libeap/src/eap_peer/eap_ttls.c

   1 /*
   2  * EAP peer method: EAP-TTLS (RFC 5281)
   3  * Copyright (c) 2004-2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "crypto/ms_funcs.h"
  19 #include "crypto/sha1.h"
  20 #include "crypto/tls.h"
  21 #include "eap_common/chap.h"
  22 #include "eap_common/eap_ttls.h"
  23 #include "mschapv2.h"
  24 #include "eap_i.h"
  25 #include "eap_tls_common.h"
  26 #include "eap_config.h"
  27
  28
  29 /* Maximum supported TTLS version
  30  * 0 = RFC 5281
  31  * 1 = draft-funk-eap-ttls-v1-00.txt
  32  */
  33 #ifndef EAP_TTLS_VERSION
  34 #define EAP_TTLS_VERSION 0 /* TTLSv1 implementation is not yet complete */
  35 #endif /* EAP_TTLS_VERSION */
  36
  37
  38 #define MSCHAPV2_KEY_LEN 16
  39 #define MSCHAPV2_NT_RESPONSE_LEN 24
  40
  41
  42 static void eap_ttls_deinit(struct eap_sm *sm, void *priv);
  43
  44
  45 struct eap_ttls_data {
  46         struct eap_ssl_data ssl;
  47         int ssl_initialized;
  48
  49         int ttls_version, force_ttls_version;
  50
  51         const struct eap_method *phase2_method;
  52         void *phase2_priv;
  53         int phase2_success;
  54         int phase2_start;
  55
  56         enum phase2_types {
  57                 EAP_TTLS_PHASE2_EAP,
  58                 EAP_TTLS_PHASE2_MSCHAPV2,
  59                 EAP_TTLS_PHASE2_MSCHAP,
  60                 EAP_TTLS_PHASE2_PAP,
  61                 EAP_TTLS_PHASE2_CHAP
  62         } phase2_type;
  63         struct eap_method_type phase2_eap_type;
  64         struct eap_method_type *phase2_eap_types;
  65         size_t num_phase2_eap_types;
  66
  67         u8 auth_response[MSCHAPV2_AUTH_RESPONSE_LEN];
  68         int auth_response_valid;
  69         u8 master_key[MSCHAPV2_MASTER_KEY_LEN]; /* MSCHAPv2 master key */
  70         u8 ident;
  71         int resuming; /* starting a resumed session */
  72         int reauth; /* reauthentication */
  73         u8 *key_data;
  74
  75         struct wpabuf *pending_phase2_req;
  76         int chbind_req_sent; /* channel binding request was sent */
  77 #ifdef EAP_TNC
  78         int ready_for_tnc;
  79         int tnc_started;
  80 #endif /* EAP_TNC */
  81 };
  82
  83
  84 /* draft-ietf-emu-chbind-13 section 5.3 */
  85
  86 #ifdef _MSC_VER
  87 #pragma pack(push, 1)
  88 #endif /* _MSC_VER */
  89
  90 struct chbind_hdr {
  91         u16 len;
  92         u8 nsid;
  93 };
  94
  95 #ifdef _MSC_VER
  96 #pragma pack(pop)
  97 #endif /* _MSC_VER */
  98
  99
 100
 101 static void * eap_ttls_init(struct eap_sm *sm)
 102 {
 103         struct eap_ttls_data *data;
 104         struct eap_peer_config *config = eap_get_config(sm);
 105         char *selected;
 106
 107         data = os_zalloc(sizeof(*data));
 108         if (data == NULL)
 109                 return NULL;
 110         data->ttls_version = EAP_TTLS_VERSION;
 111         data->force_ttls_version = -1;
 112         selected = "EAP";
 113         data->phase2_type = EAP_TTLS_PHASE2_EAP;
 114
 115 #if EAP_TTLS_VERSION > 0
 116         if (config && config->phase1) {
 117                 const char *pos = os_strstr(config->phase1, "ttlsver=");
 118                 if (pos) {
 119                         data->force_ttls_version = atoi(pos + 8);
 120                         data->ttls_version = data->force_ttls_version;
 121                         wpa_printf(MSG_DEBUG, "EAP-TTLS: Forced TTLS version "
 122                                    "%d", data->force_ttls_version);
 123                 }
 124         }
 125 #endif /* EAP_TTLS_VERSION */
 126
 127         if (config && config->phase2) {
 128                 if (os_strstr(config->phase2, "autheap=")) {
 129                         selected = "EAP";
 130                         data->phase2_type = EAP_TTLS_PHASE2_EAP;
 131                 } else if (os_strstr(config->phase2, "auth=MSCHAPV2")) {
 132                         selected = "MSCHAPV2";
 133                         data->phase2_type = EAP_TTLS_PHASE2_MSCHAPV2;
 134                 } else if (os_strstr(config->phase2, "auth=MSCHAP")) {
 135                         selected = "MSCHAP";
 136                         data->phase2_type = EAP_TTLS_PHASE2_MSCHAP;
 137                 } else if (os_strstr(config->phase2, "auth=PAP")) {
 138                         selected = "PAP";
 139                         data->phase2_type = EAP_TTLS_PHASE2_PAP;
 140                 } else if (os_strstr(config->phase2, "auth=CHAP")) {
 141                         selected = "CHAP";
 142                         data->phase2_type = EAP_TTLS_PHASE2_CHAP;
 143                 }
 144         }
 145         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase2 type: %s", selected);
 146
 147         if (data->phase2_type == EAP_TTLS_PHASE2_EAP) {
 148                 if (eap_peer_select_phase2_methods(config, "autheap=",
 149                                                    &data->phase2_eap_types,
 150                                                    &data->num_phase2_eap_types)
 151                     < 0) {
 152                         eap_ttls_deinit(sm, data);
 153                         return NULL;
 154                 }
 155
 156                 data->phase2_eap_type.vendor = EAP_VENDOR_IETF;
 157                 data->phase2_eap_type.method = EAP_TYPE_NONE;
 158         }
 159
 160 #if EAP_TTLS_VERSION > 0
 161         if (!(tls_capabilities(sm->ssl_ctx) & TLS_CAPABILITY_IA) &&
 162             data->ttls_version > 0) {
 163                 if (data->force_ttls_version > 0) {
 164                         wpa_printf(MSG_INFO, "EAP-TTLS: Forced TTLSv%d and "
 165                                    "TLS library does not support TLS/IA.",
 166                                    data->force_ttls_version);
 167                         eap_ttls_deinit(sm, data);
 168                         return NULL;
 169                 }
 170                 data->ttls_version = 0;
 171         }
 172 #endif /* EAP_TTLS_VERSION */
 173
 174         return data;
 175 }
 176
 177
 178 static void eap_ttls_phase2_eap_deinit(struct eap_sm *sm,
 179                                        struct eap_ttls_data *data)
 180 {
 181         if (data->phase2_priv && data->phase2_method) {
 182                 data->phase2_method->deinit(sm, data->phase2_priv);
 183                 data->phase2_method = NULL;
 184                 data->phase2_priv = NULL;
 185         }
 186 }
 187
 188
 189 static void eap_ttls_deinit(struct eap_sm *sm, void *priv)
 190 {
 191         struct eap_ttls_data *data = priv;
 192         if (data == NULL)
 193                 return;
 194         eap_ttls_phase2_eap_deinit(sm, data);
 195         os_free(data->phase2_eap_types);
 196         if (data->ssl_initialized)
 197                 eap_peer_tls_ssl_deinit(sm, &data->ssl);
 198         os_free(data->key_data);
 199         wpabuf_free(data->pending_phase2_req);
 200         os_free(data);
 201 }
 202
 203
 204 static u8 * eap_ttls_avp_hdr(u8 *avphdr, u32 avp_code, u32 vendor_id,
 205                              int mandatory, size_t len)
 206 {
 207         struct ttls_avp_vendor *avp;
 208         u8 flags;
 209         size_t hdrlen;
 210
 211         avp = (struct ttls_avp_vendor *) avphdr;
 212         flags = mandatory ? AVP_FLAGS_MANDATORY : 0;
 213         if (vendor_id) {
 214                 flags |= AVP_FLAGS_VENDOR;
 215                 hdrlen = sizeof(*avp);
 216                 avp->vendor_id = host_to_be32(vendor_id);
 217         } else {
 218                 hdrlen = sizeof(struct ttls_avp);
 219         }
 220
 221         avp->avp_code = host_to_be32(avp_code);
 222         avp->avp_length = host_to_be32((flags << 24) | (hdrlen + len));
 223
 224         return avphdr + hdrlen;
 225 }
 226
 227
 228 static u8 * eap_ttls_avp_add(u8 *start, u8 *avphdr, u32 avp_code,
 229                              u32 vendor_id, int mandatory,
 230                              const u8 *data, size_t len)
 231 {
 232         u8 *pos;
 233         pos = eap_ttls_avp_hdr(avphdr, avp_code, vendor_id, mandatory, len);
 234         os_memcpy(pos, data, len);
 235         pos += len;
 236         AVP_PAD(start, pos);
 237         return pos;
 238 }
 239
 240
 241 static int eap_ttls_avp_encapsulate(struct wpabuf **resp, u32 avp_code,
 242                                     int mandatory)
 243 {
 244         struct wpabuf *msg;
 245         u8 *avp, *pos;
 246
 247         msg = wpabuf_alloc(sizeof(struct ttls_avp) + wpabuf_len(*resp) + 4);
 248         if (msg == NULL) {
 249                 wpabuf_free(*resp);
 250                 *resp = NULL;
 251                 return -1;
 252         }
 253
 254         avp = wpabuf_mhead(msg);
 255         pos = eap_ttls_avp_hdr(avp, avp_code, 0, mandatory, wpabuf_len(*resp));
 256         os_memcpy(pos, wpabuf_head(*resp), wpabuf_len(*resp));
 257         pos += wpabuf_len(*resp);
 258         AVP_PAD(avp, pos);
 259         wpabuf_free(*resp);
 260         wpabuf_put(msg, pos - avp);
 261         *resp = msg;
 262         return 0;
 263 }
 264
 265
 266 #if EAP_TTLS_VERSION > 0
 267 static int eap_ttls_ia_permute_inner_secret(struct eap_sm *sm,
 268                                             struct eap_ttls_data *data,
 269                                             const u8 *key, size_t key_len)
 270 {
 271         u8 *buf;
 272         size_t buf_len;
 273         int ret;
 274
 275         if (key) {
 276                 buf_len = 2 + key_len;
 277                 buf = os_malloc(buf_len);
 278                 if (buf == NULL)
 279                         return -1;
 280                 WPA_PUT_BE16(buf, key_len);
 281                 os_memcpy(buf + 2, key, key_len);
 282         } else {
 283                 buf = NULL;
 284                 buf_len = 0;
 285         }
 286
 287         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Session keys for TLS/IA inner "
 288                         "secret permutation", buf, buf_len);
 289         ret = tls_connection_ia_permute_inner_secret(sm->ssl_ctx,
 290                                                      data->ssl.conn,
 291                                                      buf, buf_len);
 292         os_free(buf);
 293
 294         return ret;
 295 }
 296 #endif /* EAP_TTLS_VERSION */
 297
 298
 299 static int eap_ttls_v0_derive_key(struct eap_sm *sm,
 300                                   struct eap_ttls_data *data)
 301 {
 302         os_free(data->key_data);
 303         data->key_data = eap_peer_tls_derive_key(sm, &data->ssl,
 304                                                  "ttls keying material",
 305                                                  EAP_TLS_KEY_LEN);
 306         if (!data->key_data) {
 307                 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to derive key");
 308                 return -1;
 309         }
 310
 311         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived key",
 312                         data->key_data, EAP_TLS_KEY_LEN);
 313
 314         return 0;
 315 }
 316
 317
 318 #if EAP_TTLS_VERSION > 0
 319 static int eap_ttls_v1_derive_key(struct eap_sm *sm,
 320                                   struct eap_ttls_data *data)
 321 {
 322         struct tls_keys keys;
 323         u8 *rnd;
 324
 325         os_free(data->key_data);
 326         data->key_data = NULL;
 327
 328         os_memset(&keys, 0, sizeof(keys));
 329         if (tls_connection_get_keys(sm->ssl_ctx, data->ssl.conn, &keys) ||
 330             keys.client_random == NULL || keys.server_random == NULL ||
 331             keys.inner_secret == NULL) {
 332                 wpa_printf(MSG_INFO, "EAP-TTLS: Could not get inner secret, "
 333                            "client random, or server random to derive keying "
 334                            "material");
