xref: /freebsd/contrib/wpa/src/eap_peer/eap_ttls.c (revision b2d48be1bc7df45ddd13b143a160d0acb5a383c5)
1 /*
2  * EAP peer method: EAP-TTLS (RFC 5281)
3  * Copyright (c) 2004-2011, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "includes.h"
10 
11 #include "common.h"
12 #include "crypto/ms_funcs.h"
13 #include "crypto/sha1.h"
14 #include "crypto/tls.h"
15 #include "eap_common/chap.h"
16 #include "eap_common/eap_ttls.h"
17 #include "mschapv2.h"
18 #include "eap_i.h"
19 #include "eap_tls_common.h"
20 #include "eap_config.h"
21 
22 
23 #define EAP_TTLS_VERSION 0
24 
25 
26 static void eap_ttls_deinit(struct eap_sm *sm, void *priv);
27 
28 
29 struct eap_ttls_data {
30 	struct eap_ssl_data ssl;
31 
32 	int ttls_version;
33 
34 	const struct eap_method *phase2_method;
35 	void *phase2_priv;
36 	int phase2_success;
37 	int phase2_start;
38 
39 	enum phase2_types {
40 		EAP_TTLS_PHASE2_EAP,
41 		EAP_TTLS_PHASE2_MSCHAPV2,
42 		EAP_TTLS_PHASE2_MSCHAP,
43 		EAP_TTLS_PHASE2_PAP,
44 		EAP_TTLS_PHASE2_CHAP
45 	} phase2_type;
46 	struct eap_method_type phase2_eap_type;
47 	struct eap_method_type *phase2_eap_types;
48 	size_t num_phase2_eap_types;
49 
50 	u8 auth_response[MSCHAPV2_AUTH_RESPONSE_LEN];
51 	int auth_response_valid;
52 	u8 master_key[MSCHAPV2_MASTER_KEY_LEN]; /* MSCHAPv2 master key */
53 	u8 ident;
54 	int resuming; /* starting a resumed session */
55 	int reauth; /* reauthentication */
56 	u8 *key_data;
57 	u8 *session_id;
58 	size_t id_len;
59 
60 	struct wpabuf *pending_phase2_req;
61 
62 #ifdef EAP_TNC
63 	int ready_for_tnc;
64 	int tnc_started;
65 #endif /* EAP_TNC */
66 };
67 
68 
69 static void * eap_ttls_init(struct eap_sm *sm)
70 {
71 	struct eap_ttls_data *data;
72 	struct eap_peer_config *config = eap_get_config(sm);
73 	char *selected;
74 
75 	data = os_zalloc(sizeof(*data));
76 	if (data == NULL)
77 		return NULL;
78 	data->ttls_version = EAP_TTLS_VERSION;
79 	selected = "EAP";
80 	data->phase2_type = EAP_TTLS_PHASE2_EAP;
81 
82 	if (config && config->phase2) {
83 		if (os_strstr(config->phase2, "autheap=")) {
84 			selected = "EAP";
85 			data->phase2_type = EAP_TTLS_PHASE2_EAP;
86 		} else if (os_strstr(config->phase2, "auth=MSCHAPV2")) {
87 			selected = "MSCHAPV2";
88 			data->phase2_type = EAP_TTLS_PHASE2_MSCHAPV2;
89 		} else if (os_strstr(config->phase2, "auth=MSCHAP")) {
90 			selected = "MSCHAP";
91 			data->phase2_type = EAP_TTLS_PHASE2_MSCHAP;
92 		} else if (os_strstr(config->phase2, "auth=PAP")) {
93 			selected = "PAP";
94 			data->phase2_type = EAP_TTLS_PHASE2_PAP;
95 		} else if (os_strstr(config->phase2, "auth=CHAP")) {
96 			selected = "CHAP";
97 			data->phase2_type = EAP_TTLS_PHASE2_CHAP;
98 		}
99 	}
100 	wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase2 type: %s", selected);
101 
102 	if (data->phase2_type == EAP_TTLS_PHASE2_EAP) {
103 		if (eap_peer_select_phase2_methods(config, "autheap=",
104 						   &data->phase2_eap_types,
105 						   &data->num_phase2_eap_types)
106 		    < 0) {
107 			eap_ttls_deinit(sm, data);
108 			return NULL;
109 		}
110 
111 		data->phase2_eap_type.vendor = EAP_VENDOR_IETF;
112 		data->phase2_eap_type.method = EAP_TYPE_NONE;
113 	}
114 
115 	if (eap_peer_tls_ssl_init(sm, &data->ssl, config, EAP_TYPE_TTLS)) {
116 		wpa_printf(MSG_INFO, "EAP-TTLS: Failed to initialize SSL.");
117 		eap_ttls_deinit(sm, data);
118 		return NULL;
119 	}
120 
121 	return data;
122 }
123 
124 
125 static void eap_ttls_phase2_eap_deinit(struct eap_sm *sm,
126 				       struct eap_ttls_data *data)
127 {
128 	if (data->phase2_priv && data->phase2_method) {
129 		data->phase2_method->deinit(sm, data->phase2_priv);
130 		data->phase2_method = NULL;
131 		data->phase2_priv = NULL;
132 	}
133 }
134 
135 
136 static void eap_ttls_free_key(struct eap_ttls_data *data)
137 {
138 	if (data->key_data) {
139 		bin_clear_free(data->key_data, EAP_TLS_KEY_LEN + EAP_EMSK_LEN);
140 		data->key_data = NULL;
141 	}
142 }
143 
144 
145 static void eap_ttls_deinit(struct eap_sm *sm, void *priv)
146 {
147 	struct eap_ttls_data *data = priv;
148 	if (data == NULL)
149 		return;
150 	eap_ttls_phase2_eap_deinit(sm, data);
151 	os_free(data->phase2_eap_types);
152 	eap_peer_tls_ssl_deinit(sm, &data->ssl);
153 	eap_ttls_free_key(data);
154 	os_free(data->session_id);
155 	wpabuf_free(data->pending_phase2_req);
156 	os_free(data);
157 }
158 
159 
160 static u8 * eap_ttls_avp_hdr(u8 *avphdr, u32 avp_code, u32 vendor_id,
161 			     int mandatory, size_t len)
162 {
163 	struct ttls_avp_vendor *avp;
164 	u8 flags;
165 	size_t hdrlen;
166 
167 	avp = (struct ttls_avp_vendor *) avphdr;
168 	flags = mandatory ? AVP_FLAGS_MANDATORY : 0;
169 	if (vendor_id) {
170 		flags |= AVP_FLAGS_VENDOR;
171 		hdrlen = sizeof(*avp);
172 		avp->vendor_id = host_to_be32(vendor_id);
173 	} else {
174 		hdrlen = sizeof(struct ttls_avp);
175 	}
176 
177 	avp->avp_code = host_to_be32(avp_code);
178 	avp->avp_length = host_to_be32((flags << 24) | (u32) (hdrlen + len));
179 
180 	return avphdr + hdrlen;
181 }
182 
183 
184 static u8 * eap_ttls_avp_add(u8 *start, u8 *avphdr, u32 avp_code,
185 			     u32 vendor_id, int mandatory,
186 			     const u8 *data, size_t len)
187 {
188 	u8 *pos;
189 	pos = eap_ttls_avp_hdr(avphdr, avp_code, vendor_id, mandatory, len);
190 	os_memcpy(pos, data, len);
191 	pos += len;
192 	AVP_PAD(start, pos);
193 	return pos;
194 }
195 
196 
197 static int eap_ttls_avp_encapsulate(struct wpabuf **resp, u32 avp_code,
198 				    int mandatory)
199 {
200 	struct wpabuf *msg;
201 	u8 *avp, *pos;
202 
203 	msg = wpabuf_alloc(sizeof(struct ttls_avp) + wpabuf_len(*resp) + 4);
204 	if (msg == NULL) {
205 		wpabuf_free(*resp);
206 		*resp = NULL;
207 		return -1;
208 	}
209 
210 	avp = wpabuf_mhead(msg);
211 	pos = eap_ttls_avp_hdr(avp, avp_code, 0, mandatory, wpabuf_len(*resp));
212 	os_memcpy(pos, wpabuf_head(*resp), wpabuf_len(*resp));
213 	pos += wpabuf_len(*resp);
214 	AVP_PAD(avp, pos);
215 	wpabuf_free(*resp);
216 	wpabuf_put(msg, pos - avp);
217 	*resp = msg;
218 	return 0;
219 }
220 
221 
222 static int eap_ttls_v0_derive_key(struct eap_sm *sm,
223 				  struct eap_ttls_data *data)
224 {
225 	eap_ttls_free_key(data);
226 	data->key_data = eap_peer_tls_derive_key(sm, &data->ssl,
227 						 "ttls keying material",
228 						 EAP_TLS_KEY_LEN +
229 						 EAP_EMSK_LEN);
230 	if (!data->key_data) {
231 		wpa_printf(MSG_INFO, "EAP-TTLS: Failed to derive key");
232 		return -1;
233 	}
234 
235 	wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived key",
236 			data->key_data, EAP_TLS_KEY_LEN);
