src/lib/radius.c

   1 /*
   2  * radius.c     Functions to send/receive radius packets.
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This library is free software; you can redistribute it and/or
   7  *   modify it under the terms of the GNU Lesser General Public
   8  *   License as published by the Free Software Foundation; either
   9  *   version 2.1 of the License, or (at your option) any later version.
  10  *
  11  *   This library is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14  *   Lesser General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU Lesser General Public
  17  *   License along with this library; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2000-2003,2006  The FreeRADIUS server project
  21  */
  22
  23 #include        <freeradius-devel/ident.h>
  24 RCSID("$Id$")
  25
  26 #include        <freeradius-devel/autoconf.h>
  27 #include        <freeradius-devel/md5.h>
  28
  29 #include        <stdlib.h>
  30
  31 #ifdef HAVE_UNISTD_H
  32 #include        <unistd.h>
  33 #endif
  34
  35 #include        <fcntl.h>
  36 #include        <ctype.h>
  37
  38 #ifdef WITH_UDPFROMTO
  39 #include        <freeradius-devel/udpfromto.h>
  40 #endif
  41
  42
  43 #ifdef HAVE_MALLOC_H
  44 #include        <malloc.h>
  45 #endif
  46
  47 #ifdef WIN32
  48 #include        <process.h>
  49 #endif
  50
  51 #include        <freeradius-devel/missing.h>
  52 #include        <freeradius-devel/libradius.h>
  53
  54 /*
  55  *  The RFC says 4096 octets max, and most packets are less than 256.
  56  */
  57 #define MAX_PACKET_LEN 4096
  58
  59 /*
  60  *      The maximum number of attributes which we allow in an incoming
  61  *      request.  If there are more attributes than this, the request
  62  *      is rejected.
  63  *
  64  *      This helps to minimize the potential for a DoS, when an
  65  *      attacker spoofs Access-Request packets, which don't have a
  66  *      Message-Authenticator attribute.  This means that the packet
  67  *      is unsigned, and the attacker can use resources on the server,
  68  *      even if the end request is rejected.
  69  */
  70 int librad_max_attributes = 0;
  71
  72 typedef struct radius_packet_t {
  73   uint8_t       code;
  74   uint8_t       id;
  75   uint8_t       length[2];
  76   uint8_t       vector[AUTH_VECTOR_LEN];
  77   uint8_t       data[1];
  78 } radius_packet_t;
  79
  80 static lrad_randctx lrad_rand_pool;     /* across multiple calls */
  81 static int lrad_rand_initialized = 0;
  82 static unsigned int salt_offset = 0;
  83
  84
  85 #define MAX_PACKET_CODE (52)
  86 static const char *packet_codes[] = {
  87   "",
  88   "Access-Request",
  89   "Access-Accept",
  90   "Access-Reject",
  91   "Accounting-Request",
  92   "Accounting-Response",
  93   "Accounting-Status",
  94   "Password-Request",
  95   "Password-Accept",
  96   "Password-Reject",
  97   "Accounting-Message",
  98   "Access-Challenge",
  99   "Status-Server",
 100   "Status-Client",
 101   "14",
 102   "15",
 103   "16",
 104   "17",
 105   "18",
 106   "19",
 107   "20",
 108   "Resource-Free-Request",
 109   "Resource-Free-Response",
 110   "Resource-Query-Request",
 111   "Resource-Query-Response",
 112   "Alternate-Resource-Reclaim-Request",
 113   "NAS-Reboot-Request",
 114   "NAS-Reboot-Response",
 115   "28",
 116   "Next-Passcode",
 117   "New-Pin",
 118   "Terminate-Session",
 119   "Password-Expired",
 120   "Event-Request",
 121   "Event-Response",
 122   "35",
 123   "36",
 124   "37",
 125   "38",
 126   "39",
 127   "Disconnect-Request",
 128   "Disconnect-ACK",
 129   "Disconnect-NAK",
 130   "CoA-Request",
 131   "CoA-ACK",
 132   "CoA-NAK",
 133   "46",
 134   "47",
 135   "48",
 136   "49",
 137   "IP-Address-Allocate",
 138   "IP-Address-Release"
 139 };
 140
 141
 142 /*
 143  *      Wrapper for sendto which handles sendfromto, IPv6, and all
 144  *      possible combinations.
 145  */
 146 static int rad_sendto(int sockfd, void *data, size_t data_len, int flags,
 147                       lrad_ipaddr_t *src_ipaddr, lrad_ipaddr_t *dst_ipaddr,
 148                       int dst_port)
 149 {
 150         struct sockaddr_storage dst;
 151         socklen_t               sizeof_dst = sizeof(dst);
 152
 153 #ifdef WITH_UDPFROMTO
 154         struct sockaddr_storage src;
 155         socklen_t               sizeof_src = sizeof(src);
 156
 157         memset(&src, 0, sizeof(src));
 158 #endif
 159         memset(&dst, 0, sizeof(dst));
 160
 161         /*
 162          *      IPv4 is supported.
 163          */
 164         if (dst_ipaddr->af == AF_INET) {
 165                 struct sockaddr_in      *s4;
 166
 167                 s4 = (struct sockaddr_in *)&dst;
 168                 sizeof_dst = sizeof(struct sockaddr_in);
 169
 170                 s4->sin_family = AF_INET;
 171                 s4->sin_addr = dst_ipaddr->ipaddr.ip4addr;
 172                 s4->sin_port = htons(dst_port);
 173
 174 #ifdef WITH_UDPFROMTO
 175                 s4 = (struct sockaddr_in *)&src;
 176                 sizeof_src = sizeof(struct sockaddr_in);
 177
 178                 s4->sin_family = AF_INET;
 179                 s4->sin_addr = src_ipaddr->ipaddr.ip4addr;
 180 #endif
 181
 182         /*
 183          *      IPv6 MAY be supported.
 184          */
 185 #ifdef HAVE_STRUCT_SOCKADDR_IN6
 186         } else if (dst_ipaddr->af == AF_INET6) {
 187                 struct sockaddr_in6     *s6;
 188
 189                 s6 = (struct sockaddr_in6 *)&dst;
 190                 sizeof_dst = sizeof(struct sockaddr_in6);
 191
 192                 s6->sin6_family = AF_INET6;
 193                 s6->sin6_addr = dst_ipaddr->ipaddr.ip6addr;
 194                 s6->sin6_port = htons(dst_port);
 195
 196 #ifdef WITH_UDPFROMTO
 197                 return -1;      /* UDPFROMTO && IPv6 are not supported */
 198 #if 0
 199                 s6 = (struct sockaddr_in6 *)&src;
 200                 sizeof_src = sizeof(struct sockaddr_in6);
 201
 202                 s6->sin6_family = AF_INET6;
 203                 s6->sin6_addr = src_ipaddr->ipaddr.ip6addr;
 204 #endif /* #if 0 */
 205 #endif /* WITH_UDPFROMTO */
 206 #endif /* HAVE_STRUCT_SOCKADDR_IN6 */
 207         } else return -1;   /* Unknown address family, Die Die Die! */
 208
 209 #ifdef WITH_UDPFROMTO
 210         /*
 211          *      Only IPv4 is supported for udpfromto.
 212          *
 213          *      And if they don't specify a source IP address, don't
 214          *      use udpfromto.
 215          */
 216         if ((dst_ipaddr->af == AF_INET) ||
 217             (src_ipaddr->af != AF_UNSPEC)) {
 218                 return sendfromto(sockfd, data, data_len, flags,
 219                                   (struct sockaddr *)&src, sizeof_src,
 220                                   (struct sockaddr *)&dst, sizeof_dst);
 221         }
 222 #else
 223         src_ipaddr = src_ipaddr; /* -Wunused */
 224 #endif
 225
 226         /*
 227          *      No udpfromto, OR an IPv6 socket, fail gracefully.
 228          */
 229         return sendto(sockfd, data, data_len, flags,
 230                       (struct sockaddr *)&dst, sizeof_dst);
 231 }
 232
 233
 234 /*
 235  *      Wrapper for recvfrom, which handles recvfromto, IPv6, and all
 236  *      possible combinations.
 237  */
 238 static ssize_t rad_recvfrom(int sockfd, uint8_t **pbuf, int flags,
 239                             lrad_ipaddr_t *src_ipaddr, uint16_t *src_port,
 240                             lrad_ipaddr_t *dst_ipaddr, uint16_t *dst_port)
 241 {
 242         struct sockaddr_storage src;
 243         struct sockaddr_storage dst;
 244         socklen_t               sizeof_src = sizeof(src);
 245         socklen_t               sizeof_dst = sizeof(dst);
 246         ssize_t                 data_len;
 247         uint8_t                 header[4];
 248         void                    *buf;
 249         size_t                  len;
 250
 251         memset(&src, 0, sizeof_src);
 252         memset(&dst, 0, sizeof_dst);
 253
 254         /*
 255          *      Get address family, etc. first, so we know if we
 256          *      need to do udpfromto.
 257          *
 258          *      FIXME: udpfromto also does this, but it's not
 259          *      a critical problem.
 260          */
 261         if (getsockname(sockfd, (struct sockaddr *)&dst,
 262                         &sizeof_dst) < 0) return -1;
 263
 264         /*
 265          *      Read the length of the packet, from the packet.
 266          *      This lets us allocate the buffer to use for
 267          *      reading the rest of the packet.
 268          */
 269         data_len = recvfrom(sockfd, header, sizeof(header), MSG_PEEK,
 270                             (struct sockaddr *)&src, &sizeof_src);
 271         if (data_len < 0) return -1;
 272
 273         /*
 274          *      Too little data is available, round it up to 4 bytes.
 275          */
 276         if (data_len < 4) {
 277                 len = 4;
 278         } else {                /* we got 4 bytes of data. */
 279                 /*
 280                  *      See how long the packet says it is.
 281                  */
 282                 len = (header[2] * 256) + header[3];
 283
 284                 /*
 285                  *      Too short: read 4 bytes, and discard the rest.
 286                  */
 287                 if (len < 4) {
 288                         len = 4;
 289
 290                         /*
 291                          *      Enforce RFC requirements, for sanity.
 292                          *      Anything after 4k will be discarded.
 293                          */
 294                 } else if (len > MAX_PACKET_LEN) {
 295                         len = MAX_PACKET_LEN;
 296                 }
 297         }
 298
 299         buf = malloc(len);
 300         if (!buf) return -1;
 301
 302         /*
 303          *      Receive the packet.  The OS will discard any data in the
 304          *      packet after "len" bytes.
 305          */
 306 #ifdef WITH_UDPFROMTO
 307         if (dst.ss_family == AF_INET) {
 308                 data_len = recvfromto(sockfd, buf, len, flags,
 309                                       (struct sockaddr *)&src, &sizeof_src,
 310                                       (struct sockaddr *)&dst, &sizeof_dst);
 311         } else
 312 #endif
 313                 /*
 314                  *      No udpfromto, OR an IPv6 socket.  Fail gracefully.
 315                  */
 316                 data_len = recvfrom(sockfd, buf, len, flags,
 317                                     (struct sockaddr *)&src, &sizeof_src);
 318         if (data_len < 0) {
 319                 free(buf);
 320                 return data_len;
 321         }
 322
 323         /*
 324          *      Check address families, and update src/dst ports, etc.
 325          */
 326         if (src.ss_family == AF_INET) {
 327                 struct sockaddr_in      *s4;
 328
 329                 s4 = (struct sockaddr_in *)&src;
 330                 src_ipaddr->af = AF_INET;
 331                 src_ipaddr->ipaddr.ip4addr = s4->sin_addr;
 332                 *src_port = ntohs(s4->sin_port);
 333
 334                 s4 = (struct sockaddr_in *)&dst;
 335                 dst_ipaddr->af = AF_INET;
 336                 dst_ipaddr->ipaddr.ip4addr = s4->sin_addr;
 337                 *dst_port = ntohs(s4->sin_port);
 338
 339 #ifdef HAVE_STRUCT_SOCKADDR_IN6
 340         } else if (src.ss_family == AF_INET6) {
 341                 struct sockaddr_in6     *s6;
 342
 343                 s6 = (struct sockaddr_in6 *)&src;
 344                 src_ipaddr->af = AF_INET6;
 345                 src_ipaddr->ipaddr.ip6addr = s6->sin6_addr;
 346                 *src_port = ntohs(s6->sin6_port);
 347
 348                 s6 = (struct sockaddr_in6 *)&dst;
 349                 dst_ipaddr->af = AF_INET6;
 350                 dst_ipaddr->ipaddr.ip6addr = s6->sin6_addr;
 351                 *dst_port = ntohs(s6->sin6_port);
 352 #endif
 353         } else {
 354                 free(buf);
 355                 return -1;      /* Unknown address family, Die Die Die! */
 356         }
 357
 358         /*
 359          *      Different address families should never happen.
 360          */
 361         if (src.ss_family != dst.ss_family) {
 362                 free(buf);
 363                 return -1;
 364         }
 365
 366         /*
 367          *      Tell the caller about the data
 368          */
 369         *pbuf = buf;
 370
 371         return data_len;
 372 }
 373
 374
 375 #define AUTH_PASS_LEN (AUTH_VECTOR_LEN)
 376 /*************************************************************************
 377  *
 378  *      Function: make_secret
 379  *
 380  *      Purpose: Build an encrypted secret value to return in a reply
 381  *               packet.  The secret is hidden by xoring with a MD5 digest
 382  *               created from the shared secret and the authentication
 383  *               vector.  We put them into MD5 in the reverse order from
 384  *               that used when encrypting passwords to RADIUS.
