src/modules/rlm_eap/types/rlm_eap_fast/eap_fast.c

   1 /*
   2  * eap_fast.c  contains the interfaces that are called from the main handler
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  *   Copyright 2016 Alan DeKok <aland@freeradius.org>
  21  *   Copyright 2016 The FreeRADIUS server project
  22  */
  23
  24 RCSID("$Id$")
  25
  26 #include "eap_fast.h"
  27 #include "eap_fast_crypto.h"
  28 #include <freeradius-devel/sha1.h>
  29 #include <openssl/ssl.h>
  30 #include <openssl/rand.h>
  31
  32 #define RANDFILL(x) do { rad_assert(sizeof(x) % sizeof(uint32_t) == 0); for (size_t i = 0; i < sizeof(x); i += sizeof(uint32_t)) *((uint32_t *)&x[i]) = fr_rand(); } while(0)
  33
  34 /*
  35  * Copyright (c) 2002-2016, Jouni Malinen <j@w1.fi> and contributors
  36  * All Rights Reserved.
  37  *
  38  * These programs are licensed under the BSD license (the one with
  39  * advertisement clause removed).
  40  *
  41  * this function shamelessly stolen from from hostap:src/crypto/tls_openssl.c
  42  */
  43 static int openssl_get_keyblock_size(REQUEST *request, SSL *ssl)
  44 {
  45         const EVP_CIPHER *c;
  46         const EVP_MD *h;
  47 #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
  48         int md_size;
  49
  50         if (ssl->enc_read_ctx == NULL || ssl->enc_read_ctx->cipher == NULL ||
  51             ssl->read_hash == NULL)
  52                 return -1;
  53
  54         c = ssl->enc_read_ctx->cipher;
  55         h = EVP_MD_CTX_md(ssl->read_hash);
  56         if (h)
  57                 md_size = EVP_MD_size(h);
  58         else if (ssl->s3)
  59                 md_size = ssl->s3->tmp.new_mac_secret_size;
  60         else
  61                 return -1;
  62
  63         RDEBUG2("OpenSSL: keyblock size: key_len=%d MD_size=%d "
  64                    "IV_len=%d", EVP_CIPHER_key_length(c), md_size,
  65                    EVP_CIPHER_iv_length(c));
  66         return 2 * (EVP_CIPHER_key_length(c) +
  67                     md_size +
  68                     EVP_CIPHER_iv_length(c));
  69 #else
  70         const SSL_CIPHER *ssl_cipher;
  71         int cipher, digest;
  72
  73         ssl_cipher = SSL_get_current_cipher(ssl);
  74         if (!ssl_cipher)
  75                 return -1;
  76         cipher = SSL_CIPHER_get_cipher_nid(ssl_cipher);
  77         digest = SSL_CIPHER_get_digest_nid(ssl_cipher);
  78         RDEBUG2("OpenSSL: cipher nid %d digest nid %d", cipher, digest);
  79         if (cipher < 0 || digest < 0)
  80                 return -1;
  81         c = EVP_get_cipherbynid(cipher);
  82         h = EVP_get_digestbynid(digest);
  83         if (!c || !h)
  84                 return -1;
  85
  86         RDEBUG2("OpenSSL: keyblock size: key_len=%d MD_size=%d IV_len=%d",
  87                    EVP_CIPHER_key_length(c), EVP_MD_size(h),
  88                    EVP_CIPHER_iv_length(c));
  89         return 2 * (EVP_CIPHER_key_length(c) + EVP_MD_size(h) +
  90                     EVP_CIPHER_iv_length(c));
  91 #endif
  92 }
  93
  94 /**
  95  * RFC 4851 section 5.1 - EAP-FAST Authentication Phase 1: Key Derivations
  96  */
  97 static void eap_fast_init_keys(REQUEST *request, tls_session_t *tls_session)
  98 {
  99         eap_fast_tunnel_t *t = tls_session->opaque;
 100         uint8_t *buf;
 101         uint8_t *scratch;
 102         size_t ksize;
 103
 104         RDEBUG2("Deriving EAP-FAST keys");
 105
 106         rad_assert(t->simck == NULL);
 107
 108         ksize = openssl_get_keyblock_size(request, tls_session->ssl);
 109         rad_assert(ksize > 0);
 110         buf = talloc_size(request, ksize + sizeof(*t->keyblock));
 111         scratch = talloc_size(request, ksize + sizeof(*t->keyblock));
 112
 113         t->keyblock = talloc(t, eap_fast_keyblock_t);
 114
 115         eap_fast_tls_gen_challenge(tls_session->ssl, buf, scratch, ksize + sizeof(*t->keyblock), "key expansion");
 116         memcpy(t->keyblock, &buf[ksize], sizeof(*t->keyblock));
 117         memset(buf, 0, ksize + sizeof(*t->keyblock));
 118
 119         t->simck = talloc_size(t, EAP_FAST_SIMCK_LEN);
 120         memcpy(t->simck, t->keyblock, EAP_FAST_SKS_LEN);        /* S-IMCK[0] = session_key_seed */
 121
 122         t->cmk = talloc_size(t, EAP_FAST_CMK_LEN);      /* note that CMK[0] is not defined */
 123         t->imckc = 0;
 124
 125         talloc_free(buf);
 126         talloc_free(scratch);
 127 }
 128
 129 /**
 130  * RFC 4851 section 5.2 - Intermediate Compound Key Derivations
 131  */
 132 static void eap_fast_update_icmk(REQUEST *request, tls_session_t *tls_session, uint8_t *msk)
 133 {
 134         eap_fast_tunnel_t *t = tls_session->opaque;
 135         uint8_t imck[EAP_FAST_SIMCK_LEN + EAP_FAST_CMK_LEN];
 136
 137         RDEBUG2("Updating ICMK");
 138
 139         T_PRF(t->simck, EAP_FAST_SIMCK_LEN, "Inner Methods Compound Keys", msk, 32, imck, sizeof(imck));
 140
 141         memcpy(t->simck, imck, EAP_FAST_SIMCK_LEN);
 142         memcpy(t->cmk, &imck[EAP_FAST_SIMCK_LEN], EAP_FAST_CMK_LEN);
 143         t->imckc++;
 144
 145         /*
 146          * Calculate MSK/EMSK at the same time as they are coupled to ICMK
 147          *
 148          * RFC 4851 section 5.4 - EAP Master Session Key Generation
 149          */
 150         t->msk = talloc_size(t, EAP_FAST_KEY_LEN);
 151         T_PRF(t->simck, EAP_FAST_SIMCK_LEN, "Session Key Generating Function", NULL, 0, t->msk, EAP_FAST_KEY_LEN);
 152
 153         t->emsk = talloc_size(t, EAP_EMSK_LEN);
 154         T_PRF(t->simck, EAP_FAST_SIMCK_LEN, "Extended Session Key Generating Function", NULL, 0, t->emsk, EAP_EMSK_LEN);
 155 }
 156
 157 void eap_fast_tlv_append(tls_session_t *tls_session, int tlv, bool mandatory, int length, const void *data)
 158 {
 159         uint16_t hdr[2];
 160
 161         hdr[0] = (mandatory) ? htons(tlv | EAP_FAST_TLV_MANDATORY) : htons(tlv);
 162         hdr[1] = htons(length);
 163
 164         tls_session->record_plus(&tls_session->clean_in, &hdr, 4);
