src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c

   1 /*
   2  * rlm_eap_peap.c  contains the interfaces that are called from eap
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2003 Alan DeKok <aland@freeradius.org>
  21  * Copyright 2006 The FreeRADIUS server project
  22  */
  23
  24 #include <freeradius-devel/ident.h>
  25 RCSID("$Id$")
  26
  27 #include <freeradius-devel/autoconf.h>
  28 #include "eap_peap.h"
  29
  30 typedef struct rlm_eap_peap_t {
  31         /*
  32          *      Default tunneled EAP type
  33          */
  34         char    *default_eap_type_name;
  35         int     default_eap_type;
  36
  37         /*
  38          *      Use the reply attributes from the tunneled session in
  39          *      the non-tunneled reply to the client.
  40          */
  41         int     use_tunneled_reply;
  42
  43         /*
  44          *      Use SOME of the request attributes from outside of the
  45          *      tunneled session in the tunneled request
  46          */
  47         int     copy_request_to_tunnel;
  48
  49 #ifdef WITH_PROXY
  50         /*
  51          *      Proxy tunneled session as EAP, or as de-capsulated
  52          *      protocol.
  53          */
  54         int     proxy_tunneled_request_as_eap;
  55 #endif
  56
  57         /*
  58          *      Virtual server for inner tunnel session.
  59          */
  60         char    *virtual_server;
  61 } rlm_eap_peap_t;
  62
  63
  64 static CONF_PARSER module_config[] = {
  65         { "default_eap_type", PW_TYPE_STRING_PTR,
  66           offsetof(rlm_eap_peap_t, default_eap_type_name), NULL, "mschapv2" },
  67
  68         { "copy_request_to_tunnel", PW_TYPE_BOOLEAN,
  69           offsetof(rlm_eap_peap_t, copy_request_to_tunnel), NULL, "no" },
  70
  71         { "use_tunneled_reply", PW_TYPE_BOOLEAN,
  72           offsetof(rlm_eap_peap_t, use_tunneled_reply), NULL, "no" },
  73
  74 #ifdef WITH_PROXY
  75         { "proxy_tunneled_request_as_eap", PW_TYPE_BOOLEAN,
  76           offsetof(rlm_eap_peap_t, proxy_tunneled_request_as_eap), NULL, "yes" },
  77 #endif
  78
  79         { "virtual_server", PW_TYPE_STRING_PTR,
  80           offsetof(rlm_eap_peap_t, virtual_server), NULL, NULL },
  81
  82         { NULL, -1, 0, NULL, NULL }           /* end the list */
  83 };
  84
  85 /*
  86  *      Detach the module.
  87  */
  88 static int eappeap_detach(void *arg)
  89 {
  90         rlm_eap_peap_t *inst = (rlm_eap_peap_t *) arg;
  91
  92
  93         free(inst);
  94
  95         return 0;
  96 }
  97
  98 /*
  99  *      Attach the module.
 100  */
 101 static int eappeap_attach(CONF_SECTION *cs, void **instance)
 102 {
 103         rlm_eap_peap_t *inst;
 104
 105         inst = malloc(sizeof(*inst));
 106         if (!inst) {
 107                 radlog(L_ERR, "rlm_eap_peap: out of memory");
 108                 return -1;
 109         }
 110         memset(inst, 0, sizeof(*inst));
 111
 112         /*
 113          *      Parse the configuration attributes.
 114          */
 115         if (cf_section_parse(cs, inst, module_config) < 0) {
 116                 eappeap_detach(inst);
 117                 return -1;
 118         }
 119
 120         /*
 121          *      Convert the name to an integer, to make it easier to
 122          *      handle.
