src/eap_server/eap_fast.c

   1 /*
   2  * EAP-FAST server (RFC 4851)
   3  * Copyright (c) 2004-2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "aes_wrap.h"
  19 #include "sha1.h"
  20 #include "eap_i.h"
  21 #include "eap_tls_common.h"
  22 #include "tls.h"
  23 #include "eap_common/eap_tlv_common.h"
  24 #include "eap_common/eap_fast_common.h"
  25
  26
  27 static void eap_fast_reset(struct eap_sm *sm, void *priv);
  28
  29
  30 /* Private PAC-Opaque TLV types */
  31 #define PAC_OPAQUE_TYPE_PAD 0
  32 #define PAC_OPAQUE_TYPE_KEY 1
  33 #define PAC_OPAQUE_TYPE_LIFETIME 2
  34 #define PAC_OPAQUE_TYPE_IDENTITY 3
  35
  36 /* PAC-Key lifetime in seconds (hard limit) */
  37 #define PAC_KEY_LIFETIME (7 * 24 * 60 * 60)
  38
  39 /*
  40  * PAC-Key refresh time in seconds (soft limit on remaining hard limit). The
  41  * server will generate a new PAC-Key when this number of seconds (or fewer)
  42  * of the lifetime.
  43  */
  44 #define PAC_KEY_REFRESH_TIME (1 * 24 * 60 * 60)
  45
  46
  47 struct eap_fast_data {
  48         struct eap_ssl_data ssl;
  49         enum {
  50                 START, PHASE1, PHASE2_START, PHASE2_ID, PHASE2_METHOD,
  51                 CRYPTO_BINDING, REQUEST_PAC, SUCCESS, FAILURE
  52         } state;
  53
  54         int fast_version;
  55         const struct eap_method *phase2_method;
  56         void *phase2_priv;
  57         int force_version;
  58         int peer_version;
  59
  60         u8 crypto_binding_nonce[32];
  61         int final_result;
  62
  63         struct eap_fast_key_block_provisioning *key_block_p;
  64
  65         u8 simck[EAP_FAST_SIMCK_LEN];
  66         u8 cmk[EAP_FAST_CMK_LEN];
  67         int simck_idx;
  68
  69         u8 pac_opaque_encr[16];
  70         char *srv_id;
  71
  72         int anon_provisioning;
  73         int send_new_pac; /* server triggered re-keying of Tunnel PAC */
  74         struct wpabuf *pending_phase2_resp;
  75         u8 *identity; /* from PAC-Opaque */
  76         size_t identity_len;
  77         int eap_seq;
  78         int tnc_started;
  79 };
  80
  81
  82 static const char * eap_fast_state_txt(int state)
  83 {
  84         switch (state) {
  85         case START:
  86                 return "START";
  87         case PHASE1:
  88                 return "PHASE1";
  89         case PHASE2_START:
  90                 return "PHASE2_START";
  91         case PHASE2_ID:
  92                 return "PHASE2_ID";
  93         case PHASE2_METHOD:
  94                 return "PHASE2_METHOD";
  95         case CRYPTO_BINDING:
  96                 return "CRYPTO_BINDING";
  97         case REQUEST_PAC:
  98                 return "REQUEST_PAC";
  99         case SUCCESS:
 100                 return "SUCCESS";
 101         case FAILURE:
 102                 return "FAILURE";
 103         default:
 104                 return "Unknown?!";
 105         }
 106 }
 107
 108
 109 static void eap_fast_state(struct eap_fast_data *data, int state)
 110 {
 111         wpa_printf(MSG_DEBUG, "EAP-FAST: %s -> %s",
 112                    eap_fast_state_txt(data->state),
 113                    eap_fast_state_txt(state));
 114         data->state = state;
 115 }
 116
 117
 118 static EapType eap_fast_req_failure(struct eap_sm *sm,
 119                                     struct eap_fast_data *data)
 120 {
 121         /* TODO: send Result TLV(FAILURE) */
 122         eap_fast_state(data, FAILURE);
 123         return EAP_TYPE_NONE;
 124 }
 125
 126
 127 static int eap_fast_session_ticket_cb(void *ctx, const u8 *ticket, size_t len,
 128                                       const u8 *client_random,
 129                                       const u8 *server_random,
 130                                       u8 *master_secret)
 131 {
 132         struct eap_fast_data *data = ctx;
 133         const u8 *pac_opaque;
 134         size_t pac_opaque_len;
 135         u8 *buf, *pos, *end, *pac_key = NULL;
 136         os_time_t lifetime = 0;
 137         struct os_time now;
 138         u8 *identity = NULL;
 139         size_t identity_len = 0;
 140
 141         wpa_printf(MSG_DEBUG, "EAP-FAST: SessionTicket callback");
 142         wpa_hexdump(MSG_DEBUG, "EAP-FAST: SessionTicket (PAC-Opaque)",
 143                     ticket, len);
 144
 145         if (len < 4 || WPA_GET_BE16(ticket) != PAC_TYPE_PAC_OPAQUE) {
 146                 wpa_printf(MSG_DEBUG, "EAP-FAST: Ignore invalid "
 147                            "SessionTicket");
 148                 return 0;
 149         }
 150
 151         pac_opaque_len = WPA_GET_BE16(ticket + 2);
 152         pac_opaque = ticket + 4;
 153         if (pac_opaque_len < 8 || pac_opaque_len % 8 ||
 154             pac_opaque_len > len - 4) {
 155                 wpa_printf(MSG_DEBUG, "EAP-FAST: Ignore invalid PAC-Opaque "
 156                            "(len=%lu left=%lu)",
 157                            (unsigned long) pac_opaque_len,
 158                            (unsigned long) len);
 159                 return 0;
 160         }
 161         wpa_hexdump(MSG_DEBUG, "EAP-FAST: Received PAC-Opaque",
 162                     pac_opaque, pac_opaque_len);
 163
 164         buf = os_malloc(pac_opaque_len - 8);
 165         if (buf == NULL) {
 166                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to allocate memory "
 167                            "for decrypting PAC-Opaque");
 168                 return 0;
 169         }
 170
 171         if (aes_unwrap(data->pac_opaque_encr, (pac_opaque_len - 8) / 8,
 172                        pac_opaque, buf) < 0) {
 173                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to decrypt "
 174                            "PAC-Opaque");
 175                 os_free(buf);
 176                 /*
 177                  * This may have been caused by server changing the PAC-Opaque
 178                  * encryption key, so just ignore this PAC-Opaque instead of
 179                  * failing the authentication completely. Provisioning can now
 180                  * be used to provision a new PAC.
