src/eap_server/eap_ttls.c

   1 /*
   2  * hostapd / EAP-TTLS (draft-ietf-pppext-eap-ttls-05.txt)
   3  * Copyright (c) 2004-2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "eap_server/eap_i.h"
  19 #include "eap_server/eap_tls_common.h"
  20 #include "ms_funcs.h"
  21 #include "sha1.h"
  22 #include "eap_common/chap.h"
  23 #include "tls.h"
  24 #include "eap_common/eap_ttls.h"
  25
  26
  27 /* Maximum supported TTLS version
  28  * 0 = draft-ietf-pppext-eap-ttls-03.txt / draft-funk-eap-ttls-v0-00.txt
  29  * 1 = draft-funk-eap-ttls-v1-00.txt
  30  */
  31 #ifndef EAP_TTLS_VERSION
  32 #define EAP_TTLS_VERSION 0 /* TTLSv1 implementation is not yet complete */
  33 #endif /* EAP_TTLS_VERSION */
  34
  35
  36 #define MSCHAPV2_KEY_LEN 16
  37
  38
  39 static void eap_ttls_reset(struct eap_sm *sm, void *priv);
  40
  41
  42 struct eap_ttls_data {
  43         struct eap_ssl_data ssl;
  44         enum {
  45                 START, PHASE1, PHASE2_START, PHASE2_METHOD,
  46                 PHASE2_MSCHAPV2_RESP, PHASE_FINISHED, SUCCESS, FAILURE
  47         } state;
  48
  49         int ttls_version;
  50         int force_version;
  51         const struct eap_method *phase2_method;
  52         void *phase2_priv;
  53         int mschapv2_resp_ok;
  54         u8 mschapv2_auth_response[20];
  55         u8 mschapv2_ident;
  56         int tls_ia_configured;
  57         struct wpabuf *pending_phase2_eap_resp;
  58         int tnc_started;
  59 };
  60
  61
  62 static const char * eap_ttls_state_txt(int state)
  63 {
  64         switch (state) {
  65         case START:
  66                 return "START";
  67         case PHASE1:
  68                 return "PHASE1";
  69         case PHASE2_START:
  70                 return "PHASE2_START";
  71         case PHASE2_METHOD:
  72                 return "PHASE2_METHOD";
  73         case PHASE2_MSCHAPV2_RESP:
  74                 return "PHASE2_MSCHAPV2_RESP";
  75         case PHASE_FINISHED:
  76                 return "PHASE_FINISHED";
  77         case SUCCESS:
  78                 return "SUCCESS";
  79         case FAILURE:
  80                 return "FAILURE";
  81         default:
  82                 return "Unknown?!";
  83         }
  84 }
  85
  86
  87 static void eap_ttls_state(struct eap_ttls_data *data, int state)
  88 {
  89         wpa_printf(MSG_DEBUG, "EAP-TTLS: %s -> %s",
  90                    eap_ttls_state_txt(data->state),
  91                    eap_ttls_state_txt(state));
  92         data->state = state;
  93 }
  94
  95
  96 static u8 * eap_ttls_avp_hdr(u8 *avphdr, u32 avp_code, u32 vendor_id,
  97                              int mandatory, size_t len)
  98 {
  99         struct ttls_avp_vendor *avp;
 100         u8 flags;
 101         size_t hdrlen;
 102
 103         avp = (struct ttls_avp_vendor *) avphdr;
 104         flags = mandatory ? AVP_FLAGS_MANDATORY : 0;
 105         if (vendor_id) {
 106                 flags |= AVP_FLAGS_VENDOR;
 107                 hdrlen = sizeof(*avp);
 108                 avp->vendor_id = host_to_be32(vendor_id);
 109         } else {
 110                 hdrlen = sizeof(struct ttls_avp);
 111         }
 112
 113         avp->avp_code = host_to_be32(avp_code);
 114         avp->avp_length = host_to_be32((flags << 24) | (hdrlen + len));
 115
 116         return avphdr + hdrlen;
 117 }
 118
 119
 120 static struct wpabuf * eap_ttls_avp_encapsulate(struct wpabuf *resp,
 121                                                 u32 avp_code, int mandatory)
 122 {
 123         struct wpabuf *avp;
 124         u8 *pos;
 125
 126         avp = wpabuf_alloc(sizeof(struct ttls_avp) + wpabuf_len(resp) + 4);
 127         if (avp == NULL) {
 128                 wpabuf_free(resp);
 129                 return NULL;
 130         }
 131
 132         pos = eap_ttls_avp_hdr(wpabuf_mhead(avp), avp_code, 0, mandatory,
 133                                wpabuf_len(resp));
 134         os_memcpy(pos, wpabuf_head(resp), wpabuf_len(resp));
 135         pos += wpabuf_len(resp);
 136         AVP_PAD((const u8 *) wpabuf_head(avp), pos);
 137         wpabuf_free(resp);
 138         wpabuf_put(avp, pos - (u8 *) wpabuf_head(avp));
 139         return avp;
 140 }
 141
 142
 143 struct eap_ttls_avp {
 144          /* Note: eap is allocated memory; caller is responsible for freeing
 145           * it. All the other pointers are pointing to the packet data, i.e.,
 146           * they must not be freed separately. */
 147         u8 *eap;
 148         size_t eap_len;
 149         u8 *user_name;
 150         size_t user_name_len;
 151         u8 *user_password;
 152         size_t user_password_len;
 153         u8 *chap_challenge;
 154         size_t chap_challenge_len;
 155         u8 *chap_password;
 156         size_t chap_password_len;
 157         u8 *mschap_challenge;
 158         size_t mschap_challenge_len;
 159         u8 *mschap_response;
 160         size_t mschap_response_len;
 161         u8 *mschap2_response;
 162         size_t mschap2_response_len;
 163 };
 164
 165
 166 static int eap_ttls_avp_parse(u8 *buf, size_t len, struct eap_ttls_avp *parse)
 167 {
 168         struct ttls_avp *avp;
 169         u8 *pos;
 170         int left;
 171
 172         pos = buf;
 173         left = len;
 174         os_memset(parse, 0, sizeof(*parse));
 175
 176         while (left > 0) {
 177                 u32 avp_code, avp_length, vendor_id = 0;
 178                 u8 avp_flags, *dpos;
 179                 size_t pad, dlen;
 180                 avp = (struct ttls_avp *) pos;
 181                 avp_code = be_to_host32(avp->avp_code);
 182                 avp_length = be_to_host32(avp->avp_length);
 183                 avp_flags = (avp_length >> 24) & 0xff;
 184                 avp_length &= 0xffffff;
 185                 wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP: code=%d flags=0x%02x "
 186                            "length=%d", (int) avp_code, avp_flags,
 187                            (int) avp_length);
 188                 if ((int) avp_length > left) {
 189                         wpa_printf(MSG_WARNING, "EAP-TTLS: AVP overflow "
 190                                    "(len=%d, left=%d) - dropped",
 191                                    (int) avp_length, left);
 192                         goto fail;
 193                 }
 194                 if (avp_length < sizeof(*avp)) {
 195                         wpa_printf(MSG_WARNING, "EAP-TTLS: Invalid AVP length "
 196                                    "%d", avp_length);
 197                         goto fail;
 198                 }
 199                 dpos = (u8 *) (avp + 1);
 200                 dlen = avp_length - sizeof(*avp);
 201                 if (avp_flags & AVP_FLAGS_VENDOR) {
 202                         if (dlen < 4) {
 203                                 wpa_printf(MSG_WARNING, "EAP-TTLS: vendor AVP "
 204                                            "underflow");
 205                                 goto fail;
 206                         }
 207                         vendor_id = be_to_host32(* (be32 *) dpos);
 208                         wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP vendor_id %d",
 209                                    (int) vendor_id);
 210                         dpos += 4;
 211                         dlen -= 4;
 212                 }
 213
 214                 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: AVP data", dpos, dlen);
 215
 216                 if (vendor_id == 0 && avp_code == RADIUS_ATTR_EAP_MESSAGE) {
 217                         wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP - EAP Message");
 218                         if (parse->eap == NULL) {
 219                                 parse->eap = os_malloc(dlen);
 220                                 if (parse->eap == NULL) {
 221                                         wpa_printf(MSG_WARNING, "EAP-TTLS: "
 222                                                    "failed to allocate memory "
 223                                                    "for Phase 2 EAP data");
 224                                         goto fail;
 225                                 }
 226                                 os_memcpy(parse->eap, dpos, dlen);
 227                                 parse->eap_len = dlen;
 228                         } else {
 229                                 u8 *neweap = os_realloc(parse->eap,
