src/modules/rlm_eap/types/rlm_eap_peap/peap.c

   1 /*
   2  * peap.c contains the interfaces that are called from eap
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  *   Copyright 2003 Alan DeKok <aland@freeradius.org>
  21  *   Copyright 2006 The FreeRADIUS server project
  22  */
  23
  24 #include <freeradius-devel/ident.h>
  25 RCSID("$Id$")
  26
  27 #include "eap_peap.h"
  28
  29 static int setup_fake_request(REQUEST *request, REQUEST *fake, peap_tunnel_t *t);
  30
  31 /*
  32  *      Send protected EAP-Failure
  33  *
  34  *       Result-TLV = Failure
  35  */
  36 static int eappeap_failure(EAP_HANDLER *handler, tls_session_t *tls_session)
  37 {
  38         uint8_t tlv_packet[11];
  39         REQUEST *request = handler->request;
  40
  41         RDEBUG2("FAILURE");
  42
  43         tlv_packet[0] = PW_EAP_REQUEST;
  44         tlv_packet[1] = handler->eap_ds->response->id +1;
  45         tlv_packet[2] = 0;
  46         tlv_packet[3] = 11;     /* length of this packet */
  47         tlv_packet[4] = PW_EAP_TLV;
  48         tlv_packet[5] = 0x80;
  49         tlv_packet[6] = EAP_TLV_ACK_RESULT;
  50         tlv_packet[7] = 0;
  51         tlv_packet[8] = 2;      /* length of the data portion */
  52         tlv_packet[9] = 0;
  53         tlv_packet[10] = EAP_TLV_FAILURE;
  54
  55         (tls_session->record_plus)(&tls_session->clean_in, tlv_packet, 11);
  56
  57         /*
  58          *      FIXME: Check the return code.
  59          */
  60         tls_handshake_send(request, tls_session);
  61
  62         return 1;
  63 }
  64
  65
  66 /*
  67  *      Send protected EAP-Success
  68  *
  69  *       Result-TLV = Success
  70  */
  71 static int eappeap_success(EAP_HANDLER *handler, tls_session_t *tls_session)
  72 {
  73         uint8_t tlv_packet[11];
  74         REQUEST *request = handler->request;
  75
  76         RDEBUG2("SUCCESS");
  77
  78         tlv_packet[0] = PW_EAP_REQUEST;
  79         tlv_packet[1] = handler->eap_ds->response->id +1;
  80         tlv_packet[2] = 0;
  81         tlv_packet[3] = 11;     /* length of this packet */
  82         tlv_packet[4] = PW_EAP_TLV;
  83         tlv_packet[5] = 0x80;   /* mandatory AVP */
  84         tlv_packet[6] = EAP_TLV_ACK_RESULT;
  85         tlv_packet[7] = 0;
  86         tlv_packet[8] = 2;      /* length of the data portion */
  87         tlv_packet[9] = 0;
  88         tlv_packet[10] = EAP_TLV_SUCCESS;
  89
  90         (tls_session->record_plus)(&tls_session->clean_in, tlv_packet, 11);
  91
  92         /*
  93          *      FIXME: Check the return code.
  94          */
  95         tls_handshake_send(request, tls_session);
  96
  97         return 1;
  98 }
  99
 100
 101 static int eappeap_identity(EAP_HANDLER *handler, tls_session_t *tls_session)
 102 {
 103         eap_packet_t eap_packet;
 104
 105         eap_packet.code = PW_EAP_REQUEST;
 106         eap_packet.id = handler->eap_ds->response->id + 1;
 107         eap_packet.length[0] = 0;
 108         eap_packet.length[1] = EAP_HEADER_LEN + 1;
 109         eap_packet.data[0] = PW_EAP_IDENTITY;
 110
 111         (tls_session->record_plus)(&tls_session->clean_in,
 112                                   &eap_packet, sizeof(eap_packet));
 113
 114         tls_handshake_send(handler->request, tls_session);
 115         (tls_session->record_init)(&tls_session->clean_in);
 116
 117         return 1;
 118 }
 119
 120 /*
 121  * Send an MS SoH request
 122  */
 123 static int eappeap_soh(EAP_HANDLER *handler, tls_session_t *tls_session)
 124 {
 125         uint8_t tlv_packet[20];
 126
 127         tlv_packet[0] = 254;    /* extended type */
 128
 129         tlv_packet[1] = 0;
 130         tlv_packet[2] = 0x01;   /* ms vendor */
 131         tlv_packet[3] = 0x37;
 132
 133         tlv_packet[4] = 0;      /* ms soh eap */
 134         tlv_packet[5] = 0;
 135         tlv_packet[6] = 0;
 136         tlv_packet[7] = 0x21;
 137
 138         tlv_packet[8] = 0;      /* vendor-spec tlv */
 139         tlv_packet[9] = 7;
 140
 141         tlv_packet[10] = 0;
 142         tlv_packet[11] = 8;     /* payload len */
 143
 144         tlv_packet[12] = 0;     /* ms vendor */
 145         tlv_packet[13] = 0;
 146         tlv_packet[14] = 0x01;
 147         tlv_packet[15] = 0x37;
 148
 149         tlv_packet[16] = 0;
 150         tlv_packet[17] = 2;
 151         tlv_packet[18] = 0;
 152         tlv_packet[19] = 0;
 153
 154         (tls_session->record_plus)(&tls_session->clean_in, tlv_packet, 20);
 155         tls_handshake_send(handler->request, tls_session);
 156         return 1;
 157 }
 158
 159 static VALUE_PAIR* eapsoh_verify(REQUEST *request, const uint8_t *data, unsigned int data_len) {
 160
 161         VALUE_PAIR *vp;
 162         uint8_t eap_type_base;
 163         uint32_t eap_vendor;
 164         uint32_t eap_type;
 165         int rv;
 166
 167         vp = pairmake("SoH-Supported", "no", T_OP_EQ);
 168         if (data && data[0] == PW_EAP_NAK) {
 169                 RDEBUG("SoH - client NAKed");
 170                 goto done;
 171         }
 172
 173         if (!data || data_len < 8) {
 174                 RDEBUG("SoH - eap payload too short");
 175                 goto done;
 176         }
 177
 178         eap_type_base = *data++;
 179         if (eap_type_base != 254) {
 180                 RDEBUG("SoH - response is not extended EAP: %i", eap_type_base);
 181                 goto done;
 182         }
 183
 184         eap_vendor = soh_pull_be_24(data); data += 3;
 185         if (eap_vendor != 0x137) {
 186                 RDEBUG("SoH - extended eap vendor %08x is not Microsoft", eap_vendor);
 187                 goto done;
 188         }
 189
 190         eap_type = soh_pull_be_32(data); data += 4;
 191         if (eap_type != 0x21) {
 192                 RDEBUG("SoH - response eap type %08x is not EAP-SoH", eap_type);
 193                 goto done;
 194         }
 195
 196
 197         rv = soh_verify(request, vp, data, data_len - 8);
 198         if (rv<0) {
 199                 RDEBUG("SoH - error decoding payload: %s", fr_strerror());
 200         } else {
 201                 vp->vp_integer = 1;
 202         }
 203 done:
 204         return vp;
 205 }
 206
 207 /*
 208  *      Verify the tunneled EAP message.
