?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
libncp: Include <string.h> instead of <strings.h> for strlen() etc. prototypes.
[dragonfly.git] / contrib / wpa_supplicant-0.5.8 / eap_fast.c
blobd9347a986d9db7eaaf33b1c16b1ff3e366fab270
1 /*
2 * EAP peer method: EAP-FAST (draft-cam-winget-eap-fast-03.txt)
3 * Copyright (c) 2004-2006, Jouni Malinen <j@w1.fi>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Alternatively, this software may be distributed under the terms of BSD
10 * license.
11 *
12 * See README and COPYING for more details.
13 */
14
15 #include "includes.h"
16
17 #include "common.h"
18 #include "eap_i.h"
19 #include "eap_tls_common.h"
20 #include "config_ssid.h"
21 #include "tls.h"
22 #include "eap_tlv.h"
23 #include "sha1.h"
24 #include "config.h"
25
26 /* TODO:
27 * - encrypt PAC-Key in the PAC file
28 * - test session resumption and enable it if it interoperates
29 * - password change (pending mschapv2 packet; replay decrypted packet)
30 */
31
32 #define EAP_FAST_VERSION 1
33 #define EAP_FAST_KEY_LEN 64
34 #define EAP_FAST_PAC_KEY_LEN 32
35 #define EAP_FAST_SIMCK_LEN 40
36 #define EAP_FAST_SKS_LEN 40
37
38 #define TLS_EXT_PAC_OPAQUE 35
39
40 static const char *pac_file_hdr =
41 "wpa_supplicant EAP-FAST PAC file - version 1";
42
43
44 static void eap_fast_deinit(struct eap_sm *sm, void *priv);
45
46
47 #define PAC_TYPE_PAC_KEY 1
48 #define PAC_TYPE_PAC_OPAQUE 2
49 #define PAC_TYPE_CRED_LIFETIME 3
50 #define PAC_TYPE_A_ID 4
51 #define PAC_TYPE_I_ID 5
52 #define PAC_TYPE_SERVER_PROTECTED_DATA 6
53 #define PAC_TYPE_A_ID_INFO 7
54 #define PAC_TYPE_PAC_ACKNOWLEDGEMENT 8
55 #define PAC_TYPE_PAC_INFO 9
56
57 struct pac_tlv_hdr {
58 u16 type;
59 u16 len;
60 };
61
62
63 /* draft-cam-winget-eap-fast-provisioning-01.txt:
64 * 3.4 Key Derivations Used in the EAP-FAST Provisioning Exchange */
65 struct eap_fast_key_block_provisioning {
66 /* Extra key material after TLS key_block */
67 u8 session_key_seed[EAP_FAST_SKS_LEN];
68 u8 server_challenge[16];
69 u8 client_challenge[16];
70 };
71
72
73 struct eap_fast_pac {
74 struct eap_fast_pac *next;
75
76 u8 pac_key[EAP_FAST_PAC_KEY_LEN];
77 u8 *pac_opaque;
78 size_t pac_opaque_len;
79 u8 *pac_info;
80 size_t pac_info_len;
81 u8 *a_id;
82 size_t a_id_len;
83 u8 *i_id;
84 size_t i_id_len;
85 u8 *a_id_info;
86 size_t a_id_info_len;
87 };
88
89
90 struct eap_fast_data {
91 struct eap_ssl_data ssl;
92
93 int fast_version;
94
95 const struct eap_method *phase2_method;
96 void *phase2_priv;
97 int phase2_success;
98
99 struct eap_method_type phase2_type;
100 struct eap_method_type *phase2_types;
101 size_t num_phase2_types;
102 int resuming; /* starting a resumed session */
103 struct eap_fast_key_block_provisioning *key_block_p;
104 int provisioning_allowed; /* is PAC provisioning allowed */
105 int provisioning; /* doing PAC provisioning (not the normal auth) */
106
107 u8 key_data[EAP_FAST_KEY_LEN];
108 u8 emsk[EAP_EMSK_LEN];
109 int success;
110
111 struct eap_fast_pac *pac;
112 struct eap_fast_pac *current_pac;
113
114 int tls_master_secret_set;
115
116 u8 simck[EAP_FAST_SIMCK_LEN];
117 int simck_idx;
118 };
119
120
121 static void eap_fast_free_pac(struct eap_fast_pac *pac)
122 {
123 os_free(pac->pac_opaque);
124 os_free(pac->pac_info);
125 os_free(pac->a_id);
126 os_free(pac->i_id);
127 os_free(pac->a_id_info);
128 os_free(pac);
129 }
130
131
132 static struct eap_fast_pac * eap_fast_get_pac(struct eap_fast_data *data,
133 const u8 *a_id, size_t a_id_len)
134 {
135 struct eap_fast_pac *pac = data->pac;
136
137 while (pac) {
138 if (pac->a_id_len == a_id_len &&
139 os_memcmp(pac->a_id, a_id, a_id_len) == 0) {
140 return pac;
141 }
142 pac = pac->next;
143 }
144 return NULL;
145 }
146
147
148 static int eap_fast_add_pac(struct eap_fast_data *data,
149 struct eap_fast_pac *entry)
150 {
151 struct eap_fast_pac *pac, *prev;
152
153 if (entry == NULL || entry->a_id == NULL)
154 return -1;
155
156 /* Remove a possible old entry for the matching A-ID. */
157 pac = data->pac;
158 prev = NULL;
159 while (pac) {
160 if (pac->a_id_len == entry->a_id_len &&
161 os_memcmp(pac->a_id, entry->a_id, pac->a_id_len) == 0) {
162 if (prev == NULL) {
163 data->pac = pac->next;
164 } else {
165 prev->next = pac->next;
166 }
167 if (data->current_pac == pac)
168 data->current_pac = NULL;
169 eap_fast_free_pac(pac);
170 break;
171 }
172 prev = pac;
173 pac = pac->next;
174 }
175
176 /* Allocate a new entry and add it to the list of PACs. */
177 pac = os_zalloc(sizeof(*pac));
178 if (pac == NULL)
179 return -1;
180
181 os_memcpy(pac->pac_key, entry->pac_key, EAP_FAST_PAC_KEY_LEN);
182 if (entry->pac_opaque) {
183 pac->pac_opaque = os_malloc(entry->pac_opaque_len);
184 if (pac->pac_opaque == NULL) {
185 eap_fast_free_pac(pac);
186 return -1;
187 }
188 os_memcpy(pac->pac_opaque, entry->pac_opaque,
189 entry->pac_opaque_len);
190 pac->pac_opaque_len = entry->pac_opaque_len;
191 }
192 if (entry->pac_info) {
193 pac->pac_info = os_malloc(entry->pac_info_len);
194 if (pac->pac_info == NULL) {
195 eap_fast_free_pac(pac);
196 return -1;
197 }
198 os_memcpy(pac->pac_info, entry->pac_info,
199 entry->pac_info_len);
200 pac->pac_info_len = entry->pac_info_len;
201 }
202 if (entry->a_id) {
203 pac->a_id = os_malloc(entry->a_id_len);
204 if (pac->a_id == NULL) {
205 eap_fast_free_pac(pac);
206 return -1;
207 }
208 os_memcpy(pac->a_id, entry->a_id,
209 entry->a_id_len);
210 pac->a_id_len = entry->a_id_len;
211 }
212 if (entry->i_id) {
213 pac->i_id = os_malloc(entry->i_id_len);
214 if (pac->i_id == NULL) {
215 eap_fast_free_pac(pac);
216 return -1;
217 }
218 os_memcpy(pac->i_id, entry->i_id,
219 entry->i_id_len);
220 pac->i_id_len = entry->i_id_len;
221 }
222 if (entry->a_id_info) {
223 pac->a_id_info = os_malloc(entry->a_id_info_len);
224 if (pac->a_id_info == NULL) {
225 eap_fast_free_pac(pac);
226 return -1;
227 }
228 os_memcpy(pac->a_id_info, entry->a_id_info,
229 entry->a_id_info_len);
230 pac->a_id_info_len = entry->a_id_info_len;
231 }
232 pac->next = data->pac;
233 data->pac = pac;
234 return 0;
235 }
236
237
238 struct eap_fast_read_ctx {
239 FILE *f;
240 const char *pos;
241 const char *end;
242 };
243
244 static int eap_fast_read_line(struct eap_fast_read_ctx *rc, char *buf,
245 size_t buf_len)
246 {
247 char *pos;
248
249 if (rc->f) {
250 if (fgets(buf, buf_len, rc->f) == NULL)
251 return -1;
252 } else {
253 const char *l_end;
254 size_t len;
255 if (rc->pos >= rc->end)
256 return -1;
257 l_end = rc->pos;
258 while (l_end < rc->end && *l_end != '\n')
259 l_end++;
260 len = l_end - rc->pos;
261 if (len >= buf_len)
262 len = buf_len - 1;
263 os_memcpy(buf, rc->pos, len);
264 buf[len] = '\0';
265 rc->pos = l_end + 1;
266 }
267
268 buf[buf_len - 1] = '\0';
269 pos = buf;
270 while (*pos != '\0') {
271 if (*pos == '\n' || *pos == '\r') {
272 *pos = '\0';
273 break;
274 }
275 pos++;
276 }
277
278 return 0;
279 }
280
281
282 static u8 * eap_fast_parse_hex(const char *value, size_t *len)
283 {
284 int hlen;
285 u8 *buf;
286
287 if (value == NULL)
288 return NULL;
289 hlen = os_strlen(value);
290 if (hlen & 1)
291 return NULL;
292 *len = hlen / 2;
293 buf = os_malloc(*len);
294 if (buf == NULL)
295 return NULL;
296 if (hexstr2bin(value, buf, *len)) {
297 os_free(buf);
298 return NULL;
299 }
300 return buf;
301 }
302
303
304 static int eap_fast_load_pac(struct eap_sm *sm, struct eap_fast_data *data,
305 const char *pac_file)
306 {
307 struct eap_fast_read_ctx rc;
308 struct eap_fast_pac *pac = NULL;
309 int count = 0;
310 char *buf, *pos;
311 const int buf_len = 2048;
