~ubuntu-branches/ubuntu/gutsy/wpasupplicant/gutsy

Viewing changes to src/eap_peer/eap_ttls.c

Committer: Bazaar Package Importer
Author(s): Reinhard Tartler, Alexander Sack
Date: 2007-08-26 16:06:57 UTC
mfrom: (1.1.9 upstream)
Revision ID: james.westby@ubuntu.com-20070826160657-2m8pxoweuxe8f93t

Tags: 0.6.0+0.5.8-0ubuntu1

* New upstream release
* remove patch 11_erroneous_manpage_ref, applied upstream
* remove patch 25_wpas_dbus_unregister_iface_fix, applied upstream

[ Alexander Sack ]
* bumping upstream version to replace development version 0.6.0 with
  this package from stable release branch.
* attempt to fix wierd timeout and high latency issues by going
  back to stable upstream version (0.5.9) (LP: #140763,
  LP: #141233).

files added:
ChangeLog

Makefile

README-Windows.txt

aes.c

aes.h

aes_wrap.c

aes_wrap.h

asn1.c

asn1.h

asn1_test.c

base64.c

base64.h

bignum.c

bignum.h

build_config.h

common.c

common.h

config.c

config.h

config_file.c

config_none.c

config_ssid.h

config_types.h

config_winreg.c

crypto.c

crypto.h

crypto_cryptoapi.c

crypto_gnutls.c

crypto_internal.c

crypto_libtomcrypt.c

crypto_none.c

ctrl_iface.c

ctrl_iface.h

ctrl_iface_dbus.c

ctrl_iface_dbus.h

ctrl_iface_dbus_handlers.c

ctrl_iface_dbus_handlers.h

ctrl_iface_named_pipe.c

ctrl_iface_udp.c

ctrl_iface_unix.c

dbus-wpa_supplicant.conf

dbus_dict_helpers.c

dbus_dict_helpers.h

debian/functions.sh

debian/ifupdown.sh

debian/patches/01_config.dpatch

debian/patches/02_debian_doc_examples.dpatch

debian/patches/10_orinoco_wep_key_fix.dpatch

debian/patches/20_include_madwifi.dpatch

debian/patches/21_madwifi_r1794_includes.dpatch

debian/patches/21_madwifiold_20060207_includes.dpatch

debian/wpa_action.8

debian/wpa_action.sh

debian/wpa_supplicant.init-daemon

debian/wpasupplicant.preinst

defconfig

defs.h

des.c

doc/code_structure.doxygen

doc/ctrl_iface.doxygen

doc/docbook

doc/docbook/Makefile

doc/docbook/wpa_background.8

doc/docbook/wpa_background.sgml

doc/docbook/wpa_cli.8

doc/docbook/wpa_cli.sgml

doc/docbook/wpa_passphrase.8

doc/docbook/wpa_passphrase.sgml

doc/docbook/wpa_supplicant.8

doc/docbook/wpa_supplicant.conf.5

doc/docbook/wpa_supplicant.conf.sgml

doc/docbook/wpa_supplicant.sgml

doc/doxygen.fast

doc/doxygen.full

doc/driver_wrapper.doxygen

doc/eap.doxygen

doc/kerneldoc2doxygen.pl

doc/mainpage.doxygen

doc/porting.doxygen

doc/testing_tools.doxygen

doc/wpa_supplicant.fig

driver.h

driver_atmel.c

driver_broadcom.c

driver_bsd.c

driver_hostap.c

driver_hostap.h

driver_ipw.c

driver_madwifi.c

driver_ndis.c

driver_ndis.h

driver_ndis_.c

driver_ndiswrapper.c

driver_prism54.c

driver_test.c

driver_wext.c

driver_wext.h

driver_wired.c

drivers.c

eap.c

eap.h

eap_aka.c

eap_defs.h

eap_fast.c

eap_gpsk.c

eap_gpsk_common.c

eap_gpsk_common.h

eap_gtc.c

eap_i.h

eap_leap.c

eap_md5.c

eap_methods.c

eap_methods.h

eap_mschapv2.c

eap_otp.c

eap_pax.c

eap_pax_common.c

eap_pax_common.h

eap_peap.c

eap_psk.c

eap_psk_common.c

eap_psk_common.h

eap_sake.c

eap_sake_common.c

eap_sake_common.h

eap_sim.c

eap_sim_common.c

eap_sim_common.h

eap_testing.txt

eap_tls.c

eap_tls_common.c

eap_tls_common.h

eap_tlv.c

eap_tlv.h

eap_ttls.c

eap_ttls.h

eap_vendor_test.c

eapol_sm.c

eapol_sm.h

eapol_test.c

eloop.c

eloop.h

eloop_none.c

eloop_win.c

events.c

examples

examples/ieee8021x.conf

examples/plaintext.conf

examples/wep.conf

examples/wpa-psk-tkip.conf

examples/wpa2-eap-ccmp.conf

hostapd.h

includes.h

l2_packet.h

l2_packet_freebsd.c

l2_packet_linux.c

l2_packet_ndis.c

l2_packet_none.c

l2_packet_pcap.c

l2_packet_winpcap.c

libtommath.c

main.c

main_none.c

main_winmain.c

main_winsvc.c

md4.c

md5.c

md5.h

mlme.c

mlme.h

ms_funcs.c

ms_funcs.h

ndis_events.c

nmake.mak

openssl-0.9.8d-tls-extensions.patch

openssl-0.9.8e-tls-extensions.patch

openssl-tls-extensions.patch

os.h

os_internal.c

os_none.c

os_unix.c

os_win32.c

pcsc_funcs.c

pcsc_funcs.h

pmksa_cache.c

pmksa_cache.h

preauth.c

preauth.h

preauth_test.c

priv_netlink.h

radius.c

radius.h

radius_client.c

radius_client.h

rc4.c

rc4.h

rsa.c

rsa.h

sha1.c

sha1.h

sha256.c

sha256.h

state_machine.h

tests

tests/test_aes.c

tests/test_eap_sim_common.c

tests/test_md4.c

tests/test_md5.c

tests/test_ms_funcs.c

tests/test_sha1.c

tests/test_sha256.c

tests/test_x509v3.c

tls.h

tls_gnutls.c

tls_internal.c

tls_none.c

tls_openssl.c

tls_schannel.c

tlsv1_client.c

tlsv1_client.h

tlsv1_common.c

tlsv1_common.h

todo.txt

version.h

vs2005

vs2005/eapol_test

vs2005/eapol_test/eapol_test.vcproj

vs2005/win_if_list

vs2005/win_if_list/win_if_list.vcproj

vs2005/wpa_cli

vs2005/wpa_cli/wpa_cli.vcproj

vs2005/wpa_passphrase

vs2005/wpa_passphrase/wpa_passphrase.vcproj

vs2005/wpa_supplicant

vs2005/wpa_supplicant.sln

vs2005/wpa_supplicant/wpa_supplicant.vcproj

vs2005/wpasvc

vs2005/wpasvc/wpasvc.vcproj

win_example.reg

win_if_list.c

wireless_copy.h

wpa.c

wpa.h

wpa_cli.c

wpa_common.h

wpa_ctrl.c

wpa_ctrl.h

wpa_gui

wpa_gui-qt4

wpa_gui-qt4/eventhistory.cpp

wpa_gui-qt4/eventhistory.h

wpa_gui-qt4/eventhistory.ui

wpa_gui-qt4/main.cpp

wpa_gui-qt4/networkconfig.cpp

wpa_gui-qt4/networkconfig.h

wpa_gui-qt4/networkconfig.ui

wpa_gui-qt4/scanresults.cpp

wpa_gui-qt4/scanresults.h

wpa_gui-qt4/scanresults.ui

wpa_gui-qt4/setup-mingw-cross-compiling

wpa_gui-qt4/userdatarequest.cpp

wpa_gui-qt4/userdatarequest.h

wpa_gui-qt4/userdatarequest.ui

wpa_gui-qt4/wpa_gui.pro

wpa_gui-qt4/wpagui.cpp

wpa_gui-qt4/wpagui.h

wpa_gui-qt4/wpagui.ui

wpa_gui-qt4/wpamsg.h

wpa_gui/eventhistory.ui

wpa_gui/eventhistory.ui.h

wpa_gui/main.cpp

wpa_gui/networkconfig.ui

wpa_gui/networkconfig.ui.h

wpa_gui/scanresults.ui

wpa_gui/scanresults.ui.h

wpa_gui/setup-mingw-cross-compiling

wpa_gui/userdatarequest.ui

wpa_gui/userdatarequest.ui.h

wpa_gui/wpa_gui.pro

wpa_gui/wpagui.ui

wpa_gui/wpagui.ui.h

wpa_gui/wpamsg.h

wpa_i.h

wpa_passphrase.c

wpa_supplicant.c

wpa_supplicant.conf

wpa_supplicant.h

wpa_supplicant_i.h

x509v3.c

x509v3.h

files removed:
debian/dbus-wpa_supplicant.service

debian/dot.config.mk

debian/ifupdown

debian/ifupdown/functions.sh

debian/ifupdown/ifupdown.sh

debian/ifupdown/wpa_action.8

debian/ifupdown/wpa_action.sh

debian/mk-madwifi-header-patch

debian/patches/10_fix_non_wpa_zero_len_ssid.dpatch

debian/patches/20_madwifi_headers

debian/patches/30_dbus_policy.dpatch

debian/patches/40_debian_doc_examples.dpatch

patches

patches/openssl-0.9.8-tls-extensions.patch

patches/openssl-0.9.8d-tls-extensions.patch

patches/openssl-0.9.8e-tls-extensions.patch

src/Makefile

src/common

src/common/Makefile

src/common/defs.h

src/common/ieee802_11_defs.h

src/common/version.h

src/common/wireless_copy.h

src/common/wpa_common.c

src/common/wpa_common.h

src/common/wpa_ctrl.c

src/common/wpa_ctrl.h

src/crypto

src/crypto/Makefile

src/crypto/aes.c

src/crypto/aes.h

src/crypto/aes_wrap.c

src/crypto/aes_wrap.h

src/crypto/crypto.h

src/crypto/crypto_cryptoapi.c

src/crypto/crypto_gnutls.c

src/crypto/crypto_internal.c

src/crypto/crypto_libtomcrypt.c

src/crypto/crypto_none.c

src/crypto/crypto_openssl.c

src/crypto/des.c

src/crypto/md4.c

src/crypto/md5.c

src/crypto/md5.h

src/crypto/ms_funcs.c

src/crypto/ms_funcs.h

src/crypto/rc4.c

src/crypto/rc4.h

src/crypto/sha1.c

src/crypto/sha1.h

src/crypto/sha256.c

src/crypto/sha256.h

src/crypto/tls.h

src/crypto/tls_gnutls.c

src/crypto/tls_internal.c

src/crypto/tls_none.c

src/crypto/tls_openssl.c

src/crypto/tls_schannel.c

src/drivers

src/drivers/Makefile

src/drivers/driver.h

src/drivers/driver_atmel.c

src/drivers/driver_broadcom.c

src/drivers/driver_bsd.c

src/drivers/driver_hostap.c

src/drivers/driver_hostap.h

src/drivers/driver_ipw.c

src/drivers/driver_madwifi.c

src/drivers/driver_ndis.c

src/drivers/driver_ndis.h

src/drivers/driver_ndis_.c

src/drivers/driver_ndiswrapper.c

src/drivers/driver_prism54.c

src/drivers/driver_ralink.c

src/drivers/driver_ralink.h

src/drivers/driver_test.c

src/drivers/driver_wext.c

src/drivers/driver_wext.h

src/drivers/driver_wired.c

src/drivers/drivers.c

src/drivers/ndis_events.c

src/drivers/priv_netlink.h

src/eap_common

src/eap_common/Makefile

src/eap_common/eap_common.c

src/eap_common/eap_common.h

src/eap_common/eap_defs.h

src/eap_common/eap_gpsk_common.c

src/eap_common/eap_gpsk_common.h

src/eap_common/eap_pax_common.c

src/eap_common/eap_pax_common.h

src/eap_common/eap_psk_common.c

src/eap_common/eap_psk_common.h

src/eap_common/eap_sake_common.c

src/eap_common/eap_sake_common.h

src/eap_common/eap_sim_common.c

src/eap_common/eap_sim_common.h

src/eap_common/eap_ttls.h

src/eap_peer

src/eap_peer/Makefile

src/eap_peer/eap.c

src/eap_peer/eap.h

src/eap_peer/eap_aka.c

src/eap_peer/eap_fast.c

src/eap_peer/eap_fast_pac.c

src/eap_peer/eap_fast_pac.h

src/eap_peer/eap_gpsk.c

