The FreeRADIUS server $Id: 15bac2a4c627c01d1aa2047687b3418955ac7f00 $
Loading...
Searching...
No Matches
rlm_mschap.c
Go to the documentation of this file.
1/*
2 * This program is is free software; you can redistribute it and/or modify
3 * it under the terms of the GNU General Public License as published by
4 * the Free Software Foundation; either version 2 of the License, or (at
5 * your option) any later version.
6 *
7 * This program is distributed in the hope that it will be useful,
8 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10 * GNU General Public License for more details.
11 *
12 * You should have received a copy of the GNU General Public License
13 * along with this program; if not, write to the Free Software
14 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
15 */
16
17/**
18 * $Id: 589966642533d161094c555294f4d9ac742aba59 $
19 * @file rlm_mschap.c
20 * @brief Implemented mschap authentication.
21 *
22 * @copyright 2000, 2001, 2006 The FreeRADIUS server project
23 */
24
25/* MPPE support from Takahiro Wagatsuma <waga@sic.shibaura-it.ac.jp> */
26
27RCSID("$Id: 589966642533d161094c555294f4d9ac742aba59 $")
28
29#define LOG_PREFIX mctx->mi->name
30
31#include <freeradius-devel/server/base.h>
32#include <freeradius-devel/server/exec_legacy.h>
33#include <freeradius-devel/server/module_rlm.h>
34#include <freeradius-devel/server/password.h>
35#include <freeradius-devel/tls/strerror.h>
36#include <freeradius-devel/util/debug.h>
37#include <freeradius-devel/radius/defs.h>
38
39#include <freeradius-devel/util/base16.h>
40#include <freeradius-devel/util/md4.h>
41#include <freeradius-devel/util/md5.h>
42#include <freeradius-devel/util/misc.h>
43#include <freeradius-devel/util/sha1.h>
44
45#include <freeradius-devel/unlang/function.h>
46#include <freeradius-devel/unlang/xlat_func.h>
47
48#include <sys/wait.h>
49
50#include "rlm_mschap.h"
51#include "smbdes.h"
52
53#ifdef WITH_AUTH_WINBIND
54#include "auth_wbclient.h"
55#endif
56
57#ifdef WITH_TLS
58USES_APPLE_DEPRECATED_API /* OpenSSL API has been deprecated by Apple */
59# include <freeradius-devel/tls/openssl_user_macros.h>
60# include <openssl/rc4.h>
61#endif
62
63#ifdef __APPLE__
64unlang_action_t od_mschap_auth(rlm_rcode_t *p_result, request_t *request, fr_pair_t *challenge, fr_pair_t *usernamepair,
65 mschap_auth_call_env_t *env_data);
66#endif
67
68/* Allowable account control bits */
69#define ACB_DISABLED 0x00010000 //!< User account disabled.
70#define ACB_HOMDIRREQ 0x00020000 //!< Home directory required.
71#define ACB_PWNOTREQ 0x00040000 //!< User password not required.
72#define ACB_TEMPDUP 0x00080000 //!< Temporary duplicate account.
73#define ACB_NORMAL 0x00100000 //!< Normal user account.
74#define ACB_MNS 0x00200000 //!< MNS logon user account.
75#define ACB_DOMTRUST 0x00400000 //!< Interdomain trust account.
76#define ACB_WSTRUST 0x00800000 //!< Workstation trust account.
77#define ACB_SVRTRUST 0x01000000 //!< Server trust account.
78#define ACB_PWNOEXP 0x02000000 //!< User password does not expire.
79#define ACB_AUTOLOCK 0x04000000 //!< Account auto locked.
80#define ACB_FR_EXPIRED 0x00020000 //!< Password Expired.
81
86
87#ifdef WITH_AUTH_WINBIND
88static conf_parser_t reuse_winbind_config[] = {
89 FR_SLAB_CONFIG_CONF_PARSER
90 CONF_PARSER_TERMINATOR
91};
92#endif
93
94static const conf_parser_t winbind_config[] = {
95 { FR_CONF_OFFSET("username", rlm_mschap_t, wb_username) },
96#ifdef WITH_AUTH_WINBIND
97 { FR_CONF_OFFSET("retry_with_normalised_username", rlm_mschap_t, wb_retry_with_normalised_username), .dflt = "no" },
98 { FR_CONF_OFFSET_SUBSECTION("reuse", 0, rlm_mschap_t, reuse, reuse_winbind_config) },
99#endif
100 CONF_PARSER_TERMINATOR
101};
102
103static const conf_parser_t module_config[] = {
104 { FR_CONF_OFFSET("normalise", rlm_mschap_t, normify), .dflt = "yes" },
105
106 /*
107 * Cache the password by default.
108 */
109 { FR_CONF_OFFSET("use_mppe", rlm_mschap_t, use_mppe), .dflt = "yes" },
110 { FR_CONF_OFFSET("require_encryption", rlm_mschap_t, require_encryption), .dflt = "no" },
111 { FR_CONF_OFFSET("require_strong", rlm_mschap_t, require_strong), .dflt = "no" },
112 { FR_CONF_OFFSET("with_ntdomain_hack", rlm_mschap_t, with_ntdomain_hack), .dflt = "yes" },
113 { FR_CONF_OFFSET_FLAGS("ntlm_auth", CONF_FLAG_XLAT, rlm_mschap_t, ntlm_auth) },
114 { FR_CONF_OFFSET("ntlm_auth_timeout", rlm_mschap_t, ntlm_auth_timeout) },
115
116 { FR_CONF_POINTER("passchange", 0, CONF_FLAG_SUBSECTION, NULL), .subcs = (void const *) passchange_config },
117 { FR_CONF_OFFSET("allow_retry", rlm_mschap_t, allow_retry), .dflt = "yes" },
118 { FR_CONF_OFFSET("retry_msg", rlm_mschap_t, retry_msg) },
119
120
121#ifdef __APPLE__
122 { FR_CONF_OFFSET("use_open_directory", rlm_mschap_t, open_directory), .dflt = "yes" },
123#endif
124
125 { FR_CONF_POINTER("winbind", 0, CONF_FLAG_SUBSECTION, NULL), .subcs = (void const *) winbind_config },
126
127 /*
128 * These are now in a subsection above.
129 */
130 { FR_CONF_DEPRECATED("winbind_username", rlm_mschap_t, wb_username) },
131#ifdef WITH_AUTH_WINBIND
132 { FR_CONF_DEPRECATED("winbind_retry_with_normalised_username", rlm_mschap_t, wb_retry_with_normalised_username) },
133#endif
134 CONF_PARSER_TERMINATOR
135};
136
137#define MSCHAP_CALL_ENV(_x) \
138static const call_env_method_t mschap_ ## _x ## _method_env = { \
139 FR_CALL_ENV_METHOD_OUT(mschap_ ## _x ## _call_env_t), \
140 .env = (call_env_parser_t[]){ \
141 { FR_CALL_ENV_SUBSECTION("attributes", NULL, CALL_ENV_FLAG_REQUIRED, _x ## _call_env) }, \
142 CALL_ENV_TERMINATOR \
143 } \
144}
145
146#define MSCHAP_COMMON_CALL_ENV(_x) \
147{ FR_CALL_ENV_PARSE_ONLY_OFFSET("chap_challenge", FR_TYPE_OCTETS, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_ ## _x ## _call_env_t, chap_challenge), \
148 .pair.dflt = "Vendor-Specific.Microsoft.CHAP-Challenge", .pair.dflt_quote = T_BARE_WORD }, \
149{ FR_CALL_ENV_PARSE_ONLY_OFFSET("chap_response", FR_TYPE_OCTETS, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_ ## _x ## _call_env_t, chap_response), \
150 .pair.dflt = "Vendor-Specific.Microsoft.CHAP-Response", .pair.dflt_quote = T_BARE_WORD }, \
151{ FR_CALL_ENV_PARSE_ONLY_OFFSET("chap2_response", FR_TYPE_OCTETS, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_ ## _x ## _call_env_t, chap2_response), \
152 .pair.dflt = "Vendor-Specific.Microsoft.CHAP2-Response", .pair.dflt_quote = T_BARE_WORD }
153
154#define MSCHAP_OPT_CALL_ENV(_opt, _x) \
155{ FR_CALL_ENV_PARSE_ONLY_OFFSET(STRINGIFY(_opt), FR_TYPE_OCTETS, CALL_ENV_FLAG_ATTRIBUTE, mschap_ ## _x ## _call_env_t, _opt) }
156
163
169
170MSCHAP_CALL_ENV(xlat);
171
172static const call_env_parser_t auth_call_env[] = {
173 { FR_CALL_ENV_PARSE_ONLY_OFFSET("username", FR_TYPE_STRING, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_auth_call_env_t, username), .pair.dflt = "User-Name", .pair.dflt_quote = T_BARE_WORD },
174 MSCHAP_COMMON_CALL_ENV(auth),
175 MSCHAP_OPT_CALL_ENV(chap2_success, auth),
176 MSCHAP_OPT_CALL_ENV(chap_error, auth),
177 MSCHAP_OPT_CALL_ENV(chap_mppe_keys, auth),
178 MSCHAP_OPT_CALL_ENV(mppe_encryption_policy, auth),
179 MSCHAP_OPT_CALL_ENV(mppe_recv_key, auth),
180 MSCHAP_OPT_CALL_ENV(mppe_send_key, auth),
181 MSCHAP_OPT_CALL_ENV(mppe_encryption_types, auth),
182 MSCHAP_OPT_CALL_ENV(chap2_cpw, auth),
183 MSCHAP_OPT_CALL_ENV(chap_nt_enc_pw, auth),
184 CALL_ENV_TERMINATOR
185};
186
207
214
215static const call_env_parser_t autz_call_env[] = {
216 MSCHAP_COMMON_CALL_ENV(autz),
217 MSCHAP_OPT_CALL_ENV(chap2_cpw, autz),
218 CALL_ENV_TERMINATOR
219};
220
221MSCHAP_CALL_ENV(autz);
222
223static fr_dict_t const *dict_freeradius;
224static fr_dict_t const *dict_radius;
225
226extern fr_dict_autoload_t rlm_mschap_dict[];
227fr_dict_autoload_t rlm_mschap_dict[] = {
228 { .out = &dict_freeradius, .proto = "freeradius" },
229 { .out = &dict_radius, .proto = "radius" },
230 { NULL }
231};
232
233fr_dict_attr_t const *attr_auth_type;
234fr_dict_attr_t const *attr_cleartext_password;
235fr_dict_attr_t const *attr_eap_identity;
236fr_dict_attr_t const *attr_ms_chap_new_cleartext_password;
237fr_dict_attr_t const *attr_ms_chap_new_nt_password;
238fr_dict_attr_t const *attr_ms_chap_peer_challenge;
239fr_dict_attr_t const *attr_ms_chap_use_ntlm_auth;
240fr_dict_attr_t const *attr_ms_chap_user_name;
241fr_dict_attr_t const *attr_nt_password;
242fr_dict_attr_t const *attr_smb_account_ctrl_text;
243fr_dict_attr_t const *attr_smb_account_ctrl;
244
245extern fr_dict_attr_autoload_t rlm_mschap_dict_attr[];
246fr_dict_attr_autoload_t rlm_mschap_dict_attr[] = {
247 { .out = &attr_auth_type, .name = "Auth-Type", .type = FR_TYPE_UINT32, .dict = &dict_freeradius },
248 { .out = &attr_cleartext_password, .name = "Password.Cleartext", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
249 { .out = &attr_eap_identity, .name = "EAP-Identity", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
250 { .out = &attr_ms_chap_new_cleartext_password, .name = "MS-CHAP-New-Cleartext-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
251 { .out = &attr_ms_chap_new_nt_password, .name = "MS-CHAP-New-NT-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
252 { .out = &attr_ms_chap_peer_challenge, .name = "MS-CHAP-Peer-Challenge", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
253 { .out = &attr_ms_chap_use_ntlm_auth, .name = "MS-CHAP-Use-NTLM-Auth", .type = FR_TYPE_UINT8, .dict = &dict_freeradius },
254 { .out = &attr_ms_chap_user_name, .name = "MS-CHAP-User-Name", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
255 { .out = &attr_nt_password, .name = "Password.NT", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
256 { .out = &attr_smb_account_ctrl_text, .name = "SMB-Account-Ctrl-Text", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
257 { .out = &attr_smb_account_ctrl, .name = "SMB-Account-Ctrl", .type = FR_TYPE_UINT32, .dict = &dict_freeradius },
258
259 { NULL }
260};
261
262static fr_pair_t *mschap_identity_find(request_t *request, fr_dict_attr_t const *attr_user_name)
263{
264 fr_pair_t *vp;
265
266 vp = fr_pair_find_by_da(&request->request_pairs, NULL, attr_user_name);
267 if (vp) return vp;
268
269 vp = fr_pair_find_by_da(&request->request_pairs, NULL, attr_eap_identity);
270 if (vp) return vp;
271
272 REDEBUG("No user identity found in current request");
273
274 return NULL;
275}
276
277static int pdb_decode_acct_ctrl(char const *p)
278{
279 int acct_ctrl = 0;
280 int done = 0;
281
282 /*
283 * Check if the account type bits have been encoded after the
284 * NT password (in the form [NDHTUWSLXI]).
285 */
286
287 if (*p != '[') return 0;
288
289 for (p++; *p && !done; p++) {
290 switch (*p) {
291 case 'N': /* 'N'o password. */
292 acct_ctrl |= ACB_PWNOTREQ;
293 break;
294
295 case 'D': /* 'D'isabled. */
296 acct_ctrl |= ACB_DISABLED ;
297 break;
298
299 case 'H': /* 'H'omedir required. */
300 acct_ctrl |= ACB_HOMDIRREQ;
301 break;
302
303 case 'T': /* 'T'emp account. */
304 acct_ctrl |= ACB_TEMPDUP;
305 break;
306
307 case 'U': /* 'U'ser account (normal). */
308 acct_ctrl |= ACB_NORMAL;
309 break;
310
311 case 'M': /* 'M'NS logon user account. What is this? */
312 acct_ctrl |= ACB_MNS;
313 break;
314
315 case 'W': /* 'W'orkstation account. */
316 acct_ctrl |= ACB_WSTRUST;
317 break;
318
319 case 'S': /* 'S'erver account. */
320 acct_ctrl |= ACB_SVRTRUST;
321 break;
322
323 case 'L': /* 'L'ocked account. */
324 acct_ctrl |= ACB_AUTOLOCK;
325 break;
326
327 case 'X': /* No 'X'piry on password */
328 acct_ctrl |= ACB_PWNOEXP;
329 break;
330
331 case 'I': /* 'I'nterdomain trust account. */
332 acct_ctrl |= ACB_DOMTRUST;
333 break;
334
335 case 'e': /* 'e'xpired, the password has */
336 acct_ctrl |= ACB_FR_EXPIRED;
337 break;
338
339 case ' ': /* ignore spaces */
340 break;
341
342 case ':':
343 case '\n':
344 case '\0':
345 case ']':
346 default:
347 done = 1;
348 break;
349 }
350 }
351
352 return acct_ctrl;
353}
354
355static xlat_arg_parser_t const mschap_xlat_args[] = {
356 { .required = true, .single = true, .type = FR_TYPE_STRING },
357 { .concat = true, .type = FR_TYPE_STRING },
358 XLAT_ARG_PARSER_TERMINATOR
359};
360
361/** Get data from MSCHAP attributes
362 *
363 * Pulls NT-Response, LM-Response, or Challenge from MSCHAP
364 * attributes.