 385  *
 386  *************************************************************************/
 387 static void make_secret(uint8_t *digest, const uint8_t *vector,
 388                         const char *secret, const uint8_t *value)
 389 {
 390         lrad_MD5_CTX context;
 391         int             i;
 392
 393         lrad_MD5Init(&context);
 394         lrad_MD5Update(&context, vector, AUTH_VECTOR_LEN);
 395         lrad_MD5Update(&context, secret, strlen(secret));
 396         lrad_MD5Final(digest, &context);
 397
 398         for ( i = 0; i < AUTH_VECTOR_LEN; i++ ) {
 399                 digest[i] ^= value[i];
 400         }
 401 }
 402
 403 #define MAX_PASS_LEN (128)
 404 static void make_passwd(uint8_t *output, int *outlen,
 405                         const uint8_t *input, int inlen,
 406                         const char *secret, const uint8_t *vector)
 407 {
 408         lrad_MD5_CTX context, old;
 409         uint8_t digest[AUTH_VECTOR_LEN];
 410         uint8_t passwd[MAX_PASS_LEN];
 411         int     i, n;
 412         int     len;
 413
 414         /*
 415          *      If the length is zero, round it up.
 416          */
 417         len = inlen;
 418         if (len == 0) {
 419                 len = AUTH_PASS_LEN;
 420         }
 421         else if (len > MAX_PASS_LEN) len = MAX_PASS_LEN;
 422
 423         else if ((len & 0x0f) != 0) {
 424                 len += 0x0f;
 425                 len &= ~0x0f;
 426         }
 427         *outlen = len;
 428
 429         memcpy(passwd, input, len);
 430         memset(passwd + len, 0, sizeof(passwd) - len);
 431
 432         lrad_MD5Init(&context);
 433         lrad_MD5Update(&context, secret, strlen(secret));
 434         old = context;
 435
 436         /*
 437          *      Do first pass.
 438          */
 439         lrad_MD5Update(&context, vector, AUTH_PASS_LEN);
 440
 441         for (n = 0; n < len; n += AUTH_PASS_LEN) {
 442                 if (n > 0) {
 443                         context = old;
 444                         lrad_MD5Update(&context,
 445                                        passwd + n - AUTH_PASS_LEN,
 446                                        AUTH_PASS_LEN);
 447                 }
 448
 449                 lrad_MD5Final(digest, &context);
 450                 for (i = 0; i < AUTH_PASS_LEN; i++) {
 451                         passwd[i + n] ^= digest[i];
 452                 }
 453         }
 454
 455         memcpy(output, passwd, len);
 456 }
 457
 458 static void make_tunnel_passwd(uint8_t *output, int *outlen,
 459                                const uint8_t *input, int inlen, int room,
 460                                const char *secret, const uint8_t *vector)
 461 {
 462         lrad_MD5_CTX context, old;
 463         uint8_t digest[AUTH_VECTOR_LEN];
 464         uint8_t passwd[MAX_STRING_LEN + AUTH_VECTOR_LEN];
 465         int     i, n;
 466         int     len;
 467
 468         /*
 469          *      Be paranoid.
 470          */
 471         if (room > 253) room = 253;
 472
 473         /*
 474          *      Account for 2 bytes of the salt, and round the room
 475          *      available down to the nearest multiple of 16.  Then,
 476          *      subtract one from that to account for the length byte,
 477          *      and the resulting number is the upper bound on the data
 478          *      to copy.
 479          *
 480          *      We could short-cut this calculation just be forcing
 481          *      inlen to be no more than 239.  It would work for all
 482          *      VSA's, as we don't pack multiple VSA's into one
 483          *      attribute.
 484          *
 485          *      However, this calculation is more general, if a little
 486          *      complex.  And it will work in the future for all possible
 487          *      kinds of weird attribute packing.
 488          */
 489         room -= 2;
 490         room -= (room & 0x0f);
 491         room--;
 492
 493         if (inlen > room) inlen = room;
 494
 495         /*
 496          *      Length of the encrypted data is password length plus
 497          *      one byte for the length of the password.
 498          */
 499         len = inlen + 1;
 500         if ((len & 0x0f) != 0) {
 501                 len += 0x0f;
 502                 len &= ~0x0f;
 503         }
 504         *outlen = len + 2;      /* account for the salt */
 505
 506         /*
 507          *      Copy the password over.
 508          */
 509         memcpy(passwd + 3, input, inlen);
 510         memset(passwd + 3 + inlen, 0, sizeof(passwd) - 3 - inlen);
 511
 512         /*
 513          *      Generate salt.  The RFC's say:
 514          *
 515          *      The high bit of salt[0] must be set, each salt in a
 516          *      packet should be unique, and they should be random
 517          *
 518          *      So, we set the high bit, add in a counter, and then
 519          *      add in some CSPRNG data.  should be OK..
 520          */
 521         passwd[0] = (0x80 | ( ((salt_offset++) & 0x0f) << 3) |
 522                      (lrad_rand() & 0x07));
 523         passwd[1] = lrad_rand();
 524         passwd[2] = inlen;      /* length of the password string */
 525
 526         lrad_MD5Init(&context);
 527         lrad_MD5Update(&context, secret, strlen(secret));
 528         old = context;
 529
 530         lrad_MD5Update(&context, vector, AUTH_VECTOR_LEN);
 531         lrad_MD5Update(&context, &passwd[0], 2);
 532
 533         for (n = 0; n < len; n += AUTH_PASS_LEN) {
 534                 if (n > 0) {
 535                         context = old;
 536                         lrad_MD5Update(&context,
 537                                        passwd + 2 + n - AUTH_PASS_LEN,
 538                                        AUTH_PASS_LEN);
 539                 }
 540
 541                 lrad_MD5Final(digest, &context);
 542                 for (i = 0; i < AUTH_PASS_LEN; i++) {
 543                         passwd[i + 2 + n] ^= digest[i];
 544                 }
 545         }
 546         memcpy(output, passwd, len + 2);
 547 }
 548
 549 /*
 550  *      Hack for IETF RADEXT.  Don't use in a production environment!
 551  *
 552  *      FIXME: Pack multiple diameter attributes into one
 553  *      Extended-Attribute!
 554  */
 555 static int vp2diameter(const RADIUS_PACKET *packet,
 556                        const RADIUS_PACKET *original, const char *secret,
 557                        const VALUE_PAIR *vp, uint8_t *ptr)
 558 {
 559         uint32_t attr;
 560         uint32_t length = vp->length;
 561         uint32_t vendor;
 562         int total, align;
 563         uint8_t *length_ptr;
 564
 565         *(ptr++) = PW_EXTENDED_ATTRIBUTE;
 566         length_ptr = ptr++;     /* fill this in later. */
 567         total = 2;
 568
 569         attr = vp->attribute;
 570         attr &= ~(1 << 31);     /* implemented limitations, see dict_addattr */
 571         vendor = VENDOR(attr);
 572         attr = attr & 0xffff;
 573         attr = ntohl(attr);
 574
 575         memcpy(ptr, &attr, sizeof(attr));
 576         ptr += 4;
 577         total += 4;
 578         length += 8;           /* includes 8 bytes of attr & length */
 579         align = 0;              /* no padding */
 580
 581         if (vendor != 0) {
 582                 length += 4; /* include 4 bytes of vendor */
 583
 584                 length |= (1 << 31);
 585                 length = ntohl(length);
 586                 memcpy(ptr, &length, sizeof(length));
 587                 ptr += 4;
 588                 total += 4;
 589
 590                 vendor = ntohl(vendor);
 591                 memcpy(ptr, &vendor, sizeof(vendor));
 592                 ptr += 4;
 593                 total += 4;
 594         } else {
 595                 length = ntohl(length);
 596                 memcpy(ptr, &length, sizeof(length));
 597                 ptr += 4;
 598                 total += 4;
 599         }
 600         *length_ptr = total;
 601
 602         switch (vp->type) {
 603         case PW_TYPE_INTEGER:
 604         case PW_TYPE_DATE:
 605                 attr = ntohl(vp->lvalue); /* stored in host order */
 606                 memcpy(ptr, &attr, sizeof(attr));
 607                 length = 4;
 608                 break;
 609
 610         case PW_TYPE_IPADDR:
 611                 attr = vp->lvalue; /* stored in network order */
 612                 memcpy(ptr, &attr, sizeof(attr));
 613                 length = 4;
 614                 break;
 615
 616         case PW_TYPE_IFID:
 617         case PW_TYPE_IPV6ADDR:
 618         case PW_TYPE_IPV6PREFIX:
 619         case PW_TYPE_ABINARY:
 620                 memcpy(ptr, vp->vp_strvalue, vp->length);
 621                 length = vp->length;
 622                 if ((length & 0x03) != 0) align = 4 - (length & 0x03);
 623                 break;
 624
 625                 /*
 626                  *      Length MAY be larger than can fit into the
 627                  *      encapsulating attribute!
 628                  */
 629         case PW_TYPE_STRING:
 630         case PW_TYPE_OCTETS:
 631         default:
 632                 {
 633                         uint32_t offset = 0;
 634
 635                         length = vp->length;
 636                         if ((length & 0x03) != 0) align = 4 - (length & 0x03);
 637
 638                         if (total + length > 255) {
 639                                 *length_ptr = 255;
 640                                 offset = 255 - total;
 641
 642                                 memcpy(ptr, vp->vp_octets, offset);
 643                                 ptr += offset;
 644                                 *(ptr++) = PW_EXTENDED_ATTRIBUTE;
 645                                 length_ptr = ptr++;
 646                                 *length_ptr = 2;
 647                                 length -= offset;
 648
 649                                 total += offset + 2;
 650                         }
 651
 652                         memcpy(ptr, vp->vp_octets + offset, length);
 653                 }
 654                 break;
 655         }
 656
 657         /*
 658          *      Skip to the end of the data.
 659          */
 660         ptr += length;
 661         total += length;
 662         *length_ptr += length;
 663
 664         /*
 665          *      Align the data to a multiple of 4 bytes.
 666          */
 667         if (align != 0) {
 668                 unsigned int i;
 669
 670                 *length_ptr += align;
 671                 for (i = 0; i < align; i++) {
 672                         *(ptr++) = '\0';
 673                         total++;
 674                 }
 675         }
 676
 677         return total;
 678 }
 679
 680
 681 /*
 682  *      Parse a data structure into a RADIUS attribute.
 683  */
 684 int rad_vp2attr(const RADIUS_PACKET *packet, const RADIUS_PACKET *original,
 685                 const char *secret, const VALUE_PAIR *vp, uint8_t *ptr)
 686 {
 687         int             vendorcode;
 688         int             offset, len, total_length;
 689         uint32_t        lvalue;
 690         uint8_t         *length_ptr, *vsa_length_ptr;
 691         const uint8_t   *data = NULL;
 692         uint8_t         array[4];
 693
 694         vendorcode = total_length = 0;
 695         length_ptr = vsa_length_ptr = NULL;
 696
 697         /*
 698          *      For interoperability, always put vendor attributes
 699          *      into their own VSA.
 700          */
 701         if ((vendorcode = VENDOR(vp->attribute)) == 0) {
 702                 *(ptr++) = vp->attribute & 0xFF;
 703                 length_ptr = ptr;
 704                 *(ptr++) = 2;
 705                 total_length += 2;
 706
 707         } else {
 708                 int vsa_tlen = 1;
 709                 int vsa_llen = 1;
 710                 DICT_VENDOR *dv = dict_vendorbyvalue(vendorcode);
 711
 712                 /*
 713                  *      This must be an RFC-format attribute.  If it
 714                  *      wasn't, then the "decode" function would have
 715                  *      made a Vendor-Specific attribute (i.e. type
 716                  *      26), and we would have "vendorcode == 0" here.
 717                  */
 718                 if (dv) {
 719                         vsa_tlen = dv->type;
 720                         vsa_llen = dv->length;
 721                 }
 722
 723                 /*
 724                  *      Build a VSA header.
 725                  */
 726                 *ptr++ = PW_VENDOR_SPECIFIC;
 727                 vsa_length_ptr = ptr;
 728                 *ptr++ = 6;
 729                 lvalue = htonl(vendorcode);
 730                 memcpy(ptr, &lvalue, 4);
 731                 ptr += 4;
 732                 total_length += 6;
 733
 734                 switch (vsa_tlen) {
 735                 case 1:
 736                         ptr[0] = (vp->attribute & 0xFF);
 737                         break;
 738
 739                 case 2:
 740                         ptr[0] = ((vp->attribute >> 8) & 0xFF);
 741                         ptr[1] = (vp->attribute & 0xFF);
 742                         break;
 743
 744                 case 4:
 745                         ptr[0] = 0;
 746                         ptr[1] = 0;
 747                         ptr[2] = ((vp->attribute >> 8) & 0xFF);
 748                         ptr[3] = (vp->attribute & 0xFF);
 749                         break;
 750
 751                 default:
 752                         return 0; /* silently discard it */
 753                 }
 754                 ptr += vsa_tlen;
 755
 756                 switch (vsa_llen) {
 757                 case 0:
 758                         length_ptr = vsa_length_ptr;
 759                         vsa_length_ptr = NULL;
 760                         break;
 761                 case 1:
 762                         ptr[0] = 0;
 763                         length_ptr = ptr;
 764                         break;
 765                 case 2:
 766                         ptr[0] = 0;
 767                         ptr[1] = 0;
 768                         length_ptr = ptr + 1;
 769                         break;
 770
 771                 default:
 772                         return 0; /* silently discard it */
 773                 }
 774                 ptr += vsa_llen;
 775
 776                 total_length += vsa_tlen + vsa_llen;
 777                 if (vsa_length_ptr) *vsa_length_ptr += vsa_tlen + vsa_llen;
 778                 *length_ptr += vsa_tlen + vsa_llen;
 779         }
 780
 781         offset = 0;
 782         if (vp->flags.has_tag) {
 783                 if (TAG_VALID(vp->flags.tag)) {
 784                         ptr[0] = vp->flags.tag & 0xff;
 785                         offset = 1;
 786
 787                 } else if (vp->flags.encrypt == FLAG_ENCRYPT_TUNNEL_PASSWORD) {
 788                         /*
 789                          *      Tunnel passwords REQUIRE a tag, even
 790                          *      if don't have a valid tag.
 791                          */
 792                         ptr[0] = 0;
 793                         offset = 1;
 794                 } /* else don't write a tag */
 795         } /* else the attribute doesn't have a tag */
 796
 797         /*
 798          *      Set up the default sources for the data.
