src/modules/rlm_eap/types/rlm_eap_peap/peap.c

   1 /*
   2  * peap.c contains the interfaces that are called from eap
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  *   Copyright 2003 Alan DeKok <aland@freeradius.org>
  21  *   Copyright 2006 The FreeRADIUS server project
  22  */
  23
  24 #include <freeradius-devel/ident.h>
  25 RCSID("$Id$")
  26
  27 #include "eap_peap.h"
  28
  29 static int setup_fake_request(REQUEST *request, REQUEST *fake, peap_tunnel_t *t);
  30
  31 /*
  32  *      Send protected EAP-Failure
  33  *
  34  *       Result-TLV = Failure
  35  */
  36 static int eappeap_failure(eap_handler_t *handler, tls_session_t *tls_session)
  37 {
  38         uint8_t tlv_packet[11];
  39         REQUEST *request = handler->request;
  40
  41         RDEBUG2("FAILURE");
  42
  43         tlv_packet[0] = PW_EAP_REQUEST;
  44         tlv_packet[1] = handler->eap_ds->response->id +1;
  45         tlv_packet[2] = 0;
  46         tlv_packet[3] = 11;     /* length of this packet */
  47         tlv_packet[4] = PW_EAP_TLV;
  48         tlv_packet[5] = 0x80;
  49         tlv_packet[6] = EAP_TLV_ACK_RESULT;
  50         tlv_packet[7] = 0;
  51         tlv_packet[8] = 2;      /* length of the data portion */
  52         tlv_packet[9] = 0;
  53         tlv_packet[10] = EAP_TLV_FAILURE;
  54
  55         (tls_session->record_plus)(&tls_session->clean_in, tlv_packet, 11);
  56
  57         /*
  58          *      FIXME: Check the return code.
  59          */
  60         tls_handshake_send(request, tls_session);
  61
  62         return 1;
  63 }
  64
  65
  66 /*
  67  *      Send protected EAP-Success
  68  *
  69  *       Result-TLV = Success
  70  */
  71 static int eappeap_success(eap_handler_t *handler, tls_session_t *tls_session)
  72 {
  73         uint8_t tlv_packet[11];
  74         REQUEST *request = handler->request;
  75
  76         RDEBUG2("SUCCESS");
  77
  78         tlv_packet[0] = PW_EAP_REQUEST;
  79         tlv_packet[1] = handler->eap_ds->response->id +1;
  80         tlv_packet[2] = 0;
  81         tlv_packet[3] = 11;     /* length of this packet */
  82         tlv_packet[4] = PW_EAP_TLV;
  83         tlv_packet[5] = 0x80;   /* mandatory AVP */
  84         tlv_packet[6] = EAP_TLV_ACK_RESULT;
  85         tlv_packet[7] = 0;
  86         tlv_packet[8] = 2;      /* length of the data portion */
  87         tlv_packet[9] = 0;
  88         tlv_packet[10] = EAP_TLV_SUCCESS;
  89
  90         (tls_session->record_plus)(&tls_session->clean_in, tlv_packet, 11);
  91
  92         /*
  93          *      FIXME: Check the return code.
  94          */
  95         tls_handshake_send(request, tls_session);
  96
  97         return 1;
  98 }
  99
 100
 101 static int eappeap_identity(eap_handler_t *handler, tls_session_t *tls_session)
 102 {
 103         eap_packet_raw_t eap_packet;
 104
 105         eap_packet.code = PW_EAP_REQUEST;
 106         eap_packet.id = handler->eap_ds->response->id + 1;
 107         eap_packet.length[0] = 0;
 108         eap_packet.length[1] = EAP_HEADER_LEN + 1;
 109         eap_packet.data[0] = PW_EAP_IDENTITY;
 110
 111         (tls_session->record_plus)(&tls_session->clean_in,
 112                                   &eap_packet, sizeof(eap_packet));
 113
 114         tls_handshake_send(handler->request, tls_session);
 115         (tls_session->record_init)(&tls_session->clean_in);
 116
 117         return 1;
 118 }
 119
 120 /*
 121  * Send an MS SoH request
 122  */
 123 static int eappeap_soh(eap_handler_t *handler, tls_session_t *tls_session)
 124 {
 125         uint8_t tlv_packet[20];
 126
 127         tlv_packet[0] = 254;    /* extended type */
 128
 129         tlv_packet[1] = 0;
 130         tlv_packet[2] = 0x01;   /* ms vendor */
 131         tlv_packet[3] = 0x37;
 132
 133         tlv_packet[4] = 0;      /* ms soh eap */
 134         tlv_packet[5] = 0;
 135         tlv_packet[6] = 0;
 136         tlv_packet[7] = 0x21;
 137
 138         tlv_packet[8] = 0;      /* vendor-spec tlv */
 139         tlv_packet[9] = 7;
 140
 141         tlv_packet[10] = 0;
 142         tlv_packet[11] = 8;     /* payload len */
 143
 144         tlv_packet[12] = 0;     /* ms vendor */
 145         tlv_packet[13] = 0;
 146         tlv_packet[14] = 0x01;
 147         tlv_packet[15] = 0x37;
 148
 149         tlv_packet[16] = 0;
 150         tlv_packet[17] = 2;
 151         tlv_packet[18] = 0;
 152         tlv_packet[19] = 0;
 153
 154         (tls_session->record_plus)(&tls_session->clean_in, tlv_packet, 20);
 155         tls_handshake_send(handler->request, tls_session);
 156         return 1;
 157 }
 158
 159 static void eapsoh_verify(REQUEST *request, RADIUS_PACKET *packet,
 160                           const uint8_t *data, unsigned int data_len) {
 161
 162         VALUE_PAIR *vp;
 163         uint8_t eap_method_base;
 164         uint32_t eap_vendor;
 165         uint32_t eap_method;
 166         int rv;
 167
 168         vp = pairmake(packet, &packet->vps, "SoH-Supported", "no", T_OP_EQ);
 169         if (data && data[0] == PW_EAP_NAK) {
 170                 RDEBUG("SoH - client NAKed");
 171                 return;
 172         }
 173
 174         if (!data || data_len < 8) {
 175                 RDEBUG("SoH - eap payload too short");
 176                 return;
 177         }
 178
 179         eap_method_base = *data++;
 180         if (eap_method_base != 254) {
 181                 RDEBUG("SoH - response is not extended EAP: %i", eap_method_base);
 182                 return;
 183         }
 184
 185         eap_vendor = soh_pull_be_24(data); data += 3;
 186         if (eap_vendor != 0x137) {
 187                 RDEBUG("SoH - extended eap vendor %08x is not Microsoft", eap_vendor);
 188                 return;
 189         }
 190
 191         eap_method = soh_pull_be_32(data); data += 4;
 192         if (eap_method != 0x21) {
 193                 RDEBUG("SoH - response eap type %08x is not EAP-SoH", eap_method);
 194                 return;
 195         }
 196
 197
 198         rv = soh_verify(request, data, data_len - 8);
 199         if (rv<0) {
 200                 RDEBUG("SoH - error decoding payload: %s", fr_strerror());
 201         } else {
 202                 vp->vp_integer = 1;
 203         }
 204 }
 205
 206 /*
 207  *      Verify the tunneled EAP message.
