src/modules/rlm_eap/types/rlm_eap_peap/peap.c

   1 /*
   2  * peap.c contains the interfaces that are called from eap
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  *   Copyright 2003 Alan DeKok <aland@freeradius.org>
  21  *   Copyright 2006 The FreeRADIUS server project
  22  */
  23
  24 #include <freeradius-devel/ident.h>
  25 RCSID("$Id$")
  26
  27 #include "eap_peap.h"
  28
  29 static int setup_fake_request(REQUEST *request, REQUEST *fake, peap_tunnel_t *t);
  30
  31 /*
  32  *      Send protected EAP-Failure
  33  *
  34  *       Result-TLV = Failure
  35  */
  36 static int eappeap_failure(EAP_HANDLER *handler, tls_session_t *tls_session)
  37 {
  38         uint8_t tlv_packet[11];
  39         REQUEST *request = handler->request;
  40
  41         RDEBUG2("FAILURE");
  42
  43         tlv_packet[0] = PW_EAP_REQUEST;
  44         tlv_packet[1] = handler->eap_ds->response->id +1;
  45         tlv_packet[2] = 0;
  46         tlv_packet[3] = 11;     /* length of this packet */
  47         tlv_packet[4] = PW_EAP_TLV;
  48         tlv_packet[5] = 0x80;
  49         tlv_packet[6] = EAP_TLV_ACK_RESULT;
  50         tlv_packet[7] = 0;
  51         tlv_packet[8] = 2;      /* length of the data portion */
  52         tlv_packet[9] = 0;
  53         tlv_packet[10] = EAP_TLV_FAILURE;
  54
  55         (tls_session->record_plus)(&tls_session->clean_in, tlv_packet, 11);
  56
  57         /*
  58          *      FIXME: Check the return code.
  59          */
  60         tls_handshake_send(request, tls_session);
  61
  62         return 1;
  63 }
  64
  65
  66 /*
  67  *      Send protected EAP-Success
  68  *
  69  *       Result-TLV = Success
  70  */
  71 static int eappeap_success(EAP_HANDLER *handler, tls_session_t *tls_session)
  72 {
  73         uint8_t tlv_packet[11];
  74         REQUEST *request = handler->request;
  75
  76         RDEBUG2("SUCCESS");
  77
  78         tlv_packet[0] = PW_EAP_REQUEST;
  79         tlv_packet[1] = handler->eap_ds->response->id +1;
  80         tlv_packet[2] = 0;
  81         tlv_packet[3] = 11;     /* length of this packet */
  82         tlv_packet[4] = PW_EAP_TLV;
  83         tlv_packet[5] = 0x80;   /* mandatory AVP */
  84         tlv_packet[6] = EAP_TLV_ACK_RESULT;
  85         tlv_packet[7] = 0;
  86         tlv_packet[8] = 2;      /* length of the data portion */
  87         tlv_packet[9] = 0;
  88         tlv_packet[10] = EAP_TLV_SUCCESS;
  89
  90         (tls_session->record_plus)(&tls_session->clean_in, tlv_packet, 11);
  91
  92         /*
  93          *      FIXME: Check the return code.
  94          */
  95         tls_handshake_send(request, tls_session);
  96
  97         return 1;
  98 }
  99
 100
 101 static int eappeap_identity(EAP_HANDLER *handler, tls_session_t *tls_session)
 102 {
 103         eap_packet_t eap_packet;
 104
 105         eap_packet.code = PW_EAP_REQUEST;
 106         eap_packet.id = handler->eap_ds->response->id + 1;
 107         eap_packet.length[0] = 0;
 108         eap_packet.length[1] = EAP_HEADER_LEN + 1;
 109         eap_packet.data[0] = PW_EAP_IDENTITY;
 110
 111         (tls_session->record_plus)(&tls_session->clean_in,
 112                                   &eap_packet, sizeof(eap_packet));
 113
 114         tls_handshake_send(handler->request, tls_session);
 115         (tls_session->record_init)(&tls_session->clean_in);
 116
 117         return 1;
 118 }
 119
 120
 121 /*
 122  *      Verify the tunneled EAP message.
 123  */
 124 static int eapmessage_verify(REQUEST *request,
 125                              const uint8_t *data, unsigned int data_len)
 126 {
 127         const eap_packet_t *eap_packet = (const eap_packet_t *) data;
 128         uint8_t eap_type;
 129         char buffer[256];
 130
 131         /*
 132          *      No data, OR only 1 byte of EAP type.
 133          */
 134         if (!data || (data_len == 0) ||
 135             ((data_len <= 1) && (data[0] != PW_EAP_IDENTITY))) {
 136                 return 0;
 137         }
 138
 139         eap_type = *data;
 140         switch (eap_type) {
 141         case PW_EAP_IDENTITY:
 142                 if (data_len == 1) {
 143                         RDEBUG2("Identity - ");
 144                         return 1;
 145                 }
 146                 RDEBUG2("Identity - %*s",
 147                        data_len - 1, data + 1);
 148                 return 1;
 149                 break;
 150
 151                 /*
 152                  *      If the first byte of the packet is
 153                  *      EAP-Response, and the EAP data is a TLV,
 154                  *      then it looks OK...
 155                  */
 156         case PW_EAP_RESPONSE:
 157                 if (eap_packet->data[0] == PW_EAP_TLV) {
 158                         RDEBUG2("Received EAP-TLV response.");
 159                         return 1;
 160                 }
 161                 RDEBUG2("Got something weird.");
 162                 break;
 163
 164
 165                 /*
 166                  *      We normally do Microsoft MS-CHAPv2 (26), versus
 167                  *      Cisco MS-CHAPv2 (29).
