~ubuntu-branches/ubuntu/gutsy/wpasupplicant/gutsy

« back to all changes in this revision

Viewing changes to src/eap_peer/eap_fast.c

Committer: Bazaar Package Importer
Author(s): Reinhard Tartler
Date: 2007-08-26 16:06:57 UTC
mto: This revision was merged to the branch mainline in revision 26.
Revision ID: james.westby@ubuntu.com-20070826160657-mxk5ivjjh65ptxlr

Tags: upstream-0.6.0+0.5.8

Import upstream version 0.6.0+0.5.8

files added:
ChangeLog

Makefile

README-Windows.txt

aes.c

aes.h

aes_wrap.c

aes_wrap.h

asn1.c

asn1.h

asn1_test.c

base64.c

base64.h

bignum.c

bignum.h

build_config.h

common.c

common.h

config.c

config.h

config_file.c

config_none.c

config_ssid.h

config_types.h

config_winreg.c

crypto.c

crypto.h

crypto_cryptoapi.c

crypto_gnutls.c

crypto_internal.c

crypto_libtomcrypt.c

crypto_none.c

ctrl_iface.c

ctrl_iface.h

ctrl_iface_dbus.c

ctrl_iface_dbus.h

ctrl_iface_dbus_handlers.c

ctrl_iface_dbus_handlers.h

ctrl_iface_named_pipe.c

ctrl_iface_udp.c

ctrl_iface_unix.c

dbus-wpa_supplicant.conf

dbus_dict_helpers.c

dbus_dict_helpers.h

defconfig

defs.h

des.c

doc/code_structure.doxygen

doc/ctrl_iface.doxygen

doc/docbook

doc/docbook/Makefile

doc/docbook/wpa_background.8

doc/docbook/wpa_background.sgml

doc/docbook/wpa_cli.8

doc/docbook/wpa_cli.sgml

doc/docbook/wpa_passphrase.8

doc/docbook/wpa_passphrase.sgml

doc/docbook/wpa_supplicant.8

doc/docbook/wpa_supplicant.conf.5

doc/docbook/wpa_supplicant.conf.sgml

doc/docbook/wpa_supplicant.sgml

doc/doxygen.fast

doc/doxygen.full

doc/driver_wrapper.doxygen

doc/eap.doxygen

doc/kerneldoc2doxygen.pl

doc/mainpage.doxygen

doc/porting.doxygen

doc/testing_tools.doxygen

doc/wpa_supplicant.fig

driver.h

driver_atmel.c

driver_broadcom.c

driver_bsd.c

driver_hostap.c

driver_hostap.h

driver_ipw.c

driver_madwifi.c

driver_ndis.c

driver_ndis.h

driver_ndis_.c

driver_ndiswrapper.c

driver_prism54.c

driver_test.c

driver_wext.c

driver_wext.h

driver_wired.c

drivers.c

eap.c

eap.h

eap_aka.c

eap_defs.h

eap_fast.c

eap_gpsk.c

eap_gpsk_common.c

eap_gpsk_common.h

eap_gtc.c

eap_i.h

eap_leap.c

eap_md5.c

eap_methods.c

eap_methods.h

eap_mschapv2.c

eap_otp.c

eap_pax.c

eap_pax_common.c

eap_pax_common.h

eap_peap.c

eap_psk.c

eap_psk_common.c

eap_psk_common.h

eap_sake.c

eap_sake_common.c

eap_sake_common.h

eap_sim.c

eap_sim_common.c

eap_sim_common.h

eap_testing.txt

eap_tls.c

eap_tls_common.c

eap_tls_common.h

eap_tlv.c

eap_tlv.h

eap_ttls.c

eap_ttls.h

eap_vendor_test.c

eapol_sm.c

eapol_sm.h

eapol_test.c

eloop.c

eloop.h

eloop_none.c

eloop_win.c

events.c

examples

examples/ieee8021x.conf

examples/plaintext.conf

examples/wep.conf

examples/wpa-psk-tkip.conf

examples/wpa2-eap-ccmp.conf

hostapd.h

includes.h

l2_packet.h

l2_packet_freebsd.c

l2_packet_linux.c

l2_packet_ndis.c

l2_packet_none.c

l2_packet_pcap.c

l2_packet_winpcap.c

libtommath.c

main.c

main_none.c

main_winmain.c

main_winsvc.c

md4.c

md5.c

md5.h

mlme.c

mlme.h

ms_funcs.c

ms_funcs.h

ndis_events.c

nmake.mak

openssl-0.9.8d-tls-extensions.patch

openssl-0.9.8e-tls-extensions.patch

openssl-tls-extensions.patch

os.h

os_internal.c

os_none.c

os_unix.c

os_win32.c

pcsc_funcs.c

pcsc_funcs.h

pmksa_cache.c

pmksa_cache.h

preauth.c

preauth.h

preauth_test.c

priv_netlink.h

radius.c

radius.h

radius_client.c

radius_client.h

rc4.c

rc4.h

rsa.c

rsa.h

sha1.c

sha1.h

sha256.c

sha256.h

state_machine.h

tests

tests/test_aes.c

tests/test_eap_sim_common.c

tests/test_md4.c

tests/test_md5.c

tests/test_ms_funcs.c

tests/test_sha1.c

tests/test_sha256.c

tests/test_x509v3.c

tls.h

tls_gnutls.c

tls_internal.c

tls_none.c

tls_openssl.c

tls_schannel.c

tlsv1_client.c

tlsv1_client.h

tlsv1_common.c

tlsv1_common.h

todo.txt

version.h

vs2005

vs2005/eapol_test

vs2005/eapol_test/eapol_test.vcproj

vs2005/win_if_list

vs2005/win_if_list/win_if_list.vcproj

vs2005/wpa_cli

vs2005/wpa_cli/wpa_cli.vcproj

vs2005/wpa_passphrase

vs2005/wpa_passphrase/wpa_passphrase.vcproj

vs2005/wpa_supplicant

vs2005/wpa_supplicant.sln

vs2005/wpa_supplicant/wpa_supplicant.vcproj

vs2005/wpasvc

vs2005/wpasvc/wpasvc.vcproj

win_example.reg

win_if_list.c

wireless_copy.h

wpa.c

wpa.h

wpa_cli.c

wpa_common.h

wpa_ctrl.c

wpa_ctrl.h

wpa_gui

wpa_gui-qt4

wpa_gui-qt4/eventhistory.cpp

wpa_gui-qt4/eventhistory.h

wpa_gui-qt4/eventhistory.ui

wpa_gui-qt4/main.cpp

wpa_gui-qt4/networkconfig.cpp

wpa_gui-qt4/networkconfig.h

wpa_gui-qt4/networkconfig.ui

wpa_gui-qt4/scanresults.cpp

wpa_gui-qt4/scanresults.h

wpa_gui-qt4/scanresults.ui

wpa_gui-qt4/setup-mingw-cross-compiling

wpa_gui-qt4/userdatarequest.cpp

wpa_gui-qt4/userdatarequest.h

wpa_gui-qt4/userdatarequest.ui

wpa_gui-qt4/wpa_gui.pro

wpa_gui-qt4/wpagui.cpp

wpa_gui-qt4/wpagui.h

wpa_gui-qt4/wpagui.ui

wpa_gui-qt4/wpamsg.h

wpa_gui/eventhistory.ui

wpa_gui/eventhistory.ui.h

wpa_gui/main.cpp

wpa_gui/networkconfig.ui

wpa_gui/networkconfig.ui.h

wpa_gui/scanresults.ui

wpa_gui/scanresults.ui.h

wpa_gui/setup-mingw-cross-compiling

wpa_gui/userdatarequest.ui

wpa_gui/userdatarequest.ui.h

wpa_gui/wpa_gui.pro

wpa_gui/wpagui.ui

wpa_gui/wpagui.ui.h

wpa_gui/wpamsg.h

wpa_i.h

wpa_passphrase.c

wpa_supplicant.c

wpa_supplicant.conf

wpa_supplicant.h

wpa_supplicant_i.h

x509v3.c

x509v3.h

files removed:
patches

patches/openssl-0.9.8-tls-extensions.patch

patches/openssl-0.9.8d-tls-extensions.patch

patches/openssl-0.9.8e-tls-extensions.patch

src/Makefile

src/common

src/common/Makefile

src/common/defs.h

src/common/ieee802_11_defs.h

src/common/version.h

src/common/wireless_copy.h

src/common/wpa_common.c

src/common/wpa_common.h

src/common/wpa_ctrl.c

src/common/wpa_ctrl.h

src/crypto

src/crypto/Makefile

src/crypto/aes.c

src/crypto/aes.h

src/crypto/aes_wrap.c

src/crypto/aes_wrap.h

src/crypto/crypto.h

src/crypto/crypto_cryptoapi.c

src/crypto/crypto_gnutls.c

src/crypto/crypto_internal.c

src/crypto/crypto_libtomcrypt.c

src/crypto/crypto_none.c

src/crypto/crypto_openssl.c

src/crypto/des.c

src/crypto/md4.c

src/crypto/md5.c

src/crypto/md5.h

src/crypto/ms_funcs.c

src/crypto/ms_funcs.h

src/crypto/rc4.c

src/crypto/rc4.h

src/crypto/sha1.c

src/crypto/sha1.h

src/crypto/sha256.c

src/crypto/sha256.h

src/crypto/tls.h

src/crypto/tls_gnutls.c

src/crypto/tls_internal.c

src/crypto/tls_none.c

src/crypto/tls_openssl.c

src/crypto/tls_schannel.c

src/drivers

src/drivers/Makefile

src/drivers/driver.h

src/drivers/driver_atmel.c

src/drivers/driver_broadcom.c

src/drivers/driver_bsd.c

src/drivers/driver_hostap.c

src/drivers/driver_hostap.h

src/drivers/driver_ipw.c

src/drivers/driver_madwifi.c

src/drivers/driver_ndis.c

src/drivers/driver_ndis.h

src/drivers/driver_ndis_.c

src/drivers/driver_ndiswrapper.c

src/drivers/driver_prism54.c

src/drivers/driver_ralink.c

src/drivers/driver_ralink.h

src/drivers/driver_test.c

src/drivers/driver_wext.c

src/drivers/driver_wext.h

src/drivers/driver_wired.c

src/drivers/drivers.c

src/drivers/ndis_events.c

src/drivers/priv_netlink.h

src/eap_common

src/eap_common/Makefile

src/eap_common/eap_common.c

src/eap_common/eap_common.h

src/eap_common/eap_defs.h

src/eap_common/eap_gpsk_common.c

src/eap_common/eap_gpsk_common.h

src/eap_common/eap_pax_common.c

src/eap_common/eap_pax_common.h

src/eap_common/eap_psk_common.c

src/eap_common/eap_psk_common.h

src/eap_common/eap_sake_common.c

src/eap_common/eap_sake_common.h

src/eap_common/eap_sim_common.c

src/eap_common/eap_sim_common.h

src/eap_common/eap_ttls.h

src/eap_peer

src/eap_peer/Makefile

src/eap_peer/eap.c

src/eap_peer/eap.h

src/eap_peer/eap_aka.c

src/eap_peer/eap_fast.c

src/eap_peer/eap_fast_pac.c

src/eap_peer/eap_fast_pac.h

src/eap_peer/eap_gpsk.c

src/eap_peer/eap_gtc.c

src/eap_peer/eap_i.h

src/eap_peer/eap_leap.c

src/eap_peer/eap_md5.c

src/eap_peer/eap_methods.c

src/eap_peer/eap_methods.h

src/eap_peer/eap_mschapv2.c

src/eap_peer/eap_otp.c

src/eap_peer/eap_pax.c

src/eap_peer/eap_peap.c

src/eap_peer/eap_psk.c

src/eap_peer/eap_sake.c

src/eap_peer/eap_sim.c

src/eap_peer/eap_tls.c

src/eap_peer/eap_tls_common.c

src/eap_peer/eap_tls_common.h

src/eap_peer/eap_tlv.c

