src/libcharon/plugins/eap_ttls/eap_ttls_peer.c

   1 /*
   2  * Copyright (C) 2010 Andreas Steffen
   3  * Copyright (C) 2010 HSR Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include "eap_ttls_peer.h"
  17 #include "eap_ttls_avp.h"
  18
  19 #include <debug.h>
  20 #include <daemon.h>
  21 #include <radius_message.h>
  22 #include <sa/eap/eap_method.h>
  23
  24 typedef struct private_eap_ttls_peer_t private_eap_ttls_peer_t;
  25
  26 /**
  27  * Private data of an eap_ttls_peer_t object.
  28  */
  29 struct private_eap_ttls_peer_t {
  30
  31         /**
  32          * Public eap_ttls_peer_t interface.
  33          */
  34         eap_ttls_peer_t public;
  35
  36         /**
  37          * Server identity
  38          */
  39         identification_t *server;
  40
  41         /**
  42          * Peer identity
  43          */
  44         identification_t *peer;
  45
  46         /**
  47          * Current EAP-TTLS state
  48          */
  49         bool start_phase2;
  50
  51         /**
  52      * Current phase 2 EAP method
  53          */
  54         eap_method_t *method;
  55
  56         /**
  57      * Pending outbound EAP message
  58          */
  59         eap_payload_t *out;
  60
  61         /**
  62          * AVP handler
  63          */
  64         eap_ttls_avp_t *avp;
  65 };
  66
  67 METHOD(tls_application_t, process, status_t,
  68         private_eap_ttls_peer_t *this, bio_reader_t *reader)
  69 {
  70         chunk_t avp_data = chunk_empty;
  71         chunk_t eap_data = chunk_empty;
  72         status_t status;
  73         payload_t *payload;
  74         eap_payload_t *in;
  75         eap_packet_t *pkt;
  76         eap_code_t code;
  77         eap_type_t type, received_type;
  78         u_int32_t vendor, received_vendor;
  79         u_int16_t eap_len;
  80         size_t eap_pos = 0;
  81         bool concatenated = FALSE;
  82
  83         do
  84         {
  85                 status = this->avp->process(this->avp, reader, &avp_data);
  86                 switch (status)
  87                 {
  88                         case SUCCESS:
  89                                 break;
  90                         case NEED_MORE:
  91                                 DBG1(DBG_IKE, "need more AVP data");
  92                                 return NEED_MORE;
  93                         case FAILED:
  94                         default:
  95                                 return FAILED;
  96                 }
  97
  98                 if (eap_data.len == 0)
  99                 {
 100                         if (avp_data.len < 4)
 101                         {
 102                                 DBG1(DBG_IKE, "AVP size to small to contain EAP header");
 103                                 chunk_free(&avp_data);
 104                                 return FAILED;
 105                         }
 106                         pkt = (eap_packet_t*)avp_data.ptr;
 107                         eap_len = untoh16(&pkt->length);
 108
 109                         if (eap_len <= avp_data.len)
 110                         {
 111                                 /* standard:  EAP packet contained in a single AVP */
 112                                 eap_data = avp_data;
 113                                 break;
 114                         }
 115                         else if (avp_data.len == MAX_RADIUS_ATTRIBUTE_SIZE)
 116                         {
 117                                 /* non-standard: EAP packet segmented into multiple AVPs */
 118                                 eap_data = chunk_alloc(eap_len);
 119                                 concatenated = TRUE;
 120                         }
 121                         else
 122                         {
 123                                 DBG1(DBG_IKE, "non-radius segmentation of EAP packet into AVPs");
 124                                 chunk_free(&avp_data);
 125                                 return FAILED;
 126                         }
 127                 }
 128
 129                 if (avp_data.len > eap_data.len - eap_pos)
 130                 {
 131                         DBG1(DBG_IKE, "AVP size to large to fit into EAP packet");
 132                         chunk_free(&avp_data);
 133                         chunk_free(&eap_data);
 134                         return FAILED;
 135                 }
 136                 memcpy(eap_data.ptr + eap_pos, avp_data.ptr, avp_data.len);
 137                 eap_pos += avp_data.len;
 138                 chunk_free(&avp_data);
 139         }
 140         while (eap_pos < eap_data.len);
 141
 142         in = eap_payload_create_data(eap_data);
 143         chunk_free(&eap_data);
 144         payload = (payload_t*)in;
 145
 146         if (payload->verify(payload) != SUCCESS)
 147         {
 148                 in->destroy(in);
 149                 return FAILED;
 150         }
 151         code = in->get_code(in);
 152         received_type = in->get_type(in, &received_vendor);
 153         DBG1(DBG_IKE, "received tunneled EAP-TTLS AVP%s [EAP/%N/%N]",
 154                                                         concatenated ? "s" : "",
 155                                                         eap_code_short_names, code,
 156                                                         eap_type_short_names, received_type);
 157         if (code != EAP_REQUEST)
 158         {
 159                 DBG1(DBG_IKE, "%N expected", eap_code_names, EAP_REQUEST);
 160                 in->destroy(in);
 161                 return FAILED;
 162         }
 163
 164         /* yet another phase2 authentication? */
 165         if (this->method)
 166         {
 167                 type = this->method->get_type(this->method, &vendor);
