base.c File Reference

TACACS+ handler. More...

#include <freeradius-devel/io/listen.h>
#include <freeradius-devel/io/master.h>
#include <freeradius-devel/server/main_config.h>
#include <freeradius-devel/server/protocol.h>
#include <freeradius-devel/server/state.h>
#include <freeradius-devel/tacacs/tacacs.h>
#include <freeradius-devel/unlang/call.h>
#include <freeradius-devel/util/debug.h>
#include <freeradius-devel/protocol/tacacs/tacacs.h>
#include <freeradius-devel/server/process.h>

Include dependency graph for base.c:

Go to the source code of this file.

Data Structures
struct	process_tacacs_auth_t
struct	process_tacacs_sections_t
struct	process_tacacs_session_t
struct	process_tacacs_t

Macros
#define	COPY(_attr)
#define	COPY_MISSING(_attr)
#define	EXTRACT(_attr)
#define	PROCESS_CODE_MAX   FR_TACACS_CODE_MAX
#define	PROCESS_INST   process_tacacs_t
#define	PROCESS_PACKET_CODE_VALID   FR_TACACS_PACKET_CODE_VALID
#define	PROCESS_PACKET_TYPE   fr_tacacs_packet_code_t

Functions
static int	mod_bootstrap (module_inst_ctx_t const *mctx)
static int	mod_instantiate (module_inst_ctx_t const *mctx)
static unlang_action_t	mod_process (rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
	RECV (accounting_request)
	RECV (auth_cont)
	RECV (auth_cont_abort)
	RECV (auth_start)
static uint32_t	reply_code (request_t *request, fr_dict_attr_t const *status_da, uint32_t const status2code[static UINT8_MAX+1], fr_process_state_t const *state, fr_process_rcode_t const process_rcode, rlm_rcode_t rcode)
	Try and determine what the response packet type should be. More...
	RESUME (accounting_request)
	RESUME (acct_type)
	RESUME (auth_cont_abort)
	RESUME (auth_fail)
	RESUME (auth_get)
	RESUME (auth_pass)
	RESUME (auth_restart)
	RESUME (auth_start)
	RESUME (auth_type)
	RESUME (autz_request)
static int	state_create (TALLOC_CTX *ctx, fr_pair_list_t *out, request_t *request, bool reply)

Variables
static const bool	acct_flag_valid [8]
static const uint32_t	acct_status_to_packet_code [UINT8_MAX+1]
static fr_dict_attr_t const *	attr_auth_type
static fr_dict_attr_t const *	attr_chap_password
static fr_dict_attr_t const *	attr_module_failure_message
static fr_dict_attr_t const *	attr_module_success_message
static fr_dict_attr_t const *	attr_packet_type
static fr_dict_attr_t const *	attr_stripped_user_name
static fr_dict_attr_t const *	attr_tacacs_accounting_flags
static fr_dict_attr_t const *	attr_tacacs_accounting_status
static fr_dict_attr_t const *	attr_tacacs_action
static fr_dict_attr_t const *	attr_tacacs_authentication_action
static fr_dict_attr_t const *	attr_tacacs_authentication_flags
static fr_dict_attr_t const *	attr_tacacs_authentication_service
static fr_dict_attr_t const *	attr_tacacs_authentication_status
static fr_dict_attr_t const *	attr_tacacs_authentication_type
static fr_dict_attr_t const *	attr_tacacs_authorization_status
static fr_dict_attr_t const *	attr_tacacs_client_port
static fr_dict_attr_t const *	attr_tacacs_data
static fr_dict_attr_t const *	attr_tacacs_privilege_level
static fr_dict_attr_t const *	attr_tacacs_remote_address
static fr_dict_attr_t const *	attr_tacacs_sequence_number
static fr_dict_attr_t const *	attr_tacacs_server_message
static fr_dict_attr_t const *	attr_tacacs_session_id
static fr_dict_attr_t const *	attr_tacacs_state
static fr_dict_attr_t const *	attr_tacacs_user_message
static fr_dict_attr_t const *	attr_user_name
static fr_dict_attr_t const *	attr_user_password
static const conf_parser_t	auth_config []
static const uint32_t	authen_status_to_packet_code [UINT8_MAX+1]
static const uint32_t	author_status_to_packet_code [UINT8_MAX+1]
static virtual_server_compile_t	compile_list []
static const conf_parser_t	config []
static fr_dict_t const *	dict_freeradius
static fr_dict_t const *	dict_tacacs
static fr_value_box_t const *	enum_auth_flags_noecho
static fr_value_box_t const *	enum_auth_type_accept
static fr_value_box_t const *	enum_auth_type_reject
static fr_value_box_t const *	enum_tacacs_auth_type_ascii
static fr_process_state_t const	process_state []
fr_process_module_t	process_tacacs
fr_dict_autoload_t	process_tacacs_dict []
fr_dict_attr_autoload_t	process_tacacs_dict_attr []
fr_dict_enum_autoload_t	process_tacacs_dict_enum []
static const conf_parser_t	session_config []

Detailed Description

TACACS+ handler.

