1 /* 2 * hostapd / EAP-PEAP (draft-josefsson-pppext-eap-tls-eap-10.txt) 3 * Copyright (c) 2004-2008, Jouni Malinen <j@w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "includes.h" 10 11 #include "common.h" 12 #include "crypto/sha1.h" 13 #include "crypto/tls.h" 14 #include "crypto/random.h" 15 #include "eap_i.h" 16 #include "eap_tls_common.h" 17 #include "eap_common/eap_tlv_common.h" 18 #include "eap_common/eap_peap_common.h" 19 #include "tncs.h" 20 21 22 /* Maximum supported PEAP version 23 * 0 = Microsoft's PEAP version 0; draft-kamath-pppext-peapv0-00.txt 24 * 1 = draft-josefsson-ppext-eap-tls-eap-05.txt 25 */ 26 #define EAP_PEAP_VERSION 1 27 28 29 static void eap_peap_reset(struct eap_sm *sm, void *priv); 30 31 32 struct eap_peap_data { 33 struct eap_ssl_data ssl; 34 enum { 35 START, PHASE1, PHASE1_ID2, PHASE2_START, PHASE2_ID, 36 PHASE2_METHOD, PHASE2_SOH, 37 PHASE2_TLV, SUCCESS_REQ, FAILURE_REQ, SUCCESS, FAILURE 38 } state; 39 40 int peap_version; 41 int recv_version; 42 const struct eap_method *phase2_method; 43 void *phase2_priv; 44 int force_version; 45 struct wpabuf *pending_phase2_resp; 46 enum { TLV_REQ_NONE, TLV_REQ_SUCCESS, TLV_REQ_FAILURE } tlv_request; 47 int crypto_binding_sent; 48 int crypto_binding_used; 49 enum { NO_BINDING, OPTIONAL_BINDING, REQUIRE_BINDING } crypto_binding; 50 u8 binding_nonce[32]; 51 u8 ipmk[40]; 52 u8 cmk[20]; 53 u8 *phase2_key; 54 size_t phase2_key_len; 55 struct wpabuf *soh_response; 56 }; 57 58 59 static const char * eap_peap_state_txt(int state) 60 { 61 switch (state) { 62 case START: 63 return "START"; 64 case PHASE1: 65 return "PHASE1"; 66 case PHASE1_ID2: 67 return "PHASE1_ID2"; 68 case PHASE2_START: 69 return "PHASE2_START"; 70 case PHASE2_ID: 71 return "PHASE2_ID"; 72 case PHASE2_METHOD: 73 return "PHASE2_METHOD"; 74 case PHASE2_SOH: 75 return "PHASE2_SOH"; 76 case PHASE2_TLV: 77 return "PHASE2_TLV"; 78 case SUCCESS_REQ: 79 return "SUCCESS_REQ"; 80 case FAILURE_REQ: 81 return "FAILURE_REQ"; 82 case SUCCESS: 83 return "SUCCESS"; 84 case FAILURE: 85 return "FAILURE"; 86 default: 87 return "Unknown?!"; 88 } 89 } 90 91 92 static void eap_peap_state(struct eap_peap_data *data, int state) 93 { 94 wpa_printf(MSG_DEBUG, "EAP-PEAP: %s -> %s", 95 eap_peap_state_txt(data->state), 96 eap_peap_state_txt(state)); 97 data->state = state; 98 } 99 100 101 static void eap_peap_req_success(struct eap_sm *sm, 102 struct eap_peap_data *data) 103 { 104 if (data->state == FAILURE || data->state == FAILURE_REQ) { 105 eap_peap_state(data, FAILURE); 106 return; 107 } 108 109 if (data->peap_version == 0) { 110 data->tlv_request = TLV_REQ_SUCCESS; 111 eap_peap_state(data, PHASE2_TLV); 112 } else { 113 eap_peap_state(data, SUCCESS_REQ); 114 } 115 } 116 117 118 static void eap_peap_req_failure(struct eap_sm *sm, 119 struct eap_peap_data *data) 120 { 121 if (data->state == FAILURE || data->state == FAILURE_REQ || 122 data->state == SUCCESS_REQ || data->tlv_request != TLV_REQ_NONE) { 123 eap_peap_state(data, FAILURE); 124 return; 125 } 126 127 if (data->peap_version == 0) { 128 data->tlv_request = TLV_REQ_FAILURE; 129 eap_peap_state(data, PHASE2_TLV); 130 } else { 131 eap_peap_state(data, FAILURE_REQ); 132 } 133 } 134 135 136 static void * eap_peap_init(struct eap_sm *sm) 137 { 138 struct eap_peap_data *data; 139 140 data = os_zalloc(sizeof(*data)); 141 if (data == NULL) 142 return NULL; 143 data->peap_version = EAP_PEAP_VERSION; 144 data->force_version = -1; 145 if (sm->user && sm->user->force_version >= 0) { 146 data->force_version = sm->user->force_version; 147 wpa_printf(MSG_DEBUG, "EAP-PEAP: forcing version %d", 148 data->force_version); 149 data->peap_version = data->force_version; 150 } 151 data->state = START; 152 data->crypto_binding = OPTIONAL_BINDING; 153 154 if (eap_server_tls_ssl_init(sm, &data->ssl, 0)) { 155 wpa_printf(MSG_INFO, "EAP-PEAP: Failed to initialize SSL."); 156 eap_peap_reset(sm, data); 157 return NULL; 158 } 159 160 return data; 161 } 162 163 164 static void eap_peap_reset(struct eap_sm *sm, void *priv) 165 { 166 struct eap_peap_data *data = priv; 167 if (data == NULL) 168 return; 169 if (data->phase2_priv && data->phase2_method) 170 data->phase2_method->reset(sm, data->phase2_priv); 171 eap_server_tls_ssl_deinit(sm, &data->ssl); 172 wpabuf_free(data->pending_phase2_resp); 173 os_free(data->phase2_key); 174 wpabuf_free(data->soh_response); 175 bin_clear_free(data, sizeof(*data)); 176 } 