2 * Copyright (C) 2011 Andreas Steffen
3 * Copyright (C) 2011 HSR Hochschule fuer Technik Rapperswil
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 #include "eap_peap_server.h"
17 #include "eap_peap_avp.h"
19 #include <utils/debug.h>
22 typedef struct private_eap_peap_server_t private_eap_peap_server_t
;
25 * Private data of an eap_peap_server_t object.
27 struct private_eap_peap_server_t
{
30 * Public eap_peap_server_t interface.
32 eap_peap_server_t
public;
37 identification_t
*server
;
42 identification_t
*peer
;
45 * Current EAP-PEAP phase2 state
50 * Current EAP-PEAP phase2 TNC state
52 bool start_phase2_tnc
;
55 * Starts phase 2 with EAP Identity request
60 * Final EAP-PEAP phase2 result
62 eap_code_t phase2_result
;
65 * Outer phase 1 EAP method
67 eap_method_t
*ph1_method
;
70 * Current phase 2 EAP method
72 eap_method_t
*ph2_method
;
75 * Pending outbound EAP message
86 * Start EAP client authentication protocol
88 static status_t
start_phase2_auth(private_eap_peap_server_t
*this)
93 eap_type_str
= lib
->settings
->get_str(lib
->settings
,
94 "%s.plugins.eap-peap.phase2_method", "mschapv2",
96 type
= eap_type_from_string(eap_type_str
);
99 DBG1(DBG_IKE
, "unrecognized phase2 method \"%s\"", eap_type_str
);
102 DBG1(DBG_IKE
, "phase2 method %N selected", eap_type_names
, type
);
103 this->ph2_method
= charon
->eap
->create_instance(charon
->eap
, type
, 0,
104 EAP_SERVER
, this->server
, this->peer
);
105 if (this->ph2_method
== NULL
)
107 DBG1(DBG_IKE
, "%N method not available", eap_type_names
, type
);
111 /* synchronize EAP message identifiers of inner protocol with outer */
112 this->ph2_method
->set_identifier(this->ph2_method
,
113 this->ph1_method
->get_identifier(this->ph1_method
) + 1);
115 if (this->ph2_method
->initiate(this->ph2_method
, &this->out
) == NEED_MORE
)
121 DBG1(DBG_IKE
, "%N method failed", eap_type_names
, type
);
127 * If configured, start EAP-TNC protocol
129 static status_t
start_phase2_tnc(private_eap_peap_server_t
*this)
131 if (this->start_phase2_tnc
&& lib
->settings
->get_bool(lib
->settings
,
132 "%s.plugins.eap-peap.phase2_tnc", FALSE
, charon
->name
))
134 DBG1(DBG_IKE
, "phase2 method %N selected", eap_type_names
, EAP_TNC
);
135 this->ph2_method
= charon
->eap
->create_instance(charon
->eap
, EAP_TNC
,
136 0, EAP_SERVER
, this->server
, this->peer
);
137 if (this->ph2_method
== NULL
)
139 DBG1(DBG_IKE
, "%N method not available", eap_type_names
, EAP_TNC
);
142 this->start_phase2_tnc
= FALSE
;
144 /* synchronize EAP message identifiers of inner protocol with outer */
145 this->ph2_method
->set_identifier(this->ph2_method
,
146 this->ph1_method
->get_identifier(this->ph1_method
) + 1);
148 if (this->ph2_method
->initiate(this->ph2_method
, &this->out
) == NEED_MORE
)
154 DBG1(DBG_IKE
, "%N method failed", eap_type_names
, EAP_TNC
);
161 METHOD(tls_application_t
, process
, status_t
,
162 private_eap_peap_server_t
*this, bio_reader_t
*reader
)
164 chunk_t data
= chunk_empty
;
169 eap_type_t type
= EAP_NAK
, received_type
;
170 u_int32_t vendor
, received_vendor
;
172 status
= this->avp
->process(this->avp
, reader
, &data
,
173 this->ph1_method
->get_identifier(this->ph1_method
));
185 in
= eap_payload_create_data(data
);
186 DBG3(DBG_IKE
, "%B", &data
);
188 payload
= (payload_t
*)in
;
190 if (payload
->verify(payload
) != SUCCESS
)
196 code
= in
->get_code(in
);
197 if (code
== EAP_REQUEST
|| code
== EAP_RESPONSE
)
199 received_type
= in
->get_type(in
, &received_vendor
);
200 DBG1(DBG_IKE
, "received tunneled EAP-PEAP AVP [EAP/%N/%N]",
201 eap_code_short_names
, code
,
202 eap_type_short_names
, received_type
);
203 if (code
!= EAP_RESPONSE
)
205 DBG1(DBG_IKE
, "%N expected", eap_code_names
, EAP_RESPONSE
);
212 DBG1(DBG_IKE
, "received tunneled EAP-PEAP AVP [EAP/%N]",
213 eap_code_short_names
, code
);
215 /* if EAP_SUCCESS check if to continue phase2 with EAP-TNC */
216 return (this->phase2_result
== EAP_SUCCESS
&& code
== EAP_SUCCESS
) ?