 799          */
 800         data = vp->vp_octets;
 801         len = vp->length;
 802
 803         switch(vp->type) {
 804         case PW_TYPE_STRING:
 805         case PW_TYPE_OCTETS:
 806         case PW_TYPE_IFID:
 807         case PW_TYPE_IPV6ADDR:
 808         case PW_TYPE_IPV6PREFIX:
 809         case PW_TYPE_ABINARY:
 810                 /* nothing more to do */
 811                 break;
 812
 813         case PW_TYPE_BYTE:
 814                 len = 1;        /* just in case */
 815                 array[0] = vp->lvalue & 0xff;
 816                 data = array;
 817                 offset = 0;
 818                 break;
 819
 820
 821         case PW_TYPE_SHORT:
 822                 len = 2;        /* just in case */
 823                 array[0] = (vp->lvalue >> 8) & 0xff;
 824                 array[1] = vp->lvalue & 0xff;
 825                 data = array;
 826                 offset = 0;
 827                 break;
 828
 829         case PW_TYPE_INTEGER:
 830                 len = 4;        /* just in case */
 831                 lvalue = htonl(vp->lvalue);
 832                 memcpy(array, &lvalue, sizeof(lvalue));
 833
 834                 /*
 835                  *      Perhaps discard the first octet.
 836                  */
 837                 data = &array[offset];
 838                 len -= offset;
 839                 break;
 840
 841         case PW_TYPE_IPADDR:
 842                 data = (const uint8_t *) &vp->lvalue;
 843                 len = 4;        /* just in case */
 844                 break;
 845
 846                 /*
 847                  *  There are no tagged date attributes.
 848                  */
 849         case PW_TYPE_DATE:
 850                 lvalue = htonl(vp->lvalue);
 851                 data = (const uint8_t *) &lvalue;
 852                 len = 4;        /* just in case */
 853                 break;
 854
 855         default:                /* unknown type: ignore it */
 856                 librad_log("ERROR: Unknown attribute type %d", vp->type);
 857                 return -1;
 858         }
 859
 860         /*
 861          *      Bound the data to 255 bytes.
 862          */
 863         if (len + offset + total_length > 255) {
 864                 len = 255 - offset - total_length;
 865         }
 866
 867         /*
 868          *      Encrypt the various password styles
 869          *
 870          *      Attributes with encrypted values MUST be less than
 871          *      128 bytes long.
 872          */
 873         switch (vp->flags.encrypt) {
 874         case FLAG_ENCRYPT_USER_PASSWORD:
 875                 make_passwd(ptr + offset, &len,
 876                             data, len,
 877                             secret, packet->vector);
 878                 break;
 879
 880         case FLAG_ENCRYPT_TUNNEL_PASSWORD:
 881                 if (!original) {
 882                         librad_log("ERROR: No request packet, cannot encrypt %s attribute in the vp.", vp->name);
 883                         return -1;
 884                 }
 885
 886                 /*
 887                  *      Check if 255 - offset - total_length is less
 888                  *      than 18.  If so, we can't fit the data into
 889                  *      the available space, and we discard the
 890                  *      attribute.
 891                  *
 892                  *      This is ONLY a problem if we have multiple VSA's
 893                  *      in one Vendor-Specific, though.
 894                  */
 895                 if ((255 - offset - total_length) < 18) return 0;
 896
 897                 make_tunnel_passwd(ptr + offset, &len,
 898                                    data, len, 255 - offset - total_length,
 899                                    secret, original->vector);
 900                 break;
 901
 902                 /*
 903                  *      The code above ensures that this attribute
 904                  *      always fits.
 905                  */
 906         case FLAG_ENCRYPT_ASCEND_SECRET:
 907                 make_secret(ptr + offset, packet->vector,
 908                             secret, data);
 909                 len = AUTH_VECTOR_LEN;
 910                 break;
 911
 912
 913         default:
 914                 /*
 915                  *      Just copy the data over
 916                  */
 917                 memcpy(ptr + offset, data, len);
 918                 break;
 919         } /* switch over encryption flags */
 920
 921         /*
 922          *      Account for the tag (if any).
 923          */
 924         len += offset;
 925
 926         /*
 927          *      RFC 2865 section 5 says that zero-length attributes
 928          *      MUST NOT be sent.
 929          */
 930         if (len == 0) return 0;
 931
 932         /*
 933          *      Update the various lengths.
 934          */
 935         *length_ptr += len;
 936         if (vsa_length_ptr) *vsa_length_ptr += len;
 937         ptr += len;
 938         total_length += len;
 939
 940         return total_length;    /* of attribute */
 941 }
 942
 943
 944 /*
 945  *      Encode a packet.
 946  */
 947 int rad_encode(RADIUS_PACKET *packet, const RADIUS_PACKET *original,
 948                const char *secret)
 949 {
 950         radius_packet_t *hdr;
 951         uint8_t         *ptr;
 952         uint16_t        total_length;
 953         int             len;
 954         VALUE_PAIR      *reply;
 955         const char      *what;
 956         char            ip_buffer[128];
 957
 958         /*
 959          *      For simplicity in the following logic, we allow
 960          *      the attributes to "overflow" the 4k maximum
 961          *      RADIUS packet size, by one attribute.
 962          *
 963          *      It's uint32_t, for alignment purposes.
 964          */
 965         uint32_t        data[(MAX_PACKET_LEN + 256) / 4];
 966
 967         if ((packet->code > 0) && (packet->code < MAX_PACKET_CODE)) {
 968                 what = packet_codes[packet->code];
 969         } else {
 970                 what = "Reply";
 971         }
 972
 973         DEBUG("Sending %s of id %d to %s port %d\n",
 974               what, packet->id,
 975               inet_ntop(packet->dst_ipaddr.af,
 976                         &packet->dst_ipaddr.ipaddr,
 977                         ip_buffer, sizeof(ip_buffer)),
 978               packet->dst_port);
 979
 980         /*
 981          *      Double-check some things based on packet code.
 982          */
 983         switch (packet->code) {
 984         case PW_AUTHENTICATION_ACK:
 985         case PW_AUTHENTICATION_REJECT:
 986         case PW_ACCESS_CHALLENGE:
 987                 if (!original) {
 988                         librad_log("ERROR: Cannot sign response packet without a request packet.");
 989                         return -1;
 990                 }
 991                 break;
 992
 993                 /*
 994                  *      These packet vectors start off as all zero.
 995                  */
 996         case PW_ACCOUNTING_REQUEST:
 997         case PW_DISCONNECT_REQUEST:
 998         case PW_COA_REQUEST:
 999                 memset(packet->vector, 0, sizeof(packet->vector));
1000                 break;
1001
1002         default:
1003                 break;
1004         }
1005
1006         /*
1007          *      Use memory on the stack, until we know how
1008          *      large the packet will be.
1009          */
1010         hdr = (radius_packet_t *) data;
1011
1012         /*
1013          *      Build standard header
1014          */
1015         hdr->code = packet->code;
1016         hdr->id = packet->id;
1017
1018         memcpy(hdr->vector, packet->vector, sizeof(hdr->vector));
1019
1020         total_length = AUTH_HDR_LEN;
1021         packet->verified = 0;
1022
1023         /*
1024          *      Load up the configuration values for the user
1025          */
1026         ptr = hdr->data;
1027
1028         /*
1029          *      FIXME: Loop twice over the reply list.  The first time,
1030          *      calculate the total length of data.  The second time,
1031          *      allocate the memory, and fill in the VP's.
1032          *
1033          *      Hmm... this may be slower than just doing a small
1034          *      memcpy.
1035          */
1036
1037         /*
1038          *      Loop over the reply attributes for the packet.
1039          */
1040         for (reply = packet->vps; reply; reply = reply->next) {
1041                 /*
1042                  *      Ignore non-wire attributes
1043                  */
1044                 if ((VENDOR(reply->attribute) == 0) &&
1045                     ((reply->attribute & 0xFFFF) > 0xff) &&
1046                     !reply->flags.diameter) {
1047                         continue;
1048                 }
1049
1050                 /*
1051                  *      Check that the packet is no more than 4k in
1052                  *      size, AFTER over-flowing the 4k boundary.
1053                  *      Note that the 'data' buffer, above, is one
1054                  *      attribute longer than necessary, in order to
1055                  *      permit this overflow.
1056                  */
1057                 if (total_length > MAX_PACKET_LEN) {
1058                         librad_log("ERROR: Too many attributes for packet, result is larger than RFC maximum of 4k");
1059                         return -1;
1060                 }
1061
1062                 /*
1063                  *      Set the Message-Authenticator to the correct
1064                  *      length and initial value.
1065                  */
1066                 if (reply->attribute == PW_MESSAGE_AUTHENTICATOR) {
1067                         reply->length = AUTH_VECTOR_LEN;
1068                         memset(reply->vp_strvalue, 0, AUTH_VECTOR_LEN);
1069                         packet->verified = total_length; /* HACK! */
1070                 }
1071
1072                 /*
1073                  *      Check for overflow.
1074                  */
1075                 if (reply->flags.diameter) {
1076                         len = reply->length;
1077
1078                         if (len >= 4096) {
1079                                 librad_log("ERROR: Too many attributes for packet, result is larger than RFC maximum of 4k");
1080                                 return -1;
1081                         }
1082
1083                         len += 8; /* Code, length */
1084                         if (VENDOR(reply->attribute) != 0) len += 4;
1085                         if ((len & 0x03) != 0) len += 4 - (len & 0x03);
1086
1087                         if (len > 253) len += (len / 253) * 2;
1088
1089                         if ((total_length + len) > MAX_PACKET_LEN) {
1090                                 librad_log("ERROR: Too many attributes for packet, result is larger than RFC maximum of 4k");
1091                                 return -1;
1092                         }
1093
1094                         debug_pair(reply);
1095
1096                         len = vp2diameter(packet, original, secret, reply, ptr);
1097                 } else {
1098                         /*
1099                          *      Print out ONLY the attributes which
1100                          *      we're sending over the wire, and print
1101                          *      them out BEFORE they're encrypted.
1102                          */
1103                         debug_pair(reply);
1104
1105                         len = rad_vp2attr(packet, original, secret, reply, ptr);
1106                 }
1107
1108                 if (len < 0) return -1;
1109                 ptr += len;
1110                 total_length += len;
1111         } /* done looping over all attributes */
1112
1113         /*
1114          *      Fill in the rest of the fields, and copy the data over
1115          *      from the local stack to the newly allocated memory.
1116          *
1117          *      Yes, all this 'memcpy' is slow, but it means
1118          *      that we only allocate the minimum amount of
1119          *      memory for a request.
1120          */
1121         packet->data_len = total_length;
1122         packet->data = (uint8_t *) malloc(packet->data_len);
1123         if (!packet->data) {
1124                 librad_log("Out of memory");
1125                 return -1;
1126         }
1127
1128         memcpy(packet->data, data, packet->data_len);
1129         hdr = (radius_packet_t *) packet->data;
1130
1131         total_length = htons(total_length);
1132         memcpy(hdr->length, &total_length, sizeof(total_length));
1133
1134         return 0;
1135 }
1136
1137
1138 /*
1139  *      Sign a previously encoded packet.
1140  */
1141 int rad_sign(RADIUS_PACKET *packet, const RADIUS_PACKET *original,
1142              const char *secret)
1143 {
1144         radius_packet_t *hdr = (radius_packet_t *)packet->data;
1145
1146         /*
1147          *      It wasn't assigned an Id, this is bad!
1148          */
1149         if (packet->id < 0) {
1150                 librad_log("ERROR: RADIUS packets must be assigned an Id.");
1151                 return -1;
1152         }
1153
1154         if (!packet->data || (packet->data_len < AUTH_HDR_LEN) ||
1155             (packet->verified < 0)) {
1156                 librad_log("ERROR: You must call rad_encode() before rad_sign()");
1157                 return -1;
1158         }
1159
1160         /*
1161          *      If there's a Message-Authenticator, update it
1162          *      now, BEFORE updating the authentication vector.
1163          *
1164          *      This is a hack...
1165          */
1166         if (packet->verified > 0) {
1167                 uint8_t calc_auth_vector[AUTH_VECTOR_LEN];
1168
1169                 switch (packet->code) {
1170                 case PW_ACCOUNTING_REQUEST:
1171                 case PW_ACCOUNTING_RESPONSE:
1172                 case PW_DISCONNECT_REQUEST:
1173                 case PW_DISCONNECT_ACK:
1174                 case PW_DISCONNECT_NAK:
1175                 case PW_COA_REQUEST:
1176                 case PW_COA_ACK:
1177                 case PW_COA_NAK:
1178                         memset(hdr->vector, 0, AUTH_VECTOR_LEN);
1179                         break;
1180
1181                 case PW_AUTHENTICATION_ACK:
1182                 case PW_AUTHENTICATION_REJECT:
1183                 case PW_ACCESS_CHALLENGE:
1184                         if (!original) {
1185                                 librad_log("ERROR: Cannot sign response packet without a request packet.");
1186                                 return -1;
1187                         }
1188                         memcpy(hdr->vector, original->vector,
1189                                AUTH_VECTOR_LEN);
1190                         break;
1191
1192                 default:        /* others have vector already set to zero */
1193                         break;
1194
1195                 }
1196
1197                 /*
1198                  *      Set the authentication vector to zero,
1199                  *      calculate the signature, and put it
1200                  *      into the Message-Authenticator
1201                  *      attribute.
1202                  */
1203                 lrad_hmac_md5(packet->data, packet->data_len,
1204                               secret, strlen(secret),
1205                               calc_auth_vector);
1206                 memcpy(packet->data + packet->verified + 2,
1207                        calc_auth_vector, AUTH_VECTOR_LEN);
1208
1209                 /*
1210                  *      Copy the original request vector back
1211                  *      to the raw packet.
1212                  */
1213                 memcpy(hdr->vector, packet->vector, AUTH_VECTOR_LEN);
1214         }
1215
1216         /*
1217          *      Switch over the packet code, deciding how to
1218          *      sign the packet.
1219          */
1220         switch (packet->code) {
1221                 /*
1222                  *      Request packets are not signed, bur
1223                  *      have a random authentication vector.
