src/modules/rlm_eap/eap.c

   1 /*
   2  * eap.c    rfc2284 & rfc2869 implementation
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2000-2003,2006  The FreeRADIUS server project
  21  * Copyright 2001  hereUare Communications, Inc. <raghud@hereuare.com>
  22  * Copyright 2003  Alan DeKok <aland@freeradius.org>
  23  */
  24 /*
  25  *  EAP PACKET FORMAT
  26  *  --- ------ ------
  27  *  0                   1                   2                   3
  28  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  29  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  30  * |     Code      |  Identifier   |            Length             |
  31  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  32  * |    Data ...
  33  * +-+-+-+-+
  34  *
  35  *
  36  * EAP Request and Response Packet Format
  37  * --- ------- --- -------- ------ ------
  38  *  0                   1                   2                   3
  39  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  40  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  41  * |     Code      |  Identifier   |            Length             |
  42  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  43  * |     Type      |  Type-Data ...
  44  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
  45  *
  46  *
  47  * EAP Success and Failure Packet Format
  48  * --- ------- --- ------- ------ ------
  49  *  0                   1                   2                   3
  50  *  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
  51  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  52  * |     Code      |  Identifier   |            Length             |
  53  * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  54  *
  55  */
  56
  57 #include <freeradius-devel/ident.h>
  58 #include <freeradius-devel/modpriv.h>
  59 RCSID("$Id$")
  60
  61 #include "rlm_eap.h"
  62
  63 static const char *eap_codes[] = {
  64   "",                           /* 0 is invalid */
  65   "request",
  66   "response",
  67   "success",
  68   "failure"
  69 };
  70
  71 /*
  72  * Load all the required eap authentication types.
  73  * Get all the supported EAP-types from config file.
  74  */
  75 int eaptype_load(EAP_TYPES **type, int eap_type, CONF_SECTION *cs)
  76 {
  77         char            buffer[64];
  78         char            namebuf[64];
  79         const char      *eaptype_name;
  80         EAP_TYPES       *node;
  81
  82         eaptype_name = eaptype_type2name(eap_type, namebuf, sizeof(namebuf));
  83         snprintf(buffer, sizeof(buffer), "rlm_eap_%s", eaptype_name);
  84
  85         /* Make room for the EAP-Type */
  86         node = (EAP_TYPES *)malloc(sizeof(EAP_TYPES));
  87         if (node == NULL) {
  88                 radlog(L_ERR, "rlm_eap: out of memory");
  89                 return -1;
  90         }
  91         memset(node, 0, sizeof(*node));
  92
  93         /* fill in the structure */
  94         node->cs = cs;
  95
  96         /*
  97          *      In general, this is a terrible idea.  It works here
  98          *      solely because the eap_type2name function returns a
  99          *      'static const char *' pointer sometimes, and we can
 100          *      ONLY link to module which are named in that static
 101          *      array.
 102          */
 103         node->typename = eaptype_name;
 104         node->type_data = NULL;
 105
 106 #ifdef WITHOUT_LIBLTDL
 107 #ifdef WITH_DLOPEN
 108 #include <dlfcn.h>
 109
 110 #ifdef RTLD_SELF
 111         node->type = (EAP_TYPE *)lt_dlsym(RTLD_SELF, buffer);
 112         if (node->type) goto open_self;
 113 #endif
 114 #endif
 115 #endif
 116
 117         /* Link the loaded EAP-Type */
 118         node->handle = lt_dlopenext(buffer);
 119         if (node->handle == NULL) {
 120                 free(node);
 121                 radlog(L_ERR, "rlm_eap: Failed to link EAP-Type/%s: %s",
 122                        eaptype_name, lt_dlerror());
 123                 return -1;
 124         }
 125
 126         node->type = (EAP_TYPE *)lt_dlsym(node->handle, buffer);
 127         if (!node->type) {
 128                 radlog(L_ERR, "rlm_eap: Failed linking to %s structure in %s: %s",
 129                                 buffer, eaptype_name, lt_dlerror());
 130                 lt_dlclose(node->handle);       /* ignore any errors */
 131                 free(node);
 132                 return -1;
 133         }
 134
 135 #if defined(WITHOUT_LIBLTDL) && defined (WITH_DLOPEN) && defined(RTLD_SELF)
 136 open_self:
 137 #endif
 138         cf_log_module(cs, "Linked to sub-module %s", buffer);
 139
 140         cf_log_module(cs, "Instantiating eap-%s", eaptype_name);
 141
 142         if ((node->type->attach) &&
 143             ((node->type->attach)(node->cs, &(node->type_data)) < 0)) {
 144
 145                 radlog(L_ERR, "rlm_eap: Failed to initialize type %s",
 146                        eaptype_name);
 147                 lt_dlclose(node->handle);
 148                 free(node);
 149                 return -1;
 150         }
 151
 152         *type = node;
 153         return 0;
 154 }
 155
 156 /*
 157  * Call the appropriate handle with the right eap_type.
