eappeap.c

来自「linux 下通过802.1认证的安装包」· C语言 代码 · 共 600 行 · 第 1/2 页

/**
 * EAP-PEAP Function implementations
 * 
 * Licensed under a dual GPL/BSD license.  (See LICENSE file for more info.)
 *
 * \file eappeap.c
 *
 * \author [e-mail]
 *
 * $Id: eappeap.c,v 1.43.2.52 2008/01/21 22:51:49 chessing Exp $
 * $Date: 2008/01/21 22:51:49 $
 **/

#include <string.h>
#include <stdlib.h>

#ifdef WINDOWS
#include <Winsock2.h>
#endif

#include "../../../lib/libxsupconfig/xsupconfig_structs.h"
#include "../../xsup_common.h"
#include "../../../lib/libxsupconfig/xsupconfig.h"
#include "../../context.h"
#include "../../xsup_debug.h"
#include "../../xsup_err.h"
#include "../../frame_structs.h"
#include "../../eap_sm.h"
#include "../../eap_types/tls/eaptls.h"
#include "../../eap_types/tls/tls_funcs.h"
#include "eappeap.h"
#include "peap_phase2.h"
#include "../../eap_types/eap_type_common.h"
#include "../../ipc_callout.h"
#include "../../xsup_ipc.h"
#include "../../ipc_events.h"
#include "../../ipc_events_index.h"
#include "../tls/certificates.h"

#ifdef USE_EFENCE
#include <efence.h>
#endif

/************************************************************************
 *
 * This is called if methodState == INIT.  It should set up all of the
 * memory that we will need to complete the authentication.
 *
 ************************************************************************/
uint8_t eappeap_init(eap_type_data *eapdata)
{
  struct tls_vars *mytls_vars;
  struct config_eap_peap *peapconf;
  struct config_globals *globals;

  if (!xsup_assert((eapdata != NULL), "eapdata != NULL", FALSE))
    return FALSE;

  peapconf = (struct config_eap_peap *)eapdata->eap_conf_data;

  if (!xsup_assert((peapconf != NULL), "peapconf != NULL", FALSE))
    return FALSE;

  if (eapdata->eap_data == NULL)
    {
      eapdata->eap_data = Malloc(sizeof(struct tls_vars));
      if (eapdata->eap_data == NULL)
        {
          debug_printf(DEBUG_NORMAL, "Couldn't allocate memory to store PEAP "
                       "specific data structures.\n");
		  ipc_events_malloc_failed(NULL);
          return FALSE;
        }

      mytls_vars = eapdata->eap_data;

      if (tls_funcs_init(mytls_vars, EAP_TYPE_PEAP) != XENONE)
        {
          debug_printf(DEBUG_NORMAL, "Couldn't initialize SSL engine!\n");
          return FALSE;
        }
    }

  mytls_vars = eapdata->eap_data;

  mytls_vars->resume = peapconf->session_resume;

  FREE(mytls_vars->keyblock);
 
  if ((mytls_vars->certs_loaded & ROOT_CERTS_LOADED) == 0x00)
    {
	  if (peapconf->validate_cert == FALSE)
        {
          // We were told not to verify certificates.  Spew out a warning, and
          // then do it!
          mytls_vars->verify_cert = FALSE;

		  FREE(mytls_vars->cncheck);

          globals = config_get_globals();

          if (globals != NULL)
            {
              if (!TEST_FLAG(globals->flags,
                             CONFIG_GLOBALS_NO_FRIENDLY_WARNINGS))
                {
					debug_printf(DEBUG_NORMAL, "WARNING - Verification of the Trusted Server's certificate is disabled.  The connection's security could be compromised.\n");
                }
            }
        }
      else
        {
			mytls_vars->verify_cert = TRUE;

			if (certificates_load_root(mytls_vars, peapconf->trusted_server) != XENONE)
			{
				debug_printf(DEBUG_NORMAL, "Unable to load root certificate(s)!\n");
				return FALSE;
			}
	    }
	
		mytls_vars->certs_loaded |= ROOT_CERTS_LOADED;
  }

  if (tls_funcs_load_random(mytls_vars, peapconf->random_file) != XENONE)
    {
      debug_printf(DEBUG_NORMAL, "Failed to load random data!\n");
      eap_type_common_fail(eapdata);
      return XEGENERROR;
    }

  if ((mytls_vars->certs_loaded & USER_CERTS_LOADED) == 0x00)
    {
      if ((peapconf->user_cert != NULL) && (peapconf->user_key_pass != NULL))
        {
          debug_printf(DEBUG_NORMAL, "Using user certificate with PEAP!\n");
          tls_funcs_load_user_cert(mytls_vars, peapconf->user_cert,
                                   peapconf->user_key,
                                   peapconf->user_key_pass);
        }
    }

  mytls_vars->handshake_done = FALSE;

  peap_phase2_init(eapdata);

  eap_type_common_init_eap_data(eapdata);
  eapdata->methodState = MAY_CONT;

