1189251Ssam/* 2189251Ssam * EAP peer method: EAP-FAST (RFC 4851) 3189251Ssam * Copyright (c) 2004-2008, Jouni Malinen <j@w1.fi> 4189251Ssam * 5252726Srpaulo * This software may be distributed under the terms of the BSD license. 6252726Srpaulo * See README for more details. 7189251Ssam */ 8189251Ssam 9189251Ssam#include "includes.h" 10189251Ssam 11189251Ssam#include "common.h" 12214734Srpaulo#include "crypto/tls.h" 13214734Srpaulo#include "crypto/sha1.h" 14214734Srpaulo#include "eap_common/eap_tlv_common.h" 15189251Ssam#include "eap_i.h" 16189251Ssam#include "eap_tls_common.h" 17189251Ssam#include "eap_config.h" 18189251Ssam#include "eap_fast_pac.h" 19189251Ssam 20189251Ssam#ifdef EAP_FAST_DYNAMIC 21189251Ssam#include "eap_fast_pac.c" 22189251Ssam#endif /* EAP_FAST_DYNAMIC */ 23189251Ssam 24189251Ssam/* TODO: 25189251Ssam * - test session resumption and enable it if it interoperates 26189251Ssam * - password change (pending mschapv2 packet; replay decrypted packet) 27189251Ssam */ 28189251Ssam 29189251Ssam 30189251Ssamstatic void eap_fast_deinit(struct eap_sm *sm, void *priv); 31189251Ssam 32189251Ssam 33189251Ssamstruct eap_fast_data { 34189251Ssam struct eap_ssl_data ssl; 35189251Ssam 36189251Ssam int fast_version; 37189251Ssam 38189251Ssam const struct eap_method *phase2_method; 39189251Ssam void *phase2_priv; 40189251Ssam int phase2_success; 41189251Ssam 42189251Ssam struct eap_method_type phase2_type; 43189251Ssam struct eap_method_type *phase2_types; 44189251Ssam size_t num_phase2_types; 45189251Ssam int resuming; /* starting a resumed session */ 46189251Ssam struct eap_fast_key_block_provisioning *key_block_p; 47189251Ssam#define EAP_FAST_PROV_UNAUTH 1 48189251Ssam#define EAP_FAST_PROV_AUTH 2 49189251Ssam int provisioning_allowed; /* Allowed PAC provisioning modes */ 50189251Ssam int provisioning; /* doing PAC provisioning (not the normal auth) */ 51189251Ssam int anon_provisioning; /* doing anonymous (unauthenticated) 52189251Ssam * provisioning */ 53189251Ssam int session_ticket_used; 54189251Ssam 55189251Ssam u8 key_data[EAP_FAST_KEY_LEN]; 56189251Ssam u8 emsk[EAP_EMSK_LEN]; 57189251Ssam int success; 58189251Ssam 59189251Ssam struct eap_fast_pac *pac; 60189251Ssam struct eap_fast_pac *current_pac; 61189251Ssam size_t max_pac_list_len; 62189251Ssam int use_pac_binary_format; 63189251Ssam 64189251Ssam u8 simck[EAP_FAST_SIMCK_LEN]; 65189251Ssam int simck_idx; 66189251Ssam 67189251Ssam struct wpabuf *pending_phase2_req; 68189251Ssam}; 69189251Ssam 70189251Ssam 71189251Ssamstatic int eap_fast_session_ticket_cb(void *ctx, const u8 *ticket, size_t len, 72189251Ssam const u8 *client_random, 73189251Ssam const u8 *server_random, 74189251Ssam u8 *master_secret) 75189251Ssam{ 76189251Ssam struct eap_fast_data *data = ctx; 77189251Ssam 78189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: SessionTicket callback"); 79189251Ssam 80189251Ssam if (client_random == NULL || server_random == NULL || 81189251Ssam master_secret == NULL) { 82189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: SessionTicket failed - fall " 83189251Ssam "back to full TLS handshake"); 84189251Ssam data->session_ticket_used = 0; 85189251Ssam if (data->provisioning_allowed) { 86189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Try to provision a " 87189251Ssam "new PAC-Key"); 88189251Ssam data->provisioning = 1; 89189251Ssam data->current_pac = NULL; 90189251Ssam } 91189251Ssam return 0; 92189251Ssam } 93189251Ssam 94189251Ssam wpa_hexdump(MSG_DEBUG, "EAP-FAST: SessionTicket", ticket, len); 95189251Ssam 96189251Ssam if (data->current_pac == NULL) { 97189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC-Key available for " 98189251Ssam "using SessionTicket"); 99189251Ssam data->session_ticket_used = 0; 100189251Ssam return 0; 101189251Ssam } 102189251Ssam 103189251Ssam eap_fast_derive_master_secret(data->current_pac->pac_key, 104189251Ssam server_random, client_random, 105189251Ssam master_secret); 106189251Ssam 107189251Ssam data->session_ticket_used = 1; 108189251Ssam 109189251Ssam return 1; 110189251Ssam} 111189251Ssam 112189251Ssam 113189251Ssamstatic int eap_fast_parse_phase1(struct eap_fast_data *data, 114189251Ssam const char *phase1) 115189251Ssam{ 116189251Ssam const char *pos; 117189251Ssam 118189251Ssam pos = os_strstr(phase1, "fast_provisioning="); 119189251Ssam if (pos) { 120189251Ssam data->provisioning_allowed = atoi(pos + 18); 121189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Automatic PAC provisioning " 122189251Ssam "mode: %d", data->provisioning_allowed); 123189251Ssam } 124189251Ssam 125189251Ssam pos = os_strstr(phase1, "fast_max_pac_list_len="); 126189251Ssam if (pos) { 127189251Ssam data->max_pac_list_len = atoi(pos + 22); 128189251Ssam if (data->max_pac_list_len == 0) 129189251Ssam data->max_pac_list_len = 1; 130189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Maximum PAC list length: %lu", 131189251Ssam (unsigned long) data->max_pac_list_len); 132189251Ssam } 133189251Ssam 134189251Ssam pos = os_strstr(phase1, "fast_pac_format=binary"); 135189251Ssam if (pos) { 136189251Ssam data->use_pac_binary_format = 1; 137189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Using binary format for PAC " 138189251Ssam "list"); 139189251Ssam } 140189251Ssam 141189251Ssam return 0; 142189251Ssam} 143189251Ssam 144189251Ssam 145189251Ssamstatic void * eap_fast_init(struct eap_sm *sm) 146189251Ssam{ 147189251Ssam struct eap_fast_data *data; 148189251Ssam struct eap_peer_config *config = eap_get_config(sm); 149189251Ssam 150189251Ssam data = os_zalloc(sizeof(*data)); 151189251Ssam if (data == NULL) 152189251Ssam return NULL; 153189251Ssam data->fast_version = EAP_FAST_VERSION; 154189251Ssam data->max_pac_list_len = 10; 155189251Ssam 156189251Ssam if (config && config->phase1 && 157189251Ssam eap_fast_parse_phase1(data, config->phase1) < 0) { 158189251Ssam eap_fast_deinit(sm, data); 159189251Ssam return NULL; 160189251Ssam } 161189251Ssam 162189251Ssam if (eap_peer_select_phase2_methods(config, "auth=", 163189251Ssam &data->phase2_types, 164189251Ssam &data->num_phase2_types) < 0) { 165189251Ssam eap_fast_deinit(sm, data); 166189251Ssam return NULL; 167189251Ssam } 168189251Ssam 169189251Ssam data->phase2_type.vendor = EAP_VENDOR_IETF; 170189251Ssam data->phase2_type.method = EAP_TYPE_NONE; 171189251Ssam 172252726Srpaulo if (eap_peer_tls_ssl_init(sm, &data->ssl, config, EAP_TYPE_FAST)) { 173189251Ssam wpa_printf(MSG_INFO, "EAP-FAST: Failed to initialize SSL."); 174189251Ssam eap_fast_deinit(sm, data); 175189251Ssam return NULL; 176189251Ssam } 177189251Ssam 178189251Ssam if (tls_connection_set_session_ticket_cb(sm->ssl_ctx, data->ssl.conn, 179189251Ssam eap_fast_session_ticket_cb, 180189251Ssam data) < 0) { 181189251Ssam wpa_printf(MSG_INFO, "EAP-FAST: Failed to set SessionTicket " 182189251Ssam "callback"); 183189251Ssam eap_fast_deinit(sm, data); 184189251Ssam return NULL; 185189251Ssam } 186189251Ssam 187189251Ssam /* 188189251Ssam * The local RADIUS server in a Cisco AP does not seem to like empty 189189251Ssam * fragments before data, so disable that workaround for CBC. 190189251Ssam * TODO: consider making this configurable 191189251Ssam */ 192189251Ssam if (tls_connection_enable_workaround(sm->ssl_ctx, data->ssl.conn)) { 193189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to enable TLS " 194189251Ssam "workarounds"); 195189251Ssam } 196189251Ssam 197189251Ssam if (data->use_pac_binary_format && 198189251Ssam eap_fast_load_pac_bin(sm, &data->pac, config->pac_file) < 0) { 199189251Ssam eap_fast_deinit(sm, data); 200189251Ssam return NULL; 201189251Ssam } 202189251Ssam 203189251Ssam if (!data->use_pac_binary_format && 204189251Ssam eap_fast_load_pac(sm, &data->pac, config->pac_file) < 0) { 205189251Ssam eap_fast_deinit(sm, data); 206189251Ssam return NULL; 207189251Ssam } 208189251Ssam eap_fast_pac_list_truncate(data->pac, data->max_pac_list_len); 209189251Ssam 210189251Ssam if (data->pac == NULL && !data->provisioning_allowed) { 211189251Ssam wpa_printf(MSG_INFO, "EAP-FAST: No PAC configured and " 212189251Ssam "provisioning disabled"); 213189251Ssam eap_fast_deinit(sm, data); 214189251Ssam return NULL; 215189251Ssam } 216189251Ssam 217189251Ssam return data; 218189251Ssam} 219189251Ssam 220189251Ssam 221189251Ssamstatic void eap_fast_deinit(struct eap_sm *sm, void *priv) 222189251Ssam{ 223189251Ssam struct eap_fast_data *data = priv; 224189251Ssam struct eap_fast_pac *pac, *prev; 225189251Ssam 