src/modules/rlm_digest/rlm_digest.c

   1 /*
   2  * rlm_chap.c
   3  *
   4  * Version:  $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  *
  20  * Copyright 2002  The FreeRADIUS server project
  21  * Copyright 2002  Alan DeKok <aland@ox.org>
  22  */
  23
  24 #include <freeradius-devel/autoconf.h>
  25
  26 #include <stdio.h>
  27 #include <stdlib.h>
  28 #include <string.h>
  29
  30 #include <freeradius-devel/radiusd.h>
  31 #include <freeradius-devel/modules.h>
  32 #include <freeradius-devel/conffile.h>
  33
  34 static const char rcsid[] = "$Id$";
  35
  36 static int digest_authorize(void *instance, REQUEST *request)
  37 {
  38         VALUE_PAIR *vp;
  39
  40         /* quiet the compiler */
  41         instance = instance;
  42
  43         /*
  44          *      We need both of these attributes to do the authentication.
  45          */
  46         vp = pairfind(request->packet->vps, PW_DIGEST_RESPONSE);
  47         if (vp == NULL) {
  48                 return RLM_MODULE_NOOP;
  49         }
  50
  51         /*
  52          *      Check the sanity of the attribute.
  53          */
  54         if (vp->length != 32) {
  55                 DEBUG("ERROR: Received invalid Digest-Response attribute (length %d should be 32)", vp->length);
  56                 return RLM_MODULE_INVALID;
  57         }
  58
  59         /*
  60          *      We need these, too.
  61          */
  62         vp = pairfind(request->packet->vps, PW_DIGEST_ATTRIBUTES);
  63         if (vp == NULL) {
  64                 DEBUG("ERROR: Received Digest-Response without Digest-Attributes");
  65                 return RLM_MODULE_INVALID;
  66         }
  67
  68         /*
  69          *      Everything's OK, add a digest authentication type.
  70          */
  71         if (pairfind(request->config_items, PW_AUTHTYPE) == NULL) {
  72                 DEBUG("rlm_digest: Adding Auth-Type = DIGEST");
  73                 pairadd(&request->config_items,
  74                         pairmake("Auth-Type", "DIGEST", T_OP_EQ));
  75         }
  76
  77         return RLM_MODULE_OK;
  78 }
  79
  80 /*
  81  *      Perform all of the wondrous variants of digest authentication.
  82  */
  83 static int digest_authenticate(void *instance, REQUEST *request)
  84 {
  85         int i;
  86         size_t a1_len, a2_len, kd_len;
  87         uint8_t a1[(MAX_STRING_LEN + 1) * 5]; /* can be 5 attributes */
  88         uint8_t a2[(MAX_STRING_LEN + 1) * 3]; /* can be 3 attributes */
  89         uint8_t kd[(MAX_STRING_LEN + 1) * 5];
  90         uint8_t hash[16];       /* MD5 output */
  91         VALUE_PAIR *vp, *passwd, *algo;
  92         VALUE_PAIR *qop, *nonce;
  93
  94         instance = instance;    /* -Wunused */
  95
  96         /*
  97          *      We require access to the plain-text password.
  98          */
  99         passwd = pairfind(request->config_items, PW_DIGEST_HA1);
 100         if (passwd) {
 101                 if (passwd->length != 32) {
 102                         radlog(L_AUTH, "rlm_digest: Digest-HA1 has invalid length, authentication failed.");
 103                         return RLM_MODULE_INVALID;
 104                 }
 105         } else {
 106                 passwd = pairfind(request->config_items, PW_PASSWORD);
 107         }
 108         if (!passwd) {
 109                 radlog(L_AUTH, "rlm_digest: Configuration item \"User-Password\" or \"Digest-HA1\" is required for authentication.");
 110                 return RLM_MODULE_INVALID;
 111         }
 112
 113         /*
 114          *      We need these, too.
 115          */
 116         vp = pairfind(request->packet->vps, PW_DIGEST_ATTRIBUTES);
 117         if (vp == NULL) {
 118                 DEBUG("ERROR: You set 'Auth-Type = Digest' for a request that did not contain any digest attributes!");
 119                 return RLM_MODULE_INVALID;
 120         }
 121
 122         /*
 123          *      Loop through the Digest-Attributes, sanity checking them.
