src/modules/rlm_eap/types/rlm_eap_peap/peap.c

   1 /*
   2  * peap.c  contains the interfaces that are called from eap
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  *
  20  *   Copyright 2003 Alan DeKok <aland@freeradius.org>
  21  */
  22 #include "eap_peap.h"
  23
  24 /*
  25  *      Send protected EAP-Failure
  26  *
  27  *       Result-TLV = Failure
  28  */
  29 static int eappeap_failure(EAP_HANDLER *handler, tls_session_t *tls_session)
  30 {
  31         uint8_t tlv_packet[11];
  32
  33         DEBUG2("  rlm_eap_peap: FAILURE");
  34
  35         tlv_packet[0] = PW_EAP_REQUEST;
  36         tlv_packet[1] = handler->eap_ds->response->id +1;
  37         tlv_packet[2] = 0;
  38         tlv_packet[3] = 11;     /* length of this packet */
  39         tlv_packet[4] = PW_EAP_TLV;
  40         tlv_packet[5] = 0x80;
  41         tlv_packet[6] = EAP_TLV_ACK_RESULT;
  42         tlv_packet[7] = 0;
  43         tlv_packet[8] = 2;      /* length of the data portion */
  44         tlv_packet[9] = 0;
  45         tlv_packet[10] = EAP_TLV_FAILURE;
  46
  47         (tls_session->record_plus)(&tls_session->clean_in, tlv_packet, 11);
  48
  49         /*
  50          *      FIXME: Check the return code.
  51          */
  52         tls_handshake_send(tls_session);
  53
  54         return 1;
  55 }
  56
  57
  58 /*
  59  *      Send protected EAP-Success
  60  *
  61  *       Result-TLV = Success
  62  */
  63 static int eappeap_success(EAP_HANDLER *handler, tls_session_t *tls_session)
  64 {
  65         uint8_t tlv_packet[11];
  66
  67         DEBUG2("  rlm_eap_peap: SUCCESS");
  68
  69         tlv_packet[0] = PW_EAP_REQUEST;
  70         tlv_packet[1] = handler->eap_ds->response->id +1;
  71         tlv_packet[2] = 0;
  72         tlv_packet[3] = 11;     /* length of this packet */
  73         tlv_packet[4] = PW_EAP_TLV;
  74         tlv_packet[5] = 0x80;   /* mandatory AVP */
  75         tlv_packet[6] = EAP_TLV_ACK_RESULT;
  76         tlv_packet[7] = 0;
  77         tlv_packet[8] = 2;      /* length of the data portion */
  78         tlv_packet[9] = 0;
  79         tlv_packet[10] = EAP_TLV_SUCCESS;
  80
  81         (tls_session->record_plus)(&tls_session->clean_in, tlv_packet, 11);
  82
  83         /*
  84          *      FIXME: Check the return code.
  85          */
  86         tls_handshake_send(tls_session);
  87
  88         return 1;
  89 }
  90
  91
  92 /*
  93  *      Verify the tunneled EAP message.
  94  */
  95 static int eapmessage_verify(const uint8_t *data, unsigned int data_len)
  96 {
  97         const eap_packet_t *eap_packet = (const eap_packet_t *) data;
  98         uint8_t eap_type;
  99         char identity[256];
 100
 101         if (!data || (data_len <= 1)) {
 102                 return 0;
 103         }
 104
 105         eap_type = *data;
 106         switch (eap_type) {
 107         case PW_EAP_IDENTITY:
 108                 memcpy(identity, data + 1, data_len - 1);
 109                 identity[data_len - 1] = '\0';
 110                 DEBUG2("  rlm_eap_peap: Identity - %s", identity);
 111                 return 1;
 112                 break;
 113
 114                 /*
 115                  *      If the first byte of the packet is
 116                  *      EAP-Response, and the EAP data is a TLV,
 117                  *      then it looks OK...
 118                  */
 119         case PW_EAP_RESPONSE:
 120                 if (eap_packet->data[0] == PW_EAP_TLV) {
 121                         DEBUG2("  rlm_eap_peap: Received EAP-TLV response.");
 122                         return 1;
 123                 }
 124                 DEBUG2("  rlm_eap_peap: Got something weird.");
 125                 break;
 126
 127
 128                 /*
 129                  *      We normally do Microsoft MS-CHAPv2 (26), versus
 130                  *      Cisco MS-CHAPv2 (29).
