src/modules/rlm_eap/types/rlm_eap_peap/peap.c

   1 /*
   2  * peap.c  contains the interfaces that are called from eap
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  *
  20  *   Copyright 2003 Alan DeKok <aland@freeradius.org>
  21  */
  22 #include "eap_peap.h"
  23
  24 /*
  25  *      Send protected EAP-Failure
  26  *
  27  *       Result-TLV = Failure
  28  */
  29 static int eappeap_failure(EAP_HANDLER *handler, tls_session_t *tls_session)
  30 {
  31         uint8_t tlv_packet[11];
  32
  33         DEBUG2("  rlm_eap_peap: FAILURE");
  34
  35         tlv_packet[0] = PW_EAP_REQUEST;
  36         tlv_packet[1] = handler->eap_ds->response->id +1;
  37         tlv_packet[2] = 0;
  38         tlv_packet[3] = 11;     /* length of this packet */
  39         tlv_packet[4] = PW_EAP_TLV;
  40         tlv_packet[5] = 0x80;
  41         tlv_packet[6] = EAP_TLV_ACK_RESULT;
  42         tlv_packet[7] = 0;
  43         tlv_packet[8] = 2;      /* length of the data portion */
  44         tlv_packet[9] = 0;
  45         tlv_packet[10] = EAP_TLV_FAILURE;
  46
  47         (tls_session->record_plus)(&tls_session->clean_in, tlv_packet, 11);
  48
  49         /*
  50          *      FIXME: Check the return code.
  51          */
  52         tls_handshake_send(tls_session);
  53
  54         return 1;
  55 }
  56
  57
  58 /*
  59  *      Send protected EAP-Success
  60  *
  61  *       Result-TLV = Success
  62  */
  63 static int eappeap_success(EAP_HANDLER *handler, tls_session_t *tls_session)
  64 {
  65         uint8_t tlv_packet[11];
  66
  67         DEBUG2("  rlm_eap_peap: SUCCESS");
  68
  69         tlv_packet[0] = PW_EAP_REQUEST;
  70         tlv_packet[1] = handler->eap_ds->response->id +1;
  71         tlv_packet[2] = 0;
  72         tlv_packet[3] = 11;     /* length of this packet */
  73         tlv_packet[4] = PW_EAP_TLV;
  74         tlv_packet[5] = 0x80;   /* mandatory AVP */
  75         tlv_packet[6] = EAP_TLV_ACK_RESULT;
  76         tlv_packet[7] = 0;
  77         tlv_packet[8] = 2;      /* length of the data portion */
  78         tlv_packet[9] = 0;
  79         tlv_packet[10] = EAP_TLV_SUCCESS;
  80
  81         (tls_session->record_plus)(&tls_session->clean_in, tlv_packet, 11);
  82
  83         /*
  84          *      FIXME: Check the return code.
  85          */
  86         tls_handshake_send(tls_session);
  87
  88         return 1;
  89 }
  90
  91
  92 /*
  93  *      Verify the tunneled EAP message.
  94  */
  95 static int eapmessage_verify(const uint8_t *data, unsigned int data_len)
  96 {
  97         const eap_packet_t *eap_packet = (const eap_packet_t *) data;
  98         uint8_t eap_type;
  99         char identity[256];
 100
 101         if (!data || (data_len <= 1)) {
 102                 return 0;
 103         }
 104
 105         eap_type = *data;
 106         switch (eap_type) {
 107         case PW_EAP_IDENTITY:
 108                 memcpy(identity, data + 1, data_len - 1);
 109                 identity[data_len - 1] = '\0';
 110                 DEBUG2("  rlm_eap_peap: Identity - %s", identity);
 111                 return 1;
 112                 break;
 113
 114                 /*
 115                  *      If the first byte of the packet is
 116                  *      EAP-Response, and the EAP data is a TLV,
 117                  *      then it looks OK...
 118                  */
 119         case PW_EAP_RESPONSE:
 120                 if (eap_packet->data[0] == PW_EAP_TLV) {
 121                         DEBUG2("  rlm_eap_peap: Received EAP-TLV response.");
 122                         return 1;
 123                 }
 124                 DEBUG2("  rlm_eap_peap: Got something weird.");
 125                 break;
 126
 127
 128                 /*
 129                  *      We normally do Microsoft MS-CHAPv2 (26), versus
 130                  *      Cisco MS-CHAPv2 (29).
