/*
* vector: Request authenticator from access-request packet
* Put in there by rad_decode, and must be put in the
- * response RADIUS_PACKET as well before calling fr_radius_send
+ * response RADIUS_PACKET as well before calling fr_radius_packet_send
*
* verified: Filled in by rad_decode for accounting-request packets
*
void fr_radius_print_hex(RADIUS_PACKET const *packet);
-int fr_radius_send(RADIUS_PACKET *, RADIUS_PACKET const *, char const *secret);
+int fr_radius_packet_send(RADIUS_PACKET *, RADIUS_PACKET const *, char const *secret);
ssize_t fr_radius_len(uint8_t const *data, size_t data_len);
-bool fr_radius_ok(RADIUS_PACKET *packet, bool require_ma, decode_fail_t *reason);
+bool fr_radius_packet_ok(RADIUS_PACKET *packet, bool require_ma, decode_fail_t *reason);
RADIUS_PACKET *fr_radius_recv(TALLOC_CTX *ctx, int fd, int flags, bool require_ma);
ssize_t fr_radius_recv_header(int sockfd, fr_ipaddr_t *src_ipaddr, uint16_t *src_port, unsigned int *code);
-int fr_radius_verify(RADIUS_PACKET *packet, RADIUS_PACKET *original, char const *secret);
+int fr_radius_packet_verify(RADIUS_PACKET *packet, RADIUS_PACKET *original, char const *secret);
int fr_radius_decode(RADIUS_PACKET *packet, RADIUS_PACKET *original, char const *secret);
int fr_radius_encode(RADIUS_PACKET *packet, RADIUS_PACKET const *original, char const *secret);
-int fr_radius_sign(RADIUS_PACKET *packet, RADIUS_PACKET const *original, char const *secret);
+int fr_radius_packet_sign(RADIUS_PACKET *packet, RADIUS_PACKET const *original, char const *secret);
int fr_radius_digest_cmp(uint8_t const *a, uint8_t const *b, size_t length);
/** Sign a previously encoded packet
*
*/
-int fr_radius_sign(RADIUS_PACKET *packet, RADIUS_PACKET const *original,
+int fr_radius_packet_sign(RADIUS_PACKET *packet, RADIUS_PACKET const *original,
char const *secret)
{
radius_packet_t *hdr = (radius_packet_t *)packet->data;
if (!packet->data || (packet->data_len < RADIUS_HDR_LEN) ||
(packet->offset < 0)) {
- fr_strerror_printf("ERROR: You must call fr_radius_encode() before fr_radius_sign()");
+ fr_strerror_printf("ERROR: You must call fr_radius_encode() before fr_radius_packet_sign()");
return -1;
}
*
* Also attach reply attribute value pairs and any user message provided.
*/
-int fr_radius_send(RADIUS_PACKET *packet, RADIUS_PACKET const *original,
+int fr_radius_packet_send(RADIUS_PACKET *packet, RADIUS_PACKET const *original,
char const *secret)
{
/*
* Re-sign it, including updating the
* Message-Authenticator.
*/
- if (fr_radius_sign(packet, original, secret) < 0) {
+ if (fr_radius_packet_sign(packet, original, secret) < 0) {
return -1;
}
* - True on success.
* - False on failure.
*/
-bool fr_radius_ok(RADIUS_PACKET *packet, bool require_ma, decode_fail_t *reason)
+bool fr_radius_packet_ok(RADIUS_PACKET *packet, bool require_ma, decode_fail_t *reason)
{
uint8_t *attr;
size_t totallen;
/*
* See if it's a well-formed RADIUS packet.
*/
- if (!fr_radius_ok(packet, require_ma, NULL)) {
+ if (!fr_radius_packet_ok(packet, require_ma, NULL)) {
fr_radius_free(&packet);
return NULL;
}
/** Verify the Request/Response Authenticator (and Message-Authenticator if present) of a packet
*
*/
-int fr_radius_verify(RADIUS_PACKET *packet, RADIUS_PACKET *original, char const *secret)
+int fr_radius_packet_verify(RADIUS_PACKET *packet, RADIUS_PACKET *original, char const *secret)
{
uint8_t *ptr;
int length;
/*
* VSA's may not have been counted properly in
- * fr_radius_ok() above, as it is hard to count
+ * fr_radius_packet_ok() above, as it is hard to count
* then without using the dictionary. We
* therefore enforce the limits here, too.
*/
*
* "length" is AT LEAST the length of this attribute, as we
* expect the caller to have verified the data with
- * fr_radius_ok(). "length" may be up to the length of the
+ * fr_radius_packet_ok(). "length" may be up to the length of the
* packet.
*
* @return
/*
* See if it's a well-formed RADIUS packet.