 335                 return -1;
 336         }
 337
 338         rnd = os_malloc(keys.client_random_len + keys.server_random_len);
 339         data->key_data = os_malloc(EAP_TLS_KEY_LEN);
 340         if (rnd == NULL || data->key_data == NULL) {
 341                 wpa_printf(MSG_INFO, "EAP-TTLS: No memory for key derivation");
 342                 os_free(rnd);
 343                 os_free(data->key_data);
 344                 data->key_data = NULL;
 345                 return -1;
 346         }
 347         os_memcpy(rnd, keys.client_random, keys.client_random_len);
 348         os_memcpy(rnd + keys.client_random_len, keys.server_random,
 349                   keys.server_random_len);
 350
 351         if (tls_prf(keys.inner_secret, keys.inner_secret_len,
 352                     "ttls v1 keying material", rnd, keys.client_random_len +
 353                     keys.server_random_len, data->key_data, EAP_TLS_KEY_LEN)) {
 354                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Failed to derive key");
 355                 os_free(rnd);
 356                 os_free(data->key_data);
 357                 data->key_data = NULL;
 358                 return -1;
 359         }
 360
 361         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: client/server random",
 362                     rnd, keys.client_random_len + keys.server_random_len);
 363         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: TLS/IA inner secret",
 364                         keys.inner_secret, keys.inner_secret_len);
 365
 366         os_free(rnd);
 367
 368         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived key",
 369                         data->key_data, EAP_TLS_KEY_LEN);
 370
 371         return 0;
 372 }
 373 #endif /* EAP_TTLS_VERSION */
 374
 375
 376 static u8 * eap_ttls_implicit_challenge(struct eap_sm *sm,
 377                                         struct eap_ttls_data *data, size_t len)
 378 {
 379 #if EAP_TTLS_VERSION > 0
 380         struct tls_keys keys;
 381         u8 *challenge, *rnd;
 382 #endif /* EAP_TTLS_VERSION */
 383
 384         if (data->ttls_version == 0) {
 385                 return eap_peer_tls_derive_key(sm, &data->ssl,
 386                                                "ttls challenge", len);
 387         }
 388
 389 #if EAP_TTLS_VERSION > 0
 390
 391         os_memset(&keys, 0, sizeof(keys));
 392         if (tls_connection_get_keys(sm->ssl_ctx, data->ssl.conn, &keys) ||
 393             keys.client_random == NULL || keys.server_random == NULL ||
 394             keys.inner_secret == NULL) {
 395                 wpa_printf(MSG_INFO, "EAP-TTLS: Could not get inner secret, "
 396                            "client random, or server random to derive "
 397                            "implicit challenge");
 398                 return NULL;
 399         }
 400
 401         rnd = os_malloc(keys.client_random_len + keys.server_random_len);
 402         challenge = os_malloc(len);
 403         if (rnd == NULL || challenge == NULL) {
 404                 wpa_printf(MSG_INFO, "EAP-TTLS: No memory for implicit "
 405                            "challenge derivation");
 406                 os_free(rnd);
 407                 os_free(challenge);
 408                 return NULL;
 409         }
 410         os_memcpy(rnd, keys.server_random, keys.server_random_len);
 411         os_memcpy(rnd + keys.server_random_len, keys.client_random,
 412                   keys.client_random_len);
 413
 414         if (tls_prf(keys.inner_secret, keys.inner_secret_len,
 415                     "inner application challenge", rnd,
 416                     keys.client_random_len + keys.server_random_len,
 417                     challenge, len)) {
 418                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Failed to derive implicit "
 419                            "challenge");
 420                 os_free(rnd);
 421                 os_free(challenge);
 422                 return NULL;
 423         }
 424
 425         os_free(rnd);
 426
 427         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived implicit challenge",
 428                         challenge, len);
 429
 430         return challenge;
 431
 432 #else /* EAP_TTLS_VERSION */
 433
 434         return NULL;
 435
 436 #endif /* EAP_TTLS_VERSION */
 437 }
 438
 439
 440 static void eap_ttlsv1_phase2_eap_finish(struct eap_sm *sm,
 441                                          struct eap_ttls_data *data,
 442                                          struct eap_method_ret *ret)
 443 {
 444 #if EAP_TTLS_VERSION > 0
 445         if (data->ttls_version > 0) {
 446                 const struct eap_method *m = data->phase2_method;
 447                 void *priv = data->phase2_priv;
 448
 449                 /* TTLSv1 requires TLS/IA FinalPhaseFinished */
 450                 if (ret->decision == DECISION_UNCOND_SUCC)
 451                         ret->decision = DECISION_COND_SUCC;
 452                 ret->methodState = METHOD_CONT;
 453
 454                 if (ret->decision == DECISION_COND_SUCC &&
 455                     m->isKeyAvailable && m->getKey &&
 456                     m->isKeyAvailable(sm, priv)) {
 457                         u8 *key;
 458                         size_t key_len;
 459                         key = m->getKey(sm, priv, &key_len);
 460                         if (key) {
 461                                 eap_ttls_ia_permute_inner_secret(
 462                                         sm, data, key, key_len);
 463                                 os_free(key);
 464                         }
 465                 }
 466         }
 467 #endif /* EAP_TTLS_VERSION */
 468 }
 469
 470
 471 static void eap_ttls_phase2_select_eap_method(struct eap_ttls_data *data,
 472                                               u8 method)
 473 {
 474         size_t i;
 475         for (i = 0; i < data->num_phase2_eap_types; i++) {
 476                 if (data->phase2_eap_types[i].vendor != EAP_VENDOR_IETF ||
 477                     data->phase2_eap_types[i].method != method)
 478                         continue;
 479
 480                 data->phase2_eap_type.vendor =
 481                         data->phase2_eap_types[i].vendor;
 482                 data->phase2_eap_type.method =
 483                         data->phase2_eap_types[i].method;
 484                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Selected "
 485                            "Phase 2 EAP vendor %d method %d",
 486                            data->phase2_eap_type.vendor,
 487                            data->phase2_eap_type.method);
 488                 break;
 489         }
 490 }
 491
 492
 493 static int eap_ttls_phase2_eap_process(struct eap_sm *sm,
 494                                        struct eap_ttls_data *data,
 495                                        struct eap_method_ret *ret,
 496                                        struct eap_hdr *hdr, size_t len,
 497                                        struct wpabuf **resp)
 498 {
 499         struct wpabuf msg;
 500         struct eap_method_ret iret;
 501
 502         os_memset(&iret, 0, sizeof(iret));
 503         wpabuf_set(&msg, hdr, len);
 504         *resp = data->phase2_method->process(sm, data->phase2_priv, &iret,
 505                                              &msg);
 506         if ((iret.methodState == METHOD_DONE ||
 507              iret.methodState == METHOD_MAY_CONT) &&
 508             (iret.decision == DECISION_UNCOND_SUCC ||
 509              iret.decision == DECISION_COND_SUCC ||
 510              iret.decision == DECISION_FAIL)) {
 511                 ret->methodState = iret.methodState;
 512                 ret->decision = iret.decision;
 513         }
 514         eap_ttlsv1_phase2_eap_finish(sm, data, ret);
 515
 516         return 0;
 517 }
 518
 519
 520 static int eap_ttls_phase2_request_eap_method(struct eap_sm *sm,
 521                                               struct eap_ttls_data *data,
 522                                               struct eap_method_ret *ret,
 523                                               struct eap_hdr *hdr, size_t len,
 524                                               u8 method, struct wpabuf **resp)
 525 {
 526 #ifdef EAP_TNC
 527         if (data->tnc_started && data->phase2_method &&
 528             data->phase2_priv && method == EAP_TYPE_TNC &&
 529             data->phase2_eap_type.method == EAP_TYPE_TNC)
 530                 return eap_ttls_phase2_eap_process(sm, data, ret, hdr, len,
 531                                                    resp);
 532
 533         if (data->ready_for_tnc && !data->tnc_started &&
 534             method == EAP_TYPE_TNC) {
 535                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Start TNC after completed "
 536                            "EAP method");
 537                 data->tnc_started = 1;
 538         }
 539
 540         if (data->tnc_started) {
 541                 if (data->phase2_eap_type.vendor != EAP_VENDOR_IETF ||
 542                     data->phase2_eap_type.method == EAP_TYPE_TNC) {
 543                         wpa_printf(MSG_DEBUG, "EAP-TTLS: Unexpected EAP "
 544                                    "type %d for TNC", method);
 545                         return -1;
 546                 }
 547
 548                 data->phase2_eap_type.vendor = EAP_VENDOR_IETF;
 549                 data->phase2_eap_type.method = method;
 550                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Selected "
 551                            "Phase 2 EAP vendor %d method %d (TNC)",
 552                            data->phase2_eap_type.vendor,
 553                            data->phase2_eap_type.method);
 554
 555                 if (data->phase2_type == EAP_TTLS_PHASE2_EAP)
 556                         eap_ttls_phase2_eap_deinit(sm, data);
 557         }
 558 #endif /* EAP_TNC */
 559
 560         if (data->phase2_eap_type.vendor == EAP_VENDOR_IETF &&
 561             data->phase2_eap_type.method == EAP_TYPE_NONE)
 562                 eap_ttls_phase2_select_eap_method(data, method);
 563
 564         if (method != data->phase2_eap_type.method || method == EAP_TYPE_NONE)
 565         {
 566                 if (eap_peer_tls_phase2_nak(data->phase2_eap_types,
 567                                             data->num_phase2_eap_types,
 568                                             hdr, resp))
 569                         return -1;
 570                 return 0;
 571         }
 572
 573         if (data->phase2_priv == NULL) {
 574                 data->phase2_method = eap_peer_get_eap_method(
 575                         EAP_VENDOR_IETF, method);
 576                 if (data->phase2_method) {
 577                         sm->init_phase2 = 1;
 578                         data->phase2_priv = data->phase2_method->init(sm);
 579                         sm->init_phase2 = 0;
 580                 }
 581         }
 582         if (data->phase2_priv == NULL || data->phase2_method == NULL) {
 583                 wpa_printf(MSG_INFO, "EAP-TTLS: failed to initialize "
 584                            "Phase 2 EAP method %d", method);
 585                 return -1;
 586         }
 587
 588         return eap_ttls_phase2_eap_process(sm, data, ret, hdr, len, resp);
 589 }
 590
 591
 592 static int eap_ttls_phase2_request_eap(struct eap_sm *sm,
 593                                        struct eap_ttls_data *data,
 594                                        struct eap_method_ret *ret,
 595                                        struct eap_hdr *hdr,
 596                                        struct wpabuf **resp)
 597 {
 598         size_t len = be_to_host16(hdr->length);
 599         u8 *pos;
 600         struct eap_peer_config *config = eap_get_config(sm);