 131                  */
 132         case PW_EAP_MSCHAPV2:
 133         default:
 134                 DEBUG2("  rlm_eap_peap: EAP type %s",
 135                        eaptype_type2name(eap_type,
 136                                          identity, sizeof(identity)));
 137                 return 1;
 138                 break;
 139         }
 140
 141         return 0;
 142 }
 143
 144 /*
 145  *      Convert a pseudo-EAP packet to a list of VALUE_PAIR's.
 146  */
 147 static VALUE_PAIR *eap2vp(EAP_DS *eap_ds,
 148                           const uint8_t *data, unsigned int data_len)
 149 {
 150         VALUE_PAIR *vp = NULL;
 151
 152         /*
 153          *      Sanity check this...
 154          */
 155         if (data_len + EAP_HEADER_LEN > MAX_STRING_LEN) {
 156                 radlog(L_ERR, "rlm_eap_peap: EAP Response packet is too large.  Code must be fixed to handle this.");
 157                 return NULL;
 158         }
 159
 160         vp = paircreate(PW_EAP_MESSAGE, PW_TYPE_OCTETS);
 161         if (!vp) {
 162                 DEBUG2("  rlm_eap_peap: Failure in creating VP");
 163                 return NULL;
 164         }
 165
 166         /*
 167          *      Hand-build an EAP packet from the crap in PEAP version 0.
 168          */
 169         vp->strvalue[0] = PW_EAP_RESPONSE;
 170         vp->strvalue[1] = eap_ds->response->id;
 171         vp->strvalue[2] = 0;
 172         vp->strvalue[3] = EAP_HEADER_LEN + data_len;
 173
 174         memcpy(vp->strvalue + EAP_HEADER_LEN, data, data_len);
 175         vp->length = EAP_HEADER_LEN + data_len;
 176
 177         return vp;
 178 }
 179
 180
 181 /*
 182  *      Convert a list of VALUE_PAIR's to an EAP packet, through the
 183  *      simple expedient of dumping the EAP message
 184  */
 185 static int vp2eap(tls_session_t *tls_session, VALUE_PAIR *vp)
 186 {
 187         if (vp->next != NULL) {
 188                 radlog(L_ERR, "rlm_eap_peap: EAP Request packet is too large.  Code must be fixed to handle this.");
 189                 return 0;
 190         }
 191
 192         /*
 193          *      Skip the id, code, and length.  Just write the EAP
 194          *      type & data to the client.
 195          */
 196 #ifndef NDEBUG
 197         if (debug_flag > 2) {
 198                 int i;
 199                 int total = vp->length - 4;
 200
 201                 if (debug_flag > 0) for (i = 0; i < total; i++) {
 202                         if ((i & 0x0f) == 0) printf("  PEAP tunnel data out %04x: ", i);
 203
 204                         printf("%02x ", vp->strvalue[i + 4]);
 205
 206                         if ((i & 0x0f) == 0x0f) printf("\n");
 207                 }
 208                 if ((total & 0x0f) != 0) printf("\n");
 209         }
 210 #endif
 211
 212         /*
 213          *      Send the EAP data, WITHOUT the header.
 214          */
 215 #if 1
 216         (tls_session->record_plus)(&tls_session->clean_in, vp->strvalue + EAP_HEADER_LEN,
 217                 vp->length - EAP_HEADER_LEN);
 218 #else
 219         (tls_session->record_plus)(&tls_session->clean_in, vp->strvalue, vp->length);
 220 #endif
 221         tls_handshake_send(tls_session);
 222
 223         return 1;
 224 }
 225
 226
 227 /*
 228  *      See if there's a TLV in the response.
 229  */
 230 static int eappeap_check_tlv(const uint8_t *data)
 231 {
 232         const eap_packet_t *eap_packet = (const eap_packet_t *) data;
 233
 234         /*
 235          *      Look for success or failure.
 236          */
 237         if ((eap_packet->code == PW_EAP_RESPONSE) &&
 238             (eap_packet->data[0] == PW_EAP_TLV)) {
 239                 if (data[10] == EAP_TLV_SUCCESS) {
 240                         return 1;
 241                 }
 242
 243                 if (data[10] == EAP_TLV_FAILURE) {
 244                         DEBUG2("  rlm_eap_peap: Client rejected our response.  The password is probably incorrect.");
 245                         return 0;
 246                 }
 247         }
 248
 249         return 0;
 250 }
 251
 252
 253 /*
 254  *      Use a reply packet to determine what to do.
