contrib/wpa_supplicant-0.4.9/eap_ttls.c

   1 /*
   2  * WPA Supplicant / EAP-TTLS (draft-ietf-pppext-eap-ttls-03.txt)
   3  * Copyright (c) 2004-2005, Jouni Malinen <jkmaline@cc.hut.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include <stdlib.h>
  16 #include <stdio.h>
  17 #include <string.h>
  18
  19 #include "common.h"
  20 #include "eap_i.h"
  21 #include "eap_tls_common.h"
  22 #include "wpa_supplicant.h"
  23 #include "config_ssid.h"
  24 #include "ms_funcs.h"
  25 #include "crypto.h"
  26 #include "tls.h"
  27 #include "eap_ttls.h"
  28
  29
  30 static void eap_ttls_deinit(struct eap_sm *sm, void *priv);
  31
  32
  33 struct eap_ttls_data {
  34         struct eap_ssl_data ssl;
  35
  36         const struct eap_method *phase2_method;
  37         void *phase2_priv;
  38         int phase2_success;
  39         int phase2_start;
  40
  41         enum {
  42                 EAP_TTLS_PHASE2_EAP,
  43                 EAP_TTLS_PHASE2_MSCHAPV2,
  44                 EAP_TTLS_PHASE2_MSCHAP,
  45                 EAP_TTLS_PHASE2_PAP,
  46                 EAP_TTLS_PHASE2_CHAP
  47         } phase2_type;
  48         u8 phase2_eap_type;
  49         u8 *phase2_eap_types;
  50         size_t num_phase2_eap_types;
  51
  52         u8 auth_response[20];
  53         int auth_response_valid;
  54         u8 ident;
  55         int resuming; /* starting a resumed session */
  56         int reauth; /* reauthentication */
  57         u8 *key_data;
  58
  59         u8 *pending_phase2_req;
  60         size_t pending_phase2_req_len;
  61 };
  62
  63
  64 static void * eap_ttls_init(struct eap_sm *sm)
  65 {
  66         struct eap_ttls_data *data;
  67         struct wpa_ssid *config = eap_get_config(sm);
  68         char *selected;
  69
  70         data = malloc(sizeof(*data));
  71         if (data == NULL)
  72                 return NULL;
  73         memset(data, 0, sizeof(*data));
  74         selected = "EAP";
  75         data->phase2_type = EAP_TTLS_PHASE2_EAP;
  76         if (config && config->phase2) {
  77                 if (strstr(config->phase2, "autheap=")) {
  78                         selected = "EAP";
  79                         data->phase2_type = EAP_TTLS_PHASE2_EAP;
  80                 } else if (strstr(config->phase2, "auth=MSCHAPV2")) {
  81                         selected = "MSCHAPV2";
  82                         data->phase2_type = EAP_TTLS_PHASE2_MSCHAPV2;
  83                 } else if (strstr(config->phase2, "auth=MSCHAP")) {
  84                         selected = "MSCHAP";
  85                         data->phase2_type = EAP_TTLS_PHASE2_MSCHAP;
  86                 } else if (strstr(config->phase2, "auth=PAP")) {
  87                         selected = "PAP";
  88                         data->phase2_type = EAP_TTLS_PHASE2_PAP;
  89                 } else if (strstr(config->phase2, "auth=CHAP")) {
  90                         selected = "CHAP";
  91                         data->phase2_type = EAP_TTLS_PHASE2_CHAP;
  92                 }
  93         }
  94         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase2 type: %s", selected);
  95
  96         if (data->phase2_type == EAP_TTLS_PHASE2_EAP) {
  97                 if (config && config->phase2) {
  98                         char *start, *pos, *buf;
  99                         u8 method, *methods = NULL, *_methods;
 100                         size_t num_methods = 0;
 101                         start = buf = strdup(config->phase2);
 102                         if (buf == NULL) {
 103                                 eap_ttls_deinit(sm, data);
 104                                 return NULL;
 105                         }
 106                         while (start && *start != '\0') {
 107                                 pos = strstr(start, "autheap=");
 108                                 if (pos == NULL)
 109                                         break;
 110                                 if (start != pos && *(pos - 1) != ' ') {
 111                                         start = pos + 8;
 112                                         continue;
 113                                 }
 114
 115                                 start = pos + 8;
 116                                 pos = strchr(start, ' ');
 117                                 if (pos)
 118                                         *pos++ = '\0';
 119                                 method = eap_get_phase2_type(start);
 120                                 if (method == EAP_TYPE_NONE) {
 121                                         wpa_printf(MSG_ERROR, "EAP-TTLS: "
 122                                                    "Unsupported Phase2 EAP "
 123                                                    "method '%s'", start);
 124                                 } else {
 125                                         num_methods++;
 126                                         _methods = realloc(methods,
 127                                                            num_methods);
 128                                         if (_methods == NULL) {
 129                                                 free(methods);
 130                                                 free(buf);
 131                                                 eap_ttls_deinit(sm, data);
 132                                                 return NULL;
 133                                         }
 134                                         methods = _methods;
 135                                         methods[num_methods - 1] = method;
 136                                 }
 137
 138                                 start = pos;
 139                         }
 140                         free(buf);
 141                         data->phase2_eap_types = methods;
 142                         data->num_phase2_eap_types = num_methods;
 143                 }
 144                 if (data->phase2_eap_types == NULL) {
 145                         data->phase2_eap_types = eap_get_phase2_types(
 146                                 config, &data->num_phase2_eap_types);
 147                 }
 148                 if (data->phase2_eap_types == NULL) {
 149                         wpa_printf(MSG_ERROR, "EAP-TTLS: No Phase2 EAP method "
 150                                    "available");
 151                         eap_ttls_deinit(sm, data);
 152                         return NULL;
 153                 }
 154                 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Phase2 EAP types",
 155                             data->phase2_eap_types,
 156                             data->num_phase2_eap_types);
 157                 data->phase2_eap_type = EAP_TYPE_NONE;
 158         }
 159
 160
 161         if (eap_tls_ssl_init(sm, &data->ssl, config)) {
 162                 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to initialize SSL.");
 163                 eap_ttls_deinit(sm, data);
 164                 return NULL;
 165         }
 166
 167         return data;
 168 }
 169
 170
 171 static void eap_ttls_deinit(struct eap_sm *sm, void *priv)
 172 {
 173         struct eap_ttls_data *data = priv;
 174         if (data == NULL)
 175                 return;
 176         if (data->phase2_priv && data->phase2_method)
 177                 data->phase2_method->deinit(sm, data->phase2_priv);
 178         free(data->phase2_eap_types);
 179         eap_tls_ssl_deinit(sm, &data->ssl);
 180         free(data->key_data);
 181         free(data->pending_phase2_req);
 182         free(data);
 183 }
 184
 185
 186 static int eap_ttls_encrypt(struct eap_sm *sm, struct eap_ttls_data *data,
 187                             int id, const u8 *plain, size_t plain_len,
 188                             u8 **out_data, size_t *out_len)
 189 {