*/
- if (!fr_radius_ok(packet, require_ma, NULL)) {
+ if (!fr_radius_packet_ok(packet, require_ma, NULL)) {
return -1;
}
}
#endif
- if (fr_radius_send(request->reply, request->packet,
+ if (fr_radius_packet_send(request->reply, request->packet,
request->client->secret) < 0) {
RERROR("Failed sending reply: %s",
fr_strerror());
}
# endif
- if (fr_radius_send(request->reply, request->packet,
+ if (fr_radius_packet_send(request->reply, request->packet,
request->client->secret) < 0) {
RERROR("Failed sending reply: %s",
fr_strerror());
rad_assert(request->proxy->listener == listener);
rad_assert(listener->send == proxy_socket_send);
- if (fr_radius_send(request->proxy->packet, NULL,
+ if (fr_radius_packet_send(request->proxy->packet, NULL,
request->proxy->home_server->secret) < 0) {
RERROR("Failed sending proxied request: %s",
fr_strerror());
request->reply->data_len, MAX_PACKET_LEN);
}
- if (fr_radius_sign(request->reply, request->packet, request->client->secret) < 0) {
+ if (fr_radius_packet_sign(request->reply, request->packet, request->client->secret) < 0) {
RPERROR("Failed signing packet");
return -1;
listen_socket_t *sock;
#endif
- if (fr_radius_verify(request->packet, NULL,
+ if (fr_radius_packet_verify(request->packet, NULL,
request->client->secret) < 0) {
return -1;
}
request->proxy->packet->data_len, MAX_PACKET_LEN);
}
- if (fr_radius_sign(request->proxy->packet, NULL, request->proxy->home_server->secret) < 0) {
+ if (fr_radius_packet_sign(request->proxy->packet, NULL, request->proxy->home_server->secret) < 0) {
RPERROR("Failed signing proxied packet");
return -1;
static int proxy_socket_decode(UNUSED rad_listen_t *listener, REQUEST *request)
{
/*
- * fr_radius_verify is run in event.c, received_proxy_response()
+ * fr_radius_packet_verify is run in event.c, received_proxy_response()
*/
return fr_radius_decode(request->proxy->reply, request->proxy->packet,
* ignore it. This does the MD5 calculations in the
* server core, but I guess we can fix that later.
*/
- if (!proxy->reply && (fr_radius_verify(reply, proxy->packet, proxy->home_server->secret) != 0)) {
+ if (!proxy->reply && (fr_radius_packet_verify(reply, proxy->packet, proxy->home_server->secret) != 0)) {
RWDEBUG("Discarding invalid reply from host %s port %d - ID: %d: %s",
inet_ntop(reply->src_ipaddr.af, &reply->src_ipaddr.ipaddr, buffer, sizeof(buffer)),
reply->src_port, reply->id, fr_strerror());
/*
* Send the packet.
*/
- if (fr_radius_send(request->packet, NULL, secret) < 0) {
+ if (fr_radius_packet_send(request->packet, NULL, secret) < 0) {
REDEBUG("Failed to send packet for ID %d", request->packet->id);
deallocate_id(request);
request->done = true;
* Fails the signature validation: not a real reply.
* FIXME: Silently drop it and listen for another packet.
*/
- if (fr_radius_verify(reply, request->packet, secret) < 0) {
+ if (fr_radius_packet_verify(reply, request->packet, secret) < 0) {
REDEBUG("Reply verification failed");
stats.lost++;
goto packet_done; /* shared secret is incorrect */
current->src_port = ntohs(udp->src);
current->dst_port = ntohs(udp->dst);
- if (!fr_radius_ok(current, false, &reason)) {
+ if (!fr_radius_packet_ok(current, false, &reason)) {
REDEBUG("%s", fr_strerror());
if (conf->event_flags & RS_ERROR) {
rs_packet_print(NULL, count, RS_ERROR, event->in, current, &elapsed, NULL, false, false);
FILE *log_fp = fr_log_fp;
fr_log_fp = NULL;
- ret = fr_radius_verify(current, original->expect, conf->radius_secret);
+ ret = fr_radius_packet_verify(current, original->expect, conf->radius_secret);
fr_log_fp = log_fp;
if (ret != 0) {
REDEBUG("Failed verifying packet ID %d", current->id);
/*
* Only decode attributes if we want to print them or filter on them
- * fr_radius_ok( does checks to verify the packet is actually valid.
+ * fr_radius_packet_ok( does checks to verify the packet is actually valid.
*/
if (conf->decode_attrs) {
int ret;
/*
* Only decode attributes if we want to print them or filter on them
- * fr_radius_ok( does checks to verify the packet is actually valid.
+ * fr_radius_packet_ok( does checks to verify the packet is actually valid.
*/
if (conf->decode_attrs) {
int ret;
ERROR("Failed encoding request: %s", fr_strerror());
return EXIT_FAILURE;
}
- if (fr_radius_sign(request, NULL, conf->secret) < 0) {
+ if (fr_radius_packet_sign(request, NULL, conf->secret) < 0) {
ERROR("Failed signing request: %s", fr_strerror());
return EXIT_FAILURE;
}
packet->vps = NULL;
pthread_mutex_unlock(&sock->mutex);
- if (!fr_radius_ok(packet, 0, NULL)) {
+ if (!fr_radius_packet_ok(packet, 0, NULL)) {
if (DEBUG_ENABLED) ERROR("Receive - %s", fr_strerror());
DEBUG("Closing TLS socket from client");
pthread_mutex_lock(&sock->mutex);
/*
* Sign the packet.
