• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * EAP peer method: EAP-TTLS (RFC 5281)
3  * Copyright (c) 2004-2015, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "includes.h"
10 
11 #include "common.h"
12 #include "crypto/ms_funcs.h"
13 #include "crypto/sha1.h"
14 #include "crypto/tls.h"
15 #include "eap_common/chap.h"
16 #include "eap_common/eap_ttls.h"
17 #include "mschapv2.h"
18 #include "eap_i.h"
19 #include "eap_tls_common.h"
20 #include "eap_config.h"
21 #ifdef EXT_AUTHENTICATION_SUPPORT
22 #include "ext_authentication.h"
23 #endif /* EXT_AUTHENTICATION_SUPPORT */
24 
25 #define EAP_TTLS_VERSION 0
26 
27 
28 static void eap_ttls_deinit(struct eap_sm *sm, void *priv);
29 
30 
31 struct eap_ttls_data {
32 	struct eap_ssl_data ssl;
33 
34 	int ttls_version;
35 
36 	const struct eap_method *phase2_method;
37 	void *phase2_priv;
38 	int phase2_success;
39 	int phase2_start;
40 	EapDecision decision_succ;
41 
42 	enum phase2_types {
43 		EAP_TTLS_PHASE2_EAP,
44 		EAP_TTLS_PHASE2_MSCHAPV2,
45 		EAP_TTLS_PHASE2_MSCHAP,
46 		EAP_TTLS_PHASE2_PAP,
47 		EAP_TTLS_PHASE2_CHAP
48 	} phase2_type;
49 	struct eap_method_type phase2_eap_type;
50 	struct eap_method_type *phase2_eap_types;
51 	size_t num_phase2_eap_types;
52 
53 	u8 auth_response[MSCHAPV2_AUTH_RESPONSE_LEN];
54 	int auth_response_valid;
55 	u8 master_key[MSCHAPV2_MASTER_KEY_LEN]; /* MSCHAPv2 master key */
56 	u8 ident;
57 	int resuming; /* starting a resumed session */
58 	int reauth; /* reauthentication */
59 	u8 *key_data;
60 	u8 *session_id;
61 	size_t id_len;
62 
63 	struct wpabuf *pending_phase2_req;
64 	struct wpabuf *pending_resp;
65 
66 #ifdef EAP_TNC
67 	int ready_for_tnc;
68 	int tnc_started;
69 #endif /* EAP_TNC */
70 
71 	enum { NO_AUTH, FOR_INITIAL, ALWAYS } phase2_auth;
72 };
73 
74 
eap_ttls_parse_phase1(struct eap_ttls_data * data,const char * phase1)75 static void eap_ttls_parse_phase1(struct eap_ttls_data *data,
76 				  const char *phase1)
77 {
78 	if (os_strstr(phase1, "phase2_auth=0")) {
79 		data->phase2_auth = NO_AUTH;
80 		wpa_printf(MSG_DEBUG,
81 			   "EAP-TTLS: Do not require Phase 2 authentication");
82 	} else if (os_strstr(phase1, "phase2_auth=1")) {
83 		data->phase2_auth = FOR_INITIAL;
84 		wpa_printf(MSG_DEBUG,
85 			   "EAP-TTLS: Require Phase 2 authentication for initial connection");
86 	} else if (os_strstr(phase1, "phase2_auth=2")) {
87 		data->phase2_auth = ALWAYS;
88 		wpa_printf(MSG_DEBUG,
89 			   "EAP-TTLS: Require Phase 2 authentication for all cases");
90 	}
91 }
92 
93 
eap_ttls_init(struct eap_sm * sm)94 static void * eap_ttls_init(struct eap_sm *sm)
95 {
96 	struct eap_ttls_data *data;
97 	struct eap_peer_config *config = eap_get_config(sm);
98 	int selected_non_eap;
99 	char *selected;
100 
101 	data = os_zalloc(sizeof(*data));
102 	if (data == NULL)
103 		return NULL;
104 	data->ttls_version = EAP_TTLS_VERSION;
105 	selected = "EAP";
106 	selected_non_eap = 0;
107 	data->phase2_type = EAP_TTLS_PHASE2_EAP;
108 	data->phase2_auth = FOR_INITIAL;
109 
110 	if (config && config->phase1)
111 		eap_ttls_parse_phase1(data, config->phase1);
112 
113 	/*
114 	 * Either one auth= type or one or more autheap= methods can be
115 	 * specified.
116 	 */
117 	if (config && config->phase2) {
118 		const char *token, *last = NULL;
119 
120 		while ((token = cstr_token(config->phase2, " \t", &last))) {
121 			if (os_strncmp(token, "auth=", 5) != 0)
122 				continue;
123 			token += 5;
124 
125 			if (last - token == 8 &&
126 			    os_strncmp(token, "MSCHAPV2", 8) == 0) {
127 				selected = "MSCHAPV2";
128 				data->phase2_type = EAP_TTLS_PHASE2_MSCHAPV2;
129 			} else if (last - token == 6 &&
130 				   os_strncmp(token, "MSCHAP", 6) == 0) {
131 				selected = "MSCHAP";
132 				data->phase2_type = EAP_TTLS_PHASE2_MSCHAP;
133 			} else if (last - token == 3 &&
134 				   os_strncmp(token, "PAP", 3) == 0) {
135 				selected = "PAP";
136 				data->phase2_type = EAP_TTLS_PHASE2_PAP;
137 			} else if (last - token == 4 &&
138 				   os_strncmp(token, "CHAP", 4) == 0) {
139 				selected = "CHAP";
140 				data->phase2_type = EAP_TTLS_PHASE2_CHAP;
141 			} else {
142 				wpa_printf(MSG_ERROR,
143 					   "EAP-TTLS: Unsupported Phase2 type '%s'",
144 					   token);
145 				eap_ttls_deinit(sm, data);
146 				return NULL;
147 			}
148 
149 			if (selected_non_eap) {
150 				wpa_printf(MSG_ERROR,
151 					   "EAP-TTLS: Only one Phase2 type can be specified");
152 				eap_ttls_deinit(sm, data);
153 				return NULL;
154 			}
155 
156 			selected_non_eap = 1;
157 		}
158 
159 		if (os_strstr(config->phase2, "autheap=")) {
160 			if (selected_non_eap) {
161 				wpa_printf(MSG_ERROR,
162 					   "EAP-TTLS: Both auth= and autheap= params cannot be specified");
163 				eap_ttls_deinit(sm, data);
164 				return NULL;
165 			}
166 			selected = "EAP";
167 			data->phase2_type = EAP_TTLS_PHASE2_EAP;
168 		}
169 	}
170 
171 	wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase2 type: %s", selected);
172 
173 	if (data->phase2_type == EAP_TTLS_PHASE2_EAP) {
174 		if (eap_peer_select_phase2_methods(config, "autheap=",
175 						   &data->phase2_eap_types,
176 						   &data->num_phase2_eap_types,
177 						   0) < 0) {
178 			eap_ttls_deinit(sm, data);
179 			return NULL;
180 		}
181 
182 		data->phase2_eap_type.vendor = EAP_VENDOR_IETF;
183 		data->phase2_eap_type.method = EAP_TYPE_NONE;
184 	}
185 
186 	if (eap_peer_tls_ssl_init(sm, &data->ssl, config, EAP_TYPE_TTLS)) {
187 		wpa_printf(MSG_INFO, "EAP-TTLS: Failed to initialize SSL.");
188 		eap_ttls_deinit(sm, data);
189 		return NULL;
190 	}
191 
192 	return data;
193 }
194 
195 
eap_ttls_phase2_eap_deinit(struct eap_sm * sm,struct eap_ttls_data * data)196 static void eap_ttls_phase2_eap_deinit(struct eap_sm *sm,
197 				       struct eap_ttls_data *data)
198 {
199 	if (data->phase2_priv && data->phase2_method) {
200 		data->phase2_method->deinit(sm, data->phase2_priv);
201 		data->phase2_method = NULL;
202 		data->phase2_priv = NULL;
203 	}
204 }
205 
206 
eap_ttls_free_key(struct eap_ttls_data * data)207 static void eap_ttls_free_key(struct eap_ttls_data *data)
208 {
209 	if (data->key_data) {
210 		bin_clear_free(data->key_data, EAP_TLS_KEY_LEN + EAP_EMSK_LEN);
211 		data->key_data = NULL;
212 	}
213 }
214 
215 
eap_ttls_deinit(struct eap_sm * sm,void * priv)216 static void eap_ttls_deinit(struct eap_sm *sm, void *priv)
217 {
218 	struct eap_ttls_data *data = priv;
219 	if (data == NULL)
220 		return;
221 	eap_ttls_phase2_eap_deinit(sm, data);
222 	os_free(data->phase2_eap_types);
223 	eap_peer_tls_ssl_deinit(sm, &data->ssl);
224 	eap_ttls_free_key(data);
225 	os_free(data->session_id);
226 	wpabuf_clear_free(data->pending_phase2_req);
227 	wpabuf_clear_free(data->pending_resp);
228 	os_free(data);
229 }
230 
231 
eap_ttls_avp_hdr(u8 * avphdr,u32 avp_code,u32 vendor_id,int mandatory,size_t len)232 static u8 * eap_ttls_avp_hdr(u8 *avphdr, u32 avp_code, u32 vendor_id,
233 			     int mandatory, size_t len)
234 {
235 	struct ttls_avp_vendor *avp;
236 	u8 flags;
237 	size_t hdrlen;
238 
239 	avp = (struct ttls_avp_vendor *) avphdr;
240 	flags = mandatory ? AVP_FLAGS_MANDATORY : 0;
241 	if (vendor_id) {
242 		flags |= AVP_FLAGS_VENDOR;
243 		hdrlen = sizeof(*avp);
244 		avp->vendor_id = host_to_be32(vendor_id);
245 	} else {
246 		hdrlen = sizeof(struct ttls_avp);
247 	}
248 
249 	avp->avp_code = host_to_be32(avp_code);
250 	avp->avp_length = host_to_be32(((u32) flags << 24) |
251 				       (u32) (hdrlen + len));
252 
253 	return avphdr + hdrlen;
254 }
255 
256 
eap_ttls_avp_add(u8 * start,u8 * avphdr,u32 avp_code,u32 vendor_id,int mandatory,const u8 * data,size_t len)257 static u8 * eap_ttls_avp_add(u8 *start, u8 *avphdr, u32 avp_code,
258 			     u32 vendor_id, int mandatory,
259 			     const u8 *data, size_t len)
260 {
261 	u8 *pos;
262 	pos = eap_ttls_avp_hdr(avphdr, avp_code, vendor_id, mandatory, len);
263 	os_memcpy(pos, data, len);
264 	pos += len;
265 	AVP_PAD(start, pos);
266 	return pos;
267 }
268 
269 
eap_ttls_avp_encapsulate(struct wpabuf ** resp,u32 avp_code,int mandatory)270 static int eap_ttls_avp_encapsulate(struct wpabuf **resp, u32 avp_code,
271 				    int mandatory)
272 {
273 	struct wpabuf *msg;
274 	u8 *avp, *pos;
275 
276 	msg = wpabuf_alloc(sizeof(struct ttls_avp) + wpabuf_len(*resp) + 4);
277 	if (msg == NULL) {
278 		wpabuf_clear_free(*resp);
279 		*resp = NULL;
280 		return -1;
281 	}
282 
283 	avp = wpabuf_mhead(msg);
284 	pos = eap_ttls_avp_hdr(avp, avp_code, 0, mandatory, wpabuf_len(*resp));
