]>
Commit | Line | Data |
---|---|---|
6fc6879b JM |
1 | /* |
2 | * EAP-FAST server (RFC 4851) | |
3 | * Copyright (c) 2004-2008, Jouni Malinen <j@w1.fi> | |
4 | * | |
5 | * This program is free software; you can redistribute it and/or modify | |
6 | * it under the terms of the GNU General Public License version 2 as | |
7 | * published by the Free Software Foundation. | |
8 | * | |
9 | * Alternatively, this software may be distributed under the terms of BSD | |
10 | * license. | |
11 | * | |
12 | * See README and COPYING for more details. | |
13 | */ | |
14 | ||
15 | #include "includes.h" | |
16 | ||
17 | #include "common.h" | |
03da66bd JM |
18 | #include "crypto/aes_wrap.h" |
19 | #include "crypto/sha1.h" | |
20 | #include "crypto/tls.h" | |
6fc6879b JM |
21 | #include "eap_common/eap_tlv_common.h" |
22 | #include "eap_common/eap_fast_common.h" | |
03da66bd JM |
23 | #include "eap_i.h" |
24 | #include "eap_tls_common.h" | |
6fc6879b JM |
25 | |
26 | ||
27 | static void eap_fast_reset(struct eap_sm *sm, void *priv); | |
28 | ||
29 | ||
30 | /* Private PAC-Opaque TLV types */ | |
31 | #define PAC_OPAQUE_TYPE_PAD 0 | |
32 | #define PAC_OPAQUE_TYPE_KEY 1 | |
33 | #define PAC_OPAQUE_TYPE_LIFETIME 2 | |
829f14be | 34 | #define PAC_OPAQUE_TYPE_IDENTITY 3 |
6fc6879b | 35 | |
6fc6879b JM |
36 | struct eap_fast_data { |
37 | struct eap_ssl_data ssl; | |
38 | enum { | |
39 | START, PHASE1, PHASE2_START, PHASE2_ID, PHASE2_METHOD, | |
40 | CRYPTO_BINDING, REQUEST_PAC, SUCCESS, FAILURE | |
41 | } state; | |
42 | ||
43 | int fast_version; | |
44 | const struct eap_method *phase2_method; | |
45 | void *phase2_priv; | |
46 | int force_version; | |
47 | int peer_version; | |
48 | ||
49 | u8 crypto_binding_nonce[32]; | |
50 | int final_result; | |
51 | ||
52 | struct eap_fast_key_block_provisioning *key_block_p; | |
53 | ||
54 | u8 simck[EAP_FAST_SIMCK_LEN]; | |
2bab8ae4 | 55 | u8 cmk[EAP_FAST_CMK_LEN]; |
6fc6879b JM |
56 | int simck_idx; |
57 | ||
58 | u8 pac_opaque_encr[16]; | |
2d867244 JM |
59 | u8 *srv_id; |
60 | size_t srv_id_len; | |
61 | char *srv_id_info; | |
6fc6879b JM |
62 | |
63 | int anon_provisioning; | |
64 | int send_new_pac; /* server triggered re-keying of Tunnel PAC */ | |
65 | struct wpabuf *pending_phase2_resp; | |
829f14be JM |
66 | u8 *identity; /* from PAC-Opaque */ |
67 | size_t identity_len; | |
7914585f | 68 | int eap_seq; |
7db0fca5 | 69 | int tnc_started; |
a11c90a6 JM |
70 | |
71 | int pac_key_lifetime; | |
72 | int pac_key_refresh_time; | |
6fc6879b JM |
73 | }; |
74 | ||
75 | ||
c479e41f JM |
76 | static int eap_fast_process_phase2_start(struct eap_sm *sm, |
77 | struct eap_fast_data *data); | |
78 | ||
79 | ||
6fc6879b JM |
80 | static const char * eap_fast_state_txt(int state) |
81 | { | |
82 | switch (state) { | |
83 | case START: | |
84 | return "START"; | |
85 | case PHASE1: | |
86 | return "PHASE1"; | |
87 | case PHASE2_START: | |
88 | return "PHASE2_START"; | |
89 | case PHASE2_ID: | |
90 | return "PHASE2_ID"; | |
91 | case PHASE2_METHOD: | |
92 | return "PHASE2_METHOD"; | |
93 | case CRYPTO_BINDING: | |
94 | return "CRYPTO_BINDING"; | |
95 | case REQUEST_PAC: | |
96 | return "REQUEST_PAC"; | |
97 | case SUCCESS: | |
98 | return "SUCCESS"; | |
99 | case FAILURE: | |
100 | return "FAILURE"; | |
101 | default: | |
102 | return "Unknown?!"; | |
103 | } | |
104 | } | |
105 | ||
106 | ||
107 | static void eap_fast_state(struct eap_fast_data *data, int state) | |
108 | { | |
109 | wpa_printf(MSG_DEBUG, "EAP-FAST: %s -> %s", | |
110 | eap_fast_state_txt(data->state), | |
111 | eap_fast_state_txt(state)); | |
112 | data->state = state; | |
113 | } | |
114 | ||
115 | ||
116 | static EapType eap_fast_req_failure(struct eap_sm *sm, | |
117 | struct eap_fast_data *data) | |
118 | { | |
119 | /* TODO: send Result TLV(FAILURE) */ | |
120 | eap_fast_state(data, FAILURE); | |
121 | return EAP_TYPE_NONE; | |
122 | } | |
123 | ||
124 | ||
125 | static int eap_fast_session_ticket_cb(void *ctx, const u8 *ticket, size_t len, | |
126 | const u8 *client_random, | |
127 | const u8 *server_random, | |
128 | u8 *master_secret) | |
129 | { | |
130 | struct eap_fast_data *data = ctx; | |
6fc6879b JM |
131 | const u8 *pac_opaque; |
132 | size_t pac_opaque_len; | |
133 | u8 *buf, *pos, *end, *pac_key = NULL; | |
134 | os_time_t lifetime = 0; | |
135 | struct os_time now; | |
829f14be JM |
136 | u8 *identity = NULL; |
137 | size_t identity_len = 0; | |
6fc6879b JM |
138 | |
139 | wpa_printf(MSG_DEBUG, "EAP-FAST: SessionTicket callback"); | |
140 | wpa_hexdump(MSG_DEBUG, "EAP-FAST: SessionTicket (PAC-Opaque)", | |
141 | ticket, len); | |
6fc6879b JM |
142 | |
143 | if (len < 4 || WPA_GET_BE16(ticket) != PAC_TYPE_PAC_OPAQUE) { | |
144 | wpa_printf(MSG_DEBUG, "EAP-FAST: Ignore invalid " | |
145 | "SessionTicket"); | |
146 | return 0; | |
147 | } | |
148 | ||
149 | pac_opaque_len = WPA_GET_BE16(ticket + 2); | |
150 | pac_opaque = ticket + 4; | |
151 | if (pac_opaque_len < 8 || pac_opaque_len % 8 || | |
152 | pac_opaque_len > len - 4) { | |
153 | wpa_printf(MSG_DEBUG, "EAP-FAST: Ignore invalid PAC-Opaque " | |
154 | "(len=%lu left=%lu)", | |
155 | (unsigned long) pac_opaque_len, | |
156 | (unsigned long) len); | |
157 | return 0; | |
158 | } | |
159 | wpa_hexdump(MSG_DEBUG, "EAP-FAST: Received PAC-Opaque", | |
160 | pac_opaque, pac_opaque_len); | |
161 | ||
162 | buf = os_malloc(pac_opaque_len - 8); | |
163 | if (buf == NULL) { | |
164 | wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to allocate memory " | |
165 | "for decrypting PAC-Opaque"); | |
166 | return 0; | |
167 | } | |
168 | ||
169 | if (aes_unwrap(data->pac_opaque_encr, (pac_opaque_len - 8) / 8, | |
170 | pac_opaque, buf) < 0) { | |
171 | wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to decrypt " | |
172 | "PAC-Opaque"); | |
173 | os_free(buf); | |
174 | /* | |
175 | * This may have been caused by server changing the PAC-Opaque | |
176 | * encryption key, so just ignore this PAC-Opaque instead of | |
177 | * failing the authentication completely. Provisioning can now | |
178 | * be used to provision a new PAC. | |
179 | */ | |
180 | return 0; | |
181 | } | |
182 | ||
183 | end = buf + pac_opaque_len - 8; | |
184 | wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Decrypted PAC-Opaque", | |
185 | buf, end - buf); | |
186 | ||
187 | pos = buf; | |
188 | while (pos + 1 < end) { | |
189 | if (pos + 2 + pos[1] > end) | |
190 | break; | |
191 | ||
192 | switch (*pos) { | |
193 | case PAC_OPAQUE_TYPE_PAD: | |
194 | pos = end; | |
195 | break; | |
196 | case PAC_OPAQUE_TYPE_KEY: | |
197 | if (pos[1] != EAP_FAST_PAC_KEY_LEN) { | |
198 | wpa_printf(MSG_DEBUG, "EAP-FAST: Invalid " | |
199 | "PAC-Key length %d", pos[1]); | |
200 | os_free(buf); | |
201 | return -1; | |
202 | } | |
203 | pac_key = pos + 2; | |
204 | wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: PAC-Key from " | |
205 | "decrypted PAC-Opaque", | |
206 | pac_key, EAP_FAST_PAC_KEY_LEN); | |
207 | break; | |
208 | case PAC_OPAQUE_TYPE_LIFETIME: | |
209 | if (pos[1] != 4) { | |
210 | wpa_printf(MSG_DEBUG, "EAP-FAST: Invalid " | |
211 | "PAC-Key lifetime length %d", | |
212 | pos[1]); | |
213 | os_free(buf); | |
214 | return -1; | |
215 | } | |
216 | lifetime = WPA_GET_BE32(pos + 2); | |
217 | break; | |
829f14be JM |
218 | case PAC_OPAQUE_TYPE_IDENTITY: |
219 | identity = pos + 2; | |
220 | identity_len = pos[1]; | |
