2010-07-21 15:06:00 +00:00
|
|
|
/*
|
|
|
|
* Copyright (C) 2010 Martin Willi
|
|
|
|
* Copyright (C) 2010 revosec AG
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or modify it
|
|
|
|
* under the terms of the GNU General Public License as published by the
|
|
|
|
* Free Software Foundation; either version 2 of the License, or (at your
|
|
|
|
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope that it will be useful, but
|
|
|
|
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
|
|
|
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
|
|
* for more details.
|
|
|
|
*/
|
|
|
|
|
2015-11-07 17:53:50 +00:00
|
|
|
/*
|
|
|
|
* Copyright (C) 2015 Thom Troy
|
|
|
|
*
|
|
|
|
* Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
|
|
* of this software and associated documentation files (the "Software"), to deal
|
|
|
|
* in the Software without restriction, including without limitation the rights
|
|
|
|
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
|
|
* copies of the Software, and to permit persons to whom the Software is
|
|
|
|
* furnished to do so, subject to the following conditions:
|
|
|
|
*
|
|
|
|
* The above copyright notice and this permission notice shall be included in
|
|
|
|
* all copies or substantial portions of the Software.
|
|
|
|
*
|
|
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
|
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
|
|
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
|
|
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
|
|
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
|
|
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
|
|
|
* THE SOFTWARE.
|
|
|
|
*/
|
|
|
|
|
2010-07-21 15:06:00 +00:00
|
|
|
#include "radius_socket.h"
|
2012-03-13 22:26:15 +00:00
|
|
|
#include "radius_mppe.h"
|
2010-07-21 15:06:00 +00:00
|
|
|
|
|
|
|
#include <errno.h>
|
|
|
|
#include <unistd.h>
|
2015-11-07 17:53:50 +00:00
|
|
|
#include <math.h>
|
2010-07-21 15:06:00 +00:00
|
|
|
|
2012-03-13 18:23:35 +00:00
|
|
|
#include <pen/pen.h>
|
2012-10-16 14:03:21 +00:00
|
|
|
#include <utils/debug.h>
|
2010-07-21 15:06:00 +00:00
|
|
|
|
|
|
|
typedef struct private_radius_socket_t private_radius_socket_t;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Private data of an radius_socket_t object.
|
|
|
|
*/
|
|
|
|
struct private_radius_socket_t {
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Public radius_socket_t interface.
|
|
|
|
*/
|
|
|
|
radius_socket_t public;
|
|
|
|
|
|
|
|
/**
|
2012-01-30 18:15:20 +00:00
|
|
|
* Server port for authentication
|
2010-07-21 15:06:00 +00:00
|
|
|
*/
|
2016-03-22 12:22:01 +00:00
|
|
|
uint16_t auth_port;
|
2010-07-21 15:06:00 +00:00
|
|
|
|
2011-04-21 09:40:25 +00:00
|
|
|
/**
|
2012-01-30 18:15:20 +00:00
|
|
|
* socket file descriptor for authentication
|
2011-04-21 09:40:25 +00:00
|
|
|
*/
|