365 *
366 * @ingroup xlat_functions
367 */
368static xlat_action_t mschap_xlat(TALLOC_CTX *ctx, fr_dcursor_t *out,
369 xlat_ctx_t const *xctx,
370 request_t *request, fr_value_box_list_t *in)
371{
372 mschap_xlat_call_env_t *env_data = talloc_get_type_abort(xctx->env_data, mschap_xlat_call_env_t);
373 size_t data_len;
374 uint8_t const *data = NULL;
375 uint8_t buffer[32];
376 fr_pair_t *user_name;
377 fr_pair_t *chap_challenge, *response;
378 rlm_mschap_t const *inst = talloc_get_type_abort(xctx->mctx->mi->data, rlm_mschap_t);
379 fr_value_box_t *arg = fr_value_box_list_head(in);
380 fr_value_box_t *vb;
381 bool tainted = false;
382
383 response = NULL;
384
385 /*
386 * Challenge means MS-CHAPv1 challenge, or
387 * hash of MS-CHAPv2 challenge, and peer challenge.
388 */
389 if (strncasecmp(arg->vb_strvalue, "Challenge", 9) == 0) {
390 chap_challenge = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
391 tmpl_attr_tail_da(env_data->chap_challenge));
392 if (!chap_challenge) {
393 REDEBUG("No MS-CHAP-Challenge in the request");
394 return XLAT_ACTION_FAIL;
395 }
396 tainted = chap_challenge->vp_tainted;
397
398 /*
399 * MS-CHAP-Challenges are 8 octets,
400 * for MS-CHAPv1
401 */
402 if (chap_challenge->vp_length == 8) {
403 RDEBUG2("mschap1: %02x", chap_challenge->vp_octets[0]);
404 data = chap_challenge->vp_octets;
405 data_len = 8;
406
407 /*
408 * MS-CHAP-Challenges are 16 octets,
409 * for MS-CHAPv2.
410 */
411 } else if (chap_challenge->vp_length == 16) {
412 fr_pair_t *name_vp;
413 fr_pair_t *response_name;
414 char const *username_str;
415 size_t username_len;
416
417 response = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
418 tmpl_attr_tail_da(env_data->chap2_response));
419 if (!response) {
420 REDEBUG("Vendor-Specific.Microsoft.CHAP2-Response is required to calculate MS-CHAPv1 challenge");
421 return XLAT_ACTION_FAIL;
422 }
423
424 /*
425 * FIXME: Much of this is copied from
426 * below. We should put it into a
427 * separate function.
428 */
429
430 /*
431 * Responses are 50 octets.
432 */
433 if (response->vp_length < 50) {
434 REDEBUG("Vendor-Specific.Microsoft.CHAP-Response has the wrong format");
435 return XLAT_ACTION_FAIL;
436 }
437
438 user_name = mschap_identity_find(request, tmpl_attr_tail_da(env_data->username));
439 if (!user_name) return XLAT_ACTION_FAIL;
440
441 /*
442 * Check for MS-CHAP-User-Name and if found, use it
443 * to construct the MSCHAPv1 challenge. This is
444 * set by rlm_eap_mschap to the MS-CHAP Response
445 * packet Name field.
446 *
447 * We prefer this to the User-Name in the
448 * packet.
449 */
450 response_name = fr_pair_find_by_da(&request->request_pairs, NULL, attr_ms_chap_user_name);
451 name_vp = response_name ? response_name : user_name;
452
453 /*
454 * with_ntdomain_hack moved here, too.
455 */
456 username_str = memchr(name_vp->vp_strvalue, '\\', name_vp->vp_length);
457 if (username_str != NULL) {
458 if (inst->with_ntdomain_hack) {
459 username_str++;
460 } else {
461 RWDEBUG2("NT Domain delimiter found, should 'with_ntdomain_hack' be enabled?");
462 username_str = name_vp->vp_strvalue;
463 }
464 } else {
465 username_str = name_vp->vp_strvalue;
466 }
467 username_len = name_vp->vp_length - (username_str - name_vp->vp_strvalue);
468
469 if (response_name &&
470 ((user_name->vp_length != response_name->vp_length) ||
471 (memcmp(user_name->vp_strvalue, response_name->vp_strvalue, user_name->vp_length) != 0))) {
472 RWDEBUG2("%pP is not the same as %pP from EAP-MSCHAPv2", user_name, response_name);
473 }
474
475 /*
476 * Get the MS-CHAPv1 challenge
477 * from the MS-CHAPv2 peer challenge,
478 * our challenge, and the user name.
479 */
480 RDEBUG2("Creating challenge with username \"%pV\"",
481 fr_box_strvalue_len(username_str, username_len));
482 mschap_challenge_hash(buffer, response->vp_octets + 2, chap_challenge->vp_octets,
483 username_str, username_len);
484 data = buffer;
485 data_len = 8;
486 } else {
487 REDEBUG("Invalid MS-CHAP challenge length");
488 return XLAT_ACTION_FAIL;
489 }
490
491 /*
492 * Get the MS-CHAPv1 response, or the MS-CHAPv2
493 * response.
494 */
495 } else if (strncasecmp(arg->vb_strvalue, "NT-Response", 11) == 0) {
496 response = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
497 tmpl_attr_tail_da(env_data->chap_response));
498 if (!response) response = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
499 tmpl_attr_tail_da(env_data->chap2_response));
500 if (!response) {
501 REDEBUG("No MS-CHAP-Response or MS-CHAP2-Response was found in the request");
502 return XLAT_ACTION_FAIL;
503 }
504 tainted = response->vp_tainted;
505
506 /*
507 * For MS-CHAPv1, the NT-Response exists only
508 * if the second octet says so.
509 */
510 if ((response->da == tmpl_attr_tail_da(env_data->chap_response)) && ((response->vp_octets[1] & 0x01) == 0)) {
511 REDEBUG("No NT-Response in MS-CHAP-Response");
512 return XLAT_ACTION_FAIL;
513 }
514
515 if (response->vp_length < 50) {
516 REDEBUG("Vendor-Specific.Microsoft.CHAP-Response has the wrong format");
517 return XLAT_ACTION_FAIL;
518 }
519
520 /*
521 * MS-CHAP-Response and MS-CHAP2-Response have
522 * the NT-Response at the same offset, and are
523 * the same length.
524 */
525 data = response->vp_octets + 26;
526 data_len = 24;
527
528 /*
529 * LM-Response is deprecated, and exists only
530 * in MS-CHAPv1, and not often there.
531 */
532 } else if (strncasecmp(arg->vb_strvalue, "LM-Response", 11) == 0) {
533 response = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
534 tmpl_attr_tail_da(env_data->chap_response));
535 if (!response) {
536 REDEBUG("No MS-CHAP-Response was found in the request");
537 return XLAT_ACTION_FAIL;
538 }
539 tainted = response->vp_tainted;
540
541 if (response->vp_length < 50) {
542 REDEBUG("Vendor-Specific.Microsoft.CHAP-Response has the wrong format");
543 return XLAT_ACTION_FAIL;
544 }
545 /*
546 * For MS-CHAPv1, the LM-Response exists only
547 * if the second octet says so.
548 */
549 if ((response->vp_octets[1] & 0x01) != 0) {
550 REDEBUG("No LM-Response in MS-CHAP-Response");
551 return XLAT_ACTION_FAIL;
552 }
553 data = response->vp_octets + 2;
554 data_len = 24;
555
556 /*
557 * Pull the domain name out of the User-Name, if it exists.
558 *
559 * This is the full domain name, not just the name after host/
560 */
561 } else if (strncasecmp(arg->vb_strvalue, "Domain-Name", 11) == 0) {
562 char *p;
563
564 MEM(vb = fr_value_box_alloc_null(ctx));
565
566 user_name = mschap_identity_find(request, tmpl_attr_tail_da(env_data->username));
567 if (!user_name) return XLAT_ACTION_FAIL;
568
569 /*
570 * First check to see if this is a host/ style User-Name
571 * (a la Kerberos host principal)
572 */
573 if (strncmp(user_name->vp_strvalue, "host/", 5) == 0) {
574 /*
575 * If we're getting a User-Name formatted in this way,
576 * it's likely due to PEAP. The Windows Domain will be
577 * the first domain component following the hostname,
578 * or the machine name itself if only a hostname is supplied
579 */
580 p = strchr(user_name->vp_strvalue, '.');
581 if (!p) {
582 RDEBUG2("setting Domain-Name to same as machine name");
583 fr_value_box_strdup(ctx, vb, NULL, user_name->vp_strvalue + 5, user_name->vp_tainted);
584 } else {
585 p++; /* skip the period */
586
587 fr_value_box_strdup(ctx, vb, NULL, p, user_name->vp_tainted);
588 }
589 } else {
590 p = strchr(user_name->vp_strvalue, '\\');
591 if (!p) {
592 REDEBUG("No domain name was found in the User-Name");
593 talloc_free(vb);
594 return XLAT_ACTION_FAIL;
595 }
596
597 /*
598 * Hack. This is simpler than the alternatives.
599 */
600 *p = '\0';
601 fr_value_box_strdup(ctx, vb, NULL, user_name->vp_strvalue, user_name->vp_tainted);
602 *p = '\\';
603 }
604
605 fr_dcursor_append(out, vb);
606 return XLAT_ACTION_DONE;
607
608 /*
609 * Pull the NT-Domain out of the User-Name, if it exists.
610 */
611 } else if (strncasecmp(arg->vb_strvalue, "NT-Domain", 9) == 0) {
612 char *p, *q;
613
614 MEM(vb = fr_value_box_alloc_null(ctx));
615
616 user_name = mschap_identity_find(request, tmpl_attr_tail_da(env_data->username));
617 if (!user_name) return XLAT_ACTION_FAIL;
618
619 /*
620 * First check to see if this is a host/ style User-Name
621 * (a la Kerberos host principal)
622 */
623 if (strncmp(user_name->vp_strvalue, "host/", 5) == 0) {
624 /*
625 * If we're getting a User-Name formatted in this way,
626 * it's likely due to PEAP. The Windows Domain will be
627 * the first domain component following the hostname,
628 * or the machine name itself if only a hostname is supplied
629 */
630 p = strchr(user_name->vp_strvalue, '.');
631 if (!p) {
632 RDEBUG2("setting NT-Domain to same as machine name");
633 fr_value_box_strdup(ctx, vb, NULL, user_name->vp_strvalue + 5, user_name->vp_tainted);
634 } else {
635 p++; /* skip the period */
636 q = strchr(p, '.');
637 /*
638 * use the same hack as below
639 * only if another period was found
640 */
641 if (q) *q = '\0';
642 fr_value_box_strdup(ctx, vb, NULL, p, user_name->vp_tainted);
643 if (q) *q = '.';
644 }
645 } else {
646 p = strchr(user_name->vp_strvalue, '\\');
647 if (!p) {
648 REDEBUG("No NT-Domain was found in the User-Name");
649 talloc_free(vb);
650 return XLAT_ACTION_FAIL;
651 }
652
653 /*
654 * Hack. This is simpler than the alternatives.
655 */
656 *p = '\0';
657 fr_value_box_strdup(ctx, vb, NULL, user_name->vp_strvalue, user_name->vp_tainted);
658 *p = '\\';
659 }
660
661 fr_dcursor_append(out, vb);
662 return XLAT_ACTION_DONE;
663
664 /*
665 * Pull the User-Name out of the User-Name...
666 */
667 } else if (strncasecmp(arg->vb_strvalue, "User-Name", 9) == 0) {
668 char const *p, *q;
669
670 user_name = mschap_identity_find(request, tmpl_attr_tail_da(env_data->username));
671 if (!user_name) return XLAT_ACTION_FAIL;
672
673 MEM(vb = fr_value_box_alloc_null(ctx));
674
675 /*
676 * First check to see if this is a host/ style User-Name
677 * (a la Kerberos host principal)
678 */
679 if (strncmp(user_name->vp_strvalue, "host/", 5) == 0) {
680 p = user_name->vp_strvalue + 5;
681 /*
682 * If we're getting a User-Name formatted in this way,
683 * it's likely due to PEAP. When authenticating this against
684 * a Domain, Windows will expect the User-Name to be in the
685 * format of hostname$, the SAM version of the name, so we
686 * have to convert it to that here. We do so by stripping
687 * off the first 5 characters (host/), and copying everything
688 * from that point to the first period into a string and appending
689 * a $ to the end.
690 */
691 q = strchr(p, '.');
692
693 /*
694 * use the same hack as above
695 * only if a period was found
696 */
697 if (q) {
698 fr_value_box_asprintf(ctx, vb, NULL, true, "%.*s$", (int) (q - p), p);
699 } else {
700 fr_value_box_asprintf(ctx, vb, NULL, true, "%s$", p);
701 }
702 } else {
703 p = strchr(user_name->vp_strvalue, '\\');
704 if (p) {
705 p++; /* skip the backslash */
706 } else {
707 p = user_name->vp_strvalue; /* use the whole User-Name */
708 }
709 fr_value_box_strdup(ctx, vb, NULL, p, user_name->vp_tainted);
710 }
711
712 fr_dcursor_append(out, vb);
713 return XLAT_ACTION_DONE;
714
715 /*
716 * Return the NT-Hash of the passed string
717 */
718 } else if (strncasecmp(arg->vb_strvalue, "NT-Hash", 7) == 0) {
719 arg = fr_value_box_list_next(in, arg);
720 if ((!arg) || (arg->vb_length == 0))
721 return XLAT_ACTION_FAIL;
722
723 if (mschap_nt_password_hash(buffer, arg->vb_strvalue) < 0) {
724 REDEBUG("Failed generating Password.NT");
725 *buffer = '\0';
726 return XLAT_ACTION_FAIL;
727 }
728
729 MEM(vb = fr_value_box_alloc_null(ctx));
730 fr_value_box_memdup(ctx, vb, NULL, buffer, NT_DIGEST_LENGTH, false);
731 RDEBUG2("NT-Hash of \"known-good\" password: %pV", vb);
732 fr_dcursor_append(out, vb);
733 return XLAT_ACTION_DONE;
734
735 /*
736 * Return the LM-Hash of the passed string
737 */
738 } else if (strncasecmp(arg->vb_strvalue, "LM-Hash", 7) == 0) {
739 arg = fr_value_box_list_next(in, arg);
740 if ((!arg) || (arg->vb_length == 0))
741 return XLAT_ACTION_FAIL;
742
743 smbdes_lmpwdhash(arg->vb_strvalue, buffer);
744
745 MEM(vb = fr_value_box_alloc_null(ctx));
746 fr_value_box_memdup(ctx, vb, NULL, buffer, LM_DIGEST_LENGTH, false);
747 RDEBUG2("LM-Hash of %s = %pV", arg->vb_strvalue, vb);
748 fr_dcursor_append(out, vb);
749 return XLAT_ACTION_DONE;
750 } else {
751 REDEBUG("Unknown expansion string '%pV'", arg);
752 return XLAT_ACTION_FAIL;
753 }
754
755 /*
756 * Didn't set anything: this is bad.
757 */
758 if (!data) {
759 RWDEBUG2("Failed to do anything intelligent");
760 return XLAT_ACTION_FAIL;
761 }
762
763 MEM(vb = fr_value_box_alloc_null(ctx));
764 fr_value_box_memdup(ctx, vb, NULL, data, data_len, tainted);
765
766 fr_dcursor_append(out, vb);
767 return XLAT_ACTION_DONE;
768}
769
770
771#ifdef WITH_AUTH_WINBIND
772/*
773 * Free winbind context
774 */
775static int _mod_ctx_free(winbind_ctx_t *wbctx)
776{
777 wbcCtxFree(wbctx->ctx);
778 return 0;
779}
780
781/*
782 * Create winbind context
783 */
784static int winbind_ctx_alloc(winbind_ctx_t *wbctx, UNUSED void *uctx)
785{
786 wbctx->ctx = wbcCtxCreate();
787 if (!wbctx->ctx) {
788 fr_strerror_printf("Unable to create winbind context");
789 return -1;
790 }
791 talloc_set_destructor(wbctx, _mod_ctx_free);
792 return 0;
793}
794#endif
795
796/*
797 * Add MPPE attributes to the reply.