 165         tls_session->record_plus(&tls_session->clean_in, data, length);
 166 }
 167
 168 static void eap_fast_send_error(tls_session_t *tls_session, int error)
 169 {
 170         uint32_t value;
 171         value = htonl(error);
 172
 173         eap_fast_tlv_append(tls_session, EAP_FAST_TLV_ERROR, true, sizeof(value), &value);
 174 }
 175
 176 static void eap_fast_append_result(tls_session_t *tls_session, PW_CODE code)
 177 {
 178         eap_fast_tunnel_t *t = (eap_fast_tunnel_t *) tls_session->opaque;
 179
 180         int type = (t->result_final)
 181                         ? EAP_FAST_TLV_RESULT
 182                         : EAP_FAST_TLV_INTERMED_RESULT;
 183
 184         uint16_t state = (code == PW_CODE_ACCESS_REJECT)
 185                         ? EAP_FAST_TLV_RESULT_FAILURE
 186                         : EAP_FAST_TLV_RESULT_SUCCESS;
 187         state = htons(state);
 188
 189         eap_fast_tlv_append(tls_session, type, true, sizeof(state), &state);
 190 }
 191
 192 static void eap_fast_send_identity_request(REQUEST *request, tls_session_t *tls_session, eap_handler_t *eap_session)
 193 {
 194         eap_packet_raw_t eap_packet;
 195
 196         RDEBUG("Sending EAP-Identity");
 197
 198         eap_packet.code = PW_EAP_REQUEST;
 199         eap_packet.id = eap_session->eap_ds->response->id + 1;
 200         eap_packet.length[0] = 0;
 201         eap_packet.length[1] = EAP_HEADER_LEN + 1;
 202         eap_packet.data[0] = PW_EAP_IDENTITY;
 203
 204         eap_fast_tlv_append(tls_session, EAP_FAST_TLV_EAP_PAYLOAD, true, sizeof(eap_packet), &eap_packet);
 205 }
 206
 207 static void eap_fast_send_pac_tunnel(REQUEST *request, tls_session_t *tls_session)
 208 {
 209         eap_fast_tunnel_t                       *t = tls_session->opaque;
 210         eap_fast_pac_t                          pac;
 211         eap_fast_attr_pac_opaque_plaintext_t    opaque_plaintext;
 212         int                                     alen, dlen;
 213
 214         memset(&pac, 0, sizeof(pac));
 215         memset(&opaque_plaintext, 0, sizeof(opaque_plaintext));
 216
 217         RDEBUG("Sending Tunnel PAC");
 218
 219         pac.key.hdr.type = htons(EAP_FAST_TLV_MANDATORY | PAC_INFO_PAC_KEY);
 220         pac.key.hdr.length = htons(sizeof(pac.key.data));
 221         rad_assert(sizeof(pac.key.data) % sizeof(uint32_t) == 0);
 222         RANDFILL(pac.key.data);
 223
 224         pac.info.lifetime.hdr.type = htons(PAC_INFO_PAC_LIFETIME);
 225         pac.info.lifetime.hdr.length = htons(sizeof(pac.info.lifetime.data));
 226         pac.info.lifetime.data = htonl(time(NULL) + t->pac_lifetime);
 227
 228         pac.info.a_id.hdr.type = htons(EAP_FAST_TLV_MANDATORY | PAC_INFO_A_ID);
 229         pac.info.a_id.hdr.length = htons(sizeof(pac.info.a_id.data));
 230         memcpy(pac.info.a_id.data, t->a_id, sizeof(pac.info.a_id.data));
 231
 232         pac.info.a_id_info.hdr.type = htons(PAC_INFO_A_ID_INFO);
 233         pac.info.a_id_info.hdr.length = htons(sizeof(pac.info.a_id_info.data));
 234         #define MIN(a,b) (((a)>(b)) ? (b) : (a))
 235         alen = MIN(talloc_array_length(t->authority_identity) - 1, sizeof(pac.info.a_id_info.data));
 236         memcpy(pac.info.a_id_info.data, t->authority_identity, alen);
 237
 238         pac.info.type.hdr.type = htons(EAP_FAST_TLV_MANDATORY | PAC_INFO_PAC_TYPE);
 239         pac.info.type.hdr.length = htons(sizeof(pac.info.type.data));
 240         pac.info.type.data = htons(PAC_TYPE_TUNNEL);
 241
 242         pac.info.hdr.type = htons(EAP_FAST_TLV_MANDATORY | PAC_INFO_PAC_INFO);
 243         pac.info.hdr.length = htons(sizeof(pac.info.lifetime)
 244                                 + sizeof(pac.info.a_id)
 245                                 + sizeof(pac.info.a_id_info)
 246                                 + sizeof(pac.info.type));
 247
 248         memcpy(&opaque_plaintext.type, &pac.info.type, sizeof(opaque_plaintext.type));
 249         memcpy(&opaque_plaintext.lifetime, &pac.info.lifetime, sizeof(opaque_plaintext.lifetime));
 250         memcpy(&opaque_plaintext.key, &pac.key, sizeof(opaque_plaintext.key));
 251
 252
 253         rad_assert(PAC_A_ID_LENGTH <= EVP_GCM_TLS_TAG_LEN);
 254         memcpy(pac.opaque.aad, t->a_id, PAC_A_ID_LENGTH);
 255         rad_assert(RAND_bytes(pac.opaque.iv, sizeof(pac.opaque.iv)) != 0);
 256         dlen = eap_fast_encrypt((unsigned const char *)&opaque_plaintext, sizeof(opaque_plaintext),
 257                                     t->a_id, PAC_A_ID_LENGTH, t->pac_opaque_key, pac.opaque.iv,
 258                                     pac.opaque.data, pac.opaque.tag);
 259
 260         pac.opaque.hdr.type = htons(EAP_FAST_TLV_MANDATORY | PAC_INFO_PAC_OPAQUE);
 261         pac.opaque.hdr.length = htons(sizeof(pac.opaque) - sizeof(pac.opaque.hdr) - sizeof(pac.opaque.data) + dlen);
 262
 263         eap_fast_tlv_append(tls_session, EAP_FAST_TLV_MANDATORY | EAP_FAST_TLV_PAC, true,
 264                             sizeof(pac) - sizeof(pac.opaque.data) + dlen, &pac);
 265 }
 266
 267 static void eap_fast_append_crypto_binding(REQUEST *request, tls_session_t *tls_session)
 268 {
 269         eap_fast_tunnel_t               *t = tls_session->opaque;
 270         eap_tlv_crypto_binding_tlv_t    binding;
 271     memset(&binding, 0, sizeof(eap_tlv_crypto_binding_tlv_t));
 272         const int                       len = sizeof(binding) - (&binding.reserved - (uint8_t *)&binding);
 273
 274         RDEBUG("Sending Cryptobinding");
 275
 276         binding.tlv_type = htons(EAP_FAST_TLV_MANDATORY | EAP_FAST_TLV_CRYPTO_BINDING);
 277         binding.length = htons(len);
 278         binding.version = EAP_FAST_VERSION;
 279         binding.received_version = EAP_FAST_VERSION;    /* FIXME use the clients value */
 280         binding.subtype = EAP_FAST_TLV_CRYPTO_BINDING_SUBTYPE_REQUEST;
 281
 282         rad_assert(sizeof(binding.nonce) % sizeof(uint32_t) == 0);
 283         RANDFILL(binding.nonce);
