Skip to content

Commit 4b532dc

Browse files
alandekokalandekok
committed
debug print TEAP attributes we're sending in phase 2
1 parent 25ff1d7 commit 4b532dc

File tree

1 file changed

+33
-16
lines changed

1 file changed

+33
-16
lines changed

‎src/modules/rlm_eap/types/rlm_eap_teap/eap_teap.c‎

Lines changed: 33 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -168,26 +168,41 @@ static void eap_teap_derive_imck(REQUEST *request, tls_session_t *tls_session,
168168
memcpy(&t->imck_msk, &imck_msk, sizeof(imck_msk));
169169
}
170170

171-
static void eap_teap_tlv_append(tls_session_t *tls_session, int tlv, bool mandatory, int length, const void *data)
171+
static void eap_teap_tlv_append(REQUEST *request, tls_session_t *tls_session, int tlv, bool mandatory, int length, const void *data)
172172
{
173173
uint16_t hdr[2];
174174

175175
hdr[0] = htons(tlv | (mandatory ? EAP_TEAP_TLV_MANDATORY : 0));
176176
hdr[1] = htons(length);
177177

178+
if ((rad_debug_lvl > 1) && (length < 256)) {
179+
DICT_ATTR const *da;
180+
181+
da = dict_attrbyvalue((tlv << 8) | PW_FREERADIUS_EAP_TEAP_TLV, VENDORPEC_FREERADIUS);
182+
if (da) {
183+
char buf[1024];
184+
185+
for (size_t i = 0; i < (size_t) length; i++) {
186+
sprintf(&buf[2*i], "%02x", ((const uint8_t *)data)[i]);
187+
}
188+
189+
RDEBUG(" %s = 0x%s", da->name, buf);
190+
}
191+
}
192+
178193
tls_session->record_plus(&tls_session->clean_in, &hdr, 4);
179194
tls_session->record_plus(&tls_session->clean_in, data, length);
180195
}
181196

182-
static void eap_teap_send_error(tls_session_t *tls_session, int error)
197+
static void eap_teap_send_error(REQUEST *request, tls_session_t *tls_session, int error)
183198
{
184199
uint32_t value;
185200
value = htonl(error);
186201

187-
eap_teap_tlv_append(tls_session, EAP_TEAP_TLV_ERROR, true, sizeof(value), &value);
202+
eap_teap_tlv_append(request, tls_session, EAP_TEAP_TLV_ERROR, true, sizeof(value), &value);
188203
}
189204

190-
static void eap_teap_append_identity_type(tls_session_t *tls_session, int value)
205+
static void eap_teap_append_identity_type(REQUEST *request, tls_session_t *tls_session, int value)
191206
{
192207
uint16_t identity;
193208
identity = htons(value);
@@ -202,7 +217,7 @@ static void eap_teap_append_identity_type(tls_session_t *tls_session, int value)
202217
t->auths[value].required = true;
203218
t->auths[value].sent = true;
204219

205-
eap_teap_tlv_append(tls_session, EAP_TEAP_TLV_IDENTITY_TYPE, false, sizeof(identity), &identity);
220+
eap_teap_tlv_append(request, tls_session, EAP_TEAP_TLV_IDENTITY_TYPE, false, sizeof(identity), &identity);
206221
}
207222

208223
static void eap_teap_append_result(REQUEST *request, tls_session_t *tls_session, PW_CODE code)
@@ -224,7 +239,7 @@ static void eap_teap_append_result(REQUEST *request, tls_session_t *tls_session,
224239

225240
RDEBUG("Phase 2: %s = %s", name, state_name);
226241

227-
eap_teap_tlv_append(tls_session, type, true, sizeof(state), &state);
242+
eap_teap_tlv_append(request, tls_session, type, true, sizeof(state), &state);
228243
}
229244