312 int ret = 0, line = 0;
313
314 if (pac_file == NULL)
315 return -1;
316
317 os_memset(&rc, 0, sizeof(rc));
318
319 if (os_strncmp(pac_file, "blob://", 7) == 0) {
320 const struct wpa_config_blob *blob;
321 blob = eap_get_config_blob(sm, pac_file + 7);
322 if (blob == NULL) {
323 wpa_printf(MSG_INFO, "EAP-FAST: No PAC blob '%s' - "
324 "assume no PAC entries have been "
325 "provisioned", pac_file + 7);
326 return 0;
327 }
328 rc.pos = (char *) blob->data;
329 rc.end = (char *) blob->data + blob->len;
330 } else {
331 rc.f = fopen(pac_file, "r");
332 if (rc.f == NULL) {
333 wpa_printf(MSG_INFO, "EAP-FAST: No PAC file '%s' - "
334 "assume no PAC entries have been "
335 "provisioned", pac_file);
336 return 0;
337 }
338 }
339
340 buf = os_malloc(buf_len);
341 if (buf == NULL) {
342 return -1;
343 }
344
345 line++;
346 if (eap_fast_read_line(&rc, buf, buf_len) < 0 ||
347 os_strcmp(pac_file_hdr, buf) != 0) {
348 wpa_printf(MSG_INFO, "EAP-FAST: Unrecognized header line in "
349 "PAC file '%s'", pac_file);
350 os_free(buf);
351 if (rc.f)
352 fclose(rc.f);
353 return -1;
354 }
355
356 while (eap_fast_read_line(&rc, buf, buf_len) == 0) {
357 line++;
358 pos = os_strchr(buf, '=');
359 if (pos) {
360 *pos++ = '\0';
361 }
362
363 if (os_strcmp(buf, "START") == 0) {
364 if (pac) {
365 wpa_printf(MSG_INFO, "EAP-FAST: START line "
366 "without END in '%s:%d'",
367 pac_file, line);
368 ret = -1;
369 break;
370 }
371 pac = os_zalloc(sizeof(*pac));
372 if (pac == NULL) {
373 wpa_printf(MSG_INFO, "EAP-FAST: No memory for "
374 "PAC entry");
375 ret = -1;
376 break;
377 }
378 } else if (os_strcmp(buf, "END") == 0) {
379 if (pac == NULL) {
380 wpa_printf(MSG_INFO, "EAP-FAST: END line "
381 "without START in '%s:%d'",
382 pac_file, line);
383 ret = -1;
384 break;
385 }
386 pac->next = data->pac;
387 data->pac = pac;
388 pac = NULL;
389 count++;
390 } else if (pac && os_strcmp(buf, "PAC-Key") == 0) {
391 u8 *key;
392 size_t key_len;
393 key = eap_fast_parse_hex(pos, &key_len);
394 if (key == NULL || key_len != EAP_FAST_PAC_KEY_LEN) {
395 wpa_printf(MSG_INFO, "EAP-FAST: Invalid "
396 "PAC-Key '%s:%d'", pac_file, line);
397 ret = -1;
398 os_free(key);
399 break;
400 }
401
402 os_memcpy(pac->pac_key, key, EAP_FAST_PAC_KEY_LEN);
403 os_free(key);
404 } else if (pac && os_strcmp(buf, "PAC-Opaque") == 0) {
405 os_free(pac->pac_opaque);
406 pac->pac_opaque =
407 eap_fast_parse_hex(pos, &pac->pac_opaque_len);
408 if (pac->pac_opaque == NULL) {
409 wpa_printf(MSG_INFO, "EAP-FAST: Invalid "
410 "PAC-Opaque '%s:%d'",
411 pac_file, line);
412 ret = -1;
413 break;
414 }
415 } else if (pac && os_strcmp(buf, "A-ID") == 0) {
416 os_free(pac->a_id);
417 pac->a_id = eap_fast_parse_hex(pos, &pac->a_id_len);
418 if (pac->a_id == NULL) {
419 wpa_printf(MSG_INFO, "EAP-FAST: Invalid "
420 "A-ID '%s:%d'", pac_file, line);
421 ret = -1;
422 break;
423 }
424 } else if (pac && os_strcmp(buf, "I-ID") == 0) {
425 os_free(pac->i_id);
426 pac->i_id = eap_fast_parse_hex(pos, &pac->i_id_len);
427 if (pac->i_id == NULL) {
428 wpa_printf(MSG_INFO, "EAP-FAST: Invalid "
429 "I-ID '%s:%d'", pac_file, line);
430 ret = -1;
431 break;
432 }
433 } else if (pac && os_strcmp(buf, "A-ID-Info") == 0) {
434 os_free(pac->a_id_info);
435 pac->a_id_info =
436 eap_fast_parse_hex(pos, &pac->a_id_info_len);
437 if (pac->a_id_info == NULL) {
438 wpa_printf(MSG_INFO, "EAP-FAST: Invalid "
439 "A-ID-Info '%s:%d'",
440 pac_file, line);
441 ret = -1;
442 break;
443 }
444 }
445 }
446
447 if (pac) {
448 wpa_printf(MSG_INFO, "EAP-FAST: PAC block not terminated with "
449 "END in '%s'", pac_file);
450 eap_fast_free_pac(pac);
451 ret = -1;
452 }
453
454 os_free(buf);
455 if (rc.f)
456 fclose(rc.f);
457
458 if (ret == 0) {
459 wpa_printf(MSG_DEBUG, "EAP-FAST: read %d PAC entries from "
460 "'%s'", count, pac_file);
461 }
462
463 return ret;
464 }
465
466
467 static void eap_fast_write(char **buf, char **pos, size_t *buf_len,
468 const char *field, const u8 *data,
469 size_t len, int txt)
470 {
471 size_t i, need;
472 int ret;
473
474 if (data == NULL || *buf == NULL)
475 return;
476
477 need = os_strlen(field) + len * 2 + 30;
478 if (txt)
479 need += os_strlen(field) + len + 20;
480
481 if (*pos - *buf + need > *buf_len) {
482 char *nbuf = os_realloc(*buf, *buf_len + need);
483 if (nbuf == NULL) {
484 os_free(*buf);
485 *buf = NULL;
486 return;
487 }
488 *buf = nbuf;
489 *buf_len += need;
490 }
491
492 ret = os_snprintf(*pos, *buf + *buf_len - *pos, "%s=", field);
493 if (ret < 0 || ret >= *buf + *buf_len - *pos)
494 return;
495 *pos += ret;
496 *pos += wpa_snprintf_hex(*pos, *buf + *buf_len - *pos, data, len);
497 ret = os_snprintf(*pos, *buf + *buf_len - *pos, "\n");
498 if (ret < 0 || ret >= *buf + *buf_len - *pos)
499 return;
500 *pos += ret;
501
502 if (txt) {
503 ret = os_snprintf(*pos, *buf + *buf_len - *pos,
504 "%s-txt=", field);
505 if (ret < 0 || ret >= *buf + *buf_len - *pos)
506 return;
507 *pos += ret;
508 for (i = 0; i < len; i++) {
509 ret = os_snprintf(*pos, *buf + *buf_len - *pos,
510 "%c", data[i]);
511 if (ret < 0 || ret >= *buf + *buf_len - *pos)
512 return;
513 *pos += ret;
514 }
515 ret = os_snprintf(*pos, *buf + *buf_len - *pos, "\n");
516 if (ret < 0 || ret >= *buf + *buf_len - *pos)
517 return;
518 *pos += ret;
519 }
520 }
521
522
523 static int eap_fast_save_pac(struct eap_sm *sm, struct eap_fast_data *data,
524 const char *pac_file)
525 {
526 FILE *f;
527 struct eap_fast_pac *pac;
528 int count = 0, ret;
529 char *buf, *pos;
530 size_t buf_len;
531
532 if (pac_file == NULL)
533 return -1;
534
535 buf_len = 1024;
536 pos = buf = os_malloc(buf_len);
537 if (buf == NULL)
538 return -1;
539
540 ret = os_snprintf(pos, buf + buf_len - pos, "%s\n", pac_file_hdr);
541 if (ret < 0 || ret >= buf + buf_len - pos) {
542 os_free(buf);
543 return -1;
544 }
545 pos += ret;
546
547 pac = data->pac;
548 while (pac) {
549 ret = os_snprintf(pos, buf + buf_len - pos, "START\n");
550 if (ret < 0 || ret >= buf + buf_len - pos) {
551 os_free(buf);
552 return -1;
553 }
554 pos += ret;
555 eap_fast_write(&buf, &pos, &buf_len, "PAC-Key", pac->pac_key,
556 EAP_FAST_PAC_KEY_LEN, 0);
557 eap_fast_write(&buf, &pos, &buf_len, "PAC-Opaque",
558 pac->pac_opaque, pac->pac_opaque_len, 0);
559 eap_fast_write(&buf, &pos, &buf_len, "PAC-Info", pac->pac_info,
560 pac->pac_info_len, 0);
561 eap_fast_write(&buf, &pos, &buf_len, "A-ID", pac->a_id,
562 pac->a_id_len, 0);
563 eap_fast_write(&buf, &pos, &buf_len, "I-ID", pac->i_id,
564 pac->i_id_len, 1);
565 eap_fast_write(&buf, &pos, &buf_len, "A-ID-Info",
566 pac->a_id_info, pac->a_id_info_len, 1);
567 if (buf == NULL) {
568 wpa_printf(MSG_DEBUG, "EAP-FAST: No memory for PAC "
569 "data");
570 return -1;
571 }
572 ret = os_snprintf(pos, buf + buf_len - pos, "END\n");
573 if (ret < 0 || ret >= buf + buf_len - pos) {
574 os_free(buf);
575 return -1;
576 }
577 pos += ret;
578 count++;
579 pac = pac->next;
580 }
581
582 if (os_strncmp(pac_file, "blob://", 7) == 0) {
583 struct wpa_config_blob *blob;
584 blob = os_zalloc(sizeof(*blob));
585 if (blob == NULL) {
586 os_free(buf);
587 return -1;
588 }
589 blob->data = (u8 *) buf;
590 blob->len = pos - buf;
591 buf = NULL;
592 blob->name = os_strdup(pac_file + 7);
593 if (blob->name == NULL) {
594 os_free(blob->data);
595 os_free(blob);
596 return -1;
597 }
598 eap_set_config_blob(sm, blob);
599 } else {
600 f = fopen(pac_file, "w");
601 if (f == NULL) {
602 wpa_printf(MSG_INFO, "EAP-FAST: Failed to open PAC "
603 "file '%s' for writing", pac_file);
604 os_free(buf);
605 return -1;
606 }
