1 /* 2 * EAP peer method: EAP-TTLS (RFC 5281) 3 * Copyright (c) 2004-2015, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 11 #include "common.h" 12 #include "crypto/ms_funcs.h" 13 #include "crypto/sha1.h" 14 #include "crypto/tls.h" 15 #include "eap_common/chap.h" 16 #include "eap_common/eap_ttls.h" 17 #include "mschapv2.h" 18 #include "eap_i.h" 19 #include "eap_tls_common.h" 20 #include "eap_config.h" 21 22 23 #define EAP_TTLS_VERSION 0 24 25 26 static void eap_ttls_deinit(struct eap_sm *sm, void *priv); 27 28 29 struct eap_ttls_data { 30 struct eap_ssl_data ssl; 31 32 int ttls_version; 33 34 const struct eap_method *phase2_method; 35 void *phase2_priv; 36 int phase2_success; 37 int phase2_start; 38 EapDecision decision_succ; 39 40 enum phase2_types { 41 EAP_TTLS_PHASE2_EAP, 42 EAP_TTLS_PHASE2_MSCHAPV2, 43 EAP_TTLS_PHASE2_MSCHAP, 44 EAP_TTLS_PHASE2_PAP, 45 EAP_TTLS_PHASE2_CHAP 46 } phase2_type; 47 struct eap_method_type phase2_eap_type; 48 struct eap_method_type *phase2_eap_types; 49 size_t num_phase2_eap_types; 50 51 u8 auth_response[MSCHAPV2_AUTH_RESPONSE_LEN]; 52 int auth_response_valid; 53 u8 master_key[MSCHAPV2_MASTER_KEY_LEN]; /* MSCHAPv2 master key */ 54 u8 ident; 55 int resuming; /* starting a resumed session */ 56 int reauth; /* reauthentication */ 57 u8 *key_data; 58 u8 *session_id; 59 size_t id_len; 60 61 struct wpabuf *pending_phase2_req; 62 struct wpabuf *pending_resp; 63 64 #ifdef EAP_TNC 65 int ready_for_tnc; 66 int tnc_started; 67 #endif /* EAP_TNC */ 68 }; 69 70 71 static void * eap_ttls_init(struct eap_sm *sm) 72 { 73 struct eap_ttls_data *data; 74 struct eap_peer_config *config = eap_get_config(sm); 75 int selected_non_eap; 76 char *selected; 77 78 data = os_zalloc(sizeof(*data)); 79 if (data == NULL) 80 return NULL; 81 data->ttls_version = EAP_TTLS_VERSION; 82 selected = "EAP"; 83 selected_non_eap = 0; 84 data->phase2_type = EAP_TTLS_PHASE2_EAP; 85 86 /* 87 * Either one auth= type or one or more autheap= methods can be 88 * specified. 89 */ 90 if (config && config->phase2) { 91 const char *token, *last = NULL; 92 93 while ((token = cstr_token(config->phase2, " \t", &last))) { 94 if (os_strncmp(token, "auth=", 5) != 0) 95 continue; 96 token += 5; 97 98 if (last - token == 8 && 99 os_strncmp(token, "MSCHAPV2", 8) == 0) { 100 selected = "MSCHAPV2"; 101 data->phase2_type = EAP_TTLS_PHASE2_MSCHAPV2; 102 } else if (last - token == 6 && 103 os_strncmp(token, "MSCHAP", 6) == 0) { 104 selected = "MSCHAP"; 105 data->phase2_type = EAP_TTLS_PHASE2_MSCHAP; 106 } else if (last - token == 3 && 107 os_strncmp(token, "PAP", 3) == 0) { 108 selected = "PAP"; 109 data->phase2_type = EAP_TTLS_PHASE2_PAP; 110 } else if (last - token == 4 && 111 os_strncmp(token, "CHAP", 4) == 0) { 112 selected = "CHAP"; 113 data->phase2_type = EAP_TTLS_PHASE2_CHAP; 114 } else { 115 wpa_printf(MSG_ERROR, 116 "EAP-TTLS: Unsupported Phase2 type '%s'", 117 token); 118 eap_ttls_deinit(sm, data); 119 return NULL; 120 } 121 122 if (selected_non_eap) { 123 wpa_printf(MSG_ERROR, 124 "EAP-TTLS: Only one Phase2 type can be specified"); 125 eap_ttls_deinit(sm, data); 126 return NULL; 127 } 128 129 selected_non_eap = 1; 130 } 131 132 if (os_strstr(config->phase2, "autheap=")) { 133 if (selected_non_eap) { 134 wpa_printf(MSG_ERROR, 135 "EAP-TTLS: Both auth= and autheap= params cannot be specified"); 136 eap_ttls_deinit(sm, data); 137 return NULL; 138 } 139 selected = "EAP"; 140 data->phase2_type = EAP_TTLS_PHASE2_EAP; 141 } 142 } 143 144 wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase2 type: %s", selected); 145 146 if (data->phase2_type == EAP_TTLS_PHASE2_EAP) { 147 if (eap_peer_select_phase2_methods(config, "autheap=", 148 &data->phase2_eap_types, 149 &data->num_phase2_eap_types) 150 < 0) { 151 eap_ttls_deinit(sm, data); 152 return NULL; 153 } 154 155 data->phase2_eap_type.vendor = EAP_VENDOR_IETF; 156 data->phase2_eap_type.method = EAP_TYPE_NONE; 157 } 158 159 if (eap_peer_tls_ssl_init(sm, &data->ssl, config, EAP_TYPE_TTLS)) { 160 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to initialize SSL."); 161 eap_ttls_deinit(sm, data); 162 return NULL; 163 } 164 165 return data; 166 } 167 168 169 static void eap_ttls_phase2_eap_deinit(struct eap_sm *sm, 170 struct eap_ttls_data *data) 171 { 172 if (data->phase2_priv && data->phase2_method) { 173 data->phase2_method->deinit(sm, data->phase2_priv); 174 data->phase2_method = NULL; 175 data->phase2_priv = NULL; 176 } 177 } 178 179 180 static void eap_ttls_free_key(struct eap_ttls_data *data) 181 { 182 if (data->key_data) { 183 bin_clear_free(data->key_data, EAP_TLS_KEY_LEN + EAP_EMSK_LEN); 184 data->key_data = NULL; 185 } 186 } 187 188 189 static void eap_ttls_deinit(struct eap_sm *sm, void *priv) 190 { 191 struct eap_ttls_data *data = priv; 192 if (data == NULL) 193 return; 194 eap_ttls_phase2_eap_deinit(sm, data); 195 os_free(data->phase2_eap_types); 196 eap_peer_tls_ssl_deinit(sm, &data->ssl); 197 eap_ttls_free_key(data); 198 os_free(data->session_id); 199 wpabuf_free(data->pending_phase2_req); 200 wpabuf_free(data->pending_resp); 201 os_free(data); 202 } 203 204 205 static u8 * eap_ttls_avp_hdr(u8 *avphdr, u32 avp_code, u32 vendor_id, 206 int mandatory, size_t len) 207 { 208 struct ttls_avp_vendor *avp; 209 u8 flags; 210 size_t hdrlen; 211 212 avp = (struct ttls_avp_vendor *) avphdr; 213 flags = mandatory ? AVP_FLAGS_MANDATORY : 0; 214 if (vendor_id) { 215 flags |= AVP_FLAGS_VENDOR; 216 hdrlen = sizeof(*avp); 217 avp->vendor_id = host_to_be32(vendor_id); 218 } else { 219 hdrlen = sizeof(struct ttls_avp); 220 } 221 222 avp->avp_code = host_to_be32(avp_code); 223 avp->avp_length = host_to_be32(((u32) flags << 24) | 224 (u32) (hdrlen + len)); 225 226 return avphdr + hdrlen; 227 } 228 229 230 static u8 * eap_ttls_avp_add(u8 *start, u8 *avphdr, u32 avp_code, 231 u32 vendor_id, int mandatory, 232 const u8 *data, size_t len) 233 { 234 u8 *pos; 235 pos = eap_ttls_avp_hdr(avphdr, avp_code, vendor_id, mandatory, len); 236 os_memcpy(pos, data, len); 237 pos += len; 238 AVP_PAD(start, pos); 239 return pos; 240 } 241 242 243 static int eap_ttls_avp_encapsulate(struct wpabuf **resp, u32 avp_code, 244 int mandatory) 245 { 246 struct wpabuf *msg; 247 u8 *avp, *pos; 248 249 msg = wpabuf_alloc(sizeof(struct ttls_avp) + wpabuf_len(*resp) + 4); 250 if (msg == NULL) { 251 wpabuf_free(*resp); 252 *resp = NULL; 253 return -1; 254 } 255 256 avp = wpabuf_mhead(msg); 257 pos = eap_ttls_avp_hdr(avp, avp_code, 0, mandatory, wpabuf_len(*resp)); 258 os_memcpy(pos, wpabuf_head(*resp), wpabuf_len(*resp)); 259 pos += wpabuf_len(*resp); 260 AVP_PAD(avp, pos); 261 wpabuf_free(*resp); 262 wpabuf_put(msg, pos - avp); 263 *resp = msg; 264 return 0; 265 } 266 267 268 static int eap_ttls_v0_derive_key(struct eap_sm *sm, 269 struct eap_ttls_data *data) 270 { 271 eap_ttls_free_key(data); 272 data->key_data = eap_peer_tls_derive_key(sm, &data->ssl, 273 "ttls keying material", 274 EAP_TLS_KEY_LEN + 275 EAP_EMSK_LEN); 276 if (!data->key_data) { 277 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to derive key"); 278 return -1; 279 } 280 281 wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived key", 282 data->key_data, EAP_TLS_KEY_LEN); 283 wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived EMSK", 284 data->key_data + EAP_TLS_KEY_LEN, 285 EAP_EMSK_LEN); 286 287 os_free(data->session_id); 288 data->session_id = eap_peer_tls_derive_session_id(sm, &data->ssl, 289 EAP_TYPE_TTLS, 290 &data->id_len); 291 if (data->session_id) { 292 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Derived Session-Id", 293 data->session_id, data->id_len); 294 } else { 295 wpa_printf(MSG_ERROR, "EAP-TTLS: Failed to derive Session-Id"); 296 } 297 298 return 0; 299 } 300 301 302 #ifndef CONFIG_FIPS 303 static u8 * eap_ttls_implicit_challenge(struct eap_sm *sm, 304 struct eap_ttls_data *data, size_t len) 305 { 306 return eap_peer_tls_derive_key(sm, &data->ssl, "ttls challenge", len); 307 } 308 #endif /* CONFIG_FIPS */ 309 310 311 static void eap_ttls_phase2_select_eap_method(struct eap_ttls_data *data, 312 u8 method) 313 { 314 size_t i; 315 for (i = 0; i < data->num_phase2_eap_types; i++) { 316 if (data->phase2_eap_types[i].vendor != EAP_VENDOR_IETF || 317 data->phase2_eap_types[i].method != method) 318 continue; 319 320 data->phase2_eap_type.vendor = 321 data->phase2_eap_types[i].vendor; 322 data->phase2_eap_type.method = 323 data->phase2_eap_types[i].method; 324 wpa_printf(MSG_DEBUG, "EAP-TTLS: Selected " 325 "Phase 2 EAP vendor %d method %d", 326 data->phase2_eap_type.vendor, 327 data->phase2_eap_type.method); 328 break; 329 } 330 } 331 332 333 static int eap_ttls_phase2_eap_process(struct eap_sm *sm, 334 struct eap_ttls_data *data, 335 struct eap_method_ret *ret, 336 struct eap_hdr *hdr, size_t len, 337 struct wpabuf **resp) 338 { 339 struct wpabuf msg; 340 struct eap_method_ret iret; 341 342 os_memset(&iret, 0, sizeof(iret)); 343 wpabuf_set(&msg, hdr, len); 344 *resp = data->phase2_method->process(sm, data->phase2_priv, &iret, 345 &msg); 346 if ((iret.methodState == METHOD_DONE || 347 iret.methodState == METHOD_MAY_CONT) && 348 (iret.decision == DECISION_UNCOND_SUCC || 349 iret.decision == DECISION_COND_SUCC || 350 iret.decision == DECISION_FAIL)) { 351 ret->methodState = iret.methodState; 352 ret->decision = iret.decision; 353 } 354 355 return 0; 356 } 357 358 359 static int eap_ttls_phase2_request_eap_method(struct eap_sm *sm, 360 struct eap_ttls_data *data, 361 struct eap_method_ret *ret, 362 struct eap_hdr *hdr, size_t len, 363 u8 method, struct wpabuf **resp) 364 { 365 #ifdef EAP_TNC 366 if (data->tnc_started && data->phase2_method && 367 data->phase2_priv && method == EAP_TYPE_TNC && 368 data->phase2_eap_type.method == EAP_TYPE_TNC) 369 return eap_ttls_phase2_eap_process(sm, data, ret, hdr, len, 370 resp); 371 372 if (data->ready_for_tnc && !data->tnc_started && 373 method == EAP_TYPE_TNC) { 374 wpa_printf(MSG_DEBUG, "EAP-TTLS: Start TNC after completed " 375 "EAP method"); 376 data->tnc_started = 1; 377 } 378 379 if (data->tnc_started) { 380 if (data->phase2_eap_type.vendor != EAP_VENDOR_IETF || 381 data->phase2_eap_type.method == EAP_TYPE_TNC) { 382 wpa_printf(MSG_DEBUG, "EAP-TTLS: Unexpected EAP " 383 "type %d for TNC", method); 384 return -1; 385 } 386 387 data->phase2_eap_type.vendor = EAP_VENDOR_IETF; 388 data->phase2_eap_type.method = method; 389 wpa_printf(MSG_DEBUG, "EAP-TTLS: Selected " 390 "Phase 2 EAP vendor %d method %d (TNC)", 391 data->phase2_eap_type.vendor, 392 data->phase2_eap_type.method); 393 394 if (data->phase2_type == EAP_TTLS_PHASE2_EAP) 395 eap_ttls_phase2_eap_deinit(sm, data); 396 } 397 #endif /* EAP_TNC */ 398 399 if (data->phase2_eap_type.vendor == EAP_VENDOR_IETF && 400 data->phase2_eap_type.method == EAP_TYPE_NONE) 401 eap_ttls_phase2_select_eap_method(data, method); 402 403 if (method != data->phase2_eap_type.method || method == EAP_TYPE_NONE) 404 { 405 if (eap_peer_tls_phase2_nak(data->phase2_eap_types, 406 data->num_phase2_eap_types, 407 hdr, resp)) 408 return -1; 409 return 0; 410 } 411 412 if (data->phase2_priv == NULL) { 413 data->phase2_method = eap_peer_get_eap_method( 414 EAP_VENDOR_IETF, method); 415 if (data->phase2_method) { 416 sm->init_phase2 = 1; 417 data->phase2_priv = data->phase2_method->init(sm); 418 sm->init_phase2 = 0; 419 } 420 } 421 if (data->phase2_priv == NULL || data->phase2_method == NULL) { 422 wpa_printf(MSG_INFO, "EAP-TTLS: failed to initialize " 423 "Phase 2 EAP method %d", method); 424 return -1; 425 } 426 427 return eap_ttls_phase2_eap_process(sm, data, ret, hdr, len, resp); 428 } 429 430 431 static int eap_ttls_phase2_request_eap(struct eap_sm *sm, 432 struct eap_ttls_data *data, 433 struct eap_method_ret *ret, 434 struct eap_hdr *hdr, 435 struct wpabuf **resp) 436 { 437 size_t len = be_to_host16(hdr->length); 438 u8 *pos; 439 struct eap_peer_config *config = eap_get_config(sm); 440 441 if (len <= sizeof(struct eap_hdr)) { 442 wpa_printf(MSG_INFO, "EAP-TTLS: too short " 443 "Phase 2 request (len=%lu)", (unsigned long) len); 444 return -1; 445 } 446 pos = (u8 *) (hdr + 1); 447 wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 EAP Request: type=%d", *pos); 448 switch (*pos) { 449 case EAP_TYPE_IDENTITY: 450 *resp = eap_sm_buildIdentity(sm, hdr->identifier, 1); 451 break; 452 default: 453 if (eap_ttls_phase2_request_eap_method(sm, data, ret, hdr, len, 454 *pos, resp) < 0) 455 return -1; 456 break; 457 } 458 459 if (*resp == NULL && 460 (config->pending_req_identity || config->pending_req_password || 461 config->pending_req_otp || config->pending_req_sim)) { 462 return 0; 463 } 464 465 if (*resp == NULL) 466 return -1; 467 468 wpa_hexdump_buf(MSG_DEBUG, "EAP-TTLS: AVP encapsulate EAP Response", 469 *resp); 470 return eap_ttls_avp_encapsulate(resp, RADIUS_ATTR_EAP_MESSAGE, 1); 471 } 472 473 474 static int eap_ttls_phase2_request_mschapv2(struct eap_sm *sm, 475 struct eap_ttls_data *data, 476 struct eap_method_ret *ret, 477 struct wpabuf **resp) 478 { 479 #ifdef CONFIG_FIPS 480 wpa_printf(MSG_ERROR, "EAP-TTLS: MSCHAPV2 not supported in FIPS build"); 481 return -1; 482 #else /* CONFIG_FIPS */ 483 #ifdef EAP_MSCHAPv2 484 struct wpabuf *msg; 485 u8 *buf, *pos, *challenge, *peer_challenge; 486 const u8 *identity, *password; 487 size_t identity_len, password_len; 