src/eap_peer/eap_ttls.c

   1 /*
   2  * EAP peer method: EAP-TTLS (RFC 5281)
   3  * Copyright (c) 2004-2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "eap_peer/eap_i.h"
  19 #include "eap_peer/eap_tls_common.h"
  20 #include "eap_peer/eap_config.h"
  21 #include "ms_funcs.h"
  22 #include "sha1.h"
  23 #include "eap_common/chap.h"
  24 #include "tls.h"
  25 #include "mschapv2.h"
  26 #include "eap_common/eap_ttls.h"
  27
  28
  29 /* Maximum supported TTLS version
  30  * 0 = RFC 5281
  31  * 1 = draft-funk-eap-ttls-v1-00.txt
  32  */
  33 #ifndef EAP_TTLS_VERSION
  34 #define EAP_TTLS_VERSION 0 /* TTLSv1 implementation is not yet complete */
  35 #endif /* EAP_TTLS_VERSION */
  36
  37
  38 #define MSCHAPV2_KEY_LEN 16
  39 #define MSCHAPV2_NT_RESPONSE_LEN 24
  40
  41
  42 static void eap_ttls_deinit(struct eap_sm *sm, void *priv);
  43
  44
  45 struct eap_ttls_data {
  46         struct eap_ssl_data ssl;
  47         int ssl_initialized;
  48
  49         int ttls_version, force_ttls_version;
  50
  51         const struct eap_method *phase2_method;
  52         void *phase2_priv;
  53         int phase2_success;
  54         int phase2_start;
  55
  56         enum phase2_types {
  57                 EAP_TTLS_PHASE2_EAP,
  58                 EAP_TTLS_PHASE2_MSCHAPV2,
  59                 EAP_TTLS_PHASE2_MSCHAP,
  60                 EAP_TTLS_PHASE2_PAP,
  61                 EAP_TTLS_PHASE2_CHAP
  62         } phase2_type;
  63         struct eap_method_type phase2_eap_type;
  64         struct eap_method_type *phase2_eap_types;
  65         size_t num_phase2_eap_types;
  66
  67         u8 auth_response[MSCHAPV2_AUTH_RESPONSE_LEN];
  68         int auth_response_valid;
  69         u8 master_key[MSCHAPV2_MASTER_KEY_LEN]; /* MSCHAPv2 master key */
  70         u8 ident;
  71         int resuming; /* starting a resumed session */
  72         int reauth; /* reauthentication */
  73         u8 *key_data;
  74
  75         struct wpabuf *pending_phase2_req;
  76
  77 #ifdef EAP_TNC
  78         int ready_for_tnc;
  79         int tnc_started;
  80 #endif /* EAP_TNC */
  81 };
  82
  83
  84 static void * eap_ttls_init(struct eap_sm *sm)
  85 {
  86         struct eap_ttls_data *data;
  87         struct eap_peer_config *config = eap_get_config(sm);
  88         char *selected;
  89
  90         data = os_zalloc(sizeof(*data));
  91         if (data == NULL)
  92                 return NULL;
  93         data->ttls_version = EAP_TTLS_VERSION;
  94         data->force_ttls_version = -1;
  95         selected = "EAP";
  96         data->phase2_type = EAP_TTLS_PHASE2_EAP;
  97
  98 #if EAP_TTLS_VERSION > 0
  99         if (config && config->phase1) {
 100                 const char *pos = os_strstr(config->phase1, "ttlsver=");
 101                 if (pos) {
 102                         data->force_ttls_version = atoi(pos + 8);
 103                         data->ttls_version = data->force_ttls_version;
 104                         wpa_printf(MSG_DEBUG, "EAP-TTLS: Forced TTLS version "
 105                                    "%d", data->force_ttls_version);
 106                 }
 107         }
 108 #endif /* EAP_TTLS_VERSION */
 109
 110         if (config && config->phase2) {
 111                 if (os_strstr(config->phase2, "autheap=")) {
 112                         selected = "EAP";
 113                         data->phase2_type = EAP_TTLS_PHASE2_EAP;
 114                 } else if (os_strstr(config->phase2, "auth=MSCHAPV2")) {
 115                         selected = "MSCHAPV2";
 116                         data->phase2_type = EAP_TTLS_PHASE2_MSCHAPV2;
 117                 } else if (os_strstr(config->phase2, "auth=MSCHAP")) {
 118                         selected = "MSCHAP";
 119                         data->phase2_type = EAP_TTLS_PHASE2_MSCHAP;
 120                 } else if (os_strstr(config->phase2, "auth=PAP")) {
 121                         selected = "PAP";
 122                         data->phase2_type = EAP_TTLS_PHASE2_PAP;
 123                 } else if (os_strstr(config->phase2, "auth=CHAP")) {
 124                         selected = "CHAP";
 125                         data->phase2_type = EAP_TTLS_PHASE2_CHAP;
 126                 }
 127         }
 128         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase2 type: %s", selected);
 129
 130         if (data->phase2_type == EAP_TTLS_PHASE2_EAP) {
 131                 if (eap_peer_select_phase2_methods(config, "autheap=",
 132                                                    &data->phase2_eap_types,
 133                                                    &data->num_phase2_eap_types)
 134                     < 0) {
 135                         eap_ttls_deinit(sm, data);
 136                         return NULL;
 137                 }
 138
 139                 data->phase2_eap_type.vendor = EAP_VENDOR_IETF;
 140                 data->phase2_eap_type.method = EAP_TYPE_NONE;
 141         }
 142
 143 #if EAP_TTLS_VERSION > 0
 144         if (!(tls_capabilities(sm->ssl_ctx) & TLS_CAPABILITY_IA) &&
 145             data->ttls_version > 0) {
 146                 if (data->force_ttls_version > 0) {
 147                         wpa_printf(MSG_INFO, "EAP-TTLS: Forced TTLSv%d and "
 148                                    "TLS library does not support TLS/IA.",
 149                                    data->force_ttls_version);
 150                         eap_ttls_deinit(sm, data);
 151                         return NULL;
 152                 }
 153                 data->ttls_version = 0;
 154         }
 155 #endif /* EAP_TTLS_VERSION */
 156
 157         return data;
 158 }
 159
 160
 161 static void eap_ttls_phase2_eap_deinit(struct eap_sm *sm,
 162                                        struct eap_ttls_data *data)
 163 {
 164         if (data->phase2_priv && data->phase2_method) {
 165                 data->phase2_method->deinit(sm, data->phase2_priv);
 166                 data->phase2_method = NULL;
 167                 data->phase2_priv = NULL;
 168         }
 169 }
 170
 171
 172 static void eap_ttls_deinit(struct eap_sm *sm, void *priv)
 173 {
 174         struct eap_ttls_data *data = priv;
 175         if (data == NULL)
 176                 return;
 177         eap_ttls_phase2_eap_deinit(sm, data);
 178         os_free(data->phase2_eap_types);
 179         if (data->ssl_initialized)
 180                 eap_peer_tls_ssl_deinit(sm, &data->ssl);
 181         os_free(data->key_data);
 182         wpabuf_free(data->pending_phase2_req);
 183         os_free(data);
 184 }
 185
 186
 187 static u8 * eap_ttls_avp_hdr(u8 *avphdr, u32 avp_code, u32 vendor_id,
 188                              int mandatory, size_t len)
 189 {
 190         struct ttls_avp_vendor *avp;
 191         u8 flags;
 192         size_t hdrlen;
 193
 194         avp = (struct ttls_avp_vendor *) avphdr;
 195         flags = mandatory ? AVP_FLAGS_MANDATORY : 0;
 196         if (vendor_id) {
 197                 flags |= AVP_FLAGS_VENDOR;
 198                 hdrlen = sizeof(*avp);
 199                 avp->vendor_id = host_to_be32(vendor_id);
 200         } else {
 201                 hdrlen = sizeof(struct ttls_avp);
 202         }
 203
 204         avp->avp_code = host_to_be32(avp_code);
 205         avp->avp_length = host_to_be32((flags << 24) | (hdrlen + len));
 206
 207         return avphdr + hdrlen;
 208 }
 209
 210
 211 static u8 * eap_ttls_avp_add(u8 *start, u8 *avphdr, u32 avp_code,
 212                              u32 vendor_id, int mandatory,
 213                              const u8 *data, size_t len)
 214 {
 215         u8 *pos;
 216         pos = eap_ttls_avp_hdr(avphdr, avp_code, vendor_id, mandatory, len);
 217         os_memcpy(pos, data, len);
 218         pos += len;
 219         AVP_PAD(start, pos);
 220         return pos;
 221 }
 222
 223
 224 static int eap_ttls_avp_encapsulate(struct wpabuf **resp, u32 avp_code,
 225                                     int mandatory)
 226 {
 227         struct wpabuf *msg;
 228         u8 *avp, *pos;
 229
 230         msg = wpabuf_alloc(sizeof(struct ttls_avp) + wpabuf_len(*resp) + 4);
 231         if (msg == NULL) {
 232                 wpabuf_free(*resp);
 233                 *resp = NULL;
 234                 return -1;
 235         }
 236
 237         avp = wpabuf_mhead(msg);
 238         pos = eap_ttls_avp_hdr(avp, avp_code, 0, mandatory, wpabuf_len(*resp));
 239         os_memcpy(pos, wpabuf_head(*resp), wpabuf_len(*resp));
 240         pos += wpabuf_len(*resp);
 241         AVP_PAD(avp, pos);
 242         wpabuf_free(*resp);
 243         wpabuf_put(msg, pos - avp);
 244         *resp = msg;
 245         return 0;
 246 }
 247
 248
 249 #if EAP_TTLS_VERSION > 0
 250 static int eap_ttls_ia_permute_inner_secret(struct eap_sm *sm,
 251                                             struct eap_ttls_data *data,
 252                                             const u8 *key, size_t key_len)
 253 {
 254         u8 *buf;
 255         size_t buf_len;
 256         int ret;
 257
 258         if (key) {
 259                 buf_len = 2 + key_len;
 260                 buf = os_malloc(buf_len);
 261                 if (buf == NULL)
 262                         return -1;
 263                 WPA_PUT_BE16(buf, key_len);
 264                 os_memcpy(buf + 2, key, key_len);
 265         } else {
 266                 buf = NULL;
 267                 buf_len = 0;
 268         }
 269
 270         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Session keys for TLS/IA inner "
 271                         "secret permutation", buf, buf_len);
 272         ret = tls_connection_ia_permute_inner_secret(sm->ssl_ctx,
 273                                                      data->ssl.conn,
 274                                                      buf, buf_len);
 275         os_free(buf);
 276
 277         return ret;
 278 }
 279 #endif /* EAP_TTLS_VERSION */
 280
 281
 282 static int eap_ttls_v0_derive_key(struct eap_sm *sm,
 283                                   struct eap_ttls_data *data)
 284 {
 285         os_free(data->key_data);
 286         data->key_data = eap_peer_tls_derive_key(sm, &data->ssl,
