habsi/authentik
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

separate eap logic into protocol

Browse Source 
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
This commit is contained in:
Jens Langhammer
2025-05-21 00:53:18 +02:00
parent 19bb77638a
commit 1575b96262
10 changed files with 185 additions and 89 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
internal/outpost/radius/eap/context.go
View File

@ -9,6 +9,7 @@ import (
type context struct {
req *radius.Request
state interface{}
typeState map[protocol.Type]any
log *log.Entry
settings interface{}
endStatus protocol.Status
@ -23,6 +24,10 @@ func (ctx context) ProtocolSettings() interface{} {
return ctx.settings
}
func (ctx *context) StateForProtocol(p protocol.Type) interface{} {
return ctx.typeState[p]
}
func (ctx *context) GetProtocolState() interface{} {
return ctx.state
}

65
internal/outpost/radius/eap/handler.go
View File

@ -9,6 +9,7 @@ import (
"github.com/gorilla/securecookie"
log "github.com/sirupsen/logrus"
"goauthentik.io/internal/outpost/radius/eap/protocol"
"goauthentik.io/internal/outpost/radius/eap/protocol/eap"
"goauthentik.io/internal/outpost/radius/eap/protocol/legacy_nak"
"layeh.com/radius"
"layeh.com/radius/rfc2865"
@ -30,16 +31,20 @@ func (p *Packet) HandleRadiusPacket(w radius.ResponseWriter, r *radius.Request)
}
p.state = rst
rp, err := p.handleInner(r)
rep, err := p.handleInner(r)
rp := &Packet{
eap: rep,
}
rres := r.Response(radius.CodeAccessReject)
if err == nil {
rres = p.endModifier(rres)
switch rp.code {
case CodeRequest:
switch rp.eap.Code {
case protocol.CodeRequest:
rres.Code = radius.CodeAccessChallenge
case CodeFailure:
case protocol.CodeFailure:
rres.Code = radius.CodeAccessReject
case CodeSuccess:
case protocol.CodeSuccess:
rres.Code = radius.CodeAccessAccept
}
} else {
@ -54,7 +59,7 @@ func (p *Packet) HandleRadiusPacket(w radius.ResponseWriter, r *radius.Request)
sendErrorResponse(w, r)
return
}
log.WithField("length", len(eapEncoded)).WithField("type", fmt.Sprintf("%T", rp.Payload)).Debug("EAP: encapsulated challenge")
log.WithField("length", len(eapEncoded)).WithField("type", fmt.Sprintf("%T", rp.eap.Payload)).Debug("EAP: encapsulated challenge")
rfc2869.EAPMessage_Set(rres, eapEncoded)
err = p.setMessageAuthenticator(rres)
if err != nil {
@ -68,30 +73,39 @@ func (p *Packet) HandleRadiusPacket(w radius.ResponseWriter, r *radius.Request)
}
}
func (p *Packet) handleInner(r *radius.Request) (*Packet, error) {