 168                  */
 169         case PW_EAP_MSCHAPV2:
 170         default:
 171                 RDEBUG2("EAP type %s",
 172                        eaptype_type2name(eap_type,
 173                                          buffer, sizeof(buffer)));
 174                 return 1;
 175                 break;
 176         }
 177
 178         return 0;
 179 }
 180
 181 /*
 182  *      Convert a pseudo-EAP packet to a list of VALUE_PAIR's.
 183  */
 184 static VALUE_PAIR *eap2vp(REQUEST *request, EAP_DS *eap_ds,
 185                           const uint8_t *data, size_t data_len)
 186 {
 187         size_t total;
 188         VALUE_PAIR *vp = NULL, *head, **tail;
 189
 190         if (data_len > 65535) return NULL; /* paranoia */
 191
 192         vp = paircreate(PW_EAP_MESSAGE, 0, PW_TYPE_OCTETS);
 193         if (!vp) {
 194                 RDEBUG2("Failure in creating VP");
 195                 return NULL;
 196         }
 197
 198         total = data_len;
 199         if (total > 249) total = 249;
 200
 201         /*
 202          *      Hand-build an EAP packet from the crap in PEAP version 0.
 203          */
 204         vp->vp_octets[0] = PW_EAP_RESPONSE;
 205         vp->vp_octets[1] = eap_ds->response->id;
 206         vp->vp_octets[2] = (data_len + EAP_HEADER_LEN) >> 8;
 207         vp->vp_octets[3] = (data_len + EAP_HEADER_LEN) & 0xff;
 208
 209         memcpy(vp->vp_octets + EAP_HEADER_LEN, data, total);
 210         vp->length = EAP_HEADER_LEN + total;
 211
 212         head = vp;
 213         tail = &(vp->next);
 214         while (total < data_len) {
 215                 int vp_len;
 216
 217
 218                 vp = paircreate(PW_EAP_MESSAGE, 0, PW_TYPE_OCTETS);
 219                 if (!vp) {
 220                         RDEBUG2("Failure in creating VP");
 221                         pairfree(&head);
 222                         return NULL;
 223                 }
 224                 vp_len = (data_len - total);
 225                 if (vp_len > 253) vp_len = 253;
 226
 227                 memcpy(vp->vp_octets, data + total, vp_len);
 228                 vp->length = vp_len;
 229
 230                 total += vp_len;
 231                 *tail = vp;
 232                 tail = &(vp->next);
 233         }
 234
 235         return head;
 236 }
 237
 238
 239 /*
 240  *      Convert a list of VALUE_PAIR's to an EAP packet, through the
 241  *      simple expedient of dumping the EAP message
 242  */
 243 static int vp2eap(REQUEST *request, tls_session_t *tls_session, VALUE_PAIR *vp)
 244 {
 245         rad_assert(vp != NULL);
 246
 247         /*
 248          *      Skip the id, code, and length.  Just write the EAP
 249          *      type & data to the client.
 250          */
 251 #ifndef NDEBUG
 252         if ((debug_flag > 2) && fr_log_fp) {
 253                 size_t i, total;
 254                 VALUE_PAIR *this;
 255
 256                 total = 0;
 257
 258                 for (this = vp; this != NULL; this = this->next) {
 259                         int start = 0;
 260
 261                         if (this == vp) start = EAP_HEADER_LEN;
 262
 263                         for (i = start; i < vp->length; i++) {
 264                           if ((total & 0x0f) == 0) fprintf(fr_log_fp, "  PEAP tunnel data out %04x: ", (int) total);
 265
 266                                 fprintf(fr_log_fp, "%02x ", vp->vp_octets[i]);
 267
 268                                 if ((total & 0x0f) == 0x0f) fprintf(fr_log_fp, "\n");
 269                                 total++;
 270                         }
 271                 }
 272                 if ((total & 0x0f) != 0) fprintf(fr_log_fp, "\n");
 273         }
 274 #endif
 275
 276         /*
 277          *      Send the EAP data, WITHOUT the header.
 278          */
 279         (tls_session->record_plus)(&tls_session->clean_in,
 280                                    vp->vp_octets + EAP_HEADER_LEN,
 281                                    vp->length - EAP_HEADER_LEN);
 282
 283         /*
 284          *      Send the rest of the EAP data.
 285          */
 286         for (vp = vp->next; vp != NULL; vp = vp->next) {
 287                 (tls_session->record_plus)(&tls_session->clean_in,
 288                                            vp->vp_octets, vp->length);
 289         }
 290
 291         tls_handshake_send(request, tls_session);
 292
 293         return 1;
 294 }
 295
 296
 297 /*
 298  *      See if there's a TLV in the response.
 299  */
 300 static int eappeap_check_tlv(REQUEST *request, const uint8_t *data)
 301 {
 302         const eap_packet_t *eap_packet = (const eap_packet_t *) data;
 303
 304         /*
 305          *      Look for success or failure.
 306          */
 307         if ((eap_packet->code == PW_EAP_RESPONSE) &&
 308             (eap_packet->data[0] == PW_EAP_TLV)) {
 309                 if (data[10] == EAP_TLV_SUCCESS) {
 310                         return 1;
 311                 }
 312
 313                 if (data[10] == EAP_TLV_FAILURE) {
 314                         RDEBUG2("Client rejected our response.  The password is probably incorrect.");
 315                         return 0;
 316                 }
 317         }
 318
 319         return 0;
 320 }
 321
 322
 323 /*
 324  *      Use a reply packet to determine what to do.