src/eap_peer/eap_tlv.h

src/eap_peer/eap_tnc.c

src/eap_peer/eap_ttls.c

src/eap_peer/eap_vendor_test.c

src/eap_peer/tncc.c

src/eap_peer/tncc.h

src/eap_server

src/eap_server/Makefile

src/eap_server/eap.c

src/eap_server/eap.h

src/eap_server/eap_aka.c

src/eap_server/eap_gpsk.c

src/eap_server/eap_gtc.c

src/eap_server/eap_i.h

src/eap_server/eap_identity.c

src/eap_server/eap_md5.c

src/eap_server/eap_methods.c

src/eap_server/eap_methods.h

src/eap_server/eap_mschapv2.c

src/eap_server/eap_pax.c

src/eap_server/eap_peap.c

src/eap_server/eap_psk.c

src/eap_server/eap_sake.c

src/eap_server/eap_sim.c

src/eap_server/eap_sim_db.c

src/eap_server/eap_sim_db.h

src/eap_server/eap_tls.c

src/eap_server/eap_tls_common.c

src/eap_server/eap_tls_common.h

src/eap_server/eap_tlv.c

src/eap_server/eap_ttls.c

src/eap_server/eap_vendor_test.c

src/hlr_auc_gw

src/hlr_auc_gw/Makefile

src/hlr_auc_gw/hlr_auc_gw.c

src/hlr_auc_gw/hlr_auc_gw.milenage_db

src/hlr_auc_gw/milenage.c

src/hlr_auc_gw/milenage.h

src/l2_packet

src/l2_packet/Makefile

src/l2_packet/l2_packet.h

src/l2_packet/l2_packet_freebsd.c

src/l2_packet/l2_packet_linux.c

src/l2_packet/l2_packet_ndis.c

src/l2_packet/l2_packet_none.c

src/l2_packet/l2_packet_pcap.c

src/l2_packet/l2_packet_winpcap.c

src/radius

src/radius/Makefile

src/radius/radius.c

src/radius/radius.h

src/radius/radius_client.c

src/radius/radius_client.h

src/radius/radius_server.c

src/radius/radius_server.h

src/rsn_supp

src/rsn_supp/Makefile

src/rsn_supp/peerkey.c

src/rsn_supp/peerkey.h

src/rsn_supp/pmksa_cache.c

src/rsn_supp/pmksa_cache.h

src/rsn_supp/preauth.c

src/rsn_supp/preauth.h

src/rsn_supp/wpa.c

src/rsn_supp/wpa.h

src/rsn_supp/wpa_ft.c

src/rsn_supp/wpa_i.h

src/rsn_supp/wpa_ie.c

src/rsn_supp/wpa_ie.h

src/tls

src/tls/Makefile

src/tls/asn1.c

src/tls/asn1.h

src/tls/asn1_test.c

src/tls/bignum.c

src/tls/bignum.h

src/tls/libtommath.c

src/tls/rsa.c

src/tls/rsa.h

src/tls/tlsv1_client.c

src/tls/tlsv1_client.h

src/tls/tlsv1_common.c

src/tls/tlsv1_common.h

src/tls/x509v3.c

src/tls/x509v3.h

src/utils

src/utils/Makefile

src/utils/base64.c

src/utils/base64.h

src/utils/build_config.h

src/utils/common.c

src/utils/common.h

src/utils/eloop.c

src/utils/eloop.h

src/utils/eloop_none.c

src/utils/eloop_win.c

src/utils/includes.h

src/utils/ip_addr.c

src/utils/ip_addr.h

src/utils/os.h

src/utils/os_internal.c

src/utils/os_none.c

src/utils/os_unix.c

src/utils/os_win32.c

src/utils/pcsc_funcs.c

src/utils/pcsc_funcs.h

src/utils/state_machine.h

src/utils/wpa_debug.c

src/utils/wpa_debug.h

wpa_supplicant

wpa_supplicant/ChangeLog

wpa_supplicant/Makefile

wpa_supplicant/README

wpa_supplicant/README-Windows.txt

wpa_supplicant/config.c

wpa_supplicant/config.h

wpa_supplicant/config_file.c

wpa_supplicant/config_none.c

wpa_supplicant/config_ssid.h

wpa_supplicant/config_winreg.c

wpa_supplicant/ctrl_iface.c

wpa_supplicant/ctrl_iface.h

wpa_supplicant/ctrl_iface_dbus.c

wpa_supplicant/ctrl_iface_dbus.h

wpa_supplicant/ctrl_iface_dbus_handlers.c

wpa_supplicant/ctrl_iface_dbus_handlers.h

wpa_supplicant/ctrl_iface_named_pipe.c

wpa_supplicant/ctrl_iface_udp.c

wpa_supplicant/ctrl_iface_unix.c

wpa_supplicant/dbus-wpa_supplicant.conf

wpa_supplicant/dbus_dict_helpers.c

wpa_supplicant/dbus_dict_helpers.h

wpa_supplicant/defconfig

wpa_supplicant/doc

wpa_supplicant/doc/code_structure.doxygen

wpa_supplicant/doc/ctrl_iface.doxygen

wpa_supplicant/doc/docbook

wpa_supplicant/doc/docbook/Makefile

wpa_supplicant/doc/docbook/wpa_background.8

wpa_supplicant/doc/docbook/wpa_background.sgml

wpa_supplicant/doc/docbook/wpa_cli.8

wpa_supplicant/doc/docbook/wpa_cli.sgml

wpa_supplicant/doc/docbook/wpa_passphrase.8

wpa_supplicant/doc/docbook/wpa_passphrase.sgml

wpa_supplicant/doc/docbook/wpa_supplicant.8

wpa_supplicant/doc/docbook/wpa_supplicant.conf.5

wpa_supplicant/doc/docbook/wpa_supplicant.conf.sgml

wpa_supplicant/doc/docbook/wpa_supplicant.sgml

wpa_supplicant/doc/doxygen.fast

wpa_supplicant/doc/doxygen.full

wpa_supplicant/doc/driver_wrapper.doxygen

wpa_supplicant/doc/eap.doxygen

wpa_supplicant/doc/kerneldoc2doxygen.pl

wpa_supplicant/doc/mainpage.doxygen

wpa_supplicant/doc/porting.doxygen

wpa_supplicant/doc/testing_tools.doxygen

wpa_supplicant/doc/wpa_supplicant.fig

wpa_supplicant/eap_testing.txt

wpa_supplicant/eapol_sm.c

wpa_supplicant/eapol_sm.h

wpa_supplicant/eapol_test.c

wpa_supplicant/events.c

wpa_supplicant/examples

wpa_supplicant/examples/ieee8021x.conf

wpa_supplicant/examples/plaintext.conf

wpa_supplicant/examples/wep.conf

wpa_supplicant/examples/wpa-psk-tkip.conf

wpa_supplicant/examples/wpa2-eap-ccmp.conf

wpa_supplicant/examples/wpas-test.py

wpa_supplicant/main.c

wpa_supplicant/main_none.c

wpa_supplicant/main_symbian.cpp

wpa_supplicant/main_winmain.c

wpa_supplicant/main_winsvc.c

wpa_supplicant/mlme.c

wpa_supplicant/mlme.h

wpa_supplicant/nmake.mak

wpa_supplicant/preauth_test.c

wpa_supplicant/symbian

wpa_supplicant/symbian/README.symbian

wpa_supplicant/symbian/bld.inf

wpa_supplicant/symbian/wpa_supplicant.mmp

wpa_supplicant/tests

wpa_supplicant/tests/link_test.c

wpa_supplicant/tests/test_aes.c

wpa_supplicant/tests/test_eap_sim_common.c

wpa_supplicant/tests/test_md4.c

wpa_supplicant/tests/test_md5.c

wpa_supplicant/tests/test_ms_funcs.c

wpa_supplicant/tests/test_sha1.c

wpa_supplicant/tests/test_sha256.c

wpa_supplicant/tests/test_wpa.c

wpa_supplicant/tests/test_x509v3.c

wpa_supplicant/todo.txt

wpa_supplicant/vs2005

wpa_supplicant/vs2005/eapol_test

wpa_supplicant/vs2005/eapol_test/eapol_test.vcproj

wpa_supplicant/vs2005/win_if_list

wpa_supplicant/vs2005/win_if_list/win_if_list.vcproj

wpa_supplicant/vs2005/wpa_cli

wpa_supplicant/vs2005/wpa_cli/wpa_cli.vcproj

wpa_supplicant/vs2005/wpa_passphrase

wpa_supplicant/vs2005/wpa_passphrase/wpa_passphrase.vcproj

wpa_supplicant/vs2005/wpa_supplicant

wpa_supplicant/vs2005/wpa_supplicant.sln

wpa_supplicant/vs2005/wpa_supplicant/wpa_supplicant.vcproj

wpa_supplicant/vs2005/wpasvc

wpa_supplicant/vs2005/wpasvc/wpasvc.vcproj

wpa_supplicant/win_example.reg

wpa_supplicant/win_if_list.c

wpa_supplicant/wpa_cli.c

wpa_supplicant/wpa_gui

wpa_supplicant/wpa_gui-qt4

wpa_supplicant/wpa_gui-qt4/eventhistory.cpp

wpa_supplicant/wpa_gui-qt4/eventhistory.h

wpa_supplicant/wpa_gui-qt4/eventhistory.ui

wpa_supplicant/wpa_gui-qt4/main.cpp

wpa_supplicant/wpa_gui-qt4/networkconfig.cpp

wpa_supplicant/wpa_gui-qt4/networkconfig.h

wpa_supplicant/wpa_gui-qt4/networkconfig.ui

wpa_supplicant/wpa_gui-qt4/scanresults.cpp

wpa_supplicant/wpa_gui-qt4/scanresults.h

wpa_supplicant/wpa_gui-qt4/scanresults.ui

wpa_supplicant/wpa_gui-qt4/setup-mingw-cross-compiling

wpa_supplicant/wpa_gui-qt4/userdatarequest.cpp

wpa_supplicant/wpa_gui-qt4/userdatarequest.h

wpa_supplicant/wpa_gui-qt4/userdatarequest.ui

wpa_supplicant/wpa_gui-qt4/wpa_gui.pro

wpa_supplicant/wpa_gui-qt4/wpagui.cpp

wpa_supplicant/wpa_gui-qt4/wpagui.h

wpa_supplicant/wpa_gui-qt4/wpagui.ui

wpa_supplicant/wpa_gui-qt4/wpamsg.h

wpa_supplicant/wpa_gui/eventhistory.ui

wpa_supplicant/wpa_gui/eventhistory.ui.h

wpa_supplicant/wpa_gui/main.cpp

wpa_supplicant/wpa_gui/networkconfig.ui

wpa_supplicant/wpa_gui/networkconfig.ui.h

wpa_supplicant/wpa_gui/scanresults.ui

wpa_supplicant/wpa_gui/scanresults.ui.h

wpa_supplicant/wpa_gui/setup-mingw-cross-compiling

wpa_supplicant/wpa_gui/userdatarequest.ui

wpa_supplicant/wpa_gui/userdatarequest.ui.h

wpa_supplicant/wpa_gui/wpa_gui.pro

wpa_supplicant/wpa_gui/wpagui.ui

wpa_supplicant/wpa_gui/wpagui.ui.h

wpa_supplicant/wpa_gui/wpamsg.h

wpa_supplicant/wpa_passphrase.c

wpa_supplicant/wpa_supplicant.c

wpa_supplicant/wpa_supplicant.conf

wpa_supplicant/wpa_supplicant_i.h

files modified:
README

Show diffs side-by-side

added added

removed removed

src/eap_peer/eap_fast.c

* EAP peer method: EAP-FAST (RFC 4851)

* This program is free software; you can redistribute it and/or modify

* it under the terms of the GNU General Public License version 2 as

* published by the Free Software Foundation.

* Alternatively, this software may be distributed under the terms of BSD

* license.

* See README and COPYING for more details.