1224                  */
1225         case PW_AUTHENTICATION_REQUEST:
1226         case PW_STATUS_SERVER:
1227                 break;
1228
1229                 /*
1230                  *      Reply packets are signed with the
1231                  *      authentication vector of the request.
1232                  */
1233         default:
1234                 {
1235                         uint8_t digest[16];
1236
1237                         MD5_CTX context;
1238                         MD5Init(&context);
1239                         MD5Update(&context, packet->data, packet->data_len);
1240                         MD5Update(&context, secret, strlen(secret));
1241                         MD5Final(digest, &context);
1242
1243                         memcpy(hdr->vector, digest, AUTH_VECTOR_LEN);
1244                         memcpy(packet->vector, digest, AUTH_VECTOR_LEN);
1245                         break;
1246                 }
1247         }/* switch over packet codes */
1248
1249         return 0;
1250 }
1251
1252 /*
1253  *      Reply to the request.  Also attach
1254  *      reply attribute value pairs and any user message provided.
1255  */
1256 int rad_send(RADIUS_PACKET *packet, const RADIUS_PACKET *original,
1257              const char *secret)
1258 {
1259         VALUE_PAIR              *reply;
1260         const char              *what;
1261         char                    ip_buffer[128];
1262
1263         /*
1264          *      Maybe it's a fake packet.  Don't send it.
1265          */
1266         if (!packet || (packet->sockfd < 0)) {
1267                 return 0;
1268         }
1269
1270         if ((packet->code > 0) && (packet->code < MAX_PACKET_CODE)) {
1271                 what = packet_codes[packet->code];
1272         } else {
1273                 what = "Reply";
1274         }
1275
1276         /*
1277          *  First time through, allocate room for the packet
1278          */
1279         if (!packet->data) {
1280                 /*
1281                  *      Encode the packet.
1282                  */
1283                 if (rad_encode(packet, original, secret) < 0) {
1284                         return -1;
1285                 }
1286
1287                 /*
1288                  *      Re-sign it, including updating the
1289                  *      Message-Authenticator.
1290                  */
1291                 if (rad_sign(packet, original, secret) < 0) {
1292                         return -1;
1293                 }
1294
1295                 /*
1296                  *      If packet->data points to data, then we print out
1297                  *      the VP list again only for debugging.
1298                  */
1299         } else if (librad_debug) {
1300                 DEBUG("Re-sending %s of id %d to %s port %d\n", what, packet->id,
1301                       inet_ntop(packet->dst_ipaddr.af,
1302                                 &packet->dst_ipaddr.ipaddr,
1303                                 ip_buffer, sizeof(ip_buffer)),
1304                       packet->dst_port);
1305
1306                 for (reply = packet->vps; reply; reply = reply->next) {
1307                         /* FIXME: ignore attributes > 0xff */
1308                         debug_pair(reply);
1309                 }
1310         }
1311
1312         /*
1313          *      And send it on it's way.
1314          */
1315         return rad_sendto(packet->sockfd, packet->data, packet->data_len, 0,
1316                           &packet->src_ipaddr, &packet->dst_ipaddr,
1317                           packet->dst_port);
1318 }
1319
1320
1321 /*
1322  *      Validates the requesting client NAS.  Calculates the
1323  *      signature based on the clients private key.
1324  */
1325 static int calc_acctdigest(RADIUS_PACKET *packet, const char *secret)
1326 {
1327         uint8_t         digest[AUTH_VECTOR_LEN];
1328         MD5_CTX         context;
1329
1330         /*
1331          *      Older clients have the authentication vector set to
1332          *      all zeros. Return `1' in that case.
1333          */
1334         memset(digest, 0, sizeof(digest));
1335         if (memcmp(packet->vector, digest, AUTH_VECTOR_LEN) == 0) {
1336                 packet->verified = 1;
1337                 return 1;
1338         }
1339
1340         /*
1341          *      Zero out the auth_vector in the received packet.
1342          *      Then append the shared secret to the received packet,
1343          *      and calculate the MD5 sum. This must be the same
1344          *      as the original MD5 sum (packet->vector).
1345          */
1346         memset(packet->data + 4, 0, AUTH_VECTOR_LEN);
1347
1348         /*
1349          *  MD5(packet + secret);
1350          */
1351         MD5Init(&context);
1352         MD5Update(&context, packet->data, packet->data_len);
1353         MD5Update(&context, secret, strlen(secret));
1354         MD5Final(digest, &context);
1355
1356         /*
1357          *      Return 0 if OK, 2 if not OK.
1358          */
1359         packet->verified =
1360         memcmp(digest, packet->vector, AUTH_VECTOR_LEN) ? 2 : 0;
1361
1362         return packet->verified;
1363 }
1364
1365 /*
1366  *      Validates the requesting client NAS.  Calculates the
1367  *      signature based on the clients private key.
1368  */
1369 static int calc_replydigest(RADIUS_PACKET *packet, RADIUS_PACKET *original,
1370                             const char *secret)
1371 {
1372         uint8_t         calc_digest[AUTH_VECTOR_LEN];
1373         MD5_CTX         context;
1374
1375         /*
1376          *      Very bad!
1377          */
1378         if (original == NULL) {
1379                 return 3;
1380         }
1381
1382         /*
1383          *  Copy the original vector in place.
1384          */
1385         memcpy(packet->data + 4, original->vector, AUTH_VECTOR_LEN);
1386
1387         /*
1388          *  MD5(packet + secret);
1389          */
1390         MD5Init(&context);
1391         MD5Update(&context, packet->data, packet->data_len);
1392         MD5Update(&context, secret, strlen(secret));
1393         MD5Final(calc_digest, &context);
1394
1395         /*
1396          *  Copy the packet's vector back to the packet.
1397          */
1398         memcpy(packet->data + 4, packet->vector, AUTH_VECTOR_LEN);
1399
1400         /*
1401          *      Return 0 if OK, 2 if not OK.
1402          */
1403         packet->verified =
1404                 memcmp(packet->vector, calc_digest, AUTH_VECTOR_LEN) ? 2 : 0;
1405         return packet->verified;
1406 }
1407
1408
1409 /*
1410  *      See if the data pointed to by PTR is a valid RADIUS packet.
1411  *
1412  *      packet is not 'const * const' because we may update data_len,
1413  *      if there's more data in the UDP packet than in the RADIUS packet.
1414  */
1415 int rad_packet_ok(RADIUS_PACKET *packet)
1416 {
1417         uint8_t                 *attr;
1418         int                     totallen;
1419         int                     count;
1420         radius_packet_t         *hdr;
1421         char                    host_ipaddr[128];
1422         int                     seen_eap;
1423         int                     num_attributes;
1424
1425         /*
1426          *      Check for packets smaller than the packet header.
1427          *
1428          *      RFC 2865, Section 3., subsection 'length' says:
1429          *
1430          *      "The minimum length is 20 ..."
1431          */
1432         if (packet->data_len < AUTH_HDR_LEN) {
1433                 librad_log("WARNING: Malformed RADIUS packet from host %s: too short (received %d < minimum %d)",
1434                            inet_ntop(packet->src_ipaddr.af,
1435                                      &packet->src_ipaddr.ipaddr,
1436                                      host_ipaddr, sizeof(host_ipaddr)),
1437                            packet->data_len, AUTH_HDR_LEN);
1438                 return 0;
1439         }
1440
1441         /*
1442          *      RFC 2865, Section 3., subsection 'length' says:
1443          *
1444          *      " ... and maximum length is 4096."
1445          */
1446         if (packet->data_len > MAX_PACKET_LEN) {
1447                 librad_log("WARNING: Malformed RADIUS packet from host %s: too long (received %d > maximum %d)",
1448                            inet_ntop(packet->src_ipaddr.af,
1449                                      &packet->src_ipaddr.ipaddr,
1450                                      host_ipaddr, sizeof(host_ipaddr)),
1451                            packet->data_len, MAX_PACKET_LEN);
1452                 return 0;
1453         }
1454
1455         /*
1456          *      Check for packets with mismatched size.
1457          *      i.e. We've received 128 bytes, and the packet header
1458          *      says it's 256 bytes long.
1459          */
1460         totallen = (packet->data[2] << 8) | packet->data[3];
1461         hdr = (radius_packet_t *)packet->data;
1462
1463         /*
1464          *      Code of 0 is not understood.
1465          *      Code of 16 or greate is not understood.
1466          */
1467         if ((hdr->code == 0) ||
1468             (hdr->code >= MAX_PACKET_CODE)) {
1469                 librad_log("WARNING: Bad RADIUS packet from host %s: unknown packet code %d",
1470                            inet_ntop(packet->src_ipaddr.af,
1471                                      &packet->src_ipaddr.ipaddr,
1472                                      host_ipaddr, sizeof(host_ipaddr)),
1473                            hdr->code);
1474                 return 0;
1475         }
1476
1477         /*
1478          *      Repeat the length checks.  This time, instead of
1479          *      looking at the data we received, look at the value
1480          *      of the 'length' field inside of the packet.
1481          *
1482          *      Check for packets smaller than the packet header.
1483          *
1484          *      RFC 2865, Section 3., subsection 'length' says:
1485          *
1486          *      "The minimum length is 20 ..."
1487          */
1488         if (totallen < AUTH_HDR_LEN) {
1489                 librad_log("WARNING: Malformed RADIUS packet from host %s: too short (length %d < minimum %d)",
1490                            inet_ntop(packet->src_ipaddr.af,
1491                                      &packet->src_ipaddr.ipaddr,
1492                                      host_ipaddr, sizeof(host_ipaddr)),
1493                            totallen, AUTH_HDR_LEN);
1494                 return 0;
1495         }
1496
1497         /*
1498          *      And again, for the value of the 'length' field.
1499          *
1500          *      RFC 2865, Section 3., subsection 'length' says:
1501          *
1502          *      " ... and maximum length is 4096."
1503          */
1504         if (totallen > MAX_PACKET_LEN) {
1505                 librad_log("WARNING: Malformed RADIUS packet from host %s: too long (length %d > maximum %d)",
1506                            inet_ntop(packet->src_ipaddr.af,
1507                                      &packet->src_ipaddr.ipaddr,
1508                                      host_ipaddr, sizeof(host_ipaddr)),
1509                            totallen, MAX_PACKET_LEN);
1510                 return 0;
1511         }
1512
1513         /*
1514          *      RFC 2865, Section 3., subsection 'length' says:
1515          *
1516          *      "If the packet is shorter than the Length field
1517          *      indicates, it MUST be silently discarded."
1518          *
1519          *      i.e. No response to the NAS.
1520          */
1521         if (packet->data_len < totallen) {
1522                 librad_log("WARNING: Malformed RADIUS packet from host %s: received %d octets, packet length says %d",
1523                            inet_ntop(packet->src_ipaddr.af,
1524                                      &packet->src_ipaddr.ipaddr,
1525                                      host_ipaddr, sizeof(host_ipaddr)),
1526                            packet->data_len, totallen);
1527                 return 0;
1528         }
1529
1530         /*
1531          *      RFC 2865, Section 3., subsection 'length' says:
1532          *
1533          *      "Octets outside the range of the Length field MUST be
1534          *      treated as padding and ignored on reception."
1535          */
1536         if (packet->data_len > totallen) {
1537                 /*
1538                  *      We're shortening the packet below, but just
1539                  *      to be paranoid, zero out the extra data.
1540                  */
1541                 memset(packet->data + totallen, 0, packet->data_len - totallen);
1542                 packet->data_len = totallen;
1543         }
1544
1545         /*
1546          *      Walk through the packet's attributes, ensuring that
1547          *      they add up EXACTLY to the size of the packet.
1548          *
1549          *      If they don't, then the attributes either under-fill
1550          *      or over-fill the packet.  Any parsing of the packet
1551          *      is impossible, and will result in unknown side effects.
1552          *
1553          *      This would ONLY happen with buggy RADIUS implementations,
1554          *      or with an intentional attack.  Either way, we do NOT want
1555          *      to be vulnerable to this problem.
1556          */
1557         attr = hdr->data;
1558         count = totallen - AUTH_HDR_LEN;
1559         seen_eap = 0;
1560         num_attributes = 0;
1561
1562         while (count > 0) {
1563                 /*
1564                  *      Attribute number zero is NOT defined.
1565                  */
1566                 if (attr[0] == 0) {
1567                         librad_log("WARNING: Malformed RADIUS packet from host %s: Invalid attribute 0",
1568                                    inet_ntop(packet->src_ipaddr.af,
1569                                              &packet->src_ipaddr.ipaddr,
1570                                              host_ipaddr, sizeof(host_ipaddr)));
1571                         return 0;
1572                 }
1573
1574                 /*
1575                  *      Attributes are at LEAST as long as the ID & length
1576                  *      fields.  Anything shorter is an invalid attribute.
1577                  */
1578                 if (attr[1] < 2) {
1579                         librad_log("WARNING: Malformed RADIUS packet from host %s: attribute %d too short",
1580                                    inet_ntop(packet->src_ipaddr.af,
1581                                              &packet->src_ipaddr.ipaddr,
1582                                              host_ipaddr, sizeof(host_ipaddr)),
1583                                    attr[0]);
1584                         return 0;
1585                 }
1586
1587                 /*
1588                  *      Sanity check the attributes for length.
1589                  */
1590                 switch (attr[0]) {
1591                 default:        /* don't do anything by default */
1592                         break;
1593
1594                 case PW_EAP_MESSAGE:
1595                         seen_eap |= PW_EAP_MESSAGE;
1596                         break;
1597
1598                 case PW_MESSAGE_AUTHENTICATOR:
1599                         if (attr[1] != 2 + AUTH_VECTOR_LEN) {
1600                                 librad_log("WARNING: Malformed RADIUS packet from host %s: Message-Authenticator has invalid length %d",
1601                                            inet_ntop(packet->src_ipaddr.af,
1602                                                      &packet->src_ipaddr.ipaddr,
1603                                                      host_ipaddr, sizeof(host_ipaddr)),
1604                                            attr[1] - 2);
1605                                 return 0;
1606                         }
1607                         seen_eap |= PW_MESSAGE_AUTHENTICATOR;
1608                         break;
1609                 }
1610
1611                 /*
1612                  *      FIXME: Look up the base 255 attributes in the
1613                  *      dictionary, and switch over their type.  For
1614                  *      integer/date/ip, the attribute length SHOULD
1615                  *      be 6.
