extern fr_dict_attr_autoload_t radclient_dict_attr[];
fr_dict_attr_autoload_t radclient_dict_attr[] = {
- { .out = &attr_cleartext_password, .name = "Cleartext-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
+ { .out = &attr_cleartext_password, .name = "Password.Cleartext", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
{ .out = &attr_ms_chap_challenge, .name = "MS-CHAP-Challenge", .type = FR_TYPE_OCTETS, .dict = &dict_radius },
{ .out = &attr_ms_chap_password, .name = "MS-CHAP-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
{ .out = &attr_ms_chap_response, .name = "MS-CHAP-Response", .type = FR_TYPE_OCTETS, .dict = &dict_radius },
rc_file_pair_t *files; //!< Request and response file names.
- fr_pair_t *password; //!< Cleartext-Password
+ fr_pair_t *password; //!< Password.Cleartext
fr_time_delta_t timestamp;
fr_radius_packet_t *packet; //!< The outgoing request.
extern fr_dict_attr_autoload_t paircmp_dict_attr[];
fr_dict_attr_autoload_t paircmp_dict_attr[] = {
{ .out = &attr_client_ip_address, .name = "Client-IP-Address", .type = FR_TYPE_IPV4_ADDR, .dict = &dict_freeradius },
- { .out = &attr_crypt_password, .name = "Crypt-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
+ { .out = &attr_crypt_password, .name = "Password.Crypt", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
{ .out = &attr_packet_dst_ip_address, .name = "Packet-Dst-IP-Address", .type = FR_TYPE_IPV4_ADDR, .dict = &dict_freeradius },
{ .out = &attr_packet_dst_ipv6_address, .name = "Packet-Dst-IPv6-Address", .type = FR_TYPE_IPV6_ADDR, .dict = &dict_freeradius },
{ .out = &attr_packet_dst_port, .name = "Packet-Dst-Port", .type = FR_TYPE_UINT16, .dict = &dict_freeradius },
if (check_item->da == attr_user_password) {
if (check_item->op == T_OP_CMP_EQ) {
WARN("Found User-Password == \"...\"");
- WARN("Are you sure you don't mean Cleartext-Password?");
+ WARN("Are you sure you don't mean Password.Cleartext?");
WARN("See \"man rlm_pap\" for more information");
}
if (fr_pair_find_by_num(&request_list, 0, FR_USER_PASSWORD) == NULL) continue;
extern fr_dict_attr_autoload_t password_dict_attr[];
fr_dict_attr_autoload_t password_dict_attr[] = {
- { .out = &attr_cleartext, .name = "Cleartext-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
- { .out = &attr_with_header, .name = "Password-With-Header", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
- { .out = &attr_root, .name = "Password-Root", .type = FR_TYPE_TLV, .dict = &dict_freeradius },
-
- { .out = &attr_md5, .name = "MD5-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
- { .out = &attr_smd5, .name = "SMD5-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
- { .out = &attr_crypt, .name = "Crypt-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
- { .out = &attr_sha1, .name = "SHA1-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
- { .out = &attr_ssha1, .name = "SSHA1-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
-
- { .out = &attr_sha2, .name = "SHA2-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
- { .out = &attr_sha2_224, .name = "SHA2-224-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
- { .out = &attr_sha2_256, .name = "SHA2-256-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
- { .out = &attr_sha2_384, .name = "SHA2-384-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
- { .out = &attr_sha2_512, .name = "SHA2-512-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
-
- { .out = &attr_ssha2_224, .name = "SSHA2-224-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
- { .out = &attr_ssha2_256, .name = "SSHA2-256-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
- { .out = &attr_ssha2_384, .name = "SSHA2-384-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
- { .out = &attr_ssha2_512, .name = "SSHA2-512-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
-
- { .out = &attr_sha3, .name = "SHA3-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
- { .out = &attr_sha3_224, .name = "SHA3-224-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
- { .out = &attr_sha3_256, .name = "SHA3-256-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
- { .out = &attr_sha3_384, .name = "SHA3-384-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
- { .out = &attr_sha3_512, .name = "SHA3-512-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
-
- { .out = &attr_ssha3_224, .name = "SSHA3-224-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
- { .out = &attr_ssha3_256, .name = "SSHA3-256-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
- { .out = &attr_ssha3_384, .name = "SSHA3-384-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
- { .out = &attr_ssha3_512, .name = "SSHA3-512-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
-
- { .out = &attr_pbkdf2, .name = "PBKDF2-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
- { .out = &attr_lm, .name = "LM-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
- { .out = &attr_nt, .name = "NT-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
- { .out = &attr_ns_mta_md5, .name = "NS-MTA-MD5-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
+ { .out = &attr_cleartext, .name = "Password.Cleartext", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
+ { .out = &attr_with_header, .name = "Password.With-Header", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
+ { .out = &attr_root, .name = "Password", .type = FR_TYPE_TLV, .dict = &dict_freeradius },
+
+ { .out = &attr_md5, .name = "Password.MD5", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+ { .out = &attr_smd5, .name = "Password.SMD5", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+ { .out = &attr_crypt, .name = "Password.Crypt", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
