add and set require_message_authenticator for home servers

diff --git a/raddb/proxy.conf b/raddb/proxy.conf
index fe6d5789e4a37f2b62a24d2a74cf5538295263fe..e0be4c04971a46845ffcf7281a6af8b5450422d5 100644 (file)
--- a/raddb/proxy.conf
+++ b/raddb/proxy.conf
@@ -250,6 +250,20 @@ home_server localhost {
        #
        secret = testing123
 
+       #
+       #  The global configuration "security.require_message_authenticator"
+       #  flag sets the default for all home servers.  That default can be
+       #  over-ridden here, by setting it to "no".
+       #
+       #  This flag exists solely for legacy home servers which do
+       #  not send Message-Authenticator in all Access-Accept,
+       #  Access-Reject, or Access-Challenge packets.  We do not
+       #  recommend setting it to "no".
+       #
+       #  allowed values: yes, no
+       #
+#      require_message_authenticator = no
+
        ############################################################
        #
        #  The rest of the configuration items listed here are optional,

diff --git a/src/include/realms.h b/src/include/realms.h
index ae9a9c81060428d1dcf49923801ffc0261053d9e..0a5132611dcd1ad353bb86a5023dfad713ac3208 100644 (file)
--- a/src/include/realms.h
+++ b/src/include/realms.h
@@ -64,6 +64,8 @@ typedef struct home_server {
        bool                    dual;                   //!< One of a pair of homeservers on consecutive ports.
        bool                    dynamic;                //!< is this a dynamically added home server?
        bool                    nonblock;               //!< Enable a socket non-blocking to the home server.
+       bool                    require_ma;             //!< for all replies to Access-Request and Status-Server
+
        char const              *virtual_server;                //!< For internal proxying
        char const              *parent_server;
 

diff --git a/src/main/process.c b/src/main/process.c
index 3cad968806ecd1ca7ad0382f1e3f91d9d2bc4300..251cb6b75dece550346a66b1f51bcf24b88f83a7 100644 (file)
--- a/src/main/process.c
+++ b/src/main/process.c
@@ -2700,11 +2700,26 @@ int request_proxy_reply(RADIUS_PACKET *packet)
         *      server core, but I guess we can fix that later.
         */
        if (!request->proxy_reply) {
+               decode_fail_t reason;
+
+               /*
+                *      If the home server configuration requires a Message-Authenticator, then set the flag,
+                *      but only if the proxied packet is Access-Request or Status-Sercer.
+                *
+                *      The realms.c file already clears require_ma for TLS connections.
+                */
+               bool require_ma = request->home_server->require_ma && (request->proxy->code == PW_CODE_ACCESS_REQUEST);
+
                if (!request->home_server) {
                        proxy_reply_too_late(request);
                        return 0;
                }
 
+               if (!rad_packet_ok(packet, require_ma, &reason)) {
+                       DEBUG("Ignoring invalid packet - %s", fr_strerror());
+                       return 0;
+               }
+
                if (rad_verify(packet, request->proxy,
                               request->home_server->secret) != 0) {
                        DEBUG("Ignoring spoofed proxy reply.  Signature is invalid");

diff --git a/src/main/realms.c b/src/main/realms.c
index 98b02b62fd9f7832f3ca91de5eff1c2c7f82fb5f..991496cac0e86b2b49520b269e972f2d9946111c 100644 (file)
--- a/src/main/realms.c
+++ b/src/main/realms.c
@@ -437,6 +437,7 @@ static CONF_PARSER home_server_coa[] = {
 
 static CONF_PARSER home_server_config[] = {
        { "nonblock", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, home_server_t, nonblock), "no" },
+       { "require_message_authenticator", FR_CONF_OFFSET(PW_TYPE_BOOLEAN | PW_TYPE_IGNORE_DEFAULT, home_server_t, require_ma), NULL },
        { "ipaddr", FR_CONF_OFFSET(PW_TYPE_COMBO_IP_ADDR, home_server_t, ipaddr), NULL },
        { "ipv4addr", FR_CONF_OFFSET(PW_TYPE_IPV4_ADDR, home_server_t, ipaddr), NULL },
        { "ipv6addr", FR_CONF_OFFSET(PW_TYPE_IPV6_ADDR, home_server_t, ipaddr), NULL },
@@ -723,6 +724,7 @@ home_server_t *home_server_afrom_cs(TALLOC_CTX *ctx, realm_config_t *rc, CONF_SE
        home->cs = cs;
        home->state = HOME_STATE_UNKNOWN;
        home->proto = IPPROTO_UDP;
+       home->require_ma = main_config.require_ma;
 
        /*
         *      Parse the configuration into the home server
@@ -1012,6 +1014,11 @@ home_server_t *home_server_afrom_cs(TALLOC_CTX *ctx, realm_config_t *rc, CONF_SE
                if (tls) {
                        int rcode;
 
+                       /*
+                        *      We don't require this for TLS connections.
+                        */
+                       home->require_ma = false;
+
                        home->tls = tls_client_conf_parse(tls);
                        if (!home->tls) {
                                goto error;