The FreeRADIUS server $Id: 15bac2a4c627c01d1aa2047687b3418955ac7f00 $
Loading...
Searching...
No Matches
rlm_mschap.c
Go to the documentation of this file.
1/*
2 * This program is is free software; you can redistribute it and/or modify
3 * it under the terms of the GNU General Public License as published by
4 * the Free Software Foundation; either version 2 of the License, or (at
5 * your option) any later version.
6 *
7 * This program is distributed in the hope that it will be useful,
8 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10 * GNU General Public License for more details.
11 *
12 * You should have received a copy of the GNU General Public License
13 * along with this program; if not, write to the Free Software
14 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
15 */
16
17/**
18 * $Id: 94a24b1e2329409106d4048f19edc4a838ba9bc5 $
19 * @file rlm_mschap.c
20 * @brief Implemented mschap authentication.
21 *
22 * @copyright 2000, 2001, 2006 The FreeRADIUS server project
23 */
24
25/* MPPE support from Takahiro Wagatsuma <waga@sic.shibaura-it.ac.jp> */
26
27RCSID("$Id: 94a24b1e2329409106d4048f19edc4a838ba9bc5 $")
28
29#define LOG_PREFIX mctx->mi->name
30
31#include <freeradius-devel/server/base.h>
32#include <freeradius-devel/server/exec_legacy.h>
33#include <freeradius-devel/server/module_rlm.h>
34#include <freeradius-devel/server/password.h>
35#include <freeradius-devel/tls/strerror.h>
36#include <freeradius-devel/util/debug.h>
37#include <freeradius-devel/radius/defs.h>
38
39#include <freeradius-devel/util/base16.h>
40#include <freeradius-devel/util/md4.h>
41#include <freeradius-devel/util/md5.h>
42#include <freeradius-devel/util/misc.h>
43#include <freeradius-devel/util/sha1.h>
44
45#include <freeradius-devel/unlang/function.h>
46#include <freeradius-devel/unlang/xlat_func.h>
47
48#include <sys/wait.h>
49
50#include "rlm_mschap.h"
51#include "smbdes.h"
52
53#ifdef WITH_AUTH_WINBIND
54#include "auth_wbclient.h"
55#endif
56
57#ifdef WITH_TLS
58USES_APPLE_DEPRECATED_API /* OpenSSL API has been deprecated by Apple */
59# include <freeradius-devel/tls/openssl_user_macros.h>
60# include <openssl/rc4.h>
61#endif
62
63#ifdef __APPLE__
64unlang_action_t od_mschap_auth(rlm_rcode_t *p_result, request_t *request, fr_pair_t *challenge, fr_pair_t *usernamepair,
65 mschap_auth_call_env_t *env_data);
66#endif
67
68/* Allowable account control bits */
69#define ACB_DISABLED 0x00010000 //!< User account disabled.
70#define ACB_HOMDIRREQ 0x00020000 //!< Home directory required.
71#define ACB_PWNOTREQ 0x00040000 //!< User password not required.
72#define ACB_TEMPDUP 0x00080000 //!< Temporary duplicate account.
73#define ACB_NORMAL 0x00100000 //!< Normal user account.
74#define ACB_MNS 0x00200000 //!< MNS logon user account.
75#define ACB_DOMTRUST 0x00400000 //!< Interdomain trust account.
76#define ACB_WSTRUST 0x00800000 //!< Workstation trust account.
77#define ACB_SVRTRUST 0x01000000 //!< Server trust account.
78#define ACB_PWNOEXP 0x02000000 //!< User password does not expire.
79#define ACB_AUTOLOCK 0x04000000 //!< Account auto locked.
80#define ACB_FR_EXPIRED 0x00020000 //!< Password Expired.
81
86
87#ifdef WITH_AUTH_WINBIND
88static conf_parser_t reuse_winbind_config[] = {
89 FR_SLAB_CONFIG_CONF_PARSER
90 CONF_PARSER_TERMINATOR
91};
92#endif
93
94static const conf_parser_t winbind_config[] = {
95 { FR_CONF_OFFSET("username", rlm_mschap_t, wb_username) },
96#ifdef WITH_AUTH_WINBIND
97 { FR_CONF_OFFSET("retry_with_normalised_username", rlm_mschap_t, wb_retry_with_normalised_username), .dflt = "no" },
98 { FR_CONF_OFFSET_SUBSECTION("reuse", 0, rlm_mschap_t, reuse, reuse_winbind_config) },
99#endif
100 CONF_PARSER_TERMINATOR
101};
102
103static const conf_parser_t module_config[] = {
104 { FR_CONF_OFFSET("normalise", rlm_mschap_t, normify), .dflt = "yes" },
105
106 /*
107 * Cache the password by default.
108 */
109 { FR_CONF_OFFSET("use_mppe", rlm_mschap_t, use_mppe), .dflt = "yes" },
110 { FR_CONF_OFFSET("require_encryption", rlm_mschap_t, require_encryption), .dflt = "no" },
111 { FR_CONF_OFFSET("require_strong", rlm_mschap_t, require_strong), .dflt = "no" },
112 { FR_CONF_OFFSET("with_ntdomain_hack", rlm_mschap_t, with_ntdomain_hack), .dflt = "yes" },
113 { FR_CONF_OFFSET_FLAGS("ntlm_auth", CONF_FLAG_XLAT, rlm_mschap_t, ntlm_auth) },
114 { FR_CONF_OFFSET("ntlm_auth_timeout", rlm_mschap_t, ntlm_auth_timeout) },
115
116 { FR_CONF_POINTER("passchange", 0, CONF_FLAG_SUBSECTION, NULL), .subcs = (void const *) passchange_config },
117 { FR_CONF_OFFSET("allow_retry", rlm_mschap_t, allow_retry), .dflt = "yes" },
118 { FR_CONF_OFFSET("retry_msg", rlm_mschap_t, retry_msg) },
119
120
121#ifdef __APPLE__
122 { FR_CONF_OFFSET("use_open_directory", rlm_mschap_t, open_directory), .dflt = "yes" },
123#endif
124
125 { FR_CONF_POINTER("winbind", 0, CONF_FLAG_SUBSECTION, NULL), .subcs = (void const *) winbind_config },
126
127 /*
128 * These are now in a subsection above.
129 */
130 { FR_CONF_DEPRECATED("winbind_username", rlm_mschap_t, wb_username) },
131#ifdef WITH_AUTH_WINBIND
132 { FR_CONF_DEPRECATED("winbind_retry_with_normalised_username", rlm_mschap_t, wb_retry_with_normalised_username) },
133#endif
134 CONF_PARSER_TERMINATOR
135};
136
137#define MSCHAP_CALL_ENV(_x) \
138static const call_env_method_t mschap_ ## _x ## _method_env = { \
139 FR_CALL_ENV_METHOD_OUT(mschap_ ## _x ## _call_env_t), \
140 .env = (call_env_parser_t[]){ \
141 { FR_CALL_ENV_SUBSECTION("attributes", NULL, CALL_ENV_FLAG_REQUIRED, _x ## _call_env) }, \
142 CALL_ENV_TERMINATOR \
143 } \
144}
145
146#define MSCHAP_COMMON_CALL_ENV(_x) \
147{ FR_CALL_ENV_PARSE_ONLY_OFFSET("chap_challenge", FR_TYPE_OCTETS, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_ ## _x ## _call_env_t, chap_challenge), \
148 .pair.dflt = "&Vendor-Specific.Microsoft.CHAP-Challenge", .pair.dflt_quote = T_BARE_WORD }, \
149{ FR_CALL_ENV_PARSE_ONLY_OFFSET("chap_response", FR_TYPE_OCTETS, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_ ## _x ## _call_env_t, chap_response), \
150 .pair.dflt = "&Vendor-Specific.Microsoft.CHAP-Response", .pair.dflt_quote = T_BARE_WORD }, \
151{ FR_CALL_ENV_PARSE_ONLY_OFFSET("chap2_response", FR_TYPE_OCTETS, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_ ## _x ## _call_env_t, chap2_response), \
152 .pair.dflt = "&Vendor-Specific.Microsoft.CHAP2-Response", .pair.dflt_quote = T_BARE_WORD }
153
154#define MSCHAP_OPT_CALL_ENV(_opt, _x) \
155{ FR_CALL_ENV_PARSE_ONLY_OFFSET(STRINGIFY(_opt), FR_TYPE_OCTETS, CALL_ENV_FLAG_ATTRIBUTE, mschap_ ## _x ## _call_env_t, _opt) }
156
163
169
170MSCHAP_CALL_ENV(xlat);
171
172static const call_env_parser_t auth_call_env[] = {
173 { FR_CALL_ENV_PARSE_ONLY_OFFSET("username", FR_TYPE_STRING, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_auth_call_env_t, username), .pair.dflt = "&User-Name", .pair.dflt_quote = T_BARE_WORD },
174 MSCHAP_COMMON_CALL_ENV(auth),
175 MSCHAP_OPT_CALL_ENV(chap2_success, auth),
176 MSCHAP_OPT_CALL_ENV(chap_error, auth),
177 MSCHAP_OPT_CALL_ENV(chap_mppe_keys, auth),
178 MSCHAP_OPT_CALL_ENV(mppe_encryption_policy, auth),
179 MSCHAP_OPT_CALL_ENV(mppe_recv_key, auth),
180 MSCHAP_OPT_CALL_ENV(mppe_send_key, auth),
181 MSCHAP_OPT_CALL_ENV(mppe_encryption_types, auth),
182 MSCHAP_OPT_CALL_ENV(chap2_cpw, auth),
183 MSCHAP_OPT_CALL_ENV(chap_nt_enc_pw, auth),
184 CALL_ENV_TERMINATOR
185};
186
207
214
215static const call_env_parser_t autz_call_env[] = {
216 MSCHAP_COMMON_CALL_ENV(autz),
217 MSCHAP_OPT_CALL_ENV(chap2_cpw, autz),
218 CALL_ENV_TERMINATOR
219};
220
221MSCHAP_CALL_ENV(autz);
222
223static fr_dict_t const *dict_freeradius;
224static fr_dict_t const *dict_radius;
225
226extern fr_dict_autoload_t rlm_mschap_dict[];
227fr_dict_autoload_t rlm_mschap_dict[] = {
228 { .out = &dict_freeradius, .proto = "freeradius" },
229 { .out = &dict_radius, .proto = "radius" },
230 { NULL }
231};
232
233fr_dict_attr_t const *attr_auth_type;
234fr_dict_attr_t const *attr_cleartext_password;
235fr_dict_attr_t const *attr_eap_identity;
236fr_dict_attr_t const *attr_ms_chap_new_cleartext_password;
237fr_dict_attr_t const *attr_ms_chap_new_nt_password;
238fr_dict_attr_t const *attr_ms_chap_peer_challenge;
239fr_dict_attr_t const *attr_ms_chap_use_ntlm_auth;
240fr_dict_attr_t const *attr_ms_chap_user_name;
241fr_dict_attr_t const *attr_nt_password;
242fr_dict_attr_t const *attr_smb_account_ctrl_text;
243fr_dict_attr_t const *attr_smb_account_ctrl;
244
245extern fr_dict_attr_autoload_t rlm_mschap_dict_attr[];
246fr_dict_attr_autoload_t rlm_mschap_dict_attr[] = {
247 { .out = &attr_auth_type, .name = "Auth-Type", .type = FR_TYPE_UINT32, .dict = &dict_freeradius },
248 { .out = &attr_cleartext_password, .name = "Password.Cleartext", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
249 { .out = &attr_eap_identity, .name = "EAP-Identity", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
250 { .out = &attr_ms_chap_new_cleartext_password, .name = "MS-CHAP-New-Cleartext-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
251 { .out = &attr_ms_chap_new_nt_password, .name = "MS-CHAP-New-NT-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
252 { .out = &attr_ms_chap_peer_challenge, .name = "MS-CHAP-Peer-Challenge", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
253 { .out = &attr_ms_chap_use_ntlm_auth, .name = "MS-CHAP-Use-NTLM-Auth", .type = FR_TYPE_UINT8, .dict = &dict_freeradius },
254 { .out = &attr_ms_chap_user_name, .name = "MS-CHAP-User-Name", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
255 { .out = &attr_nt_password, .name = "Password.NT", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
256 { .out = &attr_smb_account_ctrl_text, .name = "SMB-Account-Ctrl-Text", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
257 { .out = &attr_smb_account_ctrl, .name = "SMB-Account-Ctrl", .type = FR_TYPE_UINT32, .dict = &dict_freeradius },
258
259 { NULL }
260};
261
262static fr_pair_t *mschap_identity_find(request_t *request, fr_dict_attr_t const *attr_user_name)
263{
264 fr_pair_t *vp;
265
266 vp = fr_pair_find_by_da(&request->request_pairs, NULL, attr_user_name);
267 if (vp) return vp;
268
269 vp = fr_pair_find_by_da(&request->request_pairs, NULL, attr_eap_identity);
270 if (vp) return vp;
271
272 REDEBUG("No user identity found in current request");
273
274 return NULL;
275}
276
277static int pdb_decode_acct_ctrl(char const *p)
278{
279 int acct_ctrl = 0;
280 int done = 0;
281
282 /*
283 * Check if the account type bits have been encoded after the
284 * NT password (in the form [NDHTUWSLXI]).
285 */
286
287 if (*p != '[') return 0;
288
289 for (p++; *p && !done; p++) {
290 switch (*p) {
291 case 'N': /* 'N'o password. */
292 acct_ctrl |= ACB_PWNOTREQ;
293 break;
294
295 case 'D': /* 'D'isabled. */
296 acct_ctrl |= ACB_DISABLED ;
297 break;
298
299 case 'H': /* 'H'omedir required. */
300 acct_ctrl |= ACB_HOMDIRREQ;
301 break;
302
303 case 'T': /* 'T'emp account. */
304 acct_ctrl |= ACB_TEMPDUP;
305 break;
306
307 case 'U': /* 'U'ser account (normal). */
308 acct_ctrl |= ACB_NORMAL;
309 break;
310
311 case 'M': /* 'M'NS logon user account. What is this? */
312 acct_ctrl |= ACB_MNS;
313 break;
314
315 case 'W': /* 'W'orkstation account. */
316 acct_ctrl |= ACB_WSTRUST;
317 break;
318
319 case 'S': /* 'S'erver account. */
320 acct_ctrl |= ACB_SVRTRUST;
321 break;
322
323 case 'L': /* 'L'ocked account. */
324 acct_ctrl |= ACB_AUTOLOCK;
325 break;
326
327 case 'X': /* No 'X'piry on password */
328 acct_ctrl |= ACB_PWNOEXP;
329 break;
330
331 case 'I': /* 'I'nterdomain trust account. */
332 acct_ctrl |= ACB_DOMTRUST;
333 break;
334
335 case 'e': /* 'e'xpired, the password has */
336 acct_ctrl |= ACB_FR_EXPIRED;
337 break;
338
339 case ' ': /* ignore spaces */
340 break;
341
342 case ':':
343 case '\n':
344 case '\0':
345 case ']':
346 default:
347 done = 1;
348 break;
349 }
350 }
351
352 return acct_ctrl;
353}
354
355static xlat_arg_parser_t const mschap_xlat_args[] = {
356 { .required = true, .single = true, .type = FR_TYPE_STRING },
357 { .concat = true, .type = FR_TYPE_STRING },
358 XLAT_ARG_PARSER_TERMINATOR
359};
360
361/** Get data from MSCHAP attributes
362 *
363 * Pulls NT-Response, LM-Response, or Challenge from MSCHAP
364 * attributes.
365 *
366 * @ingroup xlat_functions
367 */
368static xlat_action_t mschap_xlat(TALLOC_CTX *ctx, fr_dcursor_t *out,
369 xlat_ctx_t const *xctx,
370 request_t *request, fr_value_box_list_t *in)
371{
372 mschap_xlat_call_env_t *env_data = talloc_get_type_abort(xctx->env_data, mschap_xlat_call_env_t);
373 size_t data_len;
374 uint8_t const *data = NULL;
375 uint8_t buffer[32];
376 fr_pair_t *user_name;
377 fr_pair_t *chap_challenge, *response;
378 rlm_mschap_t const *inst = talloc_get_type_abort(xctx->mctx->mi->data, rlm_mschap_t);
379 fr_value_box_t *arg = fr_value_box_list_head(in);
380 fr_value_box_t *vb;
381 bool tainted = false;
382
383 response = NULL;
384
385 /*
386 * Challenge means MS-CHAPv1 challenge, or
387 * hash of MS-CHAPv2 challenge, and peer challenge.
388 */
389 if (strncasecmp(arg->vb_strvalue, "Challenge", 9) == 0) {
390 chap_challenge = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
391 tmpl_attr_tail_da(env_data->chap_challenge));
392 if (!chap_challenge) {
393 REDEBUG("No MS-CHAP-Challenge in the request");
394 return XLAT_ACTION_FAIL;
395 }
396 tainted = chap_challenge->vp_tainted;
397
398 /*
399 * MS-CHAP-Challenges are 8 octets,
400 * for MS-CHAPv1
401 */
402 if (chap_challenge->vp_length == 8) {
403 RDEBUG2("mschap1: %02x", chap_challenge->vp_octets[0]);
404 data = chap_challenge->vp_octets;
405 data_len = 8;
406
407 /*
408 * MS-CHAP-Challenges are 16 octets,
409 * for MS-CHAPv2.
410 */
411 } else if (chap_challenge->vp_length == 16) {
412 fr_pair_t *name_vp;
413 fr_pair_t *response_name;
414 char const *username_str;
415 size_t username_len;
416
417 response = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
418 tmpl_attr_tail_da(env_data->chap2_response));
419 if (!response) {
420 REDEBUG("Vendor-Specific.Microsoft.CHAP2-Response is required to calculate MS-CHAPv1 challenge");
421 return XLAT_ACTION_FAIL;
422 }
423
424 /*
425 * FIXME: Much of this is copied from
426 * below. We should put it into a
427 * separate function.