 131                  */
 132         case PW_EAP_MSCHAPV2:
 133         default:
 134                 DEBUG2("  rlm_eap_peap: EAP type %s",
 135                        eaptype_type2name(eap_type,
 136                                          identity, sizeof(identity)));
 137                 return 1;
 138                 break;
 139         }
 140
 141         return 0;
 142 }
 143
 144 /*
 145  *      Convert a pseudo-EAP packet to a list of VALUE_PAIR's.
 146  */
 147 static VALUE_PAIR *eap2vp(EAP_DS *eap_ds,
 148                           const uint8_t *data, unsigned int data_len)
 149 {
 150         VALUE_PAIR *vp = NULL;
 151
 152         /*
 153          *      Sanity check this...
 154          */
 155         if (data_len + EAP_HEADER_LEN > MAX_STRING_LEN) {
 156                 radlog(L_ERR, "rlm_eap_peap: EAP Response packet is too large.  Code must be fixed to handle this.");
 157                 return NULL;
 158         }
 159
 160         vp = paircreate(PW_EAP_MESSAGE, PW_TYPE_OCTETS);
 161         if (!vp) {
 162                 DEBUG2("  rlm_eap_peap: Failure in creating VP");
 163                 return NULL;
 164         }
 165
 166         /*
 167          *      Hand-build an EAP packet from the crap in PEAP version 0.
 168          */
 169         vp->strvalue[0] = PW_EAP_RESPONSE;
 170         vp->strvalue[1] = eap_ds->response->id;
 171         vp->strvalue[2] = 0;
 172         vp->strvalue[3] = EAP_HEADER_LEN + data_len;
 173
 174         memcpy(vp->strvalue + EAP_HEADER_LEN, data, data_len);
 175         vp->length = EAP_HEADER_LEN + data_len;
 176
 177         return vp;
 178 }
 179
 180
 181 /*
 182  *      Convert a list of VALUE_PAIR's to an EAP packet, through the
 183  *      simple expedient of dumping the EAP message
 184  */
 185 static int vp2eap(tls_session_t *tls_session, VALUE_PAIR *vp)
 186 {
 187         if (vp->next != NULL) {
 188                 radlog(L_ERR, "rlm_eap_peap: EAP Request packet is too large.  Code must be fixed to handle this.");
 189                 return 0;
 190         }
 191
 192         /*
 193          *      Skip the id, code, and length.  Just write the EAP
 194          *      type & data to the client.
 195          */
 196 #ifndef NDEBUG
 197         if (debug_flag > 2) {
 198                 int i;
 199                 int total = vp->length - 4;
 200
 201                 if (debug_flag > 0) for (i = 0; i < total; i++) {
 202                         if ((i & 0x0f) == 0) printf("  PEAP tunnel data out %04x: ", i);
 203
 204                         printf("%02x ", vp->strvalue[i + 4]);
 205
 206                         if ((i & 0x0f) == 0x0f) printf("\n");
 207                 }
 208                 if ((total & 0x0f) != 0) printf("\n");
 209         }
 210 #endif
 211
 212         /*
 213          *      Send the EAP data, WITHOUT the header.
 214          */
 215 #if 1
 216         (tls_session->record_plus)(&tls_session->clean_in, vp->strvalue + EAP_HEADER_LEN,
 217                 vp->length - EAP_HEADER_LEN);
 218 #else
 219         (tls_session->record_plus)(&tls_session->clean_in, vp->strvalue, vp->length);
 220 #endif
 221         tls_handshake_send(tls_session);
 222
 223         return 1;
 224 }
 225
 226
 227 /*
 228  *      See if there's a TLV in the response.
 229  */
 230 static int eappeap_check_tlv(const uint8_t *data)
 231 {
 232         const eap_packet_t *eap_packet = (const eap_packet_t *) data;
 233
 234         /*
 235          *      Look for success or failure.
 236          */
 237         if ((eap_packet->code == PW_EAP_RESPONSE) &&
 238             (eap_packet->data[0] == PW_EAP_TLV)) {
 239                 if (data[10] == EAP_TLV_SUCCESS) {
 240                         return 1;
 241                 }
 242
 243                 if (data[10] == EAP_TLV_FAILURE) {
 244                         DEBUG2("  rlm_eap_peap: Client rejected our response.  The password is probably incorrect.");
 245                         return 0;
 246                 }
 247         }
 248
 249         return 0;
 250 }
 251
 252
 253 /*
 254  *      Use a reply packet to determine what to do.
