2 * EAP peer method: LEAP
3 * Copyright (c) 2004-2007, Jouni Malinen <j@w1.fi>
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
12 #include "crypto/ms_funcs.h"
13 #include "crypto/crypto.h"
14 #include "crypto/random.h"
17 #define LEAP_VERSION 1
18 #define LEAP_CHALLENGE_LEN 8
19 #define LEAP_RESPONSE_LEN 24
20 #define LEAP_KEY_LEN 16
23 struct eap_leap_data {
31 u8 peer_challenge[LEAP_CHALLENGE_LEN];
32 u8 peer_response[LEAP_RESPONSE_LEN];
34 u8 ap_challenge[LEAP_CHALLENGE_LEN];
35 u8 ap_response[LEAP_RESPONSE_LEN];
39 static void * eap_leap_init(struct eap_sm *sm)
41 struct eap_leap_data *data;
43 data = os_zalloc(sizeof(*data));
46 data->state = LEAP_WAIT_CHALLENGE;
48 sm->leap_done = FALSE;
53 static void eap_leap_deinit(struct eap_sm *sm, void *priv)
59 static struct wpabuf * eap_leap_process_request(struct eap_sm *sm, void *priv,
60 struct eap_method_ret *ret,
61 const struct wpabuf *reqData)
63 struct eap_leap_data *data = priv;
65 const u8 *pos, *challenge, *identity, *password;
66 u8 challenge_len, *rpos;
67 size_t identity_len, password_len, len;
70 wpa_printf(MSG_DEBUG, "EAP-LEAP: Processing EAP-Request");
72 identity = eap_get_config_identity(sm, &identity_len);
73 password = eap_get_config_password2(sm, &password_len, &pwhash);
74 if (identity == NULL || password == NULL)
77 pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_LEAP, reqData, &len);
78 if (pos == NULL || len < 3) {
79 wpa_printf(MSG_INFO, "EAP-LEAP: Invalid EAP-Request frame");
84 if (*pos != LEAP_VERSION) {
85 wpa_printf(MSG_WARNING, "EAP-LEAP: Unsupported LEAP version "
92 pos++; /* skip unused byte */
94 challenge_len = *pos++;
95 if (challenge_len != LEAP_CHALLENGE_LEN || challenge_len > len - 3) {
96 wpa_printf(MSG_INFO, "EAP-LEAP: Invalid challenge "
97 "(challenge_len=%d reqDataLen=%lu)",
98 challenge_len, (unsigned long) wpabuf_len(reqData));
103 os_memcpy(data->peer_challenge, challenge, LEAP_CHALLENGE_LEN);
104 wpa_hexdump(MSG_MSGDUMP, "EAP-LEAP: Challenge from AP",
105 challenge, LEAP_CHALLENGE_LEN);
107 wpa_printf(MSG_DEBUG, "EAP-LEAP: Generating Challenge Response");
109 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_LEAP,
110 3 + LEAP_RESPONSE_LEN + identity_len,
111 EAP_CODE_RESPONSE, eap_get_id(reqData));
114 wpabuf_put_u8(resp, LEAP_VERSION);
115 wpabuf_put_u8(resp, 0); /* unused */
116 wpabuf_put_u8(resp, LEAP_RESPONSE_LEN);
117 rpos = wpabuf_put(resp, LEAP_RESPONSE_LEN);
119 challenge_response(challenge, password, rpos);
121 nt_challenge_response(challenge, password, password_len, rpos);
122 os_memcpy(data->peer_response, rpos, LEAP_RESPONSE_LEN);
123 wpa_hexdump(MSG_MSGDUMP, "EAP-LEAP: Response",
124 rpos, LEAP_RESPONSE_LEN);
125 wpabuf_put_data(resp, identity, identity_len);
127 data->state = LEAP_WAIT_SUCCESS;
133 static struct wpabuf * eap_leap_process_success(struct eap_sm *sm, void *priv,
134 struct eap_method_ret *ret,
135 const struct wpabuf *reqData)
137 struct eap_leap_data *data = priv;
143 wpa_printf(MSG_DEBUG, "EAP-LEAP: Processing EAP-Success");
145 identity = eap_get_config_identity(sm, &identity_len);
146 if (identity == NULL)
149 if (data->state != LEAP_WAIT_SUCCESS) {
150 wpa_printf(MSG_INFO, "EAP-LEAP: EAP-Success received in "
151 "unexpected state (%d) - ignored", data->state);
156 resp = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_LEAP,
157 3 + LEAP_CHALLENGE_LEN + identity_len,
