src/libcharon/plugins/eap_radius/eap_radius.c

   1 /*
   2  * Copyright (C) 2009 Martin Willi
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include "eap_radius.h"
  17 #include "eap_radius_forward.h"
  18
  19 #include "radius_message.h"
  20 #include "radius_client.h"
  21
  22 #include <daemon.h>
  23
  24 #define TUNNEL_TYPE_ESP         9
  25
  26 typedef struct private_eap_radius_t private_eap_radius_t;
  27
  28 /**
  29  * Private data of an eap_radius_t object.
  30  */
  31 struct private_eap_radius_t {
  32
  33         /**
  34          * Public authenticator_t interface.
  35          */
  36         eap_radius_t public;
  37
  38         /**
  39          * ID of the server
  40          */
  41         identification_t *server;
  42
  43         /**
  44          * ID of the peer
  45          */
  46         identification_t *peer;
  47
  48         /**
  49          * EAP method type we are proxying
  50          */
  51         eap_type_t type;
  52
  53         /**
  54          * EAP vendor, if any
  55          */
  56         u_int32_t vendor;
  57
  58         /**
  59          * EAP message identifier
  60          */
  61         u_int8_t identifier;
  62
  63         /**
  64          * RADIUS client instance
  65          */
  66         radius_client_t *client;
  67
  68         /**
  69          * TRUE to use EAP-Start, FALSE to send EAP-Identity Response directly
  70          */
  71         bool eap_start;
  72
  73         /**
  74          * Prefix to prepend to EAP identity
  75          */
  76         char *id_prefix;
  77
  78         /**
  79          * Handle the Class attribute as group membership information?
  80          */
  81         bool class_group;
  82
  83         /**
  84          * Handle the Filter-Id attribute as IPsec CHILD_SA name?
  85          */
  86         bool filter_id;
  87 };
  88
  89 /**
  90  * Add EAP-Identity to RADIUS message
  91  */
  92 static void add_eap_identity(private_eap_radius_t *this,
  93                                                          radius_message_t *request)
  94 {
  95         struct {
  96                 /** EAP code (REQUEST/RESPONSE) */
  97                 u_int8_t code;
  98                 /** unique message identifier */
  99                 u_int8_t identifier;
 100                 /** length of whole message */
 101                 u_int16_t length;
 102                 /** EAP type */
 103                 u_int8_t type;
 104                 /** identity data */
 105                 u_int8_t data[];
 106         } __attribute__((__packed__)) *hdr;
 107         chunk_t id, prefix;
 108         size_t len;
 109
 110         id = this->peer->get_encoding(this->peer);
 111         prefix = chunk_create(this->id_prefix, strlen(this->id_prefix));
 112         len = sizeof(*hdr) + prefix.len + id.len;
 113
 114         hdr = alloca(len);
 115         hdr->code = EAP_RESPONSE;
 116         hdr->identifier = this->identifier;
 117         hdr->length = htons(len);
 118         hdr->type = EAP_IDENTITY;
 119         memcpy(hdr->data, prefix.ptr, prefix.len);
 120         memcpy(hdr->data + prefix.len, id.ptr, id.len);
 121
 122         request->add(request, RAT_EAP_MESSAGE, chunk_create((u_char*)hdr, len));
 123 }
 124
 125 /**
 126  * Copy EAP-Message attribute from RADIUS message to an new EAP payload
 127  */
 128 static bool radius2ike(private_eap_radius_t *this,
 129                                            radius_message_t *msg, eap_payload_t **out)
 130 {
 131         enumerator_t *enumerator;
 132         eap_payload_t *payload;
 133         chunk_t data, message = chunk_empty;
 134         int type;
 135
 136         enumerator = msg->create_enumerator(msg);
 137         while (enumerator->enumerate(enumerator, &type, &data))
 138         {
 139                 if (type == RAT_EAP_MESSAGE && data.len)
 140                 {
 141                         message = chunk_cat("mc", message, data);
 142                 }
 143         }
 144         enumerator->destroy(enumerator);
 145         if (message.len)
 146         {
 147                 *out = payload = eap_payload_create_data(message);
 148
 149                 /* apply EAP method selected by RADIUS server */
 150                 this->type = payload->get_type(payload, &this->vendor);
