radius.h File Reference

#include <freeradius-devel/radius/defs.h>
#include <freeradius-devel/util/packet.h>
#include <freeradius-devel/util/rand.h>
#include <freeradius-devel/util/log.h>
#include <freeradius-devel/util/dbuff.h>
#include <freeradius-devel/io/test_point.h>

Include dependency graph for radius.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures
struct	fr_radius_attr_flags_t
struct	fr_radius_ctx_t
struct	fr_radius_decode_ctx_t
struct	fr_radius_encode_ctx_t
struct	fr_radius_tag_ctx_t

Macros
#define	AUTH_PASS_LEN   (RADIUS_AUTH_VECTOR_LENGTH)
#define	fr_packet_log_hex(_log, _packet)   _fr_packet_log_hex(_log, _packet, __FILE__, __LINE__)
#define	fr_radius_flag_abinary(_da)   fr_radius_attr_flags(_da)->abinary
#define	fr_radius_flag_concat(_da)   fr_radius_attr_flags(_da)->concat
#define	fr_radius_flag_encrypted(_da)   fr_radius_attr_flags(_da)->encrypt
#define	fr_radius_flag_has_tag(_da)   fr_radius_attr_flags(_da)->has_tag
#define	fr_radius_flag_long_extended(_da)   fr_radius_attr_flags(_da)->long_extended
#define	FR_RADIUS_PACKET_CODE_VALID(_x)   ((_x > 0) && (_x < FR_RADIUS_CODE_MAX))
#define	FR_TUNNEL_FR_ENC_LENGTH(_x)   (2 + 1 + _x + PAD(_x + 1, 16))
#define	RADIUS_AUTH_VECTOR_LENGTH   16
#define	RADIUS_AUTH_VECTOR_OFFSET   4
#define	RADIUS_HEADER_LENGTH   20
#define	RADIUS_MAX_ATTRIBUTES   255
#define	RADIUS_MAX_PACKET_SIZE   4096
#define	RADIUS_MAX_PASS_LENGTH   256
#define	RADIUS_MAX_STRING_LENGTH   253
#define	RADIUS_MAX_TUNNEL_PASSWORD_LENGTH   249
#define	RADIUS_MESSAGE_AUTHENTICATOR_LENGTH   16
#define	RADIUS_VENDORPEC_LUCENT   4846
#define	RADIUS_VENDORPEC_STARENT   8164
#define	RADIUS_VENDORPEC_USR   429

Enumerations
enum	fr_radius_attr_flags_encrypt_t {   RADIUS_FLAG_ENCRYPT_INVALID = -1 ,   RADIUS_FLAG_ENCRYPT_NONE = 0 ,   RADIUS_FLAG_ENCRYPT_USER_PASSWORD = 1 ,   RADIUS_FLAG_ENCRYPT_TUNNEL_PASSWORD = 2 ,   RADIUS_FLAG_ENCRYPT_ASCEND_SECRET = 3 }
enum	fr_radius_limit_proxy_state_t {   FR_RADIUS_LIMIT_PROXY_STATE_NO = 0x00 ,   FR_RADIUS_LIMIT_PROXY_STATE_AUTO = 0x01 ,   FR_RADIUS_LIMIT_PROXY_STATE_YES = 0x02 }
	Control whether Proxy-State is allowed in Access-Requests. More...
enum	fr_radius_require_ma_t {   FR_RADIUS_REQUIRE_MA_NO = 0x00 ,   FR_RADIUS_REQUIRE_MA_AUTO = 0x01 ,   FR_RADIUS_REQUIRE_MA_YES = 0x02 }
	Control whether Message-Authenticator is required in Access-Requests. More...

