git.maemo.org Git - wpasupplicant/blob - src/eap_server/eap_ttls.c

   1 /*
   2  * hostapd / EAP-TTLS (draft-ietf-pppext-eap-ttls-05.txt)
   3  * Copyright (c) 2004-2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "eap_server/eap_i.h"
  19 #include "eap_server/eap_tls_common.h"
  20 #include "ms_funcs.h"
  21 #include "sha1.h"
  22 #include "eap_common/chap.h"
  23 #include "tls.h"
  24 #include "eap_common/eap_ttls.h"
  25
  26
  27 /* Maximum supported TTLS version
  28  * 0 = draft-ietf-pppext-eap-ttls-03.txt / draft-funk-eap-ttls-v0-00.txt
  29  * 1 = draft-funk-eap-ttls-v1-00.txt
  30  */
  31 #ifndef EAP_TTLS_VERSION
  32 #define EAP_TTLS_VERSION 0 /* TTLSv1 implementation is not yet complete */
  33 #endif /* EAP_TTLS_VERSION */
  34
  35
  36 #define MSCHAPV2_KEY_LEN 16
  37
  38
  39 static void eap_ttls_reset(struct eap_sm *sm, void *priv);
  40
  41
  42 struct eap_ttls_data {
  43         struct eap_ssl_data ssl;
  44         enum {
  45                 START, PHASE1, PHASE2_START, PHASE2_METHOD,
  46                 PHASE2_MSCHAPV2_RESP, PHASE_FINISHED, SUCCESS, FAILURE
  47         } state;
  48
  49         int ttls_version;
  50         int force_version;
  51         const struct eap_method *phase2_method;
  52         void *phase2_priv;
  53         int mschapv2_resp_ok;
  54         u8 mschapv2_auth_response[20];
  55         u8 mschapv2_ident;
  56         int tls_ia_configured;
  57         struct wpabuf *pending_phase2_eap_resp;
  58 };
  59
  60
  61 static const char * eap_ttls_state_txt(int state)
  62 {
  63         switch (state) {
  64         case START:
  65                 return "START";
  66         case PHASE1:
  67                 return "PHASE1";
  68         case PHASE2_START:
  69                 return "PHASE2_START";
  70         case PHASE2_METHOD:
  71                 return "PHASE2_METHOD";
  72         case PHASE2_MSCHAPV2_RESP:
  73                 return "PHASE2_MSCHAPV2_RESP";
  74         case PHASE_FINISHED:
  75                 return "PHASE_FINISHED";
  76         case SUCCESS:
  77                 return "SUCCESS";
  78         case FAILURE:
  79                 return "FAILURE";
  80         default:
  81                 return "Unknown?!";
  82         }
  83 }
  84
  85
  86 static void eap_ttls_state(struct eap_ttls_data *data, int state)
  87 {
  88         wpa_printf(MSG_DEBUG, "EAP-TTLS: %s -> %s",
  89                    eap_ttls_state_txt(data->state),
  90                    eap_ttls_state_txt(state));
  91         data->state = state;
  92 }
  93
  94
  95 static u8 * eap_ttls_avp_hdr(u8 *avphdr, u32 avp_code, u32 vendor_id,
  96                              int mandatory, size_t len)
  97 {
  98         struct ttls_avp_vendor *avp;
  99         u8 flags;
 100         size_t hdrlen;
 101
 102         avp = (struct ttls_avp_vendor *) avphdr;
 103         flags = mandatory ? AVP_FLAGS_MANDATORY : 0;
 104         if (vendor_id) {
 105                 flags |= AVP_FLAGS_VENDOR;
 106                 hdrlen = sizeof(*avp);
 107                 avp->vendor_id = host_to_be32(vendor_id);
 108         } else {
 109                 hdrlen = sizeof(struct ttls_avp);
 110         }
 111
 112         avp->avp_code = host_to_be32(avp_code);
 113         avp->avp_length = host_to_be32((flags << 24) | (hdrlen + len));
 114
 115         return avphdr + hdrlen;
 116 }
 117
 118
 119 static struct wpabuf * eap_ttls_avp_encapsulate(struct wpabuf *resp,
 120                                                 u32 avp_code, int mandatory)
 121 {
 122         struct wpabuf *avp;
 123         u8 *pos;
 124
 125         avp = wpabuf_alloc(sizeof(struct ttls_avp) + wpabuf_len(resp) + 4);
 126         if (avp == NULL) {
 127                 wpabuf_free(resp);
 128                 return NULL;
 129         }
 130
 131         pos = eap_ttls_avp_hdr(wpabuf_mhead(avp), avp_code, 0, mandatory,
 132                                wpabuf_len(resp));
 133         os_memcpy(pos, wpabuf_head(resp), wpabuf_len(resp));
 134         pos += wpabuf_len(resp);
 135         AVP_PAD((const u8 *) wpabuf_head(avp), pos);
 136         wpabuf_free(resp);
 137         wpabuf_put(avp, pos - (u8 *) wpabuf_head(avp));
 138         return avp;
 139 }
 140
 141
 142 struct eap_ttls_avp {
 143          /* Note: eap is allocated memory; caller is responsible for freeing
 144           * it. All the other pointers are pointing to the packet data, i.e.,
 145           * they must not be freed separately. */
 146         u8 *eap;
 147         size_t eap_len;
 148         u8 *user_name;
 149         size_t user_name_len;
 150         u8 *user_password;
 151         size_t user_password_len;
 152         u8 *chap_challenge;
 153         size_t chap_challenge_len;
 154         u8 *chap_password;
 155         size_t chap_password_len;
 156         u8 *mschap_challenge;
 157         size_t mschap_challenge_len;
 158         u8 *mschap_response;
 159         size_t mschap_response_len;
 160         u8 *mschap2_response;
 161         size_t mschap2_response_len;
 162 };
 163
 164
 165 static int eap_ttls_avp_parse(u8 *buf, size_t len, struct eap_ttls_avp *parse)
 166 {
 167         struct ttls_avp *avp;
 168         u8 *pos;
 169         int left;
 170
 171         pos = buf;
 172         left = len;
 173         os_memset(parse, 0, sizeof(*parse));
 174
 175         while (left > 0) {
 176                 u32 avp_code, avp_length, vendor_id = 0;
 177                 u8 avp_flags, *dpos;
 178                 size_t pad, dlen;
 179                 avp = (struct ttls_avp *) pos;
 180                 avp_code = be_to_host32(avp->avp_code);
 181                 avp_length = be_to_host32(avp->avp_length);
 182                 avp_flags = (avp_length >> 24) & 0xff;
 183                 avp_length &= 0xffffff;
 184                 wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP: code=%d flags=0x%02x "
 185                            "length=%d", (int) avp_code, avp_flags,
 186                            (int) avp_length);
 187                 if ((int) avp_length > left) {
 188                         wpa_printf(MSG_WARNING, "EAP-TTLS: AVP overflow "
 189                                    "(len=%d, left=%d) - dropped",
 190                                    (int) avp_length, left);
 191                         goto fail;
 192                 }
 193                 if (avp_length < sizeof(*avp)) {
 194                         wpa_printf(MSG_WARNING, "EAP-TTLS: Invalid AVP length "
 195                                    "%d", avp_length);
 196                         goto fail;
 197                 }
 198                 dpos = (u8 *) (avp + 1);
 199                 dlen = avp_length - sizeof(*avp);
 200                 if (avp_flags & AVP_FLAGS_VENDOR) {
 201                         if (dlen < 4) {
 202                                 wpa_printf(MSG_WARNING, "EAP-TTLS: vendor AVP "
 203                                            "underflow");
 204                                 goto fail;
 205                         }
 206                         vendor_id = be_to_host32(* (be32 *) dpos);
 207                         wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP vendor_id %d",
 208                                    (int) vendor_id);
 209                         dpos += 4;
 210                         dlen -= 4;
 211                 }
 212
 213                 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: AVP data", dpos, dlen);
 214
 215                 if (vendor_id == 0 && avp_code == RADIUS_ATTR_EAP_MESSAGE) {
 216                         wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP - EAP Message");
 217                         if (parse->eap == NULL) {
 218                                 parse->eap = os_malloc(dlen);
 219                                 if (parse->eap == NULL) {
 220                                         wpa_printf(MSG_WARNING, "EAP-TTLS: "
 221                                                    "failed to allocate memory "
 222                                                    "for Phase 2 EAP data");
 223                                         goto fail;
 224                                 }
 225                                 os_memcpy(parse->eap, dpos, dlen);
 226                                 parse->eap_len = dlen;
 227                         } else {
 228                                 u8 *neweap = os_realloc(parse->eap,
 229                                                         parse->eap_len + dlen);
 230                                 if (neweap == NULL) {