src/eap_peer/eap_gtc.c

src/eap_peer/eap_i.h

src/eap_peer/eap_leap.c

src/eap_peer/eap_md5.c

src/eap_peer/eap_methods.c

src/eap_peer/eap_methods.h

src/eap_peer/eap_mschapv2.c

src/eap_peer/eap_otp.c

src/eap_peer/eap_pax.c

src/eap_peer/eap_peap.c

src/eap_peer/eap_psk.c

src/eap_peer/eap_sake.c

src/eap_peer/eap_sim.c

src/eap_peer/eap_tls.c

src/eap_peer/eap_tls_common.c

src/eap_peer/eap_tls_common.h

src/eap_peer/eap_tlv.c

src/eap_peer/eap_tlv.h

src/eap_peer/eap_tnc.c

src/eap_peer/eap_ttls.c

src/eap_peer/eap_vendor_test.c

src/eap_peer/tncc.c

src/eap_peer/tncc.h

src/eap_server

src/eap_server/Makefile

src/eap_server/eap.c

src/eap_server/eap.h

src/eap_server/eap_aka.c

src/eap_server/eap_gpsk.c

src/eap_server/eap_gtc.c

src/eap_server/eap_i.h

src/eap_server/eap_identity.c

src/eap_server/eap_md5.c

src/eap_server/eap_methods.c

src/eap_server/eap_methods.h

src/eap_server/eap_mschapv2.c

src/eap_server/eap_pax.c

src/eap_server/eap_peap.c

src/eap_server/eap_psk.c

src/eap_server/eap_sake.c

src/eap_server/eap_sim.c

src/eap_server/eap_sim_db.c

src/eap_server/eap_sim_db.h

src/eap_server/eap_tls.c

src/eap_server/eap_tls_common.c

src/eap_server/eap_tls_common.h

src/eap_server/eap_tlv.c

src/eap_server/eap_ttls.c

src/eap_server/eap_vendor_test.c

src/hlr_auc_gw

src/hlr_auc_gw/Makefile

src/hlr_auc_gw/hlr_auc_gw.c

src/hlr_auc_gw/hlr_auc_gw.milenage_db

src/hlr_auc_gw/milenage.c

src/hlr_auc_gw/milenage.h

src/l2_packet

src/l2_packet/Makefile

src/l2_packet/l2_packet.h

src/l2_packet/l2_packet_freebsd.c

src/l2_packet/l2_packet_linux.c

src/l2_packet/l2_packet_ndis.c

src/l2_packet/l2_packet_none.c

src/l2_packet/l2_packet_pcap.c

src/l2_packet/l2_packet_winpcap.c

src/radius

src/radius/Makefile

src/radius/radius.c

src/radius/radius.h

src/radius/radius_client.c

src/radius/radius_client.h

src/radius/radius_server.c

src/radius/radius_server.h

src/rsn_supp

src/rsn_supp/Makefile

src/rsn_supp/peerkey.c

src/rsn_supp/peerkey.h

src/rsn_supp/pmksa_cache.c

src/rsn_supp/pmksa_cache.h

src/rsn_supp/preauth.c

src/rsn_supp/preauth.h

src/rsn_supp/wpa.c

src/rsn_supp/wpa.h

src/rsn_supp/wpa_ft.c

src/rsn_supp/wpa_i.h

src/rsn_supp/wpa_ie.c

src/rsn_supp/wpa_ie.h

src/tls

src/tls/Makefile

src/tls/asn1.c

src/tls/asn1.h

src/tls/asn1_test.c

src/tls/bignum.c

src/tls/bignum.h

src/tls/libtommath.c

src/tls/rsa.c

src/tls/rsa.h

src/tls/tlsv1_client.c

src/tls/tlsv1_client.h

src/tls/tlsv1_common.c

src/tls/tlsv1_common.h

src/tls/x509v3.c

src/tls/x509v3.h

src/utils

src/utils/Makefile

src/utils/base64.c

src/utils/base64.h

src/utils/build_config.h

src/utils/common.c

src/utils/common.h

src/utils/eloop.c

src/utils/eloop.h

src/utils/eloop_none.c

src/utils/eloop_win.c

src/utils/includes.h

src/utils/ip_addr.c

src/utils/ip_addr.h

src/utils/os.h

src/utils/os_internal.c

src/utils/os_none.c

src/utils/os_unix.c

src/utils/os_win32.c

src/utils/pcsc_funcs.c

src/utils/pcsc_funcs.h

src/utils/state_machine.h

src/utils/wpa_debug.c

src/utils/wpa_debug.h

wpa_supplicant

wpa_supplicant/ChangeLog

wpa_supplicant/Makefile

wpa_supplicant/README

wpa_supplicant/README-Windows.txt

wpa_supplicant/config.c

wpa_supplicant/config.h

wpa_supplicant/config_file.c

wpa_supplicant/config_none.c

wpa_supplicant/config_ssid.h

wpa_supplicant/config_winreg.c

wpa_supplicant/ctrl_iface.c

wpa_supplicant/ctrl_iface.h

wpa_supplicant/ctrl_iface_dbus.c

wpa_supplicant/ctrl_iface_dbus.h

wpa_supplicant/ctrl_iface_dbus_handlers.c

wpa_supplicant/ctrl_iface_dbus_handlers.h

wpa_supplicant/ctrl_iface_named_pipe.c

wpa_supplicant/ctrl_iface_udp.c

wpa_supplicant/ctrl_iface_unix.c

wpa_supplicant/dbus-wpa_supplicant.conf

wpa_supplicant/dbus_dict_helpers.c

wpa_supplicant/dbus_dict_helpers.h

wpa_supplicant/defconfig

wpa_supplicant/doc

wpa_supplicant/doc/code_structure.doxygen

wpa_supplicant/doc/ctrl_iface.doxygen

wpa_supplicant/doc/docbook

wpa_supplicant/doc/docbook/Makefile

wpa_supplicant/doc/docbook/wpa_background.8

wpa_supplicant/doc/docbook/wpa_background.sgml

wpa_supplicant/doc/docbook/wpa_cli.8

wpa_supplicant/doc/docbook/wpa_cli.sgml

wpa_supplicant/doc/docbook/wpa_passphrase.8

wpa_supplicant/doc/docbook/wpa_passphrase.sgml

wpa_supplicant/doc/docbook/wpa_supplicant.8

wpa_supplicant/doc/docbook/wpa_supplicant.conf.5

wpa_supplicant/doc/docbook/wpa_supplicant.conf.sgml

wpa_supplicant/doc/docbook/wpa_supplicant.sgml

wpa_supplicant/doc/doxygen.fast

wpa_supplicant/doc/doxygen.full

wpa_supplicant/doc/driver_wrapper.doxygen

wpa_supplicant/doc/eap.doxygen

wpa_supplicant/doc/kerneldoc2doxygen.pl

wpa_supplicant/doc/mainpage.doxygen

wpa_supplicant/doc/porting.doxygen

wpa_supplicant/doc/testing_tools.doxygen

wpa_supplicant/doc/wpa_supplicant.fig

wpa_supplicant/eap_testing.txt

wpa_supplicant/eapol_sm.c

wpa_supplicant/eapol_sm.h

wpa_supplicant/eapol_test.c

wpa_supplicant/events.c

wpa_supplicant/examples

wpa_supplicant/examples/ieee8021x.conf

wpa_supplicant/examples/plaintext.conf

wpa_supplicant/examples/wep.conf

wpa_supplicant/examples/wpa-psk-tkip.conf

wpa_supplicant/examples/wpa2-eap-ccmp.conf

wpa_supplicant/examples/wpas-test.py

wpa_supplicant/main.c

wpa_supplicant/main_none.c

wpa_supplicant/main_symbian.cpp

wpa_supplicant/main_winmain.c

wpa_supplicant/main_winsvc.c

wpa_supplicant/mlme.c

wpa_supplicant/mlme.h

wpa_supplicant/nmake.mak

wpa_supplicant/preauth_test.c

wpa_supplicant/symbian

wpa_supplicant/symbian/README.symbian

wpa_supplicant/symbian/bld.inf

wpa_supplicant/symbian/wpa_supplicant.mmp

wpa_supplicant/tests

wpa_supplicant/tests/link_test.c

wpa_supplicant/tests/test_aes.c

wpa_supplicant/tests/test_eap_sim_common.c

wpa_supplicant/tests/test_md4.c

wpa_supplicant/tests/test_md5.c

wpa_supplicant/tests/test_ms_funcs.c

wpa_supplicant/tests/test_sha1.c

wpa_supplicant/tests/test_sha256.c

wpa_supplicant/tests/test_wpa.c

wpa_supplicant/tests/test_x509v3.c

wpa_supplicant/todo.txt

wpa_supplicant/vs2005

wpa_supplicant/vs2005/eapol_test

wpa_supplicant/vs2005/eapol_test/eapol_test.vcproj

wpa_supplicant/vs2005/win_if_list

wpa_supplicant/vs2005/win_if_list/win_if_list.vcproj

wpa_supplicant/vs2005/wpa_cli

wpa_supplicant/vs2005/wpa_cli/wpa_cli.vcproj

wpa_supplicant/vs2005/wpa_passphrase

wpa_supplicant/vs2005/wpa_passphrase/wpa_passphrase.vcproj

wpa_supplicant/vs2005/wpa_supplicant

wpa_supplicant/vs2005/wpa_supplicant.sln

wpa_supplicant/vs2005/wpa_supplicant/wpa_supplicant.vcproj

wpa_supplicant/vs2005/wpasvc

wpa_supplicant/vs2005/wpasvc/wpasvc.vcproj

wpa_supplicant/win_example.reg

wpa_supplicant/win_if_list.c

wpa_supplicant/wpa_cli.c

wpa_supplicant/wpa_gui

wpa_supplicant/wpa_gui-qt4

wpa_supplicant/wpa_gui-qt4/eventhistory.cpp

wpa_supplicant/wpa_gui-qt4/eventhistory.h

wpa_supplicant/wpa_gui-qt4/eventhistory.ui

wpa_supplicant/wpa_gui-qt4/main.cpp

wpa_supplicant/wpa_gui-qt4/networkconfig.cpp

wpa_supplicant/wpa_gui-qt4/networkconfig.h

wpa_supplicant/wpa_gui-qt4/networkconfig.ui

wpa_supplicant/wpa_gui-qt4/scanresults.cpp

wpa_supplicant/wpa_gui-qt4/scanresults.h

wpa_supplicant/wpa_gui-qt4/scanresults.ui

wpa_supplicant/wpa_gui-qt4/setup-mingw-cross-compiling

wpa_supplicant/wpa_gui-qt4/userdatarequest.cpp

wpa_supplicant/wpa_gui-qt4/userdatarequest.h

wpa_supplicant/wpa_gui-qt4/userdatarequest.ui

wpa_supplicant/wpa_gui-qt4/wpa_gui.pro

wpa_supplicant/wpa_gui-qt4/wpagui.cpp

wpa_supplicant/wpa_gui-qt4/wpagui.h

wpa_supplicant/wpa_gui-qt4/wpagui.ui

wpa_supplicant/wpa_gui-qt4/wpamsg.h

wpa_supplicant/wpa_gui/eventhistory.ui

wpa_supplicant/wpa_gui/eventhistory.ui.h

wpa_supplicant/wpa_gui/main.cpp

wpa_supplicant/wpa_gui/networkconfig.ui

wpa_supplicant/wpa_gui/networkconfig.ui.h

wpa_supplicant/wpa_gui/scanresults.ui

wpa_supplicant/wpa_gui/scanresults.ui.h

wpa_supplicant/wpa_gui/setup-mingw-cross-compiling

wpa_supplicant/wpa_gui/userdatarequest.ui

wpa_supplicant/wpa_gui/userdatarequest.ui.h

wpa_supplicant/wpa_gui/wpa_gui.pro

wpa_supplicant/wpa_gui/wpagui.ui

wpa_supplicant/wpa_gui/wpagui.ui.h

wpa_supplicant/wpa_gui/wpamsg.h

wpa_supplicant/wpa_passphrase.c

wpa_supplicant/wpa_supplicant.c

wpa_supplicant/wpa_supplicant.conf

wpa_supplicant/wpa_supplicant_i.h

files modified:
README

debian/NEWS

debian/README.Debian

debian/README.modes

debian/changelog

debian/control

debian/copyright

debian/patches/00list

debian/rules

debian/watch

debian/wpagui.install

debian/wpasupplicant.docs

debian/wpasupplicant.examples

debian/wpasupplicant.install

debian/wpasupplicant.manpages

debian/wpasupplicant.postinst

debian/wpasupplicant.wpa-ifupdown.init

Show diffs side-by-side

added added

removed removed

src/eap_peer/eap_ttls.c

* EAP peer method: EAP-TTLS (draft-ietf-pppext-eap-ttls-03.txt)

* This program is free software; you can redistribute it and/or modify

* it under the terms of the GNU General Public License version 2 as

* published by the Free Software Foundation.