237 	wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: Derived EMSK",
238 			data->key_data + EAP_TLS_KEY_LEN,
239 			EAP_EMSK_LEN);
240 
241 	os_free(data->session_id);
242 	data->session_id = eap_peer_tls_derive_session_id(sm, &data->ssl,
243 							  EAP_TYPE_TTLS,
244 	                                                  &data->id_len);
245 	if (data->session_id) {
246 		wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Derived Session-Id",
247 			    data->session_id, data->id_len);
248 	} else {
249 		wpa_printf(MSG_ERROR, "EAP-TTLS: Failed to derive Session-Id");
250 	}
251 
252 	return 0;
253 }
254 
255 
256 static u8 * eap_ttls_implicit_challenge(struct eap_sm *sm,
257 					struct eap_ttls_data *data, size_t len)
258 {
259 	return eap_peer_tls_derive_key(sm, &data->ssl, "ttls challenge", len);
260 }
261 
262 
263 static void eap_ttls_phase2_select_eap_method(struct eap_ttls_data *data,
264 					      u8 method)
265 {
266 	size_t i;
267 	for (i = 0; i < data->num_phase2_eap_types; i++) {
268 		if (data->phase2_eap_types[i].vendor != EAP_VENDOR_IETF ||
269 		    data->phase2_eap_types[i].method != method)
270 			continue;
271 
272 		data->phase2_eap_type.vendor =
273 			data->phase2_eap_types[i].vendor;
274 		data->phase2_eap_type.method =
275 			data->phase2_eap_types[i].method;
276 		wpa_printf(MSG_DEBUG, "EAP-TTLS: Selected "
277 			   "Phase 2 EAP vendor %d method %d",
278 			   data->phase2_eap_type.vendor,
279 			   data->phase2_eap_type.method);
280 		break;
281 	}
282 }
283 
284 
285 static int eap_ttls_phase2_eap_process(struct eap_sm *sm,
286 				       struct eap_ttls_data *data,
287 				       struct eap_method_ret *ret,
288 				       struct eap_hdr *hdr, size_t len,
289 				       struct wpabuf **resp)
290 {
291 	struct wpabuf msg;
292 	struct eap_method_ret iret;
293 
294 	os_memset(&iret, 0, sizeof(iret));
295 	wpabuf_set(&msg, hdr, len);
296 	*resp = data->phase2_method->process(sm, data->phase2_priv, &iret,
297 					     &msg);
298 	if ((iret.methodState == METHOD_DONE ||
299 	     iret.methodState == METHOD_MAY_CONT) &&
300 	    (iret.decision == DECISION_UNCOND_SUCC ||
301 	     iret.decision == DECISION_COND_SUCC ||
302 	     iret.decision == DECISION_FAIL)) {
303 		ret->methodState = iret.methodState;
304 		ret->decision = iret.decision;
305 	}
306 
307 	return 0;
308 }
309 
310 
311 static int eap_ttls_phase2_request_eap_method(struct eap_sm *sm,
312 					      struct eap_ttls_data *data,
313 					      struct eap_method_ret *ret,
314 					      struct eap_hdr *hdr, size_t len,
315 					      u8 method, struct wpabuf **resp)
316 {
317 #ifdef EAP_TNC
318 	if (data->tnc_started && data->phase2_method &&
319 	    data->phase2_priv && method == EAP_TYPE_TNC &&
320 	    data->phase2_eap_type.method == EAP_TYPE_TNC)
321 		return eap_ttls_phase2_eap_process(sm, data, ret, hdr, len,
322 						   resp);
323 
324 	if (data->ready_for_tnc && !data->tnc_started &&
325 	    method == EAP_TYPE_TNC) {
326 		wpa_printf(MSG_DEBUG, "EAP-TTLS: Start TNC after completed "
327 			   "EAP method");
328 		data->tnc_started = 1;
329 	}
330 
331 	if (data->tnc_started) {
332 		if (data->phase2_eap_type.vendor != EAP_VENDOR_IETF ||
333 		    data->phase2_eap_type.method == EAP_TYPE_TNC) {
334 			wpa_printf(MSG_DEBUG, "EAP-TTLS: Unexpected EAP "
335 				   "type %d for TNC", method);
336 			return -1;
337 		}
338 
339 		data->phase2_eap_type.vendor = EAP_VENDOR_IETF;
340 		data->phase2_eap_type.method = method;
341 		wpa_printf(MSG_DEBUG, "EAP-TTLS: Selected "
342 			   "Phase 2 EAP vendor %d method %d (TNC)",
343 			   data->phase2_eap_type.vendor,
344 			   data->phase2_eap_type.method);
345 
346 		if (data->phase2_type == EAP_TTLS_PHASE2_EAP)
347 			eap_ttls_phase2_eap_deinit(sm, data);
348 	}
349 #endif /* EAP_TNC */
350 
351 	if (data->phase2_eap_type.vendor == EAP_VENDOR_IETF &&
352 	    data->phase2_eap_type.method == EAP_TYPE_NONE)
353 		eap_ttls_phase2_select_eap_method(data, method);
354 
355 	if (method != data->phase2_eap_type.method || method == EAP_TYPE_NONE)
356 	{
357 		if (eap_peer_tls_phase2_nak(data->phase2_eap_types,
358 					    data->num_phase2_eap_types,
359 					    hdr, resp))
360 			return -1;
361 		return 0;
362 	}
363 
364 	if (data->phase2_priv == NULL) {
365 		data->phase2_method = eap_peer_get_eap_method(
366 			EAP_VENDOR_IETF, method);
367 		if (data->phase2_method) {
368 			sm->init_phase2 = 1;
369 			data->phase2_priv = data->phase2_method->init(sm);
370 			sm->init_phase2 = 0;
371 		}
372 	}
373 	if (data->phase2_priv == NULL || data->phase2_method == NULL) {
374 		wpa_printf(MSG_INFO, "EAP-TTLS: failed to initialize "
375 			   "Phase 2 EAP method %d", method);
376 		return -1;
377 	}
378 
379 	return eap_ttls_phase2_eap_process(sm, data, ret, hdr, len, resp);
380 }
381 
382 
383 static int eap_ttls_phase2_request_eap(struct eap_sm *sm,
384 				       struct eap_ttls_data *data,
385 				       struct eap_method_ret *ret,
386 				       struct eap_hdr *hdr,
387 				       struct wpabuf **resp)
388 {
389 	size_t len = be_to_host16(hdr->length);
390 	u8 *pos;
391 	struct eap_peer_config *config = eap_get_config(sm);
392 
393 	if (len <= sizeof(struct eap_hdr)) {
394 		wpa_printf(MSG_INFO, "EAP-TTLS: too short "
395 			   "Phase 2 request (len=%lu)", (unsigned long) len);
396 		return -1;
397 	}
398 	pos = (u8 *) (hdr + 1);
399 	wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 EAP Request: type=%d", *pos);
400 	switch (*pos) {
401 	case EAP_TYPE_IDENTITY:
402 		*resp = eap_sm_buildIdentity(sm, hdr->identifier, 1);
403 		break;
404 	default:
405 		if (eap_ttls_phase2_request_eap_method(sm, data, ret, hdr, len,
406 						       *pos, resp) < 0)
407 			return -1;
408 		break;
409 	}
410 
411 	if (*resp == NULL &&
412 	    (config->pending_req_identity || config->pending_req_password ||
413 	     config->pending_req_otp)) {
414 		return 0;
415 	}
416 
417 	if (*resp == NULL)
418 		return -1;
419 
420 	wpa_hexdump_buf(MSG_DEBUG, "EAP-TTLS: AVP encapsulate EAP Response",
421 			*resp);
422 	return eap_ttls_avp_encapsulate(resp, RADIUS_ATTR_EAP_MESSAGE, 1);
423 }
424 
425 
426 static int eap_ttls_phase2_request_mschapv2(struct eap_sm *sm,
427 					    struct eap_ttls_data *data,
428 					    struct eap_method_ret *ret,
429 					    struct wpabuf **resp)
430 {
431 #ifdef EAP_MSCHAPv2
432 	struct wpabuf *msg;
433 	u8 *buf, *pos, *challenge, *peer_challenge;
434 	const u8 *identity, *password;
435 	size_t identity_len, password_len;
436 	int pwhash;
437 