 231                                         wpa_printf(MSG_WARNING, "EAP-TTLS: "
 232                                                    "failed to allocate memory "
 233                                                    "for Phase 2 EAP data");
 234                                         goto fail;
 235                                 }
 236                                 os_memcpy(neweap + parse->eap_len, dpos, dlen);
 237                                 parse->eap = neweap;
 238                                 parse->eap_len += dlen;
 239                         }
 240                 } else if (vendor_id == 0 &&
 241                            avp_code == RADIUS_ATTR_USER_NAME) {
 242                         wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: User-Name",
 243                                           dpos, dlen);
 244                         parse->user_name = dpos;
 245                         parse->user_name_len = dlen;
 246                 } else if (vendor_id == 0 &&
 247                            avp_code == RADIUS_ATTR_USER_PASSWORD) {
 248                         u8 *password = dpos;
 249                         size_t password_len = dlen;
 250                         while (password_len > 0 &&
 251                                password[password_len - 1] == '\0') {
 252                                 password_len--;
 253                         }
 254                         wpa_hexdump_ascii_key(MSG_DEBUG, "EAP-TTLS: "
 255                                               "User-Password (PAP)",
 256                                               password, password_len);
 257                         parse->user_password = password;
 258                         parse->user_password_len = password_len;
 259                 } else if (vendor_id == 0 &&
 260                            avp_code == RADIUS_ATTR_CHAP_CHALLENGE) {
 261                         wpa_hexdump(MSG_DEBUG,
 262                                     "EAP-TTLS: CHAP-Challenge (CHAP)",
 263                                     dpos, dlen);
 264                         parse->chap_challenge = dpos;
 265                         parse->chap_challenge_len = dlen;
 266                 } else if (vendor_id == 0 &&
 267                            avp_code == RADIUS_ATTR_CHAP_PASSWORD) {
 268                         wpa_hexdump(MSG_DEBUG,
 269                                     "EAP-TTLS: CHAP-Password (CHAP)",
 270                                     dpos, dlen);
 271                         parse->chap_password = dpos;
 272                         parse->chap_password_len = dlen;
 273                 } else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT &&
 274                            avp_code == RADIUS_ATTR_MS_CHAP_CHALLENGE) {
 275                         wpa_hexdump(MSG_DEBUG,
 276                                     "EAP-TTLS: MS-CHAP-Challenge",
 277                                     dpos, dlen);
 278                         parse->mschap_challenge = dpos;
 279                         parse->mschap_challenge_len = dlen;
 280                 } else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT &&
 281                            avp_code == RADIUS_ATTR_MS_CHAP_RESPONSE) {
 282                         wpa_hexdump(MSG_DEBUG,
 283                                     "EAP-TTLS: MS-CHAP-Response (MSCHAP)",
 284                                     dpos, dlen);
 285                         parse->mschap_response = dpos;
 286                         parse->mschap_response_len = dlen;
 287                 } else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT &&
 288                            avp_code == RADIUS_ATTR_MS_CHAP2_RESPONSE) {
 289                         wpa_hexdump(MSG_DEBUG,
 290                                     "EAP-TTLS: MS-CHAP2-Response (MSCHAPV2)",
 291                                     dpos, dlen);
 292                         parse->mschap2_response = dpos;
 293                         parse->mschap2_response_len = dlen;
 294                 } else if (avp_flags & AVP_FLAGS_MANDATORY) {
 295                         wpa_printf(MSG_WARNING, "EAP-TTLS: Unsupported "
 296                                    "mandatory AVP code %d vendor_id %d - "
 297                                    "dropped", (int) avp_code, (int) vendor_id);
 298                         goto fail;
 299                 } else {
 300                         wpa_printf(MSG_DEBUG, "EAP-TTLS: Ignoring unsupported "
 301                                    "AVP code %d vendor_id %d",
 302                                    (int) avp_code, (int) vendor_id);
 303                 }
 304
 305                 pad = (4 - (avp_length & 3)) & 3;
 306                 pos += avp_length + pad;
 307                 left -= avp_length + pad;
 308         }
 309
 310         return 0;
 311
 312 fail:
 313         os_free(parse->eap);
 314         parse->eap = NULL;
 315         return -1;
 316 }
 317
 318
 319 static u8 * eap_ttls_implicit_challenge(struct eap_sm *sm,
 320                                         struct eap_ttls_data *data, size_t len)
 321 {
 322         struct tls_keys keys;
 323         u8 *challenge, *rnd;
 324
 325         if (data->ttls_version == 0) {
 326                 return eap_server_tls_derive_key(sm, &data->ssl,
 327                                                  "ttls challenge", len);
 328         }
 329
 330         os_memset(&keys, 0, sizeof(keys));
 331         if (tls_connection_get_keys(sm->ssl_ctx, data->ssl.conn, &keys) ||
 332             keys.client_random == NULL || keys.server_random == NULL ||
 333             keys.inner_secret == NULL) {
 334                 wpa_printf(MSG_INFO, "EAP-TTLS: Could not get inner secret, "
 335                            "client random, or server random to derive "
 336                            "implicit challenge");
 337                 return NULL;
 338         }
 339
 340         rnd = os_malloc(keys.client_random_len + keys.server_random_len);
 341         challenge = os_malloc(len);
 342         if (rnd == NULL || challenge == NULL) {
 343                 wpa_printf(MSG_INFO, "EAP-TTLS: No memory for implicit "
 344                            "challenge derivation");
 345                 os_free(rnd);
 346                 os_free(challenge);
 347                 return NULL;
 348         }
 349         os_memcpy(rnd, keys.server_random, keys.server_random_len);
 350         os_memcpy(rnd + keys.server_random_len, keys.client_random,
 351                   keys.client_random_len);
 352
 353         if (tls_prf(keys.inner_secret, keys.inner_secret_len,
 354                     "inner application challenge", rnd,
 355                     keys.client_random_len + keys.server_random_len,
 356                     challenge, len)) {
 357                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Failed to derive implicit "
 358                            "challenge");
 359                 os_free(rnd);
 360                 os_free(challenge);
 361                 return NULL;
 362         }
 363
 364         os_free(rnd);
 365
 366         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived implicit challenge",
 367                         challenge, len);
 368
 369         return challenge;
 370 }
 371
 372
 373 static void * eap_ttls_init(struct eap_sm *sm)
 374 {
 375         struct eap_ttls_data *data;
 376
 377         data = os_zalloc(sizeof(*data));
 378         if (data == NULL)
 379                 return NULL;
 380         data->ttls_version = EAP_TTLS_VERSION;
 381         data->force_version = -1;
 382         if (sm->user && sm->user->force_version >= 0) {
 383                 data->force_version = sm->user->force_version;
 384                 wpa_printf(MSG_DEBUG, "EAP-TTLS: forcing version %d",
 385                            data->force_version);
 386                 data->ttls_version = data->force_version;
 387         }
 388         data->state = START;
 389
 390         if (!(tls_capabilities(sm->ssl_ctx) & TLS_CAPABILITY_IA) &&
 391             data->ttls_version > 0) {
 392                 if (data->force_version > 0) {
 393                         wpa_printf(MSG_INFO, "EAP-TTLS: Forced TTLSv%d and "
 394                                    "TLS library does not support TLS/IA.",
 395                                    data->force_version);
 396                         eap_ttls_reset(sm, data);
 397                         return NULL;
 398                 }
 399                 data->ttls_version = 0;
 400         }
 401
 402         if (eap_server_tls_ssl_init(sm, &data->ssl, 0)) {