* Alternatively, this software may be distributed under the terms of BSD

* license.

* See README and COPYING for more details.

#include "includes.h"

#include "common.h"

#include "eap_peer/eap_i.h"

#include "eap_peer/eap_tls_common.h"

#include "config_ssid.h"

#include "ms_funcs.h"

#include "sha1.h"

#include "crypto.h"

#include "tls.h"

#include "eap_common/eap_ttls.h"

/* Maximum supported TTLS version

* 0 = draft-ietf-pppext-eap-ttls-03.txt / draft-funk-eap-ttls-v0-00.txt

* 1 = draft-funk-eap-ttls-v1-00.txt

#ifndef EAP_TTLS_VERSION

#define EAP_TTLS_VERSION 0 /* TTLSv1 implementation is not yet complete */

#endif /* EAP_TTLS_VERSION */

#define MSCHAPV2_KEY_LEN 16

static void eap_ttls_deinit(struct eap_sm *sm, void *priv);

struct eap_ttls_data {

struct eap_ssl_data ssl;

int ssl_initialized;

int ttls_version, force_ttls_version;

const struct eap_method *phase2_method;

void *phase2_priv;

int phase2_success;

int phase2_start;

enum {

EAP_TTLS_PHASE2_EAP,

EAP_TTLS_PHASE2_MSCHAPV2,

EAP_TTLS_PHASE2_MSCHAP,

EAP_TTLS_PHASE2_PAP,

EAP_TTLS_PHASE2_CHAP

} phase2_type;

struct eap_method_type phase2_eap_type;

struct eap_method_type *phase2_eap_types;

size_t num_phase2_eap_types;

u8 auth_response[20];

int auth_response_valid;

u8 ident;

int resuming; /* starting a resumed session */

int reauth; /* reauthentication */

u8 *key_data;

u8 *pending_phase2_req;

size_t pending_phase2_req_len;

#ifdef EAP_TNC

int ready_for_tnc;

int tnc_started;

#endif /* EAP_TNC */

};

static void * eap_ttls_init(struct eap_sm *sm)

{

struct eap_ttls_data *data;

struct wpa_ssid *config = eap_get_config(sm);

char *selected;

data = os_zalloc(sizeof(*data));

if (data == NULL)

return NULL;

data->ttls_version = EAP_TTLS_VERSION;

data->force_ttls_version = -1;

selected = "EAP";

data->phase2_type = EAP_TTLS_PHASE2_EAP;

#if EAP_TTLS_VERSION > 0

if (config && config->phase1) {

const char *pos = os_strstr(config->phase1, "ttlsver=");

if (pos) {

100

data->force_ttls_version = atoi(pos + 8);

101

data->ttls_version = data->force_ttls_version;

102

wpa_printf(MSG_DEBUG, "EAP-TTLS: Forced TTLS version "

103

"%d", data->force_ttls_version);

104

}

105

}

106

#endif /* EAP_TTLS_VERSION */

107

108

if (config && config->phase2) {

109

if (os_strstr(config->phase2, "autheap=")) {

110

selected = "EAP";

111

data->phase2_type = EAP_TTLS_PHASE2_EAP;

112

} else if (os_strstr(config->phase2, "auth=MSCHAPV2")) {

113

selected = "MSCHAPV2";

114

data->phase2_type = EAP_TTLS_PHASE2_MSCHAPV2;

115

} else if (os_strstr(config->phase2, "auth=MSCHAP")) {

116

selected = "MSCHAP";

117

data->phase2_type = EAP_TTLS_PHASE2_MSCHAP;

118

} else if (os_strstr(config->phase2, "auth=PAP")) {

119

selected = "PAP";

120

data->phase2_type = EAP_TTLS_PHASE2_PAP;

121

} else if (os_strstr(config->phase2, "auth=CHAP")) {

122

selected = "CHAP";

123

data->phase2_type = EAP_TTLS_PHASE2_CHAP;

124

}

125

}

126

wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase2 type: %s", selected);

127

128

if (data->phase2_type == EAP_TTLS_PHASE2_EAP) {

129

if (eap_peer_select_phase2_methods(config, "autheap=",

130

&data->phase2_eap_types,

131

&data->num_phase2_eap_types)

132

< 0) {

133

eap_ttls_deinit(sm, data);

134

return NULL;

135

}

136

137

data->phase2_eap_type.vendor = EAP_VENDOR_IETF;

138

data->phase2_eap_type.method = EAP_TYPE_NONE;

139

}

140

141

#if EAP_TTLS_VERSION > 0

142

if (!(tls_capabilities(sm->ssl_ctx) & TLS_CAPABILITY_IA) &&

143

data->ttls_version > 0) {

144

if (data->force_ttls_version > 0) {

145

wpa_printf(MSG_INFO, "EAP-TTLS: Forced TTLSv%d and "

146

"TLS library does not support TLS/IA.",

147

data->force_ttls_version);

148

eap_ttls_deinit(sm, data);

149

return NULL;

150

}

151

data->ttls_version = 0;

152

}

153

#endif /* EAP_TTLS_VERSION */

154

155

return data;

156

}

157

158

159

static void eap_ttls_deinit(struct eap_sm *sm, void *priv)

160

{

161

struct eap_ttls_data *data = priv;

162

if (data == NULL)

163

return;

164

if (data->phase2_priv && data->phase2_method)

165

data->phase2_method->deinit(sm, data->phase2_priv);

166

os_free(data->phase2_eap_types);

167

if (data->ssl_initialized)

168

eap_peer_tls_ssl_deinit(sm, &data->ssl);

169

os_free(data->key_data);

170

os_free(data->pending_phase2_req);

171

os_free(data);

172

}

173

174

175

static u8 * eap_ttls_avp_hdr(u8 *avphdr, u32 avp_code, u32 vendor_id,

176

int mandatory, size_t len)

177

{

178

struct ttls_avp_vendor *avp;

179

u8 flags;

180

size_t hdrlen;

181

182

avp = (struct ttls_avp_vendor *) avphdr;

183

flags = mandatory ? AVP_FLAGS_MANDATORY : 0;

184

if (vendor_id) {

185

flags |= AVP_FLAGS_VENDOR;

186

hdrlen = sizeof(*avp);

187

avp->vendor_id = host_to_be32(vendor_id);

188

} else {

189

hdrlen = sizeof(struct ttls_avp);

190

}

191

192

avp->avp_code = host_to_be32(avp_code);

193

avp->avp_length = host_to_be32((flags << 24) | (hdrlen + len));

194

195

return avphdr + hdrlen;

196

}

197

198

199

static u8 * eap_ttls_avp_add(u8 *start, u8 *avphdr, u32 avp_code,

200

u32 vendor_id, int mandatory,

201

u8 *data, size_t len)

202

{

203

u8 *pos;

204

pos = eap_ttls_avp_hdr(avphdr, avp_code, vendor_id, mandatory, len);

205

os_memcpy(pos, data, len);

206

pos += len;

207

AVP_PAD(start, pos);

208

return pos;

209

}

210

211

212

static int eap_ttls_avp_encapsulate(u8 **resp, size_t *resp_len, u32 avp_code,

213

int mandatory)

214

{

215

u8 *avp, *pos;

216

217

avp = os_malloc(sizeof(struct ttls_avp) + *resp_len + 4);

218

if (avp == NULL) {

219

os_free(*resp);

220

*resp = NULL;

221

*resp_len = 0;

222

return -1;

223

}

224

225

pos = eap_ttls_avp_hdr(avp, avp_code, 0, mandatory, *resp_len);

226

os_memcpy(pos, *resp, *resp_len);

227

pos += *resp_len;

228

AVP_PAD(avp, pos);

229

os_free(*resp);

230

*resp = avp;

231

*resp_len = pos - avp;

232

return 0;

233

}

234

235

236

#if EAP_TTLS_VERSION > 0

237

static int eap_ttls_ia_permute_inner_secret(struct eap_sm *sm,

238

struct eap_ttls_data *data,

239

const u8 *key, size_t key_len)

240

{

241

u8 *buf;

242

size_t buf_len;

243

int ret;

244

245

if (key) {

246

buf_len = 2 + key_len;

247

buf = os_malloc(buf_len);

248

if (buf == NULL)

249

return -1;

250

WPA_PUT_BE16(buf, key_len);

251

os_memcpy(buf + 2, key, key_len);

252

} else {

253

buf = NULL;

254

buf_len = 0;

255

}

256

257

wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Session keys for TLS/IA inner "

258

"secret permutation", buf, buf_len);

259

ret = tls_connection_ia_permute_inner_secret(sm->ssl_ctx,

260

data->ssl.conn,

261

buf, buf_len);

262

os_free(buf);

263

264

return ret;

265

}

266

#endif /* EAP_TTLS_VERSION */

267

268

269

static int eap_ttls_v0_derive_key(struct eap_sm *sm,

270

struct eap_ttls_data *data)

271

{

272

os_free(data->key_data);

273

data->key_data = eap_peer_tls_derive_key(sm, &data->ssl,

274

"ttls keying material",

275

EAP_TLS_KEY_LEN);

276

if (!data->key_data) {

277

wpa_printf(MSG_INFO, "EAP-TTLS: Failed to derive key");

278

return -1;

279

}

280

281

wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived key",

282

data->key_data, EAP_TLS_KEY_LEN);

283

284

return 0;

285

}

286

287

288

#if EAP_TTLS_VERSION > 0

289

static int eap_ttls_v1_derive_key(struct eap_sm *sm,

290

struct eap_ttls_data *data)

291

{

292

struct tls_keys keys;

293

u8 *rnd;

294

295

os_free(data->key_data);

296

data->key_data = NULL;

297

298

os_memset(&keys, 0, sizeof(keys));

299

if (tls_connection_get_keys(sm->ssl_ctx, data->ssl.conn, &keys) ||

300

keys.client_random == NULL || keys.server_random == NULL ||

301

keys.inner_secret == NULL) {

302

wpa_printf(MSG_INFO, "EAP-TTLS: Could not get inner secret, "

303

"client random, or server random to derive keying "

304

"material");

305

return -1;

306

}

307

308

rnd = os_malloc(keys.client_random_len + keys.server_random_len);

309

data->key_data = os_malloc(EAP_TLS_KEY_LEN);

310

if (rnd == NULL || data->key_data == NULL) {

311

wpa_printf(MSG_INFO, "EAP-TTLS: No memory for key derivation");

312

os_free(rnd);

313

os_free(data->key_data);

314

data->key_data = NULL;

315

return -1;

316

}

317

os_memcpy(rnd, keys.client_random, keys.client_random_len);

318

os_memcpy(rnd + keys.client_random_len, keys.server_random,

319

keys.server_random_len);

320

321

if (tls_prf(keys.inner_secret, keys.inner_secret_len,

322

"ttls v1 keying material", rnd, keys.client_random_len +

323

keys.server_random_len, data->key_data, EAP_TLS_KEY_LEN)) {

324

wpa_printf(MSG_DEBUG, "EAP-TTLS: Failed to derive key");

325

os_free(rnd);

326

os_free(data->key_data);

327

data->key_data = NULL;

328

return -1;

329

}

330

331

wpa_hexdump(MSG_DEBUG, "EAP-TTLS: client/server random",

332

rnd, keys.client_random_len + keys.server_random_len);

333

wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: TLS/IA inner secret",

334

keys.inner_secret, keys.inner_secret_len);

335

336

os_free(rnd);

337

338

wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived key",

339

data->key_data, EAP_TLS_KEY_LEN);

340

341

return 0;

342

}

343

#endif /* EAP_TTLS_VERSION */

344

345

346

static u8 * eap_ttls_implicit_challenge(struct eap_sm *sm,

347

struct eap_ttls_data *data, size_t len)

348

{

349

#if EAP_TTLS_VERSION > 0

350

struct tls_keys keys;

351

u8 *challenge, *rnd;

352

#endif /* EAP_TTLS_VERSION */

353

354

if (data->ttls_version == 0) {

355

return eap_peer_tls_derive_key(sm, &data->ssl,

356

"ttls challenge", len);

