From: Arran Cudbard-Bell Date: Mon, 26 Jun 2017 22:10:47 +0000 (-0400) Subject: Call old/new servers sections in eap methods X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=532591ff740b184cb5239a8f180cf54e86264cbb;p=thirdparty%2Ffreeradius-server.git Call old/new servers sections in eap methods --- diff --git a/src/modules/rlm_eap/types/rlm_eap_gtc/rlm_eap_gtc.c b/src/modules/rlm_eap/types/rlm_eap_gtc/rlm_eap_gtc.c index 8106894e644..7fe288e599b 100644 --- a/src/modules/rlm_eap/types/rlm_eap_gtc/rlm_eap_gtc.c +++ b/src/modules/rlm_eap/types/rlm_eap_gtc/rlm_eap_gtc.c @@ -40,8 +40,7 @@ RCSID("$Id$") typedef struct rlm_eap_gtc_t { char const *challenge; char const *auth_type_name; - int auth_type; - fr_dict_enum_t const *dval; + uint32_t auth_type; } rlm_eap_gtc_t; static CONF_PARSER submodule_config[] = { @@ -128,12 +127,12 @@ static rlm_rcode_t mod_process(void *instance, eap_session_t *eap_session) */ request->password = vp; - unlang = cf_section_find(request->server_cs, "authenticate", inst->dval->alias); + unlang = cf_section_find(request->server_cs, "authenticate", inst->auth_type_name); if (!unlang) { /* * Call the authenticate section of the *current* virtual server. */ - rcode = process_authenticate(inst->dval->value->vb_uint32, request); + rcode = process_authenticate(inst->auth_type, request); if (rcode != RLM_MODULE_OK) { eap_round->request->code = FR_EAP_CODE_FAILURE; return rcode; @@ -208,7 +207,8 @@ static int mod_instantiate(void *instance, CONF_SECTION *cs) cf_log_err_by_name(cs, "auth_type", "Unknown Auth-Type %s", inst->auth_type_name); return -1; } - inst->dval = dval; + inst->auth_type = dval->value->vb_uint32; + inst->auth_type_name = dval->alias; /* Corrects case mismatches */ return 0; } diff --git a/src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c b/src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c index 6ac7570ae94..9ad7eb65f68 100644 --- a/src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c +++ b/src/modules/rlm_eap/types/rlm_eap_mschapv2/rlm_eap_mschapv2.c @@ -30,10 +30,11 @@ RCSID("$Id$") #include typedef struct rlm_eap_mschapv2_t { - bool with_ntdomain_hack; - bool send_error; - char const *identity; - int auth_type_mschap; + bool with_ntdomain_hack; + bool send_error; + char const *identity; + int auth_type_mschap; + char const *auth_type_mschap_name; } rlm_eap_mschapv2_t; static CONF_PARSER submodule_config[] = { @@ -280,6 +281,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_process(void *arg, eap_session_t *eap_se VALUE_PAIR *auth_challenge, *response, *name; rlm_eap_mschapv2_t *inst = (rlm_eap_mschapv2_t *) arg; REQUEST *request = eap_session->request; + CONF_SECTION *unlang; if (!rad_cond_assert(eap_session->inst)) return 0; @@ -573,7 +575,14 @@ packet_ready: /* * This is a wild & crazy hack. */ - rcode = process_authenticate(inst->auth_type_mschap, request); + + unlang = cf_section_find(request->server_cs, "authenticate", inst->auth_type_mschap_name); + if (!unlang) { + rcode = process_authenticate(inst->auth_type_mschap, request); + } else { + unlang_push_section(request, unlang, RLM_MODULE_FAIL); + rcode = unlang_interpret_continue(request); + } /* * Delete MPPE keys & encryption policy. We don't @@ -745,7 +754,7 @@ static rlm_rcode_t mod_session_init(void *instance, eap_session_t *eap_session) static int mod_instantiate(void *instance, CONF_SECTION *cs) { rlm_eap_mschapv2_t *inst = talloc_get_type_abort(instance, rlm_eap_mschapv2_t); - fr_dict_enum_t const *dv; + fr_dict_enum_t const *enumv; if (inst->identity && (strlen(inst->identity) > 255)) { cf_log_err(cs, "identity is too long"); @@ -754,13 +763,14 @@ static int mod_instantiate(void *instance, CONF_SECTION *cs) if (!inst->identity) inst->identity = talloc_asprintf(inst, "freeradius-%s", RADIUSD_VERSION_STRING); - dv = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, FR_AUTH_TYPE), "MS-CHAP"); - if (!dv) dv = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, FR_AUTH_TYPE), "MSCHAP"); - if (!dv) { + enumv = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, FR_AUTH_TYPE), "MS-CHAP"); + if (!enumv) enumv = fr_dict_enum_by_alias(NULL, fr_dict_attr_by_num(NULL, 0, FR_AUTH_TYPE), "MSCHAP"); + if (!enumv) { cf_log_err(cs, "Failed to find 'Auth-Type MS-CHAP' section. Cannot authenticate users."); return -1; } - inst->auth_type_mschap = dv->value->vb_uint32; + inst->auth_type_mschap = enumv->value->vb_uint32; + inst->auth_type_mschap_name = enumv->alias; return 0; } diff --git a/src/modules/rlm_eap/types/rlm_eap_peap/eap_peap.h b/src/modules/rlm_eap/types/rlm_eap_peap/eap_peap.h index 236510dbdf6..f9f9bcf9078 100644 --- a/src/modules/rlm_eap/types/rlm_eap_peap/eap_peap.h +++ b/src/modules/rlm_eap/types/rlm_eap_peap/eap_peap.h @@ -68,5 +68,5 @@ typedef struct peap_tunnel_t { /* * Process the PEAP portion of an EAP-PEAP request. */ -rlm_rcode_t eap_peap_process(eap_session_t *eap_session, tls_session_t *tls_session, int auth_type_eap) CC_HINT(nonnull); +rlm_rcode_t eap_peap_process(eap_session_t *eap_session, tls_session_t *tls_session, fr_dict_enum_t const *enumv) CC_HINT(nonnull(1,2)); #endif /* _EAP_PEAP_H */ diff --git a/src/modules/rlm_eap/types/rlm_eap_peap/peap.c b/src/modules/rlm_eap/types/rlm_eap_peap/peap.c index 5428d2a7c2d..f09bc057404 100644 --- a/src/modules/rlm_eap/types/rlm_eap_peap/peap.c +++ b/src/modules/rlm_eap/types/rlm_eap_peap/peap.c @@ -618,7 +618,7 @@ static char const *peap_state(peap_tunnel_t *t) /* * Process the pseudo-EAP contents of the tunneled data. */ -rlm_rcode_t eap_peap_process(eap_session_t *eap_session, tls_session_t *tls_session, int auth_type_eap) +rlm_rcode_t eap_peap_process(eap_session_t *eap_session, tls_session_t *tls_session, fr_dict_enum_t const *enumv) { peap_tunnel_t *t = tls_session->opaque; REQUEST *fake = NULL; @@ -914,6 +914,7 @@ rlm_rcode_t eap_peap_process(eap_session_t *eap_session, tls_session_t *tls_sess * done, THEN we proxy it... */ if (!t->proxy_tunneled_request_as_eap) { + CONF_SECTION *unlang; fake->options |= RAD_REQUEST_OPTION_PROXY_EAP; /* @@ -921,7 +922,7 @@ rlm_rcode_t eap_peap_process(eap_session_t *eap_session, tls_session_t *tls_sess * Auth-Type & EAP-Message here? */ - if (!auth_type_eap) { + if (!enumv) { RERROR("You must set 'inner_eap_module' in the 'peap' configuration"); RERROR("This is required in order to proxy the inner EAP session."); rcode = RLM_MODULE_REJECT; @@ -932,7 +933,15 @@ rlm_rcode_t eap_peap_process(eap_session_t *eap_session, tls_session_t *tls_sess * Run the EAP authentication. */ RDEBUG2("Calling authenticate in order to initiate tunneled EAP session"); - rcode = process_authenticate(auth_type_eap, fake); + + unlang = cf_section_find(request->server_cs, "authenticate", enumv->alias); + if (!unlang) { + rcode = process_authenticate(enumv->value->vb_uint32, fake); + } else { + unlang_push_section(request, unlang, RLM_MODULE_FAIL); + rcode = unlang_interpret_continue(request); + } + if (rcode == RLM_MODULE_OK) { /* * Authentication succeeded! Rah! diff --git a/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c b/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c index 4bc17f51584..8ee8a822d2f 100644 --- a/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c +++ b/src/modules/rlm_eap/types/rlm_eap_peap/rlm_eap_peap.c @@ -31,7 +31,7 @@ typedef struct rlm_eap_peap_t { fr_tls_conf_t *tls_conf; char const *inner_eap_module; //!< module name for inner EAP - int auth_type_eap; + fr_dict_enum_t *auth_type_eap; bool use_tunneled_reply; //!< Use the reply attributes from the tunneled session in //!< the non-tunneled reply to the client. @@ -319,7 +319,7 @@ static int mod_instantiate(void *instance, CONF_SECTION *cs) "The server cannot proxy inner-tunnel EAP packets", inst->inner_eap_module, inst->virtual_server); } else { - inst->auth_type_eap = dv->value->vb_uint32; + inst->auth_type_eap = dv; } return 0;