src/eap_server/eap_fast.c

   1 /*
   2  * EAP-FAST server (RFC 4851)
   3  * Copyright (c) 2004-2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "aes_wrap.h"
  19 #include "sha1.h"
  20 #include "eap_i.h"
  21 #include "eap_tls_common.h"
  22 #include "tls.h"
  23 #include "eap_common/eap_tlv_common.h"
  24 #include "eap_common/eap_fast_common.h"
  25
  26
  27 static void eap_fast_reset(struct eap_sm *sm, void *priv);
  28
  29
  30 /* Private PAC-Opaque TLV types */
  31 #define PAC_OPAQUE_TYPE_PAD 0
  32 #define PAC_OPAQUE_TYPE_KEY 1
  33 #define PAC_OPAQUE_TYPE_LIFETIME 2
  34 #define PAC_OPAQUE_TYPE_IDENTITY 3
  35
  36 struct eap_fast_data {
  37         struct eap_ssl_data ssl;
  38         enum {
  39                 START, PHASE1, PHASE2_START, PHASE2_ID, PHASE2_METHOD,
  40                 CRYPTO_BINDING, REQUEST_PAC, SUCCESS, FAILURE
  41         } state;
  42
  43         int fast_version;
  44         const struct eap_method *phase2_method;
  45         void *phase2_priv;
  46         int force_version;
  47         int peer_version;
  48
  49         u8 crypto_binding_nonce[32];
  50         int final_result;
  51
  52         struct eap_fast_key_block_provisioning *key_block_p;
  53
  54         u8 simck[EAP_FAST_SIMCK_LEN];
  55         u8 cmk[EAP_FAST_CMK_LEN];
  56         int simck_idx;
  57
  58         u8 pac_opaque_encr[16];
  59         u8 *srv_id;
  60         size_t srv_id_len;
  61         char *srv_id_info;
  62
  63         int anon_provisioning;
  64         int send_new_pac; /* server triggered re-keying of Tunnel PAC */
  65         struct wpabuf *pending_phase2_resp;
  66         u8 *identity; /* from PAC-Opaque */
  67         size_t identity_len;
  68         int eap_seq;
  69         int tnc_started;
  70
  71         int pac_key_lifetime;
  72         int pac_key_refresh_time;
  73 };
  74
  75
  76 static const char * eap_fast_state_txt(int state)
  77 {
  78         switch (state) {
  79         case START:
  80                 return "START";
  81         case PHASE1:
  82                 return "PHASE1";
  83         case PHASE2_START:
  84                 return "PHASE2_START";
  85         case PHASE2_ID:
  86                 return "PHASE2_ID";
  87         case PHASE2_METHOD:
  88                 return "PHASE2_METHOD";
  89         case CRYPTO_BINDING:
  90                 return "CRYPTO_BINDING";
  91         case REQUEST_PAC:
  92                 return "REQUEST_PAC";
  93         case SUCCESS:
  94                 return "SUCCESS";
  95         case FAILURE:
  96                 return "FAILURE";
  97         default:
  98                 return "Unknown?!";
  99         }
 100 }
 101
 102
 103 static void eap_fast_state(struct eap_fast_data *data, int state)
 104 {
 105         wpa_printf(MSG_DEBUG, "EAP-FAST: %s -> %s",
 106                    eap_fast_state_txt(data->state),
 107                    eap_fast_state_txt(state));
 108         data->state = state;
 109 }
 110
 111
 112 static EapType eap_fast_req_failure(struct eap_sm *sm,
 113                                     struct eap_fast_data *data)
 114 {
 115         /* TODO: send Result TLV(FAILURE) */
 116         eap_fast_state(data, FAILURE);
 117         return EAP_TYPE_NONE;
 118 }
 119
 120
 121 static int eap_fast_session_ticket_cb(void *ctx, const u8 *ticket, size_t len,
 122                                       const u8 *client_random,
 123                                       const u8 *server_random,
 124                                       u8 *master_secret)
 125 {
 126         struct eap_fast_data *data = ctx;
 127         const u8 *pac_opaque;
 128         size_t pac_opaque_len;
 129         u8 *buf, *pos, *end, *pac_key = NULL;
 130         os_time_t lifetime = 0;
 131         struct os_time now;
 132         u8 *identity = NULL;
 133         size_t identity_len = 0;
 134
 135         wpa_printf(MSG_DEBUG, "EAP-FAST: SessionTicket callback");
 136         wpa_hexdump(MSG_DEBUG, "EAP-FAST: SessionTicket (PAC-Opaque)",
 137                     ticket, len);
 138
 139         if (len < 4 || WPA_GET_BE16(ticket) != PAC_TYPE_PAC_OPAQUE) {
 140                 wpa_printf(MSG_DEBUG, "EAP-FAST: Ignore invalid "
 141                            "SessionTicket");
 142                 return 0;
 143         }
 144
 145         pac_opaque_len = WPA_GET_BE16(ticket + 2);
 146         pac_opaque = ticket + 4;
 147         if (pac_opaque_len < 8 || pac_opaque_len % 8 ||
 148             pac_opaque_len > len - 4) {
 149                 wpa_printf(MSG_DEBUG, "EAP-FAST: Ignore invalid PAC-Opaque "
 150                            "(len=%lu left=%lu)",
 151                            (unsigned long) pac_opaque_len,
 152                            (unsigned long) len);
 153                 return 0;
 154         }
 155         wpa_hexdump(MSG_DEBUG, "EAP-FAST: Received PAC-Opaque",
 156                     pac_opaque, pac_opaque_len);
 157
 158         buf = os_malloc(pac_opaque_len - 8);
 159         if (buf == NULL) {
 160                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to allocate memory "
 161                            "for decrypting PAC-Opaque");
 162                 return 0;
 163         }
 164
 165         if (aes_unwrap(data->pac_opaque_encr, (pac_opaque_len - 8) / 8,
 166                        pac_opaque, buf) < 0) {
 167                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to decrypt "
 168                            "PAC-Opaque");
 169                 os_free(buf);
 170                 /*
 171                  * This may have been caused by server changing the PAC-Opaque
 172                  * encryption key, so just ignore this PAC-Opaque instead of
 173                  * failing the authentication completely. Provisioning can now
 174                  * be used to provision a new PAC.
 175                  */
 176                 return 0;
 177         }
 178
 179         end = buf + pac_opaque_len - 8;
 180         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Decrypted PAC-Opaque",
 181                         buf, end - buf);
 182
 183         pos = buf;
 184         while (pos + 1 < end) {
 185                 if (pos + 2 + pos[1] > end)
 186                         break;
 187
 188                 switch (*pos) {
 189                 case PAC_OPAQUE_TYPE_PAD:
 190                         pos = end;
 191                         break;
 192                 case PAC_OPAQUE_TYPE_KEY:
 193                         if (pos[1] != EAP_FAST_PAC_KEY_LEN) {
 194                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Invalid "
 195                                            "PAC-Key length %d", pos[1]);
 196                                 os_free(buf);
 197                                 return -1;
 198                         }
 199                         pac_key = pos + 2;
 200                         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: PAC-Key from "
 201                                         "decrypted PAC-Opaque",
 202                                         pac_key, EAP_FAST_PAC_KEY_LEN);
 203                         break;
 204                 case PAC_OPAQUE_TYPE_LIFETIME:
 205                         if (pos[1] != 4) {
 206                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Invalid "
 207                                            "PAC-Key lifetime length %d",
 208                                            pos[1]);
 209                                 os_free(buf);
 210                                 return -1;
 211                         }
 212                         lifetime = WPA_GET_BE32(pos + 2);
 213                         break;
 214                 case PAC_OPAQUE_TYPE_IDENTITY:
 215                         identity = pos + 2;
 216                         identity_len = pos[1];
 217                         break;
 218                 }
 219
 220                 pos += 2 + pos[1];
 221         }
 222
 223         if (pac_key == NULL) {
 224                 wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC-Key included in "
 225                            "PAC-Opaque");
 226                 os_free(buf);
 227                 return -1;
 228         }
 229
 230         if (identity) {
 231                 wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: Identity from "
 232                                   "PAC-Opaque", identity, identity_len);
 233                 os_free(data->identity);
 234                 data->identity = os_malloc(identity_len);
 235                 if (data->identity) {
 236                         os_memcpy(data->identity, identity, identity_len);
 237                         data->identity_len = identity_len;
 238                 }
 239         }
 240
 241         if (os_get_time(&now) < 0 || lifetime <= 0 || now.sec > lifetime) {
 242                 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Key not valid anymore "
 243                            "(lifetime=%ld now=%ld)", lifetime, now.sec);
 244                 data->send_new_pac = 2;
 245                 /*
 246                  * Allow PAC to be used to allow a PAC update with some level
 247                  * of server authentication (i.e., do not fall back to full TLS
 248                  * handshake since we cannot be sure that the peer would be
 249                  * able to validate server certificate now). However, reject
 250                  * the authentication since the PAC was not valid anymore. Peer
 251                  * can connect again with the newly provisioned PAC after this.
