xref: /freebsd/contrib/wpa/src/eap_peer/eap_fast.c (revision a90b9d0159070121c221b966469c3e36d912bf82)
1 /*
2  * EAP peer method: EAP-FAST (RFC 4851)
3  * Copyright (c) 2004-2015, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "includes.h"
10 
11 #include "common.h"
12 #include "crypto/tls.h"
13 #include "crypto/sha1.h"
14 #include "eap_common/eap_tlv_common.h"
15 #include "eap_i.h"
16 #include "eap_tls_common.h"
17 #include "eap_config.h"
18 #include "eap_fast_pac.h"
19 
20 #ifdef EAP_FAST_DYNAMIC
21 #include "eap_fast_pac.c"
22 #endif /* EAP_FAST_DYNAMIC */
23 
24 /* TODO:
25  * - test session resumption and enable it if it interoperates
26  * - password change (pending mschapv2 packet; replay decrypted packet)
27  */
28 
29 
30 static void eap_fast_deinit(struct eap_sm *sm, void *priv);
31 
32 
33 struct eap_fast_data {
34 	struct eap_ssl_data ssl;
35 
36 	int fast_version;
37 
38 	const struct eap_method *phase2_method;
39 	void *phase2_priv;
40 	int phase2_success;
41 
42 	struct eap_method_type phase2_type;
43 	struct eap_method_type *phase2_types;
44 	size_t num_phase2_types;
45 	int resuming; /* starting a resumed session */
46 	struct eap_fast_key_block_provisioning *key_block_p;
47 #define EAP_FAST_PROV_UNAUTH 1
48 #define EAP_FAST_PROV_AUTH 2
49 	int provisioning_allowed; /* Allowed PAC provisioning modes */
50 	int provisioning; /* doing PAC provisioning (not the normal auth) */
51 	int anon_provisioning; /* doing anonymous (unauthenticated)
52 				* provisioning */
53 	int session_ticket_used;
54 
55 	u8 key_data[EAP_FAST_KEY_LEN];
56 	u8 *session_id;
57 	size_t id_len;
58 	u8 emsk[EAP_EMSK_LEN];
59 	int success;
60 
61 	struct eap_fast_pac *pac;
62 	struct eap_fast_pac *current_pac;
63 	size_t max_pac_list_len;
64 	int use_pac_binary_format;
65 
66 	u8 simck[EAP_FAST_SIMCK_LEN];
67 	int simck_idx;
68 
69 	struct wpabuf *pending_phase2_req;
70 	struct wpabuf *pending_resp;
71 };
72 
73 
eap_fast_session_ticket_cb(void * ctx,const u8 * ticket,size_t len,const u8 * client_random,const u8 * server_random,u8 * master_secret)74 static int eap_fast_session_ticket_cb(void *ctx, const u8 *ticket, size_t len,
75 				      const u8 *client_random,
76 				      const u8 *server_random,
77 				      u8 *master_secret)
78 {
79 	struct eap_fast_data *data = ctx;
80 
81 	wpa_printf(MSG_DEBUG, "EAP-FAST: SessionTicket callback");
82 
83 	if (client_random == NULL || server_random == NULL ||
84 	    master_secret == NULL) {
85 		wpa_printf(MSG_DEBUG, "EAP-FAST: SessionTicket failed - fall "
86 			   "back to full TLS handshake");
87 		data->session_ticket_used = 0;
88 		if (data->provisioning_allowed) {
89 			wpa_printf(MSG_DEBUG, "EAP-FAST: Try to provision a "
90 				   "new PAC-Key");
91 			data->provisioning = 1;
92 			data->current_pac = NULL;
93 		}
94 		return 0;
95 	}
96 
97 	wpa_hexdump(MSG_DEBUG, "EAP-FAST: SessionTicket", ticket, len);
98 
99 	if (data->current_pac == NULL) {
100 		wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC-Key available for "
101 			   "using SessionTicket");
102 		data->session_ticket_used = 0;
103 		return 0;
104 	}
105 
106 	eap_fast_derive_master_secret(data->current_pac->pac_key,
107 				      server_random, client_random,
108 				      master_secret);
109 
110 	data->session_ticket_used = 1;
111 
112 	return 1;
113 }
114 
115 
eap_fast_parse_phase1(struct eap_fast_data * data,const char * phase1)116 static void eap_fast_parse_phase1(struct eap_fast_data *data,
117 				  const char *phase1)
118 {
119 	const char *pos;
120 
121 	pos = os_strstr(phase1, "fast_provisioning=");
122 	if (pos) {
123 		data->provisioning_allowed = atoi(pos + 18);
124 		wpa_printf(MSG_DEBUG, "EAP-FAST: Automatic PAC provisioning "
125 			   "mode: %d", data->provisioning_allowed);
126 	}
127 
128 	pos = os_strstr(phase1, "fast_max_pac_list_len=");
129 	if (pos) {
130 		data->max_pac_list_len = atoi(pos + 22);
131 		if (data->max_pac_list_len == 0)
132 			data->max_pac_list_len = 1;
133 		wpa_printf(MSG_DEBUG, "EAP-FAST: Maximum PAC list length: %lu",
134 			   (unsigned long) data->max_pac_list_len);
135 	}
136 
137 	pos = os_strstr(phase1, "fast_pac_format=binary");
138 	if (pos) {
139 		data->use_pac_binary_format = 1;
140 		wpa_printf(MSG_DEBUG, "EAP-FAST: Using binary format for PAC "
141 			   "list");
142 	}
143 }
144 
145 
eap_fast_init(struct eap_sm * sm)146 static void * eap_fast_init(struct eap_sm *sm)
147 {
148 	struct eap_fast_data *data;
149 	struct eap_peer_config *config = eap_get_config(sm);
150 
151 	if (config == NULL)
152 		return NULL;
153 
154 	data = os_zalloc(sizeof(*data));
155 	if (data == NULL)
156 		return NULL;
157 	data->fast_version = EAP_FAST_VERSION;
158 	data->max_pac_list_len = 10;
159 
160 	if (config->phase1)
161 		eap_fast_parse_phase1(data, config->phase1);
162 
163 	if (eap_peer_select_phase2_methods(config, "auth=",
164 					   &data->phase2_types,
165 					   &data->num_phase2_types, 0) < 0) {
166 		eap_fast_deinit(sm, data);
167 		return NULL;
168 	}
169 
170 	data->phase2_type.vendor = EAP_VENDOR_IETF;
171 	data->phase2_type.method = EAP_TYPE_NONE;
172 
173 	if (eap_peer_tls_ssl_init(sm, &data->ssl, config, EAP_TYPE_FAST)) {
174 		wpa_printf(MSG_INFO, "EAP-FAST: Failed to initialize SSL.");
175 		eap_fast_deinit(sm, data);
176 		return NULL;
177 	}
178 
179 	if (tls_connection_set_session_ticket_cb(sm->ssl_ctx, data->ssl.conn,
180 						 eap_fast_session_ticket_cb,
181 						 data) < 0) {
182 		wpa_printf(MSG_INFO, "EAP-FAST: Failed to set SessionTicket "
183 			   "callback");
184 		eap_fast_deinit(sm, data);
185 		return NULL;
186 	}
187 
188 	/*
189 	 * The local RADIUS server in a Cisco AP does not seem to like empty
190 	 * fragments before data, so disable that workaround for CBC.
