src/eap_server/eap_fast.c

   1 /*
   2  * EAP-FAST server (RFC 4851)
   3  * Copyright (c) 2004-2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "aes_wrap.h"
  19 #include "sha1.h"
  20 #include "eap_i.h"
  21 #include "eap_tls_common.h"
  22 #include "tls.h"
  23 #include "eap_common/eap_tlv_common.h"
  24 #include "eap_common/eap_fast_common.h"
  25
  26
  27 static void eap_fast_reset(struct eap_sm *sm, void *priv);
  28
  29
  30 /* Private PAC-Opaque TLV types */
  31 #define PAC_OPAQUE_TYPE_PAD 0
  32 #define PAC_OPAQUE_TYPE_KEY 1
  33 #define PAC_OPAQUE_TYPE_LIFETIME 2
  34 #define PAC_OPAQUE_TYPE_IDENTITY 3
  35
  36 /* PAC-Key lifetime in seconds (hard limit) */
  37 #define PAC_KEY_LIFETIME (7 * 24 * 60 * 60)
  38
  39 /*
  40  * PAC-Key refresh time in seconds (soft limit on remaining hard limit). The
  41  * server will generate a new PAC-Key when this number of seconds (or fewer)
  42  * of the lifetime.
  43  */
  44 #define PAC_KEY_REFRESH_TIME (1 * 24 * 60 * 60)
  45
  46
  47 struct eap_fast_data {
  48         struct eap_ssl_data ssl;
  49         enum {
  50                 START, PHASE1, PHASE2_START, PHASE2_ID, PHASE2_METHOD,
  51                 CRYPTO_BINDING, REQUEST_PAC, SUCCESS, FAILURE
  52         } state;
  53
  54         int fast_version;
  55         const struct eap_method *phase2_method;
  56         void *phase2_priv;
  57         int force_version;
  58         int peer_version;
  59
  60         u8 crypto_binding_nonce[32];
  61         int final_result;
  62
  63         struct eap_fast_key_block_provisioning *key_block_p;
  64
  65         u8 simck[EAP_FAST_SIMCK_LEN];
  66         u8 cmk[EAP_FAST_CMK_LEN];
  67         int simck_idx;
  68
  69         u8 pac_opaque_encr[16];
  70         char *srv_id;
  71
  72         int anon_provisioning;
  73         int send_new_pac; /* server triggered re-keying of Tunnel PAC */
  74         struct wpabuf *pending_phase2_resp;
  75         u8 *identity; /* from PAC-Opaque */
  76         size_t identity_len;
  77         int eap_seq;
  78         int tnc_started;
  79 };
  80
  81
  82 static const char * eap_fast_state_txt(int state)
  83 {
  84         switch (state) {
  85         case START:
  86                 return "START";
  87         case PHASE1:
  88                 return "PHASE1";
  89         case PHASE2_START:
  90                 return "PHASE2_START";
  91         case PHASE2_ID:
  92                 return "PHASE2_ID";
  93         case PHASE2_METHOD:
  94                 return "PHASE2_METHOD";
  95         case CRYPTO_BINDING:
  96                 return "CRYPTO_BINDING";
  97         case REQUEST_PAC:
  98                 return "REQUEST_PAC";
  99         case SUCCESS:
 100                 return "SUCCESS";
 101         case FAILURE:
 102                 return "FAILURE";
 103         default:
 104                 return "Unknown?!";
 105         }
 106 }
 107
 108
 109 static void eap_fast_state(struct eap_fast_data *data, int state)
 110 {
 111         wpa_printf(MSG_DEBUG, "EAP-FAST: %s -> %s",
 112                    eap_fast_state_txt(data->state),
 113                    eap_fast_state_txt(state));
 114         data->state = state;
 115 }
 116
 117
 118 static EapType eap_fast_req_failure(struct eap_sm *sm,
 119                                     struct eap_fast_data *data)
 120 {
 121         /* TODO: send Result TLV(FAILURE) */
 122         eap_fast_state(data, FAILURE);
 123         return EAP_TYPE_NONE;
 124 }
 125
 126
 127 static int eap_fast_session_ticket_cb(void *ctx, const u8 *ticket, size_t len,
 128                                       const u8 *client_random,
 129                                       const u8 *server_random,
 130                                       u8 *master_secret)
 131 {
 132         struct eap_fast_data *data = ctx;
 133         const u8 *pac_opaque;
 134         size_t pac_opaque_len;
 135         u8 *buf, *pos, *end, *pac_key = NULL;
 136         os_time_t lifetime = 0;
 137         struct os_time now;
 138         u8 *identity = NULL;
 139         size_t identity_len = 0;
 140
 141         wpa_printf(MSG_DEBUG, "EAP-FAST: SessionTicket callback");
 142         wpa_hexdump(MSG_DEBUG, "EAP-FAST: SessionTicket (PAC-Opaque)",
 143                     ticket, len);
 144
 145         if (len < 4 || WPA_GET_BE16(ticket) != PAC_TYPE_PAC_OPAQUE) {
 146                 wpa_printf(MSG_DEBUG, "EAP-FAST: Ignore invalid "
 147                            "SessionTicket");
 148                 return 0;
 149         }
 150
 151         pac_opaque_len = WPA_GET_BE16(ticket + 2);
 152         pac_opaque = ticket + 4;
 153         if (pac_opaque_len < 8 || pac_opaque_len % 8 ||
 154             pac_opaque_len > len - 4) {
 155                 wpa_printf(MSG_DEBUG, "EAP-FAST: Ignore invalid PAC-Opaque "
 156                            "(len=%lu left=%lu)",
 157                            (unsigned long) pac_opaque_len,
 158                            (unsigned long) len);
 159                 return 0;
 160         }
 161         wpa_hexdump(MSG_DEBUG, "EAP-FAST: Received PAC-Opaque",
 162                     pac_opaque, pac_opaque_len);
 163
 164         buf = os_malloc(pac_opaque_len - 8);
 165         if (buf == NULL) {
 166                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to allocate memory "
 167                            "for decrypting PAC-Opaque");
 168                 return 0;
 169         }
 170
 171         if (aes_unwrap(data->pac_opaque_encr, (pac_opaque_len - 8) / 8,
 172                        pac_opaque, buf) < 0) {
 173                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to decrypt "
 174                            "PAC-Opaque");
 175                 os_free(buf);
 176                 /*
 177                  * This may have been caused by server changing the PAC-Opaque
 178                  * encryption key, so just ignore this PAC-Opaque instead of
 179                  * failing the authentication completely. Provisioning can now
 180                  * be used to provision a new PAC.
