From: Matthew Newton Date: Wed, 11 Apr 2018 14:49:08 +0000 (+0100) Subject: more rlm_yubikey dict updates, remove pair_make X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=77cb46554adf080c16741c97f224be213e60bdec;p=thirdparty%2Ffreeradius-server.git more rlm_yubikey dict updates, remove pair_make --- diff --git a/src/modules/rlm_yubikey/decrypt.c b/src/modules/rlm_yubikey/decrypt.c index 0466e0d65ef..d3e1ffb80dc 100644 --- a/src/modules/rlm_yubikey/decrypt.c +++ b/src/modules/rlm_yubikey/decrypt.c @@ -10,6 +10,12 @@ #include "rlm_yubikey.h" #ifdef HAVE_YUBIKEY +extern fr_dict_attr_t const *attr_yubikey_key; +extern fr_dict_attr_t const *attr_yubikey_private_id; +extern fr_dict_attr_t const *attr_yubikey_timestamp; +extern fr_dict_attr_t const *attr_yubikey_random; +extern fr_dict_attr_t const *attr_yubikey_counter; + /** Decrypt a Yubikey OTP AES block * * @param inst Module configuration. @@ -22,18 +28,10 @@ rlm_rcode_t rlm_yubikey_decrypt(rlm_yubikey_t const *inst, REQUEST *request, cha uint32_t counter, timestamp; yubikey_token_st token; - fr_dict_attr_t const *da; - char private_id[(YUBIKEY_UID_SIZE * 2) + 1]; VALUE_PAIR *key, *vp; - da = fr_dict_attr_by_name(NULL, "Yubikey-Key"); - if (!da) { - REDEBUG("Dictionary missing entry for 'Yubikey-Key'"); - return RLM_MODULE_FAIL; - } - - key = fr_pair_find_by_da(request->control, da, TAG_ANY); + key = fr_pair_find_by_da(request->control, attr_yubikey_key, TAG_ANY); if (!key) { REDEBUG("Yubikey-Key attribute not found in control list, can't decrypt OTP data"); return RLM_MODULE_INVALID; @@ -73,52 +71,32 @@ rlm_rcode_t rlm_yubikey_decrypt(rlm_yubikey_t const *inst, REQUEST *request, cha /* * Private ID used for validation purposes */ - vp = fr_pair_make(request, &request->packet->vps, "Yubikey-Private-ID", NULL, T_OP_SET); - if (!vp) { - REDEBUG("Failed creating Yubikey-Private-ID"); - - return RLM_MODULE_FAIL; - } + MEM(vp = pair_update_request(attr_yubikey_private_id, TAG_ANY)); fr_pair_value_memcpy(vp, token.uid, YUBIKEY_UID_SIZE); /* * Token timestamp */ - vp = fr_pair_make(request, &request->packet->vps, "Yubikey-Timestamp", NULL, T_OP_SET); - if (!vp) { - REDEBUG("Failed creating Yubikey-Timestamp"); - - return RLM_MODULE_FAIL; - } + MEM(vp = pair_update_request(attr_yubikey_timestamp, TAG_ANY)); vp->vp_uint32 = timestamp; /* * Token random */ - vp = fr_pair_make(request, &request->packet->vps, "Yubikey-Random", NULL, T_OP_SET); - if (!vp) { - REDEBUG("Failed creating Yubikey-Random"); - - return RLM_MODULE_FAIL; - } + MEM(vp = pair_update_request(attr_yubikey_random, TAG_ANY)); vp->vp_uint32 = token.rnd; /* * Combine the two counter fields together so we can do * replay attack checks. */ - vp = fr_pair_make(request, &request->packet->vps, "Yubikey-Counter", NULL, T_OP_SET); - if (!vp) { - REDEBUG("Failed creating Yubikey-Counter"); - - return RLM_MODULE_FAIL; - } + MEM(vp = pair_update_request(attr_yubikey_counter, TAG_ANY)); vp->vp_uint32 = counter; /* * Now we check for replay attacks */ - vp = fr_pair_find_by_da(request->control, da, TAG_ANY); + vp = fr_pair_find_by_da(request->control, attr_yubikey_counter, TAG_ANY); if (!vp) { RWDEBUG("Yubikey-Counter not found in control