Skip to content
This repository was archived by the owner on Nov 29, 2024. It is now read-only.

Commit 690a6d5

Browse files
rozmansirozmansi
committed
EAP-GTC authentication now split into two modes: Challenge/Response and Password
1 parent e7e57ab commit 690a6d5

File tree

14 files changed

+595
-88
lines changed

14 files changed

+595
-88
lines changed

‎EAPMethods/locale/EAPMethods.pot

+23-35
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
msgid ""
33
msgstr ""
44
"Project-Id-Version: EAPMethods\n"
5-
"POT-Creation-Date: 2017-02-02 18:14+0100\n"
5+
"POT-Creation-Date: 2017-02-09 13:15+0100\n"
66
"PO-Revision-Date: 2016-06-02 12:27+0200\n"
77
"Last-Translator: Simon Rozman <simon.rozman@amebis.si>\n"
88
"Language-Team: Amebis, d. o. o., Kamnik <info@amebis.si>\n"
@@ -481,7 +481,7 @@ msgstr ""
481481
msgid "Configuring EAP method failed (error %u)."
482482
msgstr ""
483483

484-
#: master/lib/GTC_UI/res/wxGTC_UI.cpp:16 master/lib/GTC_UI/include/GTC_UI.h:93
484+
#: master/lib/GTC_UI/res/wxGTC_UI.cpp:16 master/lib/GTC_UI/include/GTC_UI.h:103
485485
msgid "GTC Challenge"
486486
msgstr ""
487487

@@ -497,11 +497,23 @@ msgstr ""
497497
msgid "Enter your response here"
498498
msgstr ""
499499

500-
#: master/lib/GTC_UI/src/GTC_UI.cpp:33
501-
msgid "GTC User ID"
500+
#: master/lib/GTC_UI/res/wxGTC_UI.cpp:70
501+
msgid "EAP-GTC authentication &mode:"
502502
msgstr ""
503503

504-
#: master/lib/GTC_UI/src/GTC_UI.cpp:69
504+
#: master/lib/GTC_UI/res/wxGTC_UI.cpp:75
505+
msgid "Select EAP-GTC authentication mode from the list"
506+
msgstr ""
507+
508+
#: master/lib/GTC_UI/src/GTC_UI.cpp:39
509+
msgid "Challenge/Response"
510+
msgstr ""
511+
512+
#: master/lib/GTC_UI/src/GTC_UI.cpp:41
513+
msgid "Password"
514+
msgstr ""
515+
516+
#: master/lib/GTC_UI/src/GTC_UI.cpp:119
505517
#, c-format
506518
msgid "%s Challenge"
507519
msgstr ""
@@ -713,7 +725,7 @@ msgstr ""
713725
msgid "Custom outer identity to use"
714726
msgstr ""
715727

716-
#: master/lib/TTLS_UI/src/Module.cpp:262 master/lib/TTLS_UI/src/Module.cpp:319
728+
#: master/lib/TTLS_UI/src/Module.cpp:262 master/lib/TTLS_UI/src/Module.cpp:330
717729
#: ver1.0/lib/TTLS_UI/src/Module.cpp:274 ver1.0/lib/TTLS_UI/src/Module.cpp:284
718730
#: ver1.1/lib/TTLS_UI/src/Module.cpp:262 ver1.1/lib/TTLS_UI/src/Module.cpp:318
719731
#: master/lib/EAPBase_UI/include/EAP_UI.h:785
@@ -723,7 +735,7 @@ msgstr ""
723735
msgid "Error writing credentials to Credential Manager: %hs (error %u)"
724736
msgstr ""
725737

726-
#: master/lib/TTLS_UI/src/Module.cpp:264 master/lib/TTLS_UI/src/Module.cpp:321
738+
#: master/lib/TTLS_UI/src/Module.cpp:264 master/lib/TTLS_UI/src/Module.cpp:332
727739
#: ver1.0/lib/TTLS_UI/src/Module.cpp:276 ver1.0/lib/TTLS_UI/src/Module.cpp:286
728740
#: ver1.1/lib/TTLS_UI/src/Module.cpp:264 ver1.1/lib/TTLS_UI/src/Module.cpp:320
729741
#: master/lib/EAPBase_UI/include/EAP_UI.h:788
@@ -732,22 +744,22 @@ msgstr ""
732744
msgid "Writing credentials failed."
733745
msgstr ""
734746