#include "includes.h"

#include "common.h"

#include "eap_i.h"

#include "eap_tls_common.h"

#include "config_ssid.h"

#include "tls.h"

#include "eap_tlv.h"

#include "sha1.h"

#include "eap_fast_pac.h"

#ifdef EAP_FAST_DYNAMIC

#include "eap_fast_pac.c"

#endif /* EAP_FAST_DYNAMIC */

/* TODO:

* - test session resumption and enable it if it interoperates

* - password change (pending mschapv2 packet; replay decrypted packet)

#define EAP_FAST_VERSION 1

#define EAP_FAST_KEY_LEN 64

#define EAP_FAST_SIMCK_LEN 40

#define EAP_FAST_SKS_LEN 40

#define TLS_EXT_PAC_OPAQUE 35

static void eap_fast_deinit(struct eap_sm *sm, void *priv);

* draft-cam-winget-eap-fast-provisioning-04.txt:

* Section 3.4 - Key Derivations Used in the EAP-FAST Provisioning Exchange

struct eap_fast_key_block_provisioning {

/* Extra key material after TLS key_block */

u8 session_key_seed[EAP_FAST_SKS_LEN];

u8 server_challenge[16]; /* MSCHAPv2 ServerChallenge */

u8 client_challenge[16]; /* MSCHAPv2 ClientChallenge */

};

struct eap_fast_data {

struct eap_ssl_data ssl;

int fast_version;

const struct eap_method *phase2_method;

void *phase2_priv;

int phase2_success;

struct eap_method_type phase2_type;

struct eap_method_type *phase2_types;

size_t num_phase2_types;

int resuming; /* starting a resumed session */

struct eap_fast_key_block_provisioning *key_block_p;

#define EAP_FAST_PROV_UNAUTH 1

#define EAP_FAST_PROV_AUTH 2

int provisioning_allowed; /* Allowed PAC provisioning modes */

int provisioning; /* doing PAC provisioning (not the normal auth) */

int anon_provisioning; /* doing anonymous (unauthenticated)

* provisioning */

u8 key_data[EAP_FAST_KEY_LEN];

u8 emsk[EAP_EMSK_LEN];

int success;

struct eap_fast_pac *pac;

struct eap_fast_pac *current_pac;

size_t max_pac_list_len;

int use_pac_binary_format;

int tls_master_secret_set;

u8 simck[EAP_FAST_SIMCK_LEN];

int simck_idx;

u8 *pending_phase2_req;

size_t pending_phase2_req_len;

};

static int eap_fast_parse_phase1(struct eap_fast_data *data,

const char *phase1)

100

{

101

const char *pos;

102

103

pos = os_strstr(phase1, "fast_provisioning=");

104

if (pos) {

105

data->provisioning_allowed = atoi(pos + 18);

106

wpa_printf(MSG_DEBUG, "EAP-FAST: Automatic PAC provisioning "

107

"mode: %d", data->provisioning_allowed);

108

}

109

110

pos = os_strstr(phase1, "fast_max_pac_list_len=");

111

if (pos) {

112

data->max_pac_list_len = atoi(pos + 22);

113

if (data->max_pac_list_len == 0)

114

data->max_pac_list_len = 1;

115

wpa_printf(MSG_DEBUG, "EAP-FAST: Maximum PAC list length: %lu",

116

(unsigned long) data->max_pac_list_len);

117

}

118

119

pos = os_strstr(phase1, "fast_pac_format=binary");

120

if (pos) {

121

data->use_pac_binary_format = 1;

122

wpa_printf(MSG_DEBUG, "EAP-FAST: Using binary format for PAC "

123

"list");

124

}

125

126

return 0;

127

}

128

129

130

static void * eap_fast_init(struct eap_sm *sm)

131

{

132

struct eap_fast_data *data;

133

struct wpa_ssid *config = eap_get_config(sm);

134

135

data = os_zalloc(sizeof(*data));

136

if (data == NULL)

137

return NULL;

138

data->fast_version = EAP_FAST_VERSION;

139

data->max_pac_list_len = 10;

140

141

if (config && config->phase1 &&

142

eap_fast_parse_phase1(data, config->phase1) < 0) {

143

eap_fast_deinit(sm, data);

144

return NULL;

145

}

146

147

if (eap_peer_select_phase2_methods(config, "auth=",

148

&data->phase2_types,

149

&data->num_phase2_types) < 0) {

150

eap_fast_deinit(sm, data);

151

return NULL;

152

}

153

154

data->phase2_type.vendor = EAP_VENDOR_IETF;

155

data->phase2_type.method = EAP_TYPE_NONE;

156

157

if (eap_peer_tls_ssl_init(sm, &data->ssl, config)) {

158

wpa_printf(MSG_INFO, "EAP-FAST: Failed to initialize SSL.");

159

eap_fast_deinit(sm, data);

160

return NULL;

161

}

162

163

164

* The local RADIUS server in a Cisco AP does not seem to like empty

165

* fragments before data, so disable that workaround for CBC.

166

* TODO: consider making this configurable

167

168

tls_connection_enable_workaround(sm->ssl_ctx, data->ssl.conn);

169

170

if (data->use_pac_binary_format &&

171

eap_fast_load_pac_bin(sm, &data->pac, config->pac_file) < 0) {

172

eap_fast_deinit(sm, data);

173

return NULL;

174

}

175

176

if (!data->use_pac_binary_format &&

177

eap_fast_load_pac(sm, &data->pac, config->pac_file) < 0) {

178

eap_fast_deinit(sm, data);

179

return NULL;

180

}

181

eap_fast_pac_list_truncate(data->pac, data->max_pac_list_len);

182

183

if (data->pac == NULL && !data->provisioning_allowed) {

184

wpa_printf(MSG_INFO, "EAP-FAST: No PAC configured and "

185

"provisioning disabled");

186

eap_fast_deinit(sm, data);

187

return NULL;

188

}

189

190

return data;

191

}

192

193

194

static void eap_fast_deinit(struct eap_sm *sm, void *priv)

195

{

196

struct eap_fast_data *data = priv;

197

struct eap_fast_pac *pac, *prev;

198

199

if (data == NULL)

200

return;

201

if (data->phase2_priv && data->phase2_method)

202

data->phase2_method->deinit(sm, data->phase2_priv);

203

os_free(data->phase2_types);

204

os_free(data->key_block_p);

205

eap_peer_tls_ssl_deinit(sm, &data->ssl);

206

207

pac = data->pac;

208

prev = NULL;

209

while (pac) {

210

prev = pac;

211

pac = pac->next;

212

eap_fast_free_pac(prev);

213

}

214

os_free(data->pending_phase2_req);

215

os_free(data);

216

}

217

218

219

static int eap_fast_derive_msk(struct eap_fast_data *data)

220

{

221

/* Derive EAP Master Session Keys (section 5.4) */

222

sha1_t_prf(data->simck, EAP_FAST_SIMCK_LEN,

223

"Session Key Generating Function", (u8 *) "", 0,

224

data->key_data, EAP_FAST_KEY_LEN);

225

wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Derived key (MSK)",

226

data->key_data, EAP_FAST_KEY_LEN);

227

228

sha1_t_prf(data->simck, EAP_FAST_SIMCK_LEN,

229

"Extended Session Key Generating Function",

230

(u8 *) "", 0, data->emsk, EAP_EMSK_LEN);

231

wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Derived key (EMSK)",

232

data->emsk, EAP_EMSK_LEN);

233

234

data->success = 1;

235

236

return 0;

237

}

238

239

240

static int eap_fast_set_tls_master_secret(struct eap_sm *sm,

241

struct eap_fast_data *data,

242

const u8 *tls, size_t tls_len)

243

{

244

struct tls_keys keys;

245

u8 master_secret[48], *seed;

246

const u8 *server_random;

247

size_t seed_len, server_random_len;

248

249

if (data->tls_master_secret_set || !data->current_pac ||

250

tls_connection_get_keys(sm->ssl_ctx, data->ssl.conn, &keys) ||

251

keys.client_random == NULL) {

252

return 0;

253

}

254

255

wpa_hexdump(MSG_DEBUG, "EAP-FAST: client_random",

256

keys.client_random, keys.client_random_len);

257

258

259

* TLS master secret is needed before TLS library has processed this

260

* message which includes both ServerHello and an encrypted handshake

261

* message, so we need to parse server_random from this message before

262

* passing it to TLS library.

263

264

* Example TLS packet header:

265

* (16 03 01 00 2a 02 00 00 26 03 01 <32 bytes server_random>)

266

* Content Type: Handshake: 0x16

267

* Version: TLS 1.0 (0x0301)

268

* Lenghth: 42 (0x002a)

269

* Handshake Type: Server Hello: 0x02

270

* Length: 38 (0x000026)

271

* Version TLS 1.0 (0x0301)

272

* Random: 32 bytes

273

274

if (tls_len < 43 || tls[0] != 0x16 ||

275

tls[1] != 0x03 || tls[2] != 0x01 ||

276

tls[5] != 0x02 || tls[9] != 0x03 || tls[10] != 0x01) {

277

wpa_hexdump(MSG_DEBUG, "EAP-FAST: unrecognized TLS "

278

"ServerHello", tls, tls_len);

279

return -1;

280

}

281

server_random = tls + 11;

282

server_random_len = 32;

283

wpa_hexdump(MSG_DEBUG, "EAP-FAST: server_random",

284

server_random, server_random_len);

285

286

seed_len = keys.client_random_len + server_random_len;

287

seed = os_malloc(seed_len);

288

if (seed == NULL)

289

return -1;

290

os_memcpy(seed, server_random, server_random_len);

291

os_memcpy(seed + server_random_len,

292

keys.client_random, keys.client_random_len);

293

294

wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: T-PRF seed", seed, seed_len);

295

wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: PAC-Key",

296

data->current_pac->pac_key, EAP_FAST_PAC_KEY_LEN);

297

298

* RFC 4851, Section 5.1:

299

* master_secret = T-PRF(PAC-Key, "PAC to master secret label hash",

300

* server_random + client_random, 48)

301

302

sha1_t_prf(data->current_pac->pac_key, EAP_FAST_PAC_KEY_LEN,

303

"PAC to master secret label hash",

304

seed, seed_len, master_secret, sizeof(master_secret));

305

os_free(seed);

306

wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: TLS pre-master-secret",

307

master_secret, sizeof(master_secret));

308

309

data->tls_master_secret_set = 1;

310

311

return tls_connection_set_master_key(sm->ssl_ctx, data->ssl.conn,

312

master_secret,

313

sizeof(master_secret));

314

}

315

316

317

static u8 * eap_fast_derive_key(struct eap_sm *sm, struct eap_ssl_data *data,

318

char *label, size_t len)

319

{

320

struct tls_keys keys;

321

u8 *rnd = NULL, *out;

322

int block_size;

323

324

block_size = tls_connection_get_keyblock_size(sm->ssl_ctx, data->conn);

325

if (block_size < 0)

326

return NULL;

327

328

out = os_malloc(block_size + len);

329

if (out == NULL)

330

return NULL;

331

332

if (tls_connection_prf(sm->ssl_ctx, data->conn, label, 1, out,

333

block_size + len) == 0) {

334

os_memmove(out, out + block_size, len);

335

return out;

336

}

337

338

if (tls_connection_get_keys(sm->ssl_ctx, data->conn, &keys))

339

goto fail;

340

341

rnd = os_malloc(keys.client_random_len + keys.server_random_len);

342

if (rnd == NULL)

343

goto fail;

344

345

os_memcpy(rnd, keys.server_random, keys.server_random_len);

346

os_memcpy(rnd + keys.server_random_len, keys.client_random,

347

keys.client_random_len);

348

349

wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: master_secret for key "

350

"expansion", keys.master_key, keys.master_key_len);

351

if (tls_prf(keys.master_key, keys.master_key_len,

352

label, rnd, keys.client_random_len +

353

keys.server_random_len, out, block_size + len))

354

goto fail;

355

os_free(rnd);

356

os_memmove(out, out + block_size, len);

357

return out;