list, skipping replay attack checks"); return RLM_MODULE_OK; diff --git a/src/modules/rlm_yubikey/rlm_yubikey.c b/src/modules/rlm_yubikey/rlm_yubikey.c index f22dd0ff06e..6b0df1e287e 100644 --- a/src/modules/rlm_yubikey/rlm_yubikey.c +++ b/src/modules/rlm_yubikey/rlm_yubikey.c @@ -49,14 +49,26 @@ static const CONF_PARSER module_config[] = { static fr_dict_t const *dict_freeradius; static fr_dict_t const *dict_radius; -static fr_dict_attr_t const *attr_user_password; static fr_dict_attr_t const *attr_auth_type; +static fr_dict_attr_t const *attr_user_password; +static fr_dict_attr_t const *attr_yubikey_key; +static fr_dict_attr_t const *attr_yubikey_public_id; +static fr_dict_attr_t const *attr_yubikey_private_id; +static fr_dict_attr_t const *attr_yubikey_counter; +static fr_dict_attr_t const *attr_yubikey_timestamp; +static fr_dict_attr_t const *attr_yubikey_random; static fr_dict_attr_t const *attr_yubikey_otp; extern fr_dict_attr_autoload_t rlm_yubikey_dict_attr[]; fr_dict_attr_autoload_t rlm_yubikey_dict_attr[] = { { .out = &attr_auth_type, .name = "Auth-Type", .type = FR_TYPE_UINT32, .dict = &dict_freeradius }, { .out = &attr_user_password, .name = "User-Password", .type = FR_TYPE_STRING, .dict = &dict_radius }, + { .out = &attr_yubikey_key, .name = "Yubikey-Key", .type = FR_TYPE_OCTETS, .dict = &dict_radius }, + { .out = &attr_yubikey_public_id, .name = "Yubikey-Public-ID", .type = FR_TYPE_STRING, .dict = &dict_radius }, + { .out = &attr_yubikey_private_id, .name = "Yubikey-Private-ID", .type = FR_TYPE_OCTETS, .dict = &dict_radius }, + { .out = &attr_yubikey_counter, .name = "Yubikey-Counter", .type = FR_TYPE_UINT32, .dict = &dict_radius }, + { .out = &attr_yubikey_timestamp, .name = "Yubikey-Timestamp", .type = FR_TYPE_UINT32, .dict = &dict_radius }, + { .out = &attr_yubikey_random, .name = "Yubikey-Random", .type = FR_TYPE_UINT32, .dict = &dict_radius }, { .out = &attr_yubikey_otp, .name = "Yubikey-OTP", .type = FR_TYPE_STRING, .dict = &dict_radius }, { NULL } }; @@ -286,11 +298,8 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(void *instance, UNUSED void *t * Insert a new request attribute just containing the OTP * portion. */ - vp = pair_make_request("Yubikey-OTP", otp, T_OP_SET); - if (!vp) { - REDEBUG("Failed creating 'Yubikey-OTP' attribute"); - return RLM_MODULE_FAIL; - } + MEM(vp = pair_update_request(attr_yubikey_otp, TAG_ANY)); + fr_pair_value_strcpy(vp, otp); /* * Replace the existing string buffer for the password @@ -323,19 +332,13 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(void *instance, UNUSED void *t * It's left up to the user if they want to decode it or not. */ if (inst->id_len) { - vp = fr_pair_make(request, &request->packet->vps, "Yubikey-Public-ID", NULL, T_OP_SET); - if (!vp) { - REDEBUG("Failed creating Yubikey-Public-ID"); - - return RLM_MODULE_FAIL; - } - + MEM(vp = pair_update_request(attr_yubikey_public_id, TAG_ANY)); fr_pair_value_bstrncpy(vp, passcode, inst->id_len); } dval = fr_dict_enum_by_alias(attr_auth_type, inst->name); if (dval) { - vp = pair_add_control(attr_auth_type, TAG_ANY); + MEM(vp = pair_add_control(attr_auth_type, TAG_ANY)); fr_value_box_copy(NULL, &vp->data, dval->value); }