contrib/wpa_supplicant/eap_peap.c

   1 /*
   2  * EAP peer method: EAP-PEAP (draft-josefsson-pppext-eap-tls-eap-07.txt)
   3  * Copyright (c) 2004-2006, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "eap_i.h"
  19 #include "eap_tls_common.h"
  20 #include "config_ssid.h"
  21 #include "tls.h"
  22 #include "eap_tlv.h"
  23
  24
  25 /* Maximum supported PEAP version
  26  * 0 = Microsoft's PEAP version 0; draft-kamath-pppext-peapv0-00.txt
  27  * 1 = draft-josefsson-ppext-eap-tls-eap-05.txt
  28  * 2 = draft-josefsson-ppext-eap-tls-eap-07.txt
  29  */
  30 #define EAP_PEAP_VERSION 1
  31
  32
  33 static void eap_peap_deinit(struct eap_sm *sm, void *priv);
  34
  35
  36 struct eap_peap_data {
  37         struct eap_ssl_data ssl;
  38
  39         int peap_version, force_peap_version, force_new_label;
  40
  41         const struct eap_method *phase2_method;
  42         void *phase2_priv;
  43         int phase2_success;
  44         int phase2_eap_success;
  45         int phase2_eap_started;
  46
  47         struct eap_method_type phase2_type;
  48         struct eap_method_type *phase2_types;
  49         size_t num_phase2_types;
  50
  51         int peap_outer_success; /* 0 = PEAP terminated on Phase 2 inner
  52                                  * EAP-Success
  53                                  * 1 = reply with tunneled EAP-Success to inner
  54                                  * EAP-Success and expect AS to send outer
  55                                  * (unencrypted) EAP-Success after this
  56                                  * 2 = reply with PEAP/TLS ACK to inner
  57                                  * EAP-Success and expect AS to send outer
  58                                  * (unencrypted) EAP-Success after this */
  59         int resuming; /* starting a resumed session */
  60         u8 *key_data;
  61
  62         u8 *pending_phase2_req;
  63         size_t pending_phase2_req_len;
  64 };
  65
  66
  67 static void * eap_peap_init(struct eap_sm *sm)
  68 {
  69         struct eap_peap_data *data;
  70         struct wpa_ssid *config = eap_get_config(sm);
  71
  72         data = os_zalloc(sizeof(*data));
  73         if (data == NULL)
  74                 return NULL;
  75         sm->peap_done = FALSE;
  76         data->peap_version = EAP_PEAP_VERSION;
  77         data->force_peap_version = -1;
  78         data->peap_outer_success = 2;
  79
  80         if (config && config->phase1) {
  81                 char *pos = os_strstr(config->phase1, "peapver=");
  82                 if (pos) {
  83                         data->force_peap_version = atoi(pos + 8);
  84                         data->peap_version = data->force_peap_version;
  85                         wpa_printf(MSG_DEBUG, "EAP-PEAP: Forced PEAP version "
  86                                    "%d", data->force_peap_version);
  87                 }
  88
  89                 if (os_strstr(config->phase1, "peaplabel=1")) {
  90                         data->force_new_label = 1;
  91                         wpa_printf(MSG_DEBUG, "EAP-PEAP: Force new label for "
  92                                    "key derivation");
  93                 }
  94
  95                 if (os_strstr(config->phase1, "peap_outer_success=0")) {
  96                         data->peap_outer_success = 0;
  97                         wpa_printf(MSG_DEBUG, "EAP-PEAP: terminate "
  98                                    "authentication on tunneled EAP-Success");
  99                 } else if (os_strstr(config->phase1, "peap_outer_success=1")) {
 100                         data->peap_outer_success = 1;
 101                         wpa_printf(MSG_DEBUG, "EAP-PEAP: send tunneled "
 102                                    "EAP-Success after receiving tunneled "
 103                                    "EAP-Success");
 104                 } else if (os_strstr(config->phase1, "peap_outer_success=2")) {
 105                         data->peap_outer_success = 2;
 106                         wpa_printf(MSG_DEBUG, "EAP-PEAP: send PEAP/TLS ACK "
 107                                    "after receiving tunneled EAP-Success");
 108                 }
 109         }
 110
 111         if (config && config->phase2) {
 112                 char *start, *pos, *buf;
 113                 struct eap_method_type *methods = NULL, *_methods;
 114                 u8 method;
