2 * EAP-FAST server (RFC 4851)
3 * Copyright (c) 2004-2008, Jouni Malinen <j@w1.fi>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Alternatively, this software may be distributed under the terms of BSD
12 * See README and COPYING for more details.
21 #include "eap_tls_common.h"
23 #include "eap_common/eap_tlv_common.h"
24 #include "eap_common/eap_fast_common.h"
27 static void eap_fast_reset(struct eap_sm
*sm
, void *priv
);
30 /* Private PAC-Opaque TLV types */
31 #define PAC_OPAQUE_TYPE_PAD 0
32 #define PAC_OPAQUE_TYPE_KEY 1
33 #define PAC_OPAQUE_TYPE_LIFETIME 2
34 #define PAC_OPAQUE_TYPE_IDENTITY 3
36 /* PAC-Key lifetime in seconds (hard limit) */
37 #define PAC_KEY_LIFETIME (7 * 24 * 60 * 60)
40 * PAC-Key refresh time in seconds (soft limit on remaining hard limit). The
41 * server will generate a new PAC-Key when this number of seconds (or fewer)
44 #define PAC_KEY_REFRESH_TIME (1 * 24 * 60 * 60)
47 struct eap_fast_data
{
48 struct eap_ssl_data ssl
;
50 START
, PHASE1
, PHASE2_START
, PHASE2_ID
, PHASE2_METHOD
,
51 CRYPTO_BINDING
, REQUEST_PAC
, SUCCESS
, FAILURE
55 const struct eap_method
*phase2_method
;
60 u8 crypto_binding_nonce
[32];
63 struct eap_fast_key_block_provisioning
*key_block_p
;
65 u8 simck
[EAP_FAST_SIMCK_LEN
];
66 u8 cmk
[EAP_FAST_CMK_LEN
];
69 u8 pac_opaque_encr
[16];
72 int anon_provisioning
;
73 int send_new_pac
; /* server triggered re-keying of Tunnel PAC */
74 struct wpabuf
*pending_phase2_resp
;
75 u8
*identity
; /* from PAC-Opaque */
81 static const char * eap_fast_state_txt(int state
)
89 return "PHASE2_START";
93 return "PHASE2_METHOD";
95 return "CRYPTO_BINDING";
108 static void eap_fast_state(struct eap_fast_data
*data
, int state
)
110 wpa_printf(MSG_DEBUG
, "EAP-FAST: %s -> %s",
111 eap_fast_state_txt(data
->state
),
112 eap_fast_state_txt(state
));
117 static EapType
eap_fast_req_failure(struct eap_sm
*sm
,
118 struct eap_fast_data
*data
)
120 /* TODO: send Result TLV(FAILURE) */
121 eap_fast_state(data
, FAILURE
);
122 return EAP_TYPE_NONE
;
126 static int eap_fast_session_ticket_cb(void *ctx
, const u8
*ticket
, size_t len
,
127 const u8
*client_random
,
128 const u8
*server_random
,
131 struct eap_fast_data
*data
= ctx
;
132 const u8
*pac_opaque
;
133 size_t pac_opaque_len
;
134 u8
*buf
, *pos
, *end
, *pac_key
= NULL
;
135 os_time_t lifetime
= 0;
138 size_t identity_len
= 0;
140 wpa_printf(MSG_DEBUG
, "EAP-FAST: SessionTicket callback");
141 wpa_hexdump(MSG_DEBUG
, "EAP-FAST: SessionTicket (PAC-Opaque)",
144 if (len
< 4 || WPA_GET_BE16(ticket
) != PAC_TYPE_PAC_OPAQUE
) {
145 wpa_printf(MSG_DEBUG
, "EAP-FAST: Ignore invalid "
150 pac_opaque_len
= WPA_GET_BE16(ticket
+ 2);
151 pac_opaque
= ticket
+ 4;
152 if (pac_opaque_len
< 8 || pac_opaque_len
% 8 ||
153 pac_opaque_len
> len
- 4) {
154 wpa_printf(MSG_DEBUG
, "EAP-FAST: Ignore invalid PAC-Opaque "
155 "(len=%lu left=%lu)",
156 (unsigned long) pac_opaque_len
,
157 (unsigned long) len
);
160 wpa_hexdump(MSG_DEBUG
, "EAP-FAST: Received PAC-Opaque",
161 pac_opaque
, pac_opaque_len
);
163 buf
= os_malloc(pac_opaque_len
- 8);
165 wpa_printf(MSG_DEBUG
, "EAP-FAST: Failed to allocate memory "
166 "for decrypting PAC-Opaque");
170 if (aes_unwrap(data
->pac_opaque_encr
, (pac_opaque_len
- 8) / 8,
171 pac_opaque
, buf
) < 0) {
172 wpa_printf(MSG_DEBUG
, "EAP-FAST: Failed to decrypt "
176 * This may have been caused by server changing the PAC-Opaque
177 * encryption key, so just ignore this PAC-Opaque instead of
178 * failing the authentication completely. Provisioning can now
179 * be used to provision a new PAC.