 287                                                  "ttls keying material",
 288                                                  EAP_TLS_KEY_LEN);
 289         if (!data->key_data) {
 290                 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to derive key");
 291                 return -1;
 292         }
 293
 294         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived key",
 295                         data->key_data, EAP_TLS_KEY_LEN);
 296
 297         return 0;
 298 }
 299
 300
 301 #if EAP_TTLS_VERSION > 0
 302 static int eap_ttls_v1_derive_key(struct eap_sm *sm,
 303                                   struct eap_ttls_data *data)
 304 {
 305         struct tls_keys keys;
 306         u8 *rnd;
 307
 308         os_free(data->key_data);
 309         data->key_data = NULL;
 310
 311         os_memset(&keys, 0, sizeof(keys));
 312         if (tls_connection_get_keys(sm->ssl_ctx, data->ssl.conn, &keys) ||
 313             keys.client_random == NULL || keys.server_random == NULL ||
 314             keys.inner_secret == NULL) {
 315                 wpa_printf(MSG_INFO, "EAP-TTLS: Could not get inner secret, "
 316                            "client random, or server random to derive keying "
 317                            "material");
 318                 return -1;
 319         }
 320
 321         rnd = os_malloc(keys.client_random_len + keys.server_random_len);
 322         data->key_data = os_malloc(EAP_TLS_KEY_LEN);
 323         if (rnd == NULL || data->key_data == NULL) {
 324                 wpa_printf(MSG_INFO, "EAP-TTLS: No memory for key derivation");
 325                 os_free(rnd);
 326                 os_free(data->key_data);
 327                 data->key_data = NULL;
 328                 return -1;
 329         }
 330         os_memcpy(rnd, keys.client_random, keys.client_random_len);
 331         os_memcpy(rnd + keys.client_random_len, keys.server_random,
 332                   keys.server_random_len);
 333
 334         if (tls_prf(keys.inner_secret, keys.inner_secret_len,
 335                     "ttls v1 keying material", rnd, keys.client_random_len +
 336                     keys.server_random_len, data->key_data, EAP_TLS_KEY_LEN)) {
 337                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Failed to derive key");
 338                 os_free(rnd);
 339                 os_free(data->key_data);
 340                 data->key_data = NULL;
 341                 return -1;
 342         }
 343
 344         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: client/server random",
 345                     rnd, keys.client_random_len + keys.server_random_len);
 346         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: TLS/IA inner secret",
 347                         keys.inner_secret, keys.inner_secret_len);
 348
 349         os_free(rnd);
 350
 351         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived key",
 352                         data->key_data, EAP_TLS_KEY_LEN);
 353
 354         return 0;
 355 }
 356 #endif /* EAP_TTLS_VERSION */
 357
 358
 359 static u8 * eap_ttls_implicit_challenge(struct eap_sm *sm,
 360                                         struct eap_ttls_data *data, size_t len)
 361 {
 362 #if EAP_TTLS_VERSION > 0
 363         struct tls_keys keys;
 364         u8 *challenge, *rnd;
 365 #endif /* EAP_TTLS_VERSION */
 366
 367         if (data->ttls_version == 0) {
 368                 return eap_peer_tls_derive_key(sm, &data->ssl,
 369                                                "ttls challenge", len);
 370         }
 371
 372 #if EAP_TTLS_VERSION > 0
 373
 374         os_memset(&keys, 0, sizeof(keys));
 375         if (tls_connection_get_keys(sm->ssl_ctx, data->ssl.conn, &keys) ||
 376             keys.client_random == NULL || keys.server_random == NULL ||
 377             keys.inner_secret == NULL) {
 378                 wpa_printf(MSG_INFO, "EAP-TTLS: Could not get inner secret, "
 379                            "client random, or server random to derive "
 380                            "implicit challenge");
 381                 return NULL;
 382         }
 383
 384         rnd = os_malloc(keys.client_random_len + keys.server_random_len);
 385         challenge = os_malloc(len);
 386         if (rnd == NULL || challenge == NULL) {
 387                 wpa_printf(MSG_INFO, "EAP-TTLS: No memory for implicit "
 388                            "challenge derivation");
 389                 os_free(rnd);
 390                 os_free(challenge);
 391                 return NULL;
 392         }
 393         os_memcpy(rnd, keys.server_random, keys.server_random_len);
 394         os_memcpy(rnd + keys.server_random_len, keys.client_random,
 395                   keys.client_random_len);
 396
 397         if (tls_prf(keys.inner_secret, keys.inner_secret_len,
 398                     "inner application challenge", rnd,
 399                     keys.client_random_len + keys.server_random_len,
 400                     challenge, len)) {
 401                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Failed to derive implicit "
 402                            "challenge");
 403                 os_free(rnd);
 404                 os_free(challenge);
 405                 return NULL;
 406         }
 407
 408         os_free(rnd);
 409
 410         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived implicit challenge",
 411                         challenge, len);
 412
 413         return challenge;
 414
 415 #else /* EAP_TTLS_VERSION */
 416
 417         return NULL;
 418
 419 #endif /* EAP_TTLS_VERSION */
 420 }
 421
 422
 423 static void eap_ttlsv1_phase2_eap_finish(struct eap_sm *sm,
 424                                          struct eap_ttls_data *data,
 425                                          struct eap_method_ret *ret)
 426 {
 427 #if EAP_TTLS_VERSION > 0
 428         if (data->ttls_version > 0) {
 429                 const struct eap_method *m = data->phase2_method;
 430                 void *priv = data->phase2_priv;
 431
 432                 /* TTLSv1 requires TLS/IA FinalPhaseFinished */
 433                 if (ret->decision == DECISION_UNCOND_SUCC)
 434                         ret->decision = DECISION_COND_SUCC;
 435                 ret->methodState = METHOD_CONT;
 436
 437                 if (ret->decision == DECISION_COND_SUCC &&
 438                     m->isKeyAvailable && m->getKey &&
 439                     m->isKeyAvailable(sm, priv)) {
 440                         u8 *key;
 441                         size_t key_len;
 442                         key = m->getKey(sm, priv, &key_len);
 443                         if (key) {
 444                                 eap_ttls_ia_permute_inner_secret(
 445                                         sm, data, key, key_len);
 446                                 os_free(key);
 447                         }
 448                 }
 449         }
 450 #endif /* EAP_TTLS_VERSION */
 451 }
 452
 453
 454 static void eap_ttls_phase2_select_eap_method(struct eap_ttls_data *data,
 455                                               u8 method)
 456 {
 457         size_t i;
 458         for (i = 0; i < data->num_phase2_eap_types; i++) {
 459                 if (data->phase2_eap_types[i].vendor != EAP_VENDOR_IETF ||
 460                     data->phase2_eap_types[i].method != method)
 461                         continue;
 462
 463                 data->phase2_eap_type.vendor =
 464                         data->phase2_eap_types[i].vendor;
 465                 data->phase2_eap_type.method =
 466                         data->phase2_eap_types[i].method;
 467                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Selected "
 468                            "Phase 2 EAP vendor %d method %d",
 469                            data->phase2_eap_type.vendor,
 470                            data->phase2_eap_type.method);
 471                 break;
 472         }
 473 }
 474
 475
 476 static int eap_ttls_phase2_eap_process(struct eap_sm *sm,
 477                                        struct eap_ttls_data *data,
 478                                        struct eap_method_ret *ret,
 479                                        struct eap_hdr *hdr, size_t len,
 480                                        struct wpabuf **resp)
 481 {
 482         struct wpabuf msg;
 483         struct eap_method_ret iret;
 484
 485         os_memset(&iret, 0, sizeof(iret));
 486         wpabuf_set(&msg, hdr, len);
 487         *resp = data->phase2_method->process(sm, data->phase2_priv, &iret,
 488                                              &msg);
 489         if ((iret.methodState == METHOD_DONE ||
 490              iret.methodState == METHOD_MAY_CONT) &&
 491             (iret.decision == DECISION_UNCOND_SUCC ||
 492              iret.decision == DECISION_COND_SUCC ||
 493              iret.decision == DECISION_FAIL)) {
 494                 ret->methodState = iret.methodState;
 495                 ret->decision = iret.decision;
 496         }
 497         eap_ttlsv1_phase2_eap_finish(sm, data, ret);
 498
 499         return 0;
 500 }
 501
 502
 503 static int eap_ttls_phase2_request_eap_method(struct eap_sm *sm,
 504                                               struct eap_ttls_data *data,
 505                                               struct eap_method_ret *ret,
 506                                               struct eap_hdr *hdr, size_t len,
 507                                               u8 method, struct wpabuf **resp)
 508 {
 509 #ifdef EAP_TNC
 510         if (data->tnc_started && data->phase2_method &&
 511             data->phase2_priv && method == EAP_TYPE_TNC &&
 512             data->phase2_eap_type.method == EAP_TYPE_TNC)
 513                 return eap_ttls_phase2_eap_process(sm, data, ret, hdr, len,
 514                                                    resp);
 515
 516         if (data->ready_for_tnc && !data->tnc_started &&
 517             method == EAP_TYPE_TNC) {
 518                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Start TNC after completed "
