www.project-moonshot.org Git - mech_eap.orig/blob - src/eap_peer/eap_ttls.c

   1 /*
   2  * EAP peer method: EAP-TTLS (RFC 5281)
   3  * Copyright (c) 2004-2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16
  17 #include "common.h"
  18 #include "crypto/ms_funcs.h"
  19 #include "crypto/sha1.h"
  20 #include "crypto/tls.h"
  21 #include "eap_common/chap.h"
  22 #include "eap_common/eap_ttls.h"
  23 #include "mschapv2.h"
  24 #include "eap_i.h"
  25 #include "eap_tls_common.h"
  26 #include "eap_config.h"
  27
  28
  29 /* Maximum supported TTLS version
  30  * 0 = RFC 5281
  31  * 1 = draft-funk-eap-ttls-v1-00.txt
  32  */
  33 #ifndef EAP_TTLS_VERSION
  34 #define EAP_TTLS_VERSION 0 /* TTLSv1 implementation is not yet complete */
  35 #endif /* EAP_TTLS_VERSION */
  36
  37
  38 #define MSCHAPV2_KEY_LEN 16
  39 #define MSCHAPV2_NT_RESPONSE_LEN 24
  40
  41
  42 static void eap_ttls_deinit(struct eap_sm *sm, void *priv);
  43
  44
  45 struct eap_ttls_data {
  46         struct eap_ssl_data ssl;
  47         int ssl_initialized;
  48
  49         int ttls_version, force_ttls_version;
  50
  51         const struct eap_method *phase2_method;
  52         void *phase2_priv;
  53         int phase2_success;
  54         int phase2_start;
  55
  56         enum phase2_types {
  57                 EAP_TTLS_PHASE2_EAP,
  58                 EAP_TTLS_PHASE2_MSCHAPV2,
  59                 EAP_TTLS_PHASE2_MSCHAP,
  60                 EAP_TTLS_PHASE2_PAP,
  61                 EAP_TTLS_PHASE2_CHAP
  62         } phase2_type;
  63         struct eap_method_type phase2_eap_type;
  64         struct eap_method_type *phase2_eap_types;
  65         size_t num_phase2_eap_types;
  66
  67         u8 auth_response[MSCHAPV2_AUTH_RESPONSE_LEN];
  68         int auth_response_valid;
  69         u8 master_key[MSCHAPV2_MASTER_KEY_LEN]; /* MSCHAPv2 master key */
  70         u8 ident;
  71         int resuming; /* starting a resumed session */
  72         int reauth; /* reauthentication */
  73         u8 *key_data;
  74
  75         struct wpabuf *pending_phase2_req;
  76
  77 #ifdef EAP_TNC
  78         int ready_for_tnc;
  79         int tnc_started;
  80 #endif /* EAP_TNC */
  81 };
  82
  83
  84 static void * eap_ttls_init(struct eap_sm *sm)
  85 {
  86         struct eap_ttls_data *data;
  87         struct eap_peer_config *config = eap_get_config(sm);
  88         char *selected;
  89
  90         data = os_zalloc(sizeof(*data));
  91         if (data == NULL)
  92                 return NULL;
  93         data->ttls_version = EAP_TTLS_VERSION;
  94         data->force_ttls_version = -1;
  95         selected = "EAP";
  96         data->phase2_type = EAP_TTLS_PHASE2_EAP;
  97
  98 #if EAP_TTLS_VERSION > 0
  99         if (config && config->phase1) {
 100                 const char *pos = os_strstr(config->phase1, "ttlsver=");
 101                 if (pos) {
 102                         data->force_ttls_version = atoi(pos + 8);
 103                         data->ttls_version = data->force_ttls_version;
 104                         wpa_printf(MSG_DEBUG, "EAP-TTLS: Forced TTLS version "
 105                                    "%d", data->force_ttls_version);
 106                 }
 107         }
 108 #endif /* EAP_TTLS_VERSION */
 109
 110         if (config && config->phase2) {
 111                 if (os_strstr(config->phase2, "autheap=")) {
 112                         selected = "EAP";
 113                         data->phase2_type = EAP_TTLS_PHASE2_EAP;
 114                 } else if (os_strstr(config->phase2, "auth=MSCHAPV2")) {
 115                         selected = "MSCHAPV2";
 116                         data->phase2_type = EAP_TTLS_PHASE2_MSCHAPV2;
 117                 } else if (os_strstr(config->phase2, "auth=MSCHAP")) {
 118                         selected = "MSCHAP";
 119                         data->phase2_type = EAP_TTLS_PHASE2_MSCHAP;
 120                 } else if (os_strstr(config->phase2, "auth=PAP")) {
 121                         selected = "PAP";
 122                         data->phase2_type = EAP_TTLS_PHASE2_PAP;
 123                 } else if (os_strstr(config->phase2, "auth=CHAP")) {
 124                         selected = "CHAP";
 125                         data->phase2_type = EAP_TTLS_PHASE2_CHAP;
 126                 }
 127         }
 128         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase2 type: %s", selected);
 129
 130         if (data->phase2_type == EAP_TTLS_PHASE2_EAP) {
 131                 if (eap_peer_select_phase2_methods(config, "autheap=",
 132                                                    &data->phase2_eap_types,
 133                                                    &data->num_phase2_eap_types)
 134                     < 0) {
 135                         eap_ttls_deinit(sm, data);
 136                         return NULL;
 137                 }
 138
 139                 data->phase2_eap_type.vendor = EAP_VENDOR_IETF;
 140                 data->phase2_eap_type.method = EAP_TYPE_NONE;
 141         }
 142
 143 #if EAP_TTLS_VERSION > 0
 144         if (!(tls_capabilities(sm->ssl_ctx) & TLS_CAPABILITY_IA) &&
 145             data->ttls_version > 0) {
 146                 if (data->force_ttls_version > 0) {
 147                         wpa_printf(MSG_INFO, "EAP-TTLS: Forced TTLSv%d and "
 148                                    "TLS library does not support TLS/IA.",
 149                                    data->force_ttls_version);
 150                         eap_ttls_deinit(sm, data);
 151                         return NULL;
 152                 }
 153                 data->ttls_version = 0;
 154         }
 155 #endif /* EAP_TTLS_VERSION */
 156
 157         return data;
 158 }
 159
 160
 161 static void eap_ttls_phase2_eap_deinit(struct eap_sm *sm,
 162                                        struct eap_ttls_data *data)
 163 {
 164         if (data->phase2_priv && data->phase2_method) {
 165                 data->phase2_method->deinit(sm, data->phase2_priv);
 166                 data->phase2_method = NULL;
 167                 data->phase2_priv = NULL;
 168         }
 169 }
 170
 171
 172 static void eap_ttls_deinit(struct eap_sm *sm, void *priv)
 173 {
 174         struct eap_ttls_data *data = priv;
 175         if (data == NULL)
 176                 return;
 177         eap_ttls_phase2_eap_deinit(sm, data);
 178         os_free(data->phase2_eap_types);
 179         if (data->ssl_initialized)
 180                 eap_peer_tls_ssl_deinit(sm, &data->ssl);
 181         os_free(data->key_data);
 182         wpabuf_free(data->pending_phase2_req);
 183         os_free(data);
 184 }
 185
 186
 187 static u8 * eap_ttls_avp_hdr(u8 *avphdr, u32 avp_code, u32 vendor_id,
 188                              int mandatory, size_t len)
 189 {
 190         struct ttls_avp_vendor *avp;
 191         u8 flags;
 192         size_t hdrlen;
 193
 194         avp = (struct ttls_avp_vendor *) avphdr;
 195         flags = mandatory ? AVP_FLAGS_MANDATORY : 0;
 196         if (vendor_id) {
 197                 flags |= AVP_FLAGS_VENDOR;
 198                 hdrlen = sizeof(*avp);
 199                 avp->vendor_id = host_to_be32(vendor_id);
 200         } else {
 201                 hdrlen = sizeof(struct ttls_avp);
 202         }
 203
 204         avp->avp_code = host_to_be32(avp_code);
 205         avp->avp_length = host_to_be32((flags << 24) | (hdrlen + len));
 206
 207         return avphdr + hdrlen;
 208 }
 209
 210
 211 static u8 * eap_ttls_avp_add(u8 *start, u8 *avphdr, u32 avp_code,
 212                              u32 vendor_id, int mandatory,
 213                              const u8 *data, size_t len)
 214 {
 215         u8 *pos;
 216         pos = eap_ttls_avp_hdr(avphdr, avp_code, vendor_id, mandatory, len);
 217         os_memcpy(pos, data, len);
 218         pos += len;
 219         AVP_PAD(start, pos);
 220         return pos;
 221 }
 222
 223
 224 static int eap_ttls_avp_encapsulate(struct wpabuf **resp, u32 avp_code,
 225                                     int mandatory)
 226 {
 227         struct wpabuf *msg;
 228         u8 *avp, *pos;
 229
 230         msg = wpabuf_alloc(sizeof(struct ttls_avp) + wpabuf_len(*resp) + 4);
 231         if (msg == NULL) {
 232                 wpabuf_free(*resp);
 233                 *resp = NULL;
 234                 return -1;
 235         }
 236
 237         avp = wpabuf_mhead(msg);
 238         pos = eap_ttls_avp_hdr(avp, avp_code, 0, mandatory, wpabuf_len(*resp));
 239         os_memcpy(pos, wpabuf_head(*resp), wpabuf_len(*resp));
 240         pos += wpabuf_len(*resp);
 241         AVP_PAD(avp, pos);
 242         wpabuf_free(*resp);
 243         wpabuf_put(msg, pos - avp);
 244         *resp = msg;
 245         return 0;
 246 }
 247
 248
 249 #if EAP_TTLS_VERSION > 0
 250 static int eap_ttls_ia_permute_inner_secret(struct eap_sm *sm,
 251                                             struct eap_ttls_data *data,
 252                                             const u8 *key, size_t key_len)
 253 {
 254         u8 *buf;
 255         size_t buf_len;
 256         int ret;
 257
 258         if (key) {
 259                 buf_len = 2 + key_len;
 260                 buf = os_malloc(buf_len);
 261                 if (buf == NULL)
 262                         return -1;
 263                 WPA_PUT_BE16(buf, key_len);
 264                 os_memcpy(buf + 2, key, key_len);
 265         } else {
 266                 buf = NULL;
 267                 buf_len = 0;
 268         }
 269
 270         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Session keys for TLS/IA inner "
 271                         "secret permutation", buf, buf_len);
 272         ret = tls_connection_ia_permute_inner_secret(sm->ssl_ctx,
 273                                                      data->ssl.conn,
 274                                                      buf, buf_len);
 275         os_free(buf);
 276
 277         return ret;
 278 }
 279 #endif /* EAP_TTLS_VERSION */
 280
 281
 282 static int eap_ttls_v0_derive_key(struct eap_sm *sm,
 283                                   struct eap_ttls_data *data)
 284 {
 285         os_free(data->key_data);