184 end
= buf
+ pac_opaque_len
- 8;
185 wpa_hexdump_key(MSG_DEBUG
, "EAP-FAST: Decrypted PAC-Opaque",
189 while (pos
+ 1 < end
) {
190 if (pos
+ 2 + pos
[1] > end
)
194 case PAC_OPAQUE_TYPE_PAD
:
197 case PAC_OPAQUE_TYPE_KEY
:
198 if (pos
[1] != EAP_FAST_PAC_KEY_LEN
) {
199 wpa_printf(MSG_DEBUG
, "EAP-FAST: Invalid "
200 "PAC-Key length %d", pos
[1]);
205 wpa_hexdump_key(MSG_DEBUG
, "EAP-FAST: PAC-Key from "
206 "decrypted PAC-Opaque",
207 pac_key
, EAP_FAST_PAC_KEY_LEN
);
209 case PAC_OPAQUE_TYPE_LIFETIME
:
211 wpa_printf(MSG_DEBUG
, "EAP-FAST: Invalid "
212 "PAC-Key lifetime length %d",
217 lifetime
= WPA_GET_BE32(pos
+ 2);
219 case PAC_OPAQUE_TYPE_IDENTITY
:
221 identity_len
= pos
[1];
228 if (pac_key
== NULL
) {
229 wpa_printf(MSG_DEBUG
, "EAP-FAST: No PAC-Key included in "
236 wpa_hexdump_ascii(MSG_DEBUG
, "EAP-FAST: Identity from "
237 "PAC-Opaque", identity
, identity_len
);
238 os_free(data
->identity
);
239 data
->identity
= os_malloc(identity_len
);
240 if (data
->identity
) {
241 os_memcpy(data
->identity
, identity
, identity_len
);
242 data
->identity_len
= identity_len
;
246 if (os_get_time(&now
) < 0 || lifetime
<= 0 || now
.sec
> lifetime
) {
247 wpa_printf(MSG_DEBUG
, "EAP-FAST: PAC-Key not valid anymore "
248 "(lifetime=%ld now=%ld)", lifetime
, now
.sec
);
253 if (lifetime
- now
.sec
< PAC_KEY_REFRESH_TIME
)
254 data
->send_new_pac
= 1;
256 eap_fast_derive_master_secret(pac_key
, server_random
, client_random
,
265 static void eap_fast_derive_key_auth(struct eap_sm
*sm
,
266 struct eap_fast_data
*data
)
270 /* RFC 4851, Section 5.1:
271 * Extra key material after TLS key_block: session_key_seed[40]
274 sks
= eap_fast_derive_key(sm
->ssl_ctx
, data
->ssl
.conn
, "key expansion",
277 wpa_printf(MSG_DEBUG
, "EAP-FAST: Failed to derive "
283 * RFC 4851, Section 5.2:
284 * S-IMCK[0] = session_key_seed
286 wpa_hexdump_key(MSG_DEBUG
,
287 "EAP-FAST: session_key_seed (SKS = S-IMCK[0])",
288 sks
, EAP_FAST_SKS_LEN
);
290 os_memcpy(data
->simck
, sks
, EAP_FAST_SIMCK_LEN
);
295 static void eap_fast_derive_key_provisioning(struct eap_sm
*sm
,
296 struct eap_fast_data
*data
)
298 os_free(data
->key_block_p
);
299 data
->key_block_p
= (struct eap_fast_key_block_provisioning
*)
300 eap_fast_derive_key(sm
->ssl_ctx
, data
->ssl
.conn
,
302 sizeof(*data
->key_block_p
));
303 if (data
->key_block_p
== NULL
) {
304 wpa_printf(MSG_DEBUG
, "EAP-FAST: Failed to derive key block");
308 * RFC 4851, Section 5.2:
309 * S-IMCK[0] = session_key_seed
311 wpa_hexdump_key(MSG_DEBUG
,
312 "EAP-FAST: session_key_seed (SKS = S-IMCK[0])",
313 data
->key_block_p
->session_key_seed
,
314 sizeof(data
->key_block_p
->session_key_seed
));
316 os_memcpy(data
->simck
, data
->key_block_p
->session_key_seed
,
318 wpa_hexdump_key(MSG_DEBUG
, "EAP-FAST: server_challenge",
319 data
->key_block_p
->server_challenge
,
320 sizeof(data
->key_block_p
->server_challenge
));
321 wpa_hexdump_key(MSG_DEBUG
, "EAP-FAST: client_challenge",
322 data
->key_block_p
->client_challenge
,
323 sizeof(data
->key_block_p
->client_challenge
));
327 static int eap_fast_get_phase2_key(struct eap_sm
*sm
,
328 struct eap_fast_data
*data
,
329 u8
*isk
, size_t isk_len
)
334 os_memset(isk
, 0, isk_len
);
336 if (data
->phase2_method
== NULL
|| data
->phase2_priv
== NULL
) {
337 wpa_printf(MSG_DEBUG
, "EAP-FAST: Phase 2 method not "
342 if (data
->phase2_method
->getKey
== NULL
)
345 if ((key
= data
->phase2_method
->getKey(sm
, data
->phase2_priv
,
346 &key_len
)) == NULL
) {
347 wpa_printf(MSG_DEBUG
, "EAP-FAST: Could not get key material "
352 if (key_len
> isk_len
)
354 os_memcpy(isk
, key
, key_len
);
361 static int eap_fast_update_icmk(struct eap_sm
*sm
, struct eap_fast_data
*data
)
363 u8 isk
[32], imck
[60];
365 wpa_printf(MSG_DEBUG
, "EAP-FAST: Deriving ICMK[%d] (S-IMCK and CMK)",
366 data
->simck_idx
+ 1);
369 * RFC 4851, Section 5.2:
370 * IMCK[j] = T-PRF(S-IMCK[j-1], "Inner Methods Compound Keys",
372 * S-IMCK[j] = first 40 octets of IMCK[j]
373 * CMK[j] = last 20 octets of IMCK[j]
376 if (eap_fast_get_phase2_key(sm
, data
, isk
, sizeof(isk
)) < 0)
378 wpa_hexdump_key(MSG_MSGDUMP
, "EAP-FAST: ISK[j]", isk
, sizeof(isk
));
379 sha1_t_prf(data
->simck
, EAP_FAST_SIMCK_LEN
,
380 "Inner Methods Compound Keys",
381 isk
, sizeof(isk
), imck
, sizeof(imck
));
383 os_memcpy(data
->simck
, imck
, EAP_FAST_SIMCK_LEN
);
384 wpa_hexdump_key(MSG_MSGDUMP
, "EAP-FAST: S-IMCK[j]",
385 data
->simck
, EAP_FAST_SIMCK_LEN
);
386 os_memcpy(data
->cmk
, imck
+ EAP_FAST_SIMCK_LEN
, EAP_FAST_CMK_LEN
);
387 wpa_hexdump_key(MSG_MSGDUMP
, "EAP-FAST: CMK[j]",
388 data
->cmk
, EAP_FAST_CMK_LEN
);
394 static void * eap_fast_init(struct eap_sm
*sm
)
396 struct eap_fast_data
*data
;
398 TLS_CIPHER_ANON_DH_AES128_SHA
,
399 TLS_CIPHER_AES128_SHA
,
400 TLS_CIPHER_RSA_DHE_AES128_SHA
,
405 data
= os_zalloc(sizeof(*data
));
408 data
->fast_version
= EAP_FAST_VERSION
;
409 data
->force_version
= -1;
410 if (sm
->user
&& sm
->user
->force_version
>= 0) {
411 data
->force_version
= sm
->user
->force_version
;
412 wpa_printf(MSG_DEBUG
, "EAP-FAST: forcing version %d",
413 data
->force_version
);
414 data
->fast_version
= data
->force_version
;
418 if (eap_server_tls_ssl_init(sm
, &data
->ssl
, 0)) {
419 wpa_printf(MSG_INFO
, "EAP-FAST: Failed to initialize SSL.");
420 eap_fast_reset(sm
, data
);
424 if (tls_connection_set_cipher_list(sm
->ssl_ctx
, data
->ssl
.conn
,
426 wpa_printf(MSG_INFO
, "EAP-FAST: Failed to set TLS cipher "
428 eap_fast_reset(sm
, data
);
432 if (tls_connection_set_session_ticket_cb(sm