607 fprintf(f, "%s", buf);
608 os_free(buf);
609 fclose(f);
610 }
611
612 wpa_printf(MSG_DEBUG, "EAP-FAST: wrote %d PAC entries into '%s'",
613 count, pac_file);
614
615 return 0;
616 }
617
618
619 static void * eap_fast_init(struct eap_sm *sm)
620 {
621 struct eap_fast_data *data;
622 struct wpa_ssid *config = eap_get_config(sm);
623
624 data = os_zalloc(sizeof(*data));
625 if (data == NULL)
626 return NULL;
627 data->fast_version = EAP_FAST_VERSION;
628
629 if (config && config->phase1) {
630 if (os_strstr(config->phase1, "fast_provisioning=1")) {
631 data->provisioning_allowed = 1;
632 wpa_printf(MSG_DEBUG, "EAP-FAST: Automatic PAC "
633 "provisioning is allowed");
634 }
635 }
636
637 if (config && config->phase2) {
638 char *start, *pos, *buf;
639 struct eap_method_type *methods = NULL, *_methods;
640 u8 method;
641 size_t num_methods = 0;
642 start = buf = os_strdup(config->phase2);
643 if (buf == NULL) {
644 eap_fast_deinit(sm, data);
645 return NULL;
646 }
647 while (start && *start != '\0') {
648 int vendor;
649 pos = os_strstr(start, "auth=");
650 if (pos == NULL)
651 break;
652 if (start != pos && *(pos - 1) != ' ') {
653 start = pos + 5;
654 continue;
655 }
656
657 start = pos + 5;
658 pos = os_strchr(start, ' ');
659 if (pos)
660 *pos++ = '\0';
661 method = eap_get_phase2_type(start, &vendor);
662 if (vendor == EAP_VENDOR_IETF &&
663 method == EAP_TYPE_NONE) {
664 wpa_printf(MSG_ERROR, "EAP-FAST: Unsupported "
665 "Phase2 method '%s'", start);
666 } else {
667 num_methods++;
668 _methods = os_realloc(
669 methods,
670 num_methods * sizeof(*methods));
671 if (_methods == NULL) {
672 os_free(methods);
673 os_free(buf);
674 eap_fast_deinit(sm, data);
675 return NULL;
676 }
677 methods = _methods;
678 methods[num_methods - 1].vendor = vendor;
679 methods[num_methods - 1].method = method;
680 }
681
682 start = pos;
683 }
684 os_free(buf);
685 data->phase2_types = methods;
686 data->num_phase2_types = num_methods;
687 }
688 if (data->phase2_types == NULL) {
689 data->phase2_types =
690 eap_get_phase2_types(config, &data->num_phase2_types);
691 }
692 if (data->phase2_types == NULL) {
693 wpa_printf(MSG_ERROR, "EAP-FAST: No Phase2 method available");
694 eap_fast_deinit(sm, data);
695 return NULL;
696 }
697 wpa_hexdump(MSG_DEBUG, "EAP-FAST: Phase2 EAP types",
698 (u8 *) data->phase2_types,
699 data->num_phase2_types * sizeof(struct eap_method_type));
700 data->phase2_type.vendor = EAP_VENDOR_IETF;
701 data->phase2_type.method = EAP_TYPE_NONE;
702
703 if (eap_tls_ssl_init(sm, &data->ssl, config)) {
704 wpa_printf(MSG_INFO, "EAP-FAST: Failed to initialize SSL.");
705 eap_fast_deinit(sm, data);
706 return NULL;
707 }
708
709 /* The local RADIUS server in a Cisco AP does not seem to like empty
710 * fragments before data, so disable that workaround for CBC.
711 * TODO: consider making this configurable */
712 tls_connection_enable_workaround(sm->ssl_ctx, data->ssl.conn);
713
714 if (eap_fast_load_pac(sm, data, config->pac_file) < 0) {
715 eap_fast_deinit(sm, data);
716 return NULL;
717 }
718
719 if (data->pac == NULL && !data->provisioning_allowed) {
720 wpa_printf(MSG_INFO, "EAP-FAST: No PAC configured and "
721 "provisioning disabled");
722 eap_fast_deinit(sm, data);
723 return NULL;
724 }
725
726 return data;
727 }
728
729
730 static void eap_fast_deinit(struct eap_sm *sm, void *priv)
731 {
732 struct eap_fast_data *data = priv;
733 struct eap_fast_pac *pac, *prev;
734
735 if (data == NULL)
736 return;
737 if (data->phase2_priv && data->phase2_method)
738 data->phase2_method->deinit(sm, data->phase2_priv);
739 os_free(data->phase2_types);
740 os_free(data->key_block_p);
741 eap_tls_ssl_deinit(sm, &data->ssl);
742
743 pac = data->pac;
744 prev = NULL;
745 while (pac) {
746 prev = pac;
747 pac = pac->next;
748 eap_fast_free_pac(prev);
749 }
750 os_free(data);
751 }
752
753
754 static int eap_fast_encrypt(struct eap_sm *sm, struct eap_fast_data *data,
755 int id, const u8 *plain, size_t plain_len,
756 u8 **out_data, size_t *out_len)
757 {
758 int res;
759 u8 *pos;
760 struct eap_hdr *resp;
761
762 /* TODO: add support for fragmentation, if needed. This will need to
763 * add TLS Message Length field, if the frame is fragmented. */
764 resp = os_malloc(sizeof(struct eap_hdr) + 2 + data->ssl.tls_out_limit);
765 if (resp == NULL)
766 return 0;
767
768 resp->code = EAP_CODE_RESPONSE;
769 resp->identifier = id;
770
771 pos = (u8 *) (resp + 1);
772 *pos++ = EAP_TYPE_FAST;
773 *pos++ = data->fast_version;
774
775 res = tls_connection_encrypt(sm->ssl_ctx, data->ssl.conn,
776 plain, plain_len,
777 pos, data->ssl.tls_out_limit);
778 if (res < 0) {
779 wpa_printf(MSG_INFO, "EAP-FAST: Failed to encrypt Phase 2 "
780 "data");
781 os_free(resp);
782 return 0;
783 }
784
785 *out_len = sizeof(struct eap_hdr) + 2 + res;
786 resp->length = host_to_be16(*out_len);
787 *out_data = (u8 *) resp;
788 return 0;
789 }
790
791
792 static int eap_fast_phase2_nak(struct eap_fast_data *data,
793 struct eap_hdr *hdr,
794 u8 **resp, size_t *resp_len)
795 {
796 struct eap_hdr *resp_hdr;
797 u8 *pos = (u8 *) (hdr + 1);
798 size_t i;
799
800 /* TODO: add support for expanded Nak */
801 wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 Request: Nak type=%d", *pos);
802 wpa_hexdump(MSG_DEBUG, "EAP-FAST: Allowed Phase2 EAP types",
803 (u8 *) data->phase2_types,
804 data->num_phase2_types * sizeof(struct eap_method_type));
805 *resp_len = sizeof(struct eap_hdr) + 1;
806 *resp = os_malloc(*resp_len + data->num_phase2_types);
807 if (*resp == NULL)
808 return -1;
809
810 resp_hdr = (struct eap_hdr *) (*resp);
811 resp_hdr->code = EAP_CODE_RESPONSE;
812 resp_hdr->identifier = hdr->identifier;
813 pos = (u8 *) (resp_hdr + 1);
814 *pos++ = EAP_TYPE_NAK;
815 for (i = 0; i < data->num_phase2_types; i++) {
816 if (data->phase2_types[i].vendor == EAP_VENDOR_IETF &&
817 data->phase2_types[i].method < 256) {
818 (*resp_len)++;
819 *pos++ = data->phase2_types[i].method;
820 }
821 }
822 resp_hdr->length = host_to_be16(*resp_len);
823
824 return 0;
825 }
826
827
828 static int eap_fast_derive_msk(struct eap_fast_data *data)
829 {
830 /* Derive EAP Master Session Keys (section 5.4) */
831 sha1_t_prf(data->simck, EAP_FAST_SIMCK_LEN,
832 "Session Key Generating Function", (u8 *) "", 0,
833 data->key_data, EAP_FAST_KEY_LEN);
834 wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Derived key (MSK)",
835 data->key_data, EAP_FAST_KEY_LEN);
836
837 sha1_t_prf(data->simck, EAP_FAST_SIMCK_LEN,
838 "Extended Session Key Generating Function",
839 (u8 *) "", 0, data->emsk, EAP_EMSK_LEN);
840 wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Derived key (EMSK)",
841 data->emsk, EAP_EMSK_LEN);
842
843 data->success = 1;
844
845 return 0;
846 }
847
848
849 static int eap_fast_set_tls_master_secret(struct eap_sm *sm,
850 struct eap_fast_data *data,
851 const u8 *tls, size_t tls_len)
852 {
853 struct tls_keys keys;
854 u8 master_secret[48], *seed;
855 const u8 *server_random;
856 size_t seed_len, server_random_len;
857
858 if (data->tls_master_secret_set || !data->current_pac ||
859 tls_connection_get_keys(sm->ssl_ctx, data->ssl.conn, &keys) ||
860 keys.client_random == NULL) {
861 return 0;
862 }
863
864 wpa_hexdump(MSG_DEBUG, "EAP-FAST: client_random",
865 keys.client_random, keys.client_random_len);
866
867 /* TLS master secret is needed before TLS library has processed this
868 * message which includes both ServerHello and an encrypted handshake
869 * message, so we need to parse server_random from this message before
870 * passing it to TLS library.
