+-----------+---------------------------+-----------------------+
|%p |Port number |%{NAS-Port} |
+-----------+---------------------------+-----------------------+
-|%s |Speed (PW_CONNECT_INFO) |%{Connect-Info} |
+|%s |Speed (FR_CONNECT_INFO) |%{Connect-Info} |
+-----------+---------------------------+-----------------------+
|%t |request in ctime format | |
+-----------+---------------------------+-----------------------+
ATTRIBUTE Tmp-Date-9 1849 date
#
-# Attributes 1850 through 1850 + PW_TYPE_MAX are reserved.
+# Attributes 1850 through 1850 + FR_TYPE_MAX are reserved.
#
ATTRIBUTE Tmp-Integer64-0 1850 integer64
src/include/attributes.h: share/dictionary.freeradius.internal
${Q}$(ECHO) HEADER $@
- ${Q}grep ^ATTRIBUTE $< | awk '{print "PW_"$$2 " " $$3 " //!< AUTOGENERATED ATTRIBUTE DEFINITION"}' | tr '[:lower:]' '[:upper:]' | tr -- - _ | sed 's/^/#define /' > $@
+ ${Q}grep ^ATTRIBUTE $< | awk '{print "FR_"$$2 " " $$3 " //!< AUTOGENERATED ATTRIBUTE DEFINITION"}' | tr '[:lower:]' '[:upper:]' | tr -- - _ | sed 's/^/#define /' > $@
${Q}echo " " >> $@
- ${Q}grep -- 'Auth-Type' $< | grep ^VALUE | awk '{print "PW_"$$2 "_" $$3 " " $$4 " //!< AUTOGENERATED VALUE DEFINITION"}' | tr '[:lower:]' '[:upper:]' | tr -- - _ | sed 's/^/#define /' >> $@
+ ${Q}grep -- 'Auth-Type' $< | grep ^VALUE | awk '{print "FR_"$$2 "_" $$3 " " $$4 " //!< AUTOGENERATED VALUE DEFINITION"}' | tr '[:lower:]' '[:upper:]' | tr -- - _ | sed 's/^/#define /' >> $@
src/include/%.h: share/dictionary.% share/dictionary.vqp share/dictionary.freeradius.snmp
${Q}$(ECHO) HEADER $@
- ${Q}grep ^ATTRIBUTE $< | awk '{print "PW_"$$2 " " $$3 " //!< AUTOGENERATED ATTRIBUTE DEFINITION"}' | tr '[:lower:]' '[:upper:]' | tr -- - _ | sed 's/^/#define /' > $@
- ${Q}grep ^VALUE $< | awk '{print "PW_"$$2"_VALUE_"$$3 " " $$4 " //!< AUTOGENERATED VALUE DEFINITION"}' | tr '[:lower:]' '[:upper:]' | tr -- - _ | tr -- . _ | sed 's/^/#define /' >> $@
+ ${Q}grep ^ATTRIBUTE $< | awk '{print "FR_"$$2 " " $$3 " //!< AUTOGENERATED ATTRIBUTE DEFINITION"}' | tr '[:lower:]' '[:upper:]' | tr -- - _ | sed 's/^/#define /' > $@
+ ${Q}grep ^VALUE $< | awk '{print "FR_"$$2"_VALUE_"$$3 " " $$4 " //!< AUTOGENERATED VALUE DEFINITION"}' | tr '[:lower:]' '[:upper:]' | tr -- - _ | tr -- . _ | sed 's/^/#define /' >> $@
#
# Build features.h by copying over WITH_* and RADIUSD_VERSION_*
*/
# define FR_CONF_TYPE_CHECK(_t, _ct, _p) \
__builtin_choose_expr((_t) & FR_TYPE_SUBSECTION, _p, \
-__builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_SIZE) && !((_t) & FR_TYPE_MULTI), \
+__builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_SIZE) && !((_t) & FR_TYPE_MULTI), \
__builtin_choose_expr(is_compatible((_ct), size_t *), _p, (_mismatch_size) 0), \
-__builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_SIZE) && ((_t) & FR_TYPE_MULTI), \
+__builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_SIZE) && ((_t) & FR_TYPE_MULTI), \
__builtin_choose_expr(is_compatible((_ct), size_t **), _p, (_mismatch_size_m) 0), \
-__builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_DATE) && !((_t) & FR_TYPE_MULTI), \
+__builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_DATE) && !((_t) & FR_TYPE_MULTI), \
__builtin_choose_expr(is_compatible((_ct), time_t *), _p, (_mismatch_time) 0), \
-__builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_DATE) && ((_t) & FR_TYPE_MULTI), \
+__builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_DATE) && ((_t) & FR_TYPE_MULTI), \
__builtin_choose_expr(is_compatible((_ct), time_t **), _p, (_mismatch_time_m) 0), \
_Generic((_ct), \
vp_tmpl_t ** : __builtin_choose_expr(((_t) & FR_TYPE_TMPL) && !((_t) & FR_TYPE_MULTI), \
_p, (_mismatch_vp_tmpl) 0), \
vp_tmpl_t *** : __builtin_choose_expr(((_t) & FR_TYPE_TMPL) && ((_t) & FR_TYPE_MULTI), \
_p, (_mismatch_vp_tmpl_m) 0), \
- char const ** : __builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_STRING) && !((_t) & FR_TYPE_MULTI), \
+ char const ** : __builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_STRING) && !((_t) & FR_TYPE_MULTI), \
_p, (_mismatch_char) 0), \
- char const *** : __builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_STRING) && ((_t) & FR_TYPE_MULTI), \
+ char const *** : __builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_STRING) && ((_t) & FR_TYPE_MULTI), \
_p, (_mismatch_char_m) 0), \
- bool * : __builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_BOOL) && !((_t) & FR_TYPE_MULTI), \
+ bool * : __builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_BOOL) && !((_t) & FR_TYPE_MULTI), \
_p, (_mismatch_bool) 0), \
- bool ** : __builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_BOOL) && ((_t) & FR_TYPE_MULTI), \
+ bool ** : __builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_BOOL) && ((_t) & FR_TYPE_MULTI), \
_p, (_mismatch_bool_m) 0), \
- uint32_t * : __builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_UINT32) && !((_t) & FR_TYPE_MULTI), \
+ uint32_t * : __builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_UINT32) && !((_t) & FR_TYPE_MULTI), \
_p, (_mismatch_uint32) 0), \
- uint32_t ** : __builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_UINT32) && ((_t) & FR_TYPE_MULTI), \
+ uint32_t ** : __builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_UINT32) && ((_t) & FR_TYPE_MULTI), \
_p, (_mismatch_uint32_m) 0), \
- fr_ipaddr_t * : __builtin_choose_expr(((PW_BASE_TYPE(_t) == FR_TYPE_IPV4_ADDR) || \
- (PW_BASE_TYPE(_t) == FR_TYPE_IPV4_PREFIX) || \
- (PW_BASE_TYPE(_t) == FR_TYPE_IPV6_ADDR) || \
- (PW_BASE_TYPE(_t) == FR_TYPE_IPV6_PREFIX) || \
- (PW_BASE_TYPE(_t) == FR_TYPE_COMBO_IP_ADDR)) || \
+ fr_ipaddr_t * : __builtin_choose_expr(((FR_BASE_TYPE(_t) == FR_TYPE_IPV4_ADDR) || \
+ (FR_BASE_TYPE(_t) == FR_TYPE_IPV4_PREFIX) || \
+ (FR_BASE_TYPE(_t) == FR_TYPE_IPV6_ADDR) || \
+ (FR_BASE_TYPE(_t) == FR_TYPE_IPV6_PREFIX) || \
+ (FR_BASE_TYPE(_t) == FR_TYPE_COMBO_IP_ADDR)) || \
!((_t) & FR_TYPE_MULTI), _p, (_mismatch_fripaddr) 0), \
- fr_ipaddr_t ** : __builtin_choose_expr(((PW_BASE_TYPE(_t) == FR_TYPE_IPV4_ADDR) || \
- (PW_BASE_TYPE(_t) == FR_TYPE_IPV4_PREFIX) || \
- (PW_BASE_TYPE(_t) == FR_TYPE_IPV6_ADDR) || \
- (PW_BASE_TYPE(_t) == FR_TYPE_IPV6_PREFIX) || \
- (PW_BASE_TYPE(_t) == FR_TYPE_COMBO_IP_ADDR)) && \
+ fr_ipaddr_t ** : __builtin_choose_expr(((FR_BASE_TYPE(_t) == FR_TYPE_IPV4_ADDR) || \
+ (FR_BASE_TYPE(_t) == FR_TYPE_IPV4_PREFIX) || \
+ (FR_BASE_TYPE(_t) == FR_TYPE_IPV6_ADDR) || \
+ (FR_BASE_TYPE(_t) == FR_TYPE_IPV6_PREFIX) || \
+ (FR_BASE_TYPE(_t) == FR_TYPE_COMBO_IP_ADDR)) && \
((_t) & FR_TYPE_MULTI), _p, (_mismatch_fripaddr_m) 0), \
- size_t[32/sizeof(size_t)] : __builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_ABINARY) && !((_t) & FR_TYPE_MULTI), \
+ size_t[32/sizeof(size_t)] : __builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_ABINARY) && !((_t) & FR_TYPE_MULTI), \
_p, (_mismatch_abinary) 0), \
- size_t*[32/sizeof(size_t)] : __builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_ABINARY) && ((_t) & FR_TYPE_MULTI), \
+ size_t*[32/sizeof(size_t)] : __builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_ABINARY) && ((_t) & FR_TYPE_MULTI), \
_p, (_mismatch_abinary_m) 0), \
- uint8_t const * : __builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_OCTETS) && !((_t) & FR_TYPE_MULTI), \
+ uint8_t const * : __builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_OCTETS) && !((_t) & FR_TYPE_MULTI), \
_p, (_mismatch_uint8) 0), \
- uint8_t const **: __builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_OCTETS) && ((_t) & FR_TYPE_MULTI), \
+ uint8_t const **: __builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_OCTETS) && ((_t) & FR_TYPE_MULTI), \
_p, (_mismatch_uint8_m) 0), \
- uint8_t * : __builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_UINT8) && !((_t) & FR_TYPE_MULTI), \
+ uint8_t * : __builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_UINT8) && !((_t) & FR_TYPE_MULTI), \
_p, (_mismatch_uint8) 0), \
- uint8_t ** : __builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_UINT8) && ((_t) & FR_TYPE_MULTI), \
+ uint8_t ** : __builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_UINT8) && ((_t) & FR_TYPE_MULTI), \
_p, (_mismatch_uint8_m) 0), \
- uint8_t[8] : __builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_IFID) && !(_t & FR_TYPE_MULTI), \
+ uint8_t[8] : __builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_IFID) && !(_t & FR_TYPE_MULTI), \
_p, (_mismatch_ifid) 0), \
- uint8_t*[8] : __builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_IFID) && ((_t) & FR_TYPE_MULTI), \
+ uint8_t*[8] : __builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_IFID) && ((_t) & FR_TYPE_MULTI), \
_p, (_mismatch_ifid_m) 0), \
- uint16_t * : __builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_UINT16) && !((_t) & FR_TYPE_MULTI), \
+ uint16_t * : __builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_UINT16) && !((_t) & FR_TYPE_MULTI), \
_p, (_mismatch_uint16) 0), \
- uint16_t ** : __builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_UINT16) && ((_t) & FR_TYPE_MULTI), \
+ uint16_t ** : __builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_UINT16) && ((_t) & FR_TYPE_MULTI), \
_p, (_mismatch_uint16_m) 0), \
- uint8_t[6] : __builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_ETHERNET) && !((_t) & FR_TYPE_MULTI), \
+ uint8_t[6] : __builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_ETHERNET) && !((_t) & FR_TYPE_MULTI), \
_p, (_mismatch_ethernet) 0), \
- uint8_t*[6] : __builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_ETHERNET) && ((_t) & FR_TYPE_MULTI), \
+ uint8_t*[6] : __builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_ETHERNET) && ((_t) & FR_TYPE_MULTI), \
_p, (_mismatch_ethernet_m) 0), \
- int32_t * : __builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_INT32) && !((_t) & FR_TYPE_MULTI), \
+ int32_t * : __builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_INT32) && !((_t) & FR_TYPE_MULTI), \
_p, (_mismatch_int32) 0), \
- int32_t ** : __builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_INT32) && ((_t) & FR_TYPE_MULTI), \
+ int32_t ** : __builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_INT32) && ((_t) & FR_TYPE_MULTI), \
_p, (_mismatch_int32_m) 0), \
- uint64_t * : __builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_UINT64) && !((_t) & FR_TYPE_MULTI), \
+ uint64_t * : __builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_UINT64) && !((_t) & FR_TYPE_MULTI), \
_p, (_mismatch_uint64) 0), \
- uint64_t ** : __builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_UINT64) && ((_t) & FR_TYPE_MULTI), \
+ uint64_t ** : __builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_UINT64) && ((_t) & FR_TYPE_MULTI), \
_p, (_mismatch_uint64_m) 0), \
- _timeval_t * : __builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_TIMEVAL) && !((_t) & FR_TYPE_MULTI), \
+ _timeval_t * : __builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_TIMEVAL) && !((_t) & FR_TYPE_MULTI), \
_p, (_mismatch_timeval) 0), \
- _timeval_t ** : __builtin_choose_expr((PW_BASE_TYPE(_t) == FR_TYPE_TIMEVAL) && ((_t) & FR_TYPE_MULTI), \
+ _timeval_t ** : __builtin_choose_expr((FR_BASE_TYPE(_t) == FR_TYPE_TIMEVAL) && ((_t) & FR_TYPE_MULTI), \
_p, (_mismatch_timeval_m) 0), \
default: (conf_type_mismatch)0))))))
//!< left as the default to is_set_offset
//!< or is_set_ptr.
-#define PW_BASE_TYPE(_t) (0xff & (_t))
+#define FR_BASE_TYPE(_t) (0xff & (_t))
/* @} **/
#define FR_SIZE_COND_CHECK(_name, _var, _cond, _new)\
/*
* This is a horrible hack.
*/
-#define PW_DHCP_OFFSET (1024)
+#define FR_DHCP_OFFSET (1024)
typedef enum {
- PW_DHCP_DISCOVER = (PW_DHCP_OFFSET + 1),
- PW_DHCP_OFFER = (PW_DHCP_OFFSET + 2),
- PW_DHCP_REQUEST = (PW_DHCP_OFFSET+ 3),
- PW_DHCP_DECLINE = (PW_DHCP_OFFSET + 4),
- PW_DHCP_ACK = (PW_DHCP_OFFSET + 5),
- PW_DHCP_NAK = (PW_DHCP_OFFSET + 6),
- PW_DHCP_RELEASE = (PW_DHCP_OFFSET + 7),
- PW_DHCP_INFORM = (PW_DHCP_OFFSET + 8),
- PW_DHCP_FORCE_RENEW = (PW_DHCP_OFFSET + 9),
- PW_DHCP_LEASE_QUERY = (PW_DHCP_OFFSET + 10),
- PW_DHCP_LEASE_UNASSIGNED = (PW_DHCP_OFFSET + 11),
- PW_DHCP_LEASE_UNKNOWN = (PW_DHCP_OFFSET + 12),
- PW_DHCP_LEASE_ACTIVE = (PW_DHCP_OFFSET + 13),
- PW_DHCP_BULK_LEASE_QUERY = (PW_DHCP_OFFSET + 14),
- PW_DHCP_LEASE_QUERY_DONE = (PW_DHCP_OFFSET + 15),
- PW_DHCP_MAX = (PW_DHCP_OFFSET + 16)
+ FR_DHCP_DISCOVER = (FR_DHCP_OFFSET + 1),
+ FR_DHCP_OFFER = (FR_DHCP_OFFSET + 2),
+ FR_DHCP_REQUEST = (FR_DHCP_OFFSET+ 3),
+ FR_DHCP_DECLINE = (FR_DHCP_OFFSET + 4),
+ FR_DHCP_ACK = (FR_DHCP_OFFSET + 5),
+ FR_DHCP_NAK = (FR_DHCP_OFFSET + 6),
+ FR_DHCP_RELEASE = (FR_DHCP_OFFSET + 7),
+ FR_DHCP_INFORM = (FR_DHCP_OFFSET + 8),
+ FR_DHCP_FORCE_RENEW = (FR_DHCP_OFFSET + 9),
+ FR_DHCP_LEASE_QUERY = (FR_DHCP_OFFSET + 10),
+ FR_DHCP_LEASE_UNASSIGNED = (FR_DHCP_OFFSET + 11),
+ FR_DHCP_LEASE_UNKNOWN = (FR_DHCP_OFFSET + 12),
+ FR_DHCP_LEASE_ACTIVE = (FR_DHCP_OFFSET + 13),
+ FR_DHCP_BULK_LEASE_QUERY = (FR_DHCP_OFFSET + 14),
+ FR_DHCP_LEASE_QUERY_DONE = (FR_DHCP_OFFSET + 15),
+ FR_DHCP_MAX = (FR_DHCP_OFFSET + 16)
} fr_dhcp_codes_t;
extern char const *dhcp_header_names[];
#define DHCP_MAGIC_VENDOR (54)
-#define PW_DHCP_OPTION_82 (82)
+#define FR_DHCP_OPTION_82 (82)
#define DHCP_PACK_OPTION1(x,y) ((x) | ((y) << 8))
#define DHCP_BASE_ATTR(x) (x & 0xff)
#define DHCP_UNPACK_OPTION1(x) (((x) & 0xff00) >> 8)
-#define PW_DHCP_MESSAGE_TYPE (53)
-#define PW_DHCP_YOUR_IP_ADDRESS (264)
-#define PW_DHCP_SUBNET_MASK (1)
-#define PW_DHCP_IP_ADDRESS_LEASE_TIME (51)
+#define FR_DHCP_MESSAGE_TYPE (53)
+#define FR_DHCP_YOUR_IP_ADDRESS (264)
+#define FR_DHCP_SUBNET_MASK (1)
+#define FR_DHCP_IP_ADDRESS_LEASE_TIME (51)
#ifdef __cplusplus
}
RADIUS_PACKET *packet; //!< The outgoing request.
RADIUS_PACKET *reply; //!< The incoming response.
VALUE_PAIR *filter; //!< If the reply passes the filter, then the request passes.
- PW_CODE filter_code; //!< Expected code of the response packet.
+ FR_CODE filter_code; //!< Expected code of the response packet.
int resend;
int tries;
*
*/
typedef enum {
- PW_CODE_UNDEFINED = 0, //!< Packet code has not been set
- PW_CODE_ACCESS_REQUEST = 1, //!< RFC2865 - Access-Request
- PW_CODE_ACCESS_ACCEPT = 2, //!< RFC2865 - Access-Accept
- PW_CODE_ACCESS_REJECT = 3, //!< RFC2865 - Access-Reject
- PW_CODE_ACCOUNTING_REQUEST = 4, //!< RFC2866 - Accounting-Request
- PW_CODE_ACCOUNTING_RESPONSE = 5, //!< RFC2866 - Accounting-Response
- PW_CODE_ACCOUNTING_STATUS = 6, //!< RFC3575 - Reserved
- PW_CODE_PASSWORD_REQUEST = 7, //!< RFC3575 - Reserved
- PW_CODE_PASSWORD_ACK = 8, //!< RFC3575 - Reserved
- PW_CODE_PASSWORD_REJECT = 9, //!< RFC3575 - Reserved
- PW_CODE_ACCOUNTING_MESSAGE = 10, //!< RFC3575 - Reserved
- PW_CODE_ACCESS_CHALLENGE = 11, //!< RFC2865 - Access-Challenge
- PW_CODE_STATUS_SERVER = 12, //!< RFC2865/RFC5997 - Status Server (request)
- PW_CODE_STATUS_CLIENT = 13, //!< RFC2865/RFC5997 - Status Server (response)
- PW_CODE_DISCONNECT_REQUEST = 40, //!< RFC3575/RFC5176 - Disconnect-Request
- PW_CODE_DISCONNECT_ACK = 41, //!< RFC3575/RFC5176 - Disconnect-Ack (positive)
- PW_CODE_DISCONNECT_NAK = 42, //!< RFC3575/RFC5176 - Disconnect-Nak (not willing to perform)
- PW_CODE_COA_REQUEST = 43, //!< RFC3575/RFC5176 - CoA-Request
- PW_CODE_COA_ACK = 44, //!< RFC3575/RFC5176 - CoA-Ack (positive)
- PW_CODE_COA_NAK = 45, //!< RFC3575/RFC5176 - CoA-Nak (not willing to perform)
- PW_CODE_MAX = 255, //!< Maximum possible code
-} PW_CODE;
-
-#define PW_AUTH_UDP_PORT 1812
-#define PW_AUTH_UDP_PORT_ALT 1645
-#define PW_ACCT_UDP_PORT 1813
-#define PW_ACCT_UDP_PORT_ALT 1646
-#define PW_POD_UDP_PORT 1700
-#define PW_RADIUS_TLS_PORT 2083
-#define PW_COA_UDP_PORT 3799
+ FR_CODE_UNDEFINED = 0, //!< Packet code has not been set
+ FR_CODE_ACCESS_REQUEST = 1, //!< RFC2865 - Access-Request
+ FR_CODE_ACCESS_ACCEPT = 2, //!< RFC2865 - Access-Accept
+ FR_CODE_ACCESS_REJECT = 3, //!< RFC2865 - Access-Reject
+ FR_CODE_ACCOUNTING_REQUEST = 4, //!< RFC2866 - Accounting-Request
+ FR_CODE_ACCOUNTING_RESPONSE = 5, //!< RFC2866 - Accounting-Response
+ FR_CODE_ACCOUNTING_STATUS = 6, //!< RFC3575 - Reserved
+ FR_CODE_PASSWORD_REQUEST = 7, //!< RFC3575 - Reserved
+ FR_CODE_PASSWORD_ACK = 8, //!< RFC3575 - Reserved
+ FR_CODE_PASSWORD_REJECT = 9, //!< RFC3575 - Reserved
+ FR_CODE_ACCOUNTING_MESSAGE = 10, //!< RFC3575 - Reserved
+ FR_CODE_ACCESS_CHALLENGE = 11, //!< RFC2865 - Access-Challenge
+ FR_CODE_STATUS_SERVER = 12, //!< RFC2865/RFC5997 - Status Server (request)
+ FR_CODE_STATUS_CLIENT = 13, //!< RFC2865/RFC5997 - Status Server (response)
+ FR_CODE_DISCONNECT_REQUEST = 40, //!< RFC3575/RFC5176 - Disconnect-Request
+ FR_CODE_DISCONNECT_ACK = 41, //!< RFC3575/RFC5176 - Disconnect-Ack (positive)
+ FR_CODE_DISCONNECT_NAK = 42, //!< RFC3575/RFC5176 - Disconnect-Nak (not willing to perform)
+ FR_CODE_COA_REQUEST = 43, //!< RFC3575/RFC5176 - CoA-Request
+ FR_CODE_COA_ACK = 44, //!< RFC3575/RFC5176 - CoA-Ack (positive)
+ FR_CODE_COA_NAK = 45, //!< RFC3575/RFC5176 - CoA-Nak (not willing to perform)
+ FR_CODE_MAX = 255, //!< Maximum possible code
+} FR_CODE;
+
+#define FR_AUTH_UDP_PORT 1812
+#define FR_AUTH_UDP_PORT_ALT 1645
+#define FR_ACCT_UDP_PORT 1813
+#define FR_ACCT_UDP_PORT_ALT 1646
+#define FR_POD_UDP_PORT 1700
+#define FR_RADIUS_TLS_PORT 2083
+#define FR_COA_UDP_PORT 3799
/*
* The RFC says 4096 octets max, and most packets are less than 256.
#include <freeradius-devel/rfc4072.h>
#include <freeradius-devel/rfc4372.h>
-#define PW_CUI PW_CHARGEABLE_USER_IDENTITY
+#define FR_CUI FR_CHARGEABLE_USER_IDENTITY
#include <freeradius-devel/rfc4675.h>
#include <freeradius-devel/rfc4818.h>
#include <freeradius-devel/vqp.h>
-#define PW_DIGEST_RESPONSE 206
-#define PW_DIGEST_ATTRIBUTES 207
+#define FR_DIGEST_RESPONSE 206
+#define FR_DIGEST_ATTRIBUTES 207
/*
* Integer Translations
/* User Types */
-#define PW_LOGIN_USER 1
-#define PW_FRAMED_USER 2
-#define PW_CALLBACK_LOGIN_USER 3
-#define PW_CALLBACK_FRAMED_USER 4
-#define PW_OUTBOUND_USER 5
-#define PW_ADMINISTRATIVE_USER 6
-#define PW_NAS_PROMPT_USER 7
-#define PW_AUTHENTICATE_ONLY 8
-#define PW_CALLBACK_NAS_PROMPT 9
-#define PW_AUTHORIZE_ONLY 17
+#define FR_LOGIN_USER 1
+#define FR_FRAMED_USER 2
+#define FR_CALLBACK_LOGIN_USER 3
+#define FR_CALLBACK_FRAMED_USER 4
+#define FR_OUTBOUND_USER 5
+#define FR_ADMINISTRATIVE_USER 6
+#define FR_NAS_PROMPT_USER 7
+#define FR_AUTHENTICATE_ONLY 8
+#define FR_CALLBACK_NAS_PROMPT 9
+#define FR_AUTHORIZE_ONLY 17
/* Framed Protocols */
-#define PW_PPP 1
-#define PW_SLIP 2
+#define FR_PPP 1
+#define FR_SLIP 2
/* Status Types */
-#define PW_STATUS_START 1
-#define PW_STATUS_STOP 2
-#define PW_STATUS_ALIVE 3
-#define PW_STATUS_ACCOUNTING_ON 7
-#define PW_STATUS_ACCOUNTING_OFF 8
+#define FR_STATUS_START 1
+#define FR_STATUS_STOP 2
+#define FR_STATUS_ALIVE 3
+#define FR_STATUS_ACCOUNTING_ON 7
+#define FR_STATUS_ACCOUNTING_OFF 8
/*
* Vendor Private Enterprise Codes
/*
* Microsoft has vendor code 311.
*/
-#define PW_MSCHAP_RESPONSE 1
-#define PW_MSCHAP_ERROR 2
-#define PW_MSCHAP_CPW_1 3
-#define PW_MSCHAP_CPW_2 4
-#define PW_MSCHAP_NT_ENC_PW 6
-#define PW_MSCHAP_MPPE_ENCRYPTION_POLICY 7
-#define PW_MSCHAP_MPPE_ENCRYPTION_TYPES 8
-#define PW_MSCHAP_CHALLENGE 11
-#define PW_MSCHAP_MPPE_SEND_KEY 16
-#define PW_MSCHAP_MPPE_RECV_KEY 17
-#define PW_MSCHAP2_RESPONSE 25
-#define PW_MSCHAP2_SUCCESS 26
-#define PW_MSCHAP2_CPW 27
-#define PW_MS_QUARANTINE_SOH 55
+#define FR_MSCHAP_RESPONSE 1
+#define FR_MSCHAP_ERROR 2
+#define FR_MSCHAP_CFR_1 3
+#define FR_MSCHAP_CFR_2 4
+#define FR_MSCHAP_NT_ENC_PW 6
+#define FR_MSCHAP_MPPE_ENCRYPTION_POLICY 7
+#define FR_MSCHAP_MPPE_ENCRYPTION_TYPES 8
+#define FR_MSCHAP_CHALLENGE 11
+#define FR_MSCHAP_MPPE_SEND_KEY 16
+#define FR_MSCHAP_MPPE_RECV_KEY 17
+#define FR_MSCHAP2_RESPONSE 25
+#define FR_MSCHAP2_SUCCESS 26
+#define FR_MSCHAP2_CPW 27
+#define FR_MS_QUARANTINE_SOH 55
/*
* JANET's code for transporting eap channel binding data over ttls
*/
-#define PW_UKERNA_CHBIND 135
-#define PW_UKERNA_TR_COI 136
+#define FR_UKERNA_CHBIND 135
+#define FR_UKERNA_TR_COI 136
#endif /* _FR_RADIUS_H */
/*
* For radmin over TCP.
*/
-#define PW_RADMIN_PORT 18120
+#define FR_RADMIN_PORT 18120
#ifdef __cplusplus
}
#endif
typedef struct rs_counters {
- uint64_t type[PW_CODE_MAX];
+ uint64_t type[FR_CODE_MAX];
} rs_counters_t;
/** Stats for a single interval
typedef struct rs_stats {
int intervals; //!< Number of stats intervals.
- rs_latency_t exchange[PW_CODE_MAX]; //!< We end up allocating ~16K, but memory is cheap so
+ rs_latency_t exchange[FR_CODE_MAX]; //!< We end up allocating ~16K, but memory is cheap so
//!< what the hell. This is required because instances of
//!< FreeRADIUS delay Access-Rejects, which would artificially
//!< increase latency stats for Access-Requests.
VALUE_PAIR *filter_request_vps; //!< Sorted filter vps.
VALUE_PAIR *filter_response_vps; //!< Sorted filter vps.
- PW_CODE filter_request_code; //!< Filter request packets by code.
- PW_CODE filter_response_code; //!< Filter response packets by code.
+ FR_CODE filter_request_code; //!< Filter request packets by code.
+ FR_CODE filter_response_code; //!< Filter response packets by code.
rs_status_t event_flags; //!< Events we log and capture on.
rs_packet_logger_t logger; //!< Packet logger
* collectd.c - Registration and processing functions
*/
rs_stats_tmpl_t *rs_stats_collectd_init_latency(TALLOC_CTX *ctx, rs_stats_tmpl_t **out, rs_t *conf,
- char const *type, rs_latency_t *stats, PW_CODE code);
+ char const *type, rs_latency_t *stats, FR_CODE code);
void rs_stats_collectd_do_stats(rs_t *conf, rs_stats_tmpl_t *tmpls, struct timeval *now);
int rs_stats_collectd_open(rs_t *conf);
int rs_stats_collectd_close(rs_t *conf);
value.strvalue = talloc_strdup(NULL, "my new username");
value.length = talloc_array_length(value.strvalue) - 1;
- if (fr_pair_update_by_num(ctx, head, PW_USERNAME, 0, TAG_ANY, FR_TYPE_STRING, &value) < 0) return -1; // error
+ if (fr_pair_update_by_num(ctx, head, FR_USERNAME, 0, TAG_ANY, FR_TYPE_STRING, &value) < 0) return -1; // error
@endcode
*
* @param _ctx new #VALUE_PAIR s should be allocated in for the specified list.
vp;
vp = fr_pair_cursor_next(&cursor)) {
if (vp->da->vendor == 0) switch (vp->da->attr) {
- case PW_NAS_IP_ADDRESS:
- case PW_NAS_IPV6_ADDRESS:
+ case FR_NAS_IP_ADDRESS:
+ case FR_NAS_IPV6_ADDRESS:
fr_pair_value_snprint(ipaddress, sizeof(ipaddress), vp, '\0');
break;
- case PW_USER_NAME:
+ case FR_USER_NAME:
memcpy(&username, &vp->vp_strvalue, sizeof(username));
break;
- case PW_ACCT_SESSION_ID:
+ case FR_ACCT_SESSION_ID:
memcpy(&acctsessionid, &vp->vp_strvalue, sizeof(acctsessionid));
break;
- case PW_ACCT_MULTI_SESSION_ID:
+ case FR_ACCT_MULTI_SESSION_ID:
memcpy(&acctmultisessionid, &vp->vp_strvalue, sizeof(acctmultisessionid));
break;
}
break;
case FR_TYPE_EVS:
- if (attr != PW_VENDOR_SPECIFIC) {
+ if (attr != FR_VENDOR_SPECIFIC) {
fr_strerror_printf("Attributes of type 'evs' MUST have attribute code 26, got %i", attr);
goto error;
}
* the RFC dictionaries we need to add it in the case
* it doesn't.
*/
- vsa_da = fr_dict_attr_child_by_num(ctx->parent, PW_VENDOR_SPECIFIC);
+ vsa_da = fr_dict_attr_child_by_num(ctx->parent, FR_VENDOR_SPECIFIC);
if (!vsa_da) {
memset(&flags, 0, sizeof(flags));
memcpy(&mutable, &ctx->parent, sizeof(mutable));
new = fr_dict_attr_alloc(mutable, fr_dict_root(ctx->dict), "Vendor-Specific", 0,
- PW_VENDOR_SPECIFIC, FR_TYPE_VSA, &flags);
+ FR_VENDOR_SPECIFIC, FR_TYPE_VSA, &flags);
fr_dict_attr_child_add(mutable, new);
vsa_da = new;
}
type_name = talloc_asprintf(dict->pool, "Tmp-Cast-%s", p->name);
n = fr_dict_attr_alloc(dict->pool, dict->root, type_name,
- 0, PW_CAST_BASE + p->number, p->number, &flags);
+ 0, FR_CAST_BASE + p->number, p->number, &flags);
if (!n) goto error;
if (!fr_hash_table_insert(dict->attributes_by_name, n)) goto error;
* The additional code is because we need at least three components
* the VSA attribute (26), the vendor ID, and actual attribute.
*/
- if (((*parent)->flags.is_root) && !*vendor && (num == PW_VENDOR_SPECIFIC)) {
+ if (((*parent)->flags.is_root) && !*vendor && (num == FR_VENDOR_SPECIFIC)) {
fr_dict_vendor_t const *dv;
if (p[0] == '\0') {
if (vendor == 0) return fr_dict_attr_child_by_num(dict->root, attr);
- parent = fr_dict_attr_child_by_num(dict->root, PW_VENDOR_SPECIFIC);
+ parent = fr_dict_attr_child_by_num(dict->root, FR_VENDOR_SPECIFIC);
if (!parent) return NULL;
parent = fr_dict_attr_child_by_num(parent, vendor);
}
/*
- * vendor=0, attr = PW_VENDOR_SPECIFIC means
+ * vendor=0, attr = FR_VENDOR_SPECIFIC means
* "match any vendor attribute".
*/
- if ((vendor == 0) && (attr == PW_VENDOR_SPECIFIC)) {
+ if ((vendor == 0) && (attr == FR_VENDOR_SPECIFIC)) {
/*
* It's a VSA: copy it over.
*/
/*
* We never move Fall-Through.
*/
- if (!i->da->vendor && i->da->attr == PW_FALL_THROUGH && i->da->parent->flags.is_root) {
+ if (!i->da->vendor && i->da->attr == FR_FALL_THROUGH && i->da->parent->flags.is_root) {
tail_from = &(i->next);
continue;
}
* @param[in] ctx for talloc
* @param[in,out] to destination list.
* @param[in,out] from source list.
- * @param[in] attr to match. If attribute PW_VENDOR_SPECIFIC and vendor 0,
+ * @param[in] attr to match. If attribute FR_VENDOR_SPECIFIC and vendor 0,
* will match (and therefore copy) only VSAs.
* If attribute 0 and vendor 0 will match (and therefore copy) all
* attributes.
}
/*
- * vendor=0, attr = PW_VENDOR_SPECIFIC means
+ * vendor=0, attr = FR_VENDOR_SPECIFIC means
* "match any vendor attribute".
*/
- if ((vendor == 0) && (attr == PW_VENDOR_SPECIFIC)) {
+ if ((vendor == 0) && (attr == FR_VENDOR_SPECIFIC)) {
/*
* It's a VSA: move it over.
*/
* @param[in] ctx for talloc
* @param[in,out] to destination list.
* @param[in,out] from source list.
- * @param[in] attr to match. If attribute PW_VENDOR_SPECIFIC and vendor 0,
+ * @param[in] attr to match. If attribute FR_VENDOR_SPECIFIC and vendor 0,
* will match (and therefore copy) only VSAs.
* If attribute 0 and vendor 0 will match (and therefore copy) all
* attributes.
* @param[in] ctx for talloc
* @param[in,out] to destination list.
* @param[in,out] from source list.
- * @param[in] attr to match. If attribute PW_VENDOR_SPECIFIC and vendor 0,
+ * @param[in] attr to match. If attribute FR_VENDOR_SPECIFIC and vendor 0,
* will match (and therefore copy) only VSAs.
* If attribute 0 and vendor 0 will match (and therefore copy) all
* attributes.
{
fr_pair_cursor_end(cursor);
- fr_pair_cursor_append(cursor, fr_pair_alloc_by_num(NULL, 0, PW_MESSAGE_AUTHENTICATOR));
+ fr_pair_cursor_append(cursor, fr_pair_alloc_by_num(NULL, 0, FR_MESSAGE_AUTHENTICATOR));
if (bad_thing) {
fr_pair_cursor_free(cursor);
* Do the data storage before proxying. This is to ensure
* that we log the packet, even if the proxy never does.
*/
- vp = fr_pair_find_by_num(request->control, 0, PW_ACCT_TYPE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_ACCT_TYPE, TAG_ANY);
if (vp) DEBUG2(" Found Acct-Type %s", fr_dict_enum_alias_by_value(NULL, vp->da, &vp->data));
rcode = process_accounting(acct_type, request);
* Maybe one of the preacct modules has decided
* that a proxy should be used.
*/
- if ((vp = fr_pair_find_by_num(request->control, 0, PW_PROXY_TO_REALM, TAG_ANY))) {
+ if ((vp = fr_pair_find_by_num(request->control, 0, FR_PROXY_TO_REALM, TAG_ANY))) {
REALM *realm;
/*
realm = realm_find2(vp->vp_strvalue);
if (realm && !realm->acct_pool) {
DEBUG("rad_accounting: Cancelling proxy to realm %s, as it is a LOCAL realm.", realm->name);
- fr_pair_delete_by_num(&request->control, 0, PW_PROXY_TO_REALM, TAG_ANY);
+ fr_pair_delete_by_num(&request->control, 0, FR_PROXY_TO_REALM, TAG_ANY);
} else {
/*
* Don't reply to the NAS now because
*/
case RLM_MODULE_OK:
case RLM_MODULE_UPDATED:
- request->reply->code = PW_CODE_ACCOUNTING_RESPONSE;
+ request->reply->code = FR_CODE_ACCOUNTING_RESPONSE;
break;
/*
uint32_t port = 0; /* RFC 2865 NAS-Port is 4 bytes */
char const *tls = "";
- if ((cli = fr_pair_find_by_num(request->packet->vps, 0, PW_CALLING_STATION_ID, TAG_ANY)) == NULL) {
+ if ((cli = fr_pair_find_by_num(request->packet->vps, 0, FR_CALLING_STATION_ID, TAG_ANY)) == NULL) {
do_cli = false;
}
- if ((pair = fr_pair_find_by_num(request->packet->vps, 0, PW_NAS_PORT, TAG_ANY)) != NULL) {
+ if ((pair = fr_pair_find_by_num(request->packet->vps, 0, FR_NAS_PORT, TAG_ANY)) != NULL) {
port = pair->vp_uint32;
}
if (request->packet->dst_port == 0) {
- if (fr_pair_find_by_num(request->packet->vps, 0, PW_FREERADIUS_PROXIED_TO, TAG_ANY)) {
+ if (fr_pair_find_by_num(request->packet->vps, 0, FR_FREERADIUS_PROXIED_TO, TAG_ANY)) {
tls = " via TLS tunnel";
} else {
tls = " via proxy to virtual server";
* Get the correct username based on the configured value
*/
if (!log_stripped_names) {
- username = fr_pair_find_by_num(request->packet->vps, 0, PW_USER_NAME, TAG_ANY);
+ username = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY);
} else {
username = request->username;
}
if (!request->password) {
VALUE_PAIR *auth_type;
- auth_type = fr_pair_find_by_num(request->control, 0, PW_AUTH_TYPE, TAG_ANY);
+ auth_type = fr_pair_find_by_num(request->control, 0, FR_AUTH_TYPE, TAG_ANY);
if (auth_type) {
snprintf(clean_password, sizeof(clean_password),
"<via Auth-Type = %s>",
} else {
strcpy(clean_password, "<no User-Password attribute>");
}
- } else if (fr_pair_find_by_num(request->packet->vps, 0, PW_CHAP_PASSWORD, TAG_ANY)) {
+ } else if (fr_pair_find_by_num(request->packet->vps, 0, FR_CHAP_PASSWORD, TAG_ANY)) {
strcpy(clean_password, "<CHAP-Password>");
} else {
fr_snprint(clean_password, sizeof(clean_password),
/*
* Look for matching check items. We skip the whole lot
- * if the authentication type is PW_AUTH_TYPE_ACCEPT or
- * PW_AUTH_TYPE_REJECT.
+ * if the authentication type is FR_AUTH_TYPE_ACCEPT or
+ * FR_AUTH_TYPE_REJECT.
*/
fr_pair_cursor_init(&cursor, &request->control);
- while ((auth_type_pair = fr_pair_cursor_next_by_num(&cursor, 0, PW_AUTH_TYPE, TAG_ANY))) {
+ while ((auth_type_pair = fr_pair_cursor_next_by_num(&cursor, 0, FR_AUTH_TYPE, TAG_ANY))) {
auth_type = auth_type_pair->vp_uint32;
auth_type_count++;
RDEBUG2("Using 'Auth-Type = %s' for authenticate {...}",
fr_dict_enum_alias_by_value(NULL, auth_type_pair->da, fr_box_uint32(auth_type)));
- if (auth_type == PW_AUTH_TYPE_REJECT) {
+ if (auth_type == FR_AUTH_TYPE_REJECT) {
RDEBUG2("Auth-Type = Reject, rejecting user");
return -2;
* rejected in the above loop. So that means it is accepted and we
* do no further authentication.
*/
- if ((auth_type == PW_AUTH_TYPE_ACCEPT)
+ if ((auth_type == FR_AUTH_TYPE_ACCEPT)
#ifdef WITH_PROXY
|| (request->proxy)
#endif
* been set, and complain if so.
*/
if (auth_type < 0) {
- if (fr_pair_find_by_num(request->control, 0, PW_CRYPT_PASSWORD, TAG_ANY) != NULL) {
+ if (fr_pair_find_by_num(request->control, 0, FR_CRYPT_PASSWORD, TAG_ANY) != NULL) {
RWDEBUG2("Please update your configuration, and remove 'Auth-Type = Crypt'");
RWDEBUG2("Use the PAP module instead");
}
- else if (fr_pair_find_by_num(request->control, 0, PW_CLEARTEXT_PASSWORD, TAG_ANY) != NULL) {
+ else if (fr_pair_find_by_num(request->control, 0, FR_CLEARTEXT_PASSWORD, TAG_ANY) != NULL) {
RWDEBUG2("Please update your configuration, and remove 'Auth-Type = Local'");
RWDEBUG2("Use the PAP or CHAP modules instead");
}
/*
* Do post-authentication calls. ignoring the return code.
*/
- vp = fr_pair_find_by_num(request->control, 0, PW_POST_AUTH_TYPE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_POST_AUTH_TYPE, TAG_ANY);
if (vp) {
postauth_type = vp->vp_uint32;
RDEBUG2("Using Post-Auth-Type %s",
case RLM_MODULE_REJECT:
case RLM_MODULE_USERLOCK:
default:
- request->reply->code = PW_CODE_ACCESS_REJECT;
+ request->reply->code = FR_CODE_ACCESS_REJECT;
fr_state_discard(global_state, request, request->packet);
rcode = RLM_MODULE_REJECT;
break;
case RLM_MODULE_UPDATED:
rcode = RLM_MODULE_OK;
- if (request->reply->code == PW_CODE_ACCESS_CHALLENGE) {
+ if (request->reply->code == FR_CODE_ACCESS_CHALLENGE) {
fr_request_to_state(global_state, request, request->packet, request->reply);
} else {
* Reply of ACCEPT means accept, thus set Auth-Type
* accordingly.
*/
- case PW_CODE_ACCESS_ACCEPT:
+ case FR_CODE_ACCESS_ACCEPT:
tmp = radius_pair_create(request,
&request->control,
- PW_AUTH_TYPE, 0);
- if (tmp) tmp->vp_uint32 = PW_AUTH_TYPE_ACCEPT;
+ FR_AUTH_TYPE, 0);
+ if (tmp) tmp->vp_uint32 = FR_AUTH_TYPE_ACCEPT;
rcode = RLM_MODULE_OK;
goto authenticate;
* Challenges are punted back to the NAS without any
* further processing.
*/
- case PW_CODE_ACCESS_CHALLENGE:
- request->reply->code = PW_CODE_ACCESS_CHALLENGE;
+ case FR_CODE_ACCESS_CHALLENGE:
+ request->reply->code = FR_CODE_ACCESS_CHALLENGE;
fr_request_to_state(global_state, request, request->packet, request->reply);
return RLM_MODULE_OK;
* are being rejected, so we minimize the amount of work
* done by the server, by rejecting them here.
*/
- case PW_CODE_ACCESS_REJECT:
+ case FR_CODE_ACCESS_REJECT:
rad_authlog("Login incorrect (Home Server says so)",
request, 0);
- request->reply->code = PW_CODE_ACCESS_REJECT;
+ request->reply->code = FR_CODE_ACCESS_REJECT;
fr_state_discard(global_state, request, request->packet);
return RLM_MODULE_REJECT;
* Look for, and cache, passwords.
*/
if (!request->password) {
- request->password = fr_pair_find_by_num(request->packet->vps, 0, PW_USER_PASSWORD, TAG_ANY);
+ request->password = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_PASSWORD, TAG_ANY);
}
if (!request->password) {
- request->password = fr_pair_find_by_num(request->packet->vps, 0, PW_CHAP_PASSWORD, TAG_ANY);
+ request->password = fr_pair_find_by_num(request->packet->vps, 0, FR_CHAP_PASSWORD, TAG_ANY);
}
/*
case RLM_MODULE_REJECT:
case RLM_MODULE_USERLOCK:
default:
- if ((module_msg = fr_pair_find_by_num(request->packet->vps, 0, PW_MODULE_FAILURE_MESSAGE, TAG_ANY)) != NULL) {
+ if ((module_msg = fr_pair_find_by_num(request->packet->vps, 0, FR_MODULE_FAILURE_MESSAGE, TAG_ANY)) != NULL) {
char msg[FR_MAX_STRING_LEN + 16];
snprintf(msg, sizeof(msg), "Invalid user (%s)",
module_msg->vp_strvalue);
} else {
rad_authlog("Invalid user", request, 0);
}
- request->reply->code = PW_CODE_ACCESS_REJECT;
+ request->reply->code = FR_CODE_ACCESS_REJECT;
return rcode;
}
if (!autz_retry) {
- tmp = fr_pair_find_by_num(request->control, 0, PW_AUTZ_TYPE, TAG_ANY);
+ tmp = fr_pair_find_by_num(request->control, 0, FR_AUTZ_TYPE, TAG_ANY);
if (tmp) {
autz_type = tmp->vp_uint32;
RDEBUG2("Using Autz-Type %s",
#ifdef WITH_PROXY
(request->proxy == NULL) &&
#endif
- ((tmp = fr_pair_find_by_num(request->control, 0, PW_PROXY_TO_REALM, TAG_ANY)) != NULL)) {
+ ((tmp = fr_pair_find_by_num(request->control, 0, FR_PROXY_TO_REALM, TAG_ANY)) != NULL)) {
REALM *realm;
realm = realm_find2(tmp->vp_strvalue);
*/
if (result < 0) {
RDEBUG2("Failed to authenticate the user");
- request->reply->code = PW_CODE_ACCESS_REJECT;
+ request->reply->code = FR_CODE_ACCESS_REJECT;
- if ((module_msg = fr_pair_find_by_num(request->packet->vps, 0, PW_MODULE_FAILURE_MESSAGE, TAG_ANY)) != NULL){
+ if ((module_msg = fr_pair_find_by_num(request->packet->vps, 0, FR_MODULE_FAILURE_MESSAGE, TAG_ANY)) != NULL){
char msg[FR_MAX_STRING_LEN+19];
snprintf(msg, sizeof(msg), "Login incorrect (%s)",
if (request->password) {
VERIFY_VP(request->password);
/* double check: maybe the secret is wrong? */
- if ((rad_debug_lvl > 1) && (request->password->da->attr == PW_USER_PASSWORD)) {
+ if ((rad_debug_lvl > 1) && (request->password->da->attr == FR_USER_PASSWORD)) {
uint8_t const *p;
p = (uint8_t const *) request->password->vp_strvalue;
#ifdef WITH_SESSION_MGMT
if (result >= 0 &&
- (check_item = fr_pair_find_by_num(request->control, 0, PW_SIMULTANEOUS_USE, TAG_ANY)) != NULL) {
+ (check_item = fr_pair_find_by_num(request->control, 0, FR_SIMULTANEOUS_USE, TAG_ANY)) != NULL) {
int r, session_type = 0;
char logstr[1024];
char umsg[FR_MAX_STRING_LEN + 1];
- tmp = fr_pair_find_by_num(request->control, 0, PW_SESSION_TYPE, TAG_ANY);
+ tmp = fr_pair_find_by_num(request->control, 0, FR_SESSION_TYPE, TAG_ANY);
if (tmp) {
session_type = tmp->vp_uint32;
RDEBUG2("Using Session-Type %s",
/* Multilink attempt. Check if port-limit > simultaneous-use */
VALUE_PAIR *port_limit;
- if ((port_limit = fr_pair_find_by_num(request->reply->vps, 0, PW_PORT_LIMIT,
+ if ((port_limit = fr_pair_find_by_num(request->reply->vps, 0, FR_PORT_LIMIT,
TAG_ANY)) != NULL &&
port_limit->vp_uint32 > check_item->vp_uint32){
RDEBUG2("MPP is OK");
strlcpy(umsg, main_config.denied_msg, sizeof(umsg));
}
- request->reply->code = PW_CODE_ACCESS_REJECT;
+ request->reply->code = FR_CODE_ACCESS_REJECT;
/*
* They're trying to log in too many times.
* Set the reply to Access-Accept, if it hasn't already
* been set to something. (i.e. Access-Challenge)
*/
- if (request->reply->code == 0) request->reply->code = PW_CODE_ACCESS_ACCEPT;
+ if (request->reply->code == 0) request->reply->code = FR_CODE_ACCESS_ACCEPT;
- if ((module_msg = fr_pair_find_by_num(request->packet->vps, 0, PW_MODULE_SUCCESS_MESSAGE, TAG_ANY)) != NULL){
+ if ((module_msg = fr_pair_find_by_num(request->packet->vps, 0, FR_MODULE_SUCCESS_MESSAGE, TAG_ANY)) != NULL){
char msg[FR_MAX_STRING_LEN+12];
snprintf(msg, sizeof(msg), "Login OK (%s)",
rdebug_pair_list(L_DBG_LVL_1, request, request->packet->vps, NULL);
if (!request->username) {
- request->username = fr_pair_find_by_num(request->packet->vps, 0, PW_USER_NAME, TAG_ANY);
+ request->username = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY);
}
/*
/*
* Look at the full User-Name with realm.
*/
- if (request->parent->username->da->attr == PW_STRIPPED_USER_NAME) {
- vp = fr_pair_find_by_num(request->parent->packet->vps, 0, PW_USER_NAME, TAG_ANY);
+ if (request->parent->username->da->attr == FR_STRIPPED_USER_NAME) {
+ vp = fr_pair_find_by_num(request->parent->packet->vps, 0, FR_USER_NAME, TAG_ANY);
if (!vp) goto skip;
} else {
vp = request->parent->username;
* We currently only handle AUTH packets here.
* This could be expanded to handle other packets as well if required.
*/
- rad_assert(request->packet->code == PW_CODE_ACCESS_REQUEST);
+ rad_assert(request->packet->code == FR_CODE_ACCESS_REQUEST);
rcode = rad_authenticate(request);
- if (request->reply->code == PW_CODE_ACCESS_REJECT) {
- fr_pair_delete_by_num(&request->control, 0, PW_POST_AUTH_TYPE, TAG_ANY);
+ if (request->reply->code == FR_CODE_ACCESS_REJECT) {
+ fr_pair_delete_by_num(&request->control, 0, FR_POST_AUTH_TYPE, TAG_ANY);
vp = pair_make_config("Post-Auth-Type", "Reject", T_OP_SET);
if (vp) (void) rad_postauth(request);
}
- if (request->reply->code == PW_CODE_ACCESS_ACCEPT) {
+ if (request->reply->code == FR_CODE_ACCESS_ACCEPT) {
(void) rad_postauth(request);
}
switch (dynamic_config[i].type) {
case FR_TYPE_IPV4_ADDR:
- if (da->attr == PW_FREERADIUS_CLIENT_IP_ADDRESS) {
+ if (da->attr == FR_FREERADIUS_CLIENT_IP_ADDRESS) {
memcpy(&c->ipaddr, &vp->vp_ip, sizeof(c->ipaddr));
cp = cf_pair_alloc(c->cs, "ipv4addr", strvalue, T_OP_SET, T_BARE_WORD, T_BARE_WORD);
- } else if (da->attr == PW_FREERADIUS_CLIENT_SRC_IP_ADDRESS) {
+ } else if (da->attr == FR_FREERADIUS_CLIENT_SRC_IP_ADDRESS) {
#ifdef WITH_UDPFROMTO
RDEBUG2("src_ipaddr = %s", strvalue);
memcpy(&c->src_ipaddr, &vp->vp_ip, sizeof(c->src_ipaddr));
break;
case FR_TYPE_IPV6_ADDR:
- if (da->attr == PW_FREERADIUS_CLIENT_IPV6_ADDRESS) {
+ if (da->attr == FR_FREERADIUS_CLIENT_IPV6_ADDRESS) {
memcpy(&c->ipaddr, &vp->vp_ip, sizeof(c->ipaddr));
cp = cf_pair_alloc(c->cs, "ipv6addr", strvalue, T_OP_SET, T_BARE_WORD, T_BARE_WORD);
- } else if (da->attr == PW_FREERADIUS_CLIENT_SRC_IPV6_ADDRESS) {
+ } else if (da->attr == FR_FREERADIUS_CLIENT_SRC_IPV6_ADDRESS) {
#ifdef WITH_UDPFROMTO
memcpy(&c->src_ipaddr, &vp->vp_ip, sizeof(c->src_ipaddr));
cp = cf_pair_alloc(c->cs, "src_addr", strvalue, T_OP_SET, T_BARE_WORD, T_BARE_WORD);
break;
case FR_TYPE_IPV4_PREFIX:
- if (da->attr == PW_FREERADIUS_CLIENT_IP_PREFIX) {
+ if (da->attr == FR_FREERADIUS_CLIENT_IP_PREFIX) {
memcpy(&c->ipaddr, &vp->vp_ip, sizeof(c->ipaddr));
cp = cf_pair_alloc(c->cs, "ipv4addr", strvalue, T_OP_SET, T_BARE_WORD, T_BARE_WORD);
}
break;
case FR_TYPE_IPV6_PREFIX:
- if (da->attr == PW_FREERADIUS_CLIENT_IPV6_PREFIX) {
+ if (da->attr == FR_FREERADIUS_CLIENT_IPV6_PREFIX) {
memcpy(&c->ipaddr, &vp->vp_ip, sizeof(c->ipaddr));;
cp = cf_pair_alloc(c->cs, "ipv6addr", strvalue, T_OP_SET, T_BARE_WORD, T_BARE_WORD);
}
*
*/
rs_stats_tmpl_t *rs_stats_collectd_init_latency(TALLOC_CTX *ctx, rs_stats_tmpl_t **out, rs_t *conf,
- char const *type, rs_latency_t *stats, PW_CODE code)
+ char const *type, rs_latency_t *stats, FR_CODE code)
{
rs_stats_tmpl_t **tmpl, *last;
char *p;
packet->id = inject_id++;
if (fake->type == RAD_LISTEN_AUTH) {
- packet->code = PW_CODE_ACCESS_REQUEST;
+ packet->code = FR_CODE_ACCESS_REQUEST;
fun = rad_authenticate;
} else {
#ifdef WITH_ACCOUNTING
- packet->code = PW_CODE_ACCOUNTING_REQUEST;
+ packet->code = FR_CODE_ACCOUNTING_REQUEST;
fun = rad_accounting;
#else
cprintf_error(listener, "This server was built without accounting support.\n");
/*
* FIXME: Recurse into sub-types somehow...
*/
- if (PW_BASE_TYPE(variables[i].type) == FR_TYPE_SUBSECTION) continue;
+ if (FR_BASE_TYPE(variables[i].type) == FR_TYPE_SUBSECTION) continue;
if (strcmp(variables[i].name, argv[1]) == 0) {
rcode = i;
for (vp = fixup->packet->vps; vp != NULL; vp = vp->next) {
if (vp->da->vendor) continue;
- if ((vp->da->attr == PW_USER_NAME) && !fixup->username) {
+ if ((vp->da->attr == FR_USER_NAME) && !fixup->username) {
fixup->username = vp;
- } else if (vp->da->attr == PW_STRIPPED_USER_NAME) {
+ } else if (vp->da->attr == FR_STRIPPED_USER_NAME) {
fixup->username = vp;
- } else if (vp->da->attr == PW_USER_PASSWORD) {
+ } else if (vp->da->attr == FR_USER_PASSWORD) {
fixup->password = vp;
}
}
return -(p - start);
}
- *pda = fr_dict_attr_by_num(NULL, 0, PW_CAST_BASE + cast);
+ *pda = fr_dict_attr_by_num(NULL, 0, FR_CAST_BASE + cast);
if (!*pda) {
*error = "Cannot cast to this data type";
return -(p - start);
return_P("Empty octet string is invalid");
}
- c->cast = fr_dict_attr_by_num(NULL, 0, PW_CAST_BASE + FR_TYPE_OCTETS);
+ c->cast = fr_dict_attr_by_num(NULL, 0, FR_CAST_BASE + FR_TYPE_OCTETS);
}
while (isspace((int)*p)) p++; /* skip spaces after LHS */
(map->lhs->tmpl_da->type == FR_TYPE_UINT16) ||
(map->lhs->tmpl_da->type == FR_TYPE_UINT32) ||
(map->lhs->tmpl_da->type == FR_TYPE_UINT64))) {
- c->cast = fr_dict_attr_by_num(NULL, 0, PW_CAST_BASE + FR_TYPE_OCTETS);
+ c->cast = fr_dict_attr_by_num(NULL, 0, FR_CAST_BASE + FR_TYPE_OCTETS);
}
}
case FR_TYPE_IPV4_ADDR:
if (strchr(c->data.map->rhs->name, '/') != NULL) {
type = FR_TYPE_IPV4_PREFIX;
- c->cast = fr_dict_attr_by_num(NULL, 0, PW_CAST_BASE + type);
+ c->cast = fr_dict_attr_by_num(NULL, 0, FR_CAST_BASE + type);
}
break;
case FR_TYPE_IPV6_ADDR:
if (strchr(c->data.map->rhs->name, '/') != NULL) {
type = FR_TYPE_IPV6_PREFIX;
- c->cast = fr_dict_attr_by_num(NULL, 0, PW_CAST_BASE + type);
+ c->cast = fr_dict_attr_by_num(NULL, 0, FR_CAST_BASE + type);
}
break;
fr_dict_attr_t const *da = c->data.map->lhs->tmpl_da;
if ((da->vendor == 0) &&
- ((da->attr == PW_AUTH_TYPE) ||
- (da->attr == PW_AUTZ_TYPE) ||
- (da->attr == PW_ACCT_TYPE) ||
- (da->attr == PW_SESSION_TYPE) ||
- (da->attr == PW_POST_AUTH_TYPE) ||
- (da->attr == PW_PRE_PROXY_TYPE) ||
- (da->attr == PW_POST_PROXY_TYPE) ||
- (da->attr == PW_PRE_ACCT_TYPE) ||
- (da->attr == PW_RECV_COA_TYPE) ||
- (da->attr == PW_SEND_COA_TYPE))) {
+ ((da->attr == FR_AUTH_TYPE) ||
+ (da->attr == FR_AUTZ_TYPE) ||
+ (da->attr == FR_ACCT_TYPE) ||
+ (da->attr == FR_SESSION_TYPE) ||
+ (da->attr == FR_POST_AUTH_TYPE) ||
+ (da->attr == FR_PRE_PROXY_TYPE) ||
+ (da->attr == FR_POST_PROXY_TYPE) ||
+ (da->attr == FR_PRE_ACCT_TYPE) ||
+ (da->attr == FR_RECV_COA_TYPE) ||
+ (da->attr == FR_SEND_COA_TYPE))) {
/*
* The types for these attributes are dynamically allocated
* by modules.c, so we can't enforce strictness here.
(c->data.map->rhs->type == TMPL_TYPE_EXEC))) {
if (c->data.map->lhs->tmpl_da->type == FR_TYPE_IPV4_ADDR) {
c->cast = fr_dict_attr_by_num(NULL, 0,
- PW_CAST_BASE + FR_TYPE_IPV4_PREFIX);
+ FR_CAST_BASE + FR_TYPE_IPV4_PREFIX);
}
if (c->data.map->lhs->tmpl_da->type == FR_TYPE_IPV6_ADDR) {
c->cast = fr_dict_attr_by_num(NULL, 0,
- PW_CAST_BASE + FR_TYPE_IPV6_PREFIX);
+ FR_CAST_BASE + FR_TYPE_IPV6_PREFIX);
}
}
attribute = (type & FR_TYPE_ATTRIBUTE);
multi = (type & FR_TYPE_MULTI);
- type = PW_BASE_TYPE(type); /* normal types are small */
+ type = FR_BASE_TYPE(type); /* normal types are small */
/*
* It's a section, recurse!
if (required) cant_be_empty = true; /* May want to review this in the future... */
- type = PW_BASE_TYPE(type); /* normal types are small */
+ type = FR_BASE_TYPE(type); /* normal types are small */
/*
* Everything except templates must have a base type.
rad_assert(dflt);
- type = PW_BASE_TYPE(type);
+ type = FR_BASE_TYPE(type);
/*
* Defaults may need their values expanding
* We don't NULL terminate. Consumer must use
* talloc_array_length().
*/
- } else switch (PW_BASE_TYPE(type)) {
+ } else switch (FR_BASE_TYPE(type)) {
case FR_TYPE_BOOL:
array = (void **)talloc_zero_array(ctx, bool, count);
break;
int i;
for (i = 0; variables[i].name != NULL; i++) {
- if ((PW_BASE_TYPE(variables[i].type) == FR_TYPE_SUBSECTION)) {
+ if ((FR_BASE_TYPE(variables[i].type) == FR_TYPE_SUBSECTION)) {
CONF_SECTION *subcs;
if (!variables[i].dflt) continue;
continue;
}
- if ((PW_BASE_TYPE(variables[i].type) != FR_TYPE_STRING) &&
+ if ((FR_BASE_TYPE(variables[i].type) != FR_TYPE_STRING) &&
(variables[i].type != FR_TYPE_FILE_INPUT) &&
(variables[i].type != FR_TYPE_FILE_OUTPUT)) {
continue;
/*
* Handle subsections specially
*/
- if (PW_BASE_TYPE(variables[i].type) == FR_TYPE_SUBSECTION) {
+ if (FR_BASE_TYPE(variables[i].type) == FR_TYPE_SUBSECTION) {
if (cf_subsection_parse(ctx, (uint8_t *)base + variables[i].offset, cs,
variables[i].name, variables[i].type,
variables[i].subcs, variables[i].subcs_size) < 0) goto finish;
fr_pair_cursor_init(&cursor, radius_list(request, PAIR_LIST_CONTROL));
while ((envlen < ((sizeof(envp) / sizeof(*envp)) - 1)) &&
- (vp = fr_pair_cursor_next_by_num(&cursor, 0, PW_EXEC_EXPORT, TAG_ANY))) {
+ (vp = fr_pair_cursor_next_by_num(&cursor, 0, FR_EXEC_EXPORT, TAG_ANY))) {
DEBUG3("export %s", vp->vp_strvalue);
memcpy(&envp[envlen++], &vp->vp_strvalue, sizeof(*envp));
}
if (!ef->trigger_prefix) return;
- da = fr_dict_attr_by_num(fr_dict_internal, 0, PW_EXFILE_NAME);
+ da = fr_dict_attr_by_num(fr_dict_internal, 0, FR_EXFILE_NAME);
if (!da) {
ROPTIONAL(RERROR, ERROR, "Incomplete internal dictionary: Missing definition for \"Exfile-Name\"");
return;
/*
* We need numbers for internal use.
*/
- dv = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, PW_LISTEN_SOCKET_TYPE), type);
+ dv = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, FR_LISTEN_SOCKET_TYPE), type);
if (!dv) {
fr_dict_attr_t const *da;
/*
* The type MUST now be defined in the dictionaries.
*/
- dv = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, PW_LISTEN_SOCKET_TYPE), type);
+ dv = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, FR_LISTEN_SOCKET_TYPE), type);
if (!dv) {
cf_log_err_cs(cs, "Failed finding dictionary entry for protocol %s", type);
talloc_const_free(module);
case RAD_LISTEN_NONE:
#endif
case RAD_LISTEN_AUTH:
- dval = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, PW_AUTZ_TYPE), "Status-Server");
+ dval = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, FR_AUTZ_TYPE), "Status-Server");
if (dval) {
rcode = process_authorize(fr_unbox_uint32(dval->value), request);
} else {
switch (rcode) {
case RLM_MODULE_OK:
case RLM_MODULE_UPDATED:
- request->reply->code = PW_CODE_ACCESS_ACCEPT;
+ request->reply->code = FR_CODE_ACCESS_ACCEPT;
break;
case RLM_MODULE_FAIL:
default:
case RLM_MODULE_REJECT:
- request->reply->code = PW_CODE_ACCESS_REJECT;
+ request->reply->code = FR_CODE_ACCESS_REJECT;
break;
}
break;
#ifdef WITH_ACCOUNTING
case RAD_LISTEN_ACCT:
- dval = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, PW_ACCT_TYPE), "Status-Server");
+ dval = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, FR_ACCT_TYPE), "Status-Server");
if (dval) {
rcode = process_accounting(fr_unbox_uint32(dval->value), request);
} else {
switch (rcode) {
case RLM_MODULE_OK:
case RLM_MODULE_UPDATED:
- request->reply->code = PW_CODE_ACCOUNTING_RESPONSE;
+ request->reply->code = FR_CODE_ACCOUNTING_RESPONSE;
break;
default:
* the WG. We like it, so it goes in here.
*/
case RAD_LISTEN_COA:
- dval = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, PW_RECV_COA_TYPE), "Status-Server");
+ dval = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, FR_RECV_COA_TYPE), "Status-Server");
if (dval) {
rcode = process_recv_coa(fr_unbox_uint32(dval->value), request);
} else {
switch (rcode) {
case RLM_MODULE_OK:
case RLM_MODULE_UPDATED:
- request->reply->code = PW_CODE_COA_ACK;
+ request->reply->code = FR_CODE_COA_ACK;
break;
default:
* Some sanity checks, based on the packet code.
*/
switch (packet->code) {
- case PW_CODE_ACCESS_REQUEST:
+ case FR_CODE_ACCESS_REQUEST:
if (listener->type != RAD_LISTEN_AUTH) goto bad_packet;
FR_STATS_INC(auth, total_requests);
fun = rad_authenticate;
break;
# ifdef WITH_ACCOUNTING
- case PW_CODE_ACCOUNTING_REQUEST:
+ case FR_CODE_ACCOUNTING_REQUEST:
if (listener->type != RAD_LISTEN_ACCT) goto bad_packet;
FR_STATS_INC(acct, total_requests);
fun = rad_accounting;
break;
# endif
- case PW_CODE_STATUS_SERVER:
+ case FR_CODE_STATUS_SERVER:
if (!main_config.status_server) {
FR_STATS_INC(auth, total_unknown_types);
WARN("Ignoring Status-Server request due to security configuration");
/*
* If unset, set to default.
*/
- if (!sock->my_port) sock->my_port = PW_RADIUS_TLS_PORT;
+ if (!sock->my_port) sock->my_port = FR_RADIUS_TLS_PORT;
this->tls = tls_conf_parse_server(tls);
if (!this->tls) {
/*
* We only understand Status-Server on this socket.
*/
- if (code != PW_CODE_STATUS_SERVER) {
+ if (code != FR_CODE_STATUS_SERVER) {
DEBUG("Ignoring packet code %d sent to Status-Server port",
code);
udp_recv_discard(listener->fd);
* Some sanity checks, based on the packet code.
*/
switch (code) {
- case PW_CODE_ACCESS_REQUEST:
+ case FR_CODE_ACCESS_REQUEST:
fun = rad_authenticate;
break;
- case PW_CODE_STATUS_SERVER:
+ case FR_CODE_STATUS_SERVER:
if (!main_config.status_server) {
udp_recv_discard(listener->fd);
FR_STATS_INC(auth, total_unknown_types);
* Some sanity checks, based on the packet code.
*/
switch (code) {
- case PW_CODE_ACCOUNTING_REQUEST:
+ case FR_CODE_ACCOUNTING_REQUEST:
fun = rad_accounting;
break;
- case PW_CODE_STATUS_SERVER:
+ case FR_CODE_STATUS_SERVER:
if (!main_config.status_server) {
udp_recv_discard(listener->fd);
FR_STATS_INC(acct, total_unknown_types);
return 0;
}
- vp = fr_pair_find_by_num(request->control, 0, PW_HOME_SERVER_POOL, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_HOME_SERVER_POOL, TAG_ANY);
if (vp) {
if (!home_pool_byname(vp->vp_strvalue, HOME_TYPE_COA)) {
/*
* We have a destination IP address. It will (later) proxied.
*/
- vp = fr_pair_find_by_num(request->control, 0, PW_PACKET_DST_IP_ADDRESS, TAG_ANY);
- if (!vp) vp = fr_pair_find_by_num(request->control, 0, PW_PACKET_DST_IPV6_ADDRESS, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_PACKET_DST_IP_ADDRESS, TAG_ANY);
+ if (!vp) vp = fr_pair_find_by_num(request->control, 0, FR_PACKET_DST_IPV6_ADDRESS, TAG_ANY);
if (!vp) return 0;
* Get the correct response
*/
switch (request->packet->code) {
- case PW_CODE_COA_REQUEST:
- ack = PW_CODE_COA_ACK;
- nak = PW_CODE_COA_NAK;
+ case FR_CODE_COA_REQUEST:
+ ack = FR_CODE_COA_ACK;
+ nak = FR_CODE_COA_NAK;
break;
- case PW_CODE_DISCONNECT_REQUEST:
- ack = PW_CODE_DISCONNECT_ACK;
- nak = PW_CODE_DISCONNECT_NAK;
+ case FR_CODE_DISCONNECT_REQUEST:
+ ack = FR_CODE_DISCONNECT_ACK;
+ nak = FR_CODE_DISCONNECT_NAK;
break;
default: /* shouldn't happen */
* with Service-Type = Authorize-Only, it MUST
* have a State attribute in it.
