src/modules/rlm_eap/rlm_eap.c

   1 /*
   2  * rlm_eap.c  contains handles that are called from modules.
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  *
  20  * Copyright 2000-2003  The FreeRADIUS server project
  21  * Copyright 2001  hereUare Communications, Inc. <raghud@hereuare.com>
  22  * Copyright 2003  Alan DeKok <aland@freeradius.org>
  23  */
  24
  25 #include "autoconf.h"
  26 #include "rlm_eap.h"
  27 #include "modules.h"
  28
  29 static const char rcsid[] = "$Id$";
  30
  31 static const CONF_PARSER module_config[] = {
  32         { "default_eap_type", PW_TYPE_STRING_PTR,
  33           offsetof(rlm_eap_t, default_eap_type_name), NULL, "md5" },
  34         { "timer_expire", PW_TYPE_INTEGER,
  35           offsetof(rlm_eap_t, timer_limit), NULL, "60"},
  36         { "ignore_unknown_eap_types", PW_TYPE_BOOLEAN,
  37           offsetof(rlm_eap_t, ignore_unknown_eap_types), NULL, "no" },
  38         { "cisco_accounting_username_bug", PW_TYPE_BOOLEAN,
  39           offsetof(rlm_eap_t, cisco_accounting_username_bug), NULL, "no" },
  40
  41         { NULL, -1, 0, NULL, NULL }           /* end the list */
  42 };
  43
  44 static int eap_init(void)
  45 {
  46         return 0;
  47 }
  48
  49
  50 /*
  51  * delete all the allocated space by eap module
  52  */
  53 static int eap_detach(void *instance)
  54 {
  55         rlm_eap_t *inst;
  56         int i;
  57
  58         inst = (rlm_eap_t *)instance;
  59
  60         eaplist_free(inst);
  61
  62         for (i = 0; i < PW_EAP_MAX_TYPES; i++) {
  63                 if (inst->types[i]) eaptype_free(inst->types[i]);
  64                 inst->types[i] = NULL;
  65         }
  66
  67 #ifdef HAVE_PTHREAD_H
  68         pthread_mutex_destroy(&(inst->session_mutex));
  69         pthread_mutex_destroy(&(inst->module_mutex));
  70 #endif
  71
  72         if (inst->default_eap_type_name) free(inst->default_eap_type_name);
  73         free(inst);
  74
  75         return 0;
  76 }
  77
  78
  79 /*
  80  * read the config section and load all the eap authentication types present.
  81  */
  82 static int eap_instantiate(CONF_SECTION *cs, void **instance)
  83 {
  84         int             eap_type;
  85         int             num_types;
  86         CONF_SECTION    *scs;
  87         rlm_eap_t       *inst;
  88
  89         inst = (rlm_eap_t *) malloc(sizeof(*inst));
  90         if (!inst) {
  91                 return -1;
  92         }
  93         memset(inst, 0, sizeof(*inst));
  94         if (cf_section_parse(cs, inst, module_config) < 0) {
  95                 eap_detach(inst);
  96                 return -1;
  97         }
  98
  99         /* Load all the configured EAP-Types */
 100         num_types = 0;
 101         for(scs=cf_subsection_find_next(cs, NULL, NULL);
 102                 scs != NULL;
 103                 scs=cf_subsection_find_next(cs, scs, NULL)) {
 104
 105                 char    *auth_type;
 106
 107                 auth_type = cf_section_name1(scs);
 108
 109                 if (!auth_type)  continue;
 110
 111                 eap_type = eaptype_name2type(auth_type);
 112                 if (eap_type < 0) {
 113                         radlog(L_ERR|L_CONS, "rlm_eap: Unknown EAP type %s",
 114                                auth_type);
 115                         eap_detach(inst);
 116                         return -1;
 117                 }
 118
 119                 /*
 120                  *      If we're asked to load TTLS or PEAP, ensure
 121                  *      that we've first loaded TLS.