 252                  */
 253         } else if (lifetime - now.sec < data->pac_key_refresh_time) {
 254                 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Key soft timeout; send "
 255                            "an update if authentication succeeds");
 256                 data->send_new_pac = 1;
 257         }
 258
 259         eap_fast_derive_master_secret(pac_key, server_random, client_random,
 260                                       master_secret);
 261
 262         os_free(buf);
 263
 264         return 1;
 265 }
 266
 267
 268 static void eap_fast_derive_key_auth(struct eap_sm *sm,
 269                                      struct eap_fast_data *data)
 270 {
 271         u8 *sks;
 272
 273         /* RFC 4851, Section 5.1:
 274          * Extra key material after TLS key_block: session_key_seed[40]
 275          */
 276
 277         sks = eap_fast_derive_key(sm->ssl_ctx, data->ssl.conn, "key expansion",
 278                                   EAP_FAST_SKS_LEN);
 279         if (sks == NULL) {
 280                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to derive "
 281                            "session_key_seed");
 282                 return;
 283         }
 284
 285         /*
 286          * RFC 4851, Section 5.2:
 287          * S-IMCK[0] = session_key_seed
 288          */
 289         wpa_hexdump_key(MSG_DEBUG,
 290                         "EAP-FAST: session_key_seed (SKS = S-IMCK[0])",
 291                         sks, EAP_FAST_SKS_LEN);
 292         data->simck_idx = 0;
 293         os_memcpy(data->simck, sks, EAP_FAST_SIMCK_LEN);
 294         os_free(sks);
 295 }
 296
 297
 298 static void eap_fast_derive_key_provisioning(struct eap_sm *sm,
 299                                              struct eap_fast_data *data)
 300 {
 301         os_free(data->key_block_p);
 302         data->key_block_p = (struct eap_fast_key_block_provisioning *)
 303                 eap_fast_derive_key(sm->ssl_ctx, data->ssl.conn,
 304                                     "key expansion",
 305                                     sizeof(*data->key_block_p));
 306         if (data->key_block_p == NULL) {
 307                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to derive key block");
 308                 return;
 309         }
 310         /*
 311          * RFC 4851, Section 5.2:
 312          * S-IMCK[0] = session_key_seed
 313          */
 314         wpa_hexdump_key(MSG_DEBUG,
 315                         "EAP-FAST: session_key_seed (SKS = S-IMCK[0])",
 316                         data->key_block_p->session_key_seed,
 317                         sizeof(data->key_block_p->session_key_seed));
 318         data->simck_idx = 0;
 319         os_memcpy(data->simck, data->key_block_p->session_key_seed,
 320                   EAP_FAST_SIMCK_LEN);
 321         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: server_challenge",
 322                         data->key_block_p->server_challenge,
 323                         sizeof(data->key_block_p->server_challenge));
 324         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: client_challenge",
 325                         data->key_block_p->client_challenge,
 326                         sizeof(data->key_block_p->client_challenge));
 327 }
 328
 329
 330 static int eap_fast_get_phase2_key(struct eap_sm *sm,
 331                                    struct eap_fast_data *data,
 332                                    u8 *isk, size_t isk_len)
 333 {
 334         u8 *key;
 335         size_t key_len;
 336
 337         os_memset(isk, 0, isk_len);
 338
 339         if (data->phase2_method == NULL || data->phase2_priv == NULL) {
 340                 wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 method not "
 341                            "available");
 342                 return -1;
 343         }
 344
 345         if (data->phase2_method->getKey == NULL)
 346                 return 0;
 347
 348         if ((key = data->phase2_method->getKey(sm, data->phase2_priv,
 349                                                &key_len)) == NULL) {
 350                 wpa_printf(MSG_DEBUG, "EAP-FAST: Could not get key material "
 351                            "from Phase 2");
 352                 return -1;
 353         }
 354
 355         if (key_len > isk_len)
 356                 key_len = isk_len;
 357         os_memcpy(isk, key, key_len);
 358         os_free(key);
 359
 360         return 0;
 361 }
 362
 363
 364 static int eap_fast_update_icmk(struct eap_sm *sm, struct eap_fast_data *data)
 365 {
 366         u8 isk[32], imck[60];
 367
 368         wpa_printf(MSG_DEBUG, "EAP-FAST: Deriving ICMK[%d] (S-IMCK and CMK)",
 369                    data->simck_idx + 1);
 370
 371         /*
 372          * RFC 4851, Section 5.2:
 373          * IMCK[j] = T-PRF(S-IMCK[j-1], "Inner Methods Compound Keys",
 374          *                 MSK[j], 60)
 375          * S-IMCK[j] = first 40 octets of IMCK[j]
 376          * CMK[j] = last 20 octets of IMCK[j]
 377          */
 378
 379         if (eap_fast_get_phase2_key(sm, data, isk, sizeof(isk)) < 0)
 380                 return -1;
 381         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: ISK[j]", isk, sizeof(isk));
 382         sha1_t_prf(data->simck, EAP_FAST_SIMCK_LEN,
 383                    "Inner Methods Compound Keys",
 384                    isk, sizeof(isk), imck, sizeof(imck));
 385         data->simck_idx++;
 386         os_memcpy(data->simck, imck, EAP_FAST_SIMCK_LEN);
 387         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: S-IMCK[j]",
 388                         data->simck, EAP_FAST_SIMCK_LEN);
 389         os_memcpy(data->cmk, imck + EAP_FAST_SIMCK_LEN, EAP_FAST_CMK_LEN);
 390         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: CMK[j]",
 391                         data->cmk, EAP_FAST_CMK_LEN);
 392
 393         return 0;
 394 }
 395
 396
 397 static void * eap_fast_init(struct eap_sm *sm)
 398 {
 399         struct eap_fast_data *data;
 400         u8 ciphers[5] = {
 401                 TLS_CIPHER_ANON_DH_AES128_SHA,
 402                 TLS_CIPHER_AES128_SHA,
 403                 TLS_CIPHER_RSA_DHE_AES128_SHA,
 404                 TLS_CIPHER_RC4_SHA,
 405                 TLS_CIPHER_NONE
 406         };
 407
 408         data = os_zalloc(sizeof(*data));
 409         if (data == NULL)
 410                 return NULL;
 411         data->fast_version = EAP_FAST_VERSION;
 412         data->force_version = -1;
 413         if (sm->user && sm->user->force_version >= 0) {
 414                 data->force_version = sm->user->force_version;
 415                 wpa_printf(MSG_DEBUG, "EAP-FAST: forcing version %d",
 416                            data->force_version);
 417                 data->fast_version = data->force_version;
 418         }
 419         data->state = START;
 420
 421         if (eap_server_tls_ssl_init(sm, &data->ssl, 0)) {
 422                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to initialize SSL.");
 423                 eap_fast_reset(sm, data);
 424                 return NULL;
 425         }
 426
 427         if (tls_connection_set_cipher_list(sm->ssl_ctx, data->ssl.conn,
 428                                            ciphers) < 0) {
 429                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to set TLS cipher "
 430                            "suites");
 431                 eap_fast_reset(sm, data);
 432                 return NULL;
 433         }
 434
 435         if (tls_connection_set_session_ticket_cb(sm->ssl_ctx, data->ssl.conn,
 436                                                  eap_fast_session_ticket_cb,
 437                                                  data) < 0) {
 438                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to set SessionTicket "
 439                            "callback");
 440                 eap_fast_reset(sm, data);
 441                 return NULL;
 442         }
 443
