src/libcharon/plugins/eap_peap/eap_peap_server.c

   1 /*
   2  * Copyright (C) 2011 Andreas Steffen
   3  *
   4  * Copyright (C) secunet Security Networks AG
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2 of the License, or (at your
   9  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  10  *
  11  * This program is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * for more details.
  15  */
  16
  17 #include "eap_peap_server.h"
  18 #include "eap_peap_avp.h"
  19
  20 #include <utils/debug.h>
  21 #include <daemon.h>
  22
  23 typedef struct private_eap_peap_server_t private_eap_peap_server_t;
  24
  25 /**
  26  * Private data of an eap_peap_server_t object.
  27  */
  28 struct private_eap_peap_server_t {
  29
  30         /**
  31          * Public eap_peap_server_t interface.
  32          */
  33         eap_peap_server_t public;
  34
  35         /**
  36          * Server identity
  37          */
  38         identification_t *server;
  39
  40         /**
  41          * Peer identity
  42          */
  43         identification_t *peer;
  44
  45         /**
  46          * Current EAP-PEAP phase2 state
  47          */
  48         bool start_phase2;
  49
  50         /**
  51          * Current EAP-PEAP phase2 TNC state
  52          */
  53         bool start_phase2_tnc;
  54
  55         /**
  56          * Starts phase 2 with EAP Identity request
  57          */
  58         bool start_phase2_id;
  59
  60         /**
  61          * Final EAP-PEAP phase2 result
  62          */
  63         eap_code_t phase2_result;
  64
  65         /**
  66      * Outer phase 1 EAP method
  67          */
  68         eap_method_t *ph1_method;
  69
  70         /**
  71      * Current phase 2 EAP method
  72          */
  73         eap_method_t *ph2_method;
  74
  75         /**
  76      * Pending outbound EAP message
  77          */
  78         eap_payload_t *out;
  79
  80         /**
  81          * AVP handler
  82          */
  83         eap_peap_avp_t *avp;
  84 };
  85
  86 /**
  87  * Start EAP client authentication protocol
  88  */
  89 static status_t start_phase2_auth(private_eap_peap_server_t *this)
  90 {
  91         char *eap_type_str;
  92         eap_type_t type;
  93
  94         eap_type_str = lib->settings->get_str(lib->settings,
  95                                                         "%s.plugins.eap-peap.phase2_method", "mschapv2",
  96                                                         lib->ns);
  97         type = eap_type_from_string(eap_type_str);
  98         if (type == 0)
  99         {
 100                 DBG1(DBG_IKE, "unrecognized phase2 method \"%s\"", eap_type_str);
 101                 return FAILED;
 102         }
 103         DBG1(DBG_IKE, "phase2 method %N selected", eap_type_names, type);
 104                 this->ph2_method = charon->eap->create_instance(charon->eap, type, 0,
 105                                                                 EAP_SERVER, this->server, this->peer);
 106         if (this->ph2_method == NULL)
 107         {
 108                 DBG1(DBG_IKE, "%N method not available", eap_type_names, type);
 109                 return FAILED;
 110         }
 111
 112         /* synchronize EAP message identifiers of inner protocol with outer */
 113         this->ph2_method->set_identifier(this->ph2_method,
 114                                                 this->ph1_method->get_identifier(this->ph1_method) + 1);
 115
 116         if (this->ph2_method->initiate(this->ph2_method, &this->out) == NEED_MORE)
 117         {
 118                 return NEED_MORE;
 119         }
 120         else
 121         {
 122                 DBG1(DBG_IKE, "%N method failed", eap_type_names, type);
 123                         return FAILED;
 124         }
 125 }
 126
 127 /**
 128  * If configured, start EAP-TNC protocol
 129  */
 130 static status_t start_phase2_tnc(private_eap_peap_server_t *this)