 286         data->key_data = eap_peer_tls_derive_key(sm, &data->ssl,
 287                                                  "ttls keying material",
 288                                                  EAP_TLS_KEY_LEN);
 289         if (!data->key_data) {
 290                 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to derive key");
 291                 return -1;
 292         }
 293
 294         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived key",
 295                         data->key_data, EAP_TLS_KEY_LEN);
 296
 297         return 0;
 298 }
 299
 300
 301 #if EAP_TTLS_VERSION > 0
 302 static int eap_ttls_v1_derive_key(struct eap_sm *sm,
 303                                   struct eap_ttls_data *data)
 304 {
 305         struct tls_keys keys;
 306         u8 *rnd;
 307
 308         os_free(data->key_data);
 309         data->key_data = NULL;
 310
 311         os_memset(&keys, 0, sizeof(keys));
 312         if (tls_connection_get_keys(sm->ssl_ctx, data->ssl.conn, &keys) ||
 313             keys.client_random == NULL || keys.server_random == NULL ||
 314             keys.inner_secret == NULL) {
 315                 wpa_printf(MSG_INFO, "EAP-TTLS: Could not get inner secret, "
 316                            "client random, or server random to derive keying "
 317                            "material");
 318                 return -1;
 319         }
 320
 321         rnd = os_malloc(keys.client_random_len + keys.server_random_len);
 322         data->key_data = os_malloc(EAP_TLS_KEY_LEN);
 323         if (rnd == NULL || data->key_data == NULL) {
 324                 wpa_printf(MSG_INFO, "EAP-TTLS: No memory for key derivation");
 325                 os_free(rnd);
 326                 os_free(data->key_data);
 327                 data->key_data = NULL;
 328                 return -1;
 329         }
 330         os_memcpy(rnd, keys.client_random, keys.client_random_len);
 331         os_memcpy(rnd + keys.client_random_len, keys.server_random,
 332                   keys.server_random_len);
 333
 334         if (tls_prf(keys.inner_secret, keys.inner_secret_len,
 335                     "ttls v1 keying material", rnd, keys.client_random_len +
 336                     keys.server_random_len, data->key_data, EAP_TLS_KEY_LEN)) {
 337                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Failed to derive key");
 338                 os_free(rnd);
 339                 os_free(data->key_data);
 340                 data->key_data = NULL;
 341                 return -1;
 342         }
 343
 344         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: client/server random",
 345                     rnd, keys.client_random_len + keys.server_random_len);
 346         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: TLS/IA inner secret",
 347                         keys.inner_secret, keys.inner_secret_len);
 348
 349         os_free(rnd);
 350
 351         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived key",
 352                         data->key_data, EAP_TLS_KEY_LEN);
 353
 354         return 0;
 355 }
 356 #endif /* EAP_TTLS_VERSION */
 357
 358
 359 static u8 * eap_ttls_implicit_challenge(struct eap_sm *sm,
 360                                         struct eap_ttls_data *data, size_t len)
 361 {
 362 #if EAP_TTLS_VERSION > 0
 363         struct tls_keys keys;
 364         u8 *challenge, *rnd;
 365 #endif /* EAP_TTLS_VERSION */
 366
 367         if (data->ttls_version == 0) {
 368                 return eap_peer_tls_derive_key(sm, &data->ssl,
 369                                                "ttls challenge", len);
 370         }
 371
 372 #if EAP_TTLS_VERSION > 0
 373
 374         os_memset(&keys, 0, sizeof(keys));
 375         if (tls_connection_get_keys(sm->ssl_ctx, data->ssl.conn, &keys) ||
 376             keys.client_random == NULL || keys.server_random == NULL ||
 377             keys.inner_secret == NULL) {
 378                 wpa_printf(MSG_INFO, "EAP-TTLS: Could not get inner secret, "
 379                            "client random, or server random to derive "
 380                            "implicit challenge");
 381                 return NULL;
 382         }
 383
 384         rnd = os_malloc(keys.client_random_len + keys.server_random_len);
 385         challenge = os_malloc(len);
 386         if (rnd == NULL || challenge == NULL) {
 387                 wpa_printf(MSG_INFO, "EAP-TTLS: No memory for implicit "
 388                            "challenge derivation");
 389                 os_free(rnd);
 390                 os_free(challenge);
 391                 return NULL;
 392         }
 393         os_memcpy(rnd, keys.server_random, keys.server_random_len);
 394         os_memcpy(rnd + keys.server_random_len, keys.client_random,
 395                   keys.client_random_len);
 396
 397         if (tls_prf(keys.inner_secret, keys.inner_secret_len,
 398                     "inner application challenge", rnd,
 399                     keys.client_random_len + keys.server_random_len,
 400                     challenge, len)) {
 401                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Failed to derive implicit "
 402                            "challenge");
 403                 os_free(rnd);
 404                 os_free(challenge);
 405                 return NULL;
 406         }
 407
 408         os_free(rnd);
 409
 410         wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived implicit challenge",
 411                         challenge, len);
 412
 413         return challenge;
 414
 415 #else /* EAP_TTLS_VERSION */
 416
 417         return NULL;
 418
 419 #endif /* EAP_TTLS_VERSION */
 420 }
 421
 422
 423 static void eap_ttlsv1_phase2_eap_finish(struct eap_sm *sm,
 424                                          struct eap_ttls_data *data,
 425                                          struct eap_method_ret *ret)
 426 {
 427 #if EAP_TTLS_VERSION > 0
 428         if (data->ttls_version > 0) {
 429                 const struct eap_method *m = data->phase2_method;
 430                 void *priv = data->phase2_priv;
 431
 432                 /* TTLSv1 requires TLS/IA FinalPhaseFinished */
 433                 if (ret->decision == DECISION_UNCOND_SUCC)
 434                         ret->decision = DECISION_COND_SUCC;
 435                 ret->methodState = METHOD_CONT;
 436
 437                 if (ret->decision == DECISION_COND_SUCC &&
 438                     m->isKeyAvailable && m->getKey &&
 439                     m->isKeyAvailable(sm, priv)) {
 440                         u8 *key;
 441                         size_t key_len;
 442                         key = m->getKey(sm, priv, &key_len);
 443                         if (key) {
 444                                 eap_ttls_ia_permute_inner_secret(
 445                                         sm, data, key, key_len);
 446                                 os_free(key);
 447                         }
 448                 }
 449         }
 450 #endif /* EAP_TTLS_VERSION */
 451 }
 452
 453
 454 static void eap_ttls_phase2_select_eap_method(struct eap_ttls_data *data,
 455                                               u8 method)
 456 {
 457         size_t i;
 458         for (i = 0; i < data->num_phase2_eap_types; i++) {
 459                 if (data->phase2_eap_types[i].vendor != EAP_VENDOR_IETF ||
 460                     data->phase2_eap_types[i].method != method)
 461                         continue;
 462
 463                 data->phase2_eap_type.vendor =
 464                         data->phase2_eap_types[i].vendor;
 465                 data->phase2_eap_type.method =
 466                         data->phase2_eap_types[i].method;
 467                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Selected "
 468                            "Phase 2 EAP vendor %d method %d",
 469                            data->phase2_eap_type.vendor,
 470                            data->phase2_eap_type.method);
 471                 break;
 472         }
 473 }
 474
 475
 476 static int eap_ttls_phase2_eap_process(struct eap_sm *sm,
 477                                        struct eap_ttls_data *data,
 478                                        struct eap_method_ret *ret,
 479                                        struct eap_hdr *hdr, size_t len,
 480                                        struct wpabuf **resp)
 481 {
 482         struct wpabuf msg;
 483         struct eap_method_ret iret;
 484
 485         os_memset(&iret, 0, sizeof(iret));
 486         wpabuf_set(&msg, hdr, len);
 487         *resp = data->phase2_method->process(sm, data->phase2_priv, &iret,
 488                                              &msg);
 489         if ((iret.methodState == METHOD_DONE ||
 490              iret.methodState == METHOD_MAY_CONT) &&
 491             (iret.decision == DECISION_UNCOND_SUCC ||
 492              iret.decision == DECISION_COND_SUCC ||
 493              iret.decision == DECISION_FAIL)) {
 494                 ret->methodState = iret.methodState;
 495                 ret->decision = iret.decision;
 496         }
 497         eap_ttlsv1_phase2_eap_finish(sm, data, ret);
 498
 499         return 0;
 500 }
 501
 502
 503 static int eap_ttls_phase2_request_eap_method(struct eap_sm *sm,
 504                                               struct eap_ttls_data *data,
 505                                               struct eap_method_ret *ret,
 506                                               struct eap_hdr *hdr, size_t len,
 507                                               u8 method, struct wpabuf **resp)
 508 {
 509 #ifdef EAP_TNC
 510         if (data->tnc_started && data->phase2_method &&
 511             data->phase2_priv && method == EAP_TYPE_TNC &&
 512             data->phase2_eap_type.method == EAP_TYPE_TNC)
 513                 return eap_ttls_phase2_eap_process(sm, data, ret, hdr, len,
 514                                                    resp);
 515
 516         if (data->ready_for_tnc && !data->tnc_started &&
 517             method == EAP_TYPE_TNC) {
 518                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Start TNC after completed "