 403                 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to initialize SSL.");
 404                 eap_ttls_reset(sm, data);
 405                 return NULL;
 406         }
 407
 408         return data;
 409 }
 410
 411
 412 static void eap_ttls_reset(struct eap_sm *sm, void *priv)
 413 {
 414         struct eap_ttls_data *data = priv;
 415         if (data == NULL)
 416                 return;
 417         if (data->phase2_priv && data->phase2_method)
 418                 data->phase2_method->reset(sm, data->phase2_priv);
 419         eap_server_tls_ssl_deinit(sm, &data->ssl);
 420         wpabuf_free(data->pending_phase2_eap_resp);
 421         os_free(data);
 422 }
 423
 424
 425 static struct wpabuf * eap_ttls_build_start(struct eap_sm *sm,
 426                                             struct eap_ttls_data *data, u8 id)
 427 {
 428         struct wpabuf *req;
 429
 430         req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_TTLS, 1,
 431                             EAP_CODE_REQUEST, id);
 432         if (req == NULL) {
 433                 wpa_printf(MSG_ERROR, "EAP-TTLS: Failed to allocate memory for"
 434                            " request");
 435                 eap_ttls_state(data, FAILURE);
 436                 return NULL;
 437         }
 438
 439         wpabuf_put_u8(req, EAP_TLS_FLAGS_START | data->ttls_version);
 440
 441         eap_ttls_state(data, PHASE1);
 442
 443         return req;
 444 }
 445
 446
 447 static struct wpabuf * eap_ttls_build_req(struct eap_sm *sm,
 448                                           struct eap_ttls_data *data, u8 id)
 449 {
 450         int res;
 451         struct wpabuf *req;
 452
 453         res = eap_server_tls_buildReq_helper(sm, &data->ssl, EAP_TYPE_TTLS,
 454                                              data->ttls_version, id, &req);
 455
 456         if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) {
 457                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase1 done, starting "
 458                            "Phase2");
 459                 eap_ttls_state(data, PHASE2_START);
 460         }
 461
 462         if (res == 1)
 463                 return eap_server_tls_build_ack(id, EAP_TYPE_TTLS,
 464                                                 data->ttls_version);
 465         return req;
 466 }
 467
 468
 469 static struct wpabuf * eap_ttls_encrypt(struct eap_sm *sm,
 470                                         struct eap_ttls_data *data,
 471                                         u8 id, u8 *plain, size_t plain_len)
 472 {
 473         int res;
 474         struct wpabuf *buf;
 475
 476         /* TODO: add support for fragmentation, if needed. This will need to
 477          * add TLS Message Length field, if the frame is fragmented. */
 478         buf = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_TTLS,
 479                             1 + data->ssl.tls_out_limit,
 480                             EAP_CODE_REQUEST, id);
 481         if (buf == NULL)
 482                 return NULL;
 483
 484         wpabuf_put_u8(buf, data->ttls_version);
 485
 486         res = tls_connection_encrypt(sm->ssl_ctx, data->ssl.conn,
 487                                      plain, plain_len, wpabuf_put(buf, 0),
 488                                      data->ssl.tls_out_limit);
 489         if (res < 0) {
 490                 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to encrypt Phase 2 "
 491                            "data");
 492                 wpabuf_free(buf);
 493                 return NULL;
 494         }
 495
 496         wpabuf_put(buf, res);
 497         eap_update_len(buf);
 498
 499         return buf;
 500 }
 501
 502
 503 static struct wpabuf * eap_ttls_build_phase2_eap_req(
 504         struct eap_sm *sm, struct eap_ttls_data *data, u8 id)
 505 {
 506         struct wpabuf *buf, *encr_req;
 507         u8 *req;
 508         size_t req_len;
 509
 510
 511         buf = data->phase2_method->buildReq(sm, data->phase2_priv, id);
 512         if (buf == NULL)
 513                 return NULL;
 514
 515         wpa_hexdump_buf_key(MSG_DEBUG,
 516                             "EAP-TTLS/EAP: Encapsulate Phase 2 data", buf);
 517
 518         buf = eap_ttls_avp_encapsulate(buf, RADIUS_ATTR_EAP_MESSAGE, 1);
 519         if (buf == NULL) {
 520                 wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: Failed to encapsulate "
 521                            "packet");
 522                 return NULL;
 523         }
 524
 525         req = wpabuf_mhead(buf);
 526         req_len = wpabuf_len(buf);
 527         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS/EAP: Encrypt encapsulated Phase "
 528                         "2 data", req, req_len);
 529
 530         encr_req = eap_ttls_encrypt(sm, data, id, req, req_len);
 531         wpabuf_free(buf);
 532
 533         return encr_req;
 534 }
 535
 536
 537 static struct wpabuf * eap_ttls_build_phase2_mschapv2(
 538         struct eap_sm *sm, struct eap_ttls_data *data, u8 id)
 539 {
 540         struct wpabuf *encr_req;
 541         u8 *req, *pos, *end;
 542         int ret;
 543         size_t req_len;
 544
 545         pos = req = os_malloc(100);
 546         if (req == NULL)
 547                 return NULL;
 548         end = req + 100;
 549
 550         if (data->mschapv2_resp_ok) {
 551                 pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP2_SUCCESS,
 552                                        RADIUS_VENDOR_ID_MICROSOFT, 1, 43);
 553                 *pos++ = data->mschapv2_ident;
 554                 ret = os_snprintf((char *) pos, end - pos, "S=");
 555                 if (ret >= 0 && ret < end - pos)
 556                         pos += ret;
 557                 pos += wpa_snprintf_hex_uppercase(
 558                         (char *) pos, end - pos, data->mschapv2_auth_response,
 559                         sizeof(data->mschapv2_auth_response));
 560         } else {
 561                 pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP_ERROR,
 562                                        RADIUS_VENDOR_ID_MICROSOFT, 1, 6);
 563                 os_memcpy(pos, "Failed", 6);
 564                 pos += 6;
 565                 AVP_PAD(req, pos);
 566         }
 567
 568         req_len = pos - req;
 569         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Encrypting Phase 2 "
 570                         "data", req, req_len);
 571
 572         encr_req = eap_ttls_encrypt(sm, data, id, req, req_len);
 573         os_free(req);
 574
 575         return encr_req;
 576 }
 577
 578
 579 static struct wpabuf * eap_ttls_build_phase_finished(
 580         struct eap_sm *sm, struct eap_ttls_data *data, u8 id, int final)
 581 {
 582         int len;
 583         struct wpabuf *req;
 584         const int max_len = 300;
 585
 586         len = 1 + max_len;
 587         req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_TTLS, len,
 588                             EAP_CODE_REQUEST, id);
 589         if (req == NULL)
 590                 return NULL;
 591
 592         wpabuf_put_u8(req, data->ttls_version);
 593
 594         len = tls_connection_ia_send_phase_finished(sm->ssl_ctx,
 595                                                     data->ssl.conn, final,
 596                                                     wpabuf_mhead(req),
 597                                                     max_len);
 598         if (len < 0) {
 599                 wpabuf_free(req);
 600                 return NULL;
 601         }
 602         wpabuf_put(req, len);
 603         eap_update_len(req);
 604
 605         return req;
 606 }
 607
 608
 609 static struct wpabuf * eap_ttls_buildReq(struct eap_sm *sm, void *priv, u8 id)
 610 {
 611         struct eap_ttls_data *data = priv;
 612
 613         switch (data->state) {
 614         case START:
 615                 return eap_ttls_build_start(sm, data, id);
 616         case PHASE1:
 617                 return eap_ttls_build_req(sm, data, id);
 618         case PHASE2_METHOD:
 619                 return eap_ttls_build_phase2_eap_req(sm, data, id);
 620         case PHASE2_MSCHAPV2_RESP:
 621                 return eap_ttls_build_phase2_mschapv2(sm, data, id);
 622         case PHASE_FINISHED:
 623                 return eap_ttls_build_phase_finished(sm, data, id, 1);
 624         default:
 625                 wpa_printf(MSG_DEBUG, "EAP-TTLS: %s - unexpected state %d",
 626                            __func__, data->state);
 627                 return NULL;
 628         }
 629 }
