contrib/wpa_supplicant/eap_fast.c

   1 /*
   2  * WPA Supplicant / EAP-FAST (draft-cam-winget-eap-fast-00.txt)
   3  * Copyright (c) 2004-2005, Jouni Malinen <jkmaline@cc.hut.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include <stdlib.h>
  16 #include <stdio.h>
  17 #include <string.h>
  18
  19 #include "common.h"
  20 #include "eap_i.h"
  21 #include "eap_tls_common.h"
  22 #include "wpa_supplicant.h"
  23 #include "config_ssid.h"
  24 #include "tls.h"
  25 #include "eap_tlv.h"
  26 #include "sha1.h"
  27 #include "config.h"
  28
  29 /* TODO:
  30  * - encrypt PAC-Key in the PAC file
  31  * - test session resumption and enable it if it interoperates
  32  * - password change (pending mschapv2 packet; replay decrypted packet)
  33  */
  34
  35 #define EAP_FAST_VERSION 1
  36 #define EAP_FAST_KEY_LEN 64
  37 #define EAP_FAST_PAC_KEY_LEN 32
  38
  39 #define TLS_EXT_PAC_OPAQUE 35
  40
  41 static const char *pac_file_hdr =
  42         "wpa_supplicant EAP-FAST PAC file - version 1";
  43
  44
  45 static void eap_fast_deinit(struct eap_sm *sm, void *priv);
  46
  47
  48 #define PAC_TYPE_PAC_KEY 1
  49 #define PAC_TYPE_PAC_OPAQUE 2
  50 #define PAC_TYPE_CRED_LIFETIME 3
  51 #define PAC_TYPE_A_ID 4
  52 #define PAC_TYPE_I_ID 5
  53 #define PAC_TYPE_SERVER_PROTECTED_DATA 6
  54 #define PAC_TYPE_A_ID_INFO 7
  55 #define PAC_TYPE_PAC_ACKNOWLEDGEMENT 8
  56 #define PAC_TYPE_PAC_INFO 9
  57
  58 struct pac_tlv_hdr {
  59         u16 type;
  60         u16 len;
  61 };
  62
  63
  64 /* draft-cam-winget-eap-fast-02.txt:
  65  * 6.2 EAP-FAST Authentication Phase 1: Key Derivations */
  66 struct eap_fast_key_block_auth {
  67         /* Extra key material after TLS key_block */
  68         u8 session_key_seed[40];
  69 };
  70
  71
  72 /* draft-cam-winget-eap-fast-provisioning-01.txt:
  73  * 3.4 Key Derivations Used in the EAP-FAST Provisioning Exchange */
  74 struct eap_fast_key_block_provisioning {
  75         /* Extra key material after TLS key_block */
  76         u8 session_key_seed[40];
  77         u8 server_challenge[16];
  78         u8 client_challenge[16];
  79 };
  80
  81
  82 struct eap_fast_pac {
  83         struct eap_fast_pac *next;
  84
  85         u8 pac_key[EAP_FAST_PAC_KEY_LEN];
  86         u8 *pac_opaque;
  87         size_t pac_opaque_len;
  88         u8 *pac_info;
  89         size_t pac_info_len;
  90         u8 *a_id;
  91         size_t a_id_len;
  92         u8 *i_id;
  93         size_t i_id_len;
  94         u8 *a_id_info;
  95         size_t a_id_info_len;
  96 };
  97
  98
  99 struct eap_fast_data {
 100         struct eap_ssl_data ssl;
 101
 102         int fast_version;
 103
 104         const struct eap_method *phase2_method;
 105         void *phase2_priv;
 106         int phase2_success;
 107
 108         u8 phase2_type;
 109         u8 *phase2_types;
 110         size_t num_phase2_types;
 111         int resuming; /* starting a resumed session */
 112         struct eap_fast_key_block_auth *key_block_a;
 113         struct eap_fast_key_block_provisioning *key_block_p;
 114         int provisioning_allowed; /* is PAC provisioning allowed */
 115         int provisioning; /* doing PAC provisioning (not the normal auth) */
 116
 117         u8 key_data[EAP_FAST_KEY_LEN];
 118         int success;
 119
 120         struct eap_fast_pac *pac;
 121         struct eap_fast_pac *current_pac;
 122
 123         int tls_master_secret_set;
 124 };
 125
 126
 127 static void eap_fast_free_pac(struct eap_fast_pac *pac)
 128 {
 129         free(pac->pac_opaque);
 130         free(pac->pac_info);
 131         free(pac->a_id);
 132         free(pac->i_id);
 133         free(pac->a_id_info);
 134         free(pac);
 135 }
 136
 137
 138 static struct eap_fast_pac * eap_fast_get_pac(struct eap_fast_data *data,
 139                                               const u8 *a_id, size_t a_id_len)
 140 {
 141         struct eap_fast_pac *pac = data->pac;
 142
 143         while (pac) {
 144                 if (pac->a_id_len == a_id_len &&
 145                     memcmp(pac->a_id, a_id, a_id_len) == 0) {
 146                         return pac;
 147                 }
 148                 pac = pac->next;
 149         }
 150         return NULL;
 151 }
 152
 153
 154 static int eap_fast_add_pac(struct eap_fast_data *data,
 155                             struct eap_fast_pac *entry)
 156 {
 157         struct eap_fast_pac *pac, *prev;
 158
 159         if (entry == NULL || entry->a_id == NULL)
 160                 return -1;
 161
 162         /* Remove a possible old entry for the matching A-ID. */
 163         pac = data->pac;
 164         prev = NULL;
 165         while (pac) {
 166                 if (pac->a_id_len == entry->a_id_len &&
 167                     memcmp(pac->a_id, entry->a_id, pac->a_id_len) == 0) {
 168                         if (prev == NULL) {
 169                                 data->pac = pac->next;
 170                         } else {
 171                                 prev->next = pac->next;
 172                         }
 173                         if (data->current_pac == pac)
 174                                 data->current_pac = NULL;
 175                         eap_fast_free_pac(pac);
 176                         break;
 177                 }
 178                 prev = pac;
 179                 pac = pac->next;
 180         }
 181
 182         /* Allocate a new entry and add it to the list of PACs. */
 183         pac = malloc(sizeof(*pac));
 184         if (pac == NULL)
 185                 return -1;
 186
 187         memset(pac, 0, sizeof(*pac));
 188         memcpy(pac->pac_key, entry->pac_key, EAP_FAST_PAC_KEY_LEN);
 189         if (entry->pac_opaque) {
 190                 pac->pac_opaque = malloc(entry->pac_opaque_len);
 191                 if (pac->pac_opaque == NULL) {
 192                         eap_fast_free_pac(pac);
 193                         return -1;
 194                 }
 195                 memcpy(pac->pac_opaque, entry->pac_opaque,
 196                        entry->pac_opaque_len);
 197                 pac->pac_opaque_len = entry->pac_opaque_len;
 198         }
 199         if (entry->pac_info) {
 200                 pac->pac_info = malloc(entry->pac_info_len);
 201                 if (pac->pac_info == NULL) {
 202                         eap_fast_free_pac(pac);
 203                         return -1;
 204                 }
 205                 memcpy(pac->pac_info, entry->pac_info,
 206                        entry->pac_info_len);
 207                 pac->pac_info_len = entry->pac_info_len;
 208         }
 209         if (entry->a_id) {
 210                 pac->a_id = malloc(entry->a_id_len);
 211                 if (pac->a_id == NULL) {
 212                         eap_fast_free_pac(pac);
 213                         return -1;
 214                 }
 215                 memcpy(pac->a_id, entry->a_id,
 216                        entry->a_id_len);
 217                 pac->a_id_len = entry->a_id_len;
 218         }
 219         if (entry->i_id) {
 220                 pac->i_id = malloc(entry->i_id_len);
 221                 if (pac->i_id == NULL) {
 222                         eap_fast_free_pac(pac);
 223                         return -1;
 224                 }
 225                 memcpy(pac->i_id, entry->i_id,
 226                        entry->i_id_len);
 227                 pac->i_id_len = entry->i_id_len;
 228         }
 229         if (entry->a_id_info) {
 230                 pac->a_id_info = malloc(entry->a_id_info_len);
 231                 if (pac->a_id_info == NULL) {
 232                         eap_fast_free_pac(pac);
 233                         return -1;
 234                 }
 235                 memcpy(pac->a_id_info, entry->a_id_info,
 236                        entry->a_id_info_len);
 237                 pac->a_id_info_len = entry->a_id_info_len;
 238         }
 239         pac->next = data->pac;
 240         data->pac = pac;
 241         return 0;
 242 }
 243
 244
 245 struct eap_fast_read_ctx {
 246         FILE *f;
 247         const char *pos;
 248         const char *end;
 249 };
 250
 251 static int eap_fast_read_line(struct eap_fast_read_ctx *rc, char *buf,
 252                               size_t buf_len)
 253 {
 254         char *pos;
 255
 256         if (rc->f) {
 257                 if (fgets(buf, buf_len, rc->f) == NULL)
 258                         return -1;
 259         } else {
 260                 const char *l_end;
 261                 size_t len;
 262                 if (rc->pos >= rc->end)
 263                         return -1;
 264                 l_end = rc->pos;
 265                 while (l_end < rc->end && *l_end != '\n')
 266                         l_end++;
 267                 len = l_end - rc->pos;
 268                 if (len >= buf_len)
 269                         len = buf_len - 1;
 270                 memcpy(buf, rc->pos, len);
 271                 buf[len] = '\0';
 272                 rc->pos = l_end + 1;
 273         }
 274
 275         buf[buf_len - 1] = '\0';
 276         pos = buf;
 277         while (*pos != '\0') {
 278                 if (*pos == '\n' || *pos == '\r') {
 279                         *pos = '\0';
 280                         break;
 281                 }
 282                 pos++;
 283         }
 284
 285         return 0;
 286 }
 287
 288
 289 static u8 * eap_fast_parse_hex(const char *value, size_t *len)
 290 {
 291         int hlen;
 292         u8 *buf;
 293
 294         if (value == NULL)
 295                 return NULL;
 296         hlen = strlen(value);
 297         if (hlen & 1)
 298                 return NULL;
 299         *len = hlen / 2;
 300         buf = malloc(*len);
 301         if (buf == NULL)
 302                 return NULL;
 303         if (hexstr2bin(value, buf, *len)) {
 304                 free(buf);
 305                 return NULL;
 306         }
 307         return buf;
 308 }
 309
 310
 311 static int eap_fast_load_pac(struct eap_sm *sm, struct eap_fast_data *data,
 312                              const char *pac_file)
 313 {
 314         struct eap_fast_read_ctx rc;
 315         struct eap_fast_pac *pac = NULL;
 316         int count = 0;
 317         char *buf, *pos;
 318         const int buf_len = 2048;
 319         int ret = 0, line = 0;
 320
 321         if (pac_file == NULL)
 322                 return -1;
 323
 324         memset(&rc, 0, sizeof(rc));
 325
 326         if (strncmp(pac_file, "blob://", 7) == 0) {
 327                 const struct wpa_config_blob *blob;
 328                 blob = eap_get_config_blob(sm, pac_file + 7);
 329                 if (blob == NULL) {
 330                         wpa_printf(MSG_INFO, "EAP-FAST: No PAC blob '%s' - "