 325  */
 326 static int process_reply(EAP_HANDLER *handler, tls_session_t *tls_session,
 327                          REQUEST *request, RADIUS_PACKET *reply)
 328 {
 329         int rcode = RLM_MODULE_REJECT;
 330         VALUE_PAIR *vp;
 331         peap_tunnel_t *t = tls_session->opaque;
 332
 333         if ((debug_flag > 0) && fr_log_fp) {
 334                 RDEBUG("Got tunneled reply RADIUS code %d",
 335                        reply->code);
 336
 337                 debug_pair_list(reply->vps);
 338         }
 339
 340         switch (reply->code) {
 341         case PW_AUTHENTICATION_ACK:
 342                 RDEBUG2("Tunneled authentication was successful.");
 343                 t->status = PEAP_STATUS_SENT_TLV_SUCCESS;
 344                 eappeap_success(handler, tls_session);
 345                 rcode = RLM_MODULE_HANDLED;
 346
 347                 /*
 348                  *      If we've been told to use the attributes from
 349                  *      the reply, then do so.
 350                  *
 351                  *      WARNING: This may leak information about the
 352                  *      tunneled user!
 353                  */
 354                 if (t->use_tunneled_reply) {
 355                         RDEBUG2("Saving tunneled attributes for later");
 356
 357                         /*
 358                          *      Clean up the tunneled reply.
 359                          */
 360                         pairdelete(&reply->vps, PW_PROXY_STATE, 0);
 361                         pairdelete(&reply->vps, PW_EAP_MESSAGE, 0);
 362                         pairdelete(&reply->vps, PW_MESSAGE_AUTHENTICATOR, 0);
 363
 364                         /*
 365                          *      Delete MPPE keys & encryption policy.  We don't
 366                          *      want these here.
 367                          */
 368                         pairdelete(&reply->vps, 7, VENDORPEC_MICROSOFT);
 369                         pairdelete(&reply->vps, 8, VENDORPEC_MICROSOFT);
 370                         pairdelete(&reply->vps, 16, VENDORPEC_MICROSOFT);
 371                         pairdelete(&reply->vps, 17, VENDORPEC_MICROSOFT);
 372
 373                         t->accept_vps = reply->vps;
 374                         reply->vps = NULL;
 375                 }
 376                 break;
 377
 378         case PW_AUTHENTICATION_REJECT:
 379                 RDEBUG2("Tunneled authentication was rejected.");
 380                 t->status = PEAP_STATUS_SENT_TLV_FAILURE;
 381                 eappeap_failure(handler, tls_session);
 382                 rcode = RLM_MODULE_HANDLED;
 383                 break;
 384
 385         case PW_ACCESS_CHALLENGE:
 386                 RDEBUG2("Got tunneled Access-Challenge");
 387
 388                 /*
 389                  *      Keep the State attribute, if necessary.
 390                  *
 391                  *      Get rid of the old State, too.
 392                  */
 393                 pairfree(&t->state);
 394                 pairmove2(&t->state, &(reply->vps), PW_STATE, 0);
 395
 396                 /*
 397                  *      PEAP takes only EAP-Message attributes inside
 398                  *      of the tunnel.  Any Reply-Message in the
 399                  *      Access-Challenge is ignored.
 400                  */
 401                 vp = NULL;
 402                 pairmove2(&vp, &(reply->vps), PW_EAP_MESSAGE, 0);
 403
 404                 /*
 405                  *      Handle EAP-MSCHAP-V2, where Access-Accept's
 406                  *      from the home server may contain MS-CHAP-Success,
 407                  *      which the module turns into challenges, so that
 408                  *      the client may respond to the challenge with
 409                  *      an "ack" packet.
 410                  */
 411                 if (t->home_access_accept && t->use_tunneled_reply) {
 412                         RDEBUG2("Saving tunneled attributes for later");
 413
 414                         /*
 415                          *      Clean up the tunneled reply.
 416                          */
 417                         pairdelete(&reply->vps, PW_PROXY_STATE, 0);
 418                         pairdelete(&reply->vps, PW_MESSAGE_AUTHENTICATOR, 0);
 419
 420                         t->accept_vps = reply->vps;
 421                         reply->vps = NULL;
 422                 }
 423
 424                 /*
 425                  *      Handle the ACK, by tunneling any necessary reply
 426                  *      VP's back to the client.
 427                  */
 428                 if (vp) {
 429                         vp2eap(request, tls_session, vp);
 430                         pairfree(&vp);
 431                 }
 432
 433                 rcode = RLM_MODULE_HANDLED;
 434                 break;
 435
 436         default:
 437                 RDEBUG2("Unknown RADIUS packet type %d: rejecting tunneled user", reply->code);
 438                 rcode = RLM_MODULE_REJECT;
 439                 break;
 440         }
 441
 442         return rcode;
 443 }
 444
 445 #ifdef WITH_PROXY
 446 /*
 447  *      Do post-proxy processing,
 448  */
 449 static int eappeap_postproxy(EAP_HANDLER *handler, void *data)
 450 {
 451         int rcode;
 452         tls_session_t *tls_session = (tls_session_t *) data;
 453         REQUEST *fake, *request = handler->request;
 454
 455         rad_assert(request != NULL);
 456         RDEBUG2("Passing reply from proxy back into the tunnel.");
 457
 458         /*
 459          *      If there was a fake request associated with the proxied
 460          *      request, do more processing of it.