 630
 631
 632 static Boolean eap_ttls_check(struct eap_sm *sm, void *priv,
 633                               struct wpabuf *respData)
 634 {
 635         const u8 *pos;
 636         size_t len;
 637
 638         pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_TTLS, respData, &len);
 639         if (pos == NULL || len < 1) {
 640                 wpa_printf(MSG_INFO, "EAP-TTLS: Invalid frame");
 641                 return TRUE;
 642         }
 643
 644         return FALSE;
 645 }
 646
 647
 648 static int eap_ttls_ia_permute_inner_secret(struct eap_sm *sm,
 649                                             struct eap_ttls_data *data,
 650                                             const u8 *key, size_t key_len)
 651 {
 652         u8 *buf;
 653         size_t buf_len;
 654         int ret;
 655
 656         if (key) {
 657                 buf_len = 2 + key_len;
 658                 buf = os_malloc(buf_len);
 659                 if (buf == NULL)
 660                         return -1;
 661                 WPA_PUT_BE16(buf, key_len);
 662                 os_memcpy(buf + 2, key, key_len);
 663         } else {
 664                 buf = NULL;
 665                 buf_len = 0;
 666         }
 667
 668         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Session keys for TLS/IA inner "
 669                         "secret permutation", buf, buf_len);
 670         ret = tls_connection_ia_permute_inner_secret(sm->ssl_ctx,
 671                                                      data->ssl.conn,
 672                                                      buf, buf_len);
 673         os_free(buf);
 674
 675         return ret;
 676 }
 677
 678
 679 static void eap_ttls_process_phase2_pap(struct eap_sm *sm,
 680                                         struct eap_ttls_data *data,
 681                                         const u8 *user_password,
 682                                         size_t user_password_len)
 683 {
 684         if (!sm->user || !sm->user->password || sm->user->password_hash ||
 685             !(sm->user->ttls_auth & EAP_TTLS_AUTH_PAP)) {
 686                 wpa_printf(MSG_DEBUG, "EAP-TTLS/PAP: No plaintext user "
 687                            "password configured");
 688                 eap_ttls_state(data, FAILURE);
 689                 return;
 690         }
 691
 692         if (sm->user->password_len != user_password_len ||
 693             os_memcmp(sm->user->password, user_password, user_password_len) !=
 694             0) {
 695                 wpa_printf(MSG_DEBUG, "EAP-TTLS/PAP: Invalid user password");
 696                 eap_ttls_state(data, FAILURE);
 697                 return;
 698         }
 699
 700         wpa_printf(MSG_DEBUG, "EAP-TTLS/PAP: Correct user password");
 701         eap_ttls_state(data, data->ttls_version > 0 ? PHASE_FINISHED :
 702                        SUCCESS);
 703 }
 704
 705
 706 static void eap_ttls_process_phase2_chap(struct eap_sm *sm,
 707                                          struct eap_ttls_data *data,
 708                                          const u8 *challenge,
 709                                          size_t challenge_len,
 710                                          const u8 *password,
 711                                          size_t password_len)
 712 {
 713         u8 *chal, hash[CHAP_MD5_LEN];
 714
 715         if (challenge == NULL || password == NULL ||
 716             challenge_len != EAP_TTLS_CHAP_CHALLENGE_LEN ||
 717             password_len != 1 + EAP_TTLS_CHAP_PASSWORD_LEN) {
 718                 wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP: Invalid CHAP attributes "
 719                            "(challenge len %lu password len %lu)",
 720                            (unsigned long) challenge_len,
 721                            (unsigned long) password_len);
 722                 eap_ttls_state(data, FAILURE);
 723                 return;
 724         }
 725
 726         if (!sm->user || !sm->user->password || sm->user->password_hash ||
 727             !(sm->user->ttls_auth & EAP_TTLS_AUTH_CHAP)) {
 728                 wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP: No plaintext user "
 729                            "password configured");
 730                 eap_ttls_state(data, FAILURE);
 731                 return;
 732         }
 733
 734         chal = eap_ttls_implicit_challenge(sm, data,
 735                                            EAP_TTLS_CHAP_CHALLENGE_LEN + 1);
 736         if (chal == NULL) {
 737                 wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP: Failed to generate "
 738                            "challenge from TLS data");
 739                 eap_ttls_state(data, FAILURE);
 740                 return;
 741         }
 742
 743         if (os_memcmp(challenge, chal, EAP_TTLS_CHAP_CHALLENGE_LEN) != 0 ||
 744             password[0] != chal[EAP_TTLS_CHAP_CHALLENGE_LEN]) {
 745                 wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP: Challenge mismatch");
 746                 os_free(chal);
 747                 eap_ttls_state(data, FAILURE);
 748                 return;
 749         }
 750         os_free(chal);
 751
 752         /* MD5(Ident + Password + Challenge) */
 753         chap_md5(password[0], sm->user->password, sm->user->password_len,
 754                  challenge, challenge_len, hash);
 755
 756         if (os_memcmp(hash, password + 1, EAP_TTLS_CHAP_PASSWORD_LEN) == 0) {
 757                 wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP: Correct user password");
 758                 eap_ttls_state(data, data->ttls_version > 0 ? PHASE_FINISHED :
 759                                SUCCESS);
 760         } else {
 761                 wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP: Invalid user password");
 762                 eap_ttls_state(data, FAILURE);
 763         }
 764 }
 765
 766
 767 static void eap_ttls_process_phase2_mschap(struct eap_sm *sm,
 768                                            struct eap_ttls_data *data,
 769                                            u8 *challenge, size_t challenge_len,
 770                                            u8 *response, size_t response_len)
 771 {
 772         u8 *chal, nt_response[24];
 773
 774         if (challenge == NULL || response == NULL ||
 775             challenge_len != EAP_TTLS_MSCHAP_CHALLENGE_LEN ||
 776             response_len != EAP_TTLS_MSCHAP_RESPONSE_LEN) {
 777                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP: Invalid MS-CHAP "
 778                            "attributes (challenge len %lu response len %lu)",
 779                            (unsigned long) challenge_len,
 780                            (unsigned long) response_len);
 781                 eap_ttls_state(data, FAILURE);
 782                 return;
 783         }
 784
 785         if (!sm->user || !sm->user->password ||
 786             !(sm->user->ttls_auth & EAP_TTLS_AUTH_MSCHAP)) {
 787                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP: No user password "
 788                            "configured");
 789                 eap_ttls_state(data, FAILURE);
 790                 return;
 791         }
 792
 793         chal = eap_ttls_implicit_challenge(sm, data,
 794                                            EAP_TTLS_MSCHAP_CHALLENGE_LEN + 1);
 795         if (chal == NULL) {
 796                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP: Failed to generate "
 797                            "challenge from TLS data");
 798                 eap_ttls_state(data, FAILURE);
 799                 return;
 800         }
 801
 802         if (os_memcmp(challenge, chal, EAP_TTLS_MSCHAP_CHALLENGE_LEN) != 0 ||
 803             response[0] != chal[EAP_TTLS_MSCHAP_CHALLENGE_LEN]) {
 804                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP: Challenge mismatch");
 805                 os_free(chal);
 806                 eap_ttls_state(data, FAILURE);
 807                 return;
 808         }
 809         os_free(chal);
 810
 811         if (sm->user->password_hash)
 812                 challenge_response(challenge, sm->user->password, nt_response);
 813         else
 814                 nt_challenge_response(challenge, sm->user->password,
 815                                       sm->user->password_len, nt_response);
 816
 817         if (os_memcmp(nt_response, response + 2 + 24, 24) == 0) {
 818                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP: Correct response");
 819                 eap_ttls_state(data, data->ttls_version > 0 ? PHASE_FINISHED :
