1 /* 2 * EAP peer method: EAP-TTLS (RFC 5281) 3 * Copyright (c) 2004-2011, Jouni Malinen <j (at) w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 11 #include "common.h" 12 #include "crypto/ms_funcs.h" 13 #include "crypto/sha1.h" 14 #include "crypto/tls.h" 15 #include "eap_common/chap.h" 16 #include "eap_common/eap_ttls.h" 17 #include "mschapv2.h" 18 #include "eap_i.h" 19 #include "eap_tls_common.h" 20 #include "eap_config.h" 21 22 23 #define EAP_TTLS_VERSION 0 24 25 26 static void eap_ttls_deinit(struct eap_sm *sm, void *priv); 27 28 29 struct eap_ttls_data { 30 struct eap_ssl_data ssl; 31 32 int ttls_version; 33 34 const struct eap_method *phase2_method; 35 void *phase2_priv; 36 int phase2_success; 37 int phase2_start; 38 39 enum phase2_types { 40 EAP_TTLS_PHASE2_EAP, 41 EAP_TTLS_PHASE2_MSCHAPV2, 42 EAP_TTLS_PHASE2_MSCHAP, 43 EAP_TTLS_PHASE2_PAP, 44 EAP_TTLS_PHASE2_CHAP 45 } phase2_type; 46 struct eap_method_type phase2_eap_type; 47 struct eap_method_type *phase2_eap_types; 48 size_t num_phase2_eap_types; 49 50 u8 auth_response[MSCHAPV2_AUTH_RESPONSE_LEN]; 51 int auth_response_valid; 52 u8 master_key[MSCHAPV2_MASTER_KEY_LEN]; /* MSCHAPv2 master key */ 53 u8 ident; 54 int resuming; /* starting a resumed session */ 55 int reauth; /* reauthentication */ 56 u8 *key_data; 57 58 struct wpabuf *pending_phase2_req; 59 60 #ifdef EAP_TNC 61 int ready_for_tnc; 62 int tnc_started; 63 #endif /* EAP_TNC */ 64 }; 65 66 67 static void * eap_ttls_init(struct eap_sm *sm) 68 { 69 struct eap_ttls_data *data; 70 struct eap_peer_config *config = eap_get_config(sm); 71 char *selected; 72 73 data = os_zalloc(sizeof(*data)); 74 if (data == NULL) 75 return NULL; 76 data->ttls_version = EAP_TTLS_VERSION; 77 selected = "EAP"; 78 data->phase2_type = EAP_TTLS_PHASE2_EAP; 79 80 if (config && config->phase2) { 81 if (os_strstr(config->phase2, "autheap=")) { 82 selected = "EAP"; 83 data->phase2_type = EAP_TTLS_PHASE2_EAP; 84 } else if (os_strstr(config->phase2, "auth=MSCHAPV2")) { 85 selected = "MSCHAPV2"; 86 data->phase2_type = EAP_TTLS_PHASE2_MSCHAPV2; 87 } else if (os_strstr(config->phase2, "auth=MSCHAP")) { 88 selected = "MSCHAP"; 89 data->phase2_type = EAP_TTLS_PHASE2_MSCHAP; 90 } else if (os_strstr(config->phase2, "auth=PAP")) { 91 selected = "PAP"; 92 data->phase2_type = EAP_TTLS_PHASE2_PAP; 93 } else if (os_strstr(config->phase2, "auth=CHAP")) { 94 selected = "CHAP"; 95 data->phase2_type = EAP_TTLS_PHASE2_CHAP; 96 } 97 } 98 wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase2 type: %s", selected); 99 100 if (data->phase2_type == EAP_TTLS_PHASE2_EAP) { 101 if (eap_peer_select_phase2_methods(config, "autheap=", 102 &data->phase2_eap_types, 103 &data->num_phase2_eap_types) 104 < 0) { 105 eap_ttls_deinit(sm, data); 106 return NULL; 107 } 108 109 data->phase2_eap_type.vendor = EAP_VENDOR_IETF; 110 data->phase2_eap_type.method = EAP_TYPE_NONE; 111 } 112 113 if (eap_peer_tls_ssl_init(sm, &data->ssl, config, EAP_TYPE_TTLS)) { 114 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to initialize SSL."); 115 eap_ttls_deinit(sm, data); 116 return NULL; 117 } 118 119 return data; 120 } 121 122 123 static void eap_ttls_phase2_eap_deinit(struct eap_sm *sm, 124 struct eap_ttls_data *data) 125 { 126 if (data->phase2_priv && data->phase2_method) { 127 data->phase2_method->deinit(sm, data->phase2_priv); 128 data->phase2_method = NULL; 129 data->phase2_priv = NULL; 130 } 131 } 132 133 134 static void eap_ttls_deinit(struct eap_sm *sm, void *priv) 135 { 136 struct eap_ttls_data *data = priv; 137 if (data == NULL) 138 return; 139 eap_ttls_phase2_eap_deinit(sm, data); 140 os_free(data->phase2_eap_types); 141 eap_peer_tls_ssl_deinit(sm, &data->ssl); 142 os_free(data->key_data); 143 wpabuf_free(data->pending_phase2_req); 144 os_free(data); 145 } 146 147 148 static u8 * eap_ttls_avp_hdr(u8 *avphdr, u32 avp_code, u32 vendor_id, 149 int mandatory, size_t len) 150 { 151 struct ttls_avp_vendor *avp; 152 u8 flags; 153 size_t hdrlen; 154 155 avp = (struct ttls_avp_vendor *) avphdr; 156 flags = mandatory ? AVP_FLAGS_MANDATORY : 0; 157 if (vendor_id) { 158 flags |= AVP_FLAGS_VENDOR; 159 hdrlen = sizeof(*avp); 160 avp->vendor_id = host_to_be32(vendor_id); 161 } else { 162 hdrlen = sizeof(struct ttls_avp); 163 } 164 165 avp->avp_code = host_to_be32(avp_code); 166 avp->avp_length = host_to_be32((flags << 24) | (u32) (hdrlen + len)); 167 168 return avphdr + hdrlen; 169 } 170 171 172 static u8 * eap_ttls_avp_add(u8 *start, u8 *avphdr, u32 avp_code, 173 u32 vendor_id, int mandatory, 174 const u8 *data, size_t len) 175 { 176 u8 *pos; 177 pos = eap_ttls_avp_hdr(avphdr, avp_code, vendor_id, mandatory, len); 178 os_memcpy(pos, data, len); 179 pos += len; 180 AVP_PAD(start, pos); 181 return pos; 182 } 183 184 185 static int eap_ttls_avp_encapsulate(struct wpabuf **resp, u32 avp_code, 186 int mandatory) 187 { 188 struct wpabuf *msg; 189 u8 *avp, *pos; 190 191 msg = wpabuf_alloc(sizeof(struct ttls_avp) + wpabuf_len(*resp) + 4); 192 if (msg == NULL) { 193 wpabuf_free(*resp); 194 *resp = NULL; 195 return -1; 196 } 197 198 avp = wpabuf_mhead(msg); 199 pos = eap_ttls_avp_hdr(avp, avp_code, 0, mandatory, wpabuf_len(*resp)); 200 os_memcpy(pos, wpabuf_head(*resp), wpabuf_len(*resp)); 201 pos += wpabuf_len(*resp); 202 AVP_PAD(avp, pos); 203 wpabuf_free(*resp); 204 wpabuf_put(msg, pos - avp); 205 *resp = msg; 206 return 0; 207 } 208 209 210 static int eap_ttls_v0_derive_key(struct eap_sm *sm, 211 struct eap_ttls_data *data) 212 { 213 os_free(data->key_data); 214 data->key_data = eap_peer_tls_derive_key(sm, &data->ssl, 215 "ttls keying material", 216 EAP_TLS_KEY_LEN); 217 if (!data->key_data) { 218 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to derive key"); 219 return -1; 220 } 221 222 wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived key", 223 data->key_data, EAP_TLS_KEY_LEN); 224 225 return 0; 226 } 227 228 229 static u8 * eap_ttls_implicit_challenge(struct eap_sm *sm, 230 struct eap_ttls_data *data, size_t len) 231 { 232 return eap_peer_tls_derive_key(sm, &data->ssl, "ttls challenge", len); 233 } 234 235 236 static void eap_ttls_phase2_select_eap_method(struct eap_ttls_data *data, 237 u8 method) 238 { 239 size_t i; 240 for (i = 0; i < data->num_phase2_eap_types; i++) { 241 if (data->phase2_eap_types[i].vendor != EAP_VENDOR_IETF || 242 data->phase2_eap_types[i].method != method) 243 continue; 244 245 data->phase2_eap_type.vendor = 246 data->phase2_eap_types[i].vendor; 247 data->phase2_eap_type.method = 248 data->phase2_eap_types[i].method; 249 wpa_printf(MSG_DEBUG, "EAP-TTLS: Selected " 250 "Phase 2 EAP vendor %d method %d", 251 data->phase2_eap_type.vendor, 252 data->phase2_eap_type.method); 253 break; 254 } 255 } 256 257 258 static int eap_ttls_phase2_eap_process(struct eap_sm *sm, 259 struct eap_ttls_data *data, 260 struct eap_method_ret *ret, 261 struct eap_hdr *hdr, size_t len, 262 struct wpabuf **resp) 263 { 264 struct wpabuf msg; 265 struct eap_method_ret iret; 266 267 os_memset(&iret, 0, sizeof(iret)); 268 wpabuf_set(&msg, hdr, len); 269 *resp = data->phase2_method->process(sm, data->phase2_priv, &iret, 270 &msg); 271 if ((iret.methodState == METHOD_DONE || 272 iret.methodState == METHOD_MAY_CONT) && 273 (iret.decision == DECISION_UNCOND_SUCC || 274 iret.decision == DECISION_COND_SUCC || 275 iret.decision == DECISION_FAIL)) { 276 ret->methodState = iret.methodState; 277 ret->decision = iret.decision; 278 } 279 280 return 0; 281 } 282 283 284 static int eap_ttls_phase2_request_eap_method(struct eap_sm *sm, 285 struct eap_ttls_data *data, 286 struct eap_method_ret *ret, 287 struct eap_hdr *hdr, size_t len, 288 u8 method, struct wpabuf **resp) 289 { 290 #ifdef EAP_TNC 291 if (data->tnc_started && data->phase2_method && 292 data->phase2_priv && method == EAP_TYPE_TNC && 293 data->phase2_eap_type.method == EAP_TYPE_TNC) 294 return eap_ttls_phase2_eap_process(sm, data, ret, hdr, len, 295 resp); 296 297 if (data->ready_for_tnc && !data->tnc_started && 298 method == EAP_TYPE_TNC) { 299 wpa_printf(MSG_DEBUG, "EAP-TTLS: Start TNC after completed " 300 "EAP method"); 301 data->tnc_started = 1; 302 } 303 304 if (data->tnc_started) { 305 if (data->phase2_eap_type.vendor != EAP_VENDOR_IETF || 306 data->phase2_eap_type.method == EAP_TYPE_TNC) { 307 wpa_printf(MSG_DEBUG, "EAP-TTLS: Unexpected EAP " 308 "type %d for TNC", method); 309 return -1; 310 } 311 312 data->phase2_eap_type.vendor = EAP_VENDOR_IETF; 313 data->phase2_eap_type.method = method; 314 wpa_printf(MSG_DEBUG, "EAP-TTLS: Selected " 315 "Phase 2 EAP vendor %d method %d (TNC)", 316 data->phase2_eap_type.vendor, 317 data->phase2_eap_type.method); 318 319 if (data->phase2_type == EAP_TTLS_PHASE2_EAP) 320 eap_ttls_phase2_eap_deinit(sm, data); 321 } 322 #endif /* EAP_TNC */ 323 324 if (data->phase2_eap_type.vendor == EAP_VENDOR_IETF && 325 data->phase2_eap_type.method == EAP_TYPE_NONE) 326 eap_ttls_phase2_select_eap_method(data, method); 327 328 if (method != data->phase2_eap_type.method || method == EAP_TYPE_NONE) 329 { 330 if (eap_peer_tls_phase2_nak(data->phase2_eap_types, 331 data->num_phase2_eap_types, 332 hdr, resp)) 333 return -1; 334 return 0; 335 } 336 337 if (data->phase2_priv == NULL) { 338 data->phase2_method = eap_peer_get_eap_method( 339 EAP_VENDOR_IETF, method); 340 if (data->phase2_method) { 341 sm->init_phase2 = 1; 342 data->phase2_priv = data->phase2_method->init(sm); 343 sm->init_phase2 = 0; 344 } 345 } 346 if (data->phase2_priv == NULL || data->phase2_method == NULL) { 347 wpa_printf(MSG_INFO, "EAP-TTLS: failed to initialize " 348 "Phase 2 EAP method %d", method); 349 return -1; 350 } 351 352 return eap_ttls_phase2_eap_process(sm, data, ret, hdr, len, resp); 353 } 354 355 356 static int eap_ttls_phase2_request_eap(struct eap_sm *sm, 357 struct eap_ttls_data *data, 358 struct eap_method_ret *ret, 359 struct eap_hdr *hdr, 360 struct wpabuf **resp) 361 { 362 size_t len = be_to_host16(hdr->length); 363 u8 *pos; 364 struct eap_peer_config *config = eap_get_config(sm); 365 366 if (len <= sizeof(struct eap_hdr)) { 367 wpa_printf(MSG_INFO, "EAP-TTLS: too short " 368 "Phase 2 request (len=%lu)", (unsigned long) len); 369 return -1; 370 } 371 pos = (u8 *) (hdr + 1); 372 wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 EAP Request: type=%d", *pos); 373 switch (*pos) { 374 case EAP_TYPE_IDENTITY: 375 *resp = eap_sm_buildIdentity(sm, hdr->identifier, 1); 376 break; 377 default: 378 if (eap_ttls_phase2_request_eap_method(sm, data, ret, hdr, len, 379 *pos, resp) < 0) 380 return -1; 381 break; 382 } 383 384 if (*resp == NULL && 385 (config->pending_req_identity || config->pending_req_password || 386 config->pending_req_otp)) { 387 return 0; 388 } 389 390 if (*resp == NULL) 391 return -1; 392 393 wpa_hexdump_buf(MSG_DEBUG, "EAP-TTLS: AVP encapsulate EAP Response", 394 *resp); 395 return eap_ttls_avp_encapsulate(resp, RADIUS_ATTR_EAP_MESSAGE, 1); 396 } 397 398 399 static int eap_ttls_phase2_request_mschapv2(struct eap_sm *sm, 400 struct eap_ttls_data *data, 401 struct eap_method_ret *ret, 402 struct wpabuf **resp) 403 { 404 #ifdef EAP_MSCHAPv2 405 struct wpabuf *msg; 406 u8 *buf, *pos, *challenge, *peer_challenge; 407 const u8 *identity, *password; 408 size_t identity_len, password_len; 409 int pwhash; 410 411 wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 MSCHAPV2 Request"); 412 413 identity = eap_get_config_identity(sm, &identity_len); 414 password = eap_get_config_password2(sm, &password_len, &pwhash); 415 if (identity == NULL || password == NULL) 416 return -1; 417 418 msg = wpabuf_alloc(identity_len + 1000); 419 if (msg == NULL) { 420 wpa_printf(MSG_ERROR, 421 "EAP-TTLS/MSCHAPV2: Failed to allocate memory"); 422 return -1; 423 } 424 pos = buf = wpabuf_mhead(msg); 425 426 /* User-Name */ 427 pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1, 428 identity, identity_len); 429 430 /* MS-CHAP-Challenge */ 431 challenge = eap_ttls_implicit_challenge( 432 