src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c

   1 /*
   2  * eap_fast.c  contains the interfaces that are called from the main handler
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  *   Copyright 2016 Alan DeKok <aland@freeradius.org>
  21  *   Copyright 2016 The FreeRADIUS server project
  22  */
  23
  24 RCSID("$Id$")
  25
  26 #include "eap_fast.h"
  27 #include "eap_fast_crypto.h"
  28 #include <freeradius-devel/sha1.h>
  29 #include <openssl/ssl.h>
  30 #include <openssl/rand.h>
  31
  32 #define RANDFILL(x) do { rad_assert(sizeof(x) % sizeof(uint32_t) == 0); for (size_t i = 0; i < sizeof(x); i += sizeof(uint32_t)) *((uint32_t *)&x[i]) = fr_rand(); } while(0)
  33
  34 /*
  35  * Copyright (c) 2002-2016, Jouni Malinen <j@w1.fi> and contributors
  36  * All Rights Reserved.
  37  *
  38  * These programs are licensed under the BSD license (the one with
  39  * advertisement clause removed).
  40  *
  41  * this function shamelessly stolen from from hostap:src/crypto/tls_openssl.c
  42  */
  43 static int openssl_get_keyblock_size(REQUEST *request, SSL *ssl)
  44 {
  45         const EVP_CIPHER *c;
  46         const EVP_MD *h;
  47 #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
  48         int md_size;
  49
  50         if (ssl->enc_read_ctx == NULL || ssl->enc_read_ctx->cipher == NULL ||
  51             ssl->read_hash == NULL)
  52                 return -1;
  53
  54         c = ssl->enc_read_ctx->cipher;
  55         h = EVP_MD_CTX_md(ssl->read_hash);
  56         if (h)
  57                 md_size = EVP_MD_size(h);
  58         else if (ssl->s3)
  59                 md_size = ssl->s3->tmp.new_mac_secret_size;
  60         else
  61                 return -1;
  62
  63         RDEBUG2("OpenSSL: keyblock size: key_len=%d MD_size=%d "
  64                    "IV_len=%d", EVP_CIPHER_key_length(c), md_size,
  65                    EVP_CIPHER_iv_length(c));
  66         return 2 * (EVP_CIPHER_key_length(c) +
  67                     md_size +
  68                     EVP_CIPHER_iv_length(c));
  69 #else
  70         const SSL_CIPHER *ssl_cipher;
  71         int cipher, digest;
  72
  73         ssl_cipher = SSL_get_current_cipher(ssl);
  74         if (!ssl_cipher)
  75                 return -1;
  76         cipher = SSL_CIPHER_get_cipher_nid(ssl_cipher);
  77         digest = SSL_CIPHER_get_digest_nid(ssl_cipher);
  78         RDEBUG2("OpenSSL: cipher nid %d digest nid %d", cipher, digest);
  79         if (cipher < 0 || digest < 0)
  80                 return -1;
  81         c = EVP_get_cipherbynid(cipher);
  82         h = EVP_get_digestbynid(digest);
  83         if (!c || !h)
  84                 return -1;
  85
  86         RDEBUG2("OpenSSL: keyblock size: key_len=%d MD_size=%d IV_len=%d",
  87                    EVP_CIPHER_key_length(c), EVP_MD_size(h),
  88                    EVP_CIPHER_iv_length(c));
  89         return 2 * (EVP_CIPHER_key_length(c) + EVP_MD_size(h) +
  90                     EVP_CIPHER_iv_length(c));
  91 #endif
  92 }
  93
  94 /**
  95  * RFC 4851 section 5.1 - EAP-FAST Authentication Phase 1: Key Derivations
  96  */
  97 static void eap_fast_init_keys(REQUEST *request, tls_session_t *tls_session)
  98 {
  99         eap_fast_tunnel_t *t = tls_session->opaque;
 100         uint8_t *buf;
 101         uint8_t *scratch;
 102         size_t ksize;
 103
 104         RDEBUG2("Deriving EAP-FAST keys");
 105
 106         rad_assert(t->simck == NULL);
 107
 108         ksize = openssl_get_keyblock_size(request, tls_session->ssl);
 109         rad_assert(ksize > 0);
 110         buf = talloc_size(request, ksize + sizeof(*t->keyblock));
 111         scratch = talloc_size(request, ksize + sizeof(*t->keyblock));
 112
 113         t->keyblock = talloc(request, eap_fast_keyblock_t);
 114
 115         eap_fast_tls_gen_challenge(tls_session->ssl, buf, scratch, ksize + sizeof(*t->keyblock), "key expansion");
 116         memcpy(t->keyblock, &buf[ksize], sizeof(*t->keyblock));
 117         memset(buf, 0, ksize + sizeof(*t->keyblock));
 118
 119         t->simck = talloc_size(request, EAP_FAST_SIMCK_LEN);
 120         memcpy(t->simck, t->keyblock, EAP_FAST_SKS_LEN);        /* S-IMCK[0] = session_key_seed */
 121
 122         t->cmk = talloc_size(request, EAP_FAST_CMK_LEN);        /* note that CMK[0] is not defined */
 123         t->imckc = 0;
 124
 125         talloc_free(buf);
 126         talloc_free(scratch);
 127 }
 128
 129 /**
 130  * RFC 4851 section 5.2 - Intermediate Compound Key Derivations
 131  */
 132 static void eap_fast_update_icmk(REQUEST *request, tls_session_t *tls_session, uint8_t *msk)
 133 {
 134         eap_fast_tunnel_t *t = tls_session->opaque;
 135         uint8_t imck[EAP_FAST_SIMCK_LEN + EAP_FAST_CMK_LEN];
 136
 137         RDEBUG2("Updating ICMK");
 138
 139         T_PRF(t->simck, EAP_FAST_SIMCK_LEN, "Inner Methods Compound Keys", msk, 32, imck, sizeof(imck));
 140
 141         memcpy(t->simck, imck, EAP_FAST_SIMCK_LEN);
 142         memcpy(t->cmk, &imck[EAP_FAST_SIMCK_LEN], EAP_FAST_CMK_LEN);
 143         t->imckc++;
 144
 145         /*
 146          * Calculate MSK/EMSK at the same time as they are coupled to ICMK
 147          *
 148          * RFC 4851 section 5.4 - EAP Master Session Key Generation
 149          */
 150         t->msk = talloc_size(request, EAP_FAST_KEY_LEN);
 151         T_PRF(t->simck, EAP_FAST_SIMCK_LEN, "Session Key Generating Function", NULL, 0, t->msk, EAP_FAST_KEY_LEN);
 152
 153         t->emsk = talloc_size(request, EAP_EMSK_LEN);
 154         T_PRF(t->simck, EAP_FAST_SIMCK_LEN, "Extended Session Key Generating Function", NULL, 0, t->emsk, EAP_EMSK_LEN);
 155 }
 156
 157 void eap_fast_tlv_append(tls_session_t *tls_session, int tlv, bool mandatory, int length, const void *data)
 158 {
 159         uint16_t hdr[2];
 160
 161         hdr[0] = (mandatory) ? htons(tlv | EAP_FAST_TLV_MANDATORY) : htons(tlv);
 162         hdr[1] = htons(length);
 163
 164         tls_session->record_plus(&tls_session->clean_in, &hdr, 4);
 165         tls_session->record_plus(&tls_session->clean_in, data, length);
 166 }
 167
 168 static void eap_fast_send_error(tls_session_t *tls_session, int error)
 169 {
 170         uint32_t value;
 171         value = htonl(error);
 172
 173         eap_fast_tlv_append(tls_session, EAP_FAST_TLV_ERROR, true, sizeof(value), &value);
 174 }
 175
 176 static void eap_fast_append_result(tls_session_t *tls_session, PW_CODE code)
 177 {
 178         eap_fast_tunnel_t *t = (eap_fast_tunnel_t *) tls_session->opaque;
 179
 180         int type = (t->result_final)
 181                         ? EAP_FAST_TLV_RESULT
 182                         : EAP_FAST_TLV_INTERMED_RESULT;
 183
 184         uint16_t state = (code == PW_CODE_ACCESS_REJECT)
 185                         ? EAP_FAST_TLV_RESULT_FAILURE
 186                         : EAP_FAST_TLV_RESULT_SUCCESS;
 187         state = htons(state);
 188