 209  */
 210 static int eapmessage_verify(REQUEST *request,
 211                              const uint8_t *data, unsigned int data_len)
 212 {
 213         const eap_packet_t *eap_packet = (const eap_packet_t *) data;
 214         uint8_t eap_type;
 215         char buffer[256];
 216
 217         /*
 218          *      No data, OR only 1 byte of EAP type.
 219          */
 220         if (!data || (data_len == 0) ||
 221             ((data_len <= 1) && (data[0] != PW_EAP_IDENTITY))) {
 222                 return 0;
 223         }
 224
 225         eap_type = *data;
 226         switch (eap_type) {
 227         case PW_EAP_IDENTITY:
 228                 if (data_len == 1) {
 229                         RDEBUG2("Identity - ");
 230                         return 1;
 231                 }
 232                 RDEBUG2("Identity - %*s",
 233                        data_len - 1, data + 1);
 234                 return 1;
 235                 break;
 236
 237                 /*
 238                  *      If the first byte of the packet is
 239                  *      EAP-Response, and the EAP data is a TLV,
 240                  *      then it looks OK...
 241                  */
 242         case PW_EAP_RESPONSE:
 243                 if (eap_packet->data[0] == PW_EAP_TLV) {
 244                         RDEBUG2("Received EAP-TLV response.");
 245                         return 1;
 246                 }
 247                 RDEBUG2("Got something weird.");
 248                 break;
 249
 250
 251                 /*
 252                  *      We normally do Microsoft MS-CHAPv2 (26), versus
 253                  *      Cisco MS-CHAPv2 (29).
 254                  */
 255         case PW_EAP_MSCHAPV2:
 256         default:
 257                 RDEBUG2("EAP type %s",
 258                        eaptype_type2name(eap_type,
 259                                          buffer, sizeof(buffer)));
 260                 return 1;
 261                 break;
 262         }
 263
 264         return 0;
 265 }
 266
 267 /*
 268  *      Convert a pseudo-EAP packet to a list of VALUE_PAIR's.
 269  */
 270 static VALUE_PAIR *eap2vp(REQUEST *request, EAP_DS *eap_ds,
 271                           const uint8_t *data, size_t data_len)
 272 {
 273         size_t total;
 274         VALUE_PAIR *vp = NULL, *head, **tail;
 275
 276         if (data_len > 65535) return NULL; /* paranoia */
 277
 278         vp = paircreate(PW_EAP_MESSAGE, 0, PW_TYPE_OCTETS);
 279         if (!vp) {
 280                 RDEBUG2("Failure in creating VP");
 281                 return NULL;
 282         }
 283
 284         total = data_len;
 285         if (total > 249) total = 249;
 286
 287         /*
 288          *      Hand-build an EAP packet from the crap in PEAP version 0.
 289          */
 290         vp->vp_octets[0] = PW_EAP_RESPONSE;
 291         vp->vp_octets[1] = eap_ds->response->id;
 292         vp->vp_octets[2] = (data_len + EAP_HEADER_LEN) >> 8;
 293         vp->vp_octets[3] = (data_len + EAP_HEADER_LEN) & 0xff;
 294
 295         memcpy(vp->vp_octets + EAP_HEADER_LEN, data, total);
 296         vp->length = EAP_HEADER_LEN + total;
 297
 298         head = vp;
 299         tail = &(vp->next);
 300         while (total < data_len) {
 301                 int vp_len;
 302
 303
 304                 vp = paircreate(PW_EAP_MESSAGE, 0, PW_TYPE_OCTETS);
 305                 if (!vp) {
 306                         RDEBUG2("Failure in creating VP");
 307                         pairfree(&head);
 308                         return NULL;
 309                 }
 310                 vp_len = (data_len - total);
 311                 if (vp_len > 253) vp_len = 253;
 312
 313                 memcpy(vp->vp_octets, data + total, vp_len);
 314                 vp->length = vp_len;
 315
 316                 total += vp_len;
 317                 *tail = vp;
 318                 tail = &(vp->next);
 319         }
 320
 321         return head;
 322 }
 323
 324
 325 /*
 326  *      Convert a list of VALUE_PAIR's to an EAP packet, through the
 327  *      simple expedient of dumping the EAP message
 328  */
 329 static int vp2eap(REQUEST *request, tls_session_t *tls_session, VALUE_PAIR *vp)
 330 {
 331         rad_assert(vp != NULL);
 332
 333         /*
 334          *      Skip the id, code, and length.  Just write the EAP
 335          *      type & data to the client.
 336          */
 337 #ifndef NDEBUG
 338         if ((debug_flag > 2) && fr_log_fp) {
 339                 size_t i, total;
 340                 VALUE_PAIR *this;
 341
 342                 total = 0;
 343
 344                 for (this = vp; this != NULL; this = this->next) {
 345                         int start = 0;
 346
 347                         if (this == vp) start = EAP_HEADER_LEN;
 348
 349                         for (i = start; i < vp->length; i++) {
 350                           if ((total & 0x0f) == 0) fprintf(fr_log_fp, "  PEAP tunnel data out %04x: ", (int) total);
 351
 352                                 fprintf(fr_log_fp, "%02x ", vp->vp_octets[i]);
 353
 354                                 if ((total & 0x0f) == 0x0f) fprintf(fr_log_fp, "\n");
 355                                 total++;
 356                         }
 357                 }
 358                 if ((total & 0x0f) != 0) fprintf(fr_log_fp, "\n");
 359         }
 360 #endif
 361
 362         /*
 363          *      Send the EAP data, WITHOUT the header.
