+++ /dev/null
-/* $Id: radius.c 7745 2008-04-06 10:18:54Z iulius $
-**
-** Authenticate a user against a remote radius server.
-*/
-
-#include "config.h"
-#include "clibrary.h"
-#include "portable/time.h"
-#include <ctype.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <netdb.h>
-#include <signal.h>
-
-/* Needed on AIX 4.1 to get fd_set and friends. */
-#if HAVE_SYS_SELECT_H
-# include <sys/select.h>
-#endif
-
-#include "inn/innconf.h"
-#include "inn/md5.h"
-#include "inn/messages.h"
-#include "libinn.h"
-#include "nntp.h"
-#include "paths.h"
-#include "conffile.h"
-
-#include "libauth.h"
-
-#define RADIUS_LOCAL_PORT NNTP_PORT
-
-#define AUTH_VECTOR_LEN 16
-
-typedef struct _auth_req {
- unsigned char code;
- unsigned char id;
- unsigned short length;
- unsigned char vector[AUTH_VECTOR_LEN];
- unsigned char data[NNTP_STRLEN*2];
- int datalen;
-} auth_req;
-
-typedef struct _rad_config_t {
- char *secret; /* pseudo encryption thingy secret that radius uses */
-
- char *radhost; /* parameters for talking to the remote radius sever */
- int radport;
- char *lochost;
- int locport;
-
- char *prefix, *suffix; /* futz with the username, if necessary */
- int ignore_source;
-
- struct _rad_config_t *next; /* point to any additional servers */
-} rad_config_t;
-
-typedef struct _sending_t {
- auth_req req;
- int reqlen;
- struct sockaddr_in sinr;
- struct _sending_t *next;
-} sending_t;
-
-#define RADlbrace 1
-#define RADrbrace 2
-#define RADserver 10
-#define RADhost 11
-#define RADsecret 12
-#define RADport 13
-#define RADlochost 14
-#define RADlocport 15
-#define RADprefix 16
-#define RADsuffix 17
-#define RADsource 18
-
-static CONFTOKEN radtoks[] = {
- { RADlbrace, "{" },
- { RADrbrace, "}" },
- { RADserver, "server" },
- { RADhost, "radhost:" },
- { RADsecret, "secret:" },
- { RADport, "radport:" },
- { RADlochost, "lochost:" },
- { RADlocport, "locport:" },
- { RADprefix, "prefix:" },
- { RADsuffix, "suffix:" },
- { RADsource, "ignore-source:" },
- { 0, 0 }
-};
-
-static rad_config_t *get_radconf(void)
-{
- rad_config_t *new;
-
- new = xcalloc(1, sizeof(rad_config_t));
- new->next = NULL;
-
- return new;
-}
-
-static int read_config(char *authfile, rad_config_t *radconf)
-{
- int inbrace;
- rad_config_t *radconfig=NULL;
- CONFFILE *file;
- CONFTOKEN *token;
- char *server;
- int type;
- char *iter;
-
- if ((file = CONFfopen(authfile)) == NULL)
- sysdie("cannot open config file %s", authfile);
-
- inbrace = 0;
- while ((token = CONFgettoken(radtoks, file)) != NULL) {
- if (!inbrace) {
- if (token->type != RADserver)
- die("expected server keyword on line %d", file->lineno);
- if ((token = CONFgettoken(0, file)) == NULL)
- die("expected server name on line %d", file->lineno);
- server = xstrdup(token->name);
- if ((token = CONFgettoken(radtoks, file)) == NULL
- || token->type != RADlbrace)
- die("expected { on line %d", file->lineno);
- inbrace = 1;
-
- if (radconfig == NULL)
- radconfig = radconf;
- else {
- radconfig->next = get_radconf();
- radconfig = radconfig->next;
- }
- }
- else {
- type = token->type;
- if (type == RADrbrace)
- inbrace = 0;
- else {
- if ((token = CONFgettoken(0, file)) == NULL)
- die("keyword with no value on line %d", file->lineno);
- iter = token->name;
-
- /* what are we setting? */
- switch(type) {
- case RADsecret:
- if (radconfig->secret) continue;
- radconfig->secret = xstrdup(iter);
- break;
- case RADhost:
- if (radconfig->radhost) continue;
- radconfig->radhost = xstrdup(iter);
- break;
- case RADport:
- if (radconfig->radport) continue;
- radconfig->radport = atoi(iter);
- break;
- case RADlochost:
- if (radconfig->lochost) continue;
- radconfig->lochost = xstrdup(iter);
- break;
- case RADlocport:
- if (radconfig->locport) continue;
- radconfig->locport = atoi(iter);