 151
 152                 DBG3(DBG_IKE, "%N payload %B", eap_type_names, this->type, &message);
 153                 free(message.ptr);
 154                 return TRUE;
 155         }
 156         return FALSE;
 157 }
 158
 159 METHOD(eap_method_t, initiate, status_t,
 160         private_eap_radius_t *this, eap_payload_t **out)
 161 {
 162         radius_message_t *request, *response;
 163         status_t status = FAILED;
 164         chunk_t username;
 165
 166         request = radius_message_create(RMC_ACCESS_REQUEST);
 167         username = chunk_create(this->id_prefix, strlen(this->id_prefix));
 168         username = chunk_cata("cc", username, this->peer->get_encoding(this->peer));
 169         request->add(request, RAT_USER_NAME, username);
 170
 171         if (this->eap_start)
 172         {
 173                 request->add(request, RAT_EAP_MESSAGE, chunk_empty);
 174         }
 175         else
 176         {
 177                 add_eap_identity(this, request);
 178         }
 179         eap_radius_forward_from_ike(request);
 180
 181         response = this->client->request(this->client, request);
 182         if (response)
 183         {
 184                 eap_radius_forward_to_ike(response);
 185                 if (radius2ike(this, response, out))
 186                 {
 187                         status = NEED_MORE;
 188                 }
 189                 response->destroy(response);
 190         }
 191         else
 192         {
 193                 charon->bus->alert(charon->bus, ALERT_RADIUS_NOT_RESPONDING);
 194         }
 195         request->destroy(request);
 196         return status;
 197 }
 198
 199 /**
 200  * Handle the Class attribute as group membership information
 201  */
 202 static void process_class(private_eap_radius_t *this, radius_message_t *msg)
 203 {
 204         enumerator_t *enumerator;
 205         chunk_t data;
 206         int type;
 207
 208         enumerator = msg->create_enumerator(msg);
 209         while (enumerator->enumerate(enumerator, &type, &data))
 210         {
 211                 if (type == RAT_CLASS)
 212                 {
 213                         identification_t *id;
 214                         ike_sa_t *ike_sa;
 215                         auth_cfg_t *auth;
 216
 217                         if (data.len >= 44)
 218                         {       /* quirk: ignore long class attributes, these are used for
 219                                  * other purposes by some RADIUS servers (such as NPS). */
 220                                 continue;
 221                         }
 222
 223                         ike_sa = charon->bus->get_sa(charon->bus);
 224                         if (ike_sa)
 225                         {
 226                                 auth = ike_sa->get_auth_cfg(ike_sa, FALSE);
 227                                 id = identification_create_from_data(data);
 228                                 DBG1(DBG_CFG, "received group membership '%Y' from RADIUS", id);
 229                                 auth->add(auth, AUTH_RULE_GROUP, id);
 230                         }
 231                 }
 232         }
 233         enumerator->destroy(enumerator);
 234 }
 235
 236 /**
 237  * Handle the Filter-Id attribute as IPsec CHILD_SA name
 238  */
 239 static void process_filter_id(private_eap_radius_t *this, radius_message_t *msg)
 240 {
 241         enumerator_t *enumerator;
 242         int type;
 243         u_int8_t tunnel_tag;
 244         u_int32_t tunnel_type;
 245         chunk_t filter_id = chunk_empty, data;
 246         bool is_esp_tunnel = FALSE;
 247
 248         enumerator = msg->create_enumerator(msg);
 249         while (enumerator->enumerate(enumerator, &type, &data))
 250         {
 251                 switch (type)
 252                 {
 253                         case RAT_TUNNEL_TYPE:
 254                                 if (data.len != 4)
 255                                 {
 256                                         continue;
 257                                 }
 258                                 tunnel_tag = *data.ptr;
 259                                 *data.ptr = 0x00;
 260                                 tunnel_type = untoh32(data.ptr);
 261                                 DBG1(DBG_IKE, "received RADIUS attribute Tunnel-Type: "