Functions
void	_fr_packet_log_hex (fr_log_t const *log, fr_packet_t const *packet, char const *file, int line)
ssize_t	fr_packet_encode (fr_packet_t *packet, fr_pair_list_t *list, fr_packet_t const *original, char const *secret))
	Encode a packet. More...
bool	fr_packet_ok (fr_packet_t *packet, uint32_t max_attributes, bool require_message_authenticator, decode_fail_t *reason))
	See if the data pointed to by PTR is a valid RADIUS packet. More...
fr_packet_t *	fr_packet_recv (TALLOC_CTX *ctx, int fd, int flags, uint32_t max_attributes, bool require_message_authenticator)
	Receive UDP client requests, and fill in the basics of a fr_packet_t structure. More...
int	fr_packet_send (fr_packet_t *packet, fr_pair_list_t *list, fr_packet_t const *original, char const *secret))
	Reply to the request. More...
int	fr_packet_sign (fr_packet_t *packet, fr_packet_t const *original, char const *secret))
	Sign a previously encoded packet. More...
int	fr_packet_verify (fr_packet_t *packet, fr_packet_t *original, char const *secret))
	Verify the Request/Response Authenticator (and Message-Authenticator if present) of a packet. More...
int	fr_radius_allow_reply (int code, bool allowed[static FR_RADIUS_CODE_MAX])
ssize_t	fr_radius_ascend_secret (fr_dbuff_t *dbuff, uint8_t const *in, size_t inlen, char const *secret, uint8_t const *vector)
	Do Ascend-Send / Recv-Secret calculation. More...
static fr_radius_attr_flags_t const *	fr_radius_attr_flags (fr_dict_attr_t const *da)
	Return RADIUS-specific flags for a given attribute. More...
ssize_t	fr_radius_decode (TALLOC_CTX *ctx, fr_pair_list_t *out, uint8_t *packet, size_t packet_len, fr_radius_decode_ctx_t *decode_ctx)
ssize_t	fr_radius_decode_abinary (fr_pair_t *vp, uint8_t const *data, size_t data_len)
	Print an Ascend binary filter attribute to a string,. More...
ssize_t	fr_radius_decode_foreign (TALLOC_CTX *ctx, fr_pair_list_t *out, uint8_t const *data, size_t data_len)
ssize_t	fr_radius_decode_pair (TALLOC_CTX *ctx, fr_pair_list_t *list, uint8_t const *data, size_t data_len, fr_radius_decode_ctx_t *packet_ctx)
	Create a "normal" fr_pair_t from the given data. More...
ssize_t	fr_radius_decode_pair_value (TALLOC_CTX *ctx, fr_pair_list_t *list, fr_dict_attr_t const *parent, uint8_t const *data, size_t const attr_len, void *packet_ctx)
	Create any kind of VP from the attribute contents. More...
ssize_t	fr_radius_decode_simple (TALLOC_CTX *ctx, fr_pair_list_t *out, uint8_t *packet, size_t packet_len, uint8_t const *vector, char const *secret))
	Simple wrapper for callers who just need a shared secret. More...
ssize_t	fr_radius_decode_tlv (TALLOC_CTX *ctx, fr_pair_list_t *list, fr_dict_attr_t const *parent, uint8_t const *data, size_t data_len, fr_radius_decode_ctx_t *packet_ctx)
	Convert TLVs to one or more VPs. More...
int	fr_radius_decode_tlv_ok (uint8_t const *data, size_t length, size_t dv_type, size_t dv_length)
	Check if a set of RADIUS formatted TLVs are OK. More...
ssize_t	fr_radius_encode (fr_dbuff_t *dbuff, fr_pair_list_t *vps, fr_radius_encode_ctx_t *packet_ctx)
ssize_t	fr_radius_encode_abinary (fr_pair_t const *vp, fr_dbuff_t *dbuff)
	Encode a string to abinary. More...
ssize_t	fr_radius_encode_foreign (fr_dbuff_t *dbuff, fr_pair_list_t const *list)
ssize_t	fr_radius_encode_pair (fr_dbuff_t *dbuff, fr_dcursor_t *cursor, void *encode_ctx)
	Encode a data structure into a RADIUS attribute. More...
static bool	fr_radius_flag_extended (fr_dict_attr_t const *da)
void	fr_radius_global_free (void)
int	fr_radius_global_init (void)
bool	fr_radius_ok (uint8_t const *packet, size_t *packet_len_p, uint32_t max_attributes, bool require_message_authenticator, decode_fail_t *reason))
	See if the data pointed to by PTR is a valid RADIUS packet. More...
void	fr_radius_packet_header_log (fr_log_t const *log, fr_packet_t *packet, bool received)
void	fr_radius_packet_log (fr_log_t const *log, fr_packet_t *packet, fr_pair_list_t *list, bool received)
ssize_t	fr_radius_recv_header (int sockfd, fr_ipaddr_t *src_ipaddr, uint16_t *src_port, unsigned int *code)
	Basic validation of RADIUS packet header. More...
int	fr_radius_sign (uint8_t *packet, uint8_t const *vector, uint8_t const *secret, size_t secret_len))
	Sign a previously encoded packet. More...
int	fr_radius_verify (uint8_t *packet, uint8_t const *vector, uint8_t const *secret, size_t secret_len, bool require_message_authenticator, bool limit_proxy_state))
	Verify a request / response packet. More...