 131 {
 132         if (this->start_phase2_tnc && lib->settings->get_bool(lib->settings,
 133                                                 "%s.plugins.eap-peap.phase2_tnc", FALSE, lib->ns))
 134         {
 135                 DBG1(DBG_IKE, "phase2 method %N selected", eap_type_names, EAP_TNC);
 136                 this->ph2_method = charon->eap->create_instance(charon->eap, EAP_TNC,
 137                                                                         0, EAP_SERVER, this->server, this->peer);
 138                 if (this->ph2_method == NULL)
 139                 {
 140                         DBG1(DBG_IKE, "%N method not available", eap_type_names, EAP_TNC);
 141                         return FAILED;
 142                 }
 143                 this->start_phase2_tnc = FALSE;
 144
 145                 /* synchronize EAP message identifiers of inner protocol with outer */
 146                 this->ph2_method->set_identifier(this->ph2_method,
 147                                                 this->ph1_method->get_identifier(this->ph1_method) + 1);
 148
 149                 if (this->ph2_method->initiate(this->ph2_method, &this->out) == NEED_MORE)
 150                 {
 151                         return NEED_MORE;
 152                 }
 153                 else
 154                 {
 155                         DBG1(DBG_IKE, "%N method failed", eap_type_names, EAP_TNC);
 156                         return FAILED;
 157                 }
 158         }
 159         return SUCCESS;
 160 }
 161
 162 METHOD(tls_application_t, process, status_t,
 163         private_eap_peap_server_t *this, bio_reader_t *reader)
 164 {
 165         chunk_t data = chunk_empty;
 166         status_t status;
 167         payload_t *payload;
 168         eap_payload_t *in;
 169         eap_code_t code;
 170         eap_type_t type = EAP_NAK, received_type;
 171         uint32_t vendor, received_vendor;
 172
 173         status = this->avp->process(this->avp, reader, &data,
 174                                                         this->ph1_method->get_identifier(this->ph1_method));
 175         switch (status)
 176         {
 177                 case SUCCESS:
 178                         break;
 179                 case NEED_MORE:
 180                         return NEED_MORE;
 181                 case FAILED:
 182                 default:
 183                         return FAILED;
 184         }
 185
 186         in = eap_payload_create_data(data);
 187         DBG3(DBG_IKE, "%B", &data);
 188         chunk_free(&data);
 189         payload = (payload_t*)in;
 190
 191         if (payload->verify(payload) != SUCCESS)
 192         {
 193                 in->destroy(in);
 194                 return FAILED;
 195         }
 196
 197         code = in->get_code(in);
 198         if (code == EAP_REQUEST || code == EAP_RESPONSE)
 199         {
 200                 received_type = in->get_type(in, &received_vendor);
 201                 DBG1(DBG_IKE, "received tunneled EAP-PEAP AVP [EAP/%N/%N]",
 202                                                                 eap_code_short_names, code,
 203                                                                 eap_type_short_names, received_type);
 204                 if (code != EAP_RESPONSE)
 205                 {
 206                         DBG1(DBG_IKE, "%N expected", eap_code_names, EAP_RESPONSE);
 207                         in->destroy(in);
 208                         return FAILED;
 209                 }
 210         }
 211         else
 212         {
 213                 DBG1(DBG_IKE, "received tunneled EAP-PEAP AVP [EAP/%N]",
 214                                                                 eap_code_short_names, code);
 215                 in->destroy(in);
 216                 /* if EAP_SUCCESS check if to continue phase2 with EAP-TNC */
 217                 return (this->phase2_result == EAP_SUCCESS && code == EAP_SUCCESS) ?