 331                                    "assume no PAC entries have been "
 332                                    "provisioned", pac_file + 7);
 333                         return 0;
 334                 }
 335                 rc.pos = (char *) blob->data;
 336                 rc.end = (char *) blob->data + blob->len;
 337         } else {
 338                 rc.f = fopen(pac_file, "r");
 339                 if (rc.f == NULL) {
 340                         wpa_printf(MSG_INFO, "EAP-FAST: No PAC file '%s' - "
 341                                    "assume no PAC entries have been "
 342                                    "provisioned", pac_file);
 343                         return 0;
 344                 }
 345         }
 346
 347         buf = malloc(buf_len);
 348         if (buf == NULL) {
 349                 return -1;
 350         }
 351
 352         line++;
 353         if (eap_fast_read_line(&rc, buf, buf_len) < 0 ||
 354             strcmp(pac_file_hdr, buf) != 0) {
 355                 wpa_printf(MSG_INFO, "EAP-FAST: Unrecognized header line in "
 356                            "PAC file '%s'", pac_file);
 357                 free(buf);
 358                 if (rc.f)
 359                         fclose(rc.f);
 360                 return -1;
 361         }
 362
 363         while (eap_fast_read_line(&rc, buf, buf_len) == 0) {
 364                 line++;
 365                 pos = strchr(buf, '=');
 366                 if (pos) {
 367                         *pos++ = '\0';
 368                 }
 369
 370                 if (strcmp(buf, "START") == 0) {
 371                         if (pac) {
 372                                 wpa_printf(MSG_INFO, "EAP-FAST: START line "
 373                                            "without END in '%s:%d'",
 374                                            pac_file, line);
 375                                 ret = -1;
 376                                 break;
 377                         }
 378                         pac = malloc(sizeof(*pac));
 379                         if (pac == NULL) {
 380                                 wpa_printf(MSG_INFO, "EAP-FAST: No memory for "
 381                                            "PAC entry");
 382                                 ret = -1;
 383                                 break;
 384                         }
 385                         memset(pac, 0, sizeof(*pac));
 386                 } else if (strcmp(buf, "END") == 0) {
 387                         if (pac == NULL) {
 388                                 wpa_printf(MSG_INFO, "EAP-FAST: END line "
 389                                            "without START in '%s:%d'",
 390                                            pac_file, line);
 391                                 ret = -1;
 392                                 break;
 393                         }
 394                         pac->next = data->pac;
 395                         data->pac = pac;
 396                         pac = NULL;
 397                         count++;
 398                 } else if (pac && strcmp(buf, "PAC-Key") == 0) {
 399                         u8 *key;
 400                         size_t key_len;
 401                         key = eap_fast_parse_hex(pos, &key_len);
 402                         if (key == NULL || key_len != EAP_FAST_PAC_KEY_LEN) {
 403                                 wpa_printf(MSG_INFO, "EAP-FAST: Invalid "
 404                                            "PAC-Key '%s:%d'", pac_file, line);
 405                                 ret = -1;
 406                                 free(key);
 407                                 break;
 408                         }
 409
 410                         memcpy(pac->pac_key, key, EAP_FAST_PAC_KEY_LEN);
 411                         free(key);
 412                 } else if (pac && strcmp(buf, "PAC-Opaque") == 0) {
 413                         pac->pac_opaque =
 414                                 eap_fast_parse_hex(pos, &pac->pac_opaque_len);
 415                         if (pac->pac_opaque == NULL) {
 416                                 wpa_printf(MSG_INFO, "EAP-FAST: Invalid "
 417                                            "PAC-Opaque '%s:%d'",
 418                                            pac_file, line);
 419                                 ret = -1;
 420                                 break;
 421                         }
 422                 } else if (pac && strcmp(buf, "A-ID") == 0) {
 423                         pac->a_id = eap_fast_parse_hex(pos, &pac->a_id_len);
 424                         if (pac->a_id == NULL) {
 425                                 wpa_printf(MSG_INFO, "EAP-FAST: Invalid "
 426                                            "A-ID '%s:%d'", pac_file, line);
 427                                 ret = -1;
 428                                 break;
 429                         }
 430                 } else if (pac && strcmp(buf, "I-ID") == 0) {
 431                         pac->i_id = eap_fast_parse_hex(pos, &pac->i_id_len);
 432                         if (pac->i_id == NULL) {
 433                                 wpa_printf(MSG_INFO, "EAP-FAST: Invalid "
 434                                            "I-ID '%s:%d'", pac_file, line);
 435                                 ret = -1;
 436                                 break;
 437                         }
 438                 } else if (pac && strcmp(buf, "A-ID-Info") == 0) {
 439                         pac->a_id_info =
 440                                 eap_fast_parse_hex(pos, &pac->a_id_info_len);
 441                         if (pac->a_id_info == NULL) {
 442                                 wpa_printf(MSG_INFO, "EAP-FAST: Invalid "
 443                                            "A-ID-Info '%s:%d'",
 444                                            pac_file, line);
 445                                 ret = -1;
 446                                 break;
 447                         }
 448                 }
 449         }
 450
 451         if (pac) {
 452                 wpa_printf(MSG_INFO, "EAP-FAST: PAC block not terminated with "
 453                            "END in '%s'", pac_file);
 454                 eap_fast_free_pac(pac);
 455                 ret = -1;
 456         }
 457
 458         free(buf);
 459         if (rc.f)
 460                 fclose(rc.f);
 461
 462         if (ret == 0) {
 463                 wpa_printf(MSG_DEBUG, "EAP-FAST: read %d PAC entries from "
 464                            "'%s'", count, pac_file);
 465         }
 466
 467         return ret;
 468 }
 469
 470
 471 static void eap_fast_write(char **buf, char **pos, size_t *buf_len,
 472                            const char *field, const u8 *data,
 473                            size_t len, int txt)
 474 {
 475         int i;
 476         size_t need;
 477
 478         if (data == NULL || *buf == NULL)
 479                 return;
 480
 481         need = strlen(field) + len * 2 + 30;
 482         if (txt)
 483                 need += strlen(field) + len + 20;
 484
 485         if (*pos - *buf + need > *buf_len) {
 486                 char *nbuf = realloc(*buf, *buf_len + need);
 487                 if (nbuf == NULL) {
 488                         free(*buf);
 489                         *buf = NULL;
 490                         return;
 491                 }
 492                 *buf = nbuf;
 493                 *buf_len += need;
 494         }
 495
 496         *pos += snprintf(*pos, *buf + *buf_len - *pos, "%s=", field);
 497         for (i = 0; i < len; i++) {
 498                 *pos += snprintf(*pos, *buf + *buf_len - *pos,
 499                                  "%02x", data[i]);
 500         }
 501         *pos += snprintf(*pos, *buf + *buf_len - *pos, "\n");
 502
 503         if (txt) {
 504                 *pos += snprintf(*pos, *buf + *buf_len - *pos,
 505                                  "%s-txt=", field);
 506                 for (i = 0; i < len; i++) {
 507                         *pos += snprintf(*pos, *buf + *buf_len - *pos,
 508                                          "%c", data[i]);
 509                 }
 510                 *pos += snprintf(*pos, *buf + *buf_len - *pos, "\n");
 511         }
 512 }
 513
 514
 515 static int eap_fast_save_pac(struct eap_sm *sm, struct eap_fast_data *data,
 516                              const char *pac_file)
 517 {
 518         FILE *f;
 519         struct eap_fast_pac *pac;
 520         int count = 0;
 521         char *buf, *pos;
 522         size_t buf_len;
 523
 524         if (pac_file == NULL)
 525                 return -1;
 526
 527         buf_len = 1024;
 528         pos = buf = malloc(buf_len);
 529         if (buf == NULL)
 530                 return -1;
 531
 532         pos += snprintf(pos, buf + buf_len - pos, "%s\n", pac_file_hdr);
 533
 534         pac = data->pac;
 535         while (pac) {
 536                 pos += snprintf(pos, buf + buf_len - pos, "START\n");
 537                 eap_fast_write(&buf, &pos, &buf_len, "PAC-Key", pac->pac_key,
 538                                EAP_FAST_PAC_KEY_LEN, 0);
 539                 eap_fast_write(&buf, &pos, &buf_len, "PAC-Opaque",
 540                                pac->pac_opaque, pac->pac_opaque_len, 0);
 541                 eap_fast_write(&buf, &pos, &buf_len, "PAC-Info", pac->pac_info,
 542                                pac->pac_info_len, 0);
 543                 eap_fast_write(&buf, &pos, &buf_len, "A-ID", pac->a_id,
 544                                pac->a_id_len, 0);
 545                 eap_fast_write(&buf, &pos, &buf_len, "I-ID", pac->i_id,
 546                                pac->i_id_len, 1);
 547                 eap_fast_write(&buf, &pos, &buf_len, "A-ID-Info",
 548                                pac->a_id_info, pac->a_id_info_len, 1);
 549                 pos += snprintf(pos, buf + buf_len - pos, "END\n");
 550                 count++;
 551                 pac = pac->next;
 552
 553                 if (buf == NULL) {
 554                         wpa_printf(MSG_DEBUG, "EAP-FAST: No memory for PAC "
 555                                    "data");
 556                         return -1;
 557                 }
 558         }
 559
 560         if (strncmp(pac_file, "blob://", 7) == 0) {
 561                 struct wpa_config_blob *blob;
 562                 blob = malloc(sizeof(*blob));
 563                 if (blob == NULL) {
 564                         free(buf);
 565                         return -1;
 566                 }
 567                 memset(blob, 0, sizeof(*blob));
 568                 blob->data = (u8 *) buf;
 569                 blob->len = pos - buf;
 570                 buf = NULL;
 571                 blob->name = strdup(pac_file + 7);
 572                 if (blob->name == NULL) {
