8744b8b8340eb7f4e8314dc2f5910b0ff6d5c9d5
[strongswan.git] / src / libcharon / plugins / eap_radius / eap_radius_dae.c
1 /*
2 * Copyright (C) 2012 Martin Willi
3 * Copyright (C) 2012 revosec AG
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include "eap_radius_dae.h"
17
18 #include "radius_message.h"
19
20 #include <sys/types.h>
21 #include <sys/stat.h>
22 #include <sys/socket.h>
23 #include <unistd.h>
24 #include <errno.h>
25
26 #include <daemon.h>
27 #include <threading/thread.h>
28 #include <processing/jobs/callback_job.h>
29
30 #define RADIUS_DAE_PORT 3799
31
32 typedef struct private_eap_radius_dae_t private_eap_radius_dae_t;
33
34 /**
35 * Private data of an eap_radius_dae_t object.
36 */
37 struct private_eap_radius_dae_t {
38
39 /**
40 * Public eap_radius_dae_t interface.
41 */
42 eap_radius_dae_t public;
43
44 /**
45 * RADIUS session state
46 */
47 eap_radius_accounting_t *accounting;
48
49 /**
50 * Socket to listen on authorization extension port
51 */
52 int fd;
53
54 /**
55 * Listen job
56 */
57 callback_job_t *job;
58
59 /**
60 * RADIUS shared secret for DAE exchanges
61 */
62 chunk_t secret;
63
64 /**
65 * MD5 hasher
66 */
67 hasher_t *hasher;
68
69 /**
70 * HMAC MD5 signer, with secret set
71 */
72 signer_t *signer;
73 };
74
75 /**
76 * Process a DAE disconnect request, send response
77 */
78 static void process_disconnect(private_eap_radius_dae_t *this,
79 radius_message_t *request, struct sockaddr* addr, socklen_t addr_len)
80 {
81 enumerator_t *enumerator, *sa_enum;
82 identification_t *user;
83 linked_list_t *ids;
84 uintptr_t id;
85 ike_sa_t *ike_sa;
86 chunk_t data;
87 host_t *host;
88 int type;
89
90 ids = linked_list_create();
91
92 host = host_create_from_sockaddr(addr);
93 enumerator = request->create_enumerator(request);
94 while (enumerator->enumerate(enumerator, &type, &data))
95 {
96 if (type == RAT_USER_NAME && data.len)
97 {
98 user = identification_create_from_data(data);
99 DBG1(DBG_CFG, "received RADIUS DAE %N for %Y from %H",
100 radius_message_code_names, RMC_DISCONNECT_REQUEST, user, host);
101 sa_enum = charon->ike_sa_manager->create_enumerator(
102 charon->ike_sa_manager, FALSE);
103 while (sa_enum->enumerate(sa_enum, &ike_sa))
104 {
105 if (user->matches(user, ike_sa->get_other_eap_id(ike_sa)))
106 {
107 id = ike_sa->get_unique_id(ike_sa);
108 ids->insert_last(ids, (void*)id);
109 }
110 }
111 sa_enum->destroy(sa_enum);
112 user->destroy(user);
113 }
114 }
115 enumerator->destroy(enumerator);
116 DESTROY_IF(host);
117
118 enumerator = ids->create_enumerator(ids);
119 while (enumerator->enumerate(enumerator, &id))
120 {
121 charon->controller->terminate_ike(charon->controller, id, NULL, NULL, 0);
122 }
123 enumerator->destroy(enumerator);
124
125 ids->destroy(ids);
126 }
127
128 /**
129 * Receive RADIUS DAE requests
130 */
131 static job_requeue_t receive(private_eap_radius_dae_t *this)
132 {
133 struct sockaddr_storage addr;
134 socklen_t addr_len = sizeof(addr);
135 radius_message_t *request;
136 char buf[2048];
137 ssize_t len;
138 bool oldstate;
139
140 oldstate = thread_cancelability(TRUE);
141 len = recvfrom(this->fd, buf, sizeof(buf), 0,
142 (struct sockaddr*)&addr, &addr_len);
143 thread_cancelability(oldstate);
144
