eap-radius: do RADIUS/IKE attribute forwarding in XAuth backend
[strongswan.git] / src / libcharon / plugins / eap_radius / eap_radius_xauth.c
1 /*
2 * Copyright (C) 2013 Martin Willi
3 * Copyright (C) 2013 revosec AG
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include "eap_radius_xauth.h"
17 #include "eap_radius_plugin.h"
18 #include "eap_radius.h"
19 #include "eap_radius_forward.h"
20
21 #include <daemon.h>
22 #include <radius_client.h>
23
24
25 typedef struct private_eap_radius_xauth_t private_eap_radius_xauth_t;
26
27 /**
28 * Private data of an eap_radius_xauth_t object.
29 */
30 struct private_eap_radius_xauth_t {
31
32 /**
33 * Public interface.
34 */
35 eap_radius_xauth_t public;
36
37 /**
38 * ID of the server
39 */
40 identification_t *server;
41
42 /**
43 * ID of the peer
44 */
45 identification_t *peer;
46
47 /**
48 * RADIUS connection
49 */
50 radius_client_t *client;
51 };
52
53 METHOD(xauth_method_t, initiate, status_t,
54 private_eap_radius_xauth_t *this, cp_payload_t **out)
55 {
56 cp_payload_t *cp;
57
58 cp = cp_payload_create_type(CONFIGURATION_V1, CFG_REQUEST);
59 cp->add_attribute(cp, configuration_attribute_create_chunk(
60 CONFIGURATION_ATTRIBUTE_V1, XAUTH_USER_NAME, chunk_empty));
61 cp->add_attribute(cp, configuration_attribute_create_chunk(
62 CONFIGURATION_ATTRIBUTE_V1, XAUTH_USER_PASSWORD, chunk_empty));
63 *out = cp;
64 return NEED_MORE;
65 }
66
67 /**
68 * Verify a password using RADIUS User-Name/User-Password attributes
69 */
70 static status_t verify_radius(private_eap_radius_xauth_t *this, chunk_t pass)
71 {
72 radius_message_t *request, *response;
73 status_t status = FAILED;
74
75 request = radius_message_create(RMC_ACCESS_REQUEST);
76 request->add(request, RAT_USER_NAME, this->peer->get_encoding(this->peer));
77 request->add(request, RAT_USER_PASSWORD, pass);
78
79 eap_radius_build_attributes(request);
80 eap_radius_forward_from_ike(request);
81
82 response = this->client->request(this->client, request);
83 if (response)
84 {
85 eap_radius_forward_to_ike(response);
86 switch (response->get_code(response))
87 {
88 case RMC_ACCESS_ACCEPT:
89 eap_radius_process_attributes(response);
90 status = SUCCESS;
91 break;
92 case RMC_ACCESS_CHALLENGE:
93 DBG1(DBG_IKE, "RADIUS Access-Challenge not supported");
94 /* FALL */
95 case RMC_ACCESS_REJECT:
96 default:
97 DBG1(DBG_IKE, "RADIUS authentication of '%Y' failed",
98 this->peer);
99 break;
100 }
101 response->destroy(response);
102 }
103 else
104 {
105 eap_radius_handle_timeout(NULL);
106 }
107 request->destroy(request);
108 return status;
109 }
110
111 METHOD(xauth_method_t, process, status_t,
112 private_eap_radius_xauth_t *this, cp_payload_t *in, cp_payload_t **out)
113 {
114 configuration_attribute_t *attr;
115 enumerator_t *enumerator;
116 identification_t *id;
117 chunk_t user = chunk_empty, pass = chunk_empty;
118
119 enumerator = in->create_attribute_enumerator(in);
120 while (enumerator->enumerate(enumerator, &attr))
121 {
122 switch (attr->get_type(attr))
123 {
124 case XAUTH_USER_NAME:
125 user = attr->get_chunk(attr);
126 break;
127 case XAUTH_USER_PASSWORD:
128 pass = attr->get_chunk(attr);
129 /* trim password to any null termination. As User-Password
130 * uses null padding, we can't have any null in it, and some
131 * clients actually send null terminated strings (Android). */
132 pass.len = strnlen(pass.ptr, pass.len);
133 break;
134 default:
135 break;
136 }
137 }
138 enumerator->destroy(enumerator);
139
140 if (!user.ptr || !pass.ptr)
141 {
142 DBG1(DBG_IKE, "peer did not respond to our XAuth request");
143 return FAILED;
144 }
145 if (user.len)
146 {
147 id = identification_create_from_data(user);
148 if (!id)
149 {
150 DBG1(DBG_IKE, "failed to parse provided XAuth username");
151 return FAILED;
152 }
153 this->peer->destroy(this->peer);
154 this->peer = id;
155 }
156 return verify_radius(this, pass);
157 }
158
159 METHOD(xauth_method_t, get_identity, identification_t*,
160 private_eap_radius_xauth_t *this)
161 {
162 return this->peer;
163 }
164
165 METHOD(xauth_method_t, destroy, void,
166 private_eap_radius_xauth_t *this)
167 {
168 DESTROY_IF(this->client);
169 this->server->destroy(this->server);
170 this->peer->destroy(this->peer);
171 free(this);
172 }
173
174 /*
175 * Described in header.
176 */
177 eap_radius_xauth_t *eap_radius_xauth_create_server(identification_t *server,
178 identification_t *peer)
179 {
180 private_eap_radius_xauth_t *this;
181
182 INIT(this,
183 .public = {
184 .xauth_method = {
185 .initiate = _initiate,
186 .process = _process,
187 .get_identity = _get_identity,
188 .destroy = _destroy,
189 },
190 },
191 .server = server->clone(server),
192 .peer = peer->clone(peer),
193 .client = eap_radius_create_client(),
194 );
195
196 if (!this->client)
197 {
198 destroy(this);
199 return NULL;
200 }
201 return &this->public;
202 }