LCOV - code coverage report
Current view: top level - src/eap_peer - eap_fast.c (source / functions) Hit Total Coverage
Test: wpa_supplicant/hostapd combined for hwsim test run 1422976643 Lines: 645 829 77.8 %
Date: 2015-02-03 Functions: 43 44 97.7 %

          Line data    Source code
       1             : /*
       2             :  * EAP peer method: EAP-FAST (RFC 4851)
       3             :  * Copyright (c) 2004-2008, Jouni Malinen <j@w1.fi>
       4             :  *
       5             :  * This software may be distributed under the terms of the BSD license.
       6             :  * See README for more details.
       7             :  */
       8             : 
       9             : #include "includes.h"
      10             : 
      11             : #include "common.h"
      12             : #include "crypto/tls.h"
      13             : #include "crypto/sha1.h"
      14             : #include "eap_common/eap_tlv_common.h"
      15             : #include "eap_i.h"
      16             : #include "eap_tls_common.h"
      17             : #include "eap_config.h"
      18             : #include "eap_fast_pac.h"
      19             : 
      20             : #ifdef EAP_FAST_DYNAMIC
      21             : #include "eap_fast_pac.c"
      22             : #endif /* EAP_FAST_DYNAMIC */
      23             : 
      24             : /* TODO:
      25             :  * - test session resumption and enable it if it interoperates
      26             :  * - password change (pending mschapv2 packet; replay decrypted packet)
      27             :  */
      28             : 
      29             : 
      30             : static void eap_fast_deinit(struct eap_sm *sm, void *priv);
      31             : 
      32             : 
      33             : struct eap_fast_data {
      34             :         struct eap_ssl_data ssl;
      35             : 
      36             :         int fast_version;
      37             : 
      38             :         const struct eap_method *phase2_method;
      39             :         void *phase2_priv;
      40             :         int phase2_success;
      41             : 
      42             :         struct eap_method_type phase2_type;
      43             :         struct eap_method_type *phase2_types;
      44             :         size_t num_phase2_types;
      45             :         int resuming; /* starting a resumed session */
      46             :         struct eap_fast_key_block_provisioning *key_block_p;
      47             : #define EAP_FAST_PROV_UNAUTH 1
      48             : #define EAP_FAST_PROV_AUTH 2
      49             :         int provisioning_allowed; /* Allowed PAC provisioning modes */
      50             :         int provisioning; /* doing PAC provisioning (not the normal auth) */
      51             :         int anon_provisioning; /* doing anonymous (unauthenticated)
      52             :                                 * provisioning */
      53             :         int session_ticket_used;
      54             : 
      55             :         u8 key_data[EAP_FAST_KEY_LEN];
      56             :         u8 *session_id;
      57             :         size_t id_len;
      58             :         u8 emsk[EAP_EMSK_LEN];
      59             :         int success;
      60             : 
      61             :         struct eap_fast_pac *pac;
      62             :         struct eap_fast_pac *current_pac;
      63             :         size_t max_pac_list_len;
      64             :         int use_pac_binary_format;
      65             : 
      66             :         u8 simck[EAP_FAST_SIMCK_LEN];
      67             :         int simck_idx;
      68             : 
      69             :         struct wpabuf *pending_phase2_req;
      70             : };
      71             : 
      72             : 
      73          21 : static int eap_fast_session_ticket_cb(void *ctx, const u8 *ticket, size_t len,
      74             :                                       const u8 *client_random,
      75             :                                       const u8 *server_random,
      76             :                                       u8 *master_secret)
      77             : {
      78          21 :         struct eap_fast_data *data = ctx;
      79             : 
      80          21 :         wpa_printf(MSG_DEBUG, "EAP-FAST: SessionTicket callback");
      81             : 
      82          21 :         if (client_random == NULL || server_random == NULL ||
      83             :             master_secret == NULL) {
      84           0 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: SessionTicket failed - fall "
      85             :                            "back to full TLS handshake");
      86           0 :                 data->session_ticket_used = 0;
      87           0 :                 if (data->provisioning_allowed) {
      88           0 :                         wpa_printf(MSG_DEBUG, "EAP-FAST: Try to provision a "
      89             :                                    "new PAC-Key");
      90           0 :                         data->provisioning = 1;
      91           0 :                         data->current_pac = NULL;
      92             :                 }
      93           0 :                 return 0;
      94             :         }
      95             : 
      96          21 :         wpa_hexdump(MSG_DEBUG, "EAP-FAST: SessionTicket", ticket, len);
      97             : 
      98          21 :         if (data->current_pac == NULL) {
      99          11 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC-Key available for "
     100             :                            "using SessionTicket");
     101          11 :                 data->session_ticket_used = 0;
     102          11 :                 return 0;
     103             :         }
     104             : 
     105          10 :         eap_fast_derive_master_secret(data->current_pac->pac_key,
     106             :                                       server_random, client_random,
     107             :                                       master_secret);
     108             : 
     109          10 :         data->session_ticket_used = 1;
     110             : 
     111          10 :         return 1;
     112             : }
     113             : 
     114             : 
     115          20 : static int eap_fast_parse_phase1(struct eap_fast_data *data,
     116             :                                  const char *phase1)
     117             : {
     118             :         const char *pos;
     119             : 
     120          20 :         pos = os_strstr(phase1, "fast_provisioning=");
     121          20 :         if (pos) {
     122          19 :                 data->provisioning_allowed = atoi(pos + 18);
     123          19 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: Automatic PAC provisioning "
     124             :                            "mode: %d", data->provisioning_allowed);
     125             :         }
     126             : 
     127          20 :         pos = os_strstr(phase1, "fast_max_pac_list_len=");
     128          20 :         if (pos) {
     129           3 :                 data->max_pac_list_len = atoi(pos + 22);
     130           3 :                 if (data->max_pac_list_len == 0)
     131           0 :                         data->max_pac_list_len = 1;
     132           3 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: Maximum PAC list length: %lu",
     133             :                            (unsigned long) data->max_pac_list_len);
     134             :         }
     135             : 
     136          20 :         pos = os_strstr(phase1, "fast_pac_format=binary");
     137          20 :         if (pos) {
     138           6 :                 data->use_pac_binary_format = 1;
     139           6 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: Using binary format for PAC "
     140             :                            "list");
     141             :         }
     142             : 
     143          20 :         return 0;
     144             : }
     145             : 
     146             : 
     147          23 : static void * eap_fast_init(struct eap_sm *sm)
     148             : {
     149             :         struct eap_fast_data *data;
     150          23 :         struct eap_peer_config *config = eap_get_config(sm);
     151             : 
     152          23 :         if (config == NULL)
     153           0 :                 return NULL;
     154             : 
     155          23 :         data = os_zalloc(sizeof(*data));
     156          23 :         if (data == NULL)
     157           0 :                 return NULL;
     158          23 :         data->fast_version = EAP_FAST_VERSION;
     159          23 :         data->max_pac_list_len = 10;
     160             : 
     161          23 :         if (config->phase1 && eap_fast_parse_phase1(data, config->phase1) < 0) {
     162           0 :                 eap_fast_deinit(sm, data);
     163           0 :                 return NULL;
     164             :         }
     165             : 
     166          23 :         if (eap_peer_select_phase2_methods(config, "auth=",
     167             :                                            &data->phase2_types,
     168             :                                            &data->num_phase2_types) < 0) {
     169           0 :                 eap_fast_deinit(sm, data);
     170           0 :                 return NULL;
     171             :         }
     172             : 
     173          23 :         data->phase2_type.vendor = EAP_VENDOR_IETF;
     174          23 :         data->phase2_type.method = EAP_TYPE_NONE;
     175             : 
     176          23 :         if (eap_peer_tls_ssl_init(sm, &data->ssl, config, EAP_TYPE_FAST)) {
     177           0 :                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to initialize SSL.");
     178           0 :                 eap_fast_deinit(sm, data);
     179           0 :                 return NULL;
     180             :         }
     181             : 
     182          23 :         if (tls_connection_set_session_ticket_cb(sm->ssl_ctx, data->ssl.conn,
     183             :                                                  eap_fast_session_ticket_cb,
     184             :                                                  data) < 0) {
     185           0 :                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to set SessionTicket "
     186             :                            "callback");
     187           0 :                 eap_fast_deinit(sm, data);
     188           0 :                 return NULL;
     189             :         }
     190             : 
     191             :         /*
     192             :          * The local RADIUS server in a Cisco AP does not seem to like empty
     193             :          * fragments before data, so disable that workaround for CBC.
