /* PW_EAP_FAST_CRYPTO_BINDING_SUB_TYPE */
1146                                 binding->subtype = vp->vp_integer;
1147                                 break;
1148                         case 5: /* PW_EAP_FAST_CRYPTO_BINDING_NONCE */
1149                                 memcpy(binding->nonce, vp->vp_octets, vp->vp_length);
1150                                 break;
1151                         case 6: /* PW_EAP_FAST_CRYPTO_BINDING_COMPOUND_MAC */
1152                                 memcpy(binding->compound_mac, vp->vp_octets, vp->vp_length);
1153                                 break;
1154                         }
1155                         continue;
1156                 case EAP_FAST_TLV_PAC:
1157                         switch (vp->da->attr) {
1158                         case PAC_INFO_PAC_ACK:
1159                                 if (vp->vp_integer == EAP_FAST_TLV_RESULT_SUCCESS) {
1160                                         code = PW_CODE_ACCESS_ACCEPT;
1161                                         t->pac.expires = UINT32_MAX;
1162                                         t->pac.expired = false;
1163                                         t->stage = COMPLETE;
1164                                 }
1165                                 break;
1166                         case PAC_INFO_PAC_TYPE:
1167                                 if (vp->vp_integer != PAC_TYPE_TUNNEL) {
1168                                         RDEBUG("only able to serve Tunnel PAC's, ignoring request");
1169                                         continue;
1170                                 }
1171                                 t->pac.send = true;
1172                                 continue;
1173                         default:
1174                                 value = vp_aprints_value(request->packet, vp, '"');
1175                                 RDEBUG2("ignoring unknown EAP-FAST-PAC-TLV %s", value);
1176                                 talloc_free(value);
1177                                 continue;
1178                         }
1179                         break;
1180                 default:
1181                         value = vp_aprints_value(request->packet, vp, '"');
1182                         RDEBUG2("ignoring non-EAP-FAST TLV %s", value);
1183                         talloc_free(value);
1184                         continue;
1185                 }
1186
1187                 if (code == PW_CODE_ACCESS_REJECT)
1188                         return PW_CODE_ACCESS_REJECT;
1189         }
1190
1191         if (binding) {
1192                 PW_CODE code = eap_fast_crypto_binding(request, eap_session, tls_session, binding);
1193                 if (code == PW_CODE_ACCESS_ACCEPT)
1194                         t->stage = PROVISIONING;
1195         }
1196
1197         return PW_CODE_ACCESS_ACCEPT;
1198 }
1199
1200
1201 /*
1202  * Process the inner tunnel data
1203  */
1204 PW_CODE eap_fast_process(eap_handler_t *eap_session, tls_session_t *tls_session)
1205 {
1206         PW_CODE                 code;
1207         VALUE_PAIR              *fast_vps;
1208         uint8_t                 const *data;
1209         size_t                  data_len;
1210         eap_fast_tunnel_t               *t;
1211         REQUEST                 *request = eap_session->request;
1212
1213         /*
1214          * Just look at the buffer directly, without doing
1215          * record_to_buff.
1216          */
1217         data_len = tls_session->clean_out.used;
1218         tls_session->clean_out.used = 0;
1219         data = tls_session->clean_out.data;
1220
1221         t = (eap_fast_tunnel_t *) tls_session->opaque;
1222
1223         /*
1224          * See if the tunneled data is well formed.