 230                                                         parse->eap_len + dlen);
 231                                 if (neweap == NULL) {
 232                                         wpa_printf(MSG_WARNING, "EAP-TTLS: "
 233                                                    "failed to allocate memory "
 234                                                    "for Phase 2 EAP data");
 235                                         goto fail;
 236                                 }
 237                                 os_memcpy(neweap + parse->eap_len, dpos, dlen);
 238                                 parse->eap = neweap;
 239                                 parse->eap_len += dlen;
 240                         }
 241                 } else if (vendor_id == 0 &&
 242                            avp_code == RADIUS_ATTR_USER_NAME) {
 243                         wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: User-Name",
 244                                           dpos, dlen);
 245                         parse->user_name = dpos;
 246                         parse->user_name_len = dlen;
 247                 } else if (vendor_id == 0 &&
 248                            avp_code == RADIUS_ATTR_USER_PASSWORD) {
 249                         u8 *password = dpos;
 250                         size_t password_len = dlen;
 251                         while (password_len > 0 &&
 252                                password[password_len - 1] == '\0') {
 253                                 password_len--;
 254                         }
 255                         wpa_hexdump_ascii_key(MSG_DEBUG, "EAP-TTLS: "
 256                                               "User-Password (PAP)",
 257                                               password, password_len);
 258                         parse->user_password = password;
 259                         parse->user_password_len = password_len;
 260                 } else if (vendor_id == 0 &&
 261                            avp_code == RADIUS_ATTR_CHAP_CHALLENGE) {
 262                         wpa_hexdump(MSG_DEBUG,
 263                                     "EAP-TTLS: CHAP-Challenge (CHAP)",
 264                                     dpos, dlen);
 265                         parse->chap_challenge = dpos;
 266                         parse->chap_challenge_len = dlen;
 267                 } else if (vendor_id == 0 &&
 268                            avp_code == RADIUS_ATTR_CHAP_PASSWORD) {
 269                         wpa_hexdump(MSG_DEBUG,
 270                                     "EAP-TTLS: CHAP-Password (CHAP)",
 271                                     dpos, dlen);
 272                         parse->chap_password = dpos;
 273                         parse->chap_password_len = dlen;
 274                 } else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT &&
 275                            avp_code == RADIUS_ATTR_MS_CHAP_CHALLENGE) {
 276                         wpa_hexdump(MSG_DEBUG,
 277                                     "EAP-TTLS: MS-CHAP-Challenge",
 278                                     dpos, dlen);
 279                         parse->mschap_challenge = dpos;
 280                         parse->mschap_challenge_len = dlen;
 281                 } else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT &&
 282                            avp_code == RADIUS_ATTR_MS_CHAP_RESPONSE) {
 283                         wpa_hexdump(MSG_DEBUG,
 284                                     "EAP-TTLS: MS-CHAP-Response (MSCHAP)",
 285                                     dpos, dlen);
 286                         parse->mschap_response = dpos;
 287                         parse->mschap_response_len = dlen;
 288                 } else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT &&
 289                            avp_code == RADIUS_ATTR_MS_CHAP2_RESPONSE) {
 290                         wpa_hexdump(MSG_DEBUG,
 291                                     "EAP-TTLS: MS-CHAP2-Response (MSCHAPV2)",
 292                                     dpos, dlen);
 293                         parse->mschap2_response = dpos;
 294                         parse->mschap2_response_len = dlen;
 295                 } else if (avp_flags & AVP_FLAGS_MANDATORY) {
 296                         wpa_printf(MSG_WARNING, "EAP-TTLS: Unsupported "
 297                                    "mandatory AVP code %d vendor_id %d - "
 298                                    "dropped", (int) avp_code, (int) vendor_id);
 299                         goto fail;
 300                 } else {
 301                         wpa_printf(MSG_DEBUG, "EAP-TTLS: Ignoring unsupported "
 302                                    "AVP code %d vendor_id %d",
 303                                    (int) avp_code, (int) vendor_id);
 304                 }
 305
 306                 pad = (4 - (avp_length & 3)) & 3;
 307                 pos += avp_length + pad;
 308                 left -= avp_length + pad;
 309         }
 310
 311         return 0;
 312
 313 fail:
 314         os_free(parse->eap);
 315         parse->eap = NULL;
 316         return -1;
 317 }
 318
 319
 320 static u8 * eap_ttls_implicit_challenge(struct eap_sm *sm,
 321                                         struct eap_ttls_data *data, size_t len)
 322 {
 323         struct tls_keys keys;
 324         u8 *challenge, *rnd;
 325
 326         if (data->ttls_version == 0) {
 327                 return eap_server_tls_derive_key(sm, &data->ssl,
 328                                                  "ttls challenge", len);
 329         }
 330
 331         os_memset(&keys, 0, sizeof(keys));
 332         if (tls_connection_get_keys(sm->ssl_ctx, data->ssl.conn, &keys) ||
 333             keys.client_random == NULL || keys.server_random == NULL ||
 334             keys.inner_secret == NULL) {
 335                 wpa_printf(MSG_INFO, "EAP-TTLS: Could not get inner secret, "
 336                            "client random, or server random to derive "
 337                            "implicit challenge");
 338                 return NULL;
 339         }
 340
 341         rnd = os_malloc(keys.client_random_len + keys.server_random_len);
 342         challenge = os_malloc(len);
 343         if (rnd == NULL || challenge == NULL) {
 344                 wpa_printf(MSG_INFO, "EAP-TTLS: No memory for implicit "
 345                            "challenge derivation");
 346                 os_free(rnd);
 347                 os_free(challenge);
 348                 return NULL;
 349         }
 350         os_memcpy(rnd, keys.server_random, keys.server_random_len);
 351         os_memcpy(rnd + keys.server_random_len, keys.client_random,
 352                   keys.client_random_len);
 353
 354         if (tls_prf(keys.inner_secret, keys.inner_secret_len,
 355                     "inner application challenge", rnd,
 356                     keys.client_random_len + keys.server_random_len,
 357                     challenge, len)) {
 358                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Failed to derive implicit "
 359                            "challenge");
 360                 os_free(rnd);
 361                 os_free(challenge);
 362                 return NULL;
 363         }
 364
 365         os_free(rnd);
 366
 367         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived implicit challenge",
 368                         challenge, len);
 369
 370         return challenge;
 371 }
 372
 373
 374 static void * eap_ttls_init(struct eap_sm *sm)
 375 {
 376         struct eap_ttls_data *data;
 377
 378         data = os_zalloc(sizeof(*data));
 379         if (data == NULL)
 380                 return NULL;
 381         data->ttls_version = EAP_TTLS_VERSION;
 382         data->force_version = -1;
 383         if (sm->user && sm->user->force_version >= 0) {
 384                 data->force_version = sm->user->force_version;
 385                 wpa_printf(MSG_DEBUG, "EAP-TTLS: forcing version %d",
 386                            data->force_version);
 387                 data->ttls_version = data->force_version;
 388         }
 389         data->state = START;
 390
 391         if (!(tls_capabilities(sm->ssl_ctx) & TLS_CAPABILITY_IA) &&
 392             data->ttls_version > 0) {
 393                 if (data->force_version > 0) {
 394                         wpa_printf(MSG_INFO, "EAP-TTLS: Forced TTLSv%d and "
 395                                    "TLS library does not support TLS/IA.",