 364          */
 365         (tls_session->record_plus)(&tls_session->clean_in,
 366                                    vp->vp_octets + EAP_HEADER_LEN,
 367                                    vp->length - EAP_HEADER_LEN);
 368
 369         /*
 370          *      Send the rest of the EAP data.
 371          */
 372         for (vp = vp->next; vp != NULL; vp = vp->next) {
 373                 (tls_session->record_plus)(&tls_session->clean_in,
 374                                            vp->vp_octets, vp->length);
 375         }
 376
 377         tls_handshake_send(request, tls_session);
 378
 379         return 1;
 380 }
 381
 382
 383 /*
 384  *      See if there's a TLV in the response.
 385  */
 386 static int eappeap_check_tlv(REQUEST *request, const uint8_t *data,
 387                              size_t data_len)
 388 {
 389         const eap_packet_t *eap_packet = (const eap_packet_t *) data;
 390
 391         if (data_len < 11) return 0;
 392
 393         /*
 394          *      Look for success or failure.
 395          */
 396         if ((eap_packet->code == PW_EAP_RESPONSE) &&
 397             (eap_packet->data[0] == PW_EAP_TLV)) {
 398                 if (data[10] == EAP_TLV_SUCCESS) {
 399                         return 1;
 400                 }
 401
 402                 if (data[10] == EAP_TLV_FAILURE) {
 403                         RDEBUG2("Client rejected our response.  The password is probably incorrect.");
 404                         return 0;
 405                 }
 406         }
 407
 408         RDEBUG("Unknown TLV %02x", data[10]);
 409
 410         return 0;
 411 }
 412
 413
 414 /*
 415  *      Use a reply packet to determine what to do.
 416  */
 417 static int process_reply(EAP_HANDLER *handler, tls_session_t *tls_session,
 418                          REQUEST *request, RADIUS_PACKET *reply)
 419 {
 420         int rcode = RLM_MODULE_REJECT;
 421         VALUE_PAIR *vp;
 422         peap_tunnel_t *t = tls_session->opaque;
 423
 424         if ((debug_flag > 0) && fr_log_fp) {
 425                 RDEBUG("Got tunneled reply RADIUS code %d",
 426                        reply->code);
 427
 428                 debug_pair_list(reply->vps);
 429         }
 430
 431         switch (reply->code) {
 432         case PW_AUTHENTICATION_ACK:
 433                 RDEBUG2("Tunneled authentication was successful.");
 434                 t->status = PEAP_STATUS_SENT_TLV_SUCCESS;
 435                 eappeap_success(handler, tls_session);
 436                 rcode = RLM_MODULE_HANDLED;
 437
 438                 /*
 439                  *      If we've been told to use the attributes from
 440                  *      the reply, then do so.
 441                  *
 442                  *      WARNING: This may leak information about the
 443                  *      tunneled user!
 444                  */
 445                 if (t->use_tunneled_reply) {
 446                         RDEBUG2("Saving tunneled attributes for later");
 447
 448                         /*
 449                          *      Clean up the tunneled reply.
 450                          */
 451                         pairdelete(&reply->vps, PW_PROXY_STATE, 0, TAG_ANY);
 452                         pairdelete(&reply->vps, PW_EAP_MESSAGE, 0, TAG_ANY);
 453                         pairdelete(&reply->vps, PW_MESSAGE_AUTHENTICATOR, 0, TAG_ANY);
 454
 455                         /*
 456                          *      Delete MPPE keys & encryption policy.  We don't
 457                          *      want these here.
 458                          */
 459                         pairdelete(&reply->vps, 7, VENDORPEC_MICROSOFT, TAG_ANY);
 460                         pairdelete(&reply->vps, 8, VENDORPEC_MICROSOFT, TAG_ANY);
 461                         pairdelete(&reply->vps, 16, VENDORPEC_MICROSOFT, TAG_ANY);
 462                         pairdelete(&reply->vps, 17, VENDORPEC_MICROSOFT, TAG_ANY);
 463
 464                         t->accept_vps = reply->vps;
 465                         reply->vps = NULL;
 466                 }
 467                 break;
 468
 469         case PW_AUTHENTICATION_REJECT:
 470                 RDEBUG2("Tunneled authentication was rejected.");
 471                 t->status = PEAP_STATUS_SENT_TLV_FAILURE;
 472                 eappeap_failure(handler, tls_session);
 473                 rcode = RLM_MODULE_HANDLED;
 474                 break;
 475
 476         case PW_ACCESS_CHALLENGE:
 477                 RDEBUG2("Got tunneled Access-Challenge");
 478
 479                 /*
 480                  *      Keep the State attribute, if necessary.
 481                  *
 482                  *      Get rid of the old State, too.
 483                  */
 484                 pairfree(&t->state);
 485                 pairmove2(&t->state, &(reply->vps), PW_STATE, 0, TAG_ANY);
 486
 487                 /*
 488                  *      PEAP takes only EAP-Message attributes inside
 489                  *      of the tunnel.  Any Reply-Message in the
 490                  *      Access-Challenge is ignored.
 491                  */
 492                 vp = NULL;
 493                 pairmove2(&vp, &(reply->vps), PW_EAP_MESSAGE, 0, TAG_ANY);
 494
 495                 /*
 496                  *      Handle EAP-MSCHAP-V2, where Access-Accept's
 497                  *      from the home server may contain MS-CHAP-Success,
 498                  *      which the module turns into challenges, so that
 499                  *      the client may respond to the challenge with
 500                  *      an "ack" packet.
 501                  */
 502                 if (t->home_access_accept && t->use_tunneled_reply) {
 503                         RDEBUG2("Saving tunneled attributes for later");
 504
 505                         /*
 506                          *      Clean up the tunneled reply.
 507                          */
 508                         pairdelete(&reply->vps, PW_PROXY_STATE, 0, TAG_ANY);
 509                         pairdelete(&reply->vps, PW_MESSAGE_AUTHENTICATOR, 0, TAG_ANY);
 510
 511                         t->accept_vps = reply->vps;
 512                         reply->vps = NULL;
 513                 }
 514
 515                 /*
 516                  *      Handle the ACK, by tunneling any necessary reply
 517                  *      VP's back to the client.