     194             :          * TODO: consider making this configurable
     195             :          */
     196          23 :         if (tls_connection_enable_workaround(sm->ssl_ctx, data->ssl.conn)) {
     197           0 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to enable TLS "
     198             :                            "workarounds");
     199             :         }
     200             : 
     201          23 :         if (!config->pac_file) {
     202           1 :                 wpa_printf(MSG_INFO, "EAP-FAST: No PAC file configured");
     203           1 :                 eap_fast_deinit(sm, data);
     204           1 :                 return NULL;
     205             :         }
     206             : 
     207          28 :         if (data->use_pac_binary_format &&
     208           6 :             eap_fast_load_pac_bin(sm, &data->pac, config->pac_file) < 0) {
     209           0 :                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to load PAC file");
     210           0 :                 eap_fast_deinit(sm, data);
     211           0 :                 return NULL;
     212             :         }
     213             : 
     214          38 :         if (!data->use_pac_binary_format &&
     215          16 :             eap_fast_load_pac(sm, &data->pac, config->pac_file) < 0) {
     216           0 :                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to load PAC file");
     217           0 :                 eap_fast_deinit(sm, data);
     218           0 :                 return NULL;
     219             :         }
     220          22 :         eap_fast_pac_list_truncate(data->pac, data->max_pac_list_len);
     221             : 
     222          22 :         if (data->pac == NULL && !data->provisioning_allowed) {
     223           1 :                 wpa_printf(MSG_INFO, "EAP-FAST: No PAC configured and "
     224             :                            "provisioning disabled");
     225           1 :                 eap_fast_deinit(sm, data);
     226           1 :                 return NULL;
     227             :         }
     228             : 
     229          21 :         return data;
     230             : }
     231             : 
     232             : 
     233          23 : static void eap_fast_deinit(struct eap_sm *sm, void *priv)
     234             : {
     235          23 :         struct eap_fast_data *data = priv;
     236             :         struct eap_fast_pac *pac, *prev;
     237             : 
     238          23 :         if (data == NULL)
     239          23 :                 return;
     240          23 :         if (data->phase2_priv && data->phase2_method)
     241          21 :                 data->phase2_method->deinit(sm, data->phase2_priv);
     242          23 :         os_free(data->phase2_types);
     243          23 :         os_free(data->key_block_p);
     244          23 :         eap_peer_tls_ssl_deinit(sm, &data->ssl);
     245             : 
     246          23 :         pac = data->pac;
     247          23 :         prev = NULL;
     248          67 :         while (pac) {
     249          21 :                 prev = pac;
     250          21 :                 pac = pac->next;
     251          21 :                 eap_fast_free_pac(prev);
     252             :         }
     253          23 :         os_memset(data->key_data, 0, EAP_FAST_KEY_LEN);
     254          23 :         os_memset(data->emsk, 0, EAP_EMSK_LEN);
     255          23 :         os_free(data->session_id);
     256          23 :         wpabuf_free(data->pending_phase2_req);
     257          23 :         os_free(data);
     258             : }
     259             : 
     260             : 
     261          17 : static int eap_fast_derive_msk(struct eap_fast_data *data)
     262             : {
     263          17 :         eap_fast_derive_eap_msk(data->simck, data->key_data);
     264          17 :         eap_fast_derive_eap_emsk(data->simck, data->emsk);
     265          17 :         data->success = 1;
     266          17 :         return 0;
     267             : }
     268             : 
     269             : 
     270          17 : static void eap_fast_derive_key_auth(struct eap_sm *sm,
     271             :                                      struct eap_fast_data *data)
     272             : {
     273             :         u8 *sks;
     274             : 
     275             :         /* RFC 4851, Section 5.1:
     276             :          * Extra key material after TLS key_block: session_key_seed[40]
     277             :          */
     278             : 
     279          17 :         sks = eap_fast_derive_key(sm->ssl_ctx, data->ssl.conn, "key expansion",
     280             :                                   EAP_FAST_SKS_LEN);
     281          17 :         if (sks == NULL) {
     282           0 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to derive "
     283             :                            "session_key_seed");
     284          17 :                 return;
     285             :         }
     286             : 
     287             :         /*
     288             :          * RFC 4851, Section 5.2:
     289             :          * S-IMCK[0] = session_key_seed
     290             :          */
     291          17 :         wpa_hexdump_key(MSG_DEBUG,
     292             :                         "EAP-FAST: session_key_seed (SKS = S-IMCK[0])",
     293             :                         sks, EAP_FAST_SKS_LEN);
     294          17 :         data->simck_idx = 0;
     295          17 :         os_memcpy(data->simck, sks, EAP_FAST_SIMCK_LEN);
     296          17 :         os_free(sks);
     297             : }
     298             : 
     299             : 
     300           4 : static void eap_fast_derive_key_provisioning(struct eap_sm *sm,
     301             :                                              struct eap_fast_data *data)
     302             : {
     303           4 :         os_free(data->key_block_p);
     304           4 :         data->key_block_p = (struct eap_fast_key_block_provisioning *)
     305           4 :                 eap_fast_derive_key(sm->ssl_ctx, data->ssl.conn,
     306             :                                     "key expansion",
     307             :                                     sizeof(*data->key_block_p));
     308           4 :         if (data->key_block_p == NULL) {
     309           0 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to derive key block");
     310           4 :                 return;
     311             :         }
     312             :         /*
     313             :          * RFC 4851, Section 5.2:
     314             :          * S-IMCK[0] = session_key_seed
     315             :          */
     316           4 :         wpa_hexdump_key(MSG_DEBUG,
     317             :                         "EAP-FAST: session_key_seed (SKS = S-IMCK[0])",
     318           4 :                         data->key_block_p->session_key_seed,
     319             :                         sizeof(data->key_block_p->session_key_seed));
     320           4 :         data->simck_idx = 0;
     321           4 :         os_memcpy(data->simck, data->key_block_p->session_key_seed,
     322             :                   EAP_FAST_SIMCK_LEN);
     323           4 :         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: server_challenge",
     324           4 :                         data->key_block_p->server_challenge,
     325             :                         sizeof(data->key_block_p->server_challenge));
     326           4 :         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: client_challenge",
     327           4 :                         data->key_block_p->client_challenge,
     328             :                         sizeof(data->key_block_p->client_challenge));
     329             : }
     330             : 
     331             : 
     332          21 : static void eap_fast_derive_keys(struct eap_sm *sm, struct eap_fast_data *data)
     333             : {
     334          21 :         if (data->anon_provisioning)
     335           4 :                 eap_fast_derive_key_provisioning(sm, data);
     336             :         else
     337          17 :                 eap_fast_derive_key_auth(sm, data);
     338          21 : }
     339             : 
     340             : 
     341          22 : static int eap_fast_init_phase2_method(struct eap_sm *sm,
     342             :                                        struct eap_fast_data *data)
     343             : {
     344          22 :         data->phase2_method =
     345          22 :                 eap_peer_get_eap_method(data->phase2_type.vendor,
     346          22 :                                         data->phase2_type.method);
     347          22 :         if (data->phase2_method == NULL)
     348           0 :                 return -1;
     349             : 
     350          22 :         if (data->key_block_p) {
     351           4 :                 sm->auth_challenge = data->key_block_p->server_challenge;
     352           4 :                 sm->peer_challenge = data->key_block_p->client_challenge;
     353             :         }
     354          22 :         sm->init_phase2 = 1;
     355          22 :         data->phase2_priv = data->phase2_method->init(sm);
     356          22 :         sm->init_phase2 = 0;
     357          22 :         sm->auth_challenge = NULL;
     358          22 :         sm->peer_challenge = NULL;
     359             : 
     360          22 :         return data->phase2_priv == NULL ? -1 : 0;
     361             : }
     362             : 
     363             : 
     364          28 : static int eap_fast_select_phase2_method(struct eap_fast_data *data, u8 type)
     365             : {
     366             :         size_t i;
     367             : 
     368             :         /* TODO: TNC with anonymous provisioning; need to require both
     369             :          * completed MSCHAPv2 and TNC */
     370             : 
     371          28 :         if (data->anon_provisioning && type != EAP_TYPE_MSCHAPV2) {
     372           0 :                 wpa_printf(MSG_INFO, "EAP-FAST: Only EAP-MSCHAPv2 is allowed "
     373             :                            "during unauthenticated provisioning; reject phase2"
     374             :                            " type %d", type);
     375           0 :                 return -1;
     376             :         }
     377             : 
     378             : #ifdef EAP_TNC
     379          28 :         if (type == EAP_TYPE_TNC) {
     380           1 :                 data->phase2_type.vendor = EAP_VENDOR_IETF;
     381           1 :                 data->phase2_type.method = EAP_TYPE_TNC;
     382           1 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: Selected Phase 2 EAP "
     383             :                            "vendor %d method %d for TNC",
     384             :                            data->phase2_type.vendor,
     385             :                            data->phase2_type.method);
     386           1 :                 return 0;
     387             :         }
     388             : #endif /* EAP_TNC */
     389             : 
     390          66 :         for (i = 0; i < data->num_phase2_types; i++) {
     391          54 :                 if (data->phase2_types[i].vendor != EAP_VENDOR_IETF ||
     392          27 :                     data->phase2_types[i].method != type)
     393           6 :                         continue;
     394             : 
     395          21 :                 data->phase2_type.vendor = data->phase2_types[i].vendor;
     396          21 :                 data->phase2_type.method = data->phase2_types[i].method;
     397          21 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: Selected Phase 2 EAP "
     398             :                            "vendor %d method %d",
     399             :                            data->phase2_type.vendor,
     400             :                            data->phase2_type.method);
     401          21 :                 break;
     402             :         }
     403             : 
     404          27 :         if (type != data->phase2_type.method || type == EAP_TYPE_NONE)
     405           6 :                 return -1;
     406             : 
     407          21 :         return 0;
     408             : }
     409             : 
     410             : 
     411          55 : static int eap_fast_phase2_request(struct eap_sm *sm,
     412             :                                    struct eap_fast_data *data,
     413             :                                    struct eap_method_ret *ret,
     414             :                                    struct eap_hdr *hdr,
     415             :                                    struct wpabuf **resp)
     416             : {
     417          55 :         size_t len = be_to_host16(hdr->length);
     418             :         u8 *pos;
     419             :         struct eap_method_ret iret;
     420          55 :         struct eap_peer_config *config = eap_get_config(sm);
     421             :         struct wpabuf msg;
     422             : 
     423          55 :         if (len <= sizeof(struct eap_hdr)) {
     424           0 :                 wpa_printf(MSG_INFO, "EAP-FAST: too short "
     425             :                            "Phase 2 request (len=%lu)", (unsigned long) len);
     426           0 :                 return -1;
     427             :         }
     428          55 :         pos = (u8 *) (hdr + 1);
     429          55 :         wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 Request: type=%d", *pos);
     430          55 :         if (*pos == EAP_TYPE_IDENTITY) {
     431          11 :                 *resp = eap_sm_buildIdentity(sm, hdr->identifier, 1);
     432          11 :                 return 0;
     433             :         }
     434             : 
     435          61 :         if (data->phase2_priv && data->phase2_method &&
     436          17 :             *pos != data->phase2_type.method) {
     437           1 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 EAP sequence - "
     438             :                            "deinitialize previous method");
     439           1 :                 data->phase2_method->deinit(sm, data->phase2_priv);
     440           1 :                 data->phase2_method = NULL;
     441           1 :                 data->phase2_priv = NULL;
     442           1 :                 data->phase2_type.vendor = EAP_VENDOR_IETF;
     443           1 :                 data->phase2_type.method = EAP_TYPE_NONE;
     444             :         }
     445             : 
     446          88 :         if (data->phase2_type.vendor == EAP_VENDOR_IETF &&
     447          72 :             data->phase2_type.method == EAP_TYPE_NONE &&
     448          28 :             eap_fast_select_phase2_method(data, *pos) < 0) {
     449           6 :                 if (eap_peer_tls_phase2_nak(data->phase2_types,
     450             :                                             data->num_phase2_types,
     451             :                                             hdr, resp))
     452           0 :                         return -1;
     453           6 :                 return 0;
     454             :         }
     455             : 
     456          60 :         if ((data->phase2_priv == NULL &&
     457          60 :              eap_fast_init_phase2_method(sm, data) < 0) ||
     458          38 :             data->phase2_method == NULL) {
     459           0 :                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to initialize "
     460           0 :                            "Phase 2 EAP method %d", *pos);
     461           0 :                 ret->methodState = METHOD_DONE;
     462           0 :                 ret->decision = DECISION_FAIL;
     463           0 :                 return -1;
     464             :         }
     465             : 
     466          38 :         os_memset(&iret, 0, sizeof(iret));
     467          38 :         wpabuf_set(&msg, hdr, len);
     468          38 :         *resp = data->phase2_method->process(sm, data->phase2_priv, &iret,
     469             :                                              &msg);
     470          76 :         if (*resp == NULL ||
     471          51 :             (iret.methodState == METHOD_DONE &&
     472          13 :              iret.decision == DECISION_FAIL)) {
     473           0 :                 ret->methodState = METHOD_DONE;
     474           0 :                 ret->decision = DECISION_FAIL;
     475          63 :         } else if ((iret.methodState == METHOD_DONE ||
     476          63 :                     iret.methodState == METHOD_MAY_CONT) &&
     477          62 :                    (iret.decision == DECISION_UNCOND_SUCC ||
     478          24 :                     iret.decision == DECISION_COND_SUCC)) {
     479          22 :                 data->phase2_success = 1;
     480             :         }
     481             : 
     482          38 :         if (*resp == NULL && config &&
     483           0 :             (config->pending_req_identity || config->pending_req_password ||
     484           0 :              config->pending_req_otp || config->pending_req_new_password)) {
     485           0 :                 wpabuf_free(data->pending_phase2_req);
     486           0 :                 data->pending_phase2_req = wpabuf_alloc_copy(hdr, len);
     487          38 :         } else if (*resp == NULL)
     488           0 :                 return -1;
     489             : 
     490          38 :         return 0;
     491             : }
     492             : 
     493             : 
     494           0 : static struct wpabuf * eap_fast_tlv_nak(int vendor_id, int tlv_type)
     495             : {
     496             :         struct wpabuf *buf;
     497             :         struct eap_tlv_nak_tlv *nak;
     498           0 :         buf = wpabuf_alloc(sizeof(*nak));
     499           0 :         if (buf == NULL)
     500           0 :                 return NULL;
     501           0 :         nak = wpabuf_put(buf, sizeof(*nak));
     502           0 :         nak->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY | EAP_TLV_NAK_TLV);
     503           0 :         nak->length = host_to_be16(6);
     504           0 :         nak->vendor_id = host_to_be32(vendor_id);
     505           0 :         nak->nak_type = host_to_be16(tlv_type);
     506           0 :         return buf;
     507             : }
     508             : 
     509             : 
     510          33 : static struct wpabuf * eap_fast_tlv_result(int status, int intermediate)
     511             : {
     512             :         struct wpabuf *buf;
     513             :         struct eap_tlv_intermediate_result_tlv *result;
     514          33 :         buf = wpabuf_alloc(sizeof(*result));
     515          33 :         if (buf == NULL)
     516           0 :                 return NULL;
     517          33 :         wpa_printf(MSG_DEBUG, "EAP-FAST: Add %sResult TLV(status=%d)",
     518             :                    intermediate ? "Intermediate " : "", status);
     519          33 :         result = wpabuf_put(buf, sizeof(*result));
     520          33 :         result->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
     521             :                                         (intermediate ?
