ims-volte-vowifi
/
strongswan
9
0
Fork 0
Code Pull Requests Releases Activity
strongswan/src/libcharon/plugins/eap_radius/eap_radius.c

812 lines
19 KiB
C
Raw Blame History

/*
* Copyright (C) 2012-2018 Tobias Brunner
* Copyright (C) 2009 Martin Willi
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "eap_radius.h"
#include "eap_radius_plugin.h"
#include "eap_radius_forward.h"
#include "eap_radius_provider.h"
#include "eap_radius_accounting.h"
#include <radius_message.h>
#include <radius_client.h>
#include <bio/bio_writer.h>
#include <daemon.h>
typedef struct private_eap_radius_t private_eap_radius_t;
/**
* Private data of an eap_radius_t object.
*/
struct private_eap_radius_t {
/**
* Public authenticator_t interface.
*/
eap_radius_t public;
/**
* ID of the server
*/
identification_t *server;
/**
* ID of the peer
*/
identification_t *peer;
/**
* EAP method type we are proxying
*/
eap_type_t type;
/**
* EAP vendor, if any
*/
uint32_t vendor;
/**
* EAP message identifier
*/
uint8_t identifier;
/**
* RADIUS client instance
*/
radius_client_t *client;
/**
* TRUE to use EAP-Start, FALSE to send EAP-Identity Response directly
*/
bool eap_start;
/**
* Prefix to prepend to EAP identity
*/
char *id_prefix;
};
/**
* Add EAP-Identity to RADIUS message
*/
static void add_eap_identity(private_eap_radius_t *this,
radius_message_t *request)
{
struct {
/** EAP code (REQUEST/RESPONSE) */
uint8_t code;
/** unique message identifier */
uint8_t identifier;
/** length of whole message */
uint16_t length;
/** EAP type */
uint8_t type;
/** identity data */
uint8_t data[];
} __attribute__((__packed__)) *hdr;
chunk_t id, prefix;
size_t len;
id = this->peer->get_encoding(this->peer);
prefix = chunk_create(this->id_prefix, strlen(this->id_prefix));
len = sizeof(*hdr) + prefix.len + id.len;
hdr = alloca(len);
hdr->code = EAP_RESPONSE;
hdr->identifier = this->identifier;
hdr->length = htons(len);
hdr->type = EAP_IDENTITY;
memcpy(hdr->data, prefix.ptr, prefix.len);
memcpy(hdr->data + prefix.len, id.ptr, id.len);
request->add(request, RAT_EAP_MESSAGE, chunk_create((u_char*)hdr, len));
}
/**
* Copy EAP-Message attribute from RADIUS message to an new EAP payload
*/
static bool radius2ike(private_eap_radius_t *this,
radius_message_t *msg, eap_payload_t **out)
{
enumerator_t *enumerator;
eap_payload_t *payload;
chunk_t data, message = chunk_empty;
int type;
enumerator = msg->create_enumerator(msg);
while (enumerator->enumerate(enumerator, &type, &data))
{
if (type == RAT_EAP_MESSAGE && data.len)
{
message = chunk_cat("mc", message, data);
}
}
enumerator->destroy(enumerator);
if (message.len)
{
*out = payload = eap_payload_create_data(message);
/* apply EAP method selected by RADIUS server */
this->type = payload->get_type(payload, &this->vendor);
DBG3(DBG_IKE, "%N payload %B", eap_type_names, this->type, &message);
free(message.ptr);
return TRUE;
}
return FALSE;
}
/**
* See header.
