The FreeRADIUS server $Id: 15bac2a4c627c01d1aa2047687b3418955ac7f00 $
Loading...
Searching...
No Matches
rlm_mschap.c
Go to the documentation of this file.
1/*
2 * This program is free software; you can redistribute it and/or modify
3 * it under the terms of the GNU General Public License as published by
4 * the Free Software Foundation; either version 2 of the License, or (at
5 * your option) any later version.
6 *
7 * This program is distributed in the hope that it will be useful,
8 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10 * GNU General Public License for more details.
11 *
12 * You should have received a copy of the GNU General Public License
13 * along with this program; if not, write to the Free Software
14 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
15 */
16
17/**
18 * $Id: 6abb3599984bdd8a40748fbe5297a64bb8f9f1d1 $
19 * @file rlm_mschap.c
20 * @brief Implemented mschap authentication.
21 *
22 * @copyright 2000, 2001, 2006 The FreeRADIUS server project
23 */
24
25/* MPPE support from Takahiro Wagatsuma <waga@sic.shibaura-it.ac.jp> */
26RCSID("$Id: 6abb3599984bdd8a40748fbe5297a64bb8f9f1d1 $")
27
28#define LOG_PREFIX mctx->mi->name
29
30#include <freeradius-devel/server/base.h>
31#include <freeradius-devel/server/exec_legacy.h>
32#include <freeradius-devel/server/module_rlm.h>
33#include <freeradius-devel/tls/strerror.h>
34#include <freeradius-devel/util/debug.h>
35#include <freeradius-devel/radius/defs.h>
36
37#include <freeradius-devel/util/base16.h>
38#include <freeradius-devel/util/md4.h>
39#include <freeradius-devel/util/md5.h>
40#include <freeradius-devel/util/misc.h>
41#include <freeradius-devel/util/sha1.h>
42
43#include <freeradius-devel/unlang/function.h>
44#include <freeradius-devel/unlang/xlat_func.h>
45
46#include <sys/wait.h>
47
48#include "rlm_mschap.h"
49#include "smbdes.h"
50
51#ifdef WITH_AUTH_WINBIND
52#include "auth_wbclient.h"
53#endif
54
55#ifdef WITH_TLS
56USES_APPLE_DEPRECATED_API /* OpenSSL API has been deprecated by Apple */
57# include <openssl/rc4.h>
58#endif
59
60#ifdef __APPLE__
61unlang_action_t od_mschap_auth(unlang_result_t *p_result, request_t *request, fr_pair_t *challenge, fr_pair_t *usernamepair,
62 mschap_auth_call_env_t *env_data);
63#endif
64
65/* Allowable account control bits */
66#define ACB_DISABLED 0x00010000 //!< User account disabled.
67#define ACB_HOMDIRREQ 0x00020000 //!< Home directory required.
68#define ACB_PWNOTREQ 0x00040000 //!< User password not required.
69#define ACB_TEMPDUP 0x00080000 //!< Temporary duplicate account.
70#define ACB_NORMAL 0x00100000 //!< Normal user account.
71#define ACB_MNS 0x00200000 //!< MNS logon user account.
72#define ACB_DOMTRUST 0x00400000 //!< Interdomain trust account.
73#define ACB_WSTRUST 0x00800000 //!< Workstation trust account.
74#define ACB_SVRTRUST 0x01000000 //!< Server trust account.
75#define ACB_PWNOEXP 0x02000000 //!< User password does not expire.
76#define ACB_AUTOLOCK 0x04000000 //!< Account auto locked.
77#define ACB_FR_EXPIRED 0x00020000 //!< Password Expired.
78
83
84#ifdef WITH_AUTH_WINBIND
85static conf_parser_t reuse_winbind_config[] = {
86 FR_SLAB_CONFIG_CONF_PARSER
87 CONF_PARSER_TERMINATOR
88};
89#endif
90
91static const conf_parser_t winbind_config[] = {
92 { FR_CONF_OFFSET("username", rlm_mschap_t, wb_username) },
93#ifdef WITH_AUTH_WINBIND
94 { FR_CONF_OFFSET("retry_with_normalised_username", rlm_mschap_t, wb_retry_with_normalised_username), .dflt = "no" },
95 { FR_CONF_OFFSET_SUBSECTION("reuse", 0, rlm_mschap_t, reuse, reuse_winbind_config) },
96#endif
97 CONF_PARSER_TERMINATOR
98};
99
100static const conf_parser_t module_config[] = {
101 { FR_CONF_OFFSET("normalise", rlm_mschap_t, normify), .dflt = "yes" },
102
103 /*
104 * Cache the password by default.
105 */
106 { FR_CONF_OFFSET("use_mppe", rlm_mschap_t, use_mppe), .dflt = "yes" },
107 { FR_CONF_OFFSET("require_encryption", rlm_mschap_t, require_encryption), .dflt = "no" },
108 { FR_CONF_OFFSET("require_strong", rlm_mschap_t, require_strong), .dflt = "no" },
109 { FR_CONF_OFFSET("with_ntdomain_hack", rlm_mschap_t, with_ntdomain_hack), .dflt = "yes" },
110 { FR_CONF_OFFSET_FLAGS("ntlm_auth", CONF_FLAG_XLAT, rlm_mschap_t, ntlm_auth) },
111 { FR_CONF_OFFSET("ntlm_auth_timeout", rlm_mschap_t, ntlm_auth_timeout) },
112
113 { FR_CONF_POINTER("passchange", 0, CONF_FLAG_SUBSECTION, NULL), .subcs = (void const *) passchange_config },
114 { FR_CONF_OFFSET("allow_retry", rlm_mschap_t, allow_retry), .dflt = "yes" },
115 { FR_CONF_OFFSET("retry_msg", rlm_mschap_t, retry_msg) },
116
117
118#ifdef __APPLE__
119 { FR_CONF_OFFSET("use_open_directory", rlm_mschap_t, open_directory), .dflt = "yes" },
120#endif
121
122 { FR_CONF_POINTER("winbind", 0, CONF_FLAG_SUBSECTION, NULL), .subcs = (void const *) winbind_config },
123
124 /*
125 * These are now in a subsection above.
126 */
127 { FR_CONF_DEPRECATED("winbind_username", rlm_mschap_t, wb_username) },
128#ifdef WITH_AUTH_WINBIND
129 { FR_CONF_DEPRECATED("winbind_retry_with_normalised_username", rlm_mschap_t, wb_retry_with_normalised_username) },
130#endif
131 CONF_PARSER_TERMINATOR
132};
133
134#define MSCHAP_CALL_ENV(_x) \
135static const call_env_method_t mschap_ ## _x ## _method_env = { \
136 FR_CALL_ENV_METHOD_OUT(mschap_ ## _x ## _call_env_t), \
137 .env = (call_env_parser_t[]){ \
138 { FR_CALL_ENV_SUBSECTION("attributes", NULL, CALL_ENV_FLAG_REQUIRED, _x ## _call_env) }, \
139 CALL_ENV_TERMINATOR \
140 } \
141}
142
143#define MSCHAP_COMMON_CALL_ENV(_x) \
144{ FR_CALL_ENV_PARSE_ONLY_OFFSET("chap_challenge", FR_TYPE_OCTETS, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_ ## _x ## _call_env_t, chap_challenge), \
145 .pair.dflt = "Vendor-Specific.Microsoft.CHAP-Challenge", .pair.dflt_quote = T_BARE_WORD }, \
146{ FR_CALL_ENV_PARSE_ONLY_OFFSET("chap_response", FR_TYPE_OCTETS, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_ ## _x ## _call_env_t, chap_response), \
147 .pair.dflt = "Vendor-Specific.Microsoft.CHAP-Response", .pair.dflt_quote = T_BARE_WORD }, \
148{ FR_CALL_ENV_PARSE_ONLY_OFFSET("chap2_response", FR_TYPE_OCTETS, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_ ## _x ## _call_env_t, chap2_response), \
149 .pair.dflt = "Vendor-Specific.Microsoft.CHAP2-Response", .pair.dflt_quote = T_BARE_WORD }
150
151#define MSCHAP_OPT_CALL_ENV(_opt, _x) \
152{ FR_CALL_ENV_PARSE_ONLY_OFFSET(STRINGIFY(_opt), FR_TYPE_OCTETS, CALL_ENV_FLAG_ATTRIBUTE, mschap_ ## _x ## _call_env_t, _opt) }
153
160
161static const call_env_parser_t xlat_call_env[] = {
162 { FR_CALL_ENV_PARSE_ONLY_OFFSET("username", FR_TYPE_STRING, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_xlat_call_env_t, username), .pair.dflt = "User-Name", .pair.dflt_quote = T_BARE_WORD },
163 MSCHAP_COMMON_CALL_ENV(xlat),
164 CALL_ENV_TERMINATOR
165};
166
167MSCHAP_CALL_ENV(xlat);
168
169static const call_env_parser_t auth_call_env[] = {
170 { FR_CALL_ENV_PARSE_ONLY_OFFSET("username", FR_TYPE_STRING, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_auth_call_env_t, username), .pair.dflt = "User-Name", .pair.dflt_quote = T_BARE_WORD },
171 MSCHAP_COMMON_CALL_ENV(auth),
172 MSCHAP_OPT_CALL_ENV(chap2_success, auth),
173 MSCHAP_OPT_CALL_ENV(chap_error, auth),
174 MSCHAP_OPT_CALL_ENV(chap_mppe_keys, auth),
175 MSCHAP_OPT_CALL_ENV(mppe_encryption_policy, auth),
176 MSCHAP_OPT_CALL_ENV(mppe_recv_key, auth),
177 MSCHAP_OPT_CALL_ENV(mppe_send_key, auth),
178 MSCHAP_OPT_CALL_ENV(mppe_encryption_types, auth),
179 MSCHAP_OPT_CALL_ENV(chap2_cpw, auth),
180 MSCHAP_OPT_CALL_ENV(chap_nt_enc_pw, auth),
181 CALL_ENV_TERMINATOR
182};
183
204
211
212static const call_env_parser_t autz_call_env[] = {
213 MSCHAP_COMMON_CALL_ENV(autz),
214 MSCHAP_OPT_CALL_ENV(chap2_cpw, autz),
215 CALL_ENV_TERMINATOR
216};
217
218MSCHAP_CALL_ENV(autz);
219
220static fr_dict_t const *dict_freeradius;
221static fr_dict_t const *dict_radius;
222
223extern fr_dict_autoload_t rlm_mschap_dict[];
224fr_dict_autoload_t rlm_mschap_dict[] = {
225 { .out = &dict_freeradius, .proto = "freeradius" },
226 { .out = &dict_radius, .proto = "radius" },
227 DICT_AUTOLOAD_TERMINATOR
228};
229
230fr_dict_attr_t const *attr_auth_type;
231fr_dict_attr_t const *attr_cleartext_password;
232fr_dict_attr_t const *attr_eap_identity;
233fr_dict_attr_t const *attr_ms_chap_new_cleartext_password;
234fr_dict_attr_t const *attr_ms_chap_new_nt_password;
235fr_dict_attr_t const *attr_ms_chap_peer_challenge;
236fr_dict_attr_t const *attr_ms_chap_use_ntlm_auth;
237fr_dict_attr_t const *attr_ms_chap_user_name;
238fr_dict_attr_t const *attr_nt_password;
239fr_dict_attr_t const *attr_smb_account_ctrl_text;
240fr_dict_attr_t const *attr_smb_account_ctrl;
241
242extern fr_dict_attr_autoload_t rlm_mschap_dict_attr[];
243fr_dict_attr_autoload_t rlm_mschap_dict_attr[] = {
244 { .out = &attr_auth_type, .name = "Auth-Type", .type = FR_TYPE_UINT32, .dict = &dict_freeradius },
245 { .out = &attr_cleartext_password, .name = "Password.Cleartext", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
246 { .out = &attr_eap_identity, .name = "EAP-Identity", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
247 { .out = &attr_ms_chap_new_cleartext_password, .name = "MS-CHAP-New-Cleartext-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
248 { .out = &attr_ms_chap_new_nt_password, .name = "MS-CHAP-New-NT-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
249 { .out = &attr_ms_chap_peer_challenge, .name = "MS-CHAP-Peer-Challenge", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
250 { .out = &attr_ms_chap_use_ntlm_auth, .name = "MS-CHAP-Use-NTLM-Auth", .type = FR_TYPE_UINT8, .dict = &dict_freeradius },
251 { .out = &attr_ms_chap_user_name, .name = "MS-CHAP-User-Name", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
252 { .out = &attr_nt_password, .name = "Password.NT", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
253 { .out = &attr_smb_account_ctrl_text, .name = "SMB-Account-Ctrl-Text", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
254 { .out = &attr_smb_account_ctrl, .name = "SMB-Account-Ctrl", .type = FR_TYPE_UINT32, .dict = &dict_freeradius },
255
256 DICT_AUTOLOAD_TERMINATOR
257};
258
259static fr_pair_t *mschap_identity_find(request_t *request, fr_dict_attr_t const *attr_user_name)
260{
261 fr_pair_t *vp;
262
263 vp = fr_pair_find_by_da(&request->request_pairs, NULL, attr_user_name);
264 if (vp) return vp;
265
266 vp = fr_pair_find_by_da(&request->request_pairs, NULL, attr_eap_identity);
267 if (vp) return vp;
268
269 REDEBUG("No user identity found in current request");
270
271 return NULL;
272}
273
274static int pdb_decode_acct_ctrl(char const *p)
275{
276 int acct_ctrl = 0;
277 int done = 0;
278
279 /*
280 * Check if the account type bits have been encoded after the
281 * NT password (in the form [NDHTUWSLXI]).
282 */
283
284 if (*p != '[') return 0;
285
286 for (p++; *p && !done; p++) {
287 switch (*p) {
288 case 'N': /* 'N'o password. */
289 acct_ctrl |= ACB_PWNOTREQ;
290 break;
291
292 case 'D': /* 'D'isabled. */
293 acct_ctrl |= ACB_DISABLED ;
294 break;
295
296 case 'H': /* 'H'omedir required. */
297 acct_ctrl |= ACB_HOMDIRREQ;
298 break;
299
300 case 'T': /* 'T'emp account. */
301 acct_ctrl |= ACB_TEMPDUP;
302 break;
303
304 case 'U': /* 'U'ser account (normal). */
305 acct_ctrl |= ACB_NORMAL;
306 break;
307
308 case 'M': /* 'M'NS logon user account. What is this? */
309 acct_ctrl |= ACB_MNS;
310 break;
311
312 case 'W': /* 'W'orkstation account. */
313 acct_ctrl |= ACB_WSTRUST;
314 break;
315
316 case 'S': /* 'S'erver account. */
317 acct_ctrl |= ACB_SVRTRUST;
318 break;
319
320 case 'L': /* 'L'ocked account. */
321 acct_ctrl |= ACB_AUTOLOCK;
322 break;
323
324 case 'X': /* No 'X'piry on password */
325 acct_ctrl |= ACB_PWNOEXP;
326 break;
327
328 case 'I': /* 'I'nterdomain trust account. */
329 acct_ctrl |= ACB_DOMTRUST;
330 break;
331
332 case 'e': /* 'e'xpired, the password has */
333 acct_ctrl |= ACB_FR_EXPIRED;
334 break;
335
336 case ' ': /* ignore spaces */
337 break;
338
339 case ':':
340 case '\n':
341 case '\0':
342 case ']':
343 default:
344 done = 1;
345 break;
346 }
347 }
348
349 return acct_ctrl;
350}
351
352static xlat_arg_parser_t const mschap_xlat_args[] = {
353 { .required = true, .single = true, .type = FR_TYPE_STRING },
354 { .concat = true, .type = FR_TYPE_STRING },
355 XLAT_ARG_PARSER_TERMINATOR
356};
357
358/** Get data from MSCHAP attributes
359 *
360 * Pulls NT-Response, LM-Response, or Challenge from MSCHAP
361 * attributes.
362 *
363 * @ingroup xlat_functions
364 */
365static xlat_action_t mschap_xlat(TALLOC_CTX *ctx, fr_dcursor_t *out,
366 xlat_ctx_t const *xctx,
367 request_t *request, fr_value_box_list_t *in)
368{
369 mschap_xlat_call_env_t *env_data = talloc_get_type_abort(xctx->env_data, mschap_xlat_call_env_t);
370 size_t data_len;
371 uint8_t const *data = NULL;
372 uint8_t buffer[32];
373 fr_pair_t *user_name;
374 fr_pair_t *chap_challenge, *response;
375 rlm_mschap_t const *inst = talloc_get_type_abort(xctx->mctx->mi->data, rlm_mschap_t);
376 fr_value_box_t *arg = fr_value_box_list_head(in);
377 fr_value_box_t *vb;
378 bool tainted = false;
379
380 response = NULL;
381
382 /*
383 * Challenge means MS-CHAPv1 challenge, or
384 * hash of MS-CHAPv2 challenge, and peer challenge.
385 */
386 if (strncasecmp(arg->vb_strvalue, "Challenge", 9) == 0) {
387 chap_challenge = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
388 tmpl_attr_tail_da(env_data->chap_challenge));
389 if (!chap_challenge) {
390 REDEBUG("No MS-CHAP-Challenge in the request");
391 return XLAT_ACTION_FAIL;
392 }
393 tainted = chap_challenge->vp_tainted;
394
395 /*
396 * MS-CHAP-Challenges are 8 octets,
397 * for MS-CHAPv1
398 */
399 if (chap_challenge->vp_length == 8) {
400 RDEBUG2("mschap1: %02x", chap_challenge->vp_octets[0]);
401 data = chap_challenge->vp_octets;
402 data_len = 8;
403
404 /*
405 * MS-CHAP-Challenges are 16 octets,
406 * for MS-CHAPv2.
