27 RCSID(
"$Id: fa6a2db7e4712ebe1f41a9182b15b70dfca440b6 $")
29 #define LOG_PREFIX mctx->inst->name
31 #include <freeradius-devel/server/base.h>
32 #include <freeradius-devel/server/exec_legacy.h>
33 #include <freeradius-devel/server/module_rlm.h>
34 #include <freeradius-devel/server/password.h>
35 #include <freeradius-devel/tls/strerror.h>
36 #include <freeradius-devel/util/debug.h>
37 #include <freeradius-devel/radius/defs.h>
39 #include <freeradius-devel/util/base16.h>
40 #include <freeradius-devel/util/md4.h>
41 #include <freeradius-devel/util/md5.h>
42 #include <freeradius-devel/util/misc.h>
43 #include <freeradius-devel/util/sha1.h>
45 #include <freeradius-devel/unlang/function.h>
46 #include <freeradius-devel/unlang/xlat_func.h>
55 #ifdef WITH_AUTH_WINBIND
61 # include <freeradius-devel/tls/openssl_user_macros.h>
62 # include <openssl/rc4.h>
71 #define ACB_DISABLED 0x00010000
72 #define ACB_HOMDIRREQ 0x00020000
73 #define ACB_PWNOTREQ 0x00040000
74 #define ACB_TEMPDUP 0x00080000
75 #define ACB_NORMAL 0x00100000
76 #define ACB_MNS 0x00200000
77 #define ACB_DOMTRUST 0x00400000
78 #define ACB_WSTRUST 0x00800000
79 #define ACB_SVRTRUST 0x01000000
80 #define ACB_PWNOEXP 0x02000000
81 #define ACB_AUTOLOCK 0x04000000
82 #define ACB_FR_EXPIRED 0x00020000
91 #ifdef WITH_AUTH_WINBIND
125 #ifdef WITH_AUTH_WINBIND
131 #define MSCHAP_CALL_ENV(_x) \
132 static const call_env_method_t mschap_ ## _x ## _method_env = { \
133 FR_CALL_ENV_METHOD_OUT(mschap_ ## _x ## _call_env_t), \
134 .env = (call_env_parser_t[]){ \
135 { FR_CALL_ENV_SUBSECTION("attributes", NULL, CALL_ENV_FLAG_REQUIRED, _x ## _call_env) }, \
136 CALL_ENV_TERMINATOR \
140 #define MSCHAP_COMMON_CALL_ENV(_x) \
141 { FR_CALL_ENV_PARSE_ONLY_OFFSET("chap_challenge", FR_TYPE_OCTETS, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_ ## _x ## _call_env_t, chap_challenge), \
142 .pair.dflt = "&Vendor-Specific.Microsoft.CHAP-Challenge", .pair.dflt_quote = T_BARE_WORD }, \
143 { FR_CALL_ENV_PARSE_ONLY_OFFSET("chap_response", FR_TYPE_OCTETS, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_ ## _x ## _call_env_t, chap_response), \
144 .pair.dflt = "&Vendor-Specific.Microsoft.CHAP-Response", .pair.dflt_quote = T_BARE_WORD }, \
145 { FR_CALL_ENV_PARSE_ONLY_OFFSET("chap2_response", FR_TYPE_OCTETS, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_ ## _x ## _call_env_t, chap2_response), \
146 .pair.dflt = "&Vendor-Specific.Microsoft.CHAP2-Response", .pair.dflt_quote = T_BARE_WORD }
148 #define MSCHAP_OPT_CALL_ENV(_opt, _x) \
149 { FR_CALL_ENV_PARSE_ONLY_OFFSET(STRINGIFY(_opt), FR_TYPE_OCTETS, CALL_ENV_FLAG_ATTRIBUTE, mschap_ ## _x ## _call_env_t, _opt) }
286 REDEBUG(
"No user identity found in current request");
301 if (*p !=
'[')
return 0;
303 for (p++; *p && !
done; p++) {
395 bool tainted =
false;
403 if (
strncasecmp(arg->vb_strvalue,
"Challenge", 9) == 0) {
406 if (!chap_challenge) {
407 REDEBUG(
"No MS-CHAP-Challenge in the request");
410 tainted = chap_challenge->vp_tainted;
416 if (chap_challenge->vp_length == 8) {
417 RDEBUG2(
"mschap1: %02x", chap_challenge->vp_octets[0]);
418 data = chap_challenge->vp_octets;
425 }
else if (chap_challenge->vp_length == 16) {
428 char const *username_str;
434 REDEBUG(
"Vendor-Specific.Microsoft.CHAP2-Response is required to calculate MS-CHAPv1 challenge");
447 if (response->vp_length < 50) {
448 REDEBUG(
"Vendor-Specific.Microsoft.CHAP-Response has the wrong format");
465 name_vp = response_name ? response_name : user_name;
470 username_str = memchr(name_vp->vp_strvalue,
'\\', name_vp->vp_length);
471 if (username_str != NULL) {
472 if (
inst->with_ntdomain_hack) {
475 RWDEBUG2(
"NT Domain delimiter found, should 'with_ntdomain_hack' be enabled?");
476 username_str = name_vp->vp_strvalue;
479 username_str = name_vp->vp_strvalue;
481 username_len = name_vp->vp_length - (username_str - name_vp->vp_strvalue);
484 ((user_name->vp_length != response_name->vp_length) ||
485 (memcmp(user_name->vp_strvalue, response_name->vp_strvalue, user_name->vp_length) != 0))) {
486 RWDEBUG2(
"%pP is not the same as %pP from EAP-MSCHAPv2", user_name, response_name);
494 RDEBUG2(
"Creating challenge with username \"%pV\"",
497 username_str, username_len);
501 REDEBUG(
"Invalid MS-CHAP challenge length");
509 }
else if (
strncasecmp(arg->vb_strvalue,
"NT-Response", 11) == 0) {
515 REDEBUG(
"No MS-CHAP-Response or MS-CHAP2-Response was found in the request");
518 tainted = response->vp_tainted;
525 REDEBUG(
"No NT-Response in MS-CHAP-Response");
529 if (response->vp_length < 50) {
530 REDEBUG(
"Vendor-Specific.Microsoft.CHAP-Response has the wrong format");
539 data = response->vp_octets + 26;
546 }
else if (
strncasecmp(arg->vb_strvalue,
"LM-Response", 11) == 0) {
550 REDEBUG(
"No MS-CHAP-Response was found in the request");
553 tainted = response->vp_tainted;
555 if (response->vp_length < 50) {
556 REDEBUG(
"Vendor-Specific.Microsoft.CHAP-Response has the wrong format");
563 if ((response->vp_octets[1] & 0x01) != 0) {
564 REDEBUG(
"No LM-Response in MS-CHAP-Response");
567 data = response->vp_octets + 2;
575 }
else if (
strncasecmp(arg->vb_strvalue,
"Domain-Name", 11) == 0) {
587 if (strncmp(user_name->vp_strvalue,
"host/", 5) == 0) {
594 p = strchr(user_name->vp_strvalue,
'.');
596 RDEBUG2(
"setting Domain-Name to same as machine name");
604 p = strchr(user_name->vp_strvalue,
'\\');
606 REDEBUG(
"No domain name was found in the User-Name");
