From: Arran Cudbard-Bell Date: Fri, 25 May 2018 11:22:16 +0000 (+0600) Subject: Move all the extremely RADIUS specific logging options out of the server core into... X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=6b2233b3520ea0d74f78ebf6bc19b47b0f97e515;p=thirdparty%2Ffreeradius-server.git Move all the extremely RADIUS specific logging options out of the server core into proto_radius_auth.c --- diff --git a/raddb/radiusd.conf.in b/raddb/radiusd.conf.in index 865d0b38908..43457601364 100644 --- a/raddb/radiusd.conf.in +++ b/raddb/radiusd.conf.in @@ -265,43 +265,6 @@ log { # don't want to change this. # syslog_facility = daemon - - # Log the full User-Name attribute, as it was found in the request. - # - # allowed values: {no, yes} - # - stripped_names = no - - # Log authentication requests to the log file. - # - # allowed values: {no, yes} - # - auth = no - - # Log passwords with the authentication requests. - # auth_badpass - logs password if it's rejected - # auth_goodpass - logs password if it's correct - # - # allowed values: {no, yes} - # - auth_badpass = no - auth_goodpass = no - - # Log additional text at the end of the "Login OK" messages. - # for these to work, the "auth" and "auth_goodpass" or "auth_badpass" - # configurations above have to be set to "yes". - # - # The strings below are dynamically expanded, which means that - # you can put anything you want in them. However, note that - # this expansion can be slow, and can negatively impact server - # performance. - # -# msg_goodpass = "" -# msg_badpass = "" - - # The message when the user exceeds the Simultaneous-Use limit. - # - msg_denied = "You are already logged in - access denied" } # ENVIRONMENT VARIABLES diff --git a/raddb/sites-available/default b/raddb/sites-available/default index 1d471d72775..0f43dd0a5f7 100644 --- a/raddb/sites-available/default +++ b/raddb/sites-available/default @@ -255,6 +255,46 @@ server default { # deny = 127.0.0/24 } } + + auth { + # Log the full User-Name attribute, as it was found in the request. + # + # allowed values: {no, yes} + # + stripped_names = no + + # Log authentication requests to the log file. + # + # allowed values: {no, yes} + # + auth = no + + # Log passwords with the authentication requests. + # + # auth_badpass - logs password if it's rejected + # auth_goodpass - logs password if it's correct + # + # allowed values: {no, yes} + # + auth_badpass = no + auth_goodpass = no + + # Log additional text at the end of the "Login OK" messages. + # for these to work, the "auth" and "auth_goodpass" or "auth_badpass" + # configurations above have to be set to "yes". + # + # The strings below are dynamically expanded, which means that + # you can put anything you want in them. However, note that + # this expansion can be slow, and can negatively impact server + # performance. + # +# msg_goodpass = "" +# msg_badpass = "" + + # The message when the user exceeds the Simultaneous-Use limit. + # + msg_denied = "You are already logged in - access denied" + } } listen { diff --git a/src/include/radiusd.h b/src/include/radiusd.h index 1e009d3e355..4565d780d99 100644 --- a/src/include/radiusd.h +++ b/src/include/radiusd.h @@ -105,15 +105,6 @@ typedef struct main_config { char const *name; //!< Name of the daemon, usually 'radiusd'. CONF_SECTION *config; //!< Root of the server config. - bool log_auth; //!< Log authentication attempts. - bool log_auth_badpass; //!< Log successful authentications. - bool log_auth_goodpass; //!< Log failed authentications. - char const *auth_badpass_msg; //!