radius.c revision 807291d85bf857320aff6a8ade38c5f622ab9df8
15d4ba8869476831ee73b15a052af8003d0a1fa2ereed@google.com/* 25d4ba8869476831ee73b15a052af8003d0a1fa2ereed@google.com * RADIUS message processing 35d4ba8869476831ee73b15a052af8003d0a1fa2ereed@google.com * Copyright (c) 2002-2009, 2011-2014, Jouni Malinen <j@w1.fi> 45d4ba8869476831ee73b15a052af8003d0a1fa2ereed@google.com * 55d4ba8869476831ee73b15a052af8003d0a1fa2ereed@google.com * This software may be distributed under the terms of the BSD license. 65d4ba8869476831ee73b15a052af8003d0a1fa2ereed@google.com * See README for more details. 75d4ba8869476831ee73b15a052af8003d0a1fa2ereed@google.com */ 833e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume 933e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume#include "utils/includes.h" 1033e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume 1133e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume#include "utils/common.h" 12c5035e70cc3fb290f95fd1c052c637aa0dbaf9earobertphillips#include "utils/wpabuf.h" 137ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel#include "crypto/md5.h" 1413dddce65fd87a8175a209a49f35615735a2886aBrian Osman#include "crypto/crypto.h" 157e910df7f133e80293117bdd069ed25998d10f8cStan Iliev#include "radius.h" 163b66ab6f9fdc6eacdf0ee1921da28751de30c018Brian Osman 17856e9d921462136da8562f8f122d42e114cd4710reed 1897b6b0730dcb0feee9224ff04eb3985ca4bd0216robertphillips@google.com/** 19e2f7d1899d890c2f08571e1bd6c7fa2c5ea1be0bRobert Phillips * struct radius_msg - RADIUS message structure for new and parsed messages 202c2bc11aea4dfcd7ee2f5859838a2aa0a56939e0Brian Osman */ 213b66ab6f9fdc6eacdf0ee1921da28751de30c018Brian Osmanstruct radius_msg { 221105224f9701e57ec5ce0354d6a380b664f5c638Brian Osman /** 2332342f032e1dfd133040324f851f0365f9d4cb51Brian Osman * buf - Allocated buffer for RADIUS message 24fe3b51636d4216c4ea6cb74ed0964c1d315ca487Brian Osman */ 25e8e54580c3c91fd485187af040af118aa5153261Brian Osman struct wpabuf *buf; 26646e4293f06d9de6d44dbfa3c32cdc15a6f5906eRobert Phillips 27bc7a4fb06780f9829b4b21470fe6f0503d2297cdRobert Phillips /** 2863954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman * hdr - Pointer to the RADIUS header in buf 29f267c1efe7de7a8e71404afde6cbf93c3808d267bsalomon */ 30993a4216a6014b9de8f4d8120360c94550dc6761bsalomon struct radius_hdr *hdr; 31262a71b7f95ce98ff3dd8dba845afbd724470903reed 323b65598bceb65736486db27ed49a56d787032747Brian Osman /** 33262a71b7f95ce98ff3dd8dba845afbd724470903reed * attr_pos - Array of indexes to attributes 347992da32f02f90e0ac9ab6914eb31676b502eb71Brian Osman * 35cb6266b5aa5bbfd880532f08eec83b0c585e873fMatt Sarett * The values are number of bytes from buf to the beginning of 36b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk * struct radius_attr_hdr. 376f1216ac158e36a3a1cc805e7f899c755c5b98a2reed */ 3803dd6d5208a6e3d92190e7020300e4399178ae4bMatt Sarett size_t *attr_pos; 39993a4216a6014b9de8f4d8120360c94550dc6761bsalomon 40b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips /** 41b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips * attr_size - Total size of the attribute pointer array 42b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips */ 43b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips size_t attr_size; 44b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips 45b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips /** 46b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips * attr_used - Total number of attributes in the array 47b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips */ 48b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips size_t attr_used; 49b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips}; 50c9b5f8b1522e72449d704d30ed6aee4fc6211ee8reed 51cef04f818820e59fb534eb226f967f72497845d3piotaixr 526f1216ac158e36a3a1cc805e7f899c755c5b98a2reedstruct radius_hdr * radius_msg_get_hdr(struct radius_msg *msg) 536f1216ac158e36a3a1cc805e7f899c755c5b98a2reed{ 546f1216ac158e36a3a1cc805e7f899c755c5b98a2reed return msg->hdr; 556f1216ac158e36a3a1cc805e7f899c755c5b98a2reed} 566f1216ac158e36a3a1cc805e7f899c755c5b98a2reed 576f1216ac158e36a3a1cc805e7f899c755c5b98a2reed 58396fcdba14a0101ed43dcc3863585bf50c4ed6ccbrianosmanstruct wpabuf * radius_msg_get_buf(struct radius_msg *msg) 59396fcdba14a0101ed43dcc3863585bf50c4ed6ccbrianosman{ 60b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips return msg->buf; 61396fcdba14a0101ed43dcc3863585bf50c4ed6ccbrianosman} 62396fcdba14a0101ed43dcc3863585bf50c4ed6ccbrianosman 63b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips 64396fcdba14a0101ed43dcc3863585bf50c4ed6ccbrianosmanstatic struct radius_attr_hdr * 65396fcdba14a0101ed43dcc3863585bf50c4ed6ccbrianosmanradius_get_attr_hdr(struct radius_msg *msg, int idx) 666251771ebc5c4d7c98af3e2f3f2e7b22e490c1d5Brian Osman{ 676251771ebc5c4d7c98af3e2f3f2e7b22e490c1d5Brian Osman return (struct radius_attr_hdr *) 686251771ebc5c4d7c98af3e2f3f2e7b22e490c1d5Brian Osman (wpabuf_mhead_u8(msg->buf) + msg->attr_pos[idx]); 696251771ebc5c4d7c98af3e2f3f2e7b22e490c1d5Brian Osman} 706251771ebc5c4d7c98af3e2f3f2e7b22e490c1d5Brian Osman 716251771ebc5c4d7c98af3e2f3f2e7b22e490c1d5Brian Osman 726251771ebc5c4d7c98af3e2f3f2e7b22e490c1d5Brian Osmanstatic void radius_msg_set_hdr(struct radius_msg *msg, u8 code, u8 identifier) 735fa3d6d4b15fd6417de877561f5e4bca422e383cMike Reed{ 745fa3d6d4b15fd6417de877561f5e4bca422e383cMike Reed msg->hdr->code = code; 756f1216ac158e36a3a1cc805e7f899c755c5b98a2reed msg->hdr->identifier = identifier; 766f1216ac158e36a3a1cc805e7f899c755c5b98a2reed} 776f1216ac158e36a3a1cc805e7f899c755c5b98a2reed 786f1216ac158e36a3a1cc805e7f899c755c5b98a2reed 796f1216ac158e36a3a1cc805e7f899c755c5b98a2reedstatic int radius_msg_initialize(struct radius_msg *msg) 806f1216ac158e36a3a1cc805e7f899c755c5b98a2reed{ 817a542c559a6e584107b94e6254ac3c7f9f24b591Mike Reed msg->attr_pos = os_calloc(RADIUS_DEFAULT_ATTR_COUNT, 827a542c559a6e584107b94e6254ac3c7f9f24b591Mike Reed sizeof(*msg->attr_pos)); 837a542c559a6e584107b94e6254ac3c7f9f24b591Mike Reed if (msg->attr_pos == NULL) 846251771ebc5c4d7c98af3e2f3f2e7b22e490c1d5Brian Osman return -1; 857a542c559a6e584107b94e6254ac3c7f9f24b591Mike Reed 867a542c559a6e584107b94e6254ac3c7f9f24b591Mike Reed msg->attr_size = RADIUS_DEFAULT_ATTR_COUNT; 877a542c559a6e584107b94e6254ac3c7f9f24b591Mike Reed msg->attr_used = 0; 887a542c559a6e584107b94e6254ac3c7f9f24b591Mike Reed 896251771ebc5c4d7c98af3e2f3f2e7b22e490c1d5Brian Osman return 0; 907a542c559a6e584107b94e6254ac3c7f9f24b591Mike Reed} 917a542c559a6e584107b94e6254ac3c7f9f24b591Mike Reed 92b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips 93b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips/** 942084ffa9a3fa7eb3c7e17ec5b55750be9942bafcBrian Salomon * radius_msg_new - Create a new RADIUS message 952084ffa9a3fa7eb3c7e17ec5b55750be9942bafcBrian Salomon * @code: Code for RADIUS header 962084ffa9a3fa7eb3c7e17ec5b55750be9942bafcBrian Salomon * @identifier: Identifier for RADIUS header 97b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips * Returns: Context for RADIUS message or %NULL on failure 988b26b99c97473f020df4b9d4ba789e074e06ceddreed * 998b26b99c97473f020df4b9d4ba789e074e06ceddreed * The caller is responsible for freeing the returned data with 100b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips * radius_msg_free(). 1017a542c559a6e584107b94e6254ac3c7f9f24b591Mike Reed */ 1028b26b99c97473f020df4b9d4ba789e074e06ceddreedstruct radius_msg * radius_msg_new(u8 code, u8 identifier) 1038b26b99c97473f020df4b9d4ba789e074e06ceddreed{ 1046f1216ac158e36a3a1cc805e7f899c755c5b98a2reed struct radius_msg *msg; 1057a542c559a6e584107b94e6254ac3c7f9f24b591Mike Reed 1067a542c559a6e584107b94e6254ac3c7f9f24b591Mike Reed msg = os_zalloc(sizeof(*msg)); 107095530389d8211895309107a4f74beefacce638creed if (msg == NULL) 108095530389d8211895309107a4f74beefacce638creed return NULL; 1098b26b99c97473f020df4b9d4ba789e074e06ceddreed 110ace135453db02cfe83d7c7bbeaa679f98d18fbe2reed@google.com msg->buf = wpabuf_alloc(RADIUS_DEFAULT_MSG_SIZE); 111ace135453db02cfe83d7c7bbeaa679f98d18fbe2reed@google.com if (msg->buf == NULL || radius_msg_initialize(msg)) { 112b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips radius_msg_free(msg); 113b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips return NULL; 114b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips } 115b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips msg->hdr = wpabuf_put(msg->buf, sizeof(struct radius_hdr)); 116b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips 11730a38ff737c61799b0f36d2e6ba412f7e612f617Robert Phillips radius_msg_set_hdr(msg, code, identifier); 118b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips 119b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips return msg; 120b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips} 121b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips 1227992da32f02f90e0ac9ab6914eb31676b502eb71Brian Osman 1237992da32f02f90e0ac9ab6914eb31676b502eb71Brian Osman/** 1247992da32f02f90e0ac9ab6914eb31676b502eb71Brian Osman * radius_msg_free - Free a RADIUS message 125b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips * @msg: RADIUS message from radius_msg_new() or radius_msg_parse() 1263798c86f6885f0b47fb2e659a43b48a4468a97efRobert Phillips */ 1277992da32f02f90e0ac9ab6914eb31676b502eb71Brian Osmanvoid radius_msg_free(struct radius_msg *msg) 1283798c86f6885f0b47fb2e659a43b48a4468a97efRobert Phillips{ 12985d9178832f4a64c9d80ffb14cb9dab4fe0fa54areed if (msg == NULL) 13085d9178832f4a64c9d80ffb14cb9dab4fe0fa54areed return; 1318b26b99c97473f020df4b9d4ba789e074e06ceddreed 1328b26b99c97473f020df4b9d4ba789e074e06ceddreed wpabuf_free(msg->buf); 1338b26b99c97473f020df4b9d4ba789e074e06ceddreed os_free(msg->attr_pos); 1348b26b99c97473f020df4b9d4ba789e074e06ceddreed os_free(msg); 1358b26b99c97473f020df4b9d4ba789e074e06ceddreed} 1368b26b99c97473f020df4b9d4ba789e074e06ceddreed 1378b26b99c97473f020df4b9d4ba789e074e06ceddreed 1388b26b99c97473f020df4b9d4ba789e074e06ceddreedstatic const char *radius_code_string(u8 code) 13997b6b0730dcb0feee9224ff04eb3985ca4bd0216robertphillips@google.com{ 1408b26b99c97473f020df4b9d4ba789e074e06ceddreed switch (code) { 1418b26b99c97473f020df4b9d4ba789e074e06ceddreed case RADIUS_CODE_ACCESS_REQUEST: return "Access-Request"; 1428b26b99c97473f020df4b9d4ba789e074e06ceddreed case RADIUS_CODE_ACCESS_ACCEPT: return "Access-Accept"; 1438b26b99c97473f020df4b9d4ba789e074e06ceddreed case RADIUS_CODE_ACCESS_REJECT: return "Access-Reject"; 1448b26b99c97473f020df4b9d4ba789e074e06ceddreed case RADIUS_CODE_ACCOUNTING_REQUEST: return "Accounting-Request"; 1458b26b99c97473f020df4b9d4ba789e074e06ceddreed case RADIUS_CODE_ACCOUNTING_RESPONSE: return "Accounting-Response"; 1468b26b99c97473f020df4b9d4ba789e074e06ceddreed case RADIUS_CODE_ACCESS_CHALLENGE: return "Access-Challenge"; 1478b26b99c97473f020df4b9d4ba789e074e06ceddreed case RADIUS_CODE_STATUS_SERVER: return "Status-Server"; 1488b26b99c97473f020df4b9d4ba789e074e06ceddreed case RADIUS_CODE_STATUS_CLIENT: return "Status-Client"; 1495d4ba8869476831ee73b15a052af8003d0a1fa2ereed@google.com case RADIUS_CODE_RESERVED: return "Reserved"; 1504af267b11964d4a8acdb232ac46094c84d890e88reed case RADIUS_CODE_DISCONNECT_REQUEST: return "Disconnect-Request"; 151fbfcd5602128ec010c82cb733c9cdc0a3254f9f3rmistry@google.com case RADIUS_CODE_DISCONNECT_ACK: return "Disconnect-ACK"; 1520ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips case RADIUS_CODE_DISCONNECT_NAK: return "Disconnect-NAK"; 1530ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips case RADIUS_CODE_COA_REQUEST: return "CoA-Request"; 1547ee385e1dc3cd6a47dc8f7297fef6e175eaba224Robert Phillips case RADIUS_CODE_COA_ACK: return "CoA-ACK"; 1550ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips case RADIUS_CODE_COA_NAK: return "CoA-NAK"; 156eee4d6e4e8cc5c4c79f065abcc3ce609f71238f9Robert Phillips default: return "?Unknown?"; 157eee4d6e4e8cc5c4c79f065abcc3ce609f71238f9Robert Phillips } 158eee4d6e4e8cc5c4c79f065abcc3ce609f71238f9Robert Phillips} 159eee4d6e4e8cc5c4c79f065abcc3ce609f71238f9Robert Phillips 