- break;
- case RADprefix:
- if (radconfig->prefix) continue;
- radconfig->prefix = xstrdup(iter);
- break;
- case RADsuffix:
- if (radconfig->suffix) continue;
- radconfig->suffix = xstrdup(iter);
- break;
- case RADsource:
- if (!strcasecmp(iter, "true"))
- radconfig->ignore_source = 1;
- else if (!strcasecmp(iter, "false"))
- radconfig->ignore_source = 0;
- else
- die("expected true or false after ignore-source on line %d",
- file->lineno);
- break;
- default:
- die("unknown keyword on line %d", file->lineno);
- }
- }
- }
- }
-
- CONFfclose(file);
-
- if (!radconf->radhost)
- die("no radius host specified");
- else if (!radconf->secret)
- die("no shared secret with radius host specified");
-
- return(0);
-}
-
-#define PW_AUTH_UDP_PORT 1645
-
-#define PW_AUTHENTICATION_REQUEST 1
-#define PW_AUTHENTICATION_ACK 2
-#define PW_AUTHENTICATION_REJECT 3
-
-#define PW_USER_NAME 1
-#define PW_PASSWORD 2
-
-#define PW_SERVICE_TYPE 6
-#define PW_SERVICE_AUTH_ONLY 8
-
-#define RAD_NAS_IP_ADDRESS 4 /* IP address */
-#define RAD_NAS_PORT 5 /* Integer */
-
-static void req_copyto (auth_req to, sending_t *from)
-{
- to = from->req;
-}
-
-static void req_copyfrom (sending_t *to, auth_req from)
-{
- to->req = from;
-}
-
-static int rad_auth(rad_config_t *radconfig, char *uname, char *pass)
-{
- auth_req req;
- int i, j, jlen, passstart;
- unsigned char secbuf[128];
- char hostname[SMBUF];
- unsigned char digest[MD5_DIGESTSIZE];
- struct timeval seed;
- struct sockaddr_in sinl;
- int sock;
- struct hostent *hent;
- int passlen;
- time_t now, end;
- struct timeval tmout;
- int got;
- fd_set rdfds;
- uint32_t nvalue;
- socklen_t slen;
- int authtries= 3; /* number of times to try reaching the radius server */
- rad_config_t *config;
- sending_t *reqtop, *sreq, *new;
- int done;
-
- /* set up the linked list */
- config = radconfig;
-
- if (config == NULL) {
- warn("no configuration file");
- return(-2);
- } else {
- /* setting sreq to NULL guarantees reqtop will be properly set later */
- sreq = NULL;
- reqtop = NULL;
- }
-
- while (config != NULL){
- new = xmalloc(sizeof(sending_t));
- new->next = NULL;
-
- if (sreq == NULL){
- reqtop = new;
- sreq = new;
- } else {
- sreq->next = new;
- sreq = sreq->next;
- }
- req_copyto(req, sreq);
-
- /* first, build the sockaddrs */
- memset(&sinl, '\0', sizeof(sinl));
- memset(&sreq->sinr, '\0', sizeof(sreq->sinr));
- sinl.sin_family = AF_INET;
- sreq->sinr.sin_family = AF_INET;
- if (config->lochost == NULL) {
- if (gethostname(hostname, sizeof(hostname)) != 0) {
- syswarn("cannot get local hostname");
- return(-2);
- }
- config->lochost = xstrdup(hostname);
- }
- if (config->lochost) {
- if (inet_aton(config->lochost, &sinl.sin_addr) != 1) {
- if ((hent = gethostbyname(config->lochost)) == NULL) {
- warn("cannot gethostbyname lochost %s", config->lochost);
- return(-2);
- }
- memcpy(&sinl.sin_addr.s_addr, hent->h_addr,
- sizeof(struct in_addr));
- }
- }
- if (inet_aton(config->radhost, &sreq->sinr.sin_addr) != 1) {
- if ((hent = gethostbyname(config->radhost)) == NULL) {
- warn("cannot gethostbyname radhost %s", config->radhost);
- return(-2);
- }
- memcpy(&sreq->sinr.sin_addr.s_addr, hent->h_addr_list[0],
- sizeof(struct in_addr));
- }
-
- if (config->radport)
- sreq->sinr.sin_port = htons(config->radport);
- else
- sreq->sinr.sin_port = htons(PW_AUTH_UDP_PORT);
-
- /* seed the random number generator for the auth vector */
- gettimeofday(&seed, 0);
- srandom((unsigned) seed.tv_sec+seed.tv_usec);
- /* build the visible part of the auth vector randomly */
- for (i = 0; i < AUTH_VECTOR_LEN; i++)
- req.vector[i] = random() % 256;
- strlcpy((char *) secbuf, config->secret, sizeof(secbuf));
- memcpy(secbuf+strlen(config->secret), req.vector, AUTH_VECTOR_LEN);