 181                  */
 182                 return 0;
 183         }
 184
 185         end = buf + pac_opaque_len - 8;
 186         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Decrypted PAC-Opaque",
 187                         buf, end - buf);
 188
 189         pos = buf;
 190         while (pos + 1 < end) {
 191                 if (pos + 2 + pos[1] > end)
 192                         break;
 193
 194                 switch (*pos) {
 195                 case PAC_OPAQUE_TYPE_PAD:
 196                         pos = end;
 197                         break;
 198                 case PAC_OPAQUE_TYPE_KEY:
 199                         if (pos[1] != EAP_FAST_PAC_KEY_LEN) {
 200                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Invalid "
 201                                            "PAC-Key length %d", pos[1]);
 202                                 os_free(buf);
 203                                 return -1;
 204                         }
 205                         pac_key = pos + 2;
 206                         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: PAC-Key from "
 207                                         "decrypted PAC-Opaque",
 208                                         pac_key, EAP_FAST_PAC_KEY_LEN);
 209                         break;
 210                 case PAC_OPAQUE_TYPE_LIFETIME:
 211                         if (pos[1] != 4) {
 212                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Invalid "
 213                                            "PAC-Key lifetime length %d",
 214                                            pos[1]);
 215                                 os_free(buf);
 216                                 return -1;
 217                         }
 218                         lifetime = WPA_GET_BE32(pos + 2);
 219                         break;
 220                 case PAC_OPAQUE_TYPE_IDENTITY:
 221                         identity = pos + 2;
 222                         identity_len = pos[1];
 223                         break;
 224                 }
 225
 226                 pos += 2 + pos[1];
 227         }
 228
 229         if (pac_key == NULL) {
 230                 wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC-Key included in "
 231                            "PAC-Opaque");
 232                 os_free(buf);
 233                 return -1;
 234         }
 235
 236         if (identity) {
 237                 wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: Identity from "
 238                                   "PAC-Opaque", identity, identity_len);
 239                 os_free(data->identity);
 240                 data->identity = os_malloc(identity_len);
 241                 if (data->identity) {
 242                         os_memcpy(data->identity, identity, identity_len);
 243                         data->identity_len = identity_len;
 244                 }
 245         }
 246
 247         if (os_get_time(&now) < 0 || lifetime <= 0 || now.sec > lifetime) {
 248                 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Key not valid anymore "
 249                            "(lifetime=%ld now=%ld)", lifetime, now.sec);
 250                 os_free(buf);
 251                 return 0;
 252         }
 253
 254         if (lifetime - now.sec < PAC_KEY_REFRESH_TIME)
 255                 data->send_new_pac = 1;
 256
 257         eap_fast_derive_master_secret(pac_key, server_random, client_random,
 258                                       master_secret);
 259
 260         os_free(buf);
 261
 262         return 1;
 263 }
 264
 265
 266 static void eap_fast_derive_key_auth(struct eap_sm *sm,
 267                                      struct eap_fast_data *data)
 268 {
 269         u8 *sks;
 270
 271         /* RFC 4851, Section 5.1:
 272          * Extra key material after TLS key_block: session_key_seed[40]
 273          */
 274
 275         sks = eap_fast_derive_key(sm->ssl_ctx, data->ssl.conn, "key expansion",
 276                                   EAP_FAST_SKS_LEN);
 277         if (sks == NULL) {
 278                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to derive "
 279                            "session_key_seed");
 280                 return;
 281         }
 282
 283         /*
 284          * RFC 4851, Section 5.2:
 285          * S-IMCK[0] = session_key_seed
 286          */
 287         wpa_hexdump_key(MSG_DEBUG,
 288                         "EAP-FAST: session_key_seed (SKS = S-IMCK[0])",
 289                         sks, EAP_FAST_SKS_LEN);
 290         data->simck_idx = 0;
 291         os_memcpy(data->simck, sks, EAP_FAST_SIMCK_LEN);
 292         os_free(sks);
 293 }
 294
 295
 296 static void eap_fast_derive_key_provisioning(struct eap_sm *sm,
 297                                              struct eap_fast_data *data)
 298 {
 299         os_free(data->key_block_p);
 300         data->key_block_p = (struct eap_fast_key_block_provisioning *)
 301                 eap_fast_derive_key(sm->ssl_ctx, data->ssl.conn,
 302                                     "key expansion",
 303                                     sizeof(*data->key_block_p));
 304         if (data->key_block_p == NULL) {
 305                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to derive key block");
 306                 return;
 307         }
 308         /*
 309          * RFC 4851, Section 5.2:
 310          * S-IMCK[0] = session_key_seed
 311          */
 312         wpa_hexdump_key(MSG_DEBUG,
 313                         "EAP-FAST: session_key_seed (SKS = S-IMCK[0])",
 314                         data->key_block_p->session_key_seed,
 315                         sizeof(data->key_block_p->session_key_seed));
 316         data->simck_idx = 0;
 317         os_memcpy(data->simck, data->key_block_p->session_key_seed,
 318                   EAP_FAST_SIMCK_LEN);
 319         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: server_challenge",
 320                         data->key_block_p->server_challenge,
 321                         sizeof(data->key_block_p->server_challenge));
 322         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: client_challenge",
 323                         data->key_block_p->client_challenge,
 324                         sizeof(data->key_block_p->client_challenge));
 325 }
 326
 327
 328 static int eap_fast_get_phase2_key(struct eap_sm *sm,
 329                                    struct eap_fast_data *data,
 330                                    u8 *isk, size_t isk_len)
 331 {
 332         u8 *key;
 333         size_t key_len;
 334
 335         os_memset(isk, 0, isk_len);
 336
 337         if (data->phase2_method == NULL || data->phase2_priv == NULL) {
 338                 wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 method not "
 339                            "available");
 340                 return -1;
 341         }
 342
 343         if (data->phase2_method->getKey == NULL)
 344                 return 0;
 345
 346         if ((key = data->phase2_method->getKey(sm, data->phase2_priv,
 347                                                &key_len)) == NULL) {
 348                 wpa_printf(MSG_DEBUG, "EAP-FAST: Could not get key material "
 349                            "from Phase 2");
 350                 return -1;
 351         }
 352
 353         if (key_len > isk_len)
 354                 key_len = isk_len;
 355         os_memcpy(isk, key, key_len);
 356         os_free(key);
 357
 358         return 0;
 359 }
 360
 361
 362 static int eap_fast_update_icmk(struct eap_sm *sm, struct eap_fast_data *data)
 363 {
 364         u8 isk[32], imck[60];
 365
 366         wpa_printf(MSG_DEBUG, "EAP-FAST: Deriving ICMK[%d] (S-IMCK and CMK)",
 367                    data->simck_idx + 1);
 368
 369         /*
 370          * RFC 4851, Section 5.2:
 371          * IMCK[j] = T-PRF(S-IMCK[j-1], "Inner Methods Compound Keys",
 372          *                 MSK[j], 60)
 373          * S-IMCK[j] = first 40 octets of IMCK[j]
 374          * CMK[j] = last 20 octets of IMCK[j]
 375          */
 376
 377         if (eap_fast_get_phase2_key(sm, data, isk, sizeof(isk)) < 0)
 378                 return -1;
 379         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: ISK[j]", isk, sizeof(isk));
 380         sha1_t_prf(data->simck, EAP_FAST_SIMCK_LEN,
 381                    "Inner Methods Compound Keys",
 382                    isk, sizeof(isk), imck, sizeof(imck));
 383         data->simck_idx++;
 384         os_memcpy(data->simck, imck, EAP_FAST_SIMCK_LEN);
 385         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: S-IMCK[j]",
 386                         data->simck, EAP_FAST_SIMCK_LEN);
 387         os_memcpy(data->cmk, imck + EAP_FAST_SIMCK_LEN, EAP_FAST_CMK_LEN);
 388         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: CMK[j]",
 389                         data->cmk, EAP_FAST_CMK_LEN);
 390
 391         return 0;
 392 }
 393
 394
 395 static void * eap_fast_init(struct eap_sm *sm)
 396 {
 397         struct eap_fast_data *data;
 398         u8 ciphers[5] = {
 399                 TLS_CIPHER_ANON_DH_AES128_SHA,
 400                 TLS_CIPHER_AES128_SHA,
 401                 TLS_CIPHER_RSA_DHE_AES128_SHA,
 402                 TLS_CIPHER_RC4_SHA,
 403                 TLS_CIPHER_NONE
 404         };
 405
 406         data = os_zalloc(sizeof(*data));
 407         if (data == NULL)
 408                 return NULL;
 409         data->fast_version = EAP_FAST_VERSION;
 410         data->force_version = -1;
 411         if (sm->user && sm->user->force_version >= 0) {
 412                 data->force_version = sm->user->force_version;
 413                 wpa_printf(MSG_DEBUG, "EAP-FAST: forcing version %d",
 414                            data->force_version);
 415                 data->fast_version = data->force_version;
 416         }
 417         data->state = START;
 418
 419         if (eap_server_tls_ssl_init(sm, &data->ssl, 0)) {
 420                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to initialize SSL.");
 421                 eap_fast_reset(sm, data);