2012-01-30 18:15:20 +00:00
|
|
|
int auth_fd;
|
2011-04-21 09:40:25 +00:00
|
|
|
|
|
|
|
/**
|
2012-01-30 18:15:20 +00:00
|
|
|
* Server port for accounting
|
2011-04-21 09:40:25 +00:00
|
|
|
*/
|
2016-03-22 12:22:01 +00:00
|
|
|
uint16_t acct_port;
|
2012-01-30 18:15:20 +00:00
|
|
|
|
|
|
|
/**
|
|
|
|
* socket file descriptor for accounting
|
|
|
|
*/
|
|
|
|
int acct_fd;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Server address
|
|
|
|
*/
|
|
|
|
char *address;
|
2011-04-21 09:40:25 +00:00
|
|
|
|
2010-07-21 15:06:00 +00:00
|
|
|
/**
|
|
|
|
* current RADIUS identifier
|
|
|
|
*/
|
2016-03-22 12:22:01 +00:00
|
|
|
uint8_t identifier;
|
2010-07-21 15:06:00 +00:00
|
|
|
|
|
|
|
/**
|
|
|
|
* hasher to use for response verification
|
|
|
|
*/
|
|
|
|
hasher_t *hasher;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* HMAC-MD5 signer to build Message-Authenticator attribute
|
|
|
|
*/
|
|
|
|
signer_t *signer;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* random number generator for RADIUS request authenticator
|
|
|
|
*/
|
|
|
|
rng_t *rng;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* RADIUS secret
|
|
|
|
*/
|
|
|
|
chunk_t secret;
|
2015-11-07 17:53:50 +00:00
|
|
|
|
|
|
|
/**
|
|
|
|
* Number of times we retransmit messages before giving up
|
|
|
|
*/
|
|
|
|
u_int retransmit_tries;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Retransmission timeout
|
|
|
|
*/
|
|
|
|
double retransmit_timeout;
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Base to calculate retransmission timeout
|
|
|
|
*/
|
|
|
|
double retransmit_base;
|
2010-07-21 15:06:00 +00:00
|
|
|
};
|
|
|
|
|
2011-04-21 09:40:25 +00:00
|
|
|
/**
|
|
|
|
* Check or establish RADIUS connection
|
|
|
|
*/
|
2012-01-30 18:15:20 +00:00
|
|
|
static bool check_connection(private_radius_socket_t *this,
|
2016-03-22 12:22:01 +00:00
|
|
|
int *fd, uint16_t port)
|
2011-04-21 09:40:25 +00:00
|
|
|
{
|
2012-01-30 18:15:20 +00:00
|
|
|
if (*fd == -1)
|
2011-04-21 09:40:25 +00:00
|
|
|
{
|
|
|
|
host_t *server;
|
|
|
|
|
2012-01-30 18:15:20 +00:00
|
|
|
server = host_create_from_dns(this->address, AF_UNSPEC, port);
|
2011-04-21 09:40:25 +00:00
|
|
|
if (!server)
|
|
|
|
{
|
|
|
|
DBG1(DBG_CFG, "resolving RADIUS server address '%s' failed",
|
|
|
|
this->address);
|
|
|
|
return FALSE;
|
|
|
|
}
|
2012-01-30 18:15:20 +00:00
|
|
|
*fd = socket(server->get_family(server), SOCK_DGRAM, IPPROTO_UDP);
|
|
|
|
if (*fd == -1)
|
2011-04-21 09:40:25 +00:00
|
|
|
{
|
|
|
|
DBG1(DBG_CFG, "opening RADIUS socket for %#H failed: %s",
|
|
|
|
server, strerror(errno));
|
|
|
|
server->destroy(server);
|
|
|
|
return FALSE;
|
|
|
|
}
|
2012-01-30 18:15:20 +00:00
|
|
|
if (connect(*fd, server->get_sockaddr(server),
|
2011-04-21 09:40:25 +00:00
|
|
|
*server->get_sockaddr_len(server)) < 0)
|
|
|
|
{
|
|
|
|
DBG1(DBG_CFG, "connecting RADIUS socket to %#H failed: %s",