 115                 size_t num_methods = 0;
 116                 start = buf = os_strdup(config->phase2);
 117                 if (buf == NULL) {
 118                         eap_peap_deinit(sm, data);
 119                         return NULL;
 120                 }
 121                 while (start && *start != '\0') {
 122                         int vendor;
 123                         pos = os_strstr(start, "auth=");
 124                         if (pos == NULL)
 125                                 break;
 126                         if (start != pos && *(pos - 1) != ' ') {
 127                                 start = pos + 5;
 128                                 continue;
 129                         }
 130
 131                         start = pos + 5;
 132                         pos = os_strchr(start, ' ');
 133                         if (pos)
 134                                 *pos++ = '\0';
 135                         method = eap_get_phase2_type(start, &vendor);
 136                         if (vendor == EAP_VENDOR_IETF &&
 137                             method == EAP_TYPE_NONE) {
 138                                 wpa_printf(MSG_ERROR, "EAP-PEAP: Unsupported "
 139                                            "Phase2 method '%s'", start);
 140                         } else {
 141                                 num_methods++;
 142                                 _methods = os_realloc(
 143                                         methods,
 144                                         num_methods * sizeof(*methods));
 145                                 if (_methods == NULL) {
 146                                         os_free(methods);
 147                                         os_free(buf);
 148                                         eap_peap_deinit(sm, data);
 149                                         return NULL;
 150                                 }
 151                                 methods = _methods;
 152                                 methods[num_methods - 1].vendor = vendor;
 153                                 methods[num_methods - 1].method = method;
 154                         }
 155
 156                         start = pos;
 157                 }
 158                 os_free(buf);
 159                 data->phase2_types = methods;
 160                 data->num_phase2_types = num_methods;
 161         }
 162         if (data->phase2_types == NULL) {
 163                 data->phase2_types =
 164                         eap_get_phase2_types(config, &data->num_phase2_types);
 165         }
 166         if (data->phase2_types == NULL) {
 167                 wpa_printf(MSG_ERROR, "EAP-PEAP: No Phase2 method available");
 168                 eap_peap_deinit(sm, data);
 169                 return NULL;
 170         }
 171         wpa_hexdump(MSG_DEBUG, "EAP-PEAP: Phase2 EAP types",
 172                     (u8 *) data->phase2_types,
 173                     data->num_phase2_types * sizeof(struct eap_method_type));
 174         data->phase2_type.vendor = EAP_VENDOR_IETF;
 175         data->phase2_type.method = EAP_TYPE_NONE;
 176
 177         if (eap_tls_ssl_init(sm, &data->ssl, config)) {
 178                 wpa_printf(MSG_INFO, "EAP-PEAP: Failed to initialize SSL.");
 179                 eap_peap_deinit(sm, data);
 180                 return NULL;
 181         }
 182
 183         return data;
 184 }
 185
 186
 187 static void eap_peap_deinit(struct eap_sm *sm, void *priv)
 188 {
 189         struct eap_peap_data *data = priv;
 190         if (data == NULL)
 191                 return;
 192         if (data->phase2_priv && data->phase2_method)
 193                 data->phase2_method->deinit(sm, data->phase2_priv);
 194         os_free(data->phase2_types);
 195         eap_tls_ssl_deinit(sm, &data->ssl);
 196         os_free(data->key_data);
 197         os_free(data->pending_phase2_req);
 198         os_free(data);
 199 }
 200
 201
 202 static int eap_peap_encrypt(struct eap_sm *sm, struct eap_peap_data *data,
 203                             int id, const u8 *plain, size_t plain_len,
 204                             u8 **out_data, size_t *out_len)
 205 {
 206         int res;
 207         u8 *pos;
 208         struct eap_hdr *resp;
 209
 210         /* TODO: add support for fragmentation, if needed. This will need to
 211          * add TLS Message Length field, if the frame is fragmented.