1225          */
1226         if (!eap_fast_verify(request, tls_session, data, data_len)) return RLM_MODULE_REJECT;
1227
1228         if (t->stage == TLS_SESSION_HANDSHAKE) {
1229                 rad_assert(t->mode == EAP_FAST_UNKNOWN);
1230
1231                 char buf[256];
1232                 if (strstr(SSL_CIPHER_description(SSL_get_current_cipher(tls_session->ssl),
1233                                                   buf, sizeof(buf)), "Au=None")) {
1234                         /* FIXME enforce MSCHAPv2 - RFC 5422 section 3.2.2 */
1235                         RDEBUG2("Using anonymous provisioning");
1236                         t->mode = EAP_FAST_PROVISIONING_ANON;
1237                         t->pac.send = true;
1238                 } else {
1239                         if (SSL_session_reused(tls_session->ssl)) {
1240                                 RDEBUG("Session Resumed from PAC");
1241                                 t->mode = EAP_FAST_NORMAL_AUTH;
1242                         } else {
1243                                 RDEBUG2("Using authenticated provisioning");
1244                                 t->mode = EAP_FAST_PROVISIONING_AUTH;
1245                         }
1246
1247                         if (!t->pac.expires || t->pac.expired || t->pac.expires - time(NULL) < t->pac_lifetime * 0.6)
1248                                 t->pac.send = true;
1249                 }
1250
1251                 eap_fast_init_keys(request, tls_session);
1252
1253                 eap_fast_send_identity_request(request, tls_session, eap_session);
1254
1255                 t->stage = AUTHENTICATION;
1256                 return PW_CODE_ACCESS_CHALLENGE;
1257         }
1258
1259         fast_vps = eap_fast_fast2vp(request, tls_session->ssl, data, data_len, NULL, NULL);
1260
1261         RDEBUG("Got Tunneled FAST TLVs");
1262         rdebug_pair_list(L_DBG_LVL_1, request, fast_vps, NULL);
1263
1264         code = eap_fast_process_tlvs(request, eap_session, tls_session, fast_vps);
1265
1266         fr_pair_list_free(&fast_vps);
1267
1268         if (code == RLM_MODULE_REJECT) return RLM_MODULE_REJECT;
1269
1270         switch (t->stage) {
1271         case AUTHENTICATION:
1272                 code = PW_CODE_ACCESS_CHALLENGE;
1273                 break;
1274         case CRYPTOBIND_CHECK:
1275         {
1276                 if (t->mode != EAP_FAST_PROVISIONING_ANON && !t->pac.send)
1277                         t->result_final = true;
1278
1279                 eap_fast_append_result(tls_session, code);
1280
1281                 eap_fast_update_icmk(request, tls_session, (uint8_t *)&t->isk);
1282                 eap_fast_append_crypto_binding(request, tls_session);
1283
1284                 code = PW_CODE_ACCESS_CHALLENGE;
1285                 break;
1286         }
1287         case PROVISIONING:
1288                 t->result_final = true;
1289
1290                 eap_fast_append_result(tls_session, code);
1291
1292                 if (code == RLM_MODULE_REJECT)
1293                         break;
1294
1295                 if (t->pac.send) {
1296                         RDEBUG("Peer requires new PAC");
1297                         eap_fast_send_pac_tunnel(request, tls_session);
1298                         code = PW_CODE_ACCESS_CHALLENGE;
1299                         break;
1300                 }
1301
1302                 t->stage = COMPLETE;
1303                 /* fallthrough */
1304         case COMPLETE:
1305                 /*
1306                  * RFC 5422 section 3.5 - Network Access after EAP-FAST Provisioning
1307                  */
1308                 if ((t->pac.type && t->pac.expired) || t->mode == EAP_FAST_PROVISIONING_ANON) {
1309                         RDEBUG("Rejecting expired PAC or unauthenticated provisioning");
1310                         code = RLM_MODULE_REJECT;
1311                         break;
1312                 }
1313
1314                 /*
1315                  * eap_tls_gen_mppe_keys() is unsuitable for EAP-FAST as Cisco decided
1316                  * it would be a great idea to flip the recv/send keys around
1317                  */
1318                 #define EAPTLS_MPPE_KEY_LEN 32
1319                 eap_add_reply(request, "MS-MPPE-Recv-Key", t->msk, EAPTLS_MPPE_KEY_LEN);
1320                 eap_add_reply(request, "MS-MPPE-Send-Key", &t->msk[EAPTLS_MPPE_KEY_LEN], EAPTLS_MPPE_KEY_LEN);
1321                 eap_add_reply(request, "EAP-MSK", t->msk, EAP_FAST_KEY_LEN);
1322                 eap_add_reply(request, "EAP-EMSK", t->emsk, EAP_EMSK_LEN);
1323
1324                 break;
1325         default:
1326                 RERROR("no idea! %d", t->stage);
1327                 code = RLM_MODULE_REJECT;
1328         }
1329
1330         return code;
1331 }