 255  */
 256 static int process_reply(EAP_HANDLER *handler, tls_session_t *tls_session,
 257                          UNUSED REQUEST *request, RADIUS_PACKET *reply)
 258 {
 259         int rcode = RLM_MODULE_REJECT;
 260         VALUE_PAIR *vp;
 261         peap_tunnel_t *t = tls_session->opaque;
 262
 263 #ifndef NDEBUG
 264         if (debug_flag > 0) {
 265                 printf("  PEAP: Processing from tunneled session code %p %d\n",
 266                        reply, reply->code);
 267
 268                 for (vp = reply->vps; vp != NULL; vp = vp->next) {
 269                         putchar('\t');vp_print(stdout, vp);putchar('\n');
 270                 }
 271         }
 272 #endif
 273
 274         switch (reply->code) {
 275         case PW_AUTHENTICATION_ACK:
 276                 DEBUG2("  PEAP: Tunneled authentication was successful.");
 277                 t->status = PEAP_STATUS_SENT_TLV_SUCCESS;
 278                 eappeap_success(handler, tls_session);
 279                 rcode = RLM_MODULE_HANDLED;
 280
 281                 /*
 282                  *      If we've been told to use the attributes from
 283                  *      the reply, then do so.
 284                  *
 285                  *      WARNING: This may leak information about the
 286                  *      tunneled user!
 287                  */
 288                 if (t->use_tunneled_reply) {
 289                         DEBUG2("  Saving tunneled attributes for later");
 290
 291                         /*
 292                          *      Clean up the tunneled reply.
 293                          */
 294                         pairdelete(&reply->vps, PW_PROXY_STATE);
 295                         pairdelete(&reply->vps, PW_EAP_MESSAGE);
 296                         pairdelete(&reply->vps, PW_MESSAGE_AUTHENTICATOR);
 297
 298                         t->accept_vps = reply->vps;
 299                         reply->vps = NULL;
 300                 }
 301                 break;
 302
 303         case PW_AUTHENTICATION_REJECT:
 304                 DEBUG2("  PEAP: Tunneled authentication was rejected.");
 305                 t->status = PEAP_STATUS_SENT_TLV_FAILURE;
 306                 eappeap_failure(handler, tls_session);
 307                 rcode = RLM_MODULE_HANDLED;
 308                 break;
 309
 310         case PW_ACCESS_CHALLENGE:
 311                 DEBUG2("  PEAP: Got tunneled Access-Challenge");
 312
 313                 /*
 314                  *      Keep the State attribute, if necessary.
 315                  *
 316                  *      Get rid of the old State, too.
 317                  */
 318                 pairfree(&t->state);
 319                 pairmove2(&t->state, &(reply->vps), PW_STATE);
 320
 321                 /*
 322                  *      PEAP takes only EAP-Message attributes inside
 323                  *      of the tunnel.  Any Reply-Message in the
 324                  *      Access-Challenge is ignored.
 325                  */
 326                 vp = NULL;
 327                 pairmove2(&vp, &(reply->vps), PW_EAP_MESSAGE);
 328
 329                 /*
 330                  *      Handle EAP-MSCHAP-V2, where Access-Accept's
 331                  *      from the home server may contain MS-CHAP-Success,
 332                  *      which the module turns into challenges, so that
 333                  *      the client may respond to the challenge with
 334                  *      an "ack" packet.
 335                  */
 336                 if (t->home_access_accept && t->use_tunneled_reply) {
 337                         DEBUG2("  Saving tunneled attributes for later");
 338
 339                         /*
 340                          *      Clean up the tunneled reply.
 341                          */
 342                         pairdelete(&reply->vps, PW_PROXY_STATE);
 343                         pairdelete(&reply->vps, PW_MESSAGE_AUTHENTICATOR);
 344
 345                         t->accept_vps = reply->vps;
 346                         reply->vps = NULL;
 347                 }
 348
 349                 /*
 350                  *      Handle the ACK, by tunneling any necessary reply
 351                  *      VP's back to the client.