 212          * Note: Microsoft IAS did not seem to like TLS Message Length with
 213          * PEAP/MSCHAPv2. */
 214         resp = os_malloc(sizeof(struct eap_hdr) + 2 + data->ssl.tls_out_limit);
 215         if (resp == NULL)
 216                 return -1;
 217
 218         resp->code = EAP_CODE_RESPONSE;
 219         resp->identifier = id;
 220
 221         pos = (u8 *) (resp + 1);
 222         *pos++ = EAP_TYPE_PEAP;
 223         *pos++ = data->peap_version;
 224
 225         res = tls_connection_encrypt(sm->ssl_ctx, data->ssl.conn,
 226                                      plain, plain_len,
 227                                      pos, data->ssl.tls_out_limit);
 228         if (res < 0) {
 229                 wpa_printf(MSG_INFO, "EAP-PEAP: Failed to encrypt Phase 2 "
 230                            "data");
 231                 os_free(resp);
 232                 return -1;
 233         }
 234
 235         *out_len = sizeof(struct eap_hdr) + 2 + res;
 236         resp->length = host_to_be16(*out_len);
 237         *out_data = (u8 *) resp;
 238         return 0;
 239 }
 240
 241
 242 static int eap_peap_phase2_nak(struct eap_peap_data *data, struct eap_hdr *hdr,
 243                                u8 **resp, size_t *resp_len)
 244 {
 245         struct eap_hdr *resp_hdr;
 246         u8 *pos = (u8 *) (hdr + 1);
 247         size_t i;
 248
 249         /* TODO: add support for expanded Nak */
 250         wpa_printf(MSG_DEBUG, "EAP-PEAP: Phase 2 Request: Nak type=%d", *pos);
 251         wpa_hexdump(MSG_DEBUG, "EAP-PEAP: Allowed Phase2 EAP types",
 252                     (u8 *) data->phase2_types,
 253                     data->num_phase2_types * sizeof(struct eap_method_type));
 254         *resp_len = sizeof(struct eap_hdr) + 1;
 255         *resp = os_malloc(*resp_len + data->num_phase2_types);
 256         if (*resp == NULL)
 257                 return -1;
 258
 259         resp_hdr = (struct eap_hdr *) (*resp);
 260         resp_hdr->code = EAP_CODE_RESPONSE;
 261         resp_hdr->identifier = hdr->identifier;
 262         pos = (u8 *) (resp_hdr + 1);
 263         *pos++ = EAP_TYPE_NAK;
 264         for (i = 0; i < data->num_phase2_types; i++) {
 265                 if (data->phase2_types[i].vendor == EAP_VENDOR_IETF &&
 266                     data->phase2_types[i].method < 256) {
 267                         (*resp_len)++;
 268                         *pos++ = data->phase2_types[i].method;
 269                 }
 270         }
 271         resp_hdr->length = host_to_be16(*resp_len);
 272
 273         return 0;
 274 }
 275
 276
 277 static int eap_peap_phase2_request(struct eap_sm *sm,
 278                                    struct eap_peap_data *data,
 279                                    struct eap_method_ret *ret,
 280                                    struct eap_hdr *hdr,
 281                                    u8 **resp, size_t *resp_len)
 282 {
 283         size_t len = be_to_host16(hdr->length);
 284         u8 *pos;
 285         struct eap_method_ret iret;
 286         struct wpa_ssid *config = eap_get_config(sm);
 287
 288         if (len <= sizeof(struct eap_hdr)) {
 289                 wpa_printf(MSG_INFO, "EAP-PEAP: too short "
 290                            "Phase 2 request (len=%lu)", (unsigned long) len);
 291                 return -1;
 292         }
 293         pos = (u8 *) (hdr + 1);
 294         wpa_printf(MSG_DEBUG, "EAP-PEAP: Phase 2 Request: type=%d", *pos);
 295         switch (*pos) {
 296         case EAP_TYPE_IDENTITY:
 297                 *resp = eap_sm_buildIdentity(sm, hdr->identifier, resp_len, 1);
 298                 break;
 299         case EAP_TYPE_TLV:
 300                 os_memset(&iret, 0, sizeof(iret));
 301                 if (eap_tlv_process(sm, &iret, hdr, resp, resp_len,
 302                                     data->phase2_eap_started &&
 303                                     !data->phase2_eap_success)) {
 304                         ret->methodState = METHOD_DONE;
 305                         ret->decision = DECISION_FAIL;
 306                         return -1;
 307                 }
 308                 if (iret.methodState == METHOD_DONE ||
 309                     iret.methodState == METHOD_MAY_CONT) {
 310                         ret->methodState = iret.methodState;
 311                         ret->decision = iret.decision;
 312                         data->phase2_success = 1;
 313                 }
 314                 break;
 315         default:
 316                 if (data->phase2_type.vendor == EAP_VENDOR_IETF &&
 317                     data->phase2_type.method == EAP_TYPE_NONE) {
 318                         size_t i;
 319                         for (i = 0; i < data->num_phase2_types; i++) {
 320                                 if (data->phase2_types[i].vendor !=
 321                                     EAP_VENDOR_IETF ||
 322                                     data->phase2_types[i].method != *pos)
 323                                         continue;
 324
 325                                 data->phase2_type.vendor =
 326                                         data->phase2_types[i].vendor;
 327                                 data->phase2_type.method =
