contrib/wpa_supplicant-0.5.8/eap_fast.c

   1 /*
   2  * EAP peer method: EAP-FAST (draft-cam-winget-eap-fast-03.txt)
   3  * Copyright (c) 2004-2006, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "eap_i.h"
  19 #include "eap_tls_common.h"
  20 #include "config_ssid.h"
  21 #include "tls.h"
  22 #include "eap_tlv.h"
  23 #include "sha1.h"
  24 #include "config.h"
  25
  26 /* TODO:
  27  * - encrypt PAC-Key in the PAC file
  28  * - test session resumption and enable it if it interoperates
  29  * - password change (pending mschapv2 packet; replay decrypted packet)
  30  */
  31
  32 #define EAP_FAST_VERSION 1
  33 #define EAP_FAST_KEY_LEN 64
  34 #define EAP_FAST_PAC_KEY_LEN 32
  35 #define EAP_FAST_SIMCK_LEN 40
  36 #define EAP_FAST_SKS_LEN 40
  37
  38 #define TLS_EXT_PAC_OPAQUE 35
  39
  40 static const char *pac_file_hdr =
  41         "wpa_supplicant EAP-FAST PAC file - version 1";
  42
  43
  44 static void eap_fast_deinit(struct eap_sm *sm, void *priv);
  45
  46
  47 #define PAC_TYPE_PAC_KEY 1
  48 #define PAC_TYPE_PAC_OPAQUE 2
  49 #define PAC_TYPE_CRED_LIFETIME 3
  50 #define PAC_TYPE_A_ID 4
  51 #define PAC_TYPE_I_ID 5
  52 #define PAC_TYPE_SERVER_PROTECTED_DATA 6
  53 #define PAC_TYPE_A_ID_INFO 7
  54 #define PAC_TYPE_PAC_ACKNOWLEDGEMENT 8
  55 #define PAC_TYPE_PAC_INFO 9
  56
  57 struct pac_tlv_hdr {
  58         u16 type;
  59         u16 len;
  60 };
  61
  62
  63 /* draft-cam-winget-eap-fast-provisioning-01.txt:
  64  * 3.4 Key Derivations Used in the EAP-FAST Provisioning Exchange */
  65 struct eap_fast_key_block_provisioning {
  66         /* Extra key material after TLS key_block */
  67         u8 session_key_seed[EAP_FAST_SKS_LEN];
  68         u8 server_challenge[16];
  69         u8 client_challenge[16];
  70 };
  71
  72
  73 struct eap_fast_pac {
  74         struct eap_fast_pac *next;
  75
  76         u8 pac_key[EAP_FAST_PAC_KEY_LEN];
  77         u8 *pac_opaque;
  78         size_t pac_opaque_len;
  79         u8 *pac_info;
  80         size_t pac_info_len;
  81         u8 *a_id;
  82         size_t a_id_len;
  83         u8 *i_id;
  84         size_t i_id_len;
  85         u8 *a_id_info;
  86         size_t a_id_info_len;
  87 };
  88
  89
  90 struct eap_fast_data {
  91         struct eap_ssl_data ssl;
  92
  93         int fast_version;
  94
  95         const struct eap_method *phase2_method;
  96         void *phase2_priv;
  97         int phase2_success;
  98
  99         struct eap_method_type phase2_type;
 100         struct eap_method_type *phase2_types;
 101         size_t num_phase2_types;
 102         int resuming; /* starting a resumed session */
 103         struct eap_fast_key_block_provisioning *key_block_p;
 104         int provisioning_allowed; /* is PAC provisioning allowed */
 105         int provisioning; /* doing PAC provisioning (not the normal auth) */
 106
 107         u8 key_data[EAP_FAST_KEY_LEN];
 108         u8 emsk[EAP_EMSK_LEN];
 109         int success;
 110
 111         struct eap_fast_pac *pac;
 112         struct eap_fast_pac *current_pac;
 113
 114         int tls_master_secret_set;
 115
 116         u8 simck[EAP_FAST_SIMCK_LEN];
 117         int simck_idx;
 118 };
 119
 120
 121 static void eap_fast_free_pac(struct eap_fast_pac *pac)
 122 {
 123         os_free(pac->pac_opaque);
 124         os_free(pac->pac_info);
 125         os_free(pac->a_id);
 126         os_free(pac->i_id);
 127         os_free(pac->a_id_info);
 128         os_free(pac);
 129 }
 130
 131
 132 static struct eap_fast_pac * eap_fast_get_pac(struct eap_fast_data *data,
 133                                               const u8 *a_id, size_t a_id_len)
 134 {
 135         struct eap_fast_pac *pac = data->pac;
 136
 137         while (pac) {
 138                 if (pac->a_id_len == a_id_len &&
 139                     os_memcmp(pac->a_id, a_id, a_id_len) == 0) {
 140                         return pac;
 141                 }
 142                 pac = pac->next;
 143         }
 144         return NULL;
 145 }
 146
 147
 148 static int eap_fast_add_pac(struct eap_fast_data *data,
 149                             struct eap_fast_pac *entry)
 150 {
 151         struct eap_fast_pac *pac, *prev;
 152
 153         if (entry == NULL || entry->a_id == NULL)
 154                 return -1;
 155
 156         /* Remove a possible old entry for the matching A-ID. */
 157         pac = data->pac;
 158         prev = NULL;
 159         while (pac) {
 160                 if (pac->a_id_len == entry->a_id_len &&
 161                     os_memcmp(pac->a_id, entry->a_id, pac->a_id_len) == 0) {
 162                         if (prev == NULL) {
 163                                 data->pac = pac->next;
 164                         } else {
 165                                 prev->next = pac->next;
 166                         }
 167                         if (data->current_pac == pac)
 168                                 data->current_pac = NULL;
 169                         eap_fast_free_pac(pac);
 170                         break;
 171                 }
 172                 prev = pac;
 173                 pac = pac->next;
 174         }
 175
 176         /* Allocate a new entry and add it to the list of PACs. */
 177         pac = os_zalloc(sizeof(*pac));
 178         if (pac == NULL)
 179                 return -1;
 180
 181         os_memcpy(pac->pac_key, entry->pac_key, EAP_FAST_PAC_KEY_LEN);
 182         if (entry->pac_opaque) {
 183                 pac->pac_opaque = os_malloc(entry->pac_opaque_len);
 184                 if (pac->pac_opaque == NULL) {
 185                         eap_fast_free_pac(pac);
 186                         return -1;
 187                 }
 188                 os_memcpy(pac->pac_opaque, entry->pac_opaque,
 189                           entry->pac_opaque_len);
 190                 pac->pac_opaque_len = entry->pac_opaque_len;
 191         }
 192         if (entry->pac_info) {
 193                 pac->pac_info = os_malloc(entry->pac_info_len);
 194                 if (pac->pac_info == NULL) {
 195                         eap_fast_free_pac(pac);
 196                         return -1;
 197                 }
 198                 os_memcpy(pac->pac_info, entry->pac_info,
 199                           entry->pac_info_len);
 200                 pac->pac_info_len = entry->pac_info_len;
 201         }
 202         if (entry->a_id) {
 203                 pac->a_id = os_malloc(entry->a_id_len);
 204                 if (pac->a_id == NULL) {
 205                         eap_fast_free_pac(pac);
 206                         return -1;
 207                 }
 208                 os_memcpy(pac->a_id, entry->a_id,
 209                           entry->a_id_len);
 210                 pac->a_id_len = entry->a_id_len;
 211         }
 212         if (entry->i_id) {
 213                 pac->i_id = os_malloc(entry->i_id_len);
 214                 if (pac->i_id == NULL) {
 215                         eap_fast_free_pac(pac);
 216                         return -1;
 217                 }
 218                 os_memcpy(pac->i_id, entry->i_id,
 219                           entry->i_id_len);
 220                 pac->i_id_len = entry->i_id_len;
 221         }
 222         if (entry->a_id_info) {
 223                 pac->a_id_info = os_malloc(entry->a_id_info_len);
 224                 if (pac->a_id_info == NULL) {
 225                         eap_fast_free_pac(pac);
 226                         return -1;
 227                 }
 228                 os_memcpy(pac->a_id_info, entry->a_id_info,
 229                           entry->a_id_info_len);
 230                 pac->a_id_info_len = entry->a_id_info_len;
 231         }
 232         pac->next = data->pac;
 233         data->pac = pac;
 234         return 0;
 235 }
 236
 237
 238 struct eap_fast_read_ctx {
 239         FILE *f;
 240         const char *pos;
 241         const char *end;
 242 };
 243
 244 static int eap_fast_read_line(struct eap_fast_read_ctx *rc, char *buf,
 245                               size_t buf_len)
 246 {
 247         char *pos;
 248
 249         if (rc->f) {
 250                 if (fgets(buf, buf_len, rc->f) == NULL)
 251                         return -1;
 252         } else {
 253                 const char *l_end;
 254                 size_t len;
 255                 if (rc->pos >= rc->end)
 256                         return -1;
 257                 l_end = rc->pos;
 258                 while (l_end < rc->end && *l_end != '\n')
 259                         l_end++;
 260                 len = l_end - rc->pos;
 261                 if (len >= buf_len)
 262                         len = buf_len - 1;
 263                 os_memcpy(buf, rc->pos, len);
 264                 buf[len] = '\0';
 265                 rc->pos = l_end + 1;
 266         }
 267
 268         buf[buf_len - 1] = '\0';
 269         pos = buf;
 270         while (*pos != '\0') {
 271                 if (*pos == '\n' || *pos == '\r') {
 272                         *pos = '\0';
 273                         break;
 274                 }
 275                 pos++;
 276         }
 277
 278         return 0;
 279 }
 280
 281
 282 static u8 * eap_fast_parse_hex(const char *value, size_t *len)
 283 {
 284         int hlen;
 285         u8 *buf;
 286
 287         if (value == NULL)
 288                 return NULL;
 289         hlen = os_strlen(value);
 290         if (hlen & 1)
 291                 return NULL;
 292         *len = hlen / 2;
 293         buf = os_malloc(*len);
 294         if (buf == NULL)
 295                 return NULL;
 296         if (hexstr2bin(value, buf, *len)) {
 297                 os_free(buf);
 298                 return NULL;
 299         }
 300         return buf;
 301 }
 302
 303
 304 static int eap_fast_load_pac(struct eap_sm *sm, struct eap_fast_data *data,
 305                              const char *pac_file)
 306 {
 307         struct eap_fast_read_ctx rc;
 308         struct eap_fast_pac *pac = NULL;
 309         int count = 0;
 310         char *buf, *pos;
 311         const int buf_len = 2048;
 312         int ret = 0, line = 0;
 313
 314         if (pac_file == NULL)
 315                 return -1;
 316
 317         os_memset(&rc, 0, sizeof(rc));
 318
 319         if (os_strncmp(pac_file, "blob://", 7) == 0) {
 320                 const struct wpa_config_blob *blob;
 321                 blob = eap_get_config_blob(sm, pac_file + 7);
 322                 if (blob == NULL) {
 323                         wpa_printf(MSG_INFO, "EAP-FAST: No PAC blob '%s' - "
 324                                    "assume no PAC entries have been "
 325                                    "provisioned", pac_file + 7);
 326                         return 0;
 327                 }
 328                 rc.pos = (char *) blob->data;
 329                 rc.end = (char *) blob->data + blob->len;
 330         } else {
 331                 rc.f = fopen(pac_file, "r");
 332                 if (rc.f == NULL) {
 333                         wpa_printf(MSG_INFO, "EAP-FAST: No PAC file '%s' - "
 334                                    "assume no PAC entries have been "
 335                                    "provisioned", pac_file);
 336                         return 0;
 337                 }
 338         }
 339
 340         buf = os_malloc(buf_len);
 341         if (buf == NULL) {
 342                 return -1;
 343         }
 344
 345         line++;