1616                  */
1617                 count -= attr[1];       /* grab the attribute length */
1618                 attr += attr[1];
1619                 num_attributes++;       /* seen one more attribute */
1620         }
1621
1622         /*
1623          *      If the attributes add up to a packet, it's allowed.
1624          *
1625          *      If not, we complain, and throw the packet away.
1626          */
1627         if (count != 0) {
1628                 librad_log("WARNING: Malformed RADIUS packet from host %s: packet attributes do NOT exactly fill the packet",
1629                            inet_ntop(packet->src_ipaddr.af,
1630                                      &packet->src_ipaddr.ipaddr,
1631                                      host_ipaddr, sizeof(host_ipaddr)));
1632                 return 0;
1633         }
1634
1635         /*
1636          *      If we're configured to look for a maximum number of
1637          *      attributes, and we've seen more than that maximum,
1638          *      then throw the packet away, as a possible DoS.
1639          */
1640         if ((librad_max_attributes > 0) &&
1641             (num_attributes > librad_max_attributes)) {
1642                 librad_log("WARNING: Possible DoS attack from host %s: Too many attributes in request (received %d, max %d are allowed).",
1643                            inet_ntop(packet->src_ipaddr.af,
1644                                      &packet->src_ipaddr.ipaddr,
1645                                      host_ipaddr, sizeof(host_ipaddr)),
1646                            num_attributes, librad_max_attributes);
1647                 return 0;
1648         }
1649
1650         /*
1651          *      http://www.freeradius.org/rfc/rfc2869.html#EAP-Message
1652          *
1653          *      A packet with an EAP-Message attribute MUST also have
1654          *      a Message-Authenticator attribute.
1655          *
1656          *      A Message-Authenticator all by itself is OK, though.
1657          */
1658         if (seen_eap &&
1659             (seen_eap != PW_MESSAGE_AUTHENTICATOR) &&
1660             (seen_eap != (PW_EAP_MESSAGE | PW_MESSAGE_AUTHENTICATOR))) {
1661                 librad_log("WARNING: Insecure packet from host %s:  Received EAP-Message with no Message-Authenticator.",
1662                            inet_ntop(packet->src_ipaddr.af,
1663                                      &packet->src_ipaddr.ipaddr,
1664                                      host_ipaddr, sizeof(host_ipaddr)));
1665                 return 0;
1666         }
1667
1668         /*
1669          *      Fill RADIUS header fields
1670          */
1671         packet->code = hdr->code;
1672         packet->id = hdr->id;
1673         memcpy(packet->vector, hdr->vector, AUTH_VECTOR_LEN);
1674
1675         return 1;
1676 }
1677
1678
1679 /*
1680  *      Receive UDP client requests, and fill in
1681  *      the basics of a RADIUS_PACKET structure.
1682  */
1683 RADIUS_PACKET *rad_recv(int fd)
1684 {
1685         RADIUS_PACKET           *packet;
1686
1687         /*
1688          *      Allocate the new request data structure
1689          */
1690         if ((packet = malloc(sizeof(*packet))) == NULL) {
1691                 librad_log("out of memory");
1692                 return NULL;
1693         }
1694         memset(packet, 0, sizeof(*packet));
1695
1696         packet->data_len = rad_recvfrom(fd, &packet->data, 0,
1697                                         &packet->src_ipaddr, &packet->src_port,
1698                                         &packet->dst_ipaddr, &packet->dst_port);
1699
1700         /*
1701          *      Check for socket errors.
1702          */
1703         if (packet->data_len < 0) {
1704                 librad_log("Error receiving packet: %s", strerror(errno));
1705                 /* packet->data is NULL */
1706                 free(packet);
1707                 return NULL;
1708         }
1709
1710         /*
1711          *      See if it's a well-formed RADIUS packet.
1712          */
1713         if (!rad_packet_ok(packet)) {
1714                 rad_free(&packet);
1715                 return NULL;
1716         }
1717
1718         /*
1719          *      Remember which socket we read the packet from.
1720          */
1721         packet->sockfd = fd;
1722
1723         /*
1724          *      FIXME: Do even more filtering by only permitting
1725          *      certain IP's.  The problem is that we don't know
1726          *      how to do this properly for all possible clients...
1727          */
1728
1729         /*
1730          *      Explicitely set the VP list to empty.
1731          */
1732         packet->vps = NULL;
1733
1734         if (librad_debug) {
1735                 char host_ipaddr[128];
1736
1737                 if ((packet->code > 0) && (packet->code < MAX_PACKET_CODE)) {
1738                         printf("rad_recv: %s packet from host %s port %d",
1739                                packet_codes[packet->code],
1740                                inet_ntop(packet->src_ipaddr.af,
1741                                          &packet->src_ipaddr.ipaddr,
1742                                          host_ipaddr, sizeof(host_ipaddr)),
1743                                packet->src_port);
1744                 } else {
1745                         printf("rad_recv: Packet from host %s port %d code=%d",
1746                                inet_ntop(packet->src_ipaddr.af,
1747                                          &packet->src_ipaddr.ipaddr,
1748                                          host_ipaddr, sizeof(host_ipaddr)),
1749                                packet->src_port,
1750                                packet->code);
1751                 }
1752                 printf(", id=%d, length=%d\n", packet->id, packet->data_len);
1753         }
1754
1755         return packet;
1756 }
1757
1758
1759 /*
1760  *      Verify the signature of a packet.
1761  */
1762 int rad_verify(RADIUS_PACKET *packet, RADIUS_PACKET *original,
1763                const char *secret)
1764 {
1765         uint8_t                 *ptr;
1766         int                     length;
1767         int                     attrlen;
1768
1769         if (!packet || !packet->data) return -1;
1770
1771         /*
1772          *      Before we allocate memory for the attributes, do more
1773          *      sanity checking.
1774          */
1775         ptr = packet->data + AUTH_HDR_LEN;
1776         length = packet->data_len - AUTH_HDR_LEN;
1777         while (length > 0) {
1778                 uint8_t msg_auth_vector[AUTH_VECTOR_LEN];
1779                 uint8_t calc_auth_vector[AUTH_VECTOR_LEN];
1780
1781                 attrlen = ptr[1];
1782
1783                 switch (ptr[0]) {
1784                 default:        /* don't do anything. */
1785                         break;
1786
1787                         /*
1788                          *      Note that more than one Message-Authenticator
1789                          *      attribute is invalid.
1790                          */
1791                 case PW_MESSAGE_AUTHENTICATOR:
1792                         memcpy(msg_auth_vector, &ptr[2], sizeof(msg_auth_vector));
1793                         memset(&ptr[2], 0, AUTH_VECTOR_LEN);
1794
1795                         switch (packet->code) {
1796                         default:
1797                                 break;
1798
1799                         case PW_ACCOUNTING_REQUEST:
1800                         case PW_ACCOUNTING_RESPONSE:
1801                         case PW_DISCONNECT_REQUEST:
1802                         case PW_DISCONNECT_ACK:
1803                         case PW_DISCONNECT_NAK:
1804                         case PW_COA_REQUEST:
1805                         case PW_COA_ACK:
1806                         case PW_COA_NAK:
1807                                 memset(packet->data + 4, 0, AUTH_VECTOR_LEN);
1808                                 break;
1809
1810                         case PW_AUTHENTICATION_ACK:
1811                         case PW_AUTHENTICATION_REJECT:
1812                         case PW_ACCESS_CHALLENGE:
1813                                 if (!original) {
1814                                         librad_log("ERROR: Cannot validate Message-Authenticator in response packet without a request packet.");
1815                                         return -1;
1816                                 }
1817                                 memcpy(packet->data + 4, original->vector, AUTH_VECTOR_LEN);
1818                                 break;
1819                         }
1820
1821                         lrad_hmac_md5(packet->data, packet->data_len,
1822                                       secret, strlen(secret), calc_auth_vector);
1823                         if (memcmp(calc_auth_vector, msg_auth_vector,
1824                                    sizeof(calc_auth_vector)) != 0) {
1825                                 char buffer[32];
1826                                 librad_log("Received packet from %s with invalid Message-Authenticator!  (Shared secret is incorrect.)",
1827                                            inet_ntop(packet->src_ipaddr.af,
1828                                                      &packet->src_ipaddr.ipaddr,
1829                                                      buffer, sizeof(buffer)));
1830                                 /* Silently drop packet, according to RFC 3579 */
1831                                 return -1;
1832                         } /* else the message authenticator was good */
1833
1834                         /*
1835                          *      Reinitialize Authenticators.
1836                          */
1837                         memcpy(&ptr[2], msg_auth_vector, AUTH_VECTOR_LEN);
1838                         memcpy(packet->data + 4, packet->vector, AUTH_VECTOR_LEN);
1839                         break;
1840                 } /* switch over the attributes */
1841
1842                 ptr += attrlen;
1843                 length -= attrlen;
1844         } /* loop over the packet, sanity checking the attributes */
1845
1846         /*
1847          *      It looks like a RADIUS packet, but we can't validate
1848          *      the signature.
1849          */
1850         if ((packet->code == 0) || packet->code >= MAX_PACKET_CODE) {
1851                 char buffer[32];
1852                 librad_log("Received Unknown packet code %d"
1853                            "from client %s port %d: Cannot validate signature",
1854                            packet->code,
1855                            inet_ntop(packet->src_ipaddr.af,
1856                                      &packet->src_ipaddr.ipaddr,
1857                                      buffer, sizeof(buffer)),
1858                            packet->src_port);
1859                 return -1;
1860         }
1861
1862         /*
1863          *      Calculate and/or verify digest.
1864          */
1865         switch(packet->code) {
1866                 int rcode;
1867                 char buffer[32];
1868
1869                 case PW_AUTHENTICATION_REQUEST:
1870                 case PW_STATUS_SERVER:
1871                 case PW_DISCONNECT_REQUEST:
1872                         /*
1873                          *      The authentication vector is random
1874                          *      nonsense, invented by the client.
1875                          */
1876                         break;
1877
1878                 case PW_ACCOUNTING_REQUEST:
1879                         if (calc_acctdigest(packet, secret) > 1) {
1880                                 librad_log("Received Accounting-Request packet "
1881                                            "from %s with invalid signature!  (Shared secret is incorrect.)",
1882                                            inet_ntop(packet->src_ipaddr.af,
1883                                                      &packet->src_ipaddr.ipaddr,
1884                                                      buffer, sizeof(buffer)));
1885                                 return -1;
1886                         }
1887                         break;
1888
1889                         /* Verify the reply digest */
1890                 case PW_AUTHENTICATION_ACK:
1891                 case PW_AUTHENTICATION_REJECT:
1892                 case PW_ACCESS_CHALLENGE:
1893                 case PW_ACCOUNTING_RESPONSE:
1894                 case PW_DISCONNECT_ACK:
1895                 case PW_DISCONNECT_NAK:
1896                 case PW_COA_ACK:
1897                 case PW_COA_NAK:
1898                         rcode = calc_replydigest(packet, original, secret);
1899                         if (rcode > 1) {
1900                                 librad_log("Received %s packet "
1901                                            "from client %s port %d with invalid signature (err=%d)!  (Shared secret is incorrect.)",
1902                                            packet_codes[packet->code],
1903                                            inet_ntop(packet->src_ipaddr.af,
1904                                                      &packet->src_ipaddr.ipaddr,
1905                                                      buffer, sizeof(buffer)),
1906                                            packet->src_port,
1907                                            rcode);
1908                                 return -1;
1909                         }
1910                         break;
1911
1912                 default:
1913                         librad_log("Received Unknown packet code %d"
1914                                    "from client %s port %d: Cannot validate signature",
1915                                    packet->code,
1916                                    inet_ntop(packet->src_ipaddr.af,
1917                                              &packet->src_ipaddr.ipaddr,
1918                                                      buffer, sizeof(buffer)),
1919                                    packet->src_port);
1920                         return -1;
1921         }
1922
1923         return 0;
1924 }
1925
1926
1927 /*
1928  *      Hack for IETF RADEXT.  Don't use in a production environment.
1929  *
1930  *      Note that due to architecture limitations, we can't handle
1931  *      AVP's with more than 253 bytes of data, but that should be
1932  *      enough for initial inter-operability.
1933  */
1934 static int diameter2vp(const RADIUS_PACKET *packet,
1935                        const RADIUS_PACKET *original, const char *secret,
1936                        const uint8_t *data, int total_length,
1937                        VALUE_PAIR **pvp)
1938 {
1939         int lookup, offset, radius_length, attr_length, diameter_length, raw;
1940         uint32_t attr, length, vendor;
1941         DICT_ATTR *da;
1942         VALUE_PAIR *head, **tail, *vp;
1943         uint8_t *header;        /* diameter header */
1944         uint8_t diameter[4096];
1945
1946         diameter_length = radius_length = 0;
1947         header = diameter;
1948
1949         *pvp = NULL;
1950
1951         /*
1952          *      Unpack all contiguous Extended-Attributes into a local
1953          *      buffer.  It's slow, but it's safe.
1954          */
1955         while (total_length > 0) {
1956                 if (data[0] != PW_EXTENDED_ATTRIBUTE) break;
1957
1958                 attr_length = data[1];
1959                 radius_length += attr_length;
1960                 total_length -= attr_length;
1961                 attr_length -= 2;
1962
1963                 memcpy(header, data + 2, attr_length);
1964                 header += attr_length;
1965                 diameter_length += attr_length;
1966
1967                 data += attr_length + 2;
1968         }
1969
1970         head = NULL;
1971         tail = NULL;
1972         header = diameter;
1973
1974 next_diameter:
1975         raw = 0;
1976
1977         if ((vp = paircreate(PW_EXTENDED_ATTRIBUTE, PW_TYPE_OCTETS)) == NULL) {
1978                 pairfree(&head);
1979                 return radius_length;
1980         }
1981
1982         /*
1983          *      Don't add it to the tail until we know it's OK.