 189         eap_fast_tlv_append(tls_session, type, true, sizeof(state), &state);
 190 }
 191
 192 static void eap_fast_send_identity_request(REQUEST *request, tls_session_t *tls_session, eap_handler_t *eap_session)
 193 {
 194         eap_packet_raw_t eap_packet;
 195
 196         RDEBUG("Sending EAP-Identity");
 197
 198         eap_packet.code = PW_EAP_REQUEST;
 199         eap_packet.id = eap_session->eap_ds->response->id + 1;
 200         eap_packet.length[0] = 0;
 201         eap_packet.length[1] = EAP_HEADER_LEN + 1;
 202         eap_packet.data[0] = PW_EAP_IDENTITY;
 203
 204         eap_fast_tlv_append(tls_session, EAP_FAST_TLV_EAP_PAYLOAD, true, sizeof(eap_packet), &eap_packet);
 205 }
 206
 207 static void eap_fast_send_pac_tunnel(REQUEST *request, tls_session_t *tls_session)
 208 {
 209         eap_fast_tunnel_t                       *t = tls_session->opaque;
 210         eap_fast_pac_t                          pac;
 211         eap_fast_attr_pac_opaque_plaintext_t    opaque_plaintext;
 212         int                                     alen, dlen;
 213
 214         memset(&pac, 0, sizeof(pac));
 215         memset(&opaque_plaintext, 0, sizeof(opaque_plaintext));
 216
 217         RDEBUG("Sending Tunnel PAC");
 218
 219         pac.key.hdr.type = htons(EAP_FAST_TLV_MANDATORY | PAC_INFO_PAC_KEY);
 220         pac.key.hdr.length = htons(sizeof(pac.key.data));
 221         rad_assert(sizeof(pac.key.data) % sizeof(uint32_t) == 0);
 222         RANDFILL(pac.key.data);
 223
 224         pac.info.lifetime.hdr.type = htons(PAC_INFO_PAC_LIFETIME);
 225         pac.info.lifetime.hdr.length = htons(sizeof(pac.info.lifetime.data));
 226         pac.info.lifetime.data = htonl(time(NULL) + t->pac_lifetime);
 227
 228         pac.info.a_id.hdr.type = htons(EAP_FAST_TLV_MANDATORY | PAC_INFO_A_ID);
 229         pac.info.a_id.hdr.length = htons(sizeof(pac.info.a_id.data));
 230         memcpy(pac.info.a_id.data, t->a_id, sizeof(pac.info.a_id.data));
 231
 232         pac.info.a_id_info.hdr.type = htons(PAC_INFO_A_ID_INFO);
 233         pac.info.a_id_info.hdr.length = htons(sizeof(pac.info.a_id_info.data));
 234         #define MIN(a,b) (((a)>(b)) ? (b) : (a))
 235         alen = MIN(talloc_array_length(t->authority_identity) - 1, sizeof(pac.info.a_id_info.data));
 236         memcpy(pac.info.a_id_info.data, t->authority_identity, alen);
 237
 238         pac.info.type.hdr.type = htons(EAP_FAST_TLV_MANDATORY | PAC_INFO_PAC_TYPE);
 239         pac.info.type.hdr.length = htons(sizeof(pac.info.type.data));
 240         pac.info.type.data = htons(PAC_TYPE_TUNNEL);
 241
 242         pac.info.hdr.type = htons(EAP_FAST_TLV_MANDATORY | PAC_INFO_PAC_INFO);
 243         pac.info.hdr.length = htons(sizeof(pac.info.lifetime)
 244                                 + sizeof(pac.info.a_id)
 245                                 + sizeof(pac.info.a_id_info)
 246                                 + sizeof(pac.info.type));
 247
 248         memcpy(&opaque_plaintext.type, &pac.info.type, sizeof(opaque_plaintext.type));
 249         memcpy(&opaque_plaintext.lifetime, &pac.info.lifetime, sizeof(opaque_plaintext.lifetime));
 250         memcpy(&opaque_plaintext.key, &pac.key, sizeof(opaque_plaintext.key));
 251
 252
 253         rad_assert(PAC_A_ID_LENGTH <= EVP_GCM_TLS_TAG_LEN);
 254         memcpy(pac.opaque.aad, t->a_id, PAC_A_ID_LENGTH);
 255         rad_assert(RAND_bytes(pac.opaque.iv, sizeof(pac.opaque.iv)) != 0);
 256         dlen = eap_fast_encrypt((unsigned const char *)&opaque_plaintext, sizeof(opaque_plaintext),
 257                                     t->a_id, PAC_A_ID_LENGTH, t->pac_opaque_key, pac.opaque.iv,
 258                                     pac.opaque.data, pac.opaque.tag);
 259
 260         pac.opaque.hdr.type = htons(EAP_FAST_TLV_MANDATORY | PAC_INFO_PAC_OPAQUE);
 261         pac.opaque.hdr.length = htons(sizeof(pac.opaque) - sizeof(pac.opaque.hdr) - sizeof(pac.opaque.data) + dlen);
 262
 263         eap_fast_tlv_append(tls_session, EAP_FAST_TLV_MANDATORY | EAP_FAST_TLV_PAC, true,
 264                             sizeof(pac) - sizeof(pac.opaque.data) + dlen, &pac);
 265 }
 266
 267 static void eap_fast_append_crypto_binding(REQUEST *request, tls_session_t *tls_session)
 268 {
 269         eap_fast_tunnel_t               *t = tls_session->opaque;
 270         eap_tlv_crypto_binding_tlv_t    binding;
 271     memset(&binding, 0, sizeof(eap_tlv_crypto_binding_tlv_t));
 272         const int                       len = sizeof(binding) - (&binding.reserved - (uint8_t *)&binding);
 273
 274         RDEBUG("Sending Cryptobinding");
 275
 276         binding.tlv_type = htons(EAP_FAST_TLV_MANDATORY | EAP_FAST_TLV_CRYPTO_BINDING);
 277         binding.length = htons(len);
 278         binding.version = EAP_FAST_VERSION;
 279         binding.received_version = EAP_FAST_VERSION;    /* FIXME use the clients value */
 280         binding.subtype = EAP_FAST_TLV_CRYPTO_BINDING_SUBTYPE_REQUEST;
 281
 282         rad_assert(sizeof(binding.nonce) % sizeof(uint32_t) == 0);
 283         RANDFILL(binding.nonce);
 284         binding.nonce[sizeof(binding.nonce) - 1] &= ~0x01; /* RFC 4851 section 4.2.8 */
 285
 286
 287         fr_hmac_sha1(binding.compound_mac, (uint8_t *)&binding, sizeof(binding), t->cmk, EAP_FAST_CMK_LEN);
 288
 289         eap_fast_tlv_append(tls_session, EAP_FAST_TLV_CRYPTO_BINDING, true, len, &binding.reserved);
 290 }
 291
 292 static int eap_fast_verify(REQUEST *request, tls_session_t *tls_session, uint8_t const *data, unsigned int data_len)
 293 {
 294         uint16_t attr;
 295         uint16_t length;
 296         unsigned int remaining = data_len;
 297         int     total = 0;
 298         int     num[EAP_FAST_TLV_MAX] = {0};
 299         eap_fast_tunnel_t *t = (eap_fast_tunnel_t *) tls_session->opaque;
 300         uint32_t present = 0;
 301
 302         rad_assert(sizeof(present) * 8 > EAP_FAST_TLV_MAX);
 303
 304         while (remaining > 0) {
 305                 if (remaining < 4) {
 306                         RDEBUG2("EAP-FAST TLV is too small (%u) to contain a EAP-FAST TLV header", remaining);
 307                         return 0;
 308                 }
 309
 310                 memcpy(&attr, data, sizeof(attr));
 311                 attr = ntohs(attr) & EAP_FAST_TLV_TYPE;
 312
 313                 switch (attr) {
 314                 case EAP_FAST_TLV_RESULT:
 315                 case EAP_FAST_TLV_NAK:
 316                 case EAP_FAST_TLV_ERROR:
 317                 case EAP_FAST_TLV_VENDOR_SPECIFIC:
 318                 case EAP_FAST_TLV_EAP_PAYLOAD:
 319                 case EAP_FAST_TLV_INTERMED_RESULT:
 320                 case EAP_FAST_TLV_PAC:
 321                 case EAP_FAST_TLV_CRYPTO_BINDING:
 322                         num[attr]++;
 323                         present |= 1 << attr;
 324
 325                         if (num[EAP_FAST_TLV_EAP_PAYLOAD] > 1) {
 326                                 RDEBUG("Too many EAP-Payload TLVs");