Variables
fr_table_num_sorted_t const	fr_radius_limit_proxy_state_table []
size_t	fr_radius_limit_proxy_state_table_len
char const *	fr_radius_packet_name [FR_RADIUS_CODE_MAX]
fr_table_num_sorted_t const	fr_radius_request_name_table []
size_t	fr_radius_request_name_table_len
fr_table_num_sorted_t const	fr_radius_require_ma_table []
size_t	fr_radius_require_ma_table_len

---

Data Structure Documentation

fr_radius_attr_flags_t

struct fr_radius_attr_flags_t

Definition at line 152 of file radius.h.

Data Fields
unsigned int	abinary: 1	Attribute is in "abinary" format.
unsigned int	concat: 1	Attribute is concatenated.
fr_radius_attr_flags_encrypt_t	encrypt	Attribute is encrypted.
unsigned int	extended: 1	Attribute is an extended attribute.
unsigned int	has_tag: 1	Attribute has a tag.
unsigned int	long_extended: 1	Attribute is a long extended attribute.

fr_radius_ctx_t

struct fr_radius_ctx_t

Definition at line 94 of file radius.h.

Data Fields
uint32_t	proxy_state	if so, this is its value
char const *	secret
size_t	secret_length
bool	secure_transport	for TLS

fr_radius_decode_ctx_t

struct fr_radius_decode_ctx_t

Definition at line 124 of file radius.h.

Collaboration diagram for fr_radius_decode_ctx_t:

Data Fields
fr_radius_ctx_t const *	common
uint8_t const *	end	end of the packet
bool	limit_proxy_state	Don't allow Proxy-State in requests.
uint8_t const *	request_authenticator
uint8_t	request_code	original code for the request.
bool	require_message_authenticator
fr_pair_list_t *	tag_root	Where to insert tag attributes.
TALLOC_CTX *	tag_root_ctx	Where to allocate new tag attributes.
fr_radius_tag_ctx_t **	tags	for decoding tagged attributes
TALLOC_CTX *	tmp_ctx	for temporary things cleaned up during decoding
bool	tunnel_password_zeros	check for trailing zeros on decode
bool	verify	can skip verify for dynamic clients

fr_radius_encode_ctx_t

struct fr_radius_encode_ctx_t

Definition at line 103 of file radius.h.

Collaboration diagram for fr_radius_encode_ctx_t:

Data Fields
bool	add_proxy_state	do we add a Proxy-State?
uint8_t	code
fr_radius_ctx_t const *	common
bool	disallow_tunnel_passwords	not all packets can have tunnel passwords
uint8_t	id
fr_fast_rand_t	rand_ctx	for tunnel passwords
uint8_t const *	request_authenticator
uint8_t	request_code
int	salt_offset	for tunnel passwords
bool	seen_message_authenticator
uint8_t	tag	current tag for encoding

fr_radius_tag_ctx_t

struct fr_radius_tag_ctx_t

Definition at line 89 of file radius.h.