871 *
872 * Example TLS packet header:
873 * (16 03 01 00 2a 02 00 00 26 03 01 <32 bytes server_random>)
874 * Content Type: Handshake: 0x16
875 * Version: TLS 1.0 (0x0301)
876 * Lenghth: 42 (0x002a)
877 * Handshake Type: Server Hello: 0x02
878 * Length: 38 (0x000026)
879 * Version TLS 1.0 (0x0301)
880 * Random: 32 bytes
881 */
882 if (tls_len < 43 || tls[0] != 0x16 ||
883 tls[1] != 0x03 || tls[2] != 0x01 ||
884 tls[5] != 0x02 || tls[9] != 0x03 || tls[10] != 0x01) {
885 wpa_hexdump(MSG_DEBUG, "EAP-FAST: unrecognized TLS "
886 "ServerHello", tls, tls_len);
887 return -1;
888 }
889 server_random = tls + 11;
890 server_random_len = 32;
891 wpa_hexdump(MSG_DEBUG, "EAP-FAST: server_random",
892 server_random, server_random_len);
893
894 seed_len = keys.client_random_len + server_random_len;
895 seed = os_malloc(seed_len);
896 if (seed == NULL)
897 return -1;
898 os_memcpy(seed, server_random, server_random_len);
899 os_memcpy(seed + server_random_len,
900 keys.client_random, keys.client_random_len);
901
902 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: T-PRF seed", seed, seed_len);
903 wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: PAC-Key",
904 data->current_pac->pac_key, EAP_FAST_PAC_KEY_LEN);
905 /* master_secret = T-PRF(PAC-Key, "PAC to master secret label hash",
906 * server_random + client_random, 48) */
907 sha1_t_prf(data->current_pac->pac_key, EAP_FAST_PAC_KEY_LEN,
908 "PAC to master secret label hash",
909 seed, seed_len, master_secret, sizeof(master_secret));
910 os_free(seed);
911 wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: TLS pre-master-secret",
912 master_secret, sizeof(master_secret));
913
914 data->tls_master_secret_set = 1;
915
916 return tls_connection_set_master_key(sm->ssl_ctx, data->ssl.conn,
917 master_secret,
918 sizeof(master_secret));
919 }
920
921
922 static u8 * eap_fast_derive_key(struct eap_sm *sm, struct eap_ssl_data *data,
923 char *label, size_t len)
924 {
925 struct tls_keys keys;
926 u8 *rnd = NULL, *out;
927 int block_size;
928
929 block_size = tls_connection_get_keyblock_size(sm->ssl_ctx, data->conn);
930 if (block_size < 0)
931 return NULL;
932
933 out = os_malloc(block_size + len);
934 if (out == NULL)
935 return NULL;
936
937 if (tls_connection_prf(sm->ssl_ctx, data->conn, label, 1, out,
938 block_size + len) == 0) {
939 os_memmove(out, out + block_size, len);
940 return out;
941 }
942
943 if (tls_connection_get_keys(sm->ssl_ctx, data->conn, &keys))
944 goto fail;
945
946 rnd = os_malloc(keys.client_random_len + keys.server_random_len);
947 if (rnd == NULL)
948 goto fail;
949
950 os_memcpy(rnd, keys.server_random, keys.server_random_len);
951 os_memcpy(rnd + keys.server_random_len, keys.client_random,
952 keys.client_random_len);
953
954 wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: master_secret for key "
955 "expansion", keys.master_key, keys.master_key_len);
956 if (tls_prf(keys.master_key, keys.master_key_len,
957 label, rnd, keys.client_random_len +
958 keys.server_random_len, out, block_size + len))
959 goto fail;
960 os_free(rnd);
961 os_memmove(out, out + block_size, len);
962 return out;
963
964 fail:
965 os_free(rnd);
966 os_free(out);
967 return NULL;
968 }
969
970
971 static void eap_fast_derive_key_auth(struct eap_sm *sm,
972 struct eap_fast_data *data)
973 {
974 u8 *sks;
975
976 /* draft-cam-winget-eap-fast-05.txt:
977 * 5.1 EAP-FAST Authentication Phase 1: Key Derivations
978 * Extra key material after TLS key_block: session_ket_seed[40]
979 */
980
981 sks = eap_fast_derive_key(sm, &data->ssl, "key expansion",
982 EAP_FAST_SKS_LEN);
983 if (sks == NULL) {
984 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to derive "
985 "session_key_seed");
986 return;
987 }
988
989 /*
990 * draft-cam-winget-eap-fast-05.txt, 5.2:
991 * S-IMCK[0] = session_key_seed
992 */
993 wpa_hexdump_key(MSG_DEBUG,
994 "EAP-FAST: session_key_seed (SKS = S-IMCK[0])",
995 sks, EAP_FAST_SKS_LEN);
996 data->simck_idx = 0;
997 os_memcpy(data->simck, sks, EAP_FAST_SIMCK_LEN);
998 os_free(sks);
999 }
1000
1001
1002 static void eap_fast_derive_key_provisioning(struct eap_sm *sm,
1003 struct eap_fast_data *data)
1004 {
1005 os_free(data->key_block_p);
1006 data->key_block_p = (struct eap_fast_key_block_provisioning *)
1007 eap_fast_derive_key(sm, &data->ssl, "key expansion",
1008 sizeof(*data->key_block_p));
1009 if (data->key_block_p == NULL) {
1010 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to derive key block");
1011 return;
1012 }
1013 /*
1014 * draft-cam-winget-eap-fast-05.txt, 5.2:
1015 * S-IMCK[0] = session_key_seed
1016 */
1017 wpa_hexdump_key(MSG_DEBUG,
1018 "EAP-FAST: session_key_seed (SKS = S-IMCK[0])",
1019 data->key_block_p->session_key_seed,
1020 sizeof(data->key_block_p->session_key_seed));
1021 data->simck_idx = 0;
1022 os_memcpy(data->simck, data->key_block_p->session_key_seed,
1023 EAP_FAST_SIMCK_LEN);
1024 wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: server_challenge",
1025 data->key_block_p->server_challenge,
1026 sizeof(data->key_block_p->server_challenge));
1027 wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: client_challenge",
1028 data->key_block_p->client_challenge,
1029 sizeof(data->key_block_p->client_challenge));
1030 }
1031
1032
1033 static void eap_fast_derive_keys(struct eap_sm *sm, struct eap_fast_data *data)
1034 {
1035 if (data->current_pac) {
1036 eap_fast_derive_key_auth(sm, data);
1037 } else {
1038 eap_fast_derive_key_provisioning(sm, data);
1039 }
1040 }
1041
1042
1043 static int eap_fast_phase2_request(struct eap_sm *sm,
1044 struct eap_fast_data *data,
1045 struct eap_method_ret *ret,
1046 struct eap_hdr *hdr,
1047 u8 **resp, size_t *resp_len)
1048 {
1049 size_t len = be_to_host16(hdr->length);
1050 u8 *pos;
1051 struct eap_method_ret iret;
1052
1053 if (len <= sizeof(struct eap_hdr)) {
1054 wpa_printf(MSG_INFO, "EAP-FAST: too short "
1055 "Phase 2 request (len=%lu)", (unsigned long) len);
1056 return -1;
1057 }
1058 pos = (u8 *) (hdr + 1);
1059 wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 Request: type=%d", *pos);
1060 switch (*pos) {
1061 case EAP_TYPE_IDENTITY:
1062 *resp = eap_sm_buildIdentity(sm, hdr->identifier, resp_len, 1);
1063 break;
1064 default:
1065 if (data->phase2_type.vendor == EAP_VENDOR_IETF &&
1066 data->phase2_type.method == EAP_TYPE_NONE) {
1067 size_t i;
1068 for (i = 0; i < data->num_phase2_types; i++) {
1069 if (data->phase2_types[i].vendor !=
1070 EAP_VENDOR_IETF ||
1071 data->phase2_types[i].method != *pos)
1072 continue;
1073
1074 data->phase2_type.vendor =
1075 data->phase2_types[i].vendor;
1076 data->phase2_type.method =
1077 data->phase2_types[i].method;
1078 wpa_printf(MSG_DEBUG, "EAP-FAST: Selected "
1079 "Phase 2 EAP vendor %d method %d",
1080 data->phase2_type.vendor,
1081 data->phase2_type.method);
1082 break;
1083 }
1084 }
1085 if (*pos != data->phase2_type.method ||
1086 *pos == EAP_TYPE_NONE) {
1087 if (eap_fast_phase2_nak(data, hdr, resp, resp_len))
1088 return -1;
1089 return 0;
1090 }
1091
1092 if (data->phase2_priv == NULL) {
1093 data->phase2_method = eap_sm_get_eap_methods(
1094 data->phase2_type.vendor,
1095 data->phase2_type.method);
1096 if (data->phase2_method) {
1097 if (data->key_block_p) {
1098 sm->auth_challenge =
1099 data->key_block_p->
1100 server_challenge;
1101 sm->peer_challenge =
1102 data->key_block_p->
1103 client_challenge;
1104 }
1105 sm->init_phase2 = 1;
1106 sm->mschapv2_full_key = 1;
1107 data->phase2_priv =
1108 data->phase2_method->init(sm);
1109 sm->init_phase2 = 0;
1110 sm->mschapv2_full_key = 0;
1111 sm->auth_challenge = NULL;
1112 sm->peer_challenge = NULL;
1113 }
1114 }
1115 if (data->phase2_priv == NULL || data->phase2_method == NULL) {
1116 wpa_printf(MSG_INFO, "EAP-FAST: failed to initialize "
1117 "Phase 2 EAP method %d", *pos);
1118 ret->methodState = METHOD_DONE;
1119 ret->decision = DECISION_FAIL;
1120 return -1;
1121 }
1122 os_memset(&iret, 0, sizeof(iret));
1123 *resp = data->phase2_method->process(sm, data->phase2_priv,
1124 &iret, (u8 *) hdr, len,
1125 resp_len);
1126 if (*resp == NULL ||
1127 (iret.methodState == METHOD_DONE &&
1128 iret.decision == DECISION_FAIL)) {
1129 ret->methodState = METHOD_DONE;
1130 ret->decision = DECISION_FAIL;
1131 } else if ((iret.methodState == METHOD_DONE ||
1132 iret.methodState == METHOD_MAY_CONT) &&
1133 (iret.decision == DECISION_UNCOND_SUCC ||
1134 iret.decision == DECISION_COND_SUCC)) {
1135 data->phase2_success = 1;
1136 }
1137 if (*resp == NULL)
1138 return -1;
1139 break;
1140 }
1141 return 0;
1142 }
1143
1144
1145 static u8 * eap_fast_tlv_nak(int vendor_id, int tlv_type, size_t *len)
1146 {
1147 struct eap_tlv_nak_tlv *nak;
1148 *len = sizeof(*nak);
1149 nak = os_malloc(*len);
1150 if (nak == NULL)
1151 return NULL;
1152 nak->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY | EAP_TLV_NAK_TLV);
1153 nak->length = host_to_be16(6);
1154 nak->vendor_id = host_to_be32(vendor_id);
1155 nak->nak_type = host_to_be16(tlv_type);
1156 return (u8 *) nak;
1157 }
1158
1159
1160 static u8 * eap_fast_tlv_result(int status, int intermediate, size_t *len)
1161 {
1162 struct eap_tlv_intermediate_result_tlv *result;
1163 *len = sizeof(*result);
1164 result = os_malloc(*len);
1165 if (result == NULL)
1166 return NULL;
1167 result->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
1168 (intermediate ?
