src/eap_peer/eap_fast.c

   1 /*
   2  * EAP peer method: EAP-FAST (RFC 4851)
   3  * Copyright (c) 2004-2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "eap_i.h"
  19 #include "eap_tls_common.h"
  20 #include "eap_config.h"
  21 #include "tls.h"
  22 #include "eap_common/eap_tlv_common.h"
  23 #include "sha1.h"
  24 #include "eap_fast_pac.h"
  25
  26 #ifdef EAP_FAST_DYNAMIC
  27 #include "eap_fast_pac.c"
  28 #endif /* EAP_FAST_DYNAMIC */
  29
  30 /* TODO:
  31  * - test session resumption and enable it if it interoperates
  32  * - password change (pending mschapv2 packet; replay decrypted packet)
  33  */
  34
  35
  36 static void eap_fast_deinit(struct eap_sm *sm, void *priv);
  37
  38
  39 struct eap_fast_data {
  40         struct eap_ssl_data ssl;
  41
  42         int fast_version;
  43
  44         const struct eap_method *phase2_method;
  45         void *phase2_priv;
  46         int phase2_success;
  47
  48         struct eap_method_type phase2_type;
  49         struct eap_method_type *phase2_types;
  50         size_t num_phase2_types;
  51         int resuming; /* starting a resumed session */
  52         struct eap_fast_key_block_provisioning *key_block_p;
  53 #define EAP_FAST_PROV_UNAUTH 1
  54 #define EAP_FAST_PROV_AUTH 2
  55         int provisioning_allowed; /* Allowed PAC provisioning modes */
  56         int provisioning; /* doing PAC provisioning (not the normal auth) */
  57         int anon_provisioning; /* doing anonymous (unauthenticated)
  58                                 * provisioning */
  59         int session_ticket_used;
  60
  61         u8 key_data[EAP_FAST_KEY_LEN];
  62         u8 emsk[EAP_EMSK_LEN];
  63         int success;
  64
  65         struct eap_fast_pac *pac;
  66         struct eap_fast_pac *current_pac;
  67         size_t max_pac_list_len;
  68         int use_pac_binary_format;
  69
  70         u8 simck[EAP_FAST_SIMCK_LEN];
  71         int simck_idx;
  72
  73         struct wpabuf *pending_phase2_req;
  74 };
  75
  76
  77 static int eap_fast_session_ticket_cb(void *ctx, const u8 *ticket, size_t len,
  78                                       const u8 *client_random,
  79                                       const u8 *server_random,
  80                                       u8 *master_secret)
  81 {
  82         struct eap_fast_data *data = ctx;
  83
  84         wpa_printf(MSG_DEBUG, "EAP-FAST: SessionTicket callback");
  85
  86         if (client_random == NULL || server_random == NULL ||
  87             master_secret == NULL) {
  88                 wpa_printf(MSG_DEBUG, "EAP-FAST: SessionTicket failed - fall "
  89                            "back to full TLS handshake");
  90                 data->session_ticket_used = 0;
  91                 if (data->provisioning_allowed) {
  92                         wpa_printf(MSG_DEBUG, "EAP-FAST: Try to provision a "
  93                                    "new PAC-Key");
  94                         data->provisioning = 1;
  95                         data->current_pac = NULL;
  96                 }
  97                 return 0;
  98         }
  99
 100         wpa_hexdump(MSG_DEBUG, "EAP-FAST: SessionTicket", ticket, len);
 101
 102         if (data->current_pac == NULL) {
 103                 wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC-Key available for "
 104                            "using SessionTicket");
 105                 data->session_ticket_used = 0;
 106                 return 0;
 107         }
 108
 109         eap_fast_derive_master_secret(data->current_pac->pac_key,
 110                                       server_random, client_random,
 111                                       master_secret);
 112
 113         data->session_ticket_used = 1;
 114
 115         return 1;
 116 }
 117
 118
 119 static int eap_fast_parse_phase1(struct eap_fast_data *data,
 120                                  const char *phase1)
 121 {
 122         const char *pos;
 123
 124         pos = os_strstr(phase1, "fast_provisioning=");
 125         if (pos) {
 126                 data->provisioning_allowed = atoi(pos + 18);
 127                 wpa_printf(MSG_DEBUG, "EAP-FAST: Automatic PAC provisioning "
 128                            "mode: %d", data->provisioning_allowed);
 129         }
 130
 131         pos = os_strstr(phase1, "fast_max_pac_list_len=");
 132         if (pos) {
 133                 data->max_pac_list_len = atoi(pos + 22);
 134                 if (data->max_pac_list_len == 0)
 135                         data->max_pac_list_len = 1;
 136                 wpa_printf(MSG_DEBUG, "EAP-FAST: Maximum PAC list length: %lu",
 137                            (unsigned long) data->max_pac_list_len);
 138         }
 139
 140         pos = os_strstr(phase1, "fast_pac_format=binary");
 141         if (pos) {
 142                 data->use_pac_binary_format = 1;
 143                 wpa_printf(MSG_DEBUG, "EAP-FAST: Using binary format for PAC "
 144                            "list");
 145         }
 146
 147         return 0;
 148 }
 149
 150
 151 static void * eap_fast_init(struct eap_sm *sm)
 152 {
 153         struct eap_fast_data *data;
 154         struct eap_peer_config *config = eap_get_config(sm);
 155
 156         data = os_zalloc(sizeof(*data));
 157         if (data == NULL)
 158                 return NULL;
 159         data->fast_version = EAP_FAST_VERSION;
 160         data->max_pac_list_len = 10;
 161
 162         if (config && config->phase1 &&
 163             eap_fast_parse_phase1(data, config->phase1) < 0) {
 164                 eap_fast_deinit(sm, data);
 165                 return NULL;
 166         }
 167
 168         if (eap_peer_select_phase2_methods(config, "auth=",
 169                                            &data->phase2_types,
 170                                            &data->num_phase2_types) < 0) {
 171                 eap_fast_deinit(sm, data);
 172                 return NULL;
 173         }
 174
 175         data->phase2_type.vendor = EAP_VENDOR_IETF;
 176         data->phase2_type.method = EAP_TYPE_NONE;
 177
 178         if (eap_peer_tls_ssl_init(sm, &data->ssl, config)) {
 179                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to initialize SSL.");
 180                 eap_fast_deinit(sm, data);
 181                 return NULL;
 182         }
 183
 184         if (tls_connection_set_session_ticket_cb(sm->ssl_ctx, data->ssl.conn,
 185                                                  eap_fast_session_ticket_cb,
 186                                                  data) < 0) {
 187                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to set SessionTicket "
 188                            "callback");
 189                 eap_fast_deinit(sm, data);
 190                 return NULL;
 191         }
 192
 193         /*
 194          * The local RADIUS server in a Cisco AP does not seem to like empty
 195          * fragments before data, so disable that workaround for CBC.
