18d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/* 28d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * hostapd / EAP-MSCHAPv2 (draft-kamath-pppext-eap-mschapv2-00.txt) server 38d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * Copyright (c) 2004-2007, Jouni Malinen <j@w1.fi> 48d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * 5c5ec7f57ead87efa365800228aa0b09a12d9e6c4Dmitry Shmidt * This software may be distributed under the terms of the BSD license. 6c5ec7f57ead87efa365800228aa0b09a12d9e6c4Dmitry Shmidt * See README for more details. 78d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */ 88d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 98d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "includes.h" 108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "common.h" 128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "crypto/ms_funcs.h" 138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "crypto/random.h" 148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "eap_i.h" 158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstruct eap_mschapv2_hdr { 188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 op_code; /* MSCHAPV2_OP_* */ 198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 mschapv2_id; /* must be changed for challenges, but not for 208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * success/failure */ 218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 ms_length[2]; /* Note: misaligned; length - 5 */ 228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* followed by data */ 238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} STRUCT_PACKED; 248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define MSCHAPV2_OP_CHALLENGE 1 268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define MSCHAPV2_OP_RESPONSE 2 278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define MSCHAPV2_OP_SUCCESS 3 288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define MSCHAPV2_OP_FAILURE 4 298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define MSCHAPV2_OP_CHANGE_PASSWORD 7 308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define MSCHAPV2_RESP_LEN 49 328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define ERROR_RESTRICTED_LOGON_HOURS 646 348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define ERROR_ACCT_DISABLED 647 358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define ERROR_PASSWD_EXPIRED 648 368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define ERROR_NO_DIALIN_PERMISSION 649 378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define ERROR_AUTHENTICATION_FAILURE 691 388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define ERROR_CHANGING_PASSWORD 709 398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define PASSWD_CHANGE_CHAL_LEN 16 418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define MSCHAPV2_KEY_LEN 16 428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define CHALLENGE_LEN 16 458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstruct eap_mschapv2_data { 478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 auth_challenge[CHALLENGE_LEN]; 488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt int auth_challenge_from_tls; 498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *peer_challenge; 508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 auth_response[20]; 518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt enum { CHALLENGE, SUCCESS_REQ, FAILURE_REQ, SUCCESS, FAILURE } state; 528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 resp_mschapv2_id; 538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 master_key[16]; 548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt int master_key_valid; 558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}; 568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void * eap_mschapv2_init(struct eap_sm *sm) 598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_mschapv2_data *data; 618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data = os_zalloc(sizeof(*data)); 638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data == NULL) 648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->state = CHALLENGE; 668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (sm->auth_challenge) { 688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(data->auth_challenge, sm->auth_challenge, 698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt CHALLENGE_LEN); 708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->auth_challenge_from_tls = 1; 718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (sm->peer_challenge) { 748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->peer_challenge = os_malloc(CHALLENGE_LEN); 758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->peer_challenge == NULL) { 768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(data); 778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcpy(data->peer_challenge, sm->peer_challenge, 808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt CHALLENGE_LEN); 818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return data; 848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void eap_mschapv2_reset(struct eap_sm *sm, void *priv) 888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_mschapv2_data *data = priv; 908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data == NULL) 918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; 928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_free(data->peer_challenge); 94c28170251eb54dbf64a9074a07fee377587425b2Dmitry Shmidt bin_clear_free(data, sizeof(*data)); 958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic struct wpabuf * eap_mschapv2_build_challenge( 998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_sm *sm, struct eap_mschapv2_data *data, u8 id) 1008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 1018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct wpabuf *req; 1028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_mschapv2_hdr *ms; 1038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t ms_len; 1048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (!data->auth_challenge_from_tls && 1068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt random_get_bytes(data->auth_challenge, CHALLENGE_LEN)) { 1078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_ERROR, "EAP-MSCHAPV2: Failed to get random " 1088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "data"); 1098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->state = FAILURE; 1108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 1118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 11334af306c42b7ccf956508e7cd23f0ba90606e360Dmitry Shmidt ms_len = sizeof(*ms) + 1 + CHALLENGE_LEN + sm->server_id_len; 1148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2, ms_len, 1158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt EAP_CODE_REQUEST, id); 1168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (req == NULL) { 1178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_ERROR, "EAP-MSCHAPV2: Failed to allocate memory" 1188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt " for request"); 1198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->state = FAILURE; 1208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 1218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ms = wpabuf_put(req, sizeof(*ms)); 1248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ms->op_code = MSCHAPV2_OP_CHALLENGE; 1258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ms->mschapv2_id = id; 1268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE16(ms->ms_length, ms_len); 