191 	 * TODO: consider making this configurable
192 	 */
193 	if (tls_connection_enable_workaround(sm->ssl_ctx, data->ssl.conn)) {
194 		wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to enable TLS "
195 			   "workarounds");
196 	}
197 
198 	if (!config->pac_file) {
199 		wpa_printf(MSG_INFO, "EAP-FAST: No PAC file configured");
200 		eap_fast_deinit(sm, data);
201 		return NULL;
202 	}
203 
204 	if (data->use_pac_binary_format &&
205 	    eap_fast_load_pac_bin(sm, &data->pac, config->pac_file) < 0) {
206 		wpa_printf(MSG_INFO, "EAP-FAST: Failed to load PAC file");
207 		eap_fast_deinit(sm, data);
208 		return NULL;
209 	}
210 
211 	if (!data->use_pac_binary_format &&
212 	    eap_fast_load_pac(sm, &data->pac, config->pac_file) < 0) {
213 		wpa_printf(MSG_INFO, "EAP-FAST: Failed to load PAC file");
214 		eap_fast_deinit(sm, data);
215 		return NULL;
216 	}
217 	eap_fast_pac_list_truncate(data->pac, data->max_pac_list_len);
218 
219 	if (data->pac == NULL && !data->provisioning_allowed) {
220 		wpa_printf(MSG_INFO, "EAP-FAST: No PAC configured and "
221 			   "provisioning disabled");
222 		eap_fast_deinit(sm, data);
223 		return NULL;
224 	}
225 
226 	return data;
227 }
228 
229 
eap_fast_deinit(struct eap_sm * sm,void * priv)230 static void eap_fast_deinit(struct eap_sm *sm, void *priv)
231 {
232 	struct eap_fast_data *data = priv;
233 	struct eap_fast_pac *pac, *prev;
234 
235 	if (data == NULL)
236 		return;
237 	if (data->phase2_priv && data->phase2_method)
238 		data->phase2_method->deinit(sm, data->phase2_priv);
239 	os_free(data->phase2_types);
240 	os_free(data->key_block_p);
241 	eap_peer_tls_ssl_deinit(sm, &data->ssl);
242 
243 	pac = data->pac;
244 	prev = NULL;
245 	while (pac) {
246 		prev = pac;
247 		pac = pac->next;
248 		eap_fast_free_pac(prev);
249 	}
250 	os_memset(data->key_data, 0, EAP_FAST_KEY_LEN);
251 	os_memset(data->emsk, 0, EAP_EMSK_LEN);
252 	os_free(data->session_id);
253 	wpabuf_clear_free(data->pending_phase2_req);
254 	wpabuf_clear_free(data->pending_resp);
255 	os_free(data);
256 }
257 
258 
eap_fast_derive_msk(struct eap_fast_data * data)259 static int eap_fast_derive_msk(struct eap_fast_data *data)
260 {
261 	if (eap_fast_derive_eap_msk(data->simck, data->key_data) < 0 ||
262 	    eap_fast_derive_eap_emsk(data->simck, data->emsk) < 0)
263 		return -1;
264 	data->success = 1;
265 	return 0;
266 }
267 
268 
eap_fast_derive_key_auth(struct eap_sm * sm,struct eap_fast_data * data)269 static int eap_fast_derive_key_auth(struct eap_sm *sm,
270 				    struct eap_fast_data *data)
271 {
272 	u8 *sks;
273 
274 	/* RFC 4851, Section 5.1:
275 	 * Extra key material after TLS key_block: session_key_seed[40]
276 	 */
277 
278 	sks = eap_fast_derive_key(sm->ssl_ctx, data->ssl.conn,
279 				  EAP_FAST_SKS_LEN);
280 	if (sks == NULL) {
281 		wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to derive "
282 			   "session_key_seed");
283 		return -1;
284 	}
285 
286 	/*
287 	 * RFC 4851, Section 5.2:
288 	 * S-IMCK[0] = session_key_seed
289 	 */
290 	wpa_hexdump_key(MSG_DEBUG,
291 			"EAP-FAST: session_key_seed (SKS = S-IMCK[0])",
292 			sks, EAP_FAST_SKS_LEN);
293 	data->simck_idx = 0;
294 	os_memcpy(data->simck, sks, EAP_FAST_SIMCK_LEN);
295 	os_free(sks);
296 	return 0;
297 }
298 
299 
eap_fast_derive_key_provisioning(struct eap_sm * sm,struct eap_fast_data * data)300 static int eap_fast_derive_key_provisioning(struct eap_sm *sm,
301 					    struct eap_fast_data *data)
302 {
303 	os_free(data->key_block_p);
304 	data->key_block_p = (struct eap_fast_key_block_provisioning *)
305 		eap_fast_derive_key(sm->ssl_ctx, data->ssl.conn,
306 				    sizeof(*data->key_block_p));
307 	if (data->key_block_p == NULL) {
308 		wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to derive key block");
309 		return -1;
310 	}
311 	/*
312 	 * RFC 4851, Section 5.2:
313 	 * S-IMCK[0] = session_key_seed
314 	 */
315 	wpa_hexdump_key(MSG_DEBUG,
316 			"EAP-FAST: session_key_seed (SKS = S-IMCK[0])",
317 			data->key_block_p->session_key_seed,
318 			sizeof(data->key_block_p->session_key_seed));
319 	data->simck_idx = 0;
320 	os_memcpy(data->simck, data->key_block_p->session_key_seed,
321 		  EAP_FAST_SIMCK_LEN);
322 	wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: server_challenge",
323 			data->key_block_p->server_challenge,
324 			sizeof(data->key_block_p->server_challenge));
325 	wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: client_challenge",
326 			data->key_block_p->client_challenge,
327 			sizeof(data->key_block_p->client_challenge));
328 	return 0;
329 }
330 
331 
eap_fast_derive_keys(struct eap_sm * sm,struct eap_fast_data * data)332 static int eap_fast_derive_keys(struct eap_sm *sm, struct eap_fast_data *data)
333 {
334 	int res;
335 
336 	if (data->anon_provisioning)
337 		res = eap_fast_derive_key_provisioning(sm, data);
338 	else
339 		res = eap_fast_derive_key_auth(sm, data);
340 	return res;
341 }
342 
343 
eap_fast_init_phase2_method(struct eap_sm * sm,struct eap_fast_data * data)344 static int eap_fast_init_phase2_method(struct eap_sm *sm,
345 				       struct eap_fast_data *data)
346 {
347 	data->phase2_method =
348 		eap_peer_get_eap_method(data->phase2_type.vendor,
349 					data->phase2_type.method);
350 	if (data->phase2_method == NULL)
351 		return -1;
352 
353 	if (data->key_block_p) {
354 		sm->auth_challenge = data->key_block_p->server_challenge;
355 		sm->peer_challenge = data->key_block_p->client_challenge;
356 	}
357 	sm->eap_fast_mschapv2 = true;
358 	sm->init_phase2 = 1;
359 	data->phase2_priv = data->phase2_method->init(sm);
360 	sm->init_phase2 = 0;
361 	sm->auth_challenge = NULL;
362 	sm->peer_challenge = NULL;
363 
364 	return data->phase2_priv == NULL ? -1 : 0;
365 }
366 
367 
eap_fast_select_phase2_method(struct eap_fast_data * data,int vendor,enum eap_type type)368 static int eap_fast_select_phase2_method(struct eap_fast_data *data,
369 					 int vendor, enum eap_type type)
370 {
371 	size_t i;
372 
373 	/* TODO: TNC with anonymous provisioning; need to require both
374 	 * completed MSCHAPv2 and TNC */
375 
376 	if (data->anon_provisioning &&
377 	    (vendor != EAP_VENDOR_IETF || type != EAP_TYPE_MSCHAPV2)) {
378 		wpa_printf(MSG_INFO,
379 			   "EAP-FAST: Only EAP-MSCHAPv2 is allowed during unauthenticated provisioning; reject phase2 type %u:%u",
380 			   vendor, type);
381 		return -1;
382 	}
383 
384 #ifdef EAP_TNC
385 	if (vendor == EAP_VENDOR_IETF && type == EAP_TYPE_TNC) {
386 		data->phase2_type.vendor = EAP_VENDOR_IETF;
387 		data->phase2_type.method = EAP_TYPE_TNC;
388 		wpa_printf(MSG_DEBUG, "EAP-FAST: Selected Phase 2 EAP "
389 			   "vendor %d method %d for TNC",
390 			   data->phase2_type.vendor,
391 			   data->phase2_type.method);
392 		return 0;
393 	}
394 #endif /* EAP_TNC */
395 
396 	for (i = 0; i < data->num_phase2_types; i++) {
397 		if (data->phase2_types[i].vendor != vendor ||
398 		    data->phase2_types[i].method != type)
399 			continue;
400 
401 		data->phase2_type.vendor = data->phase2_types[i].vendor;
402 		data->phase2_type.method = data->phase2_types[i].method;
403 		wpa_printf(MSG_DEBUG, "EAP-FAST: Selected Phase 2 EAP "
404 			   "vendor %d method %d",
405 			   data->phase2_type.vendor,
406 			   data->phase2_type.method);
407 		break;
408 	}
409 
410 	if (vendor != data->phase2_type.vendor ||
411 	    type != data->phase2_type.method ||
412 	    (vendor == EAP_VENDOR_IETF && type == EAP_TYPE_NONE))
413 		return -1;
414 
415 	return 0;
416 }
417 
418 
eap_fast_phase2_request(struct eap_sm * sm,struct eap_fast_data * data,struct eap_method_ret * ret,struct eap_hdr * hdr,struct wpabuf ** resp)419 static int eap_fast_phase2_request(struct eap_sm *sm,
420 				   struct eap_fast_data *data,
421 				   struct eap_method_ret *ret,
422 				   struct eap_hdr *hdr,
423 				   struct wpabuf **resp)
424 {
425 	size_t len = be_to_host16(hdr->length);
426 	u8 *pos;
427 	struct eap_method_ret iret;
428 	struct eap_peer_config *config = eap_get_config(sm);
429 	struct wpabuf msg;
430 	int vendor = EAP_VENDOR_IETF;
431 	enum eap_type method;
432 
433 	if (len <= sizeof(struct eap_hdr)) {
434 		wpa_printf(MSG_INFO, "EAP-FAST: too short "
435 			   "Phase 2 request (len=%lu)", (unsigned long) len);
436 		return -1;
437 	}
438 	pos = (u8 *) (hdr + 1);
439 	method = *pos;
440 	if (method == EAP_TYPE_EXPANDED) {
441 		if (len < sizeof(struct eap_hdr) + 8) {
442 			wpa_printf(MSG_INFO,
443 				   "EAP-FAST: Too short Phase 2 request (expanded header) (len=%lu)",
444 				   (unsigned long) len);
445 			return -1;
446 		}
447 		vendor = WPA_GET_BE24(pos + 1);
448 		method = WPA_GET_BE32(pos + 4);
449 	}
450 	wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 Request: type=%u:%u",
451 		   vendor, method);
452 	if (vendor == EAP_VENDOR_IETF && method == EAP_TYPE_IDENTITY) {
453 		*resp = eap_sm_buildIdentity(sm, hdr->identifier, 1);
454 		return 0;
455 	}
456 
457 	if (data->phase2_priv && data->phase2_method &&
458 	    (vendor != data->phase2_type.vendor ||
459 	     method != data->phase2_type.method)) {
460 		wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 EAP sequence - "
461 			   "deinitialize previous method");
462 		data->phase2_method->deinit(sm, data->phase2_priv);
463 		data->phase2_method = NULL;
464 		data->phase2_priv = NULL;
465 		data->phase2_type.vendor = EAP_VENDOR_IETF;
466 		data->phase2_type.method = EAP_TYPE_NONE;
467 	}
468 
469 	if (data->phase2_type.vendor == EAP_VENDOR_IETF &&
470 	    data->phase2_type.method == EAP_TYPE_NONE &&
471 	    eap_fast_select_phase2_method(data, vendor, method) < 0) {
472 		if (eap_peer_tls_phase2_nak(data->phase2_types,
473 					    data->num_phase2_types,
474 					    hdr, resp))
475 			return -1;
476 		return 0;
477 	}
478 
479 	if ((data->phase2_priv == NULL &&
480 	     eap_fast_init_phase2_method(sm, data) < 0) ||
481 	    data->phase2_method == NULL) {
482 		wpa_printf(MSG_INFO,
483 			   "EAP-FAST: Failed to initialize Phase 2 EAP method %u:%u",
484 			   vendor, method);
485 		ret->methodState = METHOD_DONE;
486 		ret->decision = DECISION_FAIL;
487 		return -1;
488 	}
489 
490 	os_memset(&iret, 0, sizeof(iret));
491 	wpabuf_set(&msg, hdr, len);
492 	*resp = data->phase2_method->process(sm, data->phase2_priv, &iret,
493 					     &msg);
494 	if (*resp == NULL ||
495 	    (iret.methodState == METHOD_DONE &&
496 	     iret.decision == DECISION_FAIL)) {
497 		ret->methodState = METHOD_DONE;
498 		ret->decision = DECISION_FAIL;
499 	} else if ((iret.methodState == METHOD_DONE ||
500 		    iret.methodState == METHOD_MAY_CONT) &&
501 		   (iret.decision == DECISION_UNCOND_SUCC ||
502 		    iret.decision == DECISION_COND_SUCC)) {
503 		data->phase2_success = 1;
504 	}
505 
506 	if (*resp == NULL && config &&
507 	    (config->pending_req_identity || config->pending_req_password ||
508 	     config->pending_req_otp || config->pending_req_new_password ||
509 	     config->pending_req_sim)) {
510 		wpabuf_clear_free(data->pending_phase2_req);
511 		data->pending_phase2_req = wpabuf_alloc_copy(hdr, len);
512 	} else if (*resp == NULL)
513 		return -1;
514 
515 	return 0;
516 }
517 
518 
eap_fast_tlv_nak(int vendor_id,int tlv_type)519 static struct wpabuf * eap_fast_tlv_nak(int vendor_id, int tlv_type)
520 {
521 	struct wpabuf *buf;
522 	struct eap_tlv_nak_tlv *nak;
523 	buf = wpabuf_alloc(sizeof(*nak));
524 	if (buf == NULL)
525 		return NULL;
526 	nak = wpabuf_put(buf, sizeof(*nak));
527 	nak->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY | EAP_TLV_NAK_TLV);
528 	nak->length = host_to_be16(6);
529 	nak->vendor_id = host_to_be32(vendor_id);
530 	nak->nak_type = host_to_be16(tlv_type);
531 	return buf;
532 }
533 
534 
eap_fast_tlv_result(int status,int intermediate)535 static struct wpabuf * eap_fast_tlv_result(int status, int intermediate)
536 {
537 	struct wpabuf *buf;
538 	struct eap_tlv_intermediate_result_tlv *result;
539 	buf = wpabuf_alloc(sizeof(*result));
540 	if (buf == NULL)
541 		return NULL;
542 	wpa_printf(MSG_DEBUG, "EAP-FAST: Add %sResult TLV(status=%d)",
543 		   intermediate ? "Intermediate " : "", status);
544 	result = wpabuf_put(buf, sizeof(*result));
545 	result->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
546 					(intermediate ?