 352                  */
 353                 if (vp) {
 354                         vp2eap(tls_session, vp);
 355                         pairfree(&vp);
 356                 }
 357
 358                 rcode = RLM_MODULE_HANDLED;
 359                 break;
 360
 361         default:
 362                 DEBUG2("  PEAP: Unknown RADIUS packet type %d: rejecting tunneled user", reply->code);
 363                 rcode = RLM_MODULE_REJECT;
 364                 break;
 365         }
 366
 367         return rcode;
 368 }
 369
 370
 371 /*
 372  *      Do post-proxy processing,
 373  */
 374 static int eappeap_postproxy(EAP_HANDLER *handler, void *data)
 375 {
 376         int rcode;
 377         tls_session_t *tls_session = (tls_session_t *) data;
 378         REQUEST *fake;
 379
 380         DEBUG2("  PEAP: Passing reply from proxy back into the tunnel.");
 381
 382         /*
 383          *      If there was a fake request associated with the proxied
 384          *      request, do more processing of it.
 385          */
 386         fake = (REQUEST *) request_data_get(handler->request,
 387                                             handler->request->proxy,
 388                                             REQUEST_DATA_EAP_MSCHAP_TUNNEL_CALLBACK);
 389
 390         /*
 391          *      Do the callback, if it exists, and if it was a success.
 392          */
 393         if (fake && (handler->request->proxy_reply->code == PW_AUTHENTICATION_ACK)) {
 394                 VALUE_PAIR *vp;
 395                 REQUEST *request = handler->request;
 396                 peap_tunnel_t *t = tls_session->opaque;
 397
 398                 t->home_access_accept = TRUE;
 399
 400                 /*
 401                  *      Terrible hacks.
 402                  */
 403                 rad_assert(fake->packet == NULL);
 404                 fake->packet = request->proxy;
 405                 request->proxy = NULL;
 406
 407                 rad_assert(fake->reply == NULL);
 408                 fake->reply = request->proxy_reply;
 409                 request->proxy_reply = NULL;
 410
 411                 /*
 412                  *      Perform a post-auth stage, which will get the EAP
 413                  *      handler, too...
 414                  */
 415                 fake->options &= ~RAD_REQUEST_OPTION_PROXY_EAP;
 416                 DEBUG2("  PEAP: Passing reply back for EAP-MS-CHAP-V2 %p %d",
 417                        fake, fake->reply->code);
 418                 rcode = module_post_proxy(0, fake);
 419
 420                 /*
 421                  *      FIXME: If rcode returns fail, do something
 422                  *      intelligent...
 423                  */
 424                 DEBUG2("  POST-PROXY %d", rcode);
 425                 rcode = rad_postauth(fake);
 426                 DEBUG2("  POST-AUTH %d", rcode);
 427
 428 #ifndef NDEBUG
 429                 if (debug_flag > 0) {
 430                         printf("  PEAP: Final reply from tunneled session code %d\n",
 431                                fake->reply->code);
 432
 433                         for (vp = fake->reply->vps; vp != NULL; vp = vp->next) {
 434                                 putchar('\t');vp_print(stdout, vp);putchar('\n');
 435                         }
 436                 }
 437 #endif
 438
 439                 /*
 440                  *      Terrible hacks.
 441                  */
 442                 request->proxy = fake->packet;
 443                 fake->packet = NULL;
 444                 request->proxy_reply = fake->reply;
 445                 fake->reply = NULL;
 446
 447                 /*
 448                  *      And we're done with this request.
 449                  */
 450
 451                 switch (rcode) {
 452                 case RLM_MODULE_FAIL:
 453                         request_free(&fake);
 454                         eaptls_fail(handler->eap_ds, 0);
 455                         return 0;
 456                         break;
 457
 458                 default:  /* Don't Do Anything */
 459                         DEBUG2(" PEAP: Got reply %d",
 460                                request->proxy_reply->code);
 461                         break;
 462                 }
 463         }
 464         request_free(&fake);    /* robust if fake == NULL */
 465
 466         /*
 467          *      If there was no EAP-Message in the reply packet, then
 468          *      we know that we're supposed to re-run the "authenticate"
 469          *      stage, in order to get the right kind of handling...
 470          */
 471
 472         /*
 473          *      Process the reply from the home server.
 474          */
 475
 476         rcode = process_reply(handler, tls_session, handler->request,
 477                               handler->request->proxy_reply);
 478
 479         /*
 480          *      The proxy code uses the reply from the home server as
 481          *      the basis for the reply to the NAS.  We don't want that,
 482          *      so we toss it, after we've had our way with it.