 190         int res;
 191         u8 *pos;
 192         struct eap_hdr *resp;
 193
 194         /* TODO: add support for fragmentation, if needed. This will need to
 195          * add TLS Message Length field, if the frame is fragmented. */
 196         resp = malloc(sizeof(struct eap_hdr) + 2 + data->ssl.tls_out_limit);
 197         if (resp == NULL)
 198                 return -1;
 199
 200         resp->code = EAP_CODE_RESPONSE;
 201         resp->identifier = id;
 202
 203         pos = (u8 *) (resp + 1);
 204         *pos++ = EAP_TYPE_TTLS;
 205         *pos++ = 0;
 206
 207         res = tls_connection_encrypt(sm->ssl_ctx, data->ssl.conn,
 208                                      plain, plain_len,
 209                                      pos, data->ssl.tls_out_limit);
 210         if (res < 0) {
 211                 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to encrypt Phase 2 "
 212                            "data");
 213                 free(resp);
 214                 return -1;
 215         }
 216
 217         *out_len = sizeof(struct eap_hdr) + 2 + res;
 218         resp->length = host_to_be16(*out_len);
 219         *out_data = (u8 *) resp;
 220         return 0;
 221 }
 222
 223
 224 static u8 * eap_ttls_avp_hdr(u8 *avphdr, u32 avp_code, u32 vendor_id,
 225                              int mandatory, size_t len)
 226 {
 227         struct ttls_avp_vendor *avp;
 228         u8 flags;
 229         size_t hdrlen;
 230
 231         avp = (struct ttls_avp_vendor *) avphdr;
 232         flags = mandatory ? AVP_FLAGS_MANDATORY : 0;
 233         if (vendor_id) {
 234                 flags |= AVP_FLAGS_VENDOR;
 235                 hdrlen = sizeof(*avp);
 236                 avp->vendor_id = host_to_be32(vendor_id);
 237         } else {
 238                 hdrlen = sizeof(struct ttls_avp);
 239         }
 240
 241         avp->avp_code = host_to_be32(avp_code);
 242         avp->avp_length = host_to_be32((flags << 24) | (hdrlen + len));
 243
 244         return avphdr + hdrlen;
 245 }
 246
 247
 248 static u8 * eap_ttls_avp_add(u8 *start, u8 *avphdr, u32 avp_code,
 249                              u32 vendor_id, int mandatory,
 250                              u8 *data, size_t len)
 251 {
 252         u8 *pos;
 253         pos = eap_ttls_avp_hdr(avphdr, avp_code, vendor_id, mandatory, len);
 254         memcpy(pos, data, len);
 255         pos += len;
 256         AVP_PAD(start, pos);
 257         return pos;
 258 }
 259
 260
 261 static int eap_ttls_avp_encapsulate(u8 **resp, size_t *resp_len, u32 avp_code,
 262                                     int mandatory)
 263 {
 264         u8 *avp, *pos;
 265
 266         avp = malloc(sizeof(struct ttls_avp) + *resp_len + 4);
 267         if (avp == NULL) {
 268                 free(*resp);
 269                 *resp = NULL;
 270                 *resp_len = 0;
 271                 return -1;
 272         }
 273
 274         pos = eap_ttls_avp_hdr(avp, avp_code, 0, mandatory, *resp_len);
 275         memcpy(pos, *resp, *resp_len);
 276         pos += *resp_len;
 277         AVP_PAD(avp, pos);
 278         free(*resp);
 279         *resp = avp;
 280         *resp_len = pos - avp;
 281         return 0;
 282 }
 283
 284
 285 static int eap_ttls_phase2_nak(struct eap_sm *sm,
 286                                struct eap_ttls_data *data,
 287                                struct eap_hdr *hdr,
 288                                u8 **resp, size_t *resp_len)
 289 {
 290         struct eap_hdr *resp_hdr;
 291         u8 *pos = (u8 *) (hdr + 1);
 292
 293         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 Request: Nak type=%d", *pos);
 294         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Allowed Phase2 EAP types",
 295                     data->phase2_eap_types, data->num_phase2_eap_types);
 296         *resp_len = sizeof(struct eap_hdr) + 1 + data->num_phase2_eap_types;
 297         *resp = malloc(*resp_len);
 298         if (*resp == NULL)
 299                 return -1;
 300
 301         resp_hdr = (struct eap_hdr *) (*resp);
 302         resp_hdr->code = EAP_CODE_RESPONSE;
 303         resp_hdr->identifier = hdr->identifier;
 304         resp_hdr->length = host_to_be16(*resp_len);
 305         pos = (u8 *) (resp_hdr + 1);
 306         *pos++ = EAP_TYPE_NAK;
 307         memcpy(pos, data->phase2_eap_types, data->num_phase2_eap_types);
 308
 309         return 0;
 310 }
 311
 312
 313 static int eap_ttls_phase2_request_eap(struct eap_sm *sm,
 314                                        struct eap_ttls_data *data,
 315                                        struct eap_method_ret *ret,
 316                                        const struct eap_hdr *req,
 317                                        struct eap_hdr *hdr,
 318                                        u8 **resp, size_t *resp_len)
 319 {
 320         size_t len = be_to_host16(hdr->length);
 321         u8 *pos;
 322         struct eap_method_ret iret;
 323         struct wpa_ssid *config = eap_get_config(sm);
 324
 325         if (len <= sizeof(struct eap_hdr)) {
 326                 wpa_printf(MSG_INFO, "EAP-TTLS: too short "
 327                            "Phase 2 request (len=%lu)", (unsigned long) len);
 328                 return -1;
 329         }
 330         pos = (u8 *) (hdr + 1);
 331         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 EAP Request: type=%d", *pos);
 332         switch (*pos) {
 333         case EAP_TYPE_IDENTITY:
 334                 *resp = eap_sm_buildIdentity(sm, req->identifier, resp_len, 1);
 335                 break;
 336         default:
 337                 if (data->phase2_eap_type == EAP_TYPE_NONE) {
 338                         int i;
 339                         for (i = 0; i < data->num_phase2_eap_types; i++) {
 340                                 if (data->phase2_eap_types[i] != *pos)
 341                                         continue;
 342
 343                                 data->phase2_eap_type = *pos;
 344                                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Selected "
 345                                            "Phase 2 EAP method %d",
 346                                            data->phase2_eap_type);
 347                                 break;
 348                         }
 349                 }
 350                 if (*pos != data->phase2_eap_type || *pos == EAP_TYPE_NONE) {
 351                         if (eap_ttls_phase2_nak(sm, data, hdr, resp, resp_len))
 352                                 return -1;
 353                         break;
 354                 }
 355
 356                 if (data->phase2_priv == NULL) {
 357                         data->phase2_method = eap_sm_get_eap_methods(*pos);
 358                         if (data->phase2_method) {
 359                                 sm->init_phase2 = 1;
 360                                 data->phase2_priv =
 361                                         data->phase2_method->init(sm);
 362                                 sm->init_phase2 = 0;
 363                         }
 364                 }
 365                 if (data->phase2_priv == NULL || data->phase2_method == NULL) {
 366                         wpa_printf(MSG_INFO, "EAP-TTLS: failed to initialize "
 367                                    "Phase 2 EAP method %d", *pos);
 368                         return -1;
 369                 }
 370                 memset(&iret, 0, sizeof(iret));
 371                 *resp = data->phase2_method->process(sm, data->phase2_priv,
 372                                                      &iret, (u8 *) hdr, len,
 373                                                      resp_len);
 374                 if ((iret.methodState == METHOD_DONE ||
 375                      iret.methodState == METHOD_MAY_CONT) &&