438 	wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 MSCHAPV2 Request");
439 
440 	identity = eap_get_config_identity(sm, &identity_len);
441 	password = eap_get_config_password2(sm, &password_len, &pwhash);
442 	if (identity == NULL || password == NULL)
443 		return -1;
444 
445 	msg = wpabuf_alloc(identity_len + 1000);
446 	if (msg == NULL) {
447 		wpa_printf(MSG_ERROR,
448 			   "EAP-TTLS/MSCHAPV2: Failed to allocate memory");
449 		return -1;
450 	}
451 	pos = buf = wpabuf_mhead(msg);
452 
453 	/* User-Name */
454 	pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,
455 			       identity, identity_len);
456 
457 	/* MS-CHAP-Challenge */
458 	challenge = eap_ttls_implicit_challenge(
459 		sm, data, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN + 1);
460 	if (challenge == NULL) {
461 		wpabuf_free(msg);
462 		wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAPV2: Failed to derive "
463 			   "implicit challenge");
464 		return -1;
465 	}
466 
467 	pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_MS_CHAP_CHALLENGE,
468 			       RADIUS_VENDOR_ID_MICROSOFT, 1,
469 			       challenge, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN);
470 
471 	/* MS-CHAP2-Response */
472 	pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP2_RESPONSE,
473 			       RADIUS_VENDOR_ID_MICROSOFT, 1,
474 			       EAP_TTLS_MSCHAPV2_RESPONSE_LEN);
475 	data->ident = challenge[EAP_TTLS_MSCHAPV2_CHALLENGE_LEN];
476 	*pos++ = data->ident;
477 	*pos++ = 0; /* Flags */
478 	if (os_get_random(pos, EAP_TTLS_MSCHAPV2_CHALLENGE_LEN) < 0) {
479 		os_free(challenge);
480 		wpabuf_free(msg);
481 		wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAPV2: Failed to get "
482 			   "random data for peer challenge");
483 		return -1;
484 	}
485 	peer_challenge = pos;
486 	pos += EAP_TTLS_MSCHAPV2_CHALLENGE_LEN;
487 	os_memset(pos, 0, 8); /* Reserved, must be zero */
488 	pos += 8;
489 	if (mschapv2_derive_response(identity, identity_len, password,
490 				     password_len, pwhash, challenge,
491 				     peer_challenge, pos, data->auth_response,
492 				     data->master_key)) {
493 		os_free(challenge);
494 		wpabuf_free(msg);
495 		wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAPV2: Failed to derive "
496 			   "response");
497 		return -1;
498 	}
499 	data->auth_response_valid = 1;
500 
501 	pos += 24;
502 	os_free(challenge);
503 	AVP_PAD(buf, pos);
504 
505 	wpabuf_put(msg, pos - buf);
506 	*resp = msg;
507 
508 	return 0;
509 #else /* EAP_MSCHAPv2 */
510 	wpa_printf(MSG_ERROR, "EAP-TTLS: MSCHAPv2 not included in the build");
511 	return -1;
512 #endif /* EAP_MSCHAPv2 */
513 }
514 
515 
516 static int eap_ttls_phase2_request_mschap(struct eap_sm *sm,
517 					  struct eap_ttls_data *data,
518 					  struct eap_method_ret *ret,
519 					  struct wpabuf **resp)
520 {
521 	struct wpabuf *msg;
522 	u8 *buf, *pos, *challenge;
523 	const u8 *identity, *password;
524 	size_t identity_len, password_len;
525 	int pwhash;
526 
527 	wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 MSCHAP Request");
528 
529 	identity = eap_get_config_identity(sm, &identity_len);
530 	password = eap_get_config_password2(sm, &password_len, &pwhash);
531 	if (identity == NULL || password == NULL)
532 		return -1;
533 
534 	msg = wpabuf_alloc(identity_len + 1000);
535 	if (msg == NULL) {
536 		wpa_printf(MSG_ERROR,
537 			   "EAP-TTLS/MSCHAP: Failed to allocate memory");
538 		return -1;
539 	}
540 	pos = buf = wpabuf_mhead(msg);
541 
542 	/* User-Name */
543 	pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,
544 			       identity, identity_len);
545 
546 	/* MS-CHAP-Challenge */
547 	challenge = eap_ttls_implicit_challenge(
548 		sm, data, EAP_TTLS_MSCHAP_CHALLENGE_LEN + 1);
549 	if (challenge == NULL) {
550 		wpabuf_free(msg);
551 		wpa_printf(MSG_ERROR, "EAP-TTLS/MSCHAP: Failed to derive "
552 			   "implicit challenge");
553 		return -1;
554 	}
555 
556 	pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_MS_CHAP_CHALLENGE,
557 			       RADIUS_VENDOR_ID_MICROSOFT, 1,
558 			       challenge, EAP_TTLS_MSCHAP_CHALLENGE_LEN);
559 
560 	/* MS-CHAP-Response */
561 	pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_MS_CHAP_RESPONSE,
562 			       RADIUS_VENDOR_ID_MICROSOFT, 1,
563 			       EAP_TTLS_MSCHAP_RESPONSE_LEN);
564 	data->ident = challenge[EAP_TTLS_MSCHAP_CHALLENGE_LEN];
565 	*pos++ = data->ident;
566 	*pos++ = 1; /* Flags: Use NT style passwords */
567 	os_memset(pos, 0, 24); /* LM-Response */
568 	pos += 24;
569 	if (pwhash) {
570 		challenge_response(challenge, password, pos); /* NT-Response */
571 		wpa_hexdump_key(MSG_DEBUG, "EAP-TTLS: MSCHAP password hash",
572 				password, 16);
573 	} else {
574 		nt_challenge_response(challenge, password, password_len,
575 				      pos); /* NT-Response */
576 		wpa_hexdump_ascii_key(MSG_DEBUG, "EAP-TTLS: MSCHAP password",
577 				      password, password_len);
578 	}
579 	wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAP implicit challenge",
580 		    challenge, EAP_TTLS_MSCHAP_CHALLENGE_LEN);
581 	wpa_hexdump(MSG_DEBUG, "EAP-TTLS: MSCHAP response", pos, 24);
582 	pos += 24;
583 	os_free(challenge);
584 	AVP_PAD(buf, pos);
585 
586 	wpabuf_put(msg, pos - buf);
587 	*resp = msg;
588 
589 	/* EAP-TTLS/MSCHAP does not provide tunneled success
590 	 * notification, so assume that Phase2 succeeds. */
591 	ret->methodState = METHOD_DONE;
592 	ret->decision = DECISION_COND_SUCC;
593 
594 	return 0;
595 }
596 
597 
598 static int eap_ttls_phase2_request_pap(struct eap_sm *sm,
599 				       struct eap_ttls_data *data,
600 				       struct eap_method_ret *ret,
601 				       struct wpabuf **resp)
602 {
603 	struct wpabuf *msg;
604 	u8 *buf, *pos;
605 	size_t pad;
606 	const u8 *identity, *password;
607 	size_t identity_len, password_len;
608 
609 	wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 PAP Request");
610 
611 	identity = eap_get_config_identity(sm, &identity_len);
612 	password = eap_get_config_password(sm, &password_len);
613 	if (identity == NULL || password == NULL)
614 		return -1;
615 
616 	msg = wpabuf_alloc(identity_len + password_len + 100);
617 	if (msg == NULL) {
618 		wpa_printf(MSG_ERROR,
619 			   "EAP-TTLS/PAP: Failed to allocate memory");
620 		return -1;
621 	}
622 	pos = buf = wpabuf_mhead(msg);
623 
624 	/* User-Name */
625 	pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,
626 			       identity, identity_len);
627 
628 	/* User-Password; in RADIUS, this is encrypted, but EAP-TTLS encrypts
629 	 * the data, so no separate encryption is used in the AVP itself.