 519                            "EAP method");
 520                 data->tnc_started = 1;
 521         }
 522
 523         if (data->tnc_started) {
 524                 if (data->phase2_eap_type.vendor != EAP_VENDOR_IETF ||
 525                     data->phase2_eap_type.method == EAP_TYPE_TNC) {
 526                         wpa_printf(MSG_DEBUG, "EAP-TTLS: Unexpected EAP "
 527                                    "type %d for TNC", method);
 528                         return -1;
 529                 }
 530
 531                 data->phase2_eap_type.vendor = EAP_VENDOR_IETF;
 532                 data->phase2_eap_type.method = method;
 533                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Selected "
 534                            "Phase 2 EAP vendor %d method %d (TNC)",
 535                            data->phase2_eap_type.vendor,
 536                            data->phase2_eap_type.method);
 537
 538                 if (data->phase2_type == EAP_TTLS_PHASE2_EAP)
 539                         eap_ttls_phase2_eap_deinit(sm, data);
 540         }
 541 #endif /* EAP_TNC */
 542
 543         if (data->phase2_eap_type.vendor == EAP_VENDOR_IETF &&
 544             data->phase2_eap_type.method == EAP_TYPE_NONE)
 545                 eap_ttls_phase2_select_eap_method(data, method);
 546
 547         if (method != data->phase2_eap_type.method || method == EAP_TYPE_NONE)
 548         {
 549                 if (eap_peer_tls_phase2_nak(data->phase2_eap_types,
 550                                             data->num_phase2_eap_types,
 551                                             hdr, resp))
 552                         return -1;
 553                 return 0;
 554         }
 555
 556         if (data->phase2_priv == NULL) {
 557                 data->phase2_method = eap_peer_get_eap_method(
 558                         EAP_VENDOR_IETF, method);
 559                 if (data->phase2_method) {
 560                         sm->init_phase2 = 1;
 561                         data->phase2_priv = data->phase2_method->init(sm);
 562                         sm->init_phase2 = 0;
 563                 }
 564         }
 565         if (data->phase2_priv == NULL || data->phase2_method == NULL) {
 566                 wpa_printf(MSG_INFO, "EAP-TTLS: failed to initialize "
 567                            "Phase 2 EAP method %d", method);
 568                 return -1;
 569         }
 570
 571         return eap_ttls_phase2_eap_process(sm, data, ret, hdr, len, resp);
 572 }
 573
 574
 575 static int eap_ttls_phase2_request_eap(struct eap_sm *sm,
 576                                        struct eap_ttls_data *data,
 577                                        struct eap_method_ret *ret,
 578                                        struct eap_hdr *hdr,
 579                                        struct wpabuf **resp)
 580 {
 581         size_t len = be_to_host16(hdr->length);
 582         u8 *pos;
 583         struct eap_peer_config *config = eap_get_config(sm);
 584
 585         if (len <= sizeof(struct eap_hdr)) {
 586                 wpa_printf(MSG_INFO, "EAP-TTLS: too short "
 587                            "Phase 2 request (len=%lu)", (unsigned long) len);
 588                 return -1;
 589         }
 590         pos = (u8 *) (hdr + 1);
 591         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 EAP Request: type=%d", *pos);
 592         switch (*pos) {
 593         case EAP_TYPE_IDENTITY:
 594                 *resp = eap_sm_buildIdentity(sm, hdr->identifier, 1);
 595                 break;
 596         default:
 597                 if (eap_ttls_phase2_request_eap_method(sm, data, ret, hdr, len,
 598                                                        *pos, resp) < 0)
 599                         return -1;
 600                 break;
 601         }
 602
 603         if (*resp == NULL &&
 604             (config->pending_req_identity || config->pending_req_password ||
 605              config->pending_req_otp)) {
 606                 return 0;
 607         }
 608
 609         if (*resp == NULL)
 610                 return -1;
 611
 612         wpa_hexdump_buf(MSG_DEBUG, "EAP-TTLS: AVP encapsulate EAP Response",
 613                         *resp);
 614         return eap_ttls_avp_encapsulate(resp, RADIUS_ATTR_EAP_MESSAGE, 1);
 615 }
 616
 617
 618 static void eap_ttlsv1_permute_inner(struct eap_sm *sm,
 619                                      struct eap_ttls_data *data)
 620 {
 621 #if EAP_TTLS_VERSION > 0
 622         u8 session_key[2 * MSCHAPV2_KEY_LEN];
 623
 624         if (data->ttls_version == 0)
 625                 return;
 626
 627         get_asymetric_start_key(data->master_key, session_key,
 628                                 MSCHAPV2_KEY_LEN, 0, 0);
 629         get_asymetric_start_key(data->master_key,
 630                                 session_key + MSCHAPV2_KEY_LEN,
 631                                 MSCHAPV2_KEY_LEN, 1, 0);
 632         eap_ttls_ia_permute_inner_secret(sm, data, session_key,
 633                                          sizeof(session_key));
 634 #endif /* EAP_TTLS_VERSION */
 635 }
 636
 637
 638 static int eap_ttls_phase2_request_mschapv2(struct eap_sm *sm,
 639                                             struct eap_ttls_data *data,
 640                                             struct eap_method_ret *ret,
 641                                             struct wpabuf **resp)
 642 {
 643         struct wpabuf *msg;
 644         u8 *buf, *pos, *challenge, *peer_challenge;
 645         const u8 *identity, *password;
 646         size_t identity_len, password_len;
 647         int pwhash;
 648
 649         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 MSCHAPV2 Request");
 650
 651         identity = eap_get_config_identity(sm, &identity_len);
 652         password = eap_get_config_password2(sm, &password_len, &pwhash);
 653         if (identity == NULL || password == NULL)
 654                 return -1;
 655
 656         msg = wpabuf_alloc(identity_len + 1000);
 657         if (msg == NULL) {
 658                 wpa_printf(MSG_ERROR,
 659                            "EAP-TTLS/MSCHAPV2: Failed to allocate memory");
 660                 return -1;
 661         }
 662         pos = buf = wpabuf_mhead(msg);
 663
 664         /* User-Name */
 665         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,
 666                                identity, identity_len);
 667
 668         /* MS-CHAP-Challenge */
 669         challenge = eap_ttls_implicit_challenge(
 670                 sm, data, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN + 1);
 671         if (challenge == NULL) {
 672                 wpabuf_free(msg);
 673                 wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAPV2: Failed to derive "
 674                            "implicit challenge");
 675                 return -1;
 676         }
 677         peer_challenge = challenge + 1 + EAP_TTLS_MSCHAPV2_CHALLENGE_LEN;
 678
 679         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_MS_CHAP_CHALLENGE,
 680                                RADIUS_VENDOR_ID_MICROSOFT, 1,
 681                                challenge, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN);
 682
 683         /* MS-CHAP2-Response */
 684         pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP2_RESPONSE,
 685                                RADIUS_VENDOR_ID_MICROSOFT, 1,
 686                                EAP_TTLS_MSCHAPV2_RESPONSE_LEN);
 687         data->ident = challenge[EAP_TTLS_MSCHAPV2_CHALLENGE_LEN];
 688         *pos++ = data->ident;
 689         *pos++ = 0; /* Flags */
 690         os_memcpy(pos, peer_challenge, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN);
 691         pos += EAP_TTLS_MSCHAPV2_CHALLENGE_LEN;
 692         os_memset(pos, 0, 8); /* Reserved, must be zero */
 693         pos += 8;
 694         if (mschapv2_derive_response(identity, identity_len, password,
 695                                      password_len, pwhash, challenge,
 696                                      peer_challenge, pos, data->auth_response,
 697                                      data->master_key)) {
 698                 wpabuf_free(msg);
 699                 wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAPV2: Failed to derive "
 700                            "response");
 701                 return -1;
 702         }
 703         data->auth_response_valid = 1;
 704
 705         eap_ttlsv1_permute_inner(sm, data);
 706
 707         pos += 24;
 708         os_free(challenge);
 709         AVP_PAD(buf, pos);
 710
 711         wpabuf_put(msg, pos - buf);
 712         *resp = msg;
 713
 714         if (sm->workaround && data->ttls_version == 0) {
 715                 /* At least FreeRADIUS seems to be terminating
 716                  * EAP-TTLS/MSHCAPV2 without the expected MS-CHAP-v2 Success
 717                  * packet. */
 718                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: EAP workaround - "
 719                            "allow success without tunneled response");
 720                 ret->methodState = METHOD_MAY_CONT;
 721                 ret->decision = DECISION_COND_SUCC;
 722         }
 723
 724         return 0;
 725 }
 726
 727
 728 static int eap_ttls_phase2_request_mschap(struct eap_sm *sm,
 729                                           struct eap_ttls_data *data,
 730                                           struct eap_method_ret *ret,
 731                                           struct wpabuf **resp)
 732 {
 733         struct wpabuf *msg;
 734         u8 *buf, *pos, *challenge;
 735         const u8 *identity, *password;
 736         size_t identity_len, password_len;
 737         int pwhash;
 738
 739         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 MSCHAP Request");
 740
 741         identity = eap_get_config_identity(sm, &identity_len);
 742         password = eap_get_config_password2(sm, &password_len, &pwhash);
 743         if (identity == NULL || password == NULL)
 744                 return -1;
 745
 746         msg = wpabuf_alloc(identity_len + 1000);
 747         if (msg == NULL) {