177 178 179 static struct wpabuf * eap_peap_build_start(struct eap_sm *sm, 180 struct eap_peap_data *data, u8 id) 181 { 182 struct wpabuf *req; 183 184 req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_PEAP, 1, 185 EAP_CODE_REQUEST, id); 186 if (req == NULL) { 187 wpa_printf(MSG_ERROR, "EAP-PEAP: Failed to allocate memory for" 188 " request"); 189 eap_peap_state(data, FAILURE); 190 return NULL; 191 } 192 193 wpabuf_put_u8(req, EAP_TLS_FLAGS_START | data->peap_version); 194 195 eap_peap_state(data, PHASE1); 196 197 return req; 198 } 199 200 201 static struct wpabuf * eap_peap_build_phase2_req(struct eap_sm *sm, 202 struct eap_peap_data *data, 203 u8 id) 204 { 205 struct wpabuf *buf, *encr_req, msgbuf; 206 const u8 *req; 207 size_t req_len; 208 209 if (data->phase2_method == NULL || data->phase2_priv == NULL) { 210 wpa_printf(MSG_DEBUG, "EAP-PEAP: Phase 2 method not ready"); 211 return NULL; 212 } 213 buf = data->phase2_method->buildReq(sm, data->phase2_priv, id); 214 if (buf == NULL) 215 return NULL; 216 217 req = wpabuf_head(buf); 218 req_len = wpabuf_len(buf); 219 wpa_hexdump_key(MSG_DEBUG, "EAP-PEAP: Encrypting Phase 2 data", 220 req, req_len); 221 222 if (data->peap_version == 0 && 223 data->phase2_method->method != EAP_TYPE_TLV) { 224 req += sizeof(struct eap_hdr); 225 req_len -= sizeof(struct eap_hdr); 226 } 227 228 wpabuf_set(&msgbuf, req, req_len); 229 encr_req = eap_server_tls_encrypt(sm, &data->ssl, &msgbuf); 230 wpabuf_free(buf); 231 232 return encr_req; 233 } 234 235 236 #ifdef EAP_SERVER_TNC 237 static struct wpabuf * eap_peap_build_phase2_soh(struct eap_sm *sm, 238 struct eap_peap_data *data, 239 u8 id) 240 { 241 struct wpabuf *buf1, *buf, *encr_req, msgbuf; 242 const u8 *req; 243 size_t req_len; 244 245 buf1 = tncs_build_soh_request(); 246 if (buf1 == NULL) 247 return NULL; 248 249 buf = eap_msg_alloc(EAP_VENDOR_MICROSOFT, 0x21, wpabuf_len(buf1), 250 EAP_CODE_REQUEST, id); 251 if (buf == NULL) { 252 wpabuf_free(buf1); 253 return NULL; 254 } 255 wpabuf_put_buf(buf, buf1); 256 wpabuf_free(buf1); 257 258 req = wpabuf_head(buf); 259 req_len = wpabuf_len(buf); 260 261 wpa_hexdump_key(MSG_DEBUG, "EAP-PEAP: Encrypting Phase 2 SOH data", 262 req, req_len); 263 264 req += sizeof(struct eap_hdr); 265 req_len -= sizeof(struct eap_hdr); 266 wpabuf_set(&msgbuf, req, req_len); 267 268 encr_req = eap_server_tls_encrypt(sm, &data->ssl, &msgbuf); 269 wpabuf_free(buf); 270 271 return encr_req; 272 } 273 #endif /* EAP_SERVER_TNC */ 274 275 276 static void eap_peap_get_isk(struct eap_peap_data *data, 277 u8 *isk, size_t isk_len) 278 { 279 size_t key_len; 280 281 os_memset(isk, 0, isk_len); 282 if (data->phase2_key == NULL) 283 return; 284 285 key_len = data->phase2_key_len; 286 if (key_len > isk_len) 287 key_len = isk_len; 288 os_memcpy(isk, data->phase2_key, key_len); 289 } 290 291 292 static int eap_peap_derive_cmk(struct eap_sm *sm, struct eap_peap_data *data) 293 { 294 u8 *tk; 295 u8 isk[32], imck[60]; 296 297 /* 298 * Tunnel key (TK) is the first 60 octets of the key generated by 299 * phase 1 of PEAP (based on TLS). 300 */ 301 tk = eap_server_tls_derive_key(sm, &data->ssl, "client EAP encryption", 302 EAP_TLS_KEY_LEN); 303 if (tk == NULL) 304 return -1; 305 wpa_hexdump_key(MSG_DEBUG, "EAP-PEAP: TK", tk, 60); 306 307 eap_peap_get_isk(data, isk, sizeof(isk)); 308 wpa_hexdump_key(MSG_DEBUG, "EAP-PEAP: ISK", isk, sizeof(isk)); 309 310 /* 311 * IPMK Seed = "Inner Methods Compound Keys" | ISK 312 * TempKey = First 40 octets of TK 313 * IPMK|CMK = PRF+(TempKey, IPMK Seed, 60) 314 * (note: draft-josefsson-pppext-eap-tls-eap-10.txt includes a space 315 * in the end of the label just before ISK; is that just a typo?) 316 */ 317 wpa_hexdump_key(MSG_DEBUG, "EAP-PEAP: TempKey", tk, 40); 318 if (peap_prfplus(data->peap_version, tk, 40, 319 "Inner Methods Compound Keys", 320 isk, sizeof(isk), imck, sizeof(imck)) < 0) { 321 os_free(tk); 322 return -1; 323 } 324 wpa_hexdump_key(MSG_DEBUG, "EAP-PEAP: IMCK (IPMKj)", 325 imck, sizeof(imck)); 326 327 os_free(tk); 328 329 /* TODO: fast-connect: IPMK|CMK = TK */ 330 os_memcpy(data->ipmk, imck, 40); 331 wpa_hexdump_key(MSG_DEBUG, "EAP-PEAP: IPMK (S-IPMKj)", data->ipmk, 40); 332 os_memcpy(data->cmk, imck + 40, 20); 333 wpa_hexdump_key(MSG_DEBUG, "EAP-PEAP: CMK (CMKj)", data->cmk, 20); 334 335 return 0; 336 } 337 338 339 static struct wpabuf * eap_peap_build_phase2_tlv(struct eap_sm *sm, 340 struct