Collaboration diagram for fr_radius_tag_ctx_t:

Data Fields
fr_dcursor_t	cursor
fr_pair_t *	parent

Macro Definition Documentation

AUTH_PASS_LEN

#define AUTH_PASS_LEN   (RADIUS_AUTH_VECTOR_LENGTH)

Definition at line 54 of file radius.h.

fr_packet_log_hex

#define fr_packet_log_hex	(		_log,
			_packet
	)		_fr_packet_log_hex(_log, _packet, __FILE__, __LINE__)

Definition at line 248 of file radius.h.

fr_radius_flag_abinary

#define fr_radius_flag_abinary

(

_da

)

fr_radius_attr_flags(_da)->abinary

Definition at line 171 of file radius.h.

fr_radius_flag_concat

#define fr_radius_flag_concat

(

_da

)

fr_radius_attr_flags(_da)->concat

Definition at line 170 of file radius.h.

fr_radius_flag_encrypted

#define fr_radius_flag_encrypted

(

_da

)

fr_radius_attr_flags(_da)->encrypt

Definition at line 172 of file radius.h.

fr_radius_flag_has_tag

#define fr_radius_flag_has_tag

(

_da

)

fr_radius_attr_flags(_da)->has_tag

Definition at line 169 of file radius.h.

fr_radius_flag_long_extended

#define fr_radius_flag_long_extended

(

_da

)

fr_radius_attr_flags(_da)->long_extended

Definition at line 181 of file radius.h.

FR_RADIUS_PACKET_CODE_VALID

#define FR_RADIUS_PACKET_CODE_VALID

(

_x

)

((_x > 0) && (_x < FR_RADIUS_CODE_MAX))

Definition at line 52 of file radius.h.

FR_TUNNEL_FR_ENC_LENGTH

#define FR_TUNNEL_FR_ENC_LENGTH

(

_x

)

(2 + 1 + _x + PAD(_x + 1, 16))

Definition at line 56 of file radius.h.

RADIUS_AUTH_VECTOR_LENGTH

#define RADIUS_AUTH_VECTOR_LENGTH   16

Definition at line 37 of file radius.h.

RADIUS_AUTH_VECTOR_OFFSET

#define RADIUS_AUTH_VECTOR_OFFSET   4

Definition at line 33 of file radius.h.

RADIUS_HEADER_LENGTH

#define RADIUS_HEADER_LENGTH   20

Definition at line 34 of file radius.h.

RADIUS_MAX_ATTRIBUTES

#define RADIUS_MAX_ATTRIBUTES   255

Definition at line 40 of file radius.h.

RADIUS_MAX_PACKET_SIZE

#define RADIUS_MAX_PACKET_SIZE   4096

Definition at line 41 of file radius.h.

RADIUS_MAX_PASS_LENGTH

#define RADIUS_MAX_PASS_LENGTH   256

Definition at line 39 of file radius.h.

RADIUS_MAX_STRING_LENGTH

#define RADIUS_MAX_STRING_LENGTH   253

Definition at line 35 of file radius.h.

RADIUS_MAX_TUNNEL_PASSWORD_LENGTH

#define RADIUS_MAX_TUNNEL_PASSWORD_LENGTH   249

Definition at line 36 of file radius.h.

RADIUS_MESSAGE_AUTHENTICATOR_LENGTH

#define RADIUS_MESSAGE_AUTHENTICATOR_LENGTH   16

Definition at line 38 of file radius.h.

RADIUS_VENDORPEC_LUCENT

#define RADIUS_VENDORPEC_LUCENT   4846

Definition at line 44 of file radius.h.

RADIUS_VENDORPEC_STARENT

#define RADIUS_VENDORPEC_STARENT   8164

Definition at line 45 of file radius.h.

RADIUS_VENDORPEC_USR

#define RADIUS_VENDORPEC_USR   429

Definition at line 43 of file radius.h.

Enumeration Type Documentation

fr_radius_attr_flags_encrypt_t

enum fr_radius_attr_flags_encrypt_t

Enumerator
RADIUS_FLAG_ENCRYPT_INVALID	Invalid encryption flag.
RADIUS_FLAG_ENCRYPT_NONE	No encryption.
RADIUS_FLAG_ENCRYPT_USER_PASSWORD	Encrypt attribute RFC 2865 style.
RADIUS_FLAG_ENCRYPT_TUNNEL_PASSWORD	Encrypt attribute RFC 2868 style.
RADIUS_FLAG_ENCRYPT_ASCEND_SECRET	Encrypt attribute ascend style.