 168
 169                 if (type != received_type || vendor != received_vendor)
 170                 {
 171                         this->method->destroy(this->method);
 172                         this->method = NULL;
 173                 }
 174         }
 175
 176         if (this->method == NULL)
 177         {
 178                 if (received_vendor)
 179                 {
 180                         DBG1(DBG_IKE, "server requested vendor specific EAP method %d-%d "
 181                                                   "(id 0x%02X)", received_type, received_vendor,
 182                                                    in->get_identifier(in));
 183                 }
 184                 else
 185                 {
 186                         DBG1(DBG_IKE, "server requested %N authentication (id 0x%02X)",
 187                                  eap_type_names, received_type, in->get_identifier(in));
 188                 }
 189                 this->method = charon->eap->create_instance(charon->eap,
 190                                                                         received_type, received_vendor,
 191                                                                         EAP_PEER, this->server, this->peer);
 192                 if (!this->method)
 193                 {
 194                         DBG1(DBG_IKE, "EAP method not supported");
 195                         this->out = eap_payload_create_nak(in->get_identifier(in));
 196                         in->destroy(in);
 197                         return NEED_MORE;
 198                 }
 199                 type = this->method->get_type(this->method, &vendor);
 200                 this->start_phase2 = FALSE;
 201         }
 202
 203         status = this->method->process(this->method, in, &this->out);
 204         in->destroy(in);
 205
 206         switch (status)
 207         {
 208                 case SUCCESS:
 209                         this->method->destroy(this->method);
 210                         this->method = NULL;
 211                         /* fall through to NEED_MORE */
 212                 case NEED_MORE:
 213                         return NEED_MORE;
 214                 case FAILED:
 215                 default:
 216                         if (vendor)
 217                         {
 218                                 DBG1(DBG_IKE, "vendor specific EAP method %d-%d failed",
 219                                                            type, vendor);
 220                         }
 221                         else
 222                         {
 223                                 DBG1(DBG_IKE, "%N method failed", eap_type_names, type);
 224                         }
 225                         return FAILED;
 226         }
 227 }
 228
 229 METHOD(tls_application_t, build, status_t,
 230         private_eap_ttls_peer_t *this, bio_writer_t *writer)
 231 {
 232         chunk_t data;
 233         eap_code_t code;
 234         eap_type_t type;
 235         u_int32_t vendor;
 236
 237         if (this->method == NULL && this->start_phase2)
 238         {
 239                 /* generate an EAP Identity response */
 240                 this->method = charon->eap->create_instance(charon->eap, EAP_IDENTITY,
 241                                                                  0,     EAP_PEER, this->server, this->peer);
 242                 if (this->method == NULL)
 243                 {
 244                         DBG1(DBG_IKE, "EAP_IDENTITY method not available");
 245                         return FAILED;
 246                 }
 247                 this->method->process(this->method, NULL, &this->out);
 248                 this->method->destroy(this->method);
 249                 this->method = NULL;
 250                 this->start_phase2 = FALSE;
 251         }
 252
 253         if (this->out)
 254         {
 255                 code = this->out->get_code(this->out);
 256                 type = this->out->get_type(this->out, &vendor);
 257                 DBG1(DBG_IKE, "sending tunneled EAP-TTLS AVP [EAP/%N/%N]",
 258                                                 eap_code_short_names, code, eap_type_short_names, type);
 259
 260                 /* get the raw EAP message data */
 261                 data = this->out->get_data(this->out);
 262                 this->avp->build(this->avp, writer, data);
 263
 264                 this->out->destroy(this->out);
 265                 this->out = NULL;
 266         }
 267         return INVALID_STATE;
 268 }
 269
 270 METHOD(tls_application_t, destroy, void,
 271         private_eap_ttls_peer_t *this)
 272 {
 273         this->server->destroy(this->server);
 274         this->peer->destroy(this->peer);
 275         DESTROY_IF(this->method);
 276         DESTROY_IF(this->out);
 277         this->avp->destroy(this->avp);
 278         free(this);
 279 }
 280
 281 /**
 282  * See header
 283  */
 284 eap_ttls_peer_t *eap_ttls_peer_create(identification_t *server,
 285                                                                           identification_t *peer)
 286 {
 287         private_eap_ttls_peer_t *this;
 288
 289         INIT(this,
 290                 .public = {
 291                         .application = {
 292                                 .process = _process,
 293                                 .build = _build,
 294                                 .destroy = _destroy,
 295                         },
 296                 },
 297                 .server = server->clone(server),
 298                 .peer = peer->clone(peer),
 299                 .start_phase2 = TRUE,
 300                 .avp = eap_ttls_avp_create(),
 301         );
 302
 303         return &this->public;
 304 }