 376                     (iret.decision == DECISION_UNCOND_SUCC ||
 377                      iret.decision == DECISION_COND_SUCC ||
 378                      iret.decision == DECISION_FAIL)) {
 379                         ret->methodState = iret.methodState;
 380                         ret->decision = iret.decision;
 381                 }
 382                 break;
 383         }
 384
 385         if (*resp == NULL &&
 386             (config->pending_req_identity || config->pending_req_password ||
 387              config->pending_req_otp)) {
 388                 return 0;
 389         }
 390
 391         if (*resp == NULL)
 392                 return -1;
 393
 394         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: AVP encapsulate EAP Response",
 395                     *resp, *resp_len);
 396         return eap_ttls_avp_encapsulate(resp, resp_len,
 397                                         RADIUS_ATTR_EAP_MESSAGE, 1);
 398 }
 399
 400
 401 static int eap_ttls_phase2_request_mschapv2(struct eap_sm *sm,
 402                                             struct eap_ttls_data *data,
 403                                             struct eap_method_ret *ret,
 404                                             const struct eap_hdr *req,
 405                                             struct eap_hdr *hdr,
 406                                             u8 **resp, size_t *resp_len)
 407 {
 408         struct wpa_ssid *config = eap_get_config(sm);
 409         u8 *buf, *pos, *challenge, *username, *peer_challenge;
 410         size_t username_len;
 411         int i;
 412
 413         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 MSCHAPV2 Request");
 414
 415         /* MSCHAPv2 does not include optional domain name in the
 416          * challenge-response calculation, so remove domain prefix
 417          * (if present). */
 418         username = config->identity;
 419         username_len = config->identity_len;
 420         pos = username;
 421         for (i = 0; i < username_len; i++) {
 422                 if (username[i] == '\\') {
 423                         username_len -= i + 1;
 424                         username += i + 1;
 425                         break;
 426                 }
 427         }
 428
 429         pos = buf = malloc(config->identity_len + 1000);
 430         if (buf == NULL) {
 431                 wpa_printf(MSG_ERROR,
 432                            "EAP-TTLS/MSCHAPV2: Failed to allocate memory");
 433                 return -1;
 434         }
 435
 436         /* User-Name */
 437         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,
 438                                config->identity, config->identity_len);
 439
 440         /* MS-CHAP-Challenge */
 441         challenge = eap_tls_derive_key(sm, &data->ssl, "ttls challenge",
 442                                        EAP_TTLS_MSCHAPV2_CHALLENGE_LEN * 2 +
 443                                        1);
 444         if (challenge == NULL) {
 445                 free(buf);
 446                 wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAPV2: Failed to derive "
 447                            "implicit challenge");
 448                 return -1;
 449         }
 450         peer_challenge = challenge + 1 + EAP_TTLS_MSCHAPV2_CHALLENGE_LEN;
 451
 452         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_MS_CHAP_CHALLENGE,
 453                                RADIUS_VENDOR_ID_MICROSOFT, 1,
 454                                challenge, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN);
 455
 456         /* MS-CHAP2-Response */
 457         pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP2_RESPONSE,
 458                                RADIUS_VENDOR_ID_MICROSOFT, 1,
 459                                EAP_TTLS_MSCHAPV2_RESPONSE_LEN);
 460         data->ident = challenge[EAP_TTLS_MSCHAPV2_CHALLENGE_LEN];
 461         *pos++ = data->ident;
 462         *pos++ = 0; /* Flags */
 463         memcpy(pos, peer_challenge, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN);
 464         pos += EAP_TTLS_MSCHAPV2_CHALLENGE_LEN;
 465         memset(pos, 0, 8); /* Reserved, must be zero */
 466         pos += 8;
 467         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAPV2: implicit auth_challenge",
 468                     challenge, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN);
 469         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAPV2: peer_challenge",
 470                     peer_challenge, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN);
 471         wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: MSCHAPV2 username",
 472                           username, username_len);
 473         wpa_hexdump_ascii_key(MSG_DEBUG, "EAP-TTLS: MSCHAPV2 password",
 474                               config->password, config->password_len);
 475         generate_nt_response(challenge, peer_challenge,
 476                              username, username_len,
 477                              config->password, config->password_len,
 478                              pos);
 479         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAPV2 response", pos, 24);
 480         generate_authenticator_response(config->password, config->password_len,
 481                                         peer_challenge, challenge,
 482                                         username, username_len,
 483                                         pos, data->auth_response);
 484         data->auth_response_valid = 1;
 485
 486         pos += 24;
 487         free(challenge);
 488         AVP_PAD(buf, pos);
 489
 490         *resp = buf;
 491         *resp_len = pos - buf;
 492
 493         if (sm->workaround) {
 494                 /* At least FreeRADIUS seems to be terminating
 495                  * EAP-TTLS/MSHCAPV2 without the expected MS-CHAP-v2 Success
 496                  * packet. */
 497                 wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: EAP workaround - "
 498                            "allow success without tunneled response");
 499                 ret->methodState = METHOD_MAY_CONT;
 500                 ret->decision = DECISION_COND_SUCC;
 501         }
 502
 503         return 0;
 504 }
 505
 506
 507 static int eap_ttls_phase2_request_mschap(struct eap_sm *sm,
 508                                           struct eap_ttls_data *data,
 509                                           struct eap_method_ret *ret,
 510                                           const struct eap_hdr *req,
 511                                           struct eap_hdr *hdr,
 512                                           u8 **resp, size_t *resp_len)
 513 {
 514         struct wpa_ssid *config = eap_get_config(sm);
 515         u8 *buf, *pos, *challenge;
 516
 517         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 MSCHAP Request");
 518
 519         pos = buf = malloc(config->identity_len + 1000);
 520         if (buf == NULL) {
 521                 wpa_printf(MSG_ERROR,
 522                            "EAP-TTLS/MSCHAP: Failed to allocate memory");
 523                 return -1;
 524         }
 525
 526         /* User-Name */
 527         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,
 528                                config->identity, config->identity_len);
 529
 530         /* MS-CHAP-Challenge */
 531         challenge = eap_tls_derive_key(sm, &data->ssl, "ttls challenge",
 532                                        EAP_TLS_KEY_LEN);
 533         if (challenge == NULL) {
 534                 free(buf);
 535                 wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAP: Failed to derive "
 536                            "implicit challenge");
 537                 return -1;