 255  */
 256 static int process_reply(EAP_HANDLER *handler, tls_session_t *tls_session,
 257                          UNUSED REQUEST *request, RADIUS_PACKET *reply)
 258 {
 259         int rcode = RLM_MODULE_REJECT;
 260         VALUE_PAIR *vp;
 261         peap_tunnel_t *t = tls_session->opaque;
 262
 263 #ifndef NDEBUG
 264         if (debug_flag > 0) {
 265                 printf("  PEAP: Processing from tunneled session code %p %d\n",
 266                        reply, reply->code);
 267
 268                 for (vp = reply->vps; vp != NULL; vp = vp->next) {
 269                         putchar('\t');vp_print(stdout, vp);putchar('\n');
 270                 }
 271         }
 272 #endif
 273
 274         switch (reply->code) {
 275         case PW_AUTHENTICATION_ACK:
 276                 DEBUG2("  PEAP: Tunneled authentication was successful.");
 277                 t->status = PEAP_STATUS_SENT_TLV_SUCCESS;
 278                 eappeap_success(handler, tls_session);
 279                 rcode = RLM_MODULE_HANDLED;
 280
 281                 /*
 282                  *      If we've been told to use the attributes from
 283                  *      the reply, then do so.
 284                  *
 285                  *      WARNING: This may leak information about the
 286                  *      tunneled user!
 287                  */
 288                 if (t->use_tunneled_reply) {
 289                         DEBUG2("  Saving tunneled attributes for later");
 290
 291                         /*
 292                          *      Clean up the tunneled reply.
 293                          */
 294                         pairdelete(&reply->vps, PW_PROXY_STATE);
 295                         pairdelete(&reply->vps, PW_EAP_MESSAGE);
 296                         pairdelete(&reply->vps, PW_MESSAGE_AUTHENTICATOR);
 297
 298                         t->accept_vps = reply->vps;
 299                         reply->vps = NULL;
 300                 }
 301                 break;
 302
 303         case PW_AUTHENTICATION_REJECT:
 304                 DEBUG2("  PEAP: Tunneled authentication was rejected.");
 305                 t->status = PEAP_STATUS_SENT_TLV_FAILURE;
 306                 eappeap_failure(handler, tls_session);
 307                 rcode = RLM_MODULE_HANDLED;
 308                 break;
 309
 310         case PW_ACCESS_CHALLENGE:
 311                 DEBUG2("  PEAP: Got tunneled Access-Challenge");
 312
 313                 /*
 314                  *      Keep the State attribute, if necessary.
 315                  *
 316                  *      Get rid of the old State, too.
 317                  */
 318                 pairfree(&t->state);
 319                 pairmove2(&t->state, &(reply->vps), PW_STATE);
 320
 321                 /*
 322                  *      PEAP takes only EAP-Message attributes inside
 323                  *      of the tunnel.  Any Reply-Message in the
 324                  *      Access-Challenge is ignored.
 325                  */
 326                 vp = NULL;
 327                 pairmove2(&vp, &(reply->vps), PW_EAP_MESSAGE);
 328
 329                 /*
 330                  *      Handle EAP-MSCHAP-V2, where Access-Accept's
 331                  *      from the home server may contain MS-CHAP-Success,
 332                  *      which the module turns into challenges, so that
 333                  *      the client may respond to the challenge with
 334                  *      an "ack" packet.
 335                  */
 336                 if (t->home_access_accept && t->use_tunneled_reply) {
 337                         DEBUG2("  Saving tunneled attributes for later");
 338
 339                         /*
 340                          *      Clean up the tunneled reply.
 341                          */
 342                         pairdelete(&reply->vps, PW_PROXY_STATE);
 343                         pairdelete(&reply->vps, PW_MESSAGE_AUTHENTICATOR);
 344
 345                         t->accept_vps = reply->vps;
 346                         reply->vps = NULL;
 347                 }
 348
 349                 /*
 350                  *      Handle the ACK, by tunneling any necessary reply
 351                  *      VP's back to the client.