 328                                         data->phase2_types[i].method;
 329                                 wpa_printf(MSG_DEBUG, "EAP-PEAP: Selected "
 330                                            "Phase 2 EAP vendor %d method %d",
 331                                            data->phase2_type.vendor,
 332                                            data->phase2_type.method);
 333                                 break;
 334                         }
 335                 }
 336                 if (*pos != data->phase2_type.method ||
 337                     *pos == EAP_TYPE_NONE) {
 338                         if (eap_peap_phase2_nak(data, hdr, resp, resp_len))
 339                                 return -1;
 340                         return 0;
 341                 }
 342
 343                 if (data->phase2_priv == NULL) {
 344                         data->phase2_method = eap_sm_get_eap_methods(
 345                                 data->phase2_type.vendor,
 346                                 data->phase2_type.method);
 347                         if (data->phase2_method) {
 348                                 sm->init_phase2 = 1;
 349                                 data->phase2_priv =
 350                                         data->phase2_method->init(sm);
 351                                 sm->init_phase2 = 0;
 352                         }
 353                 }
 354                 if (data->phase2_priv == NULL || data->phase2_method == NULL) {
 355                         wpa_printf(MSG_INFO, "EAP-PEAP: failed to initialize "
 356                                    "Phase 2 EAP method %d", *pos);
 357                         ret->methodState = METHOD_DONE;
 358                         ret->decision = DECISION_FAIL;
 359                         return -1;
 360                 }
 361                 data->phase2_eap_started = 1;
 362                 os_memset(&iret, 0, sizeof(iret));
 363                 *resp = data->phase2_method->process(sm, data->phase2_priv,
 364                                                      &iret, (u8 *) hdr, len,
 365                                                      resp_len);
 366                 if ((iret.methodState == METHOD_DONE ||
 367                      iret.methodState == METHOD_MAY_CONT) &&
 368                     (iret.decision == DECISION_UNCOND_SUCC ||
 369                      iret.decision == DECISION_COND_SUCC)) {
 370                         data->phase2_eap_success = 1;
 371                         data->phase2_success = 1;
 372                 }
 373                 break;
 374         }
 375
 376         if (*resp == NULL &&
 377             (config->pending_req_identity || config->pending_req_password ||
 378              config->pending_req_otp || config->pending_req_new_password)) {
 379                 os_free(data->pending_phase2_req);
 380                 data->pending_phase2_req = os_malloc(len);
 381                 if (data->pending_phase2_req) {
 382                         os_memcpy(data->pending_phase2_req, hdr, len);
 383                         data->pending_phase2_req_len = len;
 384                 }
 385         }
 386
 387         return 0;
 388 }
 389
 390
 391 static int eap_peap_decrypt(struct eap_sm *sm, struct eap_peap_data *data,
 392                             struct eap_method_ret *ret,
 393                             const struct eap_hdr *req,
 394                             const u8 *in_data, size_t in_len,
 395                             u8 **out_data, size_t *out_len)
 396 {
 397         u8 *in_decrypted;
 398         int res, skip_change = 0;
 399         struct eap_hdr *hdr, *rhdr;
 400         u8 *resp = NULL;
 401         size_t resp_len, len_decrypted, len, buf_len;
 402         const u8 *msg;
 403         size_t msg_len;
 404         int need_more_input;
 405
 406         wpa_printf(MSG_DEBUG, "EAP-PEAP: received %lu bytes encrypted data for"
 407                    " Phase 2", (unsigned long) in_len);
 408
 409         if (data->pending_phase2_req) {
 410                 wpa_printf(MSG_DEBUG, "EAP-PEAP: Pending Phase 2 request - "
 411                            "skip decryption and use old data");
 412                 /* Clear TLS reassembly state. */
 413                 os_free(data->ssl.tls_in);
 414                 data->ssl.tls_in = NULL;
 415                 data->ssl.tls_in_len = 0;
 416                 data->ssl.tls_in_left = 0;
 417                 data->ssl.tls_in_total = 0;
 418                 in_decrypted = data->pending_phase2_req;
 419                 data->pending_phase2_req = NULL;
 420                 len_decrypted = data->pending_phase2_req_len;
 421                 skip_change = 1;
 422                 goto continue_req;
 423         }
 424
 425         msg = eap_tls_data_reassemble(sm, &data->ssl, in_data, in_len,
 426                                       &msg_len, &need_more_input);
 427         if (msg == NULL)
 428                 return need_more_input ? 1 : -1;
 429
 430         if (in_len == 0 && sm->workaround && data->phase2_success) {
 431                 /*
 432                  * Cisco ACS seems to be using TLS ACK to terminate
 433                  * EAP-PEAPv0/GTC. Try to reply with TLS ACK.
