?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Import hostapd 0.5.8
[dragonfly.git] / contrib / hostapd-0.5.8 / eap_ttls.c
blob1c0f17e764b7623da29dcb275d11c70f23a64b78
1 /*
2 * hostapd / EAP-TTLS (draft-ietf-pppext-eap-ttls-05.txt)
3 * Copyright (c) 2004-2007, Jouni Malinen <j@w1.fi>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Alternatively, this software may be distributed under the terms of BSD
10 * license.
11 *
12 * See README and COPYING for more details.
13 */
14
15 #include "includes.h"
16
17 #include "hostapd.h"
18 #include "common.h"
19 #include "eap_i.h"
20 #include "eap_tls_common.h"
21 #include "ms_funcs.h"
22 #include "md5.h"
23 #include "sha1.h"
24 #include "crypto.h"
25 #include "tls.h"
26 #include "eap_ttls.h"
27
28
29 /* Maximum supported PEAP version
30 * 0 = draft-ietf-pppext-eap-ttls-03.txt / draft-funk-eap-ttls-v0-00.txt
31 * 1 = draft-funk-eap-ttls-v1-00.txt
32 */
33 #define EAP_TTLS_VERSION 0 /* TTLSv1 implementation is not yet complete */
34
35
36 #define MSCHAPV2_KEY_LEN 16
37
38
39 static void eap_ttls_reset(struct eap_sm *sm, void *priv);
40
41
42 struct eap_ttls_data {
43 struct eap_ssl_data ssl;
44 enum {
45 START, PHASE1, PHASE2_START, PHASE2_METHOD,
46 PHASE2_MSCHAPV2_RESP, PHASE_FINISHED, SUCCESS, FAILURE
47 } state;
48
49 int ttls_version;
50 int force_version;
51 const struct eap_method *phase2_method;
52 void *phase2_priv;
53 int mschapv2_resp_ok;
54 u8 mschapv2_auth_response[20];
55 u8 mschapv2_ident;
56 int tls_ia_configured;
57 };
58
59
60 static const char * eap_ttls_state_txt(int state)
61 {
62 switch (state) {
63 case START:
64 return "START";
65 case PHASE1:
66 return "PHASE1";
67 case PHASE2_START:
68 return "PHASE2_START";
69 case PHASE2_METHOD:
70 return "PHASE2_METHOD";
71 case PHASE2_MSCHAPV2_RESP:
72 return "PHASE2_MSCHAPV2_RESP";
73 case PHASE_FINISHED:
74 return "PHASE_FINISHED";
75 case SUCCESS:
76 return "SUCCESS";
77 case FAILURE:
78 return "FAILURE";
79 default:
80 return "Unknown?!";
81 }
82 }
83
84
85 static void eap_ttls_state(struct eap_ttls_data *data, int state)
86 {
87 wpa_printf(MSG_DEBUG, "EAP-TTLS: %s -> %s",
88 eap_ttls_state_txt(data->state),
89 eap_ttls_state_txt(state));
90 data->state = state;
91 }
92
93
94 static u8 * eap_ttls_avp_hdr(u8 *avphdr, u32 avp_code, u32 vendor_id,
95 int mandatory, size_t len)
96 {
97 struct ttls_avp_vendor *avp;
98 u8 flags;
99 size_t hdrlen;
100
101 avp = (struct ttls_avp_vendor *) avphdr;
102 flags = mandatory ? AVP_FLAGS_MANDATORY : 0;
103 if (vendor_id) {
104 flags |= AVP_FLAGS_VENDOR;
105 hdrlen = sizeof(*avp);
106 avp->vendor_id = host_to_be32(vendor_id);
107 } else {
108 hdrlen = sizeof(struct ttls_avp);
109 }
110
111 avp->avp_code = host_to_be32(avp_code);
112 avp->avp_length = host_to_be32((flags << 24) | (hdrlen + len));
113
114 return avphdr + hdrlen;
115 }
116
117
118 static int eap_ttls_avp_encapsulate(u8 **resp, size_t *resp_len, u32 avp_code,
119 int mandatory)
120 {
121 u8 *avp, *pos;
122
123 avp = malloc(sizeof(struct ttls_avp) + *resp_len + 4);
124 if (avp == NULL) {
125 free(*resp);
126 *resp_len = 0;
127 return -1;
128 }
129
130 pos = eap_ttls_avp_hdr(avp, avp_code, 0, mandatory, *resp_len);
131 memcpy(pos, *resp, *resp_len);
132 pos += *resp_len;
133 AVP_PAD(avp, pos);
134 free(*resp);
135 *resp = avp;
136 *resp_len = pos - avp;
137 return 0;
138 }
139
140
141 struct eap_ttls_avp {
142 /* Note: eap is allocated memory; caller is responsible for freeing
143 * it. All the other pointers are pointing to the packet data, i.e.,
144 * they must not be freed separately. */
145 u8 *eap;
146 size_t eap_len;
147 u8 *user_name;
148 size_t user_name_len;
149 u8 *user_password;
150 size_t user_password_len;
151 u8 *chap_challenge;
152 size_t chap_challenge_len;
153 u8 *chap_password;
154 size_t chap_password_len;
155 u8 *mschap_challenge;
156 size_t mschap_challenge_len;
157 u8 *mschap_response;
158 size_t mschap_response_len;
159 u8 *mschap2_response;
160 size_t mschap2_response_len;
161 };
162
163
164 static int eap_ttls_avp_parse(u8 *buf, size_t len, struct eap_ttls_avp *parse)
165 {
166 struct ttls_avp *avp;
167 u8 *pos;
168 int left;
169
170 pos = buf;
171 left = len;
172 memset(parse, 0, sizeof(*parse));
173
174 while (left > 0) {
175 u32 avp_code, avp_length, vendor_id = 0;
176 u8 avp_flags, *dpos;
177 size_t pad, dlen;
178 avp = (struct ttls_avp *) pos;
179 avp_code = be_to_host32(avp->avp_code);
180 avp_length = be_to_host32(avp->avp_length);
181 avp_flags = (avp_length >> 24) & 0xff;
182 avp_length &= 0xffffff;
183 wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP: code=%d flags=0x%02x "
184 "length=%d", (int) avp_code, avp_flags,
185 (int) avp_length);
186 if ((int) avp_length > left) {
187 wpa_printf(MSG_WARNING, "EAP-TTLS: AVP overflow "
188 "(len=%d, left=%d) - dropped",
189 (int) avp_length, left);
190 goto fail;
191 }
192 if (avp_length < sizeof(*avp)) {
193 wpa_printf(MSG_WARNING, "EAP-TTLS: Invalid AVP length "
194 "%d", avp_length);
195 goto fail;
196 }
197 dpos = (u8 *) (avp + 1);
198 dlen = avp_length - sizeof(*avp);
199 if (avp_flags & AVP_FLAGS_VENDOR) {
200 if (dlen < 4) {
201 wpa_printf(MSG_WARNING, "EAP-TTLS: vendor AVP "
202 "underflow");
203 goto fail;
204 }
205 vendor_id = be_to_host32(* (u32 *) dpos);
206 wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP vendor_id %d",
207 (int) vendor_id);
208 dpos += 4;
209 dlen -= 4;
210 }
211
212 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: AVP data", dpos, dlen);
213
214 if (vendor_id == 0 && avp_code == RADIUS_ATTR_EAP_MESSAGE) {
215 wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP - EAP Message");
216 if (parse->eap == NULL) {
217 parse->eap = malloc(dlen);