 352                  */
 353                 if (vp) {
 354                         vp2eap(tls_session, vp);
 355                         pairfree(&vp);
 356                 }
 357
 358                 rcode = RLM_MODULE_HANDLED;
 359                 break;
 360
 361         default:
 362                 DEBUG2("  PEAP: Unknown RADIUS packet type %d: rejecting tunneled user", reply->code);
 363                 rcode = RLM_MODULE_REJECT;
 364                 break;
 365         }
 366
 367         return rcode;
 368 }
 369
 370
 371 /*
 372  *      Do post-proxy processing,
 373  */
 374 static int eappeap_postproxy(EAP_HANDLER *handler, void *data)
 375 {
 376         int rcode;
 377         tls_session_t *tls_session = (tls_session_t *) data;
 378         REQUEST *fake;
 379
 380         DEBUG2("  PEAP: Passing reply from proxy back into the tunnel.");
 381
 382         /*
 383          *      If there was a fake request associated with the proxied
 384          *      request, do more processing of it.
 385          */
 386         fake = (REQUEST *) request_data_get(handler->request,
 387                                             handler->request->proxy,
 388                                             REQUEST_DATA_EAP_MSCHAP_TUNNEL_CALLBACK);
 389
 390         /*
 391          *      Do the callback, if it exists, and if it was a success.
 392          */
 393         if (fake && (handler->request->proxy_reply->code == PW_AUTHENTICATION_ACK)) {
 394                 VALUE_PAIR *vp;
 395                 REQUEST *request = handler->request;
 396                 peap_tunnel_t *t = tls_session->opaque;
 397
 398                 t->home_access_accept = TRUE;
 399
 400                 /*
 401                  *      Terrible hacks.
 402                  */
 403                 rad_assert(fake->packet == NULL);
 404                 fake->packet = request->proxy;
 405                 request->proxy = NULL;
 406
 407                 rad_assert(fake->reply == NULL);
 408                 fake->reply = request->proxy_reply;
 409                 request->proxy_reply = NULL;
 410
 411                 /*
 412                  *      Perform a post-auth stage, which will get the EAP
 413                  *      handler, too...
 414                  */
 415                 fake->options &= ~RAD_REQUEST_OPTION_PROXY_EAP;
 416                 DEBUG2("  PEAP: Passing reply back for EAP-MS-CHAP-V2 %p %d",
 417                        fake, fake->reply->code);
 418                 rcode = module_post_proxy(0, fake);
 419
 420                 /*
 421                  *      FIXME: If rcode returns fail, do something
 422                  *      intelligent...
 423                  */
 424                 DEBUG2("  POST-PROXY %d", rcode);
 425                 rcode = rad_postauth(fake);
 426                 DEBUG2("  POST-AUTH %d", rcode);
 427
 428 #ifndef NDEBUG
 429                 if (debug_flag > 0) {
 430                         printf("  PEAP: Final reply from tunneled session code %d\n",
 431                                fake->reply->code);
 432
 433                         for (vp = fake->reply->vps; vp != NULL; vp = vp->next) {
 434                                 putchar('\t');vp_print(stdout, vp);putchar('\n');
 435                         }
 436                 }
 437 #endif
 438
 439                 /*
 440                  *      Terrible hacks.
 441                  */
 442                 request->proxy = fake->packet;
 443                 fake->packet = NULL;
 444                 request->proxy_reply = fake->reply;
 445                 fake->reply = NULL;
 446
 447                 /*
 448                  *      And we're done with this request.
 449                  */
 450
 451                 switch (rcode) {
 452                 case RLM_MODULE_FAIL:
 453                         request_free(&fake);
 454                         eaptls_fail(handler->eap_ds, 0);
 455                         return 0;
 456                         break;
 457
 458                 default:  /* Don't Do Anything */
 459                         DEBUG2(" PEAP: Got reply %d",
 460                                request->proxy_reply->code);
 461                         break;
 462                 }
 463         }
 464         request_free(&fake);    /* robust if fake == NULL */
 465
 466         /*
 467          *      If there was no EAP-Message in the reply packet, then
 468          *      we know that we're supposed to re-run the "authenticate"
 469          *      stage, in order to get the right kind of handling...
 470          */
 471
 472         /*
 473          *      Process the reply from the home server.
 474          */
 475
 476         rcode = process_reply(handler, tls_session, handler->request,
 477                               handler->request->proxy_reply);
 478
 479         /*
 480          *      The proxy code uses the reply from the home server as
 481          *      the basis for the reply to the NAS.  We don't want that,
 482          *      so we toss it, after we've had our way with it.
