Moved generic RADIUS protocol support to a dedicated libradius
[strongswan.git] / src / libcharon / plugins / eap_radius / eap_radius.c
1 /*
2 * Copyright (C) 2009 Martin Willi
3 * Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include "eap_radius.h"
17 #include "eap_radius_plugin.h"
18 #include "eap_radius_forward.h"
19
20 #include <radius_message.h>
21 #include <radius_client.h>
22
23 #include <daemon.h>
24
25 #define TUNNEL_TYPE_ESP 9
26
27 typedef struct private_eap_radius_t private_eap_radius_t;
28
29 /**
30 * Private data of an eap_radius_t object.
31 */
32 struct private_eap_radius_t {
33
34 /**
35 * Public authenticator_t interface.
36 */
37 eap_radius_t public;
38
39 /**
40 * ID of the server
41 */
42 identification_t *server;
43
44 /**
45 * ID of the peer
46 */
47 identification_t *peer;
48
49 /**
50 * EAP method type we are proxying
51 */
52 eap_type_t type;
53
54 /**
55 * EAP vendor, if any
56 */
57 u_int32_t vendor;
58
59 /**
60 * EAP message identifier
61 */
62 u_int8_t identifier;
63
64 /**
65 * RADIUS client instance
66 */
67 radius_client_t *client;
68
69 /**
70 * TRUE to use EAP-Start, FALSE to send EAP-Identity Response directly
71 */
72 bool eap_start;
73
74 /**
75 * Prefix to prepend to EAP identity
76 */
77 char *id_prefix;
78
79 /**
80 * Handle the Class attribute as group membership information?
81 */
82 bool class_group;
83
84 /**
85 * Handle the Filter-Id attribute as IPsec CHILD_SA name?
86 */
87 bool filter_id;
88 };
89
90 /**
91 * Add EAP-Identity to RADIUS message
92 */
93 static void add_eap_identity(private_eap_radius_t *this,
94 radius_message_t *request)
95 {
96 struct {
97 /** EAP code (REQUEST/RESPONSE) */
98 u_int8_t code;
99 /** unique message identifier */
100 u_int8_t identifier;
101 /** length of whole message */
102 u_int16_t length;
103 /** EAP type */
104 u_int8_t type;
105 /** identity data */
106 u_int8_t data[];
107 } __attribute__((__packed__)) *hdr;
108 chunk_t id, prefix;
109 size_t len;
110
111 id = this->peer->get_encoding(this->peer);
112 prefix = chunk_create(this->id_prefix, strlen(this->id_prefix));
113 len = sizeof(*hdr) + prefix.len + id.len;
114
115 hdr = alloca(len);
116 hdr->code = EAP_RESPONSE;
117 hdr->identifier = this->identifier;
118 hdr->length = htons(len);
119 hdr->type = EAP_IDENTITY;
120 memcpy(hdr->data, prefix.ptr, prefix.len);
121 memcpy(hdr->data + prefix.len, id.ptr, id.len);
122
123 request->add(request, RAT_EAP_MESSAGE, chunk_create((u_char*)hdr, len));
124 }
125
126 /**
127 * Copy EAP-Message attribute from RADIUS message to an new EAP payload
128 */
129 static bool radius2ike(private_eap_radius_t *this,
130 radius_message_t *msg, eap_payload_t **out)
131 {
132 enumerator_t *enumerator;
133 eap_payload_t *payload;
134 chunk_t data, message = chunk_empty;
135 int type;
136
137 enumerator = msg->create_enumerator(msg);
138 while (enumerator->enumerate(enumerator, &type, &data))
139 {
140 if (type == RAT_EAP_MESSAGE && data.len)
141 {
142 message = chunk_cat("mc", message, data);
143 }
144 }
145 enumerator->destroy(enumerator);
146 if (message.len)
147 {
148 *out = payload = eap_payload_create_data(message);
149
150 /* apply EAP method selected by RADIUS server */
151 this->type = payload->get_type(payload, &this->vendor);
152
153 DBG3(DBG_IKE, "%N payload %B", eap_type_names, this->type, &message);
154 free(message.ptr);
155 return TRUE;
156 }
157 return FALSE;
158 }
159
160 METHOD(eap_method_t, initiate, status_t,
161 private_eap_radius_t *this, eap_payload_t **out)
162 {
163 radius_message_t *request, *response;
164 status_t status = FAILED;
165 chunk_t username;
166
167 request = radius_message_create(RMC_ACCESS_REQUEST);
168 username = chunk_create(this->id_prefix, strlen(this->id_prefix));
169 username = chunk_cata("cc", username, this->peer->get_encoding(this->peer));
