eap_server_mschapv2.c revision 214501
1214501Srpaulo/* 2214501Srpaulo * hostapd / EAP-MSCHAPv2 (draft-kamath-pppext-eap-mschapv2-00.txt) server 3214501Srpaulo * Copyright (c) 2004-2007, Jouni Malinen <j@w1.fi> 4214501Srpaulo * 5214501Srpaulo * This program is free software; you can redistribute it and/or modify 6214501Srpaulo * it under the terms of the GNU General Public License version 2 as 7214501Srpaulo * published by the Free Software Foundation. 8214501Srpaulo * 9214501Srpaulo * Alternatively, this software may be distributed under the terms of BSD 10214501Srpaulo * license. 11214501Srpaulo * 12214501Srpaulo * See README and COPYING for more details. 13214501Srpaulo */ 14214501Srpaulo 15214501Srpaulo#include "includes.h" 16214501Srpaulo 17214501Srpaulo#include "common.h" 18214501Srpaulo#include "crypto/ms_funcs.h" 19214501Srpaulo#include "eap_i.h" 20214501Srpaulo 21214501Srpaulo 22214501Srpaulostruct eap_mschapv2_hdr { 23214501Srpaulo u8 op_code; /* MSCHAPV2_OP_* */ 24214501Srpaulo u8 mschapv2_id; /* must be changed for challenges, but not for 25214501Srpaulo * success/failure */ 26214501Srpaulo u8 ms_length[2]; /* Note: misaligned; length - 5 */ 27214501Srpaulo /* followed by data */ 28214501Srpaulo} STRUCT_PACKED; 29214501Srpaulo 30214501Srpaulo#define MSCHAPV2_OP_CHALLENGE 1 31214501Srpaulo#define MSCHAPV2_OP_RESPONSE 2 32214501Srpaulo#define MSCHAPV2_OP_SUCCESS 3 33214501Srpaulo#define MSCHAPV2_OP_FAILURE 4 34214501Srpaulo#define MSCHAPV2_OP_CHANGE_PASSWORD 7 35214501Srpaulo 36214501Srpaulo#define MSCHAPV2_RESP_LEN 49 37214501Srpaulo 38214501Srpaulo#define ERROR_RESTRICTED_LOGON_HOURS 646 39214501Srpaulo#define ERROR_ACCT_DISABLED 647 40214501Srpaulo#define ERROR_PASSWD_EXPIRED 648 41214501Srpaulo#define ERROR_NO_DIALIN_PERMISSION 649 42214501Srpaulo#define ERROR_AUTHENTICATION_FAILURE 691 43214501Srpaulo#define ERROR_CHANGING_PASSWORD 709 44214501Srpaulo 45214501Srpaulo#define PASSWD_CHANGE_CHAL_LEN 16 46214501Srpaulo#define MSCHAPV2_KEY_LEN 16 47214501Srpaulo 48214501Srpaulo 49214501Srpaulo#define CHALLENGE_LEN 16 50214501Srpaulo 51214501Srpaulostruct eap_mschapv2_data { 52214501Srpaulo u8 auth_challenge[CHALLENGE_LEN]; 53214501Srpaulo int auth_challenge_from_tls; 54214501Srpaulo u8 *peer_challenge; 55214501Srpaulo u8 auth_response[20]; 56214501Srpaulo enum { CHALLENGE, SUCCESS_REQ, FAILURE_REQ, SUCCESS, FAILURE } state; 57214501Srpaulo u8 resp_mschapv2_id; 58214501Srpaulo u8 master_key[16]; 59214501Srpaulo int master_key_valid; 60214501Srpaulo}; 61214501Srpaulo 62214501Srpaulo 63214501Srpaulostatic void * eap_mschapv2_init(struct eap_sm *sm) 64214501Srpaulo{ 65214501Srpaulo struct eap_mschapv2_data *data; 66214501Srpaulo 67214501Srpaulo data = os_zalloc(sizeof(*data)); 68214501Srpaulo if (data == NULL) 69214501Srpaulo return NULL; 70214501Srpaulo data->state = CHALLENGE; 71214501Srpaulo 72214501Srpaulo if (sm->auth_challenge) { 73214501Srpaulo os_memcpy(data->auth_challenge, sm->auth_challenge, 74214501Srpaulo CHALLENGE_LEN); 