Id

6f36a73888e56e8cc0d7104edff8391b818c10e6

Author

Jorge Pereira jpere.nosp@m.ira@.nosp@m.freer.nosp@m.adiu.nosp@m.s.org

Copyright

2020 The FreeRADIUS server project.

2020 Network RADIUS SAS (legal.nosp@m.@net.nosp@m.workr.nosp@m.adiu.nosp@m.s.com)

Definition in file base.c.

---

Data Structure Documentation

process_tacacs_auth_t

struct process_tacacs_auth_t

Definition at line 160 of file base.c.

Collaboration diagram for process_tacacs_auth_t:

Data Fields
uint32_t	max_rounds	maximum number of authentication rounds allowed
uint32_t	max_session	Maximum ongoing session allowed.
fr_time_delta_t	session_timeout	Maximum time between the last response and next request.
uint8_t	state_server_id	Sets a specific byte in the state to allow the authenticating server to be identified in packet captures.
fr_state_tree_t *	state_tree	State tree to link multiple requests/responses.

process_tacacs_sections_t

struct process_tacacs_sections_t

Definition at line 132 of file base.c.

Collaboration diagram for process_tacacs_sections_t:

Data Fields
CONF_SECTION *	acct_error
CONF_SECTION *	acct_request
CONF_SECTION *	acct_success
CONF_SECTION *	auth_cont
CONF_SECTION *	auth_cont_abort
CONF_SECTION *	auth_error
CONF_SECTION *	auth_fail
CONF_SECTION *	auth_getdata
CONF_SECTION *	auth_getpass
CONF_SECTION *	auth_getuser
CONF_SECTION *	auth_pass
CONF_SECTION *	auth_restart
CONF_SECTION *	auth_start
CONF_SECTION *	autz_error
CONF_SECTION *	autz_fail
CONF_SECTION *	autz_pass_add
CONF_SECTION *	autz_pass_replace
CONF_SECTION *	autz_request
CONF_SECTION *	do_not_respond
uint64_t	nothing

process_tacacs_session_t

struct process_tacacs_session_t

Definition at line 184 of file base.c.

Collaboration diagram for process_tacacs_session_t:

Data Fields
fr_pair_list_t	list	copied from the request
uint32_t	reply	for multiround state machine
uint32_t	rounds	how many rounds were taken
uint8_t	seq_no	sequence number of last request.

process_tacacs_t

struct process_tacacs_t

Definition at line 173 of file base.c.

Collaboration diagram for process_tacacs_t:

Data Fields
process_tacacs_auth_t	auth	Authentication configuration.
process_tacacs_sections_t	sections	Pointers to various config sections we need to execute.
CONF_SECTION *	server_cs	Our virtual server.
uint32_t	session_id	current session ID

Macro Definition Documentation

COPY

#define COPY

(

_attr

)

Value:

        do { \
        vp = fr_pair_find_by_da(&request->request_pairs, NULL, _attr); \
        if (!vp) break; \
        MEM(copy = fr_pair_copy(session, vp));  \
        fr_pair_append(&session->list, copy); \
        RDEBUG2("%pP", copy); \
} while (0)

COPY_MISSING

#define COPY_MISSING

(

_attr

)

Value:

        do { \
        vp = fr_pair_find_by_da(&session->list, NULL, _attr); \
        if (vp) break; \
        COPY(_attr); \
} while (0)

EXTRACT

#define EXTRACT

(

_attr

)

Value:

        vp = fr_pair_find_by_da(&request->request_pairs, NULL, attr_tacacs_user_message); \
        if (!vp) break; \
        fr_value_box_set_secret(&vp->data, _attr->flags.secret); \
        if (pair_append_request(&copy, _attr) < 0) break; \
        if (fr_pair_value_copy(copy, vp) < 0) { \
                fr_pair_remove(&request->request_pairs, copy); \
                talloc_free(copy); \
                break; \
        } \
        RDEBUG2("Populated %pP from user_message", copy)

PROCESS_CODE_MAX

#define PROCESS_CODE_MAX   FR_TACACS_CODE_MAX

Definition at line 193 of file base.c.

PROCESS_INST

#define PROCESS_INST   process_tacacs_t

Definition at line 195 of file base.c.