357

}

358

359

#if EAP_TTLS_VERSION > 0

360

361

os_memset(&keys, 0, sizeof(keys));

362

if (tls_connection_get_keys(sm->ssl_ctx, data->ssl.conn, &keys) ||

363

keys.client_random == NULL || keys.server_random == NULL ||

364

keys.inner_secret == NULL) {

365

wpa_printf(MSG_INFO, "EAP-TTLS: Could not get inner secret, "

366

"client random, or server random to derive "

367

"implicit challenge");

368

return NULL;

369

}

370

371

rnd = os_malloc(keys.client_random_len + keys.server_random_len);

372

challenge = os_malloc(len);

373

if (rnd == NULL || challenge == NULL) {

374

wpa_printf(MSG_INFO, "EAP-TTLS: No memory for implicit "

375

"challenge derivation");

376

os_free(rnd);

377

os_free(challenge);

378

return NULL;

379

}

380

os_memcpy(rnd, keys.server_random, keys.server_random_len);

381

os_memcpy(rnd + keys.server_random_len, keys.client_random,

382

keys.client_random_len);

383

384

if (tls_prf(keys.inner_secret, keys.inner_secret_len,

385

"inner application challenge", rnd,

386

keys.client_random_len + keys.server_random_len,

387

challenge, len)) {

388

wpa_printf(MSG_DEBUG, "EAP-TTLS: Failed to derive implicit "

389

"challenge");

390

os_free(rnd);

391

os_free(challenge);

392

return NULL;

393

}

394

395

os_free(rnd);

396

397

wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived implicit challenge",

398

challenge, len);

399

400

return challenge;

401

402

#else /* EAP_TTLS_VERSION */

403

404

return NULL;

405

406

#endif /* EAP_TTLS_VERSION */

407

}

408

409

410

static void eap_ttlsv1_phase2_eap_finish(struct eap_sm *sm,

411

struct eap_ttls_data *data,

412

struct eap_method_ret *ret)

413

{

414

#if EAP_TTLS_VERSION > 0

415

if (data->ttls_version > 0) {

416

const struct eap_method *m = data->phase2_method;

417

void *priv = data->phase2_priv;

418

419

/* TTLSv1 requires TLS/IA FinalPhaseFinished */

420

if (ret->decision == DECISION_UNCOND_SUCC)

421

ret->decision = DECISION_COND_SUCC;

422

ret->methodState = METHOD_CONT;

423

424

if (ret->decision == DECISION_COND_SUCC &&

425

m->isKeyAvailable && m->getKey &&

426

m->isKeyAvailable(sm, priv)) {

427

u8 *key;

428

size_t key_len;

429

key = m->getKey(sm, priv, &key_len);

430

if (key) {

431

eap_ttls_ia_permute_inner_secret(

432

sm, data, key, key_len);

433

os_free(key);

434

}

435

}

436

}

437

#endif /* EAP_TTLS_VERSION */

438

}

439

440

441

static void eap_ttls_phase2_select_eap_method(struct eap_ttls_data *data,

442

u8 method)

443

{

444

size_t i;

445

for (i = 0; i < data->num_phase2_eap_types; i++) {

446

if (data->phase2_eap_types[i].vendor != EAP_VENDOR_IETF ||

447

data->phase2_eap_types[i].method != method)

448

continue;

449

450

data->phase2_eap_type.vendor =

451

data->phase2_eap_types[i].vendor;

452

data->phase2_eap_type.method =

453

data->phase2_eap_types[i].method;

454

wpa_printf(MSG_DEBUG, "EAP-TTLS: Selected "

455

"Phase 2 EAP vendor %d method %d",

456

data->phase2_eap_type.vendor,

457

data->phase2_eap_type.method);

458

break;

459

}

460

}

461

462

463

static int eap_ttls_phase2_request_eap_method(struct eap_sm *sm,

464

struct eap_ttls_data *data,

465

struct eap_method_ret *ret,

466

struct eap_hdr *hdr, size_t len,

467

u8 method,

468

u8 **resp, size_t *resp_len)

469

{

470

struct eap_method_ret iret;

471

472

#ifdef EAP_TNC

473

if (data->tnc_started && data->phase2_method &&

474

data->phase2_priv && method == EAP_TYPE_TNC &&

475

data->phase2_eap_type.method == EAP_TYPE_TNC)

476

goto process;

477

478

if (data->ready_for_tnc && !data->tnc_started &&

479

method == EAP_TYPE_TNC) {

480

wpa_printf(MSG_DEBUG, "EAP-TTLS: Start TNC after completed "

481

"EAP method");

482

data->tnc_started = 1;

483

}

484

485

if (data->tnc_started) {

486

if (data->phase2_eap_type.vendor != EAP_VENDOR_IETF ||

487

data->phase2_eap_type.method == EAP_TYPE_TNC) {

488

wpa_printf(MSG_DEBUG, "EAP-TTLS: Unexpected EAP "

489

"type %d for TNC", method);

490

return -1;

491

}

492

493

data->phase2_eap_type.vendor = EAP_VENDOR_IETF;

494

data->phase2_eap_type.method = method;

495

wpa_printf(MSG_DEBUG, "EAP-TTLS: Selected "

496

"Phase 2 EAP vendor %d method %d (TNC)",

497

data->phase2_eap_type.vendor,

498

data->phase2_eap_type.method);

499

500

if (data->phase2_type == EAP_TTLS_PHASE2_EAP &&

501

data->phase2_priv && data->phase2_method) {

502

data->phase2_method->deinit(sm, data->phase2_priv);

503

data->phase2_method = NULL;

504

data->phase2_priv = NULL;

505

}

506

507

goto init;

508

}

509

#endif /* EAP_TNC */

510

511

if (data->phase2_eap_type.vendor == EAP_VENDOR_IETF &&

512

data->phase2_eap_type.method == EAP_TYPE_NONE)

513

eap_ttls_phase2_select_eap_method(data, method);

514

515

if (method != data->phase2_eap_type.method || method == EAP_TYPE_NONE)

516

{

517

if (eap_peer_tls_phase2_nak(data->phase2_eap_types,

518

data->num_phase2_eap_types,

519

hdr, resp, resp_len))

520

return -1;

521

return 0;

522

}

523

524

#ifdef EAP_TNC

525

init:

526

#endif /* EAP_TNC */

527

528

if (data->phase2_priv == NULL) {

529

data->phase2_method = eap_peer_get_eap_method(

530

EAP_VENDOR_IETF, method);

531

if (data->phase2_method) {

532

sm->init_phase2 = 1;

533

sm->mschapv2_full_key = 1;

534

data->phase2_priv = data->phase2_method->init(sm);

535

sm->init_phase2 = 0;

536

sm->mschapv2_full_key = 0;

537

}

538

}

539

if (data->phase2_priv == NULL || data->phase2_method == NULL) {

540

wpa_printf(MSG_INFO, "EAP-TTLS: failed to initialize "

541

"Phase 2 EAP method %d", method);

542

return -1;

543

}

544

545

#ifdef EAP_TNC

546

process:

547

#endif /* EAP_TNC */

548

os_memset(&iret, 0, sizeof(iret));

549

*resp = data->phase2_method->process(sm, data->phase2_priv,

550

&iret, (u8 *) hdr, len,

551

resp_len);

552

if ((iret.methodState == METHOD_DONE ||

553

iret.methodState == METHOD_MAY_CONT) &&

554

(iret.decision == DECISION_UNCOND_SUCC ||

555

iret.decision == DECISION_COND_SUCC ||

556

iret.decision == DECISION_FAIL)) {

557

ret->methodState = iret.methodState;

558

ret->decision = iret.decision;

559

}

560

eap_ttlsv1_phase2_eap_finish(sm, data, ret);

561

562

return 0;

563

}

564

565

566

static int eap_ttls_phase2_request_eap(struct eap_sm *sm,

567

struct eap_ttls_data *data,

568

struct eap_method_ret *ret,

569

struct eap_hdr *hdr,

570

u8 **resp, size_t *resp_len)

571

{

572

size_t len = be_to_host16(hdr->length);

573

u8 *pos;

574

struct wpa_ssid *config = eap_get_config(sm);

575

576

if (len <= sizeof(struct eap_hdr)) {

577

wpa_printf(MSG_INFO, "EAP-TTLS: too short "

578

"Phase 2 request (len=%lu)", (unsigned long) len);

579

return -1;

580

}

581

pos = (u8 *) (hdr + 1);

582

wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 EAP Request: type=%d", *pos);

583

switch (*pos) {

584

case EAP_TYPE_IDENTITY:

585

*resp = eap_sm_buildIdentity(sm, hdr->identifier, resp_len, 1);

586

break;

587

default:

588

if (eap_ttls_phase2_request_eap_method(sm, data, ret, hdr, len,

589

*pos, resp, resp_len) <

590

591

return -1;

592

break;

593

}

594

595

if (*resp == NULL &&

596

(config->pending_req_identity || config->pending_req_password ||

597

config->pending_req_otp)) {

598

return 0;

599

}

600

601

if (*resp == NULL)

602

return -1;

603

604

wpa_hexdump(MSG_DEBUG, "EAP-TTLS: AVP encapsulate EAP Response",

605

*resp, *resp_len);

606

return eap_ttls_avp_encapsulate(resp, resp_len,

607

RADIUS_ATTR_EAP_MESSAGE, 1);

608

}

609

610

611

static void eap_ttlsv1_permute_inner(struct eap_sm *sm,

612

struct eap_ttls_data *data,

613

const u8 *nt_response)

614

{

615

#if EAP_TTLS_VERSION > 0

616

u8 pw_hash[16], pw_hash_hash[16], master_key[16];

617

u8 session_key[2 * MSCHAPV2_KEY_LEN];

618

struct wpa_ssid *config = eap_get_config(sm);

619

620

if (data->ttls_version == 0)

621

return;

622

623

nt_password_hash(config->password, config->password_len, pw_hash);

624

hash_nt_password_hash(pw_hash, pw_hash_hash);

625

get_master_key(pw_hash_hash, nt_response, master_key);

626

get_asymetric_start_key(master_key, session_key,

627

MSCHAPV2_KEY_LEN, 0, 0);

628

get_asymetric_start_key(master_key, session_key + MSCHAPV2_KEY_LEN,

629

MSCHAPV2_KEY_LEN, 1, 0);

630

eap_ttls_ia_permute_inner_secret(sm, data, session_key,

631

sizeof(session_key));

632

#endif /* EAP_TTLS_VERSION */

633

}

634

635

636

static int eap_ttls_phase2_request_mschapv2(struct eap_sm *sm,

637

struct eap_ttls_data *data,

638

struct eap_method_ret *ret,

639

u8 **resp, size_t *resp_len)

640

{

641

struct wpa_ssid *config = eap_get_config(sm);

642

u8 *buf, *pos, *challenge, *username, *peer_challenge;

643

size_t username_len, i;

644

645

wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 MSCHAPV2 Request");

646

647

/* MSCHAPv2 does not include optional domain name in the

648

* challenge-response calculation, so remove domain prefix

649

* (if present). */

650

username = config->identity;

651

username_len = config->identity_len;

652

pos = username;

653

for (i = 0; i < username_len; i++) {

654

if (username[i] == '\\') {

655

username_len -= i + 1;

656

username += i + 1;

657

break;

658

}

659

}

660

661

pos = buf = os_malloc(config->identity_len + 1000);

662

if (buf == NULL) {

663

wpa_printf(MSG_ERROR,

664

"EAP-TTLS/MSCHAPV2: Failed to allocate memory");

665

return -1;

666

}

667

668

/* User-Name */

669

pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,

670

config->identity, config->identity_len);

671

672

/* MS-CHAP-Challenge */

673

challenge = eap_ttls_implicit_challenge(

674

sm, data, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN * 2 + 1);

675

if (challenge == NULL) {

676

os_free(buf);

677

wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAPV2: Failed to derive "

678

"implicit challenge");

679

return -1;

680

}

681

peer_challenge = challenge + 1 + EAP_TTLS_MSCHAPV2_CHALLENGE_LEN;

682

683

pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_MS_CHAP_CHALLENGE,

684

RADIUS_VENDOR_ID_MICROSOFT, 1,

685

challenge, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN);

686

687

/* MS-CHAP2-Response */

688

pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP2_RESPONSE,

689

RADIUS_VENDOR_ID_MICROSOFT, 1,

690

EAP_TTLS_MSCHAPV2_RESPONSE_LEN);

691

data->ident = challenge[EAP_TTLS_MSCHAPV2_CHALLENGE_LEN];

692

*pos++ = data->ident;

