1/* 2 * EAP peer method: EAP-TTLS (RFC 5281) 3 * Copyright (c) 2004-2015, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9#include "includes.h" 10 11#include "common.h" 12#include "crypto/ms_funcs.h" 13#include "crypto/sha1.h" 14#include "crypto/tls.h" 15#include "eap_common/chap.h" 16#include "eap_common/eap_ttls.h" 17#include "mschapv2.h" 18#include "eap_i.h" 19#include "eap_tls_common.h" 20#include "eap_config.h" 21 22 23#define EAP_TTLS_VERSION 0 24 25 26static void eap_ttls_deinit(struct eap_sm *sm, void *priv); 27 28 29struct eap_ttls_data { 30 struct eap_ssl_data ssl; 31 32 int ttls_version; 33 34 const struct eap_method *phase2_method; 35 void *phase2_priv; 36 int phase2_success; 37 int phase2_start; 38 EapDecision decision_succ; 39 40 enum phase2_types { 41 EAP_TTLS_PHASE2_EAP, 42 EAP_TTLS_PHASE2_MSCHAPV2, 43 EAP_TTLS_PHASE2_MSCHAP, 44 EAP_TTLS_PHASE2_PAP, 45 EAP_TTLS_PHASE2_CHAP 46 } phase2_type; 47 struct eap_method_type phase2_eap_type; 48 struct eap_method_type *phase2_eap_types; 49 size_t num_phase2_eap_types; 50 51 u8 auth_response[MSCHAPV2_AUTH_RESPONSE_LEN]; 52 int auth_response_valid; 53 u8 master_key[MSCHAPV2_MASTER_KEY_LEN]; /* MSCHAPv2 master key */ 54 u8 ident; 55 int resuming; /* starting a resumed session */ 56 int reauth; /* reauthentication */ 57 u8 *key_data; 58 u8 *session_id; 59 size_t id_len; 60 61 struct wpabuf *pending_phase2_req; 62 struct wpabuf *pending_resp; 63 64#ifdef EAP_TNC 65 int ready_for_tnc; 66 int tnc_started; 67#endif /* EAP_TNC */ 68}; 69 70 71static void * eap_ttls_init(struct eap_sm *sm) 72{ 73 struct eap_ttls_data *data; 74 struct eap_peer_config *config = eap_get_config(sm); 75 int selected_non_eap; 76 char *selected; 77 78 data = os_zalloc(sizeof(*data)); 79 if (data == NULL) 80 return NULL; 81 data->ttls_version = EAP_TTLS_VERSION; 82 selected = "EAP"; 83 selected_non_eap = 0; 84 data->phase2_type = EAP_TTLS_PHASE2_EAP; 85 86 /* 87 * Either one auth= type or one or more autheap= methods can be 88 * specified. 89 */ 90 if (config && config->phase2) { 91 const char *token, *last = NULL; 92 93 while ((token = cstr_token(config->phase2, " \t", &last))) { 94 if (os_strncmp(token, "auth=", 5) != 0) 95 continue; 96 token += 5; 97 98 if (last - token == 8 && 99 os_strncmp(token, "MSCHAPV2", 8) == 0) { 100 selected = "MSCHAPV2"; 101 data->phase2_type = EAP_TTLS_PHASE2_MSCHAPV2; 102 } else if (last - token == 6 && 103 os_strncmp(token, "MSCHAP", 6) == 0) { 104 selected = "MSCHAP"; 105 data->phase2_type = EAP_TTLS_PHASE2_MSCHAP; 106 } else if (last - token == 3 && 107 os_strncmp(token, "PAP", 3) == 0) { 108 selected = "PAP"; 109 data->phase2_type = EAP_TTLS_PHASE2_PAP; 110 } else if (last - token == 4 && 111 os_strncmp(token, "CHAP", 4) == 0) { 112 selected = "CHAP"; 113 data->phase2_type = EAP_TTLS_PHASE2_CHAP; 114 } else { 115 wpa_printf(MSG_ERROR, 116 "EAP-TTLS: Unsupported Phase2 type '%s'", 117 token); 118 eap_ttls_deinit(sm, data); 119 return NULL; 120 } 121 122 if (selected_non_eap) { 123 wpa_printf(MSG_ERROR, 124 "EAP-TTLS: Only one Phase2 type can be specified"); 125 eap_ttls_deinit(sm, data); 126 return NULL; 127 } 128 129 selected_non_eap = 1; 130 } 131 132 if (os_strstr(config->phase2, "autheap=")) { 133 if (selected_non_eap) { 134 wpa_printf(MSG_ERROR, 135 "EAP-TTLS: Both auth= and autheap= params cannot be specified"); 136 eap_ttls_deinit(sm, data); 137 return NULL; 138 } 139 selected = "EAP"; 140 data->phase2_type = EAP_TTLS_PHASE2_EAP; 141 } 142 } 143 144 wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase2 type: %s", selected); 145 146 if (data->phase2_type == EAP_TTLS_PHASE2_EAP) { 147 if (eap_peer_select_phase2_methods(config, "autheap=", 148 &data->phase2_eap_types, 149 &data->num_phase2_eap_types) 150 < 0) { 151 eap_ttls_deinit(sm, data); 152 return NULL; 153 } 154 155 data->phase2_eap_type.vendor = EAP_VENDOR_IETF; 156 data->phase2_eap_type.method = EAP_TYPE_NONE; 157 } 158 159 if (eap_peer_tls_ssl_init(sm, &data->ssl, config, EAP_TYPE_TTLS)) { 160 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to initialize SSL."); 161 eap_ttls_deinit(sm, data); 162 return NULL; 163 } 164 165 return data; 166} 167 168 169static void eap_ttls_phase2_eap_deinit(struct eap_sm *sm, 170 struct eap_ttls_data *data) 171{ 172 if (data->phase2_priv && data->phase2_method) { 173 data->phase2_method->deinit(sm, data->phase2_priv); 174 data->phase2_method = NULL; 175 data->phase2_priv = NULL; 176 } 177} 178 179 180static void eap_ttls_free_key(struct eap_ttls_data *data) 181{ 182 if (data->key_data) { 183 bin_clear_free(data->key_data, EAP_TLS_KEY_LEN + EAP_EMSK_LEN); 184 data->key_data = NULL; 185 } 186} 187 188 189static void eap_ttls_deinit(struct eap_sm *sm, void *priv) 190{ 191 struct eap_ttls_data *data = priv; 192 if (data == NULL) 193 return; 194 eap_ttls_phase2_eap_deinit(sm, data); 195 os_free(data->phase2_eap_types); 196 eap_peer_tls_ssl_deinit(sm, &data->ssl); 197 eap_ttls_free_key(data); 198 os_free(data->session_id); 199 wpabuf_free(data->pending_phase2_req); 200 wpabuf_free(data->pending_resp); 201 os_free(data); 202} 203 204 205static u8 * eap_ttls_avp_hdr(u8 *avphdr, u32 avp_code, u32 vendor_id, 206 int mandatory, size_t len) 207{ 208 struct ttls_avp_vendor *avp; 209 u8 flags; 210 size_t hdrlen; 211 212 avp = (struct ttls_avp_vendor *) avphdr; 213 flags = mandatory ? AVP_FLAGS_MANDATORY : 0; 214 if (vendor_id) { 215 flags |= AVP_FLAGS_VENDOR; 216 hdrlen = sizeof(*avp); 217 avp->vendor_id = host_to_be32(vendor_id); 218 } else { 219 hdrlen = sizeof(struct ttls_avp); 220 } 221 222 avp->avp_code = host_to_be32(avp_code); 223 avp->avp_length = host_to_be32(((u32) flags << 24) | 224 (u32) (hdrlen + len)); 225 226 return avphdr + hdrlen; 227} 228 229 230static u8 * eap_ttls_avp_add(u8 *start, u8 *avphdr, u32 avp_code, 231 u32 vendor_id, int mandatory, 232 const u8 *data, size_t len) 233{ 234 u8 *pos; 235 pos = eap_ttls_avp_hdr(avphdr, avp_code, vendor_id, mandatory, len); 236 os_memcpy(pos, data, len); 237 pos += len; 238 AVP_PAD(start, pos); 239 return pos; 240} 241 242 243static int eap_ttls_avp_encapsulate(struct wpabuf **resp, u32 avp_code, 244 int mandatory) 245{ 246 struct wpabuf *msg; 247 u8 *avp, *pos; 248 249 msg = wpabuf_alloc(sizeof(struct ttls_avp) + wpabuf_len(*resp) + 4); 250 if (msg == NULL) { 251 wpabuf_free(*resp); 252 *resp = NULL; 253 return -1; 254 } 255 256 avp = wpabuf_mhead(msg); 257 pos = eap_ttls_avp_hdr(avp, avp_code, 0, mandatory, wpabuf_len(*resp)); 258 os_memcpy(pos, wpabuf_head(*resp), wpabuf_len(*resp)); 259 pos += wpabuf_len(*resp); 260 AVP_PAD(avp, pos); 261 wpabuf_free(*resp); 