From 00e0ae25ec062b4d92ab388e2884d1af6c2e511e Mon Sep 17 00:00:00 2001 From: venaas Date: Thu, 6 Nov 2008 09:28:24 +0000 Subject: made 20081106 snapshot branch, updated version/date info git-svn-id: https://svn.testnett.uninett.no/radsecproxy/branches/devel-20081106@434 e88ac4ed-0b26-0410-9574-a7f39faa03bf --- ChangeLog | 6 +++ README | 4 +- configure.ac | 2 +- radsecproxy.c | 109 ++++++++++++++++++++++++++++++------------------- radsecproxy.conf.5 | 35 +++++++++++++--- radsecproxy.conf.5.xml | 48 ++++++++++++++++++---- radsecproxy.h | 1 + 7 files changed, 147 insertions(+), 58 deletions(-) diff --git a/ChangeLog b/ChangeLog index 6693042..3f9948a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -47,3 +47,9 @@ Additional features in devel-20081006 Dynamic server discovery DuplicateInterval option in client block for specifying for how long a request/reply shall be stored for duplicate detection +Additional features in devel-20081106 + Support for RADIUS TTL (hopcount) attribute. Decrements value of + the TTL attribute if present, discards message if becomes 0. + If addTTL option is used, the TTL attribute is added with the + specified value if the forwarded message does not have one. + PolicyOID option can be used to require certain CA policies. diff --git a/README b/README index ec10e18..98459bf 100644 --- a/README +++ b/README @@ -1,4 +1,4 @@ -This is a revision from the radsecproxy 2.0 devel branch. +This is a snapshot of the radsecproxy 2.0 devel branch from Nov 6, 2008 radsecproxy is a generic RADIUS proxy that can support various RADIUS clients over UDP or TLS (RadSec). @@ -37,4 +37,4 @@ let me know if you feel left out. For more information, feedback etc. please see the information at http://software.uninett.no/radsecproxy/ -Stig Venaas -- 2008.10.07 +Stig Venaas -- 2008.11.06 diff --git a/configure.ac b/configure.ac index 65f386e..e5aa6b2 100644 --- a/configure.ac +++ b/configure.ac @@ -1,4 +1,4 @@ -AC_INIT(radsecproxy, 2.0-devel, venaas@uninett.no) +AC_INIT(radsecproxy, devel-20081106, venaas@uninett.no) AM_INIT_AUTOMAKE AC_PROG_CC AM_PROG_CC_C_O diff --git a/radsecproxy.c b/radsecproxy.c index b611053..347d72a 100644 --- a/radsecproxy.c +++ b/radsecproxy.c @@ -1616,6 +1616,7 @@ int addvendorattr(struct radmsg *msg, uint32_t vendor, struct tlv *attr) { vendor = htonl(vendor); memcpy(v, &vendor, 4); tlv2buf(v + 4, attr); + v[5] += 2; vattr = maketlv(RAD_Attr_Vendor_Specific, l, v); if (vattr && radmsg_add(msg, vattr)) return 1; @@ -1664,7 +1665,8 @@ int decttl(uint8_t l, uint8_t *v) { return 1; } -int dottl(struct radmsg *msg, uint32_t *attrtype, uint8_t addttl) { +/* returns -1 if no ttl, 0 if exceeded, 1 if ok */ +int checkttl(struct radmsg *msg, uint32_t *attrtype) { uint8_t alen, *subattrs; struct tlv *attr; struct list_node *node; @@ -1695,9 +1697,7 @@ int dottl(struct radmsg *msg, uint32_t *attrtype, uint8_t addttl) { subattrs += alen; } } - if (addttl) - addttlattr(msg, attrtype, addttl); - return 1; + return -1; } const char *radmsgtype2string(uint8_t code) { @@ -1902,6 +1902,7 @@ int radsrv(struct request *rq) { struct realm *realm = NULL; struct server *to = NULL; struct client *from = rq->from; + int ttlres; msg = buf2radmsg(rq->buf, (uint8_t *)from->conf->secret, NULL); free(rq->buf); @@ -1936,7 +1937,8 @@ int radsrv(struct request *rq) { if (from->conf->rewritein && !dorewrite(msg, from->conf->rewritein)) goto