src/modules/rlm_eap/rlm_eap.c

   1 /*
   2  * rlm_eap.c  contains handles that are called from modules.
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  *
  20  * Copyright 2000-2003  The FreeRADIUS server project
  21  * Copyright 2001  hereUare Communications, Inc. <raghud@hereuare.com>
  22  * Copyright 2003  Alan DeKok <aland@freeradius.org>
  23  */
  24
  25 #include "autoconf.h"
  26 #include "rlm_eap.h"
  27 #include "modules.h"
  28
  29 static const char rcsid[] = "$Id$";
  30
  31 static const CONF_PARSER module_config[] = {
  32         { "default_eap_type", PW_TYPE_STRING_PTR,
  33           offsetof(rlm_eap_t, default_eap_type_name), NULL, "md5" },
  34         { "timer_expire", PW_TYPE_INTEGER,
  35           offsetof(rlm_eap_t, timer_limit), NULL, "60"},
  36         { "ignore_unknown_eap_types", PW_TYPE_BOOLEAN,
  37           offsetof(rlm_eap_t, ignore_unknown_eap_types), NULL, "no" },
  38
  39         { NULL, -1, 0, NULL, NULL }           /* end the list */
  40 };
  41
  42 static int eap_init(void)
  43 {
  44         return 0;
  45 }
  46
  47
  48 /*
  49  * delete all the allocated space by eap module
  50  */
  51 static int eap_detach(void *instance)
  52 {
  53         rlm_eap_t *inst;
  54         int i;
  55
  56         inst = (rlm_eap_t *)instance;
  57
  58         eaplist_free(inst);
  59
  60         for (i = 0; i < PW_EAP_MAX_TYPES; i++) {
  61                 if (inst->types[i]) eaptype_free(inst->types[i]);
  62                 inst->types[i] = NULL;
  63         }
  64
  65 #ifdef HAVE_PTHREAD_H
  66         pthread_mutex_destroy(&(inst->session_mutex));
  67         pthread_mutex_destroy(&(inst->module_mutex));
  68 #endif
  69
  70         if (inst->default_eap_type_name) free(inst->default_eap_type_name);
  71         free(inst);
  72
  73         return 0;
  74 }
  75
  76
  77 /*
  78  * read the config section and load all the eap authentication types present.
  79  */
  80 static int eap_instantiate(CONF_SECTION *cs, void **instance)
  81 {
  82         int             eap_type;
  83         int             num_types;
  84         CONF_SECTION    *scs;
  85         rlm_eap_t       *inst;
  86
  87         inst = (rlm_eap_t *) malloc(sizeof(*inst));
  88         if (!inst) {
  89                 return -1;
  90         }
  91         memset(inst, 0, sizeof(*inst));
  92         if (cf_section_parse(cs, inst, module_config) < 0) {
  93                 eap_detach(inst);
  94                 return -1;
  95         }
  96
  97         /* Load all the configured EAP-Types */
  98         num_types = 0;
  99         for(scs=cf_subsection_find_next(cs, NULL, NULL);
 100                 scs != NULL;
 101                 scs=cf_subsection_find_next(cs, scs, NULL)) {
 102
 103                 char    *auth_type;
 104
 105                 auth_type = cf_section_name1(scs);
 106
 107                 if (!auth_type)  continue;
 108
 109                 eap_type = eaptype_name2type(auth_type);
 110                 if (eap_type < 0) {
 111                         radlog(L_ERR|L_CONS, "rlm_eap: Unknown EAP type %s",
 112                                auth_type);
 113                         eap_detach(inst);
 114                         return -1;
 115                 }
 116
 117                 /*
 118                  *      If we're asked to load TTLS or PEAP, ensure
 119                  *      that we've first loaded TLS.
 120                  */
 121                 if (((eap_type == PW_EAP_TTLS) ||
 122                      (eap_type == PW_EAP_PEAP)) &&
 123                     (inst->types[PW_EAP_TLS] == NULL)) {
 124                         radlog(L_ERR, "rlm_eap: Unable to load EAP-Type/%s, as EAP-Type/TLS is required first.",
 125                                auth_type);
 126                         return -1;
 127                 }
 128
 129                 /*
 130                  *      Load the type.