|
|
|
|
server, strerror(errno));
|
|
|
|
server->destroy(server);
|
2012-01-30 18:15:20 +00:00
|
|
|
close(*fd);
|
|
|
|
*fd = -1;
|
2011-04-21 09:40:25 +00:00
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
server->destroy(server);
|
|
|
|
}
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
|
2015-04-15 16:03:42 +00:00
|
|
|
/**
|
|
|
|
* Receive the response to the message with the given ID
|
|
|
|
*/
|
2016-03-22 12:22:01 +00:00
|
|
|
static status_t receive_response(int fd, int timeout, uint8_t id,
|
2015-04-15 16:03:42 +00:00
|
|
|
radius_message_t **response)
|
|
|
|
{
|
|
|
|
radius_message_t *msg;
|
|
|
|
char buf[4096];
|
|
|
|
int res;
|
|
|
|
struct pollfd pfd = {
|
|
|
|
.fd = fd,
|
|
|
|
.events = POLLIN,
|
|
|
|
};
|
|
|
|
|
|
|
|
while (TRUE)
|
|
|
|
{
|
|
|
|
res = poll(&pfd, 1, timeout);
|
|
|
|
if (res < 0)
|
|
|
|
{
|
|
|
|
DBG1(DBG_CFG, "waiting for RADIUS message failed: %s",
|
|
|
|
strerror(errno));
|
|
|
|
return FAILED;
|
|
|
|
}
|
|
|
|
if (res == 0)
|
|
|
|
{ /* timeout */
|
|
|
|
return OUT_OF_RES;
|
|
|
|
}
|
|
|
|
res = recv(fd, buf, sizeof(buf), MSG_DONTWAIT);
|
|
|
|
if (res <= 0)
|
|
|
|
{
|
|
|
|
DBG1(DBG_CFG, "receiving RADIUS message failed: %s",
|
|
|
|
strerror(errno));
|
|
|
|
return FAILED;
|
|
|
|
}
|
|
|
|
msg = radius_message_parse(chunk_create(buf, res));
|
|
|
|
if (!msg)
|
|
|
|
{
|
|
|
|
DBG1(DBG_CFG, "received invalid RADIUS message, ignored");
|
|
|
|
return FAILED;
|
|
|
|
}
|
|
|
|
if (id != msg->get_identifier(msg))
|
|
|
|
{
|
|
|
|
/* we haven't received the response to our current request, but
|
|
|
|
* perhaps one for an earlier request for which we didn't wait
|
|
|
|
* long enough */
|
|
|
|
DBG1(DBG_CFG, "received RADIUS message with unexpected ID %d "
|
|
|
|
"[%d expected], ignored", msg->get_identifier(msg), id);
|
|
|
|
msg->destroy(msg);
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
*response = msg;
|
|
|
|
return SUCCESS;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2010-07-21 15:06:00 +00:00
|
|
|
METHOD(radius_socket_t, request, radius_message_t*,
|
|
|
|
private_radius_socket_t *this, radius_message_t *request)
|
|
|
|
{
|
2015-04-15 16:03:42 +00:00
|
|
|
radius_message_t *response;
|
2010-07-21 15:06:00 +00:00
|
|
|
chunk_t data;
|
2015-11-07 17:53:50 +00:00
|
|
|
int *fd, retransmit = 0, timeout;
|
2016-03-22 12:22:01 +00:00
|
|
|
uint16_t port;
|
2012-02-22 13:22:50 +00:00
|
|
|
rng_t *rng = NULL;
|
2010-07-21 15:06:00 +00:00
|
|
|
|
2012-01-30 18:15:20 +00:00
|
|
|
if (request->get_code(request) == RMC_ACCOUNTING_REQUEST)
|
|
|
|
{
|
|
|
|
fd = &this->acct_fd;
|
|
|
|
port = this->acct_port;
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
fd = &this->auth_fd;
|
|
|
|
port = this->auth_port;
|
2012-02-22 13:22:50 +00:00
|
|
|
rng = this->rng;
|
2012-01-30 18:15:20 +00:00
|
|
|
}
|
2012-02-22 13:22:50 +00:00
