adapters/iscsi/radius_auth.c

fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte/*
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte * CDDL HEADER START
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte *
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte * The contents of this file are subject to the terms of the
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte * Common Development and Distribution License (the "License").
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte * You may not use this file except in compliance with the License.
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte *
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte * or http://www.opensolaris.org/os/licensing.
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte * See the License for the specific language governing permissions
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte * and limitations under the License.
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte *
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte * When distributing Covered Code, include this CDDL HEADER in each
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte * If applicable, add the following below this CDDL HEADER, with the
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte * fields enclosed by brackets "[]" replaced with your own identifying
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte * information: Portions Copyright [yyyy] [name of copyright owner]
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte *
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte * CDDL HEADER END
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte */
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte/*
5df5713f81d69c1a0797f99b13e95e220da00ef9bing zhao - Sun Microsystems - Beijing China * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte * Use is subject to license terms.
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte */
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte#include <netinet/in.h>
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte#include <sys/kmem.h>
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte#include <sys/random.h>
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte#include <sys/socket.h>
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte#include "chap.h"
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte#include <sys/scsi/adapters/iscsi_if.h>
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte#include "iscsi.h"
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte#include <sys/md5.h>
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte#include "radius_packet.h"
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte#include "radius_protocol.h"
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte#include "radius_auth.h"
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte#include <sys/sunddi.h>
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte/* Forward declaration */
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte/*
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte * Annotate the radius_attr_t objects with authentication data.
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte */
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Fortestatic
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Fortevoid
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forteset_radius_attrs(radius_packet_data_t *req,
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    char *target_chap_name,
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    unsigned char *target_response,
5df5713f81d69c1a0797f99b13e95e220da00ef9bing zhao - Sun Microsystems - Beijing China    uint32_t response_length,
5df5713f81d69c1a0797f99b13e95e220da00ef9bing zhao - Sun Microsystems - Beijing China    uint8_t *challenge,
5df5713f81d69c1a0797f99b13e95e220da00ef9bing zhao - Sun Microsystems - Beijing China    uint32_t challenge_length);
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte/*
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte * See radius_auth.h.
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte */
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte/* ARGSUSED */
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Fortechap_validation_status_type
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forteradius_chap_validate(char *target_chap_name,
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    char *initiator_chap_name,
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    uint8_t *challenge,
5df5713f81d69c1a0797f99b13e95e220da00ef9bing zhao - Sun Microsystems - Beijing China    uint32_t challenge_length,
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    uint8_t *target_response,
5df5713f81d69c1a0797f99b13e95e220da00ef9bing zhao - Sun Microsystems - Beijing China    uint32_t response_length,
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    uint8_t identifier,
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    iscsi_ipaddr_t rad_svr_ip_addr,
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    uint32_t rad_svr_port,
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    uint8_t *rad_svr_shared_secret,
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    uint32_t rad_svr_shared_secret_len)
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte{
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    chap_validation_status_type validation_status;
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    char lbolt[64];
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    int rcv_status;
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    void *socket;
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    radius_packet_data_t req;
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    radius_packet_data_t resp;
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    MD5_CTX context;
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    uint8_t md5_digest[16];     /* MD5 digest length 16 */
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    uint8_t random_number[16];
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    if (rad_svr_shared_secret_len == 0) {
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte        /* The secret must not be empty (section 3, RFC 2865) */
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte        cmn_err(CE_WARN, "empty RADIUS shared secret");
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte        return (CHAP_VALIDATION_BAD_RADIUS_SECRET);
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    }
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    bzero(&req, sizeof (radius_packet_data_t));
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    req.identifier = identifier;
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    req.code = RAD_ACCESS_REQ;
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    set_radius_attrs(&req,
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte        target_chap_name,
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte        target_response,
5df5713f81d69c1a0797f99b13e95e220da00ef9bing zhao - Sun Microsystems - Beijing China        response_length,
5df5713f81d69c1a0797f99b13e95e220da00ef9bing zhao - Sun Microsystems - Beijing China        challenge,
5df5713f81d69c1a0797f99b13e95e220da00ef9bing zhao - Sun Microsystems - Beijing China        challenge_length);
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    /* Prepare the request authenticator */
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    MD5Init(&context);
