#define ACB_AUTOLOCK 0x04000000 //!< Account auto locked.
#define ACB_FR_EXPIRED 0x00020000 //!< Password Expired.
+static const CONF_PARSER passchange_config[] = {
+ { FR_CONF_OFFSET("ntlm_auth", FR_TYPE_STRING | FR_TYPE_XLAT, rlm_mschap_t, ntlm_cpw) },
+ { FR_CONF_OFFSET("ntlm_auth_username", FR_TYPE_STRING | FR_TYPE_XLAT, rlm_mschap_t, ntlm_cpw_username) },
+ { FR_CONF_OFFSET("ntlm_auth_domain", FR_TYPE_STRING | FR_TYPE_XLAT, rlm_mschap_t, ntlm_cpw_domain) },
+ { FR_CONF_OFFSET("local_cpw", FR_TYPE_STRING | FR_TYPE_XLAT, rlm_mschap_t, local_cpw) },
+ CONF_PARSER_TERMINATOR
+};
+
+static const CONF_PARSER module_config[] = {
+ /*
+ * Cache the password by default.
+ */
+ { FR_CONF_OFFSET("use_mppe", FR_TYPE_BOOL, rlm_mschap_t, use_mppe), .dflt = "yes" },
+ { FR_CONF_OFFSET("require_encryption", FR_TYPE_BOOL, rlm_mschap_t, require_encryption), .dflt = "no" },
+ { FR_CONF_OFFSET("require_strong", FR_TYPE_BOOL, rlm_mschap_t, require_strong), .dflt = "no" },
+ { FR_CONF_OFFSET("with_ntdomain_hack", FR_TYPE_BOOL, rlm_mschap_t, with_ntdomain_hack), .dflt = "yes" },
+ { FR_CONF_OFFSET("ntlm_auth", FR_TYPE_STRING | FR_TYPE_XLAT, rlm_mschap_t, ntlm_auth) },
+ { FR_CONF_OFFSET("ntlm_auth_timeout", FR_TYPE_UINT32, rlm_mschap_t, ntlm_auth_timeout) },
+ { FR_CONF_POINTER("passchange", FR_TYPE_SUBSECTION, NULL), .subcs = (void const *) passchange_config },
+ { FR_CONF_OFFSET("allow_retry", FR_TYPE_BOOL, rlm_mschap_t, allow_retry), .dflt = "yes" },
+ { FR_CONF_OFFSET("retry_msg", FR_TYPE_STRING, rlm_mschap_t, retry_msg) },
+ { FR_CONF_OFFSET("winbind_username", FR_TYPE_TMPL, rlm_mschap_t, wb_username) },
+ { FR_CONF_OFFSET("winbind_domain", FR_TYPE_TMPL, rlm_mschap_t, wb_domain) },
+#ifdef WITH_AUTH_WINBIND
+ { FR_CONF_OFFSET("winbind_retry_with_normalised_username", FR_TYPE_BOOL, rlm_mschap_t, wb_retry_with_normalised_username), .dflt = "no" },
+#endif
+#ifdef __APPLE__
+ { FR_CONF_OFFSET("use_open_directory", FR_TYPE_BOOL, rlm_mschap_t, open_directory), .dflt = "yes" },
+#endif
+ CONF_PARSER_TERMINATOR
+};
+
+static fr_dict_t const *dict_freeradius;
+static fr_dict_t const *dict_radius;
+
+static fr_dict_attr_t const *attr_auth_type;
+static fr_dict_attr_t const *attr_cleartext_password;
+static fr_dict_attr_t const *attr_nt_password;
+static fr_dict_attr_t const *attr_lm_password;
+static fr_dict_attr_t const *attr_ms_chap_use_ntlm_auth;
+
+fr_dict_attr_t const *attr_ms_chap_user_name;
+
+static fr_dict_attr_t const *attr_ms_chap_peer_challenge;
+static fr_dict_attr_t const *attr_ms_chap_new_nt_password;
+static fr_dict_attr_t const *attr_ms_chap_new_cleartext_password;
+static fr_dict_attr_t const *attr_smb_account_ctrl;
+static fr_dict_attr_t const *attr_smb_account_ctrl_text;
+
+static fr_dict_attr_t const *attr_user_name;
+static fr_dict_attr_t const *attr_ms_chap_error;
+
+fr_dict_attr_t const *attr_ms_chap_challenge;
+fr_dict_attr_t const *attr_ms_chap_response;
+fr_dict_attr_t const *attr_ms_chap2_response;
+fr_dict_attr_t const *attr_ms_chap2_success;
+
+static fr_dict_attr_t const *attr_ms_chap_mppe_keys;
+static fr_dict_attr_t const *attr_ms_mppe_encryption_policy;
+static fr_dict_attr_t const *attr_ms_mppe_recv_key;
+static fr_dict_attr_t const *attr_ms_mppe_send_key;
