 |
The FreeRADIUS server
$Id: 15bac2a4c627c01d1aa2047687b3418955ac7f00 $
|
|
The FreeRADIUS server
$Id: 15bac2a4c627c01d1aa2047687b3418955ac7f00 $
|
#include <freeradius-devel/util/dbuff.h>#include <freeradius-devel/protocol/tacacs/freeradius.internal.h>#include <freeradius-devel/protocol/tacacs/dictionary.h>
Include dependency graph for tacacs.h: This graph shows which files directly or indirectly include this file:Go to the source code of this file.
Data Structures | |
| struct | fr_tacacs_ctx_t |
| Used as the decoder ctx. More... | |
| struct | fr_tacacs_packet_acct_reply_hdr_t |
| struct | fr_tacacs_packet_acct_req_hdr_t |
| struct | fr_tacacs_packet_authen_cont_hdr_t |
| struct | fr_tacacs_packet_authen_reply_hdr_t |
| struct | fr_tacacs_packet_authen_start_hdr_t |
| struct | fr_tacacs_packet_author_reply_hdr_t |
| struct | fr_tacacs_packet_author_req_hdr_t |
| struct | fr_tacacs_packet_hdr_t |
| union | fr_tacacs_packet_hdr_t.__unnamed186__ |
| struct | fr_tacacs_packet_hdr_t.__unnamed186__.ver |
| struct | fr_tacacs_packet_t |
| union | fr_tacacs_packet_t.__unnamed189__ |
Functions | |
| void | _fr_tacacs_packet_log_hex (fr_log_t const *log, fr_tacacs_packet_t const *packet, size_t packet_len, char const *file, int line) |
| int | fr_tacacs_body_xor (fr_tacacs_packet_t const *pkt, uint8_t *body, size_t body_len, char const *secret, size_t secret_len)) |
| XOR the body based on the secret key. More... | |
| int | fr_tacacs_code_to_packet (fr_tacacs_packet_t *pkt, uint32_t code) |
| ssize_t | fr_tacacs_decode (TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dict_attr_t const *vendor, uint8_t const *buffer, size_t buffer_len, UNUSED const uint8_t *original, char const *const secret, size_t secret_len, int *code) |
| ssize_t | fr_tacacs_encode (fr_dbuff_t *dbuff, uint8_t const *original, char const *const secret, size_t secret_len, unsigned int code, fr_pair_list_t *vps) |
| Encode VPS into a raw TACACS packet. More... | |
| void | fr_tacacs_global_free (void) |
| int | fr_tacacs_global_init (void) |
| ssize_t | fr_tacacs_length (uint8_t const *buffer, size_t buffer_len) |
| int | fr_tacacs_packet_to_code (fr_tacacs_packet_t const *pkt) |
Variables | |
| char const * | fr_tacacs_packet_names [FR_TACACS_CODE_MAX] |
| struct fr_tacacs_ctx_t |
Collaboration diagram for fr_tacacs_ctx_t:| Data Fields | ||
|---|---|---|
| fr_dict_attr_t const * | root | |
| char const * | secret | |
| struct fr_tacacs_packet_acct_reply_hdr_t |
| Data Fields | ||
|---|---|---|
| uint16_t | data_len | |
| uint16_t | server_msg_len | |
| fr_tacacs_acct_reply_status_t | status:8 | |
| struct fr_tacacs_packet_acct_req_hdr_t |
| Data Fields | ||
|---|---|---|
| uint8_t | arg_cnt | |
| uint8_t | arg_len[] | |
| fr_tacacs_author_authen_method_t | authen_method:8 | |
| fr_tacacs_authenservice_t | authen_service:8 | |
| fr_tacacs_authentype_t | authen_type:8 | |
| fr_tacacs_acct_req_flags_t | flags:8 | |
| uint8_t | port_len | |
| fr_tacacs_privlvl_t | priv_lvl:8 | |
| uint8_t | rem_addr_len | |
| uint8_t | user_len | |
| struct fr_tacacs_packet_authen_cont_hdr_t |
| Data Fields | ||
|---|---|---|
| uint16_t | data_len | |
| fr_tacacs_authen_cont_flags_t | flags:8 | |
| uint16_t | user_msg_len | |
| struct fr_tacacs_packet_authen_reply_hdr_t |
| Data Fields | ||
|---|---|---|
| uint16_t | data_len | |