75214501Srpaulo data->auth_challenge_from_tls = 1; 76214501Srpaulo } 77214501Srpaulo 78214501Srpaulo if (sm->peer_challenge) { 79214501Srpaulo data->peer_challenge = os_malloc(CHALLENGE_LEN); 80214501Srpaulo if (data->peer_challenge == NULL) { 81214501Srpaulo os_free(data); 82214501Srpaulo return NULL; 83214501Srpaulo } 84214501Srpaulo os_memcpy(data->peer_challenge, sm->peer_challenge, 85214501Srpaulo CHALLENGE_LEN); 86214501Srpaulo } 87214501Srpaulo 88214501Srpaulo return data; 89214501Srpaulo} 90214501Srpaulo 91214501Srpaulo 92214501Srpaulostatic void eap_mschapv2_reset(struct eap_sm *sm, void *priv) 93214501Srpaulo{ 94214501Srpaulo struct eap_mschapv2_data *data = priv; 95214501Srpaulo if (data == NULL) 96214501Srpaulo return; 97214501Srpaulo 98214501Srpaulo os_free(data->peer_challenge); 99214501Srpaulo os_free(data); 100214501Srpaulo} 101214501Srpaulo 102214501Srpaulo 103214501Srpaulostatic struct wpabuf * eap_mschapv2_build_challenge( 104214501Srpaulo struct eap_sm *sm, struct eap_mschapv2_data *data, u8 id) 105214501Srpaulo{ 106214501Srpaulo struct wpabuf *req; 107214501Srpaulo struct eap_mschapv2_hdr *ms; 108214501Srpaulo char *name = "hostapd"; /* TODO: make this configurable */ 109214501Srpaulo size_t ms_len; 110214501Srpaulo 111214501Srpaulo if (!data->auth_challenge_from_tls && 112214501Srpaulo os_get_random(data->auth_challenge, CHALLENGE_LEN)) { 113214501Srpaulo wpa_printf(MSG_ERROR, "EAP-MSCHAPV2: Failed to get random " 114214501Srpaulo "data"); 115214501Srpaulo data->state = FAILURE; 116214501Srpaulo return NULL; 117214501Srpaulo } 118214501Srpaulo 119214501Srpaulo ms_len = sizeof(*ms) + 1 + CHALLENGE_LEN + os_strlen(name); 120214501Srpaulo req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2, ms_len, 121214501Srpaulo EAP_CODE_REQUEST, id); 122214501Srpaulo if (req == NULL) { 123214501Srpaulo wpa_printf(MSG_ERROR, "EAP-MSCHAPV2: Failed to allocate memory" 124214501Srpaulo " for request"); 125214501Srpaulo data->state = FAILURE; 126214501Srpaulo return NULL; 127214501Srpaulo } 128214501Srpaulo 129214501Srpaulo ms = wpabuf_put(req, sizeof(*ms)); 130214501Srpaulo ms->op_code = MSCHAPV2_OP_CHALLENGE; 131214501Srpaulo ms->mschapv2_id = id; 132214501Srpaulo WPA_PUT_BE16(ms->ms_length, ms_len); 133214501Srpaulo 134214501Srpaulo wpabuf_put_u8(req, CHALLENGE_LEN); 135214501Srpaulo if (!data->auth_challenge_from_tls) 136214501Srpaulo wpabuf_put_data(req, data->auth_challenge, CHALLENGE_LEN); 137214501Srpaulo else 138214501Srpaulo wpabuf_put(req, CHALLENGE_LEN); 139214501Srpaulo wpa_hexdump(MSG_MSGDUMP, "EAP-MSCHAPV2: Challenge", 140214501Srpaulo data->auth_challenge, CHALLENGE_LEN); 141214501Srpaulo wpabuf_put_data(req, name, os_strlen(name)); 142214501Srpaulo 143214501Srpaulo return req; 144214501Srpaulo} 145214501Srpaulo 146214501Srpaulo 147214501Srpaulostatic struct wpabuf * eap_mschapv2_build_success_req( 148214501Srpaulo struct eap_sm *sm, struct eap_mschapv2_data *data, u8 id) 149214501Srpaulo{ 150214501Srpaulo struct wpabuf *req; 