218 if (parse->eap == NULL) {
219 wpa_printf(MSG_WARNING, "EAP-TTLS: "
220 "failed to allocate memory "
221 "for Phase 2 EAP data");
222 goto fail;
223 }
224 memcpy(parse->eap, dpos, dlen);
225 parse->eap_len = dlen;
226 } else {
227 u8 *neweap = realloc(parse->eap,
228 parse->eap_len + dlen);
229 if (neweap == NULL) {
230 wpa_printf(MSG_WARNING, "EAP-TTLS: "
231 "failed to allocate memory "
232 "for Phase 2 EAP data");
233 goto fail;
234 }
235 memcpy(neweap + parse->eap_len, dpos, dlen);
236 parse->eap = neweap;
237 parse->eap_len += dlen;
238 }
239 } else if (vendor_id == 0 &&
240 avp_code == RADIUS_ATTR_USER_NAME) {
241 wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: User-Name",
242 dpos, dlen);
243 parse->user_name = dpos;
244 parse->user_name_len = dlen;
245 } else if (vendor_id == 0 &&
246 avp_code == RADIUS_ATTR_USER_PASSWORD) {
247 u8 *password = dpos;
248 size_t password_len = dlen;
249 while (password_len > 0 &&
250 password[password_len - 1] == '\0') {
251 password_len--;
252 }
253 wpa_hexdump_ascii_key(MSG_DEBUG, "EAP-TTLS: "
254 "User-Password (PAP)",
255 password, password_len);
256 parse->user_password = password;
257 parse->user_password_len = password_len;
258 } else if (vendor_id == 0 &&
259 avp_code == RADIUS_ATTR_CHAP_CHALLENGE) {
260 wpa_hexdump(MSG_DEBUG,
261 "EAP-TTLS: CHAP-Challenge (CHAP)",
262 dpos, dlen);
263 parse->chap_challenge = dpos;
264 parse->chap_challenge_len = dlen;
265 } else if (vendor_id == 0 &&
266 avp_code == RADIUS_ATTR_CHAP_PASSWORD) {
267 wpa_hexdump(MSG_DEBUG,
268 "EAP-TTLS: CHAP-Password (CHAP)",
269 dpos, dlen);
270 parse->chap_password = dpos;
271 parse->chap_password_len = dlen;
272 } else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT &&
273 avp_code == RADIUS_ATTR_MS_CHAP_CHALLENGE) {
274 wpa_hexdump(MSG_DEBUG,
275 "EAP-TTLS: MS-CHAP-Challenge",
276 dpos, dlen);
277 parse->mschap_challenge = dpos;
278 parse->mschap_challenge_len = dlen;
279 } else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT &&
280 avp_code == RADIUS_ATTR_MS_CHAP_RESPONSE) {
281 wpa_hexdump(MSG_DEBUG,
282 "EAP-TTLS: MS-CHAP-Response (MSCHAP)",
283 dpos, dlen);
284 parse->mschap_response = dpos;
285 parse->mschap_response_len = dlen;
286 } else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT &&
287 avp_code == RADIUS_ATTR_MS_CHAP2_RESPONSE) {
288 wpa_hexdump(MSG_DEBUG,
289 "EAP-TTLS: MS-CHAP2-Response (MSCHAPV2)",
290 dpos, dlen);
291 parse->mschap2_response = dpos;
292 parse->mschap2_response_len = dlen;
293 } else if (avp_flags & AVP_FLAGS_MANDATORY) {
294 wpa_printf(MSG_WARNING, "EAP-TTLS: Unsupported "
295 "mandatory AVP code %d vendor_id %d - "
296 "dropped", (int) avp_code, (int) vendor_id);
297 goto fail;
298 } else {
299 wpa_printf(MSG_DEBUG, "EAP-TTLS: Ignoring unsupported "
300 "AVP code %d vendor_id %d",
301 (int) avp_code, (int) vendor_id);
302 }
303
304 pad = (4 - (avp_length & 3)) & 3;
305 pos += avp_length + pad;
306 left -= avp_length + pad;
307 }
308
309 return 0;
310
311 fail:
312 free(parse->eap);
313 parse->eap = NULL;
314 return -1;
315 }
316
317
318 static u8 * eap_ttls_implicit_challenge(struct eap_sm *sm,
319 struct eap_ttls_data *data, size_t len)
320 {
321 struct tls_keys keys;
322 u8 *challenge, *rnd;
323
324 if (data->ttls_version == 0) {
325 return eap_tls_derive_key(sm, &data->ssl, "ttls challenge",
326 len);
327 }
328
329 memset(&keys, 0, sizeof(keys));
330 if (tls_connection_get_keys(sm->ssl_ctx, data->ssl.conn, &keys) ||
331 keys.client_random == NULL || keys.server_random == NULL ||
332 keys.inner_secret == NULL) {
333 wpa_printf(MSG_INFO, "EAP-TTLS: Could not get inner secret, "
334 "client random, or server random to derive "
335 "implicit challenge");
336 return NULL;
337 }
338
339 rnd = malloc(keys.client_random_len + keys.server_random_len);
340 challenge = malloc(len);
341 if (rnd == NULL || challenge == NULL) {
342 wpa_printf(MSG_INFO, "EAP-TTLS: No memory for implicit "
343 "challenge derivation");
344 free(rnd);
345 free(challenge);
346 return NULL;
347 }
348 memcpy(rnd, keys.server_random, keys.server_random_len);
349 memcpy(rnd + keys.server_random_len, keys.client_random,
350 keys.client_random_len);
351
352 if (tls_prf(keys.inner_secret, keys.inner_secret_len,
353 "inner application challenge", rnd,
354 keys.client_random_len + keys.server_random_len,
355 challenge, len)) {
356 wpa_printf(MSG_DEBUG, "EAP-TTLS: Failed to derive implicit "
357 "challenge");
358 free(rnd);
359 free(challenge);
360 return NULL;
361 }
362
363 free(rnd);
364
365 wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived implicit challenge",
366 challenge, len);
367
368 return challenge;
369 }
370
371
372 static void * eap_ttls_init(struct eap_sm *sm)
373 {
374 struct eap_ttls_data *data;
375
376 data = wpa_zalloc(sizeof(*data));
377 if (data == NULL)
378 return NULL;
379 data->ttls_version = EAP_TTLS_VERSION;
380 data->force_version = -1;
381 if (sm->user && sm->user->force_version >= 0) {
382 data->force_version = sm->user->force_version;
383 wpa_printf(MSG_DEBUG, "EAP-TTLS: forcing version %d",
384 data->force_version);
385 data->ttls_version = data->force_version;
386 }
387 data->state = START;
388
389 if (!(tls_capabilities(sm->ssl_ctx) & TLS_CAPABILITY_IA) &&
390 data->ttls_version > 0) {
391 if (data->force_version > 0) {
392 wpa_printf(MSG_INFO, "EAP-TTLS: Forced TTLSv%d and "
393 "TLS library does not support TLS/IA.",
394 data->force_version);
395 eap_ttls_reset(sm, data);
396 return NULL;
397 }
398 data->ttls_version = 0;
399 }
400
401 if (eap_tls_ssl_init(sm, &data->ssl, 0)) {
402 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to initialize SSL.");
403 eap_ttls_reset(sm, data);
404 return NULL;