 483          */
 484         pairfree(&handler->request->proxy_reply->vps);
 485
 486         switch (rcode) {
 487         case RLM_MODULE_REJECT:
 488                 DEBUG2("  PEAP: Reply was rejected");
 489                 eaptls_fail(handler->eap_ds, 0);
 490                 return 0;
 491
 492         case RLM_MODULE_HANDLED:
 493                 DEBUG2("  PEAP: Reply was handled");
 494                 eaptls_request(handler->eap_ds, tls_session);
 495                 return 1;
 496
 497         case RLM_MODULE_OK:
 498                 DEBUG2("  PEAP: Reply was OK");
 499                 eaptls_success(handler->eap_ds, 0);
 500                 eaptls_gen_mppe_keys(&handler->request->reply->vps,
 501                                      tls_session->ssl,
 502                                      "client EAP encryption");
 503                 return 1;
 504
 505         default:
 506                 DEBUG2("  PEAP: Reply was unknown.");
 507                 break;
 508         }
 509
 510         eaptls_fail(handler->eap_ds, 0);
 511         return 0;
 512 }
 513
 514 /*
 515  *      Free a request.
 516  */
 517 static void my_request_free(void *data)
 518 {
 519         REQUEST *request = (REQUEST *)data;
 520
 521         request_free(&request);
 522 }
 523
 524
 525 /*
 526  *      Process the pseudo-EAP contents of the tunneled data.
 527  */
 528 int eappeap_process(EAP_HANDLER *handler, tls_session_t *tls_session)
 529 {
 530         int err;
 531         peap_tunnel_t *t = tls_session->opaque;
 532         REQUEST *fake;
 533         VALUE_PAIR *vp;
 534         int rcode = RLM_MODULE_REJECT;
 535         const uint8_t *data;
 536         unsigned int data_len;
 537         unsigned char buffer[1024];
 538 #ifndef NDEBUG
 539         int i;
 540 #endif
 541
 542         REQUEST *request = handler->request;
 543         EAP_DS *eap_ds = handler->eap_ds;
 544
 545         /*
 546          *      Grab the dirty data, and copy it to our buffer.
 547          *
 548          *      I *really* don't like these 'record_t' things...
 549          */
 550         data_len = (tls_session->record_minus)(&tls_session->dirty_in, buffer, sizeof(buffer));
 551         data = buffer;
 552
 553         /*
 554          *      Write the data from the dirty buffer (i.e. packet
 555          *      data) into the buffer which we will give to SSL for
 556          *      decoding.
 557          *
 558          *      Some of this code COULD technically go into the TLS
 559          *      module, in eaptls_process(), where it returns EAPTLS_OK.
 560          *
 561          *      Similarly, the writing of data to the SSL context could
 562          *      go there, too...
 563          */
 564         BIO_write(tls_session->into_ssl, buffer, data_len);
 565         (tls_session->record_init)(&tls_session->clean_out);
 566
 567         /*
 568          *      Read (and decrypt) the tunneled data from the SSL session,
 569          *      and put it into the decrypted data buffer.
 570          */
 571         err = SSL_read(tls_session->ssl, tls_session->clean_out.data,
 572                        sizeof(tls_session->clean_out.data));
 573         if (err < 0) {
 574                 /*
 575                  *      FIXME: Call SSL_get_error() to see what went
 576                  *      wrong.
 577                  */
 578                 radlog(L_INFO, "rlm_eap_peap: SSL_read Error");
 579                 return RLM_MODULE_REJECT;
 580         }
 581
 582         /*
 583          *      If there's no data, maybe this is an ACK to an
 584          *      MS-CHAP2-Success.
 585          */
 586         if (err == 0) {
 587                 /*
 588                  *      FIXME: Call SSL_get_error() to see what went
 589                  *      wrong.
 590                  */
 591                 radlog(L_INFO, "rlm_eap_peap: No data inside of the tunnel.");
 592                 return RLM_MODULE_REJECT;
 593         }
 594
 595         data_len = tls_session->clean_out.used = err;
 596         data = tls_session->clean_out.data;
 597
 598 #ifndef NDEBUG
 599         if (debug_flag > 2) {
 600                 for (i = 0; i < data_len; i++) {
 601                         if ((i & 0x0f) == 0) printf("  PEAP tunnel data in %04x: ", i);
 602
 603                         printf("%02x ", data[i]);
 604
 605                         if ((i & 0x0f) == 0x0f) printf("\n");
 606                 }
 607                 if ((data_len & 0x0f) != 0) printf("\n");
 608         }
 609 #endif
 610
 611         if (!eapmessage_verify(data, data_len)) {
 612                 return RLM_MODULE_REJECT;
 613         }
 614
 615         DEBUG2("  rlm_eap_peap: Tunneled data is valid.");
 616
 617         /*
 618          *      If we authenticated the user, then it's OK.