 518                  */
 519                 if (vp) {
 520                         vp2eap(request, tls_session, vp);
 521                         pairfree(&vp);
 522                 }
 523
 524                 rcode = RLM_MODULE_HANDLED;
 525                 break;
 526
 527         default:
 528                 RDEBUG2("Unknown RADIUS packet type %d: rejecting tunneled user", reply->code);
 529                 rcode = RLM_MODULE_REJECT;
 530                 break;
 531         }
 532
 533         return rcode;
 534 }
 535
 536 #ifdef WITH_PROXY
 537 /*
 538  *      Do post-proxy processing,
 539  */
 540 static int eappeap_postproxy(EAP_HANDLER *handler, void *data)
 541 {
 542         int rcode;
 543         tls_session_t *tls_session = (tls_session_t *) data;
 544         REQUEST *fake, *request = handler->request;
 545
 546         rad_assert(request != NULL);
 547         RDEBUG2("Passing reply from proxy back into the tunnel.");
 548
 549         /*
 550          *      If there was a fake request associated with the proxied
 551          *      request, do more processing of it.
 552          */
 553         fake = (REQUEST *) request_data_get(handler->request,
 554                                             handler->request->proxy,
 555                                             REQUEST_DATA_EAP_MSCHAP_TUNNEL_CALLBACK);
 556
 557         /*
 558          *      Do the callback, if it exists, and if it was a success.
 559          */
 560         if (fake && (handler->request->proxy_reply->code == PW_AUTHENTICATION_ACK)) {
 561                 peap_tunnel_t *t = tls_session->opaque;
 562
 563                 t->home_access_accept = TRUE;
 564
 565                 /*
 566                  *      Terrible hacks.
 567                  */
 568                 rad_assert(fake->packet == NULL);
 569                 fake->packet = request->proxy;
 570                 fake->packet->src_ipaddr = request->packet->src_ipaddr;
 571                 request->proxy = NULL;
 572
 573                 rad_assert(fake->reply == NULL);
 574                 fake->reply = request->proxy_reply;
 575                 request->proxy_reply = NULL;
 576
 577                 if ((debug_flag > 0) && fr_log_fp) {
 578                         fprintf(fr_log_fp, "server %s {\n", fake->server);
 579                 }
 580
 581                 /*
 582                  *      Perform a post-auth stage, which will get the EAP
 583                  *      handler, too...
 584                  */
 585                 fake->options &= ~RAD_REQUEST_OPTION_PROXY_EAP;
 586                 RDEBUG2("Passing reply back for EAP-MS-CHAP-V2");
 587                 module_post_proxy(0, fake);
 588
 589                 /*
 590                  *      FIXME: If rcode returns fail, do something
 591                  *      intelligent...
 592                  */
 593                 rcode = rad_postauth(fake);
 594
 595                 if ((debug_flag > 0) && fr_log_fp) {
 596                         fprintf(fr_log_fp, "} # server %s\n", fake->server);
 597
 598                         RDEBUG("Final reply from tunneled session code %d",
 599                                fake->reply->code);
 600
 601                         debug_pair_list(fake->reply->vps);
 602                 }
 603
 604                 /*
 605                  *      Terrible hacks.
 606                  */
 607                 request->proxy = fake->packet;
 608                 fake->packet = NULL;
 609                 request->proxy_reply = fake->reply;
 610                 fake->reply = NULL;
 611
 612                 /*
 613                  *      And we're done with this request.
 614                  */
 615
 616                 switch (rcode) {
 617                 case RLM_MODULE_FAIL:
 618                         request_free(&fake);
 619                         eaptls_fail(handler, 0);
 620                         return 0;
 621                         break;
 622
 623                 default:  /* Don't Do Anything */
 624                         RDEBUG2("Got reply %d", request->proxy_reply->code);
 625                         break;
 626                 }
 627         }
 628         request_free(&fake);    /* robust if fake == NULL */
 629
 630         /*
 631          *      If there was no EAP-Message in the reply packet, then
 632          *      we know that we're supposed to re-run the "authenticate"
 633          *      stage, in order to get the right kind of handling...
 634          */
 635
 636         /*
 637          *      Process the reply from the home server.
 638          */
 639
 640         rcode = process_reply(handler, tls_session, handler->request,
 641                               handler->request->proxy_reply);
 642
 643         /*
 644          *      The proxy code uses the reply from the home server as
 645          *      the basis for the reply to the NAS.  We don't want that,
 646          *      so we toss it, after we've had our way with it.
 647          */
 648         pairfree(&handler->request->proxy_reply->vps);
 649
 650         switch (rcode) {
 651         case RLM_MODULE_REJECT:
 652                 RDEBUG2("Reply was rejected");
 653                 eaptls_fail(handler, 0);
 654                 return 0;
 655
 656         case RLM_MODULE_HANDLED:
 657                 RDEBUG2("Reply was handled");
 658                 eaptls_request(handler->eap_ds, tls_session);
 659                 return 1;
 660
 661         case RLM_MODULE_OK:
 662                 RDEBUG2("Reply was OK");
 663
 664                 /*
 665                  *      Success: Automatically return MPPE keys.
 666                  */
 667                 return eaptls_success(handler, 0);
 668
 669         default:
 670                 RDEBUG2("Reply was unknown.");
 671                 break;
 672         }
 673
 674         eaptls_fail(handler, 0);
 675         return 0;
 676 }
 677
 678 /*
 679  *      Free a request.
