refactor: improve ttls tunnel stuff and fix some byte sizes for AVPs

README.md

@@ -5,12 +5,16 @@ Basic RADIUS Server for node.js for Google LDAP Service and WPA2 Enteprise WLAN
 
 Protect your WIFI access with a username and password by a credential provider you already use!
 
+Authenticiation tested with Windows, Linux, Android and Apple devices.
+
 ## Known Issues / Disclaimer
 
-This is a first implementation draft, which is currently only working with a nodejs fork (see https://github.com/nodejs/node/pull/31814).
+This is a first implementation, which is currently only working with node js nightly (node 13+) (see https://github.com/nodejs/node/pull/31814).
 
-- PAP / CHAP RFC not found to implement this correctly
-- a lot of bugs
+- MD5 Challenge not implenented, but RFC says this is mandatory ;-)
+- Inner Tunnel does not act differently, even though spec says that EAP-message are not allowed to get fragmented,
+this is not a problem right now, as the messages of the inner tunnel are small enough, but it could be a bug in the future.
+ways to approach this: refactor that the inner tunnel can set max fragment size, or rebuild eap fragments in ttls after inner tunnel response
 
 CONTRIBUTIONS WELCOME! If you are willing to help, just open a PR or contact me via bug system or simon.tretter@hokify.com.
 

src/auth/LDAPAuth.ts

@@ -39,7 +39,6 @@ export class LDAPAuth implements IAuthentication {
 	}
 
 	async authenticate(username: string, password: string) {
-		// console.log('AUTH', this.ldap);
 		const authResult: boolean = await new Promise((resolve, reject) => {
 			this.ldap.authenticate(username, password, function(err, user) {
 				if (err) {

src/radius/PacketHandler.ts

+import { IPacket, IPacketHandler, IPacketHandlerResult } from '../types/PacketHandler';
+import { IAuthentication } from '../types/Authentication';
+import { EAPPacketHandler } from './handler/EAPPacketHandler';
+import { EAPTTLS } from './handler/eap/eapMethods/EAP-TTLS';
+import { EAPGTC } from './handler/eap/eapMethods/EAP-GTC';
+import { EAPMD5 } from './handler/eap/eapMethods/EAP-MD5';
+import { UserPasswordPacketHandler } from './handler/UserPasswordPacketHandler';
+
+export class PacketHandler implements IPacketHandler {
+	packetHandlers: IPacketHandler[] = [];
+
+	constructor(authentication: IAuthentication) {
+		this.packetHandlers.push(
+			new EAPPacketHandler([
+				new EAPTTLS(authentication, this),
+				new EAPGTC(authentication),
+				new EAPMD5(authentication)
+			])
+		);
+		this.packetHandlers.push(new UserPasswordPacketHandler(authentication));
+	}
+
+	async handlePacket(packet: IPacket, handlingType?: number) {
+		let response: IPacketHandlerResult;
+
+		let i = 0;
+		if (!this.packetHandlers[i]) {
+			throw new Error('no packet handlers registered');
+		}
+
+		// process packet handlers until we get a response from one
+		do {
+			/* response is of type IPacketHandlerResult */
+			response = await this.packetHandlers[i].handlePacket(packet, handlingType);
+			i++;
+		} while (this.packetHandlers[i] && (!response || !response.code));
+
+		return response;
+	}
+}

src/radius/RadiusService.ts

 import * as radius from 'radius';
 import { IAuthentication } from '../types/Authentication';
-import { EAPPacketHandler } from './handler/EAPPacketHandler';
-import { DefaultPacketHandler } from './handler/DefaultPacketHandler';
-import { IPacketHandler, IPacketHandlerResult, PacketResponseCode } from '../types/PacketHandler';
+import { IPacketHandlerResult, PacketResponseCode } from '../types/PacketHandler';
 
-import { EAPTTLS } from './handler/eap/eapMethods/EAP-TTLS';
-import { EAPMD5 } from './handler/eap/eapMethods/EAP-MD5';
-import { EAPGTC } from './handler/eap/eapMethods/EAP-GTC';
+import { PacketHandler } from './PacketHandler';
 
 export class RadiusService {
-	radiusPacketHandlers: IPacketHandler[] = [];
+	private packetHandler: PacketHandler;
 
-	constructor(private secret: string, private authentication: IAuthentication) {
-		this.radiusPacketHandlers.push(
-			new EAPPacketHandler([
-				new EAPTTLS(authentication),
-				new EAPGTC(authentication),
-				new EAPMD5(authentication)
-			])
-		);
-		this.radiusPacketHandlers.push(new DefaultPacketHandler(authentication));
+	constructor(private secret: string, authentication: IAuthentication) {
+		this.packetHandler = new PacketHandler(authentication);
 	}
 
 	async handleMessage(
@@ -32,19 +21,7 @@ export class RadiusService {
 			return undefined;
 		}
 