func (p *Packet) handleInner(r *radius.Request) (*eap.Payload, error) {
st := p.stm.GetEAPState(p.state)
if st == nil {
log.Debug("EAP: blank state")
st = BlankState(p.stm.GetEAPSettings())
}
// FIXME: Statically call Handle of root EAP packet to make its data accessible
ectx := &context{
state: st.TypeState[eap.TypeEAP],
log: log.WithField("type", fmt.Sprintf("%T", &eap.Payload{})),
}
p.eap.Handle(ectx)
st.TypeState[eap.TypeEAP] = ectx.GetProtocolState()
p.stm.SetEAPState(p.state, st)
nextChallengeToOffer, err := st.GetNextProtocol()
if err != nil {
return &Packet{
code: CodeFailure,
id: p.id,
return &eap.Payload{
Code: protocol.CodeFailure,
ID: p.eap.ID,
}, err
}
next := func() (*Packet, error) {
next := func() (*eap.Payload, error) {
st.ProtocolIndex += 1
p.stm.SetEAPState(p.state, st)
return p.handleInner(r)
}
if _, ok := p.Payload.(*legacy_nak.Payload); ok {
if _, ok := p.eap.Payload.(*legacy_nak.Payload); ok {
log.Debug("EAP: received NAK, trying next protocol")
p.Payload = nil
p.eap.Payload = nil
return next()
}
@ -100,6 +114,7 @@ func (p *Packet) handleInner(r *radius.Request) (*Packet, error) {
ctx := &context{
req: r,
state: st.TypeState[np.Type()],
typeState: st.TypeState,
log: log.WithField("type", fmt.Sprintf("%T", np)),
settings: p.stm.GetEAPSettings().ProtocolSettings[np.Type()],
}
@ -119,11 +134,11 @@ func (p *Packet) handleInner(r *radius.Request) (*Packet, error) {
switch ctx.endStatus {
case protocol.StatusSuccess:
res.code = CodeSuccess
res.id -= 1
res.Code = protocol.CodeSuccess
res.ID -= 1
case protocol.StatusError:
res.code = CodeFailure
res.id -= 1
res.Code = protocol.CodeFailure
res.ID -= 1
case protocol.StatusNextProtocol:
ctx.log.Debug("EAP: Protocol ended, starting next protocol")
return next()
@ -132,18 +147,18 @@ func (p *Packet) handleInner(r *radius.Request) (*Packet, error) {
return res, nil
}
func (p *Packet) GetChallengeForType(ctx *context, np protocol.Payload) *Packet {
res := &Packet{
code: CodeRequest,
id: p.id + 1,
msgType: np.Type(),
func (p *Packet) GetChallengeForType(ctx *context, np protocol.Payload) *eap.Payload {
res := &eap.Payload{
Code: protocol.CodeRequest,
ID: p.eap.ID + 1,
MsgType: np.Type(),
}
var payload any
if ctx.IsProtocolStart() {
p.Payload = np
p.Payload.Decode(p.rawPayload)
p.eap.Payload = np
p.eap.Payload.Decode(p.eap.RawPayload)
}
payload = p.Payload.Handle(ctx)
payload = p.eap.Payload.Handle(ctx)
if payload != nil {
res.Payload = payload.(protocol.Payload)
}