428 */
429
430 /*
431 * Responses are 50 octets.
432 */
433 if (response->vp_length < 50) {
434 REDEBUG("Vendor-Specific.Microsoft.CHAP-Response has the wrong format");
435 return XLAT_ACTION_FAIL;
436 }
437
438 user_name = mschap_identity_find(request, tmpl_attr_tail_da(env_data->username));
439 if (!user_name) return XLAT_ACTION_FAIL;
440
441 /*
442 * Check for MS-CHAP-User-Name and if found, use it
443 * to construct the MSCHAPv1 challenge. This is
444 * set by rlm_eap_mschap to the MS-CHAP Response
445 * packet Name field.
446 *
447 * We prefer this to the User-Name in the
448 * packet.
449 */
450 response_name = fr_pair_find_by_da(&request->request_pairs, NULL, attr_ms_chap_user_name);
451 name_vp = response_name ? response_name : user_name;
452
453 /*
454 * with_ntdomain_hack moved here, too.
455 */
456 username_str = memchr(name_vp->vp_strvalue, '\\', name_vp->vp_length);
457 if (username_str != NULL) {
458 if (inst->with_ntdomain_hack) {
459 username_str++;
460 } else {
461 RWDEBUG2("NT Domain delimiter found, should 'with_ntdomain_hack' be enabled?");
462 username_str = name_vp->vp_strvalue;
463 }
464 } else {
465 username_str = name_vp->vp_strvalue;
466 }
467 username_len = name_vp->vp_length - (username_str - name_vp->vp_strvalue);
468
469 if (response_name &&
470 ((user_name->vp_length != response_name->vp_length) ||
471 (memcmp(user_name->vp_strvalue, response_name->vp_strvalue, user_name->vp_length) != 0))) {
472 RWDEBUG2("%pP is not the same as %pP from EAP-MSCHAPv2", user_name, response_name);
473 }
474
475 /*
476 * Get the MS-CHAPv1 challenge
477 * from the MS-CHAPv2 peer challenge,
478 * our challenge, and the user name.
479 */
480 RDEBUG2("Creating challenge with username \"%pV\"",
481 fr_box_strvalue_len(username_str, username_len));
482 mschap_challenge_hash(buffer, response->vp_octets + 2, chap_challenge->vp_octets,
483 username_str, username_len);
484 data = buffer;
485 data_len = 8;
486 } else {
487 REDEBUG("Invalid MS-CHAP challenge length");
488 return XLAT_ACTION_FAIL;
489 }
490
491 /*
492 * Get the MS-CHAPv1 response, or the MS-CHAPv2
493 * response.
494 */
495 } else if (strncasecmp(arg->vb_strvalue, "NT-Response", 11) == 0) {
496 response = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
497 tmpl_attr_tail_da(env_data->chap_response));
498 if (!response) response = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
499 tmpl_attr_tail_da(env_data->chap2_response));
500 if (!response) {
501 REDEBUG("No MS-CHAP-Response or MS-CHAP2-Response was found in the request");
502 return XLAT_ACTION_FAIL;
503 }
504 tainted = response->vp_tainted;
505
506 /*
507 * For MS-CHAPv1, the NT-Response exists only
508 * if the second octet says so.
509 */
510 if ((response->da == tmpl_attr_tail_da(env_data->chap_response)) && ((response->vp_octets[1] & 0x01) == 0)) {
511 REDEBUG("No NT-Response in MS-CHAP-Response");
512 return XLAT_ACTION_FAIL;
513 }
514
515 if (response->vp_length < 50) {
516 REDEBUG("Vendor-Specific.Microsoft.CHAP-Response has the wrong format");
517 return XLAT_ACTION_FAIL;
518 }
519
520 /*
521 * MS-CHAP-Response and MS-CHAP2-Response have
522 * the NT-Response at the same offset, and are
523 * the same length.
524 */
525 data = response->vp_octets + 26;
526 data_len = 24;
527
528 /*
529 * LM-Response is deprecated, and exists only
530 * in MS-CHAPv1, and not often there.
531 */
532 } else if (strncasecmp(arg->vb_strvalue, "LM-Response", 11) == 0) {
533 response = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
534 tmpl_attr_tail_da(env_data->chap_response));
535 if (!response) {
536 REDEBUG("No MS-CHAP-Response was found in the request");
537 return XLAT_ACTION_FAIL;
538 }
539 tainted = response->vp_tainted;
540
541 if (response->vp_length < 50) {
542 REDEBUG("Vendor-Specific.Microsoft.CHAP-Response has the wrong format");
543 return XLAT_ACTION_FAIL;
544 }
545 /*
546 * For MS-CHAPv1, the LM-Response exists only
547 * if the second octet says so.
548 */
549 if ((response->vp_octets[1] & 0x01) != 0) {
550 REDEBUG("No LM-Response in MS-CHAP-Response");
551 return XLAT_ACTION_FAIL;
552 }
553 data = response->vp_octets + 2;
554 data_len = 24;
555
556 /*
557 * Pull the domain name out of the User-Name, if it exists.
558 *
559 * This is the full domain name, not just the name after host/
560 */
561 } else if (strncasecmp(arg->vb_strvalue, "Domain-Name", 11) == 0) {
562 char *p;
563
564 MEM(vb = fr_value_box_alloc_null(ctx));
565
566 user_name = mschap_identity_find(request, tmpl_attr_tail_da(env_data->username));
567 if (!user_name) return XLAT_ACTION_FAIL;
568
569 /*
570 * First check to see if this is a host/ style User-Name
571 * (a la Kerberos host principal)
572 */
573 if (strncmp(user_name->vp_strvalue, "host/", 5) == 0) {
574 /*
575 * If we're getting a User-Name formatted in this way,
576 * it's likely due to PEAP. The Windows Domain will be
577 * the first domain component following the hostname,
578 * or the machine name itself if only a hostname is supplied
579 */
580 p = strchr(user_name->vp_strvalue, '.');
581 if (!p) {
582 RDEBUG2("setting Domain-Name to same as machine name");
583 fr_value_box_strdup(ctx, vb, NULL, user_name->vp_strvalue + 5, user_name->vp_tainted);
584 } else {
585 p++; /* skip the period */
586
587 fr_value_box_strdup(ctx, vb, NULL, p, user_name->vp_tainted);
588 }
589 } else {
590 p = strchr(user_name->vp_strvalue, '\\');
591 if (!p) {
592 REDEBUG("No domain name was found in the User-Name");
593 talloc_free(vb);
594 return XLAT_ACTION_FAIL;
595 }
596
597 /*
598 * Hack. This is simpler than the alternatives.
599 */
600 *p = '\0';
601 fr_value_box_strdup(ctx, vb, NULL, user_name->vp_strvalue, user_name->vp_tainted);
602 *p = '\\';
603 }
604
605 fr_dcursor_append(out, vb);
606 return XLAT_ACTION_DONE;
607
608 /*
609 * Pull the NT-Domain out of the User-Name, if it exists.
610 */
611 } else if (strncasecmp(arg->vb_strvalue, "NT-Domain", 9) == 0) {
612 char *p, *q;
613
614 MEM(vb = fr_value_box_alloc_null(ctx));
615
616 user_name = mschap_identity_find(request, tmpl_attr_tail_da(env_data->username));
617 if (!user_name) return XLAT_ACTION_FAIL;
618
619 /*
620 * First check to see if this is a host/ style User-Name
621 * (a la Kerberos host principal)
622 */
623 if (strncmp(user_name->vp_strvalue, "host/", 5) == 0) {
624 /*
625 * If we're getting a User-Name formatted in this way,
626 * it's likely due to PEAP. The Windows Domain will be
627 * the first domain component following the hostname,
628 * or the machine name itself if only a hostname is supplied
629 */
630 p = strchr(user_name->vp_strvalue, '.');
631 if (!p) {
632 RDEBUG2("setting NT-Domain to same as machine name");
633 fr_value_box_strdup(ctx, vb, NULL, user_name->vp_strvalue + 5, user_name->vp_tainted);
634 } else {
635 p++; /* skip the period */
636 q = strchr(p, '.');
637 /*
638 * use the same hack as below
639 * only if another period was found
640 */
641 if (q) *q = '\0';
642 fr_value_box_strdup(ctx, vb, NULL, p, user_name->vp_tainted);
643 if (q) *q = '.';
644 }
645 } else {
646 p = strchr(user_name->vp_strvalue, '\\');
647 if (!p) {
648 REDEBUG("No NT-Domain was found in the User-Name");
649 talloc_free(vb);
650 return XLAT_ACTION_FAIL;
651 }
652
653 /*
654 * Hack. This is simpler than the alternatives.
655 */
656 *p = '\0';
657 fr_value_box_strdup(ctx, vb, NULL, user_name->vp_strvalue, user_name->vp_tainted);
658 *p = '\\';
659 }
660
661 fr_dcursor_append(out, vb);
662 return XLAT_ACTION_DONE;
663
664 /*
665 * Pull the User-Name out of the User-Name...
666 */
667 } else if (strncasecmp(arg->vb_strvalue, "User-Name", 9) == 0) {
668 char const *p, *q;
669
670 user_name = mschap_identity_find(request, tmpl_attr_tail_da(env_data->username));
671 if (!user_name) return XLAT_ACTION_FAIL;
672
673 MEM(vb = fr_value_box_alloc_null(ctx));
674
675 /*
676 * First check to see if this is a host/ style User-Name
677 * (a la Kerberos host principal)
678 */
679 if (strncmp(user_name->vp_strvalue, "host/", 5) == 0) {
680 p = user_name->vp_strvalue + 5;
681 /*
682 * If we're getting a User-Name formatted in this way,
683 * it's likely due to PEAP. When authenticating this against
684 * a Domain, Windows will expect the User-Name to be in the
685 * format of hostname$, the SAM version of the name, so we
686 * have to convert it to that here. We do so by stripping
687 * off the first 5 characters (host/), and copying everything
688 * from that point to the first period into a string and appending
689 * a $ to the end.
690 */
691 q = strchr(p, '.');
692
693 /*
694 * use the same hack as above
695 * only if a period was found
696 */
697 if (q) {
698 fr_value_box_asprintf(ctx, vb, NULL, true, "%.*s$", (int) (q - p), p);
699 } else {
700 fr_value_box_asprintf(ctx, vb, NULL, true, "%s$", p);
701 }
702 } else {
703 p = strchr(user_name->vp_strvalue, '\\');
704 if (p) {
705 p++; /* skip the backslash */
706 } else {
707 p = user_name->vp_strvalue; /* use the whole User-Name */
708 }
709 fr_value_box_strdup(ctx, vb, NULL, p, user_name->vp_tainted);
710 }
711
712 fr_dcursor_append(out, vb);
713 return XLAT_ACTION_DONE;
714
715 /*
716 * Return the NT-Hash of the passed string
717 */
718 } else if (strncasecmp(arg->vb_strvalue, "NT-Hash", 7) == 0) {
719 arg = fr_value_box_list_next(in, arg);
720 if ((!arg) || (arg->vb_length == 0))
721 return XLAT_ACTION_FAIL;
722
723 if (mschap_nt_password_hash(buffer, arg->vb_strvalue) < 0) {
724 REDEBUG("Failed generating Password.NT");
725 *buffer = '\0';
726 return XLAT_ACTION_FAIL;
727 }
728
729 MEM(vb = fr_value_box_alloc_null(ctx));
730 fr_value_box_memdup(ctx, vb, NULL, buffer, NT_DIGEST_LENGTH, false);
731 RDEBUG2("NT-Hash of \"known-good\" password: %pV", vb);
732 fr_dcursor_append(out, vb);
733 return XLAT_ACTION_DONE;
734
735 /*
736 * Return the LM-Hash of the passed string
737 */
738 } else if (strncasecmp(arg->vb_strvalue, "LM-Hash", 7) == 0) {
739 arg = fr_value_box_list_next(in, arg);
740 if ((!arg) || (arg->vb_length == 0))
741 return XLAT_ACTION_FAIL;
742
743 smbdes_lmpwdhash(arg->vb_strvalue, buffer);
744
745 MEM(vb = fr_value_box_alloc_null(ctx));
746 fr_value_box_memdup(ctx, vb, NULL, buffer, LM_DIGEST_LENGTH, false);
747 RDEBUG2("LM-Hash of %s = %pV", arg->vb_strvalue, vb);
748 fr_dcursor_append(out, vb);
749 return XLAT_ACTION_DONE;
750 } else {
751 REDEBUG("Unknown expansion string '%pV'", arg);
752 return XLAT_ACTION_FAIL;
753 }
754
755 /*
756 * Didn't set anything: this is bad.
757 */
758 if (!data) {
759 RWDEBUG2("Failed to do anything intelligent");
760 return XLAT_ACTION_FAIL;
761 }
762
763 MEM(vb = fr_value_box_alloc_null(ctx));
764 fr_value_box_memdup(ctx, vb, NULL, data, data_len, tainted);
765
766 fr_dcursor_append(out, vb);
767 return XLAT_ACTION_DONE;
768}
769
770
771#ifdef WITH_AUTH_WINBIND
772/*
773 * Free winbind context
774 */
775static int _mod_ctx_free(winbind_ctx_t *wbctx)
776{
777 wbcCtxFree(wbctx->ctx);
778 return 0;
779}
780
781/*
782 * Create winbind context
783 */
784static int winbind_ctx_alloc(winbind_ctx_t *wbctx, UNUSED void *uctx)
785{
786 wbctx->ctx = wbcCtxCreate();
787 if (!wbctx->ctx) {
788 fr_strerror_printf("Unable to create winbind context");
789 return -1;
790 }
791 talloc_set_destructor(wbctx, _mod_ctx_free);
792 return 0;
793}
794#endif
795
796/*
797 * Add MPPE attributes to the reply.
798 */
799static void mppe_add_reply(UNUSED rlm_mschap_t const *inst,
800 request_t *request, fr_dict_attr_t const *da, uint8_t const *value, size_t len)
801{
802 fr_pair_t *vp;
803
804 MEM(pair_update_reply(&vp, da) >= 0);
805 fr_pair_value_memdup(vp, value, len, false);
806 RINDENT();
807 RDEBUG2("reply.%pP", vp);
808 REXDENT();
809}
810
811/*
812 * Write a string to an fd, followed by "\n"
813 */
814static int write_all(int fd, char const *buf, size_t len)
815{
816 char const *p = buf;
817 char const *end = buf + len;
818
819 while (p < end) {
820 ssize_t slen;
821
822 slen = write(fd, p, end - p);
823 if (slen <= 0) return -1;
824
825 fr_assert((size_t) slen <= (size_t) (end - p));
826
827 p += slen;
828 }
829
830 if (write(fd, "\n", 1) <= 0) return -1;
831
832 return 0;
833}
834
835/*
836 * Perform an MS-CHAP2 password change
837 */
838
839static int CC_HINT(nonnull) do_mschap_cpw(rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx,
840 uint8_t *new_nt_password, uint8_t *old_nt_hash)
841{
842 mschap_cpw_ctx_t *cpw_ctx = auth_ctx->cpw_ctx;
843 fr_value_box_t *vb;
844
845 if (inst->ntlm_cpw && auth_ctx->method != AUTH_INTERNAL) {
846 /*
847 * we're going to run ntlm_auth in helper-mode
848 * we're expecting to use the ntlm-change-password-1 protocol
849 * which needs the following on stdin:
850 *
851 * username: %mschap(User-Name)
852 * nt-domain: %mschap(NT-Domain)
853 * new-nt-password-blob: bin2hex(new_nt_password) - 1032 bytes encoded
854 * old-nt-hash-blob: bin2hex(old_nt_hash) - 32 bytes encoded
855 * new-lm-password-blob: 00000...0000 - 1032 bytes null
856 * old-lm-hash-blob: 000....000 - 32 bytes null
857 * .\n
858 *
859 * ...and it should then print out
860 *
861 * Password-Change: Yes
862 *
863 * or
864 *
865 * Password-Change: No
866 * Password-Change-Error: blah
867 */
868
869 size_t size;
870 int status, len, to_child=-1, from_child=-1;
871 pid_t pid, child_pid;
872 char buf[2048];
873 char *pmsg;
874 char const *emsg;
875
876 RDEBUG2("Doing MS-CHAPv2 password change via ntlm_auth helper");
877
878 /*
879 * Start up ntlm_auth with a pipe on stdin and stdout
880 */
881
882 pid = radius_start_program_legacy(&to_child, &from_child, NULL, inst->ntlm_cpw, request, true, NULL, false);
883 if (pid < 0) {
884 REDEBUG("could not exec ntlm_auth cpw command");
885 return -1;
886 }
887
888 /*
889 * write the stuff to the client
890 */
891
892 vb = fr_value_box_list_head(&cpw_ctx->cpw_user);
893 if (!vb) goto ntlm_auth_err;
894
895 if (write_all(to_child, vb->vb_strvalue, vb->vb_length) < 0) {
896 REDEBUG("Failed to write username to child");
897 goto ntlm_auth_err;
898 }
899
900 if (auth_ctx->env_data->ntlm_cpw_domain) {
901 vb = fr_value_box_list_head(&cpw_ctx->cpw_domain);
902 if (!vb) goto no_domain;
903
904 if (write_all(to_child, vb->vb_strvalue, vb->vb_length) < 0) {
905 REDEBUG("Failed to write domain to child");
906 goto ntlm_auth_err;
907 }
908 } else {
909 no_domain:
910 RWDEBUG2("No ntlm_auth domain set, username must be full-username to work");
911 }
912
913 /* now the password blobs */
914 size = snprintf(buf, sizeof(buf), "new-nt-password-blob: ");
915 fr_base16_encode(&FR_SBUFF_OUT(buf + size, sizeof(buf) - size), &FR_DBUFF_TMP(new_nt_password, 516));
916 size = strlen(buf);
917 if (write_all(to_child, buf, size) < 0) {
918 RDEBUG2("failed to write new password blob to child");
919 goto ntlm_auth_err;
920 }
921
922 size = snprintf(buf, sizeof(buf), "old-nt-hash-blob: ");
923 fr_base16_encode(&FR_SBUFF_OUT(buf + size, sizeof(buf) - size), &FR_DBUFF_TMP(old_nt_hash, NT_DIGEST_LENGTH));
924 size = strlen(buf);
925 if (write_all(to_child, buf, size) < 0) {
926 REDEBUG("Failed to write old hash blob to child");
927 goto ntlm_auth_err;
928 }
929
930 /*
931 * In current samba versions, failure to supply empty LM password/hash
932 * blobs causes the change to fail.