 208  */
 209 static int eapmessage_verify(REQUEST *request,
 210                              const uint8_t *data, unsigned int data_len)
 211 {
 212         const eap_packet_raw_t *eap_packet = (const eap_packet_raw_t *) data;
 213         eap_type_t eap_method;
 214
 215         /*
 216          *      No data, OR only 1 byte of EAP type.
 217          */
 218         if (!data || (data_len == 0) ||
 219             ((data_len <= 1) && (data[0] != PW_EAP_IDENTITY))) {
 220                 return 0;
 221         }
 222
 223         eap_method = *data;
 224         switch (eap_method) {
 225         case PW_EAP_IDENTITY:
 226                 if (data_len == 1) {
 227                         RDEBUG2("Identity - ");
 228                         return 1;
 229                 }
 230                 RDEBUG2("Identity - %*s",
 231                        data_len - 1, data + 1);
 232                 return 1;
 233                 break;
 234
 235                 /*
 236                  *      If the first byte of the packet is
 237                  *      EAP-Response, and the EAP data is a TLV,
 238                  *      then it looks OK...
 239                  */
 240         case PW_EAP_RESPONSE:
 241                 if (eap_packet->data[0] == PW_EAP_TLV) {
 242                         RDEBUG2("Received EAP-TLV response.");
 243                         return 1;
 244                 }
 245                 RDEBUG2("Got something weird.");
 246                 break;
 247
 248
 249                 /*
 250                  *      We normally do Microsoft MS-CHAPv2 (26), versus
 251                  *      Cisco MS-CHAPv2 (29).
 252                  */
 253         case PW_EAP_MSCHAPV2:
 254         default:
 255                 RDEBUG2("EAP type %s (%d)", eap_type2name(eap_method),
 256                         eap_method);
 257                 return 1;
 258                 break;
 259         }
 260
 261         return 0;
 262 }
 263
 264 /*
 265  *      Convert a pseudo-EAP packet to a list of VALUE_PAIR's.
 266  */
 267 static VALUE_PAIR *eap2vp(REQUEST *request, RADIUS_PACKET *packet,
 268                           EAP_DS *eap_ds,
 269                           const uint8_t *data, size_t data_len)
 270 {
 271         size_t total;
 272         VALUE_PAIR *vp = NULL, *head, **tail;
 273
 274         if (data_len > 65535) return NULL; /* paranoia */
 275
 276         vp = paircreate(packet, PW_EAP_MESSAGE, 0);
 277         if (!vp) {
 278                 RDEBUG2("Failure in creating VP");
 279                 return NULL;
 280         }
 281
 282         total = data_len;
 283         if (total > 249) total = 249;
 284
 285         /*
 286          *      Hand-build an EAP packet from the crap in PEAP version 0.
 287          */
 288         vp->vp_octets[0] = PW_EAP_RESPONSE;
 289         vp->vp_octets[1] = eap_ds->response->id;
 290         vp->vp_octets[2] = (data_len + EAP_HEADER_LEN) >> 8;
 291         vp->vp_octets[3] = (data_len + EAP_HEADER_LEN) & 0xff;
 292
 293         memcpy(vp->vp_octets + EAP_HEADER_LEN, data, total);
 294         vp->length = EAP_HEADER_LEN + total;
 295
 296         head = vp;
 297         tail = &(vp->next);
 298         while (total < data_len) {
 299                 int vp_len;
 300
 301
 302                 vp = paircreate(packet, PW_EAP_MESSAGE, 0);
 303                 if (!vp) {
 304                         RDEBUG2("Failure in creating VP");
 305                         pairfree(&head);
 306                         return NULL;
 307                 }
 308                 vp_len = (data_len - total);
 309                 if (vp_len > 253) vp_len = 253;
 310
 311                 memcpy(vp->vp_octets, data + total, vp_len);
 312                 vp->length = vp_len;
 313
 314                 total += vp_len;
 315                 *tail = vp;
 316                 tail = &(vp->next);
 317         }
 318
 319         return head;
 320 }
 321
 322
 323 /*
 324  *      Convert a list of VALUE_PAIR's to an EAP packet, through the
 325  *      simple expedient of dumping the EAP message
 326  */
 327 static int vp2eap(REQUEST *request, tls_session_t *tls_session, VALUE_PAIR *vp)
 328 {
 329         rad_assert(vp != NULL);
 330
 331         /*
 332          *      Skip the id, code, and length.  Just write the EAP
 333          *      type & data to the client.
 334          */
 335 #ifndef NDEBUG
 336         if ((debug_flag > 2) && fr_log_fp) {
 337                 size_t i, total;
 338                 VALUE_PAIR *this;
 339
 340                 total = 0;
 341
 342                 for (this = vp; this != NULL; this = this->next) {
 343                         int start = 0;
 344
 345                         if (this == vp) start = EAP_HEADER_LEN;
 346
 347                         for (i = start; i < vp->length; i++) {
 348                           if ((total & 0x0f) == 0) fprintf(fr_log_fp, "  PEAP tunnel data out %04x: ", (int) total);
 349
 350                                 fprintf(fr_log_fp, "%02x ", vp->vp_octets[i]);
 351
 352                                 if ((total & 0x0f) == 0x0f) fprintf(fr_log_fp, "\n");
 353                                 total++;
 354                         }
 355                 }
 356                 if ((total & 0x0f) != 0) fprintf(fr_log_fp, "\n");
 357         }
 358 #endif
 359
 360         /*
 361          *      Send the EAP data, WITHOUT the header.
