src/modules/rlm_eap/types/rlm_eap_peap/peap.c

   1 /*
   2  * peap.c contains the interfaces that are called from eap
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  *   Copyright 2003 Alan DeKok <aland@freeradius.org>
  21  *   Copyright 2006 The FreeRADIUS server project
  22  */
  23
  24 #include <freeradius-devel/ident.h>
  25 RCSID("$Id$")
  26
  27 #include "eap_peap.h"
  28
  29 /*
  30  *      Send protected EAP-Failure
  31  *
  32  *       Result-TLV = Failure
  33  */
  34 static int eappeap_failure(EAP_HANDLER *handler, tls_session_t *tls_session)
  35 {
  36         uint8_t tlv_packet[11];
  37         REQUEST *request = handler->request;
  38
  39         RDEBUG2("FAILURE");
  40
  41         tlv_packet[0] = PW_EAP_REQUEST;
  42         tlv_packet[1] = handler->eap_ds->response->id +1;
  43         tlv_packet[2] = 0;
  44         tlv_packet[3] = 11;     /* length of this packet */
  45         tlv_packet[4] = PW_EAP_TLV;
  46         tlv_packet[5] = 0x80;
  47         tlv_packet[6] = EAP_TLV_ACK_RESULT;
  48         tlv_packet[7] = 0;
  49         tlv_packet[8] = 2;      /* length of the data portion */
  50         tlv_packet[9] = 0;
  51         tlv_packet[10] = EAP_TLV_FAILURE;
  52
  53         (tls_session->record_plus)(&tls_session->clean_in, tlv_packet, 11);
  54
  55         /*
  56          *      FIXME: Check the return code.
  57          */
  58         tls_handshake_send(tls_session);
  59
  60         return 1;
  61 }
  62
  63
  64 /*
  65  *      Send protected EAP-Success
  66  *
  67  *       Result-TLV = Success
  68  */
  69 static int eappeap_success(EAP_HANDLER *handler, tls_session_t *tls_session)
  70 {
  71         uint8_t tlv_packet[11];
  72         REQUEST *request = handler->request;
  73
  74         RDEBUG2("SUCCESS");
  75
  76         tlv_packet[0] = PW_EAP_REQUEST;
  77         tlv_packet[1] = handler->eap_ds->response->id +1;
  78         tlv_packet[2] = 0;
  79         tlv_packet[3] = 11;     /* length of this packet */
  80         tlv_packet[4] = PW_EAP_TLV;
  81         tlv_packet[5] = 0x80;   /* mandatory AVP */
  82         tlv_packet[6] = EAP_TLV_ACK_RESULT;
  83         tlv_packet[7] = 0;
  84         tlv_packet[8] = 2;      /* length of the data portion */
  85         tlv_packet[9] = 0;
  86         tlv_packet[10] = EAP_TLV_SUCCESS;
  87
  88         (tls_session->record_plus)(&tls_session->clean_in, tlv_packet, 11);
  89
  90         /*
  91          *      FIXME: Check the return code.
  92          */
  93         tls_handshake_send(tls_session);
  94
  95         return 1;
  96 }
  97
  98
  99 /*
 100  *      Verify the tunneled EAP message.
 101  */
 102 static int eapmessage_verify(REQUEST *request,
 103                              const uint8_t *data, unsigned int data_len)
 104 {
 105         const eap_packet_t *eap_packet = (const eap_packet_t *) data;
 106         uint8_t eap_type;
 107         char buffer[256];
 108
 109         /*
 110          *      No data, OR only 1 byte of EAP type.
 111          */
 112         if (!data || (data_len == 0) ||
 113             ((data_len <= 1) && (data[0] != PW_EAP_IDENTITY))) {
 114                 return 0;
 115         }
 116
 117         eap_type = *data;
 118         switch (eap_type) {
 119         case PW_EAP_IDENTITY:
 120                 if (data_len == 1) {
 121                         RDEBUG2("Identity - ");
 122                         return 1;
 123                 }
 124                 RDEBUG2("Identity - %*s",
 125                        data_len - 1, data + 1);
 126                 return 1;
 127                 break;
 128
 129                 /*
 130                  *      If the first byte of the packet is
 131                  *      EAP-Response, and the EAP data is a TLV,
 132                  *      then it looks OK...
 133                  */
 134         case PW_EAP_RESPONSE:
 135                 if (eap_packet->data[0] == PW_EAP_TLV) {
 136                         RDEBUG2("Received EAP-TLV response.");
 137                         return 1;
 138                 }
 139                 RDEBUG2("Got something weird.");
 140                 break;
 141
 142
 143                 /*
 144                  *      We normally do Microsoft MS-CHAPv2 (26), versus
 145                  *      Cisco MS-CHAPv2 (29).