 181                  */
 182                 return 0;
 183         }
 184
 185         end = buf + pac_opaque_len - 8;
 186         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Decrypted PAC-Opaque",
 187                         buf, end - buf);
 188
 189         pos = buf;
 190         while (pos + 1 < end) {
 191                 if (pos + 2 + pos[1] > end)
 192                         break;
 193
 194                 switch (*pos) {
 195                 case PAC_OPAQUE_TYPE_PAD:
 196                         pos = end;
 197                         break;
 198                 case PAC_OPAQUE_TYPE_KEY:
 199                         if (pos[1] != EAP_FAST_PAC_KEY_LEN) {
 200                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Invalid "
 201                                            "PAC-Key length %d", pos[1]);
 202                                 os_free(buf);
 203                                 return -1;
 204                         }
 205                         pac_key = pos + 2;
 206                         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: PAC-Key from "
 207                                         "decrypted PAC-Opaque",
 208                                         pac_key, EAP_FAST_PAC_KEY_LEN);
 209                         break;
 210                 case PAC_OPAQUE_TYPE_LIFETIME:
 211                         if (pos[1] != 4) {
 212                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Invalid "
 213                                            "PAC-Key lifetime length %d",
 214                                            pos[1]);
 215                                 os_free(buf);
 216                                 return -1;
 217                         }
 218                         lifetime = WPA_GET_BE32(pos + 2);
 219                         break;
 220                 case PAC_OPAQUE_TYPE_IDENTITY:
 221                         identity = pos + 2;
 222                         identity_len = pos[1];
 223                         break;
 224                 }
 225
 226                 pos += 2 + pos[1];
 227         }
 228
 229         if (pac_key == NULL) {
 230                 wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC-Key included in "
 231                            "PAC-Opaque");
 232                 os_free(buf);
 233                 return -1;
 234         }
 235
 236         if (identity) {
 237                 wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: Identity from "
 238                                   "PAC-Opaque", identity, identity_len);
 239                 os_free(data->identity);
 240                 data->identity = os_malloc(identity_len);
 241                 if (data->identity) {
 242                         os_memcpy(data->identity, identity, identity_len);
 243                         data->identity_len = identity_len;
 244                 }
 245         }
 246
 247         if (os_get_time(&now) < 0 || lifetime <= 0 || now.sec > lifetime) {
 248                 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Key not valid anymore "
 249                            "(lifetime=%ld now=%ld)", lifetime, now.sec);
 250                 os_free(buf);
 251                 return 0;
 252         }
 253
 254         if (lifetime - now.sec < PAC_KEY_REFRESH_TIME)
 255                 data->send_new_pac = 1;
 256
 257         eap_fast_derive_master_secret(pac_key, server_random, client_random,
 258                                       master_secret);
 259
 260         os_free(buf);
 261
 262         return 1;
 263 }
 264
 265
 266 static void eap_fast_derive_key_auth(struct eap_sm *sm,
 267                                      struct eap_fast_data *data)
 268 {
 269         u8 *sks;
 270
 271         /* RFC 4851, Section 5.1:
 272          * Extra key material after TLS key_block: session_key_seed[40]
 273          */
 274
 275         sks = eap_fast_derive_key(sm->ssl_ctx, data->ssl.conn, "key expansion",
 276                                   EAP_FAST_SKS_LEN);
 277         if (sks == NULL) {
 278                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to derive "
 279                            "session_key_seed");
 280                 return;
 281         }
 282
 283         /*
 284          * RFC 4851, Section 5.2:
 285          * S-IMCK[0] = session_key_seed
 286          */
 287         wpa_hexdump_key(MSG_DEBUG,
 288                         "EAP-FAST: session_key_seed (SKS = S-IMCK[0])",
 289                         sks, EAP_FAST_SKS_LEN);
 290         data->simck_idx = 0;
 291         os_memcpy(data->simck, sks, EAP_FAST_SIMCK_LEN);
 292         os_free(sks);
 293 }
 294
 295
 296 static void eap_fast_derive_key_provisioning(struct eap_sm *sm,
 297                                              struct eap_fast_data *data)
 298 {
 299         os_free(data->key_block_p);
 300         data->key_block_p = (struct eap_fast_key_block_provisioning *)
 301                 eap_fast_derive_key(sm->ssl_ctx, data->ssl.conn,
 302                                     "key expansion",
 303                                     sizeof(*data->key_block_p));
 304         if (data->key_block_p == NULL) {
 305                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to derive key block");
 306                 return;
 307         }
 308         /*
 309          * RFC 4851, Section 5.2:
 310          * S-IMCK[0] = session_key_seed
 311          */
 312         wpa_hexdump_key(MSG_DEBUG,
 313                         "EAP-FAST: session_key_seed (SKS = S-IMCK[0])",
 314                         data->key_block_p->session_key_seed,
 315                         sizeof(data->key_block_p->session_key_seed));
 316         data->simck_idx = 0;
 317         os_memcpy(data->simck, data->key_block_p->session_key_seed,
 318                   EAP_FAST_SIMCK_LEN);
 319         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: server_challenge",
 320                         data->key_block_p->server_challenge,
 321                         sizeof(data->key_block_p->server_challenge));
 322         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: client_challenge",
 323                         data->key_block_p->client_challenge,
 324                         sizeof(data->key_block_p->client_challenge));
 325 }
 326
 327
 328 static int eap_fast_get_phase2_key(struct eap_sm *sm,
 329                                    struct eap_fast_data *data,
 330                                    u8 *isk, size_t isk_len)
 331 {
 332         u8 *key;
 333         size_t key_len;
 334
 335         os_memset(isk, 0, isk_len);
 336
 337         if (data->phase2_method == NULL || data->phase2_priv == NULL) {
 338                 wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 method not "
 339                            "available");
 340                 return -1;
 341         }
 342
 343         if (data->phase2_method->getKey == NULL)
 344                 return 0;
 345
 346         if ((key = data->phase2_method->getKey(sm, data->phase2_priv,
 347                                                &key_len)) == NULL) {
 348                 wpa_printf(MSG_DEBUG, "EAP-FAST: Could not get key material "
 349                            "from Phase 2");
 350                 return -1;
 351         }
 352
 353         if (key_len > isk_len)
 354                 key_len = isk_len;
 355         os_memcpy(isk, key, key_len);
 356         os_free(key);
 357
 358         return 0;
 359 }
 360
 361
 362 static int eap_fast_update_icmk(struct eap_sm *sm, struct eap_fast_data *data)
 363 {
 364         u8 isk[32], imck[60];
 365
 366         wpa_printf(MSG_DEBUG, "EAP-FAST: Deriving ICMK[%d] (S-IMCK and CMK)",
 367                    data->simck_idx + 1);
 368
 369         /*
 370          * RFC 4851, Section 5.2:
 371          * IMCK[j] = T-PRF(S-IMCK[j-1], "Inner Methods Compound Keys",
 372          *                 MSK[j], 60)
 373          * S-IMCK[j] = first 40 octets of IMCK[j]
 374          * CMK[j] = last 20 octets of IMCK[j]
 375          */
 376
 377         if (eap_fast_get_phase2_key(sm, data, isk, sizeof(isk)) < 0)
 378                 return -1;
 379         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: ISK[j]", isk, sizeof(isk));
 380         sha1_t_prf(data->simck, EAP_FAST_SIMCK_LEN,
 381                    "Inner Methods Compound Keys",
 382                    isk, sizeof(isk), imck, sizeof(imck));
 383         data->simck_idx++;
 384         os_memcpy(data->simck, imck, EAP_FAST_SIMCK_LEN);
 385         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: S-IMCK[j]",
 386                         data->simck, EAP_FAST_SIMCK_LEN);
 387         os_memcpy(data->cmk, imck + EAP_FAST_SIMCK_LEN, EAP_FAST_CMK_LEN);
 388         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: CMK[j]",
 389                         data->cmk, EAP_FAST_CMK_LEN);
 390
 391         return 0;
 392 }
 393
 394
 395 static void * eap_fast_init(struct eap_sm *sm)