 218                            start_phase2_tnc(this) : FAILED;
 219         }
 220
 221         if (this->ph2_method)
 222         {
 223                 type = this->ph2_method->get_type(this->ph2_method, &vendor);
 224
 225                 if (type != received_type || vendor != received_vendor)
 226                 {
 227                         if (received_vendor == 0 && received_type == EAP_NAK)
 228                         {
 229                                 DBG1(DBG_IKE, "peer does not support %N", eap_type_names, type);
 230                         }
 231                         else
 232                         {
 233                                 DBG1(DBG_IKE, "received invalid EAP response");
 234                         }
 235                         in->destroy(in);
 236                         return FAILED;
 237                 }
 238         }
 239
 240         if (!received_vendor && received_type == EAP_IDENTITY)
 241         {
 242                 chunk_t eap_id;
 243
 244                 if (this->ph2_method == NULL)
 245                 {
 246                         /* Received an EAP Identity response without a matching request */
 247                         this->ph2_method = charon->eap->create_instance(charon->eap,
 248                                                                                          EAP_IDENTITY, 0, EAP_SERVER,
 249                                                                                          this->server, this->peer);
 250                         if (this->ph2_method == NULL)
 251                         {
 252                                 DBG1(DBG_IKE, "%N method not available",
 253                                                            eap_type_names, EAP_IDENTITY);
 254                                 in->destroy(in);
 255                                 return FAILED;
 256                         }
 257                 }
 258
 259                 if (this->ph2_method->process(this->ph2_method, in, &this->out) != SUCCESS)
 260                 {
 261
 262                         DBG1(DBG_IKE, "%N method failed", eap_type_names, EAP_IDENTITY);
 263                         in->destroy(in);
 264                         return FAILED;
 265                 }
 266
 267                 if (this->ph2_method->get_msk(this->ph2_method, &eap_id) == SUCCESS)
 268                 {
 269                         this->peer->destroy(this->peer);
 270                         this->peer = identification_create_from_data(eap_id);
 271                         DBG1(DBG_IKE, "received EAP identity '%Y'", this->peer);
 272                 }
 273
 274                 in->destroy(in);
 275                 this->ph2_method->destroy(this->ph2_method);
 276                 this->ph2_method = NULL;
 277
 278                 /* Start Phase 2 of EAP-PEAP authentication */
 279                 if (lib->settings->get_bool(lib->settings,
 280                                         "%s.plugins.eap-peap.request_peer_auth", FALSE, lib->ns))
 281                 {
 282                         return start_phase2_tnc(this);
 283                 }
 284                 else
 285                 {
 286                         return start_phase2_auth(this);
 287                 }
 288         }
 289
 290         if (this->ph2_method == 0)
 291         {
 292                 DBG1(DBG_IKE, "no %N phase2 method installed", eap_type_names, EAP_PEAP);
 293                 in->destroy(in);
 294                 return FAILED;
 295         }
 296
 297         status = this->ph2_method->process(this->ph2_method, in, &this->out);
 298         in->destroy(in);
 299
 300         switch (status)
 301         {
 302                 case SUCCESS:
 303                         DBG1(DBG_IKE, "%N phase2 authentication of '%Y' with %N successful",
 304                                                         eap_type_names, EAP_PEAP, this->peer,
 305                                                         eap_type_names, type);
 306                         this->ph2_method->destroy(this->ph2_method);
 307                         this->ph2_method = NULL;
 308
 309                         /* EAP-PEAP requires the sending of an inner EAP_SUCCESS message */
 310                         this->phase2_result = EAP_SUCCESS;
 311                         this->out = eap_payload_create_code(this->phase2_result, 1 +
 312                                                         this->ph1_method->get_identifier(this->ph1_method));
 313                         return NEED_MORE;
 314                 case NEED_MORE:
 315                         break;
 316                 case FAILED:
 317                 default:
 318                         if (vendor)
 319                         {
 320                                 DBG1(DBG_IKE, "vendor specific EAP method %d-%d failed",
 321                                                            type, vendor);
 322                         }
 323                         else
 324                         {
 325                                 DBG1(DBG_IKE, "%N method failed", eap_type_names, type);
 326                         }
 327                         /* EAP-PEAP requires the sending of an inner EAP_FAILURE message */
 328                         this->phase2_result = EAP_FAILURE;
 329                         this->out = eap_payload_create_code(this->phase2_result, 1 +
 330                                                         this->ph1_method->get_identifier(this->ph1_method));
 331                         return NEED_MORE;
 332         }
 333         return status;
 334 }
 335
 336 METHOD(tls_application_t, build, status_t,
 337         private_eap_peap_server_t *this, bio_writer_t *writer)
 338 {
 339         chunk_t data;
 340         eap_code_t code;
 341         eap_type_t type;
 342         uint32_t vendor;
 343
 344         if (this->ph2_method == NULL && this->start_phase2 && this->start_phase2_id)
 345         {
 346                 /*
 347                  * Start Phase 2 with an EAP Identity request either piggybacked right
 348                  * onto the TLS Finished payload or delayed after the reception of an
 349                  * empty EAP Acknowledge message.
