From: Alan T. DeKok Date: Wed, 31 Jul 2019 17:37:31 +0000 (-0400) Subject: remove LEAP from the server. X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bfded6915c9318e4da76cf68043aed97b89c14cf;p=thirdparty%2Ffreeradius-server.git remove LEAP from the server. No one should be using it. --- diff --git a/doc/howto/modules/eap.md b/doc/howto/modules/eap.md index 9632d042e42..7068f200418 100644 --- a/doc/howto/modules/eap.md +++ b/doc/howto/modules/eap.md @@ -91,7 +91,6 @@ Path | Description `rlm_eap/types/rlm_eap_tls` | EAP-TLS based authentication. `rlm_eap/types/rlm_eap_ttls` | TTLS based authentication. `rlm_eap/types/rlm_eap_peap` | Windows PEAP based authentication. -`rlm_eap/types/rlm_eap_leap` | Cisco LEAP authentication. `rlm_eap/types/rlm_eap_sim` | EAP-SIM (GSM) based authentication ## Configuration @@ -211,12 +210,6 @@ In radiusd.conf process Access-Request { eap } - - # If you are proxying EAP-LEAP requests - # This is required to make LEAP work. - post-proxy { - eap - } ``` 2. My Userbase is in LDAP and I want to use EAP-MD5 authentication @@ -336,7 +329,7 @@ MD5-Challenge. ## Installation -EAP, EAP-MD5, and Cisco LEAP do not require any additional packages. +EAP, EAP-MD5, and EAP-MSCHAPv2 do not require any additional packages. Freeradius contains all the required packages. For EAP-TLS, EAP-TTLS, and PEAP, OPENSSL, , diff --git a/doc/rfc/leap.txt b/doc/rfc/leap.txt deleted file mode 100644 index 29b62f3f111..00000000000 --- a/doc/rfc/leap.txt +++ /dev/null @@ -1,156 +0,0 @@ - Cisco LEAP protocol description - - CLEAP = Cisco LEAP - LEAP = Lightweight EAP - EAP = Extensible Authentication Protocol - - _________________________________________________________________ - -by: - cameron macnally - -date: - Thu, 6 Sep 2001 03:39:40 -0700 (PDT) - -generated from - http://lists.cistron.nl/pipermail/cistron-radius/2001-September/002042.html - -Adam Sulmicki - since I could not find any ASCII version I took above html version - and formated it as it is below. - -Alan DeKok - The information in the original posting wasn't entirely - correct, but it was close. This updated version is correct, - and contains additional specifics not found in the original post. - - _________________________________________________________________ - - -This document describes the LEAP authentication protocol as used by Cisco -Aironet wireless routers etc. It was deduced by analysis of packets passed -between an Aironet and Cisco ACS. - -Relevant RFCs are: 2284, 2716, 2433. - -LEAP is a type of Radius EAP protocol (see RFC draft-ietf-radius-eap-05.txt -"Extensible Authentication Protocol Support in RADIUS"). The EAP type for -LEAP is 17 (0x11). It is used to authenticate access by a wireless client -(typically a laptop or pc) to a wireless router, typically a Cisco Aironet -base station. - -Definitions -AP: Access Point (the Aironet base station) -RS: Radius Server -APC: Access Point Challenge -APR: Access Point Response -PC: Peer Challenge -PR: Peer Response -PW: Users plaintext ASCII password -SK: Session Key -SS: Shared Secret shared between AP (or upstream proxy) and RS -AUTH: The 16 octet Radius authenticator of the incomintg request - -A typical successful LEAP authentication sequence consists of the -following Radius packets passed between the wireless access point (AP) and -the Radius server (RS). Each packet contains an EAP-Message as described -below. The EAP Message-Authenticator attribute is always present as usual -for EAP. - -The general description of the protocol is: - -1. AP->RS: Access-Request/EAP Identity, containing the name of the - user to be authenticated - -2. RS->AP: Access-Challenge/EAP Request/LEAP, containing a 8 octet random - MSCHAP Peer Challenge (PC) + State - -3. AP->RS: Access-Request/EAP Response/LEAP, containing the 24 octet MSCHAP - response to the challenge in 2 above (PR) + State - -4. RS->AP: Access-Challenge/EAP Success (with EAP id++) - + State (may be different than the satate send in <2>) - -5. AP->RS: Access-Request/EAP Request/LEAP, containing 8 octet Access Point - Challenge (APC) + State - -6. RS->AP: Radius Access-Accept/EAP Response/LEAP, containing 24 octet - response to the challenge in 5 above (APR), plus a session key sent - in a cisco-avpair vendor-specific attribute: - - Cisco-AVPair = "leap:session-key=..." - - where the '...' are 34 binary octets of encrypted data. This data MUST - follow the '=', and is NOT in ASCII. - -LEAP data is carried in an EAP-Message in the Type-Data subfield. The -format of the Type-Data subfield is: - -1 octet LEAP protocol version number, currently always 0x01. -1 unused octet, currently always 0x00. -1 octet byte count for the following binary data -m octets of binary data -n octets, the name of the user being authenticated - -So, for example, packet 2 in the above sequence, containg the access point -challenge (APC) would contain an EAP-Message Request (Code 0x01) attribute -something like this: - - 0 1 2 3 - 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 - - +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ - | Code 0x01 | Identifier | Length | - - +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ - | Type 0x11 | Version 0x01 | Unused 0x00 | Count 0x08 | - - +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ - | Peer