 483          */
 484         pairfree(&handler->request->proxy_reply->vps);
 485
 486         switch (rcode) {
 487         case RLM_MODULE_REJECT:
 488                 DEBUG2("  PEAP: Reply was rejected");
 489                 eaptls_fail(handler->eap_ds, 0);
 490                 return 0;
 491
 492         case RLM_MODULE_HANDLED:
 493                 DEBUG2("  PEAP: Reply was handled");
 494                 eaptls_request(handler->eap_ds, tls_session);
 495                 return 1;
 496
 497         case RLM_MODULE_OK:
 498                 DEBUG2("  PEAP: Reply was OK");
 499                 eaptls_success(handler->eap_ds, 0);
 500                 eaptls_gen_mppe_keys(&handler->request->reply->vps,
 501                                      tls_session->ssl,
 502                                      "client EAP encryption");
 503                 return 1;
 504
 505         default:
 506                 DEBUG2("  PEAP: Reply was unknown.");
 507                 break;
 508         }
 509
 510         eaptls_fail(handler->eap_ds, 0);
 511         return 0;
 512 }
 513
 514 /*
 515  *      Free a request.
 516  */
 517 static void my_request_free(void *data)
 518 {
 519         REQUEST *request = (REQUEST *)data;
 520
 521         request_free(&request);
 522 }
 523
 524
 525 /*
 526  *      Process the pseudo-EAP contents of the tunneled data.
 527  */
 528 int eappeap_process(EAP_HANDLER *handler, tls_session_t *tls_session)
 529 {
 530         int err;
 531         peap_tunnel_t *t = tls_session->opaque;
 532         REQUEST *fake;
 533         VALUE_PAIR *vp;
 534         int rcode = RLM_MODULE_REJECT;
 535         const uint8_t *data;
 536         unsigned int data_len;
 537         unsigned char buffer[1024];
 538 #ifndef NDEBUG
 539         int i;
 540 #endif
 541
 542         REQUEST *request = handler->request;
 543         EAP_DS *eap_ds = handler->eap_ds;
 544
 545         /*
 546          *      Grab the dirty data, and copy it to our buffer.
 547          *
 548          *      I *really* don't like these 'record_t' things...
 549          */
 550         data_len = (tls_session->record_minus)(&tls_session->dirty_in, buffer, sizeof(buffer));
 551         data = buffer;
 552
 553         /*
 554          *      Write the data from the dirty buffer (i.e. packet
 555          *      data) into the buffer which we will give to SSL for
 556          *      decoding.
 557          *
 558          *      Some of this code COULD technically go into the TLS
 559          *      module, in eaptls_process(), where it returns EAPTLS_OK.
 560          *
 561          *      Similarly, the writing of data to the SSL context could
 562          *      go there, too...
 563          */
 564         BIO_write(tls_session->into_ssl, buffer, data_len);
 565         (tls_session->record_init)(&tls_session->clean_out);
 566
 567         /*
 568          *      Read (and decrypt) the tunneled data from the SSL session,
 569          *      and put it into the decrypted data buffer.
 570          */
 571         err = SSL_read(tls_session->ssl, tls_session->clean_out.data,
 572                        sizeof(tls_session->clean_out.data));
 573         if (err < 0) {
 574                 /*
 575                  *      FIXME: Call SSL_get_error() to see what went
 576                  *      wrong.
 577                  */
 578                 radlog(L_INFO, "rlm_eap_peap: SSL_read Error");
 579                 return RLM_MODULE_REJECT;
 580         }
 581
 582         /*
 583          *      If there's no data, maybe this is an ACK to an
 584          *      MS-CHAP2-Success.
 585          */
 586         if (err == 0) {
 587                 /*
 588                  *      FIXME: Call SSL_get_error() to see what went
 589                  *      wrong.
 590                  */
 591                 radlog(L_INFO, "rlm_eap_peap: No data inside of the tunnel.");
 592                 return RLM_MODULE_REJECT;
 593         }
 594
 595         data_len = tls_session->clean_out.used = err;
 596         data = tls_session->clean_out.data;
 597
 598 #ifndef NDEBUG
 599         if (debug_flag > 2) {
 600                 for (i = 0; i < data_len; i++) {
 601                         if ((i & 0x0f) == 0) printf("  PEAP tunnel data in %04x: ", i);
 602
 603                         printf("%02x ", data[i]);
 604
 605                         if ((i & 0x0f) == 0x0f) printf("\n");
 606                 }
 607                 if ((data_len & 0x0f) != 0) printf("\n");
 608         }
 609 #endif
 610
 611         if (!eapmessage_verify(data, data_len)) {
 612                 return RLM_MODULE_REJECT;
 613         }
 614
 615         DEBUG2("  rlm_eap_peap: Tunneled data is valid.");
 616
 617         /*
 618          *      If we authenticated the user, then it's OK.