 262                                                           "tag = %u, value = %u", tunnel_tag, tunnel_type);
 263                                 is_esp_tunnel = (tunnel_type == TUNNEL_TYPE_ESP);
 264                                 break;
 265                         case RAT_FILTER_ID:
 266                                 filter_id = data;
 267                                 DBG1(DBG_IKE, "received RADIUS attribute Filter-Id: "
 268                                                           "'%.*s'", filter_id.len, filter_id.ptr);
 269                                 break;
 270                         default:
 271                                 break;
 272                 }
 273         }
 274         enumerator->destroy(enumerator);
 275
 276         if (is_esp_tunnel && filter_id.len)
 277         {
 278                 identification_t *id;
 279                 ike_sa_t *ike_sa;
 280                 auth_cfg_t *auth;
 281
 282                 ike_sa = charon->bus->get_sa(charon->bus);
 283                 if (ike_sa)
 284                 {
 285                         auth = ike_sa->get_auth_cfg(ike_sa, FALSE);
 286                         id = identification_create_from_data(filter_id);
 287                         auth->add(auth, AUTH_RULE_GROUP, id);
 288                 }
 289         }
 290 }
 291
 292 /**
 293  * Handle Session-Timeout attribte
 294  */
 295 static void process_timeout(private_eap_radius_t *this, radius_message_t *msg)
 296 {
 297         enumerator_t *enumerator;
 298         ike_sa_t *ike_sa;
 299         chunk_t data;
 300         int type;
 301
 302         enumerator = msg->create_enumerator(msg);
 303         while (enumerator->enumerate(enumerator, &type, &data))
 304         {
 305                 if (type == RAT_SESSION_TIMEOUT && data.len == 4)
 306                 {
 307                         ike_sa = charon->bus->get_sa(charon->bus);
 308                         if (ike_sa)
 309                         {
 310                                 ike_sa->set_auth_lifetime(ike_sa, untoh32(data.ptr));
 311                         }
 312                 }
 313         }
 314         enumerator->destroy(enumerator);
 315 }
 316
 317 METHOD(eap_method_t, process, status_t,
 318         private_eap_radius_t *this, eap_payload_t *in, eap_payload_t **out)
 319 {
 320         radius_message_t *request, *response;
 321         status_t status = FAILED;
 322         chunk_t data;
 323
 324         request = radius_message_create(RMC_ACCESS_REQUEST);
 325         request->add(request, RAT_USER_NAME, this->peer->get_encoding(this->peer));
 326         data = in->get_data(in);
 327         DBG3(DBG_IKE, "%N payload %B", eap_type_names, this->type, &data);
 328
 329         /* fragment data suitable for RADIUS (not more than 253 bytes) */
 330         while (data.len > 253)
 331         {
 332                 request->add(request, RAT_EAP_MESSAGE, chunk_create(data.ptr, 253));
 333                 data = chunk_skip(data, 253);
 334         }
 335         request->add(request, RAT_EAP_MESSAGE, data);
 336
 337         eap_radius_forward_from_ike(request);
 338         response = this->client->request(this->client, request);
 339         if (response)
 340         {
 341                 eap_radius_forward_to_ike(response);
 342                 switch (response->get_code(response))
 343                 {
 344                         case RMC_ACCESS_CHALLENGE:
 345                                 if (radius2ike(this, response, out))
 346                                 {
 347                                         status = NEED_MORE;
 348                                         break;
 349                                 }
 350                                 status = FAILED;
 351                                 break;
 352                         case RMC_ACCESS_ACCEPT:
 353                                 if (this->class_group)
 354                                 {
 355                                         process_class(this, response);
 356                                 }
 357                                 if (this->filter_id)
 358                                 {
 359                                         process_filter_id(this, response);
 360                                 }