*/
void eap_radius_build_attributes(radius_message_t *request)
{
ike_sa_t *ike_sa;
host_t *host;
char buf[40], *station_id_fmt, *session_id;
uint32_t value;
chunk_t chunk;
/* virtual NAS-Port-Type */
value = htonl(5);
request->add(request, RAT_NAS_PORT_TYPE, chunk_from_thing(value));
/* framed ServiceType */
value = htonl(2);
request->add(request, RAT_SERVICE_TYPE, chunk_from_thing(value));
ike_sa = charon->bus->get_sa(charon->bus);
if (ike_sa)
{
value = htonl(ike_sa->get_unique_id(ike_sa));
request->add(request, RAT_NAS_PORT, chunk_from_thing(value));
request->add(request, RAT_NAS_PORT_ID,
chunk_from_str(ike_sa->get_name(ike_sa)));
host = ike_sa->get_my_host(ike_sa);
chunk = host->get_address(host);
switch (host->get_family(host))
{
case AF_INET:
request->add(request, RAT_NAS_IP_ADDRESS, chunk);
break;
case AF_INET6:
request->add(request, RAT_NAS_IPV6_ADDRESS, chunk);
default:
break;
}
if (lib->settings->get_bool(lib->settings,
"%s.plugins.eap-radius.station_id_with_port",
TRUE, lib->ns))
{
station_id_fmt = "%#H";
}
else
{
station_id_fmt = "%H";
}
snprintf(buf, sizeof(buf), station_id_fmt, host);
request->add(request, RAT_CALLED_STATION_ID, chunk_from_str(buf));
host = ike_sa->get_other_host(ike_sa);
snprintf(buf, sizeof(buf), station_id_fmt, host);
request->add(request, RAT_CALLING_STATION_ID, chunk_from_str(buf));
session_id = eap_radius_accounting_session_id(ike_sa);
if (session_id)
{
request->add(request, RAT_ACCT_SESSION_ID,
chunk_from_str(session_id));
free(session_id);
}
}
}
/**
* Add a set of RADIUS attributes to a request message
*/
static void add_radius_request_attrs(private_eap_radius_t *this,
radius_message_t *request)
{
chunk_t chunk;
chunk = chunk_from_str(this->id_prefix);
chunk = chunk_cata("cc", chunk, this->peer->get_encoding(this->peer));
request->add(request, RAT_USER_NAME, chunk);
eap_radius_build_attributes(request);
eap_radius_forward_from_ike(request);
}
METHOD(eap_method_t, initiate, status_t,
private_eap_radius_t *this, eap_payload_t **out)
{
radius_message_t *request, *response;
status_t status = FAILED;
request = radius_message_create(RMC_ACCESS_REQUEST);
add_radius_request_attrs(this, request);
if (this->eap_start)
{
request->add(request, RAT_EAP_MESSAGE, chunk_empty);
}
else
{
add_eap_identity(this, request);
}
response = this->client->request(this->client, request);
if (response)
{
eap_radius_forward_to_ike(response);
switch (response->get_code(response))
{
case RMC_ACCESS_CHALLENGE:
if (radius2ike(this, response, out))
{
status = NEED_MORE;
}
break;
case RMC_ACCESS_ACCEPT:
/* Microsoft RADIUS servers can run in a mode where they respond
* like this on the first request (i.e. without authentication),
* we treat this as Access-Reject */
case RMC_ACCESS_REJECT:
default:
DBG1(DBG_IKE, "RADIUS authentication of '%Y' failed",
this->peer);
break;
}
response->destroy(response);
}
else
{
eap_radius_handle_timeout(NULL);
}
request->destroy(request);
return status;
}
/**
* Handle the Class attribute
*/
static void process_class(radius_message_t *msg)
{
enumerator_t *enumerator;
ike_sa_t *ike_sa;
identification_t *id;
auth_cfg_t *auth;
chunk_t data;
bool class_group, class_send;
int type;
class_group = lib->settings->get_bool(lib->settings,
"%s.plugins.eap-radius.class_group", FALSE, lib->ns);
class_send = lib->settings->get_bool(lib->settings,
"%s.plugins.eap-radius.accounting_send_class", FALSE, lib->ns);
ike_sa = charon->bus->get_sa(charon->bus);
if ((!class_group && !class_send) || !ike_sa)
{
return;
}
enumerator = msg->create_enumerator(msg);
while (enumerator->enumerate(enumerator, &type, &data))
{
if (type == RAT_CLASS)
{
if (class_group && data.len < 44)
{ /* quirk: ignore long class attributes, these are used for
* other purposes by some RADIUS servers (such as NPS). */
auth = ike_sa->get_auth_cfg(ike_sa, FALSE);
id = identification_create_from_data(data);