 573                         wpa_config_free_blob(blob);
 574                         return -1;
 575                 }
 576                 eap_set_config_blob(sm, blob);
 577         } else {
 578                 f = fopen(pac_file, "w");
 579                 if (f == NULL) {
 580                         wpa_printf(MSG_INFO, "EAP-FAST: Failed to open PAC "
 581                                    "file '%s' for writing", pac_file);
 582                         free(buf);
 583                         return -1;
 584                 }
 585                 fprintf(f, "%s", buf);
 586                 free(buf);
 587                 fclose(f);
 588         }
 589
 590         wpa_printf(MSG_DEBUG, "EAP-FAST: wrote %d PAC entries into '%s'",
 591                    count, pac_file);
 592
 593         return 0;
 594 }
 595
 596
 597 static void * eap_fast_init(struct eap_sm *sm)
 598 {
 599         struct eap_fast_data *data;
 600         struct wpa_ssid *config = eap_get_config(sm);
 601
 602         data = malloc(sizeof(*data));
 603         if (data == NULL)
 604                 return NULL;
 605         memset(data, 0, sizeof(*data));
 606         data->fast_version = EAP_FAST_VERSION;
 607
 608         if (config && config->phase1) {
 609                 if (strstr(config->phase1, "fast_provisioning=1")) {
 610                         data->provisioning_allowed = 1;
 611                         wpa_printf(MSG_DEBUG, "EAP-FAST: Automatic PAC "
 612                                    "provisioning is allowed");
 613                 }
 614         }
 615
 616         if (config && config->phase2) {
 617                 char *start, *pos, *buf;
 618                 u8 method, *methods = NULL, *_methods;
 619                 size_t num_methods = 0;
 620                 start = buf = strdup(config->phase2);
 621                 if (buf == NULL) {
 622                         eap_fast_deinit(sm, data);
 623                         return NULL;
 624                 }
 625                 while (start && *start != '\0') {
 626                         pos = strstr(start, "auth=");
 627                         if (pos == NULL)
 628                                 break;
 629                         if (start != pos && *(pos - 1) != ' ') {
 630                                 start = pos + 5;
 631                                 continue;
 632                         }
 633
 634                         start = pos + 5;
 635                         pos = strchr(start, ' ');
 636                         if (pos)
 637                                 *pos++ = '\0';
 638                         method = eap_get_phase2_type(start);
 639                         if (method == EAP_TYPE_NONE) {
 640                                 wpa_printf(MSG_ERROR, "EAP-FAST: Unsupported "
 641                                            "Phase2 method '%s'", start);
 642                         } else {
 643                                 num_methods++;
 644                                 _methods = realloc(methods, num_methods);
 645                                 if (_methods == NULL) {
 646                                         free(methods);
 647                                         eap_fast_deinit(sm, data);
 648                                         return NULL;
 649                                 }
 650                                 methods = _methods;
 651                                 methods[num_methods - 1] = method;
 652                         }
 653
 654                         start = pos;
 655                 }
 656                 free(buf);
 657                 data->phase2_types = methods;
 658                 data->num_phase2_types = num_methods;
 659         }
 660         if (data->phase2_types == NULL) {
 661                 data->phase2_types =
 662                         eap_get_phase2_types(config, &data->num_phase2_types);
 663         }
 664         if (data->phase2_types == NULL) {
 665                 wpa_printf(MSG_ERROR, "EAP-FAST: No Phase2 method available");
 666                 eap_fast_deinit(sm, data);
 667                 return NULL;
 668         }
 669         wpa_hexdump(MSG_DEBUG, "EAP-FAST: Phase2 EAP types",
 670                     data->phase2_types, data->num_phase2_types);
 671         data->phase2_type = EAP_TYPE_NONE;
 672
 673         if (eap_tls_ssl_init(sm, &data->ssl, config)) {
 674                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to initialize SSL.");
 675                 eap_fast_deinit(sm, data);
 676                 return NULL;
 677         }
 678
 679         /* The local RADIUS server in a Cisco AP does not seem to like empty
 680          * fragments before data, so disable that workaround for CBC.
 681          * TODO: consider making this configurable */
 682         tls_connection_enable_workaround(sm->ssl_ctx, data->ssl.conn);
 683
 684         if (eap_fast_load_pac(sm, data, config->pac_file) < 0) {
 685                 eap_fast_deinit(sm, data);
 686                 return NULL;
 687         }
 688
 689         if (data->pac == NULL && !data->provisioning_allowed) {
 690                 wpa_printf(MSG_INFO, "EAP-FAST: No PAC configured and "
 691                            "provisioning disabled");
 692                 eap_fast_deinit(sm, data);
 693                 return NULL;
 694         }
 695
 696         return data;
 697 }
 698
 699
 700 static void eap_fast_deinit(struct eap_sm *sm, void *priv)
 701 {
 702         struct eap_fast_data *data = priv;
 703         struct eap_fast_pac *pac, *prev;
 704
 705         if (data == NULL)
 706                 return;
 707         if (data->phase2_priv && data->phase2_method)
 708                 data->phase2_method->deinit(sm, data->phase2_priv);
 709         free(data->phase2_types);
 710         free(data->key_block_a);
 711         free(data->key_block_p);
 712         eap_tls_ssl_deinit(sm, &data->ssl);
 713
 714         pac = data->pac;
 715         prev = NULL;
 716         while (pac) {
 717                 prev = pac;
 718                 pac = pac->next;
 719                 eap_fast_free_pac(prev);
 720         }
 721         free(data);
 722 }
 723
 724
 725 static int eap_fast_encrypt(struct eap_sm *sm, struct eap_fast_data *data,
 726                             int id, const u8 *plain, size_t plain_len,
 727                             u8 **out_data, size_t *out_len)
 728 {
 729         int res;
 730         u8 *pos;
 731         struct eap_hdr *resp;
 732
 733         /* TODO: add support for fragmentation, if needed. This will need to
 734          * add TLS Message Length field, if the frame is fragmented. */
 735         resp = malloc(sizeof(struct eap_hdr) + 2 + data->ssl.tls_out_limit);
 736         if (resp == NULL)
 737                 return 0;
 738
 739         resp->code = EAP_CODE_RESPONSE;
 740         resp->identifier = id;
 741
 742         pos = (u8 *) (resp + 1);
 743         *pos++ = EAP_TYPE_FAST;
 744         *pos++ = data->fast_version;
 745
 746         res = tls_connection_encrypt(sm->ssl_ctx, data->ssl.conn,
 747                                      plain, plain_len,
 748                                      pos, data->ssl.tls_out_limit);
 749         if (res < 0) {
 750                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to encrypt Phase 2 "
 751                            "data");
 752                 free(resp);
 753                 return 0;
 754         }
 755
 756         *out_len = sizeof(struct eap_hdr) + 2 + res;
 757         resp->length = host_to_be16(*out_len);
 758         *out_data = (u8 *) resp;
 759         return 0;
 760 }
 761
 762
 763 static int eap_fast_phase2_nak(struct eap_sm *sm,
 764                                struct eap_fast_data *data,
 765                                struct eap_hdr *hdr,
 766                                u8 **resp, size_t *resp_len)
 767 {
 768         struct eap_hdr *resp_hdr;
 769         u8 *pos = (u8 *) (hdr + 1);
 770
 771         wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 Request: Nak type=%d", *pos);
 772         wpa_hexdump(MSG_DEBUG, "EAP-FAST: Allowed Phase2 EAP types",
 773                     data->phase2_types, data->num_phase2_types);
 774         *resp_len = sizeof(struct eap_hdr) + 1 + data->num_phase2_types;
 775         *resp = malloc(*resp_len);
 776         if (*resp == NULL)
 777                 return -1;
 778
 779         resp_hdr = (struct eap_hdr *) (*resp);
 780         resp_hdr->code = EAP_CODE_RESPONSE;
 781         resp_hdr->identifier = hdr->identifier;
 782         resp_hdr->length = host_to_be16(*resp_len);
 783         pos = (u8 *) (resp_hdr + 1);
 784         *pos++ = EAP_TYPE_NAK;
 785         memcpy(pos, data->phase2_types, data->num_phase2_types);
 786
 787         return 0;
 788 }
 789
 790
 791 static int eap_fast_derive_msk(struct eap_sm *sm, struct eap_fast_data *data)
 792 {
 793         u8 isk[32];
 794         u8 imck[60];
 795
 796         if (data->key_block_a == NULL)
 797                 return -1;
 798
 799         memset(isk, 0, sizeof(isk));
 800         sha1_t_prf(data->key_block_a->session_key_seed,
 801                    sizeof(data->key_block_a->session_key_seed),
 802                    "Inner Methods Compound Keys",
 803                    isk, sizeof(isk), imck, sizeof(imck));
 804         sha1_t_prf(imck, 40, "Session Key Generating Function", (u8 *) "", 0,
 805                    data->key_data, EAP_FAST_KEY_LEN);
 806
 807         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: Derived key (MSK)",
 808                         data->key_data, EAP_FAST_KEY_LEN);
 809
 810         data->success = 1;
 811
 812         return 0;
 813 }
 814
 815
 816 static int eap_fast_set_tls_master_secret(struct eap_sm *sm,
 817                                           struct eap_fast_data *data,
 818                                           const u8 *tls, size_t tls_len)
 819 {
 820         struct tls_keys keys;
 821         u8 master_secret[48], *seed;
 822         const u8 *server_random;
 823         size_t seed_len, server_random_len;
 824
 825         if (data->tls_master_secret_set || !data->current_pac ||
 826             tls_connection_get_keys(sm->ssl_ctx, data->ssl.conn, &keys)) {
 827                 return 0;
 828         }
 829
 830         wpa_hexdump(MSG_DEBUG, "EAP-FAST: client_random",
 831                     keys.client_random, keys.client_random_len);
 832
 833         /* TLS master secret is needed before TLS library has processed this
 834          * message which includes both ServerHello and an encrypted handshake
 835          * message, so we need to parse server_random from this message before
 836          * passing it to TLS library.