 748                 wpa_printf(MSG_ERROR,
 749                            "EAP-TTLS/MSCHAP: Failed to allocate memory");
 750                 return -1;
 751         }
 752         pos = buf = wpabuf_mhead(msg);
 753
 754         /* User-Name */
 755         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,
 756                                identity, identity_len);
 757
 758         /* MS-CHAP-Challenge */
 759         challenge = eap_ttls_implicit_challenge(
 760                 sm, data, EAP_TTLS_MSCHAP_CHALLENGE_LEN + 1);
 761         if (challenge == NULL) {
 762                 wpabuf_free(msg);
 763                 wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAP: Failed to derive "
 764                            "implicit challenge");
 765                 return -1;
 766         }
 767
 768         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_MS_CHAP_CHALLENGE,
 769                                RADIUS_VENDOR_ID_MICROSOFT, 1,
 770                                challenge, EAP_TTLS_MSCHAP_CHALLENGE_LEN);
 771
 772         /* MS-CHAP-Response */
 773         pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP_RESPONSE,
 774                                RADIUS_VENDOR_ID_MICROSOFT, 1,
 775                                EAP_TTLS_MSCHAP_RESPONSE_LEN);
 776         data->ident = challenge[EAP_TTLS_MSCHAP_CHALLENGE_LEN];
 777         *pos++ = data->ident;
 778         *pos++ = 1; /* Flags: Use NT style passwords */
 779         os_memset(pos, 0, 24); /* LM-Response */
 780         pos += 24;
 781         if (pwhash) {
 782                 challenge_response(challenge, password, pos); /* NT-Response */
 783                 wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: MSCHAP password hash",
 784                                 password, 16);
 785         } else {
 786                 nt_challenge_response(challenge, password, password_len,
 787                                       pos); /* NT-Response */
 788                 wpa_hexdump_ascii_key(MSG_DEBUG, "EAP-TTLS: MSCHAP password",
 789                                       password, password_len);
 790         }
 791         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAP implicit challenge",
 792                     challenge, EAP_TTLS_MSCHAP_CHALLENGE_LEN);
 793         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAP response", pos, 24);
 794         pos += 24;
 795         os_free(challenge);
 796         AVP_PAD(buf, pos);
 797
 798         wpabuf_put(msg, pos - buf);
 799         *resp = msg;
 800
 801         if (data->ttls_version > 0) {
 802                 /* EAP-TTLSv1 uses TLS/IA FinalPhaseFinished to report success,
 803                  * so do not allow connection to be terminated yet. */
 804                 ret->methodState = METHOD_CONT;
 805                 ret->decision = DECISION_COND_SUCC;
 806         } else {
 807                 /* EAP-TTLS/MSCHAP does not provide tunneled success
 808                  * notification, so assume that Phase2 succeeds. */
 809                 ret->methodState = METHOD_DONE;
 810                 ret->decision = DECISION_COND_SUCC;
 811         }
 812
 813         return 0;
 814 }
 815
 816
 817 static int eap_ttls_phase2_request_pap(struct eap_sm *sm,
 818                                        struct eap_ttls_data *data,
 819                                        struct eap_method_ret *ret,
 820                                        struct wpabuf **resp)
 821 {
 822         struct wpabuf *msg;
 823         u8 *buf, *pos;
 824         size_t pad;
 825         const u8 *identity, *password;
 826         size_t identity_len, password_len;
 827
 828         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 PAP Request");
 829
 830         identity = eap_get_config_identity(sm, &identity_len);
 831         password = eap_get_config_password(sm, &password_len);
 832         if (identity == NULL || password == NULL)
 833                 return -1;
 834
 835         msg = wpabuf_alloc(identity_len + password_len + 100);
 836         if (msg == NULL) {
 837                 wpa_printf(MSG_ERROR,
 838                            "EAP-TTLS/PAP: Failed to allocate memory");
 839                 return -1;
 840         }
 841         pos = buf = wpabuf_mhead(msg);
 842
 843         /* User-Name */
 844         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,
 845                                identity, identity_len);
 846
 847         /* User-Password; in RADIUS, this is encrypted, but EAP-TTLS encrypts
 848          * the data, so no separate encryption is used in the AVP itself.
 849          * However, the password is padded to obfuscate its length. */
 850         pad = password_len == 0 ? 16 : (16 - (password_len & 15)) & 15;
 851         pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_USER_PASSWORD, 0, 1,
 852                                password_len + pad);
 853         os_memcpy(pos, password, password_len);
 854         pos += password_len;
 855         os_memset(pos, 0, pad);
 856         pos += pad;
 857         AVP_PAD(buf, pos);
 858
 859         wpabuf_put(msg, pos - buf);
 860         *resp = msg;
 861
 862         if (data->ttls_version > 0) {
 863                 /* EAP-TTLSv1 uses TLS/IA FinalPhaseFinished to report success,
 864                  * so do not allow connection to be terminated yet. */
 865                 ret->methodState = METHOD_CONT;
 866                 ret->decision = DECISION_COND_SUCC;
 867         } else {
 868                 /* EAP-TTLS/PAP does not provide tunneled success notification,
 869                  * so assume that Phase2 succeeds. */
 870                 ret->methodState = METHOD_DONE;
 871                 ret->decision = DECISION_COND_SUCC;
 872         }
 873
 874         return 0;
 875 }
 876
 877
 878 static int eap_ttls_phase2_request_chap(struct eap_sm *sm,
 879                                         struct eap_ttls_data *data,
 880                                         struct eap_method_ret *ret,
 881                                         struct wpabuf **resp)
 882 {
 883         struct wpabuf *msg;
 884         u8 *buf, *pos, *challenge;
 885         const u8 *identity, *password;
 886         size_t identity_len, password_len;
 887
 888         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 CHAP Request");
 889
 890         identity = eap_get_config_identity(sm, &identity_len);
 891         password = eap_get_config_password(sm, &password_len);
 892         if (identity == NULL || password == NULL)
 893                 return -1;
 894
 895         msg = wpabuf_alloc(identity_len + 1000);
 896         if (msg == NULL) {
 897                 wpa_printf(MSG_ERROR,
 898                            "EAP-TTLS/CHAP: Failed to allocate memory");
 899                 return -1;
 900         }
 901         pos = buf = wpabuf_mhead(msg);
 902
 903         /* User-Name */
 904         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,
 905                                identity, identity_len);
 906
 907         /* CHAP-Challenge */
 908         challenge = eap_ttls_implicit_challenge(
 909                 sm, data, EAP_TTLS_CHAP_CHALLENGE_LEN + 1);
 910         if (challenge == NULL) {
 911                 wpabuf_free(msg);
 912                 wpa_printf(MSG_ERROR, "EAP-TTLS/CHAP: Failed to derive "
 913                            "implicit challenge");
 914                 return -1;
 915         }
 916
 917         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_CHAP_CHALLENGE, 0, 1,
 918                                challenge, EAP_TTLS_CHAP_CHALLENGE_LEN);
 919
 920         /* CHAP-Password */
 921         pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_CHAP_PASSWORD, 0, 1,
 922                                1 + EAP_TTLS_CHAP_PASSWORD_LEN);
 923         data->ident = challenge[EAP_TTLS_CHAP_CHALLENGE_LEN];
 924         *pos++ = data->ident;
 925
 926         /* MD5(Ident + Password + Challenge) */
 927         chap_md5(data->ident, password, password_len, challenge,
 928                  EAP_TTLS_CHAP_CHALLENGE_LEN, pos);
 929
 930         wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: CHAP username",
 931                           identity, identity_len);
 932         wpa_hexdump_ascii_key(MSG_DEBUG, "EAP-TTLS: CHAP password",
 933                               password, password_len);
 934         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: CHAP implicit challenge",
 935                     challenge, EAP_TTLS_CHAP_CHALLENGE_LEN);
 936         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: CHAP password",
 937                     pos, EAP_TTLS_CHAP_PASSWORD_LEN);
 938         pos += EAP_TTLS_CHAP_PASSWORD_LEN;
 939         os_free(challenge);
 940         AVP_PAD(buf, pos);
 941
 942         wpabuf_put(msg, pos - buf);
 943         *resp = msg;
 944
 945         if (data->ttls_version > 0) {
 946                 /* EAP-TTLSv1 uses TLS/IA FinalPhaseFinished to report success,
 947                  * so do not allow connection to be terminated yet. */
 948                 ret->methodState = METHOD_CONT;
 949                 ret->decision = DECISION_COND_SUCC;
 950         } else {
 951                 /* EAP-TTLS/CHAP does not provide tunneled success
 952                  * notification, so assume that Phase2 succeeds. */
 953                 ret->methodState = METHOD_DONE;
 954                 ret->decision = DECISION_COND_SUCC;
 955         }
 956
 957         return 0;
 958 }
 959
 960
 961 static int eap_ttls_phase2_request(struct eap_sm *sm,
 962                                    struct eap_ttls_data *data,
 963                                    struct eap_method_ret *ret,
 964                                    struct eap_hdr *hdr,
 965                                    struct wpabuf **resp)
 966 {
 967         int res = 0;
 968         size_t len;
 969         enum phase2_types phase2_type = data->phase2_type;
 970
 971 #ifdef EAP_TNC
 972         if (data->tnc_started) {
 973                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Processing TNC");
 974                 phase2_type = EAP_TTLS_PHASE2_EAP;
