radius.h

Go to the documentation of this file.

#pragma once
/*
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
 */
 
/*
 * $Id: bead5d6cf7b4b60535611a2c40a5df819d93521b $
 *
 * @file protocols/radius/radius.h
 * @brief Structures and prototypes for base RADIUS functionality.
 *
 * @copyright 1999-2017 The FreeRADIUS server project
 */
#include <freeradius-devel/radius/defs.h>
#include <freeradius-devel/util/packet.h>
#include <freeradius-devel/util/rand.h>
#include <freeradius-devel/util/log.h>
#include <freeradius-devel/util/dbuff.h>
 
#define RADIUS_AUTH_VECTOR_OFFSET               4
#define RADIUS_HEADER_LENGTH                    20
#define RADIUS_MAX_STRING_LENGTH                253
#define RADIUS_MAX_TUNNEL_PASSWORD_LENGTH       249
#define RADIUS_AUTH_VECTOR_LENGTH               16
#define RADIUS_MESSAGE_AUTHENTICATOR_LENGTH     16
#define RADIUS_MAX_PASS_LENGTH                  256
#define RADIUS_MAX_ATTRIBUTES                   255
#define RADIUS_MAX_PACKET_SIZE                  4096
 
#define RADIUS_VENDORPEC_USR                    429
#define RADIUS_VENDORPEC_LUCENT                 4846
#define RADIUS_VENDORPEC_STARENT                8164
 
/*
 *      protocols/radius/base.c
 */
 
extern char const *fr_radius_packet_name[FR_RADIUS_CODE_MAX];
#define FR_RADIUS_PACKET_CODE_VALID(_x) ((_x > 0) && (_x < FR_RADIUS_CODE_MAX))
 
#define AUTH_PASS_LEN (RADIUS_AUTH_VECTOR_LENGTH)
 
#define FR_TUNNEL_FR_ENC_LENGTH(_x) (2 + 1 + _x + PAD(_x + 1, 16))
extern fr_table_num_sorted_t const fr_radius_request_name_table[];
extern size_t fr_radius_request_name_table_len;
 
typedef enum {
        DECODE_FAIL_NONE = 0,
        DECODE_FAIL_MIN_LENGTH_PACKET,
        DECODE_FAIL_MIN_LENGTH_FIELD,
        DECODE_FAIL_MIN_LENGTH_MISMATCH,
        DECODE_FAIL_HEADER_OVERFLOW,
        DECODE_FAIL_UNKNOWN_PACKET_CODE,
        DECODE_FAIL_INVALID_ATTRIBUTE,
        DECODE_FAIL_ATTRIBUTE_TOO_SHORT,
        DECODE_FAIL_ATTRIBUTE_OVERFLOW,
        DECODE_FAIL_MA_INVALID_LENGTH,
        DECODE_FAIL_ATTRIBUTE_UNDERFLOW,
        DECODE_FAIL_TOO_MANY_ATTRIBUTES,
        DECODE_FAIL_MA_MISSING,
        DECODE_FAIL_MA_INVALID,
        DECODE_FAIL_UNKNOWN,
        DECODE_FAIL_MAX
} decode_fail_t;
 
/** subtype values for RADIUS
 *
 *  Order of the flags is important for the flag_foo() checks.
 */
enum {
        FLAG_NONE = 0,                                  //!< No extra flags
        FLAG_EXTENDED_ATTR,                             //!< the attribute is an extended attribute
        FLAG_LONG_EXTENDED_ATTR,                        //!< the attribute is a long extended attribute
        FLAG_CONCAT,                                    //!< the attribute is concatenated
        FLAG_HAS_TAG,                                   //!< the attribute has a tag
        FLAG_ABINARY,                                   //!< the attribute is in "abinary" format
        FLAG_TAGGED_TUNNEL_PASSWORD,                    //!< the attribute has a tag and is encrypted
 
        FLAG_ENCRYPT_USER_PASSWORD,                     //!< Encrypt attribute RFC 2865 style.
        FLAG_ENCRYPT_TUNNEL_PASSWORD,                   //!< Encrypt attribute RFC 2868 style.
        FLAG_ENCRYPT_ASCEND_SECRET,                     //!< Encrypt attribute ascend style.
};
 
