src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c

   1 /*
   2  * eap_fast.c  contains the interfaces that are called from the main handler
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  *   Copyright 2016 Alan DeKok <aland@freeradius.org>
  21  *   Copyright 2016 The FreeRADIUS server project
  22  */
  23
  24 RCSID("$Id$")
  25
  26 #include "eap_fast.h"
  27 #include "eap_fast_crypto.h"
  28 #include <freeradius-devel/sha1.h>
  29 #include <openssl/ssl.h>
  30 #include <openssl/rand.h>
  31
  32 #define RANDFILL(x) do { rad_assert(sizeof(x) % sizeof(uint32_t) == 0); for (size_t i = 0; i < sizeof(x); i += sizeof(uint32_t)) *((uint32_t *)&x[i]) = fr_rand(); } while(0)
  33
  34 /*
  35  * Copyright (c) 2002-2016, Jouni Malinen <j@w1.fi> and contributors
  36  * All Rights Reserved.
  37  *
  38  * These programs are licensed under the BSD license (the one with
  39  * advertisement clause removed).
  40  *
  41  * this function shamelessly stolen from from hostap:src/crypto/tls_openssl.c
  42  */
  43 static int openssl_get_keyblock_size(REQUEST *request, SSL *ssl)
  44 {
  45         const EVP_CIPHER *c;
  46         const EVP_MD *h;
  47 #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
  48         int md_size;
  49
  50         if (ssl->enc_read_ctx == NULL || ssl->enc_read_ctx->cipher == NULL ||
  51             ssl->read_hash == NULL)
  52                 return -1;
  53
  54         c = ssl->enc_read_ctx->cipher;
  55         h = EVP_MD_CTX_md(ssl->read_hash);
  56         if (h)
  57                 md_size = EVP_MD_size(h);
  58         else if (ssl->s3)
  59                 md_size = ssl->s3->tmp.new_mac_secret_size;
  60         else
  61                 return -1;
  62
  63         RDEBUG2("OpenSSL: keyblock size: key_len=%d MD_size=%d "
  64                    "IV_len=%d", EVP_CIPHER_key_length(c), md_size,
  65                    EVP_CIPHER_iv_length(c));
  66         return 2 * (EVP_CIPHER_key_length(c) +
  67                     md_size +
  68                     EVP_CIPHER_iv_length(c));
  69 #else
  70         const SSL_CIPHER *ssl_cipher;
  71         int cipher, digest;
  72
  73         ssl_cipher = SSL_get_current_cipher(ssl);
  74         if (!ssl_cipher)
  75                 return -1;
  76         cipher = SSL_CIPHER_get_cipher_nid(ssl_cipher);
  77         digest = SSL_CIPHER_get_digest_nid(ssl_cipher);
  78         RDEBUG2("OpenSSL: cipher nid %d digest nid %d", cipher, digest);
  79         if (cipher < 0 || digest < 0)
  80                 return -1;
  81         c = EVP_get_cipherbynid(cipher);
  82         h = EVP_get_digestbynid(digest);
  83         if (!c || !h)
  84                 return -1;
  85
  86         RDEBUG2("OpenSSL: keyblock size: key_len=%d MD_size=%d IV_len=%d",
  87                    EVP_CIPHER_key_length(c), EVP_MD_size(h),
  88                    EVP_CIPHER_iv_length(c));
  89         return 2 * (EVP_CIPHER_key_length(c) + EVP_MD_size(h) +
  90                     EVP_CIPHER_iv_length(c));
  91 #endif
  92 }
  93
  94 /**
  95  * RFC 4851 section 5.1 - EAP-FAST Authentication Phase 1: Key Derivations
  96  */
  97 static void eap_fast_init_keys(REQUEST *request, tls_session_t *tls_session)
  98 {
  99         eap_fast_tunnel_t *t = tls_session->opaque;
 100         uint8_t *buf;
 101         uint8_t *scratch;
 102         size_t ksize;
 103
 104         RDEBUG2("Deriving EAP-FAST keys");
 105
 106         rad_assert(t->simck == NULL);
 107
 108         ksize = openssl_get_keyblock_size(request, tls_session->ssl);
 109         rad_assert(ksize > 0);
 110         buf = talloc_size(request, ksize + sizeof(*t->keyblock));
 111         scratch = talloc_size(request, ksize + sizeof(*t->keyblock));
 112
 113         t->keyblock = talloc(request, eap_fast_keyblock_t);
 114
 115         eap_fast_tls_gen_challenge(tls_session->ssl, buf, scratch, ksize + sizeof(*t->keyblock), "key expansion");
 116         memcpy(t->keyblock, &buf[ksize], sizeof(*t->keyblock));
 117         memset(buf, 0, ksize + sizeof(*t->keyblock));
 118
 119         t->simck = talloc_size(request, EAP_FAST_SIMCK_LEN);
 120         memcpy(t->simck, t->keyblock, EAP_FAST_SKS_LEN);        /* S-IMCK[0] = session_key_seed */
 121
 122         t->cmk = talloc_size(request, EAP_FAST_CMK_LEN);        /* note that CMK[0] is not defined */
 123         t->imckc = 0;
 124
 125         talloc_free(buf);
 126         talloc_free(scratch);
 127 }
 128
 129 /**
 130  * RFC 4851 section 5.2 - Intermediate Compound Key Derivations
 131  */
 132 static void eap_fast_update_icmk(REQUEST *request, tls_session_t *tls_session, uint8_t *msk)
 133 {
 134         eap_fast_tunnel_t *t = tls_session->opaque;
 135         uint8_t imck[EAP_FAST_SIMCK_LEN + EAP_FAST_CMK_LEN];
 136
 137         RDEBUG2("Updating ICMK");
 138
 139         T_PRF(t->simck, EAP_FAST_SIMCK_LEN, "Inner Methods Compound Keys", msk, 32, imck, sizeof(imck));
 140
 141         memcpy(t->simck, imck, EAP_FAST_SIMCK_LEN);
 142         memcpy(t->cmk, &imck[EAP_FAST_SIMCK_LEN], EAP_FAST_CMK_LEN);
 143         t->imckc++;
 144
 145         /*
 146          * Calculate MSK/EMSK at the same time as they are coupled to ICMK
 147          *
 148          * RFC 4851 section 5.4 - EAP Master Session Key Generation
 149          */
 150         t->msk = talloc_size(request, EAP_FAST_KEY_LEN);
 151         T_PRF(t->simck, EAP_FAST_SIMCK_LEN, "Session Key Generating Function", NULL, 0, t->msk, EAP_FAST_KEY_LEN);
 152
 153         t->emsk = talloc_size(request, EAP_EMSK_LEN);
 154         T_PRF(t->simck, EAP_FAST_SIMCK_LEN, "Extended Session Key Generating Function", NULL, 0, t->emsk, EAP_EMSK_LEN);
 155 }
 156
 157 void eap_fast_tlv_append(tls_session_t *tls_session, int tlv, bool mandatory, int length, const void *data)
 158 {
 159         uint16_t hdr[2];
 160
 161         hdr[0] = (mandatory) ? htons(tlv | EAP_FAST_TLV_MANDATORY) : htons(tlv);
 162         hdr[1] = htons(length);
 163
 164         tls_session->record_plus(&tls_session->clean_in, &hdr, 4);
 165         tls_session->record_plus(&tls_session->clean_in, data, length);
 166 }
 167
 168 static void eap_fast_send_error(tls_session_t *tls_session, int error)
 169 {
 170         uint32_t value;
 171         value = htonl(error);
 172
 173         eap_fast_tlv_append(tls_session, EAP_FAST_TLV_ERROR, true, sizeof(value), &value);
 174 }
 175
 176 static void eap_fast_append_result(tls_session_t *tls_session, PW_CODE code)
 177 {
 178         eap_fast_tunnel_t *t = (eap_fast_tunnel_t *) tls_session->opaque;
 179
 180         int type = (t->result_final)
 181                         ? EAP_FAST_TLV_RESULT
 182                         : EAP_FAST_TLV_INTERMED_RESULT;
 183
 184         uint16_t state = (code == PW_CODE_ACCESS_REJECT)
 185                         ? EAP_FAST_TLV_RESULT_FAILURE
 186                         : EAP_FAST_TLV_RESULT_SUCCESS;