 284         binding.nonce[sizeof(binding.nonce) - 1] &= ~0x01; /* RFC 4851 section 4.2.8 */
 285
 286
 287         fr_hmac_sha1(binding.compound_mac, (uint8_t *)&binding, sizeof(binding), t->cmk, EAP_FAST_CMK_LEN);
 288
 289         eap_fast_tlv_append(tls_session, EAP_FAST_TLV_CRYPTO_BINDING, true, len, &binding.reserved);
 290 }
 291
 292 static int eap_fast_verify(REQUEST *request, tls_session_t *tls_session, uint8_t const *data, unsigned int data_len)
 293 {
 294         uint16_t attr;
 295         uint16_t length;
 296         unsigned int remaining = data_len;
 297         int     total = 0;
 298         int     num[EAP_FAST_TLV_MAX] = {0};
 299         eap_fast_tunnel_t *t = (eap_fast_tunnel_t *) tls_session->opaque;
 300         uint32_t present = 0;
 301
 302         rad_assert(sizeof(present) * 8 > EAP_FAST_TLV_MAX);
 303
 304         while (remaining > 0) {
 305                 if (remaining < 4) {
 306                         RDEBUG2("EAP-FAST TLV is too small (%u) to contain a EAP-FAST TLV header", remaining);
 307                         return 0;
 308                 }
 309
 310                 memcpy(&attr, data, sizeof(attr));
 311                 attr = ntohs(attr) & EAP_FAST_TLV_TYPE;
 312
 313                 switch (attr) {
 314                 case EAP_FAST_TLV_RESULT:
 315                 case EAP_FAST_TLV_NAK:
 316                 case EAP_FAST_TLV_ERROR:
 317                 case EAP_FAST_TLV_VENDOR_SPECIFIC:
 318                 case EAP_FAST_TLV_EAP_PAYLOAD:
 319                 case EAP_FAST_TLV_INTERMED_RESULT:
 320                 case EAP_FAST_TLV_PAC:
 321                 case EAP_FAST_TLV_CRYPTO_BINDING:
 322                         num[attr]++;
 323                         present |= 1 << attr;
 324
 325                         if (num[EAP_FAST_TLV_EAP_PAYLOAD] > 1) {
 326                                 RDEBUG("Too many EAP-Payload TLVs");
 327 unexpected:
 328                                 for (int i = 0; i < EAP_FAST_TLV_MAX; i++)
 329                                         if (present & (1 << i))
 330                                                 RDEBUG(" - attribute %d is present", i);
 331                                 eap_fast_send_error(tls_session, EAP_FAST_ERR_UNEXPECTED_TLV);
 332                                 return 0;
 333                         }
 334
 335                         if (num[EAP_FAST_TLV_INTERMED_RESULT] > 1) {
 336                                 RDEBUG("Too many Intermediate-Result TLVs");
 337                                 goto unexpected;
 338                         }
 339                         break;
 340                 default:
 341                         if ((data[0] & 0x80) != 0) {
 342                                 RDEBUG("Unknown mandatory TLV %02x", attr);
 343                                 goto unexpected;
 344                         }
 345
 346                         num[0]++;
 347                 }
 348
 349                 total++;
 350
 351                 memcpy(&length, data + 2, sizeof(length));
 352                 length = ntohs(length);
 353
 354                 data += 4;
 355                 remaining -= 4;
 356
 357                 if (length > remaining) {
 358                         RDEBUG2("EAP-FAST TLV %u is longer than room remaining in the packet (%u > %u).", attr,
 359                                 length, remaining);
 360                         return 0;
 361                 }
 362
 363                 /*
 364                  * If the rest of the TLVs are larger than
 365                  * this attribute, continue.
 366                  *
 367                  * Otherwise, if the attribute over-flows the end
 368                  * of the TLCs, die.
 369                  */
 370                 if (remaining < length) {
 371                         RDEBUG2("EAP-FAST TLV overflows packet!");
 372                         return 0;
 373                 }
 374
 375                 /*
 376                  * If there's an error, we bail out of the
 377                  * authentication process before allocating
 378                  * memory.
 379                  */
 380                 if ((attr == EAP_FAST_TLV_INTERMED_RESULT) || (attr == EAP_FAST_TLV_RESULT)) {
 381                         uint16_t status;
 382
 383                         if (length < 2) {
 384                                 RDEBUG("EAP-FAST TLV %u is too short.  Expected 2, got %d.", attr, length);
 385                                 return 0;
 386                         }
 387
 388                         memcpy(&status, data, 2);
 389                         status = ntohs(status);
 390
 391                         if (status == EAP_FAST_TLV_RESULT_FAILURE) {
 392                                 RDEBUG("EAP-FAST TLV %u indicates failure.  Rejecting request.", attr);
 393                                 return 0;
 394                         }
 395
 396                         if (status != EAP_FAST_TLV_RESULT_SUCCESS) {
 397                                 RDEBUG("EAP-FAST TLV %u contains unknown value.  Rejecting request.", attr);
 398                                 goto unexpected;
 399                         }
 400                 }
 401
 402                 /*
 403                  * remaining > length, continue.
 404                  */
 405                 remaining -= length;
 406                 data += length;
 407         }
 408
 409         /*
 410          * Check if the peer mixed & matched TLVs.
 411          */
 412         if ((num[EAP_FAST_TLV_NAK] > 0) && (num[EAP_FAST_TLV_NAK] != total)) {
 413                 RDEBUG("NAK TLV sent with non-NAK TLVs.  Rejecting request.");
 414                 goto unexpected;
 415         }
 416
 417         if (num[EAP_FAST_TLV_INTERMED_RESULT] > 0 && num[EAP_FAST_TLV_RESULT]) {
 418                 RDEBUG("NAK TLV sent with non-NAK TLVs.  Rejecting request.");
 419                 goto unexpected;
 420         }
 421
 422         /*
 423          * Check mandatory or not mandatory TLVs.