145 if (len > 0)
146 {
147 request = radius_message_parse(chunk_create(buf, len));
148 if (request)
149 {
150 if (request->verify(request, NULL, this->secret,
151 this->hasher, this->signer))
152 {
153 switch (request->get_code(request))
154 {
155 case RMC_DISCONNECT_REQUEST:
156 process_disconnect(this, request,
157 (struct sockaddr*)&addr, addr_len);
158 break;
159 case RMC_COA_REQUEST:
160 /* TODO */
161 default:
162 DBG1(DBG_CFG, "ignoring unsupported RADIUS DAE %N "
163 "message", radius_message_code_names,
164 request->get_code(request));
165 break;
166 }
167 }
168 request->destroy(request);
169 }
170 else
171 {
172 DBG1(DBG_NET, "ignoring invalid RADIUS DAE request");
173 }
174 }
175 else
176 {
177 DBG1(DBG_NET, "receving RADIUS DAE request failed: %s", strerror(errno));
178 }
179 return JOB_REQUEUE_DIRECT;
180 }
181
182 /**
183 * Open DAE socket
184 */
185 static bool open_socket(private_eap_radius_dae_t *this)
186 {
187 host_t *host;
188
189 this->fd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
190 if (this->fd == -1)
191 {
192 DBG1(DBG_CFG, "unable to open RADIUS DAE socket: %s", strerror(errno));
193 return FALSE;
194 }
195
196 host = host_create_from_string(
197 lib->settings->get_str(lib->settings,
198 "charon.plugins.eap-radius.dae.listen", "0.0.0.0"),
199 lib->settings->get_int(lib->settings,
200 "charon.plugins.eap-radius.dae.port", RADIUS_DAE_PORT));
201 if (!host)
202 {
203 DBG1(DBG_CFG, "invalid RADIUS DAE listen address");
204 return FALSE;
205 }
206
207 if (bind(this->fd, host->get_sockaddr(host),
208 *host->get_sockaddr_len(host)) == -1)
209 {
210 DBG1(DBG_CFG, "unable to bind RADIUS DAE socket: %s", strerror(errno));
211 host->destroy(host);
212 return FALSE;
213 }
214 host->destroy(host);
215 return TRUE;
216 }
217
218 METHOD(eap_radius_dae_t, destroy, void,
219 private_eap_radius_dae_t *this)
220 {
221 if (this->job)
222 {
223 this->job->cancel(this->job);
224 }
225 if (this->fd != -1)
226 {
227 close(this->fd);
228 }
229 DESTROY_IF(this->signer);
230 DESTROY_IF(this->hasher);
231 free(this);
232 }
233
234 /**
235 * See header
236 */
237 eap_radius_dae_t *eap_radius_dae_create(eap_radius_accounting_t *accounting)
238 {
239 private_eap_radius_dae_t *this;
240
241 INIT(this,
242 .public = {
243 .destroy = _destroy,
244 },
245 .accounting = accounting,
246 .fd = -1,
247 .secret = {
248 .ptr = lib->settings->get_str(lib->settings,
249 "charon.plugins.eap-radius.dae.secret", NULL),
250 },
251 .hasher = lib->crypto->create_hasher(lib->crypto, HASH_MD5),
252 .signer = lib->crypto->create_signer(lib->crypto, AUTH_HMAC_MD5_128),
253 );
254
255 if (!this->hasher || !this->signer)
256 {
257 destroy(this);
258 return NULL;
259 }
260 if (!this->secret.ptr)
261 {
262 DBG1(DBG_CFG, "missing RADIUS DAE secret, disabled");
263 destroy(this);
264 return NULL;
265 }
266 this->secret.len = strlen(this->secret.ptr);
267 this->signer->set_key(this->signer, this->secret);
268
269 if (!open_socket(this))
270 {
271 destroy(this);
272 return NULL;
273 }
274
275 this->job = callback_job_create_with_prio((callback_job_cb_t)receive,
276 this, NULL, NULL, JOB_PRIO_CRITICAL);
277 lib->processor->queue_job(lib->processor, (job_t*)this->job);
278
279 return &this->public;
280 }