1 /* 2 * Copyright (c) 2004 - Michael Richardson <mcr@xelerance.com> 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that: (1) source code distributions 6 * retain the above copyright notice and this paragraph in its entirety, (2) 7 * distributions including binary code include the above copyright notice and 8 * this paragraph in its entirety in the documentation or other materials 9 * provided with the distribution, and (3) all advertising materials mentioning 10 * features or use of this software display the following acknowledgement: 11 * ``This product includes software developed by the University of California, 12 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 13 * the University nor the names of its contributors may be used to endorse 14 * or promote products derived from this software without specific prior 15 * written permission. 16 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 17 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 18 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 19 */ 20 21 /* \summary: Extensible Authentication Protocol (EAP) printer */ 22 23 #ifdef HAVE_CONFIG_H 24 #include "config.h" 25 #endif 26 27 #include <netdissect-stdinc.h> 28 29 #include "netdissect.h" 30 #include "extract.h" 31 32 #define EAP_FRAME_TYPE_PACKET 0 33 #define EAP_FRAME_TYPE_START 1 34 #define EAP_FRAME_TYPE_LOGOFF 2 35 #define EAP_FRAME_TYPE_KEY 3 36 #define EAP_FRAME_TYPE_ENCAP_ASF_ALERT 4 37 38 struct eap_frame_t { 39 unsigned char version; 40 unsigned char type; 41 unsigned char length[2]; 42 }; 43 44 static const struct tok eap_frame_type_values[] = { 45 { EAP_FRAME_TYPE_PACKET, "EAP packet" }, 46 { EAP_FRAME_TYPE_START, "EAPOL start" }, 47 { EAP_FRAME_TYPE_LOGOFF, "EAPOL logoff" }, 48 { EAP_FRAME_TYPE_KEY, "EAPOL key" }, 49 { EAP_FRAME_TYPE_ENCAP_ASF_ALERT, "Encapsulated ASF alert" }, 50 { 0, NULL} 51 }; 52 53 /* RFC 3748 */ 54 struct eap_packet_t { 55 unsigned char code; 56 unsigned char id; 57 unsigned char length[2]; 58 }; 59 60 #define EAP_REQUEST 1 61 #define EAP_RESPONSE 2 62 #define EAP_SUCCESS 3 63 #define EAP_FAILURE 4 64 65 static const struct tok eap_code_values[] = { 66 { EAP_REQUEST, "Request" }, 67 { EAP_RESPONSE, "Response" }, 68 { EAP_SUCCESS, "Success" }, 69 { EAP_FAILURE, "Failure" }, 70 { 0, NULL} 71 }; 72 73 #define EAP_TYPE_NO_PROPOSED 0 74 #define EAP_TYPE_IDENTITY 1 75 #define EAP_TYPE_NOTIFICATION 2 76 #define EAP_TYPE_NAK 3 77 #define EAP_TYPE_MD5_CHALLENGE 4 78 #define EAP_TYPE_OTP 5 79 #define EAP_TYPE_GTC 6 80 #define EAP_TYPE_TLS 13 /* RFC 2716 */ 81 #define EAP_TYPE_SIM 18 /* RFC 4186 */ 82 #define EAP_TYPE_TTLS 21 /* draft-funk-eap-ttls-v0-01.txt */ 83 #define EAP_TYPE_AKA 23 /* RFC 4187 */ 84 #define EAP_TYPE_FAST 