src/modules/rlm_eap/types/rlm_eap_peap/peap.c

   1 /*
   2  * peap.c contains the interfaces that are called from eap
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  *   Copyright 2003 Alan DeKok <aland@freeradius.org>
  21  *   Copyright 2006 The FreeRADIUS server project
  22  */
  23
  24 RCSID("$Id$")
  25 USES_APPLE_DEPRECATED_API       /* OpenSSL API has been deprecated by Apple */
  26
  27 #include "eap_peap.h"
  28
  29 static int setup_fake_request(REQUEST *request, REQUEST *fake, peap_tunnel_t *t);
  30
  31 /*
  32  *      Send protected EAP-Failure
  33  *
  34  *       Result-TLV = Failure
  35  */
  36 static int eappeap_failure(eap_handler_t *handler, tls_session_t *tls_session)
  37 {
  38         uint8_t tlv_packet[11];
  39         REQUEST *request = handler->request;
  40
  41         RDEBUG2("FAILURE");
  42
  43         tlv_packet[0] = PW_EAP_REQUEST;
  44         tlv_packet[1] = handler->eap_ds->response->id +1;
  45         tlv_packet[2] = 0;
  46         tlv_packet[3] = 11;     /* length of this packet */
  47         tlv_packet[4] = PW_EAP_TLV;
  48         tlv_packet[5] = 0x80;
  49         tlv_packet[6] = EAP_TLV_ACK_RESULT;
  50         tlv_packet[7] = 0;
  51         tlv_packet[8] = 2;      /* length of the data portion */
  52         tlv_packet[9] = 0;
  53         tlv_packet[10] = EAP_TLV_FAILURE;
  54
  55         (tls_session->record_plus)(&tls_session->clean_in, tlv_packet, 11);
  56
  57         /*
  58          *      FIXME: Check the return code.
  59          */
  60         tls_handshake_send(request, tls_session);
  61
  62         return 1;
  63 }
  64
  65
  66 /*
  67  *      Send protected EAP-Success
  68  *
  69  *       Result-TLV = Success
  70  */
  71 static int eappeap_success(eap_handler_t *handler, tls_session_t *tls_session)
  72 {
  73         uint8_t tlv_packet[11];
  74         REQUEST *request = handler->request;
  75
  76         RDEBUG2("SUCCESS");
  77
  78         tlv_packet[0] = PW_EAP_REQUEST;
  79         tlv_packet[1] = handler->eap_ds->response->id +1;
  80         tlv_packet[2] = 0;
  81         tlv_packet[3] = 11;     /* length of this packet */
  82         tlv_packet[4] = PW_EAP_TLV;
  83         tlv_packet[5] = 0x80;   /* mandatory AVP */
  84         tlv_packet[6] = EAP_TLV_ACK_RESULT;
  85         tlv_packet[7] = 0;
  86         tlv_packet[8] = 2;      /* length of the data portion */
  87         tlv_packet[9] = 0;
  88         tlv_packet[10] = EAP_TLV_SUCCESS;
  89
  90         (tls_session->record_plus)(&tls_session->clean_in, tlv_packet, 11);
  91
  92         /*
  93          *      FIXME: Check the return code.
  94          */
  95         tls_handshake_send(request, tls_session);
  96
  97         return 1;
  98 }
  99
 100
 101 static int eappeap_identity(eap_handler_t *handler, tls_session_t *tls_session)
 102 {
 103         eap_packet_raw_t eap_packet;
 104
 105         eap_packet.code = PW_EAP_REQUEST;
 106         eap_packet.id = handler->eap_ds->response->id + 1;
 107         eap_packet.length[0] = 0;
 108         eap_packet.length[1] = EAP_HEADER_LEN + 1;
 109         eap_packet.data[0] = PW_EAP_IDENTITY;
 110
 111         (tls_session->record_plus)(&tls_session->clean_in,
 112                                   &eap_packet, sizeof(eap_packet));
 113
 114         tls_handshake_send(handler->request, tls_session);
 115         (tls_session->record_init)(&tls_session->clean_in);
 116
 117         return 1;
 118 }
 119
 120 /*
 121  * Send an MS SoH request
 122  */
 123 static int eappeap_soh(eap_handler_t *handler, tls_session_t *tls_session)
 124 {
 125         uint8_t tlv_packet[20];
 126
 127         tlv_packet[0] = 254;    /* extended type */
 128
 129         tlv_packet[1] = 0;
 130         tlv_packet[2] = 0x01;   /* ms vendor */
 131         tlv_packet[3] = 0x37;
 132
 133         tlv_packet[4] = 0;      /* ms soh eap */
 134         tlv_packet[5] = 0;
 135         tlv_packet[6] = 0;
 136         tlv_packet[7] = 0x21;
 137
 138         tlv_packet[8] = 0;      /* vendor-spec tlv */
 139         tlv_packet[9] = 7;
 140
 141         tlv_packet[10] = 0;
 142         tlv_packet[11] = 8;     /* payload len */
 143
 144         tlv_packet[12] = 0;     /* ms vendor */
 145         tlv_packet[13] = 0;
 146         tlv_packet[14] = 0x01;
 147         tlv_packet[15] = 0x37;
 148
 149         tlv_packet[16] = 0;
 150         tlv_packet[17] = 2;
 151         tlv_packet[18] = 0;
 152         tlv_packet[19] = 0;
 153
 154         (tls_session->record_plus)(&tls_session->clean_in, tlv_packet, 20);
 155         tls_handshake_send(handler->request, tls_session);
 156         return 1;
 157 }
 158
 159 static void eapsoh_verify(REQUEST *request, RADIUS_PACKET *packet,
 160                           uint8_t const *data, unsigned int data_len) {
 161
 162         VALUE_PAIR *vp;
 163         uint8_t eap_method_base;
 164         uint32_t eap_vendor;
 165         uint32_t eap_method;
 166         int rv;
 167
 168         vp = pairmake(packet, &packet->vps, "SoH-Supported", "no", T_OP_EQ);
 169         if (data && data[0] == PW_EAP_NAK) {
 170                 RDEBUG("SoH - client NAKed");
 171                 return;
 172         }
 173
 174         if (!data || data_len < 8) {
 175                 RDEBUG("SoH - eap payload too short");
 176                 return;
 177         }
 178
 179         eap_method_base = *data++;
 180         if (eap_method_base != 254) {
 181                 RDEBUG("SoH - response is not extended EAP: %i", eap_method_base);
 182                 return;
 183         }
 184
 185         eap_vendor = soh_pull_be_24(data); data += 3;
 186         if (eap_vendor != 0x137) {
 187                 RDEBUG("SoH - extended eap vendor %08x is not Microsoft", eap_vendor);
 188                 return;
 189         }
 190
 191         eap_method = soh_pull_be_32(data); data += 4;
 192         if (eap_method != 0x21) {
 193                 RDEBUG("SoH - response eap type %08x is not EAP-SoH", eap_method);
 194                 return;
 195         }
 196
 197
 198         rv = soh_verify(request, data, data_len - 8);
 199         if (rv<0) {
 200                 RDEBUG("SoH - error decoding payload: %s", fr_strerror());
 201         } else {
 202                 vp->vp_integer = 1;
 203         }
 204 }
 205
 206 /*
 207  *      Verify the tunneled EAP message.