630 	 * However, the password is padded to obfuscate its length. */
631 	pad = password_len == 0 ? 16 : (16 - (password_len & 15)) & 15;
632 	pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_USER_PASSWORD, 0, 1,
633 			       password_len + pad);
634 	os_memcpy(pos, password, password_len);
635 	pos += password_len;
636 	os_memset(pos, 0, pad);
637 	pos += pad;
638 	AVP_PAD(buf, pos);
639 
640 	wpabuf_put(msg, pos - buf);
641 	*resp = msg;
642 
643 	/* EAP-TTLS/PAP does not provide tunneled success notification,
644 	 * so assume that Phase2 succeeds. */
645 	ret->methodState = METHOD_DONE;
646 	ret->decision = DECISION_COND_SUCC;
647 
648 	return 0;
649 }
650 
651 
652 static int eap_ttls_phase2_request_chap(struct eap_sm *sm,
653 					struct eap_ttls_data *data,
654 					struct eap_method_ret *ret,
655 					struct wpabuf **resp)
656 {
657 	struct wpabuf *msg;
658 	u8 *buf, *pos, *challenge;
659 	const u8 *identity, *password;
660 	size_t identity_len, password_len;
661 
662 	wpa_printf(MSG_DEBUG, "EAP-TTLS: Phase 2 CHAP Request");
663 
664 	identity = eap_get_config_identity(sm, &identity_len);
665 	password = eap_get_config_password(sm, &password_len);
666 	if (identity == NULL || password == NULL)
667 		return -1;
668 
669 	msg = wpabuf_alloc(identity_len + 1000);
670 	if (msg == NULL) {
671 		wpa_printf(MSG_ERROR,
672 			   "EAP-TTLS/CHAP: Failed to allocate memory");
673 		return -1;
674 	}
675 	pos = buf = wpabuf_mhead(msg);
676 
677 	/* User-Name */
678 	pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_USER_NAME, 0, 1,
679 			       identity, identity_len);
680 
681 	/* CHAP-Challenge */
682 	challenge = eap_ttls_implicit_challenge(
683 		sm, data, EAP_TTLS_CHAP_CHALLENGE_LEN + 1);
684 	if (challenge == NULL) {
685 		wpabuf_free(msg);
686 		wpa_printf(MSG_ERROR, "EAP-TTLS/CHAP: Failed to derive "
687 			   "implicit challenge");
688 		return -1;
689 	}
690 
691 	pos = eap_ttls_avp_add(buf, pos, RADIUS_ATTR_CHAP_CHALLENGE, 0, 1,
692 			       challenge, EAP_TTLS_CHAP_CHALLENGE_LEN);
693 
694 	/* CHAP-Password */
695 	pos = eap_ttls_avp_hdr(pos, RADIUS_ATTR_CHAP_PASSWORD, 0, 1,
696 			       1 + EAP_TTLS_CHAP_PASSWORD_LEN);
697 	data->ident = challenge[EAP_TTLS_CHAP_CHALLENGE_LEN];
698 	*pos++ = data->ident;
699 
700 	/* MD5(Ident + Password + Challenge) */
701 	chap_md5(data->ident, password, password_len, challenge,
702 		 EAP_TTLS_CHAP_CHALLENGE_LEN, pos);
703 
704 	wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: CHAP username",
705 			  identity, identity_len);
706 	wpa_hexdump_ascii_key(MSG_DEBUG, "EAP-TTLS: CHAP password",
707 			      password, password_len);
708 	wpa_hexdump(MSG_DEBUG, "EAP-TTLS: CHAP implicit challenge",
709 		    challenge, EAP_TTLS_CHAP_CHALLENGE_LEN);
710 	wpa_hexdump(MSG_DEBUG, "EAP-TTLS: CHAP password",
711 		    pos, EAP_TTLS_CHAP_PASSWORD_LEN);
712 	pos += EAP_TTLS_CHAP_PASSWORD_LEN;
713 	os_free(challenge);
714 	AVP_PAD(buf, pos);
715 
716 	wpabuf_put(msg, pos - buf);
717 	*resp = msg;
718 
719 	/* EAP-TTLS/CHAP does not provide tunneled success
720 	 * notification, so assume that Phase2 succeeds. */
721 	ret->methodState = METHOD_DONE;
722 	ret->decision = DECISION_COND_SUCC;
723 
724 	return 0;
725 }
726 
727 
728 static int eap_ttls_phase2_request(struct eap_sm *sm,
729 				   struct eap_ttls_data *data,
730 				   struct eap_method_ret *ret,
731 				   struct eap_hdr *hdr,
732 				   struct wpabuf **resp)
733 {
734 	int res = 0;
735 	size_t len;
736 	enum phase2_types phase2_type = data->phase2_type;
737 
738 #ifdef EAP_TNC
739 	if (data->tnc_started) {
740 		wpa_printf(MSG_DEBUG, "EAP-TTLS: Processing TNC");
741 		phase2_type = EAP_TTLS_PHASE2_EAP;
742 	}
743 #endif /* EAP_TNC */
744 
745 	if (phase2_type == EAP_TTLS_PHASE2_MSCHAPV2 ||
746 	    phase2_type == EAP_TTLS_PHASE2_MSCHAP ||
747 	    phase2_type == EAP_TTLS_PHASE2_PAP ||
748 	    phase2_type == EAP_TTLS_PHASE2_CHAP) {
749 		if (eap_get_config_identity(sm, &len) == NULL) {
750 			wpa_printf(MSG_INFO,
751 				   "EAP-TTLS: Identity not configured");
752 			eap_sm_request_identity(sm);
753 			if (eap_get_config_password(sm, &len) == NULL)
754 				eap_sm_request_password(sm);
755 			return 0;
756 		}
757 
758 		if (eap_get_config_password(sm, &len) == NULL) {
759 			wpa_printf(MSG_INFO,
760 				   "EAP-TTLS: Password not configured");
761 			eap_sm_request_password(sm);
762 			return 0;
763 		}
764 	}
765 
766 	switch (phase2_type) {
767 	case EAP_TTLS_PHASE2_EAP:
768 		res = eap_ttls_phase2_request_eap(sm, data, ret, hdr, resp);
769 		break;
770 	case EAP_TTLS_PHASE2_MSCHAPV2:
771 		res = eap_ttls_phase2_request_mschapv2(sm, data, ret, resp);
772 		break;
773 	case EAP_TTLS_PHASE2_MSCHAP:
774 		res = eap_ttls_phase2_request_mschap(sm, data, ret, resp);
775 		break;
776 	case EAP_TTLS_PHASE2_PAP:
777 		res = eap_ttls_phase2_request_pap(sm, data, ret, resp);
778 		break;
779 	case EAP_TTLS_PHASE2_CHAP:
780 		res = eap_ttls_phase2_request_chap(sm, data, ret, resp);
781 		break;
782 	default:
783 		wpa_printf(MSG_ERROR, "EAP-TTLS: Phase 2 - Unknown");
784 		res = -1;
785 		break;
786 	}
787 
788 	if (res < 0) {
789 		ret->methodState = METHOD_DONE;
790 		ret->decision = DECISION_FAIL;
791 	}
792 
793 	return res;
794 }
795 
796 
797 struct ttls_parse_avp {
798 	u8 *mschapv2;
799 	u8 *eapdata;
800 	size_t eap_len;
801 	int mschapv2_error;
802 };
803 
804 
805 static int eap_ttls_parse_attr_eap(const u8 *dpos, size_t dlen,
806 				   struct ttls_parse_avp *parse)
807 {
808 	wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP - EAP Message");
809 	if (parse->eapdata == NULL) {
810 		parse->eapdata = os_malloc(dlen);
811 		if (parse->eapdata == NULL) {
812 			wpa_printf(MSG_WARNING, "EAP-TTLS: Failed to allocate "
813 				   "memory for Phase 2 EAP data");
814 			return -1;
815 		}
816 		os_memcpy(parse->eapdata, dpos, dlen);
817 		parse->eap_len = dlen;
818 	} else {
819 		u8 *neweap = os_realloc(parse->eapdata, parse->eap_len + dlen);
820 		if (neweap == NULL) {
821 			wpa_printf(MSG_WARNING, "EAP-TTLS: Failed to allocate "
822 				   "memory for Phase 2 EAP data");
823 			return -1;
824 		}
825 		os_memcpy(neweap + parse->eap_len, dpos, dlen);
826 		parse->eapdata = neweap;
827 		parse->eap_len += dlen;
828 	}
829 
830 	return 0;
831 }
832 
833 
834 static int eap_ttls_parse_avp(u8 *pos, size_t left,
835 			      struct ttls_parse_avp *parse)
836 {
837 	struct ttls_avp *avp;
838 	u32 avp_code, avp_length, vendor_id = 0;
839 	u8 avp_flags, *dpos;
840 	size_t dlen;
841 
842 	avp = (struct ttls_avp *) pos;
843 	avp_code = be_to_host32(avp->avp_code);
844 	avp_length = be_to_host32(avp->avp_length);
845 	avp_flags = (avp_length >> 24) & 0xff;
846 	avp_length &= 0xffffff;
847 	wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP: code=%d flags=0x%02x "
848 		   "length=%d", (int) avp_code, avp_flags,
849 		   (int) avp_length);
850 
851 	if (avp_length > left) {
852 		wpa_printf(MSG_WARNING, "EAP-TTLS: AVP overflow "
853 			   "(len=%d, left=%lu) - dropped",
854 			   (int) avp_length, (unsigned long) left);
855 		return -1;
856 	}
857 