262 wpabuf_put(msg, pos - avp); 263 *resp = msg; 264 return 0; 265} 266 267 268static int eap_ttls_v0_derive_key(struct eap_sm *sm, 269 struct eap_ttls_data *data) 270{ 271 eap_ttls_free_key(data); 272 data->key_data = eap_peer_tls_derive_key(sm, &data->ssl, 273 "ttls keying material", 274 EAP_TLS_KEY_LEN + 275 EAP_EMSK_LEN); 276 if (!data->key_data) { 277 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to derive key"); 278 return -1; 279 } 280 281 wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived key", 282 data->key_data, EAP_TLS_KEY_LEN); 283 wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived EMSK", 284 data->key_data + EAP_TLS_KEY_LEN, 285 EAP_EMSK_LEN); 286 287 os_free(data->session_id); 288 data->session_id = eap_peer_tls_derive_session_id(sm, &data->ssl, 289 EAP_TYPE_TTLS, 290 &data->id_len); 291 if (data->session_id) { 292 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Derived Session-Id", 293 data->session_id, data->id_len); 294 } else { 295 wpa_printf(MSG_ERROR, "EAP-TTLS: Failed to derive Session-Id"); 296 } 297 298 return 0; 299} 300 301 302#ifndef CONFIG_FIPS 303static u8 * eap_ttls_implicit_challenge(struct eap_sm *sm, 304 struct eap_ttls_data *data, size_t len) 305{ 306 return eap_peer_tls_derive_key(sm, &data->ssl, "ttls challenge", len); 307} 308#endif /* CONFIG_FIPS */ 309 310 311static void eap_ttls_phase2_select_eap_method(struct eap_ttls_data *data, 312 u8 method) 313{ 314 size_t i; 315 for (i = 0; i < data->num_phase2_eap_types; i++) { 316 if (data->phase2_eap_types[i].vendor != EAP_VENDOR_IETF || 317 data->phase2_eap_types[i].method != method) 318 continue; 319 320 data->phase2_eap_type.vendor = 321 data->phase2_eap_types[i].vendor; 322 data->phase2_eap_type.method = 323 data->phase2_eap_types[i].method; 324 wpa_printf(MSG_DEBUG, "EAP-TTLS: Selected " 325 "Phase 2 EAP vendor %d method %d", 326 data->phase2_eap_type.vendor, 327 data->phase2_eap_type.method); 328 break; 329 } 330} 331 332 333static int eap_ttls_phase2_eap_process(struct eap_sm *sm, 334 struct eap_ttls_data *data, 335 struct eap_method_ret *ret, 336 struct eap_hdr *hdr, size_t len, 337 struct wpabuf **resp) 338{ 339 struct wpabuf msg; 340 struct eap_method_ret iret; 341 342 os_memset(&iret, 0, sizeof(iret)); 343 wpabuf_set(&msg, hdr, len); 344 *resp = data->phase2_method->process(sm, data->phase2_priv, &iret, 345 &msg); 346 if ((iret.methodState == METHOD_DONE || 347 iret.methodState == METHOD_MAY_CONT) && 348 (iret.decision == DECISION_UNCOND_SUCC || 349 iret.decision == DECISION_COND_SUCC || 350 iret.decision == DECISION_FAIL)) { 351 ret->methodState = iret.methodState; 352 ret->decision = iret.decision; 353 } 354 355 return 0; 356} 357 358 359static int eap_ttls_phase2_request_eap_method(struct eap_sm *sm, 360 struct eap_ttls_data *data, 361 struct eap_method_ret *ret, 362 struct eap_hdr *hdr, size_t len, 363 u8 method, struct wpabuf **resp) 364{ 365#ifdef EAP_TNC 366 if (data->tnc_started && data->phase2_method && 367 data->phase2_priv && method == EAP_TYPE_TNC && 368 data->phase2_eap_type.method == EAP_TYPE_TNC) 369 return eap_ttls_phase2_eap_process(sm, data, ret, hdr, len, 370 resp); 371 372 if (data->ready_for_tnc && !data->tnc_started && 373 method == EAP_TYPE_TNC) { 374 wpa_printf(MSG_DEBUG, "EAP-TTLS: Start TNC after completed " 375 "EAP method"); 376 data->tnc_started = 1; 377 } 378 379 if (data->tnc_started) { 380 if (data->phase2_eap_type.vendor != EAP_VENDOR_IETF || 381 data->phase2_eap_type.method == EAP_TYPE_TNC) { 382 wpa_printf(MSG_DEBUG, "EAP-TTLS: Unexpected EAP " 383 "type %d for TNC", method); 384 return -1; 385 } 386 387 data->phase2_eap_type.vendor = EAP_VENDOR_IETF; 388 data->phase2_eap_type.method = method; 389 wpa_printf(MSG_DEBUG, "EAP-TTLS: Selected " 390 "Phase 2 EAP vendor %d method %d (TNC)", 391 data->phase2_eap_type.vendor, 392 data->phase2_eap_type.method); 393 394 if (data->phase2_type == EAP_TTLS_PHASE2_EAP) 395 eap_ttls_phase2_eap_deinit(sm, data); 396 } 397#endif /* EAP_TNC */ 398 399 if (data->phase2_eap_type.vendor == EAP_VENDOR_IETF && 400 data->phase2_eap_type.method == EAP_TYPE_NONE) 401 eap_ttls_phase2_select_eap_method(data, method); 402 403 if (method != data->phase2_eap_type.method || method == EAP_TYPE_NONE) 404 { 405 if (eap_peer_tls_phase2_nak(data->phase2_eap_types, 406 data->num_phase2_eap_types, 407 hdr, resp)) 408 return -1; 409 return 0; 410 } 411 412 if (data->phase2_priv == NULL) { 413 data->phase2_method = eap_peer_get_eap_method( 414 EAP_VENDOR_IETF, method); 415 if (data->phase2_method) { 416 sm->init_phase2 = 1; 417 data->phase2_priv = data->phase2_method->init(sm); 418 sm->init_phase2 = 0; 419 } 420 } 421 if (data->phase2_priv == NULL || data->phase2_method == NULL) { 422 wpa_printf(MSG_INFO, "EAP-TTLS: failed to initialize " 423 "Phase 2 EAP method %d", method); 424 return -1; 425 } 426 427 return eap_ttls_phase2_eap_process(sm, data, ret, hdr, len, resp); 428} 429 430 431static int eap_ttls_phase2_request_eap(struct eap_sm *sm, 432 struct eap_ttls_data *data, 433 struct eap_method_ret *ret, 434 struct eap_hdr *hdr, 435 struct wpabuf **resp) 436{ 437 size_t len = be_to_host16(hdr->length); 438 u8 *pos; 439 struct eap_peer_config *config = eap_get_config(sm); 440 441 if (len <= sizeof(struct eap_hdr)) { 442 wpa_printf(MSG_INFO, "EAP-TTLS: too short " 443 "Phase 2 request (len=%lu)", (unsigned long) len); 444 return -1; 445 } 446 pos = (u8 *) (hdr + 1); 447 wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 EAP Request: type=%d", *pos); 448 switch (*pos) { 449 case EAP_TYPE_IDENTITY: 450 *resp = eap_sm_buildIdentity(sm, hdr->identifier, 1); 451 break; 452 default: 453 if (eap_ttls_phase2_request_eap_method(sm, data, ret, hdr, len, 454 *pos, resp) < 0) 455 return -1; 456 break; 457 } 458 459 if (*resp == NULL && 460 (config->pending_req_identity || config->pending_req_password || 461 config->pending_req_otp || config->pending_req_sim)) { 462 return 0; 463 } 464 465 if (*resp == NULL) 466 return -1; 467 468 wpa_hexdump_buf(MSG_DEBUG, "EAP-TTLS: AVP encapsulate EAP Response", 469 *resp); 470 return eap_ttls_avp_encapsulate(resp, RADIUS_ATTR_EAP_MESSAGE, 1); 471} 472 473 474static int eap_ttls_phase2_request_mschapv2(struct eap_sm *sm, 475 struct eap_ttls_data *data, 476 struct eap_method_ret *ret, 477 struct wpabuf **resp) 478{ 479#ifdef CONFIG_FIPS 480 wpa_printf(MSG_ERROR, "EAP-TTLS: MSCHAPV2 not supported in FIPS build"); 481 return -1; 482#else /* CONFIG_FIPS */ 483#ifdef EAP_MSCHAPv2 484 struct wpabuf *msg; 485 u8 *buf, *pos, *challenge, *peer_challenge; 486 const u8 *identity, *password; 487 size_t identity_len, password_len; 488 int pwhash; 489 490 wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 MSCHAPV2 Request"); 491 492 identity = eap_get_config_identity(sm, &identity_len); 493 password = eap_get_config_password2(sm, &password_len, &pwhash); 494 if (identity == NULL || password == NULL) 495 return -1; 496 497 msg = wpabuf_alloc(identity_len + 1000); 498 if (msg == NULL) { 499 wpa_printf(MSG_ERROR, 500 "EAP-TTLS/MSCHAPV2: Failed to allocate memory"); 501 return -1; 502 } 503 pos = buf = wpabuf_mhead(msg); 504 505 /* User-Name */ 506 pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1, 507 identity, identity_len); 508 509 /* MS-CHAP-Challenge */ 510 challenge = eap_ttls_implicit_challenge( 511 sm, data, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN + 1); 512 if (challenge == NULL) { 513 wpabuf_free(msg); 514 wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAPV2: Failed to derive " 515 "implicit challenge"); 516 return -1; 517 } 518 519 pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_MS_CHAP_CHALLENGE, 520 RADIUS_VENDOR_ID_MICROSOFT, 1, 521 challenge, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN); 522 523 /* MS-CHAP2-Response */ 524 pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP2_RESPONSE, 525 RADIUS_VENDOR_ID_MICROSOFT, 1, 526 EAP_TTLS_MSCHAPV2_RESPONSE_LEN); 527 data->ident = challenge[EAP_TTLS_MSCHAPV2_CHALLENGE_LEN]; 528 *pos++ = data->ident; 529 *pos++ = 0; /* Flags */ 530 if (os_get_random(pos, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN) < 0) { 531 os_free(challenge); 532 wpabuf_free(msg); 533 wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAPV2: Failed to get " 534 "random data for peer challenge"); 535 return -1; 536 } 537 peer_challenge = pos; 538 pos += EAP_TTLS_MSCHAPV2_CHALLENGE_LEN; 539 os_memset(pos, 0, 8); /* Reserved, must be zero */ 540 pos += 8; 541 if (mschapv2_derive_response(identity, identity_len, password, 542 password_len, pwhash, challenge, 543 peer_challenge, pos, data->auth_response, 544 data->master_key)) { 545 os_free(challenge); 546 wpabuf_free(msg); 547 wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAPV2: Failed to derive " 548 "response"); 549 return -1; 550 } 551 data->auth_response_valid = 1; 552 553 pos += 24; 554 os_free(challenge); 555 AVP_PAD(buf, pos); 556 557 wpabuf_put(msg, pos - buf); 558 *resp = msg; 559 560 return 0; 561#else /* EAP_MSCHAPv2 */ 562 wpa_printf(MSG_ERROR, "EAP-TTLS: MSCHAPv2 not included in the build"); 563 return -1; 564#endif /* EAP_MSCHAPv2 */ 565#endif /* CONFIG_FIPS */ 566} 567 568 569static int eap_ttls_phase2_request_mschap(struct eap_sm *sm, 570 struct eap_ttls_data *data, 571 struct eap_method_ret *ret, 572 struct wpabuf **resp) 573{ 574#ifdef CONFIG_FIPS 575 wpa_printf(MSG_ERROR, "EAP-TTLS: MSCHAP not supported in FIPS build"); 576 return -1; 577#else /* CONFIG_FIPS */ 578 struct wpabuf *msg; 579 u8 *buf, *pos, *challenge; 580 const u8 *identity, *password; 581 size_t identity_len, password_len; 582 int pwhash; 583 584 wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 MSCHAP Request"); 585 586 identity = eap_get_config_identity(sm, &identity_len); 587 password = eap_get_config_password2(sm, &password_len, &pwhash); 588 if (identity == NULL || password == NULL) 589 return -1; 590 591 msg = wpabuf_alloc(identity_len + 1000); 592 if (msg == NULL) { 593 wpa_printf(MSG_ERROR, 594 "EAP-TTLS/MSCHAP: Failed to allocate memory"); 595 return -1; 596 } 597 pos = buf = wpabuf_mhead(msg); 598 599 /* User-Name */ 600 pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1, 601 identity, identity_len); 602 603 /* MS-CHAP-Challenge */ 604 challenge = eap_ttls_implicit_challenge( 605 sm, data, EAP_TTLS_MSCHAP_CHALLENGE_LEN + 1); 606 if (challenge == NULL) { 607 wpabuf_free(msg); 608 wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAP: Failed to derive " 609 "implicit challenge"); 610 return -1; 611 } 612 613 pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_MS_CHAP_CHALLENGE, 614 RADIUS_VENDOR_ID_MICROSOFT, 1, 615 challenge, EAP_TTLS_MSCHAP_CHALLENGE_LEN); 616 617 /* MS-CHAP-Response */ 618 pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP_RESPONSE, 619 RADIUS_VENDOR_ID_MICROSOFT, 1, 620 EAP_TTLS_MSCHAP_RESPONSE_LEN); 621 data->ident = challenge[EAP_TTLS_MSCHAP_CHALLENGE_LEN]; 622 *pos++ = data->ident; 623 *pos++ = 1; /* Flags: Use NT style passwords */ 624 os_memset(pos, 0, 24); /* LM-Response */ 625 pos += 24; 626 if (pwhash) { 627 challenge_response(challenge, password, pos); /* NT-Response */ 628 wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: MSCHAP password hash", 629 password, 16); 630 } else { 631 nt_challenge_response(challenge, password, password_len, 632 pos); /* NT-Response */ 633 wpa_hexdump_ascii_key(MSG_DEBUG, "EAP-TTLS: MSCHAP password", 634 password, password_len); 635 } 636 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAP implicit challenge", 637 challenge, EAP_TTLS_MSCHAP_CHALLENGE_LEN); 638 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAP response", pos, 24); 639 pos += 24; 640 os_free(challenge); 641 AVP_PAD(buf, pos); 642 643 wpabuf_put(msg, pos - buf); 644 *resp = msg; 645 646 /* EAP-TTLS/MSCHAP does not provide tunneled success 647 * notification, so assume that Phase2 succeeds. */ 648 ret->methodState = METHOD_DONE; 649 ret->decision = DECISION_COND_SUCC; 650 651 return 0; 652#endif /* CONFIG_FIPS */ 653} 654 655 656static int eap_ttls_phase2_request_pap(struct eap_sm *sm, 657 struct eap_ttls_data *data, 658 struct eap_method_ret *ret, 659 struct wpabuf **resp) 660{ 661 struct wpabuf *msg; 662 u8 *buf, *pos; 663 size_t pad; 664 const u8 *identity, *password; 665 size_t identity_len, password_len; 666 667 wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 PAP Request"); 668 669 identity = eap_get_config_identity(sm, &identity_len); 670 password = eap_get_config_password(sm, &password_len); 671 if (identity == NULL || password == NULL) 672 return -1; 673 674 msg = wpabuf_alloc(identity_len + password_len + 100); 675 if (msg == NULL) { 676 wpa_printf(MSG_ERROR, 677 "EAP-TTLS/PAP: Failed to allocate memory"); 678 return -1; 679 } 680 pos = buf = wpabuf_mhead(msg); 681 682 /* User-Name */ 683 pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1, 684 identity, identity_len); 685 686 /* User-Password; in RADIUS, this is encrypted, but EAP-TTLS encrypts 687 * the data, so no separate encryption is used in the AVP itself. 688 * However, the password is padded to obfuscate its length. */ 689 pad = password_len == 0 ? 