 538         }
 539
 540         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_MS_CHAP_CHALLENGE,
 541                                RADIUS_VENDOR_ID_MICROSOFT, 1,
 542                                challenge, EAP_TTLS_MSCHAP_CHALLENGE_LEN);
 543
 544         /* MS-CHAP-Response */
 545         pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP_RESPONSE,
 546                                RADIUS_VENDOR_ID_MICROSOFT, 1,
 547                                EAP_TTLS_MSCHAP_RESPONSE_LEN);
 548         data->ident = challenge[EAP_TTLS_MSCHAP_CHALLENGE_LEN];
 549         *pos++ = data->ident;
 550         *pos++ = 1; /* Flags: Use NT style passwords */
 551         memset(pos, 0, 24); /* LM-Response */
 552         pos += 24;
 553         nt_challenge_response(challenge,
 554                               config->password, config->password_len,
 555                               pos); /* NT-Response */
 556         wpa_hexdump_ascii_key(MSG_DEBUG, "EAP-TTLS: MSCHAP password",
 557                               config->password, config->password_len);
 558         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAP implicit challenge",
 559                     challenge, EAP_TTLS_MSCHAP_CHALLENGE_LEN);
 560         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAP response", pos, 24);
 561         pos += 24;
 562         free(challenge);
 563         AVP_PAD(buf, pos);
 564
 565         *resp = buf;
 566         *resp_len = pos - buf;
 567
 568         /* EAP-TTLS/MSCHAP does not provide tunneled success notification, so
 569          * assume that Phase2 succeeds. */
 570         ret->methodState = METHOD_DONE;
 571         ret->decision = DECISION_COND_SUCC;
 572
 573         return 0;
 574 }
 575
 576
 577 static int eap_ttls_phase2_request_pap(struct eap_sm *sm,
 578                                        struct eap_ttls_data *data,
 579                                        struct eap_method_ret *ret,
 580                                        const struct eap_hdr *req,
 581                                        struct eap_hdr *hdr,
 582                                        u8 **resp, size_t *resp_len)
 583 {
 584         struct wpa_ssid *config = eap_get_config(sm);
 585         u8 *buf, *pos;
 586         size_t pad;
 587
 588         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 PAP Request");
 589
 590         pos = buf = malloc(config->identity_len + config->password_len + 100);
 591         if (buf == NULL) {
 592                 wpa_printf(MSG_ERROR,
 593                            "EAP-TTLS/PAP: Failed to allocate memory");
 594                 return -1;
 595         }
 596
 597         /* User-Name */
 598         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,
 599                                config->identity, config->identity_len);
 600
 601         /* User-Password; in RADIUS, this is encrypted, but EAP-TTLS encrypts
 602          * the data, so no separate encryption is used in the AVP itself.
 603          * However, the password is padded to obfuscate its length. */
 604         pad = (16 - (config->password_len & 15)) & 15;
 605         pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_USER_PASSWORD, 0, 1,
 606                                config->password_len + pad);
 607         memcpy(pos, config->password, config->password_len);
 608         pos += config->password_len;
 609         memset(pos, 0, pad);
 610         pos += pad;
 611         AVP_PAD(buf, pos);
 612
 613         *resp = buf;
 614         *resp_len = pos - buf;
 615
 616         /* EAP-TTLS/PAP does not provide tunneled success notification, so
 617          * assume that Phase2 succeeds. */
 618         ret->methodState = METHOD_DONE;
 619         ret->decision = DECISION_COND_SUCC;
 620
 621         return 0;
 622 }
 623
 624
 625 static int eap_ttls_phase2_request_chap(struct eap_sm *sm,
 626                                         struct eap_ttls_data *data,
 627                                         struct eap_method_ret *ret,
 628                                         const struct eap_hdr *req,
 629                                         struct eap_hdr *hdr,
 630                                         u8 **resp, size_t *resp_len)
 631 {
 632         struct wpa_ssid *config = eap_get_config(sm);
 633         u8 *buf, *pos, *challenge;
 634         const u8 *addr[3];
 635         size_t len[3];
 636
 637         wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 CHAP Request");
 638
 639         pos = buf = malloc(config->identity_len + 1000);
 640         if (buf == NULL) {
 641                 wpa_printf(MSG_ERROR,
 642                            "EAP-TTLS/CHAP: Failed to allocate memory");
 643                 return -1;
 644         }
 645
 646         /* User-Name */
 647         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,
 648                                config->identity, config->identity_len);
 649
 650         /* CHAP-Challenge */
 651         challenge = eap_tls_derive_key(sm, &data->ssl, "ttls challenge",
 652                                        EAP_TLS_KEY_LEN);
 653         if (challenge == NULL) {
 654                 free(buf);
 655                 wpa_printf(MSG_ERROR, "EAP-TTLS/CHAP: Failed to derive "
 656                            "implicit challenge");
 657                 return -1;
 658         }
 659
 660         pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_CHAP_CHALLENGE, 0, 1,
 661                                challenge, EAP_TTLS_CHAP_CHALLENGE_LEN);
 662
 663         /* CHAP-Password */
 664         pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_CHAP_PASSWORD, 0, 1,
 665                                1 + EAP_TTLS_CHAP_PASSWORD_LEN);
 666         data->ident = challenge[EAP_TTLS_CHAP_CHALLENGE_LEN];
 667         *pos++ = data->ident;
 668
 669         /* MD5(Ident + Password + Challenge) */
 670         addr[0] = &data->ident;
 671         len[0] = 1;
 672         addr[1] = config->password;
 673         len[1] = config->password_len;
 674         addr[2] = challenge;
 675         len[2] = EAP_TTLS_CHAP_CHALLENGE_LEN;
 676         md5_vector(3, addr, len, pos);
 677
 678         wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: CHAP username",
 679                           config->identity, config->identity_len);
 680         wpa_hexdump_ascii_key(MSG_DEBUG, "EAP-TTLS: CHAP password",
 681                               config->password, config->password_len);
 682         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: CHAP implicit challenge",
 683                     challenge, EAP_TTLS_CHAP_CHALLENGE_LEN);
 684         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: CHAP password",
 685                     pos, EAP_TTLS_CHAP_PASSWORD_LEN);
 686         pos += EAP_TTLS_CHAP_PASSWORD_LEN;
 687         free(challenge);
 688         AVP_PAD(buf, pos);
 689
 690         *resp = buf;
 691         *resp_len = pos - buf;
 692
 693         /* EAP-TTLS/CHAP does not provide tunneled success notification, so
 694          * assume that Phase2 succeeds. */
 695         ret->methodState = METHOD_DONE;
 696         ret->decision = DECISION_COND_SUCC;
 697
 698         return 0;
 699 }
 700
 701
 702 static int eap_ttls_phase2_request(struct eap_sm *sm,
 703                                    struct eap_ttls_data *data,
 704                                    struct eap_method_ret *ret,
 705                                    const struct eap_hdr *req,
 706                                    struct eap_hdr *hdr,
 707                                    u8 **resp, size_t *resp_len)
 708 {
 709         struct wpa_ssid *config = eap_get_config(sm);
 710         int res = 0;
 711
 712         if (data->phase2_type == EAP_TTLS_PHASE2_MSCHAPV2 ||