1984          */
1985
1986         /*
1987          *      Too little data to contain a diameter header.
1988          */
1989         if (diameter_length < 12) {
1990         done:
1991                 vp->type = PW_TYPE_OCTETS;
1992                 memcpy(vp->vp_octets, header, diameter_length);
1993                 vp->length = diameter_length;
1994
1995                 /*
1996                  *      Ensure there's no encryption or tag stuff,
1997                  *      we just pass the attribute as-is.
1998                  */
1999                 memset(&vp->flags, 0, sizeof(vp->flags));
2000
2001
2002                 if (!head) {    /* add vp to the list */
2003                         *pvp = vp;
2004                 } else {
2005                         *pvp = head;
2006                         *tail = vp;
2007                 }
2008
2009                 return radius_length;
2010         }
2011
2012         /*
2013          *      Sanity check the lengths, next.  If the length is too
2014          *      short, then the rest of the diameter buffer can't be
2015          *      parsed.
2016          */
2017         length = (header[5] << 16) | (header[6] << 8) | header[7];
2018
2019         /*
2020          *      lies about the length (too short)
2021          *      or lies about the length (too long)
2022          *      or VSA
2023          *              with too little diameter data
2024          *              or with too little content
2025          */
2026         if ((length < 9) ||
2027             (length > diameter_length) ||
2028             (((header[4] & 0x80) != 0) &&
2029              ((diameter_length < 16) || (length < 13)))) {
2030                 /*
2031                  *      The rest of the data is small enough to fit
2032                  *      into one VP.  Copy it over, and return it.
2033                  */
2034                 if (diameter_length <= 253) goto done;
2035
2036                 /*
2037                  *      FIXME: make multiple VP's of the rest of the
2038                  *      data, so that we don't lose anything!
2039                  */
2040                 pairfree(&vp);
2041
2042                 *pvp = head;
2043                 return radius_length;
2044         }
2045
2046         memcpy(&attr, header, 4);
2047         attr = ntohl(attr);
2048         if (attr > 65535) raw = 1; /* implementation limitations */
2049
2050         /*
2051          *      1..255 are RADIUS, and shouldn't be encapsulated this way.
2052          *      256.. are Diameter.
2053          *
2054          *      We've arbitrarily assigned 32768..65535 from the
2055          *      Diameter space to "extended RADIUS" attributes.
2056          */
2057         if (attr < 32768) raw = 1;
2058
2059         /*
2060          *      We don't like any non-vendor flag bits being set.
2061          */
2062         if ((header[4] & 0x7f) != 0) raw = 1;
2063
2064         vendor = 0;
2065         if ((header[4] & 0x80) != 0) {
2066                 memcpy(&vendor, header + 8 , 4);
2067                 vendor = ntohl(vendor);
2068                 if (vendor > 32767) raw = 1; /* implementation limitations */
2069
2070                 offset = 12;
2071         } else {
2072                 offset = 8;
2073         }
2074         length -= offset;
2075         header += offset;
2076         diameter_length -= offset;
2077
2078         /*
2079          *      FIXME: This is an implementation limitation.  We
2080          *      should really allow strings longer than 253 bytes...
2081          *
2082          *      And bailing out completely (i.e. throwing away the rest
2083          *      of the data) isn't an intelligent thing to do, either.
2084          */
2085         if (length > 253) {
2086                 *pvp = head;
2087                 pairfree(&vp);
2088                 return radius_length;
2089         }
2090
2091         lookup = attr;
2092         lookup |= (vendor << 16);
2093         lookup |= (1 << 31);    /* see dict_addattr */
2094
2095         da = dict_attrbyvalue(lookup);
2096         if (!da) raw = 1;
2097
2098         if (!raw) {
2099                 /*
2100                  *      Copied from paircreate.
2101                  */
2102                 strcpy(vp->name, da->name);
2103                 vp->type = da->type;
2104                 vp->flags = da->flags;
2105                 vp->attribute = da->attr;
2106         } else {
2107                 vp->type = PW_TYPE_OCTETS;
2108         }
2109
2110         switch (vp->type) {
2111         case PW_TYPE_STRING:
2112         case PW_TYPE_OCTETS:
2113         case PW_TYPE_ABINARY:
2114                 memcpy(vp->vp_octets, header, length);
2115                 vp->length = length;
2116                 break;
2117
2118         case PW_TYPE_INTEGER:
2119                 if (length != 4) goto force_octets;
2120
2121                 memcpy(&vp->lvalue, header, 4);
2122                 vp->lvalue = ntohl(vp->lvalue);
2123                 vp->length = 4;
2124
2125                 /*
2126                  *      Try to get named VALUEs
2127                  */
2128                 {
2129                         DICT_VALUE *dval;
2130                         dval = dict_valbyattr(vp->attribute,
2131                                               vp->lvalue);
2132                         if (dval) {
2133                                 strNcpy(vp->vp_strvalue,
2134                                         dval->name,
2135                                         sizeof(vp->vp_strvalue));
2136                         }
2137                 }
2138                 break;
2139
2140         case PW_TYPE_DATE:
2141                 if (length != 4) goto force_octets;
2142
2143                 memcpy(&vp->lvalue, header, 4);
2144                 vp->lvalue = ntohl(vp->lvalue);
2145                 vp->length = 4;
2146                 break;
2147
2148
2149         case PW_TYPE_IPADDR:
2150                 if (length != 4) goto force_octets;
2151
2152                 memcpy(&vp->lvalue, header, 4);
2153                 vp->length = 4;
2154                 break;
2155
2156                 /*
2157                  *      IPv6 interface ID is 8 octets long.
2158                  */
2159         case PW_TYPE_IFID:
2160                 if (length != 8) goto force_octets;
2161                 memcpy(vp->vp_ifid, header, 8);
2162                 vp->length = 8;
2163                 break;
2164
2165                 /*
2166                  *      IPv6 addresses are 16 octets long
2167                  */
2168         case PW_TYPE_IPV6ADDR:
2169                 if (length != 16) goto force_octets;
2170                 memcpy(&vp->vp_ipv6addr, header, 16);
2171                 vp->length = 16;
2172                 break;
2173
2174                 /*
2175                  *      IPv6 prefixes are 2 to 18 octets long.
2176                  *
2177                  *      RFC 3162: The first octet is unused.
2178                  *      The second is the length of the prefix
2179                  *      the rest are the prefix data.
2180                  *
2181                  *      The prefix length can have value 0 to 128.
2182                  */
2183         case PW_TYPE_IPV6PREFIX:
2184                 if (length < 2 || length > 18) goto force_octets;
2185                 if (header[1] > 128) goto force_octets;
2186
2187                 memcpy(vp->vp_ipv6prefix, header, length);
2188                 vp->length = length;
2189
2190
2191                 /*
2192                  *      FIXME: double-check that
2193                  *      (vp->vp_octets[1] >> 3) matches vp->length + 2
2194                  */
2195                 if (vp->length < 18) {
2196                         memset(vp->vp_octets + vp->length, 0,
2197                                18 - vp->length);
2198                 }
2199                 break;
2200
2201         default:
2202         force_octets:
2203                 vp->type = PW_TYPE_OCTETS;
2204
2205                 /*
2206                  *      Ensure there's no encryption or tag stuff,
2207                  *      we just pass the attribute as-is.
2208                  */
2209                 memset(&vp->flags, 0, sizeof(vp->flags));
2210                 break;
2211         }
2212
2213         if (!head) {
2214                 head = vp;
2215         } else {
2216                 *tail = vp;
2217         }
2218         tail = &vp->next;
2219
2220         header += length;
2221         diameter_length -= length;
2222
2223         if ((length & 0x03) != 0) {
2224                 attr_length = 4 - (length & 0x03); /* padding */
2225
2226                 if (diameter_length < attr_length) {
2227                         *pvp = head;
2228                         return radius_length;
2229                 }
2230
2231                 header += attr_length;
2232                 diameter_length -= attr_length;
2233         }
2234         if (diameter_length > 0) goto next_diameter;
2235
2236         *pvp = head;
2237         return radius_length;
2238 }
2239
2240
2241
2242 /*
2243  *      Parse a RADIUS attribute into a data structure.
2244  */
2245 VALUE_PAIR *rad_attr2vp(const RADIUS_PACKET *packet, const RADIUS_PACKET *original,
2246                         const char *secret, int attribute, int length,
2247                         const uint8_t *data)
2248 {
2249         int offset = 0;
2250         VALUE_PAIR *vp;
2251
2252         if ((vp = paircreate(attribute, PW_TYPE_OCTETS)) == NULL) {
2253                 return NULL;
2254         }
2255
2256         /*
2257          *      If length is greater than 253, something is SERIOUSLY
2258          *      wrong.
2259          */
2260         if (length > 253) length = 253; /* paranoia (pair-anoia?) */
2261
2262         vp->length = length;
2263         vp->operator = T_OP_EQ;
2264         vp->next = NULL;
2265
2266         /*
2267          *      Handle tags.
2268          */
2269         if (vp->flags.has_tag) {
2270                 if (TAG_VALID(data[0]) ||
2271                     (vp->flags.encrypt == FLAG_ENCRYPT_TUNNEL_PASSWORD)) {
2272                         /*
2273                          *      Tunnel passwords REQUIRE a tag, even
2274                          *      if don't have a valid tag.
2275                          */
2276                         vp->flags.tag = data[0];
2277
2278                         if ((vp->type == PW_TYPE_STRING) ||
2279                             (vp->type == PW_TYPE_OCTETS)) offset = 1;
2280                 }
2281         }
2282
2283         /*
2284          *      Copy the data to be decrypted
2285          */
2286         memcpy(&vp->vp_octets[0], data + offset, length - offset);
2287         vp->length -= offset;
2288
2289         /*
2290          *      Decrypt the attribute.
2291          */
2292         switch (vp->flags.encrypt) {
2293                 /*
2294                  *  User-Password
2295                  */
2296         case FLAG_ENCRYPT_USER_PASSWORD:
2297                 if (original) {
2298                         rad_pwdecode((char *)vp->vp_strvalue,
2299                                      vp->length, secret,
2300                                      original->vector);
2301                 } else {
2302                         rad_pwdecode((char *)vp->vp_strvalue,
2303                                      vp->length, secret,
2304                                      packet->vector);
2305                 }
2306                 if (vp->attribute == PW_USER_PASSWORD) {
2307                         vp->length = strlen(vp->vp_strvalue);
2308                 }
2309                 break;
2310
2311                 /*
2312                  *      Tunnel-Password's may go ONLY
2313                  *      in response packets.
2314                  */
2315         case FLAG_ENCRYPT_TUNNEL_PASSWORD:
2316                 if (!original) goto raw;
2317
2318                 if (rad_tunnel_pwdecode(vp->vp_octets, &vp->length,
2319                                         secret, original->vector) < 0) {
2320                         goto raw;
2321                 }
2322                 break;
2323
2324                 /*
2325                  *  Ascend-Send-Secret
2326                  *  Ascend-Receive-Secret
2327                  */
2328         case FLAG_ENCRYPT_ASCEND_SECRET:
2329                 if (!original) {
2330                         goto raw;
2331                 } else {
2332                         uint8_t my_digest[AUTH_VECTOR_LEN];
2333                         make_secret(my_digest,
2334                                     original->vector,
2335                                     secret, data);
2336                         memcpy(vp->vp_strvalue, my_digest,
2337                                AUTH_VECTOR_LEN );
2338                         vp->vp_strvalue[AUTH_VECTOR_LEN] = '\0';
2339                         vp->length = strlen(vp->vp_strvalue);
2340                 }
2341                 break;
2342
2343         default:
2344                 break;
2345         } /* switch over encryption flags */
2346
2347
2348         switch (vp->type) {
2349         case PW_TYPE_STRING:
2350         case PW_TYPE_OCTETS:
2351         case PW_TYPE_ABINARY:
2352                 /* nothing more to do */
2353                 break;
2354
2355         case PW_TYPE_BYTE:
2356                 if (vp->length != 1) goto raw;
2357
2358                 vp->lvalue = vp->vp_octets[0];
2359                 break;
2360
2361
2362         case PW_TYPE_SHORT:
2363                 if (vp->length != 2) goto raw;
2364
2365                 vp->lvalue = (vp->vp_octets[0] << 8) | vp->vp_octets[1];
2366                 break;
2367
2368         case PW_TYPE_INTEGER:
2369                 if (vp->length != 4) goto raw;
2370
2371                 memcpy(&vp->lvalue, vp->vp_octets, 4);
2372                 vp->lvalue = ntohl(vp->lvalue);
2373
2374                 if (vp->flags.has_tag) vp->lvalue &= 0x00ffffff;
2375
2376                 /*
2377                  *      Try to get named VALUEs
2378                  */
2379                 {
2380                         DICT_VALUE *dval;
2381                         dval = dict_valbyattr(vp->attribute,
2382                                               vp->lvalue);
2383                         if (dval) {
2384                                 strNcpy(vp->vp_strvalue,
2385                                         dval->name,
2386                                         sizeof(vp->vp_strvalue));
2387                         }
2388                 }
2389                 break;
2390
2391         case PW_TYPE_DATE:
2392                 if (vp->length != 4) goto raw;
2393
2394                 memcpy(&vp->lvalue, vp->vp_octets, 4);
2395                 vp->lvalue = ntohl(vp->lvalue);
2396                 break;
2397
2398
2399         case PW_TYPE_IPADDR:
2400                 if (vp->length != 4) goto raw;
2401
2402                 memcpy(&vp->lvalue, vp->vp_octets, 4);
2403                 break;
2404
2405                 /*
2406                  *      IPv6 interface ID is 8 octets long.
2407                  */
2408         case PW_TYPE_IFID:
2409                 if (vp->length != 8) goto raw;
2410                 /* vp->vp_ifid == vp->vp_octets */
2411                 break;
2412
2413                 /*
2414                  *      IPv6 addresses are 16 octets long
2415                  */
2416         case PW_TYPE_IPV6ADDR:
2417                 if (vp->length != 16) goto raw;
2418                 /* vp->vp_ipv6addr == vp->vp_octets */
2419                 break;
2420
2421                 /*
2422                  *      IPv6 prefixes are 2 to 18 octets long.