 158  */
 159 static int eaptype_call(EAP_TYPES *atype, EAP_HANDLER *handler)
 160 {
 161         int rcode = 1;
 162         REQUEST *request = handler->request;
 163         const char *module = request->module;
 164
 165         RDEBUG2("processing type %s", atype->typename);
 166         request->module = atype->typename;
 167
 168         rad_assert(atype != NULL);
 169
 170         switch (handler->stage) {
 171         case INITIATE:
 172                 if (!atype->type->initiate(atype->type_data, handler))
 173                         rcode = 0;
 174                 break;
 175
 176         case AUTHORIZE:
 177                 /*
 178                  *   The called function updates the EAP reply packet.
 179                  */
 180                 if (!atype->type->authorize ||
 181                     !atype->type->authorize(atype->type_data, handler))
 182                         rcode = 0;
 183                 break;
 184
 185         case AUTHENTICATE:
 186                 /*
 187                  *   The called function updates the EAP reply packet.
 188                  */
 189                 if (!atype->type->authenticate ||
 190                     !atype->type->authenticate(atype->type_data, handler))
 191                         rcode = 0;
 192                 break;
 193
 194         default:
 195                 /* Should never enter here */
 196                 RDEBUG("Internal sanity check failed on eap_type");
 197                 rcode = 0;
 198                 break;
 199         }
 200
 201         request->module = module;
 202         return rcode;
 203 }
 204
 205 /*
 206  * Based on TYPE, call the appropriate EAP-type handler
 207  * Default to the configured EAP-Type
 208  * for all Unsupported EAP-Types
 209  */
 210 int eaptype_select(rlm_eap_t *inst, EAP_HANDLER *handler)
 211 {
 212         size_t          i;
 213         unsigned int    default_eap_type = inst->default_eap_type;
 214         eaptype_t       *eaptype;
 215         VALUE_PAIR      *vp;
 216         char            namebuf[64];
 217         const char      *eaptype_name;
 218         REQUEST         *request = handler->request;
 219
 220         eaptype = &handler->eap_ds->response->type;
 221
 222         /*
 223          *      Don't trust anyone.
 224          */
 225         if ((eaptype->type == 0) ||
 226             (eaptype->type > PW_EAP_MAX_TYPES)) {
 227                 RDEBUG2("Asked to select bad type");
 228                 return EAP_INVALID;
 229         }
 230
 231         /*
 232          *      Multiple levels of nesting are invalid.
 233          */
 234         if (handler->request->parent && handler->request->parent->parent) {
 235                 RDEBUG2("Multiple levels of TLS nesting is invalid.");
 236                 return EAP_INVALID;
 237         }
 238
 239         /*
 240          *      Figure out what to do.
 241          */
 242         switch(eaptype->type) {
 243         case PW_EAP_IDENTITY:
 244                 RDEBUG2("EAP Identity");
 245
 246                 /*
 247                  *      Allow per-user configuration of EAP types.
 248                  */
 249                 vp = pairfind(handler->request->config_items,
 250                               PW_EAP_TYPE, 0);
 251                 if (vp) default_eap_type = vp->vp_integer;
 252
 253         do_initiate:
 254                 /*
 255                  *      Ensure it's valid.
 256                  */
 257                 if ((default_eap_type < PW_EAP_MD5) ||
 258                     (default_eap_type > PW_EAP_MAX_TYPES) ||
 259                     (inst->types[default_eap_type] == NULL)) {
 260                         RDEBUG2("No such EAP type %s",
 261                                eaptype_type2name(default_eap_type,
 262                                                  namebuf, sizeof(namebuf)));
 263                         return EAP_INVALID;
 264                 }
 265
 266                 handler->stage = INITIATE;
 267                 handler->eap_type = default_eap_type;
 268
 269                 /*
 270                  *      Wild & crazy stuff!  For TTLS & PEAP, we
 271                  *      initiate a TLS session, and then pass that
 272                  *      session data to TTLS or PEAP for the
 273                  *      authenticate stage.
 274                  *
 275                  *      Handler->eap_type holds the TRUE type.
 276                  */
 277                 if ((default_eap_type == PW_EAP_TTLS) ||
 278                     (default_eap_type == PW_EAP_PEAP)) {
 279                         default_eap_type = PW_EAP_TLS;
 280                 }
 281
 282                 if ((default_eap_type == PW_EAP_TNC) &&
 283                     !handler->request->parent) {
 284                         RDEBUG2("ERROR: EAP-TNC must be run inside of a TLS method.");
 285                         return EAP_INVALID;
 286                 }
 287
 288                 if (eaptype_call(inst->types[default_eap_type],
 289                                  handler) == 0) {
 290                         RDEBUG2("Default EAP type %s failed in initiate",
 291                                eaptype_type2name(default_eap_type,
 292                                                  namebuf, sizeof(namebuf)));
 293                         return EAP_INVALID;
 294                 }
 295                 break;
 296
 297         case PW_EAP_NAK:
 298                 /*
 299                  *      The NAK data is the preferred EAP type(s) of
 300                  *      the client.
 301                  *
 302                  *      RFC 3748 says to list one or more proposed
 303                  *      alternative types, one per octet, or to use
 304                  *      0 for no alternative.
 305                  */
 306                 RDEBUG2("EAP NAK");
 307
 308                 /*
 309                  *      Delete old data, if necessary.