547 					 EAP_TLV_INTERMEDIATE_RESULT_TLV :
548 					 EAP_TLV_RESULT_TLV));
549 	result->length = host_to_be16(2);
550 	result->status = host_to_be16(status);
551 	return buf;
552 }
553 
554 
eap_fast_tlv_pac_ack(void)555 static struct wpabuf * eap_fast_tlv_pac_ack(void)
556 {
557 	struct wpabuf *buf;
558 	struct eap_tlv_result_tlv *res;
559 	struct eap_tlv_pac_ack_tlv *ack;
560 
561 	buf = wpabuf_alloc(sizeof(*res) + sizeof(*ack));
562 	if (buf == NULL)
563 		return NULL;
564 
565 	wpa_printf(MSG_DEBUG, "EAP-FAST: Add PAC TLV (ack)");
566 	ack = wpabuf_put(buf, sizeof(*ack));
567 	ack->tlv_type = host_to_be16(EAP_TLV_PAC_TLV |
568 				     EAP_TLV_TYPE_MANDATORY);
569 	ack->length = host_to_be16(sizeof(*ack) - sizeof(struct eap_tlv_hdr));
570 	ack->pac_type = host_to_be16(PAC_TYPE_PAC_ACKNOWLEDGEMENT);
571 	ack->pac_len = host_to_be16(2);
572 	ack->result = host_to_be16(EAP_TLV_RESULT_SUCCESS);
573 
574 	return buf;
575 }
576 
577 
eap_fast_process_eap_payload_tlv(struct eap_sm * sm,struct eap_fast_data * data,struct eap_method_ret * ret,u8 * eap_payload_tlv,size_t eap_payload_tlv_len)578 static struct wpabuf * eap_fast_process_eap_payload_tlv(
579 	struct eap_sm *sm, struct eap_fast_data *data,
580 	struct eap_method_ret *ret,
581 	u8 *eap_payload_tlv, size_t eap_payload_tlv_len)
582 {
583 	struct eap_hdr *hdr;
584 	struct wpabuf *resp = NULL;
585 
586 	if (eap_payload_tlv_len < sizeof(*hdr)) {
587 		wpa_printf(MSG_DEBUG, "EAP-FAST: too short EAP "
588 			   "Payload TLV (len=%lu)",
589 			   (unsigned long) eap_payload_tlv_len);
590 		return NULL;
591 	}
592 
593 	hdr = (struct eap_hdr *) eap_payload_tlv;
594 	if (be_to_host16(hdr->length) > eap_payload_tlv_len) {
595 		wpa_printf(MSG_DEBUG, "EAP-FAST: EAP packet overflow in "
596 			   "EAP Payload TLV");
597 		return NULL;
598 	}
599 
600 	if (hdr->code != EAP_CODE_REQUEST) {
601 		wpa_printf(MSG_INFO, "EAP-FAST: Unexpected code=%d in "
602 			   "Phase 2 EAP header", hdr->code);
603 		return NULL;
604 	}
605 
606 	if (eap_fast_phase2_request(sm, data, ret, hdr, &resp)) {
607 		wpa_printf(MSG_INFO, "EAP-FAST: Phase2 Request processing "
608 			   "failed");
609 		return NULL;
610 	}
611 
612 	return eap_fast_tlv_eap_payload(resp);
613 }
614 
615 
eap_fast_validate_crypto_binding(struct eap_tlv_crypto_binding_tlv * _bind)616 static int eap_fast_validate_crypto_binding(
617 	struct eap_tlv_crypto_binding_tlv *_bind)
618 {
619 	wpa_printf(MSG_DEBUG, "EAP-FAST: Crypto-Binding TLV: Version %d "
620 		   "Received Version %d SubType %d",
621 		   _bind->version, _bind->received_version, _bind->subtype);
622 	wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: NONCE",
623 		    _bind->nonce, sizeof(_bind->nonce));
624 	wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Compound MAC",
625 		    _bind->compound_mac, sizeof(_bind->compound_mac));
626 
627 	if (_bind->version != EAP_FAST_VERSION ||
628 	    _bind->received_version != EAP_FAST_VERSION ||
629 	    _bind->subtype != EAP_TLV_CRYPTO_BINDING_SUBTYPE_REQUEST) {
630 		wpa_printf(MSG_INFO, "EAP-FAST: Invalid version/subtype in "
631 			   "Crypto-Binding TLV: Version %d "
632 			   "Received Version %d SubType %d",
633 			   _bind->version, _bind->received_version,
634 			   _bind->subtype);
635 		return -1;
636 	}
637 
638 	return 0;
639 }
640 
641 
eap_fast_write_crypto_binding(struct eap_tlv_crypto_binding_tlv * rbind,struct eap_tlv_crypto_binding_tlv * _bind,const u8 * cmk)642 static void eap_fast_write_crypto_binding(
643 	struct eap_tlv_crypto_binding_tlv *rbind,
644 	struct eap_tlv_crypto_binding_tlv *_bind, const u8 *cmk)
645 {
646 	rbind->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
647 				       EAP_TLV_CRYPTO_BINDING_TLV);
648 	rbind->length = host_to_be16(sizeof(*rbind) -
649 				     sizeof(struct eap_tlv_hdr));
650 	rbind->version = EAP_FAST_VERSION;
651 	rbind->received_version = _bind->version;
652 	rbind->subtype = EAP_TLV_CRYPTO_BINDING_SUBTYPE_RESPONSE;
653 	os_memcpy(rbind->nonce, _bind->nonce, sizeof(_bind->nonce));
654 	inc_byte_array(rbind->nonce, sizeof(rbind->nonce));
655 	hmac_sha1(cmk, EAP_FAST_CMK_LEN, (u8 *) rbind, sizeof(*rbind),
656 		  rbind->compound_mac);
657 
658 	wpa_printf(MSG_DEBUG, "EAP-FAST: Reply Crypto-Binding TLV: Version %d "
659 		   "Received Version %d SubType %d",
660 		   rbind->version, rbind->received_version, rbind->subtype);
661 	wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: NONCE",
662 		    rbind->nonce, sizeof(rbind->nonce));
663 	wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Compound MAC",
664 		    rbind->compound_mac, sizeof(rbind->compound_mac));
665 }
666 
667 
eap_fast_get_phase2_key(struct eap_sm * sm,struct eap_fast_data * data,u8 * isk,size_t isk_len)668 static int eap_fast_get_phase2_key(struct eap_sm *sm,
669 				   struct eap_fast_data *data,
670 				   u8 *isk, size_t isk_len)
671 {
672 	u8 *key;
673 	size_t key_len;
674 
675 	os_memset(isk, 0, isk_len);
676 
677 	if (data->phase2_method == NULL || data->phase2_priv == NULL) {
678 		wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 method not "
679 			   "available");
680 		return -1;
681 	}
682 
683 	if (data->phase2_method->isKeyAvailable == NULL ||
684 	    data->phase2_method->getKey == NULL)
685 		return 0;
686 
687 	if (!data->phase2_method->isKeyAvailable(sm, data->phase2_priv) ||
688 	    (key = data->phase2_method->getKey(sm, data->phase2_priv,
689 					       &key_len)) == NULL) {
690 		wpa_printf(MSG_DEBUG, "EAP-FAST: Could not get key material "
691 			   "from Phase 2");
692 		return -1;
693 	}
694 
695 	if (key_len > isk_len)
696 		key_len = isk_len;
697 	os_memcpy(isk, key, key_len);
698 	os_free(key);
699 
700 	return 0;
701 }
702 
703 
eap_fast_get_cmk(struct eap_sm * sm,struct eap_fast_data * data,u8 * cmk)704 static int eap_fast_get_cmk(struct eap_sm *sm, struct eap_fast_data *data,
705 			    u8 *cmk)
706 {
707 	u8 isk[32], imck[60];
708 
709 	wpa_printf(MSG_DEBUG, "EAP-FAST: Determining CMK[%d] for Compound MIC "
710 		   "calculation", data->simck_idx + 1);
711 
712 	/*
713 	 * RFC 4851, Section 5.2:
714 	 * IMCK[j] = T-PRF(S-IMCK[j-1], "Inner Methods Compound Keys",
715 	 *                 MSK[j], 60)
716 	 * S-IMCK[j] = first 40 octets of IMCK[j]
717 	 * CMK[j] = last 20 octets of IMCK[j]
718 	 */
719 
720 	if (eap_fast_get_phase2_key(sm, data, isk, sizeof(isk)) < 0)
721 		return -1;
722 	wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: ISK[j]", isk, sizeof(isk));
723 	if (sha1_t_prf(data->simck, EAP_FAST_SIMCK_LEN,
724 		       "Inner Methods Compound Keys",
725 		       isk, sizeof(isk), imck, sizeof(imck)) < 0)
726 		return -1;
727 	data->simck_idx++;
728 	os_memcpy(data->simck, imck, EAP_FAST_SIMCK_LEN);
729 	wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: S-IMCK[j]",
730 			data->simck, EAP_FAST_SIMCK_LEN);
731 	os_memcpy(cmk, imck + EAP_FAST_SIMCK_LEN, EAP_FAST_CMK_LEN);