+static fr_dict_attr_t const *attr_ms_mppe_encryption_types;
+static fr_dict_attr_t const *attr_ms_chap2_cpw;
+
+extern fr_dict_attr_autoload_t rlm_mschap_dict_attr[];
+fr_dict_attr_autoload_t rlm_mschap_dict_attr[] = {
+ { .out = &attr_auth_type, .name = "Auth-Type", .type = FR_TYPE_UINT32, .dict = &dict_freeradius },
+ { .out = &attr_cleartext_password, .name = "Cleartext-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
+ { .out = &attr_nt_password, .name = "NT-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+ { .out = &attr_lm_password, .name = "LM-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+ { .out = &attr_ms_chap_use_ntlm_auth, .name = "MS-CHAP-Use-NTLM-Auth", .type = FR_TYPE_BOOL, .dict = &dict_freeradius },
+ { .out = &attr_ms_chap_user_name, .name = "MS-CHAP-User-Name", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
+ { .out = &attr_ms_chap_peer_challenge, .name = "MS-CHAP-Peer-Challenge", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+ { .out = &attr_ms_chap_new_nt_password, .name = "MS-CHAP-New-NT-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+ { .out = &attr_ms_chap_new_cleartext_password, .name = "MS-CHAP-New-Cleartext-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
+ { .out = &attr_smb_account_ctrl, .name = "SMB-Account-Ctrl", .type = FR_TYPE_UINT32, .dict = &dict_freeradius },
+ { .out = &attr_smb_account_ctrl_text, .name = "SMB-Account-Ctrl-Text", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
+
+ { .out = &attr_user_name, .name = "User-Name", .type = FR_TYPE_STRING, .dict = &dict_radius },
+ { .out = &attr_ms_chap_error, .name = "MS-CHAP-Error", .type = FR_TYPE_STRING, .dict = &dict_radius },
+ { .out = &attr_ms_chap_challenge, .name = "MS-CHAP-Challenge", .type = FR_TYPE_OCTETS, .dict = &dict_radius },
+ { .out = &attr_ms_chap_response, .name = "MS-CHAP-Response", .type = FR_TYPE_OCTETS, .dict = &dict_radius },
+ { .out = &attr_ms_chap2_response, .name = "MS-CHAP2-Response", .type = FR_TYPE_OCTETS, .dict = &dict_radius },
+ { .out = &attr_ms_chap2_success, .name = "MS-CHAP2-Success", .type = FR_TYPE_OCTETS, .dict = &dict_radius },
+ { .out = &attr_ms_chap_mppe_keys, .name = "MS-CHAP-MPPE-Keys", .type = FR_TYPE_OCTETS, .dict = &dict_radius },
+ { .out = &attr_ms_mppe_encryption_policy, .name = "MS-MPPE-Encryption-Policy", .type = FR_TYPE_UINT32, .dict = &dict_radius },
+ { .out = &attr_ms_mppe_recv_key, .name = "MS-MPPE-Recv-Key", .type = FR_TYPE_OCTETS, .dict = &dict_radius },
+ { .out = &attr_ms_mppe_send_key, .name = "MS-MPPE-Send-Key", .type = FR_TYPE_OCTETS, .dict = &dict_radius },
+ { .out = &attr_ms_mppe_encryption_types, .name = "MS-MPPE-Encryption-Types", .type = FR_TYPE_UINT32, .dict = &dict_radius },
+ { .out = &attr_ms_chap2_cpw, .name = "MS-CHAP2-CPW", .type = FR_TYPE_OCTETS, .dict = &dict_radius },
+
+ { NULL }
+};
+
+extern fr_dict_autoload_t rlm_expiration_dict[];
+fr_dict_autoload_t rlm_expiration_dict[] = {
+ { .out = &dict_freeradius, .proto = "freeradius" },
+ { .out = &dict_radius, .proto = "radius" },
+ { NULL }
+};
+
static int pdb_decode_acct_ctrl(char const *p)
{
int acct_ctrl = 0;
* hash of MS-CHAPv2 challenge, and peer challenge.