221 | break; | |
6fc6879b JM |
222 | } |
223 | ||
224 | pos += 2 + pos[1]; | |
225 | } | |
226 | ||
227 | if (pac_key == NULL) { | |
228 | wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC-Key included in " | |
229 | "PAC-Opaque"); | |
230 | os_free(buf); | |
231 | return -1; | |
232 | } | |
233 | ||
829f14be JM |
234 | if (identity) { |
235 | wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: Identity from " | |
236 | "PAC-Opaque", identity, identity_len); | |
237 | os_free(data->identity); | |
238 | data->identity = os_malloc(identity_len); | |
239 | if (data->identity) { | |
240 | os_memcpy(data->identity, identity, identity_len); | |
241 | data->identity_len = identity_len; | |
242 | } | |
243 | } | |
244 | ||
6fc6879b JM |
245 | if (os_get_time(&now) < 0 || lifetime <= 0 || now.sec > lifetime) { |
246 | wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Key not valid anymore " | |
247 | "(lifetime=%ld now=%ld)", lifetime, now.sec); | |
36100718 JM |
248 | data->send_new_pac = 2; |
249 | /* | |
250 | * Allow PAC to be used to allow a PAC update with some level | |
251 | * of server authentication (i.e., do not fall back to full TLS | |
252 | * handshake since we cannot be sure that the peer would be | |
253 | * able to validate server certificate now). However, reject | |
254 | * the authentication since the PAC was not valid anymore. Peer | |
255 | * can connect again with the newly provisioned PAC after this. | |
256 | */ | |
257 | } else if (lifetime - now.sec < data->pac_key_refresh_time) { | |
258 | wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Key soft timeout; send " | |
259 | "an update if authentication succeeds"); | |
6fc6879b | 260 | data->send_new_pac = 1; |
36100718 | 261 | } |
6fc6879b | 262 | |
7f4c1d43 JM |
263 | eap_fast_derive_master_secret(pac_key, server_random, client_random, |
264 | master_secret); | |
6fc6879b JM |
265 | |
266 | os_free(buf); | |
267 | ||
268 | return 1; | |
269 | } | |
270 | ||
271 | ||
6fc6879b JM |
272 | static void eap_fast_derive_key_auth(struct eap_sm *sm, |
273 | struct eap_fast_data *data) | |
274 | { | |
275 | u8 *sks; | |
276 | ||
277 | /* RFC 4851, Section 5.1: | |
278 | * Extra key material after TLS key_block: session_key_seed[40] | |
279 | */ | |
280 | ||
7f4c1d43 | 281 | sks = eap_fast_derive_key(sm->ssl_ctx, data->ssl.conn, "key expansion", |
6fc6879b JM |
282 | EAP_FAST_SKS_LEN); |
283 | if (sks == NULL) { | |
284 | wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to derive " | |
285 | "session_key_seed"); | |
286 | return; | |
287 | } | |
288 | ||
289 | /* | |
290 | * RFC 4851, Section 5.2: | |
291 | * S-IMCK[0] = session_key_seed | |
292 | */ | |
293 | wpa_hexdump_key(MSG_DEBUG, | |
294 | "EAP-FAST: session_key_seed (SKS = S-IMCK[0])", | |
295 | sks, EAP_FAST_SKS_LEN); | |
296 | data->simck_idx = 0; | |
297 | os_memcpy(data->simck, sks, EAP_FAST_SIMCK_LEN); | |
298 | os_free(sks); | |
299 | } | |
300 | ||
301 | ||
302 | static void eap_fast_derive_key_provisioning(struct eap_sm *sm, | |
303 | struct eap_fast_data *data) | |
304 | { | |
305 | os_free(data->key_block_p); | |
306 | data->key_block_p = (struct eap_fast_key_block_provisioning *) | |
7f4c1d43 JM |
307 | eap_fast_derive_key(sm->ssl_ctx, data->ssl.conn, |
308 | "key expansion", | |
6fc6879b JM |
309 | sizeof(*data->key_block_p)); |
310 | if (data->key_block_p == NULL) { | |
311 | wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to derive key block"); | |
312 | return; | |
313 | } | |
314 | /* | |
315 | * RFC 4851, Section 5.2: | |
316 | * S-IMCK[0] = session_key_seed | |
317 | */ | |
318 | wpa_hexdump_key(MSG_DEBUG, | |
319 | "EAP-FAST: session_key_seed (SKS = S-IMCK[0])", | |
320 | data->key_block_p->session_key_seed, | |
321 | sizeof(data->key_block_p->session_key_seed)); | |
322 | data->simck_idx = 0; | |
323 | os_memcpy(data->simck, data->key_block_p->session_key_seed, | |
324 | EAP_FAST_SIMCK_LEN); | |
325 | wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: server_challenge", | |
326 | data->key_block_p->server_challenge, | |
327 | sizeof(data->key_block_p->server_challenge)); | |
328 | wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: client_challenge", | |
329 | data->key_block_p->client_challenge, | |
330 | sizeof(data->key_block_p->client_challenge)); | |
331 | } | |
332 | ||
333 | ||
334 | static int eap_fast_get_phase2_key(struct eap_sm *sm, | |
335 | struct eap_fast_data *data, | |
336 | u8 *isk, size_t isk_len) | |
337 | { | |
338 | u8 *key; | |
339 | size_t key_len; | |
340 | ||
341 | os_memset(isk, 0, isk_len); | |
342 | ||
343 | if (data->phase2_method == NULL || data->phase2_priv == NULL) { | |
344 | wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 method not " | |
345 | "available"); | |
346 | return -1; | |
347 | } | |
348 | ||
349 | if (data->phase2_method->getKey == NULL) | |
350 | return 0; | |
351 | ||
352 | if ((key = data->phase2_method->getKey(sm, data->phase2_priv, | |
353 | &key_len)) == NULL) { | |
354 | wpa_printf(MSG_DEBUG, "EAP-FAST: Could not get key material " | |
355 | "from Phase 2"); | |
356 | return -1; | |
357 | } | |
358 | ||
359 | if (key_len > isk_len) | |
360 | key_len = isk_len; | |
000a1de7 JM |
361 | if (key_len == 32 && |
362 | data->phase2_method->vendor == EAP_VENDOR_IETF && | |
363 | data->phase2_method->method == EAP_TYPE_MSCHAPV2) { | |
364 | /* | |
365 | * EAP-FAST uses reverse order for MS-MPPE keys when deriving | |
366 | * MSK from EAP-MSCHAPv2. Swap the keys here to get the correct | |
367 | * ISK for EAP-FAST cryptobinding. | |
368 | */ | |
369 | os_memcpy(isk, key + 16, 16); | |
370 | os_memcpy(isk + 16, key, 16); | |
371 | } else | |
372 | os_memcpy(isk, key, key_len); | |
6fc6879b JM |
373 | os_free(key); |
374 | ||
375 | return 0; | |
376 | } | |
377 | ||
378 | ||
379 | static int eap_fast_update_icmk(struct eap_sm *sm, struct eap_fast_data *data) | |
380 | { | |
381 | u8 isk[32], imck[60]; | |
382 | ||
383 | wpa_printf(MSG_DEBUG, "EAP-FAST: Deriving ICMK[%d] (S-IMCK and CMK)", | |
384 | data->simck_idx + 1); | |
385 | ||
386 | /* | |
387 | * RFC 4851, Section 5.2: | |
388 | * IMCK[j] = T-PRF(S-IMCK[j-1], "Inner Methods Compound Keys", | |
389 | * MSK[j], 60) | |
390 | * S-IMCK[j] = first 40 octets of IMCK[j] | |
391 | * CMK[j] = last 20 octets of IMCK[j] | |
392 | */ | |
393 | ||
394 | if (eap_fast_get_phase2_key(sm, data, isk, sizeof(isk)) < 0) | |
395 | return -1; | |
396 | wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: ISK[j]", isk, sizeof(isk)); | |
397 | sha1_t_prf(data->simck, EAP_FAST_SIMCK_LEN, | |
398 | "Inner Methods Compound Keys", | |
399 | isk, sizeof(isk), imck, sizeof(imck)); | |
400 | data->simck_idx++; | |
401 | os_memcpy(data->simck, imck, EAP_FAST_SIMCK_LEN); | |
402 | wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: S-IMCK[j]", | |
403 | data->simck, EAP_FAST_SIMCK_LEN); | |
2bab8ae4 JM |
404 | os_memcpy(data->cmk, imck + EAP_FAST_SIMCK_LEN, EAP_FAST_CMK_LEN); |
405 | wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: CMK[j]", | |
406 | data->cmk, EAP_FAST_CMK_LEN); | |
6fc6879b JM |
407 | |
408 | return 0; | |
409 | } | |
410 | ||
411 | ||
412 | static void * eap_fast_init(struct eap_sm *sm) | |
413 | { | |
414 | struct eap_fast_data *data; | |
415 | u8 ciphers[5] = { | |
416 | TLS_CIPHER_ANON_DH_AES128_SHA, | |
417 | TLS_CIPHER_AES128_SHA, | |