 713             data->phase2_type == EAP_TTLS_PHASE2_MSCHAP ||
 714             data->phase2_type == EAP_TTLS_PHASE2_PAP ||
 715             data->phase2_type == EAP_TTLS_PHASE2_CHAP) {
 716                 if (config->identity == NULL) {
 717                         wpa_printf(MSG_INFO,
 718                                    "EAP-TTLS: Identity not configured");
 719                         eap_sm_request_identity(sm, config);
 720                         if (config->password == NULL)
 721                                 eap_sm_request_password(sm, config);
 722                         return 0;
 723                 }
 724
 725                 if (config->password == NULL) {
 726                         wpa_printf(MSG_INFO,
 727                                    "EAP-TTLS: Password not configured");
 728                         eap_sm_request_password(sm, config);
 729                         return 0;
 730                 }
 731         }
 732
 733         switch (data->phase2_type) {
 734         case EAP_TTLS_PHASE2_EAP:
 735                 res = eap_ttls_phase2_request_eap(sm, data, ret, req, hdr,
 736                                                   resp, resp_len);
 737                 break;
 738         case EAP_TTLS_PHASE2_MSCHAPV2:
 739                 res = eap_ttls_phase2_request_mschapv2(sm, data, ret, req, hdr,
 740                                                        resp, resp_len);
 741                 break;
 742         case EAP_TTLS_PHASE2_MSCHAP:
 743                 res = eap_ttls_phase2_request_mschap(sm, data, ret, req, hdr,
 744                                                      resp, resp_len);
 745                 break;
 746         case EAP_TTLS_PHASE2_PAP:
 747                 res = eap_ttls_phase2_request_pap(sm, data, ret, req, hdr,
 748                                                   resp, resp_len);
 749                 break;
 750         case EAP_TTLS_PHASE2_CHAP:
 751                 res = eap_ttls_phase2_request_chap(sm, data, ret, req, hdr,
 752                                                    resp, resp_len);
 753                 break;
 754         default:
 755                 wpa_printf(MSG_ERROR, "EAP-TTLS: Phase 2 - Unknown");
 756                 res = -1;
 757                 break;
 758         }
 759
 760         if (res < 0) {
 761                 ret->methodState = METHOD_DONE;
 762                 ret->decision = DECISION_FAIL;
 763         }
 764
 765         return res;
 766 }
 767
 768
 769 static int eap_ttls_decrypt(struct eap_sm *sm, struct eap_ttls_data *data,
 770                             struct eap_method_ret *ret,
 771                             const struct eap_hdr *req,
 772                             const u8 *in_data, size_t in_len,
 773                             u8 **out_data, size_t *out_len)
 774 {
 775         u8 *in_decrypted = NULL, *pos;
 776         int buf_len, len_decrypted = 0, len, left, retval = 0;
 777         struct eap_hdr *hdr = NULL;
 778         u8 *resp = NULL, *mschapv2 = NULL, *eapdata = NULL;
 779         size_t resp_len, eap_len = 0;
 780         struct ttls_avp *avp;
 781         u8 recv_response[20];
 782         int mschapv2_error = 0;
 783         struct wpa_ssid *config = eap_get_config(sm);
 784         const u8 *msg;
 785         size_t msg_len;
 786         int need_more_input;
 787
 788         wpa_printf(MSG_DEBUG, "EAP-TTLS: received %lu bytes encrypted data for"
 789                    " Phase 2", (unsigned long) in_len);
 790
 791         if (data->pending_phase2_req) {
 792                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Pending Phase 2 request - "
 793                            "skip decryption and use old data");
 794                 /* Clear TLS reassembly state. */
 795                 free(data->ssl.tls_in);
 796                 data->ssl.tls_in = NULL;
 797                 data->ssl.tls_in_len = 0;
 798                 data->ssl.tls_in_left = 0;
 799                 data->ssl.tls_in_total = 0;
 800
 801                 in_decrypted = data->pending_phase2_req;
 802                 data->pending_phase2_req = NULL;
 803                 len_decrypted = data->pending_phase2_req_len;
 804                 if (data->pending_phase2_req_len == 0) {
 805                         free(in_decrypted);
 806                         in_decrypted = NULL;
 807                         goto fake_req_identity;
 808                 }
 809                 goto continue_req;
 810         }
 811
 812         if (in_len == 0 && data->phase2_start) {
 813                 data->phase2_start = 0;
 814                 /* EAP-TTLS does not use Phase2 on fast re-auth; this must be
 815                  * done only if TLS part was indeed resuming a previous
 816                  * session. Most Authentication Servers terminate EAP-TTLS
 817                  * before reaching this point, but some do not. Make
 818                  * wpa_supplicant stop phase 2 here, if needed. */
 819                 if (data->reauth &&
 820                     tls_connection_resumed(sm->ssl_ctx, data->ssl.conn)) {
 821                         wpa_printf(MSG_DEBUG, "EAP-TTLS: Session resumption - "
 822                                    "skip phase 2");
 823                         *out_data = eap_tls_build_ack(&data->ssl, out_len,
 824                                                       req->identifier,
 825                                                       EAP_TYPE_TTLS, 0);
 826                         ret->methodState = METHOD_DONE;
 827                         ret->decision = DECISION_UNCOND_SUCC;
 828                         data->phase2_success = 1;
 829                         return 0;
 830                 }
 831         fake_req_identity:
 832                 wpa_printf(MSG_DEBUG, "EAP-TTLS: empty data in beginning of "
 833                            "Phase 2 - use fake EAP-Request Identity");
 834                 buf_len = sizeof(*hdr) + 1;
 835                 in_decrypted = malloc(buf_len);
 836                 if (in_decrypted == NULL) {
 837                         wpa_printf(MSG_WARNING, "EAP-TTLS: failed to allocate "
 838                                    "memory for fake EAP-Identity Request");
 839                         retval = -1;
 840                         goto done;
 841                 }
 842                 hdr = (struct eap_hdr *) in_decrypted;
 843                 hdr->code = EAP_CODE_REQUEST;
 844                 hdr->identifier = 0;
 845                 hdr->length = host_to_be16(sizeof(*hdr) + 1);
 846                 in_decrypted[sizeof(*hdr)] = EAP_TYPE_IDENTITY;
 847                 goto process_eap;
 848         }
 849
 850         msg = eap_tls_data_reassemble(sm, &data->ssl, in_data, in_len,
 851                                       &msg_len, &need_more_input);
 852         if (msg == NULL)
 853                 return need_more_input ? 1 : -1;
 854
 855         buf_len = in_len;
 856         if (data->ssl.tls_in_total > buf_len)
 857                 buf_len = data->ssl.tls_in_total;
 858         in_decrypted = malloc(buf_len);
 859         if (in_decrypted == NULL) {
 860                 free(data->ssl.tls_in);
 861                 data->ssl.tls_in = NULL;
 862                 data->ssl.tls_in_len = 0;
 863                 wpa_printf(MSG_WARNING, "EAP-TTLS: failed to allocate memory "
 864                            "for decryption");
 865                 retval = -1;
 866                 goto done;
 867         }
 868
 869         len_decrypted = tls_connection_decrypt(sm->ssl_ctx, data->ssl.conn,
 870                                                msg, msg_len,
 871                                                in_decrypted, buf_len);
 872         free(data->ssl.tls_in);
 873         data->ssl.tls_in = NULL;