*/
if (strncasecmp(fmt, "Challenge", 9) == 0) {
- chap_challenge = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_CHALLENGE,
- TAG_ANY);
+ chap_challenge = fr_pair_find_by_da(request->packet->vps, attr_ms_chap_challenge, TAG_ANY);
if (!chap_challenge) {
REDEBUG("No MS-CHAP-Challenge in the request");
return -1;
VALUE_PAIR *name_attr, *response_name;
char const *username_string;
- response = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP2_RESPONSE,
- TAG_ANY);
+ response = fr_pair_find_by_da(request->packet->vps, attr_ms_chap2_response, TAG_ANY);
if (!response) {
REDEBUG("MS-CHAP2-Response is required to calculate MS-CHAPv1 challenge");
return -1;
return -1;
}
- user_name = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY);
+ user_name = fr_pair_find_by_da(request->packet->vps, attr_user_name, TAG_ANY);
if (!user_name) {
REDEBUG("User-Name is required to calculate MS-CHAPv1 Challenge");
return -1;
* We prefer this to the User-Name in the
* packet.
*/
- response_name = fr_pair_find_by_num(request->packet->vps, 0, FR_MS_CHAP_USER_NAME, TAG_ANY);
+ response_name = fr_pair_find_by_da(request->packet->vps, attr_ms_chap_user_name, TAG_ANY);
if (response_name) {
name_attr = response_name;
} else {
* response.
*/
} else if (strncasecmp(fmt, "NT-Response", 11) == 0) {
- response = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_RESPONSE, TAG_ANY);
- if (!response) response = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT,
- FR_MSCHAP2_RESPONSE, TAG_ANY);
+ response = fr_pair_find_by_da(request->packet->vps, attr_ms_chap_response, TAG_ANY);
+ if (!response) response = fr_pair_find_by_da(request->packet->vps, attr_ms_chap2_response, TAG_ANY);
if (!response) {
REDEBUG("No MS-CHAP-Response or MS-CHAP2-Response was found in the request");
return -1;
* For MS-CHAPv1, the NT-Response exists only
* if the second octet says so.
*/
- if ((fr_dict_vendor_num_by_da(response->da) == VENDORPEC_MICROSOFT) &&
- (response->da->attr == FR_MSCHAP_RESPONSE) &&
- ((response->vp_octets[1] & 0x01) == 0)) {
+ if ((response->da == attr_ms_chap_response) && ((response->vp_octets[1] & 0x01) == 0)) {
REDEBUG("No NT-Response in MS-CHAP-Response");
return -1;
}
* in MS-CHAPv1, and not often there.