 187         state = htons(state);
 188
 189         eap_fast_tlv_append(tls_session, type, true, sizeof(state), &state);
 190 }
 191
 192 static void eap_fast_send_identity_request(REQUEST *request, tls_session_t *tls_session, eap_handler_t *eap_session)
 193 {
 194         eap_packet_raw_t eap_packet;
 195
 196         RDEBUG("Sending EAP-Identity");
 197
 198         eap_packet.code = PW_EAP_REQUEST;
 199         eap_packet.id = eap_session->eap_ds->response->id + 1;
 200         eap_packet.length[0] = 0;
 201         eap_packet.length[1] = EAP_HEADER_LEN + 1;
 202         eap_packet.data[0] = PW_EAP_IDENTITY;
 203
 204         eap_fast_tlv_append(tls_session, EAP_FAST_TLV_EAP_PAYLOAD, true, sizeof(eap_packet), &eap_packet);
 205 }
 206
 207 static void eap_fast_send_pac_tunnel(REQUEST *request, tls_session_t *tls_session)
 208 {
 209         eap_fast_tunnel_t                       *t = tls_session->opaque;
 210         eap_fast_pac_t                          pac;
 211         eap_fast_attr_pac_opaque_plaintext_t    opaque_plaintext;
 212         int                                     alen, dlen;
 213
 214         memset(&pac, 0, sizeof(pac));
 215         memset(&opaque_plaintext, 0, sizeof(opaque_plaintext));
 216
 217         RDEBUG("Sending Tunnel PAC");
 218
 219         pac.key.hdr.type = htons(EAP_FAST_TLV_MANDATORY | PAC_INFO_PAC_KEY);
 220         pac.key.hdr.length = htons(sizeof(pac.key.data));
 221         rad_assert(sizeof(pac.key.data) % sizeof(uint32_t) == 0);
 222         RANDFILL(pac.key.data);
 223
 224         pac.info.lifetime.hdr.type = htons(PAC_INFO_PAC_LIFETIME);
 225         pac.info.lifetime.hdr.length = htons(sizeof(pac.info.lifetime.data));
 226         pac.info.lifetime.data = htonl(time(NULL) + t->pac_lifetime);
 227
 228         pac.info.a_id.hdr.type = htons(EAP_FAST_TLV_MANDATORY | PAC_INFO_A_ID);
 229         pac.info.a_id.hdr.length = htons(sizeof(pac.info.a_id.data));
 230         memcpy(pac.info.a_id.data, t->a_id, sizeof(pac.info.a_id.data));
 231
 232         pac.info.a_id_info.hdr.type = htons(PAC_INFO_A_ID_INFO);
 233         pac.info.a_id_info.hdr.length = htons(sizeof(pac.info.a_id_info.data));
 234         #define MIN(a,b) (((a)>(b)) ? (b) : (a))
 235         alen = MIN(talloc_array_length(t->authority_identity) - 1, sizeof(pac.info.a_id_info.data));
 236         memcpy(pac.info.a_id_info.data, t->authority_identity, alen);
 237
 238         pac.info.type.hdr.type = htons(EAP_FAST_TLV_MANDATORY | PAC_INFO_PAC_TYPE);
 239         pac.info.type.hdr.length = htons(sizeof(pac.info.type.data));
 240         pac.info.type.data = htons(PAC_TYPE_TUNNEL);
 241
 242         pac.info.hdr.type = htons(EAP_FAST_TLV_MANDATORY | PAC_INFO_PAC_INFO);
 243         pac.info.hdr.length = htons(sizeof(pac.info.lifetime)
 244                                 + sizeof(pac.info.a_id)
 245                                 + sizeof(pac.info.a_id_info)
 246                                 + sizeof(pac.info.type));
 247
 248         memcpy(&opaque_plaintext.type, &pac.info.type, sizeof(opaque_plaintext.type));
 249         memcpy(&opaque_plaintext.lifetime, &pac.info.lifetime, sizeof(opaque_plaintext.lifetime));
 250         memcpy(&opaque_plaintext.key, &pac.key, sizeof(opaque_plaintext.key));
 251
 252
 253         rad_assert(PAC_A_ID_LENGTH <= EVP_GCM_TLS_TAG_LEN);
 254         memcpy(pac.opaque.aad, t->a_id, PAC_A_ID_LENGTH);
 255         rad_assert(RAND_bytes(pac.opaque.iv, sizeof(pac.opaque.iv)) != 0);
 256         dlen = eap_fast_encrypt((unsigned const char *)&opaque_plaintext, sizeof(opaque_plaintext),
 257                                     t->a_id, PAC_A_ID_LENGTH, t->pac_opaque_key, pac.opaque.iv,
 258                                     pac.opaque.data, pac.opaque.tag);
 259
 260         pac.opaque.hdr.type = htons(EAP_FAST_TLV_MANDATORY | PAC_INFO_PAC_OPAQUE);
 261         pac.opaque.hdr.length = htons(sizeof(pac.opaque) - sizeof(pac.opaque.hdr) - sizeof(pac.opaque.data) + dlen);
 262
 263         eap_fast_tlv_append(tls_session, EAP_FAST_TLV_MANDATORY | EAP_FAST_TLV_PAC, true,
 264                             sizeof(pac) - sizeof(pac.opaque.data) + dlen, &pac);
 265 }
 266
 267 static void eap_fast_append_crypto_binding(REQUEST *request, tls_session_t *tls_session)
 268 {
 269         eap_fast_tunnel_t               *t = tls_session->opaque;
 270         eap_tlv_crypto_binding_tlv_t    binding;
 271     memset(&binding, 0, sizeof(eap_tlv_crypto_binding_tlv_t));
 272         const int                       len = sizeof(binding) - (&binding.reserved - (uint8_t *)&binding);
 273
 274         RDEBUG("Sending Cryptobinding");
 275
 276         binding.tlv_type = htons(EAP_FAST_TLV_MANDATORY | EAP_FAST_TLV_CRYPTO_BINDING);
 277         binding.length = htons(len);
 278         binding.version = EAP_FAST_VERSION;
 279         binding.received_version = EAP_FAST_VERSION;    /* FIXME use the clients value */
 280         binding.subtype = EAP_FAST_TLV_CRYPTO_BINDING_SUBTYPE_REQUEST;
 281
 282         rad_assert(sizeof(binding.nonce) % sizeof(uint32_t) == 0);
 283         RANDFILL(binding.nonce);
 284         binding.nonce[sizeof(binding.nonce) - 1] &= ~0x01; /* RFC 4851 section 4.2.8 */
 285
 286
 287         fr_hmac_sha1(binding.compound_mac, (uint8_t *)&binding, sizeof(binding), t->cmk, EAP_FAST_CMK_LEN);
 288
 289         eap_fast_tlv_append(tls_session, EAP_FAST_TLV_CRYPTO_BINDING, true, len, &binding.reserved);
 290 }
 291
 292 static int eap_fast_verify(REQUEST *request, tls_session_t *tls_session, uint8_t const *data, unsigned int data_len)
 293 {
 294         uint16_t attr;
 295         uint16_t length;
 296         unsigned int remaining = data_len;
 297         int     total = 0;
 298         int     num[EAP_FAST_TLV_MAX] = {0};
 299         eap_fast_tunnel_t *t = (eap_fast_tunnel_t *) tls_session->opaque;
 300         uint32_t present = 0;
 301
 302         rad_assert(sizeof(present) * 8 > EAP_FAST_TLV_MAX);
 303
 304         while (remaining > 0) {
 305                 if (remaining < 4) {
 306                         RDEBUG2("EAP-FAST TLV is too small (%u) to contain a EAP-FAST TLV header", remaining);
 307                         return 0;
 308                 }
 309
 310                 memcpy(&attr, data, sizeof(attr));
 311                 attr = ntohs(attr) & EAP_FAST_TLV_TYPE;
 312
 313                 switch (attr) {
 314                 case EAP_FAST_TLV_RESULT:
 315                 case EAP_FAST_TLV_NAK:
 316                 case EAP_FAST_TLV_ERROR:
 317                 case EAP_FAST_TLV_VENDOR_SPECIFIC:
 318                 case EAP_FAST_TLV_EAP_PAYLOAD:
 319                 case EAP_FAST_TLV_INTERMED_RESULT:
 320                 case EAP_FAST_TLV_PAC:
 321                 case EAP_FAST_TLV_CRYPTO_BINDING:
 322                         num[attr]++;
 323                         present |= 1 << attr;
 324