65
internal/outpost/radius/eap/packet.go
View File

@ -1,40 +1,20 @@
package eap
import (
"encoding/binary"
"errors"
"fmt"
log "github.com/sirupsen/logrus"
"goauthentik.io/internal/outpost/radius/eap/debug"
"goauthentik.io/internal/outpost/radius/eap/protocol"
"goauthentik.io/internal/outpost/radius/eap/protocol/eap"
"layeh.com/radius"
)
type Code uint8
const (
CodeRequest Code = 1
CodeResponse Code = 2
CodeSuccess Code = 3
CodeFailure Code = 4
)
type Packet struct {
code Code
id uint8
length uint16
msgType protocol.Type
rawPayload []byte
Payload protocol.Payload
eap *eap.Payload
stm StateManager
state string
endModifier func(p *radius.Packet) *radius.Packet
}
type PayloadWriter struct{}
func emptyPayload(stm StateManager, t protocol.Type) (protocol.Payload, error) {
for _, cons := range stm.GetEAPSettings().Protocols {
if np := cons(); np.Type() == t {
@ -46,28 +26,24 @@ func emptyPayload(stm StateManager, t protocol.Type) (protocol.Payload, error) {
func Decode(stm StateManager, raw []byte) (*Packet, error) {
packet := &Packet{
eap: &eap.Payload{},
stm: stm,
endModifier: func(p *radius.Packet) *radius.Packet {
return p
},
}
packet.code = Code(raw[0])
packet.id = raw[1]
packet.length = binary.BigEndian.Uint16(raw[2:])
if packet.length != uint16(len(raw)) {
return nil, errors.New("mismatched packet length")
}
if len(raw) > 4 && (packet.code == CodeRequest || packet.code == CodeResponse) {
packet.msgType = protocol.Type(raw[4])
}
p, err := emptyPayload(stm, packet.msgType)
// FIXME: We're decoding twice here, first to get the msg type, then come back to assign the payload type
// then re-parse to parse the payload correctly
err := packet.eap.Decode(raw)
if err != nil {
return nil, err
}
packet.Payload = p
packet.rawPayload = raw[5:]
log.WithField("raw", debug.FormatBytes(raw)).WithField("payload", fmt.Sprintf("%T", packet.Payload)).Debug("EAP: decode raw")
err = packet.Payload.Decode(raw[5:])
p, err := emptyPayload(stm, packet.eap.MsgType)
if err != nil {
return nil, err
}
packet.eap.Payload = p
err = packet.eap.Decode(raw)
if err != nil {
return nil, err
}
@ -75,20 +51,5 @@ func Decode(stm StateManager, raw []byte) (*Packet, error) {
}
func (p *Packet) Encode() ([]byte, error) {
buff := make([]byte, 4)
buff[0] = uint8(p.code)
buff[1] = uint8(p.id)
if p.Payload != nil {
payloadBuffer, err := p.Payload.Encode()
if err != nil {
return buff, err
}
if p.code == CodeRequest || p.code == CodeResponse {
buff = append(buff, uint8(p.msgType))
}
buff = append(buff, payloadBuffer...)
}
binary.BigEndian.PutUint16(buff[2:], uint16(len(buff)))
return buff, nil
return p.eap.Encode()
}

2
internal/outpost/radius/eap/protocol/context.go
View File

@ -18,6 +18,8 @@ type Context interface {
Packet() *radius.Request
ProtocolSettings() interface{}
StateForProtocol(p Type) interface{}
GetProtocolState() interface{}
SetProtocolState(interface{})

83
internal/outpost/radius/eap/protocol/eap/payload.go Normal file
View File

@ -0,0 +1,83 @@
package eap
import (
"encoding/binary"
"errors"
"fmt"
log "github.com/sirupsen/logrus"
"goauthentik.io/internal/outpost/radius/eap/debug"
"goauthentik.io/internal/outpost/radius/eap/protocol"
)
const TypeEAP protocol.Type = 0
func Protocol() protocol.Payload {
return &Payload{}
}
type Payload struct {
Code protocol.Code
ID uint8
Length uint16
MsgType protocol.Type
Payload protocol.Payload
RawPayload []byte
}
func (ip *Payload) Type() protocol.Type {
return TypeEAP
}
func (ip *Payload) Offerable() bool {
return false
}
func (packet *Payload) Decode(raw []byte) error {
packet.Code = protocol.Code(raw[0])
packet.ID = raw[1]
packet.Length = binary.BigEndian.Uint16(raw[2:])
if packet.Length != uint16(len(raw)) {
return errors.New("mismatched packet length")
}
if len(raw) > 4 && (packet.Code == protocol.CodeRequest || packet.Code == protocol.CodeResponse) {
packet.MsgType = protocol.Type(raw[4])
}
packet.RawPayload = raw[5:]
if packet.Payload == nil {
return nil
}
log.WithField("raw", debug.FormatBytes(raw)).WithField("payload", fmt.Sprintf("%T", packet.Payload)).Debug("EAP: decode raw")
err := packet.Payload.Decode(raw[5:])
if err != nil {
return err
}
return nil
}
func (p *Payload) Encode() ([]byte, error) {
buff := make([]byte, 4)
buff[0] = uint8(p.Code)
buff[1] = uint8(p.ID)
if p.Payload != nil {
payloadBuffer, err := p.Payload.Encode()
if err != nil {
return buff, err
}
if p.Code == protocol.CodeRequest || p.Code == protocol.CodeResponse {
buff = append(buff, uint8(p.MsgType))
}
buff = append(buff, payloadBuffer...)
}
binary.BigEndian.PutUint16(buff[2:], uint16(len(buff)))
return buff, nil
}
func (ip *Payload) Handle(ctx protocol.Context) protocol.Payload {
ctx.Log().Debug("EAP: Handle")
ctx.SetProtocolState(&State{
PacketID: ip.ID,
})
return nil
}