 131                  */
 132                 if (eaptype_load(&inst->types[eap_type], eap_type, scs) < 0) {
 133                         eap_detach(inst);
 134                         return -1;
 135                 }
 136
 137                 num_types++;    /* successfully loaded one more types */
 138         }
 139
 140         if (num_types == 0) {
 141                 radlog(L_ERR|L_CONS, "rlm_eap: No EAP type configured, module cannot do anything.");
 142                 eap_detach(inst);
 143                 return -1;
 144         }
 145
 146         /*
 147          *      Ensure that the default EAP type is loaded.
 148          */
 149         eap_type = eaptype_name2type(inst->default_eap_type_name);
 150         if (eap_type < 0) {
 151                 radlog(L_ERR|L_CONS, "rlm_eap: Unknown default EAP type %s",
 152                        inst->default_eap_type_name);
 153                 eap_detach(inst);
 154                 return -1;
 155         }
 156
 157         if (inst->types[eap_type] == NULL) {
 158                 radlog(L_ERR|L_CONS, "rlm_eap: No such sub-type for default EAP type %s",
 159                        inst->default_eap_type_name);
 160                 eap_detach(inst);
 161                 return -1;
 162         }
 163         inst->default_eap_type = eap_type; /* save the numerical type */
 164
 165         /*
 166          *      List of sessions are set to NULL by the memset
 167          *      of 'inst', above.
 168          */
 169
 170         /* Generate a state key, specific to eap */
 171         generate_key();
 172
 173 #ifdef HAVE_PTHREAD_H
 174         pthread_mutex_init(&(inst->session_mutex), NULL);
 175         pthread_mutex_init(&(inst->module_mutex), NULL);
 176 #endif
 177
 178         *instance = inst;
 179         return 0;
 180 }
 181
 182 /*
 183  *      Dumb wrapper.
 184  *      FIXME: this should be done more intelligently...
 185  */
 186 static void my_handler_free(void *data)
 187 {
 188   EAP_HANDLER *handler = (EAP_HANDLER *) data;
 189   eap_handler_free(&handler);
 190 }
 191
 192 /*
 193  *      For backwards compatibility.
 194  */
 195 static int eap_authenticate(void *instance, REQUEST *request)
 196 {
 197         rlm_eap_t       *inst;
 198         EAP_HANDLER     *handler;
 199         eap_packet_t    *eap_packet;
 200         int             rcode;
 201 #ifdef HAVE_PTHREAD_H
 202         int             locked = FALSE;
 203 #endif
 204
 205         inst = (rlm_eap_t *) instance;
 206
 207         /*
 208          *      Get the eap packet  to start with
 209          */
 210         eap_packet = eap_attribute(request->packet->vps);
 211         if (eap_packet == NULL) {
 212                 radlog(L_ERR, "rlm_eap: Malformed EAP Message");
 213                 return RLM_MODULE_FAIL;
 214         }
 215
 216         /*
 217          *      Create the eap handler.  The eap_packet will end up being
 218          *      "swallowed" into the handler, so we can't access it after
 219          *      this call.
 220          */
 221         handler = eap_handler(inst, &eap_packet, request);
 222         if (handler == NULL) {
 223                 DEBUG2("  rlm_eap: Failed in handler");
 224                 return RLM_MODULE_INVALID;
 225         }
 226
 227         /*
 228          *      If it's a recursive request, then disallow
 229          *      TLS, TTLS, and PEAP, inside of the TLS tunnel.
 230          */
 231         if ((request->options & RAD_REQUEST_OPTION_FAKE_REQUEST) != 0) {
 232                 switch(handler->eap_ds->response->type.type) {
 233                 case PW_EAP_TLS:
 234                 case PW_EAP_TTLS:
 235                 case PW_EAP_PEAP:
 236                         DEBUG2(" rlm_eap: Unable to tunnel TLS inside of TLS");
 237                         eap_fail(handler);
 238                         eap_handler_free(&handler);
 239                         return RLM_MODULE_INVALID;
 240                         break;
 241
 242                 default:        /* It may be OK, allow it to proceed */
 243                         break;
 244
 245                 }
 246         }
 247
 248 #ifdef HAVE_PTHREAD_H
 249         else {                  /* it's a normal request from a NAS */
 250                 /*
 251                  *      The OpenSSL code isn't strictly thread-safe,
 252                  *      as we've got to provide callback functions.
 253                  *
 254                  *      Rather than doing that, we just ensure that the
 255                  *      sub-modules are locked via a mutex.
 256                  *
 257                  *      Don't lock it if we're calling ourselves recursively,
 258                  *      we've already got the lock.