405 }
406
407 return data;
408 }
409
410
411 static void eap_ttls_reset(struct eap_sm *sm, void *priv)
412 {
413 struct eap_ttls_data *data = priv;
414 if (data == NULL)
415 return;
416 if (data->phase2_priv && data->phase2_method)
417 data->phase2_method->reset(sm, data->phase2_priv);
418 eap_tls_ssl_deinit(sm, &data->ssl);
419 free(data);
420 }
421
422
423 static u8 * eap_ttls_build_start(struct eap_sm *sm, struct eap_ttls_data *data,
424 int id, size_t *reqDataLen)
425 {
426 struct eap_hdr *req;
427 u8 *pos;
428
429 *reqDataLen = sizeof(*req) + 2;
430 req = malloc(*reqDataLen);
431 if (req == NULL) {
432 wpa_printf(MSG_ERROR, "EAP-TTLS: Failed to allocate memory for"
433 " request");
434 eap_ttls_state(data, FAILURE);
435 return NULL;
436 }
437
438 req->code = EAP_CODE_REQUEST;
439 req->identifier = id;
440 req->length = htons(*reqDataLen);
441 pos = (u8 *) (req + 1);
442 *pos++ = EAP_TYPE_TTLS;
443 *pos = EAP_TLS_FLAGS_START | data->ttls_version;
444
445 eap_ttls_state(data, PHASE1);
446
447 return (u8 *) req;
448 }
449
450
451 static u8 * eap_ttls_build_req(struct eap_sm *sm, struct eap_ttls_data *data,
452 int id, size_t *reqDataLen)
453 {
454 int res;
455 u8 *req;
456
457 res = eap_tls_buildReq_helper(sm, &data->ssl, EAP_TYPE_TTLS,
458 data->ttls_version, id, &req,
459 reqDataLen);
460
461 if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) {
462 wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase1 done, starting "
463 "Phase2");
464 eap_ttls_state(data, PHASE2_START);
465 }
466
467 if (res == 1)
468 return eap_tls_build_ack(reqDataLen, id, EAP_TYPE_TTLS,
469 data->ttls_version);
470 return req;
471 }
472
473
474 static u8 * eap_ttls_encrypt(struct eap_sm *sm, struct eap_ttls_data *data,
475 int id, u8 *plain, size_t plain_len,
476 size_t *out_len)
477 {
478 int res;
479 u8 *pos;
480 struct eap_hdr *req;
481
482 /* TODO: add support for fragmentation, if needed. This will need to
483 * add TLS Message Length field, if the frame is fragmented. */
484 req = malloc(sizeof(struct eap_hdr) + 2 + data->ssl.tls_out_limit);
485 if (req == NULL)
486 return NULL;
487
488 req->code = EAP_CODE_REQUEST;
489 req->identifier = id;
490
491 pos = (u8 *) (req + 1);
492 *pos++ = EAP_TYPE_TTLS;
493 *pos++ = data->ttls_version;
494
495 res = tls_connection_encrypt(sm->ssl_ctx, data->ssl.conn,
496 plain, plain_len,
497 pos, data->ssl.tls_out_limit);
498 if (res < 0) {
499 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to encrypt Phase 2 "
500 "data");
501 free(req);
502 return NULL;
503 }
504
505 *out_len = sizeof(struct eap_hdr) + 2 + res;
506 req->length = host_to_be16(*out_len);
507 return (u8 *) req;
508 }
509
510
511 static u8 * eap_ttls_build_phase2_eap_req(struct eap_sm *sm,
512 struct eap_ttls_data *data,
513 int id, size_t *reqDataLen)
514 {
515 u8 *req, *encr_req;
516 size_t req_len;
517
518
519 req = data->phase2_method->buildReq(sm, data->phase2_priv, id,
520 &req_len);
521 if (req == NULL)
522 return NULL;
523
524 wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS/EAP: Encapsulate Phase 2 data",
525 req, req_len);
526
527 if (eap_ttls_avp_encapsulate(&req, &req_len, RADIUS_ATTR_EAP_MESSAGE,
528 1) < 0) {
529 wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: Failed to encapsulate "
530 "packet");
531 return NULL;
532 }
533
534 wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS/EAP: Encrypt encapsulated Phase "
535 "2 data", req, req_len);
536
537 encr_req = eap_ttls_encrypt(sm, data, id, req, req_len, reqDataLen);
538 free(req);
539
540 return encr_req;
541 }
542
543
544 static u8 * eap_ttls_build_phase2_mschapv2(struct eap_sm *sm,
545 struct eap_ttls_data *data,
546 int id, size_t *reqDataLen)
547 {
548 u8 *req, *encr_req, *pos, *end;
549 int ret;
550 size_t req_len;
551
552 pos = req = malloc(100);
553 if (req == NULL)
554 return NULL;
555 end = req + 100;
556
557 if (data->mschapv2_resp_ok) {
558 pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP2_SUCCESS,
559 RADIUS_VENDOR_ID_MICROSOFT, 1, 43);
560 *pos++ = data->mschapv2_ident;
561 ret = snprintf((char *) pos, end - pos, "S=");
562 if (ret >= 0 && ret < end - pos)
563 pos += ret;
564 pos += wpa_snprintf_hex_uppercase(
565 (char *) pos, end - pos, data->mschapv2_auth_response,
566 sizeof(data->mschapv2_auth_response));
567 } else {
568 pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP_ERROR,
569 RADIUS_VENDOR_ID_MICROSOFT, 1, 6);
570 memcpy(pos, "Failed", 6);
571 pos += 6;
572 AVP_PAD(req, pos);
573 }
574
575 req_len = pos - req;
576 wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Encrypting Phase 2 "
577 "data", req, req_len);
578
579 encr_req = eap_ttls_encrypt(sm, data, id, req, req_len, reqDataLen);
580 free(req);
581
582 return encr_req;
583 }
584
585
586 static u8 * eap_ttls_build_phase_finished(struct eap_sm *sm,
587 struct eap_ttls_data *data,
588 int id, int final,
589 size_t *reqDataLen)
590 {
591 int len;
592 struct eap_hdr *req;
593 u8 *pos;
594 const int max_len = 300;
595
596 len = sizeof(struct eap_hdr) + 2 + max_len;
597 req = malloc(len);
598 if (req == NULL)
599 return NULL;
600
601 req->code = EAP_CODE_REQUEST;
602 req->identifier = id;
603
604 pos = (u8 *) (req + 1);
605 *pos++ = EAP_TYPE_TTLS;
606 *pos++ = data->ttls_version;
607
608 len = tls_connection_ia_send_phase_finished(sm->ssl_ctx,
609 data->ssl.conn,
610 final, pos, max_len);
611 if (len < 0) {
612 free(req);
613 return NULL;
614 }
615
616 *reqDataLen = sizeof(struct eap_hdr) + 2 + len;
617 req->length = host_to_be16(*reqDataLen);
618
619 return (u8 *) req;
620 }
621
622
623 static u8 * eap_ttls_buildReq(struct eap_sm *sm, void *priv, int id,
624 size_t *reqDataLen)
625 {