 196          * TODO: consider making this configurable
 197          */
 198         if (tls_connection_enable_workaround(sm->ssl_ctx, data->ssl.conn)) {
 199                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to enable TLS "
 200                            "workarounds");
 201         }
 202
 203         if (data->use_pac_binary_format &&
 204             eap_fast_load_pac_bin(sm, &data->pac, config->pac_file) < 0) {
 205                 eap_fast_deinit(sm, data);
 206                 return NULL;
 207         }
 208
 209         if (!data->use_pac_binary_format &&
 210             eap_fast_load_pac(sm, &data->pac, config->pac_file) < 0) {
 211                 eap_fast_deinit(sm, data);
 212                 return NULL;
 213         }
 214         eap_fast_pac_list_truncate(data->pac, data->max_pac_list_len);
 215
 216         if (data->pac == NULL && !data->provisioning_allowed) {
 217                 wpa_printf(MSG_INFO, "EAP-FAST: No PAC configured and "
 218                            "provisioning disabled");
 219                 eap_fast_deinit(sm, data);
 220                 return NULL;
 221         }
 222
 223         return data;
 224 }
 225
 226
 227 static void eap_fast_deinit(struct eap_sm *sm, void *priv)
 228 {
 229         struct eap_fast_data *data = priv;
 230         struct eap_fast_pac *pac, *prev;
 231
 232         if (data == NULL)
 233                 return;
 234         if (data->phase2_priv && data->phase2_method)
 235                 data->phase2_method->deinit(sm, data->phase2_priv);
 236         os_free(data->phase2_types);
 237         os_free(data->key_block_p);
 238         eap_peer_tls_ssl_deinit(sm, &data->ssl);
 239
 240         pac = data->pac;
 241         prev = NULL;
 242         while (pac) {
 243                 prev = pac;
 244                 pac = pac->next;
 245                 eap_fast_free_pac(prev);
 246         }
 247         wpabuf_free(data->pending_phase2_req);
 248         os_free(data);
 249 }
 250
 251
 252 static int eap_fast_derive_msk(struct eap_fast_data *data)
 253 {
 254         eap_fast_derive_eap_msk(data->simck, data->key_data);
 255         eap_fast_derive_eap_emsk(data->simck, data->emsk);
 256         data->success = 1;
 257         return 0;
 258 }
 259
 260
 261 static void eap_fast_derive_key_auth(struct eap_sm *sm,
 262                                      struct eap_fast_data *data)
 263 {
 264         u8 *sks;
 265
 266         /* RFC 4851, Section 5.1:
 267          * Extra key material after TLS key_block: session_key_seed[40]
 268          */
 269
 270         sks = eap_fast_derive_key(sm->ssl_ctx, data->ssl.conn, "key expansion",
 271                                   EAP_FAST_SKS_LEN);
 272         if (sks == NULL) {
 273                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to derive "
 274                            "session_key_seed");
 275                 return;
 276         }
 277
 278         /*
 279          * RFC 4851, Section 5.2:
 280          * S-IMCK[0] = session_key_seed
 281          */
 282         wpa_hexdump_key(MSG_DEBUG,
 283                         "EAP-FAST: session_key_seed (SKS = S-IMCK[0])",
 284                         sks, EAP_FAST_SKS_LEN);
 285         data->simck_idx = 0;
 286         os_memcpy(data->simck, sks, EAP_FAST_SIMCK_LEN);
 287         os_free(sks);
 288 }
 289
 290
 291 static void eap_fast_derive_key_provisioning(struct eap_sm *sm,
 292                                              struct eap_fast_data *data)
 293 {
 294         os_free(data->key_block_p);
 295         data->key_block_p = (struct eap_fast_key_block_provisioning *)
 296                 eap_fast_derive_key(sm->ssl_ctx, data->ssl.conn,
 297                                     "key expansion",
 298                                     sizeof(*data->key_block_p));
 299         if (data->key_block_p == NULL) {
 300                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to derive key block");
 301                 return;
 302         }
 303         /*
 304          * RFC 4851, Section 5.2:
 305          * S-IMCK[0] = session_key_seed
 306          */
 307         wpa_hexdump_key(MSG_DEBUG,
 308                         "EAP-FAST: session_key_seed (SKS = S-IMCK[0])",
 309                         data->key_block_p->session_key_seed,
 310                         sizeof(data->key_block_p->session_key_seed));
 311         data->simck_idx = 0;
 312         os_memcpy(data->simck, data->key_block_p->session_key_seed,
 313                   EAP_FAST_SIMCK_LEN);
 314         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: server_challenge",
 315                         data->key_block_p->server_challenge,
 316                         sizeof(data->key_block_p->server_challenge));
 317         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: client_challenge",
 318                         data->key_block_p->client_challenge,
 319                         sizeof(data->key_block_p->client_challenge));
 320 }
 321
 322
 323 static void eap_fast_derive_keys(struct eap_sm *sm, struct eap_fast_data *data)
 324 {
 325         if (data->anon_provisioning)
 326                 eap_fast_derive_key_provisioning(sm, data);
 327         else
 328                 eap_fast_derive_key_auth(sm, data);
 329 }
 330
 331
 332 static int eap_fast_init_phase2_method(struct eap_sm *sm,
 333                                        struct eap_fast_data *data)
 334 {
 335         data->phase2_method =
 336                 eap_peer_get_eap_method(data->phase2_type.vendor,
 337                                         data->phase2_type.method);
 338         if (data->phase2_method == NULL)
 339                 return -1;
 340
 341         if (data->key_block_p) {
 342                 sm->auth_challenge = data->key_block_p->server_challenge;
 343                 sm->peer_challenge = data->key_block_p->client_challenge;
 344         }
 345         sm->init_phase2 = 1;
 346         sm->mschapv2_full_key = 1;
 347         data->phase2_priv = data->phase2_method->init(sm);
 348         sm->init_phase2 = 0;
 349         sm->mschapv2_full_key = 0;
 350         sm->auth_challenge = NULL;
 351         sm->peer_challenge = NULL;
 352
 353         return data->phase2_priv == NULL ? -1 : 0;
 354 }
 355
 356
 357 static int eap_fast_select_phase2_method(struct eap_fast_data *data, u8 type)
 358 {
 359         size_t i;
 360
 361         /* TODO: TNC with anonymous provisioning; need to require both
 362          * completed MSCHAPv2 and TNC */
 363
 364         if (data->anon_provisioning && type != EAP_TYPE_MSCHAPV2) {
 365                 wpa_printf(MSG_INFO, "EAP-FAST: Only EAP-MSCHAPv2 is allowed "
 366                            "during unauthenticated provisioning; reject phase2"
 367                            " type %d", type);
 368                 return -1;
 369         }
 370
 371 #ifdef EAP_TNC
 372         if (type == EAP_TYPE_TNC) {
 373                 data->phase2_type.vendor = EAP_VENDOR_IETF;
 374                 data->phase2_type.method = EAP_TYPE_TNC;
 375                 wpa_printf(MSG_DEBUG, "EAP-FAST: Selected Phase 2 EAP "
 376                            "vendor %d method %d for TNC",
 377                            data->phase2_type.vendor,
 378                            data->phase2_type.method);
 379                 return 0;
 380         }
 381 #endif /* EAP_TNC */
 382
 383         for (i = 0; i < data->num_phase2_types; i++) {
 384                 if (data->phase2_types[i].vendor != EAP_VENDOR_IETF ||
 385                     data->phase2_types[i].method != type)
 386                         continue;
 387
 388                 data->phase2_type.vendor = data->phase2_types[i].vendor;
 389                 data->phase2_type.method = data->phase2_types[i].method;
 390                 wpa_printf(MSG_DEBUG, "EAP-FAST: Selected Phase 2 EAP "
 391                            "vendor %d method %d",
 392                            data->phase2_type.vendor,
 393                            data->phase2_type.method);
 394                 break;
 395         }
 396
 397         if (type != data->phase2_type.method || type == EAP_TYPE_NONE)
 398                 return -1;
 399
 400         return 0;
 401 }
 402
 403
 404 static int eap_fast_phase2_request(struct eap_sm *sm,
 405                                    struct eap_fast_data *data,
 406                                    struct eap_method_ret *ret,
 407                                    struct eap_hdr *hdr,
 408                                    struct wpabuf **resp)
 409 {
 410         size_t len = be_to_host16(hdr->length);
 411         u8 *pos;
 412         struct eap_method_ret iret;
 413         struct eap_peer_config *config = eap_get_config(sm);
 414         struct wpabuf msg;
 415
 416         if (len <= sizeof(struct eap_hdr)) {
 417                 wpa_printf(MSG_INFO, "EAP-FAST: too short "
 418                            "Phase 2 request (len=%lu)", (unsigned long) len);
 419                 return -1;
 420         }
 421         pos = (u8 *) (hdr + 1);
 422         wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 Request: type=%d", *pos);
 423         if (*pos == EAP_TYPE_IDENTITY) {
 424                 *resp = eap_sm_buildIdentity(sm, hdr->identifier, 1);
 425                 return 0;
 426         }
 427
 428         if (data->phase2_priv && data->phase2_method &&
 429             *pos != data->phase2_type.method) {
 430                 wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 EAP sequence - "
 431                            "deinitialize previous method");
 432                 data->phase2_method->deinit(sm, data->phase2_priv);