226189251Ssam if (data == NULL) 227189251Ssam return; 228189251Ssam if (data->phase2_priv && data->phase2_method) 229189251Ssam data->phase2_method->deinit(sm, data->phase2_priv); 230189251Ssam os_free(data->phase2_types); 231189251Ssam os_free(data->key_block_p); 232189251Ssam eap_peer_tls_ssl_deinit(sm, &data->ssl); 233189251Ssam 234189251Ssam pac = data->pac; 235189251Ssam prev = NULL; 236189251Ssam while (pac) { 237189251Ssam prev = pac; 238189251Ssam pac = pac->next; 239189251Ssam eap_fast_free_pac(prev); 240189251Ssam } 241189251Ssam wpabuf_free(data->pending_phase2_req); 242189251Ssam os_free(data); 243189251Ssam} 244189251Ssam 245189251Ssam 246189251Ssamstatic int eap_fast_derive_msk(struct eap_fast_data *data) 247189251Ssam{ 248189251Ssam eap_fast_derive_eap_msk(data->simck, data->key_data); 249189251Ssam eap_fast_derive_eap_emsk(data->simck, data->emsk); 250189251Ssam data->success = 1; 251189251Ssam return 0; 252189251Ssam} 253189251Ssam 254189251Ssam 255189251Ssamstatic void eap_fast_derive_key_auth(struct eap_sm *sm, 256189251Ssam struct eap_fast_data *data) 257189251Ssam{ 258189251Ssam u8 *sks; 259189251Ssam 260189251Ssam /* RFC 4851, Section 5.1: 261189251Ssam * Extra key material after TLS key_block: session_key_seed[40] 262189251Ssam */ 263189251Ssam 264189251Ssam sks = eap_fast_derive_key(sm->ssl_ctx, data->ssl.conn, "key expansion", 265189251Ssam EAP_FAST_SKS_LEN); 266189251Ssam if (sks == NULL) { 267189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to derive " 268189251Ssam "session_key_seed"); 269189251Ssam return; 270189251Ssam } 271189251Ssam 272189251Ssam /* 273189251Ssam * RFC 4851, Section 5.2: 274189251Ssam * S-IMCK[0] = session_key_seed 275189251Ssam */ 276189251Ssam wpa_hexdump_key(MSG_DEBUG, 277189251Ssam "EAP-FAST: session_key_seed (SKS = S-IMCK[0])", 278189251Ssam sks, EAP_FAST_SKS_LEN); 279189251Ssam data->simck_idx = 0; 280189251Ssam os_memcpy(data->simck, sks, EAP_FAST_SIMCK_LEN); 281189251Ssam os_free(sks); 282189251Ssam} 283189251Ssam 284189251Ssam 285189251Ssamstatic void eap_fast_derive_key_provisioning(struct eap_sm *sm, 286189251Ssam struct eap_fast_data *data) 287189251Ssam{ 288189251Ssam os_free(data->key_block_p); 289189251Ssam data->key_block_p = (struct eap_fast_key_block_provisioning *) 290189251Ssam eap_fast_derive_key(sm->ssl_ctx, data->ssl.conn, 291189251Ssam "key expansion", 292189251Ssam sizeof(*data->key_block_p)); 293189251Ssam if (data->key_block_p == NULL) { 294189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to derive key block"); 295189251Ssam return; 296189251Ssam } 297189251Ssam /* 298189251Ssam * RFC 4851, Section 5.2: 299189251Ssam * S-IMCK[0] = session_key_seed 300189251Ssam */ 301189251Ssam wpa_hexdump_key(MSG_DEBUG, 302189251Ssam "EAP-FAST: session_key_seed (SKS = S-IMCK[0])", 303189251Ssam data->key_block_p->session_key_seed, 304189251Ssam sizeof(data->key_block_p->session_key_seed)); 305189251Ssam data->simck_idx = 0; 306189251Ssam os_memcpy(data->simck, data->key_block_p->session_key_seed, 307189251Ssam EAP_FAST_SIMCK_LEN); 308189251Ssam wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: server_challenge", 309189251Ssam data->key_block_p->server_challenge, 310189251Ssam sizeof(data->key_block_p->server_challenge)); 311189251Ssam wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: client_challenge", 312189251Ssam data->key_block_p->client_challenge, 313189251Ssam sizeof(data->key_block_p->client_challenge)); 314189251Ssam} 315189251Ssam 316189251Ssam 317189251Ssamstatic void eap_fast_derive_keys(struct eap_sm *sm, struct eap_fast_data *data) 318189251Ssam{ 319189251Ssam if (data->anon_provisioning) 320189251Ssam eap_fast_derive_key_provisioning(sm, data); 321189251Ssam else 322189251Ssam eap_fast_derive_key_auth(sm, data); 323189251Ssam} 324189251Ssam 325189251Ssam 326189251Ssamstatic int eap_fast_init_phase2_method(struct eap_sm *sm, 327189251Ssam struct eap_fast_data *data) 328189251Ssam{ 329189251Ssam data->phase2_method = 330189251Ssam eap_peer_get_eap_method(data->phase2_type.vendor, 331189251Ssam data->phase2_type.method); 332189251Ssam if (data->phase2_method == NULL) 333189251Ssam return -1; 334189251Ssam 335189251Ssam if (data->key_block_p) { 336189251Ssam sm->auth_challenge = data->key_block_p->server_challenge; 337189251Ssam sm->peer_challenge = data->key_block_p->client_challenge; 338189251Ssam } 339189251Ssam sm->init_phase2 = 1; 340189251Ssam data->phase2_priv = data->phase2_method->init(sm); 341189251Ssam sm->init_phase2 = 0; 342189251Ssam sm->auth_challenge = NULL; 343189251Ssam sm->peer_challenge = NULL; 344189251Ssam 345189251Ssam return data->phase2_priv == NULL ? -1 : 0; 346189251Ssam} 347189251Ssam 348189251Ssam 349189251Ssamstatic int eap_fast_select_phase2_method(struct eap_fast_data *data, u8 type) 350189251Ssam{ 351189251Ssam size_t i; 352189251Ssam 353189251Ssam /* TODO: TNC with anonymous provisioning; need to require both 354189251Ssam * completed MSCHAPv2 and TNC */ 355189251Ssam 356189251Ssam if (data->anon_provisioning && type != EAP_TYPE_MSCHAPV2) { 357189251Ssam wpa_printf(MSG_INFO, "EAP-FAST: Only EAP-MSCHAPv2 is allowed " 358189251Ssam "during unauthenticated provisioning; reject phase2" 359189251Ssam " type %d", type); 360189251Ssam return -1; 361189251Ssam } 362189251Ssam 363189251Ssam#ifdef EAP_TNC 364189251Ssam if (type == EAP_TYPE_TNC) { 365189251Ssam data->phase2_type.vendor = EAP_VENDOR_IETF; 366189251Ssam data->phase2_type.method = EAP_TYPE_TNC; 367189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Selected Phase 2 EAP " 368189251Ssam "vendor %d method %d for TNC", 369189251Ssam data->phase2_type.vendor, 370189251Ssam data->phase2_type.method); 371189251Ssam return 0; 372189251Ssam } 373189251Ssam#endif /* EAP_TNC */ 374189251Ssam 375189251Ssam for (i = 0; i < data->num_phase2_types; i++) { 376189251Ssam if (data->phase2_types[i].vendor != EAP_VENDOR_IETF || 377189251Ssam data->phase2_types[i].method != type) 378189251Ssam continue; 379189251Ssam 380189251Ssam data->phase2_type.vendor = data->phase2_types[i].vendor; 381189251Ssam data->phase2_type.method = data->phase2_types[i].method; 382189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Selected Phase 2 EAP " 383189251Ssam "vendor %d method %d", 384189251Ssam data->phase2_type.vendor, 385189251Ssam data->phase2_type.method); 386189251Ssam break; 387189251Ssam } 388189251Ssam 389189251Ssam if (type != data->phase2_type.method || type == EAP_TYPE_NONE) 390189251Ssam return -1; 391189251Ssam 392189251Ssam return 0; 393189251Ssam} 394189251Ssam 395189251Ssam 396189251Ssamstatic int eap_fast_phase2_request(struct eap_sm *sm, 397189251Ssam struct eap_fast_data *data, 398189251Ssam struct eap_method_ret *ret, 399189251Ssam struct eap_hdr *hdr, 400189251Ssam struct wpabuf **resp) 401189251Ssam{ 402189251Ssam size_t len = be_to_host16(hdr->length); 403189251Ssam u8 *pos; 404189251Ssam struct eap_method_ret iret; 405189251Ssam struct eap_peer_config *config = eap_get_config(sm); 406189251Ssam struct wpabuf msg; 407189251Ssam 408189251Ssam if (len <= sizeof(struct eap_hdr)) { 409189251Ssam wpa_printf(MSG_INFO, "EAP-FAST: too short " 410189251Ssam "Phase 2 request (len=%lu)", (unsigned long) len); 411189251Ssam return -1; 412189251Ssam } 413189251Ssam pos = (u8 *) (hdr + 1); 414189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 Request: type=%d", *pos); 415189251Ssam if (*pos == EAP_TYPE_IDENTITY) { 416189251Ssam *resp = eap_sm_buildIdentity(sm, hdr->identifier, 1); 417189251Ssam return 0; 418189251Ssam } 419189251Ssam 420189251Ssam if (data->phase2_priv && data->phase2_method && 421189251Ssam *pos != data->phase2_type.method) { 422189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 EAP sequence - " 423189251Ssam "deinitialize previous method"); 424189251Ssam data->phase2_method->deinit(sm, data->phase2_priv); 425189251Ssam data->phase2_method = NULL; 426189251Ssam data->phase2_priv = NULL; 427189251Ssam data->phase2_type.vendor = EAP_VENDOR_IETF; 428189251Ssam data->phase2_type.method = EAP_TYPE_NONE; 429189251Ssam } 430189251Ssam 431189251Ssam if (data->phase2_type.vendor == EAP_VENDOR_IETF && 432189251Ssam data->phase2_type.method == EAP_TYPE_NONE && 433189251Ssam eap_fast_select_phase2_method(data, *pos) < 0) { 434189251Ssam if (eap_peer_tls_phase2_nak(data->phase2_types, 435189251Ssam data->num_phase2_types, 436189251Ssam hdr, resp)) 437189251Ssam return -1; 438189251Ssam return 0; 439189251Ssam } 440189251Ssam 