*/
} else if (strncasecmp(fmt, "LM-Response", 11) == 0) {
- response = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_RESPONSE, TAG_ANY);
+ response = fr_pair_find_by_da(request->packet->vps, attr_ms_chap_response, TAG_ANY);
if (!response) {
REDEBUG("No MS-CHAP-Response was found in the request");
return -1;
} else if (strncasecmp(fmt, "NT-Domain", 9) == 0) {
char *p, *q;
- user_name = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY);
+ user_name = fr_pair_find_by_da(request->packet->vps, attr_user_name, TAG_ANY);
if (!user_name) {
REDEBUG("No User-Name was found in the request");
return -1;
} else if (strncasecmp(fmt, "User-Name", 9) == 0) {
char const *p, *q;
- user_name = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY);
+ user_name = fr_pair_find_by_da(request->packet->vps, attr_user_name, TAG_ANY);
if (!user_name) {
REDEBUG("No User-Name was found in the request");
return -1;
}
#endif
-
-static const CONF_PARSER passchange_config[] = {
- { FR_CONF_OFFSET("ntlm_auth", FR_TYPE_STRING | FR_TYPE_XLAT, rlm_mschap_t, ntlm_cpw) },
- { FR_CONF_OFFSET("ntlm_auth_username", FR_TYPE_STRING | FR_TYPE_XLAT, rlm_mschap_t, ntlm_cpw_username) },
- { FR_CONF_OFFSET("ntlm_auth_domain", FR_TYPE_STRING | FR_TYPE_XLAT, rlm_mschap_t, ntlm_cpw_domain) },
- { FR_CONF_OFFSET("local_cpw", FR_TYPE_STRING | FR_TYPE_XLAT, rlm_mschap_t, local_cpw) },
- CONF_PARSER_TERMINATOR
-};
-
-static const CONF_PARSER module_config[] = {
- /*
- * Cache the password by default.
- */
- { FR_CONF_OFFSET("use_mppe", FR_TYPE_BOOL, rlm_mschap_t, use_mppe), .dflt = "yes" },
- { FR_CONF_OFFSET("require_encryption", FR_TYPE_BOOL, rlm_mschap_t, require_encryption), .dflt = "no" },
- { FR_CONF_OFFSET("require_strong", FR_TYPE_BOOL, rlm_mschap_t, require_strong), .dflt = "no" },
- { FR_CONF_OFFSET("with_ntdomain_hack", FR_TYPE_BOOL, rlm_mschap_t, with_ntdomain_hack), .dflt = "yes" },
- { FR_CONF_OFFSET("ntlm_auth", FR_TYPE_STRING | FR_TYPE_XLAT, rlm_mschap_t, ntlm_auth) },
- { FR_CONF_OFFSET("ntlm_auth_timeout", FR_TYPE_UINT32, rlm_mschap_t, ntlm_auth_timeout) },
- { FR_CONF_POINTER("passchange", FR_TYPE_SUBSECTION, NULL), .subcs = (void const *) passchange_config },
- { FR_CONF_OFFSET("allow_retry", FR_TYPE_BOOL, rlm_mschap_t, allow_retry), .dflt = "yes" },
- { FR_CONF_OFFSET("retry_msg", FR_TYPE_STRING, rlm_mschap_t, retry_msg) },
- { FR_CONF_OFFSET("winbind_username", FR_TYPE_TMPL, rlm_mschap_t, wb_username) },
- { FR_CONF_OFFSET("winbind_domain", FR_TYPE_TMPL, rlm_mschap_t, wb_domain) },
-#ifdef WITH_AUTH_WINBIND
- { FR_CONF_OFFSET("winbind_retry_with_normalised_username", FR_TYPE_BOOL, rlm_mschap_t, wb_retry_with_normalised_username), .dflt = "no" },
-#endif
-#ifdef __APPLE__
- { FR_CONF_OFFSET("use_open_directory", FR_TYPE_BOOL, rlm_mschap_t, open_directory), .dflt = "yes" },
-#endif
- CONF_PARSER_TERMINATOR
-};
-
-
static int mod_bootstrap(void *instance, CONF_SECTION *conf)
{
char const *name;
/*
* For backwards compatibility
*/
- if (!fr_dict_enum_by_alias(fr_dict_attr_by_num(NULL, 0, FR_AUTH_TYPE), inst->xlat_name)) {
+ if (!fr_dict_enum_by_alias(attr_auth_type, inst->xlat_name)) {
inst->auth_type = "MS-CHAP";
} else {
inst->auth_type = inst->xlat_name;
* attribute to reply packet
*/
void mschap_add_reply(REQUEST *request, uint8_t ident,
- char const *name, char const *value, size_t len)
+ fr_dict_attr_t const *da, char const *value, size_t len)
{
VALUE_PAIR *vp;
- vp = pair_make_reply(name, NULL, T_OP_EQ);
- if (!vp) {
- RPEDEBUG("Failed to create attribute %s", name);
- return;
- }
+ MEM(vp = pair_update_reply(da, 0));
if (vp->vp_type == FR_TYPE_STRING) {
char *p;
/*
* Add MPPE attributes to the reply.