 433                 data->phase2_method = NULL;
 434                 data->phase2_priv = NULL;
 435                 data->phase2_type.vendor = EAP_VENDOR_IETF;
 436                 data->phase2_type.method = EAP_TYPE_NONE;
 437         }
 438
 439         if (data->phase2_type.vendor == EAP_VENDOR_IETF &&
 440             data->phase2_type.method == EAP_TYPE_NONE &&
 441             eap_fast_select_phase2_method(data, *pos) < 0) {
 442                 if (eap_peer_tls_phase2_nak(data->phase2_types,
 443                                             data->num_phase2_types,
 444                                             hdr, resp))
 445                         return -1;
 446                 return 0;
 447         }
 448
 449         if (data->phase2_priv == NULL &&
 450             eap_fast_init_phase2_method(sm, data) < 0) {
 451                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to initialize "
 452                            "Phase 2 EAP method %d", *pos);
 453                 ret->methodState = METHOD_DONE;
 454                 ret->decision = DECISION_FAIL;
 455                 return -1;
 456         }
 457
 458         os_memset(&iret, 0, sizeof(iret));
 459         wpabuf_set(&msg, hdr, len);
 460         *resp = data->phase2_method->process(sm, data->phase2_priv, &iret,
 461                                              &msg);
 462         if (*resp == NULL ||
 463             (iret.methodState == METHOD_DONE &&
 464              iret.decision == DECISION_FAIL)) {
 465                 ret->methodState = METHOD_DONE;
 466                 ret->decision = DECISION_FAIL;
 467         } else if ((iret.methodState == METHOD_DONE ||
 468                     iret.methodState == METHOD_MAY_CONT) &&
 469                    (iret.decision == DECISION_UNCOND_SUCC ||
 470                     iret.decision == DECISION_COND_SUCC)) {
 471                 data->phase2_success = 1;
 472         }
 473
 474         if (*resp == NULL && config &&
 475             (config->pending_req_identity || config->pending_req_password ||
 476              config->pending_req_otp || config->pending_req_new_password)) {
 477                 wpabuf_free(data->pending_phase2_req);
 478                 data->pending_phase2_req = wpabuf_alloc_copy(hdr, len);
 479         } else if (*resp == NULL)
 480                 return -1;
 481
 482         return 0;
 483 }
 484
 485
 486 static struct wpabuf * eap_fast_tlv_nak(int vendor_id, int tlv_type)
 487 {
 488         struct wpabuf *buf;
 489         struct eap_tlv_nak_tlv *nak;
 490         buf = wpabuf_alloc(sizeof(*nak));
 491         if (buf == NULL)
 492                 return NULL;
 493         nak = wpabuf_put(buf, sizeof(*nak));
 494         nak->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY | EAP_TLV_NAK_TLV);
 495         nak->length = host_to_be16(6);
 496         nak->vendor_id = host_to_be32(vendor_id);
 497         nak->nak_type = host_to_be16(tlv_type);
 498         return buf;
 499 }
 500
 501
 502 static struct wpabuf * eap_fast_tlv_result(int status, int intermediate)
 503 {
 504         struct wpabuf *buf;
 505         struct eap_tlv_intermediate_result_tlv *result;
 506         buf = wpabuf_alloc(sizeof(*result));
 507         if (buf == NULL)
 508                 return NULL;
 509         wpa_printf(MSG_DEBUG, "EAP-FAST: Add %sResult TLV(status=%d)",
 510                    intermediate ? "Intermediate " : "", status);
 511         result = wpabuf_put(buf, sizeof(*result));
 512         result->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
 513                                         (intermediate ?
 514                                          EAP_TLV_INTERMEDIATE_RESULT_TLV :
 515                                          EAP_TLV_RESULT_TLV));
 516         result->length = host_to_be16(2);
 517         result->status = host_to_be16(status);
 518         return buf;
 519 }
 520
 521
 522 static struct wpabuf * eap_fast_tlv_pac_ack(void)
 523 {
 524         struct wpabuf *buf;
 525         struct eap_tlv_result_tlv *res;
 526         struct eap_tlv_pac_ack_tlv *ack;
 527
 528         buf = wpabuf_alloc(sizeof(*res) + sizeof(*ack));
 529         if (buf == NULL)
 530                 return NULL;
 531
 532         wpa_printf(MSG_DEBUG, "EAP-FAST: Add PAC TLV (ack)");
 533         ack = wpabuf_put(buf, sizeof(*ack));
 534         ack->tlv_type = host_to_be16(EAP_TLV_PAC_TLV |
 535                                      EAP_TLV_TYPE_MANDATORY);
 536         ack->length = host_to_be16(sizeof(*ack) - sizeof(struct eap_tlv_hdr));
 537         ack->pac_type = host_to_be16(PAC_TYPE_PAC_ACKNOWLEDGEMENT);
 538         ack->pac_len = host_to_be16(2);
 539         ack->result = host_to_be16(EAP_TLV_RESULT_SUCCESS);
 540
 541         return buf;
 542 }
 543
 544
 545 static struct wpabuf * eap_fast_process_eap_payload_tlv(
 546         struct eap_sm *sm, struct eap_fast_data *data,
 547         struct eap_method_ret *ret, const struct eap_hdr *req,
 548         u8 *eap_payload_tlv, size_t eap_payload_tlv_len)
 549 {
 550         struct eap_hdr *hdr;
 551         struct wpabuf *resp = NULL;
 552
 553         if (eap_payload_tlv_len < sizeof(*hdr)) {
 554                 wpa_printf(MSG_DEBUG, "EAP-FAST: too short EAP "
 555                            "Payload TLV (len=%lu)",
 556                            (unsigned long) eap_payload_tlv_len);
 557                 return NULL;
 558         }
 559
 560         hdr = (struct eap_hdr *) eap_payload_tlv;
 561         if (be_to_host16(hdr->length) > eap_payload_tlv_len) {
 562                 wpa_printf(MSG_DEBUG, "EAP-FAST: EAP packet overflow in "
 563                            "EAP Payload TLV");
 564                 return NULL;
 565         }
 566
 567         if (hdr->code != EAP_CODE_REQUEST) {
 568                 wpa_printf(MSG_INFO, "EAP-FAST: Unexpected code=%d in "
 569                            "Phase 2 EAP header", hdr->code);
 570                 return NULL;
 571         }
 572
 573         if (eap_fast_phase2_request(sm, data, ret, hdr, &resp)) {
 574                 wpa_printf(MSG_INFO, "EAP-FAST: Phase2 Request processing "
 575                            "failed");
 576                 return NULL;
 577         }
 578
 579         return eap_fast_tlv_eap_payload(resp);
 580 }
 581
 582
 583 static int eap_fast_validate_crypto_binding(
 584         struct eap_tlv_crypto_binding_tlv *_bind)
 585 {
 586         wpa_printf(MSG_DEBUG, "EAP-FAST: Crypto-Binding TLV: Version %d "
 587                    "Received Version %d SubType %d",
 588                    _bind->version, _bind->received_version, _bind->subtype);
 589         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: NONCE",
 590                     _bind->nonce, sizeof(_bind->nonce));
 591         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Compound MAC",
 592                     _bind->compound_mac, sizeof(_bind->compound_mac));
 593
 594         if (_bind->version != EAP_FAST_VERSION ||
 595             _bind->received_version != EAP_FAST_VERSION ||
 596             _bind->subtype != EAP_TLV_CRYPTO_BINDING_SUBTYPE_REQUEST) {
 597                 wpa_printf(MSG_INFO, "EAP-FAST: Invalid version/subtype in "
 598                            "Crypto-Binding TLV: Version %d "
 599                            "Received Version %d SubType %d",
 600                            _bind->version, _bind->received_version,
 601                            _bind->subtype);
 602                 return -1;
 603         }
 604
 605         return 0;
 606 }
 607
 608
 609 static void eap_fast_write_crypto_binding(
 610         struct eap_tlv_crypto_binding_tlv *rbind,
 611         struct eap_tlv_crypto_binding_tlv *_bind, const u8 *cmk)
 612 {
 613         rbind->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
 614                                        EAP_TLV_CRYPTO_BINDING_TLV);
 615         rbind->length = host_to_be16(sizeof(*rbind) -
 616                                      sizeof(struct eap_tlv_hdr));
 617         rbind->version = EAP_FAST_VERSION;
 618         rbind->received_version = _bind->version;
 619         rbind->subtype = EAP_TLV_CRYPTO_BINDING_SUBTYPE_RESPONSE;
 620         os_memcpy(rbind->nonce, _bind->nonce, sizeof(_bind->nonce));
 621         inc_byte_array(rbind->nonce, sizeof(rbind->nonce));
 622         hmac_sha1(cmk, EAP_FAST_CMK_LEN, (u8 *) rbind, sizeof(*rbind),
 623                   rbind->compound_mac);
 624
 625         wpa_printf(MSG_DEBUG, "EAP-FAST: Reply Crypto-Binding TLV: Version %d "
 626                    "Received Version %d SubType %d",
 627                    rbind->version, rbind->received_version, rbind->subtype);
 628         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: NONCE",
 629                     rbind->nonce, sizeof(rbind->nonce));
 630         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Compound MAC",
 631                     rbind->compound_mac, sizeof(rbind->compound_mac));
 632 }
 633
 634
 635 static int eap_fast_get_phase2_key(struct eap_sm *sm,
 636                                    struct eap_fast_data *data,
 637                                    u8 *isk, size_t isk_len)
 638 {
 639         u8 *key;
 640         size_t key_len;
 641
 642         os_memset(isk, 0, isk_len);
 643
 644         if (data->phase2_method == NULL || data->phase2_priv == NULL) {
 645                 wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 method not "
 646                            "available");
 647                 return -1;
 648         }
 649
 650         if (data->phase2_method->isKeyAvailable == NULL ||
 651             data->phase2_method->getKey == NULL)
 652                 return 0;
