1 /*
2  * Copyright (c) 2004 - Michael Richardson <mcr@xelerance.com>
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that: (1) source code distributions
6  * retain the above copyright notice and this paragraph in its entirety, (2)
7  * distributions including binary code include the above copyright notice and
8  * this paragraph in its entirety in the documentation or other materials
9  * provided with the distribution, and (3) all advertising materials mentioning
10  * features or use of this software display the following acknowledgement:
11  * ``This product includes software developed by the University of California,
12  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
13  * the University nor the names of its contributors may be used to endorse
14  * or promote products derived from this software without specific prior
15  * written permission.
16  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
17  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
18  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
19  */
20 
21 /* \summary: Extensible Authentication Protocol (EAP) printer */
22 
23 #ifdef HAVE_CONFIG_H
24 #include "config.h"
25 #endif
26 
27 #include <netdissect-stdinc.h>
28 
29 #include "netdissect.h"
30 #include "extract.h"
31 
32 #define	EAP_FRAME_TYPE_PACKET		0
33 #define	EAP_FRAME_TYPE_START		1
34 #define	EAP_FRAME_TYPE_LOGOFF		2
35 #define	EAP_FRAME_TYPE_KEY		3
36 #define	EAP_FRAME_TYPE_ENCAP_ASF_ALERT	4
37 
38 struct eap_frame_t {
39     unsigned char   version;
40     unsigned char   type;
41     unsigned char   length[2];
42 };
43 
44 static const struct tok eap_frame_type_values[] = {
45     { EAP_FRAME_TYPE_PACKET,      	"EAP packet" },
46     { EAP_FRAME_TYPE_START,    		"EAPOL start" },
47     { EAP_FRAME_TYPE_LOGOFF,      	"EAPOL logoff" },
48     { EAP_FRAME_TYPE_KEY,      		"EAPOL key" },
49     { EAP_FRAME_TYPE_ENCAP_ASF_ALERT, 	"Encapsulated ASF alert" },
50     { 0, NULL}
51 };
52 
53 /* RFC 3748 */
54 struct eap_packet_t {
55     unsigned char	code;
56     unsigned char	id;
57     unsigned char	length[2];
58 };
59 
60 #define		EAP_REQUEST	1
61 #define		EAP_RESPONSE	2
62 #define		EAP_SUCCESS	3
63 #define		EAP_FAILURE	4
64 
65 static const struct tok eap_code_values[] = {
66     { EAP_REQUEST,	"Request" },
67     { EAP_RESPONSE,	"Response" },
68     { EAP_SUCCESS,	"Success" },
69     { EAP_FAILURE,	"Failure" },
70     { 0, NULL}
71 };
72 
73 #define		EAP_TYPE_NO_PROPOSED	0
74 #define		EAP_TYPE_IDENTITY	1
75 #define		EAP_TYPE_NOTIFICATION	2
76 #define		EAP_TYPE_NAK		3
77 #define		EAP_TYPE_MD5_CHALLENGE	4
78 #define		EAP_TYPE_OTP		5
79 #define		EAP_TYPE_GTC		6
80 #define		EAP_TYPE_TLS		13		/* RFC 2716 */
81 #define		EAP_TYPE_SIM		18		/* RFC 4186 */
82 #define		EAP_TYPE_TTLS		21		/* draft-funk-eap-ttls-v0-01.txt */
83 #define		EAP_TYPE_AKA		23		/* RFC 4187 */
84 #define		EAP_TYPE_FAST		43		/* RFC 4851 */
85 #define		EAP_TYPE_EXPANDED_TYPES	254
86 #define		EAP_TYPE_EXPERIMENTAL	255
87 
88 static const struct tok eap_type_values[] = {
89     { EAP_TYPE_NO_PROPOSED,	"No proposed" },
90     { EAP_TYPE_IDENTITY,	"Identity" },
91     { EAP_TYPE_NOTIFICATION,    "Notification" },
92     { EAP_TYPE_NAK,      	"Nak" },
93     { EAP_TYPE_MD5_CHALLENGE,   "MD5-challenge" },
94     { EAP_TYPE_OTP,      	"OTP" },
95     { EAP_TYPE_GTC,      	"GTC" },
96     { EAP_TYPE_TLS,      	"TLS" },
97     { EAP_TYPE_SIM,      	"SIM" },
98     { EAP_TYPE_TTLS,      	"TTLS" },
99     { EAP_TYPE_AKA,      	"AKA" },