+ { .out = &attr_sha1, .name = "Password.SHA1", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+ { .out = &attr_ssha1, .name = "Password.SSHA1", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+
+ { .out = &attr_sha2, .name = "Password.SHA2", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+ { .out = &attr_sha2_224, .name = "Password.SHA2-224", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+ { .out = &attr_sha2_256, .name = "Password.SHA2-256", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+ { .out = &attr_sha2_384, .name = "Password.SHA2-384", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+ { .out = &attr_sha2_512, .name = "Password.SHA2-512", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+
+ { .out = &attr_ssha2_224, .name = "Password.SSHA2-224", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+ { .out = &attr_ssha2_256, .name = "Password.SSHA2-256", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+ { .out = &attr_ssha2_384, .name = "Password.SSHA2-384", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+ { .out = &attr_ssha2_512, .name = "Password.SSHA2-512", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+
+ { .out = &attr_sha3, .name = "Password.SHA3", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+ { .out = &attr_sha3_224, .name = "Password.SHA3-224", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+ { .out = &attr_sha3_256, .name = "Password.SHA3-256", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+ { .out = &attr_sha3_384, .name = "Password.SHA3-384", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+ { .out = &attr_sha3_512, .name = "Password.SHA3-512", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+
+ { .out = &attr_ssha3_224, .name = "Password.SSHA3-224", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+ { .out = &attr_ssha3_256, .name = "Password.SSHA3-256", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+ { .out = &attr_ssha3_384, .name = "Password.SSHA3-384", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+ { .out = &attr_ssha3_512, .name = "Password.SSHA3-512", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+
+ { .out = &attr_pbkdf2, .name = "Password.PBKDF2", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+ { .out = &attr_lm, .name = "Password.LM", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+ { .out = &attr_nt, .name = "Password.NT", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
+ { .out = &attr_ns_mta_md5, .name = "Password.NS-MTA-MD5", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
{ .out = &attr_user, .name = "User-Password", .type = FR_TYPE_STRING, .dict = &dict_radius },
# endif
#endif
-/** Convert a Password-With-Header attribute to the correct type
+/** Convert a Password.With-Header attribute to the correct type
*
* Attribute may be base64 encoded, in which case it will be decoded
* first, then evaluated.
*
* @param[in] ctx to allocate new pairs in.
* @param[in] request Current request.
- * @param[in] known_good Password-With-Header attribute to convert.
+ * @param[in] known_good Password.With-Header attribute to convert.
* @return
* - Buffer containing normified value on success.
* - NULL on error.
known_good->vp_length, decoded);
/*
- * Password-With-Header is a string attribute.
+ * Password.With-Header is a string attribute.
* Even though we're handling binary data, the header
* must be \0 terminated.
*/
/*
* Rewrite to the default attribute type
- * currently Cleartext-Password.
+ * currently Password.Cleartext.
*
* This is usually correct if there's no
* header to indicate hash type.
RWDEBUG("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
RWDEBUG("!!! Ignoring control.User-Password. Update your !!!");
RWDEBUG("!!! configuration so that the \"known good\" clear text !!!");
- RWDEBUG("!!! password is in Cleartext-Password and NOT in !!!");
+ RWDEBUG("!!! password is in Password.Cleartext and NOT in !!!");
RWDEBUG("!!! User-Password. !!!");
RWDEBUG("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
continue;
extern fr_dict_attr_autoload_t rlm_chap_dict_attr[];
fr_dict_attr_autoload_t rlm_chap_dict_attr[] = {
{ .out = &attr_auth_type, .name = "Auth-Type", .type = FR_TYPE_UINT32, .dict = &dict_freeradius },
- { .out = &attr_cleartext_password, .name = "Cleartext-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
+ { .out = &attr_cleartext_password, .name = "Password.Cleartext", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
{ .out = &attr_chap_password, .name = "Chap-Password", .type = FR_TYPE_OCTETS, .dict = &dict_radius },
{ .out = &attr_chap_challenge, .name = "Chap-Challenge", .type = FR_TYPE_OCTETS, .dict = &dict_radius },
extern fr_dict_attr_autoload_t rlm_digest_dict_attr[];
fr_dict_attr_autoload_t rlm_digest_dict_attr[] = {
{ .out = &attr_auth_type, .name = "Auth-Type", .type = FR_TYPE_UINT32, .dict = &dict_freeradius },
- { .out = &attr_cleartext_password, .name = "Cleartext-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
+ { .out = &attr_cleartext_password, .name = "Password.Cleartext", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
{ .out = &attr_digest_response, .name = "Digest-Response", .type = FR_TYPE_STRING, .dict = &dict_radius },
{ .out = &attr_digest_attributes, .name = "Digest-Attributes", .type = FR_TYPE_TLV, .dict = &dict_radius },
passwd = fr_pair_find_by_da(&request->control_pairs, attr_cleartext_password);
}
if (!passwd) {
- REDEBUG("Cleartext-Password or Digest-HA1 is required for authentication");
+ REDEBUG("Password.Cleartext or Digest-HA1 is required for authentication");
RETURN_MODULE_INVALID;
}
CONF_SECTION *unlang;
/*
- * Get the Cleartext-Password for this user.