418 | TLS_CIPHER_RSA_DHE_AES128_SHA, | |
419 | TLS_CIPHER_RC4_SHA, | |
420 | TLS_CIPHER_NONE | |
421 | }; | |
422 | ||
423 | data = os_zalloc(sizeof(*data)); | |
424 | if (data == NULL) | |
425 | return NULL; | |
426 | data->fast_version = EAP_FAST_VERSION; | |
427 | data->force_version = -1; | |
428 | if (sm->user && sm->user->force_version >= 0) { | |
429 | data->force_version = sm->user->force_version; | |
430 | wpa_printf(MSG_DEBUG, "EAP-FAST: forcing version %d", | |
431 | data->force_version); | |
432 | data->fast_version = data->force_version; | |
433 | } | |
434 | data->state = START; | |
435 | ||
436 | if (eap_server_tls_ssl_init(sm, &data->ssl, 0)) { | |
437 | wpa_printf(MSG_INFO, "EAP-FAST: Failed to initialize SSL."); | |
438 | eap_fast_reset(sm, data); | |
439 | return NULL; | |
440 | } | |
441 | ||
442 | if (tls_connection_set_cipher_list(sm->ssl_ctx, data->ssl.conn, | |
443 | ciphers) < 0) { | |
444 | wpa_printf(MSG_INFO, "EAP-FAST: Failed to set TLS cipher " | |
445 | "suites"); | |
446 | eap_fast_reset(sm, data); | |
447 | return NULL; | |
448 | } | |
449 | ||
450 | if (tls_connection_set_session_ticket_cb(sm->ssl_ctx, data->ssl.conn, | |
451 | eap_fast_session_ticket_cb, | |
452 | data) < 0) { | |
453 | wpa_printf(MSG_INFO, "EAP-FAST: Failed to set SessionTicket " | |
454 | "callback"); | |
455 | eap_fast_reset(sm, data); | |
456 | return NULL; | |
457 | } | |
458 | ||
459 | if (sm->pac_opaque_encr_key == NULL) { | |
460 | wpa_printf(MSG_INFO, "EAP-FAST: No PAC-Opaque encryption key " | |
461 | "configured"); | |
462 | eap_fast_reset(sm, data); | |
463 | return NULL; | |
464 | } | |
465 | os_memcpy(data->pac_opaque_encr, sm->pac_opaque_encr_key, | |
466 | sizeof(data->pac_opaque_encr)); | |
467 | ||
468 | if (sm->eap_fast_a_id == NULL) { | |
469 | wpa_printf(MSG_INFO, "EAP-FAST: No A-ID configured"); | |
470 | eap_fast_reset(sm, data); | |
471 | return NULL; | |
472 | } | |
2d867244 | 473 | data->srv_id = os_malloc(sm->eap_fast_a_id_len); |
6fc6879b JM |
474 | if (data->srv_id == NULL) { |
475 | eap_fast_reset(sm, data); | |
476 | return NULL; | |
477 | } | |
2d867244 JM |
478 | os_memcpy(data->srv_id, sm->eap_fast_a_id, sm->eap_fast_a_id_len); |
479 | data->srv_id_len = sm->eap_fast_a_id_len; | |
480 | ||
481 | if (sm->eap_fast_a_id_info == NULL) { | |
482 | wpa_printf(MSG_INFO, "EAP-FAST: No A-ID-Info configured"); | |
483 | eap_fast_reset(sm, data); | |
484 | return NULL; | |
485 | } | |
486 | data->srv_id_info = os_strdup(sm->eap_fast_a_id_info); | |
487 | if (data->srv_id_info == NULL) { | |
488 | eap_fast_reset(sm, data); | |
489 | return NULL; | |
490 | } | |
6fc6879b | 491 | |
a11c90a6 JM |
492 | /* PAC-Key lifetime in seconds (hard limit) */ |
493 | data->pac_key_lifetime = sm->pac_key_lifetime; | |
494 | ||
495 | /* | |
496 | * PAC-Key refresh time in seconds (soft limit on remaining hard | |
497 | * limit). The server will generate a new PAC-Key when this number of | |
498 | * seconds (or fewer) of the lifetime remains. | |
499 | */ | |
500 | data->pac_key_refresh_time = sm->pac_key_refresh_time; | |
501 | ||
6fc6879b JM |
502 | return data; |
503 | } | |
504 | ||
505 | ||
506 | static void eap_fast_reset(struct eap_sm *sm, void *priv) | |
507 | { | |
508 | struct eap_fast_data *data = priv; | |
509 | if (data == NULL) | |
510 | return; | |
511 | if (data->phase2_priv && data->phase2_method) | |
512 | data->phase2_method->reset(sm, data->phase2_priv); | |
513 | eap_server_tls_ssl_deinit(sm, &data->ssl); | |
514 | os_free(data->srv_id); | |
2d867244 | 515 | os_free(data->srv_id_info); |
6fc6879b JM |
516 | os_free(data->key_block_p); |
517 | wpabuf_free(data->pending_phase2_resp); | |
829f14be | 518 | os_free(data->identity); |
6fc6879b JM |
519 | os_free(data); |
520 | } | |
521 | ||
522 | ||
523 | static struct wpabuf * eap_fast_build_start(struct eap_sm *sm, | |
524 | struct eap_fast_data *data, u8 id) | |
525 | { | |
526 | struct wpabuf *req; | |
6fc6879b JM |
527 | |
528 | req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_FAST, | |
2d867244 | 529 | 1 + sizeof(struct pac_tlv_hdr) + data->srv_id_len, |
6fc6879b JM |
530 | EAP_CODE_REQUEST, id); |
531 | if (req == NULL) { | |
532 | wpa_printf(MSG_ERROR, "EAP-FAST: Failed to allocate memory for" | |
533 | " request"); | |
534 | eap_fast_state(data, FAILURE); | |
535 | return NULL; | |
536 | } | |
537 | ||
538 | wpabuf_put_u8(req, EAP_TLS_FLAGS_START | data->fast_version); | |
a4819630 JM |
539 | |
540 | /* RFC 4851, 4.1.1. Authority ID Data */ | |
2d867244 | 541 | eap_fast_put_tlv(req, PAC_TYPE_A_ID, data->srv_id, data->srv_id_len); |
6fc6879b JM |
542 | |
543 | eap_fast_state(data, PHASE1); | |
544 | ||
545 | return req; | |
546 | } | |
547 | ||
548 | ||
549 | static int eap_fast_phase1_done(struct eap_sm *sm, struct eap_fast_data *data) | |
550 | { | |
551 | char cipher[64]; | |
552 | ||
553 | wpa_printf(MSG_DEBUG, "EAP-FAST: Phase1 done, starting Phase2"); | |
554 | ||
555 | if (tls_get_cipher(sm->ssl_ctx, data->ssl.conn, cipher, sizeof(cipher)) | |
556 | < 0) { | |
557 | wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to get cipher " | |
558 | "information"); | |
559 | eap_fast_state(data, FAILURE); | |
560 | return -1; | |
561 | } | |
562 | data->anon_provisioning = os_strstr(cipher, "ADH") != NULL; | |
563 | ||
564 | if (data->anon_provisioning) { | |
565 | wpa_printf(MSG_DEBUG, "EAP-FAST: Anonymous provisioning"); | |
566 | eap_fast_derive_key_provisioning(sm, data); | |
567 | } else | |
568 | eap_fast_derive_key_auth(sm, data); | |
569 | ||
570 | eap_fast_state(data, PHASE2_START); | |
571 | ||
572 | return 0; | |
573 | } | |
574 | ||
575 | ||
6fc6879b JM |
576 | static struct wpabuf * eap_fast_build_phase2_req(struct eap_sm *sm, |
577 | struct eap_fast_data *data, | |
578 | u8 id) | |
579 | { | |
580 | struct wpabuf *req; | |
581 | ||
582 | if (data->phase2_priv == NULL) { | |
583 | wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 method not " | |
584 | "initialized"); | |
585 | return NULL; | |
586 | } | |
587 | req = data->phase2_method->buildReq(sm, data->phase2_priv, id); | |
588 | if (req == NULL) | |
589 | return NULL; | |
590 | ||
591 | wpa_hexdump_buf_key(MSG_MSGDUMP, "EAP-FAST: Phase 2 EAP-Request", req); | |
592 | return eap_fast_tlv_eap_payload(req); | |
593 | } | |
594 | ||
595 | ||
596 | static struct wpabuf * eap_fast_build_crypto_binding( | |
597 | struct eap_sm *sm, struct eap_fast_data *data) | |
598 | { | |
599 | struct wpabuf *buf; | |
600 | struct eap_tlv_result_tlv *result; | |
ed5a02fd | 601 | struct eap_tlv_crypto_binding_tlv *binding; |
6fc6879b | 602 | |
7914585f | 603 | buf = wpabuf_alloc(2 * sizeof(*result) + sizeof(*binding)); |
6fc6879b JM |
604 | if (buf == NULL) |
605 | return NULL; | |
606 | ||
7914585f JM |
607 | if (data->send_new_pac || data->anon_provisioning || |
608 | data->phase2_method) | |
6fc6879b | 609 | data->final_result = 0; |
7914585f | 610 | else |
6fc6879b | 611 | data->final_result = 1; |
7914585f JM |
612 | |
613 | if (!data->final_result || data->eap_seq > 1) { | |
614 | /* Intermediate-Result */ | |
615 | wpa_printf(MSG_DEBUG, "EAP-FAST: Add Intermediate-Result TLV " | |
616 | "(status=SUCCESS)"); | |
617 | result = wpabuf_put(buf, sizeof(*result)); | |
618 | result->tlv_type = host_to_be16( | |
619 | EAP_TLV_TYPE_MANDATORY | | |
620 | EAP_TLV_INTERMEDIATE_RESULT_TLV); | |