441252726Srpaulo if ((data->phase2_priv == NULL && 442252726Srpaulo eap_fast_init_phase2_method(sm, data) < 0) || 443252726Srpaulo data->phase2_method == NULL) { 444189251Ssam wpa_printf(MSG_INFO, "EAP-FAST: Failed to initialize " 445189251Ssam "Phase 2 EAP method %d", *pos); 446189251Ssam ret->methodState = METHOD_DONE; 447189251Ssam ret->decision = DECISION_FAIL; 448189251Ssam return -1; 449189251Ssam } 450189251Ssam 451189251Ssam os_memset(&iret, 0, sizeof(iret)); 452189251Ssam wpabuf_set(&msg, hdr, len); 453189251Ssam *resp = data->phase2_method->process(sm, data->phase2_priv, &iret, 454189251Ssam &msg); 455189251Ssam if (*resp == NULL || 456189251Ssam (iret.methodState == METHOD_DONE && 457189251Ssam iret.decision == DECISION_FAIL)) { 458189251Ssam ret->methodState = METHOD_DONE; 459189251Ssam ret->decision = DECISION_FAIL; 460189251Ssam } else if ((iret.methodState == METHOD_DONE || 461189251Ssam iret.methodState == METHOD_MAY_CONT) && 462189251Ssam (iret.decision == DECISION_UNCOND_SUCC || 463189251Ssam iret.decision == DECISION_COND_SUCC)) { 464189251Ssam data->phase2_success = 1; 465189251Ssam } 466189251Ssam 467189251Ssam if (*resp == NULL && config && 468189251Ssam (config->pending_req_identity || config->pending_req_password || 469189251Ssam config->pending_req_otp || config->pending_req_new_password)) { 470189251Ssam wpabuf_free(data->pending_phase2_req); 471189251Ssam data->pending_phase2_req = wpabuf_alloc_copy(hdr, len); 472189251Ssam } else if (*resp == NULL) 473189251Ssam return -1; 474189251Ssam 475189251Ssam return 0; 476189251Ssam} 477189251Ssam 478189251Ssam 479189251Ssamstatic struct wpabuf * eap_fast_tlv_nak(int vendor_id, int tlv_type) 480189251Ssam{ 481189251Ssam struct wpabuf *buf; 482189251Ssam struct eap_tlv_nak_tlv *nak; 483189251Ssam buf = wpabuf_alloc(sizeof(*nak)); 484189251Ssam if (buf == NULL) 485189251Ssam return NULL; 486189251Ssam nak = wpabuf_put(buf, sizeof(*nak)); 487189251Ssam nak->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY | EAP_TLV_NAK_TLV); 488189251Ssam nak->length = host_to_be16(6); 489189251Ssam nak->vendor_id = host_to_be32(vendor_id); 490189251Ssam nak->nak_type = host_to_be16(tlv_type); 491189251Ssam return buf; 492189251Ssam} 493189251Ssam 494189251Ssam 495189251Ssamstatic struct wpabuf * eap_fast_tlv_result(int status, int intermediate) 496189251Ssam{ 497189251Ssam struct wpabuf *buf; 498189251Ssam struct eap_tlv_intermediate_result_tlv *result; 499189251Ssam buf = wpabuf_alloc(sizeof(*result)); 500189251Ssam if (buf == NULL) 501189251Ssam return NULL; 502189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Add %sResult TLV(status=%d)", 503189251Ssam intermediate ? "Intermediate " : "", status); 504189251Ssam result = wpabuf_put(buf, sizeof(*result)); 505189251Ssam result->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY | 506189251Ssam (intermediate ? 507189251Ssam EAP_TLV_INTERMEDIATE_RESULT_TLV : 508189251Ssam EAP_TLV_RESULT_TLV)); 509189251Ssam result->length = host_to_be16(2); 510189251Ssam result->status = host_to_be16(status); 511189251Ssam return buf; 512189251Ssam} 513189251Ssam 514189251Ssam 515189251Ssamstatic struct wpabuf * eap_fast_tlv_pac_ack(void) 516189251Ssam{ 517189251Ssam struct wpabuf *buf; 518189251Ssam struct eap_tlv_result_tlv *res; 519189251Ssam struct eap_tlv_pac_ack_tlv *ack; 520189251Ssam 521189251Ssam buf = wpabuf_alloc(sizeof(*res) + sizeof(*ack)); 522189251Ssam if (buf == NULL) 523189251Ssam return NULL; 524189251Ssam 525189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Add PAC TLV (ack)"); 526189251Ssam ack = wpabuf_put(buf, sizeof(*ack)); 527189251Ssam ack->tlv_type = host_to_be16(EAP_TLV_PAC_TLV | 528189251Ssam EAP_TLV_TYPE_MANDATORY); 529189251Ssam ack->length = host_to_be16(sizeof(*ack) - sizeof(struct eap_tlv_hdr)); 530189251Ssam ack->pac_type = host_to_be16(PAC_TYPE_PAC_ACKNOWLEDGEMENT); 531189251Ssam ack->pac_len = host_to_be16(2); 532189251Ssam ack->result = host_to_be16(EAP_TLV_RESULT_SUCCESS); 533189251Ssam 534189251Ssam return buf; 535189251Ssam} 536189251Ssam 537189251Ssam 538189251Ssamstatic struct wpabuf * eap_fast_process_eap_payload_tlv( 539189251Ssam struct eap_sm *sm, struct eap_fast_data *data, 540252726Srpaulo struct eap_method_ret *ret, 541189251Ssam u8 *eap_payload_tlv, size_t eap_payload_tlv_len) 542189251Ssam{ 543189251Ssam struct eap_hdr *hdr; 544189251Ssam struct wpabuf *resp = NULL; 545189251Ssam 546189251Ssam if (eap_payload_tlv_len < sizeof(*hdr)) { 547189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: too short EAP " 548189251Ssam "Payload TLV (len=%lu)", 549189251Ssam (unsigned long) eap_payload_tlv_len); 550189251Ssam return NULL; 551189251Ssam } 552189251Ssam 553189251Ssam hdr = (struct eap_hdr *) eap_payload_tlv; 554189251Ssam if (be_to_host16(hdr->length) > eap_payload_tlv_len) { 555189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: EAP packet overflow in " 556189251Ssam "EAP Payload TLV"); 557189251Ssam return NULL; 558189251Ssam } 559189251Ssam 560189251Ssam if (hdr->code != EAP_CODE_REQUEST) { 561189251Ssam wpa_printf(MSG_INFO, "EAP-FAST: Unexpected code=%d in " 562189251Ssam "Phase 2 EAP header", hdr->code); 563189251Ssam return NULL; 564189251Ssam } 565189251Ssam 566189251Ssam if (eap_fast_phase2_request(sm, data, ret, hdr, &resp)) { 567189251Ssam wpa_printf(MSG_INFO, "EAP-FAST: Phase2 Request processing " 568189251Ssam "failed"); 569189251Ssam return NULL; 570189251Ssam } 571189251Ssam 572189251Ssam return eap_fast_tlv_eap_payload(resp); 573189251Ssam} 574189251Ssam 575189251Ssam 576189251Ssamstatic int eap_fast_validate_crypto_binding( 577189251Ssam struct eap_tlv_crypto_binding_tlv *_bind) 578189251Ssam{ 579189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Crypto-Binding TLV: Version %d " 580189251Ssam "Received Version %d SubType %d", 581189251Ssam _bind->version, _bind->received_version, _bind->subtype); 582189251Ssam wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: NONCE", 583189251Ssam _bind->nonce, sizeof(_bind->nonce)); 584189251Ssam wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Compound MAC", 585189251Ssam _bind->compound_mac, sizeof(_bind->compound_mac)); 586189251Ssam 587189251Ssam if (_bind->version != EAP_FAST_VERSION || 588189251Ssam _bind->received_version != EAP_FAST_VERSION || 589189251Ssam _bind->subtype != EAP_TLV_CRYPTO_BINDING_SUBTYPE_REQUEST) { 590189251Ssam wpa_printf(MSG_INFO, "EAP-FAST: Invalid version/subtype in " 591189251Ssam "Crypto-Binding TLV: Version %d " 592189251Ssam "Received Version %d SubType %d", 593189251Ssam _bind->version, _bind->received_version, 594189251Ssam _bind->subtype); 595189251Ssam return -1; 596189251Ssam } 597189251Ssam 598189251Ssam return 0; 599189251Ssam} 600189251Ssam 601189251Ssam 602189251Ssamstatic void eap_fast_write_crypto_binding( 603189251Ssam struct eap_tlv_crypto_binding_tlv *rbind, 604189251Ssam struct eap_tlv_crypto_binding_tlv *_bind, const u8 *cmk) 605189251Ssam{ 606189251Ssam rbind->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY | 607189251Ssam EAP_TLV_CRYPTO_BINDING_TLV); 608189251Ssam rbind->length = host_to_be16(sizeof(*rbind) - 609189251Ssam sizeof(struct eap_tlv_hdr)); 610189251Ssam rbind->version = EAP_FAST_VERSION; 611189251Ssam rbind->received_version = _bind->version; 612189251Ssam rbind->subtype = EAP_TLV_CRYPTO_BINDING_SUBTYPE_RESPONSE; 613189251Ssam os_memcpy(rbind->nonce, _bind->nonce, sizeof(_bind->nonce)); 614189251Ssam inc_byte_array(rbind->nonce, sizeof(rbind->nonce)); 615189251Ssam hmac_sha1(cmk, EAP_FAST_CMK_LEN, (u8 *) rbind, sizeof(*rbind), 616189251Ssam rbind->compound_mac); 617189251Ssam 618189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Reply Crypto-Binding TLV: Version %d " 619189251Ssam "Received Version %d SubType %d", 620189251Ssam rbind->version, rbind->received_version, rbind->subtype); 621189251Ssam wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: NONCE", 622189251Ssam rbind->nonce, sizeof(rbind->nonce)); 623189251Ssam wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Compound MAC", 624189251Ssam rbind->compound_mac, sizeof(rbind->compound_mac)); 625189251Ssam} 626189251Ssam 627189251Ssam 628189251Ssamstatic int eap_fast_get_phase2_key(struct eap_sm *sm, 629189251Ssam struct eap_fast_data *data, 630189251Ssam u8 *isk, size_t isk_len) 631189251Ssam{ 632189251Ssam u8 *key; 633189251Ssam size_t key_len; 634189251Ssam 635189251Ssam os_memset(isk, 0, isk_len); 636189251Ssam 637189251Ssam if (data->phase2_method == NULL || data->phase2_priv == NULL) { 638189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 method not " 639189251Ssam "available"); 640189251Ssam return -1; 641189251Ssam } 642189251Ssam 643189251Ssam if (data->phase2_method->isKeyAvailable == NULL || 644189251Ssam data->phase2_method->getKey == NULL) 645189251Ssam return 0; 646189251Ssam 647189251Ssam if (!data->phase2_method->isKeyAvailable(sm, data->phase2_priv) || 648189251Ssam (key = data->phase2_method->getKey(sm, data->phase2_priv, 649189251Ssam &key_len)) == NULL) { 650189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Could not get key material " 651189251Ssam "from Phase 2"); 652189251Ssam return -1; 653189251Ssam } 654189251Ssam 655189251Ssam if (key_len > isk_len) 656189251Ssam key_len = isk_len; 657189251Ssam if (key_len == 32 && 658189251Ssam data->phase2_method->vendor == EAP_VENDOR_IETF && 659189251Ssam data->phase2_method->method == EAP_TYPE_MSCHAPV2) { 660189251Ssam /* 661189251Ssam * EAP-FAST uses reverse order for MS-MPPE keys when deriving 662189251Ssam * MSK from EAP-MSCHAPv2. Swap the keys here to get the correct 663189251Ssam * ISK for EAP-FAST cryptobinding. 