 124          */
 125         DEBUG("    rlm_digest: Converting Digest-Attributes to something sane...");
 126         while (vp) {
 127                 int length = vp->length;
 128                 int attrlen;
 129                 uint8_t *p = &vp->vp_octets[0];
 130                 VALUE_PAIR *sub;
 131
 132                 /*
 133                  *      Until this stupidly encoded attribure is exhausted.
 134                  */
 135                 while (length > 0) {
 136                         /*
 137                          *      The attribute type must be valid
 138                          */
 139                         if ((p[0] == 0) || (p[0] > 10)) {
 140                                 DEBUG("ERROR: Received Digest-Attributes with invalid sub-attribute %d", p[0]);
 141                                 return RLM_MODULE_INVALID;
 142                         }
 143
 144                         attrlen = p[1]; /* stupid VSA format */
 145
 146                         /*
 147                          *      Too short.
 148                          */
 149                         if (attrlen < 3) {
 150                                 DEBUG("ERROR: Received Digest-Attributes with short sub-attribute %d, of length %d", p[0], attrlen);
 151                                 return RLM_MODULE_INVALID;
 152                         }
 153
 154                         /*
 155                          *      Too long.
 156                          */
 157                         if (attrlen > length) {
 158                                 DEBUG("ERROR: Received Digest-Attributes with long sub-attribute %d, of length %d", p[0], attrlen);
 159                                 return RLM_MODULE_INVALID;
 160                         }
 161
 162                         /*
 163                          *      Create a new attribute, broken out of
 164                          *      the stupid sub-attribute crap.
 165                          *
 166                          *      Didn't they know that VSA's exist?
 167                          */
 168                         sub = paircreate(PW_DIGEST_REALM - 1 + p[0],
 169                                          PW_TYPE_STRING);
 170                         if (!sub) {
 171                                 return RLM_MODULE_FAIL; /* out of memory */
 172                         }
 173                         memcpy(&sub->vp_octets[0], &p[2], attrlen - 2);
 174                         sub->vp_octets[attrlen - 2] = '\0';
 175                         sub->length = attrlen - 2;
 176
 177                         if (debug_flag) {
 178                           putchar('\t');
 179                           vp_print(stdout, sub);
 180                           putchar('\n');
 181                         }
 182
 183                         /*
 184                          *      And add it to the request pairs.
 185                          */
 186                         pairadd(&request->packet->vps, sub);
 187
 188                         /*
 189                          *      FIXME: Check for the existence
 190                          *      of the necessary attributes!
 191                          */
 192
 193                         length -= attrlen;
 194                         p += attrlen;
 195                 } /* loop over this one attribute */
 196
 197                 /*
 198                  *      Find the next one, if it exists.
 199                  */
 200                 vp = pairfind(vp->next, PW_DIGEST_ATTRIBUTES);
 201         }
 202
 203         /*
 204          *      We require access to the Digest-Nonce-Value
 205          */
 206         nonce = pairfind(request->packet->vps, PW_DIGEST_NONCE);
 207         if (!nonce) {
 208                 DEBUG("ERROR: No Digest-Nonce: Cannot perform Digest authentication");
 209                 return RLM_MODULE_INVALID;
 210         }
 211
 212         /*
 213          *      A1 = Digest-User-Name ":" Realm ":" Password
 214          */
 215         vp = pairfind(request->packet->vps, PW_DIGEST_USER_NAME);
 216         if (!vp) {
 217                 DEBUG("ERROR: No Digest-User-Name: Cannot perform Digest authentication");
 218                 return RLM_MODULE_INVALID;
 219         }
 220         memcpy(&a1[0], &vp->vp_octets[0], vp->length);
 221         a1_len = vp->length;
 222
 223         a1[a1_len] = ':';
 224         a1_len++;
 225
 226         vp = pairfind(request->packet->vps, PW_DIGEST_REALM);
 227         if (!vp) {
 228                 DEBUG("ERROR: No Digest-Realm: Cannot perform Digest authentication");
 229                 return RLM_MODULE_INVALID;
 230         }
 231         memcpy(&a1[a1_len], &vp->vp_octets[0], vp->length);
 232         a1_len += vp->length;
 233
 234         a1[a1_len] = ':';
 235         a1_len++;
 236
 237         if (passwd->attribute == PW_USER_PASSWORD) {
 238                 memcpy(&a1[a1_len], &passwd->vp_octets[0], passwd->length);
 239                 a1_len += passwd->length;
 240                 a1[a1_len] = '\0';
 241                 DEBUG2("A1 = %s", a1);
 242         } else {
 243                 a1[a1_len] = '\0';
 244                 DEBUG2("A1 = %s (using Digest-HA1)", a1);
 245                 a1_len = 16;
 246         }
 247
 248         /*
 249          *      See which variant we calculate.