488 int pwhash; 489 490 wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 MSCHAPV2 Request"); 491 492 identity = eap_get_config_identity(sm, &identity_len); 493 password = eap_get_config_password2(sm, &password_len, &pwhash); 494 if (identity == NULL || password == NULL) 495 return -1; 496 497 msg = wpabuf_alloc(identity_len + 1000); 498 if (msg == NULL) { 499 wpa_printf(MSG_ERROR, 500 "EAP-TTLS/MSCHAPV2: Failed to allocate memory"); 501 return -1; 502 } 503 pos = buf = wpabuf_mhead(msg); 504 505 /* User-Name */ 506 pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1, 507 identity, identity_len); 508 509 /* MS-CHAP-Challenge */ 510 challenge = eap_ttls_implicit_challenge( 511 sm, data, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN + 1); 512 if (challenge == NULL) { 513 wpabuf_free(msg); 514 wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAPV2: Failed to derive " 515 "implicit challenge"); 516 return -1; 517 } 518 519 pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_MS_CHAP_CHALLENGE, 520 RADIUS_VENDOR_ID_MICROSOFT, 1, 521 challenge, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN); 522 523 /* MS-CHAP2-Response */ 524 pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP2_RESPONSE, 525 RADIUS_VENDOR_ID_MICROSOFT, 1, 526 EAP_TTLS_MSCHAPV2_RESPONSE_LEN); 527 data->ident = challenge[EAP_TTLS_MSCHAPV2_CHALLENGE_LEN]; 528 *pos++ = data->ident; 529 *pos++ = 0; /* Flags */ 530 if (os_get_random(pos, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN) < 0) { 531 os_free(challenge); 532 wpabuf_free(msg); 533 wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAPV2: Failed to get " 534 "random data for peer challenge"); 535 return -1; 536 } 537 peer_challenge = pos; 538 pos += EAP_TTLS_MSCHAPV2_CHALLENGE_LEN; 539 os_memset(pos, 0, 8); /* Reserved, must be zero */ 540 pos += 8; 541 if (mschapv2_derive_response(identity, identity_len, password, 542 password_len, pwhash, challenge, 543 peer_challenge, pos, data->auth_response, 544 data->master_key)) { 545 os_free(challenge); 546 wpabuf_free(msg); 547 wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAPV2: Failed to derive " 548 "response"); 549 return -1; 550 } 551 data->auth_response_valid = 1; 552 553 pos += 24; 554 os_free(challenge); 555 AVP_PAD(buf, pos); 556 557 wpabuf_put(msg, pos - buf); 558 *resp = msg; 559 560 return 0; 561 #else /* EAP_MSCHAPv2 */ 562 wpa_printf(MSG_ERROR, "EAP-TTLS: MSCHAPv2 not included in the build"); 563 return -1; 564 #endif /* EAP_MSCHAPv2 */ 565 #endif /* CONFIG_FIPS */ 566 } 567 568 569 static int eap_ttls_phase2_request_mschap(struct eap_sm *sm, 570 struct eap_ttls_data *data, 571 struct eap_method_ret *ret, 572 struct wpabuf **resp) 573 { 574 #ifdef CONFIG_FIPS 575 wpa_printf(MSG_ERROR, "EAP-TTLS: MSCHAP not supported in FIPS build"); 576 return -1; 577 #else /* CONFIG_FIPS */ 578 struct wpabuf *msg; 579 u8 *buf, *pos, *challenge; 580 const u8 *identity, *password; 581 size_t identity_len, password_len; 582 int pwhash; 583 584 wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 MSCHAP Request"); 585 586 identity = eap_get_config_identity(sm, &identity_len); 587 password = eap_get_config_password2(sm, &password_len, &pwhash); 588 if (identity == NULL || password == NULL) 589 return -1; 590 591 msg = wpabuf_alloc(identity_len + 1000); 592 if (msg == NULL) { 593 wpa_printf(MSG_ERROR, 594 "EAP-TTLS/MSCHAP: Failed to allocate memory"); 595 return -1; 596 } 597 pos = buf = wpabuf_mhead(msg); 598 599 /* User-Name */ 600 pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1, 601 identity, identity_len); 602 603 /* MS-CHAP-Challenge */ 604 challenge = eap_ttls_implicit_challenge( 605 sm, data, EAP_TTLS_MSCHAP_CHALLENGE_LEN + 1); 606 if (challenge == NULL) { 607 wpabuf_free(msg); 608 wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAP: Failed to derive " 609 "implicit challenge"); 610 return -1; 611 } 612 613 pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_MS_CHAP_CHALLENGE, 614 RADIUS_VENDOR_ID_MICROSOFT, 1, 615 challenge, EAP_TTLS_MSCHAP_CHALLENGE_LEN); 616 617 /* MS-CHAP-Response */ 618 pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP_RESPONSE, 619 RADIUS_VENDOR_ID_MICROSOFT, 1, 620 EAP_TTLS_MSCHAP_RESPONSE_LEN); 621 data->ident = challenge[EAP_TTLS_MSCHAP_CHALLENGE_LEN]; 622 *pos++ = data->ident; 623 *pos++ = 1; /* Flags: Use NT style passwords */ 624 os_memset(pos, 0, 24); /* LM-Response */ 625 pos += 24; 626 if (pwhash) { 627 /* NT-Response */ 628 if (challenge_response(challenge, password, pos)) { 629 wpa_printf(MSG_ERROR, 630 "EAP-TTLS/MSCHAP: Failed derive password hash"); 631 wpabuf_free(msg); 632 os_free(challenge); 633 return -1; 634 } 635 636 wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: MSCHAP password hash", 637 password, 16); 638 } else { 639 /* NT-Response */ 640 if (nt_challenge_response(challenge, password, password_len, 641 pos)) { 642 wpa_printf(MSG_ERROR, 643 "EAP-TTLS/MSCHAP: Failed derive password"); 644 wpabuf_free(msg); 645 os_free(challenge); 646 return -1; 647 } 648 649 wpa_hexdump_ascii_key(MSG_DEBUG, "EAP-TTLS: MSCHAP password", 650 password, password_len); 651 } 652 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAP implicit challenge", 653 challenge, EAP_TTLS_MSCHAP_CHALLENGE_LEN); 654 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAP response", pos, 24); 655 pos += 24; 656 os_free(challenge); 657 AVP_PAD(buf, pos); 658 659 wpabuf_put(msg, pos - buf); 660 *resp = msg; 661 662 /* EAP-TTLS/MSCHAP does not provide tunneled success 663 * notification, so assume that Phase2 succeeds. */ 664 ret->methodState = METHOD_DONE; 665 ret->decision = DECISION_COND_SUCC; 666 667 return 0; 668 #endif /* CONFIG_FIPS */ 669 } 670 671 672 static int eap_ttls_phase2_request_pap(struct eap_sm *sm, 673 struct eap_ttls_data *data, 674 struct eap_method_ret *ret, 675 struct wpabuf **resp) 676 { 677 struct wpabuf *msg; 678 u8 *buf, *pos; 679 size_t pad; 680 const u8 *identity, *password; 681 size_t identity_len, password_len; 682 683 wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 PAP Request"); 684 685 identity = eap_get_config_identity(sm, &identity_len); 686 password = eap_get_config_password(sm, &password_len); 687 if (identity == NULL || password == NULL) 688 return -1; 689 690 msg = wpabuf_alloc(identity_len + password_len + 100); 691 if (msg == NULL) { 692 wpa_printf(MSG_ERROR, 693 "EAP-TTLS/PAP: Failed to allocate memory"); 694 return -1; 695 } 696 pos = buf = wpabuf_mhead(msg); 697 698 /* User-Name */ 699 pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1, 700 identity, identity_len); 701 702 /* User-Password; in RADIUS, this is encrypted, but EAP-TTLS encrypts 703 * the data, so no separate encryption is used in the AVP itself. 