664189251Ssam */ 665189251Ssam os_memcpy(isk, key + 16, 16); 666189251Ssam os_memcpy(isk + 16, key, 16); 667189251Ssam } else 668189251Ssam os_memcpy(isk, key, key_len); 669189251Ssam os_free(key); 670189251Ssam 671189251Ssam return 0; 672189251Ssam} 673189251Ssam 674189251Ssam 675189251Ssamstatic int eap_fast_get_cmk(struct eap_sm *sm, struct eap_fast_data *data, 676189251Ssam u8 *cmk) 677189251Ssam{ 678189251Ssam u8 isk[32], imck[60]; 679189251Ssam 680189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Determining CMK[%d] for Compound MIC " 681189251Ssam "calculation", data->simck_idx + 1); 682189251Ssam 683189251Ssam /* 684189251Ssam * RFC 4851, Section 5.2: 685189251Ssam * IMCK[j] = T-PRF(S-IMCK[j-1], "Inner Methods Compound Keys", 686189251Ssam * MSK[j], 60) 687189251Ssam * S-IMCK[j] = first 40 octets of IMCK[j] 688189251Ssam * CMK[j] = last 20 octets of IMCK[j] 689189251Ssam */ 690189251Ssam 691189251Ssam if (eap_fast_get_phase2_key(sm, data, isk, sizeof(isk)) < 0) 692189251Ssam return -1; 693189251Ssam wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: ISK[j]", isk, sizeof(isk)); 694189251Ssam sha1_t_prf(data->simck, EAP_FAST_SIMCK_LEN, 695189251Ssam "Inner Methods Compound Keys", 696189251Ssam isk, sizeof(isk), imck, sizeof(imck)); 697189251Ssam data->simck_idx++; 698189251Ssam os_memcpy(data->simck, imck, EAP_FAST_SIMCK_LEN); 699189251Ssam wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: S-IMCK[j]", 700189251Ssam data->simck, EAP_FAST_SIMCK_LEN); 701189251Ssam os_memcpy(cmk, imck + EAP_FAST_SIMCK_LEN, EAP_FAST_CMK_LEN); 702189251Ssam wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: CMK[j]", 703189251Ssam cmk, EAP_FAST_CMK_LEN); 704189251Ssam 705189251Ssam return 0; 706189251Ssam} 707189251Ssam 708189251Ssam 709189251Ssamstatic u8 * eap_fast_write_pac_request(u8 *pos, u16 pac_type) 710189251Ssam{ 711189251Ssam struct eap_tlv_hdr *pac; 712189251Ssam struct eap_tlv_request_action_tlv *act; 713189251Ssam struct eap_tlv_pac_type_tlv *type; 714189251Ssam 715189251Ssam act = (struct eap_tlv_request_action_tlv *) pos; 716189251Ssam act->tlv_type = host_to_be16(EAP_TLV_REQUEST_ACTION_TLV); 717189251Ssam act->length = host_to_be16(2); 718189251Ssam act->action = host_to_be16(EAP_TLV_ACTION_PROCESS_TLV); 719189251Ssam 720189251Ssam pac = (struct eap_tlv_hdr *) (act + 1); 721189251Ssam pac->tlv_type = host_to_be16(EAP_TLV_PAC_TLV); 722189251Ssam pac->length = host_to_be16(sizeof(*type)); 723189251Ssam 724189251Ssam type = (struct eap_tlv_pac_type_tlv *) (pac + 1); 725189251Ssam type->tlv_type = host_to_be16(PAC_TYPE_PAC_TYPE); 726189251Ssam type->length = host_to_be16(2); 727189251Ssam type->pac_type = host_to_be16(pac_type); 728189251Ssam 729189251Ssam return (u8 *) (type + 1); 730189251Ssam} 731189251Ssam 732189251Ssam 733189251Ssamstatic struct wpabuf * eap_fast_process_crypto_binding( 734189251Ssam struct eap_sm *sm, struct eap_fast_data *data, 735189251Ssam struct eap_method_ret *ret, 736189251Ssam struct eap_tlv_crypto_binding_tlv *_bind, size_t bind_len) 737189251Ssam{ 738189251Ssam struct wpabuf *resp; 739189251Ssam u8 *pos; 740189251Ssam u8 cmk[EAP_FAST_CMK_LEN], cmac[SHA1_MAC_LEN]; 741189251Ssam int res; 742189251Ssam size_t len; 743189251Ssam 744189251Ssam if (eap_fast_validate_crypto_binding(_bind) < 0) 745189251Ssam return NULL; 746189251Ssam 747189251Ssam if (eap_fast_get_cmk(sm, data, cmk) < 0) 748189251Ssam return NULL; 749189251Ssam 750189251Ssam /* Validate received Compound MAC */ 751189251Ssam os_memcpy(cmac, _bind->compound_mac, sizeof(cmac)); 752189251Ssam os_memset(_bind->compound_mac, 0, sizeof(cmac)); 753189251Ssam wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Crypto-Binding TLV for Compound " 754189251Ssam "MAC calculation", (u8 *) _bind, bind_len); 755189251Ssam hmac_sha1(cmk, EAP_FAST_CMK_LEN, (u8 *) _bind, bind_len, 756189251Ssam _bind->compound_mac); 757189251Ssam res = os_memcmp(cmac, _bind->compound_mac, sizeof(cmac)); 758189251Ssam wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Received Compound MAC", 759189251Ssam cmac, sizeof(cmac)); 760189251Ssam wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Calculated Compound MAC", 761189251Ssam _bind->compound_mac, sizeof(cmac)); 762189251Ssam if (res != 0) { 763189251Ssam wpa_printf(MSG_INFO, "EAP-FAST: Compound MAC did not match"); 764189251Ssam os_memcpy(_bind->compound_mac, cmac, sizeof(cmac)); 765189251Ssam return NULL; 766189251Ssam } 767189251Ssam 768189251Ssam /* 769189251Ssam * Compound MAC was valid, so authentication succeeded. Reply with 770189251Ssam * crypto binding to allow server to complete authentication. 771189251Ssam */ 772189251Ssam 773189251Ssam len = sizeof(struct eap_tlv_crypto_binding_tlv); 774189251Ssam resp = wpabuf_alloc(len); 775189251Ssam if (resp == NULL) 776189251Ssam return NULL; 777189251Ssam 778189251Ssam if (!data->anon_provisioning && data->phase2_success && 779189251Ssam eap_fast_derive_msk(data) < 0) { 780189251Ssam wpa_printf(MSG_INFO, "EAP-FAST: Failed to generate MSK"); 781189251Ssam ret->methodState = METHOD_DONE; 782189251Ssam ret->decision = DECISION_FAIL; 783189251Ssam data->phase2_success = 0; 784189251Ssam wpabuf_free(resp); 785189251Ssam return NULL; 786189251Ssam } 787189251Ssam 788189251Ssam pos = wpabuf_put(resp, sizeof(struct eap_tlv_crypto_binding_tlv)); 789189251Ssam eap_fast_write_crypto_binding((struct eap_tlv_crypto_binding_tlv *) 790189251Ssam pos, _bind, cmk); 791189251Ssam 792189251Ssam return resp; 793189251Ssam} 794189251Ssam 795189251Ssam 796189251Ssamstatic void eap_fast_parse_pac_tlv(struct eap_fast_pac *entry, int type, 797189251Ssam u8 *pos, size_t len, int *pac_key_found) 798189251Ssam{ 799189251Ssam switch (type & 0x7fff) { 800189251Ssam case PAC_TYPE_PAC_KEY: 801189251Ssam wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: PAC-Key", pos, len); 802189251Ssam if (len != EAP_FAST_PAC_KEY_LEN) { 803189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Invalid PAC-Key " 804189251Ssam "length %lu", (unsigned long) len); 805189251Ssam break; 806189251Ssam } 807189251Ssam *pac_key_found = 1; 808189251Ssam os_memcpy(entry->pac_key, pos, len); 809189251Ssam break; 810189251Ssam case PAC_TYPE_PAC_OPAQUE: 811189251Ssam wpa_hexdump(MSG_DEBUG, "EAP-FAST: PAC-Opaque", pos, len); 812189251Ssam entry->pac_opaque = pos; 813189251Ssam entry->pac_opaque_len = len; 814189251Ssam break; 815189251Ssam case PAC_TYPE_PAC_INFO: 816189251Ssam wpa_hexdump(MSG_DEBUG, "EAP-FAST: PAC-Info", pos, len); 817189251Ssam entry->pac_info = pos; 818189251Ssam entry->pac_info_len = len; 819189251Ssam break; 820189251Ssam default: 821189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Ignored unknown PAC type %d", 822189251Ssam type); 823189251Ssam break; 824189251Ssam } 825189251Ssam} 826189251Ssam 827189251Ssam 828189251Ssamstatic int eap_fast_process_pac_tlv(struct eap_fast_pac *entry, 829189251Ssam u8 *pac, size_t pac_len) 830189251Ssam{ 831189251Ssam struct pac_tlv_hdr *hdr; 832189251Ssam u8 *pos; 833189251Ssam size_t left, len; 834189251Ssam int type, pac_key_found = 0; 835189251Ssam 836189251Ssam pos = pac; 837189251Ssam left = pac_len; 838189251Ssam 839189251Ssam while (left > sizeof(*hdr)) { 840189251Ssam hdr = (struct pac_tlv_hdr *) pos; 841189251Ssam type = be_to_host16(hdr->type); 842189251Ssam len = be_to_host16(hdr->len); 843189251Ssam pos += sizeof(*hdr); 844189251Ssam left -= sizeof(*hdr); 845189251Ssam if (len > left) { 846189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV overrun " 847189251Ssam "(type=%d len=%lu left=%lu)", 848189251Ssam type, (unsigned long) len, 849189251Ssam (unsigned long) left); 850189251Ssam return -1; 851189251Ssam } 852189251Ssam 853189251Ssam eap_fast_parse_pac_tlv(entry, type, pos, len, &pac_key_found); 854189251Ssam 855189251Ssam pos += len; 856189251Ssam left -= len; 857189251Ssam } 858189251Ssam 859189251Ssam if (!pac_key_found || !entry->pac_opaque || !entry->pac_info) { 860189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV does not include " 861189251Ssam "all the required fields"); 862189251Ssam return -1; 863189251Ssam } 864189251Ssam 865189251Ssam return 0; 866189251Ssam} 867189251Ssam 868189251Ssam 869189251Ssamstatic int eap_fast_parse_pac_info(struct eap_fast_pac *entry, int type, 870189251Ssam u8 *pos, size_t len) 871189251Ssam{ 872189251Ssam u16 pac_type; 873189251Ssam u32 lifetime; 874189251Ssam struct os_time now; 875189251Ssam 876189251Ssam switch (type & 0x7fff) { 877189251Ssam case PAC_TYPE_CRED_LIFETIME: 878189251Ssam if (len != 4) { 879189251Ssam wpa_hexdump(MSG_DEBUG, "EAP-FAST: PAC-Info - " 880189251Ssam "Invalid CRED_LIFETIME length - ignored", 881189251Ssam pos, len); 882189251Ssam return 0; 883189251Ssam } 884189251Ssam 885189251Ssam /* 886189251Ssam * This is not currently saved separately in PAC files since 887189251Ssam * the server can automatically initiate PAC update when 888189251Ssam * needed. Anyway, the information is available from PAC-Info 889189251Ssam * dump if it is needed for something in the future. 890189251Ssam */ 891189251Ssam lifetime = WPA_GET_BE32(pos); 892189251Ssam os_get_time(&now); 893189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info - CRED_LIFETIME %d " 894189251Ssam "(%d days)", 895189251Ssam lifetime, (lifetime - (u32) now.sec) / 86400); 896189251Ssam break; 897189251Ssam case PAC_TYPE_A_ID: 898189251Ssam wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: PAC-Info - A-ID", 899189251Ssam pos, len); 900189251Ssam entry->a_id = pos; 901189251Ssam entry->a_id_len = len; 902189251Ssam break; 903189251Ssam case PAC_TYPE_I_ID: 904189251Ssam wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: PAC-Info - I-ID", 905189251Ssam pos, len); 906189251Ssam entry->i_id = pos; 907189251Ssam entry->i_id_len = len; 908189251Ssam break; 909189251Ssam case PAC_TYPE_A_ID_INFO: 910189251Ssam wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: PAC-Info - A-ID-Info", 911189251Ssam pos, len); 912189251Ssam entry->a_id_info = pos; 913189251Ssam entry->a_id_info_len = len; 914189251Ssam break; 915189251Ssam case PAC_TYPE_PAC_TYPE: 916209158Srpaulo /* RFC 5422, Section 4.2.6 - PAC-Type TLV */ 917189251Ssam if (len != 2) { 918189251Ssam wpa_printf(MSG_INFO, "EAP-FAST: Invalid PAC-Type " 919189251Ssam "length %lu (expected 2)", 920189251Ssam (unsigned long) len); 921189251Ssam wpa_hexdump_ascii(MSG_DEBUG, 922189251Ssam "EAP-FAST: PAC-Info - PAC-Type", 923189251Ssam pos, len); 924189251Ssam return -1; 925189251Ssam } 926189251Ssam pac_type = WPA_GET_BE16(pos); 927189251Ssam if (pac_type != PAC_TYPE_TUNNEL_PAC && 928189251Ssam pac_type != PAC_TYPE_USER_AUTHORIZATION && 929189251Ssam pac_type != PAC_TYPE_MACHINE_AUTHENTICATION) { 930189251Ssam wpa_printf(MSG_INFO, "EAP-FAST: Unsupported PAC Type " 931189251Ssam "%d", pac_type); 932189251Ssam return -1; 933189251Ssam } 934189251Ssam 935189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info - PAC-Type %d", 936189251Ssam pac_type); 937189251Ssam entry->pac_type = pac_type; 938189251Ssam break; 939189251Ssam default: 940189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Ignored unknown PAC-Info " 941189251Ssam "type %d", type); 942189251Ssam break; 943189251Ssam } 944189251Ssam 945189251Ssam return 0; 946189251Ssam} 947189251Ssam 948189251Ssam 949189251Ssamstatic int eap_fast_process_pac_info(struct eap_fast_pac *entry) 950189251Ssam{ 951189251Ssam struct pac_tlv_hdr *hdr; 952189251Ssam u8 *pos; 953189251Ssam size_t left, len; 954189251Ssam int type; 955189251Ssam 956209158Srpaulo /* RFC 5422, Section 4.2.4 */ 957189251Ssam 958189251Ssam /* PAC-Type defaults to Tunnel PAC (Type 1) */ 959189251Ssam entry->pac_type = PAC_TYPE_TUNNEL_PAC; 960189251Ssam 961189251Ssam pos = entry->pac_info; 962189251Ssam left = entry->pac_info_len; 963189251Ssam while (left > sizeof(*hdr)) { 964189251Ssam hdr = (struct pac_tlv_hdr *) pos; 965189251Ssam type = be_to_host16(hdr->type); 966189251Ssam len = be_to_host16(hdr->len); 967189251Ssam pos += sizeof(*hdr); 968189251Ssam left -= sizeof(*hdr); 969189251Ssam if (len > left) { 970189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info overrun " 971189251Ssam "(type=%d len=%lu left=%lu)", 972189251Ssam type, (unsigned long) len, 973189251Ssam (unsigned long) left); 974189251Ssam return -1; 975189251Ssam } 976189251Ssam 977189251Ssam if (eap_fast_parse_pac_info(entry, type, pos, len) < 0) 978189251Ssam return -1; 979189251Ssam 980189251Ssam pos += len; 981189251Ssam left -= len; 982189251Ssam } 983189251Ssam 984189251Ssam if (entry->a_id == NULL || entry->a_id_info == NULL) { 985189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info does not include " 986189251Ssam "all the required fields"); 987189251Ssam return -1; 988189251Ssam } 989189251Ssam 990189251Ssam return 0; 991189251Ssam} 992189251Ssam 993189251Ssam 994189251Ssamstatic struct wpabuf * eap_fast_process_pac(struct eap_sm *sm, 995189251Ssam struct eap_fast_data *data, 996189251Ssam struct eap_method_ret *ret, 997189251Ssam u8 *pac, size_t pac_len) 998189251Ssam{ 999189251Ssam struct eap_peer_config *config = eap_get_config(sm); 1000189251Ssam struct eap_fast_pac entry; 1001189251Ssam 1002189251Ssam os_memset(&entry, 0, sizeof(entry)); 1003189251Ssam if (eap_fast_process_pac_tlv(&entry, pac, pac_len) || 1004189251Ssam eap_fast_process_pac_info(&entry)) 1005189251Ssam return NULL; 1006189251Ssam 1007189251Ssam eap_fast_add_pac(&data->pac, &data->current_pac, &entry); 1008189251Ssam eap_fast_pac_list_truncate(data->pac, data->max_pac_list_len); 1009189251Ssam if (data->use_pac_binary_format) 1010189251Ssam eap_fast_save_pac_bin(sm, data->pac, config->pac_file); 1011189251Ssam else 1012189251Ssam eap_fast_save_pac(sm, data->pac, config->pac_file); 1013189251Ssam 1014189251Ssam if (data->provisioning) { 1015189251Ssam if (data->anon_provisioning) { 1016189251Ssam /* 1017189251Ssam * Unauthenticated provisioning does not provide keying 1018189251Ssam * material and must end with an EAP-Failure. 1019189251Ssam * Authentication will be done separately after this. 1020189251Ssam */ 1021189251Ssam data->success = 0; 1022189251Ssam ret->decision = DECISION_FAIL; 1023189251Ssam } else { 1024189251Ssam /* 1025189251Ssam * Server may or may not allow authenticated 1026189251Ssam * provisioning also for key generation. 1027189251Ssam */ 1028189251Ssam ret->decision = DECISION_COND_SUCC; 1029189251Ssam } 1030189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Send PAC-Acknowledgement TLV " 1031189251Ssam "- Provisioning completed successfully"); 1032189251Ssam } else { 1033189251Ssam /* 1034189251Ssam * This is PAC refreshing, i.e., normal authentication that is 1035252726Srpaulo * expected to be completed with an EAP-Success. However, 1036252726Srpaulo * RFC 5422, Section 3.5 allows EAP-Failure to be sent even 1037252726Srpaulo * after protected success exchange in case of EAP-Fast 1038252726Srpaulo * provisioning, so we better use DECISION_COND_SUCC here 1039252726Srpaulo * instead of DECISION_UNCOND_SUCC. 1040189251Ssam */ 1041189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Send PAC-Acknowledgement TLV " 1042189251Ssam "- PAC refreshing completed successfully"); 1043252726Srpaulo ret->decision = DECISION_COND_SUCC; 1044189251Ssam } 1045189251Ssam ret->methodState = METHOD_DONE; 1046189251Ssam return eap_fast_tlv_pac_ack(); 1047189251Ssam} 1048189251Ssam 1049189251Ssam 1050189251Ssamstatic int eap_fast_parse_decrypted(struct wpabuf *decrypted, 1051189251Ssam struct eap_fast_tlv_parse *tlv, 1052189251Ssam struct wpabuf **resp) 1053189251Ssam{ 1054189251Ssam int mandatory, tlv_type, len, res; 1055189251Ssam u8 *pos, *end; 1056189251Ssam 1057189251Ssam os_memset(tlv, 0, sizeof(*tlv)); 1058189251Ssam 1059189251Ssam /* Parse TLVs from the decrypted Phase 2 data */ 1060189251Ssam