625 }
else if (
strncasecmp(arg->vb_strvalue,
"NT-Domain", 9) == 0) {
637 if (strncmp(user_name->vp_strvalue,
"host/", 5) == 0) {
644 p = strchr(user_name->vp_strvalue,
'.');
646 RDEBUG2(
"setting NT-Domain to same as machine name");
660 p = strchr(user_name->vp_strvalue,
'\\');
662 REDEBUG(
"No NT-Domain was found in the User-Name");
681 }
else if (
strncasecmp(arg->vb_strvalue,
"User-Name", 9) == 0) {
693 if (strncmp(user_name->vp_strvalue,
"host/", 5) == 0) {
694 p = user_name->vp_strvalue + 5;
717 p = strchr(user_name->vp_strvalue,
'\\');
721 p = user_name->vp_strvalue;
732 }
else if (
strncasecmp(arg->vb_strvalue,
"NT-Hash", 7) == 0) {
733 arg = fr_value_box_list_next(
in, arg);
734 if ((!arg) || (arg->vb_length == 0))
738 REDEBUG(
"Failed generating Password.NT");
745 RDEBUG2(
"NT-Hash of \"known-good\" password: %pV", vb);
752 }
else if (
strncasecmp(arg->vb_strvalue,
"LM-Hash", 7) == 0) {
753 arg = fr_value_box_list_next(
in, arg);
754 if ((!arg) || (arg->vb_length == 0))
761 RDEBUG2(
"LM-Hash of %s = %pV", arg->vb_strvalue, vb);
765 REDEBUG(
"Unknown expansion string '%pV'", arg);
773 RWDEBUG2(
"Failed to do anything intelligent");
785 #ifdef WITH_AUTH_WINBIND
801 struct wbcContext **wb_ctx;
804 wb_ctx = talloc_zero(ctx,
struct wbcContext *);
805 *wb_ctx = wbcCtxCreate();
807 if (*wb_ctx == NULL) {
808 ERROR(
"failed to create winbind context");
837 static int write_all(
int fd,
char const *buf,
int len) {
846 rv = write(fd,
"\n", 1);
847 if (rv <= 0)
return rv;
885 int status, len, to_child=-1, from_child=-1;
886 pid_t pid, child_pid;
891 RDEBUG2(
"Doing MS-CHAPv2 password change via ntlm_auth helper");
899 REDEBUG(
"could not exec ntlm_auth cpw command");
907 vb = fr_value_box_list_head(&cpw_ctx->
cpw_user);
908 if (!vb)
goto ntlm_auth_err;
910 if (
write_all(to_child, vb->vb_strvalue, vb->vb_length) != (
int)vb->vb_length) {
911 REDEBUG(
"Failed to write username to child");
916 vb = fr_value_box_list_head(&cpw_ctx->
cpw_domain);
917 if (!vb)
goto no_domain;
919 if (
write_all(to_child, vb->vb_strvalue, vb->vb_length) != (
int)vb->vb_length) {
920 REDEBUG(
"Failed to write domain to child");
925 RWDEBUG2(
"No ntlm_auth domain set, username must be full-username to work");
929 len =
snprintf(buf,
sizeof(buf),
"new-nt-password-blob: ");
932 if (
write_all(to_child, buf, len) != len) {
933 RDEBUG2(
"failed to write new password blob to child");
937 len =
snprintf(buf,
sizeof(buf),
"old-nt-hash-blob: ");
940 if (
write_all(to_child, buf, len) != len) {
941 REDEBUG(
"Failed to write old hash blob to child");
949 len =
snprintf(buf,
sizeof(buf),
"new-lm-password-blob: %01032i", 0);
950 if (
write_all(to_child, buf, len) != len) {
951 REDEBUG(
"Failed to write dummy LM password to child");
954 len =
snprintf(buf,
sizeof(buf),
"old-lm-hash-blob: %032i", 0);
955 if (
write_all(to_child, buf, len) != len) {
956 REDEBUG(
"Failed to write dummy LM hash to child");
960 REDEBUG(
"Failed to send finish to child");
972 REDEBUG(
"Failure reading from child");
979 RDEBUG2(
"ntlm_auth said: %s", buf);
981 child_pid =
waitpid(pid, &status, 0);
982 if (child_pid == 0) {
983 REDEBUG(
"Timeout waiting for child");
986 if (child_pid != pid) {
991 if (strstr(buf,
"Password-Change: Yes")) {
992 RDEBUG2(
"ntlm_auth password change succeeded");
996 pmsg = strstr(buf,
"Password-Change-Error: ");
998 emsg =
strsep(&pmsg,
"\n");
1000 emsg =
"could not find error";
1002 REDEBUG(
"ntlm auth password change failed: %s", emsg);
1026 RDEBUG2(
"Doing MS-CHAPv2 password change locally");
1032 }
else if (vb->vb_length == 0) {
1033 REDEBUG(
"Local MS-CHAPv2 password change - didn't give any result, assuming failure");
1037 RDEBUG2(
"MS-CHAPv2 password change succeeded: %pV", vb);
1053 REDEBUG(
"MS-CHAPv2 password change not configured");
1073 #ifdef WITH_AUTH_WINBIND
1096 REDEBUG(
"FAILED: No Password.NT/LM. Cannot perform authentication");
1127 true,
true,
inst->ntlm_auth_timeout);
1136 p = strcasestr(
buffer,
"0xC0000");
1141 if (strcmp(p,
"224") == 0) {
1144 }
else if (strcmp(p,
"234") == 0) {
1147 }
else if (strcmp(p,
"072") == 0) {
1167 if (strcasestr(
buffer,
"0xC0000224") ||
1168 strcasestr(
buffer,
"Password expired") ||
1169 strcasestr(
buffer,
"Password has expired") ||
1170 strcasestr(
buffer,
"Password must be changed") ||
1171 strcasestr(
buffer,
"Must change password")) {
1175 if (strcasestr(
buffer,
"0xC0000234") ||
1176 strcasestr(
buffer,
"Account locked out")) {
1181 if (strcasestr(
buffer,
"0xC0000072") ||
1182 strcasestr(
buffer,
"Account disabled")) {
1187 if (strcasestr(
buffer,
"0xC000005E") ||
1188 strcasestr(
buffer,
"No logon servers")) {
1193 if (strcasestr(
buffer,
"could not obtain winbind separator") ||
1194 strcasestr(
buffer,
"Reading winbind reply failed")) {
1199 RDEBUG2(
"External script failed");
1200 p = strchr(
buffer,
'\n');
1213 if (memcmp(
buffer,
"NT_KEY: ", 8) != 0) {
1214 REDEBUG(
"Invalid output from ntlm_auth: expecting 'NT_KEY: ' prefix");
1221 len = strlen(
buffer + 8);
1223 REDEBUG2(
"Invalid output from ntlm_auth: NT_KEY too short, expected 32 bytes got %zu bytes",
1234 REDEBUG(
"Invalid output from ntlm_auth: NT_KEY has non-hex values");
1240 #ifdef WITH_AUTH_WINBIND
1249 RERROR(
"Internal error: Unknown mschap auth method (%d)", method);
1261 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1262 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1263 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1264 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