 444         if (sm->pac_opaque_encr_key == NULL) {
 445                 wpa_printf(MSG_INFO, "EAP-FAST: No PAC-Opaque encryption key "
 446                            "configured");
 447                 eap_fast_reset(sm, data);
 448                 return NULL;
 449         }
 450         os_memcpy(data->pac_opaque_encr, sm->pac_opaque_encr_key,
 451                   sizeof(data->pac_opaque_encr));
 452
 453         if (sm->eap_fast_a_id == NULL) {
 454                 wpa_printf(MSG_INFO, "EAP-FAST: No A-ID configured");
 455                 eap_fast_reset(sm, data);
 456                 return NULL;
 457         }
 458         data->srv_id = os_malloc(sm->eap_fast_a_id_len);
 459         if (data->srv_id == NULL) {
 460                 eap_fast_reset(sm, data);
 461                 return NULL;
 462         }
 463         os_memcpy(data->srv_id, sm->eap_fast_a_id, sm->eap_fast_a_id_len);
 464         data->srv_id_len = sm->eap_fast_a_id_len;
 465
 466         if (sm->eap_fast_a_id_info == NULL) {
 467                 wpa_printf(MSG_INFO, "EAP-FAST: No A-ID-Info configured");
 468                 eap_fast_reset(sm, data);
 469                 return NULL;
 470         }
 471         data->srv_id_info = os_strdup(sm->eap_fast_a_id_info);
 472         if (data->srv_id_info == NULL) {
 473                 eap_fast_reset(sm, data);
 474                 return NULL;
 475         }
 476
 477         /* PAC-Key lifetime in seconds (hard limit) */
 478         data->pac_key_lifetime = sm->pac_key_lifetime;
 479
 480         /*
 481          * PAC-Key refresh time in seconds (soft limit on remaining hard
 482          * limit). The server will generate a new PAC-Key when this number of
 483          * seconds (or fewer) of the lifetime remains.
 484          */
 485         data->pac_key_refresh_time = sm->pac_key_refresh_time;
 486
 487         return data;
 488 }
 489
 490
 491 static void eap_fast_reset(struct eap_sm *sm, void *priv)
 492 {
 493         struct eap_fast_data *data = priv;
 494         if (data == NULL)
 495                 return;
 496         if (data->phase2_priv && data->phase2_method)
 497                 data->phase2_method->reset(sm, data->phase2_priv);
 498         eap_server_tls_ssl_deinit(sm, &data->ssl);
 499         os_free(data->srv_id);
 500         os_free(data->srv_id_info);
 501         os_free(data->key_block_p);
 502         wpabuf_free(data->pending_phase2_resp);
 503         os_free(data->identity);
 504         os_free(data);
 505 }
 506
 507
 508 static struct wpabuf * eap_fast_build_start(struct eap_sm *sm,
 509                                             struct eap_fast_data *data, u8 id)
 510 {
 511         struct wpabuf *req;
 512
 513         req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_FAST,
 514                             1 + sizeof(struct pac_tlv_hdr) + data->srv_id_len,
 515                             EAP_CODE_REQUEST, id);
 516         if (req == NULL) {
 517                 wpa_printf(MSG_ERROR, "EAP-FAST: Failed to allocate memory for"
 518                            " request");
 519                 eap_fast_state(data, FAILURE);
 520                 return NULL;
 521         }
 522
 523         wpabuf_put_u8(req, EAP_TLS_FLAGS_START | data->fast_version);
 524
 525         /* RFC 4851, 4.1.1. Authority ID Data */
 526         eap_fast_put_tlv(req, PAC_TYPE_A_ID, data->srv_id, data->srv_id_len);
 527
 528         eap_fast_state(data, PHASE1);
 529
 530         return req;
 531 }
 532
 533
 534 static int eap_fast_phase1_done(struct eap_sm *sm, struct eap_fast_data *data)
 535 {
 536         char cipher[64];
 537
 538         wpa_printf(MSG_DEBUG, "EAP-FAST: Phase1 done, starting Phase2");
 539
 540         if (tls_get_cipher(sm->ssl_ctx, data->ssl.conn, cipher, sizeof(cipher))
 541             < 0) {
 542                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to get cipher "
 543                            "information");
 544                 eap_fast_state(data, FAILURE);
 545                 return -1;
 546         }
 547         data->anon_provisioning = os_strstr(cipher, "ADH") != NULL;
 548
 549         if (data->anon_provisioning) {
 550                 wpa_printf(MSG_DEBUG, "EAP-FAST: Anonymous provisioning");
 551                 eap_fast_derive_key_provisioning(sm, data);
 552         } else
 553                 eap_fast_derive_key_auth(sm, data);
 554
 555         eap_fast_state(data, PHASE2_START);
 556
 557         return 0;
 558 }
 559
 560
 561 static struct wpabuf * eap_fast_build_phase2_req(struct eap_sm *sm,
 562                                                  struct eap_fast_data *data,
 563                                                  u8 id)
 564 {
 565         struct wpabuf *req;
 566
 567         if (data->phase2_priv == NULL) {
 568                 wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 method not "
 569                            "initialized");
 570                 return NULL;
 571         }
 572         req = data->phase2_method->buildReq(sm, data->phase2_priv, id);
 573         if (req == NULL)
 574                 return NULL;
 575
 576         wpa_hexdump_buf_key(MSG_MSGDUMP, "EAP-FAST: Phase 2 EAP-Request", req);
 577         return eap_fast_tlv_eap_payload(req);
 578 }
 579
 580
 581 static struct wpabuf * eap_fast_build_crypto_binding(
 582         struct eap_sm *sm, struct eap_fast_data *data)
 583 {
 584         struct wpabuf *buf;
 585         struct eap_tlv_result_tlv *result;
 586         struct eap_tlv_crypto_binding_tlv *binding;
 587
 588         buf = wpabuf_alloc(2 * sizeof(*result) + sizeof(*binding));
 589         if (buf == NULL)
 590                 return NULL;
 591
 592         if (data->send_new_pac || data->anon_provisioning ||
 593             data->phase2_method)
 594                 data->final_result = 0;
 595         else
 596                 data->final_result = 1;
 597
 598         if (!data->final_result || data->eap_seq > 1) {
 599                 /* Intermediate-Result */
 600                 wpa_printf(MSG_DEBUG, "EAP-FAST: Add Intermediate-Result TLV "
 601                            "(status=SUCCESS)");
 602                 result = wpabuf_put(buf, sizeof(*result));
 603                 result->tlv_type = host_to_be16(
 604                         EAP_TLV_TYPE_MANDATORY |
 605                         EAP_TLV_INTERMEDIATE_RESULT_TLV);
 606                 result->length = host_to_be16(2);
 607                 result->status = host_to_be16(EAP_TLV_RESULT_SUCCESS);
 608         }
 609
 610         if (data->final_result) {
 611                 /* Result TLV */
 612                 wpa_printf(MSG_DEBUG, "EAP-FAST: Add Result TLV "
 613                            "(status=SUCCESS)");
 614                 result = wpabuf_put(buf, sizeof(*result));
 615                 result->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
 616                                                 EAP_TLV_RESULT_TLV);
 617                 result->length = host_to_be16(2);
 618                 result->status = host_to_be16(EAP_TLV_RESULT_SUCCESS);
 619         }
 620
 621         /* Crypto-Binding TLV */
 622         binding = wpabuf_put(buf, sizeof(*binding));
 623         binding->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
 624                                          EAP_TLV_CRYPTO_BINDING_TLV);
 625         binding->length = host_to_be16(sizeof(*binding) -
 626                                        sizeof(struct eap_tlv_hdr));
 627         binding->version = EAP_FAST_VERSION;
 628         binding->received_version = data->peer_version;
 629         binding->subtype = EAP_TLV_CRYPTO_BINDING_SUBTYPE_REQUEST;
 630         if (os_get_random(binding->nonce, sizeof(binding->nonce)) < 0) {
 631                 wpabuf_free(buf);
 632                 return NULL;
 633         }
 634
 635         /*
 636          * RFC 4851, Section 4.2.8:
 637          * The nonce in a request MUST have its least significant bit set to 0.