Definition at line 144 of file radius.h.

fr_radius_limit_proxy_state_t

enum fr_radius_limit_proxy_state_t

Control whether Proxy-State is allowed in Access-Requests.

Note

Don't change the enum values. They allow efficient bistmasking.

Enumerator
FR_RADIUS_LIMIT_PROXY_STATE_NO	Do not limit Proxy-State. Allow proxy-state to be sent in all packets.
FR_RADIUS_LIMIT_PROXY_STATE_AUTO	Do not allow Proxy-State unless: All packets received from a client have containted proxy state. The client has sent a packet with a Message-Authenticator. Note This isn't used by the radius protocol code, but may be used to drive logic in modules.
FR_RADIUS_LIMIT_PROXY_STATE_YES	Limit Proxy-State. Do not allow Proxy-State to be sent in packets which do not have a Message-Authenticator attribute.

Definition at line 76 of file radius.h.

fr_radius_require_ma_t

enum fr_radius_require_ma_t

Control whether Message-Authenticator is required in Access-Requests.

Note

Don't change the enum values. They allow efficient bistmasking.

Enumerator
FR_RADIUS_REQUIRE_MA_NO	Do not require Message-Authenticator.
FR_RADIUS_REQUIRE_MA_AUTO	Only require Message-Authenticator if we've previously received a packet from this client with Message-Authenticator. Note This isn't used by the radius protocol code, but may be used to drive logic in modules.
FR_RADIUS_REQUIRE_MA_YES	Require Message-Authenticator.

Definition at line 62 of file radius.h.

Function Documentation

_fr_packet_log_hex()

void _fr_packet_log_hex	(	fr_log_t const *	log,
		fr_packet_t const *	packet,
		char const *	file,
		int	line
	)

Definition at line 349 of file packet.c.

Here is the call graph for this function:

fr_packet_encode()

ssize_t fr_packet_encode	(	fr_packet_t *	packet,
		fr_pair_list_t *	list,
		fr_packet_t const *	original,
		char const *	secret
	)

Encode a packet.

Definition at line 52 of file packet.c.

Here is the call graph for this function:

Here is the caller graph for this function:

fr_packet_ok()

bool fr_packet_ok	(	fr_packet_t *	packet,
		uint32_t	max_attributes,
		bool	require_message_authenticator,
		decode_fail_t *	reason
	)

See if the data pointed to by PTR is a valid RADIUS packet.

Packet is not 'const * const' because we may update data_len, if there's more data in the UDP packet than in the RADIUS packet.

Parameters

[in]	packet	to check.
[in]	max_attributes	to decode.
[in]	require_message_authenticator	to require Message-Authenticator.
[out]	reason	if not NULL, will have the failure reason written to where it points.

Returns

• True on success.
• False on failure.

Definition at line 119 of file packet.c.

Here is the call graph for this function:

Here is the caller graph for this function:

fr_packet_recv()

fr_packet_t* fr_packet_recv	(	TALLOC_CTX *	ctx,
		int	fd,
		int	flags,
		uint32_t	max_attributes,
		bool	require_message_authenticator
	)

Receive UDP client requests, and fill in the basics of a fr_packet_t structure.

Definition at line 205 of file packet.c.

Here is the call graph for this function:

Here is the caller graph for this function:

fr_packet_send()

int fr_packet_send	(	fr_packet_t *	packet,
		fr_pair_list_t *	list,
		fr_packet_t const *	original,
		char const *	secret
	)

Reply to the request.

Also attach reply attribute value pairs and any user message provided.

Definition at line 291 of file packet.c.

Here is the call graph for this function:

Here is the caller graph for this function:

fr_packet_sign()

int fr_packet_sign	(	fr_packet_t *	packet,
		fr_packet_t const *	original,
		char const *	secret
	)

Sign a previously encoded packet.

Definition at line 164 of file packet.c.

Here is the call graph for this function:

Here is the caller graph for this function:

fr_packet_verify()

int fr_packet_verify	(	fr_packet_t *	packet,
		fr_packet_t *	original,
		char const *	secret
	)

Verify the Request/Response Authenticator (and Message-Authenticator if present) of a packet.