 350                  */
 351                 this->ph2_method = charon->eap->create_instance(charon->eap, EAP_IDENTITY,
 352                                                                  0,     EAP_SERVER, this->server, this->peer);
 353                 if (this->ph2_method == NULL)
 354                 {
 355                         DBG1(DBG_IKE, "%N method not available",
 356                                  eap_type_names, EAP_IDENTITY);
 357                         return FAILED;
 358                 }
 359
 360                 /* synchronize EAP message identifiers of inner protocol with outer */
 361                 this->ph2_method->set_identifier(this->ph2_method,
 362                                         this->ph1_method->get_identifier(this->ph1_method));
 363
 364                 this->ph2_method->initiate(this->ph2_method, &this->out);
 365                 this->start_phase2 = FALSE;
 366         }
 367
 368         this->start_phase2_id = TRUE;
 369
 370         if (this->out)
 371         {
 372                 code = this->out->get_code(this->out);
 373                 type = this->out->get_type(this->out, &vendor);
 374                 if (code == EAP_REQUEST || code == EAP_RESPONSE)
 375                 {
 376                         DBG1(DBG_IKE, "sending tunneled EAP-PEAP AVP [EAP/%N/%N]",
 377                                  eap_code_short_names, code, eap_type_short_names, type);
 378                 }
 379                 else
 380                 {
 381                         DBG1(DBG_IKE, "sending tunneled EAP-PEAP AVP [EAP/%N]",
 382                                  eap_code_short_names, code);
 383                 }
 384
 385                 /* get the raw EAP message data */
 386                 data = this->out->get_data(this->out);
 387                 DBG3(DBG_IKE, "%B", &data);
 388                 this->avp->build(this->avp, writer, data);
 389
 390                 this->out->destroy(this->out);
 391                 this->out = NULL;
 392         }
 393         return INVALID_STATE;
 394 }
 395
 396 METHOD(tls_application_t, destroy, void,
 397         private_eap_peap_server_t *this)
 398 {
 399         this->server->destroy(this->server);
 400         this->peer->destroy(this->peer);
 401         DESTROY_IF(this->ph2_method);
 402         DESTROY_IF(this->out);
 403         this->avp->destroy(this->avp);
 404         free(this);
 405 }
 406
 407 /**
 408  * See header
 409  */
 410 eap_peap_server_t *eap_peap_server_create(identification_t *server,
 411                                                                                   identification_t *peer,
 412                                                                                   eap_method_t *eap_method)
 413 {
 414         private_eap_peap_server_t *this;
 415
 416         INIT(this,
 417                 .public = {
 418                         .application = {
 419                                 .process = _process,
 420                                 .build = _build,
 421                                 .destroy = _destroy,
 422                         },
 423                 },
 424                 .server = server->clone(server),
 425                 .peer = peer->clone(peer),
 426                 .ph1_method = eap_method,
 427                 .start_phase2 = TRUE,
 428                 .start_phase2_tnc = TRUE,
 429                 .start_phase2_id = lib->settings->get_bool(lib->settings,
 430                                                                                 "%s.plugins.eap-peap.phase2_piggyback",
 431                                                                                 FALSE, lib->ns),
 432                 .phase2_result = EAP_FAILURE,
 433                 .avp = eap_peap_avp_create(TRUE),
 434         );
 435
 436         return &this->public;
 437 }