fticks.c 5.25 KB
Newer Older
1 2 3 4
/* Copyright (C) 2011 NORDUnet A/S
 * See LICENSE for information about licensing.
 */

5
#include <string.h>
6 7 8
#include "radsecproxy.h"
#include "debug.h"
#include "fticks.h"
9
#include "fticks_hashmac.h"
10

11 12 13 14 15 16 17 18 19 20
int
fticks_configure(struct options *options,
		 uint8_t **reportingp,
		 uint8_t **macp,
		 uint8_t **keyp)
{
    int r = 0;
    const char *reporting = (const char *) *reportingp;
    const char *mac = (const char *) *macp;

21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37
    /* Set defaults.  */
    options->fticks_reporting = RSP_FTICKS_REPORTING_NONE;
    options->fticks_mac = RSP_FTICKS_MAC_VENDOR_KEY_HASHED;

    if (reporting != NULL) {
	if (strcasecmp(reporting, "None") == 0)
	    options->fticks_reporting = RSP_FTICKS_REPORTING_NONE;
	else if (strcasecmp(reporting, "Basic") == 0)
	    options->fticks_reporting = RSP_FTICKS_REPORTING_BASIC;
	else if (strcasecmp(reporting, "Full") == 0)
	    options->fticks_reporting = RSP_FTICKS_REPORTING_FULL;
	else {
	    debugx(1, DBG_ERR,
		   "config error: invalid FTicksReporting value: %s",
		   reporting);
	    r = 1;
	}
38 39
    }

40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57
    if (mac != NULL) {
	if (strcasecmp(mac, "Static") == 0)
	    options->fticks_mac = RSP_FTICKS_MAC_STATIC;
	else if (strcasecmp(mac, "Original") == 0)
	    options->fticks_mac = RSP_FTICKS_MAC_ORIGINAL;
	else if (strcasecmp(mac, "VendorHashed") == 0)
	    options->fticks_mac = RSP_FTICKS_MAC_VENDOR_HASHED;
	else if (strcasecmp(mac, "VendorKeyHashed") == 0)
	    options->fticks_mac = RSP_FTICKS_MAC_VENDOR_KEY_HASHED;
	else if (strcasecmp(mac, "FullyHashed") == 0)
	    options->fticks_mac = RSP_FTICKS_MAC_FULLY_HASHED;
	else if (strcasecmp(mac, "FullyKeyHashed") == 0)
	    options->fticks_mac = RSP_FTICKS_MAC_FULLY_KEY_HASHED;
	else {
	    debugx(1, DBG_ERR,
		   "config error: invalid FTicksMAC value: %s", mac);
	    r = 1;
	}
58 59
    }

60 61 62 63 64 65 66 67 68
    if (*keyp != NULL) {
	options->fticks_key = *keyp;
	if (options->fticks_mac != RSP_FTICKS_MAC_VENDOR_KEY_HASHED
	    && options->fticks_mac != RSP_FTICKS_MAC_FULLY_KEY_HASHED)
	    debugx(1, DBG_WARN, "config warning: FTicksKey not used");
    }
    else if (options->fticks_reporting != RSP_FTICKS_REPORTING_NONE
	     && (options->fticks_mac == RSP_FTICKS_MAC_VENDOR_KEY_HASHED
		 || options->fticks_mac == RSP_FTICKS_MAC_FULLY_KEY_HASHED)) {
69
	debugx(1, DBG_ERR,
70 71 72
	       "config error: FTicksMAC values VendorKeyHashed and "
	       "FullyKeyHashed require an FTicksKey");
	options->fticks_reporting = RSP_FTICKS_REPORTING_NONE;
73 74 75 76 77 78 79 80 81 82 83 84 85 86
	r = 1;
    }

    if (*reportingp != NULL) {
	free(*reportingp);
	*reportingp = NULL;
    }
    if (*macp != NULL) {
	free(*macp);
	*macp = NULL;
    }
    return r;
}