 461          */
 462         fake = (REQUEST *) request_data_get(handler->request,
 463                                             handler->request->proxy,
 464                                             REQUEST_DATA_EAP_MSCHAP_TUNNEL_CALLBACK);
 465
 466         /*
 467          *      Do the callback, if it exists, and if it was a success.
 468          */
 469         if (fake && (handler->request->proxy_reply->code == PW_AUTHENTICATION_ACK)) {
 470                 peap_tunnel_t *t = tls_session->opaque;
 471
 472                 t->home_access_accept = TRUE;
 473
 474                 /*
 475                  *      Terrible hacks.
 476                  */
 477                 rad_assert(fake->packet == NULL);
 478                 fake->packet = request->proxy;
 479                 fake->packet->src_ipaddr = request->packet->src_ipaddr;
 480                 request->proxy = NULL;
 481
 482                 rad_assert(fake->reply == NULL);
 483                 fake->reply = request->proxy_reply;
 484                 request->proxy_reply = NULL;
 485
 486                 if ((debug_flag > 0) && fr_log_fp) {
 487                         fprintf(fr_log_fp, "server %s {\n", fake->server);
 488                 }
 489
 490                 /*
 491                  *      Perform a post-auth stage, which will get the EAP
 492                  *      handler, too...
 493                  */
 494                 fake->options &= ~RAD_REQUEST_OPTION_PROXY_EAP;
 495                 RDEBUG2("Passing reply back for EAP-MS-CHAP-V2");
 496                 module_post_proxy(0, fake);
 497
 498                 /*
 499                  *      FIXME: If rcode returns fail, do something
 500                  *      intelligent...
 501                  */
 502                 rcode = rad_postauth(fake);
 503
 504                 if ((debug_flag > 0) && fr_log_fp) {
 505                         fprintf(fr_log_fp, "} # server %s\n", fake->server);
 506
 507                         RDEBUG("Final reply from tunneled session code %d",
 508                                fake->reply->code);
 509
 510                         debug_pair_list(fake->reply->vps);
 511                 }
 512
 513                 /*
 514                  *      Terrible hacks.
 515                  */
 516                 request->proxy = fake->packet;
 517                 fake->packet = NULL;
 518                 request->proxy_reply = fake->reply;
 519                 fake->reply = NULL;
 520
 521                 /*
 522                  *      And we're done with this request.
 523                  */
 524
 525                 switch (rcode) {
 526                 case RLM_MODULE_FAIL:
 527                         request_free(&fake);
 528                         eaptls_fail(handler, 0);
 529                         return 0;
 530                         break;
 531
 532                 default:  /* Don't Do Anything */
 533                         RDEBUG2("Got reply %d", request->proxy_reply->code);
 534                         break;
 535                 }
 536         }
 537         request_free(&fake);    /* robust if fake == NULL */
 538
 539         /*
 540          *      If there was no EAP-Message in the reply packet, then
 541          *      we know that we're supposed to re-run the "authenticate"
 542          *      stage, in order to get the right kind of handling...
 543          */
 544
 545         /*
 546          *      Process the reply from the home server.
 547          */
 548
 549         rcode = process_reply(handler, tls_session, handler->request,
 550                               handler->request->proxy_reply);
 551
 552         /*
 553          *      The proxy code uses the reply from the home server as
 554          *      the basis for the reply to the NAS.  We don't want that,
 555          *      so we toss it, after we've had our way with it.
 556          */
 557         pairfree(&handler->request->proxy_reply->vps);
 558
 559         switch (rcode) {
 560         case RLM_MODULE_REJECT:
 561                 RDEBUG2("Reply was rejected");
 562                 eaptls_fail(handler, 0);
 563                 return 0;
 564
 565         case RLM_MODULE_HANDLED:
 566                 RDEBUG2("Reply was handled");
 567                 eaptls_request(handler->eap_ds, tls_session);
 568                 return 1;
 569
 570         case RLM_MODULE_OK:
 571                 RDEBUG2("Reply was OK");
 572
 573                 /*
 574                  *      Success: Automatically return MPPE keys.
 575                  */
 576                 return eaptls_success(handler, 0);
 577
 578         default:
 579                 RDEBUG2("Reply was unknown.");
 580                 break;
 581         }
 582
 583         eaptls_fail(handler, 0);
 584         return 0;
 585 }
 586
 587 /*
 588  *      Free a request.
 589  */
 590 static void my_request_free(void *data)
 591 {
 592         REQUEST *request = (REQUEST *)data;
 593
 594         request_free(&request);
 595 }
 596 #endif
 597
 598
 599 static const char *peap_state(peap_tunnel_t *t)
 600 {
 601         switch (t->status) {
 602                 case PEAP_STATUS_TUNNEL_ESTABLISHED:
 603                         return "TUNNEL ESTABLISHED";
 604                 case PEAP_STATUS_INNER_IDENTITY_REQ_SENT:
 605                         return "WAITING FOR INNER IDENTITY";
 606                 case PEAP_STATUS_SENT_TLV_SUCCESS:
 607                         return "send tlv success";
 608                 case PEAP_STATUS_SENT_TLV_FAILURE:
 609                         return "send tlv failure";
 610                 case PEAP_STATUS_PHASE2_INIT:
 611                         return "phase2_init";
 612                 case PEAP_STATUS_PHASE2:
 613                         return "phase2";
 614                 default:
 615                         break;
 616         }
 617         return "?";
 618 }
 619
 620 static void print_tunneled_data(const uint8_t *data, size_t data_len)
 621 {
 622         size_t i;
 623
 624         if ((debug_flag > 2) && fr_log_fp) {
 625                 for (i = 0; i < data_len; i++) {
 626                   if ((i & 0x0f) == 0) fprintf(fr_log_fp, "  PEAP tunnel data in %02x: ", (int) i);
 627
 628                         fprintf(fr_log_fp, "%02x ", data[i]);
 629
 630                         if ((i & 0x0f) == 0x0f) fprintf(fr_log_fp, "\n");
 631                 }
 632                 if ((data_len & 0x0f) != 0) fprintf(fr_log_fp, "\n");
 633         }
 634 }
 635
 636
 637 /*
 638  *      Process the pseudo-EAP contents of the tunneled data.