858 	if (avp_length < sizeof(*avp)) {
859 		wpa_printf(MSG_WARNING, "EAP-TTLS: Invalid AVP length %d",
860 			   avp_length);
861 		return -1;
862 	}
863 
864 	dpos = (u8 *) (avp + 1);
865 	dlen = avp_length - sizeof(*avp);
866 	if (avp_flags & AVP_FLAGS_VENDOR) {
867 		if (dlen < 4) {
868 			wpa_printf(MSG_WARNING, "EAP-TTLS: Vendor AVP "
869 				   "underflow");
870 			return -1;
871 		}
872 		vendor_id = WPA_GET_BE32(dpos);
873 		wpa_printf(MSG_DEBUG, "EAP-TTLS: AVP vendor_id %d",
874 			   (int) vendor_id);
875 		dpos += 4;
876 		dlen -= 4;
877 	}
878 
879 	wpa_hexdump(MSG_DEBUG, "EAP-TTLS: AVP data", dpos, dlen);
880 
881 	if (vendor_id == 0 && avp_code == RADIUS_ATTR_EAP_MESSAGE) {
882 		if (eap_ttls_parse_attr_eap(dpos, dlen, parse) < 0)
883 			return -1;
884 	} else if (vendor_id == 0 && avp_code == RADIUS_ATTR_REPLY_MESSAGE) {
885 		/* This is an optional message that can be displayed to
886 		 * the user. */
887 		wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: AVP - Reply-Message",
888 				  dpos, dlen);
889 	} else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT &&
890 		   avp_code == RADIUS_ATTR_MS_CHAP2_SUCCESS) {
891 		wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: MS-CHAP2-Success",
892 				  dpos, dlen);
893 		if (dlen != 43) {
894 			wpa_printf(MSG_WARNING, "EAP-TTLS: Unexpected "
895 				   "MS-CHAP2-Success length "
896 				   "(len=%lu, expected 43)",
897 				   (unsigned long) dlen);
898 			return -1;
899 		}
900 		parse->mschapv2 = dpos;
901 	} else if (vendor_id == RADIUS_VENDOR_ID_MICROSOFT &&
902 		   avp_code == RADIUS_ATTR_MS_CHAP_ERROR) {
903 		wpa_hexdump_ascii(MSG_DEBUG, "EAP-TTLS: MS-CHAP-Error",
904 				  dpos, dlen);
905 		parse->mschapv2_error = 1;
906 	} else if (avp_flags & AVP_FLAGS_MANDATORY) {
907 		wpa_printf(MSG_WARNING, "EAP-TTLS: Unsupported mandatory AVP "
908 			   "code %d vendor_id %d - dropped",
909 			   (int) avp_code, (int) vendor_id);
910 		return -1;
911 	} else {
912 		wpa_printf(MSG_DEBUG, "EAP-TTLS: Ignoring unsupported AVP "
913 			   "code %d vendor_id %d",
914 			   (int) avp_code, (int) vendor_id);
915 	}
916 
917 	return avp_length;
918 }
919 
920 
921 static int eap_ttls_parse_avps(struct wpabuf *in_decrypted,
922 			       struct ttls_parse_avp *parse)
923 {
924 	u8 *pos;
925 	size_t left, pad;
926 	int avp_length;
927 
928 	pos = wpabuf_mhead(in_decrypted);
929 	left = wpabuf_len(in_decrypted);
930 	wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Decrypted Phase 2 AVPs", pos, left);
931 	if (left < sizeof(struct ttls_avp)) {
932 		wpa_printf(MSG_WARNING, "EAP-TTLS: Too short Phase 2 AVP frame"
933 			   " len=%lu expected %lu or more - dropped",
934 			   (unsigned long) left,
935 			   (unsigned long) sizeof(struct ttls_avp));
936 		return -1;
937 	}
938 
939 	/* Parse AVPs */
940 	os_memset(parse, 0, sizeof(*parse));
941 
942 	while (left > 0) {
943 		avp_length = eap_ttls_parse_avp(pos, left, parse);
944 		if (avp_length < 0)
945 			return -1;
946 
947 		pad = (4 - (avp_length & 3)) & 3;
948 		pos += avp_length + pad;
949 		if (left < avp_length + pad)
950 			left = 0;
951 		else
952 			left -= avp_length + pad;
953 	}
954 
955 	return 0;
956 }
957 
958 
959 static u8 * eap_ttls_fake_identity_request(void)
960 {
961 	struct eap_hdr *hdr;
962 	u8 *buf;
963 
964 	wpa_printf(MSG_DEBUG, "EAP-TTLS: empty data in beginning of "
965 		   "Phase 2 - use fake EAP-Request Identity");
966 	buf = os_malloc(sizeof(*hdr) + 1);
967 	if (buf == NULL) {
968 		wpa_printf(MSG_WARNING, "EAP-TTLS: failed to allocate "
969 			   "memory for fake EAP-Identity Request");
970 		return NULL;
971 	}
972 
973 	hdr = (struct eap_hdr *) buf;
974 	hdr->code = EAP_CODE_REQUEST;
975 	hdr->identifier = 0;
976 	hdr->length = host_to_be16(sizeof(*hdr) + 1);
977 	buf[sizeof(*hdr)] = EAP_TYPE_IDENTITY;
978 
979 	return buf;
980 }
981 
982 
983 static int eap_ttls_encrypt_response(struct eap_sm *sm,
984 				     struct eap_ttls_data *data,
985 				     struct wpabuf *resp, u8 identifier,
986 				     struct wpabuf **out_data)
987 {
988 	if (resp == NULL)
989 		return 0;
990 
991 	wpa_hexdump_buf_key(MSG_DEBUG, "EAP-TTLS: Encrypting Phase 2 data",
992 			    resp);
993 	if (eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_TTLS,
994 				 data->ttls_version, identifier,
995 				 resp, out_data)) {
996 		wpa_printf(MSG_INFO, "EAP-TTLS: Failed to encrypt a Phase 2 "
997 			   "frame");
998 		wpabuf_free(resp);
999 		return -1;
1000 	}
1001 	wpabuf_free(resp);
1002 
1003 	return 0;
1004 }
1005 
1006 
1007 static int eap_ttls_process_phase2_eap(struct eap_sm *sm,
1008 				       struct eap_ttls_data *data,
1009 				       struct eap_method_ret *ret,
1010 				       struct ttls_parse_avp *parse,
1011 				       struct wpabuf **resp)
1012 {
1013 	struct eap_hdr *hdr;
1014 	size_t len;
1015 
1016 	if (parse->eapdata == NULL) {
1017 		wpa_printf(MSG_WARNING, "EAP-TTLS: No EAP Message in the "
1018 			   "packet - dropped");
1019 		return -1;
1020 	}
1021 
1022 	wpa_hexdump(MSG_DEBUG, "EAP-TTLS: Phase 2 EAP",
1023 		    parse->eapdata, parse->eap_len);
1024 	hdr = (struct eap_hdr *) parse->eapdata;
1025 
1026 	if (parse->eap_len < sizeof(*hdr)) {
1027 		wpa_printf(MSG_WARNING, "EAP-TTLS: Too short Phase 2 EAP "
1028 			   "frame (len=%lu, expected %lu or more) - dropped",
1029 			   (unsigned long) parse->eap_len,
1030 			   (unsigned long) sizeof(*hdr));
1031 		return -1;
1032 	}
1033 	len = be_to_host16(hdr->length);
1034 	if (len > parse->eap_len) {
1035 		wpa_printf(MSG_INFO, "EAP-TTLS: Length mismatch in Phase 2 "
1036 			   "EAP frame (EAP hdr len=%lu, EAP data len in "
1037 			   "AVP=%lu)",
1038 			   (unsigned long) len,
1039 			   (unsigned long) parse->eap_len);
1040 		return -1;
1041 	}
1042 	wpa_printf(MSG_DEBUG, "EAP-TTLS: received Phase 2: code=%d "
1043 		   "identifier=%d length=%lu",
1044 		   hdr->code, hdr->identifier, (unsigned long) len);
1045 	switch (hdr->code) {
1046 	case EAP_CODE_REQUEST:
1047 		if (eap_ttls_phase2_request(sm, data, ret, hdr, resp)) {
1048 			wpa_printf(MSG_INFO, "EAP-TTLS: Phase2 Request "
1049 				   "processing failed");
1050 			return -1;
1051 		}
1052 		break;
1053 	default:
1054 		wpa_printf(MSG_INFO, "EAP-TTLS: Unexpected code=%d in "
1055 			   "Phase 2 EAP header", hdr->code);
1056 		return -1;
1057 	}
1058 
1059 	return 0;
1060 }
1061 
1062 
1063 static int eap_ttls_process_phase2_mschapv2(struct eap_sm *sm,
1064 					    struct eap_ttls_data *data,
1065 					    struct eap_method_ret *ret,
1066 					    struct ttls_parse_avp *parse)
1067 {
1068 #ifdef EAP_MSCHAPv2
1069 	if (parse->mschapv2_error) {
1070 		wpa_printf(MSG_DEBUG, "EAP-TTLS/MSCHAPV2: Received "
1071 			   "MS-CHAP-Error - failed");
1072 		ret->methodState = METHOD_DONE;
1073 		ret->decision = DECISION_FAIL;
1074 		/* Reply with empty data to ACK error */
1075 		return 1;
1076 	}
1077 
1078 	if (parse->mschapv2 == NULL) {
1079 #ifdef EAP_TNC
1080 		if (data->phase2_success && parse->eapdata) {
1081 			/*
1082 			 * Allow EAP-TNC to be started after successfully
1083 			 * completed MSCHAPV2.