735-
#: master/lib/TTLS_UI/src/Module.cpp:356 ver1.1/lib/TTLS_UI/src/Module.cpp:355
747+
#: master/lib/TTLS_UI/src/Module.cpp:367 ver1.1/lib/TTLS_UI/src/Module.cpp:355
736748
#, c-format
737749
msgid "Invoking EAP identity UI failed (error %u, %s, %s)."
738750
msgstr ""
739751

740-
#: master/lib/TTLS_UI/src/Module.cpp:358 ver1.1/lib/TTLS_UI/src/Module.cpp:357
752+
#: master/lib/TTLS_UI/src/Module.cpp:369 ver1.1/lib/TTLS_UI/src/Module.cpp:357
741753
#, c-format
742754
msgid "Invoking EAP identity UI failed (error %u)."
743755
msgstr ""
744756

745-
#: master/lib/TTLS_UI/src/Module.cpp:485
757+
#: master/lib/TTLS_UI/src/Module.cpp:496
746758
#, c-format
747759
msgid "Invoking EAP interactive UI failed (error %u, %s, %s)."
748760
msgstr ""
749761

750-
#: master/lib/TTLS_UI/src/Module.cpp:488
762+
#: master/lib/TTLS_UI/src/Module.cpp:499
751763
#, c-format
752764
msgid "Invoking EAP interactive UI failed (error %u)."
753765
msgstr ""
@@ -884,62 +896,38 @@ msgstr ""
884896
msgid "EAP Identity Provider"
885897
msgstr ""
886898

887-
#: master/EAPMethods/MSIBuild/en_US.Win32.Debug.Feature-2.idtx:4
888899
#: master/EAPMethods/MSIBuild/en_US.Win32.Release.Feature-2.idtx:4
889-
#: master/EAPMethods/MSIBuild/en_US.x64.Debug.Feature-2.idtx:4
890900
#: master/EAPMethods/MSIBuild/en_US.x64.Release.Feature-2.idtx:4
891-
#: ver1.0/EAPMethods/MSIBuild/en_US.Win32.Debug.Feature-2.idtx:4
892901
#: ver1.0/EAPMethods/MSIBuild/en_US.Win32.Release.Feature-2.idtx:4
893-
#: ver1.0/EAPMethods/MSIBuild/en_US.x64.Debug.Feature-2.idtx:4
894902
#: ver1.0/EAPMethods/MSIBuild/en_US.x64.Release.Feature-2.idtx:4
895-
#: ver1.1/EAPMethods/MSIBuild/en_US.Win32.Debug.Feature-2.idtx:4
896903
#: ver1.1/EAPMethods/MSIBuild/en_US.Win32.Release.Feature-2.idtx:4
897-
#: ver1.1/EAPMethods/MSIBuild/en_US.x64.Debug.Feature-2.idtx:4
898904
#: ver1.1/EAPMethods/MSIBuild/en_US.x64.Release.Feature-2.idtx:4
899905
msgid "EAP Methods"
900906
msgstr ""
901907

902-
#: master/EAPMethods/MSIBuild/en_US.Win32.Debug.Feature-2.idtx:4
903908
#: master/EAPMethods/MSIBuild/en_US.Win32.Release.Feature-2.idtx:4
904-
#: master/EAPMethods/MSIBuild/en_US.x64.Debug.Feature-2.idtx:4
905909
#: master/EAPMethods/MSIBuild/en_US.x64.Release.Feature-2.idtx:4
906-
#: ver1.0/EAPMethods/MSIBuild/en_US.Win32.Debug.Feature-2.idtx:4
907910
#: ver1.0/EAPMethods/MSIBuild/en_US.Win32.Release.Feature-2.idtx:4
908-
#: ver1.0/EAPMethods/MSIBuild/en_US.x64.Debug.Feature-2.idtx:4
909911
#: ver1.0/EAPMethods/MSIBuild/en_US.x64.Release.Feature-2.idtx:4
910-
#: ver1.1/EAPMethods/MSIBuild/en_US.Win32.Debug.Feature-2.idtx:4
911912
#: ver1.1/EAPMethods/MSIBuild/en_US.Win32.Release.Feature-2.idtx:4
912-
#: ver1.1/EAPMethods/MSIBuild/en_US.x64.Debug.Feature-2.idtx:4
913913
#: ver1.1/EAPMethods/MSIBuild/en_US.x64.Release.Feature-2.idtx:4
914914
msgid "Modules to support individual EAP methods"
915915
msgstr ""
916916