|
|
|
|
|
|
|
/* set Message Identifier */
|
|
|
|
request->set_identifier(request, this->identifier++);
|
|
|
|
/* sign the request */
|
2012-07-05 16:11:26 +00:00
|
|
|
if (!request->sign(request, NULL, this->secret, this->hasher, this->signer,
|
|
|
|
rng, rng != NULL))
|
|
|
|
{
|
|
|
|
return NULL;
|
|
|
|
}
|
2012-02-22 13:22:50 +00:00
|
|
|
|
2012-01-30 18:15:20 +00:00
|
|
|
if (!check_connection(this, fd, port))
|
2011-04-21 09:40:25 +00:00
|
|
|
{
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2010-07-21 15:06:00 +00:00
|
|
|
data = request->get_encoding(request);
|
2012-03-08 20:47:27 +00:00
|
|
|
DBG3(DBG_CFG, "%B", &data);
|
|
|
|
|
2015-11-07 17:53:50 +00:00
|
|
|
while (retransmit < this->retransmit_tries)
|
2010-07-21 15:06:00 +00:00
|
|
|
{
|
2015-11-07 17:53:50 +00:00
|
|
|
timeout = (int)(this->retransmit_timeout * 1000.0 *
|
|
|
|
pow(this->retransmit_base, retransmit));
|
2014-11-05 15:28:42 +00:00
|
|
|
if (retransmit)
|
|
|
|
{
|
2015-11-07 17:53:50 +00:00
|
|
|
DBG1(DBG_CFG, "retransmit %d of RADIUS %N (timeout: %.1fs)",
|
|
|
|
retransmit, radius_message_code_names,
|
|
|
|
request->get_code(request), timeout/1000.0);
|
2014-11-05 15:28:42 +00:00
|
|
|
}
|
2012-01-30 18:15:20 +00:00
|
|
|
if (send(*fd, data.ptr, data.len, 0) != data.len)
|
2010-07-21 15:06:00 +00:00
|
|
|
{
|
|
|
|
DBG1(DBG_CFG, "sending RADIUS message failed: %s", strerror(errno));
|
|
|
|
return NULL;
|
|
|
|
}
|
2015-11-07 17:53:50 +00:00
|
|
|
switch (receive_response(*fd, timeout, request->get_identifier(request),
|
2015-04-15 16:03:42 +00:00
|
|
|
&response))
|
2014-11-05 15:28:42 +00:00
|
|
|
{
|
2015-04-15 16:03:42 +00:00
|
|
|
case SUCCESS:
|
|
|
|
break;
|
|
|
|
case OUT_OF_RES:
|
|
|
|
retransmit++;
|
|
|
|
continue;
|
|
|
|
default:
|
|
|
|
return NULL;
|
2010-07-21 15:06:00 +00:00
|
|
|
}
|
2015-04-15 16:03:42 +00:00
|
|
|
if (response->verify(response, request->get_authenticator(request),
|
|
|
|
this->secret, this->hasher, this->signer))
|
2010-07-21 15:06:00 +00:00
|
|
|
{
|
2015-04-15 16:03:42 +00:00
|
|
|
return response;
|
2010-07-21 15:06:00 +00:00
|
|
|
}
|
2015-04-15 16:03:42 +00:00
|
|
|
response->destroy(response);
|
2014-11-05 15:28:42 +00:00
|
|
|
return NULL;
|
2010-07-21 15:06:00 +00:00
|
|
|
}
|
2015-11-07 17:53:50 +00:00
|
|
|
|
|
|
|
DBG1(DBG_CFG, "RADIUS %N timed out after %d attempts",
|
|
|
|
radius_message_code_names, request->get_code(request), retransmit);
|
2010-07-21 15:06:00 +00:00
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Decrypt a MS-MPPE-Send/Recv-Key
|
|
|
|
*/
|
2016-03-22 12:22:01 +00:00
|
|
|
static chunk_t decrypt_mppe_key(private_radius_socket_t *this, uint16_t salt,
|
2010-07-21 15:06:00 +00:00
|
|
|
chunk_t C, radius_message_t *request)
|
|
|
|
{
|
2013-07-22 11:45:31 +00:00
|
|
|
chunk_t decrypted;
|
2010-07-21 15:06:00 +00:00
|
|
|
|
2013-07-22 11:45:31 +00:00