pos = wpabuf_mhead(decrypted); 1061189251Ssam end = pos + wpabuf_len(decrypted); 1062189251Ssam while (pos + 4 < end) { 1063189251Ssam mandatory = pos[0] & 0x80; 1064189251Ssam tlv_type = WPA_GET_BE16(pos) & 0x3fff; 1065189251Ssam pos += 2; 1066189251Ssam len = WPA_GET_BE16(pos); 1067189251Ssam pos += 2; 1068189251Ssam if (pos + len > end) { 1069189251Ssam wpa_printf(MSG_INFO, "EAP-FAST: TLV overflow"); 1070189251Ssam return -1; 1071189251Ssam } 1072189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Received Phase 2: " 1073189251Ssam "TLV type %d length %d%s", 1074189251Ssam tlv_type, len, mandatory ? " (mandatory)" : ""); 1075189251Ssam 1076189251Ssam res = eap_fast_parse_tlv(tlv, tlv_type, pos, len); 1077189251Ssam if (res == -2) 1078189251Ssam break; 1079189251Ssam if (res < 0) { 1080189251Ssam if (mandatory) { 1081189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Nak unknown " 1082189251Ssam "mandatory TLV type %d", tlv_type); 1083189251Ssam *resp = eap_fast_tlv_nak(0, tlv_type); 1084189251Ssam break; 1085189251Ssam } else { 1086189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: ignored " 1087189251Ssam "unknown optional TLV type %d", 1088189251Ssam tlv_type); 1089189251Ssam } 1090189251Ssam } 1091189251Ssam 1092189251Ssam pos += len; 1093189251Ssam } 1094189251Ssam 1095189251Ssam return 0; 1096189251Ssam} 1097189251Ssam 1098189251Ssam 1099189251Ssamstatic int eap_fast_encrypt_response(struct eap_sm *sm, 1100189251Ssam struct eap_fast_data *data, 1101189251Ssam struct wpabuf *resp, 1102189251Ssam u8 identifier, struct wpabuf **out_data) 1103189251Ssam{ 1104189251Ssam if (resp == NULL) 1105189251Ssam return 0; 1106189251Ssam 1107189251Ssam wpa_hexdump_buf(MSG_DEBUG, "EAP-FAST: Encrypting Phase 2 data", 1108189251Ssam resp); 1109189251Ssam if (eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_FAST, 1110189251Ssam data->fast_version, identifier, 1111189251Ssam resp, out_data)) { 1112189251Ssam wpa_printf(MSG_INFO, "EAP-FAST: Failed to encrypt a Phase 2 " 1113189251Ssam "frame"); 1114189251Ssam } 1115189251Ssam wpabuf_free(resp); 1116189251Ssam 1117189251Ssam return 0; 1118189251Ssam} 1119189251Ssam 1120189251Ssam 1121189251Ssamstatic struct wpabuf * eap_fast_pac_request(void) 1122189251Ssam{ 1123189251Ssam struct wpabuf *tmp; 1124189251Ssam u8 *pos, *pos2; 1125189251Ssam 1126189251Ssam tmp = wpabuf_alloc(sizeof(struct eap_tlv_hdr) + 1127189251Ssam sizeof(struct eap_tlv_request_action_tlv) + 1128189251Ssam sizeof(struct eap_tlv_pac_type_tlv)); 1129189251Ssam if (tmp == NULL) 1130189251Ssam return NULL; 1131189251Ssam 1132189251Ssam pos = wpabuf_put(tmp, 0); 1133189251Ssam pos2 = eap_fast_write_pac_request(pos, PAC_TYPE_TUNNEL_PAC); 1134189251Ssam wpabuf_put(tmp, pos2 - pos); 1135189251Ssam return tmp; 1136189251Ssam} 1137189251Ssam 1138189251Ssam 1139189251Ssamstatic int eap_fast_process_decrypted(struct eap_sm *sm, 1140189251Ssam struct eap_fast_data *data, 1141189251Ssam struct eap_method_ret *ret, 1142189251Ssam const struct eap_hdr *req, 1143189251Ssam struct wpabuf *decrypted, 1144189251Ssam struct wpabuf **out_data) 1145189251Ssam{ 1146189251Ssam struct wpabuf *resp = NULL, *tmp; 1147189251Ssam struct eap_fast_tlv_parse tlv; 1148189251Ssam int failed = 0; 1149189251Ssam 1150189251Ssam if (eap_fast_parse_decrypted(decrypted, &tlv, &resp) < 0) 1151189251Ssam return 0; 1152189251Ssam if (resp) 1153189251Ssam return eap_fast_encrypt_response(sm, data, resp, 1154189251Ssam req->identifier, out_data); 1155189251Ssam 1156189251Ssam if (tlv.result == EAP_TLV_RESULT_FAILURE) { 1157189251Ssam resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0); 1158189251Ssam return eap_fast_encrypt_response(sm, data, resp, 1159189251Ssam req->identifier, out_data); 1160189251Ssam } 1161189251Ssam 1162189251Ssam if (tlv.iresult == EAP_TLV_RESULT_FAILURE) { 1163189251Ssam resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 1); 1164189251Ssam return eap_fast_encrypt_response(sm, data, resp, 1165189251Ssam req->identifier, out_data); 1166189251Ssam } 1167189251Ssam 1168189251Ssam if (tlv.crypto_binding) { 1169189251Ssam tmp = eap_fast_process_crypto_binding(sm, data, ret, 1170189251Ssam tlv.crypto_binding, 1171189251Ssam tlv.crypto_binding_len); 1172189251Ssam if (tmp == NULL) 1173189251Ssam failed = 1; 1174189251Ssam else 1175189251Ssam resp = wpabuf_concat(resp, tmp); 1176189251Ssam } 1177189251Ssam 1178189251Ssam if (tlv.iresult == EAP_TLV_RESULT_SUCCESS) { 1179189251Ssam tmp = eap_fast_tlv_result(failed ? EAP_TLV_RESULT_FAILURE : 1180189251Ssam EAP_TLV_RESULT_SUCCESS, 1); 1181189251Ssam resp = wpabuf_concat(resp, tmp); 1182189251Ssam } 1183189251Ssam 1184189251Ssam if (tlv.eap_payload_tlv) { 1185189251Ssam tmp = eap_fast_process_eap_payload_tlv( 1186252726Srpaulo sm, data, ret, tlv.eap_payload_tlv, 1187189251Ssam tlv.eap_payload_tlv_len); 1188189251Ssam resp = wpabuf_concat(resp, tmp); 1189189251Ssam } 1190189251Ssam 1191189251Ssam if (tlv.pac && tlv.result != EAP_TLV_RESULT_SUCCESS) { 1192189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV without Result TLV " 1193189251Ssam "acknowledging success"); 1194189251Ssam failed = 1; 1195189251Ssam } else if (tlv.pac && tlv.result == EAP_TLV_RESULT_SUCCESS) { 1196189251Ssam tmp = eap_fast_process_pac(sm, data, ret, tlv.pac, 1197189251Ssam tlv.pac_len); 1198189251Ssam resp = wpabuf_concat(resp, tmp); 1199189251Ssam } 1200189251Ssam 1201189251Ssam if (data->current_pac == NULL && data->provisioning && 1202189251Ssam !data->anon_provisioning && !tlv.pac && 1203189251Ssam (tlv.iresult == EAP_TLV_RESULT_SUCCESS || 1204189251Ssam tlv.result == EAP_TLV_RESULT_SUCCESS)) { 1205189251Ssam /* 1206189251Ssam * Need to request Tunnel PAC when using authenticated 1207189251Ssam * provisioning. 1208189251Ssam */ 1209189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Request Tunnel PAC"); 1210189251Ssam tmp = eap_fast_pac_request(); 1211189251Ssam resp = wpabuf_concat(resp, tmp); 1212189251Ssam } 1213189251Ssam 1214189251Ssam if (tlv.result == EAP_TLV_RESULT_SUCCESS && !failed) { 1215189251Ssam tmp = eap_fast_tlv_result(EAP_TLV_RESULT_SUCCESS, 0); 1216189251Ssam resp = wpabuf_concat(tmp, resp); 1217189251Ssam } else if (failed) { 1218189251Ssam tmp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0); 1219189251Ssam resp = wpabuf_concat(tmp, resp); 1220189251Ssam } 1221189251Ssam 1222189251Ssam if (resp && tlv.result == EAP_TLV_RESULT_SUCCESS && !failed && 1223189251Ssam tlv.crypto_binding && data->phase2_success) { 1224189251Ssam if (data->anon_provisioning) { 1225189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Unauthenticated " 1226189251Ssam "provisioning completed successfully."); 1227189251Ssam ret->methodState = METHOD_DONE; 1228189251Ssam ret->decision = DECISION_FAIL; 1229189251Ssam } else { 1230189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Authentication " 1231189251Ssam "completed successfully."); 1232189251Ssam if (data->provisioning) 1233189251Ssam ret->methodState = METHOD_MAY_CONT; 1234189251Ssam else 1235189251Ssam ret->methodState = METHOD_DONE; 1236189251Ssam ret->decision = DECISION_UNCOND_SUCC; 1237189251Ssam } 1238189251Ssam } 1239189251Ssam 1240189251Ssam if (resp == NULL) { 1241189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: No recognized TLVs - send " 1242189251Ssam "empty response packet"); 1243189251Ssam resp = wpabuf_alloc(1); 1244189251Ssam } 1245189251Ssam 1246189251Ssam return eap_fast_encrypt_response(sm, data, resp, req->identifier, 1247189251Ssam out_data); 1248189251Ssam} 1249189251Ssam 1250189251Ssam 1251189251Ssamstatic int eap_fast_decrypt(struct eap_sm *sm, struct eap_fast_data *data, 1252189251Ssam struct eap_method_ret *ret, 1253189251Ssam const struct eap_hdr *req, 1254189251Ssam const struct wpabuf *in_data, 1255189251Ssam struct wpabuf **out_data) 1256189251Ssam{ 1257189251Ssam struct wpabuf *in_decrypted; 1258189251Ssam int res; 1259189251Ssam 1260189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Received %lu bytes encrypted data for" 1261189251Ssam " Phase 2", (unsigned long) wpabuf_len(in_data)); 1262189251Ssam 1263189251Ssam if (data->pending_phase2_req) { 1264189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Pending Phase 2 request - " 1265189251Ssam "skip decryption and use old data"); 1266189251Ssam /* Clear TLS reassembly state. */ 1267189251Ssam eap_peer_tls_reset_input(&data->ssl); 1268189251Ssam 1269189251Ssam in_decrypted = data->pending_phase2_req; 1270189251Ssam