917-
#: master/EAPMethods/MSIBuild/en_US.Win32.Debug.Feature-2.idtx:5
918917
#: master/EAPMethods/MSIBuild/en_US.Win32.Release.Feature-2.idtx:5
919-
#: master/EAPMethods/MSIBuild/en_US.x64.Debug.Feature-2.idtx:5
920918
#: master/EAPMethods/MSIBuild/en_US.x64.Release.Feature-2.idtx:5
921-
#: ver1.0/EAPMethods/MSIBuild/en_US.Win32.Debug.Feature-2.idtx:5
922919
#: ver1.0/EAPMethods/MSIBuild/en_US.Win32.Release.Feature-2.idtx:5
923-
#: ver1.0/EAPMethods/MSIBuild/en_US.x64.Debug.Feature-2.idtx:5
924920
#: ver1.0/EAPMethods/MSIBuild/en_US.x64.Release.Feature-2.idtx:5
925-
#: ver1.1/EAPMethods/MSIBuild/en_US.Win32.Debug.Feature-2.idtx:5
926921
#: ver1.1/EAPMethods/MSIBuild/en_US.Win32.Release.Feature-2.idtx:5
927-
#: ver1.1/EAPMethods/MSIBuild/en_US.x64.Debug.Feature-2.idtx:5
928922
#: ver1.1/EAPMethods/MSIBuild/en_US.x64.Release.Feature-2.idtx:5
929923
msgid "TTLS"
930924
msgstr ""
931925

932-
#: master/EAPMethods/MSIBuild/en_US.Win32.Debug.Feature-2.idtx:5
933926
#: master/EAPMethods/MSIBuild/en_US.Win32.Release.Feature-2.idtx:5
934-
#: master/EAPMethods/MSIBuild/en_US.x64.Debug.Feature-2.idtx:5
935927
#: master/EAPMethods/MSIBuild/en_US.x64.Release.Feature-2.idtx:5
936-
#: ver1.0/EAPMethods/MSIBuild/en_US.Win32.Debug.Feature-2.idtx:5
937928
#: ver1.0/EAPMethods/MSIBuild/en_US.Win32.Release.Feature-2.idtx:5
938-
#: ver1.0/EAPMethods/MSIBuild/en_US.x64.Debug.Feature-2.idtx:5
939929
#: ver1.0/EAPMethods/MSIBuild/en_US.x64.Release.Feature-2.idtx:5
940-
#: ver1.1/EAPMethods/MSIBuild/en_US.Win32.Debug.Feature-2.idtx:5
941930
#: ver1.1/EAPMethods/MSIBuild/en_US.Win32.Release.Feature-2.idtx:5
942-
#: ver1.1/EAPMethods/MSIBuild/en_US.x64.Debug.Feature-2.idtx:5
943931
#: ver1.1/EAPMethods/MSIBuild/en_US.x64.Release.Feature-2.idtx:5
944932
msgid "Tunneled Transport Layer Security"
945933
msgstr ""

‎README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ Suite of EAP supplicants for Microsoft Windows - IEEE 802.1X plug-ins for enterp
99
- PAP
1010
- MSCHAPv2
1111
- EAP-MSCHAPv2
12-
- EAP-GTC
12+
- EAP-GTC: Challenge/Response and Password authentication modes
1313
- System-installed EAP method chaining (experimental)
1414

1515
### Security

‎lib/GTC/include/Config.h

+66-1
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,15 @@ namespace eap
4444
///
4545
class config_method_eapgtc : public config_method_with_cred
4646
{
47+
public:
48+
///
49+
/// Authentication mode
50+
///
51+
enum auth_mode_t {
52+
auth_mode_response = 0, ///< Challenge/Response
53+
auth_mode_password, ///< Password
54+
};
55+
4756
public:
4857
///
4958
/// Constructs configuration
@@ -87,6 +96,19 @@ namespace eap
8796

8897
virtual config* clone() const;
8998

99+
/// \name XML management
100+
/// @{
101+
virtual void save(_In_ IXMLDOMDocument *pDoc, _In_ IXMLDOMNode *pConfigRoot) const;
102+
virtual void load(_In_ IXMLDOMNode *pConfigRoot);
103+
/// @}
104+
105+
/// \name BLOB management
106+
/// @{
107+
virtual void operator<<(_Inout_ cursor_out &cursor) const;
108+
virtual size_t get_pk_size() const;
109+
virtual void operator>>(_Inout_ cursor_in &cursor);
110+
/// @}
111+
90112
///
91113
/// @copydoc eap::config_method::get_method_id()
92114
/// \returns This implementation always returns `winstd::eap_type_gtc`
@@ -101,10 +123,53 @@ namespace eap
101123