1278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_u8(req, CHALLENGE_LEN); 1298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (!data->auth_challenge_from_tls) 1308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_data(req, data->auth_challenge, CHALLENGE_LEN); 1318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt else 1328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put(req, CHALLENGE_LEN); 1338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump(MSG_MSGDUMP, "EAP-MSCHAPV2: Challenge", 1348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->auth_challenge, CHALLENGE_LEN); 13534af306c42b7ccf956508e7cd23f0ba90606e360Dmitry Shmidt wpabuf_put_data(req, sm->server_id, sm->server_id_len); 1368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return req; 1388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 1398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic struct wpabuf * eap_mschapv2_build_success_req( 1428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_sm *sm, struct eap_mschapv2_data *data, u8 id) 1438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 1448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct wpabuf *req; 1458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_mschapv2_hdr *ms; 1468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *msg; 1478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt char *message = "OK"; 1488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t ms_len; 1498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ms_len = sizeof(*ms) + 2 + 2 * sizeof(data->auth_response) + 1 + 2 + 1518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_strlen(message); 1528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2, ms_len, 1538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt EAP_CODE_REQUEST, id); 1548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (req == NULL) { 1558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_ERROR, "EAP-MSCHAPV2: Failed to allocate memory" 1568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt " for request"); 1578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->state = FAILURE; 1588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 1598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 1608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ms = wpabuf_put(req, sizeof(*ms)); 1628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ms->op_code = MSCHAPV2_OP_SUCCESS; 1638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ms->mschapv2_id = data->resp_mschapv2_id; 1648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE16(ms->ms_length, ms_len); 1658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt msg = (u8 *) (ms + 1); 1668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_u8(req, 'S'); 1688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_u8(req, '='); 1698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_snprintf_hex_uppercase( 1708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put(req, sizeof(data->auth_response) * 2), 1718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt sizeof(data->auth_response) * 2 + 1, 1728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->auth_response, sizeof(data->auth_response)); 1738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_u8(req, ' '); 1748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_u8(req, 'M'); 1758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_u8(req, '='); 1768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_data(req, message, os_strlen(message)); 1778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-MSCHAPV2: Success Request Message", 1798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt msg, ms_len - sizeof(*ms)); 1808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return req; 1828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 1838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic struct wpabuf * eap_mschapv2_build_failure_req( 1868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_sm *sm, struct eap_mschapv2_data *data, u8 id) 1878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 1888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct wpabuf *req; 1898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_mschapv2_hdr *ms; 1908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt char *message = "E=691 R=0 C=00000000000000000000000000000000 V=3 " 1918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "M=FAILED"; 1928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t ms_len; 1938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 1948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ms_len = sizeof(*ms) + os_strlen(message); 1958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2, ms_len, 1968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt EAP_CODE_REQUEST, id); 1978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (req == NULL) { 1988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_ERROR, "EAP-MSCHAPV2: Failed to allocate memory" 1998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt " for request"); 2008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->state = FAILURE; 2018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 2028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ms = wpabuf_put(req, sizeof(*ms)); 2058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ms->op_code = MSCHAPV2_OP_FAILURE; 2068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ms->mschapv2_id = data->resp_mschapv2_id; 2078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt WPA_PUT_BE16(ms->ms_length, ms_len); 2088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpabuf_put_data(req, message, os_strlen(message)); 2108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-MSCHAPV2: Failure Request Message", 2128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt (u8 *) message, os_strlen(message)); 2138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return req; 2158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 2168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic struct wpabuf * eap_mschapv2_buildReq(struct eap_sm *sm, void *priv, 2198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 id) 2208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 2218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_mschapv2_data *data = priv; 2228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt switch (data->state) { 2248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case CHALLENGE: 2258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return eap_mschapv2_build_challenge(sm, data, id); 2268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case SUCCESS_REQ: 2278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return eap_mschapv2_build_success_req(sm, data, id); 2288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case FAILURE_REQ: 2298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return eap_mschapv2_build_failure_req(sm, data, id); 2308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt default: 2318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Unknown state %d in " 2328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "buildReq", data->state); 2338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 2348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 2368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 2378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic Boolean eap_mschapv2_check(struct eap_sm *sm, void *priv, 2408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct wpabuf *respData) 2418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 