 619          */
 620         if (t->status == PEAP_STATUS_SENT_TLV_SUCCESS) {
 621                 if (eappeap_check_tlv(data)) {
 622                         DEBUG2("  rlm_eap_peap: Success");
 623                         return RLM_MODULE_OK;
 624                 }
 625
 626                 return RLM_MODULE_REJECT;
 627
 628         } else if (t->status == PEAP_STATUS_SENT_TLV_FAILURE) {
 629                 DEBUG2("  rlm_eap_peap:  Had sent TLV failure.  User was rejcted rejected earlier in this session.");
 630                 return RLM_MODULE_REJECT;
 631         }
 632
 633         fake = request_alloc_fake(request);
 634
 635         rad_assert(fake->packet->vps == NULL);
 636
 637         fake->packet->vps = eap2vp(eap_ds, data, data_len);
 638         if (!fake->packet->vps) {
 639                 request_free(&fake);
 640                 DEBUG2("  rlm_eap_peap: Unable to convert tunneled EAP packet to internal server data structures");
 641                 return PW_AUTHENTICATION_REJECT;
 642         }
 643
 644 #ifndef NDEBUG
 645         if (debug_flag > 0) {
 646           printf("  PEAP: Got tunneled EAP-Message\n");
 647
 648           for (vp = fake->packet->vps; vp != NULL; vp = vp->next) {
 649             putchar('\t');vp_print(stdout, vp);putchar('\n');
 650           }
 651         }
 652 #endif
 653
 654         /*
 655          *      Tell the request that it's a fake one.
 656          */
 657         vp = pairmake("Freeradius-Proxied-To", "127.0.0.1", T_OP_EQ);
 658         if (vp) {
 659                 pairadd(&fake->packet->vps, vp);
 660         }
 661
 662         /*
 663          *      Update other items in the REQUEST data structure.
 664          */
 665         if (!t->username) {
 666                 /*
 667                  *      There's no User-Name in the tunneled session,
 668                  *      so we add one here, by pulling it out of the
 669                  *      EAP-Identity packet.
 670                  */
 671                 if ((data[0] == PW_EAP_IDENTITY) && (data_len > 1)) {
 672                         t->username = pairmake("User-Name", "", T_OP_EQ);
 673                         rad_assert(t->username != NULL);
 674
 675                         memcpy(t->username->strvalue, data + 1, data_len - 1);
 676                         t->username->length = data_len - 1;
 677                         t->username->strvalue[t->username->length] = 0;
 678                         DEBUG2("  PEAP: Got tunneled identity of %s", t->username->strvalue);
 679
 680                         /*
 681                          *      If there's a default EAP type,
 682                          *      set it here.
 683                          */
 684                         if (t->default_eap_type != 0) {
 685                                 DEBUG2("  PEAP: Setting default EAP type for tunneled EAP session.");
 686                                 vp = pairmake("EAP-Type", "0", T_OP_EQ);
 687                                 vp->lvalue = t->default_eap_type;
 688                                 pairadd(&fake->config_items, vp);
 689                         }
 690                 }
 691         } /* else there WAS a t->username */
 692
 693         if (t->username) {
 694                 vp = paircopy(t->username);
 695                 pairadd(&fake->packet->vps, vp);
 696                 fake->username = pairfind(fake->packet->vps, PW_USER_NAME);
 697                 DEBUG2("  PEAP: Setting User-Name to %s",
 698                        fake->username->strvalue);
 699         }
 700
 701         /*
 702          *      Add the State attribute, too, if it exists.
 703          */
 704         if (t->state) {
 705                 DEBUG2("  PEAP: Adding old state with %02x %02x",
 706                        t->state->strvalue[0], t->state->strvalue[1]);
 707                 vp = paircopy(t->state);
 708                 if (vp) pairadd(&fake->packet->vps, vp);
 709         }
 710
 711         /*
 712          *      If this is set, we copy SOME of the request attributes
 713          *      from outside of the tunnel to inside of the tunnel.
 714          *
 715          *      We copy ONLY those attributes which do NOT already
 716          *      exist in the tunneled request.
 717          *
 718          *      This code is copied from ../rlm_eap_ttls/ttls.c
 719          */
 720         if (t->copy_request_to_tunnel) {
 721                 VALUE_PAIR *copy;
 722
 723                 for (vp = request->packet->vps; vp != NULL; vp = vp->next) {
 724                         /*
 725                          *      The attribute is a server-side thingy,
 726                          *      don't copy it.