 396 {
 397         struct eap_fast_data *data;
 398         u8 ciphers[5] = {
 399                 TLS_CIPHER_ANON_DH_AES128_SHA,
 400                 TLS_CIPHER_AES128_SHA,
 401                 TLS_CIPHER_RSA_DHE_AES128_SHA,
 402                 TLS_CIPHER_RC4_SHA,
 403                 TLS_CIPHER_NONE
 404         };
 405
 406         data = os_zalloc(sizeof(*data));
 407         if (data == NULL)
 408                 return NULL;
 409         data->fast_version = EAP_FAST_VERSION;
 410         data->force_version = -1;
 411         if (sm->user && sm->user->force_version >= 0) {
 412                 data->force_version = sm->user->force_version;
 413                 wpa_printf(MSG_DEBUG, "EAP-FAST: forcing version %d",
 414                            data->force_version);
 415                 data->fast_version = data->force_version;
 416         }
 417         data->state = START;
 418
 419         if (eap_server_tls_ssl_init(sm, &data->ssl, 0)) {
 420                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to initialize SSL.");
 421                 eap_fast_reset(sm, data);
 422                 return NULL;
 423         }
 424
 425         if (tls_connection_set_cipher_list(sm->ssl_ctx, data->ssl.conn,
 426                                            ciphers) < 0) {
 427                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to set TLS cipher "
 428                            "suites");
 429                 eap_fast_reset(sm, data);
 430                 return NULL;
 431         }
 432
 433         if (tls_connection_set_session_ticket_cb(sm->ssl_ctx, data->ssl.conn,
 434                                                  eap_fast_session_ticket_cb,
 435                                                  data) < 0) {
 436                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to set SessionTicket "
 437                            "callback");
 438                 eap_fast_reset(sm, data);
 439                 return NULL;
 440         }
 441
 442         if (sm->pac_opaque_encr_key == NULL) {
 443                 wpa_printf(MSG_INFO, "EAP-FAST: No PAC-Opaque encryption key "
 444                            "configured");
 445                 eap_fast_reset(sm, data);
 446                 return NULL;
 447         }
 448         os_memcpy(data->pac_opaque_encr, sm->pac_opaque_encr_key,
 449                   sizeof(data->pac_opaque_encr));
 450
 451         if (sm->eap_fast_a_id == NULL) {
 452                 wpa_printf(MSG_INFO, "EAP-FAST: No A-ID configured");
 453                 eap_fast_reset(sm, data);
 454                 return NULL;
 455         }
 456         data->srv_id = os_strdup(sm->eap_fast_a_id);
 457         if (data->srv_id == NULL) {
 458                 eap_fast_reset(sm, data);
 459                 return NULL;
 460         }
 461
 462         return data;
 463 }
 464
 465
 466 static void eap_fast_reset(struct eap_sm *sm, void *priv)
 467 {
 468         struct eap_fast_data *data = priv;
 469         if (data == NULL)
 470                 return;
 471         if (data->phase2_priv && data->phase2_method)
 472                 data->phase2_method->reset(sm, data->phase2_priv);
 473         eap_server_tls_ssl_deinit(sm, &data->ssl);
 474         os_free(data->srv_id);
 475         os_free(data->key_block_p);
 476         wpabuf_free(data->pending_phase2_resp);
 477         os_free(data->identity);
 478         os_free(data);
 479 }
 480
 481
 482 static struct wpabuf * eap_fast_build_start(struct eap_sm *sm,
 483                                             struct eap_fast_data *data, u8 id)
 484 {
 485         struct wpabuf *req;
 486         size_t srv_id_len = os_strlen(data->srv_id);
 487
 488         req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_FAST,
 489                             1 + sizeof(struct pac_tlv_hdr) + srv_id_len,
 490                             EAP_CODE_REQUEST, id);
 491         if (req == NULL) {
 492                 wpa_printf(MSG_ERROR, "EAP-FAST: Failed to allocate memory for"
 493                            " request");
 494                 eap_fast_state(data, FAILURE);
 495                 return NULL;
 496         }
 497
 498         wpabuf_put_u8(req, EAP_TLS_FLAGS_START | data->fast_version);
 499
 500         /* RFC 4851, 4.1.1. Authority ID Data */
 501         eap_fast_put_tlv(req, PAC_TYPE_A_ID, data->srv_id, srv_id_len);
 502
 503         eap_fast_state(data, PHASE1);
 504
 505         return req;
 506 }
 507
 508
 509 static int eap_fast_phase1_done(struct eap_sm *sm, struct eap_fast_data *data)
 510 {
 511         char cipher[64];
 512
 513         wpa_printf(MSG_DEBUG, "EAP-FAST: Phase1 done, starting Phase2");
 514
 515         if (tls_get_cipher(sm->ssl_ctx, data->ssl.conn, cipher, sizeof(cipher))
 516             < 0) {
 517                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to get cipher "
 518                            "information");
 519                 eap_fast_state(data, FAILURE);
 520                 return -1;
 521         }
 522         data->anon_provisioning = os_strstr(cipher, "ADH") != NULL;
 523
 524         if (data->anon_provisioning) {
 525                 wpa_printf(MSG_DEBUG, "EAP-FAST: Anonymous provisioning");
 526                 eap_fast_derive_key_provisioning(sm, data);
 527         } else
 528                 eap_fast_derive_key_auth(sm, data);
 529
 530         eap_fast_state(data, PHASE2_START);
 531
 532         return 0;
 533 }
 534
 535
 536 static struct wpabuf * eap_fast_build_phase2_req(struct eap_sm *sm,
 537                                                  struct eap_fast_data *data,
 538                                                  u8 id)
 539 {
 540         struct wpabuf *req;
 541
 542         if (data->phase2_priv == NULL) {
 543                 wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 method not "
 544                            "initialized");
 545                 return NULL;
 546         }
 547         req = data->phase2_method->buildReq(sm, data->phase2_priv, id);
 548         if (req == NULL)
 549                 return NULL;
 550
 551         wpa_hexdump_buf_key(MSG_MSGDUMP, "EAP-FAST: Phase 2 EAP-Request", req);
 552         return eap_fast_tlv_eap_payload(req);
 553 }
 554
 555
 556 static struct wpabuf * eap_fast_build_crypto_binding(
 557         struct eap_sm *sm, struct eap_fast_data *data)
 558 {
 559         struct wpabuf *buf;
 560         struct eap_tlv_result_tlv *result;
 561         struct eap_tlv_crypto_binding_tlv *binding;
 562
 563         buf = wpabuf_alloc(2 * sizeof(*result) + sizeof(*binding));
 564         if (buf == NULL)
 565                 return NULL;
 566
 567         if (data->send_new_pac || data->anon_provisioning ||
 568             data->phase2_method)
 569                 data->final_result = 0;
 570         else
 571                 data->final_result = 1;
 572
 573         if (!data->final_result || data->eap_seq > 1) {
 574                 /* Intermediate-Result */
 575                 wpa_printf(MSG_DEBUG, "EAP-FAST: Add Intermediate-Result TLV "
 576                            "(status=SUCCESS)");
 577                 result = wpabuf_put(buf, sizeof(*result));
 578                 result->tlv_type = host_to_be16(
 579                         EAP_TLV_TYPE_MANDATORY |
 580                         EAP_TLV_INTERMEDIATE_RESULT_TLV);
 581                 result->length = host_to_be16(2);
 582                 result->status = host_to_be16(EAP_TLV_RESULT_SUCCESS);
 583         }
 584
 585         if (data->final_result) {
 586                 /* Result TLV */
 587                 wpa_printf(MSG_DEBUG, "EAP-FAST: Add Result TLV "
 588                            "(status=SUCCESS)");
 589                 result = wpabuf_put(buf, sizeof(*result));
 590                 result->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
 591                                                 EAP_TLV_RESULT_TLV);
 592                 result->length = host_to_be16(2);
 593                 result->status = host_to_be16(EAP_TLV_RESULT_SUCCESS);
 594         }
 595
 596         /* Crypto-Binding TLV */
 597         binding = wpabuf_put(buf, sizeof(*binding));
 598         binding->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
 599                                          EAP_TLV_CRYPTO_BINDING_TLV);
 600         binding->length = host_to_be16(sizeof(*binding) -
 601                                        sizeof(struct eap_tlv_hdr));
 602         binding->version = EAP_FAST_VERSION;
 603         binding->received_version = data->peer_version;
 604         binding->subtype = EAP_TLV_CRYPTO_BINDING_SUBTYPE_REQUEST;
 605         if (os_get_random(binding->nonce, sizeof(binding->nonce)) < 0) {
 606                 wpabuf_free(buf);
 607                 return NULL;
 608         }
 609
 610         /*
 611          * RFC 4851, Section 4.2.8:
 612          * The nonce in a request MUST have its least significant bit set to 0.