 638          */
 639         binding->nonce[sizeof(binding->nonce) - 1] &= ~0x01;
 640
 641         os_memcpy(data->crypto_binding_nonce, binding->nonce,
 642                   sizeof(binding->nonce));
 643
 644         /*
 645          * RFC 4851, Section 5.3:
 646          * CMK = CMK[j]
 647          * Compound-MAC = HMAC-SHA1( CMK, Crypto-Binding TLV )
 648          */
 649
 650         hmac_sha1(data->cmk, EAP_FAST_CMK_LEN,
 651                   (u8 *) binding, sizeof(*binding),
 652                   binding->compound_mac);
 653
 654         wpa_printf(MSG_DEBUG, "EAP-FAST: Add Crypto-Binding TLV: Version %d "
 655                    "Received Version %d SubType %d",
 656                    binding->version, binding->received_version,
 657                    binding->subtype);
 658         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: NONCE",
 659                     binding->nonce, sizeof(binding->nonce));
 660         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Compound MAC",
 661                     binding->compound_mac, sizeof(binding->compound_mac));
 662
 663         return buf;
 664 }
 665
 666
 667 static struct wpabuf * eap_fast_build_pac(struct eap_sm *sm,
 668                                           struct eap_fast_data *data)
 669 {
 670         u8 pac_key[EAP_FAST_PAC_KEY_LEN];
 671         u8 *pac_buf, *pac_opaque;
 672         struct wpabuf *buf;
 673         u8 *pos;
 674         size_t buf_len, srv_id_info_len, pac_len;
 675         struct eap_tlv_hdr *pac_tlv;
 676         struct pac_tlv_hdr *pac_info;
 677         struct eap_tlv_result_tlv *result;
 678         struct os_time now;
 679
 680         if (os_get_random(pac_key, EAP_FAST_PAC_KEY_LEN) < 0 ||
 681             os_get_time(&now) < 0)
 682                 return NULL;
 683         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Generated PAC-Key",
 684                         pac_key, EAP_FAST_PAC_KEY_LEN);
 685
 686         pac_len = (2 + EAP_FAST_PAC_KEY_LEN) + (2 + 4) +
 687                 (2 + sm->identity_len) + 8;
 688         pac_buf = os_malloc(pac_len);
 689         if (pac_buf == NULL)
 690                 return NULL;
 691
 692         srv_id_info_len = os_strlen(data->srv_id_info);
 693
 694         pos = pac_buf;
 695         *pos++ = PAC_OPAQUE_TYPE_KEY;
 696         *pos++ = EAP_FAST_PAC_KEY_LEN;
 697         os_memcpy(pos, pac_key, EAP_FAST_PAC_KEY_LEN);
 698         pos += EAP_FAST_PAC_KEY_LEN;
 699
 700         *pos++ = PAC_OPAQUE_TYPE_LIFETIME;
 701         *pos++ = 4;
 702         WPA_PUT_BE32(pos, now.sec + data->pac_key_lifetime);
 703         pos += 4;
 704
 705         if (sm->identity) {
 706                 *pos++ = PAC_OPAQUE_TYPE_IDENTITY;
 707                 *pos++ = sm->identity_len;
 708                 os_memcpy(pos, sm->identity, sm->identity_len);
 709                 pos += sm->identity_len;
 710         }
 711
 712         pac_len = pos - pac_buf;
 713         while (pac_len % 8) {
 714                 *pos++ = PAC_OPAQUE_TYPE_PAD;
 715                 pac_len++;
 716         }
 717
 718         pac_opaque = os_malloc(pac_len + 8);
 719         if (pac_opaque == NULL) {
 720                 os_free(pac_buf);
 721                 return NULL;
 722         }
 723         if (aes_wrap(data->pac_opaque_encr, pac_len / 8, pac_buf,
 724                      pac_opaque) < 0) {
 725                 os_free(pac_buf);
 726                 os_free(pac_opaque);
 727                 return NULL;
 728         }
 729         os_free(pac_buf);
 730
 731         pac_len += 8;
 732         wpa_hexdump(MSG_DEBUG, "EAP-FAST: PAC-Opaque",
 733                     pac_opaque, pac_len);
 734
 735         buf_len = sizeof(*pac_tlv) +
 736                 sizeof(struct pac_tlv_hdr) + EAP_FAST_PAC_KEY_LEN +
 737                 sizeof(struct pac_tlv_hdr) + pac_len +
 738                 data->srv_id_len + srv_id_info_len + 100 + sizeof(*result);
 739         buf = wpabuf_alloc(buf_len);
 740         if (buf == NULL) {
 741                 os_free(pac_opaque);
 742                 return NULL;
 743         }
 744
 745         /* Result TLV */
 746         wpa_printf(MSG_DEBUG, "EAP-FAST: Add Result TLV (status=SUCCESS)");
 747         result = wpabuf_put(buf, sizeof(*result));
 748         WPA_PUT_BE16((u8 *) &result->tlv_type,
 749                      EAP_TLV_TYPE_MANDATORY | EAP_TLV_RESULT_TLV);
 750         WPA_PUT_BE16((u8 *) &result->length, 2);
 751         WPA_PUT_BE16((u8 *) &result->status, EAP_TLV_RESULT_SUCCESS);
 752
 753         /* PAC TLV */
 754         wpa_printf(MSG_DEBUG, "EAP-FAST: Add PAC TLV");
 755         pac_tlv = wpabuf_put(buf, sizeof(*pac_tlv));
 756         pac_tlv->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
 757                                          EAP_TLV_PAC_TLV);
 758
 759         /* PAC-Key */
 760         eap_fast_put_tlv(buf, PAC_TYPE_PAC_KEY, pac_key, EAP_FAST_PAC_KEY_LEN);
 761
 762         /* PAC-Opaque */
 763         eap_fast_put_tlv(buf, PAC_TYPE_PAC_OPAQUE, pac_opaque, pac_len);
 764         os_free(pac_opaque);
 765
 766         /* PAC-Info */
 767         pac_info = wpabuf_put(buf, sizeof(*pac_info));
 768         pac_info->type = host_to_be16(PAC_TYPE_PAC_INFO);
 769
 770         /* PAC-Lifetime (inside PAC-Info) */
 771         eap_fast_put_tlv_hdr(buf, PAC_TYPE_CRED_LIFETIME, 4);
 772         wpabuf_put_be32(buf, now.sec + data->pac_key_lifetime);
 773
 774         /* A-ID (inside PAC-Info) */
 775         eap_fast_put_tlv(buf, PAC_TYPE_A_ID, data->srv_id, data->srv_id_len);
 776
 777         /* Note: headers may be misaligned after A-ID */
 778
 779         /* A-ID-Info (inside PAC-Info) */
 780         eap_fast_put_tlv(buf, PAC_TYPE_A_ID_INFO, data->srv_id_info,
 781                          srv_id_info_len);
 782
 783         /* PAC-Type (inside PAC-Info) */
 784         eap_fast_put_tlv_hdr(buf, PAC_TYPE_PAC_TYPE, 2);
 785         wpabuf_put_be16(buf, PAC_TYPE_TUNNEL_PAC);
 786
 787         /* Update PAC-Info and PAC TLV Length fields */
 788         pos = wpabuf_put(buf, 0);
 789         pac_info->len = host_to_be16(pos - (u8 *) (pac_info + 1));
 790         pac_tlv->length = host_to_be16(pos - (u8 *) (pac_tlv + 1));
 791
 792         return buf;
 793 }
 794
 795
 796 static struct wpabuf * eap_fast_buildReq(struct eap_sm *sm, void *priv, u8 id)
 797 {
 798         struct eap_fast_data *data = priv;
 799         struct wpabuf *req = NULL;
 800         struct wpabuf *encr;
 801
 802         if (data->ssl.state == FRAG_ACK) {
 803                 return eap_server_tls_build_ack(id, EAP_TYPE_FAST,
 804                                                 data->fast_version);
 805         }
 806
 807         if (data->ssl.state == WAIT_FRAG_ACK) {
 808                 return eap_server_tls_build_msg(&data->ssl, EAP_TYPE_FAST,
 809                                                 data->fast_version, id);
 810         }
 811
 812         switch (data->state) {
 813         case START:
 814                 return eap_fast_build_start(sm, data, id);
 815         case PHASE1:
 816                 if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) {
 817                         if (eap_fast_phase1_done(sm, data) < 0)
 818                                 return NULL;
 819                 }
 820                 break;
 821         case PHASE2_ID:
 822         case PHASE2_METHOD:
 823                 req = eap_fast_build_phase2_req(sm, data, id);
 824                 break;
 825         case CRYPTO_BINDING:
 826                 req = eap_fast_build_crypto_binding(sm, data);
 827                 if (data->phase2_method) {
 828                         /*
 829                          * Include the start of the next EAP method in the
 830                          * sequence in the same message with Crypto-Binding to
 831                          * save a round-trip.