102124
///
103125
/// @copydoc eap::config_method::make_credentials()
104-
/// \returns This implementation always returns `eap::credentials_identity` type of credentials
126+
/// \returns This implementation returns `eap::credentials_identity` or `eap::credentials_pass` type of credentials, depending on authentication mode.
105127
///
106128
virtual credentials* make_credentials() const;
107129
};
108130

109131
/// @}
110132
}
133+
134+
135+
/// \addtogroup EAPBaseStream
136+
/// @{
137+
138+
///
139+
/// Packs an EAP-GTC method authentication mode
140+
///
141+
/// \param[inout] cursor Memory cursor
142+
/// \param[in] val Authentication mode to pack
143+
///
144+
inline void operator<<(_Inout_ eap::cursor_out &cursor, _In_ const eap::config_method_eapgtc::auth_mode_t &val)
145+
{
146+
cursor << (unsigned char)val;
147+
}
148+
149+
150+
///
151+
/// Returns packed size of an EAP-GTC method authentication mode
152+
///
153+
/// \param[in] val Authentication mode to pack
154+
///
155+
/// \returns Size of data when packed (in bytes)
156+
///
157+
inline size_t pksizeof(_In_ const eap::config_method_eapgtc::auth_mode_t &val)
158+
{
159+
return pksizeof((unsigned char)val);
160+
}
161+
162+
163+
///
164+
/// Unpacks an EAP-GTC method authentication mode
165+
///
166+
/// \param[inout] cursor Memory cursor
167+
/// \param[out] val Authentication mode to unpack to
168+
///
169+
inline void operator>>(_Inout_ eap::cursor_in &cursor, _Out_ eap::config_method_eapgtc::auth_mode_t &val)
170+
{
171+
val = (eap::config_method_eapgtc::auth_mode_t)0; // Reset higher bytes to zero before reading to lower byte.
172+
cursor >> (unsigned char&)val;
173+
}
174+
175+
/// @}

‎lib/GTC/include/Method.h

+2-2
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ namespace eap
5050
/// \param[in] cfg Method configuration
5151
/// \param[in] cred User credentials
5252
///
53-
method_gtc(_In_ module &mod, _In_ config_method_eapgtc &cfg, _In_ credentials_identity &cred);
53+
method_gtc(_In_ module &mod, _In_ config_method_eapgtc &cfg, _In_ credentials &cred);
5454

5555
///
5656
/// Moves a GTC method
@@ -109,7 +109,7 @@ namespace eap
109109

110110
protected:
111111
config_method_eapgtc &m_cfg; ///< Method configuration
112-
credentials_identity &m_cred; ///< Method user credentials
112+
credentials &m_cred; ///< Method user credentials
113113
winstd::sanitizing_wstring m_challenge; ///< GTC challenge
114114
winstd::sanitizing_wstring m_response; ///< GTC response
115115
};

‎lib/GTC/src/Config.cpp

+96-1
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ using namespace winstd;
3030

3131
eap::config_method_eapgtc::config_method_eapgtc(_In_ module &mod, _In_ unsigned int level) : config_method_with_cred(mod, level)
3232
{
33+
// Default to Challenge/Response authentication mode.
3334
m_cred.reset(new credentials_identity(mod));
3435
}
3536

@@ -70,6 +71,95 @@ eap::config* eap::config_method_eapgtc::clone() const
7071
}
7172