 680  */
 681 static void my_request_free(void *data)
 682 {
 683         REQUEST *request = (REQUEST *)data;
 684
 685         request_free(&request);
 686 }
 687 #endif
 688
 689
 690 static const char *peap_state(peap_tunnel_t *t)
 691 {
 692         switch (t->status) {
 693                 case PEAP_STATUS_TUNNEL_ESTABLISHED:
 694                         return "TUNNEL ESTABLISHED";
 695                 case PEAP_STATUS_WAIT_FOR_SOH_RESPONSE:
 696                         return "WAITING FOR SOH RESPONSE";
 697                 case PEAP_STATUS_INNER_IDENTITY_REQ_SENT:
 698                         return "WAITING FOR INNER IDENTITY";
 699                 case PEAP_STATUS_SENT_TLV_SUCCESS:
 700                         return "send tlv success";
 701                 case PEAP_STATUS_SENT_TLV_FAILURE:
 702                         return "send tlv failure";
 703                 case PEAP_STATUS_PHASE2_INIT:
 704                         return "phase2_init";
 705                 case PEAP_STATUS_PHASE2:
 706                         return "phase2";
 707                 default:
 708                         break;
 709         }
 710         return "?";
 711 }
 712
 713 static void print_tunneled_data(const uint8_t *data, size_t data_len)
 714 {
 715         size_t i;
 716
 717         if ((debug_flag > 2) && fr_log_fp) {
 718                 for (i = 0; i < data_len; i++) {
 719                   if ((i & 0x0f) == 0) fprintf(fr_log_fp, "  PEAP tunnel data in %02x: ", (int) i);
 720
 721                         fprintf(fr_log_fp, "%02x ", data[i]);
 722
 723                         if ((i & 0x0f) == 0x0f) fprintf(fr_log_fp, "\n");
 724                 }
 725                 if ((data_len & 0x0f) != 0) fprintf(fr_log_fp, "\n");
 726         }
 727 }
 728
 729
 730 /*
 731  *      Process the pseudo-EAP contents of the tunneled data.
 732  */
 733 int eappeap_process(EAP_HANDLER *handler, tls_session_t *tls_session)
 734 {
 735         peap_tunnel_t *t = tls_session->opaque;
 736         REQUEST *fake;
 737         VALUE_PAIR *vp;
 738         int rcode = RLM_MODULE_REJECT;
 739         const uint8_t   *data;
 740         unsigned int data_len;
 741
 742         REQUEST *request = handler->request;
 743         EAP_DS *eap_ds = handler->eap_ds;
 744
 745         rad_assert(request != NULL);
 746
 747         /*
 748          *      Just look at the buffer directly, without doing
 749          *      record_minus.  This lets us avoid another data copy.
 750          */
 751         data_len = tls_session->clean_out.used;
 752         tls_session->clean_out.used = 0;
 753         data = tls_session->clean_out.data;
 754
 755         RDEBUG2("Peap state %s", peap_state(t));
 756
 757         if ((t->status != PEAP_STATUS_TUNNEL_ESTABLISHED) &&
 758             !eapmessage_verify(request, data, data_len)) {
 759                 RDEBUG2("FAILED processing PEAP: Tunneled data is invalid.");
 760                 if (debug_flag > 2) print_tunneled_data(data, data_len);
 761                 return RLM_MODULE_REJECT;
 762         }
 763
 764         switch (t->status) {
 765         case PEAP_STATUS_TUNNEL_ESTABLISHED:
 766                 /* FIXME: should be no data in the buffer here, check & assert? */
 767
 768                 if (SSL_session_reused(tls_session->ssl)) {
 769                         RDEBUG2("Skipping Phase2 because of session resumption");
 770                         t->session_resumption_state = PEAP_RESUMPTION_YES;
 771                         if (t->soh) {
 772                                 t->status = PEAP_STATUS_WAIT_FOR_SOH_RESPONSE;
 773                                 RDEBUG2("Requesting SoH from client");
 774                                 eappeap_soh(handler, tls_session);
 775                                 return RLM_MODULE_HANDLED;
 776                         }
 777                         /* we're good, send success TLV */
 778                         t->status = PEAP_STATUS_SENT_TLV_SUCCESS;
 779                         eappeap_success(handler, tls_session);
 780
 781                 } else {
 782                         /* send an identity request */
 783                         t->session_resumption_state = PEAP_RESUMPTION_NO;
 784                         t->status = PEAP_STATUS_INNER_IDENTITY_REQ_SENT;
 785                         eappeap_identity(handler, tls_session);
 786                 }
 787                 return RLM_MODULE_HANDLED;
 788
 789         case PEAP_STATUS_INNER_IDENTITY_REQ_SENT:
 790                 /* we're expecting an identity response */
 791                 if (data[0] != PW_EAP_IDENTITY) {
 792                         RDEBUG("Expected EAP-Identity, got something else.");
 793                         return RLM_MODULE_REJECT;
 794                 }
 795
 796                 if (data_len >= sizeof(t->username->vp_strvalue)) {
 797                         RDEBUG("EAP-Identity is too long");
 798                         return RLM_MODULE_REJECT;
 799                 }
 800
 801                 /*
 802                  *      Save it for later.
 803                  */
 804                 t->username = pairmake("User-Name", "", T_OP_EQ);
 805                 rad_assert(t->username != NULL);
 806
 807                 memcpy(t->username->vp_strvalue, data + 1, data_len - 1);
 808                 t->username->length = data_len - 1;
 809                 t->username->vp_strvalue[t->username->length] = 0;
 810                 RDEBUG("Got inner identity '%s'", t->username->vp_strvalue);
 811                 if (t->soh) {
 812                         t->status = PEAP_STATUS_WAIT_FOR_SOH_RESPONSE;
 813                         RDEBUG2("Requesting SoH from client");
 814                         eappeap_soh(handler, tls_session);
 815                         return RLM_MODULE_HANDLED;
 816                 }
 817                 t->status = PEAP_STATUS_PHASE2_INIT;
 818                 break;
 819
 820         case PEAP_STATUS_WAIT_FOR_SOH_RESPONSE:
 821                 fake = request_alloc_fake(request);
 822                 rad_assert(fake->packet->vps == NULL);
 823                 fake->packet->vps = eapsoh_verify(request, data, data_len);
 824                 setup_fake_request(request, fake, t);
 825
 826                 if (t->soh_virtual_server) {
 827                         fake->server = t->soh_virtual_server;
 828                 }
 829                 RDEBUG("Sending SoH request to server %s", fake->server ? fake->server : "NULL");
 830                 debug_pair_list(fake->packet->vps);
 831                 RDEBUG("server %s {", fake->server);
 832                 rad_virtual_server(fake);
 833                 RDEBUG("} # server %s", fake->server);
 834                 RDEBUG("Got SoH reply");
 835                 debug_pair_list(fake->reply->vps);
 836
 837                 if (fake->reply->code != PW_AUTHENTICATION_ACK) {
 838                         RDEBUG2("SoH was rejected");
 839                         request_free(&fake);
 840                         t->status = PEAP_STATUS_SENT_TLV_FAILURE;
 841                         eappeap_failure(handler, tls_session);
 842                         return RLM_MODULE_HANDLED;
 843                 }
 844
 845                 /* save the SoH VPs */
 846                 t->soh_reply_vps = fake->reply->vps;
 847                 fake->reply->vps = NULL;
 848                 request_free(&fake);
 849
 850                 if (t->session_resumption_state == PEAP_RESUMPTION_YES) {
 851                         /* we're good, send success TLV */
 852                         t->status = PEAP_STATUS_SENT_TLV_SUCCESS;
 853                         eappeap_success(handler, tls_session);
 854                         return RLM_MODULE_HANDLED;
 855                 }
 856
 857                 t->status = PEAP_STATUS_PHASE2_INIT;
 858                 break;
 859
 860
 861         /*
 862          *      If we authenticated the user, then it's OK.