358

359

fail:

360

os_free(rnd);

361

os_free(out);

362

return NULL;

363

}

364

365

366

static void eap_fast_derive_key_auth(struct eap_sm *sm,

367

struct eap_fast_data *data)

368

{

369

u8 *sks;

370

371

/* RFC 4851, Section 5.1:

372

* Extra key material after TLS key_block: session_key_seed[40]

373

374

375

sks = eap_fast_derive_key(sm, &data->ssl, "key expansion",

376

EAP_FAST_SKS_LEN);

377

if (sks == NULL) {

378

wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to derive "

379

"session_key_seed");

380

return;

381

}

382

383

384

* RFC 4851, Section 5.2:

385

* S-IMCK[0] = session_key_seed

386

387

wpa_hexdump_key(MSG_DEBUG,

388

"EAP-FAST: session_key_seed (SKS = S-IMCK[0])",

389

sks, EAP_FAST_SKS_LEN);

390

data->simck_idx = 0;

391

os_memcpy(data->simck, sks, EAP_FAST_SIMCK_LEN);

392

os_free(sks);

393

}

394

395

396

static void eap_fast_derive_key_provisioning(struct eap_sm *sm,

397

struct eap_fast_data *data)

398

{

399

os_free(data->key_block_p);

400

data->key_block_p = (struct eap_fast_key_block_provisioning *)

401

eap_fast_derive_key(sm, &data->ssl, "key expansion",

402

sizeof(*data->key_block_p));

403

if (data->key_block_p == NULL) {

404

wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to derive key block");

405

return;

406

}

407

408

* RFC 4851, Section 5.2:

409

* S-IMCK[0] = session_key_seed

410

411

wpa_hexdump_key(MSG_DEBUG,

412

"EAP-FAST: session_key_seed (SKS = S-IMCK[0])",

413

data->key_block_p->session_key_seed,

414

sizeof(data->key_block_p->session_key_seed));

415

data->simck_idx = 0;

416

os_memcpy(data->simck, data->key_block_p->session_key_seed,

417

EAP_FAST_SIMCK_LEN);

418

wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: server_challenge",

419

data->key_block_p->server_challenge,

420

sizeof(data->key_block_p->server_challenge));

421

wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: client_challenge",

422

data->key_block_p->client_challenge,

423

sizeof(data->key_block_p->client_challenge));

424

}

425

426

427

static void eap_fast_derive_keys(struct eap_sm *sm, struct eap_fast_data *data)

428

{

429

if (data->anon_provisioning)

430

eap_fast_derive_key_provisioning(sm, data);

431

else

432

eap_fast_derive_key_auth(sm, data);

433

}

434

435

436

static int eap_fast_init_phase2_method(struct eap_sm *sm,

437

struct eap_fast_data *data)

438

{

439

data->phase2_method =

440

eap_peer_get_eap_method(data->phase2_type.vendor,

441

data->phase2_type.method);

442

if (data->phase2_method == NULL)

443

return -1;

444

445

if (data->key_block_p) {

446

sm->auth_challenge = data->key_block_p->server_challenge;

447

sm->peer_challenge = data->key_block_p->client_challenge;

448

}

449

sm->init_phase2 = 1;

450

sm->mschapv2_full_key = 1;

451

data->phase2_priv = data->phase2_method->init(sm);

452

sm->init_phase2 = 0;

453

sm->mschapv2_full_key = 0;

454

sm->auth_challenge = NULL;

455

sm->peer_challenge = NULL;

456

457

return data->phase2_priv == NULL ? -1 : 0;

458

}

459

460

461

static int eap_fast_select_phase2_method(struct eap_fast_data *data, u8 type)

462

{

463

size_t i;

464

465

if (data->anon_provisioning && type != EAP_TYPE_MSCHAPV2) {

466

wpa_printf(MSG_INFO, "EAP-FAST: Only EAP-MSCHAPv2 is allowed "

467

"during unauthenticated provisioning; reject phase2"

468

" type %d", type);

469

return -1;

470

}

471

472

for (i = 0; i < data->num_phase2_types; i++) {

473

if (data->phase2_types[i].vendor != EAP_VENDOR_IETF ||

474

data->phase2_types[i].method != type)

475

continue;

476

477

data->phase2_type.vendor = data->phase2_types[i].vendor;

478

data->phase2_type.method = data->phase2_types[i].method;

479

wpa_printf(MSG_DEBUG, "EAP-FAST: Selected Phase 2 EAP "

480

"vendor %d method %d",

481

data->phase2_type.vendor,

482

data->phase2_type.method);

483

break;

484

}

485

486

if (type != data->phase2_type.method || type == EAP_TYPE_NONE)

487

return -1;

488

489

return 0;

490

}

491

492

493

static int eap_fast_phase2_request(struct eap_sm *sm,

494

struct eap_fast_data *data,

495

struct eap_method_ret *ret,

496

struct eap_hdr *hdr,

497

u8 **resp, size_t *resp_len)

498

{

499

size_t len = be_to_host16(hdr->length);

500

u8 *pos;

501

struct eap_method_ret iret;

502

struct wpa_ssid *config = eap_get_config(sm);

503

504

if (len <= sizeof(struct eap_hdr)) {

505

wpa_printf(MSG_INFO, "EAP-FAST: too short "

506

"Phase 2 request (len=%lu)", (unsigned long) len);

507

return -1;

508

}

509

pos = (u8 *) (hdr + 1);

510

wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 Request: type=%d", *pos);

511

if (*pos == EAP_TYPE_IDENTITY) {

512

*resp = eap_sm_buildIdentity(sm, hdr->identifier, resp_len, 1);

513

return 0;

514

}

515

516

if (data->phase2_type.vendor == EAP_VENDOR_IETF &&

517

data->phase2_type.method == EAP_TYPE_NONE &&

518

eap_fast_select_phase2_method(data, *pos) < 0) {

519

if (eap_peer_tls_phase2_nak(data->phase2_types,

520

data->num_phase2_types,

521

hdr, resp, resp_len))

522

return -1;

523

return 0;

524

}

525

526

if (data->phase2_priv == NULL &&

527

eap_fast_init_phase2_method(sm, data) < 0) {

528

wpa_printf(MSG_INFO, "EAP-FAST: Failed to initialize "

529

"Phase 2 EAP method %d", *pos);

530

ret->methodState = METHOD_DONE;

531

ret->decision = DECISION_FAIL;

532

return -1;

533

}

534

535

os_memset(&iret, 0, sizeof(iret));

536

*resp = data->phase2_method->process(sm, data->phase2_priv, &iret,

537

(u8 *) hdr, len, resp_len);

538

if (*resp == NULL ||

539

(iret.methodState == METHOD_DONE &&

540

iret.decision == DECISION_FAIL)) {

541

ret->methodState = METHOD_DONE;

542

ret->decision = DECISION_FAIL;

543

} else if ((iret.methodState == METHOD_DONE ||

544

iret.methodState == METHOD_MAY_CONT) &&

545

(iret.decision == DECISION_UNCOND_SUCC ||

546

iret.decision == DECISION_COND_SUCC)) {

547

data->phase2_success = 1;

548

}

549

550

if (*resp == NULL && config &&

551

(config->pending_req_identity || config->pending_req_password ||

552

config->pending_req_otp || config->pending_req_new_password)) {

553

os_free(data->pending_phase2_req);

554

data->pending_phase2_req = os_malloc(len);

555

if (data->pending_phase2_req) {

556

os_memcpy(data->pending_phase2_req, hdr, len);

557

data->pending_phase2_req_len = len;

558

}

559

} else if (*resp == NULL)

560

return -1;

561

562

return 0;

563

}

564

565

566

static u8 * eap_fast_tlv_nak(int vendor_id, int tlv_type, size_t *len)

567

{

568

struct eap_tlv_nak_tlv *nak;

569

*len = sizeof(*nak);

570

nak = os_malloc(*len);

571

if (nak == NULL)

572

return NULL;

573

nak->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY | EAP_TLV_NAK_TLV);

574

nak->length = host_to_be16(6);

575

nak->vendor_id = host_to_be32(vendor_id);

576

nak->nak_type = host_to_be16(tlv_type);

577

return (u8 *) nak;

578

}

579

580

581

static u8 * eap_fast_tlv_result(int status, int intermediate, size_t *len)

582

{

583

struct eap_tlv_intermediate_result_tlv *result;

584

*len = sizeof(*result);

585

result = os_malloc(*len);

586

if (result == NULL)

587

return NULL;

588

result->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |

589

(intermediate ?

590

EAP_TLV_INTERMEDIATE_RESULT_TLV :

591

EAP_TLV_RESULT_TLV));

592

result->length = host_to_be16(2);

593

result->status = host_to_be16(status);

594

return (u8 *) result;

595

}

596

597

598

static u8 * eap_fast_tlv_pac_ack(size_t *len)

599

{

600

struct eap_tlv_result_tlv *res;

601

struct eap_tlv_pac_ack_tlv *ack;

602

603

*len = sizeof(*res) + sizeof(*ack);

604

res = os_zalloc(*len);

605

if (res == NULL)

606

return NULL;

607

608

res->tlv_type = host_to_be16(EAP_TLV_RESULT_TLV |

609

EAP_TLV_TYPE_MANDATORY);

610

res->length = host_to_be16(sizeof(*res) - sizeof(struct eap_tlv_hdr));

611

res->status = host_to_be16(EAP_TLV_RESULT_SUCCESS);

612

613

ack = (struct eap_tlv_pac_ack_tlv *) (res + 1);

614

ack->tlv_type = host_to_be16(EAP_TLV_PAC_TLV |

615

EAP_TLV_TYPE_MANDATORY);

616

ack->length = host_to_be16(sizeof(*ack) - sizeof(struct eap_tlv_hdr));

617

ack->pac_type = host_to_be16(PAC_TYPE_PAC_ACKNOWLEDGEMENT);

618

ack->pac_len = host_to_be16(2);

619

ack->result = host_to_be16(EAP_TLV_RESULT_SUCCESS);

620

621

return (u8 *) res;

622

}

623

624

625

static u8 * eap_fast_tlv_eap_payload(u8 *buf, size_t *len)

626

{

627

struct eap_tlv_hdr *tlv;

628

629

if (buf == NULL)

630

return NULL;

631

632

/* Encapsulate EAP packet in EAP Payload TLV */

633

tlv = os_malloc(sizeof(*tlv) + *len);

634

if (tlv == NULL) {

635

wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to "

636

"allocate memory for TLV "

637

"encapsulation");

638

os_free(buf);

639

return NULL;

640

}

641

tlv->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |

642

EAP_TLV_EAP_PAYLOAD_TLV);

643

tlv->length = host_to_be16(*len);

644

os_memcpy(tlv + 1, buf, *len);

645

os_free(buf);

646

*len += sizeof(*tlv);

647

return (u8 *) tlv;

648

}

649

650

651

static u8 * eap_fast_process_eap_payload_tlv(

652

struct eap_sm *sm, struct eap_fast_data *data,

653

struct eap_method_ret *ret, const struct eap_hdr *req,

654

u8 *eap_payload_tlv, size_t eap_payload_tlv_len, size_t *resp_len)

655

{

656

struct eap_hdr *hdr;

657

u8 *resp = NULL;

658

659

if (eap_payload_tlv_len < sizeof(*hdr)) {

660

wpa_printf(MSG_DEBUG, "EAP-FAST: too short EAP "

661

"Payload TLV (len=%lu)",

662

(unsigned long) eap_payload_tlv_len);

663

return NULL;

664

}

665

666

hdr = (struct eap_hdr *) eap_payload_tlv;

667

if (be_to_host16(hdr->length) > eap_payload_tlv_len) {

668

wpa_printf(MSG_DEBUG, "EAP-FAST: EAP packet overflow in "

669

"EAP Payload TLV");

670

return NULL;

671

}

672

673

if (hdr->code != EAP_CODE_REQUEST) {

674

wpa_printf(MSG_INFO, "EAP-FAST: Unexpected code=%d in "