sm, data, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN + 1); 433 if (challenge == NULL) { 434 wpabuf_free(msg); 435 wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAPV2: Failed to derive " 436 "implicit challenge"); 437 return -1; 438 } 439 440 pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_MS_CHAP_CHALLENGE, 441 RADIUS_VENDOR_ID_MICROSOFT, 1, 442 challenge, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN); 443 444 /* MS-CHAP2-Response */ 445 pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP2_RESPONSE, 446 RADIUS_VENDOR_ID_MICROSOFT, 1, 447 EAP_TTLS_MSCHAPV2_RESPONSE_LEN); 448 data->ident = challenge[EAP_TTLS_MSCHAPV2_CHALLENGE_LEN]; 449 *pos++ = data->ident; 450 *pos++ = 0; /* Flags */ 451 if (os_get_random(pos, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN) < 0) { 452 os_free(challenge); 453 wpabuf_free(msg); 454 wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAPV2: Failed to get " 455 "random data for peer challenge"); 456 return -1; 457 } 458 peer_challenge = pos; 459 pos += EAP_TTLS_MSCHAPV2_CHALLENGE_LEN; 460 os_memset(pos, 0, 8); /* Reserved, must be zero */ 461 pos += 8; 462 if (mschapv2_derive_response(identity, identity_len, password, 463 password_len, pwhash, challenge, 464 peer_challenge, pos, data->auth_response, 465 data->master_key)) { 466 os_free(challenge); 467 wpabuf_free(msg); 468 wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAPV2: Failed to derive " 469 "response"); 470 return -1; 471 } 472 data->auth_response_valid = 1; 473 474 pos += 24; 475 os_free(challenge); 476 AVP_PAD(buf, pos); 477 478 wpabuf_put(msg, pos - buf); 479 *resp = msg; 480 481 if (sm->workaround) { 482 /* At least FreeRADIUS seems to be terminating 483 * EAP-TTLS/MSHCAPV2 without the expected MS-CHAP-v2 Success 484 * packet. */ 485 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: EAP workaround - " 486 "allow success without tunneled response"); 487 ret->methodState = METHOD_MAY_CONT; 488 ret->decision = DECISION_COND_SUCC; 489 } 490 491 return 0; 492 #else /* EAP_MSCHAPv2 */ 493 wpa_printf(MSG_ERROR, "EAP-TTLS: MSCHAPv2 not included in the build"); 494 return -1; 495 #endif /* EAP_MSCHAPv2 */ 496 } 497 498 499 static int eap_ttls_phase2_request_mschap(struct eap_sm *sm, 500 struct eap_ttls_data *data, 501 struct eap_method_ret *ret, 502 struct wpabuf **resp) 503 { 504 struct wpabuf *msg; 505 u8 *buf, *pos, *challenge; 506 const u8 *identity, *password; 507 size_t identity_len, password_len; 508 int pwhash; 509 510 wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 MSCHAP Request"); 511 512 identity = eap_get_config_identity(sm, &identity_len); 513 password = eap_get_config_password2(sm, &password_len, &pwhash); 514 if (identity == NULL || password == NULL) 515 return -1; 516 517 msg = wpabuf_alloc(identity_len + 1000); 518 if (msg == NULL) { 519 wpa_printf(MSG_ERROR, 520 "EAP-TTLS/MSCHAP: Failed to allocate memory"); 521 return -1; 522 } 523 pos = buf = wpabuf_mhead(msg); 524 525 /* User-Name */ 526 pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1, 527 identity, identity_len); 528 529 /* MS-CHAP-Challenge */ 530 challenge = eap_ttls_implicit_challenge( 531 sm, data, EAP_TTLS_MSCHAP_CHALLENGE_LEN + 1); 532 if (challenge == NULL) { 533 wpabuf_free(msg); 534 wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAP: Failed to derive " 535 "implicit challenge"); 536 return -1; 537 } 538 539 pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_MS_CHAP_CHALLENGE, 540 RADIUS_VENDOR_ID_MICROSOFT, 1, 541 challenge, EAP_TTLS_MSCHAP_CHALLENGE_LEN); 542 543 /* MS-CHAP-Response */ 544 pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP_RESPONSE, 545 RADIUS_VENDOR_ID_MICROSOFT, 1, 546 EAP_TTLS_MSCHAP_RESPONSE_LEN); 547 data->ident = challenge[EAP_TTLS_MSCHAP_CHALLENGE_LEN]; 548 *pos++ = data->ident; 549 *pos++ = 1; /* Flags: Use NT style passwords */ 550 os_memset(pos, 0, 24); /* LM-Response */ 551 pos += 24; 552 if (pwhash) { 553 challenge_response(challenge, password, pos); /* NT-Response */ 554 wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: MSCHAP password hash", 555 password, 16); 556 } else { 557 nt_challenge_response(challenge, password, password_len, 558 pos); /* NT-Response */ 559 wpa_hexdump_ascii_key(MSG_DEBUG, "EAP-TTLS: MSCHAP password", 560 password, password_len); 561 } 562 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAP implicit challenge", 563 challenge, EAP_TTLS_MSCHAP_CHALLENGE_LEN); 564 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAP response", pos, 24); 565 pos += 24; 566 os_free(challenge); 567 AVP_PAD(buf, pos); 568 569 wpabuf_put(msg, pos - buf); 570 *resp = msg; 571 572 /* EAP-TTLS/MSCHAP does not provide tunneled success 573 * notification, so assume that Phase2 succeeds. */ 574 ret->methodState = METHOD_DONE; 575 ret->decision = DECISION_COND_SUCC; 576 577 return 0; 578 } 579 580 581 static int eap_ttls_phase2_request_pap(struct eap_sm *sm, 582 struct eap_ttls_data *data, 583 struct eap_method_ret *ret, 584 struct wpabuf **resp) 585 { 586 struct wpabuf *msg; 587 u8 *buf, *pos; 588 size_t pad; 589 const u8 *identity, *password; 590 size_t identity_len, password_len; 591 592 wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 PAP Request"); 593 594 identity = eap_get_config_identity(sm, &identity_len); 595 password = eap_get_config_password(sm, &password_len); 596 if (identity == NULL || password == NULL) 597 return -1; 598 599 msg = wpabuf_alloc(identity_len + password_len + 100); 600 if (msg == NULL) { 601 wpa_printf(MSG_ERROR, 602 "EAP-TTLS/PAP: Failed to allocate memory"); 603 return -1; 604 } 605 pos = buf = wpabuf_mhead(msg); 606 607 /* User-Name */ 608 pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1, 609 identity, identity_len); 610 611 /* User-Password; in RADIUS, this is encrypted, but EAP-TTLS encrypts 612 * the data, so no separate encryption is used in the AVP itself. 613 * However, the password is padded to obfuscate its length. */ 614 pad = password_len == 0 ? 