 837          *
 838          * Example TLS packet header:
 839          * (16 03 01 00 2a 02 00 00 26 03 01 <32 bytes server_random>)
 840          * Content Type: Handshake: 0x16
 841          * Version: TLS 1.0 (0x0301)
 842          * Lenghth: 42 (0x002a)
 843          * Handshake Type: Server Hello: 0x02
 844          * Length: 38 (0x000026)
 845          * Version TLS 1.0 (0x0301)
 846          * Random: 32 bytes
 847          */
 848         if (tls_len < 43 || tls[0] != 0x16 ||
 849             tls[1] != 0x03 || tls[2] != 0x01 ||
 850             tls[5] != 0x02 || tls[9] != 0x03 || tls[10] != 0x01) {
 851                 wpa_hexdump(MSG_DEBUG, "EAP-FAST: unrecognized TLS "
 852                             "ServerHello", tls, tls_len);
 853                 return -1;
 854         }
 855         server_random = tls + 11;
 856         server_random_len = 32;
 857         wpa_hexdump(MSG_DEBUG, "EAP-FAST: server_random",
 858                     server_random, server_random_len);
 859
 860
 861         seed_len = keys.client_random_len + server_random_len;
 862         seed = malloc(seed_len);
 863         if (seed == NULL)
 864                 return -1;
 865         memcpy(seed, server_random, server_random_len);
 866         memcpy(seed + server_random_len,
 867                keys.client_random, keys.client_random_len);
 868
 869         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: T-PRF seed", seed, seed_len);
 870         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: PAC-Key",
 871                         data->current_pac->pac_key, EAP_FAST_PAC_KEY_LEN);
 872         /* master_secret = T-PRF(PAC-Key, "PAC to master secret label hash",
 873          * server_random + client_random, 48) */
 874         sha1_t_prf(data->current_pac->pac_key, EAP_FAST_PAC_KEY_LEN,
 875                    "PAC to master secret label hash",
 876                    seed, seed_len, master_secret, sizeof(master_secret));
 877         free(seed);
 878         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: TLS pre-master-secret",
 879                         master_secret, sizeof(master_secret));
 880
 881         data->tls_master_secret_set = 1;
 882
 883         return tls_connection_set_master_key(sm->ssl_ctx, data->ssl.conn,
 884                                              master_secret,
 885                                              sizeof(master_secret));
 886 }
 887
 888
 889 static u8 * eap_fast_derive_key(struct eap_sm *sm, struct eap_ssl_data *data,
 890                                 char *label, size_t len)
 891 {
 892         struct tls_keys keys;
 893         u8 *rnd;
 894         u8 *out;
 895         int block_size;
 896
 897         if (tls_connection_get_keys(sm->ssl_ctx, data->conn, &keys))
 898                 return NULL;
 899         block_size = tls_connection_get_keyblock_size(sm->ssl_ctx, data->conn);
 900         if (block_size < 0)
 901                 return NULL;
 902         out = malloc(block_size + len);
 903         rnd = malloc(keys.client_random_len + keys.server_random_len);
 904         if (out == NULL || rnd == NULL) {
 905                 free(out);
 906                 free(rnd);
 907                 return NULL;
 908         }
 909         memcpy(rnd, keys.server_random, keys.server_random_len);
 910         memcpy(rnd + keys.server_random_len, keys.client_random,
 911                keys.client_random_len);
 912
 913         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: master_secret for key "
 914                         "expansion", keys.master_key, keys.master_key_len);
 915         if (tls_prf(keys.master_key, keys.master_key_len,
 916                     label, rnd, keys.client_random_len +
 917                     keys.server_random_len, out, block_size + len)) {
 918                 free(rnd);
 919                 free(out);
 920                 return NULL;
 921         }
 922         free(rnd);
 923         memmove(out, out + block_size, len);
 924         return out;
 925 }
 926
 927
 928 static void eap_fast_derive_key_auth(struct eap_sm *sm,
 929                                      struct eap_fast_data *data)
 930 {
 931         free(data->key_block_a);
 932         data->key_block_a = (struct eap_fast_key_block_auth *)
 933                 eap_fast_derive_key(sm, &data->ssl, "key expansion",
 934                                     sizeof(*data->key_block_a));
 935         if (data->key_block_a == NULL) {
 936                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to derive "
 937                            "session_key_seed");
 938                 return;
 939         }
 940         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: session_key_seed",
 941                         data->key_block_a->session_key_seed,
 942                         sizeof(data->key_block_a->session_key_seed));
 943 }
 944
 945
 946 static void eap_fast_derive_key_provisioning(struct eap_sm *sm,
 947                                              struct eap_fast_data *data)
 948 {
 949         free(data->key_block_p);
 950         data->key_block_p = (struct eap_fast_key_block_provisioning *)
 951                 eap_fast_derive_key(sm, &data->ssl, "key expansion",
 952                                     sizeof(*data->key_block_p));
 953         if (data->key_block_p == NULL) {
 954                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to derive key block");
 955                 return;
 956         }
 957         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: session_key_seed",
 958                         data->key_block_p->session_key_seed,
 959                         sizeof(data->key_block_p->session_key_seed));
 960         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: server_challenge",
 961                         data->key_block_p->server_challenge,
 962                         sizeof(data->key_block_p->server_challenge));
 963         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: client_challenge",
 964                         data->key_block_p->client_challenge,
 965                         sizeof(data->key_block_p->client_challenge));
 966 }
 967
 968
 969 static void eap_fast_derive_keys(struct eap_sm *sm, struct eap_fast_data *data)
 970 {
 971         if (data->current_pac) {
 972                 eap_fast_derive_key_auth(sm, data);
 973         } else {
 974                 eap_fast_derive_key_provisioning(sm, data);
 975         }
 976 }
 977
 978
 979 static int eap_fast_phase2_request(struct eap_sm *sm,
 980                                    struct eap_fast_data *data,
 981                                    struct eap_method_ret *ret,
 982                                    const struct eap_hdr *req,
 983                                    struct eap_hdr *hdr,
 984                                    u8 **resp, size_t *resp_len)
 985 {
 986         size_t len = be_to_host16(hdr->length);
 987         u8 *pos;
 988         struct eap_method_ret iret;
 989
 990         if (len <= sizeof(struct eap_hdr)) {
 991                 wpa_printf(MSG_INFO, "EAP-FAST: too short "
 992                            "Phase 2 request (len=%lu)", (unsigned long) len);
 993                 return -1;
 994         }
 995         pos = (u8 *) (hdr + 1);
 996         wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 Request: type=%d", *pos);
 997         switch (*pos) {
 998         case EAP_TYPE_IDENTITY:
 999                 *resp = eap_sm_buildIdentity(sm, req->identifier, resp_len, 1);
1000                 break;
1001         default:
1002                 if (data->phase2_type == EAP_TYPE_NONE) {
1003                         int i;
1004                         for (i = 0; i < data->num_phase2_types; i++) {
1005                                 if (data->phase2_types[i] != *pos)
1006                                         continue;
1007
1008                                 data->phase2_type = *pos;
1009                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Selected "
1010                                            "Phase 2 EAP method %d",
1011                                            data->phase2_type);
1012                                 break;
1013                         }
1014                 }
1015                 if (*pos != data->phase2_type || *pos == EAP_TYPE_NONE) {
1016                         if (eap_fast_phase2_nak(sm, data, hdr, resp, resp_len))
1017                                 return -1;
1018                         return 0;
1019                 }
1020
1021                 if (data->phase2_priv == NULL) {
1022                         data->phase2_method = eap_sm_get_eap_methods(*pos);
1023                         if (data->phase2_method) {
1024                                 if (data->key_block_p) {
1025                                         sm->auth_challenge =
1026                                                 data->key_block_p->
1027                                                 server_challenge;
1028                                         sm->peer_challenge =
1029                                                 data->key_block_p->
1030                                                 client_challenge;
1031                                 }
1032                                 sm->init_phase2 = 1;
1033                                 data->phase2_priv =
1034                                         data->phase2_method->init(sm);
1035                                 sm->init_phase2 = 0;
1036                                 sm->auth_challenge = NULL;
1037                                 sm->peer_challenge = NULL;
1038                         }
1039                 }
1040                 if (data->phase2_priv == NULL || data->phase2_method == NULL) {
1041                         wpa_printf(MSG_INFO, "EAP-FAST: failed to initialize "
1042                                    "Phase 2 EAP method %d", *pos);
1043                         ret->methodState = METHOD_DONE;
1044                         ret->decision = DECISION_FAIL;
1045                         return -1;
1046                 }
1047                 memset(&iret, 0, sizeof(iret));
1048                 *resp = data->phase2_method->process(sm, data->phase2_priv,
1049                                                      &iret, (u8 *) hdr, len,
1050                                                      resp_len);
1051                 if (*resp == NULL ||
1052                     (iret.methodState == METHOD_DONE &&
1053                      iret.decision == DECISION_FAIL)) {
1054                         ret->methodState = METHOD_DONE;
1055                         ret->decision = DECISION_FAIL;
1056                 } else if ((iret.methodState == METHOD_DONE ||
1057                             iret.methodState == METHOD_MAY_CONT) &&
1058                            (iret.decision == DECISION_UNCOND_SUCC ||
1059                             iret.decision == DECISION_COND_SUCC)) {
1060                         data->phase2_success = 1;
1061                 }
1062                 if (*resp == NULL)
1063                         return -1;
1064                 break;
1065         }
1066         return 0;
1067 }
1068
1069
1070 static u8 * eap_fast_tlv_nak(int vendor_id, int tlv_type, size_t *len)
1071 {
1072         struct eap_tlv_nak_tlv *nak;
1073         *len = sizeof(*nak);
1074         nak = malloc(*len);
1075         if (nak == NULL)
1076                 return NULL;
1077         nak->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY | EAP_TLV_NAK_TLV);
1078         nak->length = host_to_be16(6);
1079         nak->vendor_id = host_to_be32(vendor_id);
1080         nak->nak_type = host_to_be16(tlv_type);
1081         return (u8 *) nak;
1082 }
1083
1084
1085 static u8 * eap_fast_tlv_result(int status, int intermediate, size_t *len)
1086 {
1087         struct eap_tlv_intermediate_result_tlv *result;
1088         *len = sizeof(*result);
1089         result = malloc(*len);
1090         if (result == NULL)
1091                 return NULL;
1092         result->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
1093                                         (intermediate ?