407 */
408 } else if (chap_challenge->vp_length == 16) {
409 fr_pair_t *name_vp;
410 fr_pair_t *response_name;
411 char const *username_str;
412 size_t username_len;
413
414 response = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
415 tmpl_attr_tail_da(env_data->chap2_response));
416 if (!response) {
417 REDEBUG("Vendor-Specific.Microsoft.CHAP2-Response is required to calculate MS-CHAPv1 challenge");
418 return XLAT_ACTION_FAIL;
419 }
420
421 /*
422 * FIXME: Much of this is copied from
423 * below. We should put it into a
424 * separate function.
425 */
426
427 /*
428 * Responses are 50 octets.
429 */
430 if (response->vp_length < 50) {
431 REDEBUG("Vendor-Specific.Microsoft.CHAP-Response has the wrong format");
432 return XLAT_ACTION_FAIL;
433 }
434
435 user_name = mschap_identity_find(request, tmpl_attr_tail_da(env_data->username));
436 if (!user_name) return XLAT_ACTION_FAIL;
437
438 /*
439 * Check for MS-CHAP-User-Name and if found, use it
440 * to construct the MSCHAPv1 challenge. This is
441 * set by rlm_eap_mschap to the MS-CHAP Response
442 * packet Name field.
443 *
444 * We prefer this to the User-Name in the
445 * packet.
446 */
447 response_name = fr_pair_find_by_da(&request->request_pairs, NULL, attr_ms_chap_user_name);
448 name_vp = response_name ? response_name : user_name;
449
450 /*
451 * with_ntdomain_hack moved here, too.
452 */
453 username_str = memchr(name_vp->vp_strvalue, '\\', name_vp->vp_length);
454 if (username_str != NULL) {
455 if (inst->with_ntdomain_hack) {
456 username_str++;
457 } else {
458 RWDEBUG2("NT Domain delimiter found, should 'with_ntdomain_hack' be enabled?");
459 username_str = name_vp->vp_strvalue;
460 }
461 } else {
462 username_str = name_vp->vp_strvalue;
463 }
464 username_len = name_vp->vp_length - (username_str - name_vp->vp_strvalue);
465
466 if (response_name &&
467 ((user_name->vp_length != response_name->vp_length) ||
468 (memcmp(user_name->vp_strvalue, response_name->vp_strvalue, user_name->vp_length) != 0))) {
469 RWDEBUG2("%pP is not the same as %pP from EAP-MSCHAPv2", user_name, response_name);
470 }
471
472 /*
473 * Get the MS-CHAPv1 challenge
474 * from the MS-CHAPv2 peer challenge,
475 * our challenge, and the user name.
476 */
477 RDEBUG2("Creating challenge with username \"%pV\"",
478 fr_box_strvalue_len(username_str, username_len));
479 mschap_challenge_hash(buffer, response->vp_octets + 2, chap_challenge->vp_octets,
480 username_str, username_len);
481 data = buffer;
482 data_len = 8;
483 } else {
484 REDEBUG("Invalid MS-CHAP challenge length");
485 return XLAT_ACTION_FAIL;
486 }
487
488 /*
489 * Get the MS-CHAPv1 response, or the MS-CHAPv2
490 * response.
491 */
492 } else if (strncasecmp(arg->vb_strvalue, "NT-Response", 11) == 0) {
493 response = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
494 tmpl_attr_tail_da(env_data->chap_response));
495 if (!response) response = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
496 tmpl_attr_tail_da(env_data->chap2_response));
497 if (!response) {
498 REDEBUG("No MS-CHAP-Response or MS-CHAP2-Response was found in the request");
499 return XLAT_ACTION_FAIL;
500 }
501 tainted = response->vp_tainted;
502
503 /*
504 * For MS-CHAPv1, the NT-Response exists only
505 * if the second octet says so.
506 */
507 if ((response->da == tmpl_attr_tail_da(env_data->chap_response)) && ((response->vp_octets[1] & 0x01) == 0)) {
508 REDEBUG("No NT-Response in MS-CHAP-Response");
509 return XLAT_ACTION_FAIL;
510 }
511
512 if (response->vp_length < 50) {
513 REDEBUG("Vendor-Specific.Microsoft.CHAP-Response has the wrong format");
514 return XLAT_ACTION_FAIL;
515 }
516
517 /*
518 * MS-CHAP-Response and MS-CHAP2-Response have
519 * the NT-Response at the same offset, and are
520 * the same length.
521 */
522 data = response->vp_octets + 26;
523 data_len = 24;
524
525 /*
526 * LM-Response is deprecated, and exists only
527 * in MS-CHAPv1, and not often there.
528 */
529 } else if (strncasecmp(arg->vb_strvalue, "LM-Response", 11) == 0) {
530 response = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
531 tmpl_attr_tail_da(env_data->chap_response));
532 if (!response) {
533 REDEBUG("No MS-CHAP-Response was found in the request");
534 return XLAT_ACTION_FAIL;
535 }
536 tainted = response->vp_tainted;
537
538 if (response->vp_length < 50) {
539 REDEBUG("Vendor-Specific.Microsoft.CHAP-Response has the wrong format");
540 return XLAT_ACTION_FAIL;
541 }
542 /*
543 * For MS-CHAPv1, the LM-Response exists only
544 * if the second octet says so.
545 */
546 if ((response->vp_octets[1] & 0x01) != 0) {
547 REDEBUG("No LM-Response in MS-CHAP-Response");
548 return XLAT_ACTION_FAIL;
549 }
550 data = response->vp_octets + 2;
551 data_len = 24;
552
553 /*
554 * Pull the domain name out of the User-Name, if it exists.
555 *
556 * This is the full domain name, not just the name after host/
557 */
558 } else if (strncasecmp(arg->vb_strvalue, "Domain-Name", 11) == 0) {
559 char *p;
560
561 MEM(vb = fr_value_box_alloc_null(ctx));
562
563 user_name = mschap_identity_find(request, tmpl_attr_tail_da(env_data->username));
564 if (!user_name) return XLAT_ACTION_FAIL;
565
566 /*
567 * First check to see if this is a host/ style User-Name
568 * (a la Kerberos host principal)
569 */
570 if (strncmp(user_name->vp_strvalue, "host/", 5) == 0) {
571 /*
572 * If we're getting a User-Name formatted in this way,
573 * it's likely due to PEAP. The Windows Domain will be
574 * the first domain component following the hostname,
575 * or the machine name itself if only a hostname is supplied
576 */
577 p = strchr(user_name->vp_strvalue, '.');
578 if (!p) {
579 RDEBUG2("setting Domain-Name to same as machine name");
580 fr_value_box_strdup(ctx, vb, NULL, user_name->vp_strvalue + 5, user_name->vp_tainted);
581 } else {
582 p++; /* skip the period */
583
584 fr_value_box_strdup(ctx, vb, NULL, p, user_name->vp_tainted);
585 }
586 } else {
587 p = strchr(user_name->vp_strvalue, '\\');
588 if (!p) {
589 REDEBUG("No domain name was found in the User-Name");
590 talloc_free(vb);
591 return XLAT_ACTION_FAIL;
592 }
593
594 /*
595 * Hack. This is simpler than the alternatives.
596 */
597 *p = '\0';
598 fr_value_box_strdup(ctx, vb, NULL, user_name->vp_strvalue, user_name->vp_tainted);
599 *p = '\\';
600 }
601
602 fr_dcursor_append(out, vb);
603 return XLAT_ACTION_DONE;
604
605 /*
606 * Pull the NT-Domain out of the User-Name, if it exists.
607 */
608 } else if (strncasecmp(arg->vb_strvalue, "NT-Domain", 9) == 0) {
609 char *p, *q;
610
611 MEM(vb = fr_value_box_alloc_null(ctx));
612
613 user_name = mschap_identity_find(request, tmpl_attr_tail_da(env_data->username));
614 if (!user_name) return XLAT_ACTION_FAIL;
615
616 /*
617 * First check to see if this is a host/ style User-Name
618 * (a la Kerberos host principal)
619 */
620 if (strncmp(user_name->vp_strvalue, "host/", 5) == 0) {
621 /*
622 * If we're getting a User-Name formatted in this way,
623 * it's likely due to PEAP. The Windows Domain will be
624 * the first domain component following the hostname,
625 * or the machine name itself if only a hostname is supplied
626 */
627 p = strchr(user_name->vp_strvalue, '.');
628 if (!p) {
629 RDEBUG2("setting NT-Domain to same as machine name");
630 fr_value_box_strdup(ctx, vb, NULL, user_name->vp_strvalue + 5, user_name->vp_tainted);
631 } else {
632 p++; /* skip the period */
633 q = strchr(p, '.');
634 /*
635 * use the same hack as below
636 * only if another period was found
637 */
638 if (q) *q = '\0';
639 fr_value_box_strdup(ctx, vb, NULL, p, user_name->vp_tainted);
640 if (q) *q = '.';
641 }
642 } else {
643 p = strchr(user_name->vp_strvalue, '\\');
644 if (!p) {
645 REDEBUG("No NT-Domain was found in the User-Name");
646 talloc_free(vb);
647 return XLAT_ACTION_FAIL;
648 }
649
650 /*
651 * Hack. This is simpler than the alternatives.
652 */
653 *p = '\0';
654 fr_value_box_strdup(ctx, vb, NULL, user_name->vp_strvalue, user_name->vp_tainted);
655 *p = '\\';
656 }
657
658 fr_dcursor_append(out, vb);
659 return XLAT_ACTION_DONE;
660
661 /*
662 * Pull the User-Name out of the User-Name...
663 */
664 } else if (strncasecmp(arg->vb_strvalue, "User-Name", 9) == 0) {
665 char const *p, *q;
666
667 user_name = mschap_identity_find(request, tmpl_attr_tail_da(env_data->username));
668 if (!user_name) return XLAT_ACTION_FAIL;
669
670 MEM(vb = fr_value_box_alloc_null(ctx));
671
672 /*
673 * First check to see if this is a host/ style User-Name
674 * (a la Kerberos host principal)
675 */
676 if (strncmp(user_name->vp_strvalue, "host/", 5) == 0) {
677 p = user_name->vp_strvalue + 5;
678 /*
679 * If we're getting a User-Name formatted in this way,
680 * it's likely due to PEAP. When authenticating this against
681 * a Domain, Windows will expect the User-Name to be in the
682 * format of hostname$, the SAM version of the name, so we
683 * have to convert it to that here. We do so by stripping
684 * off the first 5 characters (host/), and copying everything
685 * from that point to the first period into a string and appending
686 * a $ to the end.
687 */
688 q = strchr(p, '.');
689
690 /*
691 * use the same hack as above
692 * only if a period was found
693 */
694 if (q) {
695 fr_value_box_asprintf(ctx, vb, NULL, true, "%.*s$", (int) (q - p), p);
696 } else {
697 fr_value_box_asprintf(ctx, vb, NULL, true, "%s$", p);
698 }
699 } else {
700 p = strchr(user_name->vp_strvalue, '\\');
701 if (p) {
702 p++; /* skip the backslash */
703 } else {
704 p = user_name->vp_strvalue; /* use the whole User-Name */
705 }
706 fr_value_box_strdup(ctx, vb, NULL, p, user_name->vp_tainted);
707 }
708
709 fr_dcursor_append(out, vb);
710 return XLAT_ACTION_DONE;
711
712 /*
713 * Return the NT-Hash of the passed string
714 */
715 } else if (strncasecmp(arg->vb_strvalue, "NT-Hash", 7) == 0) {
716 arg = fr_value_box_list_next(in, arg);
717 if ((!arg) || (arg->vb_length == 0))
718 return XLAT_ACTION_FAIL;
719
720 if (mschap_nt_password_hash(buffer, arg->vb_strvalue) < 0) {
721 REDEBUG("Failed generating Password.NT");
722 *buffer = '\0';
723 return XLAT_ACTION_FAIL;
724 }
725
726 MEM(vb = fr_value_box_alloc_null(ctx));
727 fr_value_box_memdup(ctx, vb, NULL, buffer, NT_DIGEST_LENGTH, false);
728 RDEBUG2("NT-Hash of \"known-good\" password: %pV", vb);
729 fr_dcursor_append(out, vb);
730 return XLAT_ACTION_DONE;
731
732 /*
733 * Return the LM-Hash of the passed string
734 */
735 } else if (strncasecmp(arg->vb_strvalue, "LM-Hash", 7) == 0) {
736 arg = fr_value_box_list_next(in, arg);
737 if ((!arg) || (arg->vb_length == 0))
738 return XLAT_ACTION_FAIL;
739
740 smbdes_lmpwdhash(arg->vb_strvalue, buffer);
741
742 MEM(vb = fr_value_box_alloc_null(ctx));
743 fr_value_box_memdup(ctx, vb, NULL, buffer, LM_DIGEST_LENGTH, false);
744 RDEBUG2("LM-Hash of %s = %pV", arg->vb_strvalue, vb);
745 fr_dcursor_append(out, vb);
746 return XLAT_ACTION_DONE;
747 } else {
748 REDEBUG("Unknown expansion string '%pV'", arg);
749 return XLAT_ACTION_FAIL;
750 }
751
752 /*
753 * Didn't set anything: this is bad.
754 */
755 if (!data) {
756 RWDEBUG2("Failed to do anything intelligent");
757 return XLAT_ACTION_FAIL;
758 }
759
760 MEM(vb = fr_value_box_alloc_null(ctx));
761 fr_value_box_memdup(ctx, vb, NULL, data, data_len, tainted);
762
763 fr_dcursor_append(out, vb);
764 return XLAT_ACTION_DONE;
765}
766
767
768#ifdef WITH_AUTH_WINBIND
769/*
770 * Free winbind context
771 */
772static int _mod_ctx_free(winbind_ctx_t *wbctx)
773{
774 wbcCtxFree(wbctx->ctx);
775 return 0;
776}
777
778/*
779 * Create winbind context
780 */
781static int winbind_ctx_alloc(winbind_ctx_t *wbctx, UNUSED void *uctx)
782{
783 wbctx->ctx = wbcCtxCreate();
784 if (!wbctx->ctx) {
785 fr_strerror_printf("Unable to create winbind context");
786 return -1;
787 }
788 talloc_set_destructor(wbctx, _mod_ctx_free);
789 return 0;
790}
791#endif
792
793/*
794 * Add MPPE attributes to the reply.
795 */
796static void mppe_add_reply(UNUSED rlm_mschap_t const *inst,
797 request_t *request, fr_dict_attr_t const *da, uint8_t const *value, size_t len)
798{
799 fr_pair_t *vp;
800
801 MEM(pair_update_reply(&vp, da) >= 0);
802 fr_pair_value_memdup(vp, value, len, false);
803 RINDENT();
804 RDEBUG2("reply.%pP", vp);
805 REXDENT();
806}
807
808/*
809 * Write a string to an fd, followed by "\n"
810 */
811static int write_all(int fd, char const *buf, size_t len)
812{
813 char const *p = buf;
814 char const *end = buf + len;
815
816 while (p < end) {
817 ssize_t slen;
818
819 slen = write(fd, p, end - p);
820 if (slen <= 0) return -1;
821
822 fr_assert((size_t) slen <= (size_t) (end - p));
823
824 p += slen;
825 }
826
827 if (write(fd, "\n", 1) <= 0) return -1;
828
829 return 0;
830}
831
832/*
833 * Perform an MS-CHAP2 password change
834 */
835
836static int CC_HINT(nonnull) do_mschap_cpw(rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx,
837 uint8_t *new_nt_password, uint8_t *old_nt_hash)
838{
839 mschap_cpw_ctx_t *cpw_ctx = auth_ctx->cpw_ctx;
840 fr_value_box_t *vb;
841
842 if (inst->ntlm_cpw && auth_ctx->method != AUTH_INTERNAL) {
843 /*
844 * we're going to run ntlm_auth in helper-mode
845 * we're expecting to use the ntlm-change-password-1 protocol
846 * which needs the following on stdin:
847 *
848 * username: %mschap(User-Name)
849 * nt-domain: %mschap(NT-Domain)
850 * new-nt-password-blob: bin2hex(new_nt_password) - 1032 bytes encoded
851 * old-nt-hash-blob: bin2hex(old_nt_hash) - 32 bytes encoded
852 * new-lm-password-blob: 00000...0000 - 1032 bytes null
853 * old-lm-hash-blob: 000....000 - 32 bytes null
854 * .\n
855 *
856 * ...and it should then print out
857 *
858 * Password-Change: Yes
859 *
860 * or
861 *
862 * Password-Change: No
863 * Password-Change-Error: blah
864 */
865
866 size_t size;
867 int status, len, to_child=-1, from_child=-1;
868 pid_t pid, child_pid;
869 char buf[2048];
870 char *pmsg;
871 char const *emsg;
872
873 RDEBUG2("Doing MS-CHAPv2 password change via ntlm_auth helper");
874
875 /*
876 * Start up ntlm_auth with a pipe on stdin and stdout
877 */
878
879 pid = radius_start_program_legacy(&to_child, &from_child, NULL, inst->ntlm_cpw, request, true, NULL, false);
880 if (pid < 0) {
881 REDEBUG("could not exec ntlm_auth cpw command");
882 return -1;
883 }
884
885 /*
886 * write the stuff to the client
887 */
888
889 vb = fr_value_box_list_head(&cpw_ctx->cpw_user);
890 if (!vb) goto ntlm_auth_err;
891
892 if (write_all(to_child, vb->vb_strvalue, vb->vb_length) < 0) {
893 REDEBUG("Failed to write username to child");
894 goto ntlm_auth_err;
895 }
896
897 if (auth_ctx->env_data->ntlm_cpw_domain) {
898 vb = fr_value_box_list_head(&cpw_ctx->cpw_domain);
899 if (!vb) goto no_domain;
900
901 if (write_all(to_child, vb->vb_strvalue, vb->vb_length) < 0) {
902 REDEBUG("Failed to write domain to child");
903 goto ntlm_auth_err;
904 }
905 } else {
906 no_domain:
907 RWDEBUG2("No ntlm_auth domain set, username must be full-username to work");
908 }
909
910 /* now the password blobs */
911 size = snprintf(buf, sizeof(buf), "new-nt-password-blob: ");
912 fr_base16_encode(&FR_SBUFF_OUT(buf + size, sizeof(buf) - size), &FR_DBUFF_TMP(new_nt_password, 516));
913 size = strlen(buf);
914 if (write_all(to_child, buf, size) < 0) {
915 RDEBUG2("failed to write new password blob to child");
916 goto ntlm_auth_err;
917 }
918
919 size = snprintf(buf, sizeof(buf), "old-nt-hash-blob: ");
920 fr_base16_encode(&FR_SBUFF_OUT(buf + size, sizeof(buf) - size), &FR_DBUFF_TMP(old_nt_hash, NT_DIGEST_LENGTH));
921 size = strlen(buf);
922 if (write_all(to_child, buf, size) < 0) {
923 REDEBUG("Failed to write old hash blob to child");
924 goto ntlm_auth_err;
925 }
926
927 /*
928 * In current samba versions, failure to supply empty LM password/hash
929 * blobs causes the change to fail.