 362          */
 363         (tls_session->record_plus)(&tls_session->clean_in,
 364                                    vp->vp_octets + EAP_HEADER_LEN,
 365                                    vp->length - EAP_HEADER_LEN);
 366
 367         /*
 368          *      Send the rest of the EAP data.
 369          */
 370         for (vp = vp->next; vp != NULL; vp = vp->next) {
 371                 (tls_session->record_plus)(&tls_session->clean_in,
 372                                            vp->vp_octets, vp->length);
 373         }
 374
 375         tls_handshake_send(request, tls_session);
 376
 377         return 1;
 378 }
 379
 380
 381 /*
 382  *      See if there's a TLV in the response.
 383  */
 384 static int eappeap_check_tlv(REQUEST *request, const uint8_t *data,
 385                              size_t data_len)
 386 {
 387         const eap_packet_raw_t *eap_packet = (const eap_packet_raw_t *) data;
 388
 389         if (data_len < 11) return 0;
 390
 391         /*
 392          *      Look for success or failure.
 393          */
 394         if ((eap_packet->code == PW_EAP_RESPONSE) &&
 395             (eap_packet->data[0] == PW_EAP_TLV)) {
 396                 if (data[10] == EAP_TLV_SUCCESS) {
 397                         return 1;
 398                 }
 399
 400                 if (data[10] == EAP_TLV_FAILURE) {
 401                         RDEBUG2("Client rejected our response.  The password is probably incorrect.");
 402                         return 0;
 403                 }
 404         }
 405
 406         RDEBUG("Unknown TLV %02x", data[10]);
 407
 408         return 0;
 409 }
 410
 411
 412 /*
 413  *      Use a reply packet to determine what to do.
 414  */
 415 static int process_reply(eap_handler_t *handler, tls_session_t *tls_session,
 416                          REQUEST *request, RADIUS_PACKET *reply)
 417 {
 418         int rcode = RLM_MODULE_REJECT;
 419         VALUE_PAIR *vp;
 420         peap_tunnel_t *t = tls_session->opaque;
 421
 422         if ((debug_flag > 0) && fr_log_fp) {
 423                 RDEBUG("Got tunneled reply RADIUS code %d",
 424                        reply->code);
 425
 426                 debug_pair_list(reply->vps);
 427         }
 428
 429         switch (reply->code) {
 430         case PW_AUTHENTICATION_ACK:
 431                 RDEBUG2("Tunneled authentication was successful.");
 432                 t->status = PEAP_STATUS_SENT_TLV_SUCCESS;
 433                 eappeap_success(handler, tls_session);
 434                 rcode = RLM_MODULE_HANDLED;
 435
 436                 /*
 437                  *      If we've been told to use the attributes from
 438                  *      the reply, then do so.
 439                  *
 440                  *      WARNING: This may leak information about the
 441                  *      tunneled user!
 442                  */
 443                 if (t->use_tunneled_reply) {
 444                         RDEBUG2("Saving tunneled attributes for later");
 445
 446                         /*
 447                          *      Clean up the tunneled reply.
 448                          */
 449                         pairdelete(&reply->vps, PW_PROXY_STATE, 0, TAG_ANY);
 450                         pairdelete(&reply->vps, PW_EAP_MESSAGE, 0, TAG_ANY);
 451                         pairdelete(&reply->vps, PW_MESSAGE_AUTHENTICATOR, 0, TAG_ANY);
 452
 453                         /*
 454                          *      Delete MPPE keys & encryption policy.  We don't
 455                          *      want these here.
 456                          */
 457                         pairdelete(&reply->vps, 7, VENDORPEC_MICROSOFT, TAG_ANY);
 458                         pairdelete(&reply->vps, 8, VENDORPEC_MICROSOFT, TAG_ANY);
 459                         pairdelete(&reply->vps, 16, VENDORPEC_MICROSOFT, TAG_ANY);
 460                         pairdelete(&reply->vps, 17, VENDORPEC_MICROSOFT, TAG_ANY);
 461
 462                         rad_assert(t->accept_vps == NULL);
 463                         pairmove2(t, &t->accept_vps, &reply->vps, 0, 0, TAG_ANY);
 464                         rad_assert(reply->vps == NULL);
 465                 }
 466                 break;
 467
 468         case PW_AUTHENTICATION_REJECT:
 469                 RDEBUG2("Tunneled authentication was rejected.");
 470                 t->status = PEAP_STATUS_SENT_TLV_FAILURE;
 471                 eappeap_failure(handler, tls_session);
 472                 rcode = RLM_MODULE_HANDLED;
 473                 break;
 474
 475         case PW_ACCESS_CHALLENGE:
 476                 RDEBUG2("Got tunneled Access-Challenge");
 477
 478                 /*
 479                  *      Keep the State attribute, if necessary.
 480                  *
 481                  *      Get rid of the old State, too.
 482                  */
 483                 pairfree(&t->state);
 484                 pairmove2(t, &t->state, &(reply->vps), PW_STATE, 0, TAG_ANY);
 485
 486                 /*
 487                  *      PEAP takes only EAP-Message attributes inside
 488                  *      of the tunnel.  Any Reply-Message in the
 489                  *      Access-Challenge is ignored.
 490                  */
 491                 vp = NULL;
 492                 pairmove2(t, &vp, &(reply->vps), PW_EAP_MESSAGE, 0, TAG_ANY);
 493
 494                 /*
 495                  *      Handle EAP-MSCHAP-V2, where Access-Accept's
 496                  *      from the home server may contain MS-CHAP-Success,
 497                  *      which the module turns into challenges, so that
 498                  *      the client may respond to the challenge with
 499                  *      an "ack" packet.
 500                  */
 501                 if (t->home_access_accept && t->use_tunneled_reply) {
 502                         RDEBUG2("Saving tunneled attributes for later");
 503
 504                         /*
 505                          *      Clean up the tunneled reply.
 506                          */
 507                         pairdelete(&reply->vps, PW_PROXY_STATE, 0, TAG_ANY);
 508                         pairdelete(&reply->vps, PW_MESSAGE_AUTHENTICATOR, 0, TAG_ANY);
 509
 510                         rad_assert(t->accept_vps == NULL);
 511                         pairmove2(t, &t->accept_vps, &reply->vps,
 512                                   0, 0, TAG_ANY);
 513                         rad_assert(reply->vps == NULL);
 514                 }
 515
 516                 /*
 517                  *      Handle the ACK, by tunneling any necessary reply
 518                  *      VP's back to the client.
 519                  */
 520                 if (vp) {
 521                         vp2eap(request, tls_session, vp);
 522                         pairfree(&vp);
 523                 }
 524
 525                 rcode = RLM_MODULE_HANDLED;
 526                 break;
 527
 528         default:
 529                 RDEBUG2("Unknown RADIUS packet type %d: rejecting tunneled user", reply->code);
 530                 rcode = RLM_MODULE_REJECT;
 531                 break;
 532         }
 533
 534         return rcode;
 535 }
 536
 537 #ifdef WITH_PROXY
 538 /*
 539  *      Do post-proxy processing,
 540  */
 541 static int eappeap_postproxy(eap_handler_t *handler, void *data)
 542 {
 543         int rcode;
 544         tls_session_t *tls_session = (tls_session_t *) data;
 545         REQUEST *fake, *request = handler->request;
 546
 547         rad_assert(request != NULL);
 548         RDEBUG2("Passing reply from proxy back into the tunnel.");
 549
 550         /*
 551          *      If there was a fake request associated with the proxied
 552          *      request, do more processing of it.
 553          */
 554         fake = (REQUEST *) request_data_get(handler->request,
 555                                             handler->request->proxy,
 556                                             REQUEST_DATA_EAP_MSCHAP_TUNNEL_CALLBACK);
 557
 558         /*
 559          *      Do the callback, if it exists, and if it was a success.
 560          */
 561         if (fake && (handler->request->proxy_reply->code == PW_AUTHENTICATION_ACK)) {
 562                 peap_tunnel_t *t = tls_session->opaque;
 563
 564                 t->home_access_accept = TRUE;
 565
 566                 /*
 567                  *      Terrible hacks.
 568                  */
 569                 rad_assert(fake->packet == NULL);
 570                 fake->packet = request->proxy;
 571                 fake->packet->src_ipaddr = request->packet->src_ipaddr;
 572                 request->proxy = NULL;
 573
 574                 rad_assert(fake->reply == NULL);
 575                 fake->reply = request->proxy_reply;
 576                 request->proxy_reply = NULL;
 577
 578                 if ((debug_flag > 0) && fr_log_fp) {
 579                         fprintf(fr_log_fp, "server %s {\n", fake->server);
 580                 }
 581
 582                 /*
 583                  *      Perform a post-auth stage, which will get the EAP
 584                  *      handler, too...
 585                  */
 586                 fake->options &= ~RAD_REQUEST_OPTION_PROXY_EAP;
 587                 RDEBUG2("Passing reply back for EAP-MS-CHAP-V2");
 588                 process_post_proxy(0, fake);
 589
 590                 /*
 591                  *      FIXME: If rcode returns fail, do something
 592                  *      intelligent...
 593                  */
 594                 rcode = rad_postauth(fake);
 595
 596                 if ((debug_flag > 0) && fr_log_fp) {
 597                         fprintf(fr_log_fp, "} # server %s\n", fake->server);
 598
 599                         RDEBUG("Final reply from tunneled session code %d",
 600                                fake->reply->code);
 601
 602                         debug_pair_list(fake->reply->vps);
 603                 }
 604
 605                 /*
 606                  *      Terrible hacks.
 607                  */
 608                 request->proxy = fake->packet;
 609                 fake->packet = NULL;
 610                 request->proxy_reply = fake->reply;
 611                 fake->reply = NULL;
 612
 613                 /*
 614                  *      And we're done with this request.
 615                  */
 616
 617                 switch (rcode) {
 618                 case RLM_MODULE_FAIL:
 619                         request_free(&fake);
 620                         eaptls_fail(handler, 0);
 621                         return 0;
 622                         break;
 623
 624                 default:  /* Don't Do Anything */
 625                         RDEBUG2("Got reply %d", request->proxy_reply->code);
 626                         break;
 627                 }
 628         }
 629         request_free(&fake);    /* robust if fake == NULL */
 630
 631         /*
 632          *      If there was no EAP-Message in the reply packet, then
 633          *      we know that we're supposed to re-run the "authenticate"
 634          *      stage, in order to get the right kind of handling...
 635          */
 636
 637         /*
 638          *      Process the reply from the home server.
 639          */
 640
 641         rcode = process_reply(handler, tls_session, handler->request,
 642                               handler->request->proxy_reply);
 643
 644         /*
 645          *      The proxy code uses the reply from the home server as
 646          *      the basis for the reply to the NAS.  We don't want that,
 647          *      so we toss it, after we've had our way with it.
 648          */
 649         pairfree(&handler->request->proxy_reply->vps);
 650
 651         switch (rcode) {
 652         case RLM_MODULE_REJECT:
 653                 RDEBUG2("Reply was rejected");
 654                 eaptls_fail(handler, 0);
 655                 return 0;
 656
 657         case RLM_MODULE_HANDLED:
 658                 RDEBUG2("Reply was handled");
 659                 eaptls_request(handler->eap_ds, tls_session);
 660                 return 1;
 661
 662         case RLM_MODULE_OK:
 663                 RDEBUG2("Reply was OK");
 664
 665                 /*
 666                  *      Success: Automatically return MPPE keys.
 667                  */
 668                 return eaptls_success(handler, 0);
 669
 670         default:
 671                 RDEBUG2("Reply was unknown.");
 672                 break;
 673         }
 674
 675         eaptls_fail(handler, 0);
 676         return 0;
 677 }
 678
 679 /*
 680  *      Free a request.