 346         if (eap_fast_read_line(&rc, buf, buf_len) < 0 ||
 347             os_strcmp(pac_file_hdr, buf) != 0) {
 348                 wpa_printf(MSG_INFO, "EAP-FAST: Unrecognized header line in "
 349                            "PAC file '%s'", pac_file);
 350                 os_free(buf);
 351                 if (rc.f)
 352                         fclose(rc.f);
 353                 return -1;
 354         }
 355
 356         while (eap_fast_read_line(&rc, buf, buf_len) == 0) {
 357                 line++;
 358                 pos = os_strchr(buf, '=');
 359                 if (pos) {
 360                         *pos++ = '\0';
 361                 }
 362
 363                 if (os_strcmp(buf, "START") == 0) {
 364                         if (pac) {
 365                                 wpa_printf(MSG_INFO, "EAP-FAST: START line "
 366                                            "without END in '%s:%d'",
 367                                            pac_file, line);
 368                                 ret = -1;
 369                                 break;
 370                         }
 371                         pac = os_zalloc(sizeof(*pac));
 372                         if (pac == NULL) {
 373                                 wpa_printf(MSG_INFO, "EAP-FAST: No memory for "
 374                                            "PAC entry");
 375                                 ret = -1;
 376                                 break;
 377                         }
 378                 } else if (os_strcmp(buf, "END") == 0) {
 379                         if (pac == NULL) {
 380                                 wpa_printf(MSG_INFO, "EAP-FAST: END line "
 381                                            "without START in '%s:%d'",
 382                                            pac_file, line);
 383                                 ret = -1;
 384                                 break;
 385                         }
 386                         pac->next = data->pac;
 387                         data->pac = pac;
 388                         pac = NULL;
 389                         count++;
 390                 } else if (pac && os_strcmp(buf, "PAC-Key") == 0) {
 391                         u8 *key;
 392                         size_t key_len;
 393                         key = eap_fast_parse_hex(pos, &key_len);
 394                         if (key == NULL || key_len != EAP_FAST_PAC_KEY_LEN) {
 395                                 wpa_printf(MSG_INFO, "EAP-FAST: Invalid "
 396                                            "PAC-Key '%s:%d'", pac_file, line);
 397                                 ret = -1;
 398                                 os_free(key);
 399                                 break;
 400                         }
 401
 402                         os_memcpy(pac->pac_key, key, EAP_FAST_PAC_KEY_LEN);
 403                         os_free(key);
 404                 } else if (pac && os_strcmp(buf, "PAC-Opaque") == 0) {
 405                         os_free(pac->pac_opaque);
 406                         pac->pac_opaque =
 407                                 eap_fast_parse_hex(pos, &pac->pac_opaque_len);
 408                         if (pac->pac_opaque == NULL) {
 409                                 wpa_printf(MSG_INFO, "EAP-FAST: Invalid "
 410                                            "PAC-Opaque '%s:%d'",
 411                                            pac_file, line);
 412                                 ret = -1;
 413                                 break;
 414                         }
 415                 } else if (pac && os_strcmp(buf, "A-ID") == 0) {
 416                         os_free(pac->a_id);
 417                         pac->a_id = eap_fast_parse_hex(pos, &pac->a_id_len);
 418                         if (pac->a_id == NULL) {
 419                                 wpa_printf(MSG_INFO, "EAP-FAST: Invalid "
 420                                            "A-ID '%s:%d'", pac_file, line);
 421                                 ret = -1;
 422                                 break;
 423                         }
 424                 } else if (pac && os_strcmp(buf, "I-ID") == 0) {
 425                         os_free(pac->i_id);
 426                         pac->i_id = eap_fast_parse_hex(pos, &pac->i_id_len);
 427                         if (pac->i_id == NULL) {
 428                                 wpa_printf(MSG_INFO, "EAP-FAST: Invalid "
 429                                            "I-ID '%s:%d'", pac_file, line);
 430                                 ret = -1;
 431                                 break;
 432                         }
 433                 } else if (pac && os_strcmp(buf, "A-ID-Info") == 0) {
 434                         os_free(pac->a_id_info);
 435                         pac->a_id_info =
 436                                 eap_fast_parse_hex(pos, &pac->a_id_info_len);
 437                         if (pac->a_id_info == NULL) {
 438                                 wpa_printf(MSG_INFO, "EAP-FAST: Invalid "
 439                                            "A-ID-Info '%s:%d'",
 440                                            pac_file, line);
 441                                 ret = -1;
 442                                 break;
 443                         }
 444                 }
 445         }
 446
 447         if (pac) {
 448                 wpa_printf(MSG_INFO, "EAP-FAST: PAC block not terminated with "
 449                            "END in '%s'", pac_file);
 450                 eap_fast_free_pac(pac);
 451                 ret = -1;
 452         }
 453
 454         os_free(buf);
 455         if (rc.f)
 456                 fclose(rc.f);
 457
 458         if (ret == 0) {
 459                 wpa_printf(MSG_DEBUG, "EAP-FAST: read %d PAC entries from "
 460                            "'%s'", count, pac_file);
 461         }
 462
 463         return ret;
 464 }
 465
 466
 467 static void eap_fast_write(char **buf, char **pos, size_t *buf_len,
 468                            const char *field, const u8 *data,
 469                            size_t len, int txt)
 470 {
 471         size_t i, need;
 472         int ret;
 473
 474         if (data == NULL || *buf == NULL)
 475                 return;
 476
 477         need = os_strlen(field) + len * 2 + 30;
 478         if (txt)
 479                 need += os_strlen(field) + len + 20;
 480
 481         if (*pos - *buf + need > *buf_len) {
 482                 char *nbuf = os_realloc(*buf, *buf_len + need);
 483                 if (nbuf == NULL) {
 484                         os_free(*buf);
 485                         *buf = NULL;
 486                         return;
 487                 }
 488                 *buf = nbuf;
 489                 *buf_len += need;
 490         }
 491
 492         ret = os_snprintf(*pos, *buf + *buf_len - *pos, "%s=", field);
 493         if (ret < 0 || ret >= *buf + *buf_len - *pos)
 494                 return;
 495         *pos += ret;
 496         *pos += wpa_snprintf_hex(*pos, *buf + *buf_len - *pos, data, len);
 497         ret = os_snprintf(*pos, *buf + *buf_len - *pos, "\n");
 498         if (ret < 0 || ret >= *buf + *buf_len - *pos)
 499                 return;
 500         *pos += ret;
 501
 502         if (txt) {
 503                 ret = os_snprintf(*pos, *buf + *buf_len - *pos,
 504                                   "%s-txt=", field);
 505                 if (ret < 0 || ret >= *buf + *buf_len - *pos)
 506                         return;
 507                 *pos += ret;
 508                 for (i = 0; i < len; i++) {
 509                         ret = os_snprintf(*pos, *buf + *buf_len - *pos,
 510                                           "%c", data[i]);
 511                         if (ret < 0 || ret >= *buf + *buf_len - *pos)
 512                                 return;
 513                         *pos += ret;
 514                 }
 515                 ret = os_snprintf(*pos, *buf + *buf_len - *pos, "\n");
 516                 if (ret < 0 || ret >= *buf + *buf_len - *pos)
 517                         return;
 518                 *pos += ret;
 519         }
 520 }
 521
 522
 523 static int eap_fast_save_pac(struct eap_sm *sm, struct eap_fast_data *data,
 524                              const char *pac_file)
 525 {
 526         FILE *f;
 527         struct eap_fast_pac *pac;
 528         int count = 0, ret;
 529         char *buf, *pos;
 530         size_t buf_len;
 531
 532         if (pac_file == NULL)
 533                 return -1;
 534
 535         buf_len = 1024;
 536         pos = buf = os_malloc(buf_len);
 537         if (buf == NULL)
 538                 return -1;
 539
 540         ret = os_snprintf(pos, buf + buf_len - pos, "%s\n", pac_file_hdr);
 541         if (ret < 0 || ret >= buf + buf_len - pos) {
 542                 os_free(buf);
 543                 return -1;
 544         }
 545         pos += ret;
 546
 547         pac = data->pac;
 548         while (pac) {
 549                 ret = os_snprintf(pos, buf + buf_len - pos, "START\n");
 550                 if (ret < 0 || ret >= buf + buf_len - pos) {
 551                         os_free(buf);
 552                         return -1;
 553                 }
 554                 pos += ret;
 555                 eap_fast_write(&buf, &pos, &buf_len, "PAC-Key", pac->pac_key,
 556                                EAP_FAST_PAC_KEY_LEN, 0);
 557                 eap_fast_write(&buf, &pos, &buf_len, "PAC-Opaque",
 558                                pac->pac_opaque, pac->pac_opaque_len, 0);
 559                 eap_fast_write(&buf, &pos, &buf_len, "PAC-Info", pac->pac_info,
 560                                pac->pac_info_len, 0);
 561                 eap_fast_write(&buf, &pos, &buf_len, "A-ID", pac->a_id,
 562                                pac->a_id_len, 0);
 563                 eap_fast_write(&buf, &pos, &buf_len, "I-ID", pac->i_id,
 564                                pac->i_id_len, 1);
 565                 eap_fast_write(&buf, &pos, &buf_len, "A-ID-Info",
 566                                pac->a_id_info, pac->a_id_info_len, 1);
 567                 if (buf == NULL) {
 568                         wpa_printf(MSG_DEBUG, "EAP-FAST: No memory for PAC "
 569                                    "data");
 570                         return -1;
 571                 }
 572                 ret = os_snprintf(pos, buf + buf_len - pos, "END\n");
 573                 if (ret < 0 || ret >= buf + buf_len - pos) {
 574                         os_free(buf);
 575                         return -1;
 576                 }
 577                 pos += ret;
 578                 count++;
 579                 pac = pac->next;
 580         }
 581
 582         if (os_strncmp(pac_file, "blob://", 7) == 0) {
 583                 struct wpa_config_blob *blob;
 584                 blob = os_zalloc(sizeof(*blob));
 585                 if (blob == NULL) {
 586                         os_free(buf);
 587                         return -1;
 588                 }
 589                 blob->data = (u8 *) buf;
 590                 blob->len = pos - buf;
 591                 buf = NULL;
 592                 blob->name = os_strdup(pac_file + 7);
 593                 if (blob->name == NULL) {
 594                         os_free(blob->data);
 595                         os_free(blob);
 596                         return -1;
 597                 }
 598                 eap_set_config_blob(sm, blob);
 599         } else {