|
|
|
decrypted = chunk_alloca(C.len);
|
|
|
|
if (!request->crypt(request, chunk_from_thing(salt), C, decrypted,
|
|
|
|
this->secret, this->hasher) ||
|
|
|
|
decrypted.ptr[0] >= decrypted.len)
|
2010-07-21 15:06:00 +00:00
|
|
|
{ /* decryption failed? */
|
|
|
|
return chunk_empty;
|
|
|
|
}
|
2013-07-22 11:45:31 +00:00
|
|
|
/* remove truncation, first byte is key length */
|
|
|
|
return chunk_clone(chunk_create(decrypted.ptr + 1, decrypted.ptr[0]));
|
2010-07-21 15:06:00 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
METHOD(radius_socket_t, decrypt_msk, chunk_t,
|
|
|
|
private_radius_socket_t *this, radius_message_t *request,
|
|
|
|
radius_message_t *response)
|
|
|
|
{
|
2012-03-13 22:26:15 +00:00
|
|
|
mppe_key_t *mppe_key;
|
2010-07-21 15:06:00 +00:00
|
|
|
enumerator_t *enumerator;
|
|
|
|
chunk_t data, send = chunk_empty, recv = chunk_empty;
|
|
|
|
int type;
|
|
|
|
|
|
|
|
enumerator = response->create_enumerator(response);
|
|
|
|
while (enumerator->enumerate(enumerator, &type, &data))
|
|
|
|
{
|
2012-03-13 22:26:15 +00:00
|
|
|
if (type == RAT_VENDOR_SPECIFIC && data.len > sizeof(mppe_key_t))
|
2010-07-21 15:06:00 +00:00
|
|
|
{
|
2012-03-13 22:26:15 +00:00
|
|
|
mppe_key = (mppe_key_t*)data.ptr;
|
2012-03-13 18:23:35 +00:00
|
|
|
if (ntohl(mppe_key->id) == PEN_MICROSOFT &&
|
2010-07-21 15:06:00 +00:00
|
|
|
mppe_key->length == data.len - sizeof(mppe_key->id))
|
|
|
|
{
|
2012-03-13 22:26:15 +00:00
|
|
|
data = chunk_create(mppe_key->key, data.len - sizeof(mppe_key_t));
|
2010-07-21 15:06:00 +00:00
|
|
|
if (mppe_key->type == MS_MPPE_SEND_KEY)
|
|
|
|
{
|
|
|
|
send = decrypt_mppe_key(this, mppe_key->salt, data, request);
|
|
|
|
}
|
|
|
|
if (mppe_key->type == MS_MPPE_RECV_KEY)
|
|
|
|
{
|
|
|
|
recv = decrypt_mppe_key(this, mppe_key->salt, data, request);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
enumerator->destroy(enumerator);
|
|
|
|
if (send.ptr && recv.ptr)
|
|
|
|
{
|
libradius: Pad received MSK to at least 64 bytes
According to RFC 3748 MSKs must be at least 64 bytes, however, that's
not the case for the MSK derived via EAP-MSCHAPv2. The two key parts
received are only 16 bytes each (derived according to RFC 3079,
section 3.3), so we end up with an MSK of only 32 bytes. The eap-mschapv2
plugin, on the other hand, pads these two parts with 32 zeros.
Interestingly, this is not a problem in many cases as the SHA1/2 based
PRFs used later use a block size that's >= 64 bytes, so the shorter MSK
is just padded with zeros then. However, with AES-XCBC-PRF-128, for
instance, which uses a block size of 16 bytes, the different MSKs are an
issue as XCBC is applied to both to shorten them, with different results.
This eventually causes the authentication to fail if the client uses a
zero-padded MSK produced by the eap-mschapv2 plugin and the server the 32
byte MSK received via RADIUS.