160eee4d6e4e8cc5c4c79f065abcc3ce609f71238f9Robert Phillips 161eee4d6e4e8cc5c4c79f065abcc3ce609f71238f9Robert Phillipsstruct radius_attr_type { 162eee4d6e4e8cc5c4c79f065abcc3ce609f71238f9Robert Phillips u8 type; 1630ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips char *name; 1647ee385e1dc3cd6a47dc8f7297fef6e175eaba224Robert Phillips enum { 1650ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips RADIUS_ATTR_UNDIST, RADIUS_ATTR_TEXT, RADIUS_ATTR_IP, 1660ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips RADIUS_ATTR_HEXDUMP, RADIUS_ATTR_INT32, RADIUS_ATTR_IPV6 1677ee385e1dc3cd6a47dc8f7297fef6e175eaba224Robert Phillips } data_type; 1680ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips}; 169eee4d6e4e8cc5c4c79f065abcc3ce609f71238f9Robert Phillips 1700ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillipsstatic struct radius_attr_type radius_attrs[] = 1710ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips{ 1720ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips { RADIUS_ATTR_USER_NAME, "User-Name", RADIUS_ATTR_TEXT }, 1730ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips { RADIUS_ATTR_USER_PASSWORD, "User-Password", RADIUS_ATTR_UNDIST }, 1740ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips { RADIUS_ATTR_NAS_IP_ADDRESS, "NAS-IP-Address", RADIUS_ATTR_IP }, 1750ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips { RADIUS_ATTR_NAS_PORT, "NAS-Port", RADIUS_ATTR_INT32 }, 1760ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips { RADIUS_ATTR_FRAMED_MTU, "Framed-MTU", RADIUS_ATTR_INT32 }, 1770ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips { RADIUS_ATTR_REPLY_MESSAGE, "Reply-Message", RADIUS_ATTR_TEXT }, 1780ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips { RADIUS_ATTR_STATE, "State", RADIUS_ATTR_UNDIST }, 1790ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips { RADIUS_ATTR_CLASS, "Class", RADIUS_ATTR_UNDIST }, 180eee4d6e4e8cc5c4c79f065abcc3ce609f71238f9Robert Phillips { RADIUS_ATTR_VENDOR_SPECIFIC, "Vendor-Specific", RADIUS_ATTR_UNDIST }, 181eee4d6e4e8cc5c4c79f065abcc3ce609f71238f9Robert Phillips { RADIUS_ATTR_SESSION_TIMEOUT, "Session-Timeout", RADIUS_ATTR_INT32 }, 182eee4d6e4e8cc5c4c79f065abcc3ce609f71238f9Robert Phillips { RADIUS_ATTR_IDLE_TIMEOUT, "Idle-Timeout", RADIUS_ATTR_INT32 }, 183eee4d6e4e8cc5c4c79f065abcc3ce609f71238f9Robert Phillips { RADIUS_ATTR_TERMINATION_ACTION, "Termination-Action", 184eee4d6e4e8cc5c4c79f065abcc3ce609f71238f9Robert Phillips RADIUS_ATTR_INT32 }, 1850ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips { RADIUS_ATTR_CALLED_STATION_ID, "Called-Station-Id", 1860ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips RADIUS_ATTR_TEXT }, 18703dd6d5208a6e3d92190e7020300e4399178ae4bMatt Sarett { RADIUS_ATTR_CALLING_STATION_ID, "Calling-Station-Id", 188095530389d8211895309107a4f74beefacce638creed RADIUS_ATTR_TEXT }, 18903dd6d5208a6e3d92190e7020300e4399178ae4bMatt Sarett { RADIUS_ATTR_NAS_IDENTIFIER, "NAS-Identifier", RADIUS_ATTR_TEXT }, 190cb6266b5aa5bbfd880532f08eec83b0c585e873fMatt Sarett { RADIUS_ATTR_PROXY_STATE, "Proxy-State", RADIUS_ATTR_UNDIST }, 191cb6266b5aa5bbfd880532f08eec83b0c585e873fMatt Sarett { RADIUS_ATTR_ACCT_STATUS_TYPE, "Acct-Status-Type", 192cb6266b5aa5bbfd880532f08eec83b0c585e873fMatt Sarett RADIUS_ATTR_INT32 }, 19303dd6d5208a6e3d92190e7020300e4399178ae4bMatt Sarett { RADIUS_ATTR_ACCT_DELAY_TIME, "Acct-Delay-Time", RADIUS_ATTR_INT32 }, 19403dd6d5208a6e3d92190e7020300e4399178ae4bMatt Sarett { RADIUS_ATTR_ACCT_INPUT_OCTETS, "Acct-Input-Octets", 19503dd6d5208a6e3d92190e7020300e4399178ae4bMatt Sarett RADIUS_ATTR_INT32 }, 19603dd6d5208a6e3d92190e7020300e4399178ae4bMatt Sarett { RADIUS_ATTR_ACCT_OUTPUT_OCTETS, "Acct-Output-Octets", 19703dd6d5208a6e3d92190e7020300e4399178ae4bMatt Sarett RADIUS_ATTR_INT32 }, 198b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips { RADIUS_ATTR_ACCT_SESSION_ID, "Acct-Session-Id", RADIUS_ATTR_TEXT }, 199b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips { RADIUS_ATTR_ACCT_AUTHENTIC, "Acct-Authentic", RADIUS_ATTR_INT32 }, 2008b26b99c97473f020df4b9d4ba789e074e06ceddreed { RADIUS_ATTR_ACCT_SESSION_TIME, "Acct-Session-Time", 20103dd6d5208a6e3d92190e7020300e4399178ae4bMatt Sarett RADIUS_ATTR_INT32 }, 2028b26b99c97473f020df4b9d4ba789e074e06ceddreed { RADIUS_ATTR_ACCT_INPUT_PACKETS, "Acct-Input-Packets", 203e78b7259c3d5cbed77b4390150cfb699b0b59cd4Robert Phillips RADIUS_ATTR_INT32 }, 2048b26b99c97473f020df4b9d4ba789e074e06ceddreed { RADIUS_ATTR_ACCT_OUTPUT_PACKETS, "Acct-Output-Packets", 205b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips RADIUS_ATTR_INT32 }, 206a8ac92418807e3d46a45413459e6895160134c1dBrian Osman { RADIUS_ATTR_ACCT_TERMINATE_CAUSE, "Acct-Terminate-Cause", 207a8ac92418807e3d46a45413459e6895160134c1dBrian Osman RADIUS_ATTR_INT32 }, 208a8ac92418807e3d46a45413459e6895160134c1dBrian Osman { RADIUS_ATTR_ACCT_MULTI_SESSION_ID, "Acct-Multi-Session-Id", 209a8ac92418807e3d46a45413459e6895160134c1dBrian Osman RADIUS_ATTR_TEXT }, 210a8ac92418807e3d46a45413459e6895160134c1dBrian Osman { RADIUS_ATTR_ACCT_LINK_COUNT, "Acct-Link-Count", RADIUS_ATTR_INT32 }, 211a8ac92418807e3d46a45413459e6895160134c1dBrian Osman { RADIUS_ATTR_ACCT_INPUT_GIGAWORDS, "Acct-Input-Gigawords", 212a8ac92418807e3d46a45413459e6895160134c1dBrian Osman RADIUS_ATTR_INT32 }, 213a8ac92418807e3d46a45413459e6895160134c1dBrian Osman { RADIUS_ATTR_ACCT_OUTPUT_GIGAWORDS, "Acct-Output-Gigawords", 214a8ac92418807e3d46a45413459e6895160134c1dBrian Osman RADIUS_ATTR_INT32 }, 215a8ac92418807e3d46a45413459e6895160134c1dBrian Osman { RADIUS_ATTR_EVENT_TIMESTAMP, "Event-Timestamp", 216a8ac92418807e3d46a45413459e6895160134c1dBrian Osman RADIUS_ATTR_INT32 }, 2172084ffa9a3fa7eb3c7e17ec5b55750be9942bafcBrian Salomon { RADIUS_ATTR_NAS_PORT_TYPE, "NAS-Port-Type", RADIUS_ATTR_INT32 }, 218a8ac92418807e3d46a45413459e6895160134c1dBrian Osman { RADIUS_ATTR_TUNNEL_TYPE, "Tunnel-Type", RADIUS_ATTR_HEXDUMP }, 219b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips { RADIUS_ATTR_TUNNEL_MEDIUM_TYPE, "Tunnel-Medium-Type", 220b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips RADIUS_ATTR_HEXDUMP }, 221b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips { RADIUS_ATTR_TUNNEL_PASSWORD, "Tunnel-Password", 222b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips RADIUS_ATTR_UNDIST }, 223b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips { RADIUS_ATTR_CONNECT_INFO, "Connect-Info", RADIUS_ATTR_TEXT }, 2248b26b99c97473f020df4b9d4ba789e074e06ceddreed { RADIUS_ATTR_EAP_MESSAGE, "EAP-Message", RADIUS_ATTR_UNDIST }, 2258b26b99c97473f020df4b9d4ba789e074e06ceddreed { RADIUS_ATTR_MESSAGE_AUTHENTICATOR, "Message-Authenticator", 226b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips RADIUS_ATTR_UNDIST }, 2278b26b99c97473f020df4b9d4ba789e074e06ceddreed { RADIUS_ATTR_TUNNEL_PRIVATE_GROUP_ID, "Tunnel-Private-Group-Id", 2288b26b99c97473f020df4b9d4ba789e074e06ceddreed RADIUS_ATTR_HEXDUMP }, 2298b26b99c97473f020df4b9d4ba789e074e06ceddreed { RADIUS_ATTR_ACCT_INTERIM_INTERVAL, "Acct-Interim-Interval", 2308b26b99c97473f020df4b9d4ba789e074e06ceddreed RADIUS_ATTR_INT32 }, 2318b26b99c97473f020df4b9d4ba789e074e06ceddreed { RADIUS_ATTR_CHARGEABLE_USER_IDENTITY, "Chargeable-User-Identity", 2328b26b99c97473f020df4b9d4ba789e074e06ceddreed RADIUS_ATTR_TEXT }, 2338b26b99c97473f020df4b9d4ba789e074e06ceddreed { RADIUS_ATTR_NAS_IPV6_ADDRESS, "NAS-IPv6-Address", RADIUS_ATTR_IPV6 }, 2348b26b99c97473f020df4b9d4ba789e074e06ceddreed { RADIUS_ATTR_ERROR_CAUSE, "Error-Cause", RADIUS_ATTR_INT32 }, 23503dd6d5208a6e3d92190e7020300e4399178ae4bMatt Sarett { RADIUS_ATTR_EAP_KEY_NAME, "EAP-Key-Name", RADIUS_ATTR_HEXDUMP }, 23603dd6d5208a6e3d92190e7020300e4399178ae4bMatt Sarett { RADIUS_ATTR_OPERATOR_NAME, "Operator-Name", RADIUS_ATTR_TEXT }, 2378b26b99c97473f020df4b9d4ba789e074e06ceddreed { RADIUS_ATTR_LOCATION_INFO, "Location-Information", 2388b26b99c97473f020df4b9d4ba789e074e06ceddreed RADIUS_ATTR_HEXDUMP }, 2395d4ba8869476831ee73b15a052af8003d0a1fa2ereed@google.com { RADIUS_ATTR_LOCATION_DATA, "Location-Data", RADIUS_ATTR_HEXDUMP }, 2404af267b11964d4a8acdb232ac46094c84d890e88reed { RADIUS_ATTR_BASIC_LOCATION_POLICY_RULES, 2417fb4f8bd031eda87e1da9bc0f749968c0e872e6freed "Basic-Location-Policy-Rules", RADIUS_ATTR_HEXDUMP }, 24263e7973d1f01bd03216659b9d2267f83a752c8fbBrian Salomon { RADIUS_ATTR_EXTENDED_LOCATION_POLICY_RULES, 24316d8ec66cdce2f30ce89b87066d3ac7a244c460dRobert Phillips "Extended-Location-Policy-Rules", RADIUS_ATTR_HEXDUMP }, 2447b6945bc4e639d7cc4a49b84d492690f8e865566reed { RADIUS_ATTR_LOCATION_CAPABLE, "Location-Capable", RADIUS_ATTR_INT32 }, 2457b6945bc4e639d7cc4a49b84d492690f8e865566reed { RADIUS_ATTR_REQUESTED_LOCATION_INFO, "Requested-Location-Info", 24616d8ec66cdce2f30ce89b87066d3ac7a244c460dRobert Phillips RADIUS_ATTR_INT32 }, 2477b6945bc4e639d7cc4a49b84d492690f8e865566reed { RADIUS_ATTR_MOBILITY_DOMAIN_ID, "Mobility-Domain-Id", 248b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips RADIUS_ATTR_INT32 }, 249e2f7d1899d890c2f08571e1bd6c7fa2c5ea1be0bRobert Phillips { RADIUS_ATTR_WLAN_HESSID, "WLAN-HESSID", RADIUS_ATTR_TEXT }, 250e2f7d1899d890c2f08571e1bd6c7fa2c5ea1be0bRobert Phillips { RADIUS_ATTR_WLAN_PAIRWISE_CIPHER, "WLAN-Pairwise-Cipher", 251e2f7d1899d890c2f08571e1bd6c7fa2c5ea1be0bRobert Phillips RADIUS_ATTR_HEXDUMP }, 252e2f7d1899d890c2f08571e1bd6c7fa2c5ea1be0bRobert Phillips { RADIUS_ATTR_WLAN_GROUP_CIPHER, "WLAN-Group-Cipher", 253e2f7d1899d890c2f08571e1bd6c7fa2c5ea1be0bRobert Phillips RADIUS_ATTR_HEXDUMP }, 254e2f7d1899d890c2f08571e1bd6c7fa2c5ea1be0bRobert Phillips { RADIUS_ATTR_WLAN_AKM_SUITE, "WLAN-AKM-Suite", 255e2f7d1899d890c2f08571e1bd6c7fa2c5ea1be0bRobert Phillips RADIUS_ATTR_HEXDUMP }, 256b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips { RADIUS_ATTR_WLAN_GROUP_MGMT_CIPHER, "WLAN-Group-Mgmt-Pairwise-Cipher", 257e2f7d1899d890c2f08571e1bd6c7fa2c5ea1be0bRobert Phillips RADIUS_ATTR_HEXDUMP }, 258e2f7d1899d890c2f08571e1bd6c7fa2c5ea1be0bRobert Phillips}; 259e2f7d1899d890c2f08571e1bd6c7fa2c5ea1be0bRobert Phillips#define RADIUS_ATTRS ARRAY_SIZE(radius_attrs) 260b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips 261b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips 262b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillipsstatic struct radius_attr_type *radius_get_attr_type(u8 type) 263e2f7d1899d890c2f08571e1bd6c7fa2c5ea1be0bRobert Phillips{ 2647b6945bc4e639d7cc4a49b84d492690f8e865566reed size_t i; 2657b6945bc4e639d7cc4a49b84d492690f8e865566reed 2668b26b99c97473f020df4b9d4ba789e074e06ceddreed for (i = 0; i < RADIUS_ATTRS; i++) { 2678b26b99c97473f020df4b9d4ba789e074e06ceddreed if (type == radius_attrs[i].type) 2687ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel return &radius_attrs[i]; 2697ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel } 2707ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel 271dddbe380b0e6b690041a4e020aefe57f1b21691abrianosman return NULL; 272dddbe380b0e6b690041a4e020aefe57f1b21691abrianosman} 2737fb4f8bd031eda87e1da9bc0f749968c0e872e6freed 2747fb4f8bd031eda87e1da9bc0f749968c0e872e6freed 2757ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Danielstatic void radius_msg_dump_attr(struct radius_attr_hdr *hdr) 27696fcdcc219d2a0d3579719b84b28bede76efba64halcanary{ 2778b26b99c97473f020df4b9d4ba789e074e06ceddreed struct radius_attr_type *attr; 2780ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips int len; 279b0e93a22bbfad05bb834e33387880ece56e0f6d2Robert Phillips unsigned char *pos; 2808b26b99c97473f020df4b9d4ba789e074e06ceddreed char buf[1000]; 28196fcdcc219d2a0d3579719b84b28bede76efba64halcanary 2828b26b99c97473f020df4b9d4ba789e074e06ceddreed attr = radius_get_attr_type(hdr->type); 283de49988bc24977f97bb1da8c17ceee5432fcc8e7reed 284de49988bc24977f97bb1da8c17ceee5432fcc8e7reed wpa_printf(MSG_INFO, " Attribute %d (%s) length=%d", 285de49988bc24977f97bb1da8c17ceee5432fcc8e7reed hdr->type, attr ? attr->name : "?Unknown?", hdr->length); 286de49988bc24977f97bb1da8c17ceee5432fcc8e7reed 28785d34b2e841d99dab914111fe2eaa4db99345e1eBrian Osman if (attr == NULL || hdr->length < sizeof(struct radius_attr_hdr)) 288066f020bb6cb9dbb12b977fcddd93982201777feRobert Phillips return; 