 396                                    data->force_version);
 397                         eap_ttls_reset(sm, data);
 398                         return NULL;
 399                 }
 400                 data->ttls_version = 0;
 401         }
 402
 403         if (eap_server_tls_ssl_init(sm, &data->ssl, 0)) {
 404                 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to initialize SSL.");
 405                 eap_ttls_reset(sm, data);
 406                 return NULL;
 407         }
 408
 409         return data;
 410 }
 411
 412
 413 static void eap_ttls_reset(struct eap_sm *sm, void *priv)
 414 {
 415         struct eap_ttls_data *data = priv;
 416         if (data == NULL)
 417                 return;
 418         if (data->phase2_priv && data->phase2_method)
 419                 data->phase2_method->reset(sm, data->phase2_priv);
 420         eap_server_tls_ssl_deinit(sm, &data->ssl);
 421         wpabuf_free(data->pending_phase2_eap_resp);
 422         os_free(data);
 423 }
 424
 425
 426 static struct wpabuf * eap_ttls_build_start(struct eap_sm *sm,
 427                                             struct eap_ttls_data *data, u8 id)
 428 {
 429         struct wpabuf *req;
 430
 431         req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_TTLS, 1,
 432                             EAP_CODE_REQUEST, id);
 433         if (req == NULL) {
 434                 wpa_printf(MSG_ERROR, "EAP-TTLS: Failed to allocate memory for"
 435                            " request");
 436                 eap_ttls_state(data, FAILURE);
 437                 return NULL;
 438         }
 439
 440         wpabuf_put_u8(req, EAP_TLS_FLAGS_START | data->ttls_version);
 441
 442         eap_ttls_state(data, PHASE1);
 443
 444         return req;
 445 }
 446
 447
 448 static struct wpabuf * eap_ttls_build_phase2_eap_req(
 449         struct eap_sm *sm, struct eap_ttls_data *data, u8 id)
 450 {
 451         struct wpabuf *buf, *encr_req;
 452         u8 *req;
 453         size_t req_len;
 454
 455
 456         buf = data->phase2_method->buildReq(sm, data->phase2_priv, id);
 457         if (buf == NULL)
 458                 return NULL;
 459
 460         wpa_hexdump_buf_key(MSG_DEBUG,
 461                             "EAP-TTLS/EAP: Encapsulate Phase 2 data", buf);
 462
 463         buf = eap_ttls_avp_encapsulate(buf, RADIUS_ATTR_EAP_MESSAGE, 1);
 464         if (buf == NULL) {
 465                 wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: Failed to encapsulate "
 466                            "packet");
 467                 return NULL;
 468         }
 469
 470         req = wpabuf_mhead(buf);
 471         req_len = wpabuf_len(buf);
 472         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS/EAP: Encrypt encapsulated Phase "
 473                         "2 data", req, req_len);
 474
 475         encr_req = eap_server_tls_encrypt(sm, &data->ssl, req, req_len);
 476         wpabuf_free(buf);
 477
 478         return encr_req;
 479 }
 480
 481
 482 static struct wpabuf * eap_ttls_build_phase2_mschapv2(
 483         struct eap_sm *sm, struct eap_ttls_data *data)
 484 {
 485         struct wpabuf *encr_req;
 486         u8 *req, *pos, *end;
 487         int ret;
 488         size_t req_len;
 489
 490         pos = req = os_malloc(100);
 491         if (req == NULL)
 492                 return NULL;
 493         end = req + 100;
 494
 495         if (data->mschapv2_resp_ok) {
 496                 pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP2_SUCCESS,
 497                                        RADIUS_VENDOR_ID_MICROSOFT, 1, 43);
 498                 *pos++ = data->mschapv2_ident;
 499                 ret = os_snprintf((char *) pos, end - pos, "S=");
 500                 if (ret >= 0 && ret < end - pos)
 501                         pos += ret;
 502                 pos += wpa_snprintf_hex_uppercase(
 503                         (char *) pos, end - pos, data->mschapv2_auth_response,
 504                         sizeof(data->mschapv2_auth_response));
 505         } else {
 506                 pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP_ERROR,
 507                                        RADIUS_VENDOR_ID_MICROSOFT, 1, 6);
 508                 os_memcpy(pos, "Failed", 6);
 509                 pos += 6;
 510                 AVP_PAD(req, pos);
 511         }
 512
 513         req_len = pos - req;
 514         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Encrypting Phase 2 "
 515                         "data", req, req_len);
 516
 517         encr_req = eap_server_tls_encrypt(sm, &data->ssl, req, req_len);
 518         os_free(req);
 519
 520         return encr_req;
 521 }
 522
 523
 524 static struct wpabuf * eap_ttls_build_phase_finished(
 525         struct eap_sm *sm, struct eap_ttls_data *data, int final)
 526 {
 527         int len;
 528         struct wpabuf *req;
 529         const int max_len = 300;
 530
 531         req = wpabuf_alloc(max_len);
 532         if (req == NULL)
 533                 return NULL;
 534
 535         len = tls_connection_ia_send_phase_finished(sm->ssl_ctx,
 536                                                     data->ssl.conn, final,
 537                                                     wpabuf_mhead(req),
 538                                                     max_len);
 539         if (len < 0) {
 540                 wpabuf_free(req);
 541                 return NULL;
 542         }
 543         wpabuf_put(req, len);
 544
 545         return req;
 546 }
 547
 548
 549 static struct wpabuf * eap_ttls_buildReq(struct eap_sm *sm, void *priv, u8 id)
 550 {
 551         struct eap_ttls_data *data = priv;
 552
 553         if (data->ssl.state == FRAG_ACK) {
 554                 return eap_server_tls_build_ack(id, EAP_TYPE_TTLS,
 555                                                 data->ttls_version);
 556         }
 557
 558         if (data->ssl.state == WAIT_FRAG_ACK) {
 559                 return eap_server_tls_build_msg(&data->ssl, EAP_TYPE_TTLS,
 560                                                 data->ttls_version, id);
 561         }
 562
 563         switch (data->state) {
 564         case START:
 565                 return eap_ttls_build_start(sm, data, id);
 566         case PHASE1:
 567                 if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) {
 568                         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase1 done, "
 569                                    "starting Phase2");
 570                         eap_ttls_state(data, PHASE2_START);
 571                 }
 572                 break;
 573         case PHASE2_METHOD:
 574                 wpabuf_free(data->ssl.out_buf);
 575                 data->ssl.out_used = 0;
 576                 data->ssl.out_buf = eap_ttls_build_phase2_eap_req(sm, data,
 577                                                                   id);
 578                 break;
 579         case PHASE2_MSCHAPV2_RESP:
 580                 wpabuf_free(data->ssl.out_buf);
 581                 data->ssl.out_used = 0;
 582                 data->ssl.out_buf = eap_ttls_build_phase2_mschapv2(sm, data);
 583                 break;
 584         case PHASE_FINISHED:
 585                 wpabuf_free(data->ssl.out_buf);
 586                 data->ssl.out_used = 0;
 587                 data->ssl.out_buf = eap_ttls_build_phase_finished(sm, data, 1);
 588                 break;
 589         default:
 590                 wpa_printf(MSG_DEBUG, "EAP-TTLS: %s - unexpected state %d",
 591                            __func__, data->state);
 592                 return NULL;
 593         }
 594
 595         return eap_server_tls_build_msg(&data->ssl, EAP_TYPE_TTLS,
 596                                         data->ttls_version, id);
 597 }
 598
 599
 600 static Boolean eap_ttls_check(struct eap_sm *sm, void *priv,
 601                               struct wpabuf *respData)
 602 {
 603         const u8 *pos;
 604         size_t len;
 605
 606         pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_TTLS, respData, &len);
 607         if (pos == NULL || len < 1) {
 608                 wpa_printf(MSG_INFO, "EAP-TTLS: Invalid frame");
 609                 return TRUE;
 610         }
 611
 612         return FALSE;
 613 }
 614
 615
 616 static int eap_ttls_ia_permute_inner_secret(struct eap_sm *sm,
