src/charon/sa/authenticators/eap_authenticator.c

   1 /*
   2  * Copyright (C) 2006-2008 Martin Willi
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  *
  15  * $Id$
  16  */
  17
  18 #include <string.h>
  19
  20 #include "eap_authenticator.h"
  21
  22 #include <daemon.h>
  23 #include <config/peer_cfg.h>
  24 #include <sa/authenticators/eap/eap_method.h>
  25
  26 typedef struct private_eap_authenticator_t private_eap_authenticator_t;
  27
  28 /**
  29  * Private data of an eap_authenticator_t object.
  30  */
  31 struct private_eap_authenticator_t {
  32
  33         /**
  34          * Public authenticator_t interface.
  35          */
  36         eap_authenticator_t public;
  37
  38         /**
  39          * Assigned IKE_SA
  40          */
  41         ike_sa_t *ike_sa;
  42
  43         /**
  44          * Role of this authenticator, PEER or SERVER
  45          */
  46         eap_role_t role;
  47
  48         /**
  49          * Current EAP method processing
  50          */
  51         eap_method_t *method;
  52
  53         /**
  54          * MSK used to build and verify auth payload
  55          */
  56         chunk_t msk;
  57
  58         /**
  59          * should we do a EAP-Identity exchange as server?
  60          */
  61         bool do_eap_identity;
  62
  63         /**
  64          * saved EAP type if we do eap_identity
  65          */
  66         eap_type_t type;
  67
  68         /**
  69          * saved vendor id if we do eap_identity
  70          */
  71         u_int32_t vendor;
  72 };
  73 /**
  74  * Implementation of authenticator_t.verify.
  75  */
  76 static status_t verify(private_eap_authenticator_t *this, chunk_t ike_sa_init,
  77                                            chunk_t my_nonce, auth_payload_t *auth_payload)
  78 {
  79         chunk_t auth_data, recv_auth_data;
  80         identification_t *other_id;
  81         keymat_t *keymat;
  82
  83         other_id = this->ike_sa->get_other_id(this->ike_sa);
  84         keymat = this->ike_sa->get_keymat(this->ike_sa);
  85
  86         auth_data = keymat->get_psk_sig(keymat, TRUE, ike_sa_init, my_nonce,
  87                                                                         this->msk, other_id);
  88
  89         recv_auth_data = auth_payload->get_data(auth_payload);
  90         if (!auth_data.len || !chunk_equals(auth_data, recv_auth_data))
  91         {
  92                 DBG1(DBG_IKE, "verification of AUTH payload created from EAP MSK failed");
  93                 chunk_free(&auth_data);
  94                 return FAILED;
  95         }
  96         chunk_free(&auth_data);
  97
  98         DBG1(DBG_IKE, "authentication of '%D' with %N successful",
  99                  other_id, auth_class_names, AUTH_CLASS_EAP);
 100         return SUCCESS;
 101 }
 102
 103 /**
 104  * Implementation of authenticator_t.build.
 105  */
 106 static status_t build(private_eap_authenticator_t *this, chunk_t ike_sa_init,
 107                                           chunk_t other_nonce, auth_payload_t **auth_payload)
 108 {
 109         identification_t *my_id;
 110         chunk_t auth_data;
 111         keymat_t *keymat;
 112
 113         my_id = this->ike_sa->get_my_id(this->ike_sa);
 114         keymat = this->ike_sa->get_keymat(this->ike_sa);
 115
 116         DBG1(DBG_IKE, "authentication of '%D' (myself) with %N",
 117                  my_id, auth_class_names, AUTH_CLASS_EAP);
 118
 119         auth_data = keymat->get_psk_sig(keymat, FALSE, ike_sa_init, other_nonce,
 120                                                                         this->msk, my_id);
 121
 122         *auth_payload = auth_payload_create();
 123         (*auth_payload)->set_auth_method(*auth_payload, AUTH_PSK);
 124         (*auth_payload)->set_data(*auth_payload, auth_data);
 125         chunk_free(&auth_data);
 126
 127         return SUCCESS;
 128 }
 129
 130 /**
 131  * get the peers identity to use in the EAP method
 132  */
 133 static identification_t *get_peer_id(private_eap_authenticator_t *this)
 134 {
 135         identification_t *id;
 136         peer_cfg_t *config;
 137         auth_info_t *auth;
 138
 139         id = this->ike_sa->get_eap_identity(this->ike_sa);
 140         if (!id)
 141         {
 142                 config = this->ike_sa->get_peer_cfg(this->ike_sa);
 143                 auth = config->get_auth(config);
 144                 if (!auth->get_item(auth, AUTHN_EAP_IDENTITY, (void**)&id))
 145                 {
 146                         if (this->role == EAP_PEER)
 147                         {
 148                                 id = this->ike_sa->get_my_id(this->ike_sa);
 149                         }
 150                         else
 151                         {
 152                                 id = this->ike_sa->get_other_id(this->ike_sa);
 153                         }
 154                 }
 155         }
 156         if (id->get_type(id) == ID_EAP)
 157         {
 158                 return id->clone(id);
 159         }
 160         return identification_create_from_encoding(ID_EAP, id->get_encoding(id));
 161 }
 162
 163 /**
 164  * get the servers identity to use in the EAP method
 165  */
 166 static identification_t *get_server_id(private_eap_authenticator_t *this)
 167 {
 168         identification_t *id;
 169
 170         if (this->role == EAP_SERVER)