43 /* RFC 4851 */ 85 #define EAP_TYPE_EXPANDED_TYPES 254 86 #define EAP_TYPE_EXPERIMENTAL 255 87 88 static const struct tok eap_type_values[] = { 89 { EAP_TYPE_NO_PROPOSED, "No proposed" }, 90 { EAP_TYPE_IDENTITY, "Identity" }, 91 { EAP_TYPE_NOTIFICATION, "Notification" }, 92 { EAP_TYPE_NAK, "Nak" }, 93 { EAP_TYPE_MD5_CHALLENGE, "MD5-challenge" }, 94 { EAP_TYPE_OTP, "OTP" }, 95 { EAP_TYPE_GTC, "GTC" }, 96 { EAP_TYPE_TLS, "TLS" }, 97 { EAP_TYPE_SIM, "SIM" }, 98 { EAP_TYPE_TTLS, "TTLS" }, 99 { EAP_TYPE_AKA, "AKA" }, 100 { EAP_TYPE_FAST, "FAST" }, 101 { EAP_TYPE_EXPANDED_TYPES, "Expanded types" }, 102 { EAP_TYPE_EXPERIMENTAL, "Experimental" }, 103 { 0, NULL} 104 }; 105 106 #define EAP_TLS_EXTRACT_BIT_L(x) (((x)&0x80)>>7) 107 108 /* RFC 2716 - EAP TLS bits */ 109 #define EAP_TLS_FLAGS_LEN_INCLUDED (1 << 7) 110 #define EAP_TLS_FLAGS_MORE_FRAGMENTS (1 << 6) 111 #define EAP_TLS_FLAGS_START (1 << 5) 112 113 static const struct tok eap_tls_flags_values[] = { 114 { EAP_TLS_FLAGS_LEN_INCLUDED, "L bit" }, 115 { EAP_TLS_FLAGS_MORE_FRAGMENTS, "More fragments bit"}, 116 { EAP_TLS_FLAGS_START, "Start bit"}, 117 { 0, NULL} 118 }; 119 120 #define EAP_TTLS_VERSION(x) ((x)&0x07) 121 122 /* EAP-AKA and EAP-SIM - RFC 4187 */ 123 #define EAP_AKA_CHALLENGE 1 124 #define EAP_AKA_AUTH_REJECT 2 125 #define EAP_AKA_SYNC_FAILURE 4 126 #define EAP_AKA_IDENTITY 5 127 #define EAP_SIM_START 10 128 #define EAP_SIM_CHALLENGE 11 129 #define EAP_AKA_NOTIFICATION 12 130 #define EAP_AKA_REAUTH 13 131 #define EAP_AKA_CLIENT_ERROR 14 132 133 static const struct tok eap_aka_subtype_values[] = { 134 { EAP_AKA_CHALLENGE, "Challenge" }, 135 { EAP_AKA_AUTH_REJECT, "Auth reject" }, 136 { EAP_AKA_SYNC_FAILURE, "Sync failure" }, 137 { EAP_AKA_IDENTITY, "Identity" }, 138 { EAP_SIM_START, "Start" }, 139 { EAP_SIM_CHALLENGE, "Challenge" }, 140 { EAP_AKA_NOTIFICATION, "Notification" }, 141 { EAP_AKA_REAUTH, "Reauth" }, 142 { EAP_AKA_CLIENT_ERROR, "Client error" }, 143 { 0, NULL} 144 }; 145 146 /* 147 * Print EAP requests / responses 148 */ 149 void 150 eap_print(netdissect_options *ndo, 151 register const u_char *cp, 152 u_int length) 153 { 154 const struct eap_frame_t *eap; 155 const u_char *tptr; 156 u_int tlen, type, subtype; 157 int count=0, len; 158 159 tptr = cp; 160 tlen = length; 161 eap = (const struct eap_frame_t *)cp; 162 ND_TCHECK(*eap); 163 164 /* in non-verbose mode just lets print the basic info */ 165 if (ndo->ndo_vflag < 1) { 166 ND_PRINT((ndo, "%s (%u) v%u, len %u", 167 tok2str(eap_frame_type_values, "unknown", eap->type), 168 eap->type, 169 eap->version, 170 EXTRACT_16BITS(eap->length))); 171 return; 172 } 173 174 ND_PRINT((ndo, "%s (%u) v%u, len %u", 175 tok2str(eap_frame_type_values, "unknown", eap->type), 176 