 250          *      Assume MD5 if no Digest-Algorithm attribute received
 251          */
 252         algo = pairfind(request->packet->vps, PW_DIGEST_ALGORITHM);
 253         if ((algo == NULL) ||
 254             (strcasecmp(algo->vp_strvalue, "MD5") == 0)) {
 255                 /*
 256                  *      Set A1 to Digest-HA1 if no User-Password found
 257                  */
 258                 if (passwd->attribute == PW_DIGEST_HA1) {
 259                         lrad_hex2bin(passwd->vp_strvalue, &a1[0], 16);
 260                 }
 261
 262         } else if (strcasecmp(algo->vp_strvalue, "MD5-sess") == 0) {
 263                 /*
 264                  *      K1 = H(A1) : Digest-Nonce ... : H(A2)
 265                  *
 266                  *      If we find Digest-HA1, we assume it contains
 267                  *      H(A1).
 268                  */
 269                 if (passwd->attribute == PW_USER_PASSWORD) {
 270                         librad_md5_calc(hash, &a1[0], a1_len);
 271                         lrad_bin2hex(hash, &a1[0], 16);
 272                 } else {        /* MUST be Digest-HA1 */
 273                         memcpy(&a1[0], passwd->vp_strvalue, 32);
 274                 }
 275                 a1_len = 32;
 276
 277                 a1[a1_len] = ':';
 278                 a1_len++;
 279
 280                 /*
 281                  *      Tack on the Digest-Nonce. Length must be even
 282                  */
 283                 if ((nonce->length & 1) != 0) {
 284                         DEBUG("ERROR: Received Digest-Nonce hex string with invalid length: Cannot perform Digest authentication");
 285                         return RLM_MODULE_INVALID;
 286                 }
 287                 memcpy(&a1[a1_len], &nonce->vp_octets[0], nonce->length);
 288                 a1_len += nonce->length;
 289
 290                 a1[a1_len] = ':';
 291                 a1_len++;
 292
 293                 vp = pairfind(request->packet->vps, PW_DIGEST_CNONCE);
 294                 if (!vp) {
 295                         DEBUG("ERROR: No Digest-CNonce: Cannot perform Digest authentication");
 296                         return RLM_MODULE_INVALID;
 297                 }
 298
 299                 /*
 300                  *      Digest-CNonce length must be even
 301                  */
 302                 if ((vp->length & 1) != 0) {
 303                         DEBUG("ERROR: Received Digest-CNonce hex string with invalid length: Cannot perform Digest authentication");
 304                         return RLM_MODULE_INVALID;
 305                 }
 306                 memcpy(&a1[a1_len], &vp->vp_octets[0], vp->length);
 307                 a1_len += vp->length;
 308
 309         } else if ((algo != NULL) &&
 310                    (strcasecmp(algo->vp_strvalue, "MD5") != 0)) {
 311                 /*
 312                  *      We check for "MD5-sess" and "MD5".
 313                  *      Anything else is an error.
