safebox/guacamole-client
4
0
Fork 0
mirror of https://github.com/gyurix1968/guacamole-client.git synced 2025-09-06 21:27:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

GUACAMOLE-197: Correct issues with TLS modules, including EAP-TLS and EAP-TTLS

Browse Source
This commit is contained in:
Nick Couchman
2017-02-10 16:33:19 -05:00
committed by Nick Couchman
parent aa45177387
commit 5cb9b7972d
3 changed files with 43 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
extensions/guacamole-auth-radius/src/main/java/org/apache/guacamole/auth/radius/AuthenticationProviderService.java
View File

@@ -42,6 +42,7 @@ import net.jradius.packet.AccessChallenge;
import net.jradius.packet.AccessReject;
import net.jradius.packet.AccessRequest;
import net.jradius.packet.AccessResponse;
import net.jradius.packet.attribute.AttributeList;
import net.jradius.packet.attribute.RadiusAttribute;
/**
@@ -141,6 +142,12 @@ public class AuthenticationProviderService {
* We create a new form/field with the challenge message.
*/
else if (radPack instanceof AccessChallenge) {
AttributeList radAttrs = radPack.getAttributes();
logger.debug("===BEGIN ATTRIBUTE DEBUG===");
for(RadiusAttribute attr : radAttrs.getAttributeList()) {
logger.debug("Attribute: {}; Value: {}", attr.getAttributeName(), attr.getValue());
}
logger.debug("==END ATTRIBUTE DEBUG===");
try {
RadiusAttribute stateAttr = radPack.findAttribute(Attr_State.TYPE);
// We should have a state attribute at this point, if not, we need to quit.

10
extensions/guacamole-auth-radius/src/main/java/org/apache/guacamole/auth/radius/ConfigurationService.java
View File

@@ -167,14 +167,14 @@ public class ConfigurationService {
public String getRadiusCAFile() throws GuacamoleException {
return environment.getProperty(
RadiusGuacamoleProperties.RADIUS_CA_FILE,
"radius-ca.pem"
null
);
}
public String getRadiusKeyFile() throws GuacamoleException {
return environment.getProperty(
RadiusGuacamoleProperties.RADIUS_KEY_FILE,
"radius-key.pem"
"radius.pem"
);
}
@@ -188,7 +188,7 @@ public class ConfigurationService {
public String getRadiusCAType() throws GuacamoleException {
return environment.getProperty(
RadiusGuacamoleProperties.RADIUS_CA_TYPE,
null
"pkcs12"
);
}
@@ -201,8 +201,8 @@ public class ConfigurationService {
public String getRadiusKeyType() throws GuacamoleException {
return environment.getProperty(
RadiusGuacamoleProperties.RADIUS_KEY_PASSWORD,
null
RadiusGuacamoleProperties.RADIUS_KEY_TYPE,
"pkcs12"
);
}

38
extensions/guacamole-auth-radius/src/main/java/org/apache/guacamole/auth/radius/RadiusConnectionService.java
View File