     522             :                                          EAP_TLV_INTERMEDIATE_RESULT_TLV :
     523             :                                          EAP_TLV_RESULT_TLV));
     524          33 :         result->length = host_to_be16(2);
     525          33 :         result->status = host_to_be16(status);
     526          33 :         return buf;
     527             : }
     528             : 
     529             : 
     530          11 : static struct wpabuf * eap_fast_tlv_pac_ack(void)
     531             : {
     532             :         struct wpabuf *buf;
     533             :         struct eap_tlv_result_tlv *res;
     534             :         struct eap_tlv_pac_ack_tlv *ack;
     535             : 
     536          11 :         buf = wpabuf_alloc(sizeof(*res) + sizeof(*ack));
     537          11 :         if (buf == NULL)
     538           0 :                 return NULL;
     539             : 
     540          11 :         wpa_printf(MSG_DEBUG, "EAP-FAST: Add PAC TLV (ack)");
     541          11 :         ack = wpabuf_put(buf, sizeof(*ack));
     542          11 :         ack->tlv_type = host_to_be16(EAP_TLV_PAC_TLV |
     543             :                                      EAP_TLV_TYPE_MANDATORY);
     544          11 :         ack->length = host_to_be16(sizeof(*ack) - sizeof(struct eap_tlv_hdr));
     545          11 :         ack->pac_type = host_to_be16(PAC_TYPE_PAC_ACKNOWLEDGEMENT);
     546          11 :         ack->pac_len = host_to_be16(2);
     547          11 :         ack->result = host_to_be16(EAP_TLV_RESULT_SUCCESS);
     548             : 
     549          11 :         return buf;
     550             : }
     551             : 
     552             : 
     553          55 : static struct wpabuf * eap_fast_process_eap_payload_tlv(
     554             :         struct eap_sm *sm, struct eap_fast_data *data,
     555             :         struct eap_method_ret *ret,
     556             :         u8 *eap_payload_tlv, size_t eap_payload_tlv_len)
     557             : {
     558             :         struct eap_hdr *hdr;
     559          55 :         struct wpabuf *resp = NULL;
     560             : 
     561          55 :         if (eap_payload_tlv_len < sizeof(*hdr)) {
     562           0 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: too short EAP "
     563             :                            "Payload TLV (len=%lu)",
     564             :                            (unsigned long) eap_payload_tlv_len);
     565           0 :                 return NULL;
     566             :         }
     567             : 
     568          55 :         hdr = (struct eap_hdr *) eap_payload_tlv;
     569          55 :         if (be_to_host16(hdr->length) > eap_payload_tlv_len) {
     570           0 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: EAP packet overflow in "
     571             :                            "EAP Payload TLV");
     572           0 :                 return NULL;
     573             :         }
     574             : 
     575          55 :         if (hdr->code != EAP_CODE_REQUEST) {
     576           0 :                 wpa_printf(MSG_INFO, "EAP-FAST: Unexpected code=%d in "
     577           0 :                            "Phase 2 EAP header", hdr->code);
     578           0 :                 return NULL;
     579             :         }
     580             : 
     581          55 :         if (eap_fast_phase2_request(sm, data, ret, hdr, &resp)) {
     582           0 :                 wpa_printf(MSG_INFO, "EAP-FAST: Phase2 Request processing "
     583             :                            "failed");
     584           0 :                 return NULL;
     585             :         }
     586             : 
     587          55 :         return eap_fast_tlv_eap_payload(resp);
     588             : }
     589             : 
     590             : 
     591          21 : static int eap_fast_validate_crypto_binding(
     592             :         struct eap_tlv_crypto_binding_tlv *_bind)
     593             : {
     594          63 :         wpa_printf(MSG_DEBUG, "EAP-FAST: Crypto-Binding TLV: Version %d "
     595             :                    "Received Version %d SubType %d",
     596          63 :                    _bind->version, _bind->received_version, _bind->subtype);
     597          21 :         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: NONCE",
     598          21 :                     _bind->nonce, sizeof(_bind->nonce));
     599          21 :         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Compound MAC",
     600          21 :                     _bind->compound_mac, sizeof(_bind->compound_mac));
     601             : 
     602          42 :         if (_bind->version != EAP_FAST_VERSION ||
     603          42 :             _bind->received_version != EAP_FAST_VERSION ||
     604          21 :             _bind->subtype != EAP_TLV_CRYPTO_BINDING_SUBTYPE_REQUEST) {
     605           0 :                 wpa_printf(MSG_INFO, "EAP-FAST: Invalid version/subtype in "
     606             :                            "Crypto-Binding TLV: Version %d "
     607             :                            "Received Version %d SubType %d",
     608           0 :                            _bind->version, _bind->received_version,
     609           0 :                            _bind->subtype);
     610           0 :                 return -1;
     611             :         }
     612             : 
     613          21 :         return 0;
     614             : }
     615             : 
     616             : 
     617          21 : static void eap_fast_write_crypto_binding(
     618             :         struct eap_tlv_crypto_binding_tlv *rbind,
     619             :         struct eap_tlv_crypto_binding_tlv *_bind, const u8 *cmk)
     620             : {
     621          21 :         rbind->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
     622             :                                        EAP_TLV_CRYPTO_BINDING_TLV);
     623          21 :         rbind->length = host_to_be16(sizeof(*rbind) -
     624             :                                      sizeof(struct eap_tlv_hdr));
     625          21 :         rbind->version = EAP_FAST_VERSION;
     626          21 :         rbind->received_version = _bind->version;
     627          21 :         rbind->subtype = EAP_TLV_CRYPTO_BINDING_SUBTYPE_RESPONSE;
     628          21 :         os_memcpy(rbind->nonce, _bind->nonce, sizeof(_bind->nonce));
     629          21 :         inc_byte_array(rbind->nonce, sizeof(rbind->nonce));
     630          21 :         hmac_sha1(cmk, EAP_FAST_CMK_LEN, (u8 *) rbind, sizeof(*rbind),
     631          21 :                   rbind->compound_mac);
     632             : 
     633          63 :         wpa_printf(MSG_DEBUG, "EAP-FAST: Reply Crypto-Binding TLV: Version %d "
     634             :                    "Received Version %d SubType %d",
     635          63 :                    rbind->version, rbind->received_version, rbind->subtype);
     636          21 :         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: NONCE",
     637          21 :                     rbind->nonce, sizeof(rbind->nonce));
     638          21 :         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Compound MAC",
     639          21 :                     rbind->compound_mac, sizeof(rbind->compound_mac));
     640          21 : }
     641             : 
     642             : 
     643          21 : static int eap_fast_get_phase2_key(struct eap_sm *sm,
     644             :                                    struct eap_fast_data *data,
     645             :                                    u8 *isk, size_t isk_len)
     646             : {
     647             :         u8 *key;
     648             :         size_t key_len;
     649             : 
     650          21 :         os_memset(isk, 0, isk_len);
     651             : 
     652          21 :         if (data->phase2_method == NULL || data->phase2_priv == NULL) {
     653           0 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 method not "
     654             :                            "available");
     655           0 :                 return -1;
     656             :         }
     657             : 
     658          35 :         if (data->phase2_method->isKeyAvailable == NULL ||
     659          14 :             data->phase2_method->getKey == NULL)
     660           7 :                 return 0;
     661             : 
     662          28 :         if (!data->phase2_method->isKeyAvailable(sm, data->phase2_priv) ||
     663          14 :             (key = data->phase2_method->getKey(sm, data->phase2_priv,
     664             :                                                &key_len)) == NULL) {
     665           0 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: Could not get key material "
     666             :                            "from Phase 2");
     667           0 :                 return -1;
     668             :         }
     669             : 
     670          14 :         if (key_len > isk_len)
     671           1 :                 key_len = isk_len;
     672          28 :         if (key_len == 32 &&
     673          28 :             data->phase2_method->vendor == EAP_VENDOR_IETF &&
     674          14 :             data->phase2_method->method == EAP_TYPE_MSCHAPV2) {
     675             :                 /*
     676             :                  * EAP-FAST uses reverse order for MS-MPPE keys when deriving
     677             :                  * MSK from EAP-MSCHAPv2. Swap the keys here to get the correct
     678             :                  * ISK for EAP-FAST cryptobinding.