675

"Phase 2 EAP header", hdr->code);

676

return NULL;

677

}

678

679

if (eap_fast_phase2_request(sm, data, ret, hdr, &resp, resp_len)) {

680

wpa_printf(MSG_INFO, "EAP-FAST: Phase2 Request processing "

681

"failed");

682

return NULL;

683

}

684

685

return eap_fast_tlv_eap_payload(resp, resp_len);

686

}

687

688

689

static int eap_fast_validate_crypto_binding(

690

struct eap_tlv_crypto_binding__tlv *_bind)

691

{

692

wpa_printf(MSG_DEBUG, "EAP-FAST: Crypto-Binding TLV: Version %d "

693

"Received Version %d SubType %d",

694

_bind->version, _bind->received_version, _bind->subtype);

695

wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: NONCE",

696

_bind->nonce, sizeof(_bind->nonce));

697

wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Compound MAC",

698

_bind->compound_mac, sizeof(_bind->compound_mac));

699

700

if (_bind->version != EAP_FAST_VERSION ||

701

_bind->received_version != EAP_FAST_VERSION ||

702

_bind->subtype != EAP_TLV_CRYPTO_BINDING_SUBTYPE_REQUEST) {

703

wpa_printf(MSG_INFO, "EAP-FAST: Invalid version/subtype in "

704

"Crypto-Binding TLV: Version %d "

705

"Received Version %d SubType %d",

706

_bind->version, _bind->received_version,

707

_bind->subtype);

708

return -1;

709

}

710

711

return 0;

712

}

713

714

715

static void eap_fast_write_crypto_binding(

716

struct eap_tlv_crypto_binding__tlv *rbind,

717

struct eap_tlv_crypto_binding__tlv *_bind, const u8 *cmk)

718

{

719

rbind->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |

720

EAP_TLV_CRYPTO_BINDING_TLV_);

721

rbind->length = host_to_be16(sizeof(*rbind) -

722

sizeof(struct eap_tlv_hdr));

723

rbind->version = EAP_FAST_VERSION;

724

rbind->received_version = _bind->version;

725

rbind->subtype = EAP_TLV_CRYPTO_BINDING_SUBTYPE_RESPONSE;

726

os_memcpy(rbind->nonce, _bind->nonce, sizeof(_bind->nonce));

727

inc_byte_array(rbind->nonce, sizeof(rbind->nonce));

728

hmac_sha1(cmk, 20, (u8 *) rbind, sizeof(*rbind), rbind->compound_mac);

729

730

wpa_printf(MSG_DEBUG, "EAP-FAST: Reply Crypto-Binding TLV: Version %d "

731

"Received Version %d SubType %d",

732

rbind->version, rbind->received_version, rbind->subtype);

733

wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: NONCE",

734

rbind->nonce, sizeof(rbind->nonce));

735

wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Compound MAC",

736

rbind->compound_mac, sizeof(rbind->compound_mac));

737

}

738

739

740

static int eap_fast_get_phase2_key(struct eap_sm *sm,

741

struct eap_fast_data *data,

742

u8 *isk, size_t isk_len)

743

{

744

u8 *key;

745

size_t key_len;

746

747

os_memset(isk, 0, isk_len);

748

749

if (data->phase2_method == NULL || data->phase2_priv == NULL) {

750

wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 method not "

751

"available");

752

return -1;

753

}

754

755

if (data->phase2_method->isKeyAvailable == NULL ||

756

data->phase2_method->getKey == NULL)

757

return 0;

758

759

if (!data->phase2_method->isKeyAvailable(sm, data->phase2_priv) ||

760

(key = data->phase2_method->getKey(sm, data->phase2_priv,

761

&key_len)) == NULL) {

762

wpa_printf(MSG_DEBUG, "EAP-FAST: Could not get key material "

763

"from Phase 2");

764

return -1;

765

}

766

767

if (key_len > isk_len)

768

key_len = isk_len;

769

os_memcpy(isk, key, key_len);

770

os_free(key);

771

772

return 0;

773

}

774

775

776

static int eap_fast_get_cmk(struct eap_sm *sm, struct eap_fast_data *data,

777

u8 *cmk)

778

{

779

u8 isk[32], imck[60];

780

781

wpa_printf(MSG_DEBUG, "EAP-FAST: Determining CMK[%d] for Compound MIC "

782

"calculation", data->simck_idx + 1);

783

784

785

* RFC 4851, Section 5.2:

786

* IMCK[j] = T-PRF(S-IMCK[j-1], "Inner Methods Compound Keys",

787

* MSK[j], 60)

788

* S-IMCK[j] = first 40 octets of IMCK[j]

789

* CMK[j] = last 20 octets of IMCK[j]

790

791

792

if (eap_fast_get_phase2_key(sm, data, isk, sizeof(isk)) < 0)

793

return -1;

794

wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: ISK[j]", isk, sizeof(isk));

795

sha1_t_prf(data->simck, EAP_FAST_SIMCK_LEN,

796

"Inner Methods Compound Keys",

797

isk, sizeof(isk), imck, sizeof(imck));

798

data->simck_idx++;

799

os_memcpy(data->simck, imck, EAP_FAST_SIMCK_LEN);

800

wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: S-IMCK[j]",

801

data->simck, EAP_FAST_SIMCK_LEN);

802

os_memcpy(cmk, imck + EAP_FAST_SIMCK_LEN, 20);

803

wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: CMK[j]", cmk, 20);

804

805

return 0;

806

}

807

808

809

static u8 * eap_fast_write_pac_request(u8 *pos, u16 pac_type)

810

{

811

struct eap_tlv_hdr *pac;

812

struct eap_tlv_request_action_tlv *act;

813

struct eap_tlv_pac_type_tlv *type;

814

815

act = (struct eap_tlv_request_action_tlv *) pos;

816

act->tlv_type = host_to_be16(EAP_TLV_REQUEST_ACTION_TLV);

817

act->length = host_to_be16(2);

818

act->action = host_to_be16(EAP_TLV_ACTION_PROCESS_TLV);

819

820

pac = (struct eap_tlv_hdr *) (act + 1);

821

pac->tlv_type = host_to_be16(EAP_TLV_PAC_TLV);

822

pac->length = host_to_be16(sizeof(*type));

823

824

type = (struct eap_tlv_pac_type_tlv *) (pac + 1);

825

type->tlv_type = host_to_be16(PAC_TYPE_PAC_TYPE);

826

type->length = host_to_be16(2);

827

type->pac_type = host_to_be16(pac_type);

828

829

return (u8 *) (type + 1);

830

}

831

832

833

static u8 * eap_fast_process_crypto_binding(

834

struct eap_sm *sm, struct eap_fast_data *data,

835

struct eap_method_ret *ret,

836

struct eap_tlv_crypto_binding__tlv *_bind, size_t bind_len,

837

size_t *resp_len, int final)

838

{

839

u8 *resp, *pos;

840

struct eap_tlv_intermediate_result_tlv *rresult;

841

u8 cmk[20], cmac[20];

842

int res, req_tunnel_pac = 0;

843

844

if (eap_fast_validate_crypto_binding(_bind) < 0) {

845

return eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 1,

846

resp_len);

847

}

848

849

if (eap_fast_get_cmk(sm, data, cmk) < 0)

850

return NULL;

851

852

/* Validate received Compound MAC */

853

os_memcpy(cmac, _bind->compound_mac, sizeof(cmac));

854

os_memset(_bind->compound_mac, 0, sizeof(cmac));

855

wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Crypto-Binding TLV for Compound "

856

"MAC calculation", (u8 *) _bind, bind_len);

857

hmac_sha1(cmk, 20, (u8 *) _bind, bind_len, _bind->compound_mac);

858

res = os_memcmp(cmac, _bind->compound_mac, sizeof(cmac));

859

wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Received Compound MAC",

860

cmac, sizeof(cmac));

861

wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Calculated Compound MAC",

862

_bind->compound_mac, sizeof(cmac));

863

if (res != 0) {

864

wpa_printf(MSG_INFO, "EAP-FAST: Compound MAC did not match");

865

resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 1,

866

resp_len);

867

os_memcpy(_bind->compound_mac, cmac, sizeof(cmac));

868

return resp;

869

}

870

871

872

* Compound MAC was valid, so authentication succeeded. Reply with

873

* crypto binding to allow server to complete authentication.

874

875

876

if (data->current_pac == NULL && data->provisioning &&

877

!data->anon_provisioning) {

878

879

* Need to request Tunnel PAC when using authenticated

880

* provisioning.

881

882

wpa_printf(MSG_DEBUG, "EAP-FAST: Request Tunnel PAC");

883

req_tunnel_pac = 1;

884

}

885

886

*resp_len = sizeof(*rresult) +

887

sizeof(struct eap_tlv_crypto_binding__tlv);

888

if (req_tunnel_pac)

889

*resp_len += sizeof(struct eap_tlv_hdr) +

890

sizeof(struct eap_tlv_request_action_tlv) +

891

sizeof(struct eap_tlv_pac_type_tlv);

892

resp = os_zalloc(*resp_len);

893

if (resp == NULL)

894

return NULL;

895

896

897

* Both intermediate and final Result TLVs are identical, so ok to use

898

* the same structure definition for them.

899

900

rresult = (struct eap_tlv_intermediate_result_tlv *) resp;

901

rresult->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |

902

(final ? EAP_TLV_RESULT_TLV :

903

EAP_TLV_INTERMEDIATE_RESULT_TLV));

904

rresult->length = host_to_be16(2);

905

rresult->status = host_to_be16(EAP_TLV_RESULT_SUCCESS);

906

907

if (!data->anon_provisioning && data->phase2_success &&

908

eap_fast_derive_msk(data) < 0) {

909

wpa_printf(MSG_INFO, "EAP-FAST: Failed to generate MSK");

910

ret->methodState = METHOD_DONE;

911

ret->decision = DECISION_FAIL;

912

rresult->status = host_to_be16(EAP_TLV_RESULT_FAILURE);

913

data->phase2_success = 0;

914

}

915

916

pos = (u8 *) (rresult + 1);

917

eap_fast_write_crypto_binding((struct eap_tlv_crypto_binding__tlv *)

918

pos, _bind, cmk);

919

pos += sizeof(struct eap_tlv_crypto_binding__tlv);

920

921

if (req_tunnel_pac)

922

eap_fast_write_pac_request(pos, PAC_TYPE_TUNNEL_PAC);

923

924

if (final && data->phase2_success) {

925

if (data->anon_provisioning) {

926

wpa_printf(MSG_DEBUG, "EAP-FAST: Unauthenticated "

927

"provisioning completed successfully.");

928

ret->methodState = METHOD_DONE;

929

ret->decision = DECISION_FAIL;

930

} else {

931

wpa_printf(MSG_DEBUG, "EAP-FAST: Authentication "

932

"completed successfully.");

933

if (data->provisioning)

934

ret->methodState = METHOD_MAY_CONT;

935

else

936

ret->methodState = METHOD_DONE;

937

ret->decision = DECISION_UNCOND_SUCC;

938

}

939

}

940

941

return resp;

942

}

943

944

945

static void eap_fast_parse_pac_tlv(struct eap_fast_pac *entry, int type,

946

u8 *pos, size_t len, int *pac_key_found)

947

{

948

switch (type & 0x7fff) {

949

case PAC_TYPE_PAC_KEY:

950

wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: PAC-Key", pos, len);

951

if (len != EAP_FAST_PAC_KEY_LEN) {

952

wpa_printf(MSG_DEBUG, "EAP-FAST: Invalid PAC-Key "

953

"length %lu", (unsigned long) len);

954

break;

955

}

956

*pac_key_found = 1;

957

os_memcpy(entry->pac_key, pos, len);

958

break;

959

case PAC_TYPE_PAC_OPAQUE:

960

wpa_hexdump(MSG_DEBUG, "EAP-FAST: PAC-Opaque", pos, len);

961

entry->pac_opaque = pos;

962

entry->pac_opaque_len = len;

