mostly working

Signed-off-by: Jens Langhammer <jens@goauthentik.io>

internal/outpost/radius/eap/protocol/mschapv2/auth.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 
 	"layeh.com/radius/rfc2759"
+	"layeh.com/radius/rfc3079"
 )
 
 func (p *Payload) checkChapPassword(res *Response) ([]byte, error) {
@@ -18,6 +19,17 @@ func (p *Payload) checkChapPassword(res *Response) ([]byte, error) {
 	if !bytes.Equal(ntResponse, res.NTResponse) {
 		return nil, errors.New("nt response mismatch")
 	}
+
+	p.st.recvKey, err = rfc3079.MakeKey(ntResponse, bytePwd, false)
+	if err != nil {
+		return nil, err
+	}
+
+	p.st.sendKey, err = rfc3079.MakeKey(ntResponse, bytePwd, true)
+	if err != nil {
+		return nil, err
+	}
+
 	authenticatorResponse, err := rfc2759.GenerateAuthenticatorResponse(p.st.Challenge, p.st.PeerChallenge, ntResponse, byteUser, bytePwd)
 	if err != nil {
 		return nil, err

internal/outpost/radius/eap/protocol/mschapv2/payload.go

@@ -10,6 +10,8 @@ import (
 	"goauthentik.io/internal/outpost/radius/eap/protocol"
 	"goauthentik.io/internal/outpost/radius/eap/protocol/eap"
 	"goauthentik.io/internal/outpost/radius/eap/protocol/peap"
+	"layeh.com/radius"
+	"layeh.com/radius/vendors/microsoft"
 )
 
 const TypeMSCHAPv2 protocol.Type = 26
@@ -63,7 +65,7 @@ func (p *Payload) Decode(raw []byte) error {
 
 	p.ValueSize = raw[4]
 	if p.ValueSize != responseValueSize {
-		return fmt.Errorf("mschapv2: incorrect value size: %d", p.ValueSize)
+		return fmt.Errorf("MSCHAPv2: incorrect value size: %d", p.ValueSize)
 	}
 	p.Response = raw[5 : p.ValueSize+5]
 	p.Name = raw[5+p.ValueSize:]
@@ -136,7 +138,7 @@ func (p *Payload) Handle(ctx protocol.Context) protocol.Payload {
 		}
 		return succ
 	} else if p.OpCode == OpSuccess && p.st.Authenticated {
-		return &peap.ExtensionPayload{
+		ep := &peap.ExtensionPayload{
 			AVPs: []peap.ExtensionAVP{
 				{
 					Mandatory: true,
@@ -145,6 +147,19 @@ func (p *Payload) Handle(ctx protocol.Context) protocol.Payload {
 				},
 			},
 		}
+		p.st.IsProtocolEnded = true
+		return ep
+	} else if p.st.IsProtocolEnded {
+		ctx.EndInnerProtocol(protocol.StatusSuccess, func(r *radius.Packet) *radius.Packet {
+			if len(microsoft.MSMPPERecvKey_Get(r, ctx.Packet().Packet)) < 1 {
+				microsoft.MSMPPERecvKey_Set(r, p.st.recvKey)
+			}
+			if len(microsoft.MSMPPESendKey_Get(r, ctx.Packet().Packet)) < 1 {
+				microsoft.MSMPPESendKey_Set(r, p.st.sendKey)
+			}
+			return r
+		})
+		return &Payload{}
 	}
 	return response
 }

internal/outpost/radius/eap/protocol/mschapv2/state.go

@@ -1,7 +1,10 @@
 package mschapv2
 
 type State struct {
-	Challenge     []byte
-	PeerChallenge []byte
-	Authenticated bool
+	Challenge       []byte
+	PeerChallenge   []byte
+	Authenticated   bool
+	IsProtocolEnded bool
+	recvKey         []byte
+	sendKey         []byte
 }