798 */
799static void mppe_add_reply(UNUSED rlm_mschap_t const *inst,
800 request_t *request, fr_dict_attr_t const *da, uint8_t const *value, size_t len)
801{
802 fr_pair_t *vp;
803
804 MEM(pair_update_reply(&vp, da) >= 0);
805 fr_pair_value_memdup(vp, value, len, false);
806 RINDENT();
807 RDEBUG2("reply.%pP", vp);
808 REXDENT();
809}
810
811/*
812 * Write a string to an fd, followed by "\n"
813 */
814static int write_all(int fd, char const *buf, size_t len)
815{
816 char const *p = buf;
817 char const *end = buf + len;
818
819 while (p < end) {
820 ssize_t slen;
821
822 slen = write(fd, p, end - p);
823 if (slen <= 0) return -1;
824
825 fr_assert((size_t) slen <= (size_t) (end - p));
826
827 p += slen;
828 }
829
830 if (write(fd, "\n", 1) <= 0) return -1;
831
832 return 0;
833}
834
835/*
836 * Perform an MS-CHAP2 password change
837 */
838
839static int CC_HINT(nonnull) do_mschap_cpw(rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx,
840 uint8_t *new_nt_password, uint8_t *old_nt_hash)
841{
842 mschap_cpw_ctx_t *cpw_ctx = auth_ctx->cpw_ctx;
843 fr_value_box_t *vb;
844
845 if (inst->ntlm_cpw && auth_ctx->method != AUTH_INTERNAL) {
846 /*
847 * we're going to run ntlm_auth in helper-mode
848 * we're expecting to use the ntlm-change-password-1 protocol
849 * which needs the following on stdin:
850 *
851 * username: %mschap(User-Name)
852 * nt-domain: %mschap(NT-Domain)
853 * new-nt-password-blob: bin2hex(new_nt_password) - 1032 bytes encoded
854 * old-nt-hash-blob: bin2hex(old_nt_hash) - 32 bytes encoded
855 * new-lm-password-blob: 00000...0000 - 1032 bytes null
856 * old-lm-hash-blob: 000....000 - 32 bytes null
857 * .\n
858 *
859 * ...and it should then print out
860 *
861 * Password-Change: Yes
862 *
863 * or
864 *
865 * Password-Change: No
866 * Password-Change-Error: blah
867 */
868
869 size_t size;
870 int status, len, to_child=-1, from_child=-1;
871 pid_t pid, child_pid;
872 char buf[2048];
873 char *pmsg;
874 char const *emsg;
875
876 RDEBUG2("Doing MS-CHAPv2 password change via ntlm_auth helper");
877
878 /*
879 * Start up ntlm_auth with a pipe on stdin and stdout
880 */
881
882 pid = radius_start_program_legacy(&to_child, &from_child, NULL, inst->ntlm_cpw, request, true, NULL, false);
883 if (pid < 0) {
884 REDEBUG("could not exec ntlm_auth cpw command");
885 return -1;
886 }
887
888 /*
889 * write the stuff to the client
890 */
891
892 vb = fr_value_box_list_head(&cpw_ctx->cpw_user);
893 if (!vb) goto ntlm_auth_err;
894
895 if (write_all(to_child, vb->vb_strvalue, vb->vb_length) < 0) {
896 REDEBUG("Failed to write username to child");
897 goto ntlm_auth_err;
898 }
899
900 if (auth_ctx->env_data->ntlm_cpw_domain) {
901 vb = fr_value_box_list_head(&cpw_ctx->cpw_domain);
902 if (!vb) goto no_domain;
903
904 if (write_all(to_child, vb->vb_strvalue, vb->vb_length) < 0) {
905 REDEBUG("Failed to write domain to child");
906 goto ntlm_auth_err;
907 }
908 } else {
909 no_domain:
910 RWDEBUG2("No ntlm_auth domain set, username must be full-username to work");
911 }
912
913 /* now the password blobs */
914 size = snprintf(buf, sizeof(buf), "new-nt-password-blob: ");
915 fr_base16_encode(&FR_SBUFF_OUT(buf + size, sizeof(buf) - size), &FR_DBUFF_TMP(new_nt_password, 516));
916 size = strlen(buf);
917 if (write_all(to_child, buf, size) < 0) {
918 RDEBUG2("failed to write new password blob to child");
919 goto ntlm_auth_err;
920 }
921
922 size = snprintf(buf, sizeof(buf), "old-nt-hash-blob: ");
923 fr_base16_encode(&FR_SBUFF_OUT(buf + size, sizeof(buf) - size), &FR_DBUFF_TMP(old_nt_hash, NT_DIGEST_LENGTH));
924 size = strlen(buf);
925 if (write_all(to_child, buf, size) < 0) {
926 REDEBUG("Failed to write old hash blob to child");
927 goto ntlm_auth_err;
928 }
929
930 /*
931 * In current samba versions, failure to supply empty LM password/hash
932 * blobs causes the change to fail.
933 */
934 size = snprintf(buf, sizeof(buf), "new-lm-password-blob: %01032i", 0);
935 if (write_all(to_child, buf, size) < 0) {
936 REDEBUG("Failed to write dummy LM password to child");
937 goto ntlm_auth_err;
938 }
939 size = snprintf(buf, sizeof(buf), "old-lm-hash-blob: %032i", 0);
940 if (write_all(to_child, buf, size) < 0) {
941 REDEBUG("Failed to write dummy LM hash to child");
942 goto ntlm_auth_err;
943 }
944 if (write_all(to_child, ".", 1) < 0) {
945 REDEBUG("Failed to send finish to child");
946 goto ntlm_auth_err;
947 }
948 close(to_child);
949 to_child = -1;
950
951 /*
952 * Read from the child
953 */
954 len = radius_readfrom_program_legacy(from_child, pid, fr_time_delta_from_sec(10), buf, sizeof(buf));
955 if (len < 0) {
956 /* radius_readfrom_program_legacy will have closed from_child for us */
957 REDEBUG("Failure reading from child");
958 return -1;
959 }
960 close(from_child);
961 from_child = -1;
962
963 buf[len] = 0;
964 RDEBUG2("ntlm_auth said: %s", buf);
965
966 child_pid = waitpid(pid, &status, 0);
967 if (child_pid == 0) {
968 REDEBUG("Timeout waiting for child");
969 return -1;
970 }
971 if (child_pid != pid) {
972 REDEBUG("Abnormal exit status: %s", fr_syserror(errno));
973 return -1;
974 }
975
976 if (strstr(buf, "Password-Change: Yes")) {
977 RDEBUG2("ntlm_auth password change succeeded");
978 return 0;
979 }
980
981 pmsg = strstr(buf, "Password-Change-Error: ");
982 if (pmsg) {
983 emsg = strsep(&pmsg, "\n");
984 } else {
985 emsg = "could not find error";
986 }
987 REDEBUG("ntlm auth password change failed: %s", emsg);
988
989ntlm_auth_err:
990 /* safe because these either need closing or are == -1 */
991 close(to_child);
992 close(from_child);
993
994 return -1;
995
996 /*
997 * Decrypt the new password blob, add it as a temporary request
998 * variable, xlat the local_cpw string, then remove it
999 *
1000 * this allows is to write e..g
1001 *
1002 * %sql(insert into ...)
1003 *
1004 * ...or...
1005 *
1006 * %exec('/path/to', %mschap(User-Name), %{MS-CHAP-New-Cleartext-Password})"
1007 *
1008 */
1009#ifdef WITH_TLS
1010 } else if (auth_ctx->env_data->local_cpw) {
1011 RDEBUG2("Doing MS-CHAPv2 password change locally");
1012
1013 vb = fr_value_box_list_head(&cpw_ctx->local_cpw_result);
1014
1015 if (!vb){
1016 return -1;
1017 } else if (vb->vb_length == 0) {
1018 REDEBUG("Local MS-CHAPv2 password change - didn't give any result, assuming failure");
1019 return -1;
1020 }
1021
1022 RDEBUG2("MS-CHAPv2 password change succeeded: %pV", vb);
1023
1024 /*
1025 * Update the Password.NT attribute with the new hash this lets us
1026 * fall through to the authentication code using the new hash,
1027 * not the old one.
1028 */
1029 fr_pair_value_memdup(auth_ctx->nt_password, auth_ctx->cpw_ctx->new_hash->vp_octets,
1030 auth_ctx->cpw_ctx->new_hash->vp_length, false);
1031
1032 /*
1033 * Rock on! password change succeeded.
1034 */
1035 return 0;
1036#endif
1037 } else {
1038 REDEBUG("MS-CHAPv2 password change not configured");
1039 }
1040
1041 return -1;
1042}
1043
1044/*
1045 * Do the MS-CHAP stuff.
1046 *
1047 * This function is here so that all of the MS-CHAP related
1048 * authentication is in one place, and we can perhaps later replace
1049 * it with code to call winbindd, or something similar.
1050 */
1051static int CC_HINT(nonnull) do_mschap(rlm_mschap_t const *inst, request_t *request,
1052 mschap_auth_ctx_t *auth_ctx,
1053 uint8_t const *challenge, uint8_t const *response,
1054 uint8_t nthashhash[static NT_DIGEST_LENGTH])
1055{
1056 uint8_t calculated[24];
1057 fr_pair_t *password = auth_ctx->nt_password;
1058
1059 memset(nthashhash, 0, NT_DIGEST_LENGTH);
1060
1061 switch (auth_ctx->method) {
1062 case AUTH_INTERNAL:
1063 case AUTH_AUTO:
1064 /*
1065 * Do normal authentication.
1066 */
1067 {
1068 /*
1069 * No password: can't do authentication.
1070 */
1071 if (!password) {
1072 if (auth_ctx->method == AUTH_AUTO) goto do_ntlm;
1073
1074 REDEBUG("FAILED: No Password.NT/LM. Cannot perform authentication");
1075 return -1;
1076 }
1077
1078 smbdes_mschap(password->vp_octets, challenge, calculated);
1079 if (fr_digest_cmp(response, calculated, 24) != 0) {
1080 return -1;
1081 }
1082
1083 /*
1084 * If the password exists, and is an NT-Password,
1085 * then calculate the hash of the NT hash. Doing this
1086 * here minimizes work for later.
1087 */
1088 if (password->da == attr_nt_password) fr_md4_calc(nthashhash, password->vp_octets, MD4_DIGEST_LENGTH);
1089 break;
1090 }
1091 case AUTH_NTLMAUTH_EXEC:
1092 do_ntlm:
1093 /*
1094 * Run ntlm_auth
1095 */
1096 {
1097 int result;
1098 char buffer[256];
1099 size_t len;
1100
1101 /*
1102 * Run the program, and expect that we get 16
1103 */
1104 result = radius_exec_program_legacy(buffer, sizeof(buffer), request, inst->ntlm_auth, NULL,
1105 true, true, inst->ntlm_auth_timeout);
1106 if (result != 0) {
1107 char *p;
1108
1109 /*
1110 * Do checks for numbers, which are
1111 * language neutral. They're also
1112 * faster.
1113 */
1114 p = strcasestr(buffer, "0xC0000");
1115 if (p) {
1116 result = 0;
1117
1118 p += 7;
1119 if (strcmp(p, "224") == 0) {
1120 result = -648;
1121
1122 } else if (strcmp(p, "234") == 0) {
1123 result = -647;
1124
1125 } else if (strcmp(p, "072") == 0) {
1126 result = -691;
1127
1128 } else if (strcasecmp(p, "05E") == 0) {
1129 result = -2;
1130 }
1131
1132 if (result != 0) {
1133 REDEBUG2("%s", buffer);
1134 return result;
1135 }
1136
1137 /*
1138 * Else fall through to more ridiculous checks.
1139 */
1140 }
1141
1142 /*
1143 * Look for variants of expire password.
1144 */
1145 if (strcasestr(buffer, "0xC0000224") ||
1146 strcasestr(buffer, "Password expired") ||
1147 strcasestr(buffer, "Password has expired") ||
1148 strcasestr(buffer, "Password must be changed") ||
1149 strcasestr(buffer, "Must change password")) {
1150 return -648;
1151 }
1152
1153 if (strcasestr(buffer, "0xC0000234") ||
1154 strcasestr(buffer, "Account locked out")) {
1155 REDEBUG2("%s", buffer);
1156 return -647;
1157 }
1158
1159 if (strcasestr(buffer, "0xC0000072") ||
1160 strcasestr(buffer, "Account disabled")) {
1161 REDEBUG2("%s", buffer);
1162 return -691;
1163 }
1164
1165 if (strcasestr(buffer, "0xC000005E") ||
1166 strcasestr(buffer, "No logon servers")) {
1167 REDEBUG2("%s", buffer);
1168 return -2;
1169 }
1170
1171 if (strcasestr(buffer, "could not obtain winbind separator") ||
1172 strcasestr(buffer, "Reading winbind reply failed")) {
1173 REDEBUG2("%s", buffer);
1174 return -2;
1175 }
1176
1177 RDEBUG2("External script failed");
1178 p = strchr(buffer, '\n');
1179 if (p) *p = '\0';
1180
1181 REDEBUG("External script says: %s", buffer);
1182 return -1;
1183 }
1184
1185 /*
1186 * Parse the answer as an nthashhash.
1187 *
1188 * ntlm_auth currently returns:
1189 * NT_KEY: 000102030405060708090a0b0c0d0e0f
1190 */
1191 if (memcmp(buffer, "NT_KEY: ", 8) != 0) {
1192 REDEBUG("Invalid output from ntlm_auth: expecting 'NT_KEY: ' prefix");
1193 return -1;
1194 }
1195
1196 /*
1197 * Check the length. It should be at least 32, with an LF at the end.
1198 */
1199 len = strlen(buffer + 8);
1200 if (len < 32) {
1201 REDEBUG2("Invalid output from ntlm_auth: NT_KEY too short, expected 32 bytes got %zu bytes",
1202 len);
1203
1204 return -1;
1205 }
1206
1207 /*
1208 * Update the NT hash hash, from the NT key.
1209 */
1210 if (fr_base16_decode(NULL, &FR_DBUFF_TMP(nthashhash, NT_DIGEST_LENGTH),
1211 &FR_SBUFF_IN(buffer + 8, len), false) != NT_DIGEST_LENGTH) {
1212 REDEBUG("Invalid output from ntlm_auth: NT_KEY has non-hex values");
1213 return -1;
1214 }
1215
1216 break;
1217 }
1218#ifdef WITH_AUTH_WINBIND
1219 case AUTH_WBCLIENT:
1220 /*
1221 * Process auth via the wbclient library
1222 */
1223 return do_auth_wbclient(inst, request, challenge, response, nthashhash, auth_ctx);
1224#endif
1225 default:
1226 /* We should never reach this line */
1227 RERROR("Internal error: Unknown mschap auth method (%d)", auth_ctx->method);
1228 return -1;
1229 }
1230
1231 return 0;
1232}
1233
1234
1235/*
1236 * Data for the hashes.