16 : (16 - (password_len & 15)) & 15; 690 pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_USER_PASSWORD, 0, 1, 691 password_len + pad); 692 os_memcpy(pos, password, password_len); 693 pos += password_len; 694 os_memset(pos, 0, pad); 695 pos += pad; 696 AVP_PAD(buf, pos); 697 698 wpabuf_put(msg, pos - buf); 699 *resp = msg; 700 701 /* EAP-TTLS/PAP does not provide tunneled success notification, 702 * so assume that Phase2 succeeds. */ 703 ret->methodState = METHOD_DONE; 704 ret->decision = DECISION_COND_SUCC; 705 706 return 0; 707} 708 709 710static int eap_ttls_phase2_request_chap(struct eap_sm *sm, 711 struct eap_ttls_data *data, 712 struct eap_method_ret *ret, 713 struct wpabuf **resp) 714{ 715#ifdef CONFIG_FIPS 716 wpa_printf(MSG_ERROR, "EAP-TTLS: CHAP not supported in FIPS build"); 717 return -1; 718#else /* CONFIG_FIPS */ 719 struct wpabuf *msg; 720 u8 *buf, *pos, *challenge; 721 const u8 *identity, *password; 722 size_t identity_len, password_len; 723 724 wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 CHAP Request"); 725 726 identity = eap_get_config_identity(sm, &identity_len); 727 password = eap_get_config_password(sm, &password_len); 728 if (identity == NULL || password == NULL) 729 return -1; 730 731 msg = wpabuf_alloc(identity_len + 1000); 732 if (msg == NULL) { 733 wpa_printf(MSG_ERROR, 734 "EAP-TTLS/CHAP: Failed to allocate memory"); 735 return -1; 736 } 737 pos = buf = wpabuf_mhead(msg); 738 739 /* User-Name */ 740 pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1, 741 identity, identity_len); 742 743 /* CHAP-Challenge */ 744 challenge = eap_ttls_implicit_challenge( 745 sm, data, EAP_TTLS_CHAP_CHALLENGE_LEN + 1); 746 if (challenge == NULL) { 747 wpabuf_free(msg); 748 wpa_printf(MSG_ERROR, "EAP-TTLS/CHAP: Failed to derive " 749 "implicit challenge"); 750 return -1; 751 } 752 753 pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_CHAP_CHALLENGE, 0, 1, 754 challenge, EAP_TTLS_CHAP_CHALLENGE_LEN); 755 756 /* CHAP-Password */ 757 pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_CHAP_PASSWORD, 0, 1, 758 1 + EAP_TTLS_CHAP_PASSWORD_LEN); 759 data->ident = challenge[EAP_TTLS_CHAP_CHALLENGE_LEN]; 760 *pos++ = data->ident; 761 762 /* MD5(Ident + Password + Challenge) */ 763 chap_md5(data->ident, password, password_len, challenge, 764 EAP_TTLS_CHAP_CHALLENGE_LEN, pos); 765 766 wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: CHAP username", 767 identity, identity_len); 768 wpa_hexdump_ascii_key(MSG_DEBUG, "EAP-TTLS: CHAP password", 769 password, password_len); 770 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: CHAP implicit challenge", 771 challenge, EAP_TTLS_CHAP_CHALLENGE_LEN); 772 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: CHAP password", 773 pos, EAP_TTLS_CHAP_PASSWORD_LEN); 774 pos += EAP_TTLS_CHAP_PASSWORD_LEN; 775 os_free(challenge); 776 AVP_PAD(buf, pos); 777 778 wpabuf_put(msg, pos - buf); 779 *resp = msg; 780 781 /* EAP-TTLS/CHAP does not provide tunneled success 782 * notification, so assume that Phase2 succeeds. */ 783 ret->methodState = METHOD_DONE; 784 ret->decision = DECISION_COND_SUCC; 785 786 return 0; 787#endif /* CONFIG_FIPS */ 788} 789 790 791static int eap_ttls_phase2_request(struct eap_sm *sm, 792 struct eap_ttls_data *data, 793 struct eap_method_ret *ret, 794 struct eap_hdr *hdr, 795 struct wpabuf **resp) 796{ 797 int res = 0; 798 size_t len; 799 enum phase2_types phase2_type = data->phase2_type; 800 801#ifdef EAP_TNC 802 if (data->tnc_started) { 803 wpa_printf(MSG_DEBUG, "EAP-TTLS: Processing TNC"); 804 phase2_type = EAP_TTLS_PHASE2_EAP; 805 } 806#endif /* EAP_TNC */ 807 808 if (phase2_type == EAP_TTLS_PHASE2_MSCHAPV2 || 809 phase2_type == EAP_TTLS_PHASE2_MSCHAP || 810 phase2_type == EAP_TTLS_PHASE2_PAP || 811 phase2_type == EAP_TTLS_PHASE2_CHAP) { 812 if (eap_get_config_identity(sm, &len) == NULL) { 813 wpa_printf(MSG_INFO, 814 "EAP-TTLS: Identity not configured"); 815 eap_sm_request_identity(sm); 816 if (eap_get_config_password(sm, &len) == NULL) 817 eap_sm_request_password(sm); 818 return 0; 819 } 820 821 if (eap_get_config_password(sm, &len) == NULL) { 822 wpa_printf(MSG_INFO, 823 "EAP-TTLS: Password not configured"); 824 eap_sm_request_password(sm); 825 return 0; 826 } 827 } 828 829 switch (phase2_type) { 830 case EAP_TTLS_PHASE2_EAP: 831 res = eap_ttls_phase2_request_eap(sm, data, ret, hdr, resp); 832 break; 833 case EAP_TTLS_PHASE2_MSCHAPV2: 834 res = eap_ttls_phase2_request_mschapv2(sm, data, ret, resp); 835 break; 836 case EAP_TTLS_PHASE2_MSCHAP: 837 res = eap_ttls_phase2_request_mschap(sm, data, ret, resp); 838 break; 839 case EAP_TTLS_PHASE2_PAP: 840 res = eap_ttls_phase2_request_pap(sm, data, ret, resp); 841 break; 842 case EAP_TTLS_PHASE2_CHAP: 843 res = eap_ttls_phase2_request_chap(sm, data, ret, resp); 844 break; 845 default: 846 wpa_printf(MSG_ERROR, "EAP-TTLS: Phase 2 - Unknown"); 847 res = -1; 848 break; 849 } 850 851 if (res < 0) { 852 ret->methodState = METHOD_DONE; 853 ret->decision = DECISION_FAIL; 854 } 855 856 return res; 857} 858 859 860struct ttls_parse_avp { 861 u8 *mschapv2; 862 u8 *eapdata; 863 size_t eap_len; 864 int mschapv2_error; 865}; 866 867 868static int eap_ttls_parse_attr_eap(const u8 *dpos, size_t dlen, 869 struct ttls_parse_avp *parse) 870{ 871 wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP - EAP Message"); 872 if (parse->eapdata == NULL) { 873 parse->eapdata = os_malloc(dlen); 874 if (parse->eapdata == NULL) { 875 wpa_printf(MSG_WARNING, "EAP-TTLS: Failed to allocate " 876 "memory for Phase 2 EAP data"); 877 return -1; 878 } 879 os_memcpy(parse->eapdata, dpos, dlen); 880 parse->eap_len = dlen; 881 } else { 882 u8 *neweap = os_realloc(parse->eapdata, parse->eap_len + dlen); 883 if (neweap == NULL) { 884 wpa_printf(MSG_WARNING, "EAP-TTLS: Failed to allocate " 885 "memory for Phase 2 EAP data"); 886 return -1; 887 } 888 os_memcpy(neweap + parse->eap_len, dpos, dlen); 889 parse->eapdata = neweap; 890 parse->eap_len += dlen; 891 } 892 893 return 0; 894} 895 896 897static int eap_ttls_parse_avp(u8 *pos, size_t left, 898 struct ttls_parse_avp *parse) 899{ 900 struct ttls_avp *avp; 901 u32 avp_code, avp_length, vendor_id = 0; 902 u8 avp_flags, *dpos; 903 size_t dlen; 904 905 avp = (struct ttls_avp *) pos; 906 avp_code = be_to_host32(avp->avp_code); 907 avp_length = be_to_host32(avp->avp_length); 908 avp_flags = (avp_length >> 24) & 0xff; 909 avp_length &= 0xffffff; 910 wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP: code=%d flags=0x%02x " 911 "length=%d", (int) avp_code, avp_flags, 912 (int) avp_length); 913 914 if (avp_length > left) { 915 wpa_printf(MSG_WARNING, "EAP-TTLS: AVP overflow " 916 "(len=%d, left=%lu) - dropped", 917 (int) avp_length, (unsigned long) left); 918 return -1; 919 } 920 921 if (avp_length < sizeof(*avp)) { 922 wpa_printf(MSG_WARNING, "EAP-TTLS: Invalid AVP length %d", 923 avp_length); 924 return -1; 925 } 926 927 dpos = (u8 *) (avp + 1); 928 dlen = avp_length - sizeof(*avp); 929 if (avp_flags & AVP_FLAGS_VENDOR) { 930 if (dlen < 4) { 931 wpa_printf(MSG_WARNING, "EAP-TTLS: Vendor AVP " 932 "underflow"); 933 return -1; 934 } 935 vendor_id = WPA_GET_BE32(dpos); 936 wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP vendor_id %d", 937 (int) vendor_id); 938 dpos += 4; 939 dlen -= 4; 940 } 941 942 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: AVP data", dpos, dlen); 943 944 if (vendor_id == 0 && avp_code == RADIUS_ATTR_EAP_MESSAGE) { 945 if (eap_ttls_parse_attr_eap(dpos, dlen, parse) < 0) 946 return -1; 947 } else if (vendor_id == 0 && avp_code == RADIUS_ATTR_REPLY_MESSAGE) { 948 /* This is an optional message that can be displayed to 949 * the user. */ 950 wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: AVP - Reply-Message", 951 dpos, dlen); 952 } else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT && 953 avp_code == RADIUS_ATTR_MS_CHAP2_SUCCESS) { 954 wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: MS-CHAP2-Success", 955 dpos, dlen); 956 if (dlen != 43) { 957 wpa_printf(MSG_WARNING, "EAP-TTLS: Unexpected " 958 "MS-CHAP2-Success length " 959 "(len=%lu, expected 43)", 960 (unsigned long) dlen); 961 return -1; 962 } 963 parse->mschapv2 = dpos; 964 } else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT && 965 avp_code == RADIUS_ATTR_MS_CHAP_ERROR) { 966 wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: MS-CHAP-Error", 967 dpos, dlen); 968 parse->mschapv2_error = 1; 969 } else if (avp_flags & AVP_FLAGS_MANDATORY) { 970 wpa_printf(MSG_WARNING, "EAP-TTLS: Unsupported mandatory AVP " 971 "code %d vendor_id %d - dropped", 972 (int) avp_code, (int) vendor_id); 973 return -1; 974 } else { 975 wpa_printf(MSG_DEBUG, "EAP-TTLS: Ignoring unsupported AVP " 976 "code %d vendor_id %d", 977 (int) avp_code, (int) vendor_id); 978 } 979 980 return avp_length; 981} 982 983 984static int eap_ttls_parse_avps(struct wpabuf *in_decrypted, 985 struct ttls_parse_avp *parse) 986{ 987 u8 *pos; 988 size_t left, pad; 989 int avp_length; 990 991 pos = wpabuf_mhead(in_decrypted); 992 left = wpabuf_len(in_decrypted); 993 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Decrypted Phase 2 AVPs", pos, left); 994 if (left < sizeof(struct ttls_avp)) { 995 wpa_printf(MSG_WARNING, "EAP-TTLS: Too short Phase 2 AVP frame" 996 " len=%lu expected %lu or more - dropped", 997 (unsigned long) left, 998 (unsigned long) sizeof(struct ttls_avp)); 999 return -1; 1000 } 1001 1002 /* Parse AVPs */ 1003 os_memset(parse, 0, sizeof(*parse)); 1004 1005 while (left > 0) { 1006 avp_length = eap_ttls_parse_avp(pos, left, parse); 1007 if (avp_length < 0) 1008 return -1; 1009 1010 pad = (4 - (avp_length & 3)) & 3; 1011 pos += avp_length + pad; 1012 if (left < avp_length + pad) 1013 left = 0; 1014 else 1015 left -= avp_length + pad; 1016 } 1017 1018 return 0; 1019} 1020 1021 1022static u8 * eap_ttls_fake_identity_request(void) 1023{ 1024 struct eap_hdr *hdr; 1025 u8 *buf; 1026 1027 wpa_printf(MSG_DEBUG, "EAP-TTLS: empty data in beginning of " 1028 "Phase 2 - use fake EAP-Request Identity"); 1029 buf = os_malloc(sizeof(*hdr) + 1); 1030 if (buf == NULL) { 1031 wpa_printf(MSG_WARNING, "EAP-TTLS: failed to allocate " 1032 "memory for fake EAP-Identity Request"); 1033 return NULL; 1034 } 1035 1036 hdr = (struct eap_hdr *) buf; 1037 hdr->code = EAP_CODE_REQUEST; 1038 hdr->identifier = 0; 1039 hdr->length = host_to_be16(sizeof(*hdr) + 1); 1040 buf[sizeof(*hdr)] = EAP_TYPE_IDENTITY; 1041 1042 return buf; 1043} 1044 1045 1046static int eap_ttls_encrypt_response(struct eap_sm *sm, 1047 struct eap_ttls_data *data, 1048 struct wpabuf *resp, u8 identifier, 1049 struct wpabuf **out_data) 1050{ 1051 if (resp == NULL) 1052 return 0; 1053 1054 wpa_hexdump_buf_key(MSG_DEBUG, "EAP-TTLS: Encrypting Phase 2 data", 1055 resp); 1056 if (eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_TTLS, 1057 data->ttls_version, identifier, 1058 resp, out_data)) { 1059 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to encrypt a Phase 2 " 1060 "frame"); 1061 wpabuf_free(resp); 1062 return -1; 1063 } 1064 wpabuf_free(resp); 1065 1066 return 0; 1067} 1068 1069 1070static int eap_ttls_process_phase2_eap(struct eap_sm *sm, 1071 struct eap_ttls_data *data, 1072 struct eap_method_ret *ret, 1073 struct ttls_parse_avp *parse, 1074 struct wpabuf **resp) 1075{ 1076 struct eap_hdr *hdr; 1077 size_t len; 1078 1079 if (parse->eapdata == NULL) { 1080 wpa_printf(MSG_WARNING, "EAP-TTLS: No EAP Message in the " 1081 "packet - dropped"); 1082 return -1; 1083 } 1084 1085 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Phase 2 EAP", 1086 parse->eapdata, parse->eap_len); 1087 hdr = (struct eap_hdr *) parse->eapdata; 1088 1089 if (parse->eap_len < sizeof(*hdr)) { 1090 wpa_printf(MSG_WARNING, "EAP-TTLS: Too short Phase 2 EAP " 1091 "frame (len=%lu, expected %lu or more) - dropped", 1092 (unsigned long) parse->eap_len, 1093 (unsigned long) sizeof(*hdr)); 1094 return -1; 1095 } 1096 len = be_to_host16(hdr->length); 1097 if (len > parse->eap_len) { 1098 wpa_printf(MSG_INFO, "EAP-TTLS: Length mismatch in Phase 2 " 1099 "EAP frame (EAP hdr len=%lu, EAP data len in " 1100 "AVP=%lu)", 1101 (unsigned long) len, 1102 (unsigned long) parse->eap_len); 1103 return -1; 1104 } 1105 wpa_printf(MSG_DEBUG, "EAP-TTLS: received Phase 2: code=%d " 1106 "identifier=%d length=%lu", 1107 hdr->code, hdr->identifier, (unsigned long) len); 1108 switch (hdr->code) { 1109 case EAP_CODE_REQUEST: 1110 if (eap_ttls_phase2_request(sm, data, ret, hdr, resp)) { 1111 wpa_printf(MSG_INFO, "EAP-TTLS: Phase2 Request " 1112 "processing failed"); 1113 return -1; 1114 } 1115 break; 1116 default: 1117 wpa_printf(MSG_INFO, "EAP-TTLS: Unexpected code=%d in " 1118 "Phase 2 EAP header", hdr->code); 1119 return -1; 1120 } 1121 1122 return 0; 1123} 1124 1125 1126static int eap_ttls_process_phase2_mschapv2(struct eap_sm *sm, 1127 struct eap_ttls_data *data, 1128 struct eap_method_ret *ret, 1129 struct ttls_parse_avp *parse) 1130{ 1131#ifdef EAP_MSCHAPv2 1132 if (parse->mschapv2_error) { 1133 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Received " 1134 "MS-CHAP-Error - failed"); 1135 ret->methodState = METHOD_DONE; 1136 ret->decision = DECISION_FAIL; 1137 /* Reply with empty data to ACK error */ 1138 return 1; 1139 } 1140 1141 if (parse->mschapv2 == NULL) { 1142#ifdef EAP_TNC 1143 if (data->phase2_success && parse->eapdata) { 1144 /* 1145 * Allow EAP-TNC to be started after successfully 1146 * completed MSCHAPV2. 