16 : (16 - (password_len & 15)) & 15; 615 pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_USER_PASSWORD, 0, 1, 616 password_len + pad); 617 os_memcpy(pos, password, password_len); 618 pos += password_len; 619 os_memset(pos, 0, pad); 620 pos += pad; 621 AVP_PAD(buf, pos); 622 623 wpabuf_put(msg, pos - buf); 624 *resp = msg; 625 626 /* EAP-TTLS/PAP does not provide tunneled success notification, 627 * so assume that Phase2 succeeds. */ 628 ret->methodState = METHOD_DONE; 629 ret->decision = DECISION_COND_SUCC; 630 631 return 0; 632 } 633 634 635 static int eap_ttls_phase2_request_chap(struct eap_sm *sm, 636 struct eap_ttls_data *data, 637 struct eap_method_ret *ret, 638 struct wpabuf **resp) 639 { 640 struct wpabuf *msg; 641 u8 *buf, *pos, *challenge; 642 const u8 *identity, *password; 643 size_t identity_len, password_len; 644 645 wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 CHAP Request"); 646 647 identity = eap_get_config_identity(sm, &identity_len); 648 password = eap_get_config_password(sm, &password_len); 649 if (identity == NULL || password == NULL) 650 return -1; 651 652 msg = wpabuf_alloc(identity_len + 1000); 653 if (msg == NULL) { 654 wpa_printf(MSG_ERROR, 655 "EAP-TTLS/CHAP: Failed to allocate memory"); 656 return -1; 657 } 658 pos = buf = wpabuf_mhead(msg); 659 660 /* User-Name */ 661 pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1, 662 identity, identity_len); 663 664 /* CHAP-Challenge */ 665 challenge = eap_ttls_implicit_challenge( 666 sm, data, EAP_TTLS_CHAP_CHALLENGE_LEN + 1); 667 if (challenge == NULL) { 668 wpabuf_free(msg); 669 wpa_printf(MSG_ERROR, "EAP-TTLS/CHAP: Failed to derive " 670 "implicit challenge"); 671 return -1; 672 } 673 674 pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_CHAP_CHALLENGE, 0, 1, 675 challenge, EAP_TTLS_CHAP_CHALLENGE_LEN); 676 677 /* CHAP-Password */ 678 pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_CHAP_PASSWORD, 0, 1, 679 1 + EAP_TTLS_CHAP_PASSWORD_LEN); 680 data->ident = challenge[EAP_TTLS_CHAP_CHALLENGE_LEN]; 681 *pos++ = data->ident; 682 683 /* MD5(Ident + Password + Challenge) */ 684 chap_md5(data->ident, password, password_len, challenge, 685 EAP_TTLS_CHAP_CHALLENGE_LEN, pos); 686 687 wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: CHAP username", 688 identity, identity_len); 689 wpa_hexdump_ascii_key(MSG_DEBUG, "EAP-TTLS: CHAP password", 690 password, password_len); 691 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: CHAP implicit challenge", 692 challenge, EAP_TTLS_CHAP_CHALLENGE_LEN); 693 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: CHAP password", 694 pos, EAP_TTLS_CHAP_PASSWORD_LEN); 695 pos += EAP_TTLS_CHAP_PASSWORD_LEN; 696 os_free(challenge); 697 AVP_PAD(buf, pos); 698 699 wpabuf_put(msg, pos - buf); 700 *resp = msg; 701 702 /* EAP-TTLS/CHAP does not provide tunneled success 703 * notification, so assume that Phase2 succeeds. */ 704 ret->methodState = METHOD_DONE; 705 ret->decision = DECISION_COND_SUCC; 706 707 return 0; 708 } 709 710 711 static int eap_ttls_phase2_request(struct eap_sm *sm, 712 struct eap_ttls_data *data, 713 struct eap_method_ret *ret, 714 struct eap_hdr *hdr, 715 struct wpabuf **resp) 716 { 717 int res = 0; 718 size_t len; 719 enum phase2_types phase2_type = data->phase2_type; 720 721 #ifdef EAP_TNC 722 if (data->tnc_started) { 723 wpa_printf(MSG_DEBUG, "EAP-TTLS: Processing TNC"); 724 phase2_type = EAP_TTLS_PHASE2_EAP; 725 } 726 #endif /* EAP_TNC */ 727 728 if (phase2_type == EAP_TTLS_PHASE2_MSCHAPV2 || 729 phase2_type == EAP_TTLS_PHASE2_MSCHAP || 730 phase2_type == EAP_TTLS_PHASE2_PAP || 731 phase2_type == EAP_TTLS_PHASE2_CHAP) { 732 if (eap_get_config_identity(sm, &len) == NULL) { 733 wpa_printf(MSG_INFO, 734 "EAP-TTLS: Identity not configured"); 735 eap_sm_request_identity(sm); 736 if (eap_get_config_password(sm, &len) == NULL) 737 eap_sm_request_password(sm); 738 return 0; 739 } 740 741 if (eap_get_config_password(sm, &len) == NULL) { 742 wpa_printf(MSG_INFO, 743 "EAP-TTLS: Password not configured"); 744 eap_sm_request_password(sm); 745 return 0; 746 } 747 } 748 749 switch (phase2_type) { 750 case EAP_TTLS_PHASE2_EAP: 751 res = eap_ttls_phase2_request_eap(sm, data, ret, hdr, resp); 752 break; 753 case EAP_TTLS_PHASE2_MSCHAPV2: 754 res = eap_ttls_phase2_request_mschapv2(sm, data, ret, resp); 755 break; 756 case EAP_TTLS_PHASE2_MSCHAP: 757 res = eap_ttls_phase2_request_mschap(sm, data, ret, resp); 758 break; 759 case EAP_TTLS_PHASE2_PAP: 760 res = eap_ttls_phase2_request_pap(sm, data, ret, resp); 761 break; 762 case EAP_TTLS_PHASE2_CHAP: 763 res = eap_ttls_phase2_request_chap(sm, data, ret, resp); 764 break; 765 default: 766 wpa_printf(MSG_ERROR, "EAP-TTLS: Phase 2 - Unknown"); 767 res = -1; 768 break; 769 } 770 771 if (res < 0) { 772 ret->methodState = METHOD_DONE; 773 ret->decision = DECISION_FAIL; 774 } 775 776 return res; 777 } 778 779 780 struct ttls_parse_avp { 781 u8 *mschapv2; 782 u8 *eapdata; 783 size_t eap_len; 784 int mschapv2_error; 785 }; 786 787 788 static int eap_ttls_parse_attr_eap(const u8 *dpos, size_t dlen, 789 struct ttls_parse_avp *parse) 790 { 791 wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP - EAP Message"); 792 if (parse->eapdata == NULL) { 793 parse->eapdata = os_malloc(dlen); 794 if (parse->eapdata == NULL) { 795 wpa_printf(MSG_WARNING, "EAP-TTLS: Failed to allocate " 796 "memory for Phase 2 EAP data"); 797 return -1; 798 } 799 os_memcpy(parse->eapdata, dpos, dlen); 800 parse->eap_len = dlen; 801 } else { 802 u8 *neweap = os_realloc(parse->eapdata, parse->eap_len + dlen); 803 if (neweap == NULL) { 804 wpa_printf(MSG_WARNING, "EAP-TTLS: Failed to allocate " 805 "memory for Phase 2 EAP data"); 806 return -1; 807 } 808 os_memcpy(neweap + parse->eap_len, dpos, dlen); 809 parse->eapdata = neweap; 810 parse->eap_len += dlen; 811 } 812 813 return 0; 814 } 815 816 817 static int eap_ttls_parse_avp(u8 *pos, size_t left, 818 struct ttls_parse_avp *parse) 819 { 820 struct