151214501Srpaulo struct eap_mschapv2_hdr *ms; 152214501Srpaulo u8 *msg; 153214501Srpaulo char *message = "OK"; 154214501Srpaulo size_t ms_len; 155214501Srpaulo 156214501Srpaulo ms_len = sizeof(*ms) + 2 + 2 * sizeof(data->auth_response) + 1 + 2 + 157214501Srpaulo os_strlen(message); 158214501Srpaulo req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2, ms_len, 159214501Srpaulo EAP_CODE_REQUEST, id); 160214501Srpaulo if (req == NULL) { 161214501Srpaulo wpa_printf(MSG_ERROR, "EAP-MSCHAPV2: Failed to allocate memory" 162214501Srpaulo " for request"); 163214501Srpaulo data->state = FAILURE; 164214501Srpaulo return NULL; 165214501Srpaulo } 166214501Srpaulo 167214501Srpaulo ms = wpabuf_put(req, sizeof(*ms)); 168214501Srpaulo ms->op_code = MSCHAPV2_OP_SUCCESS; 169214501Srpaulo ms->mschapv2_id = data->resp_mschapv2_id; 170214501Srpaulo WPA_PUT_BE16(ms->ms_length, ms_len); 171214501Srpaulo msg = (u8 *) (ms + 1); 172214501Srpaulo 173214501Srpaulo wpabuf_put_u8(req, 'S'); 174214501Srpaulo wpabuf_put_u8(req, '='); 175214501Srpaulo wpa_snprintf_hex_uppercase( 176214501Srpaulo wpabuf_put(req, sizeof(data->auth_response) * 2), 177214501Srpaulo sizeof(data->auth_response) * 2 + 1, 178214501Srpaulo data->auth_response, sizeof(data->auth_response)); 179214501Srpaulo wpabuf_put_u8(req, ' '); 180214501Srpaulo wpabuf_put_u8(req, 'M'); 181214501Srpaulo wpabuf_put_u8(req, '='); 182214501Srpaulo wpabuf_put_data(req, message, os_strlen(message)); 183214501Srpaulo 184214501Srpaulo wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-MSCHAPV2: Success Request Message", 185214501Srpaulo msg, ms_len - sizeof(*ms)); 186214501Srpaulo 187214501Srpaulo return req; 188214501Srpaulo} 189214501Srpaulo 190214501Srpaulo 191214501Srpaulostatic struct wpabuf * eap_mschapv2_build_failure_req( 192214501Srpaulo struct eap_sm *sm, struct eap_mschapv2_data *data, u8 id) 193214501Srpaulo{ 194214501Srpaulo struct wpabuf *req; 195214501Srpaulo struct eap_mschapv2_hdr *ms; 196214501Srpaulo char *message = "E=691 R=0 C=00000000000000000000000000000000 V=3 " 197214501Srpaulo "M=FAILED"; 198214501Srpaulo size_t ms_len; 199214501Srpaulo 200214501Srpaulo ms_len = sizeof(*ms) + os_strlen(message); 201214501Srpaulo req = eap_msg_alloc(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2, ms_len, 202214501Srpaulo EAP_CODE_REQUEST, id); 203214501Srpaulo if (req == NULL) { 204214501Srpaulo wpa_printf(MSG_ERROR, "EAP-MSCHAPV2: Failed to allocate memory" 205214501Srpaulo " for request"); 206214501Srpaulo data->state = FAILURE; 207214501Srpaulo return NULL; 208214501Srpaulo } 209214501Srpaulo 210214501Srpaulo ms = wpabuf_put(req, sizeof(*ms)); 211214501Srpaulo ms->op_code = MSCHAPV2_OP_FAILURE; 212214501Srpaulo ms->mschapv2_id = data->resp_mschapv2_id; 213214501Srpaulo WPA_PUT_BE16(ms->ms_length, ms_len); 214214501Srpaulo 215214501Srpaulo wpabuf_put_data(req, message, os_strlen(message)); 216214501Srpaulo 217214501Srpaulo wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-MSCHAPV2: Failure