From: Alan T. DeKok Date: Mon, 27 Mar 2017 15:15:51 +0000 (-0400) Subject: remove inner-tunnel from EAP-PWD X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a2b2f46e6359bb93458e769013de5bf92770da9f;p=thirdparty%2Ffreeradius-server.git remove inner-tunnel from EAP-PWD --- diff --git a/raddb/README.rst b/raddb/README.rst index 1547e0c96b6..5dade792ffd 100644 --- a/raddb/README.rst +++ b/raddb/README.rst @@ -171,6 +171,12 @@ a number of users, and they made the code substantially more complicated. Experience shows that having configurable policies in ``unlang`` is preferable to having them hard-coded in C. +rlm_eap_pwd +~~~~~~~~~~~ + +The `virtual_server` configuration has been removed from EAP-PWD. The +module now looks for &request.control:Cleartext-Password. + rlm_expr ~~~~~~~~ diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap index 5f3821a3033..8fa12c81ba2 100644 --- a/raddb/mods-available/eap +++ b/raddb/mods-available/eap @@ -63,6 +63,11 @@ eap { ## EAP-PWD (Secure password-based authentication) # + # In v4, the "known good" is taken from the + # &request.control:Cleartext-Password list, as is done by + # other modules. The "inner-tunnel" virtual server is no + # longer used by EAP-PWD. + # # pwd { # group = 19 @@ -72,15 +77,6 @@ eap { # This has the same meaning as for TLS. # # fragment_size = 1020 - - # - # The virtual server which determines the "known good" password - # for the user. Note that unlike TLS, only the "authorize" - # section is processed. EAP-PWD requests can be distinguished - # by having a User-Name, but no User-Password, CHAP-Password, - # EAP-Message, etc. - # -# virtual_server = "inner-tunnel" # } ## Cisco LEAP diff --git a/src/modules/rlm_eap/types/rlm_eap_pwd/rlm_eap_pwd.c b/src/modules/rlm_eap/types/rlm_eap_pwd/rlm_eap_pwd.c index b50c7d9d0bf..34e8f19bb47 100644 --- a/src/modules/rlm_eap/types/rlm_eap_pwd/rlm_eap_pwd.c +++ b/src/modules/rlm_eap/types/rlm_eap_pwd/rlm_eap_pwd.c @@ -46,8 +46,6 @@ static CONF_PARSER submodule_config[] = { { FR_CONF_OFFSET("group", PW_TYPE_INTEGER, rlm_eap_pwd_t, group), .dflt = "19" }, { FR_CONF_OFFSET("fragment_size", PW_TYPE_INTEGER, rlm_eap_pwd_t, fragment_size), .dflt = "1020" }, { FR_CONF_OFFSET("server_id", PW_TYPE_STRING | PW_TYPE_REQUIRED, rlm_eap_pwd_t, server_id) }, - { FR_CONF_OFFSET("virtual_server", PW_TYPE_STRING | PW_TYPE_REQUIRED | PW_TYPE_NOT_EMPTY, - rlm_eap_pwd_t, virtual_server) }, CONF_PARSER_TERMINATOR }; @@ -125,7 +123,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_process(void *instance, eap_session_t *e static rlm_rcode_t mod_process(void *instance, eap_session_t *eap_session) { rlm_eap_pwd_t *inst = talloc_get_type_abort(instance, rlm_eap_pwd_t); - REQUEST *request, *fake; + REQUEST *request; pwd_session_t *session; @@ -133,7 +131,7 @@ static rlm_rcode_t mod_process(void *instance, eap_session_t *eap_session) pwd_id_packet_t *packet; eap_packet_t *response; - VALUE_PAIR *pw, *vp; + VALUE_PAIR *vp; eap_round_t *eap_round; size_t in_len; rlm_rcode_t rcode = RLM_MODULE_OK; @@ -279,65 +277,20 @@ static rlm_rcode_t mod_process(void *instance, eap_session_t *eap_session) memcpy(session->peer_id, packet->identity, session->peer_id_len); session->peer_id[session->peer_id_len] = '\0'; - /* - * Make fake request to get the password for the usable ID - */ - MEM(fake = request_alloc_fake(eap_session->request)); - - fake->username = fr_pair_afrom_num(fake->packet, 0, PW_USER_NAME); - if (!fake->username) { - RDEBUG("Failed creating pair for peer id"); - talloc_free(fake); - return RLM_MODULE_FAIL; - } - fr_pair_value_bstrncpy(fake->username, session->peer_id, session->peer_id_len); - fr_pair_add(&fake->packet->vps, fake->username); - - if ((vp = fr_pair_find_by_num(request->control, 0, PW_VIRTUAL_SERVER, TAG_ANY)) != NULL) { - fake->server = vp->vp_strvalue; - } else if (inst->virtual_server) { - fake->server = inst->virtual_server; - } /* else fake->server == request->server */ - - RDEBUG("Sending tunneled request"); - rdebug_pair_list(L_DBG_LVL_1, request, fake->packet->vps, NULL); - - RDEBUG("server %s {", fake->server); - - /* - * Call authorization recursively, which will - * get the password. - */ - RINDENT(); - process_authorize(0, fake); - REXDENT(); - - /* - * Note that we don't do *anything* with the reply - * attributes. - */ - RDEBUG2("} # server %s", fake->server); - - RDEBUG2("Got tunneled reply code %d", fake->reply->code); - rdebug_pair_list(L_DBG_LVL_2, request, fake->reply->vps, NULL); - - pw = fr_pair_find_by_num(fake->control, 0, PW_CLEARTEXT_PASSWORD, TAG_ANY); - if (!pw) { + vp = fr_pair_find_by_num(request->control, 0, PW_CLEARTEXT_PASSWORD, TAG_ANY); + if (!vp) { REDEBUG("Failed to find password for %s to do pwd authentication", session->peer_id); - talloc_free(fake); return RLM_MODULE_REJECT; } if (compute_password_element(session, session->group_num, - pw->vp_strvalue, pw->vp_length, + vp->vp_strvalue, vp->vp_length, inst->server_id, strlen(inst->server_id), session->peer_id, strlen(session->peer_id), &session->token)) { REDEBUG("Failed to obtain password element"); - talloc_free(fake); return RLM_MODULE_FAIL; } - TALLOC_FREE(fake); /* * Compute our scalar and element @@ -561,11 +514,6 @@ static int mod_instantiate(UNUSED rlm_eap_config_t const *config, void *instance return -1; } - if (!cf_section_sub_find_name2(main_config.config, "server", inst->virtual_server)) { - cf_log_err_by_name(cs, "virtual_server", "Unknown virtual server '%s'", inst->virtual_server); - return -1; - } - switch (inst->group) { case 19: case 20: