X-Git-Url: http://git.sameswireless.fr/l2tpns.git/blobdiff_plain/221182576053ee2e83dc23bc3dd21c696ae6d911..d1789f28d01f55dd54ec9b9fcd217cd6a52c99bd:/radius.c diff --git a/radius.c b/radius.c index 1aa9d62..a2b2339 100644 --- a/radius.c +++ b/radius.c @@ -1,6 +1,6 @@ // L2TPNS Radius Stuff -char const *cvs_id_radius = "$Id: radius.c,v 1.39 2005/08/10 11:25:56 bodea Exp $"; +char const *cvs_id_radius = "$Id: radius.c,v 1.45 2005/10/19 03:09:30 bodea Exp $"; #include #include @@ -13,7 +13,7 @@ char const *cvs_id_radius = "$Id: radius.c,v 1.39 2005/08/10 11:25:56 bodea Exp #include #include #include -#include +#include "md5.h" #include "constants.h" #include "l2tpns.h" #include "plugin.h" @@ -27,6 +27,20 @@ extern configt *config; extern int *radfds; extern ip_filtert *ip_filters; +static const hasht zero; + +static void calc_auth(const void *buf, size_t len, const uint8_t *in, uint8_t *out) +{ + MD5_CTX ctx; + + MD5_Init(&ctx); + MD5_Update(&ctx, (void *)buf, 4); // code, id, length + MD5_Update(&ctx, (void *)in, 16); // auth + MD5_Update(&ctx, (void *)(buf + 20), len - 20); + MD5_Update(&ctx, config->radiussecret, strlen(config->radiussecret)); + MD5_Final(out, &ctx); +} + // Set up socket for radius requests void initrad(void) { @@ -290,18 +304,11 @@ void radiussend(uint16_t r, uint8_t state) p[1] = 6; *(uint32_t *) (p + 2) = htonl(session[s].cout_wrap); p += p[1]; - } - if (session[s].snoop_ip && session[s].snoop_port) - { - *p = 26; // vendor-specific - *(uint32_t *) (p + 2) = htonl(9); // Cisco - p[6] = 1; // Cisco-AVPair - p[7] = 2 + sprintf((char *) p + 8, "intercept=%s:%d", - fmtaddr(session[s].snoop_ip, 0), session[s].snoop_port); - - p[1] = p[7] + 6; - p += p[1]; + { + struct param_radius_account acct = { &tunnel[session[s].tunnel], &session[s], &p }; + run_plugins(PLUGIN_RADIUS_ACCOUNT, &acct); + } } } } @@ -319,6 +326,30 @@ void radiussend(uint16_t r, uint8_t state) *(uint32_t *) (p + 2) = htonl(session[s].ip); p += p[1]; } + if (s && session[s].route[0].ip) + { + int r; + for (r = 0; s && r < MAXROUTE && session[s].route[r].ip; r++) + { + int width = 32; + if (session[s].route[r].mask) + { + int mask = session[s].route[r].mask; + while (!(mask & 1)) + { + width--; + mask >>= 1; + } + } + + *p = 22; // Framed-Route + p[1] = sprintf((char *) p + 2, "%s/%d %s 1", + fmtaddr(htonl(session[s].route[r].ip), 0), + width, fmtaddr(htonl(session[s].ip), 1)) + 2; + + p += p[1]; + } + } if (*session[s].called) { *p = 30; // called @@ -326,7 +357,7 @@ void radiussend(uint16_t r, uint8_t state) strcpy((char *) p + 2, session[s].called); p += p[1]; } - else if (*session[s].calling) + if (*session[s].calling) { *p = 31; // calling p[1] = strlen(session[s].calling) + 2; @@ -343,18 +374,9 @@ void radiussend(uint16_t r, uint8_t state) *(uint16_t *) (b + 2) = htons(p - b); if (state != RADIUSAUTH) { - // Build auth for accounting packet - uint8_t z[16] = {0}; - uint8_t