->ssl_ctx
, data
->ssl
.conn
,
433 eap_fast_session_ticket_cb
,
435 wpa_printf(MSG_INFO
, "EAP-FAST: Failed to set SessionTicket "
437 eap_fast_reset(sm
, data
);
441 if (sm
->pac_opaque_encr_key
== NULL
) {
442 wpa_printf(MSG_INFO
, "EAP-FAST: No PAC-Opaque encryption key "
444 eap_fast_reset(sm
, data
);
447 os_memcpy(data
->pac_opaque_encr
, sm
->pac_opaque_encr_key
,
448 sizeof(data
->pac_opaque_encr
));
450 if (sm
->eap_fast_a_id
== NULL
) {
451 wpa_printf(MSG_INFO
, "EAP-FAST: No A-ID configured");
452 eap_fast_reset(sm
, data
);
455 data
->srv_id
= os_strdup(sm
->eap_fast_a_id
);
456 if (data
->srv_id
== NULL
) {
457 eap_fast_reset(sm
, data
);
465 static void eap_fast_reset(struct eap_sm
*sm
, void *priv
)
467 struct eap_fast_data
*data
= priv
;
470 if (data
->phase2_priv
&& data
->phase2_method
)
471 data
->phase2_method
->reset(sm
, data
->phase2_priv
);
472 eap_server_tls_ssl_deinit(sm
, &data
->ssl
);
473 os_free(data
->srv_id
);
474 os_free(data
->key_block_p
);
475 wpabuf_free(data
->pending_phase2_resp
);
476 os_free(data
->identity
);
481 static struct wpabuf
* eap_fast_build_start(struct eap_sm
*sm
,
482 struct eap_fast_data
*data
, u8 id
)
485 size_t srv_id_len
= os_strlen(data
->srv_id
);
487 req
= eap_msg_alloc(EAP_VENDOR_IETF
, EAP_TYPE_FAST
,
488 1 + sizeof(struct pac_tlv_hdr
) + srv_id_len
,
489 EAP_CODE_REQUEST
, id
);
491 wpa_printf(MSG_ERROR
, "EAP-FAST: Failed to allocate memory for"
493 eap_fast_state(data
, FAILURE
);
497 wpabuf_put_u8(req
, EAP_TLS_FLAGS_START
| data
->fast_version
);
499 /* RFC 4851, 4.1.1. Authority ID Data */
500 eap_fast_put_tlv(req
, PAC_TYPE_A_ID
, data
->srv_id
, srv_id_len
);
502 eap_fast_state(data
, PHASE1
);
508 static int eap_fast_phase1_done(struct eap_sm
*sm
, struct eap_fast_data
*data
)
512 wpa_printf(MSG_DEBUG
, "EAP-FAST: Phase1 done, starting Phase2");
514 if (tls_get_cipher(sm
->ssl_ctx
, data
->ssl
.conn
, cipher
, sizeof(cipher
))
516 wpa_printf(MSG_DEBUG
, "EAP-FAST: Failed to get cipher "
518 eap_fast_state(data
, FAILURE
);
521 data
->anon_provisioning
= os_strstr(cipher
, "ADH") != NULL
;
523 if (data
->anon_provisioning
) {
524 wpa_printf(MSG_DEBUG
, "EAP-FAST: Anonymous provisioning");
525 eap_fast_derive_key_provisioning(sm
, data
);
527 eap_fast_derive_key_auth(sm
, data
);
529 eap_fast_state(data
, PHASE2_START
);
535 static struct wpabuf
* eap_fast_build_req(struct eap_sm
*sm
,
536 struct eap_fast_data
*data
, u8 id
)
541 res
= eap_server_tls_buildReq_helper(sm
, &data
->ssl
, EAP_TYPE_FAST
,
542 data
->fast_version
, id
, &req
);
544 if (tls_connection_established(sm
->ssl_ctx
, data
->ssl
.conn
)) {
545 if (eap_fast_phase1_done(sm
, data
) < 0) {
552 return eap_server_tls_build_ack(id
, EAP_TYPE_FAST
,
558 static struct wpabuf
* eap_fast_encrypt(struct eap_sm
*sm
,
559 struct eap_fast_data
*data
,
560 u8 id
, u8
*plain
, size_t plain_len
)
565 /* TODO: add support for fragmentation, if needed. This will need to
566 * add TLS Message Length field, if the frame is fragmented. */
567 buf
= eap_msg_alloc(EAP_VENDOR_IETF
, EAP_TYPE_FAST
,
568 1 + data
->ssl
.tls_out_limit
,
569 EAP_CODE_REQUEST
, id
);
573 wpabuf_put_u8(buf
, data
->fast_version
);
575 res
= tls_connection_encrypt(sm
->ssl_ctx
, data
->ssl
.conn
,
576 plain
, plain_len
, wpabuf_put(buf
, 0),
577 data
->ssl
.tls_out_limit
);
579 wpa_printf(MSG_INFO
, "EAP-FAST: Failed to encrypt Phase 2 "
585 wpabuf_put(buf
, res
);
592 static struct wpabuf
* eap_fast_build_phase2_req(struct eap_sm
*sm
,
593 struct eap_fast_data
*data
,
598 if (data
->phase2_priv
== NULL
) {
599 wpa_printf(MSG_DEBUG
, "EAP-FAST: Phase 2 method not "
603 req
= data
->phase2_method
->buildReq(sm
, data
->phase2_priv
, id
);
607 wpa_hexdump_buf_key(MSG_MSGDUMP
, "EAP-FAST: Phase 2 EAP-Request", req
);
608 return eap_fast_tlv_eap_payload(req
);
612 static struct wpabuf
* eap_fast_build_crypto_binding(
613 struct eap_sm
*sm
, struct eap_fast_data
*data
)
616 struct eap_tlv_result_tlv
*result
;
617 struct eap_tlv_crypto_binding_tlv
*binding
;
619 buf
= wpabuf_alloc(2 * sizeof(*result
) + sizeof(*binding
));
623 if (data
->send_new_pac
|| data
->anon_provisioning
||
625 data
->final_result
= 0;
627 data
->final_result
= 1;
629 if (!data
->final_result
|| data
->eap_seq
> 1) {
630 /* Intermediate-Result */
631 wpa_printf(MSG_DEBUG
, "EAP-FAST: Add Intermediate-Result TLV "
633 result
= wpabuf_put(buf
, sizeof(*result
));
634 result
->tlv_type
= host_to_be16(
635 EAP_TLV_TYPE_MANDATORY
|
636 EAP_TLV_INTERMEDIATE_RESULT_TLV
);
637 result
->length
= host_to_be16(2);
638 result
->status
= host_to_be16(EAP_TLV_RESULT_SUCCESS
);
641 if (data
->final_result
) {
643 wpa_printf(MSG_DEBUG
, "EAP-FAST: Add Result TLV "
645 result
= wpabuf_put(buf
, sizeof(*result
));
646 result
->tlv_type
= host_to_be16(EAP_TLV_TYPE_MANDATORY
|
648 result
->length
= host_to_be16(2);
649 result
->status
= host_to_be16(EAP_TLV_RESULT_SUCCESS
);
652 /* Crypto-Binding TLV */
653 binding
= wpabuf_put(buf
, sizeof(*binding
));
654 binding
->tlv_type
= host_to_be16(EAP_TLV_TYPE_MANDATORY
|
655 EAP_TLV_CRYPTO_BINDING_TLV
);
656 binding
->length
= host_to_be16(sizeof(*binding
) -
657 sizeof(struct eap_tlv_hdr
));
658 binding
->version
= EAP_FAST_VERSION
;
659 binding
->received_version
= data
->peer_version
;
660 binding
->subtype
= EAP_TLV_CRYPTO_BINDING_SUBTYPE_REQUEST
;
661 if (os_get_random(binding
->nonce
, sizeof(binding
->nonce
)) < 0) {
667 * RFC 4851, Section 4.2.8:
668 * The nonce in a request MUST have its least significant bit set to 0.