 424          */
 425         switch (t->stage) {
 426         case TLS_SESSION_HANDSHAKE:
 427                 if (present) {
 428                         RDEBUG("Unexpected TLVs in TLS Session Handshake stage");
 429                         goto unexpected;
 430                 }
 431                 break;
 432         case AUTHENTICATION:
 433                 if (present != 1 << EAP_FAST_TLV_EAP_PAYLOAD) {
 434                         RDEBUG("Unexpected TLVs in authentication stage");
 435                         goto unexpected;
 436                 }
 437                 break;
 438         case CRYPTOBIND_CHECK:
 439         {
 440                 uint32_t bits = (t->result_final)
 441                                 ? 1 << EAP_FAST_TLV_RESULT
 442                                 : 1 << EAP_FAST_TLV_INTERMED_RESULT;
 443                 if (present & ~(bits | (1 << EAP_FAST_TLV_CRYPTO_BINDING) | (1 << EAP_FAST_TLV_PAC))) {
 444                         RDEBUG("Unexpected TLVs in cryptobind checking stage");
 445                         goto unexpected;
 446                 }
 447                 break;
 448         }
 449         case PROVISIONING:
 450                 if (present & ~((1 << EAP_FAST_TLV_PAC) | (1 << EAP_FAST_TLV_RESULT))) {
 451                         RDEBUG("Unexpected TLVs in provisioning stage");
 452                         goto unexpected;
 453                 }
 454                 break;
 455         case COMPLETE:
 456                 if (present) {
 457                         RDEBUG("Unexpected TLVs in complete stage");
 458                         goto unexpected;
 459                 }
 460                 break;
 461         default:
 462                 RDEBUG("Unexpected stage %d", t->stage);
 463                 return 0;
 464         }
 465
 466         /*
 467          * We got this far.  It looks OK.
 468          */
 469         return 1;
 470 }
 471
 472 static ssize_t eap_fast_decode_vp(TALLOC_CTX *request, DICT_ATTR const *parent,
 473                                     uint8_t const *data, size_t const attr_len, VALUE_PAIR **out)
 474 {
 475         int8_t                  tag = TAG_NONE;
 476         VALUE_PAIR              *vp;
 477         uint8_t const           *p = data;
 478
 479         /*
 480          *      FIXME: Attrlen can be larger than 253 for extended attrs!
 481          */
 482         if (!parent || !out ) {
 483                 RERROR("eap_fast_decode_vp: Invalid arguments");
 484                 return -1;
 485         }
 486
 487         /*
 488          *      Silently ignore zero-length attributes.
 489          */
 490         if (attr_len == 0) return 0;
 491
 492         /*
 493          *      And now that we've verified the basic type
 494          *      information, decode the actual p.
 495          */
 496         vp = fr_pair_afrom_da(request, parent);
 497         if (!vp) return -1;
 498
 499         vp->vp_length = attr_len;
 500         vp->tag = tag;
 501
 502         switch (parent->type) {
 503         case PW_TYPE_STRING:
 504                 fr_pair_value_bstrncpy(vp, p, attr_len);
 505                 break;
 506
 507         case PW_TYPE_OCTETS:
 508                 fr_pair_value_memcpy(vp, p, attr_len);
 509                 break;
 510
 511         case PW_TYPE_ABINARY:
 512                 if (vp->vp_length > sizeof(vp->vp_filter)) {
 513                         vp->vp_length = sizeof(vp->vp_filter);
 514                 }
 515                 memcpy(vp->vp_filter, p, vp->vp_length);
 516                 break;
 517
 518         case PW_TYPE_BYTE:
 519                 vp->vp_byte = p[0];
 520                 break;
 521
 522         case PW_TYPE_SHORT:
 523                 vp->vp_short = (p[0] << 8) | p[1];
 524                 break;
 525
 526         case PW_TYPE_INTEGER:
 527                 memcpy(&vp->vp_integer, p, 4);
 528                 vp->vp_integer = ntohl(vp->vp_integer);
 529                 break;
 530
 531         case PW_TYPE_INTEGER64:
 532                 memcpy(&vp->vp_integer64, p, 8);
 533                 vp->vp_integer64 = ntohll(vp->vp_integer64);
 534                 break;
 535
 536         case PW_TYPE_DATE:
 537                 memcpy(&vp->vp_date, p, 4);
 538                 vp->vp_date = ntohl(vp->vp_date);
 539                 break;
 540
 541         case PW_TYPE_ETHERNET:
 542                 memcpy(vp->vp_ether, p, 6);
 543                 break;
 544
 545         case PW_TYPE_IPV4_ADDR:
 546                 memcpy(&vp->vp_ipaddr, p, 4);
 547                 break;
 548
 549         case PW_TYPE_IFID:
 550                 memcpy(vp->vp_ifid, p, 8);
 551                 break;
 552
 553         case PW_TYPE_IPV6_ADDR:
 554                 memcpy(&vp->vp_ipv6addr, p, 16);
 555                 break;
 556
 557         case PW_TYPE_IPV6_PREFIX:
 558                 /*
 559                  *      FIXME: double-check that
 560                  *      (vp->vp_octets[1] >> 3) matches vp->vp_length + 2
 561                  */
 562                 memcpy(vp->vp_ipv6prefix, p, vp->vp_length);
 563                 if (vp->vp_length < 18) {
 564                         memset(((uint8_t *)vp->vp_ipv6prefix) + vp->vp_length, 0,
 565                                18 - vp->vp_length);
 566                 }
 567                 break;
 568
 569         case PW_TYPE_IPV4_PREFIX:
 570                 /* FIXME: do the same double-check as for IPv6Prefix */
 571                 memcpy(vp->vp_ipv4prefix, p, vp->vp_length);
 572
 573                 /*
 574                  *      /32 means "keep all bits".  Otherwise, mask
 575                  *      them out.
 576                  */
 577                 if ((p[1] & 0x3f) > 32) {
 578                         uint32_t addr, mask;
 579
 580                         memcpy(&addr, vp->vp_octets + 2, sizeof(addr));
 581                         mask = 1;
 582                         mask <<= (32 - (p[1] & 0x3f));
 583                         mask--;
 584                         mask = ~mask;
 585                         mask = htonl(mask);
 586                         addr &= mask;
 587                         memcpy(vp->vp_ipv4prefix + 2, &addr, sizeof(addr));
 588                 }
 589                 break;
 590
 591         case PW_TYPE_SIGNED:    /* overloaded with vp_integer */
 592                 memcpy(&vp->vp_integer, p, 4);
 593                 vp->vp_integer = ntohl(vp->vp_integer);
 594                 break;
 595
 596         default:
 597                 RERROR("eap_fast_decode_vp: type %d Internal sanity check  %d ", parent->type, __LINE__);
 598                 fr_pair_list_free(&vp);
 599                 return -1;
 600         }
 601         vp->type = VT_DATA;
 602     *out = vp;
 603         return attr_len;
 604 }
 605
 606
 607 VALUE_PAIR *eap_fast_fast2vp(REQUEST *request, SSL *ssl, uint8_t const *data, size_t data_len,
 608                              DICT_ATTR const *fast_da, vp_cursor_t *out)
 609 {
 610         uint16_t        attr;
 611         uint16_t        length;
 612         size_t          data_left = data_len;
 613         VALUE_PAIR      *first = NULL;
 614         VALUE_PAIR      *vp = NULL;
 615         DICT_ATTR const *da;
 616
 617         if (!fast_da)
 618                 fast_da = dict_attrbyvalue(PW_FREERADIUS_EAP_FAST_TLV, VENDORPEC_FREERADIUS);
 619         rad_assert(fast_da != NULL);
 620
 621         if (!out) {
 622                 out = talloc(request, vp_cursor_t);
 623                 rad_assert(out != NULL);
 624                 fr_cursor_init(out, &first);
 625         }
 626
 627         /*
 628          * Decode the TLVs
 629          */
 630         while (data_left > 0) {
 631                 ssize_t decoded;
 632
 633                 /* FIXME do something with mandatory */
 634
 635                 memcpy(&attr, data, sizeof(attr));
 636                 attr = ntohs(attr) & EAP_FAST_TLV_TYPE;
 637
 638                 memcpy(&length, data + 2, sizeof(length));
 639                 length = ntohs(length);
 640
 641                 data += 4;
 642                 data_left -= 4;
 643
 644                 /*
 645                  * Look up the TLV.