 314                  */
 315                 DEBUG("ERROR: Unknown Digest-Algorithm \"%s\": Cannot perform Digest authentication", vp->vp_strvalue);
 316                 return RLM_MODULE_INVALID;
 317         }
 318
 319         /*
 320          *      A2 = Digest-Method ":" Digest-URI
 321          */
 322         vp = pairfind(request->packet->vps, PW_DIGEST_METHOD);
 323         if (!vp) {
 324                 DEBUG("ERROR: No Digest-Method: Cannot perform Digest authentication");
 325                 return RLM_MODULE_INVALID;
 326         }
 327         memcpy(&a2[0], &vp->vp_octets[0], vp->length);
 328         a2_len = vp->length;
 329
 330         a2[a2_len] = ':';
 331         a2_len++;
 332
 333         vp = pairfind(request->packet->vps, PW_DIGEST_URI);
 334         if (!vp) {
 335                 DEBUG("ERROR: No Digest-URI: Cannot perform Digest authentication");
 336                 return RLM_MODULE_INVALID;
 337         }
 338         memcpy(&a2[a2_len], &vp->vp_octets[0], vp->length);
 339         a2_len += vp->length;
 340
 341         /*
 342          *  QOP is "auth-int", tack on ": Digest-Body-Digest"
 343          */
 344         qop = pairfind(request->packet->vps, PW_DIGEST_QOP);
 345         if ((qop != NULL) &&
 346             (strcasecmp(qop->vp_strvalue, "auth-int") == 0)) {
 347                 VALUE_PAIR *body;
 348
 349                 /*
 350                  *      Add in Digest-Body-Digest
 351                  */
 352                 a2[a2_len] = ':';
 353                 a2_len++;
 354
 355                 /*
 356                  *  Must be a hex representation of an MD5 digest.
 357                  */
 358                 body = pairfind(request->packet->vps, PW_DIGEST_BODY_DIGEST);
 359                 if (!body) {
 360                         DEBUG("ERROR: No Digest-Body-Digest: Cannot perform Digest authentication");
 361                         return RLM_MODULE_INVALID;
 362                 }
 363
 364                 if ((a2_len + body->length) > sizeof(a2)) {
 365                         DEBUG("ERROR: Digest-Body-Digest is too long");
 366                         return RLM_MODULE_INVALID;
 367                 }
 368
 369                 memcpy(a2 + a2_len, body->vp_octets, body->length);
 370                 a2_len += body->length;
 371
 372         } else if ((qop != NULL) &&
 373                    (strcasecmp(qop->vp_strvalue, "auth") != 0)) {
 374                 DEBUG("ERROR: Unknown Digest-QOP \"%s\": Cannot perform Digest authentication", qop->vp_strvalue);
 375                 return RLM_MODULE_INVALID;
 376         }
 377
 378         a2[a2_len] = '\0';
 379         DEBUG2("A2 = %s", a2);
 380
 381         /*
 382          *     KD = H(A1) : Digest-Nonce ... : H(A2).
 383          *     Compute MD5 if Digest-Algorithm == "MD5-Sess",
 384          *     or if we found a User-Password.
 385          */
 386         if (((algo != NULL) &&
 387              (strcasecmp(algo->vp_strvalue, "MD5-Sess") == 0)) ||
 388             (passwd->attribute == PW_USER_PASSWORD)) {
 389                 a1[a1_len] = '\0';
 390                 librad_md5_calc(&hash[0], &a1[0], a1_len);
 391         } else {
 392                 memcpy(&hash[0], &a1[0], a1_len);
 393         }
 394         lrad_bin2hex(hash, kd, sizeof(hash));
 395
 396 #ifndef NDEBUG
 397         if (debug_flag) {
 398                 printf("H(A1) = ");
 399                 for (i = 0; i < 16; i++) {
 400                         printf("%02x", hash[i]);
 401                 }
 402                 printf("\n");
 403         }
 404 #endif
 405         kd_len = 32;
 406
 407         kd[kd_len] = ':';
 408         kd_len++;
 409
 410         memcpy(&kd[kd_len], nonce->vp_octets, nonce->length);
 411         kd_len += nonce->length;
 412
 413         /*
 414          *      No QOP defined.  Do RFC 2069 compatibility.
 415          */
 416         if (!qop) {
 417                 /*
 418                  *      Do nothing here.
