src/modules/rlm_eap/types/rlm_eap_leap/rlm_eap_leap.c

   1 /*
   2  * rlm_eap_leap.c    Handles that are called from eap
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2003 Alan DeKok <aland@freeradius.org>
  21  * Copyright 2006 The FreeRADIUS server project
  22  */
  23
  24 #include <freeradius-devel/ident.h>
  25 RCSID("$Id$")
  26
  27 #include <stdio.h>
  28 #include <stdlib.h>
  29
  30 #include "eap_leap.h"
  31
  32
  33 /*
  34  * send an initial eap-leap request
  35  * ie access challenge to the user/peer.
  36
  37  * Frame eap reply packet.
  38  * len = header + type + leap_typedata
  39  * leap_typedata = value_size + value
  40  */
  41 static int leap_initiate(UNUSED void *instance, EAP_HANDLER *handler)
  42 {
  43         leap_session_t  *session;
  44         LEAP_PACKET     *reply;
  45
  46         DEBUG2("  rlm_eap_leap: Stage 2");
  47
  48         /*
  49          *      LEAP requires a User-Name attribute
  50          */
  51         if (!handler->request->username) {
  52                 DEBUG2("  rlm_eap_leap: User-Name is required for EAP-LEAP authentication.");
  53                 return 0;
  54         }
  55
  56         reply = eapleap_initiate(handler->eap_ds, handler->request->username);
  57         if (reply == NULL)
  58                 return 0;
  59
  60         eapleap_compose(handler->eap_ds, reply);
  61
  62         handler->opaque = malloc(sizeof(leap_session_t));
  63         if (!handler->opaque) {
  64           radlog(L_ERR, "rlm_eap_leap: Out of memory");
  65           eapleap_free(&reply);
  66           return 0;
  67         }
  68
  69         /*
  70          *      Remember which stage we're in, and which challenge
  71          *      we sent to the AP.  The later stages will take care
  72          *      of filling in the peer response.
  73          */
  74         session = (leap_session_t *) handler->opaque;
  75         handler->free_opaque = free; /* just malloc'd memory */
  76
  77         session->stage = 4;     /* the next stage we're in */
  78         memcpy(session->peer_challenge, reply->challenge, reply->count);
  79
  80         DEBUG2("  rlm_eap_leap: Successfully initiated");
  81
  82         /*
  83          *      The next stage to process the packet.
  84          */
  85         handler->stage = AUTHENTICATE;
  86
  87         eapleap_free(&reply);
  88         return 1;
  89 }
  90
  91 static int leap_authenticate(UNUSED void *instance, EAP_HANDLER *handler)
  92 {
  93         int             rcode;
  94         leap_session_t  *session;
  95         LEAP_PACKET     *packet;
  96         LEAP_PACKET     *reply;
  97         char*           username;
  98         VALUE_PAIR      *password;
  99
 100         if (!handler->opaque) {
 101                 radlog(L_ERR, "rlm_eap_leap: Cannot authenticate without LEAP history");
 102                 return 0;
 103         }
 104         session = (leap_session_t *) handler->opaque;
 105         reply = NULL;
 106
 107         /*
 108          *      Extract the LEAP packet.
 109          */
 110         if (!(packet = eapleap_extract(handler->eap_ds)))
 111                 return 0;
 112
 113         username = (char *)handler->request->username->vp_strvalue;
 114
 115         /*
 116          *      The password is never sent over the wire.
 117          *      Always get the configured password, for each user.
 118          */
 119         password = pairfind(handler->request->config_items, PW_CLEARTEXT_PASSWORD, 0, TAG_ANY);
 120         if (!password) password = pairfind(handler->request->config_items, PW_NT_PASSWORD, 0, TAG_ANY);
 121         if (!password) {
 122                 DEBUG2("rlm_eap_leap: No Cleartext-Password or NT-Password configured for this user");
 123                 eapleap_free(&packet);
 124                 return 0;
 125         }
 126
 127         /*
 128          *      We've already sent the AP challenge.  This packet
 129          *      should contain the NtChallengeResponse
 130          */
 131         switch (session->stage) {
 132         case 4:                 /* Verify NtChallengeResponse */
 133                 DEBUG2("  rlm_eap_leap: Stage 4");
 134                 rcode = eapleap_stage4(packet, password, session);
 135                 session->stage = 6;
 136
 137                 /*
 138                  *      We send EAP-Success or EAP-Fail, and not
 139                  *      any LEAP packet.  So we return here.
 140                  */
 141                 if (!rcode) {
 142                         handler->eap_ds->request->code = PW_EAP_FAILURE;
 143                         eapleap_free(&packet);
 144                         return 0;
 145                 }
 146
 147                 handler->eap_ds->request->code = PW_EAP_SUCCESS;
 148
 149                 /*
 150                  *      Do this only for Success.
 151                  */
 152                 handler->eap_ds->request->id = handler->eap_ds->response->id + 1;
 153                 handler->eap_ds->set_request_id = 1;
 154
 155                 /*
 156                  *      LEAP requires a challenge in stage 4, not
 157                  *      an Access-Accept, which is normally returned
 158                  *      by eap_compose() in eap.c, when the EAP reply code
 159                  *      is EAP_SUCCESS.
 160                  */
 161                 handler->request->reply->code = PW_ACCESS_CHALLENGE;
 162                 eapleap_free(&packet);
 163                 return 1;
 164                 break;
 165
 166         case 6:                 /* Issue session key */
 167                 DEBUG2("  rlm_eap_leap: Stage 6");
 168                 reply = eapleap_stage6(packet, handler->request,
 169                                        handler->request->username, password,
 170                                        session, &handler->request->reply->vps);
 171                 break;
 172
 173                 /*
 174                  *      Stages 1, 3, and 5 are requests from the AP.
 175                  *      Stage 2 is handled by initiate()
 176                  */
 177         default:
 178                 radlog(L_ERR, "  rlm_eap_leap: Internal sanity check failed on stage");
 179                 break;
 180         }
 181
 182         eapleap_free(&packet);
 183
 184         /*
 185          *      Process the packet.  We don't care about any previous
 186          *      EAP packets, as
 187          */
 188         if (!reply) {
 189                 return 0;
 190         }
 191
 192         eapleap_compose(handler->eap_ds, reply);
 193
 194         eapleap_free(&reply);
 195         return 1;
 196 }
 197
 198 /*
 199  *      The module name should be the only globally exported symbol.
 200  *      That is, everything else should be 'static'.
 201  */
 202 EAP_TYPE rlm_eap_leap = {
 203         "eap_leap",
 204         NULL,                   /* attach */
 205         leap_initiate,          /* Start the initial request, after Identity */
 206         NULL,                   /* authorization */
 207         leap_authenticate,      /* authentication */
 208         NULL,                   /* detach */
 209 };