 519                            "EAP method");
 520                 data->tnc_started = 1;
 521         }
 522
 523         if (data->tnc_started) {
 524                 if (data->phase2_eap_type.vendor != EAP_VENDOR_IETF ||
 525                     data->phase2_eap_type.method == EAP_TYPE_TNC) {
 526                         wpa_printf(MSG_DEBUG, "EAP-TTLS: Unexpected EAP "
 527                                    "type %d for TNC", method);
 528                         return -1;
 529                 }
 530
 531                 data->phase2_eap_type.vendor = EAP_VENDOR_IETF;
 532                 data->phase2_eap_type.method = method;
 533                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Selected "
 534                            "Phase 2 EAP vendor %d method %d (TNC)",
 535                            data->phase2_eap_type.vendor,
 536                            data->phase2_eap_type.method);
 537
 538                 if (data->phase2_type == EAP_TTLS_PHASE2_EAP)
 539                         eap_ttls_phase2_eap_deinit(sm, data);
 540         }
 541 #endif /* EAP_TNC */
 542
 543         if (data->phase2_eap_type.vendor == EAP_VENDOR_IETF &&
 544             data->phase2_eap_type.method == EAP_TYPE_NONE)
 545                 eap_ttls_phase2_select_eap_method(data, method);
 546
 547         if (method != data->phase2_eap_type.method || method == EAP_TYPE_NONE)
 548         {
 549                 if (eap_peer_tls_phase2_nak(data->phase2_eap_types,
 550                                             data->num_phase2_eap_types,
 551                                             hdr, resp))
 552                         return -1;
 553                 return 0;
 554         }
 555
 556         if (data->phase2_priv == NULL) {
 557                 data->phase2_method = eap_peer_get_eap_method(
 558                         EAP_VENDOR_IETF, method);
 559                 if (data->phase2_method) {
 560                         sm->init_phase2 = 1;
 561                         sm->mschapv2_full_key = 1;
 562                         data->phase2_priv = data->phase2_method->init(sm);
 563                         sm->init_phase2 = 0;
 564                         sm->mschapv2_full_key = 0;
 565                 }
 566         }
 567         if (data->phase2_priv == NULL || data->phase2_method == NULL) {
 568                 wpa_printf(MSG_INFO, "EAP-TTLS: failed to initialize "
 569                            "Phase 2 EAP method %d", method);
 570                 return -1;
 571         }
 572
 573         return eap_ttls_phase2_eap_process(sm, data, ret, hdr, len, resp);
 574 }
 575
 576
 577 static int eap_ttls_phase2_request_eap(struct eap_sm *sm,
 578                                        struct eap_ttls_data *data,
 579                                        struct eap_method_ret *ret,
 580                                        struct eap_hdr *hdr,
 581                                        struct wpabuf **resp)
 582 {
 583         size_t len = be_to_host16(hdr->length);
 584         u8 *pos;
 585         struct eap_peer_config *config = eap_get_config(sm);
 586
 587         if (len <= sizeof(struct eap_hdr)) {
 588                 wpa_printf(MSG_INFO, "EAP-TTLS: too short "
 589                            "Phase 2 request (len=%lu)", (unsigned long) len);
 590                 return -1;
 591         }
 592         pos = (u8 *) (hdr + 1);
 593         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 EAP Request: type=%d", *pos);
 594         switch (*pos) {
 595         case EAP_TYPE_IDENTITY:
 596                 *resp = eap_sm_buildIdentity(sm, hdr->identifier, 1);
 597                 break;
 598         default:
 599                 if (eap_ttls_phase2_request_eap_method(sm, data, ret, hdr, len,
 600                                                        *pos, resp) < 0)
 601                         return -1;
 602                 break;
 603         }
 604
 605         if (*resp == NULL &&
 606             (config->pending_req_identity || config->pending_req_password ||
 607              config->pending_req_otp)) {
 608                 return 0;
 609         }
 610
 611         if (*resp == NULL)
 612                 return -1;
 613
 614         wpa_hexdump_buf(MSG_DEBUG, "EAP-TTLS: AVP encapsulate EAP Response",
 615                         *resp);
 616         return eap_ttls_avp_encapsulate(resp, RADIUS_ATTR_EAP_MESSAGE, 1);
 617 }
 618
 619
 620 static void eap_ttlsv1_permute_inner(struct eap_sm *sm,
 621                                      struct eap_ttls_data *data)
 622 {
 623 #if EAP_TTLS_VERSION > 0
 624         u8 session_key[2 * MSCHAPV2_KEY_LEN];
 625
 626         if (data->ttls_version == 0)
 627                 return;
 628
 629         get_asymetric_start_key(data->master_key, session_key,
 630                                 MSCHAPV2_KEY_LEN, 0, 0);
 631         get_asymetric_start_key(data->master_key,
 632                                 session_key + MSCHAPV2_KEY_LEN,
 633                                 MSCHAPV2_KEY_LEN, 1, 0);
 634         eap_ttls_ia_permute_inner_secret(sm, data, session_key,
 635                                          sizeof(session_key));
 636 #endif /* EAP_TTLS_VERSION */
 637 }
 638
 639
 640 static int eap_ttls_phase2_request_mschapv2(struct eap_sm *sm,
 641                                             struct eap_ttls_data *data,
 642                                             struct eap_method_ret *ret,
 643                                             struct wpabuf **resp)
 644 {
 645         struct wpabuf *msg;
 646         u8 *buf, *pos, *challenge, *peer_challenge;
 647         const u8 *identity, *password;
 648         size_t identity_len, password_len;
 649         int pwhash;
 650
 651         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 MSCHAPV2 Request");
 652
 653         identity = eap_get_config_identity(sm, &identity_len);
 654         password = eap_get_config_password2(sm, &password_len, &pwhash);
 655         if (identity == NULL || password == NULL)
 656                 return -1;
 657
 658         msg = wpabuf_alloc(identity_len + 1000);
 659         if (msg == NULL) {
 660                 wpa_printf(MSG_ERROR,
 661                            "EAP-TTLS/MSCHAPV2: Failed to allocate memory");
 662                 return -1;
 663         }
 664         pos = buf = wpabuf_mhead(msg);
 665
 666         /* User-Name */
 667         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,
 668                                identity, identity_len);
 669
 670         /* MS-CHAP-Challenge */
 671         challenge = eap_ttls_implicit_challenge(
 672                 sm, data, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN + 1);
 673         if (challenge == NULL) {
 674                 wpabuf_free(msg);
 675                 wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAPV2: Failed to derive "
 676                            "implicit challenge");
 677                 return -1;
 678         }
 679         peer_challenge = challenge + 1 + EAP_TTLS_MSCHAPV2_CHALLENGE_LEN;
 680
 681         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_MS_CHAP_CHALLENGE,
 682                                RADIUS_VENDOR_ID_MICROSOFT, 1,
 683                                challenge, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN);
 684
 685         /* MS-CHAP2-Response */
 686         pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP2_RESPONSE,
 687                                RADIUS_VENDOR_ID_MICROSOFT, 1,
 688                                EAP_TTLS_MSCHAPV2_RESPONSE_LEN);
 689         data->ident = challenge[EAP_TTLS_MSCHAPV2_CHALLENGE_LEN];
 690         *pos++ = data->ident;
 691         *pos++ = 0; /* Flags */
 692         os_memcpy(pos, peer_challenge, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN);
 693         pos += EAP_TTLS_MSCHAPV2_CHALLENGE_LEN;
 694         os_memset(pos, 0, 8); /* Reserved, must be zero */
 695         pos += 8;
 696         mschapv2_derive_response(identity, identity_len, password,
 697                                  password_len, pwhash, challenge,
 698                                  peer_challenge, pos, data->auth_response,
 699                                  data->master_key);
 700         data->auth_response_valid = 1;
 701
 702         eap_ttlsv1_permute_inner(sm, data);
 703
 704         pos += 24;
 705         os_free(challenge);
 706         AVP_PAD(buf, pos);
 707
 708         wpabuf_put(msg, pos - buf);
 709         *resp = msg;
 710
 711         if (sm->workaround && data->ttls_version == 0) {
 712                 /* At least FreeRADIUS seems to be terminating
 713                  * EAP-TTLS/MSHCAPV2 without the expected MS-CHAP-v2 Success
 714                  * packet. */
 715                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: EAP workaround - "
 716                            "allow success without tunneled response");
 717                 ret->methodState = METHOD_MAY_CONT;
 718                 ret->decision = DECISION_COND_SUCC;
 719         }
 720
 721         return 0;
 722 }
 723
 724
 725 static int eap_ttls_phase2_request_mschap(struct eap_sm *sm,
 726                                           struct eap_ttls_data *data,
 727                                           struct eap_method_ret *ret,
 728                                           struct wpabuf **resp)
 729 {
 730         struct wpabuf *msg;
 731         u8 *buf, *pos, *challenge;
 732         const u8 *identity, *password;
 733         size_t identity_len, password_len;
 734         int pwhash;
 735
 736         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 MSCHAP Request");
 737
 738         identity = eap_get_config_identity(sm, &identity_len);
 739         password = eap_get_config_password2(sm, &password_len, &pwhash);
 740         if (identity == NULL || password == NULL)
 741                 return -1;
 742
 743         msg = wpabuf_alloc(identity_len + 1000);
 744         if (msg == NULL) {
 745                 wpa_printf(MSG_ERROR,
 746                            "EAP-TTLS/MSCHAP: Failed to allocate memory");