933 */
934 size = snprintf(buf, sizeof(buf), "new-lm-password-blob: %01032i", 0);
935 if (write_all(to_child, buf, size) < 0) {
936 REDEBUG("Failed to write dummy LM password to child");
937 goto ntlm_auth_err;
938 }
939 size = snprintf(buf, sizeof(buf), "old-lm-hash-blob: %032i", 0);
940 if (write_all(to_child, buf, size) < 0) {
941 REDEBUG("Failed to write dummy LM hash to child");
942 goto ntlm_auth_err;
943 }
944 if (write_all(to_child, ".", 1) < 0) {
945 REDEBUG("Failed to send finish to child");
946 goto ntlm_auth_err;
947 }
948 close(to_child);
949 to_child = -1;
950
951 /*
952 * Read from the child
953 */
954 len = radius_readfrom_program_legacy(from_child, pid, fr_time_delta_from_sec(10), buf, sizeof(buf));
955 if (len < 0) {
956 /* radius_readfrom_program_legacy will have closed from_child for us */
957 REDEBUG("Failure reading from child");
958 return -1;
959 }
960 close(from_child);
961 from_child = -1;
962
963 buf[len] = 0;
964 RDEBUG2("ntlm_auth said: %s", buf);
965
966 child_pid = waitpid(pid, &status, 0);
967 if (child_pid == 0) {
968 REDEBUG("Timeout waiting for child");
969 return -1;
970 }
971 if (child_pid != pid) {
972 REDEBUG("Abnormal exit status: %s", fr_syserror(errno));
973 return -1;
974 }
975
976 if (strstr(buf, "Password-Change: Yes")) {
977 RDEBUG2("ntlm_auth password change succeeded");
978 return 0;
979 }
980
981 pmsg = strstr(buf, "Password-Change-Error: ");
982 if (pmsg) {
983 emsg = strsep(&pmsg, "\n");
984 } else {
985 emsg = "could not find error";
986 }
987 REDEBUG("ntlm auth password change failed: %s", emsg);
988
989ntlm_auth_err:
990 /* safe because these either need closing or are == -1 */
991 close(to_child);
992 close(from_child);
993
994 return -1;
995
996 /*
997 * Decrypt the new password blob, add it as a temporary request
998 * variable, xlat the local_cpw string, then remove it
999 *
1000 * this allows is to write e..g
1001 *
1002 * %sql(insert into ...)
1003 *
1004 * ...or...
1005 *
1006 * %exec('/path/to', %mschap(User-Name), %{MS-CHAP-New-Cleartext-Password})"
1007 *
1008 */
1009#ifdef WITH_TLS
1010 } else if (auth_ctx->env_data->local_cpw) {
1011 RDEBUG2("Doing MS-CHAPv2 password change locally");
1012
1013 vb = fr_value_box_list_head(&cpw_ctx->local_cpw_result);
1014
1015 if (!vb){
1016 return -1;
1017 } else if (vb->vb_length == 0) {
1018 REDEBUG("Local MS-CHAPv2 password change - didn't give any result, assuming failure");
1019 return -1;
1020 }
1021
1022 RDEBUG2("MS-CHAPv2 password change succeeded: %pV", vb);
1023
1024 /*
1025 * Update the Password.NT attribute with the new hash this lets us
1026 * fall through to the authentication code using the new hash,
1027 * not the old one.
1028 */
1029 fr_pair_value_memdup(auth_ctx->nt_password, auth_ctx->cpw_ctx->new_hash->vp_octets,
1030 auth_ctx->cpw_ctx->new_hash->vp_length, false);
1031
1032 /*
1033 * Rock on! password change succeeded.
1034 */
1035 return 0;
1036#endif
1037 } else {
1038 REDEBUG("MS-CHAPv2 password change not configured");
1039 }
1040
1041 return -1;
1042}
1043
1044/*
1045 * Do the MS-CHAP stuff.
1046 *
1047 * This function is here so that all of the MS-CHAP related
1048 * authentication is in one place, and we can perhaps later replace
1049 * it with code to call winbindd, or something similar.
1050 */
1051static int CC_HINT(nonnull) do_mschap(rlm_mschap_t const *inst, request_t *request,
1052 mschap_auth_ctx_t *auth_ctx,
1053 uint8_t const *challenge, uint8_t const *response,
1054 uint8_t nthashhash[static NT_DIGEST_LENGTH])
1055{
1056 uint8_t calculated[24];
1057 fr_pair_t *password = auth_ctx->nt_password;
1058
1059 memset(nthashhash, 0, NT_DIGEST_LENGTH);
1060
1061 switch (auth_ctx->method) {
1062 case AUTH_INTERNAL:
1063 case AUTH_AUTO:
1064 /*
1065 * Do normal authentication.
1066 */
1067 {
1068 /*
1069 * No password: can't do authentication.
1070 */
1071 if (!password) {
1072 if (auth_ctx->method == AUTH_AUTO) goto do_ntlm;
1073
1074 REDEBUG("FAILED: No Password.NT/LM. Cannot perform authentication");
1075 return -1;
1076 }
1077
1078 smbdes_mschap(password->vp_octets, challenge, calculated);
1079 if (fr_digest_cmp(response, calculated, 24) != 0) {
1080 return -1;
1081 }
1082
1083 /*
1084 * If the password exists, and is an NT-Password,
1085 * then calculate the hash of the NT hash. Doing this
1086 * here minimizes work for later.
1087 */
1088 if (password->da == attr_nt_password) fr_md4_calc(nthashhash, password->vp_octets, MD4_DIGEST_LENGTH);
1089 break;
1090 }
1091 case AUTH_NTLMAUTH_EXEC:
1092 do_ntlm:
1093 /*
1094 * Run ntlm_auth
1095 */
1096 {
1097 int result;
1098 char buffer[256];
1099 size_t len;
1100
1101 /*
1102 * Run the program, and expect that we get 16
1103 */
1104 result = radius_exec_program_legacy(buffer, sizeof(buffer), request, inst->ntlm_auth, NULL,
1105 true, true, inst->ntlm_auth_timeout);
1106 if (result != 0) {
1107 char *p;
1108
1109 /*
1110 * Do checks for numbers, which are
1111 * language neutral. They're also
1112 * faster.
1113 */
1114 p = strcasestr(buffer, "0xC0000");
1115 if (p) {
1116 result = 0;
1117
1118 p += 7;
1119 if (strcmp(p, "224") == 0) {
1120 result = -648;
1121
1122 } else if (strcmp(p, "234") == 0) {
1123 result = -647;
1124
1125 } else if (strcmp(p, "072") == 0) {
1126 result = -691;
1127
1128 } else if (strcasecmp(p, "05E") == 0) {
1129 result = -2;
1130 }
1131
1132 if (result != 0) {
1133 REDEBUG2("%s", buffer);
1134 return result;
1135 }
1136
1137 /*
1138 * Else fall through to more ridiculous checks.
1139 */
1140 }
1141
1142 /*
1143 * Look for variants of expire password.
1144 */
1145 if (strcasestr(buffer, "0xC0000224") ||
1146 strcasestr(buffer, "Password expired") ||
1147 strcasestr(buffer, "Password has expired") ||
1148 strcasestr(buffer, "Password must be changed") ||
1149 strcasestr(buffer, "Must change password")) {
1150 return -648;
1151 }
1152
1153 if (strcasestr(buffer, "0xC0000234") ||
1154 strcasestr(buffer, "Account locked out")) {
1155 REDEBUG2("%s", buffer);
1156 return -647;
1157 }
1158
1159 if (strcasestr(buffer, "0xC0000072") ||
1160 strcasestr(buffer, "Account disabled")) {
1161 REDEBUG2("%s", buffer);
1162 return -691;
1163 }
1164
1165 if (strcasestr(buffer, "0xC000005E") ||
1166 strcasestr(buffer, "No logon servers")) {
1167 REDEBUG2("%s", buffer);
1168 return -2;
1169 }
1170
1171 if (strcasestr(buffer, "could not obtain winbind separator") ||
1172 strcasestr(buffer, "Reading winbind reply failed")) {
1173 REDEBUG2("%s", buffer);
1174 return -2;
1175 }
1176
1177 RDEBUG2("External script failed");
1178 p = strchr(buffer, '\n');
1179 if (p) *p = '\0';
1180
1181 REDEBUG("External script says: %s", buffer);
1182 return -1;
1183 }
1184
1185 /*
1186 * Parse the answer as an nthashhash.
1187 *
1188 * ntlm_auth currently returns:
1189 * NT_KEY: 000102030405060708090a0b0c0d0e0f
1190 */
1191 if (memcmp(buffer, "NT_KEY: ", 8) != 0) {
1192 REDEBUG("Invalid output from ntlm_auth: expecting 'NT_KEY: ' prefix");
1193 return -1;
1194 }
1195
1196 /*
1197 * Check the length. It should be at least 32, with an LF at the end.
1198 */
1199 len = strlen(buffer + 8);
1200 if (len < 32) {
1201 REDEBUG2("Invalid output from ntlm_auth: NT_KEY too short, expected 32 bytes got %zu bytes",
1202 len);
1203
1204 return -1;
1205 }
1206
1207 /*
1208 * Update the NT hash hash, from the NT key.
1209 */
1210 if (fr_base16_decode(NULL, &FR_DBUFF_TMP(nthashhash, NT_DIGEST_LENGTH),
1211 &FR_SBUFF_IN(buffer + 8, len), false) != NT_DIGEST_LENGTH) {
1212 REDEBUG("Invalid output from ntlm_auth: NT_KEY has non-hex values");
1213 return -1;
1214 }
1215
1216 break;
1217 }
1218#ifdef WITH_AUTH_WINBIND
1219 case AUTH_WBCLIENT:
1220 /*
1221 * Process auth via the wbclient library
1222 */
1223 return do_auth_wbclient(inst, request, challenge, response, nthashhash, auth_ctx);
1224#endif
1225 default:
1226 /* We should never reach this line */
1227 RERROR("Internal error: Unknown mschap auth method (%d)", auth_ctx->method);
1228 return -1;
1229 }
1230
1231 return 0;
1232}
1233
1234
1235/*
1236 * Data for the hashes.
1237 */
1238static const uint8_t SHSpad1[40] =
1239 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1240 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1241 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1242 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
1243
1244static const uint8_t SHSpad2[40] =
1245 { 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
1246 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
1247 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
1248 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2 };
1249
1250static const uint8_t magic1[27] =
1251 { 0x54, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74,
1252 0x68, 0x65, 0x20, 0x4d, 0x50, 0x50, 0x45, 0x20, 0x4d,
1253 0x61, 0x73, 0x74, 0x65, 0x72, 0x20, 0x4b, 0x65, 0x79 };
1254
1255static const uint8_t magic2[84] =
1256 { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69,
1257 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20,
1258 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
1259 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, 0x6b, 0x65, 0x79,
1260 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x73,
1261 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, 0x69, 0x64, 0x65,
1262 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
1263 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20,
1264 0x6b, 0x65, 0x79, 0x2e };
1265
1266static const uint8_t magic3[84] =
1267 { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69,
1268 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20,
1269 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
1270 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20,
1271 0x6b, 0x65, 0x79, 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68,
1272 0x65, 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73,
1273 0x69, 0x64, 0x65, 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73,
1274 0x20, 0x74, 0x68, 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20,
1275 0x6b, 0x65, 0x79, 0x2e };
1276
1277
1278static void mppe_GetMasterKey(uint8_t const *nt_hashhash, uint8_t const *nt_response,
1279 uint8_t *masterkey)
1280{
1281 uint8_t digest[20];
1282 fr_sha1_ctx Context;
1283
1284 fr_sha1_init(&Context);
1285 fr_sha1_update(&Context, nt_hashhash, NT_DIGEST_LENGTH);
1286 fr_sha1_update(&Context, nt_response, 24);
1287 fr_sha1_update(&Context, magic1, 27);
1288 fr_sha1_final(digest, &Context);
1289
1290 memcpy(masterkey, digest, 16); //-V512
1291}
1292
1293
1294static void mppe_GetAsymmetricStartKey(uint8_t *masterkey, uint8_t *sesskey,
1295 int keylen, int issend)
1296{
1297 uint8_t digest[20];
1298 const uint8_t *s;
1299 fr_sha1_ctx Context;
1300
1301 memset(digest, 0, 20);
1302
1303 if(issend) {
1304 s = magic3;
1305 } else {
1306 s = magic2;
1307 }
1308
1309 fr_sha1_init(&Context);
1310 fr_sha1_update(&Context, masterkey, 16);
1311 fr_sha1_update(&Context, SHSpad1, 40);
1312 fr_sha1_update(&Context, s, 84);
1313 fr_sha1_update(&Context, SHSpad2, 40);
1314 fr_sha1_final(digest, &Context);
1315
1316 memcpy(sesskey, digest, keylen);
1317}
1318
1319
1320static void mppe_chap2_get_keys128(uint8_t const *nt_hashhash, uint8_t const *nt_response,
1321 uint8_t *sendkey, uint8_t *recvkey)
1322{
1323 uint8_t masterkey[16];
1324
1325 mppe_GetMasterKey(nt_hashhash, nt_response, masterkey);
1326
1327 mppe_GetAsymmetricStartKey(masterkey, sendkey, 16, 1);
1328 mppe_GetAsymmetricStartKey(masterkey, recvkey, 16, 0);
1329}
1330
1331/*
1332 * Generate MPPE keys.
1333 */
1334static void mppe_chap2_gen_keys128(uint8_t const *nt_hashhash, uint8_t const *response,
1335 uint8_t *sendkey, uint8_t *recvkey)
1336{
1337 uint8_t enckey1[16];
1338 uint8_t enckey2[16];
1339
1340 mppe_chap2_get_keys128(nt_hashhash, response, enckey1, enckey2);
1341
1342 /*
1343 * dictionary.microsoft defines these attributes as
1344 * 'encrypt=Tunnel-Password'. The functions in src/lib/radius.c will
1345 * take care of encrypting/decrypting them as appropriate,
1346 * so that we don't have to.
1347 */
1348 memcpy (sendkey, enckey1, 16);
1349 memcpy (recvkey, enckey2, 16);
1350}
1351
1352
1353/*
1354 * mod_authorize() - authorize user if we can authenticate
1355 * it later. Add Auth-Type attribute if present in module
1356 * configuration (usually Auth-Type must be "MS-CHAP")
1357 */
1358static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
1359{
1360 rlm_mschap_t const *inst = talloc_get_type_abort_const(mctx->mi->data, rlm_mschap_t);
1361 mschap_autz_call_env_t *env_data = talloc_get_type_abort(mctx->env_data, mschap_autz_call_env_t);
1362 fr_pair_t *challenge = NULL;
1363 fr_pair_t *parent;
1364
1365 challenge = fr_pair_find_by_da_nested(&request->request_pairs, NULL, tmpl_attr_tail_da(env_data->chap_challenge));
1366 if (!challenge) RETURN_MODULE_NOOP;
1367
1368 /*
1369 * The responses MUST be in the same group as the challenge.
1370 */
1371 parent = fr_pair_parent(challenge);
1372 fr_assert(parent != NULL);
1373
1374 if (!fr_pair_find_by_da(&parent->vp_group, NULL, tmpl_attr_tail_da(env_data->chap_response)) &&
1375 !fr_pair_find_by_da(&parent->vp_group, NULL, tmpl_attr_tail_da(env_data->chap2_response)) &&
1376 (env_data->chap2_cpw &&
1377 !fr_pair_find_by_da(&parent->vp_group, NULL, tmpl_attr_tail_da(env_data->chap2_cpw)))) {
1378 RDEBUG2("Found MS-CHAP-Challenge, but no MS-CHAP response or Change-Password");
1379 RETURN_MODULE_NOOP;
1380 }
1381
1382 if (!inst->auth_type) {
1383 WARN("No 'authenticate %s {...}' section or 'Auth-Type = %s' set. Cannot setup MS-CHAP authentication",
1384 mctx->mi->name, mctx->mi->name);
1385 RETURN_MODULE_NOOP;
1386 }
1387
1388 if (!module_rlm_section_type_set(request, attr_auth_type, inst->auth_type)) RETURN_MODULE_NOOP;
1389
1390 RETURN_MODULE_OK;
1391}
1392
1393static unlang_action_t mschap_error(rlm_rcode_t *p_result, rlm_mschap_t const *inst, request_t *request,
1394 unsigned char ident, int mschap_result, int mschap_version, fr_pair_t *smb_ctrl,
1395 mschap_auth_call_env_t *env_data)
1396{
1397 rlm_rcode_t rcode = RLM_MODULE_OK;
1398 int error = 0;
1399 int retry = 0;
1400 char const *message = NULL;
1401
1402 int i;
1403 char new_challenge[33], buffer[128];
1404 char *p;
1405
1406 if ((mschap_result == -648) ||
1407 ((mschap_result == 0) &&
1408 (smb_ctrl && ((smb_ctrl->vp_uint32 & ACB_FR_EXPIRED) != 0)))) {
1409 REDEBUG("Password has expired. User should retry authentication");
1410 error = 648;
1411
1412 /*
1413 * A password change is NOT a retry! We MUST have retry=0 here.