 601
 602         if (len <= sizeof(struct eap_hdr)) {
 603                 wpa_printf(MSG_INFO, "EAP-TTLS: too short "
 604                            "Phase 2 request (len=%lu)", (unsigned long) len);
 605                 return -1;
 606         }
 607         pos = (u8 *) (hdr + 1);
 608         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 EAP Request: type=%d", *pos);
 609         switch (*pos) {
 610         case EAP_TYPE_IDENTITY:
 611                 *resp = eap_sm_buildIdentity(sm, hdr->identifier, 1);
 612                 break;
 613         default:
 614                 if (eap_ttls_phase2_request_eap_method(sm, data, ret, hdr, len,
 615                                                        *pos, resp) < 0)
 616                         return -1;
 617                 break;
 618         }
 619
 620         if (*resp == NULL &&
 621             (config->pending_req_identity || config->pending_req_password ||
 622              config->pending_req_otp)) {
 623                 return 0;
 624         }
 625
 626         if (*resp == NULL)
 627                 return -1;
 628
 629         wpa_hexdump_buf(MSG_DEBUG, "EAP-TTLS: AVP encapsulate EAP Response",
 630                         *resp);
 631         return eap_ttls_avp_encapsulate(resp, RADIUS_ATTR_EAP_MESSAGE, 1);
 632 }
 633
 634
 635 static void eap_ttlsv1_permute_inner(struct eap_sm *sm,
 636                                      struct eap_ttls_data *data)
 637 {
 638 #if EAP_TTLS_VERSION > 0
 639         u8 session_key[2 * MSCHAPV2_KEY_LEN];
 640
 641         if (data->ttls_version == 0)
 642                 return;
 643
 644         get_asymetric_start_key(data->master_key, session_key,
 645                                 MSCHAPV2_KEY_LEN, 0, 0);
 646         get_asymetric_start_key(data->master_key,
 647                                 session_key + MSCHAPV2_KEY_LEN,
 648                                 MSCHAPV2_KEY_LEN, 1, 0);
 649         eap_ttls_ia_permute_inner_secret(sm, data, session_key,
 650                                          sizeof(session_key));
 651 #endif /* EAP_TTLS_VERSION */
 652 }
 653
 654
 655 static int eap_ttls_phase2_request_mschapv2(struct eap_sm *sm,
 656                                             struct eap_ttls_data *data,
 657                                             struct eap_method_ret *ret,
 658                                             struct wpabuf **resp)
 659 {
 660         struct wpabuf *msg;
 661         u8 *buf, *pos, *challenge, *peer_challenge;
 662         const u8 *identity, *password;
 663         size_t identity_len, password_len;
 664         int pwhash;
 665
 666         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 MSCHAPV2 Request");
 667
 668         identity = eap_get_config_identity(sm, &identity_len);
 669         password = eap_get_config_password2(sm, &password_len, &pwhash);
 670         if (identity == NULL || password == NULL)
 671                 return -1;
 672
 673         msg = wpabuf_alloc(identity_len + 1000);
 674         if (msg == NULL) {
 675                 wpa_printf(MSG_ERROR,
 676                            "EAP-TTLS/MSCHAPV2: Failed to allocate memory");
 677                 return -1;
 678         }
 679         pos = buf = wpabuf_mhead(msg);
 680
 681         /* User-Name */
 682         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,
 683                                identity, identity_len);
 684
 685         /* MS-CHAP-Challenge */
 686         challenge = eap_ttls_implicit_challenge(
 687                 sm, data, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN + 1);
 688         if (challenge == NULL) {
 689                 wpabuf_free(msg);
 690                 wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAPV2: Failed to derive "
 691                            "implicit challenge");
 692                 return -1;
 693         }
 694         peer_challenge = challenge + 1 + EAP_TTLS_MSCHAPV2_CHALLENGE_LEN;
 695
 696         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_MS_CHAP_CHALLENGE,
 697                                RADIUS_VENDOR_ID_MICROSOFT, 1,
 698                                challenge, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN);
 699
 700         /* MS-CHAP2-Response */
 701         pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP2_RESPONSE,
 702                                RADIUS_VENDOR_ID_MICROSOFT, 1,
 703                                EAP_TTLS_MSCHAPV2_RESPONSE_LEN);
 704         data->ident = challenge[EAP_TTLS_MSCHAPV2_CHALLENGE_LEN];
 705         *pos++ = data->ident;
 706         *pos++ = 0; /* Flags */
 707         os_memcpy(pos, peer_challenge, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN);
 708         pos += EAP_TTLS_MSCHAPV2_CHALLENGE_LEN;
 709         os_memset(pos, 0, 8); /* Reserved, must be zero */
 710         pos += 8;
 711         if (mschapv2_derive_response(identity, identity_len, password,
 712                                      password_len, pwhash, challenge,
 713                                      peer_challenge, pos, data->auth_response,
 714                                      data->master_key)) {
 715                 wpabuf_free(msg);
 716                 wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAPV2: Failed to derive "
 717                            "response");
 718                 return -1;
 719         }
 720         data->auth_response_valid = 1;
 721
 722         eap_ttlsv1_permute_inner(sm, data);
 723
 724         pos += 24;
 725         os_free(challenge);
 726         AVP_PAD(buf, pos);
 727
 728         wpabuf_put(msg, pos - buf);
 729         *resp = msg;
 730
 731         if (sm->workaround && data->ttls_version == 0) {
 732                 /* At least FreeRADIUS seems to be terminating
 733                  * EAP-TTLS/MSHCAPV2 without the expected MS-CHAP-v2 Success
 734                  * packet. */
 735                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: EAP workaround - "
 736                            "allow success without tunneled response");
 737                 ret->methodState = METHOD_MAY_CONT;
 738                 ret->decision = DECISION_COND_SUCC;
 739         }
 740
 741         return 0;
 742 }
 743
 744
 745 static int eap_ttls_phase2_request_mschap(struct eap_sm *sm,
 746                                           struct eap_ttls_data *data,
 747                                           struct eap_method_ret *ret,
 748                                           struct wpabuf **resp)
 749 {
 750         struct wpabuf *msg;
 751         u8 *buf, *pos, *challenge;
 752         const u8 *identity, *password;
 753         size_t identity_len, password_len;
 754         int pwhash;
 755
 756         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 MSCHAP Request");
 757
 758         identity = eap_get_config_identity(sm, &identity_len);
 759         password = eap_get_config_password2(sm, &password_len, &pwhash);
 760         if (identity == NULL || password == NULL)
 761                 return -1;
 762
 763         msg = wpabuf_alloc(identity_len + 1000);
 764         if (msg == NULL) {
 765                 wpa_printf(MSG_ERROR,
 766                            "EAP-TTLS/MSCHAP: Failed to allocate memory");
 767                 return -1;
 768         }
 769         pos = buf = wpabuf_mhead(msg);
 770
 771         /* User-Name */
 772         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,
 773                                identity, identity_len);
 774
 775         /* MS-CHAP-Challenge */
 776         challenge = eap_ttls_implicit_challenge(
 777                 sm, data, EAP_TTLS_MSCHAP_CHALLENGE_LEN + 1);
 778         if (challenge == NULL) {
 779                 wpabuf_free(msg);
 780                 wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAP: Failed to derive "
 781                            "implicit challenge");
 782                 return -1;
 783         }
 784
 785         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_MS_CHAP_CHALLENGE,
 786                                RADIUS_VENDOR_ID_MICROSOFT, 1,
 787                                challenge, EAP_TTLS_MSCHAP_CHALLENGE_LEN);
 788
 789         /* MS-CHAP-Response */
 790         pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP_RESPONSE,
 791                                RADIUS_VENDOR_ID_MICROSOFT, 1,
 792                                EAP_TTLS_MSCHAP_RESPONSE_LEN);
 793         data->ident = challenge[EAP_TTLS_MSCHAP_CHALLENGE_LEN];
 794         *pos++ = data->ident;
 795         *pos++ = 1; /* Flags: Use NT style passwords */
 796         os_memset(pos, 0, 24); /* LM-Response */
 797         pos += 24;
 798         if (pwhash) {
 799                 challenge_response(challenge, password, pos); /* NT-Response */
 800                 wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: MSCHAP password hash",
 801                                 password, 16);
 802         } else {
 803                 nt_challenge_response(challenge, password, password_len,
 804                                       pos); /* NT-Response */
 805                 wpa_hexdump_ascii_key(MSG_DEBUG, "EAP-TTLS: MSCHAP password",
 806                                       password, password_len);
 807         }
 808         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAP implicit challenge",
 809                     challenge, EAP_TTLS_MSCHAP_CHALLENGE_LEN);
 810         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAP response", pos, 24);
 811         pos += 24;
 812         os_free(challenge);
 813         AVP_PAD(buf, pos);
 814
 815         wpabuf_put(msg, pos - buf);
 816         *resp = msg;
 817
 818         if (data->ttls_version > 0) {
 819                 /* EAP-TTLSv1 uses TLS/IA FinalPhaseFinished to report success,
 820                  * so do not allow connection to be terminated yet. */
 821                 ret->methodState = METHOD_CONT;
 822                 ret->decision = DECISION_COND_SUCC;
 823         } else {
 824                 /* EAP-TTLS/MSCHAP does not provide tunneled success
 825                  * notification, so assume that Phase2 succeeds. */
 826                 ret->methodState = METHOD_DONE;
 827                 ret->decision = DECISION_COND_SUCC;
 828         }
 829
 830         return 0;
 831 }
 832
 833
 834 static int eap_ttls_phase2_request_pap(struct eap_sm *sm,
 835                                        struct eap_ttls_data *data,
 836                                        struct eap_method_ret *ret,
 837                                        struct wpabuf **resp)
 838 {
 839         struct wpabuf *msg;
 840         u8 *buf, *pos;
 841         size_t pad;
 842         const u8 *identity, *password;
 843         size_t identity_len, password_len;
 844
 845         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 PAP Request");
 846
 847         identity = eap_get_config_identity(sm, &identity_len);
 848         password = eap_get_config_password(sm, &password_len);
 849         if (identity == NULL || password == NULL)
 850                 return -1;
 851
 852         msg = wpabuf_alloc(identity_len + password_len + 100);
 853         if (msg == NULL) {
 854                 wpa_printf(MSG_ERROR,
 855                            "EAP-TTLS/PAP: Failed to allocate memory");
 856                 return -1;
 857         }
 858         pos = buf = wpabuf_mhead(msg);
 859
 860         /* User-Name */
 861         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,
 862                                identity, identity_len);
 863
 864         /* User-Password; in RADIUS, this is encrypted, but EAP-TTLS encrypts
 865          * the data, so no separate encryption is used in the AVP itself.