 600                 f = fopen(pac_file, "w");
 601                 if (f == NULL) {
 602                         wpa_printf(MSG_INFO, "EAP-FAST: Failed to open PAC "
 603                                    "file '%s' for writing", pac_file);
 604                         os_free(buf);
 605                         return -1;
 606                 }
 607                 fprintf(f, "%s", buf);
 608                 os_free(buf);
 609                 fclose(f);
 610         }
 611
 612         wpa_printf(MSG_DEBUG, "EAP-FAST: wrote %d PAC entries into '%s'",
 613                    count, pac_file);
 614
 615         return 0;
 616 }
 617
 618
 619 static void * eap_fast_init(struct eap_sm *sm)
 620 {
 621         struct eap_fast_data *data;
 622         struct wpa_ssid *config = eap_get_config(sm);
 623
 624         data = os_zalloc(sizeof(*data));
 625         if (data == NULL)
 626                 return NULL;
 627         data->fast_version = EAP_FAST_VERSION;
 628
 629         if (config && config->phase1) {
 630                 if (os_strstr(config->phase1, "fast_provisioning=1")) {
 631                         data->provisioning_allowed = 1;
 632                         wpa_printf(MSG_DEBUG, "EAP-FAST: Automatic PAC "
 633                                    "provisioning is allowed");
 634                 }
 635         }
 636
 637         if (config && config->phase2) {
 638                 char *start, *pos, *buf;
 639                 struct eap_method_type *methods = NULL, *_methods;
 640                 u8 method;
 641                 size_t num_methods = 0;
 642                 start = buf = os_strdup(config->phase2);
 643                 if (buf == NULL) {
 644                         eap_fast_deinit(sm, data);
 645                         return NULL;
 646                 }
 647                 while (start && *start != '\0') {
 648                         int vendor;
 649                         pos = os_strstr(start, "auth=");
 650                         if (pos == NULL)
 651                                 break;
 652                         if (start != pos && *(pos - 1) != ' ') {
 653                                 start = pos + 5;
 654                                 continue;
 655                         }
 656
 657                         start = pos + 5;
 658                         pos = os_strchr(start, ' ');
 659                         if (pos)
 660                                 *pos++ = '\0';
 661                         method = eap_get_phase2_type(start, &vendor);
 662                         if (vendor == EAP_VENDOR_IETF &&
 663                             method == EAP_TYPE_NONE) {
 664                                 wpa_printf(MSG_ERROR, "EAP-FAST: Unsupported "
 665                                            "Phase2 method '%s'", start);
 666                         } else {
 667                                 num_methods++;
 668                                 _methods = os_realloc(
 669                                         methods,
 670                                         num_methods * sizeof(*methods));
 671                                 if (_methods == NULL) {
 672                                         os_free(methods);
 673                                         os_free(buf);
 674                                         eap_fast_deinit(sm, data);
 675                                         return NULL;
 676                                 }
 677                                 methods = _methods;
 678                                 methods[num_methods - 1].vendor = vendor;
 679                                 methods[num_methods - 1].method = method;
 680                         }
 681
 682                         start = pos;
 683                 }
 684                 os_free(buf);
 685                 data->phase2_types = methods;
 686                 data->num_phase2_types = num_methods;
 687         }
 688         if (data->phase2_types == NULL) {
 689                 data->phase2_types =
 690                         eap_get_phase2_types(config, &data->num_phase2_types);
 691         }
 692         if (data->phase2_types == NULL) {
 693                 wpa_printf(MSG_ERROR, "EAP-FAST: No Phase2 method available");
 694                 eap_fast_deinit(sm, data);
 695                 return NULL;
 696         }
 697         wpa_hexdump(MSG_DEBUG, "EAP-FAST: Phase2 EAP types",
 698                     (u8 *) data->phase2_types,
 699                     data->num_phase2_types * sizeof(struct eap_method_type));
 700         data->phase2_type.vendor = EAP_VENDOR_IETF;
 701         data->phase2_type.method = EAP_TYPE_NONE;
 702
 703         if (eap_tls_ssl_init(sm, &data->ssl, config)) {
 704                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to initialize SSL.");
 705                 eap_fast_deinit(sm, data);
 706                 return NULL;
 707         }
 708
 709         /* The local RADIUS server in a Cisco AP does not seem to like empty
 710          * fragments before data, so disable that workaround for CBC.
 711          * TODO: consider making this configurable */
 712         tls_connection_enable_workaround(sm->ssl_ctx, data->ssl.conn);
 713
 714         if (eap_fast_load_pac(sm, data, config->pac_file) < 0) {
 715                 eap_fast_deinit(sm, data);
 716                 return NULL;
 717         }
 718
 719         if (data->pac == NULL && !data->provisioning_allowed) {
 720                 wpa_printf(MSG_INFO, "EAP-FAST: No PAC configured and "
 721                            "provisioning disabled");
 722                 eap_fast_deinit(sm, data);
 723                 return NULL;
 724         }
 725
 726         return data;
 727 }
 728
 729
 730 static void eap_fast_deinit(struct eap_sm *sm, void *priv)
 731 {
 732         struct eap_fast_data *data = priv;
 733         struct eap_fast_pac *pac, *prev;
 734
 735         if (data == NULL)
 736                 return;
 737         if (data->phase2_priv && data->phase2_method)
 738                 data->phase2_method->deinit(sm, data->phase2_priv);
 739         os_free(data->phase2_types);
 740         os_free(data->key_block_p);
 741         eap_tls_ssl_deinit(sm, &data->ssl);
 742
 743         pac = data->pac;
 744         prev = NULL;
 745         while (pac) {
 746                 prev = pac;
 747                 pac = pac->next;
 748                 eap_fast_free_pac(prev);
 749         }
 750         os_free(data);
 751 }
 752
 753
 754 static int eap_fast_encrypt(struct eap_sm *sm, struct eap_fast_data *data,
 755                             int id, const u8 *plain, size_t plain_len,
 756                             u8 **out_data, size_t *out_len)
 757 {
 758         int res;
 759         u8 *pos;
 760         struct eap_hdr *resp;
 761
 762         /* TODO: add support for fragmentation, if needed. This will need to
 763          * add TLS Message Length field, if the frame is fragmented. */
 764         resp = os_malloc(sizeof(struct eap_hdr) + 2 + data->ssl.tls_out_limit);
 765         if (resp == NULL)
 766                 return 0;
 767
 768         resp->code = EAP_CODE_RESPONSE;
 769         resp->identifier = id;
 770
 771         pos = (u8 *) (resp + 1);
 772         *pos++ = EAP_TYPE_FAST;
 773         *pos++ = data->fast_version;
 774
 775         res = tls_connection_encrypt(sm->ssl_ctx, data->ssl.conn,
 776                                      plain, plain_len,
 777                                      pos, data->ssl.tls_out_limit);
 778         if (res < 0) {
 779                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to encrypt Phase 2 "
 780                            "data");
 781                 os_free(resp);
 782                 return 0;
 783         }
 784
 785         *out_len = sizeof(struct eap_hdr) + 2 + res;
 786         resp->length = host_to_be16(*out_len);
 787         *out_data = (u8 *) resp;
 788         return 0;
 789 }
 790
 791
 792 static int eap_fast_phase2_nak(struct eap_fast_data *data,
 793                                struct eap_hdr *hdr,
 794                                u8 **resp, size_t *resp_len)
 795 {
 796         struct eap_hdr *resp_hdr;
 797         u8 *pos = (u8 *) (hdr + 1);
 798         size_t i;
 799
 800         /* TODO: add support for expanded Nak */
 801         wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 Request: Nak type=%d", *pos);
 802         wpa_hexdump(MSG_DEBUG, "EAP-FAST: Allowed Phase2 EAP types",
 803                     (u8 *) data->phase2_types,
 804                     data->num_phase2_types * sizeof(struct eap_method_type));
 805         *resp_len = sizeof(struct eap_hdr) + 1;
 806         *resp = os_malloc(*resp_len + data->num_phase2_types);
 807         if (*resp == NULL)
 808                 return -1;
 809
 810         resp_hdr = (struct eap_hdr *) (*resp);
 811         resp_hdr->code = EAP_CODE_RESPONSE;
 812         resp_hdr->identifier = hdr->identifier;
 813         pos = (u8 *) (resp_hdr + 1);
 814         *pos++ = EAP_TYPE_NAK;
 815         for (i = 0; i < data->num_phase2_types; i++) {
 816                 if (data->phase2_types[i].vendor == EAP_VENDOR_IETF &&
 817                     data->phase2_types[i].method < 256) {
 818                         (*resp_len)++;
 819                         *pos++ = data->phase2_types[i].method;
 820                 }
 821         }
 822         resp_hdr->length = host_to_be16(*resp_len);
 823
 824         return 0;
 825 }
 826
 827
 828 static int eap_fast_derive_msk(struct eap_fast_data *data)
 829 {
 830         /* Derive EAP Master Session Keys (section 5.4) */
 831         sha1_t_prf(data->simck, EAP_FAST_SIMCK_LEN,
 832                    "Session Key Generating Function", (u8 *) "", 0,
 833                    data->key_data, EAP_FAST_KEY_LEN);
 834         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Derived key (MSK)",
 835                         data->key_data, EAP_FAST_KEY_LEN);
 836
 837         sha1_t_prf(data->simck, EAP_FAST_SIMCK_LEN,
 838                    "Extended Session Key Generating Function",
 839                    (u8 *) "", 0, data->emsk, EAP_EMSK_LEN);
 840         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Derived key (EMSK)",
 841                         data->emsk, EAP_EMSK_LEN);
 842
 843         data->success = 1;
 844
 845         return 0;
 846 }
 847
 848
 849 static int eap_fast_set_tls_master_secret(struct eap_sm *sm,
 850                                           struct eap_fast_data *data,
 851                                           const u8 *tls, size_t tls_len)
 852 {
 853         struct tls_keys keys;
 854         u8 master_secret[48], *seed;
 855         const u8 *server_random;
 856         size_t seed_len, server_random_len;
 857
 858         if (data->tls_master_secret_set || !data->current_pac ||
 859             tls_connection_get_keys(sm->ssl_ctx, data->ssl.conn, &keys) ||
 860             keys.client_random == NULL) {
 861                 return 0;
 862         }
 863
 864         wpa_hexdump(MSG_DEBUG, "EAP-FAST: client_random",
 865                     keys.client_random, keys.client_random_len);
 866
 867         /* TLS master secret is needed before TLS library has processed this
 868          * message which includes both ServerHello and an encrypted handshake
 869          * message, so we need to parse server_random from this message before
 870          * passing it to TLS library.