 619          */
 620         if (t->status == PEAP_STATUS_SENT_TLV_SUCCESS) {
 621                 if (eappeap_check_tlv(data)) {
 622                         DEBUG2("  rlm_eap_peap: Success");
 623                         return RLM_MODULE_OK;
 624                 }
 625
 626                 return RLM_MODULE_REJECT;
 627
 628         } else if (t->status == PEAP_STATUS_SENT_TLV_FAILURE) {
 629                 DEBUG2("  rlm_eap_peap:  Had sent TLV failure.  User was rejcted rejected earlier in this session.");
 630                 return RLM_MODULE_REJECT;
 631         }
 632
 633         fake = request_alloc_fake(request);
 634
 635         rad_assert(fake->packet->vps == NULL);
 636
 637         fake->packet->vps = eap2vp(eap_ds, data, data_len);
 638         if (!fake->packet->vps) {
 639                 DEBUG2("  rlm_eap_peap: Unable to convert tunneled EAP packet to internal server data structures");
 640                 return PW_AUTHENTICATION_REJECT;
 641         }
 642
 643 #ifndef NDEBUG
 644         if (debug_flag > 0) {
 645           printf("  PEAP: Got tunneled EAP-Message\n");
 646
 647           for (vp = fake->packet->vps; vp != NULL; vp = vp->next) {
 648             putchar('\t');vp_print(stdout, vp);putchar('\n');
 649           }
 650         }
 651 #endif
 652
 653         /*
 654          *      Tell the request that it's a fake one.
 655          */
 656         vp = pairmake("Freeradius-Proxied-To", "127.0.0.1", T_OP_EQ);
 657         if (vp) {
 658                 pairadd(&fake->packet->vps, vp);
 659         }
 660
 661         /*
 662          *      Update other items in the REQUEST data structure.
 663          */
 664         if (!t->username) {
 665                 /*
 666                  *      There's no User-Name in the tunneled session,
 667                  *      so we add one here, by pulling it out of the
 668                  *      EAP-Identity packet.
 669                  */
 670                 if ((data[0] == PW_EAP_IDENTITY) && (data_len > 1)) {
 671                         t->username = pairmake("User-Name", "", T_OP_EQ);
 672                         rad_assert(t->username != NULL);
 673
 674                         memcpy(t->username->strvalue, data + 1, data_len - 1);
 675                         t->username->length = data_len - 1;
 676                         t->username->strvalue[t->username->length] = 0;
 677                         DEBUG2("  PEAP: Got tunneled identity of %s", t->username->strvalue);
 678
 679                         /*
 680                          *      If there's a default EAP type,
 681                          *      set it here.
 682                          */
 683                         if (t->default_eap_type != 0) {
 684                                 DEBUG2("  PEAP: Setting default EAP type for tunneled EAP session.");
 685                                 vp = pairmake("EAP-Type", "0", T_OP_EQ);
 686                                 vp->lvalue = t->default_eap_type;
 687                                 pairadd(&fake->config_items, vp);
 688                         }
 689                 }
 690         } /* else there WAS a t->username */
 691
 692         if (t->username) {
 693                 vp = paircopy(t->username);
 694                 pairadd(&fake->packet->vps, vp);
 695                 fake->username = pairfind(fake->packet->vps, PW_USER_NAME);
 696                 DEBUG2("  PEAP: Setting User-Name to %s",
 697                        fake->username->strvalue);
 698         }
 699
 700         /*
 701          *      Add the State attribute, too, if it exists.
 702          */
 703         if (t->state) {
 704                 DEBUG2("  PEAP: Adding old state with %02x %02x",
 705                        t->state->strvalue[0], t->state->strvalue[1]);
 706                 vp = paircopy(t->state);
 707                 if (vp) pairadd(&fake->packet->vps, vp);
 708         }
 709
 710         /*
 711          *      If this is set, we copy SOME of the request attributes
 712          *      from outside of the tunnel to inside of the tunnel.
 713          *
 714          *      We copy ONLY those attributes which do NOT already
 715          *      exist in the tunneled request.
 716          *
 717          *      This code is copied from ../rlm_eap_ttls/ttls.c
 718          */
 719         if (t->copy_request_to_tunnel) {
 720                 VALUE_PAIR *copy;
 721
 722                 for (vp = request->packet->vps; vp != NULL; vp = vp->next) {
 723                         /*
 724                          *      The attribute is a server-side thingy,
 725                          *      don't copy it.