 327 unexpected:
 328                                 for (int i = 0; i < EAP_FAST_TLV_MAX; i++)
 329                                         if (present & (1 << i))
 330                                                 RDEBUG(" - attribute %d is present", i);
 331                                 eap_fast_send_error(tls_session, EAP_FAST_ERR_UNEXPECTED_TLV);
 332                                 return 0;
 333                         }
 334
 335                         if (num[EAP_FAST_TLV_INTERMED_RESULT] > 1) {
 336                                 RDEBUG("Too many Intermediate-Result TLVs");
 337                                 goto unexpected;
 338                         }
 339                         break;
 340                 default:
 341                         if ((data[0] & 0x80) != 0) {
 342                                 RDEBUG("Unknown mandatory TLV %02x", attr);
 343                                 goto unexpected;
 344                         }
 345
 346                         num[0]++;
 347                 }
 348
 349                 total++;
 350
 351                 memcpy(&length, data + 2, sizeof(length));
 352                 length = ntohs(length);
 353
 354                 data += 4;
 355                 remaining -= 4;
 356
 357                 if (length > remaining) {
 358                         RDEBUG2("EAP-FAST TLV %u is longer than room remaining in the packet (%u > %u).", attr,
 359                                 length, remaining);
 360                         return 0;
 361                 }
 362
 363                 /*
 364                  * If the rest of the TLVs are larger than
 365                  * this attribute, continue.
 366                  *
 367                  * Otherwise, if the attribute over-flows the end
 368                  * of the TLCs, die.
 369                  */
 370                 if (remaining < length) {
 371                         RDEBUG2("EAP-FAST TLV overflows packet!");
 372                         return 0;
 373                 }
 374
 375                 /*
 376                  * If there's an error, we bail out of the
 377                  * authentication process before allocating
 378                  * memory.
 379                  */
 380                 if ((attr == EAP_FAST_TLV_INTERMED_RESULT) || (attr == EAP_FAST_TLV_RESULT)) {
 381                         uint16_t status;
 382
 383                         if (length < 2) {
 384                                 RDEBUG("EAP-FAST TLV %u is too short.  Expected 2, got %d.", attr, length);
 385                                 return 0;
 386                         }
 387
 388                         memcpy(&status, data, 2);
 389                         status = ntohs(status);
 390
 391                         if (status == EAP_FAST_TLV_RESULT_FAILURE) {
 392                                 RDEBUG("EAP-FAST TLV %u indicates failure.  Rejecting request.", attr);
 393                                 return 0;
 394                         }
 395
 396                         if (status != EAP_FAST_TLV_RESULT_SUCCESS) {
 397                                 RDEBUG("EAP-FAST TLV %u contains unknown value.  Rejecting request.", attr);
 398                                 goto unexpected;
 399                         }
 400                 }
 401
 402                 /*
 403                  * remaining > length, continue.
 404                  */
 405                 remaining -= length;
 406                 data += length;
 407         }
 408
 409         /*
 410          * Check if the peer mixed & matched TLVs.
 411          */
 412         if ((num[EAP_FAST_TLV_NAK] > 0) && (num[EAP_FAST_TLV_NAK] != total)) {
 413                 RDEBUG("NAK TLV sent with non-NAK TLVs.  Rejecting request.");
 414                 goto unexpected;
 415         }
 416
 417         if (num[EAP_FAST_TLV_INTERMED_RESULT] > 0 && num[EAP_FAST_TLV_RESULT]) {
 418                 RDEBUG("NAK TLV sent with non-NAK TLVs.  Rejecting request.");
 419                 goto unexpected;
 420         }
 421
 422         /*
 423          * Check mandatory or not mandatory TLVs.
 424          */
 425         switch (t->stage) {
 426         case TLS_SESSION_HANDSHAKE:
 427                 if (present) {
 428                         RDEBUG("Unexpected TLVs in TLS Session Handshake stage");
 429                         goto unexpected;
 430                 }
 431                 break;
 432         case AUTHENTICATION:
 433                 if (present != 1 << EAP_FAST_TLV_EAP_PAYLOAD) {
 434                         RDEBUG("Unexpected TLVs in authentication stage");
 435                         goto unexpected;
 436                 }
 437                 break;
 438         case CRYPTOBIND_CHECK:
 439         {
 440                 uint32_t bits = (t->result_final)
 441                                 ? 1 << EAP_FAST_TLV_RESULT
 442                                 : 1 << EAP_FAST_TLV_INTERMED_RESULT;
 443                 if (present & ~(bits | (1 << EAP_FAST_TLV_CRYPTO_BINDING) | (1 << EAP_FAST_TLV_PAC))) {
 444                         RDEBUG("Unexpected TLVs in cryptobind checking stage");
 445                         goto unexpected;
 446                 }
 447                 break;
 448         }
 449         case PROVISIONING:
 450                 if (present & ~((1 << EAP_FAST_TLV_PAC) | (1 << EAP_FAST_TLV_RESULT))) {
 451                         RDEBUG("Unexpected TLVs in provisioning stage");
 452                         goto unexpected;
 453                 }
 454                 break;
 455         case COMPLETE:
 456                 if (present) {
 457                         RDEBUG("Unexpected TLVs in complete stage");
 458                         goto unexpected;
 459                 }
 460                 break;
 461         default:
 462                 RDEBUG("Unexpected stage %d", t->stage);
 463                 return 0;
 464         }
 465
 466         /*
 467          * We got this far.  It looks OK.
 468          */
 469         return 1;
 470 }
 471
 472 static ssize_t eap_fast_decode_vp(TALLOC_CTX *request, DICT_ATTR const *parent,
 473                                     uint8_t const *data, size_t const attr_len, VALUE_PAIR **out)
 474 {
 475         int8_t                  tag = TAG_NONE;
 476         VALUE_PAIR              *vp;
 477         uint8_t const           *p = data;
 478
 479         /*
 480          *      FIXME: Attrlen can be larger than 253 for extended attrs!
 481          */
 482         if (!parent || !out ) {
 483                 RERROR("eap_fast_decode_vp: Invalid arguments");
 484                 return -1;
 485         }
 486
 487         /*
 488          *      Silently ignore zero-length attributes.
 489          */
 490         if (attr_len == 0) return 0;
 491
 492         /*
 493          *      And now that we've verified the basic type
 494          *      information, decode the actual p.