DBG1(DBG_CFG, "received group membership '%Y' from RADIUS",
id);
auth->add(auth, AUTH_RULE_GROUP, id);
}
if (class_send)
{
eap_radius_accounting_add_class(ike_sa, data);
}
}
}
enumerator->destroy(enumerator);
}
/**
* Handle the Filter-Id attribute as IPsec CHILD_SA name
*/
static void process_filter_id(radius_message_t *msg)
{
enumerator_t *enumerator;
int type;
uint8_t tunnel_tag;
uint32_t tunnel_type;
chunk_t filter_id = chunk_empty, data;
bool is_esp_tunnel = FALSE;
enumerator = msg->create_enumerator(msg);
while (enumerator->enumerate(enumerator, &type, &data))
{
switch (type)
{
case RAT_TUNNEL_TYPE:
if (data.len != 4)
{
continue;
}
tunnel_tag = *data.ptr;
*data.ptr = 0x00;
tunnel_type = untoh32(data.ptr);
DBG1(DBG_IKE, "received RADIUS attribute Tunnel-Type: "
"tag = %u, value = %u", tunnel_tag, tunnel_type);
is_esp_tunnel = (tunnel_type == RADIUS_TUNNEL_TYPE_ESP);
break;
case RAT_FILTER_ID:
filter_id = data;
DBG1(DBG_IKE, "received RADIUS attribute Filter-Id: "
"'%.*s'", (int)filter_id.len, filter_id.ptr);
break;
default:
break;
}
}
enumerator->destroy(enumerator);
if (is_esp_tunnel && filter_id.len)
{
identification_t *id;
ike_sa_t *ike_sa;
auth_cfg_t *auth;
ike_sa = charon->bus->get_sa(charon->bus);
if (ike_sa)
{
auth = ike_sa->get_auth_cfg(ike_sa, FALSE);
id = identification_create_from_data(filter_id);
auth->add(auth, AUTH_RULE_GROUP, id);
}
}
}
/**
* Handle Session-Timeout attribute and Interim updates
*/
static void process_timeout(radius_message_t *msg)
{
enumerator_t *enumerator;
ike_sa_t *ike_sa;
chunk_t data;
int type;
ike_sa = charon->bus->get_sa(charon->bus);
if (ike_sa)
{
enumerator = msg->create_enumerator(msg);
while (enumerator->enumerate(enumerator, &type, &data))
{
if (type == RAT_SESSION_TIMEOUT && data.len == 4)
{
ike_sa->set_auth_lifetime(ike_sa, untoh32(data.ptr));
}
else if (type == RAT_ACCT_INTERIM_INTERVAL && data.len == 4)
{
eap_radius_accounting_start_interim(ike_sa, untoh32(data.ptr));
}
}
enumerator->destroy(enumerator);
}
}
/**
* Add a Cisco Unity configuration attribute
*/
static void add_unity_attribute(eap_radius_provider_t *provider, uint32_t id,
int type, chunk_t data)
{
switch (type)
{
case 15: /* CVPN3000-IPSec-Banner1 */
case 36: /* CVPN3000-IPSec-Banner2 */
provider->add_attribute(provider, id, UNITY_BANNER, data);
break;
case 28: /* CVPN3000-IPSec-Default-Domain */
provider->add_attribute(provider, id, UNITY_DEF_DOMAIN, data);
break;
case 29: /* CVPN3000-IPSec-Split-DNS-Names */
provider->add_attribute(provider, id, UNITY_SPLITDNS_NAME, data);
break;
}
}
/**
* Add a DNS/NBNS configuration attribute
*/
static void add_nameserver_attribute(eap_radius_provider_t *provider,
uint32_t id, int type, chunk_t data)
{
/* these are from different vendors, but there is currently no conflict */
switch (type)
{
case 5: /* CVPN3000-Primary-DNS */
case 6: /* CVPN3000-Secondary-DNS */
case 28: /* MS-Primary-DNS-Server */
case 29: /* MS-Secondary-DNS-Server */
provider->add_attribute(provider, id, INTERNAL_IP4_DNS, data);
break;
case 7: /* CVPN3000-Primary-WINS */
case 8: /* CVPN3000-Secondary-WINS */
case 30: /* MS-Primary-NBNS-Server */
case 31: /* MS-Secondary-NBNS-Server */
provider->add_attribute(provider, id, INTERNAL_IP4_NBNS, data);
break;
case RAT_FRAMED_IPV6_DNS_SERVER:
provider->add_attribute(provider, id, INTERNAL_IP6_DNS, data);
break;
}
}
/**
* Add a UNITY_LOCAL_LAN or UNITY_SPLIT_INCLUDE attribute
*/
static void add_unity_split_attribute(eap_radius_provider_t *provider,
uint32_t id, configuration_attribute_type_t type,
chunk_t data)
{
enumerator_t *enumerator;
bio_writer_t *writer;
char buffer[256], *token, *slash;
if (snprintf(buffer, sizeof(buffer), "%.*s", (int)data.len,
data.ptr) >= sizeof(buffer))
{
return;
}
writer = bio_writer_create(16); /* two IPv4 addresses and 6 bytes padding */