- md5_hash(secbuf, strlen(config->secret)+AUTH_VECTOR_LEN, digest);
- /* fill in the auth_req data */
- req.code = PW_AUTHENTICATION_REQUEST;
- req.id = 0;
-
- /* bracket the username in the configured prefix/suffix */
- req.data[0] = PW_USER_NAME;
- req.data[1] = 2;
- req.data[2] = '\0';
- if (config->prefix) {
- req.data[1] += strlen(config->prefix);
- strlcat((char *) &req.data[2], config->prefix, sizeof(req.data) - 2);
- }
- req.data[1] += strlen(uname);
- strlcat((char *)&req.data[2], uname, sizeof(req.data) - 2);
- if (!strchr(uname, '@') && config->suffix) {
- req.data[1] += strlen(config->suffix);
- strlcat((char *)&req.data[2], config->suffix, sizeof(req.data) - 2);
- }
- req.datalen = req.data[1];
-
- /* set the password */
- passstart = req.datalen;
- req.data[req.datalen] = PW_PASSWORD;
- /* Null pad the password */
- passlen = (strlen(pass) + 15) / 16;
- passlen *= 16;
- req.data[req.datalen+1] = passlen+2;
- strlcpy((char *)&req.data[req.datalen+2], pass,
- sizeof(req.data) - req.datalen - 2);
- passlen -= strlen(pass);
- while (passlen--)
- req.data[req.datalen+passlen+2+strlen(pass)] = '\0';
- req.datalen += req.data[req.datalen+1];
-
- /* Add NAS_PORT and NAS_IP_ADDRESS into request */
- if ((nvalue = config->locport) == 0)
- nvalue = RADIUS_LOCAL_PORT;
- req.data[req.datalen++] = RAD_NAS_PORT;
- req.data[req.datalen++] = sizeof(nvalue) + 2;
- nvalue = htonl(nvalue);
- memcpy(req.data + req.datalen, &nvalue, sizeof(nvalue));
- req.datalen += sizeof(nvalue);
- req.data[req.datalen++] = RAD_NAS_IP_ADDRESS;
- req.data[req.datalen++] = sizeof(struct in_addr) + 2;
- memcpy(req.data + req.datalen, &sinl.sin_addr.s_addr,
- sizeof(struct in_addr));
- req.datalen += sizeof(struct in_addr);
-
- /* we're only doing authentication */
- req.data[req.datalen] = PW_SERVICE_TYPE;
- req.data[req.datalen+1] = 6;
- req.data[req.datalen+2] = (PW_SERVICE_AUTH_ONLY >> 24) & 0x000000ff;
- req.data[req.datalen+3] = (PW_SERVICE_AUTH_ONLY >> 16) & 0x000000ff;
- req.data[req.datalen+4] = (PW_SERVICE_AUTH_ONLY >> 8) & 0x000000ff;
- req.data[req.datalen+5] = PW_SERVICE_AUTH_ONLY & 0x000000ff;
- req.datalen += req.data[req.datalen+1];
-
- /* filled in the data, now we know what the actual length is. */
- req.length = 4+AUTH_VECTOR_LEN+req.datalen;
-
- /* "encrypt" the password */
- for (i = 0; i < req.data[passstart+1]-2; i += sizeof(HASH)) {
- jlen = sizeof(HASH);
- if (req.data[passstart+1]-(unsigned)i-2 < sizeof(HASH))
- jlen = req.data[passstart+1]-i-2;
- for (j = 0; j < jlen; j++)
- req.data[passstart+2+i+j] ^= digest[j];
- if (jlen == sizeof(HASH)) {
- /* Recalculate the digest from the HASHed previous */
- strlcpy((char *) secbuf, config->secret, sizeof(secbuf));
- memcpy(secbuf+strlen(config->secret), &req.data[passstart+2+i],
- sizeof(HASH));
- md5_hash(secbuf, strlen(config->secret)+sizeof(HASH), digest);
- }
- }
- sreq->reqlen = req.length;
- req.length = htons(req.length);
-
- req_copyfrom(sreq, req);
-
- /* Go to the next record in the list */
- config = config->next;
- }
-
- /* YAYY! The auth_req is ready to go! Build the reply socket and send out
- * the message. */
-
- /* now, build the sockets */
- if ((sock = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
- syswarn("cannot build reply socket");
- return(-1);
- }
- if (bind(sock, (struct sockaddr*) &sinl, sizeof(sinl)) < 0) {
- syswarn("cannot bind reply socket");
- close(sock);
- return(-1);
- }
-
- for(done = 0; authtries > 0 && !done; authtries--) {
- for (config = radconfig, sreq = reqtop; sreq != NULL && !done;
- config = config->next, sreq = sreq->next){
- req_copyto(req, sreq);
-
- /* send out the packet and wait for reply. */
- if (sendto(sock, (char *)&req, sreq->reqlen, 0,
- (struct sockaddr*) &sreq->sinr,
- sizeof (struct sockaddr_in)) < 0) {