5
internal/outpost/radius/eap/protocol/eap/state.go Normal file
View File

@ -0,0 +1,5 @@
package eap
type State struct {
PacketID uint8
}

9
internal/outpost/radius/eap/protocol/packet.go
View File

@ -9,3 +9,12 @@ type Payload interface {
}
type Type uint8
type Code uint8
const (
CodeRequest Code = 1
CodeResponse Code = 2
CodeSuccess Code = 3
CodeFailure Code = 4
)

18
internal/outpost/radius/eap/protocol/peap/payload.go
View File

@ -4,6 +4,8 @@ import (
log "github.com/sirupsen/logrus"
"goauthentik.io/internal/outpost/radius/eap/debug"
"goauthentik.io/internal/outpost/radius/eap/protocol"
"goauthentik.io/internal/outpost/radius/eap/protocol/eap"
"goauthentik.io/internal/outpost/radius/eap/protocol/identity"
"goauthentik.io/internal/outpost/radius/eap/protocol/tls"
)
@ -11,11 +13,14 @@ const TypePEAP protocol.Type = 25
func Protocol() protocol.Payload {
return &tls.Payload{
Inner: &Payload{},
Inner: &Payload{
Inner: &eap.Payload{},
},
}
}
type Payload struct {
Inner protocol.Payload
}
func (p *Payload) Type() protocol.Type {
@ -33,7 +38,16 @@ func (p *Payload) Encode() ([]byte, error) {
}
func (p *Payload) Handle(ctx protocol.Context) protocol.Payload {
log.Debug("PEAP: Handle")
eapState := ctx.StateForProtocol(eap.TypeEAP).(*eap.State)
if !ctx.IsProtocolStart() {
ctx.Log().Debug("PEAP: Protocol start")
return &eap.Payload{
Code: protocol.CodeRequest,
ID: eapState.PacketID,
MsgType: identity.TypeIdentity,
Payload: &identity.Payload{},
}
}
return &Payload{}
}

11
internal/outpost/radius/eap/protocol/tls/inner.go
View File

@ -4,18 +4,19 @@ import (
"goauthentik.io/internal/outpost/radius/eap/protocol"
)
func (p *Payload) innerHandler(ctx protocol.Context) *Payload {
func (p *Payload) innerHandler(ctx protocol.Context) {
// p.st.TLS.read
// d, _ := io.ReadAll(p.st.TLS)
err := p.Inner.Decode([]byte{})
if err != nil {
ctx.Log().WithError(err).Warning("TLS: failed to decode inner protocol")
ctx.EndInnerProtocol(protocol.StatusError, nil)
return nil
return
}
pl := p.Inner.Handle(ctx)
enc, err := pl.Encode()
return &Payload{
Data: enc,
}
p.st.TLS.Write(enc)
// return &Payload{
// Data: enc,
// }
}

3
internal/outpost/radius/eap/protocol/tls/payload.go
View File

@ -124,7 +124,8 @@ func (p *Payload) Handle(ctx protocol.Context) protocol.Payload {
defer p.st.ContextCancel()
if p.Inner != nil {
ctx.Log().Debug("TLS: Handshake is done, delegating to inner protocol")
return p.innerHandler(ctx)
p.innerHandler(ctx)
return p.startChunkedTransfer(p.st.Conn.OutboundData())
}
// If we don't have a final status from the handshake finished function, stall for time
pst, _ := retry.DoWithData(