 832                          */
 833                         struct wpabuf *eap;
 834                         eap = eap_fast_build_phase2_req(sm, data, id);
 835                         req = wpabuf_concat(req, eap);
 836                         eap_fast_state(data, PHASE2_METHOD);
 837                 }
 838                 break;
 839         case REQUEST_PAC:
 840                 req = eap_fast_build_pac(sm, data);
 841                 break;
 842         default:
 843                 wpa_printf(MSG_DEBUG, "EAP-FAST: %s - unexpected state %d",
 844                            __func__, data->state);
 845                 return NULL;
 846         }
 847
 848         if (req) {
 849                 wpa_hexdump_buf_key(MSG_DEBUG, "EAP-FAST: Encrypting Phase 2 "
 850                                     "TLVs", req);
 851                 encr = eap_server_tls_encrypt(sm, &data->ssl,
 852                                               wpabuf_mhead(req),
 853                                               wpabuf_len(req));
 854                 wpabuf_free(req);
 855
 856                 wpabuf_free(data->ssl.out_buf);
 857                 data->ssl.out_used = 0;
 858                 data->ssl.out_buf = encr;
 859         }
 860
 861         return eap_server_tls_build_msg(&data->ssl, EAP_TYPE_FAST,
 862                                         data->fast_version, id);
 863 }
 864
 865
 866 static Boolean eap_fast_check(struct eap_sm *sm, void *priv,
 867                               struct wpabuf *respData)
 868 {
 869         const u8 *pos;
 870         size_t len;
 871
 872         pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_FAST, respData, &len);
 873         if (pos == NULL || len < 1) {
 874                 wpa_printf(MSG_INFO, "EAP-FAST: Invalid frame");
 875                 return TRUE;
 876         }
 877
 878         return FALSE;
 879 }
 880
 881
 882 static int eap_fast_phase2_init(struct eap_sm *sm, struct eap_fast_data *data,
 883                                 EapType eap_type)
 884 {
 885         if (data->phase2_priv && data->phase2_method) {
 886                 data->phase2_method->reset(sm, data->phase2_priv);
 887                 data->phase2_method = NULL;
 888                 data->phase2_priv = NULL;
 889         }
 890         data->phase2_method = eap_server_get_eap_method(EAP_VENDOR_IETF,
 891                                                         eap_type);
 892         if (!data->phase2_method)
 893                 return -1;
 894
 895         if (data->key_block_p) {
 896                 sm->auth_challenge = data->key_block_p->server_challenge;
 897                 sm->peer_challenge = data->key_block_p->client_challenge;
 898         }
 899         sm->init_phase2 = 1;
 900         data->phase2_priv = data->phase2_method->init(sm);
 901         sm->init_phase2 = 0;
 902         sm->auth_challenge = NULL;
 903         sm->peer_challenge = NULL;
 904
 905         return data->phase2_priv == NULL ? -1 : 0;
 906 }
 907
 908
 909 static void eap_fast_process_phase2_response(struct eap_sm *sm,
 910                                              struct eap_fast_data *data,
 911                                              u8 *in_data, size_t in_len)
 912 {
 913         u8 next_type = EAP_TYPE_NONE;
 914         struct eap_hdr *hdr;
 915         u8 *pos;
 916         size_t left;
 917         struct wpabuf buf;
 918         const struct eap_method *m = data->phase2_method;
 919         void *priv = data->phase2_priv;
 920
 921         if (priv == NULL) {
 922                 wpa_printf(MSG_DEBUG, "EAP-FAST: %s - Phase2 not "
 923                            "initialized?!", __func__);
 924                 return;
 925         }
 926
 927         hdr = (struct eap_hdr *) in_data;
 928         pos = (u8 *) (hdr + 1);
 929
 930         if (in_len > sizeof(*hdr) && *pos == EAP_TYPE_NAK) {
 931                 left = in_len - sizeof(*hdr);
 932                 wpa_hexdump(MSG_DEBUG, "EAP-FAST: Phase2 type Nak'ed; "
 933                             "allowed types", pos + 1, left - 1);
 934 #ifdef EAP_TNC
 935                 if (m && m->vendor == EAP_VENDOR_IETF &&
 936                     m->method == EAP_TYPE_TNC) {
 937                         wpa_printf(MSG_DEBUG, "EAP-FAST: Peer Nak'ed required "
 938                                    "TNC negotiation");
 939                         next_type = eap_fast_req_failure(sm, data);
 940                         eap_fast_phase2_init(sm, data, next_type);
 941                         return;
 942                 }
 943 #endif /* EAP_TNC */
 944                 eap_sm_process_nak(sm, pos + 1, left - 1);
 945                 if (sm->user && sm->user_eap_method_index < EAP_MAX_METHODS &&
 946                     sm->user->methods[sm->user_eap_method_index].method !=
 947                     EAP_TYPE_NONE) {
 948                         next_type = sm->user->methods[
 949                                 sm->user_eap_method_index++].method;
 950                         wpa_printf(MSG_DEBUG, "EAP-FAST: try EAP type %d",
 951                                    next_type);
 952                 } else {
 953                         next_type = eap_fast_req_failure(sm, data);
 954                 }
 955                 eap_fast_phase2_init(sm, data, next_type);
 956                 return;
 957         }
 958
 959         wpabuf_set(&buf, in_data, in_len);
 960
 961         if (m->check(sm, priv, &buf)) {
 962                 wpa_printf(MSG_DEBUG, "EAP-FAST: Phase2 check() asked to "
 963                            "ignore the packet");
 964                 next_type = eap_fast_req_failure(sm, data);
 965                 return;
 966         }
 967
 968         m->process(sm, priv, &buf);
 969
 970         if (!m->isDone(sm, priv))
 971                 return;
 972
 973         if (!m->isSuccess(sm, priv)) {
 974                 wpa_printf(MSG_DEBUG, "EAP-FAST: Phase2 method failed");
 975                 next_type = eap_fast_req_failure(sm, data);
 976                 eap_fast_phase2_init(sm, data, next_type);
 977                 return;
 978         }
 979
 980         switch (data->state) {
 981         case PHASE2_ID:
 982                 if (eap_user_get(sm, sm->identity, sm->identity_len, 1) != 0) {
 983                         wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: Phase2 "
 984                                           "Identity not found in the user "
 985                                           "database",
 986                                           sm->identity, sm->identity_len);
 987                         next_type = eap_fast_req_failure(sm, data);
 988                         break;
 989                 }
 990
 991                 eap_fast_state(data, PHASE2_METHOD);
 992                 if (data->anon_provisioning) {
 993                         /*
 994                          * Only EAP-MSCHAPv2 is allowed for anonymous
 995                          * provisioning.