2890ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips 2900ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips len = hdr->length - sizeof(struct radius_attr_hdr); 2916dc6f5f4a153d33ed91565cb3cd397a310a937d0bsalomon pos = (unsigned char *) (hdr + 1); 2926dc6f5f4a153d33ed91565cb3cd397a310a937d0bsalomon 2939440345a81d6c2372ac0aed937080f3da67439ddGreg Daniel switch (attr->data_type) { 2949440345a81d6c2372ac0aed937080f3da67439ddGreg Daniel case RADIUS_ATTR_TEXT: 2959440345a81d6c2372ac0aed937080f3da67439ddGreg Daniel printf_encode(buf, sizeof(buf), pos, len); 2969440345a81d6c2372ac0aed937080f3da67439ddGreg Daniel wpa_printf(MSG_INFO, " Value: '%s'", buf); 2977ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel break; 2987ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel 2999440345a81d6c2372ac0aed937080f3da67439ddGreg Daniel case RADIUS_ATTR_IP: 3009440345a81d6c2372ac0aed937080f3da67439ddGreg Daniel if (len == 4) { 3019440345a81d6c2372ac0aed937080f3da67439ddGreg Daniel struct in_addr addr; 3029440345a81d6c2372ac0aed937080f3da67439ddGreg Daniel os_memcpy(&addr, pos, 4); 3039440345a81d6c2372ac0aed937080f3da67439ddGreg Daniel wpa_printf(MSG_INFO, " Value: %s", 3047ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel inet_ntoa(addr)); 3057ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel } else { 3067ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel wpa_printf(MSG_INFO, " Invalid IP address length %d", 3077ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel len); 3087ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel } 3097ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel break; 3107ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel 3117ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel#ifdef CONFIG_IPV6 3128fe24272fa6d2fa9eb2458221ed9852d6ec16f56Brian Salomon case RADIUS_ATTR_IPV6: 3138fe24272fa6d2fa9eb2458221ed9852d6ec16f56Brian Salomon if (len == 16) { 3148fe24272fa6d2fa9eb2458221ed9852d6ec16f56Brian Salomon const char *atxt; 3158fe24272fa6d2fa9eb2458221ed9852d6ec16f56Brian Salomon struct in6_addr *addr = (struct in6_addr *) pos; 3168fe24272fa6d2fa9eb2458221ed9852d6ec16f56Brian Salomon atxt = inet_ntop(AF_INET6, addr, buf, sizeof(buf)); 317d20b5c489b5709a4d251c0cc68d584ea4514594eMike Reed wpa_printf(MSG_INFO, " Value: %s", 3188fe24272fa6d2fa9eb2458221ed9852d6ec16f56Brian Salomon atxt ? atxt : "?"); 3198fe24272fa6d2fa9eb2458221ed9852d6ec16f56Brian Salomon } else { 3208fe24272fa6d2fa9eb2458221ed9852d6ec16f56Brian Salomon wpa_printf(MSG_INFO, " Invalid IPv6 address length %d", 3218fe24272fa6d2fa9eb2458221ed9852d6ec16f56Brian Salomon len); 322fcd5fddb0264d062a461435618ad54a29ff80fc0Robert Phillips } 3238fe24272fa6d2fa9eb2458221ed9852d6ec16f56Brian Salomon break; 3248fe24272fa6d2fa9eb2458221ed9852d6ec16f56Brian Salomon#endif /* CONFIG_IPV6 */ 3258fe24272fa6d2fa9eb2458221ed9852d6ec16f56Brian Salomon 3268fe24272fa6d2fa9eb2458221ed9852d6ec16f56Brian Salomon case RADIUS_ATTR_HEXDUMP: 3278fe24272fa6d2fa9eb2458221ed9852d6ec16f56Brian Salomon case RADIUS_ATTR_UNDIST: 3288fe24272fa6d2fa9eb2458221ed9852d6ec16f56Brian Salomon wpa_snprintf_hex(buf, sizeof(buf), pos, len); 3298fe24272fa6d2fa9eb2458221ed9852d6ec16f56Brian Salomon wpa_printf(MSG_INFO, " Value: %s", buf); 3309440345a81d6c2372ac0aed937080f3da67439ddGreg Daniel break; 3319440345a81d6c2372ac0aed937080f3da67439ddGreg Daniel 332b445a57e6c36cce86580b618701b5af708a6f271jbauman case RADIUS_ATTR_INT32: 333b445a57e6c36cce86580b618701b5af708a6f271jbauman if (len == 4) 334b445a57e6c36cce86580b618701b5af708a6f271jbauman wpa_printf(MSG_INFO, " Value: %u", 335b445a57e6c36cce86580b618701b5af708a6f271jbauman WPA_GET_BE32(pos)); 336dddbe380b0e6b690041a4e020aefe57f1b21691abrianosman else 337dddbe380b0e6b690041a4e020aefe57f1b21691abrianosman wpa_printf(MSG_INFO, " Invalid INT32 length %d", 3385ec26ae9bfca635ccc98283aad5deda11519d826bsalomon len); 339993a4216a6014b9de8f4d8120360c94550dc6761bsalomon break; 340b445a57e6c36cce86580b618701b5af708a6f271jbauman 341b445a57e6c36cce86580b618701b5af708a6f271jbauman default: 342b445a57e6c36cce86580b618701b5af708a6f271jbauman break; 343b445a57e6c36cce86580b618701b5af708a6f271jbauman } 344b445a57e6c36cce86580b618701b5af708a6f271jbauman} 34596fcdcc219d2a0d3579719b84b28bede76efba64halcanary 346993a4216a6014b9de8f4d8120360c94550dc6761bsalomon 347b445a57e6c36cce86580b618701b5af708a6f271jbaumanvoid radius_msg_dump(struct radius_msg *msg) 348b445a57e6c36cce86580b618701b5af708a6f271jbauman{ 349b445a57e6c36cce86580b618701b5af708a6f271jbauman size_t i; 3507ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel 3517ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel wpa_printf(MSG_INFO, "RADIUS message: code=%d (%s) identifier=%d length=%d", 3527ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel msg->hdr->code, radius_code_string(msg->hdr->code), 3537ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel msg->hdr->identifier, be_to_host16(msg->hdr->length)); 3547ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel 3557ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel for (i = 0; i < msg->attr_used; i++) { 3567ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel struct radius_attr_hdr *attr = radius_get_attr_hdr(msg, i); 3577ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel radius_msg_dump_attr(attr); 3587ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel } 3597ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel} 3607ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel 3617ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel 3627ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Danielint radius_msg_finish(struct radius_msg *msg, const u8 *secret, 3637ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel size_t secret_len) 3647ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel{ 365bc7a4fb06780f9829b4b21470fe6f0503d2297cdRobert Phillips if (secret) { 366b445a57e6c36cce86580b618701b5af708a6f271jbauman u8 auth[MD5_MAC_LEN]; 367bc7a4fb06780f9829b4b21470fe6f0503d2297cdRobert Phillips struct radius_attr_hdr *attr; 368b445a57e6c36cce86580b618701b5af708a6f271jbauman 3697ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel os_memset(auth, 0, MD5_MAC_LEN); 3707ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel attr = radius_msg_add_attr(msg, 3717ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel RADIUS_ATTR_MESSAGE_AUTHENTICATOR, 3727ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel auth, MD5_MAC_LEN); 3737ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel if (attr == NULL) { 3747ef28f35a2f7d17b90c776f76d4b374ccee6c347Greg Daniel wpa_printf(MSG_WARNING, "RADIUS: Could not add " 375b445a57e6c36cce86580b618701b5af708a6f271jbauman "Message-Authenticator"); 376bc7a4fb06780f9829b4b21470fe6f0503d2297cdRobert Phillips return -1; 37796fcdcc219d2a0d3579719b84b28bede76efba64halcanary } 378993a4216a6014b9de8f4d8120360c94550dc6761bsalomon msg->hdr->length = host_to_be16(wpabuf_len(msg->buf)); 379993a4216a6014b9de8f4d8120360c94550dc6761bsalomon hmac_md5(secret, secret_len, wpabuf_head(msg->buf), 380d4c741e3d0e0fa633399691c47f76b6c7841ee83robertphillips wpabuf_len(msg->buf), (u8 *) (attr + 1)); 381d4c741e3d0e0fa633399691c47f76b6c7841ee83robertphillips } else 382d4c741e3d0e0fa633399691c47f76b6c7841ee83robertphillips msg->hdr->length = host_to_be16(wpabuf_len(msg->buf)); 383993a4216a6014b9de8f4d8120360c94550dc6761bsalomon 384dd3b3f41829d32d7eaf3eb4903570d49c2ba9ff8Robert Phillips if (wpabuf_len(msg->buf) > 0xffff) { 3851105224f9701e57ec5ce0354d6a380b664f5c638Brian Osman wpa_printf(MSG_WARNING, "RADIUS: Too long message (%lu)", 3861105224f9701e57ec5ce0354d6a380b664f5c638Brian Osman (unsigned long) wpabuf_len(msg->buf)); 3871105224f9701e57ec5ce0354d6a380b664f5c638Brian Osman return -1; 3881105224f9701e57ec5ce0354d6a380b664f5c638Brian Osman } 3891105224f9701e57ec5ce0354d6a380b664f5c638Brian Osman return 0; 3901105224f9701e57ec5ce0354d6a380b664f5c638Brian Osman} 3911105224f9701e57ec5ce0354d6a380b664f5c638Brian Osman 39296fcdcc219d2a0d3579719b84b28bede76efba64halcanary 393993a4216a6014b9de8f4d8120360c94550dc6761bsalomonint radius_msg_finish_srv(struct radius_msg *msg, const u8 *secret, 394993a4216a6014b9de8f4d8120360c94550dc6761bsalomon size_t secret_len, const u8 *req_authenticator) 395993a4216a6014b9de8f4d8120360c94550dc6761bsalomon{ 3967d954ad797176afedb9262fdea4507d0fc60eb9dMike Reed u8 auth[MD5_MAC_LEN]; 397fbcef6eb8abad142daf45418516550f7635b4a52Robert Phillips struct radius_attr_hdr *attr; 398fbcef6eb8abad142daf45418516550f7635b4a52Robert Phillips const u8 *addr[4]; 399993a4216a6014b9de8f4d8120360c94550dc6761bsalomon size_t len[4]; 400b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips 401c9a3706f1ee38c331610ec1e872d9a658566c397robertphillips os_memset(auth, 0, MD5_MAC_LEN); 40282f44319159bb98dcacdbbec7ea643dde5ed024bBrian Salomon attr = radius_msg_add_attr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR, 403e60ad620fe236ce4c1e85a31bd53ed0c848da8c3Robert Phillips auth, MD5_MAC_LEN); 4047ee385e1dc3cd6a47dc8f7297fef6e175eaba224Robert Phillips if (attr == NULL) { 405e60ad620fe236ce4c1e85a31bd53ed0c848da8c3Robert Phillips wpa_printf(MSG_ERROR, "WARNING: Could not add Message-Authenticator"); 406e60ad620fe236ce4c1e85a31bd53ed0c848da8c3Robert Phillips return -1; 4077ee385e1dc3cd6a47dc8f7297fef6e175eaba224Robert Phillips } 408b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips msg->hdr->length = host_to_be16(wpabuf_len(msg->buf)); 409b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips os_memcpy(msg->hdr->authenticator, req_authenticator, 410b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips sizeof(msg->hdr->authenticator)); 411b726d58efc91c4eefa5cea0881a823ee108db8fdRobert Phillips hmac_md5(secret, secret_len, wpabuf_head(msg->buf), 41275a475cf2e7c66eb58b6b8b1441deb5911e53181Robert Phillips wpabuf_len(msg->buf), (u8 *) (attr + 1)); 413993a4216a6014b9de8f4d8120360c94550dc6761bsalomon 4145617900063f69754de62b8b12d32f6e36df14104reed /* ResponseAuth = MD5(Code+ID+Length+RequestAuth+Attributes+Secret) */ 415b445a57e6c36cce86580b618701b5af708a6f271jbauman addr[0] = (u8 *) msg->hdr; 416b445a57e6c36cce86580b618701b5af708a6f271jbauman len[0] = 1 + 1 + 2; 417dddbe380b0e6b690041a4e020aefe57f1b21691abrianosman addr[1] = req_authenticator; 418dddbe380b0e6b690041a4e020aefe57f1b21691abrianosman len[1] = MD5_MAC_LEN; 419dddbe380b0e6b690041a4e020aefe57f1b21691abrianosman addr[2] = wpabuf_head_u8(msg->buf) + sizeof(struct radius_hdr); 420dddbe380b0e6b690041a4e020aefe57f1b21691abrianosman len[2] = wpabuf_len(msg->buf) - sizeof(struct radius_hdr); 421b445a57e6c36cce86580b618701b5af708a6f271jbauman addr[3] = secret; 422b445a57e6c36cce86580b618701b5af708a6f271jbauman len[3] = secret_len; 423b445a57e6c36cce86580b618701b5af708a6f271jbauman md5_vector(4, addr, len, msg->hdr->authenticator); 424b445a57e6c36cce86580b618701b5af708a6f271jbauman 425b445a57e6c36cce86580b618701b5af708a6f271jbauman if (wpabuf_len(msg->buf) > 0xffff) { 426dddbe380b0e6b690041a4e020aefe57f1b21691abrianosman wpa_printf(MSG_WARNING, "RADIUS: Too long message (%lu)", 427dddbe380b0e6b690041a4e020aefe57f1b21691abrianosman (unsigned long) wpabuf_len(msg->buf)); 428dddbe380b0e6b690041a4e020aefe57f1b21691abrianosman return -1; 429dddbe380b0e6b690041a4e020aefe57f1b21691abrianosman } 430b445a57e6c36cce86580b618701b5af708a6f271jbauman return 0; 431b445a57e6c36cce86580b618701b5af708a6f271jbauman} 4323798c86f6885f0b47fb2e659a43b48a4468a97efRobert Phillips 4333798c86f6885f0b47fb2e659a43b48a4468a97efRobert Phillips 434041f7dfc577822f1e97721a865f86a9a02660cf9Brian Osmanint radius_msg_finish_das_resp(struct radius_msg *msg, const u8 *secret, 435041f7dfc577822f1e97721a865f86a9a02660cf9Brian Osman size_t secret_len, 4363798c86f6885f0b47fb2e659a43b48a4468a97efRobert Phillips const struct radius_hdr *req_hdr) 4373798c86f6885f0b47fb2e659a43b48a4468a97efRobert Phillips{ 4383798c86f6885f0b47fb2e659a43b48a4468a97efRobert Phillips const u8 *addr[2]; 4393798c86f6885f0b47fb2e659a43b48a4468a97efRobert Phillips size_t len[2]; 440041f7dfc577822f1e97721a865f86a9a02660cf9Brian Osman u8 auth[MD5_MAC_LEN]; 441041f7dfc577822f1e97721a865f86a9a02660cf9Brian Osman