1414 */
1415 retry = 0;
1416 message = "Password expired";
1417 rcode = RLM_MODULE_REJECT;
1418
1419 /*
1420 * Account is disabled.
1421 *
1422 * They're found, but they don't exist, so we
1423 * return 'not found'.
1424 */
1425 } else if ((mschap_result == -691) ||
1426 (smb_ctrl && (((smb_ctrl->vp_uint32 & ACB_DISABLED) != 0) ||
1427 ((smb_ctrl->vp_uint32 & (ACB_NORMAL|ACB_WSTRUST)) == 0)))) {
1428 REDEBUG("SMB-Account-Ctrl (or ntlm_auth) "
1429 "says that the account is disabled, "
1430 "or is not a normal or workstation trust account");
1431 error = 691;
1432 retry = 0;
1433 message = "Account disabled";
1434 rcode = RLM_MODULE_NOTFOUND;
1435
1436 /*
1437 * User is locked out.
1438 */
1439 } else if ((mschap_result == -647) ||
1440 (smb_ctrl && ((smb_ctrl->vp_uint32 & ACB_AUTOLOCK) != 0))) {
1441 REDEBUG("SMB-Account-Ctrl (or ntlm_auth) "
1442 "says that the account is locked out");
1443 error = 647;
1444 retry = 0;
1445 message = "Account locked out";
1446 rcode = RLM_MODULE_DISALLOW;
1447
1448 } else if (mschap_result < 0) {
1449 REDEBUG("%s is incorrect", mschap_version == 1 ? env_data->chap_response->name : env_data->chap2_response->name);
1450 error = 691;
1451 retry = inst->allow_retry;
1452 message = "Authentication failed";
1453 rcode = RLM_MODULE_REJECT;
1454 }
1455
1456 if (rcode == RLM_MODULE_OK) RETURN_MODULE_OK;
1457
1458 switch (mschap_version) {
1459 case 1:
1460 for (p = new_challenge, i = 0; i < 2; i++) p += snprintf(p, 9, "%08x", fr_rand());
1461 snprintf(buffer, sizeof(buffer), "E=%i R=%i C=%s V=2",
1462 error, retry, new_challenge);
1463 break;
1464
1465 case 2:
1466 for (p = new_challenge, i = 0; i < 4; i++) p += snprintf(p, 9, "%08x", fr_rand());
1467 snprintf(buffer, sizeof(buffer), "E=%i R=%i C=%s V=3 M=%s",
1468 error, retry, new_challenge, message);
1469 break;
1470
1471 default:
1472 RETURN_MODULE_FAIL;
1473 }
1474 if (env_data->chap_error) mschap_add_reply(request, ident, tmpl_attr_tail_da(env_data->chap_error),
1475 buffer, strlen(buffer));
1476
1477 RETURN_MODULE_RCODE(rcode);
1478}
1479
1480
1481/** Find a Password.NT value, or create one from a Password.Cleartext, or Password.With-Header attribute
1482 *
1483 * @param[in] ctx to allocate ephemeral passwords in.
1484 * @param[out] out Our new Password.NT.
1485 * @param[in] inst Module configuration.
1486 * @param[in] request The current request.
1487 * @return
1488 * - 0 on success.
1489 * - -1 on failure.
1490 */
1491static int CC_HINT(nonnull(1, 2, 3)) nt_password_find(TALLOC_CTX *ctx, fr_pair_t **out,
1492 rlm_mschap_t const *inst, request_t *request)
1493{
1494 fr_pair_t *password;
1495 fr_dict_attr_t const *allowed_passwords[] = { attr_cleartext_password, attr_nt_password };
1496 bool ephemeral;
1497
1498 *out = NULL; /* Init output pointer */
1499
1500 password = password_find(&ephemeral, ctx, request,
1501 allowed_passwords, NUM_ELEMENTS(allowed_passwords), inst->normify);
1502 if (!password) {
1503 if (inst->method == AUTH_INTERNAL) {
1504 /*
1505 * Search for passwords in the parent
1506 * FIXME: This is a hack and should be removed
1507 * When EAP-MSCHAPv2 supports sections.
1508 */
1509 if (request->parent) {
1510 password = password_find(&ephemeral, ctx, request->parent,
1511 allowed_passwords,
1512 NUM_ELEMENTS(allowed_passwords), inst->normify);
1513 if (password) goto found_password;
1514 }
1515
1516 /*
1517 * If we're doing internal auth, then this is an issue
1518 */
1519 RWDEBUG2("No control.%s or control.%s found. Cannot create Password.NT",
1520 attr_cleartext_password->name, attr_nt_password->name);
1521 return -1;
1522
1523 /*
1524 * ..if we're not, then we can call out to external sources.
1525 */
1526 } else {
1527 return 0;
1528 }
1529 }
1530
1531found_password:
1532 if (password->da == attr_cleartext_password) {
1533 uint8_t *p;
1534 int ret;
1535 fr_pair_t *nt_password;
1536
1537 MEM(nt_password = fr_pair_afrom_da(ctx, attr_nt_password));
1538 MEM(fr_pair_value_mem_alloc(nt_password, &p, NT_DIGEST_LENGTH, false) == 0);
1539 ret = mschap_nt_password_hash(p, password->vp_strvalue);
1540
1541 if (ret < 0) {
1542 RERROR("Failed generating Password.NT");
1543 talloc_free(nt_password);
1544 if (ephemeral) TALLOC_FREE(password);
1545 return -1;
1546 }
1547
1548 if (RDEBUG_ENABLED3) {
1549 RDEBUG3("Hashed control.%pP to create %s = %pV",
1550 password, attr_nt_password->name, fr_box_octets(p, NT_DIGEST_LENGTH));
1551 } else {
1552 RDEBUG2("Hashed control.%s to create %s", attr_nt_password->name, password->da->name);
1553 }
1554
1555 if (ephemeral) TALLOC_FREE(password);
1556
1557 *out = nt_password;
1558
1559 return 0;
1560 }
1561
1562 fr_assert(password->da == attr_nt_password);
1563
1564 if (RDEBUG_ENABLED3) {
1565 RDEBUG3("Found control.%pP", password);
1566 } else {
1567 RDEBUG2("Found control.%s", attr_nt_password->name);
1568 }
1569 *out = password;
1570
1571 return 0;
1572}
1573
1574/*
1575 * mschap_cpw_request_process() - do the work to handle an MS-CHAP password
1576 * change request.
1577 */
1578static unlang_action_t CC_HINT(nonnull) mschap_process_cpw_request(rlm_rcode_t *p_result,
1579 rlm_mschap_t const *inst,
1580 request_t *request,
1581 mschap_auth_ctx_t *auth_ctx)
1582{
1583 mschap_auth_call_env_t *env_data = auth_ctx->env_data;
1584 mschap_cpw_ctx_t *cpw_ctx = auth_ctx->cpw_ctx;
1585
1586 /*
1587 * Perform the actual password change
1588 */
1589 if (do_mschap_cpw(inst, request, auth_ctx, cpw_ctx->new_nt_encrypted, cpw_ctx->old_nt_hash) < 0) {
1590 char buffer[128];
1591
1592 REDEBUG("Password change failed");
1593
1594 if (env_data->chap_error) {
1595 snprintf(buffer, sizeof(buffer), "E=709 R=0 M=Password change failed");
1596 mschap_add_reply(request, auth_ctx->cpw->vp_octets[1],
1597 tmpl_attr_tail_da(env_data->chap_error), buffer, strlen(buffer));
1598 }
1599
1600 RETURN_MODULE_REJECT;
1601 }
1602
1603 RDEBUG2("Password change successful");
1604
1605 RETURN_MODULE_OK;
1606}
1607
1608/** Validate data required for change password requests.
1609 *
1610 */
1611static int mschap_cpw_prepare(request_t *request, mschap_auth_ctx_t *auth_ctx)
1612{
1613 mschap_auth_call_env_t *env_data = auth_ctx->env_data;
1614 mschap_cpw_ctx_t *cpw_ctx;
1615 fr_pair_t *nt_enc = NULL;
1616 int seq, new_nt_enc_len;
1617
1618 /*
1619 * mschap2 password change request.
1620 *
1621 * We cheat - first decode and execute the passchange.
1622 * Then extract the response, add it into the request
1623 * and then jump into mschap2 auth with the challenge/
1624 * response.
1625 */
1626 RDEBUG2("MS-CHAPv2 password change request received");
1627
1628 if (auth_ctx->cpw->vp_length != 68) {
1629 REDEBUG("%s has the wrong format: length %zu != 68", env_data->chap2_cpw->name, auth_ctx->cpw->vp_length);
1630 return -1;
1631 }
1632
1633 if (auth_ctx->cpw->vp_octets[0] != 7) {
1634 REDEBUG("%s has the wrong format: code %d != 7", env_data->chap2_cpw->name, auth_ctx->cpw->vp_octets[0]);
1635 return -1;
1636 }
1637
1638 MEM(auth_ctx->cpw_ctx = talloc_zero(auth_ctx, mschap_cpw_ctx_t));
1639 cpw_ctx = auth_ctx->cpw_ctx;
1640
1641 /*
1642 * Look for the new (encrypted) password.
1643 *
1644 * Bah, stupid composite attributes...
1645 * we're expecting 3 attributes with the leading bytes -
1646 * 06:<mschapid>:00:01:<1st chunk>
1647 * 06:<mschapid>:00:02:<2nd chunk>
1648 * 06:<mschapid>:00:03:<3rd chunk>
1649 */
1650 new_nt_enc_len = 0;
1651 for (seq = 1; seq < 4; seq++) {
1652 int found = 0;
1653
1654 while ((nt_enc = fr_pair_find_by_da_nested(&request->request_pairs, nt_enc,
1655 tmpl_attr_tail_da(env_data->chap_nt_enc_pw)))) {
1656 if (nt_enc->vp_length < 4) {
1657 REDEBUG("%s with invalid format", env_data->chap_nt_enc_pw->name);
1658 return -1;
1659 }
1660
1661 if (nt_enc->vp_octets[0] != 6) {
1662 REDEBUG("%s with invalid format", env_data->chap_nt_enc_pw->name);
1663 return -1;
1664 }
1665
1666 if ((nt_enc->vp_octets[2] == 0) && (nt_enc->vp_octets[3] == seq)) {
1667 found = 1;
1668 break;
1669 }
1670 }
1671
1672 if (!found) {
1673 REDEBUG("Could not find %s with sequence number %d", env_data->chap_nt_enc_pw->name, seq);
1674 return -1;
1675 }
1676
1677 if ((new_nt_enc_len + nt_enc->vp_length - 4) > sizeof(cpw_ctx->new_nt_encrypted)) {
1678 REDEBUG("Unpacked %s length > 516", env_data->chap_nt_enc_pw->name);
1679 return -1;
1680 }
1681
1682 memcpy(cpw_ctx->new_nt_encrypted + new_nt_enc_len, nt_enc->vp_octets + 4, nt_enc->vp_length - 4);
1683 new_nt_enc_len += nt_enc->vp_length - 4;
1684 }
1685
1686 if (new_nt_enc_len != 516) {
1687 REDEBUG("Unpacked %s length is %d - should be 516", env_data->chap_nt_enc_pw->name, new_nt_enc_len);
1688 return -1;
1689 }
1690
1691 /*
1692 * RFC 2548 is confusing here. It claims:
1693 *
1694 * 1 byte code
1695 * 1 byte ident
1696 * 16 octets - old hash encrypted with new hash
1697 * 24 octets - peer challenge
1698 * this is actually:
1699 * 16 octets - peer challenge
1700 * 8 octets - reserved
1701 * 24 octets - nt response
1702 * 2 octets - flags (ignored)
1703 */
1704
1705 memcpy(cpw_ctx->old_nt_hash, auth_ctx->cpw->vp_octets + 2, sizeof(cpw_ctx->old_nt_hash));
1706
1707 RDEBUG2("Password change payload valid");
1708 return 0;
1709}
1710
1711static CC_HINT(nonnull) unlang_action_t mschap_process_response(rlm_rcode_t *p_result, int *mschap_version,
1712 uint8_t nthashhash[static NT_DIGEST_LENGTH],
1713 rlm_mschap_t const *inst, request_t *request,
1714 mschap_auth_ctx_t *auth_ctx,
1715 fr_pair_t *challenge, fr_pair_t *response)
1716{
1717 int offset;
1718 rlm_rcode_t mschap_result;
1719 mschap_auth_call_env_t *env_data = auth_ctx->env_data;
1720
1721 *mschap_version = 1;
1722
1723 RDEBUG2("Processing MS-CHAPv1 response");
1724
1725 /*
1726 * MS-CHAPv1 challenges are 8 octets.
1727 */
1728 if (challenge->vp_length < 8) {
1729 REDEBUG("%s has the wrong format", env_data->chap_challenge->name);
1730 RETURN_MODULE_INVALID;
1731 }
1732
1733 /*
1734 * Responses are 50 octets.
1735 */
1736 if (response->vp_length < 50) {
1737 REDEBUG("%s has the wrong format", env_data->chap_response->name);
1738 RETURN_MODULE_INVALID;
1739 }
1740
1741 /*
1742 * We are doing MS-CHAP. Calculate the MS-CHAP
1743 * response
1744 */
1745 if (!(response->vp_octets[1] & 0x01)) {
1746 REDEBUG2("Client used unsupported method LM-Password");
1747 RETURN_MODULE_FAIL;
1748 }
1749
1750 offset = 26;
1751
1752 /*
1753 * Do the MS-CHAP authentication.
1754 */
1755 mschap_result = do_mschap(inst, request, auth_ctx, challenge->vp_octets, response->vp_octets + offset, nthashhash);
1756
1757 /*
1758 * Check for errors, and add MSCHAP-Error if necessary.
1759 */
1760 return mschap_error(p_result, inst, request, *response->vp_octets, mschap_result, *mschap_version, auth_ctx->smb_ctrl, env_data);
1761}
1762
1763static unlang_action_t CC_HINT(nonnull) mschap_process_v2_response(rlm_rcode_t *p_result, int *mschap_version,
1764 uint8_t nthashhash[static NT_DIGEST_LENGTH],
1765 rlm_mschap_t const *inst, request_t *request,
1766 mschap_auth_ctx_t *auth_ctx,
1767 fr_pair_t *challenge, fr_pair_t *response)
1768{
1769 uint8_t mschap_challenge[16];
1770 fr_pair_t *user_name, *name_vp, *response_name, *peer_challenge_attr;
1771 uint8_t const *peer_challenge;
1772 char const *username_str;
1773 size_t username_len;
1774 int mschap_result;
1775 rlm_rcode_t rcode;
1776 char msch2resp[42];
1777 mschap_auth_call_env_t *env_data = auth_ctx->env_data;
1778
1779 *mschap_version = 2;
1780
1781 RDEBUG2("Processing MS-CHAPv2 response");
1782
1783 /*
1784 * MS-CHAPv2 challenges are 16 octets.
1785 */
1786 if (challenge->vp_length < 16) {
1787 REDEBUG("%s has the wrong format", env_data->chap_challenge->name);
1788 RETURN_MODULE_INVALID;
1789 }
1790
1791 /*
1792 * Responses are 50 octets.
1793 */
1794 if (response->vp_length < 50) {
1795 REDEBUG("%s has the wrong format", env_data->chap2_response->name);
1796 RETURN_MODULE_INVALID;
1797 }
1798
1799 /*
1800 * We also require a User-Name
1801 */
1802 user_name = mschap_identity_find(request, tmpl_attr_tail_da(env_data->username));
1803 if (!user_name) RETURN_MODULE_FAIL;
1804
1805 /*
1806 * Check for MS-CHAP-User-Name and if found, use it
1807 * to construct the MSCHAPv1 challenge. This is
1808 * set by rlm_eap_mschap to the MS-CHAP Response
1809 * packet Name field.
1810 *
1811 * We prefer this to the User-Name in the
1812 * packet.
1813 */
1814 response_name = fr_pair_find_by_da(&request->request_pairs, NULL, attr_ms_chap_user_name);
1815 name_vp = response_name ? response_name : user_name;
1816
1817 /*
1818 * with_ntdomain_hack moved here, too.
1819 */
1820 if ((username_str = strchr(name_vp->vp_strvalue, '\\')) != NULL) {
1821 if (inst->with_ntdomain_hack) {
1822 username_str++;
1823 } else {
1824 RWDEBUG2("NT Domain delimiter found, should 'with_ntdomain_hack' be enabled?");
1825 username_str = name_vp->vp_strvalue;
1826 }
1827 } else {
1828 username_str = name_vp->vp_strvalue;
1829 }
1830 username_len = name_vp->vp_length - (username_str - name_vp->vp_strvalue);
1831
1832 if (response_name && ((user_name->vp_length != response_name->vp_length) ||
1833 (strncasecmp(user_name->vp_strvalue, response_name->vp_strvalue, user_name->vp_length) != 0))) {
1834 RWDEBUG("%pP is not the same as %pP from EAP-MSCHAPv2", user_name, response_name);
1835 }
1836
1837#ifdef __APPLE__
1838 /*
1839 * No "known good" Password.NT attribute. Try to do
1840 * OpenDirectory authentication.
1841 *
1842 * If OD determines the user is an AD user it will return noop, which
1843 * indicates the auth process should continue directly to AD.
1844 * Otherwise OD will determine auth success/fail.
1845 */
1846 if (!auth_ctx->nt_password && inst->open_directory) {
1847 RDEBUG2("No Password.NT available. Trying OpenDirectory Authentication");
1848 od_mschap_auth(&rcode, request, challenge, user_name, env_data);
1849 if (rcode != RLM_MODULE_NOOP) RETURN_MODULE_RCODE(rcode);
1850 }
1851#endif
1852 peer_challenge = response->vp_octets + 2;
1853
1854 peer_challenge_attr = fr_pair_find_by_da(&request->control_pairs, NULL, attr_ms_chap_peer_challenge);
1855 if (peer_challenge_attr) {
1856 RDEBUG2("Overriding peer challenge");
1857 peer_challenge = peer_challenge_attr->vp_octets;
1858 }
1859
1860 /*
1861 * The old "mschapv2" function has been moved to
1862 * here.