 613          */
 614         binding->nonce[sizeof(binding->nonce) - 1] &= ~0x01;
 615
 616         os_memcpy(data->crypto_binding_nonce, binding->nonce,
 617                   sizeof(binding->nonce));
 618
 619         /*
 620          * RFC 4851, Section 5.3:
 621          * CMK = CMK[j]
 622          * Compound-MAC = HMAC-SHA1( CMK, Crypto-Binding TLV )
 623          */
 624
 625         hmac_sha1(data->cmk, EAP_FAST_CMK_LEN,
 626                   (u8 *) binding, sizeof(*binding),
 627                   binding->compound_mac);
 628
 629         wpa_printf(MSG_DEBUG, "EAP-FAST: Add Crypto-Binding TLV: Version %d "
 630                    "Received Version %d SubType %d",
 631                    binding->version, binding->received_version,
 632                    binding->subtype);
 633         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: NONCE",
 634                     binding->nonce, sizeof(binding->nonce));
 635         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Compound MAC",
 636                     binding->compound_mac, sizeof(binding->compound_mac));
 637
 638         return buf;
 639 }
 640
 641
 642 static struct wpabuf * eap_fast_build_pac(struct eap_sm *sm,
 643                                           struct eap_fast_data *data)
 644 {
 645         u8 pac_key[EAP_FAST_PAC_KEY_LEN];
 646         u8 *pac_buf, *pac_opaque;
 647         struct wpabuf *buf;
 648         u8 *pos;
 649         size_t buf_len, srv_id_len, pac_len;
 650         struct eap_tlv_hdr *pac_tlv;
 651         struct pac_tlv_hdr *pac_info;
 652         struct eap_tlv_result_tlv *result;
 653         struct os_time now;
 654
 655         if (os_get_random(pac_key, EAP_FAST_PAC_KEY_LEN) < 0 ||
 656             os_get_time(&now) < 0)
 657                 return NULL;
 658         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Generated PAC-Key",
 659                         pac_key, EAP_FAST_PAC_KEY_LEN);
 660
 661         pac_len = (2 + EAP_FAST_PAC_KEY_LEN) + (2 + 4) +
 662                 (2 + sm->identity_len) + 8;
 663         pac_buf = os_malloc(pac_len);
 664         if (pac_buf == NULL)
 665                 return NULL;
 666
 667         srv_id_len = os_strlen(data->srv_id);
 668
 669         pos = pac_buf;
 670         *pos++ = PAC_OPAQUE_TYPE_KEY;
 671         *pos++ = EAP_FAST_PAC_KEY_LEN;
 672         os_memcpy(pos, pac_key, EAP_FAST_PAC_KEY_LEN);
 673         pos += EAP_FAST_PAC_KEY_LEN;
 674
 675         *pos++ = PAC_OPAQUE_TYPE_LIFETIME;
 676         *pos++ = 4;
 677         WPA_PUT_BE32(pos, now.sec + PAC_KEY_LIFETIME);
 678         pos += 4;
 679
 680         if (sm->identity) {
 681                 *pos++ = PAC_OPAQUE_TYPE_IDENTITY;
 682                 *pos++ = sm->identity_len;
 683                 os_memcpy(pos, sm->identity, sm->identity_len);
 684                 pos += sm->identity_len;
 685         }
 686
 687         pac_len = pos - pac_buf;
 688         while (pac_len % 8) {
 689                 *pos++ = PAC_OPAQUE_TYPE_PAD;
 690                 pac_len++;
 691         }
 692
 693         pac_opaque = os_malloc(pac_len + 8);
 694         if (pac_opaque == NULL) {
 695                 os_free(pac_buf);
 696                 return NULL;
 697         }
 698         if (aes_wrap(data->pac_opaque_encr, pac_len / 8, pac_buf,
 699                      pac_opaque) < 0) {
 700                 os_free(pac_buf);
 701                 os_free(pac_opaque);
 702                 return NULL;
 703         }
 704         os_free(pac_buf);
 705
 706         pac_len += 8;
 707         wpa_hexdump(MSG_DEBUG, "EAP-FAST: PAC-Opaque",
 708                     pac_opaque, pac_len);
 709
 710         buf_len = sizeof(*pac_tlv) +
 711                 sizeof(struct pac_tlv_hdr) + EAP_FAST_PAC_KEY_LEN +
 712                 sizeof(struct pac_tlv_hdr) + pac_len +
 713                 2 * srv_id_len + 100 + sizeof(*result);
 714         buf = wpabuf_alloc(buf_len);
 715         if (buf == NULL) {
 716                 os_free(pac_opaque);
 717                 return NULL;
 718         }
 719
 720         /* Result TLV */
 721         wpa_printf(MSG_DEBUG, "EAP-FAST: Add Result TLV (status=SUCCESS)");
 722         result = wpabuf_put(buf, sizeof(*result));
 723         WPA_PUT_BE16((u8 *) &result->tlv_type,
 724                      EAP_TLV_TYPE_MANDATORY | EAP_TLV_RESULT_TLV);
 725         WPA_PUT_BE16((u8 *) &result->length, 2);
 726         WPA_PUT_BE16((u8 *) &result->status, EAP_TLV_RESULT_SUCCESS);
 727
 728         /* PAC TLV */
 729         wpa_printf(MSG_DEBUG, "EAP-FAST: Add PAC TLV");
 730         pac_tlv = wpabuf_put(buf, sizeof(*pac_tlv));
 731         pac_tlv->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
 732                                          EAP_TLV_PAC_TLV);
 733
 734         /* PAC-Key */
 735         eap_fast_put_tlv(buf, PAC_TYPE_PAC_KEY, pac_key, EAP_FAST_PAC_KEY_LEN);
 736
 737         /* PAC-Opaque */
 738         eap_fast_put_tlv(buf, PAC_TYPE_PAC_OPAQUE, pac_opaque, pac_len);
 739         os_free(pac_opaque);
 740
 741         /* PAC-Info */
 742         pac_info = wpabuf_put(buf, sizeof(*pac_info));
 743         pac_info->type = host_to_be16(PAC_TYPE_PAC_INFO);
 744
 745         /* PAC-Lifetime (inside PAC-Info) */
 746         eap_fast_put_tlv_hdr(buf, PAC_TYPE_CRED_LIFETIME, 4);
 747         wpabuf_put_be32(buf, now.sec + PAC_KEY_LIFETIME);
 748
 749         /* A-ID (inside PAC-Info) */
 750         eap_fast_put_tlv(buf, PAC_TYPE_A_ID, data->srv_id, srv_id_len);
 751
 752         /* Note: headers may be misaligned after A-ID */
 753
 754         /* A-ID-Info (inside PAC-Info) */
 755         eap_fast_put_tlv(buf, PAC_TYPE_A_ID_INFO, data->srv_id, srv_id_len);
 756
 757         /* PAC-Type (inside PAC-Info) */
 758         eap_fast_put_tlv_hdr(buf, PAC_TYPE_PAC_TYPE, 2);
 759         wpabuf_put_be16(buf, PAC_TYPE_TUNNEL_PAC);
 760
 761         /* Update PAC-Info and PAC TLV Length fields */
 762         pos = wpabuf_put(buf, 0);
 763         pac_info->len = host_to_be16(pos - (u8 *) (pac_info + 1));
 764         pac_tlv->length = host_to_be16(pos - (u8 *) (pac_tlv + 1));
 765
 766         return buf;
 767 }
 768
 769
 770 static struct wpabuf * eap_fast_buildReq(struct eap_sm *sm, void *priv, u8 id)
 771 {
 772         struct eap_fast_data *data = priv;
 773         struct wpabuf *req = NULL;
 774         struct wpabuf *encr;
 775
 776         if (data->ssl.state == FRAG_ACK) {
 777                 return eap_server_tls_build_ack(id, EAP_TYPE_FAST,
 778                                                 data->fast_version);
 779         }
 780
 781         if (data->ssl.state == WAIT_FRAG_ACK) {
 782                 return eap_server_tls_build_msg(&data->ssl, EAP_TYPE_FAST,
 783                                                 data->fast_version, id);
 784         }
 785
 786         switch (data->state) {
 787         case START:
 788                 return eap_fast_build_start(sm, data, id);
 789         case PHASE1:
 790                 if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) {
 791                         if (eap_fast_phase1_done(sm, data) < 0)
 792                                 return NULL;
 793                 }
 794                 break;
 795         case PHASE2_ID:
 796         case PHASE2_METHOD:
 797                 req = eap_fast_build_phase2_req(sm, data, id);
 798                 break;
 799         case CRYPTO_BINDING:
 800                 req = eap_fast_build_crypto_binding(sm, data);
 801                 if (data->phase2_method) {
 802                         /*
 803                          * Include the start of the next EAP method in the
 804                          * sequence in the same message with Crypto-Binding to
 805                          * save a round-trip.