 495          */
 496         vp = fr_pair_afrom_da(request, parent);
 497         if (!vp) return -1;
 498
 499         vp->vp_length = attr_len;
 500         vp->tag = tag;
 501
 502         switch (parent->type) {
 503         case PW_TYPE_STRING:
 504                 fr_pair_value_bstrncpy(vp, p, attr_len);
 505                 break;
 506
 507         case PW_TYPE_OCTETS:
 508                 fr_pair_value_memcpy(vp, p, attr_len);
 509                 break;
 510
 511         case PW_TYPE_ABINARY:
 512                 if (vp->vp_length > sizeof(vp->vp_filter)) {
 513                         vp->vp_length = sizeof(vp->vp_filter);
 514                 }
 515                 memcpy(vp->vp_filter, p, vp->vp_length);
 516                 break;
 517
 518         case PW_TYPE_BYTE:
 519                 vp->vp_byte = p[0];
 520                 break;
 521
 522         case PW_TYPE_SHORT:
 523                 vp->vp_short = (p[0] << 8) | p[1];
 524                 break;
 525
 526         case PW_TYPE_INTEGER:
 527                 memcpy(&vp->vp_integer, p, 4);
 528                 vp->vp_integer = ntohl(vp->vp_integer);
 529                 break;
 530
 531         case PW_TYPE_INTEGER64:
 532                 memcpy(&vp->vp_integer64, p, 8);
 533                 vp->vp_integer64 = ntohll(vp->vp_integer64);
 534                 break;
 535
 536         case PW_TYPE_DATE:
 537                 memcpy(&vp->vp_date, p, 4);
 538                 vp->vp_date = ntohl(vp->vp_date);
 539                 break;
 540
 541         case PW_TYPE_ETHERNET:
 542                 memcpy(vp->vp_ether, p, 6);
 543                 break;
 544
 545         case PW_TYPE_IPV4_ADDR:
 546                 memcpy(&vp->vp_ipaddr, p, 4);
 547                 break;
 548
 549         case PW_TYPE_IFID:
 550                 memcpy(vp->vp_ifid, p, 8);
 551                 break;
 552
 553         case PW_TYPE_IPV6_ADDR:
 554                 memcpy(&vp->vp_ipv6addr, p, 16);
 555                 break;
 556
 557         case PW_TYPE_IPV6_PREFIX:
 558                 /*
 559                  *      FIXME: double-check that
 560                  *      (vp->vp_octets[1] >> 3) matches vp->vp_length + 2
 561                  */
 562                 memcpy(vp->vp_ipv6prefix, p, vp->vp_length);
 563                 if (vp->vp_length < 18) {
 564                         memset(((uint8_t *)vp->vp_ipv6prefix) + vp->vp_length, 0,
 565                                18 - vp->vp_length);
 566                 }
 567                 break;
 568
 569         case PW_TYPE_IPV4_PREFIX:
 570                 /* FIXME: do the same double-check as for IPv6Prefix */
 571                 memcpy(vp->vp_ipv4prefix, p, vp->vp_length);
 572
 573                 /*
 574                  *      /32 means "keep all bits".  Otherwise, mask
 575                  *      them out.
 576                  */
 577                 if ((p[1] & 0x3f) > 32) {
 578                         uint32_t addr, mask;
 579
 580                         memcpy(&addr, vp->vp_octets + 2, sizeof(addr));
 581                         mask = 1;
 582                         mask <<= (32 - (p[1] & 0x3f));
 583                         mask--;
 584                         mask = ~mask;
 585                         mask = htonl(mask);
 586                         addr &= mask;
 587                         memcpy(vp->vp_ipv4prefix + 2, &addr, sizeof(addr));
 588                 }
 589                 break;
 590
 591         case PW_TYPE_SIGNED:    /* overloaded with vp_integer */
 592                 memcpy(&vp->vp_integer, p, 4);
 593                 vp->vp_integer = ntohl(vp->vp_integer);
 594                 break;
 595
 596         default:
 597                 RERROR("eap_fast_decode_vp: type %d Internal sanity check  %d ", parent->type, __LINE__);
 598                 fr_pair_list_free(&vp);
 599                 return -1;
 600         }
 601         vp->type = VT_DATA;
 602     *out = vp;
 603         return attr_len;
 604 }
 605
 606
 607 VALUE_PAIR *eap_fast_fast2vp(REQUEST *request, SSL *ssl, uint8_t const *data, size_t data_len,
 608                              DICT_ATTR const *fast_da, vp_cursor_t *out)
 609 {
 610         uint16_t        attr;
 611         uint16_t        length;
 612         size_t          data_left = data_len;
 613         VALUE_PAIR      *first = NULL;
 614         VALUE_PAIR      *vp = NULL;
 615         DICT_ATTR const *da;
 616
 617         if (!fast_da)
 618                 fast_da = dict_attrbyvalue(PW_FREERADIUS_EAP_FAST_TLV, VENDORPEC_FREERADIUS);
 619         rad_assert(fast_da != NULL);
 620
 621         if (!out) {
 622                 out = talloc(request, vp_cursor_t);
 623                 rad_assert(out != NULL);
 624                 fr_cursor_init(out, &first);
 625         }
 626
 627         /*
 628          * Decode the TLVs
 629          */
 630         while (data_left > 0) {
 631                 ssize_t decoded;
 632
 633                 /* FIXME do something with mandatory */
 634
 635                 memcpy(&attr, data, sizeof(attr));
 636                 attr = ntohs(attr) & EAP_FAST_TLV_TYPE;
 637
 638                 memcpy(&length, data + 2, sizeof(length));
 639                 length = ntohs(length);
 640
 641                 data += 4;
 642                 data_left -= 4;
 643
 644                 /*
 645                  * Look up the TLV.
 646                  *
 647                  * For now, if it doesn't exist, ignore it.
 648                  */
 649                 da = dict_attrbyparent(fast_da, attr, fast_da->vendor);
 650                 if (!da) {
 651                         RDEBUG("eap_fast_fast2vp: no sub attribute found %s attr: %u vendor: %u",
 652                                         fast_da->name, attr, fast_da->vendor);
 653                         goto next_attr;
 654                 }
 655                 if (da->type == PW_TYPE_TLV) {
 656                         eap_fast_fast2vp(request, ssl, data, length, da, out);
 657                         goto next_attr;
 658                 }
 659                 decoded = eap_fast_decode_vp(request, da, data, length, &vp);
 660                 if (decoded < 0) {
 661                         RERROR("Failed decoding %s: %s", da->name, fr_strerror());
 662                         goto next_attr;
 663                 }
 664
 665                 fr_cursor_merge(out, vp);
 666
 667         next_attr:
 668                 while (fr_cursor_next(out)) {
 669                         /* nothing */
 670                 }
 671
 672                 data += length;
 673                 data_left -= length;
 674         }
 675
 676         /*
 677          * We got this far.  It looks OK.
 678          */
 679         return first;
 680 }
 681
 682
 683 static void eap_vp2fast(tls_session_t *tls_session, VALUE_PAIR *first)
 684 {
 685         VALUE_PAIR      *vp;
 686         vp_cursor_t     cursor;
 687
 688         (void) fr_cursor_init(&cursor, &first);
 689
 690         while ((vp = fr_cursor_next_by_num(&cursor, PW_EAP_MESSAGE, 0, TAG_ANY)) != NULL) {
 691                 eap_fast_tlv_append(tls_session, EAP_FAST_TLV_EAP_PAYLOAD, true, vp->vp_length, vp->vp_octets);
 692         }
 693 }
 694
 695 static void eapfast_copy_request_to_tunnel(REQUEST *request, REQUEST *fake) {
 696     VALUE_PAIR *copy, *vp;
 697     vp_cursor_t cursor;
 698
 699     for (vp = fr_cursor_init(&cursor, &request->packet->vps);
 700          vp;
 701          vp = fr_cursor_next(&cursor)) {
 702         /*
 703          *      The attribute is a server-side thingy,
 704          *      don't copy it.