 122                  */
 123                 if (((eap_type == PW_EAP_TTLS) ||
 124                      (eap_type == PW_EAP_PEAP)) &&
 125                     (inst->types[PW_EAP_TLS] == NULL)) {
 126                         radlog(L_ERR, "rlm_eap: Unable to load EAP-Type/%s, as EAP-Type/TLS is required first.",
 127                                auth_type);
 128                         return -1;
 129                 }
 130
 131                 /*
 132                  *      Load the type.
 133                  */
 134                 if (eaptype_load(&inst->types[eap_type], eap_type, scs) < 0) {
 135                         eap_detach(inst);
 136                         return -1;
 137                 }
 138
 139                 num_types++;    /* successfully loaded one more types */
 140         }
 141
 142         if (num_types == 0) {
 143                 radlog(L_ERR|L_CONS, "rlm_eap: No EAP type configured, module cannot do anything.");
 144                 eap_detach(inst);
 145                 return -1;
 146         }
 147
 148         /*
 149          *      Ensure that the default EAP type is loaded.
 150          */
 151         eap_type = eaptype_name2type(inst->default_eap_type_name);
 152         if (eap_type < 0) {
 153                 radlog(L_ERR|L_CONS, "rlm_eap: Unknown default EAP type %s",
 154                        inst->default_eap_type_name);
 155                 eap_detach(inst);
 156                 return -1;
 157         }
 158
 159         if (inst->types[eap_type] == NULL) {
 160                 radlog(L_ERR|L_CONS, "rlm_eap: No such sub-type for default EAP type %s",
 161                        inst->default_eap_type_name);
 162                 eap_detach(inst);
 163                 return -1;
 164         }
 165         inst->default_eap_type = eap_type; /* save the numerical type */
 166
 167         /*
 168          *      List of sessions are set to NULL by the memset
 169          *      of 'inst', above.
 170          */
 171
 172         /* Generate a state key, specific to eap */
 173         generate_key();
 174
 175 #ifdef HAVE_PTHREAD_H
 176         pthread_mutex_init(&(inst->session_mutex), NULL);
 177         pthread_mutex_init(&(inst->module_mutex), NULL);
 178 #endif
 179
 180         *instance = inst;
 181         return 0;
 182 }
 183
 184 /*
 185  *      Dumb wrapper.
 186  *      FIXME: this should be done more intelligently...
 187  */
 188 static void my_handler_free(void *data)
 189 {
 190   EAP_HANDLER *handler = (EAP_HANDLER *) data;
 191   eap_handler_free(&handler);
 192 }
 193
 194 /*
 195  *      For backwards compatibility.
 196  */
 197 static int eap_authenticate(void *instance, REQUEST *request)
 198 {
 199         rlm_eap_t       *inst;
 200         EAP_HANDLER     *handler;
 201         eap_packet_t    *eap_packet;
 202         int             rcode;
 203 #ifdef HAVE_PTHREAD_H
 204         int             locked = FALSE;
 205 #endif
 206
 207         inst = (rlm_eap_t *) instance;
 208
 209         /*
 210          *      Get the eap packet  to start with
 211          */
 212         eap_packet = eap_attribute(request->packet->vps);
 213         if (eap_packet == NULL) {
 214                 radlog(L_ERR, "rlm_eap: Malformed EAP Message");
 215                 return RLM_MODULE_FAIL;
 216         }
 217
 218         /*
 219          *      Create the eap handler.  The eap_packet will end up being
 220          *      "swallowed" into the handler, so we can't access it after
 221          *      this call.
 222          */
 223         handler = eap_handler(inst, &eap_packet, request);
 224         if (handler == NULL) {
 225                 DEBUG2("  rlm_eap: Failed in handler");
 226                 return RLM_MODULE_INVALID;
 227         }
 228
 229         /*
 230          *      If it's a recursive request, then disallow
 231          *      TLS, TTLS, and PEAP, inside of the TLS tunnel.