 617                                             struct eap_ttls_data *data,
 618                                             const u8 *key, size_t key_len)
 619 {
 620         u8 *buf;
 621         size_t buf_len;
 622         int ret;
 623
 624         if (key) {
 625                 buf_len = 2 + key_len;
 626                 buf = os_malloc(buf_len);
 627                 if (buf == NULL)
 628                         return -1;
 629                 WPA_PUT_BE16(buf, key_len);
 630                 os_memcpy(buf + 2, key, key_len);
 631         } else {
 632                 buf = NULL;
 633                 buf_len = 0;
 634         }
 635
 636         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Session keys for TLS/IA inner "
 637                         "secret permutation", buf, buf_len);
 638         ret = tls_connection_ia_permute_inner_secret(sm->ssl_ctx,
 639                                                      data->ssl.conn,
 640                                                      buf, buf_len);
 641         os_free(buf);
 642
 643         return ret;
 644 }
 645
 646
 647 static void eap_ttls_process_phase2_pap(struct eap_sm *sm,
 648                                         struct eap_ttls_data *data,
 649                                         const u8 *user_password,
 650                                         size_t user_password_len)
 651 {
 652         if (!sm->user || !sm->user->password || sm->user->password_hash ||
 653             !(sm->user->ttls_auth & EAP_TTLS_AUTH_PAP)) {
 654                 wpa_printf(MSG_DEBUG, "EAP-TTLS/PAP: No plaintext user "
 655                            "password configured");
 656                 eap_ttls_state(data, FAILURE);
 657                 return;
 658         }
 659
 660         if (sm->user->password_len != user_password_len ||
 661             os_memcmp(sm->user->password, user_password, user_password_len) !=
 662             0) {
 663                 wpa_printf(MSG_DEBUG, "EAP-TTLS/PAP: Invalid user password");
 664                 eap_ttls_state(data, FAILURE);
 665                 return;
 666         }
 667
 668         wpa_printf(MSG_DEBUG, "EAP-TTLS/PAP: Correct user password");
 669         eap_ttls_state(data, data->ttls_version > 0 ? PHASE_FINISHED :
 670                        SUCCESS);
 671 }
 672
 673
 674 static void eap_ttls_process_phase2_chap(struct eap_sm *sm,
 675                                          struct eap_ttls_data *data,
 676                                          const u8 *challenge,
 677                                          size_t challenge_len,
 678                                          const u8 *password,
 679                                          size_t password_len)
 680 {
 681         u8 *chal, hash[CHAP_MD5_LEN];
 682
 683         if (challenge == NULL || password == NULL ||
 684             challenge_len != EAP_TTLS_CHAP_CHALLENGE_LEN ||
 685             password_len != 1 + EAP_TTLS_CHAP_PASSWORD_LEN) {
 686                 wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP: Invalid CHAP attributes "
 687                            "(challenge len %lu password len %lu)",
 688                            (unsigned long) challenge_len,
 689                            (unsigned long) password_len);
 690                 eap_ttls_state(data, FAILURE);
 691                 return;
 692         }
 693
 694         if (!sm->user || !sm->user->password || sm->user->password_hash ||
 695             !(sm->user->ttls_auth & EAP_TTLS_AUTH_CHAP)) {
 696                 wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP: No plaintext user "
 697                            "password configured");
 698                 eap_ttls_state(data, FAILURE);
 699                 return;
 700         }
 701
 702         chal = eap_ttls_implicit_challenge(sm, data,
 703                                            EAP_TTLS_CHAP_CHALLENGE_LEN + 1);
 704         if (chal == NULL) {
 705                 wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP: Failed to generate "
 706                            "challenge from TLS data");
 707                 eap_ttls_state(data, FAILURE);
 708                 return;
 709         }
 710
 711         if (os_memcmp(challenge, chal, EAP_TTLS_CHAP_CHALLENGE_LEN) != 0 ||
 712             password[0] != chal[EAP_TTLS_CHAP_CHALLENGE_LEN]) {
 713                 wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP: Challenge mismatch");
 714                 os_free(chal);
 715                 eap_ttls_state(data, FAILURE);
 716                 return;
 717         }
 718         os_free(chal);
 719
 720         /* MD5(Ident + Password + Challenge) */
 721         chap_md5(password[0], sm->user->password, sm->user->password_len,
 722                  challenge, challenge_len, hash);
 723
 724         if (os_memcmp(hash, password + 1, EAP_TTLS_CHAP_PASSWORD_LEN) == 0) {
 725                 wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP: Correct user password");
 726                 eap_ttls_state(data, data->ttls_version > 0 ? PHASE_FINISHED :
 727                                SUCCESS);
 728         } else {
 729                 wpa_printf(MSG_DEBUG, "EAP-TTLS/CHAP: Invalid user password");
 730                 eap_ttls_state(data, FAILURE);
 731         }
 732 }
 733
 734
 735 static void eap_ttls_process_phase2_mschap(struct eap_sm *sm,
 736                                            struct eap_ttls_data *data,
 737                                            u8 *challenge, size_t challenge_len,
 738                                            u8 *response, size_t response_len)
 739 {
 740         u8 *chal, nt_response[24];
 741
 742         if (challenge == NULL || response == NULL ||
 743             challenge_len != EAP_TTLS_MSCHAP_CHALLENGE_LEN ||
 744             response_len != EAP_TTLS_MSCHAP_RESPONSE_LEN) {
 745                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP: Invalid MS-CHAP "
 746                            "attributes (challenge len %lu response len %lu)",
 747                            (unsigned long) challenge_len,
 748                            (unsigned long) response_len);
 749                 eap_ttls_state(data, FAILURE);
 750                 return;
 751         }
 752
 753         if (!sm->user || !sm->user->password ||
 754             !(sm->user->ttls_auth & EAP_TTLS_AUTH_MSCHAP)) {
 755                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP: No user password "
 756                            "configured");
 757                 eap_ttls_state(data, FAILURE);
 758                 return;
 759         }
 760
 761         chal = eap_ttls_implicit_challenge(sm, data,
 762                                            EAP_TTLS_MSCHAP_CHALLENGE_LEN + 1);
 763         if (chal == NULL) {
 764                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP: Failed to generate "
 765                            "challenge from TLS data");
 766                 eap_ttls_state(data, FAILURE);
 767                 return;
 768         }
 769
 770         if (os_memcmp(challenge, chal, EAP_TTLS_MSCHAP_CHALLENGE_LEN) != 0 ||
 771             response[0] != chal[EAP_TTLS_MSCHAP_CHALLENGE_LEN]) {
 772                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP: Challenge mismatch");
 773                 os_free(chal);
 774                 eap_ttls_state(data, FAILURE);
 775                 return;
 776         }
 777         os_free(chal);
 778
 779         if (sm->user->password_hash)
 780                 challenge_response(challenge, sm->user->password, nt_response);
 781         else
 782                 nt_challenge_response(challenge, sm->user->password,
 783                                       sm->user->password_len, nt_response);
 784
 785         if (os_memcmp(nt_response, response + 2 + 24, 24) == 0) {
 786                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP: Correct response");
 787                 eap_ttls_state(data, data->ttls_version > 0 ? PHASE_FINISHED :
 788                                SUCCESS);
 789         } else {
 790                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAP: Invalid NT-Response");
 791                 wpa_hexdump(MSG_MSGDUMP, "EAP-TTLS/MSCHAP: Received",
 792                             response + 2 + 24, 24);
 793                 wpa_hexdump(MSG_MSGDUMP, "EAP-TTLS/MSCHAP: Expected",
 794                             nt_response, 24);