 653
 654         if (!data->phase2_method->isKeyAvailable(sm, data->phase2_priv) ||
 655             (key = data->phase2_method->getKey(sm, data->phase2_priv,
 656                                                &key_len)) == NULL) {
 657                 wpa_printf(MSG_DEBUG, "EAP-FAST: Could not get key material "
 658                            "from Phase 2");
 659                 return -1;
 660         }
 661
 662         if (key_len > isk_len)
 663                 key_len = isk_len;
 664         os_memcpy(isk, key, key_len);
 665         os_free(key);
 666
 667         return 0;
 668 }
 669
 670
 671 static int eap_fast_get_cmk(struct eap_sm *sm, struct eap_fast_data *data,
 672                             u8 *cmk)
 673 {
 674         u8 isk[32], imck[60];
 675
 676         wpa_printf(MSG_DEBUG, "EAP-FAST: Determining CMK[%d] for Compound MIC "
 677                    "calculation", data->simck_idx + 1);
 678
 679         /*
 680          * RFC 4851, Section 5.2:
 681          * IMCK[j] = T-PRF(S-IMCK[j-1], "Inner Methods Compound Keys",
 682          *                 MSK[j], 60)
 683          * S-IMCK[j] = first 40 octets of IMCK[j]
 684          * CMK[j] = last 20 octets of IMCK[j]
 685          */
 686
 687         if (eap_fast_get_phase2_key(sm, data, isk, sizeof(isk)) < 0)
 688                 return -1;
 689         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: ISK[j]", isk, sizeof(isk));
 690         sha1_t_prf(data->simck, EAP_FAST_SIMCK_LEN,
 691                    "Inner Methods Compound Keys",
 692                    isk, sizeof(isk), imck, sizeof(imck));
 693         data->simck_idx++;
 694         os_memcpy(data->simck, imck, EAP_FAST_SIMCK_LEN);
 695         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: S-IMCK[j]",
 696                         data->simck, EAP_FAST_SIMCK_LEN);
 697         os_memcpy(cmk, imck + EAP_FAST_SIMCK_LEN, EAP_FAST_CMK_LEN);
 698         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: CMK[j]",
 699                         cmk, EAP_FAST_CMK_LEN);
 700
 701         return 0;
 702 }
 703
 704
 705 static u8 * eap_fast_write_pac_request(u8 *pos, u16 pac_type)
 706 {
 707         struct eap_tlv_hdr *pac;
 708         struct eap_tlv_request_action_tlv *act;
 709         struct eap_tlv_pac_type_tlv *type;
 710
 711         act = (struct eap_tlv_request_action_tlv *) pos;
 712         act->tlv_type = host_to_be16(EAP_TLV_REQUEST_ACTION_TLV);
 713         act->length = host_to_be16(2);
 714         act->action = host_to_be16(EAP_TLV_ACTION_PROCESS_TLV);
 715
 716         pac = (struct eap_tlv_hdr *) (act + 1);
 717         pac->tlv_type = host_to_be16(EAP_TLV_PAC_TLV);
 718         pac->length = host_to_be16(sizeof(*type));
 719
 720         type = (struct eap_tlv_pac_type_tlv *) (pac + 1);
 721         type->tlv_type = host_to_be16(PAC_TYPE_PAC_TYPE);
 722         type->length = host_to_be16(2);
 723         type->pac_type = host_to_be16(pac_type);
 724
 725         return (u8 *) (type + 1);
 726 }
 727
 728
 729 static struct wpabuf * eap_fast_process_crypto_binding(
 730         struct eap_sm *sm, struct eap_fast_data *data,
 731         struct eap_method_ret *ret,
 732         struct eap_tlv_crypto_binding_tlv *_bind, size_t bind_len)
 733 {
 734         struct wpabuf *resp;
 735         u8 *pos;
 736         u8 cmk[EAP_FAST_CMK_LEN], cmac[SHA1_MAC_LEN];
 737         int res;
 738         size_t len;
 739
 740         if (eap_fast_validate_crypto_binding(_bind) < 0)
 741                 return NULL;
 742
 743         if (eap_fast_get_cmk(sm, data, cmk) < 0)
 744                 return NULL;
 745
 746         /* Validate received Compound MAC */
 747         os_memcpy(cmac, _bind->compound_mac, sizeof(cmac));
 748         os_memset(_bind->compound_mac, 0, sizeof(cmac));
 749         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Crypto-Binding TLV for Compound "
 750                     "MAC calculation", (u8 *) _bind, bind_len);
 751         hmac_sha1(cmk, EAP_FAST_CMK_LEN, (u8 *) _bind, bind_len,
 752                   _bind->compound_mac);
 753         res = os_memcmp(cmac, _bind->compound_mac, sizeof(cmac));
 754         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Received Compound MAC",
 755                     cmac, sizeof(cmac));
 756         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Calculated Compound MAC",
 757                     _bind->compound_mac, sizeof(cmac));
 758         if (res != 0) {
 759                 wpa_printf(MSG_INFO, "EAP-FAST: Compound MAC did not match");
 760                 os_memcpy(_bind->compound_mac, cmac, sizeof(cmac));
 761                 return NULL;
 762         }
 763
 764         /*
 765          * Compound MAC was valid, so authentication succeeded. Reply with
 766          * crypto binding to allow server to complete authentication.
 767          */
 768
 769         len = sizeof(struct eap_tlv_crypto_binding_tlv);
 770         resp = wpabuf_alloc(len);
 771         if (resp == NULL)
 772                 return NULL;
 773
 774         if (!data->anon_provisioning && data->phase2_success &&
 775             eap_fast_derive_msk(data) < 0) {
 776                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to generate MSK");
 777                 ret->methodState = METHOD_DONE;
 778                 ret->decision = DECISION_FAIL;
 779                 data->phase2_success = 0;
 780                 wpabuf_free(resp);
 781                 return NULL;
 782         }
 783
 784         pos = wpabuf_put(resp, sizeof(struct eap_tlv_crypto_binding_tlv));
 785         eap_fast_write_crypto_binding((struct eap_tlv_crypto_binding_tlv *)
 786                                       pos, _bind, cmk);
 787
 788         return resp;
 789 }
 790
 791
 792 static void eap_fast_parse_pac_tlv(struct eap_fast_pac *entry, int type,
 793                                    u8 *pos, size_t len, int *pac_key_found)
 794 {
 795         switch (type & 0x7fff) {
 796         case PAC_TYPE_PAC_KEY:
 797                 wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: PAC-Key", pos, len);
 798                 if (len != EAP_FAST_PAC_KEY_LEN) {
 799                         wpa_printf(MSG_DEBUG, "EAP-FAST: Invalid PAC-Key "
 800                                    "length %lu", (unsigned long) len);
 801                         break;
 802                 }
 803                 *pac_key_found = 1;
 804                 os_memcpy(entry->pac_key, pos, len);
 805                 break;
 806         case PAC_TYPE_PAC_OPAQUE:
 807                 wpa_hexdump(MSG_DEBUG, "EAP-FAST: PAC-Opaque", pos, len);
 808                 entry->pac_opaque = pos;
 809                 entry->pac_opaque_len = len;
 810                 break;
 811         case PAC_TYPE_PAC_INFO:
 812                 wpa_hexdump(MSG_DEBUG, "EAP-FAST: PAC-Info", pos, len);
 813                 entry->pac_info = pos;
 814                 entry->pac_info_len = len;
 815                 break;
 816         default:
 817                 wpa_printf(MSG_DEBUG, "EAP-FAST: Ignored unknown PAC type %d",
 818                            type);
 819                 break;
 820         }
 821 }
 822
 823
 824 static int eap_fast_process_pac_tlv(struct eap_fast_pac *entry,
 825                                     u8 *pac, size_t pac_len)
 826 {
 827         struct pac_tlv_hdr *hdr;
 828         u8 *pos;
 829         size_t left, len;
 830         int type, pac_key_found = 0;
 831
 832         pos = pac;
 833         left = pac_len;
 834
 835         while (left > sizeof(*hdr)) {
 836                 hdr = (struct pac_tlv_hdr *) pos;
 837                 type = be_to_host16(hdr->type);
 838                 len = be_to_host16(hdr->len);
 839                 pos += sizeof(*hdr);
 840                 left -= sizeof(*hdr);
 841                 if (len > left) {
 842                         wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV overrun "
 843                                    "(type=%d len=%lu left=%lu)",
 844                                    type, (unsigned long) len,
 845                                    (unsigned long) left);
 846                         return -1;
 847                 }
 848
 849                 eap_fast_parse_pac_tlv(entry, type, pos, len, &pac_key_found);
 850
 851                 pos += len;
 852                 left -= len;
 853         }
 854
 855         if (!pac_key_found || !entry->pac_opaque || !entry->pac_info) {
 856                 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV does not include "
 857                            "all the required fields");
 858                 return -1;
 859         }
 860
 861         return 0;
 862 }
 863
 864
 865 static int eap_fast_parse_pac_info(struct eap_fast_pac *entry, int type,
 866                                    u8 *pos, size_t len)
 867 {
 868         u16 pac_type;
 869         u32 lifetime;
 870         struct os_time now;
 871
 872         switch (type & 0x7fff) {
 873         case PAC_TYPE_CRED_LIFETIME:
 874                 if (len != 4) {
 875                         wpa_hexdump(MSG_DEBUG, "EAP-FAST: PAC-Info - "
 876                                     "Invalid CRED_LIFETIME length - ignored",
 877                                     pos, len);
 878                         return 0;
 879                 }
 880
 881                 /*
 882                  * This is not currently saved separately in PAC files since
 883                  * the server can automatically initiate PAC update when
 884                  * needed. Anyway, the information is available from PAC-Info
 885                  * dump if it is needed for something in the future.