693

*pos++ = 0; /* Flags */

694

os_memcpy(pos, peer_challenge, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN);

695

pos += EAP_TTLS_MSCHAPV2_CHALLENGE_LEN;

696

os_memset(pos, 0, 8); /* Reserved, must be zero */

697

pos += 8;

698

wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAPV2: implicit auth_challenge",

699

challenge, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN);

700

wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAPV2: peer_challenge",

701

peer_challenge, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN);

702

wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: MSCHAPV2 username",

703

username, username_len);

704

wpa_hexdump_ascii_key(MSG_DEBUG, "EAP-TTLS: MSCHAPV2 password",

705

config->password, config->password_len);

706

generate_nt_response(challenge, peer_challenge,

707

username, username_len,

708

config->password, config->password_len,

709

pos);

710

wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAPV2 response", pos, 24);

711

generate_authenticator_response(config->password, config->password_len,

712

peer_challenge, challenge,

713

username, username_len,

714

pos, data->auth_response);

715

data->auth_response_valid = 1;

716

717

eap_ttlsv1_permute_inner(sm, data, pos);

718

719

pos += 24;

720

os_free(challenge);

721

AVP_PAD(buf, pos);

722

723

*resp = buf;

724

*resp_len = pos - buf;

725

726

if (sm->workaround && data->ttls_version == 0) {

727

/* At least FreeRADIUS seems to be terminating

728

* EAP-TTLS/MSHCAPV2 without the expected MS-CHAP-v2 Success

729

* packet. */

730

wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: EAP workaround - "

731

"allow success without tunneled response");

732

ret->methodState = METHOD_MAY_CONT;

733

ret->decision = DECISION_COND_SUCC;

734

}

735

736

return 0;

737

}

738

739

740

static int eap_ttls_phase2_request_mschap(struct eap_sm *sm,

741

struct eap_ttls_data *data,

742

struct eap_method_ret *ret,

743

u8 **resp, size_t *resp_len)

744

{

745

struct wpa_ssid *config = eap_get_config(sm);

746

u8 *buf, *pos, *challenge;

747

748

wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 MSCHAP Request");

749

750

pos = buf = os_malloc(config->identity_len + 1000);

751

if (buf == NULL) {

752

wpa_printf(MSG_ERROR,

753

"EAP-TTLS/MSCHAP: Failed to allocate memory");

754

return -1;

755

}

756

757

/* User-Name */

758

pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,

759

config->identity, config->identity_len);

760

761

/* MS-CHAP-Challenge */

762

challenge = eap_ttls_implicit_challenge(sm, data, EAP_TLS_KEY_LEN);

763

if (challenge == NULL) {

764

os_free(buf);

765

wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAP: Failed to derive "

766

"implicit challenge");

767

return -1;

768

}

769

770

pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_MS_CHAP_CHALLENGE,

771

RADIUS_VENDOR_ID_MICROSOFT, 1,

772

challenge, EAP_TTLS_MSCHAP_CHALLENGE_LEN);

773

774

/* MS-CHAP-Response */

775

pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP_RESPONSE,

776

RADIUS_VENDOR_ID_MICROSOFT, 1,

777

EAP_TTLS_MSCHAP_RESPONSE_LEN);

778

data->ident = challenge[EAP_TTLS_MSCHAP_CHALLENGE_LEN];

779

*pos++ = data->ident;

780

*pos++ = 1; /* Flags: Use NT style passwords */

781

os_memset(pos, 0, 24); /* LM-Response */

782

pos += 24;

783

nt_challenge_response(challenge,

784

config->password, config->password_len,

785

pos); /* NT-Response */

786

wpa_hexdump_ascii_key(MSG_DEBUG, "EAP-TTLS: MSCHAP password",

787

config->password, config->password_len);

788

wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAP implicit challenge",

789

challenge, EAP_TTLS_MSCHAP_CHALLENGE_LEN);

790

wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAP response", pos, 24);

791

pos += 24;

792

os_free(challenge);

793

AVP_PAD(buf, pos);

794

795

*resp = buf;

796

*resp_len = pos - buf;

797

798

if (data->ttls_version > 0) {

799

/* EAP-TTLSv1 uses TLS/IA FinalPhaseFinished to report success,

800

* so do not allow connection to be terminated yet. */

801

ret->methodState = METHOD_CONT;

802

ret->decision = DECISION_COND_SUCC;

803

} else {

804

/* EAP-TTLS/MSCHAP does not provide tunneled success

805

* notification, so assume that Phase2 succeeds. */

806

ret->methodState = METHOD_DONE;

807

ret->decision = DECISION_COND_SUCC;

808

}

809

810

return 0;

811

}

812

813

814

static int eap_ttls_phase2_request_pap(struct eap_sm *sm,

815

struct eap_ttls_data *data,

816

struct eap_method_ret *ret,

817

u8 **resp, size_t *resp_len)

818

{

819

struct wpa_ssid *config = eap_get_config(sm);

820

u8 *buf, *pos;

821

size_t pad;

822

823

wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 PAP Request");

824

825

pos = buf = os_malloc(config->identity_len + config->password_len +

826

100);

827

if (buf == NULL) {

828

wpa_printf(MSG_ERROR,

829

"EAP-TTLS/PAP: Failed to allocate memory");

830

return -1;

831

}

832

833

/* User-Name */

834

pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,

835

config->identity, config->identity_len);

836

837

/* User-Password; in RADIUS, this is encrypted, but EAP-TTLS encrypts

838

* the data, so no separate encryption is used in the AVP itself.

839

* However, the password is padded to obfuscate its length. */

840

pad = (16 - (config->password_len & 15)) & 15;

841

pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_USER_PASSWORD, 0, 1,

842

config->password_len + pad);

843

os_memcpy(pos, config->password, config->password_len);

844

pos += config->password_len;

845

os_memset(pos, 0, pad);

846

pos += pad;

847

AVP_PAD(buf, pos);

848

849

*resp = buf;

850

*resp_len = pos - buf;

851

852

if (data->ttls_version > 0) {

853

/* EAP-TTLSv1 uses TLS/IA FinalPhaseFinished to report success,

854

* so do not allow connection to be terminated yet. */

855

ret->methodState = METHOD_CONT;

856

ret->decision = DECISION_COND_SUCC;

857

} else {

858

/* EAP-TTLS/PAP does not provide tunneled success notification,

859

* so assume that Phase2 succeeds. */

860

ret->methodState = METHOD_DONE;

861

ret->decision = DECISION_COND_SUCC;

862

}

863

864

return 0;

865

}

866

867

868

static int eap_ttls_phase2_request_chap(struct eap_sm *sm,

869

struct eap_ttls_data *data,

870

struct eap_method_ret *ret,

871

u8 **resp, size_t *resp_len)

872

{

873

struct wpa_ssid *config = eap_get_config(sm);

874

u8 *buf, *pos, *challenge;

875

const u8 *addr[3];

876

size_t len[3];

877

878

wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 CHAP Request");

879

880

pos = buf = os_malloc(config->identity_len + 1000);

881

if (buf == NULL) {

882

wpa_printf(MSG_ERROR,

883

"EAP-TTLS/CHAP: Failed to allocate memory");

884

return -1;

885

}

886

887

/* User-Name */

888

pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,

889

config->identity, config->identity_len);

890

891

/* CHAP-Challenge */

892

challenge = eap_ttls_implicit_challenge(sm, data, EAP_TLS_KEY_LEN);

893

if (challenge == NULL) {

894

os_free(buf);

895

wpa_printf(MSG_ERROR, "EAP-TTLS/CHAP: Failed to derive "

896

"implicit challenge");

897

return -1;

898

}

899

900

pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_CHAP_CHALLENGE, 0, 1,

901

challenge, EAP_TTLS_CHAP_CHALLENGE_LEN);

902

903

/* CHAP-Password */

904

pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_CHAP_PASSWORD, 0, 1,

905

1 + EAP_TTLS_CHAP_PASSWORD_LEN);

906

data->ident = challenge[EAP_TTLS_CHAP_CHALLENGE_LEN];

907

*pos++ = data->ident;

908

909

/* MD5(Ident + Password + Challenge) */

910

addr[0] = &data->ident;

911

len[0] = 1;

912

addr[1] = config->password;

913

len[1] = config->password_len;

914

addr[2] = challenge;

915

len[2] = EAP_TTLS_CHAP_CHALLENGE_LEN;

916

md5_vector(3, addr, len, pos);

917

918

wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: CHAP username",

919

config->identity, config->identity_len);

920

wpa_hexdump_ascii_key(MSG_DEBUG, "EAP-TTLS: CHAP password",

921

config->password, config->password_len);

922

wpa_hexdump(MSG_DEBUG, "EAP-TTLS: CHAP implicit challenge",

923

challenge, EAP_TTLS_CHAP_CHALLENGE_LEN);

924

wpa_hexdump(MSG_DEBUG, "EAP-TTLS: CHAP password",

925

pos, EAP_TTLS_CHAP_PASSWORD_LEN);

926

pos += EAP_TTLS_CHAP_PASSWORD_LEN;

927

os_free(challenge);

928

AVP_PAD(buf, pos);

929

930

*resp = buf;

931

*resp_len = pos - buf;

932

933

if (data->ttls_version > 0) {

934

/* EAP-TTLSv1 uses TLS/IA FinalPhaseFinished to report success,

935

* so do not allow connection to be terminated yet. */

936

ret->methodState = METHOD_CONT;

937

ret->decision = DECISION_COND_SUCC;

938

} else {

939

/* EAP-TTLS/CHAP does not provide tunneled success

940

* notification, so assume that Phase2 succeeds. */

941

ret->methodState = METHOD_DONE;

942

ret->decision = DECISION_COND_SUCC;

943

}

944

945

return 0;

946

}

947

948

949

static int eap_ttls_phase2_request(struct eap_sm *sm,

950

struct eap_ttls_data *data,

951

struct eap_method_ret *ret,

952

struct eap_hdr *hdr,

953

u8 **resp, size_t *resp_len)

954

{

955

int res = 0;

956

size_t len;

957

958

if (data->phase2_type == EAP_TTLS_PHASE2_MSCHAPV2 ||

959

data->phase2_type == EAP_TTLS_PHASE2_MSCHAP ||

960

data->phase2_type == EAP_TTLS_PHASE2_PAP ||

961

data->phase2_type == EAP_TTLS_PHASE2_CHAP) {

962

if (eap_get_config_identity(sm, &len) == NULL) {

963

wpa_printf(MSG_INFO,

964

"EAP-TTLS: Identity not configured");

965

eap_sm_request_identity(sm);

966

if (eap_get_config_password(sm, &len) == NULL)

967

eap_sm_request_password(sm);

968

return 0;

969

}

970

971

if (eap_get_config_password(sm, &len) == NULL) {

972

wpa_printf(MSG_INFO,

973

"EAP-TTLS: Password not configured");

974

eap_sm_request_password(sm);

975

return 0;

976

}

977

}

978

979

#ifdef EAP_TNC

980

if (data->tnc_started) {

981

wpa_printf(MSG_DEBUG, "EAP-TTLS: Processing TNC");

982

res = eap_ttls_phase2_request_eap(sm, data, ret, hdr,

983

resp, resp_len);

984

goto done;

985

}

986

#endif /* EAP_TNC */

987

988

switch (data->phase2_type) {

989

case EAP_TTLS_PHASE2_EAP:

990

res = eap_ttls_phase2_request_eap(sm, data, ret, hdr,

991

resp, resp_len);

992

break;

993

case EAP_TTLS_PHASE2_MSCHAPV2:

994

res = eap_ttls_phase2_request_mschapv2(sm, data, ret,

995

resp, resp_len);

996

break;

997

case EAP_TTLS_PHASE2_MSCHAP:

998

res = eap_ttls_phase2_request_mschap(sm, data, ret,

999

resp, resp_len);

1000

break;

1001

case EAP_TTLS_PHASE2_PAP:

1002

res = eap_ttls_phase2_request_pap(sm, data, ret,

1003

resp, resp_len);

1004

break;

1005

case EAP_TTLS_PHASE2_CHAP:

1006

res = eap_ttls_phase2_request_chap(sm, data, ret,

1007

resp, resp_len);

1008

break;

1009

default:

1010

wpa_printf(MSG_ERROR, "EAP-TTLS: Phase 2 - Unknown");

1011

res = -1;

1012

break;

1013

}

1014

1015

#ifdef EAP_TNC

1016

done:

1017

#endif /* EAP_TNC */

1018

1019

if (res < 0) {

1020

ret->methodState = METHOD_DONE;

1021

ret->decision = DECISION_FAIL;

1022

}

1023

1024

return res;