@@ -27,6 +27,7 @@ import java.net.UnknownHostException;
import java.security.NoSuchAlgorithmException;
import org.apache.guacamole.GuacamoleException;
import org.apache.guacamole.GuacamoleUnsupportedException;
import org.apache.guacamole.environment.LocalEnvironment;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import net.jradius.client.RadiusClient;
@@ -35,6 +36,7 @@ import net.jradius.packet.RadiusPacket;
import net.jradius.packet.AccessRequest;
import net.jradius.dictionary.*;
import net.jradius.packet.attribute.AttributeList;
import net.jradius.packet.attribute.RadiusAttribute;
import net.jradius.client.auth.EAPTLSAuthenticator;
import net.jradius.client.auth.EAPTTLSAuthenticator;
import net.jradius.client.auth.RadiusAuthenticator;
@@ -135,9 +137,13 @@ public class RadiusConnectionService {
String keyType;
Boolean trustAll;
String innerProtocol;
LocalEnvironment guacEnv;
String basePath;
// Pull configuration parameters from guacamole.properties
try {
guacEnv = new LocalEnvironment();
basePath = guacEnv.getGuacamoleHome().getAbsolutePath() + '/';
radAuthName = confService.getRadiusAuthProtocol();
caFile = confService.getRadiusCAFile();
caPassword = confService.getRadiusCAPassword();
@@ -165,7 +171,7 @@ public class RadiusConnectionService {
radAuth instanceof EAPTTLSAuthenticator) {
if (caFile != null && !caFile.isEmpty())
((EAPTLSAuthenticator)radAuth).setCaFile(caFile);
((EAPTLSAuthenticator)radAuth).setCaFile(basePath + caFile);
if (caType != null && !caType.isEmpty())
((EAPTLSAuthenticator)radAuth).setCaFileType(caType);
@@ -174,7 +180,7 @@ public class RadiusConnectionService {
((EAPTLSAuthenticator)radAuth).setCaPassword(caPassword);
if (keyFile != null && !keyFile.isEmpty())
((EAPTLSAuthenticator)radAuth).setKeyFile(keyFile);
((EAPTLSAuthenticator)radAuth).setKeyFile(basePath + keyFile);
if (keyType != null && !keyType.isEmpty())
((EAPTLSAuthenticator)radAuth).setKeyFileType(keyType);
@@ -248,18 +254,24 @@ public class RadiusConnectionService {
AttributeList radAttrs = new AttributeList();
radAttrs.add(new Attr_UserName(username));
radAttrs.add(new Attr_UserPassword(password));
radAttrs.add(new Attr_CleartextPassword(password));
AccessRequest radAcc = new AccessRequest(radiusClient);
if (radAuth instanceof EAPTTLSAuthenticator)
// EAP-TTLS tunnels protected attributes inside the TLS layer
if (radAuth instanceof EAPTTLSAuthenticator) {
radAuth.setUsername(new Attr_UserName(username));
((EAPTTLSAuthenticator)radAuth).setTunneledAttributes(radAttrs);
}
else
radAcc.addAttributes(radAttrs);
radAuth.setupRequest(radiusClient, radAcc);
radAuth.processRequest(radAcc);
RadiusResponse reply = radiusClient.sendReceive(radAcc, confService.getRadiusRetries());
if ((reply instanceof AccessChallenge) && (reply.findAttribute(Attr_EAPMessage.TYPE) != null)) {
logger.debug("We got an AccessChallenge message, and it appears to be an EAP mechanism, trying to process.");
// We receive a Challenge not asking for user input, so silently process the challenge
while((reply instanceof AccessChallenge) && (reply.findAttribute(Attr_ReplyMessage.TYPE) == null)) {
radAuth.processChallenge(radAcc, reply);
reply = radiusClient.sendReceive(radAcc, confService.getRadiusRetries());
}
@@ -335,16 +347,28 @@ public class RadiusConnectionService {
radAttrs.add(new Attr_UserName(username));
radAttrs.add(new Attr_State(state));
radAttrs.add(new Attr_UserPassword(response));
radAttrs.add(new Attr_CleartextPassword(response));
AccessRequest radAcc = new AccessRequest(radiusClient);
if (radAuth instanceof EAPTTLSAuthenticator)
// EAP-TTLS tunnels protected attributes inside the TLS layer
if (radAuth instanceof EAPTTLSAuthenticator) {
radAuth.setUsername(new Attr_UserName(username));
((EAPTTLSAuthenticator)radAuth).setTunneledAttributes(radAttrs);
}
else
radAcc.addAttributes(radAttrs);
radAuth.setupRequest(radiusClient, radAcc);
radAuth.processRequest(radAcc);
return radiusClient.sendReceive(radAcc, confService.getRadiusRetries());
RadiusResponse reply = radiusClient.sendReceive(radAcc, confService.getRadiusRetries());
// We receive a Challenge not asking for user input, so silently process the challenge
while((reply instanceof AccessChallenge) && (reply.findAttribute(Attr_ReplyMessage.TYPE) == null)) {
radAuth.processChallenge(radAcc, reply);
reply = radiusClient.sendReceive(radAcc, confService.getRadiusRetries());
}
return reply;
}
catch (RadiusException e) {
logger.error("Unable to complete authentication.", e.getMessage());