From: Alan T. DeKok Date: Sun, 25 Jun 2017 13:26:57 +0000 (-0400) Subject: rename "process pap" etc. to "authenticate pap" etc. X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=57e4e468fb6e27b2da69b47741c6ae047b910b4c;p=thirdparty%2Ffreeradius-server.git rename "process pap" etc. to "authenticate pap" etc. Confusing for v3 to v4 transition, but much clearer for the new v4 style of naming. And update the example virtual servers with the new names --- diff --git a/raddb/sites-available/README b/raddb/sites-available/README index 1990afdae7c..fd1a1e55d48 100644 --- a/raddb/sites-available/README +++ b/raddb/sites-available/README @@ -1,6 +1,6 @@ 1. Virtual Servers. - FreeRADIUS 2.0 supports virtual servers. This is probably the + FreeRADIUS 4.0 supports virtual servers. This is probably the single largest change that is NOT backwards compatible with 1.x. The virtual servers do NOT have to be set up with the @@ -12,7 +12,7 @@ one "radiusd.conf" file, and put the server configuration there: recv Access-Request { ... } - process Access-Request { + authenticate pap { ... } ... @@ -62,7 +62,7 @@ the request processing sections from radius.conf, ("authorize" , pap } - process Access-Request { + authenticate pap { pap } } diff --git a/raddb/sites-available/abfab-tr-idp b/raddb/sites-available/abfab-tr-idp index 6ebce140ead..0ff154a3863 100644 --- a/raddb/sites-available/abfab-tr-idp +++ b/raddb/sites-available/abfab-tr-idp @@ -42,16 +42,16 @@ recv Access-Request { logintime } -process Access-Request { +authenticate eap { # # Allow EAP authentication. eap } -# Post-Authentication -# Once we KNOW that the user has been authenticated, there are -# additional steps we can take. -post-auth { +# +# Run these rules when sending an Access-Accept +# +send Access-Accept { # # For EAP-TTLS and PEAP, add the cached attributes to the reply. # The "session-state" attributes are automatically cached when @@ -94,31 +94,34 @@ post-auth { # For Exec-Program and Exec-Program-Wait exec + # Remove reply message if the response contains an EAP-Message remove_reply_message_if_eap - # Access-Reject packets are sent through the REJECT sub-section of the - # post-auth section. - # - # Add the ldap module name (or instance) if you have set - # 'edir_account_policy_check = yes' in the ldap module configuration - # - Post-Auth-Type REJECT { - # log failed authentications in SQL, too. - -sql - attr_filter.access_reject - - # Insert EAP-Failure message if the request was - # rejected by policy instead of because of an - # authentication failure And already has an EAP message - # For non-ABFAB, we insert the failure all the time, but for ABFAB - # It's more desirable to preserve reply-message when we can - if (&reply:Eap-Message) { - eap - } - - # Remove reply message if the response contains an EAP-Message - remove_reply_message_if_eap +} + +# +# Run these rules for sending an Access-Reject +# +# Add the ldap module name (or instance) if you have set +# 'edir_account_policy_check = yes' in the ldap module configuration +# +send Access-Reject { + # log failed authentications in SQL, too. + -sql + attr_filter.access_reject + + # Insert EAP-Failure message if the request was + # rejected by policy instead of because of an + # authentication failure And already has an EAP message + # For non-ABFAB, we insert the failure all the time, but for ABFAB + # It's more desirable to preserve reply-message when we can + if (&reply:Eap-Message) { + eap } + + # Remove reply message if the response contains an EAP-Message + remove_reply_message_if_eap + } # # When the server decides to proxy a request to a home server, diff --git a/raddb/sites-available/buffered-sql b/raddb/sites-available/buffered-sql index b9a9373ef14..411b6ba7494 100644 --- a/raddb/sites-available/buffered-sql +++ b/raddb/sites-available/buffered-sql @@ -143,7 +143,7 @@ server buffered-sql { # # Accounting. Log the accounting data. # - process Accounting-Request { + send Accounting-Response { # # Log traffic to an SQL database. # diff --git a/raddb/sites-available/challenge b/raddb/sites-available/challenge index 94834d2b456..af852fd4b0a 100644 --- a/raddb/sites-available/challenge +++ b/raddb/sites-available/challenge @@ -42,35 +42,34 @@ recv Access-Request { } } -process Access-Request { - Auth-Type Step1 { - # If the password doesn't match, the user is rejected - # immediately. - pap - # - # Set the random number to save. - # - update session-state { - Tmp-Integer-0 := "%{randstr:n}" - } - update reply { - Reply-Message := &session-state:Tmp-Integer-0 - } +authenticate Step1 { + # If the password doesn't match, the user is rejected + # immediately. + pap - # - # Send an Access-Challenge. - # See raddb/policy.d/control for the definition - # of "challenge" - # - challenge + # + # Set the random number to save. + # + update session-state { + Tmp-Integer-0 := "%{randstr:n}" } - - Auth-Type Step2 { - # - # Do PAP authentication with the password. - # - pap + update reply { + Reply-Message := &session-state:Tmp-Integer-0 } + + # + # Send an Access-Challenge. + # See raddb/policy.d/control for the definition + # of "challenge" + # + challenge +} + +authenticate Step2 { + # + # Do PAP authentication with the password. + # + pap } } diff --git a/raddb/sites-available/copy-acct-to-home-server b/raddb/sites-available/copy-acct-to-home-server index b239b9b94ad..fe4cb7ea0aa 100644 --- a/raddb/sites-available/copy-acct-to-home-server +++ b/raddb/sites-available/copy-acct-to-home-server @@ -138,7 +138,7 @@ server copy-acct-to-home-server { # # Accounting. Log the accounting data. # - process Accounting-Request { + send Accounting-Response { # # Since we're proxying, we don't log anything # locally. Ensure that the accounting section diff --git a/raddb/sites-available/decoupled-accounting b/raddb/sites-available/decoupled-accounting index ff9a15a53bd..f13fd0e94b7 100644 --- a/raddb/sites-available/decoupled-accounting +++ b/raddb/sites-available/decoupled-accounting @@ -23,7 +23,7 @@ # Any "listen" section that listens on an accounting port should # set "virtual_server = write-detail.example.com server write_detail.example.com { - process Accounting-Request { + recv Accounting-Request { # # Write the "detail" files. # @@ -81,7 +81,7 @@ recv Accounting-Request { # # Accounting. Log the accounting data. # -process Accounting-Request { +send Accounting-Response { # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied diff --git a/raddb/sites-available/example b/raddb/sites-available/example index 7255e82e9ea..ef6f71489ef 100644 --- a/raddb/sites-available/example +++ b/raddb/sites-available/example @@ -106,16 +106,13 @@ server example { reject } - process Access-Request { + send Access-Accept { } - post-auth { - - Post-Auth-Type Reject { - update reply { - &Reply-Message = 'This is only an example.' - } + send Access-Reject { + update reply { + &Reply-Message = 'This is only an example.' } } diff --git a/raddb/sites-available/inner-tunnel b/raddb/sites-available/inner-tunnel index 394ab3efaef..55c745a86e9 100644 --- a/raddb/sites-available/inner-tunnel +++ b/raddb/sites-available/inner-tunnel @@ -199,52 +199,54 @@ recv Access-Request { # # NB You cannot forcibly accept an EAP authentication! -process Access-Request { - # - # PAP authentication, when a back-end database listed - # in the 'authorize' section supplies a password. The - # password can be clear-text, or encrypted. - Auth-Type PAP { - pap - } +# +# PAP authentication, when a back-end database listed +# in the 'authorize' section supplies a password. The +# password can be clear-text, or encrypted. +authenticate PAP { + pap +} - # - # Most people want CHAP authentication - # A back-end database listed in the 'authorize' section - # MUST supply a CLEAR TEXT password. Encrypted passwords - # won't work. - Auth-Type CHAP { - chap - } +# +# Most people want CHAP authentication +# A back-end database listed in the 'authorize' section +# MUST supply a CLEAR TEXT password. Encrypted passwords +# won't work. +authenticate CHAP { + chap +} - # - # MSCHAP