 434                  */
 435                 wpa_printf(MSG_DEBUG, "EAP-PEAP: Received TLS ACK, but "
 436                            "expected data - acknowledge with TLS ACK since "
 437                            "Phase 2 has been completed");
 438                 ret->decision = DECISION_COND_SUCC;
 439                 ret->methodState = METHOD_DONE;
 440                 return 1;
 441         }
 442
 443         buf_len = in_len;
 444         if (data->ssl.tls_in_total > buf_len)
 445                 buf_len = data->ssl.tls_in_total;
 446         in_decrypted = os_malloc(buf_len);
 447         if (in_decrypted == NULL) {
 448                 os_free(data->ssl.tls_in);
 449                 data->ssl.tls_in = NULL;
 450                 data->ssl.tls_in_len = 0;
 451                 wpa_printf(MSG_WARNING, "EAP-PEAP: failed to allocate memory "
 452                            "for decryption");
 453                 return -1;
 454         }
 455
 456         res = tls_connection_decrypt(sm->ssl_ctx, data->ssl.conn,
 457                                      msg, msg_len, in_decrypted, buf_len);
 458         os_free(data->ssl.tls_in);
 459         data->ssl.tls_in = NULL;
 460         data->ssl.tls_in_len = 0;
 461         if (res < 0) {
 462                 wpa_printf(MSG_INFO, "EAP-PEAP: Failed to decrypt Phase 2 "
 463                            "data");
 464                 os_free(in_decrypted);
 465                 return 0;
 466         }
 467         len_decrypted = res;
 468
 469 continue_req:
 470         wpa_hexdump(MSG_DEBUG, "EAP-PEAP: Decrypted Phase 2 EAP", in_decrypted,
 471                     len_decrypted);
 472
 473         hdr = (struct eap_hdr *) in_decrypted;
 474         if (len_decrypted == 5 && hdr->code == EAP_CODE_REQUEST &&
 475             be_to_host16(hdr->length) == 5 &&
 476             in_decrypted[4] == EAP_TYPE_IDENTITY) {
 477                 /* At least FreeRADIUS seems to send full EAP header with
 478                  * EAP Request Identity */
 479                 skip_change = 1;
 480         }
 481         if (len_decrypted >= 5 && hdr->code == EAP_CODE_REQUEST &&
 482             in_decrypted[4] == EAP_TYPE_TLV) {
 483                 skip_change = 1;
 484         }
 485
 486         if (data->peap_version == 0 && !skip_change) {
 487                 struct eap_hdr *nhdr = os_malloc(sizeof(struct eap_hdr) +
 488                                                  len_decrypted);
 489                 if (nhdr == NULL) {
 490                         os_free(in_decrypted);
 491                         return 0;
 492                 }
 493                 os_memcpy((u8 *) (nhdr + 1), in_decrypted, len_decrypted);
 494                 os_free(in_decrypted);
 495                 nhdr->code = req->code;
 496                 nhdr->identifier = req->identifier;
 497                 nhdr->length = host_to_be16(sizeof(struct eap_hdr) +
 498                                             len_decrypted);
 499
 500                 len_decrypted += sizeof(struct eap_hdr);
 501                 in_decrypted = (u8 *) nhdr;
 502         }
 503         hdr = (struct eap_hdr *) in_decrypted;
 504         if (len_decrypted < sizeof(*hdr)) {
 505                 os_free(in_decrypted);
 506                 wpa_printf(MSG_INFO, "EAP-PEAP: Too short Phase 2 "
 507                            "EAP frame (len=%lu)",
 508                            (unsigned long) len_decrypted);
 509                 return 0;
 510         }
 511         len = be_to_host16(hdr->length);
 512         if (len > len_decrypted) {
 513                 os_free(in_decrypted);
 514                 wpa_printf(MSG_INFO, "EAP-PEAP: Length mismatch in "
 515                            "Phase 2 EAP frame (len=%lu hdr->length=%lu)",
 516                            (unsigned long) len_decrypted, (unsigned long) len);
 517                 return 0;
 518         }
 519         if (len < len_decrypted) {
 520                 wpa_printf(MSG_INFO, "EAP-PEAP: Odd.. Phase 2 EAP header has "
 521                            "shorter length than full decrypted data "
 522                            "(%lu < %lu)",
 523                            (unsigned long) len, (unsigned long) len_decrypted);
 524                 if (sm->workaround && len == 4 && len_decrypted == 5 &&
 525                     in_decrypted[4] == EAP_TYPE_IDENTITY) {
 526                         /* Radiator 3.9 seems to set Phase 2 EAP header to use
 527                          * incorrect length for the EAP-Request Identity
 528                          * packet, so fix the inner header to interoperate..