 325                         if (num[EAP_FAST_TLV_EAP_PAYLOAD] > 1) {
 326                                 RDEBUG("Too many EAP-Payload TLVs");
 327 unexpected:
 328                                 for (int i = 0; i < EAP_FAST_TLV_MAX; i++)
 329                                         if (present & (1 << i))
 330                                                 RDEBUG(" - attribute %d is present", i);
 331                                 eap_fast_send_error(tls_session, EAP_FAST_ERR_UNEXPECTED_TLV);
 332                                 return 0;
 333                         }
 334
 335                         if (num[EAP_FAST_TLV_INTERMED_RESULT] > 1) {
 336                                 RDEBUG("Too many Intermediate-Result TLVs");
 337                                 goto unexpected;
 338                         }
 339                         break;
 340                 default:
 341                         if ((data[0] & 0x80) != 0) {
 342                                 RDEBUG("Unknown mandatory TLV %02x", attr);
 343                                 goto unexpected;
 344                         }
 345
 346                         num[0]++;
 347                 }
 348
 349                 total++;
 350
 351                 memcpy(&length, data + 2, sizeof(length));
 352                 length = ntohs(length);
 353
 354                 data += 4;
 355                 remaining -= 4;
 356
 357                 if (length > remaining) {
 358                         RDEBUG2("EAP-FAST TLV %u is longer than room remaining in the packet (%u > %u).", attr,
 359                                 length, remaining);
 360                         return 0;
 361                 }
 362
 363                 /*
 364                  * If the rest of the TLVs are larger than
 365                  * this attribute, continue.
 366                  *
 367                  * Otherwise, if the attribute over-flows the end
 368                  * of the TLCs, die.
 369                  */
 370                 if (remaining < length) {
 371                         RDEBUG2("EAP-FAST TLV overflows packet!");
 372                         return 0;
 373                 }
 374
 375                 /*
 376                  * If there's an error, we bail out of the
 377                  * authentication process before allocating
 378                  * memory.
 379                  */
 380                 if ((attr == EAP_FAST_TLV_INTERMED_RESULT) || (attr == EAP_FAST_TLV_RESULT)) {
 381                         uint16_t status;
 382
 383                         if (length < 2) {
 384                                 RDEBUG("EAP-FAST TLV %u is too short.  Expected 2, got %d.", attr, length);
 385                                 return 0;
 386                         }
 387
 388                         memcpy(&status, data, 2);
 389                         status = ntohs(status);
 390
 391                         if (status == EAP_FAST_TLV_RESULT_FAILURE) {
 392                                 RDEBUG("EAP-FAST TLV %u indicates failure.  Rejecting request.", attr);
 393                                 return 0;
 394                         }
 395
 396                         if (status != EAP_FAST_TLV_RESULT_SUCCESS) {
 397                                 RDEBUG("EAP-FAST TLV %u contains unknown value.  Rejecting request.", attr);
 398                                 goto unexpected;
 399                         }
 400                 }
 401
 402                 /*
 403                  * remaining > length, continue.
 404                  */
 405                 remaining -= length;
 406                 data += length;
 407         }
 408
 409         /*
 410          * Check if the peer mixed & matched TLVs.
 411          */
 412         if ((num[EAP_FAST_TLV_NAK] > 0) && (num[EAP_FAST_TLV_NAK] != total)) {
 413                 RDEBUG("NAK TLV sent with non-NAK TLVs.  Rejecting request.");
 414                 goto unexpected;
 415         }
 416
 417         if (num[EAP_FAST_TLV_INTERMED_RESULT] > 0 && num[EAP_FAST_TLV_RESULT]) {
 418                 RDEBUG("NAK TLV sent with non-NAK TLVs.  Rejecting request.");
 419                 goto unexpected;
 420         }
 421
 422         /*
 423          * Check mandatory or not mandatory TLVs.
 424          */
 425         switch (t->stage) {
 426         case TLS_SESSION_HANDSHAKE:
 427                 if (present) {
 428                         RDEBUG("Unexpected TLVs in TLS Session Handshake stage");
 429                         goto unexpected;
 430                 }
 431                 break;
 432         case AUTHENTICATION:
 433                 if (present != 1 << EAP_FAST_TLV_EAP_PAYLOAD) {
 434                         RDEBUG("Unexpected TLVs in authentication stage");
 435                         goto unexpected;
 436                 }
 437                 break;
 438         case CRYPTOBIND_CHECK:
 439         {
 440                 uint32_t bits = (t->result_final)
 441                                 ? 1 << EAP_FAST_TLV_RESULT
 442                                 : 1 << EAP_FAST_TLV_INTERMED_RESULT;
 443                 if (present & ~(bits | (1 << EAP_FAST_TLV_CRYPTO_BINDING) | (1 << EAP_FAST_TLV_PAC))) {
 444                         RDEBUG("Unexpected TLVs in cryptobind checking stage");
 445                         goto unexpected;
 446                 }
 447                 break;
 448         }
 449         case PROVISIONING:
 450                 if (present & ~((1 << EAP_FAST_TLV_PAC) | (1 << EAP_FAST_TLV_RESULT))) {
 451                         RDEBUG("Unexpected TLVs in provisioning stage");
 452                         goto unexpected;
 453                 }
 454                 break;
 455         case COMPLETE:
 456                 if (present) {
 457                         RDEBUG("Unexpected TLVs in complete stage");
 458                         goto unexpected;
 459                 }
 460                 break;
 461         default:
 462                 RDEBUG("Unexpected stage %d", t->stage);
 463                 return 0;
 464         }
 465
 466         /*
 467          * We got this far.  It looks OK.
 468          */
 469         return 1;
 470 }
 471
 472 static ssize_t eap_fast_decode_vp(TALLOC_CTX *request, DICT_ATTR const *parent,
 473                                     uint8_t const *data, size_t const attr_len, VALUE_PAIR **out)
 474 {
 475         int8_t                  tag = TAG_NONE;
 476         VALUE_PAIR              *vp;
 477         uint8_t const           *p = data;
 478
 479         /*
 480          *      FIXME: Attrlen can be larger than 253 for extended attrs!
 481          */
 482         if (!parent || !out ) {
 483                 RERROR("eap_fast_decode_vp: Invalid arguments");
 484                 return -1;
 485         }
 486
 487         /*
 488          *      Silently ignore zero-length attributes.