1237 */
1238static const uint8_t SHSpad1[40] =
1239 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1240 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1241 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1242 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
1243
1244static const uint8_t SHSpad2[40] =
1245 { 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
1246 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
1247 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
1248 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2 };
1249
1250static const uint8_t magic1[27] =
1251 { 0x54, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74,
1252 0x68, 0x65, 0x20, 0x4d, 0x50, 0x50, 0x45, 0x20, 0x4d,
1253 0x61, 0x73, 0x74, 0x65, 0x72, 0x20, 0x4b, 0x65, 0x79 };
1254
1255static const uint8_t magic2[84] =
1256 { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69,
1257 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20,
1258 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
1259 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, 0x6b, 0x65, 0x79,
1260 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x73,
1261 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, 0x69, 0x64, 0x65,
1262 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
1263 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20,
1264 0x6b, 0x65, 0x79, 0x2e };
1265
1266static const uint8_t magic3[84] =
1267 { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69,
1268 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20,
1269 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
1270 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20,
1271 0x6b, 0x65, 0x79, 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68,
1272 0x65, 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73,
1273 0x69, 0x64, 0x65, 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73,
1274 0x20, 0x74, 0x68, 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20,
1275 0x6b, 0x65, 0x79, 0x2e };
1276
1277
1278static void mppe_GetMasterKey(uint8_t const *nt_hashhash, uint8_t const *nt_response,
1279 uint8_t *masterkey)
1280{
1281 uint8_t digest[20];
1282 fr_sha1_ctx Context;
1283
1284 fr_sha1_init(&Context);
1285 fr_sha1_update(&Context, nt_hashhash, NT_DIGEST_LENGTH);
1286 fr_sha1_update(&Context, nt_response, 24);
1287 fr_sha1_update(&Context, magic1, 27);
1288 fr_sha1_final(digest, &Context);
1289
1290 memcpy(masterkey, digest, 16); //-V512
1291}
1292
1293
1294static void mppe_GetAsymmetricStartKey(uint8_t *masterkey, uint8_t *sesskey,
1295 int keylen, int issend)
1296{
1297 uint8_t digest[20];
1298 const uint8_t *s;
1299 fr_sha1_ctx Context;
1300
1301 memset(digest, 0, 20);
1302
1303 if(issend) {
1304 s = magic3;
1305 } else {
1306 s = magic2;
1307 }
1308
1309 fr_sha1_init(&Context);
1310 fr_sha1_update(&Context, masterkey, 16);
1311 fr_sha1_update(&Context, SHSpad1, 40);
1312 fr_sha1_update(&Context, s, 84);
1313 fr_sha1_update(&Context, SHSpad2, 40);
1314 fr_sha1_final(digest, &Context);
1315
1316 memcpy(sesskey, digest, keylen);
1317}
1318
1319
1320static void mppe_chap2_get_keys128(uint8_t const *nt_hashhash, uint8_t const *nt_response,
1321 uint8_t *sendkey, uint8_t *recvkey)
1322{
1323 uint8_t masterkey[16];
1324
1325 mppe_GetMasterKey(nt_hashhash, nt_response, masterkey);
1326
1327 mppe_GetAsymmetricStartKey(masterkey, sendkey, 16, 1);
1328 mppe_GetAsymmetricStartKey(masterkey, recvkey, 16, 0);
1329}
1330
1331/*
1332 * Generate MPPE keys.
1333 */
1334static void mppe_chap2_gen_keys128(uint8_t const *nt_hashhash, uint8_t const *response,
1335 uint8_t *sendkey, uint8_t *recvkey)
1336{
1337 uint8_t enckey1[16];
1338 uint8_t enckey2[16];
1339
1340 mppe_chap2_get_keys128(nt_hashhash, response, enckey1, enckey2);
1341
1342 /*
1343 * dictionary.microsoft defines these attributes as
1344 * 'encrypt=Tunnel-Password'. The functions in src/lib/radius.c will
1345 * take care of encrypting/decrypting them as appropriate,
1346 * so that we don't have to.
1347 */
1348 memcpy (sendkey, enckey1, 16);
1349 memcpy (recvkey, enckey2, 16);
1350}
1351
1352
1353/*
1354 * mod_authorize() - authorize user if we can authenticate
1355 * it later. Add Auth-Type attribute if present in module
1356 * configuration (usually Auth-Type must be "MS-CHAP")
1357 */
1358static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
1359{
1360 rlm_mschap_t const *inst = talloc_get_type_abort_const(mctx->mi->data, rlm_mschap_t);
1361 mschap_autz_call_env_t *env_data = talloc_get_type_abort(mctx->env_data, mschap_autz_call_env_t);
1362 fr_pair_t *challenge = NULL;
1363 fr_pair_t *parent;
1364
1365 challenge = fr_pair_find_by_da_nested(&request->request_pairs, NULL, tmpl_attr_tail_da(env_data->chap_challenge));
1366 if (!challenge) RETURN_MODULE_NOOP;
1367
1368 /*
1369 * The responses MUST be in the same group as the challenge.
1370 */
1371 parent = fr_pair_parent(challenge);
1372 fr_assert(parent != NULL);
1373
1374 if (!fr_pair_find_by_da(&parent->vp_group, NULL, tmpl_attr_tail_da(env_data->chap_response)) &&
1375 !fr_pair_find_by_da(&parent->vp_group, NULL, tmpl_attr_tail_da(env_data->chap2_response)) &&
1376 (env_data->chap2_cpw &&
1377 !fr_pair_find_by_da(&parent->vp_group, NULL, tmpl_attr_tail_da(env_data->chap2_cpw)))) {
1378 RDEBUG2("Found MS-CHAP-Challenge, but no MS-CHAP response or Change-Password");
1379 RETURN_MODULE_NOOP;
1380 }
1381
1382 if (!inst->auth_type) {
1383 WARN("No 'authenticate %s {...}' section or 'Auth-Type = %s' set. Cannot setup MS-CHAP authentication",
1384 mctx->mi->name, mctx->mi->name);
1385 RETURN_MODULE_NOOP;
1386 }
1387
1388 if (!module_rlm_section_type_set(request, attr_auth_type, inst->auth_type)) RETURN_MODULE_NOOP;
1389
1390 RETURN_MODULE_OK;
1391}
1392
1393static unlang_action_t mschap_error(rlm_rcode_t *p_result, rlm_mschap_t const *inst, request_t *request,
1394 unsigned char ident, int mschap_result, int mschap_version, fr_pair_t *smb_ctrl,
1395 mschap_auth_call_env_t *env_data)
1396{
1397 rlm_rcode_t rcode = RLM_MODULE_OK;
1398 int error = 0;
1399 int retry = 0;
1400 char const *message = NULL;
1401
1402 int i;
1403 char new_challenge[33], buffer[128];
1404 char *p;
1405
1406 if ((mschap_result == -648) ||
1407 ((mschap_result == 0) &&
1408 (smb_ctrl && ((smb_ctrl->vp_uint32 & ACB_FR_EXPIRED) != 0)))) {
1409 REDEBUG("Password has expired. User should retry authentication");
1410 error = 648;
1411
1412 /*
1413 * A password change is NOT a retry! We MUST have retry=0 here.
1414 */
1415 retry = 0;
1416 message = "Password expired";
1417 rcode = RLM_MODULE_REJECT;
1418
1419 /*
1420 * Account is disabled.
1421 *
1422 * They're found, but they don't exist, so we
1423 * return 'not found'.
1424 */
1425 } else if ((mschap_result == -691) ||
1426 (smb_ctrl && (((smb_ctrl->vp_uint32 & ACB_DISABLED) != 0) ||
1427 ((smb_ctrl->vp_uint32 & (ACB_NORMAL|ACB_WSTRUST)) == 0)))) {
1428 REDEBUG("SMB-Account-Ctrl (or ntlm_auth) "
1429 "says that the account is disabled, "
1430 "or is not a normal or workstation trust account");
1431 error = 691;
1432 retry = 0;
1433 message = "Account disabled";
1434 rcode = RLM_MODULE_NOTFOUND;
1435
1436 /*
1437 * User is locked out.
1438 */
1439 } else if ((mschap_result == -647) ||
1440 (smb_ctrl && ((smb_ctrl->vp_uint32 & ACB_AUTOLOCK) != 0))) {
1441 REDEBUG("SMB-Account-Ctrl (or ntlm_auth) "
1442 "says that the account is locked out");
1443 error = 647;
1444 retry = 0;
1445 message = "Account locked out";
1446 rcode = RLM_MODULE_DISALLOW;
1447
1448 } else if (mschap_result < 0) {
1449 REDEBUG("%s is incorrect", mschap_version == 1 ? env_data->chap_response->name : env_data->chap2_response->name);
1450 error = 691;
1451 retry = inst->allow_retry;
1452 message = "Authentication failed";
1453 rcode = RLM_MODULE_REJECT;
1454 }
1455
1456 if (rcode == RLM_MODULE_OK) RETURN_MODULE_OK;
1457
1458 switch (mschap_version) {
1459 case 1:
1460 for (p = new_challenge, i = 0; i < 2; i++) p += snprintf(p, 9, "%08x", fr_rand());
1461 snprintf(buffer, sizeof(buffer), "E=%i R=%i C=%s V=2",
1462 error, retry, new_challenge);
1463 break;
1464
1465 case 2:
1466 for (p = new_challenge, i = 0; i < 4; i++) p += snprintf(p, 9, "%08x", fr_rand());
1467 snprintf(buffer, sizeof(buffer), "E=%i R=%i C=%s V=3 M=%s",
1468 error, retry, new_challenge, message);
1469 break;
1470
1471 default:
1472 RETURN_MODULE_FAIL;
1473 }
1474 if (env_data->chap_error) mschap_add_reply(request, ident, tmpl_attr_tail_da(env_data->chap_error),
1475 buffer, strlen(buffer));
1476
1477 RETURN_MODULE_RCODE(rcode);
1478}
1479
1480
1481/** Find a Password.NT value, or create one from a Password.Cleartext, or Password.With-Header attribute
1482 *
1483 * @param[in] ctx to allocate ephemeral passwords in.
1484 * @param[out] out Our new Password.NT.
1485 * @param[in] inst Module configuration.
1486 * @param[in] request The current request.
1487 * @return
1488 * - 0 on success.
1489 * - -1 on failure.
1490 */
1491static int CC_HINT(nonnull(1, 2, 3)) nt_password_find(TALLOC_CTX *ctx, fr_pair_t **out,
1492 rlm_mschap_t const *inst, request_t *request)
1493{
1494 fr_pair_t *password;
1495 fr_dict_attr_t const *allowed_passwords[] = { attr_cleartext_password, attr_nt_password };
1496 bool ephemeral;
1497
1498 *out = NULL; /* Init output pointer */
1499
1500 password = password_find(&ephemeral, ctx, request,
1501 allowed_passwords, NUM_ELEMENTS(allowed_passwords), inst->normify);
1502 if (!password) {
1503 if (inst->method == AUTH_INTERNAL) {
1504 /*
1505 * Search for passwords in the parent
1506 * FIXME: This is a hack and should be removed
1507 * When EAP-MSCHAPv2 supports sections.
1508 */
1509 if (request->parent) {
1510 password = password_find(&ephemeral, ctx, request->parent,
1511 allowed_passwords,
1512 NUM_ELEMENTS(allowed_passwords), inst->normify);
1513 if (password) goto found_password;
1514 }
1515
1516 /*
1517 * If we're doing internal auth, then this is an issue
1518 */
1519 RWDEBUG2("No control.%s.%s or control.%s.%s found. Cannot create Password.NT",
1520 attr_cleartext_password->parent->name, attr_cleartext_password->name,
1521 attr_nt_password->parent->name, attr_nt_password->name);
1522 return -1;
1523
1524 /*
1525 * ..if we're not, then we can call out to external sources.
1526 */
1527 } else {
1528 return 0;
1529 }
1530 }
1531
1532found_password:
1533 if (password->da == attr_cleartext_password) {
1534 uint8_t *p;
1535 int ret;
1536 fr_pair_t *nt_password;
1537
1538 MEM(nt_password = fr_pair_afrom_da(ctx, attr_nt_password));
1539 MEM(fr_pair_value_mem_alloc(nt_password, &p, NT_DIGEST_LENGTH, false) == 0);
1540 ret = mschap_nt_password_hash(p, password->vp_strvalue);
1541
1542 if (ret < 0) {
1543 RERROR("Failed generating Password.NT");
1544 talloc_free(nt_password);
1545 if (ephemeral) TALLOC_FREE(password);
1546 return -1;
1547 }
1548
1549 if (RDEBUG_ENABLED3) {
1550 RDEBUG3("Hashed control.%pP to create %s = %pV",
1551 password, attr_nt_password->name, fr_box_octets(p, NT_DIGEST_LENGTH));
1552 } else {
1553 RDEBUG2("Hashed control.%s to create %s", attr_nt_password->name, password->da->name);
1554 }
1555
1556 if (ephemeral) TALLOC_FREE(password);
1557
1558 *out = nt_password;
1559
1560 return 0;
1561 }
1562
1563 fr_assert(password->da == attr_nt_password);
1564
1565 if (RDEBUG_ENABLED3) {
1566 RDEBUG3("Found control.%pP", password);
1567 } else {
1568 RDEBUG2("Found control.%s", attr_nt_password->name);
1569 }
1570 *out = password;
1571
1572 return 0;
1573}
1574
1575/*
1576 * mschap_cpw_request_process() - do the work to handle an MS-CHAP password
1577 * change request.
1578 */
1579static unlang_action_t CC_HINT(nonnull) mschap_process_cpw_request(rlm_rcode_t *p_result,
1580 rlm_mschap_t const *inst,
1581 request_t *request,
1582 mschap_auth_ctx_t *auth_ctx)
1583{
1584 mschap_auth_call_env_t *env_data = auth_ctx->env_data;
1585 mschap_cpw_ctx_t *cpw_ctx = auth_ctx->cpw_ctx;
1586
1587 /*
1588 * Perform the actual password change
1589 */
1590 if (do_mschap_cpw(inst, request, auth_ctx, cpw_ctx->new_nt_encrypted, cpw_ctx->old_nt_hash) < 0) {
1591 char buffer[128];
1592
1593 REDEBUG("Password change failed");
1594
1595 if (env_data->chap_error) {
1596 snprintf(buffer, sizeof(buffer), "E=709 R=0 M=Password change failed");
1597 mschap_add_reply(request, auth_ctx->cpw->vp_octets[1],
1598 tmpl_attr_tail_da(env_data->chap_error), buffer, strlen(buffer));
1599 }
1600
1601 RETURN_MODULE_REJECT;
1602 }
1603
1604 RDEBUG2("Password change successful");
1605
1606 RETURN_MODULE_OK;
1607}
1608
1609/** Validate data required for change password requests.
1610 *
1611 */
1612static int mschap_cpw_prepare(request_t *request, mschap_auth_ctx_t *auth_ctx)
1613{
1614 mschap_auth_call_env_t *env_data = auth_ctx->env_data;
1615 mschap_cpw_ctx_t *cpw_ctx;
1616 fr_pair_t *nt_enc = NULL;
1617 int seq, new_nt_enc_len;
1618
1619 /*
1620 * mschap2 password change request.
1621 *
1622 * We cheat - first decode and execute the passchange.
1623 * Then extract the response, add it into the request
1624 * and then jump into mschap2 auth with the challenge/
1625 * response.
1626 */
1627 RDEBUG2("MS-CHAPv2 password change request received");
1628
1629 if (auth_ctx->cpw->vp_length != 68) {
1630 REDEBUG("%s has the wrong format: length %zu != 68", env_data->chap2_cpw->name, auth_ctx->cpw->vp_length);
1631 return -1;
1632 }
1633
1634 if (auth_ctx->cpw->vp_octets[0] != 7) {
1635 REDEBUG("%s has the wrong format: code %d != 7", env_data->chap2_cpw->name, auth_ctx->cpw->vp_octets[0]);
1636 return -1;
1637 }
1638
1639 MEM(auth_ctx->cpw_ctx = talloc_zero(auth_ctx, mschap_cpw_ctx_t));
1640 cpw_ctx = auth_ctx->cpw_ctx;
1641
1642 /*
1643 * Look for the new (encrypted) password.
1644 *
1645 * Bah, stupid composite attributes...
