Merge pull request #1057 from guedou/RADIUS_fixes

[RADIUS] Remove cryptography dependency, Python3 support and tests

2 files changed, 31 insertions, 56 deletions

diff --git a/scapy/layers/radius.py b/scapy/layers/radius.py
index ada1cb42..be7b5496 100644
--- a/scapy/layers/radius.py
+++ b/scapy/layers/radius.py
@@ -10,6 +10,8 @@ RADIUS (Remote Authentication Dial In User Service)
 
 import struct
 import logging
+import hashlib
+import hmac
 from scapy.compat import *
 from scapy.packet import Packet, bind_layers
 from scapy.fields import ByteField, ByteEnumField, IntField, StrLenField,\
@@ -21,20 +23,6 @@ from scapy.config import conf
 from scapy.error import Scapy_Exception
 
 
-g_log_loading = logging.getLogger("scapy.logging")
-
-_crypto_loading_failure_message = \
-    "Could not import python-cryptography."\
-    "Computations for the \"authenticator\" field (RADIUS packets) and"\
-    "\"Message-Authenticator\" attribute value field are disabled."
-
-if conf.crypto_valid:
-    from cryptography.hazmat.backends import default_backend
-    from cryptography.hazmat.primitives import hashes, hmac
-else:
-    g_log_loading.info(_crypto_loading_failure_message)
-
-
 # https://www.iana.org/assignments/radius-types/radius-types.xhtml
 _radius_attribute_types = {
     1: "User-Name",
@@ -540,6 +528,23 @@ class RadiusAttr_State(_RadiusAttrHexStringVal):
     val = 24
 
 
+
+def prepare_packed_data(radius_packet, packed_req_authenticator):
+    """
+    Pack RADIUS data prior computing the authentication MAC
+    """
+
+    packed_hdr = struct.pack("!B", radius_packet.code)
+    packed_hdr += struct.pack("!B", radius_packet.id)
+    packed_hdr += struct.pack("!H", radius_packet.len)
+
+    packed_attrs = b''
+    for attr in radius_packet.attributes:
+        packed_attrs += raw(attr)
+
+    return packed_hdr + packed_req_authenticator + packed_attrs
+
+
 class RadiusAttr_Message_Authenticator(_RadiusAttrHexStringVal):
     """RFC 2869"""
     val = 80
@@ -556,35 +561,16 @@ class RadiusAttr_Message_Authenticator(_RadiusAttrHexStringVal):
     ]
 
     @staticmethod
-    def compute_message_authenticator(
-            radius_packet,
-            packed_req_authenticator,
-            shared_secret
-    ):
+    def compute_message_authenticator(radius_packet, packed_req_authenticator,
+                                      shared_secret):
         """
         Computes the "Message-Authenticator" of a given RADIUS packet.
         """
 
-        if not conf.crypto_valid:
-            g_log_loading.info(_crypto_loading_failure_message)
-            return None
-
-        packed_hdr = struct.pack("!B", radius_packet.code)
-        packed_hdr += struct.pack("!B", radius_packet.id)
-        packed_hdr += struct.pack("!H", radius_packet.len)
-        packed_attrs = ''
-        for index in range(0, len(radius_packet.attributes)):
-            packed_attrs = packed_attrs + str(radius_packet.attributes[index])
-
-        hmac_ = hmac.HMAC(
-            shared_secret,
-            hashes.MD5(),
-            backend=default_backend()
-        )
-        packed_data = packed_hdr + packed_req_authenticator + packed_attrs
-        hmac_.update(packed_data)
-        return hmac_.finalize()
+        data = prepare_packed_data(radius_packet, packed_req_authenticator)
+        radius_hmac = hmac.new(shared_secret, data, hashlib.md5)
 
+        return radius_hmac.digest()
 
 #
 # RADIUS attributes which values are IPv4 prefixes
@@ -1171,23 +1157,9 @@ class Radius(Packet):
         Computes the authenticator field (RFC 2865 - Section 3)
         """
 