963

break;

964

case PAC_TYPE_PAC_INFO:

965

wpa_hexdump(MSG_DEBUG, "EAP-FAST: PAC-Info", pos, len);

966

entry->pac_info = pos;

967

entry->pac_info_len = len;

968

break;

969

default:

970

wpa_printf(MSG_DEBUG, "EAP-FAST: Ignored unknown PAC type %d",

971

type);

972

break;

973

}

974

}

975

976

977

static int eap_fast_process_pac_tlv(struct eap_fast_pac *entry,

978

u8 *pac, size_t pac_len)

979

{

980

struct pac_tlv_hdr *hdr;

981

u8 *pos;

982

size_t left, len;

983

int type, pac_key_found = 0;

984

985

pos = pac;

986

left = pac_len;

987

988

while (left > sizeof(*hdr)) {

989

hdr = (struct pac_tlv_hdr *) pos;

990

type = be_to_host16(hdr->type);

991

len = be_to_host16(hdr->len);

992

pos += sizeof(*hdr);

993

left -= sizeof(*hdr);

994

if (len > left) {

995

wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV overrun "

996

"(type=%d len=%lu left=%lu)",

997

type, (unsigned long) len,

998

(unsigned long) left);

999

return -1;

1000

}

1001

1002

eap_fast_parse_pac_tlv(entry, type, pos, len, &pac_key_found);

1003

1004

pos += len;

1005

left -= len;

1006

}

1007

1008

if (!pac_key_found || !entry->pac_opaque || !entry->pac_info) {

1009

wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV does not include "

1010

"all the required fields");

1011

return -1;

1012

}

1013

1014

return 0;

1015

}

1016

1017

1018

static int eap_fast_parse_pac_info(struct eap_fast_pac *entry, int type,

1019

u8 *pos, size_t len)

1020

{

1021

u16 pac_type;

1022

u32 lifetime;

1023

struct os_time now;

1024

1025

switch (type & 0x7fff) {

1026

case PAC_TYPE_CRED_LIFETIME:

1027

if (len != 4) {

1028

wpa_hexdump(MSG_DEBUG, "EAP-FAST: PAC-Info - "

1029

"Invalid CRED_LIFETIME length - ignored",

1030

pos, len);

1031

return 0;

1032

}

1033

1034

1035

* This is not currently saved separately in PAC files since

1036

* the server can automatically initiate PAC update when

1037

* needed. Anyway, the information is available from PAC-Info

1038

* dump if it is needed for something in the future.

1039

1040

lifetime = WPA_GET_BE32(pos);

1041

os_get_time(&now);

1042

wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info - CRED_LIFETIME %d "

1043

"(%d days)",

1044

lifetime, (lifetime - (u32) now.sec) / 86400);

1045

break;

1046

case PAC_TYPE_A_ID:

1047

wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: PAC-Info - A-ID",

1048

pos, len);

1049

entry->a_id = pos;

1050

entry->a_id_len = len;

1051

break;

1052

case PAC_TYPE_I_ID:

1053

wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: PAC-Info - I-ID",

1054

pos, len);

1055

entry->i_id = pos;

1056

entry->i_id_len = len;

1057

break;

1058

case PAC_TYPE_A_ID_INFO:

1059

wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: PAC-Info - A-ID-Info",

1060

pos, len);

1061

entry->a_id_info = pos;

1062

entry->a_id_info_len = len;

1063

break;

1064

case PAC_TYPE_PAC_TYPE:

1065

1066

* draft-cam-winget-eap-fast-provisioning-04.txt,

1067

* Section 4.2.6 - PAC-Type TLV

1068

1069

if (len != 2) {

1070

wpa_printf(MSG_INFO, "EAP-FAST: Invalid PAC-Type "

1071

"length %lu (expected 2)",

1072

(unsigned long) len);

1073

wpa_hexdump_ascii(MSG_DEBUG,

1074

"EAP-FAST: PAC-Info - PAC-Type",

1075

pos, len);

1076

return -1;

1077

}

1078

pac_type = WPA_GET_BE16(pos);

1079

if (pac_type != PAC_TYPE_TUNNEL_PAC &&

1080

pac_type != PAC_TYPE_USER_AUTHORIZATION &&

1081

pac_type != PAC_TYPE_MACHINE_AUTHENTICATION) {

1082

wpa_printf(MSG_INFO, "EAP-FAST: Unsupported PAC Type "

1083

"%d", pac_type);

1084

return -1;

1085

}

1086

1087

wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info - PAC-Type %d",

1088

pac_type);

1089

entry->pac_type = pac_type;

1090

break;

1091

default:

1092

wpa_printf(MSG_DEBUG, "EAP-FAST: Ignored unknown PAC-Info "

1093

"type %d", type);

1094

break;

1095

}

1096

1097

return 0;

1098

}

1099

1100

1101

static int eap_fast_process_pac_info(struct eap_fast_pac *entry)

1102

{

1103

struct pac_tlv_hdr *hdr;

1104

u8 *pos;

1105

size_t left, len;

1106

int type;

1107

1108

/* draft-cam-winget-eap-fast-provisioning-04.txt, Section 4.2.4 */

1109

1110

/* PAC-Type defaults to Tunnel PAC (Type 1) */

1111

entry->pac_type = PAC_TYPE_TUNNEL_PAC;

1112

1113

pos = entry->pac_info;

1114

left = entry->pac_info_len;

1115

while (left > sizeof(*hdr)) {

1116

hdr = (struct pac_tlv_hdr *) pos;

1117

type = be_to_host16(hdr->type);

1118

len = be_to_host16(hdr->len);

1119

pos += sizeof(*hdr);

1120

left -= sizeof(*hdr);

1121

if (len > left) {

1122

wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info overrun "

1123

"(type=%d len=%lu left=%lu)",

1124

type, (unsigned long) len,

1125

(unsigned long) left);

1126

return -1;

1127

}

1128

1129

if (eap_fast_parse_pac_info(entry, type, pos, len) < 0)

1130

return -1;

1131

1132

pos += len;

1133

left -= len;

1134

}

1135

1136

if (entry->a_id == NULL || entry->a_id_info == NULL) {

1137

wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info does not include "

1138

"all the required fields");

1139

return -1;

1140

}

1141

1142

return 0;

1143

}

1144

1145

1146

static u8 * eap_fast_process_pac(struct eap_sm *sm, struct eap_fast_data *data,

1147

struct eap_method_ret *ret,

1148

u8 *pac, size_t pac_len, size_t *resp_len)

1149

{

1150

struct wpa_ssid *config = eap_get_config(sm);

1151

struct eap_fast_pac entry;

1152

1153

os_memset(&entry, 0, sizeof(entry));

1154

if (eap_fast_process_pac_tlv(&entry, pac, pac_len) ||

1155

eap_fast_process_pac_info(&entry))

1156

return eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0,

1157

resp_len);

1158

1159

eap_fast_add_pac(&data->pac, &data->current_pac, &entry);

1160

eap_fast_pac_list_truncate(data->pac, data->max_pac_list_len);

1161

if (data->use_pac_binary_format)

1162

eap_fast_save_pac_bin(sm, data->pac, config->pac_file);

1163

else

1164

eap_fast_save_pac(sm, data->pac, config->pac_file);

1165

1166

if (data->provisioning) {

1167

if (data->anon_provisioning) {

1168

1169

* Unauthenticated provisioning does not provide keying

1170

* material and must end with an EAP-Failure.

1171

* Authentication will be done separately after this.

1172

1173

data->success = 0;

1174

ret->decision = DECISION_FAIL;

1175

} else {

1176

1177

* Server may or may not allow authenticated

1178

* provisioning also for key generation.

1179

1180

ret->decision = DECISION_COND_SUCC;

1181

}

1182

wpa_printf(MSG_DEBUG, "EAP-FAST: Send PAC-Acknowledgement TLV "

1183

"- Provisioning completed successfully");

1184

} else {

1185

1186

* This is PAC refreshing, i.e., normal authentication that is

1187

* expected to be completed with an EAP-Success.

1188

1189

wpa_printf(MSG_DEBUG, "EAP-FAST: Send PAC-Acknowledgement TLV "

1190

"- PAC refreshing completed successfully");

1191

ret->decision = DECISION_UNCOND_SUCC;

1192

}

1193

ret->methodState = METHOD_DONE;

1194

return eap_fast_tlv_pac_ack(resp_len);

1195

}

1196

1197

1198

struct eap_fast_tlv_parse {

1199

u8 *eap_payload_tlv;

1200

size_t eap_payload_tlv_len;

1201

u8 *pac;

1202

size_t pac_len;

1203

struct eap_tlv_crypto_binding__tlv *crypto_binding;

1204

size_t crypto_binding_len;

1205

int iresult;

1206

int result;

1207

};

1208

1209

1210

static int eap_fast_parse_tlv(struct eap_fast_tlv_parse *tlv,

1211

int tlv_type, u8 *pos, int len)

1212

{

1213

switch (tlv_type) {

1214

case EAP_TLV_EAP_PAYLOAD_TLV:

1215

wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: EAP Payload TLV",

1216

pos, len);

1217

tlv->eap_payload_tlv = pos;

1218

tlv->eap_payload_tlv_len = len;

1219

break;

1220

case EAP_TLV_RESULT_TLV:

1221

wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Result TLV", pos, len);

1222

if (len < 2) {

1223

wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "

1224

"Result TLV");

1225

tlv->result = EAP_TLV_RESULT_FAILURE;

1226

break;

1227

}

1228

tlv->result = WPA_GET_BE16(pos);

1229

if (tlv->result != EAP_TLV_RESULT_SUCCESS &&

1230

tlv->result != EAP_TLV_RESULT_FAILURE) {

1231

wpa_printf(MSG_DEBUG, "EAP-FAST: Unknown Result %d",

1232

tlv->result);

1233

tlv->result = EAP_TLV_RESULT_FAILURE;

1234

}

1235

wpa_printf(MSG_DEBUG, "EAP-FAST: Result: %s",

1236

tlv->result == EAP_TLV_RESULT_SUCCESS ?

1237

"Success" : "Failure");

1238

break;

1239

case EAP_TLV_INTERMEDIATE_RESULT_TLV:

1240

wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Intermediate Result TLV",

1241

pos, len);

1242

if (len < 2) {

1243

wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "

1244

"Intermediate Result TLV");

1245

tlv->iresult = EAP_TLV_RESULT_FAILURE;

1246

break;

1247

}

1248

tlv->iresult = WPA_GET_BE16(pos);

1249

if (tlv->iresult != EAP_TLV_RESULT_SUCCESS &&

1250

tlv->iresult != EAP_TLV_RESULT_FAILURE) {

1251

wpa_printf(MSG_DEBUG, "EAP-FAST: Unknown Intermediate "

1252

"Result %d", tlv->iresult);

1253

tlv->iresult = EAP_TLV_RESULT_FAILURE;

1254

}

1255

wpa_printf(MSG_DEBUG, "EAP-FAST: Intermediate Result: %s",

1256

tlv->iresult == EAP_TLV_RESULT_SUCCESS ?