1147 */ 1148 return 1; 1149 } 1150#endif /* EAP_TNC */ 1151 wpa_printf(MSG_WARNING, "EAP-TTLS: no MS-CHAP2-Success AVP " 1152 "received for Phase2 MSCHAPV2"); 1153 return -1; 1154 } 1155 if (parse->mschapv2[0] != data->ident) { 1156 wpa_printf(MSG_WARNING, "EAP-TTLS: Ident mismatch for Phase 2 " 1157 "MSCHAPV2 (received Ident 0x%02x, expected 0x%02x)", 1158 parse->mschapv2[0], data->ident); 1159 return -1; 1160 } 1161 if (!data->auth_response_valid || 1162 mschapv2_verify_auth_response(data->auth_response, 1163 parse->mschapv2 + 1, 42)) { 1164 wpa_printf(MSG_WARNING, "EAP-TTLS: Invalid authenticator " 1165 "response in Phase 2 MSCHAPV2 success request"); 1166 return -1; 1167 } 1168 1169 wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 MSCHAPV2 " 1170 "authentication succeeded"); 1171 ret->methodState = METHOD_DONE; 1172 ret->decision = DECISION_UNCOND_SUCC; 1173 data->phase2_success = 1; 1174 1175 /* 1176 * Reply with empty data; authentication server will reply 1177 * with EAP-Success after this. 1178 */ 1179 return 1; 1180#else /* EAP_MSCHAPv2 */ 1181 wpa_printf(MSG_ERROR, "EAP-TTLS: MSCHAPv2 not included in the build"); 1182 return -1; 1183#endif /* EAP_MSCHAPv2 */ 1184} 1185 1186 1187#ifdef EAP_TNC 1188static int eap_ttls_process_tnc_start(struct eap_sm *sm, 1189 struct eap_ttls_data *data, 1190 struct eap_method_ret *ret, 1191 struct ttls_parse_avp *parse, 1192 struct wpabuf **resp) 1193{ 1194 /* TNC uses inner EAP method after non-EAP TTLS phase 2. */ 1195 if (parse->eapdata == NULL) { 1196 wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received " 1197 "unexpected tunneled data (no EAP)"); 1198 return -1; 1199 } 1200 1201 if (!data->ready_for_tnc) { 1202 wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received " 1203 "EAP after non-EAP, but not ready for TNC"); 1204 return -1; 1205 } 1206 1207 wpa_printf(MSG_DEBUG, "EAP-TTLS: Start TNC after completed " 1208 "non-EAP method"); 1209 data->tnc_started = 1; 1210 1211 if (eap_ttls_process_phase2_eap(sm, data, ret, parse, resp) < 0) 1212 return -1; 1213 1214 return 0; 1215} 1216#endif /* EAP_TNC */ 1217 1218 1219static int eap_ttls_process_decrypted(struct eap_sm *sm, 1220 struct eap_ttls_data *data, 1221 struct eap_method_ret *ret, 1222 u8 identifier, 1223 struct ttls_parse_avp *parse, 1224 struct wpabuf *in_decrypted, 1225 struct wpabuf **out_data) 1226{ 1227 struct wpabuf *resp = NULL; 1228 struct eap_peer_config *config = eap_get_config(sm); 1229 int res; 1230 enum phase2_types phase2_type = data->phase2_type; 1231 1232#ifdef EAP_TNC 1233 if (data->tnc_started) 1234 phase2_type = EAP_TTLS_PHASE2_EAP; 1235#endif /* EAP_TNC */ 1236 1237 switch (phase2_type) { 1238 case EAP_TTLS_PHASE2_EAP: 1239 if (eap_ttls_process_phase2_eap(sm, data, ret, parse, &resp) < 1240 0) 1241 return -1; 1242 break; 1243 case EAP_TTLS_PHASE2_MSCHAPV2: 1244 res = eap_ttls_process_phase2_mschapv2(sm, data, ret, parse); 1245#ifdef EAP_TNC 1246 if (res == 1 && parse->eapdata && data->phase2_success) { 1247 /* 1248 * TNC may be required as the next 1249 * authentication method within the tunnel. 1250 */ 1251 ret->methodState = METHOD_MAY_CONT; 1252 data->ready_for_tnc = 1; 1253 if (eap_ttls_process_tnc_start(sm, data, ret, parse, 1254 &resp) == 0) 1255 break; 1256 } 1257#endif /* EAP_TNC */ 1258 return res; 1259 case EAP_TTLS_PHASE2_MSCHAP: 1260 case EAP_TTLS_PHASE2_PAP: 1261 case EAP_TTLS_PHASE2_CHAP: 1262#ifdef EAP_TNC 1263 if (eap_ttls_process_tnc_start(sm, data, ret, parse, &resp) < 1264 0) 1265 return -1; 1266 break; 1267#else /* EAP_TNC */ 1268 /* EAP-TTLS/{MSCHAP,PAP,CHAP} should not send any TLS tunneled 1269 * requests to the supplicant */ 1270 wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received unexpected " 1271 "tunneled data"); 1272 return -1; 1273#endif /* EAP_TNC */ 1274 } 1275 1276 if (resp) { 1277 if (eap_ttls_encrypt_response(sm, data, resp, identifier, 1278 out_data) < 0) 1279 return -1; 1280 } else if (config->pending_req_identity || 1281 config->pending_req_password || 1282 config->pending_req_otp || 1283 config->pending_req_new_password || 1284 config->pending_req_sim) { 1285 wpabuf_free(data->pending_phase2_req); 1286 data->pending_phase2_req = wpabuf_dup(in_decrypted); 1287 } 1288 1289 return 0; 1290} 1291 1292 1293static int eap_ttls_implicit_identity_request(struct eap_sm *sm, 1294 struct eap_ttls_data *data, 1295 struct eap_method_ret *ret, 1296 u8 identifier, 1297 struct wpabuf **out_data) 1298{ 1299 int retval = 0; 1300 struct eap_hdr *hdr; 1301 struct wpabuf *resp; 1302 1303 hdr = (struct eap_hdr *) eap_ttls_fake_identity_request(); 1304 if (hdr == NULL) { 1305 ret->methodState = METHOD_DONE; 1306 ret->decision = DECISION_FAIL; 1307 return -1; 1308 } 1309 1310 resp = NULL; 1311 if (eap_ttls_phase2_request(sm, data, ret, hdr, &resp)) { 1312 wpa_printf(MSG_INFO, "EAP-TTLS: Phase2 Request " 1313 "processing failed"); 1314 retval = -1; 1315 } else { 1316 struct eap_peer_config *config = eap_get_config(sm); 1317 if (resp == NULL && 1318 (config->pending_req_identity || 1319 config->pending_req_password || 1320 config->pending_req_otp || 1321 config->pending_req_new_password || 1322 config->pending_req_sim)) { 1323 /* 1324 * Use empty buffer to force implicit request 1325 * processing when EAP request is re-processed after 1326 * user input. 1327 */ 1328 wpabuf_free(data->pending_phase2_req); 1329 data->pending_phase2_req = wpabuf_alloc(0); 1330 } 1331 1332 retval = eap_ttls_encrypt_response(sm, data, resp, identifier, 1333 out_data); 1334 } 1335 1336 os_free(hdr); 1337 1338 if (retval < 0) { 1339 ret->methodState = METHOD_DONE; 1340 ret->decision = DECISION_FAIL; 1341 } 1342 1343 return retval; 1344} 1345 1346 1347static int eap_ttls_phase2_start(struct eap_sm *sm, struct eap_ttls_data *data, 1348 struct eap_method_ret *ret, u8 identifier, 1349 struct wpabuf **out_data) 1350{ 1351 data->phase2_start = 0; 1352 1353 /* 1354 * EAP-TTLS does not use Phase2 on fast re-auth; this must be done only 1355 * if TLS part was indeed resuming a previous session. Most 1356 * Authentication Servers terminate EAP-TTLS before reaching this 1357 * point, but some do not. Make wpa_supplicant stop phase 2 here, if 1358 * needed. 1359 */ 1360 if (data->reauth && 1361 tls_connection_resumed(sm->ssl_ctx, data->ssl.conn)) { 1362 wpa_printf(MSG_DEBUG, "EAP-TTLS: Session resumption - " 1363 "skip phase 2"); 1364 *out_data = eap_peer_tls_build_ack(identifier, EAP_TYPE_TTLS, 1365 data->ttls_version); 1366 ret->methodState = METHOD_DONE; 1367 ret->decision = DECISION_UNCOND_SUCC; 1368 data->phase2_success = 1; 1369 return 0; 1370 } 1371 1372 return eap_ttls_implicit_identity_request(sm, data, ret, identifier, 1373 out_data); 1374} 1375 1376 1377static int eap_ttls_decrypt(struct eap_sm *sm, struct eap_ttls_data *data, 1378 struct eap_method_ret *ret, u8 identifier, 1379 const struct wpabuf *in_data, 1380 struct wpabuf **out_data) 1381{ 1382 struct wpabuf *in_decrypted = NULL; 1383 int retval = 0; 1384 struct ttls_parse_avp parse; 1385 1386 os_memset(&parse, 0, sizeof(parse)); 1387 1388 wpa_printf(MSG_DEBUG, "EAP-TTLS: received %lu bytes encrypted data for" 1389 " Phase 2", 1390 in_data ? (unsigned long) wpabuf_len(in_data) : 0); 1391 1392 if (data->pending_phase2_req) { 1393 wpa_printf(MSG_DEBUG, "EAP-TTLS: Pending Phase 2 request - " 1394 "skip decryption and use old data"); 1395 /* Clear TLS reassembly state. */ 1396 eap_peer_tls_reset_input(&data->ssl); 1397 1398 in_decrypted = data->pending_phase2_req; 1399 data->pending_phase2_req = NULL; 1400 if (wpabuf_len(in_decrypted) == 0) { 1401 wpabuf_free(in_decrypted); 1402 return eap_ttls_implicit_identity_request( 1403 sm, data, ret, identifier, out_data); 1404 } 1405 goto continue_req; 1406 } 1407 1408 if ((in_data == NULL || wpabuf_len(in_data) == 0) && 1409 data->phase2_start) { 1410 return eap_ttls_phase2_start(sm, data, ret, identifier, 1411 out_data); 1412 } 1413 1414 if (in_data == NULL || wpabuf_len(in_data) == 0) { 1415 /* Received TLS ACK - requesting more fragments */ 1416 return eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_TTLS, 1417 data->ttls_version, 1418 identifier, NULL, out_data); 1419 } 1420 1421 retval = eap_peer_tls_decrypt(sm, &data->ssl, in_data, &in_decrypted); 1422 if (retval) 1423 goto done; 1424 1425continue_req: 1426 data->phase2_start = 0; 1427 1428 if (eap_ttls_parse_avps(in_decrypted, &parse) < 0) { 1429 retval = -1; 1430 goto done; 1431 } 1432 1433 retval = eap_ttls_process_decrypted(sm, data, ret, identifier, 1434 &parse, in_decrypted, out_data); 1435 1436done: 1437 wpabuf_free(in_decrypted); 1438 os_free(parse.eapdata); 1439 1440 if (retval < 0) { 1441 ret->methodState = METHOD_DONE; 1442 ret->decision = DECISION_FAIL; 1443 } 1444 1445 return retval; 1446} 1447 1448 1449static int eap_ttls_process_handshake(struct eap_sm *sm, 1450 struct eap_ttls_data *data, 1451 struct eap_method_ret *ret, 1452 u8 identifier, 1453 const struct wpabuf *in_data, 1454 struct wpabuf **out_data) 1455{ 1456 int res; 1457 1458 if (sm->waiting_ext_cert_check && data->pending_resp) { 1459 struct eap_peer_config *config = eap_get_config(sm); 1460 1461 if (config->pending_ext_cert_check == EXT_CERT_CHECK_GOOD) { 1462 wpa_printf(MSG_DEBUG, 1463 "EAP-TTLS: External certificate check succeeded - continue handshake"); 1464 *out_data = data->pending_resp; 1465 data->pending_resp = NULL; 1466 sm->waiting_ext_cert_check = 0; 1467 return 0; 1468 } 1469 1470 if (config->pending_ext_cert_check == EXT_CERT_CHECK_BAD) { 1471 wpa_printf(MSG_DEBUG, 1472 "EAP-TTLS: External certificate check failed - force authentication failure"); 1473 ret->methodState = METHOD_DONE; 1474 ret->decision = DECISION_FAIL; 1475 sm->waiting_ext_cert_check = 0; 1476 return 0; 1477 } 1478 1479 wpa_printf(MSG_DEBUG, 1480 "EAP-TTLS: Continuing to wait external server certificate validation"); 1481 return 0; 1482 } 1483 1484 res = eap_peer_tls_process_helper(sm, &data->ssl, EAP_TYPE_TTLS, 1485 data->ttls_version, identifier, 1486 in_data, out_data); 1487 if (res < 0) { 1488 wpa_printf(MSG_DEBUG, "EAP-TTLS: TLS processing failed"); 1489 ret->methodState = METHOD_DONE; 1490 ret->decision = DECISION_FAIL; 1491 return -1; 1492 } 1493 1494 if (sm->waiting_ext_cert_check) { 1495 wpa_printf(MSG_DEBUG, 1496 "EAP-TTLS: Waiting external server certificate validation"); 1497 wpabuf_free(data->pending_resp); 1498 data->pending_resp = *out_data; 1499 *out_data = NULL; 1500 return 0; 1501 } 1502 1503 if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) { 1504 wpa_printf(MSG_DEBUG, "EAP-TTLS: TLS done, proceed to " 1505 "Phase 2"); 1506 if (data->resuming) { 1507 wpa_printf(MSG_DEBUG, "EAP-TTLS: fast reauth - may " 1508 "skip Phase 2"); 1509 ret->decision = DECISION_COND_SUCC; 1510 ret->methodState = METHOD_MAY_CONT; 1511 } 1512 data->phase2_start = 1; 1513 eap_ttls_v0_derive_key(sm, data); 1514 1515 if (*out_data == NULL || wpabuf_len(*out_data) == 0) { 1516 if (eap_ttls_decrypt(sm, data, ret, identifier, 1517 NULL, out_data)) { 1518 wpa_printf(MSG_WARNING, "EAP-TTLS: " 1519 "failed to process early " 1520 "start for Phase 2"); 1521 } 1522 res = 0; 1523 } 1524 data->resuming = 0; 1525 } 1526 1527 if (res == 2) { 1528 /* 1529 * Application data included in the handshake message. 1530 */ 1531 wpabuf_free(data->pending_phase2_req); 1532 data->pending_phase2_req = *out_data; 1533 *out_data = NULL; 1534 res = eap_ttls_decrypt(sm, data, ret, identifier, in_data, 1535 out_data); 1536 } 1537 1538 return res; 1539} 1540 1541 1542static void eap_ttls_check_auth_status(struct eap_sm *sm, 1543 struct eap_ttls_data *data, 1544 struct eap_method_ret *ret) 1545{ 1546 if (ret->methodState == METHOD_DONE) { 1547 ret->allowNotifications = FALSE; 1548 if (ret->decision == DECISION_UNCOND_SUCC || 1549 ret->decision == DECISION_COND_SUCC) { 1550 wpa_printf(MSG_DEBUG, "EAP-TTLS: Authentication " 1551 "completed successfully"); 1552 data->phase2_success = 1; 1553 data->decision_succ = ret->decision; 1554#ifdef EAP_TNC 1555 if (!data->ready_for_tnc && !data->tnc_started) { 1556 /* 1557 * TNC may be required as the next 1558 * authentication method within the tunnel. 