930 */
931 size = snprintf(buf, sizeof(buf), "new-lm-password-blob: %01032i", 0);
932 if (write_all(to_child, buf, size) < 0) {
933 REDEBUG("Failed to write dummy LM password to child");
934 goto ntlm_auth_err;
935 }
936 size = snprintf(buf, sizeof(buf), "old-lm-hash-blob: %032i", 0);
937 if (write_all(to_child, buf, size) < 0) {
938 REDEBUG("Failed to write dummy LM hash to child");
939 goto ntlm_auth_err;
940 }
941 if (write_all(to_child, ".", 1) < 0) {
942 REDEBUG("Failed to send finish to child");
943 goto ntlm_auth_err;
944 }
945 close(to_child);
946 to_child = -1;
947
948 /*
949 * Read from the child
950 */
951 len = radius_readfrom_program_legacy(from_child, pid, fr_time_delta_from_sec(10), buf, sizeof(buf) - 1);
952 if (len < 0) {
953 /* radius_readfrom_program_legacy will have closed from_child for us */
954 REDEBUG("Failure reading from child");
955 return -1;
956 }
957 close(from_child);
958 from_child = -1;
959
960 buf[len] = 0;
961 RDEBUG2("ntlm_auth said: %s", buf);
962
963 child_pid = waitpid(pid, &status, 0);
964 if (child_pid == 0) {
965 REDEBUG("Timeout waiting for child");
966 return -1;
967 }
968 if (child_pid != pid) {
969 REDEBUG("Abnormal exit status: %s", fr_syserror(errno));
970 return -1;
971 }
972
973 if (strstr(buf, "Password-Change: Yes")) {
974 RDEBUG2("ntlm_auth password change succeeded");
975 return 0;
976 }
977
978 pmsg = strstr(buf, "Password-Change-Error: ");
979 if (pmsg) {
980 emsg = strsep(&pmsg, "\n");
981 } else {
982 emsg = "could not find error";
983 }
984 REDEBUG("ntlm auth password change failed: %s", emsg);
985
986ntlm_auth_err:
987 /* safe because these either need closing or are == -1 */
988 close(to_child);
989 close(from_child);
990
991 return -1;
992
993 /*
994 * Decrypt the new password blob, add it as a temporary request
995 * variable, xlat the local_cpw string, then remove it
996 *
997 * this allows is to write e..g
998 *
999 * %sql(insert into ...)
1000 *
1001 * ...or...
1002 *
1003 * %exec('/path/to', %mschap(User-Name), %{MS-CHAP-New-Cleartext-Password})"
1004 *
1005 */
1006#ifdef WITH_TLS
1007 } else if (auth_ctx->env_data->local_cpw) {
1008 RDEBUG2("Doing MS-CHAPv2 password change locally");
1009
1010 vb = fr_value_box_list_head(&cpw_ctx->local_cpw_result);
1011
1012 if (!vb){
1013 return -1;
1014 } else if (vb->vb_length == 0) {
1015 REDEBUG("Local MS-CHAPv2 password change - didn't give any result, assuming failure");
1016 return -1;
1017 }
1018
1019 RDEBUG2("MS-CHAPv2 password change succeeded: %pV", vb);
1020
1021 /*
1022 * Update the Password.NT attribute with the new hash this lets us
1023 * fall through to the authentication code using the new hash,
1024 * not the old one.
1025 */
1026 fr_pair_value_memdup(auth_ctx->nt_password, auth_ctx->cpw_ctx->new_hash->vp_octets,
1027 auth_ctx->cpw_ctx->new_hash->vp_length, false);
1028
1029 /*
1030 * Rock on! password change succeeded.
1031 */
1032 return 0;
1033#endif
1034 } else {
1035 REDEBUG("MS-CHAPv2 password change not configured");
1036 }
1037
1038 return -1;
1039}
1040
1041/*
1042 * Do the MS-CHAP stuff.
1043 *
1044 * This function is here so that all of the MS-CHAP related
1045 * authentication is in one place, and we can perhaps later replace
1046 * it with code to call winbindd, or something similar.
1047 */
1048static int CC_HINT(nonnull) do_mschap(rlm_mschap_t const *inst, request_t *request,
1049 mschap_auth_ctx_t *auth_ctx,
1050 uint8_t const *challenge, uint8_t const *response,
1051 uint8_t nthashhash[static NT_DIGEST_LENGTH])
1052{
1053 uint8_t calculated[24];
1054 fr_pair_t *password = auth_ctx->nt_password;
1055
1056 memset(nthashhash, 0, NT_DIGEST_LENGTH);
1057
1058 switch (auth_ctx->method) {
1059 case AUTH_INTERNAL:
1060 case AUTH_AUTO:
1061 /*
1062 * Do normal authentication.
1063 */
1064 {
1065 /*
1066 * No password: can't do authentication.
1067 */
1068 if (!password) {
1069 if (auth_ctx->method == AUTH_AUTO) goto do_ntlm;
1070
1071 REDEBUG("FAILED: No Password.NT/LM. Cannot perform authentication");
1072 return -1;
1073 }
1074
1075 smbdes_mschap(password->vp_octets, challenge, calculated);
1076 if (fr_digest_cmp(response, calculated, 24) != 0) {
1077 return -1;
1078 }
1079
1080 /*
1081 * If the password exists, and is an NT-Password,
1082 * then calculate the hash of the NT hash. Doing this
1083 * here minimizes work for later.
1084 */
1085 if (password->da == attr_nt_password) fr_md4_calc(nthashhash, password->vp_octets, MD4_DIGEST_LENGTH);
1086 break;
1087 }
1088 case AUTH_NTLMAUTH_EXEC:
1089 do_ntlm:
1090 /*
1091 * Run ntlm_auth
1092 */
1093 {
1094 int result;
1095 char buffer[256];
1096 size_t len;
1097
1098 /*
1099 * Run the program, and expect that we get 16
1100 */
1101 result = radius_exec_program_legacy(buffer, sizeof(buffer), request, inst->ntlm_auth, NULL,
1102 true, true, inst->ntlm_auth_timeout);
1103 if (result != 0) {
1104 char *p;
1105
1106 /*
1107 * Do checks for numbers, which are
1108 * language neutral. They're also
1109 * faster.
1110 */
1111 p = strcasestr(buffer, "0xC0000");
1112 if (p) {
1113 result = 0;
1114
1115 p += 7;
1116 if (strcmp(p, "224") == 0) {
1117 result = -648;
1118
1119 } else if (strcmp(p, "234") == 0) {
1120 result = -647;
1121
1122 } else if (strcmp(p, "072") == 0) {
1123 result = -691;
1124
1125 } else if (strcasecmp(p, "05E") == 0) {
1126 result = -2;
1127 }
1128
1129 if (result != 0) {
1130 REDEBUG2("%s", buffer);
1131 return result;
1132 }
1133
1134 /*
1135 * Else fall through to more ridiculous checks.
1136 */
1137 }
1138
1139 /*
1140 * Look for variants of expire password.
1141 */
1142 if (strcasestr(buffer, "0xC0000224") ||
1143 strcasestr(buffer, "Password expired") ||
1144 strcasestr(buffer, "Password has expired") ||
1145 strcasestr(buffer, "Password must be changed") ||
1146 strcasestr(buffer, "Must change password")) {
1147 return -648;
1148 }
1149
1150 if (strcasestr(buffer, "0xC0000234") ||
1151 strcasestr(buffer, "Account locked out")) {
1152 REDEBUG2("%s", buffer);
1153 return -647;
1154 }
1155
1156 if (strcasestr(buffer, "0xC0000072") ||
1157 strcasestr(buffer, "Account disabled")) {
1158 REDEBUG2("%s", buffer);
1159 return -691;
1160 }
1161
1162 if (strcasestr(buffer, "0xC000005E") ||
1163 strcasestr(buffer, "No logon servers")) {
1164 REDEBUG2("%s", buffer);
1165 return -2;
1166 }
1167
1168 if (strcasestr(buffer, "could not obtain winbind separator") ||
1169 strcasestr(buffer, "Reading winbind reply failed")) {
1170 REDEBUG2("%s", buffer);
1171 return -2;
1172 }
1173
1174 RDEBUG2("External script failed");
1175 p = strchr(buffer, '\n');
1176 if (p) *p = '\0';
1177
1178 REDEBUG("External script says: %s", buffer);
1179 return -1;
1180 }
1181
1182 /*
1183 * Parse the answer as an nthashhash.
1184 *
1185 * ntlm_auth currently returns:
1186 * NT_KEY: 000102030405060708090a0b0c0d0e0f
1187 */
1188 if (memcmp(buffer, "NT_KEY: ", 8) != 0) {
1189 REDEBUG("Invalid output from ntlm_auth: expecting 'NT_KEY: ' prefix");
1190 return -1;
1191 }
1192
1193 /*
1194 * Check the length. It should be at least 32, with an LF at the end.
1195 */
1196 len = strlen(buffer + 8);
1197 if (len < 32) {
1198 REDEBUG2("Invalid output from ntlm_auth: NT_KEY too short, expected 32 bytes got %zu bytes",
1199 len);
1200
1201 return -1;
1202 }
1203
1204 /*
1205 * Update the NT hash hash, from the NT key.
1206 */
1207 if (fr_base16_decode(NULL, &FR_DBUFF_TMP(nthashhash, NT_DIGEST_LENGTH),
1208 &FR_SBUFF_IN(buffer + 8, len), false) != NT_DIGEST_LENGTH) {
1209 REDEBUG("Invalid output from ntlm_auth: NT_KEY has non-hex values");
1210 return -1;
1211 }
1212
1213 break;
1214 }
1215#ifdef WITH_AUTH_WINBIND
1216 case AUTH_WBCLIENT:
1217 /*
1218 * Process auth via the wbclient library
1219 */
1220 return do_auth_wbclient(inst, request, challenge, response, nthashhash, auth_ctx);
1221#endif
1222 default:
1223 /* We should never reach this line */
1224 RERROR("Internal error: Unknown mschap auth method (%d)", auth_ctx->method);
1225 return -1;
1226 }
1227
1228 return 0;
1229}
1230
1231
1232/*
1233 * Data for the hashes.
1234 */
1235static const uint8_t SHSpad1[40] =
1236 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1237 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1238 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1239 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
1240
1241static const uint8_t SHSpad2[40] =
1242 { 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
1243 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
1244 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
1245 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2 };
1246
1247static const uint8_t magic1[27] =
1248 { 0x54, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74,
1249 0x68, 0x65, 0x20, 0x4d, 0x50, 0x50, 0x45, 0x20, 0x4d,
1250 0x61, 0x73, 0x74, 0x65, 0x72, 0x20, 0x4b, 0x65, 0x79 };
1251
1252static const uint8_t magic2[84] =
1253 { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69,
1254 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20,
1255 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
1256 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, 0x6b, 0x65, 0x79,
1257 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x73,
1258 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, 0x69, 0x64, 0x65,
1259 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
1260 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20,
1261 0x6b, 0x65, 0x79, 0x2e };
1262
1263static const uint8_t magic3[84] =
1264 { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69,
1265 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20,
1266 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
1267 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20,
1268 0x6b, 0x65, 0x79, 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68,
1269 0x65, 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73,
1270 0x69, 0x64, 0x65, 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73,
1271 0x20, 0x74, 0x68, 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20,
1272 0x6b, 0x65, 0x79, 0x2e };
1273
1274
1275static void mppe_GetMasterKey(uint8_t const *nt_hashhash, uint8_t const *nt_response,
1276 uint8_t *masterkey)
1277{
1278 uint8_t digest[20];
1279 fr_sha1_ctx Context;
1280
1281 fr_sha1_init(&Context);
1282 fr_sha1_update(&Context, nt_hashhash, NT_DIGEST_LENGTH);
1283 fr_sha1_update(&Context, nt_response, 24);
1284 fr_sha1_update(&Context, magic1, 27);
1285 fr_sha1_final(digest, &Context);
1286
1287 memcpy(masterkey, digest, 16); //-V512
1288}
1289
1290
1291static void mppe_GetAsymmetricStartKey(uint8_t *masterkey, uint8_t *sesskey,
1292 int keylen, int issend)
1293{
1294 uint8_t digest[20];
1295 const uint8_t *s;
1296 fr_sha1_ctx Context;
1297
1298 memset(digest, 0, 20);
1299
1300 if(issend) {
1301 s = magic3;
1302 } else {
1303 s = magic2;
1304 }
1305
1306 fr_sha1_init(&Context);
1307 fr_sha1_update(&Context, masterkey, 16);
1308 fr_sha1_update(&Context, SHSpad1, 40);
1309 fr_sha1_update(&Context, s, 84);
1310 fr_sha1_update(&Context, SHSpad2, 40);
1311 fr_sha1_final(digest, &Context);
1312
1313 memcpy(sesskey, digest, keylen);
1314}
1315
1316
1317static void mppe_chap2_get_keys128(uint8_t const *nt_hashhash, uint8_t const *nt_response,
1318 uint8_t *sendkey, uint8_t *recvkey)
1319{
1320 uint8_t masterkey[16];
1321
1322 mppe_GetMasterKey(nt_hashhash, nt_response, masterkey);
1323
1324 mppe_GetAsymmetricStartKey(masterkey, sendkey, 16, 1);
1325 mppe_GetAsymmetricStartKey(masterkey, recvkey, 16, 0);
1326}
1327
1328/*
1329 * Generate MPPE keys.
1330 */
1331static void mppe_chap2_gen_keys128(uint8_t const *nt_hashhash, uint8_t const *response,
1332 uint8_t *sendkey, uint8_t *recvkey)
1333{
1334 uint8_t enckey1[16];
1335 uint8_t enckey2[16];
1336
1337 mppe_chap2_get_keys128(nt_hashhash, response, enckey1, enckey2);
1338
1339 /*
1340 * dictionary.microsoft defines these attributes as
1341 * 'encrypt=Tunnel-Password'. The functions in src/lib/radius.c will
1342 * take care of encrypting/decrypting them as appropriate,
1343 * so that we don't have to.
1344 */
1345 memcpy (sendkey, enckey1, 16);
1346 memcpy (recvkey, enckey2, 16);
1347}
1348
1349
1350/*
1351 * mod_authorize() - authorize user if we can authenticate
1352 * it later. Add Auth-Type attribute if present in module
1353 * configuration (usually Auth-Type must be "MS-CHAP")
1354 */
1355static unlang_action_t CC_HINT(nonnull) mod_authorize(unlang_result_t *p_result, module_ctx_t const *mctx, request_t *request)
1356{
1357 rlm_mschap_t const *inst = talloc_get_type_abort_const(mctx->mi->data, rlm_mschap_t);
1358 mschap_autz_call_env_t *env_data = talloc_get_type_abort(mctx->env_data, mschap_autz_call_env_t);
1359 fr_pair_t *challenge = NULL;
1360 fr_pair_t *parent;
1361
1362 challenge = fr_pair_find_by_da_nested(&request->request_pairs, NULL, tmpl_attr_tail_da(env_data->chap_challenge));
1363 if (!challenge) RETURN_UNLANG_NOOP;
1364
1365 /*
1366 * The responses MUST be in the same group as the challenge.
1367 */
1368 parent = fr_pair_parent(challenge);
1369 fr_assert(parent != NULL);
1370
1371 if (!fr_pair_find_by_da(&parent->vp_group, NULL, tmpl_attr_tail_da(env_data->chap_response)) &&
1372 !fr_pair_find_by_da(&parent->vp_group, NULL, tmpl_attr_tail_da(env_data->chap2_response)) &&
1373 (env_data->chap2_cpw &&
1374 !fr_pair_find_by_da(&parent->vp_group, NULL, tmpl_attr_tail_da(env_data->chap2_cpw)))) {
1375 RDEBUG2("Found MS-CHAP-Challenge, but no MS-CHAP response or Change-Password");
1376 RETURN_UNLANG_NOOP;
1377 }
1378
1379 if (!inst->auth_type) {
1380 WARN("No 'authenticate %s {...}' section or 'Auth-Type = %s' set. Cannot setup MS-CHAP authentication",
1381 mctx->mi->name, mctx->mi->name);
1382 RETURN_UNLANG_NOOP;
1383 }
1384
1385 if (!module_rlm_section_type_set(request, attr_auth_type, inst->auth_type)) RETURN_UNLANG_NOOP;
1386
1387 RETURN_UNLANG_OK;
1388}
1389
1390static unlang_action_t mschap_error(unlang_result_t *p_result, rlm_mschap_t const *inst, request_t *request,
1391 unsigned char ident, int mschap_result, int mschap_version, fr_pair_t *smb_ctrl,
1392 mschap_auth_call_env_t *env_data)
1393{
1394 rlm_rcode_t rcode = RLM_MODULE_OK;
1395 int error = 0;
1396 int retry = 0;
1397 char const *message = NULL;
1398
1399 int i;
1400 char new_challenge[33], buffer[128];
1401 char *p;
1402
1403 if ((mschap_result == -648) ||
1404 ((mschap_result == 0) &&
1405 (smb_ctrl && ((smb_ctrl->vp_uint32 & ACB_FR_EXPIRED) != 0)))) {
1406 REDEBUG("Password has expired. User should retry authentication");
1407 error = 648;
1408
1409 /*
1410 * A password change is NOT a retry! We MUST have retry=0 here.