1267 { 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
1268 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
1269 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
1270 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2 };
1273 { 0x54, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74,
1274 0x68, 0x65, 0x20, 0x4d, 0x50, 0x50, 0x45, 0x20, 0x4d,
1275 0x61, 0x73, 0x74, 0x65, 0x72, 0x20, 0x4b, 0x65, 0x79 };
1278 { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69,
1279 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20,
1280 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
1281 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, 0x6b, 0x65, 0x79,
1282 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x73,
1283 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, 0x69, 0x64, 0x65,
1284 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
1285 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20,
1286 0x6b, 0x65, 0x79, 0x2e };
1289 { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69,
1290 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20,
1291 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
1292 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20,
1293 0x6b, 0x65, 0x79, 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68,
1294 0x65, 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73,
1295 0x69, 0x64, 0x65, 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73,
1296 0x20, 0x74, 0x68, 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20,
1297 0x6b, 0x65, 0x79, 0x2e };
1312 memcpy(masterkey, digest, 16);
1317 int keylen,
int issend)
1323 memset(digest, 0, 20);
1338 memcpy(sesskey, digest, keylen);
1370 memcpy (sendkey, enckey1, 16);
1371 memcpy (recvkey, enckey2, 16);
1400 RDEBUG2(
"Found MS-CHAP-Challenge, but no MS-CHAP response or Change-Password");
1404 if (!
inst->auth_type) {
1405 WARN(
"No 'authenticate %s {...}' section or 'Auth-Type = %s' set. Cannot setup MS-CHAP authentication",
1416 unsigned char ident,
int mschap_result,
int mschap_version,
fr_pair_t *smb_ctrl,
1422 char const *message = NULL;
1425 char new_challenge[33],
buffer[128];
1428 if ((mschap_result == -648) ||
1429 ((mschap_result == 0) &&
1431 REDEBUG(
"Password has expired. User should retry authentication");
1438 message =
"Password expired";
1447 }
else if ((mschap_result == -691) ||
1448 (smb_ctrl && (((smb_ctrl->vp_uint32 &
ACB_DISABLED) != 0) ||
1450 REDEBUG(
"SMB-Account-Ctrl (or ntlm_auth) "
1451 "says that the account is disabled, "
1452 "or is not a normal or workstation trust account");
1455 message =
"Account disabled";
1461 }
else if ((mschap_result == -647) ||
1462 (smb_ctrl && ((smb_ctrl->vp_uint32 &
ACB_AUTOLOCK) != 0))) {
1463 REDEBUG(
"SMB-Account-Ctrl (or ntlm_auth) "
1464 "says that the account is locked out");
1467 message =
"Account locked out";
1470 }
else if (mschap_result < 0) {
1473 retry =
inst->allow_retry;
1474 message =
"Authentication failed";
1480 switch (mschap_version) {
1482 for (p = new_challenge, i = 0; i < 2; i++) p +=
snprintf(p, 9,
"%08x",
fr_rand());
1484 error, retry, new_challenge);
1488 for (p = new_challenge, i = 0; i < 4; i++) p +=
snprintf(p, 9,
"%08x",
fr_rand());
1490 error, retry, new_challenge, message);
1531 if (request->parent) {
1535 if (password)
goto found_password;
1541 RWDEBUG2(
"No &control.%s or &control.%s found. Cannot create Password.NT",
1564 RERROR(
"Failed generating Password.NT");
1566 if (ephemeral) TALLOC_FREE(password);
1571 RDEBUG3(
"Hashed &control.%pP to create %s = %pV",
1577 if (ephemeral) TALLOC_FREE(password);
1587 RDEBUG3(
"Found &control.%pP", password);
1614 REDEBUG(
"Password change failed");
1625 RDEBUG2(
"Password change successful");
1638 int seq, new_nt_enc_len;
1648 RDEBUG2(
"MS-CHAPv2 password change request received");
1650 if (auth_ctx->
cpw->vp_length != 68) {
1651 REDEBUG(
"%s has the wrong format: length %zu != 68", env_data->
chap2_cpw->name, auth_ctx->
cpw->vp_length);
1655 if (auth_ctx->
cpw->vp_octets[0] != 7) {
1656 REDEBUG(
"%s has the wrong format: code %d != 7", env_data->
chap2_cpw->name, auth_ctx->
cpw->vp_octets[0]);
1673 for (seq = 1; seq < 4; seq++) {
1678 if (nt_enc->vp_length < 4) {
1683 if (nt_enc->vp_octets[0] != 6) {
1688 if ((nt_enc->vp_octets[2] == 0) && (nt_enc->vp_octets[3] == seq)) {
1699 if ((new_nt_enc_len + nt_enc->vp_length - 4) >
sizeof(cpw_ctx->
new_nt_encrypted)) {
1704 memcpy(cpw_ctx->
new_nt_encrypted + new_nt_enc_len, nt_enc->vp_octets + 4, nt_enc->vp_length - 4);
1705 new_nt_enc_len += nt_enc->vp_length - 4;
1708 if (new_nt_enc_len != 516) {
1709 REDEBUG(
"Unpacked %s length is %d - should be 516", env_data->
chap_nt_enc_pw->name, new_nt_enc_len);
1729 RDEBUG2(
"Password change payload valid");
1734 int *mschap_version,
1748 *mschap_version = 1;
1750 RDEBUG2(
"Processing MS-CHAPv1 response");
1755 if (challenge->vp_length < 8) {
1756 REDEBUG(
"%s has the wrong format", env_data->chap_challenge->name);
1763 if (response->vp_length < 50) {
1764 REDEBUG(
"%s has the wrong format", env_data->chap_response->name);
1772 if (!(response->vp_octets[1] & 0x01)) {
1773 REDEBUG2(
"Client used unsupported method LM-Password");
1782 mschap_result =
do_mschap(
inst, request, nt_password, challenge->vp_octets,
1783 response->vp_octets + offset, nthashhash, method, env_data);