704 * However, the password is padded to obfuscate its length. */ 705 pad = password_len == 0 ? 16 : (16 - (password_len & 15)) & 15; 706 pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_USER_PASSWORD, 0, 1, 707 password_len + pad); 708 os_memcpy(pos, password, password_len); 709 pos += password_len; 710 os_memset(pos, 0, pad); 711 pos += pad; 712 AVP_PAD(buf, pos); 713 714 wpabuf_put(msg, pos - buf); 715 *resp = msg; 716 717 /* EAP-TTLS/PAP does not provide tunneled success notification, 718 * so assume that Phase2 succeeds. */ 719 ret->methodState = METHOD_DONE; 720 ret->decision = DECISION_COND_SUCC; 721 722 return 0; 723 } 724 725 726 static int eap_ttls_phase2_request_chap(struct eap_sm *sm, 727 struct eap_ttls_data *data, 728 struct eap_method_ret *ret, 729 struct wpabuf **resp) 730 { 731 #ifdef CONFIG_FIPS 732 wpa_printf(MSG_ERROR, "EAP-TTLS: CHAP not supported in FIPS build"); 733 return -1; 734 #else /* CONFIG_FIPS */ 735 struct wpabuf *msg; 736 u8 *buf, *pos, *challenge; 737 const u8 *identity, *password; 738 size_t identity_len, password_len; 739 740 wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 CHAP Request"); 741 742 identity = eap_get_config_identity(sm, &identity_len); 743 password = eap_get_config_password(sm, &password_len); 744 if (identity == NULL || password == NULL) 745 return -1; 746 747 msg = wpabuf_alloc(identity_len + 1000); 748 if (msg == NULL) { 749 wpa_printf(MSG_ERROR, 750 "EAP-TTLS/CHAP: Failed to allocate memory"); 751 return -1; 752 } 753 pos = buf = wpabuf_mhead(msg); 754 755 /* User-Name */ 756 pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1, 757 identity, identity_len); 758 759 /* CHAP-Challenge */ 760 challenge = eap_ttls_implicit_challenge( 761 sm, data, EAP_TTLS_CHAP_CHALLENGE_LEN + 1); 762 if (challenge == NULL) { 763 wpabuf_free(msg); 764 wpa_printf(MSG_ERROR, "EAP-TTLS/CHAP: Failed to derive " 765 "implicit challenge"); 766 return -1; 767 } 768 769 pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_CHAP_CHALLENGE, 0, 1, 770 challenge, EAP_TTLS_CHAP_CHALLENGE_LEN); 771 772 /* CHAP-Password */ 773 pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_CHAP_PASSWORD, 0, 1, 774 1 + EAP_TTLS_CHAP_PASSWORD_LEN); 775 data->ident = challenge[EAP_TTLS_CHAP_CHALLENGE_LEN]; 776 *pos++ = data->ident; 777 778 /* MD5(Ident + Password + Challenge) */ 779 chap_md5(data->ident, password, password_len, challenge, 780 EAP_TTLS_CHAP_CHALLENGE_LEN, pos); 781 782 wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: CHAP username", 783 identity, identity_len); 784 wpa_hexdump_ascii_key(MSG_DEBUG, "EAP-TTLS: CHAP password", 785 password, password_len); 786 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: CHAP implicit challenge", 787 challenge, EAP_TTLS_CHAP_CHALLENGE_LEN); 788 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: CHAP password", 789 pos, EAP_TTLS_CHAP_PASSWORD_LEN); 790 pos += EAP_TTLS_CHAP_PASSWORD_LEN; 791 os_free(challenge); 792 AVP_PAD(buf, pos); 793 794 wpabuf_put(msg, pos - buf); 795 *resp = msg; 796 797 /* EAP-TTLS/CHAP does not provide tunneled success 798 * notification, so assume that Phase2 succeeds. */ 799 ret->methodState = METHOD_DONE; 800 ret->decision = DECISION_COND_SUCC; 801 802 return 0; 803 #endif /* CONFIG_FIPS */ 804 } 805 806 807 static int eap_ttls_phase2_request(struct eap_sm *sm, 808 struct eap_ttls_data *data, 809 struct eap_method_ret *ret, 810 struct eap_hdr *hdr, 811 struct wpabuf **resp) 812 { 813 int res = 0; 814 size_t len; 815 enum phase2_types phase2_type = data->phase2_type; 816 817 #ifdef EAP_TNC 818 if (data->tnc_started) { 819 wpa_printf(MSG_DEBUG, "EAP-TTLS: Processing TNC"); 820 phase2_type = EAP_TTLS_PHASE2_EAP; 821 } 822 #endif /* EAP_TNC */ 823 824 if (phase2_type == EAP_TTLS_PHASE2_MSCHAPV2 || 825 phase2_type == EAP_TTLS_PHASE2_MSCHAP || 826 phase2_type == EAP_TTLS_PHASE2_PAP || 827 phase2_type == EAP_TTLS_PHASE2_CHAP) { 828 if (eap_get_config_identity(sm, &len) == NULL) { 829 wpa_printf(MSG_INFO, 830 "EAP-TTLS: Identity not configured"); 831 eap_sm_request_identity(sm); 832 if (eap_get_config_password(sm, &len) == NULL) 833 eap_sm_request_password(sm); 834 return 0; 835 } 836 837 if (eap_get_config_password(sm, &len) == NULL) { 838 wpa_printf(MSG_INFO, 839 "EAP-TTLS: Password not configured"); 840 eap_sm_request_password(sm); 841 return 0; 842 } 843 } 844 845 switch (phase2_type) { 846 case EAP_TTLS_PHASE2_EAP: 847 res = eap_ttls_phase2_request_eap(sm, data, ret, hdr, resp); 848 break; 849 case EAP_TTLS_PHASE2_MSCHAPV2: 850 res = eap_ttls_phase2_request_mschapv2(sm, data, ret, resp); 851 break; 852 case EAP_TTLS_PHASE2_MSCHAP: 853 res = eap_ttls_phase2_request_mschap(sm, data, ret, resp); 854 break; 855 case EAP_TTLS_PHASE2_PAP: 856 res = eap_ttls_phase2_request_pap(sm, data, ret, resp); 857 break; 858 case EAP_TTLS_PHASE2_CHAP: 859 res = eap_ttls_phase2_request_chap(sm, data, ret, resp); 860 break; 861 default: 862 wpa_printf(MSG_ERROR, "EAP-TTLS: Phase 2 - Unknown"); 863 res = -1; 864 break; 865 } 866 867 if (res < 0) { 868 ret->methodState = METHOD_DONE; 869 ret->decision = DECISION_FAIL; 870 } 871 872 return res; 873 } 874 875 876 struct ttls_parse_avp { 877 u8 *mschapv2; 878 u8 *eapdata; 879 size_t eap_len; 880 int mschapv2_error; 881 }; 882 883 884 static int eap_ttls_parse_attr_eap(const u8 *dpos, size_t dlen, 885 struct ttls_parse_avp *parse) 886 { 887 wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP - EAP Message"); 888 if (parse->eapdata == NULL) { 889 parse->eapdata = os_memdup(dpos, dlen); 890 if (parse->eapdata == NULL) { 891 wpa_printf(MSG_WARNING, "EAP-TTLS: Failed to allocate " 892 "memory for Phase 2 EAP data"); 893 return -1; 894 } 895 parse->eap_len = dlen; 896 } else { 897 u8 *neweap = os_realloc(parse->eapdata, parse->eap_len + dlen); 898 if (neweap == NULL) { 899 wpa_printf(MSG_WARNING, "EAP-TTLS: Failed to allocate " 900 "memory for Phase 2 EAP data"); 901 return -1; 902 } 903 os_memcpy(neweap + parse->eap_len, dpos, dlen); 904 parse->eapdata = neweap; 905 parse->eap_len += dlen; 906 } 907 908 return 0; 909 } 910 911 912 static int eap_ttls_parse_avp(u8 *pos, size_t left, 913 struct ttls_parse_avp *parse) 914 { 915 struct ttls_avp *avp; 916 u32 avp_code, avp_length, vendor_id = 0; 917 u8 avp_flags, *dpos; 918 size_t dlen; 919 920 avp = (struct ttls_avp *) pos; 921 avp_code = be_to_host32(avp->avp_code); 922 avp_length = be_to_host32(avp->avp_length); 923 avp_flags = (avp_length >> 24) & 0xff; 924 avp_length &= 0xffffff; 925 wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP: code=%d flags=0x%02x " 926 "length=%d", (int) avp_code, avp_flags, 927 (int) avp_length); 928 929 if (avp_length > left) { 930 wpa_printf(MSG_WARNING, "EAP-TTLS: AVP overflow " 931 "(len=%d, left=%lu) - dropped", 932 (int) avp_length, (unsigned long) left); 933 return -1; 934 } 935 936 if (avp_length < sizeof(*avp)) { 937 wpa_printf(MSG_WARNING, "EAP-TTLS: Invalid AVP length %d", 938 avp_length); 939 return -1; 940 } 941 942 dpos = (u8 *) (avp + 1); 943 dlen = avp_length - sizeof(*avp); 944 if (avp_flags & AVP_FLAGS_VENDOR) { 945 if (dlen < 4) { 946 wpa_printf(MSG_WARNING, "EAP-TTLS: Vendor AVP " 947 "underflow"); 948 return -1; 949 } 950 vendor_id = WPA_GET_BE32(dpos); 951 wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP vendor_id %d", 952 (int) vendor_id); 953 dpos += 4; 954 dlen -= 4; 955 } 956 957 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: AVP data", dpos, dlen); 958 959 if (vendor_id == 0 && avp_code == RADIUS_ATTR_EAP_MESSAGE) { 960 if (eap_ttls_parse_attr_eap(dpos, dlen, parse) < 0) 961 return -1; 962 } else if (vendor_id == 0 && avp_code == RADIUS_ATTR_REPLY_MESSAGE) { 963 /* This is an optional message that can be displayed to 964 * the user. */ 965 wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: AVP - Reply-Message", 966 dpos, dlen); 967 } else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT && 968 avp_code == RADIUS_ATTR_MS_CHAP2_SUCCESS) { 969 wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: MS-CHAP2-Success", 970 dpos, dlen); 971 if (dlen != 43) { 972 wpa_printf(MSG_WARNING, "EAP-TTLS: Unexpected " 973 "MS-CHAP2-Success length " 974 "(len=%lu, expected 43)", 975 (unsigned long) dlen); 976 return -1; 977 } 978 parse->mschapv2 = dpos; 979 } else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT && 980 avp_code == RADIUS_ATTR_MS_CHAP_ERROR) { 981 wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: MS-CHAP-Error", 982 dpos, dlen); 983 parse->mschapv2_error = 1; 984 } else if (avp_flags & AVP_FLAGS_MANDATORY) { 985 wpa_printf(MSG_WARNING, "EAP-TTLS: Unsupported mandatory AVP " 986 "code %d vendor_id %d - dropped", 987 (int) avp_code, (int) vendor_id); 988 return -1; 989 } else { 990 wpa_printf(MSG_DEBUG, "EAP-TTLS: Ignoring unsupported AVP " 991 "code %d vendor_id %d", 992 (int) avp_code, (int) vendor_id); 993 } 994 995 return avp_length; 996 } 997 998 999 static int eap_ttls_parse_avps(struct wpabuf *in_decrypted, 1000 struct ttls_parse_avp *parse) 1001 { 1002 u8 *pos; 1003 size_t left, pad; 1004 int avp_length; 1005 1006 pos = wpabuf_mhead(in_decrypted); 1007 left = wpabuf_len(in_decrypted); 1008 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Decrypted Phase 2 AVPs", pos, left); 1009 if (left < sizeof(struct ttls_avp)) { 1010 wpa_printf(MSG_WARNING, "EAP-TTLS: Too short Phase 2 AVP frame" 1011 " len=%lu expected %lu or more - dropped", 1012 (unsigned long) left, 1013 (unsigned long) sizeof(struct ttls_avp)); 1014 return -1; 1015 } 1016 1017 /* Parse AVPs */ 1018 os_memset(parse, 0, sizeof(*parse)); 1019 1020 while (left > 0) { 1021 avp_length = eap_ttls_parse_avp(pos, left, parse); 1022 if (avp_length < 0) 1023 return -1; 1024 1025 pad = (4 - (avp_length & 3)) & 3; 1026 pos += avp_length + pad; 1027 if (left < avp_length + pad) 1028 left = 0; 1029 else 1030 left -= avp_length + pad; 1031 } 1032 1033 return 0; 1034 } 1035 1036 1037 static u8 * eap_ttls_fake_identity_request(void) 1038 { 1039 struct eap_hdr *hdr; 1040 u8 *buf; 1041 1042 wpa_printf(MSG_DEBUG, "EAP-TTLS: empty data in beginning of " 1043 "Phase 2 - use fake EAP-Request Identity"); 1044 buf = os_malloc(sizeof(*hdr) + 1); 1045 if (buf == NULL) { 1046 wpa_printf(MSG_WARNING, "EAP-TTLS: failed to allocate " 1047 "memory for fake EAP-Identity Request"); 1048 return NULL; 1049 } 1050 1051 hdr = (struct eap_hdr *) buf; 1052 hdr->code = EAP_CODE_REQUEST; 1053 hdr->identifier = 0; 1054 hdr->length = host_to_be16(sizeof(*hdr) + 1); 1055 buf[sizeof(*hdr)] = EAP_TYPE_IDENTITY; 1056 1057 return buf; 1058 } 1059 1060 1061 static int eap_ttls_encrypt_response(struct eap_sm *sm, 1062 struct eap_ttls_data *data, 1063 struct wpabuf *resp, u8 identifier, 1064 struct wpabuf **out_data) 1065 { 1066 if (resp == NULL) 1067 return 0; 1068 1069 wpa_hexdump_buf_key(MSG_DEBUG, "EAP-TTLS: Encrypting Phase 2 data", 1070 resp); 1071 if (eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_TTLS, 1072 data->ttls_version, identifier, 1073 resp, out_data)) { 1074 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to encrypt a Phase 2 " 1075 "frame"); 1076 wpabuf_free(resp); 1077 return -1; 1078 } 1079 wpabuf_free(resp); 1080 1081 return 0; 1082 } 1083 1084 1085 static int eap_ttls_process_phase2_eap(struct eap_sm *sm, 1086 struct eap_ttls_data *data, 1087 struct eap_method_ret *ret, 1088 struct ttls_parse_avp *parse, 1089 struct wpabuf **resp) 1090 { 1091 struct eap_hdr *hdr; 1092 size_t len; 1093 1094 if (parse->eapdata == NULL) { 1095 wpa_printf(MSG_WARNING, "EAP-TTLS: No EAP Message in the " 1096 "packet - dropped"); 1097 return -1; 1098 } 1099 1100 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Phase 2 EAP", 1101 parse->eapdata, parse->eap_len); 1102 hdr = (struct eap_hdr *) parse->eapdata; 1103 1104 if (parse->eap_len < sizeof(*hdr)) { 1105 wpa_printf(MSG_WARNING, "EAP-TTLS: Too short Phase 2 EAP " 1106 "frame (len=%lu, expected %lu or more) - dropped", 1107 (unsigned long) parse->eap_len, 1108 (unsigned long) sizeof(*hdr)); 1109 return -1; 1110 } 1111 len = be_to_host16(hdr->length); 1112 if (len > parse->eap_len) { 1113 wpa_printf(MSG_INFO, "EAP-TTLS: Length mismatch in Phase 2 " 1114 "EAP frame (EAP hdr len=%lu, EAP data len in " 1115 "AVP=%lu)", 1116 (unsigned long) len, 1117 (unsigned long) parse->eap_len); 1118 return -1; 1119 } 1120 wpa_printf(MSG_DEBUG, "EAP-TTLS: received Phase 2: code=%d " 1121 "identifier=%d length=%lu", 1122 hdr->code, hdr->identifier, (unsigned long) len); 1123 switch (hdr->code) { 1124 case EAP_CODE_REQUEST: 1125 if (eap_ttls_phase2_request(sm, data, ret, hdr, resp)) { 1126 wpa_printf(MSG_INFO, "EAP-TTLS: Phase2 Request " 1127 "processing failed"); 1128 return -1; 1129 } 1130 break; 1131 default: 1132 wpa_printf(MSG_INFO, "EAP-TTLS: Unexpected code=%d in " 1133 "Phase 2 EAP header", hdr->code); 1134 return -1; 1135 } 1136 1137 return 0; 1138 } 1139 1140 1141 static int eap_ttls_process_phase2_mschapv2(struct eap_sm *sm, 1142 struct eap_ttls_data *data, 1143 struct eap_method_ret *ret, 1144 struct ttls_parse_avp *parse) 1145 { 1146 #ifdef EAP_MSCHAPv2 1147 if (parse->mschapv2_error) { 1148 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Received " 1149 "MS-CHAP-Error - failed"); 1150 ret->methodState = METHOD_DONE; 1151 ret->decision = DECISION_FAIL; 1152 /* Reply with empty data to ACK error */ 1153 return 1; 1154 } 1155 1156 if (parse->mschapv2 == NULL) { 1157 #ifdef EAP_TNC 1158 if (data->phase2_success && parse->eapdata) { 1159 /* 1160 * Allow EAP-TNC to be started after successfully 1161 * completed MSCHAPV2. 