 489          */
 490         if (attr_len == 0) return 0;
 491
 492         /*
 493          *      And now that we've verified the basic type
 494          *      information, decode the actual p.
 495          */
 496         vp = fr_pair_afrom_da(request, parent);
 497         if (!vp) return -1;
 498
 499         vp->vp_length = attr_len;
 500         vp->tag = tag;
 501
 502         switch (parent->type) {
 503         case PW_TYPE_STRING:
 504                 fr_pair_value_bstrncpy(vp, p, attr_len);
 505                 break;
 506
 507         case PW_TYPE_OCTETS:
 508                 fr_pair_value_memcpy(vp, p, attr_len);
 509                 break;
 510
 511         case PW_TYPE_ABINARY:
 512                 if (vp->vp_length > sizeof(vp->vp_filter)) {
 513                         vp->vp_length = sizeof(vp->vp_filter);
 514                 }
 515                 memcpy(vp->vp_filter, p, vp->vp_length);
 516                 break;
 517
 518         case PW_TYPE_BYTE:
 519                 vp->vp_byte = p[0];
 520                 break;
 521
 522         case PW_TYPE_SHORT:
 523                 vp->vp_short = (p[0] << 8) | p[1];
 524                 break;
 525
 526         case PW_TYPE_INTEGER:
 527                 memcpy(&vp->vp_integer, p, 4);
 528                 vp->vp_integer = ntohl(vp->vp_integer);
 529                 break;
 530
 531         case PW_TYPE_INTEGER64:
 532                 memcpy(&vp->vp_integer64, p, 8);
 533                 vp->vp_integer64 = ntohll(vp->vp_integer64);
 534                 break;
 535
 536         case PW_TYPE_DATE:
 537                 memcpy(&vp->vp_date, p, 4);
 538                 vp->vp_date = ntohl(vp->vp_date);
 539                 break;
 540
 541         case PW_TYPE_ETHERNET:
 542                 memcpy(vp->vp_ether, p, 6);
 543                 break;
 544
 545         case PW_TYPE_IPV4_ADDR:
 546                 memcpy(&vp->vp_ipaddr, p, 4);
 547                 break;
 548
 549         case PW_TYPE_IFID:
 550                 memcpy(vp->vp_ifid, p, 8);
 551                 break;
 552
 553         case PW_TYPE_IPV6_ADDR:
 554                 memcpy(&vp->vp_ipv6addr, p, 16);
 555                 break;
 556
 557         case PW_TYPE_IPV6_PREFIX:
 558                 /*
 559                  *      FIXME: double-check that
 560                  *      (vp->vp_octets[1] >> 3) matches vp->vp_length + 2
 561                  */
 562                 memcpy(vp->vp_ipv6prefix, p, vp->vp_length);
 563                 if (vp->vp_length < 18) {
 564                         memset(((uint8_t *)vp->vp_ipv6prefix) + vp->vp_length, 0,
 565                                18 - vp->vp_length);
 566                 }
 567                 break;
 568
 569         case PW_TYPE_IPV4_PREFIX:
 570                 /* FIXME: do the same double-check as for IPv6Prefix */
 571                 memcpy(vp->vp_ipv4prefix, p, vp->vp_length);
 572
 573                 /*
 574                  *      /32 means "keep all bits".  Otherwise, mask
 575                  *      them out.
 576                  */
 577                 if ((p[1] & 0x3f) > 32) {
 578                         uint32_t addr, mask;
 579
 580                         memcpy(&addr, vp->vp_octets + 2, sizeof(addr));
 581                         mask = 1;
 582                         mask <<= (32 - (p[1] & 0x3f));
 583                         mask--;
 584                         mask = ~mask;
 585                         mask = htonl(mask);
 586                         addr &= mask;
 587                         memcpy(vp->vp_ipv4prefix + 2, &addr, sizeof(addr));
 588                 }
 589                 break;
 590
 591         case PW_TYPE_SIGNED:    /* overloaded with vp_integer */
 592                 memcpy(&vp->vp_integer, p, 4);
 593                 vp->vp_integer = ntohl(vp->vp_integer);
 594                 break;
 595
 596         default:
 597                 RERROR("eap_fast_decode_vp: type %d Internal sanity check  %d ", parent->type, __LINE__);
 598                 fr_pair_list_free(&vp);
 599                 return -1;
 600         }
 601         vp->type = VT_DATA;
 602     *out = vp;
 603         return attr_len;
 604 }
 605
 606
 607 VALUE_PAIR *eap_fast_fast2vp(REQUEST *request, SSL *ssl, uint8_t const *data, size_t data_len,
 608                              DICT_ATTR const *fast_da, vp_cursor_t *out)
 609 {
 610         uint16_t        attr;
 611         uint16_t        length;
 612         size_t          data_left = data_len;
 613         VALUE_PAIR      *first = NULL;
 614         VALUE_PAIR      *vp = NULL;
 615         DICT_ATTR const *da;
 616
 617         if (!fast_da)
 618                 fast_da = dict_attrbyvalue(PW_EAP_FAST_TLV, 0);
 619         rad_assert(fast_da != NULL);
 620
 621         if (!out) {
 622                 out = talloc(request, vp_cursor_t);
 623                 rad_assert(out != NULL);
 624                 fr_cursor_init(out, &first);
 625         }
 626
 627         /*
 628          * Decode the TLVs
 629          */
 630         while (data_left > 0) {
 631                 ssize_t decoded;
 632
 633                 /* FIXME do something with mandatory */
 634
 635                 memcpy(&attr, data, sizeof(attr));
 636                 attr = ntohs(attr) & EAP_FAST_TLV_TYPE;
 637
 638                 memcpy(&length, data + 2, sizeof(length));
 639                 length = ntohs(length);
 640
 641                 data += 4;
 642                 data_left -= 4;
 643
 644                 /*
 645                  * Look up the TLV.
 646                  *
 647                  * For now, if it doesn't exist, ignore it.
 648                  */
 649                 da = dict_attrbyparent(fast_da, attr, fast_da->vendor);
 650                 if (!da) {
 651                         RDEBUG("eap_fast_fast2vp: no sub attribute found %s attr: %u vendor: %u",
 652                                         fast_da->name, attr, fast_da->vendor);
 653                         goto next_attr;
 654                 }
 655                 if (da->type == PW_TYPE_TLV) {
 656                         eap_fast_fast2vp(request, ssl, data, length, da, out);
 657                         goto next_attr;
 658                 }
 659                 decoded = eap_fast_decode_vp(request, da, data, length, &vp);
 660                 if (decoded < 0) {
 661                         RERROR("Failed decoding %s: %s", da->name, fr_strerror());
 662                         goto next_attr;
 663                 }
 664
 665                 fr_cursor_merge(out, vp);
 666
 667         next_attr:
 668                 while (fr_cursor_next(out)) {
 669                         /* nothing */
 670                 }
 671
 672                 data += length;
 673                 data_left -= length;
 674         }
 675
 676         /*
 677          * We got this far.  It looks OK.
 678          */
 679         return first;
 680 }
 681
 682
 683 static void eap_vp2fast(tls_session_t *tls_session, VALUE_PAIR *first)
 684 {
 685         VALUE_PAIR      *vp;
 686         vp_cursor_t     cursor;
 687
 688         for (vp = fr_cursor_init(&cursor, &first); vp; vp = fr_cursor_next(&cursor))
 689         {
 690                 if (vp->da->vendor != 0 && vp->da->attr != PW_EAP_MESSAGE) continue;
 691
 692                 eap_fast_tlv_append(tls_session, EAP_FAST_TLV_EAP_PAYLOAD, true, vp->vp_length, vp->vp_octets);
 693         }
 694 }
 695
 696 static void eapfast_copy_request_to_tunnel(REQUEST *request, REQUEST *fake) {
 697     VALUE_PAIR *copy, *vp;
 698     vp_cursor_t cursor;
 699
 700     for (vp = fr_cursor_init(&cursor, &request->packet->vps);
 701          vp;
 702          vp = fr_cursor_next(&cursor)) {
 703         /*
 704          *      The attribute is a server-side thingy,
 705          *      don't copy it.