1788 return mschap_error(p_result,
inst, request, *response->vp_octets, mschap_result, *mschap_version, smb_ctrl, env_data);
1792 int *mschap_version,
1804 fr_pair_t *user_name, *name_vp, *response_name, *peer_challenge_attr;
1805 uint8_t const *peer_challenge;
1806 char const *username_str;
1807 size_t username_len;
1812 *mschap_version = 2;
1814 RDEBUG2(
"Processing MS-CHAPv2 response");
1819 if (challenge->vp_length < 16) {
1820 REDEBUG(
"%s has the wrong format", env_data->chap_challenge->name);
1827 if (response->vp_length < 50) {
1828 REDEBUG(
"%s has the wrong format", env_data->chap2_response->name);
1848 name_vp = response_name ? response_name : user_name;
1853 if ((username_str = strchr(name_vp->vp_strvalue,
'\\')) != NULL) {
1854 if (
inst->with_ntdomain_hack) {
1857 RWDEBUG2(
"NT Domain delimiter found, should 'with_ntdomain_hack' be enabled?");
1858 username_str = name_vp->vp_strvalue;
1861 username_str = name_vp->vp_strvalue;
1863 username_len = name_vp->vp_length - (username_str - name_vp->vp_strvalue);
1865 if (response_name && ((user_name->vp_length != response_name->vp_length) ||
1866 (
strncasecmp(user_name->vp_strvalue, response_name->vp_strvalue, user_name->vp_length) != 0))) {
1867 RWDEBUG(
"%pP is not the same as %pP from EAP-MSCHAPv2", user_name, response_name);
1879 if (!nt_password &&
inst->open_directory) {
1880 RDEBUG2(
"No Password.NT available. Trying OpenDirectory Authentication");
1881 od_mschap_auth(&rcode, request, challenge, user_name, env_data);
1885 peer_challenge = response->vp_octets + 2;
1888 if (peer_challenge_attr) {
1889 RDEBUG2(
"Overriding peer challenge");
1890 peer_challenge = peer_challenge_attr->vp_octets;
1900 RDEBUG2(
"Creating challenge with username \"%pV\"",
1904 challenge->vp_octets,
1905 username_str, username_len);
1907 mschap_result =
do_mschap(
inst, request, nt_password, mschap_challenge,
1908 response->vp_octets + 26, nthashhash, method, env_data);
1914 mschap_result, *mschap_version, smb_ctrl, env_data);
1917 #ifdef WITH_AUTH_WINBIND
1918 if (
inst->wb_retry_with_normalised_username) {
1920 if (response_name) {
1921 if (strcmp(username_str, response_name->vp_strvalue)) {
1922 RDEBUG2(
"Normalising username %pV -> %pV",
1924 &response_name->data);
1925 username_str = response_name->vp_strvalue;
1934 response->vp_octets + 26,
1936 challenge->vp_octets,
1938 if (env_data->chap2_success)
mschap_add_reply(request, *response->vp_octets,
1956 int mschap_version = 0;
1959 if (auth_ctx->
cpw) {
1966 REDEBUG(
"Missing Password.NT - required for change password request");
1970 REDEBUG(
"chap_nt_enc_pw option is not set - required for change password request");
1983 RDEBUG2(
"Clearing expiry bit in SMB-Acct-Ctrl to allow authentication");
1996 p[0] = auth_ctx->
cpw->vp_octets[1];
1999 memcpy(p + 2, auth_ctx->
cpw->vp_octets + 18, 48);
2004 REDEBUG(
"&control.Auth-Type = %s set for a request that does not contain &%s",
2021 &mschap_version, nthashhash,
2024 challenge, response,
2029 &mschap_version, nthashhash,
2032 challenge, response,
2036 REDEBUG(
"&control.Auth-Type = %s set for a request that does not contain &%s or &%s attributes",
2043 if (
inst->use_mppe) {
2048 switch (mschap_version) {
2050 RDEBUG2(
"Generating MS-CHAPv1 MPPE keys");
2051 memset(mppe_sendkey, 0, 32);
2070 RDEBUG2(
"Generating MS-CHAPv2 MPPE keys");
2083 vp->vp_uint32 =
inst->require_encryption ? 2 : 1;
2086 vp->vp_uint32 =
inst->require_strong ? 4 : 6;
2115 EVP_CIPHER_CTX *evp_ctx;
2117 int c, ntlen =
sizeof(nt_pass_decrypted);
2118 size_t passlen, i = 0, len = 0;
2123 MEM(evp_ctx = EVP_CIPHER_CTX_new());
2125 if (
unlikely(EVP_EncryptInit_ex(evp_ctx, EVP_rc4(), NULL, auth_ctx->
nt_password->vp_octets, NULL) != 1)) {
2126 fr_tls_strerror_printf(NULL);
2127 RPERROR(
"Failed initialising RC4 ctx");
2131 if (
unlikely(EVP_CIPHER_CTX_set_key_length(evp_ctx, auth_ctx->
nt_password->vp_length)) != 1) {
2132 fr_tls_strerror_printf(NULL);
2133 RPERROR(
"Failed setting key length");
2138 fr_tls_strerror_printf(NULL);
2139 RPERROR(
"Failed ingesting new password");
2143 EVP_CIPHER_CTX_free(evp_ctx);
2151 passlen = nt_pass_decrypted[512];
2152 passlen += nt_pass_decrypted[513] << 8;
2153 if ((nt_pass_decrypted[514] != 0) ||
2154 (nt_pass_decrypted[515] != 0)) {
2155 REDEBUG(
"Decrypted new password blob claims length > 65536, probably an invalid Password.NT");
2162 if (passlen > 512) {
2163 REDEBUG(
"Decrypted new password blob claims length %zu > 512, "
2164 "probably an invalid Password.NT", passlen);
2168 p = nt_pass_decrypted + 512 - passlen;
2185 REDEBUG(
"Old NT hash value from client does not match our value");
2198 new_pass->vp_length = 0;
2200 while (i < passlen) {
2209 }
else if (c < 0x7ff) {
2222 while (i < passlen) {
2232 }
else if (c < 0x7ff) {
2233 *x++ = 0xc0 + (c >> 6);
2234 *x++ = 0x80 + (c & 0x3f);
2237 *x++ = 0xe0 + (c >> 12);
2238 *x++ = 0x80 + ((c>>6) & 0x3f);
2239 *x++ = 0x80 + (c & 0x3f);
2279 .method =
inst->method,
2280 .env_data = env_data,
2301 if (smb_account_ctrl_text) {
2316 RDEBUG2(
"SMB-Account-Ctrl says no password is required");
2336 if (auth_ctx->
cpw) {
2341 REDEBUG(
"Missing Password.NT - required for change password request");
2347 switch (auth_ctx->
method) {
2359 REDEBUG(
"Local MS-CHAPv2 password changes require OpenSSL support");
2365 REDEBUG(
"No ntlm_auth username set, passchange will definitely fail!");
2395 if (!