1084 			 */
1085 			return 1;
1086 		}
1087 #endif /* EAP_TNC */
1088 		wpa_printf(MSG_WARNING, "EAP-TTLS: no MS-CHAP2-Success AVP "
1089 			   "received for Phase2 MSCHAPV2");
1090 		return -1;
1091 	}
1092 	if (parse->mschapv2[0] != data->ident) {
1093 		wpa_printf(MSG_WARNING, "EAP-TTLS: Ident mismatch for Phase 2 "
1094 			   "MSCHAPV2 (received Ident 0x%02x, expected 0x%02x)",
1095 			   parse->mschapv2[0], data->ident);
1096 		return -1;
1097 	}
1098 	if (!data->auth_response_valid ||
1099 	    mschapv2_verify_auth_response(data->auth_response,
1100 					  parse->mschapv2 + 1, 42)) {
1101 		wpa_printf(MSG_WARNING, "EAP-TTLS: Invalid authenticator "
1102 			   "response in Phase 2 MSCHAPV2 success request");
1103 		return -1;
1104 	}
1105 
1106 	wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 MSCHAPV2 "
1107 		   "authentication succeeded");
1108 	ret->methodState = METHOD_DONE;
1109 	ret->decision = DECISION_UNCOND_SUCC;
1110 	data->phase2_success = 1;
1111 
1112 	/*
1113 	 * Reply with empty data; authentication server will reply
1114 	 * with EAP-Success after this.
1115 	 */
1116 	return 1;
1117 #else /* EAP_MSCHAPv2 */
1118 	wpa_printf(MSG_ERROR, "EAP-TTLS: MSCHAPv2 not included in the build");
1119 	return -1;
1120 #endif /* EAP_MSCHAPv2 */
1121 }
1122 
1123 
1124 #ifdef EAP_TNC
1125 static int eap_ttls_process_tnc_start(struct eap_sm *sm,
1126 				      struct eap_ttls_data *data,
1127 				      struct eap_method_ret *ret,
1128 				      struct ttls_parse_avp *parse,
1129 				      struct wpabuf **resp)
1130 {
1131 	/* TNC uses inner EAP method after non-EAP TTLS phase 2. */
1132 	if (parse->eapdata == NULL) {
1133 		wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received "
1134 			   "unexpected tunneled data (no EAP)");
1135 		return -1;
1136 	}
1137 
1138 	if (!data->ready_for_tnc) {
1139 		wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received "
1140 			   "EAP after non-EAP, but not ready for TNC");
1141 		return -1;
1142 	}
1143 
1144 	wpa_printf(MSG_DEBUG, "EAP-TTLS: Start TNC after completed "
1145 		   "non-EAP method");
1146 	data->tnc_started = 1;
1147 
1148 	if (eap_ttls_process_phase2_eap(sm, data, ret, parse, resp) < 0)
1149 		return -1;
1150 
1151 	return 0;
1152 }
1153 #endif /* EAP_TNC */
1154 
1155 
1156 static int eap_ttls_process_decrypted(struct eap_sm *sm,
1157 				      struct eap_ttls_data *data,
1158 				      struct eap_method_ret *ret,
1159 				      u8 identifier,
1160 				      struct ttls_parse_avp *parse,
1161 				      struct wpabuf *in_decrypted,
1162 				      struct wpabuf **out_data)
1163 {
1164 	struct wpabuf *resp = NULL;
1165 	struct eap_peer_config *config = eap_get_config(sm);
1166 	int res;
1167 	enum phase2_types phase2_type = data->phase2_type;
1168 
1169 #ifdef EAP_TNC
1170 	if (data->tnc_started)
1171 		phase2_type = EAP_TTLS_PHASE2_EAP;
1172 #endif /* EAP_TNC */
1173 
1174 	switch (phase2_type) {
1175 	case EAP_TTLS_PHASE2_EAP:
1176 		if (eap_ttls_process_phase2_eap(sm, data, ret, parse, &resp) <
1177 		    0)
1178 			return -1;
1179 		break;
1180 	case EAP_TTLS_PHASE2_MSCHAPV2:
1181 		res = eap_ttls_process_phase2_mschapv2(sm, data, ret, parse);
1182 #ifdef EAP_TNC
1183 		if (res == 1 && parse->eapdata && data->phase2_success) {
1184 			/*
1185 			 * TNC may be required as the next
1186 			 * authentication method within the tunnel.
1187 			 */
1188 			ret->methodState = METHOD_MAY_CONT;
1189 			data->ready_for_tnc = 1;
1190 			if (eap_ttls_process_tnc_start(sm, data, ret, parse,
1191 						       &resp) == 0)
1192 				break;
1193 		}
1194 #endif /* EAP_TNC */
1195 		return res;
1196 	case EAP_TTLS_PHASE2_MSCHAP:
1197 	case EAP_TTLS_PHASE2_PAP:
1198 	case EAP_TTLS_PHASE2_CHAP:
1199 #ifdef EAP_TNC
1200 		if (eap_ttls_process_tnc_start(sm, data, ret, parse, &resp) <
1201 		    0)
1202 			return -1;
1203 		break;
1204 #else /* EAP_TNC */
1205 		/* EAP-TTLS/{MSCHAP,PAP,CHAP} should not send any TLS tunneled
1206 		 * requests to the supplicant */
1207 		wpa_printf(MSG_INFO, "EAP-TTLS: Phase 2 received unexpected "
1208 			   "tunneled data");
1209 		return -1;
1210 #endif /* EAP_TNC */
1211 	}
1212 
1213 	if (resp) {
1214 		if (eap_ttls_encrypt_response(sm, data, resp, identifier,
1215 					      out_data) < 0)
1216 			return -1;
1217 	} else if (config->pending_req_identity ||
1218 		   config->pending_req_password ||
1219 		   config->pending_req_otp ||
1220 		   config->pending_req_new_password) {
1221 		wpabuf_free(data->pending_phase2_req);
1222 		data->pending_phase2_req = wpabuf_dup(in_decrypted);
1223 	}
1224 
1225 	return 0;
1226 }
1227 
1228 
1229 static int eap_ttls_implicit_identity_request(struct eap_sm *sm,
1230 					      struct eap_ttls_data *data,
1231 					      struct eap_method_ret *ret,
1232 					      u8 identifier,
1233 					      struct wpabuf **out_data)
1234 {
1235 	int retval = 0;
1236 	struct eap_hdr *hdr;
1237 	struct wpabuf *resp;
1238 
1239 	hdr = (struct eap_hdr *) eap_ttls_fake_identity_request();
1240 	if (hdr == NULL) {
1241 		ret->methodState = METHOD_DONE;
1242 		ret->decision = DECISION_FAIL;
1243 		return -1;
1244 	}
1245 
1246 	resp = NULL;
1247 	if (eap_ttls_phase2_request(sm, data, ret, hdr, &resp)) {
1248 		wpa_printf(MSG_INFO, "EAP-TTLS: Phase2 Request "
1249 			   "processing failed");
1250 		retval = -1;
1251 	} else {
1252 		struct eap_peer_config *config = eap_get_config(sm);
1253 		if (resp == NULL &&
1254 		    (config->pending_req_identity ||
1255 		     config->pending_req_password ||
1256 		     config->pending_req_otp ||
1257 		     config->pending_req_new_password)) {
1258 			/*
1259 			 * Use empty buffer to force implicit request
1260 			 * processing when EAP request is re-processed after
1261 			 * user input.