285 	os_memcpy(pos, wpabuf_head(*resp), wpabuf_len(*resp));
286 	pos += wpabuf_len(*resp);
287 	AVP_PAD(avp, pos);
288 	wpabuf_clear_free(*resp);
289 	wpabuf_put(msg, pos - avp);
290 	*resp = msg;
291 	return 0;
292 }
293 
294 
eap_ttls_v0_derive_key(struct eap_sm * sm,struct eap_ttls_data * data)295 static int eap_ttls_v0_derive_key(struct eap_sm *sm,
296 				  struct eap_ttls_data *data)
297 {
298 	const char *label;
299 	const u8 eap_tls13_context[1] = { EAP_TYPE_TTLS };
300 	const u8 *context = NULL;
301 	size_t context_len = 0;
302 
303 	if (data->ssl.tls_v13) {
304 		label = "EXPORTER_EAP_TLS_Key_Material";
305 		context = eap_tls13_context;
306 		context_len = sizeof(eap_tls13_context);
307 	} else {
308 		label = "ttls keying material";
309 	}
310 
311 	eap_ttls_free_key(data);
312 	data->key_data = eap_peer_tls_derive_key(sm, &data->ssl, label,
313 						 context, context_len,
314 						 EAP_TLS_KEY_LEN +
315 						 EAP_EMSK_LEN);
316 	if (!data->key_data) {
317 		wpa_printf(MSG_INFO, "EAP-TTLS: Failed to derive key");
318 		return -1;
319 	}
320 
321 	wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived key",
322 			data->key_data, EAP_TLS_KEY_LEN);
323 	wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived EMSK",
324 			data->key_data + EAP_TLS_KEY_LEN,
325 			EAP_EMSK_LEN);
326 
327 	os_free(data->session_id);
328 	data->session_id = eap_peer_tls_derive_session_id(sm, &data->ssl,
329 							  EAP_TYPE_TTLS,
330 	                                                  &data->id_len);
331 	if (data->session_id) {
332 		wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Derived Session-Id",
333 			    data->session_id, data->id_len);
334 	} else {
335 		wpa_printf(MSG_ERROR, "EAP-TTLS: Failed to derive Session-Id");
336 	}
337 
338 	return 0;
339 }
340 
341 
342 #ifndef CONFIG_FIPS
eap_ttls_implicit_challenge(struct eap_sm * sm,struct eap_ttls_data * data,size_t len)343 static u8 * eap_ttls_implicit_challenge(struct eap_sm *sm,
344 					struct eap_ttls_data *data, size_t len)
345 {
346 	return eap_peer_tls_derive_key(sm, &data->ssl, "ttls challenge",
347 				       NULL, 0, len);
348 }
349 #endif /* CONFIG_FIPS */
350 
351 
eap_ttls_phase2_select_eap_method(struct eap_ttls_data * data,int vendor,enum eap_type method)352 static void eap_ttls_phase2_select_eap_method(struct eap_ttls_data *data,
353 					      int vendor, enum eap_type method)
354 {
355 	size_t i;
356 	for (i = 0; i < data->num_phase2_eap_types; i++) {
357 		if (data->phase2_eap_types[i].vendor != vendor ||
358 		    data->phase2_eap_types[i].method != method)
359 			continue;
360 
361 		data->phase2_eap_type.vendor =
362 			data->phase2_eap_types[i].vendor;
363 		data->phase2_eap_type.method =
364 			data->phase2_eap_types[i].method;
365 		wpa_printf(MSG_DEBUG, "EAP-TTLS: Selected "
366 			   "Phase 2 EAP vendor %d method %d",
367 			   data->phase2_eap_type.vendor,
368 			   data->phase2_eap_type.method);
369 		break;
370 	}
371 }
372 
373 
eap_ttls_phase2_eap_process(struct eap_sm * sm,struct eap_ttls_data * data,struct eap_method_ret * ret,struct eap_hdr * hdr,size_t len,struct wpabuf ** resp)374 static int eap_ttls_phase2_eap_process(struct eap_sm *sm,
375 				       struct eap_ttls_data *data,
376 				       struct eap_method_ret *ret,
377 				       struct eap_hdr *hdr, size_t len,
378 				       struct wpabuf **resp)
379 {
380 	struct wpabuf msg;
381 	struct eap_method_ret iret;
382 
383 	os_memset(&iret, 0, sizeof(iret));
384 	wpabuf_set(&msg, hdr, len);
385 	*resp = data->phase2_method->process(sm, data->phase2_priv, &iret,
386 					     &msg);
387 	if ((iret.methodState == METHOD_DONE ||
388 	     iret.methodState == METHOD_MAY_CONT) &&
389 	    (iret.decision == DECISION_UNCOND_SUCC ||
390 	     iret.decision == DECISION_COND_SUCC ||
391 	     iret.decision == DECISION_FAIL)) {
392 		ret->methodState = iret.methodState;
393 		ret->decision = iret.decision;
394 	}
395 
396 	return 0;
397 }
398 
399 
eap_ttls_phase2_request_eap_method(struct eap_sm * sm,struct eap_ttls_data * data,struct eap_method_ret * ret,struct eap_hdr * hdr,size_t len,int vendor,enum eap_type method,struct wpabuf ** resp)400 static int eap_ttls_phase2_request_eap_method(struct eap_sm *sm,
401 					      struct eap_ttls_data *data,
402 					      struct eap_method_ret *ret,
403 					      struct eap_hdr *hdr, size_t len,
404 					      int vendor, enum eap_type method,
405 					      struct wpabuf **resp)
406 {
407 #ifdef EAP_TNC
408 	if (data->tnc_started && data->phase2_method &&
409 	    data->phase2_priv &&
410 	    vendor == EAP_VENDOR_IETF && method == EAP_TYPE_TNC &&
411 	    data->phase2_eap_type.method == EAP_TYPE_TNC)
412 		return eap_ttls_phase2_eap_process(sm, data, ret, hdr, len,
413 						   resp);
414 
415 	if (data->ready_for_tnc && !data->tnc_started &&
416 	    vendor == EAP_VENDOR_IETF && method == EAP_TYPE_TNC) {
417 		wpa_printf(MSG_DEBUG, "EAP-TTLS: Start TNC after completed "
418 			   "EAP method");
419 		data->tnc_started = 1;
420 	}
421 
422 	if (data->tnc_started) {
423 		if (data->phase2_eap_type.vendor != EAP_VENDOR_IETF ||
424 		    data->phase2_eap_type.method == EAP_TYPE_TNC) {
425 			wpa_printf(MSG_DEBUG, "EAP-TTLS: Unexpected EAP "
426 				   "type %d for TNC", method);
427 			return -1;
428 		}
429 
430 		data->phase2_eap_type.vendor = vendor;
431 		data->phase2_eap_type.method = method;
432 		wpa_printf(MSG_DEBUG, "EAP-TTLS: Selected "
433 			   "Phase 2 EAP vendor %d method %d (TNC)",
434 			   data->phase2_eap_type.vendor,
435 			   data->phase2_eap_type.method);
436 
437 		if (data->phase2_type == EAP_TTLS_PHASE2_EAP)
438 			eap_ttls_phase2_eap_deinit(sm, data);
439 	}
440 #endif /* EAP_TNC */
441 
442 	if (data->phase2_eap_type.vendor == EAP_VENDOR_IETF &&
443 	    data->phase2_eap_type.method == EAP_TYPE_NONE)
444 		eap_ttls_phase2_select_eap_method(data, vendor, method);
445 
446 	if (vendor != data->phase2_eap_type.vendor ||
447 	    method != data->phase2_eap_type.method ||
448 	    (vendor == EAP_VENDOR_IETF && method == EAP_TYPE_NONE)) {
449 		if (eap_peer_tls_phase2_nak(data->phase2_eap_types,
450 					    data->num_phase2_eap_types,
451 					    hdr, resp))
452 			return -1;
453 		return 0;
454 	}
455 
456 	if (data->phase2_priv == NULL) {
457 		data->phase2_method = eap_peer_get_eap_method(vendor, method);
458 		if (data->phase2_method) {
459 			sm->init_phase2 = 1;
460 			data->phase2_priv = data->phase2_method->init(sm);
461 			sm->init_phase2 = 0;
462 		}
463 	}
464 	if (data->phase2_priv == NULL || data->phase2_method == NULL) {
465 		wpa_printf(MSG_INFO,
466 			   "EAP-TTLS: failed to initialize Phase 2 EAP method %u:%u",
467 			   vendor, method);
468 		return -1;
469 	}
470 
471 	return eap_ttls_phase2_eap_process(sm, data, ret, hdr, len, resp);
472 }
473 
474 
eap_ttls_phase2_request_eap(struct eap_sm * sm,struct eap_ttls_data * data,struct eap_method_ret * ret,struct eap_hdr * hdr,struct wpabuf ** resp)475 static int eap_ttls_phase2_request_eap(struct eap_sm *sm,
476 				       struct eap_ttls_data *data,
477 				       struct eap_method_ret *ret,
478 				       struct eap_hdr *hdr,
479 				       struct wpabuf **resp)
480 {
481 	size_t len = be_to_host16(hdr->length);
482 	u8 *pos;
483 	struct eap_peer_config *config = eap_get_config(sm);
484 
485 	if (len <= sizeof(struct eap_hdr)) {
486 		wpa_printf(MSG_INFO, "EAP-TTLS: too short "
487 			   "Phase 2 request (len=%lu)", (unsigned long) len);
488 		return -1;
489 	}
490 	pos = (u8 *) (hdr + 1);
491 	wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 EAP Request: type=%d", *pos);
492 	switch (*pos) {
493 	case EAP_TYPE_IDENTITY:
494 		*resp = eap_sm_buildIdentity(sm, hdr->identifier, 1);
495 		break;
496 	case EAP_TYPE_EXPANDED:
497 		if (len < sizeof(struct eap_hdr) + 8) {
498 			wpa_printf(MSG_INFO,
499 				   "EAP-TTLS: Too short Phase 2 request (expanded header) (len=%lu)",
500 				   (unsigned long) len);
501 			return -1;
502 		}
503 		if (eap_ttls_phase2_request_eap_method(sm, data, ret, hdr, len,
504 						       WPA_GET_BE24(pos + 1),
505 						       WPA_GET_BE32(pos + 4),
506 						       resp) < 0)
507 			return -1;
508 		break;
509 	default:
510 		if (eap_ttls_phase2_request_eap_method(sm, data, ret, hdr, len,
511 						       EAP_VENDOR_IETF, *pos,
512 						       resp) < 0)
513 			return -1;
514 		break;
515 	}
516 
517 	if (*resp == NULL &&
518 	    (config->pending_req_identity || config->pending_req_password ||