inst->auth_type) {
2396 WARN(
"Failed to find 'authenticate %s {...}' section. MS-CHAP authentication will likely not work",
2405 if (
inst->wb_username) {
2406 #ifdef WITH_AUTH_WINBIND
2407 inst->method = AUTH_WBCLIENT;
2410 if (!
inst->wb_pool) {
2411 cf_log_err(
conf,
"Unable to initialise winbind connection pool");
2421 if (
inst->ntlm_auth) {
2425 switch (
inst->method) {
2427 DEBUG(
"Using internal authentication");
2430 DEBUG(
"Using auto password or ntlm_auth");
2433 DEBUG(
"Authenticating by calling 'ntlm_auth'");
2435 #ifdef WITH_AUTH_WINBIND
2437 DEBUG(
"Authenticating directly to winbind");
2449 cf_log_err(
conf,
"ntml_auth_timeout '%pVs' is too small (minimum: 1s)",
2454 cf_log_err(
conf,
"ntlm_auth_timeout '%pVs' is too large (maximum: 10s)",
2459 #define CHECK_OPTION(_option) cp = cf_pair_find(attrs, STRINGIFY(_option)); \
2461 WARN("Missing option \"" STRINGIFY(_option) "\", setting use_mppe to \"no\""); \
2462 inst->use_mppe = false; \
2463 goto done_mppe_check; \
2470 if (
inst->use_mppe) {
2505 #ifndef WITH_AUTH_WINBIND
2510 #ifdef WITH_AUTH_WINBIND
2533 .method_env = &mschap_autz_method_env },
unlang_action_t
Returned by unlang_op_t calls, determine the next action of the interpreter.
@ UNLANG_ACTION_PUSHED_CHILD
unlang_t pushed a new child onto the stack, execute it instead of continuing.
static int const char char buffer[256]
int do_auth_wbclient(rlm_mschap_t const *inst, request_t *request, uint8_t const *challenge, uint8_t const *response, uint8_t nthashhash[NT_DIGEST_LENGTH], mschap_auth_call_env_t *env_data)
Check NTLM authentication direct to winbind via Samba's libwbclient library.
#define fr_base16_encode(_out, _in)
#define fr_base16_decode(_err, _out, _in, _no_trailing)
#define USES_APPLE_DEPRECATED_API
#define CALL_ENV_TERMINATOR
#define FR_CALL_ENV_METHOD_OUT(_inst)
Helper macro for populating the size/type fields of a call_env_method_t from the output structure typ...
@ CALL_ENV_FLAG_SUBSECTION
This is a subsection.
@ CALL_ENV_FLAG_ATTRIBUTE
Tmpl must contain an attribute reference.
@ CALL_ENV_FLAG_REQUIRED
Associated conf pair or section is required.
@ CALL_ENV_FLAG_NULLABLE
Tmpl expansions are allowed to produce no output.
#define FR_CALL_ENV_SUBSECTION(_name, _ident2, _flags, _subcs)
Specify a call_env_parser_t which defines a nested subsection.
#define FR_CALL_ENV_OFFSET(_name, _cast_type, _flags, _struct, _field)
Specify a call_env_parser_t which writes out runtime results to the specified field.
#define FR_CALL_ENV_PARSE_ONLY_OFFSET(_name, _cast_type, _flags, _struct, _parse_field)
Specify a call_env_parser_t which writes out the result of the parsing phase to the field specified.
#define CONF_PARSER_TERMINATOR
#define FR_CONF_DEPRECATED(_name, _struct, _field)
conf_parser_t entry which raises an error if a matching CONF_PAIR is found
#define FR_CONF_OFFSET(_name, _struct, _field)
conf_parser_t which parses a single CONF_PAIR, writing the result to a field in a struct
#define FR_CONF_POINTER(_name, _type, _flags, _res_p)
conf_parser_t which parses a single CONF_PAIR producing a single global result
#define FR_CONF_OFFSET_FLAGS(_name, _flags, _struct, _field)
conf_parser_t which parses a single CONF_PAIR, writing the result to a field in a struct
@ CONF_FLAG_XLAT
string will be dynamically expanded.
@ CONF_FLAG_SUBSECTION
Instead of putting the information into a configuration structure, the configuration file routines MA...
Defines a CONF_PAIR to C data type mapping.
Configuration AVP similar to a fr_pair_t.
A section grouping multiple CONF_PAIR.
CONF_SECTION * cf_section_find(CONF_SECTION const *cs, char const *name1, char const *name2)
Find a CONF_SECTION with name1 and optionally name2.