 310                  */
 311                 if (handler->opaque && handler->free_opaque) {
 312                         handler->free_opaque(handler->opaque);
 313                         handler->free_opaque = NULL;
 314                         handler->opaque = NULL;
 315                 }
 316
 317                 if (eaptype->data == NULL) {
 318                         RDEBUG2("Empty NAK packet, cannot decide what EAP type the client wants.");
 319                         return EAP_INVALID;
 320                 }
 321
 322                 /*
 323                  *      Pick one type out of the one they asked for,
 324                  *      as they may have asked for many.
 325                  */
 326                 default_eap_type = 0;
 327                 vp = pairfind(handler->request->config_items,
 328                               PW_EAP_TYPE, 0);
 329                 for (i = 0; i < eaptype->length; i++) {
 330                         /*
 331                          *      It is invalid to request identity,
 332                          *      notification & nak in nak.
 333                          *
 334                          *      Type 0 is valid, and means there are no
 335                          *      common choices.
 336                          */
 337                         if (eaptype->data[i] < PW_EAP_MD5) {
 338                                 RDEBUG2("NAK asked for bad type %d",
 339                                        eaptype->data[i]);
 340                                 return EAP_INVALID;
 341                         }
 342
 343                         if ((eaptype->data[i] > PW_EAP_MAX_TYPES) ||
 344                             !inst->types[eaptype->data[i]]) {
 345                                 DICT_VALUE *dv;
 346
 347                                 dv = dict_valbyattr(PW_EAP_TYPE, 0, eaptype->data[i]);
 348                                 if (dv) {
 349                                         RDEBUG2("NAK asked for unsupported type %s",
 350                                                 dv->name);
 351                                 } else {
 352                                         RDEBUG2("NAK asked for unsupported type %d",
 353                                                 eaptype->data[i]);
 354                                 }
 355                                 continue;
 356                         }
 357
 358                         eaptype_name = eaptype_type2name(eaptype->data[i],
 359                                                          namebuf,
 360                                                          sizeof(namebuf));
 361
 362                         /*
 363                          *      Prevent a firestorm if the client is confused.
 364                          */
 365                         if (handler->eap_type == eaptype->data[i]) {
 366                                 RDEBUG2("ERROR! Our request for %s was NAK'd with a request for %s.  Skipping the requested type.",
 367                                        eaptype_name, eaptype_name);
 368                                 continue;
 369                         }
 370
 371                         /*
 372                          *      Enforce per-user configuration of EAP
 373                          *      types.
 374                          */
 375                         if (vp && (vp->vp_integer != eaptype->data[i])) {
 376                                 char    mynamebuf[64];
 377                                 RDEBUG2("Client wants %s, while we require %s.  Skipping the requested type.",
 378                                        eaptype_name,
 379                                        eaptype_type2name(vp->vp_integer,
 380                                                          mynamebuf,
 381                                                          sizeof(mynamebuf)));
 382                                 continue;
 383                         }
 384
 385                         default_eap_type = eaptype->data[i];
 386                         break;
 387                 }
 388
 389                 /*
 390                  *      We probably want to return 'fail' here...
 391                  */
 392                 if (!default_eap_type) {
 393                         RDEBUG2("No common EAP types found.");
 394                         return EAP_INVALID;
 395                 }
 396                 eaptype_name = eaptype_type2name(default_eap_type,
 397                                                  namebuf, sizeof(namebuf));
 398                 RDEBUG2("EAP-NAK asked for EAP-Type/%s",
 399                        eaptype_name);
 400
 401                 goto do_initiate;
 402                 break;
 403
 404                 /*
 405                  *      Key off of the configured sub-modules.
 406                  */
 407                 default:
 408                         eaptype_name = eaptype_type2name(eaptype->type,
 409                                                          namebuf,
 410                                                          sizeof(namebuf));
 411                         RDEBUG2("EAP/%s", eaptype_name);
 412
 413                         /*
 414                          *      We haven't configured it, it doesn't exit.
 415                          */
 416                         if (!inst->types[eaptype->type]) {
 417                                 RDEBUG2("EAP type %d is unsupported",
 418                                        eaptype->type);
 419                                 return EAP_INVALID;
 420                         }
 421
 422                         rad_assert(handler->stage == AUTHENTICATE);
 423                         handler->eap_type = eaptype->type;
 424                         if (eaptype_call(inst->types[eaptype->type],
 425                                          handler) == 0) {
 426                                 RDEBUG2("Handler failed in EAP/%s",
 427                                        eaptype_name);
 428                                 return EAP_INVALID;
 429                         }
 430                 break;
 431         }
 432
 433         return EAP_OK;
 434 }
 435
 436
 437 /*
 438  *      compose EAP reply packet in EAP-Message attr of RADIUS.  If
 439  *      EAP exceeds 253, frame it in multiple EAP-Message attrs.
 440  *
 441  *      Set the RADIUS reply codes based on EAP request codes.  Append
 442  *      any additonal VPs to RADIUS reply
 443  */
 444 int eap_compose(EAP_HANDLER *handler)
 445 {
 446         VALUE_PAIR *vp;
 447         eap_packet_t *eap_packet;
 448         REQUEST *request = handler->request;
 449         EAP_DS *eap_ds = handler->eap_ds;
 450         EAP_PACKET *reply = eap_ds->request;
 451         int rcode;
 452
 453         /*
 454          *      The Id for the EAP packet to the NAS wasn't set.
 455          *      Do so now.
