1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
|
/*
* $Id: authorize.c,v 1.4 2006/03/01 18:07:37 bogdan_iancu Exp $
*
* Digest Authentication - Radius support
*
* Copyright (C) 2001-2003 FhG Fokus
*
* This file is part of openser, a free SIP server.
*
* openser is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version
*
* openser is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*
* History:
* -------
* 2003-03-09: Based on authorize.c from radius_auth (janakj)
* 2006-03-01: pseudo variables support for domain name (bogdan)
*/
#include <string.h>
#include <stdlib.h>
#include "../../mem/mem.h"
#include "../../str.h"
#include "../../parser/hf.h"
#include "../../parser/digest/digest.h"
#include "../../parser/parse_uri.h"
#include "../../parser/parse_from.h"
#include "../../parser/parse_to.h"
#include "../../dprint.h"
#include "../../ut.h"
#include "../../items.h"
#include "../auth/api.h"
#include "authorize.h"
#include "sterman.h"
#include "authrad_mod.h"
/*
* Extract URI depending on the request from To or From header
*/
static inline int get_uri(struct sip_msg* _m, str** _uri)
{
if ((REQ_LINE(_m).method.len == 8) && (memcmp(REQ_LINE(_m).method.s, "REGISTER", 8) == 0)) {
if (!_m->to && ((parse_headers(_m, HDR_TO_F, 0) == -1) || !_m->to)) {
LOG(L_ERR, "get_uri(): To header field not found or malformed\n");
return -1;
}
*_uri = &(get_to(_m)->uri);
} else {
if (parse_from_header(_m)<0) {
LOG(L_ERR, "get_uri(): Error while parsing headers\n");
return -2;
}
*_uri = &(get_from(_m)->uri);
}
return 0;
}
/*
* Authorize digest credentials
*/
static inline int authorize(struct sip_msg* _msg, xl_elem_t* _realm,
int _hftype)
{
int res;
auth_result_t ret;
struct hdr_field* h;
auth_body_t* cred;
str* uri;
struct sip_uri puri;
str user, domain;
if (_realm) {
if (xl_printf_s(_msg, _realm, &domain)!=0) {
LOG(L_ERR,"ERROR:auth_radius:authorize: xl_printf_s failed\n");
return -1;
}
} else {
domain.len = 0;
domain.s = 0;
}
ret = auth_api.pre_auth(_msg, &domain, _hftype, &h);
switch(ret) {
case ERROR: return 0;
case NOT_AUTHORIZED: return -1;
case DO_AUTHORIZATION: break;
case AUTHORIZED: return 1;
}
cred = (auth_body_t*)h->parsed;
if (get_uri(_msg, &uri) < 0) {
LOG(L_ERR, "authorize(): From/To URI not found\n");
return -1;
}
if (parse_uri(uri->s, uri->len, &puri) < 0) {
LOG(L_ERR, "authorize(): Error while parsing From/To URI\n");
return -1;
}
user.s = (char *)pkg_malloc(puri.user.len);
if (user.s == NULL) {
LOG(L_ERR, "authorize: No memory left\n");
return -1;
}
un_escape(&(puri.user), &user);
res = radius_authorize_sterman(_msg, &cred->digest,
&_msg->first_line.u.request.method, &user);
pkg_free(user.s);
if (res == 1) {
ret = auth_api.post_auth(_msg, h);
switch(ret) {
case ERROR: return 0;
case NOT_AUTHORIZED: return -1;
case AUTHORIZED: return 1;
default: return -1;
}
}
return -1;
}
/*
* Authorize using Proxy-Authorize header field
*/
int radius_proxy_authorize(struct sip_msg* _msg, char* _realm, char* _s2)
{
/* realm parameter is converted to str* in str_fixup */
return authorize(_msg, (xl_elem_t*)_realm, HDR_PROXYAUTH_T);
}
/*
* Authorize using WWW-Authorize header field
*/
int radius_www_authorize(struct sip_msg* _msg, char* _realm, char* _s2)
{
return authorize(_msg, (xl_elem_t*)_realm, HDR_AUTHORIZATION_T);
}
|