 232          */
 233         if ((request->options & RAD_REQUEST_OPTION_FAKE_REQUEST) != 0) {
 234                 switch(handler->eap_ds->response->type.type) {
 235                 case PW_EAP_TLS:
 236                 case PW_EAP_TTLS:
 237                 case PW_EAP_PEAP:
 238                         DEBUG2(" rlm_eap: Unable to tunnel TLS inside of TLS");
 239                         eap_fail(handler);
 240                         eap_handler_free(&handler);
 241                         return RLM_MODULE_INVALID;
 242                         break;
 243
 244                 default:        /* It may be OK, allow it to proceed */
 245                         break;
 246
 247                 }
 248         }
 249
 250 #ifdef HAVE_PTHREAD_H
 251         else {                  /* it's a normal request from a NAS */
 252                 /*
 253                  *      The OpenSSL code isn't strictly thread-safe,
 254                  *      as we've got to provide callback functions.
 255                  *
 256                  *      Rather than doing that, we just ensure that the
 257                  *      sub-modules are locked via a mutex.
 258                  *
 259                  *      Don't lock it if we're calling ourselves recursively,
 260                  *      we've already got the lock.
 261                  */
 262                 pthread_mutex_lock(&(inst->module_mutex));
 263                 locked = TRUE;  /* for recursive calls to the module */
 264         }
 265 #endif
 266
 267         /*
 268          *      Select the appropriate eap_type or default to the
 269          *      configured one
 270          */
 271         rcode = eaptype_select(inst, handler);
 272
 273 #ifdef HAVE_PTHREAD_H
 274         if (locked) pthread_mutex_unlock(&(inst->module_mutex));
 275 #endif
 276
 277         /*
 278          *      If it failed, die.
 279          */
 280         if (rcode == EAP_INVALID) {
 281                 eap_fail(handler);
 282                 eap_handler_free(&handler);
 283                 DEBUG2("  rlm_eap: Failed in EAP select");
 284                 return RLM_MODULE_INVALID;
 285         }
 286
 287         /*
 288          *      If we're doing horrible tunneling work, remember it.
 289          */
 290         if ((request->options & RAD_REQUEST_OPTION_PROXY_EAP) != 0) {
 291                 DEBUG2("  Not-EAP proxy set.  Not composing EAP");
 292                 /*
 293                  *      Add the handle to the proxied list, so that we
 294                  *      can retrieve it in the post-proxy stage, and
 295                  *      send a response.
 296                  */
 297                 rcode = request_data_add(request,
 298                                          inst, REQUEST_DATA_EAP_HANDLER,
 299                                          handler, my_handler_free);
 300                 rad_assert(rcode == 0);
 301
 302                 return RLM_MODULE_HANDLED;
 303         }
 304
 305
 306         /*
 307          *      Maybe the request was marked to be proxied.  If so,
 308          *      proxy it.
 309          */
 310         if (request->proxy != NULL) {
 311                 VALUE_PAIR *vp = NULL;
 312
 313                 rad_assert(request->proxy_reply == NULL);
 314
 315                 /*
 316                  *      Add the handle to the proxied list, so that we
 317                  *      can retrieve it in the post-proxy stage, and
 318                  *      send a response.
 319                  */
 320                 rcode = request_data_add(request,
 321                                          inst, REQUEST_DATA_EAP_HANDLER,
 322                                          handler, my_handler_free);
 323                 rad_assert(rcode == 0);
 324
 325                 /*
 326                  *      Some simple sanity checks.  These should really
 327                  *      be handled by the radius library...
 328                  */
 329                 vp = pairfind(request->proxy->vps, PW_EAP_MESSAGE);
 330                 if (vp) {
 331                         vp = pairfind(request->proxy->vps, PW_MESSAGE_AUTHENTICATOR);
 332                         if (!vp) {
 333                                 vp = pairmake("Message-Authenticator",
 334                                               "0x00", T_OP_EQ);
 335                                 rad_assert(vp != NULL);
 336                                 pairadd(&(request->proxy->vps), vp);
 337                         }
 338                 }
 339
 340                 /*
 341                  *      Delete the "proxied to" attribute, as it's
 342                  *      set to 127.0.0.1 for tunneled requests, and
 343                  *      we don't want to tell the world that...