 747                 return -1;
 748         }
 749         pos = buf = wpabuf_mhead(msg);
 750
 751         /* User-Name */
 752         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,
 753                                identity, identity_len);
 754
 755         /* MS-CHAP-Challenge */
 756         challenge = eap_ttls_implicit_challenge(
 757                 sm, data, EAP_TTLS_MSCHAP_CHALLENGE_LEN + 1);
 758         if (challenge == NULL) {
 759                 wpabuf_free(msg);
 760                 wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAP: Failed to derive "
 761                            "implicit challenge");
 762                 return -1;
 763         }
 764
 765         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_MS_CHAP_CHALLENGE,
 766                                RADIUS_VENDOR_ID_MICROSOFT, 1,
 767                                challenge, EAP_TTLS_MSCHAP_CHALLENGE_LEN);
 768
 769         /* MS-CHAP-Response */
 770         pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP_RESPONSE,
 771                                RADIUS_VENDOR_ID_MICROSOFT, 1,
 772                                EAP_TTLS_MSCHAP_RESPONSE_LEN);
 773         data->ident = challenge[EAP_TTLS_MSCHAP_CHALLENGE_LEN];
 774         *pos++ = data->ident;
 775         *pos++ = 1; /* Flags: Use NT style passwords */
 776         os_memset(pos, 0, 24); /* LM-Response */
 777         pos += 24;
 778         if (pwhash) {
 779                 challenge_response(challenge, password, pos); /* NT-Response */
 780                 wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: MSCHAP password hash",
 781                                 password, 16);
 782         } else {
 783                 nt_challenge_response(challenge, password, password_len,
 784                                       pos); /* NT-Response */
 785                 wpa_hexdump_ascii_key(MSG_DEBUG, "EAP-TTLS: MSCHAP password",
 786                                       password, password_len);
 787         }
 788         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAP implicit challenge",
 789                     challenge, EAP_TTLS_MSCHAP_CHALLENGE_LEN);
 790         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAP response", pos, 24);
 791         pos += 24;
 792         os_free(challenge);
 793         AVP_PAD(buf, pos);
 794
 795         wpabuf_put(msg, pos - buf);
 796         *resp = msg;
 797
 798         if (data->ttls_version > 0) {
 799                 /* EAP-TTLSv1 uses TLS/IA FinalPhaseFinished to report success,
 800                  * so do not allow connection to be terminated yet. */
 801                 ret->methodState = METHOD_CONT;
 802                 ret->decision = DECISION_COND_SUCC;
 803         } else {
 804                 /* EAP-TTLS/MSCHAP does not provide tunneled success
 805                  * notification, so assume that Phase2 succeeds. */
 806                 ret->methodState = METHOD_DONE;
 807                 ret->decision = DECISION_COND_SUCC;
 808         }
 809
 810         return 0;
 811 }
 812
 813
 814 static int eap_ttls_phase2_request_pap(struct eap_sm *sm,
 815                                        struct eap_ttls_data *data,
 816                                        struct eap_method_ret *ret,
 817                                        struct wpabuf **resp)
 818 {
 819         struct wpabuf *msg;
 820         u8 *buf, *pos;
 821         size_t pad;
 822         const u8 *identity, *password;
 823         size_t identity_len, password_len;
 824
 825         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 PAP Request");
 826
 827         identity = eap_get_config_identity(sm, &identity_len);
 828         password = eap_get_config_password(sm, &password_len);
 829         if (identity == NULL || password == NULL)
 830                 return -1;
 831
 832         msg = wpabuf_alloc(identity_len + password_len + 100);
 833         if (msg == NULL) {
 834                 wpa_printf(MSG_ERROR,
 835                            "EAP-TTLS/PAP: Failed to allocate memory");
 836                 return -1;
 837         }
 838         pos = buf = wpabuf_mhead(msg);
 839
 840         /* User-Name */
 841         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,
 842                                identity, identity_len);
 843
 844         /* User-Password; in RADIUS, this is encrypted, but EAP-TTLS encrypts
 845          * the data, so no separate encryption is used in the AVP itself.
 846          * However, the password is padded to obfuscate its length. */
 847         pad = (16 - (password_len & 15)) & 15;
 848         pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_USER_PASSWORD, 0, 1,
 849                                password_len + pad);
 850         os_memcpy(pos, password, password_len);
 851         pos += password_len;
 852         os_memset(pos, 0, pad);
 853         pos += pad;
 854         AVP_PAD(buf, pos);
 855
 856         wpabuf_put(msg, pos - buf);
 857         *resp = msg;
 858
 859         if (data->ttls_version > 0) {
 860                 /* EAP-TTLSv1 uses TLS/IA FinalPhaseFinished to report success,
 861                  * so do not allow connection to be terminated yet. */
 862                 ret->methodState = METHOD_CONT;
 863                 ret->decision = DECISION_COND_SUCC;
 864         } else {
 865                 /* EAP-TTLS/PAP does not provide tunneled success notification,
 866                  * so assume that Phase2 succeeds. */
 867                 ret->methodState = METHOD_DONE;
 868                 ret->decision = DECISION_COND_SUCC;
 869         }
 870
 871         return 0;
 872 }
 873
 874
 875 static int eap_ttls_phase2_request_chap(struct eap_sm *sm,
 876                                         struct eap_ttls_data *data,
 877                                         struct eap_method_ret *ret,
 878                                         struct wpabuf **resp)
 879 {
 880         struct wpabuf *msg;
 881         u8 *buf, *pos, *challenge;
 882         const u8 *identity, *password;
 883         size_t identity_len, password_len;
 884
 885         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 CHAP Request");
 886
 887         identity = eap_get_config_identity(sm, &identity_len);
 888         password = eap_get_config_password(sm, &password_len);
 889         if (identity == NULL || password == NULL)
 890                 return -1;
 891
 892         msg = wpabuf_alloc(identity_len + 1000);
 893         if (msg == NULL) {
 894                 wpa_printf(MSG_ERROR,
 895                            "EAP-TTLS/CHAP: Failed to allocate memory");
 896                 return -1;
 897         }
 898         pos = buf = wpabuf_mhead(msg);
 899
 900         /* User-Name */
 901         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,
 902                                identity, identity_len);
 903
 904         /* CHAP-Challenge */
 905         challenge = eap_ttls_implicit_challenge(
 906                 sm, data, EAP_TTLS_CHAP_CHALLENGE_LEN + 1);
 907         if (challenge == NULL) {
 908                 wpabuf_free(msg);
 909                 wpa_printf(MSG_ERROR, "EAP-TTLS/CHAP: Failed to derive "
 910                            "implicit challenge");
 911                 return -1;
 912         }
 913
 914         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_CHAP_CHALLENGE, 0, 1,
 915                                challenge, EAP_TTLS_CHAP_CHALLENGE_LEN);
 916
 917         /* CHAP-Password */
 918         pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_CHAP_PASSWORD, 0, 1,
 919                                1 + EAP_TTLS_CHAP_PASSWORD_LEN);
 920         data->ident = challenge[EAP_TTLS_CHAP_CHALLENGE_LEN];
 921         *pos++ = data->ident;
 922
 923         /* MD5(Ident + Password + Challenge) */
 924         chap_md5(data->ident, password, password_len, challenge,
 925                  EAP_TTLS_CHAP_CHALLENGE_LEN, pos);
 926
 927         wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: CHAP username",
 928                           identity, identity_len);
 929         wpa_hexdump_ascii_key(MSG_DEBUG, "EAP-TTLS: CHAP password",
 930                               password, password_len);
 931         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: CHAP implicit challenge",
 932                     challenge, EAP_TTLS_CHAP_CHALLENGE_LEN);
 933         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: CHAP password",
 934                     pos, EAP_TTLS_CHAP_PASSWORD_LEN);
 935         pos += EAP_TTLS_CHAP_PASSWORD_LEN;
 936         os_free(challenge);
 937         AVP_PAD(buf, pos);
 938
 939         wpabuf_put(msg, pos - buf);
 940         *resp = msg;
 941
 942         if (data->ttls_version > 0) {
 943                 /* EAP-TTLSv1 uses TLS/IA FinalPhaseFinished to report success,
 944                  * so do not allow connection to be terminated yet. */
 945                 ret->methodState = METHOD_CONT;
 946                 ret->decision = DECISION_COND_SUCC;
 947         } else {
 948                 /* EAP-TTLS/CHAP does not provide tunneled success
 949                  * notification, so assume that Phase2 succeeds. */
 950                 ret->methodState = METHOD_DONE;
 951                 ret->decision = DECISION_COND_SUCC;
 952         }
 953
 954         return 0;
 955 }
 956
 957
 958 static int eap_ttls_phase2_request(struct eap_sm *sm,
 959                                    struct eap_ttls_data *data,
 960                                    struct eap_method_ret *ret,
 961                                    struct eap_hdr *hdr,
 962                                    struct wpabuf **resp)
 963 {
 964         int res = 0;
 965         size_t len;
 966         enum phase2_types phase2_type = data->phase2_type;
 967
 968 #ifdef EAP_TNC
 969         if (data->tnc_started) {
 970                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Processing TNC");
 971                 phase2_type = EAP_TTLS_PHASE2_EAP;
 972         }
 973 #endif /* EAP_TNC */
 974
 975         if (phase2_type == EAP_TTLS_PHASE2_MSCHAPV2 ||