670 binding
->nonce
[sizeof(binding
->nonce
) - 1] &= ~0x01;
672 os_memcpy(data
->crypto_binding_nonce
, binding
->nonce
,
673 sizeof(binding
->nonce
));
676 * RFC 4851, Section 5.3:
678 * Compound-MAC = HMAC-SHA1( CMK, Crypto-Binding TLV )
681 hmac_sha1(data
->cmk
, EAP_FAST_CMK_LEN
,
682 (u8
*) binding
, sizeof(*binding
),
683 binding
->compound_mac
);
685 wpa_printf(MSG_DEBUG
, "EAP-FAST: Add Crypto-Binding TLV: Version %d "
686 "Received Version %d SubType %d",
687 binding
->version
, binding
->received_version
,
689 wpa_hexdump(MSG_MSGDUMP
, "EAP-FAST: NONCE",
690 binding
->nonce
, sizeof(binding
->nonce
));
691 wpa_hexdump(MSG_MSGDUMP
, "EAP-FAST: Compound MAC",
692 binding
->compound_mac
, sizeof(binding
->compound_mac
));
698 static struct wpabuf
* eap_fast_build_pac(struct eap_sm
*sm
,
699 struct eap_fast_data
*data
)
701 u8 pac_key
[EAP_FAST_PAC_KEY_LEN
];
702 u8
*pac_buf
, *pac_opaque
;
705 size_t buf_len
, srv_id_len
, pac_len
;
706 struct eap_tlv_hdr
*pac_tlv
;
707 struct pac_tlv_hdr
*pac_info
;
708 struct eap_tlv_result_tlv
*result
;
711 if (os_get_random(pac_key
, EAP_FAST_PAC_KEY_LEN
) < 0 ||
712 os_get_time(&now
) < 0)
714 wpa_hexdump_key(MSG_DEBUG
, "EAP-FAST: Generated PAC-Key",
715 pac_key
, EAP_FAST_PAC_KEY_LEN
);
717 pac_len
= (2 + EAP_FAST_PAC_KEY_LEN
) + (2 + 4) +
718 (2 + sm
->identity_len
) + 8;
719 pac_buf
= os_malloc(pac_len
);
723 srv_id_len
= os_strlen(data
->srv_id
);
726 *pos
++ = PAC_OPAQUE_TYPE_KEY
;
727 *pos
++ = EAP_FAST_PAC_KEY_LEN
;
728 os_memcpy(pos
, pac_key
, EAP_FAST_PAC_KEY_LEN
);
729 pos
+= EAP_FAST_PAC_KEY_LEN
;
731 *pos
++ = PAC_OPAQUE_TYPE_LIFETIME
;
733 WPA_PUT_BE32(pos
, now
.sec
+ PAC_KEY_LIFETIME
);
737 *pos
++ = PAC_OPAQUE_TYPE_IDENTITY
;
738 *pos
++ = sm
->identity_len
;
739 os_memcpy(pos
, sm
->identity
, sm
->identity_len
);
740 pos
+= sm
->identity_len
;
743 pac_len
= pos
- pac_buf
;
745 *pos
++ = PAC_OPAQUE_TYPE_PAD
;
749 pac_opaque
= os_malloc(pac_len
+ 8);
750 if (pac_opaque
== NULL
) {
754 if (aes_wrap(data
->pac_opaque_encr
, pac_len
/ 8, pac_buf
,
763 wpa_hexdump(MSG_DEBUG
, "EAP-FAST: PAC-Opaque",
764 pac_opaque
, pac_len
);
766 buf_len
= sizeof(*pac_tlv
) +
767 sizeof(struct pac_tlv_hdr
) + EAP_FAST_PAC_KEY_LEN
+
768 sizeof(struct pac_tlv_hdr
) + pac_len
+
769 2 * srv_id_len
+ 100 + sizeof(*result
);
770 buf
= wpabuf_alloc(buf_len
);
777 wpa_printf(MSG_DEBUG
, "EAP-FAST: Add PAC TLV");
778 pac_tlv
= wpabuf_put(buf
, sizeof(*pac_tlv
));
779 pac_tlv
->tlv_type
= host_to_be16(EAP_TLV_TYPE_MANDATORY
|
783 eap_fast_put_tlv(buf
, PAC_TYPE_PAC_KEY
, pac_key
, EAP_FAST_PAC_KEY_LEN
);
786 eap_fast_put_tlv(buf
, PAC_TYPE_PAC_OPAQUE
, pac_opaque
, pac_len
);
790 pac_info
= wpabuf_put(buf
, sizeof(*pac_info
));
791 pac_info
->type
= host_to_be16(PAC_TYPE_PAC_INFO
);
793 /* PAC-Lifetime (inside PAC-Info) */
794 eap_fast_put_tlv_hdr(buf
, PAC_TYPE_CRED_LIFETIME
, 4);
795 wpabuf_put_be32(buf
, now
.sec
+ PAC_KEY_LIFETIME
);
797 /* A-ID (inside PAC-Info) */
798 eap_fast_put_tlv(buf
, PAC_TYPE_A_ID
, data
->srv_id
, srv_id_len
);
800 /* Note: headers may be misaligned after A-ID */
802 /* A-ID-Info (inside PAC-Info) */
803 eap_fast_put_tlv(buf
, PAC_TYPE_A_ID_INFO
, data
->srv_id
, srv_id_len
);
805 /* PAC-Type (inside PAC-Info) */
806 eap_fast_put_tlv_hdr(buf
, PAC_TYPE_PAC_TYPE
, 2);
807 wpabuf_put_be16(buf
, PAC_TYPE_TUNNEL_PAC
);
809 /* Update PAC-Info and PAC TLV Length fields */
810 pos
= wpabuf_put(buf
, 0);
811 pac_info
->len
= host_to_be16(pos
- (u8
*) (pac_info
+ 1));
812 pac_tlv
->length
= host_to_be16(pos
- (u8
*) (pac_tlv
+ 1));
815 wpa_printf(MSG_DEBUG
, "EAP-FAST: Add Result TLV (status=SUCCESS)");
816 result
= wpabuf_put(buf
, sizeof(*result
));
817 WPA_PUT_BE16((u8
*) &result
->tlv_type
,
818 EAP_TLV_TYPE_MANDATORY
| EAP_TLV_RESULT_TLV
);
819 WPA_PUT_BE16((u8
*) &result
->length
, 2);
820 WPA_PUT_BE16((u8
*) &result
->status
, EAP_TLV_RESULT_SUCCESS
);
826 static struct wpabuf
* eap_fast_buildReq(struct eap_sm
*sm
, void *priv
, u8 id
)
828 struct eap_fast_data
*data
= priv
;
832 if (data
->state
== START
)
833 return eap_fast_build_start(sm
, data
, id
);
835 if (data
->state
== PHASE1
)
836 return eap_fast_build_req(sm
, data
, id
);
838 switch (data
->state
) {
841 req
= eap_fast_build_phase2_req(sm
, data
, id
);
844 req
= eap_fast_build_crypto_binding(sm
, data
);
845 if (data
->phase2_method
) {
847 * Include the start of the next EAP method in the
848 * sequence in the same message with Crypto-Binding to
852 eap
= eap_fast_build_phase2_req(sm