 208  */
 209 static int eapmessage_verify(REQUEST *request,
 210                              uint8_t const *data, unsigned int data_len)
 211 {
 212         eap_packet_raw_t const *eap_packet = (eap_packet_raw_t const *) data;
 213         eap_type_t eap_method;
 214
 215         /*
 216          *      No data, OR only 1 byte of EAP type.
 217          */
 218         if (!data || (data_len == 0) ||
 219             ((data_len <= 1) && (data[0] != PW_EAP_IDENTITY))) {
 220                 return 0;
 221         }
 222
 223         eap_method = *data;
 224         switch (eap_method) {
 225         case PW_EAP_IDENTITY:
 226                 if (data_len == 1) {
 227                         RDEBUG2("Identity - ");
 228                         return 1;
 229                 }
 230                 RDEBUG2("Identity - %*s",
 231                        data_len - 1, data + 1);
 232                 return 1;
 233                 break;
 234
 235                 /*
 236                  *      If the first byte of the packet is
 237                  *      EAP-Response, and the EAP data is a TLV,
 238                  *      then it looks OK...
 239                  */
 240         case PW_EAP_RESPONSE:
 241                 if (eap_packet->data[0] == PW_EAP_TLV) {
 242                         RDEBUG2("Received EAP-TLV response");
 243                         return 1;
 244                 }
 245                 RDEBUG2("Got something weird");
 246                 break;
 247
 248
 249                 /*
 250                  *      We normally do Microsoft MS-CHAPv2 (26), versus
 251                  *      Cisco MS-CHAPv2 (29).
 252                  */
 253         case PW_EAP_MSCHAPV2:
 254         default:
 255                 RDEBUG2("EAP type %s (%d)", eap_type2name(eap_method),
 256                         eap_method);
 257                 return 1;
 258                 break;
 259         }
 260
 261         return 0;
 262 }
 263
 264 /*
 265  *      Convert a pseudo-EAP packet to a list of VALUE_PAIR's.
 266  */
 267 static VALUE_PAIR *eap2vp(REQUEST *request, RADIUS_PACKET *packet,
 268                           EAP_DS *eap_ds,
 269                           uint8_t const *data, size_t data_len)
 270 {
 271         size_t total;
 272         uint8_t *p;
 273         VALUE_PAIR *vp = NULL, *head = NULL;
 274         vp_cursor_t cursor;
 275
 276         if (data_len > 65535) return NULL; /* paranoia */
 277
 278         vp = paircreate(packet, PW_EAP_MESSAGE, 0);
 279         if (!vp) {
 280                 RDEBUG2("Failure in creating VP");
 281                 return NULL;
 282         }
 283
 284         total = data_len;
 285         if (total > 249) total = 249;
 286
 287         /*
 288          *      Hand-build an EAP packet from the crap in PEAP version 0.
 289          */
 290         vp->length = EAP_HEADER_LEN + total;
 291         vp->vp_octets = p = talloc_array(vp, uint8_t, vp->length);
 292
 293         p[0] = PW_EAP_RESPONSE;
 294         p[1] = eap_ds->response->id;
 295         p[2] = (data_len + EAP_HEADER_LEN) >> 8;
 296         p[3] = (data_len + EAP_HEADER_LEN) & 0xff;
 297
 298         memcpy(p + EAP_HEADER_LEN, data, total);
 299
 300         fr_cursor_init(&cursor, &head);
 301         fr_cursor_insert(&cursor, vp);
 302         while (total < data_len) {
 303                 vp = paircreate(packet, PW_EAP_MESSAGE, 0);
 304                 if (!vp) {
 305                         RDEBUG2("Failure in creating VP");
 306                         pairfree(&head);
 307                         return NULL;
 308                 }
 309
 310                 pairmemcpy(vp, data + total, (data_len - total));
 311
 312                 total += vp->length;
 313
 314                 fr_cursor_insert(&cursor, vp);
 315         }
 316
 317         return head;
 318 }
 319
 320
 321 /*
 322  *      Convert a list of VALUE_PAIR's to an EAP packet, through the
 323  *      simple expedient of dumping the EAP message
 324  */
 325 static int vp2eap(REQUEST *request, tls_session_t *tls_session, VALUE_PAIR *vp)
 326 {
 327         rad_assert(vp != NULL);
 328         VALUE_PAIR *this;
 329         vp_cursor_t cursor;
 330
 331         /*
 332          *      Skip the id, code, and length.  Just write the EAP
 333          *      type & data to the client.
 334          */
 335 #ifndef NDEBUG
 336         if ((debug_flag > 2) && fr_log_fp) {
 337                 size_t i, total, start = EAP_HEADER_LEN;
 338                 total = 0;
 339
 340                 for (this = fr_cursor_init(&cursor, &vp); this; this = fr_cursor_next(&cursor)) {
 341                         for (i = start; i < vp->length; i++) {
 342                                 if ((total & 0x0f) == 0) {
 343                                         fprintf(fr_log_fp, "  PEAP tunnel data out %04x: ", (int) total);
 344                                 }
 345                                 fprintf(fr_log_fp, "%02x ", vp->vp_octets[i]);
 346
 347                                 if ((total & 0x0f) == 0x0f) {
 348                                         fprintf(fr_log_fp, "\n");
 349                                 }
 350
 351                                 total++;
 352                         }
 353
 354                         start = 0;
 355                 }
 356
 357                 if ((total & 0x0f) != 0) {
 358                         fprintf(fr_log_fp, "\n");
 359                 }
 360         }
 361 #endif
 362
 363         /*
 364          *      Send the EAP data in the first attribute, WITHOUT the
 365          *      header.