621 | result->length = host_to_be16(2); | |
622 | result->status = host_to_be16(EAP_TLV_RESULT_SUCCESS); | |
6fc6879b JM |
623 | } |
624 | ||
7914585f JM |
625 | if (data->final_result) { |
626 | /* Result TLV */ | |
627 | wpa_printf(MSG_DEBUG, "EAP-FAST: Add Result TLV " | |
628 | "(status=SUCCESS)"); | |
629 | result = wpabuf_put(buf, sizeof(*result)); | |
630 | result->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY | | |
631 | EAP_TLV_RESULT_TLV); | |
632 | result->length = host_to_be16(2); | |
633 | result->status = host_to_be16(EAP_TLV_RESULT_SUCCESS); | |
634 | } | |
6fc6879b JM |
635 | |
636 | /* Crypto-Binding TLV */ | |
637 | binding = wpabuf_put(buf, sizeof(*binding)); | |
638 | binding->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY | | |
639 | EAP_TLV_CRYPTO_BINDING_TLV); | |
640 | binding->length = host_to_be16(sizeof(*binding) - | |
641 | sizeof(struct eap_tlv_hdr)); | |
642 | binding->version = EAP_FAST_VERSION; | |
643 | binding->received_version = data->peer_version; | |
644 | binding->subtype = EAP_TLV_CRYPTO_BINDING_SUBTYPE_REQUEST; | |
645 | if (os_get_random(binding->nonce, sizeof(binding->nonce)) < 0) { | |
646 | wpabuf_free(buf); | |
647 | return NULL; | |
648 | } | |
649 | ||
650 | /* | |
651 | * RFC 4851, Section 4.2.8: | |
652 | * The nonce in a request MUST have its least significant bit set to 0. | |
653 | */ | |
654 | binding->nonce[sizeof(binding->nonce) - 1] &= ~0x01; | |
655 | ||
656 | os_memcpy(data->crypto_binding_nonce, binding->nonce, | |
657 | sizeof(binding->nonce)); | |
658 | ||
659 | /* | |
660 | * RFC 4851, Section 5.3: | |
661 | * CMK = CMK[j] | |
662 | * Compound-MAC = HMAC-SHA1( CMK, Crypto-Binding TLV ) | |
663 | */ | |
664 | ||
2bab8ae4 JM |
665 | hmac_sha1(data->cmk, EAP_FAST_CMK_LEN, |
666 | (u8 *) binding, sizeof(*binding), | |
6fc6879b JM |
667 | binding->compound_mac); |
668 | ||
669 | wpa_printf(MSG_DEBUG, "EAP-FAST: Add Crypto-Binding TLV: Version %d " | |
670 | "Received Version %d SubType %d", | |
671 | binding->version, binding->received_version, | |
672 | binding->subtype); | |
673 | wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: NONCE", | |
674 | binding->nonce, sizeof(binding->nonce)); | |
675 | wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Compound MAC", | |
676 | binding->compound_mac, sizeof(binding->compound_mac)); | |
677 | ||
678 | return buf; | |
679 | } | |
680 | ||
681 | ||
682 | static struct wpabuf * eap_fast_build_pac(struct eap_sm *sm, | |
683 | struct eap_fast_data *data) | |
684 | { | |
829f14be JM |
685 | u8 pac_key[EAP_FAST_PAC_KEY_LEN]; |
686 | u8 *pac_buf, *pac_opaque; | |
6fc6879b JM |
687 | struct wpabuf *buf; |
688 | u8 *pos; | |
2d867244 | 689 | size_t buf_len, srv_id_info_len, pac_len; |
6fc6879b | 690 | struct eap_tlv_hdr *pac_tlv; |
a4819630 | 691 | struct pac_tlv_hdr *pac_info; |
6fc6879b JM |
692 | struct eap_tlv_result_tlv *result; |
693 | struct os_time now; | |
694 | ||
829f14be JM |
695 | if (os_get_random(pac_key, EAP_FAST_PAC_KEY_LEN) < 0 || |
696 | os_get_time(&now) < 0) | |
6fc6879b JM |
697 | return NULL; |
698 | wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Generated PAC-Key", | |
829f14be JM |
699 | pac_key, EAP_FAST_PAC_KEY_LEN); |
700 | ||
701 | pac_len = (2 + EAP_FAST_PAC_KEY_LEN) + (2 + 4) + | |
702 | (2 + sm->identity_len) + 8; | |
703 | pac_buf = os_malloc(pac_len); | |
704 | if (pac_buf == NULL) | |
705 | return NULL; | |
706 | ||
2d867244 | 707 | srv_id_info_len = os_strlen(data->srv_id_info); |
829f14be JM |
708 | |
709 | pos = pac_buf; | |
710 | *pos++ = PAC_OPAQUE_TYPE_KEY; | |
711 | *pos++ = EAP_FAST_PAC_KEY_LEN; | |
712 | os_memcpy(pos, pac_key, EAP_FAST_PAC_KEY_LEN); | |
713 | pos += EAP_FAST_PAC_KEY_LEN; | |
714 | ||
6fc6879b JM |
715 | *pos++ = PAC_OPAQUE_TYPE_LIFETIME; |
716 | *pos++ = 4; | |
a11c90a6 | 717 | WPA_PUT_BE32(pos, now.sec + data->pac_key_lifetime); |
829f14be JM |
718 | pos += 4; |
719 | ||
720 | if (sm->identity) { | |
721 | *pos++ = PAC_OPAQUE_TYPE_IDENTITY; | |
722 | *pos++ = sm->identity_len; | |
723 | os_memcpy(pos, sm->identity, sm->identity_len); | |
724 | pos += sm->identity_len; | |
725 | } | |
6fc6879b | 726 | |
829f14be | 727 | pac_len = pos - pac_buf; |
1f21bc4c | 728 | while (pac_len % 8) { |
829f14be JM |
729 | *pos++ = PAC_OPAQUE_TYPE_PAD; |
730 | pac_len++; | |
731 | } | |
732 | ||
733 | pac_opaque = os_malloc(pac_len + 8); | |
734 | if (pac_opaque == NULL) { | |
735 | os_free(pac_buf); | |
736 | return NULL; | |
737 | } | |
738 | if (aes_wrap(data->pac_opaque_encr, pac_len / 8, pac_buf, | |
739 | pac_opaque) < 0) { | |
740 | os_free(pac_buf); | |
741 | os_free(pac_opaque); | |
6fc6879b | 742 | return NULL; |
829f14be JM |
743 | } |
744 | os_free(pac_buf); | |
6fc6879b | 745 | |
829f14be | 746 | pac_len += 8; |
6fc6879b | 747 | wpa_hexdump(MSG_DEBUG, "EAP-FAST: PAC-Opaque", |
829f14be | 748 | pac_opaque, pac_len); |
6fc6879b JM |
749 | |
750 | buf_len = sizeof(*pac_tlv) + | |
a4819630 JM |
751 | sizeof(struct pac_tlv_hdr) + EAP_FAST_PAC_KEY_LEN + |
752 | sizeof(struct pac_tlv_hdr) + pac_len + | |
2d867244 | 753 | data->srv_id_len + srv_id_info_len + 100 + sizeof(*result); |
6fc6879b | 754 | buf = wpabuf_alloc(buf_len); |
829f14be JM |
755 | if (buf == NULL) { |
756 | os_free(pac_opaque); | |
6fc6879b | 757 | return NULL; |
829f14be | 758 | } |
6fc6879b | 759 | |
f36f51e4 JM |
760 | /* Result TLV */ |
761 | wpa_printf(MSG_DEBUG, "EAP-FAST: Add Result TLV (status=SUCCESS)"); | |
762 | result = wpabuf_put(buf, sizeof(*result)); | |
763 | WPA_PUT_BE16((u8 *) &result->tlv_type, | |
764 | EAP_TLV_TYPE_MANDATORY | EAP_TLV_RESULT_TLV); | |
765 | WPA_PUT_BE16((u8 *) &result->length, 2); | |
766 | WPA_PUT_BE16((u8 *) &result->status, EAP_TLV_RESULT_SUCCESS); | |
767 | ||
6fc6879b JM |
768 | /* PAC TLV */ |
769 | wpa_printf(MSG_DEBUG, "EAP-FAST: Add PAC TLV"); | |
770 | pac_tlv = wpabuf_put(buf, sizeof(*pac_tlv)); | |
771 | pac_tlv->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY | | |
772 | EAP_TLV_PAC_TLV); | |
773 | ||
774 | /* PAC-Key */ | |
a4819630 | 775 | eap_fast_put_tlv(buf, PAC_TYPE_PAC_KEY, pac_key, EAP_FAST_PAC_KEY_LEN); |
6fc6879b JM |
776 | |
777 | /* PAC-Opaque */ | |
a4819630 | 778 | eap_fast_put_tlv(buf, PAC_TYPE_PAC_OPAQUE, pac_opaque, pac_len); |
829f14be | 779 | os_free(pac_opaque); |
6fc6879b JM |
780 | |
781 | /* PAC-Info */ | |
782 | pac_info = wpabuf_put(buf, sizeof(*pac_info)); | |
783 | pac_info->type = host_to_be16(PAC_TYPE_PAC_INFO); | |
784 | ||
785 | /* PAC-Lifetime (inside PAC-Info) */ | |
a4819630 | 786 | eap_fast_put_tlv_hdr(buf, PAC_TYPE_CRED_LIFETIME, 4); |
a11c90a6 | 787 | wpabuf_put_be32(buf, now.sec + data->pac_key_lifetime); |
6fc6879b JM |
788 | |
789 | /* A-ID (inside PAC-Info) */ | |
2d867244 | 790 | eap_fast_put_tlv(buf, PAC_TYPE_A_ID, data->srv_id, data->srv_id_len); |
6fc6879b JM |
791 | |
792 | /* Note: headers may be misaligned after A-ID */ | |
793 | ||
794 | /* A-ID-Info (inside PAC-Info) */ | |
2d867244 JM |
795 | eap_fast_put_tlv(buf, PAC_TYPE_A_ID_INFO, data->srv_id_info, |
796 | srv_id_info_len); | |
6fc6879b JM |
797 | |
798 | /* PAC-Type (inside PAC-Info) */ | |
a4819630 | 799 | eap_fast_put_tlv_hdr(buf, PAC_TYPE_PAC_TYPE, 2); |
6fc6879b JM |
800 | wpabuf_put_be16(buf, PAC_TYPE_TUNNEL_PAC); |
801 | ||
802 | /* Update PAC-Info and PAC TLV Length fields */ | |
803 | pos = wpabuf_put(buf, 0); | |