 975         }
 976 #endif /* EAP_TNC */
 977
 978         if (phase2_type == EAP_TTLS_PHASE2_MSCHAPV2 ||
 979             phase2_type == EAP_TTLS_PHASE2_MSCHAP ||
 980             phase2_type == EAP_TTLS_PHASE2_PAP ||
 981             phase2_type == EAP_TTLS_PHASE2_CHAP) {
 982                 if (eap_get_config_identity(sm, &len) == NULL) {
 983                         wpa_printf(MSG_INFO,
 984                                    "EAP-TTLS: Identity not configured");
 985                         eap_sm_request_identity(sm);
 986                         if (eap_get_config_password(sm, &len) == NULL)
 987                                 eap_sm_request_password(sm);
 988                         return 0;
 989                 }
 990
 991                 if (eap_get_config_password(sm, &len) == NULL) {
 992                         wpa_printf(MSG_INFO,
 993                                    "EAP-TTLS: Password not configured");
 994                         eap_sm_request_password(sm);
 995                         return 0;
 996                 }
 997         }
 998
 999         switch (phase2_type) {
1000         case EAP_TTLS_PHASE2_EAP:
1001                 res = eap_ttls_phase2_request_eap(sm, data, ret, hdr, resp);
1002                 break;
1003         case EAP_TTLS_PHASE2_MSCHAPV2:
1004                 res = eap_ttls_phase2_request_mschapv2(sm, data, ret, resp);
1005                 break;
1006         case EAP_TTLS_PHASE2_MSCHAP:
1007                 res = eap_ttls_phase2_request_mschap(sm, data, ret, resp);
1008                 break;
1009         case EAP_TTLS_PHASE2_PAP:
1010                 res = eap_ttls_phase2_request_pap(sm, data, ret, resp);
1011                 break;
1012         case EAP_TTLS_PHASE2_CHAP:
1013                 res = eap_ttls_phase2_request_chap(sm, data, ret, resp);
1014                 break;
1015         default:
1016                 wpa_printf(MSG_ERROR, "EAP-TTLS: Phase 2 - Unknown");
1017                 res = -1;
1018                 break;
1019         }
1020
1021         if (res < 0) {
1022                 ret->methodState = METHOD_DONE;
1023                 ret->decision = DECISION_FAIL;
1024         }
1025
1026         return res;
1027 }
1028
1029
1030 #if EAP_TTLS_VERSION > 0
1031 static struct wpabuf * eap_ttls_build_phase_finished(
1032         struct eap_sm *sm, struct eap_ttls_data *data, int id, int final)
1033 {
1034         struct wpabuf *req, *buf;
1035
1036         buf = tls_connection_ia_send_phase_finished(sm->ssl_ctx,
1037                                                     data->ssl.conn,
1038                                                     final);
1039         if (buf == NULL)
1040                 return NULL;
1041
1042         req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_TTLS,
1043                             1 + wpabuf_len(buf),
1044                             EAP_CODE_RESPONSE, id);
1045         if (req == NULL) {
1046                 wpabuf_free(buf);
1047                 return NULL;
1048         }
1049
1050         wpabuf_put_u8(req, data->ttls_version);
1051         wpabuf_put_buf(req, buf);
1052         wpabuf_free(buf);
1053         eap_update_len(req);
1054
1055         return req;
1056 }
1057 #endif /* EAP_TTLS_VERSION */
1058
1059
1060 struct ttls_parse_avp {
1061         u8 *mschapv2;
1062         u8 *eapdata;
1063         size_t eap_len;
1064         int mschapv2_error;
1065 };
1066
1067
1068 static int eap_ttls_parse_attr_eap(const u8 *dpos, size_t dlen,
1069                                    struct ttls_parse_avp *parse)
1070 {
1071         wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP - EAP Message");
1072         if (parse->eapdata == NULL) {
1073                 parse->eapdata = os_malloc(dlen);
1074                 if (parse->eapdata == NULL) {
1075                         wpa_printf(MSG_WARNING, "EAP-TTLS: Failed to allocate "
1076                                    "memory for Phase 2 EAP data");
1077                         return -1;
1078                 }
1079                 os_memcpy(parse->eapdata, dpos, dlen);
1080                 parse->eap_len = dlen;
1081         } else {
1082                 u8 *neweap = os_realloc(parse->eapdata, parse->eap_len + dlen);
1083                 if (neweap == NULL) {
1084                         wpa_printf(MSG_WARNING, "EAP-TTLS: Failed to allocate "
1085                                    "memory for Phase 2 EAP data");
1086                         return -1;
1087                 }
1088                 os_memcpy(neweap + parse->eap_len, dpos, dlen);
1089                 parse->eapdata = neweap;
1090                 parse->eap_len += dlen;
1091         }
1092
1093         return 0;
1094 }
1095
1096
1097 static int eap_ttls_parse_avp(u8 *pos, size_t left,
1098                               struct ttls_parse_avp *parse)
1099 {
1100         struct ttls_avp *avp;
1101         u32 avp_code, avp_length, vendor_id = 0;
1102         u8 avp_flags, *dpos;
1103         size_t dlen;
1104
1105         avp = (struct ttls_avp *) pos;
1106         avp_code = be_to_host32(avp->avp_code);
1107         avp_length = be_to_host32(avp->avp_length);
1108         avp_flags = (avp_length >> 24) & 0xff;
1109         avp_length &= 0xffffff;
1110         wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP: code=%d flags=0x%02x "
1111                    "length=%d", (int) avp_code, avp_flags,
1112                    (int) avp_length);
1113
1114         if (avp_length > left) {
1115                 wpa_printf(MSG_WARNING, "EAP-TTLS: AVP overflow "
1116                            "(len=%d, left=%lu) - dropped",
1117                            (int) avp_length, (unsigned long) left);
1118                 return -1;
1119         }
1120
1121         if (avp_length < sizeof(*avp)) {
1122                 wpa_printf(MSG_WARNING, "EAP-TTLS: Invalid AVP length %d",
1123                            avp_length);
1124                 return -1;
1125         }
1126
1127         dpos = (u8 *) (avp + 1);
1128         dlen = avp_length - sizeof(*avp);
1129         if (avp_flags & AVP_FLAGS_VENDOR) {
1130                 if (dlen < 4) {
1131                         wpa_printf(MSG_WARNING, "EAP-TTLS: Vendor AVP "
1132                                    "underflow");
1133                         return -1;
1134                 }
1135                 vendor_id = WPA_GET_BE32(dpos);
1136                 wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP vendor_id %d",
1137                            (int) vendor_id);
1138                 dpos += 4;
1139                 dlen -= 4;
1140         }
1141
1142         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: AVP data", dpos, dlen);
1143
1144         if (vendor_id == 0 && avp_code == RADIUS_ATTR_EAP_MESSAGE) {
1145                 if (eap_ttls_parse_attr_eap(dpos, dlen, parse) < 0)
1146                         return -1;
1147         } else if (vendor_id == 0 && avp_code == RADIUS_ATTR_REPLY_MESSAGE) {
1148                 /* This is an optional message that can be displayed to
1149                  * the user. */
1150                 wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: AVP - Reply-Message",
1151                                   dpos, dlen);
1152         } else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT &&
1153                    avp_code == RADIUS_ATTR_MS_CHAP2_SUCCESS) {
1154                 wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: MS-CHAP2-Success",
1155                                   dpos, dlen);
1156                 if (dlen != 43) {
1157                         wpa_printf(MSG_WARNING, "EAP-TTLS: Unexpected "
1158                                    "MS-CHAP2-Success length "
1159                                    "(len=%lu, expected 43)",
1160                                    (unsigned long) dlen);
1161                         return -1;
1162                 }
1163                 parse->mschapv2 = dpos;
1164         } else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT &&
1165                    avp_code == RADIUS_ATTR_MS_CHAP_ERROR) {
1166                 wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: MS-CHAP-Error",
1167                                   dpos, dlen);
1168                 parse->mschapv2_error = 1;
1169         } else if (avp_flags & AVP_FLAGS_MANDATORY) {
1170                 wpa_printf(MSG_WARNING, "EAP-TTLS: Unsupported mandatory AVP "
1171                            "code %d vendor_id %d - dropped",
1172                            (int) avp_code, (int) vendor_id);
1173                 return -1;
1174         } else {
1175                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Ignoring unsupported AVP "
1176                            "code %d vendor_id %d",
1177                            (int) avp_code, (int) vendor_id);
1178         }
1179
1180         return avp_length;
1181 }
1182
1183
1184 static int eap_ttls_parse_avps(struct wpabuf *in_decrypted,
1185                                struct ttls_parse_avp *parse)
1186 {
1187         u8 *pos;
1188         size_t left, pad;
1189         int avp_length;
1190
1191         pos = wpabuf_mhead(in_decrypted);
1192         left = wpabuf_len(in_decrypted);
1193         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Decrypted Phase 2 AVPs", pos, left);
1194         if (left < sizeof(struct ttls_avp)) {
1195                 wpa_printf(MSG_WARNING, "EAP-TTLS: Too short Phase 2 AVP frame"
1196                            " len=%lu expected %lu or more - dropped",
1197                            (unsigned long) left,
1198                            (unsigned long) sizeof(struct ttls_avp));
1199                 return -1;
1200         }
1201
1202         /* Parse AVPs */
1203         os_memset(parse, 0, sizeof(*parse));
1204
1205         while (left > 0) {
1206                 avp_length = eap_ttls_parse_avp(pos, left, parse);
1207                 if (avp_length < 0)
1208                         return -1;
1209
1210                 pad = (4 - (avp_length & 3)) & 3;
1211                 pos += avp_length + pad;
1212                 if (left < avp_length + pad)