732 	wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: CMK[j]",
733 			cmk, EAP_FAST_CMK_LEN);
734 
735 	return 0;
736 }
737 
738 
eap_fast_write_pac_request(u8 * pos,u16 pac_type)739 static u8 * eap_fast_write_pac_request(u8 *pos, u16 pac_type)
740 {
741 	struct eap_tlv_hdr *pac;
742 	struct eap_tlv_request_action_tlv *act;
743 	struct eap_tlv_pac_type_tlv *type;
744 
745 	act = (struct eap_tlv_request_action_tlv *) pos;
746 	act->tlv_type = host_to_be16(EAP_TLV_REQUEST_ACTION_TLV);
747 	act->length = host_to_be16(2);
748 	act->action = host_to_be16(EAP_TLV_ACTION_PROCESS_TLV);
749 
750 	pac = (struct eap_tlv_hdr *) (act + 1);
751 	pac->tlv_type = host_to_be16(EAP_TLV_PAC_TLV);
752 	pac->length = host_to_be16(sizeof(*type));
753 
754 	type = (struct eap_tlv_pac_type_tlv *) (pac + 1);
755 	type->tlv_type = host_to_be16(PAC_TYPE_PAC_TYPE);
756 	type->length = host_to_be16(2);
757 	type->pac_type = host_to_be16(pac_type);
758 
759 	return (u8 *) (type + 1);
760 }
761 
762 
eap_fast_process_crypto_binding(struct eap_sm * sm,struct eap_fast_data * data,struct eap_method_ret * ret,struct eap_tlv_crypto_binding_tlv * _bind,size_t bind_len)763 static struct wpabuf * eap_fast_process_crypto_binding(
764 	struct eap_sm *sm, struct eap_fast_data *data,
765 	struct eap_method_ret *ret,
766 	struct eap_tlv_crypto_binding_tlv *_bind, size_t bind_len)
767 {
768 	struct wpabuf *resp;
769 	u8 *pos;
770 	u8 cmk[EAP_FAST_CMK_LEN], cmac[SHA1_MAC_LEN];
771 	int res;
772 	size_t len;
773 
774 	if (eap_fast_validate_crypto_binding(_bind) < 0)
775 		return NULL;
776 
777 	if (eap_fast_get_cmk(sm, data, cmk) < 0)
778 		return NULL;
779 
780 	/* Validate received Compound MAC */
781 	os_memcpy(cmac, _bind->compound_mac, sizeof(cmac));
782 	os_memset(_bind->compound_mac, 0, sizeof(cmac));
783 	wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Crypto-Binding TLV for Compound "
784 		    "MAC calculation", (u8 *) _bind, bind_len);
785 	hmac_sha1(cmk, EAP_FAST_CMK_LEN, (u8 *) _bind, bind_len,
786 		  _bind->compound_mac);
787 	res = os_memcmp_const(cmac, _bind->compound_mac, sizeof(cmac));
788 	wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Received Compound MAC",
789 		    cmac, sizeof(cmac));
790 	wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Calculated Compound MAC",
791 		    _bind->compound_mac, sizeof(cmac));
792 	if (res != 0) {
793 		wpa_printf(MSG_INFO, "EAP-FAST: Compound MAC did not match");
794 		os_memcpy(_bind->compound_mac, cmac, sizeof(cmac));
795 		return NULL;
796 	}
797 
798 	/*
799 	 * Compound MAC was valid, so authentication succeeded. Reply with
800 	 * crypto binding to allow server to complete authentication.
801 	 */
802 
803 	len = sizeof(struct eap_tlv_crypto_binding_tlv);
804 	resp = wpabuf_alloc(len);
805 	if (resp == NULL)
806 		return NULL;
807 
808 	if (!data->anon_provisioning && data->phase2_success &&
809 	    eap_fast_derive_msk(data) < 0) {
810 		wpa_printf(MSG_INFO, "EAP-FAST: Failed to generate MSK");
811 		ret->methodState = METHOD_DONE;
812 		ret->decision = DECISION_FAIL;
813 		data->phase2_success = 0;
814 		wpabuf_clear_free(resp);
815 		return NULL;
816 	}
817 
818 	if (!data->anon_provisioning && data->phase2_success) {
819 		os_free(data->session_id);
820 		data->session_id = eap_peer_tls_derive_session_id(
821 			sm, &data->ssl, EAP_TYPE_FAST, &data->id_len);
822 		if (data->session_id) {
823 			wpa_hexdump(MSG_DEBUG, "EAP-FAST: Derived Session-Id",
824 				    data->session_id, data->id_len);
825 		} else {
826 			wpa_printf(MSG_ERROR, "EAP-FAST: Failed to derive "
827 				   "Session-Id");
828 			wpabuf_clear_free(resp);
829 			return NULL;
830 		}
831 	}
832 
833 	pos = wpabuf_put(resp, sizeof(struct eap_tlv_crypto_binding_tlv));
834 	eap_fast_write_crypto_binding((struct eap_tlv_crypto_binding_tlv *)
835 				      pos, _bind, cmk);
836 
837 	return resp;
838 }
839 
840 
eap_fast_parse_pac_tlv(struct eap_fast_pac * entry,int type,u8 * pos,size_t len,int * pac_key_found)841 static void eap_fast_parse_pac_tlv(struct eap_fast_pac *entry, int type,
842 				   u8 *pos, size_t len, int *pac_key_found)
843 {
844 	switch (type & 0x7fff) {
845 	case PAC_TYPE_PAC_KEY:
846 		wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: PAC-Key", pos, len);
847 		if (len != EAP_FAST_PAC_KEY_LEN) {
848 			wpa_printf(MSG_DEBUG, "EAP-FAST: Invalid PAC-Key "
849 				   "length %lu", (unsigned long) len);
850 			break;
851 		}
852 		*pac_key_found = 1;
853 		os_memcpy(entry->pac_key, pos, len);
854 		break;
855 	case PAC_TYPE_PAC_OPAQUE:
856 		wpa_hexdump(MSG_DEBUG, "EAP-FAST: PAC-Opaque", pos, len);
857 		entry->pac_opaque = pos;
858 		entry->pac_opaque_len = len;
859 		break;
860 	case PAC_TYPE_PAC_INFO:
861 		wpa_hexdump(MSG_DEBUG, "EAP-FAST: PAC-Info", pos, len);
862 		entry->pac_info = pos;
863 		entry->pac_info_len = len;
864 		break;
865 	default:
866 		wpa_printf(MSG_DEBUG, "EAP-FAST: Ignored unknown PAC type %d",
867 			   type);
868 		break;
869 	}
870 }
871 
872 
eap_fast_process_pac_tlv(struct eap_fast_pac * entry,u8 * pac,size_t pac_len)873 static int eap_fast_process_pac_tlv(struct eap_fast_pac *entry,
874 				    u8 *pac, size_t pac_len)
875 {
876 	struct pac_tlv_hdr *hdr;
877 	u8 *pos;
878 	size_t left, len;
879 	int type, pac_key_found = 0;
880 
881 	pos = pac;
882 	left = pac_len;
883 
884 	while (left > sizeof(*hdr)) {
885 		hdr = (struct pac_tlv_hdr *) pos;
886 		type = be_to_host16(hdr->type);
887 		len = be_to_host16(hdr->len);
888 		pos += sizeof(*hdr);
889 		left -= sizeof(*hdr);
890 		if (len > left) {
891 			wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV overrun "
892 				   "(type=%d len=%lu left=%lu)",
893 				   type, (unsigned long) len,
894 				   (unsigned long) left);
895 			return -1;
896 		}
897 
898 		eap_fast_parse_pac_tlv(entry, type, pos, len, &pac_key_found);
899 
900 		pos += len;
901 		left -= len;
902 	}
903 
904 	if (!pac_key_found || !entry->pac_opaque || !entry->pac_info) {
905 		wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV does not include "
906 			   "all the required fields");
907 		return -1;
908 	}
909 
910 	return 0;
911 }
912 
913 
eap_fast_parse_pac_info(struct eap_fast_pac * entry,int type,u8 * pos,size_t len)914 static int eap_fast_parse_pac_info(struct eap_fast_pac *entry, int type,
915 				   u8 *pos, size_t len)
916 {
917 	u16 pac_type;
918 	u32 lifetime;
919 	struct os_time now;
920 
921 	switch (type & 0x7fff) {
922 	case PAC_TYPE_CRED_LIFETIME:
923 		if (len != 4) {
924 			wpa_hexdump(MSG_DEBUG, "EAP-FAST: PAC-Info - "
925 				    "Invalid CRED_LIFETIME length - ignored",
926 				    pos, len);
927 			return 0;
928 		}
929 
930 		/*
931 		 * This is not currently saved separately in PAC files since
932 		 * the server can automatically initiate PAC update when
933 		 * needed. Anyway, the information is available from PAC-Info
934 		 * dump if it is needed for something in the future.