 795                 eap_ttls_state(data, FAILURE);
 796         }
 797 }
 798
 799
 800 static void eap_ttls_process_phase2_mschapv2(struct eap_sm *sm,
 801                                              struct eap_ttls_data *data,
 802                                              u8 *challenge,
 803                                              size_t challenge_len,
 804                                              u8 *response, size_t response_len)
 805 {
 806         u8 *chal, *username, nt_response[24], *rx_resp, *peer_challenge,
 807                 *auth_challenge;
 808         size_t username_len, i;
 809
 810         if (challenge == NULL || response == NULL ||
 811             challenge_len != EAP_TTLS_MSCHAPV2_CHALLENGE_LEN ||
 812             response_len != EAP_TTLS_MSCHAPV2_RESPONSE_LEN) {
 813                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Invalid MS-CHAP2 "
 814                            "attributes (challenge len %lu response len %lu)",
 815                            (unsigned long) challenge_len,
 816                            (unsigned long) response_len);
 817                 eap_ttls_state(data, FAILURE);
 818                 return;
 819         }
 820
 821         if (!sm->user || !sm->user->password ||
 822             !(sm->user->ttls_auth & EAP_TTLS_AUTH_MSCHAPV2)) {
 823                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: No user password "
 824                            "configured");
 825                 eap_ttls_state(data, FAILURE);
 826                 return;
 827         }
 828
 829         /* MSCHAPv2 does not include optional domain name in the
 830          * challenge-response calculation, so remove domain prefix
 831          * (if present). */
 832         username = sm->identity;
 833         username_len = sm->identity_len;
 834         for (i = 0; i < username_len; i++) {
 835                 if (username[i] == '\\') {
 836                         username_len -= i + 1;
 837                         username += i + 1;
 838                         break;
 839                 }
 840         }
 841
 842         chal = eap_ttls_implicit_challenge(
 843                 sm, data, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN + 1);
 844         if (chal == NULL) {
 845                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Failed to generate "
 846                            "challenge from TLS data");
 847                 eap_ttls_state(data, FAILURE);
 848                 return;
 849         }
 850
 851         if (os_memcmp(challenge, chal, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN) != 0 ||
 852             response[0] != chal[EAP_TTLS_MSCHAPV2_CHALLENGE_LEN]) {
 853                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Challenge mismatch");
 854                 os_free(chal);
 855                 eap_ttls_state(data, FAILURE);
 856                 return;
 857         }
 858         os_free(chal);
 859
 860         auth_challenge = challenge;
 861         peer_challenge = response + 2;
 862
 863         wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-TTLS/MSCHAPV2: User",
 864                           username, username_len);
 865         wpa_hexdump(MSG_MSGDUMP, "EAP-TTLS/MSCHAPV2: auth_challenge",
 866                     auth_challenge, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN);
 867         wpa_hexdump(MSG_MSGDUMP, "EAP-TTLS/MSCHAPV2: peer_challenge",
 868                     peer_challenge, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN);
 869
 870         if (sm->user->password_hash) {
 871                 generate_nt_response_pwhash(auth_challenge, peer_challenge,
 872                                             username, username_len,
 873                                             sm->user->password,
 874                                             nt_response);
 875         } else {
 876                 generate_nt_response(auth_challenge, peer_challenge,
 877                                      username, username_len,
 878                                      sm->user->password,
 879                                      sm->user->password_len,
 880                                      nt_response);
 881         }
 882
 883         rx_resp = response + 2 + EAP_TTLS_MSCHAPV2_CHALLENGE_LEN + 8;
 884         if (os_memcmp(nt_response, rx_resp, 24) == 0) {
 885                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Correct "
 886                            "NT-Response");
 887                 data->mschapv2_resp_ok = 1;
 888                 if (data->ttls_version > 0) {
 889                         const u8 *pw_hash;
 890                         u8 pw_hash_buf[16], pw_hash_hash[16], master_key[16];
 891                         u8 session_key[2 * MSCHAPV2_KEY_LEN];
 892
 893                         if (sm->user->password_hash)
 894                                 pw_hash = sm->user->password;
 895                         else {
 896                                 nt_password_hash(sm->user->password,
 897                                                  sm->user->password_len,
 898                                                  pw_hash_buf);
 899                                 pw_hash = pw_hash_buf;
 900                         }
 901                         hash_nt_password_hash(pw_hash, pw_hash_hash);
 902                         get_master_key(pw_hash_hash, nt_response, master_key);
 903                         get_asymetric_start_key(master_key, session_key,
 904                                                 MSCHAPV2_KEY_LEN, 0, 0);
 905                         get_asymetric_start_key(master_key,
 906                                                 session_key + MSCHAPV2_KEY_LEN,
 907                                                 MSCHAPV2_KEY_LEN, 1, 0);
 908                         eap_ttls_ia_permute_inner_secret(sm, data,
 909                                                          session_key,
 910                                                          sizeof(session_key));
 911                 }
 912
 913                 if (sm->user->password_hash) {
 914                         generate_authenticator_response_pwhash(
 915                                 sm->user->password,
 916                                 peer_challenge, auth_challenge,
 917                                 username, username_len, nt_response,
 918                                 data->mschapv2_auth_response);
 919                 } else {
 920                         generate_authenticator_response(
 921                                 sm->user->password, sm->user->password_len,
 922                                 peer_challenge, auth_challenge,
 923                                 username, username_len, nt_response,
 924                                 data->mschapv2_auth_response);
 925                 }
 926         } else {
 927                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Invalid "
 928                            "NT-Response");
 929                 wpa_hexdump(MSG_MSGDUMP, "EAP-TTLS/MSCHAPV2: Received",
 930                             rx_resp, 24);
 931                 wpa_hexdump(MSG_MSGDUMP, "EAP-TTLS/MSCHAPV2: Expected",
 932                             nt_response, 24);
 933                 data->mschapv2_resp_ok = 0;
 934         }
 935         eap_ttls_state(data, PHASE2_MSCHAPV2_RESP);
 936         data->mschapv2_ident = response[0];
 937 }
 938
 939
 940 static int eap_ttls_phase2_eap_init(struct eap_sm *sm,
 941                                     struct eap_ttls_data *data,
 942                                     EapType eap_type)
 943 {
 944         if (data->phase2_priv && data->phase2_method) {
 945                 data->phase2_method->reset(sm, data->phase2_priv);
 946                 data->phase2_method = NULL;
 947                 data->phase2_priv = NULL;
 948         }
 949         data->phase2_method = eap_server_get_eap_method(EAP_VENDOR_IETF,
 950                                                         eap_type);
 951         if (!data->phase2_method)
 952                 return -1;
 953
 954         sm->init_phase2 = 1;
 955         data->phase2_priv = data->phase2_method->init(sm);
 956         sm->init_phase2 = 0;
 957         return 0;
 958 }
 959
 960
 961 static void eap_ttls_process_phase2_eap_response(struct eap_sm *sm,