 866          * However, the password is padded to obfuscate its length. */
 867         pad = password_len == 0 ? 16 : (16 - (password_len & 15)) & 15;
 868         pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_USER_PASSWORD, 0, 1,
 869                                password_len + pad);
 870         os_memcpy(pos, password, password_len);
 871         pos += password_len;
 872         os_memset(pos, 0, pad);
 873         pos += pad;
 874         AVP_PAD(buf, pos);
 875
 876         wpabuf_put(msg, pos - buf);
 877         *resp = msg;
 878
 879         if (data->ttls_version > 0) {
 880                 /* EAP-TTLSv1 uses TLS/IA FinalPhaseFinished to report success,
 881                  * so do not allow connection to be terminated yet. */
 882                 ret->methodState = METHOD_CONT;
 883                 ret->decision = DECISION_COND_SUCC;
 884         } else {
 885                 /* EAP-TTLS/PAP does not provide tunneled success notification,
 886                  * so assume that Phase2 succeeds. */
 887                 ret->methodState = METHOD_DONE;
 888                 ret->decision = DECISION_COND_SUCC;
 889         }
 890
 891         return 0;
 892 }
 893
 894
 895 static int eap_ttls_phase2_request_chap(struct eap_sm *sm,
 896                                         struct eap_ttls_data *data,
 897                                         struct eap_method_ret *ret,
 898                                         struct wpabuf **resp)
 899 {
 900         struct wpabuf *msg;
 901         u8 *buf, *pos, *challenge;
 902         const u8 *identity, *password;
 903         size_t identity_len, password_len;
 904
 905         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 CHAP Request");
 906
 907         identity = eap_get_config_identity(sm, &identity_len);
 908         password = eap_get_config_password(sm, &password_len);
 909         if (identity == NULL || password == NULL)
 910                 return -1;
 911
 912         msg = wpabuf_alloc(identity_len + 1000);
 913         if (msg == NULL) {
 914                 wpa_printf(MSG_ERROR,
 915                            "EAP-TTLS/CHAP: Failed to allocate memory");
 916                 return -1;
 917         }
 918         pos = buf = wpabuf_mhead(msg);
 919
 920         /* User-Name */
 921         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,
 922                                identity, identity_len);
 923
 924         /* CHAP-Challenge */
 925         challenge = eap_ttls_implicit_challenge(
 926                 sm, data, EAP_TTLS_CHAP_CHALLENGE_LEN + 1);
 927         if (challenge == NULL) {
 928                 wpabuf_free(msg);
 929                 wpa_printf(MSG_ERROR, "EAP-TTLS/CHAP: Failed to derive "
 930                            "implicit challenge");
 931                 return -1;
 932         }
 933
 934         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_CHAP_CHALLENGE, 0, 1,
 935                                challenge, EAP_TTLS_CHAP_CHALLENGE_LEN);
 936
 937         /* CHAP-Password */
 938         pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_CHAP_PASSWORD, 0, 1,
 939                                1 + EAP_TTLS_CHAP_PASSWORD_LEN);
 940         data->ident = challenge[EAP_TTLS_CHAP_CHALLENGE_LEN];
 941         *pos++ = data->ident;
 942
 943         /* MD5(Ident + Password + Challenge) */
 944         chap_md5(data->ident, password, password_len, challenge,
 945                  EAP_TTLS_CHAP_CHALLENGE_LEN, pos);
 946
 947         wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: CHAP username",
 948                           identity, identity_len);
 949         wpa_hexdump_ascii_key(MSG_DEBUG, "EAP-TTLS: CHAP password",
 950                               password, password_len);
 951         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: CHAP implicit challenge",
 952                     challenge, EAP_TTLS_CHAP_CHALLENGE_LEN);
 953         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: CHAP password",
 954                     pos, EAP_TTLS_CHAP_PASSWORD_LEN);
 955         pos += EAP_TTLS_CHAP_PASSWORD_LEN;
 956         os_free(challenge);
 957         AVP_PAD(buf, pos);
 958
 959         wpabuf_put(msg, pos - buf);
 960         *resp = msg;
 961
 962         if (data->ttls_version > 0) {
 963                 /* EAP-TTLSv1 uses TLS/IA FinalPhaseFinished to report success,
 964                  * so do not allow connection to be terminated yet. */
 965                 ret->methodState = METHOD_CONT;
 966                 ret->decision = DECISION_COND_SUCC;
 967         } else {
 968                 /* EAP-TTLS/CHAP does not provide tunneled success
 969                  * notification, so assume that Phase2 succeeds. */
 970                 ret->methodState = METHOD_DONE;
 971                 ret->decision = DECISION_COND_SUCC;
 972         }
 973
 974         return 0;
 975 }
 976
 977
 978 static int eap_ttls_phase2_request(struct eap_sm *sm,
 979                                    struct eap_ttls_data *data,
 980                                    struct eap_method_ret *ret,
 981                                    struct eap_hdr *hdr,
 982                                    struct wpabuf **resp)
 983 {
 984         int res = 0;
 985         size_t len;
 986         enum phase2_types phase2_type = data->phase2_type;
 987
 988 #ifdef EAP_TNC
 989         if (data->tnc_started) {
 990                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Processing TNC");
 991                 phase2_type = EAP_TTLS_PHASE2_EAP;
 992         }
 993 #endif /* EAP_TNC */
 994
 995         if (phase2_type == EAP_TTLS_PHASE2_MSCHAPV2 ||
 996             phase2_type == EAP_TTLS_PHASE2_MSCHAP ||
 997             phase2_type == EAP_TTLS_PHASE2_PAP ||
 998             phase2_type == EAP_TTLS_PHASE2_CHAP) {
 999                 if (eap_get_config_identity(sm, &len) == NULL) {
1000                         wpa_printf(MSG_INFO,
1001                                    "EAP-TTLS: Identity not configured");
1002                         eap_sm_request_identity(sm);
1003                         if (eap_get_config_password(sm, &len) == NULL)
1004                                 eap_sm_request_password(sm);
1005                         return 0;
1006                 }
1007
1008                 if (eap_get_config_password(sm, &len) == NULL) {
1009                         wpa_printf(MSG_INFO,
1010                                    "EAP-TTLS: Password not configured");
1011                         eap_sm_request_password(sm);
1012                         return 0;
1013                 }
1014         }
1015
1016         switch (phase2_type) {
1017         case EAP_TTLS_PHASE2_EAP:
1018                 res = eap_ttls_phase2_request_eap(sm, data, ret, hdr, resp);
1019                 break;
1020         case EAP_TTLS_PHASE2_MSCHAPV2:
1021                 res = eap_ttls_phase2_request_mschapv2(sm, data, ret, resp);
1022                 break;
1023         case EAP_TTLS_PHASE2_MSCHAP:
1024                 res = eap_ttls_phase2_request_mschap(sm, data, ret, resp);
1025                 break;
1026         case EAP_TTLS_PHASE2_PAP:
1027                 res = eap_ttls_phase2_request_pap(sm, data, ret, resp);
1028                 break;
1029         case EAP_TTLS_PHASE2_CHAP:
1030                 res = eap_ttls_phase2_request_chap(sm, data, ret, resp);
1031                 break;
1032         default:
1033                 wpa_printf(MSG_ERROR, "EAP-TTLS: Phase 2 - Unknown");
1034                 res = -1;
1035                 break;
1036         }
1037
1038         if (res < 0) {
1039                 ret->methodState = METHOD_DONE;
1040                 ret->decision = DECISION_FAIL;
1041         }
1042
1043         return res;
1044 }
1045
1046
1047 #if EAP_TTLS_VERSION > 0
1048 static struct wpabuf * eap_ttls_build_phase_finished(
1049         struct eap_sm *sm, struct eap_ttls_data *data, int id, int final)
1050 {
1051         struct wpabuf *req, *buf;
1052
1053         buf = tls_connection_ia_send_phase_finished(sm->ssl_ctx,
1054                                                     data->ssl.conn,
1055                                                     final);
1056         if (buf == NULL)
1057                 return NULL;
1058
1059         req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_TTLS,
1060                             1 + wpabuf_len(buf),
1061                             EAP_CODE_RESPONSE, id);
1062         if (req == NULL) {
1063                 wpabuf_free(buf);
1064                 return NULL;
1065         }
1066
1067         wpabuf_put_u8(req, data->ttls_version);
1068         wpabuf_put_buf(req, buf);
1069         wpabuf_free(buf);
1070         eap_update_len(req);
1071
1072         return req;
1073 }
1074 #endif /* EAP_TTLS_VERSION */
1075
1076
1077 struct ttls_parse_avp {
1078         u8 *mschapv2;
1079         u8 *eapdata;
1080         size_t eap_len;
1081         u8 *chbind_data;
1082         size_t chbind_len;
1083         int mschapv2_error;
1084 };
1085
1086
1087 static int eap_ttls_parse_attr_eap(const u8 *dpos, size_t dlen,
1088                                    struct ttls_parse_avp *parse)
1089 {
1090         wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP - EAP Message");
1091         if (parse->eapdata == NULL) {
1092                 parse->eapdata = os_malloc(dlen);
1093                 if (parse->eapdata == NULL) {
1094                         wpa_printf(MSG_WARNING, "EAP-TTLS: Failed to allocate "
1095                                    "memory for Phase 2 EAP data");
1096                         return -1;
1097                 }
1098                 os_memcpy(parse->eapdata, dpos, dlen);
1099                 parse->eap_len = dlen;
1100         } else {
1101                 u8 *neweap = os_realloc(parse->eapdata, parse->eap_len + dlen);
1102                 if (neweap == NULL) {
1103                         wpa_printf(MSG_WARNING, "EAP-TTLS: Failed to allocate "
1104                                    "memory for Phase 2 EAP data");
1105                         return -1;
1106                 }
1107                 os_memcpy(neweap + parse->eap_len, dpos, dlen);
1108                 parse->eapdata = neweap;
1109                 parse->eap_len += dlen;
1110         }
1111
1112         return 0;
1113 }
1114
1115
1116 static int eap_ttls_parse_attr_chbind(const u8 *dpos, size_t dlen,
1117                                    struct ttls_parse_avp *parse)
1118 {
1119         wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP - Channel Binding Message");
1120
1121         if (parse->chbind_data == NULL) {
1122                 parse->chbind_data = os_malloc(dlen);
1123                 if (parse->chbind_data == NULL) {
1124                         wpa_printf(MSG_WARNING, "EAP-TTLS: Failed to allocate "
1125                                    "memory for Phase 2 channel binding data");
1126                         return -1;
1127                 }
1128                 os_memcpy(parse->chbind_data, dpos, dlen);
1129                 parse->chbind_len = dlen;
1130         } else {
1131         /* TODO: can this really happen?  maybe just make this an error? */
1132                 u8 *newchbind = os_realloc(parse->chbind_data,
1133                                            parse->chbind_len + dlen);
1134                 if (newchbind == NULL) {
1135                         wpa_printf(MSG_WARNING, "EAP-TTLS: Failed to allocate "
1136                                    "memory for Phase 2 channel binding data");
1137                         return -1;
1138                 }
1139                 os_memcpy(newchbind + parse->chbind_len, dpos, dlen);
1140                 parse->chbind_data = newchbind;
1141                 parse->chbind_len += dlen;
1142         }
1143
1144         return 0;
1145 }
1146
1147
1148 static int eap_ttls_parse_avp(u8 *pos, size_t left,
1149                               struct ttls_parse_avp *parse)
1150 {
1151         struct ttls_avp *avp;
1152         u32 avp_code, avp_length, vendor_id = 0;
1153         u8 avp_flags, *dpos;
1154         size_t dlen;
1155
1156         avp = (struct ttls_avp *) pos;
1157         avp_code = be_to_host32(avp->avp_code);
1158         avp_length = be_to_host32(avp->avp_length);
1159         avp_flags = (avp_length >> 24) & 0xff;
1160         avp_length &= 0xffffff;
1161         wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP: code=%d flags=0x%02x "
1162                    "length=%d", (int) avp_code, avp_flags,
1163                    (int) avp_length);
1164
1165         if (avp_length > left) {
1166                 wpa_printf(MSG_WARNING, "EAP-TTLS: AVP overflow "
1167                            "(len=%d, left=%lu) - dropped",
1168                            (int) avp_length, (unsigned long) left);
1169                 return -1;
1170         }
1171
1172         if (avp_length < sizeof(*avp)) {
1173                 wpa_printf(MSG_WARNING, "EAP-TTLS: Invalid AVP length %d",
1174                            avp_length);
1175                 return -1;
1176         }
1177
1178         dpos = (u8 *) (avp + 1);
1179         dlen = avp_length - sizeof(*avp);
1180         if (avp_flags & AVP_FLAGS_VENDOR) {
1181                 if (dlen < 4) {
1182                         wpa_printf(MSG_WARNING, "EAP-TTLS: Vendor AVP "
1183                                    "underflow");
1184                         return -1;
1185                 }
1186                 vendor_id = WPA_GET_BE32(dpos);
1187                 wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP vendor_id %d",
1188                            (int) vendor_id);
1189                 dpos += 4;
1190                 dlen -= 4;
1191         }
1192
1193         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: AVP data", dpos, dlen);
1194
1195         if (vendor_id == 0 && avp_code == RADIUS_ATTR_EAP_MESSAGE) {
1196                 if (eap_ttls_parse_attr_eap(dpos, dlen, parse) < 0)
1197                         return -1;
1198         } else if (vendor_id == 0 &&
1199                    avp_code == DIAMETER_ATTR_CHBIND_MESSAGE) {
1200                 /* message containing channel binding data */
1201                 if (eap_ttls_parse_attr_chbind(dpos, dlen, parse) < 0)
1202                         return -1;
1203         } else if (vendor_id == 0 && avp_code == RADIUS_ATTR_REPLY_MESSAGE) {
1204                 /* This is an optional message that can be displayed to
1205                  * the user. */
1206                 wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: AVP - Reply-Message",
1207                                   dpos, dlen);
1208         } else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT &&
1209                    avp_code == RADIUS_ATTR_MS_CHAP2_SUCCESS) {
1210                 wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: MS-CHAP2-Success",
1211                                   dpos, dlen);
1212                 if (dlen != 43) {
1213                         wpa_printf(MSG_WARNING, "EAP-TTLS: Unexpected "
1214                                    "MS-CHAP2-Success length "
1215                                    "(len=%lu, expected 43)",
1216                                    (unsigned long) dlen);
1217                         return -1;
1218                 }
1219                 parse->mschapv2 = dpos;
1220         } else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT &&
1221                    avp_code == RADIUS_ATTR_MS_CHAP_ERROR) {
1222                 wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: MS-CHAP-Error",
1223                                   dpos, dlen);
1224                 parse->mschapv2_error = 1;
1225         } else if (avp_flags & AVP_FLAGS_MANDATORY) {
1226                 wpa_printf(MSG_WARNING, "EAP-TTLS: Unsupported mandatory AVP "
1227                            "code %d vendor_id %d - dropped",
1228                            (int) avp_code, (int) vendor_id);
1229                 return -1;
1230         } else {
1231                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Ignoring unsupported AVP "
1232                            "code %d vendor_id %d",
1233                            (int) avp_code, (int) vendor_id);
1234         }
1235
1236         return avp_length;
1237 }
1238
1239
1240 static int eap_ttls_parse_avps(struct wpabuf *in_decrypted,
1241                                struct ttls_parse_avp *parse)
1242 {
1243         u8 *pos;
1244         size_t left, pad;
1245         int avp_length;
1246
1247         pos = wpabuf_mhead(in_decrypted);
1248         left = wpabuf_len(in_decrypted);
1249         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Decrypted Phase 2 AVPs", pos, left);
1250         if (left < sizeof(struct ttls_avp)) {
1251                 wpa_printf(MSG_WARNING, "EAP-TTLS: Too short Phase 2 AVP frame"
1252                            " len=%lu expected %lu or more - dropped",
1253                            (unsigned long) left,
1254                            (unsigned long) sizeof(struct ttls_avp));
1255                 return -1;
1256         }
1257
1258         /* Parse AVPs */
1259         os_memset(parse, 0, sizeof(*parse));
1260
1261         while (left > 0) {
1262                 avp_length = eap_ttls_parse_avp(pos, left, parse);
1263                 if (avp_length < 0)
1264                         return -1;
1265
1266                 pad = (4 - (avp_length & 3)) & 3;
1267                 pos += avp_length + pad;
1268                 if (left < avp_length + pad)
1269                         left = 0;
1270                 else
1271                         left -= avp_length + pad;
1272         }
1273
1274         return 0;
1275 }
1276
1277
1278 static u8 * eap_ttls_fake_identity_request(void)
1279 {
1280         struct eap_hdr *hdr;
1281         u8 *buf;
1282
1283         wpa_printf(MSG_DEBUG, "EAP-TTLS: empty data in beginning of "
1284                    "Phase 2 - use fake EAP-Request Identity");
1285         buf = os_malloc(sizeof(*hdr) + 1);
1286         if (buf == NULL) {
1287                 wpa_printf(MSG_WARNING, "EAP-TTLS: failed to allocate "
1288                            "memory for fake EAP-Identity Request");
1289                 return NULL;
1290         }
1291
1292         hdr = (struct eap_hdr *) buf;
1293         hdr->code = EAP_CODE_REQUEST;
1294         hdr->identifier = 0;
1295         hdr->length = host_to_be16(sizeof(*hdr) + 1);
1296         buf[sizeof(*hdr)] = EAP_TYPE_IDENTITY;
1297
1298         return buf;
1299 }
1300
1301
1302 static int eap_ttls_encrypt_response(struct eap_sm *sm,
1303                                      struct eap_ttls_data *data,
1304                                      struct wpabuf *resp, u8 identifier,
1305                                      struct wpabuf **out_data)
1306 {
1307         if (resp == NULL)
1308                 return 0;
1309
1310         wpa_hexdump_buf_key(MSG_DEBUG, "EAP-TTLS: Encrypting Phase 2 data",
1311                             resp);
1312         if (eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_TTLS,
1313                                  data->ttls_version, identifier,
1314                                  resp, out_data)) {
1315                 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to encrypt a Phase 2 "
1316                            "frame");
1317                 return -1;
1318         }
1319         wpabuf_free(resp);
1320
1321         return 0;
1322 }
1323
1324 static int eap_ttls_add_chbind_request(struct eap_sm *sm,
1325                                        struct eap_ttls_data *data,
1326                                        struct wpabuf **resp)
1327 {
1328         struct wpabuf *chbind_req, *res;
1329         int length = 1, i;
1330         struct eap_peer_config *config = eap_get_config(sm);
1331
1332         if (!config->chbind_config || config->chbind_config_len <= 0)
1333                 return -1;
1334
1335         for (i=0; i<config->chbind_config_len; i++) {
1336                 length += 3 + config->chbind_config[i].req_data_len;
1337         }
1338
1339         chbind_req = wpabuf_alloc(length);
1340         if (!chbind_req)
1341                 return -1;
1342
1343         wpabuf_put_u8(chbind_req, CHBIND_CODE_REQUEST);
1344         for (i=0; i<config->chbind_config_len; i++) {
1345                 struct eap_peer_chbind_config *chbind_config =
1346                         &config->chbind_config[i];
1347                 wpabuf_put_be16(chbind_req, chbind_config->req_data_len);
1348                 wpabuf_put_u8(chbind_req, chbind_config->nsid);
1349                 wpabuf_put_data(chbind_req, chbind_config->req_data,
1350                                 chbind_config->req_data_len);
1351         }
1352         if (eap_ttls_avp_encapsulate(&chbind_req,
1353                 DIAMETER_ATTR_CHBIND_MESSAGE, 0) < 0)
1354                 return -1;
1355
1356         /* bleh. This will free *resp regardless of whether combined buffer
1357            alloc succeeds, which is not consistent with the other error
1358            condition behavior in this function */
1359         *resp = wpabuf_concat(chbind_req, *resp);
1360
1361         return (*resp) ? 0 : -1;
1362 }
1363
1364
1365 static int eap_ttls_process_chbind(struct eap_sm *sm,
1366                                    struct eap_ttls_data *data,
1367                                    struct eap_method_ret *ret,
