Add policy to check outer / inner tunnel user names

They should be compatible as per github issue #1471

diff --git a/raddb/policy.d/filter b/raddb/policy.d/filter
index 062d375553ffc639f5ce82616be44ac93066298f..134d2f7a10a0528f6db8cd7803438554c248fb71 100644 (file)
--- a/raddb/policy.d/filter
+++ b/raddb/policy.d/filter
@@ -109,3 +109,79 @@ filter_password {
                }
         }
 }
+
+filter_inner_identity {
+       #
+       #  No names, reject.
+       #
+       if (!&outer.request:User-Name || !&User-Name) {
+               update request {
+                       Module-Failure-Message = "User-Name is required for tunneled authentication"
+               }
+               reject
+       }
+
+       #
+       #  If the names are the same, it's OK.
+       #
+       #  Otherwise, do lots of sanity checks
+       #
+       if (&outer.request:User-Name != &User-Name) {
+               #
+               #  We require the outer User-Name
+               #  to be "@realm", or "anon...",
+               #  hopefully "anonymous", or "anonymous@realm"
+               #
+               #  The checks for "anonymous" are more relaxed
+               #  because vendors send a variety of names
+               #  instead of following the standards.
+               #
+               if ((&outer.request:User-Name !~ /^@/) && \
+                   (&outer.request:User-Name !~ /^anon/)) {
+                       update request {
+                               Module-Failure-Message = "User-Name is not correctly anonymized"
+                       }
+                       reject
+               }
+
+               #
+               #  Now we get complicated.  Look for the outer realm
+               #
+               if (&outer.request:User-Name =~ /@(.*)$/) {
+                       update request {
+                               Outer-Realm-Name = "%{1}"
+                       }
+               }
+
+               #
+               #  And the inner realm
+               #
+               if (&User-Name =~ /@(.*)$/) {
+                       update request {
+                               Inner-Realm-Name = "%{1}"
+                       }
+               }
+
+               #
+               #  It's OK to have outer "@example.com" and
+               #  inner "bob".  We do more detailed checks
+               #  only if the inner realm exists.
+               #
+               #  It's OK to have the same realm name, or
+               #  the outer one is "example.com" and the inner
+               #  is "secure.example.com"
+               #
+               if (&Inner-Realm-Name && \
+                   (&Inner-Realm-Name != &Outer-Realm-Name) && \
+                   (&Inner-Realm-Name !~ /\.%{Outer-Realm-Name}$/)) {
+                       update request {
+                               Module-Failure-Message = "Inner and outer realms are not compatible"
+                       }
+                       reject
+               }
+
+               #
+               #  It's OK to have an outer realm and no inner realm.
+               #
+       }
+}

diff --git a/raddb/sites-available/inner-tunnel b/raddb/sites-available/inner-tunnel
index 42b358f5c8e8e7dfacb63c1760f56797e012bcf3..14df8ab13e6e003d5aed0d65955e6a968587736f 100644 (file)
--- a/raddb/sites-available/inner-tunnel
+++ b/raddb/sites-available/inner-tunnel
@@ -46,6 +46,12 @@ listen {
 #  Make *sure* that 'preprocess' comes before any realm if you
 #  need to setup hints for the remote radius server
 authorize {
+       #
+       #  Do checks on outer / inner User-Name, so that users
+       #  can't spoof us by using incompatible identities
+       #
+       filter_inner_identity
+
        #
        #  The chap module will set 'Auth-Type := CHAP' if we are
        #  handling a CHAP request and Auth-Type has not already been set

diff --git a/share/dictionary.freeradius.internal b/share/dictionary.freeradius.internal
index 29259d0fe4370a1fb4b903b9c8a381c9b0ad7967..11f602dab3a09b393f506b9df8c4f334f6183046 100644 (file)
--- a/share/dictionary.freeradius.internal
+++ b/share/dictionary.freeradius.internal
@@ -306,6 +306,9 @@ ATTRIBUTE   EAP-Sim-KC3                             1214    octets
 ATTRIBUTE      EAP-Sim-Ki                              1215    octets
 ATTRIBUTE      EAP-Sim-Algo-Version                    1216    integer
 
+ATTRIBUTE      Outer-Realm-Name                        1218    string internal
+ATTRIBUTE      Inner-Realm-Name                        1219    string internal
+
 #
 #      Range:  1280 - 1535
 #              EAP-type specific attributes