PEAP fragmentation

[Manuel Sánchez Cuenca]

Hello all.

I'm modifying the PEAP module included in freeradius 1.1.4 to send in
the last message of the protected channel some information to the
client. Specifically, I'm including a new TLV in the eappeap_success
message.

The code of the eappeap_success method in the peap.c file is the following:

        . . .
        tlv_packet[10] = EAP_TLV_SUCCESS;

        /*  New code */
        tlv_packet[11] = 0x80;   /* mandatory AVP */
        tlv_packet[12] = EAP_TLV_VENDOR_SPECIFIC;
        len_aux = 4 + mydata_len;
        tlv_len = htons(len_aux);
        ptr++; // [3]
        ptr++; // [4]
        ptr++; // [5]
        ptr++; // [6]
        ptr++; // [7]
        ptr++; // [8]
        ptr++; // [9]
        ptr++; // [10]
        ptr++; // [11]
        ptr++; // [12]
        ptr++; // [13]
        memcpy(ptr, &tlv_len, 2);
        tlv_packet[15] = 0;     /* Vendor ID: Fixed to 0*/
        tlv_packet[16] = 0;     /* Vendor ID */
        tlv_packet[17] = 0;     /* Vendor ID */
        tlv_packet[18] = 1;     /* Vendor ID */

        int i;
        for (i = 0; i < mydata_len; i++) {tlv_packet[19 + i] = mydata[i];  }
        /* End new code */

        (tls_session->record_plus)(&tls_session->clean_in, tlv_packet,
packet_len);
        . . .

When the data to be sent (mydata) is small, the protocol works ok, but
when the the amount of data is big, there are some problems. In this
situation, the server sends the first fragment with the bits L and M
sets to 1. Then the client replies with a PEAP message without data
(0x020b00061900). Now, the server sends something that doesn't seem the
right data, because in one test, the total size of the fragments was
1029, the first fragment size was 1024, and the second one (with must be
5) was 37.

When the fragment ACK is received, he log of freeradius shows:

       ...
       rlm_eap_tls: Received EAP-TLS ACK message
          rlm_eap_tls: ack handshake fragment handler
          rlm_eap_tls: ack handshake is finished
          eaptls_verify returned 3
          eaptls_verify returned 3
          rlm_eap_peap: EAPTLS_SUCCESS
       ...

Can anybody help me with this problem and tell me why the second
fragment is not correct?

Thanks in advance.

-- 
-----------------------------
Manuel Sanchez Cuenca
Departamento de Ingenieria de la Informacion y las Comunicaciones
Facultad de Informatica. Universidad de Murcia
Campus de Espinardo - 30080 Murcia (SPAIN)
Tel.: +34-968-364644    Fax: +34-968-364151
email: msc at dif.um.es  |  manuelsc at um.es
url: http://libra.inf.um.es/~lolo