230245
static void eap_teap_append_eap_identity_request(REQUEST *request, tls_session_t *tls_session, eap_handler_t *eap_session)
@@ -239,7 +254,7 @@ static void eap_teap_append_eap_identity_request(REQUEST *request, tls_session_t
239254
eap_packet.length[1] = EAP_HEADER_LEN + 1;
240255
eap_packet.data[0] = PW_EAP_IDENTITY;
241256

242-
eap_teap_tlv_append(tls_session, EAP_TEAP_TLV_EAP_PAYLOAD, true, sizeof(eap_packet), &eap_packet);
257+
eap_teap_tlv_append(request, tls_session, EAP_TEAP_TLV_EAP_PAYLOAD, true, sizeof(eap_packet), &eap_packet);
243258
}
244259

245260
/*
@@ -259,8 +274,6 @@ static void eap_teap_append_crypto_binding(REQUEST *request, tls_session_t *tls_
259274
struct crypto_binding_buffer *cbb;
260275
uint8_t *outer_tlvs;
261276

262-
RDEBUG("Phase 2: Sending Cryptobinding");
263-
264277
eap_teap_derive_imck(request, tls_session, msk, msklen, emsk, emsklen);
265278

266279
t->imck_emsk_available = emsklen > 0;
@@ -281,6 +294,8 @@ static void eap_teap_append_crypto_binding(REQUEST *request, tls_session_t *tls_
281294

282295
cbb->binding.subtype = ((emsklen ? EAP_TEAP_TLV_CRYPTO_BINDING_FLAGS_CMAC_BOTH : EAP_TEAP_TLV_CRYPTO_BINDING_FLAGS_CMAC_MSK) << 4) | EAP_TEAP_TLV_CRYPTO_BINDING_SUBTYPE_REQUEST;
283296

297+
RDEBUG("Phase 2: Sending Cryptobinding flags=%d", emsklen ? EAP_TEAP_TLV_CRYPTO_BINDING_FLAGS_CMAC_BOTH : EAP_TEAP_TLV_CRYPTO_BINDING_FLAGS_CMAC_MSK);
298+
284299
rad_assert(sizeof(cbb->binding.nonce) % sizeof(uint32_t) == 0);
285300
RANDFILL(cbb->binding.nonce);
286301
cbb->binding.nonce[sizeof(cbb->binding.nonce) - 1] &= ~0x01; /* RFC 7170, Section 4.2.13 */
@@ -312,7 +327,7 @@ static void eap_teap_append_crypto_binding(REQUEST *request, tls_session_t *tls_
312327
memcpy(cbb->binding.emsk_compound_mac, &mac_emsk, sizeof(cbb->binding.emsk_compound_mac));
313328
}
314329

315-
eap_teap_tlv_append(tls_session, EAP_TEAP_TLV_CRYPTO_BINDING, true, sizeof(cbb->binding), (uint8_t *)&cbb->binding);
330+
eap_teap_tlv_append(request, tls_session, EAP_TEAP_TLV_CRYPTO_BINDING, true, sizeof(cbb->binding), (uint8_t *)&cbb->binding);
316331
}
317332

318333
static int eap_teap_verify(REQUEST *request, tls_session_t *tls_session, uint8_t const *data, unsigned int data_len)
@@ -365,7 +380,7 @@ static int eap_teap_verify(REQUEST *request, tls_session_t *tls_session, uint8_t
365380
RDEBUG("Phase 2: - attribute %d is present", i);
366381
}
367382
}
368-
eap_teap_send_error(tls_session, EAP_TEAP_ERR_UNEXPECTED_TLV);
383+
eap_teap_send_error(request, tls_session, EAP_TEAP_ERR_UNEXPECTED_TLV);
369384
return 0;
370385
}
371386

@@ -1025,7 +1040,7 @@ static rlm_rcode_t CC_HINT(nonnull) process_reply(eap_handler_t *eap_session,
10251040
t->identity_types[t->num_identities++] = vp->vp_short;
10261041