Definition at line 143 of file packet.c.

Here is the call graph for this function:

Here is the caller graph for this function:

fr_radius_allow_reply()

int fr_radius_allow_reply	(	int	code,
		bool	allowed[static FR_RADIUS_CODE_MAX]
	)

Definition at line 227 of file base.c.

Here is the caller graph for this function:

fr_radius_ascend_secret()

ssize_t fr_radius_ascend_secret	(	fr_dbuff_t *	dbuff,
		uint8_t const *	in,
		size_t	inlen,
		char const *	secret,
		uint8_t const *	vector
	)

Do Ascend-Send / Recv-Secret calculation.

The secret is hidden by xoring with a MD5 digest created from the RADIUS shared secret and the authentication vector. We put them into MD5 in the reverse order from that used when encrypting passwords to RADIUS.

Definition at line 247 of file base.c.

Here is the call graph for this function:

Here is the caller graph for this function:

fr_radius_attr_flags()

static fr_radius_attr_flags_t const* fr_radius_attr_flags ( fr_dict_attr_t const *  da )

inlinestatic

Return RADIUS-specific flags for a given attribute.

Definition at line 164 of file radius.h.

Here is the call graph for this function:

Here is the caller graph for this function:

fr_radius_decode()

ssize_t fr_radius_decode	(	TALLOC_CTX *	ctx,
		fr_pair_list_t *	out,
		uint8_t *	packet,
		size_t	packet_len,
		fr_radius_decode_ctx_t *	decode_ctx
	)

Definition at line 1087 of file base.c.

Here is the call graph for this function:

Here is the caller graph for this function:

fr_radius_decode_abinary()

ssize_t fr_radius_decode_abinary	(	fr_pair_t *	vp,
		uint8_t const *	data,
		size_t	data_len
	)

Print an Ascend binary filter attribute to a string,.

Grrr... Ascend makes the server do this work, instead of doing it on the NAS.

Parameters

[in,out]	vp	Where the decoded string will be stored.
[in]	data	binary data to decodee
[in]	data_len	length of the binary data to decodee

Returns

• 0 OK
• <0 on error. VP is untouched.

Definition at line 1322 of file abinary.c.

Here is the call graph for this function:

fr_radius_decode_foreign()

ssize_t fr_radius_decode_foreign	(	TALLOC_CTX *	ctx,
		fr_pair_list_t *	out,
		uint8_t const *	data,
		size_t	data_len
	)

Definition at line 2088 of file decode.c.

Here is the call graph for this function:

fr_radius_decode_pair()

ssize_t fr_radius_decode_pair	(	TALLOC_CTX *	ctx,
		fr_pair_list_t *	list,
		uint8_t const *	data,
		size_t	data_len,
		fr_radius_decode_ctx_t *	packet_ctx
	)

Create a "normal" fr_pair_t from the given data.

Definition at line 1983 of file decode.c.

Here is the call graph for this function:

Here is the caller graph for this function:

fr_radius_decode_pair_value()

ssize_t fr_radius_decode_pair_value	(	TALLOC_CTX *	ctx,
		fr_pair_list_t *	out,
		fr_dict_attr_t const *	parent,
		uint8_t const *	data,
		size_t const	attr_len,
		void *	decode_ctx
	)

Create any kind of VP from the attribute contents.

"length" is AT LEAST the length of this attribute, as we expect the caller to have verified the data with fr_packet_ok(). "length" may be up to the length of the packet.

This function will ONLY return -1 on programmer error or OOM. If there's anything wrong with the attribute, it will ALWAYS create a "raw" attribute.

Returns

• Length on success.
• -1 on failure.

Definition at line 1475 of file decode.c.

Here is the call graph for this function:

Here is the caller graph for this function:

fr_radius_decode_simple()

ssize_t fr_radius_decode_simple	(	TALLOC_CTX *	ctx,
		fr_pair_list_t *	out,
		uint8_t *	packet,
		size_t	packet_len,
		uint8_t const *	vector,
		char const *	secret
	)

Simple wrapper for callers who just need a shared secret.