ttls_avp *avp; 821 u32 avp_code, avp_length, vendor_id = 0; 822 u8 avp_flags, *dpos; 823 size_t dlen; 824 825 avp = (struct ttls_avp *) pos; 826 avp_code = be_to_host32(avp->avp_code); 827 avp_length = be_to_host32(avp->avp_length); 828 avp_flags = (avp_length >> 24) & 0xff; 829 avp_length &= 0xffffff; 830 wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP: code=%d flags=0x%02x " 831 "length=%d", (int) avp_code, avp_flags, 832 (int) avp_length); 833 834 if (avp_length > left) { 835 wpa_printf(MSG_WARNING, "EAP-TTLS: AVP overflow " 836 "(len=%d, left=%lu) - dropped", 837 (int) avp_length, (unsigned long) left); 838 return -1; 839 } 840 841 if (avp_length < sizeof(*avp)) { 842 wpa_printf(MSG_WARNING, "EAP-TTLS: Invalid AVP length %d", 843 avp_length); 844 return -1; 845 } 846 847 dpos = (u8 *) (avp + 1); 848 dlen = avp_length - sizeof(*avp); 849 if (avp_flags & AVP_FLAGS_VENDOR) { 850 if (dlen < 4) { 851 wpa_printf(MSG_WARNING, "EAP-TTLS: Vendor AVP " 852 "underflow"); 853 return -1; 854 } 855 vendor_id = WPA_GET_BE32(dpos); 856 wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP vendor_id %d", 857 (int) vendor_id); 858 dpos += 4; 859 dlen -= 4; 860 } 861 862 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: AVP data", dpos, dlen); 863 864 if (vendor_id == 0 && avp_code == RADIUS_ATTR_EAP_MESSAGE) { 865 if (eap_ttls_parse_attr_eap(dpos, dlen, parse) < 0) 866 return -1; 867 } else if (vendor_id == 0 && avp_code == RADIUS_ATTR_REPLY_MESSAGE) { 868 /* This is an optional message that can be displayed to 869 * the user. */ 870 wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: AVP - Reply-Message", 871 dpos, dlen); 872 } else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT && 873 avp_code == RADIUS_ATTR_MS_CHAP2_SUCCESS) { 874 wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: MS-CHAP2-Success", 875 dpos, dlen); 876 if (dlen != 43) { 877 wpa_printf(MSG_WARNING, "EAP-TTLS: Unexpected " 878 "MS-CHAP2-Success length " 879 "(len=%lu, expected 43)", 880 (unsigned long) dlen); 881 return -1; 882 } 883 parse->mschapv2 = dpos; 884 } else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT && 885 avp_code == RADIUS_ATTR_MS_CHAP_ERROR) { 886 wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: MS-CHAP-Error", 887 dpos, dlen); 888 parse->mschapv2_error = 1; 889 } else if (avp_flags & AVP_FLAGS_MANDATORY) { 890 wpa_printf(MSG_WARNING, "EAP-TTLS: Unsupported mandatory AVP " 891 "code %d vendor_id %d - dropped", 892 (int) avp_code, (int) vendor_id); 893 return -1; 894 } else { 895 wpa_printf(MSG_DEBUG, "EAP-TTLS: Ignoring unsupported AVP " 896 "code %d vendor_id %d", 897 (int) avp_code, (int) vendor_id); 898 } 899 900 return avp_length; 901 } 902 903 904 static int eap_ttls_parse_avps(struct wpabuf *in_decrypted, 905 struct ttls_parse_avp *parse) 906 { 907 u8 *pos; 908 size_t left, pad; 909 int avp_length; 910 911 pos = wpabuf_mhead(in_decrypted); 912 left = wpabuf_len(in_decrypted); 913 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Decrypted Phase 2 AVPs", pos, left); 914 if (left < sizeof(struct ttls_avp)) { 915 wpa_printf(MSG_WARNING, "EAP-TTLS: Too short Phase 2 AVP frame" 916 " len=%lu expected %lu or more - dropped", 917 (unsigned long) left, 918 (unsigned long) sizeof(struct ttls_avp)); 919 return -1; 920 } 921 922 /* Parse AVPs */ 923 os_memset(parse, 0, sizeof(*parse)); 924 925 while (left > 0) { 926 avp_length = eap_ttls_parse_avp(pos, left, parse); 927 if (avp_length < 0) 928 return -1; 929 930 pad = (4 - (avp_length & 3)) & 3; 931 pos += avp_length + pad; 932 if (left < avp_length + pad) 933 left = 0; 934 else 935 left -= avp_length + pad; 936 } 937 938 return 0; 939 } 940 941 942 static u8 * eap_ttls_fake_identity_request(void) 943 { 944 struct eap_hdr *hdr; 945 u8 *buf; 946 947 wpa_printf(MSG_DEBUG, "EAP-TTLS: empty data in beginning of " 948 "Phase 2 - use fake EAP-Request Identity"); 949 buf = os_malloc(sizeof(*hdr) + 1); 950 if (buf == NULL) { 951 wpa_printf(MSG_WARNING, "EAP-TTLS: failed to allocate " 952 "memory for fake EAP-Identity Request"); 953 return NULL; 954 } 955 956 hdr = (struct eap_hdr *) buf; 957 hdr->code = EAP_CODE_REQUEST; 958 hdr->identifier = 0; 959 hdr->length = host_to_be16(sizeof(*hdr) + 1); 960 buf[sizeof(*hdr)] = EAP_TYPE_IDENTITY; 961 962 return buf; 963 } 964 965 966 static int eap_ttls_encrypt_response(struct eap_sm *sm, 967 struct eap_ttls_data *data, 968 struct wpabuf *resp, u8 identifier, 969 struct wpabuf **out_data) 970 { 971 if (resp == NULL) 972 return 0; 973 974 wpa_hexdump_buf_key(MSG_DEBUG, "EAP-TTLS: Encrypting Phase 2 data", 975 resp); 976 if (eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_TTLS, 977 data->ttls_version, identifier, 978 resp, out_data)) { 979 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to encrypt a Phase 2 " 980 "frame"); 981 return -1; 982 } 983 wpabuf_free(resp); 984 985 return 0; 986 } 987 988 989 static int eap_ttls_process_phase2_eap(struct eap_sm *sm, 990 struct eap_ttls_data *data, 991 struct eap_method_ret *ret, 992 struct ttls_parse_avp *parse, 993 struct wpabuf **resp) 994 { 995 struct eap_hdr *hdr; 996 size_t len; 997 998 if (parse->eapdata == NULL) { 999 wpa_printf(MSG_WARNING, "EAP-TTLS: No EAP Message in the " 1000 "packet - dropped"); 1001 return -1; 1002 } 1003 1004 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Phase 2 EAP", 1005 parse->eapdata, parse->eap_len); 1006 hdr = (struct eap_hdr *) parse->eapdata; 1007 1008 if (parse->eap_len < sizeof(*hdr)) { 1009 wpa_printf(MSG_WARNING, "EAP-TTLS: Too short Phase 2 EAP " 1010 "frame (len=%lu, expected %lu or more) - dropped", 1011 (unsigned long) parse->eap_len, 1012 (unsigned long) sizeof(*hdr)); 1013 return -1; 1014 } 1015 len = be_to_host16(hdr->length); 1016 if (len > parse->eap_len) { 1017 wpa_printf(MSG_INFO, "EAP-TTLS: Length mismatch in Phase 2 " 1018 "EAP frame (EAP hdr len=%lu, EAP data len in " 1019 "AVP=%lu)", 1020 (unsigned long) len, 1021 (unsigned long) parse->eap_len); 