1025

}

1026

1027

1028

#if EAP_TTLS_VERSION > 0

1029

static u8 * eap_ttls_build_phase_finished(struct eap_sm *sm,

1030

struct eap_ttls_data *data,

1031

int id, int final,

1032

size_t *reqDataLen)

1033

{

1034

int len;

1035

struct eap_hdr *req;

1036

u8 *pos;

1037

const int max_len = 300;

1038

1039

len = sizeof(struct eap_hdr) + 2 + max_len;

1040

req = os_malloc(len);

1041

if (req == NULL)

1042

return NULL;

1043

1044

req->code = EAP_CODE_RESPONSE;

1045

req->identifier = id;

1046

1047

pos = (u8 *) (req + 1);

1048

*pos++ = EAP_TYPE_TTLS;

1049

*pos++ = data->ttls_version;

1050

1051

len = tls_connection_ia_send_phase_finished(sm->ssl_ctx,

1052

data->ssl.conn,

1053

final, pos, max_len);

1054

if (len < 0) {

1055

os_free(req);

1056

return NULL;

1057

}

1058

1059

*reqDataLen = sizeof(struct eap_hdr) + 2 + len;

1060

req->length = host_to_be16(*reqDataLen);

1061

1062

return (u8 *) req;

1063

}

1064

#endif /* EAP_TTLS_VERSION */

1065

1066

1067

struct ttls_parse_avp {

1068

u8 *mschapv2;

1069

u8 *eapdata;

1070

size_t eap_len;

1071

int mschapv2_error;

1072

};

1073

1074

1075

static int eap_ttls_parse_attr_eap(const u8 *dpos, size_t dlen,

1076

struct ttls_parse_avp *parse)

1077

{

1078

wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP - EAP Message");

1079

if (parse->eapdata == NULL) {

1080

parse->eapdata = os_malloc(dlen);

1081

if (parse->eapdata == NULL) {

1082

wpa_printf(MSG_WARNING, "EAP-TTLS: Failed to allocate "

1083

"memory for Phase 2 EAP data");

1084

return -1;

1085

}

1086

os_memcpy(parse->eapdata, dpos, dlen);

1087

parse->eap_len = dlen;

1088

} else {

1089

u8 *neweap = os_realloc(parse->eapdata, parse->eap_len + dlen);

1090

if (neweap == NULL) {

1091

wpa_printf(MSG_WARNING, "EAP-TTLS: Failed to allocate "

1092

"memory for Phase 2 EAP data");

1093

return -1;

1094

}

1095

os_memcpy(neweap + parse->eap_len, dpos, dlen);

1096

parse->eapdata = neweap;

1097

parse->eap_len += dlen;

1098

}

1099

1100

return 0;

1101

}

1102

1103

1104

static int eap_ttls_parse_avp(u8 *pos, size_t left,

1105

struct ttls_parse_avp *parse)

1106

{

1107

struct ttls_avp *avp;

1108

u32 avp_code, avp_length, vendor_id = 0;

1109

u8 avp_flags, *dpos;

1110

size_t dlen;

1111

1112

avp = (struct ttls_avp *) pos;

1113

avp_code = be_to_host32(avp->avp_code);

1114

avp_length = be_to_host32(avp->avp_length);

1115

avp_flags = (avp_length >> 24) & 0xff;

1116

avp_length &= 0xffffff;

1117

wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP: code=%d flags=0x%02x "

1118

"length=%d", (int) avp_code, avp_flags,

1119

(int) avp_length);

1120

1121

if (avp_length > left) {

1122

wpa_printf(MSG_WARNING, "EAP-TTLS: AVP overflow "

1123

"(len=%d, left=%lu) - dropped",

1124

(int) avp_length, (unsigned long) left);

1125

return -1;

1126

}

1127

1128

if (avp_length < sizeof(*avp)) {

1129

wpa_printf(MSG_WARNING, "EAP-TTLS: Invalid AVP length %d",

1130

avp_length);

1131

return -1;

1132

}

1133

1134

dpos = (u8 *) (avp + 1);

1135

dlen = avp_length - sizeof(*avp);

1136

if (avp_flags & AVP_FLAGS_VENDOR) {

1137

if (dlen < 4) {

1138

wpa_printf(MSG_WARNING, "EAP-TTLS: Vendor AVP "

1139

"underflow");

1140

return -1;

1141

}

1142

vendor_id = WPA_GET_BE32(dpos);

1143

wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP vendor_id %d",

1144

(int) vendor_id);

1145

dpos += 4;

1146

dlen -= 4;

1147

}

1148

1149

wpa_hexdump(MSG_DEBUG, "EAP-TTLS: AVP data", dpos, dlen);

1150

1151

if (vendor_id == 0 && avp_code == RADIUS_ATTR_EAP_MESSAGE) {

1152

if (eap_ttls_parse_attr_eap(dpos, dlen, parse) < 0)

1153

return -1;

1154

} else if (vendor_id == 0 && avp_code == RADIUS_ATTR_REPLY_MESSAGE) {

1155

/* This is an optional message that can be displayed to

1156

* the user. */

1157

wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: AVP - Reply-Message",

1158

dpos, dlen);

1159

} else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT &&

1160

avp_code == RADIUS_ATTR_MS_CHAP2_SUCCESS) {

1161

wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: MS-CHAP2-Success",

1162

dpos, dlen);

1163

if (dlen != 43) {

1164

wpa_printf(MSG_WARNING, "EAP-TTLS: Unexpected "

1165

"MS-CHAP2-Success length "

1166

"(len=%lu, expected 43)",

1167

(unsigned long) dlen);

1168

return -1;

1169

}

1170

parse->mschapv2 = dpos;

1171

} else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT &&

1172

avp_code == RADIUS_ATTR_MS_CHAP_ERROR) {

1173

wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: MS-CHAP-Error",

1174

dpos, dlen);

1175

parse->mschapv2_error = 1;

1176

} else if (avp_flags & AVP_FLAGS_MANDATORY) {

1177

wpa_printf(MSG_WARNING, "EAP-TTLS: Unsupported mandatory AVP "

1178

"code %d vendor_id %d - dropped",

1179

(int) avp_code, (int) vendor_id);

1180

return -1;

1181

} else {

1182

wpa_printf(MSG_DEBUG, "EAP-TTLS: Ignoring unsupported AVP "

1183

"code %d vendor_id %d",

1184

(int) avp_code, (int) vendor_id);

1185

}

1186

1187

return avp_length;

1188

}

1189

1190

1191

static int eap_ttls_parse_avps(u8 *in_decrypted, size_t len_decrypted,

1192

struct ttls_parse_avp *parse)

1193

{

1194

u8 *pos;

1195

size_t left, pad;

1196

int avp_length;

1197

1198

wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Decrypted Phase 2 AVPs",

1199

in_decrypted, len_decrypted);

1200

if (len_decrypted < sizeof(struct ttls_avp)) {

1201

wpa_printf(MSG_WARNING, "EAP-TTLS: Too short Phase 2 AVP frame"

1202

" len=%lu expected %lu or more - dropped",

1203

(unsigned long) len_decrypted,

1204

(unsigned long) sizeof(struct ttls_avp));

1205

return -1;

1206

}

1207

1208

/* Parse AVPs */

1209

pos = in_decrypted;

1210

left = len_decrypted;

1211

1212

os_memset(parse, 0, sizeof(*parse));

1213

1214

while (left > 0) {

1215

avp_length = eap_ttls_parse_avp(pos, left, parse);

1216

if (avp_length < 0)

1217

return -1;

1218

1219

pad = (4 - (avp_length & 3)) & 3;

1220

pos += avp_length + pad;

1221

if (left < avp_length + pad)

1222

left = 0;

1223

else

1224

left -= avp_length + pad;

1225

}

1226

1227

return 0;

1228

}

1229

1230

1231

static u8 * eap_ttls_fake_identity_request(void)

1232

{

1233

struct eap_hdr *hdr;

1234

u8 *buf;

1235

1236

wpa_printf(MSG_DEBUG, "EAP-TTLS: empty data in beginning of "

1237

"Phase 2 - use fake EAP-Request Identity");

1238

buf = os_malloc(sizeof(*hdr) + 1);

1239

if (buf == NULL) {

1240

wpa_printf(MSG_WARNING, "EAP-TTLS: failed to allocate "

1241

"memory for fake EAP-Identity Request");

1242

return NULL;

1243

}

1244

1245

hdr = (struct eap_hdr *) buf;

1246

hdr->code = EAP_CODE_REQUEST;

1247

hdr->identifier = 0;

1248

hdr->length = host_to_be16(sizeof(*hdr) + 1);

1249

buf[sizeof(*hdr)] = EAP_TYPE_IDENTITY;

1250

1251

return buf;

1252

}

1253

1254

1255

static int eap_ttls_encrypt_response(struct eap_sm *sm,

1256

struct eap_ttls_data *data,

1257

u8 *resp, size_t resp_len,

1258

u8 identifier,

1259

u8 **out_data, size_t *out_len)

1260

{

1261

if (resp == NULL)

1262

return 0;

1263

1264

wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Encrypting Phase 2 data",

1265

resp, resp_len);

1266

if (eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_TTLS,

1267

data->ttls_version, identifier,

1268

resp, resp_len, out_data, out_len)) {

1269

wpa_printf(MSG_INFO, "EAP-TTLS: Failed to encrypt a Phase 2 "

1270

"frame");

1271

return -1;

1272

}

1273

os_free(resp);

1274

1275

return 0;

1276

}

1277

1278

1279

static int eap_ttls_process_phase2_eap(struct eap_sm *sm,

1280

struct eap_ttls_data *data,

1281

struct eap_method_ret *ret,

1282

struct ttls_parse_avp *parse,

1283

u8 **resp, size_t *resp_len)

1284

{

1285

struct eap_hdr *hdr;

1286

size_t len;

1287

1288

if (parse->eapdata == NULL) {

1289

wpa_printf(MSG_WARNING, "EAP-TTLS: No EAP Message in the "

1290

"packet - dropped");

1291

return -1;

1292

}

1293

1294

wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Phase 2 EAP",

1295

parse->eapdata, parse->eap_len);

1296

hdr = (struct eap_hdr *) parse->eapdata;

1297

1298

if (parse->eap_len < sizeof(*hdr)) {

1299

wpa_printf(MSG_WARNING, "EAP-TTLS: Too short Phase 2 EAP "

1300

"frame (len=%lu, expected %lu or more) - dropped",

1301

(unsigned long) parse->eap_len,

1302

(unsigned long) sizeof(*hdr));

1303

return -1;

1304

}

1305

len = be_to_host16(hdr->length);

1306

if (len > parse->eap_len) {

1307

wpa_printf(MSG_INFO, "EAP-TTLS: Length mismatch in Phase 2 "

1308

"EAP frame (EAP hdr len=%lu, EAP data len in "

1309

"AVP=%lu)",

1310

(unsigned long) len,

1311

(unsigned long) parse->eap_len);

1312

return -1;

1313

}

1314

wpa_printf(MSG_DEBUG, "EAP-TTLS: received Phase 2: code=%d "

1315

"identifier=%d length=%lu",

1316

hdr->code, hdr->identifier, (unsigned long) len);

1317

switch (hdr->code) {

1318

case EAP_CODE_REQUEST:

1319

if (eap_ttls_phase2_request(sm, data, ret, hdr, resp,

1320

resp_len)) {

1321

wpa_printf(MSG_INFO, "EAP-TTLS: Phase2 Request "

1322

"processing failed");

1323

return -1;

1324

}

1325

break;

1326

default:

1327

wpa_printf(MSG_INFO, "EAP-TTLS: Unexpected code=%d in "

1328

"Phase 2 EAP header", hdr->code);

1329

return -1;

1330

}

1331

1332

return 0;

1333

}

1334

1335

1336

static int eap_ttls_process_phase2_mschapv2(struct eap_sm *sm,

1337

struct eap_ttls_data *data,

1338

struct eap_method_ret *ret,

1339

struct ttls_parse_avp *parse)

1340

{

1341

u8 recv_response[20];

1342

1343

if (parse->mschapv2_error) {

1344

wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Received "

1345

"MS-CHAP-Error - failed");

1346

ret->methodState = METHOD_DONE;

1347

ret->decision = DECISION_FAIL;

1348

/* Reply with empty data to ACK error */

1349

return 1;

1350

}

1351

1352

if (parse->mschapv2 == NULL) {

1353

wpa_printf(MSG_WARNING, "EAP-TTLS: no MS-CHAP2-Success AVP "

1354

"received for Phase2 MSCHAPV2");

1355

return -1;

1356

}

1357

if (parse->mschapv2[0] != data->ident) {

1358

wpa_printf(MSG_WARNING, "EAP-TTLS: Ident mismatch for Phase 2 "

1359

"MSCHAPV2 (received Ident 0x%02x, expected 0x%02x)",

1360

parse->mschapv2[0], data->ident);

1361

return -1;

1362

}

1363

if (!data->auth_response_valid ||

1364

parse->mschapv2[1] != 'S' || parse->mschapv2[2] != '=' ||

1365

hexstr2bin((char *) (parse->mschapv2 + 3), recv_response, 20) ||

1366

os_memcmp(data->auth_response, recv_response, 20) != 0) {

1367

wpa_printf(MSG_WARNING, "EAP-TTLS: Invalid authenticator "

1368

"response in Phase 2 MSCHAPV2 success request");

1369

return -1;

1370

}

1371

1372

wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 MSCHAPV2 "

1373

"authentication succeeded");

1374

if (data->ttls_version > 0) {

1375

1376

* EAP-TTLSv1 uses TLS/IA FinalPhaseFinished to report

1377

* success, so do not allow connection to be terminated

1378

* yet.