1863 *
1864 * MS-CHAPv2 takes some additional data to create an
1865 * MS-CHAPv1 challenge, and then does MS-CHAPv1.
1866 */
1867 RDEBUG2("Creating challenge with username \"%pV\"",
1868 fr_box_strvalue_len(username_str, username_len));
1869 mschap_challenge_hash(mschap_challenge, /* resulting challenge */
1870 peer_challenge, /* peer challenge */
1871 challenge->vp_octets, /* our challenge */
1872 username_str, username_len); /* user name */
1873
1874 mschap_result = do_mschap(inst, request, auth_ctx, mschap_challenge, response->vp_octets + 26, nthashhash);
1875
1876 /*
1877 * Check for errors, and add MSCHAP-Error if necessary.
1878 */
1879 mschap_error(&rcode, inst, request, *response->vp_octets,
1880 mschap_result, *mschap_version, auth_ctx->smb_ctrl, env_data);
1881 if (rcode != RLM_MODULE_OK) RETURN_MODULE_RCODE(rcode);
1882
1883#ifdef WITH_AUTH_WINBIND
1884 if (inst->wb_retry_with_normalised_username) {
1885 response_name = fr_pair_find_by_da(&request->request_pairs, NULL, attr_ms_chap_user_name);
1886 if (response_name) {
1887 if (strcmp(username_str, response_name->vp_strvalue)) {
1888 RDEBUG2("Normalising username %pV -> %pV",
1889 fr_box_strvalue_len(username_str, username_len),
1890 &response_name->data);
1891 username_str = response_name->vp_strvalue;
1892 }
1893 }
1894 }
1895#endif
1896
1897 mschap_auth_response(username_str, /* without the domain */
1898 username_len, /* Length of username str */
1899 nthashhash, /* nt-hash-hash */
1900 response->vp_octets + 26, /* peer response */
1901 peer_challenge, /* peer challenge */
1902 challenge->vp_octets, /* our challenge */
1903 msch2resp); /* calculated MPPE key */
1904 if (env_data->chap2_success) mschap_add_reply(request, *response->vp_octets,
1905 tmpl_attr_tail_da(env_data->chap2_success), msch2resp, 42);
1906
1907 RETURN_MODULE_OK;
1908}
1909
1910/** Complete mschap authentication after any tmpls have been expanded.
1911 *
1912 */
1913static unlang_action_t mod_authenticate_resume(rlm_rcode_t *p_result, UNUSED int *priority, request_t *request, void *uctx)
1914{
1915 mschap_auth_ctx_t *auth_ctx = talloc_get_type_abort(uctx, mschap_auth_ctx_t);
1916 mschap_auth_call_env_t *env_data = talloc_get_type_abort(auth_ctx->env_data, mschap_auth_call_env_t);
1917 rlm_mschap_t const *inst = talloc_get_type_abort_const(auth_ctx->inst, rlm_mschap_t);
1918 fr_pair_t *challenge = NULL;
1919 fr_pair_t *response = NULL;
1920 fr_pair_t *parent;
1921 uint8_t nthashhash[NT_DIGEST_LENGTH];
1922 int mschap_version = 0;
1923 rlm_rcode_t rcode = RLM_MODULE_OK;
1924
1925 if (auth_ctx->cpw) {
1926 uint8_t *p;
1927
1928 /*
1929 * Password change does require the NT password
1930 */
1931 if (!auth_ctx->nt_password) {
1932 REDEBUG("Missing Password.NT - required for change password request");
1933 RETURN_MODULE_FAIL;
1934 }
1935 if (!env_data->chap_nt_enc_pw) {
1936 REDEBUG("chap_nt_enc_pw option is not set - required for change password request");
1937 RETURN_MODULE_INVALID;
1938 }
1939
1940 mschap_process_cpw_request(&rcode, inst, request, auth_ctx);
1941 if (rcode != RLM_MODULE_OK) goto finish;
1942
1943 /*
1944 * Clear any expiry bit so the user can now login;
1945 * obviously the password change action will need
1946 * to have cleared this bit in the config/SQL/wherever.
1947 */
1948 if (auth_ctx->smb_ctrl && auth_ctx->smb_ctrl->vp_uint32 & ACB_FR_EXPIRED) {
1949 RDEBUG2("Clearing expiry bit in SMB-Acct-Ctrl to allow authentication");
1950 auth_ctx->smb_ctrl->vp_uint32 &= ~ACB_FR_EXPIRED;
1951 }
1952
1953 /*
1954 * Extract the challenge & response from the end of the
1955 * password change, add them into the request and then
1956 * continue with the authentication.
1957 */
1958 MEM(pair_update_request(&response, tmpl_attr_tail_da(env_data->chap2_response)) >= 0);
1959 MEM(fr_pair_value_mem_alloc(response, &p, 50, auth_ctx->cpw->vp_tainted) == 0);
1960
1961 /* ident & flags */
1962 p[0] = auth_ctx->cpw->vp_octets[1];
1963 p[1] = 0;
1964 /* peer challenge and client NT response */
1965 memcpy(p + 2, auth_ctx->cpw->vp_octets + 18, 48);
1966 }
1967
1968 challenge = fr_pair_find_by_da_nested(&request->request_pairs, NULL, tmpl_attr_tail_da(env_data->chap_challenge));
1969 if (!challenge) {
1970 REDEBUG("control.Auth-Type = %s set for a request that does not contain %s",
1971 auth_ctx->name, env_data->chap_challenge->name);
1972 rcode = RLM_MODULE_INVALID;
1973 goto finish;
1974 }
1975
1976 /*
1977 * The responses MUST be in the same group as the challenge.
1978 */
1979 parent = fr_pair_parent(challenge);
1980 fr_assert(parent != NULL);
1981
1982 /*
1983 * We also require an MS-CHAP-Response.
1984 */
1985 if ((response = fr_pair_find_by_da(&parent->vp_group, NULL, tmpl_attr_tail_da(env_data->chap_response)))) {
1986 mschap_process_response(&rcode,
1987 &mschap_version, nthashhash,
1988 inst, request,
1989 auth_ctx,
1990 challenge, response);
1991 if (rcode != RLM_MODULE_OK) goto finish;
1992 } else if ((response = fr_pair_find_by_da_nested(&parent->vp_group, NULL, tmpl_attr_tail_da(env_data->chap2_response)))) {
1993 mschap_process_v2_response(&rcode,
1994 &mschap_version, nthashhash,
1995 inst, request,
1996 auth_ctx,
1997 challenge, response);
1998 if (rcode != RLM_MODULE_OK) goto finish;
1999 } else { /* Neither CHAPv1 or CHAPv2 response: die */
2000 REDEBUG("control.Auth-Type = %s set for a request that does not contain %s or %s attributes",
2001 auth_ctx->name, env_data->chap_response->name, env_data->chap2_response->name);
2002 rcode = RLM_MODULE_INVALID;
2003 goto finish;
2004 }
2005
2006 /* now create MPPE attributes */
2007 if (inst->use_mppe) {
2008 fr_pair_t *vp;
2009 uint8_t mppe_sendkey[34];
2010 uint8_t mppe_recvkey[34];
2011
2012 switch (mschap_version) {
2013 case 1:
2014 RDEBUG2("Generating MS-CHAPv1 MPPE keys");
2015 memset(mppe_sendkey, 0, 32);
2016
2017 /*
2018 * According to RFC 2548 we
2019 * should send NT hash. But in
2020 * practice it doesn't work.
2021 * Instead, we should send nthashhash
2022 *
2023 * This is an error in RFC 2548.
2024 */
2025 /*
2026 * do_mschap cares to zero nthashhash if NT hash
2027 * is not available.
2028 */
2029 memcpy(mppe_sendkey + 8, nthashhash, NT_DIGEST_LENGTH);
2030 mppe_add_reply(inst, request, tmpl_attr_tail_da(env_data->chap_mppe_keys), mppe_sendkey, 24); //-V666
2031 break;
2032
2033 case 2:
2034 RDEBUG2("Generating MS-CHAPv2 MPPE keys");
2035 mppe_chap2_gen_keys128(nthashhash, response->vp_octets + 26, mppe_sendkey, mppe_recvkey);
2036
2037 mppe_add_reply(inst, request, tmpl_attr_tail_da(env_data->mppe_recv_key), mppe_recvkey, 16);
2038 mppe_add_reply(inst, request, tmpl_attr_tail_da(env_data->mppe_send_key), mppe_sendkey, 16);
2039 break;
2040
2041 default:
2042 fr_assert(0);
2043 break;
2044 }
2045
2046 MEM(pair_update_reply(&vp, tmpl_attr_tail_da(env_data->mppe_encryption_policy)) >= 0);
2047 vp->vp_uint32 = inst->require_encryption ? 2 : 1;
2048
2049 MEM(pair_update_reply(&vp, tmpl_attr_tail_da(env_data->mppe_encryption_types)) >= 0);
2050 vp->vp_uint32 = inst->require_strong ? 4 : 6;
2051 } /* else we weren't asked to use MPPE */
2052
2053finish:
2054 RETURN_MODULE_RCODE(rcode);
2055}
2056
2057/** When changing passwords using the ntlm_auth helper, evaluate the domain tmpl
2058 *
2059 */
2060static unlang_action_t mod_authenticate_domain_tmpl_push(rlm_rcode_t *p_result, UNUSED int *priority,
2061 request_t *request, void *uctx)
2062{
2063 mschap_auth_ctx_t *auth_ctx = talloc_get_type_abort(uctx, mschap_auth_ctx_t);
2064 mschap_auth_call_env_t *env_data = talloc_get_type_abort(auth_ctx->env_data, mschap_auth_call_env_t);
2065
2066 fr_value_box_list_init(&auth_ctx->cpw_ctx->cpw_domain);
2067 if (unlang_tmpl_push(auth_ctx, &auth_ctx->cpw_ctx->cpw_domain, request,
2068 env_data->ntlm_cpw_domain, NULL) < 0) RETURN_MODULE_FAIL;
2069
2070 return UNLANG_ACTION_PUSHED_CHILD;
2071}
2072
2073#ifdef WITH_TLS
2074/** Decrypt the new cleartext password when handling change password requests
2075 *
2076 */
2077static int mschap_new_pass_decrypt(request_t *request, mschap_auth_ctx_t *auth_ctx)
2078{
2079 EVP_CIPHER_CTX *evp_ctx;
2080 uint8_t nt_pass_decrypted[516], old_nt_hash_expected[NT_DIGEST_LENGTH];
2081 int c, ntlen = sizeof(nt_pass_decrypted);
2082 size_t passlen, i = 0, len = 0;
2083 char *x;
2084 uint8_t *p, *q;
2085 fr_pair_t *new_pass;
2086
2087 MEM(evp_ctx = EVP_CIPHER_CTX_new());
2088
2089 if (unlikely(EVP_EncryptInit_ex(evp_ctx, EVP_rc4(), NULL, auth_ctx->nt_password->vp_octets, NULL) != 1)) {
2090 fr_tls_strerror_printf(NULL);
2091 RPERROR("Failed initialising RC4 ctx");
2092 return -1;
2093 }
2094
2095 if (unlikely(EVP_CIPHER_CTX_set_key_length(evp_ctx, auth_ctx->nt_password->vp_length)) != 1) {
2096 fr_tls_strerror_printf(NULL);
2097 RPERROR("Failed setting key length");
2098 return -1;
2099 }
2100
2101 if (unlikely(EVP_EncryptUpdate(evp_ctx, nt_pass_decrypted, &ntlen, auth_ctx->cpw_ctx->new_nt_encrypted, ntlen) != 1)) {
2102 fr_tls_strerror_printf(NULL);
2103 RPERROR("Failed ingesting new password");
2104 return -1;
2105 }
2106
2107 EVP_CIPHER_CTX_free(evp_ctx);
2108
2109 /*
2110 * pwblock is
2111 * 512-N bytes random pad
2112 * N bytes password as utf-16-le
2113 * 4 bytes - N as big-endian int
2114 */
2115 passlen = nt_pass_decrypted[512];
2116 passlen += nt_pass_decrypted[513] << 8;
2117 if ((nt_pass_decrypted[514] != 0) ||
2118 (nt_pass_decrypted[515] != 0)) {
2119 REDEBUG("Decrypted new password blob claims length > 65536, probably an invalid Password.NT");
2120 return -1;
2121 }
2122
2123 /*
2124 * Sanity check - passlen positive and <= 512 if not, crypto has probably gone wrong
2125 */
2126 if (passlen > 512) {
2127 REDEBUG("Decrypted new password blob claims length %zu > 512, "
2128 "probably an invalid Password.NT", passlen);
2129 return -1;
2130 }
2131
2132 p = nt_pass_decrypted + 512 - passlen;
2133
2134 /*
2135 * The new NT hash - this should be preferred over the
2136 * cleartext password as it avoids unicode hassles.
2137 */
2138 MEM(pair_update_request(&auth_ctx->cpw_ctx->new_hash, attr_ms_chap_new_nt_password) >= 0);
2139 MEM(fr_pair_value_mem_alloc(auth_ctx->cpw_ctx->new_hash, &q, NT_DIGEST_LENGTH, false) == 0);
2140 fr_md4_calc(q, p, passlen);
2141
2142 /*
2143 * Check that nt_password encrypted with new_hash
2144 * matches the old_hash value from the client.
2145 */
2146 smbhash(old_nt_hash_expected, auth_ctx->nt_password->vp_octets, q);
2147 smbhash(old_nt_hash_expected + 8, auth_ctx->nt_password->vp_octets + 8, q + 7);
2148 if (memcmp(old_nt_hash_expected, auth_ctx->cpw_ctx->old_nt_hash, NT_DIGEST_LENGTH)!=0) {
2149 REDEBUG("Old NT hash value from client does not match our value");
2150 RHEXDUMP1(old_nt_hash_expected, NT_DIGEST_LENGTH, "expected");
2151 RHEXDUMP1(auth_ctx->cpw_ctx->old_nt_hash, NT_DIGEST_LENGTH, "got");
2152 return -1;
2153 }
2154
2155 /*
2156 * The new cleartext password, which is utf-16 do some unpleasant vileness
2157 * to turn it into utf8 without pulling in libraries like iconv.
2158 *
2159 * First pass: get the length of the converted string.
2160 */
2161 MEM(pair_update_request(&new_pass, attr_ms_chap_new_cleartext_password) >= 0);
2162 new_pass->vp_length = 0;
2163
2164 while (i < passlen) {
2165 c = p[i++];
2166 c += p[i++] << 8;
2167
2168 /*
2169 * Gah. nasty. maybe we should just pull in iconv?
2170 */
2171 if (c < 0x7f) {
2172 len++;
2173 } else if (c < 0x7ff) {
2174 len += 2;
2175 } else {
2176 len += 3;
2177 }
2178 }
2179
2180 MEM(fr_pair_value_bstr_alloc(new_pass, &x, len, true) == 0);
2181
2182 /*
2183 * Second pass: convert the characters from UTF-16 to UTF-8.
2184 */
2185 i = 0;
2186 while (i < passlen) {
2187 c = p[i++];
2188 c += p[i++] << 8;
2189
2190 /*
2191 * Gah. nasty. maybe we should just pull in iconv?
2192 */
2193 if (c < 0x7f) {
2194 *x++ = c;
2195
2196 } else if (c < 0x7ff) {
2197 *x++ = 0xc0 + (c >> 6);
2198 *x++ = 0x80 + (c & 0x3f);
2199
2200 } else {
2201 *x++ = 0xe0 + (c >> 12);
2202 *x++ = 0x80 + ((c>>6) & 0x3f);
2203 *x++ = 0x80 + (c & 0x3f);
2204 }
2205 }
2206
2207 *x = '\0';
2208 return 0;
2209}
2210#endif
2211
2212/*
2213 * mod_authenticate() - authenticate user based on given
2214 * attributes and configuration.
2215 * We will try to find out password in configuration
2216 * or in configured passwd file.
2217 * If one is found we will check paraneters given by NAS.
2218 *
2219 * If SMB-Account-Ctrl is not set to ACB_PWNOTREQ we must have
2220 * one of:
2221 * PAP: User-Password or
2222 * MS-CHAP: MS-CHAP-Challenge and MS-CHAP-Response or
2223 * MS-CHAP2: MS-CHAP-Challenge and MS-CHAP2-Response
2224 * In case of password mismatch or locked account we MAY return
2225 * MS-CHAP-Error for MS-CHAP or MS-CHAP v2
2226 * If MS-CHAP2 succeeds we MUST return MS-CHAP2-Success
2227 */
2228static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
2229{
2230 rlm_mschap_t const *inst = talloc_get_type_abort_const(mctx->mi->data, rlm_mschap_t);
2231#ifdef WITH_AUTH_WINBIND
2232 rlm_mschap_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_mschap_thread_t);
2233#endif
2234 mschap_auth_call_env_t *env_data = talloc_get_type_abort(mctx->env_data, mschap_auth_call_env_t);
2235 mschap_auth_ctx_t *auth_ctx;
2236
2237 MEM(auth_ctx = talloc_zero(unlang_interpret_frame_talloc_ctx(request), mschap_auth_ctx_t));
2238
2239 /*
2240 * If we have ntlm_auth configured, use it unless told
2241 * otherwise
2242 */
2243 *auth_ctx = (mschap_auth_ctx_t) {
2244 .name = mctx->mi->name,
2245 .inst = inst,
2246 .method = inst->method,
2247 .env_data = env_data,
2248#ifdef WITH_AUTH_WINBIND
2249 .t = t,
2250#endif
2251 };
2252
2253 /*
2254 * If we have an ntlm_auth configuration, then we may
2255 * want to suppress it.