*/
-static void mppe_add_reply(REQUEST *request, char const* name, uint8_t const * value, size_t len)
+static void mppe_add_reply(REQUEST *request, fr_dict_attr_t const *da, uint8_t const *value, size_t len)
{
- VALUE_PAIR *vp;
+ VALUE_PAIR *vp;
- vp = pair_make_reply(name, NULL, T_OP_EQ);
- if (!vp) {
- RPEDEBUG("mppe_add_reply failed to create attribute %s", name);
- return;
- }
+ MEM(vp = pair_update_reply(da, 0));
- fr_pair_value_memcpy(vp, value, len);
+ fr_pair_value_memcpy(vp, value, len);
}
static int write_all(int fd, char const *buf, int len) {
rlm_mschap_t const *inst = instance;
VALUE_PAIR *challenge = NULL;
- challenge = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_CHALLENGE, TAG_ANY);
+ challenge = fr_pair_find_by_da(request->packet->vps, attr_ms_chap_challenge, TAG_ANY);
if (!challenge) {
return RLM_MODULE_NOOP;
}
- if (!fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_RESPONSE, TAG_ANY) &&
- !fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP2_RESPONSE, TAG_ANY) &&
- !fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP2_CPW, TAG_ANY)) {
+ if (!fr_pair_find_by_da(request->packet->vps, attr_ms_chap_response, TAG_ANY) &&
+ !fr_pair_find_by_da(request->packet->vps, attr_ms_chap2_response, TAG_ANY) &&
+ !fr_pair_find_by_da(request->packet->vps, attr_ms_chap2_cpw, TAG_ANY)) {
RDEBUG2("Found MS-CHAP-Challenge, but no MS-CHAP response or change-password");
return RLM_MODULE_NOOP;
}
- if (fr_pair_find_by_num(request->control, 0, FR_AUTH_TYPE, TAG_ANY)) {
+ if (fr_pair_find_by_da(request->control, attr_auth_type, TAG_ANY)) {
RWDEBUG2("Auth-Type already set. Not setting to MS-CHAP");
return RLM_MODULE_NOOP;
}
default:
return RLM_MODULE_FAIL;
}
- mschap_add_reply(request, ident, "MS-CHAP-Error", buffer, strlen(buffer));
+ mschap_add_reply(request, ident, attr_ms_chap_error, buffer, strlen(buffer));
return rcode;
}
/*
* Look for NT-Password...