626 struct eap_ttls_data *data = priv;
627
628 switch (data->state) {
629 case START:
630 return eap_ttls_build_start(sm, data, id, reqDataLen);
631 case PHASE1:
632 return eap_ttls_build_req(sm, data, id, reqDataLen);
633 case PHASE2_METHOD:
634 return eap_ttls_build_phase2_eap_req(sm, data, id, reqDataLen);
635 case PHASE2_MSCHAPV2_RESP:
636 return eap_ttls_build_phase2_mschapv2(sm, data, id,
637 reqDataLen);
638 case PHASE_FINISHED:
639 return eap_ttls_build_phase_finished(sm, data, id, 1,
640 reqDataLen);
641 default:
642 wpa_printf(MSG_DEBUG, "EAP-TTLS: %s - unexpected state %d",
643 __func__, data->state);
644 return NULL;
645 }
646 }
647
648
649 static Boolean eap_ttls_check(struct eap_sm *sm, void *priv,
650 u8 *respData, size_t respDataLen)
651 {
652 struct eap_hdr *resp;
653 u8 *pos;
654
655 resp = (struct eap_hdr *) respData;
656 pos = (u8 *) (resp + 1);
657 if (respDataLen < sizeof(*resp) + 2 || *pos != EAP_TYPE_TTLS ||
658 (ntohs(resp->length)) > respDataLen) {
659 wpa_printf(MSG_INFO, "EAP-TTLS: Invalid frame");
660 return TRUE;
661 }
662
663 return FALSE;
664 }
665
666
667 static int eap_ttls_ia_permute_inner_secret(struct eap_sm *sm,
668 struct eap_ttls_data *data,
669 const u8 *key, size_t key_len)
670 {
671 u8 *buf;
672 size_t buf_len;
673 int ret;
674
675 if (key) {
676 buf_len = 2 + key_len;
677 buf = malloc(buf_len);
678 if (buf == NULL)
679 return -1;
680 WPA_PUT_BE16(buf, key_len);
681 memcpy(buf + 2, key, key_len);
682 } else {
683 buf = NULL;
684 buf_len = 0;
685 }
686
687 wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Session keys for TLS/IA inner "
688 "secret permutation", buf, buf_len);
689 ret = tls_connection_ia_permute_inner_secret(sm->ssl_ctx,
690 data->ssl.conn,
691 buf, buf_len);
692 free(buf);
693
694 return ret;
695 }
696
697
698 static void eap_ttls_process_phase2_pap(struct eap_sm *sm,
699 struct eap_ttls_data *data,
700 const u8 *user_password,
701 size_t user_password_len)
702 {
703 /* TODO: add support for verifying that the user entry accepts
704 * EAP-TTLS/PAP. */
705 if (!sm->user || !sm->user->password || sm->user->password_hash) {
706 wpa_printf(MSG_DEBUG, "EAP-TTLS/PAP: No plaintext user "
707 "password configured");
708 eap_ttls_state(data, FAILURE);
709 return;
710 }
711
712 if (sm->user->password_len != user_password_len ||
713 memcmp(sm->user->password, user_password, user_password_len) != 0)
714 {
715 wpa_printf(MSG_DEBUG, "EAP-TTLS/PAP: Invalid user password");
716 eap_ttls_state(data, FAILURE);
717 return;
718 }
719
720 wpa_printf(MSG_DEBUG, "EAP-TTLS/PAP: Correct user password");
721 eap_ttls_state(data, data->ttls_version > 0 ? PHASE_FINISHED :
722 SUCCESS);
723 }
724
725
726 static void eap_ttls_process_phase2_chap(struct eap_sm *sm,
727 struct eap_ttls_data *data,
728 const u8 *challenge,
729 size_t challenge_len,
730 const u8 *password,
731 size_t password_len)
732 {
733 u8 *chal, hash[MD5_MAC_LEN];
734 const u8 *addr[3];
735 size_t len[3];
736
737 if (challenge == NULL || password == NULL ||
738 challenge_len != EAP_TTLS_CHAP_CHALLENGE_LEN ||
739 password_len != 1 + EAP_TTLS_CHAP_PASSWORD_LEN) {
740 wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP: Invalid CHAP attributes "
741 "(challenge len %lu password len %lu)",
742 (unsigned long) challenge_len,
743 (unsigned long) password_len);
744 eap_ttls_state(data, FAILURE);
745 return;
746 }
747
748 /* TODO: add support for verifying that the user entry accepts
749 * EAP-TTLS/CHAP. */
750 if (!sm->user || !sm->user->password || sm->user->password_hash) {
751 wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP: No plaintext user "
752 "password configured");
753 eap_ttls_state(data, FAILURE);
754 return;
755 }
756
757 chal = eap_ttls_implicit_challenge(sm, data,
758 EAP_TTLS_CHAP_CHALLENGE_LEN + 1);
759 if (chal == NULL) {
760 wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP: Failed to generate "
761 "challenge from TLS data");
762 eap_ttls_state(data, FAILURE);
763 return;
764 }
765
766 if (memcmp(challenge, chal, EAP_TTLS_CHAP_CHALLENGE_LEN) != 0 ||
767 password[0] != chal[EAP_TTLS_CHAP_CHALLENGE_LEN]) {
768 wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP: Challenge mismatch");
769 free(chal);
770 eap_ttls_state(data, FAILURE);
771 return;
772 }
773 free(chal);
774
775 /* MD5(Ident + Password + Challenge) */
776 addr[0] = password;
777 len[0] = 1;
778 addr[1] = sm->user->password;
779 len[1] = sm->user->password_len;
780 addr[2] = challenge;
781 len[2] = challenge_len;
782 md5_vector(3, addr, len, hash);
783
784 if (memcmp(hash, password + 1, EAP_TTLS_CHAP_PASSWORD_LEN) == 0) {
785 wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP: Correct user password");
786 eap_ttls_state(data, data->ttls_version > 0 ? PHASE_FINISHED :
787 SUCCESS);
788 } else {
789 wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP: Invalid user password");
790 eap_ttls_state(data, FAILURE);
791 }
792 }
793
794
795 static void eap_ttls_process_phase2_mschap(struct eap_sm *sm,
796 struct eap_ttls_data *data,
797 u8 *challenge, size_t challenge_len,
798 u8 *response, size_t response_len)
799 {
800 u8 *chal, nt_response[24];
801
802 if (challenge == NULL || response == NULL ||
803 challenge_len != EAP_TTLS_MSCHAP_CHALLENGE_LEN ||
804 response_len != EAP_TTLS_MSCHAP_RESPONSE_LEN) {
805 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP: Invalid MS-CHAP "
806 "attributes (challenge len %lu response len %lu)",
807 (unsigned long) challenge_len,
808 (unsigned long) response_len);
809 eap_ttls_state(data, FAILURE);
810 return;
811 }
812
813 /* TODO: add support for verifying that the user entry accepts
814 * EAP-TTLS/MSCHAP. */
815 if (!sm->user || !sm->user->password) {