1022 return -1; 1023 } 1024 wpa_printf(MSG_DEBUG, "EAP-TTLS: received Phase 2: code=%d " 1025 "identifier=%d length=%lu", 1026 hdr->code, hdr->identifier, (unsigned long) len); 1027 switch (hdr->code) { 1028 case EAP_CODE_REQUEST: 1029 if (eap_ttls_phase2_request(sm, data, ret, hdr, resp)) { 1030 wpa_printf(MSG_INFO, "EAP-TTLS: Phase2 Request " 1031 "processing failed"); 1032 return -1; 1033 } 1034 break; 1035 default: 1036 wpa_printf(MSG_INFO, "EAP-TTLS: Unexpected code=%d in " 1037 "Phase 2 EAP header", hdr->code); 1038 return -1; 1039 } 1040 1041 return 0; 1042 } 1043 1044 1045 static int eap_ttls_process_phase2_mschapv2(struct eap_sm *sm, 1046 struct eap_ttls_data *data, 1047 struct eap_method_ret *ret, 1048 struct ttls_parse_avp *parse) 1049 { 1050 #ifdef EAP_MSCHAPv2 1051 if (parse->mschapv2_error) { 1052 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Received " 1053 "MS-CHAP-Error - failed"); 1054 ret->methodState = METHOD_DONE; 1055 ret->decision = DECISION_FAIL; 1056 /* Reply with empty data to ACK error */ 1057 return 1; 1058 } 1059 1060 if (parse->mschapv2 == NULL) { 1061 #ifdef EAP_TNC 1062 if (data->phase2_success && parse->eapdata) { 1063 /* 1064 * Allow EAP-TNC to be started after successfully 1065 * completed MSCHAPV2. 1066 */ 1067 return 1; 1068 } 1069 #endif /* EAP_TNC */ 1070 wpa_printf(MSG_WARNING, "EAP-TTLS: no MS-CHAP2-Success AVP " 1071 "received for Phase2 MSCHAPV2"); 1072 return -1; 1073 } 1074 if (parse->mschapv2[0] != data->ident) { 1075 wpa_printf(MSG_WARNING, "EAP-TTLS: Ident mismatch for Phase 2 " 1076 "MSCHAPV2 (received Ident 0x%02x, expected 0x%02x)", 1077 parse->mschapv2[0], data->ident); 1078 return -1; 1079 } 1080 if (!data->auth_response_valid || 1081 mschapv2_verify_auth_response(data->auth_response, 1082 parse->mschapv2 + 1, 42)) { 1083 wpa_printf(MSG_WARNING, "EAP-TTLS: Invalid authenticator " 1084 "response in Phase 2 MSCHAPV2 success request"); 1085 return -1; 1086 } 1087 1088 wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 MSCHAPV2 " 1089 "authentication succeeded"); 1090 ret->methodState = METHOD_DONE; 1091 ret->decision = DECISION_UNCOND_SUCC; 1092 data->phase2_success = 1; 1093 1094 /* 1095 * Reply with empty data; authentication server will reply 1096 * with EAP-Success after this. 1097 */ 1098 return 1; 1099 #else /* EAP_MSCHAPv2 */ 1100 wpa_printf(MSG_ERROR, "EAP-TTLS: MSCHAPv2 not included in the build"); 1101 return -1; 1102 #endif /* EAP_MSCHAPv2 */ 1103 } 1104 1105 1106 #ifdef EAP_TNC 1107 static int eap_ttls_process_tnc_start(struct eap_sm *sm, 1108 struct eap_ttls_data *data, 1109 struct eap_method_ret *ret, 1110 struct ttls_parse_avp *parse, 1111 struct wpabuf **resp) 1112 { 1113 /* TNC uses inner EAP method after non-EAP TTLS phase 2. */ 1114 if (parse->eapdata == NULL) { 1115 wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received " 1116 "unexpected tunneled data (no EAP)"); 1117 return -1; 1118 } 1119 1120 if (!data->ready_for_tnc) { 1121 wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received " 1122 "EAP after non-EAP, but not ready for TNC"); 1123 return -1; 1124 } 1125 1126 wpa_printf(MSG_DEBUG, "EAP-TTLS: Start TNC after completed " 1127 "non-EAP method"); 1128 data->tnc_started = 1; 1129 1130 if (eap_ttls_process_phase2_eap(sm, data, ret, parse, resp) < 0) 1131 return -1; 1132 1133 return 0; 1134 } 1135 #endif /* EAP_TNC */ 1136 1137 1138 static int eap_ttls_process_decrypted(struct eap_sm *sm, 1139 struct eap_ttls_data *data, 1140 struct eap_method_ret *ret, 1141 u8 identifier, 1142 struct ttls_parse_avp *parse, 1143 struct wpabuf *in_decrypted, 1144 struct wpabuf **out_data) 1145 { 1146 struct wpabuf *resp = NULL; 1147 struct eap_peer_config *config = eap_get_config(sm); 1148 int res; 1149 enum phase2_types phase2_type = data->phase2_type; 1150 1151 #ifdef EAP_TNC 1152 if (data->tnc_started) 1153 phase2_type = EAP_TTLS_PHASE2_EAP; 1154 #endif /* EAP_TNC */ 1155 1156 switch (phase2_type) { 1157 case EAP_TTLS_PHASE2_EAP: 1158 if (eap_ttls_process_phase2_eap(sm, data, ret, parse, &resp) < 1159 0) 1160 return -1; 1161 break; 1162 case EAP_TTLS_PHASE2_MSCHAPV2: 1163 res = eap_ttls_process_phase2_mschapv2(sm, data, ret, parse); 1164 #ifdef EAP_TNC 1165 if (res == 1 && parse->eapdata && data->phase2_success) { 1166 /* 1167 * TNC may be required as the next 1168 * authentication method within the tunnel. 1169 */ 1170 ret->methodState = METHOD_MAY_CONT; 1171 data->ready_for_tnc = 1; 1172 if (eap_ttls_process_tnc_start(sm, data, ret, parse, 1173 &resp) == 0) 1174 break; 1175 } 1176 #endif /* EAP_TNC */ 1177 return res; 1178 case EAP_TTLS_PHASE2_MSCHAP: 1179 case EAP_TTLS_PHASE2_PAP: 1180 case EAP_TTLS_PHASE2_CHAP: 1181 #ifdef EAP_TNC 1182 if (eap_ttls_process_tnc_start(sm, data, ret, parse, &resp) < 1183 0) 1184 return -1; 1185 break; 1186 #else /* EAP_TNC */ 1187 /* EAP-TTLS/{MSCHAP,PAP,CHAP} should not send any TLS tunneled 1188 * requests to the supplicant */ 1189 wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received unexpected " 1190 "tunneled data"); 1191 return -1; 1192 #endif /* EAP_TNC */ 1193 } 1194 1195 if (resp) { 1196 if (eap_ttls_encrypt_response(sm, data, resp, identifier, 1197 out_data) < 0) 1198 return -1; 1199 } else if (config->pending_req_identity || 1200 config->pending_req_password || 1201 config->pending_req_otp || 1202 config->pending_req_new_password) { 1203 wpabuf_free(data->pending_phase2_req); 1204 data->pending_phase2_req = wpabuf_dup(in_decrypted); 1205 } 1206 1207 return 0; 1208 } 1209 1210 1211 static int eap_ttls_implicit_identity_request(struct eap_sm *sm, 1212 struct eap_ttls_data *data, 1213 struct eap_method_ret *ret, 1214 u8 identifier, 1215 struct wpabuf **out_data) 1216 { 1217 int retval = 0; 1218 struct eap_hdr *hdr; 1219 struct wpabuf *resp; 1220 1221 hdr = (struct eap_hdr *) eap_ttls_fake_identity_request(); 1222 if (hdr == NULL) { 1223 ret->methodState = METHOD_DONE; 1224 ret->decision = DECISION_FAIL; 1225 return -1; 1226 } 1227 1228 resp = NULL; 1229 if (eap_ttls_phase2_request(sm, data, ret, hdr, &resp)) { 1230 wpa_printf(MSG_INFO, "EAP-TTLS: Phase2 Request " 1231 "processing failed"); 1232 retval = -1; 1233 } else { 1234 struct eap_peer_config *config = eap_get_config(sm); 1235 if (resp == NULL && 1236 (config->pending_req_identity || 1237 config->pending_req_password || 1238 config->pending_req_otp || 1239 config->pending_req_new_password)) { 1240 /* 1241 * Use empty buffer to force implicit request 1242 * processing when EAP request is re-processed after 1243 * user input. 