 646                  *
 647                  * For now, if it doesn't exist, ignore it.
 648                  */
 649                 da = dict_attrbyparent(fast_da, attr, fast_da->vendor);
 650                 if (!da) {
 651                         RDEBUG("eap_fast_fast2vp: no sub attribute found %s attr: %u vendor: %u",
 652                                         fast_da->name, attr, fast_da->vendor);
 653                         goto next_attr;
 654                 }
 655                 if (da->type == PW_TYPE_TLV) {
 656                         eap_fast_fast2vp(request, ssl, data, length, da, out);
 657                         goto next_attr;
 658                 }
 659                 decoded = eap_fast_decode_vp(request, da, data, length, &vp);
 660                 if (decoded < 0) {
 661                         RERROR("Failed decoding %s: %s", da->name, fr_strerror());
 662                         goto next_attr;
 663                 }
 664
 665                 fr_cursor_merge(out, vp);
 666
 667         next_attr:
 668                 while (fr_cursor_next(out)) {
 669                         /* nothing */
 670                 }
 671
 672                 data += length;
 673                 data_left -= length;
 674         }
 675
 676         /*
 677          * We got this far.  It looks OK.
 678          */
 679         return first;
 680 }
 681
 682
 683 static void eapfast_copy_request_to_tunnel(REQUEST *request, REQUEST *fake) {
 684     VALUE_PAIR *copy, *vp;
 685     vp_cursor_t cursor;
 686
 687     for (vp = fr_cursor_init(&cursor, &request->packet->vps);
 688          vp;
 689          vp = fr_cursor_next(&cursor)) {
 690         /*
 691          *      The attribute is a server-side thingy,
 692          *      don't copy it.
 693          */
 694         if ((vp->da->attr > 255) && (((vp->da->attr >> 16) & 0xffff) == 0)) {
 695             continue;
 696         }
 697
 698         /*
 699          *      The outside attribute is already in the
 700          *      tunnel, don't copy it.
 701          *
 702          *      This works for BOTH attributes which
 703          *      are originally in the tunneled request,
 704          *      AND attributes which are copied there
 705          *      from below.
 706          */
 707         if (fr_pair_find_by_da(fake->packet->vps, vp->da, TAG_ANY)) continue;
 708
 709         /*
 710          *      Some attributes are handled specially.
 711          */
 712         if (!vp->da->vendor) switch (vp->da->attr) {
 713             /*
 714              *  NEVER copy Message-Authenticator,
 715              *  EAP-Message, or State.  They're
 716              *  only for outside of the tunnel.
 717              */
 718         case PW_USER_NAME:
 719         case PW_USER_PASSWORD:
 720         case PW_CHAP_PASSWORD:
 721         case PW_CHAP_CHALLENGE:
 722         case PW_PROXY_STATE:
 723         case PW_MESSAGE_AUTHENTICATOR:
 724         case PW_EAP_MESSAGE:
 725         case PW_STATE:
 726             continue;
 727
 728             /*
 729              *  By default, copy it over.
 730              */
 731         default:
 732             break;
 733         }
 734
 735         /*
 736          *      Don't copy from the head, we've already
 737          *      checked it.
 738          */
 739         copy = fr_pair_list_copy_by_num(fake->packet, vp, vp->da->attr, vp->da->vendor, TAG_ANY);
 740         fr_pair_add(&fake->packet->vps, copy);
 741     }
 742 }
 743
 744 /*
 745  * Use a reply packet to determine what to do.
 746  */
 747 static rlm_rcode_t CC_HINT(nonnull) process_reply( eap_handler_t *eap_session,
 748                                                   tls_session_t *tls_session,
 749                                                   REQUEST *request, RADIUS_PACKET *reply)
 750 {
 751         rlm_rcode_t                     rcode = RLM_MODULE_REJECT;
 752         VALUE_PAIR                      *vp;
 753         vp_cursor_t                     cursor;
 754
 755         eap_fast_tunnel_t       *t = tls_session->opaque;
 756
 757         rad_assert(eap_session->request == request);
 758
 759         /*
 760          * If the response packet was Access-Accept, then
 761          * we're OK.  If not, die horribly.
 762          *
 763          * FIXME: EAP-Messages can only start with 'identity',
 764          * NOT 'eap start', so we should check for that....
 765          */
 766         switch (reply->code) {
 767         case PW_CODE_ACCESS_ACCEPT:
 768                 RDEBUG("Got tunneled Access-Accept");
 769                 rcode = RLM_MODULE_OK;
 770
 771                 for (vp = fr_cursor_init(&cursor, &reply->vps); vp; vp = fr_cursor_next(&cursor)) {
 772                         if (vp->da->vendor != VENDORPEC_MICROSOFT) continue;
 773
 774                         /* FIXME must be a better way to capture/re-derive this later for ISK */
 775                         switch (vp->da->attr) {
 776                         case PW_MSCHAP_MPPE_SEND_KEY:
 777                                 memcpy(t->isk.mppe_send, vp->vp_octets, CHAP_VALUE_LENGTH);
 778                                 break;
 779
 780                         case PW_MSCHAP_MPPE_RECV_KEY:
 781                                 memcpy(t->isk.mppe_recv, vp->vp_octets, CHAP_VALUE_LENGTH);
 782                                 break;
 783
 784                         case PW_MSCHAP2_SUCCESS:
 785                                 RDEBUG("Got %s, tunneling it to the client in a challenge", vp->da->name);
 786                                 rcode = RLM_MODULE_HANDLED;
 787                                 if (t->use_tunneled_reply) {
 788                                         t->authenticated = true;
 789                                         /*
 790                                          *      Clean up the tunneled reply.
 791                                          */
 792                                         fr_pair_delete_by_num(&reply->vps, PW_PROXY_STATE, 0, TAG_ANY);
 793                                         fr_pair_delete_by_num(&reply->vps, PW_EAP_MESSAGE, 0, TAG_ANY);
 794                                         fr_pair_delete_by_num(&reply->vps, PW_MESSAGE_AUTHENTICATOR, 0, TAG_ANY);
 795
 796                                         /*
 797                                          *      Delete MPPE keys & encryption policy.  We don't
 798                                          *      want these here.