1213                         left = 0;
1214                 else
1215                         left -= avp_length + pad;
1216         }
1217
1218         return 0;
1219 }
1220
1221
1222 static u8 * eap_ttls_fake_identity_request(void)
1223 {
1224         struct eap_hdr *hdr;
1225         u8 *buf;
1226
1227         wpa_printf(MSG_DEBUG, "EAP-TTLS: empty data in beginning of "
1228                    "Phase 2 - use fake EAP-Request Identity");
1229         buf = os_malloc(sizeof(*hdr) + 1);
1230         if (buf == NULL) {
1231                 wpa_printf(MSG_WARNING, "EAP-TTLS: failed to allocate "
1232                            "memory for fake EAP-Identity Request");
1233                 return NULL;
1234         }
1235
1236         hdr = (struct eap_hdr *) buf;
1237         hdr->code = EAP_CODE_REQUEST;
1238         hdr->identifier = 0;
1239         hdr->length = host_to_be16(sizeof(*hdr) + 1);
1240         buf[sizeof(*hdr)] = EAP_TYPE_IDENTITY;
1241
1242         return buf;
1243 }
1244
1245
1246 static int eap_ttls_encrypt_response(struct eap_sm *sm,
1247                                      struct eap_ttls_data *data,
1248                                      struct wpabuf *resp, u8 identifier,
1249                                      struct wpabuf **out_data)
1250 {
1251         if (resp == NULL)
1252                 return 0;
1253
1254         wpa_hexdump_buf_key(MSG_DEBUG, "EAP-TTLS: Encrypting Phase 2 data",
1255                             resp);
1256         if (eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_TTLS,
1257                                  data->ttls_version, identifier,
1258                                  resp, out_data)) {
1259                 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to encrypt a Phase 2 "
1260                            "frame");
1261                 return -1;
1262         }
1263         wpabuf_free(resp);
1264
1265         return 0;
1266 }
1267
1268
1269 static int eap_ttls_process_phase2_eap(struct eap_sm *sm,
1270                                        struct eap_ttls_data *data,
1271                                        struct eap_method_ret *ret,
1272                                        struct ttls_parse_avp *parse,
1273                                        struct wpabuf **resp)
1274 {
1275         struct eap_hdr *hdr;
1276         size_t len;
1277
1278         if (parse->eapdata == NULL) {
1279                 wpa_printf(MSG_WARNING, "EAP-TTLS: No EAP Message in the "
1280                            "packet - dropped");
1281                 return -1;
1282         }
1283
1284         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Phase 2 EAP",
1285                     parse->eapdata, parse->eap_len);
1286         hdr = (struct eap_hdr *) parse->eapdata;
1287
1288         if (parse->eap_len < sizeof(*hdr)) {
1289                 wpa_printf(MSG_WARNING, "EAP-TTLS: Too short Phase 2 EAP "
1290                            "frame (len=%lu, expected %lu or more) - dropped",
1291                            (unsigned long) parse->eap_len,
1292                            (unsigned long) sizeof(*hdr));
1293                 return -1;
1294         }
1295         len = be_to_host16(hdr->length);
1296         if (len > parse->eap_len) {
1297                 wpa_printf(MSG_INFO, "EAP-TTLS: Length mismatch in Phase 2 "
1298                            "EAP frame (EAP hdr len=%lu, EAP data len in "
1299                            "AVP=%lu)",
1300                            (unsigned long) len,
1301                            (unsigned long) parse->eap_len);
1302                 return -1;
1303         }
1304         wpa_printf(MSG_DEBUG, "EAP-TTLS: received Phase 2: code=%d "
1305                    "identifier=%d length=%lu",
1306                    hdr->code, hdr->identifier, (unsigned long) len);
1307         switch (hdr->code) {
1308         case EAP_CODE_REQUEST:
1309                 if (eap_ttls_phase2_request(sm, data, ret, hdr, resp)) {
1310                         wpa_printf(MSG_INFO, "EAP-TTLS: Phase2 Request "
1311                                    "processing failed");
1312                         return -1;
1313                 }
1314                 break;
1315         default:
1316                 wpa_printf(MSG_INFO, "EAP-TTLS: Unexpected code=%d in "
1317                            "Phase 2 EAP header", hdr->code);
1318                 return -1;
1319         }
1320
1321         return 0;
1322 }
1323
1324
1325 static int eap_ttls_process_phase2_mschapv2(struct eap_sm *sm,
1326                                             struct eap_ttls_data *data,
1327                                             struct eap_method_ret *ret,
1328                                             struct ttls_parse_avp *parse)
1329 {
1330         if (parse->mschapv2_error) {
1331                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Received "
1332                            "MS-CHAP-Error - failed");
1333                 ret->methodState = METHOD_DONE;
1334                 ret->decision = DECISION_FAIL;
1335                 /* Reply with empty data to ACK error */
1336                 return 1;
1337         }
1338
1339         if (parse->mschapv2 == NULL) {
1340 #ifdef EAP_TNC
1341                 if (data->phase2_success && parse->eapdata) {
1342                         /*
1343                          * Allow EAP-TNC to be started after successfully
1344                          * completed MSCHAPV2.
1345                          */
1346                         return 1;
1347                 }
1348 #endif /* EAP_TNC */
1349                 wpa_printf(MSG_WARNING, "EAP-TTLS: no MS-CHAP2-Success AVP "
1350                            "received for Phase2 MSCHAPV2");
1351                 return -1;
1352         }
1353         if (parse->mschapv2[0] != data->ident) {
1354                 wpa_printf(MSG_WARNING, "EAP-TTLS: Ident mismatch for Phase 2 "
1355                            "MSCHAPV2 (received Ident 0x%02x, expected 0x%02x)",
1356                            parse->mschapv2[0], data->ident);
1357                 return -1;
1358         }
1359         if (!data->auth_response_valid ||
1360             mschapv2_verify_auth_response(data->auth_response,
1361                                           parse->mschapv2 + 1, 42)) {
1362                 wpa_printf(MSG_WARNING, "EAP-TTLS: Invalid authenticator "
1363                            "response in Phase 2 MSCHAPV2 success request");
1364                 return -1;
1365         }
1366
1367         wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 MSCHAPV2 "
1368                    "authentication succeeded");
1369         if (data->ttls_version > 0) {
1370                 /*
1371                  * EAP-TTLSv1 uses TLS/IA FinalPhaseFinished to report
1372                  * success, so do not allow connection to be terminated
1373                  * yet.
1374                  */
1375                 ret->methodState = METHOD_CONT;
1376                 ret->decision = DECISION_COND_SUCC;
1377         } else {
1378                 ret->methodState = METHOD_DONE;
1379                 ret->decision = DECISION_UNCOND_SUCC;
1380                 data->phase2_success = 1;
1381         }
1382
1383         /*
1384          * Reply with empty data; authentication server will reply
1385          * with EAP-Success after this.
1386          */
1387         return 1;
1388 }
1389
1390
1391 #ifdef EAP_TNC
1392 static int eap_ttls_process_tnc_start(struct eap_sm *sm,
1393                                       struct eap_ttls_data *data,
1394                                       struct eap_method_ret *ret,
1395                                       struct ttls_parse_avp *parse,
1396                                       struct wpabuf **resp)
1397 {
1398         /* TNC uses inner EAP method after non-EAP TTLS phase 2. */
1399         if (parse->eapdata == NULL) {
1400                 wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received "
1401                            "unexpected tunneled data (no EAP)");
1402                 return -1;
1403         }
1404
1405         if (!data->ready_for_tnc) {
1406                 wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received "
1407                            "EAP after non-EAP, but not ready for TNC");
1408                 return -1;
1409         }
1410
1411         wpa_printf(MSG_DEBUG, "EAP-TTLS: Start TNC after completed "
1412                    "non-EAP method");
1413         data->tnc_started = 1;
1414
1415         if (eap_ttls_process_phase2_eap(sm, data, ret, parse, resp) < 0)
1416                 return -1;
1417
1418         return 0;
1419 }
1420 #endif /* EAP_TNC */
1421
1422
1423 static int eap_ttls_process_decrypted(struct eap_sm *sm,
1424                                       struct eap_ttls_data *data,
1425                                       struct eap_method_ret *ret,
1426                                       u8 identifier,
1427                                       struct ttls_parse_avp *parse,
1428                                       struct wpabuf *in_decrypted,
1429                                       struct wpabuf **out_data)
1430 {
1431         struct wpabuf *resp = NULL;
1432         struct eap_peer_config *config = eap_get_config(sm);
1433         int res;
1434         enum phase2_types phase2_type = data->phase2_type;
1435
1436 #ifdef EAP_TNC
1437         if (data->tnc_started)
1438                 phase2_type = EAP_TTLS_PHASE2_EAP;
1439 #endif /* EAP_TNC */
1440
1441         switch (phase2_type) {
1442         case EAP_TTLS_PHASE2_EAP:
1443                 if (eap_ttls_process_phase2_eap(sm, data, ret, parse, &resp) <
1444                     0)
1445                         return -1;
1446                 break;
1447         case EAP_TTLS_PHASE2_MSCHAPV2:
1448                 res = eap_ttls_process_phase2_mschapv2(sm, data, ret, parse);
1449 #ifdef EAP_TNC
1450                 if (res == 1 && parse->eapdata && data->phase2_success) {
1451                         /*
1452                          * TNC may be required as the next
1453                          * authentication method within the tunnel.