 456          *
 457          *      LEAP requires the Id to be incremented on EAP-Success
 458          *      in Stage 4, so that we can carry on the conversation
 459          *      where the client asks us to authenticate ourselves
 460          *      in stage 5.
 461          */
 462         if (!eap_ds->set_request_id) {
 463                 /*
 464                  *      Id serves to suppport request/response
 465                  *      retransmission in the EAP layer and as such
 466                  *      must be different for 'adjacent' packets
 467                  *      except in case of success/failure-replies.
 468                  *
 469                  *      RFC2716 (EAP-TLS) requires this to be
 470                  *      incremented, RFC2284 only makes the above-
 471                  *      mentioned restriction.
 472                  */
 473                 reply->id = handler->eap_ds->response->id;
 474
 475                 switch (reply->code) {
 476                         /*
 477                          *      The Id is a simple "ack" for success
 478                          *      and failure.
 479                          *
 480                          *      RFC 3748 section 4.2 says
 481                          *
 482                          *      ... The Identifier field MUST match
 483                          *      the Identifier field of the Response
 484                          *      packet that it is sent in response
 485                          *      to.
 486                          */
 487                 case PW_EAP_SUCCESS:
 488                 case PW_EAP_FAILURE:
 489                         break;
 490
 491                         /*
 492                          *      We've sent a response to their
 493                          *      request, the Id is incremented.
 494                          */
 495                 default:
 496                         ++reply->id;
 497                 }
 498         } else {
 499                 RDEBUG2("Underlying EAP-Type set EAP ID to %d",
 500                        reply->id);
 501         }
 502
 503         /*
 504          *      For Request & Response packets, set the EAP sub-type,
 505          *      if the EAP sub-module didn't already set it.
 506          *
 507          *      This allows the TLS module to be "morphic", and means
 508          *      that the TTLS and PEAP modules can call it to do most
 509          *      of their dirty work.
 510          */
 511         if (((eap_ds->request->code == PW_EAP_REQUEST) ||
 512              (eap_ds->request->code == PW_EAP_RESPONSE)) &&
 513             (eap_ds->request->type.type == 0)) {
 514                 rad_assert(handler->eap_type >= PW_EAP_MD5);
 515                 rad_assert(handler->eap_type <= PW_EAP_MAX_TYPES);
 516
 517                 eap_ds->request->type.type = handler->eap_type;
 518         }
 519
 520         /*
 521          *      FIXME: We malloc memory for the eap packet, and then
 522          *      immediately copy that data into VALUE_PAIRs.  This
 523          *      could be done more efficiently...
 524          */
 525         if (eap_wireformat(reply) == EAP_INVALID) {
 526                 return RLM_MODULE_INVALID;
 527         }
 528         eap_packet = (eap_packet_t *)reply->packet;
 529
 530         vp = eap_packet2vp(eap_packet);
 531         if (!vp) return RLM_MODULE_INVALID;
 532         pairadd(&(request->reply->vps), vp);
 533
 534         /*
 535          *      EAP-Message is always associated with
 536          *      Message-Authenticator but not vice-versa.
 537          *
 538          *      Don't add a Message-Authenticator if it's already
 539          *      there.
 540          */
 541         vp = pairfind(request->reply->vps, PW_MESSAGE_AUTHENTICATOR, 0);
 542         if (!vp) {
 543                 vp = paircreate(PW_MESSAGE_AUTHENTICATOR, 0, PW_TYPE_OCTETS);
 544                 memset(vp->vp_octets, 0, AUTH_VECTOR_LEN);
 545                 vp->length = AUTH_VECTOR_LEN;
 546                 pairadd(&(request->reply->vps), vp);
 547         }
 548
 549         /* Set request reply code, but only if it's not already set. */
 550         rcode = RLM_MODULE_OK;
 551         if (!request->reply->code) switch(reply->code) {
 552         case PW_EAP_RESPONSE:
 553                 request->reply->code = PW_AUTHENTICATION_ACK;
 554                 rcode = RLM_MODULE_HANDLED; /* leap weirdness */
 555                 break;
 556         case PW_EAP_SUCCESS:
 557                 request->reply->code = PW_AUTHENTICATION_ACK;
 558                 rcode = RLM_MODULE_OK;
 559                 break;
 560         case PW_EAP_FAILURE:
 561                 request->reply->code = PW_AUTHENTICATION_REJECT;
 562                 rcode = RLM_MODULE_REJECT;
 563                 break;
 564         case PW_EAP_REQUEST:
 565                 request->reply->code = PW_ACCESS_CHALLENGE;
 566                 rcode = RLM_MODULE_HANDLED;
 567                 break;
 568         default:
 569                 /*
 570                  *      When we're pulling MS-CHAPv2 out of EAP-MS-CHAPv2,
 571                  *      we do so WITHOUT setting a reply code, as the
 572                  *      request is being proxied.
 573                  */
 574                 if (request->options & RAD_REQUEST_OPTION_PROXY_EAP) {
 575                         return RLM_MODULE_HANDLED;
 576                 }
 577
 578                 /* Should never enter here */
 579                 radlog(L_ERR, "rlm_eap: reply code %d is unknown, Rejecting the request.", reply->code);
 580                 request->reply->code = PW_AUTHENTICATION_REJECT;
 581                 reply->code = PW_EAP_FAILURE;
 582                 rcode = RLM_MODULE_REJECT;
 583                 break;
 584         }
 585
 586         return rcode;
 587 }
 588
 589 /*
 590  * Radius criteria, EAP-Message is invalid without Message-Authenticator
 591  * For EAP_START, send Access-Challenge with EAP Identity request.