 871          *
 872          * Example TLS packet header:
 873          * (16 03 01 00 2a 02 00 00 26 03 01 <32 bytes server_random>)
 874          * Content Type: Handshake: 0x16
 875          * Version: TLS 1.0 (0x0301)
 876          * Lenghth: 42 (0x002a)
 877          * Handshake Type: Server Hello: 0x02
 878          * Length: 38 (0x000026)
 879          * Version TLS 1.0 (0x0301)
 880          * Random: 32 bytes
 881          */
 882         if (tls_len < 43 || tls[0] != 0x16 ||
 883             tls[1] != 0x03 || tls[2] != 0x01 ||
 884             tls[5] != 0x02 || tls[9] != 0x03 || tls[10] != 0x01) {
 885                 wpa_hexdump(MSG_DEBUG, "EAP-FAST: unrecognized TLS "
 886                             "ServerHello", tls, tls_len);
 887                 return -1;
 888         }
 889         server_random = tls + 11;
 890         server_random_len = 32;
 891         wpa_hexdump(MSG_DEBUG, "EAP-FAST: server_random",
 892                     server_random, server_random_len);
 893
 894         seed_len = keys.client_random_len + server_random_len;
 895         seed = os_malloc(seed_len);
 896         if (seed == NULL)
 897                 return -1;
 898         os_memcpy(seed, server_random, server_random_len);
 899         os_memcpy(seed + server_random_len,
 900                   keys.client_random, keys.client_random_len);
 901
 902         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: T-PRF seed", seed, seed_len);
 903         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: PAC-Key",
 904                         data->current_pac->pac_key, EAP_FAST_PAC_KEY_LEN);
 905         /* master_secret = T-PRF(PAC-Key, "PAC to master secret label hash",
 906          * server_random + client_random, 48) */
 907         sha1_t_prf(data->current_pac->pac_key, EAP_FAST_PAC_KEY_LEN,
 908                    "PAC to master secret label hash",
 909                    seed, seed_len, master_secret, sizeof(master_secret));
 910         os_free(seed);
 911         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: TLS pre-master-secret",
 912                         master_secret, sizeof(master_secret));
 913
 914         data->tls_master_secret_set = 1;
 915
 916         return tls_connection_set_master_key(sm->ssl_ctx, data->ssl.conn,
 917                                              master_secret,
 918                                              sizeof(master_secret));
 919 }
 920
 921
 922 static u8 * eap_fast_derive_key(struct eap_sm *sm, struct eap_ssl_data *data,
 923                                 char *label, size_t len)
 924 {
 925         struct tls_keys keys;
 926         u8 *rnd = NULL, *out;
 927         int block_size;
 928
 929         block_size = tls_connection_get_keyblock_size(sm->ssl_ctx, data->conn);
 930         if (block_size < 0)
 931                 return NULL;
 932
 933         out = os_malloc(block_size + len);
 934         if (out == NULL)
 935                 return NULL;
 936
 937         if (tls_connection_prf(sm->ssl_ctx, data->conn, label, 1, out,
 938                                block_size + len) == 0) {
 939                 os_memmove(out, out + block_size, len);
 940                 return out;
 941         }
 942
 943         if (tls_connection_get_keys(sm->ssl_ctx, data->conn, &keys))
 944                 goto fail;
 945
 946         rnd = os_malloc(keys.client_random_len + keys.server_random_len);
 947         if (rnd == NULL)
 948                 goto fail;
 949
 950         os_memcpy(rnd, keys.server_random, keys.server_random_len);
 951         os_memcpy(rnd + keys.server_random_len, keys.client_random,
 952                   keys.client_random_len);
 953
 954         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: master_secret for key "
 955                         "expansion", keys.master_key, keys.master_key_len);
 956         if (tls_prf(keys.master_key, keys.master_key_len,
 957                     label, rnd, keys.client_random_len +
 958                     keys.server_random_len, out, block_size + len))
 959                 goto fail;
 960         os_free(rnd);
 961         os_memmove(out, out + block_size, len);
 962         return out;
 963
 964 fail:
 965         os_free(rnd);
 966         os_free(out);
 967         return NULL;
 968 }
 969
 970
 971 static void eap_fast_derive_key_auth(struct eap_sm *sm,
 972                                      struct eap_fast_data *data)
 973 {
 974         u8 *sks;
 975
 976         /* draft-cam-winget-eap-fast-05.txt:
 977          * 5.1 EAP-FAST Authentication Phase 1: Key Derivations
 978          * Extra key material after TLS key_block: session_ket_seed[40]
 979          */
 980
 981         sks = eap_fast_derive_key(sm, &data->ssl, "key expansion",
 982                                   EAP_FAST_SKS_LEN);
 983         if (sks == NULL) {
 984                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to derive "
 985                            "session_key_seed");
 986                 return;
 987         }
 988
 989         /*
 990          * draft-cam-winget-eap-fast-05.txt, 5.2:
 991          * S-IMCK[0] = session_key_seed
 992          */
 993         wpa_hexdump_key(MSG_DEBUG,
 994                         "EAP-FAST: session_key_seed (SKS = S-IMCK[0])",
 995                         sks, EAP_FAST_SKS_LEN);
 996         data->simck_idx = 0;
 997         os_memcpy(data->simck, sks, EAP_FAST_SIMCK_LEN);
 998         os_free(sks);
 999 }
1000
1001
1002 static void eap_fast_derive_key_provisioning(struct eap_sm *sm,
1003                                              struct eap_fast_data *data)
1004 {
1005         os_free(data->key_block_p);
1006         data->key_block_p = (struct eap_fast_key_block_provisioning *)
1007                 eap_fast_derive_key(sm, &data->ssl, "key expansion",
1008                                     sizeof(*data->key_block_p));
1009         if (data->key_block_p == NULL) {
1010                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to derive key block");
1011                 return;
1012         }
1013         /*
1014          * draft-cam-winget-eap-fast-05.txt, 5.2:
1015          * S-IMCK[0] = session_key_seed
1016          */
1017         wpa_hexdump_key(MSG_DEBUG,
1018                         "EAP-FAST: session_key_seed (SKS = S-IMCK[0])",
1019                         data->key_block_p->session_key_seed,
1020                         sizeof(data->key_block_p->session_key_seed));
1021         data->simck_idx = 0;
1022         os_memcpy(data->simck, data->key_block_p->session_key_seed,
1023                   EAP_FAST_SIMCK_LEN);
1024         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: server_challenge",
1025                         data->key_block_p->server_challenge,
1026                         sizeof(data->key_block_p->server_challenge));
1027         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: client_challenge",
1028                         data->key_block_p->client_challenge,
1029                         sizeof(data->key_block_p->client_challenge));
1030 }
1031
1032
1033 static void eap_fast_derive_keys(struct eap_sm *sm, struct eap_fast_data *data)
1034 {
1035         if (data->current_pac) {
1036                 eap_fast_derive_key_auth(sm, data);
1037         } else {
1038                 eap_fast_derive_key_provisioning(sm, data);
1039         }
1040 }
1041
1042
1043 static int eap_fast_phase2_request(struct eap_sm *sm,
1044                                    struct eap_fast_data *data,
1045                                    struct eap_method_ret *ret,
1046                                    struct eap_hdr *hdr,
1047                                    u8 **resp, size_t *resp_len)
1048 {
1049         size_t len = be_to_host16(hdr->length);
1050         u8 *pos;
1051         struct eap_method_ret iret;
1052
1053         if (len <= sizeof(struct eap_hdr)) {
1054                 wpa_printf(MSG_INFO, "EAP-FAST: too short "
1055                            "Phase 2 request (len=%lu)", (unsigned long) len);
1056                 return -1;
1057         }
1058         pos = (u8 *) (hdr + 1);
1059         wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 Request: type=%d", *pos);
1060         switch (*pos) {
1061         case EAP_TYPE_IDENTITY:
1062                 *resp = eap_sm_buildIdentity(sm, hdr->identifier, resp_len, 1);
1063                 break;
1064         default:
1065                 if (data->phase2_type.vendor == EAP_VENDOR_IETF &&
1066                     data->phase2_type.method == EAP_TYPE_NONE) {
1067                         size_t i;
1068                         for (i = 0; i < data->num_phase2_types; i++) {
1069                                 if (data->phase2_types[i].vendor !=
1070                                     EAP_VENDOR_IETF ||
1071                                     data->phase2_types[i].method != *pos)
1072                                         continue;
1073
1074                                 data->phase2_type.vendor =
1075                                         data->phase2_types[i].vendor;
1076                                 data->phase2_type.method =
1077                                         data->phase2_types[i].method;
1078                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Selected "
1079                                            "Phase 2 EAP vendor %d method %d",
1080                                            data->phase2_type.vendor,
1081                                            data->phase2_type.method);
1082                                 break;
1083                         }
1084                 }
1085                 if (*pos != data->phase2_type.method ||
1086                     *pos == EAP_TYPE_NONE) {
1087                         if (eap_fast_phase2_nak(data, hdr, resp, resp_len))
1088                                 return -1;
1089                         return 0;
1090                 }
1091
1092                 if (data->phase2_priv == NULL) {
1093                         data->phase2_method = eap_sm_get_eap_methods(
1094                                 data->phase2_type.vendor,
1095                                 data->phase2_type.method);
1096                         if (data->phase2_method) {
1097                                 if (data->key_block_p) {
1098                                         sm->auth_challenge =
1099                                                 data->key_block_p->
1100                                                 server_challenge;
1101                                         sm->peer_challenge =
1102                                                 data->key_block_p->
1103                                                 client_challenge;
1104                                 }
1105                                 sm->init_phase2 = 1;
1106                                 sm->mschapv2_full_key = 1;
1107                                 data->phase2_priv =
1108                                         data->phase2_method->init(sm);
1109                                 sm->init_phase2 = 0;
1110                                 sm->mschapv2_full_key = 0;
1111                                 sm->auth_challenge = NULL;
1112                                 sm->peer_challenge = NULL;
1113                         }
1114                 }
1115                 if (data->phase2_priv == NULL || data->phase2_method == NULL) {
1116                         wpa_printf(MSG_INFO, "EAP-FAST: failed to initialize "
1117                                    "Phase 2 EAP method %d", *pos);
1118                         ret->methodState = METHOD_DONE;
1119                         ret->decision = DECISION_FAIL;
1120                         return -1;
1121                 }
1122                 os_memset(&iret, 0, sizeof(iret));
1123                 *resp = data->phase2_method->process(sm, data->phase2_priv,
1124                                                      &iret, (u8 *) hdr, len,
1125                                                      resp_len);
1126                 if (*resp == NULL ||
1127                     (iret.methodState == METHOD_DONE &&
1128                      iret.decision == DECISION_FAIL)) {