 863          */
 864         case PEAP_STATUS_SENT_TLV_SUCCESS:
 865                 if (eappeap_check_tlv(request, data, data_len)) {
 866                         RDEBUG2("Success");
 867                         return RLM_MODULE_OK;
 868                 }
 869
 870                 /*
 871                  *      Otherwise, the client rejected the session
 872                  *      resumption.  If the session is being re-used,
 873                  *      we need to do a full authentication.
 874                  *
 875                  *      We do this by sending an EAP-Identity request
 876                  *      inside of the PEAP tunnel.
 877                  */
 878                 if (t->session_resumption_state == PEAP_RESUMPTION_YES) {
 879                         RDEBUG2("Client rejected session resumption.  Re-starting full authentication");
 880
 881                         /*
 882                          *      Mark session resumption status.
 883                          */
 884                         t->status = PEAP_STATUS_INNER_IDENTITY_REQ_SENT;
 885                         t->session_resumption_state = PEAP_RESUMPTION_NO;
 886
 887                         eappeap_identity(handler, tls_session);
 888                         return RLM_MODULE_HANDLED;
 889                 }
 890
 891                 RDEBUG2("We sent a success, but received something weird in return.");
 892                 return RLM_MODULE_REJECT;
 893
 894         /*
 895          *      Damned if I know why the clients continue sending EAP
 896          *      packets after we told them to f*ck off.
 897          */
 898         case PEAP_STATUS_SENT_TLV_FAILURE:
 899                 RDEBUG(" The users session was previously rejected: returning reject (again.)");
 900                 RDEBUG(" *** This means you need to read the PREVIOUS messages in the debug output");
 901                 RDEBUG(" *** to find out the reason why the user was rejected.");
 902                 RDEBUG(" *** Look for \"reject\" or \"fail\".  Those earlier messages will tell you.");
 903                 RDEBUG(" *** what went wrong, and how to fix the problem.");
 904                 return RLM_MODULE_REJECT;
 905
 906                 case PEAP_STATUS_PHASE2_INIT:
 907                         RDEBUG("In state machine in phase2 init?");
 908
 909                 case PEAP_STATUS_PHASE2:
 910                         break;
 911
 912                 default:
 913                         RDEBUG2("Unhandled state in peap");
 914                         return RLM_MODULE_REJECT;
 915         }
 916
 917         fake = request_alloc_fake(request);
 918
 919         rad_assert(fake->packet->vps == NULL);
 920
 921         switch (t->status) {
 922                 /*
 923                  *      If we're in PHASE2_INIT, the phase2 method hasn't been
 924                  *      sent an Identity packet yet; do so from the stored
 925                  *      username and this will kick off the phase2 eap method
 926                  */
 927
 928         case PEAP_STATUS_PHASE2_INIT: {
 929                 size_t len = t->username->length + EAP_HEADER_LEN + 1;
 930
 931                 t->status = PEAP_STATUS_PHASE2;
 932
 933                 vp = paircreate(PW_EAP_MESSAGE, 0, PW_TYPE_OCTETS);
 934
 935                 vp->vp_octets[0] = PW_EAP_RESPONSE;
 936                 vp->vp_octets[1] = eap_ds->response->id;
 937                 vp->vp_octets[2] = (len >> 8) & 0xff;
 938                 vp->vp_octets[3] = len & 0xff;
 939                 vp->vp_octets[4] = PW_EAP_IDENTITY;
 940
 941                 if (len > sizeof(vp->vp_octets)) len = sizeof(vp->vp_octets);
 942                 memcpy(vp->vp_octets + EAP_HEADER_LEN + 1,
 943                        t->username->vp_strvalue, len - EAP_HEADER_LEN - 1);
 944                 vp->length = len;
 945
 946                 pairadd(&fake->packet->vps, vp);
 947
 948                 if (t->default_eap_type != 0) {
 949                         RDEBUG2("Setting default EAP type for tunneled EAP session.");
 950                         vp = pairmake("EAP-Type", "0", T_OP_EQ);
 951                         vp->vp_integer = t->default_eap_type;
 952                         pairadd(&fake->config_items, vp);
 953                 }
 954                 break; }
 955
 956         case PEAP_STATUS_PHASE2:
 957                 fake->packet->vps = eap2vp(request, eap_ds, data, data_len);
 958                 if (!fake->packet->vps) {
 959                         request_free(&fake);
 960                         RDEBUG2("Unable to convert tunneled EAP packet to internal server data structures");
 961                         return PW_AUTHENTICATION_REJECT;
 962                 }
 963                 break;
 964
 965         default:
 966                 RDEBUG("Invalid state change in PEAP.");
 967                 return PW_AUTHENTICATION_REJECT;
 968         }
 969
 970         if ((debug_flag > 0) && fr_log_fp) {
 971                 RDEBUG("Got tunneled request");
 972
 973                 debug_pair_list(fake->packet->vps);
 974
 975                 fprintf(fr_log_fp, "server %s {\n",
 976                         (fake->server == NULL) ? "" : fake->server);
 977         }
 978
 979         /*
 980          *      Update other items in the REQUEST data structure.
 981          */
 982         if (!t->username) {
 983                 /*
 984                  *      There's no User-Name in the tunneled session,
 985                  *      so we add one here, by pulling it out of the
 986                  *      EAP-Identity packet.