2018-01-26 08:51:07 +00:00
|
|
|
chunk_t pad = chunk_empty;
|
|
|
|
|
|
|
|
if ((send.len + recv.len) < 64)
|
|
|
|
{ /* zero-pad MSK to at least 64 bytes */
|
|
|
|
pad = chunk_alloca(64 - send.len - recv.len);
|
|
|
|
memset(pad.ptr, 0, pad.len);
|
|
|
|
}
|
|
|
|
return chunk_cat("mmc", recv, send, pad);
|
2010-07-21 15:06:00 +00:00
|
|
|
}
|
|
|
|
chunk_clear(&send);
|
|
|
|
chunk_clear(&recv);
|
|
|
|
return chunk_empty;
|
|
|
|
}
|
|
|
|
|
|
|
|
METHOD(radius_socket_t, destroy, void,
|
|
|
|
private_radius_socket_t *this)
|
|
|
|
{
|
|
|
|
DESTROY_IF(this->hasher);
|
|
|
|
DESTROY_IF(this->signer);
|
|
|
|
DESTROY_IF(this->rng);
|
2012-01-30 18:15:20 +00:00
|
|
|
if (this->auth_fd != -1)
|
|
|
|
{
|
|
|
|
close(this->auth_fd);
|
|
|
|
};
|
|
|
|
if (this->acct_fd != -1)
|
2011-04-21 09:40:25 +00:00
|
|
|
{
|
2012-01-30 18:15:20 +00:00
|
|
|
close(this->acct_fd);
|
2011-04-21 09:40:25 +00:00
|
|
|
}
|
2010-07-21 15:06:00 +00:00
|
|
|
free(this);
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* See header
|
|
|
|
*/
|
2016-03-22 12:22:01 +00:00
|
|
|
radius_socket_t *radius_socket_create(char *address, uint16_t auth_port,
|
|
|
|
uint16_t acct_port, chunk_t secret,
|
2015-11-07 17:53:50 +00:00
|
|
|
u_int tries, double timeout, double base)
|
2010-07-21 15:06:00 +00:00
|
|
|
{
|
|
|
|
private_radius_socket_t *this;
|
|
|
|
|
|
|
|
INIT(this,
|
|
|
|
.public = {
|
|
|
|
.request = _request,
|
|
|
|
.decrypt_msk = _decrypt_msk,
|
|
|
|
.destroy = _destroy,
|
|
|
|
},
|
2011-04-21 09:40:25 +00:00
|
|
|
.address = address,
|
2012-01-30 18:15:20 +00:00
|
|
|
.auth_port = auth_port,
|
|
|
|
.auth_fd = -1,
|
|
|
|
.acct_port = acct_port,
|
|
|
|
.acct_fd = -1,
|
2012-03-13 22:26:15 +00:00
|
|
|
.hasher = lib->crypto->create_hasher(lib->crypto, HASH_MD5),
|
|
|
|
.signer = lib->crypto->create_signer(lib->crypto, AUTH_HMAC_MD5_128),
|
|
|
|
.rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK),
|
2015-11-07 17:53:50 +00:00
|
|
|
.retransmit_tries = tries,
|
|
|
|
.retransmit_timeout = timeout,
|
|
|
|
.retransmit_base = base,
|
2010-07-21 15:06:00 +00:00
|
|
|
);
|
|
|
|
|
2012-07-06 07:33:10 +00:00
|
|
|
if (!this->hasher || !this->signer || !this->rng ||
|
|
|
|
!this->signer->set_key(this->signer, secret))
|
2010-07-21 15:06:00 +00:00
|
|
|
{
|
|
|
|
DBG1(DBG_CFG, "RADIUS initialization failed, HMAC/MD5/RNG required");
|
|
|
|
destroy(this);
|
|
|
|
return NULL;
|
|
|
|
}
|
2011-04-21 11:21:26 +00:00
|
|
|
this->secret = secret;
|
2010-07-21 15:06:00 +00:00
|
|
|
/* we use a random identifier, helps if we restart often */
|
|
|
|
this->identifier = random();
|
|
|
|
|
|
|
|
return &this->public;
|
|
|
|
}
|