 681  */
 682 static void my_request_free(void *data)
 683 {
 684         REQUEST *request = (REQUEST *)data;
 685
 686         request_free(&request);
 687 }
 688 #endif
 689
 690
 691 static const char *peap_state(peap_tunnel_t *t)
 692 {
 693         switch (t->status) {
 694                 case PEAP_STATUS_TUNNEL_ESTABLISHED:
 695                         return "TUNNEL ESTABLISHED";
 696                 case PEAP_STATUS_WAIT_FOR_SOH_RESPONSE:
 697                         return "WAITING FOR SOH RESPONSE";
 698                 case PEAP_STATUS_INNER_IDENTITY_REQ_SENT:
 699                         return "WAITING FOR INNER IDENTITY";
 700                 case PEAP_STATUS_SENT_TLV_SUCCESS:
 701                         return "send tlv success";
 702                 case PEAP_STATUS_SENT_TLV_FAILURE:
 703                         return "send tlv failure";
 704                 case PEAP_STATUS_PHASE2_INIT:
 705                         return "phase2_init";
 706                 case PEAP_STATUS_PHASE2:
 707                         return "phase2";
 708                 default:
 709                         break;
 710         }
 711         return "?";
 712 }
 713
 714 static void print_tunneled_data(const uint8_t *data, size_t data_len)
 715 {
 716         size_t i;
 717
 718         if ((debug_flag > 2) && fr_log_fp) {
 719                 for (i = 0; i < data_len; i++) {
 720                   if ((i & 0x0f) == 0) fprintf(fr_log_fp, "  PEAP tunnel data in %02x: ", (int) i);
 721
 722                         fprintf(fr_log_fp, "%02x ", data[i]);
 723
 724                         if ((i & 0x0f) == 0x0f) fprintf(fr_log_fp, "\n");
 725                 }
 726                 if ((data_len & 0x0f) != 0) fprintf(fr_log_fp, "\n");
 727         }
 728 }
 729
 730
 731 /*
 732  *      Process the pseudo-EAP contents of the tunneled data.
 733  */
 734 int eappeap_process(eap_handler_t *handler, tls_session_t *tls_session)
 735 {
 736         peap_tunnel_t *t = tls_session->opaque;
 737         REQUEST *fake;
 738         VALUE_PAIR *vp;
 739         int rcode = RLM_MODULE_REJECT;
 740         const uint8_t   *data;
 741         unsigned int data_len;
 742
 743         REQUEST *request = handler->request;
 744         EAP_DS *eap_ds = handler->eap_ds;
 745
 746         rad_assert(request != NULL);
 747
 748         /*
 749          *      Just look at the buffer directly, without doing
 750          *      record_minus.  This lets us avoid another data copy.
 751          */
 752         data_len = tls_session->clean_out.used;
 753         tls_session->clean_out.used = 0;
 754         data = tls_session->clean_out.data;
 755
 756         RDEBUG2("Peap state %s", peap_state(t));
 757
 758         if ((t->status != PEAP_STATUS_TUNNEL_ESTABLISHED) &&
 759             !eapmessage_verify(request, data, data_len)) {
 760                 RDEBUG2("FAILED processing PEAP: Tunneled data is invalid.");
 761                 if (debug_flag > 2) print_tunneled_data(data, data_len);
 762                 return RLM_MODULE_REJECT;
 763         }
 764
 765         switch (t->status) {
 766         case PEAP_STATUS_TUNNEL_ESTABLISHED:
 767                 /* FIXME: should be no data in the buffer here, check & assert? */
 768
 769                 if (SSL_session_reused(tls_session->ssl)) {
 770                         RDEBUG2("Skipping Phase2 because of session resumption");
 771                         t->session_resumption_state = PEAP_RESUMPTION_YES;
 772                         if (t->soh) {
 773                                 t->status = PEAP_STATUS_WAIT_FOR_SOH_RESPONSE;
 774                                 RDEBUG2("Requesting SoH from client");
 775                                 eappeap_soh(handler, tls_session);
 776                                 return RLM_MODULE_HANDLED;
 777                         }
 778                         /* we're good, send success TLV */
 779                         t->status = PEAP_STATUS_SENT_TLV_SUCCESS;
 780                         eappeap_success(handler, tls_session);
 781
 782                 } else {
 783                         /* send an identity request */
 784                         t->session_resumption_state = PEAP_RESUMPTION_NO;
 785                         t->status = PEAP_STATUS_INNER_IDENTITY_REQ_SENT;
 786                         eappeap_identity(handler, tls_session);
 787                 }
 788                 return RLM_MODULE_HANDLED;
 789
 790         case PEAP_STATUS_INNER_IDENTITY_REQ_SENT:
 791                 /* we're expecting an identity response */
 792                 if (data[0] != PW_EAP_IDENTITY) {
 793                         RDEBUG("Expected EAP-Identity, got something else.");
 794                         return RLM_MODULE_REJECT;
 795                 }
 796
 797                 if (data_len >= sizeof(t->username->vp_strvalue)) {
 798                         RDEBUG("EAP-Identity is too long");
 799                         return RLM_MODULE_REJECT;
 800                 }
 801
 802                 /*
 803                  *      Save it for later.
 804                  */
 805                 t->username = pairmake(t, NULL, "User-Name", "", T_OP_EQ);
 806                 rad_assert(t->username != NULL);
 807
 808                 memcpy(t->username->vp_strvalue, data + 1, data_len - 1);
 809                 t->username->length = data_len - 1;
 810                 t->username->vp_strvalue[t->username->length] = 0;
 811                 RDEBUG("Got inner identity '%s'", t->username->vp_strvalue);
 812                 if (t->soh) {
 813                         t->status = PEAP_STATUS_WAIT_FOR_SOH_RESPONSE;
 814                         RDEBUG2("Requesting SoH from client");
 815                         eappeap_soh(handler, tls_session);
 816                         return RLM_MODULE_HANDLED;
 817                 }
 818                 t->status = PEAP_STATUS_PHASE2_INIT;
 819                 break;
 820
 821         case PEAP_STATUS_WAIT_FOR_SOH_RESPONSE:
 822                 fake = request_alloc_fake(request);
 823                 rad_assert(fake->packet->vps == NULL);
 824                 eapsoh_verify(request, fake->packet, data, data_len);
 825                 setup_fake_request(request, fake, t);
 826
 827                 if (t->soh_virtual_server) {
 828                         fake->server = t->soh_virtual_server;
 829                 }
 830                 RDEBUG("Sending SoH request to server %s", fake->server ? fake->server : "NULL");
 831                 debug_pair_list(fake->packet->vps);
 832                 RDEBUG("server %s {", fake->server);
 833                 rad_virtual_server(fake);
 834                 RDEBUG("} # server %s", fake->server);
 835                 RDEBUG("Got SoH reply");
 836                 debug_pair_list(fake->reply->vps);
 837
 838                 if (fake->reply->code != PW_AUTHENTICATION_ACK) {
 839                         RDEBUG2("SoH was rejected");
 840                         request_free(&fake);
 841                         t->status = PEAP_STATUS_SENT_TLV_FAILURE;
 842                         eappeap_failure(handler, tls_session);
 843                         return RLM_MODULE_HANDLED;
 844                 }
 845
 846                 /* save the SoH VPs */
 847                 rad_assert(t->soh_reply_vps == NULL);
 848                 pairmove2(t, &t->soh_reply_vps, &fake->reply->vps, 0, 0, TAG_ANY);
 849                 rad_assert(fake->reply->vps == NULL);
 850                 request_free(&fake);
 851
 852                 if (t->session_resumption_state == PEAP_RESUMPTION_YES) {
 853                         /* we're good, send success TLV */
 854                         t->status = PEAP_STATUS_SENT_TLV_SUCCESS;
 855                         eappeap_success(handler, tls_session);
 856                         return RLM_MODULE_HANDLED;
 857                 }
 858
 859                 t->status = PEAP_STATUS_PHASE2_INIT;
 860                 break;
 861
 862
 863         /*
 864          *      If we authenticated the user, then it's OK.