 259                  */
 260                 pthread_mutex_lock(&(inst->module_mutex));
 261                 locked = TRUE;  /* for recursive calls to the module */
 262         }
 263 #endif
 264
 265         /*
 266          *      Select the appropriate eap_type or default to the
 267          *      configured one
 268          */
 269         rcode = eaptype_select(inst, handler);
 270
 271 #ifdef HAVE_PTHREAD_H
 272         if (locked) pthread_mutex_unlock(&(inst->module_mutex));
 273 #endif
 274
 275         /*
 276          *      If it failed, die.
 277          */
 278         if (rcode == EAP_INVALID) {
 279                 eap_fail(handler);
 280                 eap_handler_free(&handler);
 281                 DEBUG2("  rlm_eap: Failed in EAP select");
 282                 return RLM_MODULE_INVALID;
 283         }
 284
 285         /*
 286          *      Maybe the request was marked to be proxied.  If so,
 287          *      proxy it.
 288          */
 289         if (request->proxy != NULL) {
 290                 VALUE_PAIR *vp;
 291
 292                 rad_assert(request->proxy_reply == NULL);
 293
 294                 /*
 295                  *      Add the handle to the proxied list, so that we
 296                  *      can retrieve it in the post-proxy stage, and
 297                  *      send a response.
 298                  */
 299                 rcode = request_data_add(request,
 300                                          instance, REQUEST_DATA_EAP_HANDLER,
 301                                          handler, my_handler_free);
 302                 rad_assert(rcode == 0);
 303
 304                 /*
 305                  *      Some simple sanity checks.  These should really
 306                  *      be handled by the radius library...
 307                  */
 308                 vp = pairfind(request->proxy->vps, PW_EAP_MESSAGE);
 309                 if (vp) {
 310                         vp = pairfind(request->proxy->vps, PW_MESSAGE_AUTHENTICATOR);
 311                         if (!vp) {
 312                                 vp = pairmake("Message-Authenticator",
 313                                               "0x00", T_OP_EQ);
 314                                 rad_assert(vp != NULL);
 315                                 pairadd(&(request->proxy->vps), vp);
 316                         }
 317                 }
 318
 319                 /*
 320                  *      Delete the "proxied to" attribute, as it's
 321                  *      set to 127.0.0.1 for tunneled requests, and
 322                  *      we don't want to tell the world that...
 323                  */
 324                 pairdelete(&request->proxy->vps, PW_FREERADIUS_PROXIED_TO);
 325
 326                 return RLM_MODULE_HANDLED;
 327         }
 328
 329
 330         /*
 331          *      We are done, wrap the EAP-request in RADIUS to send
 332          *      with all other required radius attributes
 333          */
 334         rcode = eap_compose(handler);
 335
 336         /*
 337          *      Add to the list only if it is EAP-Request, OR if
 338          *      it's LEAP, and a response.
 339          */
 340         if ((handler->eap_ds->request->code == PW_EAP_REQUEST) &&
 341             (handler->eap_ds->request->type.type >= PW_EAP_MD5)) {
 342                 eaplist_add(inst, handler);
 343
 344                 /*
 345                  *      LEAP is a little different.  At Stage 4,
 346                  *      it sends an EAP-Success message, but we still
 347                  *      need to keep the State attribute & session
 348                  *      data structure around for the AP Challenge.
 349                  *
 350                  *      At stage 6, LEAP sends an EAP-Response, which
 351                  *      isn't put into the list.
 352                  */
 353         } else if ((handler->eap_ds->response->code == PW_EAP_RESPONSE) &&
 354                    (handler->eap_ds->response->type.type == PW_EAP_LEAP) &&
 355                    (handler->eap_ds->request->code == PW_EAP_SUCCESS) &&
 356                    (handler->eap_ds->request->type.type == 0)) {
 357
 358                 eaplist_add(inst, handler);
 359
 360         } else {
 361                 DEBUG2("  rlm_eap: Freeing handler");
 362                 /* handler is not required any more, free it now */
 363                 eap_handler_free(&handler);
 364         }
 365
 366         /*
 367          *      If it's an Access-Accept, RFC 2869, Section 2.3.1
 368          *      says that we MUST include a User-Name attribute in the
 369          *      Access-Accept.
 370          */
 371         if ((request->reply->code == PW_AUTHENTICATION_ACK) &&
 372             request->username) {
 373                 VALUE_PAIR *vp;
 374
 375                 /*
 376                  *      Doesn't exist, add it in.