 874         data->ssl.tls_in_len = 0;
 875         if (len_decrypted < 0) {
 876                 wpa_printf(MSG_INFO, "EAP-TTLS: Failed to decrypt Phase 2 "
 877                            "data");
 878                 retval = -1;
 879                 goto done;
 880         }
 881
 882 continue_req:
 883         data->phase2_start = 0;
 884
 885         wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Decrypted Phase 2 AVPs",
 886                     in_decrypted, len_decrypted);
 887         if (len_decrypted < sizeof(struct ttls_avp)) {
 888                 wpa_printf(MSG_WARNING, "EAP-TTLS: Too short Phase 2 AVP frame"
 889                            " len=%d expected %lu or more - dropped",
 890                            len_decrypted,
 891                            (unsigned long) sizeof(struct ttls_avp));
 892                 retval = -1;
 893                 goto done;
 894         }
 895
 896         /* Parse AVPs */
 897         pos = in_decrypted;
 898         left = len_decrypted;
 899         mschapv2 = NULL;
 900
 901         while (left > 0) {
 902                 u32 avp_code, avp_length, vendor_id = 0;
 903                 u8 avp_flags, *dpos;
 904                 size_t pad, dlen;
 905                 avp = (struct ttls_avp *) pos;
 906                 avp_code = be_to_host32(avp->avp_code);
 907                 avp_length = be_to_host32(avp->avp_length);
 908                 avp_flags = (avp_length >> 24) & 0xff;
 909                 avp_length &= 0xffffff;
 910                 wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP: code=%d flags=0x%02x "
 911                            "length=%d", (int) avp_code, avp_flags,
 912                            (int) avp_length);
 913                 if (avp_length > left) {
 914                         wpa_printf(MSG_WARNING, "EAP-TTLS: AVP overflow "
 915                                    "(len=%d, left=%d) - dropped",
 916                                    (int) avp_length, left);
 917                         retval = -1;
 918                         goto done;
 919                 }
 920                 dpos = (u8 *) (avp + 1);
 921                 dlen = avp_length - sizeof(*avp);
 922                 if (avp_flags & AVP_FLAGS_VENDOR) {
 923                         if (dlen < 4) {
 924                                 wpa_printf(MSG_WARNING, "EAP-TTLS: vendor AVP "
 925                                            "underflow");
 926                                 retval = -1;
 927                                 goto done;
 928                         }
 929                         vendor_id = be_to_host32(* (u32 *) dpos);
 930                         wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP vendor_id %d",
 931                                    (int) vendor_id);
 932                         dpos += 4;
 933                         dlen -= 4;
 934                 }
 935
 936                 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: AVP data", dpos, dlen);
 937
 938                 if (vendor_id == 0 && avp_code == RADIUS_ATTR_EAP_MESSAGE) {
 939                         wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP - EAP Message");
 940                         if (eapdata == NULL) {
 941                                 eapdata = malloc(dlen);
 942                                 if (eapdata == NULL) {
 943                                         retval = -1;
 944                                         wpa_printf(MSG_WARNING, "EAP-TTLS: "
 945                                                    "failed to allocate memory "
 946                                                    "for Phase 2 EAP data");
 947                                         goto done;
 948                                 }
 949                                 memcpy(eapdata, dpos, dlen);
 950                                 eap_len = dlen;
 951                         } else {
 952                                 u8 *neweap = realloc(eapdata, eap_len + dlen);
 953                                 if (neweap == NULL) {
 954                                         retval = -1;
 955                                         wpa_printf(MSG_WARNING, "EAP-TTLS: "
 956                                                    "failed to allocate memory "
 957                                                    "for Phase 2 EAP data");
 958                                         goto done;
 959                                 }
 960                                 memcpy(neweap + eap_len, dpos, dlen);
 961                                 eapdata = neweap;
 962                                 eap_len += dlen;
 963                         }
 964                 } else if (vendor_id == 0 &&
 965                            avp_code == RADIUS_ATTR_REPLY_MESSAGE) {
 966                         /* This is an optional message that can be displayed to
 967                          * the user. */
 968                         wpa_hexdump_ascii(MSG_DEBUG,
 969                                           "EAP-TTLS: AVP - Reply-Message",
 970                                           dpos, dlen);
 971                 } else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT &&
 972                            avp_code == RADIUS_ATTR_MS_CHAP2_SUCCESS) {
 973                         wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: "
 974                                           "MS-CHAP2-Success", dpos, dlen);
 975                         if (dlen != 43) {
 976                                 wpa_printf(MSG_WARNING, "EAP-TTLS: Unexpected "
 977                                            "MS-CHAP2-Success length "
 978                                            "(len=%lu, expected 43)",
 979                                            (unsigned long) dlen);
 980                                 retval = -1;
 981                                 break;
 982                         }
 983                         mschapv2 = dpos;
 984                 } else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT &&
 985                            avp_code == RADIUS_ATTR_MS_CHAP_ERROR) {
 986                         wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: "
 987                                           "MS-CHAP-Error", dpos, dlen);
 988                         mschapv2_error = 1;
 989                 } else if (avp_flags & AVP_FLAGS_MANDATORY) {
 990                         wpa_printf(MSG_WARNING, "EAP-TTLS: Unsupported "
 991                                    "mandatory AVP code %d vendor_id %d - "
 992                                    "dropped", (int) avp_code, (int) vendor_id);
 993                         retval = -1;
 994                         goto done;
 995                 } else {
 996                         wpa_printf(MSG_DEBUG, "EAP-TTLS: Ignoring unsupported "
 997                                    "AVP code %d vendor_id %d",
 998                                    (int) avp_code, (int) vendor_id);
 999                 }
1000
1001                 pad = (4 - (avp_length & 3)) & 3;
1002                 pos += avp_length + pad;
1003                 left -= avp_length + pad;
1004         }
1005
1006         switch (data->phase2_type) {
1007         case EAP_TTLS_PHASE2_EAP:
1008                 if (eapdata == NULL) {
1009                         wpa_printf(MSG_WARNING, "EAP-TTLS: No EAP Message in "
1010                                    "the packet - dropped");
1011                         retval = -1;
1012                         goto done;
1013                 }
1014
1015                 wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Phase 2 EAP",
1016                             eapdata, eap_len);
1017                 hdr = (struct eap_hdr *) eapdata;
1018