519 	     config->pending_req_otp || config->pending_req_sim)) {
520 		return 0;
521 	}
522 
523 	if (*resp == NULL)
524 		return -1;
525 
526 	wpa_hexdump_buf(MSG_DEBUG, "EAP-TTLS: AVP encapsulate EAP Response",
527 			*resp);
528 	return eap_ttls_avp_encapsulate(resp, RADIUS_ATTR_EAP_MESSAGE, 1);
529 }
530 
531 
eap_ttls_phase2_request_mschapv2(struct eap_sm * sm,struct eap_ttls_data * data,struct eap_method_ret * ret,struct wpabuf ** resp)532 static int eap_ttls_phase2_request_mschapv2(struct eap_sm *sm,
533 					    struct eap_ttls_data *data,
534 					    struct eap_method_ret *ret,
535 					    struct wpabuf **resp)
536 {
537 #ifdef CONFIG_FIPS
538 	wpa_printf(MSG_ERROR, "EAP-TTLS: MSCHAPV2 not supported in FIPS build");
539 	return -1;
540 #else /* CONFIG_FIPS */
541 #ifdef EAP_MSCHAPv2
542 	struct wpabuf *msg;
543 	u8 *buf, *pos, *challenge, *peer_challenge;
544 	const u8 *identity, *password;
545 	size_t identity_len, password_len;
546 	int pwhash;
547 
548 	wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 MSCHAPV2 Request");
549 
550 	identity = eap_get_config_identity(sm, &identity_len);
551 	password = eap_get_config_password2(sm, &password_len, &pwhash);
552 	if (identity == NULL || password == NULL)
553 		return -1;
554 
555 	msg = wpabuf_alloc(identity_len + 1000);
556 	if (msg == NULL) {
557 		wpa_printf(MSG_ERROR,
558 			   "EAP-TTLS/MSCHAPV2: Failed to allocate memory");
559 		return -1;
560 	}
561 	pos = buf = wpabuf_mhead(msg);
562 
563 	/* User-Name */
564 	pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,
565 			       identity, identity_len);
566 
567 	/* MS-CHAP-Challenge */
568 	challenge = eap_ttls_implicit_challenge(
569 		sm, data, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN + 1);
570 	if (challenge == NULL) {
571 		wpabuf_clear_free(msg);
572 		wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAPV2: Failed to derive "
573 			   "implicit challenge");
574 		return -1;
575 	}
576 
577 	pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_MS_CHAP_CHALLENGE,
578 			       RADIUS_VENDOR_ID_MICROSOFT, 1,
579 			       challenge, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN);
580 
581 	/* MS-CHAP2-Response */
582 	pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP2_RESPONSE,
583 			       RADIUS_VENDOR_ID_MICROSOFT, 1,
584 			       EAP_TTLS_MSCHAPV2_RESPONSE_LEN);
585 	data->ident = challenge[EAP_TTLS_MSCHAPV2_CHALLENGE_LEN];
586 	*pos++ = data->ident;
587 	*pos++ = 0; /* Flags */
588 	if (os_get_random(pos, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN) < 0) {
589 		os_free(challenge);
590 		wpabuf_clear_free(msg);
591 		wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAPV2: Failed to get "
592 			   "random data for peer challenge");
593 		return -1;
594 	}
595 	peer_challenge = pos;
596 	pos += EAP_TTLS_MSCHAPV2_CHALLENGE_LEN;
597 	os_memset(pos, 0, 8); /* Reserved, must be zero */
598 	pos += 8;
599 	if (mschapv2_derive_response(identity, identity_len, password,
600 				     password_len, pwhash, challenge,
601 				     peer_challenge, pos, data->auth_response,
602 				     data->master_key)) {
603 		os_free(challenge);
604 		wpabuf_clear_free(msg);
605 		wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAPV2: Failed to derive "
606 			   "response");
607 		return -1;
608 	}
609 	data->auth_response_valid = 1;
610 
611 	pos += 24;
612 	os_free(challenge);
613 	AVP_PAD(buf, pos);
614 
615 	wpabuf_put(msg, pos - buf);
616 	*resp = msg;
617 
618 	return 0;
619 #else /* EAP_MSCHAPv2 */
620 	wpa_printf(MSG_ERROR, "EAP-TTLS: MSCHAPv2 not included in the build");
621 	return -1;
622 #endif /* EAP_MSCHAPv2 */
623 #endif /* CONFIG_FIPS */
624 }
625 
626 
eap_ttls_phase2_request_mschap(struct eap_sm * sm,struct eap_ttls_data * data,struct eap_method_ret * ret,struct wpabuf ** resp)627 static int eap_ttls_phase2_request_mschap(struct eap_sm *sm,
628 					  struct eap_ttls_data *data,
629 					  struct eap_method_ret *ret,
630 					  struct wpabuf **resp)
631 {
632 #ifdef CONFIG_FIPS
633 	wpa_printf(MSG_ERROR, "EAP-TTLS: MSCHAP not supported in FIPS build");
634 	return -1;
635 #else /* CONFIG_FIPS */
636 	struct wpabuf *msg;
637 	u8 *buf, *pos, *challenge;
638 	const u8 *identity, *password;
639 	size_t identity_len, password_len;
640 	int pwhash;
641 
642 	wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 MSCHAP Request");
643 
644 	identity = eap_get_config_identity(sm, &identity_len);
645 	password = eap_get_config_password2(sm, &password_len, &pwhash);
646 	if (identity == NULL || password == NULL)
647 		return -1;
648 
649 	msg = wpabuf_alloc(identity_len + 1000);
650 	if (msg == NULL) {
651 		wpa_printf(MSG_ERROR,
652 			   "EAP-TTLS/MSCHAP: Failed to allocate memory");
653 		return -1;
654 	}
655 	pos = buf = wpabuf_mhead(msg);
656 
657 	/* User-Name */
658 	pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,
659 			       identity, identity_len);
660 
661 	/* MS-CHAP-Challenge */
662 	challenge = eap_ttls_implicit_challenge(
663 		sm, data, EAP_TTLS_MSCHAP_CHALLENGE_LEN + 1);
664 	if (challenge == NULL) {
665 		wpabuf_clear_free(msg);
666 		wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAP: Failed to derive "
667 			   "implicit challenge");
668 		return -1;
669 	}
670 
671 	pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_MS_CHAP_CHALLENGE,
672 			       RADIUS_VENDOR_ID_MICROSOFT, 1,
673 			       challenge, EAP_TTLS_MSCHAP_CHALLENGE_LEN);
674 
675 	/* MS-CHAP-Response */
676 	pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP_RESPONSE,
677 			       RADIUS_VENDOR_ID_MICROSOFT, 1,
678 			       EAP_TTLS_MSCHAP_RESPONSE_LEN);
679 	data->ident = challenge[EAP_TTLS_MSCHAP_CHALLENGE_LEN];
680 	*pos++ = data->ident;
681 	*pos++ = 1; /* Flags: Use NT style passwords */
682 	os_memset(pos, 0, 24); /* LM-Response */
683 	pos += 24;
684 	if (pwhash) {
685 		/* NT-Response */
686 		if (challenge_response(challenge, password, pos)) {
687 			wpa_printf(MSG_ERROR,
688 				   "EAP-TTLS/MSCHAP: Failed derive password hash");
689 			wpabuf_clear_free(msg);
690 			os_free(challenge);
691 			return -1;
692 		}
693 
694 		wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: MSCHAP password hash",
695 				password, 16);
696 	} else {
697 		/* NT-Response */
698 		if (nt_challenge_response(challenge, password, password_len,
699 					  pos)) {
700 			wpa_printf(MSG_ERROR,
701 				   "EAP-TTLS/MSCHAP: Failed derive password");
702 			wpabuf_clear_free(msg);
703 			os_free(challenge);
704 			return -1;
705 		}
706 
707 		wpa_hexdump_ascii_key(MSG_DEBUG, "EAP-TTLS: MSCHAP password",
708 				      password, password_len);
709 	}
710 	wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAP implicit challenge",
711 		    challenge, EAP_TTLS_MSCHAP_CHALLENGE_LEN);
712 	wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAP response", pos, 24);
713 	pos += 24;
714 	os_free(challenge);
715 	AVP_PAD(buf, pos);
716 
717 	wpabuf_put(msg, pos - buf);
718 	*resp = msg;
719 
720 	/* EAP-TTLS/MSCHAP does not provide tunneled success
721 	 * notification, so assume that Phase2 succeeds. */
722 	ret->methodState = METHOD_DONE;
723 	ret->decision = DECISION_COND_SUCC;
724 
725 	return 0;
726 #endif /* CONFIG_FIPS */
727 }
728 
729 
eap_ttls_phase2_request_pap(struct eap_sm * sm,struct eap_ttls_data * data,struct eap_method_ret * ret,struct wpabuf ** resp)730 static int eap_ttls_phase2_request_pap(struct eap_sm *sm,
731 				       struct eap_ttls_data *data,
732 				       struct eap_method_ret *ret,
733 				       struct wpabuf **resp)
734 {
735 	struct wpabuf *msg;
736 	u8 *buf, *pos;
737 	size_t pad;
738 	const u8 *identity, *password;
739 	size_t identity_len, password_len;
740 
741 	wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 PAP Request");
742 
743 	identity = eap_get_config_identity(sm, &identity_len);
744 	password = eap_get_config_password(sm, &password_len);
745 	if (identity == NULL || password == NULL)
746 		return -1;
747 
748 	msg = wpabuf_alloc(identity_len + password_len + 100);
749 	if (msg == NULL) {
750 		wpa_printf(MSG_ERROR,
751 			   "EAP-TTLS/PAP: Failed to allocate memory");
752 		return -1;
753 	}
754 	pos = buf = wpabuf_mhead(msg);
755 
756 	/* User-Name */
757 	pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,
758 			       identity, identity_len);
759 
760 	/* User-Password; in RADIUS, this is encrypted, but EAP-TTLS encrypts
761 	 * the data, so no separate encryption is used in the AVP itself.