 146                  */
 147         case PW_EAP_MSCHAPV2:
 148         default:
 149                 RDEBUG2("EAP type %s",
 150                        eaptype_type2name(eap_type,
 151                                          buffer, sizeof(buffer)));
 152                 return 1;
 153                 break;
 154         }
 155
 156         return 0;
 157 }
 158
 159 /*
 160  *      Convert a pseudo-EAP packet to a list of VALUE_PAIR's.
 161  */
 162 static VALUE_PAIR *eap2vp(REQUEST *request, EAP_DS *eap_ds,
 163                           const uint8_t *data, size_t data_len)
 164 {
 165         size_t total;
 166         VALUE_PAIR *vp = NULL, *head, **tail;
 167
 168         if (data_len > 65535) return NULL; /* paranoia */
 169
 170         vp = paircreate(PW_EAP_MESSAGE, 0, PW_TYPE_OCTETS);
 171         if (!vp) {
 172                 RDEBUG2("Failure in creating VP");
 173                 return NULL;
 174         }
 175
 176         total = data_len;
 177         if (total > 249) total = 249;
 178
 179         /*
 180          *      Hand-build an EAP packet from the crap in PEAP version 0.
 181          */
 182         vp->vp_octets[0] = PW_EAP_RESPONSE;
 183         vp->vp_octets[1] = eap_ds->response->id;
 184         vp->vp_octets[2] = (data_len + EAP_HEADER_LEN) >> 8;
 185         vp->vp_octets[3] = (data_len + EAP_HEADER_LEN) & 0xff;
 186
 187         memcpy(vp->vp_octets + EAP_HEADER_LEN, data, total);
 188         vp->length = EAP_HEADER_LEN + total;
 189
 190         head = vp;
 191         tail = &(vp->next);
 192         while (total < data_len) {
 193                 int vp_len;
 194
 195
 196                 vp = paircreate(PW_EAP_MESSAGE, 0, PW_TYPE_OCTETS);
 197                 if (!vp) {
 198                         RDEBUG2("Failure in creating VP");
 199                         pairfree(&head);
 200                         return NULL;
 201                 }
 202                 vp_len = (data_len - total);
 203                 if (vp_len > 253) vp_len = 253;
 204
 205                 memcpy(vp->vp_octets, data + total, vp_len);
 206                 vp->length = vp_len;
 207
 208                 total += vp_len;
 209                 *tail = vp;
 210                 tail = &(vp->next);
 211         }
 212
 213         return head;
 214 }
 215
 216
 217 /*
 218  *      Convert a list of VALUE_PAIR's to an EAP packet, through the
 219  *      simple expedient of dumping the EAP message
 220  */
 221 static int vp2eap(tls_session_t *tls_session, VALUE_PAIR *vp)
 222 {
 223         /*
 224          *      Skip the id, code, and length.  Just write the EAP
 225          *      type & data to the client.
 226          */
 227 #ifndef NDEBUG
 228         if ((debug_flag > 2) && fr_log_fp) {
 229                 size_t i, total;
 230                 VALUE_PAIR *this;
 231
 232                 total = 0;
 233
 234                 for (this = vp; this != NULL; this = this->next) {
 235                         int start = 0;
 236
 237                         if (this == vp) start = EAP_HEADER_LEN;
 238
 239                         for (i = start; i < vp->length; i++) {
 240                           if ((total & 0x0f) == 0) fprintf(fr_log_fp, "  PEAP tunnel data out %04x: ", (int) total);
 241
 242                                 fprintf(fr_log_fp, "%02x ", vp->vp_octets[i]);
 243
 244                                 if ((total & 0x0f) == 0x0f) fprintf(fr_log_fp, "\n");
 245                                 total++;
 246                         }
 247                 }
 248                 if ((total & 0x0f) != 0) fprintf(fr_log_fp, "\n");
 249         }
 250 #endif
 251
 252         /*
 253          *      Send the EAP data, WITHOUT the header.
 254          */
 255         (tls_session->record_plus)(&tls_session->clean_in,
 256                                    vp->vp_octets + EAP_HEADER_LEN,
 257                                    vp->length - EAP_HEADER_LEN);
 258
 259         /*
 260          *      Send the rest of the EAP data.
 261          */
 262         for (vp = vp->next; vp != NULL; vp = vp->next) {
 263                 (tls_session->record_plus)(&tls_session->clean_in,
 264                                            vp->vp_octets, vp->length);
 265         }
 266
 267         tls_handshake_send(tls_session);
 268
 269         return 1;
 270 }
 271
 272
 273 /*
 274  *      See if there's a TLV in the response.