 976             phase2_type == EAP_TTLS_PHASE2_MSCHAP ||
 977             phase2_type == EAP_TTLS_PHASE2_PAP ||
 978             phase2_type == EAP_TTLS_PHASE2_CHAP) {
 979                 if (eap_get_config_identity(sm, &len) == NULL) {
 980                         wpa_printf(MSG_INFO,
 981                                    "EAP-TTLS: Identity not configured");
 982                         eap_sm_request_identity(sm);
 983                         if (eap_get_config_password(sm, &len) == NULL)
 984                                 eap_sm_request_password(sm);
 985                         return 0;
 986                 }
 987
 988                 if (eap_get_config_password(sm, &len) == NULL) {
 989                         wpa_printf(MSG_INFO,
 990                                    "EAP-TTLS: Password not configured");
 991                         eap_sm_request_password(sm);
 992                         return 0;
 993                 }
 994         }
 995
 996         switch (phase2_type) {
 997         case EAP_TTLS_PHASE2_EAP:
 998                 res = eap_ttls_phase2_request_eap(sm, data, ret, hdr, resp);
 999                 break;
1000         case EAP_TTLS_PHASE2_MSCHAPV2:
1001                 res = eap_ttls_phase2_request_mschapv2(sm, data, ret, resp);
1002                 break;
1003         case EAP_TTLS_PHASE2_MSCHAP:
1004                 res = eap_ttls_phase2_request_mschap(sm, data, ret, resp);
1005                 break;
1006         case EAP_TTLS_PHASE2_PAP:
1007                 res = eap_ttls_phase2_request_pap(sm, data, ret, resp);
1008                 break;
1009         case EAP_TTLS_PHASE2_CHAP:
1010                 res = eap_ttls_phase2_request_chap(sm, data, ret, resp);
1011                 break;
1012         default:
1013                 wpa_printf(MSG_ERROR, "EAP-TTLS: Phase 2 - Unknown");
1014                 res = -1;
1015                 break;
1016         }
1017
1018         if (res < 0) {
1019                 ret->methodState = METHOD_DONE;
1020                 ret->decision = DECISION_FAIL;
1021         }
1022
1023         return res;
1024 }
1025
1026
1027 #if EAP_TTLS_VERSION > 0
1028 static struct wpabuf * eap_ttls_build_phase_finished(
1029         struct eap_sm *sm, struct eap_ttls_data *data, int id, int final)
1030 {
1031         int len;
1032         struct wpabuf *req;
1033         u8 *pos;
1034         const int max_len = 300;
1035
1036         req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_TTLS, 1 + max_len,
1037                             EAP_CODE_RESPONSE, id);
1038         if (req == NULL)
1039                 return NULL;
1040
1041         wpabuf_put_u8(req, data->ttls_version);
1042
1043         pos = wpabuf_put(req, 0);
1044         len = tls_connection_ia_send_phase_finished(sm->ssl_ctx,
1045                                                     data->ssl.conn,
1046                                                     final, pos, max_len);
1047         if (len < 0) {
1048                 wpabuf_free(req);
1049                 return NULL;
1050         }
1051         wpabuf_put(req, len);
1052         eap_update_len(req);
1053
1054         return req;
1055 }
1056 #endif /* EAP_TTLS_VERSION */
1057
1058
1059 struct ttls_parse_avp {
1060         u8 *mschapv2;
1061         u8 *eapdata;
1062         size_t eap_len;
1063         int mschapv2_error;
1064 };
1065
1066
1067 static int eap_ttls_parse_attr_eap(const u8 *dpos, size_t dlen,
1068                                    struct ttls_parse_avp *parse)
1069 {
1070         wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP - EAP Message");
1071         if (parse->eapdata == NULL) {
1072                 parse->eapdata = os_malloc(dlen);
1073                 if (parse->eapdata == NULL) {
1074                         wpa_printf(MSG_WARNING, "EAP-TTLS: Failed to allocate "
1075                                    "memory for Phase 2 EAP data");
1076                         return -1;
1077                 }
1078                 os_memcpy(parse->eapdata, dpos, dlen);
1079                 parse->eap_len = dlen;
1080         } else {
1081                 u8 *neweap = os_realloc(parse->eapdata, parse->eap_len + dlen);
1082                 if (neweap == NULL) {
1083                         wpa_printf(MSG_WARNING, "EAP-TTLS: Failed to allocate "
1084                                    "memory for Phase 2 EAP data");
1085                         return -1;
1086                 }
1087                 os_memcpy(neweap + parse->eap_len, dpos, dlen);
1088                 parse->eapdata = neweap;
1089                 parse->eap_len += dlen;
1090         }
1091
1092         return 0;
1093 }
1094
1095
1096 static int eap_ttls_parse_avp(u8 *pos, size_t left,
1097                               struct ttls_parse_avp *parse)
1098 {
1099         struct ttls_avp *avp;
1100         u32 avp_code, avp_length, vendor_id = 0;
1101         u8 avp_flags, *dpos;
1102         size_t dlen;
1103
1104         avp = (struct ttls_avp *) pos;
1105         avp_code = be_to_host32(avp->avp_code);
1106         avp_length = be_to_host32(avp->avp_length);
1107         avp_flags = (avp_length >> 24) & 0xff;
1108         avp_length &= 0xffffff;
1109         wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP: code=%d flags=0x%02x "
1110                    "length=%d", (int) avp_code, avp_flags,
1111                    (int) avp_length);
1112
1113         if (avp_length > left) {
1114                 wpa_printf(MSG_WARNING, "EAP-TTLS: AVP overflow "
1115                            "(len=%d, left=%lu) - dropped",
1116                            (int) avp_length, (unsigned long) left);
1117                 return -1;
1118         }
1119
1120         if (avp_length < sizeof(*avp)) {
1121                 wpa_printf(MSG_WARNING, "EAP-TTLS: Invalid AVP length %d",
1122                            avp_length);
1123                 return -1;
1124         }
1125
1126         dpos = (u8 *) (avp + 1);
1127         dlen = avp_length - sizeof(*avp);
1128         if (avp_flags & AVP_FLAGS_VENDOR) {
1129                 if (dlen < 4) {
1130                         wpa_printf(MSG_WARNING, "EAP-TTLS: Vendor AVP "
1131                                    "underflow");
1132                         return -1;
1133                 }
1134                 vendor_id = WPA_GET_BE32(dpos);
1135                 wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP vendor_id %d",
1136                            (int) vendor_id);
1137                 dpos += 4;
1138                 dlen -= 4;
1139         }
1140
1141         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: AVP data", dpos, dlen);
1142
1143         if (vendor_id == 0 && avp_code == RADIUS_ATTR_EAP_MESSAGE) {
1144                 if (eap_ttls_parse_attr_eap(dpos, dlen, parse) < 0)
1145                         return -1;
1146         } else if (vendor_id == 0 && avp_code == RADIUS_ATTR_REPLY_MESSAGE) {
1147                 /* This is an optional message that can be displayed to
1148                  * the user. */
1149                 wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: AVP - Reply-Message",
1150                                   dpos, dlen);
1151         } else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT &&
1152                    avp_code == RADIUS_ATTR_MS_CHAP2_SUCCESS) {
1153                 wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: MS-CHAP2-Success",
1154                                   dpos, dlen);
1155                 if (dlen != 43) {
1156                         wpa_printf(MSG_WARNING, "EAP-TTLS: Unexpected "
1157                                    "MS-CHAP2-Success length "
1158                                    "(len=%lu, expected 43)",
1159                                    (unsigned long) dlen);
1160                         return -1;
1161                 }
1162                 parse->mschapv2 = dpos;
1163         } else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT &&
1164                    avp_code == RADIUS_ATTR_MS_CHAP_ERROR) {
1165                 wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: MS-CHAP-Error",
1166                                   dpos, dlen);
1167                 parse->mschapv2_error = 1;
1168         } else if (avp_flags & AVP_FLAGS_MANDATORY) {
1169                 wpa_printf(MSG_WARNING, "EAP-TTLS: Unsupported mandatory AVP "
1170                            "code %d vendor_id %d - dropped",
1171                            (int) avp_code, (int) vendor_id);
1172                 return -1;
1173         } else {
1174                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Ignoring unsupported AVP "
1175                            "code %d vendor_id %d",
1176                            (int) avp_code, (int) vendor_id);
1177         }
1178
1179         return avp_length;
1180 }
1181
1182
1183 static int eap_ttls_parse_avps(struct wpabuf *in_decrypted,
1184                                struct ttls_parse_avp *parse)
1185 {
1186         u8 *pos;
1187         size_t left, pad;
1188         int avp_length;
1189
1190         pos = wpabuf_mhead(in_decrypted);
1191         left = wpabuf_len(in_decrypted);
1192         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Decrypted Phase 2 AVPs", pos, left);
1193         if (left < sizeof(struct ttls_avp)) {
1194                 wpa_printf(MSG_WARNING, "EAP-TTLS: Too short Phase 2 AVP frame"
1195                            " len=%lu expected %lu or more - dropped",
1196                            (unsigned long) left,
1197                            (unsigned long) sizeof(struct ttls_avp));
1198                 return -1;
1199         }
1200
1201         /* Parse AVPs */
1202         os_memset(parse, 0, sizeof(*parse));
1203
1204         while (left > 0) {
1205                 avp_length = eap_ttls_parse_avp(pos, left, parse);
1206                 if (avp_length < 0)
1207                         return -1;
1208
1209                 pad = (4 - (avp_length & 3)) & 3;
1210                 pos += avp_length + pad;
1211                 if (left < avp_length + pad)
1212                         left = 0;