 361                                 process_timeout(this, response);
 362                                 DBG1(DBG_IKE, "RADIUS authentication of '%Y' successful",
 363                                          this->peer);
 364                                 status = SUCCESS;
 365                                 break;
 366                         case RMC_ACCESS_REJECT:
 367                         default:
 368                                 DBG1(DBG_IKE, "RADIUS authentication of '%Y' failed", this->peer);
 369                                 status = FAILED;
 370                                 break;
 371                 }
 372                 response->destroy(response);
 373         }
 374         request->destroy(request);
 375         return status;
 376 }
 377
 378 METHOD(eap_method_t, get_type, eap_type_t,
 379         private_eap_radius_t *this, u_int32_t *vendor)
 380 {
 381         *vendor = this->vendor;
 382         return this->type;
 383 }
 384
 385 METHOD(eap_method_t, get_msk, status_t,
 386         private_eap_radius_t *this, chunk_t *out)
 387 {
 388         chunk_t msk;
 389
 390         msk = this->client->get_msk(this->client);
 391         if (msk.len)
 392         {
 393                 *out = msk;
 394                 return SUCCESS;
 395         }
 396         return FAILED;
 397 }
 398
 399 METHOD(eap_method_t, get_identifier, u_int8_t,
 400         private_eap_radius_t *this)
 401 {
 402         return this->identifier;
 403 }
 404
 405 METHOD(eap_method_t, set_identifier, void,
 406         private_eap_radius_t *this, u_int8_t identifier)
 407 {
 408         this->identifier = identifier;
 409 }
 410
 411 METHOD(eap_method_t, is_mutual, bool,
 412         private_eap_radius_t *this)
 413 {
 414         switch (this->type)
 415         {
 416                 case EAP_AKA:
 417                 case EAP_SIM:
 418                         return TRUE;
 419                 default:
 420                         return FALSE;
 421         }
 422 }
 423
 424 METHOD(eap_method_t, destroy, void,
 425         private_eap_radius_t *this)
 426 {
 427         this->peer->destroy(this->peer);
 428         this->server->destroy(this->server);
 429         this->client->destroy(this->client);
 430         free(this);
 431 }
 432
 433 /**
 434  * Generic constructor
 435  */
 436 eap_radius_t *eap_radius_create(identification_t *server, identification_t *peer)
 437 {
 438         private_eap_radius_t *this;
 439
 440         INIT(this,
 441                 .public = {
 442                         .eap_method = {
 443                                 .initiate = _initiate,
 444                                 .process = _process,
 445                                 .get_type = _get_type,
 446                                 .is_mutual = _is_mutual,
 447                                 .get_msk = _get_msk,
 448                                 .get_identifier = _get_identifier,
 449                                 .set_identifier = _set_identifier,
 450                                 .destroy = _destroy,
 451                         },
 452                 },
 453                 /* initially EAP_RADIUS, but is set to the method selected by RADIUS */
 454                 .type = EAP_RADIUS,
 455                 .eap_start = lib->settings->get_bool(lib->settings,
 456                                                                 "charon.plugins.eap-radius.eap_start", FALSE),
 457                 .id_prefix = lib->settings->get_str(lib->settings,
 458                                                                 "charon.plugins.eap-radius.id_prefix", ""),
 459                 .class_group = lib->settings->get_bool(lib->settings,
 460                                                                 "charon.plugins.eap-radius.class_group", FALSE),
 461                 .filter_id = lib->settings->get_bool(lib->settings,
 462                                                                 "charon.plugins.eap-radius.filter_id", FALSE),
 463
 464         );
 465         this->client = radius_client_create();
 466         if (!this->client)
 467         {
 468                 free(this);
 469                 return NULL;
 470         }
 471         this->peer = peer->clone(peer);
 472         this->server = server->clone(server);
 473         return &this->public;
 474 }
 475