 639  */
 640 int eappeap_process(EAP_HANDLER *handler, tls_session_t *tls_session)
 641 {
 642         peap_tunnel_t *t = tls_session->opaque;
 643         REQUEST *fake;
 644         VALUE_PAIR *vp;
 645         int rcode = RLM_MODULE_REJECT;
 646         const uint8_t   *data;
 647         unsigned int data_len;
 648
 649         REQUEST *request = handler->request;
 650         EAP_DS *eap_ds = handler->eap_ds;
 651
 652         rad_assert(request != NULL);
 653
 654         /*
 655          *      Just look at the buffer directly, without doing
 656          *      record_minus.  This lets us avoid another data copy.
 657          */
 658         data_len = tls_session->clean_out.used;
 659         tls_session->clean_out.used = 0;
 660         data = tls_session->clean_out.data;
 661
 662         RDEBUG2("Peap state %s", peap_state(t));
 663
 664         if ((t->status != PEAP_STATUS_TUNNEL_ESTABLISHED) &&
 665             !eapmessage_verify(request, data, data_len)) {
 666                 RDEBUG2("FAILED processing PEAP: Tunneled data is invalid.");
 667                 if (debug_flag > 2) print_tunneled_data(data, data_len);
 668                 return RLM_MODULE_REJECT;
 669         }
 670
 671         switch (t->status) {
 672         case PEAP_STATUS_TUNNEL_ESTABLISHED:
 673                 /* FIXME: should be no data in the buffer here, check & assert? */
 674
 675                 if (SSL_session_reused(tls_session->ssl)) {
 676                         RDEBUG2("Skipping Phase2 because of session resumption");
 677                         t->session_resumption_state = PEAP_RESUMPTION_YES;
 678
 679                         /* we're good, send success TLV */
 680                         t->status = PEAP_STATUS_SENT_TLV_SUCCESS;
 681                         eappeap_success(handler, tls_session);
 682
 683                 } else {
 684                         /* send an identity request */
 685                         t->session_resumption_state = PEAP_RESUMPTION_NO;
 686                         t->status = PEAP_STATUS_INNER_IDENTITY_REQ_SENT;
 687                         eappeap_identity(handler, tls_session);
 688                 }
 689                 return RLM_MODULE_HANDLED;
 690
 691         case PEAP_STATUS_INNER_IDENTITY_REQ_SENT:
 692                 /* we're expecting an identity response */
 693                 if (data[0] != PW_EAP_IDENTITY) {
 694                         RDEBUG("Expected EAP-Identity, got something else.");
 695                         return RLM_MODULE_REJECT;
 696                 }
 697
 698                 if (data_len >= sizeof(t->username->vp_strvalue)) {
 699                         RDEBUG("EAP-Identity is too long");
 700                         return RLM_MODULE_REJECT;
 701                 }
 702
 703                 /*
 704                  *      Save it for later.
 705                  */
 706                 t->username = pairmake("User-Name", "", T_OP_EQ);
 707                 rad_assert(t->username != NULL);
 708
 709                 memcpy(t->username->vp_strvalue, data + 1, data_len - 1);
 710                 t->username->length = data_len - 1;
 711                 t->username->vp_strvalue[t->username->length] = 0;
 712                 RDEBUG("Got inner identity '%s'", t->username->vp_strvalue);
 713
 714                 t->status = PEAP_STATUS_PHASE2_INIT;
 715                 break;
 716
 717         /*
 718          *      If we authenticated the user, then it's OK.
 719          */
 720         case PEAP_STATUS_SENT_TLV_SUCCESS:
 721                 if (eappeap_check_tlv(request, data)) {
 722                         RDEBUG2("Success");
 723                         return RLM_MODULE_OK;
 724                 }
 725
 726                 /*
 727                  *      Otherwise, the client rejected the session
 728                  *      resumption.  If the session is being re-used,
 729                  *      we need to do a full authentication.
 730                  *
 731                  *      We do this by sending an EAP-Identity request
 732                  *      inside of the PEAP tunnel.
 733                  */
 734                 if (t->session_resumption_state == PEAP_RESUMPTION_YES) {
 735                         RDEBUG2("Client rejected session resumption.  Re-starting full authentication");
 736
 737                         /*
 738                          *      Mark session resumption status.
 739                          */
 740                         t->status = PEAP_STATUS_INNER_IDENTITY_REQ_SENT;
 741                         t->session_resumption_state = PEAP_RESUMPTION_NO;
 742
 743                         eappeap_identity(handler, tls_session);
 744                         return RLM_MODULE_HANDLED;
 745                 }
 746
 747                 RDEBUG2("We sent a success, but received something weird in return.");
 748                 return RLM_MODULE_REJECT;
 749
 750         /*
 751          *      Damned if I know why the clients continue sending EAP
 752          *      packets after we told them to f*ck off.