 996                          */
 997                         next_type = EAP_TYPE_MSCHAPV2;
 998                         sm->user_eap_method_index = 0;
 999                 } else {
1000                         next_type = sm->user->methods[0].method;
1001                         sm->user_eap_method_index = 1;
1002                 }
1003                 wpa_printf(MSG_DEBUG, "EAP-FAST: try EAP type %d", next_type);
1004                 break;
1005         case PHASE2_METHOD:
1006         case CRYPTO_BINDING:
1007                 eap_fast_update_icmk(sm, data);
1008                 eap_fast_state(data, CRYPTO_BINDING);
1009                 data->eap_seq++;
1010                 next_type = EAP_TYPE_NONE;
1011 #ifdef EAP_TNC
1012                 if (sm->tnc && !data->tnc_started) {
1013                         wpa_printf(MSG_DEBUG, "EAP-FAST: Initialize TNC");
1014                         next_type = EAP_TYPE_TNC;
1015                         data->tnc_started = 1;
1016                 }
1017 #endif /* EAP_TNC */
1018                 break;
1019         case FAILURE:
1020                 break;
1021         default:
1022                 wpa_printf(MSG_DEBUG, "EAP-FAST: %s - unexpected state %d",
1023                            __func__, data->state);
1024                 break;
1025         }
1026
1027         eap_fast_phase2_init(sm, data, next_type);
1028 }
1029
1030
1031 static void eap_fast_process_phase2_eap(struct eap_sm *sm,
1032                                         struct eap_fast_data *data,
1033                                         u8 *in_data, size_t in_len)
1034 {
1035         struct eap_hdr *hdr;
1036         size_t len;
1037
1038         hdr = (struct eap_hdr *) in_data;
1039         if (in_len < (int) sizeof(*hdr)) {
1040                 wpa_printf(MSG_INFO, "EAP-FAST: Too short Phase 2 "
1041                            "EAP frame (len=%lu)", (unsigned long) in_len);
1042                 eap_fast_req_failure(sm, data);
1043                 return;
1044         }
1045         len = be_to_host16(hdr->length);
1046         if (len > in_len) {
1047                 wpa_printf(MSG_INFO, "EAP-FAST: Length mismatch in "
1048                            "Phase 2 EAP frame (len=%lu hdr->length=%lu)",
1049                            (unsigned long) in_len, (unsigned long) len);
1050                 eap_fast_req_failure(sm, data);
1051                 return;
1052         }
1053         wpa_printf(MSG_DEBUG, "EAP-FAST: Received Phase 2: code=%d "
1054                    "identifier=%d length=%lu", hdr->code, hdr->identifier,
1055                    (unsigned long) len);
1056         switch (hdr->code) {
1057         case EAP_CODE_RESPONSE:
1058                 eap_fast_process_phase2_response(sm, data, (u8 *) hdr, len);
1059                 break;
1060         default:
1061                 wpa_printf(MSG_INFO, "EAP-FAST: Unexpected code=%d in "
1062                            "Phase 2 EAP header", hdr->code);
1063                 break;
1064         }
1065 }
1066
1067
1068 static int eap_fast_parse_tlvs(u8 *data, size_t data_len,
1069                                struct eap_fast_tlv_parse *tlv)
1070 {
1071         int mandatory, tlv_type, len, res;
1072         u8 *pos, *end;
1073
1074         os_memset(tlv, 0, sizeof(*tlv));
1075
1076         pos = data;
1077         end = data + data_len;
1078         while (pos + 4 < end) {
1079                 mandatory = pos[0] & 0x80;
1080                 tlv_type = WPA_GET_BE16(pos) & 0x3fff;
1081                 pos += 2;
1082                 len = WPA_GET_BE16(pos);
1083                 pos += 2;
1084                 if (pos + len > end) {
1085                         wpa_printf(MSG_INFO, "EAP-FAST: TLV overflow");
1086                         return -1;
1087                 }
1088                 wpa_printf(MSG_DEBUG, "EAP-FAST: Received Phase 2: "
1089                            "TLV type %d length %d%s",
1090                            tlv_type, len, mandatory ? " (mandatory)" : "");
1091
1092                 res = eap_fast_parse_tlv(tlv, tlv_type, pos, len);
1093                 if (res == -2)
1094                         break;
1095                 if (res < 0) {
1096                         if (mandatory) {
1097                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Nak unknown "
1098                                            "mandatory TLV type %d", tlv_type);
1099                                 /* TODO: generate Nak TLV */
1100                                 break;
1101                         } else {
1102                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Ignored "
1103                                            "unknown optional TLV type %d",
1104                                            tlv_type);
1105                         }
1106                 }
1107
1108                 pos += len;
1109         }
1110
1111         return 0;
1112 }
1113
1114
1115 static int eap_fast_validate_crypto_binding(
1116         struct eap_fast_data *data, struct eap_tlv_crypto_binding_tlv *b,
1117         size_t bind_len)
1118 {
1119         u8 cmac[SHA1_MAC_LEN];
1120
1121         wpa_printf(MSG_DEBUG, "EAP-FAST: Reply Crypto-Binding TLV: "
1122                    "Version %d Received Version %d SubType %d",
1123                    b->version, b->received_version, b->subtype);
1124         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: NONCE",
1125                     b->nonce, sizeof(b->nonce));
1126         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Compound MAC",
1127                     b->compound_mac, sizeof(b->compound_mac));
1128
1129         if (b->version != EAP_FAST_VERSION ||
1130             b->received_version != EAP_FAST_VERSION) {
1131                 wpa_printf(MSG_DEBUG, "EAP-FAST: Unexpected version "
1132                            "in Crypto-Binding: version %d "
1133                            "received_version %d", b->version,
1134                            b->received_version);
1135                 return -1;
1136         }
1137
1138         if (b->subtype != EAP_TLV_CRYPTO_BINDING_SUBTYPE_RESPONSE) {
1139                 wpa_printf(MSG_DEBUG, "EAP-FAST: Unexpected subtype in "
1140                            "Crypto-Binding: %d", b->subtype);
1141                 return -1;
1142         }
1143
1144         if (os_memcmp(data->crypto_binding_nonce, b->nonce, 31) != 0 ||
1145             (data->crypto_binding_nonce[31] | 1) != b->nonce[31]) {
1146                 wpa_printf(MSG_DEBUG, "EAP-FAST: Invalid nonce in "
1147                            "Crypto-Binding");
1148                 return -1;
1149         }
1150
1151         os_memcpy(cmac, b->compound_mac, sizeof(cmac));
1152         os_memset(b->compound_mac, 0, sizeof(cmac));
1153         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Crypto-Binding TLV for "
1154                     "Compound MAC calculation",
1155                     (u8 *) b, bind_len);
1156         hmac_sha1(data->cmk, EAP_FAST_CMK_LEN, (u8 *) b, bind_len,
1157                   b->compound_mac);
1158         if (os_memcmp(cmac, b->compound_mac, sizeof(cmac)) != 0) {
1159                 wpa_hexdump(MSG_MSGDUMP,
1160                             "EAP-FAST: Calculated Compound MAC",
1161                             b->compound_mac, sizeof(cmac));
1162                 wpa_printf(MSG_INFO, "EAP-FAST: Compound MAC did not "
1163                            "match");
1164                 return -1;
1165         }
1166
1167         return 0;
1168 }
1169
1170
1171 static int eap_fast_pac_type(u8 *pac, size_t len, u16 type)
1172 {
1173         struct eap_tlv_pac_type_tlv *tlv;
1174
1175         if (pac == NULL || len != sizeof(*tlv))
1176                 return 0;
1177
1178         tlv = (struct eap_tlv_pac_type_tlv *) pac;
1179
1180         return be_to_host16(tlv->tlv_type) == PAC_TYPE_PAC_TYPE &&
1181                 be_to_host16(tlv->length) == 2 &&
1182                 be_to_host16(tlv->pac_type) == type;
1183 }
1184
1185
1186 static void eap_fast_process_phase2_tlvs(struct eap_sm *sm,
1187                                          struct eap_fast_data *data,
1188                                          u8 *in_data, size_t in_len)
1189 {
1190         struct eap_fast_tlv_parse tlv;
1191         int check_crypto_binding = data->state == CRYPTO_BINDING;
1192
1193         if (eap_fast_parse_tlvs(in_data, in_len, &tlv) < 0) {
1194                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to parse received "
1195                            "Phase 2 TLVs");
1196                 return;
1197         }
1198
1199         if (tlv.result == EAP_TLV_RESULT_FAILURE) {
1200                 wpa_printf(MSG_DEBUG, "EAP-FAST: Result TLV indicated "
1201                            "failure");
1202                 eap_fast_state(data, FAILURE);
1203                 return;
1204         }
1205
1206         if (data->state == REQUEST_PAC) {
1207                 u16 type, len, res;
1208                 if (tlv.pac == NULL || tlv.pac_len < 6) {
1209                         wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC "
1210                                    "Acknowledgement received");
1211                         eap_fast_state(data, FAILURE);
1212                         return;
1213                 }
1214
1215                 type = WPA_GET_BE16(tlv.pac);
1216                 len = WPA_GET_BE16(tlv.pac + 2);
1217                 res = WPA_GET_BE16(tlv.pac + 4);
1218
1219                 if (type != PAC_TYPE_PAC_ACKNOWLEDGEMENT || len != 2 ||
1220                     res != EAP_TLV_RESULT_SUCCESS) {
1221                         wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV did not "
1222                                    "contain acknowledgement");
1223                         eap_fast_state(data, FAILURE);
1224                         return;
1225                 }
1226
1227                 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Acknowledgement received "
1228                            "- PAC provisioning succeeded");
1229                 eap_fast_state(data, (data->anon_provisioning ||
1230                                       data->send_new_pac == 2) ?