*/
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_SERVICE_TYPE, TAG_ANY);
- if (request->packet->code == PW_CODE_COA_REQUEST) {
- if (vp && (vp->vp_uint32 == PW_AUTHORIZE_ONLY)) {
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_STATE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_SERVICE_TYPE, TAG_ANY);
+ if (request->packet->code == FR_CODE_COA_REQUEST) {
+ if (vp && (vp->vp_uint32 == FR_AUTHORIZE_ONLY)) {
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_STATE, TAG_ANY);
if (!vp || (vp->vp_length == 0)) {
REDEBUG("CoA-Request with Service-Type = Authorize-Only MUST "
"contain a State attribute");
- request->reply->code = PW_CODE_COA_NAK;
+ request->reply->code = FR_CODE_COA_NAK;
return RLM_MODULE_FAIL;
}
}
* RFC 5176, Section 3.2.
*/
REDEBUG("Disconnect-Request MUST NOT contain a Service-Type attribute");
- request->reply->code = PW_CODE_DISCONNECT_NAK;
+ request->reply->code = FR_CODE_DISCONNECT_NAK;
return RLM_MODULE_FAIL;
}
* Copy State from the request to the reply.
* See RFC 5176 Section 3.3.
*/
- vp = fr_pair_list_copy_by_num(request->reply, request->packet->vps, 0, PW_STATE, TAG_ANY);
+ vp = fr_pair_list_copy_by_num(request->reply, request->packet->vps, 0, FR_STATE, TAG_ANY);
if (vp) fr_pair_add(&request->reply->vps, vp);
/*
* Some sanity checks, based on the packet code.
*/
switch (code) {
- case PW_CODE_COA_REQUEST:
+ case FR_CODE_COA_REQUEST:
FR_STATS_INC(coa, total_requests);
fun = rad_coa_recv;
break;
- case PW_CODE_DISCONNECT_REQUEST:
+ case FR_CODE_DISCONNECT_REQUEST:
FR_STATS_INC(dsc, total_requests);
fun = rad_coa_recv;
break;
}
switch (packet->code) {
- case PW_CODE_ACCESS_ACCEPT:
- case PW_CODE_ACCESS_CHALLENGE:
- case PW_CODE_ACCESS_REJECT:
+ case FR_CODE_ACCESS_ACCEPT:
+ case FR_CODE_ACCESS_CHALLENGE:
+ case FR_CODE_ACCESS_REJECT:
break;
# ifdef WITH_ACCOUNTING
- case PW_CODE_ACCOUNTING_RESPONSE:
+ case FR_CODE_ACCOUNTING_RESPONSE:
break;
# endif
# ifdef WITH_COA
- case PW_CODE_DISCONNECT_ACK:
- case PW_CODE_DISCONNECT_NAK:
- case PW_CODE_COA_ACK:
- case PW_CODE_COA_NAK:
+ case FR_CODE_DISCONNECT_ACK:
+ case FR_CODE_DISCONNECT_NAK:
+ case FR_CODE_COA_ACK:
+ case FR_CODE_COA_NAK:
break;
# endif
* FIXME: Client MIB updates?
*/
switch (packet->code) {
- case PW_CODE_ACCESS_ACCEPT:
- case PW_CODE_ACCESS_CHALLENGE:
- case PW_CODE_ACCESS_REJECT:
+ case FR_CODE_ACCESS_ACCEPT:
+ case FR_CODE_ACCESS_CHALLENGE:
+ case FR_CODE_ACCESS_REJECT:
break;
# ifdef WITH_ACCOUNTING
- case PW_CODE_ACCOUNTING_RESPONSE:
+ case FR_CODE_ACCOUNTING_RESPONSE:
break;
# endif
#ifdef WITH_COMMAND_SOCKET
case RAD_LISTEN_COMMAND:
- sock->my_port = PW_RADMIN_PORT;
+ sock->my_port = FR_RADMIN_PORT;
break;
#endif
goto finish;
}
context->coa->proxy->packet->code = (map->lhs->tmpl_list == PAIR_LIST_COA) ?
- PW_CODE_COA_REQUEST :
- PW_CODE_DISCONNECT_REQUEST;
+ FR_CODE_COA_REQUEST :
+ FR_CODE_DISCONNECT_REQUEST;
}
list = radius_list(context, map->lhs->tmpl_list);
if (vp->da->flags.has_tag) continue;
if (vp->vp_type != FR_TYPE_STRING) continue;
- if (!context->username && (vp->da->attr == PW_USER_NAME)) {
+ if (!context->username && (vp->da->attr == FR_USER_NAME)) {
context->username = vp;
continue;
}
- if (vp->da->attr == PW_STRIPPED_USER_NAME) {
+ if (vp->da->attr == FR_STRIPPED_USER_NAME) {
context->username = vp;
continue;
}
- if (vp->da->attr == PW_USER_PASSWORD) {
+ if (vp->da->attr == FR_USER_PASSWORD) {
context->password = vp;
continue;
}
* Ordered by component
*/
const section_type_value_t section_type_value[MOD_COUNT] = {
- { "authenticate", "Auth-Type", PW_AUTH_TYPE },
- { "authorize", "Autz-Type", PW_AUTZ_TYPE },
- { "preacct", "Pre-Acct-Type", PW_PRE_ACCT_TYPE },
- { "accounting", "Acct-Type", PW_ACCT_TYPE },
- { "session", "Session-Type", PW_SESSION_TYPE },
- { "pre-proxy", "Pre-Proxy-Type", PW_PRE_PROXY_TYPE },
- { "post-proxy", "Post-Proxy-Type", PW_POST_PROXY_TYPE },
- { "post-auth", "Post-Auth-Type", PW_POST_AUTH_TYPE }
+ { "authenticate", "Auth-Type", FR_AUTH_TYPE },
+ { "authorize", "Autz-Type", FR_AUTZ_TYPE },
+ { "preacct", "Pre-Acct-Type", FR_PRE_ACCT_TYPE },
+ { "accounting", "Acct-Type", FR_ACCT_TYPE },
+ { "session", "Session-Type", FR_SESSION_TYPE },
+ { "pre-proxy", "Pre-Proxy-Type", FR_PRE_PROXY_TYPE },
+ { "post-proxy", "Post-Proxy-Type", FR_POST_PROXY_TYPE },
+ { "post-auth", "Post-Auth-Type", FR_POST_AUTH_TYPE }
#ifdef WITH_COA
,
- { "recv-coa", "Recv-CoA-Type", PW_RECV_COA_TYPE },
- { "send-coa", "Send-CoA-Type", PW_SEND_COA_TYPE }
+ { "recv-coa", "Recv-CoA-Type", FR_RECV_COA_TYPE },
+ { "send-coa", "Send-CoA-Type", FR_SEND_COA_TYPE }
#endif
};
* Attributes we skip during comparison.
* These are "server" check items.
*/
- case PW_CRYPT_PASSWORD:
- case PW_AUTH_TYPE:
- case PW_AUTZ_TYPE:
- case PW_ACCT_TYPE:
- case PW_SESSION_TYPE:
- case PW_STRIP_USER_NAME:
+ case FR_CRYPT_PASSWORD:
+ case FR_AUTH_TYPE:
+ case FR_AUTZ_TYPE:
+ case FR_ACCT_TYPE:
+ case FR_SESSION_TYPE:
+ case FR_STRIP_USER_NAME:
continue;
/*
*
* This hack makes CHAP-Password work..
*/
- case PW_USER_PASSWORD:
+ case FR_USER_PASSWORD:
if (check_item->op == T_OP_CMP_EQ) {
WARN("Found User-Password == \"...\"");
WARN("Are you sure you don't mean Cleartext-Password?");
WARN("See \"man rlm_pap\" for more information");
}
- if (fr_pair_find_by_num(req_list, 0, PW_USER_PASSWORD, TAG_ANY) == NULL) {
+ if (fr_pair_find_by_num(req_list, 0, FR_USER_PASSWORD, TAG_ANY) == NULL) {
continue;
}
break;
* Only Access-Requests get cleanup_delay. Everything
* else gets cleaned up immediately.
*/
- if (request->packet->code != PW_CODE_ACCESS_REQUEST) goto done;
+ if (request->packet->code != FR_CODE_ACCESS_REQUEST) goto done;
if (!request->root->cleanup_delay) goto done;
* process it.
*/
if (request->packet->dst_port == 0) {
- request->username = fr_pair_find_by_num(request->packet->vps, 0, PW_USER_NAME, TAG_ANY);
- request->password = fr_pair_find_by_num(request->packet->vps, 0, PW_USER_PASSWORD, TAG_ANY);
+ request->username = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY);
+ request->password = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_PASSWORD, TAG_ANY);
return 1;
}
}
if (!request->username) {
- request->username = fr_pair_find_by_num(request->packet->vps, 0, PW_USER_NAME, TAG_ANY);
+ request->username = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY);
}
return 1;
/*
* Override the response code if a control:Response-Packet-Type attribute is present.
*/
- vp = fr_pair_find_by_num(request->control, 0, PW_RESPONSE_PACKET_TYPE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_RESPONSE_PACKET_TYPE, TAG_ANY);
if (vp) {
if (vp->vp_uint32 == 256) {
RDEBUG2("Not responding to request");
/*
* Catch Auth-Type := Reject BEFORE proxying the packet.
*/
- else if (request->packet->code == PW_CODE_ACCESS_REQUEST) {
+ else if (request->packet->code == FR_CODE_ACCESS_REQUEST) {
if (request->reply->code == 0) {
- vp = fr_pair_find_by_num(request->control, 0, PW_AUTH_TYPE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_AUTH_TYPE, TAG_ANY);
if (!vp || (vp->vp_uint32 != 5)) {
RDEBUG2("There was no response configured: "
"rejecting request");
}
- request->reply->code = PW_CODE_ACCESS_REJECT;
+ request->reply->code = FR_CODE_ACCESS_REJECT;
}
}
/*
* Copy Proxy-State from the request to the reply.
*/
- vp = fr_pair_list_copy_by_num(request->reply, request->packet->vps, 0, PW_PROXY_STATE, TAG_ANY);
+ vp = fr_pair_list_copy_by_num(request->reply, request->packet->vps, 0, FR_PROXY_STATE, TAG_ANY);
if (vp) fr_pair_add(&request->reply->vps, vp);
switch (request->reply->code) {
- case PW_CODE_ACCESS_ACCEPT:
+ case FR_CODE_ACCESS_ACCEPT:
rad_postauth(request);
break;
- case PW_CODE_ACCESS_CHALLENGE:
- fr_pair_delete_by_num(&request->control, 0, PW_POST_AUTH_TYPE, TAG_ANY);
+ case FR_CODE_ACCESS_CHALLENGE:
+ fr_pair_delete_by_num(&request->control, 0, FR_POST_AUTH_TYPE, TAG_ANY);
vp = pair_make_config("Post-Auth-Type", "Challenge", T_OP_SET);
if (vp) rad_postauth(request);
break;
* We do this separately so ACK and challenge can change the code
* to reject if a module returns reject.
*/
- if (request->reply->code == PW_CODE_ACCESS_REJECT) {
- fr_pair_delete_by_num(&request->control, 0, PW_POST_AUTH_TYPE, TAG_ANY);
+ if (request->reply->code == FR_CODE_ACCESS_REJECT) {
+ fr_pair_delete_by_num(&request->control, 0, FR_POST_AUTH_TYPE, TAG_ANY);
vp = pair_make_config("Post-Auth-Type", "Reject", T_OP_SET);
if (vp) rad_postauth(request);
}
/*
* See if we need to delay an Access-Reject packet.
*/
- if ((request->reply->code == PW_CODE_ACCESS_REJECT) &&
+ if ((request->reply->code == FR_CODE_ACCESS_REJECT) &&
(request->root->reject_delay.tv_sec > 0)) {
request->response_delay = request->root->reject_delay;
- vp = fr_pair_find_by_num(request->reply->vps, 0, PW_FREERADIUS_RESPONSE_DELAY, TAG_ANY);
+ vp = fr_pair_find_by_num(request->reply->vps, 0, FR_FREERADIUS_RESPONSE_DELAY, TAG_ANY);
if (vp) {
if (vp->vp_uint32 <= 10) {
request->response_delay.tv_sec = vp->vp_uint32;
}
request->response_delay.tv_usec = 0;
} else {
- vp = fr_pair_find_by_num(request->reply->vps, 0, PW_FREERADIUS_RESPONSE_DELAY_USEC, TAG_ANY);
+ vp = fr_pair_find_by_num(request->reply->vps, 0, FR_FREERADIUS_RESPONSE_DELAY_USEC, TAG_ANY);
if (vp) {
if (vp->vp_uint32 <= 10 * USEC) {
request->response_delay.tv_sec = vp->vp_uint32 / USEC;
#ifdef WITH_STATS
switch (packet->code) {
- case PW_CODE_ACCESS_REQUEST:
+ case FR_CODE_ACCESS_REQUEST:
FR_STATS_INC(auth, total_dup_requests);
break;
#ifdef WITH_ACCOUNTING
- case PW_CODE_ACCOUNTING_REQUEST:
+ case FR_CODE_ACCOUNTING_REQUEST:
FR_STATS_INC(acct, total_dup_requests);
break;
#endif
#ifdef WITH_COA
- case PW_CODE_COA_REQUEST:
+ case FR_CODE_COA_REQUEST:
FR_STATS_INC(coa, total_dup_requests);
break;
- case PW_CODE_DISCONNECT_REQUEST:
+ case FR_CODE_DISCONNECT_REQUEST:
FR_STATS_INC(dsc, total_dup_requests);
break;
#endif
#ifdef WITH_STATS
request->listener->stats.last_packet = request->packet->timestamp.tv_sec;
- if (packet->code == PW_CODE_ACCESS_REQUEST) {
+ if (packet->code == FR_CODE_ACCESS_REQUEST) {
request->client->auth.last_packet = request->packet->timestamp.tv_sec;
radius_auth_stats.last_packet = request->packet->timestamp.tv_sec;
#ifdef WITH_ACCOUNTING
- } else if (packet->code == PW_CODE_ACCOUNTING_REQUEST) {
+ } else if (packet->code == FR_CODE_ACCOUNTING_REQUEST) {
request->client->acct.last_packet = request->packet->timestamp.tv_sec;
radius_acct_stats.last_packet = request->packet->timestamp.tv_sec;
#endif
/*
* Status-Server packets go to the head of the queue.
*/
- if (request->packet->code == PW_CODE_STATUS_SERVER) request->priority = 0;
+ if (request->packet->code == FR_CODE_STATUS_SERVER) request->priority = 0;
/*
* Set virtual server identity
* Accounting packets should be deleted immediately.
* They will never be retransmitted by the client.
*/
- if (request->proxy->packet->code == PW_CODE_ACCOUNTING_REQUEST) {
+ if (request->proxy->packet->code == FR_CODE_ACCOUNTING_REQUEST) {
RDEBUG("Stopping request due to failed connection to home server");
request->master_state = REQUEST_STOP_PROCESSING;
}
* Run the packet through the post-proxy stage,
* BEFORE playing games with the attributes.
*/
- vp = fr_pair_find_by_num(request->control, 0, PW_POST_PROXY_TYPE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_POST_PROXY_TYPE, TAG_ANY);
/*
* If we have a proxy_reply, and it was a reject, or a NAK
*/
if (!vp && reply) {
fr_dict_enum_t *dval = NULL;
- fr_dict_attr_t const *da = fr_dict_attr_by_num(NULL, 0, PW_POST_PROXY_TYPE);
+ fr_dict_attr_t const *da = fr_dict_attr_by_num(NULL, 0, FR_POST_PROXY_TYPE);
switch (reply->code) {
- case PW_CODE_ACCESS_REJECT:
- case PW_CODE_DISCONNECT_NAK:
- case PW_CODE_COA_NAK:
+ case FR_CODE_ACCESS_REJECT:
+ case FR_CODE_DISCONNECT_NAK:
+ case FR_CODE_COA_NAK:
dval = fr_dict_enum_by_alias(NULL, da, fr_packet_codes[reply->code]);
if (dval) {
- vp = radius_pair_create(request, &request->control, PW_POST_PROXY_TYPE, 0);
+ vp = radius_pair_create(request, &request->control, FR_POST_PROXY_TYPE, 0);
fr_value_box_copy(NULL, &vp->data, dval->value);
}
break;
/*
* Status-Server packets don't count as real packets.
*/
- if (proxy->packet->code != PW_CODE_STATUS_SERVER) {
+ if (proxy->packet->code != FR_CODE_STATUS_SERVER) {
listen_socket_t *sock = proxy->listener->data;
proxy->home_server->last_packet_recv = now.tv_sec;
proxy->listener->stats.last_packet = reply->timestamp.tv_sec;
switch (proxy->packet->code) {
- case PW_CODE_ACCESS_REQUEST:
- if (proxy->reply->code == PW_CODE_ACCESS_ACCEPT) {
+ case FR_CODE_ACCESS_REQUEST:
+ if (proxy->reply->code == FR_CODE_ACCESS_ACCEPT) {
proxy->listener->stats.total_access_accepts++;
- } else if (proxy->reply->code == PW_CODE_ACCESS_REJECT) {
+ } else if (proxy->reply->code == FR_CODE_ACCESS_REJECT) {
proxy->listener->stats.total_access_rejects++;
- } else if (proxy->reply->code == PW_CODE_ACCESS_CHALLENGE) {
+ } else if (proxy->reply->code == FR_CODE_ACCESS_CHALLENGE) {
proxy->listener->stats.total_access_challenges++;
}
break;
#ifdef WITH_ACCOUNTING
- case PW_CODE_ACCOUNTING_REQUEST:
+ case FR_CODE_ACCOUNTING_REQUEST:
proxy->listener->stats.total_responses++;
break;
#endif
#ifdef WITH_COA
- case PW_CODE_COA_REQUEST:
+ case FR_CODE_COA_REQUEST:
proxy->listener->stats.total_responses++;
break;
- case PW_CODE_DISCONNECT_REQUEST:
+ case FR_CODE_DISCONNECT_REQUEST:
proxy->listener->stats.total_responses++;
break;
proxy->home_server->stats.last_packet = reply->timestamp.tv_sec;
switch (proxy->packet->code) {
- case PW_CODE_ACCESS_REQUEST:
+ case FR_CODE_ACCESS_REQUEST:
proxy_auth_stats.last_packet = reply->timestamp.tv_sec;
break;
#ifdef WITH_ACCOUNTING
- case PW_CODE_ACCOUNTING_REQUEST:
+ case FR_CODE_ACCOUNTING_REQUEST:
proxy_acct_stats.last_packet = reply->timestamp.tv_sec;
break;
#endif
#ifdef WITH_COA
- case PW_CODE_COA_REQUEST:
+ case FR_CODE_COA_REQUEST:
proxy_coa_stats.last_packet = reply->timestamp.tv_sec;
break;
- case PW_CODE_DISCONNECT_REQUEST:
+ case FR_CODE_DISCONNECT_REQUEST:
proxy_dsc_stats.last_packet = reply->timestamp.tv_sec;
break;
static int setup_post_proxy_fail(REQUEST *request)
{
fr_dict_enum_t const *dval = NULL;
- fr_dict_attr_t const *da = fr_dict_attr_by_num(NULL, 0, PW_POST_PROXY_TYPE);
+ fr_dict_attr_t const *da = fr_dict_attr_by_num(NULL, 0, FR_POST_PROXY_TYPE);
VALUE_PAIR *vp;
char buffer[256];
if (!dval) dval = fr_dict_enum_by_alias(NULL, da, "Fail");
if (!dval) {
- fr_pair_delete_by_num(&request->control, 0, PW_POST_PROXY_TYPE, TAG_ANY);
+ fr_pair_delete_by_num(&request->control, 0, FR_POST_PROXY_TYPE, TAG_ANY);
return 0;
}
- vp = fr_pair_find_by_num(request->control, 0, PW_POST_PROXY_TYPE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_POST_PROXY_TYPE, TAG_ANY);
if (!vp) vp = radius_pair_create(request, &request->control,
- PW_POST_PROXY_TYPE, 0);
+ FR_POST_PROXY_TYPE, 0);
fr_value_box_copy(NULL, &vp->data, dval->value);
return 1;
when = request->proxy->packet->timestamp;
#ifdef WITH_COA
- if (((request->proxy->packet->code == PW_CODE_COA_REQUEST) ||
- (request->proxy->packet->code == PW_CODE_DISCONNECT_REQUEST)) &&
+ if (((request->proxy->packet->code == FR_CODE_COA_REQUEST) ||
+ (request->proxy->packet->code == FR_CODE_DISCONNECT_REQUEST)) &&
(request->packet->code != request->proxy->packet->code)) {
when.tv_sec += request->proxy->home_server->coa_mrd;
} else
* post-proxy-type FAIL told us to create
* one.
*/
- vp = fr_pair_find_by_num(request->control, 0, PW_RESPONSE_PACKET_TYPE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_RESPONSE_PACKET_TYPE, TAG_ANY);
if (vp && (vp->vp_uint32 != 256)) {
request->proxy->reply = fr_radius_alloc_reply(request, request->proxy->packet);
request->proxy->reply->code = vp->vp_uint32;
- fr_pair_delete_by_num(&request->control, 0, PW_RESPONSE_PACKET_TYPE, TAG_ANY);
+ fr_pair_delete_by_num(&request->control, 0, FR_RESPONSE_PACKET_TYPE, TAG_ANY);
}
request->handle(request);
* Except that we don't copy over Proxy-State.
*/
vp = fr_pair_list_copy(request->reply, request->proxy->reply->vps);
- fr_pair_delete_by_num(&vp, 0, PW_PROXY_STATE, TAG_ANY);
+ fr_pair_delete_by_num(&vp, 0, FR_PROXY_STATE, TAG_ANY);
fr_pair_add(&request->reply->vps, vp);
request->handle(request);
* request may be proxied.
*
* The key attributes are:
- * - PW_PROXY_TO_REALM - Specifies a realm the request should be proxied to.
- * - PW_HOME_SERVER_POOL - Specifies a specific home server pool to proxy to.
- * - PW_PACKET_DST_IP_ADDRESS - Specifies a specific IPv4 home server to proxy to.
- * - PW_PACKET_DST_IPV6_ADDRESS - Specifies a specific IPv6 home server to proxy to.
+ * - FR_PROXY_TO_REALM - Specifies a realm the request should be proxied to.
+ * - FR_HOME_SERVER_POOL - Specifies a specific home server pool to proxy to.
+ * - FR_PACKET_DST_IP_ADDRESS - Specifies a specific IPv4 home server to proxy to.
+ * - FR_PACKET_DST_IPV6_ADDRESS - Specifies a specific IPv6 home server to proxy to.
*
- * Certain packet types such as #PW_CODE_STATUS_SERVER will never be proxied.
+ * Certain packet types such as #FR_CODE_STATUS_SERVER will never be proxied.
*
* If request should be proxied, will:
* - Add request:Proxy-State
if (!request->root->proxy_requests) return 0;
if (request->packet->dst_port == 0) return 0;
- if (request->packet->code == PW_CODE_STATUS_SERVER) return 0;
+ if (request->packet->code == FR_CODE_STATUS_SERVER) return 0;
if (request->in_proxy_hash) return 0;
if (request->reply->code != 0) return 0;
- vp = fr_pair_find_by_num(request->control, 0, PW_PROXY_TO_REALM, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_PROXY_TO_REALM, TAG_ANY);
if (vp) {
realm = realm_find2(vp->vp_strvalue);
if (!realm) {
/*
* Figure out which pool to use.
*/
- if (request->packet->code == PW_CODE_ACCESS_REQUEST) {
+ if (request->packet->code == FR_CODE_ACCESS_REQUEST) {
pool = realm->auth_pool;
#ifdef WITH_ACCOUNTING
- } else if (request->packet->code == PW_CODE_ACCOUNTING_REQUEST) {
+ } else if (request->packet->code == FR_CODE_ACCOUNTING_REQUEST) {
pool = realm->acct_pool;
#endif
#ifdef WITH_COA
- } else if ((request->packet->code == PW_CODE_COA_REQUEST) ||
- (request->packet->code == PW_CODE_DISCONNECT_REQUEST)) {
+ } else if ((request->packet->code == FR_CODE_COA_REQUEST) ||
+ (request->packet->code == FR_CODE_DISCONNECT_REQUEST)) {
pool = realm->coa_pool;
#endif
return 0;
}
- } else if ((vp = fr_pair_find_by_num(request->control, 0, PW_HOME_SERVER_POOL, TAG_ANY)) != NULL) {
+ } else if ((vp = fr_pair_find_by_num(request->control, 0, FR_HOME_SERVER_POOL, TAG_ANY)) != NULL) {
int pool_type;
switch (request->packet->code) {
- case PW_CODE_ACCESS_REQUEST:
+ case FR_CODE_ACCESS_REQUEST:
pool_type = HOME_TYPE_AUTH;
break;
#ifdef WITH_ACCOUNTING
- case PW_CODE_ACCOUNTING_REQUEST:
+ case FR_CODE_ACCOUNTING_REQUEST:
pool_type = HOME_TYPE_ACCT;
break;
#endif
#ifdef WITH_COA
- case PW_CODE_COA_REQUEST:
- case PW_CODE_DISCONNECT_REQUEST:
+ case FR_CODE_COA_REQUEST:
+ case FR_CODE_DISCONNECT_REQUEST:
pool_type = HOME_TYPE_COA;
break;
#endif
/*
* Send it directly to a home server (i.e. NAS)
*/
- } else if (((vp = fr_pair_find_by_num(request->control, 0, PW_PACKET_DST_IP_ADDRESS, TAG_ANY)) != NULL) ||
- ((vp = fr_pair_find_by_num(request->control, 0, PW_PACKET_DST_IPV6_ADDRESS, TAG_ANY)) != NULL)) {
+ } else if (((vp = fr_pair_find_by_num(request->control, 0, FR_PACKET_DST_IP_ADDRESS, TAG_ANY)) != NULL) ||
+ ((vp = fr_pair_find_by_num(request->control, 0, FR_PACKET_DST_IPV6_ADDRESS, TAG_ANY)) != NULL)) {
uint16_t dst_port;
fr_ipaddr_t dst_ipaddr;
memset(&dst_ipaddr, 0, sizeof(dst_ipaddr));
- if (vp->da->attr == PW_PACKET_DST_IP_ADDRESS) {
+ if (vp->da->attr == FR_PACKET_DST_IP_ADDRESS) {
dst_ipaddr.af = AF_INET;
dst_ipaddr.addr.v4.s_addr = vp->vp_ipv4addr;
dst_ipaddr.prefix = 32;
dst_ipaddr.prefix = 128;
}
- vp = fr_pair_find_by_num(request->control, 0, PW_PACKET_DST_PORT, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_PACKET_DST_PORT, TAG_ANY);
if (!vp) {
- if (request->packet->code == PW_CODE_ACCESS_REQUEST) {
- dst_port = PW_AUTH_UDP_PORT;
+ if (request->packet->code == FR_CODE_ACCESS_REQUEST) {
+ dst_port = FR_AUTH_UDP_PORT;
#ifdef WITH_ACCOUNTING
- } else if (request->packet->code == PW_CODE_ACCOUNTING_REQUEST) {
- dst_port = PW_ACCT_UDP_PORT;
+ } else if (request->packet->code == FR_CODE_ACCOUNTING_REQUEST) {
+ dst_port = FR_ACCT_UDP_PORT;
#endif
#ifdef WITH_COA
- } else if ((request->packet->code == PW_CODE_COA_REQUEST) ||
- (request->packet->code == PW_CODE_DISCONNECT_REQUEST)) {
- dst_port = PW_COA_UDP_PORT;
+ } else if ((request->packet->code == FR_CODE_COA_REQUEST) ||
+ (request->packet->code == FR_CODE_DISCONNECT_REQUEST)) {
+ dst_port = FR_COA_UDP_PORT;
#endif
} else { /* shouldn't happen for RADIUS... */
return 0;
* requests.
*/
if (realm && (realm->strip_realm == true) &&
- (strippedname = fr_pair_find_by_num(request->proxy->packet->vps, 0, PW_STRIPPED_USER_NAME, TAG_ANY)) != NULL) {
+ (strippedname = fr_pair_find_by_num(request->proxy->packet->vps, 0, FR_STRIPPED_USER_NAME, TAG_ANY)) != NULL) {
/*
* If there's a Stripped-User-Name attribute in
* the request, then use THAT as the User-Name
* from the vps list, and making the new
* User-Name the head of the vps list.
*/
- vp = fr_pair_find_by_num(request->proxy->packet->vps, 0, PW_USER_NAME, TAG_ANY);
+ vp = fr_pair_find_by_num(request->proxy->packet->vps, 0, FR_USER_NAME, TAG_ANY);
if (!vp) {
vp_cursor_t cursor;
vp = radius_pair_create(NULL, NULL,
- PW_USER_NAME, 0);
+ FR_USER_NAME, 0);
rad_assert(vp != NULL); /* handled by above function */
/* Insert at the START of the list */
/* FIXME: Can't make assumptions about ordering */
/*
* Call the pre-proxy routines.
*/
- vp = fr_pair_find_by_num(request->control, 0, PW_PRE_PROXY_TYPE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_PRE_PROXY_TYPE, TAG_ANY);
if (vp) {
fr_dict_enum_t const *dval = fr_dict_enum_by_value(NULL, vp->da, &vp->data);
/* Must be a validation issue */
* Update the Acct-Delay-Time attribute, since the LAST
* time we tried to retransmit this packet.
*/
- if (request->packet->code == PW_CODE_ACCOUNTING_REQUEST) {
+ if (request->packet->code == FR_CODE_ACCOUNTING_REQUEST) {
VALUE_PAIR *vp;
- vp = fr_pair_find_by_num(request->proxy->packet->vps, 0, PW_ACCT_DELAY_TIME, TAG_ANY);
+ vp = fr_pair_find_by_num(request->proxy->packet->vps, 0, FR_ACCT_DELAY_TIME, TAG_ANY);
if (!vp) vp = radius_pair_create(request->proxy->packet,
&request->proxy->packet->vps,
- PW_ACCT_DELAY_TIME, 0);
+ FR_ACCT_DELAY_TIME, 0);
if (vp) {
struct timeval now;
rad_assert(request->proxy != NULL);
if (home->ping_check == HOME_PING_CHECK_STATUS_SERVER) {
- request->proxy->packet->code = PW_CODE_STATUS_SERVER;
+ request->proxy->packet->code = FR_CODE_STATUS_SERVER;
fr_pair_make(request->proxy->packet, &request->proxy->packet->vps,
"Message-Authenticator", "0x00", T_OP_SET);
} else if ((home->type == HOME_TYPE_AUTH) ||
(home->type == HOME_TYPE_AUTH_ACCT)) {
- request->proxy->packet->code = PW_CODE_ACCESS_REQUEST;
+ request->proxy->packet->code = FR_CODE_ACCESS_REQUEST;
fr_pair_make(request->proxy->packet, &request->proxy->packet->vps,
"User-Name", home->ping_user_name, T_OP_SET);
#ifdef WITH_ACCOUNTING
} else if (home->type == HOME_TYPE_ACCT) {
- request->proxy->packet->code = PW_CODE_ACCOUNTING_REQUEST;
+ request->proxy->packet->code = FR_CODE_ACCOUNTING_REQUEST;
fr_pair_make(request->proxy->packet, &request->proxy->packet->vps,
"User-Name", home->ping_user_name, T_OP_SET);
else if (home->type == HOME_TYPE_COA) {
if (request->proxy->listener) FR_STATS_TYPE_INC(request->proxy->listener->stats.total_timeouts);
- if (request->packet->code == PW_CODE_COA_REQUEST) {
+ if (request->packet->code == FR_CODE_COA_REQUEST) {
FR_STATS_TYPE_INC(proxy_coa_stats.total_timeouts);
} else {
FR_STATS_TYPE_INC(proxy_dsc_stats.total_timeouts);
* If we update the Acct-Delay-Time, we need to
* get a new ID.
*/
- if ((request->packet->code == PW_CODE_ACCOUNTING_REQUEST) &&
- fr_pair_find_by_num(request->proxy->packet->vps, 0, PW_ACCT_DELAY_TIME, TAG_ANY)) {
+ if ((request->packet->code == FR_CODE_ACCOUNTING_REQUEST) &&
+ fr_pair_find_by_num(request->proxy->packet->vps, 0, FR_ACCT_DELAY_TIME, TAG_ANY)) {
request_proxy_anew(request);
return;
}
TRACE_STATE_MACHINE;
CHECK_FOR_STOP;
- rad_assert(request->packet->code != PW_CODE_STATUS_SERVER);
+ rad_assert(request->packet->code != FR_CODE_STATUS_SERVER);
rad_assert(request->proxy->home_server != NULL);
fr_event_list_time(&now, el);
/*
* Check whether we want to originate one, or cancel one.
*/
- vp = fr_pair_find_by_num(request->control, 0, PW_SEND_COA_REQUEST, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_SEND_COA_REQUEST, TAG_ANY);
if (!vp) {
- vp = fr_pair_find_by_num(request->coa->proxy->packet->vps, 0, PW_SEND_COA_REQUEST, TAG_ANY);
+ vp = fr_pair_find_by_num(request->coa->proxy->packet->vps, 0, FR_SEND_COA_REQUEST, TAG_ANY);
}
if (vp) {
* src_ipaddr will be set up in proxy_encode.
*/
memset(&ipaddr, 0, sizeof(ipaddr));
- vp = fr_pair_find_by_num(coa->proxy->packet->vps, 0, PW_PACKET_DST_IP_ADDRESS, TAG_ANY);
+ vp = fr_pair_find_by_num(coa->proxy->packet->vps, 0, FR_PACKET_DST_IP_ADDRESS, TAG_ANY);
if (vp) {
memcpy(&ipaddr, &vp->vp_ip, sizeof(ipaddr));
- } else if ((vp = fr_pair_find_by_num(coa->proxy->packet->vps, 0, PW_PACKET_DST_IPV6_ADDRESS, TAG_ANY)) != NULL) {
+ } else if ((vp = fr_pair_find_by_num(coa->proxy->packet->vps, 0, FR_PACKET_DST_IPV6_ADDRESS, TAG_ANY)) != NULL) {
memcpy(&ipaddr, &vp->vp_ip, sizeof(ipaddr));
- } else if ((vp = fr_pair_find_by_num(coa->proxy->packet->vps, 0, PW_HOME_SERVER_POOL, TAG_ANY)) != NULL) {
+ } else if ((vp = fr_pair_find_by_num(coa->proxy->packet->vps, 0, FR_HOME_SERVER_POOL, TAG_ANY)) != NULL) {
coa->home_pool = home_pool_byname(vp->vp_strvalue,
HOME_TYPE_COA);
if (!coa->home_pool) {
home_server_update_request(coa->home_server, coa);
} else if (!coa->home_server) {
- uint16_t port = PW_COA_UDP_PORT;
+ uint16_t port = FR_COA_UDP_PORT;
char buffer[INET6_ADDRSTRLEN];
- vp = fr_pair_find_by_num(coa->proxy->packet->vps, 0, PW_PACKET_DST_PORT, TAG_ANY);
+ vp = fr_pair_find_by_num(coa->proxy->packet->vps, 0, FR_PACKET_DST_PORT, TAG_ANY);
if (vp) port = vp->vp_uint32;
coa->home_server = home_server_find(&ipaddr, port, IPPROTO_UDP);
}
}
- vp = fr_pair_find_by_num(coa->proxy->packet->vps, 0, PW_PACKET_TYPE, TAG_ANY);
+ vp = fr_pair_find_by_num(coa->proxy->packet->vps, 0, FR_PACKET_TYPE, TAG_ANY);
if (vp) {
switch (vp->vp_uint32) {
- case PW_CODE_COA_REQUEST:
- case PW_CODE_DISCONNECT_REQUEST:
+ case FR_CODE_COA_REQUEST:
+ case FR_CODE_DISCONNECT_REQUEST:
coa->proxy->packet->code = vp->vp_uint32;
break;
}
}
- if (!coa->proxy->packet->code) coa->proxy->packet->code = PW_CODE_COA_REQUEST;
+ if (!coa->proxy->packet->code) coa->proxy->packet->code = FR_CODE_COA_REQUEST;
/*
* The rest of the server code assumes that
/*
* Call the pre-proxy routines.
*/
- vp = fr_pair_find_by_num(request->control, 0, PW_PRE_PROXY_TYPE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_PRE_PROXY_TYPE, TAG_ANY);
if (vp) {
fr_dict_enum_t const *dval = fr_dict_enum_by_value(NULL, vp->da, &vp->data);
/* Must be a validation issue */
static rc_stats_t stats;
static uint16_t server_port = 0;
-static int packet_code = PW_CODE_UNDEFINED;
+static int packet_code = FR_CODE_UNDEFINED;
static fr_ipaddr_t server_ipaddr;
static int resend_count = 1;
static bool done = true;
VALUE_PAIR *challenge, *reply;
uint8_t nthash[16];
- fr_pair_delete_by_num(&packet->vps, VENDORPEC_MICROSOFT, PW_MSCHAP_CHALLENGE, TAG_ANY);
- fr_pair_delete_by_num(&packet->vps, VENDORPEC_MICROSOFT, PW_MSCHAP_RESPONSE, TAG_ANY);
+ fr_pair_delete_by_num(&packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_CHALLENGE, TAG_ANY);
+ fr_pair_delete_by_num(&packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_RESPONSE, TAG_ANY);
- challenge = fr_pair_afrom_num(packet, VENDORPEC_MICROSOFT, PW_MSCHAP_CHALLENGE);
+ challenge = fr_pair_afrom_num(packet, VENDORPEC_MICROSOFT, FR_MSCHAP_CHALLENGE);
if (!challenge) {
return 0;
}
p[i] = fr_rand();
}
- reply = fr_pair_afrom_num(packet, VENDORPEC_MICROSOFT, PW_MSCHAP_RESPONSE);
+ reply = fr_pair_afrom_num(packet, VENDORPEC_MICROSOFT, FR_MSCHAP_RESPONSE);
if (!reply) {
return 0;
}
/*
* Set a port from the request type if we don't already have one
*/
-static void radclient_get_port(PW_CODE type, uint16_t *port)
+static void radclient_get_port(FR_CODE type, uint16_t *port)
{
switch (type) {
default:
- case PW_CODE_ACCESS_REQUEST:
- case PW_CODE_ACCESS_CHALLENGE:
- case PW_CODE_STATUS_SERVER:
+ case FR_CODE_ACCESS_REQUEST:
+ case FR_CODE_ACCESS_CHALLENGE:
+ case FR_CODE_STATUS_SERVER:
if (*port == 0) *port = getport("radius");
- if (*port == 0) *port = PW_AUTH_UDP_PORT;
+ if (*port == 0) *port = FR_AUTH_UDP_PORT;
return;
- case PW_CODE_ACCOUNTING_REQUEST:
+ case FR_CODE_ACCOUNTING_REQUEST:
if (*port == 0) *port = getport("radacct");
- if (*port == 0) *port = PW_ACCT_UDP_PORT;
+ if (*port == 0) *port = FR_ACCT_UDP_PORT;
return;
- case PW_CODE_DISCONNECT_REQUEST:
- if (*port == 0) *port = PW_POD_UDP_PORT;
+ case FR_CODE_DISCONNECT_REQUEST:
+ if (*port == 0) *port = FR_POD_UDP_PORT;
return;
- case PW_CODE_COA_REQUEST:
- if (*port == 0) *port = PW_COA_UDP_PORT;
+ case FR_CODE_COA_REQUEST:
+ if (*port == 0) *port = FR_COA_UDP_PORT;
return;
- case PW_CODE_UNDEFINED:
+ case FR_CODE_UNDEFINED:
if (*port == 0) *port = 0;
return;
}
/*
* Resolve a port to a request type
*/
-static PW_CODE radclient_get_code(uint16_t port)
+static FR_CODE radclient_get_code(uint16_t port)
{
/*
* getport returns 0 if the service doesn't exist
* so we need to return early, to avoid incorrect
* codes.
*/
- if (port == 0) return PW_CODE_UNDEFINED;
+ if (port == 0) return FR_CODE_UNDEFINED;
- if ((port == getport("radius")) || (port == PW_AUTH_UDP_PORT) || (port == PW_AUTH_UDP_PORT_ALT)) {
- return PW_CODE_ACCESS_REQUEST;
+ if ((port == getport("radius")) || (port == FR_AUTH_UDP_PORT) || (port == FR_AUTH_UDP_PORT_ALT)) {
+ return FR_CODE_ACCESS_REQUEST;
}
- if ((port == getport("radacct")) || (port == PW_ACCT_UDP_PORT) || (port == PW_ACCT_UDP_PORT_ALT)) {
- return PW_CODE_ACCOUNTING_REQUEST;
+ if ((port == getport("radacct")) || (port == FR_ACCT_UDP_PORT) || (port == FR_ACCT_UDP_PORT_ALT)) {
+ return FR_CODE_ACCOUNTING_REQUEST;
}
- if (port == PW_COA_UDP_PORT) return PW_CODE_COA_REQUEST;
- if (port == PW_POD_UDP_PORT) return PW_CODE_DISCONNECT_REQUEST;
+ if (port == FR_COA_UDP_PORT) return FR_CODE_COA_REQUEST;
+ if (port == FR_POD_UDP_PORT) return FR_CODE_DISCONNECT_REQUEST;
- return PW_CODE_UNDEFINED;
+ return FR_CODE_UNDEFINED;
}
}
if (vp->da->vendor == 0 ) switch (vp->da->attr) {
- case PW_RESPONSE_PACKET_TYPE:
- case PW_PACKET_TYPE:
+ case FR_RESPONSE_PACKET_TYPE:
+ case FR_PACKET_TYPE:
fr_pair_cursor_remove(&cursor); /* so we don't break the filter */
request->filter_code = vp->vp_uint32;
talloc_free(vp);
* Allow it to set the packet type in
* the attributes read from the file.
*/
- case PW_PACKET_TYPE:
+ case FR_PACKET_TYPE:
request->packet->code = vp->vp_uint32;
break;
- case PW_RESPONSE_PACKET_TYPE:
+ case FR_RESPONSE_PACKET_TYPE:
request->filter_code = vp->vp_uint32;
break;
- case PW_PACKET_DST_PORT:
+ case FR_PACKET_DST_PORT:
request->packet->dst_port = (vp->vp_uint32 & 0xffff);
break;
- case PW_PACKET_DST_IP_ADDRESS:
- case PW_PACKET_DST_IPV6_ADDRESS:
+ case FR_PACKET_DST_IP_ADDRESS:
+ case FR_PACKET_DST_IPV6_ADDRESS:
memcpy(&request->packet->dst_ipaddr, &vp->vp_ip, sizeof(request->packet->dst_ipaddr));
break;
- case PW_PACKET_SRC_PORT:
+ case FR_PACKET_SRC_PORT:
if ((vp->vp_uint32 < 1024) ||
(vp->vp_uint32 > 65535)) {
ERROR("Invalid value '%u' for Packet-Src-Port", vp->vp_uint32);
request->packet->src_port = (vp->vp_uint32 & 0xffff);
break;
- case PW_PACKET_SRC_IP_ADDRESS:
- case PW_PACKET_SRC_IPV6_ADDRESS:
+ case FR_PACKET_SRC_IP_ADDRESS:
+ case FR_PACKET_SRC_IPV6_ADDRESS:
memcpy(&request->packet->src_ipaddr, &vp->vp_ip, sizeof(request->packet->src_ipaddr));
break;
- case PW_REQUEST_AUTHENTICATOR:
+ case FR_REQUEST_AUTHENTICATOR:
if (vp->vp_length > sizeof(request->packet->vector)) {
memcpy(request->packet->vector, vp->vp_octets, sizeof(request->packet->vector));
} else {
}
break;
- case PW_DIGEST_REALM:
- case PW_DIGEST_NONCE:
- case PW_DIGEST_METHOD:
- case PW_DIGEST_URI:
- case PW_DIGEST_QOP:
- case PW_DIGEST_ALGORITHM:
- case PW_DIGEST_BODY_DIGEST:
- case PW_DIGEST_CNONCE:
- case PW_DIGEST_NONCE_COUNT:
- case PW_DIGEST_USER_NAME:
+ case FR_DIGEST_REALM:
+ case FR_DIGEST_NONCE:
+ case FR_DIGEST_METHOD:
+ case FR_DIGEST_URI:
+ case FR_DIGEST_QOP:
+ case FR_DIGEST_ALGORITHM:
+ case FR_DIGEST_BODY_DIGEST:
+ case FR_DIGEST_CNONCE:
+ case FR_DIGEST_NONCE_COUNT:
+ case FR_DIGEST_USER_NAME:
/* overlapping! */
{
fr_dict_attr_t const *da;
p = talloc_array(vp, uint8_t, vp->vp_length + 2);
memcpy(p + 2, vp->vp_octets, vp->vp_length);
- p[0] = vp->da->attr - PW_DIGEST_REALM + 1;
+ p[0] = vp->da->attr - FR_DIGEST_REALM + 1;
vp->vp_length += 2;
p[1] = vp->vp_length;
- da = fr_dict_attr_by_num(NULL, 0, PW_DIGEST_ATTRIBUTES);
+ da = fr_dict_attr_by_num(NULL, 0, FR_DIGEST_ATTRIBUTES);
if (!da) {
ERROR("Out of memory");
goto error;
/*
* Cache this for later.
*/
- case PW_CLEARTEXT_PASSWORD:
+ case FR_CLEARTEXT_PASSWORD:
request->password = vp;
break;
/*
* Keep a copy of the the password attribute.
*/
- case PW_CHAP_PASSWORD:
+ case FR_CHAP_PASSWORD:
/*
* If it's already hex, do nothing.
*/
fr_pair_value_bstrncpy(request->password, vp->vp_strvalue, vp->vp_length);
break;
- case PW_USER_PASSWORD:
- case PW_MS_CHAP_PASSWORD:
+ case FR_USER_PASSWORD:
+ case FR_MS_CHAP_PASSWORD:
request->password = fr_pair_make(request->packet, &request->packet->vps, "Cleartext-Password",
vp->vp_strvalue, T_OP_EQ);
break;
- case PW_RADCLIENT_TEST_NAME:
+ case FR_RADCLIENT_TEST_NAME:
request->name = vp->vp_strvalue;
break;
}
/*
* Use the default set on the command line
*/
- if (request->packet->code == PW_CODE_UNDEFINED) request->packet->code = packet_code;
+ if (request->packet->code == FR_CODE_UNDEFINED) request->packet->code = packet_code;
/*
* Default to the filename
* Automatically set the response code from the request code
* (if one wasn't already set).
*/
- if (request->filter_code == PW_CODE_UNDEFINED) {
+ if (request->filter_code == FR_CODE_UNDEFINED) {
switch (request->packet->code) {
- case PW_CODE_ACCESS_REQUEST:
- request->filter_code = PW_CODE_ACCESS_ACCEPT;
+ case FR_CODE_ACCESS_REQUEST:
+ request->filter_code = FR_CODE_ACCESS_ACCEPT;
break;
- case PW_CODE_ACCOUNTING_REQUEST:
- request->filter_code = PW_CODE_ACCOUNTING_RESPONSE;
+ case FR_CODE_ACCOUNTING_REQUEST:
+ request->filter_code = FR_CODE_ACCOUNTING_RESPONSE;
break;
- case PW_CODE_COA_REQUEST:
- request->filter_code = PW_CODE_COA_ACK;
+ case FR_CODE_COA_REQUEST:
+ request->filter_code = FR_CODE_COA_ACK;
break;
- case PW_CODE_DISCONNECT_REQUEST:
- request->filter_code = PW_CODE_DISCONNECT_ACK;
+ case FR_CODE_DISCONNECT_REQUEST:
+ request->filter_code = FR_CODE_DISCONNECT_ACK;
break;
- case PW_CODE_STATUS_SERVER:
+ case FR_CODE_STATUS_SERVER:
switch (radclient_get_code(request->packet->dst_port)) {
- case PW_CODE_ACCESS_REQUEST:
- request->filter_code = PW_CODE_ACCESS_ACCEPT;
+ case FR_CODE_ACCESS_REQUEST:
+ request->filter_code = FR_CODE_ACCESS_ACCEPT;
break;
- case PW_CODE_ACCOUNTING_REQUEST:
- request->filter_code = PW_CODE_ACCOUNTING_RESPONSE;
+ case FR_CODE_ACCOUNTING_REQUEST:
+ request->filter_code = FR_CODE_ACCOUNTING_RESPONSE;
break;
default:
- request->filter_code = PW_CODE_UNDEFINED;
+ request->filter_code = FR_CODE_UNDEFINED;
break;
}
break;
- case PW_CODE_UNDEFINED:
+ case FR_CODE_UNDEFINED:
REDEBUG("Both Packet-Type and Response-Packet-Type undefined, specify at least one, "
"or a well known RADIUS port");
goto error;
* Automatically set the request code from the response code
* (if one wasn't already set).
*/
- } else if (request->packet->code == PW_CODE_UNDEFINED) {
+ } else if (request->packet->code == FR_CODE_UNDEFINED) {
switch (request->filter_code) {
- case PW_CODE_ACCESS_ACCEPT:
- case PW_CODE_ACCESS_REJECT:
- request->packet->code = PW_CODE_ACCESS_REQUEST;
+ case FR_CODE_ACCESS_ACCEPT:
+ case FR_CODE_ACCESS_REJECT:
+ request->packet->code = FR_CODE_ACCESS_REQUEST;
break;
- case PW_CODE_ACCOUNTING_RESPONSE:
- request->packet->code = PW_CODE_ACCOUNTING_REQUEST;
+ case FR_CODE_ACCOUNTING_RESPONSE:
+ request->packet->code = FR_CODE_ACCOUNTING_REQUEST;
break;
- case PW_CODE_DISCONNECT_ACK:
- case PW_CODE_DISCONNECT_NAK:
- request->packet->code = PW_CODE_DISCONNECT_REQUEST;
+ case FR_CODE_DISCONNECT_ACK:
+ case FR_CODE_DISCONNECT_NAK:
+ request->packet->code = FR_CODE_DISCONNECT_REQUEST;
break;
- case PW_CODE_COA_ACK:
- case PW_CODE_COA_NAK:
- request->packet->code = PW_CODE_COA_REQUEST;
+ case FR_CODE_COA_ACK:
+ case FR_CODE_COA_NAK:
+ request->packet->code = FR_CODE_COA_REQUEST;
break;
default:
if (request->password) {
VALUE_PAIR *vp;
- if ((vp = fr_pair_find_by_num(request->packet->vps, 0, PW_USER_PASSWORD, TAG_ANY)) != NULL) {
+ if ((vp = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_PASSWORD, TAG_ANY)) != NULL) {
fr_pair_value_strcpy(vp, request->password->vp_strvalue);
- } else if ((vp = fr_pair_find_by_num(request->packet->vps, 0, PW_CHAP_PASSWORD, TAG_ANY)) != NULL) {
+ } else if ((vp = fr_pair_find_by_num(request->packet->vps, 0, FR_CHAP_PASSWORD, TAG_ANY)) != NULL) {
uint8_t buffer[17];
fr_radius_encode_chap_password(buffer, request->packet, fr_rand() & 0xff, request->password);
fr_pair_value_memcpy(vp, buffer, 17);
- } else if (fr_pair_find_by_num(request->packet->vps, 0, PW_MS_CHAP_PASSWORD, TAG_ANY) != NULL) {
+ } else if (fr_pair_find_by_num(request->packet->vps, 0, FR_MS_CHAP_PASSWORD, TAG_ANY) != NULL) {
mschapv1_encode(request->packet, &request->packet->vps, request->password->vp_strvalue);
} else {
* Increment counters...
*/
switch (request->reply->code) {
- case PW_CODE_ACCESS_ACCEPT:
- case PW_CODE_ACCOUNTING_RESPONSE:
- case PW_CODE_COA_ACK:
- case PW_CODE_DISCONNECT_ACK:
+ case FR_CODE_ACCESS_ACCEPT:
+ case FR_CODE_ACCOUNTING_RESPONSE:
+ case FR_CODE_COA_ACK:
+ case FR_CODE_DISCONNECT_ACK:
stats.accepted++;
break;
- case PW_CODE_ACCESS_CHALLENGE:
+ case FR_CODE_ACCESS_CHALLENGE:
break;
default:
* If we had an expected response code, check to see if the
* packet matched that.
*/
- if ((request->filter_code != PW_CODE_UNDEFINED) && (request->reply->code != request->filter_code)) {
+ if ((request->filter_code != FR_CODE_UNDEFINED) && (request->reply->code != request->filter_code)) {
if (is_radius_code(request->reply->code)) {
REDEBUG("%s: Expected %s got %s", request->name, fr_packet_codes[request->filter_code],
fr_packet_codes[request->reply->code]);
/*
* Work backwards from the port to determine the packet type
*/
- if (packet_code == PW_CODE_UNDEFINED) packet_code = radclient_get_code(server_port);
+ if (packet_code == FR_CODE_UNDEFINED) packet_code = radclient_get_code(server_port);
}
radclient_get_port(packet_code, &server_port);
p = strchr(buffer, ':');
if (!p) {
- port = PW_RADMIN_PORT;
+ port = FR_RADMIN_PORT;
} else {
port = atoi(p + 1);
*p = '\0';
static char const *radsniff_version = RADIUSD_VERSION_STRING_BUILD("radsniff");
static int rs_useful_codes[] = {
- PW_CODE_ACCESS_REQUEST, //!< RFC2865 - Authentication request
- PW_CODE_ACCESS_ACCEPT, //!< RFC2865 - Access-Accept
- PW_CODE_ACCESS_REJECT, //!< RFC2865 - Access-Reject
- PW_CODE_ACCOUNTING_REQUEST, //!< RFC2866 - Accounting-Request
- PW_CODE_ACCOUNTING_RESPONSE, //!< RFC2866 - Accounting-Response
- PW_CODE_ACCESS_CHALLENGE, //!< RFC2865 - Access-Challenge
- PW_CODE_STATUS_SERVER, //!< RFC2865/RFC5997 - Status Server (request)
- PW_CODE_STATUS_CLIENT, //!< RFC2865/RFC5997 - Status Server (response)
- PW_CODE_DISCONNECT_REQUEST, //!< RFC3575/RFC5176 - Disconnect-Request
- PW_CODE_DISCONNECT_ACK, //!< RFC3575/RFC5176 - Disconnect-Ack (positive)
- PW_CODE_DISCONNECT_NAK, //!< RFC3575/RFC5176 - Disconnect-Nak (not willing to perform)
- PW_CODE_COA_REQUEST, //!< RFC3575/RFC5176 - CoA-Request
- PW_CODE_COA_ACK, //!< RFC3575/RFC5176 - CoA-Ack (positive)
- PW_CODE_COA_NAK, //!< RFC3575/RFC5176 - CoA-Nak (not willing to perform)
+ FR_CODE_ACCESS_REQUEST, //!< RFC2865 - Authentication request
+ FR_CODE_ACCESS_ACCEPT, //!< RFC2865 - Access-Accept
+ FR_CODE_ACCESS_REJECT, //!< RFC2865 - Access-Reject
+ FR_CODE_ACCOUNTING_REQUEST, //!< RFC2866 - Accounting-Request
+ FR_CODE_ACCOUNTING_RESPONSE, //!< RFC2866 - Accounting-Response
+ FR_CODE_ACCESS_CHALLENGE, //!< RFC2865 - Access-Challenge
+ FR_CODE_STATUS_SERVER, //!< RFC2865/RFC5997 - Status Server (request)
+ FR_CODE_STATUS_CLIENT, //!< RFC2865/RFC5997 - Status Server (response)
+ FR_CODE_DISCONNECT_REQUEST, //!< RFC3575/RFC5176 - Disconnect-Request
+ FR_CODE_DISCONNECT_ACK, //!< RFC3575/RFC5176 - Disconnect-Ack (positive)
+ FR_CODE_DISCONNECT_NAK, //!< RFC3575/RFC5176 - Disconnect-Nak (not willing to perform)
+ FR_CODE_COA_REQUEST, //!< RFC3575/RFC5176 - CoA-Request
+ FR_CODE_COA_ACK, //!< RFC3575/RFC5176 - CoA-Ack (positive)
+ FR_CODE_COA_NAK, //!< RFC3575/RFC5176 - CoA-Nak (not willing to perform)
};
static const FR_NAME_NUMBER rs_events[] = {
}
}
-static void rs_stats_print_code_fancy(rs_latency_t *stats, PW_CODE code)
+static void rs_stats_print_code_fancy(rs_latency_t *stats, FR_CODE code)
{
int i;
bool have_rt = false;
}
switch (current->code) {
- case PW_CODE_ACCOUNTING_RESPONSE:
- case PW_CODE_ACCESS_REJECT:
- case PW_CODE_ACCESS_ACCEPT:
- case PW_CODE_ACCESS_CHALLENGE:
- case PW_CODE_COA_NAK:
- case PW_CODE_COA_ACK:
- case PW_CODE_DISCONNECT_NAK:
- case PW_CODE_DISCONNECT_ACK:
- case PW_CODE_STATUS_CLIENT:
+ case FR_CODE_ACCOUNTING_RESPONSE:
+ case FR_CODE_ACCESS_REJECT:
+ case FR_CODE_ACCESS_ACCEPT:
+ case FR_CODE_ACCESS_CHALLENGE:
+ case FR_CODE_COA_NAK:
+ case FR_CODE_COA_ACK:
+ case FR_CODE_DISCONNECT_NAK:
+ case FR_CODE_DISCONNECT_ACK:
+ case FR_CODE_STATUS_CLIENT:
{
/* look for a matching request and use it for decoding */
search.expect = current;
break;
}
- case PW_CODE_ACCOUNTING_REQUEST:
- case PW_CODE_ACCESS_REQUEST:
- case PW_CODE_COA_REQUEST:
- case PW_CODE_DISCONNECT_REQUEST:
- case PW_CODE_STATUS_SERVER:
+ case FR_CODE_ACCOUNTING_REQUEST:
+ case FR_CODE_ACCESS_REQUEST:
+ case FR_CODE_COA_REQUEST:
+ case FR_CODE_DISCONNECT_REQUEST:
+ case FR_CODE_STATUS_SERVER:
{
/*
* Verify this code is allowed
* CoA and Disconnect Messages, as we get the average latency across both
* response types.
*
- * It also justifies allocating PW_CODE_MAX instances of rs_latency_t.
+ * It also justifies allocating FR_CODE_MAX instances of rs_latency_t.
*/
rs_stats_update_latency(&stats->exchange[current->code], &latency);
rs_stats_update_latency(&stats->exchange[original->expect->code], &latency);
}
fr_pair_cursor_init(&cursor, &conf->filter_request_vps);
- type = fr_pair_cursor_next_by_num(&cursor, 0, PW_PACKET_TYPE, TAG_ANY);
+ type = fr_pair_cursor_next_by_num(&cursor, 0, FR_PACKET_TYPE, TAG_ANY);
if (type) {
fr_pair_cursor_remove(&cursor);
conf->filter_request_code = type->vp_uint32;
}
fr_pair_cursor_init(&cursor, &conf->filter_response_vps);
- type = fr_pair_cursor_next_by_num(&cursor, 0, PW_PACKET_TYPE, TAG_ANY);
+ type = fr_pair_cursor_next_by_num(&cursor, 0, FR_PACKET_TYPE, TAG_ANY);
if (type) {
fr_pair_cursor_remove(&cursor);
conf->filter_response_code = type->vp_uint32;
* Add message authenticator or the stats
* request will be rejected.
*/
- vp = fr_pair_afrom_num(request, 0, PW_MESSAGE_AUTHENTICATOR);
+ vp = fr_pair_afrom_num(request, 0, FR_MESSAGE_AUTHENTICATOR);
if (!vp) {
ERROR("Failed allocating Message-Authenticator attribute");
return EXIT_FAILURE;
{
fr_dict_attr_t const *parent;
- parent = fr_dict_attr_child_by_num(fr_dict_root(conf->dict), PW_EXTENDED_ATTRIBUTE_1);
+ parent = fr_dict_attr_child_by_num(fr_dict_root(conf->dict), FR_EXTENDED_ATTRIBUTE_1);
if (!parent) {
ERROR("Incomplete dictionary: Missing definition for Extended-Attribute-1");
dict_error:
talloc_free(conf);
exit(1);
}
- parent = fr_dict_attr_child_by_num(parent, PW_VENDOR_SPECIFIC);
+ parent = fr_dict_attr_child_by_num(parent, FR_VENDOR_SPECIFIC);
if (!parent) {
ERROR("Incomplete dictionary: Missing definition for Extended-Attribute-1(%i)."
- "Vendor-Specific(%i)", PW_EXTENDED_ATTRIBUTE_1, PW_VENDOR_SPECIFIC);
+ "Vendor-Specific(%i)", FR_EXTENDED_ATTRIBUTE_1, FR_VENDOR_SPECIFIC);
goto dict_error;
}
parent = fr_dict_attr_child_by_num(parent, VENDORPEC_FREERADIUS);
if (!parent) {
ERROR("Incomplete dictionary: Missing definition for Extended-Attribute-1(%i)."
- "Vendor-Specific(%i).FreeRADIUS(%i)", PW_EXTENDED_ATTRIBUTE_1, PW_VENDOR_SPECIFIC,
+ "Vendor-Specific(%i).FreeRADIUS(%i)", FR_EXTENDED_ATTRIBUTE_1, FR_VENDOR_SPECIFIC,
VENDORPEC_FREERADIUS);
goto dict_error;
}
if (!conf->snmp_oid_root) {
ERROR("Incomplete dictionary: Missing definition for Extended-Attribute-1(%i)."
"Vendor-Specific(%i).FreeRADIUS(%i).FreeRADIUS-Iso(%i)",
- PW_EXTENDED_ATTRIBUTE_1, PW_VENDOR_SPECIFIC,
+ FR_EXTENDED_ATTRIBUTE_1, FR_VENDOR_SPECIFIC,
VENDORPEC_FREERADIUS, 1);
goto dict_error;
}
*/
#ifdef WITH_TLS
if (tls) {
- home->port = PW_RADIUS_TLS_PORT;
+ home->port = FR_RADIUS_TLS_PORT;
} else
#endif
switch (home->type) {
/* FALL-THROUGH */
case HOME_TYPE_AUTH:
- home->port = PW_AUTH_UDP_PORT;
+ home->port = FR_AUTH_UDP_PORT;
break;
case HOME_TYPE_ACCT:
- home->port = PW_ACCT_UDP_PORT;
+ home->port = FR_ACCT_UDP_PORT;
break;
case HOME_TYPE_COA:
- home->port = PW_COA_UDP_PORT;
+ home->port = FR_COA_UDP_PORT;
break;
}
p = strchr(name, ':');
if (!p) {
if (type == HOME_TYPE_AUTH) {
- home->port = PW_AUTH_UDP_PORT;
+ home->port = FR_AUTH_UDP_PORT;
} else {
- home->port = PW_ACCT_UDP_PORT;
+ home->port = FR_ACCT_UDP_PORT;
}
p = name;
* The RFC's say we have to do this, but FreeRADIUS
* doesn't need it.
*/
- vp = radius_pair_create(request->proxy->packet, &request->proxy->packet->vps, PW_PROXY_STATE, 0);
+ vp = radius_pair_create(request->proxy->packet, &request->proxy->packet->vps, FR_PROXY_STATE, 0);
snprintf(buff, sizeof(buff), "%u", request->packet->id);
fr_pair_value_memcpy(vp, (uint8_t *)buff, strlen(buff));
/*
- * If there is no PW_CHAP_CHALLENGE attribute but
- * there is a PW_CHAP_PASSWORD we need to add it
+ * If there is no FR_CHAP_CHALLENGE attribute but
+ * there is a FR_CHAP_PASSWORD we need to add it
* since we can't use the request->packet request
* authenticator anymore, as the
* request->proxy->packet authenticator is
* different.
*/
- if ((request->packet->code == PW_CODE_ACCESS_REQUEST) &&
- fr_pair_find_by_num(request->proxy->packet->vps, 0, PW_CHAP_PASSWORD, TAG_ANY) &&
- fr_pair_find_by_num(request->proxy->packet->vps, 0, PW_CHAP_CHALLENGE, TAG_ANY) == NULL) {
- vp = radius_pair_create(request->proxy->packet, &request->proxy->packet->vps, PW_CHAP_CHALLENGE, 0);
+ if ((request->packet->code == FR_CODE_ACCESS_REQUEST) &&
+ fr_pair_find_by_num(request->proxy->packet->vps, 0, FR_CHAP_PASSWORD, TAG_ANY) &&
+ fr_pair_find_by_num(request->proxy->packet->vps, 0, FR_CHAP_CHALLENGE, TAG_ANY) == NULL) {
+ vp = radius_pair_create(request->proxy->packet, &request->proxy->packet->vps, FR_CHAP_CHALLENGE, 0);
fr_pair_value_memcpy(vp, request->packet->vector, sizeof(request->packet->vector));
}
* Access-Requests have a Message-Authenticator added,
* unless one already exists.
*/
- if ((request->packet->code == PW_CODE_ACCESS_REQUEST) &&
- !fr_pair_find_by_num(request->proxy->packet->vps, 0, PW_MESSAGE_AUTHENTICATOR, TAG_ANY)) {
+ if ((request->packet->code == FR_CODE_ACCESS_REQUEST) &&
+ !fr_pair_find_by_num(request->proxy->packet->vps, 0, FR_MESSAGE_AUTHENTICATOR, TAG_ANY)) {
fr_pair_make(request->proxy->packet, &request->proxy->packet->vps,
"Message-Authenticator", "0x00", T_OP_SET);
}
break;
case HOME_POOL_KEYED_BALANCE:
- if ((vp = fr_pair_find_by_num(request->control, 0, PW_LOAD_BALANCE_KEY, TAG_ANY)) != NULL) {
+ if ((vp = fr_pair_find_by_num(request->control, 0, FR_LOAD_BALANCE_KEY, TAG_ANY)) != NULL) {
hash = fr_hash(vp->vp_strvalue, vp->vp_length);
start = hash % pool->num_home_servers;
break;
* there.
*/
if ((request->listener->type == RAD_LISTEN_DETAIL) &&
- (request->packet->code == PW_CODE_ACCOUNTING_REQUEST) &&
+ (request->packet->code == FR_CODE_ACCOUNTING_REQUEST) &&
(fr_ipaddr_cmp(&home->ipaddr, &request->packet->src_ipaddr) == 0)) {
continue;
}
if (!rd) return NULL;
pool = NULL;
- if (request->packet->code == PW_CODE_ACCESS_REQUEST) {
+ if (request->packet->code == FR_CODE_ACCESS_REQUEST) {
pool = rd->auth_pool;
- } else if (request->packet->code == PW_CODE_ACCOUNTING_REQUEST) {
+ } else if (request->packet->code == FR_CODE_ACCOUNTING_REQUEST) {
pool = rd->acct_pool;
}
if (!pool) return NULL;
/*
* Originate CoA requests only when necessary.