 366          */
 367         (tls_session->record_plus)(&tls_session->clean_in, vp->vp_octets + EAP_HEADER_LEN, vp->length - EAP_HEADER_LEN);
 368
 369         /*
 370          *      Send the rest of the EAP data, but skipping the first VP.
 371          */
 372         fr_cursor_init(&cursor, &vp);
 373         for (this = fr_cursor_next(&cursor);
 374              this;
 375              this = fr_cursor_next(&cursor)) {
 376                 (tls_session->record_plus)(&tls_session->clean_in, this->vp_octets, this->length);
 377         }
 378
 379         tls_handshake_send(request, tls_session);
 380
 381         return 1;
 382 }
 383
 384
 385 /*
 386  *      See if there's a TLV in the response.
 387  */
 388 static int eappeap_check_tlv(REQUEST *request, uint8_t const *data,
 389                              size_t data_len)
 390 {
 391         eap_packet_raw_t const *eap_packet = (eap_packet_raw_t const *) data;
 392
 393         if (data_len < 11) return 0;
 394
 395         /*
 396          *      Look for success or failure.
 397          */
 398         if ((eap_packet->code == PW_EAP_RESPONSE) &&
 399             (eap_packet->data[0] == PW_EAP_TLV)) {
 400                 if (data[10] == EAP_TLV_SUCCESS) {
 401                         return 1;
 402                 }
 403
 404                 if (data[10] == EAP_TLV_FAILURE) {
 405                         RDEBUG2("Client rejected our response.  The password is probably incorrect");
 406                         return 0;
 407                 }
 408         }
 409
 410         RDEBUG("Unknown TLV %02x", data[10]);
 411
 412         return 0;
 413 }
 414
 415
 416 /*
 417  *      Use a reply packet to determine what to do.
 418  */
 419 static int CC_HINT(nonnull) process_reply(eap_handler_t *handler, tls_session_t *tls_session,
 420                                           REQUEST *request, RADIUS_PACKET *reply)
 421 {
 422         int rcode = RLM_MODULE_REJECT;
 423         VALUE_PAIR *vp;
 424         peap_tunnel_t *t = tls_session->opaque;
 425
 426         if ((debug_flag > 0) && fr_log_fp) {
 427                 RDEBUG("Got tunneled reply RADIUS code %d",
 428                        reply->code);
 429
 430                 debug_pair_list(reply->vps);
 431         }
 432
 433         switch (reply->code) {
 434         case PW_CODE_ACCESS_ACCEPT:
 435                 RDEBUG2("Tunneled authentication was successful");
 436                 t->status = PEAP_STATUS_SENT_TLV_SUCCESS;
 437                 eappeap_success(handler, tls_session);
 438                 rcode = RLM_MODULE_HANDLED;
 439
 440                 /*
 441                  *      If we've been told to use the attributes from
 442                  *      the reply, then do so.
 443                  *
 444                  *      WARNING: This may leak information about the
 445                  *      tunneled user!
 446                  */
 447                 if (t->use_tunneled_reply) {
 448                         RDEBUG2("Saving tunneled attributes for later");
 449
 450                         /*
 451                          *      Clean up the tunneled reply.
 452                          */
 453                         pairdelete(&reply->vps, PW_PROXY_STATE, 0, TAG_ANY);
 454                         pairdelete(&reply->vps, PW_EAP_MESSAGE, 0, TAG_ANY);
 455                         pairdelete(&reply->vps, PW_MESSAGE_AUTHENTICATOR, 0, TAG_ANY);
 456
 457                         /*
 458                          *      Delete MPPE keys & encryption policy.  We don't
 459                          *      want these here.
 460                          */
 461                         pairdelete(&reply->vps, 7, VENDORPEC_MICROSOFT, TAG_ANY);
 462                         pairdelete(&reply->vps, 8, VENDORPEC_MICROSOFT, TAG_ANY);
 463                         pairdelete(&reply->vps, 16, VENDORPEC_MICROSOFT, TAG_ANY);
 464                         pairdelete(&reply->vps, 17, VENDORPEC_MICROSOFT, TAG_ANY);
 465
 466                         pairfree(&t->accept_vps); /* for proxying MS-CHAP2 */
 467                         pairfilter(t, &t->accept_vps, &reply->vps, 0, 0, TAG_ANY);
 468                         rad_assert(!reply->vps);
 469                 }
 470                 break;
 471
 472         case PW_CODE_ACCESS_REJECT:
 473                 RDEBUG2("Tunneled authentication was rejected");
 474                 t->status = PEAP_STATUS_SENT_TLV_FAILURE;
 475                 eappeap_failure(handler, tls_session);
 476                 rcode = RLM_MODULE_HANDLED;
 477                 break;
 478
 479         case PW_CODE_ACCESS_CHALLENGE:
 480                 RDEBUG2("Got tunneled Access-Challenge");
 481
 482                 /*
 483                  *      Keep the State attribute, if necessary.
 484                  *
 485                  *      Get rid of the old State, too.
 486                  */
 487                 pairfree(&t->state);
 488                 pairfilter(t, &t->state, &reply->vps, PW_STATE, 0, TAG_ANY);
 489
 490                 /*
 491                  *      PEAP takes only EAP-Message attributes inside
 492                  *      of the tunnel.  Any Reply-Message in the
 493                  *      Access-Challenge is ignored.
 494                  */
 495                 vp = NULL;
 496                 pairfilter(t, &vp, &reply->vps, PW_EAP_MESSAGE, 0, TAG_ANY);
 497
 498                 /*
 499                  *      Handle EAP-MSCHAP-V2, where Access-Accept's
 500                  *      from the home server may contain MS-CHAP2-Success,
 501                  *      which the module turns into challenges, so that
 502                  *      the client may respond to the challenge with
 503                  *      an "ack" packet.
 504                  */
 505                 if (t->home_access_accept && t->use_tunneled_reply) {
 506                         RDEBUG2("Saving tunneled attributes for later");
 507
 508                         /*
 509                          *      Clean up the tunneled reply.