 422                 return NULL;
 423         }
 424
 425         if (tls_connection_set_cipher_list(sm->ssl_ctx, data->ssl.conn,
 426                                            ciphers) < 0) {
 427                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to set TLS cipher "
 428                            "suites");
 429                 eap_fast_reset(sm, data);
 430                 return NULL;
 431         }
 432
 433         if (tls_connection_set_session_ticket_cb(sm->ssl_ctx, data->ssl.conn,
 434                                                  eap_fast_session_ticket_cb,
 435                                                  data) < 0) {
 436                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to set SessionTicket "
 437                            "callback");
 438                 eap_fast_reset(sm, data);
 439                 return NULL;
 440         }
 441
 442         if (sm->pac_opaque_encr_key == NULL) {
 443                 wpa_printf(MSG_INFO, "EAP-FAST: No PAC-Opaque encryption key "
 444                            "configured");
 445                 eap_fast_reset(sm, data);
 446                 return NULL;
 447         }
 448         os_memcpy(data->pac_opaque_encr, sm->pac_opaque_encr_key,
 449                   sizeof(data->pac_opaque_encr));
 450
 451         if (sm->eap_fast_a_id == NULL) {
 452                 wpa_printf(MSG_INFO, "EAP-FAST: No A-ID configured");
 453                 eap_fast_reset(sm, data);
 454                 return NULL;
 455         }
 456         data->srv_id = os_strdup(sm->eap_fast_a_id);
 457         if (data->srv_id == NULL) {
 458                 eap_fast_reset(sm, data);
 459                 return NULL;
 460         }
 461
 462         return data;
 463 }
 464
 465
 466 static void eap_fast_reset(struct eap_sm *sm, void *priv)
 467 {
 468         struct eap_fast_data *data = priv;
 469         if (data == NULL)
 470                 return;
 471         if (data->phase2_priv && data->phase2_method)
 472                 data->phase2_method->reset(sm, data->phase2_priv);
 473         eap_server_tls_ssl_deinit(sm, &data->ssl);
 474         os_free(data->srv_id);
 475         os_free(data->key_block_p);
 476         wpabuf_free(data->pending_phase2_resp);
 477         os_free(data->identity);
 478         os_free(data);
 479 }
 480
 481
 482 static struct wpabuf * eap_fast_build_start(struct eap_sm *sm,
 483                                             struct eap_fast_data *data, u8 id)
 484 {
 485         struct wpabuf *req;
 486         size_t srv_id_len = os_strlen(data->srv_id);
 487
 488         req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_FAST,
 489                             1 + sizeof(struct pac_tlv_hdr) + srv_id_len,
 490                             EAP_CODE_REQUEST, id);
 491         if (req == NULL) {
 492                 wpa_printf(MSG_ERROR, "EAP-FAST: Failed to allocate memory for"
 493                            " request");
 494                 eap_fast_state(data, FAILURE);
 495                 return NULL;
 496         }
 497
 498         wpabuf_put_u8(req, EAP_TLS_FLAGS_START | data->fast_version);
 499
 500         /* RFC 4851, 4.1.1. Authority ID Data */
 501         eap_fast_put_tlv(req, PAC_TYPE_A_ID, data->srv_id, srv_id_len);
 502
 503         eap_fast_state(data, PHASE1);
 504
 505         return req;
 506 }
 507
 508
 509 static int eap_fast_phase1_done(struct eap_sm *sm, struct eap_fast_data *data)
 510 {
 511         char cipher[64];
 512
 513         wpa_printf(MSG_DEBUG, "EAP-FAST: Phase1 done, starting Phase2");
 514
 515         if (tls_get_cipher(sm->ssl_ctx, data->ssl.conn, cipher, sizeof(cipher))
 516             < 0) {
 517                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to get cipher "
 518                            "information");
 519                 eap_fast_state(data, FAILURE);
 520                 return -1;
 521         }
 522         data->anon_provisioning = os_strstr(cipher, "ADH") != NULL;
 523
 524         if (data->anon_provisioning) {
 525                 wpa_printf(MSG_DEBUG, "EAP-FAST: Anonymous provisioning");
 526                 eap_fast_derive_key_provisioning(sm, data);
 527         } else
 528                 eap_fast_derive_key_auth(sm, data);
 529
 530         eap_fast_state(data, PHASE2_START);
 531
 532         return 0;
 533 }
 534
 535
 536 static struct wpabuf * eap_fast_build_req(struct eap_sm *sm,
 537                                           struct eap_fast_data *data, u8 id)
 538 {
 539         int res;
 540         struct wpabuf *req;
 541
 542         res = eap_server_tls_buildReq_helper(sm, &data->ssl, EAP_TYPE_FAST,
 543                                              data->fast_version, id, &req);
 544
 545         if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) {
 546                 if (eap_fast_phase1_done(sm, data) < 0) {
 547                         os_free(req);
 548                         return NULL;
 549                 }
 550         }
 551
 552         if (res == 1)
 553                 return eap_server_tls_build_ack(id, EAP_TYPE_FAST,
 554                                                 data->fast_version);
 555         return req;
 556 }
 557
 558
 559 static struct wpabuf * eap_fast_encrypt(struct eap_sm *sm,
 560                                         struct eap_fast_data *data,
 561                                         u8 id, u8 *plain, size_t plain_len)
 562 {
 563         int res;
 564         struct wpabuf *buf;
 565
 566         /* TODO: add support for fragmentation, if needed. This will need to
 567          * add TLS Message Length field, if the frame is fragmented. */
 568         buf = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_FAST,
 569                             1 + data->ssl.tls_out_limit,
 570                             EAP_CODE_REQUEST, id);
 571         if (buf == NULL)
 572                 return NULL;
 573
 574         wpabuf_put_u8(buf, data->fast_version);
 575
 576         res = tls_connection_encrypt(sm->ssl_ctx, data->ssl.conn,
 577                                      plain, plain_len, wpabuf_put(buf, 0),
 578                                      data->ssl.tls_out_limit);
 579         if (res < 0) {
 580                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to encrypt Phase 2 "
 581                            "data");
 582                 wpabuf_free(buf);
 583                 return NULL;
 584         }
 585
 586         wpabuf_put(buf, res);
 587         eap_update_len(buf);
 588
 589         return buf;
 590 }
 591
 592
 593 static struct wpabuf * eap_fast_build_phase2_req(struct eap_sm *sm,
 594                                                  struct eap_fast_data *data,
 595                                                  u8 id)
 596 {
 597         struct wpabuf *req;
 598
 599         if (data->phase2_priv == NULL) {
 600                 wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 method not "
 601                            "initialized");
 602                 return NULL;
 603         }
 604         req = data->phase2_method->buildReq(sm, data->phase2_priv, id);
 605         if (req == NULL)
 606                 return NULL;
 607
 608         wpa_hexdump_buf_key(MSG_MSGDUMP, "EAP-FAST: Phase 2 EAP-Request", req);
 609         return eap_fast_tlv_eap_payload(req);
 610 }
 611
 612
 613 static struct wpabuf * eap_fast_build_crypto_binding(
 614         struct eap_sm *sm, struct eap_fast_data *data)
 615 {
 616         struct wpabuf *buf;
 617         struct eap_tlv_result_tlv *result;
 618         struct eap_tlv_crypto_binding_tlv *binding;
 619
 620         buf = wpabuf_alloc(2 * sizeof(*result) + sizeof(*binding));
 621         if (buf == NULL)
 622                 return NULL;
 623
 624         if (data->send_new_pac || data->anon_provisioning ||
 625             data->phase2_method)
 626                 data->final_result = 0;
 627         else
 628                 data->final_result = 1;
 629
 630         if (!data->final_result || data->eap_seq > 1) {
 631                 /* Intermediate-Result */
 632                 wpa_printf(MSG_DEBUG, "EAP-FAST: Add Intermediate-Result TLV "
 633                            "(status=SUCCESS)");
 634                 result = wpabuf_put(buf, sizeof(*result));
 635                 result->tlv_type = host_to_be16(
 636                         EAP_TLV_TYPE_MANDATORY |
 637                         EAP_TLV_INTERMEDIATE_RESULT_TLV);
 638                 result->length = host_to_be16(2);
 639                 result->status = host_to_be16(EAP_TLV_RESULT_SUCCESS);
 640         }
 641
 642         if (data->final_result) {
 643                 /* Result TLV */
 644                 wpa_printf(MSG_DEBUG, "EAP-FAST: Add Result TLV "
 645                            "(status=SUCCESS)");
 646                 result = wpabuf_put(buf, sizeof(*result));
 647                 result->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
 648                                                 EAP_TLV_RESULT_TLV);
 649                 result->length = host_to_be16(2);
 650                 result->status = host_to_be16(EAP_TLV_RESULT_SUCCESS);
 651         }
 652
 653         /* Crypto-Binding TLV */
 654         binding = wpabuf_put(buf, sizeof(*binding));
 655         binding->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
 656                                          EAP_TLV_CRYPTO_BINDING_TLV);
 657         binding->length = host_to_be16(sizeof(*binding) -
 658                                        sizeof(struct eap_tlv_hdr));
 659         binding->version = EAP_FAST_VERSION;
 660         binding->received_version = data->peer_version;
 661         binding->subtype = EAP_TLV_CRYPTO_BINDING_SUBTYPE_REQUEST;
 662         if (os_get_random(binding->nonce, sizeof(binding->nonce)) < 0) {
 663                 wpabuf_free(buf);
 664                 return NULL;
 665         }
 666
 667         /*
 668          * RFC 4851, Section 4.2.8:
 669          * The nonce in a request MUST have its least significant bit set to 0.