 275  */
 276 static int eappeap_check_tlv(REQUEST *request, const uint8_t *data)
 277 {
 278         const eap_packet_t *eap_packet = (const eap_packet_t *) data;
 279
 280         /*
 281          *      Look for success or failure.
 282          */
 283         if ((eap_packet->code == PW_EAP_RESPONSE) &&
 284             (eap_packet->data[0] == PW_EAP_TLV)) {
 285                 if (data[10] == EAP_TLV_SUCCESS) {
 286                         return 1;
 287                 }
 288
 289                 if (data[10] == EAP_TLV_FAILURE) {
 290                         RDEBUG2("Client rejected our response.  The password is probably incorrect.");
 291                         return 0;
 292                 }
 293         }
 294
 295         return 0;
 296 }
 297
 298
 299 /*
 300  *      Use a reply packet to determine what to do.
 301  */
 302 static int process_reply(EAP_HANDLER *handler, tls_session_t *tls_session,
 303                          REQUEST *request, RADIUS_PACKET *reply)
 304 {
 305         int rcode = RLM_MODULE_REJECT;
 306         VALUE_PAIR *vp;
 307         peap_tunnel_t *t = tls_session->opaque;
 308
 309         if ((debug_flag > 0) && fr_log_fp) {
 310                 RDEBUG("Got tunneled reply RADIUS code %d",
 311                        reply->code);
 312
 313                 debug_pair_list(reply->vps);
 314         }
 315
 316         switch (reply->code) {
 317         case PW_AUTHENTICATION_ACK:
 318                 RDEBUG2("Tunneled authentication was successful.");
 319                 t->status = PEAP_STATUS_SENT_TLV_SUCCESS;
 320                 eappeap_success(handler, tls_session);
 321                 rcode = RLM_MODULE_HANDLED;
 322
 323                 /*
 324                  *      If we've been told to use the attributes from
 325                  *      the reply, then do so.
 326                  *
 327                  *      WARNING: This may leak information about the
 328                  *      tunneled user!
 329                  */
 330                 if (t->use_tunneled_reply) {
 331                         RDEBUG2("Saving tunneled attributes for later");
 332
 333                         /*
 334                          *      Clean up the tunneled reply.
 335                          */
 336                         pairdelete(&reply->vps, PW_PROXY_STATE, 0);
 337                         pairdelete(&reply->vps, PW_EAP_MESSAGE, 0);
 338                         pairdelete(&reply->vps, PW_MESSAGE_AUTHENTICATOR, 0);
 339
 340                         t->accept_vps = reply->vps;
 341                         reply->vps = NULL;
 342                 }
 343                 break;
 344
 345         case PW_AUTHENTICATION_REJECT:
 346                 RDEBUG2("Tunneled authentication was rejected.");
 347                 t->status = PEAP_STATUS_SENT_TLV_FAILURE;
 348                 eappeap_failure(handler, tls_session);
 349                 rcode = RLM_MODULE_HANDLED;
 350                 break;
 351
 352         case PW_ACCESS_CHALLENGE:
 353                 RDEBUG2("Got tunneled Access-Challenge");
 354
 355                 /*
 356                  *      Keep the State attribute, if necessary.
 357                  *
 358                  *      Get rid of the old State, too.
 359                  */
 360                 pairfree(&t->state);
 361                 pairmove2(&t->state, &(reply->vps), PW_STATE, 0);
 362
 363                 /*
 364                  *      PEAP takes only EAP-Message attributes inside
 365                  *      of the tunnel.  Any Reply-Message in the
 366                  *      Access-Challenge is ignored.
 367                  */
 368                 vp = NULL;
 369                 pairmove2(&vp, &(reply->vps), PW_EAP_MESSAGE, 0);
 370
 371                 /*
 372                  *      Handle EAP-MSCHAP-V2, where Access-Accept's
 373                  *      from the home server may contain MS-CHAP-Success,
 374                  *      which the module turns into challenges, so that
 375                  *      the client may respond to the challenge with
 376                  *      an "ack" packet.
 377                  */
 378                 if (t->home_access_accept && t->use_tunneled_reply) {
 379                         RDEBUG2("Saving tunneled attributes for later");
 380
 381                         /*
 382                          *      Clean up the tunneled reply.
 383                          */
 384                         pairdelete(&reply->vps, PW_PROXY_STATE, 0);
 385                         pairdelete(&reply->vps, PW_MESSAGE_AUTHENTICATOR, 0);
 386
 387                         t->accept_vps = reply->vps;
 388                         reply->vps = NULL;
 389                 }
 390
 391                 /*
 392                  *      Handle the ACK, by tunneling any necessary reply
 393                  *      VP's back to the client.