 987                  */
 988                 if ((data[0] == PW_EAP_IDENTITY) && (data_len > 1)) {
 989                         t->username = pairmake("User-Name", "", T_OP_EQ);
 990                         rad_assert(t->username != NULL);
 991
 992                         memcpy(t->username->vp_strvalue, data + 1, data_len - 1);
 993                         t->username->length = data_len - 1;
 994                         t->username->vp_strvalue[t->username->length] = 0;
 995                         DEBUG2("  PEAP: Got tunneled identity of %s", t->username->vp_strvalue);
 996
 997                         /*
 998                          *      If there's a default EAP type,
 999                          *      set it here.
1000                          */
1001                         if (t->default_eap_type != 0) {
1002                                 DEBUG2("  PEAP: Setting default EAP type for tunneled EAP session.");
1003                                 vp = pairmake("EAP-Type", "0", T_OP_EQ);
1004                                 vp->vp_integer = t->default_eap_type;
1005                                 pairadd(&fake->config_items, vp);
1006                         }
1007                 }
1008         } /* else there WAS a t->username */
1009
1010         setup_fake_request(request, fake, t);
1011
1012         if ((vp = pairfind(request->config_items, PW_VIRTUAL_SERVER, 0, TAG_ANY)) != NULL) {
1013                 fake->server = vp->vp_strvalue;
1014
1015         } else if (t->virtual_server) {
1016                 fake->server = t->virtual_server;
1017
1018         } /* else fake->server == request->server */
1019
1020         if ((debug_flag > 0) && fr_log_fp) {
1021                 fprintf(fr_log_fp, "Sending tunneled request\n");
1022
1023                 debug_pair_list(fake->packet->vps);
1024
1025                 fprintf(fr_log_fp, "server %s {\n",
1026                         (fake->server == NULL) ? "" : fake->server);
1027         }
1028
1029         /*
1030          *      Call authentication recursively, which will
1031          *      do PAP, CHAP, MS-CHAP, etc.
1032          */
1033         rad_virtual_server(fake);
1034
1035         /*
1036          *      Note that we don't do *anything* with the reply
1037          *      attributes.
1038          */
1039         if ((debug_flag > 0) && fr_log_fp) {
1040                 fprintf(fr_log_fp, "} # server %s\n",
1041                         (fake->server == NULL) ? "" : fake->server);
1042
1043                 RDEBUG("Got tunneled reply code %d", fake->reply->code);
1044
1045                 debug_pair_list(fake->reply->vps);
1046         }
1047
1048         /*
1049          *      Decide what to do with the reply.
1050          */
1051         switch (fake->reply->code) {
1052         case 0:                 /* No reply code, must be proxied... */
1053 #ifdef WITH_PROXY
1054                 vp = pairfind(fake->config_items, PW_PROXY_TO_REALM, 0, TAG_ANY);
1055
1056                 if (vp) {
1057                         eap_tunnel_data_t *tunnel;
1058
1059                         /*
1060                          *      The tunneled request was NOT handled,
1061                          *      it has to be proxied.  This means that
1062                          *      the "authenticate" stage was never
1063                          *      performed.
1064                          *
1065                          *      If we are told to NOT proxy the
1066                          *      tunneled request as EAP, then this
1067                          *      means that we've got to decode it,
1068                          *      which means that we MUST run the
1069                          *      "authenticate" portion by hand, here.
1070                          *
1071                          *      Once the tunneled EAP session is ALMOST
1072                          *      done, THEN we proxy it...
1073                          */
1074                         if (!t->proxy_tunneled_request_as_eap) {
1075                                 fake->options |= RAD_REQUEST_OPTION_PROXY_EAP;
1076
1077                                 /*
1078                                  *      Hmm... should we check for
1079                                  *      Auth-Type & EAP-Message here?
1080                                  */
1081
1082
1083                                 /*
1084                                  *      Run the EAP authentication.
1085                                  */
1086                                 DEBUG2("  PEAP: Calling authenticate in order to initiate tunneled EAP session.");
1087                                 rcode = module_authenticate(PW_AUTHTYPE_EAP, fake);
1088                                 if (rcode == RLM_MODULE_OK) {
1089                                         /*
1090                                          *      Authentication succeeded! Rah!
1091                                          */
1092                                         fake->reply->code = PW_AUTHENTICATION_ACK;
1093                                         goto do_process;
1094                                 }
1095
1096                                 if (rcode != RLM_MODULE_HANDLED) {
1097                                         DEBUG2("  PEAP: Can't handle the return code %d", rcode);
1098                                         rcode = RLM_MODULE_REJECT;
1099                                         goto done;
1100                                 }
1101
1102                                 /*
1103                                  *      The module decided it wasn't
1104                                  *      done.  Handle it like normal.
1105                                  */
1106                                 if ((fake->options & RAD_REQUEST_OPTION_PROXY_EAP) == 0) {
1107                                         DEBUG2("    PEAP: Cancelling proxy to realm %s until the tunneled EAP session has been established", vp->vp_strvalue);
1108                                         goto do_process;
1109                                 }
1110
1111                                 /*
1112                                  *      The module has decoded the
1113                                  *      EAP-Message into another set
1114                                  *      of attributes.
1115                                  */
1116                                 pairdelete(&fake->packet->vps,
1117                                            PW_EAP_MESSAGE, 0, TAG_ANY);
1118                         }
1119
1120                         DEBUG2("  PEAP: Tunneled authentication will be proxied to %s", vp->vp_strvalue);
1121
1122                         /*
1123                          *      Tell the original request that it's going
1124                          *      to be proxied.
1125                          */
1126                         pairmove2(&(request->config_items),
1127                                    &(fake->config_items),
1128                                    PW_PROXY_TO_REALM, 0, TAG_ANY);
1129
1130                         /*
1131                          *      Seed the proxy packet with the
1132                          *      tunneled request.
