src/libradius/radius_message.h

   1 /*
   2  * Copyright (C) 2009 Martin Willi
   3  * Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 /**
  17  * @defgroup libradius libradius
  18  *
  19  * @addtogroup libradius
  20  * RADIUS protocol support library.
  21  *
  22  * @defgroup radius_message radius_message
  23  * @{ @ingroup libradius
  24  */
  25
  26 #ifndef RADIUS_MESSAGE_H_
  27 #define RADIUS_MESSAGE_H_
  28
  29 #include <library.h>
  30
  31 typedef struct radius_message_t radius_message_t;
  32 typedef enum radius_message_code_t radius_message_code_t;
  33 typedef enum radius_attribute_type_t radius_attribute_type_t;
  34
  35 /**
  36  * RADIUS Message Codes.
  37  */
  38 enum radius_message_code_t {
  39         RMC_ACCESS_REQUEST = 1,
  40         RMC_ACCESS_ACCEPT = 2,
  41         RMC_ACCESS_REJECT = 3,
  42         RMC_ACCOUNTING_REQUEST = 4,
  43         RMC_ACCOUNTING_RESPONSE = 5,
  44         RMC_ACCESS_CHALLENGE = 11,
  45         RMC_DISCONNECT_REQUEST = 40,
  46         RMC_DISCONNECT_ACK = 41,
  47         RMC_DISCONNECT_NAK = 42,
  48         RMC_COA_REQUEST = 43,
  49         RMC_COA_ACK = 44,
  50         RMC_COA_NAK = 45,
  51 };
  52
  53 /**
  54  * Enum names for radius_attribute_type_t.
  55  */
  56 extern enum_name_t *radius_message_code_names;
  57
  58 /**
  59  * RADIUS Attribute Types.
  60  */
  61 enum radius_attribute_type_t {
  62         RAT_USER_NAME = 1,
  63         RAT_USER_PASSWORD = 2,
  64         RAT_CHAP_PASSWORD = 3,
  65         RAT_NAS_IP_ADDRESS = 4,
  66         RAT_NAS_PORT = 5,
  67         RAT_SERVICE_TYPE = 6,
  68         RAT_FRAMED_PROTOCOL = 7,
  69         RAT_FRAMED_IP_ADDRESS = 8,
  70         RAT_FRAMED_IP_NETMASK = 9,
  71         RAT_FRAMED_ROUTING = 10,
  72         RAT_FILTER_ID = 11,
  73         RAT_FRAMED_MTU = 12,
  74         RAT_FRAMED_COMPRESSION = 13,
  75         RAT_LOGIN_IP_HOST = 14,
  76         RAT_LOGIN_SERVICE = 15,
  77         RAT_LOGIN_TCP_PORT = 16,
  78         RAT_REPLY_MESSAGE = 18,
  79         RAT_CALLBACK_NUMBER = 19,
  80         RAT_CALLBACK_ID = 20,
  81         RAT_FRAMED_ROUTE = 22,
  82         RAT_FRAMED_IPX_NETWORK = 23,
  83         RAT_STATE = 24,
  84         RAT_CLASS = 25,
  85         RAT_VENDOR_SPECIFIC = 26,
  86         RAT_SESSION_TIMEOUT = 27,
  87         RAT_IDLE_TIMEOUT = 28,
  88         RAT_TERMINATION_ACTION = 29,
  89         RAT_CALLED_STATION_ID = 30,
  90         RAT_CALLING_STATION_ID = 31,
  91         RAT_NAS_IDENTIFIER = 32,
  92         RAT_PROXY_STATE = 33,
  93         RAT_LOGIN_LAT_SERVICE = 34,
  94         RAT_LOGIN_LAT_NODE = 35,
  95         RAT_LOGIN_LAT_GROUP = 36,
  96         RAT_FRAMED_APPLETALK_LINK = 37,
  97         RAT_FRAMED_APPLETALK_NETWORK = 38,
  98         RAT_FRAMED_APPLETALK_ZONE = 39,
  99         RAT_ACCT_STATUS_TYPE = 40,
 100         RAT_ACCT_DELAY_TIME = 41,
 101         RAT_ACCT_INPUT_OCTETS = 42,
 102         RAT_ACCT_OUTPUT_OCTETS = 43,
 103         RAT_ACCT_SESSION_ID = 44,
 104         RAT_ACCT_AUTHENTIC = 45,
 105         RAT_ACCT_SESSION_TIME = 46,
 106         RAT_ACCT_INPUT_PACKETS = 47,