 171         {
 172                 id = this->ike_sa->get_my_id(this->ike_sa);
 173         }
 174         else
 175         {
 176                 id = this->ike_sa->get_other_id(this->ike_sa);
 177         }
 178         if (id->get_type(id) == ID_EAP)
 179         {
 180                 return id->clone(id);
 181         }
 182         return identification_create_from_encoding(ID_EAP, id->get_encoding(id));
 183 }
 184
 185 /**
 186  * load an EAP method using the correct identities
 187  */
 188 static eap_method_t *load_method(private_eap_authenticator_t *this,
 189                                                         eap_type_t type, u_int32_t vendor, eap_role_t role)
 190 {
 191         identification_t *server, *peer;
 192         eap_method_t *method;
 193
 194         server = get_server_id(this);
 195         peer = get_peer_id(this);
 196         method = charon->eap->create_instance(charon->eap, type, vendor, role,
 197                                                                                   server, peer);
 198         server->destroy(server);
 199         peer->destroy(peer);
 200         return method;
 201 }
 202
 203 /**
 204  * Implementation of eap_authenticator_t.initiate
 205  */
 206 static status_t initiate(private_eap_authenticator_t *this, eap_type_t type,
 207                                                  u_int32_t vendor, eap_payload_t **out)
 208 {
 209         /* if initiate() is called, role is always server */
 210         this->role = EAP_SERVER;
 211
 212         if (this->do_eap_identity)
 213         {       /* do an EAP-Identity request first */
 214                 this->type = type;
 215                 this->vendor = vendor;
 216                 vendor = 0;
 217                 type = EAP_IDENTITY;
 218         }
 219
 220         if (type == 0)
 221         {
 222                 DBG1(DBG_IKE,
 223                          "client requested EAP authentication, but configuration forbids it");
 224                 *out = eap_payload_create_code(EAP_FAILURE, 0);
 225                 return FAILED;
 226         }
 227
 228         if (vendor)
 229         {
 230                 DBG1(DBG_IKE, "requesting vendor specific EAP method %d-%d",
 231                          type, vendor);
 232         }
 233         else
 234         {
 235                 DBG1(DBG_IKE, "requesting EAP method %N", eap_type_names, type);
 236         }
 237         this->method = load_method(this, type, vendor, this->role);
 238         if (this->method == NULL)
 239         {
 240                 if (vendor == 0 && type == EAP_IDENTITY)
 241                 {
 242                         DBG1(DBG_IKE, "skipping %N, no implementation found",
 243                                  eap_type_names, type);
 244                         this->do_eap_identity = FALSE;
 245                         return initiate(this, this->type, this->vendor, out);
 246                 }
 247                 DBG1(DBG_IKE, "configured EAP server method not supported, sending %N",
 248                          eap_code_names, EAP_FAILURE);
 249                 *out = eap_payload_create_code(EAP_FAILURE, 0);
 250                 return FAILED;
 251         }
 252         if (this->method->initiate(this->method, out) != NEED_MORE)
 253         {
 254                 DBG1(DBG_IKE, "failed to initiate EAP exchange, sending %N",
 255                          eap_type_names, type, eap_code_names, EAP_FAILURE);
 256                 *out = eap_payload_create_code(EAP_FAILURE, 0);
 257                 return FAILED;
 258         }
 259         return NEED_MORE;
 260 }
 261
 262 /**
 263  * Processing method for a peer
 264  */
 265 static status_t process_peer(private_eap_authenticator_t *this,
 266                                                          eap_payload_t *in, eap_payload_t **out)
 267 {
 268         eap_type_t type;
 269         u_int32_t vendor;
 270
 271         type = in->get_type(in, &vendor);
 272
 273         if (!vendor && type == EAP_IDENTITY)
 274         {
 275                 eap_method_t *method;
 276
 277                 method = load_method(this, type, 0, EAP_PEER);
 278                 if (method == NULL || method->process(method, in, out) != SUCCESS)
 279                 {
 280                         DBG1(DBG_IKE, "EAP server requested %N, but unable to process",
 281                                  eap_type_names, type);
 282                         DESTROY_IF(method);
 283                         return FAILED;
 284                 }
 285                 DBG1(DBG_IKE, "EAP server requested %N", eap_type_names, type);
 286                 method->destroy(method);
 287                 return NEED_MORE;
 288         }
 289
 290         /* create an eap_method for the first call */
 291         if (this->method == NULL)
 292         {
 293                 if (vendor)
 294                 {
 295                         DBG1(DBG_IKE, "EAP server requested vendor specific EAP method %d-%d",
 296                                  type, vendor);
 297                 }
 298                 else
 299                 {
 300                         DBG1(DBG_IKE, "EAP server requested %N authentication",
 301                                  eap_type_names, type);
 302                 }
 303                 this->method = load_method(this, type, vendor, EAP_PEER);
 304                 if (this->method == NULL)