+ * Get the Password.Cleartext for this user.
*/
/*
extern fr_dict_attr_autoload_t rlm_eap_md5_dict_attr[];
fr_dict_attr_autoload_t rlm_eap_md5_dict_attr[] = {
- { .out = &attr_cleartext_password, .name = "Cleartext-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
+ { .out = &attr_cleartext_password, .name = "Password.Cleartext", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
{ NULL }
};
bool ephemeral;
/*
- * Get the Cleartext-Password for this user.
+ * Get the Password.Cleartext for this user.
*/
fr_assert(eap_session->request != NULL);
extern fr_dict_attr_autoload_t rlm_eap_pwd_dict_attr[];
fr_dict_attr_autoload_t rlm_eap_pwd_dict_attr[] = {
- { .out = &attr_cleartext_password, .name = "Cleartext-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
+ { .out = &attr_cleartext_password, .name = "Password.Cleartext", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
{ .out = &attr_framed_mtu, .name = "Framed-MTU", .type = FR_TYPE_UINT32, .dict = &dict_radius },
{ .out = &attr_ms_mppe_send_key, .name = "Vendor-Specific.Microsoft.MPPE-Send-Key", .type = FR_TYPE_OCTETS, .dict = &dict_radius },
{ .out = &attr_ms_mppe_recv_key, .name = "Vendor-Specific.Microsoft.MPPE-Recv-Key", .type = FR_TYPE_OCTETS, .dict = &dict_radius },
extern fr_dict_attr_autoload_t rlm_ldap_dict_attr[];
fr_dict_attr_autoload_t rlm_ldap_dict_attr[] = {
- { .out = &attr_cleartext_password, .name = "Cleartext-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
- { .out = &attr_crypt_password, .name = "Crypt-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
+ { .out = &attr_cleartext_password, .name = "Password.Cleartext", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
+ { .out = &attr_crypt_password, .name = "Password.Crypt", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
{ .out = &attr_ldap_userdn, .name = "LDAP-UserDN", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
{ .out = &attr_nt_password, .name = "NT-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
- { .out = &attr_password_with_header, .name = "Password-With-Header", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
+ { .out = &attr_password_with_header, .name = "Password.With-Header", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
{ .out = &attr_user_password, .name = "User-Password", .type = FR_TYPE_STRING, .dict = &dict_radius },
{ .out = &attr_user_name, .name = "User-Name", .type = FR_TYPE_STRING, .dict = &dict_radius },
#ifdef WITH_EDIR
/*
- * We already have a Cleartext-Password. Skip edir.
+ * We already have a Password.Cleartext. Skip edir.
*/
if (fr_pair_find_by_da(&request->control_pairs, attr_cleartext_password)) goto skip_edir;
}
/*
- * Add Cleartext-Password attribute to the request
+ * Add Password.Cleartext attribute to the request
*/
MEM(pair_update_control(&vp, attr_cleartext_password) >= 0);
fr_pair_value_bstrndup(vp, password, pass_size, true);
* Is using a module really the best solution? We merely use it as a namespace, maybe something more OO would be nicer?