 806                          */
 807                         struct wpabuf *eap;
 808                         eap = eap_fast_build_phase2_req(sm, data, id);
 809                         req = wpabuf_concat(req, eap);
 810                         eap_fast_state(data, PHASE2_METHOD);
 811                 }
 812                 break;
 813         case REQUEST_PAC:
 814                 req = eap_fast_build_pac(sm, data);
 815                 break;
 816         default:
 817                 wpa_printf(MSG_DEBUG, "EAP-FAST: %s - unexpected state %d",
 818                            __func__, data->state);
 819                 return NULL;
 820         }
 821
 822         if (req) {
 823                 wpa_hexdump_buf_key(MSG_DEBUG, "EAP-FAST: Encrypting Phase 2 "
 824                                     "TLVs", req);
 825                 encr = eap_server_tls_encrypt(sm, &data->ssl,
 826                                               wpabuf_mhead(req),
 827                                               wpabuf_len(req));
 828                 wpabuf_free(req);
 829
 830                 wpabuf_free(data->ssl.out_buf);
 831                 data->ssl.out_used = 0;
 832                 data->ssl.out_buf = encr;
 833         }
 834
 835         return eap_server_tls_build_msg(&data->ssl, EAP_TYPE_FAST,
 836                                         data->fast_version, id);
 837 }
 838
 839
 840 static Boolean eap_fast_check(struct eap_sm *sm, void *priv,
 841                               struct wpabuf *respData)
 842 {
 843         const u8 *pos;
 844         size_t len;
 845
 846         pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_FAST, respData, &len);
 847         if (pos == NULL || len < 1) {
 848                 wpa_printf(MSG_INFO, "EAP-FAST: Invalid frame");
 849                 return TRUE;
 850         }
 851
 852         return FALSE;
 853 }
 854
 855
 856 static int eap_fast_phase2_init(struct eap_sm *sm, struct eap_fast_data *data,
 857                                 EapType eap_type)
 858 {
 859         if (data->phase2_priv && data->phase2_method) {
 860                 data->phase2_method->reset(sm, data->phase2_priv);
 861                 data->phase2_method = NULL;
 862                 data->phase2_priv = NULL;
 863         }
 864         data->phase2_method = eap_server_get_eap_method(EAP_VENDOR_IETF,
 865                                                         eap_type);
 866         if (!data->phase2_method)
 867                 return -1;
 868
 869         if (data->key_block_p) {
 870                 sm->auth_challenge = data->key_block_p->server_challenge;
 871                 sm->peer_challenge = data->key_block_p->client_challenge;
 872         }
 873         sm->init_phase2 = 1;
 874         data->phase2_priv = data->phase2_method->init(sm);
 875         sm->init_phase2 = 0;
 876         sm->auth_challenge = NULL;
 877         sm->peer_challenge = NULL;
 878
 879         return data->phase2_priv == NULL ? -1 : 0;
 880 }
 881
 882
 883 static void eap_fast_process_phase2_response(struct eap_sm *sm,
 884                                              struct eap_fast_data *data,
 885                                              u8 *in_data, size_t in_len)
 886 {
 887         u8 next_type = EAP_TYPE_NONE;
 888         struct eap_hdr *hdr;
 889         u8 *pos;
 890         size_t left;
 891         struct wpabuf buf;
 892         const struct eap_method *m = data->phase2_method;
 893         void *priv = data->phase2_priv;
 894
 895         if (priv == NULL) {
 896                 wpa_printf(MSG_DEBUG, "EAP-FAST: %s - Phase2 not "
 897                            "initialized?!", __func__);
 898                 return;
 899         }
 900
 901         hdr = (struct eap_hdr *) in_data;
 902         pos = (u8 *) (hdr + 1);
 903
 904         if (in_len > sizeof(*hdr) && *pos == EAP_TYPE_NAK) {
 905                 left = in_len - sizeof(*hdr);
 906                 wpa_hexdump(MSG_DEBUG, "EAP-FAST: Phase2 type Nak'ed; "
 907                             "allowed types", pos + 1, left - 1);
 908 #ifdef EAP_TNC
 909                 if (m && m->vendor == EAP_VENDOR_IETF &&
 910                     m->method == EAP_TYPE_TNC) {
 911                         wpa_printf(MSG_DEBUG, "EAP-FAST: Peer Nak'ed required "
 912                                    "TNC negotiation");
 913                         next_type = eap_fast_req_failure(sm, data);
 914                         eap_fast_phase2_init(sm, data, next_type);
 915                         return;
 916                 }
 917 #endif /* EAP_TNC */
 918                 eap_sm_process_nak(sm, pos + 1, left - 1);
 919                 if (sm->user && sm->user_eap_method_index < EAP_MAX_METHODS &&
 920                     sm->user->methods[sm->user_eap_method_index].method !=
 921                     EAP_TYPE_NONE) {
 922                         next_type = sm->user->methods[
 923                                 sm->user_eap_method_index++].method;
 924                         wpa_printf(MSG_DEBUG, "EAP-FAST: try EAP type %d",
 925                                    next_type);
 926                 } else {
 927                         next_type = eap_fast_req_failure(sm, data);
 928                 }
 929                 eap_fast_phase2_init(sm, data, next_type);
 930                 return;
 931         }
 932
 933         wpabuf_set(&buf, in_data, in_len);
 934
 935         if (m->check(sm, priv, &buf)) {
 936                 wpa_printf(MSG_DEBUG, "EAP-FAST: Phase2 check() asked to "
 937                            "ignore the packet");
 938                 next_type = eap_fast_req_failure(sm, data);
 939                 return;
 940         }
 941
 942         m->process(sm, priv, &buf);
 943
 944         if (!m->isDone(sm, priv))
 945                 return;
 946
 947         if (!m->isSuccess(sm, priv)) {
 948                 wpa_printf(MSG_DEBUG, "EAP-FAST: Phase2 method failed");
 949                 next_type = eap_fast_req_failure(sm, data);
 950                 eap_fast_phase2_init(sm, data, next_type);
 951                 return;
 952         }
 953
 954         switch (data->state) {
 955         case PHASE2_ID:
 956                 if (eap_user_get(sm, sm->identity, sm->identity_len, 1) != 0) {
 957                         wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: Phase2 "
 958                                           "Identity not found in the user "
 959                                           "database",
 960                                           sm->identity, sm->identity_len);
 961                         next_type = eap_fast_req_failure(sm, data);
 962                         break;
 963                 }
 964
 965                 eap_fast_state(data, PHASE2_METHOD);
 966                 if (data->anon_provisioning) {
 967                         /*
 968                          * Only EAP-MSCHAPv2 is allowed for anonymous
 969                          * provisioning.