1129                         ret->methodState = METHOD_DONE;
1130                         ret->decision = DECISION_FAIL;
1131                 } else if ((iret.methodState == METHOD_DONE ||
1132                             iret.methodState == METHOD_MAY_CONT) &&
1133                            (iret.decision == DECISION_UNCOND_SUCC ||
1134                             iret.decision == DECISION_COND_SUCC)) {
1135                         data->phase2_success = 1;
1136                 }
1137                 if (*resp == NULL)
1138                         return -1;
1139                 break;
1140         }
1141         return 0;
1142 }
1143
1144
1145 static u8 * eap_fast_tlv_nak(int vendor_id, int tlv_type, size_t *len)
1146 {
1147         struct eap_tlv_nak_tlv *nak;
1148         *len = sizeof(*nak);
1149         nak = os_malloc(*len);
1150         if (nak == NULL)
1151                 return NULL;
1152         nak->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY | EAP_TLV_NAK_TLV);
1153         nak->length = host_to_be16(6);
1154         nak->vendor_id = host_to_be32(vendor_id);
1155         nak->nak_type = host_to_be16(tlv_type);
1156         return (u8 *) nak;
1157 }
1158
1159
1160 static u8 * eap_fast_tlv_result(int status, int intermediate, size_t *len)
1161 {
1162         struct eap_tlv_intermediate_result_tlv *result;
1163         *len = sizeof(*result);
1164         result = os_malloc(*len);
1165         if (result == NULL)
1166                 return NULL;
1167         result->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
1168                                         (intermediate ?
1169                                          EAP_TLV_INTERMEDIATE_RESULT_TLV :
1170                                          EAP_TLV_RESULT_TLV));
1171         result->length = host_to_be16(2);
1172         result->status = host_to_be16(status);
1173         return (u8 *) result;
1174 }
1175
1176
1177 static u8 * eap_fast_tlv_pac_ack(size_t *len)
1178 {
1179         struct eap_tlv_result_tlv *res;
1180         struct eap_tlv_pac_ack_tlv *ack;
1181
1182         *len = sizeof(*res) + sizeof(*ack);
1183         res = os_zalloc(*len);
1184         if (res == NULL)
1185                 return NULL;
1186
1187         res->tlv_type = host_to_be16(EAP_TLV_RESULT_TLV |
1188                                      EAP_TLV_TYPE_MANDATORY);
1189         res->length = host_to_be16(sizeof(*res) - sizeof(struct eap_tlv_hdr));
1190         res->status = host_to_be16(EAP_TLV_RESULT_SUCCESS);
1191
1192         ack = (struct eap_tlv_pac_ack_tlv *) (res + 1);
1193         ack->tlv_type = host_to_be16(EAP_TLV_PAC_TLV |
1194                                      EAP_TLV_TYPE_MANDATORY);
1195         ack->length = host_to_be16(sizeof(*ack) - sizeof(struct eap_tlv_hdr));
1196         ack->pac_type = host_to_be16(PAC_TYPE_PAC_ACKNOWLEDGEMENT);
1197         ack->pac_len = host_to_be16(2);
1198         ack->result = host_to_be16(EAP_TLV_RESULT_SUCCESS);
1199
1200         return (u8 *) res;
1201 }
1202
1203
1204 static u8 * eap_fast_tlv_eap_payload(u8 *buf, size_t *len)
1205 {
1206         struct eap_tlv_hdr *tlv;
1207
1208         /* Encapsulate EAP packet in EAP Payload TLV */
1209         tlv = os_malloc(sizeof(*tlv) + *len);
1210         if (tlv == NULL) {
1211                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to "
1212                            "allocate memory for TLV "
1213                            "encapsulation");
1214                 os_free(buf);
1215                 return NULL;
1216         }
1217         tlv->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
1218                                      EAP_TLV_EAP_PAYLOAD_TLV);
1219         tlv->length = host_to_be16(*len);
1220         os_memcpy(tlv + 1, buf, *len);
1221         os_free(buf);
1222         *len += sizeof(*tlv);
1223         return (u8 *) tlv;
1224 }
1225
1226
1227 static u8 * eap_fast_process_crypto_binding(
1228         struct eap_sm *sm, struct eap_fast_data *data,
1229         struct eap_method_ret *ret,
1230         struct eap_tlv_crypto_binding__tlv *_bind, size_t bind_len,
1231         size_t *resp_len, int final)
1232 {
1233         u8 *resp;
1234         struct eap_tlv_intermediate_result_tlv *rresult;
1235         struct eap_tlv_crypto_binding__tlv *rbind;
1236         u8 isk[32], imck[60], *cmk, cmac[20], *key;
1237         size_t key_len;
1238         int res;
1239
1240         wpa_printf(MSG_DEBUG, "EAP-FAST: Crypto-Binding TLV: Version %d "
1241                    "Received Version %d SubType %d",
1242                    _bind->version, _bind->received_version, _bind->subtype);
1243         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: NONCE",
1244                     _bind->nonce, sizeof(_bind->nonce));
1245         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Compound MAC",
1246                     _bind->compound_mac, sizeof(_bind->compound_mac));
1247
1248         if (_bind->version != EAP_FAST_VERSION ||
1249             _bind->received_version != EAP_FAST_VERSION ||
1250             _bind->subtype != EAP_TLV_CRYPTO_BINDING_SUBTYPE_REQUEST) {
1251                 wpa_printf(MSG_INFO, "EAP-FAST: Invalid version/subtype in "
1252                            "Crypto-Binding TLV: Version %d "
1253                            "Received Version %d SubType %d",
1254                            _bind->version, _bind->received_version,
1255                            _bind->subtype);
1256                 resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 1,
1257                                            resp_len);
1258                 return resp;
1259         }
1260
1261         wpa_printf(MSG_DEBUG, "EAP-FAST: Determining CMK[%d] for Compound MIC "
1262                    "calculation", data->simck_idx + 1);
1263
1264         /*
1265          * draft-cam-winget-eap-fast-05.txt, 5.2:
1266          * IMCK[j] = T-PRF(S-IMCK[j-1], "Inner Methods Compound Keys",
1267          *                 MSK[j], 60)
1268          * S-IMCK[j] = first 40 octets of IMCK[j]
1269          * CMK[j] = last 20 octets of IMCK[j]
1270          */
1271
1272         os_memset(isk, 0, sizeof(isk));
1273         if (data->phase2_method == NULL || data->phase2_priv == NULL) {
1274                 wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 method not "
1275                            "available");
1276                 return NULL;
1277         }
1278         if (data->phase2_method->isKeyAvailable && data->phase2_method->getKey)
1279         {
1280                 if (!data->phase2_method->isKeyAvailable(sm, data->phase2_priv)
1281                     ||
1282                     (key = data->phase2_method->getKey(sm, data->phase2_priv,
1283                                                        &key_len)) == NULL) {
1284                         wpa_printf(MSG_DEBUG, "EAP-FAST: Could not get key "
1285                                    "material from Phase 2");
1286                         return NULL;
1287                 }
1288                 if (key_len > sizeof(isk))
1289                         key_len = sizeof(isk);
1290                 os_memcpy(isk, key, key_len);
1291                 os_free(key);
1292         }
1293         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: ISK[j]", isk, sizeof(isk));
1294         sha1_t_prf(data->simck, EAP_FAST_SIMCK_LEN,
1295                    "Inner Methods Compound Keys",
1296                    isk, sizeof(isk), imck, sizeof(imck));
1297         data->simck_idx++;
1298         os_memcpy(data->simck, imck, EAP_FAST_SIMCK_LEN);
1299         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: S-IMCK[j]",
1300                         data->simck, EAP_FAST_SIMCK_LEN);
1301         cmk = imck + EAP_FAST_SIMCK_LEN;
1302         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: CMK[j]", cmk, 20);
1303
1304         os_memcpy(cmac, _bind->compound_mac, sizeof(cmac));
1305         os_memset(_bind->compound_mac, 0, sizeof(cmac));
1306         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Crypto-Binding TLV for Compound "
1307                     "MAC calculation", (u8 *) _bind, bind_len);
1308         hmac_sha1(cmk, 20, (u8 *) _bind, bind_len, _bind->compound_mac);
1309         res = os_memcmp(cmac, _bind->compound_mac, sizeof(cmac));
1310         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Received Compound MAC",
1311                     cmac, sizeof(cmac));
1312         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Calculated Compound MAC",
1313                     _bind->compound_mac, sizeof(cmac));
1314         if (res != 0) {
1315                 wpa_printf(MSG_INFO, "EAP-FAST: Compound MAC did not match");
1316                 resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 1,
1317                                            resp_len);
1318                 os_memcpy(_bind->compound_mac, cmac, sizeof(cmac));
1319                 return resp;
1320         }
1321
1322         *resp_len = sizeof(*rresult) + sizeof(*rbind);
1323         resp = os_zalloc(*resp_len);
1324         if (resp == NULL)
1325                 return NULL;
1326
1327         /* Both intermediate and final Result TLVs are identical, so ok to use
1328          * the same structure definition for them. */
1329         rresult = (struct eap_tlv_intermediate_result_tlv *) resp;
1330         rresult->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
1331                                          (final ? EAP_TLV_RESULT_TLV :
1332                                           EAP_TLV_INTERMEDIATE_RESULT_TLV));
1333         rresult->length = host_to_be16(2);
1334         rresult->status = host_to_be16(EAP_TLV_RESULT_SUCCESS);
1335
1336         if (!data->provisioning && data->phase2_success &&
1337             eap_fast_derive_msk(data) < 0) {
1338                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to generate MSK");
1339                 ret->methodState = METHOD_DONE;
1340                 ret->decision = DECISION_FAIL;
1341                 rresult->status = host_to_be16(EAP_TLV_RESULT_FAILURE);
1342                 data->phase2_success = 0;
1343         }
1344
1345         rbind = (struct eap_tlv_crypto_binding__tlv *) (rresult + 1);
1346         rbind->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
1347                                        EAP_TLV_CRYPTO_BINDING_TLV_);
1348         rbind->length = host_to_be16(sizeof(*rbind) -
1349                                      sizeof(struct eap_tlv_hdr));
1350         rbind->version = EAP_FAST_VERSION;
1351         rbind->received_version = _bind->version;
1352         rbind->subtype = EAP_TLV_CRYPTO_BINDING_SUBTYPE_RESPONSE;
1353         os_memcpy(rbind->nonce, _bind->nonce, sizeof(_bind->nonce));
1354         inc_byte_array(rbind->nonce, sizeof(rbind->nonce));
1355         hmac_sha1(cmk, 20, (u8 *) rbind, sizeof(*rbind), rbind->compound_mac);
1356
1357         wpa_printf(MSG_DEBUG, "EAP-FAST: Reply Crypto-Binding TLV: Version %d "
1358                    "Received Version %d SubType %d",
1359                    rbind->version, rbind->received_version, rbind->subtype);
1360         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: NONCE",
1361                     rbind->nonce, sizeof(rbind->nonce));
1362         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Compound MAC",
1363                     rbind->compound_mac, sizeof(rbind->compound_mac));
1364
1365         if (final && data->phase2_success) {
1366                 wpa_printf(MSG_DEBUG, "EAP-FAST: Authentication completed "
1367                            "successfully.");
1368                 ret->methodState = METHOD_DONE;
1369                 ret->decision = DECISION_UNCOND_SUCC;
1370         }
1371
1372         return resp;
1373 }
1374
1375
1376 static u8 * eap_fast_process_pac(struct eap_sm *sm, struct eap_fast_data *data,
1377                                  struct eap_method_ret *ret,
1378                                  u8 *pac, size_t pac_len, size_t *resp_len)
1379 {
1380         struct wpa_ssid *config = eap_get_config(sm);
1381         struct pac_tlv_hdr *hdr;