Challenge | - - +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ - | Peer Challenge | - - +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ - | User Name ..... - +-+-+-+-+-+-+-+-+-+-+-+-+-+- - - -Count is 8 octets since the Peer challenge is 8 bytes. -count is 24 for EAP response, with MSCHAP response. -Length is the total number of octets in the EAP-Message. - -The Session Key (SK) is sent from RS to AP in the final packet. It is -carried in a cisco-avpair vendor specific radius attribute. The value of -the attribute is: "leap:session-key=nnnn" where nnnn is 34 octets of -binary data as described in SK below. - -Algorithms for each field are described below. Function names are those -from RFC 2433. '+' means concatenation. mppe_encrypt is the algorithm for -encrypting MS-MPPE-Send-Key as described in RFC 2548.txt, which is -also the same as the 'Tunnel-Password' encryption. - -PC: 8 octets random binary data sent to AP - -PR: 24 octets NtChallengeResponse(PC, Unicode(PW)) - e.g. AP sends MS-CHAP response to RADIUS server challenge. - -APC: 8 octets random binary data sent by the AP - -MPPEHASH: 16 octets NtPasswordHash(NtPasswordHash(Unicode(PW)))) - -APR: 24 octets ChallengeResponse(APC, MPPEHASH) - e.g. RADIUS server sends MS-CHAP response to AP challenge. - -SK: 34 octets mppe_encrypt(SS, AUTH,MD5Digest(MPPEHASH + APC + APR + PC + PR)) - via rad_tunnel_pwencode() - -Notes: -1. Some versions of Cisco ACS incorrectly drop the first 2 bytes of the -user name at the end of the EAP-MEssage in the Peer Challenge packet. - -2. If the user name does not exist, the response to packet 1 is a - Radius Access-Reject/EAP Failure - - _________________________________________________________________ - diff --git a/doc/upgrade/README.adoc b/doc/upgrade/README.adoc index c0e47aa681a..f55206d8f29 100644 --- a/doc/upgrade/README.adoc +++ b/doc/upgrade/README.adoc @@ -544,6 +544,11 @@ preferable to having them hard-coded in C. The `+virtual_server+` configuration has been removed from EAP-PWD. The module now looks for &request.control:Cleartext-Password. +=== rlm_eap_leap + +The LEAP protocol has been removed from the server. It is insecure, +non-standard, and should not be used. + === rlm_exec Exec-Program and Exec-Program-Wait have been removed. diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap index 11a3ef6becb..48ddcabb513 100644 --- a/raddb/mods-available/eap +++ b/raddb/mods-available/eap @@ -70,7 +70,6 @@ eap { # type = md5 # type = pwd -# type = leap type = gtc type = tls type = ttls @@ -107,24 +106,6 @@ eap { # fragment_size:: This has the same meaning as for TLS. # # fragment_size = 1020 -# } - - # - # ### Cisco LEAP - # - # [WARNING] - # ==== - # We do not recommend using LEAP in new deployments. - # See: http://www.securiteam.com/tools/5TP012ACKE.html - # ==== - # - # Cisco LEAP uses the MS-CHAP algorithm (but not the MS-CHAP - # attributes) to perform it's authentication. - # - # As a result, LEAP *requires* access to the plain-text User-Password, - # or the NT-Password attributes. - # -# leap { # } # diff --git a/scripts/travis/eapol_test/config_freebsd b/scripts/travis/eapol_test/config_freebsd index aedb671d608..3a61525cd5c 100644 --- a/scripts/travis/eapol_test/config_freebsd +++ b/scripts/travis/eapol_test/config_freebsd @@ -125,7 +125,7 @@ CONFIG_EAP_PWD=y CONFIG_EAP_PAX=y # LEAP -CONFIG_EAP_LEAP=y +CONFIG_EAP_LEAP=n # EAP-AKA (enable CONFIG_PCSC, if EAP-AKA is used) CONFIG_EAP_AKA=y diff --git a/scripts/travis/eapol_test/config_linux b/scripts/travis/eapol_test/config_linux index dc2747db063..5c46ea24d17 100644 --- a/scripts/travis/eapol_test/config_linux +++ b/scripts/travis/eapol_test/config_linux @@ -125,7 +125,7 @@ CONFIG_EAP_PWD=y CONFIG_EAP_PAX=y # LEAP -CONFIG_EAP_LEAP=y +CONFIG_EAP_LEAP=n # EAP-AKA (enable CONFIG_PCSC, if EAP-AKA is used) CONFIG_EAP_AKA=y diff --git a/scripts/travis/eapol_test/config_osx b/scripts/travis/eapol_test/config_osx index 3a38560e16a..eb3aa352d9e 100644 --- a/scripts/travis/eapol_test/config_osx +++ b/scripts/travis/eapol_test/config_osx @@ -125,7 +125,7 @@ CONFIG_EAP_PWD=y CONFIG_EAP_PAX=y # LEAP -CONFIG_EAP_LEAP=y +CONFIG_EAP_LEAP=n # EAP-AKA (enable CONFIG_PCSC, if EAP-AKA is used) CONFIG_EAP_AKA=y diff --git a/src/lib/eap/compose.c b/src/lib/eap/compose.c index 8b67a88fff6..6ea7f374c15 100644 --- a/src/lib/eap/compose.c +++ b/src/lib/eap/compose.c @@ -166,11 +166,6 @@ rlm_rcode_t eap_compose(eap_session_t *eap_session) /* * The Id for the EAP packet to the NAS wasn't set. * Do so now. - * - * LEAP requires the Id to be incremented on EAP-Success - * in Stage 4, so that we can carry on the conversation - * where the client asks us to authenticate ourselves - * in stage 5. */ if (!eap_round->set_request_id) { /* @@ -256,7 +251,7 @@ rlm_rcode_t eap_compose(eap_session_t *eap_session) if (!request->reply->code) switch (reply->code) { case FR_EAP_CODE_RESPONSE: request->reply->code = FR_CODE_ACCESS_ACCEPT; - rcode = RLM_MODULE_HANDLED; /* leap weirdness */ + rcode = RLM_MODULE_HANDLED; break; case FR_EAP_CODE_SUCCESS: diff --git a/src/modules/rlm_eap/rlm_eap.c b/src/modules/rlm_eap/rlm_eap.c index be470668252..e4092e4d87a 100644 --- a/src/modules/rlm_eap/rlm_eap.c +++ b/src/modules/rlm_eap/rlm_eap.c @@ -370,25 +370,10 @@ static rlm_rcode_t mod_authenticate_result(REQUEST *request, UNUSED void *instan rcode = eap_compose(eap_session); /* - * Add to the list only if it is EAP-Request, OR if - * it's LEAP, and a response. + * Add to the list only if it is EAP-Request. */ - if (((eap_session->this_round->request->code == FR_EAP_CODE_REQUEST) && - (eap_session->this_round->request->type.num >= FR_EAP_METHOD_MD5)) || - - /* - * LEAP is a little different. At Stage 4, - * it sends an EAP-Success message, but we still - * need to keep the State attribute & session - * data structure around for the AP Challenge. - * - * At stage 6, LEAP sends an EAP-Response, which - * isn't put into the list. - */ - ((eap_session->this_round->response->code == FR_EAP_CODE_RESPONSE) && - (eap_session->this_round->response->type.num == FR_EAP_METHOD_LEAP) && - (eap_session->this_round->request->code == FR_EAP_CODE_SUCCESS) && - (eap_session->this_round->request->type.num == 0))) { + if ((eap_session->this_round->request->code == FR_EAP_CODE_REQUEST) && + (eap_session->this_round->request->type.num >= FR_EAP_METHOD_MD5)) { talloc_free(eap_session->prev_round); eap_session->prev_round = eap_session->this_round; eap_session->this_round = NULL; @@ -748,15 +733,14 @@ static rlm_rcode_t mod_post_proxy(void *instance, UNUSED void *thread, REQUEST * eap_compose(eap_session); /* - * Add to the list only if it is EAP-Request, OR if - * it's LEAP, and a response. + * Add to the list only if it is EAP-Request. */ if ((eap_session->this_round->request->code == FR_EAP_CODE_REQUEST) && (eap_session->this_round->request->type.num >= FR_EAP_METHOD_MD5)) { talloc_free(eap_session->prev_round); eap_session->prev_round = eap_session->this_round; eap_session->this_round = NULL; - } else { /* couldn't have been LEAP, there's no tunnel */ + } else { RDEBUG2("Freeing eap_session"); eap_session_destroy(&eap_session); } @@ -781,87 +765,7 @@ static rlm_rcode_t mod_post_proxy(void *instance, UNUSED void *thread, REQUEST * /* * This is allowed. */ - if (!request->proxy->reply) return RLM_MODULE_NOOP; - - /* - * Hmm... there's got to be a better way to - * discover codes for vendor attributes. - * - * This is vendor Cisco (9), Cisco-AVPair - * attribute (1) - */ - for (vp = fr_cursor_iter_by_da_init(&cursor, &request->proxy->reply->vps, attr_cisco_avpair); - vp; - vp = fr_cursor_next(&cursor)) { - /* - * If it's "leap:session-key", then stop. - * - * The format is VERY specific! - */ - if (strncasecmp(vp->vp_strvalue, "leap:session-key=", 17) == 0) break; - } - - /* - * Got to the end without finding "leap:session-key=" - */ - if (!vp) return RLM_MODULE_NOOP; - - /* - * The format is very specific. - * - * - 17 bytes are "leap:session-key=" - * - 32 are the hex encoded session key. - * - 2 bytes are the salt. - */ - if (vp->vp_length != (17 + 34)) { - RDEBUG2("&Cisco-AVPair with leap:session-key has incorrect length. Got %zu, expected %d", - vp->vp_length, 17 + 34); - return RLM_MODULE_NOOP; - } - - /* - * Decrypt the session key, using the proxy data. - * - * Note that the session key is *binary*, and therefore - * may contain embedded zeros. So we have to use memdup. - * However, Cisco-AVPair is a "string", so the rest of the - * code assumes that it's terminated by a trailing '\0'. - * - * So... be sure to (a) use memdup, and (b) include the last - * zero byte. - */ - i = 34; - p = talloc_memdup(vp, vp->vp_strvalue, vp->vp_length + 1); - talloc_set_type(p, uint8_t); -/* - ret = fr_radius_decode_tunnel_password((uint8_t *)p + 17, &i, request->proxy->home_server->secret, - request->proxy->packet->vector, false); - if (ret < 0) { - REDEBUG("Decoding leap:session-key failed"); - talloc_free(p); - return RLM_MODULE_FAIL; - } -*/ - len = i; - if (len != 16) { - REDEBUG("Decoded key length is incorrect, must be 16 bytes"); - talloc_free(p); - return RLM_MODULE_FAIL; - } - - /* - * Encrypt the session key again, using the request data. - */ - ret = fr_radius_encode_tunnel_password(p + 17, &len, request->client->secret, request->packet->vector); - if (ret < 0) { - REDEBUG("Encoding leap:session-key failed"); - talloc_free(p); - return RLM_MODULE_FAIL; - } - - fr_pair_value_strsteal(vp, p); - - return RLM_MODULE_UPDATED; + return RLM_MODULE_NOOP; } #endif diff --git a/src/modules/rlm_eap/types/rlm_eap_leap/README.md b/src/modules/rlm_eap/types/rlm_eap_leap/README.md deleted file mode 100644 index f91446f5c9a..00000000000 --- a/src/modules/rlm_eap/types/rlm_eap_leap/README.md +++ /dev/null @@ -1,11 +0,0 @@ -# rlm_eap_leap -## Metadata -
-
category
authentication
-