*/
- if ((request->packet->code != PW_CODE_ACCESS_REQUEST) &&
- (request->packet->code != PW_CODE_ACCOUNTING_REQUEST)) return NULL;
+ if ((request->packet->code != FR_CODE_ACCESS_REQUEST) &&
+ (request->packet->code != FR_CODE_ACCOUNTING_REQUEST)) return NULL;
request->coa = request_alloc_fake(request);
if (!request->coa) return NULL;
stopreq = request_alloc_fake(request);
rad_assert(stopreq != NULL);
rad_assert(stopreq->packet != NULL);
- stopreq->packet->code = PW_CODE_ACCOUNTING_REQUEST; /* just to be safe */
+ stopreq->packet->code = FR_CODE_ACCOUNTING_REQUEST; /* just to be safe */
stopreq->listener = request->listener;
/* Hold your breath */
fr_pair_add(&(stopreq->packet->vps), vp); \
} while(0)
- INTPAIR(PW_ACCT_STATUS_TYPE, PW_STATUS_STOP);
- IPPAIR(PW_NAS_IP_ADDRESS, nasaddr);
+ INTPAIR(FR_ACCT_STATUS_TYPE, FR_STATUS_STOP);
+ IPPAIR(FR_NAS_IP_ADDRESS, nasaddr);
- INTPAIR(PW_EVENT_TIMESTAMP, 0);
+ INTPAIR(FR_EVENT_TIMESTAMP, 0);
vp->vp_date = time(NULL);
- INTPAIR(PW_ACCT_DELAY_TIME, 0);
+ INTPAIR(FR_ACCT_DELAY_TIME, 0);
- STRINGPAIR(PW_USER_NAME, user);
+ STRINGPAIR(FR_USER_NAME, user);
stopreq->username = vp;
- INTPAIR(PW_NAS_PORT, nas_port);
- STRINGPAIR(PW_ACCT_SESSION_ID, sessionid);
+ INTPAIR(FR_NAS_PORT, nas_port);
+ STRINGPAIR(FR_ACCT_SESSION_ID, sessionid);
if(proto == 'P') {
- INTPAIR(PW_SERVICE_TYPE, PW_FRAMED_USER);
- INTPAIR(PW_FRAMED_PROTOCOL, PW_PPP);
+ INTPAIR(FR_SERVICE_TYPE, FR_FRAMED_USER);
+ INTPAIR(FR_FRAMED_PROTOCOL, FR_PPP);
} else if(proto == 'S') {
- INTPAIR(PW_SERVICE_TYPE, PW_FRAMED_USER);
- INTPAIR(PW_FRAMED_PROTOCOL, PW_SLIP);
+ INTPAIR(FR_SERVICE_TYPE, FR_FRAMED_USER);
+ INTPAIR(FR_FRAMED_PROTOCOL, FR_SLIP);
} else {
- INTPAIR(PW_SERVICE_TYPE, PW_LOGIN_USER); /* A guess, really */
+ INTPAIR(FR_SERVICE_TYPE, FR_LOGIN_USER); /* A guess, really */
}
if(cliaddr != 0)
- IPPAIR(PW_FRAMED_IP_ADDRESS, cliaddr);
- INTPAIR(PW_ACCT_SESSION_TIME, session_time);
- INTPAIR(PW_ACCT_INPUT_OCTETS, 0);
- INTPAIR(PW_ACCT_OUTPUT_OCTETS, 0);
- INTPAIR(PW_ACCT_INPUT_PACKETS, 0);
- INTPAIR(PW_ACCT_OUTPUT_PACKETS, 0);
+ IPPAIR(FR_FRAMED_IP_ADDRESS, cliaddr);
+ INTPAIR(FR_ACCT_SESSION_TIME, session_time);
+ INTPAIR(FR_ACCT_INPUT_OCTETS, 0);
+ INTPAIR(FR_ACCT_OUTPUT_OCTETS, 0);
+ INTPAIR(FR_ACCT_INPUT_PACKETS, 0);
+ INTPAIR(FR_ACCT_OUTPUT_PACKETS, 0);
stopreq->password = NULL;
#include <freeradius-devel/rad_assert.h>
#include <freeradius-devel/freeradius.snmp.h>
-#define PW_FREERADIUS_SNMP_TYPE_OBJECT 0
+#define FR_FREERADIUS_SNMP_TYPE_OBJECT 0
#define SNMP_MAP_TERMINATOR { .name = NULL, .da = NULL, .type = 0 }
static struct timeval uptime;
static struct timeval reset_time;
-static int reset_state = PW_RADIUS_AUTH_SERV_CONFIG_RESET_VALUE_RUNNING;
+static int reset_state = FR_RADIUS_AUTH_SERV_CONFIG_RESET_VALUE_RUNNING;
static int snmp_value_serv_ident_get(TALLOC_CTX *ctx, fr_value_box_t *out, NDEBUG_UNUSED fr_snmp_map_t const *map,
UNUSED void *snmp_ctx)
rad_assert(map->da->type == FR_TYPE_UINT32);
switch (in->datum.uint32) {
- case PW_RADIUS_AUTH_SERV_CONFIG_RESET_VALUE_RESET:
+ case FR_RADIUS_AUTH_SERV_CONFIG_RESET_VALUE_RESET:
radius_signal_self(RADIUS_SIGNAL_SELF_HUP);
gettimeofday(&reset_time, NULL);
return 0;
default:
- return -(PW_FREERADIUS_SNMP_FAILURE_VALUE_WRONG_VALUE);
+ return -(FR_FREERADIUS_SNMP_FAILURE_VALUE_WRONG_VALUE);
}
}
static fr_snmp_map_t snmp_auth_client_entry_counters[] = {
{ .name = "Radius-Auth-Client-Index",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_INTEGER,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_INTEGER,
.get = snmp_client_index_get },
{ .name = "Radius-Auth-Client-Address",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_IPADDRESS,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_IPADDRESS,
.get = snmp_client_ipv4addr_get },
{ .name = "Radius-Auth-Client-ID",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_STRING,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_STRING,
.get = snmp_client_id_get },
{ .name = "Radius-Auth-Serv-Access-Requests",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
.offset = offsetof(fr_stats_t, total_requests),
.get = snmp_auth_client_stats_offset_get },
{ .name = "Radius-Auth-Serv-Dup-Access-Requests",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
.offset = offsetof(fr_stats_t, total_dup_requests),
.get = snmp_auth_client_stats_offset_get },
{ .name = "Radius-Auth-Serv-Access-Accepts",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
.offset = offsetof(fr_stats_t, total_access_accepts),
.get = snmp_auth_client_stats_offset_get },
{ .name = "Radius-Auth-Serv-Access-Rejects",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
.offset = offsetof(fr_stats_t, total_access_rejects),
.get = snmp_auth_client_stats_offset_get },
{ .name = "Radius-Auth-Serv-Access-Challenges",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
.offset = offsetof(fr_stats_t, total_access_challenges),
.get = snmp_auth_client_stats_offset_get },
{ .name = "Radius-Auth-Serv-Malformed-Access-Requests",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
.offset = offsetof(fr_stats_t, total_malformed_requests),
.get = snmp_auth_client_stats_offset_get },
{ .name = "Radius-Auth-Serv-Bad-Authenticators",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
.offset = offsetof(fr_stats_t, total_bad_authenticators),
.get = snmp_auth_client_stats_offset_get },
{ .name = "Radius-Auth-Serv-Packets-Dropped",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
.offset = offsetof(fr_stats_t, total_packets_dropped),
.get = snmp_auth_client_stats_offset_get },
{ .name = "Radius-Auth-Serv-Unknown-Types",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
.offset = offsetof(fr_stats_t, total_unknown_types),
.get = snmp_auth_client_stats_offset_get },
SNMP_MAP_TERMINATOR
static fr_snmp_map_t snmp_auth_client_entry[] = {
{ .name = "Radius-Auth-Client-Entry",
- .type = PW_FREERADIUS_SNMP_TYPE_OBJECT,
+ .type = FR_FREERADIUS_SNMP_TYPE_OBJECT,
.index = snmp_client_index,
.child = snmp_auth_client_entry_counters },
SNMP_MAP_TERMINATOR
static fr_snmp_map_t snmp_auth_serv_counters[] = {
{ .name = "Radius-Auth-Serv-Ident",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_STRING,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_STRING,
.get = snmp_value_serv_ident_get },
{ .name = "Radius-Auth-Serv-Up-Time",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_TIMETICKS,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_TIMETICKS,
.get = snmp_value_uptime_get },
{ .name = "Radius-Auth-Serv-Reset-Time",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_TIMETICKS,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_TIMETICKS,
.get = snmp_config_reset_time_get},
{ .name = "Radius-Auth-Serv-Config-Reset",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_INTEGER,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_INTEGER,
.get = snmp_config_reset_get,
.set = snmp_config_reset_set },
{ .name = "Radius-Auth-Serv-Total-Access-Requests",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
.offset = offsetof(fr_stats_t, total_requests),
.get = snmp_auth_stats_offset_get },
{ .name = "Radius-Auth-Serv-Total-Invalid-Requests",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
.offset = offsetof(fr_stats_t, total_invalid_requests),
.get = snmp_auth_stats_offset_get },
{ .name = "Radius-Auth-Serv-Total-Dup-Access-Requests",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
.offset = offsetof(fr_stats_t, total_dup_requests),
.get = snmp_auth_stats_offset_get },
{ .name = "Radius-Auth-Serv-Total-Access-Accepts",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
.offset = offsetof(fr_stats_t, total_access_accepts),
.get = snmp_auth_stats_offset_get },
{ .name = "Radius-Auth-Serv-Total-Access-Rejects",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
.offset = offsetof(fr_stats_t, total_access_rejects),
.get = snmp_auth_stats_offset_get },
{ .name = "Radius-Auth-Serv-Total-Access-Challenges",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
.offset = offsetof(fr_stats_t, total_access_challenges),
.get = snmp_auth_stats_offset_get },
{ .name = "Radius-Auth-Serv-Total-Malformed-Access-Requests",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
.offset = offsetof(fr_stats_t, total_malformed_requests),
.get = snmp_auth_stats_offset_get },
{ .name = "Radius-Auth-Serv-Total-Bad-Authenticators",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
.offset = offsetof(fr_stats_t, total_bad_authenticators),
.get = snmp_auth_stats_offset_get },
{ .name = "Radius-Auth-Serv-Total-Packets-Dropped",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
.offset = offsetof(fr_stats_t, total_packets_dropped),
.get = snmp_auth_stats_offset_get },
{ .name = "Radius-Auth-Serv-Total-Unknown-Types",
- .type = PW_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
+ .type = FR_FREERADIUS_SNMP_TYPE_VALUE_COUNTER,
.offset = offsetof(fr_stats_t, total_unknown_types),
.get = snmp_auth_stats_offset_get },
{ .name = "Radius-Auth-Client-table",
- .type = PW_FREERADIUS_SNMP_TYPE_OBJECT,
+ .type = FR_FREERADIUS_SNMP_TYPE_OBJECT,
.child = snmp_auth_client_entry},
SNMP_MAP_TERMINATOR
};
static fr_snmp_map_t snmp_auth_serv[] = {
{ .name = "Radius-Auth-Serv",
- .type = PW_FREERADIUS_SNMP_TYPE_OBJECT,
+ .type = FR_FREERADIUS_SNMP_TYPE_OBJECT,
.child = snmp_auth_serv_counters },
SNMP_MAP_TERMINATOR
};
static fr_snmp_map_t snmp_auth_serv_mib_objects[] = {
{ .name = "Radius-Auth-Serv-Mib-Objects",
- .type = PW_FREERADIUS_SNMP_TYPE_OBJECT,
+ .type = FR_FREERADIUS_SNMP_TYPE_OBJECT,
.child = snmp_auth_serv },
SNMP_MAP_TERMINATOR
};
static fr_snmp_map_t snmp_auth_serv_mib[] = {
{ .name = "Radius-Auth-Serv-Mib",
- .type = PW_FREERADIUS_SNMP_TYPE_OBJECT,
+ .type = FR_FREERADIUS_SNMP_TYPE_OBJECT,
.child = snmp_auth_serv_mib_objects },
SNMP_MAP_TERMINATOR
};
static fr_snmp_map_t snmp_authentication[] = {
{ .name = "Radius-Authentication",
- .type = PW_FREERADIUS_SNMP_TYPE_OBJECT,
+ .type = FR_FREERADIUS_SNMP_TYPE_OBJECT,
.child = snmp_auth_serv_mib },
SNMP_MAP_TERMINATOR
};
static fr_snmp_map_t snmp_radius_mib[] = {
{ .name = "Radius-Mib",
- .type = PW_FREERADIUS_SNMP_TYPE_OBJECT,
+ .type = FR_FREERADIUS_SNMP_TYPE_OBJECT,
.child = snmp_authentication },
SNMP_MAP_TERMINATOR
};
static fr_snmp_map_t snmp_mib_2[] = {
{ .name = "FreeRADIUS-Mib-2",
- .type = PW_FREERADIUS_SNMP_TYPE_OBJECT,
+ .type = FR_FREERADIUS_SNMP_TYPE_OBJECT,
.child = snmp_radius_mib },
SNMP_MAP_TERMINATOR
};
static fr_snmp_map_t snmp_mgmt[] = {
{ .name = "FreeRADIUS-Mgmt",
- .type = PW_FREERADIUS_SNMP_TYPE_OBJECT,
+ .type = FR_FREERADIUS_SNMP_TYPE_OBJECT,
.child = snmp_mib_2 },
SNMP_MAP_TERMINATOR
};
static fr_snmp_map_t snmp_internet[] = {
{ .name = "FreeRADIUS-Internet",
- .type = PW_FREERADIUS_SNMP_TYPE_OBJECT,
+ .type = FR_FREERADIUS_SNMP_TYPE_OBJECT,
.child = snmp_mgmt },
SNMP_MAP_TERMINATOR
};
static fr_snmp_map_t snmp_dod[] = {
{ .name = "FreeRADIUS-Dod",
- .type = PW_FREERADIUS_SNMP_TYPE_OBJECT,
+ .type = FR_FREERADIUS_SNMP_TYPE_OBJECT,
.child = snmp_internet },
SNMP_MAP_TERMINATOR
};
static fr_snmp_map_t snmp_org[] = {
{ .name = "FreeRADIUS-Org",
- .type = PW_FREERADIUS_SNMP_TYPE_OBJECT,
+ .type = FR_FREERADIUS_SNMP_TYPE_OBJECT,
.child = snmp_dod },
SNMP_MAP_TERMINATOR
};
static fr_snmp_map_t snmp_iso[] = {
{ .name = "FreeRADIUS-Iso",
- .type = PW_FREERADIUS_SNMP_TYPE_OBJECT,
+ .type = FR_FREERADIUS_SNMP_TYPE_OBJECT,
.child = snmp_org },
SNMP_MAP_TERMINATOR
};
if (ret > 0) {
talloc_free(tmp_ctx);
- if (snmp_op != PW_FREERADIUS_SNMP_OPERATION_VALUE_GETNEXT) {
+ if (snmp_op != FR_FREERADIUS_SNMP_OPERATION_VALUE_GETNEXT) {
invalid:
fr_strerror_printf("Invalid OID: Match stopped here");
return -(depth);
if (ret < 0) return ret; /* error */
if (ret > 0) { /* findNext */
- if (snmp_op != PW_FREERADIUS_SNMP_OPERATION_VALUE_GETNEXT) goto invalid;
+ if (snmp_op != FR_FREERADIUS_SNMP_OPERATION_VALUE_GETNEXT) goto invalid;
/*
* Rebuild the stack to point to the first
return -(ssize_t)depth;
}
- if (map[1].type != PW_FREERADIUS_SNMP_TYPE_OBJECT) {
+ if (map[1].type != FR_FREERADIUS_SNMP_TYPE_OBJECT) {
fr_strerror_printf("Invalid OID: Cannot traverse leaf");
goto error;
}
snmp_ctx, snmp_op);
if (ret < 0) return ret; /* error */
if (ret > 0) { /* findNext */
- if (snmp_op != PW_FREERADIUS_SNMP_OPERATION_VALUE_GETNEXT) goto invalid;
+ if (snmp_op != FR_FREERADIUS_SNMP_OPERATION_VALUE_GETNEXT) goto invalid;
if (++map_p <= map[0].last) continue;
return 1; /* findNext at lower level */
}
* It's a leaf attribute, call the correct get/set function
*/
switch (snmp_op) {
- case PW_FREERADIUS_SNMP_OPERATION_VALUE_GETNEXT:
+ case FR_FREERADIUS_SNMP_OPERATION_VALUE_GETNEXT:
if (map_p == map[0].last) {
return 1; /* findNext at lower level */
}
* We were called with a leaf map, but advanced
* to a non-leaf map.
*/
- if (map_p->type == PW_FREERADIUS_SNMP_TYPE_OBJECT) {
+ if (map_p->type == FR_FREERADIUS_SNMP_TYPE_OBJECT) {
return snmp_process(out, request, tlv_stack, depth + 1,
cursor, map_p->child, snmp_ctx, snmp_op);
}
}
/* FALL-THROUGH */
- case PW_FREERADIUS_SNMP_OPERATION_VALUE_GET:
+ case FR_FREERADIUS_SNMP_OPERATION_VALUE_GET:
{
fr_value_box_t data;
/*
* Verify map is a leaf
*/
- if (map_p->type == PW_FREERADIUS_SNMP_TYPE_OBJECT) {
+ if (map_p->type == FR_FREERADIUS_SNMP_TYPE_OBJECT) {
fr_strerror_printf("Invalid OID: Is not a leaf node");
goto error;
}
}
return 0;
- case PW_FREERADIUS_SNMP_OPERATION_VALUE_SET:
+ case FR_FREERADIUS_SNMP_OPERATION_VALUE_SET:
{
ssize_t ret;
- if (!map_p->set || (map_p->type == PW_FREERADIUS_SNMP_TYPE_OBJECT)) {
+ if (!map_p->set || (map_p->type == FR_FREERADIUS_SNMP_TYPE_OBJECT)) {
vp = fr_pair_afrom_da(request->reply, fr_snmp_failure);
- vp->vp_uint32 = PW_FREERADIUS_SNMP_FAILURE_VALUE_NOT_WRITABLE;
+ vp->vp_uint32 = FR_FREERADIUS_SNMP_FAILURE_VALUE_NOT_WRITABLE;
fr_pair_cursor_append(out, vp);
return 0;
}
vp = fr_pair_cursor_current(cursor);
ret = map_p->set(map_p, snmp_ctx, &vp->data);
if (ret < 0) switch (-(ret)) {
- case PW_FREERADIUS_SNMP_FAILURE_VALUE_NOT_WRITABLE:
- case PW_FREERADIUS_SNMP_FAILURE_VALUE_WRONG_TYPE:
- case PW_FREERADIUS_SNMP_FAILURE_VALUE_WRONG_LENGTH:
- case PW_FREERADIUS_SNMP_FAILURE_VALUE_WRONG_VALUE:
- case PW_FREERADIUS_SNMP_FAILURE_VALUE_INCONSISTENT_VALUE:
+ case FR_FREERADIUS_SNMP_FAILURE_VALUE_NOT_WRITABLE:
+ case FR_FREERADIUS_SNMP_FAILURE_VALUE_WRONG_TYPE:
+ case FR_FREERADIUS_SNMP_FAILURE_VALUE_WRONG_LENGTH:
+ case FR_FREERADIUS_SNMP_FAILURE_VALUE_WRONG_VALUE:
+ case FR_FREERADIUS_SNMP_FAILURE_VALUE_INCONSISTENT_VALUE:
vp = fr_pair_afrom_da(request->reply, fr_snmp_failure);
vp->vp_uint32 = -(ret);
fr_pair_cursor_append(out, vp);
* case we fake the rest of the stack.
*/
if (!tlv_stack[depth]) {
- if (snmp_op != PW_FREERADIUS_SNMP_OPERATION_VALUE_GETNEXT) {
+ if (snmp_op != FR_FREERADIUS_SNMP_OPERATION_VALUE_GETNEXT) {
fr_strerror_printf("Invalid OID: Not a leaf");
return -(ssize_t)(depth - 1);
}
}
switch (op->vp_uint32) {
- case PW_FREERADIUS_SNMP_OPERATION_VALUE_PING:
- case PW_FREERADIUS_SNMP_OPERATION_VALUE_GET:
- case PW_FREERADIUS_SNMP_OPERATION_VALUE_GETNEXT:
- case PW_FREERADIUS_SNMP_OPERATION_VALUE_SET:
+ case FR_FREERADIUS_SNMP_OPERATION_VALUE_PING:
+ case FR_FREERADIUS_SNMP_OPERATION_VALUE_GET:
+ case FR_FREERADIUS_SNMP_OPERATION_VALUE_GETNEXT:
+ case FR_FREERADIUS_SNMP_OPERATION_VALUE_SET:
break;
default:
unsigned int i;
for (i = 0; map[i].name; i++) {
- if (map[i].type == PW_FREERADIUS_SNMP_TYPE_OBJECT) {
+ if (map[i].type == FR_FREERADIUS_SNMP_TYPE_OBJECT) {
int ret;
rad_assert(map[i].child);
* int the reply, we use that in preference to the
* old state.
*/
- vp = fr_pair_find_by_num(packet->vps, 0, PW_STATE, TAG_ANY);
+ vp = fr_pair_find_by_num(packet->vps, 0, FR_STATE, TAG_ANY);
if (vp) {
if (DEBUG_ENABLED && (vp->vp_length > sizeof(entry->state))) {
WARN("State too long, will be truncated. Expected <= %zd bytes, got %zu bytes",
*/
entry->state_comp.server_id = main_config.state_server_id;
- vp = fr_pair_afrom_num(packet, 0, PW_STATE);
+ vp = fr_pair_afrom_num(packet, 0, FR_STATE);
fr_pair_value_memcpy(vp, entry->state, sizeof(entry->state));
fr_pair_add(&packet->vps, vp);
}
VALUE_PAIR *vp;
fr_state_entry_t *entry, my_entry;
- vp = fr_pair_find_by_num(packet->vps, 0, PW_STATE, TAG_ANY);
+ vp = fr_pair_find_by_num(packet->vps, 0, FR_STATE, TAG_ANY);
if (!vp) return NULL;
if (vp->vp_length != sizeof(my_entry.state)) return NULL;
/*
* No State, don't do anything.
*/
- if (!fr_pair_find_by_num(request->packet->vps, 0, PW_STATE, TAG_ANY)) {
+ if (!fr_pair_find_by_num(request->packet->vps, 0, FR_STATE, TAG_ANY)) {
RDEBUG3("No &request:State attribute, can't restore &session-state");
if (request->seq_start == 0) request->seq_start = request->number; /* Need check for fake requests */
return;
(request->listener->type != RAD_LISTEN_AUTH)) return;
/* don't count statistic requests */
- if (request->packet->code == PW_CODE_STATUS_SERVER)
+ if (request->packet->code == FR_CODE_STATUS_SERVER)
return;
#undef INC_AUTH
* deleted, because only the main server thread calls
* this function, which makes it thread-safe.
*/
- if (request->reply && request->packet && (request->packet->code != PW_CODE_STATUS_SERVER)) switch (request->reply->code) {
- case PW_CODE_ACCESS_ACCEPT:
+ if (request->reply && request->packet && (request->packet->code != FR_CODE_STATUS_SERVER)) switch (request->reply->code) {
+ case FR_CODE_ACCESS_ACCEPT:
INC_AUTH(total_access_accepts);
auth_stats:
&request->reply->timestamp);
break;
- case PW_CODE_ACCESS_REJECT:
+ case FR_CODE_ACCESS_REJECT:
INC_AUTH(total_access_rejects);
goto auth_stats;
- case PW_CODE_ACCESS_CHALLENGE:
+ case FR_CODE_ACCESS_CHALLENGE:
INC_AUTH(total_access_challenges);
goto auth_stats;
#ifdef WITH_ACCOUNTING
- case PW_CODE_ACCOUNTING_RESPONSE:
+ case FR_CODE_ACCOUNTING_RESPONSE:
INC_ACCT(total_responses);
fr_stats_bins(&radius_acct_stats,
&request->packet->timestamp,
#endif
#ifdef WITH_COA
- case PW_CODE_COA_ACK:
+ case FR_CODE_COA_ACK:
INC_COA(total_access_accepts);
coa_stats:
INC_COA(total_responses);
&request->reply->timestamp);
break;
- case PW_CODE_COA_NAK:
+ case FR_CODE_COA_NAK:
INC_COA(total_access_rejects);
goto coa_stats;
- case PW_CODE_DISCONNECT_ACK:
+ case FR_CODE_DISCONNECT_ACK:
INC_DSC(total_access_accepts);
dsc_stats:
INC_DSC(total_responses);
&request->reply->timestamp);
break;
- case PW_CODE_DISCONNECT_NAK:
+ case FR_CODE_DISCONNECT_NAK:
INC_DSC(total_access_rejects);
goto dsc_stats;
#endif
*/
case 0:
switch (request->packet->code) {
- case PW_CODE_ACCESS_REQUEST:
+ case FR_CODE_ACCESS_REQUEST:
if (request->reply->id == -1) {
INC_AUTH(total_bad_authenticators);
} else {
#ifdef WITH_ACCOUNTING
- case PW_CODE_ACCOUNTING_REQUEST:
+ case FR_CODE_ACCOUNTING_REQUEST:
if (request->reply->id == -1) {
INC_ACCT(total_bad_authenticators);
} else {
#endif
#ifdef WITH_COA
- case PW_CODE_COA_REQUEST:
+ case FR_CODE_COA_REQUEST:
if (request->reply->id == -1) {
INC_COA(total_bad_authenticators);
} else {
}
break;
- case PW_CODE_DISCONNECT_REQUEST:
+ case FR_CODE_DISCONNECT_REQUEST:
if (request->reply->id == -1) {
INC_DSC(total_bad_authenticators);
} else {
if (!request->proxy || !request->proxy->home_server) goto done; /* simplifies formatting */
switch (request->proxy->packet->code) {
- case PW_CODE_ACCESS_REQUEST:
+ case FR_CODE_ACCESS_REQUEST:
proxy_auth_stats.total_requests += request->proxy->packet->count;
request->proxy->home_server->stats.total_requests += request->proxy->packet->count;
break;
#ifdef WITH_ACCOUNTING
- case PW_CODE_ACCOUNTING_REQUEST:
+ case FR_CODE_ACCOUNTING_REQUEST:
proxy_acct_stats.total_requests += request->proxy->packet->count;
request->proxy->home_server->stats.total_requests += request->proxy->packet->count;
break;
#endif
#ifdef WITH_COA
- case PW_CODE_COA_REQUEST:
+ case FR_CODE_COA_REQUEST:
proxy_coa_stats.total_requests += request->proxy->packet->count;
request->proxy->home_server->stats.total_requests += request->proxy->packet->count;
break;
- case PW_CODE_DISCONNECT_REQUEST:
+ case FR_CODE_DISCONNECT_REQUEST:
proxy_dsc_stats.total_requests += request->proxy->packet->count;
request->proxy->home_server->stats.total_requests += request->proxy->packet->count;
break;
#define INC(_x) proxy_auth_stats._x += request->proxy->reply->count; request->proxy->home_server->stats._x += request->proxy->reply->count;
switch (request->proxy->reply->code) {
- case PW_CODE_ACCESS_ACCEPT:
+ case FR_CODE_ACCESS_ACCEPT:
INC(total_access_accepts);
proxy_stats:
INC(total_responses);
&request->proxy->reply->timestamp);
break;
- case PW_CODE_ACCESS_REJECT:
+ case FR_CODE_ACCESS_REJECT:
INC(total_access_rejects);
goto proxy_stats;
- case PW_CODE_ACCESS_CHALLENGE:
+ case FR_CODE_ACCESS_CHALLENGE:
INC(total_access_challenges);
goto proxy_stats;
#ifdef WITH_ACCOUNTING
- case PW_CODE_ACCOUNTING_RESPONSE:
+ case FR_CODE_ACCOUNTING_RESPONSE:
proxy_acct_stats.total_responses++;
request->proxy->home_server->stats.total_responses++;
fr_stats_bins(&proxy_acct_stats,
#endif
#ifdef WITH_COA
- case PW_CODE_COA_ACK:
- case PW_CODE_COA_NAK:
+ case FR_CODE_COA_ACK:
+ case FR_CODE_COA_NAK:
proxy_coa_stats.total_responses++;
request->proxy->home_server->stats.total_responses++;
fr_stats_bins(&proxy_coa_stats,
&request->proxy->reply->timestamp);
break;
- case PW_CODE_DISCONNECT_ACK:
- case PW_CODE_DISCONNECT_NAK:
+ case FR_CODE_DISCONNECT_ACK:
+ case FR_CODE_DISCONNECT_NAK:
proxy_dsc_stats.total_responses++;
request->proxy->home_server->stats.total_responses++;
fr_stats_bins(&proxy_dsc_stats,
* Authentication
*/
static fr_stats2vp authvp[] = {
- { PW_FREERADIUS_TOTAL_ACCESS_REQUESTS, offsetof(fr_stats_t, total_requests) },
- { PW_FREERADIUS_TOTAL_ACCESS_ACCEPTS, offsetof(fr_stats_t, total_access_accepts) },
- { PW_FREERADIUS_TOTAL_ACCESS_REJECTS, offsetof(fr_stats_t, total_access_rejects) },
- { PW_FREERADIUS_TOTAL_ACCESS_CHALLENGES, offsetof(fr_stats_t, total_access_challenges) },
- { PW_FREERADIUS_TOTAL_AUTH_RESPONSES, offsetof(fr_stats_t, total_responses) },
- { PW_FREERADIUS_TOTAL_AUTH_DUPLICATE_REQUESTS, offsetof(fr_stats_t, total_dup_requests) },
- { PW_FREERADIUS_TOTAL_AUTH_MALFORMED_REQUESTS, offsetof(fr_stats_t, total_malformed_requests) },
- { PW_FREERADIUS_TOTAL_AUTH_INVALID_REQUESTS, offsetof(fr_stats_t, total_bad_authenticators) },
- { PW_FREERADIUS_TOTAL_AUTH_DROPPED_REQUESTS, offsetof(fr_stats_t, total_packets_dropped) },
- { PW_FREERADIUS_TOTAL_AUTH_UNKNOWN_TYPES, offsetof(fr_stats_t, total_unknown_types) },
+ { FR_FREERADIUS_TOTAL_ACCESS_REQUESTS, offsetof(fr_stats_t, total_requests) },
+ { FR_FREERADIUS_TOTAL_ACCESS_ACCEPTS, offsetof(fr_stats_t, total_access_accepts) },
+ { FR_FREERADIUS_TOTAL_ACCESS_REJECTS, offsetof(fr_stats_t, total_access_rejects) },
+ { FR_FREERADIUS_TOTAL_ACCESS_CHALLENGES, offsetof(fr_stats_t, total_access_challenges) },
+ { FR_FREERADIUS_TOTAL_AUTH_RESPONSES, offsetof(fr_stats_t, total_responses) },
+ { FR_FREERADIUS_TOTAL_AUTH_DUPLICATE_REQUESTS, offsetof(fr_stats_t, total_dup_requests) },
+ { FR_FREERADIUS_TOTAL_AUTH_MALFORMED_REQUESTS, offsetof(fr_stats_t, total_malformed_requests) },
+ { FR_FREERADIUS_TOTAL_AUTH_INVALID_REQUESTS, offsetof(fr_stats_t, total_bad_authenticators) },
+ { FR_FREERADIUS_TOTAL_AUTH_DROPPED_REQUESTS, offsetof(fr_stats_t, total_packets_dropped) },
+ { FR_FREERADIUS_TOTAL_AUTH_UNKNOWN_TYPES, offsetof(fr_stats_t, total_unknown_types) },
{ 0, 0 }
};
* Proxied authentication requests.
*/
static fr_stats2vp proxy_authvp[] = {
- { PW_FREERADIUS_TOTAL_PROXY_ACCESS_REQUESTS, offsetof(fr_stats_t, total_requests) },
- { PW_FREERADIUS_TOTAL_PROXY_ACCESS_ACCEPTS, offsetof(fr_stats_t, total_access_accepts) },
- { PW_FREERADIUS_TOTAL_PROXY_ACCESS_REJECTS, offsetof(fr_stats_t, total_access_rejects) },
- { PW_FREERADIUS_TOTAL_PROXY_ACCESS_CHALLENGES, offsetof(fr_stats_t, total_access_challenges) },
- { PW_FREERADIUS_TOTAL_PROXY_AUTH_RESPONSES, offsetof(fr_stats_t, total_responses) },
- { PW_FREERADIUS_TOTAL_PROXY_AUTH_DUPLICATE_REQUESTS, offsetof(fr_stats_t, total_dup_requests) },
- { PW_FREERADIUS_TOTAL_PROXY_AUTH_MALFORMED_REQUESTS, offsetof(fr_stats_t, total_malformed_requests) },
- { PW_FREERADIUS_TOTAL_PROXY_AUTH_INVALID_REQUESTS, offsetof(fr_stats_t, total_bad_authenticators) },
- { PW_FREERADIUS_TOTAL_PROXY_AUTH_DROPPED_REQUESTS, offsetof(fr_stats_t, total_packets_dropped) },
- { PW_FREERADIUS_TOTAL_PROXY_AUTH_UNKNOWN_TYPES, offsetof(fr_stats_t, total_unknown_types) },
+ { FR_FREERADIUS_TOTAL_PROXY_ACCESS_REQUESTS, offsetof(fr_stats_t, total_requests) },
+ { FR_FREERADIUS_TOTAL_PROXY_ACCESS_ACCEPTS, offsetof(fr_stats_t, total_access_accepts) },
+ { FR_FREERADIUS_TOTAL_PROXY_ACCESS_REJECTS, offsetof(fr_stats_t, total_access_rejects) },
+ { FR_FREERADIUS_TOTAL_PROXY_ACCESS_CHALLENGES, offsetof(fr_stats_t, total_access_challenges) },
+ { FR_FREERADIUS_TOTAL_PROXY_AUTH_RESPONSES, offsetof(fr_stats_t, total_responses) },
+ { FR_FREERADIUS_TOTAL_PROXY_AUTH_DUPLICATE_REQUESTS, offsetof(fr_stats_t, total_dup_requests) },
+ { FR_FREERADIUS_TOTAL_PROXY_AUTH_MALFORMED_REQUESTS, offsetof(fr_stats_t, total_malformed_requests) },
+ { FR_FREERADIUS_TOTAL_PROXY_AUTH_INVALID_REQUESTS, offsetof(fr_stats_t, total_bad_authenticators) },
+ { FR_FREERADIUS_TOTAL_PROXY_AUTH_DROPPED_REQUESTS, offsetof(fr_stats_t, total_packets_dropped) },
+ { FR_FREERADIUS_TOTAL_PROXY_AUTH_UNKNOWN_TYPES, offsetof(fr_stats_t, total_unknown_types) },
{ 0, 0 }
};
#endif
* Accounting
*/
static fr_stats2vp acctvp[] = {
- { PW_FREERADIUS_TOTAL_ACCOUNTING_REQUESTS, offsetof(fr_stats_t, total_requests) },
- { PW_FREERADIUS_TOTAL_ACCOUNTING_RESPONSES, offsetof(fr_stats_t, total_responses) },
- { PW_FREERADIUS_TOTAL_ACCT_DUPLICATE_REQUESTS, offsetof(fr_stats_t, total_dup_requests) },
- { PW_FREERADIUS_TOTAL_ACCT_MALFORMED_REQUESTS, offsetof(fr_stats_t, total_malformed_requests) },
- { PW_FREERADIUS_TOTAL_ACCT_INVALID_REQUESTS, offsetof(fr_stats_t, total_bad_authenticators) },
- { PW_FREERADIUS_TOTAL_ACCT_DROPPED_REQUESTS, offsetof(fr_stats_t, total_packets_dropped) },
- { PW_FREERADIUS_TOTAL_ACCT_UNKNOWN_TYPES, offsetof(fr_stats_t, total_unknown_types) },
+ { FR_FREERADIUS_TOTAL_ACCOUNTING_REQUESTS, offsetof(fr_stats_t, total_requests) },
+ { FR_FREERADIUS_TOTAL_ACCOUNTING_RESPONSES, offsetof(fr_stats_t, total_responses) },
+ { FR_FREERADIUS_TOTAL_ACCT_DUPLICATE_REQUESTS, offsetof(fr_stats_t, total_dup_requests) },
+ { FR_FREERADIUS_TOTAL_ACCT_MALFORMED_REQUESTS, offsetof(fr_stats_t, total_malformed_requests) },
+ { FR_FREERADIUS_TOTAL_ACCT_INVALID_REQUESTS, offsetof(fr_stats_t, total_bad_authenticators) },
+ { FR_FREERADIUS_TOTAL_ACCT_DROPPED_REQUESTS, offsetof(fr_stats_t, total_packets_dropped) },
+ { FR_FREERADIUS_TOTAL_ACCT_UNKNOWN_TYPES, offsetof(fr_stats_t, total_unknown_types) },
{ 0, 0 }
};
#ifdef WITH_PROXY
static fr_stats2vp proxy_acctvp[] = {
- { PW_FREERADIUS_TOTAL_PROXY_ACCOUNTING_REQUESTS, offsetof(fr_stats_t, total_requests) },
- { PW_FREERADIUS_TOTAL_PROXY_ACCOUNTING_RESPONSES, offsetof(fr_stats_t, total_responses) },
- { PW_FREERADIUS_TOTAL_PROXY_ACCT_DUPLICATE_REQUESTS, offsetof(fr_stats_t, total_dup_requests) },
- { PW_FREERADIUS_TOTAL_PROXY_ACCT_MALFORMED_REQUESTS, offsetof(fr_stats_t, total_malformed_requests) },
- { PW_FREERADIUS_TOTAL_PROXY_ACCT_INVALID_REQUESTS, offsetof(fr_stats_t, total_bad_authenticators) },
- { PW_FREERADIUS_TOTAL_PROXY_ACCT_DROPPED_REQUESTS, offsetof(fr_stats_t, total_packets_dropped) },
- { PW_FREERADIUS_TOTAL_PROXY_ACCT_UNKNOWN_TYPES, offsetof(fr_stats_t, total_unknown_types) },
+ { FR_FREERADIUS_TOTAL_PROXY_ACCOUNTING_REQUESTS, offsetof(fr_stats_t, total_requests) },
+ { FR_FREERADIUS_TOTAL_PROXY_ACCOUNTING_RESPONSES, offsetof(fr_stats_t, total_responses) },
+ { FR_FREERADIUS_TOTAL_PROXY_ACCT_DUPLICATE_REQUESTS, offsetof(fr_stats_t, total_dup_requests) },
+ { FR_FREERADIUS_TOTAL_PROXY_ACCT_MALFORMED_REQUESTS, offsetof(fr_stats_t, total_malformed_requests) },
+ { FR_FREERADIUS_TOTAL_PROXY_ACCT_INVALID_REQUESTS, offsetof(fr_stats_t, total_bad_authenticators) },
+ { FR_FREERADIUS_TOTAL_PROXY_ACCT_DROPPED_REQUESTS, offsetof(fr_stats_t, total_packets_dropped) },
+ { FR_FREERADIUS_TOTAL_PROXY_ACCT_UNKNOWN_TYPES, offsetof(fr_stats_t, total_unknown_types) },
{ 0, 0 }
};
#endif
#endif
static fr_stats2vp client_authvp[] = {
- { PW_FREERADIUS_TOTAL_ACCESS_REQUESTS, offsetof(fr_stats_t, total_requests) },
- { PW_FREERADIUS_TOTAL_ACCESS_ACCEPTS, offsetof(fr_stats_t, total_access_accepts) },
- { PW_FREERADIUS_TOTAL_ACCESS_REJECTS, offsetof(fr_stats_t, total_access_rejects) },
- { PW_FREERADIUS_TOTAL_ACCESS_CHALLENGES, offsetof(fr_stats_t, total_access_challenges) },
- { PW_FREERADIUS_TOTAL_AUTH_RESPONSES, offsetof(fr_stats_t, total_responses) },
- { PW_FREERADIUS_TOTAL_AUTH_DUPLICATE_REQUESTS, offsetof(fr_stats_t, total_dup_requests) },
- { PW_FREERADIUS_TOTAL_AUTH_MALFORMED_REQUESTS, offsetof(fr_stats_t, total_malformed_requests) },
- { PW_FREERADIUS_TOTAL_AUTH_INVALID_REQUESTS, offsetof(fr_stats_t, total_bad_authenticators) },
- { PW_FREERADIUS_TOTAL_AUTH_DROPPED_REQUESTS, offsetof(fr_stats_t, total_packets_dropped) },
- { PW_FREERADIUS_TOTAL_AUTH_UNKNOWN_TYPES, offsetof(fr_stats_t, total_unknown_types) },
+ { FR_FREERADIUS_TOTAL_ACCESS_REQUESTS, offsetof(fr_stats_t, total_requests) },
+ { FR_FREERADIUS_TOTAL_ACCESS_ACCEPTS, offsetof(fr_stats_t, total_access_accepts) },
+ { FR_FREERADIUS_TOTAL_ACCESS_REJECTS, offsetof(fr_stats_t, total_access_rejects) },
+ { FR_FREERADIUS_TOTAL_ACCESS_CHALLENGES, offsetof(fr_stats_t, total_access_challenges) },
+ { FR_FREERADIUS_TOTAL_AUTH_RESPONSES, offsetof(fr_stats_t, total_responses) },
+ { FR_FREERADIUS_TOTAL_AUTH_DUPLICATE_REQUESTS, offsetof(fr_stats_t, total_dup_requests) },
+ { FR_FREERADIUS_TOTAL_AUTH_MALFORMED_REQUESTS, offsetof(fr_stats_t, total_malformed_requests) },
+ { FR_FREERADIUS_TOTAL_AUTH_INVALID_REQUESTS, offsetof(fr_stats_t, total_bad_authenticators) },
+ { FR_FREERADIUS_TOTAL_AUTH_DROPPED_REQUESTS, offsetof(fr_stats_t, total_packets_dropped) },
+ { FR_FREERADIUS_TOTAL_AUTH_UNKNOWN_TYPES, offsetof(fr_stats_t, total_unknown_types) },
{ 0, 0 }
};
#ifdef WITH_ACCOUNTING
static fr_stats2vp client_acctvp[] = {
- { PW_FREERADIUS_TOTAL_ACCOUNTING_REQUESTS, offsetof(fr_stats_t, total_requests) },
- { PW_FREERADIUS_TOTAL_ACCOUNTING_RESPONSES, offsetof(fr_stats_t, total_responses) },
- { PW_FREERADIUS_TOTAL_ACCT_DUPLICATE_REQUESTS, offsetof(fr_stats_t, total_dup_requests) },
- { PW_FREERADIUS_TOTAL_ACCT_MALFORMED_REQUESTS, offsetof(fr_stats_t, total_malformed_requests) },
- { PW_FREERADIUS_TOTAL_ACCT_INVALID_REQUESTS, offsetof(fr_stats_t, total_bad_authenticators) },
- { PW_FREERADIUS_TOTAL_ACCT_DROPPED_REQUESTS, offsetof(fr_stats_t, total_packets_dropped) },
- { PW_FREERADIUS_TOTAL_ACCT_UNKNOWN_TYPES, offsetof(fr_stats_t, total_unknown_types) },
+ { FR_FREERADIUS_TOTAL_ACCOUNTING_REQUESTS, offsetof(fr_stats_t, total_requests) },
+ { FR_FREERADIUS_TOTAL_ACCOUNTING_RESPONSES, offsetof(fr_stats_t, total_responses) },
+ { FR_FREERADIUS_TOTAL_ACCT_DUPLICATE_REQUESTS, offsetof(fr_stats_t, total_dup_requests) },
+ { FR_FREERADIUS_TOTAL_ACCT_MALFORMED_REQUESTS, offsetof(fr_stats_t, total_malformed_requests) },
+ { FR_FREERADIUS_TOTAL_ACCT_INVALID_REQUESTS, offsetof(fr_stats_t, total_bad_authenticators) },
+ { FR_FREERADIUS_TOTAL_ACCT_DROPPED_REQUESTS, offsetof(fr_stats_t, total_packets_dropped) },
+ { FR_FREERADIUS_TOTAL_ACCT_UNKNOWN_TYPES, offsetof(fr_stats_t, total_unknown_types) },
{ 0, 0 }
};
#endif
/*
* Statistics are available ONLY on a "status" port.
*/
- rad_assert(request->packet->code == PW_CODE_STATUS_SERVER);
+ rad_assert(request->packet->code == FR_CODE_STATUS_SERVER);
rad_assert(request->listener->type == RAD_LISTEN_NONE);
- flag = fr_pair_find_by_num(request->packet->vps, VENDORPEC_FREERADIUS, PW_FREERADIUS_STATISTICS_TYPE, TAG_ANY);
+ flag = fr_pair_find_by_num(request->packet->vps, VENDORPEC_FREERADIUS, FR_FREERADIUS_STATISTICS_TYPE, TAG_ANY);
if (!flag || (flag->vp_uint32 == 0)) return;
/*
*/
if ((flag->vp_uint32 & 0x10) != 0) {
vp = radius_pair_create(request->reply, &request->reply->vps,
- PW_FREERADIUS_STATS_START_TIME, VENDORPEC_FREERADIUS);
+ FR_FREERADIUS_STATS_START_TIME, VENDORPEC_FREERADIUS);
if (vp) vp->vp_date = start_time.tv_sec;
vp = radius_pair_create(request->reply, &request->reply->vps,
- PW_FREERADIUS_STATS_HUP_TIME, VENDORPEC_FREERADIUS);
+ FR_FREERADIUS_STATS_HUP_TIME, VENDORPEC_FREERADIUS);
if (vp) vp->vp_date = hup_time.tv_sec;
}
* socket.
*/
server_ip = fr_pair_find_by_num(request->packet->vps, VENDORPEC_FREERADIUS,
- PW_FREERADIUS_STATS_SERVER_IP_ADDRESS, TAG_ANY);
+ FR_FREERADIUS_STATS_SERVER_IP_ADDRESS, TAG_ANY);
if (server_ip) {
server_port = fr_pair_find_by_num(request->packet->vps, VENDORPEC_FREERADIUS,
- PW_FREERADIUS_STATS_SERVER_PORT, TAG_ANY);
+ FR_FREERADIUS_STATS_SERVER_PORT, TAG_ANY);
if (server_port) {
ipaddr.af = AF_INET;
vp = fr_pair_find_by_num(request->packet->vps, VENDORPEC_FREERADIUS,
- PW_FREERADIUS_STATS_CLIENT_IP_ADDRESS, TAG_ANY);
+ FR_FREERADIUS_STATS_CLIENT_IP_ADDRESS, TAG_ANY);
if (vp) {
memset(&ipaddr, 0, sizeof(ipaddr));
ipaddr.af = AF_INET;
* Else look it up by number.
*/
} else if ((vp = fr_pair_find_by_num(request->packet->vps, VENDORPEC_FREERADIUS,
- PW_FREERADIUS_STATS_CLIENT_NUMBER, TAG_ANY)) != NULL) {
+ FR_FREERADIUS_STATS_CLIENT_NUMBER, TAG_ANY)) != NULL) {
client = client_findbynumber(cl, vp->vp_uint32);
}
(client->ipaddr.af == AF_INET)) {
vp = radius_pair_create(request->reply,
&request->reply->vps,
- PW_FREERADIUS_STATS_CLIENT_IP_ADDRESS, VENDORPEC_FREERADIUS);
+ FR_FREERADIUS_STATS_CLIENT_IP_ADDRESS, VENDORPEC_FREERADIUS);
if (vp) {
vp->vp_ipv4addr = client->ipaddr.addr.v4.s_addr;
}
if (client->ipaddr.prefix != 32) {
vp = radius_pair_create(request->reply,
&request->reply->vps,
- PW_FREERADIUS_STATS_CLIENT_NETMASK, VENDORPEC_FREERADIUS);
+ FR_FREERADIUS_STATS_CLIENT_NETMASK, VENDORPEC_FREERADIUS);
if (vp) {
vp->vp_uint32 = client->ipaddr.prefix;
}
* socket.
*/
server_ip = fr_pair_find_by_num(request->packet->vps, VENDORPEC_FREERADIUS,
- PW_FREERADIUS_STATS_SERVER_IP_ADDRESS, TAG_ANY);
+ FR_FREERADIUS_STATS_SERVER_IP_ADDRESS, TAG_ANY);
if (!server_ip) return;
server_port = fr_pair_find_by_num(request->packet->vps, VENDORPEC_FREERADIUS,
- PW_FREERADIUS_STATS_SERVER_PORT, TAG_ANY);
+ FR_FREERADIUS_STATS_SERVER_PORT, TAG_ANY);
if (!server_port) return;
ipaddr.af = AF_INET;
* socket.
*/
server_ip = fr_pair_find_by_num(request->packet->vps, VENDORPEC_FREERADIUS,
- PW_FREERADIUS_STATS_SERVER_IP_ADDRESS, TAG_ANY);
+ FR_FREERADIUS_STATS_SERVER_IP_ADDRESS, TAG_ANY);
if (!server_ip) return;
server_port = fr_pair_find_by_num(request->packet->vps, VENDORPEC_FREERADIUS,
- PW_FREERADIUS_STATS_SERVER_PORT, TAG_ANY);
+ FR_FREERADIUS_STATS_SERVER_PORT, TAG_ANY);
if (!server_port) return;
#ifndef NDEBUG
fr_pair_copy(request->reply, server_port));
vp = radius_pair_create(request->reply, &request->reply->vps,
- PW_FREERADIUS_STATS_SERVER_OUTSTANDING_REQUESTS, VENDORPEC_FREERADIUS);
+ FR_FREERADIUS_STATS_SERVER_OUTSTANDING_REQUESTS, VENDORPEC_FREERADIUS);
if (vp) vp->vp_uint32 = home->currently_outstanding;
vp = radius_pair_create(request->reply, &request->reply->vps,
- PW_FREERADIUS_STATS_SERVER_STATE, VENDORPEC_FREERADIUS);
+ FR_FREERADIUS_STATS_SERVER_STATE, VENDORPEC_FREERADIUS);
if (vp) vp->vp_uint32 = home->state;
if ((home->state == HOME_STATE_ALIVE) &&
(home->revive_time.tv_sec != 0)) {
vp = radius_pair_create(request->reply, &request->reply->vps,
- PW_FREERADIUS_STATS_SERVER_TIME_OF_LIFE, VENDORPEC_FREERADIUS);
+ FR_FREERADIUS_STATS_SERVER_TIME_OF_LIFE, VENDORPEC_FREERADIUS);
if (vp) vp->vp_date = home->revive_time.tv_sec;
}
(home->ema.window > 0)) {
vp = radius_pair_create(request->reply,
&request->reply->vps,
- PW_FREERADIUS_SERVER_EMA_WINDOW, VENDORPEC_FREERADIUS);
+ FR_FREERADIUS_SERVER_EMA_WINDOW, VENDORPEC_FREERADIUS);
if (vp) vp->vp_uint32 = home->ema.window;
vp = radius_pair_create(request->reply,
&request->reply->vps,
- PW_FREERADIUS_SERVER_EMA_USEC_WINDOW_1, VENDORPEC_FREERADIUS);
+ FR_FREERADIUS_SERVER_EMA_USEC_WINDOW_1, VENDORPEC_FREERADIUS);
if (vp) vp->vp_uint32 = home->ema.ema1 / EMA_SCALE;
vp = radius_pair_create(request->reply,
&request->reply->vps,
- PW_FREERADIUS_SERVER_EMA_USEC_WINDOW_10, VENDORPEC_FREERADIUS);
+ FR_FREERADIUS_SERVER_EMA_USEC_WINDOW_10, VENDORPEC_FREERADIUS);
if (vp) vp->vp_uint32 = home->ema.ema10 / EMA_SCALE;
}
if (home->state == HOME_STATE_IS_DEAD) {
vp = radius_pair_create(request->reply, &request->reply->vps,
- PW_FREERADIUS_STATS_SERVER_TIME_OF_DEATH, VENDORPEC_FREERADIUS);
+ FR_FREERADIUS_STATS_SERVER_TIME_OF_DEATH, VENDORPEC_FREERADIUS);
if (vp) vp->vp_date = home->zombie_period_start.tv_sec + home->zombie_period;
}
* FIXME: do this for clients, too!
*/
vp = radius_pair_create(request->reply, &request->reply->vps,
- PW_FREERADIUS_STATS_LAST_PACKET_RECV, VENDORPEC_FREERADIUS);
+ FR_FREERADIUS_STATS_LAST_PACKET_RECV, VENDORPEC_FREERADIUS);
if (vp) vp->vp_date = home->last_packet_recv;
vp = radius_pair_create(request->reply, &request->reply->vps,
- PW_FREERADIUS_STATS_LAST_PACKET_SENT, VENDORPEC_FREERADIUS);
+ FR_FREERADIUS_STATS_LAST_PACKET_SENT, VENDORPEC_FREERADIUS);
if (vp) vp->vp_date = home->last_packet_sent;
if (((flag->vp_uint32 & 0x01) != 0) &&
{
VALUE_PAIR *vp;
- fr_pair_delete_by_num(&request->packet->vps, 0, PW_TLS_SESSION_ID, TAG_ANY);
+ fr_pair_delete_by_num(&request->packet->vps, 0, FR_TLS_SESSION_ID, TAG_ANY);
RDEBUG2("Setting TLS cache control attributes");
- vp = fr_pair_afrom_num(request->packet, 0, PW_TLS_SESSION_ID);
+ vp = fr_pair_afrom_num(request->packet, 0, FR_TLS_SESSION_ID);
if (!vp) return -1;
fr_pair_value_memcpy(vp, key, key_len);
rdebug_pair(L_DBG_LVL_2, request, vp, NULL);
REXDENT();
- vp = fr_pair_afrom_num(request, 0, PW_TLS_CACHE_ACTION);
+ vp = fr_pair_afrom_num(request, 0, FR_TLS_CACHE_ACTION);
if (!vp) return -1;
vp->vp_uint32 = action;
/*
* Indicate what action we're performing
*/
- vp = fr_pair_afrom_num(request, 0, PW_TLS_CACHE_ACTION);
+ vp = fr_pair_afrom_num(request, 0, FR_TLS_CACHE_ACTION);
if (!vp) return -1;
vp->vp_uint32 = autz_type;
request->module = module;
request->component = component;
- fr_pair_delete_by_num(&request->control, 0, PW_TLS_CACHE_ACTION, TAG_ANY);
+ fr_pair_delete_by_num(&request->control, 0, FR_TLS_CACHE_ACTION, TAG_ANY);
return rcode;
}
/*
* Put the SSL data into an attribute.
*/
- vp = fr_pair_afrom_num(request->state_ctx, 0, PW_TLS_SESSION_DATA);
+ vp = fr_pair_afrom_num(request->state_ctx, 0, FR_TLS_SESSION_DATA);
if (!vp) {
REDEBUG("%s", fr_strerror());
return -1;
/*
* Ensure that the session data can't be used by anyone else.
*/
- fr_pair_delete_by_num(&request->state, 0, PW_TLS_SESSION_DATA, TAG_ANY);
+ fr_pair_delete_by_num(&request->state, 0, FR_TLS_SESSION_DATA, TAG_ANY);
return ret;
}
return NULL;
}
- vp = fr_pair_find_by_num(request->state, 0, PW_TLS_SESSION_DATA, TAG_ANY);
+ vp = fr_pair_find_by_num(request->state, 0, FR_TLS_SESSION_DATA, TAG_ANY);
if (!vp) {
RWDEBUG("No cached session found");
return NULL;
/*
* Ensure that the session data can't be used by anyone else.
*/
- fr_pair_delete_by_num(&request->state, 0, PW_TLS_SESSION_DATA, TAG_ANY);
+ fr_pair_delete_by_num(&request->state, 0, FR_TLS_SESSION_DATA, TAG_ANY);
return sess;
}
*/
if (!session->allow_session_resumption) goto disable;
- vp = fr_pair_find_by_num(request->control, 0, PW_ALLOW_SESSION_RESUMPTION, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_ALLOW_SESSION_RESUMPTION, TAG_ANY);
if (vp && (vp->vp_uint32 == 0)) {
RDEBUG2("&control:Allow-Session-Resumption == no, disabling session resumption");
disable:
/*
* Allow us to cache the OCSP verified state externally
*/
- vp = fr_pair_find_by_num(request->control, 0, PW_TLS_OCSP_CERT_VALID, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_TLS_OCSP_CERT_VALID, TAG_ANY);
if (vp) switch (vp->vp_uint32) {
case 0: /* no */
RDEBUG2("Found &control:TLS-OCSP-Cert-Valid = no, forcing OCSP failure");
* we need to run the full OCSP check.
*/
if (staple_response) {
- vp = fr_pair_find_by_num(request->control, 0, PW_TLS_OCSP_RESPONSE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_TLS_OCSP_RESPONSE, TAG_ANY);
if (!vp) {
RDEBUG2("No &control:TLS-OCSP-Response attribute found, performing full OCSP check");
break;
* Add expiration as a time since the epoch
*/
if ((attr_index == 0) && (tls_utils_asn1time_to_epoch(&expires, asn_time) == 0)) {
- vp = fr_pair_afrom_num(ctx, 0, PW_TLS_CLIENT_CERT_EXPIRATION_TIME);
+ vp = fr_pair_afrom_num(ctx, 0, FR_TLS_CLIENT_CERT_EXPIRATION_TIME);
if (vp) {
vp->vp_date = expires;
fr_pair_cursor_append(cursor, vp);
/*
* Add the session certificate to the session.
*/
- vp = fr_pair_find_by_num(request->control, 0, PW_TLS_SESSION_CERT_FILE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_TLS_SESSION_CERT_FILE, TAG_ANY);
if (vp) {
RDEBUG2("Loading TLS session certificate \"%s\"", vp->vp_strvalue);
* just too much.
*/
session->mtu = conf->fragment_size;
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_FRAMED_MTU, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_FRAMED_MTU, TAG_ANY);
if (vp && (vp->vp_uint32 > 100) && (vp->vp_uint32 < session->mtu)) {
RDEBUG2("Setting fragment_len from &Framed-MTU");
session->mtu = vp->vp_uint32;
* set.
*/
switch (packet->code) {
- case PW_CODE_ACCESS_REQUEST:
+ case FR_CODE_ACCESS_REQUEST:
if (listener->type != RAD_LISTEN_AUTH) goto bad_packet;
FR_STATS_INC(auth, total_requests);
fun = rad_authenticate;
break;
#ifdef WITH_ACCOUNTING
- case PW_CODE_ACCOUNTING_REQUEST:
+ case FR_CODE_ACCOUNTING_REQUEST:
if (listener->type != RAD_LISTEN_ACCT) {
/*
* Allow auth + dual. Disallow
break;
#endif
- case PW_CODE_STATUS_SERVER:
+ case FR_CODE_STATUS_SERVER:
if (!main_config.status_server) {
FR_STATS_INC(auth, total_unknown_types);
WARN("Ignoring Status-Server request due to security configuration");
* FIXME: Client MIB updates?
*/
switch (packet->code) {
- case PW_CODE_ACCESS_ACCEPT:
- case PW_CODE_ACCESS_CHALLENGE:
- case PW_CODE_ACCESS_REJECT:
+ case FR_CODE_ACCESS_ACCEPT:
+ case FR_CODE_ACCESS_CHALLENGE:
+ case FR_CODE_ACCESS_REJECT:
break;
#ifdef WITH_ACCOUNTING
- case PW_CODE_ACCOUNTING_RESPONSE:
+ case FR_CODE_ACCOUNTING_RESPONSE:
break;
#endif
#ifdef WITH_COA
case PAIR_LIST_COA:
if (request->coa &&
- (request->coa->proxy->packet->code == PW_CODE_COA_REQUEST)) {
+ (request->coa->proxy->packet->code == FR_CODE_COA_REQUEST)) {
return &request->coa->proxy->packet->vps;
}
break;
case PAIR_LIST_COA_REPLY:
if (request->coa && /* match reply with request */
- (request->coa->proxy->packet->code == PW_CODE_COA_REQUEST) &&
+ (request->coa->proxy->packet->code == FR_CODE_COA_REQUEST) &&
request->coa->proxy->reply) {
return &request->coa->proxy->reply->vps;
}
case PAIR_LIST_DM:
if (request->coa &&
- (request->coa->proxy->packet->code == PW_CODE_DISCONNECT_REQUEST)) {
+ (request->coa->proxy->packet->code == FR_CODE_DISCONNECT_REQUEST)) {
return &request->coa->proxy->packet->vps;
}
break;
case PAIR_LIST_DM_REPLY:
if (request->coa && /* match reply with request */
- (request->coa->proxy->packet->code == PW_CODE_DISCONNECT_REQUEST) &&
+ (request->coa->proxy->packet->code == FR_CODE_DISCONNECT_REQUEST) &&
request->coa->proxy->reply) {
return &request->coa->proxy->reply->vps;
}
case PAIR_LIST_COA:
if (!request->coa) return NULL;
rad_assert(request->coa->proxy != NULL);
- if (request->coa->proxy->packet->code != PW_CODE_COA_REQUEST) return NULL;
+ if (request->coa->proxy->packet->code != FR_CODE_COA_REQUEST) return NULL;
return request->coa->proxy->packet;
case PAIR_LIST_COA_REPLY:
if (!request->coa) return NULL;
rad_assert(request->coa->proxy != NULL);
- if (request->coa->proxy->packet->code != PW_CODE_COA_REQUEST) return NULL;
+ if (request->coa->proxy->packet->code != FR_CODE_COA_REQUEST) return NULL;
return request->coa->proxy->reply;
case PAIR_LIST_DM:
if (!request->coa) return NULL;
rad_assert(request->coa->proxy != NULL);
- if (request->coa->proxy->packet->code != PW_CODE_DISCONNECT_REQUEST) return NULL;
+ if (request->coa->proxy->packet->code != FR_CODE_DISCONNECT_REQUEST) return NULL;
return request->coa->proxy->packet;
case PAIR_LIST_DM_REPLY:
if (!request->coa) return NULL;
rad_assert(request->coa->proxy != NULL);
- if (request->coa->proxy->packet->code != PW_CODE_DISCONNECT_REQUEST) return NULL;
+ if (request->coa->proxy->packet->code != FR_CODE_DISCONNECT_REQUEST) return NULL;
return request->coa->proxy->reply;
#endif
/* Don't add default */
VALUE_PAIR *out = NULL, *vp;
vp_cursor_t cursor;
- server_da = fr_dict_attr_by_num(NULL, 0, PW_CONNECTION_POOL_SERVER);
+ server_da = fr_dict_attr_by_num(NULL, 0, FR_CONNECTION_POOL_SERVER);
if (!server_da) {
ERROR("Incomplete dictionary: Missing definition for \"Connection-Pool-Server\"");
return NULL;
}
- port_da = fr_dict_attr_by_num(NULL, 0, PW_CONNECTION_POOL_PORT);
+ port_da = fr_dict_attr_by_num(NULL, 0, FR_CONNECTION_POOL_PORT);
if (!port_da) {
ERROR("Incomplete dictionary: Missing definition for \"Connection-Pool-Port\"");
return NULL;
static RADIUS_PACKET my_packet = {
.sockfd = -1,
.id = 0,
- .code = PW_CODE_ACCESS_ACCEPT,
+ .code = FR_CODE_ACCESS_ACCEPT,
.vector = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f },
};
/*
* Set the defaults for IPs, etc.
*/
- request->packet->code = PW_CODE_ACCESS_REQUEST;
+ request->packet->code = FR_CODE_ACCESS_REQUEST;
request->packet->src_ipaddr.af = AF_INET;
request->packet->src_ipaddr.prefix = 32;
* Allow it to set the packet type in
* the attributes read from the file.
*/
- case PW_PACKET_TYPE:
+ case FR_PACKET_TYPE:
request->packet->code = vp->vp_uint32;
break;
- case PW_PACKET_DST_PORT:
+ case FR_PACKET_DST_PORT:
request->packet->dst_port = (vp->vp_uint32 & 0xffff);
break;
- case PW_PACKET_DST_IP_ADDRESS:
- case PW_PACKET_DST_IPV6_ADDRESS:
+ case FR_PACKET_DST_IP_ADDRESS:
+ case FR_PACKET_DST_IPV6_ADDRESS:
memcpy(&request->packet->dst_ipaddr, &vp->vp_ip, sizeof(request->packet->dst_ipaddr));
break;
- case PW_PACKET_SRC_PORT:
+ case FR_PACKET_SRC_PORT:
request->packet->src_port = (vp->vp_uint32 & 0xffff);
break;
- case PW_PACKET_SRC_IP_ADDRESS:
- case PW_PACKET_SRC_IPV6_ADDRESS:
+ case FR_PACKET_SRC_IP_ADDRESS:
+ case FR_PACKET_SRC_IPV6_ADDRESS:
memcpy(&request->packet->src_ipaddr, &vp->vp_ip, sizeof(request->packet->src_ipaddr));
break;
- case PW_CHAP_PASSWORD: {
+ case FR_CHAP_PASSWORD: {
int i, already_hex = 0;
/*
}
break;
- case PW_DIGEST_REALM:
- case PW_DIGEST_NONCE:
- case PW_DIGEST_METHOD:
- case PW_DIGEST_URI:
- case PW_DIGEST_QOP:
- case PW_DIGEST_ALGORITHM:
- case PW_DIGEST_BODY_DIGEST:
- case PW_DIGEST_CNONCE:
- case PW_DIGEST_NONCE_COUNT:
- case PW_DIGEST_USER_NAME:
+ case FR_DIGEST_REALM:
+ case FR_DIGEST_NONCE:
+ case FR_DIGEST_METHOD:
+ case FR_DIGEST_URI:
+ case FR_DIGEST_QOP:
+ case FR_DIGEST_ALGORITHM:
+ case FR_DIGEST_BODY_DIGEST:
+ case FR_DIGEST_CNONCE:
+ case FR_DIGEST_NONCE_COUNT:
+ case FR_DIGEST_USER_NAME:
/* overlapping! */
{
fr_dict_attr_t const *da;
p = talloc_array(vp, uint8_t, vp->vp_length + 2);
memcpy(p + 2, vp->vp_octets, vp->vp_length);
- p[0] = vp->da->attr - PW_DIGEST_REALM + 1;
+ p[0] = vp->da->attr - FR_DIGEST_REALM + 1;
vp->vp_length += 2;
p[1] = vp->vp_length;
- da = fr_dict_attr_by_num(NULL, 0, PW_DIGEST_ATTRIBUTES);
+ da = fr_dict_attr_by_num(NULL, 0, FR_DIGEST_ATTRIBUTES);
rad_assert(da != NULL);
vp->da = da;
/*
* FIXME: set IPs, etc.
*/
- request->packet->code = PW_CODE_ACCESS_REQUEST;
+ request->packet->code = FR_CODE_ACCESS_REQUEST;
request->packet->src_ipaddr.af = AF_INET;
request->packet->src_ipaddr.prefix = 32;
request->log.lvl = rad_debug_lvl;
request->log.func = vradlog_request;
- request->username = fr_pair_find_by_num(request->packet->vps, 0, PW_USER_NAME, TAG_ANY);
- request->password = fr_pair_find_by_num(request->packet->vps, 0, PW_USER_PASSWORD, TAG_ANY);
+ request->username = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY);
+ request->password = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_PASSWORD, TAG_ANY);
return request;
}
for (i = 0; variables[i].name != NULL; i++) {
int ret;
- if (PW_BASE_TYPE(variables[i].type) == FR_TYPE_SUBSECTION) continue;
+ if (FR_BASE_TYPE(variables[i].type) == FR_TYPE_SUBSECTION) continue;
/* else it's a CONF_PAIR */
/*
/*
* Update the list with the response type.
*/
- vp = radius_pair_create(request->reply, &request->reply->vps, PW_RESPONSE_PACKET_TYPE, 0);
+ vp = radius_pair_create(request->reply, &request->reply->vps, FR_RESPONSE_PACKET_TYPE, 0);
vp->vp_uint32 = request->reply->code;
{
if (request->packet) {
verify_packet(file, line, request, request->packet, "request");
- if ((request->packet->code == PW_CODE_ACCESS_REQUEST) &&
+ if ((request->packet->code == FR_CODE_ACCESS_REQUEST) &&
!request->reply->code) {
rad_assert(request->state_ctx != NULL);
}
default:
break; /* ignore them */
- case PW_CLIENT_SHORTNAME:
+ case FR_CLIENT_SHORTNAME:
if (vpt->tmpl_num == NUM_COUNT) goto count_virtual;
if (request->client && request->client->shortname) {
return talloc_typed_strdup(ctx, request->client->shortname);
}
return talloc_typed_strdup(ctx, "<UNKNOWN-CLIENT>");
- case PW_REQUEST_PROCESSING_STAGE:
+ case FR_REQUEST_PROCESSING_STAGE:
if (vpt->tmpl_num == NUM_COUNT) goto count_virtual;
if (request->component) return talloc_typed_strdup(ctx, request->component);
return talloc_typed_strdup(ctx, "server_core");
- case PW_VIRTUAL_SERVER:
+ case FR_VIRTUAL_SERVER:
if (vpt->tmpl_num == NUM_COUNT) goto count_virtual;
if (!request->server) return NULL;
return talloc_typed_strdup(ctx, request->server);
- case PW_MODULE_RETURN_CODE:
+ case FR_MODULE_RETURN_CODE:
if (vpt->tmpl_num == NUM_COUNT) goto count_virtual;
if (!request->rcode) return NULL;
return talloc_typed_strdup(ctx, fr_int2str(modreturn_table, request->rcode, ""));
default:
break;
- case PW_PACKET_TYPE:
+ case FR_PACKET_TYPE:
if (packet->code > 0) {
dv = fr_dict_enum_by_value(NULL, vpt->tmpl_da, fr_box_uint32(packet->code));
if (dv) return talloc_typed_strdup(ctx, dv->alias);
*/
return talloc_strdup(ctx, "");
- case PW_RESPONSE_PACKET_TYPE:
+ case FR_RESPONSE_PACKET_TYPE:
{
int code = 0;
* because of the talloc checks sprinkled throughout the
* various VP functions.
*/
- case PW_PACKET_AUTHENTICATION_VECTOR:
+ case FR_PACKET_AUTHENTICATION_VECTOR:
virtual = fr_pair_afrom_da(ctx, vpt->tmpl_da);
fr_pair_value_memcpy(virtual, packet->vector, sizeof(packet->vector));
vp = virtual;
break;
- case PW_CLIENT_IP_ADDRESS:
- case PW_PACKET_SRC_IP_ADDRESS:
+ case FR_CLIENT_IP_ADDRESS:
+ case FR_PACKET_SRC_IP_ADDRESS:
if (packet->src_ipaddr.af == AF_INET) {
virtual = fr_pair_afrom_da(ctx, vpt->tmpl_da);
memcpy(&virtual->vp_ip, &packet->src_ipaddr, sizeof(virtual->vp_ip));
}
break;
- case PW_PACKET_DST_IP_ADDRESS:
+ case FR_PACKET_DST_IP_ADDRESS:
if (packet->dst_ipaddr.af == AF_INET) {
virtual = fr_pair_afrom_da(ctx, vpt->tmpl_da);
memcpy(&virtual->vp_ip, &packet->dst_ipaddr, sizeof(virtual->vp_ip));
}
break;
- case PW_PACKET_SRC_IPV6_ADDRESS:
+ case FR_PACKET_SRC_IPV6_ADDRESS:
if (packet->src_ipaddr.af == AF_INET6) {
virtual = fr_pair_afrom_da(ctx, vpt->tmpl_da);
memcpy(&virtual->vp_ip, &packet->src_ipaddr, sizeof(virtual->vp_ip));
}
break;
- case PW_PACKET_DST_IPV6_ADDRESS:
+ case FR_PACKET_DST_IPV6_ADDRESS:
if (packet->dst_ipaddr.af == AF_INET6) {
virtual = fr_pair_afrom_da(ctx, vpt->tmpl_da);
memcpy(&virtual->vp_ip, &packet->dst_ipaddr, sizeof(virtual->vp_ip));
}
break;
- case PW_PACKET_SRC_PORT:
+ case FR_PACKET_SRC_PORT:
virtual = fr_pair_afrom_da(ctx, vpt->tmpl_da);
virtual->vp_uint32 = packet->src_port;
vp = virtual;
break;
- case PW_PACKET_DST_PORT:
+ case FR_PACKET_DST_PORT:
virtual = fr_pair_afrom_da(ctx, vpt->tmpl_da);
virtual->vp_uint32 = packet->dst_port;
vp = virtual;
rad_assert(packet != NULL);
switch (packet->code) {
- case PW_CODE_ACCOUNTING_REQUEST:
+ case FR_CODE_ACCOUNTING_REQUEST:
fun = rad_accounting;
break;
- case PW_CODE_COA_REQUEST:
- case PW_CODE_DISCONNECT_REQUEST:
+ case FR_CODE_COA_REQUEST:
+ case FR_CODE_DISCONNECT_REQUEST:
fun = rad_coa_recv;
break;
data->timestamp = atoi(value);
data->timestamp_offset = data->last_offset;
- vp = fr_pair_afrom_num(data, 0, PW_PACKET_ORIGINAL_TIMESTAMP);
+ vp = fr_pair_afrom_num(data, 0, FR_PACKET_ORIGINAL_TIMESTAMP);
if (vp) {
vp->vp_date = (uint32_t) data->timestamp;
vp->type = VT_DATA;
*/
packet->vps = fr_pair_list_copy(packet, data->vps);
- packet->code = PW_CODE_ACCOUNTING_REQUEST;
- vp = fr_pair_find_by_num(packet->vps, 0, PW_PACKET_TYPE, TAG_ANY);
+ packet->code = FR_CODE_ACCOUNTING_REQUEST;
+ vp = fr_pair_find_by_num(packet->vps, 0, FR_PACKET_TYPE, TAG_ANY);
if (vp) packet->code = vp->vp_uint32;
gettimeofday(&packet->timestamp, NULL);
packet->src_ipaddr = data->client_ip;
}
- vp = fr_pair_find_by_num(packet->vps, 0, PW_PACKET_SRC_IP_ADDRESS, TAG_ANY);
+ vp = fr_pair_find_by_num(packet->vps, 0, FR_PACKET_SRC_IP_ADDRESS, TAG_ANY);
if (vp) {
packet->src_ipaddr.af = AF_INET;
packet->src_ipaddr.addr.v4.s_addr = vp->vp_ipv4addr;
packet->src_ipaddr.prefix = 32;
} else {
- vp = fr_pair_find_by_num(packet->vps, 0, PW_PACKET_SRC_IPV6_ADDRESS, TAG_ANY);
+ vp = fr_pair_find_by_num(packet->vps, 0, FR_PACKET_SRC_IPV6_ADDRESS, TAG_ANY);
if (vp) {
packet->src_ipaddr.af = AF_INET6;
memcpy(&packet->src_ipaddr.addr.v6,
}
}
- vp = fr_pair_find_by_num(packet->vps, 0, PW_PACKET_DST_IP_ADDRESS, TAG_ANY);
+ vp = fr_pair_find_by_num(packet->vps, 0, FR_PACKET_DST_IP_ADDRESS, TAG_ANY);
if (vp) {
packet->dst_ipaddr.af = AF_INET;
packet->dst_ipaddr.addr.v4.s_addr = vp->vp_ipv4addr;
packet->dst_ipaddr.prefix = 32;
} else {
- vp = fr_pair_find_by_num(packet->vps, 0, PW_PACKET_DST_IPV6_ADDRESS, TAG_ANY);
+ vp = fr_pair_find_by_num(packet->vps, 0, FR_PACKET_DST_IPV6_ADDRESS, TAG_ANY);
if (vp) {
packet->dst_ipaddr.af = AF_INET6;
memcpy(&packet->dst_ipaddr.addr.v6,
/*
* Create / update accounting attributes.