 592  */
 593 int eap_start(rlm_eap_t *inst, REQUEST *request)
 594 {
 595         VALUE_PAIR *vp, *proxy;
 596         VALUE_PAIR *eap_msg;
 597
 598         eap_msg = pairfind(request->packet->vps, PW_EAP_MESSAGE, 0);
 599         if (eap_msg == NULL) {
 600                 RDEBUG2("No EAP-Message, not doing EAP");
 601                 return EAP_NOOP;
 602         }
 603
 604         /*
 605          *      Look for EAP-Type = None (FreeRADIUS specific attribute)
 606          *      this allows you to NOT do EAP for some users.
 607          */
 608         vp = pairfind(request->packet->vps, PW_EAP_TYPE, 0);
 609         if (vp && vp->vp_integer == 0) {
 610                 RDEBUG2("Found EAP-Message, but EAP-Type = None, so we're not doing EAP.");
 611                 return EAP_NOOP;
 612         }
 613
 614         /*
 615          *      http://www.freeradius.org/rfc/rfc2869.html#EAP-Message
 616          *
 617          *      Checks for Message-Authenticator are handled by rad_recv().
 618          */
 619
 620         /*
 621          *      Check for a Proxy-To-Realm.  Don't get excited over LOCAL
 622          *      realms (sigh).
 623          */
 624         proxy = pairfind(request->config_items, PW_PROXY_TO_REALM, 0);
 625         if (proxy) {
 626                 REALM *realm;
 627
 628                 /*
 629                  *      If it's a LOCAL realm, then we're not proxying
 630                  *      to it.
 631                  */
 632                 realm = realm_find(proxy->vp_strvalue);
 633                 if (!realm || (realm && (realm->auth_pool == NULL))) {
 634                         proxy = NULL;
 635                 }
 636         }
 637
 638         /*
 639          *      Check the length before de-referencing the contents.
 640          *
 641          *      Lengths of zero are required by the RFC for EAP-Start,
 642          *      but we've never seen them in practice.
 643          *
 644          *      Lengths of two are what we see in practice as
 645          *      EAP-Starts.
 646          */
 647         if ((eap_msg->length == 0) || (eap_msg->length == 2)) {
 648                 EAP_DS *eap_ds;
 649                 EAP_HANDLER handler;
 650
 651                 /*
 652                  *      It's a valid EAP-Start, but the request
 653                  *      was marked as being proxied.  So we don't
 654                  *      do EAP, as the home server will do it.
 655                  */
 656                 if (proxy) {
 657                 do_proxy:
 658                         RDEBUG2("Request is supposed to be proxied to Realm %s.  Not doing EAP.", proxy->vp_strvalue);
 659                         return EAP_NOOP;
 660                 }
 661
 662                 RDEBUG2("Got EAP_START message");
 663                 if ((eap_ds = eap_ds_alloc()) == NULL) {
 664                         RDEBUG2("EAP Start failed in allocation");
 665                         return EAP_FAIL;
 666                 }
 667
 668                 /*
 669                  *      It's an EAP-Start packet.  Tell them to stop wasting
 670                  *      our time, and give us an EAP-Identity packet.
 671                  *
 672                  *      Hmm... we should probably check the contents of the
 673                  *      EAP-Start packet for something...
 674                  */
 675                 eap_ds->request->code = PW_EAP_REQUEST;
 676                 eap_ds->request->type.type = PW_EAP_IDENTITY;
 677
 678                 /*
 679                  *      We don't have a handler, but eap_compose needs one,
 680                  *      (for various reasons), so we fake it out here.
 681                  */
 682                 memset(&handler, 0, sizeof(handler));
 683                 handler.request = request;
 684                 handler.eap_ds = eap_ds;
 685
 686                 eap_compose(&handler);
 687
 688                 eap_ds_free(&eap_ds);
 689                 return EAP_FOUND;
 690         } /* end of handling EAP-Start */
 691
 692         /*
 693          *      The EAP packet header is 4 bytes, plus one byte of
 694          *      EAP sub-type.  Short packets are discarded, unless
 695          *      we're proxying.
 696          */
 697         if (eap_msg->length < (EAP_HEADER_LEN + 1)) {
 698                 if (proxy) goto do_proxy;
 699
 700                 RDEBUG2("Ignoring EAP-Message which is too short to be meaningful.");
 701                 return EAP_FAIL;
 702         }
 703
 704         /*
 705          *      Create an EAP-Type containing the EAP-type
 706          *      from the packet.
 707          */
 708         vp = paircreate(PW_EAP_TYPE, 0, PW_TYPE_INTEGER);
 709         if (vp) {
 710                 vp->vp_integer = eap_msg->vp_octets[4];
 711                 pairadd(&(request->packet->vps), vp);
 712         }
 713
 714         /*
 715          *      If the request was marked to be proxied, do it now.
 716          *      This is done after checking for a valid length
 717          *      (which may not be good), and after adding the EAP-Type
 718          *      attribute.  This lets other modules selectively cancel
 719          *      proxying based on EAP-Type.