 529                          * This was fixed in 2004-06-23 patch for Radiator and
 530                          * this workaround can be removed at some point. */
 531                         wpa_printf(MSG_INFO, "EAP-PEAP: workaround -> replace "
 532                                    "Phase 2 EAP header len (%lu) with real "
 533                                    "decrypted len (%lu)",
 534                                    (unsigned long) len,
 535                                    (unsigned long) len_decrypted);
 536                         len = len_decrypted;
 537                         hdr->length = host_to_be16(len);
 538                 }
 539         }
 540         wpa_printf(MSG_DEBUG, "EAP-PEAP: received Phase 2: code=%d "
 541                    "identifier=%d length=%lu", hdr->code, hdr->identifier,
 542                    (unsigned long) len);
 543         switch (hdr->code) {
 544         case EAP_CODE_REQUEST:
 545                 if (eap_peap_phase2_request(sm, data, ret, hdr,
 546                                             &resp, &resp_len)) {
 547                         os_free(in_decrypted);
 548                         wpa_printf(MSG_INFO, "EAP-PEAP: Phase2 Request "
 549                                    "processing failed");
 550                         return 0;
 551                 }
 552                 break;
 553         case EAP_CODE_SUCCESS:
 554                 wpa_printf(MSG_DEBUG, "EAP-PEAP: Phase 2 Success");
 555                 if (data->peap_version == 1) {
 556                         /* EAP-Success within TLS tunnel is used to indicate
 557                          * shutdown of the TLS channel. The authentication has
 558                          * been completed. */
 559                         if (data->phase2_eap_started &&
 560                             !data->phase2_eap_success) {
 561                                 wpa_printf(MSG_DEBUG, "EAP-PEAP: Phase 2 "
 562                                            "Success used to indicate success, "
 563                                            "but Phase 2 EAP was not yet "
 564                                            "completed successfully");
 565                                 ret->methodState = METHOD_DONE;
 566                                 ret->decision = DECISION_FAIL;
 567                                 os_free(in_decrypted);
 568                                 return 0;
 569                         }
 570                         wpa_printf(MSG_DEBUG, "EAP-PEAP: Version 1 - "
 571                                    "EAP-Success within TLS tunnel - "
 572                                    "authentication completed");
 573                         ret->decision = DECISION_UNCOND_SUCC;
 574                         ret->methodState = METHOD_DONE;
 575                         data->phase2_success = 1;
 576                         if (data->peap_outer_success == 2) {
 577                                 os_free(in_decrypted);
 578                                 wpa_printf(MSG_DEBUG, "EAP-PEAP: Use TLS ACK "
 579                                            "to finish authentication");
 580                                 return 1;
 581                         } else if (data->peap_outer_success == 1) {
 582                                 /* Reply with EAP-Success within the TLS
 583                                  * channel to complete the authentication. */
 584                                 resp_len = sizeof(struct eap_hdr);
 585                                 resp = os_zalloc(resp_len);
 586                                 if (resp) {
 587                                         rhdr = (struct eap_hdr *) resp;
 588                                         rhdr->code = EAP_CODE_SUCCESS;
 589                                         rhdr->identifier = hdr->identifier;
 590                                         rhdr->length = host_to_be16(resp_len);
 591                                 }
 592                         } else {
 593                                 /* No EAP-Success expected for Phase 1 (outer,
 594                                  * unencrypted auth), so force EAP state
 595                                  * machine to SUCCESS state. */
 596                                 sm->peap_done = TRUE;
 597                         }
 598                 } else {
 599                         /* FIX: ? */
 600                 }
 601                 break;
 602         case EAP_CODE_FAILURE:
 603                 wpa_printf(MSG_DEBUG, "EAP-PEAP: Phase 2 Failure");
 604                 ret->decision = DECISION_FAIL;
 605                 ret->methodState = METHOD_MAY_CONT;
 606                 ret->allowNotifications = FALSE;
 607                 /* Reply with EAP-Failure within the TLS channel to complete
 608                  * failure reporting. */
 609                 resp_len = sizeof(struct eap_hdr);
 610                 resp = os_zalloc(resp_len);
 611                 if (resp) {
 612                         rhdr = (struct eap_hdr *) resp;
 613                         rhdr->code = EAP_CODE_FAILURE;
 614                         rhdr->identifier = hdr->identifier;
 615                         rhdr->length = host_to_be16(resp_len);
 616                 }
 617                 break;
 618         default:
 619                 wpa_printf(MSG_INFO, "EAP-PEAP: Unexpected code=%d in "
 620                            "Phase 2 EAP header", hdr->code);
 621                 break;
 622         }
 623
 624         os_free(in_decrypted);
 625
 626         if (resp) {
 627                 u8 *resp_pos;
 628                 size_t resp_send_len;
 629                 int skip_change2 = 0;
 630
 631                 wpa_hexdump_key(MSG_DEBUG, "EAP-PEAP: Encrypting Phase 2 data",
 632                                 resp, resp_len);
 633                 /* PEAP version changes */
 634                 if (resp_len >= 5 && resp[0] == EAP_CODE_RESPONSE &&
 635                     resp[4] == EAP_TYPE_TLV)
 636                         skip_change2 = 1;
 637                 if (data->peap_version == 0 && !skip_change2) {
 638                         resp_pos = resp + sizeof(struct eap_hdr);
 639                         resp_send_len = resp_len - sizeof(struct eap_hdr);
 640                 } else {
 641                         resp_pos = resp;
 642                         resp_send_len = resp_len;
 643                 }
 644
 645                 if (eap_peap_encrypt(sm, data, req->identifier,