 377                  */
 378                 vp = pairfind(request->reply->vps, PW_USER_NAME);
 379                 if (!vp) {
 380                         vp = pairmake("User-Name", request->username->strvalue,
 381                                       T_OP_EQ);
 382                         rad_assert(vp != NULL);
 383                         pairadd(&(request->reply->vps), vp);
 384                 }
 385         }
 386
 387         return rcode;
 388 }
 389
 390 /*
 391  * EAP authorization DEPENDS on other rlm authorizations,
 392  * to check for user existance & get their configured values.
 393  * It Handles EAP-START Messages, User-Name initilization.
 394  */
 395 static int eap_authorize(void *instance, REQUEST *request)
 396 {
 397         rlm_eap_t       *inst;
 398         int             status;
 399         VALUE_PAIR      *vp;
 400
 401         inst = (rlm_eap_t *)instance;
 402
 403         /*
 404          *      We don't do authorization again, once we've seen the
 405          *      proxy reply (or the proxied packet)
 406          */
 407         if (request->proxy != NULL)
 408                 return RLM_MODULE_NOOP;
 409
 410         /*
 411          *      For EAP_START, send Access-Challenge with EAP Identity
 412          *      request.  even when we have to proxy this request
 413          *
 414          *      RFC 2869, Section 2.3.1 notes that the "domain" of the
 415          *      user, (i.e. where to proxy him) comes from the EAP-Identity,
 416          *      so we CANNOT proxy the user, until we know his identity.
 417          *
 418          *      We therefore send an EAP Identity request.
 419          */
 420         status = eap_start(inst, request);
 421         switch(status) {
 422         case EAP_NOOP:
 423                 return RLM_MODULE_NOOP;
 424         case EAP_FAIL:
 425                 return RLM_MODULE_FAIL;
 426         case EAP_FOUND:
 427                 return RLM_MODULE_HANDLED;
 428         case EAP_NOTFOUND:
 429         default:
 430                 break;
 431         }
 432
 433         /*
 434          *      RFC 2869, Section 2.3.1.  If a NAS sends an EAP-Identity,
 435          *      it MUST copy the identity into the User-Name attribute.
 436          *
 437          *      But we don't worry about that too much.  We depend on
 438          *      each EAP sub-module to look for handler->request->username,
 439          *      and to get excited if it doesn't appear.
 440          */
 441
 442         vp = pairfind(request->config_items, PW_AUTH_TYPE);
 443         if ((!vp) ||
 444             (vp->lvalue != PW_AUTHTYPE_REJECT)) {
 445                 vp = pairmake("Auth-Type", "EAP", T_OP_EQ);
 446                 if (!vp) {
 447                         return RLM_MODULE_FAIL;
 448                 }
 449                 pairadd(&request->config_items, vp);
 450         }
 451
 452         return RLM_MODULE_UPDATED;
 453 }
 454
 455 /*
 456  *      If we're proxying EAP, then there may be magic we need
 457  *      to do.
 458  */
 459 static int eap_post_proxy(void *inst, REQUEST *request)
 460 {
 461         int             i, len;
 462         VALUE_PAIR      *vp;
 463         EAP_HANDLER     *handler;
 464
 465         /*
 466          *      If there was a handler associated with this request,
 467          *      then it's a tunneled request which was proxied...
 468          */
 469         handler = request_data_get(request, inst, REQUEST_DATA_EAP_HANDLER);
 470         if (handler != NULL) {
 471                 int             rcode;
 472                 eap_tunnel_data_t *data;
 473
 474                 /*
 475                  *      Grab the tunnel callbacks from the request.
 476                  */
 477                 data = (eap_tunnel_data_t *) request_data_get(request,
 478                                                               request->proxy,
 479                                                               REQUEST_DATA_EAP_TUNNEL_CALLBACK);
 480                 if (!data) {
 481                         radlog(L_ERR, "rlm_eap: Failed to retrieve callback for tunneled session!");
 482                         eap_handler_free(&handler);
 483                         return RLM_MODULE_FAIL;
 484                 }
 485
 486                 /*
 487                  *      Do the callback...
 488                  */
 489                 rcode = data->callback(handler, data->tls_session);
 490                 free(data);
 491                 if (rcode == 0) {
 492                         eap_handler_free(&handler);
 493                         return RLM_MODULE_REJECT;
 494                 }
 495
 496                 /*
 497                  *      We are done, wrap the EAP-request in RADIUS to send
 498                  *      with all other required radius attributes
 499                  */
 500                 rcode = eap_compose(handler);
 501
 502                 /*
 503                  *      Add to the list only if it is EAP-Request, OR if
 504                  *      it's LEAP, and a response.