 510                          */
 511                         pairdelete(&reply->vps, PW_PROXY_STATE, 0, TAG_ANY);
 512                         pairdelete(&reply->vps, PW_MESSAGE_AUTHENTICATOR, 0, TAG_ANY);
 513
 514                         rad_assert(!t->accept_vps);
 515                         pairfilter(t, &t->accept_vps, &reply->vps, 0, 0, TAG_ANY);
 516                         rad_assert(!reply->vps);
 517                 }
 518
 519                 /*
 520                  *      Handle the ACK, by tunneling any necessary reply
 521                  *      VP's back to the client.
 522                  */
 523                 if (vp) {
 524                         vp2eap(request, tls_session, vp);
 525                         pairfree(&vp);
 526                 }
 527
 528                 rcode = RLM_MODULE_HANDLED;
 529                 break;
 530
 531         default:
 532                 RDEBUG2("Unknown RADIUS packet type %d: rejecting tunneled user", reply->code);
 533                 rcode = RLM_MODULE_REJECT;
 534                 break;
 535         }
 536
 537         return rcode;
 538 }
 539
 540 #ifdef WITH_PROXY
 541 /*
 542  *      Do post-proxy processing,
 543  */
 544 static int CC_HINT(nonnull) eappeap_postproxy(eap_handler_t *handler, void *data)
 545 {
 546         int rcode;
 547         tls_session_t *tls_session = (tls_session_t *) data;
 548         REQUEST *fake, *request = handler->request;
 549
 550         RDEBUG2("Passing reply from proxy back into the tunnel");
 551
 552         /*
 553          *      If there was a fake request associated with the proxied
 554          *      request, do more processing of it.
 555          */
 556         fake = (REQUEST *) request_data_get(handler->request,
 557                                             handler->request->proxy,
 558                                             REQUEST_DATA_EAP_MSCHAP_TUNNEL_CALLBACK);
 559
 560         /*
 561          *      Do the callback, if it exists, and if it was a success.
 562          */
 563         if (fake && (handler->request->proxy_reply->code == PW_CODE_ACCESS_ACCEPT)) {
 564                 peap_tunnel_t *t = tls_session->opaque;
 565
 566                 t->home_access_accept = true;
 567
 568                 /*
 569                  *      Terrible hacks.
 570                  */
 571                 rad_assert(!fake->packet);
 572                 fake->packet = talloc_steal(fake, request->proxy);
 573                 fake->packet->src_ipaddr = request->packet->src_ipaddr;
 574                 request->proxy = NULL;
 575
 576                 rad_assert(!fake->reply);
 577                 fake->reply = talloc_steal(fake, request->proxy_reply);
 578                 request->proxy_reply = NULL;
 579
 580                 if ((debug_flag > 0) && fr_log_fp) {
 581                         fprintf(fr_log_fp, "server %s {\n", fake->server);
 582                 }
 583
 584                 /*
 585                  *      Perform a post-auth stage, which will get the EAP
 586                  *      handler, too...
 587                  */
 588                 fake->log.lvl &= ~RAD_REQUEST_OPTION_PROXY_EAP;
 589                 RDEBUG2("Passing reply back for EAP-MS-CHAP-V2");
 590                 process_post_proxy(0, fake);
 591
 592                 /*
 593                  *      FIXME: If rcode returns fail, do something
 594                  *      intelligent...
 595                  */
 596                 rcode = rad_postauth(fake);
 597
 598                 if ((debug_flag > 0) && fr_log_fp) {
 599                         fprintf(fr_log_fp, "} # server %s\n", fake->server);
 600
 601                         RDEBUG("Final reply from tunneled session code %d",
 602                                fake->reply->code);
 603
 604                         debug_pair_list(fake->reply->vps);
 605                 }
 606
 607                 /*
 608                  *      Terrible hacks.
 609                  */
 610                 request->proxy = talloc_steal(request, fake->packet);
 611                 fake->packet = NULL;
 612                 request->proxy_reply = talloc_steal(request, fake->reply);
 613                 fake->reply = NULL;
 614
 615                 /*
 616                  *      And we're done with this request.
 617                  */
 618
 619                 switch (rcode) {
 620                 case RLM_MODULE_FAIL:
 621                         talloc_free(fake);
 622                         eaptls_fail(handler, 0);
 623                         return 0;
 624
 625                 default:  /* Don't Do Anything */
 626                         RDEBUG2("Got reply %d", request->proxy_reply->code);
 627                         break;
 628                 }
 629         }
 630         talloc_free(fake);      /* robust if !fake */
 631
 632         /*
 633          *      If there was no EAP-Message in the reply packet, then
 634          *      we know that we're supposed to re-run the "authenticate"
 635          *      stage, in order to get the right kind of handling...
 636          */
 637
 638         /*
 639          *      Process the reply from the home server.
 640          */
 641
 642         rcode = process_reply(handler, tls_session, handler->request,
 643                               handler->request->proxy_reply);
 644
 645         /*
 646          *      The proxy code uses the reply from the home server as
 647          *      the basis for the reply to the NAS.  We don't want that,
 648          *      so we toss it, after we've had our way with it.
 649          */
 650         pairfree(&handler->request->proxy_reply->vps);
 651
 652         switch (rcode) {
 653         case RLM_MODULE_REJECT:
 654                 RDEBUG2("Reply was rejected");
 655                 eaptls_fail(handler, 0);
 656                 return 0;
 657
 658         case RLM_MODULE_HANDLED:
 659                 RDEBUG2("Reply was handled");
 660                 eaptls_request(handler->eap_ds, tls_session);
 661                 request->proxy_reply->code = PW_CODE_ACCESS_CHALLENGE;
 662                 return 1;
 663
 664         case RLM_MODULE_OK:
 665                 RDEBUG2("Reply was OK");
 666
 667                 /*
 668                  *      Success: Automatically return MPPE keys.