 706          */
 707         if ((vp->da->attr > 255) && (((vp->da->attr >> 16) & 0xffff) == 0)) {
 708             continue;
 709         }
 710
 711         /*
 712          *      The outside attribute is already in the
 713          *      tunnel, don't copy it.
 714          *
 715          *      This works for BOTH attributes which
 716          *      are originally in the tunneled request,
 717          *      AND attributes which are copied there
 718          *      from below.
 719          */
 720         if (fr_pair_find_by_da(fake->packet->vps, vp->da, TAG_ANY)) continue;
 721
 722         /*
 723          *      Some attributes are handled specially.
 724          */
 725         if (!vp->da->vendor) switch (vp->da->attr) {
 726             /*
 727              *  NEVER copy Message-Authenticator,
 728              *  EAP-Message, or State.  They're
 729              *  only for outside of the tunnel.
 730              */
 731         case PW_USER_NAME:
 732         case PW_USER_PASSWORD:
 733         case PW_CHAP_PASSWORD:
 734         case PW_CHAP_CHALLENGE:
 735         case PW_PROXY_STATE:
 736         case PW_MESSAGE_AUTHENTICATOR:
 737         case PW_EAP_MESSAGE:
 738         case PW_STATE:
 739             continue;
 740
 741             /*
 742              *  By default, copy it over.
 743              */
 744         default:
 745             break;
 746         }
 747
 748         /*
 749          *      Don't copy from the head, we've already
 750          *      checked it.
 751          */
 752         copy = fr_pair_list_copy_by_num(fake->packet, vp, vp->da->attr, vp->da->vendor, TAG_ANY);
 753         fr_pair_add(&fake->packet->vps, copy);
 754     }
 755 }
 756
 757 /*
 758  * Use a reply packet to determine what to do.
 759  */
 760 static rlm_rcode_t CC_HINT(nonnull) process_reply( eap_handler_t *eap_session,
 761                                                   tls_session_t *tls_session,
 762                                                   REQUEST *request, RADIUS_PACKET *reply)
 763 {
 764         rlm_rcode_t                     rcode = RLM_MODULE_REJECT;
 765         VALUE_PAIR                      *vp, *tunnel_vps = NULL;
 766         vp_cursor_t                     cursor;
 767         vp_cursor_t                     to_tunnel;
 768
 769         eap_fast_tunnel_t       *t = tls_session->opaque;
 770
 771         rad_assert(eap_session->request == request);
 772
 773         /*
 774          * If the response packet was Access-Accept, then
 775          * we're OK.  If not, die horribly.
 776          *
 777          * FIXME: Take MS-CHAP2-Success attribute, and
 778          * tunnel it back to the client, to authenticate
 779          * ourselves to the client.
 780          *
 781          * FIXME: If we have an Access-Challenge, then
 782          * the Reply-Message is tunneled back to the client.
 783          *
 784          * FIXME: If we have an EAP-Message, then that message
 785          * must be tunneled back to the client.
 786          *
 787          * FIXME: If we have an Access-Challenge with a State
 788          * attribute, then do we tunnel that to the client, or
 789          * keep track of it ourselves?
 790          *
 791          * FIXME: EAP-Messages can only start with 'identity',
 792          * NOT 'eap start', so we should check for that....
 793          */
 794         switch (reply->code) {
 795         case PW_CODE_ACCESS_ACCEPT:
 796                 RDEBUG("Got tunneled Access-Accept");
 797                 fr_cursor_init(&to_tunnel, &tunnel_vps);
 798                 rcode = RLM_MODULE_OK;
 799
 800                 for (vp = fr_cursor_init(&cursor, &reply->vps); vp; vp = fr_cursor_next(&cursor)) {
 801                         switch (vp->da->vendor) {
 802                         case VENDORPEC_MICROSOFT:
 803                                 /* FIXME must be a better way to capture/re-derive this later for ISK */
 804                 switch(vp->da->attr) {
 805                 case PW_MSCHAP_MPPE_SEND_KEY:
 806                                         memcpy(t->isk.mppe_send, vp->vp_octets, CHAP_VALUE_LENGTH);
 807                     break;
 808
 809                 case PW_MSCHAP_MPPE_RECV_KEY:
 810                                         memcpy(t->isk.mppe_recv, vp->vp_octets, CHAP_VALUE_LENGTH);
 811                     break;
 812
 813                 case PW_MSCHAP2_SUCCESS:
 814                                         RDEBUG("Got %s, tunneling it to the client in a challenge", vp->da->name);
 815                                         rcode = RLM_MODULE_HANDLED;
 816                     if (t->use_tunneled_reply) {
 817                         t->authenticated = true;
 818                         /*
 819                          *      Clean up the tunneled reply.
 820                          */
 821                         fr_pair_delete_by_num(&reply->vps, PW_PROXY_STATE, 0, TAG_ANY);
 822                         fr_pair_delete_by_num(&reply->vps, PW_EAP_MESSAGE, 0, TAG_ANY);
 823                         fr_pair_delete_by_num(&reply->vps, PW_MESSAGE_AUTHENTICATOR, 0, TAG_ANY);
 824
 825                         /*
 826                          *      Delete MPPE keys & encryption policy.  We don't
 827                          *      want these here.
 828                          */
 829                         fr_pair_delete_by_num(&reply->vps, 7, VENDORPEC_MICROSOFT, TAG_ANY);
 830                         fr_pair_delete_by_num(&reply->vps, 8, VENDORPEC_MICROSOFT, TAG_ANY);
 831                         fr_pair_delete_by_num(&reply->vps, 16, VENDORPEC_MICROSOFT, TAG_ANY);
 832                         fr_pair_delete_by_num(&reply->vps, 17, VENDORPEC_MICROSOFT, TAG_ANY);
 833
 834                         fr_pair_list_free(&t->accept_vps); /* for proxying MS-CHAP2 */
 835                         fr_pair_list_mcopy_by_num(t, &t->accept_vps, &reply->vps, 0, 0, TAG_ANY);
 836                         rad_assert(!reply->vps);
 837                     }
 838                     break;
 839
 840                 default:
 841                     break;
 842                                 }
 843                                 break;
 844
 845                         default:
 846                                 break;
 847                         }
 848                 }
 849                 break;
 850
 851         case PW_CODE_ACCESS_REJECT:
 852                 RDEBUG("Got tunneled Access-Reject");
 853                 rcode = RLM_MODULE_REJECT;
 854                 break;
 855
 856         /*
 857          * Handle Access-Challenge, but only if we
 858          * send tunneled reply data.  This is because
 859          * an Access-Challenge means that we MUST tunnel
 860          * a Reply-Message to the client.
 861          */
 862         case PW_CODE_ACCESS_CHALLENGE:
 863                 RDEBUG("Got tunneled Access-Challenge");
 864
 865                 /*
 866                  *      Keep the State attribute, if necessary.
 867                  *
 868                  *      Get rid of the old State, too.
 869                  */
 870                 fr_pair_list_free(&t->state);
 871                 fr_pair_list_mcopy_by_num(t, &t->state, &reply->vps, PW_STATE, 0, TAG_ANY);
 872
 873                 /*
 874                  *      We should really be a bit smarter about this,
 875                  *      and move over only those attributes which
 876                  *      are relevant to the authentication request,
 877                  *      but that's a lot more work, and this "dumb"
 878                  *      method works in 99.9% of the situations.