struct radius_attr_hdr *attr; 4423798c86f6885f0b47fb2e659a43b48a4468a97efRobert Phillips 4433798c86f6885f0b47fb2e659a43b48a4468a97efRobert Phillips os_memset(auth, 0, MD5_MAC_LEN); 444041f7dfc577822f1e97721a865f86a9a02660cf9Brian Osman attr = radius_msg_add_attr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR, 445041f7dfc577822f1e97721a865f86a9a02660cf9Brian Osman auth, MD5_MAC_LEN); 4462c2bc11aea4dfcd7ee2f5859838a2aa0a56939e0Brian Osman if (attr == NULL) { 447041f7dfc577822f1e97721a865f86a9a02660cf9Brian Osman wpa_printf(MSG_WARNING, "Could not add Message-Authenticator"); 448041f7dfc577822f1e97721a865f86a9a02660cf9Brian Osman return -1; 449041f7dfc577822f1e97721a865f86a9a02660cf9Brian Osman } 4508744405448b9402e1368aebd321c4f555543301aRobert Phillips 4518744405448b9402e1368aebd321c4f555543301aRobert Phillips msg->hdr->length = host_to_be16(wpabuf_len(msg->buf)); 452041f7dfc577822f1e97721a865f86a9a02660cf9Brian Osman os_memcpy(msg->hdr->authenticator, req_hdr->authenticator, 16); 453041f7dfc577822f1e97721a865f86a9a02660cf9Brian Osman hmac_md5(secret, secret_len, wpabuf_head(msg->buf), 454df7e075c74110fcfebdc49ca503684162e118af5Brian Osman wpabuf_len(msg->buf), (u8 *) (attr + 1)); 455df7e075c74110fcfebdc49ca503684162e118af5Brian Osman 4560ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips /* ResponseAuth = MD5(Code+ID+Length+RequestAuth+Attributes+Secret) */ 4570ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips addr[0] = wpabuf_head_u8(msg->buf); 458041f7dfc577822f1e97721a865f86a9a02660cf9Brian Osman len[0] = wpabuf_len(msg->buf); 459041f7dfc577822f1e97721a865f86a9a02660cf9Brian Osman addr[1] = secret; 460041f7dfc577822f1e97721a865f86a9a02660cf9Brian Osman len[1] = secret_len; 461041f7dfc577822f1e97721a865f86a9a02660cf9Brian Osman if (md5_vector(2, addr, len, msg->hdr->authenticator) < 0) 4620ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips return -1; 4630ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips 464041f7dfc577822f1e97721a865f86a9a02660cf9Brian Osman if (wpabuf_len(msg->buf) > 0xffff) { 465041f7dfc577822f1e97721a865f86a9a02660cf9Brian Osman wpa_printf(MSG_WARNING, "RADIUS: Too long message (%lu)", 466041f7dfc577822f1e97721a865f86a9a02660cf9Brian Osman (unsigned long) wpabuf_len(msg->buf)); 467041f7dfc577822f1e97721a865f86a9a02660cf9Brian Osman return -1; 46813dddce65fd87a8175a209a49f35615735a2886aBrian Osman } 46913dddce65fd87a8175a209a49f35615735a2886aBrian Osman return 0; 47013dddce65fd87a8175a209a49f35615735a2886aBrian Osman} 47113dddce65fd87a8175a209a49f35615735a2886aBrian Osman 47213dddce65fd87a8175a209a49f35615735a2886aBrian Osman 47313dddce65fd87a8175a209a49f35615735a2886aBrian Osmanvoid radius_msg_finish_acct(struct radius_msg *msg, const u8 *secret, 47413dddce65fd87a8175a209a49f35615735a2886aBrian Osman size_t secret_len) 47513dddce65fd87a8175a209a49f35615735a2886aBrian Osman{ 47613dddce65fd87a8175a209a49f35615735a2886aBrian Osman const u8 *addr[2]; 47713dddce65fd87a8175a209a49f35615735a2886aBrian Osman size_t len[2]; 47813dddce65fd87a8175a209a49f35615735a2886aBrian Osman 47913dddce65fd87a8175a209a49f35615735a2886aBrian Osman msg->hdr->length = host_to_be16(wpabuf_len(msg->buf)); 48013dddce65fd87a8175a209a49f35615735a2886aBrian Osman os_memset(msg->hdr->authenticator, 0, MD5_MAC_LEN); 48113dddce65fd87a8175a209a49f35615735a2886aBrian Osman addr[0] = wpabuf_head(msg->buf); 48213dddce65fd87a8175a209a49f35615735a2886aBrian Osman len[0] = wpabuf_len(msg->buf); 48313dddce65fd87a8175a209a49f35615735a2886aBrian Osman addr[1] = secret; 48413dddce65fd87a8175a209a49f35615735a2886aBrian Osman len[1] = secret_len; 48513dddce65fd87a8175a209a49f35615735a2886aBrian Osman md5_vector(2, addr, len, msg->hdr->authenticator); 48613dddce65fd87a8175a209a49f35615735a2886aBrian Osman 48713dddce65fd87a8175a209a49f35615735a2886aBrian Osman if (wpabuf_len(msg->buf) > 0xffff) { 48813dddce65fd87a8175a209a49f35615735a2886aBrian Osman wpa_printf(MSG_WARNING, "RADIUS: Too long messages (%lu)", 48913dddce65fd87a8175a209a49f35615735a2886aBrian Osman (unsigned long) wpabuf_len(msg->buf)); 49013dddce65fd87a8175a209a49f35615735a2886aBrian Osman } 49113dddce65fd87a8175a209a49f35615735a2886aBrian Osman} 492eee4d6e4e8cc5c4c79f065abcc3ce609f71238f9Robert Phillips 49313dddce65fd87a8175a209a49f35615735a2886aBrian Osman 49413dddce65fd87a8175a209a49f35615735a2886aBrian Osmanvoid radius_msg_finish_acct_resp(struct radius_msg *msg, const u8 *secret, 495eee4d6e4e8cc5c4c79f065abcc3ce609f71238f9Robert Phillips size_t secret_len, const u8 *req_authenticator) 49613dddce65fd87a8175a209a49f35615735a2886aBrian Osman{ 49713dddce65fd87a8175a209a49f35615735a2886aBrian Osman const u8 *addr[2]; 49813dddce65fd87a8175a209a49f35615735a2886aBrian Osman size_t len[2]; 49913dddce65fd87a8175a209a49f35615735a2886aBrian Osman 50013dddce65fd87a8175a209a49f35615735a2886aBrian Osman msg->hdr->length = host_to_be16(wpabuf_len(msg->buf)); 50113dddce65fd87a8175a209a49f35615735a2886aBrian Osman os_memcpy(msg->hdr->authenticator, req_authenticator, MD5_MAC_LEN); 502b0e93a22bbfad05bb834e33387880ece56e0f6d2Robert Phillips addr[0] = wpabuf_head(msg->buf); 50316d8ec66cdce2f30ce89b87066d3ac7a244c460dRobert Phillips len[0] = wpabuf_len(msg->buf); 50413dddce65fd87a8175a209a49f35615735a2886aBrian Osman addr[1] = secret; 50513dddce65fd87a8175a209a49f35615735a2886aBrian Osman len[1] = secret_len; 50613dddce65fd87a8175a209a49f35615735a2886aBrian Osman md5_vector(2, addr, len, msg->hdr->authenticator); 50713dddce65fd87a8175a209a49f35615735a2886aBrian Osman 5087a86987815be3af78fe3801d4f347ebb0c63141aDerek Sollenberger if (wpabuf_len(msg->buf) > 0xffff) { 5097e910df7f133e80293117bdd069ed25998d10f8cStan Iliev wpa_printf(MSG_WARNING, "RADIUS: Too long messages (%lu)", 5107e910df7f133e80293117bdd069ed25998d10f8cStan Iliev (unsigned long) wpabuf_len(msg->buf)); 5117e910df7f133e80293117bdd069ed25998d10f8cStan Iliev } 5127e910df7f133e80293117bdd069ed25998d10f8cStan Iliev} 5137e910df7f133e80293117bdd069ed25998d10f8cStan Iliev 5147e910df7f133e80293117bdd069ed25998d10f8cStan Iliev 5157e910df7f133e80293117bdd069ed25998d10f8cStan Ilievint radius_msg_verify_acct_req(struct radius_msg *msg, const u8 *secret, 516634b43008025d039f3f2f1f6c01e8044ffbb901fbsalomon size_t secret_len) 517396fcdba14a0101ed43dcc3863585bf50c4ed6ccbrianosman{ 518634b43008025d039f3f2f1f6c01e8044ffbb901fbsalomon const u8 *addr[4]; 519634b43008025d039f3f2f1f6c01e8044ffbb901fbsalomon size_t len[4]; 520396fcdba14a0101ed43dcc3863585bf50c4ed6ccbrianosman u8 zero[MD5_MAC_LEN]; 521634b43008025d039f3f2f1f6c01e8044ffbb901fbsalomon u8 hash[MD5_MAC_LEN]; 522634b43008025d039f3f2f1f6c01e8044ffbb901fbsalomon 523634b43008025d039f3f2f1f6c01e8044ffbb901fbsalomon os_memset(zero, 0, sizeof(zero)); 524634b43008025d039f3f2f1f6c01e8044ffbb901fbsalomon addr[0] = (u8 *) msg->hdr; 525634b43008025d039f3f2f1f6c01e8044ffbb901fbsalomon len[0] = sizeof(struct radius_hdr) - MD5_MAC_LEN; 526634b43008025d039f3f2f1f6c01e8044ffbb901fbsalomon addr[1] = zero; 527634b43008025d039f3f2f1f6c01e8044ffbb901fbsalomon len[1] = MD5_MAC_LEN; 528634b43008025d039f3f2f1f6c01e8044ffbb901fbsalomon addr[2] = (u8 *) (msg->hdr + 1); 529634b43008025d039f3f2f1f6c01e8044ffbb901fbsalomon len[2] = wpabuf_len(msg->buf) - sizeof(struct radius_hdr); 530634b43008025d039f3f2f1f6c01e8044ffbb901fbsalomon addr[3] = secret; 531634b43008025d039f3f2f1f6c01e8044ffbb901fbsalomon len[3] = secret_len; 532634b43008025d039f3f2f1f6c01e8044ffbb901fbsalomon md5_vector(4, addr, len, hash); 533634b43008025d039f3f2f1f6c01e8044ffbb901fbsalomon return os_memcmp_const(msg->hdr->authenticator, hash, MD5_MAC_LEN) != 0; 5345617900063f69754de62b8b12d32f6e36df14104reed} 5355617900063f69754de62b8b12d32f6e36df14104reed 5364d516a6903d83414b5615ca9388b52064da6990cbsalomon 5374d516a6903d83414b5615ca9388b52064da6990cbsalomonint radius_msg_verify_das_req(struct radius_msg *msg, const u8 *secret, 5384d516a6903d83414b5615ca9388b52064da6990cbsalomon size_t secret_len) 5394d516a6903d83414b5615ca9388b52064da6990cbsalomon{ 54041b952c296e343eeabb07d52b6a55ba7565a286bbsalomon const u8 *addr[4]; 54141b952c296e343eeabb07d52b6a55ba7565a286bbsalomon size_t len[4]; 5424d516a6903d83414b5615ca9388b52064da6990cbsalomon u8 zero[MD5_MAC_LEN]; 5437b8400dad2f82dcc6ed3c7cc1707ebaf85f04840Brian Osman u8 hash[MD5_MAC_LEN]; 5447b8400dad2f82dcc6ed3c7cc1707ebaf85f04840Brian Osman u8 auth[MD5_MAC_LEN], orig[MD5_MAC_LEN]; 5457b8400dad2f82dcc6ed3c7cc1707ebaf85f04840Brian Osman u8 orig_authenticator[16]; 5464d516a6903d83414b5615ca9388b52064da6990cbsalomon 5477b8400dad2f82dcc6ed3c7cc1707ebaf85f04840Brian Osman struct radius_attr_hdr *attr = NULL, *tmp; 5487b8400dad2f82dcc6ed3c7cc1707ebaf85f04840Brian Osman size_t i; 5497b8400dad2f82dcc6ed3c7cc1707ebaf85f04840Brian Osman 5507b8400dad2f82dcc6ed3c7cc1707ebaf85f04840Brian Osman os_memset(zero, 0, sizeof(zero)); 5517b8400dad2f82dcc6ed3c7cc1707ebaf85f04840Brian Osman addr[0] = (u8 *) msg->hdr; 5527b8400dad2f82dcc6ed3c7cc1707ebaf85f04840Brian Osman len[0] = sizeof(struct radius_hdr) - MD5_MAC_LEN; 5537b8400dad2f82dcc6ed3c7cc1707ebaf85f04840Brian Osman addr[1] = zero; 5544d516a6903d83414b5615ca9388b52064da6990cbsalomon len[1] = MD5_MAC_LEN; 5554d516a6903d83414b5615ca9388b52064da6990cbsalomon addr[2] = (u8 *) (msg->hdr + 1); 5564d516a6903d83414b5615ca9388b52064da6990cbsalomon len[2] = wpabuf_len(msg->buf) - sizeof(struct radius_hdr); 5577b8400dad2f82dcc6ed3c7cc1707ebaf85f04840Brian Osman addr[3] = secret; 5584d516a6903d83414b5615ca9388b52064da6990cbsalomon len[3] = secret_len; 5594d516a6903d83414b5615ca9388b52064da6990cbsalomon md5_vector(4, addr, len, hash); 5604d516a6903d83414b5615ca9388b52064da6990cbsalomon if (os_memcmp_const(msg->hdr->authenticator, hash, MD5_MAC_LEN) != 0) 56133e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume return 1; 562a422d706b1a92e71c6f940de3ed3d0b84a13eb1bEric Karl 563a422d706b1a92e71c6f940de3ed3d0b84a13eb1bEric Karl for (i = 0; i < msg->attr_used; i++) { 564a422d706b1a92e71c6f940de3ed3d0b84a13eb1bEric Karl tmp = radius_get_attr_hdr(msg, i); 565a422d706b1a92e71c6f940de3ed3d0b84a13eb1bEric Karl if (tmp->type == RADIUS_ATTR_MESSAGE_AUTHENTICATOR) { 56633e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume if (attr != NULL) { 56733e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume wpa_printf(MSG_WARNING, "Multiple " 56833e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume "Message-Authenticator attributes " 56933e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume "in RADIUS message"); 57033e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume return 1; 57133e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume } 57233e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume attr = tmp; 573921bc678a7b81de31b4e672326ed2f37ffb66b10cblume } 574921bc678a7b81de31b4e672326ed2f37ffb66b10cblume } 57533e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume 57633e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume if (attr == NULL) { 577921bc678a7b81de31b4e672326ed2f37ffb66b10cblume /* Message-Authenticator is MAY; not required */ 57833e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume return 0; 57933e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume } 58033e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume 58133e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume os_memcpy(orig, attr + 1, MD5_MAC_LEN); 582921bc678a7b81de31b4e672326ed2f37ffb66b10cblume os_memset(attr + 1, 0, MD5_MAC_LEN); 58333e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume os_memcpy(orig_authenticator, msg->hdr->authenticator, 58433e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume sizeof(orig_authenticator)); 58533e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume os_memset(msg->hdr->authenticator, 0, 58633e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume sizeof(msg->hdr->authenticator)); 58733e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume hmac_md5(secret, secret_len, wpabuf_head(msg->buf), 58833e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume wpabuf_len(msg->buf), auth); 58933e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume os_memcpy(attr + 1, orig, MD5_MAC_LEN); 59033e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume os_memcpy(msg->hdr->authenticator, orig_authenticator, 5917a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl sizeof(orig_authenticator)); 5927a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl 5937a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl return os_memcmp_const(orig, auth, MD5_MAC_LEN) != 0; 5947a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl} 5957a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl 5967a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl 5977a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karlstatic int radius_msg_add_attr_to_array(struct radius_msg *msg, 5987a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl struct radius_attr_hdr *attr) 5997a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl{ 6007a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl if (msg->attr_used >= msg->attr_size) { 6017a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl size_t *nattr_pos; 60241b952c296e343eeabb07d52b6a55ba7565a286bbsalomon int nlen = msg->attr_size * 2; 603b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk 60433e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume nattr_pos = os_realloc_array(msg->attr_pos, nlen, 6057a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl sizeof(*msg->attr_pos)); 6067a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl if (nattr_pos == NULL) 6077f1d020bbfde245281fac88ff09b55366155be16Mike Reed return -1; 6087f1d020bbfde245281fac88ff09b55366155be16Mike Reed 6097f1d020bbfde245281fac88ff09b55366155be16Mike Reed msg->attr_pos = nattr_pos; 6107f1d020bbfde245281fac88ff09b55366155be16Mike Reed msg->attr_size = nlen; 6117f1d020bbfde245281fac88ff09b55366155be16Mike Reed } 6127f1d020bbfde245281fac88ff09b55366155be16Mike Reed 6137f1d020bbfde245281fac88ff09b55366155be16Mike Reed msg->attr_pos[msg->attr_used++] = 6147f1d020bbfde245281fac88ff09b55366155be16Mike Reed (unsigned char *) attr - wpabuf_head_u8(msg->buf); 6157f1d020bbfde245281fac88ff09b55366155be16Mike Reed 6167f1d020bbfde245281fac88ff09b55366155be16Mike Reed return 0; 6177f1d020bbfde245281fac88ff09b55366155be16Mike Reed} 6187f1d020bbfde245281fac88ff09b55366155be16Mike Reed 6197a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl 6207a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karlstruct radius_attr_hdr *radius_msg_add_attr(struct radius_msg *msg, u8 type, 6217a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl const u8 *data, size_t data_len) 6227a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl{ 6237a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl size_t buf_needed; 6247a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl struct radius_attr_hdr *attr; 625b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk 626b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk if (data_len > RADIUS_MAX_ATTR_LEN) { 627b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk wpa_printf(MSG_ERROR, "radius_msg_add_attr: too long attribute (%lu bytes)", 62833e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume (unsigned long) data_len); 629b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk return NULL; 630b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk } 631b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk 632b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk buf_needed = sizeof(*attr) + data_len; 633b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk 63433e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume if (wpabuf_tailroom(msg->buf) < buf_needed) { 635b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk /* allocate more space for message buffer */ 636b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk if (wpabuf_resize(&msg->buf, buf_needed) < 0) 63741b952c296e343eeabb07d52b6a55ba7565a286bbsalomon return NULL; 63841b952c296e343eeabb07d52b6a55ba7565a286bbsalomon msg->hdr = wpabuf_mhead(msg->buf); 63941b952c296e343eeabb07d52b6a55ba7565a286bbsalomon } 64041b952c296e343eeabb07d52b6a55ba7565a286bbsalomon 64141b952c296e343eeabb07d52b6a55ba7565a286bbsalomon attr = wpabuf_put(msg->buf, sizeof(struct radius_attr_hdr)); 642b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk attr->type = type; 643b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk attr->length = sizeof(*attr) + data_len; 644b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk wpabuf_put_data(msg->buf, data, data_len); 645b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk 646b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk if (radius_msg_add_attr_to_array(msg, attr)) 647b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk return NULL; 648b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk 649b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk return attr; 650b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk} 651b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk 652b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk 653b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk/** 654b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk * radius_msg_parse - Parse a RADIUS message 655b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk * @data: RADIUS message to be parsed 656b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk * @len: Length of data buffer in octets 657b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk * Returns: Parsed RADIUS message or %NULL on failure 658b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk * 659b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk * This parses a RADIUS message and makes a copy of its data. The caller is 660b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk * responsible for freeing the returned data with radius_msg_free(). 661c429baf7a28205a19975cfbb60db1b7bfc9c61faericrk */ 662b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrkstruct radius_msg * radius_msg_parse(const u8 *data, size_t len) 663c429baf7a28205a19975cfbb60db1b7bfc9c61faericrk{ 664c429baf7a28205a19975cfbb60db1b7bfc9c61faericrk struct radius_msg *msg; 665c429baf7a28205a19975cfbb60db1b7bfc9c61faericrk struct radius_hdr *hdr; 66641b952c296e343eeabb07d52b6a55ba7565a286bbsalomon struct radius_attr_hdr *attr; 66741b952c296e343eeabb07d52b6a55ba7565a286bbsalomon size_t msg_len; 66841b952c296e343eeabb07d52b6a55ba7565a286bbsalomon unsigned char *pos, *end; 669086a427b0cee3862f25c492fc5082ff24105dc53Mike Reed 67041b952c296e343eeabb07d52b6a55ba7565a286bbsalomon if (data == NULL || len < sizeof(*hdr)) 67141b952c296e343eeabb07d52b6a55ba7565a286bbsalomon return NULL; 672ade76e9236788120d8a1a4a7a252d8f66b8b9b02Matt Sarett 673ade76e9236788120d8a1a4a7a252d8f66b8b9b02Matt Sarett hdr = (struct radius_hdr *) data; 674ade76e9236788120d8a1a4a7a252d8f66b8b9b02Matt Sarett 675ade76e9236788120d8a1a4a7a252d8f66b8b9b02Matt Sarett msg_len = be_to_host16(hdr->length); 67641b952c296e343eeabb07d52b6a55ba7565a286bbsalomon if (msg_len < sizeof(*hdr) || msg_len > len) { 6777f1d020bbfde245281fac88ff09b55366155be16Mike Reed wpa_printf(MSG_INFO, "RADIUS: Invalid message length"); 67841b952c296e343eeabb07d52b6a55ba7565a286bbsalomon return NULL; 67941b952c296e343eeabb07d52b6a55ba7565a286bbsalomon } 6807992da32f02f90e0ac9ab6914eb31676b502eb71Brian Osman 6817992da32f02f90e0ac9ab6914eb31676b502eb71Brian Osman if (msg_len < len) { 6827992da32f02f90e0ac9ab6914eb31676b502eb71Brian Osman wpa_printf(MSG_DEBUG, "RADIUS: Ignored %lu extra bytes after " 68361624f0c716b576706659750d87b6956f4c15722Brian Osman "RADIUS message", (unsigned long) len - msg_len); 6847992da32f02f90e0ac9ab6914eb31676b502eb71Brian Osman } 6857992da32f02f90e0ac9ab6914eb31676b502eb71Brian Osman 6867992da32f02f90e0ac9ab6914eb31676b502eb71Brian Osman msg = os_zalloc(sizeof(*msg)); 6877992da32f02f90e0ac9ab6914eb31676b502eb71Brian Osman if (msg == NULL) 688ade76e9236788120d8a1a4a7a252d8f66b8b9b02Matt Sarett return NULL; 689ade76e9236788120d8a1a4a7a252d8f66b8b9b02Matt Sarett 690ade76e9236788120d8a1a4a7a252d8f66b8b9b02Matt Sarett msg->buf = wpabuf_alloc_copy(data, msg_len); 6917992da32f02f90e0ac9ab6914eb31676b502eb71Brian Osman if (msg->buf == NULL || radius_msg_initialize(msg)) { 6927a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl radius_msg_free(msg); 6937a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl return NULL; 69441b952c296e343eeabb07d52b6a55ba7565a286bbsalomon } 69541b952c296e343eeabb07d52b6a55ba7565a286bbsalomon msg->hdr = wpabuf_mhead(msg->buf); 6967a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl 6977a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl /* parse attributes */ 6987a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl pos = wpabuf_mhead_u8(msg->buf) + sizeof(struct radius_hdr); 6997a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl end = wpabuf_mhead_u8(msg->buf) + wpabuf_len(msg->buf); 7007a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl while (pos < end) { 701b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk if ((size_t) (end - pos) < sizeof(*attr)) 7027a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl goto fail; 703b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk 704b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk attr = (struct radius_attr_hdr *) pos; 705b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk 706b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk if (pos + attr->length > end || attr->length < sizeof(*attr)) 7077a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl goto fail; 708b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk 709b4da01d8f719f3c43d492e8f62a7e2c861e9ef27ericrk /* TODO: check that attr->length is suitable for attr->type */ 71041b952c296e343eeabb07d52b6a55ba7565a286bbsalomon 7117a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl if (radius_msg_add_attr_to_array(msg, attr)) 7127a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl goto fail; 7137a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl 7147a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl pos += attr->length; 7157a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl } 7167a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl 7177a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl return msg; 7187a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl 7197a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl fail: 72041b952c296e343eeabb07d52b6a55ba7565a286bbsalomon radius_msg_free(msg); 72141b952c296e343eeabb07d52b6a55ba7565a286bbsalomon return NULL; 7222c05280a0f792fc94c879e29011312a57532786bcblume} 72333e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume 72433e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume 72533e0cb5e7f9926b96db209c825f1eeca7c15bb16cblumeint radius_msg_add_eap(struct radius_msg *msg, const u8 *data, size_t data_len) 72633e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume{ 72733e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume const u8 *pos = data; 72833e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume size_t left = data_len; 72933e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume 73033e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume while (left > 0) { 73133e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume int len; 73233e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume if (left > RADIUS_MAX_ATTR_LEN) 73333e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume len = RADIUS_MAX_ATTR_LEN; 73433e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume else 73533e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume len = left; 73633e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume 73733e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume if (!radius_msg_add_attr(msg, RADIUS_ATTR_EAP_MESSAGE, 73833e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume pos, len)) 73933e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume return 0; 74032b5e70178acda2ce1548cce1740841e7d30344abrianosman 74133e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume pos += len; 74233e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume left -= len; 74333e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume } 74441b952c296e343eeabb07d52b6a55ba7565a286bbsalomon 74541b952c296e343eeabb07d52b6a55ba7565a286bbsalomon return 1; 74641b952c296e343eeabb07d52b6a55ba7565a286bbsalomon} 74733e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume 74833e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume 74933e0cb5e7f9926b96db209c825f1eeca7c15bb16cblumestruct wpabuf * radius_msg_get_eap(struct radius_msg *msg) 75041b952c296e343eeabb07d52b6a55ba7565a286bbsalomon{ 75141b952c296e343eeabb07d52b6a55ba7565a286bbsalomon struct wpabuf *eap; 7524d516a6903d83414b5615ca9388b52064da6990cbsalomon size_t len, i; 7534d516a6903d83414b5615ca9388b52064da6990cbsalomon struct radius_attr_hdr *attr; 75484c9cb7bd8f4c2b0cd4a378995ebbd8524efa390Matt Sarett 7554d516a6903d83414b5615ca9388b52064da6990cbsalomon if (msg == NULL) 756ade76e9236788120d8a1a4a7a252d8f66b8b9b02Matt Sarett return NULL; 7577a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl 7584d516a6903d83414b5615ca9388b52064da6990cbsalomon len = 0; 7594d516a6903d83414b5615ca9388b52064da6990cbsalomon for (i = 0; i < msg->attr_used; i++) { 7604d516a6903d83414b5615ca9388b52064da6990cbsalomon attr = radius_get_attr_hdr(msg, i); 7617a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl if (attr->type == RADIUS_ATTR_EAP_MESSAGE && 76284c9cb7bd8f4c2b0cd4a378995ebbd8524efa390Matt Sarett attr->length > sizeof(struct radius_attr_hdr)) 76384c9cb7bd8f4c2b0cd4a378995ebbd8524efa390Matt Sarett len += attr->length - sizeof(struct radius_attr_hdr); 76484c9cb7bd8f4c2b0cd4a378995ebbd8524efa390Matt Sarett } 76584c9cb7bd8f4c2b0cd4a378995ebbd8524efa390Matt Sarett 76684c9cb7bd8f4c2b0cd4a378995ebbd8524efa390Matt Sarett if (len == 0) 76784c9cb7bd8f4c2b0cd4a378995ebbd8524efa390Matt Sarett return NULL; 7684d516a6903d83414b5615ca9388b52064da6990cbsalomon 76941b952c296e343eeabb07d52b6a55ba7565a286bbsalomon eap = wpabuf_alloc(len); 77041b952c296e343eeabb07d52b6a55ba7565a286bbsalomon if (eap == NULL) 77141b952c296e343eeabb07d52b6a55ba7565a286bbsalomon return NULL; 772921bc678a7b81de31b4e672326ed2f37ffb66b10cblume 773921bc678a7b81de31b4e672326ed2f37ffb66b10cblume for (i = 0; i < msg->attr_used; i++) { 774921bc678a7b81de31b4e672326ed2f37ffb66b10cblume attr = radius_get_attr_hdr(msg, i); 77541b952c296e343eeabb07d52b6a55ba7565a286bbsalomon if (attr->type == RADIUS_ATTR_EAP_MESSAGE && 776921bc678a7b81de31b4e672326ed2f37ffb66b10cblume attr->length > sizeof(struct radius_attr_hdr)) { 777921bc678a7b81de31b4e672326ed2f37ffb66b10cblume int flen = attr->length - sizeof(*attr); 77841b952c296e343eeabb07d52b6a55ba7565a286bbsalomon wpabuf_put_data(eap, attr + 1, flen); 7796c15cc7e9d65981ec0363a050d2248f96e21a5daBrian Osman } 7806c15cc7e9d65981ec0363a050d2248f96e21a5daBrian Osman } 7816c15cc7e9d65981ec0363a050d2248f96e21a5daBrian Osman 7827b8400dad2f82dcc6ed3c7cc1707ebaf85f04840Brian Osman return eap; 7836c15cc7e9d65981ec0363a050d2248f96e21a5daBrian Osman} 7846c15cc7e9d65981ec0363a050d2248f96e21a5daBrian Osman 7857a8c84c6c92565842aeea27d4971fbd78d523f7aEric Karl 7867b8400dad2f82dcc6ed3c7cc1707ebaf85f04840Brian Osmanint radius_msg_verify_msg_auth(struct radius_msg *msg, const u8 *secret, 7876c15cc7e9d65981ec0363a050d2248f96e21a5daBrian Osman size_t secret_len, const u8 *req_auth) 7886c15cc7e9d65981ec0363a050d2248f96e21a5daBrian Osman{ 78941b952c296e343eeabb07d52b6a55ba7565a286bbsalomon u8 auth[MD5_MAC_LEN], orig[MD5_MAC_LEN]; 79041b952c296e343eeabb07d52b6a55ba7565a286bbsalomon u8 orig_authenticator[16]; 79133e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume struct radius_attr_hdr *attr = NULL, *tmp; 79233e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume size_t i; 793921bc678a7b81de31b4e672326ed2f37ffb66b10cblume 7947b8400dad2f82dcc6ed3c7cc1707ebaf85f04840Brian Osman for (i = 0; i < msg->attr_used; i++) { 79533e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume tmp = radius_get_attr_hdr(msg, i); 79633e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume if (tmp->type == RADIUS_ATTR_MESSAGE_AUTHENTICATOR) { 79733e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume if (attr != NULL) { 79833e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume wpa_printf(MSG_INFO, "Multiple Message-Authenticator attributes in RADIUS message"); 79933e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume return 1; 80033e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume } 80133e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume attr = tmp; 80233e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume } 80333e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume } 80433e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume 805921bc678a7b81de31b4e672326ed2f37ffb66b10cblume if (attr == NULL) { 80633e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume wpa_printf(MSG_INFO, "No Message-Authenticator attribute found"); 807921bc678a7b81de31b4e672326ed2f37ffb66b10cblume return 1; 80833e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume } 8094d516a6903d83414b5615ca9388b52064da6990cbsalomon 810921bc678a7b81de31b4e672326ed2f37ffb66b10cblume os_memcpy(orig, attr + 1, MD5_MAC_LEN); 81133e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume os_memset(attr + 1, 0, MD5_MAC_LEN); 81233e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume if (req_auth) { 81384c9cb7bd8f4c2b0cd4a378995ebbd8524efa390Matt Sarett os_memcpy(orig_authenticator, msg->hdr->authenticator, 81484c9cb7bd8f4c2b0cd4a378995ebbd8524efa390Matt Sarett sizeof(orig_authenticator)); 81584c9cb7bd8f4c2b0cd4a378995ebbd8524efa390Matt Sarett os_memcpy(msg->hdr->authenticator, req_auth, 81684c9cb7bd8f4c2b0cd4a378995ebbd8524efa390Matt Sarett sizeof(msg->hdr->authenticator)); 81784c9cb7bd8f4c2b0cd4a378995ebbd8524efa390Matt Sarett } 81884c9cb7bd8f4c2b0cd4a378995ebbd8524efa390Matt Sarett hmac_md5(secret, secret_len, wpabuf_head(msg->buf), 81984c9cb7bd8f4c2b0cd4a378995ebbd8524efa390Matt Sarett wpabuf_len(msg->buf), auth); 8204d516a6903d83414b5615ca9388b52064da6990cbsalomon os_memcpy(attr + 1, orig, MD5_MAC_LEN); 821921bc678a7b81de31b4e672326ed2f37ffb66b10cblume if (req_auth) { 82233e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume os_memcpy(msg->hdr->authenticator, orig_authenticator, 823921bc678a7b81de31b4e672326ed2f37ffb66b10cblume sizeof(orig_authenticator)); 82433e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume } 82533e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume 82633e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume if (os_memcmp_const(orig, auth, MD5_MAC_LEN) != 0) { 82733e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume wpa_printf(MSG_INFO, "Invalid Message-Authenticator!"); 828921bc678a7b81de31b4e672326ed2f37ffb66b10cblume return 1; 82933e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume } 83033e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume 83194ddf54a6da1b4c65beaf1a32ac1718959b0709ccblume return 0; 83294ddf54a6da1b4c65beaf1a32ac1718959b0709ccblume} 83333e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume 8347b8400dad2f82dcc6ed3c7cc1707ebaf85f04840Brian Osman 83533e0cb5e7f9926b96db209c825f1eeca7c15bb16cblumeint radius_msg_verify(struct radius_msg *msg, const u8 *secret, 83633e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume size_t secret_len, struct radius_msg *sent_msg, int auth) 83733e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume{ 83833e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume const u8 *addr[4]; 83933e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume size_t len[4]; 84033e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume u8 hash[MD5_MAC_LEN]; 84133e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume 84233e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume if (sent_msg == NULL) { 84333e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume wpa_printf(MSG_INFO, "No matching Access-Request message found"); 84433e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume return 1; 845921bc678a7b81de31b4e672326ed2f37ffb66b10cblume } 84633e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume 847921bc678a7b81de31b4e672326ed2f37ffb66b10cblume if (auth && 84833e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume radius_msg_verify_msg_auth(msg, secret, secret_len, 84912f752723b31bb015ded118bfa466c2f1e9b2905cblume sent_msg->hdr->authenticator)) { 850921bc678a7b81de31b4e672326ed2f37ffb66b10cblume return 1; 85133e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume } 85233e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume 85333e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume /* ResponseAuth = MD5(Code+ID+Length+RequestAuth+Attributes+Secret) */ 85433e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume addr[0] = (u8 *) msg->hdr; 855921bc678a7b81de31b4e672326ed2f37ffb66b10cblume len[0] = 1 + 1 + 2; 85633e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume addr[1] = sent_msg->hdr->authenticator; 857921bc678a7b81de31b4e672326ed2f37ffb66b10cblume len[1] = MD5_MAC_LEN; 858921bc678a7b81de31b4e672326ed2f37ffb66b10cblume addr[2] = wpabuf_head_u8(msg->buf) + sizeof(struct radius_hdr); 859921bc678a7b81de31b4e672326ed2f37ffb66b10cblume len[2] = wpabuf_len(msg->buf) - sizeof(struct radius_hdr); 86033e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume addr[3] = secret; 861921bc678a7b81de31b4e672326ed2f37ffb66b10cblume len[3] = secret_len; 862921bc678a7b81de31b4e672326ed2f37ffb66b10cblume md5_vector(4, addr, len, hash); 863921bc678a7b81de31b4e672326ed2f37ffb66b10cblume if (os_memcmp_const(hash, msg->hdr->authenticator, MD5_MAC_LEN) != 0) { 86433e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume wpa_printf(MSG_INFO, "Response Authenticator invalid!"); 86533e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume return 1; 86633e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume } 8674d516a6903d83414b5615ca9388b52064da6990cbsalomon 86841b952c296e343eeabb07d52b6a55ba7565a286bbsalomon return 0; 86941b952c296e343eeabb07d52b6a55ba7565a286bbsalomon} 87041b952c296e343eeabb07d52b6a55ba7565a286bbsalomon 87141b952c296e343eeabb07d52b6a55ba7565a286bbsalomon 87241b952c296e343eeabb07d52b6a55ba7565a286bbsalomonint radius_msg_copy_attr(struct radius_msg *dst, struct radius_msg *src, 87341b952c296e343eeabb07d52b6a55ba7565a286bbsalomon u8 type) 87441b952c296e343eeabb07d52b6a55ba7565a286bbsalomon{ 87541b952c296e343eeabb07d52b6a55ba7565a286bbsalomon struct radius_attr_hdr *attr; 87641b952c296e343eeabb07d52b6a55ba7565a286bbsalomon size_t i; 87741b952c296e343eeabb07d52b6a55ba7565a286bbsalomon int count = 0; 878228482a709690135da4d67879fcc13885e9882e0Brian Salomon 87941b952c296e343eeabb07d52b6a55ba7565a286bbsalomon for (i = 0; i < src->attr_used; i++) { 88041b952c296e343eeabb07d52b6a55ba7565a286bbsalomon attr = radius_get_attr_hdr(src, i); 88133e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume if (attr->type == type && attr->length >= sizeof(*attr)) { 88233e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume if (!radius_msg_add_attr(dst, type, (u8 *) (attr + 1), 8834d516a6903d83414b5615ca9388b52064da6990cbsalomon attr->length - sizeof(*attr))) 8844d516a6903d83414b5615ca9388b52064da6990cbsalomon return -1; 8854d516a6903d83414b5615ca9388b52064da6990cbsalomon count++; 88641b952c296e343eeabb07d52b6a55ba7565a286bbsalomon } 8874d516a6903d83414b5615ca9388b52064da6990cbsalomon } 8884d516a6903d83414b5615ca9388b52064da6990cbsalomon 889b92234a3210bce532f103d71002f4e04d336a182Brian Osman return count; 890b92234a3210bce532f103d71002f4e04d336a182Brian Osman} 891b92234a3210bce532f103d71002f4e04d336a182Brian Osman 89284c9cb7bd8f4c2b0cd4a378995ebbd8524efa390Matt Sarett 893dedac85b4f08546e92143d96c13b753cb1b80e23Matt Sarett/* Create Request Authenticator. The value should be unique over the lifetime 894dedac85b4f08546e92143d96c13b753cb1b80e23Matt Sarett * of the shared secret between authenticator and authentication server. 