Request Message", 218214501Srpaulo (u8 *) message, os_strlen(message)); 219214501Srpaulo 220214501Srpaulo return req; 221214501Srpaulo} 222214501Srpaulo 223214501Srpaulo 224214501Srpaulostatic struct wpabuf * eap_mschapv2_buildReq(struct eap_sm *sm, void *priv, 225214501Srpaulo u8 id) 226214501Srpaulo{ 227214501Srpaulo struct eap_mschapv2_data *data = priv; 228214501Srpaulo 229214501Srpaulo switch (data->state) { 230214501Srpaulo case CHALLENGE: 231214501Srpaulo return eap_mschapv2_build_challenge(sm, data, id); 232214501Srpaulo case SUCCESS_REQ: 233214501Srpaulo return eap_mschapv2_build_success_req(sm, data, id); 234214501Srpaulo case FAILURE_REQ: 235214501Srpaulo return eap_mschapv2_build_failure_req(sm, data, id); 236214501Srpaulo default: 237214501Srpaulo wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Unknown state %d in " 238214501Srpaulo "buildReq", data->state); 239214501Srpaulo break; 240214501Srpaulo } 241214501Srpaulo return NULL; 242214501Srpaulo} 243214501Srpaulo 244214501Srpaulo 245214501Srpaulostatic Boolean eap_mschapv2_check(struct eap_sm *sm, void *priv, 246214501Srpaulo struct wpabuf *respData) 247214501Srpaulo{ 248214501Srpaulo struct eap_mschapv2_data *data = priv; 249214501Srpaulo struct eap_mschapv2_hdr *resp; 250214501Srpaulo const u8 *pos; 251214501Srpaulo size_t len; 252214501Srpaulo 253214501Srpaulo pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2, respData, 254214501Srpaulo &len); 255214501Srpaulo if (pos == NULL || len < 1) { 256214501Srpaulo wpa_printf(MSG_INFO, "EAP-MSCHAPV2: Invalid frame"); 257214501Srpaulo return TRUE; 258214501Srpaulo } 259214501Srpaulo 260214501Srpaulo resp = (struct eap_mschapv2_hdr *) pos; 261214501Srpaulo if (data->state == CHALLENGE && 262214501Srpaulo resp->op_code != MSCHAPV2_OP_RESPONSE) { 263214501Srpaulo wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Expected Response - " 264214501Srpaulo "ignore op %d", resp->op_code); 265214501Srpaulo return TRUE; 266214501Srpaulo } 267214501Srpaulo 268214501Srpaulo if (data->state == SUCCESS_REQ && 269214501Srpaulo resp->op_code != MSCHAPV2_OP_SUCCESS && 270214501Srpaulo resp->op_code != MSCHAPV2_OP_FAILURE) { 271214501Srpaulo wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Expected Success or " 272214501Srpaulo "Failure - ignore op %d", resp->op_code); 273214501Srpaulo return TRUE; 274214501Srpaulo } 275214501Srpaulo 276214501Srpaulo if (data->state == FAILURE_REQ && 277214501Srpaulo resp->op_code != MSCHAPV2_OP_FAILURE) { 278214501Srpaulo wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Expected Failure " 279214501Srpaulo "- ignore op %d", resp->op_code); 280214501Srpaulo return TRUE; 281214501Srpaulo } 282214501Srpaulo 283214501Srpaulo return FALSE; 284214501Srpaulo} 285214501Srpaulo 286214501Srpaulo 287214501Srpaulostatic void eap_mschapv2_process_response(struct eap_sm *sm, 288214501Srpaulo struct eap_mschapv2_data *data, 289214501Srpaulo struct wpabuf *respData) 290214501Srpaulo{ 291214501Srpaulo struct