170 request->add(request, RAT_USER_NAME, username);
171
172 if (this->eap_start)
173 {
174 request->add(request, RAT_EAP_MESSAGE, chunk_empty);
175 }
176 else
177 {
178 add_eap_identity(this, request);
179 }
180 eap_radius_forward_from_ike(request);
181
182 response = this->client->request(this->client, request);
183 if (response)
184 {
185 eap_radius_forward_to_ike(response);
186 if (radius2ike(this, response, out))
187 {
188 status = NEED_MORE;
189 }
190 response->destroy(response);
191 }
192 else
193 {
194 charon->bus->alert(charon->bus, ALERT_RADIUS_NOT_RESPONDING);
195 }
196 request->destroy(request);
197 return status;
198 }
199
200 /**
201 * Handle the Class attribute as group membership information
202 */
203 static void process_class(private_eap_radius_t *this, radius_message_t *msg)
204 {
205 enumerator_t *enumerator;
206 chunk_t data;
207 int type;
208
209 enumerator = msg->create_enumerator(msg);
210 while (enumerator->enumerate(enumerator, &type, &data))
211 {
212 if (type == RAT_CLASS)
213 {
214 identification_t *id;
215 ike_sa_t *ike_sa;
216 auth_cfg_t *auth;
217
218 if (data.len >= 44)
219 { /* quirk: ignore long class attributes, these are used for
220 * other purposes by some RADIUS servers (such as NPS). */
221 continue;
222 }
223
224 ike_sa = charon->bus->get_sa(charon->bus);
225 if (ike_sa)
226 {
227 auth = ike_sa->get_auth_cfg(ike_sa, FALSE);
228 id = identification_create_from_data(data);
229 DBG1(DBG_CFG, "received group membership '%Y' from RADIUS", id);
230 auth->add(auth, AUTH_RULE_GROUP, id);
231 }
232 }
233 }
234 enumerator->destroy(enumerator);
235 }
236
237 /**
238 * Handle the Filter-Id attribute as IPsec CHILD_SA name
239 */
240 static void process_filter_id(private_eap_radius_t *this, radius_message_t *msg)
241 {
242 enumerator_t *enumerator;
243 int type;
244 u_int8_t tunnel_tag;
245 u_int32_t tunnel_type;
246 chunk_t filter_id = chunk_empty, data;
247 bool is_esp_tunnel = FALSE;
248
249 enumerator = msg->create_enumerator(msg);
250 while (enumerator->enumerate(enumerator, &type, &data))
251 {
252 switch (type)
253 {
254 case RAT_TUNNEL_TYPE:
255 if (data.len != 4)
256 {
257 continue;
258 }
259 tunnel_tag = *data.ptr;
260 *data.ptr = 0x00;
261 tunnel_type = untoh32(data.ptr);
262 DBG1(DBG_IKE, "received RADIUS attribute Tunnel-Type: "
263 "tag = %u, value = %u", tunnel_tag, tunnel_type);
264 is_esp_tunnel = (tunnel_type == TUNNEL_TYPE_ESP);
265 break;
266 case RAT_FILTER_ID:
267 filter_id = data;
268 DBG1(DBG_IKE, "received RADIUS attribute Filter-Id: "
269 "'%.*s'", filter_id.len, filter_id.ptr);
270 break;
271 default:
272 break;
273 }
274 }
275 enumerator->destroy(enumerator);
276
277 if (is_esp_tunnel && filter_id.len)
278 {
279 identification_t *id;
280 ike_sa_t *ike_sa;
281 auth_cfg_t *auth;
282
283 ike_sa = charon->bus->get_sa(charon->bus);
284 if (ike_sa)
285 {
286 auth = ike_sa->get_auth_cfg(ike_sa, FALSE);
287 id = identification_create_from_data(filter_id);
288 auth->add(auth, AUTH_RULE_GROUP, id);
289 }
290 }
291 }
292
293 /**
294 * Handle Session-Timeout attribte
295 */
296 static void process_timeout(private_eap_radius_t *this, radius_message_t *msg)
297 {
298 enumerator_t *enumerator;
299 ike_sa_t *ike_sa;
300 chunk_t data;
301 int type;
302
303 enumerator = msg->create_enumerator(msg);
304 while (enumerator->enumerate(enumerator, &type, &data))
305 {
306 if (type == RAT_SESSION_TIMEOUT && data.len == 4)
307 {
308 ike_sa = charon->bus->get_sa(charon->bus);
309 if (ike_sa)
310 {
311 ike_sa->set_auth_lifetime(ike_sa, untoh32(data.ptr));
312 }
313 }
314 }
315 enumerator->destroy(enumerator);
316 }
317
318 METHOD(eap_method_t, process, status_t,
319 private_eap_radius_t *this, eap_payload_t *in, eap_payload_t **out)
320 {
321 radius_message_t *request, *response;
322 status_t status = FAILED;
323 chunk_t data;
324