816 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP: No user password "
817 "configured");
818 eap_ttls_state(data, FAILURE);
819 return;
820 }
821
822 chal = eap_ttls_implicit_challenge(sm, data,
823 EAP_TTLS_MSCHAP_CHALLENGE_LEN + 1);
824 if (chal == NULL) {
825 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP: Failed to generate "
826 "challenge from TLS data");
827 eap_ttls_state(data, FAILURE);
828 return;
829 }
830
831 if (memcmp(challenge, chal, EAP_TTLS_MSCHAP_CHALLENGE_LEN) != 0 ||
832 response[0] != chal[EAP_TTLS_MSCHAP_CHALLENGE_LEN]) {
833 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP: Challenge mismatch");
834 free(chal);
835 eap_ttls_state(data, FAILURE);
836 return;
837 }
838 free(chal);
839
840 if (sm->user->password_hash)
841 challenge_response(challenge, sm->user->password, nt_response);
842 else
843 nt_challenge_response(challenge, sm->user->password,
844 sm->user->password_len, nt_response);
845
846 if (memcmp(nt_response, response + 2 + 24, 24) == 0) {
847 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP: Correct response");
848 eap_ttls_state(data, data->ttls_version > 0 ? PHASE_FINISHED :
849 SUCCESS);
850 } else {
851 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP: Invalid NT-Response");
852 wpa_hexdump(MSG_MSGDUMP, "EAP-TTLS/MSCHAP: Received",
853 response + 2 + 24, 24);
854 wpa_hexdump(MSG_MSGDUMP, "EAP-TTLS/MSCHAP: Expected",
855 nt_response, 24);
856 eap_ttls_state(data, FAILURE);
857 }
858 }
859
860
861 static void eap_ttls_process_phase2_mschapv2(struct eap_sm *sm,
862 struct eap_ttls_data *data,
863 u8 *challenge,
864 size_t challenge_len,
865 u8 *response, size_t response_len)
866 {
867 u8 *chal, *username, nt_response[24], *rx_resp, *peer_challenge,
868 *auth_challenge;
869 size_t username_len, i;
870
871 if (challenge == NULL || response == NULL ||
872 challenge_len != EAP_TTLS_MSCHAPV2_CHALLENGE_LEN ||
873 response_len != EAP_TTLS_MSCHAPV2_RESPONSE_LEN) {
874 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Invalid MS-CHAP2 "
875 "attributes (challenge len %lu response len %lu)",
876 (unsigned long) challenge_len,
877 (unsigned long) response_len);
878 eap_ttls_state(data, FAILURE);
879 return;
880 }
881
882 /* TODO: add support for verifying that the user entry accepts
883 * EAP-TTLS/MSCHAPV2. */
884 if (!sm->user || !sm->user->password) {
885 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: No user password "
886 "configured");
887 eap_ttls_state(data, FAILURE);
888 return;
889 }
890
891 /* MSCHAPv2 does not include optional domain name in the
892 * challenge-response calculation, so remove domain prefix
893 * (if present). */
894 username = sm->identity;
895 username_len = sm->identity_len;
896 for (i = 0; i < username_len; i++) {
897 if (username[i] == '\\') {
898 username_len -= i + 1;
899 username += i + 1;
900 break;
901 }
902 }
903
904 chal = eap_ttls_implicit_challenge(
905 sm, data, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN + 1);
906 if (chal == NULL) {
907 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Failed to generate "
908 "challenge from TLS data");
909 eap_ttls_state(data, FAILURE);
910 return;
911 }
912
913 if (memcmp(challenge, chal, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN) != 0 ||
914 response[0] != chal[EAP_TTLS_MSCHAPV2_CHALLENGE_LEN]) {
915 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Challenge mismatch");
916 free(chal);
917 eap_ttls_state(data, FAILURE);
918 return;
919 }
920 free(chal);
921
922 auth_challenge = challenge;
923 peer_challenge = response + 2;
924
925 wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-TTLS/MSCHAPV2: User",
926 username, username_len);
927 wpa_hexdump(MSG_MSGDUMP, "EAP-TTLS/MSCHAPV2: auth_challenge",
928 auth_challenge, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN);
929 wpa_hexdump(MSG_MSGDUMP, "EAP-TTLS/MSCHAPV2: peer_challenge",
930 peer_challenge, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN);
931
932 if (sm->user->password_hash) {
933 generate_nt_response_pwhash(auth_challenge, peer_challenge,
934 username, username_len,
935 sm->user->password,
936 nt_response);
937 } else {
938 generate_nt_response(auth_challenge, peer_challenge,
939 username, username_len,
940 sm->user->password,
941 sm->user->password_len,
942 nt_response);
943 }
944
945 rx_resp = response + 2 + EAP_TTLS_MSCHAPV2_CHALLENGE_LEN + 8;
946 if (memcmp(nt_response, rx_resp, 24) == 0) {
947 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Correct "
948 "NT-Response");
949 data->mschapv2_resp_ok = 1;
950 if (data->ttls_version > 0) {
951 const u8 *pw_hash;
952 u8 pw_hash_buf[16], pw_hash_hash[16], master_key[16];
953 u8 session_key[2 * MSCHAPV2_KEY_LEN];
954
955 if (sm->user->password_hash)
956 pw_hash = sm->user->password;
957 else {
958 nt_password_hash(sm->user->password,
959 sm->user->password_len,
960 pw_hash_buf);
961 pw_hash = pw_hash_buf;
962 }
963 hash_nt_password_hash(pw_hash, pw_hash_hash);
964 get_master_key(pw_hash_hash, nt_response, master_key);
965 get_asymetric_start_key(master_key, session_key,
966 MSCHAPV2_KEY_LEN, 0, 0);
967 get_asymetric_start_key(master_key,
968 session_key + MSCHAPV2_KEY_LEN,
969 MSCHAPV2_KEY_LEN, 1, 0);
970 eap_ttls_ia_permute_inner_secret(sm, data,
971 session_key,
972 sizeof(session_key));
973 }
974
975 if (sm->user->password_hash) {
976 generate_authenticator_response_pwhash(
977 sm->user->password,
978 peer_challenge, auth_challenge,
979 username, username_len, nt_response,
980 data->mschapv2_auth_response);
981 } else {
982 generate_authenticator_response(
983 sm->user->password, sm->user->password_len,
984 peer_challenge, auth_challenge,
985 username, username_len, nt_response,