eap_mschapv2_hdr *resp; 292214501Srpaulo const u8 *pos, *end, *peer_challenge, *nt_response, *name; 293214501Srpaulo u8 flags; 294214501Srpaulo size_t len, name_len, i; 295214501Srpaulo u8 expected[24]; 296214501Srpaulo const u8 *username, *user; 297214501Srpaulo size_t username_len, user_len; 298214501Srpaulo int res; 299214501Srpaulo 300214501Srpaulo pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2, respData, 301214501Srpaulo &len); 302214501Srpaulo if (pos == NULL || len < 1) 303214501Srpaulo return; /* Should not happen - frame already validated */ 304214501Srpaulo 305214501Srpaulo end = pos + len; 306214501Srpaulo resp = (struct eap_mschapv2_hdr *) pos; 307214501Srpaulo pos = (u8 *) (resp + 1); 308214501Srpaulo 309214501Srpaulo if (len < sizeof(*resp) + 1 + 49 || 310214501Srpaulo resp->op_code != MSCHAPV2_OP_RESPONSE || 311214501Srpaulo pos[0] != 49) { 312214501Srpaulo wpa_hexdump_buf(MSG_DEBUG, "EAP-MSCHAPV2: Invalid response", 313214501Srpaulo respData); 314214501Srpaulo data->state = FAILURE; 315214501Srpaulo return; 316214501Srpaulo } 317214501Srpaulo data->resp_mschapv2_id = resp->mschapv2_id; 318214501Srpaulo pos++; 319214501Srpaulo peer_challenge = pos; 320214501Srpaulo pos += 16 + 8; 321214501Srpaulo nt_response = pos; 322214501Srpaulo pos += 24; 323214501Srpaulo flags = *pos++; 324214501Srpaulo name = pos; 325214501Srpaulo name_len = end - name; 326214501Srpaulo 327214501Srpaulo if (data->peer_challenge) { 328214501Srpaulo wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Using pre-configured " 329214501Srpaulo "Peer-Challenge"); 330214501Srpaulo peer_challenge = data->peer_challenge; 331214501Srpaulo } 332214501Srpaulo wpa_hexdump(MSG_MSGDUMP, "EAP-MSCHAPV2: Peer-Challenge", 333214501Srpaulo peer_challenge, 16); 334214501Srpaulo wpa_hexdump(MSG_MSGDUMP, "EAP-MSCHAPV2: NT-Response", nt_response, 24); 335214501Srpaulo wpa_printf(MSG_MSGDUMP, "EAP-MSCHAPV2: Flags 0x%x", flags); 336214501Srpaulo wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-MSCHAPV2: Name", name, name_len); 337214501Srpaulo 338214501Srpaulo /* MSCHAPv2 does not include optional domain name in the 339214501Srpaulo * challenge-response calculation, so remove domain prefix 340214501Srpaulo * (if present). */ 341214501Srpaulo username = sm->identity; 342214501Srpaulo username_len = sm->identity_len; 343214501Srpaulo for (i = 0; i < username_len; i++) { 344214501Srpaulo if (username[i] == '\\') { 345214501Srpaulo username_len -= i + 1; 346214501Srpaulo username += i + 1; 347214501Srpaulo break; 348214501Srpaulo } 349214501Srpaulo } 350214501Srpaulo 351214501Srpaulo user = name; 352214501Srpaulo user_len = name_len; 353214501Srpaulo for (i = 0; i < user_len; i++) { 354214501Srpaulo if (user[i] == '\\') { 355214501Srpaulo user_len -= i + 1; 356214501Srpaulo user += i + 1; 357214501Srpaulo break; 358214501Srpaulo } 359214501Srpaulo } 360214501Srpaulo 361214501Srpaulo if (username_len != user_len || 362214501Srpaulo os_memcmp(username, user, username_len) != 0) { 