 705          */
 706         if ((vp->da->attr > 255) && (((vp->da->attr >> 16) & 0xffff) == 0)) {
 707             continue;
 708         }
 709
 710         /*
 711          *      The outside attribute is already in the
 712          *      tunnel, don't copy it.
 713          *
 714          *      This works for BOTH attributes which
 715          *      are originally in the tunneled request,
 716          *      AND attributes which are copied there
 717          *      from below.
 718          */
 719         if (fr_pair_find_by_da(fake->packet->vps, vp->da, TAG_ANY)) continue;
 720
 721         /*
 722          *      Some attributes are handled specially.
 723          */
 724         if (!vp->da->vendor) switch (vp->da->attr) {
 725             /*
 726              *  NEVER copy Message-Authenticator,
 727              *  EAP-Message, or State.  They're
 728              *  only for outside of the tunnel.
 729              */
 730         case PW_USER_NAME:
 731         case PW_USER_PASSWORD:
 732         case PW_CHAP_PASSWORD:
 733         case PW_CHAP_CHALLENGE:
 734         case PW_PROXY_STATE:
 735         case PW_MESSAGE_AUTHENTICATOR:
 736         case PW_EAP_MESSAGE:
 737         case PW_STATE:
 738             continue;
 739
 740             /*
 741              *  By default, copy it over.
 742              */
 743         default:
 744             break;
 745         }
 746
 747         /*
 748          *      Don't copy from the head, we've already
 749          *      checked it.
 750          */
 751         copy = fr_pair_list_copy_by_num(fake->packet, vp, vp->da->attr, vp->da->vendor, TAG_ANY);
 752         fr_pair_add(&fake->packet->vps, copy);
 753     }
 754 }
 755
 756 /*
 757  * Use a reply packet to determine what to do.
 758  */
 759 static rlm_rcode_t CC_HINT(nonnull) process_reply( eap_handler_t *eap_session,
 760                                                   tls_session_t *tls_session,
 761                                                   REQUEST *request, RADIUS_PACKET *reply)
 762 {
 763         rlm_rcode_t                     rcode = RLM_MODULE_REJECT;
 764         VALUE_PAIR                      *vp, *tunnel_vps = NULL;
 765         vp_cursor_t                     cursor;
 766         vp_cursor_t                     to_tunnel;
 767
 768         eap_fast_tunnel_t       *t = tls_session->opaque;
 769
 770         rad_assert(eap_session->request == request);
 771
 772         /*
 773          * If the response packet was Access-Accept, then
 774          * we're OK.  If not, die horribly.
 775          *
 776          * FIXME: Take MS-CHAP2-Success attribute, and
 777          * tunnel it back to the client, to authenticate
 778          * ourselves to the client.
 779          *
 780          * FIXME: If we have an Access-Challenge, then
 781          * the Reply-Message is tunneled back to the client.
 782          *
 783          * FIXME: If we have an EAP-Message, then that message
 784          * must be tunneled back to the client.
 785          *
 786          * FIXME: If we have an Access-Challenge with a State
 787          * attribute, then do we tunnel that to the client, or
 788          * keep track of it ourselves?
 789          *
 790          * FIXME: EAP-Messages can only start with 'identity',
 791          * NOT 'eap start', so we should check for that....
 792          */
 793         switch (reply->code) {
 794         case PW_CODE_ACCESS_ACCEPT:
 795                 RDEBUG("Got tunneled Access-Accept");
 796                 fr_cursor_init(&to_tunnel, &tunnel_vps);
 797                 rcode = RLM_MODULE_OK;
 798
 799                 for (vp = fr_cursor_init(&cursor, &reply->vps); vp; vp = fr_cursor_next(&cursor)) {
 800                         if (vp->da->vendor != VENDORPEC_MICROSOFT) continue;
 801
 802                         /* FIXME must be a better way to capture/re-derive this later for ISK */
 803                         switch (vp->da->attr) {
 804                         case PW_MSCHAP_MPPE_SEND_KEY:
 805                                 memcpy(t->isk.mppe_send, vp->vp_octets, CHAP_VALUE_LENGTH);
 806                                 break;
 807
 808                         case PW_MSCHAP_MPPE_RECV_KEY:
 809                                 memcpy(t->isk.mppe_recv, vp->vp_octets, CHAP_VALUE_LENGTH);
 810                                 break;
 811
 812                         case PW_MSCHAP2_SUCCESS:
 813                                 RDEBUG("Got %s, tunneling it to the client in a challenge", vp->da->name);
 814                                 rcode = RLM_MODULE_HANDLED;
 815                                 if (t->use_tunneled_reply) {
 816                                         t->authenticated = true;
 817                                         /*
 818                                          *      Clean up the tunneled reply.
 819                                          */
 820                                         fr_pair_delete_by_num(&reply->vps, PW_PROXY_STATE, 0, TAG_ANY);
 821                                         fr_pair_delete_by_num(&reply->vps, PW_EAP_MESSAGE, 0, TAG_ANY);
 822                                         fr_pair_delete_by_num(&reply->vps, PW_MESSAGE_AUTHENTICATOR, 0, TAG_ANY);
 823
 824                                         /*
 825                                          *      Delete MPPE keys & encryption policy.  We don't
 826                                          *      want these here.
 827                                          */
 828                                         fr_pair_delete_by_num(&reply->vps, 7, VENDORPEC_MICROSOFT, TAG_ANY);
 829                                         fr_pair_delete_by_num(&reply->vps, 8, VENDORPEC_MICROSOFT, TAG_ANY);
 830                                         fr_pair_delete_by_num(&reply->vps, 16, VENDORPEC_MICROSOFT, TAG_ANY);
 831                                         fr_pair_delete_by_num(&reply->vps, 17, VENDORPEC_MICROSOFT, TAG_ANY);
 832
 833                                         fr_pair_list_free(&t->accept_vps); /* for proxying MS-CHAP2 */
 834                                         fr_pair_list_mcopy_by_num(t, &t->accept_vps, &reply->vps, 0, 0, TAG_ANY);
 835                                         rad_assert(!reply->vps);
 836                                 }
 837                                 break;
 838
 839                         default:
 840                                 break;
 841                         }
 842                 }
 843                 break;
 844
 845         case PW_CODE_ACCESS_REJECT:
 846                 RDEBUG("Got tunneled Access-Reject");
 847                 rcode = RLM_MODULE_REJECT;
 848                 break;
 849
 850         /*
 851          * Handle Access-Challenge, but only if we
 852          * send tunneled reply data.  This is because
 853          * an Access-Challenge means that we MUST tunnel
 854          * a Reply-Message to the client.
 855          */
 856         case PW_CODE_ACCESS_CHALLENGE:
 857                 RDEBUG("Got tunneled Access-Challenge");
 858
 859                 /*
 860                  *      Keep the State attribute, if necessary.
 861                  *
 862                  *      Get rid of the old State, too.
 863                  */
 864                 fr_pair_list_free(&t->state);
 865                 fr_pair_list_mcopy_by_num(t, &t->state, &reply->vps, PW_STATE, 0, TAG_ANY);
 866
 867                 /*
 868                  *      We should really be a bit smarter about this,
 869                  *      and move over only those attributes which
 870                  *      are relevant to the authentication request,
 871                  *      but that's a lot more work, and this "dumb"
 872                  *      method works in 99.9% of the situations.
 873                  */
 874                 vp = NULL;
 875                 fr_pair_list_mcopy_by_num(t, &vp, &reply->vps, PW_EAP_MESSAGE, 0, TAG_ANY);
 876
 877                 /*
 878                  *      There MUST be a Reply-Message in the challenge,
 879                  *      which we tunnel back to the client.