 669                  */
 670                 return eaptls_success(handler, 0);
 671
 672         default:
 673                 RDEBUG2("Reply was unknown");
 674                 break;
 675         }
 676
 677         eaptls_fail(handler, 0);
 678         return 0;
 679 }
 680 #endif
 681
 682
 683 static char const *peap_state(peap_tunnel_t *t)
 684 {
 685         switch (t->status) {
 686                 case PEAP_STATUS_TUNNEL_ESTABLISHED:
 687                         return "TUNNEL ESTABLISHED";
 688                 case PEAP_STATUS_WAIT_FOR_SOH_RESPONSE:
 689                         return "WAITING FOR SOH RESPONSE";
 690                 case PEAP_STATUS_INNER_IDENTITY_REQ_SENT:
 691                         return "WAITING FOR INNER IDENTITY";
 692                 case PEAP_STATUS_SENT_TLV_SUCCESS:
 693                         return "send tlv success";
 694                 case PEAP_STATUS_SENT_TLV_FAILURE:
 695                         return "send tlv failure";
 696                 case PEAP_STATUS_PHASE2_INIT:
 697                         return "phase2_init";
 698                 case PEAP_STATUS_PHASE2:
 699                         return "phase2";
 700                 default:
 701                         break;
 702         }
 703         return "?";
 704 }
 705
 706 static void print_tunneled_data(uint8_t const *data, size_t data_len)
 707 {
 708         size_t i;
 709
 710         if ((debug_flag > 2) && fr_log_fp) {
 711                 for (i = 0; i < data_len; i++) {
 712                   if ((i & 0x0f) == 0) fprintf(fr_log_fp, "  PEAP tunnel data in %02x: ", (int) i);
 713
 714                         fprintf(fr_log_fp, "%02x ", data[i]);
 715
 716                         if ((i & 0x0f) == 0x0f) fprintf(fr_log_fp, "\n");
 717                 }
 718                 if ((data_len & 0x0f) != 0) fprintf(fr_log_fp, "\n");
 719         }
 720 }
 721
 722
 723 /*
 724  *      Process the pseudo-EAP contents of the tunneled data.
 725  */
 726 rlm_rcode_t eappeap_process(eap_handler_t *handler, tls_session_t *tls_session)
 727 {
 728         peap_tunnel_t   *t = tls_session->opaque;
 729         REQUEST         *fake;
 730         VALUE_PAIR      *vp;
 731         rlm_rcode_t     rcode = RLM_MODULE_REJECT;
 732         uint8_t const   *data;
 733         unsigned int    data_len;
 734         char *p;
 735
 736         REQUEST *request = handler->request;
 737         EAP_DS *eap_ds = handler->eap_ds;
 738
 739         /*
 740          *      Just look at the buffer directly, without doing
 741          *      record_minus.  This lets us avoid another data copy.
 742          */
 743         data_len = tls_session->clean_out.used;
 744         tls_session->clean_out.used = 0;
 745         data = tls_session->clean_out.data;
 746
 747         RDEBUG2("Peap state %s", peap_state(t));
 748
 749         if ((t->status != PEAP_STATUS_TUNNEL_ESTABLISHED) &&
 750             !eapmessage_verify(request, data, data_len)) {
 751                 RDEBUG2("FAILED processing PEAP: Tunneled data is invalid");
 752                 if (debug_flag > 2) print_tunneled_data(data, data_len);
 753                 return RLM_MODULE_REJECT;
 754         }
 755
 756         switch (t->status) {
 757         case PEAP_STATUS_TUNNEL_ESTABLISHED:
 758                 /* FIXME: should be no data in the buffer here, check & assert? */
 759
 760                 if (SSL_session_reused(tls_session->ssl)) {
 761                         RDEBUG2("Skipping Phase2 because of session resumption");
 762                         t->session_resumption_state = PEAP_RESUMPTION_YES;
 763                         if (t->soh) {
 764                                 t->status = PEAP_STATUS_WAIT_FOR_SOH_RESPONSE;
 765                                 RDEBUG2("Requesting SoH from client");
 766                                 eappeap_soh(handler, tls_session);
 767                                 return RLM_MODULE_HANDLED;
 768                         }
 769                         /* we're good, send success TLV */
 770                         t->status = PEAP_STATUS_SENT_TLV_SUCCESS;
 771                         eappeap_success(handler, tls_session);
 772
 773                 } else {
 774                         /* send an identity request */
 775                         t->session_resumption_state = PEAP_RESUMPTION_NO;
 776                         t->status = PEAP_STATUS_INNER_IDENTITY_REQ_SENT;
 777                         eappeap_identity(handler, tls_session);
 778                 }
 779                 return RLM_MODULE_HANDLED;
 780
 781         case PEAP_STATUS_INNER_IDENTITY_REQ_SENT:
 782                 /* we're expecting an identity response */
 783                 if (data[0] != PW_EAP_IDENTITY) {
 784                         RDEBUG("Expected EAP-Identity, got something else");
 785                         return RLM_MODULE_REJECT;
 786                 }
 787
 788                 /*
 789                  *      Save it for later.
 790                  */
 791                 t->username = pairmake(t, NULL, "User-Name", NULL, T_OP_EQ);
 792                 rad_assert(t->username != NULL);
 793
 794                 t->username->vp_strvalue = p = talloc_array(t->username, char, data_len);
 795                 memcpy(p, data + 1, data_len - 1);
 796                 t->username->length = data_len - 1;
 797                 p[t->username->length] = 0;
 798                 RDEBUG("Got inner identity '%s'", t->username->vp_strvalue);
 799                 if (t->soh) {
 800                         t->status = PEAP_STATUS_WAIT_FOR_SOH_RESPONSE;
 801                         RDEBUG2("Requesting SoH from client");
 802                         eappeap_soh(handler, tls_session);
 803                         return RLM_MODULE_HANDLED;
 804                 }
 805                 t->status = PEAP_STATUS_PHASE2_INIT;
 806                 break;
 807
 808         case PEAP_STATUS_WAIT_FOR_SOH_RESPONSE:
 809                 fake = request_alloc_fake(request);
 810                 rad_assert(!fake->packet->vps);
 811                 eapsoh_verify(request, fake->packet, data, data_len);
 812                 setup_fake_request(request, fake, t);
 813
 814                 if (t->soh_virtual_server) {
 815                         fake->server = t->soh_virtual_server;
 816                 }
 817                 RDEBUG("Sending SoH request to server %s", fake->server ? fake->server : "NULL");
 818                 rad_virtual_server(fake);
 819
 820                 if (fake->reply->code != PW_CODE_ACCESS_ACCEPT) {
 821                         RDEBUG2("SoH was rejected");
 822                         talloc_free(fake);
 823                         t->status = PEAP_STATUS_SENT_TLV_FAILURE;
 824                         eappeap_failure(handler, tls_session);
 825                         return RLM_MODULE_HANDLED;
 826                 }
 827
 828                 /* save the SoH VPs */
 829                 rad_assert(!t->soh_reply_vps);
 830                 pairfilter(t, &t->soh_reply_vps, &fake->reply->vps, 0, 0, TAG_ANY);
 831                 rad_assert(!fake->reply->vps);
 832                 talloc_free(fake);
 833
 834                 if (t->session_resumption_state == PEAP_RESUMPTION_YES) {
 835                         /* we're good, send success TLV */
 836                         t->status = PEAP_STATUS_SENT_TLV_SUCCESS;
 837                         eappeap_success(handler, tls_session);
 838                         return RLM_MODULE_HANDLED;
 839                 }
 840
 841                 t->status = PEAP_STATUS_PHASE2_INIT;
 842                 break;
 843
 844
 845         /*
 846          *      If we authenticated the user, then it's OK.