 670          */
 671         binding->nonce[sizeof(binding->nonce) - 1] &= ~0x01;
 672
 673         os_memcpy(data->crypto_binding_nonce, binding->nonce,
 674                   sizeof(binding->nonce));
 675
 676         /*
 677          * RFC 4851, Section 5.3:
 678          * CMK = CMK[j]
 679          * Compound-MAC = HMAC-SHA1( CMK, Crypto-Binding TLV )
 680          */
 681
 682         hmac_sha1(data->cmk, EAP_FAST_CMK_LEN,
 683                   (u8 *) binding, sizeof(*binding),
 684                   binding->compound_mac);
 685
 686         wpa_printf(MSG_DEBUG, "EAP-FAST: Add Crypto-Binding TLV: Version %d "
 687                    "Received Version %d SubType %d",
 688                    binding->version, binding->received_version,
 689                    binding->subtype);
 690         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: NONCE",
 691                     binding->nonce, sizeof(binding->nonce));
 692         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Compound MAC",
 693                     binding->compound_mac, sizeof(binding->compound_mac));
 694
 695         return buf;
 696 }
 697
 698
 699 static struct wpabuf * eap_fast_build_pac(struct eap_sm *sm,
 700                                           struct eap_fast_data *data)
 701 {
 702         u8 pac_key[EAP_FAST_PAC_KEY_LEN];
 703         u8 *pac_buf, *pac_opaque;
 704         struct wpabuf *buf;
 705         u8 *pos;
 706         size_t buf_len, srv_id_len, pac_len;
 707         struct eap_tlv_hdr *pac_tlv;
 708         struct pac_tlv_hdr *pac_info;
 709         struct eap_tlv_result_tlv *result;
 710         struct os_time now;
 711
 712         if (os_get_random(pac_key, EAP_FAST_PAC_KEY_LEN) < 0 ||
 713             os_get_time(&now) < 0)
 714                 return NULL;
 715         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Generated PAC-Key",
 716                         pac_key, EAP_FAST_PAC_KEY_LEN);
 717
 718         pac_len = (2 + EAP_FAST_PAC_KEY_LEN) + (2 + 4) +
 719                 (2 + sm->identity_len) + 8;
 720         pac_buf = os_malloc(pac_len);
 721         if (pac_buf == NULL)
 722                 return NULL;
 723
 724         srv_id_len = os_strlen(data->srv_id);
 725
 726         pos = pac_buf;
 727         *pos++ = PAC_OPAQUE_TYPE_KEY;
 728         *pos++ = EAP_FAST_PAC_KEY_LEN;
 729         os_memcpy(pos, pac_key, EAP_FAST_PAC_KEY_LEN);
 730         pos += EAP_FAST_PAC_KEY_LEN;
 731
 732         *pos++ = PAC_OPAQUE_TYPE_LIFETIME;
 733         *pos++ = 4;
 734         WPA_PUT_BE32(pos, now.sec + PAC_KEY_LIFETIME);
 735         pos += 4;
 736
 737         if (sm->identity) {
 738                 *pos++ = PAC_OPAQUE_TYPE_IDENTITY;
 739                 *pos++ = sm->identity_len;
 740                 os_memcpy(pos, sm->identity, sm->identity_len);
 741                 pos += sm->identity_len;
 742         }
 743
 744         pac_len = pos - pac_buf;
 745         if (pac_len % 8) {
 746                 *pos++ = PAC_OPAQUE_TYPE_PAD;
 747                 pac_len++;
 748         }
 749
 750         pac_opaque = os_malloc(pac_len + 8);
 751         if (pac_opaque == NULL) {
 752                 os_free(pac_buf);
 753                 return NULL;
 754         }
 755         if (aes_wrap(data->pac_opaque_encr, pac_len / 8, pac_buf,
 756                      pac_opaque) < 0) {
 757                 os_free(pac_buf);
 758                 os_free(pac_opaque);
 759                 return NULL;
 760         }
 761         os_free(pac_buf);
 762
 763         pac_len += 8;
 764         wpa_hexdump(MSG_DEBUG, "EAP-FAST: PAC-Opaque",
 765                     pac_opaque, pac_len);
 766
 767         buf_len = sizeof(*pac_tlv) +
 768                 sizeof(struct pac_tlv_hdr) + EAP_FAST_PAC_KEY_LEN +
 769                 sizeof(struct pac_tlv_hdr) + pac_len +
 770                 2 * srv_id_len + 100 + sizeof(*result);
 771         buf = wpabuf_alloc(buf_len);
 772         if (buf == NULL) {
 773                 os_free(pac_opaque);
 774                 return NULL;
 775         }
 776
 777         /* PAC TLV */
 778         wpa_printf(MSG_DEBUG, "EAP-FAST: Add PAC TLV");
 779         pac_tlv = wpabuf_put(buf, sizeof(*pac_tlv));
 780         pac_tlv->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
 781                                          EAP_TLV_PAC_TLV);
 782
 783         /* PAC-Key */
 784         eap_fast_put_tlv(buf, PAC_TYPE_PAC_KEY, pac_key, EAP_FAST_PAC_KEY_LEN);
 785
 786         /* PAC-Opaque */
 787         eap_fast_put_tlv(buf, PAC_TYPE_PAC_OPAQUE, pac_opaque, pac_len);
 788         os_free(pac_opaque);
 789
 790         /* PAC-Info */
 791         pac_info = wpabuf_put(buf, sizeof(*pac_info));
 792         pac_info->type = host_to_be16(PAC_TYPE_PAC_INFO);
 793
 794         /* PAC-Lifetime (inside PAC-Info) */
 795         eap_fast_put_tlv_hdr(buf, PAC_TYPE_CRED_LIFETIME, 4);
 796         wpabuf_put_be32(buf, now.sec + PAC_KEY_LIFETIME);
 797
 798         /* A-ID (inside PAC-Info) */
 799         eap_fast_put_tlv(buf, PAC_TYPE_A_ID, data->srv_id, srv_id_len);
 800
 801         /* Note: headers may be misaligned after A-ID */
 802
 803         /* A-ID-Info (inside PAC-Info) */
 804         eap_fast_put_tlv(buf, PAC_TYPE_A_ID_INFO, data->srv_id, srv_id_len);
 805
 806         /* PAC-Type (inside PAC-Info) */
 807         eap_fast_put_tlv_hdr(buf, PAC_TYPE_PAC_TYPE, 2);
 808         wpabuf_put_be16(buf, PAC_TYPE_TUNNEL_PAC);
 809
 810         /* Update PAC-Info and PAC TLV Length fields */
 811         pos = wpabuf_put(buf, 0);
 812         pac_info->len = host_to_be16(pos - (u8 *) (pac_info + 1));
 813         pac_tlv->length = host_to_be16(pos - (u8 *) (pac_tlv + 1));
 814
 815         /* Result TLV */
 816         wpa_printf(MSG_DEBUG, "EAP-FAST: Add Result TLV (status=SUCCESS)");
 817         result = wpabuf_put(buf, sizeof(*result));
 818         WPA_PUT_BE16((u8 *) &result->tlv_type,
 819                      EAP_TLV_TYPE_MANDATORY | EAP_TLV_RESULT_TLV);
 820         WPA_PUT_BE16((u8 *) &result->length, 2);
 821         WPA_PUT_BE16((u8 *) &result->status, EAP_TLV_RESULT_SUCCESS);
 822
 823         return buf;
 824 }
 825
 826
 827 static struct wpabuf * eap_fast_buildReq(struct eap_sm *sm, void *priv, u8 id)
 828 {
 829         struct eap_fast_data *data = priv;
 830         struct wpabuf *req;
 831         struct wpabuf *encr;
 832
 833         if (data->state == START)
 834                 return eap_fast_build_start(sm, data, id);
 835
 836         if (data->state == PHASE1)
 837                 return eap_fast_build_req(sm, data, id);
 838
 839         switch (data->state) {
 840         case PHASE2_ID:
 841         case PHASE2_METHOD:
 842                 req = eap_fast_build_phase2_req(sm, data, id);
 843                 break;
 844         case CRYPTO_BINDING:
 845                 req = eap_fast_build_crypto_binding(sm, data);
 846                 if (data->phase2_method) {
 847                         /*
 848                          * Include the start of the next EAP method in the
 849                          * sequence in the same message with Crypto-Binding to
 850                          * save a round-trip.