     679             :                  */
     680          13 :                 os_memcpy(isk, key + 16, 16);
     681          13 :                 os_memcpy(isk + 16, key, 16);
     682             :         } else
     683           1 :                 os_memcpy(isk, key, key_len);
     684          14 :         os_free(key);
     685             : 
     686          14 :         return 0;
     687             : }
     688             : 
     689             : 
     690          21 : static int eap_fast_get_cmk(struct eap_sm *sm, struct eap_fast_data *data,
     691             :                             u8 *cmk)
     692             : {
     693             :         u8 isk[32], imck[60];
     694             : 
     695          21 :         wpa_printf(MSG_DEBUG, "EAP-FAST: Determining CMK[%d] for Compound MIC "
     696          21 :                    "calculation", data->simck_idx + 1);
     697             : 
     698             :         /*
     699             :          * RFC 4851, Section 5.2:
     700             :          * IMCK[j] = T-PRF(S-IMCK[j-1], "Inner Methods Compound Keys",
     701             :          *                 MSK[j], 60)
     702             :          * S-IMCK[j] = first 40 octets of IMCK[j]
     703             :          * CMK[j] = last 20 octets of IMCK[j]
     704             :          */
     705             : 
     706          21 :         if (eap_fast_get_phase2_key(sm, data, isk, sizeof(isk)) < 0)
     707           0 :                 return -1;
     708          21 :         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: ISK[j]", isk, sizeof(isk));
     709          21 :         sha1_t_prf(data->simck, EAP_FAST_SIMCK_LEN,
     710             :                    "Inner Methods Compound Keys",
     711             :                    isk, sizeof(isk), imck, sizeof(imck));
     712          21 :         data->simck_idx++;
     713          21 :         os_memcpy(data->simck, imck, EAP_FAST_SIMCK_LEN);
     714          21 :         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: S-IMCK[j]",
     715          21 :                         data->simck, EAP_FAST_SIMCK_LEN);
     716          21 :         os_memcpy(cmk, imck + EAP_FAST_SIMCK_LEN, EAP_FAST_CMK_LEN);
     717          21 :         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: CMK[j]",
     718             :                         cmk, EAP_FAST_CMK_LEN);
     719             : 
     720          21 :         return 0;
     721             : }
     722             : 
     723             : 
     724           8 : static u8 * eap_fast_write_pac_request(u8 *pos, u16 pac_type)
     725             : {
     726             :         struct eap_tlv_hdr *pac;
     727             :         struct eap_tlv_request_action_tlv *act;
     728             :         struct eap_tlv_pac_type_tlv *type;
     729             : 
     730           8 :         act = (struct eap_tlv_request_action_tlv *) pos;
     731           8 :         act->tlv_type = host_to_be16(EAP_TLV_REQUEST_ACTION_TLV);
     732           8 :         act->length = host_to_be16(2);
     733           8 :         act->action = host_to_be16(EAP_TLV_ACTION_PROCESS_TLV);
     734             : 
     735           8 :         pac = (struct eap_tlv_hdr *) (act + 1);
     736           8 :         pac->tlv_type = host_to_be16(EAP_TLV_PAC_TLV);
     737           8 :         pac->length = host_to_be16(sizeof(*type));
     738             : 
     739           8 :         type = (struct eap_tlv_pac_type_tlv *) (pac + 1);
     740           8 :         type->tlv_type = host_to_be16(PAC_TYPE_PAC_TYPE);
     741           8 :         type->length = host_to_be16(2);
     742           8 :         type->pac_type = host_to_be16(pac_type);
     743             : 
     744           8 :         return (u8 *) (type + 1);
     745             : }
     746             : 
     747             : 
     748          21 : static struct wpabuf * eap_fast_process_crypto_binding(
     749             :         struct eap_sm *sm, struct eap_fast_data *data,
     750             :         struct eap_method_ret *ret,
     751             :         struct eap_tlv_crypto_binding_tlv *_bind, size_t bind_len)
     752             : {
     753             :         struct wpabuf *resp;
     754             :         u8 *pos;
     755             :         u8 cmk[EAP_FAST_CMK_LEN], cmac[SHA1_MAC_LEN];
     756             :         int res;
     757             :         size_t len;
     758             : 
     759          21 :         if (eap_fast_validate_crypto_binding(_bind) < 0)
     760           0 :                 return NULL;
     761             : 
     762          21 :         if (eap_fast_get_cmk(sm, data, cmk) < 0)
     763           0 :                 return NULL;
     764             : 
     765             :         /* Validate received Compound MAC */
     766          21 :         os_memcpy(cmac, _bind->compound_mac, sizeof(cmac));
     767          21 :         os_memset(_bind->compound_mac, 0, sizeof(cmac));
     768          21 :         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Crypto-Binding TLV for Compound "
     769             :                     "MAC calculation", (u8 *) _bind, bind_len);
     770          21 :         hmac_sha1(cmk, EAP_FAST_CMK_LEN, (u8 *) _bind, bind_len,
     771          21 :                   _bind->compound_mac);
     772          21 :         res = os_memcmp_const(cmac, _bind->compound_mac, sizeof(cmac));
     773          21 :         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Received Compound MAC",
     774             :                     cmac, sizeof(cmac));
     775          21 :         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Calculated Compound MAC",
     776          21 :                     _bind->compound_mac, sizeof(cmac));
     777          21 :         if (res != 0) {
     778           0 :                 wpa_printf(MSG_INFO, "EAP-FAST: Compound MAC did not match");
     779           0 :                 os_memcpy(_bind->compound_mac, cmac, sizeof(cmac));
     780           0 :                 return NULL;
     781             :         }
     782             : 
     783             :         /*
     784             :          * Compound MAC was valid, so authentication succeeded. Reply with
     785             :          * crypto binding to allow server to complete authentication.
     786             :          */
     787             : 
     788          21 :         len = sizeof(struct eap_tlv_crypto_binding_tlv);
     789          21 :         resp = wpabuf_alloc(len);
     790          21 :         if (resp == NULL)
     791           0 :                 return NULL;
     792             : 
     793          38 :         if (!data->anon_provisioning && data->phase2_success &&
     794          17 :             eap_fast_derive_msk(data) < 0) {
     795           0 :                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to generate MSK");
     796           0 :                 ret->methodState = METHOD_DONE;
     797           0 :                 ret->decision = DECISION_FAIL;
     798           0 :                 data->phase2_success = 0;
     799           0 :                 wpabuf_free(resp);
     800           0 :                 return NULL;
     801             :         }
     802             : 
     803          21 :         if (!data->anon_provisioning && data->phase2_success) {
     804          17 :                 os_free(data->session_id);
     805          17 :                 data->session_id = eap_peer_tls_derive_session_id(
     806             :                         sm, &data->ssl, EAP_TYPE_FAST, &data->id_len);
     807          17 :                 if (data->session_id) {
     808          34 :                         wpa_hexdump(MSG_DEBUG, "EAP-FAST: Derived Session-Id",
     809          17 :                                     data->session_id, data->id_len);
     810             :                 } else {
     811           0 :                         wpa_printf(MSG_ERROR, "EAP-FAST: Failed to derive "
     812             :                                    "Session-Id");
     813           0 :                         wpabuf_free(resp);
     814           0 :                         return NULL;
     815             :                 }
     816             :         }
     817             : 
     818          21 :         pos = wpabuf_put(resp, sizeof(struct eap_tlv_crypto_binding_tlv));
     819          21 :         eap_fast_write_crypto_binding((struct eap_tlv_crypto_binding_tlv *)
     820             :                                       pos, _bind, cmk);
     821             : 
     822          21 :         return resp;
     823             : }
     824             : 
     825             : 
     826          33 : static void eap_fast_parse_pac_tlv(struct eap_fast_pac *entry, int type,
     827             :                                    u8 *pos, size_t len, int *pac_key_found)
     828             : {
     829          33 :         switch (type & 0x7fff) {
     830             :         case PAC_TYPE_PAC_KEY:
     831          11 :                 wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: PAC-Key", pos, len);
     832          11 :                 if (len != EAP_FAST_PAC_KEY_LEN) {
     833           0 :                         wpa_printf(MSG_DEBUG, "EAP-FAST: Invalid PAC-Key "
     834             :                                    "length %lu", (unsigned long) len);
     835           0 :                         break;
     836             :                 }
     837          11 :                 *pac_key_found = 1;
     838          11 :                 os_memcpy(entry->pac_key, pos, len);
     839          11 :                 break;
     840             :         case PAC_TYPE_PAC_OPAQUE:
     841          11 :                 wpa_hexdump(MSG_DEBUG, "EAP-FAST: PAC-Opaque", pos, len);
     842          11 :                 entry->pac_opaque = pos;
     843          11 :                 entry->pac_opaque_len = len;
     844          11 :                 break;
     845             :         case PAC_TYPE_PAC_INFO:
     846          11 :                 wpa_hexdump(MSG_DEBUG, "EAP-FAST: PAC-Info", pos, len);
     847          11 :                 entry->pac_info = pos;
     848          11 :                 entry->pac_info_len = len;
     849          11 :                 break;
     850             :         default:
     851           0 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: Ignored unknown PAC type %d",
     852             :                            type);
     853           0 :                 break;
     854             :         }
     855          33 : }
     856             : 
     857             : 
     858          11 : static int eap_fast_process_pac_tlv(struct eap_fast_pac *entry,
     859             :                                     u8 *pac, size_t pac_len)
     860             : {
     861             :         struct pac_tlv_hdr *hdr;
     862             :         u8 *pos;
     863             :         size_t left, len;
     864          11 :         int type, pac_key_found = 0;
     865             : 
     866          11 :         pos = pac;
     867          11 :         left = pac_len;
     868             : 
     869          55 :         while (left > sizeof(*hdr)) {
     870          33 :                 hdr = (struct pac_tlv_hdr *) pos;
     871          33 :                 type = be_to_host16(hdr->type);
     872          33 :                 len = be_to_host16(hdr->len);
     873          33 :                 pos += sizeof(*hdr);
     874          33 :                 left -= sizeof(*hdr);
     875          33 :                 if (len > left) {
     876           0 :                         wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV overrun "
     877             :                                    "(type=%d len=%lu left=%lu)",
     878             :                                    type, (unsigned long) len,
     879             :                                    (unsigned long) left);
     880           0 :                         return -1;
     881             :                 }
     882             : 
     883          33 :                 eap_fast_parse_pac_tlv(entry, type, pos, len, &pac_key_found);
     884             : 
     885          33 :                 pos += len;
     886          33 :                 left -= len;
     887             :         }
     888             : 
     889          11 :         if (!pac_key_found || !entry->pac_opaque || !entry->pac_info) {
     890           0 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV does not include "
     891             :                            "all the required fields");
     892           0 :                 return -1;
     893             :         }
     894             : 
     895          11 :         return 0;
     896             : }
     897             : 
     898             : 
     899          55 : static int eap_fast_parse_pac_info(struct eap_fast_pac *entry, int type,
     900             :                                    u8 *pos, size_t len)
     901             : {
     902             :         u16 pac_type;
     903             :         u32 lifetime;
     904             :         struct os_time now;
     905             : 
     906          55 :         switch (type & 0x7fff) {
     907             :         case PAC_TYPE_CRED_LIFETIME:
     908          11 :                 if (len != 4) {
     909           0 :                         wpa_hexdump(MSG_DEBUG, "EAP-FAST: PAC-Info - "
     910             :                                     "Invalid CRED_LIFETIME length - ignored",
     911             :                                     pos, len);
     912           0 :                         return 0;
     913             :                 }
     914             : 
     915             :                 /*
     916             :                  * This is not currently saved separately in PAC files since
     917             :                  * the server can automatically initiate PAC update when
     918             :                  * needed. Anyway, the information is available from PAC-Info
     919             :                  * dump if it is needed for something in the future.