 727                          */
 728                         if ((vp->attribute > 255) &&
 729                             (((vp->attribute >> 16) & 0xffff) == 0)) {
 730                                 continue;
 731                         }
 732
 733                         /*
 734                          *      The outside attribute is already in the
 735                          *      tunnel, don't copy it.
 736                          *
 737                          *      This works for BOTH attributes which
 738                          *      are originally in the tunneled request,
 739                          *      AND attributes which are copied there
 740                          *      from below.
 741                          */
 742                         if (pairfind(fake->packet->vps, vp->attribute)) {
 743                                 continue;
 744                         }
 745
 746                         /*
 747                          *      Some attributes are handled specially.
 748                          */
 749                         switch (vp->attribute) {
 750                                 /*
 751                                  *      NEVER copy Message-Authenticator,
 752                                  *      EAP-Message, or State.  They're
 753                                  *      only for outside of the tunnel.
 754                                  */
 755                         case PW_USER_NAME:
 756                         case PW_USER_PASSWORD:
 757                         case PW_CHAP_PASSWORD:
 758                         case PW_CHAP_CHALLENGE:
 759                         case PW_PROXY_STATE:
 760                         case PW_MESSAGE_AUTHENTICATOR:
 761                         case PW_EAP_MESSAGE:
 762                         case PW_STATE:
 763                                 continue;
 764                                 break;
 765
 766                                 /*
 767                                  *      By default, copy it over.
 768                                  */
 769                         default:
 770                                 break;
 771                         }
 772
 773                         /*
 774                          *      Don't copy from the head, we've already
 775                          *      checked it.
 776                          */
 777                         copy = paircopy2(vp, vp->attribute);
 778                         pairadd(&fake->packet->vps, copy);
 779                 }
 780         }
 781
 782 #ifndef NDEBUG
 783         if (debug_flag > 0) {
 784                 printf("  PEAP: Sending tunneled request\n");
 785
 786                 for (vp = fake->packet->vps; vp != NULL; vp = vp->next) {
 787                         putchar('\t');vp_print(stdout, vp);putchar('\n');
 788                 }
 789         }
 790 #endif
 791
 792         /*
 793          *      Call authentication recursively, which will
 794          *      do PAP, CHAP, MS-CHAP, etc.
 795          */
 796         rad_authenticate(fake);
 797
 798         /*
 799          *      Note that we don't do *anything* with the reply
 800          *      attributes.
 801          */
 802 #ifndef NDEBUG
 803         if (debug_flag > 0) {
 804                 printf("  PEAP: Got tunneled reply RADIUS code %d\n",
 805                  fake->reply->code);
 806
 807                 for (vp = fake->reply->vps; vp != NULL; vp = vp->next) {
 808                         putchar('\t');vp_print(stdout, vp);putchar('\n');
 809                 }
 810         }
 811 #endif
 812
 813         /*
 814          *      Decide what to do with the reply.
 815          */
 816         switch (fake->reply->code) {
 817         case 0:                 /* No reply code, must be proxied... */
 818                 vp = pairfind(fake->config_items, PW_PROXY_TO_REALM);
 819
 820                 if (vp) {
 821                         eap_tunnel_data_t *tunnel;
 822
 823                         /*
 824                          *      The tunneled request was NOT handled,
 825                          *      it has to be proxied.  This means that
 826                          *      the "authenticate" stage was never
 827                          *      performed.
 828                          *
 829                          *      If we are told to NOT proxy the
 830                          *      tunneled request as EAP, then this
 831                          *      means that we've got to decode it,
 832                          *      which means that we MUST run the
 833                          *      "authenticate" portion by hand, here.
 834                          *
 835                          *      Once the tunneled EAP session is ALMOST
 836                          *      done, THEN we proxy it...
 837                          */
 838                         if (!t->proxy_tunneled_request_as_eap) {
 839                                 fake->options |= RAD_REQUEST_OPTION_PROXY_EAP;
 840
 841                                 /*
 842                                  *      Hmm... should we check for
 843                                  *      Auth-Type & EAP-Message here?
 844                                  */
 845
 846
 847                                 /*
 848                                  *      Run the EAP authentication.