, data
, id
);
853 req
= wpabuf_concat(req
, eap
);
857 req
= eap_fast_build_pac(sm
, data
);
860 wpa_printf(MSG_DEBUG
, "EAP-FAST: %s - unexpected state %d",
861 __func__
, data
->state
);
868 wpa_hexdump_buf_key(MSG_DEBUG
, "EAP-FAST: Encrypting Phase 2 TLVs",
870 encr
= eap_fast_encrypt(sm
, data
, id
, wpabuf_mhead(req
),
878 static Boolean
eap_fast_check(struct eap_sm
*sm
, void *priv
,
879 struct wpabuf
*respData
)
884 pos
= eap_hdr_validate(EAP_VENDOR_IETF
, EAP_TYPE_FAST
, respData
, &len
);
885 if (pos
== NULL
|| len
< 1) {
886 wpa_printf(MSG_INFO
, "EAP-FAST: Invalid frame");
894 static int eap_fast_phase2_init(struct eap_sm
*sm
, struct eap_fast_data
*data
,
897 if (data
->phase2_priv
&& data
->phase2_method
) {
898 data
->phase2_method
->reset(sm
, data
->phase2_priv
);
899 data
->phase2_method
= NULL
;
900 data
->phase2_priv
= NULL
;
902 data
->phase2_method
= eap_server_get_eap_method(EAP_VENDOR_IETF
,
904 if (!data
->phase2_method
)
907 if (data
->key_block_p
) {
908 sm
->auth_challenge
= data
->key_block_p
->server_challenge
;
909 sm
->peer_challenge
= data
->key_block_p
->client_challenge
;
912 data
->phase2_priv
= data
->phase2_method
->init(sm
);
914 sm
->auth_challenge
= NULL
;
915 sm
->peer_challenge
= NULL
;
917 return data
->phase2_priv
== NULL
? -1 : 0;
921 static void eap_fast_process_phase2_response(struct eap_sm
*sm
,
922 struct eap_fast_data
*data
,
923 u8
*in_data
, size_t in_len
)
925 u8 next_type
= EAP_TYPE_NONE
;
930 const struct eap_method
*m
= data
->phase2_method
;
931 void *priv
= data
->phase2_priv
;
934 wpa_printf(MSG_DEBUG
, "EAP-FAST: %s - Phase2 not "
935 "initialized?!", __func__
);
939 hdr
= (struct eap_hdr
*) in_data
;
940 pos
= (u8
*) (hdr
+ 1);
942 if (in_len
> sizeof(*hdr
) && *pos
== EAP_TYPE_NAK
) {
943 left
= in_len
- sizeof(*hdr
);
944 wpa_hexdump(MSG_DEBUG
, "EAP-FAST: Phase2 type Nak'ed; "
945 "allowed types", pos
+ 1, left
- 1);
946 eap_sm_process_nak(sm
, pos
+ 1, left
- 1);
947 if (sm
->user
&& sm
->user_eap_method_index
< EAP_MAX_METHODS
&&
948 sm
->user
->methods
[sm
->user_eap_method_index
].method
!=
950 next_type
= sm
->user
->methods
[
951 sm
->user_eap_method_index
++].method
;
952 wpa_printf(MSG_DEBUG
, "EAP-FAST: try EAP type %d",
955 next_type
= eap_fast_req_failure(sm
, data
);
957 eap_fast_phase2_init(sm
, data
, next_type
);
961 wpabuf_set(&buf
, in_data
, in_len
);
963 if (m
->check(sm
, priv
, &buf
)) {
964 wpa_printf(MSG_DEBUG
, "EAP-FAST: Phase2 check() asked to "
965 "ignore the packet");
966 next_type
= eap_fast_req_failure(sm
, data
);
970 m
->process(sm
, priv
, &buf
);
972 if (!m
->isDone(sm
, priv
))
975 if (!m
->isSuccess(sm
, priv
)) {
976 wpa_printf(MSG_DEBUG
, "EAP-FAST: Phase2 method failed");
977 next_type
= eap_fast_req_failure(sm
, data
);
978 eap_fast_phase2_init(sm
, data
, next_type
);
982 switch (data
->state
) {
984 if (eap_user_get(sm
, sm
->identity
, sm
->identity_len
, 1) != 0) {
985 wpa_hexdump_ascii(MSG_DEBUG
, "EAP-FAST: Phase2 "
986 "Identity not found in the user "
988 sm
->identity
, sm
->identity_len
);
989 next_type
= eap_fast_req_failure(sm
, data
);
993 eap_fast_state(data
, PHASE2_METHOD
);
994 if (data
->anon_provisioning
) {
996 * Only EAP-MSCHAPv2 is allowed for anonymous
999 next_type
= EAP_TYPE_MSCHAPV2
;
1000 sm
->user_eap_method_index
= 0;
1002 next_type
= sm
->user
->methods
[0].method
;
1003 sm
->user_eap_method_index
= 1;
1005 wpa_printf(MSG_DEBUG
, "EAP-FAST: try EAP type %d", next_type
);
1008 case CRYPTO_BINDING
:
1009 eap_fast_update_icmk(sm
, data
);
1010 eap_fast_state(data
, CRYPTO_BINDING
);
1012 next_type
= EAP_TYPE_NONE
;
1013 /* TODO: could start another EAP method in sequence by setting
1014 * next_type to the selected method */
1019 wpa_printf(MSG_DEBUG
, "EAP-FAST: %s - unexpected state %d",
1020 __func__
, data
->state
);
1024 eap_fast_phase2_init(sm
, data
, next_type
);
1028 static void eap_fast_process_phase2_eap(struct eap_sm
*sm
,
1029 struct eap_fast_data
*data
,
1030 u8
*in_data
, size_t in_len
)
1032 struct eap_hdr
*hdr
;
1035 hdr
= (struct eap_hdr
*) in_data
;
1036 if (in_len
< (int) sizeof(*hdr
)) {
1037 wpa_printf(MSG_INFO
, "EAP-FAST: Too short Phase 2 "
1038 "EAP frame (len=%d)", in_len
);
1039 eap_fast_req_failure(sm
, data
);
1042 len
= be_to_host16(hdr
->length
);
1044 wpa_printf(MSG_INFO
, "EAP-FAST: Length mismatch in "
1045 "Phase 2 EAP frame (len=%d hdr->length=%d)",
1047 eap_fast_req_failure(sm
, data
);
1050 wpa_printf(MSG_DEBUG