| fr_tacacs_authen_reply_flags_t | flags:8 | |
| uint16_t | server_msg_len | |
| fr_tacacs_authen_reply_status_t | status:8 | |
| struct fr_tacacs_packet_authen_start_hdr_t |
| Data Fields | ||
|---|---|---|
| fr_tacacs_action_t | action:8 | |
| fr_tacacs_authenservice_t | authen_service:8 | |
| fr_tacacs_authentype_t | authen_type:8 | |
| uint8_t | data_len | |
| uint8_t | port_len | |
| fr_tacacs_privlvl_t | priv_lvl:8 | |
| uint8_t | rem_addr_len | |
| uint8_t | user_len | |
| struct fr_tacacs_packet_author_reply_hdr_t |
| struct fr_tacacs_packet_author_req_hdr_t |
| Data Fields | ||
|---|---|---|
| uint8_t | arg_cnt | |
| uint8_t | arg_len[] | |
| fr_tacacs_author_authen_method_t | authen_method:8 | |
| fr_tacacs_authenservice_t | authen_service:8 | |
| fr_tacacs_authentype_t | authen_type:8 | |
| uint8_t | port_len | |
| fr_tacacs_privlvl_t | priv_lvl:8 | |
| uint8_t | rem_addr_len | |
| uint8_t | user_len | |
| struct fr_tacacs_packet_hdr_t |
| Data Fields | ||
|---|---|---|
| union fr_tacacs_packet_hdr_t | __unnamed__ | |
| fr_tacacs_flags_t | flags:8 | |
| uint32_t | length | |
| uint8_t | seq_no | |
| uint32_t | session_id | |
| fr_tacacs_type_t | type:8 | |
| union fr_tacacs_packet_hdr_t.__unnamed186__ |
| Data Fields | ||
|---|---|---|
| __unnamed186__ | ver | |
| uint8_t | version | |
| struct fr_tacacs_packet_hdr_t.__unnamed186__.ver |
| struct fr_tacacs_packet_t |
Collaboration diagram for fr_tacacs_packet_t:| Data Fields | ||
|---|---|---|
| union fr_tacacs_packet_t | __unnamed__ | |
| fr_tacacs_packet_hdr_t | hdr | |
| union fr_tacacs_packet_t.__unnamed189__ |
| Data Fields | ||
|---|---|---|
| fr_tacacs_packet_acct_reply_hdr_t | acct_reply | |
| fr_tacacs_packet_acct_req_hdr_t | acct_req | |
| fr_tacacs_packet_authen_cont_hdr_t | authen_cont | |
| fr_tacacs_packet_authen_reply_hdr_t | authen_reply | |
| fr_tacacs_packet_authen_start_hdr_t | authen_start | |
| fr_tacacs_packet_author_reply_hdr_t | author_reply | |
| fr_tacacs_packet_author_req_hdr_t | author_req | |
| #define FR_HEADER_LENGTH sizeof(fr_tacacs_packet_hdr_t) |
| #define FR_TACACS_PACKET_CODE_VALID | ( | _code | ) | (((_code) > 0) && ((_code) < FR_TACACS_CODE_MAX)) |
| #define fr_tacacs_packet_log_hex | ( | _log, | |
| _packet, | |||
| _size | |||
| ) | _fr_tacacs_packet_log_hex(_log, _packet, _size, __FILE__, __LINE__) |
| #define packet_is_acct_reply | ( | p | ) | (((p)->hdr.type == FR_TAC_PLUS_ACCT) && (((p)->hdr.seq_no % 2) == 0)) |
| #define packet_is_acct_request | ( | p | ) | (((p)->hdr.type == FR_TAC_PLUS_ACCT) && (((p)->hdr.seq_no % 2) == 1)) |
| #define packet_is_authen_continue | ( | p | ) | (((p)->hdr.type == FR_TAC_PLUS_AUTHEN) && ((p)->hdr.seq_no > 1) && (((p)->hdr.seq_no % 2) == 1)) |
| #define packet_is_authen_reply | ( | p | ) | (((p)->hdr.type == FR_TAC_PLUS_AUTHEN) && (((p)->hdr.seq_no % 2) == 0)) |
| #define packet_is_authen_start_request | ( | p | ) | (((p)->hdr.type == FR_TAC_PLUS_AUTHEN) && ((p)->hdr.seq_no == 1)) |
3.4.
The TACACS+ Packet Header
seq_no
This is the sequence number of the current packet for the current session. The first packet in a session MUST have the sequence number 1 and each subsequent packet will increment the sequence number by one. Thus clients only send packets containing odd sequence numbers, and TACACS+ servers only send packets containing even sequence numbers.