eap->type, 177 eap->version, 178 EXTRACT_16BITS(eap->length))); 179 180 tptr += sizeof(const struct eap_frame_t); 181 tlen -= sizeof(const struct eap_frame_t); 182 183 switch (eap->type) { 184 case EAP_FRAME_TYPE_PACKET: 185 type = *(tptr); 186 len = EXTRACT_16BITS(tptr+2); 187 ND_PRINT((ndo, ", %s (%u), id %u, len %u", 188 tok2str(eap_code_values, "unknown", type), 189 type, 190 *(tptr+1), 191 len)); 192 193 ND_TCHECK2(*tptr, len); 194 195 if (type <= 2) { /* For EAP_REQUEST and EAP_RESPONSE only */ 196 subtype = *(tptr+4); 197 ND_PRINT((ndo, "\n\t\t Type %s (%u)", 198 tok2str(eap_type_values, "unknown", *(tptr+4)), 199 *(tptr + 4))); 200 201 switch (subtype) { 202 case EAP_TYPE_IDENTITY: 203 if (len - 5 > 0) { 204 ND_PRINT((ndo, ", Identity: ")); 205 safeputs(ndo, tptr + 5, len - 5); 206 } 207 break; 208 209 case EAP_TYPE_NOTIFICATION: 210 if (len - 5 > 0) { 211 ND_PRINT((ndo, ", Notification: ")); 212 safeputs(ndo, tptr + 5, len - 5); 213 } 214 break; 215 216 case EAP_TYPE_NAK: 217 count = 5; 218 219 /* 220 * one or more octets indicating 221 * the desired authentication 222 * type one octet per type 223 */ 224 while (count < len) { 225 ND_PRINT((ndo, " %s (%u),", 226 tok2str(eap_type_values, "unknown", *(tptr+count)), 227 *(tptr + count))); 228 count++; 229 } 230 break; 231 232 case EAP_TYPE_TTLS: 233 ND_PRINT((ndo, " TTLSv%u", 234 EAP_TTLS_VERSION(*(tptr + 5)))); /* fall through */ 235 case EAP_TYPE_TLS: 236 ND_PRINT((ndo, " flags [%s] 0x%02x,", 237 bittok2str(eap_tls_flags_values, "none", *(tptr+5)), 238 *(tptr + 5))); 239 240 if (EAP_TLS_EXTRACT_BIT_L(*(tptr+5))) { 241 ND_PRINT((ndo, " len %u", EXTRACT_32BITS(tptr + 6))); 242 } 243 break; 244 245 case EAP_TYPE_FAST: 246 ND_PRINT((ndo, " FASTv%u", 247 EAP_TTLS_VERSION(*(tptr + 5)))); 248 ND_PRINT((ndo, " flags [%s] 0x%02x,", 249 bittok2str(eap_tls_flags_values, "none", *(tptr+5)), 250 *(tptr + 5))); 251 252 if (EAP_TLS_EXTRACT_BIT_L(*(tptr+5))) { 253 ND_PRINT((ndo, " len %u", EXTRACT_32BITS(tptr + 6))); 254 } 255 256 /* FIXME - TLV attributes follow */ 257 break; 258 259 case EAP_TYPE_AKA: 260 case EAP_TYPE_SIM: 261 ND_PRINT((ndo, " subtype [%s] 0x%02x,", 262 tok2str(eap_aka_subtype_values, "unknown", *(tptr+5)), 263 *(tptr + 5))); 264 265 /* FIXME - TLV attributes follow */ 266 break; 267 268 case EAP_TYPE_MD5_CHALLENGE: 269 case EAP_TYPE_OTP: 270 case EAP_TYPE_GTC: 271 case EAP_TYPE_EXPANDED_TYPES: 272 case EAP_TYPE_EXPERIMENTAL: 273 default: 274 break; 275 } 276 } 277 break; 278 279 case EAP_FRAME_TYPE_LOGOFF: 280 case EAP_FRAME_TYPE_ENCAP_ASF_ALERT: 281 default: 282 break; 283 } 284 return; 285 286 trunc: 287 ND_PRINT((ndo, "\n\t[|EAP]")); 288 } 289 290 /* 291 * Local Variables: 292 * c-basic-offset: 4 293 * End: 294 */ 295