#define cf_log_err(_cf, _fmt,...)
#define FR_DBUFF_TMP(_start, _len_or_end)
Creates a compound literal to pass into functions which accept a dbuff.
static int fr_dcursor_append(fr_dcursor_t *cursor, void *v)
Insert a single item at the end of the list.
static fr_time_delta_t timeout
fr_dict_attr_t const ** out
Where to write a pointer to the resolved fr_dict_attr_t.
fr_dict_t const ** out
Where to write a pointer to the loaded/resolved fr_dict_t.
fr_dict_enum_value_t * fr_dict_enum_by_name(fr_dict_attr_t const *da, char const *name, ssize_t len)
Specifies an attribute which must be present for the module to function.
Specifies a dictionary which must be loaded/loadable for the module to function.
dl_module_inst_t const * dl_module_instance_by_data(void const *data)
Lookup a dl_module_inst_t via instance data.
char const *_CONST name
Instance name.
void *_CONST data
Module instance's parsed configuration.
#define MODULE_MAGIC_INIT
Stop people using different module/library/server versions together.
CONF_SECTION *_CONST conf
Module's instance configuration.
#define EXEC_TIMEOUT
Default wait time for exec calls (in seconds).
int radius_exec_program_legacy(char *out, size_t outlen, request_t *request, char const *cmd, fr_pair_list_t *input_pairs, bool exec_wait, bool shell_escape, fr_time_delta_t timeout)
Execute a program.
pid_t radius_start_program_legacy(int *stdin_fd, int *stdout_fd, int *stderr_fd, char const *cmd, request_t *request, bool exec_wait, fr_pair_list_t *input_pairs, bool shell_escape)
Start a process.
int radius_readfrom_program_legacy(int fd, pid_t pid, fr_time_delta_t timeout, char *answer, int left)
Read from the child process.
#define unlang_function_push(_request, _func, _repeat, _signal, _sigmask, _top_frame, _uctx)
Push a generic function onto the unlang stack.
static xlat_action_t mschap_xlat(TALLOC_CTX *ctx, fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *in)
Get data from MSCHAP attributes.
TALLOC_CTX * unlang_interpret_frame_talloc_ctx(request_t *request)
Get a talloc_ctx which is valid only for this frame.
#define REXDENT()
Exdent (unindent) R* messages by one level.
#define RHEXDUMP1(_data, _len, _fmt,...)
#define RDEBUG_ENABLED3
True if request debug level 1-3 messages are enabled.
#define RWDEBUG2(fmt,...)
#define REDEBUG2(fmt,...)
#define RINDENT()
Indent R* messages by one level.
waitpid(reap->pid_ev->pid, &status, 0)
void fr_md4_calc(uint8_t out[static MD4_DIGEST_LENGTH], uint8_t const *in, size_t inlen)
Calculate the MD4 hash of the contents of a buffer.
#define MD4_DIGEST_LENGTH
@ FR_TYPE_STRING
String of printable characters.
@ FR_TYPE_UINT8
8 Bit unsigned integer.
@ FR_TYPE_UINT32
32 Bit unsigned integer.
@ FR_TYPE_OCTETS
Raw octets.
int fr_digest_cmp(uint8_t const *a, uint8_t const *b, size_t length)
Do a comparison of two authentication digests by comparing the FULL data.
int strncasecmp(char *s1, char *s2, int n)
int strcasecmp(char *s1, char *s2)
char * strsep(char **stringp, char const *delim)
void * env_data
Per call environment data.
#define MODULE_INST_CTX(_dl_inst)
Wrapper to create a module_inst_ctx_t as a compound literal.
dl_module_inst_t const * inst
Dynamic loader API handle for the module.
dl_module_inst_t const * inst
Dynamic loader API handle for the module.
Temporary structure to hold arguments for module calls.
Temporary structure to hold arguments for instantiation calls.
Specifies a module method identifier.
bool module_rlm_section_type_set(request_t *request, fr_dict_attr_t const *type_da, fr_dict_enum_value_t const *enumv)
Set the next section type if it's not already set.
fr_pool_t * module_rlm_connection_pool_init(CONF_SECTION *module, void *opaque, fr_pool_connection_create_t c, fr_pool_connection_alive_t a, char const *log_prefix, char const *trigger_prefix, fr_pair_list_t *trigger_args)
Initialise a module specific connection pool.
module_t common
Common fields presented by all modules.
int mschap_nt_password_hash(uint8_t out[static NT_DIGEST_LENGTH], char const *password)
Converts Unicode password to 16-byte NT hash with MD4.
void mschap_add_reply(request_t *request, uint8_t ident, fr_dict_attr_t const *da, char const *value, size_t len)
void mschap_auth_response(char const *username, size_t username_len, uint8_t const *nt_hash_hash, uint8_t const *ntresponse, uint8_t const *peer_challenge, uint8_t const *auth_challenge, char *response)
void mschap_challenge_hash(uint8_t challenge[static MSCHAP_CHALLENGE_LENGTH], uint8_t const peer_challenge[static MSCHAP_PEER_CHALLENGE_LENGTH], uint8_t const auth_challenge[static MSCHAP_PEER_AUTHENTICATOR_CHALLENGE_LENGTH], char const *user_name, size_t user_name_len)
fr_pair_t * fr_pair_find_by_da(fr_pair_list_t const *list, fr_pair_t const *prev, fr_dict_attr_t const *da)
Find the first pair with a matching da.
fr_pair_t * fr_pair_parent(fr_pair_t const *vp)
Return a pointer to the parent pair.
fr_pair_t * fr_pair_afrom_da(TALLOC_CTX *ctx, fr_dict_attr_t const *da)
Dynamically allocate a new attribute and assign a fr_dict_attr_t.
int fr_pair_value_memdup(fr_pair_t *vp, uint8_t const *src, size_t len, bool tainted)
Copy data into an "octets" data type.
int fr_pair_value_bstr_alloc(fr_pair_t *vp, char **out, size_t size, bool tainted)
Pre-allocate a memory buffer for a "string" type value pair.
fr_pair_t * fr_pair_find_by_da_nested(fr_pair_list_t const *list, fr_pair_t const *prev, fr_dict_attr_t const *da)
Find a pair with a matching fr_dict_attr_t, by walking the nested fr_dict_attr_t tree.
int fr_pair_value_mem_alloc(fr_pair_t *vp, uint8_t **out, size_t size, bool tainted)
Pre-allocate a memory buffer for a "octets" type value pair.
static ssize_t normify(normalise_t *action, uint8_t *buffer, size_t bufflen, char const *known_good, size_t len, size_t min_len)
fr_pair_t * password_find(bool *ephemeral, TALLOC_CTX *ctx, request_t *request, fr_dict_attr_t const *allowed_attrs[], size_t allowed_attrs_len, bool normify)
Find a "known good" password in the control list of a request.
void fr_pool_free(fr_pool_t *pool)
Delete a connection pool.
static const conf_parser_t config[]
static fr_dict_attr_t const * attr_user_name
#define pair_update_request(_attr, _da)
uint32_t fr_rand(void)
Return a 32-bit random number.
