wpa_supplicant AP: Add management frame RX for nl80211

[wpasupplicant] / src / eap_server / eap_fast.c

diff --git a/src/eap_server/eap_fast.c b/src/eap_server/eap_fast.c
index da011d9..3563908 100644 (file)
--- a/src/eap_server/eap_fast.c
+++ b/src/eap_server/eap_fast.c
@@ -354,7 +354,18 @@ static int eap_fast_get_phase2_key(struct eap_sm *sm,
 
        if (key_len > isk_len)
                key_len = isk_len;
-       os_memcpy(isk, key, key_len);
+       if (key_len == 32 &&
+           data->phase2_method->vendor == EAP_VENDOR_IETF &&
+           data->phase2_method->method == EAP_TYPE_MSCHAPV2) {
+               /*
+                * EAP-FAST uses reverse order for MS-MPPE keys when deriving
+                * MSK from EAP-MSCHAPv2. Swap the keys here to get the correct
+                * ISK for EAP-FAST cryptobinding.
+                */
+               os_memcpy(isk, key + 16, 16);
+               os_memcpy(isk + 16, key, 16);
+       } else
+               os_memcpy(isk, key, key_len);
        os_free(key);
 
        return 0;
@@ -931,7 +942,7 @@ static void eap_fast_process_phase2_response(struct eap_sm *sm,
                left = in_len - sizeof(*hdr);
                wpa_hexdump(MSG_DEBUG, "EAP-FAST: Phase2 type Nak'ed; "
                            "allowed types", pos + 1, left - 1);
-#ifdef EAP_TNC
+#ifdef EAP_SERVER_TNC
                if (m && m->vendor == EAP_VENDOR_IETF &&
                    m->method == EAP_TYPE_TNC) {
                        wpa_printf(MSG_DEBUG, "EAP-FAST: Peer Nak'ed required "
@@ -940,7 +951,7 @@ static void eap_fast_process_phase2_response(struct eap_sm *sm,
                        eap_fast_phase2_init(sm, data, next_type);
                        return;
                }
-#endif /* EAP_TNC */
+#endif /* EAP_SERVER_TNC */
                eap_sm_process_nak(sm, pos + 1, left - 1);
                if (sm->user && sm->user_eap_method_index < EAP_MAX_METHODS &&
                    sm->user->methods[sm->user_eap_method_index].method !=
@@ -1008,13 +1019,13 @@ static void eap_fast_process_phase2_response(struct eap_sm *sm,
                eap_fast_state(data, CRYPTO_BINDING);
                data->eap_seq++;
                next_type = EAP_TYPE_NONE;
-#ifdef EAP_TNC
+#ifdef EAP_SERVER_TNC
                if (sm->tnc && !data->tnc_started) {
                        wpa_printf(MSG_DEBUG, "EAP-FAST: Initialize TNC");
                        next_type = EAP_TYPE_TNC;
                        data->tnc_started = 1;
                }
-#endif /* EAP_TNC */
+#endif /* EAP_SERVER_TNC */
                break;
        case FAILURE:
                break;