*/
- nt_password = fr_pair_find_by_num(request->control, 0, FR_NT_PASSWORD, TAG_ANY);
+ nt_password = fr_pair_find_by_da(request->control, attr_nt_password, TAG_ANY);
if (nt_password) {
VP_VERIFY(nt_password);
if (password) {
RDEBUG2("Found Cleartext-Password, hashing to create NT-Password");
- nt_password = pair_make_config("NT-Password", NULL, T_OP_EQ);
- if (!nt_password) {
- RERROR("No memory");
- return false;
- }
+ MEM(nt_password = pair_update_control(attr_nt_password, 0));
p = talloc_array(nt_password, uint8_t, NT_DIGEST_LENGTH);
fr_pair_value_memsteal(nt_password, p);
{
VALUE_PAIR *lm_password;
- lm_password = fr_pair_find_by_num(request->control, 0, FR_LM_PASSWORD, TAG_ANY);
+ lm_password = fr_pair_find_by_da(request->control, attr_lm_password, TAG_ANY);
if (lm_password) {
VP_VERIFY(lm_password);
if (password) {
RDEBUG2("Found Cleartext-Password, hashing to create LM-Password");
- lm_password = pair_make_config("LM-Password", NULL, T_OP_EQ);
- if (!lm_password) {
- RERROR("No memory");
- return false;
- }
+ MEM(lm_password = pair_update_control(attr_lm_password, 0));
p = talloc_array(lm_password, uint8_t, LM_DIGEST_LENGTH);
fr_pair_value_memsteal(lm_password, p);
smbdes_lmpwdhash(password->vp_strvalue, p);
REDEBUG("Password change failed");
snprintf(buffer, sizeof(buffer), "E=709 R=0 M=Password change failed");
- mschap_add_reply(request, cpw->vp_octets[1], "MS-CHAP-Error", buffer, strlen(buffer));
+ mschap_add_reply(request, cpw->vp_octets[1], attr_ms_chap_error, buffer, strlen(buffer));
return RLM_MODULE_REJECT;
}
*/
static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(void *instance, UNUSED void *thread, REQUEST *request)
{
- rlm_mschap_t const *inst = instance;
- VALUE_PAIR *challenge = NULL;
- VALUE_PAIR *response = NULL;
- VALUE_PAIR *cpw = NULL;
- VALUE_PAIR *password = NULL;
- VALUE_PAIR *lm_password, *nt_password, *smb_ctrl;
- VALUE_PAIR *username;
- uint8_t nthashhash[NT_DIGEST_LENGTH];
- char msch2resp[42];
- char const *username_string;
- int mschap_version = 0;
- int mschap_result;
- MSCHAP_AUTH_METHOD auth_method;
+ rlm_mschap_t const *inst = instance;
+ VALUE_PAIR *challenge = NULL;
+ VALUE_PAIR *response = NULL;
+ VALUE_PAIR *cpw = NULL;
+ VALUE_PAIR *password = NULL;
+ VALUE_PAIR *lm_password, *nt_password, *smb_ctrl;
+ VALUE_PAIR *username;
+ uint8_t nthashhash[NT_DIGEST_LENGTH];
+ char msch2resp[42];
+ char const *username_string;
+ int mschap_version = 0;
+ int mschap_result;
+ MSCHAP_AUTH_METHOD auth_method;
/*
* If we have ntlm_auth configured, use it unless told
* want to suppress it.
*/
if (auth_method != AUTH_INTERNAL) {
- VALUE_PAIR *vp = fr_pair_find_by_num(request->control, 0, FR_MS_CHAP_USE_NTLM_AUTH, TAG_ANY);
- if (vp && vp->vp_uint32 == 0) auth_method = AUTH_INTERNAL;
+ VALUE_PAIR *vp = fr_pair_find_by_da(request->control, attr_ms_chap_use_ntlm_auth, TAG_ANY);
+ if (vp && vp->vp_bool == false) auth_method = AUTH_INTERNAL;
}
/*
* Find the SMB-Account-Ctrl attribute, or the
* SMB-Account-Ctrl-Text attribute.