authentication. - Auth-Type MS-CHAP { - mschap - } +# +# MSCHAP authentication. +authenticate MS-CHAP { + mschap +} - # - # Pluggable Authentication Modules. -# pam +# +# Pluggable Authentication Modules. +authenticate pam { + pam +} - # Uncomment it if you want to use ldap for authentication - # - # Note that this means "check plain-text password against - # the ldap database", which means that EAP won't work, - # as it does not supply a plain-text password. - # - # We do NOT recommend using this. LDAP servers are databases. - # They are NOT authentication servers. FreeRADIUS is an - # authentication server, and knows what to do with authentication. - # LDAP servers do not. - # -# Auth-Type LDAP { -# ldap -# } +# Uncomment it if you want to use ldap for authentication +# +# Note that this means "check plain-text password against +# the ldap database", which means that EAP won't work, +# as it does not supply a plain-text password. +# +# We do NOT recommend using this. LDAP servers are databases. +# They are NOT authentication servers. FreeRADIUS is an +# authentication server, and knows what to do with authentication. +# LDAP servers do not. +# +authenticate LDAP { + ldap +} - # - # Allow EAP authentication. - eap +# +# Allow EAP authentication. +authenticate eap { + eap } ###################################################################### @@ -280,7 +282,7 @@ session { # If you need to send a reply attribute in the outer session, # the ONLY safe way is to set "use_tunneled_reply = yes", and # then update the inner-tunnel reply. -post-auth { +send Access-Accept { # If you want privacy to remain, see the # Chargeable-User-Identity attribute from RFC 4372. # If you want to use it just uncomment the line below. @@ -341,6 +343,7 @@ post-auth { &outer.session-state: += &reply: } } +} # # Access-Reject packets are sent through the REJECT sub-section of the @@ -349,17 +352,16 @@ post-auth { # Add the ldap module name (or instance) if you have set # 'edir_account_policy_check = yes' in the ldap module configuration # - Post-Auth-Type REJECT { - # log failed authentications in SQL, too. - -sql - attr_filter.access_reject +send Access-Reject { + # log failed authentications in SQL, too. + -sql + attr_filter.access_reject - # - # Let the outer session know which module failed, and why. - # - update outer.session-state { - &Module-Failure-Message := &request:Module-Failure-Message - } + # + # Let the outer session know which module failed, and why. + # + update outer.session-state { + &Module-Failure-Message := &request:Module-Failure-Message } } diff --git a/raddb/sites-available/proxy-inner-tunnel b/raddb/sites-available/proxy-inner-tunnel index 7010f78949f..39495563d44 100644 --- a/raddb/sites-available/proxy-inner-tunnel +++ b/raddb/sites-available/proxy-inner-tunnel @@ -28,7 +28,7 @@ recv Access-Request { } } -process Access-Request { +authenticate eap { # # This is necessary so that the inner tunnel EAP-MSCHAPv2 # method can be called. That method takes care of turning diff --git a/raddb/sites-available/robust-proxy-accounting b/raddb/sites-available/robust-proxy-accounting index 62cdfa7e9bd..ad7b5eec7d5 100644 --- a/raddb/sites-available/robust-proxy-accounting +++ b/raddb/sites-available/robust-proxy-accounting @@ -146,7 +146,7 @@ server home.example.com { # # When the home servers come back up, the packets are forwarded, # and the detail file processed as normal. - process Accounting-Request { + recv Accounting-Request { # You may want accounting policies here... update control { diff --git a/raddb/sites-available/tacacs b/raddb/sites-available/tacacs index 0347cf75587..0734ba35ac8 100644 --- a/raddb/sites-available/tacacs +++ b/raddb/sites-available/tacacs @@ -241,26 +241,26 @@ server tacacs { send Authorization { } - recv process Accounting-Request { + recv Accounting-Request { update config { &Auth-Type = Accept } } - send process Accounting-Request { + send Accounting-Response { } # Proxying of TACACS+ requests is NOT supported. - process MSCHAP { + authenticate MSCHAP { mschap } - process CHAP { + authenticate CHAP { chap } - process PAP { + authenticate PAP { pap } } diff --git a/raddb/sites-available/virtual.example.com b/raddb/sites-available/virtual.example.com index 9ffa831647f..df3fd95575a 100644 --- a/raddb/sites-available/virtual.example.com +++ b/raddb/sites-available/virtual.example.com @@ -24,7 +24,7 @@ recv Access-Request { # insert policies here } -process Access-Request { +send Access-Accept { # insert policies here } diff --git a/src/modules/proto_radius/proto_radius_auth.c b/src/modules/proto_radius/proto_radius_auth.c index 0b3dd5b48e4..3ad6ba54878 100644 --- a/src/modules/proto_radius/proto_radius_auth.c +++ b/src/modules/proto_radius/proto_radius_auth.c @@ -257,14 +257,14 @@ static fr_io_final_t mod_process(REQUEST *request, UNUSED fr_io_action_t action) goto setup_send; } - unlang = cf_section_find(request->server_cs, "process", dv->alias); + unlang = cf_section_find(request->server_cs, "authenticate", dv->alias); if (!unlang) { - REDEBUG2("No 'process %s' section found: rejecting the user", dv->alias); + REDEBUG2("No 'authenticate %s' section found: rejecting the user", dv->alias); request->reply->code = FR_CODE_ACCESS_REJECT; goto setup_send; } - RDEBUG("Running 'process %s' from file %s", cf_section_name2(unlang), cf_filename(unlang)); + RDEBUG("Running 'authenticate %s' from file %s", cf_section_name2(unlang), cf_filename(unlang)); unlang_push_section(request, unlang, RLM_MODULE_NOTFOUND); request->request_state = REQUEST_PROCESS; @@ -568,19 +568,19 @@ static int auth_listen_compile(CONF_SECTION *server_cs, UNUSED CONF_SECTION *lis rcode = auth_compile_section(server_cs, "send", "Access-Challenge", MOD_POST_AUTH); if (rcode < 0) return rcode; - while ((subcs = cf_section_find_next(server_cs, subcs, "process", NULL))) { + while ((subcs = cf_section_find_next(server_cs, subcs, "authenticate", NULL))) { char const *name2; name2 = cf_section_name2(subcs); if (!name2) { - cf_log_err(subcs, "Cannot compile 'process { ... }' section"); + cf_log_err(subcs, "An name is required for the 'authenticate { ... }' section"); return -1; } - cf_log_debug(subcs, "Loading process %s {...}", name2); + cf_log_debug(subcs, "Loading authenticate %s {...}", name2); if (unlang_compile(subcs, MOD_AUTHENTICATE) < 0) { - cf_log_err(subcs, "Failed compiling 'process %s { ... }' section", name2); + cf_log_err(subcs, "Failed compiling 'authenticate %s { ... }' section", name2); return -1; } } @@ -605,14 +605,14 @@ static int mod_bootstrap(UNUSED void *instance, CONF_SECTION *listen_cs) return -1; } - while ((subcs = cf_section_find_next(server_cs, subcs, "process", CF_IDENT_ANY))) { + while ((subcs = cf_section_find_next(server_cs, subcs, "authenticate", CF_IDENT_ANY))) { char const *name2; fr_value_box_t value = { .type = FR_TYPE_UINT32 }; fr_dict_enum_t *dv; name2 = cf_section_name2(subcs); if (!name2) { - cf_log_err(subcs, "Invalid 'process { ... }' section, it must have a name"); + cf_log_err(subcs, "Invalid 'authenticate { ... }' section, it must have a name"); return -1; } @@ -655,19 +655,19 @@ static int mod_instantiate(UNUSED void *instance, CONF_SECTION *listen_cs) if (auth_listen_compile(server_cs, listen_cs) < 0) return -1; - while ((subcs = cf_section_find_next(server_cs, subcs, "process", CF_IDENT_ANY))) { + while ((subcs = cf_section_find_next(server_cs, subcs, "authenticate", CF_IDENT_ANY))) { int rcode; char const *name2; name2 = cf_section_name2(subcs); if (!name2) { - cf_log_err(subcs, "Invalid 'process { ... }' section, it must have a name"); + cf_log_err(subcs, "Invalid 'authenticate { ... }' section, it must have a name"); return -1; } - rcode = auth_compile_section(server_cs, "process", name2, MOD_AUTHENTICATE); + rcode = auth_compile_section(server_cs, "authenticate", name2, MOD_AUTHENTICATE); if (rcode < 0) { - cf_log_err(subcs, "Failed compiling 'process %s { ... }' section", name2); + cf_log_err(subcs, "Failed compiling 'authenticate %s { ... }' section", name2); return -1; } }