 970                          */
 971                         next_type = EAP_TYPE_MSCHAPV2;
 972                         sm->user_eap_method_index = 0;
 973                 } else {
 974                         next_type = sm->user->methods[0].method;
 975                         sm->user_eap_method_index = 1;
 976                 }
 977                 wpa_printf(MSG_DEBUG, "EAP-FAST: try EAP type %d", next_type);
 978                 break;
 979         case PHASE2_METHOD:
 980         case CRYPTO_BINDING:
 981                 eap_fast_update_icmk(sm, data);
 982                 eap_fast_state(data, CRYPTO_BINDING);
 983                 data->eap_seq++;
 984                 next_type = EAP_TYPE_NONE;
 985 #ifdef EAP_TNC
 986                 if (sm->tnc && !data->tnc_started) {
 987                         wpa_printf(MSG_DEBUG, "EAP-FAST: Initialize TNC");
 988                         next_type = EAP_TYPE_TNC;
 989                         data->tnc_started = 1;
 990                 }
 991 #endif /* EAP_TNC */
 992                 break;
 993         case FAILURE:
 994                 break;
 995         default:
 996                 wpa_printf(MSG_DEBUG, "EAP-FAST: %s - unexpected state %d",
 997                            __func__, data->state);
 998                 break;
 999         }
1000
1001         eap_fast_phase2_init(sm, data, next_type);
1002 }
1003
1004
1005 static void eap_fast_process_phase2_eap(struct eap_sm *sm,
1006                                         struct eap_fast_data *data,
1007                                         u8 *in_data, size_t in_len)
1008 {
1009         struct eap_hdr *hdr;
1010         size_t len;
1011
1012         hdr = (struct eap_hdr *) in_data;
1013         if (in_len < (int) sizeof(*hdr)) {
1014                 wpa_printf(MSG_INFO, "EAP-FAST: Too short Phase 2 "
1015                            "EAP frame (len=%d)", in_len);
1016                 eap_fast_req_failure(sm, data);
1017                 return;
1018         }
1019         len = be_to_host16(hdr->length);
1020         if (len > in_len) {
1021                 wpa_printf(MSG_INFO, "EAP-FAST: Length mismatch in "
1022                            "Phase 2 EAP frame (len=%d hdr->length=%d)",
1023                            in_len, len);
1024                 eap_fast_req_failure(sm, data);
1025                 return;
1026         }
1027         wpa_printf(MSG_DEBUG, "EAP-FAST: Received Phase 2: code=%d "
1028                    "identifier=%d length=%d", hdr->code, hdr->identifier, len);
1029         switch (hdr->code) {
1030         case EAP_CODE_RESPONSE:
1031                 eap_fast_process_phase2_response(sm, data, (u8 *) hdr, len);
1032                 break;
1033         default:
1034                 wpa_printf(MSG_INFO, "EAP-FAST: Unexpected code=%d in "
1035                            "Phase 2 EAP header", hdr->code);
1036                 break;
1037         }
1038 }
1039
1040
1041 static int eap_fast_parse_tlvs(u8 *data, size_t data_len,
1042                                struct eap_fast_tlv_parse *tlv)
1043 {
1044         int mandatory, tlv_type, len, res;
1045         u8 *pos, *end;
1046
1047         os_memset(tlv, 0, sizeof(*tlv));
1048
1049         pos = data;
1050         end = data + data_len;
1051         while (pos + 4 < end) {
1052                 mandatory = pos[0] & 0x80;
1053                 tlv_type = WPA_GET_BE16(pos) & 0x3fff;
1054                 pos += 2;
1055                 len = WPA_GET_BE16(pos);
1056                 pos += 2;
1057                 if (pos + len > end) {
1058                         wpa_printf(MSG_INFO, "EAP-FAST: TLV overflow");
1059                         return -1;
1060                 }
1061                 wpa_printf(MSG_DEBUG, "EAP-FAST: Received Phase 2: "
1062                            "TLV type %d length %d%s",
1063                            tlv_type, len, mandatory ? " (mandatory)" : "");
1064
1065                 res = eap_fast_parse_tlv(tlv, tlv_type, pos, len);
1066                 if (res == -2)
1067                         break;
1068                 if (res < 0) {
1069                         if (mandatory) {
1070                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Nak unknown "
1071                                            "mandatory TLV type %d", tlv_type);
1072                                 /* TODO: generate Nak TLV */
1073                                 break;
1074                         } else {
1075                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Ignored "
1076                                            "unknown optional TLV type %d",
1077                                            tlv_type);
1078                         }
1079                 }
1080
1081                 pos += len;
1082         }
1083
1084         return 0;
1085 }
1086
1087
1088 static int eap_fast_validate_crypto_binding(
1089         struct eap_fast_data *data, struct eap_tlv_crypto_binding_tlv *b,
1090         size_t bind_len)
1091 {
1092         u8 cmac[SHA1_MAC_LEN];
1093
1094         wpa_printf(MSG_DEBUG, "EAP-FAST: Reply Crypto-Binding TLV: "
1095                    "Version %d Received Version %d SubType %d",
1096                    b->version, b->received_version, b->subtype);
1097         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: NONCE",
1098                     b->nonce, sizeof(b->nonce));
1099         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Compound MAC",
1100                     b->compound_mac, sizeof(b->compound_mac));
1101
1102         if (b->version != EAP_FAST_VERSION ||
1103             b->received_version != EAP_FAST_VERSION) {
1104                 wpa_printf(MSG_DEBUG, "EAP-FAST: Unexpected version "
1105                            "in Crypto-Binding: version %d "
1106                            "received_version %d", b->version,
1107                            b->received_version);
1108                 return -1;
1109         }
1110
1111         if (b->subtype != EAP_TLV_CRYPTO_BINDING_SUBTYPE_RESPONSE) {
1112                 wpa_printf(MSG_DEBUG, "EAP-FAST: Unexpected subtype in "
1113                            "Crypto-Binding: %d", b->subtype);
1114                 return -1;
1115         }
1116
1117         if (os_memcmp(data->crypto_binding_nonce, b->nonce, 31) != 0 ||
1118             (data->crypto_binding_nonce[31] | 1) != b->nonce[31]) {
1119                 wpa_printf(MSG_DEBUG, "EAP-FAST: Invalid nonce in "
1120                            "Crypto-Binding");
1121                 return -1;
1122         }
1123
1124         os_memcpy(cmac, b->compound_mac, sizeof(cmac));
1125         os_memset(b->compound_mac, 0, sizeof(cmac));
1126         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Crypto-Binding TLV for "
1127                     "Compound MAC calculation",
1128                     (u8 *) b, bind_len);
1129         hmac_sha1(data->cmk, EAP_FAST_CMK_LEN, (u8 *) b, bind_len,
1130                   b->compound_mac);
1131         if (os_memcmp(cmac, b->compound_mac, sizeof(cmac)) != 0) {
1132                 wpa_hexdump(MSG_MSGDUMP,
1133                             "EAP-FAST: Calculated Compound MAC",
1134                             b->compound_mac, sizeof(cmac));