1368                                    struct ttls_parse_avp *parse,
1369                                    struct wpabuf **resp)
1370 {
1371         size_t pos=0;
1372         u8 code;
1373         u16 len;
1374         struct chbind_hdr *hdr;
1375         struct eap_peer_config *config = eap_get_config(sm);
1376
1377         if (parse->chbind_data == NULL) {
1378                 wpa_printf(MSG_WARNING, "EAP-TTLS: No channel binding message "
1379                            "in the packet - dropped");
1380                 return -1;
1381         }
1382         if (parse->chbind_len < 1 + sizeof(*hdr)) {
1383                 wpa_printf(MSG_WARNING, "EAP-TTLS: bad channel binding response "
1384                                 "frame (len=%lu, expected %lu or more) - dropped",
1385                                 (unsigned long) parse->chbind_len,
1386                                 (unsigned long) sizeof(*hdr));
1387                 return -1;
1388         }
1389         code = parse->chbind_data[pos++];
1390         while (pos+sizeof(*hdr) < parse->chbind_len) {
1391                 hdr = (struct chbind_hdr *)(&parse->chbind_data[pos]);
1392                 pos += sizeof(*hdr);
1393                 len = be_to_host16(hdr->len);
1394                 if (pos + len <= parse->chbind_len) {
1395                         int i;
1396                         for (i=0; i<config->chbind_config_len; i++) {
1397                                 struct eap_peer_chbind_config *chbind_config =
1398                                         &config->chbind_config[i];
1399                                 if (chbind_config->nsid == hdr->nsid)
1400                                         chbind_config->response_cb(
1401                                                 chbind_config->ctx,
1402                                                 code, hdr->nsid,
1403                                                 &parse->chbind_data[pos], len);
1404                         }
1405                 }
1406                 pos += len;
1407         }
1408         if (pos != parse->chbind_len) {
1409                 wpa_printf(MSG_WARNING, "EAP-TTLS: bad channel binding response "
1410                                 "frame (parsed len=%lu, expected %lu) - dropped",
1411                                 (unsigned long) pos,
1412                                 (unsigned long) parse->chbind_len);
1413                 return -1;
1414         }
1415         return 0;
1416 }
1417
1418 static int eap_ttls_process_phase2_eap(struct eap_sm *sm,
1419                                        struct eap_ttls_data *data,
1420                                        struct eap_method_ret *ret,
1421                                        struct ttls_parse_avp *parse,
1422                                        struct wpabuf **resp)
1423 {
1424         struct eap_hdr *hdr;
1425         size_t len;
1426
1427         if (parse->eapdata == NULL) {
1428                 wpa_printf(MSG_WARNING, "EAP-TTLS: No EAP Message in the "
1429                            "packet - dropped");
1430                 return -1;
1431         }
1432
1433         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Phase 2 EAP",
1434                     parse->eapdata, parse->eap_len);
1435         hdr = (struct eap_hdr *) parse->eapdata;
1436
1437         if (parse->eap_len < sizeof(*hdr)) {
1438                 wpa_printf(MSG_WARNING, "EAP-TTLS: Too short Phase 2 EAP "
1439                            "frame (len=%lu, expected %lu or more) - dropped",
1440                            (unsigned long) parse->eap_len,
1441                            (unsigned long) sizeof(*hdr));
1442                 return -1;
1443         }
1444         len = be_to_host16(hdr->length);
1445         if (len > parse->eap_len) {
1446                 wpa_printf(MSG_INFO, "EAP-TTLS: Length mismatch in Phase 2 "
1447                            "EAP frame (EAP hdr len=%lu, EAP data len in "
1448                            "AVP=%lu)",
1449                            (unsigned long) len,
1450                            (unsigned long) parse->eap_len);
1451                 return -1;
1452         }
1453         wpa_printf(MSG_DEBUG, "EAP-TTLS: received Phase 2: code=%d "
1454                    "identifier=%d length=%lu",
1455                    hdr->code, hdr->identifier, (unsigned long) len);
1456         switch (hdr->code) {
1457         case EAP_CODE_REQUEST:
1458                 if (eap_ttls_phase2_request(sm, data, ret, hdr, resp)) {
1459                         wpa_printf(MSG_INFO, "EAP-TTLS: Phase2 Request "
1460                                    "processing failed");
1461                         return -1;
1462                 }
1463                 break;
1464         default:
1465                 wpa_printf(MSG_INFO, "EAP-TTLS: Unexpected code=%d in "
1466                            "Phase 2 EAP header", hdr->code);
1467                 return -1;
1468         }
1469
1470         return 0;
1471 }
1472
1473
1474 static int eap_ttls_process_phase2_mschapv2(struct eap_sm *sm,
1475                                             struct eap_ttls_data *data,
1476                                             struct eap_method_ret *ret,
1477                                             struct ttls_parse_avp *parse)
1478 {
1479         if (parse->mschapv2_error) {
1480                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Received "
1481                            "MS-CHAP-Error - failed");
1482                 ret->methodState = METHOD_DONE;
1483                 ret->decision = DECISION_FAIL;
1484                 /* Reply with empty data to ACK error */
1485                 return 1;
1486         }
1487
1488         if (parse->mschapv2 == NULL) {
1489 #ifdef EAP_TNC
1490                 if (data->phase2_success && parse->eapdata) {
1491                         /*
1492                          * Allow EAP-TNC to be started after successfully
1493                          * completed MSCHAPV2.
1494                          */
1495                         return 1;
1496                 }
1497 #endif /* EAP_TNC */
1498                 wpa_printf(MSG_WARNING, "EAP-TTLS: no MS-CHAP2-Success AVP "
1499                            "received for Phase2 MSCHAPV2");
1500                 return -1;
1501         }
1502         if (parse->mschapv2[0] != data->ident) {
1503                 wpa_printf(MSG_WARNING, "EAP-TTLS: Ident mismatch for Phase 2 "
1504                            "MSCHAPV2 (received Ident 0x%02x, expected 0x%02x)",
1505                            parse->mschapv2[0], data->ident);
1506                 return -1;
1507         }
1508         if (!data->auth_response_valid ||
1509             mschapv2_verify_auth_response(data->auth_response,
1510                                           parse->mschapv2 + 1, 42)) {
1511                 wpa_printf(MSG_WARNING, "EAP-TTLS: Invalid authenticator "
1512                            "response in Phase 2 MSCHAPV2 success request");
1513                 return -1;
1514         }
1515
1516         wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 MSCHAPV2 "
1517                    "authentication succeeded");
1518         if (data->ttls_version > 0) {
1519                 /*
1520                  * EAP-TTLSv1 uses TLS/IA FinalPhaseFinished to report
1521                  * success, so do not allow connection to be terminated
1522                  * yet.
1523                  */
1524                 ret->methodState = METHOD_CONT;
1525                 ret->decision = DECISION_COND_SUCC;
1526         } else {
1527                 ret->methodState = METHOD_DONE;
1528                 ret->decision = DECISION_UNCOND_SUCC;
1529                 data->phase2_success = 1;
1530         }
1531
1532         /*
1533          * Reply with empty data; authentication server will reply
1534          * with EAP-Success after this.
1535          */
1536         return 1;
1537 }
1538
1539
1540 #ifdef EAP_TNC
1541 static int eap_ttls_process_tnc_start(struct eap_sm *sm,
1542                                       struct eap_ttls_data *data,
1543                                       struct eap_method_ret *ret,
1544                                       struct ttls_parse_avp *parse,
1545                                       struct wpabuf **resp)
1546 {
1547         /* TNC uses inner EAP method after non-EAP TTLS phase 2. */
1548         if (parse->eapdata == NULL) {
1549                 wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received "
1550                            "unexpected tunneled data (no EAP)");
1551                 return -1;
1552         }
1553
1554         if (!data->ready_for_tnc) {
1555                 wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received "
1556                            "EAP after non-EAP, but not ready for TNC");
1557                 return -1;
1558         }
1559
1560         wpa_printf(MSG_DEBUG, "EAP-TTLS: Start TNC after completed "
1561                    "non-EAP method");
1562         data->tnc_started = 1;
1563
1564         if (eap_ttls_process_phase2_eap(sm, data, ret, parse, resp) < 0)
1565                 return -1;
1566
1567         return 0;
1568 }
1569 #endif /* EAP_TNC */
1570
1571
1572 static int eap_ttls_process_decrypted(struct eap_sm *sm,
1573                                       struct eap_ttls_data *data,
1574                                       struct eap_method_ret *ret,
1575                                       u8 identifier,
1576                                       struct ttls_parse_avp *parse,
1577                                       struct wpabuf *in_decrypted,
1578                                       struct wpabuf **out_data)
1579 {
1580         struct wpabuf *resp = NULL;
1581         struct eap_peer_config *config = eap_get_config(sm);
1582         int res;
1583         enum phase2_types phase2_type = data->phase2_type;
1584
1585 #ifdef EAP_TNC
1586         if (data->tnc_started)
1587                 phase2_type = EAP_TTLS_PHASE2_EAP;
1588 #endif /* EAP_TNC */
1589
1590         switch (phase2_type) {
1591         case EAP_TTLS_PHASE2_EAP:
1592                 if (eap_ttls_process_phase2_eap(sm, data, ret, parse, &resp) <
1593                     0)
1594                         return -1;
1595                 break;
1596         case EAP_TTLS_PHASE2_MSCHAPV2:
1597                 res = eap_ttls_process_phase2_mschapv2(sm, data, ret, parse);
1598 #ifdef EAP_TNC
1599                 if (res == 1 && parse->eapdata && data->phase2_success) {
1600                         /*
1601                          * TNC may be required as the next
1602                          * authentication method within the tunnel.