1094                                          EAP_TLV_INTERMEDIATE_RESULT_TLV :
1095                                          EAP_TLV_RESULT_TLV));
1096         result->length = host_to_be16(2);
1097         result->status = host_to_be16(status);
1098         return (u8 *) result;
1099 }
1100
1101
1102 static u8 * eap_fast_tlv_pac_ack(size_t *len)
1103 {
1104         struct eap_tlv_result_tlv *res;
1105         struct eap_tlv_pac_ack_tlv *ack;
1106
1107         *len = sizeof(*res) + sizeof(*ack);
1108         res = malloc(*len);
1109         if (res == NULL)
1110                 return NULL;
1111
1112         memset(res, 0, *len);
1113         res->tlv_type = host_to_be16(EAP_TLV_RESULT_TLV |
1114                                      EAP_TLV_TYPE_MANDATORY);
1115         res->length = host_to_be16(sizeof(*res) - sizeof(struct eap_tlv_hdr));
1116         res->status = host_to_be16(EAP_TLV_RESULT_SUCCESS);
1117
1118         ack = (struct eap_tlv_pac_ack_tlv *) (res + 1);
1119         ack->tlv_type = host_to_be16(EAP_TLV_PAC_TLV |
1120                                      EAP_TLV_TYPE_MANDATORY);
1121         ack->length = host_to_be16(sizeof(*ack) - sizeof(struct eap_tlv_hdr));
1122         ack->pac_type = host_to_be16(PAC_TYPE_PAC_ACKNOWLEDGEMENT);
1123         ack->pac_len = host_to_be16(2);
1124         ack->result = host_to_be16(EAP_TLV_RESULT_SUCCESS);
1125
1126         return (u8 *) res;
1127 }
1128
1129
1130 static u8 * eap_fast_tlv_eap_payload(u8 *buf, size_t *len)
1131 {
1132         struct eap_tlv_hdr *tlv;
1133
1134         /* Encapsulate EAP packet in EAP Payload TLV */
1135         tlv = malloc(sizeof(*tlv) + *len);
1136         if (tlv == NULL) {
1137                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to "
1138                            "allocate memory for TLV "
1139                            "encapsulation");
1140                 free(buf);
1141                 return NULL;
1142         }
1143         tlv->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
1144                                      EAP_TLV_EAP_PAYLOAD_TLV);
1145         tlv->length = host_to_be16(*len);
1146         memcpy(tlv + 1, buf, *len);
1147         free(buf);
1148         *len += sizeof(*tlv);
1149         return (u8 *) tlv;
1150 }
1151
1152
1153 static u8 * eap_fast_process_crypto_binding(
1154         struct eap_sm *sm, struct eap_fast_data *data,
1155         struct eap_method_ret *ret,
1156         struct eap_tlv_crypto_binding__tlv *bind, size_t bind_len,
1157         size_t *resp_len, int final)
1158 {
1159         u8 *resp, *sks = NULL;
1160         struct eap_tlv_intermediate_result_tlv *rresult;
1161         struct eap_tlv_crypto_binding__tlv *rbind;
1162         u8 isk[32], imck[60], *cmk, cmac[20], *key;
1163         size_t key_len;
1164         int res;
1165
1166         wpa_printf(MSG_DEBUG, "EAP-FAST: Crypto-Binding TLV: Version %d "
1167                    "Received Version %d SubType %d",
1168                    bind->version, bind->received_version, bind->subtype);
1169         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: NONCE",
1170                     bind->nonce, sizeof(bind->nonce));
1171         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Compound MAC",
1172                     bind->compound_mac, sizeof(bind->compound_mac));
1173
1174         if (bind->version != EAP_FAST_VERSION ||
1175             bind->received_version != EAP_FAST_VERSION ||
1176             bind->subtype != EAP_TLV_CRYPTO_BINDING_SUBTYPE_REQUEST) {
1177                 wpa_printf(MSG_INFO, "EAP-FAST: Invalid version/subtype in "
1178                            "Crypto-Binding TLV: Version %d "
1179                            "Received Version %d SubType %d",
1180                            bind->version, bind->received_version,
1181                            bind->subtype);
1182                 resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 1,
1183                                            resp_len);
1184                 return resp;
1185         }
1186
1187
1188         if (data->provisioning) {
1189                 if (data->key_block_p) {
1190                         sks = data->key_block_p->session_key_seed;
1191                 }
1192         } else {
1193                 if (data->key_block_a) {
1194                         sks = data->key_block_a->session_key_seed;
1195                 }
1196         }
1197         if (sks == NULL) {
1198                 wpa_printf(MSG_INFO, "EAP-FAST: No Session Key Seed available "
1199                            "for processing Crypto-Binding TLV");
1200                 return NULL;
1201         }
1202
1203         wpa_printf(MSG_DEBUG, "EAP-FAST: Determining CMK for Compound MIC "
1204                    "calculation");
1205         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: S-IMCK[0] = SKS", sks, 40);
1206
1207         memset(isk, 0, sizeof(isk));
1208         if (data->phase2_method == NULL || data->phase2_priv == NULL) {
1209                 wpa_printf(MSG_DEBUG, "EAP-FAST: Phase 2 method not "
1210                            "available");
1211                 return NULL;
1212         }
1213         if (data->phase2_method->isKeyAvailable && data->phase2_method->getKey)
1214         {
1215                 if (!data->phase2_method->isKeyAvailable(sm, data->phase2_priv)
1216                     ||
1217                     (key = data->phase2_method->getKey(sm, data->phase2_priv,
1218                                                        &key_len)) == NULL) {
1219                         wpa_printf(MSG_DEBUG, "EAP-FAST: Could not get key "
1220                                    "material from Phase 2");
1221                         return NULL;
1222                 }
1223                 if (key_len > sizeof(isk))
1224                         key_len = sizeof(isk);
1225                 /* FIX: which end is being padded? */
1226 #if 0
1227                 memcpy(isk + (sizeof(isk) - key_len), key, key_len);
1228 #else
1229                 memcpy(isk, key, key_len);
1230 #endif
1231                 free(key);
1232         }
1233         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: ISK[0]", isk, sizeof(isk));
1234         sha1_t_prf(sks, 40, "Inner Methods Compound Keys",
1235                    isk, sizeof(isk), imck, sizeof(imck));
1236         /* S-IMCK[1] = imkc[0..39] */
1237         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: S-IMCK[1]", imck, 40);
1238         cmk = imck + 40;
1239         wpa_hexdump_key(MSG_MSGDUMP, "EAP-FAST: CMK", cmk, 20);
1240
1241         memcpy(cmac, bind->compound_mac, sizeof(cmac));
1242         memset(bind->compound_mac, 0, sizeof(cmac));
1243         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Crypto-Binding TLV for Compound "
1244                     "MAC calculation", (u8 *) bind, bind_len);
1245         hmac_sha1(cmk, 20, (u8 *) bind, bind_len, bind->compound_mac);
1246         res = memcmp(cmac, bind->compound_mac, sizeof(cmac));
1247         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Received Compound MAC",
1248                     cmac, sizeof(cmac));
1249         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Calculated Compound MAC",
1250                     bind->compound_mac, sizeof(cmac));
1251         if (res != 0) {
1252                 wpa_printf(MSG_INFO, "EAP-FAST: Compound MAC did not match");
1253                 resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 1,
1254                                            resp_len);
1255                 memcpy(bind->compound_mac, cmac, sizeof(cmac));
1256                 return resp;
1257         }
1258
1259         *resp_len = sizeof(*rresult) + sizeof(*rbind);
1260         resp = malloc(*resp_len);
1261         if (resp == NULL)
1262                 return NULL;
1263         memset(resp, 0, *resp_len);
1264
1265         /* Both intermediate and final Result TLVs are identical, so ok to use
1266          * the same structure definition for them. */
1267         rresult = (struct eap_tlv_intermediate_result_tlv *) resp;
1268         rresult->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
1269                                          (final ? EAP_TLV_RESULT_TLV :
1270                                           EAP_TLV_INTERMEDIATE_RESULT_TLV));
1271         rresult->length = host_to_be16(2);
1272         rresult->status = host_to_be16(EAP_TLV_RESULT_SUCCESS);
1273
1274         if (!data->provisioning && data->phase2_success &&
1275             eap_fast_derive_msk(sm, data) < 0) {
1276                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to generate MSK");
1277                 ret->methodState = METHOD_DONE;
1278                 ret->decision = DECISION_FAIL;
1279                 rresult->status = host_to_be16(EAP_TLV_RESULT_FAILURE);
1280                 data->phase2_success = 0;
1281         }
1282
1283         rbind = (struct eap_tlv_crypto_binding__tlv *) (rresult + 1);
1284         rbind->tlv_type = host_to_be16(EAP_TLV_TYPE_MANDATORY |
1285                                        EAP_TLV_CRYPTO_BINDING_TLV_);
1286         rbind->length = host_to_be16(sizeof(*rbind) -
1287                                      sizeof(struct eap_tlv_hdr));
1288         rbind->version = EAP_FAST_VERSION;
1289         rbind->received_version = bind->version;
1290         rbind->subtype = EAP_TLV_CRYPTO_BINDING_SUBTYPE_RESPONSE;
1291         memcpy(rbind->nonce, bind->nonce, sizeof(bind->nonce));
1292         inc_byte_array(rbind->nonce, sizeof(bind->nonce));
1293         hmac_sha1(cmk, 20, (u8 *) rbind, sizeof(*rbind), rbind->compound_mac);
1294
1295         wpa_printf(MSG_DEBUG, "EAP-FAST: Reply Crypto-Binding TLV: Version %d "
1296                    "Received Version %d SubType %d",
1297                    rbind->version, rbind->received_version, rbind->subtype);
1298         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: NONCE",
1299                     rbind->nonce, sizeof(rbind->nonce));
1300         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Compound MAC",
1301                     rbind->compound_mac, sizeof(rbind->compound_mac));
1302
1303         if (final && data->phase2_success) {
1304                 wpa_printf(MSG_DEBUG, "EAP-FAST: Authentication completed "
1305                            "successfully.");
1306                 ret->methodState = METHOD_DONE;
1307                 ret->decision = DECISION_UNCOND_SUCC;
1308         }
1309
1310         return resp;
1311 }
1312