 344                  */
 345                 pairdelete(&request->proxy->vps, PW_FREERADIUS_PROXIED_TO);
 346
 347                 DEBUG2("  Tunneled session will be proxied.  Not doing EAP.");
 348                 return RLM_MODULE_HANDLED;
 349         }
 350
 351         /*
 352          *      We are done, wrap the EAP-request in RADIUS to send
 353          *      with all other required radius attributes
 354          */
 355         rcode = eap_compose(handler);
 356
 357         /*
 358          *      Add to the list only if it is EAP-Request, OR if
 359          *      it's LEAP, and a response.
 360          */
 361         if ((handler->eap_ds->request->code == PW_EAP_REQUEST) &&
 362             (handler->eap_ds->request->type.type >= PW_EAP_MD5)) {
 363                 eaplist_add(inst, handler);
 364
 365                 /*
 366                  *      LEAP is a little different.  At Stage 4,
 367                  *      it sends an EAP-Success message, but we still
 368                  *      need to keep the State attribute & session
 369                  *      data structure around for the AP Challenge.
 370                  *
 371                  *      At stage 6, LEAP sends an EAP-Response, which
 372                  *      isn't put into the list.
 373                  */
 374         } else if ((handler->eap_ds->response->code == PW_EAP_RESPONSE) &&
 375                    (handler->eap_ds->response->type.type == PW_EAP_LEAP) &&
 376                    (handler->eap_ds->request->code == PW_EAP_SUCCESS) &&
 377                    (handler->eap_ds->request->type.type == 0)) {
 378
 379                 eaplist_add(inst, handler);
 380
 381         } else {
 382                 DEBUG2("  rlm_eap: Freeing handler");
 383                 /* handler is not required any more, free it now */
 384                 eap_handler_free(&handler);
 385         }
 386
 387         /*
 388          *      If it's an Access-Accept, RFC 2869, Section 2.3.1
 389          *      says that we MUST include a User-Name attribute in the
 390          *      Access-Accept.
 391          */
 392         if ((request->reply->code == PW_AUTHENTICATION_ACK) &&
 393             request->username) {
 394                 VALUE_PAIR *vp;
 395
 396                 /*
 397                  *      Doesn't exist, add it in.
 398                  */
 399                 vp = pairfind(request->reply->vps, PW_USER_NAME);
 400                 if (!vp) {
 401                         vp = pairmake("User-Name", request->username->strvalue,
 402                                       T_OP_EQ);
 403                         rad_assert(vp != NULL);
 404                         pairadd(&(request->reply->vps), vp);
 405                 }
 406
 407                 /*
 408                  *      Cisco AP1230 has a bug and needs a zero
 409                  *      terminated string in Access-Accept.
 410                  */
 411                 if ((inst->cisco_accounting_username_bug) &&
 412                     (vp->length < (int) sizeof(vp->strvalue))) {
 413                         vp->strvalue[vp->length] = '\0';
 414                         vp->length++;
 415                 }
 416         }
 417
 418         return rcode;
 419 }
 420
 421 /*
 422  * EAP authorization DEPENDS on other rlm authorizations,
 423  * to check for user existance & get their configured values.
 424  * It Handles EAP-START Messages, User-Name initilization.
 425  */
 426 static int eap_authorize(void *instance, REQUEST *request)
 427 {
 428         rlm_eap_t       *inst;
 429         int             status;
 430         VALUE_PAIR      *vp;
 431
 432         inst = (rlm_eap_t *)instance;
 433
 434         /*
 435          *      We don't do authorization again, once we've seen the
 436          *      proxy reply (or the proxied packet)
 437          */
 438         if (request->proxy != NULL)
 439                 return RLM_MODULE_NOOP;
 440
 441         /*
 442          *      For EAP_START, send Access-Challenge with EAP Identity
 443          *      request.  even when we have to proxy this request
 444          *
 445          *      RFC 2869, Section 2.3.1 notes that the "domain" of the
 446          *      user, (i.e. where to proxy him) comes from the EAP-Identity,
 447          *      so we CANNOT proxy the user, until we know his identity.