 886                  */
 887                 lifetime = WPA_GET_BE32(pos);
 888                 os_get_time(&now);
 889                 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info - CRED_LIFETIME %d "
 890                            "(%d days)",
 891                            lifetime, (lifetime - (u32) now.sec) / 86400);
 892                 break;
 893         case PAC_TYPE_A_ID:
 894                 wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: PAC-Info - A-ID",
 895                                   pos, len);
 896                 entry->a_id = pos;
 897                 entry->a_id_len = len;
 898                 break;
 899         case PAC_TYPE_I_ID:
 900                 wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: PAC-Info - I-ID",
 901                                   pos, len);
 902                 entry->i_id = pos;
 903                 entry->i_id_len = len;
 904                 break;
 905         case PAC_TYPE_A_ID_INFO:
 906                 wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: PAC-Info - A-ID-Info",
 907                                   pos, len);
 908                 entry->a_id_info = pos;
 909                 entry->a_id_info_len = len;
 910                 break;
 911         case PAC_TYPE_PAC_TYPE:
 912                 /*
 913                  * draft-cam-winget-eap-fast-provisioning-04.txt,
 914                  * Section 4.2.6 - PAC-Type TLV
 915                  */
 916                 if (len != 2) {
 917                         wpa_printf(MSG_INFO, "EAP-FAST: Invalid PAC-Type "
 918                                    "length %lu (expected 2)",
 919                                    (unsigned long) len);
 920                         wpa_hexdump_ascii(MSG_DEBUG,
 921                                           "EAP-FAST: PAC-Info - PAC-Type",
 922                                           pos, len);
 923                         return -1;
 924                 }
 925                 pac_type = WPA_GET_BE16(pos);
 926                 if (pac_type != PAC_TYPE_TUNNEL_PAC &&
 927                     pac_type != PAC_TYPE_USER_AUTHORIZATION &&
 928                     pac_type != PAC_TYPE_MACHINE_AUTHENTICATION) {
 929                         wpa_printf(MSG_INFO, "EAP-FAST: Unsupported PAC Type "
 930                                    "%d", pac_type);
 931                         return -1;
 932                 }
 933
 934                 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info - PAC-Type %d",
 935                            pac_type);
 936                 entry->pac_type = pac_type;
 937                 break;
 938         default:
 939                 wpa_printf(MSG_DEBUG, "EAP-FAST: Ignored unknown PAC-Info "
 940                            "type %d", type);
 941                 break;
 942         }
 943
 944         return 0;
 945 }
 946
 947
 948 static int eap_fast_process_pac_info(struct eap_fast_pac *entry)
 949 {
 950         struct pac_tlv_hdr *hdr;
 951         u8 *pos;
 952         size_t left, len;
 953         int type;
 954
 955         /* draft-cam-winget-eap-fast-provisioning-04.txt, Section 4.2.4 */
 956
 957         /* PAC-Type defaults to Tunnel PAC (Type 1) */
 958         entry->pac_type = PAC_TYPE_TUNNEL_PAC;
 959
 960         pos = entry->pac_info;
 961         left = entry->pac_info_len;
 962         while (left > sizeof(*hdr)) {
 963                 hdr = (struct pac_tlv_hdr *) pos;
 964                 type = be_to_host16(hdr->type);
 965                 len = be_to_host16(hdr->len);
 966                 pos += sizeof(*hdr);
 967                 left -= sizeof(*hdr);
 968                 if (len > left) {
 969                         wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info overrun "
 970                                    "(type=%d len=%lu left=%lu)",
 971                                    type, (unsigned long) len,
 972                                    (unsigned long) left);
 973                         return -1;
 974                 }
 975
 976                 if (eap_fast_parse_pac_info(entry, type, pos, len) < 0)
 977                         return -1;
 978
 979                 pos += len;
 980                 left -= len;
 981         }
 982
 983         if (entry->a_id == NULL || entry->a_id_info == NULL) {
 984                 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info does not include "
 985                            "all the required fields");
 986                 return -1;
 987         }
 988
 989         return 0;
 990 }
 991
 992
 993 static struct wpabuf * eap_fast_process_pac(struct eap_sm *sm,
 994                                             struct eap_fast_data *data,
 995                                             struct eap_method_ret *ret,
 996                                             u8 *pac, size_t pac_len)
 997 {
 998         struct eap_peer_config *config = eap_get_config(sm);
 999         struct eap_fast_pac entry;
1000
1001         os_memset(&entry, 0, sizeof(entry));
1002         if (eap_fast_process_pac_tlv(&entry, pac, pac_len) ||
1003             eap_fast_process_pac_info(&entry))
1004                 return NULL;
1005
1006         eap_fast_add_pac(&data->pac, &data->current_pac, &entry);
1007         eap_fast_pac_list_truncate(data->pac, data->max_pac_list_len);
1008         if (data->use_pac_binary_format)
1009                 eap_fast_save_pac_bin(sm, data->pac, config->pac_file);
1010         else
1011                 eap_fast_save_pac(sm, data->pac, config->pac_file);
1012
1013         if (data->provisioning) {
1014                 if (data->anon_provisioning) {
1015                         /*
1016                          * Unauthenticated provisioning does not provide keying
1017                          * material and must end with an EAP-Failure.
1018                          * Authentication will be done separately after this.
1019                          */
1020                         data->success = 0;
1021                         ret->decision = DECISION_FAIL;
1022                 } else {
1023                         /*
1024                          * Server may or may not allow authenticated
1025                          * provisioning also for key generation.
1026                          */
1027                         ret->decision = DECISION_COND_SUCC;
1028                 }
1029                 wpa_printf(MSG_DEBUG, "EAP-FAST: Send PAC-Acknowledgement TLV "
1030                            "- Provisioning completed successfully");
1031         } else {
1032                 /*
1033                  * This is PAC refreshing, i.e., normal authentication that is
1034                  * expected to be completed with an EAP-Success.