762 	 * However, the password is padded to obfuscate its length. */
763 	pad = password_len == 0 ? 16 : (16 - (password_len & 15)) & 15;
764 	pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_USER_PASSWORD, 0, 1,
765 			       password_len + pad);
766 	os_memcpy(pos, password, password_len);
767 	pos += password_len;
768 	os_memset(pos, 0, pad);
769 	pos += pad;
770 	AVP_PAD(buf, pos);
771 
772 	wpabuf_put(msg, pos - buf);
773 	*resp = msg;
774 
775 	/* EAP-TTLS/PAP does not provide tunneled success notification,
776 	 * so assume that Phase2 succeeds. */
777 	ret->methodState = METHOD_DONE;
778 	ret->decision = DECISION_COND_SUCC;
779 
780 	return 0;
781 }
782 
783 
eap_ttls_phase2_request_chap(struct eap_sm * sm,struct eap_ttls_data * data,struct eap_method_ret * ret,struct wpabuf ** resp)784 static int eap_ttls_phase2_request_chap(struct eap_sm *sm,
785 					struct eap_ttls_data *data,
786 					struct eap_method_ret *ret,
787 					struct wpabuf **resp)
788 {
789 #ifdef CONFIG_FIPS
790 	wpa_printf(MSG_ERROR, "EAP-TTLS: CHAP not supported in FIPS build");
791 	return -1;
792 #else /* CONFIG_FIPS */
793 	struct wpabuf *msg;
794 	u8 *buf, *pos, *challenge;
795 	const u8 *identity, *password;
796 	size_t identity_len, password_len;
797 
798 	wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 CHAP Request");
799 
800 	identity = eap_get_config_identity(sm, &identity_len);
801 	password = eap_get_config_password(sm, &password_len);
802 	if (identity == NULL || password == NULL)
803 		return -1;
804 
805 	msg = wpabuf_alloc(identity_len + 1000);
806 	if (msg == NULL) {
807 		wpa_printf(MSG_ERROR,
808 			   "EAP-TTLS/CHAP: Failed to allocate memory");
809 		return -1;
810 	}
811 	pos = buf = wpabuf_mhead(msg);
812 
813 	/* User-Name */
814 	pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,
815 			       identity, identity_len);
816 
817 	/* CHAP-Challenge */
818 	challenge = eap_ttls_implicit_challenge(
819 		sm, data, EAP_TTLS_CHAP_CHALLENGE_LEN + 1);
820 	if (challenge == NULL) {
821 		wpabuf_clear_free(msg);
822 		wpa_printf(MSG_ERROR, "EAP-TTLS/CHAP: Failed to derive "
823 			   "implicit challenge");
824 		return -1;
825 	}
826 
827 	pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_CHAP_CHALLENGE, 0, 1,
828 			       challenge, EAP_TTLS_CHAP_CHALLENGE_LEN);
829 
830 	/* CHAP-Password */
831 	pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_CHAP_PASSWORD, 0, 1,
832 			       1 + EAP_TTLS_CHAP_PASSWORD_LEN);
833 	data->ident = challenge[EAP_TTLS_CHAP_CHALLENGE_LEN];
834 	*pos++ = data->ident;
835 
836 	/* MD5(Ident + Password + Challenge) */
837 	chap_md5(data->ident, password, password_len, challenge,
838 		 EAP_TTLS_CHAP_CHALLENGE_LEN, pos);
839 
840 	wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: CHAP username",
841 			  identity, identity_len);
842 	wpa_hexdump_ascii_key(MSG_DEBUG, "EAP-TTLS: CHAP password",
843 			      password, password_len);
844 	wpa_hexdump(MSG_DEBUG, "EAP-TTLS: CHAP implicit challenge",
845 		    challenge, EAP_TTLS_CHAP_CHALLENGE_LEN);
846 	wpa_hexdump(MSG_DEBUG, "EAP-TTLS: CHAP password",
847 		    pos, EAP_TTLS_CHAP_PASSWORD_LEN);
848 	pos += EAP_TTLS_CHAP_PASSWORD_LEN;
849 	os_free(challenge);
850 	AVP_PAD(buf, pos);
851 
852 	wpabuf_put(msg, pos - buf);
853 	*resp = msg;
854 
855 	/* EAP-TTLS/CHAP does not provide tunneled success
856 	 * notification, so assume that Phase2 succeeds. */
857 	ret->methodState = METHOD_DONE;
858 	ret->decision = DECISION_COND_SUCC;
859 
860 	return 0;
861 #endif /* CONFIG_FIPS */
862 }
863 
864 
eap_ttls_phase2_request(struct eap_sm * sm,struct eap_ttls_data * data,struct eap_method_ret * ret,struct eap_hdr * hdr,struct wpabuf ** resp)865 static int eap_ttls_phase2_request(struct eap_sm *sm,
866 				   struct eap_ttls_data *data,
867 				   struct eap_method_ret *ret,
868 				   struct eap_hdr *hdr,
869 				   struct wpabuf **resp)
870 {
871 	int res = 0;
872 	size_t len;
873 	enum phase2_types phase2_type = data->phase2_type;
874 
875 #ifdef EAP_TNC
876 	if (data->tnc_started) {
877 		wpa_printf(MSG_DEBUG, "EAP-TTLS: Processing TNC");
878 		phase2_type = EAP_TTLS_PHASE2_EAP;
879 	}
880 #endif /* EAP_TNC */
881 
882 	if (phase2_type == EAP_TTLS_PHASE2_MSCHAPV2 ||
883 	    phase2_type == EAP_TTLS_PHASE2_MSCHAP ||
884 	    phase2_type == EAP_TTLS_PHASE2_PAP ||
885 	    phase2_type == EAP_TTLS_PHASE2_CHAP) {
886 		if (eap_get_config_identity(sm, &len) == NULL) {
887 			wpa_printf(MSG_INFO,
888 				   "EAP-TTLS: Identity not configured");
889 			eap_sm_request_identity(sm);
890 			if (eap_get_config_password(sm, &len) == NULL)
891 				eap_sm_request_password(sm);
892 			return 0;
893 		}
894 
895 		if (eap_get_config_password(sm, &len) == NULL) {
896 			wpa_printf(MSG_INFO,
897 				   "EAP-TTLS: Password not configured");
898 			eap_sm_request_password(sm);
899 			return 0;
900 		}
901 	}
902 
903 	switch (phase2_type) {
904 	case EAP_TTLS_PHASE2_EAP:
905 		res = eap_ttls_phase2_request_eap(sm, data, ret, hdr, resp);
906 		break;
907 	case EAP_TTLS_PHASE2_MSCHAPV2:
908 		res = eap_ttls_phase2_request_mschapv2(sm, data, ret, resp);
909 		break;
910 	case EAP_TTLS_PHASE2_MSCHAP:
911 		res = eap_ttls_phase2_request_mschap(sm, data, ret, resp);
912 		break;
913 	case EAP_TTLS_PHASE2_PAP:
914 		res = eap_ttls_phase2_request_pap(sm, data, ret, resp);
915 		break;
916 	case EAP_TTLS_PHASE2_CHAP:
917 		res = eap_ttls_phase2_request_chap(sm, data, ret, resp);
918 		break;
919 	default:
920 		wpa_printf(MSG_ERROR, "EAP-TTLS: Phase 2 - Unknown");
921 		res = -1;
922 		break;
923 	}
924 
925 	if (res < 0) {
926 		ret->methodState = METHOD_DONE;
927 		ret->decision = DECISION_FAIL;
928 	}
929 
930 	return res;
931 }
932 
933 
934 struct ttls_parse_avp {
935 	u8 *mschapv2;
936 	u8 *eapdata;
937 	size_t eap_len;
938 	int mschapv2_error;
939 };
940 
941 
eap_ttls_parse_attr_eap(const u8 * dpos,size_t dlen,struct ttls_parse_avp * parse)942 static int eap_ttls_parse_attr_eap(const u8 *dpos, size_t dlen,
943 				   struct ttls_parse_avp *parse)
944 {
945 	wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP - EAP Message");
946 	if (parse->eapdata == NULL) {
947 		parse->eapdata = os_memdup(dpos, dlen);
948 		if (parse->eapdata == NULL) {
949 			wpa_printf(MSG_WARNING, "EAP-TTLS: Failed to allocate "
950 				   "memory for Phase 2 EAP data");
951 			return -1;
952 		}
953 		parse->eap_len = dlen;
954 	} else {
955 		u8 *neweap = os_realloc(parse->eapdata, parse->eap_len + dlen);
956 		if (neweap == NULL) {
957 			wpa_printf(MSG_WARNING, "EAP-TTLS: Failed to allocate "
958 				   "memory for Phase 2 EAP data");
959 			return -1;
960 		}
961 		os_memcpy(neweap + parse->eap_len, dpos, dlen);
962 		parse->eapdata = neweap;
963 		parse->eap_len += dlen;
964 	}
965 
966 	return 0;
967 }
968 
969 
eap_ttls_parse_avp(u8 * pos,size_t left,struct ttls_parse_avp * parse)970 static int eap_ttls_parse_avp(u8 *pos, size_t left,
971 			      struct ttls_parse_avp *parse)
972 {
973 	struct ttls_avp *avp;
974 	u32 avp_code, avp_length, vendor_id = 0;
975 	u8 avp_flags, *dpos;
976 	size_t dlen;
977 
978 	avp = (struct ttls_avp *) pos;
979 	avp_code = be_to_host32(avp->avp_code);
980 	avp_length = be_to_host32(avp->avp_length);
981 	avp_flags = (avp_length >> 24) & 0xff;
982 	avp_length &= 0xffffff;
983 	wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP: code=%d flags=0x%02x "
984 		   "length=%d", (int) avp_code, avp_flags,
985 		   (int) avp_length);
986 
987 	if (avp_length > left) {
988 		wpa_printf(MSG_WARNING, "EAP-TTLS: AVP overflow "
989 			   "(len=%d, left=%lu) - dropped",
990 			   (int) avp_length, (unsigned long) left);
991 		return -1;
992 	}
993 
994 	if (avp_length < sizeof(*avp)) {
995 		wpa_printf(MSG_WARNING, "EAP-TTLS: Invalid AVP length %d",
996 			   avp_length);
997 		return -1;
998 	}
999 
1000 	dpos = (u8 *) (avp + 1);
1001 	dlen = avp_length - sizeof(*avp);
1002 	if (avp_flags & AVP_FLAGS_VENDOR) {
1003 		if (dlen < 4) {
1004 			wpa_printf(MSG_WARNING, "EAP-TTLS: Vendor AVP "
1005 				   "underflow");
1006 			return -1;
1007 		}