 847          */
 848         case PEAP_STATUS_SENT_TLV_SUCCESS:
 849                 if (eappeap_check_tlv(request, data, data_len)) {
 850                         RDEBUG2("Success");
 851                         return RLM_MODULE_OK;
 852                 }
 853
 854                 /*
 855                  *      Otherwise, the client rejected the session
 856                  *      resumption.  If the session is being re-used,
 857                  *      we need to do a full authentication.
 858                  *
 859                  *      We do this by sending an EAP-Identity request
 860                  *      inside of the PEAP tunnel.
 861                  */
 862                 if (t->session_resumption_state == PEAP_RESUMPTION_YES) {
 863                         RDEBUG2("Client rejected session resumption.  Re-starting full authentication");
 864
 865                         /*
 866                          *      Mark session resumption status.
 867                          */
 868                         t->status = PEAP_STATUS_INNER_IDENTITY_REQ_SENT;
 869                         t->session_resumption_state = PEAP_RESUMPTION_NO;
 870
 871                         eappeap_identity(handler, tls_session);
 872                         return RLM_MODULE_HANDLED;
 873                 }
 874
 875                 RDEBUG2("We sent a success, but the client did not agree");
 876                 return RLM_MODULE_REJECT;
 877
 878         /*
 879          *      Damned if I know why the clients continue sending EAP
 880          *      packets after we told them to f*ck off.
 881          */
 882         case PEAP_STATUS_SENT_TLV_FAILURE:
 883                 RINDENT();
 884                 RDEBUG("The users session was previously rejected: returning reject (again.)");
 885                 RDEBUG("*** This means you need to read the PREVIOUS messages in the debug output");
 886                 RDEBUG("*** to find out the reason why the user was rejected");
 887                 RDEBUG("*** Look for \"reject\" or \"fail\".  Those earlier messages will tell you");
 888                 RDEBUG("*** what went wrong, and how to fix the problem");
 889                 REXDENT();
 890
 891                 return RLM_MODULE_REJECT;
 892
 893                 case PEAP_STATUS_PHASE2_INIT:
 894                         RDEBUG("In state machine in phase2 init?");
 895
 896                 case PEAP_STATUS_PHASE2:
 897                         break;
 898
 899                 default:
 900                         RDEBUG2("Unhandled state in peap");
 901                         return RLM_MODULE_REJECT;
 902         }
 903
 904         fake = request_alloc_fake(request);
 905
 906         rad_assert(!fake->packet->vps);
 907
 908         switch (t->status) {
 909                 /*
 910                  *      If we're in PHASE2_INIT, the phase2 method hasn't been
 911                  *      sent an Identity packet yet; do so from the stored
 912                  *      username and this will kick off the phase2 eap method
 913                  */
 914
 915         case PEAP_STATUS_PHASE2_INIT: {
 916                 size_t len = t->username->length + EAP_HEADER_LEN + 1;
 917                 uint8_t *q;
 918
 919                 t->status = PEAP_STATUS_PHASE2;
 920
 921                 vp = paircreate(fake->packet, PW_EAP_MESSAGE, 0);
 922                 vp->length = len;
 923                 vp->vp_octets = q = talloc_array(vp, uint8_t, vp->length);
 924
 925                 q[0] = PW_EAP_RESPONSE;
 926                 q[1] = eap_ds->response->id;
 927                 q[2] = (len >> 8) & 0xff;
 928                 q[3] = len & 0xff;
 929                 q[4] = PW_EAP_IDENTITY;
 930
 931                 memcpy(q + EAP_HEADER_LEN + 1,
 932                        t->username->vp_strvalue, t->username->length);
 933
 934                 pairadd(&fake->packet->vps, vp);
 935
 936                 if (t->default_method != 0) {
 937                         RDEBUG2("Setting default EAP type for tunneled EAP session");
 938                         vp = pairmake(fake, &fake->config_items, "EAP-Type", "0", T_OP_EQ);
 939                         vp->vp_integer = t->default_method;
 940                 }
 941                 break; }
 942
 943         case PEAP_STATUS_PHASE2:
 944                 fake->packet->vps = eap2vp(request, fake->packet,
 945                                            eap_ds, data, data_len);
 946                 if (!fake->packet->vps) {
 947                         talloc_free(fake);
 948                         RDEBUG2("Unable to convert tunneled EAP packet to internal server data structures");
 949                         return RLM_MODULE_REJECT;
 950                 }
 951                 break;
 952
 953         default:
 954                 RDEBUG("Invalid state change in PEAP");
 955                 return RLM_MODULE_REJECT;
 956         }
 957
 958         if ((debug_flag > 0) && fr_log_fp) {
 959                 RDEBUG("Got tunneled request");
 960
 961                 debug_pair_list(fake->packet->vps);
 962
 963                 fprintf(fr_log_fp, "server %s {\n",
 964                         (!fake->server) ? "" : fake->server);
 965         }
 966
 967         /*
 968          *      Update other items in the REQUEST data structure.
 969          */
 970         if (!t->username) {
 971                 /*
 972                  *      There's no User-Name in the tunneled session,
 973                  *      so we add one here, by pulling it out of the
 974                  *      EAP-Identity packet.