2256 */
2257 if (auth_ctx->method != AUTH_INTERNAL) {
2258 fr_pair_t *vp = fr_pair_find_by_da(&request->control_pairs, NULL, attr_ms_chap_use_ntlm_auth);
2259 if (vp && (vp->vp_uint8 <= AUTH_AUTO)) auth_ctx->method = vp->vp_uint8;
2260 }
2261
2262 /*
2263 * Find the SMB-Account-Ctrl attribute, or the
2264 * SMB-Account-Ctrl-Text attribute.
2265 */
2266 auth_ctx->smb_ctrl = fr_pair_find_by_da(&request->control_pairs, NULL, attr_smb_account_ctrl);
2267 if (!auth_ctx->smb_ctrl) {
2268 fr_pair_t *smb_account_ctrl_text;
2269
2270 smb_account_ctrl_text = fr_pair_find_by_da(&request->control_pairs, NULL, attr_smb_account_ctrl_text);
2271 if (smb_account_ctrl_text) {
2272 MEM(pair_append_control(&auth_ctx->smb_ctrl, attr_smb_account_ctrl) >= 0);
2273 auth_ctx->smb_ctrl->vp_uint32 = pdb_decode_acct_ctrl(smb_account_ctrl_text->vp_strvalue);
2274 }
2275 }
2276
2277 /*
2278 * We're configured to do MS-CHAP authentication.
2279 * and account control information exists. Enforce it.
2280 */
2281 if (auth_ctx->smb_ctrl) {
2282 /*
2283 * Password is not required.
2284 */
2285 if ((auth_ctx->smb_ctrl->vp_uint32 & ACB_PWNOTREQ) != 0) {
2286 RDEBUG2("SMB-Account-Ctrl says no password is required");
2287 RETURN_MODULE_OK;
2288 }
2289 }
2290
2291 /*
2292 * Look for or create an Password.NT
2293 *
2294 * Password.NT can be NULL here if we didn't find an
2295 * input attribute, and we're calling out to an
2296 * external password store.
2297 */
2298 if (nt_password_find(auth_ctx, &auth_ctx->nt_password, mctx->mi->data, request) < 0) RETURN_MODULE_FAIL;
2299
2300 /*
2301 * Check to see if this is a change password request, and process
2302 * it accordingly if so.
2303 */
2304 if (env_data->chap2_cpw) auth_ctx->cpw = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
2305 tmpl_attr_tail_da(env_data->chap2_cpw));
2306 if (auth_ctx->cpw) {
2307 /*
2308 * Password change does require the NT password
2309 */
2310 if (!auth_ctx->nt_password) {
2311 REDEBUG("Missing Password.NT - required for change password request");
2312 RETURN_MODULE_FAIL;
2313 }
2314
2315 if (mschap_cpw_prepare(request, auth_ctx) < 0) RETURN_MODULE_FAIL;
2316
2317 switch (auth_ctx->method) {
2318 case AUTH_INTERNAL:
2319#ifdef WITH_TLS
2320 if (mschap_new_pass_decrypt(request, auth_ctx) < 0) RETURN_MODULE_FAIL;
2321 if (unlang_function_push(request, NULL, mod_authenticate_resume, NULL, 0,
2322 UNLANG_SUB_FRAME, auth_ctx) < 0) RETURN_MODULE_FAIL;
2323
2324 fr_value_box_list_init(&auth_ctx->cpw_ctx->local_cpw_result);
2325 if (unlang_tmpl_push(auth_ctx, &auth_ctx->cpw_ctx->local_cpw_result, request,
2326 env_data->local_cpw, NULL) < 0) RETURN_MODULE_FAIL;
2327 break;
2328#else
2329 REDEBUG("Local MS-CHAPv2 password changes require OpenSSL support");
2330 RETURN_MODULE_INVALID;
2331#endif
2332
2333 default:
2334 if (!env_data->ntlm_cpw_username) {
2335 REDEBUG("No ntlm_auth username set, passchange will definitely fail!");
2336 RETURN_MODULE_FAIL;
2337 }
2338
2339 if (unlang_function_push(request, env_data->ntlm_cpw_domain ? mod_authenticate_domain_tmpl_push : NULL,
2340 mod_authenticate_resume, NULL, 0,
2341 UNLANG_SUB_FRAME, auth_ctx) < 0) RETURN_MODULE_FAIL;
2342
2343 fr_value_box_list_init(&auth_ctx->cpw_ctx->cpw_user);
2344 if (unlang_tmpl_push(auth_ctx, &auth_ctx->cpw_ctx->cpw_user, request,
2345 env_data->ntlm_cpw_username, NULL) < 0) RETURN_MODULE_FAIL;
2346 break;
2347 }
2348
2349 return UNLANG_ACTION_PUSHED_CHILD;
2350 }
2351
2352 return mod_authenticate_resume(p_result, NULL, request, auth_ctx);
2353}
2354
2355/*
2356 * Create instance for our module. Allocate space for
2357 * instance structure and read configuration parameters
2358 */
2359static int mod_instantiate(module_inst_ctx_t const *mctx)
2360{
2361 rlm_mschap_t *inst = talloc_get_type_abort(mctx->mi->data, rlm_mschap_t);
2362 CONF_SECTION *conf = mctx->mi->conf;
2363
2364 inst->auth_type = fr_dict_enum_by_name(attr_auth_type, mctx->mi->name, -1);
2365 if (!inst->auth_type) {
2366 WARN("Failed to find 'authenticate %s {...}' section. MS-CHAP authentication will likely not work",
2367 mctx->mi->name);
2368 }
2369
2370 /*
2371 * Set auth method
2372 */
2373 inst->method = AUTH_INTERNAL;
2374
2375 if (inst->wb_username) {
2376#ifdef WITH_AUTH_WINBIND
2377 inst->method = AUTH_WBCLIENT;
2378#else
2379 cf_log_err(conf, "'winbind' auth not enabled at compiled time");
2380 return -1;
2381#endif
2382 }
2383
2384 /* preserve existing behaviour: this option overrides all */
2385 if (inst->ntlm_auth) {
2386 inst->method = AUTH_NTLMAUTH_EXEC;
2387 }
2388
2389 switch (inst->method) {
2390 case AUTH_INTERNAL:
2391 DEBUG("Using internal authentication");
2392 break;
2393 case AUTH_AUTO:
2394 DEBUG("Using auto password or ntlm_auth");
2395 break;
2396 case AUTH_NTLMAUTH_EXEC:
2397 DEBUG("Authenticating by calling 'ntlm_auth'");
2398 break;
2399#ifdef WITH_AUTH_WINBIND
2400 case AUTH_WBCLIENT:
2401 DEBUG("Authenticating directly to winbind");
2402 break;
2403#endif
2404 }
2405
2406 /*
2407 * Check ntlm_auth_timeout is sane
2408 */
2409 if (!fr_time_delta_ispos(inst->ntlm_auth_timeout)) {
2410 inst->ntlm_auth_timeout = fr_time_delta_from_sec(EXEC_TIMEOUT);
2411 }
2412 if (fr_time_delta_lt(inst->ntlm_auth_timeout, fr_time_delta_from_sec(1))) {
2413 cf_log_err(conf, "ntml_auth_timeout '%pVs' is too small (minimum: 1s)",
2414 fr_box_time_delta(inst->ntlm_auth_timeout));
2415 return -1;
2416 }
2417 if (fr_time_delta_gt(inst->ntlm_auth_timeout, fr_time_delta_from_sec(10))) {
2418 cf_log_err(conf, "ntlm_auth_timeout '%pVs' is too large (maximum: 10s)",
2419 fr_box_time_delta(inst->ntlm_auth_timeout));
2420 return -1;
2421 }
2422
2423#define CHECK_OPTION(_option) cp = cf_pair_find(attrs, STRINGIFY(_option)); \
2424if (!cp) { \
2425 WARN("Missing option \"" STRINGIFY(_option) "\", setting use_mppe to \"no\""); \
2426 inst->use_mppe = false; \
2427 goto done_mppe_check; \
2428}
2429
2430 /*
2431 * Check that MPPE attributes are in the module config, if the option is enabled.
2432 * Validity of them will be checked when the module is compiled.
2433 */
2434 if (inst->use_mppe) {
2435 CONF_SECTION *attrs = cf_section_find(conf, "attributes", NULL);
2436 CONF_PAIR *cp;
2437
2438 if (!attrs) {
2439 cf_log_err(conf, "Missing required \"attributes\" section");
2440 return -1;
2441 }
2442 CHECK_OPTION(chap_mppe_keys)
2443 CHECK_OPTION(mppe_encryption_policy)
2444 CHECK_OPTION(mppe_recv_key)
2445 CHECK_OPTION(mppe_send_key)
2446 CHECK_OPTION(mppe_encryption_types)
2447 }
2448done_mppe_check:
2449
2450 return 0;
2451}
2452
2453static int mod_bootstrap(module_inst_ctx_t const *mctx)
2454{
2455 xlat_t *xlat;
2456
2457 xlat = module_rlm_xlat_register(mctx->mi->boot, mctx, NULL, mschap_xlat, FR_TYPE_VOID);
2458 xlat_func_args_set(xlat, mschap_xlat_args);
2459 xlat_func_call_env_set(xlat, &mschap_xlat_method_env);
2460
2461 return 0;
2462}
2463
2464#ifdef WITH_AUTH_WINBIND
2465static int mod_thread_instantiate(module_thread_inst_ctx_t const *mctx)
2466{
2467 rlm_mschap_t const *inst = talloc_get_type_abort(mctx->mi->data, rlm_mschap_t);
2468 rlm_mschap_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_mschap_thread_t);
2469
2470 t->inst = inst;
2471 if (!(t->slab = mschap_slab_list_alloc(t, mctx->el, &inst->reuse, winbind_ctx_alloc, NULL, NULL, false, false))) {
2472 ERROR("Connection handle pool instantiation failed");
2473 return -1;
2474 }
2475
2476 return 0;
2477}
2478
2479static int mod_thread_detach(module_thread_inst_ctx_t const *mctx)
2480{
2481 rlm_mschap_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_mschap_thread_t);
2482 talloc_free(t->slab);
2483 return 0;
2484}
2485#endif
2486
2487extern module_rlm_t rlm_mschap;
2488module_rlm_t rlm_mschap = {
2489 .common = {
2490 .magic = MODULE_MAGIC_INIT,
2491 .name = "mschap",
2492 .inst_size = sizeof(rlm_mschap_t),
2493 .config = module_config,
2494 .bootstrap = mod_bootstrap,
2495 .instantiate = mod_instantiate,
2496#ifdef WITH_AUTH_WINBIND
2497 .thread_inst_size = sizeof(rlm_mschap_thread_t),
2498 .thread_instantiate = mod_thread_instantiate,
2499 .thread_detach = mod_thread_detach
2500#endif
2501 },
2502 .method_group = {
2503 .bindings = (module_method_binding_t[]){
2504 { .section = SECTION_NAME("authenticate", CF_IDENT_ANY), .method = mod_authenticate, .method_env = &mschap_auth_method_env },
2505 { .section = SECTION_NAME("recv", CF_IDENT_ANY), .method = mod_authorize, .method_env = &mschap_autz_method_env },
2506 MODULE_BINDING_TERMINATOR
2507 }
2508 }
2509};
unlang_action_t
unlang_action_t
Returned by unlang_op_t calls, determine the next action of the interpreter.
Definition action.h:35
UNLANG_ACTION_PUSHED_CHILD
@ UNLANG_ACTION_PUSHED_CHILD
unlang_t pushed a new child onto the stack, execute it instead of continuing.
Definition action.h:39
buffer
static int const char char buffer[256]
Definition acutest.h:576
do_auth_wbclient
int do_auth_wbclient(rlm_mschap_t const *inst, request_t *request, uint8_t const *challenge, uint8_t const *response, uint8_t nthashhash[NT_DIGEST_LENGTH], mschap_auth_ctx_t *auth_ctx)
Check NTLM authentication direct to winbind via Samba's libwbclient library.
Definition auth_wbclient.c:93
auth_wbclient.h
fr_base16_encode
#define fr_base16_encode(_out, _in)
Definition base16.h:57
fr_base16_decode
#define fr_base16_decode(_err, _out, _in, _no_trailing)
Definition base16.h:95
USES_APPLE_DEPRECATED_API
#define USES_APPLE_DEPRECATED_API
Definition build.h:470
RCSID
#define RCSID(id)
Definition build.h:483
unlikely
#define unlikely(_x)
Definition build.h:381
UNUSED
#define UNUSED
Definition build.h:315
NUM_ELEMENTS
#define NUM_ELEMENTS(_t)
Definition build.h:337
CALL_ENV_TERMINATOR
#define CALL_ENV_TERMINATOR
Definition call_env.h:236
FR_CALL_ENV_METHOD_OUT
#define FR_CALL_ENV_METHOD_OUT(_inst)
Helper macro for populating the size/type fields of a call_env_method_t from the output structure typ...
Definition call_env.h:240
call_env_method_s::env
call_env_parser_t const * env
Parsing rules for call method env.
Definition call_env.h:247
FR_CALL_ENV_SUBSECTION
#define FR_CALL_ENV_SUBSECTION(_name, _name2, _flags, _subcs)
Specify a call_env_parser_t which defines a nested subsection.
Definition call_env.h:402
CALL_ENV_FLAG_SUBSECTION
@ CALL_ENV_FLAG_SUBSECTION
This is a subsection.
Definition call_env.h:87
CALL_ENV_FLAG_ATTRIBUTE
@ CALL_ENV_FLAG_ATTRIBUTE
Tmpl MUST contain an attribute reference.
Definition call_env.h:86
CALL_ENV_FLAG_NONE
@ CALL_ENV_FLAG_NONE
Definition call_env.h:74
CALL_ENV_FLAG_REQUIRED
@ CALL_ENV_FLAG_REQUIRED
Associated conf pair or section is required.
Definition call_env.h:75
CALL_ENV_FLAG_NULLABLE
@ CALL_ENV_FLAG_NULLABLE
Tmpl expansions are allowed to produce no output.
Definition call_env.h:80
FR_CALL_ENV_OFFSET
#define FR_CALL_ENV_OFFSET(_name, _cast_type, _flags, _struct, _field)
Specify a call_env_parser_t which writes out runtime results to the specified field.
Definition call_env.h:340
FR_CALL_ENV_PARSE_ONLY_OFFSET
#define FR_CALL_ENV_PARSE_ONLY_OFFSET(_name, _cast_type, _flags, _struct, _parse_field)
Specify a call_env_parser_t which writes out the result of the parsing phase to the field specified.
Definition call_env.h:389
call_env_method_s
Definition call_env.h:244
call_env_parser_s
Per method call config.
Definition call_env.h:180
CONF_PARSER_TERMINATOR
#define CONF_PARSER_TERMINATOR
Definition cf_parse.h:658
FR_CONF_DEPRECATED
#define FR_CONF_DEPRECATED(_name, _struct, _field)
conf_parser_t entry which raises an error if a matching CONF_PAIR is found
Definition cf_parse.h:414
FR_CONF_OFFSET
#define FR_CONF_OFFSET(_name, _struct, _field)
conf_parser_t which parses a single CONF_PAIR, writing the result to a field in a struct
Definition cf_parse.h:284
FR_CONF_POINTER
#define FR_CONF_POINTER(_name, _type, _flags, _res_p)
conf_parser_t which parses a single CONF_PAIR producing a single global result
Definition cf_parse.h:339
FR_CONF_OFFSET_FLAGS
#define FR_CONF_OFFSET_FLAGS(_name, _flags, _struct, _field)
conf_parser_t which parses a single CONF_PAIR, writing the result to a field in a struct
Definition cf_parse.h:272
FR_CONF_OFFSET_SUBSECTION
#define FR_CONF_OFFSET_SUBSECTION(_name, _flags, _struct, _field, _subcs)
conf_parser_t which populates a sub-struct using a CONF_SECTION
Definition cf_parse.h:313
CONF_FLAG_XLAT
@ CONF_FLAG_XLAT
string will be dynamically expanded.
Definition cf_parse.h:445
CONF_FLAG_SUBSECTION
@ CONF_FLAG_SUBSECTION
Instead of putting the information into a configuration structure, the configuration file routines MA...
Definition cf_parse.h:428
conf_parser_s
Defines a CONF_PAIR to C data type mapping.
Definition cf_parse.h:595
cf_pair
Configuration AVP similar to a fr_pair_t.
Definition cf_priv.h:70
cf_section
A section grouping multiple CONF_PAIR.
Definition cf_priv.h:101
cf_section_find
CONF_SECTION * cf_section_find(CONF_SECTION const *cs, char const *name1, char const *name2)
Find a CONF_SECTION with name1 and optionally name2.
Definition cf_util.c:1028
cf_log_err
#define cf_log_err(_cf, _fmt,...)
Definition cf_util.h:289
CF_IDENT_ANY
#define CF_IDENT_ANY
Definition cf_util.h:78
FR_DBUFF_TMP
#define FR_DBUFF_TMP(_start, _len_or_end)
Creates a compound literal to pass into functions which accept a dbuff.
Definition dbuff.h:514
fr_dcursor_append
static int fr_dcursor_append(fr_dcursor_t *cursor, void *v)
Insert a single item at the end of the list.
Definition dcursor.h:406
fr_dcursor_s
Definition dcursor.h:93
MEM
#define MEM(x)
Definition debug.h:36
ERROR
#define ERROR(fmt,...)
Definition dhcpclient.c:41
DEBUG
#define DEBUG(fmt,...)
Definition dhcpclient.c:39
fr_dict_attr_autoload_t::out
fr_dict_attr_t const ** out
Where to write a pointer to the resolved fr_dict_attr_t.