 107         RAT_ACCT_OUTPUT_PACKETS = 48,
 108         RAT_ACCT_TERMINATE_CAUSE = 49,
 109         RAT_ACCT_MULTI_SESSION_ID = 50,
 110         RAT_ACCT_LINK_COUNT = 51,
 111         RAT_ACCT_INPUT_GIGAWORDS = 52,
 112         RAT_ACCT_OUTPUT_GIGAWORDS = 53,
 113         RAT_EVENT_TIMESTAMP = 55,
 114         RAT_EGRESS_VLANID = 56,
 115         RAT_INGRESS_FILTERS = 57,
 116         RAT_EGRESS_VLAN_NAME = 58,
 117         RAT_USER_PRIORITY_TABLE = 59,
 118         RAT_CHAP_CHALLENGE = 60,
 119         RAT_NAS_PORT_TYPE = 61,
 120         RAT_PORT_LIMIT = 62,
 121         RAT_LOGIN_LAT_PORT = 63,
 122         RAT_TUNNEL_TYPE = 64,
 123         RAT_TUNNEL_MEDIUM_TYPE = 65,
 124         RAT_TUNNEL_CLIENT_ENDPOINT = 66,
 125         RAT_TUNNEL_SERVER_ENDPOINT = 67,
 126         RAT_ACCT_TUNNEL_CONNECTION = 68,
 127         RAT_TUNNEL_PASSWORD = 69,
 128         RAT_ARAP_PASSWORD = 70,
 129         RAT_ARAP_FEATURES = 71,
 130         RAT_ARAP_ZONE_ACCESS = 72,
 131         RAT_ARAP_SECURITY = 73,
 132         RAT_ARAP_SECURITY_DATA = 74,
 133         RAT_PASSWORD_RETRY = 75,
 134         RAT_PROMPT = 76,
 135         RAT_CONNECT_INFO = 77,
 136         RAT_CONFIGURATION_TOKEN = 78,
 137         RAT_EAP_MESSAGE = 79,
 138         RAT_MESSAGE_AUTHENTICATOR = 80,
 139         RAT_TUNNEL_PRIVATE_GROUP_ID = 81,
 140         RAT_TUNNEL_ASSIGNMENT_ID = 82,
 141         RAT_TUNNEL_PREFERENCE = 83,
 142         RAT_ARAP_CHALLENGE_RESPONSE = 84,
 143         RAT_ACCT_INTERIM_INTERVAL = 85,
 144         RAT_ACCT_TUNNEL_PACKETS_LOST = 86,
 145         RAT_NAS_PORT_ID = 87,
 146         RAT_FRAMED_POOL = 88,
 147         RAT_CUI = 89,
 148         RAT_TUNNEL_CLIENT_AUTH_ID = 90,
 149         RAT_TUNNEL_SERVER_AUTH_ID = 91,
 150         RAT_NAS_FILTER_RULE = 92,
 151         RAT_UNASSIGNED = 93,
 152         RAT_ORIGINATING_LINE_INFO = 94,
 153         RAT_NAS_IPV6_ADDRESS = 95,
 154         RAT_FRAMED_INTERFACE_ID = 96,
 155         RAT_FRAMED_IPV6_PREFIX = 97,
 156         RAT_LOGIN_IPV6_HOST = 98,
 157         RAT_FRAMED_IPV6_ROUTE = 99,
 158         RAT_FRAMED_IPV6_POOL = 100,
 159         RAT_ERROR_CAUSE = 101,
 160         RAT_EAP_KEY_NAME = 102,
 161         RAT_DIGEST_RESPONSE = 103,
 162         RAT_DIGEST_REALM = 104,
 163         RAT_DIGEST_NONCE = 105,
 164         RAT_DIGEST_RESPONSE_AUTH = 106,
 165         RAT_DIGEST_NEXTNONCE = 107,
 166         RAT_DIGEST_METHOD = 108,
 167         RAT_DIGEST_URI = 109,
 168         RAT_DIGEST_QOP = 110,
 169         RAT_DIGEST_ALGORITHM = 111,
 170         RAT_DIGEST_ENTITY_BODY_HASH = 112,
 171         RAT_DIGEST_CNONCE = 113,
 172         RAT_DIGEST_NONCE_COUNT = 114,
 173         RAT_DIGEST_USERNAME = 115,
 174         RAT_DIGEST_OPAQUE = 116,
 175         RAT_DIGEST_AUTH_PARAM = 117,
 176         RAT_DIGEST_AKA_AUTS = 118,
 177         RAT_DIGEST_DOMAIN = 119,
 178         RAT_DIGEST_STALE = 120,
 179         RAT_DIGEST_HA1 = 121,
 180         RAT_SIP_AOR = 122,
 181         RAT_DELEGATED_IPV6_PREFIX = 123,
 182         RAT_MIP6_FEATURE_VECTOR = 124,
 183         RAT_MIP6_HOME_LINK_PREFIX = 125,
 184 };
 185
 186 /**
 187  * Enum names for radius_attribute_type_t.