986 data->mschapv2_auth_response);
987 }
988 } else {
989 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Invalid "
990 "NT-Response");
991 wpa_hexdump(MSG_MSGDUMP, "EAP-TTLS/MSCHAPV2: Received",
992 rx_resp, 24);
993 wpa_hexdump(MSG_MSGDUMP, "EAP-TTLS/MSCHAPV2: Expected",
994 nt_response, 24);
995 data->mschapv2_resp_ok = 0;
996 }
997 eap_ttls_state(data, PHASE2_MSCHAPV2_RESP);
998 data->mschapv2_ident = response[0];
999 }
1000
1001
1002 static int eap_ttls_phase2_eap_init(struct eap_sm *sm,
1003 struct eap_ttls_data *data,
1004 EapType eap_type)
1005 {
1006 if (data->phase2_priv && data->phase2_method) {
1007 data->phase2_method->reset(sm, data->phase2_priv);
1008 data->phase2_method = NULL;
1009 data->phase2_priv = NULL;
1010 }
1011 data->phase2_method = eap_sm_get_eap_methods(EAP_VENDOR_IETF,
1012 eap_type);
1013 if (!data->phase2_method)
1014 return -1;
1015
1016 sm->init_phase2 = 1;
1017 data->phase2_priv = data->phase2_method->init(sm);
1018 sm->init_phase2 = 0;
1019 return 0;
1020 }
1021
1022
1023 static void eap_ttls_process_phase2_eap_response(struct eap_sm *sm,
1024 struct eap_ttls_data *data,
1025 u8 *in_data, size_t in_len)
1026 {
1027 u8 next_type = EAP_TYPE_NONE;
1028 struct eap_hdr *hdr;
1029 u8 *pos;
1030 size_t left;
1031 const struct eap_method *m = data->phase2_method;
1032 void *priv = data->phase2_priv;
1033
1034 if (data->phase2_priv == NULL) {
1035 wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: %s - Phase2 not "
1036 "initialized?!", __func__);
1037 return;
1038 }
1039
1040 hdr = (struct eap_hdr *) in_data;
1041 pos = (u8 *) (hdr + 1);
1042
1043 if (in_len > sizeof(*hdr) && *pos == EAP_TYPE_NAK) {
1044 left = in_len - sizeof(*hdr);
1045 wpa_hexdump(MSG_DEBUG, "EAP-TTLS/EAP: Phase2 type Nak'ed; "
1046 "allowed types", pos + 1, left - 1);
1047 eap_sm_process_nak(sm, pos + 1, left - 1);
1048 if (sm->user && sm->user_eap_method_index < EAP_MAX_METHODS &&
1049 sm->user->methods[sm->user_eap_method_index].method !=
1050 EAP_TYPE_NONE) {
1051 next_type = sm->user->methods[
1052 sm->user_eap_method_index++].method;
1053 wpa_printf(MSG_DEBUG, "EAP-TTLS: try EAP type %d",
1054 next_type);
1055 eap_ttls_phase2_eap_init(sm, data, next_type);
1056 } else {
1057 eap_ttls_state(data, FAILURE);
1058 }
1059 return;
1060 }
1061
1062 if (m->check(sm, priv, in_data, in_len)) {
1063 wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: Phase2 check() asked to "
1064 "ignore the packet");
1065 return;
1066 }
1067
1068 m->process(sm, priv, in_data, in_len);
1069
1070 if (!m->isDone(sm, priv))
1071 return;
1072
1073 if (!m->isSuccess(sm, priv)) {
1074 wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: Phase2 method failed");
1075 eap_ttls_state(data, FAILURE);
1076 return;
1077 }
1078
1079 switch (data->state) {
1080 case PHASE2_START:
1081 if (eap_user_get(sm, sm->identity, sm->identity_len, 1) != 0) {
1082 wpa_hexdump_ascii(MSG_DEBUG, "EAP_TTLS: Phase2 "
1083 "Identity not found in the user "
1084 "database",
1085 sm->identity, sm->identity_len);
1086 eap_ttls_state(data, FAILURE);
1087 break;
1088 }
1089
1090 eap_ttls_state(data, PHASE2_METHOD);
1091 next_type = sm->user->methods[0].method;
1092 sm->user_eap_method_index = 1;
1093 wpa_printf(MSG_DEBUG, "EAP-TTLS: try EAP type %d", next_type);
1094 break;
1095 case PHASE2_METHOD:
1096 if (data->ttls_version > 0) {
1097 if (m->getKey) {
1098 u8 *key;
1099 size_t key_len;
1100 key = m->getKey(sm, priv, &key_len);
1101 eap_ttls_ia_permute_inner_secret(sm, data,
1102 key, key_len);
1103 }
1104 eap_ttls_state(data, PHASE_FINISHED);
1105 } else
1106 eap_ttls_state(data, SUCCESS);
1107 break;
1108 case FAILURE:
1109 break;
1110 default:
1111 wpa_printf(MSG_DEBUG, "EAP-TTLS: %s - unexpected state %d",
1112 __func__, data->state);
1113 break;
1114 }
1115
1116 eap_ttls_phase2_eap_init(sm, data, next_type);
1117 }
1118
1119
1120 static void eap_ttls_process_phase2_eap(struct eap_sm *sm,
1121 struct eap_ttls_data *data,
1122 const u8 *eap, size_t eap_len)
1123 {
1124 struct eap_hdr *hdr;
1125 size_t len;
1126
1127 if (data->state == PHASE2_START) {
1128 wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: initializing Phase 2");
1129 if (eap_ttls_phase2_eap_init(sm, data, EAP_TYPE_IDENTITY) < 0)
1130 {
1131 wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: failed to "
1132 "initialize EAP-Identity");
1133 return;
1134 }
1135 }
1136
1137 if (eap_len < sizeof(*hdr)) {
1138 wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: too short Phase 2 EAP "
1139 "packet (len=%lu)", (unsigned long) eap_len);
1140 return;
1141 }
1142
1143 hdr = (struct eap_hdr *) eap;
1144 len = be_to_host16(hdr->length);
1145 wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: received Phase 2 EAP: code=%d "
1146 "identifier=%d length=%lu", hdr->code, hdr->identifier,
1147 (unsigned long) len);
1148 if (len > eap_len) {
1149 wpa_printf(MSG_INFO, "EAP-TTLS/EAP: Length mismatch in Phase 2"
1150 " EAP frame (hdr len=%lu, data len in AVP=%lu)",
1151 (unsigned long) len, (unsigned long) eap_len);
1152 return;
1153 }
1154
1155 switch (hdr->code) {
1156 case EAP_CODE_RESPONSE:
1157 eap_ttls_process_phase2_eap_response(sm, data, (u8 *) hdr,
1158 len);
1159 break;
1160 default:
1161 wpa_printf(MSG_INFO, "EAP-TTLS/EAP: Unexpected code=%d in "
1162 "Phase 2 EAP header", hdr->code);
1163 break;
1164 }
1165 }
1166
1167
1168 static void eap_ttls_process_phase2(struct eap_sm *sm,
1169 struct eap_ttls_data *data,
1170 struct eap_hdr *resp,
1171 u8 *in_data, size_t in_len)
1172 {
1173 u8 *in_decrypted;
1174 int len_decrypted, res;
1175 struct eap_ttls_avp parse;
1176 size_t buf_len;
1177
1178 wpa_printf(MSG_DEBUG, "EAP-TTLS: received %lu bytes encrypted data for"
