jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

EAP-FAST: Verify that identity from PAC-Opaque matches with Phase 2 (GTC)

Browse source
This commit is contained in:
Jouni Malinen 2008-02-27 18:00:12 -08:00
parent 7914585fe0
commit 13b3f33942
3 changed files with 20 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
src/eap_server/eap_fast.c
View file

@ -1448,6 +1448,7 @@ static void eap_fast_process_phase2_start(struct eap_sm *sm,
data->identity = NULL;
sm->identity_len = data->identity_len;
data->identity_len = 0;
sm->require_identity_match = 1;
if (eap_user_get(sm, sm->identity, sm->identity_len, 1) != 0) {
wpa_hexdump_ascii(MSG_DEBUG, "EAP-FAST: "
"Phase2 Identity not found "

12
src/eap_server/eap_gtc.c
View file

@ -134,6 +134,17 @@ static void eap_gtc_process(struct eap_sm *sm, void *priv,
wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-GTC: Response user",
pos, pos2 - pos);
if (sm->identity && sm->require_identity_match &&
(pos2 - pos != (int) sm->identity_len ||
os_memcmp(pos, sm->identity, sm->identity_len))) {
wpa_printf(MSG_DEBUG, "EAP-GTC: Phase 2 Identity did "
"not match with required Identity");
wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-GTC: Expected "
"identity",
sm->identity, sm->identity_len);
data->state = FAILURE;
return;
} else {
os_free(sm->identity);
sm->identity_len = pos2 - pos;
sm->identity = os_malloc(sm->identity_len);
@ -142,6 +153,7 @@ static void eap_gtc_process(struct eap_sm *sm, void *priv,
return;
}
os_memcpy(sm->identity, pos, sm->identity_len);
}
if (eap_user_get(sm, sm->identity, sm->identity_len, 1) != 0) {
wpa_hexdump_ascii(MSG_DEBUG, "EAP-GTC: Phase2 "

2
src/eap_server/eap_i.h
View file

@ -150,6 +150,8 @@ struct eap_sm {
void *eap_method_priv;
u8 *identity;
size_t identity_len;
/* Whether Phase 2 method should validate identity match */
int require_identity_match;
int lastId; /* Identifier used in the last EAP-Packet */
struct eap_user *user;
int user_eap_method_index;