325 request = radius_message_create(RMC_ACCESS_REQUEST);
326 request->add(request, RAT_USER_NAME, this->peer->get_encoding(this->peer));
327 data = in->get_data(in);
328 DBG3(DBG_IKE, "%N payload %B", eap_type_names, this->type, &data);
329
330 /* fragment data suitable for RADIUS (not more than 253 bytes) */
331 while (data.len > 253)
332 {
333 request->add(request, RAT_EAP_MESSAGE, chunk_create(data.ptr, 253));
334 data = chunk_skip(data, 253);
335 }
336 request->add(request, RAT_EAP_MESSAGE, data);
337
338 eap_radius_forward_from_ike(request);
339 response = this->client->request(this->client, request);
340 if (response)
341 {
342 eap_radius_forward_to_ike(response);
343 switch (response->get_code(response))
344 {
345 case RMC_ACCESS_CHALLENGE:
346 if (radius2ike(this, response, out))
347 {
348 status = NEED_MORE;
349 break;
350 }
351 status = FAILED;
352 break;
353 case RMC_ACCESS_ACCEPT:
354 if (this->class_group)
355 {
356 process_class(this, response);
357 }
358 if (this->filter_id)
359 {
360 process_filter_id(this, response);
361 }
362 process_timeout(this, response);
363 DBG1(DBG_IKE, "RADIUS authentication of '%Y' successful",
364 this->peer);
365 status = SUCCESS;
366 break;
367 case RMC_ACCESS_REJECT:
368 default:
369 DBG1(DBG_IKE, "RADIUS authentication of '%Y' failed", this->peer);
370 status = FAILED;
371 break;
372 }
373 response->destroy(response);
374 }
375 request->destroy(request);
376 return status;
377 }
378
379 METHOD(eap_method_t, get_type, eap_type_t,
380 private_eap_radius_t *this, u_int32_t *vendor)
381 {
382 *vendor = this->vendor;
383 return this->type;
384 }
385
386 METHOD(eap_method_t, get_msk, status_t,
387 private_eap_radius_t *this, chunk_t *out)
388 {
389 chunk_t msk;
390
391 msk = this->client->get_msk(this->client);
392 if (msk.len)
393 {
394 *out = msk;
395 return SUCCESS;
396 }
397 return FAILED;
398 }
399
400 METHOD(eap_method_t, get_identifier, u_int8_t,
401 private_eap_radius_t *this)
402 {
403 return this->identifier;
404 }
405
406 METHOD(eap_method_t, set_identifier, void,
407 private_eap_radius_t *this, u_int8_t identifier)
408 {
409 this->identifier = identifier;
410 }
411
412 METHOD(eap_method_t, is_mutual, bool,
413 private_eap_radius_t *this)
414 {
415 switch (this->type)
416 {
417 case EAP_AKA:
418 case EAP_SIM:
419 return TRUE;
420 default:
421 return FALSE;
422 }
423 }
424
425 METHOD(eap_method_t, destroy, void,
426 private_eap_radius_t *this)
427 {
428 this->peer->destroy(this->peer);
429 this->server->destroy(this->server);
430 this->client->destroy(this->client);
431 free(this);
432 }
433
434 /**
435 * Generic constructor
436 */
437 eap_radius_t *eap_radius_create(identification_t *server, identification_t *peer)
438 {
439 private_eap_radius_t *this;
440
441 INIT(this,
442 .public = {
443 .eap_method = {
444 .initiate = _initiate,
445 .process = _process,
446 .get_type = _get_type,
447 .is_mutual = _is_mutual,
448 .get_msk = _get_msk,
449 .get_identifier = _get_identifier,
450 .set_identifier = _set_identifier,
451 .destroy = _destroy,
452 },
453 },
454 /* initially EAP_RADIUS, but is set to the method selected by RADIUS */
455 .type = EAP_RADIUS,
456 .eap_start = lib->settings->get_bool(lib->settings,
457 "charon.plugins.eap-radius.eap_start", FALSE),
458 .id_prefix = lib->settings->get_str(lib->settings,
459 "charon.plugins.eap-radius.id_prefix", ""),
460 .class_group = lib->settings->get_bool(lib->settings,
461 "charon.plugins.eap-radius.class_group", FALSE),
462 .filter_id = lib->settings->get_bool(lib->settings,
463 "charon.plugins.eap-radius.filter_id", FALSE),
464
465 );
466 this->client = eap_radius_create_client();
467 if (!this->client)
468 {
469 free(this);
470 return NULL;
471 }
472 this->peer = peer->clone(peer);
473 this->server = server->clone(server);
474 return &this->public;
475 }
476