217 start_phase2_tnc(this) : FAILED
;
220 if (this->ph2_method
)
222 type
= this->ph2_method
->get_type(this->ph2_method
, &vendor
);
224 if (type
!= received_type
|| vendor
!= received_vendor
)
226 if (received_vendor
== 0 && received_type
== EAP_NAK
)
228 DBG1(DBG_IKE
, "peer does not support %N", eap_type_names
, type
);
232 DBG1(DBG_IKE
, "received invalid EAP response");
239 if (!received_vendor
&& received_type
== EAP_IDENTITY
)
243 if (this->ph2_method
== NULL
)
245 /* Received an EAP Identity response without a matching request */
246 this->ph2_method
= charon
->eap
->create_instance(charon
->eap
,
247 EAP_IDENTITY
, 0, EAP_SERVER
,
248 this->server
, this->peer
);
249 if (this->ph2_method
== NULL
)
251 DBG1(DBG_IKE
, "%N method not available",
252 eap_type_names
, EAP_IDENTITY
);
257 if (this->ph2_method
->process(this->ph2_method
, in
, &this->out
) != SUCCESS
)
260 DBG1(DBG_IKE
, "%N method failed", eap_type_names
, EAP_IDENTITY
);
264 if (this->ph2_method
->get_msk(this->ph2_method
, &eap_id
) == SUCCESS
)
266 this->peer
->destroy(this->peer
);
267 this->peer
= identification_create_from_data(eap_id
);
268 DBG1(DBG_IKE
, "received EAP identity '%Y'", this->peer
);
272 this->ph2_method
->destroy(this->ph2_method
);
273 this->ph2_method
= NULL
;
275 /* Start Phase 2 of EAP-PEAP authentication */
276 if (lib
->settings
->get_bool(lib
->settings
,
277 "%s.plugins.eap-peap.request_peer_auth", FALSE
, charon
->name
))
279 return start_phase2_tnc(this);
283 return start_phase2_auth(this);
287 if (this->ph2_method
== 0)
289 DBG1(DBG_IKE
, "no %N phase2 method installed", eap_type_names
, EAP_PEAP
);
294 status
= this->ph2_method
->process(this->ph2_method
, in
, &this->out
);
300 DBG1(DBG_IKE
, "%N phase2 authentication of '%Y' with %N successful",
301 eap_type_names
, EAP_PEAP
, this->peer
,
302 eap_type_names
, type
);
303 this->ph2_method
->destroy(this->ph2_method
);
304 this->ph2_method
= NULL
;
306 /* EAP-PEAP requires the sending of an inner EAP_SUCCESS message */
307 this->phase2_result
= EAP_SUCCESS
;
308 this->out
= eap_payload_create_code(this->phase2_result
, 1 +
309 this->ph1_method
->get_identifier(this->ph1_method
));
317 DBG1(DBG_IKE
, "vendor specific EAP method %d-%d failed",
322 DBG1(DBG_IKE
, "%N method failed", eap_type_names
, type
);
324 /* EAP-PEAP requires the sending of an inner EAP_FAILURE message */
325 this->phase2_result
= EAP_FAILURE
;
326 this->out
= eap_payload_create_code(this->phase2_result
, 1 +
327 this->ph1_method
->get_identifier(this->ph1_method
));
333 METHOD(tls_application_t
, build
, status_t
,
334 private_eap_peap_server_t
*this, bio_writer_t
*writer
)
341 if (this->ph2_method
== NULL
&& this->start_phase2
&& this->start_phase2_id
)
344 * Start Phase 2 with an EAP Identity request either piggybacked right
345 * onto the TLS Finished payload or delayed after the reception of an
346 * empty EAP Acknowledge message.
348 this->ph2_method
= charon
->eap
->create_instance(charon
->eap
, EAP_IDENTITY
,
349 0, EAP_SERVER
, this->server
, this->peer
);
350 if (this->ph2_method
== NULL
)
352 DBG1(DBG_IKE
, "%N method not available",
353 eap_type_names
, EAP_IDENTITY
);
357 /* synchronize EAP message identifiers of inner protocol with outer */
358 this->ph2_method
->set_identifier(this->ph2_method
,
359 this->ph1_method
->get_identifier(this->ph1_method
));
361 this->ph2_method
->initiate(this->ph2_method
, &this->out
);
362 this->start_phase2
= FALSE
;
365 this->start_phase2_id
= TRUE
;
369 code
= this->out
->get_code(this->out
);
370 type
= this->out
->get_type(this->out
, &vendor
);
371 if (code
== EAP_REQUEST
|| code
== EAP_RESPONSE
)
373 DBG1(DBG_IKE
, "sending tunneled EAP-PEAP AVP [EAP/%N/%N]",
374 eap_code_short_names
, code
, eap_type_short_names
, type
);
378 DBG1(DBG_IKE
, "sending tunneled EAP-PEAP AVP [EAP/%N]",
379 eap_code_short_names
, code
);
382 /* get the raw EAP message data */
383 data
= this->out
->get_data(this->out
);
384 DBG3(DBG_IKE
, "%B", &data
);
385 this->avp
->build(this->avp
, writer
, data
);
387 this->out
->destroy(this->out
);
390 return INVALID_STATE
;
393 METHOD(tls_application_t
, destroy
, void,
394 private_eap_peap_server_t
*this)
396 this->server
->destroy(this->server
);
397 this->peer
->destroy(this->peer
);
398 DESTROY_IF(this->ph2_method
);
399 DESTROY_IF(this->out
);
400 this->avp
->destroy(this->avp
);
407 eap_peap_server_t
*eap_peap_server_create(identification_t
*server
,
408 identification_t
*peer
,
409 eap_method_t
*eap_method
)
411 private_eap_peap_server_t
*this;
421 .server
= server
->clone(server
),
422 .peer
= peer
->clone(peer
),
423 .ph1_method
= eap_method
,
424 .start_phase2
= TRUE
,
425 .start_phase2_tnc
= TRUE
,
426 .start_phase2_id
= lib
->settings
->get_bool(lib
->settings
,
427 "%s.plugins.eap-peap.phase2_piggyback",
428 FALSE
, charon
->name
),
429 .phase2_result
= EAP_FAILURE
,
430 .avp
= eap_peap_avp_create(TRUE
),
433 return &this->public;