1313
1314 static u8 * eap_fast_process_pac(struct eap_sm *sm, struct eap_fast_data *data,
1315                                  struct eap_method_ret *ret,
1316                                  u8 *pac, size_t pac_len, size_t *resp_len)
1317 {
1318         struct wpa_ssid *config = eap_get_config(sm);
1319         struct pac_tlv_hdr *hdr;
1320         u8 *pos;
1321         size_t left, len;
1322         int type, pac_key_found = 0;
1323         struct eap_fast_pac entry;
1324
1325         memset(&entry, 0, sizeof(entry));
1326         pos = pac;
1327         left = pac_len;
1328         while (left > sizeof(*hdr)) {
1329                 hdr = (struct pac_tlv_hdr *) pos;
1330                 type = be_to_host16(hdr->type);
1331                 len = be_to_host16(hdr->len);
1332                 pos += sizeof(*hdr);
1333                 left -= sizeof(*hdr);
1334                 if (len > left) {
1335                         wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV overrun "
1336                                    "(type=%d len=%lu left=%lu)",
1337                                    type, (unsigned long) len,
1338                                    (unsigned long) left);
1339                         return eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0,
1340                                                    resp_len);
1341                 }
1342                 switch (type) {
1343                 case PAC_TYPE_PAC_KEY:
1344                         wpa_hexdump_key(MSG_DEBUG, "EAP-FAST: PAC-Key",
1345                                         pos, len);
1346                         if (len != EAP_FAST_PAC_KEY_LEN) {
1347                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Invalid "
1348                                            "PAC-Key length %lu",
1349                                            (unsigned long) len);
1350                                 break;
1351                         }
1352                         pac_key_found = 1;
1353                         memcpy(entry.pac_key, pos, len);
1354                         break;
1355                 case PAC_TYPE_PAC_OPAQUE:
1356                         wpa_hexdump(MSG_DEBUG, "EAP-FAST: PAC-Opaque",
1357                                         pos, len);
1358                         entry.pac_opaque = pos;
1359                         entry.pac_opaque_len = len;
1360                         break;
1361                 case PAC_TYPE_PAC_INFO:
1362                         wpa_hexdump(MSG_DEBUG, "EAP-FAST: PAC-Info",
1363                                     pos, len);
1364                         entry.pac_info = pos;
1365                         entry.pac_info_len = len;
1366                         break;
1367                 default:
1368                         wpa_printf(MSG_DEBUG, "EAP-FAST: Ignored unknown PAC "
1369                                    "type %d", type);
1370                         break;
1371                 }
1372
1373                 pos += len;
1374                 left -= len;
1375         }
1376
1377         if (!pac_key_found || !entry.pac_opaque || !entry.pac_info) {
1378                 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV does not include "
1379                            "all the required fields");
1380                 return eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0,
1381                                            resp_len);
1382         }
1383
1384         pos = entry.pac_info;
1385         left = entry.pac_info_len;
1386         while (left > sizeof(*hdr)) {
1387                 hdr = (struct pac_tlv_hdr *) pos;
1388                 type = be_to_host16(hdr->type);
1389                 len = be_to_host16(hdr->len);
1390                 pos += sizeof(*hdr);
1391                 left -= sizeof(*hdr);
1392                 if (len > left) {
1393                         wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info overrun "
1394                                    "(type=%d len=%lu left=%lu)",
1395                                    type, (unsigned long) len,
1396                                    (unsigned long) left);
1397                         return eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0,
1398                                                    resp_len);
1399                 }
1400                 switch (type) {
1401                 case PAC_TYPE_A_ID:
1402                         wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: PAC-Info - "
1403                                           "A-ID", pos, len);
1404                         entry.a_id = pos;
1405                         entry.a_id_len = len;
1406                         break;
1407                 case PAC_TYPE_I_ID:
1408                         wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: PAC-Info - "
1409                                           "I-ID", pos, len);
1410                         entry.i_id = pos;
1411                         entry.i_id_len = len;
1412                         break;
1413                 case PAC_TYPE_A_ID_INFO:
1414                         wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: PAC-Info - "
1415                                           "A-ID-Info", pos, len);
1416                         entry.a_id_info = pos;
1417                         entry.a_id_info_len = len;
1418                         break;
1419                 default:
1420                         wpa_printf(MSG_DEBUG, "EAP-FAST: Ignored unknown "
1421                                    "PAC-Info type %d", type);
1422                         break;
1423                 }
1424
1425                 pos += len;
1426                 left -= len;
1427         }
1428
1429         if (entry.a_id == NULL || entry.a_id_info == NULL) {
1430                 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC-Info does not include "
1431                            "all the required fields");
1432                 return eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0,
1433                                            resp_len);
1434         }
1435
1436         eap_fast_add_pac(data, &entry);
1437         eap_fast_save_pac(sm, data, config->pac_file);
1438
1439         if (data->provisioning) {
1440                 /* EAP-FAST provisioning does not provide keying material and
1441                  * must end with an EAP-Failure. Authentication will be done
1442                  * separately after this. */
1443                 data->success = 0;
1444                 ret->decision = DECISION_FAIL;
1445                 wpa_printf(MSG_DEBUG, "EAP-FAST: Send PAC-Acknowledgement TLV "
1446                            "- Provisioning completed successfully");
1447         } else {
1448                 /* This is PAC refreshing, i.e., normal authentication that is
1449                  * expected to be completed with an EAP-Success. */
1450                 wpa_printf(MSG_DEBUG, "EAP-FAST: Send PAC-Acknowledgement TLV "
1451                            "- PAC refreshing completed successfully");
1452                 ret->decision = DECISION_UNCOND_SUCC;
1453         }
1454         ret->methodState = METHOD_DONE;
1455         return eap_fast_tlv_pac_ack(resp_len);
1456 }
1457
1458
1459 static int eap_fast_decrypt(struct eap_sm *sm, struct eap_fast_data *data,
1460                             struct eap_method_ret *ret,
1461                             const struct eap_hdr *req,
1462                             const u8 *in_data, size_t in_len,
1463                             u8 **out_data, size_t *out_len)
1464 {
1465         u8 *in_decrypted, *pos, *end;
1466         int buf_len, len_decrypted, len;
1467         struct eap_hdr *hdr;
1468         u8 *resp = NULL;
1469         size_t resp_len;
1470         int mandatory, tlv_type;
1471         u8 *eap_payload_tlv = NULL, *pac = NULL;
1472         size_t eap_payload_tlv_len = 0, pac_len = 0;
1473         int iresult = 0, result = 0;
1474         struct eap_tlv_crypto_binding__tlv *crypto_binding = NULL;
1475         size_t crypto_binding_len = 0;
1476         const u8 *msg;
1477         size_t msg_len;
1478         int need_more_input;
1479
1480         wpa_printf(MSG_DEBUG, "EAP-FAST: received %lu bytes encrypted data for"
1481                    " Phase 2", (unsigned long) in_len);
1482
1483         msg = eap_tls_data_reassemble(sm, &data->ssl, in_data, in_len,
1484                                       &msg_len, &need_more_input);
1485         if (msg == NULL)
1486                 return need_more_input ? 1 : -1;
1487
1488         buf_len = in_len;
1489         if (data->ssl.tls_in_total > buf_len)
1490                 buf_len = data->ssl.tls_in_total;
1491         in_decrypted = malloc(buf_len);
1492         if (in_decrypted == NULL) {
1493                 free(data->ssl.tls_in);
1494                 data->ssl.tls_in = NULL;
1495                 data->ssl.tls_in_len = 0;
1496                 wpa_printf(MSG_WARNING, "EAP-FAST: failed to allocate memory "
1497                            "for decryption");
1498                 return -1;
1499         }
1500
1501         len_decrypted = tls_connection_decrypt(sm->ssl_ctx, data->ssl.conn,
1502                                                msg, msg_len,
1503                                                in_decrypted, buf_len);
1504         free(data->ssl.tls_in);
1505         data->ssl.tls_in = NULL;
1506         data->ssl.tls_in_len = 0;
1507         if (len_decrypted < 0) {
1508                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to decrypt Phase 2 "
1509                            "data");
1510                 free(in_decrypted);
1511                 return -1;
1512         }
1513
1514         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Decrypted Phase 2 TLV(s)",
1515                     in_decrypted, len_decrypted);
1516
1517         if (len_decrypted < 4) {
1518                 free(in_decrypted);
1519                 wpa_printf(MSG_INFO, "EAP-FAST: Too short Phase 2 "
1520                            "TLV frame (len=%d)", len_decrypted);
1521                 return -1;
1522         }
1523
1524         pos = in_decrypted;
1525         end = in_decrypted + len_decrypted;
1526         while (pos + 4 < end) {
1527                 mandatory = pos[0] & 0x80;
1528                 tlv_type = WPA_GET_BE16(pos) & 0x3fff;
1529                 pos += 2;
1530                 len = WPA_GET_BE16(pos);
1531                 pos += 2;
1532                 if (pos + len > end) {