 720          */
 721         if (proxy) goto do_proxy;
 722
 723         /*
 724          *      From now on, we're supposed to be handling the
 725          *      EAP packet.  We better understand it...
 726          */
 727
 728         /*
 729          *      We're allowed only a few codes.  Request, Response,
 730          *      Success, or Failure.
 731          */
 732         if ((eap_msg->vp_octets[0] == 0) ||
 733             (eap_msg->vp_octets[0] > PW_EAP_MAX_CODES)) {
 734                 RDEBUG2("Unknown EAP packet");
 735         } else {
 736                 RDEBUG2("EAP packet type %s id %d length %d",
 737                        eap_codes[eap_msg->vp_octets[0]],
 738                        eap_msg->vp_octets[1],
 739                        eap_msg->length);
 740         }
 741
 742         /*
 743          *      We handle request and responses.  The only other defined
 744          *      codes are success and fail.  The client SHOULD NOT be
 745          *      sending success/fail packets to us, as it doesn't make
 746          *      sense.
 747          */
 748         if ((eap_msg->vp_octets[0] != PW_EAP_REQUEST) &&
 749             (eap_msg->vp_octets[0] != PW_EAP_RESPONSE)) {
 750                 RDEBUG2("Ignoring EAP packet which we don't know how to handle.");
 751                 return EAP_FAIL;
 752         }
 753
 754         /*
 755          *      We've been told to ignore unknown EAP types, AND it's
 756          *      an unknown type.  Return "NOOP", which will cause the
 757          *      eap_authorize() to return NOOP.
 758          *
 759          *      EAP-Identity, Notification, and NAK are all handled
 760          *      internally, so they never have handlers.
 761          */
 762         if ((eap_msg->vp_octets[4] >= PW_EAP_MD5) &&
 763             inst->ignore_unknown_eap_types &&
 764             ((eap_msg->vp_octets[4] == 0) ||
 765              (eap_msg->vp_octets[4] > PW_EAP_MAX_TYPES) ||
 766              (inst->types[eap_msg->vp_octets[4]] == NULL))) {
 767                 RDEBUG2(" Ignoring Unknown EAP type");
 768                 return EAP_NOOP;
 769         }
 770
 771         /*
 772          *      They're NAKing the EAP type we wanted to use, and
 773          *      asking for one which we don't support.
 774          *
 775          *      NAK is code + id + length1 + length + NAK
 776          *             + requested EAP type(s).
 777          *
 778          *      We know at this point that we can't handle the
 779          *      request.  We could either return an EAP-Fail here, but
 780          *      it's not too critical.
 781          *
 782          *      By returning "noop", we can ensure that authorize()
 783          *      returns NOOP, and another module may choose to proxy
 784          *      the request.
 785          */
 786         if ((eap_msg->vp_octets[4] == PW_EAP_NAK) &&
 787             (eap_msg->length >= (EAP_HEADER_LEN + 2)) &&
 788             inst->ignore_unknown_eap_types &&
 789             ((eap_msg->vp_octets[5] == 0) ||
 790              (eap_msg->vp_octets[5] > PW_EAP_MAX_TYPES) ||
 791              (inst->types[eap_msg->vp_octets[5]] == NULL))) {
 792                 RDEBUG2("Ignoring NAK with request for unknown EAP type");
 793                 return EAP_NOOP;
 794         }
 795
 796         if ((eap_msg->vp_octets[4] == PW_EAP_TTLS) ||
 797             (eap_msg->vp_octets[4] == PW_EAP_PEAP)) {
 798                 RDEBUG2("Continuing tunnel setup.");
 799                 return EAP_OK;
 800         }
 801
 802         /*
 803          *      Later EAP messages are longer than the 'start'
 804          *      message, so if everything is OK, this function returns
 805          *      'no start found', so that the rest of the EAP code can
 806          *      use the State attribute to match this EAP-Message to
 807          *      an ongoing conversation.
 808          */
 809         RDEBUG2("No EAP Start, assuming it's an on-going EAP conversation");
 810
 811         return EAP_NOTFOUND;
 812 }
 813
 814 /*
 815  *      compose EAP FAILURE packet in EAP-Message
 816  */
 817 void eap_fail(EAP_HANDLER *handler)
 818 {
 819         /*
 820          *      Delete any previous replies.