1262 			 */
1263 			wpabuf_free(data->pending_phase2_req);
1264 			data->pending_phase2_req = wpabuf_alloc(0);
1265 		}
1266 
1267 		retval = eap_ttls_encrypt_response(sm, data, resp, identifier,
1268 						   out_data);
1269 	}
1270 
1271 	os_free(hdr);
1272 
1273 	if (retval < 0) {
1274 		ret->methodState = METHOD_DONE;
1275 		ret->decision = DECISION_FAIL;
1276 	}
1277 
1278 	return retval;
1279 }
1280 
1281 
1282 static int eap_ttls_phase2_start(struct eap_sm *sm, struct eap_ttls_data *data,
1283 				 struct eap_method_ret *ret, u8 identifier,
1284 				 struct wpabuf **out_data)
1285 {
1286 	data->phase2_start = 0;
1287 
1288 	/*
1289 	 * EAP-TTLS does not use Phase2 on fast re-auth; this must be done only
1290 	 * if TLS part was indeed resuming a previous session. Most
1291 	 * Authentication Servers terminate EAP-TTLS before reaching this
1292 	 * point, but some do not. Make wpa_supplicant stop phase 2 here, if
1293 	 * needed.
1294 	 */
1295 	if (data->reauth &&
1296 	    tls_connection_resumed(sm->ssl_ctx, data->ssl.conn)) {
1297 		wpa_printf(MSG_DEBUG, "EAP-TTLS: Session resumption - "
1298 			   "skip phase 2");
1299 		*out_data = eap_peer_tls_build_ack(identifier, EAP_TYPE_TTLS,
1300 						   data->ttls_version);
1301 		ret->methodState = METHOD_DONE;
1302 		ret->decision = DECISION_UNCOND_SUCC;
1303 		data->phase2_success = 1;
1304 		return 0;
1305 	}
1306 
1307 	return eap_ttls_implicit_identity_request(sm, data, ret, identifier,
1308 						  out_data);
1309 }
1310 
1311 
1312 static int eap_ttls_decrypt(struct eap_sm *sm, struct eap_ttls_data *data,
1313 			    struct eap_method_ret *ret, u8 identifier,
1314 			    const struct wpabuf *in_data,
1315 			    struct wpabuf **out_data)
1316 {
1317 	struct wpabuf *in_decrypted = NULL;
1318 	int retval = 0;
1319 	struct ttls_parse_avp parse;
1320 
1321 	os_memset(&parse, 0, sizeof(parse));
1322 
1323 	wpa_printf(MSG_DEBUG, "EAP-TTLS: received %lu bytes encrypted data for"
1324 		   " Phase 2",
1325 		   in_data ? (unsigned long) wpabuf_len(in_data) : 0);
1326 
1327 	if (data->pending_phase2_req) {
1328 		wpa_printf(MSG_DEBUG, "EAP-TTLS: Pending Phase 2 request - "
1329 			   "skip decryption and use old data");
1330 		/* Clear TLS reassembly state. */
1331 		eap_peer_tls_reset_input(&data->ssl);
1332 
1333 		in_decrypted = data->pending_phase2_req;
1334 		data->pending_phase2_req = NULL;
1335 		if (wpabuf_len(in_decrypted) == 0) {
1336 			wpabuf_free(in_decrypted);
1337 			return eap_ttls_implicit_identity_request(
1338 				sm, data, ret, identifier, out_data);
1339 		}
1340 		goto continue_req;
1341 	}
1342 
1343 	if ((in_data == NULL || wpabuf_len(in_data) == 0) &&
1344 	    data->phase2_start) {
1345 		return eap_ttls_phase2_start(sm, data, ret, identifier,
1346 					     out_data);
1347 	}
1348 
1349 	if (in_data == NULL || wpabuf_len(in_data) == 0) {
1350 		/* Received TLS ACK - requesting more fragments */
1351 		return eap_peer_tls_encrypt(sm, &data->ssl, EAP_TYPE_TTLS,
1352 					    data->ttls_version,
1353 					    identifier, NULL, out_data);
1354 	}
1355 
1356 	retval = eap_peer_tls_decrypt(sm, &data->ssl, in_data, &in_decrypted);
1357 	if (retval)
1358 		goto done;
1359 
1360 continue_req:
1361 	data->phase2_start = 0;
1362 
1363 	if (eap_ttls_parse_avps(in_decrypted, &parse) < 0) {
1364 		retval = -1;
1365 		goto done;
1366 	}
1367 
1368 	retval = eap_ttls_process_decrypted(sm, data, ret, identifier,
1369 					    &parse, in_decrypted, out_data);
1370 
1371 done:
1372 	wpabuf_free(in_decrypted);
1373 	os_free(parse.eapdata);
1374 
1375 	if (retval < 0) {
1376 		ret->methodState = METHOD_DONE;
1377 		ret->decision = DECISION_FAIL;
1378 	}
1379 
1380 	return retval;
1381 }
1382 
1383 
1384 static int eap_ttls_process_handshake(struct eap_sm *sm,
1385 				      struct eap_ttls_data *data,
1386 				      struct eap_method_ret *ret,
1387 				      u8 identifier,
1388 				      const u8 *in_data, size_t in_len,
1389 				      struct wpabuf **out_data)
1390 {
1391 	int res;
1392 
1393 	res = eap_peer_tls_process_helper(sm, &data->ssl, EAP_TYPE_TTLS,
1394 					  data->ttls_version, identifier,
1395 					  in_data, in_len, out_data);
1396 
1397 	if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) {
1398 		wpa_printf(MSG_DEBUG, "EAP-TTLS: TLS done, proceed to "
1399 			   "Phase 2");
1400 		if (data->resuming) {
1401 			wpa_printf(MSG_DEBUG, "EAP-TTLS: fast reauth - may "
1402 				   "skip Phase 2");
1403 			ret->decision = DECISION_COND_SUCC;
1404 			ret->methodState = METHOD_MAY_CONT;
1405 		}
1406 		data->phase2_start = 1;
1407 		eap_ttls_v0_derive_key(sm, data);
1408 
1409 		if (*out_data == NULL || wpabuf_len(*out_data) == 0) {
1410 			if (eap_ttls_decrypt(sm, data, ret, identifier,
1411 					     NULL, out_data)) {
1412 				wpa_printf(MSG_WARNING, "EAP-TTLS: "
1413 					   "failed to process early "
1414 					   "start for Phase 2");
1415 			}
1416 			res = 0;
1417 		}
1418 		data->resuming = 0;
1419 	}
1420 
1421 	if (res == 2) {
1422 		struct wpabuf msg;
1423 		/*
1424 		 * Application data included in the handshake message.
1425 		 */
1426 		wpabuf_free(data->pending_phase2_req);
1427 		data->pending_phase2_req = *out_data;
1428 		*out_data = NULL;
1429 		wpabuf_set(&msg, in_data, in_len);
1430 		res = eap_ttls_decrypt(sm, data, ret, identifier, &msg,
1431 				       out_data);
1432 	}
1433 
1434 	return res;
1435 }
1436 
1437 
1438 static void eap_ttls_check_auth_status(struct eap_sm *sm,
1439 				       struct eap_ttls_data *data,
1440 				       struct eap_method_ret *ret)
1441 {
1442 	if (ret->methodState == METHOD_DONE) {
1443 		ret->allowNotifications = FALSE;
1444 		if (ret->decision == DECISION_UNCOND_SUCC ||
1445 		    ret->decision == DECISION_COND_SUCC) {
1446 			wpa_printf(MSG_DEBUG, "EAP-TTLS: Authentication "
1447 				   "completed successfully");
1448 			data->phase2_success = 1;
1449 #ifdef EAP_TNC
1450 			if (!data->ready_for_tnc && !data->tnc_started) {
1451 				/*
1452 				 * TNC may be required as the next
1453 				 * authentication method within the tunnel.
1454 				 */
1455 				ret->methodState = METHOD_MAY_CONT;
1456 				data->ready_for_tnc = 1;
1457 			}
1458 #endif /* EAP_TNC */
1459 		}
1460 	} else if (ret->methodState == METHOD_MAY_CONT &&
1461 		   (ret->decision == DECISION_UNCOND_SUCC ||
1462 		    ret->decision == DECISION_COND_SUCC)) {
1463 			wpa_printf(MSG_DEBUG, "EAP-TTLS: Authentication "
1464 				   "completed successfully (MAY_CONT)");
1465 			data->phase2_success = 1;
1466 	}
1467 }
1468 
1469 
1470 static struct wpabuf * eap_ttls_process(struct eap_sm *sm, void *priv,
1471 					struct eap_method_ret *ret,
1472 					const struct wpabuf *reqData)
1473 {
1474 	size_t left;
1475 	int res;
1476 	u8 flags, id;
1477 	struct wpabuf *resp;
1478 	const u8 *pos;
1479 	struct eap_ttls_data *data = priv;
1480 
1481 	pos = eap_peer_tls_process_init(sm, &data->ssl, EAP_TYPE_TTLS, ret,
1482 					reqData, &left, &flags);
1483 	if (pos == NULL)
1484 		return NULL;
1485 	id = eap_get_id(reqData);
1486 
1487 	if (flags & EAP_TLS_FLAGS_START) {
1488 		wpa_printf(MSG_DEBUG, "EAP-TTLS: Start (server ver=%d, own "
1489 			   "ver=%d)", flags & EAP_TLS_VERSION_MASK,
1490 			   data->ttls_version);
1491 
1492 		/* RFC 5281, Ch. 9.2:
1493 		 * "This packet MAY contain additional information in the form
1494 		 * of AVPs, which may provide useful hints to the client"
1495 		 * For now, ignore any potential extra data.