eap_peap_data *data, 341 u8 id) 342 { 343 struct wpabuf *buf, *encr_req; 344 size_t mlen; 345 346 mlen = 6; /* Result TLV */ 347 if (data->peap_version == 0 && data->tlv_request == TLV_REQ_SUCCESS && 348 data->crypto_binding != NO_BINDING) { 349 mlen += 60; /* Cryptobinding TLV */ 350 #ifdef EAP_SERVER_TNC 351 if (data->soh_response) 352 mlen += wpabuf_len(data->soh_response); 353 #endif /* EAP_SERVER_TNC */ 354 } 355 356 buf = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_TLV, mlen, 357 EAP_CODE_REQUEST, id); 358 if (buf == NULL) 359 return NULL; 360 361 wpabuf_put_u8(buf, 0x80); /* Mandatory */ 362 wpabuf_put_u8(buf, EAP_TLV_RESULT_TLV); 363 /* Length */ 364 wpabuf_put_be16(buf, 2); 365 /* Status */ 366 wpabuf_put_be16(buf, data->tlv_request == TLV_REQ_SUCCESS ? 367 EAP_TLV_RESULT_SUCCESS : EAP_TLV_RESULT_FAILURE); 368 369 if (data->peap_version == 0 && data->tlv_request == TLV_REQ_SUCCESS && 370 data->crypto_binding != NO_BINDING) { 371 u8 *mac; 372 u8 eap_type = EAP_TYPE_PEAP; 373 const u8 *addr[2]; 374 size_t len[2]; 375 u16 tlv_type; 376 377 #ifdef EAP_SERVER_TNC 378 if (data->soh_response) { 379 wpa_printf(MSG_DEBUG, "EAP-PEAP: Adding MS-SOH " 380 "Response TLV"); 381 wpabuf_put_buf(buf, data->soh_response); 382 wpabuf_free(data->soh_response); 383 data->soh_response = NULL; 384 } 385 #endif /* EAP_SERVER_TNC */ 386 387 if (eap_peap_derive_cmk(sm, data) < 0 || 388 random_get_bytes(data->binding_nonce, 32)) { 389 wpabuf_free(buf); 390 return NULL; 391 } 392 393 /* Compound_MAC: HMAC-SHA1-160(cryptobinding TLV | EAP type) */ 394 addr[0] = wpabuf_put(buf, 0); 395 len[0] = 60; 396 addr[1] = &eap_type; 397 len[1] = 1; 398 399 tlv_type = EAP_TLV_CRYPTO_BINDING_TLV; 400 wpabuf_put_be16(buf, tlv_type); 401 wpabuf_put_be16(buf, 56); 402 403 wpabuf_put_u8(buf, 0); /* Reserved */ 404 wpabuf_put_u8(buf, data->peap_version); /* Version */ 405 wpabuf_put_u8(buf, data->recv_version); /* RecvVersion */ 406 wpabuf_put_u8(buf, 0); /* SubType: 0 = Request, 1 = Response */ 407 wpabuf_put_data(buf, data->binding_nonce, 32); /* Nonce */ 408 mac = wpabuf_put(buf, 20); /* Compound_MAC */ 409 wpa_hexdump(MSG_MSGDUMP, "EAP-PEAP: Compound_MAC CMK", 410 data->cmk, 20); 411 wpa_hexdump(MSG_MSGDUMP, "EAP-PEAP: Compound_MAC data 1", 412 addr[0], len[0]); 413 wpa_hexdump(MSG_MSGDUMP, "EAP-PEAP: Compound_MAC data 2", 414 addr[1], len[1]); 415 hmac_sha1_vector(data->cmk, 20, 2, addr, len, mac); 416 wpa_hexdump(MSG_MSGDUMP, "EAP-PEAP: Compound_MAC", 417 mac, SHA1_MAC_LEN); 418 data->crypto_binding_sent = 1; 419 } 420 421 wpa_hexdump_buf_key(MSG_DEBUG, "EAP-PEAP: Encrypting Phase 2 TLV data", 422 buf); 423 424 encr_req = eap_server_tls_encrypt(sm, &data->ssl, buf); 425 wpabuf_free(buf); 426 427 return encr_req; 428 } 429 430 431 static struct wpabuf * eap_peap_build_phase2_term(struct eap_sm *sm, 432 struct eap_peap_data *data, 433 u8 id, int success) 434 { 435 struct wpabuf *encr_req, msgbuf; 436 size_t req_len; 437 struct eap_hdr *hdr; 438 439 req_len = sizeof(*hdr); 440 hdr = os_zalloc(req_len); 441 if (hdr == NULL) 442 return NULL; 443 444 hdr->code = success ? EAP_CODE_SUCCESS : EAP_CODE_FAILURE; 445 hdr->identifier = id; 446 hdr->length = host_to_be16(req_len); 447 448 wpa_hexdump_key(MSG_DEBUG, "EAP-PEAP: Encrypting Phase 2 data", 449 (u8 *) hdr, req_len); 450 451 wpabuf_set(&msgbuf, hdr, req_len); 452 encr_req = eap_server_tls_encrypt(sm, &data->ssl, &msgbuf); 453 os_free(hdr); 454 455 return encr_req; 456 } 457 458 459 static struct wpabuf * eap_peap_buildReq(struct eap_sm *sm, void *priv, u8 id) 460 { 461 struct eap_peap_data *data = priv; 462 463 if (data->ssl.state == FRAG_ACK) { 464 return eap_server_tls_build_ack(id, EAP_TYPE_PEAP, 465 data->peap_version); 466 } 467 468 if (data->ssl.state == WAIT_FRAG_ACK) { 469 return eap_server_tls_build_msg(&data->ssl, EAP_TYPE_PEAP, 470 data->peap_version, id); 471 } 472 473 switch (data->state) { 474 case START: 475 return eap_peap_build_start(sm, data, id); 476 case PHASE1: 477 case PHASE1_ID2: 478 if (tls_connection_established(sm->ssl_ctx, data->ssl.conn)) { 479 wpa_printf(MSG_DEBUG, "EAP-PEAP: Phase1 done, " 480 "starting Phase2"); 481 eap_peap_state(data, PHASE2_START); 482 } 483 break; 484 case PHASE2_ID: 485 case PHASE2_METHOD: 486 wpabuf_free(data->ssl.tls_out); 487 data->ssl.tls_out_pos = 0; 488 data->ssl.tls_out = eap_peap_build_phase2_req(sm, data, id); 489 break; 490 #ifdef EAP_SERVER_TNC 491 case