804 | pac_info->len = host_to_be16(pos - (u8 *) (pac_info + 1)); | |
805 | pac_tlv->length = host_to_be16(pos - (u8 *) (pac_tlv + 1)); | |
806 | ||
6fc6879b JM |
807 | return buf; |
808 | } | |
809 | ||
810 | ||
c479e41f JM |
811 | static int eap_fast_encrypt_phase2(struct eap_sm *sm, |
812 | struct eap_fast_data *data, | |
813 | struct wpabuf *plain, int piggyback) | |
814 | { | |
815 | struct wpabuf *encr; | |
816 | ||
817 | wpa_hexdump_buf_key(MSG_DEBUG, "EAP-FAST: Encrypting Phase 2 TLVs", | |
818 | plain); | |
81c85c06 | 819 | encr = eap_server_tls_encrypt(sm, &data->ssl, plain); |
c479e41f JM |
820 | wpabuf_free(plain); |
821 | ||
822 | if (data->ssl.out_buf && piggyback) { | |
823 | wpa_printf(MSG_DEBUG, "EAP-FAST: Piggyback Phase 2 data " | |
824 | "(len=%d) with last Phase 1 Message (len=%d " | |
825 | "used=%d)", | |
826 | (int) wpabuf_len(encr), | |
827 | (int) wpabuf_len(data->ssl.out_buf), | |
828 | (int) data->ssl.out_used); | |
829 | if (wpabuf_resize(&data->ssl.out_buf, wpabuf_len(encr)) < 0) { | |
830 | wpa_printf(MSG_WARNING, "EAP-FAST: Failed to resize " | |
831 | "output buffer"); | |
832 | wpabuf_free(encr); | |
833 | return -1; | |
834 | } | |
835 | wpabuf_put_buf(data->ssl.out_buf, encr); | |
836 | wpabuf_free(encr); | |
837 | } else { | |
838 | wpabuf_free(data->ssl.out_buf); | |
839 | data->ssl.out_used = 0; | |
840 | data->ssl.out_buf = encr; | |
841 | } | |
842 | ||
843 | return 0; | |
844 | } | |
845 | ||
846 | ||
6fc6879b JM |
847 | static struct wpabuf * eap_fast_buildReq(struct eap_sm *sm, void *priv, u8 id) |
848 | { | |
849 | struct eap_fast_data *data = priv; | |
34f564db | 850 | struct wpabuf *req = NULL; |
c479e41f | 851 | int piggyback = 0; |
6fc6879b | 852 | |
34f564db JM |
853 | if (data->ssl.state == FRAG_ACK) { |
854 | return eap_server_tls_build_ack(id, EAP_TYPE_FAST, | |
855 | data->fast_version); | |
856 | } | |
6fc6879b | 857 | |
34f564db JM |
858 | if (data->ssl.state == WAIT_FRAG_ACK) { |
859 | return eap_server_tls_build_msg(&data->ssl, EAP_TYPE_FAST, | |
860 | data->fast_version, id); | |
861 | } | |
6fc6879b JM |
862 | |
863 | switch (data->state) { | |
34f564db JM |
864 | case START: |
865 | return eap_fast_build_start(sm, data, id); | |
866 | case PHASE1: | |
867 | if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) { | |
868 | if (eap_fast_phase1_done(sm, data) < 0) | |
869 | return NULL; | |
c479e41f JM |
870 | if (data->state == PHASE2_START) { |
871 | /* | |
872 | * Try to generate Phase 2 data to piggyback | |
873 | * with the end of Phase 1 to avoid extra | |
874 | * roundtrip. | |
875 | */ | |
876 | wpa_printf(MSG_DEBUG, "EAP-FAST: Try to start " | |
877 | "Phase 2"); | |
878 | if (eap_fast_process_phase2_start(sm, data)) | |
879 | break; | |
880 | req = eap_fast_build_phase2_req(sm, data, id); | |
881 | piggyback = 1; | |
882 | } | |
34f564db JM |
883 | } |
884 | break; | |
6fc6879b JM |
885 | case PHASE2_ID: |
886 | case PHASE2_METHOD: | |
887 | req = eap_fast_build_phase2_req(sm, data, id); | |
888 | break; | |
889 | case CRYPTO_BINDING: | |
890 | req = eap_fast_build_crypto_binding(sm, data); | |
7914585f JM |
891 | if (data->phase2_method) { |
892 | /* | |
893 | * Include the start of the next EAP method in the | |
894 | * sequence in the same message with Crypto-Binding to | |
895 | * save a round-trip. | |
896 | */ | |
897 | struct wpabuf *eap; | |
898 | eap = eap_fast_build_phase2_req(sm, data, id); | |
899 | req = wpabuf_concat(req, eap); | |
7db0fca5 | 900 | eap_fast_state(data, PHASE2_METHOD); |
7914585f | 901 | } |
6fc6879b JM |
902 | break; |
903 | case REQUEST_PAC: | |
904 | req = eap_fast_build_pac(sm, data); | |
905 | break; | |
906 | default: | |
907 | wpa_printf(MSG_DEBUG, "EAP-FAST: %s - unexpected state %d", | |
908 | __func__, data->state); | |
909 | return NULL; | |
910 | } | |
911 | ||
c479e41f JM |
912 | if (req && |
913 | eap_fast_encrypt_phase2(sm, data, req, piggyback) < 0) | |
914 | return NULL; | |
6fc6879b | 915 | |
34f564db JM |
916 | return eap_server_tls_build_msg(&data->ssl, EAP_TYPE_FAST, |
917 | data->fast_version, id); | |
6fc6879b JM |
918 | } |
919 | ||
920 | ||
921 | static Boolean eap_fast_check(struct eap_sm *sm, void *priv, | |
922 | struct wpabuf *respData) | |
923 | { | |
924 | const u8 *pos; | |
925 | size_t len; | |
926 | ||
927 | pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_FAST, respData, &len); | |
928 | if (pos == NULL || len < 1) { | |
929 | wpa_printf(MSG_INFO, "EAP-FAST: Invalid frame"); | |
930 | return TRUE; | |
931 | } | |
932 | ||
933 | return FALSE; | |
934 | } | |
935 | ||
936 | ||
937 | static int eap_fast_phase2_init(struct eap_sm *sm, struct eap_fast_data *data, | |
938 | EapType eap_type) | |
939 | { | |
940 | if (data->phase2_priv && data->phase2_method) { | |
941 | data->phase2_method->reset(sm, data->phase2_priv); | |
942 | data->phase2_method = NULL; | |
943 | data->phase2_priv = NULL; | |
944 | } | |
945 | data->phase2_method = eap_server_get_eap_method(EAP_VENDOR_IETF, | |
946 | eap_type); | |
947 | if (!data->phase2_method) | |
948 | return -1; | |
949 | ||
950 | if (data->key_block_p) { | |
951 | sm->auth_challenge = data->key_block_p->server_challenge; | |
952 | sm->peer_challenge = data->key_block_p->client_challenge; | |
953 | } | |
954 | sm->init_phase2 = 1; | |
955 | data->phase2_priv = data->phase2_method->init(sm); | |
956 | sm->init_phase2 = 0; | |
957 | sm->auth_challenge = NULL; | |
958 | sm->peer_challenge = NULL; | |
959 | ||
960 | return data->phase2_priv == NULL ? -1 : 0; | |
961 | } | |
962 | ||
963 | ||
964 | static void eap_fast_process_phase2_response(struct eap_sm *sm, | |
965 | struct eap_fast_data *data, | |
966 | u8 *in_data, size_t in_len) | |
967 | { | |
968 | u8 next_type = EAP_TYPE_NONE; | |
969 | struct eap_hdr *hdr; | |
970 | u8 *pos; | |
971 | size_t left; | |
972 | struct wpabuf buf; | |
973 | const struct eap_method *m = data->phase2_method; | |
974 | void *priv = data->phase2_priv; | |
975 | ||
976 | if (priv == NULL) { | |
977 | wpa_printf(MSG_DEBUG, "EAP-FAST: %s - Phase2 not " | |
978 | "initialized?!", __func__); | |
979 | return; | |
980 | } | |
981 | ||
982 | hdr = (struct eap_hdr *) in_data; | |
983 | pos = (u8 *) (hdr + 1); | |
984 | ||
985 | if (in_len > sizeof(*hdr) && *pos == EAP_TYPE_NAK) { | |
986 | left = in_len - sizeof(*hdr); | |
987 | wpa_hexdump(MSG_DEBUG, "EAP-FAST: Phase2 type Nak'ed; " | |
988 | "allowed types", pos + 1, left - 1); | |
1e5839e0 | 989 | #ifdef EAP_SERVER_TNC |
7db0fca5 JM |
990 | if (m && m->vendor == EAP_VENDOR_IETF && |
991 | m->method == EAP_TYPE_TNC) { | |
992 | wpa_printf(MSG_DEBUG, "EAP-FAST: Peer Nak'ed required " | |
993 | "TNC negotiation"); | |
994 | next_type = eap_fast_req_failure(sm, data); | |
995 | eap_fast_phase2_init(sm, data, next_type); | |
996 | return; | |
997 | } | |
1e5839e0 | 998 | #endif /* EAP_SERVER_TNC */ |
6fc6879b JM |
999 | eap_sm_process_nak(sm, pos + 1, left - 1); |
1000 | if (sm->user && sm->user_eap_method_index < EAP_MAX_METHODS && | |
1001 | sm->user->methods[sm->user_eap_method_index].method != | |
1002 | EAP_TYPE_NONE) { | |
1003 | next_type = sm->user->methods[ | |
1004 | sm->user_eap_method_index++].method; | |
1005 | wpa_printf(MSG_DEBUG, "EAP-FAST: try EAP type %d", | |
1006 | next_type); | |
1007 | } else { | |
1008 | next_type = eap_fast_req_failure(sm, data); | |
