Fixed interoperability issue with PEAPv0 cryptobinding and NPS

Windows Server 2008 NPS gets very confused if the TLS Message Length is
not included in the Phase 1 messages even if fragmentation is not used.
If the TLS Message Length field is not included in ClientHello message,
NPS seems to decide to use the ClientHello data (excluding first six
octets, i.e., EAP header, type, Flags) as the OuterTLVs data in
Cryptobinding Compound_MAC calculation (per PEAPv2; not MS-PEAP)..

Lets add the TLS Message Length to PEAPv0 Phase 1 messages to get rid of
this issue. This seems to fix Cryptobinding issues with NPS and PEAPv0
is now using optional Cryptobinding by default (again) since there are
no known interop issues with it anymore.

diff --git a/src/eap_peer/eap_peap.c b/src/eap_peer/eap_peap.c
index 11c93ded7630e017b248ad86f875cf0268e709d8..894fc632fda369815cfda8bac3ab5b061d0b6250 100644 (file)
--- a/src/eap_peer/eap_peap.c
+++ b/src/eap_peer/eap_peap.c
@@ -147,7 +147,7 @@ static void * eap_peap_init(struct eap_sm *sm)
        data->peap_version = EAP_PEAP_VERSION;
        data->force_peap_version = -1;
        data->peap_outer_success = 2;
-       data->crypto_binding = NO_BINDING;
+       data->crypto_binding = OPTIONAL_BINDING;
 
        if (config && config->phase1 &&
            eap_peap_parse_phase1(data, config->phase1) < 0) {

diff --git a/src/eap_peer/eap_tls_common.c b/src/eap_peer/eap_tls_common.c
index 9ff4eed8d7ee2bd1e4fe309d29d9cb614dc7de5e..5db8bf666313d1c270e7cccac39234d4c212ce22 100644 (file)
--- a/src/eap_peer/eap_tls_common.c
+++ b/src/eap_peer/eap_tls_common.c
@@ -501,6 +501,17 @@ static int eap_tls_process_output(struct eap_ssl_data *data, EapType eap_type,
        length_included = data->tls_out_pos == 0 &&
                (data->tls_out_len > data->tls_out_limit ||
                 data->include_tls_length);
+       if (!length_included &&
+           eap_type == EAP_TYPE_PEAP && peap_version == 0 &&
+           !tls_connection_established(data->eap->ssl_ctx, data->conn)) {
+               /*
+                * Windows Server 2008 NPS really wants to have the TLS Message
+                * length included in phase 0 even for unfragmented frames or
+                * it will get very confused with Compound MAC calculation and
+                * Outer TLVs.
+                */
+               length_included = 1;
+       }
 
        *out_data = eap_msg_alloc(EAP_VENDOR_IETF, eap_type,
                                  1 + length_included * 4 + len,

diff --git a/wpa_supplicant/ChangeLog b/wpa_supplicant/ChangeLog
index 2ba86a506ec5ee0461b82ad3a43b77f78b388586..14ad8ceb91dcb5b11f09c9ab758a4ece8c77df5a 100644 (file)
--- a/wpa_supplicant/ChangeLog
+++ b/wpa_supplicant/ChangeLog
@@ -12,6 +12,8 @@ ChangeLog for wpa_supplicant
          manage WPS negotiation; see README-WPS for more details
        * added support for EAP-AKA' (draft-arkko-eap-aka-kdf)
        * added support for using driver_test over UDP socket
+       * fixed PEAPv0 Cryptobinding interoperability issue with Windows Server
+         2008 NPS; optional cryptobinding is now enabled (again) by default
 
 2008-11-23 - v0.6.6
        * added Milenage SIM/USIM emulator for EAP-SIM/EAP-AKA