1133                          */
1134                         rad_assert(request->proxy == NULL);
1135                         request->proxy = fake->packet;
1136                         memset(&request->proxy->src_ipaddr, 0,
1137                                sizeof(request->proxy->src_ipaddr));
1138                         memset(&request->proxy->dst_ipaddr, 0,
1139                                sizeof(request->proxy->dst_ipaddr));
1140                         request->proxy->src_port = 0;
1141                         request->proxy->dst_port = 0;
1142                         fake->packet = NULL;
1143                         rad_free(&fake->reply);
1144                         fake->reply = NULL;
1145
1146                         /*
1147                          *      Set up the callbacks for the tunnel
1148                          */
1149                         tunnel = rad_malloc(sizeof(*tunnel));
1150                         memset(tunnel, 0, sizeof(*tunnel));
1151
1152                         tunnel->tls_session = tls_session;
1153                         tunnel->callback = eappeap_postproxy;
1154
1155                         /*
1156                          *      Associate the callback with the request.
1157                          */
1158                         rcode = request_data_add(request,
1159                                                  request->proxy,
1160                                                  REQUEST_DATA_EAP_TUNNEL_CALLBACK,
1161                                                  tunnel, free);
1162                         rad_assert(rcode == 0);
1163
1164                         /*
1165                          *      We're not proxying it as EAP, so we've got
1166                          *      to do the callback later.
1167                          */
1168                         if ((fake->options & RAD_REQUEST_OPTION_PROXY_EAP) != 0) {
1169                                 DEBUG2("  PEAP: Remembering to do EAP-MS-CHAP-V2 post-proxy.");
1170
1171                                 /*
1172                                  *      rlm_eap.c has taken care of associating
1173                                  *      the handler with the fake request.
1174                                  *
1175                                  *      So we associate the fake request with
1176                                  *      this request.
1177                                  */
1178                                 rcode = request_data_add(request,
1179                                                          request->proxy,
1180                                                          REQUEST_DATA_EAP_MSCHAP_TUNNEL_CALLBACK,
1181                                                          fake, my_request_free);
1182                                 rad_assert(rcode == 0);
1183
1184                                 /*
1185                                  *      Do NOT free the fake request!
1186                                  */
1187                                 return RLM_MODULE_UPDATED;
1188                         }
1189
1190                         /*
1191                          *      Didn't authenticate the packet, but
1192                          *      we're proxying it.
1193                          */
1194                         rcode = RLM_MODULE_UPDATED;
1195
1196                 } else
1197 #endif  /* WITH_PROXY */
1198                   {
1199                         DEBUG2("  PEAP: Unknown RADIUS packet type %d: rejecting tunneled user", fake->reply->code);
1200                         rcode = RLM_MODULE_REJECT;
1201                   }
1202                 break;
1203
1204         default:
1205         do_process:
1206                 rcode = process_reply(handler, tls_session, request,
1207                                       fake->reply);
1208                 break;
1209         }
1210
1211  done:
1212         request_free(&fake);
1213
1214         return rcode;
1215 }
1216
1217 static int setup_fake_request(REQUEST *request, REQUEST *fake, peap_tunnel_t *t) {
1218
1219         VALUE_PAIR *vp;
1220         /*
1221          *      Tell the request that it's a fake one.
1222          */
1223         vp = pairmake("Freeradius-Proxied-To", "127.0.0.1", T_OP_EQ);
1224         if (vp) {
1225                 pairadd(&fake->packet->vps, vp);
1226         }
1227
1228         if (t->username) {
1229                 vp = paircopy(t->username);
1230                 pairadd(&fake->packet->vps, vp);
1231                 fake->username = pairfind(fake->packet->vps, PW_USER_NAME, 0, TAG_ANY);
1232                 RDEBUG2("Setting User-Name to %s", fake->username->vp_strvalue);
1233         } else {
1234                 RDEBUG2("No tunnel username (SSL resumption?)");
1235         }
1236
1237
1238         /*
1239          *      Add the State attribute, too, if it exists.
1240          */
1241         if (t->state) {
1242                 vp = paircopy(t->state);
1243                 if (vp) pairadd(&fake->packet->vps, vp);
1244         }
1245
1246         /*
1247          *      If this is set, we copy SOME of the request attributes
1248          *      from outside of the tunnel to inside of the tunnel.
1249          *
1250          *      We copy ONLY those attributes which do NOT already
1251          *      exist in the tunneled request.
1252          *
1253          *      This code is copied from ../rlm_eap_ttls/ttls.c
1254          */
1255         if (t->copy_request_to_tunnel) {
1256                 VALUE_PAIR *copy;
1257
1258                 for (vp = request->packet->vps; vp != NULL; vp = vp->next) {
1259                         /*
1260                          *      The attribute is a server-side thingy,
1261                          *      don't copy it.
1262                          */
1263                         if ((vp->da->attr > 255) &&
1264                             (((vp->da->attr >> 16) & 0xffff) == 0)) {
1265                                 continue;
1266                         }
1267
1268                         /*
1269                          *      The outside attribute is already in the
1270                          *      tunnel, don't copy it.
1271                          *
1272                          *      This works for BOTH attributes which
1273                          *      are originally in the tunneled request,
1274                          *      AND attributes which are copied there
1275                          *      from below.
1276                          */
1277                         if (pairfind(fake->packet->vps, vp->da->attr, vp->da->vendor, TAG_ANY)) {
1278                                 continue;
1279                         }
1280
1281                         /*
1282                          *      Some attributes are handled specially.
1283                          */
1284                         switch (vp->da->attr) {
1285                                 /*
1286                                  *      NEVER copy Message-Authenticator,
1287                                  *      EAP-Message, or State.  They're
1288                                  *      only for outside of the tunnel.
1289                                  */
1290                         case PW_USER_NAME:
1291                         case PW_USER_PASSWORD:
1292                         case PW_CHAP_PASSWORD:
1293                         case PW_CHAP_CHALLENGE:
1294                         case PW_PROXY_STATE:
1295                         case PW_MESSAGE_AUTHENTICATOR:
1296                         case PW_EAP_MESSAGE:
1297                         case PW_STATE:
1298                                 continue;
1299                                 break;
1300
1301                                 /*
1302                                  *      By default, copy it over.
1303                                  */
1304                         default:
1305                                 break;
1306                         }
1307
1308                         /*
1309                          *      Don't copy from the head, we've already
1310                          *      checked it.
1311                          */
1312                         copy = paircopy2(vp, vp->da->attr, vp->da->vendor, TAG_ANY);
1313                         pairadd(&fake->packet->vps, copy);
1314                 }
1315         }
1316
1317         return 0;
1318 }