1646 * we're expecting 3 attributes with the leading bytes -
1647 * 06:<mschapid>:00:01:<1st chunk>
1648 * 06:<mschapid>:00:02:<2nd chunk>
1649 * 06:<mschapid>:00:03:<3rd chunk>
1650 */
1651 new_nt_enc_len = 0;
1652 for (seq = 1; seq < 4; seq++) {
1653 int found = 0;
1654
1655 while ((nt_enc = fr_pair_find_by_da_nested(&request->request_pairs, nt_enc,
1656 tmpl_attr_tail_da(env_data->chap_nt_enc_pw)))) {
1657 if (nt_enc->vp_length < 4) {
1658 REDEBUG("%s with invalid format", env_data->chap_nt_enc_pw->name);
1659 return -1;
1660 }
1661
1662 if (nt_enc->vp_octets[0] != 6) {
1663 REDEBUG("%s with invalid format", env_data->chap_nt_enc_pw->name);
1664 return -1;
1665 }
1666
1667 if ((nt_enc->vp_octets[2] == 0) && (nt_enc->vp_octets[3] == seq)) {
1668 found = 1;
1669 break;
1670 }
1671 }
1672
1673 if (!found) {
1674 REDEBUG("Could not find %s with sequence number %d", env_data->chap_nt_enc_pw->name, seq);
1675 return -1;
1676 }
1677
1678 if ((new_nt_enc_len + nt_enc->vp_length - 4) > sizeof(cpw_ctx->new_nt_encrypted)) {
1679 REDEBUG("Unpacked %s length > 516", env_data->chap_nt_enc_pw->name);
1680 return -1;
1681 }
1682
1683 memcpy(cpw_ctx->new_nt_encrypted + new_nt_enc_len, nt_enc->vp_octets + 4, nt_enc->vp_length - 4);
1684 new_nt_enc_len += nt_enc->vp_length - 4;
1685 }
1686
1687 if (new_nt_enc_len != 516) {
1688 REDEBUG("Unpacked %s length is %d - should be 516", env_data->chap_nt_enc_pw->name, new_nt_enc_len);
1689 return -1;
1690 }
1691
1692 /*
1693 * RFC 2548 is confusing here. It claims:
1694 *
1695 * 1 byte code
1696 * 1 byte ident
1697 * 16 octets - old hash encrypted with new hash
1698 * 24 octets - peer challenge
1699 * this is actually:
1700 * 16 octets - peer challenge
1701 * 8 octets - reserved
1702 * 24 octets - nt response
1703 * 2 octets - flags (ignored)
1704 */
1705
1706 memcpy(cpw_ctx->old_nt_hash, auth_ctx->cpw->vp_octets + 2, sizeof(cpw_ctx->old_nt_hash));
1707
1708 RDEBUG2("Password change payload valid");
1709 return 0;
1710}
1711
1712static CC_HINT(nonnull) unlang_action_t mschap_process_response(rlm_rcode_t *p_result, int *mschap_version,
1713 uint8_t nthashhash[static NT_DIGEST_LENGTH],
1714 rlm_mschap_t const *inst, request_t *request,
1715 mschap_auth_ctx_t *auth_ctx,
1716 fr_pair_t *challenge, fr_pair_t *response)
1717{
1718 int offset;
1719 rlm_rcode_t mschap_result;
1720 mschap_auth_call_env_t *env_data = auth_ctx->env_data;
1721
1722 *mschap_version = 1;
1723
1724 RDEBUG2("Processing MS-CHAPv1 response");
1725
1726 /*
1727 * MS-CHAPv1 challenges are 8 octets.
1728 */
1729 if (challenge->vp_length < 8) {
1730 REDEBUG("%s has the wrong format", env_data->chap_challenge->name);
1731 RETURN_MODULE_INVALID;
1732 }
1733
1734 /*
1735 * Responses are 50 octets.
1736 */
1737 if (response->vp_length < 50) {
1738 REDEBUG("%s has the wrong format", env_data->chap_response->name);
1739 RETURN_MODULE_INVALID;
1740 }
1741
1742 /*
1743 * We are doing MS-CHAP. Calculate the MS-CHAP
1744 * response
1745 */
1746 if (!(response->vp_octets[1] & 0x01)) {
1747 REDEBUG2("Client used unsupported method LM-Password");
1748 RETURN_MODULE_FAIL;
1749 }
1750
1751 offset = 26;
1752
1753 /*
1754 * Do the MS-CHAP authentication.
1755 */
1756 mschap_result = do_mschap(inst, request, auth_ctx, challenge->vp_octets, response->vp_octets + offset, nthashhash);
1757
1758 /*
1759 * Check for errors, and add MSCHAP-Error if necessary.
1760 */
1761 return mschap_error(p_result, inst, request, *response->vp_octets, mschap_result, *mschap_version, auth_ctx->smb_ctrl, env_data);
1762}
1763
1764static unlang_action_t CC_HINT(nonnull) mschap_process_v2_response(rlm_rcode_t *p_result, int *mschap_version,
1765 uint8_t nthashhash[static NT_DIGEST_LENGTH],
1766 rlm_mschap_t const *inst, request_t *request,
1767 mschap_auth_ctx_t *auth_ctx,
1768 fr_pair_t *challenge, fr_pair_t *response)
1769{
1770 uint8_t mschap_challenge[16];
1771 fr_pair_t *user_name, *name_vp, *response_name, *peer_challenge_attr;
1772 uint8_t const *peer_challenge;
1773 char const *username_str;
1774 size_t username_len;
1775 int mschap_result;
1776 rlm_rcode_t rcode;
1777 char msch2resp[42];
1778 mschap_auth_call_env_t *env_data = auth_ctx->env_data;
1779
1780 *mschap_version = 2;
1781
1782 RDEBUG2("Processing MS-CHAPv2 response");
1783
1784 /*
1785 * MS-CHAPv2 challenges are 16 octets.
1786 */
1787 if (challenge->vp_length < 16) {
1788 REDEBUG("%s has the wrong format", env_data->chap_challenge->name);
1789 RETURN_MODULE_INVALID;
1790 }
1791
1792 /*
1793 * Responses are 50 octets.
1794 */
1795 if (response->vp_length < 50) {
1796 REDEBUG("%s has the wrong format", env_data->chap2_response->name);
1797 RETURN_MODULE_INVALID;
1798 }
1799
1800 /*
1801 * We also require a User-Name
1802 */
1803 user_name = mschap_identity_find(request, tmpl_attr_tail_da(env_data->username));
1804 if (!user_name) RETURN_MODULE_FAIL;
1805
1806 /*
1807 * Check for MS-CHAP-User-Name and if found, use it
1808 * to construct the MSCHAPv1 challenge. This is
1809 * set by rlm_eap_mschap to the MS-CHAP Response
1810 * packet Name field.
1811 *
1812 * We prefer this to the User-Name in the
1813 * packet.
1814 */
1815 response_name = fr_pair_find_by_da(&request->request_pairs, NULL, attr_ms_chap_user_name);
1816 name_vp = response_name ? response_name : user_name;
1817
1818 /*
1819 * with_ntdomain_hack moved here, too.
1820 */
1821 if ((username_str = strchr(name_vp->vp_strvalue, '\\')) != NULL) {
1822 if (inst->with_ntdomain_hack) {
1823 username_str++;
1824 } else {
1825 RWDEBUG2("NT Domain delimiter found, should 'with_ntdomain_hack' be enabled?");
1826 username_str = name_vp->vp_strvalue;
1827 }
1828 } else {
1829 username_str = name_vp->vp_strvalue;
1830 }
1831 username_len = name_vp->vp_length - (username_str - name_vp->vp_strvalue);
1832
1833 if (response_name && ((user_name->vp_length != response_name->vp_length) ||
1834 (strncasecmp(user_name->vp_strvalue, response_name->vp_strvalue, user_name->vp_length) != 0))) {
1835 RWDEBUG("%pP is not the same as %pP from EAP-MSCHAPv2", user_name, response_name);
1836 }
1837
1838#ifdef __APPLE__
1839 /*
1840 * No "known good" Password.NT attribute. Try to do
1841 * OpenDirectory authentication.
1842 *
1843 * If OD determines the user is an AD user it will return noop, which
1844 * indicates the auth process should continue directly to AD.
1845 * Otherwise OD will determine auth success/fail.
1846 */
1847 if (!auth_ctx->nt_password && inst->open_directory) {
1848 RDEBUG2("No Password.NT available. Trying OpenDirectory Authentication");
1849 od_mschap_auth(&rcode, request, challenge, user_name, env_data);
1850 if (rcode != RLM_MODULE_NOOP) RETURN_MODULE_RCODE(rcode);
1851 }
1852#endif
1853 peer_challenge = response->vp_octets + 2;
1854
1855 peer_challenge_attr = fr_pair_find_by_da(&request->control_pairs, NULL, attr_ms_chap_peer_challenge);
1856 if (peer_challenge_attr) {
1857 RDEBUG2("Overriding peer challenge");
1858 peer_challenge = peer_challenge_attr->vp_octets;
1859 }
1860
1861 /*
1862 * The old "mschapv2" function has been moved to
1863 * here.
1864 *
1865 * MS-CHAPv2 takes some additional data to create an
1866 * MS-CHAPv1 challenge, and then does MS-CHAPv1.
1867 */
1868 RDEBUG2("Creating challenge with username \"%pV\"",
1869 fr_box_strvalue_len(username_str, username_len));
1870 mschap_challenge_hash(mschap_challenge, /* resulting challenge */
1871 peer_challenge, /* peer challenge */
1872 challenge->vp_octets, /* our challenge */
1873 username_str, username_len); /* user name */
1874
1875 mschap_result = do_mschap(inst, request, auth_ctx, mschap_challenge, response->vp_octets + 26, nthashhash);
1876
1877 /*
1878 * Check for errors, and add MSCHAP-Error if necessary.
1879 */
1880 mschap_error(&rcode, inst, request, *response->vp_octets,
1881 mschap_result, *mschap_version, auth_ctx->smb_ctrl, env_data);
1882 if (rcode != RLM_MODULE_OK) RETURN_MODULE_RCODE(rcode);
1883
1884#ifdef WITH_AUTH_WINBIND
1885 if (inst->wb_retry_with_normalised_username) {
1886 response_name = fr_pair_find_by_da(&request->request_pairs, NULL, attr_ms_chap_user_name);
1887 if (response_name) {
1888 if (strcmp(username_str, response_name->vp_strvalue)) {
1889 RDEBUG2("Normalising username %pV -> %pV",
1890 fr_box_strvalue_len(username_str, username_len),
1891 &response_name->data);
1892 username_str = response_name->vp_strvalue;
1893 }
1894 }
1895 }
1896#endif
1897
1898 mschap_auth_response(username_str, /* without the domain */
1899 username_len, /* Length of username str */
1900 nthashhash, /* nt-hash-hash */
1901 response->vp_octets + 26, /* peer response */
1902 peer_challenge, /* peer challenge */
1903 challenge->vp_octets, /* our challenge */
1904 msch2resp); /* calculated MPPE key */
1905 if (env_data->chap2_success) mschap_add_reply(request, *response->vp_octets,
1906 tmpl_attr_tail_da(env_data->chap2_success), msch2resp, 42);
1907
1908 RETURN_MODULE_OK;
1909}
1910
1911/** Complete mschap authentication after any tmpls have been expanded.
1912 *
1913 */
1914static unlang_action_t mod_authenticate_resume(rlm_rcode_t *p_result, UNUSED int *priority, request_t *request, void *uctx)
1915{
1916 mschap_auth_ctx_t *auth_ctx = talloc_get_type_abort(uctx, mschap_auth_ctx_t);
1917 mschap_auth_call_env_t *env_data = talloc_get_type_abort(auth_ctx->env_data, mschap_auth_call_env_t);
1918 rlm_mschap_t const *inst = talloc_get_type_abort_const(auth_ctx->inst, rlm_mschap_t);
1919 fr_pair_t *challenge = NULL;
1920 fr_pair_t *response = NULL;
1921 fr_pair_t *parent;
1922 uint8_t nthashhash[NT_DIGEST_LENGTH];
1923 int mschap_version = 0;
1924 rlm_rcode_t rcode = RLM_MODULE_OK;
1925
1926 if (auth_ctx->cpw) {
1927 uint8_t *p;
1928
1929 /*
1930 * Password change does require the NT password
1931 */
1932 if (!auth_ctx->nt_password) {
1933 REDEBUG("Missing Password.NT - required for change password request");
1934 RETURN_MODULE_FAIL;
1935 }
1936 if (!env_data->chap_nt_enc_pw) {
1937 REDEBUG("chap_nt_enc_pw option is not set - required for change password request");
1938 RETURN_MODULE_INVALID;
1939 }
1940
1941 mschap_process_cpw_request(&rcode, inst, request, auth_ctx);
1942 if (rcode != RLM_MODULE_OK) goto finish;
1943
1944 /*
1945 * Clear any expiry bit so the user can now login;
1946 * obviously the password change action will need
1947 * to have cleared this bit in the config/SQL/wherever.
1948 */
1949 if (auth_ctx->smb_ctrl && auth_ctx->smb_ctrl->vp_uint32 & ACB_FR_EXPIRED) {
1950 RDEBUG2("Clearing expiry bit in SMB-Acct-Ctrl to allow authentication");
1951 auth_ctx->smb_ctrl->vp_uint32 &= ~ACB_FR_EXPIRED;
1952 }
1953
1954 /*
1955 * Extract the challenge & response from the end of the
1956 * password change, add them into the request and then
1957 * continue with the authentication.
1958 */
1959 MEM(pair_update_request(&response, tmpl_attr_tail_da(env_data->chap2_response)) >= 0);
1960 MEM(fr_pair_value_mem_alloc(response, &p, 50, auth_ctx->cpw->vp_tainted) == 0);
1961
1962 /* ident & flags */
1963 p[0] = auth_ctx->cpw->vp_octets[1];
1964 p[1] = 0;
1965 /* peer challenge and client NT response */
1966 memcpy(p + 2, auth_ctx->cpw->vp_octets + 18, 48);
1967 }
1968
1969 challenge = fr_pair_find_by_da_nested(&request->request_pairs, NULL, tmpl_attr_tail_da(env_data->chap_challenge));
1970 if (!challenge) {
1971 REDEBUG("control.Auth-Type = %s set for a request that does not contain %s",
1972 auth_ctx->name, env_data->chap_challenge->name);
1973 rcode = RLM_MODULE_INVALID;
1974 goto finish;
1975 }
1976
1977 /*
1978 * The responses MUST be in the same group as the challenge.
1979 */
1980 parent = fr_pair_parent(challenge);
1981 fr_assert(parent != NULL);
1982
1983 /*
1984 * We also require an MS-CHAP-Response.
1985 */
1986 if ((response = fr_pair_find_by_da(&parent->vp_group, NULL, tmpl_attr_tail_da(env_data->chap_response)))) {
1987 mschap_process_response(&rcode,
1988 &mschap_version, nthashhash,
1989 inst, request,
1990 auth_ctx,
1991 challenge, response);
1992 if (rcode != RLM_MODULE_OK) goto finish;
1993 } else if ((response = fr_pair_find_by_da_nested(&parent->vp_group, NULL, tmpl_attr_tail_da(env_data->chap2_response)))) {
1994 mschap_process_v2_response(&rcode,
1995 &mschap_version, nthashhash,
1996 inst, request,
1997 auth_ctx,
1998 challenge, response);
1999 if (rcode != RLM_MODULE_OK) goto finish;
2000 } else { /* Neither CHAPv1 or CHAPv2 response: die */
2001 REDEBUG("control.Auth-Type = %s set for a request that does not contain %s or %s attributes",
2002 auth_ctx->name, env_data->chap_response->name, env_data->chap2_response->name);
2003 rcode = RLM_MODULE_INVALID;
2004 goto finish;
2005 }
2006
2007 /* now create MPPE attributes */
2008 if (inst->use_mppe) {
2009 fr_pair_t *vp;
2010 uint8_t mppe_sendkey[34];
2011 uint8_t mppe_recvkey[34];
2012
2013 switch (mschap_version) {
2014 case 1:
2015 RDEBUG2("Generating MS-CHAPv1 MPPE keys");
2016 memset(mppe_sendkey, 0, 32);
2017
2018 /*
2019 * According to RFC 2548 we
2020 * should send NT hash. But in
2021 * practice it doesn't work.