*/
- if (packet->code == PW_CODE_ACCOUNTING_REQUEST) {
+ if (packet->code == FR_CODE_ACCOUNTING_REQUEST) {
/*
* Prefer the Event-Timestamp in the packet, if it
* exists. That is when the event occurred, whereas the
* "Timestamp" field is when we wrote the packet to the
* detail file, which could have been much later.
*/
- vp = fr_pair_find_by_num(packet->vps, 0, PW_EVENT_TIMESTAMP, TAG_ANY);
+ vp = fr_pair_find_by_num(packet->vps, 0, FR_EVENT_TIMESTAMP, TAG_ANY);
if (vp) {
data->timestamp = vp->vp_uint32;
}
* Look for Acct-Delay-Time, and update
* based on Acct-Delay-Time += (time(NULL) - timestamp)
*/
- vp = fr_pair_find_by_num(packet->vps, 0, PW_ACCT_DELAY_TIME, TAG_ANY);
+ vp = fr_pair_find_by_num(packet->vps, 0, FR_ACCT_DELAY_TIME, TAG_ANY);
if (!vp) {
- vp = fr_pair_afrom_num(packet, 0, PW_ACCT_DELAY_TIME);
+ vp = fr_pair_afrom_num(packet, 0, FR_ACCT_DELAY_TIME);
rad_assert(vp != NULL);
fr_pair_add(&packet->vps, vp);
}
/*
* Set the transmission count.
*/
- vp = fr_pair_find_by_num(packet->vps, 0, PW_PACKET_TRANSMIT_COUNTER, TAG_ANY);
+ vp = fr_pair_find_by_num(packet->vps, 0, FR_PACKET_TRANSMIT_COUNTER, TAG_ANY);
if (!vp) {
- vp = fr_pair_afrom_num(packet, 0, PW_PACKET_TRANSMIT_COUNTER);
+ vp = fr_pair_afrom_num(packet, 0, FR_PACKET_TRANSMIT_COUNTER);
rad_assert(vp != NULL);
fr_pair_add(&packet->vps, vp);
}
memcpy(&magic, data + 4, 4);
pkt_id = ntohl(magic);
- code = dhcp_get_option((dhcp_packet_t const *) data, data_len, PW_DHCP_MESSAGE_TYPE);
+ code = dhcp_get_option((dhcp_packet_t const *) data, data_len, FR_DHCP_MESSAGE_TYPE);
if (!code) {
fr_strerror_printf("No message-type option was found in the packet");
return NULL;
}
packet->data_len = data_len;
- packet->code = code[2] | PW_DHCP_OFFSET;
+ packet->code = code[2] | FR_DHCP_OFFSET;
packet->id = pkt_id;
packet->dst_port = dst_port;
/*
* Stupid hacks until we have protocol specific dictionaries
*/
- parent = fr_dict_attr_child_by_num(parent, PW_VENDOR_SPECIFIC);
+ parent = fr_dict_attr_child_by_num(parent, FR_VENDOR_SPECIFIC);
if (!parent) {
fr_strerror_printf("Can't find Vendor-Specific (26)");
return -1;
/*
* DHCP-Message-Type is first, for simplicity.
*/
- if (((my_a->da->parent->type != FR_TYPE_TLV) && (my_a->da->attr == PW_DHCP_MESSAGE_TYPE)) &&
- ((my_b->da->parent->type == FR_TYPE_TLV) || (my_b->da->attr != PW_DHCP_MESSAGE_TYPE))) return -1;
- if (((my_a->da->parent->type == FR_TYPE_TLV) || (my_a->da->attr != PW_DHCP_MESSAGE_TYPE)) &&
- ((my_b->da->parent->type != FR_TYPE_TLV) && (my_b->da->attr == PW_DHCP_MESSAGE_TYPE))) return +1;
+ if (((my_a->da->parent->type != FR_TYPE_TLV) && (my_a->da->attr == FR_DHCP_MESSAGE_TYPE)) &&
+ ((my_b->da->parent->type == FR_TYPE_TLV) || (my_b->da->attr != FR_DHCP_MESSAGE_TYPE))) return -1;
+ if (((my_a->da->parent->type == FR_TYPE_TLV) || (my_a->da->attr != FR_DHCP_MESSAGE_TYPE)) &&
+ ((my_b->da->parent->type != FR_TYPE_TLV) && (my_b->da->attr == FR_DHCP_MESSAGE_TYPE))) return +1;
/*
* Relay-Agent is last.
if (!vp) return -1;
if (vp->da->vendor != DHCP_MAGIC_VENDOR) goto next; /* not a DHCP option */
- if (vp->da->attr == PW_DHCP_MESSAGE_TYPE) goto next; /* already done */
- if ((vp->da->attr > 255) && (DHCP_BASE_ATTR(vp->da->attr) != PW_DHCP_OPTION_82)) {
+ if (vp->da->attr == FR_DHCP_MESSAGE_TYPE) goto next; /* already done */
+ if ((vp->da->attr > 255) && (DHCP_BASE_ATTR(vp->da->attr) != FR_DHCP_OPTION_82)) {
next:
fr_strerror_printf("Attribute \"%s\" is not a DHCP option", vp->da->name);
fr_pair_cursor_next(cursor);
packet->data = talloc_zero_array(packet, uint8_t, packet->data_len);
/* XXX Ugly ... should be set by the caller */
- if (packet->code == 0) packet->code = PW_DHCP_NAK;
+ if (packet->code == 0) packet->code = FR_DHCP_NAK;
/* store xid */
if ((vp = fr_pair_find_by_num(packet->vps, DHCP_MAGIC_VENDOR, 260, TAG_ANY))) {
p[0] = 0x35; /* DHCP-Message-Type */
p[1] = 1;
- p[2] = packet->code - PW_DHCP_OFFSET;
+ p[2] = packet->code - FR_DHCP_OFFSET;
p += 3;
/*
TALLOC_FREE(raw_packet);
packet->id = xid;
- code = dhcp_get_option((dhcp_packet_t const *) packet->data, packet->data_len, PW_DHCP_MESSAGE_TYPE);
+ code = dhcp_get_option((dhcp_packet_t const *) packet->data, packet->data_len, FR_DHCP_MESSAGE_TYPE);
if (!code) {
fr_strerror_printf("No message-type option was found in the packet");
fr_radius_free(&packet);
return NULL;
}
- packet->code = code[2] | PW_DHCP_OFFSET;
+ packet->code = code[2] | FR_DHCP_OFFSET;
/*
* Create a unique vector from the MAC address and the
*/
int dhcp_init(void)
{
- dhcp_option_82 = fr_dict_attr_by_num(NULL, DHCP_MAGIC_VENDOR, PW_DHCP_OPTION_82);
+ dhcp_option_82 = fr_dict_attr_by_num(NULL, DHCP_MAGIC_VENDOR, FR_DHCP_OPTION_82);
if (!dhcp_option_82) {
fr_strerror_printf("Missing dictionary attribute for DHCP-Option-82");
return -1;
} dc_offer_t;
static const FR_NAME_NUMBER request_types[] = {
- { "discover", PW_DHCP_DISCOVER },
- { "request", PW_DHCP_REQUEST },
- { "decline", PW_DHCP_DECLINE },
- { "release", PW_DHCP_RELEASE },
- { "inform", PW_DHCP_INFORM },
- { "lease_query", PW_DHCP_LEASE_QUERY },
- { "auto", PW_CODE_UNDEFINED },
+ { "discover", FR_DHCP_DISCOVER },
+ { "request", FR_DHCP_REQUEST },
+ { "decline", FR_DHCP_DECLINE },
+ { "release", FR_DHCP_RELEASE },
+ { "inform", FR_DHCP_INFORM },
+ { "lease_query", FR_DHCP_LEASE_QUERY },
+ { "auto", FR_CODE_UNDEFINED },
{ NULL, 0}
};
/*
* Allow to set packet type using DHCP-Message-Type
*/
- if (vp->da->vendor == DHCP_MAGIC_VENDOR && vp->da->attr == PW_DHCP_MESSAGE_TYPE) {
- request->code = vp->vp_uint32 + PW_DHCP_OFFSET;
+ if (vp->da->vendor == DHCP_MAGIC_VENDOR && vp->da->attr == FR_DHCP_MESSAGE_TYPE) {
+ request->code = vp->vp_uint32 + FR_DHCP_OFFSET;
} else if (!vp->da->vendor) switch (vp->da->attr) {
/*
* Allow it to set the packet type in
* the attributes read from the file.
* (this takes precedence over the command argument.)
*/
- case PW_PACKET_TYPE:
+ case FR_PACKET_TYPE:
request->code = vp->vp_uint32;
break;
- case PW_PACKET_DST_PORT:
+ case FR_PACKET_DST_PORT:
request->dst_port = (vp->vp_uint32 & 0xffff);
break;
- case PW_PACKET_DST_IP_ADDRESS:
- case PW_PACKET_DST_IPV6_ADDRESS:
+ case FR_PACKET_DST_IP_ADDRESS:
+ case FR_PACKET_DST_IPV6_ADDRESS:
memcpy(&request->dst_ipaddr, &vp->vp_ip, sizeof(request->src_ipaddr));
break;
- case PW_PACKET_SRC_PORT:
+ case FR_PACKET_SRC_PORT:
request->src_port = (vp->vp_uint32 & 0xffff);
break;
- case PW_PACKET_SRC_IP_ADDRESS:
- case PW_PACKET_SRC_IPV6_ADDRESS:
+ case FR_PACKET_SRC_IP_ADDRESS:
+ case FR_PACKET_SRC_IPV6_ADDRESS:
memcpy(&request->src_ipaddr, &vp->vp_ip, sizeof(request->src_ipaddr));
break;
if (!reply_p) reply_p = cur_reply_p;
- if (cur_reply_p->code == PW_DHCP_OFFER) {
+ if (cur_reply_p->code == FR_DHCP_OFFER) {
VALUE_PAIR *vp1 = fr_pair_find_by_num(cur_reply_p->vps, DHCP_MAGIC_VENDOR, 54, TAG_ANY); /* DHCP-DHCP-Server-Identifier */
VALUE_PAIR *vp2 = fr_pair_find_by_num(cur_reply_p->vps, DHCP_MAGIC_VENDOR, 264, TAG_ANY); /* DHCP-Your-IP-address */
#endif
"length %zu\n",
received ? "Received" : "Sending",
- dhcp_message_types[packet->code - PW_DHCP_OFFSET],
+ dhcp_message_types[packet->code - FR_DHCP_OFFSET],
packet->id,
packet->src_ipaddr.af == AF_INET6 ? "[" : "",
inet_ntop(packet->src_ipaddr.af,
/*
* These kind of packets do not get a reply, so don't wait for one.
*/
- if ((request->code == PW_DHCP_RELEASE) || (request->code == PW_DHCP_DECLINE)) {
+ if ((request->code == FR_DHCP_RELEASE) || (request->code == FR_DHCP_DECLINE)) {
reply_expected = false;
}
request->reply->dst_ipaddr.addr.v4.s_addr = giaddr->vp_ipv4addr;
request->reply->dst_port = request->packet->dst_port; /* server port */
- if ((request->packet->code == PW_DHCP_NAK) ||
+ if ((request->packet->code == FR_DHCP_NAK) ||
!sock->src_interface ||
((vp = fr_pair_find_by_num(request->packet->vps, DHCP_MAGIC_VENDOR, 262, TAG_ANY)) /* DHCP-Flags */ &&
(vp->vp_uint32 & 0x8000) &&
* packet may not be forwarded if it was the first time
* the client was requesting an IP address.
*/
- if (request->packet->code == PW_DHCP_OFFER) {
+ if (request->packet->code == FR_DHCP_OFFER) {
VALUE_PAIR *hwvp = fr_pair_find_by_num(request->packet->vps, DHCP_MAGIC_VENDOR, 267,
TAG_ANY); /* DHCP-Client-Hardware-Address */
if (hwvp == NULL) {
if (vp) {
request->reply->code = vp->vp_uint8;
if ((request->reply->code != 0) &&
- (request->reply->code < PW_DHCP_OFFSET)) {
- request->reply->code += PW_DHCP_OFFSET;
+ (request->reply->code < FR_DHCP_OFFSET)) {
+ request->reply->code += FR_DHCP_OFFSET;
}
}
else switch (rcode) {
case RLM_MODULE_OK:
case RLM_MODULE_UPDATED:
- if (request->packet->code == PW_DHCP_DISCOVER) {
- request->reply->code = PW_DHCP_OFFER;
+ if (request->packet->code == FR_DHCP_DISCOVER) {
+ request->reply->code = FR_DHCP_OFFER;
break;
- } else if (request->packet->code == PW_DHCP_REQUEST) {
- request->reply->code = PW_DHCP_ACK;
+ } else if (request->packet->code == FR_DHCP_REQUEST) {
+ request->reply->code = FR_DHCP_ACK;
break;
}
- request->reply->code = PW_DHCP_NAK;
+ request->reply->code = FR_DHCP_NAK;
break;
default:
case RLM_MODULE_INVALID:
case RLM_MODULE_NOOP:
case RLM_MODULE_NOTFOUND:
- if (request->packet->code == PW_DHCP_DISCOVER) {
+ if (request->packet->code == FR_DHCP_DISCOVER) {
request->reply->code = 0; /* ignore the packet */
} else {
- request->reply->code = PW_DHCP_NAK;
+ request->reply->code = FR_DHCP_NAK;
}
break;
/*
* Releases don't get replies.
*/
- if (request->packet->code == PW_DHCP_RELEASE) {
+ if (request->packet->code == FR_DHCP_RELEASE) {
request->reply->code = 0;
}
/*
* Allow NAKs to be delayed for a short period of time.
*/
- if (request->reply->code == PW_DHCP_NAK) {
- vp = fr_pair_find_by_num(request->reply->vps, 0, PW_FREERADIUS_RESPONSE_DELAY, TAG_ANY);
+ if (request->reply->code == FR_DHCP_NAK) {
+ vp = fr_pair_find_by_num(request->reply->vps, 0, FR_FREERADIUS_RESPONSE_DELAY, TAG_ANY);
if (vp) {
if (vp->vp_uint32 <= 10) {
request->response_delay.tv_sec = vp->vp_uint32;
#ifndef USEC
#define USEC 1000000
#endif
- vp = fr_pair_find_by_num(request->reply->vps, 0, PW_FREERADIUS_RESPONSE_DELAY_USEC, TAG_ANY);
+ vp = fr_pair_find_by_num(request->reply->vps, 0, FR_FREERADIUS_RESPONSE_DELAY_USEC, TAG_ANY);
if (vp) {
if (vp->vp_uint32 <= 10 * USEC) {
request->response_delay.tv_sec = vp->vp_uint32 / USEC;
/*
* Packet-Src-IP-Address has highest precedence
*/
- vp = fr_pair_find_by_num(request->reply->vps, 0, PW_PACKET_SRC_IP_ADDRESS, TAG_ANY);
+ vp = fr_pair_find_by_num(request->reply->vps, 0, FR_PACKET_SRC_IP_ADDRESS, TAG_ANY);
if (vp) {
request->reply->if_index = 0; /* Must be 0, we don't know the outbound if_index */
request->reply->src_ipaddr.addr.v4.s_addr = vp->vp_ipv4addr;
request->reply->dst_ipaddr.addr.v4.s_addr = vp->vp_ipv4addr;
request->reply->dst_port = request->packet->dst_port;
- vp = fr_pair_find_by_num(request->reply->vps, 0, PW_PACKET_DST_PORT, TAG_ANY);
+ vp = fr_pair_find_by_num(request->reply->vps, 0, FR_PACKET_DST_PORT, TAG_ANY);
if (vp) request->reply->dst_port = vp->vp_uint32;
return RLM_MODULE_OK;
* If it's a NAK, or the broadcast flag was set, ond
* there's no client-ip-address, send a broadcast.
*/
- if ((request->reply->code == PW_DHCP_NAK) ||
+ if ((request->reply->code == FR_DHCP_NAK) ||
((vp = fr_pair_find_by_num(request->reply->vps, DHCP_MAGIC_VENDOR, 262, TAG_ANY)) && /* DHCP-Flags */
(vp->vp_uint32 & 0x8000) &&
((vp = fr_pair_find_by_num(request->reply->vps, DHCP_MAGIC_VENDOR, 263, TAG_ANY)) && /* DHCP-Client-IP-Address */
* This is a cute hack to avoid us having to create a raw
* socket to send DHCP packets.
*/
- if (request->reply->code == PW_DHCP_OFFER) {
+ if (request->reply->code == FR_DHCP_OFFER) {
VALUE_PAIR *hwvp = fr_pair_find_by_num(request->reply->vps, DHCP_MAGIC_VENDOR, 267, TAG_ANY); /* DHCP-Client-Hardware-Address */
if (!hwvp) return RLM_MODULE_FAIL;
*
* This really belongs in a utility library
*/
- if ((packet->code > PW_DHCP_OFFSET) && (packet->code < PW_DHCP_MAX)) {
+ if ((packet->code > FR_DHCP_OFFSET) && (packet->code < FR_DHCP_MAX)) {
radlog_request(L_DBG, L_DBG_LVL_1, request, "%s %s Id %08x from %s%s%s:%i to %s%s%s:%i "
#if defined(WITH_UDPFROMTO) && defined(WITH_IFINDEX_NAME_RESOLUTION)
"%s%s%s"
#endif
"length %zu",
received ? "Received" : "Sent",
- dhcp_message_types[packet->code - PW_DHCP_OFFSET],
+ dhcp_message_types[packet->code - FR_DHCP_OFFSET],
packet->id,
packet->src_ipaddr.af == AF_INET6 ? "[" : "",
inet_ntop(packet->src_ipaddr.af,
#include <ctype.h>
-#define PW_DHCP_PARAMETER_REQUEST_LIST 55
+#define FR_DHCP_PARAMETER_REQUEST_LIST 55
/*
* Define a structure for our module configuration.
/*
* Fixup dictionary entry for DHCP-Paramter-Request-List adding all the options
*/
- da = fr_dict_attr_by_num(NULL, DHCP_MAGIC_VENDOR, PW_DHCP_PARAMETER_REQUEST_LIST);
+ da = fr_dict_attr_by_num(NULL, DHCP_MAGIC_VENDOR, FR_DHCP_PARAMETER_REQUEST_LIST);
if (da) {
fr_value_box_t value = { .type = FR_TYPE_UINT8 };
uint8_t i;
request->component = "radius";
- da = fr_dict_attr_by_num(NULL, 0, PW_PACKET_TYPE);
+ da = fr_dict_attr_by_num(NULL, 0, FR_PACKET_TYPE);
rad_assert(da != NULL);
dv = fr_dict_enum_by_value(NULL, da, fr_box_uint32(request->packet->code));
if (!dv) {
case RLM_MODULE_NOOP:
case RLM_MODULE_OK:
case RLM_MODULE_UPDATED:
- request->reply->code = PW_CODE_ACCOUNTING_RESPONSE;
+ request->reply->code = FR_CODE_ACCOUNTING_RESPONSE;
break;
case RLM_MODULE_HANDLED:
/*
* Allow for over-ride of reply code.
*/
- vp = fr_pair_find_by_num(request->reply->vps, 0, PW_PACKET_TYPE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->reply->vps, 0, FR_PACKET_TYPE, TAG_ANY);
if (vp) {
if (vp->vp_uint32 == 256) {
request->reply->code = 0;
}
}
- if (!da) da = fr_dict_attr_by_num(NULL, 0, PW_PACKET_TYPE);
+ if (!da) da = fr_dict_attr_by_num(NULL, 0, FR_PACKET_TYPE);
rad_assert(da != NULL);
dv = fr_dict_enum_by_value(NULL, da, fr_box_uint32(request->reply->code));
return 0;
}
- if (packet->code != PW_CODE_ACCOUNTING_REQUEST) {
+ if (packet->code != FR_CODE_ACCOUNTING_REQUEST) {
if (packet->code < FR_MAX_PACKET_CODE) {
DEBUG2("Invalid packet code %s sent to accounting port", fr_packet_codes[packet->code]);
} else {
if (common_socket_parse(cs, this) < 0) return -1;
- if (!sock->my_port) sock->my_port = PW_ACCT_UDP_PORT;
+ if (!sock->my_port) sock->my_port = FR_ACCT_UDP_PORT;
return 0;
}
* Get the correct username based on the configured value
*/
if (!log_stripped_names) {
- username = fr_pair_find_by_num(request->packet->vps, 0, PW_USER_NAME, TAG_ANY);
+ username = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY);
} else {
username = request->username;
}
if (!request->password) {
VALUE_PAIR *auth_type;
- auth_type = fr_pair_find_by_num(request->control, 0, PW_AUTH_TYPE, TAG_ANY);
+ auth_type = fr_pair_find_by_num(request->control, 0, FR_AUTH_TYPE, TAG_ANY);
if (auth_type) {
snprintf(clean_password, sizeof(clean_password), "<via Auth-Type = %s>",
fr_dict_enum_alias_by_value(NULL, auth_type->da, &auth_type->data));
} else {
strcpy(clean_password, "<no User-Password attribute>");
}
- } else if (fr_pair_find_by_num(request->packet->vps, 0, PW_CHAP_PASSWORD, TAG_ANY)) {
+ } else if (fr_pair_find_by_num(request->packet->vps, 0, FR_CHAP_PASSWORD, TAG_ANY)) {
strcpy(clean_password, "<CHAP-Password>");
} else {
fr_snprint(clean_password, sizeof(clean_password),
request->component = "radius";
- da = fr_dict_attr_by_num(NULL, 0, PW_PACKET_TYPE);
+ da = fr_dict_attr_by_num(NULL, 0, FR_PACKET_TYPE);
rad_assert(da != NULL);
dv = fr_dict_enum_by_value(NULL, da, fr_box_uint32(request->packet->code));
if (!dv) {
REDEBUG("Failed to find value for &request:Packet-Type");
- request->reply->code = PW_CODE_ACCESS_REJECT;
+ request->reply->code = FR_CODE_ACCESS_REJECT;
goto setup_send;
}
if (!unlang) unlang = cf_subsection_find_name2(request->server_cs, "recv", "*");
if (!unlang) {
REDEBUG("Failed to find 'recv' section");
- request->reply->code = PW_CODE_ACCESS_REJECT;
+ request->reply->code = FR_CODE_ACCESS_REJECT;
goto setup_send;
}
/*
* Do various setups.
*/
- request->username = fr_pair_find_by_num(request->packet->vps, 0, PW_USER_NAME, TAG_ANY);
- request->password = fr_pair_find_by_num(request->packet->vps, 0, PW_USER_PASSWORD, TAG_ANY);
+ request->username = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY);
+ request->password = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_PASSWORD, TAG_ANY);
/*
* Grab the VPS and data associated with the State attribute.
case RLM_MODULE_REJECT:
case RLM_MODULE_USERLOCK:
default:
- if ((vp = fr_pair_find_by_num(request->packet->vps, 0, PW_MODULE_FAILURE_MESSAGE, TAG_ANY)) != NULL) {
+ if ((vp = fr_pair_find_by_num(request->packet->vps, 0, FR_MODULE_FAILURE_MESSAGE, TAG_ANY)) != NULL) {
char msg[FR_MAX_STRING_LEN + 16];
snprintf(msg, sizeof(msg), "Invalid user (%s)",
auth_message("Invalid user", request, 0);
}
- request->reply->code = PW_CODE_ACCESS_REJECT;
+ request->reply->code = FR_CODE_ACCESS_REJECT;
goto setup_send;
}
*/
fr_pair_cursor_init(&cursor, &request->control);
auth_type = NULL;
- while ((vp = fr_pair_cursor_next_by_num(&cursor, 0, PW_AUTH_TYPE, TAG_ANY)) != NULL) {
+ while ((vp = fr_pair_cursor_next_by_num(&cursor, 0, FR_AUTH_TYPE, TAG_ANY)) != NULL) {
if (!auth_type) {
auth_type = vp;
continue;
*/
if (!auth_type) {
REDEBUG2("No Auth-Type available: rejecting the user.");
- request->reply->code = PW_CODE_ACCESS_REJECT;
+ request->reply->code = FR_CODE_ACCESS_REJECT;
goto setup_send;
}
/*
* Handle hard-coded Accept and Reject.
*/
- if (auth_type->vp_uint32 == PW_AUTH_TYPE_ACCEPT) {
+ if (auth_type->vp_uint32 == FR_AUTH_TYPE_ACCEPT) {
RDEBUG2("Auth-Type = Accept, allowing user");
- request->reply->code = PW_CODE_ACCESS_ACCEPT;
+ request->reply->code = FR_CODE_ACCESS_ACCEPT;
goto setup_send;
}
- if (auth_type->vp_uint32 == PW_AUTH_TYPE_REJECT) {
+ if (auth_type->vp_uint32 == FR_AUTH_TYPE_REJECT) {
RDEBUG2("Auth-Type = Reject, rejecting user");
- request->reply->code = PW_CODE_ACCESS_REJECT;
+ request->reply->code = FR_CODE_ACCESS_REJECT;
goto setup_send;
}
dv = fr_dict_enum_by_value(NULL, vp->da, &vp->data);
if (!dv) {
REDEBUG2("Unknown Auth-Type %d found: rejecting the user", vp->vp_uint32);
- request->reply->code = PW_CODE_ACCESS_REJECT;
+ request->reply->code = FR_CODE_ACCESS_REJECT;
goto setup_send;
}
unlang = cf_subsection_find_name2(request->server_cs, "process", dv->alias);
if (!unlang) {
REDEBUG2("No 'process %s' section found: rejecting the user", dv->alias);
- request->reply->code = PW_CODE_ACCESS_REJECT;
+ request->reply->code = FR_CODE_ACCESS_REJECT;
goto setup_send;
}
case RLM_MODULE_USERLOCK:
default:
RDEBUG2("Failed to authenticate the user");
- request->reply->code = PW_CODE_ACCESS_REJECT;
+ request->reply->code = FR_CODE_ACCESS_REJECT;
- if ((vp = fr_pair_find_by_num(request->packet->vps, 0, PW_MODULE_FAILURE_MESSAGE, TAG_ANY)) != NULL){
+ if ((vp = fr_pair_find_by_num(request->packet->vps, 0, FR_MODULE_FAILURE_MESSAGE, TAG_ANY)) != NULL){
char msg[FR_MAX_STRING_LEN+19];
snprintf(msg, sizeof(msg), "Login incorrect (%s)",
if (request->password) {
VERIFY_VP(request->password);
- if ((rad_debug_lvl > 1) && (request->password->da->attr == PW_USER_PASSWORD)) {
+ if ((rad_debug_lvl > 1) && (request->password->da->attr == FR_USER_PASSWORD)) {
uint8_t const *p;
p = (uint8_t const *) request->password->vp_strvalue;
goto setup_send;
case RLM_MODULE_OK:
- request->reply->code = PW_CODE_ACCESS_ACCEPT;
+ request->reply->code = FR_CODE_ACCESS_ACCEPT;
break;
case RLM_MODULE_HANDLED:
/*
* Allow for over-ride of reply code.
*/
- vp = fr_pair_find_by_num(request->reply->vps, 0, PW_PACKET_TYPE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->reply->vps, 0, FR_PACKET_TYPE, TAG_ANY);
if (vp) {
if (vp->vp_uint32 == 256) {
request->reply->code = 0;
}
}
- if (request->reply->code == PW_CODE_ACCESS_ACCEPT) {
- if ((vp = fr_pair_find_by_num(request->packet->vps, 0, PW_MODULE_SUCCESS_MESSAGE, TAG_ANY)) != NULL){
+ if (request->reply->code == FR_CODE_ACCESS_ACCEPT) {
+ if ((vp = fr_pair_find_by_num(request->packet->vps, 0, FR_MODULE_SUCCESS_MESSAGE, TAG_ANY)) != NULL){
char msg[FR_MAX_STRING_LEN+12];
snprintf(msg, sizeof(msg), "Login OK (%s)",
}
setup_send:
- if (!da) da = fr_dict_attr_by_num(NULL, 0, PW_PACKET_TYPE);
+ if (!da) da = fr_dict_attr_by_num(NULL, 0, FR_PACKET_TYPE);
rad_assert(da != NULL);
dv = fr_dict_enum_by_value(NULL, da, fr_box_uint32(request->reply->code));
* If we over-ride an ACK with a NAK, run
* the NAK section.
*/
- if (request->reply->code != PW_CODE_ACCESS_REJECT) {
- if (!da) da = fr_dict_attr_by_num(NULL, 0, PW_PACKET_TYPE);
+ if (request->reply->code != FR_CODE_ACCESS_REJECT) {
+ if (!da) da = fr_dict_attr_by_num(NULL, 0, FR_PACKET_TYPE);
rad_assert(da != NULL);
dv = fr_dict_enum_by_value(NULL, da, fr_box_uint32(request->reply->code));
RWDEBUG("Failed running 'send %s', trying 'send Access-Reject'.", dv->alias);
- request->reply->code = PW_CODE_ACCESS_REJECT;
+ request->reply->code = FR_CODE_ACCESS_REJECT;
dv = fr_dict_enum_by_value(NULL, da, fr_box_uint32(request->reply->code));
unlang = NULL;
* Save session-state list for Access-Challenge,
* discard it for everything else.
*/
- if (request->reply->code == PW_CODE_ACCESS_CHALLENGE) {
+ if (request->reply->code == FR_CODE_ACCESS_CHALLENGE) {
fr_request_to_state(global_state, request, request->packet, request->reply);
} else {
}
if (!request->reply->code) {
- vp = fr_pair_find_by_num(request->control, 0, PW_AUTH_TYPE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_AUTH_TYPE, TAG_ANY);
if (vp) {
- if (vp->vp_uint32 == PW_AUTH_TYPE_ACCEPT) {
- request->reply->code = PW_CODE_ACCESS_ACCEPT;
+ if (vp->vp_uint32 == FR_AUTH_TYPE_ACCEPT) {
+ request->reply->code = FR_CODE_ACCESS_ACCEPT;
- } else if (vp->vp_uint32 == PW_AUTH_TYPE_REJECT) {
- request->reply->code = PW_CODE_ACCESS_REJECT;
+ } else if (vp->vp_uint32 == FR_AUTH_TYPE_REJECT) {
+ request->reply->code = FR_CODE_ACCESS_REJECT;
}
}
}
* If we delay rejects, then calculate the
* correct delay.
*/
- if ((request->reply->code == PW_CODE_ACCESS_REJECT) &&
+ if ((request->reply->code == FR_CODE_ACCESS_REJECT) &&
((request->root->reject_delay.tv_sec > 0) ||
(request->root->reject_delay.tv_usec > 0))) {
struct timeval when, delay;
delay = request->root->reject_delay;
- vp = fr_pair_find_by_num(request->reply->vps, 0, PW_FREERADIUS_RESPONSE_DELAY, TAG_ANY);
+ vp = fr_pair_find_by_num(request->reply->vps, 0, FR_FREERADIUS_RESPONSE_DELAY, TAG_ANY);
if (vp) {
if (vp->vp_uint32 <= 10) {
delay.tv_sec = vp->vp_uint32;
}
delay.tv_usec = 0;
} else {
- vp = fr_pair_find_by_num(request->reply->vps, 0, PW_FREERADIUS_RESPONSE_DELAY_USEC, TAG_ANY);
+ vp = fr_pair_find_by_num(request->reply->vps, 0, FR_FREERADIUS_RESPONSE_DELAY_USEC, TAG_ANY);
if (vp) {
if (vp->vp_uint32 <= 10 * USEC) {
delay.tv_sec = vp->vp_uint32 / USEC;
return 0;
}
- if (packet->code != PW_CODE_ACCESS_REQUEST) {
+ if (packet->code != FR_CODE_ACCESS_REQUEST) {
if (packet->code < FR_MAX_PACKET_CODE) {
DEBUG2("Invalid packet code %s sent to authentication port", fr_packet_codes[packet->code]);
} else {
CONF_SECTION *subcs;
fr_dict_attr_t const *da;
- da = fr_dict_attr_by_num(NULL, 0, PW_AUTH_TYPE);
+ da = fr_dict_attr_by_num(NULL, 0, FR_AUTH_TYPE);
if (!da) {
cf_log_err_cs(server_cs, "Failed finding dictionary definition for Auth-Type");
return -1;
if (common_socket_parse(cs, this) < 0) return -1;
- if (!sock->my_port) sock->my_port = PW_AUTH_UDP_PORT;
+ if (!sock->my_port) sock->my_port = FR_AUTH_UDP_PORT;
sock->dup_tree = rbtree_create(NULL, packet_entry_cmp, NULL, 0);
request->component = "radius";
- da = fr_dict_attr_by_num(NULL, 0, PW_PACKET_TYPE);
+ da = fr_dict_attr_by_num(NULL, 0, FR_PACKET_TYPE);
rad_assert(da != NULL);
dv = fr_dict_enum_by_value(NULL, da, fr_box_uint32(request->packet->code));
if (!dv) {
/*
* Allow for over-ride of reply code.
*/
- vp = fr_pair_find_by_num(request->reply->vps, 0, PW_PACKET_TYPE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->reply->vps, 0, FR_PACKET_TYPE, TAG_ANY);
if (vp) {
if (vp->vp_uint32 == 256) {
request->reply->code = 0;
}
}
- if (!da) da = fr_dict_attr_by_num(NULL, 0, PW_PACKET_TYPE);
+ if (!da) da = fr_dict_attr_by_num(NULL, 0, FR_PACKET_TYPE);
rad_assert(da != NULL);
dv = fr_dict_enum_by_value(NULL, da, fr_box_uint32(request->reply->code));
* the NAK section.
*/
if (request->reply->code == request->packet->code + 1) {
- if (!da) da = fr_dict_attr_by_num(NULL, 0, PW_PACKET_TYPE);
+ if (!da) da = fr_dict_attr_by_num(NULL, 0, FR_PACKET_TYPE);
rad_assert(da != NULL);
dv = fr_dict_enum_by_value(NULL, da, fr_box_uint32(request->reply->code));
return 0;
}
- if ((packet->code != PW_CODE_COA_REQUEST) &&
- (packet->code != PW_CODE_DISCONNECT_REQUEST)) {
+ if ((packet->code != FR_CODE_COA_REQUEST) &&
+ (packet->code != FR_CODE_DISCONNECT_REQUEST)) {
DEBUG2("Invalid packet code %d", packet->code);
talloc_free(ctx);
return 0;
if (common_socket_parse(cs, this) < 0) return -1;
- if (!sock->my_port) sock->my_port = PW_COA_UDP_PORT;
+ if (!sock->my_port) sock->my_port = FR_COA_UDP_PORT;
return 0;
}
request->component = "radius";
- da = fr_dict_attr_by_num(NULL, 0, PW_PACKET_TYPE);
+ da = fr_dict_attr_by_num(NULL, 0, FR_PACKET_TYPE);
rad_assert(da != NULL);
dv = fr_dict_enum_by_value(NULL, da, fr_box_uint32(request->packet->code));
if (!dv) {
unlang = cf_subsection_find_name2(request->server_cs, "recv", dv->alias);
if (!unlang) {
RWDEBUG("Failed to find 'recv' section");
- request->reply->code = PW_CODE_ACCESS_REJECT;
+ request->reply->code = FR_CODE_ACCESS_REJECT;
goto send_reply;
}
switch (rcode) {
case RLM_MODULE_OK:
case RLM_MODULE_UPDATED:
- request->reply->code = PW_CODE_ACCESS_ACCEPT;
+ request->reply->code = FR_CODE_ACCESS_ACCEPT;
break;
case RLM_MODULE_FAIL:
default:
case RLM_MODULE_REJECT:
- request->reply->code = PW_CODE_ACCESS_REJECT;
+ request->reply->code = FR_CODE_ACCESS_REJECT;
break;
}
- if (!da) da = fr_dict_attr_by_num(NULL, 0, PW_PACKET_TYPE);
+ if (!da) da = fr_dict_attr_by_num(NULL, 0, FR_PACKET_TYPE);
rad_assert(da != NULL);
dv = fr_dict_enum_by_value(NULL, da, fr_box_uint32(request->reply->code));
* If we over-ride an ACK with a NAK, run
* the NAK section.
*/
- if (request->reply->code != PW_CODE_ACCESS_REJECT) {
- if (!da) da = fr_dict_attr_by_num(NULL, 0, PW_PACKET_TYPE);
+ if (request->reply->code != FR_CODE_ACCESS_REJECT) {
+ if (!da) da = fr_dict_attr_by_num(NULL, 0, FR_PACKET_TYPE);
rad_assert(da != NULL);
dv = fr_dict_enum_by_value(NULL, da, fr_box_uint32(request->reply->code));
RWDEBUG("Failed running 'send %s', trying 'send Access-Reject'.", dv->alias);
- request->reply->code = PW_CODE_ACCESS_REJECT;
+ request->reply->code = FR_CODE_ACCESS_REJECT;
dv = fr_dict_enum_by_value(NULL, da, fr_box_uint32(request->reply->code));
unlang = NULL;
session_id = tacacs_session_id(request->packet);
memcpy(&buf[sizeof(buf) - sizeof(session_id)], &session_id, sizeof(session_id));
- vp = fr_pair_afrom_num(packet, 0, PW_STATE);
+ vp = fr_pair_afrom_num(packet, 0, FR_STATE);
rad_assert(vp != NULL);
fr_pair_value_memcpy(vp, (uint8_t const *)buf, sizeof(buf));
fr_pair_add(&packet->vps, vp);
*/
fr_pair_cursor_init(&cursor, &request->control);
auth_type = NULL;
- while ((vp = fr_pair_cursor_next_by_num(&cursor, 0, PW_AUTH_TYPE, TAG_ANY)) != NULL) {
+ while ((vp = fr_pair_cursor_next_by_num(&cursor, 0, FR_AUTH_TYPE, TAG_ANY)) != NULL) {
if (!auth_type) {
auth_type = vp;
continue;
/*
* Handle hard-coded Accept and Reject.
*/
- if (auth_type->vp_uint32 == PW_AUTH_TYPE_ACCEPT) {
+ if (auth_type->vp_uint32 == FR_AUTH_TYPE_ACCEPT) {
RDEBUG2("Auth-Type = Accept, allowing user");
tacacs_status(request, RLM_MODULE_OK);
goto setup_send;
}
- if (auth_type->vp_uint32 == PW_AUTH_TYPE_REJECT) {
+ if (auth_type->vp_uint32 == FR_AUTH_TYPE_REJECT) {
RDEBUG2("Auth-Type = Reject, rejecting user");
tacacs_status(request, RLM_MODULE_REJECT);
goto setup_send;
static int tacacs_load(void)
{
- dict_tacacs_root = fr_dict_attr_child_by_num(fr_dict_root(fr_dict_internal), PW_TACACS_ROOT);
+ dict_tacacs_root = fr_dict_attr_child_by_num(fr_dict_root(fr_dict_internal), FR_TACACS_ROOT);
if (!dict_tacacs_root) {
ERROR("Missing TACACS-Root attribute");
return -1;
{
VALUE_PAIR const *vp;
- vp = fr_pair_find_by_child_num(packet->vps, dict_tacacs_root, PW_TACACS_PACKET_TYPE, TAG_ANY);
+ vp = fr_pair_find_by_child_num(packet->vps, dict_tacacs_root, FR_TACACS_PACKET_TYPE, TAG_ANY);
rad_assert(vp != NULL);
return (tacacs_type_t)vp->vp_uint8;
type = tacacs_type(packet);
- da = fr_dict_attr_child_by_num(dict_tacacs_root, PW_TACACS_PACKET_TYPE);
+ da = fr_dict_attr_child_by_num(dict_tacacs_root, FR_TACACS_PACKET_TYPE);
rad_assert(da != NULL);
dv = fr_dict_enum_by_value(NULL, da, fr_box_uint32(type));
rad_assert(dv != NULL);
{
VALUE_PAIR const *vp;
- vp = fr_pair_find_by_child_num(packet->vps, dict_tacacs_root, PW_TACACS_SESSION_ID, TAG_ANY);
+ vp = fr_pair_find_by_child_num(packet->vps, dict_tacacs_root, FR_TACACS_SESSION_ID, TAG_ANY);
rad_assert(vp != NULL);
return vp->vp_uint32;
if (!vp->da->flags.internal) continue;
switch (vp->da->attr) {
- case PW_TACACS_VERSION_MINOR:
+ case FR_TACACS_VERSION_MINOR:
pkt->hdr.ver.minor = vp->vp_uint8;
break;
- case PW_TACACS_PACKET_TYPE:
+ case FR_TACACS_PACKET_TYPE:
pkt->hdr.type = vp->vp_uint8;
break;
- case PW_TACACS_SEQUENCE_NUMBER:
+ case FR_TACACS_SEQUENCE_NUMBER:
pkt->hdr.seq_no = vp->vp_uint8;
break;
- case PW_TACACS_SESSION_ID:
+ case FR_TACACS_SESSION_ID:
pkt->hdr.session_id = htonl(vp->vp_uint32);
break;
- case PW_TACACS_AUTHENTICATION_STATUS:
+ case FR_TACACS_AUTHENTICATION_STATUS:
pkt->authen.reply.status = vp->vp_uint8;
status = vp->vp_uint8;
break;
- case PW_TACACS_AUTHENTICATION_FLAGS:
+ case FR_TACACS_AUTHENTICATION_FLAGS:
authen_reply_flags |= vp->vp_uint8;
break;
- case PW_TACACS_AUTHORIZATION_STATUS:
+ case FR_TACACS_AUTHORIZATION_STATUS:
pkt->author.res.status = vp->vp_uint8;
status = vp->vp_uint8;
break;
- case PW_TACACS_ACCOUNTING_STATUS:
+ case FR_TACACS_ACCOUNTING_STATUS:
pkt->acct.res.status = vp->vp_uint8;
status = vp->vp_uint8;
break;
- case PW_TACACS_SERVER_MESSAGE:
+ case FR_TACACS_SERVER_MESSAGE:
length_body += vp->vp_length;
field.server_msg = vp;
break;
- case PW_TACACS_DATA:
+ case FR_TACACS_DATA:
length_body += vp->vp_length;
field.data = vp;
break;
fr_pair_cursor_init(&cursor, &packet->vps);
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_VERSION_MINOR);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_VERSION_MINOR);
if (!vp) return -1;
vp->vp_uint8 = pkt->hdr.ver.minor;
fr_pair_cursor_append(&cursor, vp);
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_PACKET_TYPE);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_PACKET_TYPE);
if (!vp) return -1;
vp->vp_uint8 = pkt->hdr.type;
fr_pair_cursor_append(&cursor, vp);
packet->code = pkt->hdr.type;
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_SEQUENCE_NUMBER);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_SEQUENCE_NUMBER);
if (!vp) return -1;
vp->vp_uint8 = pkt->hdr.seq_no;
fr_pair_cursor_append(&cursor, vp);
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_SESSION_ID);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_SESSION_ID);
if (!vp) return -1;
vp->vp_uint32 = ntohl(pkt->hdr.session_id);
fr_pair_cursor_append(&cursor, vp);
case 1:
p = pkt->authen.start.body;
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_ACTION);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_ACTION);
if (!vp) return -1;
vp->vp_uint8 = pkt->authen.start.action;
fr_pair_cursor_append(&cursor, vp);
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_PRIVILEGE_LEVEL);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_PRIVILEGE_LEVEL);
if (!vp) return -1;
vp->vp_uint8 = pkt->authen.start.priv_lvl;
fr_pair_cursor_append(&cursor, vp);
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_AUTHENTICATION_TYPE);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_AUTHENTICATION_TYPE);
if (!vp) return -1;
vp->vp_uint8 = pkt->authen.start.authen_type;
fr_pair_cursor_append(&cursor, vp);
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_AUTHENTICATION_SERVICE);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_AUTHENTICATION_SERVICE);
if (!vp) return -1;
vp->vp_uint8 = pkt->authen.start.authen_service;
fr_pair_cursor_append(&cursor, vp);
if (pkt->authen.start.user_len) {
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_USER_NAME);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_USER_NAME);
if (!vp) return -1;
fr_pair_value_bstrncpy(vp, p, pkt->authen.start.user_len);
p += vp->vp_length;
}
if (pkt->authen.start.port_len) {
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_CLIENT_PORT);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_CLIENT_PORT);
if (!vp) return -1;
fr_pair_value_bstrncpy(vp, p, pkt->authen.start.port_len);
p += vp->vp_length;
}
if (pkt->authen.start.rem_addr_len) {
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_REMOTE_ADDRESS);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_REMOTE_ADDRESS);
if (!vp) return -1;
fr_pair_value_bstrncpy(vp, p, pkt->authen.start.rem_addr_len);
p += vp->vp_length;
}
if (pkt->authen.start.data_len) {
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_DATA);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_DATA);
if (!vp) return -1;
fr_pair_value_bstrncpy(vp, p, pkt->authen.start.data_len);
fr_pair_cursor_append(&cursor, vp);
p = pkt->authen.cont.body;
if (pkt->authen.cont.user_msg_len) {
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_USER_MESSAGE);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_USER_MESSAGE);
if (!vp) return -1;
fr_pair_value_bstrncpy(vp, p, ntohs(pkt->authen.cont.user_msg_len));
p += vp->vp_length;
}
if (pkt->authen.cont.data_len) {
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_DATA);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_DATA);
if (!vp) return -1;
fr_pair_value_bstrncpy(vp, p, ntohs(pkt->authen.cont.data_len));
fr_pair_cursor_append(&cursor, vp);
p = pkt->author.req.body;
p += pkt->author.req.arg_cnt;
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_AUTHENTICATION_METHOD);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_AUTHENTICATION_METHOD);
if (!vp) return -1;
vp->vp_uint8 = pkt->author.req.authen_method;
fr_pair_cursor_append(&cursor, vp);
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_PRIVILEGE_LEVEL);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_PRIVILEGE_LEVEL);
if (!vp) return -1;
vp->vp_uint8 = pkt->author.req.priv_lvl;
fr_pair_cursor_append(&cursor, vp);
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_AUTHENTICATION_TYPE);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_AUTHENTICATION_TYPE);
if (!vp) return -1;
vp->vp_uint8 = pkt->author.req.authen_type;
fr_pair_cursor_append(&cursor, vp);
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_AUTHENTICATION_SERVICE);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_AUTHENTICATION_SERVICE);
if (!vp) return -1;
vp->vp_uint8 = pkt->author.req.authen_service;
fr_pair_cursor_append(&cursor, vp);
if (pkt->author.req.user_len) {
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_USER_NAME);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_USER_NAME);
if (!vp) return -1;
fr_pair_value_bstrncpy(vp, p, pkt->author.req.user_len);
p += vp->vp_length;
}
if (pkt->author.req.port_len) {
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_CLIENT_PORT);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_CLIENT_PORT);
if (!vp) return -1;
fr_pair_value_bstrncpy(vp, p, pkt->author.req.port_len);
p += vp->vp_length;
}
if (pkt->author.req.rem_addr_len) {
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_REMOTE_ADDRESS);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_REMOTE_ADDRESS);
if (!vp) return -1;
fr_pair_value_bstrncpy(vp, p, pkt->author.req.rem_addr_len);
fr_pair_cursor_append(&cursor, vp);
p += pkt->acct.req.arg_cnt;
if (pkt->acct.req.flags & TAC_PLUS_ACCT_FLAG_START) {
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_ACCOUNTING_FLAGS);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_ACCOUNTING_FLAGS);
if (!vp) return -1;
vp->vp_uint8 = TAC_PLUS_ACCT_FLAG_START;
fr_pair_cursor_append(&cursor, vp);
}
if (pkt->acct.req.flags & TAC_PLUS_ACCT_FLAG_STOP) {
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_ACCOUNTING_FLAGS);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_ACCOUNTING_FLAGS);
if (!vp) return -1;
vp->vp_uint8 = TAC_PLUS_ACCT_FLAG_STOP;
fr_pair_cursor_append(&cursor, vp);
}
if (pkt->acct.req.flags & TAC_PLUS_ACCT_FLAG_WATCHDOG) {
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_ACCOUNTING_FLAGS);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_ACCOUNTING_FLAGS);
if (!vp) return -1;
vp->vp_uint8 = TAC_PLUS_ACCT_FLAG_WATCHDOG;
fr_pair_cursor_append(&cursor, vp);
}
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_AUTHENTICATION_METHOD);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_AUTHENTICATION_METHOD);
if (!vp) return -1;
vp->vp_uint8 = pkt->acct.req.authen_method;
fr_pair_cursor_append(&cursor, vp);
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_PRIVILEGE_LEVEL);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_PRIVILEGE_LEVEL);
if (!vp) return -1;
vp->vp_uint8 = pkt->acct.req.priv_lvl;
fr_pair_cursor_append(&cursor, vp);
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_AUTHENTICATION_TYPE);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_AUTHENTICATION_TYPE);
if (!vp) return -1;
vp->vp_uint8 = pkt->acct.req.authen_type;
fr_pair_cursor_append(&cursor, vp);
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_AUTHENTICATION_SERVICE);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_AUTHENTICATION_SERVICE);
if (!vp) return -1;
vp->vp_uint8 = pkt->acct.req.authen_service;
fr_pair_cursor_append(&cursor, vp);
if (pkt->acct.req.user_len) {
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_USER_NAME);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_USER_NAME);
if (!vp) return -1;
fr_pair_value_bstrncpy(vp, p, pkt->acct.req.user_len);
p += vp->vp_length;
}
if (pkt->acct.req.port_len) {
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_CLIENT_PORT);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_CLIENT_PORT);
if (!vp) return -1;
fr_pair_value_bstrncpy(vp, p, pkt->acct.req.port_len);
p += vp->vp_length;
}
if (pkt->acct.req.rem_addr_len) {
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_REMOTE_ADDRESS);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_REMOTE_ADDRESS);
if (!vp) return -1;
fr_pair_value_bstrncpy(vp, p, pkt->acct.req.rem_addr_len);
fr_pair_cursor_append(&cursor, vp);
uint8_t seq_no;
VALUE_PAIR *vp;
- vp = fr_pair_find_by_child_num(original->vps, dict_tacacs_root, PW_TACACS_VERSION_MINOR, TAG_ANY);
+ vp = fr_pair_find_by_child_num(original->vps, dict_tacacs_root, FR_TACACS_VERSION_MINOR, TAG_ANY);
rad_assert(vp != NULL);
vminor = vp->vp_uint8;
type = tacacs_type(original);
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_PACKET_TYPE);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_PACKET_TYPE);
vp->vp_uint8 = type;
fr_pair_add(&packet->vps, vp);
- vp = fr_pair_find_by_child_num(original->vps, dict_tacacs_root, PW_TACACS_SEQUENCE_NUMBER, TAG_ANY);
+ vp = fr_pair_find_by_child_num(original->vps, dict_tacacs_root, FR_TACACS_SEQUENCE_NUMBER, TAG_ANY);
rad_assert(vp != NULL);
seq_no = vp->vp_uint8 + 1; /* we catch client 255 on ingress */
vp->vp_uint8 = seq_no;
fr_pair_add(&packet->vps, vp);
- vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, PW_TACACS_SESSION_ID);
+ vp = fr_pair_afrom_child_num(packet, dict_tacacs_root, FR_TACACS_SESSION_ID);
if (!vp) return -1;
vp->vp_uint32 = tacacs_session_id(original);
fr_pair_add(&packet->vps, vp);
if (packet->data_len < VQP_HDR_LEN) return -1;
fr_pair_cursor_init(&cursor, &packet->vps);
- vp = fr_pair_afrom_num(packet, 0, PW_VQP_PACKET_TYPE);
+ vp = fr_pair_afrom_num(packet, 0, FR_VQP_PACKET_TYPE);
if (!vp) {
fr_strerror_printf("No memory");
return -1;
debug_pair(vp);
fr_pair_cursor_append(&cursor, vp);
- vp = fr_pair_afrom_num(packet, 0, PW_VQP_ERROR_CODE);
+ vp = fr_pair_afrom_num(packet, 0, FR_VQP_ERROR_CODE);
if (!vp) {
fr_strerror_printf("No memory");
return -1;
debug_pair(vp);
fr_pair_cursor_append(&cursor, vp);
- vp = fr_pair_afrom_num(packet, 0, PW_VQP_SEQUENCE_NUMBER);
+ vp = fr_pair_afrom_num(packet, 0, FR_VQP_SEQUENCE_NUMBER);
if (!vp) {
fr_strerror_printf("No memory");
return -1;
code = packet->code;
if (!code) {
- vp = fr_pair_find_by_num(packet->vps, 0, PW_VQP_PACKET_TYPE, TAG_ANY);
+ vp = fr_pair_find_by_num(packet->vps, 0, FR_VQP_PACKET_TYPE, TAG_ANY);
if (!vp) {
fr_strerror_printf("Failed to find VQP-Packet-Type in response packet");
return -1;
length = VQP_HDR_LEN;
- vp = fr_pair_find_by_num(packet->vps, 0, PW_VQP_ERROR_CODE, TAG_ANY);
+ vp = fr_pair_find_by_num(packet->vps, 0, FR_VQP_ERROR_CODE, TAG_ANY);
if (vp) {
packet->data = talloc_array(packet, uint8_t, length);
if (!packet->data) {
check_item;
check_item = fr_pair_cursor_next(&check)) {
if (!check_item->da->vendor &&
- (check_item->da->attr == PW_FALL_THROUGH) &&
+ (check_item->da->attr == FR_FALL_THROUGH) &&
(check_item->vp_uint32 == 1)) {
fall_through = 1;
continue;
}
- else if (!check_item->da->vendor && check_item->da->attr == PW_RELAX_FILTER) {
+ else if (!check_item->da->vendor && check_item->da->attr == FR_RELAX_FILTER) {
relax_filter = check_item->vp_uint32;
continue;
}
* Vendor-Specific is special, and matches any VSA if the
* comparison is always true.
*/
- if ((check_item->da->attr == PW_VENDOR_SPECIFIC) && (input_item->da->vendor != 0) &&
+ if ((check_item->da->attr == FR_VENDOR_SPECIFIC) && (input_item->da->vendor != 0) &&
(check_item->op == T_OP_CMP_TRUE)) {
pass++;
continue;
fr_pair_list_free(&packet->vps);
packet->vps = output;
- if (request->packet->code == PW_CODE_ACCESS_REQUEST) {
- request->username = fr_pair_find_by_num(request->packet->vps, 0, PW_STRIPPED_USER_NAME, TAG_ANY);
+ if (request->packet->code == FR_CODE_ACCESS_REQUEST) {
+ request->username = fr_pair_find_by_num(request->packet->vps, 0, FR_STRIPPED_USER_NAME, TAG_ANY);
if (!request->username) {
- request->username = fr_pair_find_by_num(request->packet->vps, 0, PW_USER_NAME, TAG_ANY);
+ request->username = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY);
}
- request->password = fr_pair_find_by_num(request->packet->vps, 0, PW_USER_PASSWORD, TAG_ANY);
+ request->password = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_PASSWORD, TAG_ANY);
}
return RLM_MODULE_UPDATED;
/*
* Pull out the cache created date
*/
- if ((head->lhs->tmpl_da->vendor == 0) && (head->lhs->tmpl_da->attr == PW_CACHE_CREATED)) {
+ if ((head->lhs->tmpl_da->vendor == 0) && (head->lhs->tmpl_da->attr == FR_CACHE_CREATED)) {
vp_map_t *map;
c->created = head->rhs->tmpl_fr_value_box_datum.date;
/*
* Pull out the cache expires date
*/
- if ((head->lhs->tmpl_da->vendor == 0) && (head->lhs->tmpl_da->attr == PW_CACHE_EXPIRES)) {
+ if ((head->lhs->tmpl_da->vendor == 0) && (head->lhs->tmpl_da->attr == FR_CACHE_EXPIRES)) {
vp_map_t *map;
c->expires = head->rhs->tmpl_fr_value_box_datum.date;
if (inst->config.stats) {
rad_assert(request->packet != NULL);
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_CACHE_ENTRY_HITS, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_CACHE_ENTRY_HITS, TAG_ANY);
if (!vp) {
- vp = fr_pair_afrom_num(request->packet, 0, PW_CACHE_ENTRY_HITS);
+ vp = fr_pair_afrom_num(request->packet, 0, FR_CACHE_ENTRY_HITS);
rad_assert(vp != NULL);
fr_pair_add(&request->packet->vps, vp);
}
* cache control attributes.
*/
if (map->rhs->type == TMPL_TYPE_LIST) switch (vp->da->attr) {
- case PW_CACHE_TTL:
- case PW_CACHE_STATUS_ONLY:
- case PW_CACHE_MERGE_NEW:
- case PW_CACHE_ENTRY_HITS:
+ case FR_CACHE_TTL:
+ case FR_CACHE_STATUS_ONLY:
+ case FR_CACHE_MERGE_NEW:
+ case FR_CACHE_ENTRY_HITS:
RDEBUG2("Skipping %s", vp->da->name);
continue;
/*
* Check to see if we need to merge the entry into the request
*/
- vp = fr_pair_find_by_num(request->control, 0, PW_CACHE_MERGE_NEW, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_CACHE_MERGE_NEW, TAG_ANY);
if (vp && (vp->vp_uint32 > 0)) merge = true;
if (merge) cache_merge(inst, request, c);
* If Cache-Status-Only == yes, only return whether we found a
* valid cache entry
*/
- vp = fr_pair_find_by_num(request->control, 0, PW_CACHE_STATUS_ONLY, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_CACHE_STATUS_ONLY, TAG_ANY);
if (vp && vp->vp_uint32) {
RINDENT();
RDEBUG3("status-only: yes");
/*
* Figure out what operation we're doing
*/
- vp = fr_pair_find_by_num(request->control, 0, PW_CACHE_ALLOW_MERGE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_CACHE_ALLOW_MERGE, TAG_ANY);
if (vp) merge = (bool)vp->vp_uint32;
- vp = fr_pair_find_by_num(request->control, 0, PW_CACHE_ALLOW_INSERT, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_CACHE_ALLOW_INSERT, TAG_ANY);
if (vp) insert = (bool)vp->vp_uint32;
- vp = fr_pair_find_by_num(request->control, 0, PW_CACHE_TTL, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_CACHE_TTL, TAG_ANY);
if (vp) {
if (vp->vp_int32 == 0) {
expire = true;
vp;
vp = fr_pair_cursor_next(&cursor)) {
if (vp->da->vendor == 0) switch (vp->da->attr) {
- case PW_CACHE_TTL:
- case PW_CACHE_STATUS_ONLY:
- case PW_CACHE_ALLOW_MERGE:
- case PW_CACHE_ALLOW_INSERT:
- case PW_CACHE_MERGE_NEW:
+ case FR_CACHE_TTL:
+ case FR_CACHE_STATUS_ONLY:
+ case FR_CACHE_ALLOW_MERGE:
+ case FR_CACHE_ALLOW_INSERT:
+ case FR_CACHE_MERGE_NEW:
RDEBUG2("Removing &control:%s", vp->da->name);
vp = fr_pair_cursor_remove(&cursor);
talloc_free(vp);
* relevant cache entry fields.
*/
if (map->lhs->tmpl_da->vendor == 0) switch (map->lhs->tmpl_da->attr) {
- case PW_CACHE_CREATED:
+ case FR_CACHE_CREATED:
c->created = map->rhs->tmpl_fr_value_box_datum.date;
talloc_free(map);
goto next;
- case PW_CACHE_EXPIRES:
+ case FR_CACHE_EXPIRES:
c->expires = map->rhs->tmpl_fr_value_box_datum.date;
talloc_free(map);
goto next;
static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED void *instance, UNUSED void *thread, REQUEST *request)
{
- if (!fr_pair_find_by_num(request->packet->vps, 0, PW_CHAP_PASSWORD, TAG_ANY)) {
+ if (!fr_pair_find_by_num(request->packet->vps, 0, FR_CHAP_PASSWORD, TAG_ANY)) {
return RLM_MODULE_NOOP;
}
- if (fr_pair_find_by_num(request->control, 0, PW_AUTH_TYPE, TAG_ANY) != NULL) {
+ if (fr_pair_find_by_num(request->control, 0, FR_AUTH_TYPE, TAG_ANY) != NULL) {
RWDEBUG2("&control:Auth-Type already set. Not setting to CHAP");
return RLM_MODULE_NOOP;
}
return RLM_MODULE_INVALID;
}
- chap = fr_pair_find_by_num(request->packet->vps, 0, PW_CHAP_PASSWORD, TAG_ANY);
+ chap = fr_pair_find_by_num(request->packet->vps, 0, FR_CHAP_PASSWORD, TAG_ANY);
if (!chap) {
REDEBUG("You set '&control:Auth-Type = CHAP' for a request that "
"does not contain a CHAP-Password attribute!");
return RLM_MODULE_INVALID;
}
- password = fr_pair_find_by_num(request->control, 0, PW_CLEARTEXT_PASSWORD, TAG_ANY);
+ password = fr_pair_find_by_num(request->control, 0, FR_CLEARTEXT_PASSWORD, TAG_ANY);
if (password == NULL) {
- if (fr_pair_find_by_num(request->control, 0, PW_USER_PASSWORD, TAG_ANY) != NULL){
+ if (fr_pair_find_by_num(request->control, 0, FR_USER_PASSWORD, TAG_ANY) != NULL){
REDEBUG("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
REDEBUG("!!! Please update your configuration so that the \"known !!!");
REDEBUG("!!! good\" cleartext password is in Cleartext-Password, !!!");
RDEBUG3("Comparing with \"known good\" &control:Cleartext-Password value \"%s\"",
password->vp_strvalue);
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_CHAP_CHALLENGE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_CHAP_CHALLENGE, TAG_ANY);
if (vp) {
RDEBUG2("Using challenge from &request:CHAP-Challenge");
p = vp->vp_octets;
* For Access-Requests, which have CHAP-Password,
* and no CHAP-Challenge, copy it over from the request.
*/
- if (request->packet->code != PW_CODE_ACCESS_REQUEST) return RLM_MODULE_NOOP;
+ if (request->packet->code != FR_CODE_ACCESS_REQUEST) return RLM_MODULE_NOOP;
- if (!fr_pair_find_by_num(request->proxy->packet->vps, 0, PW_CHAP_PASSWORD, TAG_ANY)) return RLM_MODULE_NOOP;
+ if (!fr_pair_find_by_num(request->proxy->packet->vps, 0, FR_CHAP_PASSWORD, TAG_ANY)) return RLM_MODULE_NOOP;
- if (fr_pair_find_by_num(request->proxy->packet->vps, 0, PW_CHAP_CHALLENGE, TAG_ANY)) return RLM_MODULE_NOOP;
+ if (fr_pair_find_by_num(request->proxy->packet->vps, 0, FR_CHAP_CHALLENGE, TAG_ANY)) return RLM_MODULE_NOOP;
- vp = radius_pair_create(request->proxy->packet, &request->proxy->packet->vps, PW_CHAP_CHALLENGE, 0);
+ vp = radius_pair_create(request->proxy->packet, &request->proxy->packet->vps, FR_CHAP_CHALLENGE, 0);
if (!vp) return RLM_MODULE_FAIL;
fr_pair_value_memcpy(vp, request->packet->vector, sizeof(request->packet->vector));
}
/* get current event timestamp */
- if ((vp = fr_pair_find_by_num(vps, 0, PW_EVENT_TIMESTAMP, TAG_ANY)) != NULL) {
+ if ((vp = fr_pair_find_by_num(vps, 0, FR_EVENT_TIMESTAMP, TAG_ANY)) != NULL) {
/* get seconds value from attribute */
ts = vp->vp_date;
} else {
memset(value, 0, sizeof(value));
/* get elapsed session time */
- if ((vp = fr_pair_find_by_num(vps, 0, PW_ACCT_SESSION_TIME, TAG_ANY)) != NULL) {
+ if ((vp = fr_pair_find_by_num(vps, 0, FR_ACCT_SESSION_TIME, TAG_ANY)) != NULL) {
/* calculate diff */
ts = (ts - vp->vp_uint32);
/* calculate start time */
rad_assert(request->packet != NULL);
/* sanity check */
- if ((vp = fr_pair_find_by_num(request->packet->vps, 0, PW_ACCT_STATUS_TYPE, TAG_ANY)) == NULL) {
+ if ((vp = fr_pair_find_by_num(request->packet->vps, 0, FR_ACCT_STATUS_TYPE, TAG_ANY)) == NULL) {
/* log debug */
RDEBUG("could not find status type in packet");
/* return */
status = vp->vp_uint32;
/* acknowledge the request but take no action */
- if (status == PW_STATUS_ACCOUNTING_ON || status == PW_STATUS_ACCOUNTING_OFF) {
+ if (status == FR_STATUS_ACCOUNTING_ON || status == FR_STATUS_ACCOUNTING_OFF) {
/* log debug */
RDEBUG("handling accounting on/off request without action");
/* return */
/* status specific replacements for start/stop time */
switch (status) {
- case PW_STATUS_START:
+ case FR_STATUS_START:
/* add start time */
- if ((vp = fr_pair_find_by_num(request->packet->vps, 0, PW_EVENT_TIMESTAMP, TAG_ANY)) != NULL) {
+ if ((vp = fr_pair_find_by_num(request->packet->vps, 0, FR_EVENT_TIMESTAMP, TAG_ANY)) != NULL) {
/* add to json object */
json_object_object_add(cookie->jobj, "startTimestamp",
mod_value_pair_to_json_object(request, vp));
}
break;
- case PW_STATUS_STOP:
+ case FR_STATUS_STOP:
/* add stop time */
- if ((vp = fr_pair_find_by_num(request->packet->vps, 0, PW_EVENT_TIMESTAMP, TAG_ANY)) != NULL) {
+ if ((vp = fr_pair_find_by_num(request->packet->vps, 0, FR_EVENT_TIMESTAMP, TAG_ANY)) != NULL) {
/* add to json object */
json_object_object_add(cookie->jobj, "stopTimestamp",
mod_value_pair_to_json_object(request, vp));
mod_ensure_start_timestamp(cookie->jobj, request->packet->vps);
break;
- case PW_STATUS_ALIVE:
+ case FR_STATUS_ALIVE:
/* check start timestamp and adjust if needed */
mod_ensure_start_timestamp(cookie->jobj, request->packet->vps);
break;
request->simul_count = 0;
/* get client ip address for MPP detection below */
- if ((vp = fr_pair_find_by_num(request->packet->vps, 0, PW_FRAMED_IP_ADDRESS, TAG_ANY)) != NULL) {
+ if ((vp = fr_pair_find_by_num(request->packet->vps, 0, FR_FRAMED_IP_ADDRESS, TAG_ANY)) != NULL) {
client_ip_addr = vp->vp_ipv4addr;
}
/* get calling station id for MPP detection below */
- if ((vp = fr_pair_find_by_num(request->packet->vps, 0, PW_CALLING_STATION_ID, TAG_ANY)) != NULL) {
+ if ((vp = fr_pair_find_by_num(request->packet->vps, 0, FR_CALLING_STATION_ID, TAG_ANY)) != NULL) {
client_cs_id = vp->vp_strvalue;
}
VALUE_PAIR *authtype, *challenge, *response, *password;
uint8_t buffer[64];
- password = fr_pair_find_by_num(request->control, 0, PW_CLEARTEXT_PASSWORD, TAG_ANY);
+ password = fr_pair_find_by_num(request->control, 0, FR_CLEARTEXT_PASSWORD, TAG_ANY);
if (!password) {
REDEBUG("&Cleartext-Password is required for authentication");
return RLM_MODULE_INVALID;
switch (packet->src_ipaddr.af) {
case AF_INET:
- src_vp.da = fr_dict_attr_by_num(NULL, 0, PW_PACKET_SRC_IP_ADDRESS);
+ src_vp.da = fr_dict_attr_by_num(NULL, 0, FR_PACKET_SRC_IP_ADDRESS);
src_vp.vp_ipv4addr = packet->src_ipaddr.addr.v4.s_addr;
- dst_vp.da = fr_dict_attr_by_num(NULL, 0, PW_PACKET_DST_IP_ADDRESS);
+ dst_vp.da = fr_dict_attr_by_num(NULL, 0, FR_PACKET_DST_IP_ADDRESS);
dst_vp.vp_ipv4addr = packet->dst_ipaddr.addr.v4.s_addr;
break;
case AF_INET6:
- src_vp.da = fr_dict_attr_by_num(NULL, 0, PW_PACKET_SRC_IPV6_ADDRESS);
+ src_vp.da = fr_dict_attr_by_num(NULL, 0, FR_PACKET_SRC_IPV6_ADDRESS);
memcpy(&src_vp.vp_ipv6addr, &packet->src_ipaddr.addr.v6,
sizeof(packet->src_ipaddr.addr.v6));
- dst_vp.da = fr_dict_attr_by_num(NULL, 0, PW_PACKET_DST_IPV6_ADDRESS);
+ dst_vp.da = fr_dict_attr_by_num(NULL, 0, FR_PACKET_DST_IPV6_ADDRESS);
memcpy(&dst_vp.vp_ipv6addr, &packet->dst_ipaddr.addr.v6,
sizeof(packet->dst_ipaddr.addr.v6));
break;
detail_fr_pair_fprint(request, out, &src_vp);
detail_fr_pair_fprint(request, out, &dst_vp);
- src_vp.da = fr_dict_attr_by_num(NULL, 0, PW_PACKET_SRC_PORT);
+ src_vp.da = fr_dict_attr_by_num(NULL, 0, FR_PACKET_SRC_PORT);
src_vp.vp_uint32 = packet->src_port;
- dst_vp.da = fr_dict_attr_by_num(NULL, 0, PW_PACKET_DST_PORT);
+ dst_vp.da = fr_dict_attr_by_num(NULL, 0, FR_PACKET_DST_PORT);
dst_vp.vp_uint32 = packet->dst_port;
detail_fr_pair_fprint(request, out, &src_vp);
/*
* Don't print passwords in old format...