1379

1380

ret->methodState = METHOD_CONT;

1381

ret->decision = DECISION_COND_SUCC;

1382

} else {

1383

ret->methodState = METHOD_DONE;

1384

ret->decision = DECISION_UNCOND_SUCC;

1385

data->phase2_success = 1;

1386

}

1387

1388

1389

* Reply with empty data; authentication server will reply

1390

* with EAP-Success after this.

1391

1392

return 1;

1393

}

1394

1395

1396

#ifdef EAP_TNC

1397

static int eap_ttls_process_tnc_start(struct eap_sm *sm,

1398

struct eap_ttls_data *data,

1399

struct eap_method_ret *ret,

1400

struct ttls_parse_avp *parse,

1401

u8 **resp, size_t *resp_len)

1402

{

1403

/* TNC uses inner EAP method after non-EAP TTLS phase 2. */

1404

if (parse->eapdata == NULL) {

1405

wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received "

1406

"unexpected tunneled data (no EAP)");

1407

return -1;

1408

}

1409

1410

if (!data->ready_for_tnc) {

1411

wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received "

1412

"EAP after non-EAP, but not ready for TNC");

1413

return -1;

1414

}

1415

1416

wpa_printf(MSG_DEBUG, "EAP-TTLS: Start TNC after completed "

1417

"non-EAP method");

1418

data->tnc_started = 1;

1419

1420

if (eap_ttls_process_phase2_eap(sm, data, ret, parse, resp,

1421

resp_len) < 0)

1422

return -1;

1423

1424

return 0;

1425

}

1426

#endif /* EAP_TNC */

1427

1428

1429

static int eap_ttls_process_decrypted(struct eap_sm *sm,

1430

struct eap_ttls_data *data,

1431

struct eap_method_ret *ret,

1432

u8 identifier,

1433

struct ttls_parse_avp *parse,

1434

u8 *in_decrypted, size_t len_decrypted,

1435

u8 **out_data, size_t *out_len)

1436

{

1437

u8 *resp = NULL;

1438

size_t resp_len;

1439

struct wpa_ssid *config = eap_get_config(sm);

1440

int res;

1441

1442

switch (data->phase2_type) {

1443

case EAP_TTLS_PHASE2_EAP:

1444

if (eap_ttls_process_phase2_eap(sm, data, ret, parse, &resp,

1445

&resp_len) < 0)

1446

return -1;

1447

break;

1448

case EAP_TTLS_PHASE2_MSCHAPV2:

1449

res = eap_ttls_process_phase2_mschapv2(sm, data, ret, parse);

1450

#ifdef EAP_TNC

1451

if (res == 1 && parse->eapdata &&

1452

ret->methodState == METHOD_DONE &&

1453

ret->decision == DECISION_UNCOND_SUCC) {

1454

1455

* TNC may be required as the next

1456

* authentication method within the tunnel.

1457

1458

ret->methodState = METHOD_MAY_CONT;

1459

data->ready_for_tnc = 1;

1460

if (eap_ttls_process_tnc_start(sm, data, ret, parse,

1461

&resp, &resp_len) == 0)

1462

break;

1463

}

1464

#endif /* EAP_TNC */

1465

return res;

1466

case EAP_TTLS_PHASE2_MSCHAP:

1467

case EAP_TTLS_PHASE2_PAP:

1468

case EAP_TTLS_PHASE2_CHAP:

1469

#ifdef EAP_TNC

1470

if (eap_ttls_process_tnc_start(sm, data, ret, parse,

1471

&resp, &resp_len) < 0)

1472

return -1;

1473

break;

1474

#else /* EAP_TNC */

1475

/* EAP-TTLS/{MSCHAP,PAP,CHAP} should not send any TLS tunneled

1476

* requests to the supplicant */

1477

wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received unexpected "

1478

"tunneled data");

1479

return -1;

1480

#endif /* EAP_TNC */

1481

}

1482

1483

if (resp) {

1484

if (eap_ttls_encrypt_response(sm, data, resp, resp_len,

1485

identifier,

1486

out_data, out_len) < 0)

1487

return -1;

1488

} else if (config->pending_req_identity ||

1489

config->pending_req_password ||

1490

config->pending_req_otp ||

1491

config->pending_req_new_password) {

1492

os_free(data->pending_phase2_req);

1493

data->pending_phase2_req = os_malloc(len_decrypted);

1494

if (data->pending_phase2_req) {

1495

os_memcpy(data->pending_phase2_req, in_decrypted,

1496

len_decrypted);

1497

data->pending_phase2_req_len = len_decrypted;

1498

}

1499

}

1500

1501

return 0;

1502

}

1503

1504

1505

#if EAP_TTLS_VERSION > 0

1506

static void eap_ttls_final_phase_finished(struct eap_sm *sm,

1507

struct eap_ttls_data *data,

1508

struct eap_method_ret *ret,

1509

u8 identifier,

1510

u8 **out_data, size_t *out_len)

1511

{

1512

wpa_printf(MSG_DEBUG, "EAP-TTLS: FinalPhaseFinished received");

1513

wpa_printf(MSG_INFO, "EAP-TTLS: TLS/IA authentication succeeded");

1514

ret->methodState = METHOD_DONE;

1515

ret->decision = DECISION_UNCOND_SUCC;

1516

data->phase2_success = 1;

1517

*out_data = eap_ttls_build_phase_finished(sm, data, identifier, 1,

1518

out_len);

1519

eap_ttls_v1_derive_key(sm, data);

1520

}

1521

#endif /* EAP_TTLS_VERSION */

1522

1523

1524

static int eap_ttls_implicit_identity_request(struct eap_sm *sm,

1525

struct eap_ttls_data *data,

1526

struct eap_method_ret *ret,

1527

u8 identifier,

1528

u8 **out_data, size_t *out_len)

1529

{

1530

int retval = 0;

1531

struct eap_hdr *hdr;

1532

u8 *resp;

1533

size_t resp_len;

1534

1535

hdr = (struct eap_hdr *) eap_ttls_fake_identity_request();

1536

if (hdr == NULL) {

1537

ret->methodState = METHOD_DONE;

1538

ret->decision = DECISION_FAIL;

1539

return -1;

1540

}

1541

1542

resp = NULL;

1543

if (eap_ttls_phase2_request(sm, data, ret, hdr, &resp, &resp_len)) {

1544

wpa_printf(MSG_INFO, "EAP-TTLS: Phase2 Request "

1545

"processing failed");

1546

retval = -1;

1547

} else {

1548

retval = eap_ttls_encrypt_response(sm, data, resp, resp_len,

1549

identifier, out_data,

1550

out_len);

1551

}

1552

1553

os_free(hdr);

1554

1555

if (retval < 0) {

1556

ret->methodState = METHOD_DONE;

1557

ret->decision = DECISION_FAIL;

1558

}

1559

1560

return retval;

1561

}

1562

1563

1564

static int eap_ttls_phase2_start(struct eap_sm *sm, struct eap_ttls_data *data,

1565

struct eap_method_ret *ret, u8 identifier,

1566

u8 **out_data, size_t *out_len)

1567

{

1568

data->phase2_start = 0;

1569

1570

1571

* EAP-TTLS does not use Phase2 on fast re-auth; this must be done only

1572

* if TLS part was indeed resuming a previous session. Most

1573

* Authentication Servers terminate EAP-TTLS before reaching this

1574

* point, but some do not. Make wpa_supplicant stop phase 2 here, if

1575

* needed.

1576

1577

if (data->reauth &&

1578

tls_connection_resumed(sm->ssl_ctx, data->ssl.conn)) {

1579

wpa_printf(MSG_DEBUG, "EAP-TTLS: Session resumption - "

1580

"skip phase 2");

1581

*out_data = eap_peer_tls_build_ack(&data->ssl, out_len,

1582

identifier, EAP_TYPE_TTLS,

1583

data->ttls_version);

1584

ret->methodState = METHOD_DONE;

1585

ret->decision = DECISION_UNCOND_SUCC;

1586

data->phase2_success = 1;

1587

return 0;

1588

}

1589

1590

return eap_ttls_implicit_identity_request(sm, data, ret, identifier,

1591

out_data, out_len);

1592

}

1593

1594

1595

static int eap_ttls_decrypt(struct eap_sm *sm, struct eap_ttls_data *data,

1596

struct eap_method_ret *ret,

1597

u8 identifier,

1598

const u8 *in_data, size_t in_len,

1599

u8 **out_data, size_t *out_len)

1600

{

1601

u8 *in_decrypted = NULL;

1602

int retval = 0;

1603

size_t len_decrypted = 0;

1604

struct ttls_parse_avp parse;

1605

1606

os_memset(&parse, 0, sizeof(parse));

1607

1608

wpa_printf(MSG_DEBUG, "EAP-TTLS: received %lu bytes encrypted data for"

1609

" Phase 2", (unsigned long) in_len);

1610

1611

if (data->pending_phase2_req) {

1612

wpa_printf(MSG_DEBUG, "EAP-TTLS: Pending Phase 2 request - "

1613

"skip decryption and use old data");

1614

/* Clear TLS reassembly state. */

1615

eap_peer_tls_reset_input(&data->ssl);

1616

1617

in_decrypted = data->pending_phase2_req;

1618

data->pending_phase2_req = NULL;

1619

len_decrypted = data->pending_phase2_req_len;

1620

if (data->pending_phase2_req_len == 0) {

1621

os_free(in_decrypted);

1622

return eap_ttls_implicit_identity_request(

1623

sm, data, ret, identifier, out_data,

1624

out_len);

1625

}

1626

goto continue_req;

1627

}

1628

1629

if (in_len == 0 && data->phase2_start) {

1630

return eap_ttls_phase2_start(sm, data, ret, identifier,

1631

out_data, out_len);

1632

}

1633

1634

if (in_len == 0) {

1635

/* Received TLS ACK - requesting more fragments */

1636

return eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_TTLS,

1637

data->ttls_version,

1638

identifier, NULL, 0,

1639

out_data, out_len);

1640

}

1641

1642

retval = eap_peer_tls_decrypt(sm, &data->ssl, in_data, in_len,

1643

&in_decrypted, &len_decrypted);

1644

if (retval)

1645

goto done;

1646

1647

#if EAP_TTLS_VERSION > 0

1648

if (data->ttls_version > 0 && len_decrypted == 0 &&

1649

tls_connection_ia_final_phase_finished(sm->ssl_ctx,

1650

data->ssl.conn)) {

1651

eap_ttls_final_phase_finished(sm, data, ret, identifier,

1652

out_data, out_len);

1653

goto done;

1654

}

1655

#endif /* EAP_TTLS_VERSION */

1656

1657

continue_req:

1658

data->phase2_start = 0;

1659

1660

if (eap_ttls_parse_avps(in_decrypted, len_decrypted, &parse) < 0) {

1661

retval = -1;

1662

goto done;

1663

}

1664

1665

retval = eap_ttls_process_decrypted(sm, data, ret, identifier,

1666

&parse,

1667

in_decrypted, len_decrypted,

1668

out_data, out_len);

1669

1670

done:

1671

os_free(in_decrypted);

1672

os_free(parse.eapdata);

1673

1674

if (retval < 0) {

1675

ret->methodState = METHOD_DONE;

1676

ret->decision = DECISION_FAIL;

1677

}

1678

1679

return retval;

1680

}

1681

1682

1683

static int eap_ttls_process_start(struct eap_sm *sm,

1684

struct eap_ttls_data *data, u8 flags,

1685

struct eap_method_ret *ret)