1019                 if (eap_len < sizeof(*hdr)) {
1020                         wpa_printf(MSG_WARNING, "EAP-TTLS: Too short Phase 2 "
1021                                    "EAP frame (len=%lu, expected %lu or more) "
1022                                    "- dropped", (unsigned long) eap_len,
1023                                    (unsigned long) sizeof(*hdr));
1024                         retval = -1;
1025                         goto done;
1026                 }
1027                 len = be_to_host16(hdr->length);
1028                 if (len > eap_len) {
1029                         wpa_printf(MSG_INFO, "EAP-TTLS: Length mismatch in "
1030                                    "Phase 2 EAP frame (EAP hdr len=%d, EAP "
1031                                    "data len in AVP=%lu)", len,
1032                                    (unsigned long) eap_len);
1033                         retval = -1;
1034                         goto done;
1035                 }
1036                 wpa_printf(MSG_DEBUG, "EAP-TTLS: received Phase 2: code=%d "
1037                            "identifier=%d length=%d",
1038                            hdr->code, hdr->identifier, len);
1039         process_eap:
1040                 switch (hdr->code) {
1041                 case EAP_CODE_REQUEST:
1042                         if (eap_ttls_phase2_request(sm, data, ret, req, hdr,
1043                                                     &resp, &resp_len)) {
1044                                 wpa_printf(MSG_INFO, "EAP-TTLS: Phase2 "
1045                                            "Request processing failed");
1046                                 retval = -1;
1047                                 goto done;
1048                         }
1049                         break;
1050                 default:
1051                         wpa_printf(MSG_INFO, "EAP-TTLS: Unexpected code=%d in "
1052                                    "Phase 2 EAP header", hdr->code);
1053                         retval = -1;
1054                         break;
1055                 }
1056                 break;
1057         case EAP_TTLS_PHASE2_MSCHAPV2:
1058                 if (mschapv2_error) {
1059                         wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Received "
1060                                    "MS-CHAP-Error - failed");
1061                         ret->methodState = METHOD_DONE;
1062                         ret->decision = DECISION_FAIL;
1063                         *out_data = eap_tls_build_ack(&data->ssl, out_len,
1064                                                       req->identifier,
1065                                                       EAP_TYPE_TTLS, 0);
1066                         break;
1067                 }
1068
1069                 if (mschapv2 == NULL) {
1070                         wpa_printf(MSG_WARNING, "EAP-TTLS: no MS-CHAP2-Success"
1071                                    " AVP received for Phase2 MSCHAPV2");
1072                         retval = -1;
1073                         break;
1074                 }
1075                 if (mschapv2[0] != data->ident) {
1076                         wpa_printf(MSG_WARNING, "EAP-TTLS: Ident mismatch "
1077                                    "for Phase 2 MSCHAPV2 (received Ident "
1078                                    "0x%02x, expected 0x%02x)",
1079                                    mschapv2[0], data->ident);
1080                         retval = -1;
1081                         break;
1082                 }
1083                 if (!data->auth_response_valid ||
1084                     mschapv2[1] != 'S' || mschapv2[2] != '=' ||
1085                     hexstr2bin((char *) (mschapv2 + 3), recv_response, 20) ||
1086                     memcmp(data->auth_response, recv_response, 20) != 0) {
1087                         wpa_printf(MSG_WARNING, "EAP-TTLS: Invalid "
1088                                    "authenticator response in Phase 2 "
1089                                    "MSCHAPV2 success request");
1090                         retval = -1;
1091                         break;
1092                 }
1093
1094                 wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 MSCHAPV2 "
1095                            "authentication succeeded");
1096                 ret->methodState = METHOD_DONE;
1097                 ret->decision = DECISION_UNCOND_SUCC;
1098                 data->phase2_success = 1;
1099
1100                 /* Reply with empty data; authentication server will reply
1101                  * with EAP-Success after this. */
1102                 retval = 1;
1103                 goto done;
1104         case EAP_TTLS_PHASE2_MSCHAP:
1105         case EAP_TTLS_PHASE2_PAP:
1106         case EAP_TTLS_PHASE2_CHAP:
1107                 /* EAP-TTLS/{MSCHAP,PAP,CHAP} should not send any TLS tunneled
1108                  * requests to the supplicant */
1109                 wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received unexpected "
1110                            "tunneled data");
1111                 retval = -1;
1112                 break;
1113         }
1114
1115         if (resp) {
1116                 wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Encrypting Phase 2 data",
1117                                 resp, resp_len);
1118
1119                 if (eap_ttls_encrypt(sm, data, req->identifier,
1120                                      resp, resp_len, out_data, out_len)) {
1121                         wpa_printf(MSG_INFO, "EAP-TTLS: Failed to encrypt "
1122                                    "a Phase 2 frame");
1123                 }
1124                 free(resp);
1125         } else if (config->pending_req_identity ||
1126                    config->pending_req_password ||
1127                    config->pending_req_otp ||
1128                    config->pending_req_new_password) {
1129                 free(data->pending_phase2_req);
1130                 data->pending_phase2_req = malloc(len_decrypted);
1131                 if (data->pending_phase2_req) {
1132                         memcpy(data->pending_phase2_req, in_decrypted,
1133                                len_decrypted);
1134                         data->pending_phase2_req_len = len_decrypted;
1135                 }
1136         }
1137
1138 done:
1139         free(in_decrypted);
1140         free(eapdata);
1141
1142         if (retval < 0) {
1143                 ret->methodState = METHOD_DONE;
1144                 ret->decision = DECISION_FAIL;
1145         }
1146
1147         return retval;
1148 }
1149
1150
1151 static u8 * eap_ttls_process(struct eap_sm *sm, void *priv,
1152                              struct eap_method_ret *ret,
1153                              const u8 *reqData, size_t reqDataLen,
1154                              size_t *respDataLen)
1155 {
1156         const struct eap_hdr *req;
1157         size_t left;
1158         int res;
1159         u8 flags, *resp, id;
1160         const u8 *pos;
1161         struct eap_ttls_data *data = priv;
1162
1163         pos = eap_tls_process_init(sm, &data->ssl, EAP_TYPE_TTLS, ret,
1164                                    reqData, reqDataLen, &left, &flags);
1165         if (pos == NULL)
1166                 return NULL;
1167         req = (const struct eap_hdr *) reqData;
1168         id = req->identifier;
1169
1170         if (flags & EAP_TLS_FLAGS_START) {
1171                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Start");
1172                 /* draft-ietf-pppext-eap-ttls-03.txt, Ch. 8.1:
1173                  * EAP-TTLS Start packet may, in a future specification, be
1174                  * allowed to contain data. Client based on this draft version
1175                  * must ignore such data but must not reject the Start packet.