1169 EAP_TLV_INTERMEDIATE_RESULT_TLV :
1170 EAP_TLV_RESULT_TLV));
1171 result->length = host_to_be16(2);
1172 result->status = host_to_be16(status);
1173 return (u8 *) result;
1174 }
1175
1176
1177 static u8 * eap_fast_tlv_pac_ack(size_t *len)
1178 {
1179 struct eap_tlv_result_tlv *res;
1180 struct eap_tlv_pac_ack_tlv *ack;
1181
1182 *len = sizeof(*res) + sizeof(*ack);
1183 res = os_zalloc(*len);
1184 if (res == NULL)
1185 return NULL;
1186
1187 res->tlv_type = host_to_be16(EAP_TLV_RESULT_TLV |
1188 EAP_TLV_TYPE_MANDATORY);
1189 res->length = host_to_be16(sizeof(*res) - sizeof(struct eap_tlv_hdr));
1190 res->status = host_to_be16(EAP_TLV_RESULT_SUCCESS);
1191
1192 ack = (struct eap_tlv_pac_ack_tlv *) (res + 1);
1193 ack->tlv_type = host_to_be16(EAP_TLV_PAC_TLV |
1194 EAP_TLV_TYPE_MANDATORY);
1195 ack->length = host_to_be16(sizeof(*ack) - sizeof(struct eap_tlv_hdr));
1196 ack->pac_type = host_to_be16(PAC_TYPE_PAC_ACKNOWLEDGEMENT);
1197 ack->pac_len = host_to_be16(2);
1198 ack->result = host_to_be16(EAP_TLV_RESULT_SUCCESS);
1199
1200 return (u8 *) res;
1201 }
1202
1203
1204 static u8 * eap_fast_tlv_eap_payload(u8 *buf, size_t *len)
1205 {
1206 struct eap_tlv_hdr *tlv;
1207
1208 /* Encapsulate EAP packet in EAP Payload TLV */
1209 tlv = os_malloc(sizeof(*tlv) + *len);
1210 if (tlv == NULL) {
1211 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to "
1212 "allocate memory for TLV "
1213 "encapsulation");
1214 os_free(buf);
1215 return NULL;
1216 }
1217 tlv->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
1218 EAP_TLV_EAP_PAYLOAD_TLV);
1219 tlv->length = host_to_be16(*len);
1220 os_memcpy(tlv + 1, buf, *len);
1221 os_free(buf);
1222 *len += sizeof(*tlv);
1223 return (u8 *) tlv;
1224 }
1225
1226
1227 static u8 * eap_fast_process_crypto_binding(
1228 struct eap_sm *sm, struct eap_fast_data *data,
1229 struct eap_method_ret *ret,
1230 struct eap_tlv_crypto_binding__tlv *_bind, size_t bind_len,
1231 size_t *resp_len, int final)
1232 {
1233 u8 *resp;
1234 struct eap_tlv_intermediate_result_tlv *rresult;
1235 struct eap_tlv_crypto_binding__tlv *rbind;
1236 u8 isk[32], imck[60], *cmk, cmac[20], *key;
1237 size_t key_len;
1238 int res;
1239
1240 wpa_printf(MSG_DEBUG, "EAP-FAST: Crypto-Binding TLV: Version %d "
1241 "Received Version %d SubType %d",
1242 _bind->version, _bind->received_version, _bind->subtype);
1243 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: NONCE",
1244 _bind->nonce, sizeof(_bind->nonce));
1245 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Compound MAC",
1246 _bind->compound_mac, sizeof(_bind->compound_mac));
1247
1248 if (_bind->version != EAP_FAST_VERSION ||
1249 _bind->received_version != EAP_FAST_VERSION ||
1250 _bind->subtype != EAP_TLV_CRYPTO_BINDING_SUBTYPE_REQUEST) {
1251 wpa_printf(MSG_INFO, "EAP-FAST: Invalid version/subtype in "
1252 "Crypto-Binding TLV: Version %d "
1253 "Received Version %d SubType %d",
1254 _bind->version, _bind->received_version,
1255 _bind->subtype);
1256 resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 1,
1257 resp_len);
1258 return resp;
1259 }
1260
1261 wpa_printf(MSG_DEBUG, "EAP-FAST: Determining CMK[%d] for Compound MIC "
1262 "calculation", data->simck_idx + 1);
1263
1264 /*
1265 * draft-cam-winget-eap-fast-05.txt, 5.2:
1266 * IMCK[j] = T-PRF(S-IMCK[j-1], "Inner Methods Compound Keys",
1267 * MSK[j], 60)
1268 * S-IMCK[j] = first 40 octets of IMCK[j]
1269 * CMK[j] = last 20 octets of IMCK[j]
1270 */
1271
1272 os_memset(isk, 0, sizeof(isk));
1273 if (data->phase2_method == NULL || data->phase2_priv == NULL) {
1274 wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 method not "
1275 "available");
1276 return NULL;
1277 }
1278 if (data->phase2_method->isKeyAvailable && data->phase2_method->getKey)
1279 {
1280 if (!data->phase2_method->isKeyAvailable(sm, data->phase2_priv)
1281 ||
1282 (key = data->phase2_method->getKey(sm, data->phase2_priv,
1283 &key_len)) == NULL) {
1284 wpa_printf(MSG_DEBUG, "EAP-FAST: Could not get key "
1285 "material from Phase 2");
1286 return NULL;
1287 }
1288 if (key_len > sizeof(isk))
1289 key_len = sizeof(isk);
1290 os_memcpy(isk, key, key_len);
1291 os_free(key);
1292 }
1293 wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: ISK[j]", isk, sizeof(isk));
1294 sha1_t_prf(data->simck, EAP_FAST_SIMCK_LEN,
1295 "Inner Methods Compound Keys",
1296 isk, sizeof(isk), imck, sizeof(imck));
1297 data->simck_idx++;
1298 os_memcpy(data->simck, imck, EAP_FAST_SIMCK_LEN);
1299 wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: S-IMCK[j]",
1300 data->simck, EAP_FAST_SIMCK_LEN);
1301 cmk = imck + EAP_FAST_SIMCK_LEN;
1302 wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: CMK[j]", cmk, 20);
1303
1304 os_memcpy(cmac, _bind->compound_mac, sizeof(cmac));
1305 os_memset(_bind->compound_mac, 0, sizeof(cmac));
1306 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Crypto-Binding TLV for Compound "
1307 "MAC calculation", (u8 *) _bind, bind_len);
1308 hmac_sha1(cmk, 20, (u8 *) _bind, bind_len, _bind->compound_mac);
1309 res = os_memcmp(cmac, _bind->compound_mac, sizeof(cmac));
1310 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Received Compound MAC",
1311 cmac, sizeof(cmac));
1312 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Calculated Compound MAC",
1313 _bind->compound_mac, sizeof(cmac));
1314 if (res != 0) {
1315 wpa_printf(MSG_INFO, "EAP-FAST: Compound MAC did not match");
1316 resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 1,
1317 resp_len);
1318 os_memcpy(_bind->compound_mac, cmac, sizeof(cmac));
1319 return resp;
1320 }
1321
1322 *resp_len = sizeof(*rresult) + sizeof(*rbind);
1323 resp = os_zalloc(*resp_len);
1324 if (resp == NULL)
1325 return NULL;
1326
1327 /* Both intermediate and final Result TLVs are identical, so ok to use
1328 * the same structure definition for them. */
1329 rresult = (struct eap_tlv_intermediate_result_tlv *) resp;
1330 rresult->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
1331 (final ? EAP_TLV_RESULT_TLV :
1332 EAP_TLV_INTERMEDIATE_RESULT_TLV));
1333 rresult->length = host_to_be16(2);
1334 rresult->status = host_to_be16(EAP_TLV_RESULT_SUCCESS);
1335
1336 if (!data->provisioning && data->phase2_success &&
1337 eap_fast_derive_msk(data) < 0) {
1338 wpa_printf(MSG_INFO, "EAP-FAST: Failed to generate MSK");
1339 ret->methodState = METHOD_DONE;
1340 ret->decision = DECISION_FAIL;
1341 rresult->status = host_to_be16(EAP_TLV_RESULT_FAILURE);
1342 data->phase2_success = 0;
1343 }
1344
1345 rbind = (struct eap_tlv_crypto_binding__tlv *) (rresult + 1);
1346 rbind->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
1347 EAP_TLV_CRYPTO_BINDING_TLV_);
1348 rbind->length = host_to_be16(sizeof(*rbind) -
1349 sizeof(struct eap_tlv_hdr));
1350 rbind->version = EAP_FAST_VERSION;
1351 rbind->received_version = _bind->version;
1352 rbind->subtype = EAP_TLV_CRYPTO_BINDING_SUBTYPE_RESPONSE;
1353 os_memcpy(rbind->nonce, _bind->nonce, sizeof(_bind->nonce));
1354 inc_byte_array(rbind->nonce, sizeof(rbind->nonce));
1355 hmac_sha1(cmk, 20, (u8 *) rbind, sizeof(*rbind), rbind->compound_mac);
1356
1357 wpa_printf(MSG_DEBUG, "EAP-FAST: Reply Crypto-Binding TLV: Version %d "
1358 "Received Version %d SubType %d",
1359 rbind->version, rbind->received_version, rbind->subtype);
1360 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: NONCE",
1361 rbind->nonce, sizeof(rbind->nonce));
1362 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Compound MAC",
1363 rbind->compound_mac, sizeof(rbind->compound_mac));
1364
1365 if (final && data->phase2_success) {
1366 wpa_printf(MSG_DEBUG, "EAP-FAST: Authentication completed "
1367 "successfully.");
1368 ret->methodState = METHOD_DONE;
1369 ret->decision = DECISION_UNCOND_SUCC;
1370 }
1371
1372 return resp;
1373 }
1374
1375
1376 static u8 * eap_fast_process_pac(struct eap_sm *sm, struct eap_fast_data *data,
1377 struct eap_method_ret *ret,