158 EAP_CODE_REQUEST, eap_get_id(reqData));
161 wpabuf_put_u8(resp, LEAP_VERSION);
162 wpabuf_put_u8(resp, 0); /* unused */
163 wpabuf_put_u8(resp, LEAP_CHALLENGE_LEN);
164 pos = wpabuf_put(resp, LEAP_CHALLENGE_LEN);
165 if (random_get_bytes(pos, LEAP_CHALLENGE_LEN)) {
166 wpa_printf(MSG_WARNING, "EAP-LEAP: Failed to read random data "
172 os_memcpy(data->ap_challenge, pos, LEAP_CHALLENGE_LEN);
173 wpa_hexdump(MSG_MSGDUMP, "EAP-LEAP: Challenge to AP/AS", pos,
175 wpabuf_put_data(resp, identity, identity_len);
177 data->state = LEAP_WAIT_RESPONSE;
183 static struct wpabuf * eap_leap_process_response(struct eap_sm *sm, void *priv,
184 struct eap_method_ret *ret,
185 const struct wpabuf *reqData)
187 struct eap_leap_data *data = priv;
188 const u8 *pos, *password;
189 u8 response_len, pw_hash[16], pw_hash_hash[16],
190 expected[LEAP_RESPONSE_LEN];
191 size_t password_len, len;
194 wpa_printf(MSG_DEBUG, "EAP-LEAP: Processing EAP-Response");
196 password = eap_get_config_password2(sm, &password_len, &pwhash);
197 if (password == NULL)
200 pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_LEAP, reqData, &len);
201 if (pos == NULL || len < 3) {
202 wpa_printf(MSG_INFO, "EAP-LEAP: Invalid EAP-Response frame");
207 if (*pos != LEAP_VERSION) {
208 wpa_printf(MSG_WARNING, "EAP-LEAP: Unsupported LEAP version "
215 pos++; /* skip unused byte */
217 response_len = *pos++;
218 if (response_len != LEAP_RESPONSE_LEN || response_len > len - 3) {
219 wpa_printf(MSG_INFO, "EAP-LEAP: Invalid response "
220 "(response_len=%d reqDataLen=%lu)",
221 response_len, (unsigned long) wpabuf_len(reqData));
226 wpa_hexdump(MSG_DEBUG, "EAP-LEAP: Response from AP",
227 pos, LEAP_RESPONSE_LEN);
228 os_memcpy(data->ap_response, pos, LEAP_RESPONSE_LEN);
231 if (hash_nt_password_hash(password, pw_hash_hash)) {
236 if (nt_password_hash(password, password_len, pw_hash) ||
237 hash_nt_password_hash(pw_hash, pw_hash_hash)) {
242 challenge_response(data->ap_challenge, pw_hash_hash, expected);
244 ret->methodState = METHOD_DONE;
245 ret->allowNotifications = FALSE;
247 if (os_memcmp_const(pos, expected, LEAP_RESPONSE_LEN) != 0) {
248 wpa_printf(MSG_WARNING, "EAP-LEAP: AP sent an invalid "
249 "response - authentication failed");
250 wpa_hexdump(MSG_DEBUG, "EAP-LEAP: Expected response from AP",
251 expected, LEAP_RESPONSE_LEN);
252 ret->decision = DECISION_FAIL;
256 ret->decision = DECISION_UNCOND_SUCC;
258 /* LEAP is somewhat odd method since it sends EAP-Success in the middle
259 * of the authentication. Use special variable to transit EAP state
260 * machine to SUCCESS state. */
261 sm->leap_done = TRUE;
262 data->state = LEAP_DONE;
264 /* No more authentication messages expected; AP will send EAPOL-Key
265 * frames if encryption is enabled. */
270 static struct wpabuf * eap_leap_process(struct eap_sm *sm, void *priv,
271 struct eap_method_ret *ret,
272 const struct wpabuf *reqData)
274 const struct eap_hdr *eap;
278 password = eap_get_config_password(sm, &password_len);
279 if (password == NULL) {
280 wpa_printf(MSG_INFO, "EAP-LEAP: Password not configured");
281 eap_sm_request_password(sm);
287 * LEAP needs to be able to handle EAP-Success frame which does not
288 * include Type field. Consequently, eap_hdr_validate() cannot be used
289 * here. This validation will be done separately for EAP-Request and
290 * EAP-Response frames.