 880                  *
 881                  *      If there isn't one in the reply VP's, then
 882                  *      we MUST create one, with an empty string as
 883                  *      it's value.
 884                  */
 885                 fr_pair_list_mcopy_by_num(t, &vp, &reply->vps, PW_REPLY_MESSAGE, 0, TAG_ANY);
 886
 887                 if (vp) {
 888                         RDEBUG("Sending tunneled reply attributes");
 889                         eap_vp2fast(tls_session, vp);
 890                         fr_pair_list_free(&vp);
 891                 }
 892
 893                 rcode = RLM_MODULE_HANDLED;
 894                 break;
 895
 896         default:
 897                 RDEBUG("Unknown RADIUS packet type %d: rejecting tunneled user", reply->code);
 898                 rcode = RLM_MODULE_INVALID;
 899                 break;
 900         }
 901
 902
 903         /*
 904          * Pack any tunnelled VPs and send them back
 905          * to the supplicant.
 906          */
 907         if (tunnel_vps) {
 908                 RDEBUG("Sending tunneled reply attributes");
 909                 rdebug_pair_list(L_DBG_LVL_2, request, tunnel_vps, NULL);
 910
 911                 eap_vp2fast(tls_session, tunnel_vps);
 912                 fr_pair_list_free(&tunnel_vps);
 913         }
 914
 915         return rcode;
 916 }
 917
 918 static PW_CODE eap_fast_eap_payload(REQUEST *request, eap_handler_t *eap_session,
 919                                     tls_session_t *tls_session, VALUE_PAIR *tlv_eap_payload)
 920 {
 921         PW_CODE                 code = PW_CODE_ACCESS_REJECT;
 922         rlm_rcode_t             rcode;
 923         VALUE_PAIR              *vp;
 924         eap_fast_tunnel_t       *t;
 925         REQUEST                 *fake;
 926
 927         RDEBUG("Processing received EAP Payload");
 928
 929         /*
 930          * Allocate a fake REQUEST structure.
 931          */
 932         fake = request_alloc_fake(request);
 933         rad_assert(!fake->packet->vps);
 934
 935         t = (eap_fast_tunnel_t *) tls_session->opaque;
 936
 937         /*
 938          * Add the tunneled attributes to the fake request.
 939          */
 940
 941         fake->packet->vps = fr_pair_afrom_num(fake->packet, PW_EAP_MESSAGE, 0);
 942         fr_pair_value_memcpy(fake->packet->vps, tlv_eap_payload->vp_octets, tlv_eap_payload->vp_length);
 943
 944         RDEBUG("Got tunneled request");
 945         rdebug_pair_list(L_DBG_LVL_1, request, fake->packet->vps, NULL);
 946
 947         /*
 948          * Tell the request that it's a fake one.
 949          */
 950         fr_pair_make(fake->packet, &fake->packet->vps, "Freeradius-Proxied-To", "127.0.0.1", T_OP_EQ);
 951
 952         /*
 953          * Update other items in the REQUEST data structure.
 954          */
 955         fake->username = fr_pair_find_by_num(fake->packet->vps, PW_USER_NAME, 0, TAG_ANY);
 956         fake->password = fr_pair_find_by_num(fake->packet->vps, PW_USER_PASSWORD, 0, TAG_ANY);
 957
 958         /*
 959          * No User-Name, try to create one from stored data.
 960          */
 961         if (!fake->username) {
 962                 /*
 963                  * No User-Name in the stored data, look for
 964                  * an EAP-Identity, and pull it out of there.
 965                  */
 966                 if (!t->username) {
 967                         vp = fr_pair_find_by_num(fake->packet->vps, PW_EAP_MESSAGE, 0, TAG_ANY);
 968                         if (vp &&
 969                             (vp->vp_length >= EAP_HEADER_LEN + 2) &&
 970                             (vp->vp_strvalue[0] == PW_EAP_RESPONSE) &&
 971                             (vp->vp_strvalue[EAP_HEADER_LEN] == PW_EAP_IDENTITY) &&
 972                             (vp->vp_strvalue[EAP_HEADER_LEN + 1] != 0)) {
 973                                 /*
 974                                  * Create & remember a User-Name
 975                                  */
 976                                 t->username = fr_pair_make(t, NULL, "User-Name", NULL, T_OP_EQ);
 977                                 rad_assert(t->username != NULL);
 978
 979                                 fr_pair_value_bstrncpy(t->username, vp->vp_octets + 5, vp->vp_length - 5);
 980
 981                                 RDEBUG("Got tunneled identity of %s", t->username->vp_strvalue);
 982                         } else {
 983                                 /*
 984                                  * Don't reject the request outright,
 985                                  * as it's permitted to do EAP without
 986                                  * user-name.
 987                                  */
 988                                 RWDEBUG2("No EAP-Identity found to start EAP conversation");
 989                         }
 990                 } /* else there WAS a t->username */
 991
 992                 if (t->username) {
 993                         vp = fr_pair_list_copy(fake->packet, t->username);
 994                         fr_pair_add(&fake->packet->vps, vp);
 995                         fake->username = vp;
 996                 }
 997         } /* else the request ALREADY had a User-Name */
 998
 999         /*
1000          *      Add the State attribute, too, if it exists.
1001          */
1002         if (t->state) {
1003                 vp = fr_pair_list_copy(fake->packet, t->state);
1004                 if (vp) fr_pair_add(&fake->packet->vps, vp);
1005         }
1006
1007
1008         if (t->stage == AUTHENTICATION) {       /* FIXME do this only for MSCHAPv2 */
1009                 VALUE_PAIR *tvp;
1010
1011         RWDEBUG2("AUTHENTICATION");
1012         vp = fr_pair_make(fake, &fake->config, "EAP-Type", "0", T_OP_EQ);
1013         vp->vp_integer = t->default_method;
1014         RWDEBUG2("AUTHENTICATION");
1015
1016                 /*
1017                  * RFC 5422 section 3.2.3 - Authenticating Using EAP-FAST-MSCHAPv2
1018                  */
1019                 if (t->mode == EAP_FAST_PROVISIONING_ANON) {
1020                         tvp = fr_pair_afrom_num(fake->packet, PW_MSCHAP_CHALLENGE, VENDORPEC_MICROSOFT);
1021                         fr_pair_value_memcpy(tvp, t->keyblock->server_challenge, CHAP_VALUE_LENGTH);
1022                         fr_pair_add(&fake->config, tvp);
1023
1024                         tvp = fr_pair_afrom_num(fake->packet, PW_MS_CHAP_PEER_CHALLENGE, 0);
1025                         fr_pair_value_memcpy(tvp, t->keyblock->client_challenge, CHAP_VALUE_LENGTH);
1026                         fr_pair_add(&fake->config, tvp);
1027                 }
1028         }
1029
1030         if (t->copy_request_to_tunnel) {
1031                 eapfast_copy_request_to_tunnel(request, fake);
1032         }
1033
1034         if ((vp = fr_pair_find_by_num(request->config, PW_VIRTUAL_SERVER, 0, TAG_ANY)) != NULL) {
1035                 fake->server = vp->vp_strvalue;
1036
1037         } else if (t->virtual_server) {
1038                 fake->server = t->virtual_server;
1039
1040         } /* else fake->server == request->server */
1041
1042         /*
1043          * Call authentication recursively, which will
1044          * do PAP, CHAP, MS-CHAP, etc.
1045          */
1046         rad_virtual_server(fake);
1047
1048         /*
1049          * Decide what to do with the reply.