     920             :                  */
     921          11 :                 lifetime = WPA_GET_BE32(pos);
     922          11 :                 os_get_time(&now);
     923          11 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info - CRED_LIFETIME %d "
     924             :                            "(%d days)",
     925          11 :                            lifetime, (lifetime - (u32) now.sec) / 86400);
     926          11 :                 break;
     927             :         case PAC_TYPE_A_ID:
     928          11 :                 wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: PAC-Info - A-ID",
     929             :                                   pos, len);
     930          11 :                 entry->a_id = pos;
     931          11 :                 entry->a_id_len = len;
     932          11 :                 break;
     933             :         case PAC_TYPE_I_ID:
     934          11 :                 wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: PAC-Info - I-ID",
     935             :                                   pos, len);
     936          11 :                 entry->i_id = pos;
     937          11 :                 entry->i_id_len = len;
     938          11 :                 break;
     939             :         case PAC_TYPE_A_ID_INFO:
     940          11 :                 wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: PAC-Info - A-ID-Info",
     941             :                                   pos, len);
     942          11 :                 entry->a_id_info = pos;
     943          11 :                 entry->a_id_info_len = len;
     944          11 :                 break;
     945             :         case PAC_TYPE_PAC_TYPE:
     946             :                 /* RFC 5422, Section 4.2.6 - PAC-Type TLV */
     947          11 :                 if (len != 2) {
     948           0 :                         wpa_printf(MSG_INFO, "EAP-FAST: Invalid PAC-Type "
     949             :                                    "length %lu (expected 2)",
     950             :                                    (unsigned long) len);
     951           0 :                         wpa_hexdump_ascii(MSG_DEBUG,
     952             :                                           "EAP-FAST: PAC-Info - PAC-Type",
     953             :                                           pos, len);
     954           0 :                         return -1;
     955             :                 }
     956          11 :                 pac_type = WPA_GET_BE16(pos);
     957          11 :                 if (pac_type != PAC_TYPE_TUNNEL_PAC &&
     958           0 :                     pac_type != PAC_TYPE_USER_AUTHORIZATION &&
     959             :                     pac_type != PAC_TYPE_MACHINE_AUTHENTICATION) {
     960           0 :                         wpa_printf(MSG_INFO, "EAP-FAST: Unsupported PAC Type "
     961             :                                    "%d", pac_type);
     962           0 :                         return -1;
     963             :                 }
     964             : 
     965          11 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info - PAC-Type %d",
     966             :                            pac_type);
     967          11 :                 entry->pac_type = pac_type;
     968          11 :                 break;
     969             :         default:
     970           0 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: Ignored unknown PAC-Info "
     971             :                            "type %d", type);
     972           0 :                 break;
     973             :         }
     974             : 
     975          55 :         return 0;
     976             : }
     977             : 
     978             : 
     979          11 : static int eap_fast_process_pac_info(struct eap_fast_pac *entry)
     980             : {
     981             :         struct pac_tlv_hdr *hdr;
     982             :         u8 *pos;
     983             :         size_t left, len;
     984             :         int type;
     985             : 
     986             :         /* RFC 5422, Section 4.2.4 */
     987             : 
     988             :         /* PAC-Type defaults to Tunnel PAC (Type 1) */
     989          11 :         entry->pac_type = PAC_TYPE_TUNNEL_PAC;
     990             : 
     991          11 :         pos = entry->pac_info;
     992          11 :         left = entry->pac_info_len;
     993          77 :         while (left > sizeof(*hdr)) {
     994          55 :                 hdr = (struct pac_tlv_hdr *) pos;
     995          55 :                 type = be_to_host16(hdr->type);
     996          55 :                 len = be_to_host16(hdr->len);
     997          55 :                 pos += sizeof(*hdr);
     998          55 :                 left -= sizeof(*hdr);
     999          55 :                 if (len > left) {
    1000           0 :                         wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info overrun "
    1001             :                                    "(type=%d len=%lu left=%lu)",
    1002             :                                    type, (unsigned long) len,
    1003             :                                    (unsigned long) left);
    1004           0 :                         return -1;
    1005             :                 }
    1006             : 
    1007          55 :                 if (eap_fast_parse_pac_info(entry, type, pos, len) < 0)
    1008           0 :                         return -1;
    1009             : 
    1010          55 :                 pos += len;
    1011          55 :                 left -= len;
    1012             :         }
    1013             : 
    1014          11 :         if (entry->a_id == NULL || entry->a_id_info == NULL) {
    1015           0 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info does not include "
    1016             :                            "all the required fields");
    1017           0 :                 return -1;
    1018             :         }
    1019             : 
    1020          11 :         return 0;
    1021             : }
    1022             : 
    1023             : 
    1024          11 : static struct wpabuf * eap_fast_process_pac(struct eap_sm *sm,
    1025             :                                             struct eap_fast_data *data,
    1026             :                                             struct eap_method_ret *ret,
    1027             :                                             u8 *pac, size_t pac_len)
    1028             : {
    1029          11 :         struct eap_peer_config *config = eap_get_config(sm);
    1030             :         struct eap_fast_pac entry;
    1031             : 
    1032          11 :         os_memset(&entry, 0, sizeof(entry));
    1033          22 :         if (eap_fast_process_pac_tlv(&entry, pac, pac_len) ||
    1034          11 :             eap_fast_process_pac_info(&entry))
    1035           0 :                 return NULL;
    1036             : 
    1037          11 :         eap_fast_add_pac(&data->pac, &data->current_pac, &entry);
    1038          11 :         eap_fast_pac_list_truncate(data->pac, data->max_pac_list_len);
    1039          11 :         if (data->use_pac_binary_format)
    1040           2 :                 eap_fast_save_pac_bin(sm, data->pac, config->pac_file);
    1041             :         else
    1042           9 :                 eap_fast_save_pac(sm, data->pac, config->pac_file);
    1043             : 
    1044          11 :         if (data->provisioning) {
    1045          11 :                 if (data->anon_provisioning) {
    1046             :                         /*
    1047             :                          * Unauthenticated provisioning does not provide keying
    1048             :                          * material and must end with an EAP-Failure.
    1049             :                          * Authentication will be done separately after this.
    1050             :                          */
    1051           4 :                         data->success = 0;
    1052           4 :                         ret->decision = DECISION_FAIL;
    1053             :                 } else {
    1054             :                         /*
    1055             :                          * Server may or may not allow authenticated
    1056             :                          * provisioning also for key generation.
    1057             :                          */
    1058           7 :                         ret->decision = DECISION_COND_SUCC;
    1059             :                 }
    1060          11 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: Send PAC-Acknowledgement TLV "
    1061             :                            "- Provisioning completed successfully");
    1062          11 :                 sm->expected_failure = 1;
    1063             :         } else {
    1064             :                 /*
    1065             :                  * This is PAC refreshing, i.e., normal authentication that is
    1066             :                  * expected to be completed with an EAP-Success. However,
    1067             :                  * RFC 5422, Section 3.5 allows EAP-Failure to be sent even
    1068             :                  * after protected success exchange in case of EAP-Fast
    1069             :                  * provisioning, so we better use DECISION_COND_SUCC here
    1070             :                  * instead of DECISION_UNCOND_SUCC.