1162 */ 1163 return 1; 1164 } 1165 #endif /* EAP_TNC */ 1166 wpa_printf(MSG_WARNING, "EAP-TTLS: no MS-CHAP2-Success AVP " 1167 "received for Phase2 MSCHAPV2"); 1168 return -1; 1169 } 1170 if (parse->mschapv2[0] != data->ident) { 1171 wpa_printf(MSG_WARNING, "EAP-TTLS: Ident mismatch for Phase 2 " 1172 "MSCHAPV2 (received Ident 0x%02x, expected 0x%02x)", 1173 parse->mschapv2[0], data->ident); 1174 return -1; 1175 } 1176 if (!data->auth_response_valid || 1177 mschapv2_verify_auth_response(data->auth_response, 1178 parse->mschapv2 + 1, 42)) { 1179 wpa_printf(MSG_WARNING, "EAP-TTLS: Invalid authenticator " 1180 "response in Phase 2 MSCHAPV2 success request"); 1181 return -1; 1182 } 1183 1184 wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 MSCHAPV2 " 1185 "authentication succeeded"); 1186 ret->methodState = METHOD_DONE; 1187 ret->decision = DECISION_UNCOND_SUCC; 1188 data->phase2_success = 1; 1189 1190 /* 1191 * Reply with empty data; authentication server will reply 1192 * with EAP-Success after this. 1193 */ 1194 return 1; 1195 #else /* EAP_MSCHAPv2 */ 1196 wpa_printf(MSG_ERROR, "EAP-TTLS: MSCHAPv2 not included in the build"); 1197 return -1; 1198 #endif /* EAP_MSCHAPv2 */ 1199 } 1200 1201 1202 #ifdef EAP_TNC 1203 static int eap_ttls_process_tnc_start(struct eap_sm *sm, 1204 struct eap_ttls_data *data, 1205 struct eap_method_ret *ret, 1206 struct ttls_parse_avp *parse, 1207 struct wpabuf **resp) 1208 { 1209 /* TNC uses inner EAP method after non-EAP TTLS phase 2. */ 1210 if (parse->eapdata == NULL) { 1211 wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received " 1212 "unexpected tunneled data (no EAP)"); 1213 return -1; 1214 } 1215 1216 if (!data->ready_for_tnc) { 1217 wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received " 1218 "EAP after non-EAP, but not ready for TNC"); 1219 return -1; 1220 } 1221 1222 wpa_printf(MSG_DEBUG, "EAP-TTLS: Start TNC after completed " 1223 "non-EAP method"); 1224 data->tnc_started = 1; 1225 1226 if (eap_ttls_process_phase2_eap(sm, data, ret, parse, resp) < 0) 1227 return -1; 1228 1229 return 0; 1230 } 1231 #endif /* EAP_TNC */ 1232 1233 1234 static int eap_ttls_process_decrypted(struct eap_sm *sm, 1235 struct eap_ttls_data *data, 1236 struct eap_method_ret *ret, 1237 u8 identifier, 1238 struct ttls_parse_avp *parse, 1239 struct wpabuf *in_decrypted, 1240 struct wpabuf **out_data) 1241 { 1242 struct wpabuf *resp = NULL; 1243 struct eap_peer_config *config = eap_get_config(sm); 1244 int res; 1245 enum phase2_types phase2_type = data->phase2_type; 1246 1247 #ifdef EAP_TNC 1248 if (data->tnc_started) 1249 phase2_type = EAP_TTLS_PHASE2_EAP; 1250 #endif /* EAP_TNC */ 1251 1252 switch (phase2_type) { 1253 case EAP_TTLS_PHASE2_EAP: 1254 if (eap_ttls_process_phase2_eap(sm, data, ret, parse, &resp) < 1255 0) 1256 return -1; 1257 break; 1258 case EAP_TTLS_PHASE2_MSCHAPV2: 1259 res = eap_ttls_process_phase2_mschapv2(sm, data, ret, parse); 1260 #ifdef EAP_TNC 1261 if (res == 1 && parse->eapdata && data->phase2_success) { 1262 /* 1263 * TNC may be required as the next 1264 * authentication method within the tunnel. 1265 */ 1266 ret->methodState = METHOD_MAY_CONT; 1267 data->ready_for_tnc = 1; 1268 if (eap_ttls_process_tnc_start(sm, data, ret, parse, 1269 &resp) == 0) 1270 break; 1271 } 1272 #endif /* EAP_TNC */ 1273 return res; 1274 case EAP_TTLS_PHASE2_MSCHAP: 1275 case EAP_TTLS_PHASE2_PAP: 1276 case EAP_TTLS_PHASE2_CHAP: 1277 #ifdef EAP_TNC 1278 if (eap_ttls_process_tnc_start(sm, data, ret, parse, &resp) < 1279 0) 1280 return -1; 1281 break; 1282 #else /* EAP_TNC */ 1283 /* EAP-TTLS/{MSCHAP,PAP,CHAP} should not send any TLS tunneled 1284 * requests to the supplicant */ 1285 wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received unexpected " 1286 "tunneled data"); 1287 return -1; 1288 #endif /* EAP_TNC */ 1289 } 1290 1291 if (resp) { 1292 if (eap_ttls_encrypt_response(sm, data, resp, identifier, 1293 out_data) < 0) 1294 return -1; 1295 } else if (config->pending_req_identity || 1296 config->pending_req_password || 1297 config->pending_req_otp || 1298 config->pending_req_new_password || 1299 config->pending_req_sim) { 1300 wpabuf_free(data->pending_phase2_req); 1301 data->pending_phase2_req = wpabuf_dup(in_decrypted); 1302 } 1303 1304 return 0; 1305 } 1306 1307 1308 static int eap_ttls_implicit_identity_request(struct eap_sm *sm, 1309 struct eap_ttls_data *data, 1310 struct eap_method_ret *ret, 1311 u8 identifier, 1312 struct wpabuf **out_data) 1313 { 1314 int retval = 0; 1315 struct eap_hdr *hdr; 1316 struct wpabuf *resp; 1317 1318 hdr = (struct eap_hdr *) eap_ttls_fake_identity_request(); 1319 if (hdr == NULL) { 1320 ret->methodState = METHOD_DONE; 1321 ret->decision = DECISION_FAIL; 1322 return -1; 1323 } 1324 1325 resp = NULL; 1326 if (eap_ttls_phase2_request(sm, data, ret, hdr, &resp)) { 1327 wpa_printf(MSG_INFO, "EAP-TTLS: Phase2 Request " 1328 "processing failed"); 1329 retval = -1; 1330 } else { 1331 struct eap_peer_config *config = eap_get_config(sm); 1332 if (resp == NULL && 1333 (config->pending_req_identity || 1334 config->pending_req_password || 1335 config->pending_req_otp || 1336 config->pending_req_new_password || 1337 config->pending_req_sim)) { 1338 /* 1339 * Use empty buffer to force implicit request 1340 * processing when EAP request is re-processed after 1341 * user input. 1342 */ 1343 wpabuf_free(data->pending_phase2_req); 1344 data->pending_phase2_req = wpabuf_alloc(0); 1345 } 1346 1347 retval = eap_ttls_encrypt_response(sm, data, resp, identifier, 1348 out_data); 1349 } 1350 1351 os_free(hdr); 1352 1353 if (retval < 0) { 1354 ret->methodState = METHOD_DONE; 1355 ret->decision = DECISION_FAIL; 1356 } 1357 1358 return retval; 1359 } 1360 1361 1362 static int eap_ttls_phase2_start(struct eap_sm *sm, struct eap_ttls_data *data, 1363 struct eap_method_ret *ret, u8 identifier, 1364 struct wpabuf **out_data) 1365 { 1366 data->phase2_start = 0; 1367 1368 /* 1369 * EAP-TTLS does not use Phase2 on fast re-auth; this must be done only 1370 * if TLS part was indeed resuming a previous session. Most 1371 * Authentication Servers terminate EAP-TTLS before reaching this 1372 * point, but some do not. Make wpa_supplicant stop phase 2 here, if 1373 * needed. 