100     { EAP_TYPE_FAST,      	"FAST" },
101     { EAP_TYPE_EXPANDED_TYPES,  "Expanded types" },
102     { EAP_TYPE_EXPERIMENTAL,    "Experimental" },
103     { 0, NULL}
104 };
105 
106 #define EAP_TLS_EXTRACT_BIT_L(x) 	(((x)&0x80)>>7)
107 
108 /* RFC 2716 - EAP TLS bits */
109 #define EAP_TLS_FLAGS_LEN_INCLUDED		(1 << 7)
110 #define EAP_TLS_FLAGS_MORE_FRAGMENTS		(1 << 6)
111 #define EAP_TLS_FLAGS_START			(1 << 5)
112 
113 static const struct tok eap_tls_flags_values[] = {
114 	{ EAP_TLS_FLAGS_LEN_INCLUDED, "L bit" },
115 	{ EAP_TLS_FLAGS_MORE_FRAGMENTS, "More fragments bit"},
116 	{ EAP_TLS_FLAGS_START, "Start bit"},
117 	{ 0, NULL}
118 };
119 
120 #define EAP_TTLS_VERSION(x)		((x)&0x07)
121 
122 /* EAP-AKA and EAP-SIM - RFC 4187 */
123 #define EAP_AKA_CHALLENGE		1
124 #define EAP_AKA_AUTH_REJECT		2
125 #define EAP_AKA_SYNC_FAILURE		4
126 #define EAP_AKA_IDENTITY		5
127 #define EAP_SIM_START			10
128 #define EAP_SIM_CHALLENGE		11
129 #define EAP_AKA_NOTIFICATION		12
130 #define EAP_AKA_REAUTH			13
131 #define EAP_AKA_CLIENT_ERROR		14
132 
133 static const struct tok eap_aka_subtype_values[] = {
134     { EAP_AKA_CHALLENGE,	"Challenge" },
135     { EAP_AKA_AUTH_REJECT,	"Auth reject" },
136     { EAP_AKA_SYNC_FAILURE,	"Sync failure" },
137     { EAP_AKA_IDENTITY,		"Identity" },
138     { EAP_SIM_START,		"Start" },
139     { EAP_SIM_CHALLENGE,	"Challenge" },
140     { EAP_AKA_NOTIFICATION,	"Notification" },
141     { EAP_AKA_REAUTH,		"Reauth" },
142     { EAP_AKA_CLIENT_ERROR,	"Client error" },
143     { 0, NULL}
144 };
145 
146 /*
147  * Print EAP requests / responses
148  */
149 void
eap_print(netdissect_options * ndo,register const u_char * cp,u_int length)150 eap_print(netdissect_options *ndo,
151           register const u_char *cp,
152           u_int length)
153 {
154     const struct eap_frame_t *eap;
155     const u_char *tptr;
156     u_int tlen, type, subtype;
157     int count=0, len;
158 
159     tptr = cp;
160     tlen = length;
161     eap = (const struct eap_frame_t *)cp;
162     ND_TCHECK(*eap);
163 
164     /* in non-verbose mode just lets print the basic info */
165     if (ndo->ndo_vflag < 1) {
166 	ND_PRINT((ndo, "%s (%u) v%u, len %u",
167                tok2str(eap_frame_type_values, "unknown", eap->type),
168                eap->type,
169                eap->version,
170                EXTRACT_16BITS(eap->length)));
171 	return;
172     }
173 
174     ND_PRINT((ndo, "%s (%u) v%u, len %u",
175            tok2str(eap_frame_type_values, "unknown", eap->type),
176            eap->type,
177            eap->version,
178            EXTRACT_16BITS(eap->length)));
179 
180     tptr += sizeof(const struct eap_frame_t);
181     tlen -= sizeof(const struct eap_frame_t);
182 
183     switch (eap->type) {
184     case EAP_FRAME_TYPE_PACKET:
185         ND_TCHECK_8BITS(tptr);
186         type = *(tptr);
187         ND_TCHECK_16BITS(tptr+2);
188         len = EXTRACT_16BITS(tptr+2);
189         ND_PRINT((ndo, ", %s (%u), id %u, len %u",
190                tok2str(eap_code_values, "unknown", type),
191                type,
192                *(tptr+1),
193                len));
194 
195         ND_TCHECK2(*tptr, len);
196 
197         if (type <= 2) { /* For EAP_REQUEST and EAP_RESPONSE only */
198             ND_TCHECK_8BITS(tptr+4);
199             subtype = *(tptr+4);
200             ND_PRINT((ndo, "\n\t\t Type %s (%u)",
201                    tok2str(eap_type_values, "unknown", subtype),
202                    subtype));
203 
204             switch (subtype) {