-		let response: IPacketHandlerResult;
-
-		let i = 0;
-		if (!this.radiusPacketHandlers[i]) {
-			throw new Error('no packet handlers registered');
-		}
-
-		// process packet handlers until we get a response from one
-		do {
-			/* response is of type IPacketHandlerResult */
-			response = await this.radiusPacketHandlers[i].handlePacket(packet.attributes, packet);
-			i++;
-		} while (this.radiusPacketHandlers[i] && (!response || !response.code));
+		const response: IPacketHandlerResult = await this.packetHandler.handlePacket(packet);
 
 		// still no response, we are done here
 		if (!response || !response.code) {

src/radius/handler/EAPPacketHandler.ts

 // https://tools.ietf.org/html/rfc3748#section-4.1
 
 import * as NodeCache from 'node-cache';
-import { RadiusPacket } from 'radius';
 import debug from 'debug';
 import { makeid } from '../../helpers';
-import { IPacketHandler, IPacketHandlerResult } from '../../types/PacketHandler';
+import { IPacket, IPacketHandler, IPacketHandlerResult } from '../../types/PacketHandler';
 import { IEAPMethod } from '../../types/EAPMethod';
 import { buildEAPResponse, decodeEAPHeader } from './eap/EAPHelper';
 
 const log = debug('radius:eap');
 
 export class EAPPacketHandler implements IPacketHandler {
+	private identities = new NodeCache({ useClones: false, stdTTL: 60 }); // queue data maximum for 60 seconds
+
 	// 	private eapConnectionStates: { [key: string]: { validMethods: IEAPMethod[] } } = {};
 	private eapConnectionStates = new NodeCache({ useClones: false, stdTTL: 3600 }); // max for one hour
 
 	constructor(private eapMethods: IEAPMethod[]) {}
 
-	async handlePacket(
-		attributes: { [key: string]: Buffer | string },
-		orgRadiusPacket: RadiusPacket
-	): Promise<IPacketHandlerResult> {
-		if (!attributes['EAP-Message']) {
+	async handlePacket(packet: IPacket, handlingType?: number): Promise<IPacketHandlerResult> {
+		if (!packet.attributes['EAP-Message']) {
 			// not an EAP message
 			return {};
 		}
 
-		const stateID = (attributes.State && attributes.State.toString()) || makeid(16);
+		const stateID = (packet.attributes.State && packet.attributes.State.toString()) || makeid(16);
 
 		if (!this.eapConnectionStates.get(stateID)) {
 			this.eapConnectionStates.set(stateID, {
-				validMethods: this.eapMethods // on init all registered eap methods are valid, we kick them out in case we get a NAK response
+				validMethods: this.eapMethods.filter(eap => eap.getEAPType() !== handlingType) // on init all registered eap methods are valid, we kick them out in case we get a NAK response
 			});
 		}
 
 		// EAP MESSAGE
-		const msg = attributes['EAP-Message'] as Buffer;
+		const msg = packet.attributes['EAP-Message'] as Buffer;
 
 		const { code, type, identifier, data } = decodeEAPHeader(msg);
 
@@ -45,7 +43,13 @@ export class EAPPacketHandler implements IPacketHandler {
 			case 2: // for response
 				switch (type) {
 					case 1: // identifiy
-						log('>>>>>>>>>>>> REQUEST FROM CLIENT: IDENTIFY', {});
+						log('>>>>>>>>>>>> REQUEST FROM CLIENT: IDENTIFY', stateID, data.toString());
+						if (data) {
+							this.identities.set(stateID, data); // use token til binary 0.);
+						} else {
+							log('no msg');
+						}
+
 						// start identify
 						if (currentState.validMethods.length > 0) {
 							return currentState.validMethods[0].identify(identifier, stateID, data);
@@ -65,6 +69,7 @@ export class EAPPacketHandler implements IPacketHandler {
 						console.error('not implemented type', type);
 						break;
 					case 3: // nak
+						// console.log('got NAK', data);
 						if (data) {
 							// if there is data, each data octect reprsents a eap method the clients supports,
 							// kick out all unsupported ones
@@ -73,27 +78,38 @@ export class EAPPacketHandler implements IPacketHandler {
 								supportedEAPMethods.push(supportedMethod);
 							}
 