1603                          */
1604                         ret->methodState = METHOD_MAY_CONT;
1605                         data->ready_for_tnc = 1;
1606                         if (eap_ttls_process_tnc_start(sm, data, ret, parse,
1607                                                        &resp) == 0)
1608                                 break;
1609                 }
1610 #endif /* EAP_TNC */
1611                 return res;
1612         case EAP_TTLS_PHASE2_MSCHAP:
1613         case EAP_TTLS_PHASE2_PAP:
1614         case EAP_TTLS_PHASE2_CHAP:
1615 #ifdef EAP_TNC
1616                 if (eap_ttls_process_tnc_start(sm, data, ret, parse, &resp) <
1617                     0)
1618                         return -1;
1619                 break;
1620 #else /* EAP_TNC */
1621                 /* EAP-TTLS/{MSCHAP,PAP,CHAP} should not send any TLS tunneled
1622                  * requests to the supplicant */
1623                 wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received unexpected "
1624                            "tunneled data");
1625                 return -1;
1626 #endif /* EAP_TNC */
1627         }
1628
1629         if (!resp && (config->pending_req_identity ||
1630                         config->pending_req_password ||
1631                         config->pending_req_otp ||
1632                         config->pending_req_new_password)) {
1633                 wpabuf_free(data->pending_phase2_req);
1634                 data->pending_phase2_req = wpabuf_dup(in_decrypted);
1635                 return 0;
1636         }
1637
1638         /* handle channel binding response here */
1639         if (parse->chbind_data) {
1640                 /* received channel binding repsonse */
1641                 if (eap_ttls_process_chbind(sm, data, ret, parse, &resp) < 0)
1642                         return -1;
1643         }
1644         /* issue channel binding request when appropriate */
1645         if (config->chbind_config && config->chbind_config_len > 0 &&
1646                 !data->chbind_req_sent) {
1647                 if (eap_ttls_add_chbind_request(sm, data, &resp) < 0)
1648                         return -1;
1649                 data->chbind_req_sent = 1;
1650         }
1651
1652         if (resp) {
1653                 if (eap_ttls_encrypt_response(sm, data, resp, identifier,
1654                                               out_data) < 0)
1655                         return -1;
1656         }
1657
1658         return 0;
1659 }
1660
1661
1662 #if EAP_TTLS_VERSION > 0
1663 static void eap_ttls_final_phase_finished(struct eap_sm *sm,
1664                                           struct eap_ttls_data *data,
1665                                           struct eap_method_ret *ret,
1666                                           u8 identifier,
1667                                           struct wpabuf **out_data)
1668 {
1669         wpa_printf(MSG_DEBUG, "EAP-TTLS: FinalPhaseFinished received");
1670         wpa_printf(MSG_INFO, "EAP-TTLS: TLS/IA authentication succeeded");
1671         ret->methodState = METHOD_DONE;
1672         ret->decision = DECISION_UNCOND_SUCC;
1673         data->phase2_success = 1;
1674         *out_data = eap_ttls_build_phase_finished(sm, data, identifier, 1);
1675         eap_ttls_v1_derive_key(sm, data);
1676 }
1677 #endif /* EAP_TTLS_VERSION */
1678
1679
1680 static int eap_ttls_implicit_identity_request(struct eap_sm *sm,
1681                                               struct eap_ttls_data *data,
1682                                               struct eap_method_ret *ret,
1683                                               u8 identifier,
1684                                               struct wpabuf **out_data)
1685 {
1686         int retval = 0;
1687         struct eap_hdr *hdr;
1688         struct wpabuf *resp;
1689
1690         hdr = (struct eap_hdr *) eap_ttls_fake_identity_request();
1691         if (hdr == NULL) {
1692                 ret->methodState = METHOD_DONE;
1693                 ret->decision = DECISION_FAIL;
1694                 return -1;
1695         }
1696
1697         resp = NULL;
1698         if (eap_ttls_phase2_request(sm, data, ret, hdr, &resp)) {
1699                 wpa_printf(MSG_INFO, "EAP-TTLS: Phase2 Request "
1700                            "processing failed");
1701                 retval = -1;
1702         } else {
1703                 retval = eap_ttls_encrypt_response(sm, data, resp, identifier,
1704                                                    out_data);
1705         }
1706
1707         os_free(hdr);
1708
1709         if (retval < 0) {
1710                 ret->methodState = METHOD_DONE;
1711                 ret->decision = DECISION_FAIL;
1712         }
1713
1714         return retval;
1715 }
1716
1717
1718 static int eap_ttls_phase2_start(struct eap_sm *sm, struct eap_ttls_data *data,
1719                                  struct eap_method_ret *ret, u8 identifier,
1720                                  struct wpabuf **out_data)
1721 {
1722         data->phase2_start = 0;
1723
1724         /*
1725          * EAP-TTLS does not use Phase2 on fast re-auth; this must be done only
1726          * if TLS part was indeed resuming a previous session. Most
1727          * Authentication Servers terminate EAP-TTLS before reaching this
1728          * point, but some do not. Make wpa_supplicant stop phase 2 here, if
1729          * needed.
1730          */
1731         if (data->reauth &&
1732             tls_connection_resumed(sm->ssl_ctx, data->ssl.conn)) {
1733                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Session resumption - "
1734                            "skip phase 2");
1735                 *out_data = eap_peer_tls_build_ack(identifier, EAP_TYPE_TTLS,
1736                                                    data->ttls_version);
1737                 ret->methodState = METHOD_DONE;
1738                 ret->decision = DECISION_UNCOND_SUCC;
1739                 data->phase2_success = 1;
1740                 return 0;
1741         }
1742
1743         return eap_ttls_implicit_identity_request(sm, data, ret, identifier,
1744                                                   out_data);
1745 }
1746
1747
1748 static int eap_ttls_decrypt(struct eap_sm *sm, struct eap_ttls_data *data,
1749                             struct eap_method_ret *ret, u8 identifier,
1750                             const struct wpabuf *in_data,
1751                             struct wpabuf **out_data)
1752 {
1753         struct wpabuf *in_decrypted = NULL;
1754         int retval = 0;
1755         struct ttls_parse_avp parse;
1756
1757         os_memset(&parse, 0, sizeof(parse));
1758
1759         wpa_printf(MSG_DEBUG, "EAP-TTLS: received %lu bytes encrypted data for"
1760                    " Phase 2",
1761                    in_data ? (unsigned long) wpabuf_len(in_data) : 0);
1762
1763         if (data->pending_phase2_req) {
1764                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Pending Phase 2 request - "
1765                            "skip decryption and use old data");
1766                 /* Clear TLS reassembly state. */
1767                 eap_peer_tls_reset_input(&data->ssl);
1768
1769                 in_decrypted = data->pending_phase2_req;
1770                 data->pending_phase2_req = NULL;
1771                 if (wpabuf_len(in_decrypted) == 0) {
1772                         wpabuf_free(in_decrypted);
1773                         return eap_ttls_implicit_identity_request(
1774                                 sm, data, ret, identifier, out_data);
1775                 }
1776                 goto continue_req;
1777         }
1778
1779         if ((in_data == NULL || wpabuf_len(in_data) == 0) &&
1780             data->phase2_start) {
1781                 return eap_ttls_phase2_start(sm, data, ret, identifier,
1782                                              out_data);
1783         }
1784
1785         if (in_data == NULL || wpabuf_len(in_data) == 0) {
1786                 /* Received TLS ACK - requesting more fragments */
1787                 return eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_TTLS,
1788                                             data->ttls_version,
1789                                             identifier, NULL, out_data);
1790         }
1791
1792         retval = eap_peer_tls_decrypt(sm, &data->ssl, in_data, &in_decrypted);
1793         if (retval)
1794                 goto done;
1795
1796 #if EAP_TTLS_VERSION > 0
1797         if (data->ttls_version > 0 &&
1798             (in_decrypted == NULL || wpabuf_len(in_decrypted) == 0) &&
1799             tls_connection_ia_final_phase_finished(sm->ssl_ctx,
1800                                                    data->ssl.conn)) {
1801                 eap_ttls_final_phase_finished(sm, data, ret, identifier,
1802                                               out_data);
1803                 goto done;
1804         }
1805 #endif /* EAP_TTLS_VERSION */
1806
1807 continue_req:
1808         data->phase2_start = 0;
1809
1810         if (eap_ttls_parse_avps(in_decrypted, &parse) < 0) {
1811                 retval = -1;
1812                 goto done;
1813         }
1814
1815         retval = eap_ttls_process_decrypted(sm, data, ret, identifier,
1816                                             &parse, in_decrypted, out_data);
1817
1818 done:
1819         wpabuf_free(in_decrypted);
1820         os_free(parse.eapdata);
1821
1822         if (retval < 0) {
1823                 ret->methodState = METHOD_DONE;
1824                 ret->decision = DECISION_FAIL;
1825         }
1826
1827         return retval;
1828 }
1829
1830
1831 static int eap_ttls_process_start(struct eap_sm *sm,
1832                                   struct eap_ttls_data *data, u8 flags,
1833                                   struct eap_method_ret *ret)
1834 {
1835         struct eap_peer_config *config = eap_get_config(sm);
1836
1837         wpa_printf(MSG_DEBUG, "EAP-TTLS: Start (server ver=%d, own ver=%d)",
1838                    flags & EAP_TLS_VERSION_MASK, data->ttls_version);
1839 #if EAP_TTLS_VERSION > 0
1840         if ((flags & EAP_TLS_VERSION_MASK) < data->ttls_version)
1841                 data->ttls_version = flags & EAP_TLS_VERSION_MASK;
1842         if (data->force_ttls_version >= 0 &&
1843             data->force_ttls_version != data->ttls_version) {
1844                 wpa_printf(MSG_WARNING, "EAP-TTLS: Failed to select "
1845                            "forced TTLS version %d",
1846                            data->force_ttls_version);
1847                 ret->methodState = METHOD_DONE;
1848                 ret->decision = DECISION_FAIL;
1849                 ret->allowNotifications = FALSE;
1850                 return -1;
1851         }
1852         wpa_printf(MSG_DEBUG, "EAP-TTLS: Using TTLS version %d",
1853                    data->ttls_version);
1854
1855         if (data->ttls_version > 0)
1856                 data->ssl.tls_ia = 1;
1857 #endif /* EAP_TTLS_VERSION */
1858         if (!data->ssl_initialized &&
1859             eap_peer_tls_ssl_init(sm, &data->ssl, config)) {
1860                 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to initialize SSL.");
1861                 return -1;
1862         }
1863         data->ssl_initialized = 1;
1864
1865         wpa_printf(MSG_DEBUG, "EAP-TTLS: Start");
1866
1867         return 0;
1868 }
1869
1870
1871 static int eap_ttls_process_handshake(struct eap_sm *sm,
1872                                       struct eap_ttls_data *data,
1873                                       struct eap_method_ret *ret,
1874                                       u8 identifier,
1875                                       const u8 *in_data, size_t in_len,
1876                                       struct wpabuf **out_data)
1877 {
1878         int res;
1879
1880         res = eap_peer_tls_process_helper(sm, &data->ssl, EAP_TYPE_TTLS,
1881                                           data->ttls_version, identifier,
1882                                           in_data, in_len, out_data);
1883
1884         if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) {
1885                 wpa_printf(MSG_DEBUG, "EAP-TTLS: TLS done, proceed to "
1886                            "Phase 2");
1887                 if (data->resuming) {
1888                         wpa_printf(MSG_DEBUG, "EAP-TTLS: fast reauth - may "
1889                                    "skip Phase 2");
1890                         ret->decision = DECISION_COND_SUCC;
1891                         ret->methodState = METHOD_MAY_CONT;
1892                 }
1893                 data->phase2_start = 1;
1894                 if (data->ttls_version == 0)
1895                         eap_ttls_v0_derive_key(sm, data);
1896
1897                 if (*out_data == NULL || wpabuf_len(*out_data) == 0) {
1898                         if (eap_ttls_decrypt(sm, data, ret, identifier,
1899                                              NULL, out_data)) {
1900                                 wpa_printf(MSG_WARNING, "EAP-TTLS: "
1901                                            "failed to process early "
1902                                            "start for Phase 2");
1903                         }
1904                         res = 0;
1905                 }
1906                 data->resuming = 0;
1907         }
1908
1909         if (res == 2) {
1910                 struct wpabuf msg;
1911                 /*
1912                  * Application data included in the handshake message.