hash[16] = {0}; - MD5_CTX ctx; - MD5_Init(&ctx); - MD5_Update(&ctx, b, 4); - MD5_Update(&ctx, z, 16); - MD5_Update(&ctx, b + 20, (p - b) - 20); - MD5_Update(&ctx, config->radiussecret, strlen(config->radiussecret)); - MD5_Final(hash, &ctx); - memcpy(b + 4, hash, 16); - memcpy(radius[r].auth, hash, 16); + // Build auth for accounting packet + calc_auth(b, p - b, zero, b + 4); + memcpy(radius[r].auth, b + 4, 16); } memset(&addr, 0, sizeof(addr)); addr.sin_family = AF_INET; @@ -414,8 +436,7 @@ static void handle_avpair(sessionidt s, uint8_t *avp, int len) // process RADIUS response void processrad(uint8_t *buf, int len, char socket_index) { - uint8_t b[MAXCONTROL]; - MD5_CTX ctx; + uint8_t b[MAXETHER]; uint16_t r; sessionidt s; tunnelidt t = 0; @@ -454,12 +475,7 @@ void processrad(uint8_t *buf, int len, char socket_index) return; } t = session[s].tunnel; - MD5_Init(&ctx); - MD5_Update(&ctx, buf, 4); - MD5_Update(&ctx, radius[r].auth, 16); - MD5_Update(&ctx, buf + 20, len - 20); - MD5_Update(&ctx, config->radiussecret, strlen(config->radiussecret)); - MD5_Final(hash, &ctx); + calc_auth(buf, len, radius[r].auth, hash); do { if (memcmp(hash, buf + 4, 16)) { @@ -762,8 +778,8 @@ extern int daefd; void processdae(uint8_t *buf, int len, struct sockaddr_in *addr, int alen) { int i, r_code, r_id, length, attribute_length; - uint8_t vector[16], hash[16], *packet, attribute; - MD5_CTX ctx; + uint8_t *packet, attribute; + hasht hash; char username[MAXUSER] = ""; in_addr_t nas = 0; in_addr_t ip = 0; @@ -808,17 +824,8 @@ void processdae(uint8_t *buf, int len, struct sockaddr_in *addr, int alen) LOG(3, 0, 0, "Received DAE %s, id %d\n", radius_code(r_code), r_id); // check authenticator - memcpy(vector, buf + 4, 16); - memset(buf + 4, 0, 16); - - i = strlen(config->radiussecret); - if (i > 16) i = 16; - - MD5_Init(&ctx); - MD5_Update(&ctx, buf, len); - MD5_Update(&ctx, config->radiussecret, i); - MD5_Final(hash, &ctx); - if (memcmp(hash, vector, 16) != 0) + calc_auth(buf, len, zero, hash); + if (memcmp(hash, buf + 4, 16) != 0) { LOG(1, 0, 0, "Incorrect vector in DAE request (wrong secret in radius config?)\n"); return; @@ -1024,10 +1031,9 @@ void processdae(uint8_t *buf, int len, struct sockaddr_in *addr, int alen) packet = buf; *packet++ = r_code; *packet++ = r_id; - packet += 2; - memset(packet, 0, 16); - packet += 16; - len = 20; + // skip len + auth + packet += 2 + 16; + len = packet - buf; // add attributes if (error) @@ -1042,14 +1048,7 @@ void processdae(uint8_t *buf, int len, struct sockaddr_in *addr, int alen) *((uint16_t *)(buf + 2)) = htons(len); // make vector - i = strlen(config->radiussecret); - if (i > 16) i = 16; - - MD5_Init(&ctx); - MD5_Update(&ctx, buf, len); - MD5_Update(&ctx, config->radiussecret, i); - MD5_Final(hash, &ctx); - memcpy(buf + 4, hash, 16); + calc_auth(buf, len, hash, buf + 4); LOG(3, 0, 0, "Sending DAE %s, id=%d\n", radius_code(r_code), r_id);