1009 | } | |
1010 | eap_fast_phase2_init(sm, data, next_type); | |
1011 | return; | |
1012 | } | |
1013 | ||
1014 | wpabuf_set(&buf, in_data, in_len); | |
1015 | ||
1016 | if (m->check(sm, priv, &buf)) { | |
1017 | wpa_printf(MSG_DEBUG, "EAP-FAST: Phase2 check() asked to " | |
1018 | "ignore the packet"); | |
1019 | next_type = eap_fast_req_failure(sm, data); | |
1020 | return; | |
1021 | } | |
1022 | ||
1023 | m->process(sm, priv, &buf); | |
1024 | ||
1025 | if (!m->isDone(sm, priv)) | |
1026 | return; | |
1027 | ||
1028 | if (!m->isSuccess(sm, priv)) { | |
1029 | wpa_printf(MSG_DEBUG, "EAP-FAST: Phase2 method failed"); | |
1030 | next_type = eap_fast_req_failure(sm, data); | |
1031 | eap_fast_phase2_init(sm, data, next_type); | |
1032 | return; | |
1033 | } | |
1034 | ||
1035 | switch (data->state) { | |
1036 | case PHASE2_ID: | |
1037 | if (eap_user_get(sm, sm->identity, sm->identity_len, 1) != 0) { | |
1038 | wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: Phase2 " | |
1039 | "Identity not found in the user " | |
1040 | "database", | |
1041 | sm->identity, sm->identity_len); | |
1042 | next_type = eap_fast_req_failure(sm, data); | |
1043 | break; | |
1044 | } | |
1045 | ||
1046 | eap_fast_state(data, PHASE2_METHOD); | |
1047 | if (data->anon_provisioning) { | |
1048 | /* | |
1049 | * Only EAP-MSCHAPv2 is allowed for anonymous | |
1050 | * provisioning. | |
1051 | */ | |
1052 | next_type = EAP_TYPE_MSCHAPV2; | |
1053 | sm->user_eap_method_index = 0; | |
1054 | } else { | |
1055 | next_type = sm->user->methods[0].method; | |
1056 | sm->user_eap_method_index = 1; | |
1057 | } | |
1058 | wpa_printf(MSG_DEBUG, "EAP-FAST: try EAP type %d", next_type); | |
1059 | break; | |
1060 | case PHASE2_METHOD: | |
7914585f | 1061 | case CRYPTO_BINDING: |
6fc6879b JM |
1062 | eap_fast_update_icmk(sm, data); |
1063 | eap_fast_state(data, CRYPTO_BINDING); | |
7914585f | 1064 | data->eap_seq++; |
6fc6879b | 1065 | next_type = EAP_TYPE_NONE; |
1e5839e0 | 1066 | #ifdef EAP_SERVER_TNC |
7db0fca5 JM |
1067 | if (sm->tnc && !data->tnc_started) { |
1068 | wpa_printf(MSG_DEBUG, "EAP-FAST: Initialize TNC"); | |
1069 | next_type = EAP_TYPE_TNC; | |
1070 | data->tnc_started = 1; | |
1071 | } | |
1e5839e0 | 1072 | #endif /* EAP_SERVER_TNC */ |
6fc6879b JM |
1073 | break; |
1074 | case FAILURE: | |
1075 | break; | |
1076 | default: | |
1077 | wpa_printf(MSG_DEBUG, "EAP-FAST: %s - unexpected state %d", | |
1078 | __func__, data->state); | |
1079 | break; | |
1080 | } | |
1081 | ||
1082 | eap_fast_phase2_init(sm, data, next_type); | |
1083 | } | |
1084 | ||
1085 | ||
1086 | static void eap_fast_process_phase2_eap(struct eap_sm *sm, | |
1087 | struct eap_fast_data *data, | |
1088 | u8 *in_data, size_t in_len) | |
1089 | { | |
1090 | struct eap_hdr *hdr; | |
1091 | size_t len; | |
1092 | ||
1093 | hdr = (struct eap_hdr *) in_data; | |
1094 | if (in_len < (int) sizeof(*hdr)) { | |
1095 | wpa_printf(MSG_INFO, "EAP-FAST: Too short Phase 2 " | |
dd20838a | 1096 | "EAP frame (len=%lu)", (unsigned long) in_len); |
6fc6879b JM |
1097 | eap_fast_req_failure(sm, data); |
1098 | return; | |
1099 | } | |
1100 | len = be_to_host16(hdr->length); | |
1101 | if (len > in_len) { | |
1102 | wpa_printf(MSG_INFO, "EAP-FAST: Length mismatch in " | |
dd20838a JM |
1103 | "Phase 2 EAP frame (len=%lu hdr->length=%lu)", |
1104 | (unsigned long) in_len, (unsigned long) len); | |
6fc6879b JM |
1105 | eap_fast_req_failure(sm, data); |
1106 | return; | |
1107 | } | |
1108 | wpa_printf(MSG_DEBUG, "EAP-FAST: Received Phase 2: code=%d " | |
dd20838a JM |
1109 | "identifier=%d length=%lu", hdr->code, hdr->identifier, |
1110 | (unsigned long) len); | |
6fc6879b JM |
1111 | switch (hdr->code) { |
1112 | case EAP_CODE_RESPONSE: | |
1113 | eap_fast_process_phase2_response(sm, data, (u8 *) hdr, len); | |
1114 | break; | |
1115 | default: | |
1116 | wpa_printf(MSG_INFO, "EAP-FAST: Unexpected code=%d in " | |
1117 | "Phase 2 EAP header", hdr->code); | |
1118 | break; | |
1119 | } | |
1120 | } | |
1121 | ||
1122 | ||
81c85c06 | 1123 | static int eap_fast_parse_tlvs(struct wpabuf *data, |
6fc6879b JM |
1124 | struct eap_fast_tlv_parse *tlv) |
1125 | { | |
1126 | int mandatory, tlv_type, len, res; | |
1127 | u8 *pos, *end; | |
1128 | ||
1129 | os_memset(tlv, 0, sizeof(*tlv)); | |
1130 | ||
81c85c06 JM |
1131 | pos = wpabuf_mhead(data); |
1132 | end = pos + wpabuf_len(data); | |
6fc6879b JM |
1133 | while (pos + 4 < end) { |
1134 | mandatory = pos[0] & 0x80; | |
1135 | tlv_type = WPA_GET_BE16(pos) & 0x3fff; | |
1136 | pos += 2; | |
1137 | len = WPA_GET_BE16(pos); | |
1138 | pos += 2; | |
1139 | if (pos + len > end) { | |
1140 | wpa_printf(MSG_INFO, "EAP-FAST: TLV overflow"); | |
1141 | return -1; | |
1142 | } | |
1143 | wpa_printf(MSG_DEBUG, "EAP-FAST: Received Phase 2: " | |
1144 | "TLV type %d length %d%s", | |
1145 | tlv_type, len, mandatory ? " (mandatory)" : ""); | |
1146 | ||
1147 | res = eap_fast_parse_tlv(tlv, tlv_type, pos, len); | |
1148 | if (res == -2) | |
1149 | break; | |
1150 | if (res < 0) { | |
1151 | if (mandatory) { | |
1152 | wpa_printf(MSG_DEBUG, "EAP-FAST: Nak unknown " | |
1153 | "mandatory TLV type %d", tlv_type); | |
1154 | /* TODO: generate Nak TLV */ | |
1155 | break; | |
1156 | } else { | |
1157 | wpa_printf(MSG_DEBUG, "EAP-FAST: Ignored " | |
1158 | "unknown optional TLV type %d", | |
1159 | tlv_type); | |
1160 | } | |
1161 | } | |
1162 | ||
1163 | pos += len; | |
1164 | } | |
1165 | ||
1166 | return 0; | |
1167 | } | |
1168 | ||
1169 | ||
1170 | static int eap_fast_validate_crypto_binding( | |
ed5a02fd | 1171 | struct eap_fast_data *data, struct eap_tlv_crypto_binding_tlv *b, |
6fc6879b JM |
1172 | size_t bind_len) |
1173 | { | |
2bab8ae4 | 1174 | u8 cmac[SHA1_MAC_LEN]; |
6fc6879b JM |
1175 | |
1176 | wpa_printf(MSG_DEBUG, "EAP-FAST: Reply Crypto-Binding TLV: " | |
1177 | "Version %d Received Version %d SubType %d", | |
1178 | b->version, b->received_version, b->subtype); | |
1179 | wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: NONCE", | |
1180 | b->nonce, sizeof(b->nonce)); | |
1181 | wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Compound MAC", | |
1182 | b->compound_mac, sizeof(b->compound_mac)); | |
1183 | ||
1184 | if (b->version != EAP_FAST_VERSION || | |
1185 | b->received_version != EAP_FAST_VERSION) { | |
1186 | wpa_printf(MSG_DEBUG, "EAP-FAST: Unexpected version " | |
1187 | "in Crypto-Binding: version %d " | |
1188 | "received_version %d", b->version, | |
1189 | b->received_version); | |
1190 | return -1; | |
1191 | } | |
1192 | ||
1193 | if (b->subtype != EAP_TLV_CRYPTO_BINDING_SUBTYPE_RESPONSE) { | |
1194 | wpa_printf(MSG_DEBUG, "EAP-FAST: Unexpected subtype in " | |
1195 | "Crypto-Binding: %d", b->subtype); | |
1196 | return -1; | |
1197 | } | |
1198 | ||
1199 | if (os_memcmp(data->crypto_binding_nonce, b->nonce, 31) != 0 || | |
1200 | (data->crypto_binding_nonce[31] | 1) != b->nonce[31]) { | |
1201 | wpa_printf(MSG_DEBUG, "EAP-FAST: Invalid nonce in " | |
1202 | "Crypto-Binding"); | |
1203 | return -1; | |
1204 | } | |
1205 | ||
1206 | os_memcpy(cmac, b->compound_mac, sizeof(cmac)); | |
1207 | os_memset(b->compound_mac, 0, sizeof(cmac)); | |
1208 | wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Crypto-Binding TLV for " | |
1209 | "Compound MAC calculation", | |
1210 | (u8 *) b, bind_len); | |
2bab8ae4 JM |