    1071             :                  */
    1072           0 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: Send PAC-Acknowledgement TLV "
    1073             :                            "- PAC refreshing completed successfully");
    1074           0 :                 ret->decision = DECISION_COND_SUCC;
    1075             :         }
    1076          11 :         ret->methodState = METHOD_DONE;
    1077          11 :         return eap_fast_tlv_pac_ack();
    1078             : }
    1079             : 
    1080             : 
    1081          86 : static int eap_fast_parse_decrypted(struct wpabuf *decrypted,
    1082             :                                     struct eap_fast_tlv_parse *tlv,
    1083             :                                     struct wpabuf **resp)
    1084             : {
    1085             :         int mandatory, tlv_type, res;
    1086             :         size_t len;
    1087             :         u8 *pos, *end;
    1088             : 
    1089          86 :         os_memset(tlv, 0, sizeof(*tlv));
    1090             : 
    1091             :         /* Parse TLVs from the decrypted Phase 2 data */
    1092          86 :         pos = wpabuf_mhead(decrypted);
    1093          86 :         end = pos + wpabuf_len(decrypted);
    1094         292 :         while (pos + 4 < end) {
    1095         120 :                 mandatory = pos[0] & 0x80;
    1096         120 :                 tlv_type = WPA_GET_BE16(pos) & 0x3fff;
    1097         120 :                 pos += 2;
    1098         120 :                 len = WPA_GET_BE16(pos);
    1099         120 :                 pos += 2;
    1100         120 :                 if (len > (size_t) (end - pos)) {
    1101           0 :                         wpa_printf(MSG_INFO, "EAP-FAST: TLV overflow");
    1102           0 :                         return -1;
    1103             :                 }
    1104         120 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: Received Phase 2: "
    1105             :                            "TLV type %d length %u%s",
    1106             :                            tlv_type, (unsigned int) len,
    1107             :                            mandatory ? " (mandatory)" : "");
    1108             : 
    1109         120 :                 res = eap_fast_parse_tlv(tlv, tlv_type, pos, len);
    1110         120 :                 if (res == -2)
    1111           0 :                         break;
    1112         120 :                 if (res < 0) {
    1113           0 :                         if (mandatory) {
    1114           0 :                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Nak unknown "
    1115             :                                            "mandatory TLV type %d", tlv_type);
    1116           0 :                                 *resp = eap_fast_tlv_nak(0, tlv_type);
    1117           0 :                                 break;
    1118             :                         } else {
    1119           0 :                                 wpa_printf(MSG_DEBUG, "EAP-FAST: ignored "
    1120             :                                            "unknown optional TLV type %d",
    1121             :                                            tlv_type);
    1122             :                         }
    1123             :                 }
    1124             : 
    1125         120 :                 pos += len;
    1126             :         }
    1127             : 
    1128          86 :         return 0;
    1129             : }
    1130             : 
    1131             : 
    1132          86 : static int eap_fast_encrypt_response(struct eap_sm *sm,
    1133             :                                      struct eap_fast_data *data,
    1134             :                                      struct wpabuf *resp,
    1135             :                                      u8 identifier, struct wpabuf **out_data)
    1136             : {
    1137          86 :         if (resp == NULL)
    1138           0 :                 return 0;
    1139             : 
    1140          86 :         wpa_hexdump_buf(MSG_DEBUG, "EAP-FAST: Encrypting Phase 2 data",
    1141             :                         resp);
    1142          86 :         if (eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_FAST,
    1143             :                                  data->fast_version, identifier,
    1144             :                                  resp, out_data)) {
    1145           0 :                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to encrypt a Phase 2 "
    1146             :                            "frame");
    1147             :         }
    1148          86 :         wpabuf_free(resp);
    1149             : 
    1150          86 :         return 0;
    1151             : }
    1152             : 
    1153             : 
    1154           8 : static struct wpabuf * eap_fast_pac_request(void)
    1155             : {
    1156             :         struct wpabuf *tmp;
    1157             :         u8 *pos, *pos2;
    1158             : 
    1159           8 :         tmp = wpabuf_alloc(sizeof(struct eap_tlv_hdr) +
    1160             :                            sizeof(struct eap_tlv_request_action_tlv) +
    1161             :                            sizeof(struct eap_tlv_pac_type_tlv));
    1162           8 :         if (tmp == NULL)
    1163           0 :                 return NULL;
    1164             : 
    1165           8 :         pos = wpabuf_put(tmp, 0);
    1166           8 :         pos2 = eap_fast_write_pac_request(pos, PAC_TYPE_TUNNEL_PAC);
    1167           8 :         wpabuf_put(tmp, pos2 - pos);
    1168           8 :         return tmp;
    1169             : }
    1170             : 
    1171             : 
    1172          86 : static int eap_fast_process_decrypted(struct eap_sm *sm,
    1173             :                                       struct eap_fast_data *data,
    1174             :                                       struct eap_method_ret *ret,
    1175             :                                       const struct eap_hdr *req,
    1176             :                                       struct wpabuf *decrypted,
    1177             :                                       struct wpabuf **out_data)
    1178             : {
    1179          86 :         struct wpabuf *resp = NULL, *tmp;
    1180             :         struct eap_fast_tlv_parse tlv;
    1181          86 :         int failed = 0;
    1182             : 
    1183          86 :         if (eap_fast_parse_decrypted(decrypted, &tlv, &resp) < 0)
    1184           0 :                 return 0;
    1185          86 :         if (resp)
    1186           0 :                 return eap_fast_encrypt_response(sm, data, resp,
    1187           0 :                                                  req->identifier, out_data);
    1188             : 
    1189          86 :         if (tlv.result == EAP_TLV_RESULT_FAILURE) {
    1190           0 :                 resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0);
    1191           0 :                 return eap_fast_encrypt_response(sm, data, resp,
    1192           0 :                                                  req->identifier, out_data);
    1193             :         }
    1194             : 
    1195          86 :         if (tlv.iresult == EAP_TLV_RESULT_FAILURE) {
    1196           0 :                 resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 1);
    1197           0 :                 return eap_fast_encrypt_response(sm, data, resp,
    1198           0 :                                                  req->identifier, out_data);
    1199             :         }
    1200             : 
    1201          86 :         if (tlv.crypto_binding) {
    1202          21 :                 tmp = eap_fast_process_crypto_binding(sm, data, ret,
    1203             :                                                       tlv.crypto_binding,
    1204             :                                                       tlv.crypto_binding_len);
    1205          21 :                 if (tmp == NULL)
    1206           0 :                         failed = 1;
    1207             :                 else
    1208          21 :                         resp = wpabuf_concat(resp, tmp);
    1209             :         }
    1210             : 
    1211          86 :         if (tlv.iresult == EAP_TLV_RESULT_SUCCESS) {
    1212           6 :                 tmp = eap_fast_tlv_result(failed ? EAP_TLV_RESULT_FAILURE :
    1213             :                                           EAP_TLV_RESULT_SUCCESS, 1);
    1214           6 :                 resp = wpabuf_concat(resp, tmp);
    1215             :         }
    1216             : 
    1217          86 :         if (tlv.eap_payload_tlv) {
    1218          55 :                 tmp = eap_fast_process_eap_payload_tlv(
    1219             :                         sm, data, ret, tlv.eap_payload_tlv,
    1220             :                         tlv.eap_payload_tlv_len);
    1221          55 :                 resp = wpabuf_concat(resp, tmp);
    1222             :         }
    1223             : 
    1224          86 :         if (tlv.pac && tlv.result != EAP_TLV_RESULT_SUCCESS) {
    1225           0 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV without Result TLV "
    1226             :                            "acknowledging success");
    1227           0 :                 failed = 1;
    1228          86 :         } else if (tlv.pac && tlv.result == EAP_TLV_RESULT_SUCCESS) {
    1229          11 :                 tmp = eap_fast_process_pac(sm, data, ret, tlv.pac,
    1230             :                                            tlv.pac_len);
    1231          11 :                 resp = wpabuf_concat(resp, tmp);
    1232             :         }
    1233             : 
    1234         143 :         if (data->current_pac == NULL && data->provisioning &&
    1235         124 :             !data->anon_provisioning && !tlv.pac &&
    1236          58 :             (tlv.iresult == EAP_TLV_RESULT_SUCCESS ||
    1237          28 :              tlv.result == EAP_TLV_RESULT_SUCCESS)) {
    1238             :                 /*
    1239             :                  * Need to request Tunnel PAC when using authenticated
    1240             :                  * provisioning.
    1241             :                  */
    1242           8 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: Request Tunnel PAC");
    1243           8 :                 tmp = eap_fast_pac_request();
    1244           8 :                 resp = wpabuf_concat(resp, tmp);
    1245             :         }
    1246             : 
    1247          86 :         if (tlv.result == EAP_TLV_RESULT_SUCCESS && !failed) {
    1248          27 :                 tmp = eap_fast_tlv_result(EAP_TLV_RESULT_SUCCESS, 0);
    1249          27 :                 resp = wpabuf_concat(tmp, resp);
    1250          59 :         } else if (failed) {
    1251           0 :                 tmp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0);
    1252           0 :                 resp = wpabuf_concat(tmp, resp);
    1253             :         }
    1254             : 
    1255         113 :         if (resp && tlv.result == EAP_TLV_RESULT_SUCCESS && !failed &&
    1256          43 :             tlv.crypto_binding && data->phase2_success) {
    1257          16 :                 if (data->anon_provisioning) {
    1258           0 :                         wpa_printf(MSG_DEBUG, "EAP-FAST: Unauthenticated "
    1259             :                                    "provisioning completed successfully.");
    1260           0 :                         ret->methodState = METHOD_DONE;
    1261           0 :                         ret->decision = DECISION_FAIL;
    1262           0 :                         sm->expected_failure = 1;
    1263             :                 } else {
    1264          16 :                         wpa_printf(MSG_DEBUG, "EAP-FAST: Authentication "
    1265             :                                    "completed successfully.");
    1266          16 :                         if (data->provisioning)
    1267           7 :                                 ret->methodState = METHOD_MAY_CONT;
    1268             :                         else
    1269           9 :                                 ret->methodState = METHOD_DONE;
    1270          16 :                         ret->decision = DECISION_UNCOND_SUCC;
    1271             :                 }
    1272             :         }
    1273             : 
    1274          86 :         if (resp == NULL) {
    1275           0 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: No recognized TLVs - send "
    1276             :                            "empty response packet");
    1277           0 :                 resp = wpabuf_alloc(1);
    1278             :         }
    1279             : 
    1280          86 :         return eap_fast_encrypt_response(sm, data, resp, req->identifier,
    1281             :                                          out_data);
    1282             : }
    1283             : 
    1284             : 
    1285          86 : static int eap_fast_decrypt(struct eap_sm *sm, struct eap_fast_data *data,
    1286             :                             struct eap_method_ret *ret,
    1287             :                             const struct eap_hdr *req,
    1288             :                             const struct wpabuf *in_data,
    1289             :                             struct wpabuf **out_data)
    1290             : {
    1291             :         struct wpabuf *in_decrypted;
    1292             :         int res;
    1293             : 
    1294          86 :         wpa_printf(MSG_DEBUG, "EAP-FAST: Received %lu bytes encrypted data for"
    1295             :                    " Phase 2", (unsigned long) wpabuf_len(in_data));
    1296             : 
    1297          86 :         if (data->pending_phase2_req) {
    1298          11 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: Pending Phase 2 request - "
    1299             :                            "skip decryption and use old data");
    1300             :                 /* Clear TLS reassembly state. */
    1301          11 :                 eap_peer_tls_reset_input(&data->ssl);
    1302             : 
    1303          11 :                 in_decrypted = data->pending_phase2_req;
    1304          11 :                 data->pending_phase2_req = NULL;
    1305          11 :                 goto continue_req;
    1306             :         }
    1307             : 
    1308          75 :         if (wpabuf_len(in_data) == 0) {
    1309             :                 /* Received TLS ACK - requesting more fragments */
    1310           0 :                 return eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_FAST,
    1311             :                                             data->fast_version,
    1312           0 :                                             req->identifier, NULL, out_data);
    1313             :         }
    1314             : 
    1315          75 :         res = eap_peer_tls_decrypt(sm, &data->ssl, in_data, &in_decrypted);
    1316          75 :         if (res)
    1317           0 :                 return res;
    1318             : 
    1319             : continue_req:
    1320          86 :         wpa_hexdump_buf(MSG_MSGDUMP, "EAP-FAST: Decrypted Phase 2 TLV(s)",
    1321             :                         in_decrypted);
    1322             : 
    1323          86 :         if (wpabuf_len(in_decrypted) < 4) {
    1324           0 :                 wpa_printf(MSG_INFO, "EAP-FAST: Too short Phase 2 "
    1325             :                            "TLV frame (len=%lu)",
    1326             :                            (unsigned long) wpabuf_len(in_decrypted));
    1327           0 :                 wpabuf_free(in_decrypted);
    1328           0 :                 return -1;
    1329             :         }
    1330             : 
    1331          86 :         res = eap_fast_process_decrypted(sm, data, ret, req,
    1332             :                                          in_decrypted, out_data);
    1333             : 
    1334          86 :         wpabuf_free(in_decrypted);
    1335             : 
    1336          86 :         return res;
    1337             : }
    1338             : 
    1339             : 
    1340          21 : static const u8 * eap_fast_get_a_id(const u8 *buf, size_t len, size_t *id_len)
    1341             : {
    1342             :         const u8 *a_id;
    1343             :         struct pac_tlv_hdr *hdr;
    1344             : 
    1345             :         /*
    1346             :          * Parse authority identity (A-ID) from the EAP-FAST/Start. This
    1347             :          * supports both raw A-ID and one inside an A-ID TLV.