-							this.eapConnectionStates.set(stateID, {
-								...currentState,
-								validMethods: currentState.validMethods.filter(method => {
-									return supportedEAPMethods.includes(method.getEAPType()); // kick it out?
-								})
+							currentState.validMethods = currentState.validMethods.filter(method => {
+								return supportedEAPMethods.includes(method.getEAPType()); // kick it out?
 							});
+							// save
+							this.eapConnectionStates.set(stateID, currentState);
+
+							// new identidy request
+							// start identify
+							if (currentState.validMethods.length > 0) {
+								return currentState.validMethods[0].identify(identifier, stateID, data);
+							}
 						}
 					// continue with responding a NAK and add rest of supported methods
 					// eslint-disable-next-line no-fallthrough
 					default: {
-						const eapMethod = currentState.validMethods.find(method => {
+						const eapMethod = this.eapMethods.find(method => {
 							return type === method.getEAPType();
 						});
 
 						if (eapMethod) {
-							return eapMethod.handleMessage(identifier, stateID, msg, orgRadiusPacket);
+							return eapMethod.handleMessage(
+								identifier,
+								stateID,
+								msg,
+								packet,
+								this.identities.get(stateID)
+							);
 						}
 
 						// we do not support this auth type, ask for something we support
-						const serverSupportedMethods = currentState.validMethods.map(
-							method => method.getEAPType
+						const serverSupportedMethods = currentState.validMethods.map(method =>
+							method.getEAPType()
 						);
 
 						console.error('unsupported type', type, `requesting: ${serverSupportedMethods}`);

src/radius/handler/DefaultPacketHandler.ts → src/radius/handler/UserPasswordPacketHandler.ts

+import debug from 'debug';
 import { IAuthentication } from '../../types/Authentication';
 import {
+	IPacket,
 	IPacketHandler,
 	IPacketHandlerResult,
 	PacketResponseCode
 } from '../../types/PacketHandler';
 
-export class DefaultPacketHandler implements IPacketHandler {
+const log = debug('radius:user-pwd');
+
+export class UserPasswordPacketHandler implements IPacketHandler {
 	constructor(private authentication: IAuthentication) {}
 
-	async handlePacket(attributes: { [key: string]: Buffer }): Promise<IPacketHandlerResult> {
-		const username = attributes['User-Name'];
-		const password = attributes['User-Password'];
+	async handlePacket(packet: IPacket): Promise<IPacketHandlerResult> {
+		const username = packet.attributes['User-Name'];
+		const password = packet.attributes['User-Password'];
 
 		if (!username || !password) {
 			// params missing, this handler cannot continue...
 			return {};
 		}
 
+		log('username', username, username.toString());
+		log('token', password, password.toString());
+
 		const authenticated = await this.authentication.authenticate(
 			username.toString(),
 			password.toString()
@@ -24,7 +31,8 @@ export class DefaultPacketHandler implements IPacketHandler {
 		if (authenticated) {
 			// success
 			return {
-				code: PacketResponseCode.AccessAccept
+				code: PacketResponseCode.AccessAccept,
+				attributes: [['User-Name', username]]
 			};
 		}
 

src/radius/handler/eap/eapMethods/EAP-GTC.ts

 // https://tools.ietf.org/html/rfc5281 TTLS v0
 // https://tools.ietf.org/html/draft-funk-eap-ttls-v1-00 TTLS v1 (not implemented)
 /* eslint-disable no-bitwise */
-import * as NodeCache from 'node-cache';
 import debug from 'debug';
 import { IPacketHandlerResult, PacketResponseCode } from '../../../../types/PacketHandler';
 import { IEAPMethod } from '../../../../types/EAPMethod';
@@ -11,24 +10,19 @@ import { buildEAPResponse, decodeEAPHeader } from '../EAPHelper';
 const log = debug('radius:eap:gtc');
 
 export class EAPGTC implements IEAPMethod {
-	private loginData = new NodeCache({ useClones: false, stdTTL: 60 }); // queue data maximum for 60 seconds
-
 	getEAPType(): number {
 		return 6;
 	}
 
-	identify(identifier: number, stateID: string, msg?: Buffer): IPacketHandlerResult {
-		if (msg) {
-			const parsedMsg = msg.slice(
-				0,
-				msg.findIndex(v => v === 0)
-			);
-			log('identify', parsedMsg, parsedMsg.toString());
-			this.loginData.set(stateID, parsedMsg); // use token til binary 0.);
-		} else {
-			log('no msg');
+	extractValue(msg: Buffer) {
+		let tillBinary0 = msg.findIndex(v => v === 0) || msg.length;
+		if (tillBinary0 < 0) {
+			tillBinary0 = msg.length - 1;
 		}
+		return msg.slice(0, tillBinary0 + 1); // use token til binary 0.
+	}
 