 646                                      resp_pos, resp_send_len,
 647                                      out_data, out_len)) {
 648                         wpa_printf(MSG_INFO, "EAP-PEAP: Failed to encrypt "
 649                                    "a Phase 2 frame");
 650                 }
 651                 os_free(resp);
 652         }
 653
 654         return 0;
 655 }
 656
 657
 658 static u8 * eap_peap_process(struct eap_sm *sm, void *priv,
 659                              struct eap_method_ret *ret,
 660                              const u8 *reqData, size_t reqDataLen,
 661                              size_t *respDataLen)
 662 {
 663         const struct eap_hdr *req;
 664         size_t left;
 665         int res;
 666         u8 flags, *resp, id;
 667         const u8 *pos;
 668         struct eap_peap_data *data = priv;
 669
 670         pos = eap_tls_process_init(sm, &data->ssl, EAP_TYPE_PEAP, ret,
 671                                    reqData, reqDataLen, &left, &flags);
 672         if (pos == NULL)
 673                 return NULL;
 674         req = (const struct eap_hdr *) reqData;
 675         id = req->identifier;
 676
 677         if (flags & EAP_TLS_FLAGS_START) {
 678                 wpa_printf(MSG_DEBUG, "EAP-PEAP: Start (server ver=%d, own "
 679                            "ver=%d)", flags & EAP_PEAP_VERSION_MASK,
 680                         data->peap_version);
 681                 if ((flags & EAP_PEAP_VERSION_MASK) < data->peap_version)
 682                         data->peap_version = flags & EAP_PEAP_VERSION_MASK;
 683                 if (data->force_peap_version >= 0 &&
 684                     data->force_peap_version != data->peap_version) {
 685                         wpa_printf(MSG_WARNING, "EAP-PEAP: Failed to select "
 686                                    "forced PEAP version %d",
 687                                    data->force_peap_version);
 688                         ret->methodState = METHOD_DONE;
 689                         ret->decision = DECISION_FAIL;
 690                         ret->allowNotifications = FALSE;
 691                         return NULL;
 692                 }
 693                 wpa_printf(MSG_DEBUG, "EAP-PEAP: Using PEAP version %d",
 694                            data->peap_version);
 695                 left = 0; /* make sure that this frame is empty, even though it
 696                            * should always be, anyway */
 697         }
 698
 699         resp = NULL;
 700         if (tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&
 701             !data->resuming) {
 702                 res = eap_peap_decrypt(sm, data, ret, req, pos, left,
 703                                        &resp, respDataLen);
 704         } else {
 705                 res = eap_tls_process_helper(sm, &data->ssl, EAP_TYPE_PEAP,
 706                                              data->peap_version, id, pos, left,
 707                                              &resp, respDataLen);
 708
 709                 if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) {
 710                         char *label;
 711                         wpa_printf(MSG_DEBUG,
 712                                    "EAP-PEAP: TLS done, proceed to Phase 2");
 713                         os_free(data->key_data);
 714                         /* draft-josefsson-ppext-eap-tls-eap-05.txt
 715                          * specifies that PEAPv1 would use "client PEAP
 716                          * encryption" as the label. However, most existing
 717                          * PEAPv1 implementations seem to be using the old
 718                          * label, "client EAP encryption", instead. Use the old
 719                          * label by default, but allow it to be configured with
 720                          * phase1 parameter peaplabel=1. */
 721                         if (data->peap_version > 1 || data->force_new_label)
 722                                 label = "client PEAP encryption";
 723                         else
 724                                 label = "client EAP encryption";
 725                         wpa_printf(MSG_DEBUG, "EAP-PEAP: using label '%s' in "
 726                                    "key derivation", label);
 727                         data->key_data =
 728                                 eap_tls_derive_key(sm, &data->ssl, label,
 729                                                    EAP_TLS_KEY_LEN);
 730                         if (data->key_data) {
 731                                 wpa_hexdump_key(MSG_DEBUG,
 732                                                 "EAP-PEAP: Derived key",
 733                                                 data->key_data,
 734                                                 EAP_TLS_KEY_LEN);
 735                         } else {
 736                                 wpa_printf(MSG_DEBUG, "EAP-PEAP: Failed to "
 737                                            "derive key");
 738                         }
 739
 740                         if (sm->workaround && data->resuming) {
 741                                 /*
 742                                  * At least few RADIUS servers (Aegis v1.1.6;
 743                                  * but not v1.1.4; and Cisco ACS) seem to be
 744                                  * terminating PEAPv1 (Aegis) or PEAPv0 (Cisco
 745                                  * ACS) session resumption with outer
 746                                  * EAP-Success. This does not seem to follow
 747                                  * draft-josefsson-pppext-eap-tls-eap-05.txt
 748                                  * section 4.2, so only allow this if EAP
 749                                  * workarounds are enabled.
 750                                  */
 751                                 wpa_printf(MSG_DEBUG, "EAP-PEAP: Workaround - "
 752                                            "allow outer EAP-Success to "
 753                                            "terminate PEAP resumption");
 754                                 ret->decision = DECISION_COND_SUCC;
 755                                 data->phase2_success = 1;
 756                         }
 757
 758                         data->resuming = 0;
 759                 }
 760
 761                 if (res == 2) {
 762                         /*
 763                          * Application data included in the handshake message.