 726                          */
 727                         if ((vp->attribute > 255) &&
 728                             (((vp->attribute >> 16) & 0xffff) == 0)) {
 729                                 continue;
 730                         }
 731
 732                         /*
 733                          *      The outside attribute is already in the
 734                          *      tunnel, don't copy it.
 735                          *
 736                          *      This works for BOTH attributes which
 737                          *      are originally in the tunneled request,
 738                          *      AND attributes which are copied there
 739                          *      from below.
 740                          */
 741                         if (pairfind(fake->packet->vps, vp->attribute)) {
 742                                 continue;
 743                         }
 744
 745                         /*
 746                          *      Some attributes are handled specially.
 747                          */
 748                         switch (vp->attribute) {
 749                                 /*
 750                                  *      NEVER copy Message-Authenticator,
 751                                  *      EAP-Message, or State.  They're
 752                                  *      only for outside of the tunnel.
 753                                  */
 754                         case PW_USER_NAME:
 755                         case PW_USER_PASSWORD:
 756                         case PW_CHAP_PASSWORD:
 757                         case PW_CHAP_CHALLENGE:
 758                         case PW_PROXY_STATE:
 759                         case PW_MESSAGE_AUTHENTICATOR:
 760                         case PW_EAP_MESSAGE:
 761                         case PW_STATE:
 762                                 continue;
 763                                 break;
 764
 765                                 /*
 766                                  *      By default, copy it over.
 767                                  */
 768                         default:
 769                                 break;
 770                         }
 771
 772                         /*
 773                          *      Don't copy from the head, we've already
 774                          *      checked it.
 775                          */
 776                         copy = paircopy2(vp, vp->attribute);
 777                         pairadd(&fake->packet->vps, copy);
 778                 }
 779         }
 780
 781 #ifndef NDEBUG
 782         if (debug_flag > 0) {
 783                 printf("  PEAP: Sending tunneled request\n");
 784
 785                 for (vp = fake->packet->vps; vp != NULL; vp = vp->next) {
 786                         putchar('\t');vp_print(stdout, vp);putchar('\n');
 787                 }
 788         }
 789 #endif
 790
 791         /*
 792          *      Call authentication recursively, which will
 793          *      do PAP, CHAP, MS-CHAP, etc.
 794          */
 795         rad_authenticate(fake);
 796
 797         /*
 798          *      Note that we don't do *anything* with the reply
 799          *      attributes.
 800          */
 801 #ifndef NDEBUG
 802         if (debug_flag > 0) {
 803                 printf("  PEAP: Got tunneled reply RADIUS code %d\n",
 804                  fake->reply->code);
 805
 806                 for (vp = fake->reply->vps; vp != NULL; vp = vp->next) {
 807                         putchar('\t');vp_print(stdout, vp);putchar('\n');
 808                 }
 809         }
 810 #endif
 811
 812         /*
 813          *      Decide what to do with the reply.
 814          */
 815         switch (fake->reply->code) {
 816         case 0:                 /* No reply code, must be proxied... */
 817                 vp = pairfind(fake->config_items, PW_PROXY_TO_REALM);
 818
 819                 if (vp) {
 820                         eap_tunnel_data_t *tunnel;
 821
 822                         /*
 823                          *      The tunneled request was NOT handled,
 824                          *      it has to be proxied.  This means that
 825                          *      the "authenticate" stage was never
 826                          *      performed.
 827                          *
 828                          *      If we are told to NOT proxy the
 829                          *      tunneled request as EAP, then this
 830                          *      means that we've got to decode it,
 831                          *      which means that we MUST run the
 832                          *      "authenticate" portion by hand, here.
 833                          *
 834                          *      Once the tunneled EAP session is ALMOST
 835                          *      done, THEN we proxy it...
 836                          */
 837                         if (!t->proxy_tunneled_request_as_eap) {
 838                                 fake->options |= RAD_REQUEST_OPTION_PROXY_EAP;
 839
 840                                 /*
 841                                  *      Hmm... should we check for
 842                                  *      Auth-Type & EAP-Message here?
 843                                  */
 844
 845
 846                                 /*
 847                                  *      Run the EAP authentication.