*/
- if (compat && !vp->da->vendor && (vp->da->attr == PW_USER_PASSWORD)) continue;
+ if (compat && !vp->da->vendor && (vp->da->attr == FR_USER_PASSWORD)) continue;
/*
* Print all of the attributes, operator should always be '='.
rcode = mod_accounting(instance, thread, request);
if (rcode == RLM_MODULE_OK) {
- request->reply->code = PW_CODE_ACCOUNTING_RESPONSE;
+ request->reply->code = FR_CODE_ACCOUNTING_RESPONSE;
}
return rcode;
}
/*
* We need both of these attributes to do the authentication.
*/
- first = fr_pair_find_by_num(request->packet->vps, 0, PW_DIGEST_RESPONSE, TAG_ANY);
+ first = fr_pair_find_by_num(request->packet->vps, 0, FR_DIGEST_RESPONSE, TAG_ANY);
if (!first) {
return RLM_MODULE_NOOP;
}
*/
RDEBUG("Checking for correctly formatted Digest-Attributes");
- first = fr_pair_find_by_num(request->packet->vps, 0, PW_DIGEST_ATTRIBUTES, TAG_ANY);
+ first = fr_pair_find_by_num(request->packet->vps, 0, FR_DIGEST_ATTRIBUTES, TAG_ANY);
if (!first) {
return RLM_MODULE_NOOP;
}
fr_pair_cursor_init(&cursor, &first);
- while ((i = fr_pair_cursor_next_by_num(&cursor, 0, PW_DIGEST_ATTRIBUTES, TAG_ANY))) {
+ while ((i = fr_pair_cursor_next_by_num(&cursor, 0, FR_DIGEST_ATTRIBUTES, TAG_ANY))) {
int length = i->vp_length;
int attrlen;
uint8_t const *p = i->vp_octets;
*/
RDEBUG("Digest-Attributes look OK. Converting them to something more useful");
fr_pair_cursor_first(&cursor);
- while ((i = fr_pair_cursor_next_by_num(&cursor, 0, PW_DIGEST_ATTRIBUTES, TAG_ANY))) {
+ while ((i = fr_pair_cursor_next_by_num(&cursor, 0, FR_DIGEST_ATTRIBUTES, TAG_ANY))) {
int length = i->vp_length;
int attrlen;
uint8_t const *p = &i->vp_octets[0];
* Didn't they know that VSA's exist?
*/
sub = radius_pair_create(request->packet, &request->packet->vps,
- PW_DIGEST_REALM - 1 + p[0], 0);
+ FR_DIGEST_REALM - 1 + p[0], 0);
fr_pair_value_bstrncpy(sub, p + 2, attrlen - 2);
RINDENT();
if (rcode != RLM_MODULE_OK) return rcode;
- if (fr_pair_find_by_num(request->control, 0, PW_AUTH_TYPE, TAG_ANY)) {
+ if (fr_pair_find_by_num(request->control, 0, FR_AUTH_TYPE, TAG_ANY)) {
RWDEBUG2("Auth-Type already set. Not setting to DIGEST");
return RLM_MODULE_NOOP;
}
* We require access to the plain-text password, or to the
* Digest-HA1 parameter.
*/
- passwd = fr_pair_find_by_num(request->control, 0, PW_DIGEST_HA1, TAG_ANY);
+ passwd = fr_pair_find_by_num(request->control, 0, FR_DIGEST_HA1, TAG_ANY);
if (passwd) {
if (passwd->vp_length != 32) {
RAUTH("Digest-HA1 has invalid length, authentication failed");
return RLM_MODULE_INVALID;
}
} else {
- passwd = fr_pair_find_by_num(request->control, 0, PW_CLEARTEXT_PASSWORD, TAG_ANY);
+ passwd = fr_pair_find_by_num(request->control, 0, FR_CLEARTEXT_PASSWORD, TAG_ANY);
}
if (!passwd) {
RAUTH("Cleartext-Password or Digest-HA1 is required for authentication");
/*
* We need these, too.
*/
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_DIGEST_ATTRIBUTES, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_DIGEST_ATTRIBUTES, TAG_ANY);
if (!vp) {
error:
REDEBUG("You set 'Auth-Type = Digest' for a request that does not contain any digest attributes!");
* "authorize" section. In that case, try to decode the
* attributes here.
*/
- if (!fr_pair_find_by_num(request->packet->vps, 0, PW_DIGEST_NONCE, TAG_ANY)) {
+ if (!fr_pair_find_by_num(request->packet->vps, 0, FR_DIGEST_NONCE, TAG_ANY)) {
int rcode;
rcode = digest_fix(request);
/*
* We require access to the Digest-Nonce-Value
*/
- nonce = fr_pair_find_by_num(request->packet->vps, 0, PW_DIGEST_NONCE, TAG_ANY);
+ nonce = fr_pair_find_by_num(request->packet->vps, 0, FR_DIGEST_NONCE, TAG_ANY);
if (!nonce) {
REDEBUG("No Digest-Nonce: Cannot perform Digest authentication");
return RLM_MODULE_INVALID;
/*
* A1 = Digest-User-Name ":" Realm ":" Password
*/
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_DIGEST_USER_NAME, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_DIGEST_USER_NAME, TAG_ANY);
if (!vp) {
REDEBUG("No Digest-User-Name: Cannot perform Digest authentication");
return RLM_MODULE_INVALID;
a1[a1_len] = ':';
a1_len++;
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_DIGEST_REALM, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_DIGEST_REALM, TAG_ANY);
if (!vp) {
REDEBUG("No Digest-Realm: Cannot perform Digest authentication");
return RLM_MODULE_INVALID;
a1[a1_len] = ':';
a1_len++;
- if (passwd->da->attr == PW_CLEARTEXT_PASSWORD) {
+ if (passwd->da->attr == FR_CLEARTEXT_PASSWORD) {
memcpy(&a1[a1_len], passwd->vp_octets, passwd->vp_length);
a1_len += passwd->vp_length;
a1[a1_len] = '\0';
* See which variant we calculate.
* Assume MD5 if no Digest-Algorithm attribute received
*/
- algo = fr_pair_find_by_num(request->packet->vps, 0, PW_DIGEST_ALGORITHM, TAG_ANY);
+ algo = fr_pair_find_by_num(request->packet->vps, 0, FR_DIGEST_ALGORITHM, TAG_ANY);
if ((!algo) ||
(strcasecmp(algo->vp_strvalue, "MD5") == 0)) {
/*
* Set A1 to Digest-HA1 if no User-Password found
*/
- if (passwd->da->attr == PW_DIGEST_HA1) {
+ if (passwd->da->attr == FR_DIGEST_HA1) {
if (fr_hex2bin(&a1[0], sizeof(a1), passwd->vp_strvalue, passwd->vp_length) != 16) {
RDEBUG2("Invalid text in Digest-HA1");
return RLM_MODULE_INVALID;
* If we find Digest-HA1, we assume it contains
* H(A1).
*/
- if (passwd->da->attr == PW_CLEARTEXT_PASSWORD) {
+ if (passwd->da->attr == FR_CLEARTEXT_PASSWORD) {
fr_md5_calc(hash, &a1[0], a1_len);
fr_bin2hex((char *) &a1[0], hash, 16);
} else { /* MUST be Digest-HA1 */
a1[a1_len] = ':';
a1_len++;
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_DIGEST_CNONCE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_DIGEST_CNONCE, TAG_ANY);
if (!vp) {
REDEBUG("No Digest-CNonce: Cannot perform Digest authentication");
return RLM_MODULE_INVALID;
/*
* A2 = Digest-Method ":" Digest-URI
*/
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_DIGEST_METHOD, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_DIGEST_METHOD, TAG_ANY);
if (!vp) {
REDEBUG("No Digest-Method: Cannot perform Digest authentication");
return RLM_MODULE_INVALID;
a2[a2_len] = ':';
a2_len++;
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_DIGEST_URI, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_DIGEST_URI, TAG_ANY);
if (!vp) {
REDEBUG("No Digest-URI: Cannot perform Digest authentication");
return RLM_MODULE_INVALID;
/*
* QOP is "auth-int", tack on ": Digest-Body-Digest"
*/
- qop = fr_pair_find_by_num(request->packet->vps, 0, PW_DIGEST_QOP, TAG_ANY);
+ qop = fr_pair_find_by_num(request->packet->vps, 0, FR_DIGEST_QOP, TAG_ANY);
if (qop) {
if (strcasecmp(qop->vp_strvalue, "auth-int") == 0) {
VALUE_PAIR *body;
/*
* Must be a hex representation of an MD5 digest.
*/
- body = fr_pair_find_by_num(request->packet->vps, 0, PW_DIGEST_BODY_DIGEST, TAG_ANY);
+ body = fr_pair_find_by_num(request->packet->vps, 0, FR_DIGEST_BODY_DIGEST, TAG_ANY);
if (!body) {
REDEBUG("No Digest-Body-Digest: Cannot perform Digest authentication");
return RLM_MODULE_INVALID;
*/
if (((algo != NULL) &&
(strcasecmp(algo->vp_strvalue, "MD5-Sess") == 0)) ||
- (passwd->da->attr == PW_CLEARTEXT_PASSWORD)) {
+ (passwd->da->attr == FR_CLEARTEXT_PASSWORD)) {
a1[a1_len] = '\0';
fr_md5_calc(&hash[0], &a1[0], a1_len);
} else {
kd[kd_len] = ':';
kd_len++;
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_DIGEST_NONCE_COUNT, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_DIGEST_NONCE_COUNT, TAG_ANY);
if (!vp) {
REDEBUG("No Digest-Nonce-Count: Cannot perform Digest authentication");
return RLM_MODULE_INVALID;
kd[kd_len] = ':';
kd_len++;
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_DIGEST_CNONCE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_DIGEST_CNONCE, TAG_ANY);
if (!vp) {
REDEBUG("No Digest-CNonce: Cannot perform Digest authentication");
return RLM_MODULE_INVALID;
/*
* Get the binary value of Digest-Response
*/
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_DIGEST_RESPONSE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_DIGEST_RESPONSE, TAG_ANY);
if (!vp) {
REDEBUG("No Digest-Response attribute in the request. Cannot perform digest authentication");
return RLM_MODULE_INVALID;
* packet that it is sent in response
* to.
*/
- case PW_EAP_SUCCESS:
- case PW_EAP_FAILURE:
+ case FR_EAP_SUCCESS:
+ case FR_EAP_FAILURE:
break;
/*
* that the TTLS and PEAP modules can call it to do most
* of their dirty work.
*/
- if (((eap_round->request->code == PW_EAP_REQUEST) ||
- (eap_round->request->code == PW_EAP_RESPONSE)) &&
+ if (((eap_round->request->code == FR_EAP_REQUEST) ||
+ (eap_round->request->code == FR_EAP_RESPONSE)) &&
(eap_round->request->type.num == 0)) {
- rad_assert(eap_session->type >= PW_EAP_MD5);
- rad_assert(eap_session->type < PW_EAP_MAX_TYPES);
+ rad_assert(eap_session->type >= FR_EAP_MD5);
+ rad_assert(eap_session->type < FR_EAP_MAX_TYPES);
eap_round->request->type.num = eap_session->type;
}
eap_packet = (eap_packet_raw_t *)reply->packet;
- vp = radius_pair_create(request->reply, &request->reply->vps, PW_EAP_MESSAGE, 0);
+ vp = radius_pair_create(request->reply, &request->reply->vps, FR_EAP_MESSAGE, 0);
if (!vp) return RLM_MODULE_INVALID;
vp->vp_length = eap_packet->length[0] * 256 + eap_packet->length[1];
* Don't add a Message-Authenticator if
* it's already there.
*/
- vp = fr_pair_find_by_num(request->reply->vps, 0, PW_MESSAGE_AUTHENTICATOR, TAG_ANY);
+ vp = fr_pair_find_by_num(request->reply->vps, 0, FR_MESSAGE_AUTHENTICATOR, TAG_ANY);
if (!vp) {
- vp = fr_pair_afrom_num(request->reply, 0, PW_MESSAGE_AUTHENTICATOR);
+ vp = fr_pair_afrom_num(request->reply, 0, FR_MESSAGE_AUTHENTICATOR);
fr_pair_value_memsteal(vp, talloc_zero_array(vp, uint8_t, AUTH_VECTOR_LEN));
fr_pair_add(&(request->reply->vps), vp);
}
/* Set request reply code, but only if it's not already set. */
rcode = RLM_MODULE_OK;
if (!request->reply->code) switch (reply->code) {
- case PW_EAP_RESPONSE:
- request->reply->code = PW_CODE_ACCESS_ACCEPT;
+ case FR_EAP_RESPONSE:
+ request->reply->code = FR_CODE_ACCESS_ACCEPT;
rcode = RLM_MODULE_HANDLED; /* leap weirdness */
break;
- case PW_EAP_SUCCESS:
- request->reply->code = PW_CODE_ACCESS_ACCEPT;
+ case FR_EAP_SUCCESS:
+ request->reply->code = FR_CODE_ACCESS_ACCEPT;
rcode = RLM_MODULE_OK;
break;
- case PW_EAP_FAILURE:
- request->reply->code = PW_CODE_ACCESS_REJECT;
+ case FR_EAP_FAILURE:
+ request->reply->code = FR_CODE_ACCESS_REJECT;
rcode = RLM_MODULE_REJECT;
break;
- case PW_EAP_REQUEST:
- request->reply->code = PW_CODE_ACCESS_CHALLENGE;
+ case FR_EAP_REQUEST:
+ request->reply->code = FR_CODE_ACCESS_CHALLENGE;
rcode = RLM_MODULE_HANDLED;
break;
/* Should never enter here */
REDEBUG("Reply code %d is unknown, rejecting the request", reply->code);
- request->reply->code = PW_CODE_ACCESS_REJECT;
- reply->code = PW_EAP_FAILURE;
+ request->reply->code = FR_CODE_ACCESS_REJECT;
+ reply->code = FR_EAP_FAILURE;
rcode = RLM_MODULE_REJECT;
break;
}
VALUE_PAIR *vp, *proxy;
VALUE_PAIR *eap_msg;
- eap_msg = fr_pair_find_by_num(request->packet->vps, 0, PW_EAP_MESSAGE, TAG_ANY);
+ eap_msg = fr_pair_find_by_num(request->packet->vps, 0, FR_EAP_MESSAGE, TAG_ANY);
if (!eap_msg) {
RDEBUG2("No EAP-Message, not doing EAP");
return RLM_MODULE_NOOP;
* Look for EAP-Type = None (FreeRADIUS specific attribute)
* this allows you to NOT do EAP for some users.
*/
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_EAP_TYPE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_EAP_TYPE, TAG_ANY);
if (vp && vp->vp_uint32 == 0) {
RDEBUG2("Found EAP-Message, but EAP-Type = None, so we're not doing EAP");
return RLM_MODULE_NOOP;
* Check for a Proxy-To-Realm. Don't get excited over LOCAL
* realms (sigh).
*/
- proxy = fr_pair_find_by_num(request->control, 0, PW_PROXY_TO_REALM, TAG_ANY);
+ proxy = fr_pair_find_by_num(request->control, 0, FR_PROXY_TO_REALM, TAG_ANY);
if (proxy) {
REALM *realm;
}
RDEBUG2("Got EAP_START message");
- vp = fr_pair_afrom_num(request->reply, 0, PW_EAP_MESSAGE);
+ vp = fr_pair_afrom_num(request->reply, 0, FR_EAP_MESSAGE);
if (!vp) return RLM_MODULE_FAIL;
fr_pair_add(&request->reply->vps, vp);
* Manually create an EAP Identity request
*/
p = talloc_array(vp, uint8_t, 5);
- p[0] = PW_EAP_REQUEST;
+ p[0] = FR_EAP_REQUEST;
p[1] = 0; /* ID */
p[2] = 0;
p[3] = 5; /* length */
- p[4] = PW_EAP_IDENTITY;
+ p[4] = FR_EAP_IDENTITY;
fr_pair_value_memsteal(vp, p);
return RLM_MODULE_HANDLED;
* server, but they're not forbidden from doing so.
* This behaviour was observed with a Spirent Avalanche test server.
*/
- if ((eap_msg->vp_length == EAP_HEADER_LEN) && (eap_msg->vp_octets[0] == PW_EAP_FAILURE)) {
+ if ((eap_msg->vp_length == EAP_HEADER_LEN) && (eap_msg->vp_octets[0] == FR_EAP_FAILURE)) {
REDEBUG("Peer sent EAP %s (code %i) ID %d length %zu",
eap_codes[eap_msg->vp_octets[0]],
eap_msg->vp_octets[0],
* Create an EAP-Type containing the EAP-type
* from the packet.
*/
- vp = fr_pair_afrom_num(request->packet, 0, PW_EAP_TYPE);
+ vp = fr_pair_afrom_num(request->packet, 0, FR_EAP_TYPE);
if (vp) {
vp->vp_uint32 = eap_msg->vp_octets[4];
fr_pair_add(&(request->packet->vps), vp);
* Success, or Failure.
*/
if ((eap_msg->vp_octets[0] == 0) ||
- (eap_msg->vp_octets[0] >= PW_EAP_MAX_CODES)) {
+ (eap_msg->vp_octets[0] >= FR_EAP_MAX_CODES)) {
RDEBUG2("Peer sent EAP packet with unknown code %i", eap_msg->vp_octets[0]);
} else {
RDEBUG2("Peer sent EAP %s (code %i) ID %d length %zu",
* sending success/fail packets to us, as it doesn't make
* sense.
*/
- if ((eap_msg->vp_octets[0] != PW_EAP_REQUEST) &&
- (eap_msg->vp_octets[0] != PW_EAP_RESPONSE)) {
+ if ((eap_msg->vp_octets[0] != FR_EAP_REQUEST) &&
+ (eap_msg->vp_octets[0] != FR_EAP_RESPONSE)) {
RDEBUG2("Ignoring EAP packet which we don't know how to handle");
return RLM_MODULE_FAIL;
}
* EAP-Identity, Notification, and NAK are all handled
* internally, so they never have eap_sessions.
*/
- if ((eap_msg->vp_octets[4] >= PW_EAP_MD5) &&
+ if ((eap_msg->vp_octets[4] >= FR_EAP_MD5) &&
inst->config.ignore_unknown_types &&
((eap_msg->vp_octets[4] == 0) ||
- (eap_msg->vp_octets[4] >= PW_EAP_MAX_TYPES) ||
+ (eap_msg->vp_octets[4] >= FR_EAP_MAX_TYPES) ||
(!inst->methods[eap_msg->vp_octets[4]]))) {
RDEBUG2("Ignoring Unknown EAP type");
return RLM_MODULE_NOOP;
* returns NOOP, and another module may choose to proxy
* the request.
*/
- if ((eap_msg->vp_octets[4] == PW_EAP_NAK) &&
+ if ((eap_msg->vp_octets[4] == FR_EAP_NAK) &&
(eap_msg->vp_length >= (EAP_HEADER_LEN + 2)) &&
inst->config.ignore_unknown_types &&
((eap_msg->vp_octets[5] == 0) ||
- (eap_msg->vp_octets[5] >= PW_EAP_MAX_TYPES) ||
+ (eap_msg->vp_octets[5] >= FR_EAP_MAX_TYPES) ||
(!inst->methods[eap_msg->vp_octets[5]]))) {
RDEBUG2("Ignoring NAK with request for unknown EAP type");
return RLM_MODULE_NOOP;
}
- if ((eap_msg->vp_octets[4] == PW_EAP_TTLS) ||
- (eap_msg->vp_octets[4] == PW_EAP_PEAP)) {
+ if ((eap_msg->vp_octets[4] == FR_EAP_TTLS) ||
+ (eap_msg->vp_octets[4] == FR_EAP_PEAP)) {
RDEBUG2("Continuing tunnel setup");
return RLM_MODULE_OK;
}
*
* ...in the inner-tunnel, to avoid expensive and unnecessary SQL/LDAP lookups
*/
- if (eap_msg->vp_octets[4] == PW_EAP_IDENTITY) {
+ if (eap_msg->vp_octets[4] == FR_EAP_IDENTITY) {
RDEBUG2("Peer sent EAP-Identity. Returning 'ok' so we can short-circuit the rest of authorize");
return RLM_MODULE_OK;
}
/*
* Delete any previous replies.
*/
- fr_pair_delete_by_num(&eap_session->request->reply->vps, 0, PW_EAP_MESSAGE, TAG_ANY);
- fr_pair_delete_by_num(&eap_session->request->reply->vps, 0, PW_STATE, TAG_ANY);
+ fr_pair_delete_by_num(&eap_session->request->reply->vps, 0, FR_EAP_MESSAGE, TAG_ANY);
+ fr_pair_delete_by_num(&eap_session->request->reply->vps, 0, FR_STATE, TAG_ANY);
talloc_free(eap_session->this_round->request);
eap_session->this_round->request = talloc_zero(eap_session->this_round, eap_packet_t);
- eap_session->this_round->request->code = PW_EAP_FAILURE;
+ eap_session->this_round->request->code = FR_EAP_FAILURE;
eap_session->finished = true;
eap_compose(eap_session);
}
*/
void eap_success(eap_session_t *eap_session)
{
- eap_session->this_round->request->code = PW_EAP_SUCCESS;
+ eap_session->this_round->request->code = FR_EAP_SUCCESS;
eap_session->finished = true;
eap_compose(eap_session);
}
* High level EAP packet checks
*/
if ((len <= EAP_HEADER_LEN) ||
- ((eap_packet->code != PW_EAP_RESPONSE) &&
- (eap_packet->code != PW_EAP_REQUEST))) {
+ ((eap_packet->code != FR_EAP_RESPONSE) &&
+ (eap_packet->code != FR_EAP_REQUEST))) {
REDEBUG("Badly formatted EAP Message: Ignoring the packet");
return -1;
}
if ((eap_packet->data[0] <= 0) ||
- (eap_packet->data[0] >= PW_EAP_MAX_TYPES)) {
+ (eap_packet->data[0] >= FR_EAP_MAX_TYPES)) {
/*
* Handle expanded types by smashing them to
* normal types.
*/
- if (eap_packet->data[0] == PW_EAP_EXPANDED_TYPE) {
+ if (eap_packet->data[0] == FR_EAP_EXPANDED_TYPE) {
uint8_t *p, *q;
if (len <= (EAP_HEADER_LEN + 1 + 3 + 4)) {
}
if ((eap_packet->data[7] == 0) ||
- (eap_packet->data[7] >= PW_EAP_MAX_TYPES)) {
+ (eap_packet->data[7] >= FR_EAP_MAX_TYPES)) {
REDEBUG("Unsupported Expanded EAP type %s (%u): ignoring the packet",
eap_type2name(eap_packet->data[7]), eap_packet->data[7]);
return -1;
}
- if (eap_packet->data[7] == PW_EAP_NAK) {
+ if (eap_packet->data[7] == FR_EAP_NAK) {
REDEBUG("Unsupported Expanded EAP-NAK: ignoring the packet");
return -1;
}
}
/* we don't expect notification, but we send it */
- if (eap_packet->data[0] == PW_EAP_NOTIFICATION) {
+ if (eap_packet->data[0] == FR_EAP_NOTIFICATION) {
REDEBUG("Got NOTIFICATION, Ignoring the packet");
return -1;
}
uint16_t len;
if (!eap_packet ||
- (eap_packet->code != PW_EAP_RESPONSE) ||
- (eap_packet->data[0] != PW_EAP_IDENTITY)) return NULL;
+ (eap_packet->code != FR_EAP_RESPONSE) ||
+ (eap_packet->data[0] != FR_EAP_IDENTITY)) return NULL;
memcpy(&len, eap_packet->length, sizeof(uint16_t));
len = ntohs(len);
* eap_session_t MUST be found in the list if it is not
* EAP-Identity response
*/
- if (eap_packet->data[0] != PW_EAP_IDENTITY) {
+ if (eap_packet->data[0] != FR_EAP_IDENTITY) {
eap_session = eap_session_thaw(request);
if (!eap_session) {
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_STATE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_STATE, TAG_ANY);
if (!vp) {
REDEBUG("EAP requires the State attribute to work, but no State exists in the Access-Request packet.");
REDEBUG("The RADIUS client is broken. No amount of changing FreeRADIUS will fix the RADIUS client.");
* to a request for a particular type, but it's NOT
* OK to blindly return data for another type.
*/
- if ((eap_packet->data[0] != PW_EAP_NAK) &&
+ if ((eap_packet->data[0] != FR_EAP_NAK) &&
(eap_packet->data[0] != eap_session->type)) {
RERROR("Response appears to match a previous request, but the EAP type is wrong");
RERROR("We expected EAP type %s, but received type %s",
request_data_add(request, NULL, REQUEST_DATA_EAP_SESSION, eap_session, true, true, true);
}
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_USER_NAME, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY);
if (!vp) {
/*
* NAS did not set the User-Name
#define REQUEST_DATA_EAP_SESSION (1)
#define REQUEST_DATA_EAP_SESSION_PROXIED (2)
-#define REQUEST_DATA_EAP_TUNNEL_CALLBACK PW_EAP_MESSAGE
-#define REQUEST_DATA_EAP_MSCHAP_TUNNEL_CALLBACK ((PW_EAP_MESSAGE << 16) | PW_EAP_MSCHAPV2)
+#define REQUEST_DATA_EAP_TUNNEL_CALLBACK FR_EAP_MESSAGE
+#define REQUEST_DATA_EAP_MSCHAP_TUNNEL_CALLBACK ((FR_EAP_MESSAGE << 16) | FR_EAP_MSCHAPV2)
#define RAD_REQUEST_OPTION_PROXY_EAP (1 << 16)
/*
* Skip things which shouldn't be in channel bindings.
*/
if (vp->da->flags.encrypt != FLAG_ENCRYPT_NONE) continue;
- if (!vp->da->vendor && (vp->da->attr == PW_MESSAGE_AUTHENTICATOR)) continue;
+ if (!vp->da->vendor && (vp->da->attr == FR_MESSAGE_AUTHENTICATOR)) continue;
total += 2 + vp->vp_length;
}
* Set the response code. Default to "fail" if none was
* specified.
*/
- vp = fr_pair_find_by_num(request->control, 0, PW_CHBIND_RESPONSE_CODE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_CHBIND_RESPONSE_CODE, TAG_ANY);
if (vp) {
ptr[0] = vp->vp_uint32;
} else {
fr_pair_cursor_next(&cursor);
continue;
}
- if (!vp->da->vendor && (vp->da->attr == PW_MESSAGE_AUTHENTICATOR)) goto next;
+ if (!vp->da->vendor && (vp->da->attr == FR_MESSAGE_AUTHENTICATOR)) goto next;
length = fr_radius_encode_pair(ptr, end - ptr, &cursor, NULL);
ptr += length;
}
-PW_CODE chbind_process(REQUEST *request, CHBIND_REQ *chbind)
+FR_CODE chbind_process(REQUEST *request, CHBIND_REQ *chbind)
{
- PW_CODE code;
+ FR_CODE code;
rlm_rcode_t rcode;
REQUEST *fake = NULL;
uint8_t const *attr_data;
*/
talloc_free(fake);
- return PW_CODE_ACCESS_ACCEPT;
+ return FR_CODE_ACCESS_ACCEPT;
}
attr_data += attr_len;
data_len -= attr_len;
* bindings, this is hard-coded for now.
*/
fake->server = "channel_bindings";
- fake->packet->code = PW_CODE_ACCESS_REQUEST;
+ fake->packet->code = FR_CODE_ACCESS_REQUEST;
rcode = rad_virtual_server(fake);
case RLM_MODULE_OK:
case RLM_MODULE_HANDLED:
if (chbind_build_response(fake, chbind)) {
- code = PW_CODE_ACCESS_ACCEPT;
+ code = FR_CODE_ACCESS_ACCEPT;
break;
}
/* FALL-THROUGH */
/* If we got any other response from rad_authenticate, it maps to a reject */
default:
- code = PW_CODE_ACCESS_REJECT;
+ code = FR_CODE_ACCESS_REJECT;
break;
}
chbind_packet_t *packet;
vp_cursor_t cursor;
- first = fr_pair_find_by_num(vps, VENDORPEC_UKERNA, PW_UKERNA_CHBIND, TAG_ANY);
+ first = fr_pair_find_by_num(vps, VENDORPEC_UKERNA, FR_UKERNA_CHBIND, TAG_ANY);
if (!first) return NULL;
/*
length = 0;
for (vp =fr_pair_cursor_init(&cursor, &first);
vp != NULL;
- vp = fr_pair_cursor_next_by_num(&cursor, VENDORPEC_UKERNA, PW_UKERNA_CHBIND, TAG_ANY)) {
+ vp = fr_pair_cursor_next_by_num(&cursor, VENDORPEC_UKERNA, FR_UKERNA_CHBIND, TAG_ANY)) {
length += vp->vp_length;
}
packet = (chbind_packet_t *) ptr;
for (vp = fr_pair_cursor_init(&cursor, &first);
vp != NULL;
- vp = fr_pair_cursor_next_by_num(&cursor, VENDORPEC_UKERNA, PW_UKERNA_CHBIND, TAG_ANY)) {
+ vp = fr_pair_cursor_next_by_num(&cursor, VENDORPEC_UKERNA, FR_UKERNA_CHBIND, TAG_ANY)) {
memcpy(ptr, vp->vp_octets, vp->vp_length);
ptr += vp->vp_length;
}
if (!chbind) return NULL; /* don't produce garbage */
- vp = fr_pair_afrom_num(packet, VENDORPEC_UKERNA, PW_UKERNA_CHBIND);
+ vp = fr_pair_afrom_num(packet, VENDORPEC_UKERNA, FR_UKERNA_CHBIND);
if (!vp) return NULL;
fr_pair_value_memcpy(vp, (uint8_t *) chbind, talloc_array_length((uint8_t *)chbind));
#define CHBIND_CODE_FAILURE 3
/* Channel binding function prototypes */
-PW_CODE chbind_process(REQUEST *request, CHBIND_REQ *chbind_req);
+FR_CODE chbind_process(REQUEST *request, CHBIND_REQ *chbind_req);
VALUE_PAIR *eap_chbind_packet2vp(RADIUS_PACKET *packet, chbind_packet_t *chbind);
chbind_packet_t *eap_chbind_vp2packet(TALLOC_CTX *ctx, VALUE_PAIR *vps);
case EAP_TLS_ACK_SEND:
case EAP_TLS_START_SEND:
case EAP_TLS_RECORD_SEND:
- eap_round->request->code = PW_EAP_REQUEST;
+ eap_round->request->code = FR_EAP_REQUEST;
break;
case EAP_TLS_ESTABLISHED:
- eap_round->request->code = PW_EAP_SUCCESS;
+ eap_round->request->code = FR_EAP_SUCCESS;
break;
case EAP_TLS_FAIL:
- eap_round->request->code = PW_EAP_FAILURE;
+ eap_round->request->code = FR_EAP_FAILURE;
break;
default:
#define EAP_HEADER_LEN 4
typedef enum eap_code {
- PW_EAP_REQUEST = 1,
- PW_EAP_RESPONSE,
- PW_EAP_SUCCESS,
- PW_EAP_FAILURE,
- PW_EAP_MAX_CODES
+ FR_EAP_REQUEST = 1,
+ FR_EAP_RESPONSE,
+ FR_EAP_SUCCESS,
+ FR_EAP_FAILURE,
+ FR_EAP_MAX_CODES
} eap_code_t;
typedef enum eap_method {
- PW_EAP_INVALID = 0, /* 0 */
- PW_EAP_IDENTITY, /* 1 */
- PW_EAP_NOTIFICATION, /* 2 */
- PW_EAP_NAK, /* 3 */
- PW_EAP_MD5, /* 4 */
- PW_EAP_OTP, /* 5 */
- PW_EAP_GTC, /* 6 */
- PW_EAP_7, /* 7 - unused */
- PW_EAP_8, /* 8 - unused */
- PW_EAP_RSA_PUBLIC_KEY, /* 9 */
- PW_EAP_DSS_UNILATERAL, /* 10 */
- PW_EAP_KEA, /* 11 */
- PW_EAP_KEA_VALIDATE, /* 12 */
- PW_EAP_TLS, /* 13 */
- PW_EAP_DEFENDER_TOKEN, /* 14 */
- PW_EAP_RSA_SECURID, /* 15 */
- PW_EAP_ARCOT_SYSTEMS, /* 16 */
- PW_EAP_LEAP, /* 17 */
- PW_EAP_SIM, /* 18 */
- PW_EAP_SRP_SHA1, /* 19 */
- PW_EAP_20, /* 20 - unassigned */
- PW_EAP_TTLS, /* 21 */
- PW_EAP_REMOTE_ACCESS_SERVICE, /* 22 */
- PW_EAP_AKA, /* 23 */
- PW_EAP_3COM, /* 24 - should this be EAP-HP now? */
- PW_EAP_PEAP, /* 25 */
- PW_EAP_MSCHAPV2, /* 26 */
- PW_EAP_MAKE, /* 27 */
- PW_EAP_CRYPTOCARD, /* 28 */
- PW_EAP_CISCO_MSCHAPV2, /* 29 */
- PW_EAP_DYNAMID, /* 30 */
- PW_EAP_ROB, /* 31 */
- PW_EAP_POTP, /* 32 */
- PW_EAP_MS_ATLV, /* 33 */
- PW_EAP_SENTRINET, /* 34 */
- PW_EAP_ACTIONTEC, /* 35 */
- PW_EAP_COGENT_BIOMETRIC, /* 36 */
- PW_EAP_AIRFORTRESS, /* 37 */
- PW_EAP_TNC, /* 38 - fixme conflicts with HTTP DIGEST */
-// PW_EAP_HTTP_DIGEST, /* 38 */
- PW_EAP_SECURISUITE, /* 39 */
- PW_EAP_DEVICECONNECT, /* 40 */
- PW_EAP_SPEKE, /* 41 */
- PW_EAP_MOBAC, /* 42 */
- PW_EAP_FAST, /* 43 */
- PW_EAP_ZONELABS, /* 44 */
- PW_EAP_LINK, /* 45 */
- PW_EAP_PAX, /* 46 */
- PW_EAP_PSK, /* 47 */
- PW_EAP_SAKE, /* 48 */
- PW_EAP_IKEV2, /* 49 */
- PW_EAP_AKA2, /* 50 */
- PW_EAP_GPSK, /* 51 */
- PW_EAP_PWD, /* 52 */
- PW_EAP_EKE, /* 53 */
- PW_EAP_PT, /* 54 */
- PW_EAP_TEAP, /* 55 */
- PW_EAP_MAX_TYPES /* 56 - for validation */
+ FR_EAP_INVALID = 0, /* 0 */
+ FR_EAP_IDENTITY, /* 1 */
+ FR_EAP_NOTIFICATION, /* 2 */
+ FR_EAP_NAK, /* 3 */
+ FR_EAP_MD5, /* 4 */
+ FR_EAP_OTP, /* 5 */
+ FR_EAP_GTC, /* 6 */
+ FR_EAP_7, /* 7 - unused */
+ FR_EAP_8, /* 8 - unused */
+ FR_EAP_RSA_PUBLIC_KEY, /* 9 */
+ FR_EAP_DSS_UNILATERAL, /* 10 */
+ FR_EAP_KEA, /* 11 */
+ FR_EAP_KEA_VALIDATE, /* 12 */
+ FR_EAP_TLS, /* 13 */
+ FR_EAP_DEFENDER_TOKEN, /* 14 */
+ FR_EAP_RSA_SECURID, /* 15 */
+ FR_EAP_ARCOT_SYSTEMS, /* 16 */
+ FR_EAP_LEAP, /* 17 */
+ FR_EAP_SIM, /* 18 */
+ FR_EAP_SRP_SHA1, /* 19 */
+ FR_EAP_20, /* 20 - unassigned */
+ FR_EAP_TTLS, /* 21 */
+ FR_EAP_REMOTE_ACCESS_SERVICE, /* 22 */
+ FR_EAP_AKA, /* 23 */
+ FR_EAP_3COM, /* 24 - should this be EAP-HP now? */
+ FR_EAP_PEAP, /* 25 */
+ FR_EAP_MSCHAPV2, /* 26 */
+ FR_EAP_MAKE, /* 27 */
+ FR_EAP_CRYPTOCARD, /* 28 */
+ FR_EAP_CISCO_MSCHAPV2, /* 29 */
+ FR_EAP_DYNAMID, /* 30 */
+ FR_EAP_ROB, /* 31 */
+ FR_EAP_POTP, /* 32 */
+ FR_EAP_MS_ATLV, /* 33 */
+ FR_EAP_SENTRINET, /* 34 */
+ FR_EAP_ACTIONTEC, /* 35 */
+ FR_EAP_COGENT_BIOMETRIC, /* 36 */
+ FR_EAP_AIRFORTRESS, /* 37 */
+ FR_EAP_TNC, /* 38 - fixme conflicts with HTTP DIGEST */
+// FR_EAP_HTTP_DIGEST, /* 38 */
+ FR_EAP_SECURISUITE, /* 39 */
+ FR_EAP_DEVICECONNECT, /* 40 */
+ FR_EAP_SPEKE, /* 41 */
+ FR_EAP_MOBAC, /* 42 */
+ FR_EAP_FAST, /* 43 */
+ FR_EAP_ZONELABS, /* 44 */
+ FR_EAP_LINK, /* 45 */
+ FR_EAP_PAX, /* 46 */
+ FR_EAP_PSK, /* 47 */
+ FR_EAP_SAKE, /* 48 */
+ FR_EAP_IKEV2, /* 49 */
+ FR_EAP_AKA2, /* 50 */
+ FR_EAP_GPSK, /* 51 */
+ FR_EAP_PWD, /* 52 */
+ FR_EAP_EKE, /* 53 */
+ FR_EAP_PT, /* 54 */
+ FR_EAP_TEAP, /* 55 */
+ FR_EAP_MAX_TYPES /* 56 - for validation */
} eap_type_t;
-#define PW_EAP_EXPANDED_TYPE (254)
+#define FR_EAP_EXPANDED_TYPE (254)
/** EAP-Type specific data
*/
* @param name to convert.
* @return
* - IANA EAP type.
- * - #PW_EAP_INVALID if the name doesn't match any known types.
+ * - #FR_EAP_INVALID if the name doesn't match any known types.
*/
eap_type_t eap_name2type(char const *name)
{
fr_dict_enum_t *dv;
- dv = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, PW_EAP_TYPE), name);
- if (!dv) return PW_EAP_INVALID;
+ dv = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, FR_EAP_TYPE), name);
+ if (!dv) return FR_EAP_INVALID;
- if (fr_unbox_uint32(dv->value) >= PW_EAP_MAX_TYPES) return PW_EAP_INVALID;
+ if (fr_unbox_uint32(dv->value) >= FR_EAP_MAX_TYPES) return FR_EAP_INVALID;
return fr_unbox_uint32(dv->value);
}
{
fr_dict_enum_t *dv;
- dv = fr_dict_enum_by_value(NULL, fr_dict_attr_by_num(NULL, 0, PW_EAP_TYPE), fr_box_uint32(method));
+ dv = fr_dict_enum_by_value(NULL, fr_dict_attr_by_num(NULL, 0, FR_EAP_TYPE), fr_box_uint32(method));
if (dv) return dv->alias;
return "unknown";
/*
* Request and Response packets are special.
*/
- if ((reply->code == PW_EAP_REQUEST) ||
- (reply->code == PW_EAP_RESPONSE)) {
+ if ((reply->code == FR_EAP_REQUEST) ||
+ (reply->code == FR_EAP_RESPONSE)) {
header->data[0] = (reply->type.num & 0xFF);
/*
if (eap_wireformat(reply) < 0) return RLM_MODULE_INVALID;
eap_packet = (eap_packet_raw_t *)reply->packet;
- fr_pair_delete_by_num(&(packet->vps), 0, PW_EAP_MESSAGE, TAG_ANY);
+ fr_pair_delete_by_num(&(packet->vps), 0, FR_EAP_MESSAGE, TAG_ANY);
vp = eap_packet2vp(packet, eap_packet);
if (!vp) return RLM_MODULE_INVALID;
* Don't add a Message-Authenticator if it's already
* there.
*/
- vp = fr_pair_find_by_num(packet->vps, 0, PW_MESSAGE_AUTHENTICATOR, TAG_ANY);
+ vp = fr_pair_find_by_num(packet->vps, 0, FR_MESSAGE_AUTHENTICATOR, TAG_ANY);
if (!vp) {
- vp = fr_pair_afrom_num(packet, 0, PW_MESSAGE_AUTHENTICATOR);
+ vp = fr_pair_afrom_num(packet, 0, FR_MESSAGE_AUTHENTICATOR);
vp->vp_length = AUTH_VECTOR_LEN;
vp->vp_octets = talloc_zero_array(vp, uint8_t, vp->vp_length);
/* Set request reply code, but only if it's not already set. */
rcode = RLM_MODULE_OK;
if (!packet->code) switch (reply->code) {
- case PW_EAP_RESPONSE:
- case PW_EAP_SUCCESS:
- packet->code = PW_CODE_ACCESS_ACCEPT;
+ case FR_EAP_RESPONSE:
+ case FR_EAP_SUCCESS:
+ packet->code = FR_CODE_ACCESS_ACCEPT;
rcode = RLM_MODULE_HANDLED;
break;
- case PW_EAP_FAILURE:
- packet->code = PW_CODE_ACCESS_REJECT;
+ case FR_EAP_FAILURE:
+ packet->code = FR_CODE_ACCESS_REJECT;
rcode = RLM_MODULE_REJECT;
break;
- case PW_EAP_REQUEST:
- packet->code = PW_CODE_ACCESS_CHALLENGE;
+ case FR_EAP_REQUEST:
+ packet->code = FR_CODE_ACCESS_CHALLENGE;
rcode = RLM_MODULE_HANDLED;
break;
default:
/* Should never enter here */
ERROR("Reply code %d is unknown, Rejecting the request", reply->code);
- packet->code = PW_CODE_ACCESS_REJECT;
+ packet->code = FR_CODE_ACCESS_REJECT;
break;
}
size = total;
if (size > 253) size = 253;
- vp = fr_pair_afrom_num(packet, 0, PW_EAP_MESSAGE);
+ vp = fr_pair_afrom_num(packet, 0, FR_EAP_MESSAGE);
if (!vp) {
fr_pair_list_free(&head);
return NULL;
/*
* Get only EAP-Message attribute list
*/
- first = fr_pair_find_by_num(vps, 0, PW_EAP_MESSAGE, TAG_ANY);
+ first = fr_pair_find_by_num(vps, 0, FR_EAP_MESSAGE, TAG_ANY);
if (!first) {
fr_strerror_printf("EAP-Message not found");
return NULL;
*/
total_len = 0;
fr_pair_cursor_init(&cursor, &first);
- while ((i = fr_pair_cursor_next_by_num(&cursor, 0, PW_EAP_MESSAGE, TAG_ANY))) {
+ while ((i = fr_pair_cursor_next_by_num(&cursor, 0, FR_EAP_MESSAGE, TAG_ANY))) {
total_len += i->vp_length;
if (total_len > len) {
/* RADIUS ensures order of attrs, so just concatenate all */
fr_pair_cursor_first(&cursor);
- while ((i = fr_pair_cursor_next_by_num(&cursor, 0, PW_EAP_MESSAGE, TAG_ANY))) {
+ while ((i = fr_pair_cursor_next_by_num(&cursor, 0, FR_EAP_MESSAGE, TAG_ANY))) {
memcpy(ptr, i->vp_strvalue, i->vp_length);
ptr += i->vp_length;
}
rlm_rcode_t rcode;
VALUE_PAIR *vp;
- vp = fr_pair_find_by_num(request->control, 0, PW_VIRTUAL_SERVER, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_VIRTUAL_SERVER, TAG_ANY);
fake->server = vp ? vp->vp_strvalue : virtual_server;
if (fake->server) {
VALUE_PAIR *vp;
uint8_t *p;
- vp = fr_pair_afrom_num(packet, 0, PW_EAP_SESSION_ID);
+ vp = fr_pair_afrom_num(packet, 0, FR_EAP_SESSION_ID);
if (!vp) return;
p = talloc_array(vp, uint8_t, 1 + 2 * SSL3_RANDOM_SIZE);
VALUE_PAIR *mac;
fr_dict_attr_t const *da;
- da = fr_dict_attr_child_by_num(root, PW_EAP_SIM_MAC);
+ da = fr_dict_attr_child_by_num(root, FR_EAP_SIM_MAC);
if (!da) {
fr_strerror_printf("Missing definition for EAP-SIM-MAC");
return -1;
*/
attr = buffer + 8;
while (attr < (buffer + elen)) {
- if (attr[0] == PW_EAP_SIM_MAC) {
+ if (attr[0] == FR_EAP_SIM_MAC) {
/* zero the data portion, after making sure
* the size is >=5. Maybe future versions.
* will use more bytes, so be liberal.
* by identical
*/
#define DICT_SANITY_CHECK(_name) \
- static_assert(PW_EAP_SIM_##_name == PW_EAP_AKA_##_name, \
- "Number mismatch between PW_EAP_SIM_##_name and PW_EAP_AKA_##_name")
+ static_assert(FR_EAP_SIM_##_name == FR_EAP_AKA_##_name, \
+ "Number mismatch between FR_EAP_SIM_##_name and FR_EAP_AKA_##_name")
DICT_SANITY_CHECK(PERMANENT_ID_REQ);
DICT_SANITY_CHECK(ANY_ID_REQ);
DICT_SANITY_CHECK(NOTIFICATION);
DICT_SANITY_CHECK(CLIENT_ERROR_CODE);
-#define PW_SIM_PERMANENT_ID_REQ (PW_EAP_SIM_PERMANENT_ID_REQ & PW_EAP_AKA_PERMANENT_ID_REQ)
-#define PW_SIM_ANY_ID_REQ (PW_EAP_SIM_ANY_ID_REQ & PW_EAP_AKA_ANY_ID_REQ)
-#define PW_SIM_FULLAUTH_ID_REQ (PW_EAP_SIM_FULLAUTH_ID_REQ & PW_EAP_AKA_FULLAUTH_ID_REQ)
-#define PW_SIM_IDENTITY (PW_EAP_SIM_IDENTITY & PW_EAP_AKA_IDENTITY)
-#define PW_SIM_RAND (PW_EAP_SIM_RAND & PW_EAP_AKA_RAND)
-#define PW_SIM_NEXT_PSEUDONYM (PW_EAP_SIM_NEXT_PSEUDONYM & PW_EAP_AKA_NEXT_PSEUDONYM)
-#define PW_SIM_NEXT_REAUTH_ID (PW_EAP_SIM_NEXT_REAUTH_ID & PW_EAP_AKA_NEXT_REAUTH_ID)
-#define PW_SIM_IV (PW_EAP_SIM_IV & PW_EAP_AKA_IV)
-#define PW_SIM_ENCR_DATA (PW_EAP_SIM_ENCR_DATA & PW_EAP_AKA_ENCR_DATA)
-#define PW_SIM_PADDING (PW_EAP_SIM_PADDING & PW_EAP_AKA_PADDING)
-#define PW_SIM_RESULT_IND (PW_EAP_SIM_RESULT_IND & PW_EAP_AKA_RESULT_IND)
-#define PW_SIM_MAC (PW_EAP_SIM_MAC & PW_EAP_AKA_MAC)
-#define PW_SIM_COUNTER (PW_EAP_SIM_COUNTER & PW_EAP_AKA_COUNTER)
-#define PW_SIM_COUNTER_TOO_SMALL (PW_EAP_SIM_COUNTER_TOO_SMALL & PW_EAP_AKA_COUNTER_TOO_SMALL)
-#define PW_SIM_NONCE_S (PW_EAP_SIM_NONCE_S & PW_EAP_AKA_NONCE_S)
-#define PW_SIM_NOTIFICATION (PW_EAP_SIM_NOTIFICATION & PW_EAP_AKA_NOTIFICATION)
-#define PW_SIM_CLIENT_ERROR_CODE (PW_EAP_SIM_CLIENT_ERROR_CODE & PW_EAP_AKA_CLIENT_ERROR_CODE)
+#define FR_SIM_PERMANENT_ID_REQ (FR_EAP_SIM_PERMANENT_ID_REQ & FR_EAP_AKA_PERMANENT_ID_REQ)
+#define FR_SIM_ANY_ID_REQ (FR_EAP_SIM_ANY_ID_REQ & FR_EAP_AKA_ANY_ID_REQ)
+#define FR_SIM_FULLAUTH_ID_REQ (FR_EAP_SIM_FULLAUTH_ID_REQ & FR_EAP_AKA_FULLAUTH_ID_REQ)
+#define FR_SIM_IDENTITY (FR_EAP_SIM_IDENTITY & FR_EAP_AKA_IDENTITY)
+#define FR_SIM_RAND (FR_EAP_SIM_RAND & FR_EAP_AKA_RAND)
+#define FR_SIM_NEXT_PSEUDONYM (FR_EAP_SIM_NEXT_PSEUDONYM & FR_EAP_AKA_NEXT_PSEUDONYM)
+#define FR_SIM_NEXT_REAUTH_ID (FR_EAP_SIM_NEXT_REAUTH_ID & FR_EAP_AKA_NEXT_REAUTH_ID)
+#define FR_SIM_IV (FR_EAP_SIM_IV & FR_EAP_AKA_IV)
+#define FR_SIM_ENCR_DATA (FR_EAP_SIM_ENCR_DATA & FR_EAP_AKA_ENCR_DATA)
+#define FR_SIM_PADDING (FR_EAP_SIM_PADDING & FR_EAP_AKA_PADDING)
+#define FR_SIM_RESULT_IND (FR_EAP_SIM_RESULT_IND & FR_EAP_AKA_RESULT_IND)
+#define FR_SIM_MAC (FR_EAP_SIM_MAC & FR_EAP_AKA_MAC)
+#define FR_SIM_COUNTER (FR_EAP_SIM_COUNTER & FR_EAP_AKA_COUNTER)
+#define FR_SIM_COUNTER_TOO_SMALL (FR_EAP_SIM_COUNTER_TOO_SMALL & FR_EAP_AKA_COUNTER_TOO_SMALL)
+#define FR_SIM_NONCE_S (FR_EAP_SIM_NONCE_S & FR_EAP_AKA_NONCE_S)
+#define FR_SIM_NOTIFICATION (FR_EAP_SIM_NOTIFICATION & FR_EAP_AKA_NOTIFICATION)
+#define FR_SIM_CLIENT_ERROR_CODE (FR_EAP_SIM_CLIENT_ERROR_CODE & FR_EAP_AKA_CLIENT_ERROR_CODE)
/*
* Common internal attributes
DICT_SANITY_CHECK(KEY);
DICT_SANITY_CHECK(EXTRA);
-#define PW_SIM_SUBTYPE (PW_EAP_SIM_SUBTYPE & PW_EAP_AKA_SUBTYPE)
-#define PW_SIM_HMAC (PW_EAP_SIM_HMAC & PW_EAP_AKA_HMAC)
-#define PW_SIM_KEY (PW_EAP_SIM_KEY & PW_EAP_AKA_KEY)
-#define PW_SIM_EXTRA (PW_EAP_SIM_EXTRA & PW_EAP_AKA_EXTRA)
+#define FR_SIM_SUBTYPE (FR_EAP_SIM_SUBTYPE & FR_EAP_AKA_SUBTYPE)
+#define FR_SIM_HMAC (FR_EAP_SIM_HMAC & FR_EAP_AKA_HMAC)
+#define FR_SIM_KEY (FR_EAP_SIM_KEY & FR_EAP_AKA_KEY)
+#define FR_SIM_EXTRA (FR_EAP_SIM_EXTRA & FR_EAP_AKA_EXTRA)
uint8_t sim_at = p[0];
size_t sim_at_len = p[1] * sizeof(uint32_t);
- if (sim_at == PW_SIM_IV) {
+ if (sim_at == FR_SIM_IV) {
if (sim_iv_extract(&(this->iv[0]), p, sim_at_len) < 0) return -1;
this->have_iv = true;
break;
* to pad out the value to the correct length for the
* block cipher (16 in the case of AES-128-CBC).
*/
- case PW_SIM_PADDING:
+ case FR_SIM_PADDING:
if (!parent->parent || (parent->parent->type != FR_TYPE_TLV) || (!parent->parent->flags.encrypt)) {
fr_strerror_printf("%s: Found padding attribute outside of an encrypted TLV", __FUNCTION__);
return -1;
* find it in the rest of the packet after the encrypted
* attribute.
*/
- case PW_SIM_IV:
+ case FR_SIM_IV:
if (sim_iv_extract(&this->iv[0], data, attr_len) < 0) return -1;
this->have_iv = true;
break;
{
VALUE_PAIR *vp;
- vp = fr_pair_afrom_child_num(request->packet, parent, PW_SIM_SUBTYPE);
+ vp = fr_pair_afrom_child_num(request->packet, parent, FR_SIM_SUBTYPE);
if (!vp) {
fr_strerror_printf("Failed allocating subtype attribute");
goto error;
* It might be too big for putting into an
* EAP packet.
*/
- vp = fr_pair_find_by_child_num(to_encode, parent, PW_SIM_SUBTYPE, TAG_ANY);
+ vp = fr_pair_find_by_child_num(to_encode, parent, FR_SIM_SUBTYPE, TAG_ANY);
if (!vp) {
REDEBUG("Missing subtype attribute");
return -1;
}
subtype = vp->vp_uint16;
- vp = fr_pair_find_by_num(to_encode, 0, PW_EAP_ID, TAG_ANY);
+ vp = fr_pair_find_by_num(to_encode, 0, FR_EAP_ID, TAG_ANY);
id = vp ? vp->vp_uint32 : ((int)getpid() & 0xff);
- vp = fr_pair_find_by_num(to_encode, 0, PW_EAP_CODE, TAG_ANY);
- eap_code = vp ? vp->vp_uint32 : PW_EAP_REQUEST;
+ vp = fr_pair_find_by_num(to_encode, 0, FR_EAP_CODE, TAG_ANY);
+ eap_code = vp ? vp->vp_uint32 : FR_EAP_REQUEST;
/*
* Fill in some bits in the EAP packet
*
* These are needed even if we're sending an almost empty packet.
*/
- if (eap_packet->code != PW_EAP_SUCCESS) eap_packet->code = eap_code;
+ if (eap_packet->code != FR_EAP_SUCCESS) eap_packet->code = eap_code;
eap_packet->id = (id & 0xff);
eap_packet->type.num = type;
*
* At this point, we only care about the size.
*/
- if (vp->da->attr == PW_SIM_MAC) {
+ if (vp->da->attr == FR_SIM_MAC) {
vp_len = 18;
do_hmac = true;
/*
/*
* We'll append the HMAC last.
*/
- if (vp->da->attr == PW_EAP_SIM_MAC) continue;
+ if (vp->da->attr == FR_EAP_SIM_MAC) continue;
/*
* For strings we have an 'actual' value field.
if (do_hmac) {
ssize_t slen;
- vp = fr_pair_find_by_child_num(to_encode, parent, PW_SIM_KEY, TAG_ANY);
+ vp = fr_pair_find_by_child_num(to_encode, parent, FR_SIM_KEY, TAG_ANY);
if (!vp) {
fr_strerror_printf("Need to sign packet, but no HMAC key set");
error:
/*
* We left some room earlier...
*/
- *p++ = PW_SIM_MAC;
+ *p++ = FR_SIM_MAC;
*p++ = (SIM_CALC_MAC_SIZE >> 2);
*p++ = 0x00;
*p++ = 0x00;
if (done_init) return 0;
- dict_aka_root = fr_dict_attr_child_by_num(fr_dict_root(fr_dict_internal), PW_EAP_AKA_ROOT);
+ dict_aka_root = fr_dict_attr_child_by_num(fr_dict_root(fr_dict_internal), FR_EAP_AKA_ROOT);
if (!dict_aka_root) {
fr_strerror_printf("Missing AKA root");
return -1;
}
- dict_sim_root = fr_dict_attr_child_by_num(fr_dict_root(fr_dict_internal), PW_EAP_SIM_ROOT);
+ dict_sim_root = fr_dict_attr_child_by_num(fr_dict_root(fr_dict_internal), FR_EAP_SIM_ROOT);
if (!dict_sim_root) {
fr_strerror_printf("Missing SIM root");
return -1;
/*
* Generate a new RAND value, and derive Kc and SRES from Ki
*/
- vp = fr_pair_find_by_child_num(vps, dict_sim_root, PW_SIM_KI, TAG_ANY);
+ vp = fr_pair_find_by_child_num(vps, dict_sim_root, FR_SIM_KI, TAG_ANY);
if (!vp) {
RDEBUG3("No &control:SIM-KI found, not generating triplets locally");
return 1;
* Check to see if have a Ki for the IMSI, this allows us to generate the rest
* of the triplets.
*/
- version = fr_pair_find_by_child_num(vps, dict_sim_root, PW_SIM_ALGO_VERSION, TAG_ANY);
+ version = fr_pair_find_by_child_num(vps, dict_sim_root, FR_SIM_ALGO_VERSION, TAG_ANY);
if (!version) {
RDEBUG3("No &control:SIM-ALGO-VERSION found, not generating triplets locally");
return 1;
int i;
for (i = 0, fr_pair_cursor_init(&cursor, &vps);
- (i <= idx) && (kc = fr_pair_cursor_next_by_child_num(&cursor, dict_sim_root, PW_EAP_SIM_KC, TAG_ANY)); i++);
+ (i <= idx) && (kc = fr_pair_cursor_next_by_child_num(&cursor, dict_sim_root, FR_EAP_SIM_KC, TAG_ANY)); i++);
if (!kc) {
RDEBUG3("No &control:EAP-SIM-KC[%i] attribute found, not using GSM triplets", idx);
return 1;
}
for (i = 0, fr_pair_cursor_init(&cursor, &vps);
- (i <= idx) && (rand = fr_pair_cursor_next_by_child_num(&cursor, dict_sim_root, PW_EAP_SIM_RAND, TAG_ANY));
+ (i <= idx) && (rand = fr_pair_cursor_next_by_child_num(&cursor, dict_sim_root, FR_EAP_SIM_RAND, TAG_ANY));
i++);
if (!rand) {
RDEBUG3("No &control:EAP-SIM-Rand[%i] attribute found, not using GSM triplets", idx);
}
for (i = 0, fr_pair_cursor_init(&cursor, &vps);
- (i <= idx) && (sres = fr_pair_cursor_next_by_child_num(&cursor, dict_sim_root, PW_EAP_SIM_SRES, TAG_ANY)); i++);
+ (i <= idx) && (sres = fr_pair_cursor_next_by_child_num(&cursor, dict_sim_root, FR_EAP_SIM_SRES, TAG_ANY)); i++);
if (!sres) {
RDEBUG3("No &control:EAP-SIM-SRES[%i] attribute found, not using GSM triplets", idx);
return 1;
* Fetch CK
*/
for (i = 0, fr_pair_cursor_init(&cursor, &vps);
- (i <= idx) && (ck = fr_pair_cursor_next_by_child_num(&cursor, dict_aka_root, PW_EAP_AKA_CK, TAG_ANY)); i++);
+ (i <= idx) && (ck = fr_pair_cursor_next_by_child_num(&cursor, dict_aka_root, FR_EAP_AKA_CK, TAG_ANY)); i++);
if (!ck) {
RDEBUG3("No &control:EAP-AKA-CK[%i] attribute found, not using quintuplet derivation", idx);
return 1;
* Fetch IK
*/
for (i = 0, fr_pair_cursor_init(&cursor, &vps);
- (i <= idx) && (ik = fr_pair_cursor_next_by_child_num(&cursor, dict_aka_root, PW_EAP_AKA_IK, TAG_ANY)); i++);
+ (i <= idx) && (ik = fr_pair_cursor_next_by_child_num(&cursor, dict_aka_root, FR_EAP_AKA_IK, TAG_ANY)); i++);
if (!ik) {
RDEBUG3("No &control:EAP-AKA-IK[%i] attribute found, not using quintuplet derivation", idx);
return 1;
* Fetch RAND
*/
for (i = 0, fr_pair_cursor_init(&cursor, &vps); (i <= idx) &&
- (rand = fr_pair_cursor_next_by_child_num(&cursor, dict_aka_root, PW_EAP_AKA_RAND, TAG_ANY)); i++);
+ (rand = fr_pair_cursor_next_by_child_num(&cursor, dict_aka_root, FR_EAP_AKA_RAND, TAG_ANY)); i++);
if (!rand) {
RDEBUG3("No &control:EAP-AKA-Rand[%i] attribute found, not using quintuplet derivation", idx);
return 1;
* Fetch XRES
*/
for (i = 0, fr_pair_cursor_init(&cursor, &vps);
- (i <= idx) && (xres = fr_pair_cursor_next_by_child_num(&cursor, dict_aka_root, PW_EAP_AKA_XRES, TAG_ANY)); i++);
+ (i <= idx) && (xres = fr_pair_cursor_next_by_child_num(&cursor, dict_aka_root, FR_EAP_AKA_XRES, TAG_ANY)); i++);
if (!xres) {
RDEBUG3("No &control:EAP-AKA-XRES[%i] attribute found, not using quintuplet derivation", idx);
return 1;
/*
* Generate a new RAND value, and derive Kc and SRES from Ki
*/
- vp = fr_pair_find_by_num(vps, 0, PW_SIM_KI, TAG_ANY);
+ vp = fr_pair_find_by_num(vps, 0, FR_SIM_KI, TAG_ANY);
if (!vp) {
RDEBUG3("No &control:aka-KI found, not generating triplets locally");
return 1;
* Check to see if have a Ki for the IMSI, this allows us to generate the rest
* of the triplets.
*/
- version = fr_pair_find_by_num(vps, 0, PW_SIM_ALGO_VERSION, TAG_ANY);
+ version = fr_pair_find_by_num(vps, 0, FR_SIM_ALGO_VERSION, TAG_ANY);
if (!version) {
RDEBUG3("No &control:SIM-ALGO-VERSION found, not generating triplets locally");
return 1;
/*
* Fetch AUTN
*/
- autn = fr_pair_find_by_child_num(vps, dict_aka_root, PW_EAP_AKA_AUTN, TAG_ANY);
+ autn = fr_pair_find_by_child_num(vps, dict_aka_root, FR_EAP_AKA_AUTN, TAG_ANY);
if (!autn) {
- RDEBUG3("No &control:PW_EAP_AKA_AUTN attribute found, not using UMTS quintuplets");
+ RDEBUG3("No &control:FR_EAP_AKA_AUTN attribute found, not using UMTS quintuplets");
return 1;
}
/*
* Fetch CK
*/
- ck = fr_pair_find_by_child_num(vps, dict_aka_root, PW_EAP_AKA_CK, TAG_ANY);
+ ck = fr_pair_find_by_child_num(vps, dict_aka_root, FR_EAP_AKA_CK, TAG_ANY);
if (!ck) {
RDEBUG3("No &control:EAP-AKA-CK attribute found, not using UMTS quintuplets");
return 1;
/*
* Fetch IK
*/
- ik = fr_pair_find_by_child_num(vps, dict_aka_root, PW_EAP_AKA_IK, TAG_ANY);
+ ik = fr_pair_find_by_child_num(vps, dict_aka_root, FR_EAP_AKA_IK, TAG_ANY);
if (!ik) {
RDEBUG3("No &control:EAP-AKA-IK attribute found, not using UMTS quintuplets");
return 1;
/*
* Fetch RAND
*/
- rand = fr_pair_find_by_child_num(vps, dict_aka_root, PW_EAP_AKA_RAND, TAG_ANY);
+ rand = fr_pair_find_by_child_num(vps, dict_aka_root, FR_EAP_AKA_RAND, TAG_ANY);
if (!rand) {
RDEBUG3("No &control:EAP-AKA-Rand attribute found, not using quintuplet derivation");
return 1;
/*
* Fetch XRES
*/
- xres = fr_pair_find_by_child_num(vps, dict_aka_root, PW_EAP_AKA_XRES, TAG_ANY);
+ xres = fr_pair_find_by_child_num(vps, dict_aka_root, FR_EAP_AKA_XRES, TAG_ANY);
if (!xres) {
RDEBUG3("No &control:EAP-AKA-XRES attribute found, not using UMTS quintuplets");
return 1;
if (!strcmp(name, TLS_CONFIG_SECTION)) continue;
method = eap_name2type(name);
- if (method == PW_EAP_INVALID) {
+ if (method == FR_EAP_INVALID) {
cf_log_err_cs(cs, "Unknown EAP type %s", name);
return -1;
}
- if ((method < PW_EAP_MD5) || (method >= PW_EAP_MAX_TYPES)) {
+ if ((method < FR_EAP_MD5) || (method >= FR_EAP_MAX_TYPES)) {
cf_log_err_cs(cs, "Invalid EAP method %s (unsupported)", name);
return -1;
}
* have EAP without the TLS types.
*/
switch (method) {
- case PW_EAP_TLS:
- case PW_EAP_TTLS:
- case PW_EAP_PEAP:
- case PW_EAP_PWD:
+ case FR_EAP_TLS:
+ case FR_EAP_TTLS:
+ case FR_EAP_PEAP:
+ case FR_EAP_PWD:
WARN("Ignoring EAP method %s because we don't have OpenSSL support", name);
continue;
* Ensure that the default EAP type is loaded.
*/
method = eap_name2type(inst->config.default_method_name);
- if (method == PW_EAP_INVALID) {
+ if (method == FR_EAP_INVALID) {
cf_log_err_by_name(cs, "default_eap_type", "Unknown EAP type %s",
inst->config.default_method_name);
return -1;
{
unsigned int i;
VALUE_PAIR *vp;
- eap_type_t method = PW_EAP_INVALID;
+ eap_type_t method = FR_EAP_INVALID;
/*
* The NAK data is the preferred EAP type(s) of
if (!nak->data) {
REDEBUG("Peer sent empty (invalid) NAK. Can't select method to continue with");
- return PW_EAP_INVALID;
+ return FR_EAP_INVALID;
}
/*
* Pick one type out of the one they asked for,
* as they may have asked for many.
*/
- vp = fr_pair_find_by_num(request->control, 0, PW_EAP_TYPE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_EAP_TYPE, TAG_ANY);
for (i = 0; i < nak->length; i++) {
/*
* Type 0 is valid, and means there are no
if (nak->data[i] == 0) {
RDEBUG("Peer NAK'd indicating it is not willing to continue ");
- return PW_EAP_INVALID;
+ return FR_EAP_INVALID;
}
/*
* It is invalid to request identity,
* notification & nak in nak.
*/
- if (nak->data[i] < PW_EAP_MD5) {
+ if (nak->data[i] < FR_EAP_MD5) {
REDEBUG("Peer NAK'd asking for bad type %s (%d)", eap_type2name(nak->data[i]), nak->data[i]);
- return PW_EAP_INVALID;
+ return FR_EAP_INVALID;
}
- if ((nak->data[i] >= PW_EAP_MAX_TYPES) ||
+ if ((nak->data[i] >= FR_EAP_MAX_TYPES) ||
!inst->methods[nak->data[i]]) {
RDEBUG2("Peer NAK'd asking for unsupported EAP type %s (%d), skipping...",
eap_type2name(nak->data[i]),
break;
}
- if (method == PW_EAP_INVALID) {
+ if (method == FR_EAP_INVALID) {
REDEBUG("No mutually acceptable types found");
}
/*
* Don't trust anyone.
*/
- if ((type->num == 0) || (type->num >= PW_EAP_MAX_TYPES)) {
+ if ((type->num == 0) || (type->num >= FR_EAP_MAX_TYPES)) {
REDEBUG("Peer sent EAP type number %d, which is outside known range", type->num);
return RLM_MODULE_INVALID;
* Figure out what to do.
*/
switch (type->num) {
- case PW_EAP_IDENTITY:
+ case FR_EAP_IDENTITY:
/*
* Allow per-user configuration of EAP types.
*/
- vp = fr_pair_find_by_num(eap_session->request->control, 0, PW_EAP_TYPE, TAG_ANY);
+ vp = fr_pair_find_by_num(eap_session->request->control, 0, FR_EAP_TYPE, TAG_ANY);
if (vp) {
RDEBUG2("Setting method from &control:EAP-Type");
next = vp->vp_uint32;
/*
* Ensure it's valid.
*/
- if ((next < PW_EAP_MD5) || (next >= PW_EAP_MAX_TYPES) || (!inst->methods[next])) {
+ if ((next < FR_EAP_MD5) || (next >= FR_EAP_MAX_TYPES) || (!inst->methods[next])) {
REDEBUG2("Tried to start unsupported EAP type %s (%d)",
eap_type2name(next), next);
return RLM_MODULE_INVALID;
/*
* If any of these fail, we messed badly somewhere
*/
- rad_assert(next >= PW_EAP_MD5);
- rad_assert(next < PW_EAP_MAX_TYPES);
+ rad_assert(next >= FR_EAP_MD5);
+ rad_assert(next < FR_EAP_MAX_TYPES);
rad_assert(inst->methods[next]);
eap_session->process = inst->methods[next]->submodule->session_init;
eap_session->type = next;
goto module_call;
- case PW_EAP_NAK:
+ case FR_EAP_NAK:
/*
* Delete old data, if necessary. If we called a method
* before, and it initialized itself, we need to free
eap_packet_raw_t *eap_packet;
rlm_rcode_t rcode;
- if (!fr_pair_find_by_num(request->packet->vps, 0, PW_EAP_MESSAGE, TAG_ANY)) {
+ if (!fr_pair_find_by_num(request->packet->vps, 0, FR_EAP_MESSAGE, TAG_ANY)) {
REDEBUG("You set 'Auth-Type = EAP' for a request that does not contain an EAP-Message attribute!");
return RLM_MODULE_INVALID;
}
* Add to the list only if it is EAP-Request, OR if
* it's LEAP, and a response.
*/
- if (((eap_session->this_round->request->code == PW_EAP_REQUEST) &&
- (eap_session->this_round->request->type.num >= PW_EAP_MD5)) ||
+ if (((eap_session->this_round->request->code == FR_EAP_REQUEST) &&
+ (eap_session->this_round->request->type.num >= FR_EAP_MD5)) ||
/*
* LEAP is a little different. At Stage 4,
* At stage 6, LEAP sends an EAP-Response, which
* isn't put into the list.
*/
- ((eap_session->this_round->response->code == PW_EAP_RESPONSE) &&
- (eap_session->this_round->response->type.num == PW_EAP_LEAP) &&
- (eap_session->this_round->request->code == PW_EAP_SUCCESS) &&
+ ((eap_session->this_round->response->code == FR_EAP_RESPONSE) &&
+ (eap_session->this_round->response->type.num == FR_EAP_LEAP) &&
+ (eap_session->this_round->request->code == FR_EAP_SUCCESS) &&
(eap_session->this_round->request->type.num == 0))) {
talloc_free(eap_session->prev_round);
eap_session->prev_round = eap_session->this_round;
* says that we MUST include a User-Name attribute in the
* Access-Accept.
*/
- if ((request->reply->code == PW_CODE_ACCESS_ACCEPT) && request->username) {
+ if ((request->reply->code == FR_CODE_ACCESS_ACCEPT) && request->username) {
VALUE_PAIR *vp;
/*
* Doesn't exist, add it in.