 799                                          */
 800                                         fr_pair_delete_by_num(&reply->vps, 7, VENDORPEC_MICROSOFT, TAG_ANY);
 801                                         fr_pair_delete_by_num(&reply->vps, 8, VENDORPEC_MICROSOFT, TAG_ANY);
 802                                         fr_pair_delete_by_num(&reply->vps, 16, VENDORPEC_MICROSOFT, TAG_ANY);
 803                                         fr_pair_delete_by_num(&reply->vps, 17, VENDORPEC_MICROSOFT, TAG_ANY);
 804
 805                                         fr_pair_list_free(&t->accept_vps); /* for proxying MS-CHAP2 */
 806                                         fr_pair_list_mcopy_by_num(t, &t->accept_vps, &reply->vps, 0, 0, TAG_ANY);
 807                                         rad_assert(!reply->vps);
 808                                 }
 809                                 break;
 810
 811                         default:
 812                                 break;
 813                         }
 814                 }
 815                 break;
 816
 817         case PW_CODE_ACCESS_REJECT:
 818                 RDEBUG("Got tunneled Access-Reject");
 819                 rcode = RLM_MODULE_REJECT;
 820                 break;
 821
 822         /*
 823          * Handle Access-Challenge, but only if we
 824          * send tunneled reply data.  This is because
 825          * an Access-Challenge means that we MUST tunnel
 826          * a Reply-Message to the client.
 827          */
 828         case PW_CODE_ACCESS_CHALLENGE:
 829                 RDEBUG("Got tunneled Access-Challenge");
 830
 831                 /*
 832                  *      Keep the State attribute, if necessary.
 833                  *
 834                  *      Get rid of the old State, too.
 835                  */
 836                 fr_pair_list_free(&t->state);
 837                 fr_pair_list_mcopy_by_num(t, &t->state, &reply->vps, PW_STATE, 0, TAG_ANY);
 838
 839                 /*
 840                  *      Copy the EAP-Message back to the tunnel.
 841                  */
 842                 (void) fr_cursor_init(&cursor, &reply->vps);
 843
 844                 while ((vp = fr_cursor_next_by_num(&cursor, PW_EAP_MESSAGE, 0, TAG_ANY)) != NULL) {
 845                         eap_fast_tlv_append(tls_session, EAP_FAST_TLV_EAP_PAYLOAD, true, vp->vp_length, vp->vp_octets);
 846                 }
 847
 848                 rcode = RLM_MODULE_HANDLED;
 849                 break;
 850
 851         default:
 852                 RDEBUG("Unknown RADIUS packet type %d: rejecting tunneled user", reply->code);
 853                 rcode = RLM_MODULE_INVALID;
 854                 break;
 855         }
 856
 857
 858         return rcode;
 859 }
 860
 861 static PW_CODE eap_fast_eap_payload(REQUEST *request, eap_handler_t *eap_session,
 862                                     tls_session_t *tls_session, VALUE_PAIR *tlv_eap_payload)
 863 {
 864         PW_CODE                 code = PW_CODE_ACCESS_REJECT;
 865         rlm_rcode_t             rcode;
 866         VALUE_PAIR              *vp;
 867         eap_fast_tunnel_t       *t;
 868         REQUEST                 *fake;
 869
 870         RDEBUG("Processing received EAP Payload");
 871
 872         /*
 873          * Allocate a fake REQUEST structure.
 874          */
 875         fake = request_alloc_fake(request);
 876         rad_assert(!fake->packet->vps);
 877
 878         t = (eap_fast_tunnel_t *) tls_session->opaque;
 879
 880         /*
 881          * Add the tunneled attributes to the fake request.
 882          */
 883
 884         fake->packet->vps = fr_pair_afrom_num(fake->packet, PW_EAP_MESSAGE, 0);
 885         fr_pair_value_memcpy(fake->packet->vps, tlv_eap_payload->vp_octets, tlv_eap_payload->vp_length);
 886
 887         RDEBUG("Got tunneled request");
 888         rdebug_pair_list(L_DBG_LVL_1, request, fake->packet->vps, NULL);
 889
 890         /*
 891          * Tell the request that it's a fake one.
 892          */
 893         fr_pair_make(fake->packet, &fake->packet->vps, "Freeradius-Proxied-To", "127.0.0.1", T_OP_EQ);
 894
 895         /*
 896          * Update other items in the REQUEST data structure.
 897          */
 898         fake->username = fr_pair_find_by_num(fake->packet->vps, PW_USER_NAME, 0, TAG_ANY);
 899         fake->password = fr_pair_find_by_num(fake->packet->vps, PW_USER_PASSWORD, 0, TAG_ANY);
 900
 901         /*
 902          * No User-Name, try to create one from stored data.
 903          */
 904         if (!fake->username) {
 905                 /*
 906                  * No User-Name in the stored data, look for
 907                  * an EAP-Identity, and pull it out of there.
 908                  */
 909                 if (!t->username) {
 910                         vp = fr_pair_find_by_num(fake->packet->vps, PW_EAP_MESSAGE, 0, TAG_ANY);
 911                         if (vp &&
 912                             (vp->vp_length >= EAP_HEADER_LEN + 2) &&
 913                             (vp->vp_strvalue[0] == PW_EAP_RESPONSE) &&
 914                             (vp->vp_strvalue[EAP_HEADER_LEN] == PW_EAP_IDENTITY) &&
 915                             (vp->vp_strvalue[EAP_HEADER_LEN + 1] != 0)) {
 916                                 /*
 917                                  * Create & remember a User-Name
 918                                  */
 919                                 t->username = fr_pair_make(t, NULL, "User-Name", NULL, T_OP_EQ);
 920                                 rad_assert(t->username != NULL);
 921
 922                                 fr_pair_value_bstrncpy(t->username, vp->vp_octets + 5, vp->vp_length - 5);
 923
 924                                 RDEBUG("Got tunneled identity of %s", t->username->vp_strvalue);
 925                         } else {
 926                                 /*
 927                                  * Don't reject the request outright,
 928                                  * as it's permitted to do EAP without
 929                                  * user-name.
 930                                  */
 931                                 RWDEBUG2("No EAP-Identity found to start EAP conversation");
 932                         }
 933                 } /* else there WAS a t->username */
 934
 935                 if (t->username) {
 936                         vp = fr_pair_list_copy(fake->packet, t->username);
 937                         fr_pair_add(&fake->packet->vps, vp);
 938                         fake->username = vp;
 939                 }
 940         } /* else the request ALREADY had a User-Name */
 941
 942         /*
 943          *      Add the State attribute, too, if it exists.
 944          */
 945         if (t->state) {
 946                 vp = fr_pair_list_copy(fake->packet, t->state);
 947                 if (vp) fr_pair_add(&fake->packet->vps, vp);
 948         }
 949
 950
 951         if (t->stage == AUTHENTICATION) {       /* FIXME do this only for MSCHAPv2 */
 952                 VALUE_PAIR *tvp;
 953
 954                 RDEBUG2("AUTHENTICATION");
 955                 vp = fr_pair_make(fake, &fake->config, "EAP-Type", "0", T_OP_EQ);
 956                 vp->vp_integer = t->default_method;
 957
 958                 /*
 959                  * RFC 5422 section 3.2.3 - Authenticating Using EAP-FAST-MSCHAPv2
 960                  */
 961                 if (t->mode == EAP_FAST_PROVISIONING_ANON) {
 962                         tvp = fr_pair_afrom_num(fake, PW_MSCHAP_CHALLENGE, VENDORPEC_MICROSOFT);
 963                         fr_pair_value_memcpy(tvp, t->keyblock->server_challenge, CHAP_VALUE_LENGTH);
 964                         fr_pair_add(&fake->config, tvp);
 965
 966                         tvp = fr_pair_afrom_num(fake, PW_MS_CHAP_PEER_CHALLENGE, 0);
 967                         fr_pair_value_memcpy(tvp, t->keyblock->client_challenge, CHAP_VALUE_LENGTH);
 968                         fr_pair_add(&fake->config, tvp);
 969                 }
 970         }
 971
 972         if (t->copy_request_to_tunnel) {
 973                 eapfast_copy_request_to_tunnel(request, fake);
 974         }
 975
 976         if ((vp = fr_pair_find_by_num(request->config, PW_VIRTUAL_SERVER, 0, TAG_ANY)) != NULL) {
 977                 fake->server = vp->vp_strvalue;
 978
 979         } else if (t->virtual_server) {
 980                 fake->server = t->virtual_server;
 981
 982         } /* else fake->server == request->server */
 983
 984         /*
 985          * Call authentication recursively, which will
 986          * do PAP, CHAP, MS-CHAP, etc.