 851                          */
 852                         struct wpabuf *eap;
 853                         eap = eap_fast_build_phase2_req(sm, data, id);
 854                         req = wpabuf_concat(req, eap);
 855                         eap_fast_state(data, PHASE2_METHOD);
 856                 }
 857                 break;
 858         case REQUEST_PAC:
 859                 req = eap_fast_build_pac(sm, data);
 860                 break;
 861         default:
 862                 wpa_printf(MSG_DEBUG, "EAP-FAST: %s - unexpected state %d",
 863                            __func__, data->state);
 864                 return NULL;
 865         }
 866
 867         if (req == NULL)
 868                 return NULL;
 869
 870         wpa_hexdump_buf_key(MSG_DEBUG, "EAP-FAST: Encrypting Phase 2 TLVs",
 871                             req);
 872         encr = eap_fast_encrypt(sm, data, id, wpabuf_mhead(req),
 873                                 wpabuf_len(req));
 874         wpabuf_free(req);
 875
 876         return encr;
 877 }
 878
 879
 880 static Boolean eap_fast_check(struct eap_sm *sm, void *priv,
 881                               struct wpabuf *respData)
 882 {
 883         const u8 *pos;
 884         size_t len;
 885
 886         pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_FAST, respData, &len);
 887         if (pos == NULL || len < 1) {
 888                 wpa_printf(MSG_INFO, "EAP-FAST: Invalid frame");
 889                 return TRUE;
 890         }
 891
 892         return FALSE;
 893 }
 894
 895
 896 static int eap_fast_phase2_init(struct eap_sm *sm, struct eap_fast_data *data,
 897                                 EapType eap_type)
 898 {
 899         if (data->phase2_priv && data->phase2_method) {
 900                 data->phase2_method->reset(sm, data->phase2_priv);
 901                 data->phase2_method = NULL;
 902                 data->phase2_priv = NULL;
 903         }
 904         data->phase2_method = eap_server_get_eap_method(EAP_VENDOR_IETF,
 905                                                         eap_type);
 906         if (!data->phase2_method)
 907                 return -1;
 908
 909         if (data->key_block_p) {
 910                 sm->auth_challenge = data->key_block_p->server_challenge;
 911                 sm->peer_challenge = data->key_block_p->client_challenge;
 912         }
 913         sm->init_phase2 = 1;
 914         data->phase2_priv = data->phase2_method->init(sm);
 915         sm->init_phase2 = 0;
 916         sm->auth_challenge = NULL;
 917         sm->peer_challenge = NULL;
 918
 919         return data->phase2_priv == NULL ? -1 : 0;
 920 }
 921
 922
 923 static void eap_fast_process_phase2_response(struct eap_sm *sm,
 924                                              struct eap_fast_data *data,
 925                                              u8 *in_data, size_t in_len)
 926 {
 927         u8 next_type = EAP_TYPE_NONE;
 928         struct eap_hdr *hdr;
 929         u8 *pos;
 930         size_t left;
 931         struct wpabuf buf;
 932         const struct eap_method *m = data->phase2_method;
 933         void *priv = data->phase2_priv;
 934
 935         if (priv == NULL) {
 936                 wpa_printf(MSG_DEBUG, "EAP-FAST: %s - Phase2 not "
 937                            "initialized?!", __func__);
 938                 return;
 939         }
 940
 941         hdr = (struct eap_hdr *) in_data;
 942         pos = (u8 *) (hdr + 1);
 943
 944         if (in_len > sizeof(*hdr) && *pos == EAP_TYPE_NAK) {
 945                 left = in_len - sizeof(*hdr);
 946                 wpa_hexdump(MSG_DEBUG, "EAP-FAST: Phase2 type Nak'ed; "
 947                             "allowed types", pos + 1, left - 1);
 948 #ifdef EAP_TNC
 949                 if (m && m->vendor == EAP_VENDOR_IETF &&
 950                     m->method == EAP_TYPE_TNC) {
 951                         wpa_printf(MSG_DEBUG, "EAP-FAST: Peer Nak'ed required "
 952                                    "TNC negotiation");
 953                         next_type = eap_fast_req_failure(sm, data);
 954                         eap_fast_phase2_init(sm, data, next_type);
 955                         return;
 956                 }
 957 #endif /* EAP_TNC */
 958                 eap_sm_process_nak(sm, pos + 1, left - 1);
 959                 if (sm->user && sm->user_eap_method_index < EAP_MAX_METHODS &&
 960                     sm->user->methods[sm->user_eap_method_index].method !=
 961                     EAP_TYPE_NONE) {
 962                         next_type = sm->user->methods[
 963                                 sm->user_eap_method_index++].method;
 964                         wpa_printf(MSG_DEBUG, "EAP-FAST: try EAP type %d",
 965                                    next_type);
 966                 } else {
 967                         next_type = eap_fast_req_failure(sm, data);
 968                 }
 969                 eap_fast_phase2_init(sm, data, next_type);
 970                 return;
 971         }
 972
 973         wpabuf_set(&buf, in_data, in_len);
 974
 975         if (m->check(sm, priv, &buf)) {
 976                 wpa_printf(MSG_DEBUG, "EAP-FAST: Phase2 check() asked to "
 977                            "ignore the packet");
 978                 next_type = eap_fast_req_failure(sm, data);
 979                 return;
 980         }
 981
 982         m->process(sm, priv, &buf);
 983
 984         if (!m->isDone(sm, priv))
 985                 return;
 986
 987         if (!m->isSuccess(sm, priv)) {
 988                 wpa_printf(MSG_DEBUG, "EAP-FAST: Phase2 method failed");
 989                 next_type = eap_fast_req_failure(sm, data);
 990                 eap_fast_phase2_init(sm, data, next_type);
 991                 return;
 992         }
 993
 994         switch (data->state) {
 995         case PHASE2_ID:
 996                 if (eap_user_get(sm, sm->identity, sm->identity_len, 1) != 0) {
 997                         wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: Phase2 "
 998                                           "Identity not found in the user "
 999                                           "database",
1000                                           sm->identity, sm->identity_len);
1001                         next_type = eap_fast_req_failure(sm, data);
1002                         break;
1003                 }
1004
1005                 eap_fast_state(data, PHASE2_METHOD);
1006                 if (data->anon_provisioning) {
1007                         /*
1008                          * Only EAP-MSCHAPv2 is allowed for anonymous
1009                          * provisioning.