*/
- vp = fr_pair_find_by_num(request->reply->vps, 0, PW_USER_NAME, TAG_ANY);
+ vp = fr_pair_find_by_num(request->reply->vps, 0, FR_USER_NAME, TAG_ANY);
if (!vp) {
vp = fr_pair_copy(request->reply, request->username);
fr_pair_add(&request->reply->vps, vp);
* each EAP sub-module to look for eap_session->request->username,
* and to get excited if it doesn't appear.
*/
- vp = fr_pair_find_by_num(request->control, 0, PW_AUTH_TYPE, TAG_ANY);
- if ((!vp) || (vp->vp_uint32 != PW_AUTH_TYPE_REJECT)) {
+ vp = fr_pair_find_by_num(request->control, 0, FR_AUTH_TYPE, TAG_ANY);
+ if ((!vp) || (vp->vp_uint32 != FR_AUTH_TYPE_REJECT)) {
vp = pair_make_config("Auth-Type", inst->name, T_OP_EQ);
if (!vp) {
RDEBUG2("Failed to create Auth-Type %s: %s\n",
* Add to the list only if it is EAP-Request, OR if
* it's LEAP, and a response.
*/
- if ((eap_session->this_round->request->code == PW_EAP_REQUEST) &&
- (eap_session->this_round->request->type.num >= PW_EAP_MD5)) {
+ if ((eap_session->this_round->request->code == FR_EAP_REQUEST) &&
+ (eap_session->this_round->request->type.num >= FR_EAP_MD5)) {
talloc_free(eap_session->prev_round);
eap_session->prev_round = eap_session->this_round;
eap_session->this_round = NULL;
* says that we MUST include a User-Name attribute in the
* Access-Accept.
*/
- if ((request->reply->code == PW_CODE_ACCESS_ACCEPT) && request->username) {
+ if ((request->reply->code == FR_CODE_ACCESS_ACCEPT) && request->username) {
/*
* Doesn't exist, add it in.
*/
- vp = fr_pair_find_by_num(request->reply->vps, 0, PW_USER_NAME, TAG_ANY);
+ vp = fr_pair_find_by_num(request->reply->vps, 0, FR_USER_NAME, TAG_ANY);
if (!vp) {
pair_make_reply("User-Name", request->username->vp_strvalue, T_OP_EQ);
}
/*
* Only build a failure message if something previously rejected the request
*/
- vp = fr_pair_find_by_num(request->control, 0, PW_POST_AUTH_TYPE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_POST_AUTH_TYPE, TAG_ANY);
- if (!vp || (vp->vp_uint32 != PW_POST_AUTH_TYPE_REJECT)) return RLM_MODULE_NOOP;
+ if (!vp || (vp->vp_uint32 != FR_POST_AUTH_TYPE_REJECT)) return RLM_MODULE_NOOP;
- if (!fr_pair_find_by_num(request->packet->vps, 0, PW_EAP_MESSAGE, TAG_ANY)) {
+ if (!fr_pair_find_by_num(request->packet->vps, 0, FR_EAP_MESSAGE, TAG_ANY)) {
RDEBUG3("Request didn't contain an EAP-Message, not inserting EAP-Failure");
return RLM_MODULE_NOOP;
}
- if (fr_pair_find_by_num(request->reply->vps, 0, PW_EAP_MESSAGE, TAG_ANY)) {
+ if (fr_pair_find_by_num(request->reply->vps, 0, FR_EAP_MESSAGE, TAG_ANY)) {
RDEBUG3("Reply already contained an EAP-Message, not inserting EAP-Failure");
return RLM_MODULE_NOOP;
}
* Make sure there's a message authenticator attribute in the response
* RADIUS protocol code will calculate the correct value later...
*/
- vp = fr_pair_find_by_num(request->reply->vps, 0, PW_MESSAGE_AUTHENTICATOR, TAG_ANY);
+ vp = fr_pair_find_by_num(request->reply->vps, 0, FR_MESSAGE_AUTHENTICATOR, TAG_ANY);
if (!vp) {
- vp = fr_pair_afrom_num(request->reply, 0, PW_MESSAGE_AUTHENTICATOR);
+ vp = fr_pair_afrom_num(request->reply, 0, FR_MESSAGE_AUTHENTICATOR);
fr_pair_value_memsteal(vp, talloc_zero_array(vp, uint8_t, AUTH_VECTOR_LEN));
fr_pair_add(&(request->reply->vps), vp);
}
char const *name; //!< Name of this instance.
- rlm_eap_method_t *methods[PW_EAP_MAX_TYPES]; //!< Array of loaded (or not), submodules.
+ rlm_eap_method_t *methods[FR_EAP_MAX_TYPES]; //!< Array of loaded (or not), submodules.
fr_randctx rand_pool; //!< Pool of random data.
} rlm_eap_t;
/* we will set the ID on requests, since we have to HMAC it */
eap_session->this_round->set_request_id = true;
- return fr_sim_encode(eap_session->request, dict_aka_root, PW_EAP_AKA,
+ return fr_sim_encode(eap_session->request, dict_aka_root, FR_EAP_AKA,
eap_session->request->reply->vps, eap_session->this_round->request,
NULL, 0);
}
*
* Challenges will come from one of three places eventually:
*
- * 1 from attributes like PW_EAP_SIM_RANDx
+ * 1 from attributes like FR_EAP_SIM_RANDx
* (these might be retrieved from a database)
*
* 2 from internally implemented SIM authenticators
/*
* Okay, we got the challenge! Put it into an attribute.
*/
- MEM(vp = fr_pair_afrom_child_num(packet, dict_aka_root, PW_EAP_AKA_RAND));
+ MEM(vp = fr_pair_afrom_child_num(packet, dict_aka_root, FR_EAP_AKA_RAND));
MEM(p = rand = talloc_array(vp, uint8_t, 2 + SIM_VECTOR_UMTS_RAND_SIZE));
memset(p, 0, 2); /* clear reserved bytes */
memcpy(p + 2, eap_aka_session->keys.umts.vector.rand, SIM_VECTOR_UMTS_RAND_SIZE);
* Send the AUTN value to the client, so it can authenticate
* whoever has knowledge of the Ki.
*/
- MEM(vp = fr_pair_afrom_child_num(packet, dict_aka_root, PW_EAP_AKA_AUTN));
+ MEM(vp = fr_pair_afrom_child_num(packet, dict_aka_root, FR_EAP_AKA_AUTN));
MEM(p = talloc_array(vp, uint8_t, 2 + SIM_VECTOR_UMTS_AUTN_SIZE));
memset(p, 0, 2); /* clear reserved bytes */
memcpy(p + 2, eap_aka_session->keys.umts.vector.autn, SIM_VECTOR_UMTS_AUTN_SIZE);
/*
* Set the EAP_ID - new value
*/
- vp = fr_pair_afrom_child_num(packet, fr_dict_root(fr_dict_internal), PW_EAP_ID);
+ vp = fr_pair_afrom_child_num(packet, fr_dict_root(fr_dict_internal), FR_EAP_ID);
vp->vp_uint32 = eap_aka_session->aka_id++;
fr_pair_replace(to_client, vp);
* need to include an AT_MAC attribute so that it will get
* calculated.
*/
- vp = fr_pair_afrom_child_num(packet, dict_aka_root, PW_EAP_AKA_MAC);
+ vp = fr_pair_afrom_child_num(packet, dict_aka_root, FR_EAP_AKA_MAC);
fr_pair_value_memcpy(vp, hmac_zero, sizeof(hmac_zero));
fr_pair_replace(to_client, vp);
- vp = fr_pair_afrom_child_num(packet, dict_aka_root, PW_EAP_AKA_KEY);
+ vp = fr_pair_afrom_child_num(packet, dict_aka_root, FR_EAP_AKA_KEY);
fr_pair_value_memcpy(vp, eap_aka_session->keys.k_aut, 16);
fr_pair_replace(to_client, vp);
/* the SUBTYPE, set to challenge. */
- vp = fr_pair_afrom_child_num(packet, dict_aka_root, PW_EAP_AKA_SUBTYPE);
- vp->vp_uint32 = PW_EAP_AKA_SUBTYPE_VALUE_AKA_CHALLENGE;
+ vp = fr_pair_afrom_child_num(packet, dict_aka_root, FR_EAP_AKA_SUBTYPE);
+ vp->vp_uint32 = FR_EAP_AKA_SUBTYPE_VALUE_AKA_CHALLENGE;
fr_pair_replace(to_client, vp);
return 1;
VALUE_PAIR *vp;
RADIUS_PACKET *packet;
- eap_session->this_round->request->code = PW_EAP_SUCCESS;
+ eap_session->this_round->request->code = FR_EAP_SUCCESS;
eap_session->finished = true;
/* to_client is the data to the client. */
eap_aka_session = talloc_get_type_abort(eap_session->opaque, eap_aka_session_t);
/* set the EAP_ID - new value */
- vp = fr_pair_afrom_child_num(packet, fr_dict_root(fr_dict_internal), PW_EAP_ID);
+ vp = fr_pair_afrom_child_num(packet, fr_dict_root(fr_dict_internal), FR_EAP_ID);
vp->vp_uint32 = eap_aka_session->aka_id++;
fr_pair_replace(&eap_session->request->reply->vps, vp);
return -1;
}
- vp = fr_pair_find_by_child_num(vps, dict_aka_root, PW_EAP_AKA_RES, TAG_ANY);
+ vp = fr_pair_find_by_child_num(vps, dict_aka_root, FR_EAP_AKA_RES, TAG_ANY);
if (!vp) {
REDEBUG("Missing EAP-AKA-RES from challenge response");
return -1;
rdebug_pair_list(L_DBG_LVL_2, request, vp, NULL);
}
- MEM(vp = fr_pair_find_by_child_num(vps, dict_aka_root, PW_EAP_AKA_SUBTYPE, TAG_ANY));
+ MEM(vp = fr_pair_find_by_child_num(vps, dict_aka_root, FR_EAP_AKA_SUBTYPE, TAG_ANY));
subtype = vp->vp_uint32;
switch (eap_aka_session->state) {
{
char buff[20];
- vp = fr_pair_find_by_child_num(vps, dict_aka_root, PW_EAP_AKA_CLIENT_ERROR_CODE, TAG_ANY);
+ vp = fr_pair_find_by_child_num(vps, dict_aka_root, FR_EAP_AKA_CLIENT_ERROR_CODE, TAG_ANY);
if (!vp) {
REDEBUG("EAP-AKA Peer rejected AKA-Challenge with client-error message but "
"has not supplied a client error code");
static int mod_load(void)
{
- dict_aka_root = fr_dict_attr_child_by_num(fr_dict_root(fr_dict_internal), PW_EAP_AKA_ROOT);
+ dict_aka_root = fr_dict_attr_child_by_num(fr_dict_root(fr_dict_internal), FR_EAP_AKA_ROOT);
if (!dict_aka_root) {
ERROR("Missing EAP-AKA-Root attribute");
return -1;
eap_fast_tlv_append(tls_session, EAP_FAST_TLV_ERROR, true, sizeof(value), &value);
}
-static void eap_fast_append_result(tls_session_t *tls_session, PW_CODE code)
+static void eap_fast_append_result(tls_session_t *tls_session, FR_CODE code)
{
eap_fast_tunnel_t *t = talloc_get_type_abort(tls_session->opaque, eap_fast_tunnel_t);
? EAP_FAST_TLV_RESULT
: EAP_FAST_TLV_INTERMED_RESULT;
- uint16_t state = (code == PW_CODE_ACCESS_REJECT)
+ uint16_t state = (code == FR_CODE_ACCESS_REJECT)
? EAP_FAST_TLV_RESULT_FAILURE
: EAP_FAST_TLV_RESULT_SUCCESS;
state = htons(state);
RDEBUG("Sending EAP-Identity");
- eap_packet.code = PW_EAP_REQUEST;
+ eap_packet.code = FR_EAP_REQUEST;
eap_packet.id = eap_session->this_round->response->id + 1;
eap_packet.length[0] = 0;
eap_packet.length[1] = EAP_HEADER_LEN + 1;
- eap_packet.data[0] = PW_EAP_IDENTITY;
+ eap_packet.data[0] = FR_EAP_IDENTITY;
eap_fast_tlv_append(tls_session, EAP_FAST_TLV_EAP_PAYLOAD, true, sizeof(eap_packet), &eap_packet);
}
* NOT 'eap start', so we should check for that....
*/
switch (reply->code) {
- case PW_CODE_ACCESS_ACCEPT:
+ case FR_CODE_ACCESS_ACCEPT:
RDEBUG("Got tunneled Access-Accept");
rcode = RLM_MODULE_OK;
/* FIXME must be a better way to capture/re-derive this later for ISK */
switch (vp->da->attr) {
- case PW_MSCHAP_MPPE_SEND_KEY:
+ case FR_MSCHAP_MPPE_SEND_KEY:
memcpy(t->isk.mppe_send, vp->vp_octets, CHAP_VALUE_LENGTH);
break;
- case PW_MSCHAP_MPPE_RECV_KEY:
+ case FR_MSCHAP_MPPE_RECV_KEY:
memcpy(t->isk.mppe_recv, vp->vp_octets, CHAP_VALUE_LENGTH);
break;
- case PW_MSCHAP2_SUCCESS:
+ case FR_MSCHAP2_SUCCESS:
RDEBUG("Got %s, tunneling it to the client in a challenge", vp->da->name);
rcode = RLM_MODULE_HANDLED;
t->authenticated = true;
RHEXDUMP(L_DBG_LVL_MAX, (uint8_t *)&t->isk, 2 * CHAP_VALUE_LENGTH, "ISK[j]"); /* FIXME (part of above) */
break;
- case PW_CODE_ACCESS_REJECT:
+ case FR_CODE_ACCESS_REJECT:
RDEBUG("Got tunneled Access-Reject");
rcode = RLM_MODULE_REJECT;
break;
- case PW_CODE_ACCESS_CHALLENGE:
+ case FR_CODE_ACCESS_CHALLENGE:
RDEBUG("Got tunneled Access-Challenge");
/*
*/
(void) fr_pair_cursor_init(&cursor, &reply->vps);
- while ((vp = fr_pair_cursor_next_by_num(&cursor, 0, PW_EAP_MESSAGE, TAG_ANY)) != NULL) {
+ while ((vp = fr_pair_cursor_next_by_num(&cursor, 0, FR_EAP_MESSAGE, TAG_ANY)) != NULL) {
eap_fast_tlv_append(tls_session, EAP_FAST_TLV_EAP_PAYLOAD, true, vp->vp_length, vp->vp_octets);
}
return rcode;
}
-static PW_CODE eap_fast_eap_payload(REQUEST *request, eap_session_t *eap_session,
+static FR_CODE eap_fast_eap_payload(REQUEST *request, eap_session_t *eap_session,
tls_session_t *tls_session, VALUE_PAIR *tlv_eap_payload)
{
- PW_CODE code = PW_CODE_ACCESS_REJECT;
+ FR_CODE code = FR_CODE_ACCESS_REJECT;
rlm_rcode_t rcode;
VALUE_PAIR *vp;
eap_fast_tunnel_t *t;
* Add the tunneled attributes to the fake request.
*/
- fake->packet->vps = fr_pair_afrom_num(fake->packet, 0, PW_EAP_MESSAGE);
+ fake->packet->vps = fr_pair_afrom_num(fake->packet, 0, FR_EAP_MESSAGE);
fr_pair_value_memcpy(fake->packet->vps, tlv_eap_payload->vp_octets, tlv_eap_payload->vp_length);
RDEBUG("Got tunneled request");
/*
* Update other items in the REQUEST data structure.
*/
- fake->username = fr_pair_find_by_num(fake->packet->vps, 0, PW_USER_NAME, TAG_ANY);
- fake->password = fr_pair_find_by_num(fake->packet->vps, 0, PW_USER_PASSWORD, TAG_ANY);
+ fake->username = fr_pair_find_by_num(fake->packet->vps, 0, FR_USER_NAME, TAG_ANY);
+ fake->password = fr_pair_find_by_num(fake->packet->vps, 0, FR_USER_PASSWORD, TAG_ANY);
/*
* No User-Name, try to create one from stored data.
* an EAP-Identity, and pull it out of there.
*/
if (!t->username) {
- vp = fr_pair_find_by_num(fake->packet->vps, 0, PW_EAP_MESSAGE, TAG_ANY);
+ vp = fr_pair_find_by_num(fake->packet->vps, 0, FR_EAP_MESSAGE, TAG_ANY);
if (vp &&
(vp->vp_length >= EAP_HEADER_LEN + 2) &&
- (vp->vp_strvalue[0] == PW_EAP_RESPONSE) &&
- (vp->vp_strvalue[EAP_HEADER_LEN] == PW_EAP_IDENTITY) &&
+ (vp->vp_strvalue[0] == FR_EAP_RESPONSE) &&
+ (vp->vp_strvalue[EAP_HEADER_LEN] == FR_EAP_IDENTITY) &&
(vp->vp_strvalue[EAP_HEADER_LEN + 1] != 0)) {
/*
* Create & remember a User-Name
if (t->username) {
vp = fr_pair_list_copy(fake->packet, t->username);
fr_pair_add(&fake->packet->vps, vp);
- fake->username = fr_pair_find_by_num(fake->packet->vps, 0, PW_USER_NAME, TAG_ANY);
+ fake->username = fr_pair_find_by_num(fake->packet->vps, 0, FR_USER_NAME, TAG_ANY);
}
} /* else the request ALREADY had a User-Name */
if (t->stage == EAP_FAST_AUTHENTICATION) { /* FIXME do this only for MSCHAPv2 */
VALUE_PAIR *tvp;
- tvp = fr_pair_afrom_num(fake, 0, PW_EAP_TYPE);
+ tvp = fr_pair_afrom_num(fake, 0, FR_EAP_TYPE);
tvp->vp_uint32 = t->default_provisioning_method;
fr_pair_add(&fake->control, tvp);
* RFC 5422 section 3.2.3 - Authenticating Using EAP-FAST-MSCHAPv2
*/
if (t->mode == EAP_FAST_PROVISIONING_ANON) {
- tvp = fr_pair_afrom_num(fake, VENDORPEC_MICROSOFT, PW_MSCHAP_CHALLENGE);
+ tvp = fr_pair_afrom_num(fake, VENDORPEC_MICROSOFT, FR_MSCHAP_CHALLENGE);
fr_pair_value_memcpy(tvp, t->keyblock->server_challenge, CHAP_VALUE_LENGTH);
fr_pair_add(&fake->control, tvp);
RHEXDUMP(L_DBG_LVL_MAX, t->keyblock->server_challenge, CHAP_VALUE_LENGTH, "MSCHAPv2 auth_challenge");
- tvp = fr_pair_afrom_num(fake, 0, PW_MS_CHAP_PEER_CHALLENGE);
+ tvp = fr_pair_afrom_num(fake, 0, FR_MS_CHAP_PEER_CHALLENGE);
fr_pair_value_memcpy(tvp, t->keyblock->client_challenge, CHAP_VALUE_LENGTH);
fr_pair_add(&fake->control, tvp);
RHEXDUMP(L_DBG_LVL_MAX, t->keyblock->client_challenge, CHAP_VALUE_LENGTH, "MSCHAPv2 peer_challenge");
switch (fake->reply->code) {
case 0: /* No reply code, must be proxied... */
#ifdef WITH_PROXY
- vp = fr_pair_find_by_num(fake->control, 0, PW_PROXY_TO_REALM, TAG_ANY);
+ vp = fr_pair_find_by_num(fake->control, 0, FR_PROXY_TO_REALM, TAG_ANY);
if (vp) {
int ret;
eap_tunnel_data_t *tunnel;
* to be proxied.
*/
fr_pair_list_mcopy_by_num(request, &request->control, &fake->control, 0,
- PW_PROXY_TO_REALM, TAG_ANY);
+ FR_PROXY_TO_REALM, TAG_ANY);
/*
* Seed the proxy packet with the
* Didn't authenticate the packet, but
* we're proxying it.
*/
- code = PW_CODE_STATUS_CLIENT;
+ code = FR_CODE_STATUS_CLIENT;
} else
#endif /* WITH_PROXY */
{
RDEBUG("No tunneled reply was found, and the request was not proxied: rejecting the user.");
- code = PW_CODE_ACCESS_REJECT;
+ code = FR_CODE_ACCESS_REJECT;
}
break;
default:
/*
- * Returns RLM_MODULE_FOO, and we want to return PW_FOO
+ * Returns RLM_MODULE_FOO, and we want to return FR_FOO
*/
rcode = process_reply(eap_session, tls_session, request, fake->reply);
switch (rcode) {
case RLM_MODULE_REJECT:
- code = PW_CODE_ACCESS_REJECT;
+ code = FR_CODE_ACCESS_REJECT;
break;
case RLM_MODULE_HANDLED:
- code = PW_CODE_ACCESS_CHALLENGE;
+ code = FR_CODE_ACCESS_CHALLENGE;
break;
case RLM_MODULE_OK:
- code = PW_CODE_ACCESS_ACCEPT;
+ code = FR_CODE_ACCESS_ACCEPT;
break;
default:
- code = PW_CODE_ACCESS_REJECT;
+ code = FR_CODE_ACCESS_REJECT;
break;
}
break;
return code;
}
-static PW_CODE eap_fast_crypto_binding(REQUEST *request, UNUSED eap_session_t *eap_session,
+static FR_CODE eap_fast_crypto_binding(REQUEST *request, UNUSED eap_session_t *eap_session,
tls_session_t *tls_session, eap_tlv_crypto_binding_tlv_t *binding)
{
uint8_t cmac[sizeof(binding->compound_mac)];
RDEBUG2("Crypto-Binding TLV mis-match");
RHEXDUMP(L_DBG_LVL_MAX, (uint8_t const *) binding->compound_mac,
sizeof(binding->compound_mac), "Calculated Compound MAC");
- return PW_CODE_ACCESS_REJECT;
+ return FR_CODE_ACCESS_REJECT;
}
- return PW_CODE_ACCESS_ACCEPT;
+ return FR_CODE_ACCESS_ACCEPT;
}
-static PW_CODE eap_fast_process_tlvs(REQUEST *request, eap_session_t *eap_session,
+static FR_CODE eap_fast_process_tlvs(REQUEST *request, eap_session_t *eap_session,
tls_session_t *tls_session, VALUE_PAIR *fast_vps)
{
eap_fast_tunnel_t *t = talloc_get_type_abort(tls_session->opaque, eap_fast_tunnel_t);
eap_tlv_crypto_binding_tlv_t *binding = NULL;
for (vp = fr_pair_cursor_init(&cursor, &fast_vps); vp; vp = fr_pair_cursor_next(&cursor)) {
- PW_CODE code = PW_CODE_ACCESS_REJECT;
+ FR_CODE code = FR_CODE_ACCESS_REJECT;
char *value;
switch (vp->da->parent->attr) {
- case PW_EAP_FAST_TLV:
+ case FR_EAP_FAST_TLV:
switch (vp->da->attr) {
case EAP_FAST_TLV_EAP_PAYLOAD:
code = eap_fast_eap_payload(request, eap_session, tls_session, vp);
- if (code == PW_CODE_ACCESS_ACCEPT)
+ if (code == FR_CODE_ACCESS_ACCEPT)
t->stage = EAP_FAST_CRYPTOBIND_CHECK;
break;
case EAP_FAST_TLV_RESULT:
case EAP_FAST_TLV_INTERMED_RESULT:
- code = PW_CODE_ACCESS_ACCEPT;
+ code = FR_CODE_ACCESS_ACCEPT;
t->stage = EAP_FAST_PROVISIONING;
break;
default:
* fr_radius_encode_pair() does not work for structures
*/
switch (vp->da->attr) {
- case 1: /* PW_EAP_FAST_CRYPTO_BINDING_RESERVED */
+ case 1: /* FR_EAP_FAST_CRYPTO_BINDING_RESERVED */
binding->reserved = vp->vp_uint32;
break;
- case 2: /* PW_EAP_FAST_CRYPTO_BINDING_VERSION */
+ case 2: /* FR_EAP_FAST_CRYPTO_BINDING_VERSION */
binding->version = vp->vp_uint32;
break;
- case 3: /* PW_EAP_FAST_CRYPTO_BINDING_RECV_VERSION */
+ case 3: /* FR_EAP_FAST_CRYPTO_BINDING_RECV_VERSION */
binding->received_version = vp->vp_uint32;
break;
- case 4: /* PW_EAP_FAST_CRYPTO_BINDING_SUB_TYPE */
+ case 4: /* FR_EAP_FAST_CRYPTO_BINDING_SUB_TYPE */
binding->subtype = vp->vp_uint32;
break;
- case 5: /* PW_EAP_FAST_CRYPTO_BINDING_NONCE */
+ case 5: /* FR_EAP_FAST_CRYPTO_BINDING_NONCE */
memcpy(binding->nonce, vp->vp_octets, vp->vp_length);
break;
- case 6: /* PW_EAP_FAST_CRYPTO_BINDING_COMPOUND_MAC */
+ case 6: /* FR_EAP_FAST_CRYPTO_BINDING_COMPOUND_MAC */
memcpy(binding->compound_mac, vp->vp_octets, vp->vp_length);
break;
}
switch (vp->da->attr) {
case PAC_INFO_PAC_ACK:
if (vp->vp_uint32 == EAP_FAST_TLV_RESULT_SUCCESS) {
- code = PW_CODE_ACCESS_ACCEPT;
+ code = FR_CODE_ACCESS_ACCEPT;
t->pac.expires = UINT32_MAX;
t->pac.expired = false;
t->stage = EAP_FAST_COMPLETE;
continue;
}
- if (code == PW_CODE_ACCESS_REJECT)
- return PW_CODE_ACCESS_REJECT;
+ if (code == FR_CODE_ACCESS_REJECT)
+ return FR_CODE_ACCESS_REJECT;
}
if (binding) {
- PW_CODE code = eap_fast_crypto_binding(request, eap_session, tls_session, binding);
- if (code == PW_CODE_ACCESS_ACCEPT)
+ FR_CODE code = eap_fast_crypto_binding(request, eap_session, tls_session, binding);
+ if (code == FR_CODE_ACCESS_ACCEPT)
t->stage = EAP_FAST_PROVISIONING;
}
- return PW_CODE_ACCESS_ACCEPT;
+ return FR_CODE_ACCESS_ACCEPT;
}
/*
* Process the inner tunnel data
*/
-PW_CODE eap_fast_process(eap_session_t *eap_session, tls_session_t *tls_session)
+FR_CODE eap_fast_process(eap_session_t *eap_session, tls_session_t *tls_session)
{
- PW_CODE code;
+ FR_CODE code;
VALUE_PAIR *fast_vps = NULL;
vp_cursor_t cursor;
uint8_t const *data;
/*
* See if the tunneled data is well formed.
*/
- if (!eap_fast_verify(request, tls_session, data, data_len)) return PW_CODE_ACCESS_REJECT;
+ if (!eap_fast_verify(request, tls_session, data, data_len)) return FR_CODE_ACCESS_REJECT;
if (t->stage == EAP_FAST_TLS_SESSION_HANDSHAKE) {
rad_assert(t->mode == EAP_FAST_UNKNOWN);
eap_fast_send_identity_request(request, tls_session, eap_session);
t->stage = EAP_FAST_AUTHENTICATION;
- return PW_CODE_ACCESS_CHALLENGE;
+ return FR_CODE_ACCESS_CHALLENGE;
}
fr_pair_cursor_init(&cursor, &fast_vps);
- if (eap_fast_decode_pair(request, &cursor, fr_dict_attr_by_num(NULL, 0, PW_EAP_FAST_TLV),
- data, data_len, NULL) < 0) return PW_CODE_ACCESS_REJECT;
+ if (eap_fast_decode_pair(request, &cursor, fr_dict_attr_by_num(NULL, 0, FR_EAP_FAST_TLV),
+ data, data_len, NULL) < 0) return FR_CODE_ACCESS_REJECT;
RDEBUG("Got Tunneled FAST TLVs");
rdebug_pair_list(L_DBG_LVL_1, request, fast_vps, NULL);
code = eap_fast_process_tlvs(request, eap_session, tls_session, fast_vps);
fr_pair_list_free(&fast_vps);
- if (code == PW_CODE_ACCESS_REJECT) return PW_CODE_ACCESS_REJECT;
+ if (code == FR_CODE_ACCESS_REJECT) return FR_CODE_ACCESS_REJECT;
switch (t->stage) {
case EAP_FAST_AUTHENTICATION:
- code = PW_CODE_ACCESS_CHALLENGE;
+ code = FR_CODE_ACCESS_CHALLENGE;
break;
case EAP_FAST_CRYPTOBIND_CHECK:
eap_fast_update_icmk(request, tls_session, (uint8_t *)&t->isk);
eap_fast_append_crypto_binding(request, tls_session);
- code = PW_CODE_ACCESS_CHALLENGE;
+ code = FR_CODE_ACCESS_CHALLENGE;
break;
}
case EAP_FAST_PROVISIONING:
eap_fast_append_result(tls_session, code);
- if (code == PW_CODE_ACCESS_REJECT)
+ if (code == FR_CODE_ACCESS_REJECT)
break;
if (t->pac.send) {
RDEBUG("Peer requires new PAC");
eap_fast_send_pac_tunnel(request, tls_session);
- code = PW_CODE_ACCESS_CHALLENGE;
+ code = FR_CODE_ACCESS_CHALLENGE;
break;
}
*/
if (t->pac.type && t->pac.expired) {
REDEBUG("Rejecting expired PAC.");
- code = PW_CODE_ACCESS_REJECT;
+ code = FR_CODE_ACCESS_REJECT;
break;
}
if (t->mode == EAP_FAST_PROVISIONING_ANON) {
REDEBUG("Rejecting unauthenticated provisioning");
- code = PW_CODE_ACCESS_REJECT;
+ code = FR_CODE_ACCESS_REJECT;
break;
}
default:
RERROR("Internal sanity check failed in EAP-FAST at %d", t->stage);
- code = PW_CODE_ACCESS_REJECT;
+ code = FR_CODE_ACCESS_REJECT;
}
return code;
*/
void eap_fast_tlv_append(tls_session_t *tls_session, int tlv, bool mandatory,
int length, const void *data) CC_HINT(nonnull);
-PW_CODE eap_fast_process(eap_session_t *eap_session, tls_session_t *tls_session) CC_HINT(nonnull);
+FR_CODE eap_fast_process(eap_session_t *eap_session, tls_session_t *tls_session) CC_HINT(nonnull);
/*
* A bunch of EAP-FAST helper functions.
rcode = eap_fast_process(eap_session, tls_session);
switch (rcode) {
- case PW_CODE_ACCESS_REJECT:
+ case FR_CODE_ACCESS_REJECT:
eap_tls_fail(eap_session);
return RLM_MODULE_FAIL;
/*
* Access-Challenge, continue tunneled conversation.
*/
- case PW_CODE_ACCESS_CHALLENGE:
+ case FR_CODE_ACCESS_CHALLENGE:
tls_session_send(request, tls_session);
eap_tls_request(eap_session);
return RLM_MODULE_HANDLED;
/*
* Success: Automatically return MPPE keys.
*/
- case PW_CODE_ACCESS_ACCEPT:
+ case FR_CODE_ACCESS_ACCEPT:
RDEBUG("Note that the 'missing PRF label' message below is harmless. Please ignore it.");
if (eap_tls_success(eap_session) < 0) return RLM_MODULE_FAIL;
return RLM_MODULE_OK;
* that the request now has a "proxy" packet, and
* will proxy it, rather than returning an EAP packet.
*/
- case PW_CODE_STATUS_CLIENT:
+ case FR_CODE_STATUS_CLIENT:
#ifdef WITH_PROXY
rad_assert(eap_session->request->proxy != NULL);
#endif
* EAP-TLS-Require-Client-Cert attribute will override
* the require_client_cert configuration option.
*/
- vp = fr_pair_find_by_num(eap_session->request->control, 0, PW_EAP_TLS_REQUIRE_CLIENT_CERT, TAG_ANY);
+ vp = fr_pair_find_by_num(eap_session->request->control, 0, FR_EAP_TLS_REQUIRE_CLIENT_CERT, TAG_ANY);
if (vp) {
client_cert = vp->vp_uint32 ? true : false;
} else {
if (rcode == RLM_MODULE_YIELD) return rcode;
if (rcode != RLM_MODULE_OK) {
- eap_round->request->code = PW_EAP_FAILURE;
+ eap_round->request->code = FR_EAP_FAILURE;
return rcode;
}
- eap_round->request->code = PW_EAP_SUCCESS;
+ eap_round->request->code = FR_EAP_SUCCESS;
return RLM_MODULE_OK;
}
*/
if (eap_round->response->length <= 4) {
ERROR("Corrupted data");
- eap_round->request->code = PW_EAP_FAILURE;
+ eap_round->request->code = FR_EAP_FAILURE;
return RLM_MODULE_INVALID;
}
*/
if (eap_round->response->type.length > 128) {
ERROR("Response is too large to understand");
- eap_round->request->code = PW_EAP_FAILURE;
+ eap_round->request->code = FR_EAP_FAILURE;
return RLM_MODULE_INVALID;
}
* If there was a User-Password in the request,
* why the heck are they using EAP-GTC?
*/
- fr_pair_delete_by_num(&request->packet->vps, 0, PW_USER_PASSWORD, TAG_ANY);
+ fr_pair_delete_by_num(&request->packet->vps, 0, FR_USER_PASSWORD, TAG_ANY);
MEM(vp = pair_make_request("User-Password", NULL, T_OP_EQ));
fr_pair_value_bstrncpy(vp, eap_round->response->type.data, eap_round->response->type.length);
*/
rcode = process_authenticate(inst->auth_type, request);
if (rcode != RLM_MODULE_OK) {
- eap_round->request->code = PW_EAP_FAILURE;
+ eap_round->request->code = FR_EAP_FAILURE;
return rcode;
}
- eap_round->request->code = PW_EAP_SUCCESS;
+ eap_round->request->code = FR_EAP_SUCCESS;
return RLM_MODULE_OK;
}
/*
* We're sending a request...
*/
- eap_round->request->code = PW_EAP_REQUEST;
+ eap_round->request->code = FR_EAP_REQUEST;
eap_round->request->type.data = talloc_array(eap_round->request, uint8_t, length);
if (!eap_round->request->type.data) return RLM_MODULE_FAIL;
return -1;
}
- dval = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, PW_AUTH_TYPE), inst->auth_type_name);
+ dval = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, FR_AUTH_TYPE), inst->auth_type_name);
if (!dval) {
cf_log_err_by_name(cs, "auth_type", "Unknown Auth-Type %s",
inst->auth_type_name);
* messages sent to it.
*/
if (!eap_round || !eap_round->response ||
- ((eap_round->response->code != PW_EAP_RESPONSE) && (eap_round->response->code != PW_EAP_REQUEST)) ||
- (eap_round->response->type.num != PW_EAP_LEAP) || !eap_round->response->type.data ||
+ ((eap_round->response->code != FR_EAP_RESPONSE) && (eap_round->response->code != FR_EAP_REQUEST)) ||
+ (eap_round->response->type.num != FR_EAP_LEAP) || !eap_round->response->type.data ||
(eap_round->response->length < LEAP_HEADER_LEN) ||
(eap_round->response->type.data[0] != 0x01)) { /* version 1 */
REDEBUG("Corrupted data");
* of the stages.
*/
switch (eap_round->response->code) {
- case PW_EAP_RESPONSE:
+ case FR_EAP_RESPONSE:
if (data->count != 24) {
REDEBUG("Bad NTChallengeResponse in LEAP stage 3");
return NULL;
}
break;
- case PW_EAP_REQUEST:
+ case FR_EAP_REQUEST:
if (data->count != 8) {
REDEBUG("Bad AP Challenge in LEAP stage 5");
return NULL;
*/
static int eap_leap_ntpwdhash(uint8_t *out, REQUEST *request, VALUE_PAIR *password)
{
- if ((password->da->attr == PW_USER_PASSWORD) ||
- (password->da->attr == PW_CLEARTEXT_PASSWORD)) {
+ if ((password->da->attr == FR_USER_PASSWORD) ||
+ (password->da->attr == FR_CLEARTEXT_PASSWORD)) {
ssize_t len;
uint8_t ucs2_password[512];
reply = talloc(session, leap_packet_t);
if (!reply) return NULL;
- reply->code = PW_EAP_RESPONSE;
+ reply->code = FR_EAP_RESPONSE;
reply->length = LEAP_HEADER_LEN + 24 + user_name->vp_length;
reply->count = 24;
*/
fr_md5_calc(hash, buffer, 16 + 8 + 24 + 8 + 24);
- q = talloc_array(vp, char, FR_TUNNEL_PW_ENC_LENGTH(16) + sizeof("leap:session-key="));
+ q = talloc_array(vp, char, FR_TUNNEL_FR_ENC_LENGTH(16) + sizeof("leap:session-key="));
strcpy(q, "leap:session-key=");
memcpy(q + 17, hash, 16);
return NULL;
}
- reply->code = PW_EAP_REQUEST;
+ reply->code = FR_EAP_REQUEST;
reply->length = LEAP_HEADER_LEN + 8 + user_name->vp_length;
reply->count = 8; /* random challenge */
* We need the name and the challenge.
*/
switch (reply->code) {
- case PW_EAP_REQUEST:
- case PW_EAP_RESPONSE:
- eap_round->request->type.num = PW_EAP_LEAP;
+ case FR_EAP_REQUEST:
+ case FR_EAP_RESPONSE:
+ eap_round->request->type.num = FR_EAP_LEAP;
eap_round->request->type.length = reply->length;
eap_round->request->type.data = talloc_array(eap_round->request, uint8_t, reply->length);
* EAP-Success packets don't contain any data
* other than the header.
*/
- case PW_EAP_SUCCESS:
+ case FR_EAP_SUCCESS:
eap_round->request->type.length = 0;
break;
#include "eap.h"
-#define PW_LEAP_CHALLENGE 1
-#define PW_LEAP_RESPONSE 2
-#define PW_LEAP_SUCCESS 3
-#define PW_LEAP_FAILURE 4
-#define PW_LEAP_MAX_CODES 4
+#define FR_LEAP_CHALLENGE 1
+#define FR_LEAP_RESPONSE 2
+#define FR_LEAP_SUCCESS 3
+#define FR_LEAP_FAILURE 4
+#define FR_LEAP_MAX_CODES 4
/*
* Version + unused + count
* The password is never sent over the wire.
* Always get the configured password, for each user.
*/
- password = fr_pair_find_by_num(eap_session->request->control, 0, PW_CLEARTEXT_PASSWORD, TAG_ANY);
- if (!password) password = fr_pair_find_by_num(eap_session->request->control, 0, PW_NT_PASSWORD, TAG_ANY);
+ password = fr_pair_find_by_num(eap_session->request->control, 0, FR_CLEARTEXT_PASSWORD, TAG_ANY);
+ if (!password) password = fr_pair_find_by_num(eap_session->request->control, 0, FR_NT_PASSWORD, TAG_ANY);
if (!password) {
REDEBUG("No Cleartext-Password or NT-Password configured for this user");
talloc_free(packet);
* any LEAP packet. So we return here.
*/
if (!rcode) {
- eap_session->this_round->request->code = PW_EAP_FAILURE;
+ eap_session->this_round->request->code = FR_EAP_FAILURE;
talloc_free(packet);
return 0;
}
- eap_session->this_round->request->code = PW_EAP_SUCCESS;
+ eap_session->this_round->request->code = FR_EAP_SUCCESS;
/*
* Do this only for Success.
* by eap_compose() in eap.c, when the EAP reply code
* is EAP_SUCCESS.
*/
- eap_session->request->reply->code = PW_CODE_ACCESS_CHALLENGE;
+ eap_session->request->reply->code = FR_CODE_ACCESS_CHALLENGE;
talloc_free(packet);
return RLM_MODULE_OK;
*/
if (!eap_round ||
!eap_round->response ||
- (eap_round->response->code != PW_MD5_RESPONSE) ||
- eap_round->response->type.num != PW_EAP_MD5 ||
+ (eap_round->response->code != FR_MD5_RESPONSE) ||
+ eap_round->response->type.num != FR_EAP_MD5 ||
!eap_round->response->type.data ||
(eap_round->response->length <= MD5_HEADER_LEN) ||
(eap_round->response->type.data[0] <= 0)) {
* and EAP-Success, and EAP-Failure.
*/
if (reply->code < 3) {
- eap_round->request->type.num = PW_EAP_MD5;
+ eap_round->request->type.num = FR_EAP_MD5;
rad_assert(reply->length > 0);
#include "eap.h"
-#define PW_MD5_CHALLENGE 1
-#define PW_MD5_RESPONSE 2
-#define PW_MD5_SUCCESS 3
-#define PW_MD5_FAILURE 4
-#define PW_MD5_MAX_CODES 4
+#define FR_MD5_CHALLENGE 1
+#define FR_MD5_RESPONSE 2
+#define FR_MD5_SUCCESS 3
+#define FR_MD5_FAILURE 4
+#define FR_MD5_MAX_CODES 4
#define MD5_HEADER_LEN 4
#define MD5_CHALLENGE_LEN 16
/*
* Fill it with data.
*/
- reply->code = PW_MD5_CHALLENGE;
+ reply->code = FR_MD5_CHALLENGE;
reply->length = 1 + MD5_CHALLENGE_LEN; /* one byte of value size */
reply->value_size = MD5_CHALLENGE_LEN;
*/
rad_assert(eap_session->request != NULL);
- password = fr_pair_find_by_num(eap_session->request->control, 0, PW_CLEARTEXT_PASSWORD, TAG_ANY);
+ password = fr_pair_find_by_num(eap_session->request->control, 0, FR_CLEARTEXT_PASSWORD, TAG_ANY);
if (!password) {
REDEBUG2("Cleartext-Password is required for EAP-MD5 authentication");
return RLM_MODULE_REJECT;
* (i.e. challenge) which we sent out.
*/
if (eap_md5_verify(packet, password, eap_session->opaque)) {
- reply->code = PW_MD5_SUCCESS;
+ reply->code = FR_MD5_SUCCESS;
} else {
- reply->code = PW_MD5_FAILURE;
+ reply->code = FR_MD5_FAILURE;
}
/*
* <-- success
* ack -->
*/
-#define PW_EAP_MSCHAPV2_ACK 0
-#define PW_EAP_MSCHAPV2_CHALLENGE 1
-#define PW_EAP_MSCHAPV2_RESPONSE 2
-#define PW_EAP_MSCHAPV2_SUCCESS 3
-#define PW_EAP_MSCHAPV2_FAILURE 4
-#define PW_EAP_MSCHAPV2_CHGPASSWD 7
-#define PW_EAP_MSCHAPV2_MAX_CODES 7
+#define FR_EAP_MSCHAPV2_ACK 0
+#define FR_EAP_MSCHAPV2_CHALLENGE 1
+#define FR_EAP_MSCHAPV2_RESPONSE 2
+#define FR_EAP_MSCHAPV2_SUCCESS 3
+#define FR_EAP_MSCHAPV2_FAILURE 4
+#define FR_EAP_MSCHAPV2_CHGPASSWD 7
+#define FR_EAP_MSCHAPV2_MAX_CODES 7
#define MSCHAPV2_HEADER_LEN 5
#define MSCHAPV2_CHALLENGE_LEN 16
eap_round_t *eap_round = eap_session->this_round;
REQUEST *request = eap_session->request;
- eap_round->request->code = PW_EAP_REQUEST;
- eap_round->request->type.num = PW_EAP_MSCHAPV2;
+ eap_round->request->code = FR_EAP_REQUEST;
+ eap_round->request->type.num = FR_EAP_MSCHAPV2;
/*
* Always called with vendor Microsoft
*/
switch (reply->da->attr) {
- case PW_MSCHAP_CHALLENGE:
+ case FR_MSCHAP_CHALLENGE:
/*
* 0 1 2 3
* 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
ptr = eap_round->request->type.data;
hdr = (mschapv2_header_t *) ptr;
- hdr->opcode = PW_EAP_MSCHAPV2_CHALLENGE;
+ hdr->opcode = FR_EAP_MSCHAPV2_CHALLENGE;
hdr->mschapv2_id = eap_round->response->id + 1;
length = htons(length);
memcpy(hdr->ms_length, &length, sizeof(uint16_t));
memcpy((ptr + reply->vp_length), inst->identity, strlen(inst->identity));
break;
- case PW_MSCHAP2_SUCCESS:
+ case FR_MSCHAP2_SUCCESS:
/*
* 0 1 2 3
* 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
memset(eap_round->request->type.data, 0, length);
eap_round->request->type.length = length;
- eap_round->request->type.data[0] = PW_EAP_MSCHAPV2_SUCCESS;
+ eap_round->request->type.data[0] = FR_EAP_MSCHAPV2_SUCCESS;
eap_round->request->type.data[1] = eap_round->response->id;
length = htons(length);
memcpy((eap_round->request->type.data + 2), &length, sizeof(uint16_t));
memcpy((eap_round->request->type.data + 4), reply->vp_strvalue + 1, 42);
break;
- case PW_MSCHAP_ERROR:
+ case FR_MSCHAP_ERROR:
REDEBUG("MSCHAP Failure");
length = 4 + reply->vp_length - 1;
eap_round->request->type.data = talloc_array(eap_round->request, uint8_t, length);
memset(eap_round->request->type.data, 0, length);
eap_round->request->type.length = length;
- eap_round->request->type.data[0] = PW_EAP_MSCHAPV2_FAILURE;
+ eap_round->request->type.data[0] = FR_EAP_MSCHAPV2_FAILURE;
eap_round->request->type.data[1] = eap_round->response->id;
length = htons(length);
memcpy((eap_round->request->type.data + 2), &length, sizeof(uint16_t));
* There is only a limited number of possibilities.
*/
switch (request->reply->code) {
- case PW_CODE_ACCESS_ACCEPT:
+ case FR_CODE_ACCESS_ACCEPT:
RDEBUG2("Proxied authentication succeeded");
/*
* the reply.
*/
fr_pair_list_mcopy_by_num(data, &response, &request->reply->vps, VENDORPEC_MICROSOFT,
- PW_MSCHAP2_SUCCESS, TAG_ANY);
+ FR_MSCHAP2_SUCCESS, TAG_ANY);
break;
default:
- case PW_CODE_ACCESS_REJECT:
+ case FR_CODE_ACCESS_REJECT:
REDEBUG("Proxied authentication was rejected");
return RLM_MODULE_REJECT;
}
request->options &= ~RAD_REQUEST_OPTION_PROXY_EAP;
if (!rad_cond_assert(eap_session->inst)) return 0;
eapmschapv2_compose(eap_session->inst, eap_session, response);
- data->code = PW_EAP_MSCHAPV2_SUCCESS;
+ data->code = FR_EAP_MSCHAPV2_SUCCESS;
/*
* Delete MPPE keys & encryption policy
* And we need to challenge the user, not ack/reject them,
* so we re-write the ACK to a challenge. Yuck.
*/
- request->reply->code = PW_CODE_ACCESS_CHALLENGE;
+ request->reply->code = FR_CODE_ACCESS_CHALLENGE;
fr_pair_list_free(&response);
return RLM_MODULE_OK;
ccode = eap_round->response->type.data[0];
switch (data->code) {
- case PW_EAP_MSCHAPV2_FAILURE:
- if (ccode == PW_EAP_MSCHAPV2_RESPONSE) {
+ case FR_EAP_MSCHAPV2_FAILURE:
+ if (ccode == FR_EAP_MSCHAPV2_RESPONSE) {
RDEBUG2("Authentication re-try from client after we sent a failure");
break;
}
* regular MS-CHAP2-CPW packet and pass it to rlm_mschap
* (or proxy it, I guess)
*/
- if (ccode == PW_EAP_MSCHAPV2_CHGPASSWD) {
+ if (ccode == FR_EAP_MSCHAPV2_CHGPASSWD) {
VALUE_PAIR *cpw;
int mschap_id = eap_round->response->type.data[1];
int copied = 0 ,seq = 1;
/*
* we sent a failure and are expecting a failure back
*/
- if (ccode != PW_EAP_MSCHAPV2_FAILURE) {
+ if (ccode != FR_EAP_MSCHAPV2_FAILURE) {
REDEBUG("Sent FAILURE expecting FAILURE but got %d", ccode);
return RLM_MODULE_INVALID;
}
failure:
request->options &= ~RAD_REQUEST_OPTION_PROXY_EAP;
- eap_round->request->code = PW_EAP_FAILURE;
+ eap_round->request->code = FR_EAP_FAILURE;
return RLM_MODULE_REJECT;
- case PW_EAP_MSCHAPV2_SUCCESS:
+ case FR_EAP_MSCHAPV2_SUCCESS:
/*
* we sent a success to the client; some clients send a
* success back as-per the RFC, some send an ACK. Permit
*/
switch (ccode) {
- case PW_EAP_MSCHAPV2_SUCCESS:
- eap_round->request->code = PW_EAP_SUCCESS;
+ case FR_EAP_MSCHAPV2_SUCCESS:
+ eap_round->request->code = FR_EAP_SUCCESS;
fr_pair_list_mcopy_by_num(request->reply, &request->reply->vps, &data->mppe_keys, 0, 0, TAG_ANY);
/* FALL-THROUGH */
- case PW_EAP_MSCHAPV2_ACK:
+ case FR_EAP_MSCHAPV2_ACK:
#ifdef WITH_PROXY
/*
* It's a success. Don't proxy it.
REDEBUG("Sent SUCCESS expecting SUCCESS (or ACK) but got %d", ccode);
return RLM_MODULE_INVALID;
- case PW_EAP_MSCHAPV2_CHALLENGE:
- if (ccode == PW_EAP_MSCHAPV2_FAILURE) goto failure;
+ case FR_EAP_MSCHAPV2_CHALLENGE:
+ if (ccode == FR_EAP_MSCHAPV2_FAILURE) goto failure;
/*
* we sent a challenge, expecting a response
*/
- if (ccode != PW_EAP_MSCHAPV2_RESPONSE) {
+ if (ccode != FR_EAP_MSCHAPV2_RESPONSE) {
REDEBUG("Sent CHALLENGE expecting RESPONSE but got %d", ccode);
return RLM_MODULE_INVALID;
}
* the State attribute back, before passing
* the eap_session & request back into the tunnel.
*/
- fr_pair_delete_by_num(&request->packet->vps, 0, PW_STATE, TAG_ANY);
+ fr_pair_delete_by_num(&request->packet->vps, 0, FR_STATE, TAG_ANY);
/*
* Fix the User-Name when proxying, to strip off
* in the user name, THEN discard the user name.
*/
if (inst->with_ntdomain_hack &&
- ((auth_challenge = fr_pair_find_by_num(request->packet->vps, 0, PW_USER_NAME, TAG_ANY)) != NULL) &&
+ ((auth_challenge = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY)) != NULL) &&
((username = memchr(auth_challenge->vp_octets, '\\', auth_challenge->vp_length)) != NULL)) {
/*
* Wipe out the NT domain.
response = NULL;
if (rcode == RLM_MODULE_OK) {
fr_pair_list_mcopy_by_num(data, &response, &request->reply->vps, VENDORPEC_MICROSOFT,
- PW_MSCHAP2_SUCCESS, TAG_ANY);
- data->code = PW_EAP_MSCHAPV2_SUCCESS;
+ FR_MSCHAP2_SUCCESS, TAG_ANY);
+ data->code = FR_EAP_MSCHAPV2_SUCCESS;
} else if (inst->send_error) {
- fr_pair_list_mcopy_by_num(data, &response, &request->reply->vps, VENDORPEC_MICROSOFT, PW_MSCHAP_ERROR,
+ fr_pair_list_mcopy_by_num(data, &response, &request->reply->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_ERROR,
TAG_ANY);
if (response) {
int n,err,retry;
RDEBUG2("Could not parse new challenge from MS-CHAP-Error: %d", n);
}
}
- data->code = PW_EAP_MSCHAPV2_FAILURE;
+ data->code = FR_EAP_MSCHAPV2_FAILURE;
} else {
- eap_round->request->code = PW_EAP_FAILURE;
+ eap_round->request->code = FR_EAP_FAILURE;
return RLM_MODULE_REJECT;
}
if (!rad_cond_assert(instance)) return RLM_MODULE_FAIL;
- auth_challenge = fr_pair_find_by_num(request->control, VENDORPEC_MICROSOFT, PW_MSCHAP_CHALLENGE, TAG_ANY);
+ auth_challenge = fr_pair_find_by_num(request->control, VENDORPEC_MICROSOFT, FR_MSCHAP_CHALLENGE, TAG_ANY);
if (auth_challenge && (auth_challenge->vp_length != MSCHAPV2_CHALLENGE_LEN)) {
RWDEBUG("control:MS-CHAP-Challenge is incorrect length. Ignoring it.");
auth_challenge = NULL;
}
- peer_challenge = fr_pair_find_by_num(request->control, 0, PW_MS_CHAP_PEER_CHALLENGE, TAG_ANY);
+ peer_challenge = fr_pair_find_by_num(request->control, 0, FR_MS_CHAP_PEER_CHALLENGE, TAG_ANY);
if (peer_challenge && (peer_challenge->vp_length != MSCHAPV2_CHALLENGE_LEN)) {
RWDEBUG("control:MS-CHAP-Peer-Challenge is incorrect length. Ignoring it.");
peer_challenge = NULL;
if (auth_challenge) {
created_auth_challenge = false;
- peer_challenge = fr_pair_find_by_num(request->control, 0, PW_MS_CHAP_PEER_CHALLENGE, TAG_ANY);
+ peer_challenge = fr_pair_find_by_num(request->control, 0, FR_MS_CHAP_PEER_CHALLENGE, TAG_ANY);
if (peer_challenge && (peer_challenge->vp_length != MSCHAPV2_CHALLENGE_LEN)) {
RWDEBUG("control:MS-CHAP-Peer-Challenge is incorrect length. Ignoring it.");
peer_challenge = NULL;
/*
* We're at the stage where we're challenging the user.
*/
- data->code = PW_EAP_MSCHAPV2_CHALLENGE;
+ data->code = FR_EAP_MSCHAPV2_CHALLENGE;
memcpy(data->auth_challenge, auth_challenge->vp_octets, MSCHAPV2_CHALLENGE_LEN);
data->mppe_keys = NULL;
data->reply = NULL;
if (!inst->identity) inst->identity = talloc_asprintf(inst, "freeradius-%s", RADIUSD_VERSION_STRING);
- dv = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, PW_AUTH_TYPE), "MS-CHAP");
- if (!dv) dv = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, PW_AUTH_TYPE), "MSCHAP");
+ dv = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, FR_AUTH_TYPE), "MS-CHAP");
+ if (!dv) dv = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, FR_AUTH_TYPE), "MSCHAP");
if (!dv) {
cf_log_err_cs(cs, "Failed to find 'Auth-Type MS-CHAP' section. Cannot authenticate users.");
return -1;
#define EAP_TLV_FAILURE (2)
#define EAP_TLV_ACK_RESULT (3)
-#define PW_EAP_TLV 33
+#define FR_EAP_TLV 33
/*
* Process the PEAP portion of an EAP-PEAP request.
RDEBUG2("FAILURE");
- tlv_packet[0] = PW_EAP_REQUEST;
+ tlv_packet[0] = FR_EAP_REQUEST;
tlv_packet[1] = eap_session->this_round->response->id +1;
tlv_packet[2] = 0;
tlv_packet[3] = 11; /* length of this packet */
- tlv_packet[4] = PW_EAP_TLV;
+ tlv_packet[4] = FR_EAP_TLV;
tlv_packet[5] = 0x80;
tlv_packet[6] = EAP_TLV_ACK_RESULT;
tlv_packet[7] = 0;
RDEBUG2("SUCCESS");
- tlv_packet[0] = PW_EAP_REQUEST;
+ tlv_packet[0] = FR_EAP_REQUEST;
tlv_packet[1] = eap_session->this_round->response->id +1;
tlv_packet[2] = 0;
tlv_packet[3] = 11; /* length of this packet */
- tlv_packet[4] = PW_EAP_TLV;
+ tlv_packet[4] = FR_EAP_TLV;
tlv_packet[5] = 0x80; /* mandatory AVP */
tlv_packet[6] = EAP_TLV_ACK_RESULT;
tlv_packet[7] = 0;
{
eap_packet_raw_t eap_packet;
- eap_packet.code = PW_EAP_REQUEST;
+ eap_packet.code = FR_EAP_REQUEST;
eap_packet.id = eap_session->this_round->response->id + 1;
eap_packet.length[0] = 0;
eap_packet.length[1] = EAP_HEADER_LEN + 1;
- eap_packet.data[0] = PW_EAP_IDENTITY;
+ eap_packet.data[0] = FR_EAP_IDENTITY;
(tls_session->record_from_buff)(&tls_session->clean_in, &eap_packet, sizeof(eap_packet));
tls_session_send(eap_session->request, tls_session);
int rv;
vp = fr_pair_make(packet, &packet->vps, "SoH-Supported", "no", T_OP_EQ);
- if (data && data[0] == PW_EAP_NAK) {
+ if (data && data[0] == FR_EAP_NAK) {
RDEBUG("SoH - client NAKed");
return;
}
* No data, OR only 1 byte of EAP type.
*/
if (!data || (data_len == 0) ||
- ((data_len <= 1) && (data[0] != PW_EAP_IDENTITY))) {
+ ((data_len <= 1) && (data[0] != FR_EAP_IDENTITY))) {
return 0;
}
eap_method = *data;
switch (eap_method) {
- case PW_EAP_IDENTITY:
+ case FR_EAP_IDENTITY:
RDEBUG2("Received EAP-Identity-Response");
return 1;
* EAP-Response, and the EAP data is a TLV,
* then it looks OK...
*/
- case PW_EAP_RESPONSE:
- if (eap_packet->data[0] == PW_EAP_TLV) {
+ case FR_EAP_RESPONSE:
+ if (eap_packet->data[0] == FR_EAP_TLV) {
RDEBUG2("Received EAP-TLV response");
return 1;
}
* We normally do Microsoft MS-CHAPv2 (26), versus
* Cisco MS-CHAPv2 (29).
*/
- case PW_EAP_MSCHAPV2:
+ case FR_EAP_MSCHAPV2:
default:
RDEBUG2("EAP method %s (%d)", eap_type2name(eap_method), eap_method);
return 1;
if (data_len > 65535) return NULL; /* paranoia */
- vp = fr_pair_afrom_num(packet, 0, PW_EAP_MESSAGE);
+ vp = fr_pair_afrom_num(packet, 0, FR_EAP_MESSAGE);
if (!vp) {
return NULL;
}
* Hand-build an EAP packet from the crap in PEAP version 0.
*/
p = talloc_array(vp, uint8_t, EAP_HEADER_LEN + total);
- p[0] = PW_EAP_RESPONSE;
+ p[0] = FR_EAP_RESPONSE;
p[1] = eap_round->response->id;
p[2] = (data_len + EAP_HEADER_LEN) >> 8;
p[3] = (data_len + EAP_HEADER_LEN) & 0xff;
fr_pair_cursor_init(&cursor, &head);
fr_pair_cursor_append(&cursor, vp);
while (total < data_len) {
- vp = fr_pair_afrom_num(packet, 0, PW_EAP_MESSAGE);
+ vp = fr_pair_afrom_num(packet, 0, FR_EAP_MESSAGE);
if (!vp) {
fr_pair_list_free(&head);
return NULL;
/*
* Look for success or failure.
*/
- if ((eap_packet->code == PW_EAP_RESPONSE) &&
- (eap_packet->data[0] == PW_EAP_TLV)) {
+ if ((eap_packet->code == FR_EAP_RESPONSE) &&
+ (eap_packet->data[0] == FR_EAP_TLV)) {
if (data[10] == EAP_TLV_SUCCESS) {
return 1;
}
}
switch (reply->code) {
- case PW_CODE_ACCESS_ACCEPT:
+ case FR_CODE_ACCESS_ACCEPT:
RDEBUG2("Tunneled authentication was successful");
t->status = PEAP_STATUS_SENT_TLV_SUCCESS;
eap_peap_success(eap_session, tls_session);
rcode = RLM_MODULE_HANDLED;
break;
- case PW_CODE_ACCESS_REJECT:
+ case FR_CODE_ACCESS_REJECT:
RDEBUG2("Tunneled authentication was rejected");
t->status = PEAP_STATUS_SENT_TLV_FAILURE;
eap_peap_failure(eap_session, tls_session);
rcode = RLM_MODULE_HANDLED;
break;
- case PW_CODE_ACCESS_CHALLENGE:
+ case FR_CODE_ACCESS_CHALLENGE:
RDEBUG2("Got tunneled Access-Challenge");
/*
* Access-Challenge is ignored.
*/
vp = NULL;
- fr_pair_list_mcopy_by_num(t, &vp, &reply->vps, 0, PW_EAP_MESSAGE, TAG_ANY);
+ fr_pair_list_mcopy_by_num(t, &vp, &reply->vps, 0, FR_EAP_MESSAGE, TAG_ANY);
/*
* Handle the ACK, by tunneling any necessary reply
/*
* Do the callback, if it exists, and if it was a success.
*/
- if (fake && (eap_session->request->proxy->reply->code == PW_CODE_ACCESS_ACCEPT)) {
+ if (fake && (eap_session->request->proxy->reply->code == FR_CODE_ACCESS_ACCEPT)) {
peap_tunnel_t *t = tls_session->opaque;
t->home_access_accept = true;
case RLM_MODULE_HANDLED:
RDEBUG2("Reply was handled");
eap_tls_request(eap_session);
- request->proxy->reply->code = PW_CODE_ACCESS_CHALLENGE;
+ request->proxy->reply->code = FR_CODE_ACCESS_CHALLENGE;
return 1;
case RLM_MODULE_OK:
case PEAP_STATUS_INNER_IDENTITY_REQ_SENT:
/* we're expecting an identity response */
- if (data[0] != PW_EAP_IDENTITY) {
+ if (data[0] != FR_EAP_IDENTITY) {
REDEBUG("Expected EAP-Identity, got something else");
rcode = RLM_MODULE_REJECT;
goto finish;
RDEBUG("Sending SoH request to server %s", fake->server ? fake->server : "NULL");
rad_virtual_server(fake);
- if (fake->reply->code != PW_CODE_ACCESS_ACCEPT) {
+ if (fake->reply->code != FR_CODE_ACCESS_ACCEPT) {
RDEBUG2("SoH was rejected");
TALLOC_FREE(fake);
t->status = PEAP_STATUS_SENT_TLV_FAILURE;
t->status = PEAP_STATUS_PHASE2;
- vp = fr_pair_afrom_num(fake->packet, 0, PW_EAP_MESSAGE);
+ vp = fr_pair_afrom_num(fake->packet, 0, FR_EAP_MESSAGE);
q = talloc_array(vp, uint8_t, len);
- q[0] = PW_EAP_RESPONSE;
+ q[0] = FR_EAP_RESPONSE;
q[1] = eap_round->response->id;
q[2] = (len >> 8) & 0xff;
q[3] = len & 0xff;
- q[4] = PW_EAP_IDENTITY;
+ q[4] = FR_EAP_IDENTITY;
memcpy(q + EAP_HEADER_LEN + 1,
t->username->vp_strvalue, t->username->vp_length);
* so we add one here, by pulling it out of the
* EAP-Identity packet.
*/
- if ((data[0] == PW_EAP_IDENTITY) && (data_len > 1)) {
+ if ((data[0] == FR_EAP_IDENTITY) && (data_len > 1)) {
t->username = fr_pair_make(t, NULL, "User-Name", NULL, T_OP_EQ);
rad_assert(t->username != NULL);
t->username->vp_tainted = true;
switch (fake->reply->code) {
case 0: /* No reply code, must be proxied... */
#ifdef WITH_PROXY
- vp = fr_pair_find_by_num(fake->control, 0, PW_PROXY_TO_REALM, TAG_ANY);
+ vp = fr_pair_find_by_num(fake->control, 0, FR_PROXY_TO_REALM, TAG_ANY);
if (vp) {
eap_tunnel_data_t *tunnel;
/*
* Authentication succeeded! Rah!
*/
- fake->reply->code = PW_CODE_ACCESS_ACCEPT;
+ fake->reply->code = FR_CODE_ACCESS_ACCEPT;
goto do_process;
}
* EAP-Message into another set
* of attributes.
*/
- fr_pair_delete_by_num(&fake->packet->vps, 0, PW_EAP_MESSAGE, TAG_ANY);
+ fr_pair_delete_by_num(&fake->packet->vps, 0, FR_EAP_MESSAGE, TAG_ANY);
}
RDEBUG2("Tunnelled authentication will be proxied to %s", vp->vp_strvalue);
* Tell the original request that it's going
* to be proxied.
*/
- fr_pair_list_mcopy_by_num(request, &request->control, &fake->control, 0, PW_PROXY_TO_REALM,
+ fr_pair_list_mcopy_by_num(request, &request->control, &fake->control, 0, FR_PROXY_TO_REALM,
TAG_ANY);
/*
* EAP-TLS-Require-Client-Cert attribute will override
* the require_client_cert configuration option.
*/
- vp = fr_pair_find_by_num(eap_session->request->control, 0, PW_EAP_TLS_REQUIRE_CLIENT_CERT, TAG_ANY);
+ vp = fr_pair_find_by_num(eap_session->request->control, 0, FR_EAP_TLS_REQUIRE_CLIENT_CERT, TAG_ANY);
if (vp) {
client_cert = vp->vp_uint32 ? true : false;
} else {
*/
if (!inst->inner_eap_module) inst->inner_eap_module = "eap";
- dv = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, PW_AUTH_TYPE), inst->inner_eap_module);
+ dv = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, FR_AUTH_TYPE), inst->inner_eap_module);
if (!dv) {
WARN("Failed to find 'Auth-Type %s' section in virtual server %s. "
"The server cannot proxy inner-tunnel EAP packets",
* first compute the session-id = TypeCode | H(ciphersuite | scal_p |
* scal_s)
*/
- session_id[0] = PW_EAP_PWD;
+ session_id[0] = FR_EAP_PWD;
HMAC_Init_ex(hmac_ctx, allzero, SHA256_DIGEST_LENGTH, EVP_sha256(), NULL);
HMAC_Update(hmac_ctx, (uint8_t *)&session->ciphersuite, sizeof(session->ciphersuite));
offset = BN_num_bytes(session->order) - BN_num_bytes(session->peer_scalar);
len = (session->out_len - session->out_pos) + sizeof(pwd_hdr);
rad_assert(len > 0);
- eap_round->request->code = PW_EAP_REQUEST;
- eap_round->request->type.num = PW_EAP_PWD;
+ eap_round->request->code = FR_EAP_REQUEST;
+ eap_round->request->type.num = FR_EAP_PWD;
eap_round->request->type.length = (len > session->mtu) ? session->mtu : len;
eap_round->request->type.data = talloc_zero_array(eap_round->request, uint8_t, eap_round->request->type.length);
hdr = (pwd_hdr *)eap_round->request->type.data;
* send back an ACK for this fragment
*/
exch = EAP_PWD_GET_EXCHANGE(hdr);
- eap_round->request->code = PW_EAP_REQUEST;
- eap_round->request->type.num = PW_EAP_PWD;
+ eap_round->request->code = FR_EAP_REQUEST;
+ eap_round->request->type.num = FR_EAP_PWD;
eap_round->request->type.length = sizeof(pwd_hdr);
MEM(eap_round->request->type.data = talloc_array(eap_round->request, uint8_t, sizeof(pwd_hdr)));
memcpy(session->peer_id, packet->identity, session->peer_id_len);
session->peer_id[session->peer_id_len] = '\0';
- vp = fr_pair_find_by_num(request->control, 0, PW_CLEARTEXT_PASSWORD, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_CLEARTEXT_PASSWORD, TAG_ANY);
if (!vp) {
REDEBUG("Failed to find password for %s to do pwd authentication", session->peer_id);
return RLM_MODULE_REJECT;
REDEBUG("Failed generating (E)MSK");
return RLM_MODULE_FAIL;
}
- eap_round->request->code = PW_EAP_SUCCESS;
+ eap_round->request->code = FR_EAP_SUCCESS;
/*
* Return the MSK (in halves).
* The admin can dynamically change the MTU.
*/
session->mtu = inst->fragment_size;
- vp = fr_pair_find_by_num(eap_session->request->packet->vps, 0, PW_FRAMED_MTU, TAG_ANY);
+ vp = fr_pair_find_by_num(eap_session->request->packet->vps, 0, FR_FRAMED_MTU, TAG_ANY);
/*
* session->mtu is *our* MTU. We need to subtract off the EAP
/* we will set the ID on requests, since we have to HMAC it */
eap_session->this_round->set_request_id = true;
- return fr_sim_encode(eap_session->request, dict_sim_root, PW_EAP_SIM,
+ return fr_sim_encode(eap_session->request, dict_sim_root, FR_EAP_SIM,
eap_session->request->reply->vps, eap_session->this_round->request,
eap_sim_session->keys.gsm.nonce_mt, sizeof(eap_sim_session->keys.gsm.nonce_mt));
}
words[1] = htons(EAP_SIM_VERSION);
words[2] = 0;
- newvp = fr_pair_afrom_child_num(packet, dict_sim_root, PW_EAP_SIM_VERSION_LIST);
+ newvp = fr_pair_afrom_child_num(packet, dict_sim_root, FR_EAP_SIM_VERSION_LIST);
fr_pair_value_memcpy(newvp, (uint8_t const *) words, sizeof(words));
fr_pair_add(vps, newvp);
/* set the EAP_ID - new value */
- newvp = fr_pair_afrom_child_num(packet, fr_dict_root(fr_dict_internal), PW_EAP_ID);
+ newvp = fr_pair_afrom_child_num(packet, fr_dict_root(fr_dict_internal), FR_EAP_ID);
newvp->vp_uint32 = eap_sim_session->sim_id++;
fr_pair_replace(vps, newvp);
memcpy(eap_sim_session->keys.gsm.version_list, words + 1, eap_sim_session->keys.gsm.version_list_len);
/* the ANY_ID attribute. We do not support re-auth or pseudonym */
- MEM(newvp = fr_pair_afrom_child_num(packet, dict_sim_root, PW_EAP_SIM_FULLAUTH_ID_REQ));
+ MEM(newvp = fr_pair_afrom_child_num(packet, dict_sim_root, FR_EAP_SIM_FULLAUTH_ID_REQ));
MEM(p = talloc_array(newvp, uint8_t, 2));
p[0] = 0;
p[1] = 1;
fr_pair_add(vps, newvp);
/* the SUBTYPE, set to start. */
- newvp = fr_pair_afrom_child_num(packet, dict_sim_root, PW_EAP_SIM_SUBTYPE);
+ newvp = fr_pair_afrom_child_num(packet, dict_sim_root, FR_EAP_SIM_SUBTYPE);
newvp->vp_uint32 = EAP_SIM_START;
fr_pair_replace(vps, newvp);
*
* Challenges will come from one of three places eventually:
*
- * 1 from attributes like PW_EAP_SIM_RANDx
+ * 1 from attributes like FR_EAP_SIM_RANDx
* (these might be retrieved from a database)
*
* 2 from internally implemented SIM authenticators
/*
* Okay, we got the challenges! Put them into an attribute.