1559 */ 1560 ret->methodState = METHOD_MAY_CONT; 1561 data->ready_for_tnc = 1; 1562 } 1563#endif /* EAP_TNC */ 1564 } 1565 } else if (ret->methodState == METHOD_MAY_CONT && 1566 (ret->decision == DECISION_UNCOND_SUCC || 1567 ret->decision == DECISION_COND_SUCC)) { 1568 wpa_printf(MSG_DEBUG, "EAP-TTLS: Authentication " 1569 "completed successfully (MAY_CONT)"); 1570 data->phase2_success = 1; 1571 data->decision_succ = ret->decision; 1572 } else if (data->decision_succ != DECISION_FAIL && 1573 data->phase2_success && 1574 !data->ssl.tls_out) { 1575 /* 1576 * This is needed to cover the case where the final Phase 2 1577 * message gets fragmented since fragmentation clears 1578 * decision back to FAIL. 1579 */ 1580 wpa_printf(MSG_DEBUG, 1581 "EAP-TTLS: Restore success decision after fragmented frame sent completely"); 1582 ret->decision = data->decision_succ; 1583 } 1584} 1585 1586 1587static struct wpabuf * eap_ttls_process(struct eap_sm *sm, void *priv, 1588 struct eap_method_ret *ret, 1589 const struct wpabuf *reqData) 1590{ 1591 size_t left; 1592 int res; 1593 u8 flags, id; 1594 struct wpabuf *resp; 1595 const u8 *pos; 1596 struct eap_ttls_data *data = priv; 1597 struct wpabuf msg; 1598 1599 pos = eap_peer_tls_process_init(sm, &data->ssl, EAP_TYPE_TTLS, ret, 1600 reqData, &left, &flags); 1601 if (pos == NULL) 1602 return NULL; 1603 id = eap_get_id(reqData); 1604 1605 if (flags & EAP_TLS_FLAGS_START) { 1606 wpa_printf(MSG_DEBUG, "EAP-TTLS: Start (server ver=%d, own " 1607 "ver=%d)", flags & EAP_TLS_VERSION_MASK, 1608 data->ttls_version); 1609 1610 /* RFC 5281, Ch. 9.2: 1611 * "This packet MAY contain additional information in the form 1612 * of AVPs, which may provide useful hints to the client" 1613 * For now, ignore any potential extra data. 1614 */ 1615 left = 0; 1616 } 1617 1618 wpabuf_set(&msg, pos, left); 1619 1620 resp = NULL; 1621 if (tls_connection_established(sm->ssl_ctx, data->ssl.conn) && 1622 !data->resuming) { 1623 res = eap_ttls_decrypt(sm, data, ret, id, &msg, &resp); 1624 } else { 1625 res = eap_ttls_process_handshake(sm, data, ret, id, 1626 &msg, &resp); 1627 } 1628 1629 eap_ttls_check_auth_status(sm, data, ret); 1630 1631 /* FIX: what about res == -1? Could just move all error processing into 1632 * the other functions and get rid of this res==1 case here. */ 1633 if (res == 1) { 1634 wpabuf_free(resp); 1635 return eap_peer_tls_build_ack(id, EAP_TYPE_TTLS, 1636 data->ttls_version); 1637 } 1638 return resp; 1639} 1640 1641 1642static Boolean eap_ttls_has_reauth_data(struct eap_sm *sm, void *priv) 1643{ 1644 struct eap_ttls_data *data = priv; 1645 return tls_connection_established(sm->ssl_ctx, data->ssl.conn) && 1646 data->phase2_success; 1647} 1648 1649 1650static void eap_ttls_deinit_for_reauth(struct eap_sm *sm, void *priv) 1651{ 1652 struct eap_ttls_data *data = priv; 1653 1654 if (data->phase2_priv && data->phase2_method && 1655 data->phase2_method->deinit_for_reauth) 1656 data->phase2_method->deinit_for_reauth(sm, data->phase2_priv); 1657 wpabuf_free(data->pending_phase2_req); 1658 data->pending_phase2_req = NULL; 1659 wpabuf_free(data->pending_resp); 1660 data->pending_resp = NULL; 1661 data->decision_succ = DECISION_FAIL; 1662#ifdef EAP_TNC 1663 data->ready_for_tnc = 0; 1664 data->tnc_started = 0; 1665#endif /* EAP_TNC */ 1666} 1667 1668 1669static void * eap_ttls_init_for_reauth(struct eap_sm *sm, void *priv) 1670{ 1671 struct eap_ttls_data *data = priv; 1672 eap_ttls_free_key(data); 1673 os_free(data->session_id); 1674 data->session_id = NULL; 1675 if (eap_peer_tls_reauth_init(sm, &data->ssl)) { 1676 os_free(data); 1677 return NULL; 1678 } 1679 if (data->phase2_priv && data->phase2_method && 1680 data->phase2_method->init_for_reauth) 1681 data->phase2_method->init_for_reauth(sm, data->phase2_priv); 1682 data->phase2_start = 0; 1683 data->phase2_success = 0; 1684 data->resuming = 1; 1685 data->reauth = 1; 1686 return priv; 1687} 1688 1689 1690static int eap_ttls_get_status(struct eap_sm *sm, void *priv, char *buf, 1691 size_t buflen, int verbose) 1692{ 1693 struct eap_ttls_data *data = priv; 1694 int len, ret; 1695 1696 len = eap_peer_tls_status(sm, &data->ssl, buf, buflen, verbose); 1697 ret = os_snprintf(buf + len, buflen - len, 1698 "EAP-TTLSv%d Phase2 method=", 1699 data->ttls_version); 1700 if (os_snprintf_error(buflen - len, ret)) 1701 return len; 1702 len += ret; 1703 switch (data->phase2_type) { 1704 case EAP_TTLS_PHASE2_EAP: 1705 ret = os_snprintf(buf + len, buflen - len, "EAP-%s\n", 1706 data->phase2_method ? 1707 data->phase2_method->name : "?"); 1708 break; 1709 case EAP_TTLS_PHASE2_MSCHAPV2: 1710 ret = os_snprintf(buf + len, buflen - len, "MSCHAPV2\n"); 1711 break; 1712 case EAP_TTLS_PHASE2_MSCHAP: 1713 ret = os_snprintf(buf + len, buflen - len, "MSCHAP\n"); 1714 break; 1715 case EAP_TTLS_PHASE2_PAP: 1716 ret = os_snprintf(buf + len, buflen - len, "PAP\n"); 1717 break; 1718 case EAP_TTLS_PHASE2_CHAP: 1719 ret = os_snprintf(buf + len, buflen - len, "CHAP\n"); 1720 break; 1721 default: 1722 ret = 0; 1723 break; 1724 } 1725 if (os_snprintf_error(buflen - len, ret)) 1726 return len; 1727 len += ret; 1728 1729 return len; 1730} 1731 1732 1733static Boolean eap_ttls_isKeyAvailable(struct eap_sm *sm, void *priv) 1734{ 1735 struct eap_ttls_data *data = priv; 1736 return data->key_data != NULL && data->phase2_success; 1737} 1738 1739 1740static u8 * eap_ttls_getKey(struct eap_sm *sm, void *priv, size_t *len) 1741{ 1742 struct eap_ttls_data *data = priv; 1743 u8 *key; 1744 1745 if (data->key_data == NULL || !data->phase2_success) 1746 return NULL; 1747 1748 key = os_malloc(EAP_TLS_KEY_LEN); 1749 if (key == NULL) 1750 return NULL; 1751 1752 *len = EAP_TLS_KEY_LEN; 1753 os_memcpy(key, data->key_data, EAP_TLS_KEY_LEN); 1754 1755 return key; 1756} 1757 1758 1759static u8 * eap_ttls_get_session_id(struct eap_sm *sm, void *priv, size_t *len) 1760{ 1761 struct eap_ttls_data *data = priv; 1762 u8 *id; 1763 1764 if (data->session_id == NULL || !data->phase2_success) 1765 return NULL; 1766 1767 id = os_malloc(data->id_len); 1768 if (id == NULL) 1769 return NULL; 1770 1771 *len = data->id_len; 1772 os_memcpy(id, data->session_id, data->id_len); 1773 1774 return id; 1775} 1776 1777 1778static u8 * eap_ttls_get_emsk(struct eap_sm *sm, void *priv, size_t *len) 1779{ 1780 struct eap_ttls_data *data = priv; 1781 u8 *key; 1782 1783 if (data->key_data == NULL) 1784 return NULL; 1785 1786 key = os_malloc(EAP_EMSK_LEN); 1787 if (key == NULL) 1788 return NULL; 1789 1790 *len = EAP_EMSK_LEN; 1791 os_memcpy(key, data->key_data + EAP_TLS_KEY_LEN, EAP_EMSK_LEN); 1792 1793 return key; 1794} 1795 1796 1797int eap_peer_ttls_register(void) 1798{ 1799 struct eap_method *eap; 1800 1801 eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION, 1802 EAP_VENDOR_IETF, EAP_TYPE_TTLS, "TTLS"); 1803 if (eap == NULL) 1804 return -1; 1805 1806 eap->init = eap_ttls_init; 1807 eap->deinit = eap_ttls_deinit; 1808 eap->process = eap_ttls_process; 1809 eap->isKeyAvailable = eap_ttls_isKeyAvailable; 1810 eap->getKey = eap_ttls_getKey; 1811 eap->getSessionId = eap_ttls_get_session_id; 1812 eap->get_status = eap_ttls_get_status; 1813 eap->has_reauth_data = eap_ttls_has_reauth_data; 1814 eap->deinit_for_reauth = eap_ttls_deinit_for_reauth; 1815 eap->init_for_reauth = eap_ttls_init_for_reauth; 1816 eap->get_emsk = eap_ttls_get_emsk; 1817 1818 return eap_peer_method_register(eap); 1819} 1820