895dedac85b4f08546e92143d96c13b753cb1b80e23Matt Sarett * Use one-way MD5 hash calculated from current timestamp and some data given 896dedac85b4f08546e92143d96c13b753cb1b80e23Matt Sarett * by the caller. */ 897dedac85b4f08546e92143d96c13b753cb1b80e23Matt Sarettvoid radius_msg_make_authenticator(struct radius_msg *msg, 898ed182d7c9020a0a533ada3e601183f34e4da7504Brian Osman const u8 *data, size_t len) 899ed182d7c9020a0a533ada3e601183f34e4da7504Brian Osman{ 900ed182d7c9020a0a533ada3e601183f34e4da7504Brian Osman struct os_time tv; 901ed182d7c9020a0a533ada3e601183f34e4da7504Brian Osman long int l; 902ed182d7c9020a0a533ada3e601183f34e4da7504Brian Osman const u8 *addr[3]; 903b92234a3210bce532f103d71002f4e04d336a182Brian Osman size_t elen[3]; 904b92234a3210bce532f103d71002f4e04d336a182Brian Osman 905b92234a3210bce532f103d71002f4e04d336a182Brian Osman os_get_time(&tv); 906b92234a3210bce532f103d71002f4e04d336a182Brian Osman l = os_random(); 907b92234a3210bce532f103d71002f4e04d336a182Brian Osman addr[0] = (u8 *) &tv; 908b92234a3210bce532f103d71002f4e04d336a182Brian Osman elen[0] = sizeof(tv); 9098ccbbb455c6ef194920c47e846b95b50f5017138Brian Osman addr[1] = data; 910b92234a3210bce532f103d71002f4e04d336a182Brian Osman elen[1] = len; 911b92234a3210bce532f103d71002f4e04d336a182Brian Osman addr[2] = (u8 *) &l; 912b92234a3210bce532f103d71002f4e04d336a182Brian Osman elen[2] = sizeof(l); 913b92234a3210bce532f103d71002f4e04d336a182Brian Osman md5_vector(3, addr, elen, msg->hdr->authenticator); 91441b952c296e343eeabb07d52b6a55ba7565a286bbsalomon} 91541b952c296e343eeabb07d52b6a55ba7565a286bbsalomon 91641b952c296e343eeabb07d52b6a55ba7565a286bbsalomon 91741b952c296e343eeabb07d52b6a55ba7565a286bbsalomon/* Get Vendor-specific RADIUS Attribute from a parsed RADIUS message. 918186d2d430ba248fea1e00669154b95252ac9a486cblume * Returns the Attribute payload and sets alen to indicate the length of the 919590533f066035a48df9f78395a80314b559f4714Robert Phillips * payload if a vendor attribute with subtype is found, otherwise returns NULL. 92033e0cb5e7f9926b96db209c825f1eeca7c15bb16cblume * The returned payload is allocated with os_malloc() and caller must free it 9217b8400dad2f82dcc6ed3c7cc1707ebaf85f04840Brian Osman * by calling os_free(). 9221119dc366e15ef737d05d3a087410ea40c508101Robert Phillips */ 923186d2d430ba248fea1e00669154b95252ac9a486cblumestatic u8 *radius_msg_get_vendor_attr(struct radius_msg *msg, u32 vendor, 924186d2d430ba248fea1e00669154b95252ac9a486cblume u8 subtype, size_t *alen) 925186d2d430ba248fea1e00669154b95252ac9a486cblume{ 9260ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips u8 *data, *pos; 9270ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips size_t i, len; 9280ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips 929186d2d430ba248fea1e00669154b95252ac9a486cblume if (msg == NULL) 930186d2d430ba248fea1e00669154b95252ac9a486cblume return NULL; 9310ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips 9320ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips for (i = 0; i < msg->attr_used; i++) { 9330ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips struct radius_attr_hdr *attr = radius_get_attr_hdr(msg, i); 9340ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips size_t left; 9350ae6faa34d73ffc7ebec3d13f0473703bade821bRobert Phillips u32 vendor_id; 936186d2d430ba248fea1e00669154b95252ac9a486cblume struct radius_attr_vendor *vhdr; 93763954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman 938d3df9ec874b2668111b36ce0993d860b4f88c765Matt Sarett if (attr->type != RADIUS_ATTR_VENDOR_SPECIFIC || 9399f3dcb3f760274d42e28095fd3cf0f484168d996Matt Sarett attr->length < sizeof(*attr)) 9409f3dcb3f760274d42e28095fd3cf0f484168d996Matt Sarett continue; 9419f3dcb3f760274d42e28095fd3cf0f484168d996Matt Sarett 9429f3dcb3f760274d42e28095fd3cf0f484168d996Matt Sarett left = attr->length - sizeof(*attr); 9439f3dcb3f760274d42e28095fd3cf0f484168d996Matt Sarett if (left < 4) 9449f3dcb3f760274d42e28095fd3cf0f484168d996Matt Sarett continue; 945d3df9ec874b2668111b36ce0993d860b4f88c765Matt Sarett 946d3df9ec874b2668111b36ce0993d860b4f88c765Matt Sarett pos = (u8 *) (attr + 1); 947d3df9ec874b2668111b36ce0993d860b4f88c765Matt Sarett 948d3df9ec874b2668111b36ce0993d860b4f88c765Matt Sarett os_memcpy(&vendor_id, pos, 4); 949d3df9ec874b2668111b36ce0993d860b4f88c765Matt Sarett pos += 4; 950d3df9ec874b2668111b36ce0993d860b4f88c765Matt Sarett left -= 4; 951d3df9ec874b2668111b36ce0993d860b4f88c765Matt Sarett 952d3df9ec874b2668111b36ce0993d860b4f88c765Matt Sarett if (ntohl(vendor_id) != vendor) 953d3df9ec874b2668111b36ce0993d860b4f88c765Matt Sarett continue; 954d3df9ec874b2668111b36ce0993d860b4f88c765Matt Sarett 95563954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman while (left >= sizeof(*vhdr)) { 95663954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman vhdr = (struct radius_attr_vendor *) pos; 95763954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman if (vhdr->vendor_length > left || 95863954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman vhdr->vendor_length < sizeof(*vhdr)) { 959dd3b3f41829d32d7eaf3eb4903570d49c2ba9ff8Robert Phillips break; 96063954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman } 96163954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman if (vhdr->vendor_type != subtype) { 96263954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman pos += vhdr->vendor_length; 96363954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman left -= vhdr->vendor_length; 96463954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman continue; 96563954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman } 96663954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman 967fbcef6eb8abad142daf45418516550f7635b4a52Robert Phillips len = vhdr->vendor_length - sizeof(*vhdr); 96863954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman data = os_malloc(len); 96963954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman if (data == NULL) 97063954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman return NULL; 97163954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman os_memcpy(data, pos + sizeof(*vhdr), len); 97263954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman if (alen) 97363954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman *alen = len; 9747ee385e1dc3cd6a47dc8f7297fef6e175eaba224Robert Phillips return data; 97563954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman } 97663954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman } 97763954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman 97863954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman return NULL; 97963954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman} 98063954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman 981d3df9ec874b2668111b36ce0993d860b4f88c765Matt Sarett 98263954c9944a5eed4527e0ed368f4e501faf2c625Brian Osmanstatic u8 * decrypt_ms_key(const u8 *key, size_t len, 98363954c9944a5eed4527e0ed368f4e501faf2c625Brian Osman const u8 *req_authenticator, 9845bbd076c52a6cebff4a2d63edd027b0f31624287Brian Osman const u8 *secret, size_t secret_len, size_t *reslen) 9855bbd076c52a6cebff4a2d63edd027b0f31624287Brian Osman{ 9865bbd076c52a6cebff4a2d63edd027b0f31624287Brian Osman u8 *plain, *ppos, *res; 9875bbd076c52a6cebff4a2d63edd027b0f31624287Brian Osman const u8 *pos; 9885bbd076c52a6cebff4a2d63edd027b0f31624287Brian Osman size_t left, plen; 9895bbd076c52a6cebff4a2d63edd027b0f31624287Brian Osman u8 hash[MD5_MAC_LEN]; 9905bbd076c52a6cebff4a2d63edd027b0f31624287Brian Osman int i, first = 1; 9915bbd076c52a6cebff4a2d63edd027b0f31624287Brian Osman const u8 *addr[3]; 9925bbd076c52a6cebff4a2d63edd027b0f31624287Brian Osman size_t elen[3]; 9935bbd076c52a6cebff4a2d63edd027b0f31624287Brian Osman 9945bbd076c52a6cebff4a2d63edd027b0f31624287Brian Osman /* key: 16-bit salt followed by encrypted key info */ 9955bbd076c52a6cebff4a2d63edd027b0f31624287Brian Osman 9965bbd076c52a6cebff4a2d63edd027b0f31624287Brian Osman if (len < 2 + 16) { 997 wpa_printf(MSG_DEBUG, "RADIUS: %s: Len is too small: %d", 998 __func__, (int) len); 999 return NULL; 1000 } 1001 1002 pos = key + 2; 1003 left = len - 2; 1004 if (left % 16) { 1005 wpa_printf(MSG_INFO, "RADIUS: Invalid ms key len %lu", 1006 (unsigned long) left); 1007 return NULL; 1008 } 1009 1010 plen = left; 1011 ppos = plain = os_malloc(plen); 1012 if (plain == NULL) 1013 return NULL; 1014 plain[0] = 0; 1015 1016 while (left > 0) { 1017 /* b(1) = MD5(Secret + Request-Authenticator + Salt) 1018 * b(i) = MD5(Secret + c(i - 1)) for i > 1 */ 1019 1020 addr[0] = secret; 1021 elen[0] = secret_len; 1022 if (first) { 1023 addr[1] = req_authenticator; 1024 elen[1] = MD5_MAC_LEN; 1025 addr[2] = key; 1026 elen[2] = 2; /* Salt */ 1027 } else { 1028 addr[1] = pos - MD5_MAC_LEN; 1029 elen[1] = MD5_MAC_LEN; 1030 } 1031 md5_vector(first ? 3 : 2, addr, elen, hash); 1032 first = 0; 1033 1034 for (i = 0; i < MD5_MAC_LEN; i++) 1035 *ppos++ = *pos++ ^ hash[i]; 1036 left -= MD5_MAC_LEN; 1037 } 1038 1039 if (plain[0] == 0 || plain[0] > plen - 1) { 1040 wpa_printf(MSG_INFO, "RADIUS: Failed to decrypt MPPE key"); 1041 os_free(plain); 1042 return NULL; 1043 } 1044 1045 res = os_malloc(plain[0]); 1046 if (res == NULL) { 1047 os_free(plain); 1048 return NULL; 1049 } 1050 os_memcpy(res, plain + 1, plain[0]); 1051 if (reslen) 1052 *reslen = plain[0]; 1053 os_free(plain); 1054 return res; 1055} 1056 1057 1058static void encrypt_ms_key(const u8 *key, size_t key_len, u16 salt, 1059 const u8 *req_authenticator, 1060 const u8 *secret, size_t secret_len, 1061 u8 *ebuf, size_t *elen) 1062{ 1063 int i, len, first = 1; 1064 u8 hash[MD5_MAC_LEN], saltbuf[2], *pos; 1065 const u8 *addr[3]; 1066 size_t _len[3]; 1067 1068 WPA_PUT_BE16(saltbuf, salt); 1069 1070 len = 1 + key_len; 1071 if (len & 0x0f) { 1072 len = (len & 0xf0) + 16; 1073 } 1074 os_memset(ebuf, 0, len); 1075 ebuf[0] = key_len; 1076 os_memcpy(ebuf + 1, key, key_len); 1077 1078 *elen = len; 1079 1080 pos = ebuf; 1081 while (len > 0) { 1082 /* b(1) = MD5(Secret + Request-Authenticator + Salt) 1083 * b(i) = MD5(Secret + c(i - 1)) for i > 1 */ 1084 addr[0] = secret; 1085 _len[0] = secret_len; 1086 if (first) { 1087 addr[1] = req_authenticator; 1088 _len[1] = MD5_MAC_LEN; 1089 addr[2] = saltbuf; 1090 _len[2] = sizeof(saltbuf); 1091 } else { 1092 addr[1] = pos - MD5_MAC_LEN; 1093 _len[1] = MD5_MAC_LEN; 1094 } 1095 md5_vector(first ? 3 : 2, addr, _len, hash); 1096 first = 0; 1097 1098 for (i = 0; i < MD5_MAC_LEN; i++) 1099 *pos++ ^= hash[i]; 1100 1101 len -= MD5_MAC_LEN; 1102 } 1103} 1104 1105 1106struct radius_ms_mppe_keys * 1107radius_msg_get_ms_keys(struct radius_msg *msg, struct radius_msg *sent_msg, 1108 const u8 *secret, size_t secret_len) 1109{ 1110 u8 *key; 1111 size_t keylen; 1112 struct radius_ms_mppe_keys *keys; 1113 1114 if (msg == NULL || sent_msg == NULL) 1115 return NULL; 1116 1117 keys = os_zalloc(sizeof(*keys)); 1118 if (keys == NULL) 1119 return NULL; 1120 1121 key = radius_msg_get_vendor_attr(msg, RADIUS_VENDOR_ID_MICROSOFT, 1122 RADIUS_VENDOR_ATTR_MS_MPPE_SEND_KEY, 1123 &keylen); 1124 if (key) { 1125 keys->send = decrypt_ms_key(key, keylen, 1126 sent_msg->hdr->authenticator, 1127 secret, secret_len, 1128 &keys->send_len); 1129 if (!keys->send) { 1130 wpa_printf(MSG_DEBUG, 1131 "RADIUS: Failed to decrypt send key"); 1132 } 1133 os_free(key); 1134 } 1135 1136 key = radius_msg_get_vendor_attr(msg, RADIUS_VENDOR_ID_MICROSOFT, 1137 RADIUS_VENDOR_ATTR_MS_MPPE_RECV_KEY, 1138 &keylen); 1139 if (key) { 1140 keys->recv = decrypt_ms_key(key, keylen, 1141 sent_msg->hdr->authenticator, 1142 secret, secret_len, 1143 &keys->recv_len); 1144 if (!keys->recv) { 1145 wpa_printf(MSG_DEBUG, 1146 "RADIUS: Failed to decrypt recv key"); 1147 } 1148 os_free(key); 1149 } 1150 1151 return keys; 1152} 1153 1154 1155struct radius_ms_mppe_keys * 1156radius_msg_get_cisco_keys(struct radius_msg *msg, struct radius_msg *sent_msg, 1157 const u8 *secret, size_t secret_len) 1158{ 1159 u8 *key; 1160 size_t keylen; 1161 struct radius_ms_mppe_keys *keys; 1162 1163 if (msg == NULL || sent_msg == NULL) 1164 return NULL; 1165 1166 keys = os_zalloc(sizeof(*keys)); 1167 if (keys == NULL) 1168 return NULL; 1169 1170 key = radius_msg_get_vendor_attr(msg, RADIUS_VENDOR_ID_CISCO, 1171 RADIUS_CISCO_AV_PAIR, &keylen); 1172 if (key && keylen == 51 && 1173 os_memcmp(key, "leap:session-key=", 17) == 0) { 1174 keys->recv = decrypt_ms_key(key + 17, keylen - 17, 1175 sent_msg->hdr->authenticator, 1176 secret, secret_len, 