 
#define flag_has_tag(_flags)         (!(_flags)->extra && (((_flags)->subtype == FLAG_HAS_TAG) || ((_flags)->subtype == FLAG_TAGGED_TUNNEL_PASSWORD)))
#define flag_concat(_flags)          (!(_flags)->extra && (_flags)->subtype == FLAG_CONCAT)
#define flag_abinary(_flags)         (!(_flags)->extra && (_flags)->subtype == FLAG_ABINARY)
#define flag_encrypted(_flags)       (!(_flags)->extra && (_flags)->subtype >= FLAG_TAGGED_TUNNEL_PASSWORD)
#define flag_extended(_flags)        (!(_flags)->extra && (((_flags)->subtype == FLAG_EXTENDED_ATTR) || (_flags)->subtype == FLAG_LONG_EXTENDED_ATTR))
#define flag_long_extended(_flags)   (!(_flags)->extra && (_flags)->subtype == FLAG_LONG_EXTENDED_ATTR)
#define flag_tunnel_password(_flags) (!(_flags)->extra && (((_flags)->subtype == FLAG_ENCRYPT_TUNNEL_PASSWORD) || ((_flags)->subtype == FLAG_TAGGED_TUNNEL_PASSWORD)))
 
typedef struct {
        fr_pair_t       *parent;
        fr_dcursor_t    cursor;
} fr_radius_tag_ctx_t;
 
typedef struct {
        char const      *secret;
        size_t          secret_length;
 
        bool            add_proxy_state;                //!< do we add a Proxy-State?
        uint64_t        my_proxy_state;                 //!< if so, this is its value
 
        uint32_t        acct_delay_time;                //!< additional time to add to acct_delay_time
 
        uint8_t         vector[RADIUS_AUTH_VECTOR_LENGTH]; //!< vector for authenticating the reply
} fr_radius_ctx_t;
 
typedef struct {
        fr_radius_ctx_t         *common;
 
        uint8_t const           *request_authenticator;
 
        fr_fast_rand_t          rand_ctx;               //!< for tunnel passwords
        int                     salt_offset;            //!< for tunnel passwords
 
        uint8_t                 tag;                    //!< current tag for encoding
 
        bool                    disallow_tunnel_passwords; //!< not all packets can have tunnel passwords
        bool                    seen_message_authenticator;
} fr_radius_encode_ctx_t;
 
typedef struct {
        fr_radius_ctx_t         *common;
 
        uint8_t const           *request_authenticator;
 
        TALLOC_CTX              *tmp_ctx;               //!< for temporary things cleaned up during decoding
        uint8_t const           *end;                   //!< end of the packet
 
        uint8_t                 request_code;           //!< original code for the request.
 
        bool                    tunnel_password_zeros;  //!< check for trailing zeros on decode
        bool                    verify;                 //!< can skip verify for dynamic clients
        bool                    require_message_authenticator;
 
        fr_radius_tag_ctx_t     **tags;                 //!< for decoding tagged attributes
        fr_pair_list_t          *tag_root;              //!< Where to insert tag attributes.
        TALLOC_CTX              *tag_root_ctx;          //!< Where to allocate new tag attributes.
} fr_radius_decode_ctx_t;
 
/*
 *      protocols/radius/base.c
 */
int             fr_radius_allow_reply(int code, bool allowed[static FR_RADIUS_CODE_MAX]);
 
int             fr_radius_sign(uint8_t *packet, uint8_t const *vector,
                               uint8_t const *secret, size_t secret_len) CC_HINT(nonnull (1,3));
int             fr_radius_verify(uint8_t *packet, uint8_t const *vector,
                                 uint8_t const *secret, size_t secret_len, bool require_ma) CC_HINT(nonnull (1,3));
bool            fr_radius_ok(uint8_t const *packet, size_t *packet_len_p,
                             uint32_t max_attributes, bool require_ma, decode_fail_t *reason) CC_HINT(nonnull (1,2));
 
ssize_t         fr_radius_ascend_secret(fr_dbuff_t *dbuff, uint8_t const *in, size_t inlen,
                                        char const *secret, uint8_t const *vector);
 
ssize_t         fr_radius_recv_header(int sockfd, fr_ipaddr_t *src_ipaddr, uint16_t *src_port, unsigned int *code);
 
ssize_t         fr_radius_encode(uint8_t *packet, size_t packet_len, uint8_t const *original,
                                 char const *secret, size_t secret_len, int code, int id, fr_pair_list_t *vps);
 