 865          */
 866         case PEAP_STATUS_SENT_TLV_SUCCESS:
 867                 if (eappeap_check_tlv(request, data, data_len)) {
 868                         RDEBUG2("Success");
 869                         return RLM_MODULE_OK;
 870                 }
 871
 872                 /*
 873                  *      Otherwise, the client rejected the session
 874                  *      resumption.  If the session is being re-used,
 875                  *      we need to do a full authentication.
 876                  *
 877                  *      We do this by sending an EAP-Identity request
 878                  *      inside of the PEAP tunnel.
 879                  */
 880                 if (t->session_resumption_state == PEAP_RESUMPTION_YES) {
 881                         RDEBUG2("Client rejected session resumption.  Re-starting full authentication");
 882
 883                         /*
 884                          *      Mark session resumption status.
 885                          */
 886                         t->status = PEAP_STATUS_INNER_IDENTITY_REQ_SENT;
 887                         t->session_resumption_state = PEAP_RESUMPTION_NO;
 888
 889                         eappeap_identity(handler, tls_session);
 890                         return RLM_MODULE_HANDLED;
 891                 }
 892
 893                 RDEBUG2("We sent a success, but received something weird in return.");
 894                 return RLM_MODULE_REJECT;
 895
 896         /*
 897          *      Damned if I know why the clients continue sending EAP
 898          *      packets after we told them to f*ck off.
 899          */
 900         case PEAP_STATUS_SENT_TLV_FAILURE:
 901                 RDEBUG(" The users session was previously rejected: returning reject (again.)");
 902                 RDEBUG(" *** This means you need to read the PREVIOUS messages in the debug output");
 903                 RDEBUG(" *** to find out the reason why the user was rejected.");
 904                 RDEBUG(" *** Look for \"reject\" or \"fail\".  Those earlier messages will tell you.");
 905                 RDEBUG(" *** what went wrong, and how to fix the problem.");
 906                 return RLM_MODULE_REJECT;
 907
 908                 case PEAP_STATUS_PHASE2_INIT:
 909                         RDEBUG("In state machine in phase2 init?");
 910
 911                 case PEAP_STATUS_PHASE2:
 912                         break;
 913
 914                 default:
 915                         RDEBUG2("Unhandled state in peap");
 916                         return RLM_MODULE_REJECT;
 917         }
 918
 919         fake = request_alloc_fake(request);
 920
 921         rad_assert(fake->packet->vps == NULL);
 922
 923         switch (t->status) {
 924                 /*
 925                  *      If we're in PHASE2_INIT, the phase2 method hasn't been
 926                  *      sent an Identity packet yet; do so from the stored
 927                  *      username and this will kick off the phase2 eap method
 928                  */
 929
 930         case PEAP_STATUS_PHASE2_INIT: {
 931                 size_t len = t->username->length + EAP_HEADER_LEN + 1;
 932
 933                 t->status = PEAP_STATUS_PHASE2;
 934
 935                 vp = paircreate(fake->packet, PW_EAP_MESSAGE, 0);
 936
 937                 vp->vp_octets[0] = PW_EAP_RESPONSE;
 938                 vp->vp_octets[1] = eap_ds->response->id;
 939                 vp->vp_octets[2] = (len >> 8) & 0xff;
 940                 vp->vp_octets[3] = len & 0xff;
 941                 vp->vp_octets[4] = PW_EAP_IDENTITY;
 942
 943                 if (len > sizeof(vp->vp_octets)) len = sizeof(vp->vp_octets);
 944                 memcpy(vp->vp_octets + EAP_HEADER_LEN + 1,
 945                        t->username->vp_strvalue, len - EAP_HEADER_LEN - 1);
 946                 vp->length = len;
 947
 948                 pairadd(&fake->packet->vps, vp);
 949
 950                 if (t->default_method != 0) {
 951                         RDEBUG2("Setting default EAP type for tunneled EAP session.");
 952                         vp = pairmake(fake, &fake->config_items, "EAP-Type", "0", T_OP_EQ);
 953                         vp->vp_integer = t->default_method;
 954                 }
 955                 break; }
 956
 957         case PEAP_STATUS_PHASE2:
 958                 fake->packet->vps = eap2vp(request, fake->packet,
 959                                            eap_ds, data, data_len);
 960                 if (!fake->packet->vps) {
 961                         request_free(&fake);
 962                         RDEBUG2("Unable to convert tunneled EAP packet to internal server data structures");
 963                         return PW_AUTHENTICATION_REJECT;
 964                 }
 965                 break;
 966
 967         default:
 968                 RDEBUG("Invalid state change in PEAP.");
 969                 return PW_AUTHENTICATION_REJECT;
 970         }
 971
 972         if ((debug_flag > 0) && fr_log_fp) {
 973                 RDEBUG("Got tunneled request");
 974
 975                 debug_pair_list(fake->packet->vps);
 976
 977                 fprintf(fr_log_fp, "server %s {\n",
 978                         (fake->server == NULL) ? "" : fake->server);
 979         }
 980
 981         /*
 982          *      Update other items in the REQUEST data structure.