2423                  *
2424                  *      RFC 3162: The first octet is unused.
2425                  *      The second is the length of the prefix
2426                  *      the rest are the prefix data.
2427                  *
2428                  *      The prefix length can have value 0 to 128.
2429                  */
2430         case PW_TYPE_IPV6PREFIX:
2431                 if (vp->length < 2 || vp->length > 18) goto raw;
2432                 if (vp->vp_octets[1] > 128) goto raw;
2433
2434                 /*
2435                  *      FIXME: double-check that
2436                  *      (vp->vp_octets[1] >> 3) matches vp->length + 2
2437                  */
2438                 if (vp->length < 18) {
2439                         memset(vp->vp_octets + vp->length, 0,
2440                                18 - vp->length);
2441                 }
2442                 break;
2443
2444         default:
2445         raw:
2446                 vp->type = PW_TYPE_OCTETS;
2447                 vp->length = length;
2448                 memcpy(vp->vp_octets, data, length);
2449
2450
2451                 /*
2452                  *      Ensure there's no encryption or tag stuff,
2453                  *      we just pass the attribute as-is.
2454                  */
2455                 memset(&vp->flags, 0, sizeof(vp->flags));
2456         }
2457
2458         return vp;
2459 }
2460
2461
2462 /*
2463  *      Calculate/check digest, and decode radius attributes.
2464  *      Returns:
2465  *      -1 on decoding error
2466  *      0 on success
2467  */
2468 int rad_decode(RADIUS_PACKET *packet, RADIUS_PACKET *original,
2469                const char *secret)
2470 {
2471         uint32_t                lvalue;
2472         uint32_t                vendorcode;
2473         VALUE_PAIR              **tail;
2474         VALUE_PAIR              *pair;
2475         uint8_t                 *ptr;
2476         int                     packet_length;
2477         int                     attribute;
2478         int                     attrlen;
2479         int                     vendorlen;
2480         radius_packet_t         *hdr;
2481         int                     vsa_tlen, vsa_llen;
2482         DICT_VENDOR             *dv = NULL;
2483
2484         /*
2485          *      Extract attribute-value pairs
2486          */
2487         hdr = (radius_packet_t *)packet->data;
2488         ptr = hdr->data;
2489         packet_length = packet->data_len - AUTH_HDR_LEN;
2490
2491         /*
2492          *      There may be VP's already in the packet.  Don't
2493          *      destroy them.
2494          */
2495         for (tail = &packet->vps; *tail != NULL; tail = &((*tail)->next)) {
2496                 /* nothing */
2497         }
2498
2499         vendorcode = 0;
2500         vendorlen  = 0;
2501         vsa_tlen = vsa_llen = 1;
2502
2503         /*
2504          *      We have to read at least two bytes.
2505          *
2506          *      rad_recv() above ensures that this is OK.
2507          */
2508         while (packet_length > 0) {
2509                 attribute = -1;
2510                 attrlen = -1;
2511
2512                 /*
2513                  *      Normal attribute, handle it like normal.
2514                  */
2515                 if (vendorcode == 0) {
2516                         /*
2517                          *      No room to read attr/length,
2518                          *      or bad attribute, or attribute is
2519                          *      too short, or attribute is too long,
2520                          *      stop processing the packet.
2521                          */
2522                         if ((packet_length < 2) ||
2523                             (ptr[0] == 0) ||  (ptr[1] < 2) ||
2524                             (ptr[1] > packet_length)) break;
2525
2526                         /*
2527                          *      192 is "integer" for Ascend.  So if we
2528                          *      get 12 or more bytes, it must be the
2529                          *      new extended format.
2530                          */
2531                         if ((ptr[0] == PW_EXTENDED_ATTRIBUTE) &&
2532                             (ptr[1] >= 2 + 12)) {
2533                                 pair = NULL;
2534                                 attrlen = diameter2vp(packet, original, secret,
2535                                                       ptr, packet_length, &pair);
2536                                 goto check_pair;
2537                         }
2538
2539                         attribute = *ptr++;
2540                         attrlen   = *ptr++;
2541
2542                         attrlen -= 2;
2543                         packet_length  -= 2;
2544
2545                         if (attribute != PW_VENDOR_SPECIFIC) goto create_pair;
2546
2547                         /*
2548                          *      No vendor code, or ONLY vendor code.
2549                          */
2550                         if (attrlen <= 4) goto create_pair;
2551
2552                         vendorlen = 0;
2553                 }
2554
2555                 /*
2556                  *      Handle Vendor-Specific
2557                  */
2558                 if (vendorlen == 0) {
2559                         uint8_t *subptr;
2560                         int sublen;
2561                         int myvendor;
2562
2563                         /*
2564                          *      attrlen was checked above.
2565                          */
2566                         memcpy(&lvalue, ptr, 4);
2567                         myvendor = ntohl(lvalue);
2568
2569                         /*
2570                          *      Zero isn't allowed.
2571                          */
2572                         if (myvendor == 0) goto create_pair;
2573
2574                         /*
2575                          *      This is an implementation issue.
2576                          *      We currently pack vendor into the upper
2577                          *      16 bits of a 32-bit attribute number,
2578                          *      so we can't handle vendor numbers larger
2579                          *      than 16 bits.
2580                          */
2581                         if (myvendor > 65535) goto create_pair;
2582
2583                         vsa_tlen = vsa_llen = 1;
2584                         dv = dict_vendorbyvalue(myvendor);
2585                         if (dv) {
2586                                 vsa_tlen = dv->type;
2587                                 vsa_llen = dv->length;
2588                         }
2589
2590                         /*
2591                          *      Sweep through the list of VSA's,
2592                          *      seeing if they exactly fill the
2593                          *      outer Vendor-Specific attribute.
2594                          *
2595                          *      If not, create a raw Vendor-Specific.
2596                          */
2597                         subptr = ptr + 4;
2598                         sublen = attrlen - 4;
2599
2600                         /*
2601                          *      See if we can parse it.
2602                          */
2603                         do {
2604                                 int myattr = 0;
2605
2606                                 /*
2607                                  *      Don't have a type, it's bad.
2608                                  */
2609                                 if (sublen < vsa_tlen) goto create_pair;
2610
2611                                 /*
2612                                  *      Ensure that the attribute number
2613                                  *      is OK.
2614                                  */
2615                                 switch (vsa_tlen) {
2616                                 case 1:
2617                                         myattr = subptr[0];
2618                                         break;
2619
2620                                 case 2:
2621                                         myattr = (subptr[0] << 8) | subptr[1];
2622                                         break;
2623
2624                                 case 4:
2625                                         if ((subptr[0] != 0) ||
2626                                             (subptr[1] != 0)) goto create_pair;
2627
2628                                         myattr = (subptr[2] << 8) | subptr[3];
2629                                         break;
2630
2631                                         /*
2632                                          *      Our dictionary is broken.
2633                                          */
2634                                 default:
2635                                         goto create_pair;
2636                                 }
2637
2638                                 /*
2639                                  *      Not enough room for one more
2640                                  *      attribute.  Die!
2641                                  */
2642                                 if (sublen < vsa_tlen + vsa_llen) goto create_pair;
2643                                 switch (vsa_llen) {
2644                                 case 0:
2645                                         attribute = (myvendor << 16) | myattr;
2646                                         ptr += 4 + vsa_tlen;
2647                                         attrlen -= (4 + vsa_tlen);
2648                                         packet_length -= 4 + vsa_tlen;
2649                                         goto create_pair;
2650
2651                                 case 1:
2652                                         if (subptr[vsa_tlen] < (vsa_tlen + vsa_llen))
2653                                                 goto create_pair;
2654
2655                                         if (subptr[vsa_tlen] > sublen)
2656                                                 goto create_pair;
2657                                         sublen -= subptr[vsa_tlen];
2658                                         subptr += subptr[vsa_tlen];
2659                                         break;
2660
2661                                 case 2:
2662                                         if (subptr[vsa_tlen] != 0) goto create_pair;
2663                                         if (subptr[vsa_tlen + 1] < (vsa_tlen + vsa_llen))
2664                                                 goto create_pair;
2665                                         if (subptr[vsa_tlen + 1] > sublen)
2666                                                 goto create_pair;
2667                                         sublen -= subptr[vsa_tlen + 1];
2668                                         subptr += subptr[vsa_tlen + 1];
2669                                         break;
2670
2671                                         /*
2672                                          *      Our dictionaries are
2673                                          *      broken.
2674                                          */
2675                                 default:
2676                                         goto create_pair;
2677                                 }
2678                         } while (sublen > 0);
2679
2680                         vendorcode = myvendor;
2681                         vendorlen = attrlen - 4;
2682                         packet_length -= 4;
2683
2684                         ptr += 4;
2685                 }
2686
2687                 /*
2688                  *      attrlen is the length of this attribute.
2689                  *      total_len is the length of the encompassing
2690                  *      attribute.
2691                  */
2692                 switch (vsa_tlen) {
2693                 case 1:
2694                         attribute = ptr[0];
2695                         break;
2696
2697                 case 2:
2698                         attribute = (ptr[0] << 8) | ptr[1];
2699                         break;
2700
2701                 default:        /* can't hit this. */
2702                         return -1;
2703                 }
2704                 attribute |= (vendorcode << 16);
2705                 ptr += vsa_tlen;
2706
2707                 switch (vsa_llen) {
2708                 case 1:
2709                         attrlen = ptr[0] - (vsa_tlen + vsa_llen);
2710                         break;
2711
2712                 case 2:
2713                         attrlen = ptr[1] - (vsa_tlen + vsa_llen);
2714                         break;
2715
2716                 default:        /* can't hit this. */
2717                         return -1;
2718                 }
2719                 ptr += vsa_llen;
2720                 vendorlen -= vsa_tlen + vsa_llen + attrlen;
2721                 if (vendorlen == 0) vendorcode = 0;
2722                 packet_length -= (vsa_tlen + vsa_llen);
2723
2724                 /*
2725                  *      Create the attribute, setting the default type
2726                  *      to 'octets'.  If the type in the dictionary
2727                  *      is different, then the dictionary type will
2728                  *      over-ride this one.
2729                  */
2730         create_pair:
2731                 pair = rad_attr2vp(packet, original, secret,
2732                                    attribute, attrlen, ptr);
2733         check_pair:
2734                 if (!pair) {
2735                         pairfree(&packet->vps);
2736                         librad_log("out of memory");
2737                         return -1;
2738                 }
2739
2740                 *tail = pair;
2741                 while (pair) {
2742                         debug_pair(pair);
2743                         tail = &pair->next;
2744                         pair = pair->next;
2745                 }
2746
2747                 ptr += attrlen;
2748                 packet_length -= attrlen;
2749         }
2750
2751         /*
2752          *      Merge information from the outside world into our
2753          *      random pool.
2754          */
2755         lrad_rand_seed(packet->data, AUTH_HDR_LEN);
2756
2757         return 0;
2758 }
2759
2760
2761 /*
2762  *      Encode password.
2763  *
2764  *      We assume that the passwd buffer passed is big enough.
2765  *      RFC2138 says the password is max 128 chars, so the size
2766  *      of the passwd buffer must be at least 129 characters.
2767  *      Preferably it's just MAX_STRING_LEN.
2768  *
2769  *      int *pwlen is updated to the new length of the encrypted
2770  *      password - a multiple of 16 bytes.
2771  */
2772 int rad_pwencode(char *passwd, int *pwlen, const char *secret,
2773                  const uint8_t *vector)
2774 {
2775         lrad_MD5_CTX context, old;
2776         uint8_t digest[AUTH_VECTOR_LEN];
2777         int     i, n, secretlen;
2778         int     len;
2779
2780         /*
2781          *      RFC maximum is 128 bytes.
2782          *
2783          *      If length is zero, pad it out with zeros.
2784          *
2785          *      If the length isn't aligned to 16 bytes,
2786          *      zero out the extra data.
2787          */
2788         len = *pwlen;
2789
2790         if (len > 128) len = 128;
2791
2792         if (len == 0) {
2793                 memset(passwd, 0, AUTH_PASS_LEN);
2794                 len = AUTH_PASS_LEN;
2795         } else if ((len % AUTH_PASS_LEN) != 0) {
2796                 memset(&passwd[len], 0, AUTH_PASS_LEN - (len % AUTH_PASS_LEN));
2797                 len += AUTH_PASS_LEN - (len % AUTH_PASS_LEN);
2798         }
2799         *pwlen = len;
2800
2801         /*
2802          *      Use the secret to setup the decryption digest
2803          */
2804         secretlen = strlen(secret);
2805
2806         lrad_MD5Init(&context);
2807         lrad_MD5Update(&context, secret, secretlen);
2808         old = context;          /* save intermediate work */
2809
2810         /*
2811          *      Encrypt it in place.  Don't bother checking
2812          *      len, as we've ensured above that it's OK.
2813          */
2814         for (n = 0; n < len; n += AUTH_PASS_LEN) {
2815                 if (n == 0) {
2816                         lrad_MD5Update(&context, vector, AUTH_PASS_LEN);
2817                         lrad_MD5Final(digest, &context);
2818                 } else {
2819                         context = old;
2820                         lrad_MD5Update(&context,
2821                                          passwd + n - AUTH_PASS_LEN,
2822                                          AUTH_PASS_LEN);
2823                         lrad_MD5Final(digest, &context);
2824                 }
2825
2826                 for (i = 0; i < AUTH_PASS_LEN; i++) {
2827                         passwd[i + n] ^= digest[i];
2828                 }
2829         }
2830
2831         return 0;
2832 }
2833
2834 /*
2835  *      Decode password.
2836  */
2837 int rad_pwdecode(char *passwd, int pwlen, const char *secret,
2838                  const uint8_t *vector)
2839 {
2840         lrad_MD5_CTX context, old;
2841         uint8_t digest[AUTH_VECTOR_LEN];
2842         int     i, n, secretlen;
2843
2844         /*
2845          *      The RFC's say that the maximum is 128.