enumerator = enumerator_create_token(buffer, ",", " ");
while (enumerator->enumerate(enumerator, &token))
{
host_t *net, *mask = NULL;
chunk_t padding;
slash = strchr(token, '/');
if (slash)
{
*slash++ = '\0';
mask = host_create_from_string(slash, 0);
}
if (!mask)
{ /* default to /32 */
mask = host_create_from_string("255.255.255.255", 0);
}
net = host_create_from_string(token, 0);
if (!net || net->get_family(net) != AF_INET ||
mask->get_family(mask) != AF_INET)
{
mask->destroy(mask);
DESTROY_IF(net);
continue;
}
writer->write_data(writer, net->get_address(net));
writer->write_data(writer, mask->get_address(mask));
padding = writer->skip(writer, 6); /* 6 bytes padding */
memset(padding.ptr, 0, padding.len);
mask->destroy(mask);
net->destroy(net);
}
enumerator->destroy(enumerator);
data = writer->get_buf(writer);
if (data.len)
{
provider->add_attribute(provider, id, type, data);
}
writer->destroy(writer);
}
/**
* Handle Framed-IP-Address and other IKE configuration attributes
*/
static void process_cfg_attributes(radius_message_t *msg)
{
eap_radius_provider_t *provider;
enumerator_t *enumerator;
ike_sa_t *ike_sa;
host_t *host;
chunk_t data;
configuration_attribute_type_t split_type = 0;
int type, vendor;
ike_sa = charon->bus->get_sa(charon->bus);
provider = eap_radius_provider_get();
if (provider && ike_sa)
{
enumerator = msg->create_enumerator(msg);
while (enumerator->enumerate(enumerator, &type, &data))
{
if ((type == RAT_FRAMED_IP_ADDRESS && data.len == 4) ||
(type == RAT_FRAMED_IPV6_ADDRESS && data.len == 16))
{
host = host_create_from_chunk(AF_UNSPEC, data, 0);
if (host)
{
provider->add_framed_ip(provider,
ike_sa->get_unique_id(ike_sa), host);
}
}
else if (type == RAT_FRAMED_IP_NETMASK && data.len == 4)
{
provider->add_attribute(provider, ike_sa->get_unique_id(ike_sa),
INTERNAL_IP4_NETMASK, data);
}
else if (type == RAT_FRAMED_IPV6_DNS_SERVER && data.len == 16)
{
add_nameserver_attribute(provider,
ike_sa->get_unique_id(ike_sa), type, data);
}
}
enumerator->destroy(enumerator);
enumerator = msg->create_vendor_enumerator(msg);
while (enumerator->enumerate(enumerator, &vendor, &type, &data))
{
if (vendor == PEN_ALTIGA /* aka Cisco VPN3000 */)
{
switch (type)
{
case 5: /* CVPN3000-Primary-DNS */
case 6: /* CVPN3000-Secondary-DNS */
case 7: /* CVPN3000-Primary-WINS */
case 8: /* CVPN3000-Secondary-WINS */
if (data.len == 4)
{
add_nameserver_attribute(provider,
ike_sa->get_unique_id(ike_sa), type, data);
}
break;
case 15: /* CVPN3000-IPSec-Banner1 */
case 28: /* CVPN3000-IPSec-Default-Domain */
case 29: /* CVPN3000-IPSec-Split-DNS-Names */
case 36: /* CVPN3000-IPSec-Banner2 */
if (ike_sa->supports_extension(ike_sa, EXT_CISCO_UNITY))
{
add_unity_attribute(provider,
ike_sa->get_unique_id(ike_sa), type, data);
}
break;
case 55: /* CVPN3000-IPSec-Split-Tunneling-Policy */
if (data.len)
{
switch (data.ptr[data.len - 1])
{
case 0: /* tunnelall */
default:
break;
case 1: /* tunnelspecified */
split_type = UNITY_SPLIT_INCLUDE;
break;
case 2: /* excludespecified */
split_type = UNITY_LOCAL_LAN;
break;
}
}
break;
default:
break;
}
}
if (vendor == PEN_MICROSOFT)
{
switch (type)
{
case 28: /* MS-Primary-DNS-Server */
case 29: /* MS-Secondary-DNS-Server */
case 30: /* MS-Primary-NBNS-Server */
case 31: /* MS-Secondary-NBNS-Server */
if (data.len == 4)
{
add_nameserver_attribute(provider,
ike_sa->get_unique_id(ike_sa), type, data);
}
break;
}
}
}
enumerator->destroy(enumerator);
if (split_type != 0 &&
ike_sa->supports_extension(ike_sa, EXT_CISCO_UNITY))
{
enumerator = msg->create_vendor_enumerator(msg);
while (enumerator->enumerate(enumerator, &vendor, &type, &data))
{
if (vendor == PEN_ALTIGA /* aka Cisco VPN3000 */ &&
type == 27 /* CVPN3000-IPSec-Split-Tunnel-List */)
{
add_unity_split_attribute(provider,
ike_sa->get_unique_id(ike_sa), split_type, data);
}
}
enumerator->destroy(enumerator);
}
}
}
/**
* See header.