 962                                                  struct eap_ttls_data *data,
 963                                                  u8 *in_data, size_t in_len)
 964 {
 965         u8 next_type = EAP_TYPE_NONE;
 966         struct eap_hdr *hdr;
 967         u8 *pos;
 968         size_t left;
 969         struct wpabuf buf;
 970         const struct eap_method *m = data->phase2_method;
 971         void *priv = data->phase2_priv;
 972
 973         if (priv == NULL) {
 974                 wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: %s - Phase2 not "
 975                            "initialized?!", __func__);
 976                 return;
 977         }
 978
 979         hdr = (struct eap_hdr *) in_data;
 980         pos = (u8 *) (hdr + 1);
 981
 982         if (in_len > sizeof(*hdr) && *pos == EAP_TYPE_NAK) {
 983                 left = in_len - sizeof(*hdr);
 984                 wpa_hexdump(MSG_DEBUG, "EAP-TTLS/EAP: Phase2 type Nak'ed; "
 985                             "allowed types", pos + 1, left - 1);
 986                 eap_sm_process_nak(sm, pos + 1, left - 1);
 987                 if (sm->user && sm->user_eap_method_index < EAP_MAX_METHODS &&
 988                     sm->user->methods[sm->user_eap_method_index].method !=
 989                     EAP_TYPE_NONE) {
 990                         next_type = sm->user->methods[
 991                                 sm->user_eap_method_index++].method;
 992                         wpa_printf(MSG_DEBUG, "EAP-TTLS: try EAP type %d",
 993                                    next_type);
 994                         eap_ttls_phase2_eap_init(sm, data, next_type);
 995                 } else {
 996                         eap_ttls_state(data, FAILURE);
 997                 }
 998                 return;
 999         }
1000
1001         wpabuf_set(&buf, in_data, in_len);
1002
1003         if (m->check(sm, priv, &buf)) {
1004                 wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: Phase2 check() asked to "
1005                            "ignore the packet");
1006                 return;
1007         }
1008
1009         m->process(sm, priv, &buf);
1010
1011         if (sm->method_pending == METHOD_PENDING_WAIT) {
1012                 wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: Phase2 method is in "
1013                            "pending wait state - save decrypted response");
1014                 wpabuf_free(data->pending_phase2_eap_resp);
1015                 data->pending_phase2_eap_resp = wpabuf_dup(&buf);
1016         }
1017
1018         if (!m->isDone(sm, priv))
1019                 return;
1020
1021         if (!m->isSuccess(sm, priv)) {
1022                 wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: Phase2 method failed");
1023                 eap_ttls_state(data, FAILURE);
1024                 return;
1025         }
1026
1027         switch (data->state) {
1028         case PHASE2_START:
1029                 if (eap_user_get(sm, sm->identity, sm->identity_len, 1) != 0) {
1030                         wpa_hexdump_ascii(MSG_DEBUG, "EAP_TTLS: Phase2 "
1031                                           "Identity not found in the user "
1032                                           "database",
1033                                           sm->identity, sm->identity_len);
1034                         eap_ttls_state(data, FAILURE);
1035                         break;
1036                 }
1037
1038                 eap_ttls_state(data, PHASE2_METHOD);
1039                 next_type = sm->user->methods[0].method;
1040                 sm->user_eap_method_index = 1;
1041                 wpa_printf(MSG_DEBUG, "EAP-TTLS: try EAP type %d", next_type);
1042                 break;
1043         case PHASE2_METHOD:
1044                 if (data->ttls_version > 0) {
1045                         if (m->getKey) {
1046                                 u8 *key;
1047                                 size_t key_len;
1048                                 key = m->getKey(sm, priv, &key_len);
1049                                 eap_ttls_ia_permute_inner_secret(sm, data,
1050                                                                  key, key_len);
1051                         }
1052                         eap_ttls_state(data, PHASE_FINISHED);
1053                 } else
1054                         eap_ttls_state(data, SUCCESS);
1055                 break;
1056         case FAILURE:
1057                 break;
1058         default:
1059                 wpa_printf(MSG_DEBUG, "EAP-TTLS: %s - unexpected state %d",
1060                            __func__, data->state);
1061                 break;
1062         }
1063
1064         eap_ttls_phase2_eap_init(sm, data, next_type);
1065 }
1066
1067
1068 static void eap_ttls_process_phase2_eap(struct eap_sm *sm,
1069                                         struct eap_ttls_data *data,
1070                                         const u8 *eap, size_t eap_len)
1071 {
1072         struct eap_hdr *hdr;
1073         size_t len;
1074
1075         if (data->state == PHASE2_START) {
1076                 wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: initializing Phase 2");
1077                 if (eap_ttls_phase2_eap_init(sm, data, EAP_TYPE_IDENTITY) < 0)
1078                 {
1079                         wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: failed to "
1080                                    "initialize EAP-Identity");
1081                         return;
1082                 }
1083         }
1084
1085         if (eap_len < sizeof(*hdr)) {
1086                 wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: too short Phase 2 EAP "
1087                            "packet (len=%lu)", (unsigned long) eap_len);
1088                 return;
1089         }
1090
1091         hdr = (struct eap_hdr *) eap;
1092         len = be_to_host16(hdr->length);
1093         wpa_printf(MSG_DEBUG, "EAP-TTLS/EAP: received Phase 2 EAP: code=%d "
1094                    "identifier=%d length=%lu", hdr->code, hdr->identifier,
1095                    (unsigned long) len);
1096         if (len > eap_len) {
1097                 wpa_printf(MSG_INFO, "EAP-TTLS/EAP: Length mismatch in Phase 2"
1098                            " EAP frame (hdr len=%lu, data len in AVP=%lu)",
1099                            (unsigned long) len, (unsigned long) eap_len);
1100                 return;
1101         }
1102
1103         switch (hdr->code) {
1104         case EAP_CODE_RESPONSE:
1105                 eap_ttls_process_phase2_eap_response(sm, data, (u8 *) hdr,
1106                                                      len);
1107                 break;
1108         default:
1109                 wpa_printf(MSG_INFO, "EAP-TTLS/EAP: Unexpected code=%d in "
1110                            "Phase 2 EAP header", hdr->code);
1111                 break;
1112         }
1113 }
1114
1115
1116 static void eap_ttls_process_phase2(struct eap_sm *sm,
1117                                     struct eap_ttls_data *data,
1118                                     struct wpabuf *in_buf)
1119 {
1120         u8 *in_decrypted;
1121         int len_decrypted;
1122         struct eap_ttls_avp parse;
1123         size_t buf_len;
1124         u8 *in_data;
1125         size_t in_len;
1126
1127         in_data = wpabuf_mhead(in_buf);
1128         in_len = wpabuf_len(in_buf);
1129
1130         wpa_printf(MSG_DEBUG, "EAP-TTLS: received %lu bytes encrypted data for"
1131                    " Phase 2", (unsigned long) in_len);
1132
1133         if (data->pending_phase2_eap_resp) {
1134                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Pending Phase 2 EAP response "
1135                            "- skip decryption and use old data");
1136                 eap_ttls_process_phase2_eap(
1137                         sm, data, wpabuf_head(data->pending_phase2_eap_resp),
1138                         wpabuf_len(data->pending_phase2_eap_resp));
1139                 wpabuf_free(data->pending_phase2_eap_resp);
1140                 data->pending_phase2_eap_resp = NULL;
1141                 return;
1142         }
1143
1144         buf_len = in_len;
1145         /*
1146          * Even though we try to disable TLS compression, it is possible that
1147          * this cannot be done with all TLS libraries. Add extra buffer space
1148          * to handle the possibility of the decrypted data being longer than
1149          * input data.