1179 " Phase 2", (unsigned long) in_len);
1180
1181 res = eap_tls_data_reassemble(sm, &data->ssl, &in_data, &in_len);
1182 if (res < 0 || res == 1)
1183 return;
1184
1185 buf_len = in_len;
1186 if (data->ssl.tls_in_total > buf_len)
1187 buf_len = data->ssl.tls_in_total;
1188 in_decrypted = malloc(buf_len);
1189 if (in_decrypted == NULL) {
1190 free(data->ssl.tls_in);
1191 data->ssl.tls_in = NULL;
1192 data->ssl.tls_in_len = 0;
1193 wpa_printf(MSG_WARNING, "EAP-TTLS: failed to allocate memory "
1194 "for decryption");
1195 return;
1196 }
1197
1198 len_decrypted = tls_connection_decrypt(sm->ssl_ctx, data->ssl.conn,
1199 in_data, in_len,
1200 in_decrypted, buf_len);
1201 free(data->ssl.tls_in);
1202 data->ssl.tls_in = NULL;
1203 data->ssl.tls_in_len = 0;
1204 if (len_decrypted < 0) {
1205 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to decrypt Phase 2 "
1206 "data");
1207 free(in_decrypted);
1208 eap_ttls_state(data, FAILURE);
1209 return;
1210 }
1211
1212 if (data->state == PHASE_FINISHED) {
1213 if (len_decrypted == 0 &&
1214 tls_connection_ia_final_phase_finished(sm->ssl_ctx,
1215 data->ssl.conn)) {
1216 wpa_printf(MSG_DEBUG, "EAP-TTLS: FinalPhaseFinished "
1217 "received");
1218 eap_ttls_state(data, SUCCESS);
1219 } else {
1220 wpa_printf(MSG_INFO, "EAP-TTLS: Did not receive valid "
1221 "FinalPhaseFinished");
1222 eap_ttls_state(data, FAILURE);
1223 }
1224
1225 free(in_decrypted);
1226 return;
1227 }
1228
1229 wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Decrypted Phase 2 EAP",
1230 in_decrypted, len_decrypted);
1231
1232 if (eap_ttls_avp_parse(in_decrypted, len_decrypted, &parse) < 0) {
1233 wpa_printf(MSG_DEBUG, "EAP-TTLS: Failed to parse AVPs");
1234 free(in_decrypted);
1235 eap_ttls_state(data, FAILURE);
1236 return;
1237 }
1238
1239 if (parse.user_name) {
1240 free(sm->identity);
1241 sm->identity = malloc(parse.user_name_len);
1242 if (sm->identity) {
1243 memcpy(sm->identity, parse.user_name,
1244 parse.user_name_len);
1245 sm->identity_len = parse.user_name_len;
1246 }
1247 if (eap_user_get(sm, parse.user_name, parse.user_name_len, 1)
1248 != 0) {
1249 wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase2 Identity not "
1250 "found in the user database");
1251 eap_ttls_state(data, FAILURE);
1252 goto done;
1253 }
1254 }
1255
1256 if (parse.eap) {
1257 eap_ttls_process_phase2_eap(sm, data, parse.eap,
1258 parse.eap_len);
1259 } else if (parse.user_password) {
1260 eap_ttls_process_phase2_pap(sm, data, parse.user_password,
1261 parse.user_password_len);
1262 } else if (parse.chap_password) {
1263 eap_ttls_process_phase2_chap(sm, data,
1264 parse.chap_challenge,
1265 parse.chap_challenge_len,
1266 parse.chap_password,
1267 parse.chap_password_len);
1268 } else if (parse.mschap_response) {
1269 eap_ttls_process_phase2_mschap(sm, data,
1270 parse.mschap_challenge,
1271 parse.mschap_challenge_len,
1272 parse.mschap_response,
1273 parse.mschap_response_len);
1274 } else if (parse.mschap2_response) {
1275 eap_ttls_process_phase2_mschapv2(sm, data,
1276 parse.mschap_challenge,
1277 parse.mschap_challenge_len,
1278 parse.mschap2_response,
1279 parse.mschap2_response_len);
1280 }
1281
1282 done:
1283 free(in_decrypted);
1284 free(parse.eap);
1285 }
1286
1287
1288 static void eap_ttls_process(struct eap_sm *sm, void *priv,
1289 u8 *respData, size_t respDataLen)
1290 {
1291 struct eap_ttls_data *data = priv;
1292 struct eap_hdr *resp;
1293 u8 *pos, flags;
1294 int left;
1295 unsigned int tls_msg_len;
1296 int peer_version;
1297
1298 resp = (struct eap_hdr *) respData;
1299 pos = (u8 *) (resp + 1);
1300 pos++;
1301 flags = *pos++;
1302 left = htons(resp->length) - sizeof(struct eap_hdr) - 2;
1303 wpa_printf(MSG_DEBUG, "EAP-TTLS: Received packet(len=%lu) - "
1304 "Flags 0x%02x", (unsigned long) respDataLen, flags);
1305 peer_version = flags & EAP_PEAP_VERSION_MASK;
1306 if (peer_version < data->ttls_version) {
1307 wpa_printf(MSG_DEBUG, "EAP-TTLS: peer ver=%d, own ver=%d; "
1308 "use version %d",
1309 peer_version, data->ttls_version, peer_version);
1310 data->ttls_version = peer_version;
1311 }
1312
1313 if (data->ttls_version > 0 && !data->tls_ia_configured) {
1314 if (tls_connection_set_ia(sm->ssl_ctx, data->ssl.conn, 1)) {
1315 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to enable "
1316 "TLS/IA");
1317 eap_ttls_state(data, FAILURE);
1318 return;
1319 }
1320 data->tls_ia_configured = 1;
1321 }
1322
1323 if (flags & EAP_TLS_FLAGS_LENGTH_INCLUDED) {
1324 if (left < 4) {
1325 wpa_printf(MSG_INFO, "EAP-TTLS: Short frame with TLS "
1326 "length");
1327 eap_ttls_state(data, FAILURE);
1328 return;
1329 }
1330 tls_msg_len = (pos[0] << 24) | (pos[1] << 16) | (pos[2] << 8) |
1331 pos[3];
1332 wpa_printf(MSG_DEBUG, "EAP-TTLS: TLS Message Length: %d",
1333 tls_msg_len);
1334 if (data->ssl.tls_in_left == 0) {
1335 data->ssl.tls_in_total = tls_msg_len;
1336 data->ssl.tls_in_left = tls_msg_len;
1337 free(data->ssl.tls_in);
1338 data->ssl.tls_in = NULL;
1339 data->ssl.tls_in_len = 0;
1340 }
1341 pos += 4;
1342 left -= 4;
1343 }
1344
1345 switch (data->state) {
1346 case PHASE1:
1347 if (eap_tls_process_helper(sm, &data->ssl, pos, left) < 0) {
1348 wpa_printf(MSG_INFO, "EAP-TTLS: TLS processing "
1349 "failed");
1350 eap_ttls_state(data, FAILURE);
1351 }
1352 break;
1353 case PHASE2_START:
1354 case PHASE2_METHOD:
1355 case PHASE_FINISHED:
1356 eap_ttls_process_phase2(sm, data, resp, pos, left);
1357 break;
1358 case PHASE2_MSCHAPV2_RESP:
1359 if (data->mschapv2_resp_ok && left == 0) {
1360 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Peer "
1361 "acknowledged response");
1362 eap_ttls_state(data, data->ttls_version > 0 ?