1177 &keys->recv_len); 1178 } 1179 os_free(key); 1180 1181 return keys; 1182} 1183 1184 1185int radius_msg_add_mppe_keys(struct radius_msg *msg, 1186 const u8 *req_authenticator, 1187 const u8 *secret, size_t secret_len, 1188 const u8 *send_key, size_t send_key_len, 1189 const u8 *recv_key, size_t recv_key_len) 1190{ 1191 struct radius_attr_hdr *attr; 1192 u32 vendor_id = htonl(RADIUS_VENDOR_ID_MICROSOFT); 1193 u8 *buf; 1194 struct radius_attr_vendor *vhdr; 1195 u8 *pos; 1196 size_t elen; 1197 int hlen; 1198 u16 salt; 1199 1200 hlen = sizeof(vendor_id) + sizeof(*vhdr) + 2; 1201 1202 /* MS-MPPE-Send-Key */ 1203 buf = os_malloc(hlen + send_key_len + 16); 1204 if (buf == NULL) { 1205 return 0; 1206 } 1207 pos = buf; 1208 os_memcpy(pos, &vendor_id, sizeof(vendor_id)); 1209 pos += sizeof(vendor_id); 1210 vhdr = (struct radius_attr_vendor *) pos; 1211 vhdr->vendor_type = RADIUS_VENDOR_ATTR_MS_MPPE_SEND_KEY; 1212 pos = (u8 *) (vhdr + 1); 1213 salt = os_random() | 0x8000; 1214 WPA_PUT_BE16(pos, salt); 1215 pos += 2; 1216 encrypt_ms_key(send_key, send_key_len, salt, req_authenticator, secret, 1217 secret_len, pos, &elen); 1218 vhdr->vendor_length = hlen + elen - sizeof(vendor_id); 1219 1220 attr = radius_msg_add_attr(msg, RADIUS_ATTR_VENDOR_SPECIFIC, 1221 buf, hlen + elen); 1222 os_free(buf); 1223 if (attr == NULL) { 1224 return 0; 1225 } 1226 1227 /* MS-MPPE-Recv-Key */ 1228 buf = os_malloc(hlen + send_key_len + 16); 1229 if (buf == NULL) { 1230 return 0; 1231 } 1232 pos = buf; 1233 os_memcpy(pos, &vendor_id, sizeof(vendor_id)); 1234 pos += sizeof(vendor_id); 1235 vhdr = (struct radius_attr_vendor *) pos; 1236 vhdr->vendor_type = RADIUS_VENDOR_ATTR_MS_MPPE_RECV_KEY; 1237 pos = (u8 *) (vhdr + 1); 1238 salt ^= 1; 1239 WPA_PUT_BE16(pos, salt); 1240 pos += 2; 1241 encrypt_ms_key(recv_key, recv_key_len, salt, req_authenticator, secret, 1242 secret_len, pos, &elen); 1243 vhdr->vendor_length = hlen + elen - sizeof(vendor_id); 1244 1245 attr = radius_msg_add_attr(msg, RADIUS_ATTR_VENDOR_SPECIFIC, 1246 buf, hlen + elen); 1247 os_free(buf); 1248 if (attr == NULL) { 1249 return 0; 1250 } 1251 1252 return 1; 1253} 1254 1255 1256int radius_msg_add_wfa(struct radius_msg *msg, u8 subtype, const u8 *data, 1257 size_t len) 1258{ 1259 struct radius_attr_hdr *attr; 1260 u8 *buf, *pos; 1261 size_t alen; 1262 1263 alen = 4 + 2 + len; 1264 buf = os_malloc(alen); 1265 if (buf == NULL) 1266 return 0; 1267 pos = buf; 1268 WPA_PUT_BE32(pos, RADIUS_VENDOR_ID_WFA); 1269 pos += 4; 1270 *pos++ = subtype; 1271 *pos++ = 2 + len; 1272 os_memcpy(pos, data, len); 1273 attr = radius_msg_add_attr(msg, RADIUS_ATTR_VENDOR_SPECIFIC, 1274 buf, alen); 1275 os_free(buf); 1276 if (attr == NULL) 1277 return 0; 1278 1279 return 1; 1280} 1281 1282 1283int radius_user_password_hide(struct radius_msg *msg, 1284 const u8 *data, size_t data_len, 1285 const u8 *secret, size_t secret_len, 1286 u8 *buf, size_t buf_len) 1287{ 1288 size_t padlen, i, pos; 1289 const u8 *addr[2]; 1290 size_t len[2]; 1291 u8 hash[16]; 1292 1293 if (data_len + 16 > buf_len) 1294 return -1; 1295 1296 os_memcpy(buf, data, data_len); 1297 1298 padlen = data_len % 16; 1299 if (padlen && data_len < buf_len) { 1300 padlen = 16 - padlen; 1301 os_memset(buf + data_len, 0, padlen); 1302 buf_len = data_len + padlen; 1303 } else { 1304 buf_len = data_len; 1305 } 1306 1307 addr[0] = secret; 1308 len[0] = secret_len; 1309 addr[1] = msg->hdr->authenticator; 1310 len[1] = 16; 1311 md5_vector(2, addr, len, hash); 1312 1313 for (i = 0; i < 16; i++) 1314 buf[i] ^= hash[i]; 1315 pos = 16; 1316 1317 while (pos < buf_len) { 1318 addr[0] = secret; 1319 len[0] = secret_len; 1320 addr[1] = &buf[pos - 16]; 1321 len[1] = 16; 1322 md5_vector(2, addr, len, hash); 1323 1324 for (i = 0; i < 16; i++) 1325 buf[pos + i] ^= hash[i]; 1326 1327 pos += 16; 1328 } 1329 1330 return buf_len; 1331} 1332 1333 1334/* Add User-Password attribute to a RADIUS message and encrypt it as specified 1335 * in RFC 2865, Chap. 5.2 */ 1336struct radius_attr_hdr * 1337radius_msg_add_attr_user_password(struct radius_msg *msg, 1338 const u8 *data, size_t data_len, 1339 const u8 *secret, size_t secret_len) 1340{ 1341 u8 buf[128]; 1342 int res; 1343 1344 res = radius_user_password_hide(msg, data, data_len, 1345 secret, secret_len, buf, sizeof(buf)); 1346 if (res < 0) 1347 return NULL; 1348 1349 return radius_msg_add_attr(msg, RADIUS_ATTR_USER_PASSWORD, 1350 buf, res); 1351} 1352 1353 1354int radius_msg_get_attr(struct radius_msg *msg, u8 type, u8 *buf, size_t len) 1355{ 1356 struct radius_attr_hdr *attr = NULL, *tmp; 1357 size_t i, dlen; 1358 1359 for (i = 0; i < msg->attr_used; i++) { 1360 tmp = radius_get_attr_hdr(msg, i); 1361 if (tmp->type == type) { 1362 attr = tmp; 1363 break; 1364 } 1365 } 1366 1367 if (!attr || attr->length < sizeof(*attr)) 1368 return -1; 1369 1370 dlen = attr->length - sizeof(*attr); 1371 if (buf) 1372 os_memcpy(buf, (attr + 1), dlen > len ? len : dlen); 1373 return dlen; 1374} 1375 1376 1377int radius_msg_get_attr_ptr(struct radius_msg *msg, u8 type, u8 **buf, 1378 size_t *len, const u8 *start) 1379{ 1380 size_t i; 1381 struct radius_attr_hdr *attr = NULL, *tmp; 1382 1383 for (i = 0; i < msg->attr_used; i++) { 1384 tmp = radius_get_attr_hdr(msg, i); 1385 if (tmp->type == type && 1386 (start == NULL || (u8 *) tmp > start)) { 1387 attr = tmp; 1388 break; 1389 } 1390 } 1391 1392 if (!attr || attr->length < sizeof(*attr)) 1393 return -1; 1394 1395 *buf = (u8 *) (attr + 1); 1396 *len = attr->length - sizeof(*attr); 1397 return 0; 1398} 1399 1400 1401int radius_msg_count_attr(struct radius_msg *msg, u8 type, int min_len) 1402{ 1403 size_t i; 1404 int count; 1405 1406 for (count = 0, i = 0; i < msg->attr_used; i++) { 1407 struct radius_attr_hdr *attr = radius_get_attr_hdr(msg, i); 1408 if (attr->type == type && 1409 attr->length >= sizeof(struct radius_attr_hdr) + min_len) 1410 count++; 1411 } 1412 1413 return count; 1414} 1415 1416 1417struct radius_tunnel_attrs { 1418 int tag_used; 1419 int type; /* Tunnel-Type */ 1420 int medium_type; /* Tunnel-Medium-Type */ 1421 int vlanid; 1422}; 1423 1424 1425/** 1426 * radius_msg_get_vlanid - Parse RADIUS attributes for VLAN tunnel information 1427 * @msg: RADIUS message 1428 * Returns: VLAN ID for the first tunnel configuration of -1 if none is found 1429 */ 1430int radius_msg_get_vlanid(struct radius_msg *msg) 1431{ 1432 struct radius_tunnel_attrs tunnel[RADIUS_TUNNEL_TAGS], *tun; 1433 size_t i; 1434 struct radius_attr_hdr *attr = NULL; 1435 const u8 *data; 1436 char buf[10]; 1437 size_t dlen; 1438 1439 os_memset(&tunnel, 0, sizeof(tunnel)); 1440 1441 for (i = 0; i < msg->attr_used; i++) { 1442 attr = radius_get_attr_hdr(msg, i); 1443 if (attr->length < sizeof(*attr)) 1444 return -1; 1445 data = (const u8 *) (attr + 1); 1446 dlen = attr->length - sizeof(*attr); 1447 if (attr->length < 3) 1448 continue; 1449 if (data[0] >= RADIUS_TUNNEL_TAGS) 1450 tun = &tunnel[0]; 1451 else 1452 tun = &tunnel[data[0]]; 1453 1454 switch (attr->type) { 1455 case RADIUS_ATTR_TUNNEL_TYPE: 1456 if (attr->length != 6) 1457 break; 1458 tun->tag_used++; 1459 tun->type = WPA_GET_BE24(data + 1); 1460 break; 1461 case RADIUS_ATTR_TUNNEL_MEDIUM_TYPE: 1462 if (attr->length != 6) 1463 break; 1464 tun->tag_used++; 1465 tun->medium_type = WPA_GET_BE24(data + 1); 1466 break; 1467 case RADIUS_ATTR_TUNNEL_PRIVATE_GROUP_ID: 1468 if (data[0] < RADIUS_TUNNEL_TAGS) { 1469 data++; 1470 dlen--; 1471 } 1472 if (dlen >= sizeof(buf)) 1473 break; 1474 os_memcpy(buf, data, dlen); 1475 buf[dlen] = '\0'; 1476 tun->tag_used++; 1477 tun->vlanid = atoi(buf); 1478 break; 1479 } 1480 } 1481 1482 for (i = 0; i < RADIUS_TUNNEL_TAGS; i++) { 1483 tun = &tunnel[i]; 1484 if (tun->tag_used && 1485 tun->type == RADIUS_TUNNEL_TYPE_VLAN && 1486 tun->medium_type == RADIUS_TUNNEL_MEDIUM_TYPE_802 && 1487 tun->vlanid > 0) 1488 return tun->vlanid; 1489 } 1490 1491 return -1; 1492} 1493 1494 1495/** 1496 * radius_msg_get_tunnel_password - Parse RADIUS attribute Tunnel-Password 1497 * @msg: Received RADIUS message 1498 * @keylen: Length of returned password 1499 * @secret: RADIUS shared secret 1500 * @secret_len: Length of secret 1501 * @sent_msg: Sent RADIUS message 1502 * @n: Number of password attribute to return (starting with 0) 1503 * Returns: Pointer to n-th password (free with os_free) or %NULL 1504 */ 1505char * radius_msg_get_tunnel_password(struct radius_msg *msg, int *keylen, 1506 const u8 *secret, size_t secret_len, 1507 struct radius_msg *sent_msg, size_t n) 1508{ 1509 u8 *buf = NULL; 1510 size_t buflen; 1511 const u8 *salt; 1512 u8 *str; 1513 const u8 *addr[3]; 1514 size_t len[3]; 1515 u8 hash[16]; 1516 u8 *pos; 1517 size_t i, j = 0; 1518 struct radius_attr_hdr *attr; 1519 const u8 *data; 1520 size_t dlen; 1521 const u8 *fdata = NULL; /* points to found item */ 1522 size_t fdlen = -1; 1523 char *ret = NULL; 1524 1525 /* find n-th valid Tunnel-Password attribute */ 1526 for (i = 0; i < msg->attr_used; i++) { 1527 attr = radius_get_attr_hdr(msg, i); 1528 if (attr == NULL || 1529 attr->type != RADIUS_ATTR_TUNNEL_PASSWORD) { 1530 continue; 1531 } 1532 if (attr->length <= 5) 1533 continue; 1534 data = (const u8 *) (attr + 1); 1535 dlen = attr->length - sizeof(*attr); 1536 if (dlen <= 3 || dlen % 16 != 3) 1537 continue; 1538 j++; 1539 if (j <= n) 1540 continue; 1541 1542 fdata = data; 1543 fdlen = dlen; 1544 break; 1545 } 1546 if (fdata == NULL) 1547 goto out; 1548 1549 /* alloc writable memory for decryption */ 1550 buf = os_malloc(fdlen); 1551 if (buf == NULL) 1552 goto out; 1553 os_memcpy(buf, fdata, fdlen); 1554 buflen = fdlen; 1555 1556 /* init pointers */ 1557 salt = buf + 1; 1558 str = buf + 3; 1559 1560 /* decrypt blocks */ 1561 pos = buf + buflen - 16; /* last block */ 1562 while (pos >= str + 16) { /* all but the first block */ 1563 addr[0] = secret; 1564 len[0] = secret_len; 1565 addr[1] = pos - 16; 1566 len[1] = 16; 1567 md5_vector(2, addr, len, hash); 1568 1569 for (i = 0; i < 16; i++) 1570 pos[i] ^= hash[i]; 1571 1572 pos -= 16; 1573 } 1574 1575 /* decrypt first block */ 1576 if (str != pos) 1577 goto out; 1578 addr[0] = secret; 1579 len[0] = secret_len; 1580 addr[1] = sent_msg->hdr->authenticator; 1581 len[1] = 16; 1582 addr[2] = salt; 1583 len[2] = 2; 1584 md5_vector(3, addr, len, hash); 1585 1586 for (i = 0; i < 16; i++) 1587 pos[i] ^= hash[i]; 1588 1589 /* derive plaintext length from first subfield */ 1590 *keylen = (unsigned char) str[0]; 1591 if ((u8 *) (str + *keylen) >= (u8 *) (buf + buflen)) { 1592 /* decryption error - invalid key length */ 1593 goto out; 1594 } 1595 if (*keylen == 0) { 1596 /* empty password */ 1597 goto out; 1598 } 1599 1600 /* copy passphrase into new buffer */ 1601 ret = os_malloc(*keylen); 1602 if (ret) 1603 os_memcpy(ret, str + 1, *keylen); 1604 1605out: 1606 /* return new buffer */ 1607 os_free(buf); 1608 return ret; 1609} 1610 1611 1612void radius_free_class(struct radius_class_data *c) 1613{ 1614 size_t i; 1615 if (c == NULL) 1616 return; 1617 for (i = 0; i < c->count; i++) 1618 os_free(c->attr[i].data); 1619 os_free(c->attr); 1620 c->attr = NULL; 1621 c->count = 0; 1622} 1623 1624 1625int radius_copy_class(struct radius_class_data *dst, 1626 const struct radius_class_data *src) 1627{ 1628 size_t i; 1629 1630 if (src->attr == NULL) 1631 return 0; 1632 1633 dst->attr = os_calloc(src->count, sizeof(struct radius_attr_data)); 1634 if (dst->attr == NULL) 1635 return -1; 1636 1637 dst->count = 0; 1638 1639 for (i = 0; i < src->count; i++) { 1640 dst->attr[i].data = os_malloc(src->attr[i].len); 1641 if (dst->attr[i].data == NULL) 1642 break; 1643 dst->count++; 1644 os_memcpy(dst->attr[i].data, src->attr[i].data, 1645 src->attr[i].len); 1646 dst->attr[i].len = src->attr[i].len; 1647 } 1648 1649 return 0; 1650} 1651 1652 1653u8 radius_msg_find_unlisted_attr(struct radius_msg *msg, u8 *attrs) 1654{ 1655 size_t i, j; 1656 struct radius_attr_hdr *attr; 1657 1658 for (i = 0; i < msg->attr_used; i++) { 1659 attr = radius_get_attr_hdr(msg, i); 1660 1661 for (j = 0; attrs[j]; j++) { 1662 if (attr->type == attrs[j]) 1663 break; 1664 } 1665 1666 if (attrs[j] == 0) 1667 return attr->type; /* unlisted attr */ 1668 } 1669 1670 return 0; 1671} 1672