935 		 */
936 		lifetime = WPA_GET_BE32(pos);
937 		os_get_time(&now);
938 		wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info - CRED_LIFETIME %d "
939 			   "(%d days)",
940 			   lifetime, (lifetime - (u32) now.sec) / 86400);
941 		break;
942 	case PAC_TYPE_A_ID:
943 		wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: PAC-Info - A-ID",
944 				  pos, len);
945 		entry->a_id = pos;
946 		entry->a_id_len = len;
947 		break;
948 	case PAC_TYPE_I_ID:
949 		wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: PAC-Info - I-ID",
950 				  pos, len);
951 		entry->i_id = pos;
952 		entry->i_id_len = len;
953 		break;
954 	case PAC_TYPE_A_ID_INFO:
955 		wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: PAC-Info - A-ID-Info",
956 				  pos, len);
957 		entry->a_id_info = pos;
958 		entry->a_id_info_len = len;
959 		break;
960 	case PAC_TYPE_PAC_TYPE:
961 		/* RFC 5422, Section 4.2.6 - PAC-Type TLV */
962 		if (len != 2) {
963 			wpa_printf(MSG_INFO, "EAP-FAST: Invalid PAC-Type "
964 				   "length %lu (expected 2)",
965 				   (unsigned long) len);
966 			wpa_hexdump_ascii(MSG_DEBUG,
967 					  "EAP-FAST: PAC-Info - PAC-Type",
968 					  pos, len);
969 			return -1;
970 		}
971 		pac_type = WPA_GET_BE16(pos);
972 		if (pac_type != PAC_TYPE_TUNNEL_PAC &&
973 		    pac_type != PAC_TYPE_USER_AUTHORIZATION &&
974 		    pac_type != PAC_TYPE_MACHINE_AUTHENTICATION) {
975 			wpa_printf(MSG_INFO, "EAP-FAST: Unsupported PAC Type "
976 				   "%d", pac_type);
977 			return -1;
978 		}
979 
980 		wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info - PAC-Type %d",
981 			   pac_type);
982 		entry->pac_type = pac_type;
983 		break;
984 	default:
985 		wpa_printf(MSG_DEBUG, "EAP-FAST: Ignored unknown PAC-Info "
986 			   "type %d", type);
987 		break;
988 	}
989 
990 	return 0;
991 }
992 
993 
eap_fast_process_pac_info(struct eap_fast_pac * entry)994 static int eap_fast_process_pac_info(struct eap_fast_pac *entry)
995 {
996 	struct pac_tlv_hdr *hdr;
997 	u8 *pos;
998 	size_t left, len;
999 	int type;
1000 
1001 	/* RFC 5422, Section 4.2.4 */
1002 
1003 	/* PAC-Type defaults to Tunnel PAC (Type 1) */
1004 	entry->pac_type = PAC_TYPE_TUNNEL_PAC;
1005 
1006 	pos = entry->pac_info;
1007 	left = entry->pac_info_len;
1008 	while (left > sizeof(*hdr)) {
1009 		hdr = (struct pac_tlv_hdr *) pos;
1010 		type = be_to_host16(hdr->type);
1011 		len = be_to_host16(hdr->len);
1012 		pos += sizeof(*hdr);
1013 		left -= sizeof(*hdr);
1014 		if (len > left) {
1015 			wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info overrun "
1016 				   "(type=%d len=%lu left=%lu)",
1017 				   type, (unsigned long) len,
1018 				   (unsigned long) left);
1019 			return -1;
1020 		}
1021 
1022 		if (eap_fast_parse_pac_info(entry, type, pos, len) < 0)
1023 			return -1;
1024 
1025 		pos += len;
1026 		left -= len;
1027 	}
1028 
1029 	if (entry->a_id == NULL || entry->a_id_info == NULL) {
1030 		wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info does not include "
1031 			   "all the required fields");
1032 		return -1;
1033 	}
1034 
1035 	return 0;
1036 }
1037 
1038 
eap_fast_process_pac(struct eap_sm * sm,struct eap_fast_data * data,struct eap_method_ret * ret,u8 * pac,size_t pac_len)1039 static struct wpabuf * eap_fast_process_pac(struct eap_sm *sm,
1040 					    struct eap_fast_data *data,
1041 					    struct eap_method_ret *ret,
1042 					    u8 *pac, size_t pac_len)
1043 {
1044 	struct eap_peer_config *config = eap_get_config(sm);
1045 	struct eap_fast_pac entry;
1046 
1047 	os_memset(&entry, 0, sizeof(entry));
1048 	if (eap_fast_process_pac_tlv(&entry, pac, pac_len) ||
1049 	    eap_fast_process_pac_info(&entry))
1050 		return NULL;
1051 
1052 	eap_fast_add_pac(&data->pac, &data->current_pac, &entry);
1053 	eap_fast_pac_list_truncate(data->pac, data->max_pac_list_len);
1054 	if (data->use_pac_binary_format)
1055 		eap_fast_save_pac_bin(sm, data->pac, config->pac_file);
1056 	else
1057 		eap_fast_save_pac(sm, data->pac, config->pac_file);
1058 
1059 	if (data->provisioning) {
1060 		if (data->anon_provisioning) {
1061 			/*
1062 			 * Unauthenticated provisioning does not provide keying
1063 			 * material and must end with an EAP-Failure.
1064 			 * Authentication will be done separately after this.
1065 			 */
1066 			data->success = 0;
1067 			ret->decision = DECISION_FAIL;
1068 		} else {
1069 			/*
1070 			 * Server may or may not allow authenticated
1071 			 * provisioning also for key generation.
1072 			 */
1073 			ret->decision = DECISION_COND_SUCC;
1074 		}
1075 		wpa_printf(MSG_DEBUG, "EAP-FAST: Send PAC-Acknowledgement TLV "
1076 			   "- Provisioning completed successfully");
1077 		sm->expected_failure = 1;
1078 	} else {
1079 		/*
1080 		 * This is PAC refreshing, i.e., normal authentication that is
1081 		 * expected to be completed with an EAP-Success. However,
1082 		 * RFC 5422, Section 3.5 allows EAP-Failure to be sent even
1083 		 * after protected success exchange in case of EAP-Fast
1084 		 * provisioning, so we better use DECISION_COND_SUCC here
1085 		 * instead of DECISION_UNCOND_SUCC.