 448          *
 449          *      We therefore send an EAP Identity request.
 450          */
 451         status = eap_start(inst, request);
 452         switch(status) {
 453         case EAP_NOOP:
 454                 return RLM_MODULE_NOOP;
 455         case EAP_FAIL:
 456                 return RLM_MODULE_FAIL;
 457         case EAP_FOUND:
 458                 return RLM_MODULE_HANDLED;
 459         case EAP_NOTFOUND:
 460         default:
 461                 break;
 462         }
 463
 464         /*
 465          *      RFC 2869, Section 2.3.1.  If a NAS sends an EAP-Identity,
 466          *      it MUST copy the identity into the User-Name attribute.
 467          *
 468          *      But we don't worry about that too much.  We depend on
 469          *      each EAP sub-module to look for handler->request->username,
 470          *      and to get excited if it doesn't appear.
 471          */
 472
 473         vp = pairfind(request->config_items, PW_AUTH_TYPE);
 474         if ((!vp) ||
 475             (vp->lvalue != PW_AUTHTYPE_REJECT)) {
 476                 vp = pairmake("Auth-Type", "EAP", T_OP_EQ);
 477                 if (!vp) {
 478                         return RLM_MODULE_FAIL;
 479                 }
 480                 pairadd(&request->config_items, vp);
 481         }
 482
 483         return RLM_MODULE_UPDATED;
 484 }
 485
 486 /*
 487  *      If we're proxying EAP, then there may be magic we need
 488  *      to do.
 489  */
 490 static int eap_post_proxy(void *inst, REQUEST *request)
 491 {
 492         int             i, len;
 493         VALUE_PAIR      *vp;
 494         EAP_HANDLER     *handler;
 495
 496         /*
 497          *      If there was a handler associated with this request,
 498          *      then it's a tunneled request which was proxied...
 499          */
 500         handler = request_data_get(request, inst, REQUEST_DATA_EAP_HANDLER);
 501         if (handler != NULL) {
 502                 int             rcode;
 503                 eap_tunnel_data_t *data;
 504
 505                 /*
 506                  *      Grab the tunnel callbacks from the request.
 507                  */
 508                 data = (eap_tunnel_data_t *) request_data_get(request,
 509                                                               request->proxy,
 510                                                               REQUEST_DATA_EAP_TUNNEL_CALLBACK);
 511                 if (!data) {
 512                         radlog(L_ERR, "rlm_eap: Failed to retrieve callback for tunneled session!");
 513                         eap_handler_free(&handler);
 514                         return RLM_MODULE_FAIL;
 515                 }
 516
 517                 /*
 518                  *      Do the callback...
 519                  */
 520                 rcode = data->callback(handler, data->tls_session);
 521                 free(data);
 522                 if (rcode == 0) {
 523                         eap_handler_free(&handler);
 524                         return RLM_MODULE_REJECT;
 525                 }
 526
 527                 /*
 528                  *      We are done, wrap the EAP-request in RADIUS to send
 529                  *      with all other required radius attributes
 530                  */
 531                 rcode = eap_compose(handler);
 532
 533                 /*
 534                  *      Add to the list only if it is EAP-Request, OR if
 535                  *      it's LEAP, and a response.
 536                  */
 537                 if ((handler->eap_ds->request->code == PW_EAP_REQUEST) &&
 538                     (handler->eap_ds->request->type.type >= PW_EAP_MD5)) {
 539                         eaplist_add(inst, handler);
 540
 541                 } else {        /* couldn't have been LEAP, there's no tunnel */
 542                         DEBUG2("  rlm_eap: Freeing handler");
 543                         /* handler is not required any more, free it now */
 544                         eap_handler_free(&handler);
 545                 }
 546
 547                 /*
 548                  *      If it's an Access-Accept, RFC 2869, Section 2.3.1
 549                  *      says that we MUST include a User-Name attribute in the
 550                  *      Access-Accept.