 419                  */
 420
 421         } else {                /* Digest-QOP MUST be "auth" or "auth-int" */
 422                 /*
 423                  *      Tack on ":" Digest-Nonce-Count ":" Digest-CNonce
 424                  *             ":" Digest-QOP
 425                  */
 426                 kd[kd_len] = ':';
 427                 kd_len++;
 428
 429                 vp = pairfind(request->packet->vps, PW_DIGEST_NONCE_COUNT);
 430                 if (!vp) {
 431                         DEBUG("ERROR: No Digest-Nonce-Count: Cannot perform Digest authentication");
 432                         return RLM_MODULE_INVALID;
 433                 }
 434                 memcpy(&kd[kd_len], &vp->vp_octets[0], vp->length);
 435                 kd_len += vp->length;
 436
 437                 kd[kd_len] = ':';
 438                 kd_len++;
 439
 440                 vp = pairfind(request->packet->vps, PW_DIGEST_CNONCE);
 441                 if (!vp) {
 442                         DEBUG("ERROR: No Digest-CNonce: Cannot perform Digest authentication");
 443                         return RLM_MODULE_INVALID;
 444                 }
 445                 memcpy(&kd[kd_len], &vp->vp_octets[0], vp->length);
 446                 kd_len += vp->length;
 447
 448                 kd[kd_len] = ':';
 449                 kd_len++;
 450
 451                 memcpy(&kd[kd_len], &qop->vp_octets[0], qop->length);
 452                 kd_len += qop->length;
 453         }
 454
 455         /*
 456          *      Tack on ":" H(A2)
 457          */
 458         kd[kd_len] = ':';
 459         kd_len++;
 460
 461         librad_md5_calc(&hash[0], &a2[0], a2_len);
 462
 463         lrad_bin2hex(hash, kd + kd_len, sizeof(hash));
 464
 465 #ifndef NDEBUG
 466         if (debug_flag) {
 467                 printf("H(A2) = ");
 468                 for (i = 0; i < 16; i++) {
 469                         printf("%02x", hash[i]);
 470                 }
 471                 printf("\n");
 472         }
 473 #endif
 474         kd_len += 32;
 475
 476         kd[kd_len] = 0;
 477
 478         DEBUG2("KD = %s\n", &kd[0]);
 479
 480         /*
 481          *      Take the hash of KD.
 482          */
 483         librad_md5_calc(&hash[0], &kd[0], kd_len);
 484         memcpy(&kd[0], &hash[0], 16);
 485
 486         /*
 487          *      Get the binary value of Digest-Response
 488          */
 489         vp = pairfind(request->packet->vps, PW_DIGEST_RESPONSE);
 490         if (!vp) {
 491                 DEBUG("ERROR: No Digest-Response attribute in the request.  Cannot perform digest authentication");
 492                 return RLM_MODULE_INVALID;
 493         }
 494
 495         lrad_hex2bin(&vp->vp_octets[0], &hash[0], vp->length >> 1);
 496
 497 #ifndef NDEBUG
 498         if (debug_flag) {
 499                 printf("EXPECTED ");
 500                 for (i = 0; i < 16; i++) {
 501                         printf("%02x", kd[i]);
 502                 }
 503                 printf("\n");
 504
 505                 printf("RECEIVED ");
 506                 for (i = 0; i < 16; i++) {
 507                         printf("%02x", hash[i]);
 508                 }
 509                 printf("\n");
 510         }
 511 #endif
 512
 513         /*
 514          *  And finally, compare the digest in the packet with KD.
 515          */
 516         if (memcmp(&kd[0], &hash[0], 16) == 0) {
 517                 return RLM_MODULE_OK;
 518         }
 519
 520         DEBUG("rlm_digest: FAILED authentication");
 521         return RLM_MODULE_REJECT;
 522 }
 523
 524 /*
 525  *      The module name should be the only globally exported symbol.
 526  *      That is, everything else should be 'static'.
 527  *
 528  *      If the module needs to temporarily modify it's instantiation
 529  *      data, the type should be changed to RLM_TYPE_THREAD_UNSAFE.
 530  *      The server will then take care of ensuring that the module
 531  *      is single-threaded.
 532  */
 533 module_t rlm_digest = {
 534         RLM_MODULE_INIT,
 535         "digest",
 536         0,                              /* type */
 537         NULL,                           /* instantiation */
 538         NULL,                           /* detach */
 539         {
 540                 digest_authenticate,    /* authentication */
 541                 digest_authorize,       /* authorization */
 542                 NULL,                   /* preaccounting */
 543                 NULL,                   /* accounting */
 544                 NULL,                   /* checksimul */
 545                 NULL,                   /* pre-proxy */
 546                 NULL,                   /* post-proxy */
 547                 NULL                    /* post-auth */
 548         },
 549 };