1374 */ 1375 if (data->reauth && 1376 tls_connection_resumed(sm->ssl_ctx, data->ssl.conn)) { 1377 wpa_printf(MSG_DEBUG, "EAP-TTLS: Session resumption - " 1378 "skip phase 2"); 1379 *out_data = eap_peer_tls_build_ack(identifier, EAP_TYPE_TTLS, 1380 data->ttls_version); 1381 ret->methodState = METHOD_DONE; 1382 ret->decision = DECISION_UNCOND_SUCC; 1383 data->phase2_success = 1; 1384 return 0; 1385 } 1386 1387 return eap_ttls_implicit_identity_request(sm, data, ret, identifier, 1388 out_data); 1389 } 1390 1391 1392 static int eap_ttls_decrypt(struct eap_sm *sm, struct eap_ttls_data *data, 1393 struct eap_method_ret *ret, u8 identifier, 1394 const struct wpabuf *in_data, 1395 struct wpabuf **out_data) 1396 { 1397 struct wpabuf *in_decrypted = NULL; 1398 int retval = 0; 1399 struct ttls_parse_avp parse; 1400 1401 os_memset(&parse, 0, sizeof(parse)); 1402 1403 wpa_printf(MSG_DEBUG, "EAP-TTLS: received %lu bytes encrypted data for" 1404 " Phase 2", 1405 in_data ? (unsigned long) wpabuf_len(in_data) : 0); 1406 1407 if (data->pending_phase2_req) { 1408 wpa_printf(MSG_DEBUG, "EAP-TTLS: Pending Phase 2 request - " 1409 "skip decryption and use old data"); 1410 /* Clear TLS reassembly state. */ 1411 eap_peer_tls_reset_input(&data->ssl); 1412 1413 in_decrypted = data->pending_phase2_req; 1414 data->pending_phase2_req = NULL; 1415 if (wpabuf_len(in_decrypted) == 0) { 1416 wpabuf_free(in_decrypted); 1417 return eap_ttls_implicit_identity_request( 1418 sm, data, ret, identifier, out_data); 1419 } 1420 goto continue_req; 1421 } 1422 1423 if ((in_data == NULL || wpabuf_len(in_data) == 0) && 1424 data->phase2_start) { 1425 return eap_ttls_phase2_start(sm, data, ret, identifier, 1426 out_data); 1427 } 1428 1429 if (in_data == NULL || wpabuf_len(in_data) == 0) { 1430 /* Received TLS ACK - requesting more fragments */ 1431 return eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_TTLS, 1432 data->ttls_version, 1433 identifier, NULL, out_data); 1434 } 1435 1436 retval = eap_peer_tls_decrypt(sm, &data->ssl, in_data, &in_decrypted); 1437 if (retval) 1438 goto done; 1439 1440 continue_req: 1441 data->phase2_start = 0; 1442 1443 if (eap_ttls_parse_avps(in_decrypted, &parse) < 0) { 1444 retval = -1; 1445 goto done; 1446 } 1447 1448 retval = eap_ttls_process_decrypted(sm, data, ret, identifier, 1449 &parse, in_decrypted, out_data); 1450 1451 done: 1452 wpabuf_free(in_decrypted); 1453 os_free(parse.eapdata); 1454 1455 if (retval < 0) { 1456 ret->methodState = METHOD_DONE; 1457 ret->decision = DECISION_FAIL; 1458 } 1459 1460 return retval; 1461 } 1462 1463 1464 static int eap_ttls_process_handshake(struct eap_sm *sm, 1465 struct eap_ttls_data *data, 1466 struct eap_method_ret *ret, 1467 u8 identifier, 1468 const struct wpabuf *in_data, 1469 struct wpabuf **out_data) 1470 { 1471 int res; 1472 1473 if (sm->waiting_ext_cert_check && data->pending_resp) { 1474 struct eap_peer_config *config = eap_get_config(sm); 1475 1476 if (config->pending_ext_cert_check == EXT_CERT_CHECK_GOOD) { 1477 wpa_printf(MSG_DEBUG, 1478 "EAP-TTLS: External certificate check succeeded - continue handshake"); 1479 *out_data = data->pending_resp; 1480 data->pending_resp = NULL; 1481 sm->waiting_ext_cert_check = 0; 1482 return 0; 1483 } 1484 1485 if (config->pending_ext_cert_check == EXT_CERT_CHECK_BAD) { 1486 wpa_printf(MSG_DEBUG, 1487 "EAP-TTLS: External certificate check failed - force authentication failure"); 1488 ret->methodState = METHOD_DONE; 1489 ret->decision = DECISION_FAIL; 1490 sm->waiting_ext_cert_check = 0; 1491 return 0; 1492 } 1493 1494 wpa_printf(MSG_DEBUG, 1495 "EAP-TTLS: Continuing to wait external server certificate validation"); 1496 return 0; 1497 } 1498 1499 res = eap_peer_tls_process_helper(sm, &data->ssl, EAP_TYPE_TTLS, 1500 data->ttls_version, identifier, 1501 in_data, out_data); 1502 if (res < 0) { 1503 wpa_printf(MSG_DEBUG, "EAP-TTLS: TLS processing failed"); 1504 ret->methodState = METHOD_DONE; 1505 ret->decision = DECISION_FAIL; 1506 return -1; 1507 } 1508 1509 if (sm->waiting_ext_cert_check) { 1510 wpa_printf(MSG_DEBUG, 1511 "EAP-TTLS: Waiting external server certificate validation"); 1512 wpabuf_free(data->pending_resp); 1513 data->pending_resp = *out_data; 1514 *out_data = NULL; 1515 return 0; 1516 } 1517 1518 if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) { 1519 wpa_printf(MSG_DEBUG, "EAP-TTLS: TLS done, proceed to " 1520 "Phase 2"); 1521 if (data->resuming) { 1522 wpa_printf(MSG_DEBUG, "EAP-TTLS: fast reauth - may " 1523 "skip Phase 2"); 1524 ret->decision = DECISION_COND_SUCC; 1525 ret->methodState = METHOD_MAY_CONT; 1526 } 1527 data->phase2_start = 1; 1528 eap_ttls_v0_derive_key(sm, data); 1529 1530 if (*out_data == NULL || wpabuf_len(*out_data) == 0) { 1531 if (eap_ttls_decrypt(sm, data, ret, identifier, 1532 NULL, out_data)) { 1533 wpa_printf(MSG_WARNING, "EAP-TTLS: " 1534 "failed to process early " 1535 "start for Phase 2"); 1536 } 1537 res = 0; 1538 } 1539 data->resuming = 0; 1540 } 1541 1542 if (res == 2) { 1543 /* 1544 * Application data included in the handshake message. 1545 */ 1546 wpabuf_free(data->pending_phase2_req); 1547 data->pending_phase2_req = *out_data; 1548 *out_data = NULL; 1549 res = eap_ttls_decrypt(sm, data, ret, identifier, in_data, 1550 out_data); 1551 } 1552 1553 return res; 1554 } 1555 1556 1557 static void eap_ttls_check_auth_status(struct eap_sm *sm, 1558 struct eap_ttls_data *data, 1559 struct eap_method_ret *ret) 1560 { 1561 if (ret->methodState == METHOD_DONE) { 1562 ret->allowNotifications = FALSE; 1563 if (ret->decision == DECISION_UNCOND_SUCC || 1564 ret->decision == DECISION_COND_SUCC) { 1565 wpa_printf(MSG_DEBUG, "EAP-TTLS: Authentication " 1566 "completed successfully"); 1567 data->phase2_success = 1; 1568 data->decision_succ = ret->decision; 1569 #ifdef EAP_TNC 1570 if (!data->ready_for_tnc && !data->tnc_started) { 1571 /* 1572 * TNC may be required as the next 1573 * authentication method within the tunnel. 