 821          */
 822         pairdelete(&handler->request->reply->vps, PW_EAP_MESSAGE, 0);
 823         pairdelete(&handler->request->reply->vps, PW_STATE, 0);
 824
 825         eap_packet_free(&handler->eap_ds->request);
 826         handler->eap_ds->request = eap_packet_alloc();
 827
 828         handler->eap_ds->request->code = PW_EAP_FAILURE;
 829         eap_compose(handler);
 830 }
 831
 832 /*
 833  *      compose EAP SUCCESS packet in EAP-Message
 834  */
 835 void eap_success(EAP_HANDLER *handler)
 836 {
 837         handler->eap_ds->request->code = PW_EAP_SUCCESS;
 838         eap_compose(handler);
 839 }
 840
 841 /*
 842  * Basic EAP packet verfications & validations
 843  */
 844 static int eap_validation(REQUEST *request, eap_packet_t *eap_packet)
 845 {
 846         uint16_t len;
 847
 848         memcpy(&len, eap_packet->length, sizeof(uint16_t));
 849         len = ntohs(len);
 850
 851         /*
 852          *      High level EAP packet checks
 853          */
 854         if ((len <= EAP_HEADER_LEN) ||
 855             ((eap_packet->code != PW_EAP_RESPONSE) &&
 856              (eap_packet->code != PW_EAP_REQUEST)) ||
 857             (eap_packet->data[0] <= 0) ||
 858             (eap_packet->data[0] > PW_EAP_MAX_TYPES)) {
 859
 860                 radlog_request(L_AUTH, 0, request,
 861                                "Badly formatted EAP Message: Ignoring the packet");
 862                 return EAP_INVALID;
 863         }
 864
 865         /* we don't expect notification, but we send it */
 866         if (eap_packet->data[0] == PW_EAP_NOTIFICATION) {
 867                 radlog_request(L_AUTH, 0, request, "Got NOTIFICATION, "
 868                                "Ignoring the packet");
 869                 return EAP_INVALID;
 870         }
 871
 872         return EAP_VALID;
 873 }
 874
 875
 876 /*
 877  *  Get the user Identity only from EAP-Identity packets
 878  */
 879 static char *eap_identity(REQUEST *request, eap_packet_t *eap_packet)
 880 {
 881         int size;
 882         uint16_t len;
 883         char *identity;
 884
 885         if ((eap_packet == NULL) ||
 886             (eap_packet->code != PW_EAP_RESPONSE) ||
 887             (eap_packet->data[0] != PW_EAP_IDENTITY)) {
 888                 return NULL;
 889         }
 890
 891         memcpy(&len, eap_packet->length, sizeof(uint16_t));
 892         len = ntohs(len);
 893
 894         if ((len <= 5) || (eap_packet->data[1] == 0x00)) {
 895                 RDEBUG("UserIdentity Unknown ");
 896                 return NULL;
 897         }
 898
 899         size = len - 5;
 900         identity = rad_malloc(size + 1);
 901         memcpy(identity, &eap_packet->data[1], size);
 902         identity[size] = '\0';
 903
 904         return identity;
 905 }
 906
 907
 908 /*
 909  *      Create our Request-Response data structure with the eap packet
 910  */
 911 static EAP_DS *eap_buildds(eap_packet_t **eap_packet_p)
 912 {
 913         EAP_DS          *eap_ds = NULL;
 914         eap_packet_t    *eap_packet = *eap_packet_p;
 915         int             typelen;
 916         uint16_t        len;
 917
 918         if ((eap_ds = eap_ds_alloc()) == NULL) {
 919                 return NULL;
 920         }
 921
 922         eap_ds->response->packet = (unsigned char *)eap_packet;
 923         eap_ds->response->code = eap_packet->code;
 924         eap_ds->response->id = eap_packet->id;
 925         eap_ds->response->type.type = eap_packet->data[0];
 926
 927         memcpy(&len, eap_packet->length, sizeof(uint16_t));
 928         len = ntohs(len);
 929         eap_ds->response->length = len;
 930
 931         /*
 932          *      We've eaten the eap packet into the eap_ds.
 933          */
 934         *eap_packet_p = NULL;
 935
 936         /*
 937          *      First 5 bytes in eap, are code + id + length(2) + type.
 938          *
 939          *      The rest is type-specific data.  We skip type while
 940          *      getting typedata from data.
 941          */
 942         typelen = len - 5/*code + id + length + type */;
 943         if (typelen > 0) {
 944                 /*
 945                  *      Since the packet contains the complete
 946                  *      eap_packet, typedata will be a ptr in packet
 947                  *      to its typedata
 948                  */
 949                 eap_ds->response->type.data = eap_ds->response->packet + 5/*code+id+length+type*/;
 950                 eap_ds->response->type.length = typelen;
 951         } else {
 952                 eap_ds->response->type.length = 0;
 953                 eap_ds->response->type.data = NULL;
 954         }
 955
 956         return eap_ds;
 957 }
 958
 959
 960 /*
 961  * If identity response then create a fresh handler & fill the identity
 962  * else handler MUST be in our list, get that.
 963  * This handler creation cannot fail
 964  *
 965  * username contains REQUEST->username which might have been stripped.
 966  * identity contains the one sent in EAP-Identity response
 967  */
 968 EAP_HANDLER *eap_handler(rlm_eap_t *inst, eap_packet_t **eap_packet_p,
 969                          REQUEST *request)
 970 {
 971         EAP_HANDLER     *handler = NULL;
 972         eap_packet_t    *eap_packet = *eap_packet_p;
 973         VALUE_PAIR      *vp;
 974
 975         /*
 976          *      Ensure it's a valid EAP-Request, or EAP-Response.
 977          */
 978         if (eap_validation(request, eap_packet) == EAP_INVALID) {
 979                 free(*eap_packet_p);
 980                 *eap_packet_p = NULL;
 981                 return NULL;
 982         }
 983
 984         /*
 985          *      EAP_HANDLER MUST be found in the list if it is not
 986          *      EAP-Identity response
 987          */
 988         if (eap_packet->data[0] != PW_EAP_IDENTITY) {
 989                 handler = eaplist_find(inst, request, eap_packet);
 990                 if (handler == NULL) {
 991                         /* Either send EAP_Identity or EAP-Fail */
 992                         RDEBUG("Either EAP-request timed out OR"
 993                                " EAP-response to an unknown EAP-request");
 994                         free(*eap_packet_p);
 995                         *eap_packet_p = NULL;
 996                         return NULL;
 997                 }
 998
 999                 /*
1000                  *      Even more paranoia.  Without this, some weird
1001                  *      clients could do crazy things.