 753          */
 754         case PEAP_STATUS_SENT_TLV_FAILURE:
 755                 RDEBUG(" The users session was previously rejected: returning reject (again.)");
 756                 RDEBUG(" *** This means you need to read the PREVIOUS messages in the debug output");
 757                 RDEBUG(" *** to find out the reason why the user was rejected.");
 758                 RDEBUG(" *** Look for \"reject\" or \"fail\".  Those earlier messages will tell you.");
 759                 RDEBUG(" *** what went wrong, and how to fix the problem.");
 760                 return RLM_MODULE_REJECT;
 761
 762                 case PEAP_STATUS_PHASE2_INIT:
 763                         RDEBUG("In state machine in phase2 init?");
 764
 765                 case PEAP_STATUS_PHASE2:
 766                         break;
 767
 768                 default:
 769                         RDEBUG2("Unhandled state in peap");
 770                         return RLM_MODULE_REJECT;
 771         }
 772
 773         fake = request_alloc_fake(request);
 774
 775         rad_assert(fake->packet->vps == NULL);
 776
 777         switch (t->status) {
 778                 /*
 779                  *      If we're in PHASE2_INIT, the phase2 method hasn't been
 780                  *      sent an Identity packet yet; do so from the stored
 781                  *      username and this will kick off the phase2 eap method
 782                  */
 783
 784         case PEAP_STATUS_PHASE2_INIT: {
 785                 int len = t->username->length + EAP_HEADER_LEN + 1;
 786
 787                 t->status = PEAP_STATUS_PHASE2;
 788
 789                 vp = paircreate(PW_EAP_MESSAGE, 0, PW_TYPE_OCTETS);
 790
 791                 vp->vp_octets[0] = PW_EAP_RESPONSE;
 792                 vp->vp_octets[1] = eap_ds->response->id;
 793                 vp->vp_octets[2] = (len >> 8) & 0xff;
 794                 vp->vp_octets[3] = len & 0xff;
 795                 vp->vp_octets[4] = PW_EAP_IDENTITY;
 796
 797                 memcpy(vp->vp_octets + EAP_HEADER_LEN + 1, t->username->vp_strvalue, t->username->length);
 798                 vp->length = len;
 799
 800                 pairadd(&fake->packet->vps, vp);
 801
 802                 if (t->default_eap_type != 0) {
 803                         RDEBUG2("Setting default EAP type for tunneled EAP session.");
 804                         vp = pairmake("EAP-Type", "0", T_OP_EQ);
 805                         vp->vp_integer = t->default_eap_type;
 806                         pairadd(&fake->config_items, vp);
 807                 }
 808                 break; }
 809
 810         case PEAP_STATUS_PHASE2:
 811                 fake->packet->vps = eap2vp(request, eap_ds, data, data_len);
 812                 if (!fake->packet->vps) {
 813                         request_free(&fake);
 814                         RDEBUG2("Unable to convert tunneled EAP packet to internal server data structures");
 815                         return PW_AUTHENTICATION_REJECT;
 816                 }
 817                 break;
 818
 819         default:
 820                 RDEBUG("Invalid state change in PEAP.");
 821                 return PW_AUTHENTICATION_REJECT;
 822         }
 823
 824         if ((debug_flag > 0) && fr_log_fp) {
 825                 RDEBUG("Got tunneled request");
 826
 827                 debug_pair_list(fake->packet->vps);
 828
 829                 fprintf(fr_log_fp, "server %s {\n",
 830                         (fake->server == NULL) ? "" : fake->server);
 831         }
 832
 833         /*
 834          *      Update other items in the REQUEST data structure.
 835          */
 836         if (!t->username) {
 837                 /*
 838                  *      There's no User-Name in the tunneled session,
 839                  *      so we add one here, by pulling it out of the
 840                  *      EAP-Identity packet.
 841                  */
 842                 if ((data[0] == PW_EAP_IDENTITY) && (data_len > 1)) {
 843                         t->username = pairmake("User-Name", "", T_OP_EQ);
 844                         rad_assert(t->username != NULL);
 845
 846                         memcpy(t->username->vp_strvalue, data + 1, data_len - 1);
 847                         t->username->length = data_len - 1;
 848                         t->username->vp_strvalue[t->username->length] = 0;
 849                         DEBUG2("  PEAP: Got tunneled identity of %s", t->username->vp_strvalue);
 850
 851                         /*
 852                          *      If there's a default EAP type,
 853                          *      set it here.
 854                          */
 855                         if (t->default_eap_type != 0) {
 856                                 DEBUG2("  PEAP: Setting default EAP type for tunneled EAP session.");
 857                                 vp = pairmake("EAP-Type", "0", T_OP_EQ);
 858                                 vp->vp_integer = t->default_eap_type;
 859                                 pairadd(&fake->config_items, vp);
 860                         }
 861                 }
 862         } /* else there WAS a t->username */
 863
 864         setup_fake_request(request, fake, t);
 865
 866         if ((vp = pairfind(request->config_items, PW_VIRTUAL_SERVER)) != NULL) {
 867                 fake->server = vp->vp_strvalue;
 868
 869         } else if (t->virtual_server) {
 870                 fake->server = t->virtual_server;
 871
 872         } /* else fake->server == request->server */
 873
 874         if ((debug_flag > 0) && fr_log_fp) {
 875                 fprintf(fr_log_fp, "Sending tunneled request\n");
 876
 877                 debug_pair_list(fake->packet->vps);
 878
 879                 fprintf(fr_log_fp, "server %s {\n",
 880                         (fake->server == NULL) ? "" : fake->server);
 881         }
 882
 883         /*
 884          *      Call authentication recursively, which will
 885          *      do PAP, CHAP, MS-CHAP, etc.