2022 * Instead, we should send nthashhash
2023 *
2024 * This is an error in RFC 2548.
2025 */
2026 /*
2027 * do_mschap cares to zero nthashhash if NT hash
2028 * is not available.
2029 */
2030 memcpy(mppe_sendkey + 8, nthashhash, NT_DIGEST_LENGTH);
2031 mppe_add_reply(inst, request, tmpl_attr_tail_da(env_data->chap_mppe_keys), mppe_sendkey, 24); //-V666
2032 break;
2033
2034 case 2:
2035 RDEBUG2("Generating MS-CHAPv2 MPPE keys");
2036 mppe_chap2_gen_keys128(nthashhash, response->vp_octets + 26, mppe_sendkey, mppe_recvkey);
2037
2038 mppe_add_reply(inst, request, tmpl_attr_tail_da(env_data->mppe_recv_key), mppe_recvkey, 16);
2039 mppe_add_reply(inst, request, tmpl_attr_tail_da(env_data->mppe_send_key), mppe_sendkey, 16);
2040 break;
2041
2042 default:
2043 fr_assert(0);
2044 break;
2045 }
2046
2047 MEM(pair_update_reply(&vp, tmpl_attr_tail_da(env_data->mppe_encryption_policy)) >= 0);
2048 vp->vp_uint32 = inst->require_encryption ? 2 : 1;
2049
2050 MEM(pair_update_reply(&vp, tmpl_attr_tail_da(env_data->mppe_encryption_types)) >= 0);
2051 vp->vp_uint32 = inst->require_strong ? 4 : 6;
2052 } /* else we weren't asked to use MPPE */
2053
2054finish:
2055 RETURN_MODULE_RCODE(rcode);
2056}
2057
2058/** When changing passwords using the ntlm_auth helper, evaluate the domain tmpl
2059 *
2060 */
2061static unlang_action_t mod_authenticate_domain_tmpl_push(rlm_rcode_t *p_result, UNUSED int *priority,
2062 request_t *request, void *uctx)
2063{
2064 mschap_auth_ctx_t *auth_ctx = talloc_get_type_abort(uctx, mschap_auth_ctx_t);
2065 mschap_auth_call_env_t *env_data = talloc_get_type_abort(auth_ctx->env_data, mschap_auth_call_env_t);
2066
2067 fr_value_box_list_init(&auth_ctx->cpw_ctx->cpw_domain);
2068 if (unlang_tmpl_push(auth_ctx, &auth_ctx->cpw_ctx->cpw_domain, request,
2069 env_data->ntlm_cpw_domain, NULL) < 0) RETURN_MODULE_FAIL;
2070
2071 return UNLANG_ACTION_PUSHED_CHILD;
2072}
2073
2074#ifdef WITH_TLS
2075/** Decrypt the new cleartext password when handling change password requests
2076 *
2077 */
2078static int mschap_new_pass_decrypt(request_t *request, mschap_auth_ctx_t *auth_ctx)
2079{
2080 EVP_CIPHER_CTX *evp_ctx;
2081 uint8_t nt_pass_decrypted[516], old_nt_hash_expected[NT_DIGEST_LENGTH];
2082 int c, ntlen = sizeof(nt_pass_decrypted);
2083 size_t passlen, i = 0, len = 0;
2084 char *x;
2085 uint8_t *p, *q;
2086 fr_pair_t *new_pass;
2087
2088 MEM(evp_ctx = EVP_CIPHER_CTX_new());
2089
2090 if (unlikely(EVP_EncryptInit_ex(evp_ctx, EVP_rc4(), NULL, auth_ctx->nt_password->vp_octets, NULL) != 1)) {
2091 fr_tls_strerror_printf(NULL);
2092 RPERROR("Failed initialising RC4 ctx");
2093 return -1;
2094 }
2095
2096 if (unlikely(EVP_CIPHER_CTX_set_key_length(evp_ctx, auth_ctx->nt_password->vp_length)) != 1) {
2097 fr_tls_strerror_printf(NULL);
2098 RPERROR("Failed setting key length");
2099 return -1;
2100 }
2101
2102 if (unlikely(EVP_EncryptUpdate(evp_ctx, nt_pass_decrypted, &ntlen, auth_ctx->cpw_ctx->new_nt_encrypted, ntlen) != 1)) {
2103 fr_tls_strerror_printf(NULL);
2104 RPERROR("Failed ingesting new password");
2105 return -1;
2106 }
2107
2108 EVP_CIPHER_CTX_free(evp_ctx);
2109
2110 /*
2111 * pwblock is
2112 * 512-N bytes random pad
2113 * N bytes password as utf-16-le
2114 * 4 bytes - N as big-endian int
2115 */
2116 passlen = nt_pass_decrypted[512];
2117 passlen += nt_pass_decrypted[513] << 8;
2118 if ((nt_pass_decrypted[514] != 0) ||
2119 (nt_pass_decrypted[515] != 0)) {
2120 REDEBUG("Decrypted new password blob claims length > 65536, probably an invalid Password.NT");
2121 return -1;
2122 }
2123
2124 /*
2125 * Sanity check - passlen positive and <= 512 if not, crypto has probably gone wrong
2126 */
2127 if (passlen > 512) {
2128 REDEBUG("Decrypted new password blob claims length %zu > 512, "
2129 "probably an invalid Password.NT", passlen);
2130 return -1;
2131 }
2132
2133 p = nt_pass_decrypted + 512 - passlen;
2134
2135 /*
2136 * The new NT hash - this should be preferred over the
2137 * cleartext password as it avoids unicode hassles.
2138 */
2139 MEM(pair_update_request(&auth_ctx->cpw_ctx->new_hash, attr_ms_chap_new_nt_password) >= 0);
2140 MEM(fr_pair_value_mem_alloc(auth_ctx->cpw_ctx->new_hash, &q, NT_DIGEST_LENGTH, false) == 0);
2141 fr_md4_calc(q, p, passlen);
2142
2143 /*
2144 * Check that nt_password encrypted with new_hash
2145 * matches the old_hash value from the client.
2146 */
2147 smbhash(old_nt_hash_expected, auth_ctx->nt_password->vp_octets, q);
2148 smbhash(old_nt_hash_expected + 8, auth_ctx->nt_password->vp_octets + 8, q + 7);
2149 if (memcmp(old_nt_hash_expected, auth_ctx->cpw_ctx->old_nt_hash, NT_DIGEST_LENGTH)!=0) {
2150 REDEBUG("Old NT hash value from client does not match our value");
2151 RHEXDUMP1(old_nt_hash_expected, NT_DIGEST_LENGTH, "expected");
2152 RHEXDUMP1(auth_ctx->cpw_ctx->old_nt_hash, NT_DIGEST_LENGTH, "got");
2153 return -1;
2154 }
2155
2156 /*
2157 * The new cleartext password, which is utf-16 do some unpleasant vileness
2158 * to turn it into utf8 without pulling in libraries like iconv.
2159 *
2160 * First pass: get the length of the converted string.
2161 */
2162 MEM(pair_update_request(&new_pass, attr_ms_chap_new_cleartext_password) >= 0);
2163 new_pass->vp_length = 0;
2164
2165 while (i < passlen) {
2166 c = p[i++];
2167 c += p[i++] << 8;
2168
2169 /*
2170 * Gah. nasty. maybe we should just pull in iconv?
2171 */
2172 if (c < 0x7f) {
2173 len++;
2174 } else if (c < 0x7ff) {
2175 len += 2;
2176 } else {
2177 len += 3;
2178 }
2179 }
2180
2181 MEM(fr_pair_value_bstr_alloc(new_pass, &x, len, true) == 0);
2182
2183 /*
2184 * Second pass: convert the characters from UTF-16 to UTF-8.
2185 */
2186 i = 0;
2187 while (i < passlen) {
2188 c = p[i++];
2189 c += p[i++] << 8;
2190
2191 /*
2192 * Gah. nasty. maybe we should just pull in iconv?
2193 */
2194 if (c < 0x7f) {
2195 *x++ = c;
2196
2197 } else if (c < 0x7ff) {
2198 *x++ = 0xc0 + (c >> 6);
2199 *x++ = 0x80 + (c & 0x3f);
2200
2201 } else {
2202 *x++ = 0xe0 + (c >> 12);
2203 *x++ = 0x80 + ((c>>6) & 0x3f);
2204 *x++ = 0x80 + (c & 0x3f);
2205 }
2206 }
2207
2208 *x = '\0';
2209 return 0;
2210}
2211#endif
2212
2213/*
2214 * mod_authenticate() - authenticate user based on given
2215 * attributes and configuration.
2216 * We will try to find out password in configuration
2217 * or in configured passwd file.
2218 * If one is found we will check paraneters given by NAS.
2219 *
2220 * If SMB-Account-Ctrl is not set to ACB_PWNOTREQ we must have
2221 * one of:
2222 * PAP: User-Password or
2223 * MS-CHAP: MS-CHAP-Challenge and MS-CHAP-Response or
2224 * MS-CHAP2: MS-CHAP-Challenge and MS-CHAP2-Response
2225 * In case of password mismatch or locked account we MAY return
2226 * MS-CHAP-Error for MS-CHAP or MS-CHAP v2
2227 * If MS-CHAP2 succeeds we MUST return MS-CHAP2-Success
2228 */
2229static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
2230{
2231 rlm_mschap_t const *inst = talloc_get_type_abort_const(mctx->mi->data, rlm_mschap_t);
2232#ifdef WITH_AUTH_WINBIND
2233 rlm_mschap_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_mschap_thread_t);
2234#endif
2235 mschap_auth_call_env_t *env_data = talloc_get_type_abort(mctx->env_data, mschap_auth_call_env_t);
2236 mschap_auth_ctx_t *auth_ctx;
2237
2238 MEM(auth_ctx = talloc_zero(unlang_interpret_frame_talloc_ctx(request), mschap_auth_ctx_t));
2239
2240 /*
2241 * If we have ntlm_auth configured, use it unless told
2242 * otherwise
2243 */
2244 *auth_ctx = (mschap_auth_ctx_t) {
2245 .name = mctx->mi->name,
2246 .inst = inst,
2247 .method = inst->method,
2248 .env_data = env_data,
2249#ifdef WITH_AUTH_WINBIND
2250 .t = t,
2251#endif
2252 };
2253
2254 /*
2255 * If we have an ntlm_auth configuration, then we may
2256 * want to suppress it.
2257 */
2258 if (auth_ctx->method != AUTH_INTERNAL) {
2259 fr_pair_t *vp = fr_pair_find_by_da(&request->control_pairs, NULL, attr_ms_chap_use_ntlm_auth);
2260 if (vp && (vp->vp_uint8 <= AUTH_AUTO)) auth_ctx->method = vp->vp_uint8;
2261 }
2262
2263 /*
2264 * Find the SMB-Account-Ctrl attribute, or the
2265 * SMB-Account-Ctrl-Text attribute.
2266 */
2267 auth_ctx->smb_ctrl = fr_pair_find_by_da(&request->control_pairs, NULL, attr_smb_account_ctrl);
2268 if (!auth_ctx->smb_ctrl) {
2269 fr_pair_t *smb_account_ctrl_text;
2270
2271 smb_account_ctrl_text = fr_pair_find_by_da(&request->control_pairs, NULL, attr_smb_account_ctrl_text);
2272 if (smb_account_ctrl_text) {
2273 MEM(pair_append_control(&auth_ctx->smb_ctrl, attr_smb_account_ctrl) >= 0);
2274 auth_ctx->smb_ctrl->vp_uint32 = pdb_decode_acct_ctrl(smb_account_ctrl_text->vp_strvalue);
2275 }
2276 }
2277
2278 /*
2279 * We're configured to do MS-CHAP authentication.
2280 * and account control information exists. Enforce it.
2281 */
2282 if (auth_ctx->smb_ctrl) {
2283 /*
2284 * Password is not required.
2285 */
2286 if ((auth_ctx->smb_ctrl->vp_uint32 & ACB_PWNOTREQ) != 0) {
2287 RDEBUG2("SMB-Account-Ctrl says no password is required");
2288 RETURN_MODULE_OK;
2289 }
2290 }
2291
2292 /*
2293 * Look for or create an Password.NT
2294 *
2295 * Password.NT can be NULL here if we didn't find an
2296 * input attribute, and we're calling out to an
2297 * external password store.
2298 */
2299 if (nt_password_find(auth_ctx, &auth_ctx->nt_password, mctx->mi->data, request) < 0) RETURN_MODULE_FAIL;
2300
2301 /*
2302 * Check to see if this is a change password request, and process
2303 * it accordingly if so.