*/
- MEM(vp = fr_pair_afrom_child_num(packet, dict_sim_root, PW_EAP_SIM_RAND));
+ MEM(vp = fr_pair_afrom_child_num(packet, dict_sim_root, FR_EAP_SIM_RAND));
MEM(p = rand = talloc_array(vp, uint8_t, 2 + (SIM_VECTOR_GSM_RAND_SIZE * 3)));
memset(p, 0, 2); /* clear reserved bytes */
p += 2;
/*
* Set the EAP_ID - new value
*/
- vp = fr_pair_afrom_child_num(packet, fr_dict_root(fr_dict_internal), PW_EAP_ID);
+ vp = fr_pair_afrom_child_num(packet, fr_dict_root(fr_dict_internal), FR_EAP_ID);
vp->vp_uint32 = eap_sim_session->sim_id++;
fr_pair_replace(to_client, vp);
/*
* Use the SIM identity, if available
*/
- vp = fr_pair_find_by_child_num(*from_client, dict_sim_root, PW_EAP_SIM_IDENTITY, TAG_ANY);
+ vp = fr_pair_find_by_child_num(*from_client, dict_sim_root, FR_EAP_SIM_IDENTITY, TAG_ANY);
if (vp) {
MEM(eap_sim_session->keys.identity = (uint8_t *)talloc_bstrndup(eap_sim_session,
vp->vp_strvalue, vp->vp_length));
* Need to include an AT_MAC attribute so that it will get
* calculated.
*/
- vp = fr_pair_afrom_child_num(packet, dict_sim_root, PW_EAP_SIM_MAC);
+ vp = fr_pair_afrom_child_num(packet, dict_sim_root, FR_EAP_SIM_MAC);
fr_pair_value_memcpy(vp, hmac_zero, sizeof(hmac_zero));
fr_pair_replace(to_client, vp);
- vp = fr_pair_afrom_child_num(packet, dict_sim_root, PW_EAP_SIM_KEY);
+ vp = fr_pair_afrom_child_num(packet, dict_sim_root, FR_EAP_SIM_KEY);
fr_pair_value_memcpy(vp, eap_sim_session->keys.k_aut, 16);
fr_pair_replace(to_client, vp);
/*
* Set subtype to challenge.
*/
- vp = fr_pair_afrom_child_num(packet, dict_sim_root, PW_EAP_SIM_SUBTYPE);
+ vp = fr_pair_afrom_child_num(packet, dict_sim_root, FR_EAP_SIM_SUBTYPE);
vp->vp_uint32 = EAP_SIM_CHALLENGE;
fr_pair_replace(to_client, vp);
VALUE_PAIR *vp;
RADIUS_PACKET *packet;
- eap_session->this_round->request->code = PW_EAP_SUCCESS;
+ eap_session->this_round->request->code = FR_EAP_SUCCESS;
eap_session->finished = true;
/* to_client is the data to the client. */
eap_sim_session = talloc_get_type_abort(eap_session->opaque, eap_sim_session_t);
/* set the EAP_ID - new value */
- vp = fr_pair_afrom_child_num(packet, fr_dict_root(fr_dict_internal), PW_EAP_ID);
+ vp = fr_pair_afrom_child_num(packet, fr_dict_root(fr_dict_internal), FR_EAP_ID);
vp->vp_uint32 = eap_sim_session->sim_id++;
fr_pair_replace(&eap_session->request->reply->vps, vp);
eap_sim_session = talloc_get_type_abort(eap_session->opaque, eap_sim_session_t);
- nonce_vp = fr_pair_find_by_child_num(vps, dict_sim_root, PW_EAP_SIM_NONCE_MT, TAG_ANY);
- selected_version_vp = fr_pair_find_by_child_num(vps, dict_sim_root, PW_EAP_SIM_SELECTED_VERSION, TAG_ANY);
+ nonce_vp = fr_pair_find_by_child_num(vps, dict_sim_root, FR_EAP_SIM_NONCE_MT, TAG_ANY);
+ selected_version_vp = fr_pair_find_by_child_num(vps, dict_sim_root, FR_EAP_SIM_SELECTED_VERSION, TAG_ANY);
if (!nonce_vp || !selected_version_vp) {
RDEBUG2("Client did not select a version and send a NONCE");
eap_sim_state_enter(eap_session, eap_sim_session, EAP_SIM_SERVER_START);
/*
* See what kind of message we have gotten
*/
- vp = fr_pair_find_by_child_num(vps, dict_sim_root, PW_EAP_SIM_SUBTYPE, TAG_ANY);
+ vp = fr_pair_find_by_child_num(vps, dict_sim_root, FR_EAP_SIM_SUBTYPE, TAG_ANY);
if (!vp) {
REDEBUG2("No subtype attribute was created, message dropped");
return 0;
fr_dict_attr_t const *da;
CONF_SECTION *subcs;
- da = fr_dict_attr_child_by_num(dict_sim_root, PW_EAP_SIM_SUBTYPE);
+ da = fr_dict_attr_child_by_num(dict_sim_root, FR_EAP_SIM_SUBTYPE);
if (!da) {
cf_log_err_cs(cs, "Failed to find EAP-Sim-Subtype attribute");
return -1;
static int mod_load(void)
{
- dict_sim_root = fr_dict_attr_child_by_num(fr_dict_root(fr_dict_internal), PW_EAP_SIM_ROOT);
+ dict_sim_root = fr_dict_attr_child_by_num(fr_dict_root(fr_dict_internal), FR_EAP_SIM_ROOT);
if (!dict_sim_root) {
ERROR("Missing EAP-SIM-Root attribute");
return -1;
fake->packet->vps = fr_pair_list_copy(fake->packet, request->packet->vps);
/* set the virtual server to use */
- if ((vp = fr_pair_find_by_num(request->control, 0, PW_VIRTUAL_SERVER, TAG_ANY)) != NULL) {
+ if ((vp = fr_pair_find_by_num(request->control, 0, FR_VIRTUAL_SERVER, TAG_ANY)) != NULL) {
fake->server = vp->vp_strvalue;
} else {
fake->server = inst->virtual_server;
TAG_ANY);
/* reject if virtual server didn't return accept */
- if (fake->reply->code != PW_CODE_ACCESS_ACCEPT) {
+ if (fake->reply->code != FR_CODE_ACCESS_ACCEPT) {
RDEBUG2("Certificate rejected by the virtual server");
talloc_free(fake);
eap_tls_fail(eap_session);
* EAP-TLS-Require-Client-Cert attribute will override
* the require_client_cert configuration option.
*/
- vp = fr_pair_find_by_num(eap_session->request->control, 0, PW_EAP_TLS_REQUIRE_CLIENT_CERT, TAG_ANY);
+ vp = fr_pair_find_by_num(eap_session->request->control, 0, FR_EAP_TLS_REQUIRE_CLIENT_CERT, TAG_ANY);
if (vp) {
client_cert = vp->vp_uint32 ? true : false;
} else {
/*
* Process the TTLS portion of an EAP-TTLS request.
*/
-PW_CODE eap_ttls_process(eap_session_t *eap_session, tls_session_t *tls_session) CC_HINT(nonnull);
+FR_CODE eap_ttls_process(eap_session_t *eap_session, tls_session_t *tls_session) CC_HINT(nonnull);
#endif /* _EAP_TTLS_H */
*/
rcode = eap_ttls_process(eap_session, tls_session);
switch (rcode) {
- case PW_CODE_ACCESS_REJECT:
+ case FR_CODE_ACCESS_REJECT:
eap_tls_fail(eap_session);
return RLM_MODULE_REJECT;
/*
* Access-Challenge, continue tunneled conversation.
*/
- case PW_CODE_ACCESS_CHALLENGE:
+ case FR_CODE_ACCESS_CHALLENGE:
eap_tls_request(eap_session);
return RLM_MODULE_OK;
/*
* Success: Automatically return MPPE keys.
*/
- case PW_CODE_ACCESS_ACCEPT:
+ case FR_CODE_ACCESS_ACCEPT:
if (eap_tls_success(eap_session) < 0) return 0;
return RLM_MODULE_OK;
* that the request now has a "proxy" packet, and
* will proxy it, rather than returning an EAP packet.
*/
- case PW_CODE_STATUS_CLIENT:
+ case FR_CODE_STATUS_CLIENT:
#ifdef WITH_PROXY
rad_assert(eap_session->request->proxy != NULL);
#endif
* EAP-TLS-Require-Client-Cert attribute will override
* the require_client_cert configuration option.
*/
- vp = fr_pair_find_by_num(eap_session->request->control, 0, PW_EAP_TLS_REQUIRE_CLIENT_CERT, TAG_ANY);
+ vp = fr_pair_find_by_num(eap_session->request->control, 0, FR_EAP_TLS_REQUIRE_CLIENT_CERT, TAG_ANY);
if (vp) {
client_cert = vp->vp_uint32 ? true : false;
} else {
VALUE_PAIR *vp = NULL;
fr_dict_attr_t const *vendor_root = fr_dict_attr_child_by_num(fr_dict_root(fr_dict_internal),
- PW_VENDOR_SPECIFIC);
+ FR_VENDOR_SPECIFIC);
SSL *ssl = decoder_ctx;
while (p < end) {
p += 4;
value_len -= 4; /* -= 4 for the vendor ID field */
- our_parent = fr_dict_vendor_attr_by_num(fr_dict_internal, PW_VENDOR_SPECIFIC, vendor);
+ our_parent = fr_dict_vendor_attr_by_num(fr_dict_internal, FR_VENDOR_SPECIFIC, vendor);
if (!our_parent) {
if (flags & FR_DIAMETER_AVP_FLAG_MANDATORY) {
fr_strerror_printf("Mandatory bit set and no vendor %u found", vendor);
* challenge) But if the client gets the challenge correct,
* we're not too worried about the Id.
*/
- if (((vp->da->vendor == 0) && (vp->da->attr == PW_CHAP_CHALLENGE)) ||
- ((vp->da->vendor == VENDORPEC_MICROSOFT) && (vp->da->attr == PW_MSCHAP_CHALLENGE))) {
+ if (((vp->da->vendor == 0) && (vp->da->attr == FR_CHAP_CHALLENGE)) ||
+ ((vp->da->vendor == VENDORPEC_MICROSOFT) && (vp->da->attr == FR_MSCHAP_CHALLENGE))) {
uint8_t challenge[16];
uint8_t scratch[16];
* NOT 'eap start', so we should check for that....
*/
switch (reply->code) {
- case PW_CODE_ACCESS_ACCEPT:
+ case FR_CODE_ACCESS_ACCEPT:
{
RDEBUG("Got tunneled Access-Accept");
vp = fr_pair_cursor_next(&cursor)) {
switch (vp->da->vendor) {
case VENDORPEC_MICROSOFT:
- if (vp->da->attr == PW_MSCHAP2_SUCCESS) {
+ if (vp->da->attr == FR_MSCHAP2_SUCCESS) {
RDEBUG("Got MS-CHAP2-Success, tunneling it to the client in a challenge");
rcode = RLM_MODULE_HANDLED;
break;
case VENDORPEC_UKERNA:
- if (vp->da->attr == PW_UKERNA_CHBIND) {
+ if (vp->da->attr == FR_UKERNA_CHBIND) {
rcode = RLM_MODULE_HANDLED;
t->authenticated = true;
fr_pair_cursor_prepend(&to_tunnel, fr_pair_copy(tls_session, vp));
break;
- case PW_CODE_ACCESS_REJECT:
+ case FR_CODE_ACCESS_REJECT:
RDEBUG("Got tunneled Access-Reject");
rcode = RLM_MODULE_REJECT;
break;
* an Access-Challenge means that we MUST tunnel
* a Reply-Message to the client.
*/
- case PW_CODE_ACCESS_CHALLENGE:
+ case FR_CODE_ACCESS_CHALLENGE:
RDEBUG("Got tunneled Access-Challenge");
fr_pair_cursor_init(&to_tunnel, &tunnel_vps);
vp = fr_pair_cursor_next(&cursor)) {
switch (vp->da->vendor) {
case VENDORPEC_UKERNA:
- if (vp->da->attr == PW_UKERNA_CHBIND) {
+ if (vp->da->attr == FR_UKERNA_CHBIND) {
fr_pair_cursor_prepend(&to_tunnel, fr_pair_copy(tls_session, vp));
}
break;
case 0:
switch (vp->da->attr) {
- case PW_EAP_MESSAGE:
- case PW_REPLY_MESSAGE:
+ case FR_EAP_MESSAGE:
+ case FR_REPLY_MESSAGE:
fr_pair_cursor_prepend(&to_tunnel, fr_pair_copy(tls_session, vp));
break;
/*
* Do the callback, if it exists, and if it was a success.
*/
- if (fake && (eap_session->request->proxy->reply->code == PW_CODE_ACCESS_ACCEPT)) {
+ if (fake && (eap_session->request->proxy->reply->code == FR_CODE_ACCESS_ACCEPT)) {
/*
* Terrible hacks.
*/
case RLM_MODULE_HANDLED:
RDEBUG("Reply was handled");
eap_tls_request(eap_session);
- request->proxy->reply->code = PW_CODE_ACCESS_CHALLENGE;
+ request->proxy->reply->code = FR_CODE_ACCESS_CHALLENGE;
return 1;
case RLM_MODULE_OK:
/*
* Process the "diameter" contents of the tunneled data.
*/
-PW_CODE eap_ttls_process(eap_session_t *eap_session, tls_session_t *tls_session)
+FR_CODE eap_ttls_process(eap_session_t *eap_session, tls_session_t *tls_session)
{
- PW_CODE code = PW_CODE_ACCESS_REJECT;
+ FR_CODE code = FR_CODE_ACCESS_REJECT;
rlm_rcode_t rcode;
REQUEST *fake = NULL;
VALUE_PAIR *vp = NULL;
if (data_len == 0) {
if (t->authenticated) {
RDEBUG("Got ACK, and the user was already authenticated");
- code = PW_CODE_ACCESS_ACCEPT;
+ code = FR_CODE_ACCESS_ACCEPT;
goto finish;
} /* else no session, no data, die. */
* wrong.
*/
RDEBUG2("SSL_read Error");
- code = PW_CODE_ACCESS_REJECT;
+ code = FR_CODE_ACCESS_REJECT;
goto finish;
}
if (!diameter_verify(request, data, data_len)) {
- code = PW_CODE_ACCESS_REJECT;
+ code = FR_CODE_ACCESS_REJECT;
goto finish;
}
if (eap_ttls_decode_pair(fake->packet, &cursor, fr_dict_root(fr_dict_internal),
data, data_len, tls_session->ssl) < 0) {
RPEDEBUG("Decoding TTLS TLVs failed");
- code = PW_CODE_ACCESS_REJECT;
+ code = FR_CODE_ACCESS_REJECT;
goto finish;
}
/*
* Update other items in the REQUEST data structure.
*/
- fake->username = fr_pair_find_by_num(fake->packet->vps, 0, PW_USER_NAME, TAG_ANY);
- fake->password = fr_pair_find_by_num(fake->packet->vps, 0, PW_USER_PASSWORD, TAG_ANY);
+ fake->username = fr_pair_find_by_num(fake->packet->vps, 0, FR_USER_NAME, TAG_ANY);
+ fake->password = fr_pair_find_by_num(fake->packet->vps, 0, FR_USER_PASSWORD, TAG_ANY);
/*
* No User-Name, try to create one from stored data.
* an EAP-Identity, and pull it out of there.
*/
if (!t->username) {
- vp = fr_pair_find_by_num(fake->packet->vps, 0, PW_EAP_MESSAGE, TAG_ANY);
+ vp = fr_pair_find_by_num(fake->packet->vps, 0, FR_EAP_MESSAGE, TAG_ANY);
if (vp &&
(vp->vp_length >= EAP_HEADER_LEN + 2) &&
- (vp->vp_strvalue[0] == PW_EAP_RESPONSE) &&
- (vp->vp_strvalue[EAP_HEADER_LEN] == PW_EAP_IDENTITY) &&
+ (vp->vp_strvalue[0] == FR_EAP_RESPONSE) &&
+ (vp->vp_strvalue[EAP_HEADER_LEN] == FR_EAP_IDENTITY) &&
(vp->vp_strvalue[EAP_HEADER_LEN + 1] != 0)) {
/*
* Create & remember a User-Name
if (t->username) {
vp = fr_pair_list_copy(fake->packet, t->username);
fr_pair_add(&fake->packet->vps, vp);
- fake->username = fr_pair_find_by_num(fake->packet->vps, 0, PW_USER_NAME, TAG_ANY);
+ fake->username = fr_pair_find_by_num(fake->packet->vps, 0, FR_USER_NAME, TAG_ANY);
}
} /* else the request ALREADY had a User-Name */
*/
chbind = eap_chbind_vp2packet(fake, fake->packet->vps);
if (chbind) {
- PW_CODE chbind_code;
+ FR_CODE chbind_code;
CHBIND_REQ *req = talloc_zero(fake, CHBIND_REQ);
RDEBUG("received chbind request");
/* clean up chbind req */
talloc_free(req);
- if (chbind_code != PW_CODE_ACCESS_ACCEPT) {
+ if (chbind_code != FR_CODE_ACCESS_ACCEPT) {
code = chbind_code;
goto finish;
}
switch (fake->reply->code) {
case 0: /* No reply code, must be proxied... */
#ifdef WITH_PROXY
- vp = fr_pair_find_by_num(fake->control, 0, PW_PROXY_TO_REALM, TAG_ANY);
+ vp = fr_pair_find_by_num(fake->control, 0, FR_PROXY_TO_REALM, TAG_ANY);
if (vp) {
int ret;
eap_tunnel_data_t *tunnel;
* Tell the original request that it's going
* to be proxied.
*/
- fr_pair_list_mcopy_by_num(request, &request->control, &fake->control, 0, PW_PROXY_TO_REALM,
+ fr_pair_list_mcopy_by_num(request, &request->control, &fake->control, 0, FR_PROXY_TO_REALM,
TAG_ANY);
/*
* Didn't authenticate the packet, but
* we're proxying it.
*/
- code = PW_CODE_STATUS_CLIENT;
+ code = FR_CODE_STATUS_CLIENT;
} else
#endif /* WITH_PROXY */
{
RDEBUG("No tunneled reply was found for request %" PRIu64 ", and the request was not "
"proxied: rejecting the user", request->number);
- code = PW_CODE_ACCESS_REJECT;
+ code = FR_CODE_ACCESS_REJECT;
}
break;
default:
/*
- * Returns RLM_MODULE_FOO, and we want to return PW_FOO
+ * Returns RLM_MODULE_FOO, and we want to return FR_FOO
*/
rcode = process_reply(eap_session, tls_session, request, fake->reply);
switch (rcode) {
case RLM_MODULE_REJECT:
- code = PW_CODE_ACCESS_REJECT;
+ code = FR_CODE_ACCESS_REJECT;
break;
case RLM_MODULE_HANDLED:
- code = PW_CODE_ACCESS_CHALLENGE;
+ code = FR_CODE_ACCESS_CHALLENGE;
break;
case RLM_MODULE_OK:
- code = PW_CODE_ACCESS_ACCEPT;
+ code = FR_CODE_ACCESS_ACCEPT;
break;
default:
- code = PW_CODE_ACCESS_REJECT;
+ code = FR_CODE_ACCESS_REJECT;
break;
}
break;
return -1;
}
- paircompare_register_byname("Example-Paircmp", fr_dict_attr_by_num(NULL, 0, PW_USER_NAME), false,
+ paircompare_register_byname("Example-Paircmp", fr_dict_attr_by_num(NULL, 0, FR_USER_NAME), false,
rlm_example_cmp, inst);
return 0;
/*
* Look for the 'state' attribute.
*/
- state = fr_pair_find_by_num(request->packet->vps, 0, PW_STATE, TAG_ANY);
+ state = fr_pair_find_by_num(request->packet->vps, 0, FR_STATE, TAG_ANY);
if (state != NULL) {
RDEBUG("Found reply to access challenge");
return RLM_MODULE_OK;
*
* The server will take care of sending it to the user.
*/
- request->reply->code = PW_CODE_ACCESS_CHALLENGE;
+ request->reply->code = FR_CODE_ACCESS_CHALLENGE;
RDEBUG("Sending Access-Challenge");
return RLM_MODULE_HANDLED;
} else {
fr_dict_enum_t *dval;
- dval = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, PW_PACKET_TYPE), inst->packet_type);
+ dval = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, FR_PACKET_TYPE), inst->packet_type);
if (!dval) {
cf_log_err_cs(conf, "Unknown packet type %s: See list of VALUEs for Packet-Type in "
"share/dictionary", inst->packet_type);
bool we_wait = false;
VALUE_PAIR *vp, *tmp;
- vp = fr_pair_find_by_num(request->reply->vps, 0, PW_EXEC_PROGRAM, TAG_ANY);
+ vp = fr_pair_find_by_num(request->reply->vps, 0, FR_EXEC_PROGRAM, TAG_ANY);
if (vp) {
we_wait = false;
- } else if ((vp = fr_pair_find_by_num(request->reply->vps, 0, PW_EXEC_PROGRAM_WAIT, TAG_ANY)) != NULL) {
+ } else if ((vp = fr_pair_find_by_num(request->reply->vps, 0, FR_EXEC_PROGRAM_WAIT, TAG_ANY)) != NULL) {
we_wait = true;
}
if (!vp) {
case RLM_MODULE_FAIL:
case RLM_MODULE_INVALID:
case RLM_MODULE_REJECT:
- request->reply->code = PW_CODE_ACCESS_REJECT;
+ request->reply->code = FR_CODE_ACCESS_REJECT;
break;
default:
return mod_exec_dispatch(instance, thread, request);
}
- vp = fr_pair_find_by_num(request->reply->vps, 0, PW_EXEC_PROGRAM, TAG_ANY);
+ vp = fr_pair_find_by_num(request->reply->vps, 0, FR_EXEC_PROGRAM, TAG_ANY);
if (vp) {
we_wait = true;
- } else if ((vp = fr_pair_find_by_num(request->reply->vps, 0, PW_EXEC_PROGRAM_WAIT, TAG_ANY)) != NULL) {
+ } else if ((vp = fr_pair_find_by_num(request->reply->vps, 0, FR_EXEC_PROGRAM_WAIT, TAG_ANY)) != NULL) {
we_wait = false;
}
if (!vp) {
{
VALUE_PAIR *vp, *check_item = NULL;
- check_item = fr_pair_find_by_num(request->control, 0, PW_EXPIRATION, TAG_ANY);
+ check_item = fr_pair_find_by_num(request->control, 0, FR_EXPIRATION, TAG_ANY);
if (check_item != NULL) {
char date[50];
/*
* Else the account hasn't expired, but it may do so
* in the future. Set Session-Timeout.
*/
- vp = fr_pair_find_by_num(request->reply->vps, 0, PW_SESSION_TIMEOUT, TAG_ANY);
+ vp = fr_pair_find_by_num(request->reply->vps, 0, FR_SESSION_TIMEOUT, TAG_ANY);
if (!vp) {
- vp = radius_pair_create(request->reply, &request->reply->vps, PW_SESSION_TIMEOUT, 0);
+ vp = radius_pair_create(request->reply, &request->reply->vps, FR_SESSION_TIMEOUT, 0);
vp->vp_date = (uint32_t) (((time_t) check_item->vp_date) - request->packet->timestamp.tv_sec);
} else if (vp->vp_date > ((uint32_t) (((time_t) check_item->vp_date) - request->packet->timestamp.tv_sec))) {
vp->vp_date = (uint32_t) (((time_t) check_item->vp_date) - request->packet->timestamp.tv_sec);
/*
* Register the expiration comparison operation.
*/
- paircompare_register(fr_dict_attr_by_num(NULL, 0, PW_EXPIRATION), NULL, false, expirecmp, instance);
+ paircompare_register(fr_dict_attr_by_num(NULL, 0, FR_EXPIRATION), NULL, false, expirecmp, instance);
return 0;
}
* Compare prefix/suffix.
*
* If they compare:
- * - if PW_STRIP_USER_NAME is present in check_pairs,
+ * - if FR_STRIP_USER_NAME is present in check_pairs,
* strip the username of prefix/suffix.
- * - if PW_STRIP_USER_NAME is not present in check_pairs,
- * add a PW_STRIPPED_USER_NAME to the request.
+ * - if FR_STRIP_USER_NAME is not present in check_pairs,
+ * add a FR_STRIPPED_USER_NAME to the request.
*/
static int presufcmp(UNUSED void *instance,
REQUEST *request,
len = strlen(check->vp_strvalue);
if (check->da->vendor == 0) switch (check->da->attr) {
- case PW_PREFIX:
+ case FR_PREFIX:
ret = strncmp(name, check->vp_strvalue, len);
if (ret == 0)
strlcpy(rest, name + len, sizeof(rest));
break;
- case PW_SUFFIX:
+ case FR_SUFFIX:
namelen = strlen(name);
if (namelen < len)
break;
/*
* If Strip-User-Name == No, then don't do any more.
*/
- vp = fr_pair_find_by_num(check_pairs, 0, PW_STRIP_USER_NAME, TAG_ANY);
+ vp = fr_pair_find_by_num(check_pairs, 0, FR_STRIP_USER_NAME, TAG_ANY);
if (vp && !vp->vp_uint32) return ret;
/*
* See where to put the stripped user name.
*/
- vp = fr_pair_find_by_num(check_pairs, 0, PW_STRIPPED_USER_NAME, TAG_ANY);
+ vp = fr_pair_find_by_num(check_pairs, 0, FR_STRIPPED_USER_NAME, TAG_ANY);
if (!vp) {
/*
* If "request" is NULL, then the memory will be
* lost!
*/
- vp = radius_pair_create(request->packet, &req, PW_STRIPPED_USER_NAME, 0);
+ vp = radius_pair_create(request->packet, &req, FR_STRIPPED_USER_NAME, 0);
if (!vp) return ret;
request->username = vp;
}
}
static int generic_attrs[] = {
- PW_CLIENT_IP_ADDRESS,
- PW_PACKET_SRC_IP_ADDRESS,
- PW_PACKET_DST_IP_ADDRESS,
- PW_PACKET_SRC_PORT,
- PW_PACKET_DST_PORT,
- PW_REQUEST_PROCESSING_STAGE,
- PW_PACKET_SRC_IPV6_ADDRESS,
- PW_PACKET_DST_IPV6_ADDRESS,
- PW_VIRTUAL_SERVER,
+ FR_CLIENT_IP_ADDRESS,
+ FR_PACKET_SRC_IP_ADDRESS,
+ FR_PACKET_DST_IP_ADDRESS,
+ FR_PACKET_SRC_PORT,
+ FR_PACKET_DST_PORT,
+ FR_REQUEST_PROCESSING_STAGE,
+ FR_PACKET_SRC_IPV6_ADDRESS,
+ FR_PACKET_DST_IPV6_ADDRESS,
+ FR_VIRTUAL_SERVER,
0
};
{
int i;
- paircompare_register(fr_dict_attr_by_num(NULL, 0, PW_PREFIX), fr_dict_attr_by_num(NULL, 0, PW_USER_NAME), false, presufcmp, instance);
- paircompare_register(fr_dict_attr_by_num(NULL, 0, PW_SUFFIX), fr_dict_attr_by_num(NULL, 0, PW_USER_NAME), false, presufcmp, instance);
- paircompare_register(fr_dict_attr_by_num(NULL, 0, PW_CONNECT_RATE), fr_dict_attr_by_num(NULL, 0,
- PW_CONNECT_INFO),
+ paircompare_register(fr_dict_attr_by_num(NULL, 0, FR_PREFIX), fr_dict_attr_by_num(NULL, 0, FR_USER_NAME), false, presufcmp, instance);
+ paircompare_register(fr_dict_attr_by_num(NULL, 0, FR_SUFFIX), fr_dict_attr_by_num(NULL, 0, FR_USER_NAME), false, presufcmp, instance);
+ paircompare_register(fr_dict_attr_by_num(NULL, 0, FR_CONNECT_RATE), fr_dict_attr_by_num(NULL, 0,
+ FR_CONNECT_INFO),
false, connectcmp, instance);
- paircompare_register(fr_dict_attr_by_num(NULL, 0, PW_PACKET_TYPE), NULL, true, packetcmp, instance);
- paircompare_register(fr_dict_attr_by_num(NULL, 0, PW_RESPONSE_PACKET_TYPE), NULL, true, responsecmp, instance);
+ paircompare_register(fr_dict_attr_by_num(NULL, 0, FR_PACKET_TYPE), NULL, true, packetcmp, instance);
+ paircompare_register(fr_dict_attr_by_num(NULL, 0, FR_RESPONSE_PACKET_TYPE), NULL, true, responsecmp, instance);
for (i = 0; generic_attrs[i] != 0; i++) {
paircompare_register(fr_dict_attr_by_num(NULL, 0, generic_attrs[i]), NULL, true, genericcmp, instance);
static int fall_through(VALUE_PAIR *vp)
{
VALUE_PAIR *tmp;
- tmp = fr_pair_find_by_num(vp, 0, PW_FALL_THROUGH, TAG_ANY);
+ tmp = fr_pair_find_by_num(vp, 0, FR_FALL_THROUGH, TAG_ANY);
return tmp ? tmp->vp_uint32 : 0;
}
/*
* Remove server internal parameters.
*/
- fr_pair_delete_by_num(&reply_packet->vps, 0, PW_FALL_THROUGH, TAG_ANY);
+ fr_pair_delete_by_num(&reply_packet->vps, 0, FR_FALL_THROUGH, TAG_ANY);
/*
* See if we succeeded.
* Ensure that we're being passed a plain-text password,
* and not anything else.
*/
- if (request->password->da->attr != PW_USER_PASSWORD) {
+ if (request->password->da->attr != FR_USER_PASSWORD) {
REDEBUG("Attribute \"User-Password\" is required for authentication. Cannot use \"%s\".",
request->password->da->name);
}
if (!request->password ||
- (request->password->da->attr != PW_USER_PASSWORD)) {
+ (request->password->da->attr != FR_USER_PASSWORD)) {
RWDEBUG("You have set \"Auth-Type := LDAP\" somewhere");
RWDEBUG("*********************************************");
RWDEBUG("* THAT CONFIGURATION IS WRONG. DELETE IT. ");
/*
* We already have a Cleartext-Password. Skip edir.
*/
- if (fr_pair_find_by_num(request->control, 0, PW_CLEARTEXT_PASSWORD, TAG_ANY)) {
+ if (fr_pair_find_by_num(request->control, 0, FR_CLEARTEXT_PASSWORD, TAG_ANY)) {
goto skip_edir;
}
/*
* Add Cleartext-Password attribute to the request
*/
- vp = radius_pair_create(request, &request->control, PW_CLEARTEXT_PASSWORD, 0);
+ vp = radius_pair_create(request, &request->control, FR_CLEARTEXT_PASSWORD, 0);
fr_pair_value_bstrncpy(vp, password, pass_size);
if (RDEBUG_ENABLED3) {
group_attribute = "LDAP-Group";
}
- if (paircompare_register_byname(group_attribute, fr_dict_attr_by_num(NULL, 0, PW_USER_NAME),
+ if (paircompare_register_byname(group_attribute, fr_dict_attr_by_num(NULL, 0, FR_USER_NAME),
false, rlm_ldap_groupcmp, inst) < 0) {
PERROR("Error registering group comparison");
goto error;
* If the caller isn't looking for the result we can just return the current userdn value.
*/
if (!force) {
- vp = fr_pair_find_by_num(request->control, 0, PW_LDAP_USERDN, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_LDAP_USERDN, TAG_ANY);
if (vp) {
RDEBUG("Using user DN from request \"%s\"", vp->vp_strvalue);
*rcode = RLM_MODULE_OK;
*/
if (!inst->expect_password || (rad_debug_lvl < L_DBG_LVL_2)) return;
- if (!fr_pair_find_by_num(request->control, 0, PW_CLEARTEXT_PASSWORD, TAG_ANY) &&
- !fr_pair_find_by_num(request->control, 0, PW_NT_PASSWORD, TAG_ANY) &&
- !fr_pair_find_by_num(request->control, 0, PW_USER_PASSWORD, TAG_ANY) &&
- !fr_pair_find_by_num(request->control, 0, PW_PASSWORD_WITH_HEADER, TAG_ANY) &&
- !fr_pair_find_by_num(request->control, 0, PW_CRYPT_PASSWORD, TAG_ANY)) {
+ if (!fr_pair_find_by_num(request->control, 0, FR_CLEARTEXT_PASSWORD, TAG_ANY) &&
+ !fr_pair_find_by_num(request->control, 0, FR_NT_PASSWORD, TAG_ANY) &&
+ !fr_pair_find_by_num(request->control, 0, FR_USER_PASSWORD, TAG_ANY) &&
+ !fr_pair_find_by_num(request->control, 0, FR_PASSWORD_WITH_HEADER, TAG_ANY) &&
+ !fr_pair_find_by_num(request->control, 0, FR_CRYPT_PASSWORD, TAG_ANY)) {
switch (conn->directory->type) {
case FR_LDAP_DIRECTORY_ACTIVE_DIRECTORY:
RWDEBUG("!!! Found map between LDAP attribute and a FreeRADIUS password attribute");
VALUE_PAIR *ends, *timeout;
int left;
- ends = fr_pair_find_by_num(request->control, 0, PW_LOGIN_TIME, TAG_ANY);
+ ends = fr_pair_find_by_num(request->control, 0, FR_LOGIN_TIME, TAG_ANY);
if (!ends) {
return RLM_MODULE_NOOP;
}
*/
RDEBUG("Login within allowed time-slot, %d seconds left in this session", left);
- timeout = fr_pair_find_by_num(request->reply->vps, 0, PW_SESSION_TIMEOUT, TAG_ANY);
+ timeout = fr_pair_find_by_num(request->reply->vps, 0, FR_SESSION_TIMEOUT, TAG_ANY);
if (timeout) { /* just update... */
if (timeout->vp_uint32 > (unsigned int) left) {
timeout->vp_uint32 = left;
}
} else {
- timeout = radius_pair_create(request->reply, &request->reply->vps, PW_SESSION_TIMEOUT, 0);
+ timeout = radius_pair_create(request->reply, &request->reply->vps, FR_SESSION_TIMEOUT, 0);
timeout->vp_uint32 = left;
}
/*
* Register a Current-Time comparison function
*/
- paircompare_register(fr_dict_attr_by_num(NULL, 0, PW_CURRENT_TIME), NULL, true, timecmp, inst);
- paircompare_register(fr_dict_attr_by_num(NULL, 0, PW_TIME_OF_DAY), NULL, true, time_of_day, inst);
+ paircompare_register(fr_dict_attr_by_num(NULL, 0, FR_CURRENT_TIME), NULL, true, timecmp, inst);
+ paircompare_register(fr_dict_attr_by_num(NULL, 0, FR_TIME_OF_DAY), NULL, true, time_of_day, inst);
return 0;
}
if (strcmp(authparams.account_name, normalised_username) != 0) {
authparams.account_name = normalised_username;
- /* Set PW_MS_CHAP_USER_NAME */
+ /* Set FR_MS_CHAP_USER_NAME */
if (!fr_pair_make(request->packet, &request->packet->vps, "MS-CHAP-User-Name", normalised_username, T_OP_SET)) {
RERROR("Failed creating MS-CHAP-User-Name");
goto normalised_username_retry_failure;
authparams.domain_name);
/* Recalculate hash */
- if (!(vp_challenge = fr_pair_find_by_num(request->packet->vps, PW_MSCHAP_CHALLENGE, VENDORPEC_MICROSOFT, TAG_ANY))) {
+ if (!(vp_challenge = fr_pair_find_by_num(request->packet->vps, FR_MSCHAP_CHALLENGE, VENDORPEC_MICROSOFT, TAG_ANY))) {
RERROR("Unable to get MS-CHAP-Challenge");
goto normalised_username_retry_failure;
}
- if (!(vp_response = fr_pair_find_by_num(request->packet->vps, PW_MSCHAP2_RESPONSE, VENDORPEC_MICROSOFT, TAG_ANY))) {
+ if (!(vp_response = fr_pair_find_by_num(request->packet->vps, FR_MSCHAP2_RESPONSE, VENDORPEC_MICROSOFT, TAG_ANY))) {
RERROR("Unable to get MS-CHAP2-Response");
goto normalised_username_retry_failure;
}
char *username_string = NULL;
char *shortUserName = NULL;
VALUE_PAIR *response = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT,
- PW_MSCHAP2_RESPONSE, TAG_ANY);
+ FR_MSCHAP2_RESPONSE, TAG_ANY);
#ifndef NDEBUG
unsigned int t;
#endif
#define ACB_SVRTRUST 0x01000000 //!< Server trust account.
#define ACB_PWNOEXP 0x02000000 //!< User password does not expire.
#define ACB_AUTOLOCK 0x04000000 //!< Account auto locked.
-#define ACB_PW_EXPIRED 0x00020000 //!< Password Expired.
+#define ACB_FR_EXPIRED 0x00020000 //!< Password Expired.
static int pdb_decode_acct_ctrl(char const *p)
{
break;
case 'e': /* 'e'xpired, the password has */
- acct_ctrl |= ACB_PW_EXPIRED;
+ acct_ctrl |= ACB_FR_EXPIRED;
break;
case ' ': /* ignore spaces */
* hash of MS-CHAPv2 challenge, and peer challenge.
*/
if (strncasecmp(fmt, "Challenge", 9) == 0) {
- chap_challenge = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, PW_MSCHAP_CHALLENGE,
+ chap_challenge = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_CHALLENGE,
TAG_ANY);
if (!chap_challenge) {
REDEBUG("No MS-CHAP-Challenge in the request");
VALUE_PAIR *name_attr, *response_name;
char const *username_string;
- response = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, PW_MSCHAP2_RESPONSE,
+ response = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP2_RESPONSE,
TAG_ANY);
if (!response) {
REDEBUG("MS-CHAP2-Response is required to calculate MS-CHAPv1 challenge");
return -1;
}
- user_name = fr_pair_find_by_num(request->packet->vps, 0, PW_USER_NAME, TAG_ANY);
+ user_name = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY);
if (!user_name) {
REDEBUG("User-Name is required to calculate MS-CHAPv1 Challenge");
return -1;
* We prefer this to the User-Name in the
* packet.
*/
- response_name = fr_pair_find_by_num(request->packet->vps, 0, PW_MS_CHAP_USER_NAME, TAG_ANY);
+ response_name = fr_pair_find_by_num(request->packet->vps, 0, FR_MS_CHAP_USER_NAME, TAG_ANY);
if (response_name) {
name_attr = response_name;
} else {
* response.
*/
} else if (strncasecmp(fmt, "NT-Response", 11) == 0) {
- response = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, PW_MSCHAP_RESPONSE, TAG_ANY);
+ response = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_RESPONSE, TAG_ANY);
if (!response) response = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT,
- PW_MSCHAP2_RESPONSE, TAG_ANY);
+ FR_MSCHAP2_RESPONSE, TAG_ANY);
if (!response) {
REDEBUG("No MS-CHAP-Response or MS-CHAP2-Response was found in the request");
return -1;
* if the second octet says so.
*/
if ((response->da->vendor == VENDORPEC_MICROSOFT) &&
- (response->da->attr == PW_MSCHAP_RESPONSE) &&
+ (response->da->attr == FR_MSCHAP_RESPONSE) &&
((response->vp_octets[1] & 0x01) == 0)) {
REDEBUG("No NT-Response in MS-CHAP-Response");
return -1;
* in MS-CHAPv1, and not often there.
*/
} else if (strncasecmp(fmt, "LM-Response", 11) == 0) {
- response = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, PW_MSCHAP_RESPONSE, TAG_ANY);
+ response = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_RESPONSE, TAG_ANY);
if (!response) {
REDEBUG("No MS-CHAP-Response was found in the request");
return -1;
} else if (strncasecmp(fmt, "NT-Domain", 9) == 0) {
char *p, *q;
- user_name = fr_pair_find_by_num(request->packet->vps, 0, PW_USER_NAME, TAG_ANY);
+ user_name = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY);
if (!user_name) {
REDEBUG("No User-Name was found in the request");
return -1;
} else if (strncasecmp(fmt, "User-Name", 9) == 0) {
char const *p, *q;
- user_name = fr_pair_find_by_num(request->packet->vps, 0, PW_USER_NAME, TAG_ANY);
+ user_name = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY);
if (!user_name) {
REDEBUG("No User-Name was found in the request");
return -1;
/*
* For backwards compatibility
*/
- if (!fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, PW_AUTH_TYPE), inst->xlat_name)) {
+ if (!fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, FR_AUTH_TYPE), inst->xlat_name)) {
inst->auth_type = "MS-CHAP";
} else {
inst->auth_type = inst->xlat_name;
* here minimizes work for later.
*/
if (!password->da->vendor &&
- (password->da->attr == PW_NT_PASSWORD)) {
+ (password->da->attr == FR_NT_PASSWORD)) {
fr_md4_calc(nthashhash, password->vp_octets, MD4_DIGEST_LENGTH);
}
rlm_mschap_t const *inst = instance;
VALUE_PAIR *challenge = NULL;
- challenge = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, PW_MSCHAP_CHALLENGE, TAG_ANY);
+ challenge = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_CHALLENGE, TAG_ANY);
if (!challenge) {
return RLM_MODULE_NOOP;
}
- if (!fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, PW_MSCHAP_RESPONSE, TAG_ANY) &&
- !fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, PW_MSCHAP2_RESPONSE, TAG_ANY) &&
- !fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, PW_MSCHAP2_CPW, TAG_ANY)) {
+ if (!fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_RESPONSE, TAG_ANY) &&
+ !fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP2_RESPONSE, TAG_ANY) &&
+ !fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP2_CPW, TAG_ANY)) {
RDEBUG2("Found MS-CHAP-Challenge, but no MS-CHAP response or change-password");
return RLM_MODULE_NOOP;
}
- if (fr_pair_find_by_num(request->control, 0, PW_AUTH_TYPE, TAG_ANY)) {
+ if (fr_pair_find_by_num(request->control, 0, FR_AUTH_TYPE, TAG_ANY)) {
RWDEBUG2("Auth-Type already set. Not setting to MS-CHAP");
return RLM_MODULE_NOOP;
}
if ((mschap_result == -648) ||
((mschap_result == 0) &&
- (smb_ctrl && ((smb_ctrl->vp_uint32 & ACB_PW_EXPIRED) != 0)))) {
+ (smb_ctrl && ((smb_ctrl->vp_uint32 & ACB_FR_EXPIRED) != 0)))) {
REDEBUG("Password has expired. User should retry authentication");
error = 648;
/*
* Look for NT-Password...
*/
- nt_password = fr_pair_find_by_num(request->control, 0, PW_NT_PASSWORD, TAG_ANY);
+ nt_password = fr_pair_find_by_num(request->control, 0, FR_NT_PASSWORD, TAG_ANY);
if (nt_password) {
VERIFY_VP(nt_password);
{
VALUE_PAIR *lm_password;
- lm_password = fr_pair_find_by_num(request->control, 0, PW_LM_PASSWORD, TAG_ANY);
+ lm_password = fr_pair_find_by_num(request->control, 0, FR_LM_PASSWORD, TAG_ANY);
if (lm_password) {
VERIFY_VP(lm_password);
if (nt_enc->da->vendor != VENDORPEC_MICROSOFT)
continue;
- if (nt_enc->da->attr != PW_MSCHAP_NT_ENC_PW)
+ if (nt_enc->da->attr != FR_MSCHAP_NT_ENC_PW)
continue;
if (nt_enc->vp_length < 4) {
* or in configured passwd file.
* If one is found we will check paraneters given by NAS.
*
- * If PW_SMB_ACCOUNT_CTRL is not set to ACB_PWNOTREQ we must have
+ * If FR_SMB_ACCOUNT_CTRL is not set to ACB_PWNOTREQ we must have
* one of:
- * PAP: PW_USER_PASSWORD or
- * MS-CHAP: PW_MSCHAP_CHALLENGE and PW_MSCHAP_RESPONSE or
- * MS-CHAP2: PW_MSCHAP_CHALLENGE and PW_MSCHAP2_RESPONSE
+ * PAP: FR_USER_PASSWORD or
+ * MS-CHAP: FR_MSCHAP_CHALLENGE and FR_MSCHAP_RESPONSE or
+ * MS-CHAP2: FR_MSCHAP_CHALLENGE and FR_MSCHAP2_RESPONSE
* In case of password mismatch or locked account we MAY return
- * PW_MSCHAP_ERROR for MS-CHAP or MS-CHAP v2
+ * FR_MSCHAP_ERROR for MS-CHAP or MS-CHAP v2
* If MS-CHAP2 succeeds we MUST return
- * PW_MSCHAP2_SUCCESS
+ * FR_MSCHAP2_SUCCESS
*/
static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(void *instance, UNUSED void *thread, REQUEST *request)
{
* want to suppress it.
*/
if (auth_method != AUTH_INTERNAL) {
- VALUE_PAIR *vp = fr_pair_find_by_num(request->control, 0, PW_MS_CHAP_USE_NTLM_AUTH, TAG_ANY);
+ VALUE_PAIR *vp = fr_pair_find_by_num(request->control, 0, FR_MS_CHAP_USE_NTLM_AUTH, TAG_ANY);
if (vp && vp->vp_uint32 == 0) auth_method = AUTH_INTERNAL;
}
* Find the SMB-Account-Ctrl attribute, or the
* SMB-Account-Ctrl-Text attribute.
*/
- smb_ctrl = fr_pair_find_by_num(request->control, 0, PW_SMB_ACCOUNT_CTRL, TAG_ANY);
+ smb_ctrl = fr_pair_find_by_num(request->control, 0, FR_SMB_ACCOUNT_CTRL, TAG_ANY);
if (!smb_ctrl) {
- password = fr_pair_find_by_num(request->control, 0, PW_SMB_ACCOUNT_CTRL_TEXT, TAG_ANY);
+ password = fr_pair_find_by_num(request->control, 0, FR_SMB_ACCOUNT_CTRL_TEXT, TAG_ANY);
if (password) {
smb_ctrl = pair_make_config("SMB-Account-CTRL", "0", T_OP_SET);
if (smb_ctrl) {
/*
* Decide how to get the passwords.
*/
- password = fr_pair_find_by_num(request->control, 0, PW_CLEARTEXT_PASSWORD, TAG_ANY);
+ password = fr_pair_find_by_num(request->control, 0, FR_CLEARTEXT_PASSWORD, TAG_ANY);
/*
* Look for or create an NT-Password
* Check to see if this is a change password request, and process
* it accordingly if so.
*/
- cpw = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, PW_MSCHAP2_CPW, TAG_ANY);
+ cpw = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP2_CPW, TAG_ANY);
if (cpw) {
uint8_t *p;
rlm_rcode_t rc;
* obviously the password change action will need
* to have cleared this bit in the config/SQL/wherever.
*/
- if (smb_ctrl && smb_ctrl->vp_uint32 & ACB_PW_EXPIRED) {
+ if (smb_ctrl && smb_ctrl->vp_uint32 & ACB_FR_EXPIRED) {
RDEBUG("Clearing expiry bit in SMB-Acct-Ctrl to allow authentication");
- smb_ctrl->vp_uint32 &= ~ACB_PW_EXPIRED;
+ smb_ctrl->vp_uint32 &= ~ACB_FR_EXPIRED;
}
/*
* continue with the authentication.
*/
response = radius_pair_create(request->packet, &request->packet->vps,
- PW_MSCHAP2_RESPONSE,
+ FR_MSCHAP2_RESPONSE,
VENDORPEC_MICROSOFT);
p = talloc_array(response, uint8_t, 50);
fr_pair_value_memsteal(response, p);
}
- challenge = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, PW_MSCHAP_CHALLENGE, TAG_ANY);
+ challenge = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_CHALLENGE, TAG_ANY);
if (!challenge) {
REDEBUG("You set 'Auth-Type = MS-CHAP' for a request that does not contain any MS-CHAP attributes!");
return RLM_MODULE_REJECT;
/*
* We also require an MS-CHAP-Response.
*/
- response = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, PW_MSCHAP_RESPONSE, TAG_ANY);
+ response = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_RESPONSE, TAG_ANY);
/*
* MS-CHAP-Response, means MS-CHAPv1
rcode = mschap_error(inst, request, *response->vp_octets,
mschap_result, mschap_version, smb_ctrl);
if (rcode != RLM_MODULE_OK) return rcode;
- } else if ((response = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, PW_MSCHAP2_RESPONSE,
+ } else if ((response = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP2_RESPONSE,
TAG_ANY)) != NULL) {
uint8_t mschapv1_challenge[16];
VALUE_PAIR *name_attr, *response_name;
/*
* We also require a User-Name
*/
- username = fr_pair_find_by_num(request->packet->vps, 0, PW_USER_NAME, TAG_ANY);
+ username = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY);
if (!username) {
REDEBUG("We require a User-Name for MS-CHAPv2");
return RLM_MODULE_INVALID;
* We prefer this to the User-Name in the
* packet.
*/
- response_name = fr_pair_find_by_num(request->packet->vps, 0, PW_MS_CHAP_USER_NAME, TAG_ANY);
+ response_name = fr_pair_find_by_num(request->packet->vps, 0, FR_MS_CHAP_USER_NAME, TAG_ANY);
name_attr = response_name ? response_name : username;
/*
#ifdef WITH_AUTH_WINBIND
if (inst->wb_retry_with_normalised_username) {
- if ((response_name = fr_pair_find_by_num(request->packet->vps, PW_MS_CHAP_USER_NAME, 0, TAG_ANY))) {
+ if ((response_name = fr_pair_find_by_num(request->packet->vps, FR_MS_CHAP_USER_NAME, 0, TAG_ANY))) {
if (strcmp(username_string, response_name->vp_strvalue)) {
RDEBUG2("Changing username %s to %s", username_string, response_name->vp_strvalue);
username_string = response_name->vp_strvalue;
* Can't do OpenDirectory if there's no password.
*/
if (!request->password ||
- (request->password->da->attr != PW_USER_PASSWORD)) {
+ (request->password->da->attr != FR_USER_PASSWORD)) {
REDEBUG("You set 'Auth-Type = OpenDirectory' for a request that does not contain a User-Password attribute!");
return RLM_MODULE_INVALID;
}
if (uuid_is_null(guid_sacl) && uuid_is_null(guid_nasgroup)) {
RDEBUG("No access control groups, all users allowed");
- if (fr_pair_find_by_num(request->control, 0, PW_AUTH_TYPE, TAG_ANY) == NULL) {
+ if (fr_pair_find_by_num(request->control, 0, FR_AUTH_TYPE, TAG_ANY) == NULL) {
pair_make_config("Auth-Type", kAuthType, T_OP_EQ);
RDEBUG("Setting Auth-Type = %s", kAuthType);
}
}
}
- if (fr_pair_find_by_num(request->control, 0, PW_AUTH_TYPE, TAG_ANY) == NULL) {
+ if (fr_pair_find_by_num(request->control, 0, FR_AUTH_TYPE, TAG_ANY) == NULL) {
pair_make_config("Auth-Type", kAuthType, T_OP_EQ);
RDEBUG("Setting Auth-Type = %s", kAuthType);
}
* Ensure that we're being passed a plain-text password,
* and not anything else.
*/
- if (request->password->da->attr != PW_USER_PASSWORD) {
+ if (request->password->da->attr != FR_USER_PASSWORD) {
RAUTH("Attribute \"User-Password\" is required for authentication. Cannot use \"%s\".", request->password->da->name);
return RLM_MODULE_INVALID;
}
* Let the 'users' file over-ride the PAM auth name string,
* for backwards compatibility.
*/
- pair = fr_pair_find_by_num(request->control, 0, PW_PAM_AUTH, TAG_ANY);
+ pair = fr_pair_find_by_num(request->control, 0, FR_PAM_AUTH, TAG_ANY);
if (pair) pam_auth_string = pair->vp_strvalue;
ret = do_pam(request, request->username->vp_strvalue, request->password->vp_strvalue, pam_auth_string);
* @note Header comparison is case insensitive.
*/
static const FR_NAME_NUMBER header_names[] = {
- { "{clear}", PW_CLEARTEXT_PASSWORD },
- { "{cleartext}", PW_CLEARTEXT_PASSWORD },
- { "{md5}", PW_MD5_PASSWORD },
- { "{base64_md5}", PW_MD5_PASSWORD },
- { "{smd5}", PW_SMD5_PASSWORD },
- { "{crypt}", PW_CRYPT_PASSWORD },
+ { "{clear}", FR_CLEARTEXT_PASSWORD },
+ { "{cleartext}", FR_CLEARTEXT_PASSWORD },
+ { "{md5}", FR_MD5_PASSWORD },
+ { "{base64_md5}", FR_MD5_PASSWORD },
+ { "{smd5}", FR_SMD5_PASSWORD },
+ { "{crypt}", FR_CRYPT_PASSWORD },
#ifdef HAVE_OPENSSL_EVP_H
/*
* It'd make more sense for the headers to be
* ssha2-* with SHA3 coming soon but we're at
* the mercy of directory implementors.
*/
- { "{sha2}", PW_SHA2_PASSWORD },
- { "{sha224}", PW_SHA2_PASSWORD },
- { "{sha256}", PW_SHA2_PASSWORD },
- { "{sha384}", PW_SHA2_PASSWORD },
- { "{sha512}", PW_SHA2_PASSWORD },
- { "{ssha224}", PW_SSHA2_224_PASSWORD },
- { "{ssha256}", PW_SSHA2_256_PASSWORD },
- { "{ssha384}", PW_SSHA2_384_PASSWORD },
- { "{ssha512}", PW_SSHA2_512_PASSWORD },
+ { "{sha2}", FR_SHA2_PASSWORD },
+ { "{sha224}", FR_SHA2_PASSWORD },
+ { "{sha256}", FR_SHA2_PASSWORD },
+ { "{sha384}", FR_SHA2_PASSWORD },
+ { "{sha512}", FR_SHA2_PASSWORD },
+ { "{ssha224}", FR_SSHA2_224_PASSWORD },
+ { "{ssha256}", FR_SSHA2_256_PASSWORD },
+ { "{ssha384}", FR_SSHA2_384_PASSWORD },
+ { "{ssha512}", FR_SSHA2_512_PASSWORD },
#endif
- { "{sha}", PW_SHA_PASSWORD },
- { "{ssha}", PW_SSHA_PASSWORD },
- { "{md4}", PW_NT_PASSWORD },
- { "{nt}", PW_NT_PASSWORD },
- { "{nthash}", PW_NT_PASSWORD },
- { "{x-nthash}", PW_NT_PASSWORD },
- { "{ns-mta-md5}", PW_NS_MTA_MD5_PASSWORD },
- { "{x- orcllmv}", PW_LM_PASSWORD },
- { "{X- orclntv}", PW_NT_PASSWORD },
+ { "{sha}", FR_SHA_PASSWORD },
+ { "{ssha}", FR_SSHA_PASSWORD },
+ { "{md4}", FR_NT_PASSWORD },
+ { "{nt}", FR_NT_PASSWORD },
+ { "{nthash}", FR_NT_PASSWORD },
+ { "{x-nthash}", FR_NT_PASSWORD },
+ { "{ns-mta-md5}", FR_NS_MTA_MD5_PASSWORD },
+ { "{x- orcllmv}", FR_LM_PASSWORD },
+ { "{X- orclntv}", FR_NT_PASSWORD },
{ NULL, 0 }
};
inst->name = cf_section_name1(conf);
}
- dval = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, PW_AUTH_TYPE), inst->name);
+ dval = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, FR_AUTH_TYPE), inst->name);
if (dval) {
inst->auth_type = fr_unbox_uint32(dval->value);
} else {
}
unknown_header:
- new = fr_pair_afrom_num(request, 0, PW_CLEARTEXT_PASSWORD);
+ new = fr_pair_afrom_num(request, 0, FR_CLEARTEXT_PASSWORD);
fr_pair_value_strcpy(new, vp->vp_strvalue);
return new;
VERIFY_VP(vp);
next:
switch (vp->da->attr) {
- case PW_USER_PASSWORD: /* deprecated */
+ case FR_USER_PASSWORD: /* deprecated */
RWDEBUG("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
RWDEBUG("!!! Ignoring control:User-Password. Update your !!!");
RWDEBUG("!!! configuration so that the \"known good\" clear text !!!");
RWDEBUG("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
break;
- case PW_PASSWORD_WITH_HEADER: /* preferred */
+ case FR_PASSWORD_WITH_HEADER: /* preferred */
{
VALUE_PAIR *new;
/*
* Password already exists: use that instead of this one.
*/
- if (fr_pair_find_by_num(request->control, 0, PW_CLEARTEXT_PASSWORD, TAG_ANY)) {
+ if (fr_pair_find_by_num(request->control, 0, FR_CLEARTEXT_PASSWORD, TAG_ANY)) {
RWDEBUG("Config already contains a \"known good\" password "
"(&control:Cleartext-Password). Ignoring &config:Password-With-Header");
break;
}
break;
- case PW_CLEARTEXT_PASSWORD:
- case PW_CRYPT_PASSWORD:
- case PW_NS_MTA_MD5_PASSWORD:
+ case FR_CLEARTEXT_PASSWORD:
+ case FR_CRYPT_PASSWORD:
+ case FR_NS_MTA_MD5_PASSWORD:
found_pw = true;
break; /* don't touch these */
- case PW_MD5_PASSWORD:
- case PW_SMD5_PASSWORD:
- case PW_NT_PASSWORD:
- case PW_LM_PASSWORD:
+ case FR_MD5_PASSWORD:
+ case FR_SMD5_PASSWORD:
+ case FR_NT_PASSWORD:
+ case FR_LM_PASSWORD:
if (inst->normify) {
normify(request, vp, 16); /* ensure it's in the right format */
}
break;
#ifdef HAVE_OPENSSL_EVP_H
- case PW_SHA2_PASSWORD:
+ case FR_SHA2_PASSWORD:
if (inst->normify) {
normify(request, vp, 28); /* ensure it's in the right format */
}
found_pw = true;
break;
- case PW_SSHA2_224_PASSWORD:
+ case FR_SSHA2_224_PASSWORD:
if (inst->normify) {
normify(request, vp, 28); /* ensure it's in the right format */
}
found_pw = true;
break;
- case PW_SSHA2_256_PASSWORD:
+ case FR_SSHA2_256_PASSWORD:
if (inst->normify) {
normify(request, vp, 32); /* ensure it's in the right format */
}
found_pw = true;
break;
- case PW_SSHA2_384_PASSWORD:
+ case FR_SSHA2_384_PASSWORD:
if (inst->normify) {
normify(request, vp, 48); /* ensure it's in the right format */
}
found_pw = true;
break;
- case PW_SSHA2_512_PASSWORD:
+ case FR_SSHA2_512_PASSWORD:
if (inst->normify) {
normify(request, vp, 64); /* ensure it's in the right format */
}
break;
#endif
- case PW_SHA_PASSWORD:
- case PW_SSHA_PASSWORD:
+ case FR_SHA_PASSWORD:
+ case FR_SSHA_PASSWORD:
if (inst->normify) {
normify(request, vp, 20); /* ensure it's in the right format */
}
* If it's proxied somewhere, don't complain
* about not having passwords or Auth-Type.
*/
- case PW_PROXY_TO_REALM:
+ case FR_PROXY_TO_REALM:
{
REALM *realm = realm_find(vp->vp_strvalue);
if (realm && realm->auth_pool) {
break;
}
- case PW_AUTH_TYPE:
+ case FR_AUTH_TYPE:
auth_type = true;
/*
* Likely going to be proxied. Avoid printing
* warning message.
*/
- if (fr_pair_find_by_num(request->control, 0, PW_REALM, TAG_ANY) ||
- (fr_pair_find_by_num(request->control, 0, PW_PROXY_TO_REALM, TAG_ANY))) {
+ if (fr_pair_find_by_num(request->control, 0, FR_REALM, TAG_ANY) ||
+ (fr_pair_find_by_num(request->control, 0, FR_PROXY_TO_REALM, TAG_ANY))) {
return RLM_MODULE_NOOP;
}
/*
* The TLS types don't need passwords.
*/
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_EAP_TYPE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_EAP_TYPE, TAG_ANY);
if (vp &&
((vp->vp_uint32 == 13) || /* EAP-TLS */
(vp->vp_uint32 == 21) || /* EAP-TTLS */
* Can't do PAP if there's no password.
*/
if (!request->password ||
- (request->password->da->attr != PW_USER_PASSWORD)) {
+ (request->password->da->attr != FR_USER_PASSWORD)) {
RDEBUG2("No User-Password attribute in the request. Cannot do PAP");
return RLM_MODULE_NOOP;
}
if (inst->auth_type) {
vp = radius_pair_create(request, &request->control,
- PW_AUTH_TYPE, 0);
+ FR_AUTH_TYPE, 0);
vp->vp_uint32 = inst->auth_type;
}
unsigned int digest_len, min_len = 0;
switch (vp->da->attr) {
- case PW_SSHA2_224_PASSWORD:
+ case FR_SSHA2_224_PASSWORD:
name = "SSHA2-224";
md = EVP_sha224();
min_len = 28;
break;
- case PW_SSHA2_256_PASSWORD:
+ case FR_SSHA2_256_PASSWORD:
name = "SSHA2-256";
md = EVP_sha256();
min_len = 32;
break;
- case PW_SSHA2_384_PASSWORD:
+ case FR_SSHA2_384_PASSWORD:
name = "SSHA2-384";
md = EVP_sha384();
min_len = 48;
break;
- case PW_SSHA2_512_PASSWORD:
+ case FR_SSHA2_512_PASSWORD:
name = "SSHA2-512";
min_len = 64;
md = EVP_sha512();
RDEBUG("Comparing with \"known-good\" NT-Password");
rad_assert(request->password != NULL);
- rad_assert(request->password->da->attr == PW_USER_PASSWORD);
+ rad_assert(request->password->da->attr == FR_USER_PASSWORD);
if (inst->normify) {
normify(request, vp, 16);
if (!request->password ||
(request->password->da->vendor != 0) ||
- (request->password->da->attr != PW_USER_PASSWORD)) {
+ (request->password->da->attr != FR_USER_PASSWORD)) {
REDEBUG("You set 'Auth-Type = PAP' for a request that does not contain a User-Password attribute!");
return RLM_MODULE_INVALID;
}
vp;
vp = fr_pair_cursor_next(&cursor)) {
if (!vp->da->vendor) switch (vp->da->attr) {
- case PW_CLEARTEXT_PASSWORD:
+ case FR_CLEARTEXT_PASSWORD:
auth_func = &pap_auth_clear;
break;
- case PW_CRYPT_PASSWORD:
+ case FR_CRYPT_PASSWORD:
auth_func = &pap_auth_crypt;
break;
- case PW_MD5_PASSWORD:
+ case FR_MD5_PASSWORD:
auth_func = &pap_auth_md5;
break;
- case PW_SMD5_PASSWORD:
+ case FR_SMD5_PASSWORD:
auth_func = &pap_auth_smd5;
break;
#ifdef HAVE_OPENSSL_EVP_H
- case PW_SHA2_PASSWORD:
+ case FR_SHA2_PASSWORD:
auth_func = &pap_auth_sha2;
break;
- case PW_SSHA2_224_PASSWORD:
- case PW_SSHA2_256_PASSWORD:
- case PW_SSHA2_384_PASSWORD:
- case PW_SSHA2_512_PASSWORD:
+ case FR_SSHA2_224_PASSWORD:
+ case FR_SSHA2_256_PASSWORD:
+ case FR_SSHA2_384_PASSWORD:
+ case FR_SSHA2_512_PASSWORD:
auth_func = &pap_auth_ssha2;
break;
#endif
- case PW_SHA_PASSWORD:
+ case FR_SHA_PASSWORD:
auth_func = &pap_auth_sha;
break;
- case PW_SSHA_PASSWORD:
+ case FR_SSHA_PASSWORD:
auth_func = &pap_auth_ssha;
break;
- case PW_NT_PASSWORD:
+ case FR_NT_PASSWORD:
auth_func = &pap_auth_nt;
break;
- case PW_LM_PASSWORD:
+ case FR_LM_PASSWORD:
auth_func = &pap_auth_lm;
break;
- case PW_NS_MTA_MD5_PASSWORD:
+ case FR_NS_MTA_MD5_PASSWORD:
auth_func = &pap_auth_ns_mta_md5;
break;
/*
* Update cached copies
*/
- request->username = fr_pair_find_by_num(request->packet->vps, 0, PW_USER_NAME, TAG_ANY);
- request->password = fr_pair_find_by_num(request->packet->vps, 0, PW_USER_PASSWORD, TAG_ANY);
+ request->username = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY);
+ request->password = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_PASSWORD, TAG_ANY);
if (!request->password)
- request->password = fr_pair_find_by_num(request->packet->vps, 0, PW_CHAP_PASSWORD,
+ request->password = fr_pair_find_by_num(request->packet->vps, 0, FR_CHAP_PASSWORD,
TAG_ANY);
}
VALUE_PAIR *pair;
int acctstatustype = 0;
- if ((pair = fr_pair_find_by_num(request->packet->vps, 0, PW_ACCT_STATUS_TYPE, TAG_ANY)) != NULL) {
+ if ((pair = fr_pair_find_by_num(request->packet->vps, 0, FR_ACCT_STATUS_TYPE, TAG_ANY)) != NULL) {
acctstatustype = pair->vp_uint32;
} else {
RDEBUG("Invalid Accounting Packet");
}
switch (acctstatustype) {
- case PW_STATUS_START:
+ case FR_STATUS_START:
if (((rlm_perl_t const *)instance)->func_start_accounting) {
return do_perl(instance, request,
((rlm_perl_t const *)instance)->func_start_accounting);
((rlm_perl_t const *)instance)->func_accounting);
}
- case PW_STATUS_STOP:
+ case FR_STATUS_STOP:
if (((rlm_perl_t const *)instance)->func_stop_accounting) {
return do_perl(instance, request,
((rlm_perl_t const *)instance)->func_stop_accounting);
static int fall_through(VALUE_PAIR *vp)
{
VALUE_PAIR *tmp;
- tmp = fr_pair_find_by_num(vp, 0, PW_FALL_THROUGH, TAG_ANY);
+ tmp = fr_pair_find_by_num(vp, 0, FR_FALL_THROUGH, TAG_ANY);
return tmp ? tmp->vp_uint32 : 0;
}
* If it isn't there, then we can't mangle the request.
*/
request_pairs = request->packet->vps;
- namepair = fr_pair_find_by_num(request_pairs, 0, PW_USER_NAME, TAG_ANY);
+ namepair = fr_pair_find_by_num(request_pairs, 0, FR_USER_NAME, TAG_ANY);
if (!namepair || (namepair->vp_length == 0)) {
return;
}
* Small check: if Framed-Protocol present but Service-Type
* is missing, add Service-Type = Framed-User.
*/
- if (fr_pair_find_by_num(request_pairs, 0, PW_FRAMED_PROTOCOL, TAG_ANY) != NULL &&
- fr_pair_find_by_num(request_pairs, 0, PW_SERVICE_TYPE, TAG_ANY) == NULL) {
- tmp = radius_pair_create(request->packet, &request->packet->vps, PW_SERVICE_TYPE, 0);
- tmp->vp_uint32 = PW_FRAMED_USER;
+ if (fr_pair_find_by_num(request_pairs, 0, FR_FRAMED_PROTOCOL, TAG_ANY) != NULL &&
+ fr_pair_find_by_num(request_pairs, 0, FR_SERVICE_TYPE, TAG_ANY) == NULL) {
+ tmp = radius_pair_create(request->packet, &request->packet->vps, FR_SERVICE_TYPE, 0);
+ tmp->vp_uint32 = FR_FRAMED_USER;
}
num_proxy_state = 0;
continue;
}
- if (tmp->da->attr != PW_PROXY_STATE) {
+ if (tmp->da->attr != FR_PROXY_STATE) {
continue;
}
/*
* Check for valid input, zero length names not permitted
*/
- name = (tmp = fr_pair_find_by_num(request_pairs, 0, PW_USER_NAME, TAG_ANY)) ?
+ name = (tmp = fr_pair_find_by_num(request_pairs, 0, FR_USER_NAME, TAG_ANY)) ?
tmp->vp_strvalue : NULL;
if (!name || name[0] == 0) {
/*
RDEBUG2("hints: Matched %s at %d", i->name, i->lineno);
/*
* Now add all attributes to the request list,
- * except PW_STRIP_USER_NAME and PW_FALL_THROUGH
+ * except FR_STRIP_USER_NAME and FR_FALL_THROUGH
* and xlat them.
*/
add = fr_pair_list_copy(request->packet, i->reply);
ft = fall_through(add);
- fr_pair_delete_by_num(&add, 0, PW_STRIP_USER_NAME, TAG_ANY);
- fr_pair_delete_by_num(&add, 0, PW_FALL_THROUGH, TAG_ANY);
+ fr_pair_delete_by_num(&add, 0, FR_STRIP_USER_NAME, TAG_ANY);
+ fr_pair_delete_by_num(&add, 0, FR_FALL_THROUGH, TAG_ANY);
radius_pairmove(request, &request->packet->vps, add, true);
updated = 1;
* We've matched the huntgroup, so add it in
* to the list of request pairs.
*/
- vp = fr_pair_find_by_num(request_pairs, 0, PW_HUNTGROUP_NAME, TAG_ANY);
+ vp = fr_pair_find_by_num(request_pairs, 0, FR_HUNTGROUP_NAME, TAG_ANY);
if (!vp) {
- vp = radius_pair_create(request->packet, &request->packet->vps, PW_HUNTGROUP_NAME, 0);
+ vp = radius_pair_create(request->packet, &request->packet->vps, FR_HUNTGROUP_NAME, 0);
fr_pair_value_strcpy(vp, i->name);
}
r = RLM_MODULE_OK;
switch (request->packet->src_ipaddr.af) {
case AF_INET:
- nas = fr_pair_find_by_num(request->packet->vps, 0, PW_NAS_IP_ADDRESS, TAG_ANY);
+ nas = fr_pair_find_by_num(request->packet->vps, 0, FR_NAS_IP_ADDRESS, TAG_ANY);
if (!nas) {
- nas = radius_pair_create(request->packet, &request->packet->vps, PW_NAS_IP_ADDRESS, 0);
+ nas = radius_pair_create(request->packet, &request->packet->vps, FR_NAS_IP_ADDRESS, 0);
nas->vp_ipv4addr = request->packet->src_ipaddr.addr.v4.s_addr;
}
break;
case AF_INET6:
- nas = fr_pair_find_by_num(request->packet->vps, 0, PW_NAS_IPV6_ADDRESS, TAG_ANY);
+ nas = fr_pair_find_by_num(request->packet->vps, 0, FR_NAS_IPV6_ADDRESS, TAG_ANY);
if (!nas) {
- nas = radius_pair_create(request->packet, &request->packet->vps, PW_NAS_IPV6_ADDRESS, 0);
+ nas = radius_pair_create(request->packet, &request->packet->vps, FR_NAS_IPV6_ADDRESS, 0);
memcpy(&nas->vp_ipv6addr, &request->packet->src_ipaddr.addr,
sizeof(request->packet->src_ipaddr.addr));
}
* in place, to go from Ascend's weird values to something
* approaching rationality.