 505                  */
 506                 if ((handler->eap_ds->request->code == PW_EAP_REQUEST) &&
 507                     (handler->eap_ds->request->type.type >= PW_EAP_MD5)) {
 508                         eaplist_add(inst, handler);
 509
 510                 } else {        /* couldn't have been LEAP, there's no tunnel */
 511                         DEBUG2("  rlm_eap: Freeing handler");
 512                         /* handler is not required any more, free it now */
 513                         eap_handler_free(&handler);
 514                 }
 515
 516                 /*
 517                  *      If it's an Access-Accept, RFC 2869, Section 2.3.1
 518                  *      says that we MUST include a User-Name attribute in the
 519                  *      Access-Accept.
 520                  */
 521                 if ((request->reply->code == PW_AUTHENTICATION_ACK) &&
 522                     request->username) {
 523                         /*
 524                          *      Doesn't exist, add it in.
 525                          */
 526                         vp = pairfind(request->reply->vps, PW_USER_NAME);
 527                         if (!vp) {
 528                                 vp = pairmake("User-Name", request->username->strvalue,
 529                                               T_OP_EQ);
 530                                 rad_assert(vp != NULL);
 531                                 pairadd(&(request->reply->vps), vp);
 532                         }
 533                 }
 534
 535                 return RLM_MODULE_OK;
 536         }
 537
 538
 539         /*
 540          *      There may be more than one Cisco-AVPair.
 541          *      Ensure we find the one with the LEAP attribute.
 542          */
 543         vp = request->proxy_reply->vps;
 544         for (;;) {
 545                 /*
 546                  *      Hmm... there's got to be a better way to
 547                  *      discover codes for vendor attributes.
 548                  *
 549                  *      This is vendor Cisco (9), Cisco-AVPair
 550                  *      attribute (1)
 551                  */
 552                 vp = pairfind(vp, (9 << 16)  | 1);
 553                 if (!vp) {
 554                         return RLM_MODULE_NOOP;
 555                 }
 556
 557                 /*
 558                  *      If it's "leap:session-key", then stop.
 559                  *
 560                  *      The format is VERY specific!
 561                  */
 562                 if (strncasecmp(vp->strvalue, "leap:session-key=", 17) == 0) {
 563                         break;
 564                 }
 565         }
 566
 567         /*
 568          *      The format is very specific.
 569          */
 570         if (vp->length != 17 + 34) {
 571                 DEBUG2("  rlm_eap: Cisco-AVPair with leap:session-key has incorrect length %d: Expected %d",
 572                        vp->length, 17 + 34);
 573                 return RLM_MODULE_NOOP;
 574         }
 575
 576         /*
 577          *      Decrypt the session key, using the proxy data.
 578          */
 579         i = 34;                 /* starts off with 34 octets */
 580         len = rad_tunnel_pwdecode(vp->strvalue + 17, &i,
 581                                   request->proxysecret,
 582                                   request->proxy->vector);
 583
 584         /*
 585          *      FIXME: Assert that i == 16.
 586          */
 587
 588         /*
 589          *      Encrypt the session key again, using the request data.
 590          */
 591         rad_tunnel_pwencode(vp->strvalue + 17, &len,
 592                             request->secret,
 593                             request->packet->vector);
 594
 595         return RLM_MODULE_UPDATED;
 596 }
 597
 598
 599 /*
 600  *      The module name should be the only globally exported symbol.
 601  *      That is, everything else should be 'static'.
 602  */
 603 module_t rlm_eap = {
 604         "eap",
 605         RLM_TYPE_THREAD_SAFE,           /* type */
 606         eap_init,                       /* initialization */
 607         eap_instantiate,                /* instantiation */
 608         {
 609                 eap_authenticate,       /* authentication */
 610                 eap_authorize,          /* authorization */
 611                 NULL,                   /* preaccounting */
 612                 NULL,                   /* accounting */
 613                 NULL,                   /* checksimul */
 614                 NULL,                   /* pre-proxy */
 615                 eap_post_proxy,         /* post-proxy */
 616                 NULL                    /* post-auth */
 617         },
 618         eap_detach,                     /* detach */
 619         NULL,                           /* destroy */
 620 };