PROCESS_PACKET_CODE_VALID

#define PROCESS_PACKET_CODE_VALID   FR_TACACS_PACKET_CODE_VALID

Definition at line 194 of file base.c.

PROCESS_PACKET_TYPE

#define PROCESS_PACKET_TYPE   fr_tacacs_packet_code_t

Definition at line 192 of file base.c.

Function Documentation

mod_bootstrap()

static int mod_bootstrap ( module_inst_ctx_t const *  mctx )

static

Definition at line 1071 of file base.c.

Here is the call graph for this function:

mod_instantiate()

static int mod_instantiate ( module_inst_ctx_t const *  mctx )

static

Definition at line 1053 of file base.c.

Here is the call graph for this function:

mod_process()

static unlang_action_t mod_process ( rlm_rcode_t *  p_result, module_ctx_t const *  mctx, request_t *  request  )

static

Definition at line 1027 of file base.c.

Here is the call graph for this function:

RECV() [1/4]

RECV

(

accounting_request

)

Definition at line 937 of file base.c.

Here is the call graph for this function:

RECV() [2/4]

RECV

(

auth_cont

)

Definition at line 754 of file base.c.

Here is the call graph for this function:

RECV() [3/4]

RECV

(

auth_cont_abort

)

Definition at line 822 of file base.c.

Here is the call graph for this function:

RECV() [4/4]

RECV

(

auth_start

)

Definition at line 333 of file base.c.

Here is the call graph for this function:

reply_code()

static uint32_t reply_code ( request_t *  request, fr_dict_attr_t const *  status_da, uint32_t const  status2code[static UINT8_MAX+1], fr_process_state_t const *  state, fr_process_rcode_t const  process_rcode, rlm_rcode_t  rcode  )

static

Try and determine what the response packet type should be.

We check three sources:

• reply.<status_attr>
• reply.Packet-Type
• State machine packet type assignments for the section rcode

Parameters

[in]	request	The current request.
[in]	status_da	Specialised status attribute.
[in]	status2code	Mapping table of packet status types to rcodes.
[in]	state	Mappings for process state machine
[in]	process_rcode	Mappings for Auth-Type / Acct-Type, which don't use the process state machine
[in]	rcode	The last section rcode.

Returns

• >0 if we determined a reply code.
• 0 if we couldn't - Usually indicates additional sections should be run.

Definition at line 284 of file base.c.

Here is the call graph for this function:

Here is the caller graph for this function:

RESUME() [1/10]

RESUME

(

accounting_request

)

Definition at line 954 of file base.c.

Here is the call graph for this function:

RESUME() [2/10]

RESUME

(

acct_type

)

Definition at line 897 of file base.c.

Here is the call graph for this function:

RESUME() [3/10]

RESUME

(

auth_cont_abort

)

Definition at line 834 of file base.c.

Here is the call graph for this function:

RESUME() [4/10]

RESUME

(

auth_fail

)

Definition at line 642 of file base.c.

Here is the call graph for this function:

RESUME() [5/10]

RESUME

(

auth_get

)

Definition at line 665 of file base.c.

Here is the call graph for this function:

RESUME() [6/10]

RESUME

(

auth_pass

)

Definition at line 630 of file base.c.

Here is the call graph for this function:

RESUME() [7/10]

RESUME

(

auth_restart

)

Definition at line 655 of file base.c.

Here is the call graph for this function:

RESUME() [8/10]

RESUME

(

auth_start

)

Definition at line 376 of file base.c.

Here is the call graph for this function:

RESUME() [9/10]

RESUME

(

auth_type

)

Definition at line 560 of file base.c.

Here is the call graph for this function:

RESUME() [10/10]

RESUME

(

autz_request

)

Definition at line 855 of file base.c.

Here is the call graph for this function:

state_create()

static int state_create ( TALLOC_CTX *  ctx, fr_pair_list_t *  out, request_t *  request, bool  reply  )

static

Definition at line 225 of file base.c.