10271042
/* RFC7170, Appendix C.6 */
1028-
eap_teap_append_identity_type(tls_session, vp->vp_short);
1043+
eap_teap_append_identity_type(request, tls_session, vp->vp_short);
10291044

10301045
if (t->default_method || t->eap_method[vp->vp_short]) {
10311046
eap_teap_append_eap_identity_request(request, tls_session, eap_session);
@@ -1125,7 +1140,7 @@ static rlm_rcode_t CC_HINT(nonnull) process_reply(eap_handler_t *eap_session,
11251140
vp = fr_pair_find_by_num(reply->vps, PW_EAP_MESSAGE, 0, TAG_ANY);
11261141
if (vp) {
11271142
doing_eap = true;
1128-
eap_teap_tlv_append(tls_session, EAP_TEAP_TLV_EAP_PAYLOAD, true, vp->vp_length, vp->vp_octets);
1143+
eap_teap_tlv_append(request, tls_session, EAP_TEAP_TLV_EAP_PAYLOAD, true, vp->vp_length, vp->vp_octets);
11291144
}
11301145

11311146
/*
@@ -1146,7 +1161,7 @@ static rlm_rcode_t CC_HINT(nonnull) process_reply(eap_handler_t *eap_session,
11461161
t->sent_basic_password = true;
11471162

11481163
RDEBUG("Phase 2: Sending Basic-Password-Auth-Req");
1149-
eap_teap_tlv_append(tls_session, EAP_TEAP_TLV_BASIC_PASSWORD_AUTH_REQ, true, vp->vp_length, vp->vp_strvalue);
1164+
eap_teap_tlv_append(request, tls_session, EAP_TEAP_TLV_BASIC_PASSWORD_AUTH_REQ, true, vp->vp_length, vp->vp_strvalue);
11501165
}
11511166

11521167
break;
@@ -1468,6 +1483,8 @@ static PW_CODE eap_teap_crypto_binding(REQUEST *request, UNUSED eap_handler_t *e
14681483
*/
14691484
const EVP_MD *md = SSL_CIPHER_get_handshake_digest(SSL_get_current_cipher(tls_session->ssl));
14701485

1486+
RDEBUG("Phase 2: Crypto-Binding flags=%d", flags);
1487+
14711488
/*
14721489
* We verify cryptobinding MSK and EMSK, but we prefer
14731490
* EMSK for the later IMCK deriviation.
@@ -1761,7 +1778,7 @@ PW_CODE eap_teap_process(eap_handler_t *eap_session, tls_session_t *tls_session)
17611778
vp = fr_pair_find_by_num(request->state, PW_EAP_TEAP_TLV_IDENTITY_TYPE, VENDORPEC_FREERADIUS, TAG_ANY);
17621779
if (vp) {
17631780
RDEBUG("Phase 2: Sending Identity-Type = %s", (vp->vp_short == 1) ? "User" : "Machine");
1764-
eap_teap_append_identity_type(tls_session, vp->vp_short);
1781+
eap_teap_append_identity_type(request, tls_session, vp->vp_short);
17651782

17661783
if (t->num_identities == 2) {
17671784
RDEBUG("Phase 2: Configured to send too many identities, failing the session");
@@ -1783,7 +1800,7 @@ PW_CODE eap_teap_process(eap_handler_t *eap_session, tls_session_t *tls_session)
17831800
} else {
17841801
RDEBUG("Phase 2: No %s EAP method configured - sending Basic-Password-Auth-Req = \"\"",
17851802
!vp ? "" : (vp->vp_short == 1) ? "User" : "Machine");
1786-
eap_teap_tlv_append(tls_session, EAP_TEAP_TLV_BASIC_PASSWORD_AUTH_REQ, true, 0, "");
1803+
eap_teap_tlv_append(request, tls_session, EAP_TEAP_TLV_BASIC_PASSWORD_AUTH_REQ, true, 0, "");
17871804
}
17881805

17891806
t->stage = AUTHENTICATION;

0 commit comments

Comments
 (0)