1382         u8 *pos;
1383         size_t left, len;
1384         int type, pac_key_found = 0;
1385         struct eap_fast_pac entry;
1386
1387         os_memset(&entry, 0, sizeof(entry));
1388         pos = pac;
1389         left = pac_len;
1390         while (left > sizeof(*hdr)) {
1391                 hdr = (struct pac_tlv_hdr *) pos;
1392                 type = be_to_host16(hdr->type);
1393                 len = be_to_host16(hdr->len);
1394                 pos += sizeof(*hdr);
1395                 left -= sizeof(*hdr);
1396                 if (len > left) {
1397                         wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV overrun "
1398                                    "(type=%d len=%lu left=%lu)",
1399                                    type, (unsigned long) len,
1400                                    (unsigned long) left);
1401                         return eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0,
1402                                                    resp_len);
1403                 }
1404                 switch (type) {
1405                 case PAC_TYPE_PAC_KEY:
1406                         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: PAC-Key",
1407                                         pos, len);
1408                         if (len != EAP_FAST_PAC_KEY_LEN) {
1409                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Invalid "
1410                                            "PAC-Key length %lu",
1411                                            (unsigned long) len);
1412                                 break;
1413                         }
1414                         pac_key_found = 1;
1415                         os_memcpy(entry.pac_key, pos, len);
1416                         break;
1417                 case PAC_TYPE_PAC_OPAQUE:
1418                         wpa_hexdump(MSG_DEBUG, "EAP-FAST: PAC-Opaque",
1419                                         pos, len);
1420                         entry.pac_opaque = pos;
1421                         entry.pac_opaque_len = len;
1422                         break;
1423                 case PAC_TYPE_PAC_INFO:
1424                         wpa_hexdump(MSG_DEBUG, "EAP-FAST: PAC-Info",
1425                                     pos, len);
1426                         entry.pac_info = pos;
1427                         entry.pac_info_len = len;
1428                         break;
1429                 default:
1430                         wpa_printf(MSG_DEBUG, "EAP-FAST: Ignored unknown PAC "
1431                                    "type %d", type);
1432                         break;
1433                 }
1434
1435                 pos += len;
1436                 left -= len;
1437         }
1438
1439         if (!pac_key_found || !entry.pac_opaque || !entry.pac_info) {
1440                 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV does not include "
1441                            "all the required fields");
1442                 return eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0,
1443                                            resp_len);
1444         }
1445
1446         pos = entry.pac_info;
1447         left = entry.pac_info_len;
1448         while (left > sizeof(*hdr)) {
1449                 hdr = (struct pac_tlv_hdr *) pos;
1450                 type = be_to_host16(hdr->type);
1451                 len = be_to_host16(hdr->len);
1452                 pos += sizeof(*hdr);
1453                 left -= sizeof(*hdr);
1454                 if (len > left) {
1455                         wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info overrun "
1456                                    "(type=%d len=%lu left=%lu)",
1457                                    type, (unsigned long) len,
1458                                    (unsigned long) left);
1459                         return eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0,
1460                                                    resp_len);
1461                 }
1462                 switch (type) {
1463                 case PAC_TYPE_A_ID:
1464                         wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: PAC-Info - "
1465                                           "A-ID", pos, len);
1466                         entry.a_id = pos;
1467                         entry.a_id_len = len;
1468                         break;
1469                 case PAC_TYPE_I_ID:
1470                         wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: PAC-Info - "
1471                                           "I-ID", pos, len);
1472                         entry.i_id = pos;
1473                         entry.i_id_len = len;
1474                         break;
1475                 case PAC_TYPE_A_ID_INFO:
1476                         wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: PAC-Info - "
1477                                           "A-ID-Info", pos, len);
1478                         entry.a_id_info = pos;
1479                         entry.a_id_info_len = len;
1480                         break;
1481                 default:
1482                         wpa_printf(MSG_DEBUG, "EAP-FAST: Ignored unknown "
1483                                    "PAC-Info type %d", type);
1484                         break;
1485                 }
1486
1487                 pos += len;
1488                 left -= len;
1489         }
1490
1491         if (entry.a_id == NULL || entry.a_id_info == NULL) {
1492                 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info does not include "
1493                            "all the required fields");
1494                 return eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0,
1495                                            resp_len);
1496         }
1497
1498         eap_fast_add_pac(data, &entry);
1499         eap_fast_save_pac(sm, data, config->pac_file);
1500
1501         if (data->provisioning) {
1502                 /* EAP-FAST provisioning does not provide keying material and
1503                  * must end with an EAP-Failure. Authentication will be done
1504                  * separately after this. */
1505                 data->success = 0;
1506                 ret->decision = DECISION_FAIL;
1507                 wpa_printf(MSG_DEBUG, "EAP-FAST: Send PAC-Acknowledgement TLV "
1508                            "- Provisioning completed successfully");
1509         } else {
1510                 /* This is PAC refreshing, i.e., normal authentication that is
1511                  * expected to be completed with an EAP-Success. */
1512                 wpa_printf(MSG_DEBUG, "EAP-FAST: Send PAC-Acknowledgement TLV "
1513                            "- PAC refreshing completed successfully");
1514                 ret->decision = DECISION_UNCOND_SUCC;
1515         }
1516         ret->methodState = METHOD_DONE;
1517         return eap_fast_tlv_pac_ack(resp_len);
1518 }
1519
1520
1521 static int eap_fast_decrypt(struct eap_sm *sm, struct eap_fast_data *data,
1522                             struct eap_method_ret *ret,
1523                             const struct eap_hdr *req,
1524                             const u8 *in_data, size_t in_len,
1525                             u8 **out_data, size_t *out_len)
1526 {
1527         u8 *in_decrypted, *pos, *end;
1528         int len_decrypted, len;
1529         struct eap_hdr *hdr;
1530         u8 *resp = NULL;
1531         size_t buf_len, resp_len;
1532         int mandatory, tlv_type;
1533         u8 *eap_payload_tlv = NULL, *pac = NULL;
1534         size_t eap_payload_tlv_len = 0, pac_len = 0;
1535         int iresult = 0, result = 0;
1536         struct eap_tlv_crypto_binding__tlv *crypto_binding = NULL;
1537         size_t crypto_binding_len = 0;
1538         const u8 *msg;
1539         size_t msg_len;
1540         int need_more_input, stop;
1541
1542         wpa_printf(MSG_DEBUG, "EAP-FAST: received %lu bytes encrypted data for"
1543                    " Phase 2", (unsigned long) in_len);
1544
1545         msg = eap_tls_data_reassemble(sm, &data->ssl, in_data, in_len,
1546                                       &msg_len, &need_more_input);
1547         if (msg == NULL)
1548                 return need_more_input ? 1 : -1;
1549
1550         buf_len = in_len;
1551         if (data->ssl.tls_in_total > buf_len)
1552                 buf_len = data->ssl.tls_in_total;
1553         in_decrypted = os_malloc(buf_len);
1554         if (in_decrypted == NULL) {
1555                 os_free(data->ssl.tls_in);
1556                 data->ssl.tls_in = NULL;
1557                 data->ssl.tls_in_len = 0;
1558                 wpa_printf(MSG_WARNING, "EAP-FAST: failed to allocate memory "
1559                            "for decryption");
1560                 return -1;
1561         }
1562
1563         len_decrypted = tls_connection_decrypt(sm->ssl_ctx, data->ssl.conn,
1564                                                msg, msg_len,
1565                                                in_decrypted, buf_len);
1566         os_free(data->ssl.tls_in);
1567         data->ssl.tls_in = NULL;
1568         data->ssl.tls_in_len = 0;
1569         if (len_decrypted < 0) {
1570                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to decrypt Phase 2 "
1571                            "data");
1572                 os_free(in_decrypted);
1573                 return -1;
1574         }
1575
1576         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Decrypted Phase 2 TLV(s)",
1577                     in_decrypted, len_decrypted);
1578
1579         if (len_decrypted < 4) {
1580                 os_free(in_decrypted);
1581                 wpa_printf(MSG_INFO, "EAP-FAST: Too short Phase 2 "
1582                            "TLV frame (len=%d)", len_decrypted);
1583                 return -1;
1584         }
1585
1586         pos = in_decrypted;
1587         end = in_decrypted + len_decrypted;
1588         stop = 0;
1589         while (pos + 4 < end && !stop) {
1590                 mandatory = pos[0] & 0x80;
1591                 tlv_type = WPA_GET_BE16(pos) & 0x3fff;
1592                 pos += 2;
1593                 len = WPA_GET_BE16(pos);
1594                 pos += 2;
1595                 if (pos + len > end) {
1596                         os_free(in_decrypted);
1597                         wpa_printf(MSG_INFO, "EAP-FAST: TLV overflow");
1598                         return 0;
1599                 }
1600                 wpa_printf(MSG_DEBUG, "EAP-FAST: received Phase 2: "
1601                            "TLV type %d length %d%s",
1602                            tlv_type, len, mandatory ? " (mandatory)" : "");
1603
1604                 switch (tlv_type) {
1605                 case EAP_TLV_EAP_PAYLOAD_TLV:
1606                         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: EAP Payload TLV",
1607                                     pos, len);
1608                         eap_payload_tlv = pos;
1609                         eap_payload_tlv_len = len;
1610                         break;
1611                 case EAP_TLV_RESULT_TLV:
1612                         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Result TLV",
1613                                     pos, len);
1614                         if (len < 2) {
1615                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
1616                                            "Result TLV");
1617                                 result = EAP_TLV_RESULT_FAILURE;
1618                                 break;
1619                         }
1620                         result = WPA_GET_BE16(pos);
1621                         if (result != EAP_TLV_RESULT_SUCCESS &&
1622                             result != EAP_TLV_RESULT_FAILURE) {
1623                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Unknown "
1624                                            "Result %d", result);
1625                                 result = EAP_TLV_RESULT_FAILURE;
1626                         }
1627                         wpa_printf(MSG_DEBUG, "EAP-FAST: Result: %s",
1628                                    result == EAP_TLV_RESULT_SUCCESS ?