1035                  */
1036                 wpa_printf(MSG_DEBUG, "EAP-FAST: Send PAC-Acknowledgement TLV "
1037                            "- PAC refreshing completed successfully");
1038                 ret->decision = DECISION_UNCOND_SUCC;
1039         }
1040         ret->methodState = METHOD_DONE;
1041         return eap_fast_tlv_pac_ack();
1042 }
1043
1044
1045 static int eap_fast_parse_decrypted(struct wpabuf *decrypted,
1046                                     struct eap_fast_tlv_parse *tlv,
1047                                     struct wpabuf **resp)
1048 {
1049         int mandatory, tlv_type, len, res;
1050         u8 *pos, *end;
1051
1052         os_memset(tlv, 0, sizeof(*tlv));
1053
1054         /* Parse TLVs from the decrypted Phase 2 data */
1055         pos = wpabuf_mhead(decrypted);
1056         end = pos + wpabuf_len(decrypted);
1057         while (pos + 4 < end) {
1058                 mandatory = pos[0] & 0x80;
1059                 tlv_type = WPA_GET_BE16(pos) & 0x3fff;
1060                 pos += 2;
1061                 len = WPA_GET_BE16(pos);
1062                 pos += 2;
1063                 if (pos + len > end) {
1064                         wpa_printf(MSG_INFO, "EAP-FAST: TLV overflow");
1065                         return -1;
1066                 }
1067                 wpa_printf(MSG_DEBUG, "EAP-FAST: Received Phase 2: "
1068                            "TLV type %d length %d%s",
1069                            tlv_type, len, mandatory ? " (mandatory)" : "");
1070
1071                 res = eap_fast_parse_tlv(tlv, tlv_type, pos, len);
1072                 if (res == -2)
1073                         break;
1074                 if (res < 0) {
1075                         if (mandatory) {
1076                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Nak unknown "
1077                                            "mandatory TLV type %d", tlv_type);
1078                                 *resp = eap_fast_tlv_nak(0, tlv_type);
1079                                 break;
1080                         } else {
1081                                 wpa_printf(MSG_DEBUG, "EAP-FAST: ignored "
1082                                            "unknown optional TLV type %d",
1083                                            tlv_type);
1084                         }
1085                 }
1086
1087                 pos += len;
1088         }
1089
1090         return 0;
1091 }
1092
1093
1094 static int eap_fast_encrypt_response(struct eap_sm *sm,
1095                                      struct eap_fast_data *data,
1096                                      struct wpabuf *resp,
1097                                      u8 identifier, struct wpabuf **out_data)
1098 {
1099         if (resp == NULL)
1100                 return 0;
1101
1102         wpa_hexdump_buf(MSG_DEBUG, "EAP-FAST: Encrypting Phase 2 data",
1103                         resp);
1104         if (eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_FAST,
1105                                  data->fast_version, identifier,
1106                                  resp, out_data)) {
1107                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to encrypt a Phase 2 "
1108                            "frame");
1109         }
1110         wpabuf_free(resp);
1111
1112         return 0;
1113 }
1114
1115
1116 static struct wpabuf * eap_fast_pac_request(void)
1117 {
1118         struct wpabuf *tmp;
1119         u8 *pos, *pos2;
1120
1121         tmp = wpabuf_alloc(sizeof(struct eap_tlv_hdr) +
1122                            sizeof(struct eap_tlv_request_action_tlv) +
1123                            sizeof(struct eap_tlv_pac_type_tlv));
1124         if (tmp == NULL)
1125                 return NULL;
1126
1127         pos = wpabuf_put(tmp, 0);
1128         pos2 = eap_fast_write_pac_request(pos, PAC_TYPE_TUNNEL_PAC);
1129         wpabuf_put(tmp, pos2 - pos);
1130         return tmp;
1131 }
1132
1133
1134 static int eap_fast_process_decrypted(struct eap_sm *sm,
1135                                       struct eap_fast_data *data,
1136                                       struct eap_method_ret *ret,
1137                                       const struct eap_hdr *req,
1138                                       struct wpabuf *decrypted,
1139                                       struct wpabuf **out_data)
1140 {
1141         struct wpabuf *resp = NULL, *tmp;
1142         struct eap_fast_tlv_parse tlv;
1143         int failed = 0;
1144
1145         if (eap_fast_parse_decrypted(decrypted, &tlv, &resp) < 0)
1146                 return 0;
1147         if (resp)
1148                 return eap_fast_encrypt_response(sm, data, resp,
1149                                                  req->identifier, out_data);
1150
1151         if (tlv.result == EAP_TLV_RESULT_FAILURE) {
1152                 resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0);
1153                 return eap_fast_encrypt_response(sm, data, resp,
1154                                                  req->identifier, out_data);
1155         }
1156
1157         if (tlv.iresult == EAP_TLV_RESULT_FAILURE) {
1158                 resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 1);
1159                 return eap_fast_encrypt_response(sm, data, resp,
1160                                                  req->identifier, out_data);
1161         }
1162
1163         if (tlv.crypto_binding) {
1164                 tmp = eap_fast_process_crypto_binding(sm, data, ret,
1165                                                       tlv.crypto_binding,
1166                                                       tlv.crypto_binding_len);
1167                 if (tmp == NULL)
1168                         failed = 1;
1169                 else
1170                         resp = wpabuf_concat(resp, tmp);
1171         }
1172
1173         if (tlv.iresult == EAP_TLV_RESULT_SUCCESS) {
1174                 tmp = eap_fast_tlv_result(failed ? EAP_TLV_RESULT_FAILURE :
1175                                           EAP_TLV_RESULT_SUCCESS, 1);
1176                 resp = wpabuf_concat(resp, tmp);
1177         }
1178
1179         if (tlv.eap_payload_tlv) {
1180                 tmp = eap_fast_process_eap_payload_tlv(
1181                         sm, data, ret, req, tlv.eap_payload_tlv,
1182                         tlv.eap_payload_tlv_len);
1183                 resp = wpabuf_concat(resp, tmp);
1184         }
1185
1186         if (tlv.pac && tlv.result != EAP_TLV_RESULT_SUCCESS) {
1187                 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV without Result TLV "
1188                            "acknowledging success");
1189                 failed = 1;
1190         } else if (tlv.pac && tlv.result == EAP_TLV_RESULT_SUCCESS) {
1191                 tmp = eap_fast_process_pac(sm, data, ret, tlv.pac,
1192                                            tlv.pac_len);
1193                 resp = wpabuf_concat(resp, tmp);
1194         }
1195
1196         if (data->current_pac == NULL && data->provisioning &&
1197             !data->anon_provisioning && !tlv.pac &&
1198             (tlv.iresult == EAP_TLV_RESULT_SUCCESS ||
1199              tlv.result == EAP_TLV_RESULT_SUCCESS)) {
1200                 /*
1201                  * Need to request Tunnel PAC when using authenticated
1202                  * provisioning.
1203                  */
1204                 wpa_printf(MSG_DEBUG, "EAP-FAST: Request Tunnel PAC");
1205                 tmp = eap_fast_pac_request();
1206                 resp = wpabuf_concat(resp, tmp);
1207         }
1208
1209         if (tlv.result == EAP_TLV_RESULT_SUCCESS && !failed) {
1210                 tmp = eap_fast_tlv_result(EAP_TLV_RESULT_SUCCESS, 0);
1211                 resp = wpabuf_concat(tmp, resp);
1212         } else if (failed) {
1213                 tmp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0);
1214                 resp = wpabuf_concat(tmp, resp);
1215         }
1216
1217         if (resp && tlv.result == EAP_TLV_RESULT_SUCCESS && !failed &&
1218             tlv.crypto_binding && data->phase2_success) {
1219                 if (data->anon_provisioning) {
1220                         wpa_printf(MSG_DEBUG, "EAP-FAST: Unauthenticated "
1221                                    "provisioning completed successfully.");
1222                         ret->methodState = METHOD_DONE;
1223                         ret->decision = DECISION_FAIL;
1224                 } else {
1225                         wpa_printf(MSG_DEBUG, "EAP-FAST: Authentication "
1226                                    "completed successfully.");
1227                         if (data->provisioning)
1228                                 ret->methodState = METHOD_MAY_CONT;
1229                         else
1230                                 ret->methodState = METHOD_DONE;
1231                         ret->decision = DECISION_UNCOND_SUCC;
1232                 }
1233         }
1234
1235         if (resp == NULL) {
1236                 wpa_printf(MSG_DEBUG, "EAP-FAST: No recognized TLVs - send "
1237                            "empty response packet");
1238                 resp = wpabuf_alloc(1);
1239         }
1240
1241         return eap_fast_encrypt_response(sm, data, resp, req->identifier,
1242                                          out_data);
1243 }
1244
1245
1246 static int eap_fast_decrypt(struct eap_sm *sm, struct eap_fast_data *data,
1247                             struct eap_method_ret *ret,
1248                             const struct eap_hdr *req,
1249                             const struct wpabuf *in_data,
1250                             struct wpabuf **out_data)
1251 {
1252         struct wpabuf *in_decrypted;
1253         int res;
1254
1255         wpa_printf(MSG_DEBUG, "EAP-FAST: Received %lu bytes encrypted data for"
1256                    " Phase 2", (unsigned long) wpabuf_len(in_data));
1257
1258         if (data->pending_phase2_req) {
1259                 wpa_printf(MSG_DEBUG, "EAP-FAST: Pending Phase 2 request - "
1260                            "skip decryption and use old data");
1261                 /* Clear TLS reassembly state. */
1262                 eap_peer_tls_reset_input(&data->ssl);
1263
1264                 in_decrypted = data->pending_phase2_req;
1265                 data->pending_phase2_req = NULL;
1266                 goto continue_req;
1267         }
1268
1269         if (wpabuf_len(in_data) == 0) {
1270                 /* Received TLS ACK - requesting more fragments */
1271                 return eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_FAST,
1272                                             data->fast_version,
1273                                             req->identifier, NULL, out_data);
1274         }
1275
1276         res = eap_peer_tls_decrypt(sm, &data->ssl, in_data, &in_decrypted);
1277         if (res)
1278                 return res;
1279
1280 continue_req:
1281         wpa_hexdump_buf(MSG_MSGDUMP, "EAP-FAST: Decrypted Phase 2 TLV(s)",
1282                         in_decrypted);
1283
1284         if (wpabuf_len(in_decrypted) < 4) {
1285                 wpa_printf(MSG_INFO, "EAP-FAST: Too short Phase 2 "
1286                            "TLV frame (len=%lu)",
1287                            (unsigned long) wpabuf_len(in_decrypted));
1288                 wpabuf_free(in_decrypted);
1289                 return -1;
1290         }
1291
1292         res = eap_fast_process_decrypted(sm, data, ret, req,
1293                                          in_decrypted, out_data);
1294
1295         wpabuf_free(in_decrypted);
1296
1297         return res;
1298 }
1299
1300
1301 static const u8 * eap_fast_get_a_id(const u8 *buf, size_t len, size_t *id_len)
1302 {
1303         const u8 *a_id;
1304         struct pac_tlv_hdr *hdr;
1305
1306         /*
1307          * Parse authority identity (A-ID) from the EAP-FAST/Start. This
1308          * supports both raw A-ID and one inside an A-ID TLV.