1378 u8 *pac, size_t pac_len, size_t *resp_len)
1379 {
1380 struct wpa_ssid *config = eap_get_config(sm);
1381 struct pac_tlv_hdr *hdr;
1382 u8 *pos;
1383 size_t left, len;
1384 int type, pac_key_found = 0;
1385 struct eap_fast_pac entry;
1386
1387 os_memset(&entry, 0, sizeof(entry));
1388 pos = pac;
1389 left = pac_len;
1390 while (left > sizeof(*hdr)) {
1391 hdr = (struct pac_tlv_hdr *) pos;
1392 type = be_to_host16(hdr->type);
1393 len = be_to_host16(hdr->len);
1394 pos += sizeof(*hdr);
1395 left -= sizeof(*hdr);
1396 if (len > left) {
1397 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV overrun "
1398 "(type=%d len=%lu left=%lu)",
1399 type, (unsigned long) len,
1400 (unsigned long) left);
1401 return eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0,
1402 resp_len);
1403 }
1404 switch (type) {
1405 case PAC_TYPE_PAC_KEY:
1406 wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: PAC-Key",
1407 pos, len);
1408 if (len != EAP_FAST_PAC_KEY_LEN) {
1409 wpa_printf(MSG_DEBUG, "EAP-FAST: Invalid "
1410 "PAC-Key length %lu",
1411 (unsigned long) len);
1412 break;
1413 }
1414 pac_key_found = 1;
1415 os_memcpy(entry.pac_key, pos, len);
1416 break;
1417 case PAC_TYPE_PAC_OPAQUE:
1418 wpa_hexdump(MSG_DEBUG, "EAP-FAST: PAC-Opaque",
1419 pos, len);
1420 entry.pac_opaque = pos;
1421 entry.pac_opaque_len = len;
1422 break;
1423 case PAC_TYPE_PAC_INFO:
1424 wpa_hexdump(MSG_DEBUG, "EAP-FAST: PAC-Info",
1425 pos, len);
1426 entry.pac_info = pos;
1427 entry.pac_info_len = len;
1428 break;
1429 default:
1430 wpa_printf(MSG_DEBUG, "EAP-FAST: Ignored unknown PAC "
1431 "type %d", type);
1432 break;
1433 }
1434
1435 pos += len;
1436 left -= len;
1437 }
1438
1439 if (!pac_key_found || !entry.pac_opaque || !entry.pac_info) {
1440 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV does not include "
1441 "all the required fields");
1442 return eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0,
1443 resp_len);
1444 }
1445
1446 pos = entry.pac_info;
1447 left = entry.pac_info_len;
1448 while (left > sizeof(*hdr)) {
1449 hdr = (struct pac_tlv_hdr *) pos;
1450 type = be_to_host16(hdr->type);
1451 len = be_to_host16(hdr->len);
1452 pos += sizeof(*hdr);
1453 left -= sizeof(*hdr);
1454 if (len > left) {
1455 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info overrun "
1456 "(type=%d len=%lu left=%lu)",
1457 type, (unsigned long) len,
1458 (unsigned long) left);
1459 return eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0,
1460 resp_len);
1461 }
1462 switch (type) {
1463 case PAC_TYPE_A_ID:
1464 wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: PAC-Info - "
1465 "A-ID", pos, len);
1466 entry.a_id = pos;
1467 entry.a_id_len = len;
1468 break;
1469 case PAC_TYPE_I_ID:
1470 wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: PAC-Info - "
1471 "I-ID", pos, len);
1472 entry.i_id = pos;
1473 entry.i_id_len = len;
1474 break;
1475 case PAC_TYPE_A_ID_INFO:
1476 wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: PAC-Info - "
1477 "A-ID-Info", pos, len);
1478 entry.a_id_info = pos;
1479 entry.a_id_info_len = len;
1480 break;
1481 default:
1482 wpa_printf(MSG_DEBUG, "EAP-FAST: Ignored unknown "
1483 "PAC-Info type %d", type);
1484 break;
1485 }
1486
1487 pos += len;
1488 left -= len;
1489 }
1490
1491 if (entry.a_id == NULL || entry.a_id_info == NULL) {
1492 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info does not include "
1493 "all the required fields");
1494 return eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0,
1495 resp_len);
1496 }
1497
1498 eap_fast_add_pac(data, &entry);
1499 eap_fast_save_pac(sm, data, config->pac_file);
1500
1501 if (data->provisioning) {
1502 /* EAP-FAST provisioning does not provide keying material and
1503 * must end with an EAP-Failure. Authentication will be done
1504 * separately after this. */
1505 data->success = 0;
1506 ret->decision = DECISION_FAIL;
1507 wpa_printf(MSG_DEBUG, "EAP-FAST: Send PAC-Acknowledgement TLV "
1508 "- Provisioning completed successfully");
1509 } else {
1510 /* This is PAC refreshing, i.e., normal authentication that is
1511 * expected to be completed with an EAP-Success. */
1512 wpa_printf(MSG_DEBUG, "EAP-FAST: Send PAC-Acknowledgement TLV "
1513 "- PAC refreshing completed successfully");
1514 ret->decision = DECISION_UNCOND_SUCC;
1515 }
1516 ret->methodState = METHOD_DONE;
1517 return eap_fast_tlv_pac_ack(resp_len);
1518 }
1519
1520
1521 static int eap_fast_decrypt(struct eap_sm *sm, struct eap_fast_data *data,
1522 struct eap_method_ret *ret,
1523 const struct eap_hdr *req,
1524 const u8 *in_data, size_t in_len,
1525 u8 **out_data, size_t *out_len)
1526 {
1527 u8 *in_decrypted, *pos, *end;
1528 int len_decrypted, len;
1529 struct eap_hdr *hdr;
1530 u8 *resp = NULL;
1531 size_t buf_len, resp_len;
1532 int mandatory, tlv_type;
1533 u8 *eap_payload_tlv = NULL, *pac = NULL;
1534 size_t eap_payload_tlv_len = 0, pac_len = 0;
1535 int iresult = 0, result = 0;
1536 struct eap_tlv_crypto_binding__tlv *crypto_binding = NULL;
1537 size_t crypto_binding_len = 0;
1538 const u8 *msg;
1539 size_t msg_len;
1540 int need_more_input, stop;
1541
1542 wpa_printf(MSG_DEBUG, "EAP-FAST: received %lu bytes encrypted data for"
1543 " Phase 2", (unsigned long) in_len);
1544
1545 msg = eap_tls_data_reassemble(sm, &data->ssl, in_data, in_len,
1546 &msg_len, &need_more_input);
1547 if (msg == NULL)
1548 return need_more_input ? 1 : -1;
1549
1550 buf_len = in_len;
1551 if (data->ssl.tls_in_total > buf_len)
1552 buf_len = data->ssl.tls_in_total;
1553 in_decrypted = os_malloc(buf_len);
1554 if (in_decrypted == NULL) {
1555 os_free(data->ssl.tls_in);
1556 data->ssl.tls_in = NULL;
1557 data->ssl.tls_in_len = 0;
1558 wpa_printf(MSG_WARNING, "EAP-FAST: failed to allocate memory "
1559 "for decryption");
1560 return -1;
1561 }
1562
1563 len_decrypted = tls_connection_decrypt(sm->ssl_ctx, data->ssl.conn,
1564 msg, msg_len,
1565 in_decrypted, buf_len);
1566 os_free(data->ssl.tls_in);
1567 data->ssl.tls_in = NULL;
1568 data->ssl.tls_in_len = 0;
1569 if (len_decrypted < 0) {
1570 wpa_printf(MSG_INFO, "EAP-FAST: Failed to decrypt Phase 2 "
1571 "data");
1572 os_free(in_decrypted);
1573 return -1;
1574 }
1575
1576 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Decrypted Phase 2 TLV(s)",
1577 in_decrypted, len_decrypted);
1578
1579 if (len_decrypted < 4) {
1580 os_free(in_decrypted);
1581 wpa_printf(MSG_INFO, "EAP-FAST: Too short Phase 2 "
1582 "TLV frame (len=%d)", len_decrypted);
1583 return -1;
1584 }
1585
1586 pos = in_decrypted;
1587 end = in_decrypted + len_decrypted;
1588 stop = 0;
1589 while (pos + 4 < end && !stop) {
1590 mandatory = pos[0] & 0x80;
1591 tlv_type = WPA_GET_BE16(pos) & 0x3fff;
1592 pos += 2;
1593 len = WPA_GET_BE16(pos);
1594 pos += 2;
1595 if (pos + len > end) {
1596 os_free(in_decrypted);
1597 wpa_printf(MSG_INFO, "EAP-FAST: TLV overflow");
1598 return 0;
1599 }
1600 wpa_printf(MSG_DEBUG, "EAP-FAST: received Phase 2: "
1601 "TLV type %d length %d%s",
1602 tlv_type, len, mandatory ? " (mandatory)" : "");
1603
1604 switch (tlv_type) {
1605 case EAP_TLV_EAP_PAYLOAD_TLV:
1606 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: EAP Payload TLV",
1607 pos, len);
1608 eap_payload_tlv = pos;
1609 eap_payload_tlv_len = len;
1610 break;
1611 case EAP_TLV_RESULT_TLV:
1612 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Result TLV",
1613 pos, len);
1614 if (len < 2) {
1615 wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
1616 "Result TLV");
1617 result = EAP_TLV_RESULT_FAILURE;
1618 break;
1619 }
1620 result = WPA_GET_BE16(pos);
1621 if (result != EAP_TLV_RESULT_SUCCESS &&
1622 result != EAP_TLV_RESULT_FAILURE) {
1623 wpa_printf(MSG_DEBUG, "EAP-FAST: Unknown "
1624 "Result %d", result);
1625 result = EAP_TLV_RESULT_FAILURE;
1626 }
1627 wpa_printf(MSG_DEBUG, "EAP-FAST: Result: %s",
1628 result == EAP_TLV_RESULT_SUCCESS ?