1135                 wpa_printf(MSG_INFO, "EAP-FAST: Compound MAC did not "
1136                            "match");
1137                 return -1;
1138         }
1139
1140         return 0;
1141 }
1142
1143
1144 static int eap_fast_pac_type(u8 *pac, size_t len, u16 type)
1145 {
1146         struct eap_tlv_pac_type_tlv *tlv;
1147
1148         if (pac == NULL || len != sizeof(*tlv))
1149                 return 0;
1150
1151         tlv = (struct eap_tlv_pac_type_tlv *) pac;
1152
1153         return be_to_host16(tlv->tlv_type) == PAC_TYPE_PAC_TYPE &&
1154                 be_to_host16(tlv->length) == 2 &&
1155                 be_to_host16(tlv->pac_type) == type;
1156 }
1157
1158
1159 static void eap_fast_process_phase2_tlvs(struct eap_sm *sm,
1160                                          struct eap_fast_data *data,
1161                                          u8 *in_data, size_t in_len)
1162 {
1163         struct eap_fast_tlv_parse tlv;
1164         int check_crypto_binding = data->state == CRYPTO_BINDING;
1165
1166         if (eap_fast_parse_tlvs(in_data, in_len, &tlv) < 0) {
1167                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to parse received "
1168                            "Phase 2 TLVs");
1169                 return;
1170         }
1171
1172         if (tlv.result == EAP_TLV_RESULT_FAILURE) {
1173                 wpa_printf(MSG_DEBUG, "EAP-FAST: Result TLV indicated "
1174                            "failure");
1175                 eap_fast_state(data, FAILURE);
1176                 return;
1177         }
1178
1179         if (data->state == REQUEST_PAC) {
1180                 u16 type, len, res;
1181                 if (tlv.pac == NULL || tlv.pac_len < 6) {
1182                         wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC "
1183                                    "Acknowledgement received");
1184                         eap_fast_state(data, FAILURE);
1185                         return;
1186                 }
1187
1188                 type = WPA_GET_BE16(tlv.pac);
1189                 len = WPA_GET_BE16(tlv.pac + 2);
1190                 res = WPA_GET_BE16(tlv.pac + 4);
1191
1192                 if (type != PAC_TYPE_PAC_ACKNOWLEDGEMENT || len != 2 ||
1193                     res != EAP_TLV_RESULT_SUCCESS) {
1194                         wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV did not "
1195                                    "contain acknowledgement");
1196                         eap_fast_state(data, FAILURE);
1197                         return;
1198                 }
1199
1200                 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Acknowledgement received "
1201                            "- PAC provisioning succeeded");
1202                 eap_fast_state(data, data->anon_provisioning ?
1203                                FAILURE : SUCCESS);
1204                 return;
1205         }
1206
1207         if (check_crypto_binding) {
1208                 if (tlv.crypto_binding == NULL) {
1209                         wpa_printf(MSG_DEBUG, "EAP-FAST: No Crypto-Binding "
1210                                    "TLV received");
1211                         eap_fast_state(data, FAILURE);
1212                         return;
1213                 }
1214
1215                 if (data->final_result &&
1216                     tlv.result != EAP_TLV_RESULT_SUCCESS) {
1217                         wpa_printf(MSG_DEBUG, "EAP-FAST: Crypto-Binding TLV "
1218                                    "without Success Result");
1219                         eap_fast_state(data, FAILURE);
1220                         return;
1221                 }
1222
1223                 if (!data->final_result &&
1224                     tlv.iresult != EAP_TLV_RESULT_SUCCESS) {
1225                         wpa_printf(MSG_DEBUG, "EAP-FAST: Crypto-Binding TLV "
1226                                    "without intermediate Success Result");
1227                         eap_fast_state(data, FAILURE);
1228                         return;
1229                 }
1230
1231                 if (eap_fast_validate_crypto_binding(data, tlv.crypto_binding,
1232                                                      tlv.crypto_binding_len)) {
1233                         eap_fast_state(data, FAILURE);
1234                         return;
1235                 }
1236
1237                 wpa_printf(MSG_DEBUG, "EAP-FAST: Valid Crypto-Binding TLV "
1238                            "received");
1239                 if (data->final_result) {
1240                         wpa_printf(MSG_DEBUG, "EAP-FAST: Authentication "
1241                                    "completed successfully");
1242                 }
1243
1244                 if (data->anon_provisioning ||
1245                     (tlv.request_action == EAP_TLV_ACTION_PROCESS_TLV &&
1246                      eap_fast_pac_type(tlv.pac, tlv.pac_len,
1247                                        PAC_TYPE_TUNNEL_PAC))) {
1248                         wpa_printf(MSG_DEBUG, "EAP-FAST: Requested a new "
1249                                    "Tunnel PAC");
1250                         eap_fast_state(data, REQUEST_PAC);
1251                 } else if (data->send_new_pac) {
1252                         wpa_printf(MSG_DEBUG, "EAP-FAST: Server triggered "
1253                                    "re-keying of Tunnel PAC");
1254                         eap_fast_state(data, REQUEST_PAC);
1255                 } else if (data->final_result)
1256                         eap_fast_state(data, SUCCESS);
1257         }
1258
1259         if (tlv.eap_payload_tlv) {
1260                 eap_fast_process_phase2_eap(sm, data, tlv.eap_payload_tlv,
1261                                             tlv.eap_payload_tlv_len);
1262         }
1263 }
1264
1265
1266 static void eap_fast_process_phase2(struct eap_sm *sm,
1267                                     struct eap_fast_data *data,
1268                                     struct wpabuf *in_buf)
1269 {
1270         u8 *in_decrypted;
1271         int len_decrypted;
1272         size_t buf_len;
1273         u8 *in_data;
1274         size_t in_len;
1275
1276         in_data = wpabuf_mhead(in_buf);
1277         in_len = wpabuf_len(in_buf);
1278
1279         wpa_printf(MSG_DEBUG, "EAP-FAST: Received %lu bytes encrypted data for"
1280                    " Phase 2", (unsigned long) in_len);
1281
1282         if (data->pending_phase2_resp) {
1283                 wpa_printf(MSG_DEBUG, "EAP-PEAP: Pending Phase 2 response - "
1284                            "skip decryption and use old data");
1285                 eap_fast_process_phase2_tlvs(
1286                         sm, data, wpabuf_mhead(data->pending_phase2_resp),
1287                         wpabuf_len(data->pending_phase2_resp));
1288                 wpabuf_free(data->pending_phase2_resp);
1289                 data->pending_phase2_resp = NULL;
1290                 return;
1291         }
1292
1293         buf_len = in_len;
1294         /*
1295          * Even though we try to disable TLS compression, it is possible that
1296          * this cannot be done with all TLS libraries. Add extra buffer space
1297          * to handle the possibility of the decrypted data being longer than
1298          * input data.