1309          */
1310         a_id = buf;
1311         *id_len = len;
1312         if (len > sizeof(*hdr)) {
1313                 int tlen;
1314                 hdr = (struct pac_tlv_hdr *) buf;
1315                 tlen = be_to_host16(hdr->len);
1316                 if (be_to_host16(hdr->type) == PAC_TYPE_A_ID &&
1317                     sizeof(*hdr) + tlen <= len) {
1318                         wpa_printf(MSG_DEBUG, "EAP-FAST: A-ID was in TLV "
1319                                    "(Start)");
1320                         a_id = (u8 *) (hdr + 1);
1321                         *id_len = tlen;
1322                 }
1323         }
1324         wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: A-ID", a_id, *id_len);
1325
1326         return a_id;
1327 }
1328
1329
1330 static void eap_fast_select_pac(struct eap_fast_data *data,
1331                                 const u8 *a_id, size_t a_id_len)
1332 {
1333         data->current_pac = eap_fast_get_pac(data->pac, a_id, a_id_len,
1334                                              PAC_TYPE_TUNNEL_PAC);
1335         if (data->current_pac == NULL) {
1336                 /*
1337                  * Tunnel PAC was not available for this A-ID. Try to use
1338                  * Machine Authentication PAC, if one is available.
1339                  */
1340                 data->current_pac = eap_fast_get_pac(
1341                         data->pac, a_id, a_id_len,
1342                         PAC_TYPE_MACHINE_AUTHENTICATION);
1343         }
1344
1345         if (data->current_pac) {
1346                 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC found for this A-ID "
1347                            "(PAC-Type %d)", data->current_pac->pac_type);
1348                 wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-FAST: A-ID-Info",
1349                                   data->current_pac->a_id_info,
1350                                   data->current_pac->a_id_info_len);
1351         }
1352 }
1353
1354
1355 static int eap_fast_use_pac_opaque(struct eap_sm *sm,
1356                                    struct eap_fast_data *data,
1357                                    struct eap_fast_pac *pac)
1358 {
1359         u8 *tlv;
1360         size_t tlv_len, olen;
1361         struct eap_tlv_hdr *ehdr;
1362
1363         olen = pac->pac_opaque_len;
1364         tlv_len = sizeof(*ehdr) + olen;
1365         tlv = os_malloc(tlv_len);
1366         if (tlv) {
1367                 ehdr = (struct eap_tlv_hdr *) tlv;
1368                 ehdr->tlv_type = host_to_be16(PAC_TYPE_PAC_OPAQUE);
1369                 ehdr->length = host_to_be16(olen);
1370                 os_memcpy(ehdr + 1, pac->pac_opaque, olen);
1371         }
1372         if (tlv == NULL ||
1373             tls_connection_client_hello_ext(sm->ssl_ctx, data->ssl.conn,
1374                                             TLS_EXT_PAC_OPAQUE,
1375                                             tlv, tlv_len) < 0) {
1376                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to add PAC-Opaque TLS "
1377                            "extension");
1378                 os_free(tlv);
1379                 return -1;
1380         }
1381         os_free(tlv);
1382
1383         return 0;
1384 }
1385
1386
1387 static int eap_fast_clear_pac_opaque_ext(struct eap_sm *sm,
1388                                          struct eap_fast_data *data)
1389 {
1390         if (tls_connection_client_hello_ext(sm->ssl_ctx, data->ssl.conn,
1391                                             TLS_EXT_PAC_OPAQUE, NULL, 0) < 0) {
1392                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to remove PAC-Opaque "
1393                            "TLS extension");
1394                 return -1;
1395         }
1396         return 0;
1397 }
1398
1399
1400 static int eap_fast_set_provisioning_ciphers(struct eap_sm *sm,
1401                                              struct eap_fast_data *data)
1402 {
1403         u8 ciphers[5];
1404         int count = 0;
1405
1406         if (data->provisioning_allowed & EAP_FAST_PROV_UNAUTH) {
1407                 wpa_printf(MSG_DEBUG, "EAP-FAST: Enabling unauthenticated "
1408                            "provisioning TLS cipher suites");
1409                 ciphers[count++] = TLS_CIPHER_ANON_DH_AES128_SHA;
1410         }
1411
1412         if (data->provisioning_allowed & EAP_FAST_PROV_AUTH) {
1413                 wpa_printf(MSG_DEBUG, "EAP-FAST: Enabling authenticated "
1414                            "provisioning TLS cipher suites");
1415                 ciphers[count++] = TLS_CIPHER_RSA_DHE_AES128_SHA;
1416                 ciphers[count++] = TLS_CIPHER_AES128_SHA;
1417                 ciphers[count++] = TLS_CIPHER_RC4_SHA;
1418         }
1419
1420         ciphers[count++] = TLS_CIPHER_NONE;
1421
1422         if (tls_connection_set_cipher_list(sm->ssl_ctx, data->ssl.conn,
1423                                            ciphers)) {
1424                 wpa_printf(MSG_INFO, "EAP-FAST: Could not configure TLS "
1425                            "cipher suites for provisioning");
1426                 return -1;
1427         }
1428
1429         return 0;
1430 }
1431
1432
1433 static int eap_fast_process_start(struct eap_sm *sm,
1434                                   struct eap_fast_data *data, u8 flags,
1435                                   const u8 *pos, size_t left)
1436 {
1437         const u8 *a_id;
1438         size_t a_id_len;
1439
1440         /* EAP-FAST Version negotiation (section 3.1) */
1441         wpa_printf(MSG_DEBUG, "EAP-FAST: Start (server ver=%d, own ver=%d)",
1442                    flags & EAP_PEAP_VERSION_MASK, data->fast_version);
1443         if ((flags & EAP_PEAP_VERSION_MASK) < data->fast_version)
1444                 data->fast_version = flags & EAP_PEAP_VERSION_MASK;
1445         wpa_printf(MSG_DEBUG, "EAP-FAST: Using FAST version %d",
1446                    data->fast_version);
1447
1448         a_id = eap_fast_get_a_id(pos, left, &a_id_len);
1449         eap_fast_select_pac(data, a_id, a_id_len);
1450
1451         if (data->resuming && data->current_pac) {
1452                 wpa_printf(MSG_DEBUG, "EAP-FAST: Trying to resume session - "
1453                            "do not add PAC-Opaque to TLS ClientHello");
1454                 if (eap_fast_clear_pac_opaque_ext(sm, data) < 0)
1455                         return -1;
1456         } else if (data->current_pac) {
1457                 /*
1458                  * PAC found for the A-ID and we are not resuming an old
1459                  * session, so add PAC-Opaque extension to ClientHello.