 551                  */
 552                 if ((request->reply->code == PW_AUTHENTICATION_ACK) &&
 553                     request->username) {
 554                         /*
 555                          *      Doesn't exist, add it in.
 556                          */
 557                         vp = pairfind(request->reply->vps, PW_USER_NAME);
 558                         if (!vp) {
 559                                 vp = pairmake("User-Name", request->username->strvalue,
 560                                               T_OP_EQ);
 561                                 rad_assert(vp != NULL);
 562                                 pairadd(&(request->reply->vps), vp);
 563                         }
 564                 }
 565
 566                 return RLM_MODULE_OK;
 567         }
 568
 569
 570         /*
 571          *      There may be more than one Cisco-AVPair.
 572          *      Ensure we find the one with the LEAP attribute.
 573          */
 574         vp = request->proxy_reply->vps;
 575         for (;;) {
 576                 /*
 577                  *      Hmm... there's got to be a better way to
 578                  *      discover codes for vendor attributes.
 579                  *
 580                  *      This is vendor Cisco (9), Cisco-AVPair
 581                  *      attribute (1)
 582                  */
 583                 vp = pairfind(vp, (9 << 16)  | 1);
 584                 if (!vp) {
 585                         return RLM_MODULE_NOOP;
 586                 }
 587
 588                 /*
 589                  *      If it's "leap:session-key", then stop.
 590                  *
 591                  *      The format is VERY specific!
 592                  */
 593                 if (strncasecmp(vp->strvalue, "leap:session-key=", 17) == 0) {
 594                         break;
 595                 }
 596
 597                 /*
 598                  *      Not this AV-pair.  Go to the next one.
 599                  */
 600                 vp = vp->next;
 601         }
 602
 603         /*
 604          *      The format is very specific.
 605          */
 606         if (vp->length != 17 + 34) {
 607                 DEBUG2("  rlm_eap: Cisco-AVPair with leap:session-key has incorrect length %d: Expected %d",
 608                        vp->length, 17 + 34);
 609                 return RLM_MODULE_NOOP;
 610         }
 611
 612         /*
 613          *      Decrypt the session key, using the proxy data.
 614          */
 615         i = 34;                 /* starts off with 34 octets */
 616         len = rad_tunnel_pwdecode(vp->strvalue + 17, &i,
 617                                   request->proxysecret,
 618                                   request->proxy->vector);
 619
 620         /*
 621          *      FIXME: Assert that i == 16.
 622          */
 623
 624         /*
 625          *      Encrypt the session key again, using the request data.
 626          */
 627         rad_tunnel_pwencode(vp->strvalue + 17, &len,
 628                             request->secret,
 629                             request->packet->vector);
 630
 631         return RLM_MODULE_UPDATED;
 632 }
 633
 634
 635 /*
 636  *      The module name should be the only globally exported symbol.
 637  *      That is, everything else should be 'static'.
 638  */
 639 module_t rlm_eap = {
 640         "eap",
 641         RLM_TYPE_THREAD_SAFE,           /* type */
 642         eap_init,                       /* initialization */
 643         eap_instantiate,                /* instantiation */
 644         {
 645                 eap_authenticate,       /* authentication */
 646                 eap_authorize,          /* authorization */
 647                 NULL,                   /* preaccounting */
 648                 NULL,                   /* accounting */
 649                 NULL,                   /* checksimul */
 650                 NULL,                   /* pre-proxy */
 651                 eap_post_proxy,         /* post-proxy */
 652                 NULL                    /* post-auth */
 653         },
 654         eap_detach,                     /* detach */
 655         NULL,                           /* destroy */
 656 };