    1348             :          */
    1349          21 :         a_id = buf;
    1350          21 :         *id_len = len;
    1351          21 :         if (len > sizeof(*hdr)) {
    1352             :                 int tlen;
    1353          21 :                 hdr = (struct pac_tlv_hdr *) buf;
    1354          21 :                 tlen = be_to_host16(hdr->len);
    1355          42 :                 if (be_to_host16(hdr->type) == PAC_TYPE_A_ID &&
    1356          21 :                     sizeof(*hdr) + tlen <= len) {
    1357          21 :                         wpa_printf(MSG_DEBUG, "EAP-FAST: A-ID was in TLV "
    1358             :                                    "(Start)");
    1359          21 :                         a_id = (u8 *) (hdr + 1);
    1360          21 :                         *id_len = tlen;
    1361             :                 }
    1362             :         }
    1363          21 :         wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: A-ID", a_id, *id_len);
    1364             : 
    1365          21 :         return a_id;
    1366             : }
    1367             : 
    1368             : 
    1369          21 : static void eap_fast_select_pac(struct eap_fast_data *data,
    1370             :                                 const u8 *a_id, size_t a_id_len)
    1371             : {
    1372          21 :         data->current_pac = eap_fast_get_pac(data->pac, a_id, a_id_len,
    1373             :                                              PAC_TYPE_TUNNEL_PAC);
    1374          21 :         if (data->current_pac == NULL) {
    1375             :                 /*
    1376             :                  * Tunnel PAC was not available for this A-ID. Try to use
    1377             :                  * Machine Authentication PAC, if one is available.
    1378             :                  */
    1379          11 :                 data->current_pac = eap_fast_get_pac(
    1380             :                         data->pac, a_id, a_id_len,
    1381             :                         PAC_TYPE_MACHINE_AUTHENTICATION);
    1382             :         }
    1383             : 
    1384          21 :         if (data->current_pac) {
    1385          10 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC found for this A-ID "
    1386          10 :                            "(PAC-Type %d)", data->current_pac->pac_type);
    1387          20 :                 wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-FAST: A-ID-Info",
    1388          10 :                                   data->current_pac->a_id_info,
    1389          10 :                                   data->current_pac->a_id_info_len);
    1390             :         }
    1391          21 : }
    1392             : 
    1393             : 
    1394          10 : static int eap_fast_use_pac_opaque(struct eap_sm *sm,
    1395             :                                    struct eap_fast_data *data,
    1396             :                                    struct eap_fast_pac *pac)
    1397             : {
    1398             :         u8 *tlv;
    1399             :         size_t tlv_len, olen;
    1400             :         struct eap_tlv_hdr *ehdr;
    1401             : 
    1402          10 :         olen = pac->pac_opaque_len;
    1403          10 :         tlv_len = sizeof(*ehdr) + olen;
    1404          10 :         tlv = os_malloc(tlv_len);
    1405          10 :         if (tlv) {
    1406          10 :                 ehdr = (struct eap_tlv_hdr *) tlv;
    1407          10 :                 ehdr->tlv_type = host_to_be16(PAC_TYPE_PAC_OPAQUE);
    1408          10 :                 ehdr->length = host_to_be16(olen);
    1409          10 :                 os_memcpy(ehdr + 1, pac->pac_opaque, olen);
    1410             :         }
    1411          20 :         if (tlv == NULL ||
    1412          10 :             tls_connection_client_hello_ext(sm->ssl_ctx, data->ssl.conn,
    1413             :                                             TLS_EXT_PAC_OPAQUE,
    1414             :                                             tlv, tlv_len) < 0) {
    1415           0 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to add PAC-Opaque TLS "
    1416             :                            "extension");
    1417           0 :                 os_free(tlv);
    1418           0 :                 return -1;
    1419             :         }
    1420          10 :         os_free(tlv);
    1421             : 
    1422          10 :         return 0;
    1423             : }
    1424             : 
    1425             : 
    1426          11 : static int eap_fast_clear_pac_opaque_ext(struct eap_sm *sm,
    1427             :                                          struct eap_fast_data *data)
    1428             : {
    1429          11 :         if (tls_connection_client_hello_ext(sm->ssl_ctx, data->ssl.conn,
    1430             :                                             TLS_EXT_PAC_OPAQUE, NULL, 0) < 0) {
    1431           0 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to remove PAC-Opaque "
    1432             :                            "TLS extension");
    1433           0 :                 return -1;
    1434             :         }
    1435          11 :         return 0;
    1436             : }
    1437             : 
    1438             : 
    1439          11 : static int eap_fast_set_provisioning_ciphers(struct eap_sm *sm,
    1440             :                                              struct eap_fast_data *data)
    1441             : {
    1442             :         u8 ciphers[5];
    1443          11 :         int count = 0;
    1444             : 
    1445          11 :         if (data->provisioning_allowed & EAP_FAST_PROV_UNAUTH) {
    1446           4 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: Enabling unauthenticated "
    1447             :                            "provisioning TLS cipher suites");
    1448           4 :                 ciphers[count++] = TLS_CIPHER_ANON_DH_AES128_SHA;
    1449             :         }
    1450             : 
    1451          11 :         if (data->provisioning_allowed & EAP_FAST_PROV_AUTH) {
    1452           7 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: Enabling authenticated "
    1453             :                            "provisioning TLS cipher suites");
    1454           7 :                 ciphers[count++] = TLS_CIPHER_RSA_DHE_AES128_SHA;
    1455           7 :                 ciphers[count++] = TLS_CIPHER_AES128_SHA;
    1456           7 :                 ciphers[count++] = TLS_CIPHER_RC4_SHA;
    1457             :         }
    1458             : 
    1459          11 :         ciphers[count++] = TLS_CIPHER_NONE;
    1460             : 
    1461          11 :         if (tls_connection_set_cipher_list(sm->ssl_ctx, data->ssl.conn,
    1462             :                                            ciphers)) {
    1463           0 :                 wpa_printf(MSG_INFO, "EAP-FAST: Could not configure TLS "
    1464             :                            "cipher suites for provisioning");
    1465           0 :                 return -1;
    1466             :         }
    1467             : 
    1468          11 :         return 0;
    1469             : }
    1470             : 
    1471             : 
    1472          21 : static int eap_fast_process_start(struct eap_sm *sm,
    1473             :                                   struct eap_fast_data *data, u8 flags,
    1474             :                                   const u8 *pos, size_t left)
    1475             : {
    1476             :         const u8 *a_id;
    1477             :         size_t a_id_len;
    1478             : 
    1479             :         /* EAP-FAST Version negotiation (section 3.1) */
    1480          21 :         wpa_printf(MSG_DEBUG, "EAP-FAST: Start (server ver=%d, own ver=%d)",
    1481             :                    flags & EAP_TLS_VERSION_MASK, data->fast_version);
    1482          21 :         if ((flags & EAP_TLS_VERSION_MASK) < data->fast_version)
    1483           0 :                 data->fast_version = flags & EAP_TLS_VERSION_MASK;
    1484          21 :         wpa_printf(MSG_DEBUG, "EAP-FAST: Using FAST version %d",
    1485             :                    data->fast_version);
    1486             : 
    1487          21 :         a_id = eap_fast_get_a_id(pos, left, &a_id_len);
    1488          21 :         eap_fast_select_pac(data, a_id, a_id_len);
    1489             : 
    1490          21 :         if (data->resuming && data->current_pac) {
    1491           0 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: Trying to resume session - "
    1492             :                            "do not add PAC-Opaque to TLS ClientHello");
    1493           0 :                 if (eap_fast_clear_pac_opaque_ext(sm, data) < 0)
    1494           0 :                         return -1;
    1495          21 :         } else if (data->current_pac) {
    1496             :                 /*
    1497             :                  * PAC found for the A-ID and we are not resuming an old
    1498             :                  * session, so add PAC-Opaque extension to ClientHello.
    1499             :                  */
    1500          10 :                 if (eap_fast_use_pac_opaque(sm, data, data->current_pac) < 0)
    1501           0 :                         return -1;
    1502             :         } else {
    1503             :                 /* No PAC found, so we must provision one. */
    1504          11 :                 if (!data->provisioning_allowed) {
    1505           0 :                         wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC found and "
    1506             :                                    "provisioning disabled");
    1507           0 :                         return -1;
    1508             :                 }
    1509          11 :                 wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC found - "
    1510             :                            "starting provisioning");
    1511          22 :                 if (eap_fast_set_provisioning_ciphers(sm, data) < 0 ||
    1512          11 :                     eap_fast_clear_pac_opaque_ext(sm, data) < 0)
    1513           0 :                         return -1;
    1514          11 :                 data->provisioning = 1;
    1515             :         }
    1516             : 
    1517          21 :         return 0;
    1518             : }
    1519             : 
    1520             : 
    1521         134 : static struct wpabuf * eap_fast_process(struct eap_sm *sm, void *priv,
    1522             :                                         struct eap_method_ret *ret,
    1523             :                                         const struct wpabuf *reqData)
    1524             : {
    1525             :         const struct eap_hdr *req;
    1526             :         size_t left;
    1527             :         int res;
    1528             :         u8 flags, id;
    1529             :         struct wpabuf *resp;
    1530             :         const u8 *pos;
    1531         134 :         struct eap_fast_data *data = priv;
    1532             : 
    1533         134 :         pos = eap_peer_tls_process_init(sm, &data->ssl, EAP_TYPE_FAST, ret,
    1534             :                                         reqData, &left, &flags);
    1535         134 :         if (pos == NULL)
    1536           0 :                 return NULL;
    1537             : 
    1538         134 :         req = wpabuf_head(reqData);
    1539         134 :         id = req->identifier;
    1540             : 
    1541         134 :         if (flags & EAP_TLS_FLAGS_START) {
    1542          21 :                 if (eap_fast_process_start(sm, data, flags, pos, left) < 0)
    1543           0 :                         return NULL;
    1544             : 
    1545          21 :                 left = 0; /* A-ID is not used in further packet processing */
    1546             :         }
    1547             : 
    1548         134 :         resp = NULL;
    1549         209 :         if (tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&
    1550         150 :             !data->resuming) {
    1551             :                 /* Process tunneled (encrypted) phase 2 data. */
    1552             :                 struct wpabuf msg;
    1553          75 :                 wpabuf_set(&msg, pos, left);
    1554          75 :                 res = eap_fast_decrypt(sm, data, ret, req, &msg, &resp);
    1555          75 :                 if (res < 0) {
    1556           0 :                         ret->methodState = METHOD_DONE;
    1557           0 :                         ret->decision = DECISION_FAIL;
    1558             :                         /*
    1559             :                          * Ack possible Alert that may have caused failure in
    1560             :                          * decryption.