1008 		vendor_id = WPA_GET_BE32(dpos);
1009 		wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP vendor_id %d",
1010 			   (int) vendor_id);
1011 		dpos += 4;
1012 		dlen -= 4;
1013 	}
1014 
1015 	wpa_hexdump(MSG_DEBUG, "EAP-TTLS: AVP data", dpos, dlen);
1016 
1017 	if (vendor_id == 0 && avp_code == RADIUS_ATTR_EAP_MESSAGE) {
1018 		if (eap_ttls_parse_attr_eap(dpos, dlen, parse) < 0)
1019 			return -1;
1020 	} else if (vendor_id == 0 && avp_code == RADIUS_ATTR_REPLY_MESSAGE) {
1021 		/* This is an optional message that can be displayed to
1022 		 * the user. */
1023 		wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: AVP - Reply-Message",
1024 				  dpos, dlen);
1025 	} else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT &&
1026 		   avp_code == RADIUS_ATTR_MS_CHAP2_SUCCESS) {
1027 		wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: MS-CHAP2-Success",
1028 				  dpos, dlen);
1029 		if (dlen != 43) {
1030 			wpa_printf(MSG_WARNING, "EAP-TTLS: Unexpected "
1031 				   "MS-CHAP2-Success length "
1032 				   "(len=%lu, expected 43)",
1033 				   (unsigned long) dlen);
1034 			return -1;
1035 		}
1036 		parse->mschapv2 = dpos;
1037 	} else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT &&
1038 		   avp_code == RADIUS_ATTR_MS_CHAP_ERROR) {
1039 		wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: MS-CHAP-Error",
1040 				  dpos, dlen);
1041 		parse->mschapv2_error = 1;
1042 	} else if (avp_flags & AVP_FLAGS_MANDATORY) {
1043 		wpa_printf(MSG_WARNING, "EAP-TTLS: Unsupported mandatory AVP "
1044 			   "code %d vendor_id %d - dropped",
1045 			   (int) avp_code, (int) vendor_id);
1046 		return -1;
1047 	} else {
1048 		wpa_printf(MSG_DEBUG, "EAP-TTLS: Ignoring unsupported AVP "
1049 			   "code %d vendor_id %d",
1050 			   (int) avp_code, (int) vendor_id);
1051 	}
1052 
1053 	return avp_length;
1054 }
1055 
1056 
eap_ttls_parse_avps(struct wpabuf * in_decrypted,struct ttls_parse_avp * parse)1057 static int eap_ttls_parse_avps(struct wpabuf *in_decrypted,
1058 			       struct ttls_parse_avp *parse)
1059 {
1060 	u8 *pos;
1061 	size_t left, pad;
1062 	int avp_length;
1063 
1064 	pos = wpabuf_mhead(in_decrypted);
1065 	left = wpabuf_len(in_decrypted);
1066 	wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Decrypted Phase 2 AVPs", pos, left);
1067 	if (left < sizeof(struct ttls_avp)) {
1068 		wpa_printf(MSG_WARNING, "EAP-TTLS: Too short Phase 2 AVP frame"
1069 			   " len=%lu expected %lu or more - dropped",
1070 			   (unsigned long) left,
1071 			   (unsigned long) sizeof(struct ttls_avp));
1072 		return -1;
1073 	}
1074 
1075 	/* Parse AVPs */
1076 	os_memset(parse, 0, sizeof(*parse));
1077 
1078 	while (left > 0) {
1079 		avp_length = eap_ttls_parse_avp(pos, left, parse);
1080 		if (avp_length < 0)
1081 			return -1;
1082 
1083 		pad = (4 - (avp_length & 3)) & 3;
1084 		pos += avp_length + pad;
1085 		if (left < avp_length + pad)
1086 			left = 0;
1087 		else
1088 			left -= avp_length + pad;
1089 	}
1090 
1091 	return 0;
1092 }
1093 
1094 
eap_ttls_fake_identity_request(void)1095 static u8 * eap_ttls_fake_identity_request(void)
1096 {
1097 	struct eap_hdr *hdr;
1098 	u8 *buf;
1099 
1100 	wpa_printf(MSG_DEBUG, "EAP-TTLS: empty data in beginning of "
1101 		   "Phase 2 - use fake EAP-Request Identity");
1102 	buf = os_malloc(sizeof(*hdr) + 1);
1103 	if (buf == NULL) {
1104 		wpa_printf(MSG_WARNING, "EAP-TTLS: failed to allocate "
1105 			   "memory for fake EAP-Identity Request");
1106 		return NULL;
1107 	}
1108 
1109 	hdr = (struct eap_hdr *) buf;
1110 	hdr->code = EAP_CODE_REQUEST;
1111 	hdr->identifier = 0;
1112 	hdr->length = host_to_be16(sizeof(*hdr) + 1);
1113 	buf[sizeof(*hdr)] = EAP_TYPE_IDENTITY;
1114 
1115 	return buf;
1116 }
1117 
1118 
eap_ttls_encrypt_response(struct eap_sm * sm,struct eap_ttls_data * data,struct wpabuf * resp,u8 identifier,struct wpabuf ** out_data)1119 static int eap_ttls_encrypt_response(struct eap_sm *sm,
1120 				     struct eap_ttls_data *data,
1121 				     struct wpabuf *resp, u8 identifier,
1122 				     struct wpabuf **out_data)
1123 {
1124 	if (resp == NULL)
1125 		return 0;
1126 
1127 	wpa_hexdump_buf_key(MSG_DEBUG, "EAP-TTLS: Encrypting Phase 2 data",
1128 			    resp);
1129 #ifdef EXT_AUTHENTICATION_SUPPORT
1130     if (sm->eapRespData != NULL && sm->eapRespData->size > TYPE_OFFSET) {
1131         int ifname = get_ext_auth(EAP_CODE_RESPONSE, (int)(sm->eapRespData->buf[TYPE_OFFSET]));
1132         if (IFNAME_UNKNOWN < ifname && ifname < IFNAME_SIZE) {
1133             set_eap_data(sm->eapRespData->buf, sm->eapRespData->size);
1134             wpa_printf(MSG_DEBUG, "ext_certification set_encrypt_data");
1135             set_encrypt_data(&data->ssl, EAP_TYPE_TTLS, data->ttls_version, identifier);
1136         }
1137     }
1138 #endif /* EXT_AUTHENTICATION_SUPPORT */
1139 	if (eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_TTLS,
1140 				 data->ttls_version, identifier,
1141 				 resp, out_data)) {
1142 		wpa_printf(MSG_INFO, "EAP-TTLS: Failed to encrypt a Phase 2 "
1143 			   "frame");
1144 		wpabuf_clear_free(resp);
1145 		return -1;
1146 	}
1147 	wpabuf_clear_free(resp);
1148 
1149 	return 0;
1150 }
1151 
1152 
eap_ttls_process_phase2_eap(struct eap_sm * sm,struct eap_ttls_data * data,struct eap_method_ret * ret,struct ttls_parse_avp * parse,struct wpabuf ** resp)1153 static int eap_ttls_process_phase2_eap(struct eap_sm *sm,
1154 				       struct eap_ttls_data *data,
1155 				       struct eap_method_ret *ret,
1156 				       struct ttls_parse_avp *parse,
1157 				       struct wpabuf **resp)
1158 {
1159 	struct eap_hdr *hdr;
1160 	size_t len;
1161 
1162 	if (parse->eapdata == NULL) {
1163 		wpa_printf(MSG_WARNING, "EAP-TTLS: No EAP Message in the "
1164 			   "packet - dropped");
1165 		return -1;
1166 	}
1167 
1168 	wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Phase 2 EAP",
1169 		    parse->eapdata, parse->eap_len);
1170 	hdr = (struct eap_hdr *) parse->eapdata;
1171 
1172 	if (parse->eap_len < sizeof(*hdr)) {
1173 		wpa_printf(MSG_WARNING, "EAP-TTLS: Too short Phase 2 EAP "
1174 			   "frame (len=%lu, expected %lu or more) - dropped",
1175 			   (unsigned long) parse->eap_len,
1176 			   (unsigned long) sizeof(*hdr));
1177 		return -1;
1178 	}
1179 	len = be_to_host16(hdr->length);
1180 	if (len > parse->eap_len) {
1181 		wpa_printf(MSG_INFO, "EAP-TTLS: Length mismatch in Phase 2 "
1182 			   "EAP frame (EAP hdr len=%lu, EAP data len in "
1183 			   "AVP=%lu)",
1184 			   (unsigned long) len,
1185 			   (unsigned long) parse->eap_len);
1186 		return -1;
1187 	}
1188 	wpa_printf(MSG_DEBUG, "EAP-TTLS: received Phase 2: code=%d "
1189 		   "identifier=%d length=%lu",
1190 		   hdr->code, hdr->identifier, (unsigned long) len);
1191 	switch (hdr->code) {
1192 	case EAP_CODE_REQUEST:
1193 		if (eap_ttls_phase2_request(sm, data, ret, hdr, resp)) {
1194 			wpa_printf(MSG_INFO, "EAP-TTLS: Phase2 Request "
1195 				   "processing failed");
1196 			return -1;
1197 		}
1198 		break;
1199 	default:
1200 		wpa_printf(MSG_INFO, "EAP-TTLS: Unexpected code=%d in "
1201 			   "Phase 2 EAP header", hdr->code);
1202 		return -1;
1203 	}
1204 
1205 	return 0;
1206 }
1207 
1208 
eap_ttls_process_phase2_mschapv2(struct eap_sm * sm,struct eap_ttls_data * data,struct eap_method_ret * ret,struct ttls_parse_avp * parse)1209 static int eap_ttls_process_phase2_mschapv2(struct eap_sm *sm,
1210 					    struct eap_ttls_data *data,
1211 					    struct eap_method_ret *ret,
1212 					    struct ttls_parse_avp *parse)
1213 {
1214 #ifdef EAP_MSCHAPv2
1215 	if (parse->mschapv2_error) {
1216 		wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Received "
1217 			   "MS-CHAP-Error - failed");
1218 		ret->methodState = METHOD_DONE;
1219 		ret->decision = DECISION_FAIL;
1220 		/* Reply with empty data to ACK error */
1221 		return 1;
1222 	}
1223 
1224 	if (parse->mschapv2 == NULL) {
1225 #ifdef EAP_TNC
1226 		if (data->phase2_success && parse->eapdata) {
1227 			/*
1228 			 * Allow EAP-TNC to be started after successfully
1229 			 * completed MSCHAPV2.