 305                 {
 306                         DBG1(DBG_IKE, "EAP server requested unsupported "
 307                                  "EAP method, sending EAP_NAK");
 308                         *out = eap_payload_create_nak(in->get_identifier(in));
 309                         return NEED_MORE;
 310                 }
 311         }
 312
 313         type = this->method->get_type(this->method, &vendor);
 314
 315         switch (this->method->process(this->method, in, out))
 316         {
 317                 case NEED_MORE:
 318                         return NEED_MORE;
 319                 case SUCCESS:
 320                         if (vendor)
 321                         {
 322                                 DBG1(DBG_IKE, "EAP vendor specific method %d-%d succeded",
 323                                          type, vendor);
 324                         }
 325                         else
 326                         {
 327                                 DBG1(DBG_IKE, "EAP method %N succeeded", eap_type_names, type);
 328                         }
 329                         return SUCCESS;
 330                 case FAILED:
 331                 default:
 332                         if (vendor)
 333                         {
 334                                 DBG1(DBG_IKE, "EAP vendor specific method %d-%d failed",
 335                                          type, vendor);
 336                         }
 337                         else
 338                         {
 339                                 DBG1(DBG_IKE, "EAP method %N failed",
 340                                          eap_type_names, type);
 341                         }
 342                         return FAILED;
 343         }
 344 }
 345
 346 /**
 347  * handle an EAP-Identity response on the server
 348  */
 349 static status_t process_eap_identity(private_eap_authenticator_t *this,
 350                                                                          eap_payload_t **out)
 351 {
 352         chunk_t data;
 353         identification_t *id;
 354
 355         if (this->method->get_msk(this->method, &data) == SUCCESS)
 356         {
 357                 id = identification_create_from_encoding(ID_EAP, data);
 358                 DBG1(DBG_IKE, "using EAP identity '%D'", id);
 359                 this->ike_sa->set_eap_identity(this->ike_sa, id);
 360         }
 361         /* restart EAP exchange, but with real method */
 362         this->method->destroy(this->method);
 363         this->do_eap_identity = FALSE;
 364         return initiate(this, this->type, this->vendor, out);
 365 }
 366
 367 /**
 368  * Processing method for a server
 369  */
 370 static status_t process_server(private_eap_authenticator_t *this,
 371                                                            eap_payload_t *in, eap_payload_t **out)
 372 {
 373         eap_type_t type;
 374         u_int32_t vendor;
 375
 376         type = this->method->get_type(this->method, &vendor);
 377
 378         switch (this->method->process(this->method, in, out))
 379         {
 380                 case NEED_MORE:
 381                         return NEED_MORE;
 382                 case SUCCESS:
 383                         if (this->do_eap_identity)
 384                         {
 385                                 return process_eap_identity(this, out);
 386                         }
 387                         if (this->method->get_msk(this->method, &this->msk) == SUCCESS)
 388                         {
 389                                 this->msk = chunk_clone(this->msk);
 390                         }
 391                         if (vendor)
 392                         {
 393                                 DBG1(DBG_IKE, "EAP vendor specific method %d-%d succeded, "
 394                                          "%sMSK established", type, vendor,
 395                                          this->msk.ptr ? "" : "no ");
 396                         }
 397                         else
 398                         {
 399                                 DBG1(DBG_IKE, "EAP method %N succeded, %sMSK established",
 400                                          eap_type_names, type, this->msk.ptr ? "" : "no ");
 401                         }
 402                         *out = eap_payload_create_code(EAP_SUCCESS, in->get_identifier(in));
 403                         return SUCCESS;
 404                 case FAILED:
 405                 default:
 406                         if (vendor)
 407                         {
 408                                 DBG1(DBG_IKE, "EAP vendor specific method %d-%d failed for "
 409                                          "peer %D", type, vendor,
 410                                          this->ike_sa->get_other_id(this->ike_sa));
 411                         }
 412                         else
 413                         {
 414                                 DBG1(DBG_IKE, "EAP method %N failed for peer %D",
 415                                          eap_type_names, type,
 416                                          this->ike_sa->get_other_id(this->ike_sa));
 417                         }
 418                         *out = eap_payload_create_code(EAP_FAILURE, in->get_identifier(in));
 419                         return FAILED;
 420         }
 421 }
 422
 423 /**
