eappeap.c

来自「linux 下通过802.1认证的安装包」· C语言 代码 · 共 600 行 · 第 1/2 页

      eapdata->methodState = tls_funcs_process(eapdata->eap_data,
                                               eapdata->eapReqData);

	  if (eapdata->methodState == EAP_FAIL) eap_type_common_fail(eapdata);
    }
  else
    {
      // We are in later packets of phase 2.
      eaphdr = (struct eap_header *)eapdata->eapReqData;
      bufsiz = ntohs(eaphdr->eap_length) - sizeof(struct eap_header);

      if (tls_funcs_buffer(eapdata->eap_data,
                           &eapdata->eapReqData[sizeof(struct eap_header)],
                           bufsiz) != XENONE)
        {
	  debug_printf(DEBUG_NORMAL, "There was an error buffering data "
                       "fragments.  Discarding fragment.\n");
          eapdata->ignore = FALSE;
          return;
        }

      bufsiz = tls_funcs_decrypt_ready(eapdata->eap_data);

      switch (bufsiz)
        {
        case 0:
          // Nothing to do yet.
          break;

        case -1:
          // Got an error.  Discard the frame.
			eap_type_common_fail(eapdata);
          break;

        default:
          // Data to be decrypted.
          resbuf = Malloc(bufsiz);
          if (resbuf == NULL)
            {
              debug_printf(DEBUG_NORMAL, "Couldn't allocate memory needed to"
                           " store decrypted data!\n");
			  ipc_events_malloc_failed(NULL);
			  eap_type_common_fail(eapdata);
              break;
            }

          if (tls_funcs_decrypt(eapdata->eap_data, resbuf, (uint16_t *)&bufsiz) != XENONE)
            {
              debug_printf(DEBUG_NORMAL, "Decryption failed!\n");
			  ipc_events_error(NULL, IPC_EVENT_ERROR_TLS_DECRYPTION_FAILED, NULL);
			  eap_type_common_fail(eapdata);
              break;
            }

	  peap_phase2_process(eapdata, resbuf, bufsiz);

          FREE(resbuf);
	  break;
	}
    }
}

/************************************************************************
 *
 * Build a PEAP response message.
 *
 ************************************************************************/
uint8_t *eappeap_buildResp(eap_type_data *eapdata)
{
  uint8_t *res = NULL, *peapres = NULL;
  uint16_t res_size = 0, total_size = 0;
  struct eap_header *eaphdr = NULL;
  uint8_t reqId;
  uint8_t resbuf[1500];
  struct tls_vars *mytls_vars = NULL;
  struct config_eap_peap *eapconf = NULL;

  if (!xsup_assert((eapdata != NULL), "eapdata != NULL", FALSE))
    return NULL;

  if (!xsup_assert((eapdata->eap_data != NULL), "eapdata->eap_data != NULL",
                   FALSE))
    return NULL;

  if (!xsup_assert((eapdata->eap_conf_data != NULL),
                   "eapdata->eap_conf_data != NULL", FALSE))
    return NULL;

  eapconf = eapdata->eap_conf_data;

  mytls_vars = (struct tls_vars *)eapdata->eap_data;

  if (mytls_vars->handshake_done == TRUE)
    {
      peap_phase2_buildResp(eapdata, (uint8_t *)&resbuf,
                            (uint16_t *)&res_size);

      if (res_size == 0)
	{
          // Build ACK.
          peapres = eap_type_common_buildAck(eapdata, EAP_TYPE_PEAP);
		  peapres[sizeof(struct eap_header)] |= get_peap_version(eapdata);
		  return peapres; 
        }
      else
        {
          tls_funcs_encrypt(eapdata->eap_data, resbuf, res_size);
        }
    }

  if ((eapconf->chunk_size == 0) || (eapconf->chunk_size > MAX_CHUNK))
    eapconf->chunk_size = MAX_CHUNK;

  if (tls_funcs_get_packet(eapdata->eap_data, eapconf->chunk_size, &res,
                           &res_size) != XENONE)
    {
      return NULL;
    }

  if (res == NULL) return NULL;

  eaphdr = (struct eap_header *)eapdata->eapReqData;
  reqId = eaphdr->eap_identifier;

  peapres = Malloc(res_size + sizeof(struct eap_header));
  if (peapres == NULL) 
  {
	  ipc_events_malloc_failed(NULL);
	  return NULL;
  }

  eaphdr = (struct eap_header *)peapres;

  eaphdr->eap_code = EAP_RESPONSE_PKT;
  eaphdr->eap_identifier = reqId;
  total_size = res_size + sizeof(struct eap_header);
  eaphdr->eap_length = htons(total_size);
  eaphdr->eap_type = EAP_TYPE_PEAP;

  memcpy(&peapres[sizeof(struct eap_header)], res, res_size);

  peapres[sizeof(struct eap_header)] |= get_peap_version(eapdata);