1411 */
1412 retry = 0;
1413 message = "Password expired";
1414 rcode = RLM_MODULE_REJECT;
1415
1416 /*
1417 * Account is disabled.
1418 *
1419 * They're found, but they don't exist, so we
1420 * return 'not found'.
1421 */
1422 } else if ((mschap_result == -691) ||
1423 (smb_ctrl && (((smb_ctrl->vp_uint32 & ACB_DISABLED) != 0) ||
1424 ((smb_ctrl->vp_uint32 & (ACB_NORMAL|ACB_WSTRUST)) == 0)))) {
1425 REDEBUG("SMB-Account-Ctrl (or ntlm_auth) "
1426 "says that the account is disabled, "
1427 "or is not a normal or workstation trust account");
1428 error = 691;
1429 retry = 0;
1430 message = "Account disabled";
1431 rcode = RLM_MODULE_NOTFOUND;
1432
1433 /*
1434 * User is locked out.
1435 */
1436 } else if ((mschap_result == -647) ||
1437 (smb_ctrl && ((smb_ctrl->vp_uint32 & ACB_AUTOLOCK) != 0))) {
1438 REDEBUG("SMB-Account-Ctrl (or ntlm_auth) "
1439 "says that the account is locked out");
1440 error = 647;
1441 retry = 0;
1442 message = "Account locked out";
1443 rcode = RLM_MODULE_DISALLOW;
1444
1445 } else if (mschap_result < 0) {
1446 REDEBUG("%s is incorrect", mschap_version == 1 ? env_data->chap_response->name : env_data->chap2_response->name);
1447 error = 691;
1448 retry = inst->allow_retry;
1449 message = "Authentication failed";
1450 rcode = RLM_MODULE_REJECT;
1451 }
1452
1453 if (rcode == RLM_MODULE_OK) RETURN_UNLANG_OK;
1454
1455 switch (mschap_version) {
1456 case 1:
1457 for (p = new_challenge, i = 0; i < 2; i++) p += snprintf(p, 9, "%08x", fr_rand());
1458 snprintf(buffer, sizeof(buffer), "E=%i R=%i C=%s V=2",
1459 error, retry, new_challenge);
1460 break;
1461
1462 case 2:
1463 for (p = new_challenge, i = 0; i < 4; i++) p += snprintf(p, 9, "%08x", fr_rand());
1464 snprintf(buffer, sizeof(buffer), "E=%i R=%i C=%s V=3 M=%s",
1465 error, retry, new_challenge, message);
1466 break;
1467
1468 default:
1469 RETURN_UNLANG_FAIL;
1470 }
1471 if (env_data->chap_error) mschap_add_reply(request, ident, tmpl_attr_tail_da(env_data->chap_error),
1472 buffer, strlen(buffer));
1473
1474 RETURN_UNLANG_RCODE(rcode);
1475}
1476
1477
1478/** Find a Password.NT value, or create one from a Password.Cleartext, or Password.With-Header attribute
1479 *
1480 * @param[in] ctx to allocate ephemeral passwords in.
1481 * @param[out] out Our new Password.NT.
1482 * @param[in] inst Module configuration.
1483 * @param[in] request The current request.
1484 * @return
1485 * - 0 on success.
1486 * - -1 on failure.
1487 */
1488static int CC_HINT(nonnull(1, 2, 3)) nt_password_find(TALLOC_CTX *ctx, fr_pair_t **out,
1489 rlm_mschap_t const *inst, request_t *request)
1490{
1491 fr_pair_t *password;
1492 fr_dict_attr_t const *allowed_passwords[] = { attr_cleartext_password, attr_nt_password };
1493 bool ephemeral;
1494
1495 *out = NULL; /* Init output pointer */
1496
1497 password = password_find(&ephemeral, ctx, request,
1498 allowed_passwords, NUM_ELEMENTS(allowed_passwords), inst->normify);
1499 if (!password) {
1500 if (inst->method == AUTH_INTERNAL) {
1501 /*
1502 * Search for passwords in the parent
1503 * FIXME: This is a hack and should be removed
1504 * When EAP-MSCHAPv2 supports sections.
1505 */
1506 if (request->parent) {
1507 password = password_find(&ephemeral, ctx, request->parent,
1508 allowed_passwords,
1509 NUM_ELEMENTS(allowed_passwords), inst->normify);
1510 if (password) goto found_password;
1511 }
1512
1513 /*
1514 * If we're doing internal auth, then this is an issue
1515 */
1516 REDEBUG2("No control.%s.%s or control.%s.%s found. Cannot create Password.NT",
1517 attr_cleartext_password->parent->name, attr_cleartext_password->name,
1518 attr_nt_password->parent->name, attr_nt_password->name);
1519 return -1;
1520
1521 /*
1522 * ..if we're not, then we can call out to external sources.
1523 */
1524 } else {
1525 return 0;
1526 }
1527 }
1528
1529found_password:
1530 if (password->da == attr_cleartext_password) {
1531 uint8_t *p;
1532 int ret;
1533 fr_pair_t *nt_password;
1534
1535 MEM(nt_password = fr_pair_afrom_da(ctx, attr_nt_password));
1536 MEM(fr_pair_value_mem_alloc(nt_password, &p, NT_DIGEST_LENGTH, false) == 0);
1537 ret = mschap_nt_password_hash(p, password->vp_strvalue);
1538
1539 if (ret < 0) {
1540 RERROR("Failed generating Password.NT");
1541 talloc_free(nt_password);
1542 if (ephemeral) TALLOC_FREE(password);
1543 return -1;
1544 }
1545
1546 if (RDEBUG_ENABLED3) {
1547 RDEBUG3("Hashed control.%pP to create %s = %pV",
1548 password, attr_nt_password->name, fr_box_octets(p, NT_DIGEST_LENGTH));
1549 } else {
1550 RDEBUG2("Hashed control.%s to create %s", attr_nt_password->name, password->da->name);
1551 }
1552
1553 if (ephemeral) TALLOC_FREE(password);
1554
1555 *out = nt_password;
1556
1557 return 0;
1558 }
1559
1560 fr_assert(password->da == attr_nt_password);
1561
1562 if (RDEBUG_ENABLED3) {
1563 RDEBUG3("Found control.%pP", password);
1564 } else {
1565 RDEBUG2("Found control.%s", attr_nt_password->name);
1566 }
1567 *out = password;
1568
1569 return 0;
1570}
1571
1572/*
1573 * mschap_cpw_request_process() - do the work to handle an MS-CHAP password
1574 * change request.
1575 */
1576static unlang_action_t CC_HINT(nonnull) mschap_process_cpw_request(unlang_result_t *p_result,
1577 rlm_mschap_t const *inst,
1578 request_t *request,
1579 mschap_auth_ctx_t *auth_ctx)
1580{
1581 mschap_auth_call_env_t *env_data = auth_ctx->env_data;
1582 mschap_cpw_ctx_t *cpw_ctx = auth_ctx->cpw_ctx;
1583
1584 /*
1585 * Perform the actual password change
1586 */
1587 if (do_mschap_cpw(inst, request, auth_ctx, cpw_ctx->new_nt_encrypted, cpw_ctx->old_nt_hash) < 0) {
1588 char buffer[128];
1589
1590 REDEBUG("Password change failed");
1591
1592 if (env_data->chap_error) {
1593 snprintf(buffer, sizeof(buffer), "E=709 R=0 M=Password change failed");
1594 mschap_add_reply(request, auth_ctx->cpw->vp_octets[1],
1595 tmpl_attr_tail_da(env_data->chap_error), buffer, strlen(buffer));
1596 }
1597
1598 RETURN_UNLANG_REJECT;
1599 }
1600
1601 RDEBUG2("Password change successful");
1602
1603 RETURN_UNLANG_OK;
1604}
1605
1606/** Validate data required for change password requests.
1607 *
1608 */
1609static int mschap_cpw_prepare(request_t *request, mschap_auth_ctx_t *auth_ctx)
1610{
1611 mschap_auth_call_env_t *env_data = auth_ctx->env_data;
1612 mschap_cpw_ctx_t *cpw_ctx;
1613 fr_pair_t *nt_enc = NULL;
1614 int seq, new_nt_enc_len;
1615
1616 /*
1617 * mschap2 password change request.
1618 *
1619 * We cheat - first decode and execute the passchange.
1620 * Then extract the response, add it into the request
1621 * and then jump into mschap2 auth with the challenge/
1622 * response.
1623 */
1624 RDEBUG2("MS-CHAPv2 password change request received");
1625
1626 if (auth_ctx->cpw->vp_length != 68) {
1627 REDEBUG("%s has the wrong format: length %zu != 68", env_data->chap2_cpw->name, auth_ctx->cpw->vp_length);
1628 return -1;
1629 }
1630
1631 if (auth_ctx->cpw->vp_octets[0] != 7) {
1632 REDEBUG("%s has the wrong format: code %d != 7", env_data->chap2_cpw->name, auth_ctx->cpw->vp_octets[0]);
1633 return -1;
1634 }
1635
1636 MEM(auth_ctx->cpw_ctx = talloc_zero(auth_ctx, mschap_cpw_ctx_t));
1637 cpw_ctx = auth_ctx->cpw_ctx;
1638
1639 /*
1640 * Look for the new (encrypted) password.
1641 *
1642 * Bah, stupid composite attributes...
1643 * we're expecting 3 attributes with the leading bytes -
1644 * 06:<mschapid>:00:01:<1st chunk>
1645 * 06:<mschapid>:00:02:<2nd chunk>
1646 * 06:<mschapid>:00:03:<3rd chunk>
1647 */
1648 new_nt_enc_len = 0;
1649 for (seq = 1; seq < 4; seq++) {
1650 int found = 0;
1651
1652 while ((nt_enc = fr_pair_find_by_da_nested(&request->request_pairs, nt_enc,
1653 tmpl_attr_tail_da(env_data->chap_nt_enc_pw)))) {
1654 if (nt_enc->vp_length < 4) {
1655 REDEBUG("%s with invalid format", env_data->chap_nt_enc_pw->name);
1656 return -1;
1657 }
1658
1659 if (nt_enc->vp_octets[0] != 6) {
1660 REDEBUG("%s with invalid format", env_data->chap_nt_enc_pw->name);
1661 return -1;
1662 }
1663
1664 if ((nt_enc->vp_octets[2] == 0) && (nt_enc->vp_octets[3] == seq)) {
1665 found = 1;
1666 break;
1667 }
1668 }
1669
1670 if (!found) {
1671 REDEBUG("Could not find %s with sequence number %d", env_data->chap_nt_enc_pw->name, seq);
1672 return -1;
1673 }
1674
1675 if ((new_nt_enc_len + nt_enc->vp_length - 4) > sizeof(cpw_ctx->new_nt_encrypted)) {
1676 REDEBUG("Unpacked %s length > 516", env_data->chap_nt_enc_pw->name);
1677 return -1;
1678 }
1679
1680 memcpy(cpw_ctx->new_nt_encrypted + new_nt_enc_len, nt_enc->vp_octets + 4, nt_enc->vp_length - 4);
1681 new_nt_enc_len += nt_enc->vp_length - 4;
1682 }
1683
1684 if (new_nt_enc_len != 516) {
1685 REDEBUG("Unpacked %s length is %d - should be 516", env_data->chap_nt_enc_pw->name, new_nt_enc_len);
1686 return -1;
1687 }
1688
1689 /*
1690 * RFC 2548 is confusing here. It claims:
1691 *
1692 * 1 byte code
1693 * 1 byte ident
1694 * 16 octets - old hash encrypted with new hash
1695 * 24 octets - peer challenge
1696 * this is actually:
1697 * 16 octets - peer challenge
1698 * 8 octets - reserved
1699 * 24 octets - nt response
1700 * 2 octets - flags (ignored)
1701 */
1702
1703 memcpy(cpw_ctx->old_nt_hash, auth_ctx->cpw->vp_octets + 2, sizeof(cpw_ctx->old_nt_hash));
1704
1705 RDEBUG2("Password change payload valid");
1706 return 0;
1707}
1708
1709static CC_HINT(nonnull) unlang_action_t mschap_process_response(unlang_result_t *p_result, int *mschap_version,
1710 uint8_t nthashhash[static NT_DIGEST_LENGTH],
1711 rlm_mschap_t const *inst, request_t *request,
1712 mschap_auth_ctx_t *auth_ctx,
1713 fr_pair_t *challenge, fr_pair_t *response)
1714{
1715 int offset;
1716 rlm_rcode_t mschap_result;
1717 mschap_auth_call_env_t *env_data = auth_ctx->env_data;
1718
1719 *mschap_version = 1;
1720
1721 RDEBUG2("Processing MS-CHAPv1 response");
1722
1723 /*
1724 * MS-CHAPv1 challenges are 8 octets.
1725 */
1726 if (challenge->vp_length < 8) {
1727 REDEBUG("%s has the wrong format", env_data->chap_challenge->name);
1728 RETURN_UNLANG_INVALID;
1729 }
1730
1731 /*
1732 * Responses are 50 octets.
1733 */
1734 if (response->vp_length < 50) {
1735 REDEBUG("%s has the wrong format", env_data->chap_response->name);
1736 RETURN_UNLANG_INVALID;
1737 }
1738
1739 /*
1740 * We are doing MS-CHAP. Calculate the MS-CHAP
1741 * response
1742 */
1743 if (!(response->vp_octets[1] & 0x01)) {
1744 REDEBUG2("Client used unsupported method LM-Password");
1745 RETURN_UNLANG_FAIL;
1746 }
1747
1748 offset = 26;
1749
1750 /*
1751 * Do the MS-CHAP authentication.
1752 */
1753 mschap_result = do_mschap(inst, request, auth_ctx, challenge->vp_octets, response->vp_octets + offset, nthashhash);
1754
1755 /*
1756 * Check for errors, and add MSCHAP-Error if necessary.
1757 */
1758 return mschap_error(p_result, inst, request, *response->vp_octets, mschap_result, *mschap_version, auth_ctx->smb_ctrl, env_data);
1759}
1760
1761static unlang_action_t CC_HINT(nonnull) mschap_process_v2_response(unlang_result_t *p_result, int *mschap_version,
1762 uint8_t nthashhash[static NT_DIGEST_LENGTH],
1763 rlm_mschap_t const *inst, request_t *request,
1764 mschap_auth_ctx_t *auth_ctx,
1765 fr_pair_t *challenge, fr_pair_t *response)
1766{
1767 uint8_t mschap_challenge[16];
1768 fr_pair_t *user_name, *name_vp, *response_name, *peer_challenge_attr;
1769 uint8_t const *peer_challenge;
1770 char const *username_str;
1771 size_t username_len;
1772 int mschap_result;
1773 char msch2resp[42];
1774 mschap_auth_call_env_t *env_data = auth_ctx->env_data;
1775
1776 *mschap_version = 2;
1777
1778 RDEBUG2("Processing MS-CHAPv2 response");
1779
1780 /*
1781 * MS-CHAPv2 challenges are 16 octets.
1782 */
1783 if (challenge->vp_length < 16) {
1784 REDEBUG("%s has the wrong format", env_data->chap_challenge->name);
1785 RETURN_UNLANG_INVALID;
1786 }
1787
1788 /*
1789 * Responses are 50 octets.
1790 */
1791 if (response->vp_length < 50) {
1792 REDEBUG("%s has the wrong format", env_data->chap2_response->name);
1793 RETURN_UNLANG_INVALID;
1794 }
1795
1796 /*
1797 * We also require a User-Name
1798 */
1799 user_name = mschap_identity_find(request, tmpl_attr_tail_da(env_data->username));
1800 if (!user_name) RETURN_UNLANG_FAIL;
1801
1802 /*
1803 * Check for MS-CHAP-User-Name and if found, use it
1804 * to construct the MSCHAPv1 challenge. This is
1805 * set by rlm_eap_mschap to the MS-CHAP Response
1806 * packet Name field.
1807 *
1808 * We prefer this to the User-Name in the
1809 * packet.
1810 */
1811 response_name = fr_pair_find_by_da(&request->request_pairs, NULL, attr_ms_chap_user_name);
1812 name_vp = response_name ? response_name : user_name;
1813
1814 /*
1815 * with_ntdomain_hack moved here, too.
1816 */
1817 if ((username_str = strchr(name_vp->vp_strvalue, '\\')) != NULL) {
1818 if (inst->with_ntdomain_hack) {
1819 username_str++;
1820 } else {
1821 RWDEBUG2("NT Domain delimiter found, should 'with_ntdomain_hack' be enabled?");
1822 username_str = name_vp->vp_strvalue;
1823 }
1824 } else {
1825 username_str = name_vp->vp_strvalue;
1826 }
1827 username_len = name_vp->vp_length - (username_str - name_vp->vp_strvalue);
1828
1829 if (response_name && ((user_name->vp_length != response_name->vp_length) ||
1830 (strncasecmp(user_name->vp_strvalue, response_name->vp_strvalue, user_name->vp_length) != 0))) {
1831 RWDEBUG("%pP is not the same as %pP from EAP-MSCHAPv2", user_name, response_name);
1832 }
1833
1834#ifdef __APPLE__
1835 /*
1836 * No "known good" Password.NT attribute. Try to do
1837 * OpenDirectory authentication.
1838 *
1839 * If OD determines the user is an AD user it will return noop, which
1840 * indicates the auth process should continue directly to AD.
1841 * Otherwise OD will determine auth success/fail.
1842 */
1843 if (!auth_ctx->nt_password && inst->open_directory) {
1844 RDEBUG2("No Password.NT available. Trying OpenDirectory Authentication");
1845 od_mschap_auth(p_result, request, challenge, user_name, env_data);
1846 if (p_result->rcode != RLM_MODULE_NOOP) return UNLANG_ACTION_CALCULATE_RESULT;
1847 }
1848#endif
1849 peer_challenge = response->vp_octets + 2;
1850
1851 peer_challenge_attr = fr_pair_find_by_da(&request->control_pairs, NULL, attr_ms_chap_peer_challenge);
1852 if (peer_challenge_attr) {
1853 RDEBUG2("Overriding peer challenge");
1854 peer_challenge = peer_challenge_attr->vp_octets;
1855 }
1856
1857 /*
1858 * The old "mschapv2" function has been moved to
1859 * here.