Here is the call graph for this function:

Here is the caller graph for this function:

Variable Documentation

acct_flag_valid

const bool acct_flag_valid[8]

static

Initial value:

= {
        false, true, true, false, 
        true, true, false, false, 
}

Definition at line 932 of file base.c.

acct_status_to_packet_code

const uint32_t acct_status_to_packet_code[UINT8_MAX+1]

static

Initial value:

= {
        [FR_TAC_PLUS_ACCT_STATUS_SUCCESS] = FR_TACACS_CODE_ACCT_SUCCESS,
        [FR_TAC_PLUS_ACCT_STATUS_ERROR] = FR_TACACS_CODE_ACCT_ERROR,
}

Definition at line 892 of file base.c.

attr_auth_type

fr_dict_attr_t const* attr_auth_type

static

Definition at line 49 of file base.c.

attr_chap_password

fr_dict_attr_t const* attr_chap_password

static

Definition at line 78 of file base.c.

attr_module_failure_message

fr_dict_attr_t const* attr_module_failure_message

static

Definition at line 50 of file base.c.

attr_module_success_message

fr_dict_attr_t const* attr_module_success_message

static

Definition at line 51 of file base.c.

attr_packet_type

fr_dict_attr_t const* attr_packet_type

static

Definition at line 53 of file base.c.

attr_stripped_user_name

fr_dict_attr_t const* attr_stripped_user_name

static

Definition at line 52 of file base.c.

attr_tacacs_accounting_flags

fr_dict_attr_t const* attr_tacacs_accounting_flags

static

Definition at line 64 of file base.c.

attr_tacacs_accounting_status

fr_dict_attr_t const* attr_tacacs_accounting_status

static

Definition at line 63 of file base.c.

attr_tacacs_action

fr_dict_attr_t const* attr_tacacs_action

static

Definition at line 55 of file base.c.

attr_tacacs_authentication_action

fr_dict_attr_t const* attr_tacacs_authentication_action

static

Definition at line 56 of file base.c.

attr_tacacs_authentication_flags

fr_dict_attr_t const* attr_tacacs_authentication_flags

static

Definition at line 57 of file base.c.

attr_tacacs_authentication_service

fr_dict_attr_t const* attr_tacacs_authentication_service

static

Definition at line 59 of file base.c.

attr_tacacs_authentication_status

fr_dict_attr_t const* attr_tacacs_authentication_status

static

Definition at line 60 of file base.c.

attr_tacacs_authentication_type

fr_dict_attr_t const* attr_tacacs_authentication_type

static

Definition at line 58 of file base.c.

attr_tacacs_authorization_status

fr_dict_attr_t const* attr_tacacs_authorization_status

static

Definition at line 62 of file base.c.

attr_tacacs_client_port

fr_dict_attr_t const* attr_tacacs_client_port

static

Definition at line 66 of file base.c.

attr_tacacs_data

fr_dict_attr_t const* attr_tacacs_data

static

Definition at line 67 of file base.c.

attr_tacacs_privilege_level

fr_dict_attr_t const* attr_tacacs_privilege_level

static

Definition at line 68 of file base.c.

attr_tacacs_remote_address

fr_dict_attr_t const* attr_tacacs_remote_address

static

Definition at line 69 of file base.c.

attr_tacacs_sequence_number

fr_dict_attr_t const* attr_tacacs_sequence_number

static

Definition at line 72 of file base.c.

attr_tacacs_server_message

fr_dict_attr_t const* attr_tacacs_server_message

static

Definition at line 70 of file base.c.

attr_tacacs_session_id

fr_dict_attr_t const* attr_tacacs_session_id

static

Definition at line 71 of file base.c.

attr_tacacs_state

fr_dict_attr_t const* attr_tacacs_state

static

Definition at line 73 of file base.c.

attr_tacacs_user_message

fr_dict_attr_t const* attr_tacacs_user_message

static

Definition at line 74 of file base.c.

attr_user_name

fr_dict_attr_t const* attr_user_name

static

Definition at line 76 of file base.c.

attr_user_password

fr_dict_attr_t const* attr_user_password

static

Definition at line 77 of file base.c.

auth_config

const conf_parser_t auth_config[]

static

Initial value:

= {
        { FR_CONF_POINTER("session", 0, CONF_FLAG_SUBSECTION, NULL), .subcs = (void const *) session_config },
 
        CONF_PARSER_TERMINATOR
}

Definition at line 208 of file base.c.

authen_status_to_packet_code

const uint32_t authen_status_to_packet_code[UINT8_MAX+1]

static

Initial value:

= {
        [FR_TAC_PLUS_AUTHEN_STATUS_PASS] = FR_TACACS_CODE_AUTH_PASS,
        [FR_TAC_PLUS_AUTHEN_STATUS_FAIL] = FR_TACACS_CODE_AUTH_FAIL,
        [FR_TAC_PLUS_AUTHEN_STATUS_GETDATA] = FR_TACACS_CODE_AUTH_GETDATA,
        [FR_TAC_PLUS_AUTHEN_STATUS_GETUSER] = FR_TACACS_CODE_AUTH_GETUSER,
        [FR_TAC_PLUS_AUTHEN_STATUS_GETPASS] = FR_TACACS_CODE_AUTH_GETPASS,
        [FR_TAC_PLUS_AUTHEN_STATUS_RESTART] = FR_TACACS_CODE_AUTH_RESTART,
        [FR_TAC_PLUS_AUTHEN_STATUS_ERROR] = FR_TACACS_CODE_AUTH_ERROR,
}