 879                  */
 880                 vp = NULL;
 881                 fr_pair_list_mcopy_by_num(t, &vp, &reply->vps, PW_EAP_MESSAGE, 0, TAG_ANY);
 882
 883                 /*
 884                  *      There MUST be a Reply-Message in the challenge,
 885                  *      which we tunnel back to the client.
 886                  *
 887                  *      If there isn't one in the reply VP's, then
 888                  *      we MUST create one, with an empty string as
 889                  *      it's value.
 890                  */
 891                 fr_pair_list_mcopy_by_num(t, &vp, &reply->vps, PW_REPLY_MESSAGE, 0, TAG_ANY);
 892
 893         if (vp) {
 894             RDEBUG("Sending tunneled reply attributes");
 895             eap_vp2fast(tls_session, vp);
 896             fr_pair_list_free(&vp);
 897         }
 898
 899                 rcode = RLM_MODULE_HANDLED;
 900                 break;
 901
 902         default:
 903                 RDEBUG("Unknown RADIUS packet type %d: rejecting tunneled user", reply->code);
 904                 rcode = RLM_MODULE_INVALID;
 905                 break;
 906         }
 907
 908
 909         /*
 910          * Pack any tunnelled VPs and send them back
 911          * to the supplicant.
 912          */
 913         if (tunnel_vps) {
 914                 RDEBUG("Sending tunneled reply attributes");
 915                 rdebug_pair_list(L_DBG_LVL_2, request, tunnel_vps, NULL);
 916
 917                 eap_vp2fast(tls_session, tunnel_vps);
 918                 fr_pair_list_free(&tunnel_vps);
 919         }
 920
 921         return rcode;
 922 }
 923
 924 static PW_CODE eap_fast_eap_payload(REQUEST *request, eap_handler_t *eap_session,
 925                                     tls_session_t *tls_session, VALUE_PAIR *tlv_eap_payload)
 926 {
 927         PW_CODE                 code = PW_CODE_ACCESS_REJECT;
 928         rlm_rcode_t             rcode;
 929         VALUE_PAIR              *vp;
 930         eap_fast_tunnel_t       *t;
 931         REQUEST                 *fake;
 932
 933         RDEBUG("Processing received EAP Payload");
 934
 935         /*
 936          * Allocate a fake REQUEST structure.
 937          */
 938         fake = request_alloc_fake(request);
 939         rad_assert(!fake->packet->vps);
 940
 941         t = (eap_fast_tunnel_t *) tls_session->opaque;
 942
 943         /*
 944          * Add the tunneled attributes to the fake request.
 945          */
 946
 947         fake->packet->vps = fr_pair_afrom_num(fake->packet, PW_EAP_MESSAGE, 0);
 948         fr_pair_value_memcpy(fake->packet->vps, tlv_eap_payload->vp_octets, tlv_eap_payload->vp_length);
 949
 950         RDEBUG("Got tunneled request");
 951         rdebug_pair_list(L_DBG_LVL_1, request, fake->packet->vps, NULL);
 952
 953         /*
 954          * Tell the request that it's a fake one.
 955          */
 956         fr_pair_make(fake->packet, &fake->packet->vps, "Freeradius-Proxied-To", "127.0.0.1", T_OP_EQ);
 957
 958         /*
 959          * Update other items in the REQUEST data structure.
 960          */
 961         fake->username = fr_pair_find_by_num(fake->packet->vps, PW_USER_NAME, 0, TAG_ANY);
 962         fake->password = fr_pair_find_by_num(fake->packet->vps, PW_USER_PASSWORD, 0, TAG_ANY);
 963
 964         /*
 965          * No User-Name, try to create one from stored data.
 966          */
 967         if (!fake->username) {
 968                 /*
 969                  * No User-Name in the stored data, look for
 970                  * an EAP-Identity, and pull it out of there.
 971                  */
 972                 if (!t->username) {
 973                         vp = fr_pair_find_by_num(fake->packet->vps, PW_EAP_MESSAGE, 0, TAG_ANY);
 974                         if (vp &&
 975                             (vp->vp_length >= EAP_HEADER_LEN + 2) &&
 976                             (vp->vp_strvalue[0] == PW_EAP_RESPONSE) &&
 977                             (vp->vp_strvalue[EAP_HEADER_LEN] == PW_EAP_IDENTITY) &&
 978                             (vp->vp_strvalue[EAP_HEADER_LEN + 1] != 0)) {
 979                                 /*
 980                                  * Create & remember a User-Name
 981                                  */
 982                                 t->username = fr_pair_make(t, NULL, "User-Name", NULL, T_OP_EQ);
 983                                 rad_assert(t->username != NULL);
 984
 985                                 fr_pair_value_bstrncpy(t->username, vp->vp_octets + 5, vp->vp_length - 5);
 986
 987                                 RDEBUG("Got tunneled identity of %s", t->username->vp_strvalue);
 988                         } else {
 989                                 /*
 990                                  * Don't reject the request outright,
 991                                  * as it's permitted to do EAP without
 992                                  * user-name.
 993                                  */
 994                                 RWDEBUG2("No EAP-Identity found to start EAP conversation");
 995                         }
 996                 } /* else there WAS a t->username */
 997
 998                 if (t->username) {
 999                         vp = fr_pair_list_copy(fake->packet, t->username);
1000                         fr_pair_add(&fake->packet->vps, vp);
1001                         fake->username = vp;
1002                 }
1003         } /* else the request ALREADY had a User-Name */
1004
1005         /*
1006          *      Add the State attribute, too, if it exists.
1007          */
1008         if (t->state) {
1009                 vp = fr_pair_list_copy(fake->packet, t->state);
1010                 if (vp) fr_pair_add(&fake->packet->vps, vp);
1011         }
1012
1013
1014         if (t->stage == AUTHENTICATION) {       /* FIXME do this only for MSCHAPv2 */
1015                 VALUE_PAIR *tvp;
1016
1017         RWDEBUG2("AUTHENTICATION");
1018         vp = fr_pair_make(fake, &fake->config, "EAP-Type", "0", T_OP_EQ);
1019         vp->vp_integer = t->default_method;
1020         RWDEBUG2("AUTHENTICATION");
1021
1022                 /*
1023                  * RFC 5422 section 3.2.3 - Authenticating Using EAP-FAST-MSCHAPv2
1024                  */
1025                 if (t->mode == EAP_FAST_PROVISIONING_ANON) {
1026                         tvp = fr_pair_afrom_num(fake->packet, PW_MSCHAP_CHALLENGE, VENDORPEC_MICROSOFT);
1027                         fr_pair_value_memcpy(tvp, t->keyblock->server_challenge, CHAP_VALUE_LENGTH);
1028                         fr_pair_add(&fake->config, tvp);
1029
1030                         tvp = fr_pair_afrom_num(fake->packet, PW_MS_CHAP_PEER_CHALLENGE, 0);
1031                         fr_pair_value_memcpy(tvp, t->keyblock->client_challenge, CHAP_VALUE_LENGTH);
1032                         fr_pair_add(&fake->config, tvp);
1033                 }
1034         }
1035
1036         /*
1037          * Call authentication recursively, which will
1038          * do PAP, CHAP, MS-CHAP, etc.
1039          */
1040         rad_virtual_server(fake);
1041
1042         /*
1043          * Decide what to do with the reply.
1044          */
1045         switch (fake->reply->code) {
1046         case 0:                 /* No reply code, must be proxied... */
1047 #ifdef WITH_PROXY
1048                 vp = fr_pair_find_by_num(fake->config, PW_PROXY_TO_REALM, 0, TAG_ANY);
1049                 if (vp) {
1050                         int                     ret;
1051                         eap_tunnel_data_t       *tunnel;
1052
1053                         RDEBUG("Tunneled authentication will be proxied to %s", vp->vp_strvalue);
1054
1055                         /*
1056                          * Tell the original request that it's going
1057                          * to be proxied.