    1561             :                          */
    1562           0 :                         res = 1;
    1563             :                 }
    1564             :         } else {
    1565             :                 /* Continue processing TLS handshake (phase 1). */
    1566          59 :                 res = eap_peer_tls_process_helper(sm, &data->ssl,
    1567             :                                                   EAP_TYPE_FAST,
    1568             :                                                   data->fast_version, id, pos,
    1569             :                                                   left, &resp);
    1570             : 
    1571          59 :                 if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) {
    1572             :                         char cipher[80];
    1573          21 :                         wpa_printf(MSG_DEBUG,
    1574             :                                    "EAP-FAST: TLS done, proceed to Phase 2");
    1575          32 :                         if (data->provisioning &&
    1576          11 :                             (!(data->provisioning_allowed &
    1577           7 :                                EAP_FAST_PROV_AUTH) ||
    1578           7 :                              tls_get_cipher(sm->ssl_ctx, data->ssl.conn,
    1579           7 :                                             cipher, sizeof(cipher)) < 0 ||
    1580          14 :                              os_strstr(cipher, "ADH-") ||
    1581           7 :                              os_strstr(cipher, "anon"))) {
    1582           4 :                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Using "
    1583             :                                            "anonymous (unauthenticated) "
    1584             :                                            "provisioning");
    1585           4 :                                 data->anon_provisioning = 1;
    1586             :                         } else
    1587          17 :                                 data->anon_provisioning = 0;
    1588          21 :                         data->resuming = 0;
    1589          21 :                         eap_fast_derive_keys(sm, data);
    1590             :                 }
    1591             : 
    1592          59 :                 if (res == 2) {
    1593             :                         struct wpabuf msg;
    1594             :                         /*
    1595             :                          * Application data included in the handshake message.
    1596             :                          */
    1597          11 :                         wpabuf_free(data->pending_phase2_req);
    1598          11 :                         data->pending_phase2_req = resp;
    1599          11 :                         resp = NULL;
    1600          11 :                         wpabuf_set(&msg, pos, left);
    1601          11 :                         res = eap_fast_decrypt(sm, data, ret, req, &msg,
    1602             :                                                &resp);
    1603             :                 }
    1604             :         }
    1605             : 
    1606         134 :         if (res == 1) {
    1607           6 :                 wpabuf_free(resp);
    1608           6 :                 return eap_peer_tls_build_ack(id, EAP_TYPE_FAST,
    1609             :                                               data->fast_version);
    1610             :         }
    1611             : 
    1612         128 :         return resp;
    1613             : }
    1614             : 
    1615             : 
    1616             : #if 0 /* FIX */
    1617             : static Boolean eap_fast_has_reauth_data(struct eap_sm *sm, void *priv)
    1618             : {
    1619             :         struct eap_fast_data *data = priv;
    1620             :         return tls_connection_established(sm->ssl_ctx, data->ssl.conn);
    1621             : }
    1622             : 
    1623             : 
    1624             : static void eap_fast_deinit_for_reauth(struct eap_sm *sm, void *priv)
    1625             : {
    1626             :         struct eap_fast_data *data = priv;
    1627             :         os_free(data->key_block_p);
    1628             :         data->key_block_p = NULL;
    1629             :         wpabuf_free(data->pending_phase2_req);
    1630             :         data->pending_phase2_req = NULL;
    1631             : }
    1632             : 
    1633             : 
    1634             : static void * eap_fast_init_for_reauth(struct eap_sm *sm, void *priv)
    1635             : {
    1636             :         struct eap_fast_data *data = priv;
    1637             :         if (eap_peer_tls_reauth_init(sm, &data->ssl)) {
    1638             :                 os_free(data);
    1639             :                 return NULL;
    1640             :         }
    1641             :         os_memset(data->key_data, 0, EAP_FAST_KEY_LEN);
    1642             :         os_memset(data->emsk, 0, EAP_EMSK_LEN);
    1643             :         os_free(data->session_id);
    1644             :         data->session_id = NULL;
    1645             :         if (data->phase2_priv && data->phase2_method &&
    1646             :             data->phase2_method->init_for_reauth)
    1647             :                 data->phase2_method->init_for_reauth(sm, data->phase2_priv);
    1648             :         data->phase2_success = 0;
    1649             :         data->resuming = 1;
    1650             :         data->provisioning = 0;
    1651             :         data->anon_provisioning = 0;
    1652             :         data->simck_idx = 0;
    1653             :         return priv;
    1654             : }
    1655             : #endif
    1656             : 
    1657             : 
    1658          14 : static int eap_fast_get_status(struct eap_sm *sm, void *priv, char *buf,
    1659             :                                size_t buflen, int verbose)
    1660             : {
    1661          14 :         struct eap_fast_data *data = priv;
    1662             :         int len, ret;
    1663             : 
    1664          14 :         len = eap_peer_tls_status(sm, &data->ssl, buf, buflen, verbose);
    1665          14 :         if (data->phase2_method) {
    1666          14 :                 ret = os_snprintf(buf + len, buflen - len,
    1667             :                                   "EAP-FAST Phase2 method=%s\n",
    1668          14 :                                   data->phase2_method->name);
    1669          14 :                 if (os_snprintf_error(buflen - len, ret))
    1670           0 :                         return len;
    1671          14 :                 len += ret;
    1672             :         }
    1673          14 :         return len;
    1674             : }
    1675             : 
    1676             : 
    1677         134 : static Boolean eap_fast_isKeyAvailable(struct eap_sm *sm, void *priv)
    1678             : {
    1679         134 :         struct eap_fast_data *data = priv;
    1680         134 :         return data->success;
    1681             : }
    1682             : 
    1683             : 
    1684          26 : static u8 * eap_fast_getKey(struct eap_sm *sm, void *priv, size_t *len)
    1685             : {
    1686          26 :         struct eap_fast_data *data = priv;
    1687             :         u8 *key;
    1688             : 
    1689          26 :         if (!data->success)
    1690           0 :                 return NULL;
    1691             : 
    1692          26 :         key = os_malloc(EAP_FAST_KEY_LEN);
    1693          26 :         if (key == NULL)
    1694           0 :                 return NULL;
    1695             : 
    1696          26 :         *len = EAP_FAST_KEY_LEN;
    1697          26 :         os_memcpy(key, data->key_data, EAP_FAST_KEY_LEN);
    1698             : 
    1699          26 :         return key;
    1700             : }
    1701             : 
    1702             : 
    1703          26 : static u8 * eap_fast_get_session_id(struct eap_sm *sm, void *priv, size_t *len)
    1704             : {
    1705          26 :         struct eap_fast_data *data = priv;
    1706             :         u8 *id;
    1707             : 
    1708          26 :         if (!data->success)
    1709           0 :                 return NULL;
    1710             : 
    1711          26 :         id = os_malloc(data->id_len);
    1712          26 :         if (id == NULL)
    1713           0 :                 return NULL;
    1714             : 
    1715          26 :         *len = data->id_len;
    1716          26 :         os_memcpy(id, data->session_id, data->id_len);
    1717             : 
    1718          26 :         return id;
    1719             : }
    1720             : 
    1721             : 
    1722           2 : static u8 * eap_fast_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
    1723             : {
    1724           2 :         struct eap_fast_data *data = priv;
    1725             :         u8 *key;
    1726             : 
    1727           2 :         if (!data->success)
    1728           0 :                 return NULL;
    1729             : 
    1730           2 :         key = os_malloc(EAP_EMSK_LEN);
    1731           2 :         if (key == NULL)
    1732           0 :                 return NULL;
    1733             : 
    1734           2 :         *len = EAP_EMSK_LEN;
    1735           2 :         os_memcpy(key, data->emsk, EAP_EMSK_LEN);
    1736             : 
    1737           2 :         return key;
    1738             : }
    1739             : 
    1740             : 
    1741          30 : int eap_peer_fast_register(void)
    1742             : {
    1743             :         struct eap_method *eap;
    1744             :         int ret;
    1745             : 
    1746          30 :         eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
    1747             :                                     EAP_VENDOR_IETF, EAP_TYPE_FAST, "FAST");
    1748          30 :         if (eap == NULL)
    1749           0 :                 return -1;
    1750             : 
    1751          30 :         eap->init = eap_fast_init;
    1752          30 :         eap->deinit = eap_fast_deinit;
    1753          30 :         eap->process = eap_fast_process;
    1754          30 :         eap->isKeyAvailable = eap_fast_isKeyAvailable;
    1755          30 :         eap->getKey = eap_fast_getKey;
    1756          30 :         eap->getSessionId = eap_fast_get_session_id;
    1757          30 :         eap->get_status = eap_fast_get_status;
    1758             : #if 0
    1759             :         eap->has_reauth_data = eap_fast_has_reauth_data;
    1760             :         eap->deinit_for_reauth = eap_fast_deinit_for_reauth;
    1761             :         eap->init_for_reauth = eap_fast_init_for_reauth;
    1762             : #endif
    1763          30 :         eap->get_emsk = eap_fast_get_emsk;
    1764             : 
    1765          30 :         ret = eap_peer_method_register(eap);
    1766          30 :         if (ret)
    1767           0 :                 eap_peer_method_free(eap);
    1768          30 :         return ret;
    1769             : }

Generated by: LCOV version 1.10