rlm_digest: cannot do "auth-int" digest authentication to work
Hi all, I'm testing the rlm_digest module in freeradius 1.0.5 to make a digest authentication. To test, I'm using radclient and I'm passing to it the Digest attributes in order to authenticate on the localhost. I'm using the command bellow to authenticate the user "bob" password "zanzibar" in my radius server but it's not working. echo ' User-name = "bob", Digest-Response = "bdbeebb2da6adb6bca02599c2239e192", Digest-Realm = "biloxi.com", Digest-Nonce = "dcd98b7102dd2f0e8b11d0f600bfb0c093", Digest-Method = "INVITE", Digest-URI = "sip:bob@biloxi.com", Digest-Algorithm = "MD5", Digest-User-Name = "bob", Digest-QOP = "auth-int", Digest-Nonce-Count = "00000001", Digest-CNonce = "0a4f113b", Digest-Body-Digest = "c1ed018b8ec4a3b170c0921f5b564e48"' | /usr/bin/radclient localhost auth testing123 2>&1 The values in I'm passing in the attributes are supposed to be correct. I extracted them from the draft http://ftp6.us.freebsd.org/pub/rfc/internet-drafts/draft-smith-sipping-auth-... What is going wrong is the calculation of H(A2). See the output of "radiusd -X" in response to that command above: Cleaning up request 0 ID 111 with timestamp 439dbec1 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:32937, id=117, length=229 User-Name = "bob" Digest-Response = "bdbeebb2da6adb6bca02599c2239e192" Digest-Attributes = 0x010c62696c6f78692e636f6d Digest-Attributes = 0x022464636439386237313032646432663065386231316430663630306266623063303933 Digest-Attributes = 0x0308494e56495445 Digest-Attributes = 0x04147369703a626f624062696c6f78692e636f6d Digest-Attributes = 0x06054d4435 Digest-Attributes = 0x0a05626f62 Digest-Attributes = 0x050a617574682d696e74 Digest-Attributes = 0x090a3030303030303031 Digest-Attributes = 0x080a3061346631313362 Digest-Attributes = 0x07226331656430313862386563346133623137306330393231663562353634653438 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_digest: Converting Digest-Attributes to something sane... Digest-Realm = "biloxi.com" Digest-Nonce = "dcd98b7102dd2f0e8b11d0f600bfb0c093" Digest-Method = "INVITE" Digest-URI = "sip:bob@biloxi.com" Digest-Algorithm = "MD5" Digest-User-Name = "bob" Digest-QOP = "auth-int" Digest-Nonce-Count = "00000001" Digest-CNonce = "0a4f113b" Digest-Body-Digest = "c1ed018b8ec4a3b170c0921f5b564e48" rlm_digest: Adding Auth-Type = DIGEST modcall[authorize]: module "digest" returns ok for request 1 rlm_realm: No '@' in User-Name = "bob", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry bob at line 5 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns ok for request 1 rad_check_password: Found Auth-Type Digest auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 A1 = bob:biloxi.com:zanzibar A2 = INVITE:sip:bob@biloxi.com:Áí???Ä£±pÀ??[VNH H(A1) = 12af60467a33e8518da5c68bbff12b11 H(A2) = 7a3ae801f64033d060b8209ec071569c KD = 12af60467a33e8518da5c68bbff12b11:dcd98b7102dd2f0e8b11d0f600bfb0c093:00000001:0a4f113b:auth-int:7a3ae801f64033d060b8209ec071569c EXPECTED 6b2a26c4371e4bbac1d5e71763443f5f RECEIVED bdbeebb2da6adb6bca02599c2239e192 rlm_digest: FAILED authentication modcall[authenticate]: module "digest" returns reject for request 1 modcall: group authenticate returns reject for request 1 auth: Failed to validate the user. PS: The value of H(A2) should be 3e8ec46a56447dbb073e1171b1be0683. You verify it by running te command: echo -n "INVITE:sip:bob@biloxi.com:c1ed018b8ec4a3b170c0921f5b564e48" | md5sum That draft also confirms that H(A2) should be " 3e8ec46a56447dbb073e1171b1be0683". So, why is rlm_digest calculating it as "7a3ae801f64033d060b8209ec071569c"? Is it really a bug or am I making a some silly mistake? Any help will be greatly appreciated. bnegrao
Bruno Negrao <bnegraolists@gmail.com> wrote:
What is going wrong is the calculation of H(A2). See the output of "radiusd -X" in response to that command above: ... A2 =3D INVITE:sip:bob@biloxi.com:=C1=ED???=C4=A3=B1p=C0??[VNH
That looks bad.