* Can we simplify the getter methods? Simulating something like `attr_reader` would be perfect here
* Use more suitable data types for the values passed to the method. We have data types like Integer and DateTime, so use those instead of stringifying everything
-* Add methods on the request object to modify the lists. The current return value is a bit ridiculous, a call like `request.config.add_vp('Cleartext-Password', 'hello')` looks a lot cleaner
+* Add methods on the request object to modify the lists. The current return value is a bit ridiculous, a call like `request.config.add_vp('Password.Cleartext', 'hello')` looks a lot cleaner
* In a similar fashion: methods to get the attributes: `request.request.get_attribute('User-Name')`
* Add a xlat callback, similar to `rlm_perl` `radius_xlat`
* Unit tests
radlog(L_WARN, "Authorize: #{request.request.inspect}(#{request.request.class})")
reply = [["Framed-MTU", 1500]]
- control = [["Cleartext-Password", "hello"], ["Tmp-String-0", "!*", "ANY"]]
+ control = [["Password.Cleartext", "hello"], ["Tmp-String-0", "!*", "ANY"]]
return [RLM_MODULE_UPDATED, reply, control]
end
def self.post_auth(request)
extern fr_dict_attr_autoload_t rlm_mschap_dict_attr[];
fr_dict_attr_autoload_t rlm_mschap_dict_attr[] = {
{ .out = &attr_auth_type, .name = "Auth-Type", .type = FR_TYPE_UINT32, .dict = &dict_freeradius },
- { .out = &attr_cleartext_password, .name = "Cleartext-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
+ { .out = &attr_cleartext_password, .name = "Password.Cleartext", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
{ .out = &attr_eap_identity, .name = "EAP-Identity", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
- { .out = &attr_ms_chap_new_cleartext_password, .name = "MS-CHAP-New-Cleartext-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
+ { .out = &attr_ms_chap_new_cleartext_password, .name = "MS-CHAP-New-Password.Cleartext", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
{ .out = &attr_ms_chap_new_nt_password, .name = "MS-CHAP-New-NT-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
{ .out = &attr_ms_chap_peer_challenge, .name = "MS-CHAP-Peer-Challenge", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
{ .out = &attr_ms_chap_use_ntlm_auth, .name = "MS-CHAP-Use-NTLM-Auth", .type = FR_TYPE_BOOL, .dict = &dict_freeradius },
}
-/** Find an NT-Password value, or create one from a Cleartext-Password, or Password-With-Header attribute
+/** Find an NT-Password value, or create one from a Password.Cleartext, or Password.With-Header attribute
*
* @param[out] ephemeral Whether we created a new password
* attribute. Usually the caller will
static fr_dict_attr_autoload_t rlm_pap_dict_attr[] = {
{ .out = &attr_auth_type, .name = "Auth-Type", .type = FR_TYPE_UINT32, .dict = &dict_freeradius },
- { .out = &attr_root, .name = "Password-Root", .type = FR_TYPE_TLV, .dict = &dict_freeradius },
+ { .out = &attr_root, .name = "Password", .type = FR_TYPE_TLV, .dict = &dict_freeradius },
{ .out = &attr_user, .name = "User-Password", .type = FR_TYPE_STRING, .dict = &dict_radius },
/*
* get the vps and put them in perl hash
* If one VP have multiple values it is added as array_ref
- * Example for this is Cisco-AVPair that holds multiple values.
- * Which will be available as array_ref in $RAD_REQUEST{'Cisco-AVPair'}
+ * Example for this is Vendor-Specific.Cisco.AVPair that holds multiple values.
+ * Which will be available as array_ref in $RAD_REQUEST{'Vendor-Specific.Cisco.AVPair'}
*/
static void perl_store_vps(UNUSED TALLOC_CTX *ctx, request_t *request, fr_pair_t **vps, HV *rad_hv,
const char *hash_name, const char *list_name)
my $resp = HTTP::Response->new('200', 'OK');
$resp->header('Content-Type' => 'application/json');
- $resp->content('{"control.Cleartext-Password":"testing123","reply.Reply-Message":"Hello from demo.pl"}');
+ $resp->content('{"control.Password.Cleartext":"testing123","reply.Reply-Message":"Hello from demo.pl"}');
$client->send_response($resp);
} else {
extern fr_dict_attr_autoload_t rlm_unix_dict_attr[];
fr_dict_attr_autoload_t rlm_unix_dict_attr[] = {
{ .out = &attr_auth_type, .name = "Auth-Type", .type = FR_TYPE_UINT32, .dict = &dict_freeradius },
- { .out = &attr_crypt_password, .name = "Crypt-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
+ { .out = &attr_crypt_password, .name = "Password.Crypt", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
{ .out = &attr_user_name, .name = "User-Name", .type = FR_TYPE_STRING, .dict = &dict_radius },
{ .out = &attr_login_ip_host, .name = "Login-IP-Host", .type = FR_TYPE_IPV4_ADDR, .dict = &dict_radius },
{ .out = &attr_framed_ip_address, .name = "Framed-IP-Address", .type = FR_TYPE_IPV4_ADDR, .dict = &dict_radius },