1629 "Success" : "Failure");
1630 break;
1631 case EAP_TLV_INTERMEDIATE_RESULT_TLV:
1632 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Intermediate "
1633 "Result TLV", pos, len);
1634 if (len < 2) {
1635 wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
1636 "Intermediate Result TLV");
1637 iresult = EAP_TLV_RESULT_FAILURE;
1638 break;
1639 }
1640 iresult = WPA_GET_BE16(pos);
1641 if (iresult != EAP_TLV_RESULT_SUCCESS &&
1642 iresult != EAP_TLV_RESULT_FAILURE) {
1643 wpa_printf(MSG_DEBUG, "EAP-FAST: Unknown "
1644 "Intermediate Result %d", iresult);
1645 iresult = EAP_TLV_RESULT_FAILURE;
1646 }
1647 wpa_printf(MSG_DEBUG,
1648 "EAP-FAST: Intermediate Result: %s",
1649 iresult == EAP_TLV_RESULT_SUCCESS ?
1650 "Success" : "Failure");
1651 break;
1652 case EAP_TLV_CRYPTO_BINDING_TLV_:
1653 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Crypto-Binding "
1654 "TLV", pos, len);
1655 crypto_binding_len = sizeof(struct eap_tlv_hdr) + len;
1656 if (crypto_binding_len < sizeof(*crypto_binding)) {
1657 wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
1658 "Crypto-Binding TLV");
1659 iresult = EAP_TLV_RESULT_FAILURE;
1660 pos = end;
1661 break;
1662 }
1663 crypto_binding =
1664 (struct eap_tlv_crypto_binding__tlv *)
1665 (pos - sizeof(struct eap_tlv_hdr));
1666 break;
1667 case EAP_TLV_PAC_TLV:
1668 wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: PAC TLV",
1669 pos, len);
1670 pac = pos;
1671 pac_len = len;
1672 break;
1673 default:
1674 if (mandatory) {
1675 wpa_printf(MSG_DEBUG, "EAP-FAST: Nak unknown "
1676 "mandatory TLV type %d", tlv_type);
1677 resp = eap_fast_tlv_nak(0, tlv_type,
1678 &resp_len);
1679 stop = 1;
1680 } else {
1681 wpa_printf(MSG_DEBUG, "EAP-FAST: ignored "
1682 "unknown optional TLV type %d",
1683 tlv_type);
1684 }
1685 break;
1686 }
1687
1688 pos += len;
1689 }
1690
1691 if (!resp && result == EAP_TLV_RESULT_FAILURE) {
1692 resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0,
1693 &resp_len);
1694 if (!resp) {
1695 os_free(in_decrypted);
1696 return 0;
1697 }
1698 }
1699
1700 if (!resp && iresult == EAP_TLV_RESULT_FAILURE) {
1701 resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 1,
1702 &resp_len);
1703 if (!resp) {
1704 os_free(in_decrypted);
1705 return 0;
1706 }
1707 }
1708
1709 if (!resp && eap_payload_tlv) {
1710 if (eap_payload_tlv_len < sizeof(*hdr)) {
1711 wpa_printf(MSG_DEBUG, "EAP-FAST: too short EAP "
1712 "Payload TLV (len=%lu)",
1713 (unsigned long) eap_payload_tlv_len);
1714 os_free(in_decrypted);
1715 return 0;
1716 }
1717 hdr = (struct eap_hdr *) eap_payload_tlv;
1718 if (be_to_host16(hdr->length) > eap_payload_tlv_len) {
1719 wpa_printf(MSG_DEBUG, "EAP-FAST: EAP packet overflow "
1720 "in EAP Payload TLV");
1721 os_free(in_decrypted);
1722 return 0;
1723 }
1724 if (hdr->code == EAP_CODE_REQUEST) {
1725 if (eap_fast_phase2_request(sm, data, ret, hdr,
1726 &resp, &resp_len)) {
1727 os_free(in_decrypted);
1728 wpa_printf(MSG_INFO, "EAP-FAST: Phase2 "
1729 "Request processing failed");
1730 return 0;
1731 }
1732 resp = eap_fast_tlv_eap_payload(resp, &resp_len);
1733 if (resp == NULL) {
1734 os_free(in_decrypted);
1735 return 0;
1736 }
1737 } else {
1738 wpa_printf(MSG_INFO, "EAP-FAST: Unexpected code=%d in "
1739 "Phase 2 EAP header", hdr->code);
1740 os_free(in_decrypted);
1741 return 0;
1742 }
1743 }
1744
1745 if (!resp && crypto_binding) {
1746 int final = result == EAP_TLV_RESULT_SUCCESS;
1747 resp = eap_fast_process_crypto_binding(sm, data, ret,
1748 crypto_binding,
1749 crypto_binding_len,
1750 &resp_len, final);
1751 if (!resp) {
1752 os_free(in_decrypted);
1753 return 0;
1754 }
1755 }
1756
1757 if (!resp && pac && result != EAP_TLV_RESULT_SUCCESS) {
1758 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV without Result TLV "
1759 "acknowledging success");
1760 resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0,
1761 &resp_len);
1762 if (!resp) {
1763 os_free(in_decrypted);
1764 return 0;
1765 }
1766 }
1767
1768 if (!resp && pac && result == EAP_TLV_RESULT_SUCCESS) {
1769 resp = eap_fast_process_pac(sm, data, ret, pac, pac_len,
1770 &resp_len);
1771 if (!resp) {
1772 os_free(in_decrypted);
1773 return 0;
1774 }
1775 }
1776
1777 os_free(in_decrypted);
1778
1779 if (resp == NULL) {
1780 wpa_printf(MSG_DEBUG, "EAP-FAST: No recognized TLVs - send "
1781 "empty response packet");
1782 resp = os_malloc(1);
1783 if (resp == NULL)
1784 return 0;
1785 resp_len = 0;
1786 }
1787
1788 wpa_hexdump(MSG_DEBUG, "EAP-FAST: Encrypting Phase 2 data",
1789 resp, resp_len);
1790 if (eap_fast_encrypt(sm, data, req->identifier, resp, resp_len,
1791 out_data, out_len)) {
1792 wpa_printf(MSG_INFO, "EAP-FAST: Failed to encrypt a Phase 2 "
1793 "frame");
1794 }
1795 os_free(resp);
1796
1797 return 0;
1798 }
1799
1800
1801 static u8 * eap_fast_process(struct eap_sm *sm, void *priv,
1802 struct eap_method_ret *ret,
1803 const u8 *reqData, size_t reqDataLen,
1804 size_t *respDataLen)
1805 {
1806 const struct eap_hdr *req;
1807 size_t left;
1808 int res;
1809 u8 flags, *resp, id;
1810 const u8 *pos;
1811 struct eap_fast_data *data = priv;
1812
1813 pos = eap_tls_process_init(sm, &data->ssl, EAP_TYPE_FAST, ret,
1814 reqData, reqDataLen, &left, &flags);
1815 if (pos == NULL)
1816 return NULL;
1817 req = (const struct eap_hdr *) reqData;
1818 id = req->identifier;
1819
1820 if (flags & EAP_TLS_FLAGS_START) {
1821 const u8 *a_id;
1822 size_t a_id_len;
1823 struct pac_tlv_hdr *hdr;
1824
1825 wpa_printf(MSG_DEBUG, "EAP-FAST: Start (server ver=%d, own "
1826 "ver=%d)", flags & EAP_PEAP_VERSION_MASK,
1827 data->fast_version);
1828 if ((flags & EAP_PEAP_VERSION_MASK) < data->fast_version)
1829 data->fast_version = flags & EAP_PEAP_VERSION_MASK;
1830 wpa_printf(MSG_DEBUG, "EAP-FAST: Using FAST version %d",
1831 data->fast_version);
1832
1833 a_id = pos;
1834 a_id_len = left;
1835 if (left > sizeof(*hdr)) {
1836 int tlen;
1837 hdr = (struct pac_tlv_hdr *) pos;
1838 tlen = be_to_host16(hdr->len);
1839 if (be_to_host16(hdr->type) == PAC_TYPE_A_ID &&
1840 sizeof(*hdr) + tlen <= left) {
1841 a_id = (u8 *) (hdr + 1);
1842 a_id_len = tlen;
1843 }
1844 }
1845 wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: A-ID", a_id, a_id_len);
1846
1847 data->current_pac = eap_fast_get_pac(data, a_id, a_id_len);
1848 if (data->current_pac) {
1849 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC found for this "
1850 "A-ID");
1851 wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-FAST: A-ID-Info",
1852 data->current_pac->a_id_info,
1853 data->current_pac->a_id_info_len);
1854 }
1855
1856 if (data->resuming && data->current_pac) {