Definition at line 1195 of file base.c.

Here is the call graph for this function:

Here is the caller graph for this function:

fr_radius_decode_tlv()

ssize_t fr_radius_decode_tlv	(	TALLOC_CTX *	ctx,
		fr_pair_list_t *	list,
		fr_dict_attr_t const *	parent,
		uint8_t const *	data,
		size_t	data_len,
		fr_radius_decode_ctx_t *	packet_ctx
	)

Convert TLVs to one or more VPs.

Definition at line 647 of file decode.c.

Here is the call graph for this function:

Here is the caller graph for this function:

fr_radius_decode_tlv_ok()

int fr_radius_decode_tlv_ok	(	uint8_t const *	data,
		size_t	length,
		size_t	dv_type,
		size_t	dv_length
	)

Check if a set of RADIUS formatted TLVs are OK.

Definition at line 250 of file decode.c.

Here is the caller graph for this function:

fr_radius_encode()

ssize_t fr_radius_encode	(	fr_dbuff_t *	dbuff,
		fr_pair_list_t *	vps,
		fr_radius_encode_ctx_t *	packet_ctx
	)

Definition at line 952 of file base.c.

Here is the call graph for this function:

Here is the caller graph for this function:

fr_radius_encode_abinary()

ssize_t fr_radius_encode_abinary	(	fr_pair_t const *	vp,
		fr_dbuff_t *	dbuff
	)

Encode a string to abinary.

This routine will call routines to parse entries from an ASCII format to a binary format recognized by the Ascend boxes.

Parameters

vp	VP to encode
dbuff	where to write the VP data

Returns

• >0 on success == size of the data encoded
• <=0 on failure, which is the size needed to encode the data

Definition at line 1198 of file abinary.c.

Here is the call graph for this function:

Here is the caller graph for this function:

fr_radius_encode_foreign()

ssize_t fr_radius_encode_foreign	(	fr_dbuff_t *	dbuff,
		fr_pair_list_t const *	list
	)

Definition at line 1682 of file encode.c.

Here is the call graph for this function:

fr_radius_encode_pair()

ssize_t fr_radius_encode_pair	(	fr_dbuff_t *	dbuff,
		fr_dcursor_t *	cursor,
		void *	encode_ctx
	)

Encode a data structure into a RADIUS attribute.

This is the main entry point into the encoder. It sets up the encoder array we use for tracking our TLV/VSA nesting and then calls the appropriate dispatch function.

Parameters

[out]	dbuff	Where to write encoded data.
[in]	cursor	Specifying attribute to encode.
[in]	encode_ctx	Additional data such as the shared secret to use.

Returns

• >0 The number of bytes written to out.
• 0 Nothing to encode (or attribute skipped).
• <0 an error occurred.

Definition at line 1517 of file encode.c.

Here is the call graph for this function:

Here is the caller graph for this function:

fr_radius_flag_extended()

static bool fr_radius_flag_extended ( fr_dict_attr_t const *  da )

static

Definition at line 174 of file radius.h.

Here is the call graph for this function:

Here is the caller graph for this function:

fr_radius_global_free()

void fr_radius_global_free

(

void

)

Definition at line 1240 of file base.c.

Here is the caller graph for this function:

fr_radius_global_init()

int fr_radius_global_init

(

void

)

Definition at line 1217 of file base.c.

Here is the call graph for this function:

Here is the caller graph for this function:

fr_radius_ok()

bool fr_radius_ok	(	uint8_t const *	packet,
		size_t *	packet_len_p,
		uint32_t	max_attributes,
		bool	require_message_authenticator,
		decode_fail_t *	reason
	)

See if the data pointed to by PTR is a valid RADIUS packet.

Parameters

[in]	packet	to check.
[in,out]	packet_len_p	The size of the packet data.
[in]	max_attributes	to allow in the packet.
[in]	require_message_authenticator	whether we require Message-Authenticator.
[in]	reason	if not NULL, will have the failure reason written to where it points.

Returns

• True on success.
• False on failure.

Definition at line 259 of file merged_model.c.