, "EAP-FAST: Received Phase 2: code=%d "
1051 "identifier=%d length=%d", hdr
->code
, hdr
->identifier
, len
);
1052 switch (hdr
->code
) {
1053 case EAP_CODE_RESPONSE
:
1054 eap_fast_process_phase2_response(sm
, data
, (u8
*) hdr
, len
);
1057 wpa_printf(MSG_INFO
, "EAP-FAST: Unexpected code=%d in "
1058 "Phase 2 EAP header", hdr
->code
);
1064 static int eap_fast_parse_tlvs(u8
*data
, size_t data_len
,
1065 struct eap_fast_tlv_parse
*tlv
)
1067 int mandatory
, tlv_type
, len
, res
;
1070 os_memset(tlv
, 0, sizeof(*tlv
));
1073 end
= data
+ data_len
;
1074 while (pos
+ 4 < end
) {
1075 mandatory
= pos
[0] & 0x80;
1076 tlv_type
= WPA_GET_BE16(pos
) & 0x3fff;
1078 len
= WPA_GET_BE16(pos
);
1080 if (pos
+ len
> end
) {
1081 wpa_printf(MSG_INFO
, "EAP-FAST: TLV overflow");
1084 wpa_printf(MSG_DEBUG
, "EAP-FAST: Received Phase 2: "
1085 "TLV type %d length %d%s",
1086 tlv_type
, len
, mandatory
? " (mandatory)" : "");
1088 res
= eap_fast_parse_tlv(tlv
, tlv_type
, pos
, len
);
1093 wpa_printf(MSG_DEBUG
, "EAP-FAST: Nak unknown "
1094 "mandatory TLV type %d", tlv_type
);
1095 /* TODO: generate Nak TLV */
1098 wpa_printf(MSG_DEBUG
, "EAP-FAST: Ignored "
1099 "unknown optional TLV type %d",
1111 static int eap_fast_validate_crypto_binding(
1112 struct eap_fast_data
*data
, struct eap_tlv_crypto_binding_tlv
*b
,
1115 u8 cmac
[SHA1_MAC_LEN
];
1117 wpa_printf(MSG_DEBUG
, "EAP-FAST: Reply Crypto-Binding TLV: "
1118 "Version %d Received Version %d SubType %d",
1119 b
->version
, b
->received_version
, b
->subtype
);
1120 wpa_hexdump(MSG_MSGDUMP
, "EAP-FAST: NONCE",
1121 b
->nonce
, sizeof(b
->nonce
));
1122 wpa_hexdump(MSG_MSGDUMP
, "EAP-FAST: Compound MAC",
1123 b
->compound_mac
, sizeof(b
->compound_mac
));
1125 if (b
->version
!= EAP_FAST_VERSION
||
1126 b
->received_version
!= EAP_FAST_VERSION
) {
1127 wpa_printf(MSG_DEBUG
, "EAP-FAST: Unexpected version "
1128 "in Crypto-Binding: version %d "
1129 "received_version %d", b
->version
,
1130 b
->received_version
);
1134 if (b
->subtype
!= EAP_TLV_CRYPTO_BINDING_SUBTYPE_RESPONSE
) {
1135 wpa_printf(MSG_DEBUG
, "EAP-FAST: Unexpected subtype in "
1136 "Crypto-Binding: %d", b
->subtype
);
1140 if (os_memcmp(data
->crypto_binding_nonce
, b
->nonce
, 31) != 0 ||
1141 (data
->crypto_binding_nonce
[31] | 1) != b
->nonce
[31]) {
1142 wpa_printf(MSG_DEBUG
, "EAP-FAST: Invalid nonce in "
1147 os_memcpy(cmac
, b
->compound_mac
, sizeof(cmac
));
1148 os_memset(b
->compound_mac
, 0, sizeof(cmac
));
1149 wpa_hexdump(MSG_MSGDUMP
, "EAP-FAST: Crypto-Binding TLV for "
1150 "Compound MAC calculation",
1151 (u8
*) b
, bind_len
);
1152 hmac_sha1(data
->cmk
, EAP_FAST_CMK_LEN
, (u8
*) b
, bind_len
,
1154 if (os_memcmp(cmac
, b
->compound_mac
, sizeof(cmac
)) != 0) {
1155 wpa_hexdump(MSG_MSGDUMP
,
1156 "EAP-FAST: Calculated Compound MAC",
1157 b
->compound_mac
, sizeof(cmac
));
1158 wpa_printf(MSG_INFO
, "EAP-FAST: Compound MAC did not "
1167 static int eap_fast_pac_type(u8
*pac
, size_t len
, u16 type
)
1169 struct eap_tlv_pac_type_tlv
*tlv
;
1171 if (pac
== NULL
|| len
!= sizeof(*tlv
))
1174 tlv
= (struct eap_tlv_pac_type_tlv
*) pac
;
1176 return be_to_host16(tlv
->tlv_type
) == PAC_TYPE_PAC_TYPE
&&
1177 be_to_host16(tlv
->length
) == 2 &&
1178 be_to_host16(tlv
->pac_type
) == type
;
1182 static void eap_fast_process_phase2_tlvs(struct eap_sm
*sm
,
1183 struct eap_fast_data
*data
,
1184 u8
*in_data
, size_t in_len
)
1186 struct eap_fast_tlv_parse tlv
;
1187 int check_crypto_binding
= data
->state
== CRYPTO_BINDING
;
1189 if (eap_fast_parse_tlvs(in_data
, in_len
, &tlv
) < 0) {
1190 wpa_printf(MSG_DEBUG
, "EAP-FAST: Failed to parse received "
1195 if (tlv
.result
== EAP_TLV_RESULT_FAILURE
) {
1196 wpa_printf(MSG_DEBUG
, "EAP-FAST: Result TLV indicated "
1198 eap_fast_state(data
, FAILURE
);
1202 if (data
->state
== REQUEST_PAC
) {
1204 if (tlv
.pac
== NULL
|| tlv
.pac_len
< 6) {
1205 wpa_printf(MSG_DEBUG
, "EAP-FAST: No PAC "
1206 "Acknowledgement received");
1207 eap_fast_state(data
, FAILURE
);
1211 type
= WPA_GET_BE16(tlv
.pac
);
1212 len
= WPA_GET_BE16(tlv
.pac
+ 2);
1213 res
= WPA_GET_BE16(tlv
.pac
+ 4);
1215 if (type
!= PAC_TYPE_PAC_ACKNOWLEDGEMENT
|| len
!= 2 ||
1216 res
!= EAP_TLV_RESULT_SUCCESS
) {
1217 wpa_printf(MSG_DEBUG
, "EAP-FAST: PAC TLV did not "
1218 "contain acknowledgement");
1219 eap_fast_state(data
, FAILURE
);
1223 wpa_printf(MSG_DEBUG
, "EAP-FAST: PAC-Acknowledgement received "
1224 "- PAC provisioning succeeded");
1225 eap_fast_state(data
, data
->anon_provisioning
?