#define RETURN_MODULE_REJECT
#define RETURN_MODULE_NOOP
#define RETURN_MODULE_RCODE(_rcode)
#define RETURN_MODULE_INVALID
rlm_rcode_t
Return codes indicating the result of the module call.
@ RLM_MODULE_INVALID
The module considers the request invalid.
@ RLM_MODULE_OK
The module is OK, continue.
@ RLM_MODULE_DISALLOW
Reject the request (user is locked out).
@ RLM_MODULE_REJECT
Immediately reject the request.
@ RLM_MODULE_NOTFOUND
User not found.
@ RLM_MODULE_NOOP
Module succeeded without doing anything.
static int _mod_conn_free(rlm_cache_memcached_handle_t *mandle)
Free a connection handle.
static void * mod_conn_create(TALLOC_CTX *ctx, void *instance, fr_time_delta_t timeout)
Create a new memcached handle.
static const uint8_t SHSpad2[40]
fr_dict_attr_t const * attr_smb_account_ctrl
uint8_t new_nt_encrypted[516]
#define CHECK_OPTION(_option)
static const call_env_parser_t xlat_call_env[]
static void mppe_chap2_get_keys128(uint8_t const *nt_hashhash, uint8_t const *nt_response, uint8_t *sendkey, uint8_t *recvkey)
static void mppe_add_reply(UNUSED rlm_mschap_t const *inst, request_t *request, fr_dict_attr_t const *da, uint8_t const *value, size_t len)
fr_dict_attr_t const * attr_nt_password
fr_dict_attr_t const * attr_ms_chap_new_cleartext_password
fr_dict_autoload_t rlm_mschap_dict[]
#define ACB_MNS
MNS logon user account.
static const call_env_parser_t auth_call_env[]
tmpl_t const * chap_response
static int write_all(int fd, char const *buf, int len)
MSCHAP_AUTH_METHOD method
fr_dict_attr_t const * attr_eap_identity
tmpl_t const * chap2_response
#define ACB_AUTOLOCK
Account auto locked.
#define MSCHAP_CALL_ENV(_x)
fr_dict_attr_t const * attr_smb_account_ctrl_text
static const call_env_parser_t autz_call_env[]
#define ACB_TEMPDUP
Temporary duplicate account.
static int pdb_decode_acct_ctrl(char const *p)
static fr_dict_t const * dict_freeradius
static void mppe_GetMasterKey(uint8_t const *nt_hashhash, uint8_t const *nt_response, uint8_t *masterkey)
static const call_env_method_t mschap_auth_method_env
static fr_pair_t * mschap_identity_find(request_t *request, fr_dict_attr_t const *attr_user_name)
static int nt_password_find(TALLOC_CTX *ctx, fr_pair_t **out, rlm_mschap_t const *inst, request_t *request)
Find a Password.NT value, or create one from a Password.Cleartext, or Password.With-Header attribute.
#define ACB_FR_EXPIRED
Password Expired.
#define ACB_DISABLED
User account disabled.
static unlang_action_t mschap_process_response(rlm_rcode_t *p_result, int *mschap_version, uint8_t nthashhash[static NT_DIGEST_LENGTH], rlm_mschap_t const *inst, request_t *request, fr_pair_t *smb_ctrl, fr_pair_t *nt_password, fr_pair_t *challenge, fr_pair_t *response, MSCHAP_AUTH_METHOD method, mschap_auth_call_env_t *env_data)
static fr_dict_t const * dict_radius
static const uint8_t magic1[27]
static unlang_action_t mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
static int mod_bootstrap(module_inst_ctx_t const *mctx)
static const uint8_t SHSpad1[40]
fr_dict_attr_t const * attr_auth_type
static int mod_detach(UNUSED module_detach_ctx_t const *mctx)
fr_dict_attr_t const * attr_ms_chap_user_name
rlm_mschap_t const * inst
tmpl_t const * chap_response
fr_value_box_list_t cpw_user
fr_value_box_list_t cpw_domain
static void mppe_GetAsymmetricStartKey(uint8_t *masterkey, uint8_t *sesskey, int keylen, int issend)
static xlat_arg_parser_t const mschap_xlat_args[]
fr_dict_attr_t const * attr_ms_chap_use_ntlm_auth
#define ACB_HOMDIRREQ
Home directory required.
tmpl_t const * chap2_response
fr_value_box_list_t local_cpw_result
fr_dict_attr_t const * attr_cleartext_password
static unlang_action_t mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
fr_dict_attr_autoload_t rlm_mschap_dict_attr[]
static unlang_action_t mod_authenticate_resume(rlm_rcode_t *p_result, UNUSED int *priority, request_t *request, void *uctx)
Complete mschap authentication after any tmpls have been expanded.
static unlang_action_t mschap_process_v2_response(rlm_rcode_t *p_result, int *mschap_version, uint8_t nthashhash[static NT_DIGEST_LENGTH], rlm_mschap_t const *inst, request_t *request, fr_pair_t *smb_ctrl, fr_pair_t *nt_password, fr_pair_t *challenge, fr_pair_t *response, MSCHAP_AUTH_METHOD method, mschap_auth_call_env_t *env_data)
mschap_auth_call_env_t * env_data
static const uint8_t magic3[84]
static int do_mschap_cpw(rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx, uint8_t *new_nt_password, uint8_t *old_nt_hash)
static const uint8_t magic2[84]
static int do_mschap(rlm_mschap_t const *inst, request_t *request, fr_pair_t *password, uint8_t const *challenge, uint8_t const *response, uint8_t nthashhash[static NT_DIGEST_LENGTH], MSCHAP_AUTH_METHOD method, UNUSED mschap_auth_call_env_t *env_data)
#define ACB_DOMTRUST
Interdomain trust account.