 987          */
 988         rad_virtual_server(fake);
 989
 990         /*
 991          * Decide what to do with the reply.
 992          */
 993         switch (fake->reply->code) {
 994         case 0:
 995                 RDEBUG("No tunneled reply was found, rejecting the user.");
 996                 code = PW_CODE_ACCESS_REJECT;
 997                 break;
 998
 999         default:
1000                 /*
1001                  * Returns RLM_MODULE_FOO, and we want to return PW_FOO
1002                  */
1003                 rcode = process_reply(eap_session, tls_session, request, fake->reply);
1004                 switch (rcode) {
1005                 case RLM_MODULE_REJECT:
1006                         code = PW_CODE_ACCESS_REJECT;
1007                         break;
1008
1009                 case RLM_MODULE_HANDLED:
1010                         code = PW_CODE_ACCESS_CHALLENGE;
1011                         break;
1012
1013                 case RLM_MODULE_OK:
1014                         code = PW_CODE_ACCESS_ACCEPT;
1015                         break;
1016
1017                 default:
1018                         code = PW_CODE_ACCESS_REJECT;
1019                         break;
1020                 }
1021                 break;
1022         }
1023
1024         talloc_free(fake);
1025
1026         return code;
1027 }
1028
1029 static PW_CODE eap_fast_crypto_binding(REQUEST *request, UNUSED eap_handler_t *eap_session,
1030                                        tls_session_t *tls_session, eap_tlv_crypto_binding_tlv_t *binding)
1031 {
1032         uint8_t                 cmac[sizeof(binding->compound_mac)];
1033         eap_fast_tunnel_t       *t = tls_session->opaque;
1034
1035         memcpy(cmac, binding->compound_mac, sizeof(cmac));
1036         memset(binding->compound_mac, 0, sizeof(binding->compound_mac));
1037
1038
1039         fr_hmac_sha1(binding->compound_mac, (uint8_t *)binding, sizeof(*binding), t->cmk, EAP_FAST_CMK_LEN);
1040         if (memcmp(binding->compound_mac, cmac, sizeof(cmac))) {
1041                 RDEBUG2("Crypto-Binding TLV mis-match");
1042                 return PW_CODE_ACCESS_REJECT;
1043         }
1044
1045         return PW_CODE_ACCESS_ACCEPT;
1046 }
1047
1048
1049 #define PW_EAP_FAST_TLV_PAC (PW_FREERADIUS_EAP_FAST_TLV | (EAP_FAST_TLV_PAC << 8))
1050
1051
1052
1053 static PW_CODE eap_fast_process_tlvs(REQUEST *request, eap_handler_t *eap_session,
1054                                      tls_session_t *tls_session, VALUE_PAIR *fast_vps)
1055 {
1056         eap_fast_tunnel_t               *t = (eap_fast_tunnel_t *) tls_session->opaque;
1057         VALUE_PAIR                      *vp;
1058         vp_cursor_t                     cursor;
1059         eap_tlv_crypto_binding_tlv_t    *binding = NULL;
1060
1061         for (vp = fr_cursor_init(&cursor, &fast_vps); vp; vp = fr_cursor_next(&cursor)) {
1062                 PW_CODE code = PW_CODE_ACCESS_REJECT;
1063                 char *value;
1064                 DICT_ATTR const *parent_da = NULL;
1065                 parent_da = dict_parent(vp->da->attr, vp->da->vendor);
1066                 if (parent_da == NULL || vp->da->vendor != VENDORPEC_FREERADIUS ||
1067                         ((vp->da->attr & 0xff) != PW_FREERADIUS_EAP_FAST_TLV)) {
1068                         value = vp_aprints(request->packet, vp, '"');
1069                         RDEBUG2("ignoring non-EAP-FAST TLV %s", value);
1070                         talloc_free(value);
1071                         continue;
1072                 }
1073
1074                 switch (parent_da->attr) {
1075                 case PW_FREERADIUS_EAP_FAST_TLV:
1076                         switch (vp->da->attr >> 8) {
1077                         case EAP_FAST_TLV_EAP_PAYLOAD:
1078                                 code = eap_fast_eap_payload(request, eap_session, tls_session, vp);
1079                                 if (code == PW_CODE_ACCESS_ACCEPT)
1080                                         t->stage = CRYPTOBIND_CHECK;
1081                                 break;
1082                         case EAP_FAST_TLV_RESULT:
1083                         case EAP_FAST_TLV_INTERMED_RESULT:
1084                                 code = PW_CODE_ACCESS_ACCEPT;
1085                                 t->stage = PROVISIONING;
1086                                 break;
1087                         case EAP_FAST_TLV_CRYPTO_BINDING:
1088                                 if (!binding) {
1089                                         binding = talloc_zero(request->packet, eap_tlv_crypto_binding_tlv_t);
1090                                         memcpy(binding, vp->vp_octets, sizeof(*binding));
1091                                         binding->tlv_type = htons(EAP_FAST_TLV_MANDATORY | EAP_FAST_TLV_CRYPTO_BINDING);
1092                                         binding->length = htons(sizeof(*binding) - 2 * sizeof(uint16_t));
1093                                 }
1094                                 continue;
1095                         default:
1096                                 value = vp_aprints_value(request->packet, vp, '"');
1097                                 RDEBUG2("ignoring unknown %s", value);
1098                                 talloc_free(value);
1099                                 continue;
1100                         }
1101                         break;
1102                 case PW_EAP_FAST_TLV_PAC:
1103                         switch ( ( vp->da->attr >> 16 )) {
1104                         case PAC_INFO_PAC_ACK:
1105                                 if (vp->vp_integer == EAP_FAST_TLV_RESULT_SUCCESS) {
1106                                         code = PW_CODE_ACCESS_ACCEPT;
1107                                         t->pac.expires = UINT32_MAX;
1108                                         t->pac.expired = false;
1109                                         t->stage = COMPLETE;
1110                                 }
1111                                 break;
1112                         case PAC_INFO_PAC_TYPE:
1113                                 if (vp->vp_integer != PAC_TYPE_TUNNEL) {
1114                                         RDEBUG("only able to serve Tunnel PAC's, ignoring request");
1115                                         continue;
1116                                 }
1117                                 t->pac.send = true;
1118                                 continue;
1119                         default:
1120                                 value = vp_aprints(request->packet, vp, '"');
1121                                 RDEBUG2("ignoring unknown EAP-FAST-PAC-TLV %s", value);
1122                                 talloc_free(value);
1123                                 continue;
1124                         }
1125                         break;
1126                 default:
1127                         value = vp_aprints(request->packet, vp, '"');
1128                         RDEBUG2("ignoring EAP-FAST TLV %s", value);
1129                         talloc_free(value);
1130                         continue;
1131                 }
1132
1133                 if (code == PW_CODE_ACCESS_REJECT)
1134                         return PW_CODE_ACCESS_REJECT;
1135         }
1136
1137         if (binding) {
1138                 PW_CODE code = eap_fast_crypto_binding(request, eap_session, tls_session, binding);
1139                 if (code == PW_CODE_ACCESS_ACCEPT)
1140                         t->stage = PROVISIONING;
1141         }
1142
1143         return PW_CODE_ACCESS_ACCEPT;
1144 }
1145
1146
1147 /*
1148  * Process the inner tunnel data
1149  */
1150 PW_CODE eap_fast_process(eap_handler_t *eap_session, tls_session_t *tls_session)
1151 {
1152         PW_CODE                 code;
1153         VALUE_PAIR              *fast_vps;
1154         uint8_t                 const *data;
1155         size_t                  data_len;
1156         eap_fast_tunnel_t               *t;
1157         REQUEST                 *request = eap_session->request;
1158
1159         /*
1160          * Just look at the buffer directly, without doing
1161          * record_to_buff.