  FREE(res);

  return peapres;
}

/************************************************************************
*
*  Set the key constants based on the PEAP version in use.
*
*************************************************************************/
void eappeap_set_key_const(struct tls_vars *mytls_vars, uint8_t ver)
{
  switch (ver)
    {
    case PEAP_VERSION0:
      debug_printf(DEBUG_AUTHTYPES, "Setting Key Constant for PEAP v0!\n");
      mytls_vars->sessionkeyconst = (uint8_t *)_strdup(PEAP_SESSION_KEY_CONST);
      mytls_vars->sessionkeylen = PEAP_SESSION_KEY_CONST_SIZE;
      break;

    case PEAP_VERSION1:
      debug_printf(DEBUG_AUTHTYPES, "Setting Key Constant for PEAP v1!\n");
      mytls_vars->sessionkeyconst = (uint8_t *)_strdup(PEAPv1_SESSION_KEY_CONST);
      mytls_vars->sessionkeylen = PEAPv1_SESSION_KEY_CONST_SIZE;
      break;

    default:
      debug_printf(DEBUG_NORMAL, "Unknown PEAP version %d!\n", ver);
      break;
    }
}

/************************************************************************
 *
 * Determine if keying material is available.
 *
 ************************************************************************/
uint8_t eappeap_isKeyAvailable(eap_type_data *eapdata)
{
  struct tls_vars *mytls_vars = NULL;
  struct config_eap_peap *peapconf = NULL;
  uint8_t ver = 0;

  if (!xsup_assert((eapdata != NULL), "eapdata != NULL", FALSE))
    return FALSE;

  if (!xsup_assert((eapdata->eap_data != NULL), "eapdata->eap_data != NULL",
                   FALSE))
    return FALSE;

  if (!xsup_assert((eapdata->eap_conf_data != NULL), "eapdata->eap_conf_data != NULL",
	  FALSE))
	  return FALSE;

  mytls_vars = (struct tls_vars *)eapdata->eap_data;
  peapconf = (struct config_eap_peap *)eapdata->eap_conf_data;

  if (mytls_vars->handshake_done == FALSE) return FALSE;

  if (mytls_vars->keyblock != NULL) return TRUE;

  ver = get_peap_version(eapdata);

  if ((ver == 1) && (peapconf->proper_peapv1 == TRUE))
  {
	  debug_printf(DEBUG_NORMAL, "NOTICE : Most RADIUS servers do not do proper PEAP v1 keying!\n");
	  debug_printf(DEBUG_NORMAL, "If your authentication succeeds, and traffic cannot flow, try\n");
	  debug_printf(DEBUG_NORMAL, "turning off Proper_PEAP_V1_Keying!\n");
  }
  else
  {
	  ver = 0;
  }

  eappeap_set_key_const(mytls_vars, ver);

  mytls_vars->keyblock = tls_funcs_gen_keyblock(mytls_vars,
						TLS_FUNCS_CLIENT_FIRST,
                                                mytls_vars->sessionkeyconst,
                                                mytls_vars->sessionkeylen);

  if (mytls_vars->keyblock == NULL) return FALSE;

  return TRUE;
}

/************************************************************************
 *
 * If keying material is available, get the key.
 *
 ************************************************************************/
uint8_t *eappeap_getKey(eap_type_data *eapdata)
{
  struct tls_vars *mytls_vars;
  uint8_t *keydata;

  if (!xsup_assert((eapdata != NULL), "eapdata != NULL", FALSE))
    return NULL;

  if (!xsup_assert((eapdata->eap_data != NULL), "eapdata->eap_data != NULL",
                   FALSE))
    return NULL;

  mytls_vars = (struct tls_vars *)eapdata->eap_data;

  if (mytls_vars->keyblock == NULL)
    {
      debug_printf(DEBUG_NORMAL, "No keying material available!\n");
      return NULL;
    }

  keydata = Malloc(64);
  if (keydata == NULL)
    {
      debug_printf(DEBUG_NORMAL, "Couldn't allocate memory to return key "
		   "block!\n");
	  ipc_events_malloc_failed(NULL);
      return NULL;
    }

  memcpy(keydata, mytls_vars->keyblock, 64);

  debug_printf(DEBUG_AUTHTYPES, "Generated keyblock : \n");
  debug_hex_dump(DEBUG_AUTHTYPES, mytls_vars->keyblock, 64);

  return keydata;
}

/************************************************************************
 *
 * Clean up after ourselves.
 *
 ************************************************************************/
void eappeap_deinit(eap_type_data *eapdata)
{
  struct tls_vars *mytls_vars;

  if (!xsup_assert((eapdata != NULL), "eapdata != NULL", FALSE))
    return;

  if (!xsup_assert((eapdata->eap_data != NULL), 
		   "eapdata->eap_data != NULL", FALSE))
    return;

  mytls_vars = (struct tls_vars *)eapdata->eap_data;

  peap_phase2_deinit(eapdata);
  tls_funcs_deinit(mytls_vars);

  FREE(mytls_vars->keyblock);

  FREE(eapdata->eap_data);
 
  debug_printf(DEBUG_AUTHTYPES, "(EAP-PEAP) Cleaned up.\n");
}