 983          */
 984         if (!t->username) {
 985                 /*
 986                  *      There's no User-Name in the tunneled session,
 987                  *      so we add one here, by pulling it out of the
 988                  *      EAP-Identity packet.
 989                  */
 990                 if ((data[0] == PW_EAP_IDENTITY) && (data_len > 1)) {
 991                         t->username = pairmake(t, NULL, "User-Name", "", T_OP_EQ);
 992                         rad_assert(t->username != NULL);
 993
 994                         memcpy(t->username->vp_strvalue, data + 1, data_len - 1);
 995                         t->username->length = data_len - 1;
 996                         t->username->vp_strvalue[t->username->length] = 0;
 997                         DEBUG2("  PEAP: Got tunneled identity of %s", t->username->vp_strvalue);
 998
 999                         /*
1000                          *      If there's a default EAP type,
1001                          *      set it here.
1002                          */
1003                         if (t->default_method != 0) {
1004                                 DEBUG2("  PEAP: Setting default EAP type for tunneled EAP session.");
1005                                 vp = pairmake(fake, &fake->config_items, "EAP-Type", "0", T_OP_EQ);
1006                                 vp->vp_integer = t->default_method;
1007                         }
1008                 }
1009         } /* else there WAS a t->username */
1010
1011         setup_fake_request(request, fake, t);
1012
1013         if ((vp = pairfind(request->config_items, PW_VIRTUAL_SERVER, 0, TAG_ANY)) != NULL) {
1014                 fake->server = vp->vp_strvalue;
1015
1016         } else if (t->virtual_server) {
1017                 fake->server = t->virtual_server;
1018
1019         } /* else fake->server == request->server */
1020
1021         if ((debug_flag > 0) && fr_log_fp) {
1022                 fprintf(fr_log_fp, "Sending tunneled request\n");
1023
1024                 debug_pair_list(fake->packet->vps);
1025
1026                 fprintf(fr_log_fp, "server %s {\n",
1027                         (fake->server == NULL) ? "" : fake->server);
1028         }
1029
1030         /*
1031          *      Call authentication recursively, which will
1032          *      do PAP, CHAP, MS-CHAP, etc.
1033          */
1034         rad_virtual_server(fake);
1035
1036         /*
1037          *      Note that we don't do *anything* with the reply
1038          *      attributes.
1039          */
1040         if ((debug_flag > 0) && fr_log_fp) {
1041                 fprintf(fr_log_fp, "} # server %s\n",
1042                         (fake->server == NULL) ? "" : fake->server);
1043
1044                 RDEBUG("Got tunneled reply code %d", fake->reply->code);
1045
1046                 debug_pair_list(fake->reply->vps);
1047         }
1048
1049         /*
1050          *      Decide what to do with the reply.
1051          */
1052         switch (fake->reply->code) {
1053         case 0:                 /* No reply code, must be proxied... */
1054 #ifdef WITH_PROXY
1055                 vp = pairfind(fake->config_items, PW_PROXY_TO_REALM, 0, TAG_ANY);
1056
1057                 if (vp) {
1058                         eap_tunnel_data_t *tunnel;
1059
1060                         /*
1061                          *      The tunneled request was NOT handled,
1062                          *      it has to be proxied.  This means that
1063                          *      the "authenticate" stage was never
1064                          *      performed.
1065                          *
1066                          *      If we are told to NOT proxy the
1067                          *      tunneled request as EAP, then this
1068                          *      means that we've got to decode it,
1069                          *      which means that we MUST run the
1070                          *      "authenticate" portion by hand, here.
1071                          *
1072                          *      Once the tunneled EAP session is ALMOST
1073                          *      done, THEN we proxy it...
1074                          */
1075                         if (!t->proxy_tunneled_request_as_eap) {
1076                                 fake->options |= RAD_REQUEST_OPTION_PROXY_EAP;
1077
1078                                 /*
1079                                  *      Hmm... should we check for
1080                                  *      Auth-Type & EAP-Message here?
1081                                  */
1082
1083
1084                                 /*
1085                                  *      Run the EAP authentication.
1086                                  */
1087                                 DEBUG2("  PEAP: Calling authenticate in order to initiate tunneled EAP session.");
1088                                 rcode = process_authenticate(PW_AUTHTYPE_EAP, fake);
1089                                 if (rcode == RLM_MODULE_OK) {
1090                                         /*
1091                                          *      Authentication succeeded! Rah!
1092                                          */
1093                                         fake->reply->code = PW_AUTHENTICATION_ACK;
1094                                         goto do_process;
1095                                 }
1096
1097                                 if (rcode != RLM_MODULE_HANDLED) {
1098                                         DEBUG2("  PEAP: Can't handle the return code %d", rcode);
1099                                         rcode = RLM_MODULE_REJECT;
1100                                         goto done;
1101                                 }
1102
1103                                 /*
1104                                  *      The module decided it wasn't
1105                                  *      done.  Handle it like normal.
1106                                  */
1107                                 if ((fake->options & RAD_REQUEST_OPTION_PROXY_EAP) == 0) {
1108                                         DEBUG2("    PEAP: Cancelling proxy to realm %s until the tunneled EAP session has been established", vp->vp_strvalue);
1109                                         goto do_process;
1110                                 }
1111
1112                                 /*
1113                                  *      The module has decoded the
1114                                  *      EAP-Message into another set
1115                                  *      of attributes.
1116                                  */
1117                                 pairdelete(&fake->packet->vps,
1118                                            PW_EAP_MESSAGE, 0, TAG_ANY);
1119                         }
1120
1121                         DEBUG2("  PEAP: Tunneled authentication will be proxied to %s", vp->vp_strvalue);
1122
1123                         /*
1124                          *      Tell the original request that it's going
1125                          *      to be proxied.
1126                          */
1127                         pairmove2(request, &(request->config_items),
1128                                    &(fake->config_items),
1129                                    PW_PROXY_TO_REALM, 0, TAG_ANY);
1130
1131                         /*
1132                          *      Seed the proxy packet with the
1133                          *      tunneled request.