363214501Srpaulo wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Mismatch in user names"); 364214501Srpaulo wpa_hexdump_ascii(MSG_DEBUG, "EAP-MSCHAPV2: Expected user " 365214501Srpaulo "name", username, username_len); 366214501Srpaulo wpa_hexdump_ascii(MSG_DEBUG, "EAP-MSCHAPV2: Received user " 367214501Srpaulo "name", user, user_len); 368214501Srpaulo data->state = FAILURE; 369214501Srpaulo return; 370214501Srpaulo } 371214501Srpaulo 372214501Srpaulo wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-MSCHAPV2: User name", 373214501Srpaulo username, username_len); 374214501Srpaulo 375214501Srpaulo if (sm->user->password_hash) { 376214501Srpaulo res = generate_nt_response_pwhash(data->auth_challenge, 377214501Srpaulo peer_challenge, 378214501Srpaulo username, username_len, 379214501Srpaulo sm->user->password, 380214501Srpaulo expected); 381214501Srpaulo } else { 382214501Srpaulo res = generate_nt_response(data->auth_challenge, 383214501Srpaulo peer_challenge, 384214501Srpaulo username, username_len, 385214501Srpaulo sm->user->password, 386214501Srpaulo sm->user->password_len, 387214501Srpaulo expected); 388214501Srpaulo } 389214501Srpaulo if (res) { 390214501Srpaulo data->state = FAILURE; 391214501Srpaulo return; 392214501Srpaulo } 393214501Srpaulo 394214501Srpaulo if (os_memcmp(nt_response, expected, 24) == 0) { 395214501Srpaulo const u8 *pw_hash; 396214501Srpaulo u8 pw_hash_buf[16], pw_hash_hash[16]; 397214501Srpaulo 398214501Srpaulo wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Correct NT-Response"); 399214501Srpaulo data->state = SUCCESS_REQ; 400214501Srpaulo 401214501Srpaulo /* Authenticator response is not really needed yet, but 402214501Srpaulo * calculate it here so that peer_challenge and username need 403214501Srpaulo * not be saved. */ 404214501Srpaulo if (sm->user->password_hash) { 405214501Srpaulo pw_hash = sm->user->password; 406214501Srpaulo } else { 407214501Srpaulo nt_password_hash(sm->user->password, 408214501Srpaulo sm->user->password_len, 409214501Srpaulo pw_hash_buf); 410214501Srpaulo pw_hash = pw_hash_buf; 411214501Srpaulo } 412214501Srpaulo generate_authenticator_response_pwhash( 413214501Srpaulo pw_hash, peer_challenge, data->auth_challenge, 414214501Srpaulo username, username_len, nt_response, 415214501Srpaulo data->auth_response); 416214501Srpaulo 417214501Srpaulo hash_nt_password_hash(pw_hash, pw_hash_hash); 418214501Srpaulo get_master_key(pw_hash_hash, nt_response, data->master_key); 419214501Srpaulo data->master_key_valid = 1; 420214501Srpaulo wpa_hexdump_key(MSG_DEBUG, "EAP-MSCHAPV2: Derived Master Key", 421214501Srpaulo data->master_key, MSCHAPV2_KEY_LEN); 422214501Srpaulo } else { 423214501Srpaulo wpa_hexdump(MSG_MSGDUMP, "EAP-MSCHAPV2: Expected NT-Response", 424214501Srpaulo expected, 24); 425214501Srpaulo wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Invalid NT-Response"); 426214501Srpaulo data->state = FAILURE_REQ; 427214501Srpaulo } 428214501Srpaulo} 429214501Srpaulo 430214501Srpaulo 