< Additional text to append to successful auth messages. - char const *auth_goodpass_msg; //!< Additional text to append to failed auth messages. - - char const *denied_msg; //!< Additional text to append if the user is already logged - //!< in (simultaneous use check failed). - bool daemonize; //!< Should the server daemonize on startup. bool spawn_workers; //!< Should the server spawn threads. char const *pid_file; //!< Path to write out PID file. @@ -131,7 +122,7 @@ typedef struct main_config { char const *log_file; int syslog_facility; - char const *dict_dir; //!< Where to load dictionaries from. + char const *dict_dir; //!< Where to load dictionaries from. struct timeval init_delay; //!< Initial request processing delay. @@ -338,7 +329,6 @@ extern fr_log_lvl_t req_debug_lvl; extern char const *radacct_dir; extern char const *log_dir; extern char const *radlib_dir; -extern bool log_stripped_names; extern char const *radiusd_version; extern char const *radiusd_version_short; void radius_signal_self(int flag); diff --git a/src/main/auth.c b/src/main/auth.c index c52ca4aac34..80105482be3 100644 --- a/src/main/auth.c +++ b/src/main/auth.c @@ -64,97 +64,6 @@ char *auth_name(char *buf, size_t buflen, REQUEST *request, bool do_cli) return buf; } - - -/* - * Make sure user/pass are clean - * and then log them - */ -static int rad_authlog(char const *msg, REQUEST *request, int goodpass) -{ - int logit; - char const *extra_msg = NULL; - char clean_password[1024]; - char clean_username[1024]; - char buf[1024]; - char extra[1024]; - char *p; - VALUE_PAIR *username = NULL; - - if (!request->root->log_auth) { - return 0; - } - - /* - * Get the correct username based on the configured value - */ - if (!log_stripped_names) { - username = fr_pair_find_by_num(request->packet->vps, 0, FR_USER_NAME, TAG_ANY); - } else { - username = request->username; - } - - /* - * Clean up the username - */ - if (username == NULL) { - strcpy(clean_username, ""); - } else { - fr_snprint(clean_username, sizeof(clean_username), username->vp_strvalue, username->vp_length, '\0'); - } - - /* - * Clean up the password - */ - if (request->root->log_auth_badpass || request->root->log_auth_goodpass) { - if (!request->password) { - VALUE_PAIR *auth_type; - - auth_type = fr_pair_find_by_num(request->control, 0, FR_AUTH_TYPE, TAG_ANY); - if (auth_type) { - snprintf(clean_password, sizeof(clean_password), - "", - fr_dict_enum_alias_by_value(auth_type->da, &auth_type->data)); - } else { - strcpy(clean_password, ""); - } - } else if (fr_pair_find_by_num(request->packet->vps, 0, FR_CHAP_PASSWORD, TAG_ANY)) { - strcpy(clean_password, ""); - } else { - fr_snprint(clean_password, sizeof(clean_password), - request->password->vp_strvalue, request->password->vp_length, '\0'); - } - } - - if (goodpass) { - logit = request->root->log_auth_goodpass; - extra_msg = request->root->auth_goodpass_msg; - } else { - logit = request->root->log_auth_badpass; - extra_msg = request->root->auth_badpass_msg; - } - - if (extra_msg) { - extra[0] = ' '; - p = extra + 1; - if (xlat_eval(p, sizeof(extra) - 1, request, extra_msg, NULL, NULL) < 0) { - return -1; - } - } else { - *extra = '\0'; - } - - RAUTH("%s: [%s%s%s] (%s)%s", - msg, - clean_username, - logit ? "/" : "", - logit ? clean_password : "", - auth_name(buf, sizeof(buf), request, 1), - extra); - - return 0; -} - /* * Check password. * @@ -392,14 +301,6 @@ autz_redo: case RLM_MODULE_REJECT: case RLM_MODULE_USERLOCK: default: - if ((module_msg = fr_pair_find_by_num(request->packet->vps, 