1231                                FAILURE : SUCCESS);
1232                 return;
1233         }
1234
1235         if (check_crypto_binding) {
1236                 if (tlv.crypto_binding == NULL) {
1237                         wpa_printf(MSG_DEBUG, "EAP-FAST: No Crypto-Binding "
1238                                    "TLV received");
1239                         eap_fast_state(data, FAILURE);
1240                         return;
1241                 }
1242
1243                 if (data->final_result &&
1244                     tlv.result != EAP_TLV_RESULT_SUCCESS) {
1245                         wpa_printf(MSG_DEBUG, "EAP-FAST: Crypto-Binding TLV "
1246                                    "without Success Result");
1247                         eap_fast_state(data, FAILURE);
1248                         return;
1249                 }
1250
1251                 if (!data->final_result &&
1252                     tlv.iresult != EAP_TLV_RESULT_SUCCESS) {
1253                         wpa_printf(MSG_DEBUG, "EAP-FAST: Crypto-Binding TLV "
1254                                    "without intermediate Success Result");
1255                         eap_fast_state(data, FAILURE);
1256                         return;
1257                 }
1258
1259                 if (eap_fast_validate_crypto_binding(data, tlv.crypto_binding,
1260                                                      tlv.crypto_binding_len)) {
1261                         eap_fast_state(data, FAILURE);
1262                         return;
1263                 }
1264
1265                 wpa_printf(MSG_DEBUG, "EAP-FAST: Valid Crypto-Binding TLV "
1266                            "received");
1267                 if (data->final_result) {
1268                         wpa_printf(MSG_DEBUG, "EAP-FAST: Authentication "
1269                                    "completed successfully");
1270                 }
1271
1272                 if (data->anon_provisioning &&
1273                     sm->eap_fast_prov != ANON_PROV &&
1274                     sm->eap_fast_prov != BOTH_PROV) {
1275                         wpa_printf(MSG_DEBUG, "EAP-FAST: Client is trying to "
1276                                    "use unauthenticated provisioning which is "
1277                                    "disabled");
1278                         eap_fast_state(data, FAILURE);
1279                         return;
1280                 }
1281
1282                 if (sm->eap_fast_prov != AUTH_PROV &&
1283                     sm->eap_fast_prov != BOTH_PROV &&
1284                     tlv.request_action == EAP_TLV_ACTION_PROCESS_TLV &&
1285                     eap_fast_pac_type(tlv.pac, tlv.pac_len,
1286                                       PAC_TYPE_TUNNEL_PAC)) {
1287                         wpa_printf(MSG_DEBUG, "EAP-FAST: Client is trying to "
1288                                    "use authenticated provisioning which is "
1289                                    "disabled");
1290                         eap_fast_state(data, FAILURE);
1291                         return;
1292                 }
1293
1294                 if (data->anon_provisioning ||
1295                     (tlv.request_action == EAP_TLV_ACTION_PROCESS_TLV &&
1296                      eap_fast_pac_type(tlv.pac, tlv.pac_len,
1297                                        PAC_TYPE_TUNNEL_PAC))) {
1298                         wpa_printf(MSG_DEBUG, "EAP-FAST: Requested a new "
1299                                    "Tunnel PAC");
1300                         eap_fast_state(data, REQUEST_PAC);
1301                 } else if (data->send_new_pac) {
1302                         wpa_printf(MSG_DEBUG, "EAP-FAST: Server triggered "
1303                                    "re-keying of Tunnel PAC");
1304                         eap_fast_state(data, REQUEST_PAC);
1305                 } else if (data->final_result)
1306                         eap_fast_state(data, SUCCESS);
1307         }
1308
1309         if (tlv.eap_payload_tlv) {
1310                 eap_fast_process_phase2_eap(sm, data, tlv.eap_payload_tlv,
1311                                             tlv.eap_payload_tlv_len);
1312         }
1313 }
1314
1315
1316 static void eap_fast_process_phase2(struct eap_sm *sm,
1317                                     struct eap_fast_data *data,
1318                                     struct wpabuf *in_buf)
1319 {
1320         u8 *in_decrypted;
1321         int len_decrypted;
1322         size_t buf_len;
1323         u8 *in_data;
1324         size_t in_len;
1325
1326         in_data = wpabuf_mhead(in_buf);
1327         in_len = wpabuf_len(in_buf);
1328
1329         wpa_printf(MSG_DEBUG, "EAP-FAST: Received %lu bytes encrypted data for"
1330                    " Phase 2", (unsigned long) in_len);
1331
1332         if (data->pending_phase2_resp) {
1333                 wpa_printf(MSG_DEBUG, "EAP-PEAP: Pending Phase 2 response - "
1334                            "skip decryption and use old data");
1335                 eap_fast_process_phase2_tlvs(
1336                         sm, data, wpabuf_mhead(data->pending_phase2_resp),
1337                         wpabuf_len(data->pending_phase2_resp));
1338                 wpabuf_free(data->pending_phase2_resp);
1339                 data->pending_phase2_resp = NULL;
1340                 return;
1341         }
1342
1343         buf_len = in_len;
1344         /*
1345          * Even though we try to disable TLS compression, it is possible that
1346          * this cannot be done with all TLS libraries. Add extra buffer space
1347          * to handle the possibility of the decrypted data being longer than
1348          * input data.