 848                                  */
 849                                 DEBUG2("  PEAP: Calling authenticate in order to initiate tunneled EAP session.");
 850                                 rcode = module_authenticate(PW_AUTHTYPE_EAP, fake);
 851                                 if (rcode == RLM_MODULE_OK) {
 852                                         /*
 853                                          *      Authentication succeeded! Rah!
 854                                          */
 855                                         fake->reply->code = PW_AUTHENTICATION_ACK;
 856                                         goto do_process;
 857                                 }
 858
 859                                 if (rcode != RLM_MODULE_HANDLED) {
 860                                         DEBUG2("  PEAP: Can't handle the return code %d", rcode);
 861                                         rcode = RLM_MODULE_REJECT;
 862                                         goto done;
 863                                 }
 864
 865                                 /*
 866                                  *      The module decided it wasn't
 867                                  *      done.  Handle it like normal.
 868                                  */
 869                                 if ((fake->options & RAD_REQUEST_OPTION_PROXY_EAP) == 0) {
 870                                         DEBUG2("    PEAP: Cancelling proxy to realm %s until the tunneled EAP session has been established", vp->strvalue);
 871                                         goto do_process;
 872                                 }
 873
 874                                 /*
 875                                  *      The module has decoded the
 876                                  *      EAP-Message into another set
 877                                  *      of attributes.
 878                                  */
 879                                 pairdelete(&fake->packet->vps,
 880                                            PW_EAP_MESSAGE);
 881                         }
 882
 883                         DEBUG2("  PEAP: Tunneled authentication will be proxied to %s", vp->strvalue);
 884
 885                         /*
 886                          *      Tell the original request that it's going
 887                          *      to be proxied.
 888                          */
 889                         pairmove2(&(request->config_items),
 890                                   &(fake->config_items),
 891                                   PW_PROXY_TO_REALM);
 892
 893                         /*
 894                          *      Seed the proxy packet with the
 895                          *      tunneled request.
 896                          */
 897                         rad_assert(request->proxy == NULL);
 898                         request->proxy = fake->packet;
 899                         fake->packet = NULL;
 900                         rad_free(&fake->reply);
 901                         fake->reply = NULL;
 902
 903                         /*
 904                          *      Set up the callbacks for the tunnel
 905                          */
 906                         tunnel = rad_malloc(sizeof(*tunnel));
 907                         memset(tunnel, 0, sizeof(*tunnel));
 908
 909                         tunnel->tls_session = tls_session;
 910                         tunnel->callback = eappeap_postproxy;
 911
 912                         /*
 913                          *      Associate the callback with the request.
 914                          */
 915                         rcode = request_data_add(request,
 916                                                  request->proxy,
 917                                                  REQUEST_DATA_EAP_TUNNEL_CALLBACK,
 918                                                  tunnel, free);
 919                         rad_assert(rcode == 0);
 920
 921                         /*
 922                          *      We're not proxying it as EAP, so we've got
 923                          *      to do the callback later.
 924                          */
 925                         if ((fake->options & RAD_REQUEST_OPTION_PROXY_EAP) != 0) {
 926                                 DEBUG2("  PEAP: Remembering to do EAP-MS-CHAP-V2 post-proxy.");
 927
 928                                 /*
 929                                  *      rlm_eap.c has taken care of associating
 930                                  *      the handler with the fake request.
 931                                  *
 932                                  *      So we associate the fake request with
 933                                  *      this request.
 934                                  */
 935                                 rcode = request_data_add(request,
 936                                                          request->proxy,
 937                                                          REQUEST_DATA_EAP_MSCHAP_TUNNEL_CALLBACK,
 938                                                          fake, my_request_free);
 939                                 rad_assert(rcode == 0);
 940
 941                                 /*
 942                                  *      Do NOT free the fake request!
 943                                  */
 944                                 return RLM_MODULE_UPDATED;
 945                         }
 946
 947                         /*
 948                          *      Didn't authenticate the packet, but
 949                          *      we're proxying it.
 950                          */
 951                         rcode = RLM_MODULE_UPDATED;
 952
 953                 } else {
 954                         DEBUG2("  PEAP: Unknown RADIUS packet type %d: rejecting tunneled user", fake->reply->code);
 955                         rcode = RLM_MODULE_REJECT;
 956                 }
 957                 break;
 958
 959         default:
 960         do_process:
 961                 rcode = process_reply(handler, tls_session, request,
 962                                       fake->reply);
 963                 break;
 964         }
 965
 966  done:
 967         request_free(&fake);
 968
 969         return rcode;
 970 }