1629                                    "Success" : "Failure");
1630                         break;
1631                 case EAP_TLV_INTERMEDIATE_RESULT_TLV:
1632                         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Intermediate "
1633                                     "Result TLV", pos, len);
1634                         if (len < 2) {
1635                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
1636                                            "Intermediate Result TLV");
1637                                 iresult = EAP_TLV_RESULT_FAILURE;
1638                                 break;
1639                         }
1640                         iresult = WPA_GET_BE16(pos);
1641                         if (iresult != EAP_TLV_RESULT_SUCCESS &&
1642                             iresult != EAP_TLV_RESULT_FAILURE) {
1643                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Unknown "
1644                                            "Intermediate Result %d", iresult);
1645                                 iresult = EAP_TLV_RESULT_FAILURE;
1646                         }
1647                         wpa_printf(MSG_DEBUG,
1648                                    "EAP-FAST: Intermediate Result: %s",
1649                                    iresult == EAP_TLV_RESULT_SUCCESS ?
1650                                    "Success" : "Failure");
1651                         break;
1652                 case EAP_TLV_CRYPTO_BINDING_TLV_:
1653                         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Crypto-Binding "
1654                                     "TLV", pos, len);
1655                         crypto_binding_len = sizeof(struct eap_tlv_hdr) + len;
1656                         if (crypto_binding_len < sizeof(*crypto_binding)) {
1657                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
1658                                            "Crypto-Binding TLV");
1659                                 iresult = EAP_TLV_RESULT_FAILURE;
1660                                 pos = end;
1661                                 break;
1662                         }
1663                         crypto_binding =
1664                                 (struct eap_tlv_crypto_binding__tlv *)
1665                                 (pos - sizeof(struct eap_tlv_hdr));
1666                         break;
1667                 case EAP_TLV_PAC_TLV:
1668                         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: PAC TLV",
1669                                     pos, len);
1670                         pac = pos;
1671                         pac_len = len;
1672                         break;
1673                 default:
1674                         if (mandatory) {
1675                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Nak unknown "
1676                                            "mandatory TLV type %d", tlv_type);
1677                                 resp = eap_fast_tlv_nak(0, tlv_type,
1678                                                         &resp_len);
1679                                 stop = 1;
1680                         } else {
1681                                 wpa_printf(MSG_DEBUG, "EAP-FAST: ignored "
1682                                            "unknown optional TLV type %d",
1683                                            tlv_type);
1684                         }
1685                         break;
1686                 }
1687
1688                 pos += len;
1689         }
1690
1691         if (!resp && result == EAP_TLV_RESULT_FAILURE) {
1692                 resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0,
1693                                            &resp_len);
1694                 if (!resp) {
1695                         os_free(in_decrypted);
1696                         return 0;
1697                 }
1698         }
1699
1700         if (!resp && iresult == EAP_TLV_RESULT_FAILURE) {
1701                 resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 1,
1702                                            &resp_len);
1703                 if (!resp) {
1704                         os_free(in_decrypted);
1705                         return 0;
1706                 }
1707         }
1708
1709         if (!resp && eap_payload_tlv) {
1710                 if (eap_payload_tlv_len < sizeof(*hdr)) {
1711                         wpa_printf(MSG_DEBUG, "EAP-FAST: too short EAP "
1712                                    "Payload TLV (len=%lu)",
1713                                    (unsigned long) eap_payload_tlv_len);
1714                         os_free(in_decrypted);
1715                         return 0;
1716                 }
1717                 hdr = (struct eap_hdr *) eap_payload_tlv;
1718                 if (be_to_host16(hdr->length) > eap_payload_tlv_len) {
1719                         wpa_printf(MSG_DEBUG, "EAP-FAST: EAP packet overflow "
1720                                    "in EAP Payload TLV");
1721                         os_free(in_decrypted);
1722                         return 0;
1723                 }
1724                 if (hdr->code == EAP_CODE_REQUEST) {
1725                         if (eap_fast_phase2_request(sm, data, ret, hdr,
1726                                                     &resp, &resp_len)) {
1727                                 os_free(in_decrypted);
1728                                 wpa_printf(MSG_INFO, "EAP-FAST: Phase2 "
1729                                            "Request processing failed");
1730                                 return 0;
1731                         }
1732                         resp = eap_fast_tlv_eap_payload(resp, &resp_len);
1733                         if (resp == NULL) {
1734                                 os_free(in_decrypted);
1735                                 return 0;
1736                         }
1737                 } else {
1738                         wpa_printf(MSG_INFO, "EAP-FAST: Unexpected code=%d in "
1739                                    "Phase 2 EAP header", hdr->code);
1740                         os_free(in_decrypted);
1741                         return 0;
1742                 }
1743         }
1744
1745         if (!resp && crypto_binding) {
1746                 int final = result == EAP_TLV_RESULT_SUCCESS;
1747                 resp = eap_fast_process_crypto_binding(sm, data, ret,
1748                                                        crypto_binding,
1749                                                        crypto_binding_len,
1750                                                        &resp_len, final);
1751                 if (!resp) {
1752                         os_free(in_decrypted);
1753                         return 0;
1754                 }
1755         }
1756
1757         if (!resp && pac && result != EAP_TLV_RESULT_SUCCESS) {
1758                 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV without Result TLV "
1759                            "acknowledging success");
1760                 resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0,
1761                                            &resp_len);
1762                 if (!resp) {
1763                         os_free(in_decrypted);
1764                         return 0;
1765                 }
1766         }
1767
1768         if (!resp && pac && result == EAP_TLV_RESULT_SUCCESS) {
1769                 resp = eap_fast_process_pac(sm, data, ret, pac, pac_len,
1770                                             &resp_len);
1771                 if (!resp) {
1772                         os_free(in_decrypted);
1773                         return 0;
1774                 }
1775         }
1776
1777         os_free(in_decrypted);
1778
1779         if (resp == NULL) {
1780                 wpa_printf(MSG_DEBUG, "EAP-FAST: No recognized TLVs - send "
1781                            "empty response packet");
1782                 resp = os_malloc(1);
1783                 if (resp == NULL)
1784                         return 0;
1785                 resp_len = 0;
1786         }
1787
1788         wpa_hexdump(MSG_DEBUG, "EAP-FAST: Encrypting Phase 2 data",
1789                     resp, resp_len);
1790         if (eap_fast_encrypt(sm, data, req->identifier, resp, resp_len,
1791                              out_data, out_len)) {
1792                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to encrypt a Phase 2 "
1793                            "frame");
1794         }
1795         os_free(resp);
1796
1797         return 0;
1798 }
1799
1800
1801 static u8 * eap_fast_process(struct eap_sm *sm, void *priv,
1802                              struct eap_method_ret *ret,
1803                              const u8 *reqData, size_t reqDataLen,
1804                              size_t *respDataLen)
1805 {
1806         const struct eap_hdr *req;
1807         size_t left;
1808         int res;
1809         u8 flags, *resp, id;
1810         const u8 *pos;
1811         struct eap_fast_data *data = priv;
1812
1813         pos = eap_tls_process_init(sm, &data->ssl, EAP_TYPE_FAST, ret,
1814                                    reqData, reqDataLen, &left, &flags);
1815         if (pos == NULL)
1816                 return NULL;
1817         req = (const struct eap_hdr *) reqData;
1818         id = req->identifier;
1819
1820         if (flags & EAP_TLS_FLAGS_START) {
1821                 const u8 *a_id;
1822                 size_t a_id_len;
1823                 struct pac_tlv_hdr *hdr;
1824
1825                 wpa_printf(MSG_DEBUG, "EAP-FAST: Start (server ver=%d, own "
1826                            "ver=%d)", flags & EAP_PEAP_VERSION_MASK,
1827                         data->fast_version);
1828                 if ((flags & EAP_PEAP_VERSION_MASK) < data->fast_version)
1829                         data->fast_version = flags & EAP_PEAP_VERSION_MASK;
1830                 wpa_printf(MSG_DEBUG, "EAP-FAST: Using FAST version %d",
1831                            data->fast_version);
1832
1833                 a_id = pos;
1834                 a_id_len = left;
1835                 if (left > sizeof(*hdr)) {
1836                         int tlen;
1837                         hdr = (struct pac_tlv_hdr *) pos;
1838                         tlen = be_to_host16(hdr->len);
1839                         if (be_to_host16(hdr->type) == PAC_TYPE_A_ID &&
1840                             sizeof(*hdr) + tlen <= left) {
1841                                 a_id = (u8 *) (hdr + 1);
1842                                 a_id_len = tlen;
1843                         }
1844                 }
1845                 wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: A-ID", a_id, a_id_len);