205             case EAP_TYPE_IDENTITY:
206                 if (len - 5 > 0) {
207                     ND_PRINT((ndo, ", Identity: "));
208                     safeputs(ndo, tptr + 5, len - 5);
209                 }
210                 break;
211 
212             case EAP_TYPE_NOTIFICATION:
213                 if (len - 5 > 0) {
214                     ND_PRINT((ndo, ", Notification: "));
215                     safeputs(ndo, tptr + 5, len - 5);
216                 }
217                 break;
218 
219             case EAP_TYPE_NAK:
220                 count = 5;
221 
222                 /*
223                  * one or more octets indicating
224                  * the desired authentication
225                  * type one octet per type
226                  */
227                 while (count < len) {
228                     ND_TCHECK_8BITS(tptr+count);
229                     ND_PRINT((ndo, " %s (%u),",
230                            tok2str(eap_type_values, "unknown", *(tptr+count)),
231                            *(tptr + count)));
232                     count++;
233                 }
234                 break;
235 
236             case EAP_TYPE_TTLS:
237             case EAP_TYPE_TLS:
238                 ND_TCHECK_8BITS(tptr + 5);
239                 if (subtype == EAP_TYPE_TTLS)
240                     ND_PRINT((ndo, " TTLSv%u",
241                            EAP_TTLS_VERSION(*(tptr + 5))));
242                 ND_PRINT((ndo, " flags [%s] 0x%02x,",
243                        bittok2str(eap_tls_flags_values, "none", *(tptr+5)),
244                        *(tptr + 5)));
245 
246                 if (EAP_TLS_EXTRACT_BIT_L(*(tptr+5))) {
247                     ND_TCHECK_32BITS(tptr + 6);
248 		    ND_PRINT((ndo, " len %u", EXTRACT_32BITS(tptr + 6)));
249                 }
250                 break;
251 
252             case EAP_TYPE_FAST:
253                 ND_TCHECK_8BITS(tptr + 5);
254                 ND_PRINT((ndo, " FASTv%u",
255                        EAP_TTLS_VERSION(*(tptr + 5))));
256                 ND_PRINT((ndo, " flags [%s] 0x%02x,",
257                        bittok2str(eap_tls_flags_values, "none", *(tptr+5)),
258                        *(tptr + 5)));
259 
260                 if (EAP_TLS_EXTRACT_BIT_L(*(tptr+5))) {
261                     ND_TCHECK_32BITS(tptr + 6);
262                     ND_PRINT((ndo, " len %u", EXTRACT_32BITS(tptr + 6)));
263                 }
264 
265                 /* FIXME - TLV attributes follow */
266                 break;
267 
268             case EAP_TYPE_AKA:
269             case EAP_TYPE_SIM:
270                 ND_TCHECK_8BITS(tptr + 5);
271                 ND_PRINT((ndo, " subtype [%s] 0x%02x,",
272                        tok2str(eap_aka_subtype_values, "unknown", *(tptr+5)),
273                        *(tptr + 5)));
274 
275                 /* FIXME - TLV attributes follow */
276                 break;
277 
278             case EAP_TYPE_MD5_CHALLENGE:
279             case EAP_TYPE_OTP:
280             case EAP_TYPE_GTC:
281             case EAP_TYPE_EXPANDED_TYPES:
282             case EAP_TYPE_EXPERIMENTAL:
283             default:
284                 break;
285             }
286         }
287         break;
288 
289     case EAP_FRAME_TYPE_LOGOFF:
290     case EAP_FRAME_TYPE_ENCAP_ASF_ALERT:
291     default:
292         break;
293     }
294     return;
295 
296  trunc:
297     ND_PRINT((ndo, "\n\t[|EAP]"));
298 }
299 
300 /*
301  * Local Variables:
302  * c-basic-offset: 4
303  * End:
304  */
305