+	identify(identifier: number, _stateID: string): IPacketHandlerResult {
 		return buildEAPResponse(identifier, 6, Buffer.from('Password: '));
 	}
 
@@ -36,18 +30,16 @@ export class EAPGTC implements IEAPMethod {
 
 	async handleMessage(
 		_identifier: number,
-		stateID: string,
-		msg: Buffer
+		_stateID: string,
+		msg: Buffer,
+		_,
+		identity?: string
 	): Promise<IPacketHandlerResult> {
-		const username = this.loginData.get(stateID) as Buffer | undefined;
+		const username = identity; // this.loginData.get(stateID) as Buffer | undefined;
 
 		const { data } = decodeEAPHeader(msg);
 
-		let tillBinary0 = data.findIndex(v => v === 0) || data.length;
-		if (tillBinary0 < 0) {
-			tillBinary0 = data.length - 1;
-		}
-		const token = data.slice(0, tillBinary0 + 1); // use token til binary 0.
+		const token = this.extractValue(data);
 
 		if (!username) {
 			throw new Error('no username');
@@ -59,7 +51,8 @@ export class EAPGTC implements IEAPMethod {
 		const success = await this.authentication.authenticate(username.toString(), token.toString());
 
 		return {
-			code: success ? PacketResponseCode.AccessAccept : PacketResponseCode.AccessReject
+			code: success ? PacketResponseCode.AccessAccept : PacketResponseCode.AccessReject,
+			attributes: (success && [['User-Name', username]]) || undefined
 		};
 	}
 }

src/radius/handler/eap/eapMethods/EAP-MD5.ts

@@ -8,8 +8,6 @@ import { IPacketHandlerResult } from '../../../../types/PacketHandler';
 import { IEAPMethod } from '../../../../types/EAPMethod';
 import { IAuthentication } from '../../../../types/Authentication';
 
-const log = debug('radius:eap:md5');
-
 interface IEAPResponseHandlers {
 	response: (respData?: Buffer, msgType?: number) => void;
 	checkAuth: ResponseAuthHandler;

src/tls/crypt.ts

@@ -5,7 +5,6 @@ import * as crypto from 'crypto';
 import * as DuplexPair from 'native-duplexpair';
 import * as constants from 'constants';
 import debug from 'debug';
-import { makeid } from '../helpers';
 import * as config from '../../config';
 
 const log = debug('radius:tls');
@@ -136,11 +135,10 @@ export function encodeTunnelPW(key: Buffer, authenticator: Buffer, secret: strin
      contents of each Salt field in a given Access-Accept packet MUST
      be unique.
      */
-	const salt = Buffer.concat([
-		// eslint-disable-next-line no-bitwise
-		Buffer.from((Number(makeid(1)) & 0b10000000).toString()), // ensure left most bit is set (1)
-		Buffer.from(makeid(1))
-	]);
+	const salt = crypto.randomBytes(2);
+
+	// eslint-disable-next-line no-bitwise
+	salt[0] |= 0b10000000; // ensure leftmost bit is set to 1
 
 	/*
    String

src/types/EAPMethod.ts

-import { RadiusPacket } from 'radius';
-import { IPacketHandlerResult } from './PacketHandler';
+import { IPacket, IPacketHandlerResult } from './PacketHandler';
 
 export interface IEAPMethod {
 	getEAPType(): number;
@@ -10,6 +9,7 @@ export interface IEAPMethod {
 		identifier: number,
 		stateID: string,
 		msg: Buffer,
-		orgRadiusPacket?: RadiusPacket
+		packet?: IPacket,
+		identity?: string
 	): Promise<IPacketHandlerResult>;
 }

src/types/PacketHandler.ts

-import { RadiusPacket } from 'radius';
-
 export enum PacketResponseCode {
 	AccessChallenge = 'Access-Challenge',
 	AccessAccept = 'Access-Accept',
@@ -8,12 +6,19 @@ export enum PacketResponseCode {
 
 export interface IPacketHandlerResult {
 	code?: PacketResponseCode;
-	attributes?: [string, Buffer][];
+	attributes?: [string, Buffer | string][];
+}
+
+export interface IPacketAttributes {
+	[key: string]: string | Buffer;
+}
+
+export interface IPacket {
+	attributes: { [key: string]: string | Buffer };
+	authenticator?: Buffer;
 }
 
 export interface IPacketHandler {
-	handlePacket(
-		attributes: { [key: string]: Buffer },
-		orgRadiusPacket: RadiusPacket
-	): Promise<IPacketHandlerResult>;
+	/** handlingType is the attreibute ID of the currently processing type (e.g. TTLS, GTC, MD5,..) */
+	handlePacket(packet: IPacket, handlingType?: number): Promise<IPacketHandlerResult>;
 }