 886          */
 887         rad_authenticate(fake);
 888
 889         /*
 890          *      Note that we don't do *anything* with the reply
 891          *      attributes.
 892          */
 893         if ((debug_flag > 0) && fr_log_fp) {
 894                 fprintf(fr_log_fp, "} # server %s\n",
 895                         (fake->server == NULL) ? "" : fake->server);
 896
 897                 RDEBUG("Got tunneled reply code %d", fake->reply->code);
 898
 899                 debug_pair_list(fake->reply->vps);
 900         }
 901
 902         /*
 903          *      Decide what to do with the reply.
 904          */
 905         switch (fake->reply->code) {
 906         case 0:                 /* No reply code, must be proxied... */
 907 #ifdef WITH_PROXY
 908                 vp = pairfind(fake->config_items, PW_PROXY_TO_REALM, 0);
 909
 910                 if (vp) {
 911                         eap_tunnel_data_t *tunnel;
 912
 913                         /*
 914                          *      The tunneled request was NOT handled,
 915                          *      it has to be proxied.  This means that
 916                          *      the "authenticate" stage was never
 917                          *      performed.
 918                          *
 919                          *      If we are told to NOT proxy the
 920                          *      tunneled request as EAP, then this
 921                          *      means that we've got to decode it,
 922                          *      which means that we MUST run the
 923                          *      "authenticate" portion by hand, here.
 924                          *
 925                          *      Once the tunneled EAP session is ALMOST
 926                          *      done, THEN we proxy it...
 927                          */
 928                         if (!t->proxy_tunneled_request_as_eap) {
 929                                 fake->options |= RAD_REQUEST_OPTION_PROXY_EAP;
 930
 931                                 /*
 932                                  *      Hmm... should we check for
 933                                  *      Auth-Type & EAP-Message here?
 934                                  */
 935
 936
 937                                 /*
 938                                  *      Run the EAP authentication.
 939                                  */
 940                                 DEBUG2("  PEAP: Calling authenticate in order to initiate tunneled EAP session.");
 941                                 rcode = module_authenticate(PW_AUTHTYPE_EAP, fake);
 942                                 if (rcode == RLM_MODULE_OK) {
 943                                         /*
 944                                          *      Authentication succeeded! Rah!
 945                                          */
 946                                         fake->reply->code = PW_AUTHENTICATION_ACK;
 947                                         goto do_process;
 948                                 }
 949
 950                                 if (rcode != RLM_MODULE_HANDLED) {
 951                                         DEBUG2("  PEAP: Can't handle the return code %d", rcode);
 952                                         rcode = RLM_MODULE_REJECT;
 953                                         goto done;
 954                                 }
 955
 956                                 /*
 957                                  *      The module decided it wasn't
 958                                  *      done.  Handle it like normal.
 959                                  */
 960                                 if ((fake->options & RAD_REQUEST_OPTION_PROXY_EAP) == 0) {
 961                                         DEBUG2("    PEAP: Cancelling proxy to realm %s until the tunneled EAP session has been established", vp->vp_strvalue);
 962                                         goto do_process;
 963                                 }
 964
 965                                 /*
 966                                  *      The module has decoded the
 967                                  *      EAP-Message into another set
 968                                  *      of attributes.
 969                                  */
 970                                 pairdelete(&fake->packet->vps,
 971                                            PW_EAP_MESSAGE, 0);
 972                         }
 973
 974                         DEBUG2("  PEAP: Tunneled authentication will be proxied to %s", vp->vp_strvalue);
 975
 976                         /*
 977                          *      Tell the original request that it's going
 978                          *      to be proxied.
 979                          */
 980                         pairmove2(&(request->config_items),
 981                                   &(fake->config_items),
 982                                   PW_PROXY_TO_REALM, 0);
 983
 984                         /*
 985                          *      Seed the proxy packet with the
 986                          *      tunneled request.
 987                          */
 988                         rad_assert(request->proxy == NULL);
 989                         request->proxy = fake->packet;
 990                         memset(&request->proxy->src_ipaddr, 0,
 991                                sizeof(request->proxy->src_ipaddr));
 992                         memset(&request->proxy->src_ipaddr, 0,
 993                                sizeof(request->proxy->src_ipaddr));
 994                         request->proxy->src_port = 0;
 995                         request->proxy->dst_port = 0;
 996                         fake->packet = NULL;
 997                         rad_free(&fake->reply);
 998                         fake->reply = NULL;
 999
1000                         /*
1001                          *      Set up the callbacks for the tunnel
1002                          */
1003                         tunnel = rad_malloc(sizeof(*tunnel));
1004                         memset(tunnel, 0, sizeof(*tunnel));
1005
1006                         tunnel->tls_session = tls_session;
1007                         tunnel->callback = eappeap_postproxy;
1008
1009                         /*
1010                          *      Associate the callback with the request.