1230 			 */
1231 			return 1;
1232 		}
1233 #endif /* EAP_TNC */
1234 		wpa_printf(MSG_WARNING, "EAP-TTLS: no MS-CHAP2-Success AVP "
1235 			   "received for Phase2 MSCHAPV2");
1236 		return -1;
1237 	}
1238 	if (parse->mschapv2[0] != data->ident) {
1239 		wpa_printf(MSG_WARNING, "EAP-TTLS: Ident mismatch for Phase 2 "
1240 			   "MSCHAPV2 (received Ident 0x%02x, expected 0x%02x)",
1241 			   parse->mschapv2[0], data->ident);
1242 		return -1;
1243 	}
1244 	if (!data->auth_response_valid ||
1245 	    mschapv2_verify_auth_response(data->auth_response,
1246 					  parse->mschapv2 + 1, 42)) {
1247 		wpa_printf(MSG_WARNING, "EAP-TTLS: Invalid authenticator "
1248 			   "response in Phase 2 MSCHAPV2 success request");
1249 		return -1;
1250 	}
1251 
1252 	wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 MSCHAPV2 "
1253 		   "authentication succeeded");
1254 	ret->methodState = METHOD_DONE;
1255 	ret->decision = DECISION_UNCOND_SUCC;
1256 	data->phase2_success = 1;
1257 
1258 	/*
1259 	 * Reply with empty data; authentication server will reply
1260 	 * with EAP-Success after this.
1261 	 */
1262 	return 1;
1263 #else /* EAP_MSCHAPv2 */
1264 	wpa_printf(MSG_ERROR, "EAP-TTLS: MSCHAPv2 not included in the build");
1265 	return -1;
1266 #endif /* EAP_MSCHAPv2 */
1267 }
1268 
1269 
1270 #ifdef EAP_TNC
eap_ttls_process_tnc_start(struct eap_sm * sm,struct eap_ttls_data * data,struct eap_method_ret * ret,struct ttls_parse_avp * parse,struct wpabuf ** resp)1271 static int eap_ttls_process_tnc_start(struct eap_sm *sm,
1272 				      struct eap_ttls_data *data,
1273 				      struct eap_method_ret *ret,
1274 				      struct ttls_parse_avp *parse,
1275 				      struct wpabuf **resp)
1276 {
1277 	/* TNC uses inner EAP method after non-EAP TTLS phase 2. */
1278 	if (parse->eapdata == NULL) {
1279 		wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received "
1280 			   "unexpected tunneled data (no EAP)");
1281 		return -1;
1282 	}
1283 
1284 	if (!data->ready_for_tnc) {
1285 		wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received "
1286 			   "EAP after non-EAP, but not ready for TNC");
1287 		return -1;
1288 	}
1289 
1290 	wpa_printf(MSG_DEBUG, "EAP-TTLS: Start TNC after completed "
1291 		   "non-EAP method");
1292 	data->tnc_started = 1;
1293 
1294 	if (eap_ttls_process_phase2_eap(sm, data, ret, parse, resp) < 0)
1295 		return -1;
1296 
1297 	return 0;
1298 }
1299 #endif /* EAP_TNC */
1300 
1301 
eap_ttls_process_decrypted(struct eap_sm * sm,struct eap_ttls_data * data,struct eap_method_ret * ret,u8 identifier,struct ttls_parse_avp * parse,struct wpabuf * in_decrypted,struct wpabuf ** out_data)1302 static int eap_ttls_process_decrypted(struct eap_sm *sm,
1303 				      struct eap_ttls_data *data,
1304 				      struct eap_method_ret *ret,
1305 				      u8 identifier,
1306 				      struct ttls_parse_avp *parse,
1307 				      struct wpabuf *in_decrypted,
1308 				      struct wpabuf **out_data)
1309 {
1310 	struct wpabuf *resp = NULL;
1311 	struct eap_peer_config *config = eap_get_config(sm);
1312 	int res;
1313 	enum phase2_types phase2_type = data->phase2_type;
1314 
1315 #ifdef EAP_TNC
1316 	if (data->tnc_started)
1317 		phase2_type = EAP_TTLS_PHASE2_EAP;
1318 #endif /* EAP_TNC */
1319 
1320 	switch (phase2_type) {
1321 	case EAP_TTLS_PHASE2_EAP:
1322 		if (eap_ttls_process_phase2_eap(sm, data, ret, parse, &resp) <
1323 		    0)
1324 			return -1;
1325 		break;
1326 	case EAP_TTLS_PHASE2_MSCHAPV2:
1327 		res = eap_ttls_process_phase2_mschapv2(sm, data, ret, parse);
1328 #ifdef EAP_TNC
1329 		if (res == 1 && parse->eapdata && data->phase2_success) {
1330 			/*
1331 			 * TNC may be required as the next
1332 			 * authentication method within the tunnel.
1333 			 */
1334 			ret->methodState = METHOD_MAY_CONT;
1335 			data->ready_for_tnc = 1;
1336 			if (eap_ttls_process_tnc_start(sm, data, ret, parse,
1337 						       &resp) == 0)
1338 				break;
1339 		}
1340 #endif /* EAP_TNC */
1341 		return res;
1342 	case EAP_TTLS_PHASE2_MSCHAP:
1343 	case EAP_TTLS_PHASE2_PAP:
1344 	case EAP_TTLS_PHASE2_CHAP:
1345 #ifdef EAP_TNC
1346 		if (eap_ttls_process_tnc_start(sm, data, ret, parse, &resp) <
1347 		    0)
1348 			return -1;
1349 		break;
1350 #else /* EAP_TNC */
1351 		/* EAP-TTLS/{MSCHAP,PAP,CHAP} should not send any TLS tunneled
1352 		 * requests to the supplicant */
1353 		wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received unexpected "
1354 			   "tunneled data");
1355 		return -1;
1356 #endif /* EAP_TNC */
1357 	}
1358 
1359 	if (resp) {
1360 		if (eap_ttls_encrypt_response(sm, data, resp, identifier,
1361 					      out_data) < 0)
1362 			return -1;
1363 	} else if (config->pending_req_identity ||
1364 		   config->pending_req_password ||
1365 		   config->pending_req_otp ||
1366 		   config->pending_req_new_password ||
1367 		   config->pending_req_sim) {
1368 		wpabuf_clear_free(data->pending_phase2_req);
1369 		data->pending_phase2_req = wpabuf_dup(in_decrypted);
1370 	}
1371 
1372 	return 0;
1373 }
1374 
1375 
eap_ttls_implicit_identity_request(struct eap_sm * sm,struct eap_ttls_data * data,struct eap_method_ret * ret,u8 identifier,struct wpabuf ** out_data)1376 static int eap_ttls_implicit_identity_request(struct eap_sm *sm,
1377 					      struct eap_ttls_data *data,
1378 					      struct eap_method_ret *ret,
1379 					      u8 identifier,
1380 					      struct wpabuf **out_data)
1381 {
1382 	int retval = 0;
1383 	struct eap_hdr *hdr;
1384 	struct wpabuf *resp;
1385 
1386 	hdr = (struct eap_hdr *) eap_ttls_fake_identity_request();
1387 	if (hdr == NULL) {
1388 		ret->methodState = METHOD_DONE;
1389 		ret->decision = DECISION_FAIL;
1390 		return -1;
1391 	}
1392 
1393 	resp = NULL;
1394 	if (eap_ttls_phase2_request(sm, data, ret, hdr, &resp)) {
1395 		wpa_printf(MSG_INFO, "EAP-TTLS: Phase2 Request "
1396 			   "processing failed");
1397 		retval = -1;
1398 	} else {
1399 		struct eap_peer_config *config = eap_get_config(sm);
1400 		if (resp == NULL &&
1401 		    (config->pending_req_identity ||
1402 		     config->pending_req_password ||
1403 		     config->pending_req_otp ||
1404 		     config->pending_req_new_password ||
1405 		     config->pending_req_sim)) {
1406 			/*
1407 			 * Use empty buffer to force implicit request
1408 			 * processing when EAP request is re-processed after
1409 			 * user input.
1410 			 */
1411 			wpabuf_clear_free(data->pending_phase2_req);
1412 			data->pending_phase2_req = wpabuf_alloc(0);
1413 		}
1414 
1415 		retval = eap_ttls_encrypt_response(sm, data, resp, identifier,
1416 						   out_data);
1417 	}
1418 
1419 	os_free(hdr);
1420 
1421 	if (retval < 0) {
1422 		ret->methodState = METHOD_DONE;
1423 		ret->decision = DECISION_FAIL;
1424 	}
1425 
1426 	return retval;
1427 }
1428 
1429 
eap_ttls_phase2_start(struct eap_sm * sm,struct eap_ttls_data * data,struct eap_method_ret * ret,u8 identifier,struct wpabuf ** out_data)1430 static int eap_ttls_phase2_start(struct eap_sm *sm, struct eap_ttls_data *data,
1431 				 struct eap_method_ret *ret, u8 identifier,
1432 				 struct wpabuf **out_data)
1433 {
1434 	data->phase2_start = 0;
1435 
1436 	/*
1437 	 * EAP-TTLS does not use Phase2 on fast re-auth; this must be done only
1438 	 * if TLS part was indeed resuming a previous session. Most
1439 	 * Authentication Servers terminate EAP-TTLS before reaching this
1440 	 * point, but some do not. Make wpa_supplicant stop phase 2 here, if
1441 	 * needed.