1857 wpa_printf(MSG_DEBUG, "EAP-FAST: Trying to resume "
1858 "session - do not add PAC-Opaque to TLS "
1859 "ClientHello");
1860 if (tls_connection_client_hello_ext(
1861 sm->ssl_ctx, data->ssl.conn,
1862 TLS_EXT_PAC_OPAQUE, NULL, 0) < 0) {
1863 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to "
1864 "remove PAC-Opaque TLS extension");
1865 return NULL;
1866 }
1867
1868 } else if (data->current_pac) {
1869 u8 *tlv;
1870 size_t tlv_len, olen;
1871 struct eap_tlv_hdr *ehdr;
1872 olen = data->current_pac->pac_opaque_len;
1873 tlv_len = sizeof(*ehdr) + olen;
1874 tlv = os_malloc(tlv_len);
1875 if (tlv) {
1876 ehdr = (struct eap_tlv_hdr *) tlv;
1877 ehdr->tlv_type =
1878 host_to_be16(PAC_TYPE_PAC_OPAQUE);
1879 ehdr->length = host_to_be16(olen);
1880 os_memcpy(ehdr + 1,
1881 data->current_pac->pac_opaque, olen);
1882 }
1883 if (tlv == NULL ||
1884 tls_connection_client_hello_ext(
1885 sm->ssl_ctx, data->ssl.conn,
1886 TLS_EXT_PAC_OPAQUE, tlv, tlv_len) < 0) {
1887 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to "
1888 "add PAC-Opaque TLS extension");
1889 os_free(tlv);
1890 return NULL;
1891 }
1892 os_free(tlv);
1893 } else {
1894 u8 ciphers[2];
1895 if (!data->provisioning_allowed) {
1896 wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC found "
1897 "and provisioning disabled");
1898 return NULL;
1899 }
1900 wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC found - "
1901 "starting provisioning");
1902 ciphers[0] = TLS_CIPHER_ANON_DH_AES128_SHA;
1903 ciphers[1] = TLS_CIPHER_NONE;
1904 if (tls_connection_set_cipher_list(sm->ssl_ctx,
1905 data->ssl.conn,
1906 ciphers)) {
1907 wpa_printf(MSG_INFO, "EAP-FAST: Could not "
1908 "configure anonymous DH for TLS "
1909 "connection");
1910 return NULL;
1911 }
1912 if (tls_connection_client_hello_ext(
1913 sm->ssl_ctx, data->ssl.conn,
1914 TLS_EXT_PAC_OPAQUE, NULL, 0) < 0) {
1915 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to "
1916 "remove PAC-Opaque TLS extension");
1917 return NULL;
1918 }
1919 data->provisioning = 1;
1920 }
1921
1922 left = 0; /* A-ID is not used in further packet processing */
1923 }
1924
1925 resp = NULL;
1926 if (tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&
1927 !data->resuming) {
1928 res = eap_fast_decrypt(sm, data, ret, req, pos, left,
1929 &resp, respDataLen);
1930 if (res < 0) {
1931 ret->methodState = METHOD_DONE;
1932 ret->decision = DECISION_FAIL;
1933 /* Ack possible Alert that may have caused failure in
1934 * decryption */
1935 res = 1;
1936 }
1937 } else {
1938 if (eap_fast_set_tls_master_secret(sm, data, pos, left) < 0) {
1939 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to configure "
1940 "TLS master secret");
1941 ret->methodState = METHOD_DONE;
1942 ret->decision = DECISION_FAIL;
1943 return NULL;
1944 }
1945
1946 res = eap_tls_process_helper(sm, &data->ssl, EAP_TYPE_FAST,
1947 data->fast_version, id, pos, left,
1948 &resp, respDataLen);
1949
1950 if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) {
1951 wpa_printf(MSG_DEBUG,
1952 "EAP-FAST: TLS done, proceed to Phase 2");
1953 data->resuming = 0;
1954 eap_fast_derive_keys(sm, data);
1955 }
1956 }
1957
1958 if (res == 1)
1959 return eap_tls_build_ack(&data->ssl, respDataLen, id,
1960 EAP_TYPE_FAST, data->fast_version);
1961 return resp;
1962 }
1963
1964
1965 #if 0 /* FIX */
1966 static Boolean eap_fast_has_reauth_data(struct eap_sm *sm, void *priv)
1967 {
1968 struct eap_fast_data *data = priv;
1969 return tls_connection_established(sm->ssl_ctx, data->ssl.conn);
1970 }
1971
1972
1973 static void eap_fast_deinit_for_reauth(struct eap_sm *sm, void *priv)
1974 {
1975 struct eap_fast_data *data = priv;
1976 os_free(data->key_block_p);
1977 data->key_block_p = NULL;
1978 }
1979
1980
1981 static void * eap_fast_init_for_reauth(struct eap_sm *sm, void *priv)
1982 {
1983 struct eap_fast_data *data = priv;
1984 if (eap_tls_reauth_init(sm, &data->ssl)) {
1985 os_free(data);
1986 return NULL;
1987 }
1988 if (data->phase2_priv && data->phase2_method &&
1989 data->phase2_method->init_for_reauth)
1990 data->phase2_method->init_for_reauth(sm, data->phase2_priv);
1991 data->phase2_success = 0;
1992 data->resuming = 1;
1993 data->provisioning = 0;
1994 data->simck_idx = 0;
1995 return priv;
1996 }
1997 #endif
1998
1999
2000 static int eap_fast_get_status(struct eap_sm *sm, void *priv, char *buf,
2001 size_t buflen, int verbose)
2002 {
2003 struct eap_fast_data *data = priv;
2004 int len, ret;
2005
2006 len = eap_tls_status(sm, &data->ssl, buf, buflen, verbose);
2007 if (data->phase2_method) {
2008 ret = os_snprintf(buf + len, buflen - len,
2009 "EAP-FAST Phase2 method=%s\n",
2010 data->phase2_method->name);
2011 if (ret < 0 || (size_t) ret >= buflen - len)
2012 return len;
2013 len += ret;
2014 }
2015 return len;
2016 }
2017
2018
2019 static Boolean eap_fast_isKeyAvailable(struct eap_sm *sm, void *priv)
2020 {
2021 struct eap_fast_data *data = priv;
2022 return data->success;
2023 }
2024
2025
2026 static u8 * eap_fast_getKey(struct eap_sm *sm, void *priv, size_t *len)
2027 {
2028 struct eap_fast_data *data = priv;
2029 u8 *key;
2030
2031 if (!data->success)
2032 return NULL;
2033
2034 key = os_malloc(EAP_FAST_KEY_LEN);
2035 if (key == NULL)
2036 return NULL;
2037
2038 *len = EAP_FAST_KEY_LEN;
2039 os_memcpy(key, data->key_data, EAP_FAST_KEY_LEN);
2040
2041 return key;
2042 }
2043
2044
2045 static u8 * eap_fast_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
2046 {
2047 struct eap_fast_data *data = priv;
2048 u8 *key;
2049
2050 if (!data->success)
2051 return NULL;
2052
2053 key = os_malloc(EAP_EMSK_LEN);
2054 if (key == NULL)
2055 return NULL;
2056
2057 *len = EAP_EMSK_LEN;
2058 os_memcpy(key, data->emsk, EAP_EMSK_LEN);
2059
2060 return key;
2061 }
2062
2063
2064 int eap_peer_fast_register(void)
2065 {
2066 struct eap_method *eap;
2067 int ret;
2068
2069 eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
2070 EAP_VENDOR_IETF, EAP_TYPE_FAST, "FAST");
2071 if (eap == NULL)
2072 return -1;
2073
2074 eap->init = eap_fast_init;
2075 eap->deinit = eap_fast_deinit;
2076 eap->process = eap_fast_process;
2077 eap->isKeyAvailable = eap_fast_isKeyAvailable;
2078 eap->getKey = eap_fast_getKey;
2079 eap->get_status = eap_fast_get_status;
2080 #if 0
2081 eap->has_reauth_data = eap_fast_has_reauth_data;
2082 eap->deinit_for_reauth = eap_fast_deinit_for_reauth;
2083 eap->init_for_reauth = eap_fast_init_for_reauth;
2084 #endif
2085 eap->get_emsk = eap_fast_get_emsk;
2086
2087 ret = eap_peer_method_register(eap);
2088 if (ret)
2089 eap_peer_method_free(eap);
2090 return ret;
2091 }
DragonFly BSD