ssize_t         fr_radius_encode_dbuff(fr_dbuff_t *dbuff, uint8_t const *original,
                                 char const *secret, UNUSED size_t secret_len, int code, int id, fr_pair_list_t *vps);
 
ssize_t         fr_radius_decode(TALLOC_CTX *ctx, fr_pair_list_t *out,
                                 uint8_t *packet, size_t packet_len,
                                 fr_radius_decode_ctx_t *decode_ctx) CC_HINT(nonnull);
 
ssize_t         fr_radius_decode_simple(TALLOC_CTX *ctx, fr_pair_list_t *out,
                                        uint8_t *packet, size_t packet_len,
                                        uint8_t const *vector, char const *secret) CC_HINT(nonnull(1,2,3,6));
 
int             fr_radius_global_init(void);
 
void            fr_radius_global_free(void);
 
/*
 *      protocols/radius/packet.c
 */
ssize_t         fr_packet_encode(fr_packet_t *packet, fr_pair_list_t *list,
                                        fr_packet_t const *original,
                                        char const *secret) CC_HINT(nonnull (1,2,4));
 
bool            fr_packet_ok(fr_packet_t *packet, uint32_t max_attributes, bool require_ma,
                                    decode_fail_t *reason) CC_HINT(nonnull (1));
 
int             fr_packet_verify(fr_packet_t *packet, fr_packet_t *original,
                                        char const *secret) CC_HINT(nonnull (1,3));
int             fr_packet_sign(fr_packet_t *packet, fr_packet_t const *original,
                                      char const *secret) CC_HINT(nonnull (1,3));
 
fr_packet_t     *fr_packet_recv(TALLOC_CTX *ctx, int fd, int flags, uint32_t max_attributes, bool require_ma);
int             fr_packet_send(fr_packet_t *packet, fr_pair_list_t *list,
                                      fr_packet_t const *original, char const *secret) CC_HINT(nonnull (1,2,4));
 
#define fr_packet_log_hex(_log, _packet) _fr_packet_log_hex(_log, _packet, __FILE__, __LINE__)
void            _fr_packet_log_hex(fr_log_t const *log, fr_packet_t const *packet, char const *file, int line) CC_HINT(nonnull);
 
/*
 *      protocols/radius/abinary.c
 */
ssize_t         fr_radius_encode_abinary(fr_pair_t const *vp, fr_dbuff_t *dbuff);
 
ssize_t         fr_radius_decode_abinary(fr_pair_t *vp, uint8_t const *data, size_t data_len);
 
/*
 *      protocols/radius/encode.c
 */
ssize_t         fr_radius_encode_pair(fr_dbuff_t *dbuff, fr_dcursor_t *cursor, void *encode_ctx);
 
ssize_t         fr_radius_encode_foreign(fr_dbuff_t *dbuff, fr_pair_list_t const *list) CC_HINT(nonnull);
 
/*
 *      protocols/radius/decode.c
 */
int             fr_radius_decode_tlv_ok(uint8_t const *data, size_t length, size_t dv_type, size_t dv_length);
 
ssize_t         fr_radius_decode_pair_value(TALLOC_CTX *ctx, fr_pair_list_t *list,
                                            fr_dict_attr_t const *parent,
                                            uint8_t const *data, size_t const attr_len,
                                            void *packet_ctx) CC_HINT(nonnull);
 
ssize_t         fr_radius_decode_tlv(TALLOC_CTX *ctx, fr_pair_list_t *list,
                                     fr_dict_attr_t const *parent,
                                     uint8_t const *data, size_t data_len,
                                     fr_radius_decode_ctx_t *packet_ctx) CC_HINT(nonnull);
 
ssize_t         fr_radius_decode_pair(TALLOC_CTX *ctx, fr_pair_list_t *list,
                                      uint8_t const *data, size_t data_len, fr_radius_decode_ctx_t *packet_ctx) CC_HINT(nonnull);
 
ssize_t         fr_radius_decode_foreign(TALLOC_CTX *ctx, fr_pair_list_t *out,
                                         uint8_t const *data, size_t data_len) CC_HINT(nonnull);
 
void            fr_radius_packet_header_log(fr_log_t const *log, fr_packet_t *packet, bool received);
 
void            fr_radius_packet_log(fr_log_t const *log, fr_packet_t *packet, fr_pair_list_t *list, bool received);