1086 		 */
1087 		wpa_printf(MSG_DEBUG, "EAP-FAST: Send PAC-Acknowledgement TLV "
1088 			   "- PAC refreshing completed successfully");
1089 		ret->decision = DECISION_COND_SUCC;
1090 	}
1091 	ret->methodState = METHOD_DONE;
1092 	return eap_fast_tlv_pac_ack();
1093 }
1094 
1095 
eap_fast_parse_decrypted(struct wpabuf * decrypted,struct eap_fast_tlv_parse * tlv,struct wpabuf ** resp)1096 static int eap_fast_parse_decrypted(struct wpabuf *decrypted,
1097 				    struct eap_fast_tlv_parse *tlv,
1098 				    struct wpabuf **resp)
1099 {
1100 	int mandatory, tlv_type, res;
1101 	size_t len;
1102 	u8 *pos, *end;
1103 
1104 	os_memset(tlv, 0, sizeof(*tlv));
1105 
1106 	/* Parse TLVs from the decrypted Phase 2 data */
1107 	pos = wpabuf_mhead(decrypted);
1108 	end = pos + wpabuf_len(decrypted);
1109 	while (end - pos > 4) {
1110 		mandatory = pos[0] & 0x80;
1111 		tlv_type = WPA_GET_BE16(pos) & 0x3fff;
1112 		pos += 2;
1113 		len = WPA_GET_BE16(pos);
1114 		pos += 2;
1115 		if (len > (size_t) (end - pos)) {
1116 			wpa_printf(MSG_INFO, "EAP-FAST: TLV overflow");
1117 			return -1;
1118 		}
1119 		wpa_printf(MSG_DEBUG, "EAP-FAST: Received Phase 2: "
1120 			   "TLV type %d length %u%s",
1121 			   tlv_type, (unsigned int) len,
1122 			   mandatory ? " (mandatory)" : "");
1123 
1124 		res = eap_fast_parse_tlv(tlv, tlv_type, pos, len);
1125 		if (res == -2)
1126 			break;
1127 		if (res < 0) {
1128 			if (mandatory) {
1129 				wpa_printf(MSG_DEBUG, "EAP-FAST: Nak unknown "
1130 					   "mandatory TLV type %d", tlv_type);
1131 				*resp = eap_fast_tlv_nak(0, tlv_type);
1132 				break;
1133 			} else {
1134 				wpa_printf(MSG_DEBUG, "EAP-FAST: ignored "
1135 					   "unknown optional TLV type %d",
1136 					   tlv_type);
1137 			}
1138 		}
1139 
1140 		pos += len;
1141 	}
1142 
1143 	return 0;
1144 }
1145 
1146 
eap_fast_encrypt_response(struct eap_sm * sm,struct eap_fast_data * data,struct wpabuf * resp,u8 identifier,struct wpabuf ** out_data)1147 static int eap_fast_encrypt_response(struct eap_sm *sm,
1148 				     struct eap_fast_data *data,
1149 				     struct wpabuf *resp,
1150 				     u8 identifier, struct wpabuf **out_data)
1151 {
1152 	if (resp == NULL)
1153 		return 0;
1154 
1155 	wpa_hexdump_buf(MSG_DEBUG, "EAP-FAST: Encrypting Phase 2 data",
1156 			resp);
1157 	if (eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_FAST,
1158 				 data->fast_version, identifier,
1159 				 resp, out_data)) {
1160 		wpa_printf(MSG_INFO, "EAP-FAST: Failed to encrypt a Phase 2 "
1161 			   "frame");
1162 	}
1163 	wpabuf_clear_free(resp);
1164 
1165 	return 0;
1166 }
1167 
1168 
eap_fast_pac_request(void)1169 static struct wpabuf * eap_fast_pac_request(void)
1170 {
1171 	struct wpabuf *tmp;
1172 	u8 *pos, *pos2;
1173 
1174 	tmp = wpabuf_alloc(sizeof(struct eap_tlv_hdr) +
1175 			   sizeof(struct eap_tlv_request_action_tlv) +
1176 			   sizeof(struct eap_tlv_pac_type_tlv));
1177 	if (tmp == NULL)
1178 		return NULL;
1179 
1180 	pos = wpabuf_put(tmp, 0);
1181 	pos2 = eap_fast_write_pac_request(pos, PAC_TYPE_TUNNEL_PAC);
1182 	wpabuf_put(tmp, pos2 - pos);
1183 	return tmp;
1184 }
1185 
1186 
eap_fast_process_decrypted(struct eap_sm * sm,struct eap_fast_data * data,struct eap_method_ret * ret,u8 identifier,struct wpabuf * decrypted,struct wpabuf ** out_data)1187 static int eap_fast_process_decrypted(struct eap_sm *sm,
1188 				      struct eap_fast_data *data,
1189 				      struct eap_method_ret *ret,
1190 				      u8 identifier,
1191 				      struct wpabuf *decrypted,
1192 				      struct wpabuf **out_data)
1193 {
1194 	struct wpabuf *resp = NULL, *tmp;
1195 	struct eap_fast_tlv_parse tlv;
1196 	int failed = 0;
1197 
1198 	if (eap_fast_parse_decrypted(decrypted, &tlv, &resp) < 0)
1199 		return 0;
1200 	if (resp)
1201 		return eap_fast_encrypt_response(sm, data, resp,
1202 						 identifier, out_data);
1203 
1204 	if (tlv.result == EAP_TLV_RESULT_FAILURE) {
1205 		resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0);
1206 		return eap_fast_encrypt_response(sm, data, resp,
1207 						 identifier, out_data);
1208 	}
1209 
1210 	if (tlv.iresult == EAP_TLV_RESULT_FAILURE) {
1211 		resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 1);
1212 		return eap_fast_encrypt_response(sm, data, resp,
1213 						 identifier, out_data);
1214 	}
1215 
1216 	if (tlv.crypto_binding) {
1217 		tmp = eap_fast_process_crypto_binding(sm, data, ret,
1218 						      tlv.crypto_binding,
1219 						      tlv.crypto_binding_len);
1220 		if (tmp == NULL)
1221 			failed = 1;
1222 		else
1223 			resp = wpabuf_concat(resp, tmp);
1224 	}
1225 
1226 	if (tlv.iresult == EAP_TLV_RESULT_SUCCESS) {
1227 		tmp = eap_fast_tlv_result(failed ? EAP_TLV_RESULT_FAILURE :
1228 					  EAP_TLV_RESULT_SUCCESS, 1);
1229 		resp = wpabuf_concat(resp, tmp);
1230 	}
1231 
1232 	if (tlv.eap_payload_tlv) {
1233 		tmp = eap_fast_process_eap_payload_tlv(
1234 			sm, data, ret, tlv.eap_payload_tlv,
1235 			tlv.eap_payload_tlv_len);
1236 		resp = wpabuf_concat(resp, tmp);
1237 	}
1238 
1239 	if (tlv.pac && tlv.result != EAP_TLV_RESULT_SUCCESS) {
1240 		wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV without Result TLV "
1241 			   "acknowledging success");
1242 		failed = 1;
1243 	} else if (tlv.pac && tlv.result == EAP_TLV_RESULT_SUCCESS) {
1244 		tmp = eap_fast_process_pac(sm, data, ret, tlv.pac,
1245 					   tlv.pac_len);
1246 		resp = wpabuf_concat(resp, tmp);
1247 	}
1248 
1249 	if (data->current_pac == NULL && data->provisioning &&
1250 	    !data->anon_provisioning && !tlv.pac &&
1251 	    (tlv.iresult == EAP_TLV_RESULT_SUCCESS ||
1252 	     tlv.result == EAP_TLV_RESULT_SUCCESS)) {
1253 		/*
1254 		 * Need to request Tunnel PAC when using authenticated
1255 		 * provisioning.
1256 		 */
1257 		wpa_printf(MSG_DEBUG, "EAP-FAST: Request Tunnel PAC");
1258 		tmp = eap_fast_pac_request();
1259 		resp = wpabuf_concat(resp, tmp);
1260 	}
1261 
1262 	if (tlv.result == EAP_TLV_RESULT_SUCCESS && !failed) {
1263 		tmp = eap_fast_tlv_result(EAP_TLV_RESULT_SUCCESS, 0);
1264 		resp = wpabuf_concat(tmp, resp);
1265 	} else if (failed) {
1266 		tmp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0);
1267 		resp = wpabuf_concat(tmp, resp);
1268 	}
1269 
1270 	if (resp && tlv.result == EAP_TLV_RESULT_SUCCESS && !failed &&
1271 	    tlv.crypto_binding && data->phase2_success) {
1272 		if (data->anon_provisioning) {
1273 			wpa_printf(MSG_DEBUG, "EAP-FAST: Unauthenticated "
1274 				   "provisioning completed successfully.");
1275 			ret->methodState = METHOD_DONE;
1276 			ret->decision = DECISION_FAIL;
1277 			sm->expected_failure = 1;
1278 		} else {
1279 			wpa_printf(MSG_DEBUG, "EAP-FAST: Authentication "
1280 				   "completed successfully.");
1281 			if (data->provisioning)
1282 				ret->methodState = METHOD_MAY_CONT;
1283 			else
1284 				ret->methodState = METHOD_DONE;
1285 			ret->decision = DECISION_UNCOND_SUCC;
1286 		}
1287 	}
1288 
1289 	if (resp == NULL) {
1290 		wpa_printf(MSG_DEBUG, "EAP-FAST: No recognized TLVs - send "
1291 			   "empty response packet");
1292 		resp = wpabuf_alloc(1);
1293 	}
1294 
1295 	return eap_fast_encrypt_response(sm, data, resp, identifier,
1296 					 out_data);
1297 }
1298 
1299 
eap_fast_decrypt(struct eap_sm * sm,struct eap_fast_data * data,struct eap_method_ret * ret,u8 identifier,const struct wpabuf * in_data,struct wpabuf ** out_data)1300 static int eap_fast_decrypt(struct eap_sm *sm, struct eap_fast_data *data,
1301 			    struct eap_method_ret *ret, u8 identifier,
1302 			    const struct wpabuf *in_data,
1303 			    struct wpabuf **out_data)
1304 {
1305 	struct wpabuf *in_decrypted;
1306 	int res;
1307 
1308 	wpa_printf(MSG_DEBUG, "EAP-FAST: Received %lu bytes encrypted data for"
1309 		   " Phase 2", (unsigned long) wpabuf_len(in_data));
1310 
1311 	if (data->pending_phase2_req) {
1312 		wpa_printf(MSG_DEBUG, "EAP-FAST: Pending Phase 2 request - "
1313 			   "skip decryption and use old data");
1314 		/* Clear TLS reassembly state. */
1315 		eap_peer_tls_reset_input(&data->ssl);
1316 
1317 		in_decrypted = data->pending_phase2_req;
1318 		data->pending_phase2_req = NULL;
1319 		goto continue_req;
1320 	}
1321 
1322 	if (wpabuf_len(in_data) == 0) {
1323 		/* Received TLS ACK - requesting more fragments */
1324 		return eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_FAST,
1325 					    data->fast_version,
1326 					    identifier, NULL, out_data);
1327 	}
1328 
1329 	res = eap_peer_tls_decrypt(sm, &data->ssl, in_data, &in_decrypted);
1330 	if (res)
1331 		return res;
1332 
1333 continue_req:
1334 	wpa_hexdump_buf(MSG_MSGDUMP, "EAP-FAST: Decrypted Phase 2 TLV(s)",
1335 			in_decrypted);
1336 
1337 	if (wpabuf_len(in_decrypted) < 4) {
1338 		wpa_printf(MSG_INFO, "EAP-FAST: Too short Phase 2 "
1339 			   "TLV frame (len=%lu)",
1340 			   (unsigned long) wpabuf_len(in_decrypted));
1341 		wpabuf_clear_free(in_decrypted);
1342 		return -1;
1343 	}
1344 
1345 	res = eap_fast_process_decrypted(sm, data, ret, identifier,
1346 					 in_decrypted, out_data);
1347 
1348 	wpabuf_clear_free(in_decrypted);
1349 
1350 	return res;
1351 }
1352 
1353 
eap_fast_get_a_id(const u8 * buf,size_t len,size_t * id_len)1354 static const u8 * eap_fast_get_a_id(const u8 *buf, size_t len, size_t *id_len)
1355 {
1356 	const u8 *a_id;
1357 	const struct pac_tlv_hdr *hdr;
1358 
1359 	/*
1360 	 * Parse authority identity (A-ID) from the EAP-FAST/Start. This
1361 	 * supports both raw A-ID and one inside an A-ID TLV.