1574 */ 1575 ret->methodState = METHOD_MAY_CONT; 1576 data->ready_for_tnc = 1; 1577 } 1578 #endif /* EAP_TNC */ 1579 } 1580 } else if (ret->methodState == METHOD_MAY_CONT && 1581 (ret->decision == DECISION_UNCOND_SUCC || 1582 ret->decision == DECISION_COND_SUCC)) { 1583 wpa_printf(MSG_DEBUG, "EAP-TTLS: Authentication " 1584 "completed successfully (MAY_CONT)"); 1585 data->phase2_success = 1; 1586 data->decision_succ = ret->decision; 1587 } else if (data->decision_succ != DECISION_FAIL && 1588 data->phase2_success && 1589 !data->ssl.tls_out) { 1590 /* 1591 * This is needed to cover the case where the final Phase 2 1592 * message gets fragmented since fragmentation clears 1593 * decision back to FAIL. 1594 */ 1595 wpa_printf(MSG_DEBUG, 1596 "EAP-TTLS: Restore success decision after fragmented frame sent completely"); 1597 ret->decision = data->decision_succ; 1598 } 1599 } 1600 1601 1602 static struct wpabuf * eap_ttls_process(struct eap_sm *sm, void *priv, 1603 struct eap_method_ret *ret, 1604 const struct wpabuf *reqData) 1605 { 1606 size_t left; 1607 int res; 1608 u8 flags, id; 1609 struct wpabuf *resp; 1610 const u8 *pos; 1611 struct eap_ttls_data *data = priv; 1612 struct wpabuf msg; 1613 1614 pos = eap_peer_tls_process_init(sm, &data->ssl, EAP_TYPE_TTLS, ret, 1615 reqData, &left, &flags); 1616 if (pos == NULL) 1617 return NULL; 1618 id = eap_get_id(reqData); 1619 1620 if (flags & EAP_TLS_FLAGS_START) { 1621 wpa_printf(MSG_DEBUG, "EAP-TTLS: Start (server ver=%d, own " 1622 "ver=%d)", flags & EAP_TLS_VERSION_MASK, 1623 data->ttls_version); 1624 1625 /* RFC 5281, Ch. 9.2: 1626 * "This packet MAY contain additional information in the form 1627 * of AVPs, which may provide useful hints to the client" 1628 * For now, ignore any potential extra data. 1629 */ 1630 left = 0; 1631 } 1632 1633 wpabuf_set(&msg, pos, left); 1634 1635 resp = NULL; 1636 if (tls_connection_established(sm->ssl_ctx, data->ssl.conn) && 1637 !data->resuming) { 1638 res = eap_ttls_decrypt(sm, data, ret, id, &msg, &resp); 1639 } else { 1640 res = eap_ttls_process_handshake(sm, data, ret, id, 1641 &msg, &resp); 1642 } 1643 1644 eap_ttls_check_auth_status(sm, data, ret); 1645 1646 /* FIX: what about res == -1? Could just move all error processing into 1647 * the other functions and get rid of this res==1 case here. */ 1648 if (res == 1) { 1649 wpabuf_free(resp); 1650 return eap_peer_tls_build_ack(id, EAP_TYPE_TTLS, 1651 data->ttls_version); 1652 } 1653 return resp; 1654 } 1655 1656 1657 static Boolean eap_ttls_has_reauth_data(struct eap_sm *sm, void *priv) 1658 { 1659 struct eap_ttls_data *data = priv; 1660 return tls_connection_established(sm->ssl_ctx, data->ssl.conn) && 1661 data->phase2_success; 1662 } 1663 1664 1665 static void eap_ttls_deinit_for_reauth(struct eap_sm *sm, void *priv) 1666 { 1667 struct eap_ttls_data *data = priv; 1668 1669 if (data->phase2_priv && data->phase2_method && 1670 data->phase2_method->deinit_for_reauth) 1671 data->phase2_method->deinit_for_reauth(sm, data->phase2_priv); 1672 wpabuf_free(data->pending_phase2_req); 1673 data->pending_phase2_req = NULL; 1674 wpabuf_free(data->pending_resp); 1675 data->pending_resp = NULL; 1676 data->decision_succ = DECISION_FAIL; 1677 #ifdef EAP_TNC 1678 data->ready_for_tnc = 0; 1679 data->tnc_started = 0; 1680 #endif /* EAP_TNC */ 1681 } 1682 1683 1684 static void * eap_ttls_init_for_reauth(struct eap_sm *sm, void *priv) 1685 { 1686 struct eap_ttls_data *data = priv; 1687 eap_ttls_free_key(data); 1688 os_free(data->session_id); 1689 data->session_id = NULL; 1690 if (eap_peer_tls_reauth_init(sm, &data->ssl)) { 1691 os_free(data); 1692 return NULL; 1693 } 1694 if (data->phase2_priv && data->phase2_method && 1695 data->phase2_method->init_for_reauth) 1696 data->phase2_method->init_for_reauth(sm, data->phase2_priv); 1697 data->phase2_start = 0; 1698 data->phase2_success = 0; 1699 data->resuming = 1; 1700 data->reauth = 1; 1701 return priv; 1702 } 1703 1704 1705 static int eap_ttls_get_status(struct eap_sm *sm, void *priv, char *buf, 1706 size_t buflen, int verbose) 1707 { 1708 struct eap_ttls_data *data = priv; 1709 int len, ret; 1710 1711 len = eap_peer_tls_status(sm, &data->ssl, buf, buflen, verbose); 1712 ret = os_snprintf(buf + len, buflen - len, 1713 "EAP-TTLSv%d Phase2 method=", 1714 data->ttls_version); 1715 if (os_snprintf_error(buflen - len, ret)) 1716 return len; 1717 len += ret; 1718 switch (data->phase2_type) { 1719 case EAP_TTLS_PHASE2_EAP: 1720 ret = os_snprintf(buf + len, buflen - len, "EAP-%s\n", 1721 data->phase2_method ? 1722 data->phase2_method->name : "?"); 1723 break; 1724 case EAP_TTLS_PHASE2_MSCHAPV2: 1725 ret = os_snprintf(buf + len, buflen - len, "MSCHAPV2\n"); 1726 break; 1727 case EAP_TTLS_PHASE2_MSCHAP: 1728 ret = os_snprintf(buf + len, buflen - len, "MSCHAP\n"); 1729 break; 1730 case EAP_TTLS_PHASE2_PAP: 1731 ret = os_snprintf(buf + len, buflen - len, "PAP\n"); 1732 break; 1733 case EAP_TTLS_PHASE2_CHAP: 1734 ret = os_snprintf(buf + len, buflen - len, "CHAP\n"); 1735 break; 1736 default: 1737 ret = 0; 1738 break; 1739 } 1740 if (os_snprintf_error(buflen - len, ret)) 1741 return len; 1742 len += ret; 1743 1744 return len; 1745 } 1746 1747 1748 static Boolean eap_ttls_isKeyAvailable(struct eap_sm *sm, void *priv) 1749 { 1750 struct eap_ttls_data *data = priv; 1751 return data->key_data != NULL && data->phase2_success; 1752 } 1753 1754 1755 static u8 * eap_ttls_getKey(struct eap_sm *sm, void *priv, size_t *len) 1756 { 1757 struct eap_ttls_data *data = priv; 1758 u8 *key; 1759 1760 if (data->key_data == NULL || !data->phase2_success) 1761 return NULL; 1762 1763 key = os_memdup(data->key_data, EAP_TLS_KEY_LEN); 1764 if (key == NULL) 1765 return NULL; 1766 1767 *len = EAP_TLS_KEY_LEN; 1768 1769 return key; 1770 } 1771 1772 1773 static u8 * eap_ttls_get_session_id(struct eap_sm *sm, void *priv, size_t *len) 1774 { 1775 struct eap_ttls_data *data = priv; 1776 u8 *id; 1777 1778 if (data->session_id == NULL || !data->phase2_success) 1779 return NULL; 1780 1781 id = os_memdup(data->session_id, data->id_len); 1782 if (id == NULL) 1783 return NULL; 1784 1785 *len = data->id_len; 1786 1787 return id; 1788 } 1789 1790 1791 static u8 * eap_ttls_get_emsk(struct eap_sm *sm, void *priv, size_t *len) 1792 { 1793 struct eap_ttls_data *data = priv; 1794 u8 *key; 1795 1796 if (data->key_data == NULL) 1797 return NULL; 1798 1799 key = os_memdup(data->key_data + EAP_TLS_KEY_LEN, EAP_EMSK_LEN); 1800 if (key == NULL) 1801 return NULL; 1802 1803 *len = EAP_EMSK_LEN; 1804 1805 return key; 1806 } 1807 1808 1809 int eap_peer_ttls_register(void) 1810 { 1811 struct eap_method *eap; 1812 1813 eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION, 1814 EAP_VENDOR_IETF, EAP_TYPE_TTLS, "TTLS"); 1815 if (eap == NULL) 1816 return -1; 1817 1818 eap->init = eap_ttls_init; 1819 eap->deinit = eap_ttls_deinit; 1820 eap->process = eap_ttls_process; 1821 eap->isKeyAvailable = eap_ttls_isKeyAvailable; 1822 eap->getKey = eap_ttls_getKey; 1823 eap->getSessionId = eap_ttls_get_session_id; 1824 eap->get_status = eap_ttls_get_status; 1825 eap->has_reauth_data = eap_ttls_has_reauth_data; 1826 eap->deinit_for_reauth = eap_ttls_deinit_for_reauth; 1827 eap->init_for_reauth = eap_ttls_init_for_reauth; 1828 eap->get_emsk = eap_ttls_get_emsk; 1829 1830 return eap_peer_method_register(eap); 1831 } 1832