292 eap = wpabuf_head(reqData);
293 if (wpabuf_len(reqData) < sizeof(*eap) ||
294 be_to_host16(eap->length) > wpabuf_len(reqData)) {
295 wpa_printf(MSG_INFO, "EAP-LEAP: Invalid frame");
301 ret->allowNotifications = TRUE;
302 ret->methodState = METHOD_MAY_CONT;
303 ret->decision = DECISION_FAIL;
305 sm->leap_done = FALSE;
308 case EAP_CODE_REQUEST:
309 return eap_leap_process_request(sm, priv, ret, reqData);
310 case EAP_CODE_SUCCESS:
311 return eap_leap_process_success(sm, priv, ret, reqData);
312 case EAP_CODE_RESPONSE:
313 return eap_leap_process_response(sm, priv, ret, reqData);
315 wpa_printf(MSG_INFO, "EAP-LEAP: Unexpected EAP code (%d) - "
316 "ignored", eap->code);
323 static Boolean eap_leap_isKeyAvailable(struct eap_sm *sm, void *priv)
325 struct eap_leap_data *data = priv;
326 return data->state == LEAP_DONE;
330 static u8 * eap_leap_getKey(struct eap_sm *sm, void *priv, size_t *len)
332 struct eap_leap_data *data = priv;
333 u8 *key, pw_hash_hash[16], pw_hash[16];
334 const u8 *addr[5], *password;
335 size_t elen[5], password_len;
338 if (data->state != LEAP_DONE)
341 password = eap_get_config_password2(sm, &password_len, &pwhash);
342 if (password == NULL)
345 key = os_malloc(LEAP_KEY_LEN);
350 if (hash_nt_password_hash(password, pw_hash_hash)) {
355 if (nt_password_hash(password, password_len, pw_hash) ||
356 hash_nt_password_hash(pw_hash, pw_hash_hash)) {
361 wpa_hexdump_key(MSG_DEBUG, "EAP-LEAP: pw_hash_hash",
363 wpa_hexdump(MSG_DEBUG, "EAP-LEAP: peer_challenge",
364 data->peer_challenge, LEAP_CHALLENGE_LEN);
365 wpa_hexdump(MSG_DEBUG, "EAP-LEAP: peer_response",
366 data->peer_response, LEAP_RESPONSE_LEN);
367 wpa_hexdump(MSG_DEBUG, "EAP-LEAP: ap_challenge",
368 data->ap_challenge, LEAP_CHALLENGE_LEN);
369 wpa_hexdump(MSG_DEBUG, "EAP-LEAP: ap_response",
370 data->ap_response, LEAP_RESPONSE_LEN);
372 addr[0] = pw_hash_hash;
374 addr[1] = data->ap_challenge;
375 elen[1] = LEAP_CHALLENGE_LEN;
376 addr[2] = data->ap_response;
377 elen[2] = LEAP_RESPONSE_LEN;
378 addr[3] = data->peer_challenge;
379 elen[3] = LEAP_CHALLENGE_LEN;
380 addr[4] = data->peer_response;
381 elen[4] = LEAP_RESPONSE_LEN;
382 md5_vector(5, addr, elen, key);
383 wpa_hexdump_key(MSG_DEBUG, "EAP-LEAP: master key", key, LEAP_KEY_LEN);
386 os_memset(pw_hash, 0, sizeof(pw_hash));
387 os_memset(pw_hash_hash, 0, sizeof(pw_hash_hash));
393 int eap_peer_leap_register(void)
395 struct eap_method *eap;
397 eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
398 EAP_VENDOR_IETF, EAP_TYPE_LEAP, "LEAP");
402 eap->init = eap_leap_init;
403 eap->deinit = eap_leap_deinit;
404 eap->process = eap_leap_process;
405 eap->isKeyAvailable = eap_leap_isKeyAvailable;
406 eap->getKey = eap_leap_getKey;
408 return eap_peer_method_register(eap);