1050          */
1051         switch (fake->reply->code) {
1052         case 0:                 /* No reply code, must be proxied... */
1053 #ifdef WITH_PROXY
1054                 vp = fr_pair_find_by_num(fake->config, PW_PROXY_TO_REALM, 0, TAG_ANY);
1055                 if (vp) {
1056                         int                     ret;
1057                         eap_tunnel_data_t       *tunnel;
1058
1059                         RDEBUG("Tunneled authentication will be proxied to %s", vp->vp_strvalue);
1060
1061                         /*
1062                          * Tell the original request that it's going
1063                          * to be proxied.
1064                          */
1065                         fr_pair_list_mcopy_by_num(request, &request->config, &fake->config, PW_PROXY_TO_REALM, 0,
1066                                                    TAG_ANY);
1067
1068                         /*
1069                          * Seed the proxy packet with the
1070                          * tunneled request.
1071                          */
1072                         rad_assert(!request->proxy);
1073
1074                         request->proxy = talloc_steal(request, fake->packet);
1075
1076                         memset(&request->proxy->src_ipaddr, 0,
1077                                sizeof(request->proxy->src_ipaddr));
1078                         memset(&request->proxy->src_ipaddr, 0,
1079                                sizeof(request->proxy->src_ipaddr));
1080                         request->proxy->src_port = 0;
1081                         request->proxy->dst_port = 0;
1082                         fake->packet = NULL;
1083                         rad_free(&fake->reply);
1084                         fake->reply = NULL;
1085
1086                         /*
1087                          * Set up the callbacks for the tunnel
1088                          */
1089                         tunnel = talloc_zero(request, eap_tunnel_data_t);
1090                         tunnel->tls_session = tls_session;
1091
1092                         /*
1093                          * Associate the callback with the request.
1094                          */
1095                         ret = request_data_add(request, request->proxy, REQUEST_DATA_EAP_TUNNEL_CALLBACK,
1096                                                tunnel, false);
1097                         rad_assert(ret == 0);
1098
1099                         /*
1100                          * rlm_eap.c has taken care of associating
1101                          * the eap_session with the fake request.
1102                          *
1103                          * So we associate the fake request with
1104                          * this request.
1105                          */
1106                         ret = request_data_add(request, request->proxy, REQUEST_DATA_EAP_MSCHAP_TUNNEL_CALLBACK,
1107                                                fake, true);
1108                         rad_assert(ret == 0);
1109
1110                         fake = NULL;
1111
1112                         /*
1113                          * Didn't authenticate the packet, but
1114                          * we're proxying it.
1115                          */
1116                         code = PW_CODE_STATUS_CLIENT;
1117
1118                 } else
1119 #endif  /* WITH_PROXY */
1120                   {
1121                           RDEBUG("No tunneled reply was found, and the request was not proxied: rejecting the user.");
1122                           code = PW_CODE_ACCESS_REJECT;
1123                   }
1124                 break;
1125
1126         default:
1127                 /*
1128                  * Returns RLM_MODULE_FOO, and we want to return PW_FOO
1129                  */
1130                 rcode = process_reply(eap_session, tls_session, request, fake->reply);
1131                 switch (rcode) {
1132                 case RLM_MODULE_REJECT:
1133                         code = PW_CODE_ACCESS_REJECT;
1134                         break;
1135
1136                 case RLM_MODULE_HANDLED:
1137                         code = PW_CODE_ACCESS_CHALLENGE;
1138                         break;
1139
1140                 case RLM_MODULE_OK:
1141                         code = PW_CODE_ACCESS_ACCEPT;
1142                         break;
1143
1144                 default:
1145                         code = PW_CODE_ACCESS_REJECT;
1146                         break;
1147                 }
1148                 break;
1149         }
1150
1151         talloc_free(fake);
1152
1153         return code;
1154 }
1155
1156 static PW_CODE eap_fast_crypto_binding(REQUEST *request, UNUSED eap_handler_t *eap_session,
1157                                        tls_session_t *tls_session, eap_tlv_crypto_binding_tlv_t *binding)
1158 {
1159         uint8_t                 cmac[sizeof(binding->compound_mac)];
1160         eap_fast_tunnel_t       *t = tls_session->opaque;
1161
1162         memcpy(cmac, binding->compound_mac, sizeof(cmac));
1163         memset(binding->compound_mac, 0, sizeof(binding->compound_mac));
1164
1165
1166         fr_hmac_sha1(binding->compound_mac, (uint8_t *)binding, sizeof(*binding), t->cmk, EAP_FAST_CMK_LEN);
1167         if (memcmp(binding->compound_mac, cmac, sizeof(cmac))) {
1168                 RDEBUG2("Crypto-Binding TLV mis-match");
1169                 return PW_CODE_ACCESS_REJECT;
1170         }
1171
1172         return PW_CODE_ACCESS_ACCEPT;
1173 }
1174
1175
1176 #define PW_EAP_FAST_TLV_PAC (PW_FREERADIUS_EAP_FAST_TLV | (EAP_FAST_TLV_PAC << 8))
1177
1178
1179
1180 static PW_CODE eap_fast_process_tlvs(REQUEST *request, eap_handler_t *eap_session,
1181                                      tls_session_t *tls_session, VALUE_PAIR *fast_vps)
1182 {
1183         eap_fast_tunnel_t               *t = (eap_fast_tunnel_t *) tls_session->opaque;
1184         VALUE_PAIR                      *vp;
1185         vp_cursor_t                     cursor;
1186         eap_tlv_crypto_binding_tlv_t    *binding = NULL;
1187
1188         for (vp = fr_cursor_init(&cursor, &fast_vps); vp; vp = fr_cursor_next(&cursor)) {
1189                 PW_CODE code = PW_CODE_ACCESS_REJECT;
1190                 char *value;
1191                 DICT_ATTR const *parent_da = NULL;
1192                 parent_da = dict_parent(vp->da->attr, vp->da->vendor);
1193                 if (parent_da == NULL || vp->da->vendor != VENDORPEC_FREERADIUS ||
1194                         ((vp->da->attr & 0xff) != PW_FREERADIUS_EAP_FAST_TLV)) {
1195                         value = vp_aprints(request->packet, vp, '"');
1196                         RDEBUG2("ignoring non-EAP-FAST TLV %s", value);
1197                         talloc_free(value);
1198                         continue;
1199                 }
1200
1201                 switch (parent_da->attr) {
1202                 case PW_FREERADIUS_EAP_FAST_TLV:
1203                         switch (vp->da->attr >> 8) {
1204                         case EAP_FAST_TLV_EAP_PAYLOAD:
1205                                 code = eap_fast_eap_payload(request, eap_session, tls_session, vp);
1206                                 if (code == PW_CODE_ACCESS_ACCEPT)
1207                                         t->stage = CRYPTOBIND_CHECK;
1208                                 break;
1209                         case EAP_FAST_TLV_RESULT:
1210                         case EAP_FAST_TLV_INTERMED_RESULT:
1211                                 code = PW_CODE_ACCESS_ACCEPT;
1212                                 t->stage = PROVISIONING;
1213                                 break;
1214                         case EAP_FAST_TLV_CRYPTO_BINDING:
1215                                 if (!binding) {
1216                                         binding = talloc_zero(request->packet, eap_tlv_crypto_binding_tlv_t);
1217                                         memcpy(binding, vp->vp_octets, sizeof(*binding));
1218                                         binding->tlv_type = htons(EAP_FAST_TLV_MANDATORY | EAP_FAST_TLV_CRYPTO_BINDING);
1219                                         binding->length = htons(sizeof(*binding) - 2 * sizeof(uint16_t));
1220                                 }
1221                                 continue;
1222                         default:
1223                                 value = vp_aprints_value(request->packet, vp, '"');
1224                                 RDEBUG2("ignoring unknown %s", value);
1225                                 talloc_free(value);
1226                                 continue;
1227                         }
1228                         break;
1229                 case PW_EAP_FAST_TLV_PAC:
1230                         switch ( ( vp->da->attr >> 16 )) {
1231                         case PAC_INFO_PAC_ACK:
1232                                 if (vp->vp_integer == EAP_FAST_TLV_RESULT_SUCCESS) {
1233                                         code = PW_CODE_ACCESS_ACCEPT;
1234                                         t->pac.expires = UINT32_MAX;
1235                                         t->pac.expired = false;
1236                                         t->stage = COMPLETE;
1237                                 }
1238                                 break;
1239                         case PAC_INFO_PAC_TYPE:
1240                                 if (vp->vp_integer != PAC_TYPE_TUNNEL) {
1241                                         RDEBUG("only able to serve Tunnel PAC's, ignoring request");
1242                                         continue;
1243                                 }
1244                                 t->pac.send = true;
1245                                 continue;
1246                         default:
1247                                 value = vp_aprints(request->packet, vp, '"');
1248                                 RDEBUG2("ignoring unknown EAP-FAST-PAC-TLV %s", value);
1249                                 talloc_free(value);
1250                                 continue;
1251                         }
1252                         break;
1253                 default:
1254                         value = vp_aprints(request->packet, vp, '"');
1255                         RDEBUG2("ignoring EAP-FAST TLV %s", value);
1256                         talloc_free(value);
1257                         continue;
1258                 }
1259
1260                 if (code == PW_CODE_ACCESS_REJECT)
1261                         return PW_CODE_ACCESS_REJECT;
1262         }
1263
1264         if (binding) {
1265                 PW_CODE code = eap_fast_crypto_binding(request, eap_session, tls_session, binding);
1266                 if (code == PW_CODE_ACCESS_ACCEPT)
1267                         t->stage = PROVISIONING;
1268         }
1269
1270         return PW_CODE_ACCESS_ACCEPT;
1271 }
1272
1273
1274 /*
1275  * Process the inner tunnel data
1276  */
1277 PW_CODE eap_fast_process(eap_handler_t *eap_session, tls_session_t *tls_session)
1278 {
1279         PW_CODE                 code;
1280         VALUE_PAIR              *fast_vps;
1281         uint8_t                 const *data;
1282         size_t                  data_len;
1283         eap_fast_tunnel_t               *t;
1284         REQUEST                 *request = eap_session->request;
1285
1286         /*
1287          * Just look at the buffer directly, without doing
1288          * record_to_buff.
