X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=fticks.c;h=4d4d2eba8e2a59ab5d7a8eafbc614bc471ca64d7;hb=refs%2Fheads%2Flicensing-nogpl;hp=0147f1b904b3f4fa3e941e7eba5159988c52dafb;hpb=66743827eea20b870a0319660a4a5eb32bfe32ca;p=libradsec.git diff --git a/fticks.c b/fticks.c index 0147f1b..4d4d2eb 100644 --- a/fticks.c +++ b/fticks.c @@ -1,54 +1,11 @@ -/* Copyright (C) 2011 NORDUnet A/S - * See LICENSE for information about licensing. - */ +/* Copyright (c) 2006-2010, UNINETT AS + * Copyright (c) 2010-2012, NORDUnet A/S */ +/* See LICENSE for licensing information. */ -#include /* For sprintf(). */ -#include -#include -#include - -#include -#include -#include #include "radsecproxy.h" #include "debug.h" - #include "fticks.h" - -static void -_format_hash(const uint8_t *hash, size_t out_len, uint8_t *out) -{ - int ir, iw; - - for (ir = 0, iw = 0; iw <= out_len - 3; ir++, iw += 2) - sprintf((char *) out + iw, "%02x", hash[ir % SHA256_DIGEST_SIZE]); -} - -static void -_hash(const uint8_t *in, - const uint8_t *key, - size_t out_len, - uint8_t *out) -{ - if (key == NULL) { - struct sha256_ctx ctx; - uint8_t hash[SHA256_DIGEST_SIZE]; - - sha256_init(&ctx); - sha256_update(&ctx, strlen((char *) in), in); - sha256_digest(&ctx, sizeof(hash), hash); - _format_hash(hash, out_len, out); - } - else { - struct hmac_sha256_ctx ctx; - uint8_t hash[SHA256_DIGEST_SIZE]; - - hmac_sha256_set_key(&ctx, strlen((char *) key), key); - hmac_sha256_update(&ctx, strlen((char *) in), in); - hmac_sha256_digest(&ctx, sizeof(hash), hash); - _format_hash(hash, out_len, out); - } -} +#include "fticks_hashmac.h" int fticks_configure(struct options *options, @@ -60,54 +17,61 @@ fticks_configure(struct options *options, const char *reporting = (const char *) *reportingp; const char *mac = (const char *) *macp; - if (reporting == NULL) - goto out; - - if (strcasecmp(reporting, "None") == 0) - options->fticks_reporting = RSP_FTICKS_REPORTING_NONE; - else if (strcasecmp(reporting, "Basic") == 0) - options->fticks_reporting = RSP_FTICKS_REPORTING_BASIC; - else if (strcasecmp(reporting, "Full") == 0) - options->fticks_reporting = RSP_FTICKS_REPORTING_FULL; - else { - debugx(1, DBG_ERR, "config error: invalid FTicksReporting value: %s", - reporting); - r = 1; - goto out; + /* Set defaults. */ + options->fticks_reporting = RSP_FTICKS_REPORTING_NONE; + options->fticks_mac = RSP_FTICKS_MAC_VENDOR_KEY_HASHED; + + if (reporting != NULL) { + if (strcasecmp(reporting, "None") == 0) + options->fticks_reporting = RSP_FTICKS_REPORTING_NONE; + else if (strcasecmp(reporting, "Basic") == 0) + options->fticks_reporting = RSP_FTICKS_REPORTING_BASIC; + else if (strcasecmp(reporting, "Full") == 0) + options->fticks_reporting = RSP_FTICKS_REPORTING_FULL; + else { + debugx(1, DBG_ERR, + "config error: invalid FTicksReporting value: %s", + reporting); + r = 1; + } } - if (strcasecmp(mac, "Static") == 0) - options->fticks_mac = RSP_FTICKS_MAC_STATIC; - else if (strcasecmp(mac, "Original") == 0) - options->fticks_mac = RSP_FTICKS_MAC_ORIGINAL; - else if (strcasecmp(mac, "VendorHashed") == 0) - options->fticks_mac = RSP_FTICKS_MAC_VENDOR_HASHED; - else if (strcasecmp(mac, "VendorKeyHashed") == 0) - options->fticks_mac = RSP_FTICKS_MAC_VENDOR_KEY_HASHED; - else if (strcasecmp(mac, "FullyHashed") == 0) - options->fticks_mac = RSP_FTICKS_MAC_FULLY_HASHED; - else if (strcasecmp(mac, "FullyKeyHashed") == 0) - options->fticks_mac = RSP_FTICKS_MAC_FULLY_KEY_HASHED; - else { - debugx(1, DBG_ERR, "config error: invalid FTicksMAC value: %s", mac); - r = 1; - goto out; + if (mac != NULL) { + if (strcasecmp(mac, "Static") == 0) + options->fticks_mac = RSP_FTICKS_MAC_STATIC; + else if (strcasecmp(mac, "Original") == 0) + options->fticks_mac = RSP_FTICKS_MAC_ORIGINAL; + else if (strcasecmp(mac, "VendorHashed") == 0) + options->fticks_mac = RSP_FTICKS_MAC_VENDOR_HASHED; + else if (strcasecmp(mac, "VendorKeyHashed") == 0) + options->fticks_mac = RSP_FTICKS_MAC_VENDOR_KEY_HASHED; + else if (strcasecmp(mac, "FullyHashed") == 0) + options->fticks_mac = RSP_FTICKS_MAC_FULLY_HASHED; + else if (strcasecmp(mac, "FullyKeyHashed") == 0) + options->fticks_mac = RSP_FTICKS_MAC_FULLY_KEY_HASHED; + else { + debugx(1, DBG_ERR, + "config error: invalid FTicksMAC value: %s", mac); + r = 1; + } } - if (*keyp == NULL - && (options->fticks_mac == RSP_FTICKS_MAC_VENDOR_KEY_HASHED - || options->fticks_mac == RSP_FTICKS_MAC_FULLY_KEY_HASHED)) { + if (*keyp != NULL) { + options->fticks_key = *keyp; + if (options->fticks_mac != RSP_FTICKS_MAC_VENDOR_KEY_HASHED + && options->fticks_mac != RSP_FTICKS_MAC_FULLY_KEY_HASHED) + debugx(1, DBG_WARN, "config warning: FTicksKey not used"); + } + else if (options->fticks_reporting != RSP_FTICKS_REPORTING_NONE + && (options->fticks_mac == RSP_FTICKS_MAC_VENDOR_KEY_HASHED + || options->fticks_mac == RSP_FTICKS_MAC_FULLY_KEY_HASHED)) { debugx(1, DBG_ERR, - "config error: FTicksMAC %s requires an FTicksKey", mac); - options->fticks_mac = RSP_FTICKS_MAC_STATIC; + "config error: FTicksMAC values VendorKeyHashed and " + "FullyKeyHashed require an FTicksKey"); + options->fticks_reporting = RSP_FTICKS_REPORTING_NONE; r = 1; - goto out; } - if (*keyp != NULL) - options->fticks_key = *keyp; - -out: if (*reportingp != NULL) { free(*reportingp); *reportingp = NULL; @@ -119,30 +83,6 @@ out: return r; } -/** Hash the Ethernet MAC address in \a IN, keying a HMAC with \a KEY - unless \a KEY is NULL. If \a KEY is null \a IN is hashed with an - ordinary cryptographic hash function such as SHA-2. - - \a IN and \a KEY are NULL terminated strings. - - \a IN is supposed to be an Ethernet MAC address and is sanitised - by lowercasing it, removing all but [0-9a-f] and truncating it at - the first ';' found. The truncation is done because RADIUS - supposedly has a praxis of tacking on SSID to the MAC address in - Calling-Station-Id. */ -void -fticks_hashmac(const uint8_t *in, - const uint8_t *key, - size_t out_len, - uint8_t *out) -{ - /* TODO: lowercase */ - /* TODO: s/[!0-9a-f]//1 */ - /* TODO: truncate after first ';', if any */ - - _hash(in, key, out_len, out); -} - void fticks_log(const struct options *options, const struct client *client, @@ -167,8 +107,13 @@ fticks_log(const struct options *options, memset(visinst, 0, sizeof(visinst)); if (options->fticks_reporting == RSP_FTICKS_REPORTING_FULL) { - snprintf((char *) visinst, sizeof(visinst), "VISINST=%s#", - client->conf->name); + if (client->conf->fticks_visinst != NULL ) { + snprintf((char *) visinst, sizeof(visinst), "VISINST=%s#", + client->conf->fticks_visinst); + } else { + snprintf((char *) visinst, sizeof(visinst), "VISINST=%s#", + client->conf->name); + } } memset(macout, 0, sizeof(macout)); @@ -212,7 +157,7 @@ fticks_log(const struct options *options, } } } - debug(0xff, + fticks_debug( "F-TICKS/eduroam/1.0#REALM=%s#VISCOUNTRY=%s#%sCSI=%s#RESULT=%s#", realm, client->conf->fticks_viscountry,