X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=fticks.c;h=f8b4c2093cc3698b289fc45282d0b8cdb54ef467;hb=869d3bd09e1f636fa0952709ddc0038a6c40ca70;hp=98022cd612dde0af8ee95bba68e21b44de4268b6;hpb=59e93add209b19fd1c29209930397a20a9d9c932;p=libradsec.git diff --git a/fticks.c b/fticks.c index 98022cd..f8b4c20 100644 --- a/fticks.c +++ b/fticks.c @@ -2,73 +2,79 @@ * See LICENSE for information about licensing. */ -#include /* For sprintf(). */ -#include -#include -#include - -#include -#include -#include -#include "list.h" #include "radsecproxy.h" #include "debug.h" - #include "fticks.h" +#include "fticks_hashmac.h" -static void -format_hash(const uint8_t *hash, size_t out_len, uint8_t *out) -{ - int i; - - for (i = 0; i < out_len / 2; i++) - sprintf((char *) out + i*2, "%02x", hash[i % SHA256_DIGEST_SIZE]); -} - -static void -hash(const uint8_t *in, - const uint8_t *key, - size_t out_len, - uint8_t *out) +int +fticks_configure(struct options *options, + uint8_t **reportingp, + uint8_t **macp, + uint8_t **keyp) { - if (key == NULL) { - struct sha256_ctx ctx; - uint8_t hash[SHA256_DIGEST_SIZE]; - - sha256_init(&ctx); - sha256_update(&ctx, strlen((char *) in), in); - sha256_digest(&ctx, sizeof(hash), hash); - format_hash(hash, out_len, out); - } + int r = 0; + const char *reporting = (const char *) *reportingp; + const char *mac = (const char *) *macp; + + if (reporting == NULL) + goto out; + if (strcasecmp(reporting, "None") == 0) + options->fticks_reporting = RSP_FTICKS_REPORTING_NONE; + else if (strcasecmp(reporting, "Basic") == 0) + options->fticks_reporting = RSP_FTICKS_REPORTING_BASIC; + else if (strcasecmp(reporting, "Full") == 0) + options->fticks_reporting = RSP_FTICKS_REPORTING_FULL; else { - struct hmac_sha256_ctx ctx; - uint8_t hash[SHA256_DIGEST_SIZE]; - - hmac_sha256_set_key(&ctx, strlen((char *) key), key); - hmac_sha256_update(&ctx, strlen((char *) in), in); - hmac_sha256_digest(&ctx, sizeof(hash), hash); - format_hash(hash, out_len, out); + debugx(1, DBG_ERR, "config error: invalid FTicksReporting value: %s", + reporting); + r = 1; + goto out; } -} -/** Hash the MAC in \a IN, keying with \a KEY if it's not NULL. + if (mac == NULL) + goto out; + if (strcasecmp(mac, "Static") == 0) + options->fticks_mac = RSP_FTICKS_MAC_STATIC; + else if (strcasecmp(mac, "Original") == 0) + options->fticks_mac = RSP_FTICKS_MAC_ORIGINAL; + else if (strcasecmp(mac, "VendorHashed") == 0) + options->fticks_mac = RSP_FTICKS_MAC_VENDOR_HASHED; + else if (strcasecmp(mac, "VendorKeyHashed") == 0) + options->fticks_mac = RSP_FTICKS_MAC_VENDOR_KEY_HASHED; + else if (strcasecmp(mac, "FullyHashed") == 0) + options->fticks_mac = RSP_FTICKS_MAC_FULLY_HASHED; + else if (strcasecmp(mac, "FullyKeyHashed") == 0) + options->fticks_mac = RSP_FTICKS_MAC_FULLY_KEY_HASHED; + else { + debugx(1, DBG_ERR, "config error: invalid FTicksMAC value: %s", mac); + r = 1; + goto out; + } - \a IN and \a KEY are NULL terminated strings. + if (*keyp == NULL + && (options->fticks_mac == RSP_FTICKS_MAC_VENDOR_KEY_HASHED + || options->fticks_mac == RSP_FTICKS_MAC_FULLY_KEY_HASHED)) { + debugx(1, DBG_ERR, + "config error: FTicksMAC %s requires an FTicksKey", mac); + options->fticks_mac = RSP_FTICKS_MAC_STATIC; + r = 1; + goto out; + } - \a IN is sanitised by lowercasing it, removing all but [0-9a-f] - and truncating it at first ';' (due to RADIUS praxis with tacking - on SSID to MAC in Calling-Station-Id). */ -void -fticks_hashmac(const uint8_t *in, - const uint8_t *key, - size_t out_len, - uint8_t *out) -{ - /* TODO: lowercase */ - /* TODO: s/[!0-9a-f]//1 */ - /* TODO: truncate after first ';', if any */ + if (*keyp != NULL) + options->fticks_key = *keyp; - hash(in, key, out_len, out); +out: + if (*reportingp != NULL) { + free(*reportingp); + *reportingp = NULL; + } + if (*macp != NULL) { + free(*macp); + *macp = NULL; + } + return r; } void @@ -77,8 +83,8 @@ fticks_log(const struct options *options, const struct radmsg *msg, const struct rqout *rqout) { - unsigned char *username = NULL; - unsigned char *realm = NULL; + uint8_t *username = NULL; + uint8_t *realm = NULL; uint8_t visinst[8+40+1+1]; /* Room for 40 octets of VISINST. */ uint8_t *macin = NULL; uint8_t macout[2*32+1]; /* Room for ASCII representation of SHA256. */ @@ -86,55 +92,59 @@ fticks_log(const struct options *options, username = radattr2ascii(radmsg_gettype(rqout->rq->msg, RAD_Attr_User_Name)); if (username != NULL) { - realm = (unsigned char *) strrchr((char *) username, '@'); + realm = (uint8_t *) strrchr((char *) username, '@'); if (realm != NULL) realm++; - else - realm = (unsigned char *) ""; } + if (realm == NULL) + realm = (uint8_t *) ""; memset(visinst, 0, sizeof(visinst)); - if (options->fticks_reporting == RSP_FTICKS_REPORTING_FULL) + if (options->fticks_reporting == RSP_FTICKS_REPORTING_FULL) { snprintf((char *) visinst, sizeof(visinst), "VISINST=%s#", client->conf->name); + } -#define BOGUS_MAC "00:00:00:00:00:00" /* FIXME: Is there a standard - * for bogus MAC addresses? */ memset(macout, 0, sizeof(macout)); - strncpy((char *) macout, BOGUS_MAC, sizeof(macout) - 1); - if (options->fticks_mac != RSP_FTICKS_MAC_STATIC) { + if (options->fticks_mac == RSP_FTICKS_MAC_STATIC) { + strncpy((char *) macout, "undisclosed", sizeof(macout) - 1); + } + else { macin = radattr2ascii(radmsg_gettype(rqout->rq->msg, RAD_Attr_Calling_Station_Id)); - } -#if RS_TESTING || 1 - if (macin == NULL) - macin = (uint8_t *) strdup(BOGUS_MAC); -#endif /* RS_TESTING */ - - switch (options->fticks_mac) - { - case RSP_FTICKS_MAC_STATIC: - memcpy(macout, BOGUS_MAC, sizeof(BOGUS_MAC)); - break; - case RSP_FTICKS_MAC_ORIGINAL: - memcpy(macout, macin, sizeof(macout)); - break; - case RSP_FTICKS_MAC_VENDOR_HASHED: - fticks_hashmac(macin + 3, NULL, sizeof(macout), macout); - break; - case RSP_FTICKS_MAC_VENDOR_KEY_HASHED: - fticks_hashmac(macin + 3, options->fticks_key, sizeof(macout), - macout); - break; - case RSP_FTICKS_MAC_FULLY_HASHED: - fticks_hashmac(macin, NULL, sizeof(macout), macout); - break; - case RSP_FTICKS_MAC_FULLY_KEY_HASHED: - fticks_hashmac(macin, options->fticks_key, sizeof(macout), macout); - break; - default: - debugx(2, DBG_ERR, "invalid fticks mac configuration: %d", - options->fticks_mac); + if (macin) { + switch (options->fticks_mac) + { + case RSP_FTICKS_MAC_ORIGINAL: + memcpy(macout, macin, sizeof(macout)); + break; + case RSP_FTICKS_MAC_VENDOR_HASHED: + memcpy(macout, macin, 9); + fticks_hashmac(macin, NULL, sizeof(macout) - 9, macout + 9); + break; + case RSP_FTICKS_MAC_VENDOR_KEY_HASHED: + memcpy(macout, macin, 9); + /* We are hashing the first nine octets too for easier + * correlation between vendor-key-hashed and + * fully-key-hashed log records. This opens up for a + * known plaintext attack on the key but the + * consequences of that is considered outweighed by + * the convenience gained. */ + fticks_hashmac(macin, options->fticks_key, + sizeof(macout) - 9, macout + 9); + break; + case RSP_FTICKS_MAC_FULLY_HASHED: + fticks_hashmac(macin, NULL, sizeof(macout), macout); + break; + case RSP_FTICKS_MAC_FULLY_KEY_HASHED: + fticks_hashmac(macin, options->fticks_key, sizeof(macout), + macout); + break; + default: + debugx(2, DBG_ERR, "invalid fticks mac configuration: %d", + options->fticks_mac); + } + } } debug(0xff, "F-TICKS/eduroam/1.0#REALM=%s#VISCOUNTRY=%s#%sCSI=%s#RESULT=%s#",