1362 	 */
1363 	a_id = buf;
1364 	*id_len = len;
1365 	if (len > sizeof(*hdr)) {
1366 		int tlen;
1367 		hdr = (const struct pac_tlv_hdr *) buf;
1368 		tlen = be_to_host16(hdr->len);
1369 		if (be_to_host16(hdr->type) == PAC_TYPE_A_ID &&
1370 		    sizeof(*hdr) + tlen <= len) {
1371 			wpa_printf(MSG_DEBUG, "EAP-FAST: A-ID was in TLV "
1372 				   "(Start)");
1373 			a_id = (const u8 *) (hdr + 1);
1374 			*id_len = tlen;
1375 		}
1376 	}
1377 	wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: A-ID", a_id, *id_len);
1378 
1379 	return a_id;
1380 }
1381 
1382 
eap_fast_select_pac(struct eap_fast_data * data,const u8 * a_id,size_t a_id_len)1383 static void eap_fast_select_pac(struct eap_fast_data *data,
1384 				const u8 *a_id, size_t a_id_len)
1385 {
1386 	data->current_pac = eap_fast_get_pac(data->pac, a_id, a_id_len,
1387 					     PAC_TYPE_TUNNEL_PAC);
1388 	if (data->current_pac == NULL) {
1389 		/*
1390 		 * Tunnel PAC was not available for this A-ID. Try to use
1391 		 * Machine Authentication PAC, if one is available.
1392 		 */
1393 		data->current_pac = eap_fast_get_pac(
1394 			data->pac, a_id, a_id_len,
1395 			PAC_TYPE_MACHINE_AUTHENTICATION);
1396 	}
1397 
1398 	if (data->current_pac) {
1399 		wpa_printf(MSG_DEBUG, "EAP-FAST: PAC found for this A-ID "
1400 			   "(PAC-Type %d)", data->current_pac->pac_type);
1401 		wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-FAST: A-ID-Info",
1402 				  data->current_pac->a_id_info,
1403 				  data->current_pac->a_id_info_len);
1404 	}
1405 }
1406 
1407 
eap_fast_use_pac_opaque(struct eap_sm * sm,struct eap_fast_data * data,struct eap_fast_pac * pac)1408 static int eap_fast_use_pac_opaque(struct eap_sm *sm,
1409 				   struct eap_fast_data *data,
1410 				   struct eap_fast_pac *pac)
1411 {
1412 	u8 *tlv;
1413 	size_t tlv_len, olen;
1414 	struct eap_tlv_hdr *ehdr;
1415 
1416 	olen = pac->pac_opaque_len;
1417 	tlv_len = sizeof(*ehdr) + olen;
1418 	tlv = os_malloc(tlv_len);
1419 	if (tlv) {
1420 		ehdr = (struct eap_tlv_hdr *) tlv;
1421 		ehdr->tlv_type = host_to_be16(PAC_TYPE_PAC_OPAQUE);
1422 		ehdr->length = host_to_be16(olen);
1423 		os_memcpy(ehdr + 1, pac->pac_opaque, olen);
1424 	}
1425 	if (tlv == NULL ||
1426 	    tls_connection_client_hello_ext(sm->ssl_ctx, data->ssl.conn,
1427 					    TLS_EXT_PAC_OPAQUE,
1428 					    tlv, tlv_len) < 0) {
1429 		wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to add PAC-Opaque TLS "
1430 			   "extension");
1431 		os_free(tlv);
1432 		return -1;
1433 	}
1434 	os_free(tlv);
1435 
1436 	return 0;
1437 }
1438 
1439 
eap_fast_clear_pac_opaque_ext(struct eap_sm * sm,struct eap_fast_data * data)1440 static int eap_fast_clear_pac_opaque_ext(struct eap_sm *sm,
1441 					 struct eap_fast_data *data)
1442 {
1443 	if (tls_connection_client_hello_ext(sm->ssl_ctx, data->ssl.conn,
1444 					    TLS_EXT_PAC_OPAQUE, NULL, 0) < 0) {
1445 		wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to remove PAC-Opaque "
1446 			   "TLS extension");
1447 		return -1;
1448 	}
1449 	return 0;
1450 }
1451 
1452 
eap_fast_set_provisioning_ciphers(struct eap_sm * sm,struct eap_fast_data * data)1453 static int eap_fast_set_provisioning_ciphers(struct eap_sm *sm,
1454 					     struct eap_fast_data *data)
1455 {
1456 	u8 ciphers[7];
1457 	int count = 0;
1458 
1459 	if (data->provisioning_allowed & EAP_FAST_PROV_UNAUTH) {
1460 		wpa_printf(MSG_DEBUG, "EAP-FAST: Enabling unauthenticated "
1461 			   "provisioning TLS cipher suites");
1462 		ciphers[count++] = TLS_CIPHER_ANON_DH_AES128_SHA;
1463 	}
1464 
1465 	if (data->provisioning_allowed & EAP_FAST_PROV_AUTH) {
1466 		wpa_printf(MSG_DEBUG, "EAP-FAST: Enabling authenticated "
1467 			   "provisioning TLS cipher suites");
1468 		ciphers[count++] = TLS_CIPHER_RSA_DHE_AES256_SHA;
1469 		ciphers[count++] = TLS_CIPHER_RSA_DHE_AES128_SHA;
1470 		ciphers[count++] = TLS_CIPHER_AES256_SHA;
1471 		ciphers[count++] = TLS_CIPHER_AES128_SHA;
1472 		ciphers[count++] = TLS_CIPHER_RC4_SHA;
1473 	}
1474 
1475 	ciphers[count++] = TLS_CIPHER_NONE;
1476 
1477 	if (tls_connection_set_cipher_list(sm->ssl_ctx, data->ssl.conn,
1478 					   ciphers)) {
1479 		wpa_printf(MSG_INFO, "EAP-FAST: Could not configure TLS "
1480 			   "cipher suites for provisioning");
1481 		return -1;
1482 	}
1483 
1484 	return 0;
1485 }
1486 
1487 
eap_fast_process_start(struct eap_sm * sm,struct eap_fast_data * data,u8 flags,const u8 * pos,size_t left)1488 static int eap_fast_process_start(struct eap_sm *sm,
1489 				  struct eap_fast_data *data, u8 flags,
1490 				  const u8 *pos, size_t left)
1491 {
1492 	const u8 *a_id;
1493 	size_t a_id_len;
1494 
1495 	/* EAP-FAST Version negotiation (section 3.1) */
1496 	wpa_printf(MSG_DEBUG, "EAP-FAST: Start (server ver=%d, own ver=%d)",
1497 		   flags & EAP_TLS_VERSION_MASK, data->fast_version);
1498 	if ((flags & EAP_TLS_VERSION_MASK) < data->fast_version)
1499 		data->fast_version = flags & EAP_TLS_VERSION_MASK;
1500 	wpa_printf(MSG_DEBUG, "EAP-FAST: Using FAST version %d",
1501 		   data->fast_version);
1502 
1503 	a_id = eap_fast_get_a_id(pos, left, &a_id_len);
1504 	eap_fast_select_pac(data, a_id, a_id_len);
1505 
1506 	if (data->resuming && data->current_pac) {
1507 		wpa_printf(MSG_DEBUG, "EAP-FAST: Trying to resume session - "
1508 			   "do not add PAC-Opaque to TLS ClientHello");
1509 		if (eap_fast_clear_pac_opaque_ext(sm, data) < 0)
1510 			return -1;
1511 	} else if (data->current_pac) {
1512 		/*
1513 		 * PAC found for the A-ID and we are not resuming an old
1514 		 * session, so add PAC-Opaque extension to ClientHello.
1515 		 */
1516 		if (eap_fast_use_pac_opaque(sm, data, data->current_pac) < 0)
1517 			return -1;
1518 	} else {
1519 		/* No PAC found, so we must provision one. */
1520 		if (!data->provisioning_allowed) {
1521 			wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC found and "
1522 				   "provisioning disabled");
1523 			return -1;
1524 		}
1525 		wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC found - "
1526 			   "starting provisioning");
1527 		if (eap_fast_set_provisioning_ciphers(sm, data) < 0 ||
1528 		    eap_fast_clear_pac_opaque_ext(sm, data) < 0)
1529 			return -1;
1530 		data->provisioning = 1;
1531 	}
1532 
1533 	return 0;
1534 }
1535 
1536 
eap_fast_process(struct eap_sm * sm,void * priv,struct eap_method_ret * ret,const struct wpabuf * reqData)1537 static struct wpabuf * eap_fast_process(struct eap_sm *sm, void *priv,
1538 					struct eap_method_ret *ret,
1539 					const struct wpabuf *reqData)
1540 {
1541 	const struct eap_hdr *req;
1542 	size_t left;
1543 	int res;
1544 	u8 flags, id;
1545 	struct wpabuf *resp;
1546 	const u8 *pos;
1547 	struct eap_fast_data *data = priv;
1548 	struct wpabuf msg;
1549 
1550 	pos = eap_peer_tls_process_init(sm, &data->ssl, EAP_TYPE_FAST, ret,
1551 					reqData, &left, &flags);
1552 	if (pos == NULL)
1553 		return NULL;
1554 
1555 	req = wpabuf_head(reqData);
1556 	id = req->identifier;
1557 
1558 	if (flags & EAP_TLS_FLAGS_START) {
1559 		if (eap_fast_process_start(sm, data, flags, pos, left) < 0)
1560 			return NULL;
1561 
1562 		left = 0; /* A-ID is not used in further packet processing */
1563 	}
1564 
1565 	wpabuf_set(&msg, pos, left);
1566 
1567 	resp = NULL;
1568 	if (tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&
1569 	    !data->resuming) {
1570 		/* Process tunneled (encrypted) phase 2 data. */
1571 		res = eap_fast_decrypt(sm, data, ret, id, &msg, &resp);
1572 		if (res < 0) {
1573 			ret->methodState = METHOD_DONE;
1574 			ret->decision = DECISION_FAIL;
1575 			/*
1576 			 * Ack possible Alert that may have caused failure in
1577 			 * decryption.