1860 *
1861 * MS-CHAPv2 takes some additional data to create an
1862 * MS-CHAPv1 challenge, and then does MS-CHAPv1.
1863 */
1864 RDEBUG2("Creating challenge with username \"%pV\"",
1865 fr_box_strvalue_len(username_str, username_len));
1866 mschap_challenge_hash(mschap_challenge, /* resulting challenge */
1867 peer_challenge, /* peer challenge */
1868 challenge->vp_octets, /* our challenge */
1869 username_str, username_len); /* user name */
1870
1871 mschap_result = do_mschap(inst, request, auth_ctx, mschap_challenge, response->vp_octets + 26, nthashhash);
1872
1873 /*
1874 * Check for errors, and add MSCHAP-Error if necessary.
1875 */
1876 mschap_error(p_result, inst, request, *response->vp_octets,
1877 mschap_result, *mschap_version, auth_ctx->smb_ctrl, env_data);
1878 if (p_result->rcode != RLM_MODULE_OK) return UNLANG_ACTION_CALCULATE_RESULT;
1879
1880#ifdef WITH_AUTH_WINBIND
1881 if (inst->wb_retry_with_normalised_username) {
1882 response_name = fr_pair_find_by_da(&request->request_pairs, NULL, attr_ms_chap_user_name);
1883 if (response_name) {
1884 if (strcmp(username_str, response_name->vp_strvalue)) {
1885 RDEBUG2("Normalising username %pV -> %pV",
1886 fr_box_strvalue_len(username_str, username_len),
1887 &response_name->data);
1888 username_str = response_name->vp_strvalue;
1889 }
1890 }
1891 }
1892#endif
1893
1894 mschap_auth_response(username_str, /* without the domain */
1895 username_len, /* Length of username str */
1896 nthashhash, /* nt-hash-hash */
1897 response->vp_octets + 26, /* peer response */
1898 peer_challenge, /* peer challenge */
1899 challenge->vp_octets, /* our challenge */
1900 msch2resp); /* calculated MPPE key */
1901 if (env_data->chap2_success) mschap_add_reply(request, *response->vp_octets,
1902 tmpl_attr_tail_da(env_data->chap2_success), msch2resp, 42);
1903
1904 RETURN_UNLANG_OK;
1905}
1906
1907/** Complete mschap authentication after any tmpls have been expanded.
1908 *
1909 */
1910static unlang_action_t mod_authenticate_resume(unlang_result_t *p_result, module_ctx_t const *mctx, request_t *request)
1911{
1912 mschap_auth_ctx_t *auth_ctx = talloc_get_type_abort(mctx->rctx, mschap_auth_ctx_t);
1913 mschap_auth_call_env_t *env_data = talloc_get_type_abort(auth_ctx->env_data, mschap_auth_call_env_t);
1914 rlm_mschap_t const *inst = talloc_get_type_abort_const(auth_ctx->inst, rlm_mschap_t);
1915 fr_pair_t *challenge = NULL;
1916 fr_pair_t *response = NULL;
1917 fr_pair_t *parent;
1918 uint8_t nthashhash[NT_DIGEST_LENGTH];
1919 int mschap_version = 0;
1920
1921 p_result->rcode = RLM_MODULE_OK;
1922
1923 if (auth_ctx->cpw) {
1924 uint8_t *p;
1925
1926 /*
1927 * Password change does require the NT password
1928 */
1929 if (!auth_ctx->nt_password) {
1930 REDEBUG("Missing Password.NT - required for change password request");
1931 RETURN_UNLANG_FAIL;
1932 }
1933 if (!env_data->chap_nt_enc_pw) {
1934 REDEBUG("chap_nt_enc_pw option is not set - required for change password request");
1935 RETURN_UNLANG_INVALID;
1936 }
1937
1938 mschap_process_cpw_request(p_result, inst, request, auth_ctx);
1939 if (p_result->rcode != RLM_MODULE_OK) goto finish;
1940
1941 /*
1942 * Clear any expiry bit so the user can now login;
1943 * obviously the password change action will need
1944 * to have cleared this bit in the config/SQL/wherever.
1945 */
1946 if (auth_ctx->smb_ctrl && auth_ctx->smb_ctrl->vp_uint32 & ACB_FR_EXPIRED) {
1947 RDEBUG2("Clearing expiry bit in SMB-Acct-Ctrl to allow authentication");
1948 auth_ctx->smb_ctrl->vp_uint32 &= ~ACB_FR_EXPIRED;
1949 }
1950
1951 /*
1952 * Extract the challenge & response from the end of the
1953 * password change, add them into the request and then
1954 * continue with the authentication.
1955 */
1956 MEM(pair_update_request(&response, tmpl_attr_tail_da(env_data->chap2_response)) >= 0);
1957 MEM(fr_pair_value_mem_alloc(response, &p, 50, auth_ctx->cpw->vp_tainted) == 0);
1958
1959 /* ident & flags */
1960 p[0] = auth_ctx->cpw->vp_octets[1];
1961 p[1] = 0;
1962 /* peer challenge and client NT response */
1963 memcpy(p + 2, auth_ctx->cpw->vp_octets + 18, 48);
1964 }
1965
1966 challenge = fr_pair_find_by_da_nested(&request->request_pairs, NULL, tmpl_attr_tail_da(env_data->chap_challenge));
1967 if (!challenge) {
1968 REDEBUG("control.Auth-Type = %s set for a request that does not contain %s",
1969 auth_ctx->name, env_data->chap_challenge->name);
1970 p_result->rcode = RLM_MODULE_INVALID;
1971 goto finish;
1972 }
1973
1974 /*
1975 * The responses MUST be in the same group as the challenge.
1976 */
1977 parent = fr_pair_parent(challenge);
1978 fr_assert(parent != NULL);
1979
1980 /*
1981 * We also require an MS-CHAP-Response.
1982 */
1983 if ((response = fr_pair_find_by_da(&parent->vp_group, NULL, tmpl_attr_tail_da(env_data->chap_response)))) {
1984 mschap_process_response(p_result,
1985 &mschap_version, nthashhash,
1986 inst, request,
1987 auth_ctx,
1988 challenge, response);
1989 if (p_result->rcode != RLM_MODULE_OK) goto finish;
1990 } else if ((response = fr_pair_find_by_da_nested(&parent->vp_group, NULL, tmpl_attr_tail_da(env_data->chap2_response)))) {
1991 mschap_process_v2_response(p_result,
1992 &mschap_version, nthashhash,
1993 inst, request,
1994 auth_ctx,
1995 challenge, response);
1996 if (p_result->rcode != RLM_MODULE_OK) goto finish;
1997 } else { /* Neither CHAPv1 or CHAPv2 response: die */
1998 REDEBUG("control.Auth-Type = %s set for a request that does not contain %s or %s attributes",
1999 auth_ctx->name, env_data->chap_response->name, env_data->chap2_response->name);
2000 p_result->rcode = RLM_MODULE_INVALID;
2001 goto finish;
2002 }
2003
2004 /* now create MPPE attributes */
2005 if (inst->use_mppe) {
2006 fr_pair_t *vp;
2007 uint8_t mppe_sendkey[34];
2008 uint8_t mppe_recvkey[34];
2009
2010 switch (mschap_version) {
2011 case 1:
2012 RDEBUG2("Generating MS-CHAPv1 MPPE keys");
2013 memset(mppe_sendkey, 0, 32);
2014
2015 /*
2016 * According to RFC 2548 we
2017 * should send NT hash. But in
2018 * practice it doesn't work.
2019 * Instead, we should send nthashhash
2020 *
2021 * This is an error in RFC 2548.
2022 */
2023 /*
2024 * do_mschap cares to zero nthashhash if NT hash
2025 * is not available.
2026 */
2027 memcpy(mppe_sendkey + 8, nthashhash, NT_DIGEST_LENGTH);
2028 mppe_add_reply(inst, request, tmpl_attr_tail_da(env_data->chap_mppe_keys), mppe_sendkey, 24); //-V666
2029 break;
2030
2031 case 2:
2032 RDEBUG2("Generating MS-CHAPv2 MPPE keys");
2033 mppe_chap2_gen_keys128(nthashhash, response->vp_octets + 26, mppe_sendkey, mppe_recvkey);
2034
2035 mppe_add_reply(inst, request, tmpl_attr_tail_da(env_data->mppe_recv_key), mppe_recvkey, 16);
2036 mppe_add_reply(inst, request, tmpl_attr_tail_da(env_data->mppe_send_key), mppe_sendkey, 16);
2037 break;
2038
2039 default:
2040 fr_assert(0);
2041 break;
2042 }
2043
2044 MEM(pair_update_reply(&vp, tmpl_attr_tail_da(env_data->mppe_encryption_policy)) >= 0);
2045 vp->vp_uint32 = inst->require_encryption ? 2 : 1;
2046
2047 MEM(pair_update_reply(&vp, tmpl_attr_tail_da(env_data->mppe_encryption_types)) >= 0);
2048 vp->vp_uint32 = inst->require_strong ? 4 : 6;
2049 } /* else we weren't asked to use MPPE */
2050
2051finish:
2052 return UNLANG_ACTION_CALCULATE_RESULT;
2053}
2054
2055#ifdef WITH_TLS
2056/** Decrypt the new cleartext password when handling change password requests
2057 *
2058 */
2059static int mschap_new_pass_decrypt(request_t *request, mschap_auth_ctx_t *auth_ctx)
2060{
2061 EVP_CIPHER_CTX *evp_ctx;
2062 uint8_t nt_pass_decrypted[516], old_nt_hash_expected[NT_DIGEST_LENGTH];
2063 int c, ntlen = sizeof(nt_pass_decrypted);
2064 size_t passlen, i = 0, len = 0;
2065 char *x;
2066 uint8_t *p, *q;
2067 fr_pair_t *new_pass;
2068
2069 MEM(evp_ctx = EVP_CIPHER_CTX_new());
2070
2071 if (unlikely(EVP_EncryptInit_ex(evp_ctx, EVP_rc4(), NULL, auth_ctx->nt_password->vp_octets, NULL) != 1)) {
2072 EVP_CIPHER_CTX_free(evp_ctx);
2073 fr_tls_strerror_printf(NULL);
2074 RPERROR("Failed initialising RC4 ctx");
2075 return -1;
2076 }
2077
2078 if (unlikely(EVP_CIPHER_CTX_set_key_length(evp_ctx, auth_ctx->nt_password->vp_length) != 1)) {
2079 EVP_CIPHER_CTX_free(evp_ctx);
2080 fr_tls_strerror_printf(NULL);
2081 RPERROR("Failed setting key length");
2082 return -1;
2083 }
2084
2085 if (unlikely(EVP_EncryptUpdate(evp_ctx, nt_pass_decrypted, &ntlen, auth_ctx->cpw_ctx->new_nt_encrypted, ntlen) != 1)) {
2086 EVP_CIPHER_CTX_free(evp_ctx);
2087 fr_tls_strerror_printf(NULL);
2088 RPERROR("Failed ingesting new password");
2089 return -1;
2090 }
2091
2092 EVP_CIPHER_CTX_free(evp_ctx);
2093
2094 /*
2095 * pwblock is
2096 * 512-N bytes random pad
2097 * N bytes password as utf-16-le
2098 * 4 bytes - N as big-endian int
2099 */
2100 passlen = nt_pass_decrypted[512];
2101 passlen += nt_pass_decrypted[513] << 8;
2102 if ((nt_pass_decrypted[514] != 0) ||
2103 (nt_pass_decrypted[515] != 0)) {
2104 REDEBUG("Decrypted new password blob claims length > 65536, probably an invalid Password.NT");
2105 return -1;
2106 }
2107
2108 /*
2109 * Sanity check - passlen positive and <= 512 if not, crypto has probably gone wrong
2110 */
2111 if (passlen > 512) {
2112 REDEBUG("Decrypted new password blob claims length %zu > 512, "
2113 "probably an invalid Password.NT", passlen);
2114 return -1;
2115 }
2116
2117 p = nt_pass_decrypted + 512 - passlen;
2118
2119 /*
2120 * The new NT hash - this should be preferred over the
2121 * cleartext password as it avoids unicode hassles.
2122 */
2123 MEM(pair_update_request(&auth_ctx->cpw_ctx->new_hash, attr_ms_chap_new_nt_password) >= 0);
2124 MEM(fr_pair_value_mem_alloc(auth_ctx->cpw_ctx->new_hash, &q, NT_DIGEST_LENGTH, false) == 0);
2125 fr_md4_calc(q, p, passlen);
2126
2127 /*
2128 * Check that nt_password encrypted with new_hash
2129 * matches the old_hash value from the client.
2130 */
2131 smbhash(old_nt_hash_expected, auth_ctx->nt_password->vp_octets, q);
2132 smbhash(old_nt_hash_expected + 8, auth_ctx->nt_password->vp_octets + 8, q + 7);
2133 if (fr_digest_cmp(old_nt_hash_expected, auth_ctx->cpw_ctx->old_nt_hash, NT_DIGEST_LENGTH)!=0) {
2134 REDEBUG("Old NT hash value from client does not match our value");
2135 RHEXDUMP1(old_nt_hash_expected, NT_DIGEST_LENGTH, "expected");
2136 RHEXDUMP1(auth_ctx->cpw_ctx->old_nt_hash, NT_DIGEST_LENGTH, "got");
2137 return -1;
2138 }
2139
2140 /*
2141 * The new cleartext password, which is utf-16 do some unpleasant vileness
2142 * to turn it into utf8 without pulling in libraries like iconv.
2143 *
2144 * First pass: get the length of the converted string.
2145 */
2146 MEM(pair_update_request(&new_pass, attr_ms_chap_new_cleartext_password) >= 0);
2147 new_pass->vp_length = 0;
2148
2149 while (i < passlen) {
2150 c = p[i++];
2151 c += p[i++] << 8;
2152
2153 /*
2154 * Gah. nasty. maybe we should just pull in iconv?
2155 */
2156 if (c <= 0x7f) {
2157 len++;
2158 } else if (c <= 0x7ff) {
2159 len += 2;
2160 } else {
2161 len += 3;
2162 }
2163 }
2164
2165 MEM(fr_pair_value_bstr_alloc(new_pass, &x, len, true) == 0);
2166
2167 /*
2168 * Second pass: convert the characters from UTF-16 to UTF-8.
2169 */
2170 i = 0;
2171 while (i < passlen) {
2172 c = p[i++];
2173 c += p[i++] << 8;
2174
2175 /*
2176 * Gah. nasty. maybe we should just pull in iconv?
2177 */
2178 if (c < 0x7f) {
2179 *x++ = c;
2180
2181 } else if (c < 0x7ff) {
2182 *x++ = 0xc0 + (c >> 6);
2183 *x++ = 0x80 + (c & 0x3f);
2184
2185 } else {
2186 *x++ = 0xe0 + (c >> 12);
2187 *x++ = 0x80 + ((c>>6) & 0x3f);
2188 *x++ = 0x80 + (c & 0x3f);
2189 }
2190 }
2191
2192 *x = '\0';
2193 return 0;
2194}
2195#endif
2196
2197/*
2198 * mod_authenticate() - authenticate user based on given
2199 * attributes and configuration.
2200 * We will try to find out password in configuration
2201 * or in configured passwd file.
2202 * If one is found we will check paraneters given by NAS.
2203 *
2204 * If SMB-Account-Ctrl is not set to ACB_PWNOTREQ we must have
2205 * one of:
2206 * PAP: User-Password or
2207 * MS-CHAP: MS-CHAP-Challenge and MS-CHAP-Response or
2208 * MS-CHAP2: MS-CHAP-Challenge and MS-CHAP2-Response
2209 * In case of password mismatch or locked account we MAY return
2210 * MS-CHAP-Error for MS-CHAP or MS-CHAP v2
2211 * If MS-CHAP2 succeeds we MUST return MS-CHAP2-Success
2212 */
2213static unlang_action_t CC_HINT(nonnull) mod_authenticate(unlang_result_t *p_result, module_ctx_t const *mctx, request_t *request)
2214{
2215 rlm_mschap_t const *inst = talloc_get_type_abort_const(mctx->mi->data, rlm_mschap_t);
2216#ifdef WITH_AUTH_WINBIND
2217 rlm_mschap_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_mschap_thread_t);
2218#endif
2219 mschap_auth_call_env_t *env_data = talloc_get_type_abort(mctx->env_data, mschap_auth_call_env_t);
2220 mschap_auth_ctx_t *auth_ctx;
2221
2222 MEM(auth_ctx = talloc_zero(unlang_interpret_frame_talloc_ctx(request), mschap_auth_ctx_t));
2223
2224 /*
2225 * If we have ntlm_auth configured, use it unless told
2226 * otherwise
2227 */
2228 *auth_ctx = (mschap_auth_ctx_t) {
2229 .name = mctx->mi->name,
2230 .inst = inst,
2231 .method = inst->method,
2232 .env_data = env_data,
2233#ifdef WITH_AUTH_WINBIND
2234 .t = t,
2235#endif
2236 };
2237
2238 /*
2239 * If we have an ntlm_auth configuration, then we may
2240 * want to suppress it.
2241 */
2242 if (auth_ctx->method != AUTH_INTERNAL) {
2243 fr_pair_t *vp = fr_pair_find_by_da(&request->control_pairs, NULL, attr_ms_chap_use_ntlm_auth);
2244 if (vp && (vp->vp_uint8 <= AUTH_AUTO)) auth_ctx->method = vp->vp_uint8;
2245 }
2246
2247 /*
2248 * Find the SMB-Account-Ctrl attribute, or the
2249 * SMB-Account-Ctrl-Text attribute.