PHASE2_SOH: 492 wpabuf_free(data->ssl.tls_out); 493 data->ssl.tls_out_pos = 0; 494 data->ssl.tls_out = eap_peap_build_phase2_soh(sm, data, id); 495 break; 496 #endif /* EAP_SERVER_TNC */ 497 case PHASE2_TLV: 498 wpabuf_free(data->ssl.tls_out); 499 data->ssl.tls_out_pos = 0; 500 data->ssl.tls_out = eap_peap_build_phase2_tlv(sm, data, id); 501 break; 502 case SUCCESS_REQ: 503 wpabuf_free(data->ssl.tls_out); 504 data->ssl.tls_out_pos = 0; 505 data->ssl.tls_out = eap_peap_build_phase2_term(sm, data, id, 506 1); 507 break; 508 case FAILURE_REQ: 509 wpabuf_free(data->ssl.tls_out); 510 data->ssl.tls_out_pos = 0; 511 data->ssl.tls_out = eap_peap_build_phase2_term(sm, data, id, 512 0); 513 break; 514 default: 515 wpa_printf(MSG_DEBUG, "EAP-PEAP: %s - unexpected state %d", 516 __func__, data->state); 517 return NULL; 518 } 519 520 return eap_server_tls_build_msg(&data->ssl, EAP_TYPE_PEAP, 521 data->peap_version, id); 522 } 523 524 525 static Boolean eap_peap_check(struct eap_sm *sm, void *priv, 526 struct wpabuf *respData) 527 { 528 const u8 *pos; 529 size_t len; 530 531 pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_PEAP, respData, &len); 532 if (pos == NULL || len < 1) { 533 wpa_printf(MSG_INFO, "EAP-PEAP: Invalid frame"); 534 return TRUE; 535 } 536 537 return FALSE; 538 } 539 540 541 static int eap_peap_phase2_init(struct eap_sm *sm, struct eap_peap_data *data, 542 EapType eap_type) 543 { 544 if (data->phase2_priv && data->phase2_method) { 545 data->phase2_method->reset(sm, data->phase2_priv); 546 data->phase2_method = NULL; 547 data->phase2_priv = NULL; 548 } 549 data->phase2_method = eap_server_get_eap_method(EAP_VENDOR_IETF, 550 eap_type); 551 if (!data->phase2_method) 552 return -1; 553 554 sm->init_phase2 = 1; 555 data->phase2_priv = data->phase2_method->init(sm); 556 sm->init_phase2 = 0; 557 return 0; 558 } 559 560 561 static int eap_tlv_validate_cryptobinding(struct eap_sm *sm, 562 struct eap_peap_data *data, 563 const u8 *crypto_tlv, 564 size_t crypto_tlv_len) 565 { 566 u8 buf[61], mac[SHA1_MAC_LEN]; 567 const u8 *pos; 568 569 if (crypto_tlv_len != 4 + 56) { 570 wpa_printf(MSG_DEBUG, "EAP-PEAP: Invalid cryptobinding TLV " 571 "length %d", (int) crypto_tlv_len); 572 return -1; 573 } 574 575 pos = crypto_tlv; 576 pos += 4; /* TLV header */ 577 if (pos[1] != data->peap_version) { 578 wpa_printf(MSG_DEBUG, "EAP-PEAP: Cryptobinding TLV Version " 579 "mismatch (was %d; expected %d)", 580 pos[1], data->peap_version); 581 return -1; 582 } 583 584 if (pos[3] != 1) { 585 wpa_printf(MSG_DEBUG, "EAP-PEAP: Unexpected Cryptobinding TLV " 586 "SubType %d", pos[3]); 587 return -1; 588 } 589 pos += 4; 590 pos += 32; /* Nonce */ 591 592 /* Compound_MAC: HMAC-SHA1-160(cryptobinding TLV | EAP type) */ 593 os_memcpy(buf, crypto_tlv, 60); 594 os_memset(buf + 4 + 4 + 32, 0, 20); /* Compound_MAC */ 595 buf[60] = EAP_TYPE_PEAP; 596 hmac_sha1(data->cmk, 20, buf, sizeof(buf), mac); 597 598 if (os_memcmp_const(mac, pos, SHA1_MAC_LEN) != 0) { 599 wpa_printf(MSG_DEBUG, "EAP-PEAP: Invalid Compound_MAC in " 600 "cryptobinding TLV"); 601 wpa_hexdump_key(MSG_DEBUG, "EAP-PEAP: CMK", data->cmk, 20); 602 wpa_hexdump(MSG_DEBUG, "EAP-PEAP: Cryptobinding seed data", 603 buf, 61); 604 return -1; 605 } 606 607 wpa_printf(MSG_DEBUG, "EAP-PEAP: Valid cryptobinding TLV received"); 608 609 return 0; 610 } 611 612 613 static void eap_peap_process_phase2_tlv(struct eap_sm *sm, 614 struct eap_peap_data *data, 615 struct wpabuf *in_data) 616 { 617 const u8 *pos; 618 size_t left; 619 const u8 *result_tlv = NULL, *crypto_tlv = NULL; 620 size_t result_tlv_len = 0, crypto_tlv_len = 0; 621 int tlv_type, mandatory, tlv_len; 622 623 pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_TLV, in_data, &left); 624 if (pos == NULL) { 625 wpa_printf(MSG_DEBUG, "EAP-PEAP: Invalid EAP-TLV header"); 626 return; 627 } 628 629 /* Parse TLVs */ 630 wpa_hexdump(MSG_DEBUG, "EAP-PEAP: Received TLVs", pos, left); 631 while (left >= 4) { 632 mandatory = !!