 424  * Implementation of eap_authenticator_t.process
 425  */
 426 static status_t process(private_eap_authenticator_t *this, eap_payload_t *in,
 427                                                 eap_payload_t **out)
 428 {
 429         eap_code_t code = in->get_code(in);
 430
 431         switch (this->role)
 432         {
 433                 case EAP_SERVER:
 434                 {
 435                         switch (code)
 436                         {
 437                                 case EAP_RESPONSE:
 438                                 {
 439                                         return process_server(this, in, out);
 440                                 }
 441                                 default:
 442                                 {
 443                                         DBG1(DBG_IKE, "received %N, sending %N",
 444                                                  eap_code_names, code, eap_code_names, EAP_FAILURE);
 445                                         *out = eap_payload_create_code(EAP_FAILURE,
 446                                                                                                    in->get_identifier(in));
 447                                         return FAILED;
 448                                 }
 449                         }
 450                 }
 451                 case EAP_PEER:
 452                 {
 453                         switch (code)
 454                         {
 455                                 case EAP_REQUEST:
 456                                 {
 457                                         return process_peer(this, in, out);
 458                                 }
 459                                 case EAP_SUCCESS:
 460                                 {
 461                                         if (this->method->get_msk(this->method, &this->msk) == SUCCESS)
 462                                         {
 463                                                 this->msk = chunk_clone(this->msk);
 464                                         }
 465                                         return SUCCESS;
 466                                 }
 467                                 case EAP_FAILURE:
 468                                 default:
 469                                 {
 470                                         DBG1(DBG_IKE, "received %N, EAP authentication failed",
 471                                                  eap_code_names, code);
 472                                         return FAILED;
 473                                 }
 474                         }
 475                 }
 476                 default:
 477                 {
 478                         return FAILED;
 479                 }
 480         }
 481 }
 482
 483 /**
 484  * Implementation of authenticator_t.is_mutual.
 485  */
 486 static bool is_mutual(private_eap_authenticator_t *this)
 487 {
 488         if (this->method)
 489         {
 490                 return this->method->is_mutual(this->method);
 491         }
 492         return FALSE;
 493 }
 494
 495 /**
 496  * Implementation of authenticator_t.destroy.
 497  */
 498 static void destroy(private_eap_authenticator_t *this)
 499 {
 500         DESTROY_IF(this->method);
 501         chunk_free(&this->msk);
 502         free(this);
 503 }
 504
 505 /*
 506  * Described in header.
 507  */
 508 eap_authenticator_t *eap_authenticator_create(ike_sa_t *ike_sa)
 509 {
 510         peer_cfg_t *config;
 511         auth_info_t *auth;
 512         identification_t *id;
 513         private_eap_authenticator_t *this = malloc_thing(private_eap_authenticator_t);
 514
 515         /* public functions */
 516         this->public.authenticator_interface.verify = (status_t(*)(authenticator_t*,chunk_t,chunk_t,auth_payload_t*))verify;
 517         this->public.authenticator_interface.build = (status_t(*)(authenticator_t*,chunk_t,chunk_t,auth_payload_t**))build;
 518         this->public.authenticator_interface.destroy = (void(*)(authenticator_t*))destroy;
 519
 520         this->public.is_mutual = (bool(*)(eap_authenticator_t*))is_mutual;
 521         this->public.initiate = (status_t(*)(eap_authenticator_t*,eap_type_t,u_int32_t,eap_payload_t**))initiate;
 522         this->public.process = (status_t(*)(eap_authenticator_t*,eap_payload_t*,eap_payload_t**))process;
 523
 524         /* private data */
 525         this->ike_sa = ike_sa;
 526         this->role = EAP_PEER;
 527         this->method = NULL;
 528         this->msk = chunk_empty;
 529         this->do_eap_identity = FALSE;
 530         this->type = 0;
 531         this->vendor = 0;
 532
 533         config = ike_sa->get_peer_cfg(ike_sa);
 534         if (config)
 535         {
 536                 auth = config->get_auth(config);
 537                 if (auth->get_item(auth, AUTHN_EAP_IDENTITY, (void**)&id))
 538                 {
 539                         if (id->get_type(id) == ID_ANY)
 540                         {       /* %any as configured EAP identity runs EAP-Identity first */
 541                                 this->do_eap_identity = TRUE;
 542                         }
 543                         else
 544                         {
 545                                 ike_sa->set_eap_identity(ike_sa, id->clone(id));
 546                         }
 547                 }
 548         }
 549         return &this->public;
 550 }