2250 */
2251 auth_ctx->smb_ctrl = fr_pair_find_by_da(&request->control_pairs, NULL, attr_smb_account_ctrl);
2252 if (!auth_ctx->smb_ctrl) {
2253 fr_pair_t *smb_account_ctrl_text;
2254
2255 smb_account_ctrl_text = fr_pair_find_by_da(&request->control_pairs, NULL, attr_smb_account_ctrl_text);
2256 if (smb_account_ctrl_text) {
2257 MEM(pair_append_control(&auth_ctx->smb_ctrl, attr_smb_account_ctrl) >= 0);
2258 auth_ctx->smb_ctrl->vp_uint32 = pdb_decode_acct_ctrl(smb_account_ctrl_text->vp_strvalue);
2259 }
2260 }
2261
2262 /*
2263 * We're configured to do MS-CHAP authentication.
2264 * and account control information exists. Enforce it.
2265 */
2266 if (auth_ctx->smb_ctrl) {
2267 /*
2268 * Password is not required.
2269 */
2270 if ((auth_ctx->smb_ctrl->vp_uint32 & ACB_PWNOTREQ) != 0) {
2271 RDEBUG2("SMB-Account-Ctrl says no password is required");
2272 RETURN_UNLANG_OK;
2273 }
2274 }
2275
2276 /*
2277 * Look for or create an Password.NT
2278 *
2279 * Password.NT can be NULL here if we didn't find an
2280 * input attribute, and we're calling out to an
2281 * external password store.
2282 */
2283 if (nt_password_find(auth_ctx, &auth_ctx->nt_password, mctx->mi->data, request) < 0) RETURN_UNLANG_FAIL;
2284
2285 /*
2286 * Check to see if this is a change password request, and process
2287 * it accordingly if so.
2288 */
2289 if (env_data->chap2_cpw) auth_ctx->cpw = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
2290 tmpl_attr_tail_da(env_data->chap2_cpw));
2291 if (auth_ctx->cpw) {
2292 /*
2293 * Password change does require the NT password
2294 */
2295 if (!auth_ctx->nt_password) {
2296 REDEBUG("Missing Password.NT - required for change password request");
2297 RETURN_UNLANG_FAIL;
2298 }
2299
2300 if (mschap_cpw_prepare(request, auth_ctx) < 0) RETURN_UNLANG_FAIL;
2301
2302 switch (auth_ctx->method) {
2303 case AUTH_INTERNAL:
2304#ifdef WITH_TLS
2305 if (mschap_new_pass_decrypt(request, auth_ctx) < 0) RETURN_UNLANG_FAIL;
2306
2307 if (unlang_module_yield(request, mod_authenticate_resume, NULL, 0, auth_ctx) == UNLANG_ACTION_FAIL) {
2308 RETURN_UNLANG_FAIL;
2309 }
2310
2311 fr_value_box_list_init(&auth_ctx->cpw_ctx->local_cpw_result);
2312 if (unlang_tmpl_push(auth_ctx, NULL, &auth_ctx->cpw_ctx->local_cpw_result, request,
2313 env_data->local_cpw, NULL, UNLANG_SUB_FRAME) < 0) RETURN_UNLANG_FAIL;
2314 break;
2315#else
2316 REDEBUG("Local MS-CHAPv2 password changes require OpenSSL support");
2317 RETURN_UNLANG_INVALID;
2318#endif
2319
2320 default:
2321 if (!env_data->ntlm_cpw_username) {
2322 REDEBUG("No ntlm_auth username set, passchange will definitely fail!");
2323 RETURN_UNLANG_FAIL;
2324 }
2325
2326 /*
2327 * Run the resumption function where we're done with:
2328 */
2329 if (unlang_module_yield(request, mod_authenticate_resume, NULL, 0, auth_ctx) == UNLANG_ACTION_FAIL) {
2330 RETURN_UNLANG_FAIL;
2331 };
2332
2333 /*
2334 * a) Expanding the domain, if specified
2335 */
2336 if (env_data->ntlm_cpw_domain) {
2337 fr_value_box_list_init(&auth_ctx->cpw_ctx->cpw_domain);
2338 if (unlang_tmpl_push(auth_ctx, NULL, &auth_ctx->cpw_ctx->cpw_domain, request,
2339 env_data->ntlm_cpw_domain, NULL, UNLANG_SUB_FRAME) < 0) RETURN_UNLANG_FAIL;
2340 }
2341
2342 fr_value_box_list_init(&auth_ctx->cpw_ctx->cpw_user);
2343
2344 /*
2345 * b) Expanding the username
2346 */
2347 if (unlang_tmpl_push(auth_ctx, NULL, &auth_ctx->cpw_ctx->cpw_user, request,
2348 env_data->ntlm_cpw_username, NULL, UNLANG_SUB_FRAME) < 0) RETURN_UNLANG_FAIL;
2349 break;
2350 }
2351
2352 return UNLANG_ACTION_PUSHED_CHILD;
2353 }
2354
2355 /*
2356 * Not doing password change, just jump straight to the resumption function...
2357 */
2358 {
2359 module_ctx_t our_mctx = *mctx;
2360 our_mctx.rctx = auth_ctx;
2361
2362 return mod_authenticate_resume(p_result, &our_mctx, request);
2363 }
2364}
2365
2366/*
2367 * Create instance for our module. Allocate space for
2368 * instance structure and read configuration parameters
2369 */
2370static int mod_instantiate(module_inst_ctx_t const *mctx)
2371{
2372 rlm_mschap_t *inst = talloc_get_type_abort(mctx->mi->data, rlm_mschap_t);
2373 CONF_SECTION *conf = mctx->mi->conf;
2374
2375 inst->auth_type = fr_dict_enum_by_name(attr_auth_type, mctx->mi->name, -1);
2376 if (!inst->auth_type) {
2377 WARN("Failed to find 'authenticate %s {...}' section. MS-CHAP authentication will likely not work",
2378 mctx->mi->name);
2379 }
2380
2381 /*
2382 * Set auth method
2383 */
2384 inst->method = AUTH_INTERNAL;
2385
2386 if (inst->wb_username) {
2387#ifdef WITH_AUTH_WINBIND
2388 inst->method = AUTH_WBCLIENT;
2389#else
2390 cf_log_err(conf, "'winbind' auth not enabled at compiled time");
2391 return -1;
2392#endif
2393 }
2394
2395 /* preserve existing behaviour: this option overrides all */
2396 if (inst->ntlm_auth) {
2397 inst->method = AUTH_NTLMAUTH_EXEC;
2398 }
2399
2400 switch (inst->method) {
2401 case AUTH_INTERNAL:
2402 DEBUG("Using internal authentication");
2403 break;
2404 case AUTH_AUTO:
2405 DEBUG("Using auto password or ntlm_auth");
2406 break;
2407 case AUTH_NTLMAUTH_EXEC:
2408 DEBUG("Authenticating by calling 'ntlm_auth'");
2409 break;
2410#ifdef WITH_AUTH_WINBIND
2411 case AUTH_WBCLIENT:
2412 DEBUG("Authenticating directly to winbind");
2413 break;
2414#endif
2415 }
2416
2417 /*
2418 * Check ntlm_auth_timeout is sane
2419 */
2420 if (!fr_time_delta_ispos(inst->ntlm_auth_timeout)) {
2421 inst->ntlm_auth_timeout = fr_time_delta_from_sec(EXEC_TIMEOUT);
2422 }
2423 if (fr_time_delta_lt(inst->ntlm_auth_timeout, fr_time_delta_from_sec(1))) {
2424 cf_log_err(conf, "ntml_auth_timeout '%pVs' is too small (minimum: 1s)",
2425 fr_box_time_delta(inst->ntlm_auth_timeout));
2426 return -1;
2427 }
2428 if (fr_time_delta_gt(inst->ntlm_auth_timeout, fr_time_delta_from_sec(10))) {
2429 cf_log_err(conf, "ntlm_auth_timeout '%pVs' is too large (maximum: 10s)",
2430 fr_box_time_delta(inst->ntlm_auth_timeout));
2431 return -1;
2432 }
2433
2434#define CHECK_OPTION(_option) cp = cf_pair_find(attrs, STRINGIFY(_option)); \
2435if (!cp) { \
2436 WARN("Missing option \"" STRINGIFY(_option) "\", setting use_mppe to \"no\""); \
2437 inst->use_mppe = false; \
2438 goto done_mppe_check; \
2439}
2440
2441 /*
2442 * Check that MPPE attributes are in the module config, if the option is enabled.
2443 * Validity of them will be checked when the module is compiled.
2444 */
2445 if (inst->use_mppe) {
2446 CONF_SECTION *attrs = cf_section_find(conf, "attributes", NULL);
2447 CONF_PAIR *cp;
2448
2449 if (!attrs) {
2450 cf_log_err(conf, "Missing required \"attributes\" section");
2451 return -1;
2452 }
2453 CHECK_OPTION(chap_mppe_keys)
2454 CHECK_OPTION(mppe_encryption_policy)
2455 CHECK_OPTION(mppe_recv_key)
2456 CHECK_OPTION(mppe_send_key)
2457 CHECK_OPTION(mppe_encryption_types)
2458 }
2459done_mppe_check:
2460
2461 return 0;
2462}
2463
2464static int mod_bootstrap(module_inst_ctx_t const *mctx)
2465{
2466 xlat_t *xlat;
2467
2468 xlat = module_rlm_xlat_register(mctx->mi->boot, mctx, NULL, mschap_xlat, FR_TYPE_VOID);
2469 xlat_func_args_set(xlat, mschap_xlat_args);
2470 xlat_func_call_env_set(xlat, &mschap_xlat_method_env);
2471
2472 return 0;
2473}
2474
2475#ifdef WITH_AUTH_WINBIND
2476static int mod_thread_instantiate(module_thread_inst_ctx_t const *mctx)
2477{
2478 rlm_mschap_t const *inst = talloc_get_type_abort(mctx->mi->data, rlm_mschap_t);
2479 rlm_mschap_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_mschap_thread_t);
2480
2481 t->inst = inst;
2482 if (!(t->slab = mschap_slab_list_alloc(t, mctx->el, &inst->reuse, winbind_ctx_alloc, NULL, NULL, false, false))) {
2483 ERROR("Connection handle pool instantiation failed");
2484 return -1;
2485 }
2486
2487 return 0;
2488}
2489
2490static int mod_thread_detach(module_thread_inst_ctx_t const *mctx)
2491{
2492 rlm_mschap_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_mschap_thread_t);
2493 talloc_free(t->slab);
2494 return 0;
2495}
2496#endif
2497
2498extern module_rlm_t rlm_mschap;
2499module_rlm_t rlm_mschap = {
2500 .common = {
2501 .magic = MODULE_MAGIC_INIT,
2502 .name = "mschap",
2503 .inst_size = sizeof(rlm_mschap_t),
2504 .config = module_config,
2505 .bootstrap = mod_bootstrap,
2506 .instantiate = mod_instantiate,
2507#ifdef WITH_AUTH_WINBIND
2508 .thread_inst_size = sizeof(rlm_mschap_thread_t),
2509 .thread_instantiate = mod_thread_instantiate,
2510 .thread_detach = mod_thread_detach
2511#endif
2512 },
2513 .method_group = {
2514 .bindings = (module_method_binding_t[]){
2515 { .section = SECTION_NAME("authenticate", CF_IDENT_ANY), .method = mod_authenticate, .method_env = &mschap_auth_method_env },
2516 { .section = SECTION_NAME("recv", CF_IDENT_ANY), .method = mod_authorize, .method_env = &mschap_autz_method_env },
2517 MODULE_BINDING_TERMINATOR
2518 }
2519 }
2520};
unlang_action_t
unlang_action_t
Returned by unlang_op_t calls, determine the next action of the interpreter.
Definition action.h:35
UNLANG_ACTION_PUSHED_CHILD
@ UNLANG_ACTION_PUSHED_CHILD
unlang_t pushed a new child onto the stack, execute it instead of continuing.
Definition action.h:39
UNLANG_ACTION_FAIL
@ UNLANG_ACTION_FAIL
Encountered an unexpected error.
Definition action.h:36
UNLANG_ACTION_CALCULATE_RESULT
@ UNLANG_ACTION_CALCULATE_RESULT
Calculate a new section rlm_rcode_t value.
Definition action.h:37
buffer
static int const char char buffer[256]
Definition acutest.h:576
do_auth_wbclient
int do_auth_wbclient(rlm_mschap_t const *inst, request_t *request, uint8_t const *challenge, uint8_t const *response, uint8_t nthashhash[NT_DIGEST_LENGTH], mschap_auth_ctx_t *auth_ctx)
Check NTLM authentication direct to winbind via Samba's libwbclient library.
Definition auth_wbclient.c:93
auth_wbclient.h
fr_base16_encode
#define fr_base16_encode(_out, _in)
Definition base16.h:54
fr_base16_decode
#define fr_base16_decode(_err, _out, _in, _no_trailing)
Definition base16.h:92
USES_APPLE_DEPRECATED_API
#define USES_APPLE_DEPRECATED_API
Definition build.h:493
RCSID
#define RCSID(id)
Definition build.h:506
unlikely
#define unlikely(_x)
Definition build.h:402
UNUSED
#define UNUSED
Definition build.h:336
NUM_ELEMENTS
#define NUM_ELEMENTS(_t)
Definition build.h:358
CALL_ENV_TERMINATOR
#define CALL_ENV_TERMINATOR
Definition call_env.h:236
FR_CALL_ENV_METHOD_OUT
#define FR_CALL_ENV_METHOD_OUT(_inst)
Helper macro for populating the size/type fields of a call_env_method_t from the output structure typ...
Definition call_env.h:240
call_env_method_s::env
call_env_parser_t const * env
Parsing rules for call method env.
Definition call_env.h:247
FR_CALL_ENV_SUBSECTION
#define FR_CALL_ENV_SUBSECTION(_name, _name2, _flags, _subcs)
Specify a call_env_parser_t which defines a nested subsection.
Definition call_env.h:402
CALL_ENV_FLAG_SUBSECTION
@ CALL_ENV_FLAG_SUBSECTION
This is a subsection.
Definition call_env.h:87
CALL_ENV_FLAG_ATTRIBUTE
@ CALL_ENV_FLAG_ATTRIBUTE
Tmpl MUST contain an attribute reference.
Definition call_env.h:86
CALL_ENV_FLAG_NONE
@ CALL_ENV_FLAG_NONE
Definition call_env.h:74
CALL_ENV_FLAG_REQUIRED
@ CALL_ENV_FLAG_REQUIRED
Associated conf pair or section is required.
Definition call_env.h:75
CALL_ENV_FLAG_NULLABLE
@ CALL_ENV_FLAG_NULLABLE
Tmpl expansions are allowed to produce no output.
Definition call_env.h:80
FR_CALL_ENV_OFFSET
#define FR_CALL_ENV_OFFSET(_name, _cast_type, _flags, _struct, _field)
Specify a call_env_parser_t which writes out runtime results to the specified field.
Definition call_env.h:340
FR_CALL_ENV_PARSE_ONLY_OFFSET
#define FR_CALL_ENV_PARSE_ONLY_OFFSET(_name, _cast_type, _flags, _struct, _parse_field)
Specify a call_env_parser_t which writes out the result of the parsing phase to the field specified.
Definition call_env.h:389
call_env_method_s
Definition call_env.h:244
call_env_parser_s
Per method call config.
Definition call_env.h:180
CONF_PARSER_TERMINATOR
#define CONF_PARSER_TERMINATOR
Definition cf_parse.h:657
FR_CONF_DEPRECATED
#define FR_CONF_DEPRECATED(_name, _struct, _field)
conf_parser_t entry which raises an error if a matching CONF_PAIR is found
Definition cf_parse.h:409
FR_CONF_OFFSET
#define FR_CONF_OFFSET(_name, _struct, _field)
conf_parser_t which parses a single CONF_PAIR, writing the result to a field in a struct
Definition cf_parse.h:280
FR_CONF_POINTER
#define FR_CONF_POINTER(_name, _type, _flags, _res_p)
conf_parser_t which parses a single CONF_PAIR producing a single global result
Definition cf_parse.h:334
FR_CONF_OFFSET_FLAGS
#define FR_CONF_OFFSET_FLAGS(_name, _flags, _struct, _field)
conf_parser_t which parses a single CONF_PAIR, writing the result to a field in a struct
Definition cf_parse.h:268
FR_CONF_OFFSET_SUBSECTION
#define FR_CONF_OFFSET_SUBSECTION(_name, _flags, _struct, _field, _subcs)
conf_parser_t which populates a sub-struct using a CONF_SECTION
Definition cf_parse.h:309
CONF_FLAG_XLAT
@ CONF_FLAG_XLAT
string will be dynamically expanded.
Definition cf_parse.h:443
CONF_FLAG_SUBSECTION
@ CONF_FLAG_SUBSECTION
Instead of putting the information into a configuration structure, the configuration file routines MA...
Definition cf_parse.h:423
conf_parser_s
Defines a CONF_PAIR to C data type mapping.
Definition cf_parse.h:594
cf_pair
Configuration AVP similar to a fr_pair_t.
Definition cf_priv.h:72
cf_section
A section grouping multiple CONF_PAIR.
Definition cf_priv.h:101
cf_section_find
CONF_SECTION * cf_section_find(CONF_SECTION const *cs, char const *name1, char const *name2)
Find a CONF_SECTION with name1 and optionally name2.
Definition cf_util.c:1027
cf_log_err
#define cf_log_err(_cf, _fmt,...)
Definition cf_util.h:285
CF_IDENT_ANY
#define CF_IDENT_ANY
Definition cf_util.h:75
FR_DBUFF_TMP
#define FR_DBUFF_TMP(_start, _len_or_end)
Creates a compound literal to pass into functions which accept a dbuff.
Definition dbuff.h:522
fr_dcursor_append
static int fr_dcursor_append(fr_dcursor_t *cursor, void *v)
Insert a single item at the end of the list.
Definition dcursor.h:406
fr_dcursor_s
Definition dcursor.h:91
MEM
#define MEM(x)
Definition debug.h:46
ERROR
#define ERROR(fmt,...)
Definition dhcpclient.c:40
DEBUG
#define DEBUG(fmt,...)