1578 			 */
1579 			res = 1;
1580 		}
1581 	} else {
1582 		if (sm->waiting_ext_cert_check && data->pending_resp) {
1583 			struct eap_peer_config *config = eap_get_config(sm);
1584 
1585 			if (config->pending_ext_cert_check ==
1586 			    EXT_CERT_CHECK_GOOD) {
1587 				wpa_printf(MSG_DEBUG,
1588 					   "EAP-FAST: External certificate check succeeded - continue handshake");
1589 				resp = data->pending_resp;
1590 				data->pending_resp = NULL;
1591 				sm->waiting_ext_cert_check = 0;
1592 				return resp;
1593 			}
1594 
1595 			if (config->pending_ext_cert_check ==
1596 			    EXT_CERT_CHECK_BAD) {
1597 				wpa_printf(MSG_DEBUG,
1598 					   "EAP-FAST: External certificate check failed - force authentication failure");
1599 				ret->methodState = METHOD_DONE;
1600 				ret->decision = DECISION_FAIL;
1601 				sm->waiting_ext_cert_check = 0;
1602 				return NULL;
1603 			}
1604 
1605 			wpa_printf(MSG_DEBUG,
1606 				   "EAP-FAST: Continuing to wait external server certificate validation");
1607 			return NULL;
1608 		}
1609 
1610 		/* Continue processing TLS handshake (phase 1). */
1611 		res = eap_peer_tls_process_helper(sm, &data->ssl,
1612 						  EAP_TYPE_FAST,
1613 						  data->fast_version, id, &msg,
1614 						  &resp);
1615 		if (res < 0) {
1616 			wpa_printf(MSG_DEBUG,
1617 				   "EAP-FAST: TLS processing failed");
1618 			ret->methodState = METHOD_DONE;
1619 			ret->decision = DECISION_FAIL;
1620 			return resp;
1621 		}
1622 
1623 		if (sm->waiting_ext_cert_check) {
1624 			wpa_printf(MSG_DEBUG,
1625 				   "EAP-FAST: Waiting external server certificate validation");
1626 			wpabuf_clear_free(data->pending_resp);
1627 			data->pending_resp = resp;
1628 			return NULL;
1629 		}
1630 
1631 		if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) {
1632 			char cipher[80];
1633 			wpa_printf(MSG_DEBUG,
1634 				   "EAP-FAST: TLS done, proceed to Phase 2");
1635 			if (data->provisioning &&
1636 			    (!(data->provisioning_allowed &
1637 			       EAP_FAST_PROV_AUTH) ||
1638 			     tls_get_cipher(sm->ssl_ctx, data->ssl.conn,
1639 					    cipher, sizeof(cipher)) < 0 ||
1640 			     os_strstr(cipher, "ADH-") ||
1641 			     os_strstr(cipher, "anon"))) {
1642 				wpa_printf(MSG_DEBUG, "EAP-FAST: Using "
1643 					   "anonymous (unauthenticated) "
1644 					   "provisioning");
1645 				data->anon_provisioning = 1;
1646 			} else
1647 				data->anon_provisioning = 0;
1648 			data->resuming = 0;
1649 			if (eap_fast_derive_keys(sm, data) < 0) {
1650 				wpa_printf(MSG_DEBUG,
1651 					   "EAP-FAST: Could not derive keys");
1652 				ret->methodState = METHOD_DONE;
1653 				ret->decision = DECISION_FAIL;
1654 				wpabuf_clear_free(resp);
1655 				return NULL;
1656 			}
1657 		}
1658 
1659 		if (res == 2) {
1660 			/*
1661 			 * Application data included in the handshake message.
1662 			 */
1663 			wpabuf_clear_free(data->pending_phase2_req);
1664 			data->pending_phase2_req = resp;
1665 			resp = NULL;
1666 			res = eap_fast_decrypt(sm, data, ret, id, &msg, &resp);
1667 		}
1668 	}
1669 
1670 	if (res == 1) {
1671 		wpabuf_clear_free(resp);
1672 		return eap_peer_tls_build_ack(id, EAP_TYPE_FAST,
1673 					      data->fast_version);
1674 	}
1675 
1676 	return resp;
1677 }
1678 
1679 
1680 #if 0 /* FIX */
1681 static bool eap_fast_has_reauth_data(struct eap_sm *sm, void *priv)
1682 {
1683 	struct eap_fast_data *data = priv;
1684 	return tls_connection_established(sm->ssl_ctx, data->ssl.conn);
1685 }
1686 
1687 
1688 static void eap_fast_deinit_for_reauth(struct eap_sm *sm, void *priv)
1689 {
1690 	struct eap_fast_data *data = priv;
1691 
1692 	if (data->phase2_priv && data->phase2_method &&
1693 	    data->phase2_method->deinit_for_reauth)
1694 		data->phase2_method->deinit_for_reauth(sm, data->phase2_priv);
1695 	os_free(data->key_block_p);
1696 	data->key_block_p = NULL;
1697 	wpabuf_clear_free(data->pending_phase2_req);
1698 	data->pending_phase2_req = NULL;
1699 	wpabuf_clear_free(data->pending_resp);
1700 	data->pending_resp = NULL;
1701 }
1702 
1703 
1704 static void * eap_fast_init_for_reauth(struct eap_sm *sm, void *priv)
1705 {
1706 	struct eap_fast_data *data = priv;
1707 	if (eap_peer_tls_reauth_init(sm, &data->ssl)) {
1708 		os_free(data);
1709 		return NULL;
1710 	}
1711 	os_memset(data->key_data, 0, EAP_FAST_KEY_LEN);
1712 	os_memset(data->emsk, 0, EAP_EMSK_LEN);
1713 	os_free(data->session_id);
1714 	data->session_id = NULL;
1715 	if (data->phase2_priv && data->phase2_method &&
1716 	    data->phase2_method->init_for_reauth)
1717 		data->phase2_method->init_for_reauth(sm, data->phase2_priv);
1718 	data->phase2_success = 0;
1719 	data->resuming = 1;
1720 	data->provisioning = 0;
1721 	data->anon_provisioning = 0;
1722 	data->simck_idx = 0;
1723 	return priv;
1724 }
1725 #endif
1726 
1727 
eap_fast_get_status(struct eap_sm * sm,void * priv,char * buf,size_t buflen,int verbose)1728 static int eap_fast_get_status(struct eap_sm *sm, void *priv, char *buf,
1729 			       size_t buflen, int verbose)
1730 {
1731 	struct eap_fast_data *data = priv;
1732 	int len, ret;
1733 
1734 	len = eap_peer_tls_status(sm, &data->ssl, buf, buflen, verbose);
1735 	if (data->phase2_method) {
1736 		ret = os_snprintf(buf + len, buflen - len,
1737 				  "EAP-FAST Phase2 method=%s\n",
1738 				  data->phase2_method->name);
1739 		if (os_snprintf_error(buflen - len, ret))
1740 			return len;
1741 		len += ret;
1742 	}
1743 	return len;
1744 }
1745 
1746 
eap_fast_isKeyAvailable(struct eap_sm * sm,void * priv)1747 static bool eap_fast_isKeyAvailable(struct eap_sm *sm, void *priv)
1748 {
1749 	struct eap_fast_data *data = priv;
1750 	return data->success;
1751 }
1752 
1753 
eap_fast_getKey(struct eap_sm * sm,void * priv,size_t * len)1754 static u8 * eap_fast_getKey(struct eap_sm *sm, void *priv, size_t *len)
1755 {
1756 	struct eap_fast_data *data = priv;
1757 	u8 *key;
1758 
1759 	if (!data->success)
1760 		return NULL;
1761 
1762 	key = os_memdup(data->key_data, EAP_FAST_KEY_LEN);
1763 	if (key == NULL)
1764 		return NULL;
1765 
1766 	*len = EAP_FAST_KEY_LEN;
1767 
1768 	return key;
1769 }
1770 
1771 
eap_fast_get_session_id(struct eap_sm * sm,void * priv,size_t * len)1772 static u8 * eap_fast_get_session_id(struct eap_sm *sm, void *priv, size_t *len)
1773 {
1774 	struct eap_fast_data *data = priv;
1775 	u8 *id;
1776 
1777 	if (!data->success || !data->session_id)
1778 		return NULL;
1779 
1780 	id = os_memdup(data->session_id, data->id_len);
1781 	if (id == NULL)
1782 		return NULL;
1783 
1784 	*len = data->id_len;
1785 
1786 	return id;
1787 }
1788 
1789 
eap_fast_get_emsk(struct eap_sm * sm,void * priv,size_t * len)1790 static u8 * eap_fast_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
1791 {
1792 	struct eap_fast_data *data = priv;
1793 	u8 *key;
1794 
1795 	if (!data->success)
1796 		return NULL;
1797 
1798 	key = os_memdup(data->emsk, EAP_EMSK_LEN);
1799 	if (key == NULL)
1800 		return NULL;
1801 
1802 	*len = EAP_EMSK_LEN;
1803 
1804 	return key;
1805 }
1806 
1807 
eap_peer_fast_register(void)1808 int eap_peer_fast_register(void)
1809 {
1810 	struct eap_method *eap;
1811 
1812 	eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
1813 				    EAP_VENDOR_IETF, EAP_TYPE_FAST, "FAST");
1814 	if (eap == NULL)
1815 		return -1;
1816 
1817 	eap->init = eap_fast_init;
1818 	eap->deinit = eap_fast_deinit;
1819 	eap->process = eap_fast_process;
1820 	eap->isKeyAvailable = eap_fast_isKeyAvailable;
1821 	eap->getKey = eap_fast_getKey;
1822 	eap->getSessionId = eap_fast_get_session_id;
1823 	eap->get_status = eap_fast_get_status;
1824 #if 0
1825 	eap->has_reauth_data = eap_fast_has_reauth_data;
1826 	eap->deinit_for_reauth = eap_fast_deinit_for_reauth;
1827 	eap->init_for_reauth = eap_fast_init_for_reauth;
1828 #endif
1829 	eap->get_emsk = eap_fast_get_emsk;
1830 
1831 	return eap_peer_method_register(eap);
1832 }
1833