7273

74+
void eap::config_method_eapgtc::save(_In_ IXMLDOMDocument *pDoc, _In_ IXMLDOMNode *pConfigRoot) const
75+
{
76+
assert(pDoc);
77+
assert(pConfigRoot);
78+
79+
config_method_with_cred::save(pDoc, pConfigRoot);
80+
81+
HRESULT hr;
82+
83+
if (dynamic_cast<credentials_identity*>(m_cred.get()))
84+
hr = eapxml::put_element_value(pDoc, pConfigRoot, bstr(L"AuthMode"), namespace_eapmetadata, bstr(L"Challenge/Response"));
85+
else if (dynamic_cast<credentials_pass*>(m_cred.get()))
86+
hr = eapxml::put_element_value(pDoc, pConfigRoot, bstr(L"AuthMode"), namespace_eapmetadata, bstr(L"Password"));
87+
else
88+
throw invalid_argument(__FUNCTION__ " Unsupported authentication mode.");
89+
if (FAILED(hr))
90+
throw com_runtime_error(hr, __FUNCTION__ " Error creating <AuthMode> element.");
91+
}
92+
93+
94+
void eap::config_method_eapgtc::load(_In_ IXMLDOMNode *pConfigRoot)
95+
{
96+
assert(pConfigRoot);
97+
HRESULT hr;
98+
wstring xpath(eapxml::get_xpath(pConfigRoot));
99+
100+
// Load authentication mode first, then (re)create credentials to match the authentication mode.
101+
bstr auth_mode;
102+
if (FAILED(hr = eapxml::get_element_value(pConfigRoot, bstr(L"eap-metadata:AuthMode"), auth_mode)) ||
103+
CompareStringEx(LOCALE_NAME_INVARIANT, NORM_IGNORECASE, auth_mode, auth_mode.length(), _L("Challenge/Response"), -1, NULL, NULL, 0) == CSTR_EQUAL)
104+
{
105+
m_cred.reset(new eap::credentials_identity(m_module));
106+
} else if (CompareStringEx(LOCALE_NAME_INVARIANT, NORM_IGNORECASE, auth_mode, auth_mode.length(), _L("Password"), -1, NULL, NULL, 0) == CSTR_EQUAL) {
107+
m_cred.reset(new eap::credentials_pass(m_module));
108+
} else
109+
throw invalid_argument(string_printf(__FUNCTION__ " Unsupported authentication mode (%ls).", (BSTR)auth_mode));
110+
111+
// Load method configuration.
112+
config_method_with_cred::load(pConfigRoot);
113+
114+
m_module.log_config((xpath + L"/AuthMode").c_str(), auth_mode);
115+
}
116+
117+
118+
void eap::config_method_eapgtc::operator<<(_Inout_ cursor_out &cursor) const
119+
{
120+
// Save authentication mode first, as credential loading will require this information.
121+
if (dynamic_cast<credentials_identity*>(m_cred.get()))
122+
cursor << auth_mode_response;
123+
else if (dynamic_cast<credentials_pass*>(m_cred.get()))
124+
cursor << auth_mode_password;
125+
else
126+
throw invalid_argument(__FUNCTION__ " Unsupported authentication mode.");
127+
128+
config_method_with_cred::operator<<(cursor);
129+
}
130+
131+
132+
size_t eap::config_method_eapgtc::get_pk_size() const
133+
{
134+
auth_mode_t auth_mode;
135+
if (dynamic_cast<credentials_identity*>(m_cred.get()))
136+
auth_mode = auth_mode_response;
137+
else if (dynamic_cast<credentials_pass*>(m_cred.get()))
138+
auth_mode = auth_mode_password;
139+
else
140+
throw invalid_argument(__FUNCTION__ " Unsupported authentication mode.");
141+
142+
return
143+
pksizeof(auth_mode) +
144+
config_method_with_cred::get_pk_size();
145+
}
146+
147+
148+
void eap::config_method_eapgtc::operator>>(_Inout_ cursor_in &cursor)
149+
{
150+
// (Re)create credentials to match the authentication mode.
151+
auth_mode_t auth_mode;
152+
cursor >> auth_mode;
153+
switch (auth_mode) {
154+
case auth_mode_response: m_cred.reset(new eap::credentials_identity(m_module)); break;
155+
case auth_mode_password: m_cred.reset(new eap::credentials_pass (m_module)); break;
156+
default : throw invalid_argument(string_printf(__FUNCTION__ " Unsupported authentication mode (%u).", auth_mode));
157+
}
158+
159+
config_method_with_cred::operator>>(cursor);
160+
}
161+
162+
73163
eap_type_t eap::config_method_eapgtc::get_method_id() const
74164
{
75165
return eap_type_gtc;
@@ -84,5 +174,10 @@ const wchar_t* eap::config_method_eapgtc::get_method_str() const
84174

85175
eap::credentials* eap::config_method_eapgtc::make_credentials() const
86176
{
87-
return new eap::credentials_identity(m_module);
177+
if (dynamic_cast<credentials_identity*>(m_cred.get()))
178+
return new eap::credentials_identity(m_module);
179+
else if (dynamic_cast<credentials_pass*>(m_cred.get()))
180+
return new eap::credentials_pass (m_module);
181+
else
182+
throw invalid_argument(__FUNCTION__ " Unsupported authentication mode.");
88183
}

0 commit comments

Comments
 (0)