Definition dhcpclient.c:38
fr_dict_attr_autoload_t::out
fr_dict_attr_t const ** out
Where to write a pointer to the resolved fr_dict_attr_t.
Definition dict.h:292
fr_dict_autoload_t::out
fr_dict_t const ** out
Where to write a pointer to the loaded/resolved fr_dict_t.
Definition dict.h:305
DICT_AUTOLOAD_TERMINATOR
#define DICT_AUTOLOAD_TERMINATOR
Definition dict.h:311
fr_dict_enum_by_name
fr_dict_enum_value_t const * fr_dict_enum_by_name(fr_dict_attr_t const *da, char const *name, ssize_t len)
Definition dict_util.c:3701
in
static fr_slen_t in
Definition dict.h:882
fr_dict_attr_autoload_t
Specifies an attribute which must be present for the module to function.
Definition dict.h:291
fr_dict_autoload_t
Specifies a dictionary which must be loaded/loadable for the module to function.
Definition dict.h:304
value
Test enumeration values.
Definition dict_test.h:92
MODULE_MAGIC_INIT
#define MODULE_MAGIC_INIT
Stop people using different module/library/server versions together.
Definition dl_module.h:63
EXEC_TIMEOUT
#define EXEC_TIMEOUT
Default wait time for exec calls (in seconds).
Definition exec.h:32
radius_exec_program_legacy
int radius_exec_program_legacy(char *out, size_t outlen, request_t *request, char const *cmd, fr_pair_list_t *input_pairs, bool exec_wait, bool shell_escape, fr_time_delta_t timeout)
Execute a program.
Definition exec_legacy.c:474
radius_start_program_legacy
pid_t radius_start_program_legacy(int *stdin_fd, int *stdout_fd, int *stderr_fd, char const *cmd, request_t *request, bool exec_wait, fr_pair_list_t *input_pairs, bool shell_escape)
Start a process.
Definition exec_legacy.c:227
radius_readfrom_program_legacy
int radius_readfrom_program_legacy(int fd, pid_t pid, fr_time_delta_t timeout, char *answer, int left)
Read from the child process.
Definition exec_legacy.c:357
mschap_xlat
static xlat_action_t mschap_xlat(TALLOC_CTX *ctx, fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *in)
Get data from MSCHAP attributes.
Definition rlm_mschap.c:365
talloc_free
talloc_free(hp)
unlang_interpret_frame_talloc_ctx
TALLOC_CTX * unlang_interpret_frame_talloc_ctx(request_t *request)
Get a talloc_ctx which is valid only for this frame.
Definition interpret.c:1681
UNLANG_SUB_FRAME
#define UNLANG_SUB_FRAME
Definition interpret.h:37
unlang_result_t::rcode
rlm_rcode_t rcode
The current rcode, from executing the instruction or merging the result from a frame.
Definition interpret.h:134
unlang_result_t
Definition interpret.h:133
REXDENT
#define REXDENT()
Exdent (unindent) R* messages by one level.
Definition log.h:455
RHEXDUMP1
#define RHEXDUMP1(_data, _len, _fmt,...)
Definition log.h:715
RWDEBUG
#define RWDEBUG(fmt,...)
Definition log.h:373
RDEBUG_ENABLED3
#define RDEBUG_ENABLED3
True if request debug level 1-3 messages are enabled.
Definition log.h:347
RDEBUG3
#define RDEBUG3(fmt,...)
Definition log.h:355
RWDEBUG2
#define RWDEBUG2(fmt,...)
Definition log.h:374
RERROR
#define RERROR(fmt,...)
Definition log.h:310
RPERROR
#define RPERROR(fmt,...)
Definition log.h:314
REDEBUG2
#define REDEBUG2(fmt,...)
Definition log.h:384
RINDENT
#define RINDENT()
Indent R* messages by one level.
Definition log.h:442
fr_md4_calc
void fr_md4_calc(uint8_t out[static MD4_DIGEST_LENGTH], uint8_t const *in, size_t inlen)
Calculate the MD4 hash of the contents of a buffer.
Definition md4.c:473
MD4_DIGEST_LENGTH
#define MD4_DIGEST_LENGTH
Definition md4.h:22
FR_TYPE_STRING
@ FR_TYPE_STRING
String of printable characters.
Definition merged_model.c:83
FR_TYPE_UINT8
@ FR_TYPE_UINT8
8 Bit unsigned integer.
Definition merged_model.c:97
FR_TYPE_UINT32
@ FR_TYPE_UINT32
32 Bit unsigned integer.
Definition merged_model.c:99
FR_TYPE_VOID
@ FR_TYPE_VOID
User data.
Definition merged_model.c:127
FR_TYPE_OCTETS
@ FR_TYPE_OCTETS
Raw octets.
Definition merged_model.c:84
ssize_t
long int ssize_t
Definition merged_model.c:24
uint8_t
unsigned char uint8_t
Definition merged_model.c:30
fr_dict_attr_t
Definition merged_model.c:133
fr_dict_t
Definition merged_model.c:198
fr_value_box_t
Definition merged_model.c:136
request_t
Definition merged_model.c:210
tmpl_t
Definition merged_model.c:225
fr_digest_cmp
int fr_digest_cmp(uint8_t const *a, uint8_t const *b, size_t length)
Do a comparison of two authentication digests by comparing the FULL data.
Definition misc.c:504
strncasecmp
int strncasecmp(char *s1, char *s2, int n)
Definition missing.c:35
strsep
char * strsep(char **stringp, char const *delim)
Definition missing.c:122
strcasecmp
int strcasecmp(char *s1, char *s2)
Definition missing.c:65
module_ctx_t::env_data
void * env_data
Per call environment data.
Definition module_ctx.h:44
module_ctx_t::mi
module_instance_t const * mi
Instance of the module being instantiated.
Definition module_ctx.h:42
module_ctx_t::thread
void * thread
Thread specific instance data.
Definition module_ctx.h:43
module_ctx_t::rctx
void * rctx
Resume ctx that a module previously set.
Definition module_ctx.h:45
module_thread_inst_ctx_t::el
fr_event_list_t * el
Event list to register any IO handlers and timers against.
Definition module_ctx.h:68
module_thread_inst_ctx_t::thread
void * thread
Thread instance data.
Definition module_ctx.h:67
module_thread_inst_ctx_t::mi
module_instance_t const * mi
Instance of the module being instantiated.
Definition module_ctx.h:64
module_inst_ctx_t::mi
module_instance_t * mi
Instance of the module being instantiated.
Definition module_ctx.h:51
module_ctx_t
Temporary structure to hold arguments for module calls.
Definition module_ctx.h:41
module_inst_ctx_t
Temporary structure to hold arguments for instantiation calls.
Definition module_ctx.h:50
module_thread_inst_ctx_t
Temporary structure to hold arguments for thread_instantiation calls.
Definition module_ctx.h:63
module_rlm_xlat_register
xlat_t * module_rlm_xlat_register(TALLOC_CTX *ctx, module_inst_ctx_t const *mctx, char const *name, xlat_func_t func, fr_type_t return_type)
Definition module_rlm.c:247
module_rlm_section_type_set
bool module_rlm_section_type_set(request_t *request, fr_dict_attr_t const *type_da, fr_dict_enum_value_t const *enumv)
Set the next section type if it's not already set.
Definition module_rlm.c:418
module_rlm_s::common
module_t common
Common fields presented by all modules.
Definition module_rlm.h:39
module_rlm_s
Definition module_rlm.h:38
mschap_nt_password_hash
int mschap_nt_password_hash(uint8_t out[static NT_DIGEST_LENGTH], char const *password)
Converts Unicode password to 16-byte NT hash with MD4.
Definition mschap.c:52
mschap_add_reply
void mschap_add_reply(request_t *request, uint8_t ident, fr_dict_attr_t const *da, char const *value, size_t len)
Definition mschap.c:162
mschap_auth_response
void mschap_auth_response(char const *username, size_t username_len, uint8_t const *nt_hash_hash, uint8_t const *ntresponse, uint8_t const *peer_challenge, uint8_t const *auth_challenge, char *response)
Definition mschap.c:101
mschap_challenge_hash
void mschap_challenge_hash(uint8_t challenge[static MSCHAP_CHALLENGE_LENGTH], uint8_t const peer_challenge[static MSCHAP_PEER_CHALLENGE_LENGTH], uint8_t const auth_challenge[static MSCHAP_PEER_AUTHENTICATOR_CHALLENGE_LENGTH], char const *user_name, size_t user_name_len)
Definition mschap.c:72
LM_DIGEST_LENGTH
#define LM_DIGEST_LENGTH
Definition mschap.h:8
NT_DIGEST_LENGTH
#define NT_DIGEST_LENGTH
Definition mschap.h:7
fr_pair_value_memdup
int fr_pair_value_memdup(fr_pair_t *vp, uint8_t const *src, size_t len, bool tainted)
Copy data into an "octets" data type.
Definition pair.c:2962
fr_pair_find_by_da_nested
fr_pair_t * fr_pair_find_by_da_nested(fr_pair_list_t const *list, fr_pair_t const *prev, fr_dict_attr_t const *da)
Find a pair with a matching fr_dict_attr_t, by walking the nested fr_dict_attr_t tree.
Definition pair.c:784
fr_pair_find_by_da
fr_pair_t * fr_pair_find_by_da(fr_pair_list_t const *list, fr_pair_t const *prev, fr_dict_attr_t const *da)
Find the first pair with a matching da.
Definition pair.c:707
fr_pair_parent
fr_pair_t * fr_pair_parent(fr_pair_t const *vp)
Return a pointer to the parent pair.
Definition pair.c:956
fr_pair_afrom_da
fr_pair_t * fr_pair_afrom_da(TALLOC_CTX *ctx, fr_dict_attr_t const *da)
Dynamically allocate a new attribute and assign a fr_dict_attr_t.
Definition pair.c:290
fr_pair_value_bstr_alloc
int fr_pair_value_bstr_alloc(fr_pair_t *vp, char **out, size_t size, bool tainted)
Pre-allocate a memory buffer for a "string" type value pair.
Definition pair.c:2759
fr_pair_value_mem_alloc
int fr_pair_value_mem_alloc(fr_pair_t *vp, uint8_t **out, size_t size, bool tainted)
Pre-allocate a memory buffer for a "octets" type value pair.
Definition pair.c:2911
normify
static ssize_t normify(normalise_t *action, uint8_t *buffer, size_t bufflen, char const *known_good, size_t len, size_t min_len)
Definition password.c:429
password_find
fr_pair_t * password_find(bool *ephemeral, TALLOC_CTX *ctx, request_t *request, fr_dict_attr_t const *allowed_attrs[], size_t allowed_attrs_len, bool normify)
Find a "known good" password in the control list of a request.
Definition password.c:994
config
static const conf_parser_t config[]
Definition base.c:163
fr_assert
#define fr_assert(_expr)
Definition rad_assert.h:37
attr_user_name
static fr_dict_attr_t const * attr_user_name
Definition radclient-ng.c:127
pair_update_request
#define pair_update_request(_attr, _da)
Definition radclient-ng.c:59
REDEBUG
#define REDEBUG(fmt,...)
Definition radclient-ng.h:52
RDEBUG2
#define RDEBUG2(fmt,...)
Definition radclient-ng.h:54
WARN
#define WARN(fmt,...)
Definition radclient-ng.h:47
done
static bool done
Definition radclient.c:80
conf
static rs_t * conf
Definition radsniff.c:52
fr_rand
uint32_t fr_rand(void)
Return a 32-bit random number.
Definition rand.c:104
RETURN_UNLANG_INVALID
#define RETURN_UNLANG_INVALID
Definition rcode.h:66
RETURN_UNLANG_RCODE
#define RETURN_UNLANG_RCODE(_rcode)
Definition rcode.h:61
RETURN_UNLANG_FAIL
#define RETURN_UNLANG_FAIL
Definition rcode.h:63
RETURN_UNLANG_REJECT
#define RETURN_UNLANG_REJECT
Definition rcode.h:62
RETURN_UNLANG_OK
#define RETURN_UNLANG_OK
Definition rcode.h:64
rlm_rcode_t
rlm_rcode_t
Return codes indicating the result of the module call.
Definition rcode.h:44
RLM_MODULE_INVALID
@ RLM_MODULE_INVALID
The module considers the request invalid.
Definition rcode.h:51
RLM_MODULE_OK
@ RLM_MODULE_OK
The module is OK, continue.
Definition rcode.h:49
RLM_MODULE_DISALLOW
@ RLM_MODULE_DISALLOW
Reject the request (user is locked out).
Definition rcode.h:52
RLM_MODULE_REJECT
@ RLM_MODULE_REJECT
Immediately reject the request.
Definition rcode.h:47
RLM_MODULE_NOTFOUND
@ RLM_MODULE_NOTFOUND
User not found.
Definition rcode.h:53
RLM_MODULE_NOOP
@ RLM_MODULE_NOOP
Module succeeded without doing anything.
Definition rcode.h:54
RETURN_UNLANG_NOOP
#define RETURN_UNLANG_NOOP
Definition rcode.h:69
mod_thread_instantiate
static int mod_thread_instantiate(module_thread_inst_ctx_t const *mctx)
Definition rlm_cache_memcached.c:325
mod_thread_detach
static int mod_thread_detach(module_thread_inst_ctx_t const *mctx)
Definition rlm_cache_memcached.c:340
SHSpad2
static const uint8_t SHSpad2[40]
Definition rlm_mschap.c:1241
attr_smb_account_ctrl
fr_dict_attr_t const * attr_smb_account_ctrl
Definition rlm_mschap.c:240
mschap_xlat_call_env_t::username
tmpl_t const * username
Definition rlm_mschap.c:155
CHECK_OPTION
#define CHECK_OPTION(_option)
mschap_process_response
static unlang_action_t mschap_process_response(unlang_result_t *p_result, int *mschap_version, uint8_t nthashhash[static NT_DIGEST_LENGTH], rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx, fr_pair_t *challenge, fr_pair_t *response)
Definition rlm_mschap.c:1709
xlat_call_env
static const call_env_parser_t xlat_call_env[]
Definition rlm_mschap.c:161
mppe_chap2_get_keys128
static void mppe_chap2_get_keys128(uint8_t const *nt_hashhash, uint8_t const *nt_response, uint8_t *sendkey, uint8_t *recvkey)
Definition rlm_mschap.c:1317
mppe_add_reply
static void mppe_add_reply(UNUSED rlm_mschap_t const *inst, request_t *request, fr_dict_attr_t const *da, uint8_t const *value, size_t len)
Definition rlm_mschap.c:796
attr_nt_password
fr_dict_attr_t const * attr_nt_password
Definition rlm_mschap.c:238
attr_ms_chap_new_cleartext_password
fr_dict_attr_t const * attr_ms_chap_new_cleartext_password
Definition rlm_mschap.c:233
rlm_mschap_dict
fr_dict_autoload_t rlm_mschap_dict[]
Definition rlm_mschap.c:224
ACB_MNS
#define ACB_MNS
MNS logon user account.
Definition rlm_mschap.c:71
auth_call_env
static const call_env_parser_t auth_call_env[]
Definition rlm_mschap.c:169
mschap_xlat_call_env_t::chap_response
tmpl_t const * chap_response
Definition rlm_mschap.c:157
mschap_process_v2_response
static unlang_action_t mschap_process_v2_response(unlang_result_t *p_result, int *mschap_version, uint8_t nthashhash[static NT_DIGEST_LENGTH], rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx, fr_pair_t *challenge, fr_pair_t *response)
Definition rlm_mschap.c:1761
mschap_autz_call_env_t::chap2_cpw
tmpl_t const * chap2_cpw
Definition rlm_mschap.c:209
attr_eap_identity
fr_dict_attr_t const * attr_eap_identity
Definition rlm_mschap.c:232
mschap_autz_call_env_t::chap2_response
tmpl_t const * chap2_response
Definition rlm_mschap.c:208
mschap_error
static unlang_action_t mschap_error(unlang_result_t *p_result, rlm_mschap_t const *inst, request_t *request, unsigned char ident, int mschap_result, int mschap_version, fr_pair_t *smb_ctrl, mschap_auth_call_env_t *env_data)
Definition rlm_mschap.c:1390
ACB_AUTOLOCK
#define ACB_AUTOLOCK
Account auto locked.
Definition rlm_mschap.c:76
MSCHAP_CALL_ENV
#define MSCHAP_CALL_ENV(_x)
Definition rlm_mschap.c:134
attr_smb_account_ctrl_text
fr_dict_attr_t const * attr_smb_account_ctrl_text
Definition rlm_mschap.c:239
mod_authenticate_resume
static unlang_action_t mod_authenticate_resume(unlang_result_t *p_result, module_ctx_t const *mctx, request_t *request)
Complete mschap authentication after any tmpls have been expanded.
Definition rlm_mschap.c:1910
autz_call_env
static const call_env_parser_t autz_call_env[]
Definition rlm_mschap.c:212
ACB_TEMPDUP
#define ACB_TEMPDUP
Temporary duplicate account.
Definition rlm_mschap.c:69
pdb_decode_acct_ctrl
static int pdb_decode_acct_ctrl(char const *p)
Definition rlm_mschap.c:274
dict_freeradius
static fr_dict_t const * dict_freeradius
Definition rlm_mschap.c:220
mppe_GetMasterKey
static void mppe_GetMasterKey(uint8_t const *nt_hashhash, uint8_t const *nt_response, uint8_t *masterkey)
Definition rlm_mschap.c:1275
mschap_auth_method_env
static const call_env_method_t mschap_auth_method_env
Definition rlm_mschap.c:184
nt_password_find
static int nt_password_find(TALLOC_CTX *ctx, fr_pair_t **out, rlm_mschap_t const *inst, request_t *request)
Find a Password.NT value, or create one from a Password.Cleartext, or Password.With-Header attribute.
Definition rlm_mschap.c:1488
ACB_FR_EXPIRED
#define ACB_FR_EXPIRED
Password Expired.
Definition rlm_mschap.c:77
ACB_DISABLED
#define ACB_DISABLED
User account disabled.