Definition dict.h:268
fr_dict_autoload_t::out
fr_dict_t const ** out
Where to write a pointer to the loaded/resolved fr_dict_t.
Definition dict.h:281
fr_dict_enum_by_name
fr_dict_enum_value_t * fr_dict_enum_by_name(fr_dict_attr_t const *da, char const *name, ssize_t len)
Definition dict_util.c:3399
in
static fr_slen_t in
Definition dict.h:823
fr_dict_attr_autoload_t
Specifies an attribute which must be present for the module to function.
Definition dict.h:267
fr_dict_autoload_t
Specifies a dictionary which must be loaded/loadable for the module to function.
Definition dict.h:280
value
Test enumeration values.
Definition dict_test.h:92
MODULE_MAGIC_INIT
#define MODULE_MAGIC_INIT
Stop people using different module/library/server versions together.
Definition dl_module.h:63
EXEC_TIMEOUT
#define EXEC_TIMEOUT
Default wait time for exec calls (in seconds).
Definition exec.h:32
radius_exec_program_legacy
int radius_exec_program_legacy(char *out, size_t outlen, request_t *request, char const *cmd, fr_pair_list_t *input_pairs, bool exec_wait, bool shell_escape, fr_time_delta_t timeout)
Execute a program.
Definition exec_legacy.c:474
radius_start_program_legacy
pid_t radius_start_program_legacy(int *stdin_fd, int *stdout_fd, int *stderr_fd, char const *cmd, request_t *request, bool exec_wait, fr_pair_list_t *input_pairs, bool shell_escape)
Start a process.
Definition exec_legacy.c:227
radius_readfrom_program_legacy
int radius_readfrom_program_legacy(int fd, pid_t pid, fr_time_delta_t timeout, char *answer, int left)
Read from the child process.
Definition exec_legacy.c:357
unlang_function_push
#define unlang_function_push(_request, _func, _repeat, _signal, _sigmask, _top_frame, _uctx)
Push a generic function onto the unlang stack.
Definition function.h:111
mschap_xlat
static xlat_action_t mschap_xlat(TALLOC_CTX *ctx, fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *in)
Get data from MSCHAP attributes.
Definition rlm_mschap.c:368
unlang_interpret_frame_talloc_ctx
TALLOC_CTX * unlang_interpret_frame_talloc_ctx(request_t *request)
Get a talloc_ctx which is valid only for this frame.
Definition interpret.c:1407
UNLANG_SUB_FRAME
#define UNLANG_SUB_FRAME
Definition interpret.h:36
REXDENT
#define REXDENT()
Exdent (unindent) R* messages by one level.
Definition log.h:443
RHEXDUMP1
#define RHEXDUMP1(_data, _len, _fmt,...)
Definition log.h:703
RWDEBUG
#define RWDEBUG(fmt,...)
Definition log.h:361
RDEBUG_ENABLED3
#define RDEBUG_ENABLED3
True if request debug level 1-3 messages are enabled.
Definition log.h:335
RDEBUG3
#define RDEBUG3(fmt,...)
Definition log.h:343
RWDEBUG2
#define RWDEBUG2(fmt,...)
Definition log.h:362
RERROR
#define RERROR(fmt,...)
Definition log.h:298
RPERROR
#define RPERROR(fmt,...)
Definition log.h:302
REDEBUG2
#define REDEBUG2(fmt,...)
Definition log.h:372
RINDENT
#define RINDENT()
Indent R* messages by one level.
Definition log.h:430
waitpid
waitpid(reap->pid_ev->pid, &status, 0)
talloc_free
talloc_free(reap)
fr_md4_calc
void fr_md4_calc(uint8_t out[static MD4_DIGEST_LENGTH], uint8_t const *in, size_t inlen)
Calculate the MD4 hash of the contents of a buffer.
Definition md4.c:482
MD4_DIGEST_LENGTH
#define MD4_DIGEST_LENGTH
Definition md4.h:25
FR_TYPE_STRING
@ FR_TYPE_STRING
String of printable characters.
Definition merged_model.c:83
FR_TYPE_UINT8
@ FR_TYPE_UINT8
8 Bit unsigned integer.
Definition merged_model.c:97
FR_TYPE_UINT32
@ FR_TYPE_UINT32
32 Bit unsigned integer.
Definition merged_model.c:99
FR_TYPE_VOID
@ FR_TYPE_VOID
User data.
Definition merged_model.c:127
FR_TYPE_OCTETS
@ FR_TYPE_OCTETS
Raw octets.
Definition merged_model.c:84
ssize_t
long int ssize_t
Definition merged_model.c:24
uint8_t
unsigned char uint8_t
Definition merged_model.c:30
fr_dict_attr_t
Definition merged_model.c:133
fr_dict_t
Definition merged_model.c:198
fr_value_box_t
Definition merged_model.c:136
request_t
Definition merged_model.c:210
tmpl_t
Definition merged_model.c:225
fr_digest_cmp
int fr_digest_cmp(uint8_t const *a, uint8_t const *b, size_t length)
Do a comparison of two authentication digests by comparing the FULL data.
Definition misc.c:472
strncasecmp
int strncasecmp(char *s1, char *s2, int n)
Definition missing.c:36
strsep
char * strsep(char **stringp, char const *delim)
Definition missing.c:123
strcasecmp
int strcasecmp(char *s1, char *s2)
Definition missing.c:66
module_ctx_t::env_data
void * env_data
Per call environment data.
Definition module_ctx.h:44
module_ctx_t::mi
module_instance_t const * mi
Instance of the module being instantiated.
Definition module_ctx.h:42
module_ctx_t::thread
void * thread
Thread specific instance data.
Definition module_ctx.h:43
module_thread_inst_ctx_t::el
fr_event_list_t * el
Event list to register any IO handlers and timers against.
Definition module_ctx.h:68
module_thread_inst_ctx_t::thread
void * thread
Thread instance data.
Definition module_ctx.h:67
module_thread_inst_ctx_t::mi
module_instance_t const * mi
Instance of the module being instantiated.
Definition module_ctx.h:64
module_inst_ctx_t::mi
module_instance_t * mi
Instance of the module being instantiated.
Definition module_ctx.h:51
module_ctx_t
Temporary structure to hold arguments for module calls.
Definition module_ctx.h:41
module_inst_ctx_t
Temporary structure to hold arguments for instantiation calls.
Definition module_ctx.h:50
module_thread_inst_ctx_t
Temporary structure to hold arguments for thread_instantiation calls.
Definition module_ctx.h:63
module_rlm_xlat_register
xlat_t * module_rlm_xlat_register(TALLOC_CTX *ctx, module_inst_ctx_t const *mctx, char const *name, xlat_func_t func, fr_type_t return_type)
Definition module_rlm.c:257
module_rlm_section_type_set
bool module_rlm_section_type_set(request_t *request, fr_dict_attr_t const *type_da, fr_dict_enum_value_t const *enumv)
Set the next section type if it's not already set.
Definition module_rlm.c:427
module_rlm_s::common
module_t common
Common fields presented by all modules.
Definition module_rlm.h:39
module_rlm_s
Definition module_rlm.h:38
mschap_nt_password_hash
int mschap_nt_password_hash(uint8_t out[static NT_DIGEST_LENGTH], char const *password)
Converts Unicode password to 16-byte NT hash with MD4.
Definition mschap.c:52
mschap_add_reply
void mschap_add_reply(request_t *request, uint8_t ident, fr_dict_attr_t const *da, char const *value, size_t len)
Definition mschap.c:162
mschap_auth_response
void mschap_auth_response(char const *username, size_t username_len, uint8_t const *nt_hash_hash, uint8_t const *ntresponse, uint8_t const *peer_challenge, uint8_t const *auth_challenge, char *response)
Definition mschap.c:101
mschap_challenge_hash
void mschap_challenge_hash(uint8_t challenge[static MSCHAP_CHALLENGE_LENGTH], uint8_t const peer_challenge[static MSCHAP_PEER_CHALLENGE_LENGTH], uint8_t const auth_challenge[static MSCHAP_PEER_AUTHENTICATOR_CHALLENGE_LENGTH], char const *user_name, size_t user_name_len)
Definition mschap.c:72
LM_DIGEST_LENGTH
#define LM_DIGEST_LENGTH
Definition mschap.h:8
NT_DIGEST_LENGTH
#define NT_DIGEST_LENGTH
Definition mschap.h:7
fr_pair_value_memdup
int fr_pair_value_memdup(fr_pair_t *vp, uint8_t const *src, size_t len, bool tainted)
Copy data into an "octets" data type.
Definition pair.c:2981
fr_pair_find_by_da_nested
fr_pair_t * fr_pair_find_by_da_nested(fr_pair_list_t const *list, fr_pair_t const *prev, fr_dict_attr_t const *da)
Find a pair with a matching fr_dict_attr_t, by walking the nested fr_dict_attr_t tree.
Definition pair.c:770
fr_pair_find_by_da
fr_pair_t * fr_pair_find_by_da(fr_pair_list_t const *list, fr_pair_t const *prev, fr_dict_attr_t const *da)
Find the first pair with a matching da.
Definition pair.c:693
fr_pair_parent
fr_pair_t * fr_pair_parent(fr_pair_t const *vp)
Return a pointer to the parent pair.
Definition pair.c:942
fr_pair_afrom_da
fr_pair_t * fr_pair_afrom_da(TALLOC_CTX *ctx, fr_dict_attr_t const *da)
Dynamically allocate a new attribute and assign a fr_dict_attr_t.
Definition pair.c:283
fr_pair_value_bstr_alloc
int fr_pair_value_bstr_alloc(fr_pair_t *vp, char **out, size_t size, bool tainted)
Pre-allocate a memory buffer for a "string" type value pair.
Definition pair.c:2730
fr_pair_value_mem_alloc
int fr_pair_value_mem_alloc(fr_pair_t *vp, uint8_t **out, size_t size, bool tainted)
Pre-allocate a memory buffer for a "octets" type value pair.
Definition pair.c:2930
normify
static ssize_t normify(normalise_t *action, uint8_t *buffer, size_t bufflen, char const *known_good, size_t len, size_t min_len)
Definition password.c:400
password_find
fr_pair_t * password_find(bool *ephemeral, TALLOC_CTX *ctx, request_t *request, fr_dict_attr_t const *allowed_attrs[], size_t allowed_attrs_len, bool normify)
Find a "known good" password in the control list of a request.
Definition password.c:954
config
static const conf_parser_t config[]
Definition base.c:183
fr_assert
#define fr_assert(_expr)
Definition rad_assert.h:38
attr_user_name
static fr_dict_attr_t const * attr_user_name
Definition radclient-ng.c:128
pair_update_request
#define pair_update_request(_attr, _da)
Definition radclient-ng.c:60
done
static bool done
Definition radclient.c:80
REDEBUG
#define REDEBUG(fmt,...)
Definition radclient.h:52
RDEBUG2
#define RDEBUG2(fmt,...)
Definition radclient.h:54
WARN
#define WARN(fmt,...)
Definition radclient.h:47
conf
static rs_t * conf
Definition radsniff.c:53
fr_rand
uint32_t fr_rand(void)
Return a 32-bit random number.
Definition rand.c:105
RETURN_MODULE_REJECT
#define RETURN_MODULE_REJECT
Definition rcode.h:55
RETURN_MODULE_NOOP
#define RETURN_MODULE_NOOP
Definition rcode.h:62
RETURN_MODULE_RCODE
#define RETURN_MODULE_RCODE(_rcode)
Definition rcode.h:64
RETURN_MODULE_INVALID
#define RETURN_MODULE_INVALID
Definition rcode.h:59
RETURN_MODULE_OK
#define RETURN_MODULE_OK
Definition rcode.h:57
RETURN_MODULE_FAIL
#define RETURN_MODULE_FAIL
Definition rcode.h:56
rlm_rcode_t
rlm_rcode_t
Return codes indicating the result of the module call.
Definition rcode.h:40
RLM_MODULE_INVALID
@ RLM_MODULE_INVALID
The module considers the request invalid.
Definition rcode.h:45
RLM_MODULE_OK
@ RLM_MODULE_OK
The module is OK, continue.
Definition rcode.h:43
RLM_MODULE_DISALLOW
@ RLM_MODULE_DISALLOW
Reject the request (user is locked out).
Definition rcode.h:46
RLM_MODULE_REJECT
@ RLM_MODULE_REJECT
Immediately reject the request.
Definition rcode.h:41
RLM_MODULE_NOTFOUND
@ RLM_MODULE_NOTFOUND
User not found.
Definition rcode.h:47
RLM_MODULE_NOOP
@ RLM_MODULE_NOOP
Module succeeded without doing anything.
Definition rcode.h:48
mod_thread_instantiate
static int mod_thread_instantiate(module_thread_inst_ctx_t const *mctx)
Definition rlm_cache_memcached.c:326
mod_thread_detach
static int mod_thread_detach(module_thread_inst_ctx_t const *mctx)
Definition rlm_cache_memcached.c:341
SHSpad2
static const uint8_t SHSpad2[40]
Definition rlm_mschap.c:1244
attr_smb_account_ctrl
fr_dict_attr_t const * attr_smb_account_ctrl
Definition rlm_mschap.c:243
mschap_xlat_call_env_t::username
tmpl_t const * username
Definition rlm_mschap.c:158
CHECK_OPTION
#define CHECK_OPTION(_option)
xlat_call_env
static const call_env_parser_t xlat_call_env[]
Definition rlm_mschap.c:164
mppe_chap2_get_keys128
static void mppe_chap2_get_keys128(uint8_t const *nt_hashhash, uint8_t const *nt_response, uint8_t *sendkey, uint8_t *recvkey)
Definition rlm_mschap.c:1320
mppe_add_reply
static void mppe_add_reply(UNUSED rlm_mschap_t const *inst, request_t *request, fr_dict_attr_t const *da, uint8_t const *value, size_t len)
Definition rlm_mschap.c:799
attr_nt_password
fr_dict_attr_t const * attr_nt_password
Definition rlm_mschap.c:241
attr_ms_chap_new_cleartext_password
fr_dict_attr_t const * attr_ms_chap_new_cleartext_password
Definition rlm_mschap.c:236
rlm_mschap_dict
fr_dict_autoload_t rlm_mschap_dict[]
Definition rlm_mschap.c:227
ACB_MNS
#define ACB_MNS
MNS logon user account.
Definition rlm_mschap.c:74
auth_call_env
static const call_env_parser_t auth_call_env[]
Definition rlm_mschap.c:172
mschap_xlat_call_env_t::chap_response
tmpl_t const * chap_response
Definition rlm_mschap.c:160
mschap_autz_call_env_t::chap2_cpw
tmpl_t const * chap2_cpw
Definition rlm_mschap.c:212
attr_eap_identity
fr_dict_attr_t const * attr_eap_identity
Definition rlm_mschap.c:235
mschap_autz_call_env_t::chap2_response
tmpl_t const * chap2_response
Definition rlm_mschap.c:211
mschap_process_v2_response
static unlang_action_t mschap_process_v2_response(rlm_rcode_t *p_result, int *mschap_version, uint8_t nthashhash[static NT_DIGEST_LENGTH], rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx, fr_pair_t *challenge, fr_pair_t *response)
Definition rlm_mschap.c:1763
ACB_AUTOLOCK
#define ACB_AUTOLOCK
Account auto locked.
Definition rlm_mschap.c:79
MSCHAP_CALL_ENV
#define MSCHAP_CALL_ENV(_x)
Definition rlm_mschap.c:137
attr_smb_account_ctrl_text
fr_dict_attr_t const * attr_smb_account_ctrl_text
Definition rlm_mschap.c:242
autz_call_env
static const call_env_parser_t autz_call_env[]
Definition rlm_mschap.c:215
ACB_TEMPDUP
#define ACB_TEMPDUP
Temporary duplicate account.
Definition rlm_mschap.c:72
pdb_decode_acct_ctrl
static int pdb_decode_acct_ctrl(char const *p)
Definition rlm_mschap.c:277
dict_freeradius
static fr_dict_t const * dict_freeradius
Definition rlm_mschap.c:223
mschap_process_response
static unlang_action_t mschap_process_response(rlm_rcode_t *p_result, int *mschap_version, uint8_t nthashhash[static NT_DIGEST_LENGTH], rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx, fr_pair_t *challenge, fr_pair_t *response)
Definition rlm_mschap.c:1711
mppe_GetMasterKey
static void mppe_GetMasterKey(uint8_t const *nt_hashhash, uint8_t const *nt_response, uint8_t *masterkey)
Definition rlm_mschap.c:1278
mschap_auth_method_env
static const call_env_method_t mschap_auth_method_env
Definition rlm_mschap.c:187
nt_password_find
static int nt_password_find(TALLOC_CTX *ctx, fr_pair_t **out, rlm_mschap_t const *inst, request_t *request)
Find a Password.NT value, or create one from a Password.Cleartext, or Password.With-Header attribute.
Definition rlm_mschap.c:1491
ACB_FR_EXPIRED
#define ACB_FR_EXPIRED
Password Expired.
Definition rlm_mschap.c:80
ACB_DISABLED
#define ACB_DISABLED
User account disabled.
Definition rlm_mschap.c:69
dict_radius
static fr_dict_t const * dict_radius
Definition rlm_mschap.c:224
magic1
static const uint8_t magic1[27]
Definition rlm_mschap.c:1250
mod_authenticate
static unlang_action_t mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
Definition rlm_mschap.c:2228
mod_bootstrap
static int mod_bootstrap(module_inst_ctx_t const *mctx)
Definition rlm_mschap.c:2453
SHSpad1
static const uint8_t SHSpad1[40]
Definition rlm_mschap.c:1238
attr_auth_type
fr_dict_attr_t const * attr_auth_type
Definition rlm_mschap.c:233
attr_ms_chap_user_name
fr_dict_attr_t const * attr_ms_chap_user_name
Definition rlm_mschap.c:240
mschap_autz_call_env_t::chap_response
tmpl_t const * chap_response
Definition rlm_mschap.c:210
mppe_GetAsymmetricStartKey
static void mppe_GetAsymmetricStartKey(uint8_t *masterkey, uint8_t *sesskey, int keylen, int issend)
Definition rlm_mschap.c:1294
mschap_xlat_args
static xlat_arg_parser_t const mschap_xlat_args[]
Definition rlm_mschap.c:355
attr_ms_chap_use_ntlm_auth
fr_dict_attr_t const * attr_ms_chap_use_ntlm_auth
Definition rlm_mschap.c:239
ACB_HOMDIRREQ
#define ACB_HOMDIRREQ
Home directory required.