1442 	 */
1443 	if (data->reauth &&
1444 	    tls_connection_resumed(sm->ssl_ctx, data->ssl.conn)) {
1445 		wpa_printf(MSG_DEBUG, "EAP-TTLS: Session resumption - "
1446 			   "skip phase 2");
1447 		*out_data = eap_peer_tls_build_ack(identifier, EAP_TYPE_TTLS,
1448 						   data->ttls_version);
1449 		ret->methodState = METHOD_DONE;
1450 		ret->decision = DECISION_UNCOND_SUCC;
1451 		data->phase2_success = 1;
1452 		return 0;
1453 	}
1454 
1455 	return eap_ttls_implicit_identity_request(sm, data, ret, identifier,
1456 						  out_data);
1457 }
1458 
1459 
eap_ttls_decrypt(struct eap_sm * sm,struct eap_ttls_data * data,struct eap_method_ret * ret,u8 identifier,const struct wpabuf * in_data,struct wpabuf ** out_data)1460 static int eap_ttls_decrypt(struct eap_sm *sm, struct eap_ttls_data *data,
1461 			    struct eap_method_ret *ret, u8 identifier,
1462 			    const struct wpabuf *in_data,
1463 			    struct wpabuf **out_data)
1464 {
1465 	struct wpabuf *in_decrypted = NULL;
1466 	int retval = 0;
1467 	struct ttls_parse_avp parse;
1468 
1469 	os_memset(&parse, 0, sizeof(parse));
1470 
1471 	wpa_printf(MSG_DEBUG, "EAP-TTLS: received %lu bytes encrypted data for"
1472 		   " Phase 2",
1473 		   in_data ? (unsigned long) wpabuf_len(in_data) : 0);
1474 
1475 	if (data->pending_phase2_req) {
1476 		wpa_printf(MSG_DEBUG, "EAP-TTLS: Pending Phase 2 request - "
1477 			   "skip decryption and use old data");
1478 		/* Clear TLS reassembly state. */
1479 		eap_peer_tls_reset_input(&data->ssl);
1480 
1481 		in_decrypted = data->pending_phase2_req;
1482 		data->pending_phase2_req = NULL;
1483 		if (wpabuf_len(in_decrypted) == 0) {
1484 			wpabuf_clear_free(in_decrypted);
1485 			return eap_ttls_implicit_identity_request(
1486 				sm, data, ret, identifier, out_data);
1487 		}
1488 		goto continue_req;
1489 	}
1490 
1491 	if ((in_data == NULL || wpabuf_len(in_data) == 0) &&
1492 	    data->phase2_start) {
1493 start:
1494 		return eap_ttls_phase2_start(sm, data, ret, identifier,
1495 					     out_data);
1496 	}
1497 
1498 	if (in_data == NULL || wpabuf_len(in_data) == 0) {
1499 #ifdef EXT_AUTHENTICATION_SUPPORT
1500         if (sm->eapRespData != NULL && sm->eapRespData->size > TYPE_OFFSET) {
1501             int ifname = get_ext_auth(EAP_CODE_RESPONSE, (int)(sm->eapRespData->buf[TYPE_OFFSET]));
1502             if (IFNAME_UNKOWN < ifname && ifname < IFNAME_SIZE) {
1503                 set_eap_data(sm->eapRespData->buf, sm->eapRespData->size);
1504                 wpa_printf(MSG_DEBUG, "ext_certification set_encrypt_data");
1505                 set_encrypt_data(&data->ssl, EAP_TYPE_TTLS, data->ttls_version, identifier);
1506             }
1507         }
1508 #endif /* EXT_AUTHENTICATION_SUPPORT */
1509 		/* Received TLS ACK - requesting more fragments */
1510 		return eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_TTLS,
1511 					    data->ttls_version,
1512 					    identifier, NULL, out_data);
1513 	}
1514 
1515 	retval = eap_peer_tls_decrypt(sm, &data->ssl, in_data, &in_decrypted);
1516 	if (retval)
1517 		goto done;
1518 	if (wpabuf_len(in_decrypted) == 0) {
1519 		wpabuf_free(in_decrypted);
1520 		goto start;
1521 	}
1522 
1523 	/* RFC 9190 Section 2.5 */
1524 	if (data->ssl.tls_v13 && wpabuf_len(in_decrypted) == 1 &&
1525 	    *wpabuf_head_u8(in_decrypted) == 0) {
1526 		wpa_printf(MSG_DEBUG,
1527 			   "EAP-TLS: ACKing protected success indication (appl data 0x00)");
1528 		eap_peer_tls_reset_output(&data->ssl);
1529 		wpabuf_free(in_decrypted);
1530 		return 1;
1531 	}
1532 
1533 continue_req:
1534 	data->phase2_start = 0;
1535 
1536 	if (eap_ttls_parse_avps(in_decrypted, &parse) < 0) {
1537 		retval = -1;
1538 		goto done;
1539 	}
1540 
1541 	retval = eap_ttls_process_decrypted(sm, data, ret, identifier,
1542 					    &parse, in_decrypted, out_data);
1543 
1544 done:
1545 	wpabuf_clear_free(in_decrypted);
1546 	os_free(parse.eapdata);
1547 
1548 	if (retval < 0) {
1549 		ret->methodState = METHOD_DONE;
1550 		ret->decision = DECISION_FAIL;
1551 	}
1552 
1553 	return retval;
1554 }
1555 
1556 
eap_ttls_process_handshake(struct eap_sm * sm,struct eap_ttls_data * data,struct eap_method_ret * ret,u8 identifier,const struct wpabuf * in_data,struct wpabuf ** out_data)1557 static int eap_ttls_process_handshake(struct eap_sm *sm,
1558 				      struct eap_ttls_data *data,
1559 				      struct eap_method_ret *ret,
1560 				      u8 identifier,
1561 				      const struct wpabuf *in_data,
1562 				      struct wpabuf **out_data)
1563 {
1564 	int res;
1565 
1566 	if (sm->waiting_ext_cert_check && data->pending_resp) {
1567 		struct eap_peer_config *config = eap_get_config(sm);
1568 
1569 		if (config->pending_ext_cert_check == EXT_CERT_CHECK_GOOD) {
1570 			wpa_printf(MSG_DEBUG,
1571 				   "EAP-TTLS: External certificate check succeeded - continue handshake");
1572 			*out_data = data->pending_resp;
1573 			data->pending_resp = NULL;
1574 			sm->waiting_ext_cert_check = 0;
1575 			return 0;
1576 		}
1577 
1578 		if (config->pending_ext_cert_check == EXT_CERT_CHECK_BAD) {
1579 			wpa_printf(MSG_DEBUG,
1580 				   "EAP-TTLS: External certificate check failed - force authentication failure");
1581 			ret->methodState = METHOD_DONE;
1582 			ret->decision = DECISION_FAIL;
1583 			sm->waiting_ext_cert_check = 0;
1584 			return 0;
1585 		}
1586 
1587 		wpa_printf(MSG_DEBUG,
1588 			   "EAP-TTLS: Continuing to wait external server certificate validation");
1589 		return 0;
1590 	}
1591 
1592 	res = eap_peer_tls_process_helper(sm, &data->ssl, EAP_TYPE_TTLS,
1593 					  data->ttls_version, identifier,
1594 					  in_data, out_data);
1595 	if (res < 0) {
1596 		wpa_printf(MSG_DEBUG, "EAP-TTLS: TLS processing failed");
1597 		ret->methodState = METHOD_DONE;
1598 		ret->decision = DECISION_FAIL;
1599 		return -1;
1600 	}
1601 
1602 	if (sm->waiting_ext_cert_check) {
1603 		wpa_printf(MSG_DEBUG,
1604 			   "EAP-TTLS: Waiting external server certificate validation");
1605 		wpabuf_clear_free(data->pending_resp);
1606 		data->pending_resp = *out_data;
1607 		*out_data = NULL;
1608 		return 0;
1609 	}
1610 
1611 	if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) {
1612 		wpa_printf(MSG_DEBUG, "EAP-TTLS: TLS done, proceed to "
1613 			   "Phase 2");
1614 		if (data->resuming) {
1615 			wpa_printf(MSG_DEBUG, "EAP-TTLS: fast reauth - may "
1616 				   "skip Phase 2");
1617 			ret->decision = DECISION_COND_SUCC;
1618 			ret->methodState = METHOD_MAY_CONT;
1619 		}
1620 		data->phase2_start = 1;
1621 		eap_ttls_v0_derive_key(sm, data);
1622 
1623 		if (*out_data == NULL || wpabuf_len(*out_data) == 0) {
1624 			if (eap_ttls_decrypt(sm, data, ret, identifier,
1625 					     NULL, out_data)) {
1626 				wpa_printf(MSG_WARNING, "EAP-TTLS: "
1627 					   "failed to process early "
1628 					   "start for Phase 2");
1629 			}
1630 			res = 0;
1631 		}
1632 		data->resuming = 0;
1633 	}
1634 
1635 	if (res == 2) {
1636 		/*
1637 		 * Application data included in the handshake message.
1638 		 */
1639 		wpabuf_clear_free(data->pending_phase2_req);
1640 		data->pending_phase2_req = *out_data;
1641 		*out_data = NULL;
1642 		res = eap_ttls_decrypt(sm, data, ret, identifier, in_data,
1643 				       out_data);
1644 	}
1645 
1646 	return res;
1647 }
1648 
1649 
eap_ttls_check_auth_status(struct eap_sm * sm,struct eap_ttls_data * data,struct eap_method_ret * ret)1650 static void eap_ttls_check_auth_status(struct eap_sm *sm,
1651 				       struct eap_ttls_data *data,
1652 				       struct eap_method_ret *ret)
1653 {
1654 	if (ret->methodState == METHOD_DONE) {
1655 		ret->allowNotifications = false;
1656 		if (ret->decision == DECISION_UNCOND_SUCC ||
1657 		    ret->decision == DECISION_COND_SUCC) {
1658 			wpa_printf(MSG_DEBUG, "EAP-TTLS: Authentication "
1659 				   "completed successfully");
1660 			data->phase2_success = 1;
1661 			data->decision_succ = ret->decision;
1662 #ifdef EAP_TNC
1663 			if (!data->ready_for_tnc && !data->tnc_started) {
1664 				/*
1665 				 * TNC may be required as the next
1666 				 * authentication method within the tunnel.