- -## Summary -Implements Cisco's EAP-LEAP protocol. EAP-LEAP has multiple critical security vulnerabilities, this method is -only provided for backwards compatibility. - -If you need to use Cisco proprietary EAP methods, it's recommended to use EAP-FAST instead. diff --git a/src/modules/rlm_eap/types/rlm_eap_leap/all.mk b/src/modules/rlm_eap/types/rlm_eap_leap/all.mk deleted file mode 100644 index baa20aa61bb..00000000000 --- a/src/modules/rlm_eap/types/rlm_eap_leap/all.mk +++ /dev/null @@ -1,13 +0,0 @@ -TARGETNAME := rlm_eap_leap - -ifneq "$(TARGETNAME)" "" -TARGET := $(TARGETNAME).a -endif - -SOURCES := $(TARGETNAME).c eap_leap.c smbdes.c - -SRC_CFLAGS := -TGT_LDLIBS := -SRC_INCDIRS := ${top_srcdir}/src/modules/rlm_eap/ ${top_srcdir}/src/modules/rlm_eap/lib/base/ - -TGT_PREREQS := libfreeradius-radius.a libfreeradius-util.a libfreeradius-eap.a diff --git a/src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.c b/src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.c deleted file mode 100644 index c7e29b885c7..00000000000 --- a/src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.c +++ /dev/null @@ -1,441 +0,0 @@ -/* - * eap_leap.c EAP LEAP functionality. - * - * Version: $Id$ - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA - * - * @copyright 2003 Alan DeKok (aland@freeradius.org) - * @copyright 2006 The FreeRADIUS server project - */ - -/* - * - * LEAP Packet Format in EAP Type-Data - * --- ------ ------ -- --- --------- - * 0 1 2 3 - * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 - * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ - * | Type 0x11 | Version 0x01 | Unused 0x00 | Count 0x08 | - * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ - * | Peer Challenge | - * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ - * | Peer Challenge | - * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ - * | User Name ..... - * +-+-+-+-+-+-+-+-+-+-+-+-+-+- - * - * Count is 8 octets since the Peer challenge is 8 bytes. - * Count is 24 for EAP response, with MSCHAP response. - * Length is the total number of octets in the EAP-Message. - * - * The LEAP type (0x11) is *not* included in the type data... - */ - -RCSID("$Id$") - -#include -#include -#include -#include "eap_leap.h" - -#include - -/* - * Extract the data from the LEAP packet. - */ -leap_packet_t *eap_leap_extract(REQUEST *request, eap_round_t *eap_round) -{ - leap_packet_raw_t *data; - leap_packet_t *packet; - int name_len; - - /* - * LEAP can have EAP-Response or EAP-Request (step 5) - * messages sent to it. - */ - if (!eap_round || !eap_round->response || - ((eap_round->response->code != FR_EAP_CODE_RESPONSE) && (eap_round->response->code != FR_EAP_CODE_REQUEST)) || - (eap_round->response->type.num != FR_EAP_METHOD_LEAP) || !eap_round->response->type.data || - (eap_round->response->length < LEAP_HEADER_LEN) || - (eap_round->response->type.data[0] != 0x01)) { /* version 1 */ - REDEBUG("Corrupted data"); - return NULL; - } - - /* - * Hmm... this cast isn't the best thing to do. - */ - data = (leap_packet_raw_t *)eap_round->response->type.data; - - /* - * Some simple sanity checks on the incoming packet. - * - * See 'leap.txt' in this directory for a description - * of the stages. - */ - switch (eap_round->response->code) { - case FR_EAP_CODE_RESPONSE: - if (data->count != 24) { - REDEBUG("Bad NTChallengeResponse in LEAP stage 3"); - return NULL; - } - break; - - case FR_EAP_CODE_REQUEST: - if (data->count != 8) { - REDEBUG("Bad AP Challenge in LEAP stage 5"); - return NULL; - } - break; - - default: - REDEBUG("Invalid EAP code %d", eap_round->response->code); - return NULL; - } - - packet = talloc(eap_round, leap_packet_t); - if (!packet) return NULL; - - /* - * Remember code, length, and id. - */ - packet->code = eap_round->response->code; - packet->id = eap_round->response->id; - - /* - * The size of the LEAP portion of the packet, not - * counting the EAP header and the type. - */ - packet->length = eap_round->response->length - EAP_HEADER_LEN - 1; - - /* - * Remember the length of the challenge. - */ - packet->count = data->count; - - packet->challenge = talloc_array(packet, uint8_t, packet->count); - if (!packet->challenge) { - talloc_free(packet); - return NULL; - } - memcpy(packet->challenge, data->challenge, packet->count); - - /* - * The User-Name comes after the challenge. - * - * Length of the EAP-LEAP portion of the packet, minus - * 3 octets for data, minus the challenge size, is the - * length of the user name. - */ - name_len = packet->length - 3 - packet->count; - if (name_len > 0) { - packet->name = talloc_array(packet, char, name_len + 1); - if (!packet->name) { - talloc_free(packet); - return NULL; - } - memcpy(packet->name, &data->challenge[packet->count], name_len); - packet->name[name_len] = '\0'; - packet->name_len = name_len; - } - - return packet; -} - -/* - * Get the NT-Password hash. - */ -static int eap_leap_ntpwdhash(uint8_t *out, REQUEST *request, VALUE_PAIR *password) -{ - if ((password->da == attr_user_password) || - (password->da == attr_cleartext_password)) { - ssize_t len; - uint8_t ucs2_password[512]; - - /* - * Convert the password to NT's weird Unicode format. - */ - len = fr_utf8_to_ucs2(ucs2_password, sizeof(ucs2_password), password->vp_strvalue, password->vp_length); - if (len < 0) { - REDEBUG("Error converting password to UCS2"); - return 0; - } - - /* - * Get the NT Password hash. - */ - fr_md4_calc(out, ucs2_password, len); - } else { /* MUST be NT-Password */ - uint8_t *p = NULL; - - if (password->vp_length == 32) { - p = talloc_array(password, uint8_t, 16); - password->vp_length = fr_hex2bin(p, 16, password->vp_strvalue, password->vp_length); - } - if (password->vp_length != 16) { - REDEBUG("Bad NT-Password"); - return 0; - } - - if (p) { - fr_pair_value_memcpy(password, p, 16, password->data.tainted); - talloc_free(p); - } - - memcpy(out, password->vp_octets, 16); - } - return 1; -} - - -/* - * Verify the MS-CHAP response from the user. - */ -int eap_leap_stage4(REQUEST *request, leap_packet_t *packet, VALUE_PAIR *password, leap_session_t *session) -{ - uint8_t hash[16]; - uint8_t response[24]; - - /* - * No password or previous packet. Die. - */ - if ((!password) || (!session)) { - return 0; - } - - if (!eap_leap_ntpwdhash(hash, request, password)) { - return 0; - } - - /* - * Calculate and verify the CHAP challenge. - */ - eap_leap_mschap(hash, session->peer_challenge, response); - if (memcmp(response, packet->challenge, 24) == 0) { - RDEBUG2("NTChallengeResponse from AP is valid"); - memcpy(session->peer_response, response, sizeof(response)); - return 1; - } - REDEBUG("FAILED incorrect NtChallengeResponse from AP"); - - return 0; -} - -/* - * Verify ourselves to the AP - */ -leap_packet_t *eap_leap_stage6(REQUEST *request, leap_packet_t *packet, VALUE_PAIR *user_name, VALUE_PAIR *password, - leap_session_t *session) -{ - size_t i; - uint8_t hash[16], mppe[16]; - uint8_t *p, buffer[256]; - leap_packet_t *reply; - char *q; - VALUE_PAIR *vp; - - /* - * No password or previous packet. Die. - */ - if ((!password) || (!session)) { - return NULL; - } - - reply = talloc(session, leap_packet_t); - if (!reply) return NULL; - - reply->code = FR_EAP_CODE_RESPONSE; - reply->length = LEAP_HEADER_LEN + 24 + user_name->vp_length; - reply->count = 24; - - reply->challenge = talloc_array(reply, uint8_t, reply->count); - if (!reply->challenge) { - talloc_free(reply); - return NULL; - } - - /* - * The LEAP packet also contains the user name. - */ - reply->name = talloc_array(reply, char, user_name->vp_length + 1); - if (!reply->name) { - talloc_free(reply); - return NULL; - } - - /* - * Copy the name over, and ensure it's NUL terminated. - */ - memcpy(reply->name, user_name->vp_strvalue, user_name->vp_length); - reply->name[user_name->vp_length] = '\0'; - reply->name_len = user_name->vp_length; - - /* - * MPPE hash = ntpwdhash(ntpwdhash(unicode(pw))) - */ - if (!eap_leap_ntpwdhash(hash, request, password)) { - talloc_free(reply); - return NULL; - } - fr_md4_calc(mppe, hash, 16); - - /* - * Calculate our response, to authenticate ourselves to the AP. - */ - eap_leap_mschap(mppe, packet->challenge, reply->challenge); - - /* - * Calculate the leap:session-key attribute - */ - MEM(pair_add_reply(&vp, attr_cisco_avpair) >= 0); - - /* - * And calculate the MPPE session key. - */ - p = buffer; - memcpy(p, mppe, 16); /* MPPEHASH */ - p += 16; - memcpy(p, packet->challenge, 8); /* APC */ - p += 8; - memcpy(p, reply->challenge, 24); /* APR */ - p += 24; - memcpy(p, session->peer_challenge, 8); /* PC */ - p += 8; - memcpy(p, session->peer_response, 24); /* PR */ - - /* - * These 16 bytes are the session key to use. - */ - fr_md5_calc(hash, buffer, 16 + 8 + 24 + 8 + 24); - - q = talloc_array(vp, char, FR_TUNNEL_FR_ENC_LENGTH(16) + sizeof("leap:session-key=")); - strcpy(q, "leap:session-key="); - - memcpy(q + 17, hash, 16); - - i = 16; - fr_radius_encode_tunnel_password(q + 17, &i, request->client->secret, request->packet->vector); - fr_pair_value_strsteal(vp, q); - vp->vp_length = 17 + i; - - return reply; -} - -/* - * If an EAP LEAP request needs to be initiated then - * create such a packet. - */ -leap_packet_t *eap_leap_initiate(REQUEST *request, eap_round_t *eap_round, VALUE_PAIR *user_name) -{ - int i; - leap_packet_t *reply; - - reply = talloc(eap_round, leap_packet_t); - if (!reply) { - return NULL; - } - - reply->code = FR_EAP_CODE_REQUEST; - reply->length = LEAP_HEADER_LEN + 8 + user_name->vp_length; - reply->count = 8; /* random challenge */ - - reply->challenge = talloc_array(reply, uint8_t, reply->count); - if (!reply->challenge) { - talloc_free(reply); - return NULL; - } - - /* - * Fill the challenge with random bytes. - */ - for (i = 0; i < reply->count; i++) { - reply->challenge[i] = fr_rand(); - } - RDEBUG2("Issuing AP Challenge"); - - /* - * The LEAP packet also contains the user name. - */ - reply->name = talloc_array(reply, char, user_name->vp_length + 1); - if (!reply->name) { - talloc_free(reply); - return NULL; - } - - /* - * Copy the name over, and ensure it's NUL terminated. - */ - memcpy(reply->name, user_name->vp_strvalue, user_name->vp_length); - reply->name[user_name->vp_length] = '\0'; - reply->name_len = user_name->vp_length; - - return reply; -} - -/* - * compose the LEAP reply packet in the EAP reply typedata - */ -int eap_leap_compose(REQUEST *request, eap_round_t *eap_round, leap_packet_t *reply) -{ - leap_packet_raw_t *data; - - rad_assert(eap_round->request); - rad_assert(reply); - - /* - * We need the name and the challenge. - */ - switch (reply->code) { - case FR_EAP_CODE_REQUEST: - case FR_EAP_CODE_RESPONSE: - eap_round->request->type.num = FR_EAP_METHOD_LEAP; - eap_round->request->type.length = reply->length; - - eap_round->request->type.data = talloc_array(eap_round->request, uint8_t, reply->length); - if (!eap_round->request->type.data) return 0; - - data = (leap_packet_raw_t *) eap_round->request->type.data; - data->version = 0x01; - data->unused = 0; - data->count = reply->count; - - /* - * N bytes of the challenge, followed by the user name. - */ - memcpy(&data->challenge[0], reply->challenge, reply->count); - memcpy(&data->challenge[reply->count], reply->name, reply->name_len); - break; - - /* - * EAP-Success packets don't contain any data - * other than the header. - */ - case FR_EAP_CODE_SUCCESS: - eap_round->request->type.length = 0; - break; - - default: - REDEBUG("Internal sanity check failed"); - return 0; - } - - /* - * Set the EAP code. - */ - eap_round->request->code = reply->code; - - return 1; -} diff --git a/src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.h b/src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.h deleted file mode 100644 index 1dfef4bac04..00000000000 --- a/src/modules/rlm_eap/types/rlm_eap_leap/eap_leap.h +++ /dev/null @@ -1,73 +0,0 @@ -#pragma once -RCSIDH(eap_leap_h, "$Id$") - -#include - -#define FR_LEAP_CHALLENGE 1 -#define FR_LEAP_RESPONSE 2 -#define FR_LEAP_SUCCESS 3 -#define FR_LEAP_FAILURE 4 -#define FR_LEAP_MAX_CODES 4 - -/* - * Version + unused + count - */ -#define LEAP_HEADER_LEN 3 - -/* - **** - * EAP - LEAP does not specify code, id & length but chap specifies them, - * for generalization purpose, complete header should be sent - * and not just value_size, value and name. - * future implementation. - */ - -/* eap packet structure */ -typedef struct { - /* - * EAP header, followed by type comes before this. - */ - uint8_t version; - uint8_t unused; - uint8_t count; - uint8_t challenge[1]; /* 8 or 24, followed by user name */ -} leap_packet_raw_t; - -/* - * Which is decoded into this. - */ -typedef struct { - unsigned char code; - unsigned char id; - size_t length; - int count; - unsigned char *challenge; - size_t name_len; - char *name; -} leap_packet_t; - -/* - * The information which must be kept around - * during the LEAP session. - */ -typedef struct { - int stage; - uint8_t peer_challenge[8]; - uint8_t peer_response[24]; -} leap_session_t; - -extern fr_dict_attr_t const *attr_cleartext_password; -extern fr_dict_attr_t const *attr_nt_password; -extern fr_dict_attr_t const *attr_cisco_avpair; -extern fr_dict_attr_t const *attr_user_password; - -/* function declarations here */ - -int eap_leap_compose(REQUEST *request, eap_round_t *auth, leap_packet_t *reply); -leap_packet_t *eap_leap_extract(REQUEST *request, eap_round_t *eap_round); -leap_packet_t *eap_leap_initiate(REQUEST *request, eap_round_t *eap_round, VALUE_PAIR *user_name); -int eap_leap_stage4(REQUEST *request, leap_packet_t *packet, VALUE_PAIR* password, leap_session_t *session); -leap_packet_t *eap_leap_stage6(REQUEST *request, leap_packet_t *packet, VALUE_PAIR *user_name, VALUE_PAIR* password, - leap_session_t *session); - -void eap_leap_mschap(unsigned char const *win_password, unsigned char const *challenge, unsigned char *response); diff --git a/src/modules/rlm_eap/types/rlm_eap_leap/rlm_eap_leap.c b/src/modules/rlm_eap/types/rlm_eap_leap/rlm_eap_leap.c deleted file mode 100644 index 6fd768e9e52..00000000000 --- a/src/modules/rlm_eap/types/rlm_eap_leap/rlm_eap_leap.c +++ /dev/null @@ -1,214 +0,0 @@ -/* - * rlm_eap_leap.c Handles that are called from eap - * - * Version: $Id$ - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA - * - * @copyright 2003 Alan DeKok (aland@freeradius.org) - * @copyright 2006 The FreeRADIUS server project - */ - -RCSID("$Id$") - -#include "eap_leap.h" - -static fr_dict_t *dict_freeradius; -static fr_dict_t *dict_radius; - -extern fr_dict_autoload_t rlm_eap_leap_dict[]; -fr_dict_autoload_t rlm_eap_leap_dict[] = { - { .out = &dict_freeradius, .proto = "freeradius" }, - { .out = &dict_radius, .proto = "radius" }, - { NULL } -}; - -fr_dict_attr_t const *attr_cleartext_password; -fr_dict_attr_t const *attr_nt_password; -fr_dict_attr_t const *attr_cisco_avpair; -fr_dict_attr_t const *attr_user_password; - -extern fr_dict_attr_autoload_t rlm_eap_leap_dict_attr[]; -fr_dict_attr_autoload_t rlm_eap_leap_dict_attr[] = { - { .out = &attr_cleartext_password, .name = "Cleartext-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius }, - { .out = &attr_nt_password, .name = "NT-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius }, - { .out = &attr_cisco_avpair, .name = "Cisco-AVPair", .type = FR_TYPE_STRING, .dict = &dict_radius }, - { .out = &attr_user_password, .name = "User-Password", .type = FR_TYPE_STRING, .dict = &dict_radius }, - { NULL } -}; - -static rlm_rcode_t mod_process(UNUSED void *instance, UNUSED void *thread, REQUEST *request) -{ - rlm_rcode_t rcode; - - eap_session_t *eap_session = eap_session_get(request); - leap_session_t *session; - leap_packet_t *packet; - leap_packet_t *reply; - - VALUE_PAIR *password; - - if (!eap_session->opaque) { - REDEBUG("Cannot authenticate without LEAP history"); - return RLM_MODULE_INVALID; - } - session = talloc_get_type_abort(eap_session->opaque, leap_session_t); - reply = NULL; - - /* - * Extract the LEAP packet. - */ - packet = eap_leap_extract(request, eap_session->this_round); - if (!packet) return RLM_MODULE_INVALID; - - /* - * The password is never sent over the wire. - * Always get the configured password, for each user. - */ - password = fr_pair_find_by_da(eap_session->request->control, attr_cleartext_password, TAG_ANY); - if (!password) password = fr_pair_find_by_da(eap_session->request->control, attr_nt_password, TAG_ANY); - if (!password) { - REDEBUG("No Cleartext-Password or NT-Password configured for this user"); - talloc_free(packet); - return RLM_MODULE_REJECT; - } - - /* - * We've already sent the AP challenge. This packet - * should contain the NtChallengeResponse - */ - switch (session->stage) { - case 4: /* Verify NtChallengeResponse */ - RDEBUG2("Stage 4"); - rcode = eap_leap_stage4(request, packet, password, session); - session->stage = 6; - - /* - * We send EAP-Success or EAP-Fail, and not - * any LEAP packet. So we return here. - */ - if (!rcode) { - eap_session->this_round->request->code = FR_EAP_CODE_FAILURE; - talloc_free(packet); - return 0; - } - - eap_session->this_round->request->code = FR_EAP_CODE_SUCCESS; - - /* - * Do this only for Success. - */ - eap_session->this_round->request->id = eap_session->this_round->response->id + 1; - eap_session->this_round->set_request_id = true; - - /* - * LEAP requires a challenge in stage 4, not - * an Access-Accept, which is normally returned - * by eap_compose() in eap.c, when the EAP reply code - * is EAP_SUCCESS. - */ - eap_session->request->reply->code = FR_CODE_ACCESS_CHALLENGE; - talloc_free(packet); - return RLM_MODULE_OK; - - case 6: /* Issue session key */ - RDEBUG2("Stage 6"); - reply = eap_leap_stage6(request, packet, eap_session->request->username, password, session); - break; - - /* - * Stages 1, 3, and 5 are requests from the AP. - * Stage 2 is handled by initiate() - */ - default: - REDEBUG("Internal sanity check failed on stage"); - break; - } - - talloc_free(packet); - - /* - * Process the packet. We don't care about any previous - * EAP packets, as - */ - if (!reply) return RLM_MODULE_FAIL; - - eap_leap_compose(request, eap_session->this_round, reply); - talloc_free(reply); - - return RLM_MODULE_HANDLED; -} - -/* - * send an initial eap-leap request - * ie access challenge to the user/peer. - - * Frame eap reply packet. - * len = header + type + leap_methoddata - * leap_methoddata = value_size + value - */ -static rlm_rcode_t CC_HINT(nonnull) mod_session_init(UNUSED void *instance, UNUSED void *thread, REQUEST *request) -{ - eap_session_t *eap_session = eap_session_get(request); - leap_session_t *session; - leap_packet_t *reply; - - RDEBUG2("Stage 2"); - - /* - * LEAP requires a User-Name attribute - */ - if (!eap_session->request->username) { - REDEBUG("User-Name is required for EAP-LEAP authentication"); - return RLM_MODULE_REJECT; - } - - reply = eap_leap_initiate(request, eap_session->this_round, request->username); - if (!reply) return RLM_MODULE_FAIL; - - eap_leap_compose(request, eap_session->this_round, reply); - - MEM(eap_session->opaque = session = talloc(eap_session, leap_session_t)); - - /* - * Remember which stage we're in, and which challenge - * we sent to the AP. The later stages will take care - * of filling in the peer response. - */ - session->stage = 4; /* the next stage we're in */ - memcpy(session->peer_challenge, reply->challenge, reply->count); - - RDEBUG2("Successfully initiated"); - - talloc_free(reply); - - eap_session->process = mod_process; - - return RLM_MODULE_HANDLED; -} - -/* - * The module name should be the only globally exported symbol. - * That is, everything else should be 'static'. - */ -extern rlm_eap_submodule_t rlm_eap_leap; -rlm_eap_submodule_t rlm_eap_leap = { - .name = "eap_leap", - .magic = RLM_MODULE_INIT, - - .provides = { FR_EAP_METHOD_LEAP }, - .session_init = mod_session_init, /* Initialise a new EAP session */ - .entry_point = mod_process /* Process next round of EAP method */ -}; diff --git a/src/modules/rlm_eap/types/rlm_eap_leap/smbdes.c b/src/modules/rlm_eap/types/rlm_eap_leap/smbdes.c deleted file mode 100644 index bb13a0b7dbc..00000000000 --- a/src/modules/rlm_eap/types/rlm_eap_leap/smbdes.c +++ /dev/null @@ -1,327 +0,0 @@ -/* - Unix SMB/CIFS implementation. - - a partial implementation of DES designed for use in the - SMB authentication protocol - - @copyright Andrew Tridgell 1998 - @copyright 2006 The FreeRADIUS server project - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -*/ - - -/* NOTES: - - This code makes no attempt to be fast! In fact, it is a very - slow implementation - - This code is NOT a complete DES implementation. It implements only - the minimum necessary for SMB authentication, as used by all SMB - products (including every copy of Microsoft Windows95 ever sold) - - In particular, it can only do a unchained forward DES pass. This - means it is not possible to use this code for encryption/decryption - of data, instead it is only useful as a "hash" algorithm. - - There is no entry point into this code that allows normal DES operation. - - I believe this means that this code does not come under ITAR - regulations but this is NOT a legal opinion. If you are concerned - about the applicability of ITAR regulations to this code then you - should confirm it for yourself (and maybe let me know if you come - up with a different answer to the one above) -*/ - -RCSID("$Id$") - -#include -#include -#include "eap_leap.h" - -#define uchar unsigned char - -static const uchar perm1[56] = {57, 49, 41, 33, 25, 17, 9, - 1, 58, 50, 42, 34, 26, 18, - 10, 2, 59, 51, 43, 35, 27, - 19, 11, 3, 60, 52, 44, 36, - 63, 55, 47, 39, 31, 23, 15, - 7, 62, 54, 46, 38, 30, 22, - 14, 6, 61, 53, 45, 37, 29, - 21, 13, 5, 28, 20, 12, 4}; - -static const uchar perm2[48] = {14, 17, 11, 24, 1, 5, - 3, 28, 15, 6, 21, 10, - 23, 19, 12, 4, 26, 8, - 16, 7, 27, 20, 13, 2, - 41, 52, 31, 37, 47, 55, - 30, 40, 51, 45, 33, 48, - 44, 49, 39, 56, 34, 53, - 46, 42, 50, 36, 29, 32}; - -static const uchar perm3[64] = {58, 50, 42, 34, 26, 18, 