2428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_mschapv2_data *data = priv; 2438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_mschapv2_hdr *resp; 2448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *pos; 2458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t len; 2468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2, respData, 2488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt &len); 2498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos == NULL || len < 1) { 2508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_INFO, "EAP-MSCHAPV2: Invalid frame"); 2518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return TRUE; 2528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt resp = (struct eap_mschapv2_hdr *) pos; 2558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->state == CHALLENGE && 2568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt resp->op_code != MSCHAPV2_OP_RESPONSE) { 2578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Expected Response - " 2588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "ignore op %d", resp->op_code); 2598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return TRUE; 2608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->state == SUCCESS_REQ && 2638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt resp->op_code != MSCHAPV2_OP_SUCCESS && 2648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt resp->op_code != MSCHAPV2_OP_FAILURE) { 2658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Expected Success or " 2668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "Failure - ignore op %d", resp->op_code); 2678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return TRUE; 2688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->state == FAILURE_REQ && 2718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt resp->op_code != MSCHAPV2_OP_FAILURE) { 2728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Expected Failure " 2738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "- ignore op %d", resp->op_code); 2748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return TRUE; 2758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 2768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return FALSE; 2788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 2798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void eap_mschapv2_process_response(struct eap_sm *sm, 2828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_mschapv2_data *data, 2838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct wpabuf *respData) 2848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 2858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_mschapv2_hdr *resp; 2868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *pos, *end, *peer_challenge, *nt_response, *name; 2878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 flags; 2888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t len, name_len, i; 2898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 expected[24]; 2908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *username, *user; 2918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t username_len, user_len; 2928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt int res; 293818ea489ef32dcdc7c098d8a336d6e1dd8996112Dmitry Shmidt char *buf; 2948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 2958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2, respData, 2968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt &len); 2978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos == NULL || len < 1) 2988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; /* Should not happen - frame already validated */ 2998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt end = pos + len; 3018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt resp = (struct eap_mschapv2_hdr *) pos; 3028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = (u8 *) (resp + 1); 3038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (len < sizeof(*resp) + 1 + 49 || 3058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt resp->op_code != MSCHAPV2_OP_RESPONSE || 3068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos[0] != 49) { 3078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump_buf(MSG_DEBUG, "EAP-MSCHAPV2: Invalid response", 3088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt respData); 3098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->state = FAILURE; 3108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; 3118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->resp_mschapv2_id = resp->mschapv2_id; 3138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos++; 3148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt peer_challenge = pos; 3158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 16 + 8; 3168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt nt_response = pos; 3178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos += 24; 3188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt flags = *pos++; 3198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt name = pos; 3208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt name_len = end - name; 3218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->peer_challenge) { 3238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Using pre-configured " 3248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "Peer-Challenge"); 3258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt peer_challenge = data->peer_challenge; 3268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump(MSG_MSGDUMP, "EAP-MSCHAPV2: Peer-Challenge", 3288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt peer_challenge, 16); 3298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump(MSG_MSGDUMP, "EAP-MSCHAPV2: NT-Response", nt_response, 24); 3308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_MSGDUMP, "EAP-MSCHAPV2: Flags 0x%x", flags); 3318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-MSCHAPV2: Name", name, name_len); 3328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 333b5d893b5dec601a58c3ce0fc9e5d6da3816ce97aDmitry Shmidt buf = os_malloc(name_len * 4 + 1); 334818ea489ef32dcdc7c098d8a336d6e1dd8996112Dmitry Shmidt if (buf) { 335b5d893b5dec601a58c3ce0fc9e5d6da3816ce97aDmitry Shmidt printf_encode(buf, name_len * 4 + 1, name, name_len); 336818ea489ef32dcdc7c098d8a336d6e1dd8996112Dmitry Shmidt eap_log_msg(sm, "EAP-MSCHAPV2 Name '%s'", buf); 337818ea489ef32dcdc7c098d8a336d6e1dd8996112Dmitry Shmidt os_free(buf); 338818ea489ef32dcdc7c098d8a336d6e1dd8996112Dmitry Shmidt } 339818ea489ef32dcdc7c098d8a336d6e1dd8996112Dmitry Shmidt 3408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* MSCHAPv2 does not include optional domain name in the 3418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * challenge-response calculation, so remove domain prefix 3428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * (if present). */ 3438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt username = sm->identity; 3448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt username_len = sm->identity_len; 3458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt for (i = 0; i < username_len; i++) { 3468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (username[i] == '\\') { 3478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt username_len -= i + 1; 3488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt username += i + 1; 3498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 3508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt user = name; 3548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt user_len = name_len; 3558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt for (i = 0; i < user_len; i++) { 3568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (user[i] == '\\') { 3578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt user_len -= i + 1; 3588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt user += i + 1; 3598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 3608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (username_len != user_len || 3648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt os_memcmp(username, user, username_len) != 0) { 3658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Mismatch in user names"); 3668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump_ascii(MSG_DEBUG, "EAP-MSCHAPV2: Expected user " 3678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "name", username, username_len); 3688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump_ascii(MSG_DEBUG, "EAP-MSCHAPV2: Received user " 3698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "name", user, user_len); 3708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->state = FAILURE; 3718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; 3728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-MSCHAPV2: User name", 3758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt username, username_len); 3768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 3778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (sm->user->password_hash) { 3788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt res = generate_nt_response_pwhash(data->auth_challenge, 3798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt peer_challenge, 3808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt username, username_len, 3818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt sm->user->password, 3828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt expected); 3838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } else { 3848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt res = generate_nt_response(data->auth_challenge, 3858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt peer_challenge, 3868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt username, username_len, 3878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt sm->user->password, 3888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt sm->user->password_len, 3898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt expected); 3908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (res) { 3928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->state = FAILURE; 3938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; 3948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 3958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 396c28170251eb54dbf64a9074a07fee377587425b2Dmitry Shmidt if (os_memcmp_const(nt_response, expected, 24) == 0) { 3978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *pw_hash; 3988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 pw_hash_buf[16], pw_hash_hash[16]; 3998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Correct NT-Response"); 4018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->state = SUCCESS_REQ; 4028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* Authenticator response is not really needed yet, but 4048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * calculate it here so that peer_challenge and username need 4058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * not be saved. */ 4068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (sm->user->password_hash) { 4078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pw_hash = sm->user->password; 4088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } else { 4091f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt if (nt_password_hash(sm->user->password, 4101f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt sm->user->password_len, 4111f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt pw_hash_buf) < 0) { 4121f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt data->state = FAILURE; 4131f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt return; 4141f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt } 4158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pw_hash = pw_hash_buf; 4168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt generate_authenticator_response_pwhash( 4188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pw_hash, peer_challenge, data->auth_challenge, 4198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt username, username_len, nt_response, 4208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->auth_response); 4218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt hash_nt_password_hash(pw_hash, pw_hash_hash); 4238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt get_master_key(pw_hash_hash, nt_response, data->master_key); 4248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->master_key_valid = 1; 4258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump_key(MSG_DEBUG, "EAP-MSCHAPV2: Derived Master Key", 4268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->master_key, MSCHAPV2_KEY_LEN); 4278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } else { 4288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump(MSG_MSGDUMP, "EAP-MSCHAPV2: Expected NT-Response", 4298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt expected, 24); 4308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Invalid NT-Response"); 4318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->state = FAILURE_REQ; 4328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 4348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void eap_mschapv2_process_success_resp(struct eap_sm *sm, 4378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_mschapv2_data *data, 4388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct wpabuf *respData) 4398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 4408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_mschapv2_hdr *resp; 4418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *pos; 4428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t len; 4438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2, respData, 4458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt &len); 4468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos == NULL || len < 1) 4478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; /* Should not happen - frame already validated */ 4488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt resp = (struct eap_mschapv2_hdr *) pos; 4508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (resp->op_code == MSCHAPV2_OP_SUCCESS) { 4528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Received Success Response" 4538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt " - authentication completed successfully"); 4548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->state = SUCCESS; 4558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } else { 4568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Did not receive Success " 4578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "Response - peer rejected authentication"); 4588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->state = FAILURE; 4598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 4618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void eap_mschapv2_process_failure_resp(struct eap_sm *sm, 4648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_mschapv2_data *data, 4658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct wpabuf *respData) 4668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 4678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_mschapv2_hdr *resp; 4688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt const u8 *pos; 4698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt size_t len; 4708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2, respData, 4728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt &len); 4738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (pos == NULL || len < 1) 4748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; /* Should not happen - frame already validated */ 4758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt resp = (struct eap_mschapv2_hdr *) pos; 4778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (resp->op_code == MSCHAPV2_OP_FAILURE) { 4798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Received Failure Response" 4808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt " - authentication failed"); 4818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } else { 4828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Did not receive Failure " 4838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "Response - authentication failed"); 4848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 4858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->state = FAILURE; 4878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 4888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void eap_mschapv2_process(struct eap_sm *sm, void *priv, 4918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct wpabuf *respData) 4928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 4938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_mschapv2_data *data = priv; 4948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 4958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (sm->user == NULL || sm->user->password == NULL) { 4968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_INFO, "EAP-MSCHAPV2: Password not configured"); 4978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt data->state = FAILURE; 4988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return; 4998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 5008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt switch (data->state) { 5028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case CHALLENGE: 5038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_mschapv2_process_response(sm, data, respData); 5048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 5058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case SUCCESS_REQ: 5068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_mschapv2_process_success_resp(sm, data, respData); 5078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 5088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt case FAILURE_REQ: 5098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_mschapv2_process_failure_resp(sm, data, respData); 5108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 5118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt default: 5128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Unknown state %d in " 5138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "process", data->state); 5148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt break; 5158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt } 5168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 5178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic Boolean eap_mschapv2_isDone(struct eap_sm *sm, void *priv) 5208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 5218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_mschapv2_data *data = priv; 5228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return data->state == SUCCESS || data->state == FAILURE; 5238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 5248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic u8 * eap_mschapv2_getKey(struct eap_sm *sm, void *priv, size_t *len) 5278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 5288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_mschapv2_data *data = priv; 5298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt u8 *key; 5308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (data->state != SUCCESS || !data->master_key_valid) 5328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 5338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *len = 2 * MSCHAPV2_KEY_LEN; 5358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt key = os_malloc(*len); 5368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (key == NULL) 5378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return NULL; 5388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt /* MSK = server MS-MPPE-Recv-Key | MS-MPPE-Send-Key */ 5398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt get_asymetric_start_key(data->master_key, key, MSCHAPV2_KEY_LEN, 0, 1); 5408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt get_asymetric_start_key(data->master_key, key + MSCHAPV2_KEY_LEN, 5418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt MSCHAPV2_KEY_LEN, 1, 1); 5428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt wpa_hexdump_key(MSG_DEBUG, "EAP-MSCHAPV2: Derived key", key, *len); 5438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return key; 5458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 5468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic Boolean eap_mschapv2_isSuccess(struct eap_sm *sm, void *priv) 5498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 5508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_mschapv2_data *data = priv; 5518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return data->state == SUCCESS; 5528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 5538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtint eap_server_mschapv2_register(void) 5568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{ 5578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt struct eap_method *eap; 5588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt int ret; 5598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap = eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION, 5618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2, 5628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt "MSCHAPV2"); 5638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (eap == NULL) 5648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return -1; 5658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->init = eap_mschapv2_init; 5678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->reset = eap_mschapv2_reset; 5688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->buildReq = eap_mschapv2_buildReq; 5698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->check = eap_mschapv2_check; 5708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->process = eap_mschapv2_process; 5718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->isDone = eap_mschapv2_isDone; 5728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->getKey = eap_mschapv2_getKey; 5738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap->isSuccess = eap_mschapv2_isSuccess; 5748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt 5758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt ret = eap_server_method_register(eap); 5768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt if (ret) 5778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt eap_server_method_free(eap); 5788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt return ret; 5798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} 580