*/
- smb_ctrl = fr_pair_find_by_num(request->control, 0, FR_SMB_ACCOUNT_CTRL, TAG_ANY);
+ smb_ctrl = fr_pair_find_by_da(request->control, attr_smb_account_ctrl, TAG_ANY);
if (!smb_ctrl) {
- password = fr_pair_find_by_num(request->control, 0, FR_SMB_ACCOUNT_CTRL_TEXT, TAG_ANY);
+ password = fr_pair_find_by_da(request->control, attr_smb_account_ctrl_text, TAG_ANY);
if (password) {
- smb_ctrl = pair_make_config("SMB-Account-CTRL", "0", T_OP_SET);
- if (smb_ctrl) {
- smb_ctrl->vp_uint32 = pdb_decode_acct_ctrl(password->vp_strvalue);
- }
+ MEM(smb_ctrl = pair_add_control(attr_smb_account_ctrl, 0));
+ smb_ctrl->vp_uint32 = pdb_decode_acct_ctrl(password->vp_strvalue);
}
}
/*
* Decide how to get the passwords.
*/
- password = fr_pair_find_by_num(request->control, 0, FR_CLEARTEXT_PASSWORD, TAG_ANY);
+ password = fr_pair_find_by_da(request->control, attr_cleartext_password, TAG_ANY);
/*
* Look for or create an NT-Password
* Check to see if this is a change password request, and process
* it accordingly if so.
*/
- cpw = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP2_CPW, TAG_ANY);
+ cpw = fr_pair_find_by_da(request->packet->vps, attr_ms_chap2_cpw, TAG_ANY);
if (cpw) {
uint8_t *p;
rlm_rcode_t rc;
rc = process_cpw_request(instance, request, cpw, nt_password);
- if (rc != RLM_MODULE_OK) {
- return rc;
- }
+ if (rc != RLM_MODULE_OK) return rc;
/*
* Clear any expiry bit so the user can now login;
* password change, add them into the request and then
* continue with the authentication.
*/
- response = radius_pair_create(request->packet, &request->packet->vps,
- FR_MSCHAP2_RESPONSE,
- VENDORPEC_MICROSOFT);
+ MEM(response = pair_update_reply(attr_ms_chap2_response, 0));
p = talloc_array(response, uint8_t, 50);
/* ident & flags */
fr_pair_value_memsteal(response, p);
}
- challenge = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_CHALLENGE, TAG_ANY);
+ challenge = fr_pair_find_by_da(request->packet->vps, attr_ms_chap_challenge, TAG_ANY);
if (!challenge) {
REDEBUG("You set 'Auth-Type = MS-CHAP' for a request that does not contain any MS-CHAP attributes!");
return RLM_MODULE_REJECT;
/*
* We also require an MS-CHAP-Response.
*/
- response = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_RESPONSE, TAG_ANY);
+ response = fr_pair_find_by_da(request->packet->vps, attr_ms_chap_response, TAG_ANY);
/*
* MS-CHAP-Response, means MS-CHAPv1
/*
* Check for errors, and add MSCHAP-Error if necessary.
*/
- rcode = mschap_error(inst, request, *response->vp_octets,
- mschap_result, mschap_version, smb_ctrl);
+ rcode = mschap_error(inst, request, *response->vp_octets, mschap_result, mschap_version, smb_ctrl);
if (rcode != RLM_MODULE_OK) return rcode;
- } else if ((response = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP2_RESPONSE,
- TAG_ANY)) != NULL) {
+ } else if ((response = fr_pair_find_by_da(request->packet->vps, attr_ms_chap2_response, TAG_ANY)) != NULL) {
uint8_t mschapv1_challenge[16];
VALUE_PAIR *name_attr, *response_name, *peer_challenge_attr;
rlm_rcode_t rcode;
/*
* We also require a User-Name
*/
- username = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY);
+ username = fr_pair_find_by_da(request->packet->vps, attr_user_name, TAG_ANY);
if (!username) {
REDEBUG("We require a User-Name for MS-CHAPv2");
return RLM_MODULE_INVALID;
* We prefer this to the User-Name in the
* packet.