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    bzero(&md5_digest, 16);
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    /* First, the shared secret */
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    MD5Update(&context, rad_svr_shared_secret, rad_svr_shared_secret_len);
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    /* Then a unique number - use lbolt plus a random number */
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    bzero(&lbolt, sizeof (lbolt));
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    (void) snprintf(lbolt, sizeof (lbolt), "%lx", ddi_get_lbolt());
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    MD5Update(&context, (uint8_t *)lbolt, strlen(lbolt));
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    bzero(&random_number, sizeof (random_number));
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    (void) random_get_pseudo_bytes(random_number,
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte        sizeof (random_number));
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    MD5Update(&context, random_number, sizeof (random_number));
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    MD5Final(md5_digest, &context);
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    bcopy(md5_digest, &req.authenticator, RAD_AUTHENTICATOR_LEN);
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    socket = iscsi_net->socket(AF_INET, SOCK_DGRAM, 0);
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    if (socket == NULL) {
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte        /* Error obtaining socket for RADIUS use */
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte        return (CHAP_VALIDATION_RADIUS_ACCESS_ERROR);
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    }
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    /* Send the authentication access request to the RADIUS server */
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    if (snd_radius_request(socket,
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte        rad_svr_ip_addr,
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte        rad_svr_port,
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte        &req) == -1) {
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte        return (CHAP_VALIDATION_RADIUS_ACCESS_ERROR);
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    }
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    bzero(&resp, sizeof (radius_packet_data_t));
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    /*  Analyze the response coming through from the same socket. */
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    rcv_status = rcv_radius_response(socket,
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte        rad_svr_shared_secret,
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte        rad_svr_shared_secret_len,
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte        req.authenticator, &resp);
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    if (rcv_status == RAD_RSP_RCVD_SUCCESS) {
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte        if (resp.code == RAD_ACCESS_ACPT) {
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte            validation_status = CHAP_VALIDATION_PASSED;
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte        } else if (resp.code == RAD_ACCESS_REJ) {
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte            validation_status = CHAP_VALIDATION_INVALID_RESPONSE;
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte        } else {
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte            validation_status =
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte                CHAP_VALIDATION_UNKNOWN_RADIUS_CODE;
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte        }
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    } else if (rcv_status == RAD_RSP_RCVD_AUTH_FAILED) {
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte        cmn_err(CE_WARN, "RADIUS packet authentication failed");
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte        validation_status = CHAP_VALIDATION_BAD_RADIUS_SECRET;
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    } else {
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte        validation_status = CHAP_VALIDATION_RADIUS_ACCESS_ERROR;
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    }
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    iscsi_net->close(socket);
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    return (validation_status);
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte}
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte/* See forward declaration. */
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Fortestatic void
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forteset_radius_attrs(radius_packet_data_t *req,
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    char *target_chap_name,
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    unsigned char *target_response,
5df5713f81d69c1a0797f99b13e95e220da00ef9bing zhao - Sun Microsystems - Beijing China    uint32_t response_length,
5df5713f81d69c1a0797f99b13e95e220da00ef9bing zhao - Sun Microsystems - Beijing China    uint8_t *challenge,
5df5713f81d69c1a0797f99b13e95e220da00ef9bing zhao - Sun Microsystems - Beijing China    uint32_t challenge_length)
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte{
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    req->attrs[0].attr_type_code = RAD_USER_NAME;
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    (void) strncpy((char *)req->attrs[0].attr_value,
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte        (const char *)target_chap_name,
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte        strlen(target_chap_name));
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    req->attrs[0].attr_value_len = strlen(target_chap_name);
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    req->attrs[1].attr_type_code = RAD_CHAP_PASSWORD;
5df5713f81d69c1a0797f99b13e95e220da00ef9bing zhao - Sun Microsystems - Beijing China    bcopy(target_response,
5df5713f81d69c1a0797f99b13e95e220da00ef9bing zhao - Sun Microsystems - Beijing China        (char *)req->attrs[1].attr_value,
5df5713f81d69c1a0797f99b13e95e220da00ef9bing zhao - Sun Microsystems - Beijing China        min(response_length, sizeof (req->attrs[1].attr_value)));
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    /* A target response is an MD5 hash thus its length has to be 16. */
5df5713f81d69c1a0797f99b13e95e220da00ef9bing zhao - Sun Microsystems - Beijing China    req->attrs[1].attr_value_len = response_length;
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    req->attrs[2].attr_type_code = RAD_CHAP_CHALLENGE;
5df5713f81d69c1a0797f99b13e95e220da00ef9bing zhao - Sun Microsystems - Beijing China    bcopy(challenge,
5df5713f81d69c1a0797f99b13e95e220da00ef9bing zhao - Sun Microsystems - Beijing China        (char *)req->attrs[2].attr_value,
5df5713f81d69c1a0797f99b13e95e220da00ef9bing zhao - Sun Microsystems - Beijing China        min(challenge_length, sizeof (req->attrs[2].attr_value)));
5df5713f81d69c1a0797f99b13e95e220da00ef9bing zhao - Sun Microsystems - Beijing China    req->attrs[2].attr_value_len = challenge_length;
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    /* 3 attributes associated with each RADIUS packet. */
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte    req->num_of_attrs = 3;
fcf3ce441efd61da9bb2884968af01cb7c1452ccJohn Forte}