1230 if (check_crypto_binding
) {
1231 if (tlv
.crypto_binding
== NULL
) {
1232 wpa_printf(MSG_DEBUG
, "EAP-FAST: No Crypto-Binding "
1234 eap_fast_state(data
, FAILURE
);
1238 if (data
->final_result
&&
1239 tlv
.result
!= EAP_TLV_RESULT_SUCCESS
) {
1240 wpa_printf(MSG_DEBUG
, "EAP-FAST: Crypto-Binding TLV "
1241 "without Success Result");
1242 eap_fast_state(data
, FAILURE
);
1246 if (!data
->final_result
&&
1247 tlv
.iresult
!= EAP_TLV_RESULT_SUCCESS
) {
1248 wpa_printf(MSG_DEBUG
, "EAP-FAST: Crypto-Binding TLV "
1249 "without intermediate Success Result");
1250 eap_fast_state(data
, FAILURE
);
1254 if (eap_fast_validate_crypto_binding(data
, tlv
.crypto_binding
,
1255 tlv
.crypto_binding_len
)) {
1256 eap_fast_state(data
, FAILURE
);
1260 wpa_printf(MSG_DEBUG
, "EAP-FAST: Valid Crypto-Binding TLV "
1262 if (data
->final_result
) {
1263 wpa_printf(MSG_DEBUG
, "EAP-FAST: Authentication "
1264 "completed successfully");
1267 if (data
->anon_provisioning
||
1268 (tlv
.request_action
== EAP_TLV_ACTION_PROCESS_TLV
&&
1269 eap_fast_pac_type(tlv
.pac
, tlv
.pac_len
,
1270 PAC_TYPE_TUNNEL_PAC
))) {
1271 wpa_printf(MSG_DEBUG
, "EAP-FAST: Requested a new "
1273 eap_fast_state(data
, REQUEST_PAC
);
1274 } else if (data
->send_new_pac
) {
1275 wpa_printf(MSG_DEBUG
, "EAP-FAST: Server triggered "
1276 "re-keying of Tunnel PAC");
1277 eap_fast_state(data
, REQUEST_PAC
);
1278 } else if (data
->final_result
)
1279 eap_fast_state(data
, SUCCESS
);
1282 if (tlv
.eap_payload_tlv
) {
1283 eap_fast_process_phase2_eap(sm
, data
, tlv
.eap_payload_tlv
,
1284 tlv
.eap_payload_tlv_len
);
1289 static void eap_fast_process_phase2(struct eap_sm
*sm
,
1290 struct eap_fast_data
*data
,
1291 const u8
*in_data
, size_t in_len
)
1294 int len_decrypted
, res
;
1297 wpa_printf(MSG_DEBUG
, "EAP-FAST: Received %lu bytes encrypted data for"
1298 " Phase 2", (unsigned long) in_len
);
1300 if (data
->pending_phase2_resp
) {
1301 wpa_printf(MSG_DEBUG
, "EAP-PEAP: Pending Phase 2 response - "
1302 "skip decryption and use old data");
1303 eap_fast_process_phase2_tlvs(
1304 sm
, data
, wpabuf_mhead(data
->pending_phase2_resp
),
1305 wpabuf_len(data
->pending_phase2_resp
));
1306 wpabuf_free(data
->pending_phase2_resp
);
1307 data
->pending_phase2_resp
= NULL
;
1311 /* FIX: get rid of const -> non-const typecast */
1312 res
= eap_server_tls_data_reassemble(sm
, &data
->ssl
, (u8
**) &in_data
,
1314 if (res
< 0 || res
== 1)
1318 if (data
->ssl
.tls_in_total
> buf_len
)
1319 buf_len
= data
->ssl
.tls_in_total
;
1320 in_decrypted
= os_malloc(buf_len
);
1321 if (in_decrypted
== NULL
) {
1322 os_free(data
->ssl
.tls_in
);
1323 data
->ssl
.tls_in
= NULL
;
1324 data
->ssl
.tls_in_len
= 0;
1325 wpa_printf(MSG_WARNING
, "EAP-FAST: Failed to allocate memory "
1330 len_decrypted
= tls_connection_decrypt(sm
->ssl_ctx
, data
->ssl
.conn
,
1332 in_decrypted
, buf_len
);
1333 os_free(data
->ssl
.tls_in
);
1334 data
->ssl
.tls_in
= NULL
;
1335 data
->ssl
.tls_in_len
= 0;
1336 if (len_decrypted
< 0) {
1337 wpa_printf(MSG_INFO
, "EAP-FAST: Failed to decrypt Phase 2 "
1339 os_free(in_decrypted
);
1340 eap_fast_state(data
, FAILURE
);
1344 wpa_hexdump_key(MSG_DEBUG
, "EAP-FAST: Decrypted Phase 2 TLVs",
1345 in_decrypted
, len_decrypted
);
1347 eap_fast_process_phase2_tlvs(sm
, data
, in_decrypted
, len_decrypted
);
1349 if (sm
->method_pending
== METHOD_PENDING_WAIT
) {
1350 wpa_printf(MSG_DEBUG
, "EAP-FAST: Phase2 method is in "
1351 "pending wait state - save decrypted response");
1352 wpabuf_free(data
->pending_phase2_resp
);
1353 data
->pending_phase2_resp
= wpabuf_alloc_copy(in_decrypted
,
1357 os_free(in_decrypted
);
1361 static int eap_fast_process_version(struct eap_fast_data
*data
,
1364 data
->peer_version
= peer_version
;
1366 if (data
->force_version
>= 0 && peer_version
!= data
->force_version
) {
1367 wpa_printf(MSG_INFO
, "EAP-FAST: peer did not select the forced"
1368 " version (forced=%d peer=%d) - reject",
1369 data
->force_version
, peer_version
);
1370 eap_fast_state(data
, FAILURE
);
1374 if (peer_version
< data
->fast_version
) {
1375 wpa_printf(MSG_DEBUG
, "EAP-FAST: peer ver=%d, own ver=%d; "
1377 peer_version
, data
->fast_version
, peer_version
);
1378 data
->fast_version
= peer_version
;
1385 static int eap_fast_process_length(struct eap_fast_data
*data
,
1386 const u8
**pos
, size_t *left
)
1391 wpa_printf(MSG_INFO
, "EAP-FAST: Short frame with TLS "
1393 eap_fast_state(data
, FAILURE
);
1397 tls_msg_len
= WPA_GET_BE32(*pos
);
1398 wpa_printf(MSG_DEBUG
, "EAP-FAST: TLS Message Length: %d",
1401 if (data
->ssl
.tls_in_left
== 0) {
1402 data
->ssl
.tls_in_total
= tls_msg_len
;
1403 data
->ssl
.tls_in_left
= tls_msg_len
;
1404 os_free(data
->ssl
.tls_in
);
1405 data
->ssl
.tls_in
= NULL
;
1406 data
->ssl
.tls_in_len
= 0;
1416 static int eap_fast_process_phase1(struct eap_sm
*sm
,
1417 struct eap_fast_data
*data
,
1418 const u8
*pos
, size_t left
)
1420 if (eap_server_tls_process_helper(sm
, &data
->ssl
, pos
, left
) < 0) {
1421 wpa_printf(MSG_INFO
, "EAP-FAST: TLS processing failed");
1422 eap_fast_state(data
, FAILURE
);
1426 if (!tls_connection_established(sm
->ssl_ctx
, data
->ssl
.conn
) ||
1427 data
->ssl
.tls_out_len
> 0)
1431 * Phase 1 was completed with the received message (e.g., when using
1432 * abbreviated handshake), so Phase 2 can be started immediately
1433 * without having to send through an empty message to the peer.