10, 2, - 60, 52, 44, 36, 28, 20, 12, 4, - 62, 54, 46, 38, 30, 22, 14, 6, - 64, 56, 48, 40, 32, 24, 16, 8, - 57, 49, 41, 33, 25, 17, 9, 1, - 59, 51, 43, 35, 27, 19, 11, 3, - 61, 53, 45, 37, 29, 21, 13, 5, - 63, 55, 47, 39, 31, 23, 15, 7}; - -static const uchar perm4[48] = { 32, 1, 2, 3, 4, 5, - 4, 5, 6, 7, 8, 9, - 8, 9, 10, 11, 12, 13, - 12, 13, 14, 15, 16, 17, - 16, 17, 18, 19, 20, 21, - 20, 21, 22, 23, 24, 25, - 24, 25, 26, 27, 28, 29, - 28, 29, 30, 31, 32, 1}; - -static const uchar perm5[32] = { 16, 7, 20, 21, - 29, 12, 28, 17, - 1, 15, 23, 26, - 5, 18, 31, 10, - 2, 8, 24, 14, - 32, 27, 3, 9, - 19, 13, 30, 6, - 22, 11, 4, 25}; - - -static const uchar perm6[64] ={ 40, 8, 48, 16, 56, 24, 64, 32, - 39, 7, 47, 15, 55, 23, 63, 31, - 38, 6, 46, 14, 54, 22, 62, 30, - 37, 5, 45, 13, 53, 21, 61, 29, - 36, 4, 44, 12, 52, 20, 60, 28, - 35, 3, 43, 11, 51, 19, 59, 27, - 34, 2, 42, 10, 50, 18, 58, 26, - 33, 1, 41, 9, 49, 17, 57, 25}; - - -static const uchar sc[16] = {1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1}; - -static const uchar sbox[8][4][16] = { - {{14, 4, 13, 1, 2, 15, 11, 8, 3, 10, 6, 12, 5, 9, 0, 7}, - {0, 15, 7, 4, 14, 2, 13, 1, 10, 6, 12, 11, 9, 5, 3, 8}, - {4, 1, 14, 8, 13, 6, 2, 11, 15, 12, 9, 7, 3, 10, 5, 0}, - {15, 12, 8, 2, 4, 9, 1, 7, 5, 11, 3, 14, 10, 0, 6, 13}}, - - {{15, 1, 8, 14, 6, 11, 3, 4, 9, 7, 2, 13, 12, 0, 5, 10}, - {3, 13, 4, 7, 15, 2, 8, 14, 12, 0, 1, 10, 6, 9, 11, 5}, - {0, 14, 7, 11, 10, 4, 13, 1, 5, 8, 12, 6, 9, 3, 2, 15}, - {13, 8, 10, 1, 3, 15, 4, 2, 11, 6, 7, 12, 0, 5, 14, 9}}, - - {{10, 0, 9, 14, 6, 3, 15, 5, 1, 13, 12, 7, 11, 4, 2, 8}, - {13, 7, 0, 9, 3, 4, 6, 10, 2, 8, 5, 14, 12, 11, 15, 1}, - {13, 6, 4, 9, 8, 15, 3, 0, 11, 1, 2, 12, 5, 10, 14, 7}, - {1, 10, 13, 0, 6, 9, 8, 7, 4, 15, 14, 3, 11, 5, 2, 12}}, - - {{7, 13, 14, 3, 0, 6, 9, 10, 1, 2, 8, 5, 11, 12, 4, 15}, - {13, 8, 11, 5, 6, 15, 0, 3, 4, 7, 2, 12, 1, 10, 14, 9}, - {10, 6, 9, 0, 12, 11, 7, 13, 15, 1, 3, 14, 5, 2, 8, 4}, - {3, 15, 0, 6, 10, 1, 13, 8, 9, 4, 5, 11, 12, 7, 2, 14}}, - - {{2, 12, 4, 1, 7, 10, 11, 6, 8, 5, 3, 15, 13, 0, 14, 9}, - {14, 11, 2, 12, 4, 7, 13, 1, 5, 0, 15, 10, 3, 9, 8, 6}, - {4, 2, 1, 11, 10, 13, 7, 8, 15, 9, 12, 5, 6, 3, 0, 14}, - {11, 8, 12, 7, 1, 14, 2, 13, 6, 15, 0, 9, 10, 4, 5, 3}}, - - {{12, 1, 10, 15, 9, 2, 6, 8, 0, 13, 3, 4, 14, 7, 5, 11}, - {10, 15, 4, 2, 7, 12, 9, 5, 6, 1, 13, 14, 0, 11, 3, 8}, - {9, 14, 15, 5, 2, 8, 12, 3, 7, 0, 4, 10, 1, 13, 11, 6}, - {4, 3, 2, 12, 9, 5, 15, 10, 11, 14, 1, 7, 6, 0, 8, 13}}, - - {{4, 11, 2, 14, 15, 0, 8, 13, 3, 12, 9, 7, 5, 10, 6, 1}, - {13, 0, 11, 7, 4, 9, 1, 10, 14, 3, 5, 12, 2, 15, 8, 6}, - {1, 4, 11, 13, 12, 3, 7, 14, 10, 15, 6, 8, 0, 5, 9, 2}, - {6, 11, 13, 8, 1, 4, 10, 7, 9, 5, 0, 15, 14, 2, 3, 12}}, - - {{13, 2, 8, 4, 6, 15, 11, 1, 10, 9, 3, 14, 5, 0, 12, 7}, - {1, 15, 13, 8, 10, 3, 7, 4, 12, 5, 6, 11, 0, 14, 9, 2}, - {7, 11, 4, 1, 9, 12, 14, 2, 0, 6, 10, 13, 15, 3, 5, 8}, - {2, 1, 14, 7, 4, 10, 8, 13, 15, 12, 9, 0, 3, 5, 6, 11}}}; - -static void permute(char *out, char const *in, uchar const *p, int n) -{ - int i; - for (i=0;i>1; - key[1] = ((str[0]&0x01)<<6) | (str[1]>>2); - key[2] = ((str[1]&0x03)<<5) | (str[2]>>3); - key[3] = ((str[2]&0x07)<<4) | (str[3]>>4); - key[4] = ((str[3]&0x0F)<<3) | (str[4]>>5); - key[5] = ((str[4]&0x1F)<<2) | (str[5]>>6); - key[6] = ((str[5]&0x3F)<<1) | (str[6]>>7); - key[7] = str[6]&0x7F; - for (i=0;i<8;i++) { - key[i] = (key[i]<<1); - } -} - - -static void smbhash(unsigned char *out, unsigned char const *in, unsigned char *key) -{ - int i; - char outb[64]; - char inb[64]; - char keyb[64]; - unsigned char key2[8]; - - str_to_key(key, key2); - - for (i=0;i<64;i++) { - inb[i] = (in[i/8] & (1<<(7-(i%8)))) ? 1 : 0; - keyb[i] = (key2[i/8] & (1<<(7-(i%8)))) ? 1 : 0; - outb[i] = 0; - } - - dohash(outb, inb, keyb); - - for (i=0;i<8;i++) { - out[i] = 0; - } - - for (i=0;i<64;i++) { - if (outb[i]) - out[i/8] |= (1<<(7-(i%8))); - } -} - -/* - * Take the NT or LM password, and return the MSCHAP response - * - * The win_password MUST be exactly 16 bytes long. - */ -void eap_leap_mschap(unsigned char const *win_password, unsigned char const *challenge, unsigned char *response) -{ - unsigned char p21[21]; - - memset(p21, 0, sizeof(p21)); - memcpy(p21, win_password, 16); - - smbhash(response, challenge, p21); - smbhash(response+8, challenge, p21+7); - smbhash(response+16, challenge, p21+14); -} diff --git a/src/tests/config/test.conf b/src/tests/config/test.conf index d0319fefb24..6dbea69ffd6 100644 --- a/src/tests/config/test.conf +++ b/src/tests/config/test.conf @@ -46,16 +46,12 @@ modules { default_eap_type = md5 type = md5 - type = leap type = gtc type = mschapv2 md5 { } - leap { - } - gtc { auth_type = PAP } diff --git a/src/tests/eapol_test/config/methods-available/leap b/src/tests/eapol_test/config/methods-available/leap deleted file mode 100644 index 128f277c428..00000000000 --- a/src/tests/eapol_test/config/methods-available/leap +++ /dev/null @@ -1,4 +0,0 @@ -type = leap - -leap { -} diff --git a/src/tests/eapol_test/leap.conf b/src/tests/eapol_test/leap.conf deleted file mode 100644 index 77cb6ef6ca3..00000000000 --- a/src/tests/eapol_test/leap.conf +++ /dev/null @@ -1,10 +0,0 @@ -# -# eapol_test -c leap.conf -s testing123 -# -network={ - ssid="example" - key_mgmt=WPA-EAP - eap=LEAP - identity="bob" - password="bob" -}