 188  */
 189 extern enum_name_t *radius_attribute_type_names;
 190
 191 /**
 192  * A RADIUS message, contains attributes.
 193  */
 194 struct radius_message_t {
 195
 196         /**
 197          * Create an enumerator over contained RADIUS attributes.
 198          *
 199          * @return                              enumerator over (int type, chunk_t data)
 200          */
 201         enumerator_t* (*create_enumerator)(radius_message_t *this);
 202
 203         /**
 204          * Add a RADIUS attribute to the message.
 205          *
 206          * @param type                  type of attribute to add
 207          * @param                               attribute data, gets cloned
 208          */
 209         void (*add)(radius_message_t *this, radius_attribute_type_t type,
 210                                 chunk_t data);
 211
 212         /**
 213          * Get the message type (code).
 214          *
 215          * @return                              message code
 216          */
 217         radius_message_code_t (*get_code)(radius_message_t *this);
 218
 219         /**
 220          * Get the message identifier.
 221          *
 222          * @return                              message identifier
 223          */
 224         u_int8_t (*get_identifier)(radius_message_t *this);
 225
 226         /**
 227          * Set the message identifier.
 228          *
 229          * @param identifier    message identifier
 230          */
 231         void (*set_identifier)(radius_message_t *this, u_int8_t identifier);
 232
 233         /**
 234          * Get the 16 byte authenticator.
 235          *
 236          * @return                              pointer to the Authenticator field
 237          */
 238         u_int8_t* (*get_authenticator)(radius_message_t *this);
 239
 240         /**
 241          * Get the RADIUS message in its encoded form.
 242          *
 243          * @return                              chunk pointing to internal RADIUS message.
 244          */
 245         chunk_t (*get_encoding)(radius_message_t *this);
 246
 247         /**
 248          * Calculate and add the Message-Authenticator attribute to the message.
 249          *
 250          * @param req_auth              16 byte Authenticator of request, or NULL
 251          * @param secret                shared RADIUS secret
 252          * @param signer                HMAC-MD5 signer with secret set
 253          * @param hasher                MD5 hasher
 254          * @param rng                   RNG to create Message-Authenticator, NULL to omit
 255          */
 256         void (*sign)(radius_message_t *this, u_int8_t *req_auth, chunk_t secret,
 257                                  hasher_t *hasher, signer_t *signer, rng_t *rng);
 258
 259         /**
 260          * Verify the integrity of a received RADIUS message.
 261          *
 262          * @param req_auth              16 byte Authenticator of request, or NULL
 263          * @param secret                shared RADIUS secret
 264          * @param signer                HMAC-MD5 signer with secret set
 265          * @param hasher                MD5 hasher
 266          */
 267         bool (*verify)(radius_message_t *this, u_int8_t *req_auth, chunk_t secret,
 268                                    hasher_t *hasher, signer_t *signer);
 269
 270         /**
 271          * Destroy the message.
 272          */
 273         void (*destroy)(radius_message_t *this);
 274 };
 275
 276 /**
 277  * Create an empty RADIUS message.
 278  *
 279  * @param code                  request type
 280  * @return                              radius_message_t object
 281  */
 282 radius_message_t *radius_message_create(radius_message_code_t code);
 283
 284 /**
 285  * Parse and verify a recevied RADIUS message.
 286  *
 287  * @param data                  received message data
 288  * @return                              radius_message_t object, NULL if length invalid
 289  */
 290 radius_message_t *radius_message_parse(chunk_t data);
 291
 292 #endif /** RADIUS_MESSAGE_H_ @}*/