 123          */
 124         inst->default_eap_type = eaptype_name2type(inst->default_eap_type_name);
 125         if (inst->default_eap_type < 0) {
 126                 radlog(L_ERR, "rlm_eap_peap: Unknown EAP type %s",
 127                        inst->default_eap_type_name);
 128                 eappeap_detach(inst);
 129                 return -1;
 130         }
 131
 132         *instance = inst;
 133
 134         return 0;
 135 }
 136
 137 /*
 138  *      Free the PEAP per-session data
 139  */
 140 static void peap_free(void *p)
 141 {
 142         peap_tunnel_t *t = (peap_tunnel_t *) p;
 143
 144         if (!t) return;
 145
 146         pairfree(&t->username);
 147         pairfree(&t->state);
 148         pairfree(&t->accept_vps);
 149
 150         free(t);
 151 }
 152
 153
 154 /*
 155  *      Free the PEAP per-session data
 156  */
 157 static peap_tunnel_t *peap_alloc(rlm_eap_peap_t *inst)
 158 {
 159         peap_tunnel_t *t;
 160
 161         t = rad_malloc(sizeof(*t));
 162         memset(t, 0, sizeof(*t));
 163
 164         t->default_eap_type = inst->default_eap_type;
 165         t->copy_request_to_tunnel = inst->copy_request_to_tunnel;
 166         t->use_tunneled_reply = inst->use_tunneled_reply;
 167 #ifdef WITH_PROXY
 168         t->proxy_tunneled_request_as_eap = inst->proxy_tunneled_request_as_eap;
 169 #endif
 170         t->virtual_server = inst->virtual_server;
 171         t->session_resumption_state = PEAP_RESUMPTION_MAYBE;
 172
 173         return t;
 174 }
 175
 176 /*
 177  *      Do authentication, by letting EAP-TLS do most of the work.
 178  */
 179 static int eappeap_authenticate(void *arg, EAP_HANDLER *handler)
 180 {
 181         int rcode;
 182         eaptls_status_t status;
 183         rlm_eap_peap_t *inst = (rlm_eap_peap_t *) arg;
 184         tls_session_t *tls_session = (tls_session_t *) handler->opaque;
 185         peap_tunnel_t *peap = tls_session->opaque;
 186         REQUEST *request = handler->request;
 187
 188         /*
 189          *      Session resumption requires the storage of data, so
 190          *      allocate it if it doesn't already exist.
 191          */
 192         if (!tls_session->opaque) {
 193                 peap = tls_session->opaque = peap_alloc(inst);
 194                 tls_session->free_opaque = peap_free;
 195         }
 196
 197         status = eaptls_process(handler);
 198         RDEBUG2("eaptls_process returned %d\n", status);
 199         switch (status) {
 200                 /*
 201                  *      EAP-TLS handshake was successful, tell the
 202                  *      client to keep talking.
 203                  *
 204                  *      If this was EAP-TLS, we would just return
 205                  *      an EAP-TLS-Success packet here.
 206                  */
 207         case EAPTLS_SUCCESS:
 208                 if (SSL_session_reused(tls_session->ssl)) {
 209                         uint8_t tlv_packet[11];
 210
 211                         RDEBUG2("Skipping Phase2 because of session resumption.");
 212                         peap->session_resumption_state = PEAP_RESUMPTION_YES;
 213
 214                         tlv_packet[0] = PW_EAP_REQUEST;
 215                         tlv_packet[1] = handler->eap_ds->response->id +1;
 216                         tlv_packet[2] = 0;
 217                         tlv_packet[3] = 11;     /* length of this packet */
 218                         tlv_packet[4] = PW_EAP_TLV;
 219                         tlv_packet[5] = 0x80;
 220                         tlv_packet[6] = EAP_TLV_ACK_RESULT;
 221                         tlv_packet[7] = 0;
 222                         tlv_packet[8] = 2;      /* length of the data portion */
 223                         tlv_packet[9] = 0;
 224                         tlv_packet[10] = EAP_TLV_SUCCESS;
 225
 226                         peap->status = PEAP_STATUS_SENT_TLV_SUCCESS;
 227
 228                         (tls_session->record_plus)(&tls_session->clean_in, tlv_packet, 11);
 229                         tls_handshake_send(tls_session);
 230                         (tls_session->record_init)(&tls_session->clean_in);
 231
 232                 } else {
 233                         eap_packet_t eap_packet;
 234
 235                         eap_packet.code = PW_EAP_REQUEST;
 236                         eap_packet.id = handler->eap_ds->response->id + 1;
 237                         eap_packet.length[0] = 0;
 238                         eap_packet.length[1] = EAP_HEADER_LEN + 1;
 239                         eap_packet.data[0] = PW_EAP_IDENTITY;
 240
 241                         (tls_session->record_plus)(&tls_session->clean_in,
 242                                                   &eap_packet, sizeof(eap_packet));
 243
 244                         tls_handshake_send(tls_session);
 245                         (tls_session->record_init)(&tls_session->clean_in);
 246                 }
 247
 248                 eaptls_request(handler->eap_ds, tls_session);
 249                 RDEBUG2("EAPTLS_SUCCESS");
 250                 return 1;
 251
 252                 /*
 253                  *      The TLS code is still working on the TLS
 254                  *      exchange, and it's a valid TLS request.