1460                  */
1461                 if (eap_fast_use_pac_opaque(sm, data, data->current_pac) < 0)
1462                         return -1;
1463         } else {
1464                 /* No PAC found, so we must provision one. */
1465                 if (!data->provisioning_allowed) {
1466                         wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC found and "
1467                                    "provisioning disabled");
1468                         return -1;
1469                 }
1470                 wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC found - "
1471                            "starting provisioning");
1472                 if (eap_fast_set_provisioning_ciphers(sm, data) < 0 ||
1473                     eap_fast_clear_pac_opaque_ext(sm, data) < 0)
1474                         return -1;
1475                 data->provisioning = 1;
1476         }
1477
1478         return 0;
1479 }
1480
1481
1482 static struct wpabuf * eap_fast_process(struct eap_sm *sm, void *priv,
1483                                         struct eap_method_ret *ret,
1484                                         const struct wpabuf *reqData)
1485 {
1486         const struct eap_hdr *req;
1487         size_t left;
1488         int res;
1489         u8 flags, id;
1490         struct wpabuf *resp;
1491         const u8 *pos;
1492         struct eap_fast_data *data = priv;
1493
1494         pos = eap_peer_tls_process_init(sm, &data->ssl, EAP_TYPE_FAST, ret,
1495                                         reqData, &left, &flags);
1496         if (pos == NULL)
1497                 return NULL;
1498
1499         req = wpabuf_head(reqData);
1500         id = req->identifier;
1501
1502         if (flags & EAP_TLS_FLAGS_START) {
1503                 if (eap_fast_process_start(sm, data, flags, pos, left) < 0)
1504                         return NULL;
1505
1506                 left = 0; /* A-ID is not used in further packet processing */
1507         }
1508
1509         resp = NULL;
1510         if (tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&
1511             !data->resuming) {
1512                 /* Process tunneled (encrypted) phase 2 data. */
1513                 struct wpabuf msg;
1514                 wpabuf_set(&msg, pos, left);
1515                 res = eap_fast_decrypt(sm, data, ret, req, &msg, &resp);
1516                 if (res < 0) {
1517                         ret->methodState = METHOD_DONE;
1518                         ret->decision = DECISION_FAIL;
1519                         /*
1520                          * Ack possible Alert that may have caused failure in
1521                          * decryption.
1522                          */
1523                         res = 1;
1524                 }
1525         } else {
1526                 /* Continue processing TLS handshake (phase 1). */
1527                 res = eap_peer_tls_process_helper(sm, &data->ssl,
1528                                                   EAP_TYPE_FAST,
1529                                                   data->fast_version, id, pos,
1530                                                   left, &resp);
1531
1532                 if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) {
1533                         char cipher[80];
1534                         wpa_printf(MSG_DEBUG,
1535                                    "EAP-FAST: TLS done, proceed to Phase 2");
1536                         if (data->provisioning &&
1537                             (!(data->provisioning_allowed &
1538                                EAP_FAST_PROV_AUTH) ||
1539                              tls_get_cipher(sm->ssl_ctx, data->ssl.conn,
1540                                             cipher, sizeof(cipher)) < 0 ||
1541                              os_strstr(cipher, "ADH-") ||
1542                              os_strstr(cipher, "anon"))) {
1543                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Using "
1544                                            "anonymous (unauthenticated) "
1545                                            "provisioning");
1546                                 data->anon_provisioning = 1;
1547                         } else
1548                                 data->anon_provisioning = 0;
1549                         data->resuming = 0;
1550                         eap_fast_derive_keys(sm, data);
1551                 }
1552
1553                 if (res == 2) {
1554                         struct wpabuf msg;
1555                         /*
1556                          * Application data included in the handshake message.
1557                          */
1558                         wpabuf_free(data->pending_phase2_req);
1559                         data->pending_phase2_req = resp;
1560                         resp = NULL;
1561                         wpabuf_set(&msg, pos, left);
1562                         res = eap_fast_decrypt(sm, data, ret, req, &msg,
1563                                                &resp);
1564                 }
1565         }
1566
1567         if (res == 1) {
1568                 wpabuf_free(resp);
1569                 return eap_peer_tls_build_ack(id, EAP_TYPE_FAST,
1570                                               data->fast_version);
1571         }
1572
1573         return resp;
1574 }
1575
1576
1577 #if 0 /* FIX */
1578 static Boolean eap_fast_has_reauth_data(struct eap_sm *sm, void *priv)
1579 {
1580         struct eap_fast_data *data = priv;
1581         return tls_connection_established(sm->ssl_ctx, data->ssl.conn);
1582 }
1583
1584
1585 static void eap_fast_deinit_for_reauth(struct eap_sm *sm, void *priv)
1586 {
1587         struct eap_fast_data *data = priv;
1588         os_free(data->key_block_p);
1589         data->key_block_p = NULL;
1590         wpabuf_free(data->pending_phase2_req);
1591         data->pending_phase2_req = NULL;
1592 }
1593
1594
1595 static void * eap_fast_init_for_reauth(struct eap_sm *sm, void *priv)
1596 {
1597         struct eap_fast_data *data = priv;
1598         if (eap_peer_tls_reauth_init(sm, &data->ssl)) {
1599                 os_free(data);
1600                 return NULL;
1601         }
1602         if (data->phase2_priv && data->phase2_method &&
1603             data->phase2_method->init_for_reauth)
1604                 data->phase2_method->init_for_reauth(sm, data->phase2_priv);
1605         data->phase2_success = 0;
1606         data->resuming = 1;
1607         data->provisioning = 0;
1608         data->anon_provisioning = 0;
1609         data->simck_idx = 0;
1610         return priv;
1611 }
1612 #endif
1613
1614
1615 static int eap_fast_get_status(struct eap_sm *sm, void *priv, char *buf,
1616                                size_t buflen, int verbose)
1617 {
1618         struct eap_fast_data *data = priv;
1619         int len, ret;
1620
1621         len = eap_peer_tls_status(sm, &data->ssl, buf, buflen, verbose);
1622         if (data->phase2_method) {
1623                 ret = os_snprintf(buf + len, buflen - len,
1624                                   "EAP-FAST Phase2 method=%s\n",
1625                                   data->phase2_method->name);
1626                 if (ret < 0 || (size_t) ret >= buflen - len)
1627                         return len;
1628                 len += ret;
1629         }
1630         return len;
1631 }
1632
1633
1634 static Boolean eap_fast_isKeyAvailable(struct eap_sm *sm, void *priv)
1635 {
1636         struct eap_fast_data *data = priv;
1637         return data->success;
1638 }
1639
1640
1641 static u8 * eap_fast_getKey(struct eap_sm *sm, void *priv, size_t *len)
1642 {
1643         struct eap_fast_data *data = priv;
1644         u8 *key;
1645
1646         if (!data->success)
1647                 return NULL;
1648
1649         key = os_malloc(EAP_FAST_KEY_LEN);
1650         if (key == NULL)
1651                 return NULL;
1652
1653         *len = EAP_FAST_KEY_LEN;
1654         os_memcpy(key, data->key_data, EAP_FAST_KEY_LEN);
1655
1656         return key;
1657 }
1658
1659
1660 static u8 * eap_fast_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
1661 {
1662         struct eap_fast_data *data = priv;
1663         u8 *key;
1664
1665         if (!data->success)
1666                 return NULL;
1667
1668         key = os_malloc(EAP_EMSK_LEN);
1669         if (key == NULL)
1670                 return NULL;
1671
1672         *len = EAP_EMSK_LEN;
1673         os_memcpy(key, data->emsk, EAP_EMSK_LEN);
1674
1675         return key;
1676 }
1677
1678
1679 int eap_peer_fast_register(void)
1680 {
1681         struct eap_method *eap;
1682         int ret;
1683
1684         eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
1685                                     EAP_VENDOR_IETF, EAP_TYPE_FAST, "FAST");
1686         if (eap == NULL)
1687                 return -1;
1688
1689         eap->init = eap_fast_init;
1690         eap->deinit = eap_fast_deinit;
1691         eap->process = eap_fast_process;
1692         eap->isKeyAvailable = eap_fast_isKeyAvailable;
1693         eap->getKey = eap_fast_getKey;
1694         eap->get_status = eap_fast_get_status;
1695 #if 0
1696         eap->has_reauth_data = eap_fast_has_reauth_data;
1697         eap->deinit_for_reauth = eap_fast_deinit_for_reauth;
1698         eap->init_for_reauth = eap_fast_init_for_reauth;
1699 #endif
1700         eap->get_emsk = eap_fast_get_emsk;
1701
1702         ret = eap_peer_method_register(eap);
1703         if (ret)
1704                 eap_peer_method_free(eap);
1705         return ret;
1706 }