1257

"Success" : "Failure");

1258

break;

1259

case EAP_TLV_CRYPTO_BINDING_TLV_:

1260

wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Crypto-Binding TLV",

1261

pos, len);

1262

tlv->crypto_binding_len = sizeof(struct eap_tlv_hdr) + len;

1263

if (tlv->crypto_binding_len < sizeof(*tlv->crypto_binding)) {

1264

wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "

1265

"Crypto-Binding TLV");

1266

tlv->iresult = EAP_TLV_RESULT_FAILURE;

1267

return -2;

1268

}

1269

tlv->crypto_binding = (struct eap_tlv_crypto_binding__tlv *)

1270

(pos - sizeof(struct eap_tlv_hdr));

1271

break;

1272

case EAP_TLV_PAC_TLV:

1273

wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: PAC TLV", pos, len);

1274

tlv->pac = pos;

1275

tlv->pac_len = len;

1276

break;

1277

default:

1278

/* Unknown TLV */

1279

return -1;

1280

}

1281

1282

return 0;

1283

}

1284

1285

1286

static int eap_fast_parse_decrypted(u8 *decrypted, size_t decrypted_len,

1287

struct eap_fast_tlv_parse *tlv,

1288

u8 **resp, size_t *resp_len)

1289

{

1290

int mandatory, tlv_type, len, res;

1291

u8 *pos, *end;

1292

1293

os_memset(tlv, 0, sizeof(*tlv));

1294

1295

/* Parse TLVs from the decrypted Phase 2 data */

1296

pos = decrypted;

1297

end = decrypted + decrypted_len;

1298

while (pos + 4 < end) {

1299

mandatory = pos[0] & 0x80;

1300

tlv_type = WPA_GET_BE16(pos) & 0x3fff;

1301

pos += 2;

1302

len = WPA_GET_BE16(pos);

1303

pos += 2;

1304

if (pos + len > end) {

1305

wpa_printf(MSG_INFO, "EAP-FAST: TLV overflow");

1306

return -1;

1307

}

1308

wpa_printf(MSG_DEBUG, "EAP-FAST: Received Phase 2: "

1309

"TLV type %d length %d%s",

1310

tlv_type, len, mandatory ? " (mandatory)" : "");

1311

1312

res = eap_fast_parse_tlv(tlv, tlv_type, pos, len);

1313

if (res == -2)

1314

break;

1315

if (res < 0) {

1316

if (mandatory) {

1317

wpa_printf(MSG_DEBUG, "EAP-FAST: Nak unknown "

1318

"mandatory TLV type %d", tlv_type);

1319

*resp = eap_fast_tlv_nak(0, tlv_type,

1320

resp_len);

1321

break;

1322

} else {

1323

wpa_printf(MSG_DEBUG, "EAP-FAST: ignored "

1324

"unknown optional TLV type %d",

1325

tlv_type);

1326

}

1327

}

1328

1329

pos += len;

1330

}

1331

1332

return 0;

1333

}

1334

1335

1336

static int eap_fast_encrypt_response(struct eap_sm *sm,

1337

struct eap_fast_data *data,

1338

u8 *resp, size_t resp_len,

1339

u8 identifier,

1340

u8 **out_data, size_t *out_len)

1341

{

1342

if (resp == NULL)

1343

return 0;

1344

1345

wpa_hexdump(MSG_DEBUG, "EAP-FAST: Encrypting Phase 2 data",

1346

resp, resp_len);

1347

if (eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_FAST,

1348

data->fast_version, identifier,

1349

resp, resp_len, out_data, out_len)) {

1350

wpa_printf(MSG_INFO, "EAP-FAST: Failed to encrypt a Phase 2 "

1351

"frame");

1352

}

1353

os_free(resp);

1354

1355

return 0;

1356

}

1357

1358

1359

static int eap_fast_process_decrypted(struct eap_sm *sm,

1360

struct eap_fast_data *data,

1361

struct eap_method_ret *ret,

1362

const struct eap_hdr *req,

1363

u8 *decrypted, size_t decrypted_len,

1364

u8 **out_data, size_t *out_len)

1365

{

1366

u8 *resp = NULL;

1367

size_t resp_len;

1368

struct eap_fast_tlv_parse tlv;

1369

1370

if (eap_fast_parse_decrypted(decrypted, decrypted_len, &tlv,

1371

&resp, &resp_len) < 0)

1372

return 0;

1373

if (resp)

1374

return eap_fast_encrypt_response(sm, data, resp, resp_len,

1375

req->identifier,

1376

out_data, out_len);

1377

1378

if (tlv.result == EAP_TLV_RESULT_FAILURE) {

1379

resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0,

1380

&resp_len);

1381

return eap_fast_encrypt_response(sm, data, resp, resp_len,

1382

req->identifier,

1383

out_data, out_len);

1384

}

1385

1386

if (tlv.iresult == EAP_TLV_RESULT_FAILURE) {

1387

resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 1,

1388

&resp_len);

1389

return eap_fast_encrypt_response(sm, data, resp, resp_len,

1390

req->identifier,

1391

out_data, out_len);

1392

}

1393

1394

if (tlv.eap_payload_tlv) {

1395

resp = eap_fast_process_eap_payload_tlv(

1396

sm, data, ret, req, tlv.eap_payload_tlv,

1397

tlv.eap_payload_tlv_len, &resp_len);

1398

return eap_fast_encrypt_response(sm, data, resp, resp_len,

1399

req->identifier,

1400

out_data, out_len);

1401

}

1402

1403

if (tlv.crypto_binding) {

1404

int final = tlv.result == EAP_TLV_RESULT_SUCCESS;

1405

resp = eap_fast_process_crypto_binding(sm, data, ret,

1406

tlv.crypto_binding,

1407

tlv.crypto_binding_len,

1408

&resp_len, final);

1409

return eap_fast_encrypt_response(sm, data, resp, resp_len,

1410

req->identifier,

1411

out_data, out_len);

1412

}

1413

1414

if (tlv.pac && tlv.result != EAP_TLV_RESULT_SUCCESS) {

1415

wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV without Result TLV "

1416

"acknowledging success");

1417

resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0,

1418

&resp_len);

1419

return eap_fast_encrypt_response(sm, data, resp, resp_len,

1420

req->identifier,

1421

out_data, out_len);

1422

}

1423

1424

if (tlv.pac && tlv.result == EAP_TLV_RESULT_SUCCESS) {

1425

resp = eap_fast_process_pac(sm, data, ret, tlv.pac,

1426

tlv.pac_len, &resp_len);

1427

return eap_fast_encrypt_response(sm, data, resp, resp_len,

1428

req->identifier,

1429

out_data, out_len);

1430

}

1431

1432

wpa_printf(MSG_DEBUG, "EAP-FAST: No recognized TLVs - send "

1433

"empty response packet");

1434

return eap_fast_encrypt_response(sm, data, os_malloc(1), 0,

1435

req->identifier,

1436

out_data, out_len);

1437

}

1438

1439

1440

static int eap_fast_decrypt(struct eap_sm *sm, struct eap_fast_data *data,

1441

struct eap_method_ret *ret,

1442

const struct eap_hdr *req,

1443

const u8 *in_data, size_t in_len,

1444

u8 **out_data, size_t *out_len)

1445

{

1446

u8 *in_decrypted;

1447

size_t len_decrypted;

1448

int res;

1449

1450

wpa_printf(MSG_DEBUG, "EAP-FAST: Received %lu bytes encrypted data for"

1451

" Phase 2", (unsigned long) in_len);

1452

1453

if (data->pending_phase2_req) {

1454

wpa_printf(MSG_DEBUG, "EAP-FAST: Pending Phase 2 request - "

1455

"skip decryption and use old data");

1456

/* Clear TLS reassembly state. */

1457

eap_peer_tls_reset_input(&data->ssl);

1458

in_decrypted = data->pending_phase2_req;

1459

data->pending_phase2_req = NULL;

1460

len_decrypted = data->pending_phase2_req_len;

1461

goto continue_req;

1462

}

1463

1464

if (in_len == 0) {

1465

/* Received TLS ACK - requesting more fragments */

1466

return eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_FAST,

1467

data->fast_version,

1468

req->identifier, NULL, 0,

1469

out_data, out_len);

1470

}

1471

1472

res = eap_peer_tls_decrypt(sm, &data->ssl, in_data, in_len,

1473

&in_decrypted, &len_decrypted);

1474

if (res)

1475

return res;

1476

1477

continue_req:

1478

wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Decrypted Phase 2 TLV(s)",

1479

in_decrypted, len_decrypted);

1480

1481

if (len_decrypted < 4) {

1482

os_free(in_decrypted);

1483

wpa_printf(MSG_INFO, "EAP-FAST: Too short Phase 2 "

1484

"TLV frame (len=%d)", len_decrypted);

1485

return -1;

1486

}

1487

1488

res = eap_fast_process_decrypted(sm, data, ret, req,

1489

in_decrypted, len_decrypted,

1490

out_data, out_len);

1491

1492

os_free(in_decrypted);

1493

1494

return res;

1495

}

1496

1497

1498

static const u8 * eap_fast_get_a_id(const u8 *buf, size_t len, size_t *id_len)

1499

{

1500

const u8 *a_id;

1501

struct pac_tlv_hdr *hdr;

1502

1503

1504

* Parse authority identity (A-ID) from the EAP-FAST/Start. This

1505

* supports both raw A-ID and one inside an A-ID TLV.

1506

1507

a_id = buf;

1508

*id_len = len;

1509

if (len > sizeof(*hdr)) {

1510

int tlen;

1511

hdr = (struct pac_tlv_hdr *) buf;

1512

tlen = be_to_host16(hdr->len);

1513

if (be_to_host16(hdr->type) == PAC_TYPE_A_ID &&

1514

sizeof(*hdr) + tlen <= len) {

1515

wpa_printf(MSG_DEBUG, "EAP-FAST: A-ID was in TLV "

1516

"(Start)");

1517

a_id = (u8 *) (hdr + 1);

1518

*id_len = tlen;

1519

}

1520

}

1521

wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: A-ID", a_id, *id_len);

1522

1523

return a_id;

1524

}

1525

1526

1527

static void eap_fast_select_pac(struct eap_fast_data *data,

1528

const u8 *a_id, size_t a_id_len)

1529

{

1530

data->current_pac = eap_fast_get_pac(data->pac, a_id, a_id_len,

1531

PAC_TYPE_TUNNEL_PAC);

1532

if (data->current_pac == NULL) {

1533

1534

* Tunnel PAC was not available for this A-ID. Try to use

1535

* Machine Authentication PAC, if one is available.

1536

1537

data->current_pac = eap_fast_get_pac(

1538

data->pac, a_id, a_id_len,

1539

PAC_TYPE_MACHINE_AUTHENTICATION);

1540

}

1541

1542

if (data->current_pac) {

1543

wpa_printf(MSG_DEBUG, "EAP-FAST: PAC found for this A-ID "

1544

"(PAC-Type %d)", data->current_pac->pac_type);

1545

wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-FAST: A-ID-Info",

1546

data->current_pac->a_id_info,

1547

data->current_pac->a_id_info_len);

1548

}

1549

}

1550

1551

1552

static int eap_fast_use_pac_opaque(struct eap_sm *sm,

1553

struct eap_fast_data *data,

1554

struct eap_fast_pac *pac)

1555

{

1556

u8 *tlv;

1557

size_t tlv_len, olen;

1558

struct eap_tlv_hdr *ehdr;

1559

1560

olen = pac->pac_opaque_len;

1561

tlv_len = sizeof(*ehdr) + olen;

1562

tlv = os_malloc(tlv_len);

1563

if (tlv) {

1564

ehdr = (struct eap_tlv_hdr *) tlv;

1565

ehdr->tlv_type = host_to_be16(PAC_TYPE_PAC_OPAQUE);

1566

ehdr->length = host_to_be16(olen);

1567

os_memcpy(ehdr + 1, pac->pac_opaque, olen);

1568

}

1569

if (tlv == NULL ||

1570

tls_connection_client_hello_ext(sm->ssl_ctx, data->ssl.conn,

1571

TLS_EXT_PAC_OPAQUE,

1572

tlv, tlv_len) < 0) {

1573

wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to add PAC-Opaque TLS "

1574

"extension");

1575

os_free(tlv);

1576

return -1;

1577

}

1578

os_free(tlv);

1579

1580

return 0;

1581

}

1582

1583

1584

static int eap_fast_clear_pac_opaque_ext(struct eap_sm *sm,

1585

struct eap_fast_data *data)

1586

{

1587

if (tls_connection_client_hello_ext(sm->ssl_ctx, data->ssl.conn,

1588

TLS_EXT_PAC_OPAQUE, NULL, 0) < 0) {

1589

wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to remove PAC-Opaque "

1590

"TLS extension");

1591

return -1;

1592

}

1593

return 0;