1454                          */
1455                         ret->methodState = METHOD_MAY_CONT;
1456                         data->ready_for_tnc = 1;
1457                         if (eap_ttls_process_tnc_start(sm, data, ret, parse,
1458                                                        &resp) == 0)
1459                                 break;
1460                 }
1461 #endif /* EAP_TNC */
1462                 return res;
1463         case EAP_TTLS_PHASE2_MSCHAP:
1464         case EAP_TTLS_PHASE2_PAP:
1465         case EAP_TTLS_PHASE2_CHAP:
1466 #ifdef EAP_TNC
1467                 if (eap_ttls_process_tnc_start(sm, data, ret, parse, &resp) <
1468                     0)
1469                         return -1;
1470                 break;
1471 #else /* EAP_TNC */
1472                 /* EAP-TTLS/{MSCHAP,PAP,CHAP} should not send any TLS tunneled
1473                  * requests to the supplicant */
1474                 wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received unexpected "
1475                            "tunneled data");
1476                 return -1;
1477 #endif /* EAP_TNC */
1478         }
1479
1480         if (resp) {
1481                 if (eap_ttls_encrypt_response(sm, data, resp, identifier,
1482                                               out_data) < 0)
1483                         return -1;
1484         } else if (config->pending_req_identity ||
1485                    config->pending_req_password ||
1486                    config->pending_req_otp ||
1487                    config->pending_req_new_password) {
1488                 wpabuf_free(data->pending_phase2_req);
1489                 data->pending_phase2_req = wpabuf_dup(in_decrypted);
1490         }
1491
1492         return 0;
1493 }
1494
1495
1496 #if EAP_TTLS_VERSION > 0
1497 static void eap_ttls_final_phase_finished(struct eap_sm *sm,
1498                                           struct eap_ttls_data *data,
1499                                           struct eap_method_ret *ret,
1500                                           u8 identifier,
1501                                           struct wpabuf **out_data)
1502 {
1503         wpa_printf(MSG_DEBUG, "EAP-TTLS: FinalPhaseFinished received");
1504         wpa_printf(MSG_INFO, "EAP-TTLS: TLS/IA authentication succeeded");
1505         ret->methodState = METHOD_DONE;
1506         ret->decision = DECISION_UNCOND_SUCC;
1507         data->phase2_success = 1;
1508         *out_data = eap_ttls_build_phase_finished(sm, data, identifier, 1);
1509         eap_ttls_v1_derive_key(sm, data);
1510 }
1511 #endif /* EAP_TTLS_VERSION */
1512
1513
1514 static int eap_ttls_implicit_identity_request(struct eap_sm *sm,
1515                                               struct eap_ttls_data *data,
1516                                               struct eap_method_ret *ret,
1517                                               u8 identifier,
1518                                               struct wpabuf **out_data)
1519 {
1520         int retval = 0;
1521         struct eap_hdr *hdr;
1522         struct wpabuf *resp;
1523
1524         hdr = (struct eap_hdr *) eap_ttls_fake_identity_request();
1525         if (hdr == NULL) {
1526                 ret->methodState = METHOD_DONE;
1527                 ret->decision = DECISION_FAIL;
1528                 return -1;
1529         }
1530
1531         resp = NULL;
1532         if (eap_ttls_phase2_request(sm, data, ret, hdr, &resp)) {
1533                 wpa_printf(MSG_INFO, "EAP-TTLS: Phase2 Request "
1534                            "processing failed");
1535                 retval = -1;
1536         } else {
1537                 retval = eap_ttls_encrypt_response(sm, data, resp, identifier,
1538                                                    out_data);
1539         }
1540
1541         os_free(hdr);
1542
1543         if (retval < 0) {
1544                 ret->methodState = METHOD_DONE;
1545                 ret->decision = DECISION_FAIL;
1546         }
1547
1548         return retval;
1549 }
1550
1551
1552 static int eap_ttls_phase2_start(struct eap_sm *sm, struct eap_ttls_data *data,
1553                                  struct eap_method_ret *ret, u8 identifier,
1554                                  struct wpabuf **out_data)
1555 {
1556         data->phase2_start = 0;
1557
1558         /*
1559          * EAP-TTLS does not use Phase2 on fast re-auth; this must be done only
1560          * if TLS part was indeed resuming a previous session. Most
1561          * Authentication Servers terminate EAP-TTLS before reaching this
1562          * point, but some do not. Make wpa_supplicant stop phase 2 here, if
1563          * needed.
1564          */
1565         if (data->reauth &&
1566             tls_connection_resumed(sm->ssl_ctx, data->ssl.conn)) {
1567                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Session resumption - "
1568                            "skip phase 2");
1569                 *out_data = eap_peer_tls_build_ack(identifier, EAP_TYPE_TTLS,
1570                                                    data->ttls_version);
1571                 ret->methodState = METHOD_DONE;
1572                 ret->decision = DECISION_UNCOND_SUCC;
1573                 data->phase2_success = 1;
1574                 return 0;
1575         }
1576
1577         return eap_ttls_implicit_identity_request(sm, data, ret, identifier,
1578                                                   out_data);
1579 }
1580
1581
1582 static int eap_ttls_decrypt(struct eap_sm *sm, struct eap_ttls_data *data,
1583                             struct eap_method_ret *ret, u8 identifier,
1584                             const struct wpabuf *in_data,
1585                             struct wpabuf **out_data)
1586 {
1587         struct wpabuf *in_decrypted = NULL;
1588         int retval = 0;
1589         struct ttls_parse_avp parse;
1590
1591         os_memset(&parse, 0, sizeof(parse));
1592
1593         wpa_printf(MSG_DEBUG, "EAP-TTLS: received %lu bytes encrypted data for"
1594                    " Phase 2",
1595                    in_data ? (unsigned long) wpabuf_len(in_data) : 0);
1596
1597         if (data->pending_phase2_req) {
1598                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Pending Phase 2 request - "
1599                            "skip decryption and use old data");
1600                 /* Clear TLS reassembly state. */
1601                 eap_peer_tls_reset_input(&data->ssl);
1602
1603                 in_decrypted = data->pending_phase2_req;
1604                 data->pending_phase2_req = NULL;
1605                 if (wpabuf_len(in_decrypted) == 0) {
1606                         wpabuf_free(in_decrypted);
1607                         return eap_ttls_implicit_identity_request(
1608                                 sm, data, ret, identifier, out_data);
1609                 }
1610                 goto continue_req;
1611         }
1612
1613         if ((in_data == NULL || wpabuf_len(in_data) == 0) &&
1614             data->phase2_start) {
1615                 return eap_ttls_phase2_start(sm, data, ret, identifier,
1616                                              out_data);
1617         }
1618
1619         if (in_data == NULL || wpabuf_len(in_data) == 0) {
1620                 /* Received TLS ACK - requesting more fragments */
1621                 return eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_TTLS,
1622                                             data->ttls_version,
1623                                             identifier, NULL, out_data);
1624         }
1625
1626         retval = eap_peer_tls_decrypt(sm, &data->ssl, in_data, &in_decrypted);
1627         if (retval)
1628                 goto done;
1629
1630 #if EAP_TTLS_VERSION > 0
1631         if (data->ttls_version > 0 &&
1632             (in_decrypted == NULL || wpabuf_len(in_decrypted) == 0) &&
1633             tls_connection_ia_final_phase_finished(sm->ssl_ctx,
1634                                                    data->ssl.conn)) {
1635                 eap_ttls_final_phase_finished(sm, data, ret, identifier,
1636                                               out_data);
1637                 goto done;
1638         }
1639 #endif /* EAP_TTLS_VERSION */
1640
1641 continue_req:
1642         data->phase2_start = 0;
1643
1644         if (eap_ttls_parse_avps(in_decrypted, &parse) < 0) {
1645                 retval = -1;
1646                 goto done;
1647         }
1648
1649         retval = eap_ttls_process_decrypted(sm, data, ret, identifier,
1650                                             &parse, in_decrypted, out_data);
1651
1652 done:
1653         wpabuf_free(in_decrypted);
1654         os_free(parse.eapdata);
1655
1656         if (retval < 0) {
1657                 ret->methodState = METHOD_DONE;
1658                 ret->decision = DECISION_FAIL;
1659         }
1660
1661         return retval;
1662 }
1663
1664
1665 static int eap_ttls_process_start(struct eap_sm *sm,
1666                                   struct eap_ttls_data *data, u8 flags,
1667                                   struct eap_method_ret *ret)
1668 {
1669         struct eap_peer_config *config = eap_get_config(sm);
1670
1671         wpa_printf(MSG_DEBUG, "EAP-TTLS: Start (server ver=%d, own ver=%d)",
1672                    flags & EAP_TLS_VERSION_MASK, data->ttls_version);
1673 #if EAP_TTLS_VERSION > 0
1674         if ((flags & EAP_TLS_VERSION_MASK) < data->ttls_version)
1675                 data->ttls_version = flags & EAP_TLS_VERSION_MASK;
1676         if (data->force_ttls_version >= 0 &&
1677             data->force_ttls_version != data->ttls_version) {
1678                 wpa_printf(MSG_WARNING, "EAP-TTLS: Failed to select "
1679                            "forced TTLS version %d",
1680                            data->force_ttls_version);
1681                 ret->methodState = METHOD_DONE;
1682                 ret->decision = DECISION_FAIL;
1683                 ret->allowNotifications = FALSE;
1684                 return -1;
1685         }
1686         wpa_printf(MSG_DEBUG, "EAP-TTLS: Using TTLS version %d",
1687                    data->ttls_version);
1688
1689         if (data->ttls_version > 0)
1690                 data->ssl.tls_ia = 1;
1691 #endif /* EAP_TTLS_VERSION */
1692         if (!data->ssl_initialized &&
1693             eap_peer_tls_ssl_init(sm, &data->ssl, config)) {
1694                 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to initialize SSL.");
1695                 return -1;
1696         }
1697         data->ssl_initialized = 1;
1698
1699         wpa_printf(MSG_DEBUG, "EAP-TTLS: Start");
1700
1701         return 0;
1702 }
1703
1704
1705 static int eap_ttls_process_handshake(struct eap_sm *sm,
1706                                       struct eap_ttls_data *data,
1707                                       struct eap_method_ret *ret,
1708                                       u8 identifier,
1709                                       const u8 *in_data, size_t in_len,
1710                                       struct wpabuf **out_data)
1711 {
1712         int res;
1713
1714         res = eap_peer_tls_process_helper(sm, &data->ssl, EAP_TYPE_TTLS,
1715                                           data->ttls_version, identifier,
1716                                           in_data, in_len, out_data);
1717
1718         if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) {
1719                 wpa_printf(MSG_DEBUG, "EAP-TTLS: TLS done, proceed to "
1720                            "Phase 2");
1721                 if (data->resuming) {
1722                         wpa_printf(MSG_DEBUG, "EAP-TTLS: fast reauth - may "
1723                                    "skip Phase 2");
1724                         ret->decision = DECISION_COND_SUCC;
1725                         ret->methodState = METHOD_MAY_CONT;
1726                 }
1727                 data->phase2_start = 1;
1728                 if (data->ttls_version == 0)
1729                         eap_ttls_v0_derive_key(sm, data);
1730
1731                 if (*out_data == NULL || wpabuf_len(*out_data) == 0) {
1732                         if (eap_ttls_decrypt(sm, data, ret, identifier,
1733                                              NULL, out_data)) {
1734                                 wpa_printf(MSG_WARNING, "EAP-TTLS: "
1735                                            "failed to process early "
1736                                            "start for Phase 2");
1737                         }
1738                         res = 0;
1739                 }
1740                 data->resuming = 0;
1741         }
1742
1743         if (res == 2) {
1744                 struct wpabuf msg;
1745                 /*
1746                  * Application data included in the handshake message.