1010                          */
1011                         next_type = EAP_TYPE_MSCHAPV2;
1012                         sm->user_eap_method_index = 0;
1013                 } else {
1014                         next_type = sm->user->methods[0].method;
1015                         sm->user_eap_method_index = 1;
1016                 }
1017                 wpa_printf(MSG_DEBUG, "EAP-FAST: try EAP type %d", next_type);
1018                 break;
1019         case PHASE2_METHOD:
1020         case CRYPTO_BINDING:
1021                 eap_fast_update_icmk(sm, data);
1022                 eap_fast_state(data, CRYPTO_BINDING);
1023                 data->eap_seq++;
1024                 next_type = EAP_TYPE_NONE;
1025 #ifdef EAP_TNC
1026                 if (sm->tnc && !data->tnc_started) {
1027                         wpa_printf(MSG_DEBUG, "EAP-FAST: Initialize TNC");
1028                         next_type = EAP_TYPE_TNC;
1029                         data->tnc_started = 1;
1030                 }
1031 #endif /* EAP_TNC */
1032                 break;
1033         case FAILURE:
1034                 break;
1035         default:
1036                 wpa_printf(MSG_DEBUG, "EAP-FAST: %s - unexpected state %d",
1037                            __func__, data->state);
1038                 break;
1039         }
1040
1041         eap_fast_phase2_init(sm, data, next_type);
1042 }
1043
1044
1045 static void eap_fast_process_phase2_eap(struct eap_sm *sm,
1046                                         struct eap_fast_data *data,
1047                                         u8 *in_data, size_t in_len)
1048 {
1049         struct eap_hdr *hdr;
1050         size_t len;
1051
1052         hdr = (struct eap_hdr *) in_data;
1053         if (in_len < (int) sizeof(*hdr)) {
1054                 wpa_printf(MSG_INFO, "EAP-FAST: Too short Phase 2 "
1055                            "EAP frame (len=%d)", in_len);
1056                 eap_fast_req_failure(sm, data);
1057                 return;
1058         }
1059         len = be_to_host16(hdr->length);
1060         if (len > in_len) {
1061                 wpa_printf(MSG_INFO, "EAP-FAST: Length mismatch in "
1062                            "Phase 2 EAP frame (len=%d hdr->length=%d)",
1063                            in_len, len);
1064                 eap_fast_req_failure(sm, data);
1065                 return;
1066         }
1067         wpa_printf(MSG_DEBUG, "EAP-FAST: Received Phase 2: code=%d "
1068                    "identifier=%d length=%d", hdr->code, hdr->identifier, len);
1069         switch (hdr->code) {
1070         case EAP_CODE_RESPONSE:
1071                 eap_fast_process_phase2_response(sm, data, (u8 *) hdr, len);
1072                 break;
1073         default:
1074                 wpa_printf(MSG_INFO, "EAP-FAST: Unexpected code=%d in "
1075                            "Phase 2 EAP header", hdr->code);
1076                 break;
1077         }
1078 }
1079
1080
1081 static int eap_fast_parse_tlvs(u8 *data, size_t data_len,
1082                                struct eap_fast_tlv_parse *tlv)
1083 {
1084         int mandatory, tlv_type, len, res;
1085         u8 *pos, *end;
1086
1087         os_memset(tlv, 0, sizeof(*tlv));
1088
1089         pos = data;
1090         end = data + data_len;
1091         while (pos + 4 < end) {
1092                 mandatory = pos[0] & 0x80;
1093                 tlv_type = WPA_GET_BE16(pos) & 0x3fff;
1094                 pos += 2;
1095                 len = WPA_GET_BE16(pos);
1096                 pos += 2;
1097                 if (pos + len > end) {
1098                         wpa_printf(MSG_INFO, "EAP-FAST: TLV overflow");
1099                         return -1;
1100                 }
1101                 wpa_printf(MSG_DEBUG, "EAP-FAST: Received Phase 2: "
1102                            "TLV type %d length %d%s",
1103                            tlv_type, len, mandatory ? " (mandatory)" : "");
1104
1105                 res = eap_fast_parse_tlv(tlv, tlv_type, pos, len);
1106                 if (res == -2)
1107                         break;
1108                 if (res < 0) {
1109                         if (mandatory) {
1110                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Nak unknown "
1111                                            "mandatory TLV type %d", tlv_type);
1112                                 /* TODO: generate Nak TLV */
1113                                 break;
1114                         } else {
1115                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Ignored "
1116                                            "unknown optional TLV type %d",
1117                                            tlv_type);
1118                         }
1119                 }
1120
1121                 pos += len;
1122         }
1123
1124         return 0;
1125 }
1126
1127
1128 static int eap_fast_validate_crypto_binding(
1129         struct eap_fast_data *data, struct eap_tlv_crypto_binding_tlv *b,
1130         size_t bind_len)
1131 {
1132         u8 cmac[SHA1_MAC_LEN];
1133
1134         wpa_printf(MSG_DEBUG, "EAP-FAST: Reply Crypto-Binding TLV: "
1135                    "Version %d Received Version %d SubType %d",
1136                    b->version, b->received_version, b->subtype);
1137         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: NONCE",
1138                     b->nonce, sizeof(b->nonce));
1139         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Compound MAC",
1140                     b->compound_mac, sizeof(b->compound_mac));
1141
1142         if (b->version != EAP_FAST_VERSION ||
1143             b->received_version != EAP_FAST_VERSION) {
1144                 wpa_printf(MSG_DEBUG, "EAP-FAST: Unexpected version "
1145                            "in Crypto-Binding: version %d "
1146                            "received_version %d", b->version,
1147                            b->received_version);
1148                 return -1;
1149         }
1150
1151         if (b->subtype != EAP_TLV_CRYPTO_BINDING_SUBTYPE_RESPONSE) {
1152                 wpa_printf(MSG_DEBUG, "EAP-FAST: Unexpected subtype in "
1153                            "Crypto-Binding: %d", b->subtype);
1154                 return -1;
1155         }
1156
1157         if (os_memcmp(data->crypto_binding_nonce, b->nonce, 31) != 0 ||
1158             (data->crypto_binding_nonce[31] | 1) != b->nonce[31]) {
1159                 wpa_printf(MSG_DEBUG, "EAP-FAST: Invalid nonce in "
1160                            "Crypto-Binding");
1161                 return -1;
1162         }
1163
1164         os_memcpy(cmac, b->compound_mac, sizeof(cmac));
1165         os_memset(b->compound_mac, 0, sizeof(cmac));
1166         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Crypto-Binding TLV for "
1167                     "Compound MAC calculation",
1168                     (u8 *) b, bind_len);
1169         hmac_sha1(data->cmk, EAP_FAST_CMK_LEN, (u8 *) b, bind_len,
1170                   b->compound_mac);
1171         if (os_memcmp(cmac, b->compound_mac, sizeof(cmac)) != 0) {
1172                 wpa_hexdump(MSG_MSGDUMP,
1173                             "EAP-FAST: Calculated Compound MAC",
1174                             b->compound_mac, sizeof(cmac));
1175                 wpa_printf(MSG_INFO, "EAP-FAST: Compound MAC did not "
1176                            "match");
1177                 return -1;
1178         }
1179
1180         return 0;
1181 }
1182
1183
1184 static int eap_fast_pac_type(u8 *pac, size_t len, u16 type)
1185 {
1186         struct eap_tlv_pac_type_tlv *tlv;
1187
1188         if (pac == NULL || len != sizeof(*tlv))
1189                 return 0;
1190
1191         tlv = (struct eap_tlv_pac_type_tlv *) pac;
1192
1193         return be_to_host16(tlv->tlv_type) == PAC_TYPE_PAC_TYPE &&
1194                 be_to_host16(tlv->length) == 2 &&
1195                 be_to_host16(tlv->pac_type) == type;
1196 }
1197
1198
1199 static void eap_fast_process_phase2_tlvs(struct eap_sm *sm,
1200                                          struct eap_fast_data *data,
1201                                          u8 *in_data, size_t in_len)
1202 {
1203         struct eap_fast_tlv_parse tlv;
1204         int check_crypto_binding = data->state == CRYPTO_BINDING;
1205
1206         if (eap_fast_parse_tlvs(in_data, in_len, &tlv) < 0) {
1207                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to parse received "
1208                            "Phase 2 TLVs");
1209                 return;
1210         }
1211
1212         if (tlv.result == EAP_TLV_RESULT_FAILURE) {
1213                 wpa_printf(MSG_DEBUG, "EAP-FAST: Result TLV indicated "
1214                            "failure");
1215                 eap_fast_state(data, FAILURE);
1216                 return;
1217         }
1218
1219         if (data->state == REQUEST_PAC) {
1220                 u16 type, len, res;
1221                 if (tlv.pac == NULL || tlv.pac_len < 6) {
1222                         wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC "
1223                                    "Acknowledgement received");
1224                         eap_fast_state(data, FAILURE);
1225                         return;
1226                 }
1227
1228                 type = WPA_GET_BE16(tlv.pac);
1229                 len = WPA_GET_BE16(tlv.pac + 2);
1230                 res = WPA_GET_BE16(tlv.pac + 4);
1231
1232                 if (type != PAC_TYPE_PAC_ACKNOWLEDGEMENT || len != 2 ||
1233                     res != EAP_TLV_RESULT_SUCCESS) {
1234                         wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV did not "
1235                                    "contain acknowledgement");
1236                         eap_fast_state(data, FAILURE);
1237                         return;
1238                 }
1239
1240                 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Acknowledgement received "
1241                            "- PAC provisioning succeeded");
1242                 eap_fast_state(data, data->anon_provisioning ?