data->pending_phase2_req = NULL; 1271189251Ssam goto continue_req; 1272189251Ssam } 1273189251Ssam 1274189251Ssam if (wpabuf_len(in_data) == 0) { 1275189251Ssam /* Received TLS ACK - requesting more fragments */ 1276189251Ssam return eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_FAST, 1277189251Ssam data->fast_version, 1278189251Ssam req->identifier, NULL, out_data); 1279189251Ssam } 1280189251Ssam 1281189251Ssam res = eap_peer_tls_decrypt(sm, &data->ssl, in_data, &in_decrypted); 1282189251Ssam if (res) 1283189251Ssam return res; 1284189251Ssam 1285189251Ssamcontinue_req: 1286189251Ssam wpa_hexdump_buf(MSG_MSGDUMP, "EAP-FAST: Decrypted Phase 2 TLV(s)", 1287189251Ssam in_decrypted); 1288189251Ssam 1289189251Ssam if (wpabuf_len(in_decrypted) < 4) { 1290189251Ssam wpa_printf(MSG_INFO, "EAP-FAST: Too short Phase 2 " 1291189251Ssam "TLV frame (len=%lu)", 1292189251Ssam (unsigned long) wpabuf_len(in_decrypted)); 1293189251Ssam wpabuf_free(in_decrypted); 1294189251Ssam return -1; 1295189251Ssam } 1296189251Ssam 1297189251Ssam res = eap_fast_process_decrypted(sm, data, ret, req, 1298189251Ssam in_decrypted, out_data); 1299189251Ssam 1300189251Ssam wpabuf_free(in_decrypted); 1301189251Ssam 1302189251Ssam return res; 1303189251Ssam} 1304189251Ssam 1305189251Ssam 1306189251Ssamstatic const u8 * eap_fast_get_a_id(const u8 *buf, size_t len, size_t *id_len) 1307189251Ssam{ 1308189251Ssam const u8 *a_id; 1309189251Ssam struct pac_tlv_hdr *hdr; 1310189251Ssam 1311189251Ssam /* 1312189251Ssam * Parse authority identity (A-ID) from the EAP-FAST/Start. This 1313189251Ssam * supports both raw A-ID and one inside an A-ID TLV. 1314189251Ssam */ 1315189251Ssam a_id = buf; 1316189251Ssam *id_len = len; 1317189251Ssam if (len > sizeof(*hdr)) { 1318189251Ssam int tlen; 1319189251Ssam hdr = (struct pac_tlv_hdr *) buf; 1320189251Ssam tlen = be_to_host16(hdr->len); 1321189251Ssam if (be_to_host16(hdr->type) == PAC_TYPE_A_ID && 1322189251Ssam sizeof(*hdr) + tlen <= len) { 1323189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: A-ID was in TLV " 1324189251Ssam "(Start)"); 1325189251Ssam a_id = (u8 *) (hdr + 1); 1326189251Ssam *id_len = tlen; 1327189251Ssam } 1328189251Ssam } 1329189251Ssam wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: A-ID", a_id, *id_len); 1330189251Ssam 1331189251Ssam return a_id; 1332189251Ssam} 1333189251Ssam 1334189251Ssam 1335189251Ssamstatic void eap_fast_select_pac(struct eap_fast_data *data, 1336189251Ssam const u8 *a_id, size_t a_id_len) 1337189251Ssam{ 1338189251Ssam data->current_pac = eap_fast_get_pac(data->pac, a_id, a_id_len, 1339189251Ssam PAC_TYPE_TUNNEL_PAC); 1340189251Ssam if (data->current_pac == NULL) { 1341189251Ssam /* 1342189251Ssam * Tunnel PAC was not available for this A-ID. Try to use 1343189251Ssam * Machine Authentication PAC, if one is available. 1344189251Ssam */ 1345189251Ssam data->current_pac = eap_fast_get_pac( 1346189251Ssam data->pac, a_id, a_id_len, 1347189251Ssam PAC_TYPE_MACHINE_AUTHENTICATION); 1348189251Ssam } 1349189251Ssam 1350189251Ssam if (data->current_pac) { 1351189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: PAC found for this A-ID " 1352189251Ssam "(PAC-Type %d)", data->current_pac->pac_type); 1353189251Ssam wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-FAST: A-ID-Info", 1354189251Ssam data->current_pac->a_id_info, 1355189251Ssam data->current_pac->a_id_info_len); 1356189251Ssam } 1357189251Ssam} 1358189251Ssam 1359189251Ssam 1360189251Ssamstatic int eap_fast_use_pac_opaque(struct eap_sm *sm, 1361189251Ssam struct eap_fast_data *data, 1362189251Ssam struct eap_fast_pac *pac) 1363189251Ssam{ 1364189251Ssam u8 *tlv; 1365189251Ssam size_t tlv_len, olen; 1366189251Ssam struct eap_tlv_hdr *ehdr; 1367189251Ssam 1368189251Ssam olen = pac->pac_opaque_len; 1369189251Ssam tlv_len = sizeof(*ehdr) + olen; 1370189251Ssam tlv = os_malloc(tlv_len); 1371189251Ssam if (tlv) { 1372189251Ssam ehdr = (struct eap_tlv_hdr *) tlv; 1373189251Ssam ehdr->tlv_type = host_to_be16(PAC_TYPE_PAC_OPAQUE); 1374189251Ssam ehdr->length = host_to_be16(olen); 1375189251Ssam os_memcpy(ehdr + 1, pac->pac_opaque, olen); 1376189251Ssam } 1377189251Ssam if (tlv == NULL || 1378189251Ssam tls_connection_client_hello_ext(sm->ssl_ctx, data->ssl.conn, 1379189251Ssam TLS_EXT_PAC_OPAQUE, 1380189251Ssam tlv, tlv_len) < 0) { 1381189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to add PAC-Opaque TLS " 1382189251Ssam "extension"); 1383189251Ssam os_free(tlv); 1384189251Ssam return -1; 1385189251Ssam } 1386189251Ssam os_free(tlv); 1387189251Ssam 1388189251Ssam return 0; 1389189251Ssam} 1390189251Ssam 1391189251Ssam 1392189251Ssamstatic int eap_fast_clear_pac_opaque_ext(struct eap_sm *sm, 1393189251Ssam struct eap_fast_data *data) 1394189251Ssam{ 1395189251Ssam if (tls_connection_client_hello_ext(sm->ssl_ctx, data->ssl.conn, 1396189251Ssam TLS_EXT_PAC_OPAQUE, NULL, 0) < 0) { 1397189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to remove PAC-Opaque " 1398189251Ssam "TLS extension"); 1399189251Ssam return -1; 1400189251Ssam } 1401189251Ssam return 0; 1402189251Ssam} 1403189251Ssam 1404189251Ssam 1405189251Ssamstatic int eap_fast_set_provisioning_ciphers(struct eap_sm *sm, 1406189251Ssam struct eap_fast_data *data) 1407189251Ssam{ 1408189251Ssam u8 ciphers[5]; 1409189251Ssam int count = 0; 1410189251Ssam 1411189251Ssam if (data->provisioning_allowed & EAP_FAST_PROV_UNAUTH) { 1412189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Enabling unauthenticated " 1413189251Ssam "provisioning TLS cipher suites"); 1414189251Ssam ciphers[count++] = TLS_CIPHER_ANON_DH_AES128_SHA; 1415189251Ssam } 1416189251Ssam 1417189251Ssam if (data->provisioning_allowed & EAP_FAST_PROV_AUTH) { 1418189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Enabling authenticated " 1419189251Ssam "provisioning TLS cipher suites"); 1420189251Ssam ciphers[count++] = TLS_CIPHER_RSA_DHE_AES128_SHA; 1421189251Ssam ciphers[count++] = TLS_CIPHER_AES128_SHA; 1422189251Ssam ciphers[count++] = TLS_CIPHER_RC4_SHA; 1423189251Ssam } 1424189251Ssam 1425189251Ssam ciphers[count++] = TLS_CIPHER_NONE; 1426189251Ssam 1427189251Ssam if (tls_connection_set_cipher_list(sm->ssl_ctx, data->ssl.conn, 1428189251Ssam ciphers)) { 1429189251Ssam wpa_printf(MSG_INFO, "EAP-FAST: Could not configure TLS " 1430189251Ssam "cipher suites for provisioning"); 1431189251Ssam return -1; 1432189251Ssam } 1433189251Ssam 1434189251Ssam return 0; 1435189251Ssam} 1436189251Ssam 1437189251Ssam 1438189251Ssamstatic int eap_fast_process_start(struct eap_sm *sm, 1439189251Ssam struct eap_fast_data *data, u8 flags, 1440189251Ssam const u8 *pos, size_t left) 1441189251Ssam{ 1442189251Ssam const u8 *a_id; 1443189251Ssam size_t a_id_len; 1444189251Ssam 1445189251Ssam /* EAP-FAST Version negotiation (section 3.1) */ 1446189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Start (server ver=%d, own ver=%d)", 1447214734Srpaulo flags & EAP_TLS_VERSION_MASK, data->fast_version); 1448214734Srpaulo if ((flags & EAP_TLS_VERSION_MASK) < data->fast_version) 1449214734Srpaulo data->fast_version = flags & EAP_TLS_VERSION_MASK; 1450189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Using FAST version %d", 1451189251Ssam data->fast_version); 1452189251Ssam 1453189251Ssam a_id = eap_fast_get_a_id(pos, left, &a_id_len); 1454189251Ssam eap_fast_select_pac(data, a_id, a_id_len); 1455189251Ssam 1456189251Ssam if (data->resuming && data->current_pac) { 1457189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Trying to resume session - " 1458189251Ssam "do not add PAC-Opaque to TLS ClientHello"); 1459189251Ssam if (eap_fast_clear_pac_opaque_ext(sm, data) < 0) 1460189251Ssam return -1; 1461189251Ssam } else if (data->current_pac) { 1462189251Ssam /* 1463189251Ssam * PAC found for the A-ID and we are not resuming an old 1464189251Ssam * session, so add PAC-Opaque extension to ClientHello. 