1747                  */
1748                 wpabuf_free(data->pending_phase2_req);
1749                 data->pending_phase2_req = *out_data;
1750                 *out_data = NULL;
1751                 wpabuf_set(&msg, in_data, in_len);
1752                 res = eap_ttls_decrypt(sm, data, ret, identifier, &msg,
1753                                        out_data);
1754         }
1755
1756         return res;
1757 }
1758
1759
1760 static void eap_ttls_check_auth_status(struct eap_sm *sm,
1761                                        struct eap_ttls_data *data,
1762                                        struct eap_method_ret *ret)
1763 {
1764         if (data->ttls_version == 0 && ret->methodState == METHOD_DONE) {
1765                 ret->allowNotifications = FALSE;
1766                 if (ret->decision == DECISION_UNCOND_SUCC ||
1767                     ret->decision == DECISION_COND_SUCC) {
1768                         wpa_printf(MSG_DEBUG, "EAP-TTLS: Authentication "
1769                                    "completed successfully");
1770                         data->phase2_success = 1;
1771 #ifdef EAP_TNC
1772                         if (!data->ready_for_tnc && !data->tnc_started) {
1773                                 /*
1774                                  * TNC may be required as the next
1775                                  * authentication method within the tunnel.
1776                                  */
1777                                 ret->methodState = METHOD_MAY_CONT;
1778                                 data->ready_for_tnc = 1;
1779                         }
1780 #endif /* EAP_TNC */
1781                 }
1782         } else if (data->ttls_version == 0 &&
1783                    ret->methodState == METHOD_MAY_CONT &&
1784                    (ret->decision == DECISION_UNCOND_SUCC ||
1785                     ret->decision == DECISION_COND_SUCC)) {
1786                         wpa_printf(MSG_DEBUG, "EAP-TTLS: Authentication "
1787                                    "completed successfully (MAY_CONT)");
1788                         data->phase2_success = 1;
1789         }
1790 }
1791
1792
1793 static struct wpabuf * eap_ttls_process(struct eap_sm *sm, void *priv,
1794                                         struct eap_method_ret *ret,
1795                                         const struct wpabuf *reqData)
1796 {
1797         size_t left;
1798         int res;
1799         u8 flags, id;
1800         struct wpabuf *resp;
1801         const u8 *pos;
1802         struct eap_ttls_data *data = priv;
1803
1804         pos = eap_peer_tls_process_init(sm, &data->ssl, EAP_TYPE_TTLS, ret,
1805                                         reqData, &left, &flags);
1806         if (pos == NULL)
1807                 return NULL;
1808         id = eap_get_id(reqData);
1809
1810         if (flags & EAP_TLS_FLAGS_START) {
1811                 if (eap_ttls_process_start(sm, data, flags, ret) < 0)
1812                         return NULL;
1813
1814                 /* RFC 5281, Ch. 9.2:
1815                  * "This packet MAY contain additional information in the form
1816                  * of AVPs, which may provide useful hints to the client"
1817                  * For now, ignore any potential extra data.
1818                  */
1819                 left = 0;
1820         } else if (!data->ssl_initialized) {
1821                 wpa_printf(MSG_DEBUG, "EAP-TTLS: First message did not "
1822                            "include Start flag");
1823                 ret->methodState = METHOD_DONE;
1824                 ret->decision = DECISION_FAIL;
1825                 ret->allowNotifications = FALSE;
1826                 return NULL;
1827         }
1828
1829         resp = NULL;
1830         if (tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&
1831             !data->resuming) {
1832                 struct wpabuf msg;
1833                 wpabuf_set(&msg, pos, left);
1834                 res = eap_ttls_decrypt(sm, data, ret, id, &msg, &resp);
1835         } else {
1836                 res = eap_ttls_process_handshake(sm, data, ret, id,
1837                                                  pos, left, &resp);
1838         }
1839
1840         eap_ttls_check_auth_status(sm, data, ret);
1841
1842         /* FIX: what about res == -1? Could just move all error processing into
1843          * the other functions and get rid of this res==1 case here. */
1844         if (res == 1) {
1845                 wpabuf_free(resp);
1846                 return eap_peer_tls_build_ack(id, EAP_TYPE_TTLS,
1847                                               data->ttls_version);
1848         }
1849         return resp;
1850 }
1851
1852
1853 static Boolean eap_ttls_has_reauth_data(struct eap_sm *sm, void *priv)
1854 {
1855         struct eap_ttls_data *data = priv;
1856         return tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&
1857                 data->phase2_success;
1858 }
1859
1860
1861 static void eap_ttls_deinit_for_reauth(struct eap_sm *sm, void *priv)
1862 {
1863         struct eap_ttls_data *data = priv;
1864         wpabuf_free(data->pending_phase2_req);
1865         data->pending_phase2_req = NULL;
1866 #ifdef EAP_TNC
1867         data->ready_for_tnc = 0;
1868         data->tnc_started = 0;
1869 #endif /* EAP_TNC */
1870 }
1871
1872
1873 static void * eap_ttls_init_for_reauth(struct eap_sm *sm, void *priv)
1874 {
1875         struct eap_ttls_data *data = priv;
1876         os_free(data->key_data);
1877         data->key_data = NULL;
1878         if (eap_peer_tls_reauth_init(sm, &data->ssl)) {
1879                 os_free(data);
1880                 return NULL;
1881         }
1882         if (data->phase2_priv && data->phase2_method &&
1883             data->phase2_method->init_for_reauth)
1884                 data->phase2_method->init_for_reauth(sm, data->phase2_priv);
1885         data->phase2_start = 0;
1886         data->phase2_success = 0;
1887         data->resuming = 1;
1888         data->reauth = 1;
1889         return priv;
1890 }
1891
1892
1893 static int eap_ttls_get_status(struct eap_sm *sm, void *priv, char *buf,
1894                                size_t buflen, int verbose)
1895 {
1896         struct eap_ttls_data *data = priv;
1897         int len, ret;
1898
1899         len = eap_peer_tls_status(sm, &data->ssl, buf, buflen, verbose);
1900         ret = os_snprintf(buf + len, buflen - len,
1901                           "EAP-TTLSv%d Phase2 method=",
1902                           data->ttls_version);
1903         if (ret < 0 || (size_t) ret >= buflen - len)
1904                 return len;
1905         len += ret;
1906         switch (data->phase2_type) {
1907         case EAP_TTLS_PHASE2_EAP:
1908                 ret = os_snprintf(buf + len, buflen - len, "EAP-%s\n",
1909                                   data->phase2_method ?
1910                                   data->phase2_method->name : "?");
1911                 break;
1912         case EAP_TTLS_PHASE2_MSCHAPV2:
1913                 ret = os_snprintf(buf + len, buflen - len, "MSCHAPV2\n");
1914                 break;
1915         case EAP_TTLS_PHASE2_MSCHAP:
1916                 ret = os_snprintf(buf + len, buflen - len, "MSCHAP\n");
1917                 break;
1918         case EAP_TTLS_PHASE2_PAP:
1919                 ret = os_snprintf(buf + len, buflen - len, "PAP\n");
1920                 break;
1921         case EAP_TTLS_PHASE2_CHAP:
1922                 ret = os_snprintf(buf + len, buflen - len, "CHAP\n");
1923                 break;
1924         default:
1925                 ret = 0;
1926                 break;
1927         }
1928         if (ret < 0 || (size_t) ret >= buflen - len)
1929                 return len;
1930         len += ret;
1931
1932         return len;
1933 }
1934
1935
1936 static Boolean eap_ttls_isKeyAvailable(struct eap_sm *sm, void *priv)
1937 {
1938         struct eap_ttls_data *data = priv;
1939         return data->key_data != NULL && data->phase2_success;
1940 }
1941
1942
1943 static u8 * eap_ttls_getKey(struct eap_sm *sm, void *priv, size_t *len)
1944 {
1945         struct eap_ttls_data *data = priv;
1946         u8 *key;
1947
1948         if (data->key_data == NULL || !data->phase2_success)
1949                 return NULL;
1950
1951         key = os_malloc(EAP_TLS_KEY_LEN);
1952         if (key == NULL)
1953                 return NULL;
1954
1955         *len = EAP_TLS_KEY_LEN;
1956         os_memcpy(key, data->key_data, EAP_TLS_KEY_LEN);
1957
1958         return key;
1959 }
1960
1961
1962 int eap_peer_ttls_register(void)
1963 {
1964         struct eap_method *eap;
1965         int ret;
1966
1967         eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
1968                                     EAP_VENDOR_IETF, EAP_TYPE_TTLS, "TTLS");
1969         if (eap == NULL)
1970                 return -1;
1971
1972         eap->init = eap_ttls_init;
1973         eap->deinit = eap_ttls_deinit;
1974         eap->process = eap_ttls_process;
1975         eap->isKeyAvailable = eap_ttls_isKeyAvailable;
1976         eap->getKey = eap_ttls_getKey;
1977         eap->get_status = eap_ttls_get_status;
1978         eap->has_reauth_data = eap_ttls_has_reauth_data;
1979         eap->deinit_for_reauth = eap_ttls_deinit_for_reauth;
1980         eap->init_for_reauth = eap_ttls_init_for_reauth;
1981
1982         ret = eap_peer_method_register(eap);
1983         if (ret)
1984                 eap_peer_method_free(eap);
1985         return ret;
1986 }