So, why is rlm_digest calculating it as "7a3ae801f64033d060b8209ec071569c"?
Is it really a bug or am I making a some silly mistake?
It's a bug. See revision 1.15 -> 1.16 of rlm_digest.c for a patch. You'll have to add it by hand to your build, though. The fix should be in all versions after 1.0.5. Alan DeKok.
Hi Alan, Thank you very much in answering. Since you confirmed it is a bug I'd like to let you know that my tests using MD5-sess algorithm also had failed. This time the error is when calculating the H(A1). Again, using the user 'bob' password 'zanzibar', when i run the following command: echo ' User-name = "bob", Digest-Response = "e4e4ea61d186d07a92c9e1f6919902e9", Digest-Realm = "biloxi.com", Digest-Nonce = "dcd98b7102dd2f0e8b11d0f600bfb0c093", Digest-Method = "INVITE", Digest-URI = "sip:bob@biloxi.com", Digest-Algorithm = "MD5-sess", Digest-User-Name = "bob", Digest-QOP = "auth", Digest-Nonce-Count = "00000001", Digest-CNonce = "0a4f113b"' | /usr/bin/radclient localhost auth testing123 2>&1 the output of radiusd -X is: rad_recv: Access-Request packet from host 127.0.0.1:32937, id=87, length=194 User-Name = "bob" Digest-Response = "e4e4ea61d186d07a92c9e1f6919902e9" Digest-Attributes = 0x010c62696c6f78692e636f6d Digest-Attributes = 0x022464636439386237313032646432663065386231316430663630306266623063303933 Digest-Attributes = 0x0308494e56495445 Digest-Attributes = 0x04147369703a626f624062696c6f78692e636f6d Digest-Attributes = 0x060a4d44352d73657373 Digest-Attributes = 0x0a05626f62 Digest-Attributes = 0x050661757468 Digest-Attributes = 0x090a3030303030303031 Digest-Attributes = 0x080a3061346631313362 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 15 modcall[authorize]: module "preprocess" returns ok for request 15 modcall[authorize]: module "chap" returns noop for request 15 modcall[authorize]: module "mschap" returns noop for request 15 rlm_digest: Converting Digest-Attributes to something sane... Digest-Realm = "biloxi.com" Digest-Nonce = "dcd98b7102dd2f0e8b11d0f600bfb0c093" Digest-Method = "INVITE" Digest-URI = "sip:bob@biloxi.com" Digest-Algorithm = "MD5-sess" Digest-User-Name = "bob" Digest-QOP = "auth" Digest-Nonce-Count = "00000001" Digest-CNonce = "0a4f113b" rlm_digest: Adding Auth-Type = DIGEST modcall[authorize]: module "digest" returns ok for request 15 rlm_realm: No '@' in User-Name = "bob", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 15 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 15 users: Matched entry bob at line 5 modcall[authorize]: module "files" returns ok for request 15 modcall: group authorize returns ok for request 15 rad_check_password: Found Auth-Type Digest auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 15 A1 = bob:biloxi.com:zanzibar A2 = INVITE:sip:bob@biloxi.com H(A1) = 3fe46a5fca36d79d9b5567e49a5b9fa1 H(A2) = 13a14a3eb5e2c24732a1a04fff543e92 KD = 3fe46a5fca36d79d9b5567e49a5b9fa1:dcd98b7102dd2f0e8b11d0f600bfb0c093:00000001:0a4f113b:auth:13a14a3eb5e2c24732a1a04fff543e92 EXPECTED 9c9e30a46fcc7a25a16cc7c4a1330ef8 RECEIVED e4e4ea61d186d07a92c9e1f6919902e9 rlm_digest: FAILED authentication The correct H(A1) for this case should be: "4f36886771c77832be5c5a8de5a7ec82" instead of "3fe46a5fca36d79d9b5567e49a5b9fa1". If you didn't fix this bug yet, use the examples from the draft http://ftp6.us.freebsd.org/pub/rfc/internet-drafts/draft-smith-sipping-auth-... They certainly will help you. Thank you, bnegrao
participants (2)
-
Alan DeKok -
Bruno Negrao