 394                  */
 395                 if (vp) {
 396                         vp2eap(tls_session, vp);
 397                         pairfree(&vp);
 398                 }
 399
 400                 rcode = RLM_MODULE_HANDLED;
 401                 break;
 402
 403         default:
 404                 RDEBUG2("Unknown RADIUS packet type %d: rejecting tunneled user", reply->code);
 405                 rcode = RLM_MODULE_REJECT;
 406                 break;
 407         }
 408
 409         return rcode;
 410 }
 411
 412 #ifdef WITH_PROXY
 413 /*
 414  *      Do post-proxy processing,
 415  */
 416 static int eappeap_postproxy(EAP_HANDLER *handler, void *data)
 417 {
 418         int rcode;
 419         tls_session_t *tls_session = (tls_session_t *) data;
 420         REQUEST *fake, *request = handler->request;
 421
 422         RDEBUG2("Passing reply from proxy back into the tunnel.");
 423
 424         /*
 425          *      If there was a fake request associated with the proxied
 426          *      request, do more processing of it.
 427          */
 428         fake = (REQUEST *) request_data_get(handler->request,
 429                                             handler->request->proxy,
 430                                             REQUEST_DATA_EAP_MSCHAP_TUNNEL_CALLBACK);
 431
 432         /*
 433          *      Do the callback, if it exists, and if it was a success.
 434          */
 435         if (fake && (handler->request->proxy_reply->code == PW_AUTHENTICATION_ACK)) {
 436                 peap_tunnel_t *t = tls_session->opaque;
 437
 438                 t->home_access_accept = TRUE;
 439
 440                 /*
 441                  *      Terrible hacks.
 442                  */
 443                 rad_assert(fake->packet == NULL);
 444                 fake->packet = request->proxy;
 445                 fake->packet->src_ipaddr = request->packet->src_ipaddr;
 446                 request->proxy = NULL;
 447
 448                 rad_assert(fake->reply == NULL);
 449                 fake->reply = request->proxy_reply;
 450                 request->proxy_reply = NULL;
 451
 452                 if ((debug_flag > 0) && fr_log_fp) {
 453                         fprintf(fr_log_fp, "server %s {\n", fake->server);
 454                 }
 455
 456                 /*
 457                  *      Perform a post-auth stage, which will get the EAP
 458                  *      handler, too...
 459                  */
 460                 fake->options &= ~RAD_REQUEST_OPTION_PROXY_EAP;
 461                 RDEBUG2("Passing reply back for EAP-MS-CHAP-V2");
 462                 rcode = module_post_proxy(0, fake);
 463
 464                 /*
 465                  *      FIXME: If rcode returns fail, do something
 466                  *      intelligent...
 467                  */
 468                 rcode = rad_postauth(fake);
 469
 470                 if ((debug_flag > 0) && fr_log_fp) {
 471                         fprintf(fr_log_fp, "} # server %s\n", fake->server);
 472
 473                         RDEBUG("Final reply from tunneled session code %d",
 474                                fake->reply->code);
 475
 476                         debug_pair_list(fake->reply->vps);
 477                 }
 478
 479                 /*
 480                  *      Terrible hacks.
 481                  */
 482                 request->proxy = fake->packet;
 483                 fake->packet = NULL;
 484                 request->proxy_reply = fake->reply;
 485                 fake->reply = NULL;
 486
 487                 /*
 488                  *      And we're done with this request.
 489                  */
 490
 491                 switch (rcode) {
 492                 case RLM_MODULE_FAIL:
 493                         request_free(&fake);
 494                         eaptls_fail(handler, 0);
 495                         return 0;
 496                         break;
 497
 498                 default:  /* Don't Do Anything */
 499                         RDEBUG2("Got reply %d", request->proxy_reply->code);
 500                         break;
 501                 }
 502         }
 503         request_free(&fake);    /* robust if fake == NULL */
 504
 505         /*
 506          *      If there was no EAP-Message in the reply packet, then
 507          *      we know that we're supposed to re-run the "authenticate"
 508          *      stage, in order to get the right kind of handling...
 509          */
 510
 511         /*
 512          *      Process the reply from the home server.
 513          */
 514
 515         rcode = process_reply(handler, tls_session, handler->request,
 516                               handler->request->proxy_reply);
 517
 518         /*
 519          *      The proxy code uses the reply from the home server as
 520          *      the basis for the reply to the NAS.  We don't want that,
 521          *      so we toss it, after we've had our way with it.