1211 | hmac_sha1(data->cmk, EAP_FAST_CMK_LEN, (u8 *) b, bind_len, |
1212 | b->compound_mac); | |
6fc6879b JM |
1213 | if (os_memcmp(cmac, b->compound_mac, sizeof(cmac)) != 0) { |
1214 | wpa_hexdump(MSG_MSGDUMP, | |
1215 | "EAP-FAST: Calculated Compound MAC", | |
1216 | b->compound_mac, sizeof(cmac)); | |
1217 | wpa_printf(MSG_INFO, "EAP-FAST: Compound MAC did not " | |
1218 | "match"); | |
1219 | return -1; | |
1220 | } | |
1221 | ||
1222 | return 0; | |
1223 | } | |
1224 | ||
1225 | ||
1226 | static int eap_fast_pac_type(u8 *pac, size_t len, u16 type) | |
1227 | { | |
1228 | struct eap_tlv_pac_type_tlv *tlv; | |
1229 | ||
1230 | if (pac == NULL || len != sizeof(*tlv)) | |
1231 | return 0; | |
1232 | ||
1233 | tlv = (struct eap_tlv_pac_type_tlv *) pac; | |
1234 | ||
1235 | return be_to_host16(tlv->tlv_type) == PAC_TYPE_PAC_TYPE && | |
1236 | be_to_host16(tlv->length) == 2 && | |
1237 | be_to_host16(tlv->pac_type) == type; | |
1238 | } | |
1239 | ||
1240 | ||
1241 | static void eap_fast_process_phase2_tlvs(struct eap_sm *sm, | |
1242 | struct eap_fast_data *data, | |
81c85c06 | 1243 | struct wpabuf *in_data) |
6fc6879b JM |
1244 | { |
1245 | struct eap_fast_tlv_parse tlv; | |
1246 | int check_crypto_binding = data->state == CRYPTO_BINDING; | |
1247 | ||
81c85c06 | 1248 | if (eap_fast_parse_tlvs(in_data, &tlv) < 0) { |
6fc6879b JM |
1249 | wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to parse received " |
1250 | "Phase 2 TLVs"); | |
1251 | return; | |
1252 | } | |
1253 | ||
1254 | if (tlv.result == EAP_TLV_RESULT_FAILURE) { | |
1255 | wpa_printf(MSG_DEBUG, "EAP-FAST: Result TLV indicated " | |
1256 | "failure"); | |
1257 | eap_fast_state(data, FAILURE); | |
1258 | return; | |
1259 | } | |
1260 | ||
1261 | if (data->state == REQUEST_PAC) { | |
1262 | u16 type, len, res; | |
1263 | if (tlv.pac == NULL || tlv.pac_len < 6) { | |
1264 | wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC " | |
1265 | "Acknowledgement received"); | |
1266 | eap_fast_state(data, FAILURE); | |
1267 | return; | |
1268 | } | |
1269 | ||
1270 | type = WPA_GET_BE16(tlv.pac); | |
1271 | len = WPA_GET_BE16(tlv.pac + 2); | |
1272 | res = WPA_GET_BE16(tlv.pac + 4); | |
1273 | ||
1274 | if (type != PAC_TYPE_PAC_ACKNOWLEDGEMENT || len != 2 || | |
1275 | res != EAP_TLV_RESULT_SUCCESS) { | |
1276 | wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV did not " | |
1277 | "contain acknowledgement"); | |
1278 | eap_fast_state(data, FAILURE); | |
1279 | return; | |
1280 | } | |
1281 | ||
1282 | wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Acknowledgement received " | |
1283 | "- PAC provisioning succeeded"); | |
36100718 JM |
1284 | eap_fast_state(data, (data->anon_provisioning || |
1285 | data->send_new_pac == 2) ? | |
6fc6879b JM |
1286 | FAILURE : SUCCESS); |
1287 | return; | |
1288 | } | |
1289 | ||
6fc6879b JM |
1290 | if (check_crypto_binding) { |
1291 | if (tlv.crypto_binding == NULL) { | |
1292 | wpa_printf(MSG_DEBUG, "EAP-FAST: No Crypto-Binding " | |
1293 | "TLV received"); | |
1294 | eap_fast_state(data, FAILURE); | |
1295 | return; | |
1296 | } | |
1297 | ||
1298 | if (data->final_result && | |
1299 | tlv.result != EAP_TLV_RESULT_SUCCESS) { | |
1300 | wpa_printf(MSG_DEBUG, "EAP-FAST: Crypto-Binding TLV " | |
1301 | "without Success Result"); | |
1302 | eap_fast_state(data, FAILURE); | |
1303 | return; | |
1304 | } | |
1305 | ||
1306 | if (!data->final_result && | |
1307 | tlv.iresult != EAP_TLV_RESULT_SUCCESS) { | |
1308 | wpa_printf(MSG_DEBUG, "EAP-FAST: Crypto-Binding TLV " | |
1309 | "without intermediate Success Result"); | |
1310 | eap_fast_state(data, FAILURE); | |
1311 | return; | |
1312 | } | |
1313 | ||
1314 | if (eap_fast_validate_crypto_binding(data, tlv.crypto_binding, | |
1315 | tlv.crypto_binding_len)) { | |
1316 | eap_fast_state(data, FAILURE); | |
1317 | return; | |
1318 | } | |
1319 | ||
1320 | wpa_printf(MSG_DEBUG, "EAP-FAST: Valid Crypto-Binding TLV " | |
7914585f JM |
1321 | "received"); |
1322 | if (data->final_result) { | |
1323 | wpa_printf(MSG_DEBUG, "EAP-FAST: Authentication " | |
1324 | "completed successfully"); | |
1325 | } | |
6fc6879b | 1326 | |
378eae5e JM |
1327 | if (data->anon_provisioning && |
1328 | sm->eap_fast_prov != ANON_PROV && | |
1329 | sm->eap_fast_prov != BOTH_PROV) { | |
1330 | wpa_printf(MSG_DEBUG, "EAP-FAST: Client is trying to " | |
1331 | "use unauthenticated provisioning which is " | |
1332 | "disabled"); | |
1333 | eap_fast_state(data, FAILURE); | |
1334 | return; | |
1335 | } | |
1336 | ||
1337 | if (sm->eap_fast_prov != AUTH_PROV && | |
1338 | sm->eap_fast_prov != BOTH_PROV && | |
1339 | tlv.request_action == EAP_TLV_ACTION_PROCESS_TLV && | |
1340 | eap_fast_pac_type(tlv.pac, tlv.pac_len, | |
1341 | PAC_TYPE_TUNNEL_PAC)) { | |
1342 | wpa_printf(MSG_DEBUG, "EAP-FAST: Client is trying to " | |
1343 | "use authenticated provisioning which is " | |
1344 | "disabled"); | |
1345 | eap_fast_state(data, FAILURE); | |
1346 | return; | |
1347 | } | |
1348 | ||
6fc6879b JM |
1349 | if (data->anon_provisioning || |
1350 | (tlv.request_action == EAP_TLV_ACTION_PROCESS_TLV && | |
1351 | eap_fast_pac_type(tlv.pac, tlv.pac_len, | |
1352 | PAC_TYPE_TUNNEL_PAC))) { | |
1353 | wpa_printf(MSG_DEBUG, "EAP-FAST: Requested a new " | |
1354 | "Tunnel PAC"); | |
1355 | eap_fast_state(data, REQUEST_PAC); | |
1356 | } else if (data->send_new_pac) { | |
1357 | wpa_printf(MSG_DEBUG, "EAP-FAST: Server triggered " | |
1358 | "re-keying of Tunnel PAC"); | |
1359 | eap_fast_state(data, REQUEST_PAC); | |
7914585f | 1360 | } else if (data->final_result) |
6fc6879b JM |
1361 | eap_fast_state(data, SUCCESS); |
1362 | } | |
7914585f JM |
1363 | |
1364 | if (tlv.eap_payload_tlv) { | |
1365 | eap_fast_process_phase2_eap(sm, data, tlv.eap_payload_tlv, | |
1366 | tlv.eap_payload_tlv_len); | |
1367 | } | |
6fc6879b JM |
1368 | } |
1369 | ||
1370 | ||
1371 | static void eap_fast_process_phase2(struct eap_sm *sm, | |
1372 | struct eap_fast_data *data, | |
34f564db | 1373 | struct wpabuf *in_buf) |
6fc6879b | 1374 | { |
81c85c06 | 1375 | struct wpabuf *in_decrypted; |
6fc6879b JM |
1376 | |
1377 | wpa_printf(MSG_DEBUG, "EAP-FAST: Received %lu bytes encrypted data for" | |
81c85c06 | 1378 | " Phase 2", (unsigned long) wpabuf_len(in_buf)); |
6fc6879b JM |
1379 | |
1380 | if (data->pending_phase2_resp) { | |
1381 | wpa_printf(MSG_DEBUG, "EAP-PEAP: Pending Phase 2 response - " | |
1382 | "skip decryption and use old data"); | |
81c85c06 JM |
1383 | eap_fast_process_phase2_tlvs(sm, data, |
1384 | data->pending_phase2_resp); | |
6fc6879b JM |
1385 | wpabuf_free(data->pending_phase2_resp); |
1386 | data->pending_phase2_resp = NULL; | |
1387 | return; | |
1388 | } | |
1389 | ||
81c85c06 JM |
1390 | in_decrypted = tls_connection_decrypt(sm->ssl_ctx, data->ssl.conn, |
1391 | in_buf); | |
6fc6879b | 1392 | if (in_decrypted == NULL) { |
6fc6879b JM |
1393 | wpa_printf(MSG_INFO, "EAP-FAST: Failed to decrypt Phase 2 " |
1394 | "data"); | |
6fc6879b JM |
1395 | eap_fast_state(data, FAILURE); |
1396 | return; | |
1397 | } | |
1398 | ||
81c85c06 JM |
1399 | wpa_hexdump_buf_key(MSG_DEBUG, "EAP-FAST: Decrypted Phase 2 TLVs", |
1400 | in_decrypted); | |
6fc6879b | 1401 | |
81c85c06 | 1402 | eap_fast_process_phase2_tlvs(sm, data, in_decrypted); |
6fc6879b JM |
1403 | |
1404 | if (sm->method_pending == METHOD_PENDING_WAIT) { | |
1405 | wpa_printf(MSG_DEBUG, "EAP-FAST: Phase2 method is in " | |