1363 PHASE_FINISHED : SUCCESS);
1364 } else if (!data->mschapv2_resp_ok) {
1365 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Peer "
1366 "acknowledged error");
1367 eap_ttls_state(data, FAILURE);
1368 } else {
1369 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Unexpected "
1370 "frame from peer (payload len %d, expected "
1371 "empty frame)", left);
1372 eap_ttls_state(data, FAILURE);
1373 }
1374 break;
1375 default:
1376 wpa_printf(MSG_DEBUG, "EAP-TTLS: Unexpected state %d in %s",
1377 data->state, __func__);
1378 break;
1379 }
1380
1381 if (tls_connection_get_write_alerts(sm->ssl_ctx, data->ssl.conn) > 1) {
1382 wpa_printf(MSG_INFO, "EAP-TTLS: Locally detected fatal error "
1383 "in TLS processing");
1384 eap_ttls_state(data, FAILURE);
1385 }
1386 }
1387
1388
1389 static Boolean eap_ttls_isDone(struct eap_sm *sm, void *priv)
1390 {
1391 struct eap_ttls_data *data = priv;
1392 return data->state == SUCCESS || data->state == FAILURE;
1393 }
1394
1395
1396 static u8 * eap_ttls_v1_derive_key(struct eap_sm *sm,
1397 struct eap_ttls_data *data)
1398 {
1399 struct tls_keys keys;
1400 u8 *rnd, *key;
1401
1402 memset(&keys, 0, sizeof(keys));
1403 if (tls_connection_get_keys(sm->ssl_ctx, data->ssl.conn, &keys) ||
1404 keys.client_random == NULL || keys.server_random == NULL ||
1405 keys.inner_secret == NULL) {
1406 wpa_printf(MSG_INFO, "EAP-TTLS: Could not get inner secret, "
1407 "client random, or server random to derive keying "
1408 "material");
1409 return NULL;
1410 }
1411
1412 rnd = malloc(keys.client_random_len + keys.server_random_len);
1413 key = malloc(EAP_TLS_KEY_LEN);
1414 if (rnd == NULL || key == NULL) {
1415 wpa_printf(MSG_INFO, "EAP-TTLS: No memory for key derivation");
1416 free(rnd);
1417 free(key);
1418 return NULL;
1419 }
1420 memcpy(rnd, keys.client_random, keys.client_random_len);
1421 memcpy(rnd + keys.client_random_len, keys.server_random,
1422 keys.server_random_len);
1423
1424 if (tls_prf(keys.inner_secret, keys.inner_secret_len,
1425 "ttls v1 keying material", rnd, keys.client_random_len +
1426 keys.server_random_len, key, EAP_TLS_KEY_LEN)) {
1427 wpa_printf(MSG_DEBUG, "EAP-TTLS: Failed to derive key");
1428 free(rnd);
1429 free(key);
1430 return NULL;
1431 }
1432
1433 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: client/server random",
1434 rnd, keys.client_random_len + keys.server_random_len);
1435 wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: TLS/IA inner secret",
1436 keys.inner_secret, keys.inner_secret_len);
1437
1438 free(rnd);
1439
1440 return key;
1441 }
1442
1443
1444 static u8 * eap_ttls_getKey(struct eap_sm *sm, void *priv, size_t *len)
1445 {
1446 struct eap_ttls_data *data = priv;
1447 u8 *eapKeyData;
1448
1449 if (data->state != SUCCESS)
1450 return NULL;
1451
1452 if (data->ttls_version == 0) {
1453 eapKeyData = eap_tls_derive_key(sm, &data->ssl,
1454 "ttls keying material",
1455 EAP_TLS_KEY_LEN);
1456 } else {
1457 eapKeyData = eap_ttls_v1_derive_key(sm, data);
1458 }
1459
1460 if (eapKeyData) {
1461 *len = EAP_TLS_KEY_LEN;
1462 wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived key",
1463 eapKeyData, EAP_TLS_KEY_LEN);
1464 } else {
1465 wpa_printf(MSG_DEBUG, "EAP-TTLS: Failed to derive key");
1466 }
1467
1468 return eapKeyData;
1469 }
1470
1471
1472 static Boolean eap_ttls_isSuccess(struct eap_sm *sm, void *priv)
1473 {
1474 struct eap_ttls_data *data = priv;
1475 return data->state == SUCCESS;
1476 }
1477
1478
1479 int eap_server_ttls_register(void)
1480 {
1481 struct eap_method *eap;
1482 int ret;
1483
1484 eap = eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION,
1485 EAP_VENDOR_IETF, EAP_TYPE_TTLS, "TTLS");
1486 if (eap == NULL)
1487 return -1;
1488
1489 eap->init = eap_ttls_init;
1490 eap->reset = eap_ttls_reset;
1491 eap->buildReq = eap_ttls_buildReq;
1492 eap->check = eap_ttls_check;
1493 eap->process = eap_ttls_process;
1494 eap->isDone = eap_ttls_isDone;
1495 eap->getKey = eap_ttls_getKey;
1496 eap->isSuccess = eap_ttls_isSuccess;
1497
1498 ret = eap_server_method_register(eap);
1499 if (ret)
1500 eap_server_method_free(eap);
1501 return ret;
1502 }
DragonFly BSD