*/
- ascend_nasport_hack(fr_pair_find_by_num(request->packet->vps, 0, PW_NAS_PORT, TAG_ANY),
+ ascend_nasport_hack(fr_pair_find_by_num(request->packet->vps, 0, FR_NAS_PORT, TAG_ANY),
inst->ascend_channels_per_line);
}
* Add an event timestamp. Means Event-Timestamp can be used
* consistently instead of one letter expansions.
*/
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_EVENT_TIMESTAMP, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_EVENT_TIMESTAMP, TAG_ANY);
if (!vp) {
- vp = radius_pair_create(request->packet, &request->packet->vps, PW_EVENT_TIMESTAMP, 0);
+ vp = radius_pair_create(request->packet, &request->packet->vps, FR_EVENT_TIMESTAMP, 0);
vp->vp_date = request->packet->timestamp.tv_sec;
}
hints_setup(inst->hints, request);
/*
- * If there is a PW_CHAP_PASSWORD attribute but there
- * is PW_CHAP_CHALLENGE we need to add it so that other
+ * If there is a FR_CHAP_PASSWORD attribute but there
+ * is FR_CHAP_CHALLENGE we need to add it so that other
* modules can use it as a normal attribute.
*/
- if (fr_pair_find_by_num(request->packet->vps, 0, PW_CHAP_PASSWORD, TAG_ANY) &&
- fr_pair_find_by_num(request->packet->vps, 0, PW_CHAP_CHALLENGE, TAG_ANY) == NULL) {
- vp = radius_pair_create(request->packet, &request->packet->vps, PW_CHAP_CHALLENGE, 0);
+ if (fr_pair_find_by_num(request->packet->vps, 0, FR_CHAP_PASSWORD, TAG_ANY) &&
+ fr_pair_find_by_num(request->packet->vps, 0, FR_CHAP_CHALLENGE, TAG_ANY) == NULL) {
+ vp = radius_pair_create(request->packet, &request->packet->vps, FR_CHAP_CHALLENGE, 0);
fr_pair_value_memcpy(vp, request->packet->vector, AUTH_VECTOR_LEN);
}
* the server can use it, rather than various error-prone
* manual calculations.
*/
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_EVENT_TIMESTAMP, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_EVENT_TIMESTAMP, TAG_ANY);
if (!vp) {
VALUE_PAIR *delay;
- vp = radius_pair_create(request->packet, &request->packet->vps, PW_EVENT_TIMESTAMP, 0);
+ vp = radius_pair_create(request->packet, &request->packet->vps, FR_EVENT_TIMESTAMP, 0);
vp->vp_date = request->packet->timestamp.tv_sec;
- delay = fr_pair_find_by_num(request->packet->vps, 0, PW_ACCT_DELAY_TIME, TAG_ANY);
+ delay = fr_pair_find_by_num(request->packet->vps, 0, FR_ACCT_DELAY_TIME, TAG_ANY);
if (delay) {
if ((delay->vp_uint32 >= vp->vp_date) || (delay->vp_uint32 == UINT32_MAX)) {
RWARN("Ignoring invalid Acct-Delay-time of %u seconds", delay->vp_uint32);
/*
* We retransmit only a few kinds of packets.
*/
- if (!((packet->code == PW_CODE_ACCESS_REQUEST) ||
- (packet->code == PW_CODE_COA_REQUEST) ||
- (packet->code == PW_CODE_DISCONNECT_REQUEST))) {
+ if (!((packet->code == FR_CODE_ACCESS_REQUEST) ||
+ (packet->code == FR_CODE_COA_REQUEST) ||
+ (packet->code == FR_CODE_DISCONNECT_REQUEST))) {
return;
}
}
}
- vp = fr_pair_afrom_num(packet, 0, PW_PROXY_STATE);
+ vp = fr_pair_afrom_num(packet, 0, FR_PROXY_STATE);
rad_assert(vp != NULL);
fr_pair_value_snprintf(vp, "%08x", fr_rand());
fr_pair_add(&packet->vps, vp);
/*
* Access-Requests get special mangling.
*/
- if (request->packet->code == PW_CODE_ACCESS_REQUEST) {
+ if (request->packet->code == FR_CODE_ACCESS_REQUEST) {
/*
* Add CHAP-Challenge if necessary.
*/
if ((request->packet->code == packet->code) &&
- fr_pair_find_by_num(request->packet->vps, 0, PW_CHAP_PASSWORD, TAG_ANY) &&
- fr_pair_find_by_num(request->packet->vps, 0, PW_CHAP_CHALLENGE, TAG_ANY) == NULL) {
- vp = radius_pair_create(packet, &packet->vps, PW_CHAP_CHALLENGE, 0);
+ fr_pair_find_by_num(request->packet->vps, 0, FR_CHAP_PASSWORD, TAG_ANY) &&
+ fr_pair_find_by_num(request->packet->vps, 0, FR_CHAP_CHALLENGE, TAG_ANY) == NULL) {
+ vp = radius_pair_create(packet, &packet->vps, FR_CHAP_CHALLENGE, 0);
fr_pair_value_memcpy(vp, request->packet->vector, sizeof(request->packet->vector));
}
/*
* Which type is this.
*/
- if ((vp = fr_pair_find_by_num(request->packet->vps, 0, PW_ACCT_STATUS_TYPE, TAG_ANY)) == NULL) {
+ if ((vp = fr_pair_find_by_num(request->packet->vps, 0, FR_ACCT_STATUS_TYPE, TAG_ANY)) == NULL) {
RDEBUG2("No Accounting-Status-Type record");
return RLM_MODULE_NOOP;
}
* Look for weird reboot packets.
*
* ComOS (up to and including 3.5.1b20) does not send
- * standard PW_STATUS_ACCOUNTING_XXX messages.
+ * standard FR_STATUS_ACCOUNTING_XXX messages.
*
* Check for: o no Acct-Session-Time, or time of 0
* o Acct-Session-Id of "00000000".
* We could also check for NAS-Port, that attribute
* should NOT be present (but we don't right now).
*/
- if ((status != PW_STATUS_ACCOUNTING_ON) &&
- (status != PW_STATUS_ACCOUNTING_OFF)) do {
+ if ((status != FR_STATUS_ACCOUNTING_ON) &&
+ (status != FR_STATUS_ACCOUNTING_OFF)) do {
int check1 = 0;
int check2 = 0;
- if ((vp = fr_pair_find_by_num(request->packet->vps, 0, PW_ACCT_SESSION_TIME, TAG_ANY))
+ if ((vp = fr_pair_find_by_num(request->packet->vps, 0, FR_ACCT_SESSION_TIME, TAG_ANY))
== NULL || vp->vp_date == 0)
check1 = 1;
- if ((vp = fr_pair_find_by_num(request->packet->vps, 0, PW_ACCT_SESSION_ID, TAG_ANY))
+ if ((vp = fr_pair_find_by_num(request->packet->vps, 0, FR_ACCT_SESSION_ID, TAG_ANY))
!= NULL && vp->vp_length == 8 &&
memcmp(vp->vp_strvalue, "00000000", 8) == 0)
check2 = 1;
break;
}
RIDEBUG("Converting reboot records");
- if (status == PW_STATUS_STOP) status = PW_STATUS_ACCOUNTING_OFF;
- else if (status == PW_STATUS_START) status = PW_STATUS_ACCOUNTING_ON;
+ if (status == FR_STATUS_STOP) status = FR_STATUS_ACCOUNTING_OFF;
+ else if (status == FR_STATUS_START) status = FR_STATUS_ACCOUNTING_ON;
} while(0);
time(&t);
vp;
vp = fr_pair_cursor_next(&cursor)) {
if (!vp->da->vendor) switch (vp->da->attr) {
- case PW_LOGIN_IP_HOST:
- case PW_FRAMED_IP_ADDRESS:
+ case FR_LOGIN_IP_HOST:
+ case FR_FRAMED_IP_ADDRESS:
ut.framed_address = vp->vp_ipv4addr;
break;
- case PW_FRAMED_PROTOCOL:
+ case FR_FRAMED_PROTOCOL:
protocol = vp->vp_uint32;
break;
- case PW_NAS_IP_ADDRESS:
+ case FR_NAS_IP_ADDRESS:
ut.nas_address = vp->vp_ipv4addr;
break;
- case PW_NAS_PORT:
+ case FR_NAS_PORT:
ut.nas_port = vp->vp_uint32;
port_seen = true;
break;
- case PW_ACCT_DELAY_TIME:
+ case FR_ACCT_DELAY_TIME:
ut.delay = vp->vp_uint32;
break;
- case PW_ACCT_SESSION_ID:
+ case FR_ACCT_SESSION_ID:
/*
* If length > 8, only store the
* last 8 bytes.
sizeof(ut.session_id));
break;
- case PW_NAS_PORT_TYPE:
+ case FR_NAS_PORT_TYPE:
if (vp->vp_uint32 <= 4)
ut.porttype = porttypes[vp->vp_uint32];
break;
- case PW_CALLING_STATION_ID:
+ case FR_CALLING_STATION_ID:
if (inst->caller_id_ok) strlcpy(ut.caller_id, vp->vp_strvalue, sizeof(ut.caller_id));
break;
}
/*
* Set the protocol field.
*/
- if (protocol == PW_PPP) {
+ if (protocol == FR_PPP) {
ut.proto = 'P';
- } else if (protocol == PW_SLIP) {
+ } else if (protocol == FR_SLIP) {
ut.proto = 'S';
} else {
ut.proto = 'T';
* Hmm... we may not want to zap all of the users when the NAS comes up, because of issues with receiving
* UDP packets out of order.
*/
- if (status == PW_STATUS_ACCOUNTING_ON && (ut.nas_address != htonl(INADDR_NONE))) {
+ if (status == FR_STATUS_ACCOUNTING_ON && (ut.nas_address != htonl(INADDR_NONE))) {
RIDEBUG("NAS %s restarted (Accounting-On packet seen)", nas);
rcode = radutmp_zap(request, filename, ut.nas_address, ut.time);
goto finish;
}
- if (status == PW_STATUS_ACCOUNTING_OFF && (ut.nas_address != htonl(INADDR_NONE))) {
+ if (status == FR_STATUS_ACCOUNTING_OFF && (ut.nas_address != htonl(INADDR_NONE))) {
RIDEBUG("NAS %s rebooted (Accounting-Off packet seen)", nas);
rcode = radutmp_zap(request, filename, ut.nas_address, ut.time);
/*
* If we don't know this type of entry pretend we succeeded.
*/
- if (status != PW_STATUS_START && status != PW_STATUS_STOP && status != PW_STATUS_ALIVE) {
+ if (status != FR_STATUS_START && status != FR_STATUS_STOP && status != FR_STATUS_ALIVE) {
REDEBUG("NAS %s port %u unknown packet type %d)", nas, ut.nas_port, status);
rcode = RLM_MODULE_NOOP;
/*
* Don't compare stop records to unused entries.
*/
- if (status == PW_STATUS_STOP && u.type == P_IDLE) {
+ if (status == FR_STATUS_STOP && u.type == P_IDLE) {
continue;
}
- if ((status == PW_STATUS_STOP) && strncmp(ut.session_id, u.session_id, sizeof(u.session_id)) != 0) {
+ if ((status == FR_STATUS_STOP) && strncmp(ut.session_id, u.session_id, sizeof(u.session_id)) != 0) {
/*
* Don't complain if this is not a
* login record (some clients can
break;
}
- if ((status == PW_STATUS_START) && strncmp(ut.session_id, u.session_id, sizeof(u.session_id)) == 0 &&
+ if ((status == FR_STATUS_START) && strncmp(ut.session_id, u.session_id, sizeof(u.session_id)) == 0 &&
u.time >= ut.time) {
if (u.type == P_LOGIN) {
RIDEBUG("Login entry for NAS %s port %u duplicate", nas, u.nas_port);
* FIXME: the ALIVE record could need some more checking, but anyway I'd
* rather rewrite this mess -- miquels.
*/
- if ((status == PW_STATUS_ALIVE) && strncmp(ut.session_id, u.session_id, sizeof(u.session_id)) == 0 &&
+ if ((status == FR_STATUS_ALIVE) && strncmp(ut.session_id, u.session_id, sizeof(u.session_id)) == 0 &&
u.type == P_LOGIN) {
/*
* Keep the original login time.
* Found the entry, do start/update it with
* the information from the packet.
*/
- if ((r >= 0) && (status == PW_STATUS_START || status == PW_STATUS_ALIVE)) {
+ if ((r >= 0) && (status == FR_STATUS_START || status == FR_STATUS_ALIVE)) {
/*
* Remember where the entry was, because it's
* easier than searching through the entire file.
* The user has logged off, delete the entry by
* re-writing it in place.
*/
- if (status == PW_STATUS_STOP) {
+ if (status == FR_STATUS_STOP) {
if (r > 0) {
u.type = P_IDLE;
u.time = ut.time;
/*
* Setup some stuff, like for MPP detection.
*/
- if ((vp = fr_pair_find_by_num(request->packet->vps, 0, PW_FRAMED_IP_ADDRESS, TAG_ANY)) != NULL) {
+ if ((vp = fr_pair_find_by_num(request->packet->vps, 0, FR_FRAMED_IP_ADDRESS, TAG_ANY)) != NULL) {
ipno = vp->vp_ipv4addr;
}
- if ((vp = fr_pair_find_by_num(request->packet->vps, 0, PW_CALLING_STATION_ID, TAG_ANY)) != NULL) {
+ if ((vp = fr_pair_find_by_num(request->packet->vps, 0, FR_CALLING_STATION_ID, TAG_ANY)) != NULL) {
call_num = vp->vp_strvalue;
}
* it already ( via another rlm_realm instance ) and should return.
*/
- if (fr_pair_find_by_num(request->packet->vps, 0, PW_REALM, TAG_ANY) != NULL) {
+ if (fr_pair_find_by_num(request->packet->vps, 0, FR_REALM, TAG_ANY) != NULL) {
RDEBUG2("Request already has destination realm set. Ignoring");
return RLM_MODULE_NOOP;
}
* doesn't exist.
*
*/
- if (request->username->da->attr != PW_STRIPPED_USER_NAME) {
+ if (request->username->da->attr != FR_STRIPPED_USER_NAME) {
vp = radius_pair_create(request->packet, &request->packet->vps,
- PW_STRIPPED_USER_NAME, 0);
+ FR_STRIPPED_USER_NAME, 0);
RDEBUG2("Adding Stripped-User-Name = \"%s\"", username);
} else {
vp = request->username;
/*
* Perhaps accounting proxying was turned off.
*/
- case PW_CODE_ACCOUNTING_REQUEST:
+ case FR_CODE_ACCOUNTING_REQUEST:
if (!realm->acct_pool) {
RDEBUG2("Accounting realm is LOCAL");
return RLM_MODULE_OK;
/*
* Perhaps authentication proxying was turned off.
*/
- case PW_CODE_ACCESS_REQUEST:
+ case FR_CODE_ACCESS_REQUEST:
if (!realm->auth_pool) {
RDEBUG2("Authentication realm is LOCAL");
return RLM_MODULE_OK;
* Skip additional checks if it's not an accounting
* request.
*/
- if (request->packet->code != PW_CODE_ACCOUNTING_REQUEST) {
+ if (request->packet->code != FR_CODE_ACCOUNTING_REQUEST) {
*returnrealm = realm;
return RLM_MODULE_UPDATED;
}
* that has already proxied the request, we don't need to do
* it again.
*/
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_FREERADIUS_PROXIED_TO, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_FREERADIUS_PROXIED_TO, TAG_ANY);
if (vp && (request->packet->src_ipaddr.af == AF_INET)) {
int i;
fr_ipaddr_t my_ipaddr;
VALUE_PAIR *vp;
REALM *realm;
- if (fr_pair_find_by_num(request->packet->vps, 0, PW_REALM, TAG_ANY) != NULL) {
+ if (fr_pair_find_by_num(request->packet->vps, 0, FR_REALM, TAG_ANY) != NULL) {
RDEBUG2("Request already has destination realm set. Ignoring");
return RLM_MODULE_NOOP;
}
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_OPERATOR_NAME, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_OPERATOR_NAME, TAG_ANY);
if (!vp) return RLM_MODULE_NOOP;
/*
if (!trust_router) trust_router = "none";
/* See if the request overrides the community*/
- vp = fr_pair_find_by_num(request->packet->vps, VENDORPEC_UKERNA, PW_UKERNA_TR_COI, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, VENDORPEC_UKERNA, FR_UKERNA_TR_COI, TAG_ANY);
if (vp) {
community = vp->vp_strvalue;
} else if (community) {
/*
* Pool-Action override
*/
- vp = fr_pair_find_by_num(request->control, 0, PW_POOL_ACTION, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_POOL_ACTION, TAG_ANY);
if (vp) return mod_action(inst, request, vp->vp_uint32);
/*
* Otherwise, guess the action by Acct-Status-Type
*/
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_ACCT_STATUS_TYPE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_ACCT_STATUS_TYPE, TAG_ANY);
if (!vp) {
RDEBUG2("Couldn't find &request:Acct-Status-Type or &control:Pool-Action, doing nothing...");
return RLM_MODULE_NOOP;
}
switch (vp->vp_uint32) {
- case PW_STATUS_START:
- case PW_STATUS_ALIVE:
+ case FR_STATUS_START:
+ case FR_STATUS_ALIVE:
return mod_action(inst, request, POOL_ACTION_UPDATE);
- case PW_STATUS_STOP:
+ case FR_STATUS_STOP:
return mod_action(inst, request, POOL_ACTION_RELEASE);
- case PW_STATUS_ACCOUNTING_OFF:
- case PW_STATUS_ACCOUNTING_ON:
+ case FR_STATUS_ACCOUNTING_OFF:
+ case FR_STATUS_ACCOUNTING_ON:
return mod_action(inst, request, POOL_ACTION_BULK_RELEASE);
default:
* Unless it's overridden the default action is to allocate
* when called in Post-Auth.
*/
- vp = fr_pair_find_by_num(request->control, 0, PW_POOL_ACTION, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_POOL_ACTION, TAG_ANY);
return mod_action(inst, request, vp ? vp->vp_uint32 : POOL_ACTION_ALLOCATE);
}
* Unless it's overridden the default action is to allocate
* when called in Post-Auth.
*/
- vp = fr_pair_find_by_num(request->control, 0, PW_POOL_ACTION, TAG_ANY);
+ vp = fr_pair_find_by_num(request->control, 0, FR_POOL_ACTION, TAG_ANY);
return mod_action(inst, request, vp ? vp->vp_uint32 : POOL_ACTION_ALLOCATE);
}
CONF_SECTION *cs;
char const *insert, *trim, *expire;
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_ACCT_STATUS_TYPE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_ACCT_STATUS_TYPE, TAG_ANY);
if (!vp) {
RDEBUG("Could not find account status type in packet");
return RLM_MODULE_NOOP;
*
* This is done once per request with the same packet being sent to multiple realms.
*/
-static rlm_rcode_t rlm_replicate_alloc(RADIUS_PACKET **out, REQUEST *request, pair_lists_t list, PW_CODE code)
+static rlm_rcode_t rlm_replicate_alloc(RADIUS_PACKET **out, REQUEST *request, pair_lists_t list, FR_CODE code)
{
rlm_rcode_t rcode = RLM_MODULE_OK;
RADIUS_PACKET *packet = NULL;
/*
* For CHAP, create the CHAP-Challenge if it doesn't exist.
*/
- if ((code == PW_CODE_ACCESS_REQUEST) &&
- (fr_pair_find_by_num(request->packet->vps, 0, PW_CHAP_PASSWORD, TAG_ANY) != NULL) &&
- (fr_pair_find_by_num(request->packet->vps, 0, PW_CHAP_CHALLENGE, TAG_ANY) == NULL)) {
- vp = radius_pair_create(packet, &packet->vps, PW_CHAP_CHALLENGE, 0);
+ if ((code == FR_CODE_ACCESS_REQUEST) &&
+ (fr_pair_find_by_num(request->packet->vps, 0, FR_CHAP_PASSWORD, TAG_ANY) != NULL) &&
+ (fr_pair_find_by_num(request->packet->vps, 0, FR_CHAP_CHALLENGE, TAG_ANY) == NULL)) {
+ vp = radius_pair_create(packet, &packet->vps, FR_CHAP_CHALLENGE, 0);
fr_pair_value_memcpy(vp, request->packet->vector, AUTH_VECTOR_LEN);
}
* - #RLM_MODULE_NOOP if no replications succeeded.
* - #RLM_MODULE_OK if successful.
*/
-static rlm_rcode_t replicate_packet(UNUSED void const *instance, REQUEST *request, pair_lists_t list, PW_CODE code)
+static rlm_rcode_t replicate_packet(UNUSED void const *instance, REQUEST *request, pair_lists_t list, FR_CODE code)
{
int rcode;
bool pass1 = true;
* Send as many packets as necessary to different destinations.
*/
fr_pair_cursor_init(&cursor, &request->control);
- while ((vp = fr_pair_cursor_next_by_num(&cursor, 0, PW_REPLICATE_TO_REALM, TAG_ANY))) {
+ while ((vp = fr_pair_cursor_next_by_num(&cursor, 0, FR_REPLICATE_TO_REALM, TAG_ANY))) {
home_server_t *home;
REALM *realm;
home_pool_t *pool;
rcode = RLM_MODULE_FAIL;
goto done;
- case PW_CODE_ACCESS_REQUEST:
+ case FR_CODE_ACCESS_REQUEST:
pool = realm->auth_pool;
break;
#ifdef WITH_ACCOUNTING
- case PW_CODE_ACCOUNTING_REQUEST:
+ case FR_CODE_ACCOUNTING_REQUEST:
pool = realm->acct_pool;
break;
#endif
#ifdef WITH_COA
- case PW_CODE_COA_REQUEST:
- case PW_CODE_DISCONNECT_REQUEST:
+ case FR_CODE_COA_REQUEST:
+ case FR_CODE_DISCONNECT_REQUEST:
pool = realm->coa_pool;
break;
#endif
if (!ctx->headers) goto error_header;
fr_pair_cursor_init(&headers, &request->control);
- while (fr_pair_cursor_next_by_num(&headers, 0, PW_REST_HTTP_HEADER, TAG_ANY)) {
+ while (fr_pair_cursor_next_by_num(&headers, 0, FR_REST_HTTP_HEADER, TAG_ANY)) {
header = fr_pair_cursor_remove(&headers);
if (!strchr(header->vp_strvalue, ':')) {
RWDEBUG("Invalid HTTP header \"%s\" must be in format '<attribute>: <value>'. Skipping...",
* current request.
*/
RADIUS_LIST_AND_CTX(ctx, list, request, REQUEST_CURRENT, PAIR_LIST_REQUEST);
- if (!list || (fr_pair_update_by_num(ctx, list, 0, PW_REST_HTTP_STATUS_CODE, TAG_ANY, &value) < 0)) {
+ if (!list || (fr_pair_update_by_num(ctx, list, 0, FR_REST_HTTP_STATUS_CODE, TAG_ANY, &value) < 0)) {
REDEBUG("Failed updating &REST-HTTP-Status-Code");
return -1;
}
password = request->password;
if (!password ||
- (password->da->attr != PW_USER_PASSWORD)) {
+ (password->da->attr != FR_USER_PASSWORD)) {
REDEBUG("You set 'Auth-Type = REST' for a request that does not contain a User-Password attribute!");
return RLM_MODULE_INVALID;
}
/*
* We key the sessions off of the 'state' attribute
*/
- state = fr_pair_find_by_num(request->packet->vps, 0, PW_STATE, TAG_ANY);
+ state = fr_pair_find_by_num(request->packet->vps, 0, FR_STATE, TAG_ANY);
if (!state) {
return NULL;
}
/*
* Clear-text passwords are the only ones we support.
*/
- if (request->password->da->attr != PW_USER_PASSWORD) {
+ if (request->password->da->attr != FR_USER_PASSWORD) {
REDEBUG("Attribute \"User-Password\" is required for authentication. Cannot use \"%s\"",
request->password->da->name);
return RLM_MODULE_INVALID;
/* reply with Access-challenge message code (11) */
/* Generate Prompt attribute */
- vp = fr_pair_afrom_num(request->reply, 0, PW_PROMPT);
+ vp = fr_pair_afrom_num(request->reply, 0, FR_PROMPT);
rad_assert(vp != NULL);
vp->vp_uint32 = 0; /* no echo */
fr_pair_add(&request->reply->vps, vp);
/* Mark the packet as a Acceess-Challenge Packet */
- request->reply->code = PW_CODE_ACCESS_CHALLENGE;
+ request->reply->code = FR_CODE_ACCESS_CHALLENGE;
RDEBUG("Sending Access-Challenge");
rcode = RLM_MODULE_HANDLED;
break;
rad_assert(vec->sim.sres);
rad_assert(vec->sim.kc);
- root = fr_dict_attr_child_by_num(fr_dict_root(fr_dict_internal), PW_EAP_SIM_ROOT);
+ root = fr_dict_attr_child_by_num(fr_dict_root(fr_dict_internal), FR_EAP_SIM_ROOT);
if (!root) {
REDEBUG("Can't find dict root for EAP-SIM");
goto error;
RDEBUG2("SIM auth vector %i", i);
RINDENT();
- vp = fr_pair_afrom_child_num(request, root, PW_EAP_SIM_RAND);
+ vp = fr_pair_afrom_child_num(request, root, FR_EAP_SIM_RAND);
fr_pair_value_memsteal(vp, vec->sim.rand);
rdebug_pair(L_DBG_LVL_2, request, vp, "&control:");
fr_pair_cursor_append(&cursor, vp);
- vp = fr_pair_afrom_child_num(request, root, PW_EAP_SIM_SRES);
+ vp = fr_pair_afrom_child_num(request, root, FR_EAP_SIM_SRES);
fr_pair_value_memsteal(vp, vec->sim.sres);
rdebug_pair(L_DBG_LVL_2, request, vp, "&control:");
fr_pair_cursor_append(&cursor, vp);
- vp = fr_pair_afrom_child_num(request, root, PW_EAP_SIM_KC);
+ vp = fr_pair_afrom_child_num(request, root, FR_EAP_SIM_KC);
fr_pair_value_memsteal(vp, vec->sim.kc);
rdebug_pair(L_DBG_LVL_2, request, vp, "&control:");
fr_pair_cursor_append(&cursor, vp);
rad_assert(vec->umts.ik);
rad_assert(vec->umts.authn);
- root = fr_dict_attr_child_by_num(fr_dict_root(fr_dict_internal), PW_EAP_AKA_ROOT);
+ root = fr_dict_attr_child_by_num(fr_dict_root(fr_dict_internal), FR_EAP_AKA_ROOT);
if (!root) {
REDEBUG("Can't find dict root for EAP-AKA");
goto error;
RDEBUG2("UMTS auth vector %i", i);
RINDENT();
- vp = fr_pair_afrom_child_num(request, root, PW_EAP_AKA_RAND);
+ vp = fr_pair_afrom_child_num(request, root, FR_EAP_AKA_RAND);
fr_pair_value_memsteal(vp, vec->umts.rand);
rdebug_pair(L_DBG_LVL_2, request, vp, "&control:");
fr_pair_cursor_append(&cursor, vp);
- vp = fr_pair_afrom_child_num(request, root, PW_EAP_AKA_XRES);
+ vp = fr_pair_afrom_child_num(request, root, FR_EAP_AKA_XRES);
fr_pair_value_memsteal(vp, vec->umts.xres);
rdebug_pair(L_DBG_LVL_2, request, vp, "&control:");
fr_pair_cursor_append(&cursor, vp);
- vp = fr_pair_afrom_child_num(request, root, PW_EAP_AKA_CK);
+ vp = fr_pair_afrom_child_num(request, root, FR_EAP_AKA_CK);
fr_pair_value_memsteal(vp, vec->umts.ck);
rdebug_pair(L_DBG_LVL_2, request, vp, "&control:");
fr_pair_cursor_append(&cursor, vp);
- vp = fr_pair_afrom_child_num(request, root, PW_EAP_AKA_IK);
+ vp = fr_pair_afrom_child_num(request, root, FR_EAP_AKA_IK);
fr_pair_value_memsteal(vp, vec->umts.ik);
rdebug_pair(L_DBG_LVL_2, request, vp, "&control:");
fr_pair_cursor_append(&cursor, vp);
- vp = fr_pair_afrom_child_num(request, root, PW_EAP_AKA_AUTN);
+ vp = fr_pair_afrom_child_num(request, root, FR_EAP_AKA_AUTN);
fr_pair_value_memsteal(vp, vec->umts.authn);
rdebug_pair(L_DBG_LVL_2, request, vp, "&control:");
fr_pair_cursor_append(&cursor, vp);
/*
* There will be no point unless SoH-Supported = yes
*/
- vp[0] = fr_pair_find_by_num(request->packet->vps, 0, PW_SOH_SUPPORTED, TAG_ANY);
+ vp[0] = fr_pair_find_by_num(request->packet->vps, 0, FR_SOH_SUPPORTED, TAG_ANY);
if (!vp[0])
return 0;
if (strncasecmp(fmt, "OS", 2) == 0) {
/* OS vendor */
- vp[0] = fr_pair_find_by_num(request->packet->vps, 0, PW_SOH_MS_MACHINE_OS_VENDOR, TAG_ANY);
- vp[1] = fr_pair_find_by_num(request->packet->vps, 0, PW_SOH_MS_MACHINE_OS_VERSION, TAG_ANY);
- vp[2] = fr_pair_find_by_num(request->packet->vps, 0, PW_SOH_MS_MACHINE_OS_RELEASE, TAG_ANY);
- vp[3] = fr_pair_find_by_num(request->packet->vps, 0, PW_SOH_MS_MACHINE_OS_BUILD, TAG_ANY);
- vp[4] = fr_pair_find_by_num(request->packet->vps, 0, PW_SOH_MS_MACHINE_SP_VERSION, TAG_ANY);
- vp[5] = fr_pair_find_by_num(request->packet->vps, 0, PW_SOH_MS_MACHINE_SP_RELEASE, TAG_ANY);
+ vp[0] = fr_pair_find_by_num(request->packet->vps, 0, FR_SOH_MS_MACHINE_OS_VENDOR, TAG_ANY);
+ vp[1] = fr_pair_find_by_num(request->packet->vps, 0, FR_SOH_MS_MACHINE_OS_VERSION, TAG_ANY);
+ vp[2] = fr_pair_find_by_num(request->packet->vps, 0, FR_SOH_MS_MACHINE_OS_RELEASE, TAG_ANY);
+ vp[3] = fr_pair_find_by_num(request->packet->vps, 0, FR_SOH_MS_MACHINE_OS_BUILD, TAG_ANY);
+ vp[4] = fr_pair_find_by_num(request->packet->vps, 0, FR_SOH_MS_MACHINE_SP_VERSION, TAG_ANY);
+ vp[5] = fr_pair_find_by_num(request->packet->vps, 0, FR_SOH_MS_MACHINE_SP_RELEASE, TAG_ANY);
if (vp[0] && vp[0]->vp_uint32 == VENDORPEC_MICROSOFT) {
if (!vp[1]) {
int rv;
/* try to find the MS-SoH payload */
- vp = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, PW_MS_QUARANTINE_SOH, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MS_QUARANTINE_SOH, TAG_ANY);
if (!vp) {
RDEBUG("SoH radius VP not found");
return RLM_MODULE_NOOP;
*/
if ((inst->rcode == RLM_MODULE_HANDLED) && reply) {
switch (packet->code) {
- case PW_CODE_ACCESS_REQUEST:
- reply->code = PW_CODE_ACCESS_ACCEPT;
+ case FR_CODE_ACCESS_REQUEST:
+ reply->code = FR_CODE_ACCESS_ACCEPT;
break;
- case PW_CODE_ACCOUNTING_REQUEST:
- reply->code = PW_CODE_ACCOUNTING_RESPONSE;
+ case FR_CODE_ACCOUNTING_REQUEST:
+ reply->code = FR_CODE_ACCOUNTING_RESPONSE;
break;
- case PW_CODE_COA_REQUEST:
- reply->code = PW_CODE_COA_ACK;
+ case FR_CODE_COA_REQUEST:
+ reply->code = FR_CODE_COA_ACK;
break;
- case PW_CODE_DISCONNECT_REQUEST:
- reply->code = PW_CODE_DISCONNECT_ACK;
+ case FR_CODE_DISCONNECT_REQUEST:
+ reply->code = FR_CODE_DISCONNECT_ACK;
break;
default:
static sql_fall_through_t fall_through(VALUE_PAIR *vp)
{
VALUE_PAIR *tmp;
- tmp = fr_pair_find_by_num(vp, 0, PW_FALL_THROUGH, TAG_ANY);
+ tmp = fr_pair_find_by_num(vp, 0, FR_FALL_THROUGH, TAG_ANY);
return tmp ? tmp->vp_uint32 : FALL_THROUGH_DEFAULT;
}
/*
* Checks if attribute already exists.
*/
- if (paircompare_register_byname(group_attribute, fr_dict_attr_by_num(NULL, 0, PW_USER_NAME),
+ if (paircompare_register_byname(group_attribute, fr_dict_attr_by_num(NULL, 0, FR_USER_NAME),
false, sql_groupcmp, inst) < 0) {
PERROR("Failed registering group comparison");
goto error;
* Check for a default_profile or for a User-Profile.
*/
RDEBUG3("... falling-through to profile processing");
- user_profile = fr_pair_find_by_num(request->control, 0, PW_USER_PROFILE, TAG_ANY);
+ user_profile = fr_pair_find_by_num(request->control, 0, FR_USER_PROFILE, TAG_ANY);
char const *profile = user_profile ?
user_profile->vp_strvalue :
*/
request->simul_count = 0;
- if ((vp = fr_pair_find_by_num(request->packet->vps, 0, PW_FRAMED_IP_ADDRESS, TAG_ANY)) != NULL) {
+ if ((vp = fr_pair_find_by_num(request->packet->vps, 0, FR_FRAMED_IP_ADDRESS, TAG_ANY)) != NULL) {
ipno = vp->vp_ipv4addr;
}
- if ((vp = fr_pair_find_by_num(request->packet->vps, 0, PW_CALLING_STATION_ID, TAG_ANY)) != NULL) {
+ if ((vp = fr_pair_find_by_num(request->packet->vps, 0, FR_CALLING_STATION_ID, TAG_ANY)) != NULL) {
call_num = vp->vp_strvalue;
}
#include <freeradius-devel/modpriv.h>
#include <freeradius-devel/exfile.h>
-#define PW_ITEM_CHECK 0
-#define PW_ITEM_REPLY 1
+#define FR_ITEM_CHECK 0
+#define FR_ITEM_REPLY 1
/* SQL Errors */
* The REAL username, after stripping.
*/
if ((inst->key_attr->tmpl_list == PAIR_LIST_REQUEST) &&
- (inst->key_attr->tmpl_da->vendor == 0) && (inst->key_attr->tmpl_da->attr == PW_USER_NAME)) {
+ (inst->key_attr->tmpl_da->vendor == 0) && (inst->key_attr->tmpl_da->attr == FR_USER_NAME)) {
key_vp = request->username;
} else {
tmpl_find_vp(&key_vp, request, inst->key_attr);
* again. Do this only for Session-Timeout.
*/
if (((inst->reply_attr->tmpl_da->vendor == 0) &&
- (inst->reply_attr->tmpl_da->attr == PW_SESSION_TIMEOUT)) &&
+ (inst->reply_attr->tmpl_da->attr == FR_SESSION_TIMEOUT)) &&
inst->reset_time && (res >= (uint64_t)(inst->reset_time - request->packet->timestamp.tv_sec))) {
uint64_t to_reset = inst->reset_time - request->packet->timestamp.tv_sec;
/* if IP is already there, then nothing to do */
- vp = fr_pair_find_by_num(request->reply->vps, 0, PW_FRAMED_IP_ADDRESS, TAG_ANY);
+ vp = fr_pair_find_by_num(request->reply->vps, 0, FR_FRAMED_IP_ADDRESS, TAG_ANY);
if (vp) {
RDEBUG2("IP address already in the reply packet - exiting");
return RLM_MODULE_NOOP;
}
/* if no NAS IP address, assign 0 */
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_NAS_IP_ADDRESS, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_NAS_IP_ADDRESS, TAG_ANY);
if (vp) {
nasip = ntohl(vp->vp_ipv4addr);
}
}
/* add IP address to reply packet */
- vp = radius_pair_create(request->reply, &request->reply->vps, PW_FRAMED_IP_ADDRESS, 0);
+ vp = radius_pair_create(request->reply, &request->reply->vps, FR_FRAMED_IP_ADDRESS, 0);
vp->vp_ipv4addr = ip.s_addr;
RDEBUG2("Returning %s", inet_ntoa(ip));
rlm_sqlhpwippool_t *inst = (rlm_sqlhpwippool_t *) instance;
/* if no unique session ID, don't even try */
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_ACCT_UNIQUE_SESSION_ID, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_ACCT_UNIQUE_SESSION_ID, TAG_ANY);
if (vp) {
sessid = vp->vp_strvalue;
}
return RLM_MODULE_FAIL;
}
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_ACCT_STATUS_TYPE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_ACCT_STATUS_TYPE, TAG_ANY);
if (vp) {
acct_type = vp->vp_uint32;
}
return RLM_MODULE_FAIL;
}
- if (!(acct_type == PW_STATUS_START ||
- acct_type == PW_STATUS_ALIVE ||
- acct_type == PW_STATUS_STOP ||
- acct_type == PW_STATUS_ACCOUNTING_OFF ||
- acct_type == PW_STATUS_ACCOUNTING_ON)) {
+ if (!(acct_type == FR_STATUS_START ||
+ acct_type == FR_STATUS_ALIVE ||
+ acct_type == FR_STATUS_STOP ||
+ acct_type == FR_STATUS_ACCOUNTING_OFF ||
+ acct_type == FR_STATUS_ACCOUNTING_ON)) {
return RLM_MODULE_NOOP;
}
switch (acct_type) {
- case PW_STATUS_START:
- case PW_STATUS_ALIVE:
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_FRAMED_IP_ADDRESS, TAG_ANY);
+ case FR_STATUS_START:
+ case FR_STATUS_ALIVE:
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_FRAMED_IP_ADDRESS, TAG_ANY);
if (!vp) {
REDEBUG("No framed IP");
fr_connection_release(inst->sql_inst->pool, request, sqlsock);
nvp_finish(inst, sqlsock);
break;
- case PW_STATUS_STOP:
+ case FR_STATUS_STOP:
if (!nvp_query(inst, sqlsock,
"UPDATE `%s`.`ips`, `%1$s`.`ip_pools` "
"SET "
nvp_finish(inst, sqlsock);
break;
- case PW_STATUS_ACCOUNTING_OFF:
- case PW_STATUS_ACCOUNTING_ON:
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_NAS_IP_ADDRESS, TAG_ANY);
+ case FR_STATUS_ACCOUNTING_OFF:
+ case FR_STATUS_ACCOUNTING_ON:
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_NAS_IP_ADDRESS, TAG_ANY);
if (!vp) {
REDEBUG("No NAS IP");
fr_connection_release(inst->sql_inst->pool, request, sqlsock);
}
if (!inst->ipv6) {
- inst->framed_ip_address = PW_FRAMED_IP_ADDRESS;
+ inst->framed_ip_address = FR_FRAMED_IP_ADDRESS;
} else {
- inst->framed_ip_address = PW_FRAMED_IPV6_PREFIX;
+ inst->framed_ip_address = FR_FRAMED_IPV6_PREFIX;
}
inst->sql_inst = (rlm_sql_t *) sql_inst->data;
return do_logging(request, inst->log_exists, RLM_MODULE_NOOP);
}
- if (fr_pair_find_by_num(request->control, 0, PW_POOL_NAME, TAG_ANY) == NULL) {
+ if (fr_pair_find_by_num(request->control, 0, FR_POOL_NAME, TAG_ANY) == NULL) {
RDEBUG("No Pool-Name defined");
return do_logging(request, inst->log_nopool, RLM_MODULE_NOOP);
rlm_sqlippool_t *inst = (rlm_sqlippool_t *) instance;
rlm_sql_handle_t *handle;
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_ACCT_STATUS_TYPE, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_ACCT_STATUS_TYPE, TAG_ANY);
if (!vp) {
RDEBUG("Could not find account status type in packet");
return RLM_MODULE_NOOP;
acct_status_type = vp->vp_uint32;
switch (acct_status_type) {
- case PW_STATUS_START:
- case PW_STATUS_ALIVE:
- case PW_STATUS_STOP:
- case PW_STATUS_ACCOUNTING_ON:
- case PW_STATUS_ACCOUNTING_OFF:
+ case FR_STATUS_START:
+ case FR_STATUS_ALIVE:
+ case FR_STATUS_STOP:
+ case FR_STATUS_ACCOUNTING_ON:
+ case FR_STATUS_ACCOUNTING_OFF:
break; /* continue through to the next section */
default:
if (inst->sql_inst->sql_set_user(inst->sql_inst, request, NULL) < 0) return RLM_MODULE_FAIL;
switch (acct_status_type) {
- case PW_STATUS_START:
+ case FR_STATUS_START:
rcode = mod_accounting_start(&handle, inst, request);
break;
- case PW_STATUS_ALIVE:
+ case FR_STATUS_ALIVE:
rcode = mod_accounting_alive(&handle, inst, request);
break;
- case PW_STATUS_STOP:
+ case FR_STATUS_STOP:
rcode = mod_accounting_stop(&handle, inst, request);
break;
- case PW_STATUS_ACCOUNTING_ON:
+ case FR_STATUS_ACCOUNTING_ON:
rcode = mod_accounting_on(&handle, inst, request);
break;
- case PW_STATUS_ACCOUNTING_OFF:
+ case FR_STATUS_ACCOUNTING_OFF:
rcode = mod_accounting_off(&handle, inst, request);
break;
}
{
rlm_test_t *inst = instance;
- paircompare_register_byname("test-Paircmp", fr_dict_attr_by_num(NULL, 0, PW_USER_NAME), false,
+ paircompare_register_byname("test-Paircmp", fr_dict_attr_by_num(NULL, 0, FR_USER_NAME), false,
rlm_test_cmp, inst);
/*
inst->name = cf_section_name2(conf);
if (!inst->name) inst->name = cf_section_name1(conf);
- group_da = fr_dict_attr_by_num(fr_dict_internal, 0, PW_GROUP);
+ group_da = fr_dict_attr_by_num(fr_dict_internal, 0, FR_GROUP);
if (!group_da) {
PERROR("&Group attribute not found in dictionary");
return -1;
}
- user_name_da = fr_dict_attr_by_num(NULL, 0, PW_USER_NAME);
+ user_name_da = fr_dict_attr_by_num(NULL, 0, FR_USER_NAME);
if (!user_name_da) {
ERROR("&User-Name attribute not found in dictionary");
return -1;
* groupcmp can actually do something */
paircompare_register(group_da, user_name_da, false, groupcmp, inst);
-#ifdef PW_GROUP_NAME /* compat */
+#ifdef FR_GROUP_NAME /* compat */
{
fr_dict_attr_t const *group_name_da;
- group_name_da = fr_dict_attr_by_num(fr_dict_internal, 0, PW_GROUP_NAME);
+ group_name_da = fr_dict_attr_by_num(fr_dict_internal, 0, FR_GROUP_NAME);
if (!group_name_da) {
ERROR("&Group-Name attribute not found in dictionary");
return -1;
/*
* Which type is this.
*/
- if ((vp = fr_pair_find_by_num(request->packet->vps, 0, PW_ACCT_STATUS_TYPE, TAG_ANY)) == NULL) {
+ if ((vp = fr_pair_find_by_num(request->packet->vps, 0, FR_ACCT_STATUS_TYPE, TAG_ANY)) == NULL) {
RDEBUG("no Accounting-Status-Type attribute in request");
return RLM_MODULE_NOOP;
}
status = vp->vp_uint32;
/*
- * FIXME: handle PW_STATUS_ALIVE like 1.5.4.3 did.
+ * FIXME: handle FR_STATUS_ALIVE like 1.5.4.3 did.
*/
- if (status != PW_STATUS_START &&
- status != PW_STATUS_STOP)
+ if (status != FR_STATUS_START &&
+ status != FR_STATUS_STOP)
return RLM_MODULE_NOOP;
/*
* We're only interested in accounting messages
* with a username in it.
*/
- if (fr_pair_find_by_num(request->packet->vps, 0, PW_USER_NAME, TAG_ANY) == NULL)
+ if (fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY) == NULL)
return RLM_MODULE_NOOP;
t = request->packet->timestamp.tv_sec;
vp;
vp = fr_pair_cursor_next(&cursor)) {
if (!vp->da->vendor) switch (vp->da->attr) {
- case PW_USER_NAME:
+ case FR_USER_NAME:
if (vp->vp_length >= sizeof(ut.ut_name)) {
memcpy(ut.ut_name, vp->vp_strvalue, sizeof(ut.ut_name));
} else {
}
break;
- case PW_LOGIN_IP_HOST:
- case PW_FRAMED_IP_ADDRESS:
+ case FR_LOGIN_IP_HOST:
+ case FR_FRAMED_IP_ADDRESS:
framed_address = vp->vp_ipv4addr;
break;
#ifdef USER_PROCESS
- case PW_FRAMED_PROTOCOL:
+ case FR_FRAMED_PROTOCOL:
protocol = vp->vp_uint32;
break;
#endif
- case PW_NAS_IP_ADDRESS:
+ case FR_NAS_IP_ADDRESS:
nas_address = vp->vp_ipv4addr;
break;
- case PW_NAS_PORT:
+ case FR_NAS_PORT:
nas_port = vp->vp_uint32;
port_seen = true;
break;
- case PW_ACCT_DELAY_TIME:
+ case FR_ACCT_DELAY_TIME:
delay = vp->vp_ipv4addr;
break;
}
* And we can use the ID field to store
* the protocol.
*/
- if (protocol == PW_PPP)
+ if (protocol == FR_PPP)
strcpy(ut.ut_id, "P");
- else if (protocol == PW_SLIP)
+ else if (protocol == FR_SLIP)
strcpy(ut.ut_id, "S");
else
strcpy(ut.ut_id, "T");
- ut.ut_type = status == PW_STATUS_STOP ? DEAD_PROCESS : USER_PROCESS;
+ ut.ut_type = status == FR_STATUS_STOP ? DEAD_PROCESS : USER_PROCESS;
#endif
- if (status == PW_STATUS_STOP)
+ if (status == FR_STATUS_STOP)
ut.ut_name[0] = 0;
/*
goto nothing;
}
- da = fr_dict_attr_by_num(NULL, 0, PW_CAST_BASE + type);
+ da = fr_dict_attr_by_num(NULL, 0, FR_CAST_BASE + type);
if (!da) {
REDEBUG("Cannot decode type '%s'", data_type);
goto nothing;
/*
* Fix Calling-Station-Id. Damn you, WiMAX!
*/
- vp = fr_pair_find_by_num(request->packet->vps, 0, PW_CALLING_STATION_ID, TAG_ANY);
+ vp = fr_pair_find_by_num(request->packet->vps, 0, FR_CALLING_STATION_ID, TAG_ANY);
if (vp && (vp->vp_length == 6)) {
int i;
char *p;
uint8_t mip_rk_1[EVP_MAX_MD_SIZE], mip_rk_2[EVP_MAX_MD_SIZE];
uint8_t mip_rk[2 * EVP_MAX_MD_SIZE];
- msk = fr_pair_find_by_num(request->reply->vps, 0, PW_EAP_MSK, TAG_ANY);
- emsk = fr_pair_find_by_num(request->reply->vps, 0, PW_EAP_EMSK, TAG_ANY);
+ msk = fr_pair_find_by_num(request->reply->vps, 0, FR_EAP_MSK, TAG_ANY);
+ emsk = fr_pair_find_by_num(request->reply->vps, 0, FR_EAP_EMSK, TAG_ANY);
if (!msk || !emsk) {
RDEBUG("No EAP-MSK or EAP-EMSK. Cannot create WiMAX keys");
return RLM_MODULE_NOOP;
* the WiMAX-MSK so that the client has a key available.
*/
if (inst->delete_mppe_keys) {
- fr_pair_delete_by_num(&request->reply->vps, VENDORPEC_MICROSOFT, PW_MSCHAP_MPPE_SEND_KEY, TAG_ANY);
- fr_pair_delete_by_num(&request->reply->vps, VENDORPEC_MICROSOFT, PW_MSCHAP_MPPE_RECV_KEY, TAG_ANY);
+ fr_pair_delete_by_num(&request->reply->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_MPPE_SEND_KEY, TAG_ANY);
+ fr_pair_delete_by_num(&request->reply->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_MPPE_RECV_KEY, TAG_ANY);
vp = pair_make_reply("WiMAX-MSK", NULL, T_OP_EQ);
if (vp) {
/*
* Calculate mobility keys
*/
- mn_nai = fr_pair_find_by_num(request->packet->vps, 0, PW_WIMAX_MN_NAI, TAG_ANY);
- if (!mn_nai) mn_nai = fr_pair_find_by_num(request->reply->vps, 0, PW_WIMAX_MN_NAI, TAG_ANY);
+ mn_nai = fr_pair_find_by_num(request->packet->vps, 0, FR_WIMAX_MN_NAI, TAG_ANY);
+ if (!mn_nai) mn_nai = fr_pair_find_by_num(request->reply->vps, 0, FR_WIMAX_MN_NAI, TAG_ANY);
if (!mn_nai) {
RWDEBUG("WiMAX-MN-NAI was not found in the request or in the reply");
RWDEBUG("We cannot calculate MN-HA keys");
char const *group_attribute;
char buffer[256];
- user_name_da = fr_dict_attr_by_num(NULL, 0, PW_USER_NAME);
+ user_name_da = fr_dict_attr_by_num(NULL, 0, FR_USER_NAME);
if (!user_name_da) {
ERROR("Unable to find User-Name attribute in dictionary");
return -1;
*/
static rlm_rcode_t CC_HINT(nonnull) mod_authorize(UNUSED void *instance, UNUSED void *thread, REQUEST *request)
{
- if (!request->password || (request->password->da->attr != PW_USER_PASSWORD)) {
+ if (!request->password || (request->password->da->attr != FR_USER_PASSWORD)) {
RDEBUG("No User-Password found in the request; not doing winbind authentication.");
return RLM_MODULE_NOOP;
}
- if (fr_pair_find_by_num(request->control, 0, PW_AUTH_TYPE, TAG_ANY) != NULL) {
+ if (fr_pair_find_by_num(request->control, 0, FR_AUTH_TYPE, TAG_ANY) != NULL) {
RWDEBUG2("Auth-type already set, not setting to winbind");
return RLM_MODULE_NOOP;
}
*/
if (!request->password ||
(request->password->da->vendor != 0) ||
- (request->password->da->attr != PW_USER_PASSWORD)) {
+ (request->password->da->attr != FR_USER_PASSWORD)) {
REDEBUG("You set 'Auth-Type = winbind' for a request that does not contain a User-Password attribute!");
return RLM_MODULE_INVALID;
}
/*
* Can't do yubikey auth if there's no password.
*/
- if (!request->password || (request->password->da->attr != PW_USER_PASSWORD)) {
+ if (!request->password || (request->password->da->attr != FR_USER_PASSWORD)) {
/*
* Don't print out debugging messages if we know
* they're useless.
*/
- if (request->packet->code != PW_CODE_ACCESS_CHALLENGE) {
+ if (request->packet->code != FR_CODE_ACCESS_CHALLENGE) {
RDEBUG2("No cleartext password in the request. Can't do Yubikey authentication");
}
fr_pair_value_bstrncpy(vp, passcode, inst->id_len);
}
- dval = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, PW_AUTH_TYPE), inst->name);
+ dval = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, FR_AUTH_TYPE), inst->name);
if (dval) {
- vp = radius_pair_create(request, &request->control, PW_AUTH_TYPE, 0);
+ vp = radius_pair_create(request, &request->control, FR_AUTH_TYPE, 0);
fr_value_box_copy(NULL, &vp->data, dval->value);
}
/*
* Can't do yubikey auth if there's no password.
*/
- if (!request->password || (request->password->da->attr != PW_USER_PASSWORD)) {
+ if (!request->password || (request->password->da->attr != FR_USER_PASSWORD)) {
REDEBUG("No User-Password in the request. Can't do Yubikey authentication");
return RLM_MODULE_INVALID;
}
#define FR_DEBUG_STRERROR_PRINTF if (fr_debug_lvl) fr_strerror_printf
FR_NAME_NUMBER const fr_request_types[] = {
- { "auth", PW_CODE_ACCESS_REQUEST },
- { "challenge", PW_CODE_ACCESS_CHALLENGE },
- { "acct", PW_CODE_ACCOUNTING_REQUEST },
- { "status", PW_CODE_STATUS_SERVER },
- { "disconnect", PW_CODE_DISCONNECT_REQUEST },
- { "coa", PW_CODE_COA_REQUEST },
- { "auto", PW_CODE_UNDEFINED },
+ { "auth", FR_CODE_ACCESS_REQUEST },
+ { "challenge", FR_CODE_ACCESS_CHALLENGE },
+ { "acct", FR_CODE_ACCOUNTING_REQUEST },
+ { "status", FR_CODE_STATUS_SERVER },
+ { "disconnect", FR_CODE_DISCONNECT_REQUEST },
+ { "coa", FR_CODE_COA_REQUEST },
+ { "auto", FR_CODE_UNDEFINED },
{ NULL, 0}
};
while (msg < end) {
if ((end - msg) < 2) goto invalid_attribute;
- if (msg[0] != PW_MESSAGE_AUTHENTICATOR) {
+ if (msg[0] != FR_MESSAGE_AUTHENTICATOR) {
if (msg[1] < 2) goto invalid_attribute;
if ((msg + msg[1]) > end) {
}
switch (packet[0]) {
- case PW_CODE_ACCOUNTING_RESPONSE:
+ case FR_CODE_ACCOUNTING_RESPONSE:
if (!original) goto need_original;
- if (original[0] == PW_CODE_STATUS_SERVER) goto do_ack;
+ if (original[0] == FR_CODE_STATUS_SERVER) goto do_ack;
goto do_response;
- case PW_CODE_ACCOUNTING_REQUEST:
- case PW_CODE_DISCONNECT_REQUEST:
- case PW_CODE_DISCONNECT_ACK:
- case PW_CODE_DISCONNECT_NAK:
- case PW_CODE_COA_REQUEST:
- case PW_CODE_COA_ACK:
- case PW_CODE_COA_NAK:
+ case FR_CODE_ACCOUNTING_REQUEST:
+ case FR_CODE_DISCONNECT_REQUEST:
+ case FR_CODE_DISCONNECT_ACK:
+ case FR_CODE_DISCONNECT_NAK:
+ case FR_CODE_COA_REQUEST:
+ case FR_CODE_COA_ACK:
+ case FR_CODE_COA_NAK:
if (!original) goto need_original;
do_response:
memset(packet + 4, 0, AUTH_VECTOR_LEN);
break;
- case PW_CODE_ACCESS_ACCEPT:
- case PW_CODE_ACCESS_REJECT:
- case PW_CODE_ACCESS_CHALLENGE:
+ case FR_CODE_ACCESS_ACCEPT:
+ case FR_CODE_ACCESS_REJECT:
+ case FR_CODE_ACCESS_CHALLENGE:
do_ack:
memcpy(packet + 4, original + 4, AUTH_VECTOR_LEN);
break;
- case PW_CODE_ACCESS_REQUEST:
- case PW_CODE_STATUS_SERVER:
+ case FR_CODE_ACCESS_REQUEST:
+ case FR_CODE_STATUS_SERVER:
/* packet + 4 MUST be the Request Authenticator filled with random data */
break;
* Initialize the request authenticator.
*/
switch (packet[0]) {
- case PW_CODE_ACCOUNTING_REQUEST:
- case PW_CODE_DISCONNECT_REQUEST:
- case PW_CODE_COA_REQUEST:
+ case FR_CODE_ACCOUNTING_REQUEST:
+ case FR_CODE_DISCONNECT_REQUEST:
+ case FR_CODE_COA_REQUEST:
memset(packet + 4, 0, AUTH_VECTOR_LEN);
break;
- case PW_CODE_ACCESS_ACCEPT:
- case PW_CODE_ACCESS_REJECT:
- case PW_CODE_ACCESS_CHALLENGE:
- case PW_CODE_ACCOUNTING_RESPONSE:
- case PW_CODE_DISCONNECT_ACK:
- case PW_CODE_DISCONNECT_NAK:
- case PW_CODE_COA_ACK:
- case PW_CODE_COA_NAK:
+ case FR_CODE_ACCESS_ACCEPT:
+ case FR_CODE_ACCESS_REJECT:
+ case FR_CODE_ACCESS_CHALLENGE:
+ case FR_CODE_ACCOUNTING_RESPONSE:
+ case FR_CODE_DISCONNECT_ACK:
+ case FR_CODE_DISCONNECT_NAK:
+ case FR_CODE_COA_ACK:
+ case FR_CODE_COA_NAK:
if (!original) {
need_original:
fr_strerror_printf("Cannot sign response packet without a request packet");
* We don't need to sign anything else, so
* return.
*/
- case PW_CODE_ACCESS_REQUEST:
- case PW_CODE_STATUS_SERVER:
+ case FR_CODE_ACCESS_REQUEST:
+ case FR_CODE_STATUS_SERVER:
return 0;
default:
* Message-Authenticator is required in Status-Server
* packets, otherwise they can be trivially forged.
*/
- if (packet[0] == PW_CODE_STATUS_SERVER) require_ma = true;
+ if (packet[0] == FR_CODE_STATUS_SERVER) require_ma = true;
/*
* Repeat the length checks. This time, instead of
/*
* Track this for prioritizing ongoing EAP sessions.
*/
- case PW_STATE:
+ case FR_STATE:
if (attr[1] > 2) packet->rounds = attr[2];
break;
#endif
* If there's an EAP-Message, we require
* a Message-Authenticator.
*/
- case PW_EAP_MESSAGE:
+ case FR_EAP_MESSAGE:
require_ma = true;
break;
- case PW_MESSAGE_AUTHENTICATOR:
+ case FR_MESSAGE_AUTHENTICATOR:
if (attr[1] != 2 + AUTH_VECTOR_LEN) {
FR_DEBUG_STRERROR_PRINTF("Message-Authenticator has invalid length (%d != 18) at offset %zd",
attr[1] - 2, attr - packet);
while (msg < end) {
if ((end - msg) < 2) goto invalid_attribute;
- if (msg[0] != PW_MESSAGE_AUTHENTICATOR) {
+ if (msg[0] != FR_MESSAGE_AUTHENTICATOR) {
if (msg[1] < 2) goto invalid_attribute;
if ((msg + msg[1]) > end) {
* These are random numbers, so there's no point in
* comparing them.
*/
- if ((packet[0] == PW_CODE_ACCESS_REQUEST) || (packet[0] == PW_CODE_STATUS_SERVER)) {
+ if ((packet[0] == FR_CODE_ACCESS_REQUEST) || (packet[0] == FR_CODE_STATUS_SERVER)) {
return 0;
}
while (frag < end) {
if (last_frag ||
- (frag[0] != PW_VENDOR_SPECIFIC) ||
+ (frag[0] != FR_VENDOR_SPECIFIC) ||
(frag[1] < 9) || /* too short for wimax */
((frag + frag[1]) > end) || /* overflow */
(memcmp(frag + 2, data, 4) != 0) || /* not wimax */
child = fr_dict_attr_child_by_num(parent, p[0]);
if (!child) {
- if ((p[0] != PW_VENDOR_SPECIFIC) || (data_len < (3 + 4 + 1))) {
+ if ((p[0] != FR_VENDOR_SPECIFIC) || (data_len < (3 + 4 + 1))) {
/* da->attr < 255, da->vendor == 0 */
child = fr_dict_unknown_afrom_fields(ctx, parent, 0, p[0]);
} else {
if (!parent->flags.is_root) return 2;
- if (data[0] != PW_CHARGEABLE_USER_IDENTITY) return 2;
+ if (data[0] != FR_CHARGEABLE_USER_IDENTITY) return 2;
/*
* Hacks for CUI. The WiMAX spec says that it can be
* Use Chap-Challenge pair if present,
* Request Authenticator otherwise.
*/
- challenge = fr_pair_find_by_num(packet->vps, 0, PW_CHAP_CHALLENGE, TAG_ANY);
+ challenge = fr_pair_find_by_num(packet->vps, 0, FR_CHAP_CHALLENGE, TAG_ANY);
if (challenge) {
memcpy(ptr, challenge->vp_strvalue, challenge->vp_length);
i += challenge->vp_length;
*/
if (outlen < 9) return 0;
- if (tlv_stack[depth++]->attr != PW_VENDOR_SPECIFIC) {
+ if (tlv_stack[depth++]->attr != FR_VENDOR_SPECIFIC) {
fr_strerror_printf("%s: level[1] of tlv_stack is incorrect, must be Vendor-Specific (26)",
__FUNCTION__);
return -1;
* Build the Vendor-Specific header
*/
out = start;
- out[0] = PW_VENDOR_SPECIFIC;
+ out[0] = FR_VENDOR_SPECIFIC;
out[1] = 9;
lvalue = htonl(vp->da->vendor);
memcpy(out + 2, &lvalue, 4);
/*
* Build the Vendor-Specific header
*/
- out[0] = PW_VENDOR_SPECIFIC;
+ out[0] = FR_VENDOR_SPECIFIC;
out[1] = 6;
/*
* Only CUI is allowed to have zero length.
* Thank you, WiMAX!
*/
- if ((vp->da->attr == PW_CHARGEABLE_USER_IDENTITY) && (vp->vp_length == 0)) {
- out[0] = PW_CHARGEABLE_USER_IDENTITY;
+ if ((vp->da->attr == FR_CHARGEABLE_USER_IDENTITY) && (vp->vp_length == 0)) {
+ out[0] = FR_CHARGEABLE_USER_IDENTITY;
out[1] = 2;
vp = next_encodable(cursor);
/*
* Message-Authenticator is hard-coded.
*/
- if (!vp->da->vendor && (vp->da->attr == PW_MESSAGE_AUTHENTICATOR)) {
+ if (!vp->da->vendor && (vp->da->attr == FR_MESSAGE_AUTHENTICATOR)) {
if (outlen < 18) return -1;
- out[0] = PW_MESSAGE_AUTHENTICATOR;
+ out[0] = FR_MESSAGE_AUTHENTICATOR;
out[1] = 18;
memset(out + 2, 0, 16);
#ifndef NDEBUG
*/
if (fr_radius_attr_len(vp) == 0) {
if ((vp->da->vendor != 0) ||
- ((vp->da->attr != PW_CHARGEABLE_USER_IDENTITY) &&
- (vp->da->attr != PW_MESSAGE_AUTHENTICATOR))) {
+ ((vp->da->attr != FR_CHARGEABLE_USER_IDENTITY) &&
+ (vp->da->attr != FR_MESSAGE_AUTHENTICATOR))) {
next_encodable(cursor);
return 0;
}
packet_ctx.vector = packet->vector;
switch (packet->code) {
- case PW_CODE_ACCESS_REQUEST:
+ case FR_CODE_ACCESS_REQUEST:
break;
-
- case PW_CODE_ACCESS_ACCEPT:
- case PW_CODE_ACCESS_REJECT:
- case PW_CODE_ACCESS_CHALLENGE:
+
+ case FR_CODE_ACCESS_ACCEPT:
+ case FR_CODE_ACCESS_REJECT:
+ case FR_CODE_ACCESS_CHALLENGE:
#ifdef WITH_ACCOUNTING
- case PW_CODE_ACCOUNTING_RESPONSE:
+ case FR_CODE_ACCOUNTING_RESPONSE:
#endif
#ifdef WITH_COA
- case PW_CODE_COA_ACK:
- case PW_CODE_COA_NAK:
- case PW_CODE_DISCONNECT_ACK:
- case PW_CODE_DISCONNECT_NAK:
+ case FR_CODE_COA_ACK:
+ case FR_CODE_COA_NAK:
+ case FR_CODE_DISCONNECT_ACK:
+ case FR_CODE_DISCONNECT_NAK:
#endif
if (!original) {
fr_strerror_printf("Cannot encode response without request");
break;
#ifdef WITH_ACCOUNTING
- case PW_CODE_ACCOUNTING_REQUEST:
+ case FR_CODE_ACCOUNTING_REQUEST:
packet_ctx.vector = nullvector;
break;
#endif
#ifdef WITH_COA
- case PW_CODE_COA_REQUEST:
- case PW_CODE_DISCONNECT_REQUEST:
+ case FR_CODE_COA_REQUEST:
+ case FR_CODE_DISCONNECT_REQUEST:
packet_ctx.vector = nullvector;
break;
#endif
* Permit the admin to send BADLY formatted
* attributes with a debug build.
*/
- if (vp->da->attr == PW_RAW_ATTRIBUTE) {
+ if (vp->da->attr == FR_RAW_ATTRIBUTE) {
if (vp->vp_length > room) {
len = room;
} else {
* Set the Message-Authenticator to the correct
* length and initial value.
*/
- if (!vp->da->vendor && (vp->da->attr == PW_MESSAGE_AUTHENTICATOR)) {
+ if (!vp->da->vendor && (vp->da->attr == FR_MESSAGE_AUTHENTICATOR)) {
last_len = 16;
} else {
last_len = vp->vp_length;
packet_ctx.vector = packet->vector;
switch (packet->code) {
- case PW_CODE_ACCESS_REQUEST:
+ case FR_CODE_ACCESS_REQUEST:
break;
-
- case PW_CODE_ACCESS_ACCEPT:
- case PW_CODE_ACCESS_REJECT:
- case PW_CODE_ACCESS_CHALLENGE:
+
+ case FR_CODE_ACCESS_ACCEPT:
+ case FR_CODE_ACCESS_REJECT:
+ case FR_CODE_ACCESS_CHALLENGE:
#ifdef WITH_ACCOUNTING
- case PW_CODE_ACCOUNTING_RESPONSE:
+ case FR_CODE_ACCOUNTING_RESPONSE:
#endif
#ifdef WITH_COA
- case PW_CODE_COA_ACK:
- case PW_CODE_COA_NAK:
- case PW_CODE_DISCONNECT_ACK:
- case PW_CODE_DISCONNECT_NAK:
+ case FR_CODE_COA_ACK:
+ case FR_CODE_COA_NAK:
+ case FR_CODE_DISCONNECT_ACK:
+ case FR_CODE_DISCONNECT_NAK:
#endif
if (!original) {
fr_strerror_printf("Cannot decode response without request");
break;
#ifdef WITH_ACCOUNTING
- case PW_CODE_ACCOUNTING_REQUEST:
+ case FR_CODE_ACCOUNTING_REQUEST:
memset(packet->vector, 0, sizeof(packet->vector));
break;
#endif
#ifdef WITH_COA
- case PW_CODE_COA_REQUEST:
- case PW_CODE_DISCONNECT_REQUEST:
+ case FR_CODE_COA_REQUEST:
+ case FR_CODE_DISCONNECT_REQUEST:
memset(packet->vector, 0, sizeof(packet->vector));
break;
#endif
* codes have the Request Authenticator be the packet
* signature.
*/
- if ((packet->code == PW_CODE_ACCESS_REQUEST) ||
- (packet->code == PW_CODE_STATUS_SERVER)) {
+ if ((packet->code == FR_CODE_ACCESS_REQUEST) ||
+ (packet->code == FR_CODE_STATUS_SERVER)) {
memcpy(packet->data + 4, packet->vector, sizeof(packet->vector));
}
fprintf(fr_log_fp, "%02x %02x ", ptr[0], ptr[1]);
attrlen = ptr[1] - 2;
- if ((ptr[0] == PW_VENDOR_SPECIFIC) &&
+ if ((ptr[0] == FR_VENDOR_SPECIFIC) &&
(attrlen > 4)) {
vendor = (ptr[3] << 16) | (ptr[4] << 8) | ptr[5];
fprintf(fr_log_fp, "%02x%02x%02x%02x (%u) ",
*/
#define AUTH_PASS_LEN (AUTH_VECTOR_LEN)
#define MAX_PASS_LEN (128)
-#define FR_TUNNEL_PW_ENC_LENGTH(_x) (2 + 1 + _x + PAD(_x + 1, 16))
+#define FR_TUNNEL_FR_ENC_LENGTH(_x) (2 + 1 + _x + PAD(_x + 1, 16))
extern size_t const fr_radius_attr_sizes[FR_TYPE_MAX + 1][2];
extern FR_NAME_NUMBER const fr_request_types[];
if (buffer_len < 20) return -1;
- buffer[0] = PW_CODE_ACCESS_ACCEPT;
+ buffer[0] = FR_CODE_ACCESS_ACCEPT;
buffer[1] = pc->id;
buffer[2] = 0;
buffer[3] = 20;
MPRINT1("\t\tENCODE >>> request %zd - data %p %p room %zd\n", request->number, packet_ctx, buffer, buffer_len);
- buffer[0] = PW_CODE_ACCESS_ACCEPT;
+ buffer[0] = FR_CODE_ACCESS_ACCEPT;
buffer[1] = pc->id;
buffer[2] = 0;
buffer[3] = 20;
* Verify the packet before doing anything more with it.
*/
packet = cd->m.data;
- if (packet[0] != PW_CODE_ACCESS_REQUEST) {
+ if (packet[0] != FR_CODE_ACCESS_REQUEST) {
MPRINT1("Master ignoring packet code %u\n", packet[0]);
goto discard;
}
MPRINT1("\t\tENCODE >>> request %zd - data %p %p room %zd\n", request->number, pc, buffer, buffer_len);
- buffer[0] = PW_CODE_ACCESS_ACCEPT;
+ buffer[0] = FR_CODE_ACCESS_ACCEPT;
buffer[1] = pc->id;
buffer[2] = 0;
buffer[3] = 20;
MPRINT1("\t\tENCODE >>> request %zd - data %p %p room %zd\n", request->number, packet_ctx, buffer, buffer_len);
- buffer[0] = PW_CODE_ACCESS_ACCEPT;
+ buffer[0] = FR_CODE_ACCESS_ACCEPT;
buffer[1] = pc->id;
buffer[2] = 0;
buffer[3] = 20;
projects / thirdparty / freeradius-server.git / commitdiff