431214501Srpaulostatic void eap_mschapv2_process_success_resp(struct eap_sm *sm, 432214501Srpaulo struct eap_mschapv2_data *data, 433214501Srpaulo struct wpabuf *respData) 434214501Srpaulo{ 435214501Srpaulo struct eap_mschapv2_hdr *resp; 436214501Srpaulo const u8 *pos; 437214501Srpaulo size_t len; 438214501Srpaulo 439214501Srpaulo pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2, respData, 440214501Srpaulo &len); 441214501Srpaulo if (pos == NULL || len < 1) 442214501Srpaulo return; /* Should not happen - frame already validated */ 443214501Srpaulo 444214501Srpaulo resp = (struct eap_mschapv2_hdr *) pos; 445214501Srpaulo 446214501Srpaulo if (resp->op_code == MSCHAPV2_OP_SUCCESS) { 447214501Srpaulo wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Received Success Response" 448214501Srpaulo " - authentication completed successfully"); 449214501Srpaulo data->state = SUCCESS; 450214501Srpaulo } else { 451214501Srpaulo wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Did not receive Success " 452214501Srpaulo "Response - peer rejected authentication"); 453214501Srpaulo data->state = FAILURE; 454214501Srpaulo } 455214501Srpaulo} 456214501Srpaulo 457214501Srpaulo 458214501Srpaulostatic void eap_mschapv2_process_failure_resp(struct eap_sm *sm, 459214501Srpaulo struct eap_mschapv2_data *data, 460214501Srpaulo struct wpabuf *respData) 461214501Srpaulo{ 462214501Srpaulo struct eap_mschapv2_hdr *resp; 463214501Srpaulo const u8 *pos; 464214501Srpaulo size_t len; 465214501Srpaulo 466214501Srpaulo pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2, respData, 467214501Srpaulo &len); 468214501Srpaulo if (pos == NULL || len < 1) 469214501Srpaulo return; /* Should not happen - frame already validated */ 470214501Srpaulo 471214501Srpaulo resp = (struct eap_mschapv2_hdr *) pos; 472214501Srpaulo 473214501Srpaulo if (resp->op_code == MSCHAPV2_OP_FAILURE) { 474214501Srpaulo wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Received Failure Response" 475214501Srpaulo " - authentication failed"); 476214501Srpaulo } else { 477214501Srpaulo wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Did not receive Failure " 478214501Srpaulo "Response - authentication failed"); 479214501Srpaulo } 480214501Srpaulo 481214501Srpaulo data->state = FAILURE; 482214501Srpaulo} 483214501Srpaulo 484214501Srpaulo 485214501Srpaulostatic void eap_mschapv2_process(struct eap_sm *sm, void *priv, 486214501Srpaulo struct wpabuf *respData) 487214501Srpaulo{ 488214501Srpaulo struct eap_mschapv2_data *data = priv; 489214501Srpaulo 490214501Srpaulo if (sm->user == NULL || sm->user->password == NULL) { 491214501Srpaulo wpa_printf(MSG_INFO, "EAP-MSCHAPV2: Password not configured"); 492214501Srpaulo data->state = FAILURE; 493214501Srpaulo return; 494214501Srpaulo } 495214501Srpaulo 496214501Srpaulo switch (data->state) { 497214501Srpaulo case CHALLENGE: 498214501Srpaulo eap_mschapv2_process_response(sm, data, respData); 499214501Srpaulo break; 500214501Srpaulo case SUCCESS_REQ: 