From: Arran Cudbard-Bell Date: Thu, 7 Dec 2017 07:28:00 +0000 (+0000) Subject: Fix various SIM packet encoder issues X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cd80f9c20e9681acf146f7e6cd3e9506789f70f5;p=thirdparty%2Ffreeradius-server.git Fix various SIM packet encoder issues --- diff --git a/src/modules/rlm_eap/lib/sim/decode.c b/src/modules/rlm_eap/lib/sim/decode.c index 107bca323f2..9b157402932 100644 --- a/src/modules/rlm_eap/lib/sim/decode.c +++ b/src/modules/rlm_eap/lib/sim/decode.c @@ -944,6 +944,8 @@ int fr_sim_decode(REQUEST *request, vp_cursor_t *decoded, uint8_t const *end = p + data_len; fr_sim_decode_ctx_t *packet_ctx = decoder_ctx; + rad_assert(packet_ctx->root); + fr_strerror(); /* diff --git a/src/modules/rlm_eap/lib/sim/encode.c b/src/modules/rlm_eap/lib/sim/encode.c index 02565ed3ff2..ed102e6dcfa 100644 --- a/src/modules/rlm_eap/lib/sim/encode.c +++ b/src/modules/rlm_eap/lib/sim/encode.c @@ -909,8 +909,10 @@ ssize_t fr_sim_encode_pair(uint8_t *out, size_t outlen, vp_cursor_t *cursor, voi return -1; } - if (vp->da->attr == FR_EAP_SIM_MAC) return 0; - + if (vp->da->attr == FR_EAP_SIM_MAC) { + next_encodable(cursor, encoder_ctx); + return 0; + } /* * Nested structures of attributes can't be longer than * 4 * 255 bytes, so each call to an encode function can @@ -996,13 +998,13 @@ ssize_t fr_sim_encode(REQUEST *request, fr_dict_attr_t const *parent, uint8_t ty } subtype = vp->vp_uint16; - vp = fr_pair_find_by_num(to_encode, 0, FR_EAP_ID, TAG_ANY); + vp = fr_pair_find_by_child_num(to_encode, parent, FR_EAP_ID, TAG_ANY); id = vp ? vp->vp_uint32 : ((int)getpid() & 0xff); - vp = fr_pair_find_by_num(to_encode, 0, FR_EAP_CODE, TAG_ANY); + vp = fr_pair_find_by_child_num(to_encode, parent, FR_EAP_CODE, TAG_ANY); eap_code = vp ? vp->vp_uint32 : FR_EAP_CODE_REQUEST; - vp = fr_pair_find_by_num(to_encode, 0, FR_EAP_SIM_MAC, TAG_ANY); + vp = fr_pair_find_by_child_num(to_encode, parent, FR_EAP_SIM_MAC, TAG_ANY); if (vp) do_hmac = true; /* @@ -1060,12 +1062,14 @@ ssize_t fr_sim_encode(REQUEST *request, fr_dict_attr_t const *parent, uint8_t ty rad_assert(p < end); /* We messed up a check somewhere in the encoder */ } - eap_packet->type.length = p - end; + eap_packet->type.length = p - buff; + eap_packet->type.data = buff; /* * Calculate a SHA1-HMAC over the complete EAP packet */ if (do_hmac) { + uint8_t *start = p; /* * We left some room earlier... */ @@ -1079,7 +1083,10 @@ ssize_t fr_sim_encode(REQUEST *request, fr_dict_attr_t const *parent, uint8_t ty keys->vector_type == SIM_VECTOR_GSM ? keys->gsm.nonce_mt : NULL, keys->vector_type == SIM_VECTOR_GSM ? sizeof(keys->gsm.nonce_mt) : 0); if (slen < 0) goto error; + p += slen; + eap_packet->type.length += SIM_CALC_MAC_SIZE; + FR_PROTO_HEX_DUMP("hmac attribute", start, p - start); } FR_PROTO_HEX_DUMP("sim packet", buff, eap_packet->type.length); @@ -1087,14 +1094,12 @@ ssize_t fr_sim_encode(REQUEST *request, fr_dict_attr_t const *parent, uint8_t ty * Shrink buffer to the correct size */ if (eap_packet->type.length != talloc_array_length(buff)) { - uint8_t *new; + uint8_t *realloced; - new = talloc_realloc(eap_packet, buff, uint8_t, eap_packet->type.length); - if (!new) goto error; + realloced = talloc_realloc(eap_packet, buff, uint8_t, eap_packet->type.length); + if (!realloced) goto error; - eap_packet->type.data = new; - } else { - eap_packet->type.data = buff; + eap_packet->type.data = realloced; } return len; diff --git a/src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c b/src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c index 2352848c5f4..6eeb4d931d3 100644 --- a/src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c +++ b/src/modules/rlm_eap/types/rlm_eap_sim/rlm_eap_sim.c @@ -45,13 +45,34 @@ RCSID("$Id$") static int eap_sim_compose(eap_session_t *eap_session) { eap_sim_session_t *eap_sim_session = talloc_get_type_abort(eap_session->opaque, eap_sim_session_t); + vp_cursor_t cursor; + vp_cursor_t to_encode; + VALUE_PAIR *head = NULL, *vp; + REQUEST *request = eap_session->request; + ssize_t ret; /* we will set the ID on requests, since we have to HMAC it */ eap_session->this_round->set_request_id = true; - return fr_sim_encode(eap_session->request, dict_sim_root, FR_EAP_SIM, - eap_session->request->reply->vps, eap_session->this_round->request, - &eap_sim_session->keys); + fr_pair_cursor_init(&cursor, &eap_session->request->reply->vps); + fr_pair_cursor_init(&to_encode, &head); + + while ((fr_pair_cursor_next_by_ancestor(&cursor, dict_sim_root, TAG_ANY))) { + vp = fr_pair_cursor_remove(&cursor); + fr_pair_cursor_append(&to_encode, vp); + } + + RDEBUG2("Encoding EAP-SIM attributes"); + rdebug_pair_list(L_DBG_LVL_2, request, head, NULL); + + ret = fr_sim_encode(eap_session->request, dict_sim_root, FR_EAP_SIM, + head, eap_session->this_round->request, + &eap_sim_session->keys); + fr_pair_cursor_first(&to_encode); + fr_pair_cursor_free(&to_encode); + + if (ret < 0) return -1; + return 0; } static int eap_sim_send_state(eap_session_t *eap_session) @@ -409,7 +430,7 @@ static rlm_rcode_t mod_process(UNUSED void *arg, eap_session_t *eap_session) int ret; - memset(&ctx, 0, sizeof(ctx)); + rad_assert(dict_sim_root); /* * VPS is the data from the client @@ -427,7 +448,7 @@ static rlm_rcode_t mod_process(UNUSED void *arg, eap_session_t *eap_session) vp = fr_pair_cursor_next(&cursor); if (vp && RDEBUG_ENABLED2) { - RDEBUG2("EAP-SIM decoded attributes"); + RDEBUG2("Eecoded EAP-SIM attributes"); rdebug_pair_list(L_DBG_LVL_2, request, vp, NULL); }