 522          */
 523         pairfree(&handler->request->proxy_reply->vps);
 524
 525         switch (rcode) {
 526         case RLM_MODULE_REJECT:
 527                 RDEBUG2("Reply was rejected");
 528                 eaptls_fail(handler, 0);
 529                 return 0;
 530
 531         case RLM_MODULE_HANDLED:
 532                 RDEBUG2("Reply was handled");
 533                 eaptls_request(handler->eap_ds, tls_session);
 534                 return 1;
 535
 536         case RLM_MODULE_OK:
 537                 RDEBUG2("Reply was OK");
 538
 539                 /*
 540                  *      Success: Automatically return MPPE keys.
 541                  */
 542                 return eaptls_success(handler, 0);
 543
 544         default:
 545                 RDEBUG2("Reply was unknown.");
 546                 break;
 547         }
 548
 549         eaptls_fail(handler, 0);
 550         return 0;
 551 }
 552
 553 /*
 554  *      Free a request.
 555  */
 556 static void my_request_free(void *data)
 557 {
 558         REQUEST *request = (REQUEST *)data;
 559
 560         request_free(&request);
 561 }
 562 #endif
 563
 564
 565 static void print_tunneled_data(uint8_t *data, size_t data_len)
 566 {
 567         size_t i;
 568
 569         if ((debug_flag > 2) && fr_log_fp) {
 570                 for (i = 0; i < data_len; i++) {
 571                         if ((i & 0x0f) == 0) fprintf(fr_log_fp, "  PEAP tunnel data in %04x: ", i);
 572
 573                         fprintf(fr_log_fp, "%02x ", data[i]);
 574
 575                         if ((i & 0x0f) == 0x0f) fprintf(fr_log_fp, "\n");
 576                 }
 577                 if ((data_len & 0x0f) != 0) fprintf(fr_log_fp, "\n");
 578         }
 579 }
 580
 581
 582 /*
 583  *      Process the pseudo-EAP contents of the tunneled data.
 584  */
 585 int eappeap_process(EAP_HANDLER *handler, tls_session_t *tls_session)
 586 {
 587         peap_tunnel_t *t = tls_session->opaque;
 588         REQUEST *fake;
 589         VALUE_PAIR *vp;
 590         int rcode = RLM_MODULE_REJECT;
 591         const uint8_t   *data;
 592         unsigned int data_len;
 593
 594         REQUEST *request = handler->request;
 595         EAP_DS *eap_ds = handler->eap_ds;
 596
 597         /*
 598          *      Just look at the buffer directly, without doing
 599          *      record_minus.  This lets us avoid another data copy.
 600          */
 601         data_len = tls_session->clean_out.used;
 602         tls_session->clean_out.used = 0;
 603         data = tls_session->clean_out.data;
 604
 605         if (!eapmessage_verify(request, data, data_len)) {
 606                 RDEBUG2("FAILED processing PEAP: Tunneled data is invalid.");
 607                 if (debug_flag > 2) print_tunneled_data(data, data_len);
 608                 return RLM_MODULE_REJECT;
 609         }
 610
 611         /*
 612          *      If we authenticated the user, then it's OK.
 613          */
 614         if (t->status == PEAP_STATUS_SENT_TLV_SUCCESS) {
 615                 if (eappeap_check_tlv(request, data)) {
 616                         RDEBUG2("Success");
 617                         return RLM_MODULE_OK;
 618                 }
 619
 620                 /*
 621                  *      Otherwise, the client rejected the session
 622                  *      resumption.  If the session is being re-used,
 623                  *      we need to do a full authentication.
 624                  *
 625                  *      We do this by sending an EAP-Identity request
 626                  *      inside of the PEAP tunnel.
 627                  */
 628                 if ((t->session_resumption_state != PEAP_RESUMPTION_NO) &&
 629                     SSL_session_reused(tls_session->ssl)) {
 630                         eap_packet_t eap_packet;
 631
 632                         RDEBUG2("Client rejected session resumption.  Re-starting full authentication");
 633                         eap_packet.code = PW_EAP_REQUEST;
 634                         eap_packet.id = handler->eap_ds->response->id + 1;
 635                         eap_packet.length[0] = 0;
 636                         eap_packet.length[1] = EAP_HEADER_LEN + 1;
 637                         eap_packet.data[0] = PW_EAP_IDENTITY;
 638
 639                         /*
 640                          *      Mark session resumption status.
