Pass in raw packet instead of reconstructing original packet from EAP-Messages

diff --git a/src/modules/rlm_eap/lib/sim/crypto.c b/src/modules/rlm_eap/lib/sim/crypto.c
index d74fa8f5a5b01d12e5473a855b26782b27aba93c..fdca3bd4369e82bb4185da5c9abf3ee48ed7a8aa 100644 (file)
--- a/src/modules/rlm_eap/lib/sim/crypto.c
+++ b/src/modules/rlm_eap/lib/sim/crypto.c
@@ -43,11 +43,11 @@ RCSID("$Id$")
  */
 int fr_sim_crypto_mac_verify(TALLOC_CTX *ctx, fr_dict_attr_t const *root,
                             VALUE_PAIR *rvps,
+                            eap_packet_raw_t *packet,
                             uint8_t key[EAP_SIM_AUTH_SIZE],
                             uint8_t *extra, int extra_len, uint8_t calc_mac[20])
 {
        int                     ret;
-       eap_packet_raw_t        *e;
        uint8_t                 *buffer;
        int                     elen, len;
        VALUE_PAIR              *mac;
@@ -65,23 +65,14 @@ int fr_sim_crypto_mac_verify(TALLOC_CTX *ctx, fr_dict_attr_t const *root,
                return 0;
        }
 
-       /* get original copy of EAP message, note that it was sanitized
-        * to have a valid length, which we depend upon.
-        */
-       e = eap_vp2packet(ctx, rvps);
-       if (!e) return 0;
-
        /* make copy big enough for everything */
-       elen = (e->length[0] * 256) + e->length[1];
+       elen = (packet->length[0] * 256) + packet->length[1];
        len = elen + extra_len;
 
        buffer = talloc_array(ctx, uint8_t, len);
-       if (!buffer) {
-               talloc_free(e);
-               return 0;
-       }
+       if (!buffer) return 0;
 
-       memcpy(buffer, e, elen);
+       memcpy(buffer, packet, elen);
        memcpy(buffer + elen, extra, extra_len);
 
        /*
@@ -118,9 +109,8 @@ int fr_sim_crypto_mac_verify(TALLOC_CTX *ctx, fr_dict_attr_t const *root,
 
        ret = memcmp(&mac->vp_strvalue[2], calc_mac, 16) == 0 ? 1 : 0;          //-V512
  done:
-       talloc_free(e);
        talloc_free(buffer);
-       return(ret);
+       return ret;
 }
 
 

diff --git a/src/modules/rlm_eap/lib/sim/sim_proto.h b/src/modules/rlm_eap/lib/sim/sim_proto.h
index 6f8f85df49a9e12f30e3eb40660ea997c8c1306c..22225b2e6ca61df02964bc62b20596a88c75480d 100644 (file)
--- a/src/modules/rlm_eap/lib/sim/sim_proto.h
+++ b/src/modules/rlm_eap/lib/sim/sim_proto.h
@@ -201,6 +201,7 @@ ssize_t             fr_sim_crypto_sign_packet(uint8_t out[16], eap_packet_t *eap_packet,
 
 int            fr_sim_crypto_mac_verify(TALLOC_CTX *ctx, fr_dict_attr_t const *root,
                                         VALUE_PAIR *rvps,
+                                        eap_packet_raw_t *packet,
                                         uint8_t key[8],
                                         uint8_t *extra, int extra_len,
                                         uint8_t calc_mac[20])

diff --git a/src/modules/rlm_eap/types/rlm_eap_aka/rlm_eap_aka.c b/src/modules/rlm_eap/types/rlm_eap_aka/rlm_eap_aka.c
index f6ad75ad66661b8df16df0e41bf9f0b02b0a8760..a44eb4147c46dd926d82aae56e97e49020470813 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_aka/rlm_eap_aka.c
+++ b/src/modules/rlm_eap/types/rlm_eap_aka/rlm_eap_aka.c
@@ -233,6 +233,7 @@ static int process_eap_aka_challenge(eap_session_t *eap_session, VALUE_PAIR *vps
         *      Verify the MAC, now that we have all the keys
         */
        if (fr_sim_crypto_mac_verify(eap_session, dict_aka_root, vps,
+                                    (eap_packet_raw_t *)eap_session->this_round->response->packet,
                                     eap_aka_session->keys.k_aut,
                                     NULL, 0, calc_mac)) {
                RDEBUG2("MAC check succeed");

diff --git a/src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c b/src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c
index 9016f30e10b7bb56ab749f01e01f9bb9c26a412f..191de0922385c080077aba23adf2cf0a1d92b24d 100644 (file)
--- a/src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c
+++ b/src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c
@@ -373,6 +373,7 @@ static int process_eap_sim_challenge(eap_session_t *eap_session, VALUE_PAIR *vps
         *      Verify the MAC, now that we have all the keys
         */
        if (fr_sim_crypto_mac_verify(eap_session, dict_sim_root, vps,
+                                    (eap_packet_raw_t *)eap_session->this_round->response->packet,
                                     eap_sim_session->keys.k_aut,
                                     sres_cat, sizeof(sres_cat), calc_mac)) {
                RDEBUG2("MAC check succeed");