1243                                FAILURE : SUCCESS);
1244                 return;
1245         }
1246
1247         if (check_crypto_binding) {
1248                 if (tlv.crypto_binding == NULL) {
1249                         wpa_printf(MSG_DEBUG, "EAP-FAST: No Crypto-Binding "
1250                                    "TLV received");
1251                         eap_fast_state(data, FAILURE);
1252                         return;
1253                 }
1254
1255                 if (data->final_result &&
1256                     tlv.result != EAP_TLV_RESULT_SUCCESS) {
1257                         wpa_printf(MSG_DEBUG, "EAP-FAST: Crypto-Binding TLV "
1258                                    "without Success Result");
1259                         eap_fast_state(data, FAILURE);
1260                         return;
1261                 }
1262
1263                 if (!data->final_result &&
1264                     tlv.iresult != EAP_TLV_RESULT_SUCCESS) {
1265                         wpa_printf(MSG_DEBUG, "EAP-FAST: Crypto-Binding TLV "
1266                                    "without intermediate Success Result");
1267                         eap_fast_state(data, FAILURE);
1268                         return;
1269                 }
1270
1271                 if (eap_fast_validate_crypto_binding(data, tlv.crypto_binding,
1272                                                      tlv.crypto_binding_len)) {
1273                         eap_fast_state(data, FAILURE);
1274                         return;
1275                 }
1276
1277                 wpa_printf(MSG_DEBUG, "EAP-FAST: Valid Crypto-Binding TLV "
1278                            "received");
1279                 if (data->final_result) {
1280                         wpa_printf(MSG_DEBUG, "EAP-FAST: Authentication "
1281                                    "completed successfully");
1282                 }
1283
1284                 if (data->anon_provisioning ||
1285                     (tlv.request_action == EAP_TLV_ACTION_PROCESS_TLV &&
1286                      eap_fast_pac_type(tlv.pac, tlv.pac_len,
1287                                        PAC_TYPE_TUNNEL_PAC))) {
1288                         wpa_printf(MSG_DEBUG, "EAP-FAST: Requested a new "
1289                                    "Tunnel PAC");
1290                         eap_fast_state(data, REQUEST_PAC);
1291                 } else if (data->send_new_pac) {
1292                         wpa_printf(MSG_DEBUG, "EAP-FAST: Server triggered "
1293                                    "re-keying of Tunnel PAC");
1294                         eap_fast_state(data, REQUEST_PAC);
1295                 } else if (data->final_result)
1296                         eap_fast_state(data, SUCCESS);
1297         }
1298
1299         if (tlv.eap_payload_tlv) {
1300                 eap_fast_process_phase2_eap(sm, data, tlv.eap_payload_tlv,
1301                                             tlv.eap_payload_tlv_len);
1302         }
1303 }
1304
1305
1306 static void eap_fast_process_phase2(struct eap_sm *sm,
1307                                     struct eap_fast_data *data,
1308                                     const u8 *in_data, size_t in_len)
1309 {
1310         u8 *in_decrypted;
1311         int len_decrypted, res;
1312         size_t buf_len;
1313
1314         wpa_printf(MSG_DEBUG, "EAP-FAST: Received %lu bytes encrypted data for"
1315                    " Phase 2", (unsigned long) in_len);
1316
1317         if (data->pending_phase2_resp) {
1318                 wpa_printf(MSG_DEBUG, "EAP-PEAP: Pending Phase 2 response - "
1319                            "skip decryption and use old data");
1320                 eap_fast_process_phase2_tlvs(
1321                         sm, data, wpabuf_mhead(data->pending_phase2_resp),
1322                         wpabuf_len(data->pending_phase2_resp));
1323                 wpabuf_free(data->pending_phase2_resp);
1324                 data->pending_phase2_resp = NULL;
1325                 return;
1326         }
1327
1328         /* FIX: get rid of const -> non-const typecast */
1329         res = eap_server_tls_data_reassemble(sm, &data->ssl, (u8 **) &in_data,
1330                                              &in_len);
1331         if (res < 0 || res == 1)
1332                 return;
1333
1334         buf_len = in_len;
1335         if (data->ssl.tls_in_total > buf_len)
1336                 buf_len = data->ssl.tls_in_total;
1337         in_decrypted = os_malloc(buf_len);
1338         if (in_decrypted == NULL) {
1339                 os_free(data->ssl.tls_in);
1340                 data->ssl.tls_in = NULL;
1341                 data->ssl.tls_in_len = 0;
1342                 wpa_printf(MSG_WARNING, "EAP-FAST: Failed to allocate memory "
1343                            "for decryption");
1344                 return;
1345         }
1346
1347         len_decrypted = tls_connection_decrypt(sm->ssl_ctx, data->ssl.conn,
1348                                                in_data, in_len,
1349                                                in_decrypted, buf_len);
1350         os_free(data->ssl.tls_in);
1351         data->ssl.tls_in = NULL;
1352         data->ssl.tls_in_len = 0;
1353         if (len_decrypted < 0) {
1354                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to decrypt Phase 2 "
1355                            "data");
1356                 os_free(in_decrypted);
1357                 eap_fast_state(data, FAILURE);
1358                 return;
1359         }
1360
1361         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Decrypted Phase 2 TLVs",
1362                         in_decrypted, len_decrypted);
1363
1364         eap_fast_process_phase2_tlvs(sm, data, in_decrypted, len_decrypted);
1365
1366         if (sm->method_pending == METHOD_PENDING_WAIT) {
1367                 wpa_printf(MSG_DEBUG, "EAP-FAST: Phase2 method is in "
1368                            "pending wait state - save decrypted response");
1369                 wpabuf_free(data->pending_phase2_resp);
1370                 data->pending_phase2_resp = wpabuf_alloc_copy(in_decrypted,
1371                                                               len_decrypted);
1372         }
1373
1374         os_free(in_decrypted);
1375 }
1376
1377
1378 static int eap_fast_process_version(struct eap_fast_data *data,
1379                                     int peer_version)
1380 {
1381         data->peer_version = peer_version;
1382
1383         if (data->force_version >= 0 && peer_version != data->force_version) {
1384                 wpa_printf(MSG_INFO, "EAP-FAST: peer did not select the forced"
1385                            " version (forced=%d peer=%d) - reject",
1386                            data->force_version, peer_version);
1387                 eap_fast_state(data, FAILURE);
1388                 return -1;
1389         }
1390
1391         if (peer_version < data->fast_version) {
1392                 wpa_printf(MSG_DEBUG, "EAP-FAST: peer ver=%d, own ver=%d; "
1393                            "use version %d",
1394                            peer_version, data->fast_version, peer_version);
1395                 data->fast_version = peer_version;
1396         }
1397
1398         return 0;
1399 }
1400
1401
1402 static int eap_fast_process_length(struct eap_fast_data *data,
1403                                    const u8 **pos, size_t *left)
1404 {
1405         u32 tls_msg_len;
1406
1407         if (*left < 4) {
1408                 wpa_printf(MSG_INFO, "EAP-FAST: Short frame with TLS "
1409                            "length");
1410                 eap_fast_state(data, FAILURE);
1411                 return -1;
1412         }
1413
1414         tls_msg_len = WPA_GET_BE32(*pos);
1415         wpa_printf(MSG_DEBUG, "EAP-FAST: TLS Message Length: %d",
1416                    tls_msg_len);
1417
1418         if (data->ssl.tls_in_left == 0) {
1419                 data->ssl.tls_in_total = tls_msg_len;
1420                 data->ssl.tls_in_left = tls_msg_len;
1421                 os_free(data->ssl.tls_in);
1422                 data->ssl.tls_in = NULL;
1423                 data->ssl.tls_in_len = 0;
1424         }
1425
1426         *pos += 4;
1427         *left -= 4;
1428
1429         return 0;
1430 }
1431
1432
1433 static int eap_fast_process_phase1(struct eap_sm *sm,
1434                                    struct eap_fast_data *data,
1435                                    const u8 *pos, size_t left)
1436 {
1437         if (eap_server_tls_process_helper(sm, &data->ssl, pos, left) < 0) {
1438                 wpa_printf(MSG_INFO, "EAP-FAST: TLS processing failed");
1439                 eap_fast_state(data, FAILURE);
1440                 return -1;
1441         }
1442
1443         if (!tls_connection_established(sm->ssl_ctx, data->ssl.conn) ||
1444             data->ssl.tls_out_len > 0)
1445                 return 1;
1446
1447         /*
1448          * Phase 1 was completed with the received message (e.g., when using
1449          * abbreviated handshake), so Phase 2 can be started immediately
1450          * without having to send through an empty message to the peer.