1213                 else
1214                         left -= avp_length + pad;
1215         }
1216
1217         return 0;
1218 }
1219
1220
1221 static u8 * eap_ttls_fake_identity_request(void)
1222 {
1223         struct eap_hdr *hdr;
1224         u8 *buf;
1225
1226         wpa_printf(MSG_DEBUG, "EAP-TTLS: empty data in beginning of "
1227                    "Phase 2 - use fake EAP-Request Identity");
1228         buf = os_malloc(sizeof(*hdr) + 1);
1229         if (buf == NULL) {
1230                 wpa_printf(MSG_WARNING, "EAP-TTLS: failed to allocate "
1231                            "memory for fake EAP-Identity Request");
1232                 return NULL;
1233         }
1234
1235         hdr = (struct eap_hdr *) buf;
1236         hdr->code = EAP_CODE_REQUEST;
1237         hdr->identifier = 0;
1238         hdr->length = host_to_be16(sizeof(*hdr) + 1);
1239         buf[sizeof(*hdr)] = EAP_TYPE_IDENTITY;
1240
1241         return buf;
1242 }
1243
1244
1245 static int eap_ttls_encrypt_response(struct eap_sm *sm,
1246                                      struct eap_ttls_data *data,
1247                                      struct wpabuf *resp, u8 identifier,
1248                                      struct wpabuf **out_data)
1249 {
1250         if (resp == NULL)
1251                 return 0;
1252
1253         wpa_hexdump_buf_key(MSG_DEBUG, "EAP-TTLS: Encrypting Phase 2 data",
1254                             resp);
1255         if (eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_TTLS,
1256                                  data->ttls_version, identifier,
1257                                  resp, out_data)) {
1258                 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to encrypt a Phase 2 "
1259                            "frame");
1260                 return -1;
1261         }
1262         wpabuf_free(resp);
1263
1264         return 0;
1265 }
1266
1267
1268 static int eap_ttls_process_phase2_eap(struct eap_sm *sm,
1269                                        struct eap_ttls_data *data,
1270                                        struct eap_method_ret *ret,
1271                                        struct ttls_parse_avp *parse,
1272                                        struct wpabuf **resp)
1273 {
1274         struct eap_hdr *hdr;
1275         size_t len;
1276
1277         if (parse->eapdata == NULL) {
1278                 wpa_printf(MSG_WARNING, "EAP-TTLS: No EAP Message in the "
1279                            "packet - dropped");
1280                 return -1;
1281         }
1282
1283         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Phase 2 EAP",
1284                     parse->eapdata, parse->eap_len);
1285         hdr = (struct eap_hdr *) parse->eapdata;
1286
1287         if (parse->eap_len < sizeof(*hdr)) {
1288                 wpa_printf(MSG_WARNING, "EAP-TTLS: Too short Phase 2 EAP "
1289                            "frame (len=%lu, expected %lu or more) - dropped",
1290                            (unsigned long) parse->eap_len,
1291                            (unsigned long) sizeof(*hdr));
1292                 return -1;
1293         }
1294         len = be_to_host16(hdr->length);
1295         if (len > parse->eap_len) {
1296                 wpa_printf(MSG_INFO, "EAP-TTLS: Length mismatch in Phase 2 "
1297                            "EAP frame (EAP hdr len=%lu, EAP data len in "
1298                            "AVP=%lu)",
1299                            (unsigned long) len,
1300                            (unsigned long) parse->eap_len);
1301                 return -1;
1302         }
1303         wpa_printf(MSG_DEBUG, "EAP-TTLS: received Phase 2: code=%d "
1304                    "identifier=%d length=%lu",
1305                    hdr->code, hdr->identifier, (unsigned long) len);
1306         switch (hdr->code) {
1307         case EAP_CODE_REQUEST:
1308                 if (eap_ttls_phase2_request(sm, data, ret, hdr, resp)) {
1309                         wpa_printf(MSG_INFO, "EAP-TTLS: Phase2 Request "
1310                                    "processing failed");
1311                         return -1;
1312                 }
1313                 break;
1314         default:
1315                 wpa_printf(MSG_INFO, "EAP-TTLS: Unexpected code=%d in "
1316                            "Phase 2 EAP header", hdr->code);
1317                 return -1;
1318         }
1319
1320         return 0;
1321 }
1322
1323
1324 static int eap_ttls_process_phase2_mschapv2(struct eap_sm *sm,
1325                                             struct eap_ttls_data *data,
1326                                             struct eap_method_ret *ret,
1327                                             struct ttls_parse_avp *parse)
1328 {
1329         if (parse->mschapv2_error) {
1330                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Received "
1331                            "MS-CHAP-Error - failed");
1332                 ret->methodState = METHOD_DONE;
1333                 ret->decision = DECISION_FAIL;
1334                 /* Reply with empty data to ACK error */
1335                 return 1;
1336         }
1337
1338         if (parse->mschapv2 == NULL) {
1339 #ifdef EAP_TNC
1340                 if (data->phase2_success && parse->eapdata) {
1341                         /*
1342                          * Allow EAP-TNC to be started after successfully
1343                          * completed MSCHAPV2.
1344                          */
1345                         return 1;
1346                 }
1347 #endif /* EAP_TNC */
1348                 wpa_printf(MSG_WARNING, "EAP-TTLS: no MS-CHAP2-Success AVP "
1349                            "received for Phase2 MSCHAPV2");
1350                 return -1;
1351         }
1352         if (parse->mschapv2[0] != data->ident) {
1353                 wpa_printf(MSG_WARNING, "EAP-TTLS: Ident mismatch for Phase 2 "
1354                            "MSCHAPV2 (received Ident 0x%02x, expected 0x%02x)",
1355                            parse->mschapv2[0], data->ident);
1356                 return -1;
1357         }
1358         if (!data->auth_response_valid ||
1359             mschapv2_verify_auth_response(data->auth_response,
1360                                           parse->mschapv2 + 1, 42)) {
1361                 wpa_printf(MSG_WARNING, "EAP-TTLS: Invalid authenticator "
1362                            "response in Phase 2 MSCHAPV2 success request");
1363                 return -1;
1364         }
1365
1366         wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 MSCHAPV2 "
1367                    "authentication succeeded");
1368         if (data->ttls_version > 0) {
1369                 /*
1370                  * EAP-TTLSv1 uses TLS/IA FinalPhaseFinished to report
1371                  * success, so do not allow connection to be terminated
1372                  * yet.
1373                  */
1374                 ret->methodState = METHOD_CONT;
1375                 ret->decision = DECISION_COND_SUCC;
1376         } else {
1377                 ret->methodState = METHOD_DONE;
1378                 ret->decision = DECISION_UNCOND_SUCC;
1379                 data->phase2_success = 1;
1380         }
1381
1382         /*
1383          * Reply with empty data; authentication server will reply
1384          * with EAP-Success after this.
1385          */
1386         return 1;
1387 }
1388
1389
1390 #ifdef EAP_TNC
1391 static int eap_ttls_process_tnc_start(struct eap_sm *sm,
1392                                       struct eap_ttls_data *data,
1393                                       struct eap_method_ret *ret,
1394                                       struct ttls_parse_avp *parse,
1395                                       struct wpabuf **resp)
1396 {
1397         /* TNC uses inner EAP method after non-EAP TTLS phase 2. */
1398         if (parse->eapdata == NULL) {
1399                 wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received "
1400                            "unexpected tunneled data (no EAP)");
1401                 return -1;
1402         }
1403
1404         if (!data->ready_for_tnc) {
1405                 wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received "
1406                            "EAP after non-EAP, but not ready for TNC");
1407                 return -1;
1408         }
1409
1410         wpa_printf(MSG_DEBUG, "EAP-TTLS: Start TNC after completed "
1411                    "non-EAP method");
1412         data->tnc_started = 1;
1413
1414         if (eap_ttls_process_phase2_eap(sm, data, ret, parse, resp) < 0)
1415                 return -1;
1416
1417         return 0;
1418 }
1419 #endif /* EAP_TNC */
1420
1421
1422 static int eap_ttls_process_decrypted(struct eap_sm *sm,
1423                                       struct eap_ttls_data *data,
1424                                       struct eap_method_ret *ret,
1425                                       u8 identifier,
1426                                       struct ttls_parse_avp *parse,
1427                                       struct wpabuf *in_decrypted,
1428                                       struct wpabuf **out_data)
1429 {
1430         struct wpabuf *resp = NULL;
1431         struct eap_peer_config *config = eap_get_config(sm);
1432         int res;
1433         enum phase2_types phase2_type = data->phase2_type;
1434
1435 #ifdef EAP_TNC
1436         if (data->tnc_started)
1437                 phase2_type = EAP_TTLS_PHASE2_EAP;
1438 #endif /* EAP_TNC */
1439
1440         switch (phase2_type) {
1441         case EAP_TTLS_PHASE2_EAP:
1442                 if (eap_ttls_process_phase2_eap(sm, data, ret, parse, &resp) <
1443                     0)
1444                         return -1;
1445                 break;
1446         case EAP_TTLS_PHASE2_MSCHAPV2:
1447                 res = eap_ttls_process_phase2_mschapv2(sm, data, ret, parse);
1448 #ifdef EAP_TNC
1449                 if (res == 1 && parse->eapdata && data->phase2_success) {
1450                         /*
1451                          * TNC may be required as the next
1452                          * authentication method within the tunnel.