- syswarn("cannot send auth_reg");
- close(sock);
- return(-1);
- }
-
- /* wait 5 seconds maximum for a radius reply. */
- now = time(0);
- end = now+5;
- tmout.tv_sec = 6;
- tmout.tv_usec = 0;
- FD_ZERO(&rdfds);
- /* store the old vector to verify next checksum */
- memcpy(secbuf+sizeof(req.vector), req.vector, sizeof(req.vector));
- FD_SET(sock, &rdfds);
- got = select(sock+1, &rdfds, 0, 0, &tmout);
- if (got < 0) {
- syswarn("cannot not select");
- break;
- } else if (got == 0) {
- /* timer ran out */
- now = time(0);
- tmout.tv_sec = end - now + 1;
- tmout.tv_usec = 0;
- continue;
- }
- slen = sizeof(sinl);
- if ((jlen = recvfrom(sock, (char *)&req, sizeof(req)-sizeof(int), 0,
- (struct sockaddr*) &sinl, &slen)) < 0) {
- syswarn("cannot recvfrom");
- break;
- }
- if (!config->ignore_source) {
- if (sinl.sin_addr.s_addr != sreq->sinr.sin_addr.s_addr ||
- (sinl.sin_port != sreq->sinr.sin_port)) {
- warn("received unexpected UDP packet from %s:%d",
- inet_ntoa(sinl.sin_addr), ntohs(sinl.sin_port));
- continue;
- }
- }
- sreq->reqlen = ntohs(req.length);
- if (jlen < 4+AUTH_VECTOR_LEN || jlen != sreq->reqlen) {
- warn("received badly-sized packet");
- continue;
- }
- /* verify the checksum */
- memcpy(((char*)&req)+sreq->reqlen, config->secret, strlen(config->secret));
- memcpy(secbuf, req.vector, sizeof(req.vector));
- memcpy(req.vector, secbuf+sizeof(req.vector), sizeof(req.vector));
- md5_hash((unsigned char *)&req, strlen(config->secret)+sreq->reqlen,
- digest);
- if (memcmp(digest, secbuf, sizeof(HASH)) != 0) {
- warn("checksum didn't match");
- continue;
- }
- /* FINALLY! Got back a known-good packet. See if we're in. */
- close(sock);
- return (req.code == PW_AUTHENTICATION_ACK) ? 0 : -1;
- done = 1;
- req_copyfrom(sreq, req);
- break;
- }
- }
- if (authtries == 0)
- warn("cannot talk to remote radius server %s:%d",
- inet_ntoa(sreq->sinr.sin_addr), ntohs(sreq->sinr.sin_port));
- return(-2);
-}
-
-#define RAD_HAVE_HOST 1
-#define RAD_HAVE_PORT 2
-#define RAD_HAVE_PREFIX 4
-#define RAD_HAVE_SUFFIX 8
-#define RAD_HAVE_LOCHOST 16
-#define RAD_HAVE_LOCPORT 32
-
-int main(int argc, char *argv[])
-{
- int opt;
- int havefile, haveother;
- struct auth_info *authinfo;
- rad_config_t radconfig;
- int retval;
- char *radius_config;
-
- message_program_name = "radius";
-
- if (!innconf_read(NULL))
- exit(1);
-
- memset(&radconfig, '\0', sizeof(rad_config_t));
- haveother = havefile = 0;
-
- while ((opt = getopt(argc, argv, "f:h")) != -1) {
- switch (opt) {
- case 'f':
- if (haveother)
- die("-f flag after another flag");
- if (!havefile) {
- /* override the standard config completely if the user
- * specifies an alternate config file */
- memset(&radconfig, '\0', sizeof(rad_config_t));
- havefile = 1;
- }
- read_config(optarg, &radconfig);
- break;
- case 'h':
- printf("Usage: radius [-f config]\n");
- exit(0);
- }
- }
- if (argc != optind)
- exit(2);
- if (!havefile) {
- radius_config = concatpath(innconf->pathetc, _PATH_RADIUS_CONFIG);
- read_config(radius_config, &radconfig);
-
- free(radius_config);
- }
-
- authinfo = get_auth_info(stdin);
- if (authinfo == NULL)
- die("failed getting auth info");
- if (authinfo->username[0] == '\0')
- die("empty username");
-
- /* got username and password, check that they're valid */
-
- retval = rad_auth(&radconfig, authinfo->username, authinfo->password);
- if (retval == -1)
- die("user %s password doesn't match", authinfo->username);
- else if (retval == -2)
- /* couldn't talk to the radius server.. output logged above. */
- exit(1);
- else if (retval != 0)
- die("unexpected return code from authentication function: %d",
- retval);
-
- /* radius password matches! */
- printf("User:%s\n", authinfo->username);
- exit(0);
-}
~ian / inn-innduct.git / blobdiff