2304 */
2305 if (env_data->chap2_cpw) auth_ctx->cpw = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
2306 tmpl_attr_tail_da(env_data->chap2_cpw));
2307 if (auth_ctx->cpw) {
2308 /*
2309 * Password change does require the NT password
2310 */
2311 if (!auth_ctx->nt_password) {
2312 REDEBUG("Missing Password.NT - required for change password request");
2313 RETURN_MODULE_FAIL;
2314 }
2315
2316 if (mschap_cpw_prepare(request, auth_ctx) < 0) RETURN_MODULE_FAIL;
2317
2318 switch (auth_ctx->method) {
2319 case AUTH_INTERNAL:
2320#ifdef WITH_TLS
2321 if (mschap_new_pass_decrypt(request, auth_ctx) < 0) RETURN_MODULE_FAIL;
2322 if (unlang_function_push(request, NULL, mod_authenticate_resume, NULL, 0,
2323 UNLANG_SUB_FRAME, auth_ctx) < 0) RETURN_MODULE_FAIL;
2324
2325 fr_value_box_list_init(&auth_ctx->cpw_ctx->local_cpw_result);
2326 if (unlang_tmpl_push(auth_ctx, &auth_ctx->cpw_ctx->local_cpw_result, request,
2327 env_data->local_cpw, NULL) < 0) RETURN_MODULE_FAIL;
2328 break;
2329#else
2330 REDEBUG("Local MS-CHAPv2 password changes require OpenSSL support");
2331 RETURN_MODULE_INVALID;
2332#endif
2333
2334 default:
2335 if (!env_data->ntlm_cpw_username) {
2336 REDEBUG("No ntlm_auth username set, passchange will definitely fail!");
2337 RETURN_MODULE_FAIL;
2338 }
2339
2340 if (unlang_function_push(request, env_data->ntlm_cpw_domain ? mod_authenticate_domain_tmpl_push : NULL,
2341 mod_authenticate_resume, NULL, 0,
2342 UNLANG_SUB_FRAME, auth_ctx) < 0) RETURN_MODULE_FAIL;
2343
2344 fr_value_box_list_init(&auth_ctx->cpw_ctx->cpw_user);
2345 if (unlang_tmpl_push(auth_ctx, &auth_ctx->cpw_ctx->cpw_user, request,
2346 env_data->ntlm_cpw_username, NULL) < 0) RETURN_MODULE_FAIL;
2347 break;
2348 }
2349
2350 return UNLANG_ACTION_PUSHED_CHILD;
2351 }
2352
2353 return mod_authenticate_resume(p_result, NULL, request, auth_ctx);
2354}
2355
2356/*
2357 * Create instance for our module. Allocate space for
2358 * instance structure and read configuration parameters
2359 */
2360static int mod_instantiate(module_inst_ctx_t const *mctx)
2361{
2362 rlm_mschap_t *inst = talloc_get_type_abort(mctx->mi->data, rlm_mschap_t);
2363 CONF_SECTION *conf = mctx->mi->conf;
2364
2365 inst->auth_type = fr_dict_enum_by_name(attr_auth_type, mctx->mi->name, -1);
2366 if (!inst->auth_type) {
2367 WARN("Failed to find 'authenticate %s {...}' section. MS-CHAP authentication will likely not work",
2368 mctx->mi->name);
2369 }
2370
2371 /*
2372 * Set auth method
2373 */
2374 inst->method = AUTH_INTERNAL;
2375
2376 if (inst->wb_username) {
2377#ifdef WITH_AUTH_WINBIND
2378 inst->method = AUTH_WBCLIENT;
2379#else
2380 cf_log_err(conf, "'winbind' auth not enabled at compiled time");
2381 return -1;
2382#endif
2383 }
2384
2385 /* preserve existing behaviour: this option overrides all */
2386 if (inst->ntlm_auth) {
2387 inst->method = AUTH_NTLMAUTH_EXEC;
2388 }
2389
2390 switch (inst->method) {
2391 case AUTH_INTERNAL:
2392 DEBUG("Using internal authentication");
2393 break;
2394 case AUTH_AUTO:
2395 DEBUG("Using auto password or ntlm_auth");
2396 break;
2397 case AUTH_NTLMAUTH_EXEC:
2398 DEBUG("Authenticating by calling 'ntlm_auth'");
2399 break;
2400#ifdef WITH_AUTH_WINBIND
2401 case AUTH_WBCLIENT:
2402 DEBUG("Authenticating directly to winbind");
2403 break;
2404#endif
2405 }
2406
2407 /*
2408 * Check ntlm_auth_timeout is sane
2409 */
2410 if (!fr_time_delta_ispos(inst->ntlm_auth_timeout)) {
2411 inst->ntlm_auth_timeout = fr_time_delta_from_sec(EXEC_TIMEOUT);
2412 }
2413 if (fr_time_delta_lt(inst->ntlm_auth_timeout, fr_time_delta_from_sec(1))) {
2414 cf_log_err(conf, "ntml_auth_timeout '%pVs' is too small (minimum: 1s)",
2415 fr_box_time_delta(inst->ntlm_auth_timeout));
2416 return -1;
2417 }
2418 if (fr_time_delta_gt(inst->ntlm_auth_timeout, fr_time_delta_from_sec(10))) {
2419 cf_log_err(conf, "ntlm_auth_timeout '%pVs' is too large (maximum: 10s)",
2420 fr_box_time_delta(inst->ntlm_auth_timeout));
2421 return -1;
2422 }
2423
2424#define CHECK_OPTION(_option) cp = cf_pair_find(attrs, STRINGIFY(_option)); \
2425if (!cp) { \
2426 WARN("Missing option \"" STRINGIFY(_option) "\", setting use_mppe to \"no\""); \
2427 inst->use_mppe = false; \
2428 goto done_mppe_check; \
2429}
2430
2431 /*
2432 * Check that MPPE attributes are in the module config, if the option is enabled.
2433 * Validity of them will be checked when the module is compiled.
2434 */
2435 if (inst->use_mppe) {
2436 CONF_SECTION *attrs = cf_section_find(conf, "attributes", NULL);
2437 CONF_PAIR *cp;
2438
2439 if (!attrs) {
2440 cf_log_err(conf, "Missing required \"attributes\" section");
2441 return -1;
2442 }
2443 CHECK_OPTION(chap_mppe_keys)
2444 CHECK_OPTION(mppe_encryption_policy)
2445 CHECK_OPTION(mppe_recv_key)
2446 CHECK_OPTION(mppe_send_key)
2447 CHECK_OPTION(mppe_encryption_types)
2448 }
2449done_mppe_check:
2450
2451 return 0;
2452}
2453
2454static int mod_bootstrap(module_inst_ctx_t const *mctx)
2455{
2456 xlat_t *xlat;
2457
2458 xlat = module_rlm_xlat_register(mctx->mi->boot, mctx, NULL, mschap_xlat, FR_TYPE_VOID);
2459 xlat_func_args_set(xlat, mschap_xlat_args);
2460 xlat_func_call_env_set(xlat, &mschap_xlat_method_env);
2461
2462 return 0;
2463}
2464
2465#ifdef WITH_AUTH_WINBIND
2466static int mod_thread_instantiate(module_thread_inst_ctx_t const *mctx)
2467{
2468 rlm_mschap_t const *inst = talloc_get_type_abort(mctx->mi->data, rlm_mschap_t);
2469 rlm_mschap_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_mschap_thread_t);
2470
2471 t->inst = inst;
2472 if (!(t->slab = mschap_slab_list_alloc(t, mctx->el, &inst->reuse, winbind_ctx_alloc, NULL, NULL, false, false))) {
2473 ERROR("Connection handle pool instantiation failed");
2474 return -1;
2475 }
2476
2477 return 0;
2478}
2479
2480static int mod_thread_detach(module_thread_inst_ctx_t const *mctx)
2481{
2482 rlm_mschap_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_mschap_thread_t);
2483 talloc_free(t->slab);
2484 return 0;
2485}
2486#endif
2487
2488extern module_rlm_t rlm_mschap;
2489module_rlm_t rlm_mschap = {
2490 .common = {
2491 .magic = MODULE_MAGIC_INIT,
2492 .name = "mschap",
2493 .inst_size = sizeof(rlm_mschap_t),
2494 .config = module_config,
2495 .bootstrap = mod_bootstrap,
2496 .instantiate = mod_instantiate,
2497#ifdef WITH_AUTH_WINBIND
2498 .thread_inst_size = sizeof(rlm_mschap_thread_t),
2499 .thread_instantiate = mod_thread_instantiate,
2500 .thread_detach = mod_thread_detach
2501#endif
2502 },
2503 .method_group = {
2504 .bindings = (module_method_binding_t[]){
2505 { .section = SECTION_NAME("authenticate", CF_IDENT_ANY), .method = mod_authenticate, .method_env = &mschap_auth_method_env },
2506 { .section = SECTION_NAME("recv", CF_IDENT_ANY), .method = mod_authorize, .method_env = &mschap_autz_method_env },
2507 MODULE_BINDING_TERMINATOR
2508 }
2509 }
2510};
unlang_action_t
unlang_action_t
Returned by unlang_op_t calls, determine the next action of the interpreter.
Definition action.h:35
UNLANG_ACTION_PUSHED_CHILD
@ UNLANG_ACTION_PUSHED_CHILD
unlang_t pushed a new child onto the stack, execute it instead of continuing.
Definition action.h:39
buffer
static int const char char buffer[256]
Definition acutest.h:576
do_auth_wbclient
int do_auth_wbclient(rlm_mschap_t const *inst, request_t *request, uint8_t const *challenge, uint8_t const *response, uint8_t nthashhash[NT_DIGEST_LENGTH], mschap_auth_ctx_t *auth_ctx)
Check NTLM authentication direct to winbind via Samba's libwbclient library.
Definition auth_wbclient.c:93
auth_wbclient.h
fr_base16_encode
#define fr_base16_encode(_out, _in)
Definition base16.h:57
fr_base16_decode
#define fr_base16_decode(_err, _out, _in, _no_trailing)
Definition base16.h:95
USES_APPLE_DEPRECATED_API
#define USES_APPLE_DEPRECATED_API
Definition build.h:472
RCSID
#define RCSID(id)
Definition build.h:485
unlikely
#define unlikely(_x)
Definition build.h:383
UNUSED
#define UNUSED
Definition build.h:317
NUM_ELEMENTS
#define NUM_ELEMENTS(_t)
Definition build.h:339
CALL_ENV_TERMINATOR
#define CALL_ENV_TERMINATOR
Definition call_env.h:236
FR_CALL_ENV_METHOD_OUT
#define FR_CALL_ENV_METHOD_OUT(_inst)
Helper macro for populating the size/type fields of a call_env_method_t from the output structure typ...
Definition call_env.h:240
call_env_method_s::env
call_env_parser_t const * env
Parsing rules for call method env.
Definition call_env.h:247
FR_CALL_ENV_SUBSECTION
#define FR_CALL_ENV_SUBSECTION(_name, _name2, _flags, _subcs)
Specify a call_env_parser_t which defines a nested subsection.
Definition call_env.h:402
CALL_ENV_FLAG_SUBSECTION
@ CALL_ENV_FLAG_SUBSECTION
This is a subsection.
Definition call_env.h:87
CALL_ENV_FLAG_ATTRIBUTE
@ CALL_ENV_FLAG_ATTRIBUTE
Tmpl MUST contain an attribute reference.
Definition call_env.h:86
CALL_ENV_FLAG_NONE
@ CALL_ENV_FLAG_NONE
Definition call_env.h:74
CALL_ENV_FLAG_REQUIRED
@ CALL_ENV_FLAG_REQUIRED
Associated conf pair or section is required.
Definition call_env.h:75
CALL_ENV_FLAG_NULLABLE
@ CALL_ENV_FLAG_NULLABLE
Tmpl expansions are allowed to produce no output.
Definition call_env.h:80
FR_CALL_ENV_OFFSET
#define FR_CALL_ENV_OFFSET(_name, _cast_type, _flags, _struct, _field)
Specify a call_env_parser_t which writes out runtime results to the specified field.
Definition call_env.h:340
FR_CALL_ENV_PARSE_ONLY_OFFSET
#define FR_CALL_ENV_PARSE_ONLY_OFFSET(_name, _cast_type, _flags, _struct, _parse_field)
Specify a call_env_parser_t which writes out the result of the parsing phase to the field specified.
Definition call_env.h:389
call_env_method_s
Definition call_env.h:244
call_env_parser_s
Per method call config.
Definition call_env.h:180
CONF_PARSER_TERMINATOR
#define CONF_PARSER_TERMINATOR
Definition cf_parse.h:658
FR_CONF_DEPRECATED
#define FR_CONF_DEPRECATED(_name, _struct, _field)
conf_parser_t entry which raises an error if a matching CONF_PAIR is found
Definition cf_parse.h:414
FR_CONF_OFFSET
#define FR_CONF_OFFSET(_name, _struct, _field)
conf_parser_t which parses a single CONF_PAIR, writing the result to a field in a struct
Definition cf_parse.h:284
FR_CONF_POINTER
#define FR_CONF_POINTER(_name, _type, _flags, _res_p)
conf_parser_t which parses a single CONF_PAIR producing a single global result
Definition cf_parse.h:339
FR_CONF_OFFSET_FLAGS
#define FR_CONF_OFFSET_FLAGS(_name, _flags, _struct, _field)
conf_parser_t which parses a single CONF_PAIR, writing the result to a field in a struct
Definition cf_parse.h:272
FR_CONF_OFFSET_SUBSECTION
#define FR_CONF_OFFSET_SUBSECTION(_name, _flags, _struct, _field, _subcs)
conf_parser_t which populates a sub-struct using a CONF_SECTION
Definition cf_parse.h:313
CONF_FLAG_XLAT
@ CONF_FLAG_XLAT
string will be dynamically expanded.
Definition cf_parse.h:445
CONF_FLAG_SUBSECTION
@ CONF_FLAG_SUBSECTION
Instead of putting the information into a configuration structure, the configuration file routines MA...
Definition cf_parse.h:428
conf_parser_s
Defines a CONF_PAIR to C data type mapping.
Definition cf_parse.h:595
cf_pair
Configuration AVP similar to a fr_pair_t.
Definition cf_priv.h:70
cf_section
A section grouping multiple CONF_PAIR.
Definition cf_priv.h:101
cf_section_find
CONF_SECTION * cf_section_find(CONF_SECTION const *cs, char const *name1, char const *name2)
Find a CONF_SECTION with name1 and optionally name2.
Definition cf_util.c:1027
cf_log_err
#define cf_log_err(_cf, _fmt,...)
Definition cf_util.h:289
CF_IDENT_ANY
#define CF_IDENT_ANY
Definition cf_util.h:78
FR_DBUFF_TMP
#define FR_DBUFF_TMP(_start, _len_or_end)
Creates a compound literal to pass into functions which accept a dbuff.
Definition dbuff.h:514
fr_dcursor_append
static int fr_dcursor_append(fr_dcursor_t *cursor, void *v)
Insert a single item at the end of the list.
Definition dcursor.h:408
fr_dcursor_s
Definition dcursor.h:93
MEM
#define MEM(x)
Definition debug.h:36
ERROR
#define ERROR(fmt,...)
Definition dhcpclient.c:41
DEBUG
#define DEBUG(fmt,...)
Definition dhcpclient.c:39
fr_dict_attr_autoload_t::out
fr_dict_attr_t const ** out
Where to write a pointer to the resolved fr_dict_attr_t.
Definition dict.h:273
fr_dict_autoload_t::out
fr_dict_t const ** out
Where to write a pointer to the loaded/resolved fr_dict_t.
Definition dict.h:286
fr_dict_enum_by_name
fr_dict_enum_value_t const * fr_dict_enum_by_name(fr_dict_attr_t const *da, char const *name, ssize_t len)
Definition dict_util.c:3439
in
static fr_slen_t in
Definition dict.h:840
fr_dict_attr_autoload_t
Specifies an attribute which must be present for the module to function.
Definition dict.h:272
fr_dict_autoload_t
Specifies a dictionary which must be loaded/loadable for the module to function.
Definition dict.h:285
value
Test enumeration values.
Definition dict_test.h:92
MODULE_MAGIC_INIT
#define MODULE_MAGIC_INIT
Stop people using different module/library/server versions together.
Definition dl_module.h:63
EXEC_TIMEOUT
#define EXEC_TIMEOUT
Default wait time for exec calls (in seconds).
Definition exec.h:32
radius_exec_program_legacy
int radius_exec_program_legacy(char *out, size_t outlen, request_t *request, char const *cmd, fr_pair_list_t *input_pairs, bool exec_wait, bool shell_escape, fr_time_delta_t timeout)
Execute a program.
Definition exec_legacy.c:474
radius_start_program_legacy
pid_t radius_start_program_legacy(int *stdin_fd, int *stdout_fd, int *stderr_fd, char const *cmd, request_t *request, bool exec_wait, fr_pair_list_t *input_pairs, bool shell_escape)
Start a process.
Definition exec_legacy.c:227
radius_readfrom_program_legacy
int radius_readfrom_program_legacy(int fd, pid_t pid, fr_time_delta_t timeout, char *answer, int left)
Read from the child process.
Definition exec_legacy.c:357
unlang_function_push
#define unlang_function_push(_request, _func, _repeat, _signal, _sigmask, _top_frame, _uctx)
Push a generic function onto the unlang stack.
Definition function.h:111
mschap_xlat
static xlat_action_t mschap_xlat(TALLOC_CTX *ctx, fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *in)
Get data from MSCHAP attributes.
Definition rlm_mschap.c:368
unlang_interpret_frame_talloc_ctx
TALLOC_CTX * unlang_interpret_frame_talloc_ctx(request_t *request)
Get a talloc_ctx which is valid only for this frame.
Definition interpret.c:1405
UNLANG_SUB_FRAME
#define UNLANG_SUB_FRAME
Definition interpret.h:36
REXDENT
#define REXDENT()
Exdent (unindent) R* messages by one level.
Definition log.h:443
RHEXDUMP1
#define RHEXDUMP1(_data, _len, _fmt,...)
Definition log.h:703
RWDEBUG
#define RWDEBUG(fmt,...)
Definition log.h:361
RDEBUG_ENABLED3
#define RDEBUG_ENABLED3
True if request debug level 1-3 messages are enabled.
Definition log.h:335
RDEBUG3
#define RDEBUG3(fmt,...)