1533                         free(in_decrypted);
1534                         wpa_printf(MSG_INFO, "EAP-FAST: TLV overflow");
1535                         return 0;
1536                 }
1537                 wpa_printf(MSG_DEBUG, "EAP-FAST: received Phase 2: "
1538                            "TLV type %d length %d%s",
1539                            tlv_type, len, mandatory ? " (mandatory)" : "");
1540
1541                 switch (tlv_type) {
1542                 case EAP_TLV_EAP_PAYLOAD_TLV:
1543                         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: EAP Payload TLV",
1544                                     pos, len);
1545                         eap_payload_tlv = pos;
1546                         eap_payload_tlv_len = len;
1547                         break;
1548                 case EAP_TLV_RESULT_TLV:
1549                         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Result TLV",
1550                                     pos, len);
1551                         if (len < 2) {
1552                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
1553                                            "Result TLV");
1554                                 result = EAP_TLV_RESULT_FAILURE;
1555                                 break;
1556                         }
1557                         result = WPA_GET_BE16(pos);
1558                         if (result != EAP_TLV_RESULT_SUCCESS &&
1559                             result != EAP_TLV_RESULT_FAILURE) {
1560                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Unknown "
1561                                            "Result %d", result);
1562                                 result = EAP_TLV_RESULT_FAILURE;
1563                         }
1564                         wpa_printf(MSG_DEBUG, "EAP-FAST: Result: %s",
1565                                    result == EAP_TLV_RESULT_SUCCESS ?
1566                                    "Success" : "Failure");
1567                         break;
1568                 case EAP_TLV_INTERMEDIATE_RESULT_TLV:
1569                         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Intermediate "
1570                                     "Result TLV", pos, len);
1571                         if (len < 2) {
1572                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
1573                                            "Intermediate Result TLV");
1574                                 iresult = EAP_TLV_RESULT_FAILURE;
1575                                 break;
1576                         }
1577                         iresult = WPA_GET_BE16(pos);
1578                         if (iresult != EAP_TLV_RESULT_SUCCESS &&
1579                             iresult != EAP_TLV_RESULT_FAILURE) {
1580                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Unknown "
1581                                            "Intermediate Result %d", iresult);
1582                                 iresult = EAP_TLV_RESULT_FAILURE;
1583                         }
1584                         wpa_printf(MSG_DEBUG,
1585                                    "EAP-FAST: Intermediate Result: %s",
1586                                    iresult == EAP_TLV_RESULT_SUCCESS ?
1587                                    "Success" : "Failure");
1588                         break;
1589                 case EAP_TLV_CRYPTO_BINDING_TLV_:
1590                         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: Crypto-Binding "
1591                                     "TLV", pos, len);
1592                         crypto_binding_len = sizeof(struct eap_tlv_hdr) + len;
1593                         if (crypto_binding_len < sizeof(*crypto_binding)) {
1594                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Too short "
1595                                            "Crypto-Binding TLV");
1596                                 iresult = EAP_TLV_RESULT_FAILURE;
1597                                 pos = end;
1598                                 break;
1599                         }
1600                         crypto_binding =
1601                                 (struct eap_tlv_crypto_binding__tlv *)
1602                                 (pos - sizeof(struct eap_tlv_hdr));
1603                         break;
1604                 case EAP_TLV_PAC_TLV:
1605                         wpa_hexdump(MSG_MSGDUMP, "EAP-FAST: PAC TLV",
1606                                     pos, len);
1607                         pac = pos;
1608                         pac_len = len;
1609                         break;
1610                 default:
1611                         if (mandatory) {
1612                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Nak unknown "
1613                                            "mandatory TLV type %d", tlv_type);
1614                                 resp = eap_fast_tlv_nak(0, tlv_type,
1615                                                         &resp_len);
1616                                 pos = end;
1617                         } else {
1618                                 wpa_printf(MSG_DEBUG, "EAP-FAST: ignored "
1619                                            "unknown optional TLV type %d",
1620                                            tlv_type);
1621                         }
1622                         break;
1623                 }
1624
1625                 pos += len;
1626         }
1627
1628         if (!resp && result == EAP_TLV_RESULT_FAILURE) {
1629                 resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0,
1630                                            &resp_len);
1631                 if (!resp) {
1632                         free(in_decrypted);
1633                         return 0;
1634                 }
1635         }
1636
1637         if (!resp && iresult == EAP_TLV_RESULT_FAILURE) {
1638                 resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 1,
1639                                            &resp_len);
1640                 if (!resp) {
1641                         free(in_decrypted);
1642                         return 0;
1643                 }
1644         }
1645
1646         if (!resp && eap_payload_tlv) {
1647                 if (eap_payload_tlv_len < sizeof(*hdr)) {
1648                         wpa_printf(MSG_DEBUG, "EAP-FAST: too short EAP "
1649                                    "Payload TLV (len=%lu)",
1650                                    (unsigned long) eap_payload_tlv_len);
1651                         free(in_decrypted);
1652                         return 0;
1653                 }
1654                 hdr = (struct eap_hdr *) eap_payload_tlv;
1655                 if (be_to_host16(hdr->length) > eap_payload_tlv_len) {
1656                         wpa_printf(MSG_DEBUG, "EAP-FAST: EAP packet overflow "
1657                                    "in EAP Payload TLV");
1658                 }
1659                 if (hdr->code == EAP_CODE_REQUEST) {
1660                         if (eap_fast_phase2_request(sm, data, ret, req, hdr,
1661                                                     &resp, &resp_len)) {
1662                                 free(in_decrypted);
1663                                 wpa_printf(MSG_INFO, "EAP-FAST: Phase2 "
1664                                            "Request processing failed");
1665                                 return 0;
1666                         }
1667                         resp = eap_fast_tlv_eap_payload(resp, &resp_len);
1668                         if (resp == NULL) {
1669                                 free(in_decrypted);
1670                                 return 0;
1671                         }
1672                 } else {
1673                         wpa_printf(MSG_INFO, "EAP-FAST: Unexpected code=%d in "
1674                                    "Phase 2 EAP header", hdr->code);
1675                         free(in_decrypted);
1676                         return 0;
1677                 }
1678         }
1679
1680         if (!resp && crypto_binding) {
1681                 int final = result == EAP_TLV_RESULT_SUCCESS;
1682                 resp = eap_fast_process_crypto_binding(sm, data, ret,
1683                                                        crypto_binding,
1684                                                        crypto_binding_len,
1685                                                        &resp_len, final);
1686                 if (!resp) {
1687                         free(in_decrypted);
1688                         return 0;
1689                 }
1690         }
1691
1692         if (!resp && pac && result != EAP_TLV_RESULT_SUCCESS) {
1693                 wpa_printf(MSG_DEBUG, "EAP-FAST: PAC TLV without Result TLV "
1694                            "acknowledging success");
1695                 resp = eap_fast_tlv_result(EAP_TLV_RESULT_FAILURE, 0,
1696                                            &resp_len);
1697                 if (!resp) {
1698                         free(in_decrypted);
1699                         return 0;
1700                 }
1701         }
1702
1703         if (!resp && pac && result == EAP_TLV_RESULT_SUCCESS) {
1704                 resp = eap_fast_process_pac(sm, data, ret, pac, pac_len,
1705                                             &resp_len);
1706                 if (!resp) {
1707                         free(in_decrypted);
1708                         return 0;
1709                 }
1710         }
1711
1712         free(in_decrypted);
1713
1714         if (resp == NULL) {
1715                 wpa_printf(MSG_DEBUG, "EAP-FAST: No recognized TLVs - send "
1716                            "empty response packet");
1717                 resp = malloc(1);
1718                 if (resp == NULL)
1719                         return 0;
1720                 resp_len = 0;
1721         }
1722
1723         wpa_hexdump(MSG_DEBUG, "EAP-FAST: Encrypting Phase 2 data",
1724                     resp, resp_len);
1725         if (eap_fast_encrypt(sm, data, req->identifier, resp, resp_len,
1726                              out_data, out_len)) {
1727                 wpa_printf(MSG_INFO, "EAP-FAST: Failed to encrypt a Phase 2 "
1728                            "frame");
1729         }
1730         free(resp);
1731
1732         return 0;
1733 }
1734
1735
1736 static u8 * eap_fast_process(struct eap_sm *sm, void *priv,
1737                              struct eap_method_ret *ret,
1738                              const u8 *reqData, size_t reqDataLen,