 641                          */
 642                         t->status = 0;
 643                         t->session_resumption_state = PEAP_RESUMPTION_NO;
 644
 645                         (tls_session->record_plus)(&tls_session->clean_in,
 646                                                    &eap_packet,
 647                                                    sizeof(eap_packet));
 648                         tls_handshake_send(tls_session);
 649                         return RLM_MODULE_HANDLED;
 650                 }
 651
 652                 return RLM_MODULE_REJECT;
 653
 654         }
 655
 656         /*
 657          *      Damned if I know why the clients continue sending EAP
 658          *      packets after we told them to f*ck off.
 659          */
 660         if (t->status == PEAP_STATUS_SENT_TLV_FAILURE) {
 661                 RDEBUG(" The users session was previously rejected: returning reject (again.)");
 662                 RDEBUG(" *** This means you need to read the PREVIOUS messages in the debug output");
 663                 RDEBUG(" *** to find out the reason why the user was rejected.");
 664                 RDEBUG(" *** Look for \"reject\" or \"fail\".  Those earlier messages will tell you.");
 665                 RDEBUG(" *** what went wrong, and how to fix the problem.");
 666                 return RLM_MODULE_REJECT;
 667         }
 668
 669         fake = request_alloc_fake(request);
 670
 671         rad_assert(fake->packet->vps == NULL);
 672
 673         fake->packet->vps = eap2vp(request, eap_ds, data, data_len);
 674         if (!fake->packet->vps) {
 675                 request_free(&fake);
 676                 RDEBUG2("Unable to convert tunneled EAP packet to internal server data structures");
 677                 return PW_AUTHENTICATION_REJECT;
 678         }
 679
 680         if ((debug_flag > 0) && fr_log_fp) {
 681                 RDEBUG("Got tunneled request");
 682
 683                 debug_pair_list(fake->packet->vps);
 684
 685                 fprintf(fr_log_fp, "server %s {\n",
 686                         (fake->server == NULL) ? "" : fake->server);
 687         }
 688
 689         /*
 690          *      Tell the request that it's a fake one.
 691          */
 692         vp = pairmake("Freeradius-Proxied-To", "127.0.0.1", T_OP_EQ);
 693         if (vp) {
 694                 pairadd(&fake->packet->vps, vp);
 695         }
 696
 697         /*
 698          *      Update other items in the REQUEST data structure.
 699          */
 700         if (!t->username) {
 701                 /*
 702                  *      There's no User-Name in the tunneled session,
 703                  *      so we add one here, by pulling it out of the
 704                  *      EAP-Identity packet.
 705                  */
 706                 if ((data[0] == PW_EAP_IDENTITY) && (data_len > 1)) {
 707                         t->username = pairmake("User-Name", "", T_OP_EQ);
 708                         rad_assert(t->username != NULL);
 709
 710                         memcpy(t->username->vp_strvalue, data + 1, data_len - 1);
 711                         t->username->length = data_len - 1;
 712                         t->username->vp_strvalue[t->username->length] = 0;
 713                         DEBUG2("  PEAP: Got tunneled identity of %s", t->username->vp_strvalue);
 714
 715                         /*
 716                          *      If there's a default EAP type,
 717                          *      set it here.
 718                          */
 719                         if (t->default_eap_type != 0) {
 720                                 DEBUG2("  PEAP: Setting default EAP type for tunneled EAP session.");
 721                                 vp = pairmake("EAP-Type", "0", T_OP_EQ);
 722                                 vp->vp_integer = t->default_eap_type;
 723                                 pairadd(&fake->config_items, vp);
 724                         }
 725                 }
 726         } /* else there WAS a t->username */
 727
 728         if (t->username) {
 729                 vp = paircopy(t->username);
 730                 pairadd(&fake->packet->vps, vp);
 731                 fake->username = pairfind(fake->packet->vps, PW_USER_NAME, 0);
 732                 DEBUG2("  PEAP: Setting User-Name to %s",
 733                        fake->username->vp_strvalue);
 734         }
 735
 736         /*
 737          *      Add the State attribute, too, if it exists.
 738          */
 739         if (t->state) {
 740                 vp = paircopy(t->state);
 741                 if (vp) pairadd(&fake->packet->vps, vp);
 742         }
 743
 744         /*
 745          *      If this is set, we copy SOME of the request attributes
 746          *      from outside of the tunnel to inside of the tunnel.
 747          *
 748          *      We copy ONLY those attributes which do NOT already
 749          *      exist in the tunneled request.
 750          *
 751          *      This code is copied from ../rlm_eap_ttls/ttls.c
 752          */
 753         if (t->copy_request_to_tunnel) {
 754                 VALUE_PAIR *copy;
 755
 756                 for (vp = request->packet->vps; vp != NULL; vp = vp->next) {
 757                         /*
 758                          *      The attribute is a server-side thingy,
 759                          *      don't copy it.