1686

{

1687

struct wpa_ssid *config = eap_get_config(sm);

1688

1689

wpa_printf(MSG_DEBUG, "EAP-TTLS: Start (server ver=%d, own ver=%d)",

1690

flags & EAP_PEAP_VERSION_MASK, data->ttls_version);

1691

#if EAP_TTLS_VERSION > 0

1692

if ((flags & EAP_PEAP_VERSION_MASK) < data->ttls_version)

1693

data->ttls_version = flags & EAP_PEAP_VERSION_MASK;

1694

if (data->force_ttls_version >= 0 &&

1695

data->force_ttls_version != data->ttls_version) {

1696

wpa_printf(MSG_WARNING, "EAP-TTLS: Failed to select "

1697

"forced TTLS version %d",

1698

data->force_ttls_version);

1699

ret->methodState = METHOD_DONE;

1700

ret->decision = DECISION_FAIL;

1701

ret->allowNotifications = FALSE;

1702

return -1;

1703

}

1704

wpa_printf(MSG_DEBUG, "EAP-TTLS: Using TTLS version %d",

1705

data->ttls_version);

1706

1707

if (data->ttls_version > 0)

1708

data->ssl.tls_ia = 1;

1709

#endif /* EAP_TTLS_VERSION */

1710

if (!data->ssl_initialized &&

1711

eap_peer_tls_ssl_init(sm, &data->ssl, config)) {

1712

wpa_printf(MSG_INFO, "EAP-TTLS: Failed to initialize SSL.");

1713

return -1;

1714

}

1715

data->ssl_initialized = 1;

1716

1717

wpa_printf(MSG_DEBUG, "EAP-TTLS: Start");

1718

1719

return 0;

1720

}

1721

1722

1723

static int eap_ttls_process_handshake(struct eap_sm *sm,

1724

struct eap_ttls_data *data,

1725

struct eap_method_ret *ret,

1726

u8 identifier,

1727

const u8 *in_data, size_t in_len,

1728

u8 **out_data, size_t *out_len)

1729

{

1730

int res;

1731

1732

res = eap_peer_tls_process_helper(sm, &data->ssl, EAP_TYPE_TTLS,

1733

data->ttls_version, identifier,

1734

in_data, in_len, out_data, out_len);

1735

1736

if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) {

1737

wpa_printf(MSG_DEBUG, "EAP-TTLS: TLS done, proceed to "

1738

"Phase 2");

1739

if (data->resuming) {

1740

wpa_printf(MSG_DEBUG, "EAP-TTLS: fast reauth - may "

1741

"skip Phase 2");

1742

ret->decision = DECISION_COND_SUCC;

1743

ret->methodState = METHOD_MAY_CONT;

1744

}

1745

data->phase2_start = 1;

1746

if (data->ttls_version == 0)

1747

eap_ttls_v0_derive_key(sm, data);

1748

1749

if (*out_len == 0) {

1750

if (eap_ttls_decrypt(sm, data, ret, identifier,

1751

NULL, 0, out_data, out_len)) {

1752

wpa_printf(MSG_WARNING, "EAP-TTLS: "

1753

"failed to process early "

1754

"start for Phase 2");

1755

}

1756

res = 0;

1757

}

1758

data->resuming = 0;

1759

}

1760

1761

if (res == 2) {

1762

1763

* Application data included in the handshake message.

1764

1765

os_free(data->pending_phase2_req);

1766

data->pending_phase2_req = *out_data;

1767

data->pending_phase2_req_len = *out_len;

1768

*out_data = NULL;

1769

*out_len = 0;

1770

res = eap_ttls_decrypt(sm, data, ret, identifier,

1771

in_data, in_len, out_data, out_len);

1772

}

1773

1774

return res;

1775

}

1776

1777

1778

static void eap_ttls_check_auth_status(struct eap_sm *sm,

1779

struct eap_ttls_data *data,

1780

struct eap_method_ret *ret)

1781

{

1782

if (data->ttls_version == 0 && ret->methodState == METHOD_DONE) {

1783

ret->allowNotifications = FALSE;

1784

if (ret->decision == DECISION_UNCOND_SUCC ||

1785

ret->decision == DECISION_COND_SUCC) {

1786

wpa_printf(MSG_DEBUG, "EAP-TTLS: Authentication "

1787

"completed successfully");

1788

data->phase2_success = 1;

1789

#ifdef EAP_TNC

1790

if (!data->ready_for_tnc && !data->tnc_started) {

1791

1792

* TNC may be required as the next

1793

* authentication method within the tunnel.

1794

1795

ret->methodState = METHOD_MAY_CONT;

1796

data->ready_for_tnc = 1;

1797

}

1798

#endif /* EAP_TNC */

1799

}

1800

} else if (data->ttls_version == 0 && sm->workaround &&

1801

ret->methodState == METHOD_MAY_CONT &&

1802

(ret->decision == DECISION_UNCOND_SUCC ||

1803

ret->decision == DECISION_COND_SUCC)) {

1804

wpa_printf(MSG_DEBUG, "EAP-TTLS: Authentication "

1805

"completed successfully (EAP workaround)");

1806

data->phase2_success = 1;

1807

}

1808

}

1809

1810

1811

static u8 * eap_ttls_process(struct eap_sm *sm, void *priv,

1812

struct eap_method_ret *ret,

1813

const u8 *reqData, size_t reqDataLen,

1814

size_t *respDataLen)

1815

{

1816

const struct eap_hdr *req;

1817

size_t left;

1818

int res;

1819

u8 flags, *resp;

1820

const u8 *pos;

1821

struct eap_ttls_data *data = priv;

1822

1823

pos = eap_peer_tls_process_init(sm, &data->ssl, EAP_TYPE_TTLS, ret,

1824

reqData, reqDataLen, &left, &flags);

1825

if (pos == NULL)

1826

return NULL;

1827

req = (const struct eap_hdr *) reqData;

1828

1829

if (flags & EAP_TLS_FLAGS_START) {

1830

if (eap_ttls_process_start(sm, data, flags, ret) < 0)

1831

return NULL;

1832

1833

/* draft-ietf-pppext-eap-ttls-03.txt, Ch. 8.1:

1834

* EAP-TTLS Start packet may, in a future specification, be

1835

* allowed to contain data. Client based on this draft version

1836

* must ignore such data but must not reject the Start packet.

1837

1838

left = 0;

1839

} else if (!data->ssl_initialized) {

1840

wpa_printf(MSG_DEBUG, "EAP-TTLS: First message did not "

1841

"include Start flag");

1842

ret->methodState = METHOD_DONE;

1843

ret->decision = DECISION_FAIL;

1844

ret->allowNotifications = FALSE;

1845

return NULL;

1846

}

1847

1848

resp = NULL;

1849

if (tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&

1850

!data->resuming) {

1851

res = eap_ttls_decrypt(sm, data, ret, req->identifier,

1852

pos, left, &resp, respDataLen);

1853

} else {

1854

res = eap_ttls_process_handshake(sm, data, ret,

1855

req->identifier, pos, left,

1856

&resp, respDataLen);

1857

}

1858

1859

eap_ttls_check_auth_status(sm, data, ret);

1860

1861

/* FIX: what about res == -1? Could just move all error processing into

1862

* the other functions and get rid of this res==1 case here. */

1863

if (res == 1) {

1864

os_free(resp);

1865

return eap_peer_tls_build_ack(&data->ssl, respDataLen,

1866

req->identifier, EAP_TYPE_TTLS,

1867

data->ttls_version);

1868

}

1869

return resp;

1870

}

1871

1872

1873

static Boolean eap_ttls_has_reauth_data(struct eap_sm *sm, void *priv)

1874

{

1875

struct eap_ttls_data *data = priv;

1876

return tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&

1877

data->phase2_success;

1878

}

1879

1880

1881

static void eap_ttls_deinit_for_reauth(struct eap_sm *sm, void *priv)

1882

{

1883

struct eap_ttls_data *data = priv;

1884

os_free(data->pending_phase2_req);

1885

data->pending_phase2_req = NULL;

1886

#ifdef EAP_TNC

1887

data->ready_for_tnc = 0;

1888

data->tnc_started = 0;

1889

#endif /* EAP_TNC */

1890

}

1891

1892

1893

static void * eap_ttls_init_for_reauth(struct eap_sm *sm, void *priv)

1894

{

1895

struct eap_ttls_data *data = priv;

1896

os_free(data->key_data);

1897

data->key_data = NULL;

1898

if (eap_peer_tls_reauth_init(sm, &data->ssl)) {

1899

os_free(data);

1900

return NULL;

1901

}

1902

if (data->phase2_priv && data->phase2_method &&

1903

data->phase2_method->init_for_reauth)

1904

data->phase2_method->init_for_reauth(sm, data->phase2_priv);

1905

data->phase2_start = 0;

1906

data->phase2_success = 0;

1907

data->resuming = 1;

1908

data->reauth = 1;

1909

return priv;

1910

}

1911

1912

1913

static int eap_ttls_get_status(struct eap_sm *sm, void *priv, char *buf,

1914

size_t buflen, int verbose)

1915

{

1916

struct eap_ttls_data *data = priv;

1917

int len, ret;

1918

1919

len = eap_peer_tls_status(sm, &data->ssl, buf, buflen, verbose);

1920

ret = os_snprintf(buf + len, buflen - len,

1921

"EAP-TTLSv%d Phase2 method=",

1922

data->ttls_version);

1923

if (ret < 0 || (size_t) ret >= buflen - len)

1924

return len;

1925

len += ret;

1926

switch (data->phase2_type) {

1927

case EAP_TTLS_PHASE2_EAP:

1928

ret = os_snprintf(buf + len, buflen - len, "EAP-%s\n",

1929

data->phase2_method ?

1930

data->phase2_method->name : "?");

1931

break;

1932

case EAP_TTLS_PHASE2_MSCHAPV2:

1933

ret = os_snprintf(buf + len, buflen - len, "MSCHAPV2\n");

1934

break;

1935

case EAP_TTLS_PHASE2_MSCHAP:

1936

ret = os_snprintf(buf + len, buflen - len, "MSCHAP\n");

1937

break;

1938

case EAP_TTLS_PHASE2_PAP:

1939

ret = os_snprintf(buf + len, buflen - len, "PAP\n");

1940

break;

1941

case EAP_TTLS_PHASE2_CHAP:

1942

ret = os_snprintf(buf + len, buflen - len, "CHAP\n");

1943

break;

1944

default:

1945

ret = 0;

1946

break;

1947

}

1948

if (ret < 0 || (size_t) ret >= buflen - len)

1949

return len;

1950

len += ret;

1951

1952

return len;

1953

}

1954

1955

1956

static Boolean eap_ttls_isKeyAvailable(struct eap_sm *sm, void *priv)

1957

{

1958

struct eap_ttls_data *data = priv;

1959

return data->key_data != NULL && data->phase2_success;

1960

}

1961

1962

1963

static u8 * eap_ttls_getKey(struct eap_sm *sm, void *priv, size_t *len)

1964

{

1965

struct eap_ttls_data *data = priv;

1966

u8 *key;

1967

1968

if (data->key_data == NULL || !data->phase2_success)

1969

return NULL;

1970

1971

key = os_malloc(EAP_TLS_KEY_LEN);

1972

if (key == NULL)

1973

return NULL;

1974

1975

*len = EAP_TLS_KEY_LEN;

1976

os_memcpy(key, data->key_data, EAP_TLS_KEY_LEN);

1977

1978

return key;

1979

}

1980

1981

1982

int eap_peer_ttls_register(void)

1983

{

1984

struct eap_method *eap;

1985

int ret;

1986

1987

eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,

1988

EAP_VENDOR_IETF, EAP_TYPE_TTLS, "TTLS");

1989

if (eap == NULL)

1990

return -1;

1991

1992

eap->init = eap_ttls_init;

1993

eap->deinit = eap_ttls_deinit;

1994

eap->process = eap_ttls_process;

1995

eap->isKeyAvailable = eap_ttls_isKeyAvailable;

1996

eap->getKey = eap_ttls_getKey;

1997

eap->get_status = eap_ttls_get_status;

1998

eap->has_reauth_data = eap_ttls_has_reauth_data;

1999

eap->deinit_for_reauth = eap_ttls_deinit_for_reauth;

2000

eap->init_for_reauth = eap_ttls_init_for_reauth;

2001

2002

ret = eap_peer_method_register(eap);

2003

if (ret)

2004

eap_peer_method_free(eap);

2005

return ret;

2006

}

Older »