1150          */
1151         buf_len += 500;
1152         buf_len *= 3;
1153         in_decrypted = os_malloc(buf_len);
1154         if (in_decrypted == NULL) {
1155                 wpa_printf(MSG_WARNING, "EAP-TTLS: failed to allocate memory "
1156                            "for decryption");
1157                 return;
1158         }
1159
1160         len_decrypted = tls_connection_decrypt(sm->ssl_ctx, data->ssl.conn,
1161                                                in_data, in_len,
1162                                                in_decrypted, buf_len);
1163         if (len_decrypted < 0) {
1164                 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to decrypt Phase 2 "
1165                            "data");
1166                 os_free(in_decrypted);
1167                 eap_ttls_state(data, FAILURE);
1168                 return;
1169         }
1170
1171         if (data->state == PHASE_FINISHED) {
1172                 if (len_decrypted == 0 &&
1173                     tls_connection_ia_final_phase_finished(sm->ssl_ctx,
1174                                                            data->ssl.conn)) {
1175                         wpa_printf(MSG_DEBUG, "EAP-TTLS: FinalPhaseFinished "
1176                                    "received");
1177                         eap_ttls_state(data, SUCCESS);
1178                 } else {
1179                         wpa_printf(MSG_INFO, "EAP-TTLS: Did not receive valid "
1180                                    "FinalPhaseFinished");
1181                         eap_ttls_state(data, FAILURE);
1182                 }
1183
1184                 os_free(in_decrypted);
1185                 return;
1186         }
1187
1188         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Decrypted Phase 2 EAP",
1189                         in_decrypted, len_decrypted);
1190
1191         if (eap_ttls_avp_parse(in_decrypted, len_decrypted, &parse) < 0) {
1192                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Failed to parse AVPs");
1193                 os_free(in_decrypted);
1194                 eap_ttls_state(data, FAILURE);
1195                 return;
1196         }
1197
1198         if (parse.user_name) {
1199                 os_free(sm->identity);
1200                 sm->identity = os_malloc(parse.user_name_len);
1201                 if (sm->identity) {
1202                         os_memcpy(sm->identity, parse.user_name,
1203                                   parse.user_name_len);
1204                         sm->identity_len = parse.user_name_len;
1205                 }
1206                 if (eap_user_get(sm, parse.user_name, parse.user_name_len, 1)
1207                     != 0) {
1208                         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase2 Identity not "
1209                                    "found in the user database");
1210                         eap_ttls_state(data, FAILURE);
1211                         goto done;
1212                 }
1213         }
1214
1215 #ifdef EAP_TNC
1216         if (data->tnc_started && parse.eap == NULL) {
1217                 wpa_printf(MSG_DEBUG, "EAP-TTLS: TNC started but no EAP "
1218                            "response from peer");
1219                 eap_ttls_state(data, FAILURE);
1220                 goto done;
1221         }
1222 #endif /* EAP_TNC */
1223
1224         if (parse.eap) {
1225                 eap_ttls_process_phase2_eap(sm, data, parse.eap,
1226                                             parse.eap_len);
1227         } else if (parse.user_password) {
1228                 eap_ttls_process_phase2_pap(sm, data, parse.user_password,
1229                                             parse.user_password_len);
1230         } else if (parse.chap_password) {
1231                 eap_ttls_process_phase2_chap(sm, data,
1232                                              parse.chap_challenge,
1233                                              parse.chap_challenge_len,
1234                                              parse.chap_password,
1235                                              parse.chap_password_len);
1236         } else if (parse.mschap_response) {
1237                 eap_ttls_process_phase2_mschap(sm, data,
1238                                                parse.mschap_challenge,
1239                                                parse.mschap_challenge_len,
1240                                                parse.mschap_response,
1241                                                parse.mschap_response_len);
1242         } else if (parse.mschap2_response) {
1243                 eap_ttls_process_phase2_mschapv2(sm, data,
1244                                                  parse.mschap_challenge,
1245                                                  parse.mschap_challenge_len,
1246                                                  parse.mschap2_response,
1247                                                  parse.mschap2_response_len);
1248         }
1249
1250 done:
1251         os_free(in_decrypted);
1252         os_free(parse.eap);
1253 }
1254
1255
1256 static void eap_ttls_start_tnc(struct eap_sm *sm, struct eap_ttls_data *data)
1257 {
1258 #ifdef EAP_TNC
1259         if (!sm->tnc || data->state != SUCCESS || data->tnc_started)
1260                 return;
1261
1262         wpa_printf(MSG_DEBUG, "EAP-TTLS: Initialize TNC");
1263         if (eap_ttls_phase2_eap_init(sm, data, EAP_TYPE_TNC)) {
1264                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Failed to initialize TNC");
1265                 eap_ttls_state(data, FAILURE);
1266                 return;
1267         }
1268
1269         data->tnc_started = 1;
1270         eap_ttls_state(data, PHASE2_METHOD);
1271 #endif /* EAP_TNC */
1272 }
1273
1274
1275 static void eap_ttls_process_version(struct eap_sm *sm,
1276                                      struct eap_ttls_data *data,
1277                                      int peer_version)
1278 {
1279         if (peer_version < data->ttls_version) {
1280                 wpa_printf(MSG_DEBUG, "EAP-TTLS: peer ver=%d, own ver=%d; "
1281                            "use version %d",
1282                            peer_version, data->ttls_version, peer_version);
1283                 data->ttls_version = peer_version;
1284         }
1285
1286         if (data->ttls_version > 0 && !data->tls_ia_configured) {
1287                 if (tls_connection_set_ia(sm->ssl_ctx, data->ssl.conn, 1)) {
1288                         wpa_printf(MSG_INFO, "EAP-TTLS: Failed to enable "
1289                                    "TLS/IA");
1290                         eap_ttls_state(data, FAILURE);
1291                         return;
1292                 }
1293                 data->tls_ia_configured = 1;
1294         }
1295 }
1296
1297
1298 static void eap_ttls_process(struct eap_sm *sm, void *priv,
1299                              struct wpabuf *respData)
1300 {
1301         struct eap_ttls_data *data = priv;
1302         const u8 *pos;
1303         u8 flags;
1304         size_t left;
1305         int ret;
1306
1307         pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_TTLS, respData,
1308                                &left);
1309         if (pos == NULL || left < 1)
1310                 return;
1311         flags = *pos++;
1312         left--;
1313         wpa_printf(MSG_DEBUG, "EAP-TTLS: Received packet(len=%lu) - "
1314                    "Flags 0x%02x", (unsigned long) wpabuf_len(respData),
1315                    flags);
1316
1317         eap_ttls_process_version(sm, data, flags & EAP_PEAP_VERSION_MASK);
1318
1319         ret = eap_server_tls_reassemble(&data->ssl, flags, &pos, &left);
1320         if (ret < 0) {
1321                 eap_ttls_state(data, FAILURE);
1322                 return;
1323         } else if (ret == 1)
1324                 return;
1325
1326         switch (data->state) {
1327         case PHASE1:
1328                 if (eap_server_tls_phase1(sm, &data->ssl) < 0)
1329                         eap_ttls_state(data, FAILURE);
1330                 break;
1331         case PHASE2_START:
1332         case PHASE2_METHOD:
1333         case PHASE_FINISHED:
1334                 eap_ttls_process_phase2(sm, data, data->ssl.in_buf);
1335                 eap_ttls_start_tnc(sm, data);
1336                 break;
1337         case PHASE2_MSCHAPV2_RESP:
1338                 if (data->mschapv2_resp_ok && left == 0) {
1339                         wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Peer "
1340                                    "acknowledged response");
1341                         eap_ttls_state(data, data->ttls_version > 0 ?