1453                          */
1454                         ret->methodState = METHOD_MAY_CONT;
1455                         data->ready_for_tnc = 1;
1456                         if (eap_ttls_process_tnc_start(sm, data, ret, parse,
1457                                                        &resp) == 0)
1458                                 break;
1459                 }
1460 #endif /* EAP_TNC */
1461                 return res;
1462         case EAP_TTLS_PHASE2_MSCHAP:
1463         case EAP_TTLS_PHASE2_PAP:
1464         case EAP_TTLS_PHASE2_CHAP:
1465 #ifdef EAP_TNC
1466                 if (eap_ttls_process_tnc_start(sm, data, ret, parse, &resp) <
1467                     0)
1468                         return -1;
1469                 break;
1470 #else /* EAP_TNC */
1471                 /* EAP-TTLS/{MSCHAP,PAP,CHAP} should not send any TLS tunneled
1472                  * requests to the supplicant */
1473                 wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received unexpected "
1474                            "tunneled data");
1475                 return -1;
1476 #endif /* EAP_TNC */
1477         }
1478
1479         if (resp) {
1480                 if (eap_ttls_encrypt_response(sm, data, resp, identifier,
1481                                               out_data) < 0)
1482                         return -1;
1483         } else if (config->pending_req_identity ||
1484                    config->pending_req_password ||
1485                    config->pending_req_otp ||
1486                    config->pending_req_new_password) {
1487                 wpabuf_free(data->pending_phase2_req);
1488                 data->pending_phase2_req = wpabuf_dup(in_decrypted);
1489         }
1490
1491         return 0;
1492 }
1493
1494
1495 #if EAP_TTLS_VERSION > 0
1496 static void eap_ttls_final_phase_finished(struct eap_sm *sm,
1497                                           struct eap_ttls_data *data,
1498                                           struct eap_method_ret *ret,
1499                                           u8 identifier,
1500                                           struct wpabuf **out_data)
1501 {
1502         wpa_printf(MSG_DEBUG, "EAP-TTLS: FinalPhaseFinished received");
1503         wpa_printf(MSG_INFO, "EAP-TTLS: TLS/IA authentication succeeded");
1504         ret->methodState = METHOD_DONE;
1505         ret->decision = DECISION_UNCOND_SUCC;
1506         data->phase2_success = 1;
1507         *out_data = eap_ttls_build_phase_finished(sm, data, identifier, 1);
1508         eap_ttls_v1_derive_key(sm, data);
1509 }
1510 #endif /* EAP_TTLS_VERSION */
1511
1512
1513 static int eap_ttls_implicit_identity_request(struct eap_sm *sm,
1514                                               struct eap_ttls_data *data,
1515                                               struct eap_method_ret *ret,
1516                                               u8 identifier,
1517                                               struct wpabuf **out_data)
1518 {
1519         int retval = 0;
1520         struct eap_hdr *hdr;
1521         struct wpabuf *resp;
1522
1523         hdr = (struct eap_hdr *) eap_ttls_fake_identity_request();
1524         if (hdr == NULL) {
1525                 ret->methodState = METHOD_DONE;
1526                 ret->decision = DECISION_FAIL;
1527                 return -1;
1528         }
1529
1530         resp = NULL;
1531         if (eap_ttls_phase2_request(sm, data, ret, hdr, &resp)) {
1532                 wpa_printf(MSG_INFO, "EAP-TTLS: Phase2 Request "
1533                            "processing failed");
1534                 retval = -1;
1535         } else {
1536                 retval = eap_ttls_encrypt_response(sm, data, resp, identifier,
1537                                                    out_data);
1538         }
1539
1540         os_free(hdr);
1541
1542         if (retval < 0) {
1543                 ret->methodState = METHOD_DONE;
1544                 ret->decision = DECISION_FAIL;
1545         }
1546
1547         return retval;
1548 }
1549
1550
1551 static int eap_ttls_phase2_start(struct eap_sm *sm, struct eap_ttls_data *data,
1552                                  struct eap_method_ret *ret, u8 identifier,
1553                                  struct wpabuf **out_data)
1554 {
1555         data->phase2_start = 0;
1556
1557         /*
1558          * EAP-TTLS does not use Phase2 on fast re-auth; this must be done only
1559          * if TLS part was indeed resuming a previous session. Most
1560          * Authentication Servers terminate EAP-TTLS before reaching this
1561          * point, but some do not. Make wpa_supplicant stop phase 2 here, if
1562          * needed.
1563          */
1564         if (data->reauth &&
1565             tls_connection_resumed(sm->ssl_ctx, data->ssl.conn)) {
1566                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Session resumption - "
1567                            "skip phase 2");
1568                 *out_data = eap_peer_tls_build_ack(identifier, EAP_TYPE_TTLS,
1569                                                    data->ttls_version);
1570                 ret->methodState = METHOD_DONE;
1571                 ret->decision = DECISION_UNCOND_SUCC;
1572                 data->phase2_success = 1;
1573                 return 0;
1574         }
1575
1576         return eap_ttls_implicit_identity_request(sm, data, ret, identifier,
1577                                                   out_data);
1578 }
1579
1580
1581 static int eap_ttls_decrypt(struct eap_sm *sm, struct eap_ttls_data *data,
1582                             struct eap_method_ret *ret, u8 identifier,
1583                             const struct wpabuf *in_data,
1584                             struct wpabuf **out_data)
1585 {
1586         struct wpabuf *in_decrypted = NULL;
1587         int retval = 0;
1588         struct ttls_parse_avp parse;
1589
1590         os_memset(&parse, 0, sizeof(parse));
1591
1592         wpa_printf(MSG_DEBUG, "EAP-TTLS: received %lu bytes encrypted data for"
1593                    " Phase 2",
1594                    in_data ? (unsigned long) wpabuf_len(in_data) : 0);
1595
1596         if (data->pending_phase2_req) {
1597                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Pending Phase 2 request - "
1598                            "skip decryption and use old data");
1599                 /* Clear TLS reassembly state. */
1600                 eap_peer_tls_reset_input(&data->ssl);
1601
1602                 in_decrypted = data->pending_phase2_req;
1603                 data->pending_phase2_req = NULL;
1604                 if (wpabuf_len(in_decrypted) == 0) {
1605                         wpabuf_free(in_decrypted);
1606                         return eap_ttls_implicit_identity_request(
1607                                 sm, data, ret, identifier, out_data);
1608                 }
1609                 goto continue_req;
1610         }
1611
1612         if ((in_data == NULL || wpabuf_len(in_data) == 0) &&
1613             data->phase2_start) {
1614                 return eap_ttls_phase2_start(sm, data, ret, identifier,
1615                                              out_data);
1616         }
1617
1618         if (in_data == NULL || wpabuf_len(in_data) == 0) {
1619                 /* Received TLS ACK - requesting more fragments */
1620                 return eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_TTLS,
1621                                             data->ttls_version,
1622                                             identifier, NULL, out_data);
1623         }
1624
1625         retval = eap_peer_tls_decrypt(sm, &data->ssl, in_data, &in_decrypted);
1626         if (retval)
1627                 goto done;
1628
1629 #if EAP_TTLS_VERSION > 0
1630         if (data->ttls_version > 0 &&
1631             (in_decrypted == NULL || wpabuf_len(in_decrypted) == 0) &&
1632             tls_connection_ia_final_phase_finished(sm->ssl_ctx,
1633                                                    data->ssl.conn)) {
1634                 eap_ttls_final_phase_finished(sm, data, ret, identifier,
1635                                               out_data);
1636                 goto done;
1637         }
1638 #endif /* EAP_TTLS_VERSION */
1639
1640 continue_req:
1641         data->phase2_start = 0;
1642
1643         if (eap_ttls_parse_avps(in_decrypted, &parse) < 0) {
1644                 retval = -1;
1645                 goto done;
1646         }
1647
1648         retval = eap_ttls_process_decrypted(sm, data, ret, identifier,
1649                                             &parse, in_decrypted, out_data);
1650
1651 done:
1652         wpabuf_free(in_decrypted);
1653         os_free(parse.eapdata);
1654
1655         if (retval < 0) {
1656                 ret->methodState = METHOD_DONE;
1657                 ret->decision = DECISION_FAIL;
1658         }
1659
1660         return retval;
1661 }
1662
1663
1664 static int eap_ttls_process_start(struct eap_sm *sm,
1665                                   struct eap_ttls_data *data, u8 flags,
1666                                   struct eap_method_ret *ret)
1667 {
1668         struct eap_peer_config *config = eap_get_config(sm);
1669
1670         wpa_printf(MSG_DEBUG, "EAP-TTLS: Start (server ver=%d, own ver=%d)",
1671                    flags & EAP_PEAP_VERSION_MASK, data->ttls_version);
1672 #if EAP_TTLS_VERSION > 0
1673         if ((flags & EAP_PEAP_VERSION_MASK) < data->ttls_version)
1674                 data->ttls_version = flags & EAP_PEAP_VERSION_MASK;
1675         if (data->force_ttls_version >= 0 &&
1676             data->force_ttls_version != data->ttls_version) {
1677                 wpa_printf(MSG_WARNING, "EAP-TTLS: Failed to select "
1678                            "forced TTLS version %d",
1679                            data->force_ttls_version);
1680                 ret->methodState = METHOD_DONE;
1681                 ret->decision = DECISION_FAIL;
1682                 ret->allowNotifications = FALSE;
1683                 return -1;
1684         }
1685         wpa_printf(MSG_DEBUG, "EAP-TTLS: Using TTLS version %d",
1686                    data->ttls_version);
1687
1688         if (data->ttls_version > 0)
1689                 data->ssl.tls_ia = 1;
1690 #endif /* EAP_TTLS_VERSION */
1691         if (!data->ssl_initialized &&
1692             eap_peer_tls_ssl_init(sm, &data->ssl, config)) {
1693                 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to initialize SSL.");
1694                 return -1;
1695         }
1696         data->ssl_initialized = 1;
1697
1698         wpa_printf(MSG_DEBUG, "EAP-TTLS: Start");
1699
1700         return 0;
1701 }
1702
1703
1704 static int eap_ttls_process_handshake(struct eap_sm *sm,
1705                                       struct eap_ttls_data *data,
1706                                       struct eap_method_ret *ret,
1707                                       u8 identifier,
1708                                       const u8 *in_data, size_t in_len,
1709                                       struct wpabuf **out_data)
1710 {
1711         int res;
1712
1713         res = eap_peer_tls_process_helper(sm, &data->ssl, EAP_TYPE_TTLS,
1714                                           data->ttls_version, identifier,
1715                                           in_data, in_len, out_data);
1716
1717         if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) {
1718                 wpa_printf(MSG_DEBUG, "EAP-TTLS: TLS done, proceed to "
1719                            "Phase 2");
1720                 if (data->resuming) {
1721                         wpa_printf(MSG_DEBUG, "EAP-TTLS: fast reauth - may "
1722                                    "skip Phase 2");
1723                         ret->decision = DECISION_COND_SUCC;
1724                         ret->methodState = METHOD_MAY_CONT;
1725                 }
1726                 data->phase2_start = 1;
1727                 if (data->ttls_version == 0)
1728                         eap_ttls_v0_derive_key(sm, data);
1729
1730                 if (*out_data == NULL || wpabuf_len(*out_data) == 0) {
1731                         if (eap_ttls_decrypt(sm, data, ret, identifier,
1732                                              NULL, out_data)) {
1733                                 wpa_printf(MSG_WARNING, "EAP-TTLS: "
1734                                            "failed to process early "
1735                                            "start for Phase 2");
1736                         }
1737                         res = 0;
1738                 }
1739                 data->resuming = 0;
1740         }
1741
1742         if (res == 2) {
1743                 struct wpabuf msg;
1744                 /*
1745                  * Application data included in the handshake message.