1496 		 */
1497 		left = 0;
1498 	}
1499 
1500 	resp = NULL;
1501 	if (tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&
1502 	    !data->resuming) {
1503 		struct wpabuf msg;
1504 		wpabuf_set(&msg, pos, left);
1505 		res = eap_ttls_decrypt(sm, data, ret, id, &msg, &resp);
1506 	} else {
1507 		res = eap_ttls_process_handshake(sm, data, ret, id,
1508 						 pos, left, &resp);
1509 	}
1510 
1511 	eap_ttls_check_auth_status(sm, data, ret);
1512 
1513 	/* FIX: what about res == -1? Could just move all error processing into
1514 	 * the other functions and get rid of this res==1 case here. */
1515 	if (res == 1) {
1516 		wpabuf_free(resp);
1517 		return eap_peer_tls_build_ack(id, EAP_TYPE_TTLS,
1518 					      data->ttls_version);
1519 	}
1520 	return resp;
1521 }
1522 
1523 
1524 static Boolean eap_ttls_has_reauth_data(struct eap_sm *sm, void *priv)
1525 {
1526 	struct eap_ttls_data *data = priv;
1527 	return tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&
1528 		data->phase2_success;
1529 }
1530 
1531 
1532 static void eap_ttls_deinit_for_reauth(struct eap_sm *sm, void *priv)
1533 {
1534 	struct eap_ttls_data *data = priv;
1535 	wpabuf_free(data->pending_phase2_req);
1536 	data->pending_phase2_req = NULL;
1537 #ifdef EAP_TNC
1538 	data->ready_for_tnc = 0;
1539 	data->tnc_started = 0;
1540 #endif /* EAP_TNC */
1541 }
1542 
1543 
1544 static void * eap_ttls_init_for_reauth(struct eap_sm *sm, void *priv)
1545 {
1546 	struct eap_ttls_data *data = priv;
1547 	eap_ttls_free_key(data);
1548 	os_free(data->session_id);
1549 	data->session_id = NULL;
1550 	if (eap_peer_tls_reauth_init(sm, &data->ssl)) {
1551 		os_free(data);
1552 		return NULL;
1553 	}
1554 	if (data->phase2_priv && data->phase2_method &&
1555 	    data->phase2_method->init_for_reauth)
1556 		data->phase2_method->init_for_reauth(sm, data->phase2_priv);
1557 	data->phase2_start = 0;
1558 	data->phase2_success = 0;
1559 	data->resuming = 1;
1560 	data->reauth = 1;
1561 	return priv;
1562 }
1563 
1564 
1565 static int eap_ttls_get_status(struct eap_sm *sm, void *priv, char *buf,
1566 			       size_t buflen, int verbose)
1567 {
1568 	struct eap_ttls_data *data = priv;
1569 	int len, ret;
1570 
1571 	len = eap_peer_tls_status(sm, &data->ssl, buf, buflen, verbose);
1572 	ret = os_snprintf(buf + len, buflen - len,
1573 			  "EAP-TTLSv%d Phase2 method=",
1574 			  data->ttls_version);
1575 	if (os_snprintf_error(buflen - len, ret))
1576 		return len;
1577 	len += ret;
1578 	switch (data->phase2_type) {
1579 	case EAP_TTLS_PHASE2_EAP:
1580 		ret = os_snprintf(buf + len, buflen - len, "EAP-%s\n",
1581 				  data->phase2_method ?
1582 				  data->phase2_method->name : "?");
1583 		break;
1584 	case EAP_TTLS_PHASE2_MSCHAPV2:
1585 		ret = os_snprintf(buf + len, buflen - len, "MSCHAPV2\n");
1586 		break;
1587 	case EAP_TTLS_PHASE2_MSCHAP:
1588 		ret = os_snprintf(buf + len, buflen - len, "MSCHAP\n");
1589 		break;
1590 	case EAP_TTLS_PHASE2_PAP:
1591 		ret = os_snprintf(buf + len, buflen - len, "PAP\n");
1592 		break;
1593 	case EAP_TTLS_PHASE2_CHAP:
1594 		ret = os_snprintf(buf + len, buflen - len, "CHAP\n");
1595 		break;
1596 	default:
1597 		ret = 0;
1598 		break;
1599 	}
1600 	if (os_snprintf_error(buflen - len, ret))
1601 		return len;
1602 	len += ret;
1603 
1604 	return len;
1605 }
1606 
1607 
1608 static Boolean eap_ttls_isKeyAvailable(struct eap_sm *sm, void *priv)
1609 {
1610 	struct eap_ttls_data *data = priv;
1611 	return data->key_data != NULL && data->phase2_success;
1612 }
1613 
1614 
1615 static u8 * eap_ttls_getKey(struct eap_sm *sm, void *priv, size_t *len)
1616 {
1617 	struct eap_ttls_data *data = priv;
1618 	u8 *key;
1619 
1620 	if (data->key_data == NULL || !data->phase2_success)
1621 		return NULL;
1622 
1623 	key = os_malloc(EAP_TLS_KEY_LEN);
1624 	if (key == NULL)
1625 		return NULL;
1626 
1627 	*len = EAP_TLS_KEY_LEN;
1628 	os_memcpy(key, data->key_data, EAP_TLS_KEY_LEN);
1629 
1630 	return key;
1631 }
1632 
1633 
1634 static u8 * eap_ttls_get_session_id(struct eap_sm *sm, void *priv, size_t *len)
1635 {
1636 	struct eap_ttls_data *data = priv;
1637 	u8 *id;
1638 
1639 	if (data->session_id == NULL || !data->phase2_success)
1640 		return NULL;
1641 
1642 	id = os_malloc(data->id_len);
1643 	if (id == NULL)
1644 		return NULL;
1645 
1646 	*len = data->id_len;
1647 	os_memcpy(id, data->session_id, data->id_len);
1648 
1649 	return id;
1650 }
1651 
1652 
1653 static u8 * eap_ttls_get_emsk(struct eap_sm *sm, void *priv, size_t *len)
1654 {
1655 	struct eap_ttls_data *data = priv;
1656 	u8 *key;
1657 
1658 	if (data->key_data == NULL)
1659 		return NULL;
1660 
1661 	key = os_malloc(EAP_EMSK_LEN);
1662 	if (key == NULL)
1663 		return NULL;
1664 
1665 	*len = EAP_EMSK_LEN;
1666 	os_memcpy(key, data->key_data + EAP_TLS_KEY_LEN, EAP_EMSK_LEN);
1667 
1668 	return key;
1669 }
1670 
1671 
1672 int eap_peer_ttls_register(void)
1673 {
1674 	struct eap_method *eap;
1675 	int ret;
1676 
1677 	eap = eap_peer_method_alloc(EAP_PEER_METHOD_INTERFACE_VERSION,
1678 				    EAP_VENDOR_IETF, EAP_TYPE_TTLS, "TTLS");
1679 	if (eap == NULL)
1680 		return -1;
1681 
1682 	eap->init = eap_ttls_init;
1683 	eap->deinit = eap_ttls_deinit;
1684 	eap->process = eap_ttls_process;
1685 	eap->isKeyAvailable = eap_ttls_isKeyAvailable;
1686 	eap->getKey = eap_ttls_getKey;
1687 	eap->getSessionId = eap_ttls_get_session_id;
1688 	eap->get_status = eap_ttls_get_status;
1689 	eap->has_reauth_data = eap_ttls_has_reauth_data;
1690 	eap->deinit_for_reauth = eap_ttls_deinit_for_reauth;
1691 	eap->init_for_reauth = eap_ttls_init_for_reauth;
1692 	eap->get_emsk = eap_ttls_get_emsk;
1693 
1694 	ret = eap_peer_method_register(eap);
1695 	if (ret)
1696 		eap_peer_method_free(eap);
1697 	return ret;
1698 }
1699