  return TRUE;
}

/************************************************************************
 *
 * Check to see if we are ready to do a PEAP authentication.
 *
 ************************************************************************/
void eappeap_check(eap_type_data *eapdata)
{
  struct config_eap_peap *peapconf;
  struct tls_vars *mytls_vars;

  if (!xsup_assert((eapdata != NULL), "eapdata != NULL", FALSE))
    return;

  if (!xsup_assert((eapdata->eap_conf_data != NULL), 
		   "eapdata->eap_conf_data != NULL", FALSE))
    {
      eap_type_common_fail(eapdata);
      return;
    }

  debug_printf(DEBUG_AUTHTYPES, "(EAP-PEAP) Checking...\n");
  if (eapdata->methodState == INIT)
    {
      if (eappeap_init(eapdata) != TRUE)
	{
	  debug_printf(DEBUG_NORMAL, "Failed to init PEAP!\n");
	  eap_type_common_fail(eapdata);
	  return;
	}
    }

  if (!xsup_assert((eapdata->eap_data != NULL), "eapdata->eap_data != NULL",
		   FALSE))
    {
      eap_type_common_fail(eapdata);
      return;
    }

  mytls_vars = (struct tls_vars *)eapdata->eap_data;

  peapconf = (struct config_eap_peap *)eapdata->eap_conf_data;

  if ((peapconf->user_key_pass == NULL) && (peapconf->user_key != NULL))
    {
      debug_printf(DEBUG_NORMAL, "No PEAP phase 1 password!\n");
      eap_type_common_fail(eapdata);
      return;
    }
      
  peap_phase2_check(eapdata);
}

/************************************************************************
 *
 * Process a PEAP request.
 *
 ************************************************************************/
void eappeap_process(eap_type_data *eapdata)
{
  struct tls_vars *mytls_vars = NULL;
  struct config_eap_peap *peapconf;
  struct phase2_data *p2d = NULL;
  uint8_t peap_version;
  uint8_t *tls_type = NULL;
  struct eap_header *eaphdr = NULL;
  uint8_t *resbuf = NULL;
  int16_t bufsiz = 0;

  debug_printf(DEBUG_AUTHTYPES, "(EAP-PEAP) Processing.\n");
  if (!xsup_assert((eapdata != NULL), "eapdata != NULL", FALSE))
      return;

  if (!xsup_assert((eapdata->eap_data != NULL), 
		   "eapdata->eap_data != NULL", FALSE))
    {
      eapdata->decision = EAP_FAIL;
      eapdata->ignore = TRUE;
      return;
    }

  mytls_vars = eapdata->eap_data;

  if (eapdata->methodState == INIT)
    {
      if (eappeap_init(eapdata) == FALSE)
	{
	  debug_printf(DEBUG_NORMAL, "Failed the initialize EAP-PEAP.  We "
		       "cannot continue the authentication.\n");
	  eapdata->decision = EAP_FAIL;
	  eapdata->ignore = TRUE;
	}
    }

  p2d = mytls_vars->phase2data;

  if (p2d == NULL)
    {
      debug_printf(DEBUG_NORMAL, "No phase 2 data structure available!\n");
      eapdata->decision = EAP_FAIL;
      eapdata->ignore = TRUE;
      return;
    }

  peapconf = (struct config_eap_peap *)eapdata->eap_conf_data;

  if (peapconf == NULL)
  {
	  debug_printf(DEBUG_NORMAL, "No valid PEAP configuration found in memory!\n");
	  eap_type_common_fail(eapdata);
	  return;
  }

  tls_type = &eapdata->eapReqData[sizeof(struct eap_header)];
  peap_version = (tls_type[0] & PEAP_VERSION_MASK);

  if (peapconf->force_peap_version != 0xff)
  {
	  if (peapconf->force_peap_version > HIGHEST_PEAP_SUPPORTED)
	  {
		  debug_printf(DEBUG_NORMAL, "User requested that we force the PEAP version to a version "
				"that we don't support.  We will negotiate with the server.\n");
		  peapconf->force_peap_version = 0xff;   // So we don't try the wrong thing again.

		  set_peap_version(p2d, peap_version);
	  }
	  else
	  {
	    if (peap_version != peapconf->force_peap_version)
		{
			debug_printf(DEBUG_NORMAL, "Forcing PEAP version to %d, per configuration file!\n",
				peapconf->force_peap_version);
		}

		set_peap_version(p2d, peapconf->force_peap_version);
	  }
  }
  else
  {
	set_peap_version(p2d, peap_version);
  }

  tls_type[0] = (tls_type[0] & PEAP_MASK_OUT_VERSION);

  if ((eapdata->eapReqData[sizeof(struct eap_header)] == EAPTLS_START)
      || (mytls_vars->handshake_done != TRUE))
    {
      debug_printf(DEBUG_AUTHTYPES, "(EAP-PEAP) Processing packet.\n");
      // Actually start to process the packet.