Definition rlm_mschap.c:70
mschap_xlat_call_env_t::chap2_response
tmpl_t const * chap2_response
Definition rlm_mschap.c:161
rlm_mschap
module_rlm_t rlm_mschap
Definition rlm_mschap.c:2488
write_all
static int write_all(int fd, char const *buf, size_t len)
Definition rlm_mschap.c:814
attr_cleartext_password
fr_dict_attr_t const * attr_cleartext_password
Definition rlm_mschap.c:234
mod_authorize
static unlang_action_t mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
Definition rlm_mschap.c:1358
rlm_mschap_dict_attr
fr_dict_attr_autoload_t rlm_mschap_dict_attr[]
Definition rlm_mschap.c:246
mod_authenticate_resume
static unlang_action_t mod_authenticate_resume(rlm_rcode_t *p_result, UNUSED int *priority, request_t *request, void *uctx)
Complete mschap authentication after any tmpls have been expanded.
Definition rlm_mschap.c:1913
magic3
static const uint8_t magic3[84]
Definition rlm_mschap.c:1266
do_mschap_cpw
static int do_mschap_cpw(rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx, uint8_t *new_nt_password, uint8_t *old_nt_hash)
Definition rlm_mschap.c:839
do_mschap
static int do_mschap(rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx, uint8_t const *challenge, uint8_t const *response, uint8_t nthashhash[static NT_DIGEST_LENGTH])
Definition rlm_mschap.c:1051
magic2
static const uint8_t magic2[84]
Definition rlm_mschap.c:1255
ACB_DOMTRUST
#define ACB_DOMTRUST
Interdomain trust account.
Definition rlm_mschap.c:75
ACB_WSTRUST
#define ACB_WSTRUST
Workstation trust account.
Definition rlm_mschap.c:76
mppe_chap2_gen_keys128
static void mppe_chap2_gen_keys128(uint8_t const *nt_hashhash, uint8_t const *response, uint8_t *sendkey, uint8_t *recvkey)
Definition rlm_mschap.c:1334
attr_ms_chap_new_nt_password
fr_dict_attr_t const * attr_ms_chap_new_nt_password
Definition rlm_mschap.c:237
ACB_NORMAL
#define ACB_NORMAL
Normal user account.
Definition rlm_mschap.c:73
mschap_xlat_call_env_t::chap_challenge
tmpl_t const * chap_challenge
Definition rlm_mschap.c:159
ACB_PWNOTREQ
#define ACB_PWNOTREQ
User password not required.
Definition rlm_mschap.c:71
mschap_error
static unlang_action_t mschap_error(rlm_rcode_t *p_result, rlm_mschap_t const *inst, request_t *request, unsigned char ident, int mschap_result, int mschap_version, fr_pair_t *smb_ctrl, mschap_auth_call_env_t *env_data)
Definition rlm_mschap.c:1393
module_config
static const conf_parser_t module_config[]
Definition rlm_mschap.c:103
mschap_process_cpw_request
static unlang_action_t mschap_process_cpw_request(rlm_rcode_t *p_result, rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx)
Definition rlm_mschap.c:1578
mod_authenticate_domain_tmpl_push
static unlang_action_t mod_authenticate_domain_tmpl_push(rlm_rcode_t *p_result, UNUSED int *priority, request_t *request, void *uctx)
When changing passwords using the ntlm_auth helper, evaluate the domain tmpl.
Definition rlm_mschap.c:2060
attr_ms_chap_peer_challenge
fr_dict_attr_t const * attr_ms_chap_peer_challenge
Definition rlm_mschap.c:238
mschap_cpw_prepare
static int mschap_cpw_prepare(request_t *request, mschap_auth_ctx_t *auth_ctx)
Validate data required for change password requests.
Definition rlm_mschap.c:1611
MSCHAP_OPT_CALL_ENV
#define MSCHAP_OPT_CALL_ENV(_opt, _x)
Definition rlm_mschap.c:154
mod_instantiate
static int mod_instantiate(module_inst_ctx_t const *mctx)
Definition rlm_mschap.c:2359
ACB_PWNOEXP
#define ACB_PWNOEXP
User password does not expire.
Definition rlm_mschap.c:78
mschap_identity_find
static fr_pair_t * mschap_identity_find(request_t *request, fr_dict_attr_t const *attr_user_name)
Definition rlm_mschap.c:262
passchange_config
static const conf_parser_t passchange_config[]
Definition rlm_mschap.c:82
mschap_autz_call_env_t::chap_challenge
tmpl_t const * chap_challenge
Definition rlm_mschap.c:209
MSCHAP_COMMON_CALL_ENV
#define MSCHAP_COMMON_CALL_ENV(_x)
Definition rlm_mschap.c:146
ACB_SVRTRUST
#define ACB_SVRTRUST
Server trust account.
Definition rlm_mschap.c:77
winbind_config
static const conf_parser_t winbind_config[]
Definition rlm_mschap.c:94
mschap_autz_call_env_t
Definition rlm_mschap.c:208
mschap_xlat_call_env_t
Definition rlm_mschap.c:157
rlm_mschap.h
mschap_cpw_ctx_t::new_nt_encrypted
uint8_t new_nt_encrypted[516]
Definition rlm_mschap.h:106
mschap_auth_call_env_t::username
tmpl_t const * username
Definition rlm_mschap.h:82
mschap_auth_ctx_t::method
MSCHAP_AUTH_METHOD method
Definition rlm_mschap.h:115
mschap_auth_call_env_t::mppe_encryption_types
tmpl_t const * mppe_encryption_types
Definition rlm_mschap.h:92
mschap_auth_ctx_t::cpw
fr_pair_t * cpw
Definition rlm_mschap.h:118
mschap_auth_ctx_t::name
char const * name
Definition rlm_mschap.h:112
mschap_auth_call_env_t::ntlm_cpw_domain
tmpl_t const * ntlm_cpw_domain
Definition rlm_mschap.h:98
mschap_cpw_ctx_t::new_hash
fr_pair_t * new_hash
Definition rlm_mschap.h:108
mschap_auth_call_env_t::ntlm_cpw_username
tmpl_t const * ntlm_cpw_username
Definition rlm_mschap.h:97
mschap_auth_call_env_t::chap_nt_enc_pw
tmpl_t const * chap_nt_enc_pw
Definition rlm_mschap.h:94
mschap_auth_call_env_t::mppe_send_key
tmpl_t const * mppe_send_key
Definition rlm_mschap.h:91
mschap_auth_ctx_t::inst
rlm_mschap_t const * inst
Definition rlm_mschap.h:113
mschap_cpw_ctx_t::cpw_user
fr_value_box_list_t cpw_user
Definition rlm_mschap.h:103
mschap_auth_call_env_t::chap_response
tmpl_t const * chap_response
Definition rlm_mschap.h:85
mschap_auth_call_env_t::local_cpw
tmpl_t const * local_cpw
Definition rlm_mschap.h:99
mschap_cpw_ctx_t::cpw_domain
fr_value_box_list_t cpw_domain
Definition rlm_mschap.h:104
mschap_auth_ctx_t::smb_ctrl
fr_pair_t * smb_ctrl
Definition rlm_mschap.h:117
mschap_auth_call_env_t::chap_challenge
tmpl_t const * chap_challenge
Definition rlm_mschap.h:84
mschap_auth_call_env_t::chap2_response
tmpl_t const * chap2_response
Definition rlm_mschap.h:86
mschap_cpw_ctx_t::local_cpw_result
fr_value_box_list_t local_cpw_result
Definition rlm_mschap.h:105
mschap_auth_call_env_t::mppe_encryption_policy
tmpl_t const * mppe_encryption_policy
Definition rlm_mschap.h:89
mschap_auth_ctx_t::env_data
mschap_auth_call_env_t * env_data
Definition rlm_mschap.h:114
mschap_auth_call_env_t::mppe_recv_key
tmpl_t const * mppe_recv_key
Definition rlm_mschap.h:90
mschap_auth_call_env_t::chap_error
tmpl_t const * chap_error
Definition rlm_mschap.h:83
mschap_auth_call_env_t::chap2_cpw
tmpl_t const * chap2_cpw
Definition rlm_mschap.h:93
mschap_cpw_ctx_t::old_nt_hash
uint8_t old_nt_hash[NT_DIGEST_LENGTH]
Definition rlm_mschap.h:107
mschap_auth_call_env_t::chap2_success
tmpl_t const * chap2_success
Definition rlm_mschap.h:87
mschap_auth_ctx_t::cpw_ctx
mschap_cpw_ctx_t * cpw_ctx
Definition rlm_mschap.h:119
mschap_auth_ctx_t::nt_password
fr_pair_t * nt_password
Definition rlm_mschap.h:116
AUTH_AUTO
@ AUTH_AUTO
Definition rlm_mschap.h:20
AUTH_INTERNAL
@ AUTH_INTERNAL
Definition rlm_mschap.h:18
AUTH_NTLMAUTH_EXEC
@ AUTH_NTLMAUTH_EXEC
Definition rlm_mschap.h:19
mschap_auth_call_env_t::chap_mppe_keys
tmpl_t const * chap_mppe_keys
Definition rlm_mschap.h:88
mschap_auth_call_env_t
Definition rlm_mschap.h:81
mschap_auth_ctx_t
Definition rlm_mschap.h:111
mschap_cpw_ctx_t
Definition rlm_mschap.h:102
rlm_mschap_t
Definition rlm_mschap.h:41
instantiate
static int instantiate(module_inst_ctx_t const *mctx)
Definition rlm_rest.c:1310
username
username
Definition rlm_securid.c:420
winbind_ctx_alloc
static int winbind_ctx_alloc(winbind_ctx_t *wbctx, UNUSED void *uctx)
Definition rlm_winbind.c:283
reuse_winbind_config
static conf_parser_t reuse_winbind_config[]
Definition rlm_winbind.c:45
_mod_ctx_free
static int _mod_ctx_free(winbind_ctx_t *wbctx)
Definition rlm_winbind.c:274
winbind_ctx_t::ctx
struct wbcContext * ctx
Definition rlm_winbind.h:20
winbind_ctx_t
Definition rlm_winbind.h:19
FR_SBUFF_IN
#define FR_SBUFF_IN(_start, _len_or_end)
FR_SBUFF_OUT
#define FR_SBUFF_OUT(_start, _len_or_end)
SECTION_NAME
#define SECTION_NAME(_name1, _name2)
Define a section name consisting of a verb and a noun.
Definition section.h:40
module_instance_s::name
char const * name
Instance name e.g. user_database.
Definition module.h:335
module_instance_s::conf
CONF_SECTION * conf
Module's instance configuration.
Definition module.h:329
module_s::inst_size
size_t inst_size
Size of the module's instance data.
Definition module.h:203
module_instance_s::data
void * data
Module's instance data.
Definition module.h:271
module_instance_s::boot
void * boot
Data allocated during the boostrap phase.
Definition module.h:274
MODULE_BINDING_TERMINATOR
#define MODULE_BINDING_TERMINATOR
Terminate a module binding list.
Definition module.h:151
module_method_binding_s
Named methods exported by a module.
Definition module.h:173
pair_append_control
#define pair_append_control(_attr, _da)
Allocate and append a fr_pair_t to the control list.
Definition pair.h:57
pair_update_reply
#define pair_update_reply(_attr, _da)
Return or allocate a fr_pair_t in the reply list.
Definition pair.h:129
tmpl_attr_tail_da
static fr_dict_attr_t const * tmpl_attr_tail_da(tmpl_t const *vpt)
Return the last attribute reference da.
Definition tmpl.h:818
fr_sha1_init
void fr_sha1_init(fr_sha1_ctx *context)
Definition sha1.c:93
fr_sha1_final
void fr_sha1_final(uint8_t digest[static SHA1_DIGEST_LENGTH], fr_sha1_ctx *context)
Definition sha1.c:141
fr_sha1_update
void fr_sha1_update(fr_sha1_ctx *context, uint8_t const *in, size_t len)
Definition sha1.c:105
fr_sha1_ctx
Definition sha1.h:33
FR_SLAB_CONFIG_CONF_PARSER
#define FR_SLAB_CONFIG_CONF_PARSER
conf_parser_t entries to populate user configurable slab values
Definition slab.h:35
smbhash
void smbhash(unsigned char *out, unsigned char const *in, unsigned char *key)
Definition smbdes.c:287
smbdes_mschap
void smbdes_mschap(uint8_t const win_password[16], uint8_t const *challenge, uint8_t *response)
Definition smbdes.c:339
smbdes_lmpwdhash
void smbdes_lmpwdhash(char const *password, uint8_t *lmhash)
Definition smbdes.c:319
snprintf
PUBLIC int snprintf(char *string, size_t length, char *format, va_alist)
Definition snprintf.c:689
inst
eap_aka_sim_process_conf_t * inst
Definition state_machine.c:3620
vp
fr_pair_t * vp
Definition state_machine.c:2262
value_pair_s
Stores an attribute, a value and various bits of other data.
Definition pair.h:68
value_pair_s::da
fr_dict_attr_t const *_CONST da
Dictionary attribute defines the attribute number, vendor and type of the pair.
Definition pair.h:69
fr_syserror
char const * fr_syserror(int num)
Guaranteed to be thread-safe version of strerror.
Definition syserror.c:243
talloc_get_type_abort_const
#define talloc_get_type_abort_const
Definition talloc.h:282
fr_time_delta_lt
#define fr_time_delta_lt(_a, _b)
Definition time.h:285
fr_time_delta_from_sec
static fr_time_delta_t fr_time_delta_from_sec(int64_t sec)
Definition time.h:590
fr_time_delta_ispos
#define fr_time_delta_ispos(_a)
Definition time.h:290
fr_time_delta_gt
#define fr_time_delta_gt(_a, _b)
Definition time.h:283
unlang_tmpl_push
int unlang_tmpl_push(TALLOC_CTX *ctx, fr_value_box_list_t *out, request_t *request, tmpl_t const *tmpl, unlang_tmpl_args_t *args)
Push a tmpl onto the stack for evaluation.
Definition tmpl.c:262
T_BARE_WORD
@ T_BARE_WORD
Definition token.h:120
close
close(uq->fd)
xlat_arg_parser_t::required
bool required
Argument must be present, and non-empty.
Definition xlat.h:148
XLAT_ARG_PARSER_TERMINATOR
#define XLAT_ARG_PARSER_TERMINATOR
Definition xlat.h:168
xlat_action_t
xlat_action_t
Definition xlat.h:37
XLAT_ACTION_FAIL
@ XLAT_ACTION_FAIL
An xlat function failed.
Definition xlat.h:44
XLAT_ACTION_DONE
@ XLAT_ACTION_DONE
We're done evaluating this level of nesting.
Definition xlat.h:43
xlat_arg_parser_t
Definition for a single argument consumend by an xlat function.
Definition xlat.h:147
parent
static fr_slen_t parent
Definition pair.h:851
fr_strerror_printf
#define fr_strerror_printf(_fmt,...)
Log to thread local error buffer.
Definition strerror.h:64
fr_value_box_asprintf
int fr_value_box_asprintf(TALLOC_CTX *ctx, fr_value_box_t *dst, fr_dict_attr_t const *enumv, bool tainted, char const *fmt,...)
Print a formatted string using our internal printf wrapper and assign it to a value box.
Definition value.c:4014
fr_value_box_strdup
int fr_value_box_strdup(TALLOC_CTX *ctx, fr_value_box_t *dst, fr_dict_attr_t const *enumv, char const *src, bool tainted)
Copy a nul terminated string to a fr_value_box_t.
Definition value.c:3927
fr_value_box_memdup
int fr_value_box_memdup(TALLOC_CTX *ctx, fr_value_box_t *dst, fr_dict_attr_t const *enumv, uint8_t const *src, size_t len, bool tainted)
Copy a buffer to a fr_value_box_t.
Definition value.c:4468
data
static fr_slen_t data
Definition value.h:1265
fr_box_strvalue_len
#define fr_box_strvalue_len(_val, _len)
Definition value.h:286
fr_box_time_delta
#define fr_box_time_delta(_val)
Definition value.h:343
nonnull
int nonnull(2, 5))
fr_value_box_alloc_null
#define fr_value_box_alloc_null(_ctx)
Allocate a value box for later use with a value assignment function.
Definition value.h:632
out
static size_t char ** out
Definition value.h:997
fr_box_octets
#define fr_box_octets(_val, _len)
Definition value.h:288
xlat_ctx_s::env_data
void * env_data
Expanded call env data.
Definition xlat_ctx.h:53
xlat_ctx_s::mctx
module_ctx_t const * mctx
Synthesised module calling ctx.
Definition xlat_ctx.h:52
xlat_ctx_s
An xlat calling ctx.
Definition xlat_ctx.h:49
xlat_func_args_set
int xlat_func_args_set(xlat_t *x, xlat_arg_parser_t const args[])
Register the arguments of an xlat.
Definition xlat_func.c:365
xlat_func_call_env_set
void xlat_func_call_env_set(xlat_t *x, call_env_method_t const *env_method)
Register call environment of an xlat.
Definition xlat_func.c:392
xlat_s
Definition xlat_priv.h:59
Generated by   doxygen 1.9.8