(pos[0] & 0x80); 633 tlv_type = pos[0] & 0x3f; 634 tlv_type = (tlv_type << 8) | pos[1]; 635 tlv_len = ((int) pos[2] << 8) | pos[3]; 636 pos += 4; 637 left -= 4; 638 if ((size_t) tlv_len > left) { 639 wpa_printf(MSG_DEBUG, "EAP-PEAP: TLV underrun " 640 "(tlv_len=%d left=%lu)", tlv_len, 641 (unsigned long) left); 642 eap_peap_state(data, FAILURE); 643 return; 644 } 645 switch (tlv_type) { 646 case EAP_TLV_RESULT_TLV: 647 result_tlv = pos; 648 result_tlv_len = tlv_len; 649 break; 650 case EAP_TLV_CRYPTO_BINDING_TLV: 651 crypto_tlv = pos; 652 crypto_tlv_len = tlv_len; 653 break; 654 default: 655 wpa_printf(MSG_DEBUG, "EAP-PEAP: Unsupported TLV Type " 656 "%d%s", tlv_type, 657 mandatory ? " (mandatory)" : ""); 658 if (mandatory) { 659 eap_peap_state(data, FAILURE); 660 return; 661 } 662 /* Ignore this TLV, but process other TLVs */ 663 break; 664 } 665 666 pos += tlv_len; 667 left -= tlv_len; 668 } 669 if (left) { 670 wpa_printf(MSG_DEBUG, "EAP-PEAP: Last TLV too short in " 671 "Request (left=%lu)", (unsigned long) left); 672 eap_peap_state(data, FAILURE); 673 return; 674 } 675 676 /* Process supported TLVs */ 677 if (crypto_tlv && data->crypto_binding_sent) { 678 wpa_hexdump(MSG_DEBUG, "EAP-PEAP: Cryptobinding TLV", 679 crypto_tlv, crypto_tlv_len); 680 if (eap_tlv_validate_cryptobinding(sm, data, crypto_tlv - 4, 681 crypto_tlv_len + 4) < 0) { 682 eap_peap_state(data, FAILURE); 683 return; 684 } 685 data->crypto_binding_used = 1; 686 } else if (!crypto_tlv && data->crypto_binding_sent && 687 data->crypto_binding == REQUIRE_BINDING) { 688 wpa_printf(MSG_DEBUG, "EAP-PEAP: No cryptobinding TLV"); 689 eap_peap_state(data, FAILURE); 690 return; 691 } 692 693 if (result_tlv) { 694 int status; 695 const char *requested; 696 697 wpa_hexdump(MSG_DEBUG, "EAP-PEAP: Result TLV", 698 result_tlv, result_tlv_len); 699 if (result_tlv_len < 2) { 700 wpa_printf(MSG_INFO, "EAP-PEAP: Too short Result TLV " 701 "(len=%lu)", 702 (unsigned long) result_tlv_len); 703 eap_peap_state(data, FAILURE); 704 return; 705 } 706 requested = data->tlv_request == TLV_REQ_SUCCESS ? "Success" : 707 "Failure"; 708 status = WPA_GET_BE16(result_tlv); 709 if (status == EAP_TLV_RESULT_SUCCESS) { 710 wpa_printf(MSG_INFO, "EAP-PEAP: TLV Result - Success " 711 "- requested %s", requested); 712 if (data->tlv_request == TLV_REQ_SUCCESS) 713 eap_peap_state(data, SUCCESS); 714 else 715 eap_peap_state(data, FAILURE); 716 717 } else if (status == EAP_TLV_RESULT_FAILURE) { 718 wpa_printf(MSG_INFO, "EAP-PEAP: TLV Result - Failure " 719 "- requested %s", requested); 720 eap_peap_state(data, FAILURE); 721 } else { 722 wpa_printf(MSG_INFO, "EAP-PEAP: Unknown TLV Result " 723 "Status %d", status); 724 eap_peap_state(data, FAILURE); 725 } 726 } 727 } 728 729 730 #ifdef EAP_SERVER_TNC 731 static void eap_peap_process_phase2_soh(struct eap_sm *sm, 732 struct eap_peap_data *data, 733 struct wpabuf *in_data) 734 { 735 const u8 *pos, *vpos; 736 size_t left; 737 const u8 *soh_tlv = NULL; 738 size_t soh_tlv_len = 0; 739 int tlv_type, mandatory, tlv_len, vtlv_len; 740 u8 next_type; 741 u32 vendor_id; 742 743 pos = eap_hdr_validate(EAP_VENDOR_MICROSOFT, 0x21, in_data, &left); 744 if (pos == NULL) { 745 wpa_printf(MSG_DEBUG, "EAP-PEAP: Not a valid SoH EAP " 746 "Extensions Method header - skip TNC"); 747 goto auth_method; 748 } 749 750 /* Parse TLVs */ 751 wpa_hexdump(MSG_DEBUG, "EAP-PEAP: Received TLVs (SoH)", pos, left); 752 while (left >= 4) { 753 mandatory = !!(pos[0] & 0x80); 754 tlv_type = pos[0] & 0x3f; 755 tlv_type = (tlv_type << 8) | pos[1]; 756 tlv_len = ((int) pos[2] << 8) | pos[3]; 757 pos += 4; 758 left -= 4; 759 if ((size_t) tlv_len > left) { 760 wpa_printf(MSG_DEBUG, "EAP-PEAP: TLV underrun " 761 "(tlv_len=%d left=%lu)", tlv_len, 762 (unsigned long) left); 763 eap_peap_state(data, FAILURE); 764 return; 765 } 766 switch (tlv_type) { 767 case EAP_TLV_VENDOR_SPECIFIC_TLV: 768 if (tlv_len < 4) { 769 wpa_printf(MSG_DEBUG, "EAP-PEAP: Too short " 770 "vendor specific TLV (len=%d)", 771 (int) tlv_len); 772 eap_peap_state(data, FAILURE); 773 return; 774 } 775 776 vendor_id = WPA_GET_BE32(pos); 777 if (vendor_id != EAP_VENDOR_MICROSOFT) { 778 if (mandatory) { 779 eap_peap_state(data, FAILURE); 780 return; 781 } 782 break; 783 } 784 785 vpos = pos + 4; 786 mandatory = !!