1739                              size_t *respDataLen)
1740 {
1741         const struct eap_hdr *req;
1742         size_t left;
1743         int res;
1744         u8 flags, *resp, id;
1745         const u8 *pos;
1746         struct eap_fast_data *data = priv;
1747
1748         pos = eap_tls_process_init(sm, &data->ssl, EAP_TYPE_FAST, ret,
1749                                    reqData, reqDataLen, &left, &flags);
1750         if (pos == NULL)
1751                 return NULL;
1752         req = (const struct eap_hdr *) reqData;
1753         id = req->identifier;
1754
1755         if (flags & EAP_TLS_FLAGS_START) {
1756                 const u8 *a_id;
1757                 size_t a_id_len;
1758                 struct pac_tlv_hdr *hdr;
1759
1760                 wpa_printf(MSG_DEBUG, "EAP-FAST: Start (server ver=%d, own "
1761                            "ver=%d)", flags & EAP_PEAP_VERSION_MASK,
1762                         data->fast_version);
1763                 if ((flags & EAP_PEAP_VERSION_MASK) < data->fast_version)
1764                         data->fast_version = flags & EAP_PEAP_VERSION_MASK;
1765                 wpa_printf(MSG_DEBUG, "EAP-FAST: Using FAST version %d",
1766                            data->fast_version);
1767
1768                 a_id = pos;
1769                 a_id_len = left;
1770                 if (left > sizeof(*hdr)) {
1771                         int tlen;
1772                         hdr = (struct pac_tlv_hdr *) pos;
1773                         tlen = be_to_host16(hdr->len);
1774                         if (be_to_host16(hdr->type) == PAC_TYPE_A_ID &&
1775                             sizeof(*hdr) + tlen <= left) {
1776                                 a_id = (u8 *) (hdr + 1);
1777                                 a_id_len = tlen;
1778                         }
1779                 }
1780                 wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: A-ID", a_id, a_id_len);
1781
1782                 data->current_pac = eap_fast_get_pac(data, a_id, a_id_len);
1783                 if (data->current_pac) {
1784                         wpa_printf(MSG_DEBUG, "EAP-FAST: PAC found for this "
1785                                    "A-ID");
1786                         wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-FAST: A-ID-Info",
1787                                           data->current_pac->a_id_info,
1788                                           data->current_pac->a_id_info_len);
1789                 }
1790
1791                 if (data->resuming && data->current_pac) {
1792                         wpa_printf(MSG_DEBUG, "EAP-FAST: Trying to resume "
1793                                    "session - do not add PAC-Opaque to TLS "
1794                                    "ClientHello");
1795                         if (tls_connection_client_hello_ext(
1796                                     sm->ssl_ctx, data->ssl.conn,
1797                                     TLS_EXT_PAC_OPAQUE, NULL, 0) < 0) {
1798                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to "
1799                                            "remove PAC-Opaque TLS extension");
1800                                 return NULL;
1801                         }
1802
1803                 } else if (data->current_pac) {
1804                         u8 *tlv;
1805                         size_t tlv_len, olen;
1806                         struct eap_tlv_hdr *hdr;
1807                         olen = data->current_pac->pac_opaque_len;
1808                         tlv_len = sizeof(*hdr) + olen;
1809                         tlv = malloc(tlv_len);
1810                         if (tlv) {
1811                                 hdr = (struct eap_tlv_hdr *) tlv;
1812                                 hdr->tlv_type =
1813                                         host_to_be16(PAC_TYPE_PAC_OPAQUE);
1814                                 hdr->length = host_to_be16(olen);
1815                                 memcpy(hdr + 1, data->current_pac->pac_opaque,
1816                                        olen);
1817                         }
1818                         if (tlv == NULL ||
1819                             tls_connection_client_hello_ext(
1820                                     sm->ssl_ctx, data->ssl.conn,
1821                                     TLS_EXT_PAC_OPAQUE, tlv, tlv_len) < 0) {
1822                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to "
1823                                            "add PAC-Opaque TLS extension");
1824                                 free(tlv);
1825                                 return NULL;
1826                         }
1827                         free(tlv);
1828                 } else {
1829                         if (!data->provisioning_allowed) {
1830                                 wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC found "
1831                                            "and provisioning disabled");
1832                                 return NULL;
1833                         }
1834                         wpa_printf(MSG_DEBUG, "EAP-FAST: No PAC found - "
1835                                    "starting provisioning");
1836                         if (tls_connection_set_anon_dh(sm->ssl_ctx,
1837                                                        data->ssl.conn)) {
1838                                 wpa_printf(MSG_INFO, "EAP-FAST: Could not "
1839                                            "configure anonymous DH for TLS "
1840                                            "connection");
1841                                 return NULL;
1842                         }
1843                         if (tls_connection_client_hello_ext(
1844                                     sm->ssl_ctx, data->ssl.conn,
1845                                     TLS_EXT_PAC_OPAQUE, NULL, 0) < 0) {
1846                                 wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to "
1847                                            "remove PAC-Opaque TLS extension");
1848                                 return NULL;
1849                         }
1850                         data->provisioning = 1;
1851                 }
1852
1853                 left = 0; /* A-ID is not used in further packet processing */
1854         }
1855
1856         resp = NULL;
1857         if (tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&
1858             !data->resuming) {
1859                 res = eap_fast_decrypt(sm, data, ret, req, pos, left,
1860                                        &resp, respDataLen);
1861                 if (res < 0) {
1862                         ret->methodState = METHOD_DONE;
1863                         ret->decision = DECISION_FAIL;
1864                         /* Ack possible Alert that may have caused failure in
1865                          * decryption */
1866                         res = 1;
1867                 }
1868         } else {
1869                 if (eap_fast_set_tls_master_secret(sm, data, pos, left) < 0) {
1870                         wpa_printf(MSG_DEBUG, "EAP-FAST: Failed to configure "
1871                                    "TLS master secret");
1872                         ret->methodState = METHOD_DONE;
1873                         ret->decision = DECISION_FAIL;
1874                         return NULL;
1875                 }
1876
1877                 res = eap_tls_process_helper(sm, &data->ssl, EAP_TYPE_FAST,
1878                                              data->fast_version, id, pos, left,
1879                                              &resp, respDataLen);
1880
1881                 if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) {
1882                         wpa_printf(MSG_DEBUG,
1883                                    "EAP-FAST: TLS done, proceed to Phase 2");
1884                         data->resuming = 0;
1885                         eap_fast_derive_keys(sm, data);
1886                 }
1887         }
1888
1889         if (res == 1)
1890                 return eap_tls_build_ack(&data->ssl, respDataLen, id,
1891                                          EAP_TYPE_FAST, data->fast_version);
1892         return resp;
1893 }
1894
1895
1896 #if 0 /* FIX */
1897 static Boolean eap_fast_has_reauth_data(struct eap_sm *sm, void *priv)
1898 {
1899         struct eap_fast_data *data = priv;
1900         return tls_connection_established(sm->ssl_ctx, data->ssl.conn);
1901 }
1902
1903
1904 static void eap_fast_deinit_for_reauth(struct eap_sm *sm, void *priv)
1905 {
1906 }
1907
1908
1909 static void * eap_fast_init_for_reauth(struct eap_sm *sm, void *priv)
1910 {
1911         struct eap_fast_data *data = priv;
1912         if (eap_tls_reauth_init(sm, &data->ssl)) {
1913                 free(data);
1914                 return NULL;
1915         }
1916         data->phase2_success = 0;
1917         data->resuming = 1;
1918         data->provisioning = 0;
1919         return priv;
1920 }
1921 #endif
1922
1923
1924 static int eap_fast_get_status(struct eap_sm *sm, void *priv, char *buf,
1925                                size_t buflen, int verbose)
1926 {
1927         struct eap_fast_data *data = priv;
1928         return eap_tls_status(sm, &data->ssl, buf, buflen, verbose);
1929 }
1930
1931
1932 static Boolean eap_fast_isKeyAvailable(struct eap_sm *sm, void *priv)
1933 {
1934         struct eap_fast_data *data = priv;
1935         return data->success;
1936 }
1937
1938
1939 static u8 * eap_fast_getKey(struct eap_sm *sm, void *priv, size_t *len)
1940 {
1941         struct eap_fast_data *data = priv;
1942         u8 *key;
1943
1944         if (!data->success)
1945                 return NULL;
1946
1947         key = malloc(EAP_FAST_KEY_LEN);
1948         if (key == NULL)
1949                 return NULL;
1950
1951         *len = EAP_FAST_KEY_LEN;
1952         memcpy(key, data->key_data, EAP_FAST_KEY_LEN);
1953
1954         return key;
1955 }
1956
1957
1958 const struct eap_method eap_method_fast =
1959 {
1960         .method = EAP_TYPE_FAST,
1961         .name = "FAST",
1962         .init = eap_fast_init,
1963         .deinit = eap_fast_deinit,
1964         .process = eap_fast_process,
1965         .isKeyAvailable = eap_fast_isKeyAvailable,
1966         .getKey = eap_fast_getKey,
1967         .get_status = eap_fast_get_status,
1968 #if 0
1969         .has_reauth_data = eap_fast_has_reauth_data,
1970         .deinit_for_reauth = eap_fast_deinit_for_reauth,
1971         .init_for_reauth = eap_fast_init_for_reauth,
1972 #endif
1973 };