DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

TTLS client: Support phase2_auth=2

Browse source 
Allow the phase2_auth=2 parameter (in phase1 configuration item) to be
used with EAP-TTLS to require Phase 2 authentication. In practice, this
disables TLS session resumption since EAP-TTLS is defined to skip Phase
2 when resuming a session.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
This commit is contained in:
Jouni Malinen 2023-07-17 21:20:37 +03:00 • committed by Jouni Malinen
parent 8e6485a1bc
commit de9a11f4dd
1 changed files with 27 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
src/eap_peer/eap_ttls.c
View file

@ -65,9 +65,30 @@ struct eap_ttls_data {
int ready_for_tnc; int ready_for_tnc;
int tnc_started; int tnc_started;
#endif /* EAP_TNC */ #endif /* EAP_TNC */
enum { NO_AUTH, FOR_INITIAL, ALWAYS } phase2_auth;
}; };
static void eap_ttls_parse_phase1(struct eap_ttls_data *data,
const char *phase1)
{
if (os_strstr(phase1, "phase2_auth=0")) {
data->phase2_auth = NO_AUTH;
wpa_printf(MSG_DEBUG,
"EAP-TTLS: Do not require Phase 2 authentication");
} else if (os_strstr(phase1, "phase2_auth=1")) {
data->phase2_auth = FOR_INITIAL;
wpa_printf(MSG_DEBUG,
"EAP-TTLS: Require Phase 2 authentication for initial connection");
} else if (os_strstr(phase1, "phase2_auth=2")) {
data->phase2_auth = ALWAYS;
wpa_printf(MSG_DEBUG,
"EAP-TTLS: Require Phase 2 authentication for all cases");
}
}
static void * eap_ttls_init(struct eap_sm *sm) static void * eap_ttls_init(struct eap_sm *sm)
{ {
struct eap_ttls_data *data; struct eap_ttls_data *data;
@ -82,6 +103,10 @@ static void * eap_ttls_init(struct eap_sm *sm)
selected = "EAP"; selected = "EAP";
selected_non_eap = 0; selected_non_eap = 0;
data->phase2_type = EAP_TTLS_PHASE2_EAP; data->phase2_type = EAP_TTLS_PHASE2_EAP;
data->phase2_auth = FOR_INITIAL;
if (config && config->phase1)
eap_ttls_parse_phase1(data, config->phase1);
/* /*
* Either one auth= type or one or more autheap= methods can be * Either one auth= type or one or more autheap= methods can be
@ -1703,8 +1728,9 @@ static struct wpabuf * eap_ttls_process(struct eap_sm *sm, void *priv,
static bool eap_ttls_has_reauth_data(struct eap_sm *sm, void *priv) static bool eap_ttls_has_reauth_data(struct eap_sm *sm, void *priv)
{ {
struct eap_ttls_data *data = priv; struct eap_ttls_data *data = priv;
return tls_connection_established(sm->ssl_ctx, data->ssl.conn) && return tls_connection_established(sm->ssl_ctx, data->ssl.conn) &&
data->phase2_success; data->phase2_success && data->phase2_auth != ALWAYS;
} }