(vpos[0] & 0x80); 787 tlv_type = vpos[0] & 0x3f; 788 tlv_type = (tlv_type << 8) | vpos[1]; 789 vtlv_len = ((int) vpos[2] << 8) | vpos[3]; 790 vpos += 4; 791 if (vpos + vtlv_len > pos + left) { 792 wpa_printf(MSG_DEBUG, "EAP-PEAP: Vendor TLV " 793 "underrun"); 794 eap_peap_state(data, FAILURE); 795 return; 796 } 797 798 if (tlv_type == 1) { 799 soh_tlv = vpos; 800 soh_tlv_len = vtlv_len; 801 break; 802 } 803 804 wpa_printf(MSG_DEBUG, "EAP-PEAP: Unsupported MS-TLV " 805 "Type %d%s", tlv_type, 806 mandatory ? " (mandatory)" : ""); 807 if (mandatory) { 808 eap_peap_state(data, FAILURE); 809 return; 810 } 811 /* Ignore this TLV, but process other TLVs */ 812 break; 813 default: 814 wpa_printf(MSG_DEBUG, "EAP-PEAP: Unsupported TLV Type " 815 "%d%s", tlv_type, 816 mandatory ? " (mandatory)" : ""); 817 if (mandatory) { 818 eap_peap_state(data, FAILURE); 819 return; 820 } 821 /* Ignore this TLV, but process other TLVs */ 822 break; 823 } 824 825 pos += tlv_len; 826 left -= tlv_len; 827 } 828 if (left) { 829 wpa_printf(MSG_DEBUG, "EAP-PEAP: Last TLV too short in " 830 "Request (left=%lu)", (unsigned long) left); 831 eap_peap_state(data, FAILURE); 832 return; 833 } 834 835 /* Process supported TLVs */ 836 if (soh_tlv) { 837 int failure = 0; 838 wpabuf_free(data->soh_response); 839 data->soh_response = tncs_process_soh(soh_tlv, soh_tlv_len, 840 &failure); 841 if (failure) { 842 eap_peap_state(data, FAILURE); 843 return; 844 } 845 } else { 846 wpa_printf(MSG_DEBUG, "EAP-PEAP: No SoH TLV received"); 847 eap_peap_state(data, FAILURE); 848 return; 849 } 850 851 auth_method: 852 eap_peap_state(data, PHASE2_METHOD); 853 next_type = sm->user->methods[0].method; 854 sm->user_eap_method_index = 1; 855 wpa_printf(MSG_DEBUG, "EAP-PEAP: try EAP type %d", next_type); 856 eap_peap_phase2_init(sm, data, next_type); 857 } 858 #endif /* EAP_SERVER_TNC */ 859 860 861 static void eap_peap_process_phase2_response(struct eap_sm *sm, 862 struct eap_peap_data *data, 863 struct wpabuf *in_data) 864 { 865 u8 next_type = EAP_TYPE_NONE; 866 const struct eap_hdr *hdr; 867 const u8 *pos; 868 size_t left; 869 870 if (data->state == PHASE2_TLV) { 871 eap_peap_process_phase2_tlv(sm, data, in_data); 872 return; 873 } 874 875 #ifdef EAP_SERVER_TNC 876 if (data->state == PHASE2_SOH) { 877 eap_peap_process_phase2_soh(sm, data, in_data); 878 return; 879 } 880 #endif /* EAP_SERVER_TNC */ 881 882 if (data->phase2_priv == NULL) { 883 wpa_printf(MSG_DEBUG, "EAP-PEAP: %s - Phase2 not " 884 "initialized?!", __func__); 885 return; 886 } 887 888 hdr = wpabuf_head(in_data); 889 pos = (const u8 *) (hdr + 1); 890 891 if (wpabuf_len(in_data) > sizeof(*hdr) && *pos == EAP_TYPE_NAK) { 892 left = wpabuf_len(in_data) - sizeof(*hdr); 893 wpa_hexdump(MSG_DEBUG, "EAP-PEAP: Phase2 type Nak'ed; " 894 "allowed types", pos + 1, left - 1); 895 eap_sm_process_nak(sm, pos + 1, left - 1); 896 if (sm->user && sm->user_eap_method_index < EAP_MAX_METHODS && 897 sm->user->methods[sm->user_eap_method_index].method != 898 EAP_TYPE_NONE) { 899 next_type = sm->user->methods[ 900 sm->user_eap_method_index++].method; 901 wpa_printf(MSG_DEBUG, "EAP-PEAP: try EAP type %d", 902 next_type); 903 } else { 904 eap_peap_req_failure(sm, data); 905 next_type = EAP_TYPE_NONE; 906 } 907 eap_peap_phase2_init(sm, data, next_type); 908 return; 909 } 910 911 if (data->phase2_method->check(sm, data->phase2_priv, in_data)) { 912 wpa_printf(MSG_DEBUG, "EAP-PEAP: Phase2 check() asked to " 913 "ignore the packet"); 914 return; 915 } 916 917 data->phase2_method->process(sm, data->phase2_priv, in_data); 918 919 if (sm->method_pending == METHOD_PENDING_WAIT) { 920 wpa_printf(MSG_DEBUG, "EAP-PEAP: Phase2 method is in " 921 "pending wait state - save decrypted response"); 922 wpabuf_free(data->pending_phase2_resp); 923 data->pending_phase2_resp = wpabuf_dup(in_data); 924 } 925 926 if (!data->phase2_method->isDone(sm, data->phase2_priv)) 927 return; 928 929 if (!data->phase2_method->isSuccess(sm, data->phase2_priv)) { 930 wpa_printf(MSG_DEBUG, "EAP-PEAP: Phase2 method failed"); 931 eap_peap_req_failure(sm, data); 932 next_type = EAP_TYPE_NONE; 933 eap_peap_phase2_init(sm, data, next_type); 934 return; 935 } 936 937 os_free(data->phase2_key); 938 if (data->phase2_method->getKey) { 939 data->phase2_key = data->phase2_method->getKey( 940 sm, data->phase2_priv, &data->phase2_key_len); 941 if (data->phase2_key == NULL) { 942 wpa_printf(MSG_DEBUG, "EAP-PEAP: Phase2 getKey " 943 "failed"); 944 eap_peap_req_failure(sm, data); 945 eap_peap_phase2_init(sm, data, EAP_TYPE_NONE); 946 return; 947 } 948 } 949 950 switch (data->state) { 951 case PHASE1_ID2: 952 case PHASE2_ID: 953 case PHASE2_SOH: 954 if (eap_user_get(sm, sm->identity, sm->identity_len, 1) != 0) { 955 wpa_hexdump_ascii(MSG_DEBUG, "EAP_PEAP: Phase2 " 956 "Identity not found in the user " 957 "database", 958 sm->identity, sm->identity_len); 959 eap_peap_req_failure(sm, data); 960 next_type = EAP_TYPE_NONE; 961 break; 962 } 963 964 #ifdef EAP_SERVER_TNC 965 if (data->state != PHASE2_SOH && sm->tnc && 966 data->peap_version == 0) { 967 eap_peap_state(data, PHASE2_SOH); 968 wpa_printf(MSG_DEBUG, "EAP-PEAP: Try to initialize " 969 "TNC (NAP SOH)"); 970 next_type = EAP_TYPE_NONE; 971 break; 972 } 973 #endif /* EAP_SERVER_TNC */ 974 975 eap_peap_state(data, PHASE2_METHOD); 976 next_type = sm->user->methods[0].method; 977 sm->user_eap_method_index = 1; 978 wpa_printf(MSG_DEBUG, "EAP-PEAP: try EAP type %d", next_type); 979 break; 980 case PHASE2_METHOD: 981 eap_peap_req_success(sm, data); 982 next_type = EAP_TYPE_NONE; 983 break; 984 case FAILURE: 985 break; 986 default: 987 wpa_printf(MSG_DEBUG, "EAP-PEAP: %s - unexpected state %d", 988 __func__, data->state); 989 break; 990 } 991 992 eap_peap_phase2_init(sm, data, next_type); 993 } 994 995 996 static void eap_peap_process_phase2(struct eap_sm *sm, 997 struct eap_peap_data *data, 998 const struct wpabuf *respData, 999 struct wpabuf *in_buf) 1000 { 1001 struct wpabuf *in_decrypted; 1002 const struct eap_hdr *hdr; 1003 size_t len; 1004 1005 wpa_printf(MSG_DEBUG, "EAP-PEAP: received %lu bytes encrypted data for" 1006 " Phase 2", (unsigned long) wpabuf_len(in_buf)); 1007 1008 if (data->pending_phase2_resp) { 1009 wpa_printf(MSG_DEBUG, "EAP-PEAP: Pending Phase 2 response - " 1010 "skip decryption and use old data"); 1011 eap_peap_process_phase2_response(sm, data, 1012 data->pending_phase2_resp); 1013 wpabuf_free(data->pending_phase2_resp); 1014 data->pending_phase2_resp = NULL; 1015 return; 1016 } 1017 1018 in_decrypted = tls_connection_decrypt(sm->ssl_ctx, data->ssl.conn, 1019 in_buf); 1020 if (in_decrypted == NULL) { 1021 wpa_printf(MSG_INFO, "EAP-PEAP: Failed to decrypt Phase 2 " 1022 "data"); 1023 eap_peap_state(data, FAILURE); 1024 return; 1025 } 1026 1027 wpa_hexdump_buf_key(MSG_DEBUG, "EAP-PEAP: Decrypted Phase 2 EAP", 1028 in_decrypted); 1029 1030 if (data->peap_version == 0 && data->state != PHASE2_TLV) { 1031 const struct eap_hdr *resp; 1032 struct eap_hdr *nhdr; 1033 struct wpabuf *nbuf = 1034 wpabuf_alloc(sizeof(struct eap_hdr) + 1035 wpabuf_len(in_decrypted)); 1036 if (nbuf == NULL) { 1037 wpabuf_free(in_decrypted); 1038 return; 1039 } 1040 1041 resp = wpabuf_head(respData); 1042 nhdr = wpabuf_put(nbuf, sizeof(*nhdr)); 1043 nhdr->code = resp->code; 1044 nhdr->identifier = resp->identifier; 1045 nhdr->length = host_to_be16(sizeof(struct eap_hdr) + 1046 wpabuf_len(in_decrypted)); 1047 wpabuf_put_buf(nbuf, in_decrypted); 1048 wpabuf_free(in_decrypted); 1049 1050 in_decrypted = nbuf; 1051 } 1052 1053 hdr = wpabuf_head(in_decrypted); 1054 if (wpabuf_len(in_decrypted) < (int) sizeof(*hdr)) { 1055 wpa_printf(MSG_INFO, "EAP-PEAP: Too short Phase 2 " 1056 "EAP frame (len=%lu)", 1057 (unsigned long) wpabuf_len(in_decrypted)); 1058 wpabuf_free(in_decrypted); 1059 eap_peap_req_failure(sm, data); 1060 return; 1061 } 1062 len = be_to_host16(hdr->length); 1063 if (len > wpabuf_len(in_decrypted)) { 1064 wpa_printf(MSG_INFO, "EAP-PEAP: Length mismatch in " 1065 "Phase 2 EAP frame (len=%lu hdr->length=%lu)", 1066 (unsigned long) wpabuf_len(in_decrypted), 1067 (unsigned long) len); 1068 wpabuf_free(in_decrypted); 1069 eap_peap_req_failure(sm, data); 1070 return; 1071 } 1072 wpa_printf(MSG_DEBUG, "EAP-PEAP: received Phase 2: code=%d " 1073 "identifier=%d length=%lu", hdr->code, hdr->identifier, 1074 (unsigned long) len); 1075 switch (hdr->code) { 1076 case EAP_CODE_RESPONSE: 1077 eap_peap_process_phase2_response(sm, data, in_decrypted); 1078 break; 1079 case EAP_CODE_SUCCESS: 1080 wpa_printf(MSG_DEBUG, "EAP-PEAP: Phase 2 Success"); 1081 if (data->state == SUCCESS_REQ) { 1082 eap_peap_state(data, SUCCESS); 1083 } 1084 break; 1085 case EAP_CODE_FAILURE: 1086 wpa_printf(MSG_DEBUG, "EAP-PEAP: Phase 2 Failure"); 1087 eap_peap_state(data, FAILURE); 1088 break; 1089 default: 1090 wpa_printf(MSG_INFO, "EAP-PEAP: Unexpected code=%d in " 1091 "Phase 2 EAP header", hdr->code); 1092 break; 1093 } 1094 1095 wpabuf_free(in_decrypted); 1096 } 1097 1098 1099 static int eap_peap_process_version(struct eap_sm *sm, void *priv, 1100 int peer_version) 1101 { 1102 struct eap_peap_data *data = priv; 1103 1104 data->recv_version = peer_version; 1105 if (data->force_version >= 0 && peer_version != data->force_version) { 1106 wpa_printf(MSG_INFO, "EAP-PEAP: peer did not select the forced" 1107 " version (forced=%d peer=%d) - reject", 1108 data->force_version, peer_version); 1109 return -1; 1110 } 1111 if (peer_version < data->peap_version) { 1112 wpa_printf(MSG_DEBUG, "EAP-PEAP: peer ver=%d, own ver=%d; " 1113 "use version %d", 1114 peer_version, data->peap_version, peer_version); 1115 data->peap_version = peer_version; 1116 } 1117 1118 return 0; 1119 } 1120 1121 1122 static void eap_peap_process_msg(struct eap_sm *sm, void *priv, 1123 const struct wpabuf *respData) 1124 { 1125 struct eap_peap_data *data = priv; 1126 1127 switch (data->state) { 1128 case PHASE1: 1129 if (eap_server_tls_phase1(sm, &data->ssl) < 0) { 1130 eap_peap_state(data, FAILURE); 1131 break; 1132 } 1133 break; 1134 case PHASE2_START: 1135 eap_peap_state(data, PHASE2_ID); 1136 eap_peap_phase2_init(sm, data, EAP_TYPE_IDENTITY); 1137 break; 1138 case PHASE1_ID2: 1139 case PHASE2_ID: 1140 case PHASE2_METHOD: 1141 case PHASE2_SOH: 1142 case PHASE2_TLV: 1143 eap_peap_process_phase2(sm, data, respData, data->ssl.tls_in); 1144 break; 1145 case SUCCESS_REQ: 1146 eap_peap_state(data, SUCCESS); 1147 break; 1148 case FAILURE_REQ: 1149 eap_peap_state(data, FAILURE); 1150 break; 1151 default: 1152 wpa_printf(MSG_DEBUG, "EAP-PEAP: Unexpected state %d in %s", 1153 data->state, __func__); 1154 break; 1155 } 1156 } 1157 1158 1159 static void eap_peap_process(struct eap_sm *sm, void *priv, 1160 struct wpabuf *respData) 1161 { 1162 struct eap_peap_data *data = priv; 1163 if (eap_server_tls_process(sm, &data->ssl, respData, data, 1164 EAP_TYPE_PEAP, eap_peap_process_version, 1165 eap_peap_process_msg) < 0) 1166 eap_peap_state(data, FAILURE); 1167 } 1168 1169 1170 static Boolean eap_peap_isDone(struct eap_sm *sm, void *priv) 1171 { 1172 struct eap_peap_data *data = priv; 1173 return data->state == SUCCESS || data->state == FAILURE; 1174 } 1175 1176 1177 static u8 * eap_peap_getKey(struct eap_sm *sm, void *priv, size_t *len) 1178 { 1179 struct eap_peap_data *data = priv; 1180 u8 *eapKeyData; 1181 1182 if (data->state != SUCCESS) 1183 return NULL; 1184 1185 if (data->crypto_binding_used) { 1186 u8 csk[128]; 1187 /* 1188 * Note: It looks like Microsoft implementation requires null 1189 * termination for this label while the one used for deriving 1190 * IPMK|CMK did not use null termination. 1191 */ 1192 if (peap_prfplus(data->peap_version, data->ipmk, 40, 1193 "Session Key Generating Function", 1194 (u8 *) "\00", 1, csk, sizeof(csk)) < 0) 1195 return NULL; 1196 wpa_hexdump_key(MSG_DEBUG, "EAP-PEAP: CSK", csk, sizeof(csk)); 1197 eapKeyData = os_malloc(EAP_TLS_KEY_LEN); 1198 if (eapKeyData) { 1199 os_memcpy(eapKeyData, csk, EAP_TLS_KEY_LEN); 1200 *len = EAP_TLS_KEY_LEN; 1201 wpa_hexdump(MSG_DEBUG, "EAP-PEAP: Derived key", 1202 eapKeyData, EAP_TLS_KEY_LEN); 1203 } else { 1204 wpa_printf(MSG_DEBUG, "EAP-PEAP: Failed to derive " 1205 "key"); 1206 } 1207 1208 return eapKeyData; 1209 } 1210 1211 /* TODO: PEAPv1 - different label in some cases */ 1212 eapKeyData = eap_server_tls_derive_key(sm, &data->ssl, 1213 "client EAP encryption", 1214 EAP_TLS_KEY_LEN); 1215 if (eapKeyData) { 1216 *len = EAP_TLS_KEY_LEN; 1217 wpa_hexdump(MSG_DEBUG, "EAP-PEAP: Derived key", 1218 eapKeyData, EAP_TLS_KEY_LEN); 1219 } else { 1220 wpa_printf(MSG_DEBUG, "EAP-PEAP: Failed to derive key"); 1221 } 1222 1223 return eapKeyData; 1224 } 1225 1226 1227 static Boolean eap_peap_isSuccess(struct eap_sm *sm, void *priv) 1228 { 1229 struct eap_peap_data *data = priv; 1230 return data->state == SUCCESS; 1231 } 1232 1233 1234 static u8 * eap_peap_get_session_id(struct eap_sm *sm, void *priv, size_t *len) 1235 { 1236 struct eap_peap_data *data = priv; 1237 1238 if (data->state != SUCCESS) 1239 return NULL; 1240 1241 return eap_server_tls_derive_session_id(sm, &data->ssl, EAP_TYPE_PEAP, 1242 len); 1243 } 1244 1245 1246 int eap_server_peap_register(void) 1247 { 1248 struct eap_method *eap; 1249 int ret; 1250 1251 eap = eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION, 1252 EAP_VENDOR_IETF, EAP_TYPE_PEAP, "PEAP"); 1253 if (eap == NULL) 1254 return -1; 1255 1256 eap->init = eap_peap_init; 1257 eap->reset = eap_peap_reset; 1258 eap->buildReq = eap_peap_buildReq; 1259 eap->check = eap_peap_check; 1260 eap->process = eap_peap_process; 1261 eap->isDone = eap_peap_isDone; 1262 eap->getKey = eap_peap_getKey; 1263 eap->isSuccess = eap_peap_isSuccess; 1264 eap->getSessionId = eap_peap_get_session_id; 1265 1266 ret = eap_server_method_register(eap); 1267 if (ret) 1268 eap_server_method_free(eap); 1269 return ret; 1270 } 1271