1244 */ 1245 wpabuf_free(data->pending_phase2_req); 1246 data->pending_phase2_req = wpabuf_alloc(0); 1247 } 1248 1249 retval = eap_ttls_encrypt_response(sm, data, resp, identifier, 1250 out_data); 1251 } 1252 1253 os_free(hdr); 1254 1255 if (retval < 0) { 1256 ret->methodState = METHOD_DONE; 1257 ret->decision = DECISION_FAIL; 1258 } 1259 1260 return retval; 1261 } 1262 1263 1264 static int eap_ttls_phase2_start(struct eap_sm *sm, struct eap_ttls_data *data, 1265 struct eap_method_ret *ret, u8 identifier, 1266 struct wpabuf **out_data) 1267 { 1268 data->phase2_start = 0; 1269 1270 /* 1271 * EAP-TTLS does not use Phase2 on fast re-auth; this must be done only 1272 * if TLS part was indeed resuming a previous session. Most 1273 * Authentication Servers terminate EAP-TTLS before reaching this 1274 * point, but some do not. Make wpa_supplicant stop phase 2 here, if 1275 * needed. 1276 */ 1277 if (data->reauth && 1278 tls_connection_resumed(sm->ssl_ctx, data->ssl.conn)) { 1279 wpa_printf(MSG_DEBUG, "EAP-TTLS: Session resumption - " 1280 "skip phase 2"); 1281 *out_data = eap_peer_tls_build_ack(identifier, EAP_TYPE_TTLS, 1282 data->ttls_version); 1283 ret->methodState = METHOD_DONE; 1284 ret->decision = DECISION_UNCOND_SUCC; 1285 data->phase2_success = 1; 1286 return 0; 1287 } 1288 1289 return eap_ttls_implicit_identity_request(sm, data, ret, identifier, 1290 out_data); 1291 } 1292 1293 1294 static int eap_ttls_decrypt(struct eap_sm *sm, struct eap_ttls_data *data, 1295 struct eap_method_ret *ret, u8 identifier, 1296 const struct wpabuf *in_data, 1297 struct wpabuf **out_data) 1298 { 1299 struct wpabuf *in_decrypted = NULL; 1300 int retval = 0; 1301 struct ttls_parse_avp parse; 1302 1303 os_memset(&parse, 0, sizeof(parse)); 1304 1305 wpa_printf(MSG_DEBUG, "EAP-TTLS: received %lu bytes encrypted data for" 1306 " Phase 2", 1307 in_data ? (unsigned long) wpabuf_len(in_data) : 0); 1308 1309 if (data->pending_phase2_req) { 1310 wpa_printf(MSG_DEBUG, "EAP-TTLS: Pending Phase 2 request - " 1311 "skip decryption and use old data"); 1312 /* Clear TLS reassembly state. */ 1313 eap_peer_tls_reset_input(&data->ssl); 1314 1315 in_decrypted = data->pending_phase2_req; 1316 data->pending_phase2_req = NULL; 1317 if (wpabuf_len(in_decrypted) == 0) { 1318 wpabuf_free(in_decrypted); 1319 return eap_ttls_implicit_identity_request( 1320 sm, data, ret, identifier, out_data); 1321 } 1322 goto continue_req; 1323 } 1324 1325 if ((in_data == NULL || wpabuf_len(in_data) == 0) && 1326 data->phase2_start) { 1327 return eap_ttls_phase2_start(sm, data, ret, identifier, 1328 out_data); 1329 } 1330 1331 if (in_data == NULL || wpabuf_len(in_data) == 0) { 1332 /* Received TLS ACK - requesting more fragments */ 1333 return eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_TTLS, 1334 data->ttls_version, 1335 identifier, NULL, out_data); 1336 } 1337 1338 retval = eap_peer_tls_decrypt(sm, &data->ssl, in_data, &in_decrypted); 1339 if (retval) 1340 goto done; 1341 1342 continue_req: 1343 data->phase2_start = 0; 1344 1345 if (eap_ttls_parse_avps(in_decrypted, &parse) < 0) { 1346 retval = -1; 1347 goto done; 1348 } 1349 1350 retval = eap_ttls_process_decrypted(sm, data, ret, identifier, 1351 &parse, in_decrypted, out_data); 1352 1353 done: 1354 wpabuf_free(in_decrypted); 1355 os_free(parse.eapdata); 1356 1357 if (retval < 0) { 1358 ret->methodState = METHOD_DONE; 1359 ret->decision = DECISION_FAIL; 1360 } 1361 1362 return retval; 1363 } 1364 1365 1366 static int eap_ttls_process_handshake(struct eap_sm *sm, 1367 struct eap_ttls_data *data, 1368 struct eap_method_ret *ret, 1369 u8 identifier, 1370 const u8 *in_data, size_t in_len, 1371 struct wpabuf **out_data) 1372 { 1373 int res; 1374 1375 res = eap_peer_tls_process_helper(sm, &data->ssl, EAP_TYPE_TTLS, 1376 data->ttls_version, identifier, 1377 in_data, in_len, out_data); 1378 1379 if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) { 1380 wpa_printf(MSG_DEBUG, "EAP-TTLS: TLS done, proceed to " 1381 "Phase 2"); 1382 if (data->resuming) { 1383 wpa_printf(MSG_DEBUG, "EAP-TTLS: fast reauth - may " 1384 "skip Phase 2"); 1385 ret->decision = DECISION_COND_SUCC; 1386 ret->methodState = METHOD_MAY_CONT; 1387 } 1388 data->phase2_start = 1; 1389 eap_ttls_v0_derive_key(sm, data); 1390 1391 if (*out_data == NULL || wpabuf_len(*out_data) == 0) { 1392 if (eap_ttls_decrypt(sm, data, ret, identifier, 1393 NULL, out_data)) { 1394 wpa_printf(MSG_WARNING, "EAP-TTLS: " 1395 "failed to process early " 1396 "start for Phase 2"); 1397 } 1398 res = 0; 1399 } 1400 data->resuming = 0; 1401 } 1402 1403 if (res == 2) { 1404 struct wpabuf msg; 1405 /* 1406 * Application data included in the handshake message. 1407 */ 1408 wpabuf_free(data->pending_phase2_req); 1409 data->pending_phase2_req = *out_data; 1410 *out_data = NULL; 1411 wpabuf_set(&msg, in_data, in_len); 1412 res = eap_ttls_decrypt(sm, data, ret, identifier, &msg, 1413 out_data); 1414 } 1415 1416 return res; 1417 } 1418 1419 1420 static void eap_ttls_check_auth_status(struct eap_sm *sm, 1421 struct eap_ttls_data *data, 1422 struct eap_method_ret *ret) 1423 { 1424 if (ret->methodState == METHOD_DONE) { 1425 ret->allowNotifications = FALSE; 1426 if (ret->decision == DECISION_UNCOND_SUCC || 1427 ret->decision == DECISION_COND_SUCC) { 1428 wpa_printf(MSG_DEBUG, "EAP-TTLS: Authentication " 1429 "completed successfully"); 1430 data->phase2_success = 1; 1431 #ifdef EAP_TNC 1432 if (!data->ready_for_tnc && !data->tnc_started) { 1433 /* 1434 * TNC may be required as the next 1435 * authentication method within the tunnel. 