rmclrqexit; - if (!dottl(msg, options.ttlattrtype, options.addttl)) { + ttlres = checkttl(msg, options.ttlattrtype); + if (!ttlres) { debug(DBG_WARN, "radsrv: ignoring request from client %s (%s), ttl exceeded", from->conf->name, addr2string(from->addr)); goto exit; } @@ -2013,6 +2015,9 @@ int radsrv(struct request *rq) { if (to->conf->rewriteout && !dorewrite(msg, to->conf->rewriteout)) goto rmclrqexit; + if (ttlres == -1 && (options.addttl || to->conf->addttl)) + addttlattr(msg, options.ttlattrtype, to->conf->addttl ? to->conf->addttl : options.addttl); + free(userascii); rq->to = to; sendrq(rq); @@ -2035,7 +2040,7 @@ int radsrv(struct request *rq) { void replyh(struct server *server, unsigned char *buf) { struct client *from; struct rqout *rqout; - int sublen; + int sublen, ttlres; unsigned char *subattrs; uint8_t *username, *stationid, *replymsg; struct radmsg *msg = NULL; @@ -2084,7 +2089,8 @@ void replyh(struct server *server, unsigned char *buf) { goto errunlock; } - if (!dottl(msg, options.ttlattrtype, options.addttl)) { + ttlres = checkttl(msg, options.ttlattrtype); + if (!ttlres) { debug(DBG_WARN, "replyh: ignoring reply from server %s, ttl exceeded", server->conf->host); goto errunlock; } @@ -2159,6 +2165,9 @@ void replyh(struct server *server, unsigned char *buf) { debug(DBG_WARN, "replyh: rewriteout failed"); goto errunlock; } + + if (ttlres == -1 && (options.addttl || from->conf->addttl)) + addttlattr(msg, options.ttlattrtype, from->conf->addttl ? from->conf->addttl : options.addttl); debug(DBG_INFO, "replyh: passing reply to client %s (%s)", from->conf->name, addr2string(from->addr)); radmsg_free(rqout->rq->msg); @@ -3266,7 +3275,7 @@ int mergesrvconf(struct clsrvconf *dst, struct clsrvconf *src) { int confclient_cb(struct gconffile **cf, void *arg, char *block, char *opt, char *val) { struct clsrvconf *conf; char *conftype = NULL, *rewriteinalias = NULL; - long int dupinterval = LONG_MIN; + long int dupinterval = LONG_MIN, addttl = LONG_MIN; debug(DBG_DBG, "confclient_cb called for %s", block); @@ -3277,18 +3286,19 @@ int confclient_cb(struct gconffile **cf, void *arg, char *block, char *opt, char conf->certnamecheck = 1; if (!getgenericconfig(cf, block, - "type", CONF_STR, &conftype, - "host", CONF_STR, &conf->host, - "secret", CONF_STR, &conf->secret, - "tls", CONF_STR, &conf->tls, - "matchcertificateattribute", CONF_STR, &conf->matchcertattr, - "CertificateNameCheck", CONF_BLN, &conf->certnamecheck, - "DuplicateInterval", CONF_LINT, &dupinterval, - "rewrite", CONF_STR, &rewriteinalias, - "rewriteIn", CONF_STR, &conf->confrewritein, - "rewriteOut", CONF_STR, &conf->confrewriteout, - "rewriteattribute", CONF_STR, &conf->confrewriteusername, - NULL + "type", CONF_STR, &conftype, + "host", CONF_STR, &conf->host, + "secret", CONF_STR, &conf->secret, + "tls", CONF_STR, &conf->tls, + "matchcertificateattribute", CONF_STR, &conf->matchcertattr, + "CertificateNameCheck", CONF_BLN, &conf->certnamecheck, + "DuplicateInterval", CONF_LINT, &dupinterval, + "addTTL", CONF_LINT, &addttl, + "rewrite", CONF_STR, &rewriteinalias, + "rewriteIn", CONF_STR, &conf->confrewritein, + "rewriteOut", CONF_STR, &conf->confrewriteout, + "rewriteattribute", CONF_STR, &conf->confrewriteusername, + NULL )) debugx(1, DBG_ERR, "configuration error"); @@ -3321,6 +3331,12 @@ int confclient_cb(struct gconffile **cf, void *arg, char *block, char *opt, char } else conf->dupinterval = conf->pdef->duplicateintervaldefault; + if (addttl != LONG_MIN) { + if (addttl < 1 || addttl > 255) + debugx(1, DBG_ERR, "error in block %s, value of option addTTL is %d, must be 1-255", block, addttl); + conf->addttl = (uint8_t)addttl; + } + if (!conf->confrewritein) conf->confrewritein = rewriteinalias; else @@ -3408,7 +3424,7 @@ int compileserverconfig(struct clsrvconf *conf, const char *block) { int confserver_cb(struct gconffile **cf, void *arg, char *block, char *opt, char *val) { struct clsrvconf *conf, *resconf; char *conftype = NULL, *rewriteinalias = NULL; - long int retryinterval = LONG_MIN, retrycount = LONG_MIN; + long int retryinterval = LONG_MIN, retrycount = LONG_MIN, addttl = LONG_MIN; debug(DBG_DBG, "confserver_cb called for %s", block); @@ -3432,6 +3448,7 @@ int confserver_cb(struct gconffile **cf, void *arg, char *block, char *opt, char "secret", CONF_STR, &conf->secret, "tls", CONF_STR, &conf->tls, "MatchCertificateAttribute", CONF_STR, &conf->matchcertattr, + "addTTL", CONF_LINT, &addttl, "rewrite", CONF_STR, &rewriteinalias, "rewriteIn", CONF_STR, &conf->confrewritein, "rewriteOut", CONF_STR, &conf->confrewriteout, @@ -3494,6 +3511,14 @@ int confserver_cb(struct gconffile **cf, void *arg, char *block, char *opt, char } else conf->retrycount = 255; + if (addttl != LONG_MIN) { + if (addttl < 1 || addttl > 255) { + debug(DBG_ERR, "error in block %s, value of option addTTL is %d, must be 1-255", block, addttl); + goto errexit; + } + conf->addttl = (uint8_t)addttl; + } + if (resconf) { if (!mergesrvconf(resconf, conf)) goto errexit; @@ -3533,11 +3558,11 @@ int confrealm_cb(struct gconffile **cf, void *arg, char *block, char *opt, char debug(DBG_DBG, "confrealm_cb called for %s", block); if (!getgenericconfig(cf, block, - "server", CONF_MSTR, &servers, - "accountingServer", CONF_MSTR, &accservers, - "ReplyMessage", CONF_STR, &msg, - "AccountingResponse", CONF_BLN, &accresp, - NULL + "server", CONF_MSTR, &servers, + "accountingServer", CONF_MSTR, &accservers, + "ReplyMessage", CONF_STR, &msg, + "AccountingResponse", CONF_BLN, &accresp, + NULL )) debugx(1, DBG_ERR, "configuration error"); @@ -3559,15 +3584,15 @@ int conftls_cb(struct gconffile **cf, void *arg, char *block, char *opt, char *v memset(conf, 0, sizeof(struct tls)); if (!getgenericconfig(cf, block, - "CACertificateFile", CONF_STR, &conf->cacertfile, - "CACertificatePath", CONF_STR, &conf->cacertpath, - "CertificateFile", CONF_STR, &conf->certfile, - "CertificateKeyFile", CONF_STR, &conf->certkeyfile, - "CertificateKeyPassword", CONF_STR, &conf->certkeypwd, - "CacheExpiry", CONF_LINT, &expiry, - "CRLCheck", CONF_BLN, &conf->crlcheck, - "PolicyOID", CONF_MSTR, &conf->policyoids, - NULL + "CACertificateFile", CONF_STR, &conf->cacertfile, + "CACertificatePath", CONF_STR, &conf->cacertpath, + "CertificateFile", CONF_STR, &conf->certfile, + "CertificateKeyFile", CONF_STR, &conf->certkeyfile, + "CertificateKeyPassword", CONF_STR, &conf->certkeypwd, + "CacheExpiry", CONF_LINT, &expiry, + "CRLCheck", CONF_BLN, &conf->crlcheck, + "PolicyOID", CONF_MSTR, &conf->policyoids, + NULL )) { debug(DBG_ERR, "conftls_cb: configuration error in block %s", val); goto errexit; @@ -3620,11 +3645,11 @@ int confrewrite_cb(struct gconffile **cf, void *arg, char *block, char *opt, cha debug(DBG_DBG, "confrewrite_cb called for %s", block); if (!getgenericconfig(cf, block, - "removeAttribute", CONF_MSTR, &rmattrs, - "removeVendorAttribute", CONF_MSTR, &rmvattrs, - "addAttribute", CONF_MSTR, &addattrs, - "modifyAttribute", CONF_MSTR, &modattrs, - NULL + "removeAttribute", CONF_MSTR, &rmattrs, + "removeVendorAttribute", CONF_MSTR, &rmvattrs, + "addAttribute", CONF_MSTR, &addattrs, + "modifyAttribute", CONF_MSTR, &modattrs, + NULL )) debugx(1, DBG_ERR, "configuration error"); addrewrite(val, rmattrs, rmvattrs, addattrs, modattrs); @@ -3715,7 +3740,7 @@ void getargs(int argc, char **argv, uint8_t *foreground, uint8_t *pretend, uint8 *pretend = 1; break; case 'v': - debugx(0, DBG_ERR, "radsecproxy revision $Rev$"); + debugx(0, DBG_ERR, "radsecproxy devel-20081106"); default: goto usage; } @@ -3802,7 +3827,7 @@ int main(int argc, char **argv) { debugx(1, DBG_ERR, "daemon() failed: %s", strerror(errno)); debug_timestamp_on(); - debug(DBG_INFO, "radsecproxy revision $Rev$ starting"); + debug(DBG_INFO, "radsecproxy devel-20081106 starting"); sigemptyset(&sigset); /* exit on all but SIGPIPE, ignore more? */ diff --git a/radsecproxy.conf.5 b/radsecproxy.conf.5 index 315ccf2..0fb7826 100644 --- a/radsecproxy.conf.5 +++ b/radsecproxy.conf.5 @@ -5,7 +5,7 @@ \\$2 \(la\\$1\(ra\\$3 .. .if \n(.g .mso www.tmac -.TH "radsecproxy.conf " 5 2008-10-16 "radsecproxy devel 2008-10-16" "" +.TH "radsecproxy.conf " 5 2008-11-06 "radsecproxy devel-20081106" "" .SH NAME radsecproxy.conf \- Radsec proxy configuration file @@ -171,6 +171,21 @@ will use for TLS connections. This can be used to specify source address and/or source port that the proxy will use for DTLS connections. .TP +\*(T +This can be used to change the default TTL attribute. Only change this if +you know what you are doing. The syntax is either a numerical value +denoting the TTL attribute, or two numerical values separated by column +specifying a vendor attribute, i.e. \*(T. +.TP +\*(T +If a TTL attribute is present, the proxy will decrement the value and +discard the message if zero. Normally the proxy does nothing if no TTL +attribute is present. If you use the addTTL option with a value 1-255, +the proxy will when forwarding a message with no TTL attribute, add one +with the specified value. Note that this option can also be specified +for a client/server. It will then override this setting when forwarding +a message to that client/server. +.TP \*(T This can be set to \*(T or \*(T with \*(T being the default. When this is enabled, a request @@ -225,9 +240,10 @@ The allowed options in a client block are \*(T, \*(T, \*(T, \*(T, \*(T, \*(T, -\*(T, \*(T, -\*(T, \*(T and -\*(T. We already discussed the +\*(T, \*(T, +\*(T, \*(T, +\*(T and \*(T. +We already discussed the \*(T option. The value of \*(T must be one of \*(T, \*(T, \*(T or \*(T. The value of \*(T is the @@ -262,6 +278,11 @@ from the same client, with the same authenticator etc. The proxy will then ignore the new request (if it is still processing the previous one), or returned a copy of the previous reply. .PP +The \*(T option is similar to the +\*(T option used in the basic config. See that for +details. Any value configured here overrides the basic one when sending +messages to this client. +.PP The \*(T option is deprecated. Use \*(T instead. .PP @@ -309,7 +330,8 @@ administrator. The allowed options in a server block are \*(T, \*(T, \*(T, \*(T, \*(T, \*(T, -\*(T, \*(T, +\*(T, \*(T, +\*(T, \*(T, \*(T, \*(T, \*(T, \*(T and \*(T. @@ -318,7 +340,8 @@ We already discussed the \*(T option. The \*(T option allows you to specify which port number the server uses. The usage of \*(T, \*(T, \*(T, \*(T, -\*(T, \*(T, +\*(T, \*(T, +\*(T, \*(T and \*(T are just as specified for the \*(T above, except that \*(T (and not \*(T) diff --git a/radsecproxy.conf.5.xml b/radsecproxy.conf.5.xml index 41f29be..a40e341 100644 --- a/radsecproxy.conf.5.xml +++ b/radsecproxy.conf.5.xml @@ -2,14 +2,14 @@ "http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd"> - 2008-10-16 + 2008-11-06 radsecproxy.conf 5 - radsecproxy devel 2008-10-16 + radsecproxy devel-20081106 @@ -256,6 +256,31 @@ will use for DTLS connections. + TTLAttribute + + +This can be used to change the default TTL attribute. Only change this if +you know what you are doing. The syntax is either a numerical value +denoting the TTL attribute, or two numerical values separated by column +specifying a vendor attribute, i.e. vendorid:attribute. + + + + + addTTL + + +If a TTL attribute is present, the proxy will decrement the value and +discard the message if zero. Normally the proxy does nothing if no TTL +attribute is present. If you use the addTTL option with a value 1-255, +the proxy will when forwarding a message with no TTL attribute, add one +with the specified value. Note that this option can also be specified +for a client/server. It will then override this setting when forwarding +a message to that client/server. + + + + loopPrevention @@ -333,9 +358,10 @@ The allowed options in a client block are host, type, secret, tls, certificateNameCheck, matchCertificateAttribute, -duplicateInterval, rewrite, -rewriteIn, rewriteOut and -rewriteAttribute. We already discussed the +duplicateInterval, addTTL, +rewrite, rewriteIn, +rewriteOut and rewriteAttribute. +We already discussed the host option. The value of type must be one of udp, tcp, tls or dtls. The value of secret is the @@ -375,6 +401,12 @@ ignore the new request (if it is still processing the previous one), or returned a copy of the previous reply. +The addTTL option is similar to the +addTTL option used in the basic config. See that for +details. Any value configured here overrides the basic one when sending +messages to this client. + + The rewrite option is deprecated. Use rewriteIn instead. @@ -433,7 +465,8 @@ administrator. The allowed options in a server block are host, port, type, secret, tls, certificateNameCheck, -matchCertificateAttribute, rewrite, +matchCertificateAttribute, addTTL, +rewrite, rewriteIn, rewriteOut, statusServer, retryCount, retryInterval and dynamicLookupCommand. @@ -443,7 +476,8 @@ We already discussed the host option. The port option allows you to specify which port number the server uses. The usage of type, secret, tls, certificateNameCheck, -matchCertificateAttribute, rewrite, +matchCertificateAttribute, addTTL, +rewrite, rewriteIn and rewriteOut are just as specified for the client block above, except that defaultServer (and not defaultClient) diff --git a/radsecproxy.h b/radsecproxy.h index c891ba5..a67d88d 100644 --- a/radsecproxy.h +++ b/radsecproxy.h @@ -92,6 +92,7 @@ struct clsrvconf { uint8_t retrycount; uint8_t dupinterval; uint8_t certnamecheck; + uint8_t addttl; struct rewrite *rewritein; struct rewrite *rewriteout; struct addrinfo *addrinfo; -- cgit v1.1