 255                  *      do nothing.
 256                  */
 257         case EAPTLS_HANDLED:
 258           /*
 259            *    FIXME: If the SSL session is established, grab the state
 260            *    and EAP id from the inner tunnel, and update it with
 261            *    the expected EAP id!
 262            */
 263                 RDEBUG2("EAPTLS_HANDLED");
 264                 return 1;
 265
 266                 /*
 267                  *      Handshake is done, proceed with decoding tunneled
 268                  *      data.
 269                  */
 270         case EAPTLS_OK:
 271                 RDEBUG2("EAPTLS_OK");
 272                 break;
 273
 274                 /*
 275                  *      Anything else: fail.
 276                  */
 277         default:
 278                 RDEBUG2("EAPTLS_OTHERS");
 279                 return 0;
 280         }
 281
 282         /*
 283          *      Session is established, proceed with decoding
 284          *      tunneled data.
 285          */
 286         RDEBUG2("Session established.  Decoding tunneled attributes.");
 287
 288         /*
 289          *      We may need PEAP data associated with the session, so
 290          *      allocate it here, if it wasn't already alloacted.
 291          */
 292         if (!tls_session->opaque) {
 293                 tls_session->opaque = peap_alloc(inst);
 294                 tls_session->free_opaque = peap_free;
 295         }
 296
 297         /*
 298          *      Process the PEAP portion of the request.
 299          */
 300         rcode = eappeap_process(handler, tls_session);
 301         switch (rcode) {
 302         case RLM_MODULE_REJECT:
 303                 eaptls_fail(handler, 0);
 304                 return 0;
 305
 306         case RLM_MODULE_HANDLED:
 307                 eaptls_request(handler->eap_ds, tls_session);
 308                 return 1;
 309
 310         case RLM_MODULE_OK:
 311                 /*
 312                  *      Move the saved VP's from the Access-Accept to
 313                  *      our Access-Accept.
 314                  */
 315                 peap = tls_session->opaque;
 316                 if (peap->accept_vps) {
 317                         RDEBUG2("Using saved attributes from the original Access-Accept");
 318                         pairadd(&handler->request->reply->vps, &peap->accept_vps);
 319                         pairfree(&peap->accept_vps);
 320                 }
 321
 322                 /*
 323                  *      Success: Automatically return MPPE keys.
 324                  */
 325                 return eaptls_success(handler, 0);
 326
 327                 /*
 328                  *      No response packet, MUST be proxying it.
 329                  *      The main EAP module will take care of discovering
 330                  *      that the request now has a "proxy" packet, and
 331                  *      will proxy it, rather than returning an EAP packet.
 332                  */
 333         case RLM_MODULE_UPDATED:
 334 #ifdef WITH_PROXY
 335                 rad_assert(handler->request->proxy != NULL);
 336 #endif
 337                 return 1;
 338                 break;
 339
 340         default:
 341                 break;
 342         }
 343
 344         eaptls_fail(handler, 0);
 345         return 0;
 346 }
 347
 348
 349 /*
 350  *      The module name should be the only globally exported symbol.
 351  *      That is, everything else should be 'static'.
 352  */
 353 EAP_TYPE rlm_eap_peap = {
 354         "eap_peap",
 355         eappeap_attach,                 /* attach */
 356         /*
 357          *      Note! There is NO eappeap_initate() function, as the
 358          *      main EAP module takes care of calling
 359          *      eaptls_initiate().
 360          *
 361          *      This is because PEAP is a protocol on top of TLS, so
 362          *      before we need to do PEAP, we've got to initiate a TLS
 363          *      session.
 364          */
 365         NULL,                           /* Start the initial request */
 366         NULL,                           /* authorization */
 367         eappeap_authenticate,           /* authentication */
 368         eappeap_detach                  /* detach */
 369 };