Definition at line 366 of file base.c.

author_status_to_packet_code

const uint32_t author_status_to_packet_code[UINT8_MAX+1]

static

Initial value:

= {
        [FR_TAC_PLUS_AUTHOR_STATUS_PASS_ADD] = FR_TACACS_CODE_AUTZ_PASS_ADD,
        [FR_TAC_PLUS_AUTHOR_STATUS_PASS_REPL] = FR_TACACS_CODE_AUTZ_PASS_REPLACE,
        [FR_TAC_PLUS_AUTHOR_STATUS_FAIL] = FR_TACACS_CODE_AUTZ_FAIL,
        [FR_TAC_PLUS_AUTHOR_STATUS_ERROR] = FR_TACACS_CODE_AUTZ_ERROR,
}

Definition at line 847 of file base.c.

compile_list

virtual_server_compile_t compile_list[]

static

Definition at line 1310 of file base.c.

config

const conf_parser_t config[]

static

Initial value:

= {
        { FR_CONF_POINTER("Authentication", 0, CONF_FLAG_SUBSECTION, NULL), .subcs = (void const *) auth_config,
          .offset = offsetof(process_tacacs_t, auth), },
 
        CONF_PARSER_TERMINATOR
}

Definition at line 214 of file base.c.

dict_freeradius

fr_dict_t const* dict_freeradius

static

Definition at line 39 of file base.c.

dict_tacacs

fr_dict_t const* dict_tacacs

static

Definition at line 40 of file base.c.

enum_auth_flags_noecho

fr_value_box_t const* enum_auth_flags_noecho

static

Definition at line 119 of file base.c.

enum_auth_type_accept

fr_value_box_t const* enum_auth_type_accept

static

Definition at line 117 of file base.c.

enum_auth_type_reject

fr_value_box_t const* enum_auth_type_reject

static

Definition at line 118 of file base.c.

enum_tacacs_auth_type_ascii

fr_value_box_t const* enum_tacacs_auth_type_ascii

static

Definition at line 120 of file base.c.

process_state

fr_process_state_t const process_state[]

static

Definition at line 1085 of file base.c.

process_tacacs

fr_process_module_t process_tacacs

Initial value:

= {
        .common = {
                .magic          = MODULE_MAGIC_INIT,
                .name           = "tacacs",
                .config         = config,
                .inst_size      = sizeof(process_tacacs_t),
                .bootstrap      = mod_bootstrap,
                .instantiate    = mod_instantiate
        },
        .process        = mod_process,
        .compile_list   = compile_list,
        .dict           = &dict_tacacs,
}

Definition at line 1442 of file base.c.

process_tacacs_dict

fr_dict_autoload_t process_tacacs_dict

Initial value:

= {
        { .out = &dict_freeradius, .proto = "freeradius" },
        { .out = &dict_tacacs, .proto = "tacacs" },
        { NULL }
}

Definition at line 43 of file base.c.

process_tacacs_dict_attr

fr_dict_attr_autoload_t process_tacacs_dict_attr

Definition at line 81 of file base.c.

process_tacacs_dict_enum

fr_dict_enum_autoload_t process_tacacs_dict_enum

Initial value:

= {
        { .out = &enum_auth_type_accept, .name = "Accept", .attr = &attr_auth_type },
        { .out = &enum_auth_type_reject, .name = "Reject", .attr = &attr_auth_type },
        { .out = &enum_auth_flags_noecho, .name = "No-Echo", .attr = &attr_tacacs_authentication_flags },
        { .out = &enum_tacacs_auth_type_ascii, .name = "ASCII", .attr = &attr_tacacs_authentication_type },
        { NULL }
}

Definition at line 123 of file base.c.

session_config

const conf_parser_t session_config[]

static

Initial value:

= {
        { FR_CONF_OFFSET("timeout", process_tacacs_auth_t, session_timeout), .dflt = "15" },
        { FR_CONF_OFFSET("max", process_tacacs_auth_t, max_session), .dflt = "4096" },
        { FR_CONF_OFFSET("max_rounds", process_tacacs_auth_t, max_rounds), .dflt = "4" },
        { FR_CONF_OFFSET("state_server_id", process_tacacs_auth_t, state_server_id) },
 
        CONF_PARSER_TERMINATOR
}

Definition at line 199 of file base.c.