87 88 89 90 91 92
void
fticks_log(const struct options *options,
	   const struct client *client,
	   const struct radmsg *msg,
	   const struct rqout *rqout)
{
93 94
    uint8_t *username = NULL;
    uint8_t *realm = NULL;
95 96 97 98 99 100 101
    uint8_t visinst[8+40+1+1]; /* Room for 40 octets of VISINST.  */
    uint8_t *macin = NULL;
    uint8_t macout[2*32+1]; /* Room for ASCII representation of SHA256.  */

    username = radattr2ascii(radmsg_gettype(rqout->rq->msg,
					    RAD_Attr_User_Name));
    if (username != NULL) {
102
	realm = (uint8_t *) strrchr((char *) username, '@');
103 104 105
	if (realm != NULL)
	    realm++;
    }
106 107
    if (realm == NULL)
	realm = (uint8_t *) "";
108 109

    memset(visinst, 0, sizeof(visinst));
110
    if (options->fticks_reporting == RSP_FTICKS_REPORTING_FULL) {
111 112
        if (client->conf->fticks_visinst != NULL ) {
	    snprintf((char *) visinst, sizeof(visinst), "VISINST=%s#",
113
                     client->conf->fticks_visinst);
114 115
        } else {
	    snprintf((char *) visinst, sizeof(visinst), "VISINST=%s#",
116
                     client->conf->name);
117
        }
118
    }
119 120

    memset(macout, 0, sizeof(macout));
121 122 123 124
    if (options->fticks_mac == RSP_FTICKS_MAC_STATIC) {
	strncpy((char *) macout, "undisclosed", sizeof(macout) - 1);
    }
    else {
125 126
	macin = radattr2ascii(radmsg_gettype(rqout->rq->msg,
					     RAD_Attr_Calling_Station_Id));
127 128 129 130 131 132 133 134
	if (macin) {
	    switch (options->fticks_mac)
	    {
	    case RSP_FTICKS_MAC_ORIGINAL:
		memcpy(macout, macin, sizeof(macout));
		break;
	    case RSP_FTICKS_MAC_VENDOR_HASHED:
		memcpy(macout, macin, 9);
135
		fticks_hashmac(macin, NULL, sizeof(macout) - 9, macout + 9);
136 137 138
		break;
	    case RSP_FTICKS_MAC_VENDOR_KEY_HASHED:
		memcpy(macout, macin, 9);
139 140 141 142 143 144 145
		/* We are hashing the first nine octets too for easier
		 * correlation between vendor-key-hashed and
		 * fully-key-hashed log records.  This opens up for a
		 * known plaintext attack on the key but the
		 * consequences of that is considered outweighed by
		 * the convenience gained.  */
		fticks_hashmac(macin, options->fticks_key,
146 147 148 149 150 151 152 153 154 155 156 157 158 159
			       sizeof(macout) - 9, macout + 9);
		break;
	    case RSP_FTICKS_MAC_FULLY_HASHED:
		fticks_hashmac(macin, NULL, sizeof(macout), macout);
		break;
	    case RSP_FTICKS_MAC_FULLY_KEY_HASHED:
		fticks_hashmac(macin, options->fticks_key, sizeof(macout),
			       macout);
		break;
	    default:
		debugx(2, DBG_ERR, "invalid fticks mac configuration: %d",
		       options->fticks_mac);
	    }
	}
160
    }
161
    fticks_debug(
162 163 164 165 166 167 168 169 170 171 172 173
	  "F-TICKS/eduroam/1.0#REALM=%s#VISCOUNTRY=%s#%sCSI=%s#RESULT=%s#",
	  realm,
	  client->conf->fticks_viscountry,
	  visinst,
	  macout,
	  msg->code == RAD_Access_Accept ? "OK" : "FAIL");
    if (macin != NULL)
	free(macin);
    if (username != NULL)
	free(username);
}

174 175 176
/* Local Variables: */
/* c-file-style: "stroustrup" */
/* End: */