1846
1847                 data->current_pac = eap_fast_get_pac(data, a_id, a_id_len);
1848                 if (data->current_pac) {
1849                         wpa_printf(MSG_DEBUG, "EAP-FAST: PAC found for this "
1850                                    "A-ID");
1851                         wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-FAST: A-ID-Info",
1852                                           data->current_pac->a_id_info,
1853                                           data->current_pac->a_id_info_len);
1854                 }
1855
1856                 if (data->resuming && data->current_pac) {
1857                         wpa_printf(MSG_DEBUG, "EAP-FAST: Trying to resume "
1858                                    "session - do not add PAC-Opaque to TLS "
1859                                    "ClientHello");
1860                         if (tls_connection_client_hello_ext(
1861                                     sm->ssl_ctx, data->ssl.conn,
1862                                     TLS_EXT_PAC_OPAQUE, NULL, 0) < 0) {
1863                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to "
1864                                            "remove PAC-Opaque TLS extension");
1865                                 return NULL;
1866                         }
1867
1868                 } else if (data->current_pac) {
1869                         u8 *tlv;
1870                         size_t tlv_len, olen;
1871                         struct eap_tlv_hdr *ehdr;
1872                         olen = data->current_pac->pac_opaque_len;
1873                         tlv_len = sizeof(*ehdr) + olen;
1874                         tlv = os_malloc(tlv_len);
1875                         if (tlv) {
1876                                 ehdr = (struct eap_tlv_hdr *) tlv;
1877                                 ehdr->tlv_type =
1878                                         host_to_be16(PAC_TYPE_PAC_OPAQUE);
1879                                 ehdr->length = host_to_be16(olen);
1880                                 os_memcpy(ehdr + 1,
1881                                           data->current_pac->pac_opaque, olen);
1882                         }
1883                         if (tlv == NULL ||
1884                             tls_connection_client_hello_ext(
1885                                     sm->ssl_ctx, data->ssl.conn,
1886                                     TLS_EXT_PAC_OPAQUE, tlv, tlv_len) < 0) {
1887                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to "
1888                                            "add PAC-Opaque TLS extension");
1889                                 os_free(tlv);
1890                                 return NULL;
1891                         }
1892                         os_free(tlv);
1893                 } else {
1894                         u8 ciphers[2];
1895                         if (!data->provisioning_allowed) {
1896                                 wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC found "
1897                                            "and provisioning disabled");
1898                                 return NULL;
1899                         }
1900                         wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC found - "
1901                                    "starting provisioning");
1902                         ciphers[0] = TLS_CIPHER_ANON_DH_AES128_SHA;
1903                         ciphers[1] = TLS_CIPHER_NONE;
1904                         if (tls_connection_set_cipher_list(sm->ssl_ctx,
1905                                                            data->ssl.conn,
1906                                                            ciphers)) {
1907                                 wpa_printf(MSG_INFO, "EAP-FAST: Could not "
1908                                            "configure anonymous DH for TLS "
1909                                            "connection");
1910                                 return NULL;
1911                         }
1912                         if (tls_connection_client_hello_ext(
1913                                     sm->ssl_ctx, data->ssl.conn,
1914                                     TLS_EXT_PAC_OPAQUE, NULL, 0) < 0) {
1915                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to "
1916                                            "remove PAC-Opaque TLS extension");
1917                                 return NULL;
1918                         }
1919                         data->provisioning = 1;
1920                 }
1921
1922                 left = 0; /* A-ID is not used in further packet processing */
1923         }
1924
1925         resp = NULL;
1926         if (tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&
1927             !data->resuming) {
1928                 res = eap_fast_decrypt(sm, data, ret, req, pos, left,
1929                                        &resp, respDataLen);
1930                 if (res < 0) {
1931                         ret->methodState = METHOD_DONE;
1932                         ret->decision = DECISION_FAIL;
1933                         /* Ack possible Alert that may have caused failure in
1934                          * decryption */
1935                         res = 1;
1936                 }
1937         } else {
1938                 if (eap_fast_set_tls_master_secret(sm, data, pos, left) < 0) {
1939                         wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to configure "
1940                                    "TLS master secret");
1941                         ret->methodState = METHOD_DONE;
1942                         ret->decision = DECISION_FAIL;
1943                         return NULL;
1944                 }
1945
1946                 res = eap_tls_process_helper(sm, &data->ssl, EAP_TYPE_FAST,
1947                                              data->fast_version, id, pos, left,
1948                                              &resp, respDataLen);
1949
1950                 if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) {
1951                         wpa_printf(MSG_DEBUG,
1952                                    "EAP-FAST: TLS done, proceed to Phase 2");
1953                         data->resuming = 0;
1954                         eap_fast_derive_keys(sm, data);
1955                 }
1956         }
1957
1958         if (res == 1)
1959                 return eap_tls_build_ack(&data->ssl, respDataLen, id,
1960                                          EAP_TYPE_FAST, data->fast_version);
1961         return resp;
1962 }
1963
1964
1965 #if 0 /* FIX */
1966 static Boolean eap_fast_has_reauth_data(struct eap_sm *sm, void *priv)
1967 {
1968         struct eap_fast_data *data = priv;
1969         return tls_connection_established(sm->ssl_ctx, data->ssl.conn);
1970 }
1971
1972
1973 static void eap_fast_deinit_for_reauth(struct eap_sm *sm, void *priv)
1974 {
1975         struct eap_fast_data *data = priv;
1976         os_free(data->key_block_p);
1977         data->key_block_p = NULL;
1978 }
1979
1980
1981 static void * eap_fast_init_for_reauth(struct eap_sm *sm, void *priv)
1982 {
1983         struct eap_fast_data *data = priv;
1984         if (eap_tls_reauth_init(sm, &data->ssl)) {
1985                 os_free(data);
1986                 return NULL;
1987         }
1988         if (data->phase2_priv && data->phase2_method &&
1989             data->phase2_method->init_for_reauth)
1990                 data->phase2_method->init_for_reauth(sm, data->phase2_priv);
1991         data->phase2_success = 0;
1992         data->resuming = 1;
1993         data->provisioning = 0;
1994         data->simck_idx = 0;
1995         return priv;
1996 }
1997 #endif
1998
1999
2000 static int eap_fast_get_status(struct eap_sm *sm, void *priv, char *buf,
2001                                size_t buflen, int verbose)
2002 {
2003         struct eap_fast_data *data = priv;
2004         int len, ret;
2005
2006         len = eap_tls_status(sm, &data->ssl, buf, buflen, verbose);
2007         if (data->phase2_method) {
2008                 ret = os_snprintf(buf + len, buflen - len,
2009                                   "EAP-FAST Phase2 method=%s\n",
2010                                   data->phase2_method->name);
2011                 if (ret < 0 || (size_t) ret >= buflen - len)
2012                         return len;
2013                 len += ret;
2014         }
2015         return len;
2016 }
2017
2018
2019 static Boolean eap_fast_isKeyAvailable(struct eap_sm *sm, void *priv)
2020 {
2021         struct eap_fast_data *data = priv;
2022         return data->success;
2023 }
2024
2025
2026 static u8 * eap_fast_getKey(struct eap_sm *sm, void *priv, size_t *len)
2027 {
2028         struct eap_fast_data *data = priv;
2029         u8 *key;
2030
2031         if (!data->success)
2032                 return NULL;
2033
2034         key = os_malloc(EAP_FAST_KEY_LEN);
2035         if (key == NULL)
2036                 return NULL;
2037
2038         *len = EAP_FAST_KEY_LEN;
2039         os_memcpy(key, data->key_data, EAP_FAST_KEY_LEN);
2040
2041         return key;
2042 }
2043
2044
2045 static u8 * eap_fast_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
2046 {
2047         struct eap_fast_data *data = priv;
2048         u8 *key;
2049
2050         if (!data->success)
2051                 return NULL;
2052
2053         key = os_malloc(EAP_EMSK_LEN);
2054         if (key == NULL)
2055                 return NULL;
2056
2057         *len = EAP_EMSK_LEN;
2058         os_memcpy(key, data->emsk, EAP_EMSK_LEN);
2059
2060         return key;
2061 }
2062
2063
2064 int eap_peer_fast_register(void)
2065 {
2066         struct eap_method *eap;
2067         int ret;
2068
2069         eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
2070                                     EAP_VENDOR_IETF, EAP_TYPE_FAST, "FAST");
2071         if (eap == NULL)
2072                 return -1;
2073
2074         eap->init = eap_fast_init;
2075         eap->deinit = eap_fast_deinit;
2076         eap->process = eap_fast_process;
2077         eap->isKeyAvailable = eap_fast_isKeyAvailable;
2078         eap->getKey = eap_fast_getKey;
2079         eap->get_status = eap_fast_get_status;
2080 #if 0
2081         eap->has_reauth_data = eap_fast_has_reauth_data;
2082         eap->deinit_for_reauth = eap_fast_deinit_for_reauth;
2083         eap->init_for_reauth = eap_fast_init_for_reauth;
2084 #endif
2085         eap->get_emsk = eap_fast_get_emsk;
2086
2087         ret = eap_peer_method_register(eap);
2088         if (ret)
2089                 eap_peer_method_free(eap);
2090         return ret;
2091 }