1436 */ 1437 ret->methodState = METHOD_MAY_CONT; 1438 data->ready_for_tnc = 1; 1439 } 1440 #endif /* EAP_TNC */ 1441 } 1442 } else if (ret->methodState == METHOD_MAY_CONT && 1443 (ret->decision == DECISION_UNCOND_SUCC || 1444 ret->decision == DECISION_COND_SUCC)) { 1445 wpa_printf(MSG_DEBUG, "EAP-TTLS: Authentication " 1446 "completed successfully (MAY_CONT)"); 1447 data->phase2_success = 1; 1448 } 1449 } 1450 1451 1452 static struct wpabuf * eap_ttls_process(struct eap_sm *sm, void *priv, 1453 struct eap_method_ret *ret, 1454 const struct wpabuf *reqData) 1455 { 1456 size_t left; 1457 int res; 1458 u8 flags, id; 1459 struct wpabuf *resp; 1460 const u8 *pos; 1461 struct eap_ttls_data *data = priv; 1462 1463 pos = eap_peer_tls_process_init(sm, &data->ssl, EAP_TYPE_TTLS, ret, 1464 reqData, &left, &flags); 1465 if (pos == NULL) 1466 return NULL; 1467 id = eap_get_id(reqData); 1468 1469 if (flags & EAP_TLS_FLAGS_START) { 1470 wpa_printf(MSG_DEBUG, "EAP-TTLS: Start (server ver=%d, own " 1471 "ver=%d)", flags & EAP_TLS_VERSION_MASK, 1472 data->ttls_version); 1473 1474 /* RFC 5281, Ch. 9.2: 1475 * "This packet MAY contain additional information in the form 1476 * of AVPs, which may provide useful hints to the client" 1477 * For now, ignore any potential extra data. 1478 */ 1479 left = 0; 1480 } 1481 1482 resp = NULL; 1483 if (tls_connection_established(sm->ssl_ctx, data->ssl.conn) && 1484 !data->resuming) { 1485 struct wpabuf msg; 1486 wpabuf_set(&msg, pos, left); 1487 res = eap_ttls_decrypt(sm, data, ret, id, &msg, &resp); 1488 } else { 1489 res = eap_ttls_process_handshake(sm, data, ret, id, 1490 pos, left, &resp); 1491 } 1492 1493 eap_ttls_check_auth_status(sm, data, ret); 1494 1495 /* FIX: what about res == -1? Could just move all error processing into 1496 * the other functions and get rid of this res==1 case here. */ 1497 if (res == 1) { 1498 wpabuf_free(resp); 1499 return eap_peer_tls_build_ack(id, EAP_TYPE_TTLS, 1500 data->ttls_version); 1501 } 1502 return resp; 1503 } 1504 1505 1506 static Boolean eap_ttls_has_reauth_data(struct eap_sm *sm, void *priv) 1507 { 1508 struct eap_ttls_data *data = priv; 1509 return tls_connection_established(sm->ssl_ctx, data->ssl.conn) && 1510 data->phase2_success; 1511 } 1512 1513 1514 static void eap_ttls_deinit_for_reauth(struct eap_sm *sm, void *priv) 1515 { 1516 struct eap_ttls_data *data = priv; 1517 wpabuf_free(data->pending_phase2_req); 1518 data->pending_phase2_req = NULL; 1519 #ifdef EAP_TNC 1520 data->ready_for_tnc = 0; 1521 data->tnc_started = 0; 1522 #endif /* EAP_TNC */ 1523 } 1524 1525 1526 static void * eap_ttls_init_for_reauth(struct eap_sm *sm, void *priv) 1527 { 1528 struct eap_ttls_data *data = priv; 1529 os_free(data->key_data); 1530 data->key_data = NULL; 1531 if (eap_peer_tls_reauth_init(sm, &data->ssl)) { 1532 os_free(data); 1533 return NULL; 1534 } 1535 if (data->phase2_priv && data->phase2_method && 1536 data->phase2_method->init_for_reauth) 1537 data->phase2_method->init_for_reauth(sm, data->phase2_priv); 1538 data->phase2_start = 0; 1539 data->phase2_success = 0; 1540 data->resuming = 1; 1541 data->reauth = 1; 1542 return priv; 1543 } 1544 1545 1546 static int eap_ttls_get_status(struct eap_sm *sm, void *priv, char *buf, 1547 size_t buflen, int verbose) 1548 { 1549 struct eap_ttls_data *data = priv; 1550 int len, ret; 1551 1552 len = eap_peer_tls_status(sm, &data->ssl, buf, buflen, verbose); 1553 ret = os_snprintf(buf + len, buflen - len, 1554 "EAP-TTLSv%d Phase2 method=", 1555 data->ttls_version); 1556 if (ret < 0 || (size_t) ret >= buflen - len) 1557 return len; 1558 len += ret; 1559 switch (data->phase2_type) { 1560 case EAP_TTLS_PHASE2_EAP: 1561 ret = os_snprintf(buf + len, buflen - len, "EAP-%s\n", 1562 data->phase2_method ? 1563 data->phase2_method->name : "?"); 1564 break; 1565 case EAP_TTLS_PHASE2_MSCHAPV2: 1566 ret = os_snprintf(buf + len, buflen - len, "MSCHAPV2\n"); 1567 break; 1568 case EAP_TTLS_PHASE2_MSCHAP: 1569 ret = os_snprintf(buf + len, buflen - len, "MSCHAP\n"); 1570 break; 1571 case EAP_TTLS_PHASE2_PAP: 1572 ret = os_snprintf(buf + len, buflen - len, "PAP\n"); 1573 break; 1574 case EAP_TTLS_PHASE2_CHAP: 1575 ret = os_snprintf(buf + len, buflen - len, "CHAP\n"); 1576 break; 1577 default: 1578 ret = 0; 1579 break; 1580 } 1581 if (ret < 0 || (size_t) ret >= buflen - len) 1582 return len; 1583 len += ret; 1584 1585 return len; 1586 } 1587 1588 1589 static Boolean eap_ttls_isKeyAvailable(struct eap_sm *sm, void *priv) 1590 { 1591 struct eap_ttls_data *data = priv; 1592 return data->key_data != NULL && data->phase2_success; 1593 } 1594 1595 1596 static u8 * eap_ttls_getKey(struct eap_sm *sm, void *priv, size_t *len) 1597 { 1598 struct eap_ttls_data *data = priv; 1599 u8 *key; 1600 1601 if (data->key_data == NULL || !data->phase2_success) 1602 return NULL; 1603 1604 key = os_malloc(EAP_TLS_KEY_LEN); 1605 if (key == NULL) 1606 return NULL; 1607 1608 *len = EAP_TLS_KEY_LEN; 1609 os_memcpy(key, data->key_data, EAP_TLS_KEY_LEN); 1610 1611 return key; 1612 } 1613 1614 1615 int eap_peer_ttls_register(void) 1616 { 1617 struct eap_method *eap; 1618 int ret; 1619 1620 eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION, 1621 EAP_VENDOR_IETF, EAP_TYPE_TTLS, "TTLS"); 1622 if (eap == NULL) 1623 return -1; 1624 1625 eap->init = eap_ttls_init; 1626 eap->deinit = eap_ttls_deinit; 1627 eap->process = eap_ttls_process; 1628 eap->isKeyAvailable = eap_ttls_isKeyAvailable; 1629 eap->getKey = eap_ttls_getKey; 1630 eap->get_status = eap_ttls_get_status; 1631 eap->has_reauth_data = eap_ttls_has_reauth_data; 1632 eap->deinit_for_reauth = eap_ttls_deinit_for_reauth; 1633 eap->init_for_reauth = eap_ttls_init_for_reauth; 1634 1635 ret = eap_peer_method_register(eap); 1636 if (ret) 1637 eap_peer_method_free(eap); 1638 return ret; 1639 } 1640