0, FR_MODULE_FAILURE_MESSAGE, TAG_ANY)) != NULL) { - char msg[FR_MAX_STRING_LEN + 16]; - snprintf(msg, sizeof(msg), "Invalid user (%s)", - module_msg->vp_strvalue); - rad_authlog(msg,request,0); - } else { - rad_authlog("Invalid user", request, 0); - } request->reply->code = FR_CODE_ACCESS_REJECT; return rcode; } @@ -436,16 +337,6 @@ autz_redo: RDEBUG2("Failed to authenticate the user"); request->reply->code = FR_CODE_ACCESS_REJECT; - if ((module_msg = fr_pair_find_by_num(request->packet->vps, 0, FR_MODULE_FAILURE_MESSAGE, TAG_ANY)) != NULL){ - char msg[FR_MAX_STRING_LEN+19]; - - snprintf(msg, sizeof(msg), "Login incorrect (%s)", - module_msg->vp_strvalue); - rad_authlog(msg, request, 0); - } else { - rad_authlog("Login incorrect", request, 0); - } - if (request->password) { VP_VERIFY(request->password); /* double check: maybe the secret is wrong? */ @@ -482,16 +373,6 @@ autz_redo: */ if (request->reply->code == 0) request->reply->code = FR_CODE_ACCESS_ACCEPT; - if ((module_msg = fr_pair_find_by_num(request->packet->vps, 0, FR_MODULE_SUCCESS_MESSAGE, TAG_ANY)) != NULL){ - char msg[FR_MAX_STRING_LEN+12]; - - snprintf(msg, sizeof(msg), "Login OK (%s)", - module_msg->vp_strvalue); - rad_authlog(msg, request, 1); - } else { - rad_authlog("Login OK", request, 1); - } - return rcode; } diff --git a/src/main/cf_parse.c b/src/main/cf_parse.c index 53cd6ee4ca9..6702b8cafdc 100644 --- a/src/main/cf_parse.c +++ b/src/main/cf_parse.c @@ -666,7 +666,7 @@ static int CC_HINT(nonnull(3,4)) cf_pair_parse_internal(TALLOC_CTX *ctx, void *o } /* - * Switch between customer parsing function + * Switch between custom parsing function * and the standard value parsing function. */ if (rule->func) { diff --git a/src/main/mainconfig.c b/src/main/mainconfig.c index fd9fac627d8..83246e7c944 100644 --- a/src/main/mainconfig.c +++ b/src/main/mainconfig.c @@ -122,16 +122,9 @@ static const CONF_PARSER initial_logging_config[] = { * **********************************************************************/ static const CONF_PARSER log_config[] = { - { FR_CONF_POINTER("stripped_names", FR_TYPE_BOOL, &log_stripped_names), .dflt = "no" }, - { FR_CONF_POINTER("auth", FR_TYPE_BOOL, &main_config.log_auth), .dflt = "no" }, - { FR_CONF_POINTER("auth_badpass", FR_TYPE_BOOL, &main_config.log_auth_badpass), .dflt = "no" }, - { FR_CONF_POINTER("auth_goodpass", FR_TYPE_BOOL, &main_config.log_auth_goodpass), .dflt = "no" }, - { FR_CONF_POINTER("msg_badpass", FR_TYPE_STRING, &main_config.auth_badpass_msg) }, - { FR_CONF_POINTER("msg_goodpass", FR_TYPE_STRING, &main_config.auth_goodpass_msg) }, { FR_CONF_POINTER("colourise", FR_TYPE_BOOL, &do_colourise) }, { FR_CONF_POINTER("timestamp", FR_TYPE_BOOL, &log_timestamp) }, { FR_CONF_POINTER("use_utc", FR_TYPE_BOOL, &log_dates_utc) }, - { FR_CONF_POINTER("msg_denied", FR_TYPE_STRING, &main_config.denied_msg), .dflt = "You are already logged in - access denied" }, #ifdef WITH_CONF_WRITE { FR_CONF_POINTER("write_dir", FR_TYPE_STRING, &main_config.write_dir), .dflt = NULL }, #endif @@ -196,10 +189,10 @@ static const CONF_PARSER server_config[] = { * DON'T exist in radiusd.conf, then the previously parsed * values for "log { foo = bar}" will be used. */ - { FR_CONF_POINTER("log_auth", FR_TYPE_BOOL | FR_TYPE_DEPRECATED, &main_config.log_auth) }, - { FR_CONF_POINTER("log_auth_badpass", FR_TYPE_BOOL | FR_TYPE_DEPRECATED, &main_config.log_auth_badpass) }, - { FR_CONF_POINTER("log_auth_goodpass", FR_TYPE_BOOL | FR_TYPE_DEPRECATED, &main_config.log_auth_goodpass) }, - { FR_CONF_POINTER("log_stripped_names", FR_TYPE_BOOL | FR_TYPE_DEPRECATED, &log_stripped_names) }, + { FR_CONF_DEPRECATED("log_auth", FR_TYPE_BOOL, NULL, NULL) }, + { FR_CONF_DEPRECATED("log_auth_badpass", FR_TYPE_BOOL, NULL, NULL) }, + { FR_CONF_DEPRECATED("log_auth_goodpass", FR_TYPE_BOOL, NULL, NULL ) }, + { FR_CONF_DEPRECATED("log_stripped_names", FR_TYPE_BOOL, NULL, NULL) }, CONF_PARSER_TERMINATOR }; diff --git a/src/main/radiusd.c b/src/main/radiusd.c index 86b2e4aeaf6..eb2ecd596aa 100644 --- a/src/main/radiusd.c +++ b/src/main/radiusd.c @@ -66,8 +66,6 @@ RCSID("$Id$") char const *radacct_dir = NULL; char const *log_dir = NULL; -bool log_stripped_names; - char const *radiusd_version = RADIUSD_VERSION_STRING_BUILD("FreeRADIUS"); static pid_t radius_pid; @@ -315,9 +313,6 @@ int main(int argc, char *argv[]) main_config.spawn_workers = false; main_config.daemonize = false; rad_debug_lvl += 2; - main_config.log_auth = true; - main_config.log_auth_badpass = true; - main_config.log_auth_goodpass = true; do_stdout: fr_log_fp = stdout; default_log.dst = L_DST_STDOUT; diff --git a/src/main/radwho.c b/src/main/radwho.c index 88f1c53a6ac..9df3ce3bdee 100644 --- a/src/main/radwho.c +++ b/src/main/radwho.c @@ -55,8 +55,6 @@ static char const *dict_dir = DICTDIR; char const *radacct_dir = NULL; -bool log_stripped_names; - /* * Global, for log.c to use. */ diff --git a/src/main/unit_test_module.c b/src/main/unit_test_module.c index 8cfd0f81e33..d8b86dc2289 100644 --- a/src/main/unit_test_module.c +++ b/src/main/unit_test_module.c @@ -44,7 +44,7 @@ RCSID("$Id$") */ char const *radacct_dir = NULL; char const *log_dir = NULL; -bool log_stripped_names = false; + static bool filedone = false; @@ -782,9 +782,6 @@ int main(int argc, char *argv[]) case 'X': rad_debug_lvl += 2; - main_config.log_auth = true; - main_config.log_auth_badpass = true; - main_config.log_auth_goodpass = true; break; case 'x': diff --git a/src/modules/proto_radius/proto_radius.c b/src/modules/proto_radius/proto_radius.c index 0430b8f8e01..020fd941862 100644 --- a/src/modules/proto_radius/proto_radius.c +++ b/src/modules/proto_radius/proto_radius.c @@ -155,6 +155,7 @@ static int type_parse(TALLOC_CTX *ctx, void *out, CONF_ITEM *ci, UNUSED CONF_PAR char const *type_str = cf_pair_value(cf_item_to_pair(ci)); CONF_SECTION *listen_cs = cf_item_to_section(cf_parent(ci)); + CONF_SECTION *process_app_cs; CONF_SECTION *server = cf_item_to_section(cf_parent(listen_cs)); proto_radius_t *inst; dl_instance_t *parent_inst; @@ -231,10 +232,21 @@ static int type_parse(TALLOC_CTX *ctx, void *out, CONF_ITEM *ci, UNUSED CONF_PAR inst->code_allowed[FR_CODE_DISCONNECT_REQUEST] = true; } + process_app_cs = cf_section_find(listen_cs, name, NULL); + + /* + * Allocate an empty section if one doesn't exist + * this is so defaults get parsed. + */ + if (!process_app_cs) { + process_app_cs = cf_section_alloc(listen_cs, listen_cs, name, NULL); + cf_section_add(listen_cs, process_app_cs); + } + /* * Parent dl_instance_t added in virtual_servers.c (listen_parse) */ - return dl_instance(ctx, out, listen_cs, parent_inst, name, DL_TYPE_SUBMODULE); + return dl_instance(ctx, out, cf_section_find(listen_cs, name, NULL), parent_inst, name, DL_TYPE_SUBMODULE); } /** Wrapper around dl_instance @@ -261,7 +273,10 @@ static int transport_parse(TALLOC_CTX *ctx, void *out, CONF_ITEM *ci, UNUSED CON * Allocate an empty section if one doesn't exist * this is so defaults get parsed. */ - if (!transport_cs) transport_cs = cf_section_alloc(listen_cs, listen_cs, name, NULL); + if (!transport_cs) { + transport_cs = cf_section_alloc(listen_cs, listen_cs, name, NULL); + cf_section_add(listen_cs, transport_cs); + } parent_inst = cf_data_value(cf_data_find(listen_cs, dl_instance_t, "proto_radius")); rad_assert(parent_inst); diff --git a/src/modules/proto_radius/proto_radius_auth.c b/src/modules/proto_radius/proto_radius_auth.c index 3cffe8c9f37..92c3414c85c 100644 --- a/src/modules/proto_radius/proto_radius_auth.c +++ b/src/modules/proto_radius/proto_radius_auth.c @@ -34,6 +34,30 @@ #define USEC (1000000) #endif +typedef struct { + bool log_stripped_names; + bool log_auth; //!< Log authentication attempts. + bool log_auth_badpass; //!< Log successful authentications. + bool log_auth_goodpass; //!< Log failed authentications. + char const *auth_badpass_msg; //!< Additional text to append to successful auth messages. + char const *auth_goodpass_msg; //!< Additional text to append to failed auth messages. + + char const *denied_msg; //!< Additional text to append if the user is already logged + //!< in (simultaneous use check failed). +} proto_radius_auth_t; + +static const CONF_PARSER proto_radius_auth_config[] = { + { FR_CONF_OFFSET("log_stripped_names", FR_TYPE_BOOL, proto_radius_auth_t, log_stripped_names), .dflt = "no" }, + { FR_CONF_OFFSET("log_auth", FR_TYPE_BOOL, proto_radius_auth_t, log_auth), .dflt = "no" }, + { FR_CONF_OFFSET("log_auth_badpass", FR_TYPE_BOOL, proto_radius_auth_t, log_auth_badpass), .dflt = "no" }, + { FR_CONF_OFFSET("log_auth_goodpass", FR_TYPE_BOOL,proto_radius_auth_t, log_auth_goodpass), .dflt = "no" }, + { FR_CONF_OFFSET("msg_badpass", FR_TYPE_STRING, proto_radius_auth_t, auth_badpass_msg) }, + { FR_CONF_OFFSET("msg_goodpass", FR_TYPE_STRING, proto_radius_auth_t, auth_goodpass_msg) }, + { FR_CONF_OFFSET("msg_denied", FR_TYPE_STRING, proto_radius_auth_t, denied_msg), .dflt = "You are already logged in - access denied" }, + + CONF_PARSER_TERMINATOR +}; + static fr_dict_t *dict_freeradius; static fr_dict_t *dict_radius; @@ -72,7 +96,8 @@ fr_dict_attr_autoload_t proto_radius_auth_dict_attr[] = { * Make sure user/pass are clean and then create an attribute * which contains the log message. */ -static void CC_HINT(format (printf, 3, 4)) auth_message(REQUEST *request, bool goodpass, char const *fmt, ...) +static void CC_HINT(format (printf, 4, 5)) auth_message(proto_radius_auth_t const *inst, + REQUEST *request, bool goodpass, char const *fmt, ...) { va_list ap; @@ -91,7 +116,7 @@ static void CC_HINT(format (printf, 3, 4)) auth_message(REQUEST *request, bool g /* * Get the correct username based on the configured value */ - if (!log_stripped_names) { + if (!inst->log_stripped_names) { username = fr_pair_find_by_da(request->packet->vps, attr_user_name, TAG_ANY); } else { username = request->username; @@ -100,7 +125,7 @@ static void CC_HINT(format (printf, 3, 4)) auth_message(REQUEST *request, bool g /* * Clean up the password */ - if (request->root->log_auth_badpass || request->root->log_auth_goodpass) { + if (inst->log_auth_badpass || inst->log_auth_goodpass) { if (!request->password) { VALUE_PAIR *auth_type; @@ -118,11 +143,11 @@ static void CC_HINT(format (printf, 3, 4)) auth_message(REQUEST *request, bool g } if (goodpass) { - logit = request->root->log_auth_goodpass; - extra_msg = request->root->auth_goodpass_msg; + logit = inst->log_auth_goodpass; + extra_msg = inst->auth_goodpass_msg; } else { - logit = request->root->log_auth_badpass; - extra_msg = request->root->auth_badpass_msg; + logit = inst->log_auth_badpass; + extra_msg = inst->auth_badpass_msg; } if (extra_msg) { @@ -151,13 +176,14 @@ static void CC_HINT(format (printf, 3, 4)) auth_message(REQUEST *request, bool g talloc_free(msg); } -static fr_io_final_t mod_process(UNUSED void const *instance, REQUEST *request, fr_io_action_t action) +static fr_io_final_t mod_process(void const *instance, REQUEST *request, fr_io_action_t action) { - VALUE_PAIR *vp, *auth_type; - rlm_rcode_t rcode; - CONF_SECTION *unlang; - fr_dict_enum_t const *dv = NULL; - fr_cursor_t cursor; + proto_radius_auth_t const *inst = instance; + VALUE_PAIR *vp, *auth_type; + rlm_rcode_t rcode; + CONF_SECTION *unlang; + fr_dict_enum_t const *dv = NULL; + fr_cursor_t cursor; REQUEST_VERIFY(request); @@ -230,9 +256,9 @@ static fr_io_final_t mod_process(UNUSED void const *instance, REQUEST *request, default: if ((vp = fr_pair_find_by_da(request->packet->vps, attr_module_failure_message, TAG_ANY)) != NULL) { - auth_message(request, false, "Invalid user (%pV)", &vp->data); + auth_message(inst, request, false, "Invalid user (%pV)", &vp->data); } else { - auth_message(request, false, "Invalid user"); + auth_message(inst, request, false, "Invalid user"); } request->reply->code = FR_CODE_ACCESS_REJECT; @@ -355,9 +381,9 @@ static fr_io_final_t mod_process(UNUSED void const *instance, REQUEST *request, vp = fr_pair_find_by_da(request->packet->vps, attr_module_failure_message, TAG_ANY); if (vp) { - auth_message(request, false, "Login incorrect (%pV)", &vp->data); + auth_message(inst, request, false, "Login incorrect (%pV)", &vp->data); } else { - auth_message(request, false, "Login incorrect"); + auth_message(inst, request, false, "Login incorrect"); } /* @@ -403,9 +429,9 @@ static fr_io_final_t mod_process(UNUSED void const *instance, REQUEST *request, if (request->reply->code == FR_CODE_ACCESS_ACCEPT) { vp = fr_pair_find_by_da(request->packet->vps, attr_module_success_message, TAG_ANY); if (vp){ - auth_message(request, true, "Login OK (%pV)", &vp->data); + auth_message(inst, request, true, "Login OK (%pV)", &vp->data); } else { - auth_message(request, true, "Login OK"); + auth_message(inst, request, true, "Login OK"); } } @@ -554,8 +580,9 @@ static fr_io_final_t mod_process(UNUSED void const *instance, REQUEST *request, } -static int mod_bootstrap(UNUSED void *instance, CONF_SECTION *listen_cs) +static int mod_bootstrap(UNUSED void *instance, CONF_SECTION *process_app_cs) { + CONF_SECTION *listen_cs = cf_item_to_section(cf_parent(process_app_cs)); CONF_SECTION *server_cs; rad_assert(listen_cs); @@ -563,16 +590,16 @@ static int mod_bootstrap(UNUSED void *instance, CONF_SECTION *listen_cs) server_cs = cf_item_to_section(cf_parent(listen_cs)); rad_assert(strcmp(cf_section_name1(server_cs), "server") == 0); - if (virtual_server_section_attribute_define(server_cs, "authenticate", attr_auth_type) < 0) return -1; return 0; } -static int mod_instantiate(UNUSED void *instance, CONF_SECTION *listen_cs) +static int mod_instantiate(UNUSED void *instance, CONF_SECTION *process_app_cs) { - CONF_SECTION *subcs = NULL;; + CONF_SECTION *listen_cs = cf_item_to_section(cf_parent(process_app_cs)); CONF_SECTION *server_cs; + CONF_SECTION *subcs = NULL; rad_assert(listen_cs); @@ -603,6 +630,9 @@ extern fr_app_process_t proto_radius_auth; fr_app_process_t proto_radius_auth = { .magic = RLM_MODULE_INIT, .name = "radius_auth", + .config = proto_radius_auth_config, + .inst_size = sizeof(proto_radius_auth_t), + .bootstrap = mod_bootstrap, .instantiate = mod_instantiate, .entry_point = mod_process,