denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

require Message-Authenticator attribute only if we have a EAP-Message

Browse Source
This commit is contained in:
Martin Willi
2009-03-27 13:25:34 +00:00
parent 510be1a32a
commit 9d1bd18243
1 changed files with 18 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/plugins/eap_radius/radius_message.c
+18 -6
View File
@@ -308,6 +308,7 @@ static bool verify(private_radius_message_t *this, u_int8_t *req_auth,
enumerator_t *enumerator; enumerator_t *enumerator;
int type; int type;
chunk_t data, msg; chunk_t data, msg;
bool has_eap = FALSE, has_auth = FALSE;
/* replace Response by Request Authenticator for verification */ /* replace Response by Request Authenticator for verification */
memcpy(res_auth, this->msg->authenticator, HASH_SIZE_MD5); memcpy(res_auth, this->msg->authenticator, HASH_SIZE_MD5);
@@ -339,11 +340,11 @@ static bool verify(private_radius_message_t *this, u_int8_t *req_auth,
memset(data.ptr, 0, data.len); memset(data.ptr, 0, data.len);
if (signer->verify_signature(signer, msg, if (signer->verify_signature(signer, msg,
chunk_create(buf, sizeof(buf)))) chunk_create(buf, sizeof(buf))))
{ /* good, restore Authenticators */ {
memcpy(this->msg->authenticator, res_auth, HASH_SIZE_MD5); /* restore Message-Authenticator */
memcpy(data.ptr, buf, data.len); memcpy(data.ptr, buf, data.len);
enumerator->destroy(enumerator); has_auth = TRUE;
return TRUE; break;
} }
else else
{ {
@@ -352,10 +353,21 @@ static bool verify(private_radius_message_t *this, u_int8_t *req_auth,
return FALSE; return FALSE;
} }
} }
else if (type == RAT_EAP_MESSAGE)
{
has_eap = TRUE;
}
} }
enumerator->destroy(enumerator); enumerator->destroy(enumerator);
DBG1(DBG_CFG, "RADIUS Message-Authenticator attribute missing"); /* restore Response-Authenticator */
return FALSE; memcpy(this->msg->authenticator, res_auth, HASH_SIZE_MD5);
if (has_eap && !has_auth)
{ /* Message-Authenticator is required if we have an EAP-Message */
DBG1(DBG_CFG, "RADIUS Message-Authenticator attribute missing");
return FALSE;
}
return TRUE;
} }
/** /**