 849                                  */
 850                                 DEBUG2("  PEAP: Calling authenticate in order to initiate tunneled EAP session.");
 851                                 rcode = module_authenticate(PW_AUTHTYPE_EAP, fake);
 852                                 if (rcode == RLM_MODULE_OK) {
 853                                         /*
 854                                          *      Authentication succeeded! Rah!
 855                                          */
 856                                         fake->reply->code = PW_AUTHENTICATION_ACK;
 857                                         goto do_process;
 858                                 }
 859
 860                                 if (rcode != RLM_MODULE_HANDLED) {
 861                                         DEBUG2("  PEAP: Can't handle the return code %d", rcode);
 862                                         rcode = RLM_MODULE_REJECT;
 863                                         goto done;
 864                                 }
 865
 866                                 /*
 867                                  *      The module decided it wasn't
 868                                  *      done.  Handle it like normal.
 869                                  */
 870                                 if ((fake->options & RAD_REQUEST_OPTION_PROXY_EAP) == 0) {
 871                                         DEBUG2("    PEAP: Cancelling proxy to realm %s until the tunneled EAP session has been established", vp->strvalue);
 872                                         goto do_process;
 873                                 }
 874
 875                                 /*
 876                                  *      The module has decoded the
 877                                  *      EAP-Message into another set
 878                                  *      of attributes.
 879                                  */
 880                                 pairdelete(&fake->packet->vps,
 881                                            PW_EAP_MESSAGE);
 882                         }
 883
 884                         DEBUG2("  PEAP: Tunneled authentication will be proxied to %s", vp->strvalue);
 885
 886                         /*
 887                          *      Tell the original request that it's going
 888                          *      to be proxied.
 889                          */
 890                         pairmove2(&(request->config_items),
 891                                   &(fake->config_items),
 892                                   PW_PROXY_TO_REALM);
 893
 894                         /*
 895                          *      Seed the proxy packet with the
 896                          *      tunneled request.
 897                          */
 898                         rad_assert(request->proxy == NULL);
 899                         request->proxy = fake->packet;
 900                         fake->packet = NULL;
 901                         rad_free(&fake->reply);
 902                         fake->reply = NULL;
 903
 904                         /*
 905                          *      Set up the callbacks for the tunnel
 906                          */
 907                         tunnel = rad_malloc(sizeof(*tunnel));
 908                         memset(tunnel, 0, sizeof(*tunnel));
 909
 910                         tunnel->tls_session = tls_session;
 911                         tunnel->callback = eappeap_postproxy;
 912
 913                         /*
 914                          *      Associate the callback with the request.
 915                          */
 916                         rcode = request_data_add(request,
 917                                                  request->proxy,
 918                                                  REQUEST_DATA_EAP_TUNNEL_CALLBACK,
 919                                                  tunnel, free);
 920                         rad_assert(rcode == 0);
 921
 922                         /*
 923                          *      We're not proxying it as EAP, so we've got
 924                          *      to do the callback later.
 925                          */
 926                         if ((fake->options & RAD_REQUEST_OPTION_PROXY_EAP) != 0) {
 927                                 DEBUG2("  PEAP: Remembering to do EAP-MS-CHAP-V2 post-proxy.");
 928
 929                                 /*
 930                                  *      rlm_eap.c has taken care of associating
 931                                  *      the handler with the fake request.
 932                                  *
 933                                  *      So we associate the fake request with
 934                                  *      this request.
 935                                  */
 936                                 rcode = request_data_add(request,
 937                                                          request->proxy,
 938                                                          REQUEST_DATA_EAP_MSCHAP_TUNNEL_CALLBACK,
 939                                                          fake, my_request_free);
 940                                 rad_assert(rcode == 0);
 941
 942                                 /*
 943                                  *      Do NOT free the fake request!
 944                                  */
 945                                 return RLM_MODULE_UPDATED;
 946                         }
 947
 948                         /*
 949                          *      Didn't authenticate the packet, but
 950                          *      we're proxying it.
 951                          */
 952                         rcode = RLM_MODULE_UPDATED;
 953
 954                 } else {
 955                         DEBUG2("  PEAP: Unknown RADIUS packet type %d: rejecting tunneled user", fake->reply->code);
 956                         rcode = RLM_MODULE_REJECT;
 957                 }
 958                 break;
 959
 960         default:
 961         do_process:
 962                 rcode = process_reply(handler, tls_session, request,
 963                                       fake->reply);
 964                 break;
 965         }
 966
 967  done:
 968         request_free(&fake);
 969
 970         return rcode;
 971 }