The sequence number must never wrap i.e. if the sequence number 2^8-1 is ever reached, that session must terminate and be restarted with a sequence number of 1.
| #define packet_is_author_reply | ( | p | ) | (((p)->hdr.type == FR_TAC_PLUS_AUTHOR) && (((p)->hdr.seq_no % 2) == 0)) |
| #define packet_is_author_request | ( | p | ) | (((p)->hdr.type == FR_TAC_PLUS_AUTHOR) && (((p)->hdr.seq_no % 2) == 1)) |
| #define packet_is_encrypted | ( | p | ) | (((p)->hdr.flags & FR_TAC_PLUS_UNENCRYPTED_FLAG) == 0) |
| enum fr_tacacs_action_t |
| enum fr_tacacs_flags_t |
| enum fr_tacacs_privlvl_t |
| enum fr_tacacs_type_t |
| void _fr_tacacs_packet_log_hex | ( | fr_log_t const * | log, |
| fr_tacacs_packet_t const * | packet, | ||
| size_t | packet_len, | ||
| char const * | file, | ||
| int | line | ||
| ) |
| int fr_tacacs_body_xor | ( | fr_tacacs_packet_t const * | pkt, |
| uint8_t * | body, | ||
| size_t | body_len, | ||
| char const * | secret, | ||
| size_t | secret_len | ||
| ) |
| int fr_tacacs_code_to_packet | ( | fr_tacacs_packet_t * | pkt, |
| uint32_t | code | ||
| ) |
| ssize_t fr_tacacs_decode | ( | TALLOC_CTX * | ctx, |
| fr_pair_list_t * | out, | ||
| fr_dict_attr_t const * | vendor, | ||
| uint8_t const * | buffer, | ||
| size_t | buffer_len, | ||
| UNUSED const uint8_t * | original, | ||
| char const *const | secret, | ||
| size_t | secret_len, | ||
| int * | code | ||
| ) |
| ssize_t fr_tacacs_encode | ( | fr_dbuff_t * | dbuff, |
| uint8_t const * | original, | ||
| char const *const | secret, | ||
| size_t | secret_len, | ||
| unsigned int | code, | ||
| fr_pair_list_t * | vps | ||
| ) |
Encode VPS into a raw TACACS packet.
4.1. The Authentication START Packet Body
1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 +-------------—+-------------—+-------------—+-------------—+ | action | priv_lvl | authen_type | authen_service | +-------------—+-------------—+-------------—+-------------—+ | user_len | port_len | rem_addr_len | data_len | +-------------—+-------------—+-------------—+-------------—+ | user ... +-------------—+-------------—+-------------—+-------------—+ | port ... +-------------—+-------------—+-------------—+-------------—+ | rem_addr ... +-------------—+-------------—+-------------—+-------------—+ | data... +-------------—+-------------—+-------------—+-------------—+
6.1. The Account REQUEST Packet Body
1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 +-------------—+-------------—+-------------—+-------------—+ | flags | authen_method | priv_lvl | authen_type | +-------------—+-------------—+-------------—+-------------—+ | authen_service | user_len | port_len | rem_addr_len | +-------------—+-------------—+-------------—+-------------—+ | arg_cnt | arg_1_len | arg_2_len | ... | +-------------—+-------------—+-------------—+-------------—+ | arg_N_len | user ... +-------------—+-------------—+-------------—+-------------—+ | port ... +-------------—+-------------—+-------------—+-------------—+ | rem_addr ... +-------------—+-------------—+-------------—+-------------—+ | arg_1 ... +-------------—+-------------—+-------------—+-------------—+ | arg_2 ... +-------------—+-------------—+-------------—+-------------—+ | ... +-------------—+-------------—+-------------—+-------------—+ | arg_N ... +-------------—+-------------—+-------------—+-------------—+
6.2. The Accounting REPLY Packet Body
1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 +-------------—+-------------—+-------------—+-------------—+ | server_msg len | data_len | +-------------—+-------------—+-------------—+-------------—+ | status | server_msg ... +-------------—+-------------—+-------------—+-------------—+ | data ... +-------------—+
Definition at line 363 of file encode.c.
Here is the call graph for this function: Here is the caller graph for this function:| void fr_tacacs_global_free | ( | void | ) |
| int fr_tacacs_global_init | ( | void | ) |
Return how long a TACACS+ packet is Note that we only look at the 12 byte packet header. We don't (yet) do validation on authentication / authorization / accounting headers. The packet may still be determined later to be invalid.
| buffer | to check |
| buffer_len | length of the buffer |
Definition at line 242 of file base.c.
Here is the call graph for this function: Here is the caller graph for this function:| int fr_tacacs_packet_to_code | ( | fr_tacacs_packet_t const * | pkt | ) |
|
extern |
1.9.1