 820                                SUCCESS);
 821         } else {
 822                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP: Invalid NT-Response");
 823                 wpa_hexdump(MSG_MSGDUMP, "EAP-TTLS/MSCHAP: Received",
 824                             response + 2 + 24, 24);
 825                 wpa_hexdump(MSG_MSGDUMP, "EAP-TTLS/MSCHAP: Expected",
 826                             nt_response, 24);
 827                 eap_ttls_state(data, FAILURE);
 828         }
 829 }
 830
 831
 832 static void eap_ttls_process_phase2_mschapv2(struct eap_sm *sm,
 833                                              struct eap_ttls_data *data,
 834                                              u8 *challenge,
 835                                              size_t challenge_len,
 836                                              u8 *response, size_t response_len)
 837 {
 838         u8 *chal, *username, nt_response[24], *rx_resp, *peer_challenge,
 839                 *auth_challenge;
 840         size_t username_len, i;
 841
 842         if (challenge == NULL || response == NULL ||
 843             challenge_len != EAP_TTLS_MSCHAPV2_CHALLENGE_LEN ||
 844             response_len != EAP_TTLS_MSCHAPV2_RESPONSE_LEN) {
 845                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Invalid MS-CHAP2 "
 846                            "attributes (challenge len %lu response len %lu)",
 847                            (unsigned long) challenge_len,
 848                            (unsigned long) response_len);
 849                 eap_ttls_state(data, FAILURE);
 850                 return;
 851         }
 852
 853         if (!sm->user || !sm->user->password ||
 854             !(sm->user->ttls_auth & EAP_TTLS_AUTH_MSCHAPV2)) {
 855                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: No user password "
 856                            "configured");
 857                 eap_ttls_state(data, FAILURE);
 858                 return;
 859         }
 860
 861         /* MSCHAPv2 does not include optional domain name in the
 862          * challenge-response calculation, so remove domain prefix
 863          * (if present). */
 864         username = sm->identity;
 865         username_len = sm->identity_len;
 866         for (i = 0; i < username_len; i++) {
 867                 if (username[i] == '\\') {
 868                         username_len -= i + 1;
 869                         username += i + 1;
 870                         break;
 871                 }
 872         }
 873
 874         chal = eap_ttls_implicit_challenge(
 875                 sm, data, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN + 1);
 876         if (chal == NULL) {
 877                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Failed to generate "
 878                            "challenge from TLS data");
 879                 eap_ttls_state(data, FAILURE);
 880                 return;
 881         }
 882
 883         if (os_memcmp(challenge, chal, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN) != 0 ||
 884             response[0] != chal[EAP_TTLS_MSCHAPV2_CHALLENGE_LEN]) {
 885                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Challenge mismatch");
 886                 os_free(chal);
 887                 eap_ttls_state(data, FAILURE);
 888                 return;
 889         }
 890         os_free(chal);
 891
 892         auth_challenge = challenge;
 893         peer_challenge = response + 2;
 894
 895         wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-TTLS/MSCHAPV2: User",
 896                           username, username_len);
 897         wpa_hexdump(MSG_MSGDUMP, "EAP-TTLS/MSCHAPV2: auth_challenge",
 898                     auth_challenge, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN);
 899         wpa_hexdump(MSG_MSGDUMP, "EAP-TTLS/MSCHAPV2: peer_challenge",
 900                     peer_challenge, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN);
 901
 902         if (sm->user->password_hash) {
 903                 generate_nt_response_pwhash(auth_challenge, peer_challenge,
 904                                             username, username_len,
 905                                             sm->user->password,
 906                                             nt_response);
 907         } else {
 908                 generate_nt_response(auth_challenge, peer_challenge,
 909                                      username, username_len,
 910                                      sm->user->password,
 911                                      sm->user->password_len,
 912                                      nt_response);
 913         }
 914
 915         rx_resp = response + 2 + EAP_TTLS_MSCHAPV2_CHALLENGE_LEN + 8;
 916         if (os_memcmp(nt_response, rx_resp, 24) == 0) {
 917                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Correct "
 918                            "NT-Response");
 919                 data->mschapv2_resp_ok = 1;
 920                 if (data->ttls_version > 0) {
 921                         const u8 *pw_hash;
 922                         u8 pw_hash_buf[16], pw_hash_hash[16], master_key[16];
 923                         u8 session_key[2 * MSCHAPV2_KEY_LEN];
 924
 925                         if (sm->user->password_hash)
 926                                 pw_hash = sm->user->password;
 927                         else {
 928                                 nt_password_hash(sm->user->password,
 929                                                  sm->user->password_len,
 930                                                  pw_hash_buf);
 931                                 pw_hash = pw_hash_buf;
 932                         }
 933                         hash_nt_password_hash(pw_hash, pw_hash_hash);
 934                         get_master_key(pw_hash_hash, nt_response, master_key);
 935                         get_asymetric_start_key(master_key, session_key,
 936                                                 MSCHAPV2_KEY_LEN, 0, 0);
 937                         get_asymetric_start_key(master_key,
 938                                                 session_key + MSCHAPV2_KEY_LEN,
 939                                                 MSCHAPV2_KEY_LEN, 1, 0);
 940                         eap_ttls_ia_permute_inner_secret(sm, data,
 941                                                          session_key,
 942                                                          sizeof(session_key));
 943                 }
 944
 945                 if (sm->user->password_hash) {
 946                         generate_authenticator_response_pwhash(
 947                                 sm->user->password,
 948                                 peer_challenge, auth_challenge,
 949                                 username, username_len, nt_response,
 950                                 data->mschapv2_auth_response);
 951                 } else {
 952                         generate_authenticator_response(
 953                                 sm->user->password, sm->user->password_len,
 954                                 peer_challenge, auth_challenge,
 955                                 username, username_len, nt_response,
 956                                 data->mschapv2_auth_response);
 957                 }
 958         } else {
 959                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Invalid "
 960                            "NT-Response");
 961                 wpa_hexdump(MSG_MSGDUMP, "EAP-TTLS/MSCHAPV2: Received",
 962                             rx_resp, 24);
 963                 wpa_hexdump(MSG_MSGDUMP, "EAP-TTLS/MSCHAPV2: Expected",
 964                             nt_response, 24);
 965                 data->mschapv2_resp_ok = 0;
 966         }
 967         eap_ttls_state(data, PHASE2_MSCHAPV2_RESP);
 968         data->mschapv2_ident = response[0];
 969 }
 970
 971
 972 static int eap_ttls_phase2_eap_init(struct eap_sm *sm,
 973                                     struct eap_ttls_data *data,
 974                                     EapType eap_type)
 975 {
 976         if (data->phase2_priv && data->phase2_method) {
 977                 data->phase2_method->reset(sm, data->phase2_priv);
 978                 data->phase2_method = NULL;
 979                 data->phase2_priv = NULL;
 980         }
 981         data->phase2_method = eap_server_get_eap_method(EAP_VENDOR_IETF,
 982                                                         eap_type);
 983         if (!data->phase2_method)
 984                 return -1;
 985