1746                  */
1747                 wpabuf_free(data->pending_phase2_req);
1748                 data->pending_phase2_req = *out_data;
1749                 *out_data = NULL;
1750                 wpabuf_set(&msg, in_data, in_len);
1751                 res = eap_ttls_decrypt(sm, data, ret, identifier, &msg,
1752                                        out_data);
1753         }
1754
1755         return res;
1756 }
1757
1758
1759 static void eap_ttls_check_auth_status(struct eap_sm *sm,
1760                                        struct eap_ttls_data *data,
1761                                        struct eap_method_ret *ret)
1762 {
1763         if (data->ttls_version == 0 && ret->methodState == METHOD_DONE) {
1764                 ret->allowNotifications = FALSE;
1765                 if (ret->decision == DECISION_UNCOND_SUCC ||
1766                     ret->decision == DECISION_COND_SUCC) {
1767                         wpa_printf(MSG_DEBUG, "EAP-TTLS: Authentication "
1768                                    "completed successfully");
1769                         data->phase2_success = 1;
1770 #ifdef EAP_TNC
1771                         if (!data->ready_for_tnc && !data->tnc_started) {
1772                                 /*
1773                                  * TNC may be required as the next
1774                                  * authentication method within the tunnel.
1775                                  */
1776                                 ret->methodState = METHOD_MAY_CONT;
1777                                 data->ready_for_tnc = 1;
1778                         }
1779 #endif /* EAP_TNC */
1780                 }
1781         } else if (data->ttls_version == 0 &&
1782                    ret->methodState == METHOD_MAY_CONT &&
1783                    (ret->decision == DECISION_UNCOND_SUCC ||
1784                     ret->decision == DECISION_COND_SUCC)) {
1785                         wpa_printf(MSG_DEBUG, "EAP-TTLS: Authentication "
1786                                    "completed successfully (MAY_CONT)");
1787                         data->phase2_success = 1;
1788         }
1789 }
1790
1791
1792 static struct wpabuf * eap_ttls_process(struct eap_sm *sm, void *priv,
1793                                         struct eap_method_ret *ret,
1794                                         const struct wpabuf *reqData)
1795 {
1796         size_t left;
1797         int res;
1798         u8 flags, id;
1799         struct wpabuf *resp;
1800         const u8 *pos;
1801         struct eap_ttls_data *data = priv;
1802
1803         pos = eap_peer_tls_process_init(sm, &data->ssl, EAP_TYPE_TTLS, ret,
1804                                         reqData, &left, &flags);
1805         if (pos == NULL)
1806                 return NULL;
1807         id = eap_get_id(reqData);
1808
1809         if (flags & EAP_TLS_FLAGS_START) {
1810                 if (eap_ttls_process_start(sm, data, flags, ret) < 0)
1811                         return NULL;
1812
1813                 /* RFC 5281, Ch. 9.2:
1814                  * "This packet MAY contain additional information in the form
1815                  * of AVPs, which may provide useful hints to the client"
1816                  * For now, ignore any potential extra data.
1817                  */
1818                 left = 0;
1819         } else if (!data->ssl_initialized) {
1820                 wpa_printf(MSG_DEBUG, "EAP-TTLS: First message did not "
1821                            "include Start flag");
1822                 ret->methodState = METHOD_DONE;
1823                 ret->decision = DECISION_FAIL;
1824                 ret->allowNotifications = FALSE;
1825                 return NULL;
1826         }
1827
1828         resp = NULL;
1829         if (tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&
1830             !data->resuming) {
1831                 struct wpabuf msg;
1832                 wpabuf_set(&msg, pos, left);
1833                 res = eap_ttls_decrypt(sm, data, ret, id, &msg, &resp);
1834         } else {
1835                 res = eap_ttls_process_handshake(sm, data, ret, id,
1836                                                  pos, left, &resp);
1837         }
1838
1839         eap_ttls_check_auth_status(sm, data, ret);
1840
1841         /* FIX: what about res == -1? Could just move all error processing into
1842          * the other functions and get rid of this res==1 case here. */
1843         if (res == 1) {
1844                 wpabuf_free(resp);
1845                 return eap_peer_tls_build_ack(id, EAP_TYPE_TTLS,
1846                                               data->ttls_version);
1847         }
1848         return resp;
1849 }
1850
1851
1852 static Boolean eap_ttls_has_reauth_data(struct eap_sm *sm, void *priv)
1853 {
1854         struct eap_ttls_data *data = priv;
1855         return tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&
1856                 data->phase2_success;
1857 }
1858
1859
1860 static void eap_ttls_deinit_for_reauth(struct eap_sm *sm, void *priv)
1861 {
1862         struct eap_ttls_data *data = priv;
1863         wpabuf_free(data->pending_phase2_req);
1864         data->pending_phase2_req = NULL;
1865 #ifdef EAP_TNC
1866         data->ready_for_tnc = 0;
1867         data->tnc_started = 0;
1868 #endif /* EAP_TNC */
1869 }
1870
1871
1872 static void * eap_ttls_init_for_reauth(struct eap_sm *sm, void *priv)
1873 {
1874         struct eap_ttls_data *data = priv;
1875         os_free(data->key_data);
1876         data->key_data = NULL;
1877         if (eap_peer_tls_reauth_init(sm, &data->ssl)) {
1878                 os_free(data);
1879                 return NULL;
1880         }
1881         if (data->phase2_priv && data->phase2_method &&
1882             data->phase2_method->init_for_reauth)
1883                 data->phase2_method->init_for_reauth(sm, data->phase2_priv);
1884         data->phase2_start = 0;
1885         data->phase2_success = 0;
1886         data->resuming = 1;
1887         data->reauth = 1;
1888         return priv;
1889 }
1890
1891
1892 static int eap_ttls_get_status(struct eap_sm *sm, void *priv, char *buf,
1893                                size_t buflen, int verbose)
1894 {
1895         struct eap_ttls_data *data = priv;
1896         int len, ret;
1897
1898         len = eap_peer_tls_status(sm, &data->ssl, buf, buflen, verbose);
1899         ret = os_snprintf(buf + len, buflen - len,
1900                           "EAP-TTLSv%d Phase2 method=",
1901                           data->ttls_version);
1902         if (ret < 0 || (size_t) ret >= buflen - len)
1903                 return len;
1904         len += ret;
1905         switch (data->phase2_type) {
1906         case EAP_TTLS_PHASE2_EAP:
1907                 ret = os_snprintf(buf + len, buflen - len, "EAP-%s\n",
1908                                   data->phase2_method ?
1909                                   data->phase2_method->name : "?");
1910                 break;
1911         case EAP_TTLS_PHASE2_MSCHAPV2:
1912                 ret = os_snprintf(buf + len, buflen - len, "MSCHAPV2\n");
1913                 break;
1914         case EAP_TTLS_PHASE2_MSCHAP:
1915                 ret = os_snprintf(buf + len, buflen - len, "MSCHAP\n");
1916                 break;
1917         case EAP_TTLS_PHASE2_PAP:
1918                 ret = os_snprintf(buf + len, buflen - len, "PAP\n");
1919                 break;
1920         case EAP_TTLS_PHASE2_CHAP:
1921                 ret = os_snprintf(buf + len, buflen - len, "CHAP\n");
1922                 break;
1923         default:
1924                 ret = 0;
1925                 break;
1926         }
1927         if (ret < 0 || (size_t) ret >= buflen - len)
1928                 return len;
1929         len += ret;
1930
1931         return len;
1932 }
1933
1934
1935 static Boolean eap_ttls_isKeyAvailable(struct eap_sm *sm, void *priv)
1936 {
1937         struct eap_ttls_data *data = priv;
1938         return data->key_data != NULL && data->phase2_success;
1939 }
1940
1941
1942 static u8 * eap_ttls_getKey(struct eap_sm *sm, void *priv, size_t *len)
1943 {
1944         struct eap_ttls_data *data = priv;
1945         u8 *key;
1946
1947         if (data->key_data == NULL || !data->phase2_success)
1948                 return NULL;
1949
1950         key = os_malloc(EAP_TLS_KEY_LEN);
1951         if (key == NULL)
1952                 return NULL;
1953
1954         *len = EAP_TLS_KEY_LEN;
1955         os_memcpy(key, data->key_data, EAP_TLS_KEY_LEN);
1956
1957         return key;
1958 }
1959
1960
1961 int eap_peer_ttls_register(void)
1962 {
1963         struct eap_method *eap;
1964         int ret;
1965
1966         eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
1967                                     EAP_VENDOR_IETF, EAP_TYPE_TTLS, "TTLS");
1968         if (eap == NULL)
1969                 return -1;
1970
1971         eap->init = eap_ttls_init;
1972         eap->deinit = eap_ttls_deinit;
1973         eap->process = eap_ttls_process;
1974         eap->isKeyAvailable = eap_ttls_isKeyAvailable;
1975         eap->getKey = eap_ttls_getKey;
1976         eap->get_status = eap_ttls_get_status;
1977         eap->has_reauth_data = eap_ttls_has_reauth_data;
1978         eap->deinit_for_reauth = eap_ttls_deinit_for_reauth;
1979         eap->init_for_reauth = eap_ttls_init_for_reauth;
1980
1981         ret = eap_peer_method_register(eap);
1982         if (ret)
1983                 eap_peer_method_free(eap);
1984         return ret;
1985 }