1134                          */
1135                         rad_assert(request->proxy == NULL);
1136                         request->proxy = fake->packet;
1137                         memset(&request->proxy->src_ipaddr, 0,
1138                                sizeof(request->proxy->src_ipaddr));
1139                         memset(&request->proxy->dst_ipaddr, 0,
1140                                sizeof(request->proxy->dst_ipaddr));
1141                         request->proxy->src_port = 0;
1142                         request->proxy->dst_port = 0;
1143                         fake->packet = NULL;
1144                         rad_free(&fake->reply);
1145                         fake->reply = NULL;
1146
1147                         /*
1148                          *      Set up the callbacks for the tunnel
1149                          */
1150                         tunnel = talloc_zero(request, eap_tunnel_data_t);
1151                         tunnel->tls_session = tls_session;
1152                         tunnel->callback = eappeap_postproxy;
1153
1154                         /*
1155                          *      Associate the callback with the request.
1156                          */
1157                         rcode = request_data_add(request,
1158                                                  request->proxy,
1159                                                  REQUEST_DATA_EAP_TUNNEL_CALLBACK,
1160                                                  tunnel, NULL);
1161                         rad_assert(rcode == 0);
1162
1163                         /*
1164                          *      We're not proxying it as EAP, so we've got
1165                          *      to do the callback later.
1166                          */
1167                         if ((fake->options & RAD_REQUEST_OPTION_PROXY_EAP) != 0) {
1168                                 DEBUG2("  PEAP: Remembering to do EAP-MS-CHAP-V2 post-proxy.");
1169
1170                                 /*
1171                                  *      rlm_eap.c has taken care of associating
1172                                  *      the handler with the fake request.
1173                                  *
1174                                  *      So we associate the fake request with
1175                                  *      this request.
1176                                  */
1177                                 rcode = request_data_add(request,
1178                                                          request->proxy,
1179                                                          REQUEST_DATA_EAP_MSCHAP_TUNNEL_CALLBACK,
1180                                                          fake, my_request_free);
1181                                 rad_assert(rcode == 0);
1182
1183                                 /*
1184                                  *      Do NOT free the fake request!
1185                                  */
1186                                 return RLM_MODULE_UPDATED;
1187                         }
1188
1189                         /*
1190                          *      Didn't authenticate the packet, but
1191                          *      we're proxying it.
1192                          */
1193                         rcode = RLM_MODULE_UPDATED;
1194
1195                 } else
1196 #endif  /* WITH_PROXY */
1197                   {
1198                         DEBUG2("  PEAP: Unknown RADIUS packet type %d: rejecting tunneled user", fake->reply->code);
1199                         rcode = RLM_MODULE_REJECT;
1200                   }
1201                 break;
1202
1203         default:
1204         do_process:
1205                 rcode = process_reply(handler, tls_session, request,
1206                                       fake->reply);
1207                 break;
1208         }
1209
1210  done:
1211         request_free(&fake);
1212
1213         return rcode;
1214 }
1215
1216 static int setup_fake_request(REQUEST *request, REQUEST *fake, peap_tunnel_t *t) {
1217
1218         VALUE_PAIR *vp;
1219         /*
1220          *      Tell the request that it's a fake one.
1221          */
1222         pairmake(fake->packet, &fake->packet->vps,
1223                  "Freeradius-Proxied-To", "127.0.0.1", T_OP_EQ);
1224
1225         if (t->username) {
1226                 vp = paircopy(fake->packet, t->username);
1227                 pairadd(&fake->packet->vps, vp);
1228                 fake->username = pairfind(fake->packet->vps, PW_USER_NAME, 0, TAG_ANY);
1229                 RDEBUG2("Setting User-Name to %s", fake->username->vp_strvalue);
1230         } else {
1231                 RDEBUG2("No tunnel username (SSL resumption?)");
1232         }
1233
1234
1235         /*
1236          *      Add the State attribute, too, if it exists.
1237          */
1238         if (t->state) {
1239                 vp = paircopy(fake->packet, t->state);
1240                 if (vp) pairadd(&fake->packet->vps, vp);
1241         }
1242
1243         /*
1244          *      If this is set, we copy SOME of the request attributes
1245          *      from outside of the tunnel to inside of the tunnel.
1246          *
1247          *      We copy ONLY those attributes which do NOT already
1248          *      exist in the tunneled request.
1249          *
1250          *      This code is copied from ../rlm_eap_ttls/ttls.c
1251          */
1252         if (t->copy_request_to_tunnel) {
1253                 VALUE_PAIR *copy;
1254
1255                 for (vp = request->packet->vps; vp != NULL; vp = vp->next) {
1256                         /*
1257                          *      The attribute is a server-side thingy,
1258                          *      don't copy it.
1259                          */
1260                         if ((vp->da->attr > 255) &&
1261                             (((vp->da->attr >> 16) & 0xffff) == 0)) {
1262                                 continue;
1263                         }
1264
1265                         /*
1266                          *      The outside attribute is already in the
1267                          *      tunnel, don't copy it.
1268                          *
1269                          *      This works for BOTH attributes which
1270                          *      are originally in the tunneled request,
1271                          *      AND attributes which are copied there
1272                          *      from below.
1273                          */
1274                         if (pairfind(fake->packet->vps, vp->da->attr, vp->da->vendor, TAG_ANY)) {
1275                                 continue;
1276                         }
1277
1278                         /*
1279                          *      Some attributes are handled specially.
1280                          */
1281                         switch (vp->da->attr) {
1282                                 /*
1283                                  *      NEVER copy Message-Authenticator,
1284                                  *      EAP-Message, or State.  They're
1285                                  *      only for outside of the tunnel.
1286                                  */
1287                         case PW_USER_NAME:
1288                         case PW_USER_PASSWORD:
1289                         case PW_CHAP_PASSWORD:
1290                         case PW_CHAP_CHALLENGE:
1291                         case PW_PROXY_STATE:
1292                         case PW_MESSAGE_AUTHENTICATOR:
1293                         case PW_EAP_MESSAGE:
1294                         case PW_STATE:
1295                                 continue;
1296                                 break;
1297
1298                                 /*
1299                                  *      By default, copy it over.
1300                                  */
1301                         default:
1302                                 break;
1303                         }
1304
1305                         /*
1306                          *      Don't copy from the head, we've already
1307                          *      checked it.
1308                          */
1309                         copy = paircopy2(fake->packet, vp, vp->da->attr, vp->da->vendor, TAG_ANY);
1310                         pairadd(&fake->packet->vps, copy);
1311                 }
1312         }
1313
1314         return 0;
1315 }