uint8_t old_nt_hash[NT_DIGEST_LENGTH]
#define ACB_WSTRUST
Workstation trust account.
static void mppe_chap2_gen_keys128(uint8_t const *nt_hashhash, uint8_t const *response, uint8_t *sendkey, uint8_t *recvkey)
fr_dict_attr_t const * attr_ms_chap_new_nt_password
#define ACB_NORMAL
Normal user account.
mschap_cpw_ctx_t * cpw_ctx
tmpl_t const * chap_challenge
#define ACB_PWNOTREQ
User password not required.
static unlang_action_t mschap_error(rlm_rcode_t *p_result, rlm_mschap_t const *inst, request_t *request, unsigned char ident, int mschap_result, int mschap_version, fr_pair_t *smb_ctrl, mschap_auth_call_env_t *env_data)
static const conf_parser_t module_config[]
static unlang_action_t mschap_process_cpw_request(rlm_rcode_t *p_result, rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx)
static unlang_action_t mod_authenticate_domain_tmpl_push(rlm_rcode_t *p_result, UNUSED int *priority, request_t *request, void *uctx)
When changing passwords using the ntlm_auth helper, evaluate the domain tmpl.
fr_dict_attr_t const * attr_ms_chap_peer_challenge
static int mschap_cpw_prepare(request_t *request, mschap_auth_ctx_t *auth_ctx)
Validate data required for change password requests.
#define MSCHAP_OPT_CALL_ENV(_opt, _x)
static int mod_instantiate(module_inst_ctx_t const *mctx)
#define ACB_PWNOEXP
User password does not expire.
static const conf_parser_t passchange_config[]
tmpl_t const * chap_challenge
#define MSCHAP_COMMON_CALL_ENV(_x)
#define ACB_SVRTRUST
Server trust account.
static const conf_parser_t winbind_config[]
tmpl_t const * mppe_encryption_types
tmpl_t const * ntlm_cpw_domain
tmpl_t const * ntlm_cpw_username
tmpl_t const * chap_nt_enc_pw
tmpl_t const * mppe_send_key
tmpl_t const * chap_response
tmpl_t const * chap_challenge
tmpl_t const * chap2_response
tmpl_t const * mppe_encryption_policy
tmpl_t const * mppe_recv_key
tmpl_t const * chap_error
tmpl_t const * chap_mppe_keys
static int instantiate(module_inst_ctx_t const *mctx)
#define FR_SBUFF_IN(_start, _len_or_end)
#define FR_SBUFF_OUT(_start, _len_or_end)
#define MODULE_NAME_TERMINATOR
#define pair_append_control(_attr, _da)
Allocate and append a fr_pair_t to the control list.
#define pair_update_reply(_attr, _da)
Return or allocate a fr_pair_t in the reply list.
static fr_dict_attr_t const * tmpl_attr_tail_da(tmpl_t const *vpt)
Return the last attribute reference da.
void fr_sha1_init(fr_sha1_ctx *context)
void fr_sha1_final(uint8_t digest[static SHA1_DIGEST_LENGTH], fr_sha1_ctx *context)
void fr_sha1_update(fr_sha1_ctx *context, uint8_t const *in, size_t len)
void smbhash(unsigned char *out, unsigned char const *in, unsigned char *key)
void smbdes_mschap(uint8_t const win_password[16], uint8_t const *challenge, uint8_t *response)
void smbdes_lmpwdhash(char const *password, uint8_t *lmhash)
PUBLIC int snprintf(char *string, size_t length, char *format, va_alist)
MEM(pair_append_request(&vp, attr_eap_aka_sim_identity) >=0)
eap_aka_sim_process_conf_t * inst
Stores an attribute, a value and various bits of other data.
fr_dict_attr_t const *_CONST da
Dictionary attribute defines the attribute number, vendor and type of the pair.
char const * fr_syserror(int num)
Guaranteed to be thread-safe version of strerror.
#define talloc_get_type_abort_const
#define fr_time_delta_lt(_a, _b)
static fr_time_delta_t fr_time_delta_from_sec(int64_t sec)
#define fr_time_delta_ispos(_a)
#define fr_time_delta_gt(_a, _b)
A time delta, a difference in time measured in nanoseconds.
int unlang_tmpl_push(TALLOC_CTX *ctx, fr_value_box_list_t *out, request_t *request, tmpl_t const *tmpl, unlang_tmpl_args_t *args)
Push a tmpl onto the stack for evaluation.
bool required
Argument must be present, and non-empty.
#define XLAT_ARG_PARSER_TERMINATOR
@ XLAT_ACTION_FAIL
An xlat function failed.
@ XLAT_ACTION_DONE
We're done evaluating this level of nesting.
Definition for a single argument consumend by an xlat function.
int fr_value_box_asprintf(TALLOC_CTX *ctx, fr_value_box_t *dst, fr_dict_attr_t const *enumv, bool tainted, char const *fmt,...)
Print a formatted string using our internal printf wrapper and assign it to a value box.
int fr_value_box_strdup(TALLOC_CTX *ctx, fr_value_box_t *dst, fr_dict_attr_t const *enumv, char const *src, bool tainted)
Copy a nul terminated string to a fr_value_box_t.
int fr_value_box_memdup(TALLOC_CTX *ctx, fr_value_box_t *dst, fr_dict_attr_t const *enumv, uint8_t const *src, size_t len, bool tainted)
Copy a buffer to a fr_value_box_t.
#define fr_box_strvalue_len(_val, _len)
#define fr_box_time_delta(_val)
#define fr_value_box_alloc_null(_ctx)
Allocate a value box for later use with a value assignment function.
static size_t char ** out
#define fr_box_octets(_val, _len)
module_ctx_t const * mctx
Synthesised module calling ctx.
void * env_data
Expanded call env data.
int xlat_func_args_set(xlat_t *x, xlat_arg_parser_t const args[])
Register the arguments of an xlat.
void xlat_func_call_env_set(xlat_t *x, call_env_method_t const *env_method)
Register call environment of an xlat.
xlat_t * xlat_func_register_module(TALLOC_CTX *ctx, module_inst_ctx_t const *mctx, char const *name, xlat_func_t func, fr_type_t return_type)
Register an xlat function for a module.