 760                          */
 761                         if ((vp->attribute > 255) &&
 762                             (vp->vendor == 0)) {
 763                                 continue;
 764                         }
 765
 766                         /*
 767                          *      The outside attribute is already in the
 768                          *      tunnel, don't copy it.
 769                          *
 770                          *      This works for BOTH attributes which
 771                          *      are originally in the tunneled request,
 772                          *      AND attributes which are copied there
 773                          *      from below.
 774                          */
 775                         if (pairfind(fake->packet->vps, vp->attribute, vp->vendor)) {
 776                                 continue;
 777                         }
 778
 779                         /*
 780                          *      Some attributes are handled specially.
 781                          */
 782                         switch (vp->attribute) {
 783                                 /*
 784                                  *      NEVER copy Message-Authenticator,
 785                                  *      EAP-Message, or State.  They're
 786                                  *      only for outside of the tunnel.
 787                                  */
 788                         case PW_USER_NAME:
 789                         case PW_USER_PASSWORD:
 790                         case PW_CHAP_PASSWORD:
 791                         case PW_CHAP_CHALLENGE:
 792                         case PW_PROXY_STATE:
 793                         case PW_MESSAGE_AUTHENTICATOR:
 794                         case PW_EAP_MESSAGE:
 795                         case PW_STATE:
 796                                 continue;
 797                                 break;
 798
 799                                 /*
 800                                  *      By default, copy it over.
 801                                  */
 802                         default:
 803                                 break;
 804                         }
 805
 806                         /*
 807                          *      Don't copy from the head, we've already
 808                          *      checked it.
 809                          */
 810                         copy = paircopy2(vp, vp->attribute, vp->vendor);
 811                         pairadd(&fake->packet->vps, copy);
 812                 }
 813         }
 814
 815         if ((vp = pairfind(request->config_items, PW_VIRTUAL_SERVER, 0)) != NULL) {
 816                 fake->server = vp->vp_strvalue;
 817
 818         } else if (t->virtual_server) {
 819                 fake->server = t->virtual_server;
 820
 821         } /* else fake->server == request->server */
 822
 823         if ((debug_flag > 0) && fr_log_fp) {
 824                 fprintf(fr_log_fp, "Sending tunneled request\n");
 825
 826                 debug_pair_list(fake->packet->vps);
 827
 828                 fprintf(fr_log_fp, "server %s {\n",
 829                         (fake->server == NULL) ? "" : fake->server);
 830         }
 831
 832         /*
 833          *      Call authentication recursively, which will
 834          *      do PAP, CHAP, MS-CHAP, etc.
 835          */
 836         rad_authenticate(fake);
 837
 838         /*
 839          *      Note that we don't do *anything* with the reply
 840          *      attributes.
 841          */
 842         if ((debug_flag > 0) && fr_log_fp) {
 843                 fprintf(fr_log_fp, "} # server %s\n",
 844                         (fake->server == NULL) ? "" : fake->server);
 845
 846                 RDEBUG("Got tunneled reply code %d", fake->reply->code);
 847
 848                 debug_pair_list(fake->reply->vps);
 849         }
 850
 851         /*
 852          *      Decide what to do with the reply.
 853          */
 854         switch (fake->reply->code) {
 855         case 0:                 /* No reply code, must be proxied... */
 856 #ifdef WITH_PROXY
 857                 vp = pairfind(fake->config_items, PW_PROXY_TO_REALM, 0);
 858
 859                 if (vp) {
 860                         eap_tunnel_data_t *tunnel;
 861
 862                         /*
 863                          *      The tunneled request was NOT handled,
 864                          *      it has to be proxied.  This means that
 865                          *      the "authenticate" stage was never
 866                          *      performed.
 867                          *
 868                          *      If we are told to NOT proxy the
 869                          *      tunneled request as EAP, then this
 870                          *      means that we've got to decode it,
 871                          *      which means that we MUST run the
 872                          *      "authenticate" portion by hand, here.
 873                          *
 874                          *      Once the tunneled EAP session is ALMOST
 875                          *      done, THEN we proxy it...
 876                          */
 877                         if (!t->proxy_tunneled_request_as_eap) {
 878                                 fake->options |= RAD_REQUEST_OPTION_PROXY_EAP;
 879
 880                                 /*
 881                                  *      Hmm... should we check for
 882                                  *      Auth-Type & EAP-Message here?
 883                                  */
 884
 885
 886                                 /*
 887                                  *      Run the EAP authentication.