1162          */
1163         data_len = tls_session->clean_out.used;
1164         tls_session->clean_out.used = 0;
1165         data = tls_session->clean_out.data;
1166
1167         t = (eap_fast_tunnel_t *) tls_session->opaque;
1168
1169         /*
1170          * See if the tunneled data is well formed.
1171          */
1172         if (!eap_fast_verify(request, tls_session, data, data_len)) return PW_CODE_ACCESS_REJECT;
1173
1174         if (t->stage == TLS_SESSION_HANDSHAKE) {
1175                 rad_assert(t->mode == EAP_FAST_UNKNOWN);
1176
1177                 char buf[256];
1178                 if (strstr(SSL_CIPHER_description(SSL_get_current_cipher(tls_session->ssl),
1179                                                   buf, sizeof(buf)), "Au=None")) {
1180                         /* FIXME enforce MSCHAPv2 - RFC 5422 section 3.2.2 */
1181                         RDEBUG2("Using anonymous provisioning");
1182                         t->mode = EAP_FAST_PROVISIONING_ANON;
1183                         t->pac.send = true;
1184                 } else {
1185                         if (SSL_session_reused(tls_session->ssl)) {
1186                                 RDEBUG("Session Resumed from PAC");
1187                                 t->mode = EAP_FAST_NORMAL_AUTH;
1188                         } else {
1189                                 RDEBUG2("Using authenticated provisioning");
1190                                 t->mode = EAP_FAST_PROVISIONING_AUTH;
1191                         }
1192
1193                         if (!t->pac.expires || t->pac.expired || t->pac.expires - time(NULL) < t->pac_lifetime * 0.6)
1194                                 t->pac.send = true;
1195                 }
1196
1197                 eap_fast_init_keys(request, tls_session);
1198
1199                 eap_fast_send_identity_request(request, tls_session, eap_session);
1200
1201                 t->stage = AUTHENTICATION;
1202                 return PW_CODE_ACCESS_CHALLENGE;
1203         }
1204
1205         fast_vps = eap_fast_fast2vp(request, tls_session->ssl, data, data_len, NULL, NULL);
1206
1207         RDEBUG("Got Tunneled FAST TLVs");
1208         rdebug_pair_list(L_DBG_LVL_1, request, fast_vps, NULL);
1209
1210         code = eap_fast_process_tlvs(request, eap_session, tls_session, fast_vps);
1211
1212         fr_pair_list_free(&fast_vps);
1213
1214         if (code == PW_CODE_ACCESS_REJECT) return PW_CODE_ACCESS_REJECT;
1215
1216         switch (t->stage) {
1217         case AUTHENTICATION:
1218                 code = PW_CODE_ACCESS_CHALLENGE;
1219                 break;
1220         case CRYPTOBIND_CHECK:
1221         {
1222                 if (t->mode != EAP_FAST_PROVISIONING_ANON && !t->pac.send)
1223                         t->result_final = true;
1224
1225                 eap_fast_append_result(tls_session, code);
1226
1227                 eap_fast_update_icmk(request, tls_session, (uint8_t *)&t->isk);
1228                 eap_fast_append_crypto_binding(request, tls_session);
1229
1230                 code = PW_CODE_ACCESS_CHALLENGE;
1231                 break;
1232         }
1233         case PROVISIONING:
1234                 t->result_final = true;
1235
1236                 eap_fast_append_result(tls_session, code);
1237
1238                 if (code == PW_CODE_ACCESS_REJECT)
1239                         break;
1240
1241                 if (t->pac.send) {
1242                         RDEBUG("Peer requires new PAC");
1243                         eap_fast_send_pac_tunnel(request, tls_session);
1244                         code = PW_CODE_ACCESS_CHALLENGE;
1245                         break;
1246                 }
1247
1248                 t->stage = COMPLETE;
1249                 /* fallthrough */
1250         case COMPLETE:
1251                 /*
1252                  * RFC 5422 section 3.5 - Network Access after EAP-FAST Provisioning
1253                  */
1254                 if (t->pac.type && t->pac.expired) {
1255                         REDEBUG("Rejecting expired PAC.");
1256                         code = PW_CODE_ACCESS_REJECT;
1257                         break;
1258                 }
1259
1260                 if (t->mode == EAP_FAST_PROVISIONING_ANON) {
1261                         REDEBUG("Rejecting unauthenticated provisioning");
1262                         code = PW_CODE_ACCESS_REJECT;
1263                         break;
1264                 }
1265
1266                 /*
1267                  * eap_tls_gen_mppe_keys() is unsuitable for EAP-FAST as Cisco decided
1268                  * it would be a great idea to flip the recv/send keys around
1269                  */
1270                 #define EAPTLS_MPPE_KEY_LEN 32
1271                 eap_add_reply(request, "MS-MPPE-Recv-Key", t->msk, EAPTLS_MPPE_KEY_LEN);
1272                 eap_add_reply(request, "MS-MPPE-Send-Key", &t->msk[EAPTLS_MPPE_KEY_LEN], EAPTLS_MPPE_KEY_LEN);
1273                 eap_add_reply(request, "EAP-MSK", t->msk, EAP_FAST_KEY_LEN);
1274                 eap_add_reply(request, "EAP-EMSK", t->emsk, EAP_EMSK_LEN);
1275
1276                 break;
1277
1278         default:
1279                 RERROR("Internal sanity check failed in EAP-FAST at %d", t->stage);
1280                 code = PW_CODE_ACCESS_REJECT;
1281         }
1282
1283         return code;
1284 }