1913                  */
1914                 wpabuf_free(data->pending_phase2_req);
1915                 data->pending_phase2_req = *out_data;
1916                 *out_data = NULL;
1917                 wpabuf_set(&msg, in_data, in_len);
1918                 res = eap_ttls_decrypt(sm, data, ret, identifier, &msg,
1919                                        out_data);
1920         }
1921
1922         return res;
1923 }
1924
1925
1926 static void eap_ttls_check_auth_status(struct eap_sm *sm,
1927                                        struct eap_ttls_data *data,
1928                                        struct eap_method_ret *ret)
1929 {
1930         if (data->ttls_version == 0 && ret->methodState == METHOD_DONE) {
1931                 ret->allowNotifications = FALSE;
1932                 if (ret->decision == DECISION_UNCOND_SUCC ||
1933                     ret->decision == DECISION_COND_SUCC) {
1934                         wpa_printf(MSG_DEBUG, "EAP-TTLS: Authentication "
1935                                    "completed successfully");
1936                         data->phase2_success = 1;
1937 #ifdef EAP_TNC
1938                         if (!data->ready_for_tnc && !data->tnc_started) {
1939                                 /*
1940                                  * TNC may be required as the next
1941                                  * authentication method within the tunnel.
1942                                  */
1943                                 ret->methodState = METHOD_MAY_CONT;
1944                                 data->ready_for_tnc = 1;
1945                         }
1946 #endif /* EAP_TNC */
1947                 }
1948         } else if (data->ttls_version == 0 &&
1949                    ret->methodState == METHOD_MAY_CONT &&
1950                    (ret->decision == DECISION_UNCOND_SUCC ||
1951                     ret->decision == DECISION_COND_SUCC)) {
1952                         wpa_printf(MSG_DEBUG, "EAP-TTLS: Authentication "
1953                                    "completed successfully (MAY_CONT)");
1954                         data->phase2_success = 1;
1955         }
1956 }
1957
1958
1959 static struct wpabuf * eap_ttls_process(struct eap_sm *sm, void *priv,
1960                                         struct eap_method_ret *ret,
1961                                         const struct wpabuf *reqData)
1962 {
1963         size_t left;
1964         int res;
1965         u8 flags, id;
1966         struct wpabuf *resp;
1967         const u8 *pos;
1968         struct eap_ttls_data *data = priv;
1969
1970         pos = eap_peer_tls_process_init(sm, &data->ssl, EAP_TYPE_TTLS, ret,
1971                                         reqData, &left, &flags);
1972         if (pos == NULL)
1973                 return NULL;
1974         id = eap_get_id(reqData);
1975
1976         if (flags & EAP_TLS_FLAGS_START) {
1977                 if (eap_ttls_process_start(sm, data, flags, ret) < 0)
1978                         return NULL;
1979
1980                 /* RFC 5281, Ch. 9.2:
1981                  * "This packet MAY contain additional information in the form
1982                  * of AVPs, which may provide useful hints to the client"
1983                  * For now, ignore any potential extra data.
1984                  */
1985                 left = 0;
1986         } else if (!data->ssl_initialized) {
1987                 wpa_printf(MSG_DEBUG, "EAP-TTLS: First message did not "
1988                            "include Start flag");
1989                 ret->methodState = METHOD_DONE;
1990                 ret->decision = DECISION_FAIL;
1991                 ret->allowNotifications = FALSE;
1992                 return NULL;
1993         }
1994
1995         resp = NULL;
1996         if (tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&
1997             !data->resuming) {
1998                 struct wpabuf msg;
1999                 wpabuf_set(&msg, pos, left);
2000                 res = eap_ttls_decrypt(sm, data, ret, id, &msg, &resp);
2001         } else {
2002                 res = eap_ttls_process_handshake(sm, data, ret, id,
2003                                                  pos, left, &resp);
2004         }
2005
2006         eap_ttls_check_auth_status(sm, data, ret);
2007
2008         /* FIX: what about res == -1? Could just move all error processing into
2009          * the other functions and get rid of this res==1 case here. */
2010         if (res == 1) {
2011                 wpabuf_free(resp);
2012                 return eap_peer_tls_build_ack(id, EAP_TYPE_TTLS,
2013                                               data->ttls_version);
2014         }
2015         return resp;
2016 }
2017
2018
2019 static Boolean eap_ttls_has_reauth_data(struct eap_sm *sm, void *priv)
2020 {
2021         struct eap_ttls_data *data = priv;
2022         return tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&
2023                 data->phase2_success;
2024 }
2025
2026
2027 static void eap_ttls_deinit_for_reauth(struct eap_sm *sm, void *priv)
2028 {
2029         struct eap_ttls_data *data = priv;
2030         wpabuf_free(data->pending_phase2_req);
2031         data->pending_phase2_req = NULL;
2032 #ifdef EAP_TNC
2033         data->ready_for_tnc = 0;
2034         data->tnc_started = 0;
2035 #endif /* EAP_TNC */
2036 }
2037
2038
2039 static void * eap_ttls_init_for_reauth(struct eap_sm *sm, void *priv)
2040 {
2041         struct eap_ttls_data *data = priv;
2042         os_free(data->key_data);
2043         data->key_data = NULL;
2044         if (eap_peer_tls_reauth_init(sm, &data->ssl)) {
2045                 os_free(data);
2046                 return NULL;
2047         }
2048         if (data->phase2_priv && data->phase2_method &&
2049             data->phase2_method->init_for_reauth)
2050                 data->phase2_method->init_for_reauth(sm, data->phase2_priv);
2051         data->phase2_start = 0;
2052         data->phase2_success = 0;
2053         data->resuming = 1;
2054         data->reauth = 1;
2055         return priv;
2056 }
2057
2058
2059 static int eap_ttls_get_status(struct eap_sm *sm, void *priv, char *buf,
2060                                size_t buflen, int verbose)
2061 {
2062         struct eap_ttls_data *data = priv;
2063         int len, ret;
2064
2065         len = eap_peer_tls_status(sm, &data->ssl, buf, buflen, verbose);
2066         ret = os_snprintf(buf + len, buflen - len,
2067                           "EAP-TTLSv%d Phase2 method=",
2068                           data->ttls_version);
2069         if (ret < 0 || (size_t) ret >= buflen - len)
2070                 return len;
2071         len += ret;
2072         switch (data->phase2_type) {
2073         case EAP_TTLS_PHASE2_EAP:
2074                 ret = os_snprintf(buf + len, buflen - len, "EAP-%s\n",
2075                                   data->phase2_method ?
2076                                   data->phase2_method->name : "?");
2077                 break;
2078         case EAP_TTLS_PHASE2_MSCHAPV2:
2079                 ret = os_snprintf(buf + len, buflen - len, "MSCHAPV2\n");
2080                 break;
2081         case EAP_TTLS_PHASE2_MSCHAP:
2082                 ret = os_snprintf(buf + len, buflen - len, "MSCHAP\n");
2083                 break;
2084         case EAP_TTLS_PHASE2_PAP:
2085                 ret = os_snprintf(buf + len, buflen - len, "PAP\n");
2086                 break;
2087         case EAP_TTLS_PHASE2_CHAP:
2088                 ret = os_snprintf(buf + len, buflen - len, "CHAP\n");
2089                 break;
2090         default:
2091                 ret = 0;
2092                 break;
2093         }
2094         if (ret < 0 || (size_t) ret >= buflen - len)
2095                 return len;
2096         len += ret;
2097
2098         return len;
2099 }
2100
2101
2102 static Boolean eap_ttls_isKeyAvailable(struct eap_sm *sm, void *priv)
2103 {
2104         struct eap_ttls_data *data = priv;
2105         return data->key_data != NULL && data->phase2_success;
2106 }
2107
2108
2109 static u8 * eap_ttls_getKey(struct eap_sm *sm, void *priv, size_t *len)
2110 {
2111         struct eap_ttls_data *data = priv;
2112         u8 *key;
2113
2114         if (data->key_data == NULL || !data->phase2_success)
2115                 return NULL;
2116
2117         key = os_malloc(EAP_TLS_KEY_LEN);
2118         if (key == NULL)
2119                 return NULL;
2120
2121         *len = EAP_TLS_KEY_LEN;
2122         os_memcpy(key, data->key_data, EAP_TLS_KEY_LEN);
2123
2124         return key;
2125 }
2126
2127
2128 int eap_peer_ttls_register(void)
2129 {
2130         struct eap_method *eap;
2131         int ret;
2132
2133         eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
2134                                     EAP_VENDOR_IETF, EAP_TYPE_TTLS, "TTLS");
2135         if (eap == NULL)
2136                 return -1;
2137
2138         eap->init = eap_ttls_init;
2139         eap->deinit = eap_ttls_deinit;
2140         eap->process = eap_ttls_process;
2141         eap->isKeyAvailable = eap_ttls_isKeyAvailable;
2142         eap->getKey = eap_ttls_getKey;
2143         eap->get_status = eap_ttls_get_status;
2144         eap->has_reauth_data = eap_ttls_has_reauth_data;
2145         eap->deinit_for_reauth = eap_ttls_deinit_for_reauth;
2146         eap->init_for_reauth = eap_ttls_init_for_reauth;
2147
2148         ret = eap_peer_method_register(eap);
2149         if (ret)
2150                 eap_peer_method_free(eap);
2151         return ret;
2152 }