src/libcharon/plugins/eap_peap/eap_peap.c

   1 /*
   2  * Copyright (C) 2010 Martin Willi, revosec AG
   3  * Copyright (C) 2010 Andreas Steffen, HSR Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include "eap_peap.h"
  17 #include "eap_peap_peer.h"
  18 #include "eap_peap_server.h"
  19
  20 #include <tls_eap.h>
  21
  22 #include <daemon.h>
  23 #include <library.h>
  24
  25 typedef struct private_eap_peap_t private_eap_peap_t;
  26
  27 /**
  28  * Private data of an eap_peap_t object.
  29  */
  30 struct private_eap_peap_t {
  31
  32         /**
  33          * Public interface.
  34          */
  35         eap_peap_t public;
  36
  37         /**
  38          * TLS stack, wrapped by EAP helper
  39          */
  40         tls_eap_t *tls_eap;
  41 };
  42
  43 /** Maximum number of EAP-PEAP messages/fragments allowed */
  44 #define MAX_MESSAGE_COUNT 32
  45 /** Default size of a EAP-PEAP fragment */
  46 #define MAX_FRAGMENT_LEN 1024
  47
  48 METHOD(eap_method_t, initiate, status_t,
  49         private_eap_peap_t *this, eap_payload_t **out)
  50 {
  51         chunk_t data;
  52
  53         if (this->tls_eap->initiate(this->tls_eap, &data) == NEED_MORE)
  54         {
  55                 *out = eap_payload_create_data(data);
  56                 free(data.ptr);
  57                 return NEED_MORE;
  58         }
  59         return FAILED;
  60 }
  61
  62 METHOD(eap_method_t, process, status_t,
  63         private_eap_peap_t *this, eap_payload_t *in, eap_payload_t **out)
  64 {
  65         status_t status;
  66         chunk_t data;
  67
  68         data = in->get_data(in);
  69         status = this->tls_eap->process(this->tls_eap, data, &data);
  70         if (status == NEED_MORE)
  71         {
  72                 *out = eap_payload_create_data(data);
  73                 free(data.ptr);
  74         }
  75         return status;
  76 }
  77
  78 METHOD(eap_method_t, get_type, eap_type_t,
  79         private_eap_peap_t *this, u_int32_t *vendor)
  80 {
  81         *vendor = 0;
  82         return EAP_PEAP;
  83 }
  84
  85 METHOD(eap_method_t, get_msk, status_t,
  86         private_eap_peap_t *this, chunk_t *msk)
  87 {
  88         *msk = this->tls_eap->get_msk(this->tls_eap);
  89         if (msk->len)
  90         {
  91                 return SUCCESS;
  92         }
  93         return FAILED;
  94 }
  95
  96 METHOD(eap_method_t, get_identifier, u_int8_t,
  97         private_eap_peap_t *this)
  98 {
  99         return this->tls_eap->get_identifier(this->tls_eap);
 100 }
 101
 102 METHOD(eap_method_t, set_identifier, void,
 103         private_eap_peap_t *this, u_int8_t identifier)
 104 {
 105         this->tls_eap->set_identifier(this->tls_eap, identifier);
 106 }
 107
 108 METHOD(eap_method_t, is_mutual, bool,
 109         private_eap_peap_t *this)
 110 {
 111         return TRUE;
 112 }
 113
 114 METHOD(eap_method_t, destroy, void,
 115         private_eap_peap_t *this)
 116 {
 117         this->tls_eap->destroy(this->tls_eap);
 118         free(this);
 119 }
 120
 121 /**
 122  * Create an empty private eap_peap_t object
 123  */
 124 static private_eap_peap_t *eap_peap_create_empty(void)
 125 {
 126         private_eap_peap_t *this;
 127
 128         INIT(this,
 129                 .public = {
 130                         .eap_method = {
 131                                 .initiate = _initiate,
 132                                 .process = _process,
 133                                 .get_type = _get_type,
 134                                 .is_mutual = _is_mutual,
 135                                 .get_msk = _get_msk,
 136                                 .get_identifier = _get_identifier,
 137                                 .set_identifier = _set_identifier,
 138                                 .destroy = _destroy,
 139                         },
 140                 },
 141         );
 142         return this;
 143 }
 144
 145 /**
 146  * Generic private constructor
 147  */
 148 static eap_peap_t *eap_peap_create(private_eap_peap_t * this,
 149                                                                    identification_t *server,
 150                                                                    identification_t *peer, bool is_server,
 151                                                                    tls_application_t *application)
 152 {
 153         size_t frag_size;
 154         int max_msg_count;
 155         bool include_length;
 156         tls_t *tls;
 157
 158         if (is_server && !lib->settings->get_bool(lib->settings,
 159                                                                 "%s.plugins.eap-peap.request_peer_auth", FALSE,
 160                                                                 lib->ns))
 161         {
 162                 peer = NULL;
 163         }
 164         frag_size = lib->settings->get_int(lib->settings,
 165                                         "%s.plugins.eap-peap.fragment_size", MAX_FRAGMENT_LEN,
 166                                         lib->ns);
 167         max_msg_count = lib->settings->get_int(lib->settings,
 168                                         "%s.plugins.eap-peap.max_message_count", MAX_MESSAGE_COUNT,
 169                                         lib->ns);
 170         include_length = lib->settings->get_bool(lib->settings,
 171                                         "%s.plugins.eap-peap.include_length", FALSE, lib->ns);
 172         tls = tls_create(is_server, server, peer, TLS_PURPOSE_EAP_PEAP,
 173                                          application, NULL);
 174         this->tls_eap = tls_eap_create(EAP_PEAP, tls, frag_size, max_msg_count,
 175                                                                                                   include_length);
 176         if (!this->tls_eap)
 177         {
 178                 application->destroy(application);
 179                 free(this);
 180                 return NULL;
 181         }
 182         return &this->public;
 183 }
 184
 185 eap_peap_t *eap_peap_create_server(identification_t *server,
 186                                                                    identification_t *peer)
 187 {
 188         private_eap_peap_t *eap_peap;
 189         eap_method_t *eap_method;
 190         eap_peap_server_t *eap_peap_server;
 191         tls_application_t *application;
 192
 193         /* the tunneled application needs a reference to the outer EAP-PEAP method */
 194         eap_peap = eap_peap_create_empty();
 195         eap_method = &eap_peap->public.eap_method;
 196         eap_peap_server = eap_peap_server_create(server, peer, eap_method);
 197         application = &eap_peap_server->application;
 198
 199         return eap_peap_create(eap_peap, server, peer, TRUE, application);
 200 }
 201
 202 eap_peap_t *eap_peap_create_peer(identification_t *server,
 203                                                                  identification_t *peer)
 204 {
 205         private_eap_peap_t *eap_peap;
 206         eap_method_t *eap_method;
 207         eap_peap_peer_t *eap_peap_peer;
 208         tls_application_t *application;
 209
 210         /* the tunneled application needs a reference to the outer EAP-PEAP method */
 211         eap_peap = eap_peap_create_empty();
 212         eap_method = &eap_peap->public.eap_method;
 213         eap_peap_peer = eap_peap_peer_create(server, peer, eap_method);
 214         application = &eap_peap_peer->application;
 215
 216         return eap_peap_create(eap_peap, server, peer, FALSE, application);
 217 }