1299          */
1300         buf_len += 500;
1301         buf_len *= 3;
1302         in_decrypted = os_malloc(buf_len);
1303         if (in_decrypted == NULL) {
1304                 wpa_printf(MSG_WARNING, "EAP-FAST: Failed to allocate memory "
1305                            "for decryption");
1306                 return;
1307         }
1308
1309         len_decrypted = tls_connection_decrypt(sm->ssl_ctx, data->ssl.conn,
1310                                                in_data, in_len,
1311                                                in_decrypted, buf_len);
1312         if (len_decrypted < 0) {
1313                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to decrypt Phase 2 "
1314                            "data");
1315                 os_free(in_decrypted);
1316                 eap_fast_state(data, FAILURE);
1317                 return;
1318         }
1319
1320         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Decrypted Phase 2 TLVs",
1321                         in_decrypted, len_decrypted);
1322
1323         eap_fast_process_phase2_tlvs(sm, data, in_decrypted, len_decrypted);
1324
1325         if (sm->method_pending == METHOD_PENDING_WAIT) {
1326                 wpa_printf(MSG_DEBUG, "EAP-FAST: Phase2 method is in "
1327                            "pending wait state - save decrypted response");
1328                 wpabuf_free(data->pending_phase2_resp);
1329                 data->pending_phase2_resp = wpabuf_alloc_copy(in_decrypted,
1330                                                               len_decrypted);
1331         }
1332
1333         os_free(in_decrypted);
1334 }
1335
1336
1337 static int eap_fast_process_version(struct eap_sm *sm, void *priv,
1338                                     int peer_version)
1339 {
1340         struct eap_fast_data *data = priv;
1341
1342         data->peer_version = peer_version;
1343
1344         if (data->force_version >= 0 && peer_version != data->force_version) {
1345                 wpa_printf(MSG_INFO, "EAP-FAST: peer did not select the forced"
1346                            " version (forced=%d peer=%d) - reject",
1347                            data->force_version, peer_version);
1348                 return -1;
1349         }
1350
1351         if (peer_version < data->fast_version) {
1352                 wpa_printf(MSG_DEBUG, "EAP-FAST: peer ver=%d, own ver=%d; "
1353                            "use version %d",
1354                            peer_version, data->fast_version, peer_version);
1355                 data->fast_version = peer_version;
1356         }
1357
1358         return 0;
1359 }
1360
1361
1362 static int eap_fast_process_phase1(struct eap_sm *sm,
1363                                    struct eap_fast_data *data)
1364 {
1365         if (eap_server_tls_phase1(sm, &data->ssl) < 0) {
1366                 wpa_printf(MSG_INFO, "EAP-FAST: TLS processing failed");
1367                 eap_fast_state(data, FAILURE);
1368                 return -1;
1369         }
1370
1371         if (!tls_connection_established(sm->ssl_ctx, data->ssl.conn) ||
1372             wpabuf_len(data->ssl.out_buf) > 0)
1373                 return 1;
1374
1375         /*
1376          * Phase 1 was completed with the received message (e.g., when using
1377          * abbreviated handshake), so Phase 2 can be started immediately
1378          * without having to send through an empty message to the peer.
1379          */
1380
1381         return eap_fast_phase1_done(sm, data);
1382 }
1383
1384
1385 static void eap_fast_process_phase2_start(struct eap_sm *sm,
1386                                           struct eap_fast_data *data)
1387 {
1388         u8 next_type;
1389
1390         if (data->identity) {
1391                 os_free(sm->identity);
1392                 sm->identity = data->identity;
1393                 data->identity = NULL;
1394                 sm->identity_len = data->identity_len;
1395                 data->identity_len = 0;
1396                 sm->require_identity_match = 1;
1397                 if (eap_user_get(sm, sm->identity, sm->identity_len, 1) != 0) {
1398                         wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: "
1399                                           "Phase2 Identity not found "
1400                                           "in the user database",
1401                                           sm->identity, sm->identity_len);
1402                         next_type = eap_fast_req_failure(sm, data);
1403                 } else {
1404                         wpa_printf(MSG_DEBUG, "EAP-FAST: Identity already "
1405                                    "known - skip Phase 2 Identity Request");
1406                         next_type = sm->user->methods[0].method;
1407                         sm->user_eap_method_index = 1;
1408                 }
1409
1410                 eap_fast_state(data, PHASE2_METHOD);
1411         } else {
1412                 eap_fast_state(data, PHASE2_ID);
1413                 next_type = EAP_TYPE_IDENTITY;
1414         }
1415
1416         eap_fast_phase2_init(sm, data, next_type);
1417 }
1418
1419
1420 static void eap_fast_process_msg(struct eap_sm *sm, void *priv,
1421                                  const struct wpabuf *respData)
1422 {
1423         struct eap_fast_data *data = priv;
1424
1425         switch (data->state) {
1426         case PHASE1:
1427                 if (eap_fast_process_phase1(sm, data))
1428                         break;
1429
1430                 /* fall through to PHASE2_START */
1431         case PHASE2_START:
1432                 eap_fast_process_phase2_start(sm, data);
1433                 break;
1434         case PHASE2_ID:
1435         case PHASE2_METHOD:
1436         case CRYPTO_BINDING:
1437         case REQUEST_PAC:
1438                 eap_fast_process_phase2(sm, data, data->ssl.in_buf);
1439                 break;
1440         default:
1441                 wpa_printf(MSG_DEBUG, "EAP-FAST: Unexpected state %d in %s",
1442                            data->state, __func__);
1443                 break;
1444         }
1445 }
1446
1447
1448 static void eap_fast_process(struct eap_sm *sm, void *priv,
1449                              struct wpabuf *respData)
1450 {
1451         struct eap_fast_data *data = priv;
1452         if (eap_server_tls_process(sm, &data->ssl, respData, data,
1453                                    EAP_TYPE_FAST, eap_fast_process_version,
1454                                    eap_fast_process_msg) < 0)
1455                 eap_fast_state(data, FAILURE);
1456 }
1457
1458
1459 static Boolean eap_fast_isDone(struct eap_sm *sm, void *priv)
1460 {
1461         struct eap_fast_data *data = priv;
1462         return data->state == SUCCESS || data->state == FAILURE;
1463 }
1464
1465
1466 static u8 * eap_fast_getKey(struct eap_sm *sm, void *priv, size_t *len)
1467 {
1468         struct eap_fast_data *data = priv;
1469         u8 *eapKeyData;
1470
1471         if (data->state != SUCCESS)
1472                 return NULL;
1473
1474         eapKeyData = os_malloc(EAP_FAST_KEY_LEN);
1475         if (eapKeyData == NULL)
1476                 return NULL;
1477
1478         eap_fast_derive_eap_msk(data->simck, eapKeyData);
1479         *len = EAP_FAST_KEY_LEN;
1480
1481         return eapKeyData;
1482 }
1483
1484
1485 static u8 * eap_fast_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
1486 {
1487         struct eap_fast_data *data = priv;
1488         u8 *eapKeyData;
1489
1490         if (data->state != SUCCESS)
1491                 return NULL;
1492
1493         eapKeyData = os_malloc(EAP_EMSK_LEN);
1494         if (eapKeyData == NULL)
1495                 return NULL;
1496
1497         eap_fast_derive_eap_emsk(data->simck, eapKeyData);
1498         *len = EAP_EMSK_LEN;
1499
1500         return eapKeyData;
1501 }
1502
1503
1504 static Boolean eap_fast_isSuccess(struct eap_sm *sm, void *priv)
1505 {
1506         struct eap_fast_data *data = priv;
1507         return data->state == SUCCESS;
1508 }
1509
1510
1511 int eap_server_fast_register(void)
1512 {
1513         struct eap_method *eap;
1514         int ret;
1515
1516         eap = eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION,
1517                                       EAP_VENDOR_IETF, EAP_TYPE_FAST, "FAST");
1518         if (eap == NULL)
1519                 return -1;
1520
1521         eap->init = eap_fast_init;
1522         eap->reset = eap_fast_reset;
1523         eap->buildReq = eap_fast_buildReq;
1524         eap->check = eap_fast_check;
1525         eap->process = eap_fast_process;
1526         eap->isDone = eap_fast_isDone;
1527         eap->getKey = eap_fast_getKey;
1528         eap->get_emsk = eap_fast_get_emsk;
1529         eap->isSuccess = eap_fast_isSuccess;
1530
1531         ret = eap_server_method_register(eap);
1532         if (ret)
1533                 eap_server_method_free(eap);
1534         return ret;
1535 }