1667 				 */
1668 				ret->methodState = METHOD_MAY_CONT;
1669 				data->ready_for_tnc = 1;
1670 			}
1671 #endif /* EAP_TNC */
1672 		}
1673 	} else if (ret->methodState == METHOD_MAY_CONT &&
1674 		   (ret->decision == DECISION_UNCOND_SUCC ||
1675 		    ret->decision == DECISION_COND_SUCC)) {
1676 			wpa_printf(MSG_DEBUG, "EAP-TTLS: Authentication "
1677 				   "completed successfully (MAY_CONT)");
1678 			data->phase2_success = 1;
1679 			data->decision_succ = ret->decision;
1680 	} else if (data->decision_succ != DECISION_FAIL &&
1681 		   data->phase2_success &&
1682 		   !data->ssl.tls_out) {
1683 		/*
1684 		 * This is needed to cover the case where the final Phase 2
1685 		 * message gets fragmented since fragmentation clears
1686 		 * decision back to FAIL.
1687 		 */
1688 		wpa_printf(MSG_DEBUG,
1689 			   "EAP-TTLS: Restore success decision after fragmented frame sent completely");
1690 		ret->decision = data->decision_succ;
1691 	}
1692 }
1693 
1694 
eap_ttls_process(struct eap_sm * sm,void * priv,struct eap_method_ret * ret,const struct wpabuf * reqData)1695 static struct wpabuf * eap_ttls_process(struct eap_sm *sm, void *priv,
1696 					struct eap_method_ret *ret,
1697 					const struct wpabuf *reqData)
1698 {
1699 	size_t left;
1700 	int res;
1701 	u8 flags, id;
1702 	struct wpabuf *resp;
1703 	const u8 *pos;
1704 	struct eap_ttls_data *data = priv;
1705 	struct wpabuf msg;
1706 
1707 	pos = eap_peer_tls_process_init(sm, &data->ssl, EAP_TYPE_TTLS, ret,
1708 					reqData, &left, &flags);
1709 	if (pos == NULL)
1710 		return NULL;
1711 	id = eap_get_id(reqData);
1712 
1713 	if (flags & EAP_TLS_FLAGS_START) {
1714 		wpa_printf(MSG_DEBUG, "EAP-TTLS: Start (server ver=%d, own "
1715 			   "ver=%d)", flags & EAP_TLS_VERSION_MASK,
1716 			   data->ttls_version);
1717 
1718 		/* RFC 5281, Ch. 9.2:
1719 		 * "This packet MAY contain additional information in the form
1720 		 * of AVPs, which may provide useful hints to the client"
1721 		 * For now, ignore any potential extra data.
1722 		 */
1723 		left = 0;
1724 	}
1725 
1726 	wpabuf_set(&msg, pos, left);
1727 
1728 	resp = NULL;
1729 	if (tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&
1730 	    !data->resuming) {
1731 		res = eap_ttls_decrypt(sm, data, ret, id, &msg, &resp);
1732 	} else {
1733 		res = eap_ttls_process_handshake(sm, data, ret, id,
1734 						 &msg, &resp);
1735 	}
1736 
1737 	eap_ttls_check_auth_status(sm, data, ret);
1738 
1739 	/* FIX: what about res == -1? Could just move all error processing into
1740 	 * the other functions and get rid of this res==1 case here. */
1741 	if (res == 1) {
1742 		wpabuf_clear_free(resp);
1743 		return eap_peer_tls_build_ack(id, EAP_TYPE_TTLS,
1744 					      data->ttls_version);
1745 	}
1746 	return resp;
1747 }
1748 
1749 
eap_ttls_has_reauth_data(struct eap_sm * sm,void * priv)1750 static bool eap_ttls_has_reauth_data(struct eap_sm *sm, void *priv)
1751 {
1752 	struct eap_ttls_data *data = priv;
1753 
1754 	return tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&
1755 		data->phase2_success && data->phase2_auth != ALWAYS;
1756 }
1757 
1758 
eap_ttls_deinit_for_reauth(struct eap_sm * sm,void * priv)1759 static void eap_ttls_deinit_for_reauth(struct eap_sm *sm, void *priv)
1760 {
1761 	struct eap_ttls_data *data = priv;
1762 
1763 	if (data->phase2_priv && data->phase2_method &&
1764 	    data->phase2_method->deinit_for_reauth)
1765 		data->phase2_method->deinit_for_reauth(sm, data->phase2_priv);
1766 	wpabuf_clear_free(data->pending_phase2_req);
1767 	data->pending_phase2_req = NULL;
1768 	wpabuf_clear_free(data->pending_resp);
1769 	data->pending_resp = NULL;
1770 	data->decision_succ = DECISION_FAIL;
1771 #ifdef EAP_TNC
1772 	data->ready_for_tnc = 0;
1773 	data->tnc_started = 0;
1774 #endif /* EAP_TNC */
1775 }
1776 
1777 
eap_ttls_init_for_reauth(struct eap_sm * sm,void * priv)1778 static void * eap_ttls_init_for_reauth(struct eap_sm *sm, void *priv)
1779 {
1780 	struct eap_ttls_data *data = priv;
1781 	eap_ttls_free_key(data);
1782 	os_free(data->session_id);
1783 	data->session_id = NULL;
1784 	if (eap_peer_tls_reauth_init(sm, &data->ssl)) {
1785 		os_free(data);
1786 		return NULL;
1787 	}
1788 	if (data->phase2_priv && data->phase2_method &&
1789 	    data->phase2_method->init_for_reauth)
1790 		data->phase2_method->init_for_reauth(sm, data->phase2_priv);
1791 	data->phase2_start = 0;
1792 	data->phase2_success = 0;
1793 	data->resuming = 1;
1794 	data->reauth = 1;
1795 	return priv;
1796 }
1797 
1798 
eap_ttls_get_status(struct eap_sm * sm,void * priv,char * buf,size_t buflen,int verbose)1799 static int eap_ttls_get_status(struct eap_sm *sm, void *priv, char *buf,
1800 			       size_t buflen, int verbose)
1801 {
1802 	struct eap_ttls_data *data = priv;
1803 	int len, ret;
1804 
1805 	len = eap_peer_tls_status(sm, &data->ssl, buf, buflen, verbose);
1806 	ret = os_snprintf(buf + len, buflen - len,
1807 			  "EAP-TTLSv%d Phase2 method=",
1808 			  data->ttls_version);
1809 	if (os_snprintf_error(buflen - len, ret))
1810 		return len;
1811 	len += ret;
1812 	switch (data->phase2_type) {
1813 	case EAP_TTLS_PHASE2_EAP:
1814 		ret = os_snprintf(buf + len, buflen - len, "EAP-%s\n",
1815 				  data->phase2_method ?
1816 				  data->phase2_method->name : "?");
1817 		break;
1818 	case EAP_TTLS_PHASE2_MSCHAPV2:
1819 		ret = os_snprintf(buf + len, buflen - len, "MSCHAPV2\n");
1820 		break;
1821 	case EAP_TTLS_PHASE2_MSCHAP:
1822 		ret = os_snprintf(buf + len, buflen - len, "MSCHAP\n");
1823 		break;
1824 	case EAP_TTLS_PHASE2_PAP:
1825 		ret = os_snprintf(buf + len, buflen - len, "PAP\n");
1826 		break;
1827 	case EAP_TTLS_PHASE2_CHAP:
1828 		ret = os_snprintf(buf + len, buflen - len, "CHAP\n");
1829 		break;
1830 	default:
1831 		ret = 0;
1832 		break;
1833 	}
1834 	if (os_snprintf_error(buflen - len, ret))
1835 		return len;
1836 	len += ret;
1837 
1838 	return len;
1839 }
1840 
1841 
eap_ttls_isKeyAvailable(struct eap_sm * sm,void * priv)1842 static bool eap_ttls_isKeyAvailable(struct eap_sm *sm, void *priv)
1843 {
1844 	struct eap_ttls_data *data = priv;
1845 	return data->key_data != NULL && data->phase2_success;
1846 }
1847 
1848 
eap_ttls_getKey(struct eap_sm * sm,void * priv,size_t * len)1849 static u8 * eap_ttls_getKey(struct eap_sm *sm, void *priv, size_t *len)
1850 {
1851 	struct eap_ttls_data *data = priv;
1852 	u8 *key;
1853 
1854 	if (data->key_data == NULL || !data->phase2_success)
1855 		return NULL;
1856 
1857 	key = os_memdup(data->key_data, EAP_TLS_KEY_LEN);
1858 	if (key == NULL)
1859 		return NULL;
1860 
1861 	*len = EAP_TLS_KEY_LEN;
1862 
1863 	return key;
1864 }
1865 
1866 
eap_ttls_get_session_id(struct eap_sm * sm,void * priv,size_t * len)1867 static u8 * eap_ttls_get_session_id(struct eap_sm *sm, void *priv, size_t *len)
1868 {
1869 	struct eap_ttls_data *data = priv;
1870 	u8 *id;
1871 
1872 	if (data->session_id == NULL || !data->phase2_success)
1873 		return NULL;
1874 
1875 	id = os_memdup(data->session_id, data->id_len);
1876 	if (id == NULL)
1877 		return NULL;
1878 
1879 	*len = data->id_len;
1880 
1881 	return id;
1882 }
1883 
1884 
eap_ttls_get_emsk(struct eap_sm * sm,void * priv,size_t * len)1885 static u8 * eap_ttls_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
1886 {
1887 	struct eap_ttls_data *data = priv;
1888 	u8 *key;
1889 
1890 	if (data->key_data == NULL)
1891 		return NULL;
1892 
1893 	key = os_memdup(data->key_data + EAP_TLS_KEY_LEN, EAP_EMSK_LEN);
1894 	if (key == NULL)
1895 		return NULL;
1896 
1897 	*len = EAP_EMSK_LEN;
1898 
1899 	return key;
1900 }
1901 
1902 
eap_peer_ttls_register(void)1903 int eap_peer_ttls_register(void)
1904 {
1905 	struct eap_method *eap;
1906 
1907 	eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
1908 				    EAP_VENDOR_IETF, EAP_TYPE_TTLS, "TTLS");
1909 	if (eap == NULL)
1910 		return -1;
1911 
1912 	eap->init = eap_ttls_init;
1913 	eap->deinit = eap_ttls_deinit;
1914 	eap->process = eap_ttls_process;
1915 	eap->isKeyAvailable = eap_ttls_isKeyAvailable;
1916 	eap->getKey = eap_ttls_getKey;
1917 	eap->getSessionId = eap_ttls_get_session_id;
1918 	eap->get_status = eap_ttls_get_status;
1919 	eap->has_reauth_data = eap_ttls_has_reauth_data;
1920 	eap->deinit_for_reauth = eap_ttls_deinit_for_reauth;
1921 	eap->init_for_reauth = eap_ttls_init_for_reauth;
1922 	eap->get_emsk = eap_ttls_get_emsk;
1923 
1924 	return eap_peer_method_register(eap);
1925 }
1926