1058                          */
1059                         fr_pair_list_mcopy_by_num(request, &request->config, &fake->config, PW_PROXY_TO_REALM, 0,
1060                                                    TAG_ANY);
1061
1062                         /*
1063                          * Seed the proxy packet with the
1064                          * tunneled request.
1065                          */
1066                         rad_assert(!request->proxy);
1067
1068                         request->proxy = talloc_steal(request, fake->packet);
1069
1070                         memset(&request->proxy->src_ipaddr, 0,
1071                                sizeof(request->proxy->src_ipaddr));
1072                         memset(&request->proxy->src_ipaddr, 0,
1073                                sizeof(request->proxy->src_ipaddr));
1074                         request->proxy->src_port = 0;
1075                         request->proxy->dst_port = 0;
1076                         fake->packet = NULL;
1077                         rad_free(&fake->reply);
1078                         fake->reply = NULL;
1079
1080                         /*
1081                          * Set up the callbacks for the tunnel
1082                          */
1083                         tunnel = talloc_zero(request, eap_tunnel_data_t);
1084                         tunnel->tls_session = tls_session;
1085
1086                         /*
1087                          * Associate the callback with the request.
1088                          */
1089                         ret = request_data_add(request, request->proxy, REQUEST_DATA_EAP_TUNNEL_CALLBACK,
1090                                                tunnel, false);
1091                         rad_assert(ret == 0);
1092
1093                         /*
1094                          * rlm_eap.c has taken care of associating
1095                          * the eap_session with the fake request.
1096                          *
1097                          * So we associate the fake request with
1098                          * this request.
1099                          */
1100                         ret = request_data_add(request, request->proxy, REQUEST_DATA_EAP_MSCHAP_TUNNEL_CALLBACK,
1101                                                fake, true);
1102                         rad_assert(ret == 0);
1103
1104                         fake = NULL;
1105
1106                         /*
1107                          * Didn't authenticate the packet, but
1108                          * we're proxying it.
1109                          */
1110                         code = PW_CODE_STATUS_CLIENT;
1111
1112                 } else
1113 #endif  /* WITH_PROXY */
1114                   {
1115                           RDEBUG("No tunneled reply was found, and the request was not proxied: rejecting the user.");
1116                           code = PW_CODE_ACCESS_REJECT;
1117                   }
1118                 break;
1119
1120         default:
1121                 /*
1122                  * Returns RLM_MODULE_FOO, and we want to return PW_FOO
1123                  */
1124                 rcode = process_reply(eap_session, tls_session, request, fake->reply);
1125                 switch (rcode) {
1126                 case RLM_MODULE_REJECT:
1127                         code = PW_CODE_ACCESS_REJECT;
1128                         break;
1129
1130                 case RLM_MODULE_HANDLED:
1131                         code = PW_CODE_ACCESS_CHALLENGE;
1132                         break;
1133
1134                 case RLM_MODULE_OK:
1135                         code = PW_CODE_ACCESS_ACCEPT;
1136                         break;
1137
1138                 default:
1139                         code = PW_CODE_ACCESS_REJECT;
1140                         break;
1141                 }
1142                 break;
1143         }
1144
1145         talloc_free(fake);
1146
1147         return code;
1148 }
1149
1150 static PW_CODE eap_fast_crypto_binding(REQUEST *request, UNUSED eap_handler_t *eap_session,
1151                                        tls_session_t *tls_session, eap_tlv_crypto_binding_tlv_t *binding)
1152 {
1153         uint8_t                 cmac[sizeof(binding->compound_mac)];
1154         eap_fast_tunnel_t       *t = tls_session->opaque;
1155
1156         memcpy(cmac, binding->compound_mac, sizeof(cmac));
1157         memset(binding->compound_mac, 0, sizeof(binding->compound_mac));
1158
1159
1160         fr_hmac_sha1(binding->compound_mac, (uint8_t *)binding, sizeof(*binding), t->cmk, EAP_FAST_CMK_LEN);
1161         if (memcmp(binding->compound_mac, cmac, sizeof(cmac))) {
1162                 RDEBUG2("Crypto-Binding TLV mis-match");
1163                 return PW_CODE_ACCESS_REJECT;
1164         }
1165
1166         return PW_CODE_ACCESS_ACCEPT;
1167 }
1168
1169 #define EAP_FAST_TLV_VENDOR_ID 0xa7000000
1170 #define EAP_FAST_TLV_SUB_ID(_id)    (EAP_FAST_TLV_VENDOR_ID | _id)
1171 #define EAP_FAST_PAC_SUB_ID(_id)    ( (_id << 0 ) | 0x0b)
1172
1173
1174 static PW_CODE eap_fast_process_tlvs(REQUEST *request, eap_handler_t *eap_session,
1175                                      tls_session_t *tls_session, VALUE_PAIR *fast_vps)
1176 {
1177         eap_fast_tunnel_t               *t = (eap_fast_tunnel_t *) tls_session->opaque;
1178         VALUE_PAIR                      *vp;
1179         vp_cursor_t                     cursor;
1180         eap_tlv_crypto_binding_tlv_t    *binding = NULL;
1181
1182         for (vp = fr_cursor_init(&cursor, &fast_vps); vp; vp = fr_cursor_next(&cursor)) {
1183                 PW_CODE code = PW_CODE_ACCESS_REJECT;
1184                 char *value;
1185         unsigned int parent = vp->da->vendor;
1186         if (parent != EAP_FAST_TLV_VENDOR_ID) {
1187                         value = vp_aprints_value(request->packet, vp, '"');
1188                         RDEBUG2("ignoring non-EAP-FAST TLV %s", value);
1189                         talloc_free(value);
1190                         continue;
1191         }
1192         if (vp->da->attr & 0xff00) {
1193             parent |= (vp->da->attr & 0xff);
1194         }
1195         RDEBUG("vp->da->vendor 0x%08x, vp->da->attr 0x%08x", vp->da->vendor, vp->da->attr);
1196
1197                 switch (parent) {
1198                 case EAP_FAST_TLV_VENDOR_ID:
1199                         switch (vp->da->attr) {
1200                         case EAP_FAST_TLV_EAP_PAYLOAD:
1201                                 code = eap_fast_eap_payload(request, eap_session, tls_session, vp);
1202                                 if (code == PW_CODE_ACCESS_ACCEPT)
1203                                         t->stage = CRYPTOBIND_CHECK;
1204                                 break;
1205                         case EAP_FAST_TLV_RESULT:
1206                         case EAP_FAST_TLV_INTERMED_RESULT:
1207                                 code = PW_CODE_ACCESS_ACCEPT;
1208                                 t->stage = PROVISIONING;
1209                                 break;
1210             case EAP_FAST_TLV_CRYPTO_BINDING:
1211                 if (!binding) {
1212                     binding = talloc_zero(request->packet, eap_tlv_crypto_binding_tlv_t);
1213                     memcpy(binding, vp->vp_octets, sizeof(*binding));
1214                     binding->tlv_type = htons(EAP_FAST_TLV_MANDATORY | EAP_FAST_TLV_CRYPTO_BINDING);
1215                     binding->length = htons(sizeof(*binding) - 2 * sizeof(uint16_t));
1216                 }
1217                                 continue;
1218                         default:
1219                                 value = vp_aprints_value(request->packet, vp, '"');
1220                                 RDEBUG2("ignoring unknown %s", value);
1221                                 talloc_free(value);
1222                                 continue;
1223                         }
1224                         break;