2846          *      The buffer we're putting it into above is 254, so
2847          *      we don't need to do any length checking.
2848          */
2849         if (pwlen > 128) pwlen = 128;
2850
2851         /*
2852          *      Catch idiots.
2853          */
2854         if (pwlen == 0) goto done;
2855
2856         /*
2857          *      Use the secret to setup the decryption digest
2858          */
2859         secretlen = strlen(secret);
2860
2861         lrad_MD5Init(&context);
2862         lrad_MD5Update(&context, secret, secretlen);
2863         old = context;          /* save intermediate work */
2864
2865         /*
2866          *      The inverse of the code above.
2867          */
2868         for (n = 0; n < pwlen; n += AUTH_PASS_LEN) {
2869                 if (n == 0) {
2870                         lrad_MD5Update(&context, vector, AUTH_VECTOR_LEN);
2871                         lrad_MD5Final(digest, &context);
2872
2873                         context = old;
2874                         lrad_MD5Update(&context, passwd, AUTH_PASS_LEN);
2875                 } else {
2876                         lrad_MD5Final(digest, &context);
2877
2878                         context = old;
2879                         lrad_MD5Update(&context, passwd + n, AUTH_PASS_LEN);
2880                 }
2881
2882                 for (i = 0; i < AUTH_PASS_LEN; i++) {
2883                         passwd[i + n] ^= digest[i];
2884                 }
2885         }
2886
2887  done:
2888         passwd[pwlen] = '\0';
2889         return strlen(passwd);
2890 }
2891
2892
2893 /*
2894  *      Encode Tunnel-Password attributes when sending them out on the wire.
2895  *
2896  *      int *pwlen is updated to the new length of the encrypted
2897  *      password - a multiple of 16 bytes.
2898  *
2899  *      This is per RFC-2868 which adds a two char SALT to the initial intermediate
2900  *      value MD5 hash.
2901  */
2902 int rad_tunnel_pwencode(char *passwd, int *pwlen, const char *secret,
2903                         const uint8_t *vector)
2904 {
2905         uint8_t buffer[AUTH_VECTOR_LEN + MAX_STRING_LEN + 3];
2906         unsigned char   digest[AUTH_VECTOR_LEN];
2907         char*   salt;
2908         int     i, n, secretlen;
2909         unsigned len, n2;
2910
2911         len = *pwlen;
2912
2913         if (len > 127) len = 127;
2914
2915         /*
2916          * Shift the password 3 positions right to place a salt and original
2917          * length, tag will be added automatically on packet send
2918          */
2919         for (n=len ; n>=0 ; n--) passwd[n+3] = passwd[n];
2920         salt = passwd;
2921         passwd += 2;
2922         /*
2923          * save original password length as first password character;
2924          */
2925         *passwd = len;
2926         len += 1;
2927
2928
2929         /*
2930          *      Generate salt.  The RFC's say:
2931          *
2932          *      The high bit of salt[0] must be set, each salt in a
2933          *      packet should be unique, and they should be random
2934          *
2935          *      So, we set the high bit, add in a counter, and then
2936          *      add in some CSPRNG data.  should be OK..
2937          */
2938         salt[0] = (0x80 | ( ((salt_offset++) & 0x0f) << 3) |
2939                    (lrad_rand() & 0x07));
2940         salt[1] = lrad_rand();
2941
2942         /*
2943          *      Padd password to multiple of AUTH_PASS_LEN bytes.
2944          */
2945         n = len % AUTH_PASS_LEN;
2946         if (n) {
2947                 n = AUTH_PASS_LEN - n;
2948                 for (; n > 0; n--, len++)
2949                         passwd[len] = 0;
2950         }
2951         /* set new password length */
2952         *pwlen = len + 2;
2953
2954         /*
2955          *      Use the secret to setup the decryption digest
2956          */
2957         secretlen = strlen(secret);
2958         memcpy(buffer, secret, secretlen);
2959
2960         for (n2 = 0; n2 < len; n2+=AUTH_PASS_LEN) {
2961                 if (!n2) {
2962                         memcpy(buffer + secretlen, vector, AUTH_VECTOR_LEN);
2963                         memcpy(buffer + secretlen + AUTH_VECTOR_LEN, salt, 2);
2964                         librad_md5_calc(digest, buffer, secretlen + AUTH_VECTOR_LEN + 2);
2965                 } else {
2966                         memcpy(buffer + secretlen, passwd + n2 - AUTH_PASS_LEN, AUTH_PASS_LEN);
2967                         librad_md5_calc(digest, buffer, secretlen + AUTH_PASS_LEN);
2968                 }
2969
2970                 for (i = 0; i < AUTH_PASS_LEN; i++) {
2971                         passwd[i + n2] ^= digest[i];
2972                 }
2973         }
2974         passwd[n2] = 0;
2975         return 0;
2976 }
2977
2978 /*
2979  *      Decode Tunnel-Password encrypted attributes.
2980  *
2981  *      Defined in RFC-2868, this uses a two char SALT along with the
2982  *      initial intermediate value, to differentiate it from the
2983  *      above.
2984  */
2985 int rad_tunnel_pwdecode(uint8_t *passwd, int *pwlen, const char *secret,
2986                         const uint8_t *vector)
2987 {
2988         lrad_MD5_CTX  context, old;
2989         uint8_t         digest[AUTH_VECTOR_LEN];
2990         int             secretlen;
2991         unsigned        i, n, len, reallen;
2992
2993         len = *pwlen;
2994
2995         /*
2996          *      We need at least a salt.
2997          */
2998         if (len < 2) {
2999                 librad_log("tunnel password is too short");
3000                 return -1;
3001         }
3002
3003         /*
3004          *      There's a salt, but no password.  Or, there's a salt
3005          *      and a 'data_len' octet.  It's wrong, but at least we
3006          *      can figure out what it means: the password is empty.
3007          *
3008          *      Note that this means we ignore the 'data_len' field,
3009          *      if the attribute length tells us that there's no
3010          *      more data.  So the 'data_len' field may be wrong,
3011          *      but that's ok...
3012          */
3013         if (len <= 3) {
3014                 passwd[0] = 0;
3015                 *pwlen = 0;
3016                 return 0;
3017         }
3018
3019         len -= 2;               /* discount the salt */
3020
3021         /*
3022          *      Use the secret to setup the decryption digest
3023          */
3024         secretlen = strlen(secret);
3025
3026         lrad_MD5Init(&context);
3027         lrad_MD5Update(&context, secret, secretlen);
3028         old = context;          /* save intermediate work */
3029
3030         /*
3031          *      Set up the initial key:
3032          *
3033          *       b(1) = MD5(secret + vector + salt)
3034          */
3035         lrad_MD5Update(&context, vector, AUTH_VECTOR_LEN);
3036         lrad_MD5Update(&context, passwd, 2);
3037
3038         reallen = 0;
3039         for (n = 0; n < len; n += AUTH_PASS_LEN) {
3040                 int base = 0;
3041
3042                 if (n == 0) {
3043                         lrad_MD5Final(digest, &context);
3044
3045                         context = old;
3046
3047                         /*
3048                          *      A quick check: decrypt the first octet
3049                          *      of the password, which is the
3050                          *      'data_len' field.  Ensure it's sane.
3051                          */
3052                         reallen = passwd[2] ^ digest[0];
3053                         if (reallen >= len) {
3054                                 librad_log("tunnel password is too long for the attribute");
3055                                 return -1;
3056                         }
3057
3058                         lrad_MD5Update(&context, passwd + 2, AUTH_PASS_LEN);
3059
3060                         base = 1;
3061                 } else {
3062                         lrad_MD5Final(digest, &context);
3063
3064                         context = old;
3065                         lrad_MD5Update(&context, passwd + n + 2, AUTH_PASS_LEN);
3066                 }
3067
3068                 for (i = base; i < AUTH_PASS_LEN; i++) {
3069                         passwd[n + i - 1] = passwd[n + i + 2] ^ digest[i];
3070                 }
3071         }
3072
3073         /*
3074          *      See make_tunnel_password, above.
3075          */
3076         if (reallen > 239) reallen = 239;
3077
3078         *pwlen = reallen;
3079         passwd[reallen] = 0;
3080
3081         return reallen;
3082 }
3083
3084 /*
3085  *      Encode a CHAP password
3086  *
3087  *      FIXME: might not work with Ascend because
3088  *      we use vp->length, and Ascend gear likes
3089  *      to send an extra '\0' in the string!
3090  */
3091 int rad_chap_encode(RADIUS_PACKET *packet, uint8_t *output, int id,
3092                     VALUE_PAIR *password)
3093 {
3094         int             i;
3095         char            *ptr;
3096         uint8_t         string[MAX_STRING_LEN * 2 + 1];
3097         VALUE_PAIR      *challenge;
3098
3099         /*
3100          *      Sanity check the input parameters
3101          */
3102         if ((packet == NULL) || (password == NULL)) {
3103                 return -1;
3104         }
3105
3106         /*
3107          *      Note that the password VP can be EITHER
3108          *      a User-Password attribute (from a check-item list),
3109          *      or a CHAP-Password attribute (the client asking
3110          *      the library to encode it).
3111          */
3112
3113         i = 0;
3114         ptr = string;
3115         *ptr++ = id;
3116
3117         i++;
3118         memcpy(ptr, password->vp_strvalue, password->length);
3119         ptr += password->length;
3120         i += password->length;
3121
3122         /*
3123          *      Use Chap-Challenge pair if present,
3124          *      Request-Authenticator otherwise.
3125          */
3126         challenge = pairfind(packet->vps, PW_CHAP_CHALLENGE);
3127         if (challenge) {
3128                 memcpy(ptr, challenge->vp_strvalue, challenge->length);
3129                 i += challenge->length;
3130         } else {
3131                 memcpy(ptr, packet->vector, AUTH_VECTOR_LEN);
3132                 i += AUTH_VECTOR_LEN;
3133         }
3134
3135         *output = id;
3136         librad_md5_calc((uint8_t *)output + 1, (uint8_t *)string, i);
3137
3138         return 0;
3139 }
3140
3141
3142 /*
3143  *      Seed the random number generator.
3144  *
3145  *      May be called any number of times.
3146  */
3147 void lrad_rand_seed(const void *data, size_t size)
3148 {
3149         uint32_t hash;
3150
3151         /*
3152          *      Ensure that the pool is initialized.
3153          */
3154         if (!lrad_rand_initialized) {
3155                 int fd;
3156
3157                 memset(&lrad_rand_pool, 0, sizeof(lrad_rand_pool));
3158
3159                 fd = open("/dev/urandom", O_RDONLY);
3160                 if (fd >= 0) {
3161                         size_t total;
3162                         ssize_t this;
3163
3164                         total = this = 0;
3165                         while (total < sizeof(lrad_rand_pool.randrsl)) {
3166                                 this = read(fd, lrad_rand_pool.randrsl,
3167                                             sizeof(lrad_rand_pool.randrsl) - total);
3168                                 if ((this < 0) && (errno != EINTR)) break;
3169                                 if (this > 0) total += this;
3170                         }
3171                         close(fd);
3172                 } else {
3173                         lrad_rand_pool.randrsl[0] = fd;
3174                         lrad_rand_pool.randrsl[1] = time(NULL);
3175                         lrad_rand_pool.randrsl[2] = errno;
3176                 }
3177
3178                 lrad_randinit(&lrad_rand_pool, 1);
3179                 lrad_rand_pool.randcnt = 0;
3180                 lrad_rand_initialized = 1;
3181         }
3182
3183         if (!data) return;
3184
3185         /*
3186          *      Hash the user data
3187          */
3188         hash = lrad_rand();
3189         if (!hash) hash = lrad_rand();
3190         hash = lrad_hash_update(data, size, hash);
3191
3192         lrad_rand_pool.randmem[lrad_rand_pool.randcnt] ^= hash;
3193 }
3194
3195
3196 /*
3197  *      Return a 32-bit random number.
3198  */
3199 uint32_t lrad_rand(void)
3200 {
3201         uint32_t num;
3202
3203         /*
3204          *      Ensure that the pool is initialized.
3205          */
3206         if (!lrad_rand_initialized) {
3207                 lrad_rand_seed(NULL, 0);
3208         }
3209
3210         num = lrad_rand_pool.randrsl[lrad_rand_pool.randcnt++];
3211         if (lrad_rand_pool.randcnt == 256) {
3212                 lrad_isaac(&lrad_rand_pool);
3213                 lrad_rand_pool.randcnt = 0;
3214         }
3215
3216         return num;
3217 }
3218
3219
3220 /*
3221  *      Allocate a new RADIUS_PACKET
3222  */
3223 RADIUS_PACKET *rad_alloc(int newvector)
3224 {
3225         RADIUS_PACKET   *rp;
3226
3227         if ((rp = malloc(sizeof(RADIUS_PACKET))) == NULL) {
3228                 librad_log("out of memory");
3229                 return NULL;
3230         }
3231         memset(rp, 0, sizeof(*rp));
3232         rp->id = -1;
3233         rp->verified = -1;
3234
3235         if (newvector) {
3236                 int i;
3237                 uint32_t hash, base;
3238
3239                 /*
3240                  *      Don't expose the actual contents of the random
3241                  *      pool.
3242                  */
3243                 base = lrad_rand();
3244                 for (i = 0; i < AUTH_VECTOR_LEN; i += sizeof(uint32_t)) {
3245                         hash = lrad_rand() ^ base;
3246                         memcpy(rp->vector + i, &hash, sizeof(hash));
3247                 }
3248         }
3249         lrad_rand();            /* stir the pool again */
3250
3251         return rp;
3252 }
3253
3254 /*
3255  *      Free a RADIUS_PACKET
3256  */
3257 void rad_free(RADIUS_PACKET **radius_packet_ptr)
3258 {
3259         RADIUS_PACKET *radius_packet;
3260
3261         if (!radius_packet_ptr) return;
3262         radius_packet = *radius_packet_ptr;
3263
3264         free(radius_packet->data);
3265         pairfree(&radius_packet->vps);
3266
3267         free(radius_packet);
3268
3269         *radius_packet_ptr = NULL;
3270 }