*/
- response_name = fr_pair_find_by_num(request->packet->vps, 0, FR_MS_CHAP_USER_NAME, TAG_ANY);
+ response_name = fr_pair_find_by_da(request->packet->vps, attr_ms_chap_user_name, TAG_ANY);
name_attr = response_name ? response_name : username;
/*
#endif
peer_challenge = response->vp_octets + 2;
- peer_challenge_attr = fr_pair_find_by_num(request->control, 0, FR_MS_CHAP_PEER_CHALLENGE, TAG_ANY);
+ peer_challenge_attr = fr_pair_find_by_da(request->control, attr_ms_chap_peer_challenge, TAG_ANY);
if (peer_challenge_attr) {
RDEBUG2("Overriding peer challenge");
peer_challenge = peer_challenge_attr->vp_octets;
#ifdef WITH_AUTH_WINBIND
if (inst->wb_retry_with_normalised_username) {
- if ((response_name = fr_pair_find_by_num(request->packet->vps, 0, FR_MS_CHAP_USER_NAME, TAG_ANY))) {
+ response_name = fr_pair_find_by_da(request->packet->vps, attr_ms_chap_user_name, TAG_ANY)
+ if (response_name) {
if (strcmp(username_string, response_name->vp_strvalue)) {
- RDEBUG2("Changing username %s to %s", username_string, response_name->vp_strvalue);
+ RDEBUG2("Changing username %s to %s", username_string,
+ response_name->vp_strvalue);
username_string = response_name->vp_strvalue;
}
}
peer_challenge, /* peer challenge */
challenge->vp_octets, /* our challenge */
msch2resp); /* calculated MPPE key */
- mschap_add_reply(request, *response->vp_octets, "MS-CHAP2-Success", msch2resp, 42);
-
-
+ mschap_add_reply(request, *response->vp_octets, attr_ms_chap2_success, msch2resp, 42);
} else { /* Neither CHAPv1 or CHAPv2 response: die */
REDEBUG("You set 'Auth-Type = MS-CHAP' for a request that does not contain any MS-CHAP attributes!");
return RLM_MODULE_INVALID;
/* now create MPPE attributes */
if (inst->use_mppe) {
- uint8_t mppe_sendkey[34];
- uint8_t mppe_recvkey[34];
+ VALUE_PAIR *vp;
+ uint8_t mppe_sendkey[34];
+ uint8_t mppe_recvkey[34];
switch (mschap_version) {
case 1:
* is not available.
*/
memcpy(mppe_sendkey + 8, nthashhash, NT_DIGEST_LENGTH);
- mppe_add_reply(request, "MS-CHAP-MPPE-Keys", mppe_sendkey, 24); //-V666
+ mppe_add_reply(request, attr_ms_chap_mppe_keys, mppe_sendkey, 24); //-V666
break;
case 2:
RDEBUG2("Adding MS-CHAPv2 MPPE keys");
mppe_chap2_gen_keys128(nthashhash, response->vp_octets + 26, mppe_sendkey, mppe_recvkey);
- mppe_add_reply(request, "MS-MPPE-Recv-Key", mppe_recvkey, 16);
- mppe_add_reply(request, "MS-MPPE-Send-Key", mppe_sendkey, 16);
+ mppe_add_reply(request, attr_ms_mppe_recv_key, mppe_recvkey, 16);
+ mppe_add_reply(request, attr_ms_mppe_send_key, mppe_sendkey, 16);
break;
default:
break;
}
- pair_make_reply("MS-MPPE-Encryption-Policy",
- (inst->require_encryption) ? "0x00000002":"0x00000001", T_OP_EQ);
- pair_make_reply("MS-MPPE-Encryption-Types",
- (inst->require_strong) ? "0x00000004":"0x00000006", T_OP_EQ);
+ MEM(vp = pair_update_reply(attr_ms_mppe_encryption_policy, 0));
+ vp->vp_uint32 = inst->require_encryption ? 2 : 1;
+
+ MEM(vp = pair_update_reply(attr_ms_mppe_encryption_types, 0));
+ vp->vp_uint32 = inst->require_strong ? 4 : 6;
} /* else we weren't asked to use MPPE */
return RLM_MODULE_OK;
projects / thirdparty / freeradius-server.git / commitdiff