501214501Srpaulo eap_mschapv2_process_success_resp(sm, data, respData); 502214501Srpaulo break; 503214501Srpaulo case FAILURE_REQ: 504214501Srpaulo eap_mschapv2_process_failure_resp(sm, data, respData); 505214501Srpaulo break; 506214501Srpaulo default: 507214501Srpaulo wpa_printf(MSG_DEBUG, "EAP-MSCHAPV2: Unknown state %d in " 508214501Srpaulo "process", data->state); 509214501Srpaulo break; 510214501Srpaulo } 511214501Srpaulo} 512214501Srpaulo 513214501Srpaulo 514214501Srpaulostatic Boolean eap_mschapv2_isDone(struct eap_sm *sm, void *priv) 515214501Srpaulo{ 516214501Srpaulo struct eap_mschapv2_data *data = priv; 517214501Srpaulo return data->state == SUCCESS || data->state == FAILURE; 518214501Srpaulo} 519214501Srpaulo 520214501Srpaulo 521214501Srpaulostatic u8 * eap_mschapv2_getKey(struct eap_sm *sm, void *priv, size_t *len) 522214501Srpaulo{ 523214501Srpaulo struct eap_mschapv2_data *data = priv; 524214501Srpaulo u8 *key; 525214501Srpaulo 526214501Srpaulo if (data->state != SUCCESS || !data->master_key_valid) 527214501Srpaulo return NULL; 528214501Srpaulo 529214501Srpaulo *len = 2 * MSCHAPV2_KEY_LEN; 530214501Srpaulo key = os_malloc(*len); 531214501Srpaulo if (key == NULL) 532214501Srpaulo return NULL; 533214501Srpaulo /* MSK = server MS-MPPE-Recv-Key | MS-MPPE-Send-Key */ 534214501Srpaulo get_asymetric_start_key(data->master_key, key, MSCHAPV2_KEY_LEN, 0, 1); 535214501Srpaulo get_asymetric_start_key(data->master_key, key + MSCHAPV2_KEY_LEN, 536214501Srpaulo MSCHAPV2_KEY_LEN, 1, 1); 537214501Srpaulo wpa_hexdump_key(MSG_DEBUG, "EAP-MSCHAPV2: Derived key", key, *len); 538214501Srpaulo 539214501Srpaulo return key; 540214501Srpaulo} 541214501Srpaulo 542214501Srpaulo 543214501Srpaulostatic Boolean eap_mschapv2_isSuccess(struct eap_sm *sm, void *priv) 544214501Srpaulo{ 545214501Srpaulo struct eap_mschapv2_data *data = priv; 546214501Srpaulo return data->state == SUCCESS; 547214501Srpaulo} 548214501Srpaulo 549214501Srpaulo 550214501Srpauloint eap_server_mschapv2_register(void) 551214501Srpaulo{ 552214501Srpaulo struct eap_method *eap; 553214501Srpaulo int ret; 554214501Srpaulo 555214501Srpaulo eap = eap_server_method_alloc(EAP_SERVER_METHOD_INTERFACE_VERSION, 556214501Srpaulo EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2, 557214501Srpaulo "MSCHAPV2"); 558214501Srpaulo if (eap == NULL) 559214501Srpaulo return -1; 560214501Srpaulo 561214501Srpaulo eap->init = eap_mschapv2_init; 562214501Srpaulo eap->reset = eap_mschapv2_reset; 563214501Srpaulo eap->buildReq = eap_mschapv2_buildReq; 564214501Srpaulo eap->check = eap_mschapv2_check; 565214501Srpaulo eap->process = eap_mschapv2_process; 566214501Srpaulo eap->isDone = eap_mschapv2_isDone; 567214501Srpaulo eap->getKey = eap_mschapv2_getKey; 568214501Srpaulo eap->isSuccess = eap_mschapv2_isSuccess; 569214501Srpaulo 570214501Srpaulo ret = eap_server_method_register(eap); 571214501Srpaulo if (ret) 572214501Srpaulo eap_server_method_free(eap); 573214501Srpaulo return ret; 574214501Srpaulo} 575