1451          */
1452
1453         return eap_fast_phase1_done(sm, data);
1454 }
1455
1456
1457 static void eap_fast_process_phase2_start(struct eap_sm *sm,
1458                                           struct eap_fast_data *data)
1459 {
1460         u8 next_type;
1461
1462         if (data->identity) {
1463                 os_free(sm->identity);
1464                 sm->identity = data->identity;
1465                 data->identity = NULL;
1466                 sm->identity_len = data->identity_len;
1467                 data->identity_len = 0;
1468                 sm->require_identity_match = 1;
1469                 if (eap_user_get(sm, sm->identity, sm->identity_len, 1) != 0) {
1470                         wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: "
1471                                           "Phase2 Identity not found "
1472                                           "in the user database",
1473                                           sm->identity, sm->identity_len);
1474                         next_type = eap_fast_req_failure(sm, data);
1475                 } else {
1476                         wpa_printf(MSG_DEBUG, "EAP-FAST: Identity already "
1477                                    "known - skip Phase 2 Identity Request");
1478                         next_type = sm->user->methods[0].method;
1479                         sm->user_eap_method_index = 1;
1480                 }
1481
1482                 eap_fast_state(data, PHASE2_METHOD);
1483         } else {
1484                 eap_fast_state(data, PHASE2_ID);
1485                 next_type = EAP_TYPE_IDENTITY;
1486         }
1487
1488         eap_fast_phase2_init(sm, data, next_type);
1489 }
1490
1491
1492 static void eap_fast_process(struct eap_sm *sm, void *priv,
1493                              struct wpabuf *respData)
1494 {
1495         struct eap_fast_data *data = priv;
1496         const u8 *pos;
1497         u8 flags;
1498         size_t left;
1499
1500         pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_FAST, respData,
1501                                &left);
1502         if (pos == NULL || left < 1)
1503                 return;
1504         flags = *pos++;
1505         left--;
1506         wpa_printf(MSG_DEBUG, "EAP-FAST: Received packet(len=%lu) - "
1507                    "Flags 0x%02x", (unsigned long) wpabuf_len(respData),
1508                    flags);
1509
1510         if (eap_fast_process_version(data, flags & EAP_PEAP_VERSION_MASK))
1511                 return;
1512
1513         if ((flags & EAP_TLS_FLAGS_LENGTH_INCLUDED) &&
1514             eap_fast_process_length(data, &pos, &left))
1515                 return;
1516
1517         switch (data->state) {
1518         case PHASE1:
1519                 if (eap_fast_process_phase1(sm, data, pos, left))
1520                         break;
1521
1522                 /* fall through to PHASE2_START */
1523         case PHASE2_START:
1524                 eap_fast_process_phase2_start(sm, data);
1525                 break;
1526         case PHASE2_ID:
1527         case PHASE2_METHOD:
1528         case CRYPTO_BINDING:
1529         case REQUEST_PAC:
1530                 eap_fast_process_phase2(sm, data, pos, left);
1531                 break;
1532         default:
1533                 wpa_printf(MSG_DEBUG, "EAP-FAST: Unexpected state %d in %s",
1534                            data->state, __func__);
1535                 break;
1536         }
1537
1538         if (tls_connection_get_write_alerts(sm->ssl_ctx, data->ssl.conn) > 1) {
1539                 wpa_printf(MSG_INFO, "EAP-FAST: Locally detected fatal error "
1540                            "in TLS processing");
1541                 eap_fast_state(data, FAILURE);
1542         }
1543 }
1544
1545
1546 static Boolean eap_fast_isDone(struct eap_sm *sm, void *priv)
1547 {
1548         struct eap_fast_data *data = priv;
1549         return data->state == SUCCESS || data->state == FAILURE;
1550 }
1551
1552
1553 static u8 * eap_fast_getKey(struct eap_sm *sm, void *priv, size_t *len)
1554 {
1555         struct eap_fast_data *data = priv;
1556         u8 *eapKeyData;
1557
1558         if (data->state != SUCCESS)
1559                 return NULL;
1560
1561         eapKeyData = os_malloc(EAP_FAST_KEY_LEN);
1562         if (eapKeyData == NULL)
1563                 return NULL;
1564
1565         eap_fast_derive_eap_msk(data->simck, eapKeyData);
1566         *len = EAP_FAST_KEY_LEN;
1567
1568         return eapKeyData;
1569 }
1570
1571
1572 static u8 * eap_fast_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
1573 {
1574         struct eap_fast_data *data = priv;
1575         u8 *eapKeyData;
1576
1577         if (data->state != SUCCESS)
1578                 return NULL;
1579
1580         eapKeyData = os_malloc(EAP_EMSK_LEN);
1581         if (eapKeyData == NULL)
1582                 return NULL;
1583
1584         eap_fast_derive_eap_emsk(data->simck, eapKeyData);
1585         *len = EAP_EMSK_LEN;
1586
1587         return eapKeyData;
1588 }
1589
1590
1591 static Boolean eap_fast_isSuccess(struct eap_sm *sm, void *priv)
1592 {
1593         struct eap_fast_data *data = priv;
1594         return data->state == SUCCESS;
1595 }
1596
1597
1598 int eap_server_fast_register(void)
1599 {
1600         struct eap_method *eap;
1601         int ret;
1602
1603         eap = eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION,
1604                                       EAP_VENDOR_IETF, EAP_TYPE_FAST, "FAST");
1605         if (eap == NULL)
1606                 return -1;
1607
1608         eap->init = eap_fast_init;
1609         eap->reset = eap_fast_reset;
1610         eap->buildReq = eap_fast_buildReq;
1611         eap->check = eap_fast_check;
1612         eap->process = eap_fast_process;
1613         eap->isDone = eap_fast_isDone;
1614         eap->getKey = eap_fast_getKey;
1615         eap->get_emsk = eap_fast_get_emsk;
1616         eap->isSuccess = eap_fast_isSuccess;
1617
1618         ret = eap_server_method_register(eap);
1619         if (ret)
1620                 eap_server_method_free(eap);
1621         return ret;
1622 }