1406 | "pending wait state - save decrypted response"); | |
1407 | wpabuf_free(data->pending_phase2_resp); | |
81c85c06 JM |
1408 | data->pending_phase2_resp = in_decrypted; |
1409 | return; | |
6fc6879b JM |
1410 | } |
1411 | ||
81c85c06 | 1412 | wpabuf_free(in_decrypted); |
6fc6879b JM |
1413 | } |
1414 | ||
1415 | ||
cda97d11 | 1416 | static int eap_fast_process_version(struct eap_sm *sm, void *priv, |
cdd1bc92 JM |
1417 | int peer_version) |
1418 | { | |
cda97d11 JM |
1419 | struct eap_fast_data *data = priv; |
1420 | ||
cdd1bc92 JM |
1421 | data->peer_version = peer_version; |
1422 | ||
1423 | if (data->force_version >= 0 && peer_version != data->force_version) { | |
1424 | wpa_printf(MSG_INFO, "EAP-FAST: peer did not select the forced" | |
1425 | " version (forced=%d peer=%d) - reject", | |
1426 | data->force_version, peer_version); | |
cdd1bc92 JM |
1427 | return -1; |
1428 | } | |
1429 | ||
1430 | if (peer_version < data->fast_version) { | |
1431 | wpa_printf(MSG_DEBUG, "EAP-FAST: peer ver=%d, own ver=%d; " | |
1432 | "use version %d", | |
1433 | peer_version, data->fast_version, peer_version); | |
1434 | data->fast_version = peer_version; | |
1435 | } | |
1436 | ||
1437 | return 0; | |
1438 | } | |
1439 | ||
1440 | ||
cdd1bc92 | 1441 | static int eap_fast_process_phase1(struct eap_sm *sm, |
34f564db | 1442 | struct eap_fast_data *data) |
cdd1bc92 | 1443 | { |
34f564db | 1444 | if (eap_server_tls_phase1(sm, &data->ssl) < 0) { |
cdd1bc92 JM |
1445 | wpa_printf(MSG_INFO, "EAP-FAST: TLS processing failed"); |
1446 | eap_fast_state(data, FAILURE); | |
1447 | return -1; | |
1448 | } | |
1449 | ||
1450 | if (!tls_connection_established(sm->ssl_ctx, data->ssl.conn) || | |
34f564db | 1451 | wpabuf_len(data->ssl.out_buf) > 0) |
cdd1bc92 JM |
1452 | return 1; |
1453 | ||
1454 | /* | |
1455 | * Phase 1 was completed with the received message (e.g., when using | |
1456 | * abbreviated handshake), so Phase 2 can be started immediately | |
1457 | * without having to send through an empty message to the peer. | |
1458 | */ | |
1459 | ||
1460 | return eap_fast_phase1_done(sm, data); | |
1461 | } | |
1462 | ||
1463 | ||
c479e41f JM |
1464 | static int eap_fast_process_phase2_start(struct eap_sm *sm, |
1465 | struct eap_fast_data *data) | |
cdd1bc92 JM |
1466 | { |
1467 | u8 next_type; | |
1468 | ||
1469 | if (data->identity) { | |
1470 | os_free(sm->identity); | |
1471 | sm->identity = data->identity; | |
1472 | data->identity = NULL; | |
1473 | sm->identity_len = data->identity_len; | |
1474 | data->identity_len = 0; | |
13b3f339 | 1475 | sm->require_identity_match = 1; |
cdd1bc92 JM |
1476 | if (eap_user_get(sm, sm->identity, sm->identity_len, 1) != 0) { |
1477 | wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: " | |
1478 | "Phase2 Identity not found " | |
1479 | "in the user database", | |
1480 | sm->identity, sm->identity_len); | |
1481 | next_type = eap_fast_req_failure(sm, data); | |
1482 | } else { | |
1483 | wpa_printf(MSG_DEBUG, "EAP-FAST: Identity already " | |
1484 | "known - skip Phase 2 Identity Request"); | |
1485 | next_type = sm->user->methods[0].method; | |
1486 | sm->user_eap_method_index = 1; | |
1487 | } | |
1488 | ||
1489 | eap_fast_state(data, PHASE2_METHOD); | |
1490 | } else { | |
1491 | eap_fast_state(data, PHASE2_ID); | |
1492 | next_type = EAP_TYPE_IDENTITY; | |
1493 | } | |
1494 | ||
c479e41f | 1495 | return eap_fast_phase2_init(sm, data, next_type); |
cdd1bc92 JM |
1496 | } |
1497 | ||
1498 | ||
cda97d11 JM |
1499 | static void eap_fast_process_msg(struct eap_sm *sm, void *priv, |
1500 | const struct wpabuf *respData) | |
6fc6879b JM |
1501 | { |
1502 | struct eap_fast_data *data = priv; | |
6fc6879b JM |
1503 | |
1504 | switch (data->state) { | |
1505 | case PHASE1: | |
34f564db | 1506 | if (eap_fast_process_phase1(sm, data)) |
6fc6879b JM |
1507 | break; |
1508 | ||
1509 | /* fall through to PHASE2_START */ | |
1510 | case PHASE2_START: | |
cdd1bc92 | 1511 | eap_fast_process_phase2_start(sm, data); |
6fc6879b JM |
1512 | break; |
1513 | case PHASE2_ID: | |
1514 | case PHASE2_METHOD: | |
1515 | case CRYPTO_BINDING: | |
1516 | case REQUEST_PAC: | |
34f564db | 1517 | eap_fast_process_phase2(sm, data, data->ssl.in_buf); |
6fc6879b JM |
1518 | break; |
1519 | default: | |
1520 | wpa_printf(MSG_DEBUG, "EAP-FAST: Unexpected state %d in %s", | |
1521 | data->state, __func__); | |
1522 | break; | |
1523 | } | |
cda97d11 | 1524 | } |
6fc6879b | 1525 | |
34f564db | 1526 | |
cda97d11 JM |
1527 | static void eap_fast_process(struct eap_sm *sm, void *priv, |
1528 | struct wpabuf *respData) | |
1529 | { | |
1530 | struct eap_fast_data *data = priv; | |
1531 | if (eap_server_tls_process(sm, &data->ssl, respData, data, | |
1532 | EAP_TYPE_FAST, eap_fast_process_version, | |
1533 | eap_fast_process_msg) < 0) | |
1534 | eap_fast_state(data, FAILURE); | |
6fc6879b JM |
1535 | } |
1536 | ||
1537 | ||
1538 | static Boolean eap_fast_isDone(struct eap_sm *sm, void *priv) | |
1539 | { | |
1540 | struct eap_fast_data *data = priv; | |
1541 | return data->state == SUCCESS || data->state == FAILURE; | |
1542 | } | |
1543 | ||
1544 | ||
1545 | static u8 * eap_fast_getKey(struct eap_sm *sm, void *priv, size_t *len) | |
1546 | { | |
1547 | struct eap_fast_data *data = priv; | |
1548 | u8 *eapKeyData; | |
1549 | ||
1550 | if (data->state != SUCCESS) | |
1551 | return NULL; | |
1552 | ||
6fc6879b JM |
1553 | eapKeyData = os_malloc(EAP_FAST_KEY_LEN); |
1554 | if (eapKeyData == NULL) | |
1555 | return NULL; | |
1556 | ||
7f4c1d43 | 1557 | eap_fast_derive_eap_msk(data->simck, eapKeyData); |
6fc6879b JM |
1558 | *len = EAP_FAST_KEY_LEN; |
1559 | ||
1560 | return eapKeyData; | |
1561 | } | |
1562 | ||
1563 | ||
1564 | static u8 * eap_fast_get_emsk(struct eap_sm *sm, void *priv, size_t *len) | |
1565 | { | |
1566 | struct eap_fast_data *data = priv; | |
1567 | u8 *eapKeyData; | |
1568 | ||
1569 | if (data->state != SUCCESS) | |
1570 | return NULL; | |
1571 | ||
6fc6879b JM |
1572 | eapKeyData = os_malloc(EAP_EMSK_LEN); |
1573 | if (eapKeyData == NULL) | |
1574 | return NULL; | |
1575 | ||
7f4c1d43 | 1576 | eap_fast_derive_eap_emsk(data->simck, eapKeyData); |
6fc6879b JM |
1577 | *len = EAP_EMSK_LEN; |
1578 | ||
1579 | return eapKeyData; | |
1580 | } | |
1581 | ||
1582 | ||
1583 | static Boolean eap_fast_isSuccess(struct eap_sm *sm, void *priv) | |
1584 | { | |
1585 | struct eap_fast_data *data = priv; | |
1586 | return data->state == SUCCESS; | |
1587 | } | |
1588 | ||
1589 | ||
1590 | int eap_server_fast_register(void) | |
1591 | { | |
1592 | struct eap_method *eap; | |
1593 | int ret; | |
1594 | ||
1595 | eap = eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION, | |
1596 | EAP_VENDOR_IETF, EAP_TYPE_FAST, "FAST"); | |
1597 | if (eap == NULL) | |
1598 | return -1; | |
1599 | ||
1600 | eap->init = eap_fast_init; | |
1601 | eap->reset = eap_fast_reset; | |
1602 | eap->buildReq = eap_fast_buildReq; | |
1603 | eap->check = eap_fast_check; | |
1604 | eap->process = eap_fast_process; | |
1605 | eap->isDone = eap_fast_isDone; | |
1606 | eap->getKey = eap_fast_getKey; | |
1607 | eap->get_emsk = eap_fast_get_emsk; | |
1608 | eap->isSuccess = eap_fast_isSuccess; | |
1609 | ||
1610 | ret = eap_server_method_register(eap); | |
1611 | if (ret) | |
1612 | eap_server_method_free(eap); | |
1613 | return ret; | |
1614 | } |