1289          */
1290         data_len = tls_session->clean_out.used;
1291         tls_session->clean_out.used = 0;
1292         data = tls_session->clean_out.data;
1293
1294         t = (eap_fast_tunnel_t *) tls_session->opaque;
1295
1296         /*
1297          * See if the tunneled data is well formed.
1298          */
1299         if (!eap_fast_verify(request, tls_session, data, data_len)) return PW_CODE_ACCESS_REJECT;
1300
1301         if (t->stage == TLS_SESSION_HANDSHAKE) {
1302                 rad_assert(t->mode == EAP_FAST_UNKNOWN);
1303
1304                 char buf[256];
1305                 if (strstr(SSL_CIPHER_description(SSL_get_current_cipher(tls_session->ssl),
1306                                                   buf, sizeof(buf)), "Au=None")) {
1307                         /* FIXME enforce MSCHAPv2 - RFC 5422 section 3.2.2 */
1308                         RDEBUG2("Using anonymous provisioning");
1309                         t->mode = EAP_FAST_PROVISIONING_ANON;
1310                         t->pac.send = true;
1311                 } else {
1312                         if (SSL_session_reused(tls_session->ssl)) {
1313                                 RDEBUG("Session Resumed from PAC");
1314                                 t->mode = EAP_FAST_NORMAL_AUTH;
1315                         } else {
1316                                 RDEBUG2("Using authenticated provisioning");
1317                                 t->mode = EAP_FAST_PROVISIONING_AUTH;
1318                         }
1319
1320                         if (!t->pac.expires || t->pac.expired || t->pac.expires - time(NULL) < t->pac_lifetime * 0.6)
1321                                 t->pac.send = true;
1322                 }
1323
1324                 eap_fast_init_keys(request, tls_session);
1325
1326                 eap_fast_send_identity_request(request, tls_session, eap_session);
1327
1328                 t->stage = AUTHENTICATION;
1329                 return PW_CODE_ACCESS_CHALLENGE;
1330         }
1331
1332         fast_vps = eap_fast_fast2vp(request, tls_session->ssl, data, data_len, NULL, NULL);
1333
1334         RDEBUG("Got Tunneled FAST TLVs");
1335         rdebug_pair_list(L_DBG_LVL_1, request, fast_vps, NULL);
1336
1337         code = eap_fast_process_tlvs(request, eap_session, tls_session, fast_vps);
1338
1339         fr_pair_list_free(&fast_vps);
1340
1341         if (code == PW_CODE_ACCESS_REJECT) return PW_CODE_ACCESS_REJECT;
1342
1343         switch (t->stage) {
1344         case AUTHENTICATION:
1345                 code = PW_CODE_ACCESS_CHALLENGE;
1346                 break;
1347         case CRYPTOBIND_CHECK:
1348         {
1349                 if (t->mode != EAP_FAST_PROVISIONING_ANON && !t->pac.send)
1350                         t->result_final = true;
1351
1352                 eap_fast_append_result(tls_session, code);
1353
1354                 eap_fast_update_icmk(request, tls_session, (uint8_t *)&t->isk);
1355                 eap_fast_append_crypto_binding(request, tls_session);
1356
1357                 code = PW_CODE_ACCESS_CHALLENGE;
1358                 break;
1359         }
1360         case PROVISIONING:
1361                 t->result_final = true;
1362
1363                 eap_fast_append_result(tls_session, code);
1364
1365                 if (code == PW_CODE_ACCESS_REJECT)
1366                         break;
1367
1368                 if (t->pac.send) {
1369                         RDEBUG("Peer requires new PAC");
1370                         eap_fast_send_pac_tunnel(request, tls_session);
1371                         code = PW_CODE_ACCESS_CHALLENGE;
1372                         break;
1373                 }
1374
1375                 t->stage = COMPLETE;
1376                 /* fallthrough */
1377         case COMPLETE:
1378                 /*
1379                  * RFC 5422 section 3.5 - Network Access after EAP-FAST Provisioning
1380                  */
1381                 if (t->pac.type && t->pac.expired) {
1382                         REDEBUG("Rejecting expired PAC.");
1383                         code = PW_CODE_ACCESS_REJECT;
1384                         break;
1385                 }
1386
1387                 if (t->mode == EAP_FAST_PROVISIONING_ANON) {
1388                         REDEBUG("Rejecting unauthenticated provisioning");
1389                         code = PW_CODE_ACCESS_REJECT;
1390                         break;
1391                 }
1392
1393                 /*
1394                  * eap_tls_gen_mppe_keys() is unsuitable for EAP-FAST as Cisco decided
1395                  * it would be a great idea to flip the recv/send keys around
1396                  */
1397                 #define EAPTLS_MPPE_KEY_LEN 32
1398                 eap_add_reply(request, "MS-MPPE-Recv-Key", t->msk, EAPTLS_MPPE_KEY_LEN);
1399                 eap_add_reply(request, "MS-MPPE-Send-Key", &t->msk[EAPTLS_MPPE_KEY_LEN], EAPTLS_MPPE_KEY_LEN);
1400                 eap_add_reply(request, "EAP-MSK", t->msk, EAP_FAST_KEY_LEN);
1401                 eap_add_reply(request, "EAP-EMSK", t->emsk, EAP_EMSK_LEN);
1402
1403                 break;
1404
1405         default:
1406                 RERROR("Internal sanity check failed in EAP-FAST at %d", t->stage);
1407                 code = PW_CODE_ACCESS_REJECT;
1408         }
1409
1410         return code;
1411 }