Support RADIUS passwords up to 128 characters

Previous limit was 16 characters, due to lack of support for multiple passes
of encryption.

Marko Tiikkaja

diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c
index 4699efacd05189d8ea3572d2d48145de686915ca..aca4ffe4c7e9e832fc5cd396380b764d6014ca80 100644 (file)
--- a/src/backend/libpq/auth.c
+++ b/src/backend/libpq/auth.c
@@ -2168,6 +2168,7 @@ CheckCertAuth(Port *port)
 
 #define RADIUS_VECTOR_LENGTH 16
 #define RADIUS_HEADER_LENGTH 20
+#define RADIUS_MAX_PASSWORD_LENGTH 128
 
 typedef struct
 {
@@ -2241,7 +2242,9 @@ CheckRADIUSAuth(Port *port)
    radius_packet *receivepacket = (radius_packet *) receive_buffer;
    int32       service = htonl(RADIUS_AUTHENTICATE_ONLY);
    uint8      *cryptvector;
-   uint8       encryptedpassword[RADIUS_VECTOR_LENGTH];
+   int         encryptedpasswordlen;
+   uint8       encryptedpassword[RADIUS_MAX_PASSWORD_LENGTH];
+   uint8      *md5trailer;
    int         packetlength;
    pgsocket    sock;
 
@@ -2259,6 +2262,7 @@ CheckRADIUSAuth(Port *port)
    fd_set      fdset;
    struct timeval endtime;
    int         i,
+               j,
                r;
 
    /* Make sure struct alignment is correct */
@@ -2316,13 +2320,14 @@ CheckRADIUSAuth(Port *port)
        return STATUS_ERROR;
    }
 
-   if (strlen(passwd) > RADIUS_VECTOR_LENGTH)
+   if (strlen(passwd) > RADIUS_MAX_PASSWORD_LENGTH)
    {
        ereport(LOG,
-               (errmsg("RADIUS authentication does not support passwords longer than 16 characters")));
+               (errmsg("RADIUS authentication does not support passwords longer than %d characters", RADIUS_MAX_PASSWORD_LENGTH)));
        return STATUS_ERROR;
    }
 
+
    /* Construct RADIUS packet */
    packet->code = RADIUS_ACCESS_REQUEST;
    packet->length = RADIUS_HEADER_LENGTH;
@@ -2344,28 +2349,43 @@ CheckRADIUSAuth(Port *port)
    radius_add_attribute(packet, RADIUS_NAS_IDENTIFIER, (unsigned char *) identifier, strlen(identifier));
 
    /*
-    * RADIUS password attributes are calculated as: e[0] = p[0] XOR
-    * MD5(secret + vector)
+    * RADIUS password attributes are calculated as:
+    *   e[0] = p[0] XOR MD5(secret + Request Authenticator)
+    * for the first group of 16 octets, and then:
+    *   e[i] = p[i] XOR MD5(secret + e[i-1])
+    * for the following ones (if necessary)
     */
-   cryptvector = palloc(RADIUS_VECTOR_LENGTH + strlen(port->hba->radiussecret));
+   encryptedpasswordlen = ((strlen(passwd) + RADIUS_VECTOR_LENGTH - 1) / RADIUS_VECTOR_LENGTH) * RADIUS_VECTOR_LENGTH;
+   cryptvector = palloc(strlen(port->hba->radiussecret) + RADIUS_VECTOR_LENGTH);
    memcpy(cryptvector, port->hba->radiussecret, strlen(port->hba->radiussecret));
-   memcpy(cryptvector + strlen(port->hba->radiussecret), packet->vector, RADIUS_VECTOR_LENGTH);
-   if (!pg_md5_binary(cryptvector, RADIUS_VECTOR_LENGTH + strlen(port->hba->radiussecret), encryptedpassword))
+
+   /* for the first iteration, we use the Request Authenticator vector */
+   md5trailer = packet->vector;
+   for (i = 0; i < encryptedpasswordlen; i += RADIUS_VECTOR_LENGTH)
    {
-       ereport(LOG,
-               (errmsg("could not perform MD5 encryption of password")));
-       pfree(cryptvector);
-       return STATUS_ERROR;
+       memcpy(cryptvector + strlen(port->hba->radiussecret), md5trailer, RADIUS_VECTOR_LENGTH);
+       /* .. and for subsequent iterations the result of the previous XOR (calculated below) */
+       md5trailer = encryptedpassword + i;
+
+       if (!pg_md5_binary(cryptvector, strlen(port->hba->radiussecret) + RADIUS_VECTOR_LENGTH, encryptedpassword + i))
+       {
+           ereport(LOG,
+                   (errmsg("could not perform MD5 encryption of password")));
+           pfree(cryptvector);
+           return STATUS_ERROR;
+       }
+
+       for (j = i; j < i+RADIUS_VECTOR_LENGTH; j++)
+       {
+           if (j < strlen(passwd))
+               encryptedpassword[j] = passwd[j] ^ encryptedpassword[j];
+           else
+               encryptedpassword[j] = '\0' ^ encryptedpassword[j];
+       }
    }
    pfree(cryptvector);
-   for (i = 0; i < RADIUS_VECTOR_LENGTH; i++)
-   {
-       if (i < strlen(passwd))
-           encryptedpassword[i] = passwd[i] ^ encryptedpassword[i];
-       else
-           encryptedpassword[i] = '\0' ^ encryptedpassword[i];
-   }
-   radius_add_attribute(packet, RADIUS_PASSWORD, encryptedpassword, RADIUS_VECTOR_LENGTH);
+
+   radius_add_attribute(packet, RADIUS_PASSWORD, encryptedpassword, encryptedpasswordlen);
 
    /* Length need to be in network order on the wire */
    packetlength = packet->length;