 986         sm->init_phase2 = 1;
 987         data->phase2_priv = data->phase2_method->init(sm);
 988         sm->init_phase2 = 0;
 989         return 0;
 990 }
 991
 992
 993 static void eap_ttls_process_phase2_eap_response(struct eap_sm *sm,
 994                                                  struct eap_ttls_data *data,
 995                                                  u8 *in_data, size_t in_len)
 996 {
 997         u8 next_type = EAP_TYPE_NONE;
 998         struct eap_hdr *hdr;
 999         u8 *pos;
1000         size_t left;
1001         struct wpabuf buf;
1002         const struct eap_method *m = data->phase2_method;
1003         void *priv = data->phase2_priv;
1004
1005         if (priv == NULL) {
1006                 wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: %s - Phase2 not "
1007                            "initialized?!", __func__);
1008                 return;
1009         }
1010
1011         hdr = (struct eap_hdr *) in_data;
1012         pos = (u8 *) (hdr + 1);
1013
1014         if (in_len > sizeof(*hdr) && *pos == EAP_TYPE_NAK) {
1015                 left = in_len - sizeof(*hdr);
1016                 wpa_hexdump(MSG_DEBUG, "EAP-TTLS/EAP: Phase2 type Nak'ed; "
1017                             "allowed types", pos + 1, left - 1);
1018                 eap_sm_process_nak(sm, pos + 1, left - 1);
1019                 if (sm->user && sm->user_eap_method_index < EAP_MAX_METHODS &&
1020                     sm->user->methods[sm->user_eap_method_index].method !=
1021                     EAP_TYPE_NONE) {
1022                         next_type = sm->user->methods[
1023                                 sm->user_eap_method_index++].method;
1024                         wpa_printf(MSG_DEBUG, "EAP-TTLS: try EAP type %d",
1025                                    next_type);
1026                         eap_ttls_phase2_eap_init(sm, data, next_type);
1027                 } else {
1028                         eap_ttls_state(data, FAILURE);
1029                 }
1030                 return;
1031         }
1032
1033         wpabuf_set(&buf, in_data, in_len);
1034
1035         if (m->check(sm, priv, &buf)) {
1036                 wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: Phase2 check() asked to "
1037                            "ignore the packet");
1038                 return;
1039         }
1040
1041         m->process(sm, priv, &buf);
1042
1043         if (sm->method_pending == METHOD_PENDING_WAIT) {
1044                 wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: Phase2 method is in "
1045                            "pending wait state - save decrypted response");
1046                 wpabuf_free(data->pending_phase2_eap_resp);
1047                 data->pending_phase2_eap_resp = wpabuf_dup(&buf);
1048         }
1049
1050         if (!m->isDone(sm, priv))
1051                 return;
1052
1053         if (!m->isSuccess(sm, priv)) {
1054                 wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: Phase2 method failed");
1055                 eap_ttls_state(data, FAILURE);
1056                 return;
1057         }
1058
1059         switch (data->state) {
1060         case PHASE2_START:
1061                 if (eap_user_get(sm, sm->identity, sm->identity_len, 1) != 0) {
1062                         wpa_hexdump_ascii(MSG_DEBUG, "EAP_TTLS: Phase2 "
1063                                           "Identity not found in the user "
1064                                           "database",
1065                                           sm->identity, sm->identity_len);
1066                         eap_ttls_state(data, FAILURE);
1067                         break;
1068                 }
1069
1070                 eap_ttls_state(data, PHASE2_METHOD);
1071                 next_type = sm->user->methods[0].method;
1072                 sm->user_eap_method_index = 1;
1073                 wpa_printf(MSG_DEBUG, "EAP-TTLS: try EAP type %d", next_type);
1074                 break;
1075         case PHASE2_METHOD:
1076                 if (data->ttls_version > 0) {
1077                         if (m->getKey) {
1078                                 u8 *key;
1079                                 size_t key_len;
1080                                 key = m->getKey(sm, priv, &key_len);
1081                                 eap_ttls_ia_permute_inner_secret(sm, data,
1082                                                                  key, key_len);
1083                         }
1084                         eap_ttls_state(data, PHASE_FINISHED);
1085                 } else
1086                         eap_ttls_state(data, SUCCESS);
1087                 break;
1088         case FAILURE:
1089                 break;
1090         default:
1091                 wpa_printf(MSG_DEBUG, "EAP-TTLS: %s - unexpected state %d",
1092                            __func__, data->state);
1093                 break;
1094         }
1095
1096         eap_ttls_phase2_eap_init(sm, data, next_type);
1097 }
1098
1099
1100 static void eap_ttls_process_phase2_eap(struct eap_sm *sm,
1101                                         struct eap_ttls_data *data,
1102                                         const u8 *eap, size_t eap_len)
1103 {
1104         struct eap_hdr *hdr;
1105         size_t len;
1106
1107         if (data->state == PHASE2_START) {
1108                 wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: initializing Phase 2");
1109                 if (eap_ttls_phase2_eap_init(sm, data, EAP_TYPE_IDENTITY) < 0)
1110                 {
1111                         wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: failed to "
1112                                    "initialize EAP-Identity");
1113                         return;
1114                 }
1115         }
1116
1117         if (eap_len < sizeof(*hdr)) {
1118                 wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: too short Phase 2 EAP "
1119                            "packet (len=%lu)", (unsigned long) eap_len);
1120                 return;
1121         }
1122
1123         hdr = (struct eap_hdr *) eap;
1124         len = be_to_host16(hdr->length);
1125         wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: received Phase 2 EAP: code=%d "
1126                    "identifier=%d length=%lu", hdr->code, hdr->identifier,
1127                    (unsigned long) len);
1128         if (len > eap_len) {
1129                 wpa_printf(MSG_INFO, "EAP-TTLS/EAP: Length mismatch in Phase 2"
1130                            " EAP frame (hdr len=%lu, data len in AVP=%lu)",
1131                            (unsigned long) len, (unsigned long) eap_len);
1132                 return;
1133         }
1134
1135         switch (hdr->code) {
1136         case EAP_CODE_RESPONSE:
1137                 eap_ttls_process_phase2_eap_response(sm, data, (u8 *) hdr,
1138                                                      len);
1139                 break;
1140         default:
1141                 wpa_printf(MSG_INFO, "EAP-TTLS/EAP: Unexpected code=%d in "
1142                            "Phase 2 EAP header", hdr->code);
1143                 break;
1144         }
1145 }
1146
1147
1148 static void eap_ttls_process_phase2(struct eap_sm *sm,
1149                                     struct eap_ttls_data *data,
1150                                     u8 *in_data, size_t in_len)
1151 {
1152         u8 *in_decrypted;
1153         int len_decrypted, res;
1154         struct eap_ttls_avp parse;
1155         size_t buf_len;
1156
1157         wpa_printf(MSG_DEBUG, "EAP-TTLS: received %lu bytes encrypted data for"
1158                    " Phase 2", (unsigned long) in_len);
1159
1160         if (data->pending_phase2_eap_resp) {
1161                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Pending Phase 2 EAP response "
1162                            "- skip decryption and use old data");
1163                 eap_ttls_process_phase2_eap(
1164                         sm, data, wpabuf_head(data->pending_phase2_eap_resp),
1165                         wpabuf_len(data->pending_phase2_eap_resp));
1166                 wpabuf_free(data->pending_phase2_eap_resp);
1167                 data->pending_phase2_eap_resp = NULL;
1168                 return;
1169         }
1170
1171         res = eap_server_tls_data_reassemble(sm, &data->ssl, &in_data,
1172                                              &in_len);
1173         if (res < 0 || res == 1)
1174                 return;
1175
1176         buf_len = in_len;
1177         if (data->ssl.tls_in_total > buf_len)
1178                 buf_len = data->ssl.tls_in_total;
