Hi all,<br><br>I'm testing the rlm_digest module in freeradius 1.0.5 to make a digest authentication.<br><br>To test, I'm using radclient and I'm passing to it the Digest attributes in order to authenticate on the localhost.
<br><br>I'm using the command bellow to authenticate the user "bob" password "zanzibar" in my radius server but it's not working.<br><br><br><span style="font-family: courier new,monospace;">echo
' User-name = "bob", Digest-Response =
"bdbeebb2da6adb6bca02599c2239e192", Digest-Realm = "<a href="http://biloxi.com">biloxi.com</a>",
Digest-Nonce = "dcd98b7102dd2f0e8b11d0f600bfb0c093", Digest-Method =
"INVITE", Digest-URI = "<a href="mailto:sip:bob@biloxi.com">sip:bob@biloxi.com</a>", Digest-Algorithm = "MD5",
Digest-User-Name = "bob", Digest-QOP = "auth-int",
Digest-Nonce-Count = "00000001", Digest-CNonce = "0a4f113b",
Digest-Body-Digest = "c1ed018b8ec4a3b170c0921f5b564e48"' |
/usr/bin/radclient localhost auth testing123 2>&1</span><br><br>The
values in I'm passing in the attributes are supposed to be correct. I
extracted them from the draft
<a href="http://ftp6.us.freebsd.org/pub/rfc/internet-drafts/draft-smith-sipping-auth-examples-01.txt">http://ftp6.us.freebsd.org/pub/rfc/internet-drafts/draft-smith-sipping-auth-examples-01.txt</a><br><br>What is going wrong is the calculation of H(A2). See the output of "radiusd -X" in response to that command above:
<br><br><span style="color: rgb(51, 51, 255);">Cleaning up request 0 ID 111 with timestamp 439dbec1</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);">Nothing to do. Sleeping until we see a request.
</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);">rad_recv: Access-Request packet from host <a href="http://127.0.0.1:32937">127.0.0.1:32937</a>, id=117, length=229</span><br style="color: rgb(51, 51, 255);">
<span style="color: rgb(51, 51, 255);"> User-Name = "bob"</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> Digest-Response = "bdbeebb2da6adb6bca02599c2239e192"
</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> Digest-Attributes = 0x010c62696c6f78692e636f6d</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> Digest-Attributes
=
0x022464636439386237313032646432663065386231316430663630306266623063303933</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> Digest-Attributes = 0x0308494e56495445</span><br style="color: rgb(51, 51, 255);">
<span style="color: rgb(51, 51, 255);"> Digest-Attributes = 0x04147369703a626f624062696c6f78692e636f6d</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> Digest-Attributes = 0x06054d4435
</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> Digest-Attributes = 0x0a05626f62</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> Digest-Attributes = 0x050a617574682d696e74
</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> Digest-Attributes = 0x090a3030303030303031</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> Digest-Attributes = 0x080a3061346631313362
</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> Digest-Attributes
= 0x07226331656430313862386563346133623137306330393231663562353634653438</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> Processing the authorize section of radiusd.conf</span><br style="color: rgb(51, 51, 255);">
<span style="color: rgb(51, 51, 255);">modcall: entering group authorize for request 1</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> modcall[authorize]: module "preprocess" returns ok for request 1
</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> modcall[authorize]: module "chap" returns noop for request 1</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);">
modcall[authorize]: module "mschap" returns noop for request 1</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> rlm_digest: Converting Digest-Attributes to something sane...
</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> Digest-Realm = "<a href="http://biloxi.com">biloxi.com</a>"</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);">
Digest-Nonce = "dcd98b7102dd2f0e8b11d0f600bfb0c093"</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> Digest-Method = "INVITE"</span><br style="color: rgb(51, 51, 255);">
<span style="color: rgb(51, 51, 255);"> Digest-URI = "<a href="mailto:sip:bob@biloxi.com">sip:bob@biloxi.com</a>"</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> Digest-Algorithm = "MD5"
</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> Digest-User-Name = "bob"</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> Digest-QOP = "auth-int"
</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> Digest-Nonce-Count = "00000001"</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> Digest-CNonce = "0a4f113b"
</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> Digest-Body-Digest = "c1ed018b8ec4a3b170c0921f5b564e48"</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);">
rlm_digest: Adding Auth-Type = DIGEST</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> modcall[authorize]: module "digest" returns ok for request 1</span><br style="color: rgb(51, 51, 255);">
<span style="color: rgb(51, 51, 255);"> rlm_realm: No '@' in User-Name = "bob", looking up realm NULL</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> rlm_realm: No such realm "NULL"
</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> modcall[authorize]: module "suffix" returns noop for request 1</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);">
rlm_eap: No EAP-Message, not doing EAP</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> modcall[authorize]: module "eap" returns noop for request 1</span><br style="color: rgb(51, 51, 255);">
<span style="color: rgb(51, 51, 255);"> users: Matched entry bob at line 5</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> modcall[authorize]: module "files" returns ok for request 1
</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);">modcall: group authorize returns ok for request 1</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> rad_check_password: Found Auth-Type Digest
</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);">auth: type "digest"</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> Processing the authenticate section of
radiusd.conf</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);">modcall: entering group authenticate for request 1</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);">
A1 = bob:biloxi.com:zanzibar</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);">A2 = INVITE:sip:bob@biloxi.com:Áí???Ä£±pÀ??[VNH</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);">
H(A1) = 12af60467a33e8518da5c68bbff12b11</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);">H(A2) = 7a3ae801f64033d060b8209ec071569c </span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);">
KD
=
12af60467a33e8518da5c68bbff12b11:dcd98b7102dd2f0e8b11d0f600bfb0c093:00000001:0a4f113b:auth-int:7a3ae801f64033d060b8209ec071569c</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);">EXPECTED 6b2a26c4371e4bbac1d5e71763443f5f
</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);">RECEIVED bdbeebb2da6adb6bca02599c2239e192</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);">rlm_digest: FAILED authentication
</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);"> modcall[authenticate]: module "digest" returns reject for request 1</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);">
modcall: group authenticate returns reject for request 1</span><br style="color: rgb(51, 51, 255);"><span style="color: rgb(51, 51, 255);">auth: Failed to validate the user.</span><br><br><br>PS: The value of H(A2) should be 3e8ec46a56447dbb073e1171b1be0683. You verify it by running te command:
<br><br style="font-family: courier new,monospace;"><span style="font-family: courier new,monospace;">echo -n "INVITE:sip:bob@biloxi.com:c1ed018b8ec4a3b170c0921f5b564e48" | md5sum</span><br><br>That draft also confirms that H(A2) should be "
<span style="font-family: courier new,monospace;">3e8ec46a56447dbb073e1171b1be0683</span>".<br><br>So, why is rlm_digest calculating it as "<span style="font-family: courier new,monospace;">7a3ae801f64033d060b8209ec071569c
</span>"?<br><br>Is it really a bug or am I making a some silly mistake?<br><br>Any help will be greatly appreciated.<br><br>bnegrao<br><br><br><br><br>