From: Arran Cudbard-Bell Date: Thu, 12 Apr 2018 04:20:35 +0000 (+0600) Subject: Autoload rlm_mschap attributes X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=34fdda8acd78e6491c42b82f8df06c943be9675e;p=thirdparty%2Ffreeradius-server.git Autoload rlm_mschap attributes --- diff --git a/share/dictionary.freeradius.internal b/share/dictionary.freeradius.internal index 879a487f2ef..183b2e4e32e 100644 --- a/share/dictionary.freeradius.internal +++ b/share/dictionary.freeradius.internal @@ -127,7 +127,7 @@ ATTRIBUTE Rewrite-Rule 1078 string # SQL-Group is now dynamically created ATTRIBUTE Response-Packet-Type 1080 integer virtual ATTRIBUTE Digest-HA1 1081 string -ATTRIBUTE MS-CHAP-Use-NTLM-Auth 1082 integer +ATTRIBUTE MS-CHAP-Use-NTLM-Auth 1082 bool ATTRIBUTE NTLM-User-Name 1083 string ATTRIBUTE MS-CHAP-User-Name 1083 string ATTRIBUTE Packet-Src-IP-Address 1084 ipaddr virtual @@ -1025,9 +1025,3 @@ VALUE EAP-Code Request 1 VALUE EAP-Code Response 2 VALUE EAP-Code Success 3 VALUE EAP-Code Failure 4 - -# -# For MS-CHAP, do we run ntlm_auth, or not. -# -VALUE MS-CHAP-Use-NTLM-Auth No 0 -VALUE MS-CHAP-Use-NTLM-Auth Yes 1 diff --git a/src/modules/rlm_mschap/auth_wbclient.c b/src/modules/rlm_mschap/auth_wbclient.c index c8d2dbe5c38..8a04a5d559d 100644 --- a/src/modules/rlm_mschap/auth_wbclient.c +++ b/src/modules/rlm_mschap/auth_wbclient.c @@ -165,6 +165,7 @@ int do_auth_wbclient(rlm_mschap_t const *inst, REQUEST *request, if (err == WBC_ERR_AUTH_ERROR && inst->wb_retry_with_normalised_username) { VALUE_PAIR *vp_response; VALUE_PAIR *vp_challenge; + VALUE_PAIR *vp_chap_user_name; char *normalised_username = NULL; normalised_username = wbclient_normalise_username(request, wb_ctx, authparams.domain_name, @@ -177,25 +178,21 @@ int do_auth_wbclient(rlm_mschap_t const *inst, REQUEST *request, authparams.account_name = normalised_username; /* Set FR_MS_CHAP_USER_NAME */ - if (!fr_pair_make(request->packet, &request->packet->vps, "MS-CHAP-User-Name", - normalised_username, T_OP_SET)) { - RERROR("Failed creating MS-CHAP-User-Name"); - goto done; - } + MEM(vp_chap_user_name = pair_update_request(attr_ms_chap_user_name, 0)); + fr_pair_value_bstrncpy(vp_chap_user_name, + normalised_username, talloc_array_length(normalised_username) - 1); RDEBUG2("Retrying authentication request user='%s' domain='%s'", authparams.account_name, authparams.domain_name); /* Recalculate hash */ - vp_challenge = fr_pair_find_by_num(request->packet->vps, FR_MSCHAP_CHALLENGE, - VENDORPEC_MICROSOFT, TAG_ANY); + vp_challenge = fr_pair_find_by_da(request->packet->vps, attr_ms_chap_challenge, TAG_ANY); if (!vp_challenge) { RERROR("Unable to get MS-CHAP-Challenge"); goto done; } - vp_response = fr_pair_find_by_num(request->packet->vps, FR_MSCHAP2_RESPONSE, - VENDORPEC_MICROSOFT, TAG_ANY); + vp_response = fr_pair_find_by_da(request->packet->vps, attr_ms_chap2_response, TAG_ANY); if (!vp_response) { RERROR("Unable to get MS-CHAP2-Response"); goto done; diff --git a/src/modules/rlm_mschap/mschap.h b/src/modules/rlm_mschap/mschap.h index 6f14f3200ad..61d9db847c1 100644 --- a/src/modules/rlm_mschap/mschap.h +++ b/src/modules/rlm_mschap/mschap.h @@ -1,7 +1,6 @@ -/* @copyright 2006 The FreeRADIUS server project */ +#pragma once -#ifndef _MSCHAP_H -#define _MSCHAP_H +/* @copyright 2006 The FreeRADIUS server project */ RCSIDH(mschap_h, "$Id$") @@ -19,7 +18,4 @@ void mschap_auth_response(char const *username, uint8_t const *peer_challenge, uint8_t const *auth_challenge, char *response); void mschap_add_reply(REQUEST *request, unsigned char ident, - char const *name, char const *value, size_t len); - - -#endif /*_MSCHAP_H*/ + fr_dict_attr_t const *da, char const *value, size_t len); diff --git a/src/modules/rlm_mschap/opendir.c b/src/modules/rlm_mschap/opendir.c index 646d1690a0d..05ef0df4a8f 100644 --- a/src/modules/rlm_mschap/opendir.c +++ b/src/modules/rlm_mschap/opendir.c @@ -21,25 +21,21 @@ RCSID("$Id$") USES_APPLE_DEPRECATED_API -#include -#include -#include -#include +#include +#include +#include +#include -#include +#include -#include "smbdes.h" +#include "smbdes.h" +#include "rlm_mschap.h" +#include "mschap.h" #include #define kActiveDirLoc "/Active Directory/" -/* - * In rlm_mschap.c - */ -void mschap_add_reply(REQUEST *request, VALUE_PAIR** vp, unsigned char ident, - char const* name, char const* value, int len); - /* * Only used by rlm_mschap.c */ @@ -293,7 +289,6 @@ rlm_rcode_t od_mschap_auth(REQUEST *request, VALUE_PAIR *challenge, VALUE_PAIR * peerchal = response->vp_strvalue + 2 (16 octets) p24 = response->vp_strvalue + 26 (24 octets) */ - pStepBuff = dsDataBufferAllocate(dsRef, 4096); tDataBuff = dsDataBufferAllocate(dsRef, 4096); pAuthType = dsDataNodeAllocateString(dsRef, kDSStdAuthMSCHAP2); @@ -381,10 +376,10 @@ rlm_rcode_t od_mschap_auth(REQUEST *request, VALUE_PAIR *challenge, VALUE_PAIR * mschap_reply[0] = 'S'; mschap_reply[1] = '='; memcpy(&(mschap_reply[2]), &(pStepBuff->fBufferData[4]), len); - mschap_add_reply(request, &request->reply->vps, + mschap_add_reply(request, *response->vp_strvalue, - "MS-CHAP2-Success", - mschap_reply, len+2); + attr_ms_chap2_success, + mschap_reply, len + 2); RDEBUG2("dsDoDirNodeAuth returns stepbuff: %s (len=%zu)\n", mschap_reply, len); } } diff --git a/src/modules/rlm_mschap/rlm_mschap.c b/src/modules/rlm_mschap/rlm_mschap.c index 43e4c011733..3562edadb40 100644 --- a/src/modules/rlm_mschap/rlm_mschap.c +++ b/src/modules/rlm_mschap/rlm_mschap.c @@ -64,6 +64,107 @@ int od_mschap_auth(REQUEST *request, VALUE_PAIR *challenge, VALUE_PAIR * usernam #define ACB_AUTOLOCK 0x04000000 //!< Account auto locked. #define ACB_FR_EXPIRED 0x00020000 //!< Password Expired. +static const CONF_PARSER passchange_config[] = { + { FR_CONF_OFFSET("ntlm_auth", FR_TYPE_STRING | FR_TYPE_XLAT, rlm_mschap_t, ntlm_cpw) }, + { FR_CONF_OFFSET("ntlm_auth_username", FR_TYPE_STRING | FR_TYPE_XLAT, rlm_mschap_t, ntlm_cpw_username) }, + { FR_CONF_OFFSET("ntlm_auth_domain", FR_TYPE_STRING | FR_TYPE_XLAT, rlm_mschap_t, ntlm_cpw_domain) }, + { FR_CONF_OFFSET("local_cpw", FR_TYPE_STRING | FR_TYPE_XLAT, rlm_mschap_t, local_cpw) }, + CONF_PARSER_TERMINATOR +}; + +static const CONF_PARSER module_config[] = { + /* + * Cache the password by default. + */ + { FR_CONF_OFFSET("use_mppe", FR_TYPE_BOOL, rlm_mschap_t, use_mppe), .dflt = "yes" }, + { FR_CONF_OFFSET("require_encryption", FR_TYPE_BOOL, rlm_mschap_t, require_encryption), .dflt = "no" }, + { FR_CONF_OFFSET("require_strong", FR_TYPE_BOOL, rlm_mschap_t, require_strong), .dflt = "no" }, + { FR_CONF_OFFSET("with_ntdomain_hack", FR_TYPE_BOOL, rlm_mschap_t, with_ntdomain_hack), .dflt = "yes" }, + { FR_CONF_OFFSET("ntlm_auth", FR_TYPE_STRING | FR_TYPE_XLAT, rlm_mschap_t, ntlm_auth) }, + { FR_CONF_OFFSET("ntlm_auth_timeout", FR_TYPE_UINT32, rlm_mschap_t, ntlm_auth_timeout) }, + { FR_CONF_POINTER("passchange", FR_TYPE_SUBSECTION, NULL), .subcs = (void const *) passchange_config }, + { FR_CONF_OFFSET("allow_retry", FR_TYPE_BOOL, rlm_mschap_t, allow_retry), .dflt = "yes" }, + { FR_CONF_OFFSET("retry_msg", FR_TYPE_STRING, rlm_mschap_t, retry_msg) }, + { FR_CONF_OFFSET("winbind_username", FR_TYPE_TMPL, rlm_mschap_t, wb_username) }, + { FR_CONF_OFFSET("winbind_domain", FR_TYPE_TMPL, rlm_mschap_t, wb_domain) }, +#ifdef WITH_AUTH_WINBIND + { FR_CONF_OFFSET("winbind_retry_with_normalised_username", FR_TYPE_BOOL, rlm_mschap_t, wb_retry_with_normalised_username), .dflt = "no" }, +#endif +#ifdef __APPLE__ + { FR_CONF_OFFSET("use_open_directory", FR_TYPE_BOOL, rlm_mschap_t, open_directory), .dflt = "yes" }, +#endif + CONF_PARSER_TERMINATOR +}; + +static fr_dict_t const *dict_freeradius; +static fr_dict_t const *dict_radius; + +static fr_dict_attr_t const *attr_auth_type; +static fr_dict_attr_t const *attr_cleartext_password; +static fr_dict_attr_t const *attr_nt_password; +static fr_dict_attr_t const *attr_lm_password; +static fr_dict_attr_t const *attr_ms_chap_use_ntlm_auth; + +fr_dict_attr_t const *attr_ms_chap_user_name; + +static fr_dict_attr_t const *attr_ms_chap_peer_challenge; +static fr_dict_attr_t const *attr_ms_chap_new_nt_password; +static fr_dict_attr_t const *attr_ms_chap_new_cleartext_password; +static fr_dict_attr_t const *attr_smb_account_ctrl; +static fr_dict_attr_t const *attr_smb_account_ctrl_text; + +static fr_dict_attr_t const *attr_user_name; +static fr_dict_attr_t const *attr_ms_chap_error; + +fr_dict_attr_t const *attr_ms_chap_challenge; +fr_dict_attr_t const *attr_ms_chap_response; +fr_dict_attr_t const *attr_ms_chap2_response; +fr_dict_attr_t const *attr_ms_chap2_success; + +static fr_dict_attr_t const *attr_ms_chap_mppe_keys; +static fr_dict_attr_t const *attr_ms_mppe_encryption_policy; +static fr_dict_attr_t const *attr_ms_mppe_recv_key; +static fr_dict_attr_t const *attr_ms_mppe_send_key; +static fr_dict_attr_t const *attr_ms_mppe_encryption_types; +static fr_dict_attr_t const *attr_ms_chap2_cpw; + +extern fr_dict_attr_autoload_t rlm_mschap_dict_attr[]; +fr_dict_attr_autoload_t rlm_mschap_dict_attr[] = { + { .out = &attr_auth_type, .name = "Auth-Type", .type = FR_TYPE_UINT32, .dict = &dict_freeradius }, + { .out = &attr_cleartext_password, .name = "Cleartext-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius }, + { .out = &attr_nt_password, .name = "NT-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius }, + { .out = &attr_lm_password, .name = "LM-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius }, + { .out = &attr_ms_chap_use_ntlm_auth, .name = "MS-CHAP-Use-NTLM-Auth", .type = FR_TYPE_BOOL, .dict = &dict_freeradius }, + { .out = &attr_ms_chap_user_name, .name = "MS-CHAP-User-Name", .type = FR_TYPE_STRING, .dict = &dict_freeradius }, + { .out = &attr_ms_chap_peer_challenge, .name = "MS-CHAP-Peer-Challenge", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius }, + { .out = &attr_ms_chap_new_nt_password, .name = "MS-CHAP-New-NT-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius }, + { .out = &attr_ms_chap_new_cleartext_password, .name = "MS-CHAP-New-Cleartext-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius }, + { .out = &attr_smb_account_ctrl, .name = "SMB-Account-Ctrl", .type = FR_TYPE_UINT32, .dict = &dict_freeradius }, + { .out = &attr_smb_account_ctrl_text, .name = "SMB-Account-Ctrl-Text", .type = FR_TYPE_STRING, .dict = &dict_freeradius }, + + { .out = &attr_user_name, .name = "User-Name", .type = FR_TYPE_STRING, .dict = &dict_radius }, + { .out = &attr_ms_chap_error, .name = "MS-CHAP-Error", .type = FR_TYPE_STRING, .dict = &dict_radius }, + { .out = &attr_ms_chap_challenge, .name = "MS-CHAP-Challenge", .type = FR_TYPE_OCTETS, .dict = &dict_radius }, + { .out = &attr_ms_chap_response, .name = "MS-CHAP-Response", .type = FR_TYPE_OCTETS, .dict = &dict_radius }, + { .out = &attr_ms_chap2_response, .name = "MS-CHAP2-Response", .type = FR_TYPE_OCTETS, .dict = &dict_radius }, + { .out = &attr_ms_chap2_success, .name = "MS-CHAP2-Success", .type = FR_TYPE_OCTETS, .dict = &dict_radius }, + { .out = &attr_ms_chap_mppe_keys, .name = "MS-CHAP-MPPE-Keys", .type = FR_TYPE_OCTETS, .dict = &dict_radius }, + { .out = &attr_ms_mppe_encryption_policy, .name = "MS-MPPE-Encryption-Policy", .type = FR_TYPE_UINT32, .dict = &dict_radius }, + { .out = &attr_ms_mppe_recv_key, .name = "MS-MPPE-Recv-Key", .type = FR_TYPE_OCTETS, .dict = &dict_radius }, + { .out = &attr_ms_mppe_send_key, .name = "MS-MPPE-Send-Key", .type = FR_TYPE_OCTETS, .dict = &dict_radius }, + { .out = &attr_ms_mppe_encryption_types, .name = "MS-MPPE-Encryption-Types", .type = FR_TYPE_UINT32, .dict = &dict_radius }, + { .out = &attr_ms_chap2_cpw, .name = "MS-CHAP2-CPW", .type = FR_TYPE_OCTETS, .dict = &dict_radius }, + + { NULL } +}; + +extern fr_dict_autoload_t rlm_expiration_dict[]; +fr_dict_autoload_t rlm_expiration_dict[] = { + { .out = &dict_freeradius, .proto = "freeradius" }, + { .out = &dict_radius, .proto = "radius" }, + { NULL } +}; + static int pdb_decode_acct_ctrl(char const *p) { int acct_ctrl = 0; @@ -167,8 +268,7 @@ static ssize_t mschap_xlat(UNUSED TALLOC_CTX *ctx, char **out, size_t outlen, * hash of MS-CHAPv2 challenge, and peer challenge. */ if (strncasecmp(fmt, "Challenge", 9) == 0) { - chap_challenge = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_CHALLENGE, - TAG_ANY); + chap_challenge = fr_pair_find_by_da(request->packet->vps, attr_ms_chap_challenge, TAG_ANY); if (!chap_challenge) { REDEBUG("No MS-CHAP-Challenge in the request"); return -1; @@ -191,8 +291,7 @@ static ssize_t mschap_xlat(UNUSED TALLOC_CTX *ctx, char **out, size_t outlen, VALUE_PAIR *name_attr, *response_name; char const *username_string; - response = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP2_RESPONSE, - TAG_ANY); + response = fr_pair_find_by_da(request->packet->vps, attr_ms_chap2_response, TAG_ANY); if (!response) { REDEBUG("MS-CHAP2-Response is required to calculate MS-CHAPv1 challenge"); return -1; @@ -212,7 +311,7 @@ static ssize_t mschap_xlat(UNUSED TALLOC_CTX *ctx, char **out, size_t outlen, return -1; } - user_name = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY); + user_name = fr_pair_find_by_da(request->packet->vps, attr_user_name, TAG_ANY); if (!user_name) { REDEBUG("User-Name is required to calculate MS-CHAPv1 Challenge"); return -1; @@ -227,7 +326,7 @@ static ssize_t mschap_xlat(UNUSED TALLOC_CTX *ctx, char **out, size_t outlen, * We prefer this to the User-Name in the * packet. */ - response_name = fr_pair_find_by_num(request->packet->vps, 0, FR_MS_CHAP_USER_NAME, TAG_ANY); + response_name = fr_pair_find_by_da(request->packet->vps, attr_ms_chap_user_name, TAG_ANY); if (response_name) { name_attr = response_name; } else { @@ -277,9 +376,8 @@ static ssize_t mschap_xlat(UNUSED TALLOC_CTX *ctx, char **out, size_t outlen, * response. */ } else if (strncasecmp(fmt, "NT-Response", 11) == 0) { - response = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_RESPONSE, TAG_ANY); - if (!response) response = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, - FR_MSCHAP2_RESPONSE, TAG_ANY); + response = fr_pair_find_by_da(request->packet->vps, attr_ms_chap_response, TAG_ANY); + if (!response) response = fr_pair_find_by_da(request->packet->vps, attr_ms_chap2_response, TAG_ANY); if (!response) { REDEBUG("No MS-CHAP-Response or MS-CHAP2-Response was found in the request"); return -1; @@ -289,9 +387,7 @@ static ssize_t mschap_xlat(UNUSED TALLOC_CTX *ctx, char **out, size_t outlen, * For MS-CHAPv1, the NT-Response exists only * if the second octet says so. */ - if ((fr_dict_vendor_num_by_da(response->da) == VENDORPEC_MICROSOFT) && - (response->da->attr == FR_MSCHAP_RESPONSE) && - ((response->vp_octets[1] & 0x01) == 0)) { + if ((response->da == attr_ms_chap_response) && ((response->vp_octets[1] & 0x01) == 0)) { REDEBUG("No NT-Response in MS-CHAP-Response"); return -1; } @@ -309,7 +405,7 @@ static ssize_t mschap_xlat(UNUSED TALLOC_CTX *ctx, char **out, size_t outlen, * in MS-CHAPv1, and not often there. */ } else if (strncasecmp(fmt, "LM-Response", 11) == 0) { - response = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_RESPONSE, TAG_ANY); + response = fr_pair_find_by_da(request->packet->vps, attr_ms_chap_response, TAG_ANY); if (!response) { REDEBUG("No MS-CHAP-Response was found in the request"); return -1; @@ -332,7 +428,7 @@ static ssize_t mschap_xlat(UNUSED TALLOC_CTX *ctx, char **out, size_t outlen, } else if (strncasecmp(fmt, "NT-Domain", 9) == 0) { char *p, *q; - user_name = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY); + user_name = fr_pair_find_by_da(request->packet->vps, attr_user_name, TAG_ANY); if (!user_name) { REDEBUG("No User-Name was found in the request"); return -1; @@ -387,7 +483,7 @@ static ssize_t mschap_xlat(UNUSED TALLOC_CTX *ctx, char **out, size_t outlen, } else if (strncasecmp(fmt, "User-Name", 9) == 0) { char const *p, *q; - user_name = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY); + user_name = fr_pair_find_by_da(request->packet->vps, attr_user_name, TAG_ANY); if (!user_name) { REDEBUG("No User-Name was found in the request"); return -1; @@ -539,40 +635,6 @@ static void *mod_conn_create(TALLOC_CTX *ctx, UNUSED void *instance, UNUSED stru } #endif - -static const CONF_PARSER passchange_config[] = { - { FR_CONF_OFFSET("ntlm_auth", FR_TYPE_STRING | FR_TYPE_XLAT, rlm_mschap_t, ntlm_cpw) }, - { FR_CONF_OFFSET("ntlm_auth_username", FR_TYPE_STRING | FR_TYPE_XLAT, rlm_mschap_t, ntlm_cpw_username) }, - { FR_CONF_OFFSET("ntlm_auth_domain", FR_TYPE_STRING | FR_TYPE_XLAT, rlm_mschap_t, ntlm_cpw_domain) }, - { FR_CONF_OFFSET("local_cpw", FR_TYPE_STRING | FR_TYPE_XLAT, rlm_mschap_t, local_cpw) }, - CONF_PARSER_TERMINATOR -}; - -static const CONF_PARSER module_config[] = { - /* - * Cache the password by default. - */ - { FR_CONF_OFFSET("use_mppe", FR_TYPE_BOOL, rlm_mschap_t, use_mppe), .dflt = "yes" }, - { FR_CONF_OFFSET("require_encryption", FR_TYPE_BOOL, rlm_mschap_t, require_encryption), .dflt = "no" }, - { FR_CONF_OFFSET("require_strong", FR_TYPE_BOOL, rlm_mschap_t, require_strong), .dflt = "no" }, - { FR_CONF_OFFSET("with_ntdomain_hack", FR_TYPE_BOOL, rlm_mschap_t, with_ntdomain_hack), .dflt = "yes" }, - { FR_CONF_OFFSET("ntlm_auth", FR_TYPE_STRING | FR_TYPE_XLAT, rlm_mschap_t, ntlm_auth) }, - { FR_CONF_OFFSET("ntlm_auth_timeout", FR_TYPE_UINT32, rlm_mschap_t, ntlm_auth_timeout) }, - { FR_CONF_POINTER("passchange", FR_TYPE_SUBSECTION, NULL), .subcs = (void const *) passchange_config }, - { FR_CONF_OFFSET("allow_retry", FR_TYPE_BOOL, rlm_mschap_t, allow_retry), .dflt = "yes" }, - { FR_CONF_OFFSET("retry_msg", FR_TYPE_STRING, rlm_mschap_t, retry_msg) }, - { FR_CONF_OFFSET("winbind_username", FR_TYPE_TMPL, rlm_mschap_t, wb_username) }, - { FR_CONF_OFFSET("winbind_domain", FR_TYPE_TMPL, rlm_mschap_t, wb_domain) }, -#ifdef WITH_AUTH_WINBIND - { FR_CONF_OFFSET("winbind_retry_with_normalised_username", FR_TYPE_BOOL, rlm_mschap_t, wb_retry_with_normalised_username), .dflt = "no" }, -#endif -#ifdef __APPLE__ - { FR_CONF_OFFSET("use_open_directory", FR_TYPE_BOOL, rlm_mschap_t, open_directory), .dflt = "yes" }, -#endif - CONF_PARSER_TERMINATOR -}; - - static int mod_bootstrap(void *instance, CONF_SECTION *conf) { char const *name; @@ -600,7 +662,7 @@ static int mod_instantiate(void *instance, CONF_SECTION *conf) /* * For backwards compatibility */ - if (!fr_dict_enum_by_alias(fr_dict_attr_by_num(NULL, 0, FR_AUTH_TYPE), inst->xlat_name)) { + if (!fr_dict_enum_by_alias(attr_auth_type, inst->xlat_name)) { inst->auth_type = "MS-CHAP"; } else { inst->auth_type = inst->xlat_name; @@ -684,15 +746,11 @@ static int mod_detach(UNUSED void *instance) * attribute to reply packet */ void mschap_add_reply(REQUEST *request, uint8_t ident, - char const *name, char const *value, size_t len) + fr_dict_attr_t const *da, char const *value, size_t len) { VALUE_PAIR *vp; - vp = pair_make_reply(name, NULL, T_OP_EQ); - if (!vp) { - RPEDEBUG("Failed to create attribute %s", name); - return; - } + MEM(vp = pair_update_reply(da, 0)); if (vp->vp_type == FR_TYPE_STRING) { char *p; @@ -715,17 +773,13 @@ void mschap_add_reply(REQUEST *request, uint8_t ident, /* * Add MPPE attributes to the reply. */ -static void mppe_add_reply(REQUEST *request, char const* name, uint8_t const * value, size_t len) +static void mppe_add_reply(REQUEST *request, fr_dict_attr_t const *da, uint8_t const *value, size_t len) { - VALUE_PAIR *vp; + VALUE_PAIR *vp; - vp = pair_make_reply(name, NULL, T_OP_EQ); - if (!vp) { - RPEDEBUG("mppe_add_reply failed to create attribute %s", name); - return; - } + MEM(vp = pair_update_reply(da, 0)); - fr_pair_value_memcpy(vp, value, len); + fr_pair_value_memcpy(vp, value, len); } static int write_all(int fd, char const *buf, int len) { @@ -1368,19 +1422,19 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authorize(void *instance, UNUSED void *t rlm_mschap_t const *inst = instance; VALUE_PAIR *challenge = NULL; - challenge = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_CHALLENGE, TAG_ANY); + challenge = fr_pair_find_by_da(request->packet->vps, attr_ms_chap_challenge, TAG_ANY); if (!challenge) { return RLM_MODULE_NOOP; } - if (!fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_RESPONSE, TAG_ANY) && - !fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP2_RESPONSE, TAG_ANY) && - !fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP2_CPW, TAG_ANY)) { + if (!fr_pair_find_by_da(request->packet->vps, attr_ms_chap_response, TAG_ANY) && + !fr_pair_find_by_da(request->packet->vps, attr_ms_chap2_response, TAG_ANY) && + !fr_pair_find_by_da(request->packet->vps, attr_ms_chap2_cpw, TAG_ANY)) { RDEBUG2("Found MS-CHAP-Challenge, but no MS-CHAP response or change-password"); return RLM_MODULE_NOOP; } - if (fr_pair_find_by_num(request->control, 0, FR_AUTH_TYPE, TAG_ANY)) { + if (fr_pair_find_by_da(request->control, attr_auth_type, TAG_ANY)) { RWDEBUG2("Auth-Type already set. Not setting to MS-CHAP"); return RLM_MODULE_NOOP; } @@ -1479,7 +1533,7 @@ static rlm_rcode_t mschap_error(rlm_mschap_t const *inst, REQUEST *request, unsi default: return RLM_MODULE_FAIL; } - mschap_add_reply(request, ident, "MS-CHAP-Error", buffer, strlen(buffer)); + mschap_add_reply(request, ident, attr_ms_chap_error, buffer, strlen(buffer)); return rcode; } @@ -1499,7 +1553,7 @@ static bool CC_HINT(nonnull (1, 2, 4)) find_nt_password(rlm_mschap_t const *inst /* * Look for NT-Password... */ - nt_password = fr_pair_find_by_num(request->control, 0, FR_NT_PASSWORD, TAG_ANY); + nt_password = fr_pair_find_by_da(request->control, attr_nt_password, TAG_ANY); if (nt_password) { VP_VERIFY(nt_password); @@ -1532,11 +1586,7 @@ static bool CC_HINT(nonnull (1, 2, 4)) find_nt_password(rlm_mschap_t const *inst if (password) { RDEBUG2("Found Cleartext-Password, hashing to create NT-Password"); - nt_password = pair_make_config("NT-Password", NULL, T_OP_EQ); - if (!nt_password) { - RERROR("No memory"); - return false; - } + MEM(nt_password = pair_update_control(attr_nt_password, 0)); p = talloc_array(nt_password, uint8_t, NT_DIGEST_LENGTH); fr_pair_value_memsteal(nt_password, p); @@ -1566,7 +1616,7 @@ static bool CC_HINT(nonnull (1, 2, 5)) find_lm_password(rlm_mschap_t const *inst { VALUE_PAIR *lm_password; - lm_password = fr_pair_find_by_num(request->control, 0, FR_LM_PASSWORD, TAG_ANY); + lm_password = fr_pair_find_by_da(request->control, attr_lm_password, TAG_ANY); if (lm_password) { VP_VERIFY(lm_password); @@ -1598,12 +1648,8 @@ static bool CC_HINT(nonnull (1, 2, 5)) find_lm_password(rlm_mschap_t const *inst if (password) { RDEBUG2("Found Cleartext-Password, hashing to create LM-Password"); - lm_password = pair_make_config("LM-Password", NULL, T_OP_EQ); - if (!lm_password) { - RERROR("No memory"); - return false; - } + MEM(lm_password = pair_update_control(attr_lm_password, 0)); p = talloc_array(lm_password, uint8_t, LM_DIGEST_LENGTH); fr_pair_value_memsteal(lm_password, p); smbdes_lmpwdhash(password->vp_strvalue, p); @@ -1737,7 +1783,7 @@ static rlm_rcode_t CC_HINT(nonnull) process_cpw_request(rlm_mschap_t const *inst REDEBUG("Password change failed"); snprintf(buffer, sizeof(buffer), "E=709 R=0 M=Password change failed"); - mschap_add_reply(request, cpw->vp_octets[1], "MS-CHAP-Error", buffer, strlen(buffer)); + mschap_add_reply(request, cpw->vp_octets[1], attr_ms_chap_error, buffer, strlen(buffer)); return RLM_MODULE_REJECT; } @@ -1767,19 +1813,19 @@ static rlm_rcode_t CC_HINT(nonnull) process_cpw_request(rlm_mschap_t const *inst */ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(void *instance, UNUSED void *thread, REQUEST *request) { - rlm_mschap_t const *inst = instance; - VALUE_PAIR *challenge = NULL; - VALUE_PAIR *response = NULL; - VALUE_PAIR *cpw = NULL; - VALUE_PAIR *password = NULL; - VALUE_PAIR *lm_password, *nt_password, *smb_ctrl; - VALUE_PAIR *username; - uint8_t nthashhash[NT_DIGEST_LENGTH]; - char msch2resp[42]; - char const *username_string; - int mschap_version = 0; - int mschap_result; - MSCHAP_AUTH_METHOD auth_method; + rlm_mschap_t const *inst = instance; + VALUE_PAIR *challenge = NULL; + VALUE_PAIR *response = NULL; + VALUE_PAIR *cpw = NULL; + VALUE_PAIR *password = NULL; + VALUE_PAIR *lm_password, *nt_password, *smb_ctrl; + VALUE_PAIR *username; + uint8_t nthashhash[NT_DIGEST_LENGTH]; + char msch2resp[42]; + char const *username_string; + int mschap_version = 0; + int mschap_result; + MSCHAP_AUTH_METHOD auth_method; /* * If we have ntlm_auth configured, use it unless told @@ -1792,22 +1838,20 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(void *instance, UNUSED void * want to suppress it. */ if (auth_method != AUTH_INTERNAL) { - VALUE_PAIR *vp = fr_pair_find_by_num(request->control, 0, FR_MS_CHAP_USE_NTLM_AUTH, TAG_ANY); - if (vp && vp->vp_uint32 == 0) auth_method = AUTH_INTERNAL; + VALUE_PAIR *vp = fr_pair_find_by_da(request->control, attr_ms_chap_use_ntlm_auth, TAG_ANY); + if (vp && vp->vp_bool == false) auth_method = AUTH_INTERNAL; } /* * Find the SMB-Account-Ctrl attribute, or the * SMB-Account-Ctrl-Text attribute. */ - smb_ctrl = fr_pair_find_by_num(request->control, 0, FR_SMB_ACCOUNT_CTRL, TAG_ANY); + smb_ctrl = fr_pair_find_by_da(request->control, attr_smb_account_ctrl, TAG_ANY); if (!smb_ctrl) { - password = fr_pair_find_by_num(request->control, 0, FR_SMB_ACCOUNT_CTRL_TEXT, TAG_ANY); + password = fr_pair_find_by_da(request->control, attr_smb_account_ctrl_text, TAG_ANY); if (password) { - smb_ctrl = pair_make_config("SMB-Account-CTRL", "0", T_OP_SET); - if (smb_ctrl) { - smb_ctrl->vp_uint32 = pdb_decode_acct_ctrl(password->vp_strvalue); - } + MEM(smb_ctrl = pair_add_control(attr_smb_account_ctrl, 0)); + smb_ctrl->vp_uint32 = pdb_decode_acct_ctrl(password->vp_strvalue); } } @@ -1828,7 +1872,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(void *instance, UNUSED void /* * Decide how to get the passwords. */ - password = fr_pair_find_by_num(request->control, 0, FR_CLEARTEXT_PASSWORD, TAG_ANY); + password = fr_pair_find_by_da(request->control, attr_cleartext_password, TAG_ANY); /* * Look for or create an NT-Password @@ -1849,15 +1893,13 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(void *instance, UNUSED void * Check to see if this is a change password request, and process * it accordingly if so. */ - cpw = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP2_CPW, TAG_ANY); + cpw = fr_pair_find_by_da(request->packet->vps, attr_ms_chap2_cpw, TAG_ANY); if (cpw) { uint8_t *p; rlm_rcode_t rc; rc = process_cpw_request(instance, request, cpw, nt_password); - if (rc != RLM_MODULE_OK) { - return rc; - } + if (rc != RLM_MODULE_OK) return rc; /* * Clear any expiry bit so the user can now login; @@ -1874,9 +1916,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(void *instance, UNUSED void * password change, add them into the request and then * continue with the authentication. */ - response = radius_pair_create(request->packet, &request->packet->vps, - FR_MSCHAP2_RESPONSE, - VENDORPEC_MICROSOFT); + MEM(response = pair_update_reply(attr_ms_chap2_response, 0)); p = talloc_array(response, uint8_t, 50); /* ident & flags */ @@ -1888,7 +1928,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(void *instance, UNUSED void fr_pair_value_memsteal(response, p); } - challenge = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_CHALLENGE, TAG_ANY); + challenge = fr_pair_find_by_da(request->packet->vps, attr_ms_chap_challenge, TAG_ANY); if (!challenge) { REDEBUG("You set 'Auth-Type = MS-CHAP' for a request that does not contain any MS-CHAP attributes!"); return RLM_MODULE_REJECT; @@ -1897,7 +1937,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(void *instance, UNUSED void /* * We also require an MS-CHAP-Response. */ - response = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP_RESPONSE, TAG_ANY); + response = fr_pair_find_by_da(request->packet->vps, attr_ms_chap_response, TAG_ANY); /* * MS-CHAP-Response, means MS-CHAPv1 @@ -1945,11 +1985,9 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(void *instance, UNUSED void /* * Check for errors, and add MSCHAP-Error if necessary. */ - rcode = mschap_error(inst, request, *response->vp_octets, - mschap_result, mschap_version, smb_ctrl); + rcode = mschap_error(inst, request, *response->vp_octets, mschap_result, mschap_version, smb_ctrl); if (rcode != RLM_MODULE_OK) return rcode; - } else if ((response = fr_pair_find_by_num(request->packet->vps, VENDORPEC_MICROSOFT, FR_MSCHAP2_RESPONSE, - TAG_ANY)) != NULL) { + } else if ((response = fr_pair_find_by_da(request->packet->vps, attr_ms_chap2_response, TAG_ANY)) != NULL) { uint8_t mschapv1_challenge[16]; VALUE_PAIR *name_attr, *response_name, *peer_challenge_attr; rlm_rcode_t rcode; @@ -1976,7 +2014,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(void *instance, UNUSED void /* * We also require a User-Name */ - username = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY); + username = fr_pair_find_by_da(request->packet->vps, attr_user_name, TAG_ANY); if (!username) { REDEBUG("We require a User-Name for MS-CHAPv2"); return RLM_MODULE_INVALID; @@ -1991,7 +2029,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(void *instance, UNUSED void * We prefer this to the User-Name in the * packet. */ - response_name = fr_pair_find_by_num(request->packet->vps, 0, FR_MS_CHAP_USER_NAME, TAG_ANY); + response_name = fr_pair_find_by_da(request->packet->vps, attr_ms_chap_user_name, TAG_ANY); name_attr = response_name ? response_name : username; /* @@ -2033,7 +2071,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(void *instance, UNUSED void #endif peer_challenge = response->vp_octets + 2; - peer_challenge_attr = fr_pair_find_by_num(request->control, 0, FR_MS_CHAP_PEER_CHALLENGE, TAG_ANY); + peer_challenge_attr = fr_pair_find_by_da(request->control, attr_ms_chap_peer_challenge, TAG_ANY); if (peer_challenge_attr) { RDEBUG2("Overriding peer challenge"); peer_challenge = peer_challenge_attr->vp_octets; @@ -2065,9 +2103,11 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(void *instance, UNUSED void #ifdef WITH_AUTH_WINBIND if (inst->wb_retry_with_normalised_username) { - if ((response_name = fr_pair_find_by_num(request->packet->vps, 0, FR_MS_CHAP_USER_NAME, TAG_ANY))) { + response_name = fr_pair_find_by_da(request->packet->vps, attr_ms_chap_user_name, TAG_ANY) + if (response_name) { if (strcmp(username_string, response_name->vp_strvalue)) { - RDEBUG2("Changing username %s to %s", username_string, response_name->vp_strvalue); + RDEBUG2("Changing username %s to %s", username_string, + response_name->vp_strvalue); username_string = response_name->vp_strvalue; } } @@ -2080,9 +2120,7 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(void *instance, UNUSED void peer_challenge, /* peer challenge */ challenge->vp_octets, /* our challenge */ msch2resp); /* calculated MPPE key */ - mschap_add_reply(request, *response->vp_octets, "MS-CHAP2-Success", msch2resp, 42); - - + mschap_add_reply(request, *response->vp_octets, attr_ms_chap2_success, msch2resp, 42); } else { /* Neither CHAPv1 or CHAPv2 response: die */ REDEBUG("You set 'Auth-Type = MS-CHAP' for a request that does not contain any MS-CHAP attributes!"); return RLM_MODULE_INVALID; @@ -2090,8 +2128,9 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(void *instance, UNUSED void /* now create MPPE attributes */ if (inst->use_mppe) { - uint8_t mppe_sendkey[34]; - uint8_t mppe_recvkey[34]; + VALUE_PAIR *vp; + uint8_t mppe_sendkey[34]; + uint8_t mppe_recvkey[34]; switch (mschap_version) { case 1: @@ -2112,15 +2151,15 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(void *instance, UNUSED void * is not available. */ memcpy(mppe_sendkey + 8, nthashhash, NT_DIGEST_LENGTH); - mppe_add_reply(request, "MS-CHAP-MPPE-Keys", mppe_sendkey, 24); //-V666 + mppe_add_reply(request, attr_ms_chap_mppe_keys, mppe_sendkey, 24); //-V666 break; case 2: RDEBUG2("Adding MS-CHAPv2 MPPE keys"); mppe_chap2_gen_keys128(nthashhash, response->vp_octets + 26, mppe_sendkey, mppe_recvkey); - mppe_add_reply(request, "MS-MPPE-Recv-Key", mppe_recvkey, 16); - mppe_add_reply(request, "MS-MPPE-Send-Key", mppe_sendkey, 16); + mppe_add_reply(request, attr_ms_mppe_recv_key, mppe_recvkey, 16); + mppe_add_reply(request, attr_ms_mppe_send_key, mppe_sendkey, 16); break; default: @@ -2128,10 +2167,11 @@ static rlm_rcode_t CC_HINT(nonnull) mod_authenticate(void *instance, UNUSED void break; } - pair_make_reply("MS-MPPE-Encryption-Policy", - (inst->require_encryption) ? "0x00000002":"0x00000001", T_OP_EQ); - pair_make_reply("MS-MPPE-Encryption-Types", - (inst->require_strong) ? "0x00000004":"0x00000006", T_OP_EQ); + MEM(vp = pair_update_reply(attr_ms_mppe_encryption_policy, 0)); + vp->vp_uint32 = inst->require_encryption ? 2 : 1; + + MEM(vp = pair_update_reply(attr_ms_mppe_encryption_types, 0)); + vp->vp_uint32 = inst->require_strong ? 4 : 6; } /* else we weren't asked to use MPPE */ return RLM_MODULE_OK; diff --git a/src/modules/rlm_mschap/rlm_mschap.h b/src/modules/rlm_mschap/rlm_mschap.h index 15fece98567..964ded527fb 100644 --- a/src/modules/rlm_mschap/rlm_mschap.h +++ b/src/modules/rlm_mschap/rlm_mschap.h @@ -22,6 +22,12 @@ typedef enum { #endif } MSCHAP_AUTH_METHOD; +extern fr_dict_attr_t const *attr_ms_chap_user_name; +extern fr_dict_attr_t const *attr_ms_chap_challenge; +extern fr_dict_attr_t const *attr_ms_chap_response; +extern fr_dict_attr_t const *attr_ms_chap2_response; +extern fr_dict_attr_t const *attr_ms_chap2_success; + typedef struct rlm_mschap_t { bool use_mppe; bool require_encryption;