1342                                        PHASE_FINISHED : SUCCESS);
1343                 } else if (!data->mschapv2_resp_ok) {
1344                         wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Peer "
1345                                    "acknowledged error");
1346                         eap_ttls_state(data, FAILURE);
1347                 } else {
1348                         wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Unexpected "
1349                                    "frame from peer (payload len %lu, "
1350                                    "expected empty frame)",
1351                                    (unsigned long) left);
1352                         eap_ttls_state(data, FAILURE);
1353                 }
1354                 eap_ttls_start_tnc(sm, data);
1355                 break;
1356         default:
1357                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Unexpected state %d in %s",
1358                            data->state, __func__);
1359                 break;
1360         }
1361
1362         if (tls_connection_get_write_alerts(sm->ssl_ctx, data->ssl.conn) > 1) {
1363                 wpa_printf(MSG_INFO, "EAP-TTLS: Locally detected fatal error "
1364                            "in TLS processing");
1365                 eap_ttls_state(data, FAILURE);
1366         }
1367
1368         eap_server_tls_free_in_buf(&data->ssl);
1369 }
1370
1371
1372 static Boolean eap_ttls_isDone(struct eap_sm *sm, void *priv)
1373 {
1374         struct eap_ttls_data *data = priv;
1375         return data->state == SUCCESS || data->state == FAILURE;
1376 }
1377
1378
1379 static u8 * eap_ttls_v1_derive_key(struct eap_sm *sm,
1380                                    struct eap_ttls_data *data)
1381 {
1382         struct tls_keys keys;
1383         u8 *rnd, *key;
1384
1385         os_memset(&keys, 0, sizeof(keys));
1386         if (tls_connection_get_keys(sm->ssl_ctx, data->ssl.conn, &keys) ||
1387             keys.client_random == NULL || keys.server_random == NULL ||
1388             keys.inner_secret == NULL) {
1389                 wpa_printf(MSG_INFO, "EAP-TTLS: Could not get inner secret, "
1390                            "client random, or server random to derive keying "
1391                            "material");
1392                 return NULL;
1393         }
1394
1395         rnd = os_malloc(keys.client_random_len + keys.server_random_len);
1396         key = os_malloc(EAP_TLS_KEY_LEN);
1397         if (rnd == NULL || key == NULL) {
1398                 wpa_printf(MSG_INFO, "EAP-TTLS: No memory for key derivation");
1399                 os_free(rnd);
1400                 os_free(key);
1401                 return NULL;
1402         }
1403         os_memcpy(rnd, keys.client_random, keys.client_random_len);
1404         os_memcpy(rnd + keys.client_random_len, keys.server_random,
1405                   keys.server_random_len);
1406
1407         if (tls_prf(keys.inner_secret, keys.inner_secret_len,
1408                     "ttls v1 keying material", rnd, keys.client_random_len +
1409                     keys.server_random_len, key, EAP_TLS_KEY_LEN)) {
1410                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Failed to derive key");
1411                 os_free(rnd);
1412                 os_free(key);
1413                 return NULL;
1414         }
1415
1416         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: client/server random",
1417                     rnd, keys.client_random_len + keys.server_random_len);
1418         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: TLS/IA inner secret",
1419                         keys.inner_secret, keys.inner_secret_len);
1420
1421         os_free(rnd);
1422
1423         return key;
1424 }
1425
1426
1427 static u8 * eap_ttls_getKey(struct eap_sm *sm, void *priv, size_t *len)
1428 {
1429         struct eap_ttls_data *data = priv;
1430         u8 *eapKeyData;
1431
1432         if (data->state != SUCCESS)
1433                 return NULL;
1434
1435         if (data->ttls_version == 0) {
1436                 eapKeyData = eap_server_tls_derive_key(sm, &data->ssl,
1437                                                        "ttls keying material",
1438                                                        EAP_TLS_KEY_LEN);
1439         } else {
1440                 eapKeyData = eap_ttls_v1_derive_key(sm, data);
1441         }
1442
1443         if (eapKeyData) {
1444                 *len = EAP_TLS_KEY_LEN;
1445                 wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived key",
1446                                 eapKeyData, EAP_TLS_KEY_LEN);
1447         } else {
1448                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Failed to derive key");
1449         }
1450
1451         return eapKeyData;
1452 }
1453
1454
1455 static Boolean eap_ttls_isSuccess(struct eap_sm *sm, void *priv)
1456 {
1457         struct eap_ttls_data *data = priv;
1458         return data->state == SUCCESS;
1459 }
1460
1461
1462 int eap_server_ttls_register(void)
1463 {
1464         struct eap_method *eap;
1465         int ret;
1466
1467         eap = eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION,
1468                                       EAP_VENDOR_IETF, EAP_TYPE_TTLS, "TTLS");
1469         if (eap == NULL)
1470                 return -1;
1471
1472         eap->init = eap_ttls_init;
1473         eap->reset = eap_ttls_reset;
1474         eap->buildReq = eap_ttls_buildReq;
1475         eap->check = eap_ttls_check;
1476         eap->process = eap_ttls_process;
1477         eap->isDone = eap_ttls_isDone;
1478         eap->getKey = eap_ttls_getKey;
1479         eap->isSuccess = eap_ttls_isSuccess;
1480
1481         ret = eap_server_method_register(eap);
1482         if (ret)
1483                 eap_server_method_free(eap);
1484         return ret;
1485 }