*/
void eap_radius_process_attributes(radius_message_t *message)
{
process_class(message);
if (lib->settings->get_bool(lib->settings,
"%s.plugins.eap-radius.filter_id", FALSE, lib->ns))
{
process_filter_id(message);
}
process_timeout(message);
process_cfg_attributes(message);
}
METHOD(eap_method_t, process, status_t,
private_eap_radius_t *this, eap_payload_t *in, eap_payload_t **out)
{
radius_message_t *request, *response;
status_t status = FAILED;
chunk_t data;
request = radius_message_create(RMC_ACCESS_REQUEST);
add_radius_request_attrs(this, request);
data = in->get_data(in);
DBG3(DBG_IKE, "%N payload %B", eap_type_names, this->type, &data);
/* fragment data suitable for RADIUS */
while (data.len > MAX_RADIUS_ATTRIBUTE_SIZE)
{
request->add(request, RAT_EAP_MESSAGE,
chunk_create(data.ptr,MAX_RADIUS_ATTRIBUTE_SIZE));
data = chunk_skip(data, MAX_RADIUS_ATTRIBUTE_SIZE);
}
request->add(request, RAT_EAP_MESSAGE, data);
response = this->client->request(this->client, request);
if (response)
{
eap_radius_forward_to_ike(response);
switch (response->get_code(response))
{
case RMC_ACCESS_CHALLENGE:
if (radius2ike(this, response, out))
{
status = NEED_MORE;
break;
}
status = FAILED;
break;
case RMC_ACCESS_ACCEPT:
eap_radius_process_attributes(response);
DBG1(DBG_IKE, "RADIUS authentication of '%Y' successful",
this->peer);
status = SUCCESS;
break;
case RMC_ACCESS_REJECT:
default:
DBG1(DBG_IKE, "RADIUS authentication of '%Y' failed",
this->peer);
status = FAILED;
break;
}
response->destroy(response);
}
request->destroy(request);
return status;
}
METHOD(eap_method_t, get_type, eap_type_t,
private_eap_radius_t *this, uint32_t *vendor)
{
*vendor = this->vendor;
return this->type;
}
METHOD(eap_method_t, get_msk, status_t,
private_eap_radius_t *this, chunk_t *out)
{
chunk_t msk;
msk = this->client->get_msk(this->client);
if (msk.len)
{
*out = msk;
return SUCCESS;
}
return FAILED;
}
METHOD(eap_method_t, get_identifier, uint8_t,
private_eap_radius_t *this)
{
return this->identifier;
}
METHOD(eap_method_t, set_identifier, void,
private_eap_radius_t *this, uint8_t identifier)
{
this->identifier = identifier;
}
METHOD(eap_method_t, is_mutual, bool,
private_eap_radius_t *this)
{
switch (this->type)
{
case EAP_AKA:
case EAP_SIM:
return TRUE;
default:
return FALSE;
}
}
METHOD(eap_method_t, destroy, void,
private_eap_radius_t *this)
{
this->peer->destroy(this->peer);
this->server->destroy(this->server);
this->client->destroy(this->client);
free(this);
}
/**
* Generic constructor
*/
eap_radius_t *eap_radius_create(identification_t *server, identification_t *peer)
{
private_eap_radius_t *this;
INIT(this,
.public = {
.eap_method = {
.initiate = _initiate,
.process = _process,
.get_type = _get_type,
.is_mutual = _is_mutual,
.get_msk = _get_msk,
.get_identifier = _get_identifier,
.set_identifier = _set_identifier,
.destroy = _destroy,
},
},
/* initially EAP_RADIUS, but is set to the method selected by RADIUS */
.type = EAP_RADIUS,
.eap_start = lib->settings->get_bool(lib->settings,
"%s.plugins.eap-radius.eap_start", FALSE,
lib->ns),
.id_prefix = lib->settings->get_str(lib->settings,
"%s.plugins.eap-radius.id_prefix", "",
lib->ns),
);
this->client = eap_radius_create_client();
if (!this->client)
{
free(this);
return NULL;
}
this->peer = peer->clone(peer);
this->server = server->clone(server);
return &this->public;
}
View Git Blame Copy Permalink