 975                  */
 976                 if ((data[0] == PW_EAP_IDENTITY) && (data_len > 1)) {
 977                         t->username = pairmake(t, NULL, "User-Name", NULL, T_OP_EQ);
 978                         rad_assert(t->username != NULL);
 979
 980                         t->username->vp_strvalue = p = talloc_array(t->username, char, data_len);
 981                         memcpy(p, data + 1, data_len - 1);
 982                         t->username->length = data_len - 1;
 983                         p[t->username->length] = 0;
 984                         DEBUG2("  PEAP: Got tunneled identity of %s", t->username->vp_strvalue);
 985
 986                         /*
 987                          *      If there's a default EAP type,
 988                          *      set it here.
 989                          */
 990                         if (t->default_method != 0) {
 991                                 DEBUG2("  PEAP: Setting default EAP type for tunneled EAP session");
 992                                 vp = pairmake(fake, &fake->config_items, "EAP-Type", "0", T_OP_EQ);
 993                                 vp->vp_integer = t->default_method;
 994                         }
 995                 }
 996         } /* else there WAS a t->username */
 997
 998         setup_fake_request(request, fake, t);
 999
1000         if ((vp = pairfind(request->config_items, PW_VIRTUAL_SERVER, 0, TAG_ANY)) != NULL) {
1001                 fake->server = vp->vp_strvalue;
1002
1003         } else if (t->virtual_server) {
1004                 fake->server = t->virtual_server;
1005
1006         } /* else fake->server == request->server */
1007
1008         if ((debug_flag > 0) && fr_log_fp) {
1009                 fprintf(fr_log_fp, "Sending tunneled request\n");
1010
1011                 debug_pair_list(fake->packet->vps);
1012
1013                 fprintf(fr_log_fp, "server %s {\n",
1014                         (!fake->server) ? "" : fake->server);
1015         }
1016
1017         /*
1018          *      Call authentication recursively, which will
1019          *      do PAP, CHAP, MS-CHAP, etc.
1020          */
1021         rad_virtual_server(fake);
1022
1023         /*
1024          *      Note that we don't do *anything* with the reply
1025          *      attributes.
1026          */
1027         if ((debug_flag > 0) && fr_log_fp) {
1028                 fprintf(fr_log_fp, "} # server %s\n",
1029                         (!fake->server) ? "" : fake->server);
1030
1031                 RDEBUG("Got tunneled reply code %d", fake->reply->code);
1032
1033                 debug_pair_list(fake->reply->vps);
1034         }
1035
1036         /*
1037          *      Decide what to do with the reply.
1038          */
1039         switch (fake->reply->code) {
1040         case 0:                 /* No reply code, must be proxied... */
1041 #ifdef WITH_PROXY
1042                 vp = pairfind(fake->config_items, PW_PROXY_TO_REALM, 0, TAG_ANY);
1043
1044                 if (vp) {
1045                         eap_tunnel_data_t *tunnel;
1046
1047                         /*
1048                          *      The tunneled request was NOT handled,
1049                          *      it has to be proxied.  This means that
1050                          *      the "authenticate" stage was never
1051                          *      performed.
1052                          *
1053                          *      If we are told to NOT proxy the
1054                          *      tunneled request as EAP, then this
1055                          *      means that we've got to decode it,
1056                          *      which means that we MUST run the
1057                          *      "authenticate" portion by hand, here.
1058                          *
1059                          *      Once the tunneled EAP session is ALMOST
1060                          *      done, THEN we proxy it...
1061                          */
1062                         if (!t->proxy_tunneled_request_as_eap) {
1063                                 fake->log.lvl |= RAD_REQUEST_OPTION_PROXY_EAP;
1064
1065                                 /*
1066                                  *      Hmm... should we check for
1067                                  *      Auth-Type & EAP-Message here?
1068                                  */
1069
1070
1071                                 /*
1072                                  *      Run the EAP authentication.
1073                                  */
1074                                 DEBUG2("  PEAP: Calling authenticate in order to initiate tunneled EAP session");
1075                                 rcode = process_authenticate(PW_AUTHTYPE_EAP, fake);
1076                                 if (rcode == RLM_MODULE_OK) {
1077                                         /*
1078                                          *      Authentication succeeded! Rah!
1079                                          */
1080                                         fake->reply->code = PW_CODE_ACCESS_ACCEPT;
1081                                         goto do_process;
1082                                 }
1083
1084                                 if (rcode != RLM_MODULE_HANDLED) {
1085                                         DEBUG2("  PEAP: Can't handle the return code %d", rcode);
1086                                         rcode = RLM_MODULE_REJECT;
1087                                         goto done;
1088                                 }
1089
1090                                 /*
1091                                  *      The module decided it wasn't
1092                                  *      done.  Handle it like normal.
1093                                  */
1094                                 if ((fake->log.lvl & RAD_REQUEST_OPTION_PROXY_EAP) == 0) {
1095                                         DEBUG2("    PEAP: Cancelling proxy to realm %s until the tunneled EAP session has been established", vp->vp_strvalue);
1096                                         goto do_process;
1097                                 }
1098
1099                                 /*
1100                                  *      The module has decoded the
1101                                  *      EAP-Message into another set
1102                                  *      of attributes.
1103                                  */
1104                                 pairdelete(&fake->packet->vps,
1105                                            PW_EAP_MESSAGE, 0, TAG_ANY);
1106                         }
1107
1108                         DEBUG2("  PEAP: Tunneled authentication will be proxied to %s", vp->vp_strvalue);
1109
1110                         /*
1111                          *      Tell the original request that it's going
1112                          *      to be proxied.
1113                          */
1114                         pairfilter(request, &request->config_items,
1115                                    &fake->config_items,
1116                                    PW_PROXY_TO_REALM, 0, TAG_ANY);
1117
1118                         /*
1119                          *      Seed the proxy packet with the
1120                          *      tunneled request.
