25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis/*
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis * CDDL HEADER START
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis *
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis * The contents of this file are subject to the terms of the
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis * Common Development and Distribution License (the "License").
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis * You may not use this file except in compliance with the License.
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis *
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis * or http://www.opensolaris.org/os/licensing.
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis * See the License for the specific language governing permissions
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis * and limitations under the License.
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis *
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis * When distributing Covered Code, include this CDDL HEADER in each
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis * If applicable, add the following below this CDDL HEADER, with the
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis * fields enclosed by brackets "[]" replaced with your own identifying
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis * information: Portions Copyright [yyyy] [name of copyright owner]
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis *
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis * CDDL HEADER END
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis */
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis/*
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis */
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis#include <sys/random.h>
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis#include <sys/ddi.h>
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis#include <sys/md5.h>
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis#include <sys/iscsit/iscsi_if.h>
ddc0e0b53c661f6e439e3b7072b3ef353eadb4afRichard Lowe#include <sys/idm/idm.h>
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis#include <sys/idm/idm_so.h>
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis#include <sys/iscsit/radius_packet.h>
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis#include <sys/iscsit/radius_protocol.h>
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis#include "radius_auth.h"
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis/* Forward declaration */
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis/*
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis * Annotate the radius_attr_t objects with authentication data.
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis */
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtisstatic
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtisvoid
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtisset_radius_attrs(radius_packet_data_t *req,
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis char *target_chap_name,
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis unsigned char *target_response,
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis uint32_t response_length,
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis uint8_t *challenge,
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis uint32_t challenge_length);
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis/*
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis * See radius_auth.h.
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis */
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis/* ARGSUSED */
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtischap_validation_status_type
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtisiscsit_radius_chap_validate(char *target_chap_name,
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis char *initiator_chap_name,
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis uint8_t *challenge,
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis uint32_t challenge_length,
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis uint8_t *target_response,
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis uint32_t response_length,
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis uint8_t identifier,
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis iscsi_ipaddr_t rad_svr_ip_addr,
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis uint32_t rad_svr_port,
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis uint8_t *rad_svr_shared_secret,
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis uint32_t rad_svr_shared_secret_len)
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis{
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis chap_validation_status_type validation_status;
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis char lbolt[64];
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis int rcv_status;
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis void *socket;
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis radius_packet_data_t req;
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis radius_packet_data_t resp;
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis MD5_CTX context;
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis uint8_t md5_digest[16]; /* MD5 digest length 16 */
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis uint8_t random_number[16];
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis if (rad_svr_shared_secret_len == 0) {
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis /* The secret must not be empty (section 3, RFC 2865) */
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis cmn_err(CE_WARN, "empty RADIUS shared secret");
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis return (CHAP_VALIDATION_BAD_RADIUS_SECRET);
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis }
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis bzero(&req, sizeof (radius_packet_data_t));
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis
25c28e83beb90e7c80452a7c818c5e6f73a07dc8Piotr Jasiukajtis req.identifier = identifier;
req.code = RAD_ACCESS_REQ;
set_radius_attrs(&req,
target_chap_name,
target_response,
response_length,
challenge,
challenge_length);
/* Prepare the request authenticator */
MD5Init(&context);
bzero(&md5_digest, 16);
/* First, the shared secret */
MD5Update(&context, rad_svr_shared_secret, rad_svr_shared_secret_len);
/* Then a unique number - use lbolt plus a random number */
bzero(&lbolt, sizeof (lbolt));
(void) snprintf(lbolt, sizeof (lbolt), "%lx", ddi_get_lbolt());
MD5Update(&context, (uint8_t *)lbolt, strlen(lbolt));
bzero(&random_number, sizeof (random_number));
(void) random_get_pseudo_bytes(random_number, sizeof (random_number));
MD5Update(&context, random_number, sizeof (random_number));
MD5Final(md5_digest, &context);
bcopy(md5_digest, &req.authenticator, RAD_AUTHENTICATOR_LEN);
socket = idm_socreate(PF_INET, SOCK_DGRAM, 0);
if (socket == NULL) {
/* Error obtaining socket for RADIUS use */
return (CHAP_VALIDATION_RADIUS_ACCESS_ERROR);
}
/* Send the authentication access request to the RADIUS server */
if (iscsit_snd_radius_request(socket,
rad_svr_ip_addr,
rad_svr_port,
&req) != 0) {
idm_soshutdown(socket);
idm_sodestroy(socket);
return (CHAP_VALIDATION_RADIUS_ACCESS_ERROR);
}
bzero(&resp, sizeof (radius_packet_data_t));
/* Analyze the response coming through from the same socket. */
rcv_status = iscsit_rcv_radius_response(socket,
rad_svr_shared_secret,
rad_svr_shared_secret_len,
req.authenticator, &resp);
if (rcv_status == RAD_RSP_RCVD_SUCCESS) {
if (resp.code == RAD_ACCESS_ACPT) {
validation_status = CHAP_VALIDATION_PASSED;
} else if (resp.code == RAD_ACCESS_REJ) {
validation_status = CHAP_VALIDATION_INVALID_RESPONSE;
} else {
validation_status =
CHAP_VALIDATION_UNKNOWN_RADIUS_CODE;
}
} else if (rcv_status == RAD_RSP_RCVD_AUTH_FAILED) {
validation_status = CHAP_VALIDATION_BAD_RADIUS_SECRET;
} else {
validation_status = CHAP_VALIDATION_RADIUS_ACCESS_ERROR;
}
/* Done! Close the socket. */
idm_soshutdown(socket);
idm_sodestroy(socket);
return (validation_status);
}
/* See forward declaration. */
static void
set_radius_attrs(radius_packet_data_t *req,
char *target_chap_name,
unsigned char *target_response,
uint32_t response_length,
uint8_t *challenge,
uint32_t challenge_length)
{
req->attrs[0].attr_type_code = RAD_USER_NAME;
(void) strncpy((char *)req->attrs[0].attr_value,
(const char *)target_chap_name,
strlen(target_chap_name));
req->attrs[0].attr_value_len = strlen(target_chap_name);
req->attrs[1].attr_type_code = RAD_CHAP_PASSWORD;
bcopy(target_response,
(char *)req->attrs[1].attr_value,
min(response_length, sizeof (req->attrs[1].attr_value)));
/* A target response is an MD5 hash thus its length has to be 16. */
req->attrs[1].attr_value_len = 16;
req->attrs[2].attr_type_code = RAD_CHAP_CHALLENGE;
bcopy(challenge,
(char *)req->attrs[2].attr_value,
min(challenge_length, sizeof (req->attrs[2].attr_value)));
req->attrs[2].attr_value_len = challenge_length;
/* 3 attributes associated with each RADIUS packet. */
req->num_of_attrs = 3;
}