1465189251Ssam */ 1466189251Ssam if (eap_fast_use_pac_opaque(sm, data, data->current_pac) < 0) 1467189251Ssam return -1; 1468189251Ssam } else { 1469189251Ssam /* No PAC found, so we must provision one. */ 1470189251Ssam if (!data->provisioning_allowed) { 1471189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC found and " 1472189251Ssam "provisioning disabled"); 1473189251Ssam return -1; 1474189251Ssam } 1475189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC found - " 1476189251Ssam "starting provisioning"); 1477189251Ssam if (eap_fast_set_provisioning_ciphers(sm, data) < 0 || 1478189251Ssam eap_fast_clear_pac_opaque_ext(sm, data) < 0) 1479189251Ssam return -1; 1480189251Ssam data->provisioning = 1; 1481189251Ssam } 1482189251Ssam 1483189251Ssam return 0; 1484189251Ssam} 1485189251Ssam 1486189251Ssam 1487189251Ssamstatic struct wpabuf * eap_fast_process(struct eap_sm *sm, void *priv, 1488189251Ssam struct eap_method_ret *ret, 1489189251Ssam const struct wpabuf *reqData) 1490189251Ssam{ 1491189251Ssam const struct eap_hdr *req; 1492189251Ssam size_t left; 1493189251Ssam int res; 1494189251Ssam u8 flags, id; 1495189251Ssam struct wpabuf *resp; 1496189251Ssam const u8 *pos; 1497189251Ssam struct eap_fast_data *data = priv; 1498189251Ssam 1499189251Ssam pos = eap_peer_tls_process_init(sm, &data->ssl, EAP_TYPE_FAST, ret, 1500189251Ssam reqData, &left, &flags); 1501189251Ssam if (pos == NULL) 1502189251Ssam return NULL; 1503189251Ssam 1504189251Ssam req = wpabuf_head(reqData); 1505189251Ssam id = req->identifier; 1506189251Ssam 1507189251Ssam if (flags & EAP_TLS_FLAGS_START) { 1508189251Ssam if (eap_fast_process_start(sm, data, flags, pos, left) < 0) 1509189251Ssam return NULL; 1510189251Ssam 1511189251Ssam left = 0; /* A-ID is not used in further packet processing */ 1512189251Ssam } 1513189251Ssam 1514189251Ssam resp = NULL; 1515189251Ssam if (tls_connection_established(sm->ssl_ctx, data->ssl.conn) && 1516189251Ssam !data->resuming) { 1517189251Ssam /* Process tunneled (encrypted) phase 2 data. */ 1518189251Ssam struct wpabuf msg; 1519189251Ssam wpabuf_set(&msg, pos, left); 1520189251Ssam res = eap_fast_decrypt(sm, data, ret, req, &msg, &resp); 1521189251Ssam if (res < 0) { 1522189251Ssam ret->methodState = METHOD_DONE; 1523189251Ssam ret->decision = DECISION_FAIL; 1524189251Ssam /* 1525189251Ssam * Ack possible Alert that may have caused failure in 1526189251Ssam * decryption. 1527189251Ssam */ 1528189251Ssam res = 1; 1529189251Ssam } 1530189251Ssam } else { 1531189251Ssam /* Continue processing TLS handshake (phase 1). */ 1532189251Ssam res = eap_peer_tls_process_helper(sm, &data->ssl, 1533189251Ssam EAP_TYPE_FAST, 1534189251Ssam data->fast_version, id, pos, 1535189251Ssam left, &resp); 1536189251Ssam 1537189251Ssam if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) { 1538189251Ssam char cipher[80]; 1539189251Ssam wpa_printf(MSG_DEBUG, 1540189251Ssam "EAP-FAST: TLS done, proceed to Phase 2"); 1541189251Ssam if (data->provisioning && 1542189251Ssam (!(data->provisioning_allowed & 1543189251Ssam EAP_FAST_PROV_AUTH) || 1544189251Ssam tls_get_cipher(sm->ssl_ctx, data->ssl.conn, 1545189251Ssam cipher, sizeof(cipher)) < 0 || 1546189251Ssam os_strstr(cipher, "ADH-") || 1547189251Ssam os_strstr(cipher, "anon"))) { 1548189251Ssam wpa_printf(MSG_DEBUG, "EAP-FAST: Using " 1549189251Ssam "anonymous (unauthenticated) " 1550189251Ssam "provisioning"); 1551189251Ssam data->anon_provisioning = 1; 1552189251Ssam } else 1553189251Ssam data->anon_provisioning = 0; 1554189251Ssam data->resuming = 0; 1555189251Ssam eap_fast_derive_keys(sm, data); 1556189251Ssam } 1557189251Ssam 1558189251Ssam if (res == 2) { 1559189251Ssam struct wpabuf msg; 1560189251Ssam /* 1561189251Ssam * Application data included in the handshake message. 1562189251Ssam */ 1563189251Ssam wpabuf_free(data->pending_phase2_req); 1564189251Ssam data->pending_phase2_req = resp; 1565189251Ssam resp = NULL; 1566189251Ssam wpabuf_set(&msg, pos, left); 1567189251Ssam res = eap_fast_decrypt(sm, data, ret, req, &msg, 1568189251Ssam &resp); 1569189251Ssam } 1570189251Ssam } 1571189251Ssam 1572189251Ssam if (res == 1) { 1573189251Ssam wpabuf_free(resp); 1574189251Ssam return eap_peer_tls_build_ack(id, EAP_TYPE_FAST, 1575189251Ssam data->fast_version); 1576189251Ssam } 1577189251Ssam 1578189251Ssam return resp; 1579189251Ssam} 1580189251Ssam 1581189251Ssam 1582189251Ssam#if 0 /* FIX */ 1583189251Ssamstatic Boolean eap_fast_has_reauth_data(struct eap_sm *sm, void *priv) 1584189251Ssam{ 1585189251Ssam struct eap_fast_data *data = priv; 1586189251Ssam return tls_connection_established(sm->ssl_ctx, data->ssl.conn); 1587189251Ssam} 1588189251Ssam 1589189251Ssam 1590189251Ssamstatic void eap_fast_deinit_for_reauth(struct eap_sm *sm, void *priv) 1591189251Ssam{ 1592189251Ssam struct eap_fast_data *data = priv; 1593189251Ssam os_free(data->key_block_p); 1594189251Ssam data->key_block_p = NULL; 1595189251Ssam wpabuf_free(data->pending_phase2_req); 1596189251Ssam data->pending_phase2_req = NULL; 1597189251Ssam} 1598189251Ssam 1599189251Ssam 1600189251Ssamstatic void * eap_fast_init_for_reauth(struct eap_sm *sm, void *priv) 1601189251Ssam{ 1602189251Ssam struct eap_fast_data *data = priv; 1603189251Ssam if (eap_peer_tls_reauth_init(sm, &data->ssl)) { 1604189251Ssam os_free(data); 1605189251Ssam return NULL; 1606189251Ssam } 1607189251Ssam if (data->phase2_priv && data->phase2_method && 1608189251Ssam data->phase2_method->init_for_reauth) 1609189251Ssam data->phase2_method->init_for_reauth(sm, data->phase2_priv); 1610189251Ssam data->phase2_success = 0; 1611189251Ssam data->resuming = 1; 1612189251Ssam data->provisioning = 0; 1613189251Ssam data->anon_provisioning = 0; 1614189251Ssam data->simck_idx = 0; 1615189251Ssam return priv; 1616189251Ssam} 1617189251Ssam#endif 1618189251Ssam 1619189251Ssam 1620189251Ssamstatic int eap_fast_get_status(struct eap_sm *sm, void *priv, char *buf, 1621189251Ssam size_t buflen, int verbose) 1622189251Ssam{ 1623189251Ssam struct eap_fast_data *data = priv; 1624189251Ssam int len, ret; 1625189251Ssam 1626189251Ssam len = eap_peer_tls_status(sm, &data->ssl, buf, buflen, verbose); 1627189251Ssam if (data->phase2_method) { 1628189251Ssam ret = os_snprintf(buf + len, buflen - len, 1629189251Ssam "EAP-FAST Phase2 method=%s\n", 1630189251Ssam data->phase2_method->name); 1631189251Ssam if (ret < 0 || (size_t) ret >= buflen - len) 1632189251Ssam return len; 1633189251Ssam len += ret; 1634189251Ssam } 1635189251Ssam return len; 1636189251Ssam} 1637189251Ssam 1638189251Ssam 1639189251Ssamstatic Boolean eap_fast_isKeyAvailable(struct eap_sm *sm, void *priv) 1640189251Ssam{ 1641189251Ssam struct eap_fast_data *data = priv; 1642189251Ssam return data->success; 1643189251Ssam} 1644189251Ssam 1645189251Ssam 1646189251Ssamstatic u8 * eap_fast_getKey(struct eap_sm *sm, void *priv, size_t *len) 1647189251Ssam{ 1648189251Ssam struct eap_fast_data *data = priv; 1649189251Ssam u8 *key; 1650189251Ssam 1651189251Ssam if (!data->success) 1652189251Ssam return NULL; 1653189251Ssam 1654189251Ssam key = os_malloc(EAP_FAST_KEY_LEN); 1655189251Ssam if (key == NULL) 1656189251Ssam return NULL; 1657189251Ssam 1658189251Ssam *len = EAP_FAST_KEY_LEN; 1659189251Ssam os_memcpy(key, data->key_data, EAP_FAST_KEY_LEN); 1660189251Ssam 1661189251Ssam return key; 1662189251Ssam} 1663189251Ssam 1664189251Ssam 1665189251Ssamstatic u8 * eap_fast_get_emsk(struct eap_sm *sm, void *priv, size_t *len) 1666189251Ssam{ 1667189251Ssam struct eap_fast_data *data = priv; 1668189251Ssam u8 *key; 1669189251Ssam 1670189251Ssam if (!data->success) 1671189251Ssam return NULL; 1672189251Ssam 1673189251Ssam key = os_malloc(EAP_EMSK_LEN); 1674189251Ssam if (key == NULL) 1675189251Ssam return NULL; 1676189251Ssam 1677189251Ssam *len = EAP_EMSK_LEN; 1678189251Ssam os_memcpy(key, data->emsk, EAP_EMSK_LEN); 1679189251Ssam 1680189251Ssam return key; 1681189251Ssam} 1682189251Ssam 1683189251Ssam 1684189251Ssamint eap_peer_fast_register(void) 1685189251Ssam{ 1686189251Ssam struct eap_method *eap; 1687189251Ssam int ret; 1688189251Ssam 1689189251Ssam eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION, 1690189251Ssam EAP_VENDOR_IETF, EAP_TYPE_FAST, "FAST"); 1691189251Ssam if (eap == NULL) 1692189251Ssam return -1; 1693189251Ssam 1694189251Ssam eap->init = eap_fast_init; 1695189251Ssam eap->deinit = eap_fast_deinit; 1696189251Ssam eap->process = eap_fast_process; 1697189251Ssam eap->isKeyAvailable = eap_fast_isKeyAvailable; 1698189251Ssam eap->getKey = eap_fast_getKey; 1699189251Ssam eap->get_status = eap_fast_get_status; 1700189251Ssam#if 0 1701189251Ssam eap->has_reauth_data = eap_fast_has_reauth_data; 1702189251Ssam eap->deinit_for_reauth = eap_fast_deinit_for_reauth; 1703189251Ssam eap->init_for_reauth = eap_fast_init_for_reauth; 1704189251Ssam#endif 1705189251Ssam eap->get_emsk = eap_fast_get_emsk; 1706189251Ssam 1707189251Ssam ret = eap_peer_method_register(eap); 1708189251Ssam if (ret) 1709189251Ssam eap_peer_method_free(eap); 1710189251Ssam return ret; 1711189251Ssam} 1712