Definition rlm_mschap.c:66
mschap_process_cpw_request
static unlang_action_t mschap_process_cpw_request(unlang_result_t *p_result, rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx)
Definition rlm_mschap.c:1576
dict_radius
static fr_dict_t const * dict_radius
Definition rlm_mschap.c:221
magic1
static const uint8_t magic1[27]
Definition rlm_mschap.c:1247
mod_bootstrap
static int mod_bootstrap(module_inst_ctx_t const *mctx)
Definition rlm_mschap.c:2464
SHSpad1
static const uint8_t SHSpad1[40]
Definition rlm_mschap.c:1235
attr_auth_type
fr_dict_attr_t const * attr_auth_type
Definition rlm_mschap.c:230
attr_ms_chap_user_name
fr_dict_attr_t const * attr_ms_chap_user_name
Definition rlm_mschap.c:237
mschap_autz_call_env_t::chap_response
tmpl_t const * chap_response
Definition rlm_mschap.c:207
mod_authorize
static unlang_action_t mod_authorize(unlang_result_t *p_result, module_ctx_t const *mctx, request_t *request)
Definition rlm_mschap.c:1355
mppe_GetAsymmetricStartKey
static void mppe_GetAsymmetricStartKey(uint8_t *masterkey, uint8_t *sesskey, int keylen, int issend)
Definition rlm_mschap.c:1291
mschap_xlat_args
static xlat_arg_parser_t const mschap_xlat_args[]
Definition rlm_mschap.c:352
attr_ms_chap_use_ntlm_auth
fr_dict_attr_t const * attr_ms_chap_use_ntlm_auth
Definition rlm_mschap.c:236
ACB_HOMDIRREQ
#define ACB_HOMDIRREQ
Home directory required.
Definition rlm_mschap.c:67
mschap_xlat_call_env_t::chap2_response
tmpl_t const * chap2_response
Definition rlm_mschap.c:158
rlm_mschap
module_rlm_t rlm_mschap
Definition rlm_mschap.c:2499
write_all
static int write_all(int fd, char const *buf, size_t len)
Definition rlm_mschap.c:811
attr_cleartext_password
fr_dict_attr_t const * attr_cleartext_password
Definition rlm_mschap.c:231
rlm_mschap_dict_attr
fr_dict_attr_autoload_t rlm_mschap_dict_attr[]
Definition rlm_mschap.c:243
mod_authenticate
static unlang_action_t mod_authenticate(unlang_result_t *p_result, module_ctx_t const *mctx, request_t *request)
Definition rlm_mschap.c:2213
magic3
static const uint8_t magic3[84]
Definition rlm_mschap.c:1263
do_mschap_cpw
static int do_mschap_cpw(rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx, uint8_t *new_nt_password, uint8_t *old_nt_hash)
Definition rlm_mschap.c:836
do_mschap
static int do_mschap(rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx, uint8_t const *challenge, uint8_t const *response, uint8_t nthashhash[static NT_DIGEST_LENGTH])
Definition rlm_mschap.c:1048
magic2
static const uint8_t magic2[84]
Definition rlm_mschap.c:1252
ACB_DOMTRUST
#define ACB_DOMTRUST
Interdomain trust account.
Definition rlm_mschap.c:72
ACB_WSTRUST
#define ACB_WSTRUST
Workstation trust account.
Definition rlm_mschap.c:73
mppe_chap2_gen_keys128
static void mppe_chap2_gen_keys128(uint8_t const *nt_hashhash, uint8_t const *response, uint8_t *sendkey, uint8_t *recvkey)
Definition rlm_mschap.c:1331
attr_ms_chap_new_nt_password
fr_dict_attr_t const * attr_ms_chap_new_nt_password
Definition rlm_mschap.c:234
ACB_NORMAL
#define ACB_NORMAL
Normal user account.
Definition rlm_mschap.c:70
mschap_xlat_call_env_t::chap_challenge
tmpl_t const * chap_challenge
Definition rlm_mschap.c:156
ACB_PWNOTREQ
#define ACB_PWNOTREQ
User password not required.
Definition rlm_mschap.c:68
module_config
static const conf_parser_t module_config[]
Definition rlm_mschap.c:100
attr_ms_chap_peer_challenge
fr_dict_attr_t const * attr_ms_chap_peer_challenge
Definition rlm_mschap.c:235
mschap_cpw_prepare
static int mschap_cpw_prepare(request_t *request, mschap_auth_ctx_t *auth_ctx)
Validate data required for change password requests.
Definition rlm_mschap.c:1609
MSCHAP_OPT_CALL_ENV
#define MSCHAP_OPT_CALL_ENV(_opt, _x)
Definition rlm_mschap.c:151
mod_instantiate
static int mod_instantiate(module_inst_ctx_t const *mctx)
Definition rlm_mschap.c:2370
ACB_PWNOEXP
#define ACB_PWNOEXP
User password does not expire.
Definition rlm_mschap.c:75
mschap_identity_find
static fr_pair_t * mschap_identity_find(request_t *request, fr_dict_attr_t const *attr_user_name)
Definition rlm_mschap.c:259
passchange_config
static const conf_parser_t passchange_config[]
Definition rlm_mschap.c:79
mschap_autz_call_env_t::chap_challenge
tmpl_t const * chap_challenge
Definition rlm_mschap.c:206
MSCHAP_COMMON_CALL_ENV
#define MSCHAP_COMMON_CALL_ENV(_x)
Definition rlm_mschap.c:143
ACB_SVRTRUST
#define ACB_SVRTRUST
Server trust account.
Definition rlm_mschap.c:74
winbind_config
static const conf_parser_t winbind_config[]
Definition rlm_mschap.c:91
mschap_autz_call_env_t
Definition rlm_mschap.c:205
mschap_xlat_call_env_t
Definition rlm_mschap.c:154
rlm_mschap.h
mschap_cpw_ctx_t::new_nt_encrypted
uint8_t new_nt_encrypted[516]
Definition rlm_mschap.h:106
mschap_auth_call_env_t::username
tmpl_t const * username
Definition rlm_mschap.h:82
mschap_auth_ctx_t::method
MSCHAP_AUTH_METHOD method
Definition rlm_mschap.h:115
mschap_auth_call_env_t::mppe_encryption_types
tmpl_t const * mppe_encryption_types
Definition rlm_mschap.h:92
mschap_auth_ctx_t::cpw
fr_pair_t * cpw
Definition rlm_mschap.h:118
mschap_auth_ctx_t::name
char const * name
Definition rlm_mschap.h:112
mschap_auth_call_env_t::ntlm_cpw_domain
tmpl_t const * ntlm_cpw_domain
Definition rlm_mschap.h:98
mschap_cpw_ctx_t::new_hash
fr_pair_t * new_hash
Definition rlm_mschap.h:108
mschap_auth_call_env_t::ntlm_cpw_username
tmpl_t const * ntlm_cpw_username
Definition rlm_mschap.h:97
mschap_auth_call_env_t::chap_nt_enc_pw
tmpl_t const * chap_nt_enc_pw
Definition rlm_mschap.h:94
mschap_auth_call_env_t::mppe_send_key
tmpl_t const * mppe_send_key
Definition rlm_mschap.h:91
mschap_auth_ctx_t::inst
rlm_mschap_t const * inst
Definition rlm_mschap.h:113
mschap_cpw_ctx_t::cpw_user
fr_value_box_list_t cpw_user
Definition rlm_mschap.h:103
mschap_auth_call_env_t::chap_response
tmpl_t const * chap_response
Definition rlm_mschap.h:85
mschap_auth_call_env_t::local_cpw
tmpl_t const * local_cpw
Definition rlm_mschap.h:99
mschap_cpw_ctx_t::cpw_domain
fr_value_box_list_t cpw_domain
Definition rlm_mschap.h:104
mschap_auth_ctx_t::smb_ctrl
fr_pair_t * smb_ctrl
Definition rlm_mschap.h:117
mschap_auth_call_env_t::chap_challenge
tmpl_t const * chap_challenge
Definition rlm_mschap.h:84
mschap_auth_call_env_t::chap2_response
tmpl_t const * chap2_response
Definition rlm_mschap.h:86
mschap_cpw_ctx_t::local_cpw_result
fr_value_box_list_t local_cpw_result
Definition rlm_mschap.h:105
mschap_auth_call_env_t::mppe_encryption_policy
tmpl_t const * mppe_encryption_policy
Definition rlm_mschap.h:89
mschap_auth_ctx_t::env_data
mschap_auth_call_env_t * env_data
Definition rlm_mschap.h:114
mschap_auth_call_env_t::mppe_recv_key
tmpl_t const * mppe_recv_key
Definition rlm_mschap.h:90
mschap_auth_call_env_t::chap_error
tmpl_t const * chap_error
Definition rlm_mschap.h:83
mschap_auth_call_env_t::chap2_cpw
tmpl_t const * chap2_cpw
Definition rlm_mschap.h:93
mschap_cpw_ctx_t::old_nt_hash
uint8_t old_nt_hash[NT_DIGEST_LENGTH]
Definition rlm_mschap.h:107
mschap_auth_call_env_t::chap2_success
tmpl_t const * chap2_success
Definition rlm_mschap.h:87
mschap_auth_ctx_t::cpw_ctx
mschap_cpw_ctx_t * cpw_ctx
Definition rlm_mschap.h:119
mschap_auth_ctx_t::nt_password
fr_pair_t * nt_password
Definition rlm_mschap.h:116
AUTH_AUTO
@ AUTH_AUTO
Definition rlm_mschap.h:20
AUTH_INTERNAL
@ AUTH_INTERNAL
Definition rlm_mschap.h:18
AUTH_NTLMAUTH_EXEC
@ AUTH_NTLMAUTH_EXEC
Definition rlm_mschap.h:19
mschap_auth_call_env_t::chap_mppe_keys
tmpl_t const * chap_mppe_keys
Definition rlm_mschap.h:88
mschap_auth_call_env_t
Definition rlm_mschap.h:81
mschap_auth_ctx_t
Definition rlm_mschap.h:111
mschap_cpw_ctx_t
Definition rlm_mschap.h:102
rlm_mschap_t
Definition rlm_mschap.h:41
winbind_ctx_alloc
static int winbind_ctx_alloc(winbind_ctx_t *wbctx, UNUSED void *uctx)
Definition rlm_winbind.c:353
reuse_winbind_config
static conf_parser_t reuse_winbind_config[]
Definition rlm_winbind.c:44
_mod_ctx_free
static int _mod_ctx_free(winbind_ctx_t *wbctx)
Definition rlm_winbind.c:344
winbind_ctx_t::ctx
struct wbcContext * ctx
Definition rlm_winbind.h:21
winbind_ctx_t
Definition rlm_winbind.h:20
FR_SBUFF_IN
#define FR_SBUFF_IN(_start, _len_or_end)
FR_SBUFF_OUT
#define FR_SBUFF_OUT(_start, _len_or_end)
SECTION_NAME
#define SECTION_NAME(_name1, _name2)
Define a section name consisting of a verb and a noun.
Definition section.h:39
module_instance_s::name
char const * name
Instance name e.g. user_database.
Definition module.h:357
module_instance_s::conf
CONF_SECTION * conf
Module's instance configuration.
Definition module.h:351
module_s::inst_size
size_t inst_size
Size of the module's instance data.
Definition module.h:212
module_instance_s::data
void * data
Module's instance data.
Definition module.h:293
module_instance_s::boot
void * boot
Data allocated during the boostrap phase.
Definition module.h:296
MODULE_BINDING_TERMINATOR
#define MODULE_BINDING_TERMINATOR
Terminate a module binding list.
Definition module.h:152
module_method_binding_s
Named methods exported by a module.
Definition module.h:174
pair_append_control
#define pair_append_control(_attr, _da)
Allocate and append a fr_pair_t to the control list.
Definition pair.h:57
pair_update_reply
#define pair_update_reply(_attr, _da)
Return or allocate a fr_pair_t in the reply list.
Definition pair.h:129
tmpl_attr_tail_da
static fr_dict_attr_t const * tmpl_attr_tail_da(tmpl_t const *vpt)
Return the last attribute reference da.
Definition tmpl.h:801
fr_sha1_init
void fr_sha1_init(fr_sha1_ctx *context)
Definition sha1.c:93
fr_sha1_final
void fr_sha1_final(uint8_t digest[static SHA1_DIGEST_LENGTH], fr_sha1_ctx *context)
Definition sha1.c:141
fr_sha1_update
void fr_sha1_update(fr_sha1_ctx *context, uint8_t const *in, size_t len)
Definition sha1.c:105
fr_sha1_ctx
Definition sha1.h:33
FR_SLAB_CONFIG_CONF_PARSER
#define FR_SLAB_CONFIG_CONF_PARSER
conf_parser_t entries to populate user configurable slab values
Definition slab.h:35
smbhash
void smbhash(unsigned char *out, unsigned char const *in, unsigned char *key)
Definition smbdes.c:287
smbdes_mschap
void smbdes_mschap(uint8_t const win_password[16], uint8_t const *challenge, uint8_t *response)
Definition smbdes.c:339
smbdes_lmpwdhash
void smbdes_lmpwdhash(char const *password, uint8_t *lmhash)
Definition smbdes.c:319
snprintf
PUBLIC int snprintf(char *string, size_t length, char *format, va_alist)
Definition snprintf.c:689
unlang_module_yield
unlang_action_t unlang_module_yield(request_t *request, module_method_t resume, unlang_module_signal_t signal, fr_signal_t sigmask, void *rctx)
Yield a request back to the interpreter from within a module.
Definition module.c:431
inst
eap_aka_sim_process_conf_t * inst
Definition state_machine.c:3645
vp
fr_pair_t * vp
Definition state_machine.c:2287
value_pair_s
Stores an attribute, a value and various bits of other data.
Definition pair.h:68
value_pair_s::da
fr_dict_attr_t const *_CONST da
Dictionary attribute defines the attribute number, vendor and type of the pair.
Definition pair.h:69
fr_syserror
char const * fr_syserror(int num)
Guaranteed to be thread-safe version of strerror.
Definition syserror.c:243
talloc_get_type_abort_const
#define talloc_get_type_abort_const
Definition talloc.h:110
fr_time_delta_lt
#define fr_time_delta_lt(_a, _b)
Definition time.h:285
fr_time_delta_from_sec
static fr_time_delta_t fr_time_delta_from_sec(int64_t sec)
Definition time.h:590
fr_time_delta_ispos
#define fr_time_delta_ispos(_a)
Definition time.h:290
fr_time_delta_gt
#define fr_time_delta_gt(_a, _b)
Definition time.h:283
unlang_tmpl_push
int unlang_tmpl_push(TALLOC_CTX *ctx, unlang_result_t *p_result, fr_value_box_list_t *out, request_t *request, tmpl_t const *tmpl, unlang_tmpl_args_t *args, bool top_frame)
Push a tmpl onto the stack for evaluation.
Definition tmpl.c:276
T_BARE_WORD
@ T_BARE_WORD
Definition token.h:118
xlat_arg_parser_t::required
unsigned int required
Argument must be present, and non-empty.
Definition xlat.h:146
XLAT_ARG_PARSER_TERMINATOR
#define XLAT_ARG_PARSER_TERMINATOR
Definition xlat.h:170
xlat_action_t
xlat_action_t
Definition xlat.h:37
XLAT_ACTION_FAIL
@ XLAT_ACTION_FAIL
An xlat function failed.
Definition xlat.h:44
XLAT_ACTION_DONE
@ XLAT_ACTION_DONE
We're done evaluating this level of nesting.
Definition xlat.h:43
xlat_arg_parser_t
Definition for a single argument consumed by an xlat function.
Definition xlat.h:145
parent
static fr_slen_t parent
Definition pair.h:858
fr_strerror_printf
#define fr_strerror_printf(_fmt,...)
Log to thread local error buffer.
Definition strerror.h:64
fr_value_box_asprintf
int fr_value_box_asprintf(TALLOC_CTX *ctx, fr_value_box_t *dst, fr_dict_attr_t const *enumv, bool tainted, char const *fmt,...)
Print a formatted string using our internal printf wrapper and assign it to a value box.
Definition value.c:4692
fr_value_box_strdup
int fr_value_box_strdup(TALLOC_CTX *ctx, fr_value_box_t *dst, fr_dict_attr_t const *enumv, char const *src, bool tainted)
Copy a nul terminated string to a fr_value_box_t.
Definition value.c:4604
fr_value_box_memdup
int fr_value_box_memdup(TALLOC_CTX *ctx, fr_value_box_t *dst, fr_dict_attr_t const *enumv, uint8_t const *src, size_t len, bool tainted)
Copy a buffer to a fr_value_box_t.
Definition value.c:5064
data
static fr_slen_t data
Definition value.h:1340
fr_box_strvalue_len
#define fr_box_strvalue_len(_val, _len)
Definition value.h:309
fr_box_time_delta
#define fr_box_time_delta(_val)
Definition value.h:366
nonnull
int nonnull(2, 5))
fr_value_box_alloc_null
#define fr_value_box_alloc_null(_ctx)
Allocate a value box for later use with a value assignment function.
Definition value.h:655
out
static size_t char ** out
Definition value.h:1030
fr_box_octets
#define fr_box_octets(_val, _len)
Definition value.h:311
xlat_ctx_s::env_data
void * env_data
Expanded call env data.
Definition xlat_ctx.h:53
xlat_ctx_s::mctx
module_ctx_t const * mctx
Synthesised module calling ctx.
Definition xlat_ctx.h:52
xlat_ctx_s
An xlat calling ctx.
Definition xlat_ctx.h:49
xlat_func_args_set
int xlat_func_args_set(xlat_t *x, xlat_arg_parser_t const args[])
Register the arguments of an xlat.
Definition xlat_func.c:363
xlat_func_call_env_set
void xlat_func_call_env_set(xlat_t *x, call_env_method_t const *env_method)
Register call environment of an xlat.
Definition xlat_func.c:389
xlat_s
Definition xlat_priv.h:59
Generated by   doxygen 1.9.8