1002                  *
1003                  *      It's ok to send EAP sub-type NAK in response
1004                  *      to a request for a particular type, but it's NOT
1005                  *      OK to blindly return data for another type.
1006                  */
1007                 if ((eap_packet->data[0] != PW_EAP_NAK) &&
1008                     (eap_packet->data[0] != handler->eap_type)) {
1009                         RDEBUG("Response appears to match, but EAP type is wrong.");
1010                         free(*eap_packet_p);
1011                         *eap_packet_p = NULL;
1012                         return NULL;
1013                 }
1014
1015                vp = pairfind(request->packet->vps, PW_USER_NAME, 0);
1016                if (!vp) {
1017                        /*
1018                         *       NAS did not set the User-Name
1019                         *       attribute, so we set it here and
1020                         *       prepend it to the beginning of the
1021                         *       request vps so that autz's work
1022                         *       correctly
1023                         */
1024                        RDEBUG2("Broken NAS did not set User-Name, setting from EAP Identity");
1025                        vp = pairmake("User-Name", handler->identity, T_OP_EQ);
1026                        if (vp == NULL) {
1027                                RDEBUG("Out of memory");
1028                                free(*eap_packet_p);
1029                                *eap_packet_p = NULL;
1030                                return NULL;
1031                        }
1032                        vp->next = request->packet->vps;
1033                        request->packet->vps = vp;
1034
1035                } else {
1036                        /*
1037                         *      A little more paranoia.  If the NAS
1038                         *      *did* set the User-Name, and it doesn't
1039                         *      match the identity, (i.e. If they
1040                         *      change their User-Name part way through
1041                         *      the EAP transaction), then reject the
1042                         *      request as the NAS is doing something
1043                         *      funny.
1044                         */
1045                        if (strncmp(handler->identity, vp->vp_strvalue,
1046                                    MAX_STRING_LEN) != 0) {
1047                                RDEBUG("Identity does not match User-Name.  Authentication failed.");
1048                                free(*eap_packet_p);
1049                                *eap_packet_p = NULL;
1050                                return NULL;
1051                        }
1052                }
1053         } else {                /* packet was EAP identity */
1054                 handler = eap_handler_alloc(inst);
1055                 if (handler == NULL) {
1056                         RDEBUG("Out of memory.");
1057                         free(*eap_packet_p);
1058                         *eap_packet_p = NULL;
1059                         return NULL;
1060                 }
1061
1062                 /*
1063                  *      All fields in the handler are set to zero.
1064                  */
1065                 handler->identity = eap_identity(request, eap_packet);
1066                 if (handler->identity == NULL) {
1067                         RDEBUG("Identity Unknown, authentication failed");
1068                         free(*eap_packet_p);
1069                         *eap_packet_p = NULL;
1070                         eap_handler_free(inst, handler);
1071                         return NULL;
1072                 }
1073
1074                vp = pairfind(request->packet->vps, PW_USER_NAME, 0);
1075                if (!vp) {
1076                        /*
1077                         *       NAS did not set the User-Name
1078                         *       attribute, so we set it here and
1079                         *       prepend it to the beginning of the
1080                         *       request vps so that autz's work
1081                         *       correctly
1082                         */
1083                        RDEBUG2("WARNING NAS did not set User-Name.  Setting it locally from EAP Identity");
1084                        vp = pairmake("User-Name", handler->identity, T_OP_EQ);
1085                        if (vp == NULL) {
1086                                RDEBUG("Out of memory");
1087                                free(*eap_packet_p);
1088                                *eap_packet_p = NULL;
1089                                eap_handler_free(inst, handler);
1090                                return NULL;
1091                        }
1092                        vp->next = request->packet->vps;
1093                        request->packet->vps = vp;
1094                } else {
1095                        /*
1096                         *      Paranoia.  If the NAS *did* set the
1097                         *      User-Name, and it doesn't match the
1098                         *      identity, the NAS is doing something
1099                         *      funny, so reject the request.
1100                         */
1101                        if (strncmp(handler->identity, vp->vp_strvalue,
1102                                    MAX_STRING_LEN) != 0) {
1103                                RDEBUG("Identity does not match User-Name, setting from EAP Identity.");
1104                                free(*eap_packet_p);
1105                                *eap_packet_p = NULL;
1106                                eap_handler_free(inst, handler);
1107                                return NULL;
1108                        }
1109                }
1110         }
1111
1112         handler->eap_ds = eap_buildds(eap_packet_p);
1113         if (handler->eap_ds == NULL) {
1114                 free(*eap_packet_p);
1115                 *eap_packet_p = NULL;
1116                 eap_handler_free(inst, handler);
1117                 return NULL;
1118         }
1119
1120         handler->timestamp = request->timestamp;
1121         handler->request = request; /* LEAP needs this */
1122         return handler;
1123 }