1176                  */
1177                 left = 0;
1178         }
1179
1180         resp = NULL;
1181         if (tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&
1182             !data->resuming) {
1183                 res = eap_ttls_decrypt(sm, data, ret, req, pos, left,
1184                                        &resp, respDataLen);
1185         } else {
1186                 res = eap_tls_process_helper(sm, &data->ssl, EAP_TYPE_TTLS, 0,
1187                                              id, pos, left,
1188                                              &resp, respDataLen);
1189
1190                 if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) {
1191                         wpa_printf(MSG_DEBUG,
1192                                    "EAP-TTLS: TLS done, proceed to Phase 2");
1193                         if (data->resuming) {
1194                                 wpa_printf(MSG_DEBUG, "EAP-TTLS: fast reauth -"
1195                                            " may skip Phase 2");
1196                                 ret->decision = DECISION_COND_SUCC;
1197                                 ret->methodState = METHOD_MAY_CONT;
1198                         }
1199                         data->phase2_start = 1;
1200                         free(data->key_data);
1201                         data->key_data =
1202                                 eap_tls_derive_key(sm, &data->ssl,
1203                                                    "ttls keying material",
1204                                                    EAP_TLS_KEY_LEN);
1205                         if (data->key_data) {
1206                                 wpa_hexdump_key(MSG_DEBUG,
1207                                                 "EAP-TTLS: Derived key",
1208                                                 data->key_data,
1209                                                 EAP_TLS_KEY_LEN);
1210                         } else {
1211                                 wpa_printf(MSG_DEBUG, "EAP-TTLS: Failed to "
1212                                            "derive key");
1213                         }
1214
1215                         if (*respDataLen == 0) {
1216                                 if (eap_ttls_decrypt(sm, data, ret, req, NULL,
1217                                                      0, &resp, respDataLen)) {
1218                                         wpa_printf(MSG_WARNING, "EAP-TTLS: "
1219                                                    "failed to process early "
1220                                                    "start for Phase 2");
1221                                 }
1222                                 res = 0;
1223                         }
1224                         data->resuming = 0;
1225                 }
1226         }
1227
1228         if (ret->methodState == METHOD_DONE) {
1229                 ret->allowNotifications = FALSE;
1230                 if (ret->decision == DECISION_UNCOND_SUCC ||
1231                     ret->decision == DECISION_COND_SUCC) {
1232                         wpa_printf(MSG_DEBUG, "EAP-TTLS: Authentication "
1233                                    "completed successfully");
1234                         data->phase2_success = 1;
1235                 }
1236         } else if (sm->workaround && ret->methodState == METHOD_MAY_CONT &&
1237                    (ret->decision == DECISION_UNCOND_SUCC ||
1238                     ret->decision == DECISION_COND_SUCC)) {
1239                         wpa_printf(MSG_DEBUG, "EAP-TTLS: Authentication "
1240                                    "completed successfully (EAP workaround)");
1241                         data->phase2_success = 1;
1242         }
1243
1244         if (res == 1) {
1245                 return eap_tls_build_ack(&data->ssl, respDataLen, id,
1246                                          EAP_TYPE_TTLS, 0);
1247         }
1248         return resp;
1249 }
1250
1251
1252 static Boolean eap_ttls_has_reauth_data(struct eap_sm *sm, void *priv)
1253 {
1254         struct eap_ttls_data *data = priv;
1255         return tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&
1256                 data->phase2_success;
1257 }
1258
1259
1260 static void eap_ttls_deinit_for_reauth(struct eap_sm *sm, void *priv)
1261 {
1262         struct eap_ttls_data *data = priv;
1263         free(data->pending_phase2_req);
1264         data->pending_phase2_req = NULL;
1265 }
1266
1267
1268 static void * eap_ttls_init_for_reauth(struct eap_sm *sm, void *priv)
1269 {
1270         struct eap_ttls_data *data = priv;
1271         free(data->key_data);
1272         data->key_data = NULL;
1273         if (eap_tls_reauth_init(sm, &data->ssl)) {
1274                 free(data);
1275                 return NULL;
1276         }
1277         data->phase2_start = 0;
1278         data->phase2_success = 0;
1279         data->resuming = 1;
1280         data->reauth = 1;
1281         return priv;
1282 }
1283
1284
1285 static int eap_ttls_get_status(struct eap_sm *sm, void *priv, char *buf,
1286                                size_t buflen, int verbose)
1287 {
1288         struct eap_ttls_data *data = priv;
1289         int len;
1290
1291         len = eap_tls_status(sm, &data->ssl, buf, buflen, verbose);
1292         switch (data->phase2_type) {
1293         case EAP_TTLS_PHASE2_EAP:
1294                 len += snprintf(buf + len, buflen - len,
1295                                 "EAP-TTLS Phase2 method=EAP-%s\n",
1296                                 data->phase2_method ? data->phase2_method->name
1297                                 : "?");
1298                 break;
1299         case EAP_TTLS_PHASE2_MSCHAPV2:
1300                 len += snprintf(buf + len, buflen - len,
1301                                 "EAP-TTLS Phase2 method=MSCHAPV2\n");
1302                 break;
1303         case EAP_TTLS_PHASE2_MSCHAP:
1304                 len += snprintf(buf + len, buflen - len,
1305                                 "EAP-TTLS Phase2 method=MSCHAP\n");
1306                 break;
1307         case EAP_TTLS_PHASE2_PAP:
1308                 len += snprintf(buf + len, buflen - len,
1309                                 "EAP-TTLS Phase2 method=PAP\n");
1310                 break;
1311         case EAP_TTLS_PHASE2_CHAP:
1312                 len += snprintf(buf + len, buflen - len,
1313                                 "EAP-TTLS Phase2 method=CHAP\n");
1314                 break;
1315         }
1316
1317         return len;
1318 }
1319
1320
1321 static Boolean eap_ttls_isKeyAvailable(struct eap_sm *sm, void *priv)
1322 {
1323         struct eap_ttls_data *data = priv;
1324         return data->key_data != NULL && data->phase2_success;
1325 }
1326
1327
1328 static u8 * eap_ttls_getKey(struct eap_sm *sm, void *priv, size_t *len)
1329 {
1330         struct eap_ttls_data *data = priv;
1331         u8 *key;
1332
1333         if (data->key_data == NULL || !data->phase2_success)
1334                 return NULL;
1335
1336         key = malloc(EAP_TLS_KEY_LEN);
1337         if (key == NULL)
1338                 return NULL;
1339
1340         *len = EAP_TLS_KEY_LEN;
1341         memcpy(key, data->key_data, EAP_TLS_KEY_LEN);
1342
1343         return key;
1344 }
1345
1346
1347 const struct eap_method eap_method_ttls =
1348 {
1349         .method = EAP_TYPE_TTLS,
1350         .name = "TTLS",
1351         .init = eap_ttls_init,
1352         .deinit = eap_ttls_deinit,
1353         .process = eap_ttls_process,
1354         .isKeyAvailable = eap_ttls_isKeyAvailable,
1355         .getKey = eap_ttls_getKey,
1356         .get_status = eap_ttls_get_status,
1357         .has_reauth_data = eap_ttls_has_reauth_data,
1358         .deinit_for_reauth = eap_ttls_deinit_for_reauth,
1359         .init_for_reauth = eap_ttls_init_for_reauth,
1360 };