1011                          */
1012                         rcode = request_data_add(request,
1013                                                  request->proxy,
1014                                                  REQUEST_DATA_EAP_TUNNEL_CALLBACK,
1015                                                  tunnel, free);
1016                         rad_assert(rcode == 0);
1017
1018                         /*
1019                          *      We're not proxying it as EAP, so we've got
1020                          *      to do the callback later.
1021                          */
1022                         if ((fake->options & RAD_REQUEST_OPTION_PROXY_EAP) != 0) {
1023                                 DEBUG2("  PEAP: Remembering to do EAP-MS-CHAP-V2 post-proxy.");
1024
1025                                 /*
1026                                  *      rlm_eap.c has taken care of associating
1027                                  *      the handler with the fake request.
1028                                  *
1029                                  *      So we associate the fake request with
1030                                  *      this request.
1031                                  */
1032                                 rcode = request_data_add(request,
1033                                                          request->proxy,
1034                                                          REQUEST_DATA_EAP_MSCHAP_TUNNEL_CALLBACK,
1035                                                          fake, my_request_free);
1036                                 rad_assert(rcode == 0);
1037
1038                                 /*
1039                                  *      Do NOT free the fake request!
1040                                  */
1041                                 return RLM_MODULE_UPDATED;
1042                         }
1043
1044                         /*
1045                          *      Didn't authenticate the packet, but
1046                          *      we're proxying it.
1047                          */
1048                         rcode = RLM_MODULE_UPDATED;
1049
1050                 } else
1051 #endif  /* WITH_PROXY */
1052                   {
1053                         DEBUG2("  PEAP: Unknown RADIUS packet type %d: rejecting tunneled user", fake->reply->code);
1054                         rcode = RLM_MODULE_REJECT;
1055                   }
1056                 break;
1057
1058         default:
1059         do_process:
1060                 rcode = process_reply(handler, tls_session, request,
1061                                       fake->reply);
1062                 break;
1063         }
1064
1065  done:
1066         request_free(&fake);
1067
1068         return rcode;
1069 }
1070
1071 static int setup_fake_request(REQUEST *request, REQUEST *fake, peap_tunnel_t *t) {
1072
1073         VALUE_PAIR *vp;
1074         /*
1075          *      Tell the request that it's a fake one.
1076          */
1077         vp = pairmake("Freeradius-Proxied-To", "127.0.0.1", T_OP_EQ);
1078         if (vp) {
1079                 pairadd(&fake->packet->vps, vp);
1080         }
1081
1082         if (t->username) {
1083                 vp = paircopy(t->username);
1084                 pairadd(&fake->packet->vps, vp);
1085                 fake->username = pairfind(fake->packet->vps, PW_USER_NAME, 0);
1086                 RDEBUG2("Setting User-Name to %s", fake->username->vp_strvalue);
1087         } else {
1088                 RDEBUG2("No tunnel username (SSL resumption?)");
1089         }
1090
1091
1092         /*
1093          *      Add the State attribute, too, if it exists.
1094          */
1095         if (t->state) {
1096                 vp = paircopy(t->state);
1097                 if (vp) pairadd(&fake->packet->vps, vp);
1098         }
1099
1100         /*
1101          *      If this is set, we copy SOME of the request attributes
1102          *      from outside of the tunnel to inside of the tunnel.
1103          *
1104          *      We copy ONLY those attributes which do NOT already
1105          *      exist in the tunneled request.
1106          *
1107          *      This code is copied from ../rlm_eap_ttls/ttls.c
1108          */
1109         if (t->copy_request_to_tunnel) {
1110                 VALUE_PAIR *copy;
1111
1112                 for (vp = request->packet->vps; vp != NULL; vp = vp->next) {
1113                         /*
1114                          *      The attribute is a server-side thingy,
1115                          *      don't copy it.
1116                          */
1117                         if ((vp->attribute > 255) &&
1118                             (((vp->attribute >> 16) & 0xffff) == 0)) {
1119                                 continue;
1120                         }
1121
1122                         /*
1123                          *      The outside attribute is already in the
1124                          *      tunnel, don't copy it.
1125                          *
1126                          *      This works for BOTH attributes which
1127                          *      are originally in the tunneled request,
1128                          *      AND attributes which are copied there
1129                          *      from below.
1130                          */
1131                         if (pairfind(fake->packet->vps, vp->attribute, vp->vendor)) {
1132                                 continue;
1133                         }
1134
1135                         /*
1136                          *      Some attributes are handled specially.
1137                          */
1138                         switch (vp->attribute) {
1139                                 /*
1140                                  *      NEVER copy Message-Authenticator,
1141                                  *      EAP-Message, or State.  They're
1142                                  *      only for outside of the tunnel.
1143                                  */
1144                         case PW_USER_NAME:
1145                         case PW_USER_PASSWORD:
1146                         case PW_CHAP_PASSWORD:
1147                         case PW_CHAP_CHALLENGE:
1148                         case PW_PROXY_STATE:
1149                         case PW_MESSAGE_AUTHENTICATOR:
1150                         case PW_EAP_MESSAGE:
1151                         case PW_STATE:
1152                                 continue;
1153                                 break;
1154
1155                                 /*
1156                                  *      By default, copy it over.
1157                                  */
1158                         default:
1159                                 break;
1160                         }
1161
1162                         /*
1163                          *      Don't copy from the head, we've already
1164                          *      checked it.
1165                          */
1166                         copy = paircopy2(vp, vp->attribute);
1167                         pairadd(&fake->packet->vps, copy);
1168                 }
1169         }
1170
1171         return 0;
1172 }