1225                 case EAP_FAST_TLV_SUB_ID(EAP_FAST_TLV_PAC):
1226                         switch ( ( vp->da->attr >> 8 )) {
1227                         case PAC_INFO_PAC_ACK:
1228                                 if (vp->vp_integer == EAP_FAST_TLV_RESULT_SUCCESS) {
1229                                         code = PW_CODE_ACCESS_ACCEPT;
1230                                         t->pac.expires = UINT32_MAX;
1231                                         t->pac.expired = false;
1232                                         t->stage = COMPLETE;
1233                                 }
1234                                 break;
1235                         case PAC_INFO_PAC_TYPE:
1236                                 if (vp->vp_integer != PAC_TYPE_TUNNEL) {
1237                                         RDEBUG("only able to serve Tunnel PAC's, ignoring request");
1238                                         continue;
1239                                 }
1240                                 t->pac.send = true;
1241                                 continue;
1242                         default:
1243                                 value = vp_aprints_value(request->packet, vp, '"');
1244                                 RDEBUG2("ignoring unknown EAP-FAST-PAC-TLV %s", value);
1245                                 talloc_free(value);
1246                                 continue;
1247                         }
1248                         break;
1249                 default:
1250                         value = vp_aprints_value(request->packet, vp, '"');
1251                         RDEBUG2("ignoring non-EAP-FAST TLV %s", value);
1252                         talloc_free(value);
1253                         continue;
1254                 }
1255
1256                 if (code == PW_CODE_ACCESS_REJECT)
1257                         return PW_CODE_ACCESS_REJECT;
1258         }
1259
1260         if (binding) {
1261                 PW_CODE code = eap_fast_crypto_binding(request, eap_session, tls_session, binding);
1262                 if (code == PW_CODE_ACCESS_ACCEPT)
1263                         t->stage = PROVISIONING;
1264         }
1265
1266         return PW_CODE_ACCESS_ACCEPT;
1267 }
1268
1269
1270 /*
1271  * Process the inner tunnel data
1272  */
1273 PW_CODE eap_fast_process(eap_handler_t *eap_session, tls_session_t *tls_session)
1274 {
1275         PW_CODE                 code;
1276         VALUE_PAIR              *fast_vps;
1277         uint8_t                 const *data;
1278         size_t                  data_len;
1279         eap_fast_tunnel_t               *t;
1280         REQUEST                 *request = eap_session->request;
1281
1282         /*
1283          * Just look at the buffer directly, without doing
1284          * record_to_buff.
1285          */
1286         data_len = tls_session->clean_out.used;
1287         tls_session->clean_out.used = 0;
1288         data = tls_session->clean_out.data;
1289
1290         t = (eap_fast_tunnel_t *) tls_session->opaque;
1291
1292         /*
1293          * See if the tunneled data is well formed.
1294          */
1295         if (!eap_fast_verify(request, tls_session, data, data_len)) return PW_CODE_ACCESS_REJECT;
1296
1297         if (t->stage == TLS_SESSION_HANDSHAKE) {
1298                 rad_assert(t->mode == EAP_FAST_UNKNOWN);
1299
1300                 char buf[256];
1301                 if (strstr(SSL_CIPHER_description(SSL_get_current_cipher(tls_session->ssl),
1302                                                   buf, sizeof(buf)), "Au=None")) {
1303                         /* FIXME enforce MSCHAPv2 - RFC 5422 section 3.2.2 */
1304                         RDEBUG2("Using anonymous provisioning");
1305                         t->mode = EAP_FAST_PROVISIONING_ANON;
1306                         t->pac.send = true;
1307                 } else {
1308                         if (SSL_session_reused(tls_session->ssl)) {
1309                                 RDEBUG("Session Resumed from PAC");
1310                                 t->mode = EAP_FAST_NORMAL_AUTH;
1311                         } else {
1312                                 RDEBUG2("Using authenticated provisioning");
1313                                 t->mode = EAP_FAST_PROVISIONING_AUTH;
1314                         }
1315
1316                         if (!t->pac.expires || t->pac.expired || t->pac.expires - time(NULL) < t->pac_lifetime * 0.6)
1317                                 t->pac.send = true;
1318                 }
1319
1320                 eap_fast_init_keys(request, tls_session);
1321
1322                 eap_fast_send_identity_request(request, tls_session, eap_session);
1323
1324                 t->stage = AUTHENTICATION;
1325                 return PW_CODE_ACCESS_CHALLENGE;
1326         }
1327
1328         fast_vps = eap_fast_fast2vp(request, tls_session->ssl, data, data_len, NULL, NULL);
1329
1330         RDEBUG("Got Tunneled FAST TLVs");
1331         rdebug_pair_list(L_DBG_LVL_1, request, fast_vps, NULL);
1332
1333         code = eap_fast_process_tlvs(request, eap_session, tls_session, fast_vps);
1334
1335         fr_pair_list_free(&fast_vps);
1336
1337         if (code == PW_CODE_ACCESS_REJECT) return PW_CODE_ACCESS_REJECT;
1338
1339         switch (t->stage) {
1340         case AUTHENTICATION:
1341                 code = PW_CODE_ACCESS_CHALLENGE;
1342                 break;
1343         case CRYPTOBIND_CHECK:
1344         {
1345                 if (t->mode != EAP_FAST_PROVISIONING_ANON && !t->pac.send)
1346                         t->result_final = true;
1347
1348                 eap_fast_append_result(tls_session, code);
1349
1350                 eap_fast_update_icmk(request, tls_session, (uint8_t *)&t->isk);
1351                 eap_fast_append_crypto_binding(request, tls_session);
1352
1353                 code = PW_CODE_ACCESS_CHALLENGE;
1354                 break;
1355         }
1356         case PROVISIONING:
1357                 t->result_final = true;
1358
1359                 eap_fast_append_result(tls_session, code);
1360
1361                 if (code == PW_CODE_ACCESS_REJECT)
1362                         break;
1363
1364                 if (t->pac.send) {
1365                         RDEBUG("Peer requires new PAC");
1366                         eap_fast_send_pac_tunnel(request, tls_session);
1367                         code = PW_CODE_ACCESS_CHALLENGE;
1368                         break;
1369                 }
1370
1371                 t->stage = COMPLETE;
1372                 /* fallthrough */
1373         case COMPLETE:
1374                 /*
1375                  * RFC 5422 section 3.5 - Network Access after EAP-FAST Provisioning
1376                  */
1377                 if ((t->pac.type && t->pac.expired) || t->mode == EAP_FAST_PROVISIONING_ANON) {
1378                         RDEBUG("Rejecting expired PAC or unauthenticated provisioning");
1379                         code = PW_CODE_ACCESS_REJECT;
1380                         break;
1381                 }
1382
1383                 /*
1384                  * eap_tls_gen_mppe_keys() is unsuitable for EAP-FAST as Cisco decided
1385                  * it would be a great idea to flip the recv/send keys around
1386                  */
1387                 #define EAPTLS_MPPE_KEY_LEN 32
1388                 eap_add_reply(request, "MS-MPPE-Recv-Key", t->msk, EAPTLS_MPPE_KEY_LEN);
1389                 eap_add_reply(request, "MS-MPPE-Send-Key", &t->msk[EAPTLS_MPPE_KEY_LEN], EAPTLS_MPPE_KEY_LEN);
1390                 eap_add_reply(request, "EAP-MSK", t->msk, EAP_FAST_KEY_LEN);
1391                 eap_add_reply(request, "EAP-EMSK", t->emsk, EAP_EMSK_LEN);
1392
1393                 break;
1394         default:
1395                 RERROR("no idea! %d", t->stage);
1396                 code = PW_CODE_ACCESS_REJECT;
1397         }
1398
1399         return code;
1400 }