1121                          */
1122                         rad_assert(!request->proxy);
1123                         request->proxy = talloc_steal(request, fake->packet);
1124                         memset(&request->proxy->src_ipaddr, 0,
1125                                sizeof(request->proxy->src_ipaddr));
1126                         memset(&request->proxy->dst_ipaddr, 0,
1127                                sizeof(request->proxy->dst_ipaddr));
1128                         request->proxy->src_port = 0;
1129                         request->proxy->dst_port = 0;
1130                         fake->packet = NULL;
1131                         rad_free(&fake->reply);
1132                         fake->reply = NULL;
1133
1134                         /*
1135                          *      Set up the callbacks for the tunnel
1136                          */
1137                         tunnel = talloc_zero(request, eap_tunnel_data_t);
1138                         tunnel->tls_session = tls_session;
1139                         tunnel->callback = eappeap_postproxy;
1140
1141                         /*
1142                          *      Associate the callback with the request.
1143                          */
1144                         rcode = request_data_add(request,
1145                                                  request->proxy,
1146                                                  REQUEST_DATA_EAP_TUNNEL_CALLBACK,
1147                                                  tunnel, false);
1148                         rad_assert(rcode == 0);
1149
1150                         /*
1151                          *      We're not proxying it as EAP, so we've got
1152                          *      to do the callback later.
1153                          */
1154                         if ((fake->log.lvl & RAD_REQUEST_OPTION_PROXY_EAP) != 0) {
1155                                 DEBUG2("  PEAP: Remembering to do EAP-MS-CHAP-V2 post-proxy");
1156
1157                                 /*
1158                                  *      rlm_eap.c has taken care of associating
1159                                  *      the handler with the fake request.
1160                                  *
1161                                  *      So we associate the fake request with
1162                                  *      this request.
1163                                  */
1164                                 rcode = request_data_add(request, request->proxy,
1165                                                          REQUEST_DATA_EAP_MSCHAP_TUNNEL_CALLBACK,
1166                                                          fake, true);
1167                                 rad_assert(rcode == 0);
1168
1169                                 /*
1170                                  *      Do NOT free the fake request!
1171                                  */
1172                                 return RLM_MODULE_UPDATED;
1173                         }
1174
1175                         /*
1176                          *      Didn't authenticate the packet, but
1177                          *      we're proxying it.
1178                          */
1179                         rcode = RLM_MODULE_UPDATED;
1180
1181                 } else
1182 #endif  /* WITH_PROXY */
1183                   {
1184                         DEBUG2("  PEAP: Unknown RADIUS packet type %d: rejecting tunneled user", fake->reply->code);
1185                         rcode = RLM_MODULE_REJECT;
1186                   }
1187                 break;
1188
1189         default:
1190 #ifdef WITH_PROXY
1191         do_process:
1192 #endif
1193                 rcode = process_reply(handler, tls_session, request,
1194                                       fake->reply);
1195                 break;
1196         }
1197
1198 #ifdef WITH_PROXY
1199  done:
1200 #endif
1201         talloc_free(fake);
1202
1203         return rcode;
1204 }
1205
1206 static int CC_HINT(nonnull) setup_fake_request(REQUEST *request, REQUEST *fake, peap_tunnel_t *t) {
1207
1208         VALUE_PAIR *vp;
1209
1210         /*
1211          *      Tell the request that it's a fake one.
1212          */
1213         pairmake(fake->packet, &fake->packet->vps,
1214                  "Freeradius-Proxied-To", "127.0.0.1", T_OP_EQ);
1215
1216         if (t->username) {
1217                 vp = paircopy(fake->packet, t->username);
1218                 pairadd(&fake->packet->vps, vp);
1219                 fake->username = vp;
1220                 RDEBUG2("Setting User-Name to %s", fake->username->vp_strvalue);
1221         } else {
1222                 RDEBUG2("No tunnel username (SSL resumption?)");
1223         }
1224
1225
1226         /*
1227          *      Add the State attribute, too, if it exists.
1228          */
1229         if (t->state) {
1230                 vp = paircopy(fake->packet, t->state);
1231                 if (vp) pairadd(&fake->packet->vps, vp);
1232         }
1233
1234         /*
1235          *      If this is set, we copy SOME of the request attributes
1236          *      from outside of the tunnel to inside of the tunnel.
1237          *
1238          *      We copy ONLY those attributes which do NOT already
1239          *      exist in the tunneled request.
1240          *
1241          *      This code is copied from ../rlm_eap_ttls/ttls.c
1242          */
1243         if (t->copy_request_to_tunnel) {
1244                 VALUE_PAIR *copy;
1245                 vp_cursor_t cursor;
1246
1247                 for (vp = fr_cursor_init(&cursor, &request->packet->vps);
1248                      vp;
1249                      vp = fr_cursor_next(&cursor)) {
1250                         /*
1251                          *      The attribute is a server-side thingy,
1252                          *      don't copy it.
1253                          */
1254                         if ((vp->da->attr > 255) && (((vp->da->attr >> 16) & 0xffff) == 0)) {
1255                                 continue;
1256                         }
1257
1258                         /*
1259                          *      The outside attribute is already in the
1260                          *      tunnel, don't copy it.
1261                          *
1262                          *      This works for BOTH attributes which
1263                          *      are originally in the tunneled request,
1264                          *      AND attributes which are copied there
1265                          *      from below.
1266                          */
1267                         if (pairfind(fake->packet->vps, vp->da->attr, vp->da->vendor, TAG_ANY)) {
1268                                 continue;
1269                         }
1270
1271                         /*
1272                          *      Some attributes are handled specially.
1273                          */
1274                         switch (vp->da->attr) {
1275                                 /*
1276                                  *      NEVER copy Message-Authenticator,
1277                                  *      EAP-Message, or State.  They're
1278                                  *      only for outside of the tunnel.
1279                                  */
1280                         case PW_USER_NAME:
1281                         case PW_USER_PASSWORD:
1282                         case PW_CHAP_PASSWORD:
1283                         case PW_CHAP_CHALLENGE:
1284                         case PW_PROXY_STATE:
1285                         case PW_MESSAGE_AUTHENTICATOR:
1286                         case PW_EAP_MESSAGE:
1287                         case PW_STATE:
1288                                 continue;
1289
1290                                 /*
1291                                  *      By default, copy it over.
1292                                  */
1293                         default:
1294                                 break;
1295                         }
1296
1297                         /*
1298                          *      Don't copy from the head, we've already
1299                          *      checked it.
1300                          */
1301                         copy = paircopy2(fake->packet, vp, vp->da->attr, vp->da->vendor, TAG_ANY);
1302                         pairadd(&fake->packet->vps, copy);
1303                 }
1304         }
1305
1306         return 0;
1307 }