Here is the call graph for this function:

Here is the caller graph for this function:

fr_radius_packet_header_log()

void fr_radius_packet_header_log	(	fr_log_t const *	log,
		fr_packet_t *	packet,
		bool	received
	)

Definition at line 420 of file packet.c.

Here is the call graph for this function:

Here is the caller graph for this function:

fr_radius_packet_log()

void fr_radius_packet_log	(	fr_log_t const *	log,
		fr_packet_t *	packet,
		fr_pair_list_t *	list,
		bool	received
	)

Definition at line 491 of file packet.c.

Here is the call graph for this function:

Here is the caller graph for this function:

fr_radius_recv_header()

ssize_t fr_radius_recv_header	(	int	sockfd,
		fr_ipaddr_t *	src_ipaddr,
		uint16_t *	src_port,
		unsigned int *	code
	)

Basic validation of RADIUS packet header.

Note

fr_strerror errors are only available if fr_debug_lvl > 0. This is to reduce CPU time consumed when discarding malformed packet.

Parameters

[in]	sockfd	we're reading from.
[out]	src_ipaddr	of the packet.
[out]	src_port	of the packet.
[out]	code	Pointer to where to write the packet code.

Returns

• -1 on failure.
• 1 on decode error.
• >= RADIUS_HEADER_LENGTH on success. This is the packet length as specified in the header.

Definition at line 285 of file base.c.

Here is the call graph for this function:

Here is the caller graph for this function:

fr_radius_sign()

int fr_radius_sign	(	uint8_t *	packet,
		uint8_t const *	vector,
		uint8_t const *	secret,
		size_t	secret_len
	)

Sign a previously encoded packet.

Calculates the request/response authenticator for packets which need it, and fills in the message-authenticator value if the attribute is present in the encoded packet.

Parameters

[in,out]	packet	(request or response).
[in]	vector	original packet vector to use
[in]	secret	to sign the packet with.
[in]	secret_len	The length of the secret.

Returns

• <0 on error
• 0 on success

Definition at line 358 of file base.c.

Here is the call graph for this function:

Here is the caller graph for this function:

fr_radius_verify()

int fr_radius_verify	(	uint8_t *	packet,
		uint8_t const *	vector,
		uint8_t const *	secret,
		size_t	secret_len,
		bool	require_message_authenticator,
		bool	limit_proxy_state
	)

Verify a request / response packet.

This function does its work by calling fr_radius_sign(), and then comparing the signature in the packet with the one we calculated. If they differ, there's a problem.

Parameters

[in]	packet	the raw RADIUS packet (request or response)
[in]	vector	the original packet vector
[in]	secret	the shared secret
[in]	secret_len	the length of the secret
[in]	require_message_authenticator	whether we require Message-Authenticator.
[in]	limit_proxy_state	whether we allow Proxy-State without Message-Authenticator.

Returns

• -2 if the message authenticator or request authenticator was invalid.
• -1 if we were unable to verify the shared secret, or the packet was in some other way malformed.
• 0 on success.

Definition at line 777 of file base.c.

Here is the call graph for this function:

Here is the caller graph for this function:

Variable Documentation

fr_radius_limit_proxy_state_table

fr_table_num_sorted_t const fr_radius_limit_proxy_state_table[]

extern

Definition at line 92 of file base.c.

fr_radius_limit_proxy_state_table_len

size_t fr_radius_limit_proxy_state_table_len

extern

Definition at line 99 of file base.c.

fr_radius_packet_name

char const* fr_radius_packet_name[FR_RADIUS_CODE_MAX]

extern

Definition at line 112 of file base.c.

fr_radius_request_name_table

fr_table_num_sorted_t const fr_radius_request_name_table[]

extern

Definition at line 101 of file base.c.

fr_radius_request_name_table_len

size_t fr_radius_request_name_table_len

extern

Definition at line 110 of file base.c.

fr_radius_require_ma_table

fr_table_num_sorted_t const fr_radius_require_ma_table[]

extern

Definition at line 83 of file base.c.

fr_radius_require_ma_table_len

size_t fr_radius_require_ma_table_len

extern

Definition at line 90 of file base.c.