1436 return eap_fast_phase1_done(sm
, data
);
1440 static void eap_fast_process_phase2_start(struct eap_sm
*sm
,
1441 struct eap_fast_data
*data
)
1445 if (data
->identity
) {
1446 os_free(sm
->identity
);
1447 sm
->identity
= data
->identity
;
1448 data
->identity
= NULL
;
1449 sm
->identity_len
= data
->identity_len
;
1450 data
->identity_len
= 0;
1451 if (eap_user_get(sm
, sm
->identity
, sm
->identity_len
, 1) != 0) {
1452 wpa_hexdump_ascii(MSG_DEBUG
, "EAP-FAST: "
1453 "Phase2 Identity not found "
1454 "in the user database",
1455 sm
->identity
, sm
->identity_len
);
1456 next_type
= eap_fast_req_failure(sm
, data
);
1458 wpa_printf(MSG_DEBUG
, "EAP-FAST: Identity already "
1459 "known - skip Phase 2 Identity Request");
1460 next_type
= sm
->user
->methods
[0].method
;
1461 sm
->user_eap_method_index
= 1;
1464 eap_fast_state(data
, PHASE2_METHOD
);
1466 eap_fast_state(data
, PHASE2_ID
);
1467 next_type
= EAP_TYPE_IDENTITY
;
1470 eap_fast_phase2_init(sm
, data
, next_type
);
1474 static void eap_fast_process(struct eap_sm
*sm
, void *priv
,
1475 struct wpabuf
*respData
)
1477 struct eap_fast_data
*data
= priv
;
1482 pos
= eap_hdr_validate(EAP_VENDOR_IETF
, EAP_TYPE_FAST
, respData
,
1484 if (pos
== NULL
|| left
< 1)
1488 wpa_printf(MSG_DEBUG
, "EAP-FAST: Received packet(len=%lu) - "
1489 "Flags 0x%02x", (unsigned long) wpabuf_len(respData
),
1492 if (eap_fast_process_version(data
, flags
& EAP_PEAP_VERSION_MASK
))
1495 if ((flags
& EAP_TLS_FLAGS_LENGTH_INCLUDED
) &&
1496 eap_fast_process_length(data
, &pos
, &left
))
1499 switch (data
->state
) {
1501 if (eap_fast_process_phase1(sm
, data
, pos
, left
))
1504 /* fall through to PHASE2_START */
1506 eap_fast_process_phase2_start(sm
, data
);
1510 case CRYPTO_BINDING
:
1512 eap_fast_process_phase2(sm
, data
, pos
, left
);
1515 wpa_printf(MSG_DEBUG
, "EAP-FAST: Unexpected state %d in %s",
1516 data
->state
, __func__
);
1520 if (tls_connection_get_write_alerts(sm
->ssl_ctx
, data
->ssl
.conn
) > 1) {
1521 wpa_printf(MSG_INFO
, "EAP-FAST: Locally detected fatal error "
1522 "in TLS processing");
1523 eap_fast_state(data
, FAILURE
);
1528 static Boolean
eap_fast_isDone(struct eap_sm
*sm
, void *priv
)
1530 struct eap_fast_data
*data
= priv
;
1531 return data
->state
== SUCCESS
|| data
->state
== FAILURE
;
1535 static u8
* eap_fast_getKey(struct eap_sm
*sm
, void *priv
, size_t *len
)
1537 struct eap_fast_data
*data
= priv
;
1540 if (data
->state
!= SUCCESS
)
1543 eapKeyData
= os_malloc(EAP_FAST_KEY_LEN
);
1544 if (eapKeyData
== NULL
)
1547 eap_fast_derive_eap_msk(data
->simck
, eapKeyData
);
1548 *len
= EAP_FAST_KEY_LEN
;
1554 static u8
* eap_fast_get_emsk(struct eap_sm
*sm
, void *priv
, size_t *len
)
1556 struct eap_fast_data
*data
= priv
;
1559 if (data
->state
!= SUCCESS
)
1562 eapKeyData
= os_malloc(EAP_EMSK_LEN
);
1563 if (eapKeyData
== NULL
)
1566 eap_fast_derive_eap_emsk(data
->simck
, eapKeyData
);
1567 *len
= EAP_EMSK_LEN
;
1573 static Boolean
eap_fast_isSuccess(struct eap_sm
*sm
, void *priv
)
1575 struct eap_fast_data
*data
= priv
;
1576 return data
->state
== SUCCESS
;
1580 int eap_server_fast_register(void)
1582 struct eap_method
*eap
;
1585 eap
= eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION
,
1586 EAP_VENDOR_IETF
, EAP_TYPE_FAST
, "FAST");
1590 eap
->init
= eap_fast_init
;
1591 eap
->reset
= eap_fast_reset
;
1592 eap
->buildReq
= eap_fast_buildReq
;
1593 eap
->check
= eap_fast_check
;
1594 eap
->process
= eap_fast_process
;
1595 eap
->isDone
= eap_fast_isDone
;
1596 eap
->getKey
= eap_fast_getKey
;
1597 eap
->get_emsk
= eap_fast_get_emsk
;
1598 eap
->isSuccess
= eap_fast_isSuccess
;
1600 ret
= eap_server_method_register(eap
);
1602 eap_server_method_free(eap
);