1179         in_decrypted = os_malloc(buf_len);
1180         if (in_decrypted == NULL) {
1181                 os_free(data->ssl.tls_in);
1182                 data->ssl.tls_in = NULL;
1183                 data->ssl.tls_in_len = 0;
1184                 wpa_printf(MSG_WARNING, "EAP-TTLS: failed to allocate memory "
1185                            "for decryption");
1186                 return;
1187         }
1188
1189         len_decrypted = tls_connection_decrypt(sm->ssl_ctx, data->ssl.conn,
1190                                                in_data, in_len,
1191                                                in_decrypted, buf_len);
1192         os_free(data->ssl.tls_in);
1193         data->ssl.tls_in = NULL;
1194         data->ssl.tls_in_len = 0;
1195         if (len_decrypted < 0) {
1196                 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to decrypt Phase 2 "
1197                            "data");
1198                 os_free(in_decrypted);
1199                 eap_ttls_state(data, FAILURE);
1200                 return;
1201         }
1202
1203         if (data->state == PHASE_FINISHED) {
1204                 if (len_decrypted == 0 &&
1205                     tls_connection_ia_final_phase_finished(sm->ssl_ctx,
1206                                                            data->ssl.conn)) {
1207                         wpa_printf(MSG_DEBUG, "EAP-TTLS: FinalPhaseFinished "
1208                                    "received");
1209                         eap_ttls_state(data, SUCCESS);
1210                 } else {
1211                         wpa_printf(MSG_INFO, "EAP-TTLS: Did not receive valid "
1212                                    "FinalPhaseFinished");
1213                         eap_ttls_state(data, FAILURE);
1214                 }
1215
1216                 os_free(in_decrypted);
1217                 return;
1218         }
1219
1220         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Decrypted Phase 2 EAP",
1221                         in_decrypted, len_decrypted);
1222
1223         if (eap_ttls_avp_parse(in_decrypted, len_decrypted, &parse) < 0) {
1224                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Failed to parse AVPs");
1225                 os_free(in_decrypted);
1226                 eap_ttls_state(data, FAILURE);
1227                 return;
1228         }
1229
1230         if (parse.user_name) {
1231                 os_free(sm->identity);
1232                 sm->identity = os_malloc(parse.user_name_len);
1233                 if (sm->identity) {
1234                         os_memcpy(sm->identity, parse.user_name,
1235                                   parse.user_name_len);
1236                         sm->identity_len = parse.user_name_len;
1237                 }
1238                 if (eap_user_get(sm, parse.user_name, parse.user_name_len, 1)
1239                     != 0) {
1240                         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase2 Identity not "
1241                                    "found in the user database");
1242                         eap_ttls_state(data, FAILURE);
1243                         goto done;
1244                 }
1245         }
1246
1247         if (parse.eap) {
1248                 eap_ttls_process_phase2_eap(sm, data, parse.eap,
1249                                             parse.eap_len);
1250         } else if (parse.user_password) {
1251                 eap_ttls_process_phase2_pap(sm, data, parse.user_password,
1252                                             parse.user_password_len);
1253         } else if (parse.chap_password) {
1254                 eap_ttls_process_phase2_chap(sm, data,
1255                                              parse.chap_challenge,
1256                                              parse.chap_challenge_len,
1257                                              parse.chap_password,
1258                                              parse.chap_password_len);
1259         } else if (parse.mschap_response) {
1260                 eap_ttls_process_phase2_mschap(sm, data,
1261                                                parse.mschap_challenge,
1262                                                parse.mschap_challenge_len,
1263                                                parse.mschap_response,
1264                                                parse.mschap_response_len);
1265         } else if (parse.mschap2_response) {
1266                 eap_ttls_process_phase2_mschapv2(sm, data,
1267                                                  parse.mschap_challenge,
1268                                                  parse.mschap_challenge_len,
1269                                                  parse.mschap2_response,
1270                                                  parse.mschap2_response_len);
1271         }
1272
1273 done:
1274         os_free(in_decrypted);
1275         os_free(parse.eap);
1276 }
1277
1278
1279 static void eap_ttls_process(struct eap_sm *sm, void *priv,
1280                              struct wpabuf *respData)
1281 {
1282         struct eap_ttls_data *data = priv;
1283         const u8 *pos;
1284         u8 flags;
1285         size_t left;
1286         unsigned int tls_msg_len;
1287         int peer_version;
1288
1289         pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_TTLS, respData,
1290                                &left);
1291         if (pos == NULL || left < 1)
1292                 return;
1293         flags = *pos++;
1294         left--;
1295         wpa_printf(MSG_DEBUG, "EAP-TTLS: Received packet(len=%lu) - "
1296                    "Flags 0x%02x", (unsigned long) wpabuf_len(respData),
1297                    flags);
1298         peer_version = flags & EAP_PEAP_VERSION_MASK;
1299         if (peer_version < data->ttls_version) {
1300                 wpa_printf(MSG_DEBUG, "EAP-TTLS: peer ver=%d, own ver=%d; "
1301                            "use version %d",
1302                            peer_version, data->ttls_version, peer_version);
1303                 data->ttls_version = peer_version;
1304         }
1305
1306         if (data->ttls_version > 0 && !data->tls_ia_configured) {
1307                 if (tls_connection_set_ia(sm->ssl_ctx, data->ssl.conn, 1)) {
1308                         wpa_printf(MSG_INFO, "EAP-TTLS: Failed to enable "
1309                                    "TLS/IA");
1310                         eap_ttls_state(data, FAILURE);
1311                         return;
1312                 }
1313                 data->tls_ia_configured = 1;
1314         }
1315
1316         if (flags & EAP_TLS_FLAGS_LENGTH_INCLUDED) {
1317                 if (left < 4) {
1318                         wpa_printf(MSG_INFO, "EAP-TTLS: Short frame with TLS "
1319                                    "length");
1320                         eap_ttls_state(data, FAILURE);
1321                         return;
1322                 }
1323                 tls_msg_len = WPA_GET_BE32(pos);
1324                 wpa_printf(MSG_DEBUG, "EAP-TTLS: TLS Message Length: %d",
1325                            tls_msg_len);
1326                 if (data->ssl.tls_in_left == 0) {
1327                         data->ssl.tls_in_total = tls_msg_len;
1328                         data->ssl.tls_in_left = tls_msg_len;
1329                         os_free(data->ssl.tls_in);
1330                         data->ssl.tls_in = NULL;
1331                         data->ssl.tls_in_len = 0;
1332                 }
1333                 pos += 4;
1334                 left -= 4;
1335         }
1336
1337         switch (data->state) {
1338         case PHASE1:
1339                 if (eap_server_tls_process_helper(sm, &data->ssl, pos, left) <
1340                     0) {
1341                         wpa_printf(MSG_INFO, "EAP-TTLS: TLS processing "
1342                                    "failed");
1343                         eap_ttls_state(data, FAILURE);
1344                 }
1345                 break;
1346         case PHASE2_START:
1347         case PHASE2_METHOD:
1348         case PHASE_FINISHED:
1349                 /* FIX: get rid of const->non-const typecast */
1350                 eap_ttls_process_phase2(sm, data, (u8 *) pos, left);
1351                 break;
1352         case PHASE2_MSCHAPV2_RESP:
1353                 if (data->mschapv2_resp_ok && left == 0) {
1354                         wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Peer "
1355                                    "acknowledged response");
1356                         eap_ttls_state(data, data->ttls_version > 0 ?