*/
- if (fr_radius_sign(request->reply, request->packet,
+ if (fr_radius_packet_sign(request->reply, request->packet,
request->client->secret) < 0) {
RPERROR("Failed signing packet");
return 0;
goto done;
}
- if (fr_radius_sign(request->reply, request->packet, request->client->secret) < 0) {
+ if (fr_radius_packet_sign(request->reply, request->packet, request->client->secret) < 0) {
RDEBUG("Failed signing RADIUS reply: %s", fr_strerror());
goto done;
}
- if (fr_radius_send(request->reply, request->packet, request->client->secret) < 0) {
+ if (fr_radius_packet_send(request->reply, request->packet, request->client->secret) < 0) {
RDEBUG("Failed sending RADIUS reply: %s", fr_strerror());
}
/* FALL-THROUGH */
if (request->reply->code != 0) {
gettimeofday(&request->reply->timestamp, NULL);
- if (fr_radius_send(request->reply, request->packet, request->client->secret) < 0) {
+ if (fr_radius_packet_send(request->reply, request->packet, request->client->secret) < 0) {
RDEBUG("Failed sending RADIUS reply: %s", fr_strerror());
goto done;
}
if (RDEBUG_ENABLED) common_packet_debug(request, request->reply, false);
gettimeofday(&request->reply->timestamp, NULL);
- if (fr_radius_send(request->reply, request->packet, request->client->secret) < 0) {
+ if (fr_radius_packet_send(request->reply, request->packet, request->client->secret) < 0) {
RDEBUG("Failed sending RADIUS reply: %s", fr_strerror());
goto done;
}
goto stop_processing;
}
- if (fr_radius_sign(request->reply, request->packet, request->client->secret) < 0) {
+ if (fr_radius_packet_sign(request->reply, request->packet, request->client->secret) < 0) {
RDEBUG("Failed signing RADIUS reply: %s", fr_strerror());
/*
/* else fall through to sending the response immediately. */
}
- if (fr_radius_send(request->reply, request->packet, request->client->secret) < 0) {
+ if (fr_radius_packet_send(request->reply, request->packet, request->client->secret) < 0) {
RDEBUG("Failed sending RADIUS reply: %s", fr_strerror());
goto done;
}
goto done;
}
- if (fr_radius_sign(request->reply, request->packet, request->client->secret) < 0) {
+ if (fr_radius_packet_sign(request->reply, request->packet, request->client->secret) < 0) {
RDEBUG("Failed signing RADIUS reply: %s", fr_strerror());
goto done;
}
- if (fr_radius_send(request->reply, request->packet, request->client->secret) < 0) {
+ if (fr_radius_packet_send(request->reply, request->packet, request->client->secret) < 0) {
RDEBUG("Failed sending RADIUS reply: %s", fr_strerror());
}
/* FALL-THROUGH */
goto done;
}
- if (fr_radius_sign(request->reply, request->packet, request->client->secret) < 0) {
+ if (fr_radius_packet_sign(request->reply, request->packet, request->client->secret) < 0) {
RDEBUG("Failed signing RADIUS reply: %s", fr_strerror());
goto done;
}
- if (fr_radius_send(request->reply, request->packet, request->client->secret) < 0) {
+ if (fr_radius_packet_send(request->reply, request->packet, request->client->secret) < 0) {
RDEBUG("Failed sending RADIUS reply: %s", fr_strerror());
}
/* FALL-THROUGH */
/*
* If the reply fails the signature validation, it's not a real reply.
*/
- if (fr_radius_verify(reply, ccr->packet, ccr->inst->home_server->secret) < 0) {
+ if (fr_radius_packet_verify(reply, ccr->packet, ccr->inst->home_server->secret) < 0) {
REDEBUG("Reply verification failed for home server %s", ccr->inst->home_server->name);
fr_radius_free(&reply);
return;
buffer, sizeof(buffer)),
packet->dst_port, packet->id);
- fr_radius_send(packet, NULL, inst->home_server->secret);
+ fr_radius_packet_send(packet, NULL, inst->home_server->secret);
packet->count++;
}
buffer, sizeof(buffer)),
packet->dst_port, packet->id);
- (void) fr_radius_send(packet, NULL, inst->home_server->secret);
+ (void) fr_radius_packet_send(packet, NULL, inst->home_server->secret);
packet->count++;
timeout = ccr->inst->home_server->response_window;
* Encode, sign and then send the packet.
*/
RDEBUG("Replicating %s list to Realm \"%s\"", fr_int2str(pair_lists, list, "<INVALID>"), realm->name);
- if (fr_radius_send(packet, NULL, home->secret) < 0) {
+ if (fr_radius_packet_send(packet, NULL, home->secret) < 0) {
RPEDEBUG("Failed replicating packet");
rcode = RLM_MODULE_FAIL;
goto done;