 888                                  */
 889                                 DEBUG2("  PEAP: Calling authenticate in order to initiate tunneled EAP session.");
 890                                 rcode = module_authenticate(PW_AUTHTYPE_EAP, fake);
 891                                 if (rcode == RLM_MODULE_OK) {
 892                                         /*
 893                                          *      Authentication succeeded! Rah!
 894                                          */
 895                                         fake->reply->code = PW_AUTHENTICATION_ACK;
 896                                         goto do_process;
 897                                 }
 898
 899                                 if (rcode != RLM_MODULE_HANDLED) {
 900                                         DEBUG2("  PEAP: Can't handle the return code %d", rcode);
 901                                         rcode = RLM_MODULE_REJECT;
 902                                         goto done;
 903                                 }
 904
 905                                 /*
 906                                  *      The module decided it wasn't
 907                                  *      done.  Handle it like normal.
 908                                  */
 909                                 if ((fake->options & RAD_REQUEST_OPTION_PROXY_EAP) == 0) {
 910                                         DEBUG2("    PEAP: Cancelling proxy to realm %s until the tunneled EAP session has been established", vp->vp_strvalue);
 911                                         goto do_process;
 912                                 }
 913
 914                                 /*
 915                                  *      The module has decoded the
 916                                  *      EAP-Message into another set
 917                                  *      of attributes.
 918                                  */
 919                                 pairdelete(&fake->packet->vps,
 920                                            PW_EAP_MESSAGE, 0);
 921                         }
 922
 923                         DEBUG2("  PEAP: Tunneled authentication will be proxied to %s", vp->vp_strvalue);
 924
 925                         /*
 926                          *      Tell the original request that it's going
 927                          *      to be proxied.
 928                          */
 929                         pairmove2(&(request->config_items),
 930                                   &(fake->config_items),
 931                                   PW_PROXY_TO_REALM, 0);
 932
 933                         /*
 934                          *      Seed the proxy packet with the
 935                          *      tunneled request.
 936                          */
 937                         rad_assert(request->proxy == NULL);
 938                         request->proxy = fake->packet;
 939                         fake->packet = NULL;
 940                         rad_free(&fake->reply);
 941                         fake->reply = NULL;
 942
 943                         /*
 944                          *      Set up the callbacks for the tunnel
 945                          */
 946                         tunnel = rad_malloc(sizeof(*tunnel));
 947                         memset(tunnel, 0, sizeof(*tunnel));
 948
 949                         tunnel->tls_session = tls_session;
 950                         tunnel->callback = eappeap_postproxy;
 951
 952                         /*
 953                          *      Associate the callback with the request.
 954                          */
 955                         rcode = request_data_add(request,
 956                                                  request->proxy,
 957                                                  REQUEST_DATA_EAP_TUNNEL_CALLBACK,
 958                                                  tunnel, free);
 959                         rad_assert(rcode == 0);
 960
 961                         /*
 962                          *      We're not proxying it as EAP, so we've got
 963                          *      to do the callback later.
 964                          */
 965                         if ((fake->options & RAD_REQUEST_OPTION_PROXY_EAP) != 0) {
 966                                 DEBUG2("  PEAP: Remembering to do EAP-MS-CHAP-V2 post-proxy.");
 967
 968                                 /*
 969                                  *      rlm_eap.c has taken care of associating
 970                                  *      the handler with the fake request.
 971                                  *
 972                                  *      So we associate the fake request with
 973                                  *      this request.
 974                                  */
 975                                 rcode = request_data_add(request,
 976                                                          request->proxy,
 977                                                          REQUEST_DATA_EAP_MSCHAP_TUNNEL_CALLBACK,
 978                                                          fake, my_request_free);
 979                                 rad_assert(rcode == 0);
 980
 981                                 /*
 982                                  *      Do NOT free the fake request!
 983                                  */
 984                                 return RLM_MODULE_UPDATED;
 985                         }
 986
 987                         /*
 988                          *      Didn't authenticate the packet, but
 989                          *      we're proxying it.
 990                          */
 991                         rcode = RLM_MODULE_UPDATED;
 992
 993                 } else
 994 #endif  /* WITH_PROXY */
 995                   {
 996                         DEBUG2("  PEAP: Unknown RADIUS packet type %d: rejecting tunneled user", fake->reply->code);
 997                         rcode = RLM_MODULE_REJECT;
 998                   }
 999                 break;
1000
1001         default:
1002         do_process:
1003                 rcode = process_reply(handler, tls_session, request,
1004                                       fake->reply);
1005                 break;
1006         }
1007
1008  done:
1009         request_free(&fake);
1010
1011         return rcode;
1012 }