1594

}

1595

1596

1597

static int eap_fast_set_provisioning_ciphers(struct eap_sm *sm,

1598

struct eap_fast_data *data)

1599

{

1600

u8 ciphers[5];

1601

int count = 0;

1602

1603

if (data->provisioning_allowed & EAP_FAST_PROV_UNAUTH) {

1604

wpa_printf(MSG_DEBUG, "EAP-FAST: Enabling unauthenticated "

1605

"provisioning TLS cipher suites");

1606

ciphers[count++] = TLS_CIPHER_ANON_DH_AES128_SHA;

1607

}

1608

1609

if (data->provisioning_allowed & EAP_FAST_PROV_AUTH) {

1610

wpa_printf(MSG_DEBUG, "EAP-FAST: Enabling authenticated "

1611

"provisioning TLS cipher suites");

1612

ciphers[count++] = TLS_CIPHER_RSA_DHE_AES128_SHA;

1613

ciphers[count++] = TLS_CIPHER_AES128_SHA;

1614

ciphers[count++] = TLS_CIPHER_RC4_SHA;

1615

}

1616

1617

ciphers[count++] = TLS_CIPHER_NONE;

1618

1619

if (tls_connection_set_cipher_list(sm->ssl_ctx, data->ssl.conn,

1620

ciphers)) {

1621

wpa_printf(MSG_INFO, "EAP-FAST: Could not configure TLS "

1622

"cipher suites for provisioning");

1623

return -1;

1624

}

1625

1626

return 0;

1627

}

1628

1629

1630

static int eap_fast_process_start(struct eap_sm *sm,

1631

struct eap_fast_data *data, u8 flags,

1632

const u8 *pos, size_t left)

1633

{

1634

const u8 *a_id;

1635

size_t a_id_len;

1636

1637

/* EAP-FAST Version negotiation (section 3.1) */

1638

wpa_printf(MSG_DEBUG, "EAP-FAST: Start (server ver=%d, own ver=%d)",

1639

flags & EAP_PEAP_VERSION_MASK, data->fast_version);

1640

if ((flags & EAP_PEAP_VERSION_MASK) < data->fast_version)

1641

data->fast_version = flags & EAP_PEAP_VERSION_MASK;

1642

wpa_printf(MSG_DEBUG, "EAP-FAST: Using FAST version %d",

1643

data->fast_version);

1644

1645

a_id = eap_fast_get_a_id(pos, left, &a_id_len);

1646

eap_fast_select_pac(data, a_id, a_id_len);

1647

1648

if (data->resuming && data->current_pac) {

1649

wpa_printf(MSG_DEBUG, "EAP-FAST: Trying to resume session - "

1650

"do not add PAC-Opaque to TLS ClientHello");

1651

if (eap_fast_clear_pac_opaque_ext(sm, data) < 0)

1652

return -1;

1653

} else if (data->current_pac) {

1654

1655

* PAC found for the A-ID and we are not resuming an old

1656

* session, so add PAC-Opaque extension to ClientHello.

1657

1658

if (eap_fast_use_pac_opaque(sm, data, data->current_pac) < 0)

1659

return -1;

1660

} else {

1661

/* No PAC found, so we must provision one. */

1662

if (!data->provisioning_allowed) {

1663

wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC found and "

1664

"provisioning disabled");

1665

return -1;

1666

}

1667

wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC found - "

1668

"starting provisioning");

1669

if (eap_fast_set_provisioning_ciphers(sm, data) < 0 ||

1670

eap_fast_clear_pac_opaque_ext(sm, data) < 0)

1671

return -1;

1672

data->provisioning = 1;

1673

}

1674

1675

return 0;

1676

}

1677

1678

1679

static u8 * eap_fast_process(struct eap_sm *sm, void *priv,

1680

struct eap_method_ret *ret,

1681

const u8 *reqData, size_t reqDataLen,

1682

size_t *respDataLen)

1683

{

1684

const struct eap_hdr *req;

1685

size_t left;

1686

int res;

1687

u8 flags, *resp, id;

1688

const u8 *pos;

1689

struct eap_fast_data *data = priv;

1690

1691

pos = eap_peer_tls_process_init(sm, &data->ssl, EAP_TYPE_FAST, ret,

1692

reqData, reqDataLen, &left, &flags);

1693

if (pos == NULL)

1694

return NULL;

1695

1696

req = (const struct eap_hdr *) reqData;

1697

id = req->identifier;

1698

1699

if (flags & EAP_TLS_FLAGS_START) {

1700

if (eap_fast_process_start(sm, data, flags, pos, left) < 0)

1701

return NULL;

1702

1703

left = 0; /* A-ID is not used in further packet processing */

1704

}

1705

1706

resp = NULL;

1707

if (tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&

1708

!data->resuming) {

1709

/* Process tunneled (encrypted) phase 2 data. */

1710

res = eap_fast_decrypt(sm, data, ret, req, pos, left,

1711

&resp, respDataLen);

1712

if (res < 0) {

1713

ret->methodState = METHOD_DONE;

1714

ret->decision = DECISION_FAIL;

1715

1716

* Ack possible Alert that may have caused failure in

1717

* decryption.

1718

1719

res = 1;

1720

}

1721

} else {

1722

1723

* Try to configure the TLS master secret based on PAC-Key

1724

* and server/client random values. If the needed values are

1725

* not yet available, the function returns 0, so we only abort

1726

* on failure case when configuring the TLS library fails, not

1727

* if the key material is not yet available.

1728

1729

if (eap_fast_set_tls_master_secret(sm, data, pos, left) < 0) {

1730

wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to configure "

1731

"TLS master secret");

1732

ret->methodState = METHOD_DONE;

1733

ret->decision = DECISION_FAIL;

1734

return NULL;

1735

}

1736

1737

/* Continue processing TLS handshake (phase 1). */

1738

res = eap_peer_tls_process_helper(sm, &data->ssl,

1739

EAP_TYPE_FAST,

1740

data->fast_version, id, pos,

1741

left, &resp, respDataLen);

1742

1743

if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) {

1744

char cipher[80];

1745

wpa_printf(MSG_DEBUG,

1746

"EAP-FAST: TLS done, proceed to Phase 2");

1747

if (data->provisioning &&

1748

(!(data->provisioning_allowed &

1749

EAP_FAST_PROV_AUTH) ||

1750

tls_get_cipher(sm->ssl_ctx, data->ssl.conn,

1751

cipher, sizeof(cipher)) < 0 ||

1752

os_strstr(cipher, "ADH-") ||

1753

os_strstr(cipher, "anon"))) {

1754

wpa_printf(MSG_DEBUG, "EAP-FAST: Using "

1755

"anonymous (unauthenticated) "

1756

"provisioning");

1757

data->anon_provisioning = 1;

1758

} else

1759

data->anon_provisioning = 0;

1760

data->resuming = 0;

1761

eap_fast_derive_keys(sm, data);

1762

}

1763

1764

if (res == 2) {

1765

1766

* Application data included in the handshake message.

1767

1768

os_free(data->pending_phase2_req);

1769

data->pending_phase2_req = resp;

1770

data->pending_phase2_req_len = *respDataLen;

1771

resp = NULL;

1772

*respDataLen = 0;

1773

res = eap_fast_decrypt(sm, data, ret, req, pos, left,

1774

&resp, respDataLen);

1775

}

1776

}

1777

1778

if (res == 1) {

1779

os_free(resp);

1780

return eap_peer_tls_build_ack(&data->ssl, respDataLen, id,

1781

EAP_TYPE_FAST,

1782

data->fast_version);

1783

}

1784

1785

return resp;

1786

}

1787

1788

1789

#if 0 /* FIX */

1790

static Boolean eap_fast_has_reauth_data(struct eap_sm *sm, void *priv)

1791

{

1792

struct eap_fast_data *data = priv;

1793

return tls_connection_established(sm->ssl_ctx, data->ssl.conn);

1794

}

1795

1796

1797

static void eap_fast_deinit_for_reauth(struct eap_sm *sm, void *priv)

1798

{

1799

struct eap_fast_data *data = priv;

1800

os_free(data->key_block_p);

1801

data->key_block_p = NULL;

1802

os_free(data->pending_phase2_req);

1803

data->pending_phase2_req = NULL;

1804

}

1805

1806

1807

static void * eap_fast_init_for_reauth(struct eap_sm *sm, void *priv)

1808

{

1809

struct eap_fast_data *data = priv;

1810

if (eap_peer_tls_reauth_init(sm, &data->ssl)) {

1811

os_free(data);

1812

return NULL;

1813

}

1814

if (data->phase2_priv && data->phase2_method &&

1815

data->phase2_method->init_for_reauth)

1816

data->phase2_method->init_for_reauth(sm, data->phase2_priv);

1817

data->phase2_success = 0;

1818

data->resuming = 1;

1819

data->provisioning = 0;

1820

data->anon_provisioning = 0;

1821

data->simck_idx = 0;

1822

return priv;

1823

}

1824

#endif

1825

1826

1827

static int eap_fast_get_status(struct eap_sm *sm, void *priv, char *buf,

1828

size_t buflen, int verbose)

1829

{

1830

struct eap_fast_data *data = priv;

1831

int len, ret;

1832

1833

len = eap_peer_tls_status(sm, &data->ssl, buf, buflen, verbose);

1834

if (data->phase2_method) {

1835

ret = os_snprintf(buf + len, buflen - len,

1836

"EAP-FAST Phase2 method=%s\n",

1837

data->phase2_method->name);

1838

if (ret < 0 || (size_t) ret >= buflen - len)

1839

return len;

1840

len += ret;

1841

}

1842

return len;

1843

}

1844

1845

1846

static Boolean eap_fast_isKeyAvailable(struct eap_sm *sm, void *priv)

1847

{

1848

struct eap_fast_data *data = priv;

1849

return data->success;

1850

}

1851

1852

1853

static u8 * eap_fast_getKey(struct eap_sm *sm, void *priv, size_t *len)

1854

{

1855

struct eap_fast_data *data = priv;

1856

u8 *key;

1857

1858

if (!data->success)

1859

return NULL;

1860

1861

key = os_malloc(EAP_FAST_KEY_LEN);

1862

if (key == NULL)

1863

return NULL;

1864

1865

*len = EAP_FAST_KEY_LEN;

1866

os_memcpy(key, data->key_data, EAP_FAST_KEY_LEN);

1867

1868

return key;

1869

}

1870

1871

1872

static u8 * eap_fast_get_emsk(struct eap_sm *sm, void *priv, size_t *len)

1873

{

1874

struct eap_fast_data *data = priv;

1875

u8 *key;

1876

1877

if (!data->success)

1878

return NULL;

1879

1880

key = os_malloc(EAP_EMSK_LEN);

1881

if (key == NULL)

1882

return NULL;

1883

1884

*len = EAP_EMSK_LEN;

1885

os_memcpy(key, data->emsk, EAP_EMSK_LEN);

1886

1887

return key;

1888

}

1889

1890

1891

int eap_peer_fast_register(void)

1892

{

1893

struct eap_method *eap;

1894

int ret;

1895

1896

eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,

1897

EAP_VENDOR_IETF, EAP_TYPE_FAST, "FAST");

1898

if (eap == NULL)

1899

return -1;

1900

1901

eap->init = eap_fast_init;

1902

eap->deinit = eap_fast_deinit;

1903

eap->process = eap_fast_process;

1904

eap->isKeyAvailable = eap_fast_isKeyAvailable;

1905

eap->getKey = eap_fast_getKey;

1906

eap->get_status = eap_fast_get_status;

1907

#if 0

1908

eap->has_reauth_data = eap_fast_has_reauth_data;

1909

eap->deinit_for_reauth = eap_fast_deinit_for_reauth;

1910

eap->init_for_reauth = eap_fast_init_for_reauth;

1911

#endif

1912

eap->get_emsk = eap_fast_get_emsk;

1913

1914

ret = eap_peer_method_register(eap);

1915

if (ret)

1916

eap_peer_method_free(eap);

1917

return ret;

1918

}

Older »