 764                          */
 765                         os_free(data->pending_phase2_req);
 766                         data->pending_phase2_req = resp;
 767                         data->pending_phase2_req_len = *respDataLen;
 768                         resp = NULL;
 769                         *respDataLen = 0;
 770                         res = eap_peap_decrypt(sm, data, ret, req, pos, left,
 771                                                &resp, respDataLen);
 772                 }
 773         }
 774
 775         if (ret->methodState == METHOD_DONE) {
 776                 ret->allowNotifications = FALSE;
 777         }
 778
 779         if (res == 1) {
 780                 return eap_tls_build_ack(&data->ssl, respDataLen, id,
 781                                          EAP_TYPE_PEAP, data->peap_version);
 782         }
 783
 784         return resp;
 785 }
 786
 787
 788 static Boolean eap_peap_has_reauth_data(struct eap_sm *sm, void *priv)
 789 {
 790         struct eap_peap_data *data = priv;
 791         return tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&
 792                 data->phase2_success;
 793 }
 794
 795
 796 static void eap_peap_deinit_for_reauth(struct eap_sm *sm, void *priv)
 797 {
 798         struct eap_peap_data *data = priv;
 799         os_free(data->pending_phase2_req);
 800         data->pending_phase2_req = NULL;
 801 }
 802
 803
 804 static void * eap_peap_init_for_reauth(struct eap_sm *sm, void *priv)
 805 {
 806         struct eap_peap_data *data = priv;
 807         os_free(data->key_data);
 808         data->key_data = NULL;
 809         if (eap_tls_reauth_init(sm, &data->ssl)) {
 810                 os_free(data);
 811                 return NULL;
 812         }
 813         if (data->phase2_priv && data->phase2_method &&
 814             data->phase2_method->init_for_reauth)
 815                 data->phase2_method->init_for_reauth(sm, data->phase2_priv);
 816         data->phase2_success = 0;
 817         data->phase2_eap_success = 0;
 818         data->phase2_eap_started = 0;
 819         data->resuming = 1;
 820         sm->peap_done = FALSE;
 821         return priv;
 822 }
 823
 824
 825 static int eap_peap_get_status(struct eap_sm *sm, void *priv, char *buf,
 826                                size_t buflen, int verbose)
 827 {
 828         struct eap_peap_data *data = priv;
 829         int len, ret;
 830
 831         len = eap_tls_status(sm, &data->ssl, buf, buflen, verbose);
 832         if (data->phase2_method) {
 833                 ret = os_snprintf(buf + len, buflen - len,
 834                                   "EAP-PEAPv%d Phase2 method=%s\n",
 835                                   data->peap_version,
 836                                   data->phase2_method->name);
 837                 if (ret < 0 || (size_t) ret >= buflen - len)
 838                         return len;
 839                 len += ret;
 840         }
 841         return len;
 842 }
 843
 844
 845 static Boolean eap_peap_isKeyAvailable(struct eap_sm *sm, void *priv)
 846 {
 847         struct eap_peap_data *data = priv;
 848         return data->key_data != NULL && data->phase2_success;
 849 }
 850
 851
 852 static u8 * eap_peap_getKey(struct eap_sm *sm, void *priv, size_t *len)
 853 {
 854         struct eap_peap_data *data = priv;
 855         u8 *key;
 856
 857         if (data->key_data == NULL || !data->phase2_success)
 858                 return NULL;
 859
 860         key = os_malloc(EAP_TLS_KEY_LEN);
 861         if (key == NULL)
 862                 return NULL;
 863
 864         *len = EAP_TLS_KEY_LEN;
 865         os_memcpy(key, data->key_data, EAP_TLS_KEY_LEN);
 866
 867         return key;
 868 }
 869
 870
 871 int eap_peer_peap_register(void)
 872 {
 873         struct eap_method *eap;
 874         int ret;
 875
 876         eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
 877                                     EAP_VENDOR_IETF, EAP_TYPE_PEAP, "PEAP");
 878         if (eap == NULL)
 879                 return -1;
 880
 881         eap->init = eap_peap_init;
 882         eap->deinit = eap_peap_deinit;
 883         eap->process = eap_peap_process;
 884         eap->isKeyAvailable = eap_peap_isKeyAvailable;
 885         eap->getKey = eap_peap_getKey;
 886         eap->get_status = eap_peap_get_status;
 887         eap->has_reauth_data = eap_peap_has_reauth_data;
 888         eap->deinit_for_reauth = eap_peap_deinit_for_reauth;
 889         eap->init_for_reauth = eap_peap_init_for_reauth;
 890
 891         ret = eap_peer_method_register(eap);
 892         if (ret)
 893                 eap_peer_method_free(eap);
 894         return ret;
 895 }