1349          */
1350         buf_len += 500;
1351         buf_len *= 3;
1352         in_decrypted = os_malloc(buf_len);
1353         if (in_decrypted == NULL) {
1354                 wpa_printf(MSG_WARNING, "EAP-FAST: Failed to allocate memory "
1355                            "for decryption");
1356                 return;
1357         }
1358
1359         len_decrypted = tls_connection_decrypt(sm->ssl_ctx, data->ssl.conn,
1360                                                in_data, in_len,
1361                                                in_decrypted, buf_len);
1362         if (len_decrypted < 0) {
1363                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to decrypt Phase 2 "
1364                            "data");
1365                 os_free(in_decrypted);
1366                 eap_fast_state(data, FAILURE);
1367                 return;
1368         }
1369
1370         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Decrypted Phase 2 TLVs",
1371                         in_decrypted, len_decrypted);
1372
1373         eap_fast_process_phase2_tlvs(sm, data, in_decrypted, len_decrypted);
1374
1375         if (sm->method_pending == METHOD_PENDING_WAIT) {
1376                 wpa_printf(MSG_DEBUG, "EAP-FAST: Phase2 method is in "
1377                            "pending wait state - save decrypted response");
1378                 wpabuf_free(data->pending_phase2_resp);
1379                 data->pending_phase2_resp = wpabuf_alloc_copy(in_decrypted,
1380                                                               len_decrypted);
1381         }
1382
1383         os_free(in_decrypted);
1384 }
1385
1386
1387 static int eap_fast_process_version(struct eap_sm *sm, void *priv,
1388                                     int peer_version)
1389 {
1390         struct eap_fast_data *data = priv;
1391
1392         data->peer_version = peer_version;
1393
1394         if (data->force_version >= 0 && peer_version != data->force_version) {
1395                 wpa_printf(MSG_INFO, "EAP-FAST: peer did not select the forced"
1396                            " version (forced=%d peer=%d) - reject",
1397                            data->force_version, peer_version);
1398                 return -1;
1399         }
1400
1401         if (peer_version < data->fast_version) {
1402                 wpa_printf(MSG_DEBUG, "EAP-FAST: peer ver=%d, own ver=%d; "
1403                            "use version %d",
1404                            peer_version, data->fast_version, peer_version);
1405                 data->fast_version = peer_version;
1406         }
1407
1408         return 0;
1409 }
1410
1411
1412 static int eap_fast_process_phase1(struct eap_sm *sm,
1413                                    struct eap_fast_data *data)
1414 {
1415         if (eap_server_tls_phase1(sm, &data->ssl) < 0) {
1416                 wpa_printf(MSG_INFO, "EAP-FAST: TLS processing failed");
1417                 eap_fast_state(data, FAILURE);
1418                 return -1;
1419         }
1420
1421         if (!tls_connection_established(sm->ssl_ctx, data->ssl.conn) ||
1422             wpabuf_len(data->ssl.out_buf) > 0)
1423                 return 1;
1424
1425         /*
1426          * Phase 1 was completed with the received message (e.g., when using
1427          * abbreviated handshake), so Phase 2 can be started immediately
1428          * without having to send through an empty message to the peer.
1429          */
1430
1431         return eap_fast_phase1_done(sm, data);
1432 }
1433
1434
1435 static void eap_fast_process_phase2_start(struct eap_sm *sm,
1436                                           struct eap_fast_data *data)
1437 {
1438         u8 next_type;
1439
1440         if (data->identity) {
1441                 os_free(sm->identity);
1442                 sm->identity = data->identity;
1443                 data->identity = NULL;
1444                 sm->identity_len = data->identity_len;
1445                 data->identity_len = 0;
1446                 sm->require_identity_match = 1;
1447                 if (eap_user_get(sm, sm->identity, sm->identity_len, 1) != 0) {
1448                         wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: "
1449                                           "Phase2 Identity not found "
1450                                           "in the user database",
1451                                           sm->identity, sm->identity_len);
1452                         next_type = eap_fast_req_failure(sm, data);
1453                 } else {
1454                         wpa_printf(MSG_DEBUG, "EAP-FAST: Identity already "
1455                                    "known - skip Phase 2 Identity Request");
1456                         next_type = sm->user->methods[0].method;
1457                         sm->user_eap_method_index = 1;
1458                 }
1459
1460                 eap_fast_state(data, PHASE2_METHOD);
1461         } else {
1462                 eap_fast_state(data, PHASE2_ID);
1463                 next_type = EAP_TYPE_IDENTITY;
1464         }
1465
1466         eap_fast_phase2_init(sm, data, next_type);
1467 }
1468
1469
1470 static void eap_fast_process_msg(struct eap_sm *sm, void *priv,
1471                                  const struct wpabuf *respData)
1472 {
1473         struct eap_fast_data *data = priv;
1474
1475         switch (data->state) {
1476         case PHASE1:
1477                 if (eap_fast_process_phase1(sm, data))
1478                         break;
1479
1480                 /* fall through to PHASE2_START */
1481         case PHASE2_START:
1482                 eap_fast_process_phase2_start(sm, data);
1483                 break;
1484         case PHASE2_ID:
1485         case PHASE2_METHOD:
1486         case CRYPTO_BINDING:
1487         case REQUEST_PAC:
1488                 eap_fast_process_phase2(sm, data, data->ssl.in_buf);
1489                 break;
1490         default:
1491                 wpa_printf(MSG_DEBUG, "EAP-FAST: Unexpected state %d in %s",
1492                            data->state, __func__);
1493                 break;
1494         }
1495 }
1496
1497
1498 static void eap_fast_process(struct eap_sm *sm, void *priv,
1499                              struct wpabuf *respData)
1500 {
1501         struct eap_fast_data *data = priv;
1502         if (eap_server_tls_process(sm, &data->ssl, respData, data,
1503                                    EAP_TYPE_FAST, eap_fast_process_version,
1504                                    eap_fast_process_msg) < 0)
1505                 eap_fast_state(data, FAILURE);
1506 }
1507
1508
1509 static Boolean eap_fast_isDone(struct eap_sm *sm, void *priv)
1510 {
1511         struct eap_fast_data *data = priv;
1512         return data->state == SUCCESS || data->state == FAILURE;
1513 }
1514
1515
1516 static u8 * eap_fast_getKey(struct eap_sm *sm, void *priv, size_t *len)
1517 {
1518         struct eap_fast_data *data = priv;
1519         u8 *eapKeyData;
1520
1521         if (data->state != SUCCESS)
1522                 return NULL;
1523
1524         eapKeyData = os_malloc(EAP_FAST_KEY_LEN);
1525         if (eapKeyData == NULL)
1526                 return NULL;
1527
1528         eap_fast_derive_eap_msk(data->simck, eapKeyData);
1529         *len = EAP_FAST_KEY_LEN;
1530
1531         return eapKeyData;
1532 }
1533
1534
1535 static u8 * eap_fast_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
1536 {
1537         struct eap_fast_data *data = priv;
1538         u8 *eapKeyData;
1539
1540         if (data->state != SUCCESS)
1541                 return NULL;
1542
1543         eapKeyData = os_malloc(EAP_EMSK_LEN);
1544         if (eapKeyData == NULL)
1545                 return NULL;
1546
1547         eap_fast_derive_eap_emsk(data->simck, eapKeyData);
1548         *len = EAP_EMSK_LEN;
1549
1550         return eapKeyData;
1551 }
1552
1553
1554 static Boolean eap_fast_isSuccess(struct eap_sm *sm, void *priv)
1555 {
1556         struct eap_fast_data *data = priv;
1557         return data->state == SUCCESS;
1558 }
1559
1560
1561 int eap_server_fast_register(void)
1562 {
1563         struct eap_method *eap;
1564         int ret;
1565
1566         eap = eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION,
1567                                       EAP_VENDOR_IETF, EAP_TYPE_FAST, "FAST");
1568         if (eap == NULL)
1569                 return -1;
1570
1571         eap->init = eap_fast_init;
1572         eap->reset = eap_fast_reset;
1573         eap->buildReq = eap_fast_buildReq;
1574         eap->check = eap_fast_check;
1575         eap->process = eap_fast_process;
1576         eap->isDone = eap_fast_isDone;
1577         eap->getKey = eap_fast_getKey;
1578         eap->get_emsk = eap_fast_get_emsk;
1579         eap->isSuccess = eap_fast_isSuccess;
1580
1581         ret = eap_server_method_register(eap);
1582         if (ret)
1583                 eap_server_method_free(eap);
1584         return ret;
1585 }