1357                                        PHASE_FINISHED : SUCCESS);
1358                 } else if (!data->mschapv2_resp_ok) {
1359                         wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Peer "
1360                                    "acknowledged error");
1361                         eap_ttls_state(data, FAILURE);
1362                 } else {
1363                         wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Unexpected "
1364                                    "frame from peer (payload len %lu, "
1365                                    "expected empty frame)",
1366                                    (unsigned long) left);
1367                         eap_ttls_state(data, FAILURE);
1368                 }
1369                 break;
1370         default:
1371                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Unexpected state %d in %s",
1372                            data->state, __func__);
1373                 break;
1374         }
1375
1376         if (tls_connection_get_write_alerts(sm->ssl_ctx, data->ssl.conn) > 1) {
1377                 wpa_printf(MSG_INFO, "EAP-TTLS: Locally detected fatal error "
1378                            "in TLS processing");
1379                 eap_ttls_state(data, FAILURE);
1380         }
1381 }
1382
1383
1384 static Boolean eap_ttls_isDone(struct eap_sm *sm, void *priv)
1385 {
1386         struct eap_ttls_data *data = priv;
1387         return data->state == SUCCESS || data->state == FAILURE;
1388 }
1389
1390
1391 static u8 * eap_ttls_v1_derive_key(struct eap_sm *sm,
1392                                    struct eap_ttls_data *data)
1393 {
1394         struct tls_keys keys;
1395         u8 *rnd, *key;
1396
1397         os_memset(&keys, 0, sizeof(keys));
1398         if (tls_connection_get_keys(sm->ssl_ctx, data->ssl.conn, &keys) ||
1399             keys.client_random == NULL || keys.server_random == NULL ||
1400             keys.inner_secret == NULL) {
1401                 wpa_printf(MSG_INFO, "EAP-TTLS: Could not get inner secret, "
1402                            "client random, or server random to derive keying "
1403                            "material");
1404                 return NULL;
1405         }
1406
1407         rnd = os_malloc(keys.client_random_len + keys.server_random_len);
1408         key = os_malloc(EAP_TLS_KEY_LEN);
1409         if (rnd == NULL || key == NULL) {
1410                 wpa_printf(MSG_INFO, "EAP-TTLS: No memory for key derivation");
1411                 os_free(rnd);
1412                 os_free(key);
1413                 return NULL;
1414         }
1415         os_memcpy(rnd, keys.client_random, keys.client_random_len);
1416         os_memcpy(rnd + keys.client_random_len, keys.server_random,
1417                   keys.server_random_len);
1418
1419         if (tls_prf(keys.inner_secret, keys.inner_secret_len,
1420                     "ttls v1 keying material", rnd, keys.client_random_len +
1421                     keys.server_random_len, key, EAP_TLS_KEY_LEN)) {
1422                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Failed to derive key");
1423                 os_free(rnd);
1424                 os_free(key);
1425                 return NULL;
1426         }
1427
1428         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: client/server random",
1429                     rnd, keys.client_random_len + keys.server_random_len);
1430         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: TLS/IA inner secret",
1431                         keys.inner_secret, keys.inner_secret_len);
1432
1433         os_free(rnd);
1434
1435         return key;
1436 }
1437
1438
1439 static u8 * eap_ttls_getKey(struct eap_sm *sm, void *priv, size_t *len)
1440 {
1441         struct eap_ttls_data *data = priv;
1442         u8 *eapKeyData;
1443
1444         if (data->state != SUCCESS)
1445                 return NULL;
1446
1447         if (data->ttls_version == 0) {
1448                 eapKeyData = eap_server_tls_derive_key(sm, &data->ssl,
1449                                                        "ttls keying material",
1450                                                        EAP_TLS_KEY_LEN);
1451         } else {
1452                 eapKeyData = eap_ttls_v1_derive_key(sm, data);
1453         }
1454
1455         if (eapKeyData) {
1456                 *len = EAP_TLS_KEY_LEN;
1457                 wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived key",
1458                                 eapKeyData, EAP_TLS_KEY_LEN);
1459         } else {
1460                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Failed to derive key");
1461         }
1462
1463         return eapKeyData;
1464 }
1465
1466
1467 static Boolean eap_ttls_isSuccess(struct eap_sm *sm, void *priv)
1468 {
1469         struct eap_ttls_data *data = priv;
1470         return data->state == SUCCESS;
1471 }
1472
1473
1474 int eap_server_ttls_register(void)
1475 {
1476         struct eap_method *eap;
1477         int ret;
1478
1479         eap = eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION,
1480                                       EAP_VENDOR_IETF, EAP_TYPE_TTLS, "TTLS");
1481         if (eap == NULL)
1482                 return -1;
1483
1484         eap->init = eap_ttls_init;
1485         eap->reset = eap_ttls_reset;
1486         eap->buildReq = eap_ttls_buildReq;
1487         eap->check = eap_ttls_check;
1488         eap->process = eap_ttls_process;
1489         eap->isDone = eap_ttls_isDone;
1490         eap->getKey = eap_ttls_getKey;
1491         eap->isSuccess = eap_ttls_isSuccess;
1492
1493         ret = eap_server_method_register(eap);
1494         if (ret)
1495                 eap_server_method_free(eap);
1496         return ret;
1497 }