-        if not conf.crypto_valid:
-            g_log_loading.info(_crypto_loading_failure_message)
-            return None
-
-        packed_hdr = struct.pack("!B", self.code)
-        packed_hdr += struct.pack("!B", self.id)
-        packed_hdr += struct.pack("!H", self.len)
-        packed_attrs = b''
-        for attr in self.attributes:
-            packed_attrs = packed_attrs + raw(attr)
-        packed_data = packed_hdr + packed_request_auth + packed_attrs +\
-            shared_secret
-
-        digest = hashes.Hash(hashes.MD5(), backend=default_backend())
-        digest.update(packed_data)
-        return digest.finalize()
-
+        data = prepare_packed_data(self, packed_request_auth)
+        radius_mac = hashlib.md5(data + shared_secret)
+        return radius_mac.digest()
 
     def post_build(self, p, pay):
         p += pay
diff --git a/test/regression.uts b/test/regression.uts
index 88ca90a3..3569724e 100644
--- a/test/regression.uts
+++ b/test/regression.uts
@@ -8138,6 +8138,10 @@ assert(type(radius_packet.attributes[16]) == RadiusAttr_NAS_Port)
 assert(radius_packet.attributes[16].len == 6)
 assert(radius_packet.attributes[16].value == 50118)
 
+= RADIUS - compute_message_authenticator()
+ram = radius_packet[RadiusAttr_Message_Authenticator]
+assert ram.compute_message_authenticator(radius_packet, b"dummy bytes", b"scapy") == b'\x19\xa4\x0e*Y4\xe0l?,\x94\x9f \xb8Jb'
+
 = RADIUS - Access-Challenge - Dissection (2)
 s = b'\x0b\xae\x00[\xc7\xae\xfc6\xa1=\xb5\x99&^\xdf=\xe9\x00\xa6\xe8\x12\rHello, leapO\x16\x01\x02\x00\x14\x11\x01\x00\x08\xb8\xc4\x1a4\x97x\xd3\x82leapP\x12\xd3\x12\x17\xa6\x0c.\x94\x85\x03]t\xd1\xdb\xd0\x13\x8c\x18\x12iQs\xf7iSb@k\x9d,\xa0\x99\x8ehO'
 radius_packet = Radius(s)
@@ -8239,7 +8243,6 @@ assert(radius_packet.attributes[3].len == 18)
 assert(radius_packet.attributes[3].value == b'iQs\xf7hRb@k\x9d,\xa0\x99\x8ehO')
 
 = RADIUS - Response Authenticator computation
-~ crypto
 s = b'\x01\xae\x01\x17>k\xd4\xc4\x19V\x0b*1\x99\xc8D\xea\xc2\x94Z\x01\x06leap\x06\x06\x00\x00\x00\x02\x1a\x1b\x00\x00\x00\t\x01\x15service-type=Framed\x0c\x06\x00\x00#\xee\x1e\x13AC-7E-8A-4E-E2-92\x1f\x1300-26-73-9E-0F-D3O\x0b\x02\x01\x00\t\x01leapP\x12U\xbc\x12\xcdM\x00\xf8\xdb4\xf1\x18r\xca_\x8c\xf6f\x02\x1a1\x00\x00\x00\t\x01+audit-session-id=0AC8090E0000001A0354CA00\x1a\x14\x00\x00\x00\t\x01\x0emethod=dot1x\x08\x06\xc0\xa8\n\xb9\x04\x06\xc0\xa8\n\x80\x1a\x1d\x00\x00\x00\t\x02\x17GigabitEthernet1/0/18W\x17GigabitEthernet1/0/18=\x06\x00\x00\x00\x0f\x05\x06\x00\x00\xc3\xc6'
 access_request = Radius(s)
 s = b'\x0b\xae\x00[\xc7\xae\xfc6\xa1=\xb5\x99&^\xdf=\xe9\x00\xa6\xe8\x12\rHello, leapO\x16\x01\x02\x00\x14\x11\x01\x00\x08\xb8\xc4\x1a4\x97x\xd3\x82leapP\x12\xd3\x12\x17\xa6\x0c.\x94\x85\x03]t\xd1\xdb\xd0\x13\x8c\x18\x12iQs\xf7iSb@k\x9d,\xa0\x99\x8ehO'