Definition log.h:343
RWDEBUG2
#define RWDEBUG2(fmt,...)
Definition log.h:362
RERROR
#define RERROR(fmt,...)
Definition log.h:298
RPERROR
#define RPERROR(fmt,...)
Definition log.h:302
REDEBUG2
#define REDEBUG2(fmt,...)
Definition log.h:372
RINDENT
#define RINDENT()
Indent R* messages by one level.
Definition log.h:430
waitpid
waitpid(reap->pid_ev->pid, &status, 0)
talloc_free
talloc_free(reap)
fr_md4_calc
void fr_md4_calc(uint8_t out[static MD4_DIGEST_LENGTH], uint8_t const *in, size_t inlen)
Calculate the MD4 hash of the contents of a buffer.
Definition md4.c:482
MD4_DIGEST_LENGTH
#define MD4_DIGEST_LENGTH
Definition md4.h:25
FR_TYPE_STRING
@ FR_TYPE_STRING
String of printable characters.
Definition merged_model.c:83
FR_TYPE_UINT8
@ FR_TYPE_UINT8
8 Bit unsigned integer.
Definition merged_model.c:97
FR_TYPE_UINT32
@ FR_TYPE_UINT32
32 Bit unsigned integer.
Definition merged_model.c:99
FR_TYPE_VOID
@ FR_TYPE_VOID
User data.
Definition merged_model.c:127
FR_TYPE_OCTETS
@ FR_TYPE_OCTETS
Raw octets.
Definition merged_model.c:84
ssize_t
long int ssize_t
Definition merged_model.c:24
uint8_t
unsigned char uint8_t
Definition merged_model.c:30
fr_dict_attr_t
Definition merged_model.c:133
fr_dict_t
Definition merged_model.c:198
fr_value_box_t
Definition merged_model.c:136
request_t
Definition merged_model.c:210
tmpl_t
Definition merged_model.c:225
fr_digest_cmp
int fr_digest_cmp(uint8_t const *a, uint8_t const *b, size_t length)
Do a comparison of two authentication digests by comparing the FULL data.
Definition misc.c:472
strncasecmp
int strncasecmp(char *s1, char *s2, int n)
Definition missing.c:36
strsep
char * strsep(char **stringp, char const *delim)
Definition missing.c:123
strcasecmp
int strcasecmp(char *s1, char *s2)
Definition missing.c:66
module_ctx_t::env_data
void * env_data
Per call environment data.
Definition module_ctx.h:44
module_ctx_t::mi
module_instance_t const * mi
Instance of the module being instantiated.
Definition module_ctx.h:42
module_ctx_t::thread
void * thread
Thread specific instance data.
Definition module_ctx.h:43
module_thread_inst_ctx_t::el
fr_event_list_t * el
Event list to register any IO handlers and timers against.
Definition module_ctx.h:68
module_thread_inst_ctx_t::thread
void * thread
Thread instance data.
Definition module_ctx.h:67
module_thread_inst_ctx_t::mi
module_instance_t const * mi
Instance of the module being instantiated.
Definition module_ctx.h:64
module_inst_ctx_t::mi
module_instance_t * mi
Instance of the module being instantiated.
Definition module_ctx.h:51
module_ctx_t
Temporary structure to hold arguments for module calls.
Definition module_ctx.h:41
module_inst_ctx_t
Temporary structure to hold arguments for instantiation calls.
Definition module_ctx.h:50
module_thread_inst_ctx_t
Temporary structure to hold arguments for thread_instantiation calls.
Definition module_ctx.h:63
module_rlm_xlat_register
xlat_t * module_rlm_xlat_register(TALLOC_CTX *ctx, module_inst_ctx_t const *mctx, char const *name, xlat_func_t func, fr_type_t return_type)
Definition module_rlm.c:243
module_rlm_section_type_set
bool module_rlm_section_type_set(request_t *request, fr_dict_attr_t const *type_da, fr_dict_enum_value_t const *enumv)
Set the next section type if it's not already set.
Definition module_rlm.c:413
module_rlm_s::common
module_t common
Common fields presented by all modules.
Definition module_rlm.h:39
module_rlm_s
Definition module_rlm.h:38
mschap_nt_password_hash
int mschap_nt_password_hash(uint8_t out[static NT_DIGEST_LENGTH], char const *password)
Converts Unicode password to 16-byte NT hash with MD4.
Definition mschap.c:52
mschap_add_reply
void mschap_add_reply(request_t *request, uint8_t ident, fr_dict_attr_t const *da, char const *value, size_t len)
Definition mschap.c:162
mschap_auth_response
void mschap_auth_response(char const *username, size_t username_len, uint8_t const *nt_hash_hash, uint8_t const *ntresponse, uint8_t const *peer_challenge, uint8_t const *auth_challenge, char *response)
Definition mschap.c:101
mschap_challenge_hash
void mschap_challenge_hash(uint8_t challenge[static MSCHAP_CHALLENGE_LENGTH], uint8_t const peer_challenge[static MSCHAP_PEER_CHALLENGE_LENGTH], uint8_t const auth_challenge[static MSCHAP_PEER_AUTHENTICATOR_CHALLENGE_LENGTH], char const *user_name, size_t user_name_len)
Definition mschap.c:72
LM_DIGEST_LENGTH
#define LM_DIGEST_LENGTH
Definition mschap.h:8
NT_DIGEST_LENGTH
#define NT_DIGEST_LENGTH
Definition mschap.h:7
fr_pair_value_memdup
int fr_pair_value_memdup(fr_pair_t *vp, uint8_t const *src, size_t len, bool tainted)
Copy data into an "octets" data type.
Definition pair.c:2936
fr_pair_find_by_da_nested
fr_pair_t * fr_pair_find_by_da_nested(fr_pair_list_t const *list, fr_pair_t const *prev, fr_dict_attr_t const *da)
Find a pair with a matching fr_dict_attr_t, by walking the nested fr_dict_attr_t tree.
Definition pair.c:774
fr_pair_find_by_da
fr_pair_t * fr_pair_find_by_da(fr_pair_list_t const *list, fr_pair_t const *prev, fr_dict_attr_t const *da)
Find the first pair with a matching da.
Definition pair.c:697
fr_pair_parent
fr_pair_t * fr_pair_parent(fr_pair_t const *vp)
Return a pointer to the parent pair.
Definition pair.c:946
fr_pair_afrom_da
fr_pair_t * fr_pair_afrom_da(TALLOC_CTX *ctx, fr_dict_attr_t const *da)
Dynamically allocate a new attribute and assign a fr_dict_attr_t.
Definition pair.c:287
fr_pair_value_bstr_alloc
int fr_pair_value_bstr_alloc(fr_pair_t *vp, char **out, size_t size, bool tainted)
Pre-allocate a memory buffer for a "string" type value pair.
Definition pair.c:2732
fr_pair_value_mem_alloc
int fr_pair_value_mem_alloc(fr_pair_t *vp, uint8_t **out, size_t size, bool tainted)
Pre-allocate a memory buffer for a "octets" type value pair.
Definition pair.c:2885
normify
static ssize_t normify(normalise_t *action, uint8_t *buffer, size_t bufflen, char const *known_good, size_t len, size_t min_len)
Definition password.c:429
password_find
fr_pair_t * password_find(bool *ephemeral, TALLOC_CTX *ctx, request_t *request, fr_dict_attr_t const *allowed_attrs[], size_t allowed_attrs_len, bool normify)
Find a "known good" password in the control list of a request.
Definition password.c:983
config
static const conf_parser_t config[]
Definition base.c:183
fr_assert
#define fr_assert(_expr)
Definition rad_assert.h:38
attr_user_name
static fr_dict_attr_t const * attr_user_name
Definition radclient-ng.c:128
pair_update_request
#define pair_update_request(_attr, _da)
Definition radclient-ng.c:60
done
static bool done
Definition radclient.c:81
REDEBUG
#define REDEBUG(fmt,...)
Definition radclient.h:52
RDEBUG2
#define RDEBUG2(fmt,...)
Definition radclient.h:54
WARN
#define WARN(fmt,...)
Definition radclient.h:47
conf
static rs_t * conf
Definition radsniff.c:53
fr_rand
uint32_t fr_rand(void)
Return a 32-bit random number.
Definition rand.c:105
RETURN_MODULE_REJECT
#define RETURN_MODULE_REJECT
Definition rcode.h:56
RETURN_MODULE_NOOP
#define RETURN_MODULE_NOOP
Definition rcode.h:63
RETURN_MODULE_RCODE
#define RETURN_MODULE_RCODE(_rcode)
Definition rcode.h:66
RETURN_MODULE_INVALID
#define RETURN_MODULE_INVALID
Definition rcode.h:60
RETURN_MODULE_OK
#define RETURN_MODULE_OK
Definition rcode.h:58
RETURN_MODULE_FAIL
#define RETURN_MODULE_FAIL
Definition rcode.h:57
rlm_rcode_t
rlm_rcode_t
Return codes indicating the result of the module call.
Definition rcode.h:40
RLM_MODULE_INVALID
@ RLM_MODULE_INVALID
The module considers the request invalid.
Definition rcode.h:45
RLM_MODULE_OK
@ RLM_MODULE_OK
The module is OK, continue.
Definition rcode.h:43
RLM_MODULE_DISALLOW
@ RLM_MODULE_DISALLOW
Reject the request (user is locked out).
Definition rcode.h:46
RLM_MODULE_REJECT
@ RLM_MODULE_REJECT
Immediately reject the request.
Definition rcode.h:41
RLM_MODULE_NOTFOUND
@ RLM_MODULE_NOTFOUND
User not found.
Definition rcode.h:47
RLM_MODULE_NOOP
@ RLM_MODULE_NOOP
Module succeeded without doing anything.
Definition rcode.h:48
mod_thread_instantiate
static int mod_thread_instantiate(module_thread_inst_ctx_t const *mctx)
Definition rlm_cache_memcached.c:326
mod_thread_detach
static int mod_thread_detach(module_thread_inst_ctx_t const *mctx)
Definition rlm_cache_memcached.c:341
SHSpad2
static const uint8_t SHSpad2[40]
Definition rlm_mschap.c:1244
attr_smb_account_ctrl
fr_dict_attr_t const * attr_smb_account_ctrl
Definition rlm_mschap.c:243
mschap_xlat_call_env_t::username
tmpl_t const * username
Definition rlm_mschap.c:158
CHECK_OPTION
#define CHECK_OPTION(_option)
xlat_call_env
static const call_env_parser_t xlat_call_env[]
Definition rlm_mschap.c:164
mppe_chap2_get_keys128
static void mppe_chap2_get_keys128(uint8_t const *nt_hashhash, uint8_t const *nt_response, uint8_t *sendkey, uint8_t *recvkey)
Definition rlm_mschap.c:1320
mppe_add_reply
static void mppe_add_reply(UNUSED rlm_mschap_t const *inst, request_t *request, fr_dict_attr_t const *da, uint8_t const *value, size_t len)
Definition rlm_mschap.c:799
attr_nt_password
fr_dict_attr_t const * attr_nt_password
Definition rlm_mschap.c:241
attr_ms_chap_new_cleartext_password
fr_dict_attr_t const * attr_ms_chap_new_cleartext_password
Definition rlm_mschap.c:236
rlm_mschap_dict
fr_dict_autoload_t rlm_mschap_dict[]
Definition rlm_mschap.c:227
ACB_MNS
#define ACB_MNS
MNS logon user account.
Definition rlm_mschap.c:74
auth_call_env
static const call_env_parser_t auth_call_env[]
Definition rlm_mschap.c:172
mschap_xlat_call_env_t::chap_response
tmpl_t const * chap_response
Definition rlm_mschap.c:160
mschap_autz_call_env_t::chap2_cpw
tmpl_t const * chap2_cpw
Definition rlm_mschap.c:212
attr_eap_identity
fr_dict_attr_t const * attr_eap_identity
Definition rlm_mschap.c:235
mschap_autz_call_env_t::chap2_response
tmpl_t const * chap2_response
Definition rlm_mschap.c:211
mschap_process_v2_response
static unlang_action_t mschap_process_v2_response(rlm_rcode_t *p_result, int *mschap_version, uint8_t nthashhash[static NT_DIGEST_LENGTH], rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx, fr_pair_t *challenge, fr_pair_t *response)
Definition rlm_mschap.c:1764
ACB_AUTOLOCK
#define ACB_AUTOLOCK
Account auto locked.
Definition rlm_mschap.c:79
MSCHAP_CALL_ENV
#define MSCHAP_CALL_ENV(_x)
Definition rlm_mschap.c:137
attr_smb_account_ctrl_text
fr_dict_attr_t const * attr_smb_account_ctrl_text
Definition rlm_mschap.c:242
autz_call_env
static const call_env_parser_t autz_call_env[]
Definition rlm_mschap.c:215
ACB_TEMPDUP
#define ACB_TEMPDUP
Temporary duplicate account.
Definition rlm_mschap.c:72
pdb_decode_acct_ctrl
static int pdb_decode_acct_ctrl(char const *p)
Definition rlm_mschap.c:277
dict_freeradius
static fr_dict_t const * dict_freeradius
Definition rlm_mschap.c:223
mschap_process_response
static unlang_action_t mschap_process_response(rlm_rcode_t *p_result, int *mschap_version, uint8_t nthashhash[static NT_DIGEST_LENGTH], rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx, fr_pair_t *challenge, fr_pair_t *response)
Definition rlm_mschap.c:1712
mppe_GetMasterKey
static void mppe_GetMasterKey(uint8_t const *nt_hashhash, uint8_t const *nt_response, uint8_t *masterkey)
Definition rlm_mschap.c:1278
mschap_auth_method_env
static const call_env_method_t mschap_auth_method_env
Definition rlm_mschap.c:187
nt_password_find
static int nt_password_find(TALLOC_CTX *ctx, fr_pair_t **out, rlm_mschap_t const *inst, request_t *request)
Find a Password.NT value, or create one from a Password.Cleartext, or Password.With-Header attribute.
Definition rlm_mschap.c:1491
ACB_FR_EXPIRED
#define ACB_FR_EXPIRED
Password Expired.
Definition rlm_mschap.c:80
ACB_DISABLED
#define ACB_DISABLED
User account disabled.
Definition rlm_mschap.c:69
dict_radius
static fr_dict_t const * dict_radius
Definition rlm_mschap.c:224
magic1
static const uint8_t magic1[27]
Definition rlm_mschap.c:1250
mod_authenticate
static unlang_action_t mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
Definition rlm_mschap.c:2229
mod_bootstrap
static int mod_bootstrap(module_inst_ctx_t const *mctx)
Definition rlm_mschap.c:2454
SHSpad1
static const uint8_t SHSpad1[40]
Definition rlm_mschap.c:1238
attr_auth_type
fr_dict_attr_t const * attr_auth_type
Definition rlm_mschap.c:233
attr_ms_chap_user_name
fr_dict_attr_t const * attr_ms_chap_user_name
Definition rlm_mschap.c:240
mschap_autz_call_env_t::chap_response
tmpl_t const * chap_response
Definition rlm_mschap.c:210
mppe_GetAsymmetricStartKey
static void mppe_GetAsymmetricStartKey(uint8_t *masterkey, uint8_t *sesskey, int keylen, int issend)
Definition rlm_mschap.c:1294
mschap_xlat_args
static xlat_arg_parser_t const mschap_xlat_args[]
Definition rlm_mschap.c:355
attr_ms_chap_use_ntlm_auth
fr_dict_attr_t const * attr_ms_chap_use_ntlm_auth
Definition rlm_mschap.c:239
ACB_HOMDIRREQ
#define ACB_HOMDIRREQ
Home directory required.
Definition rlm_mschap.c:70
mschap_xlat_call_env_t::chap2_response
tmpl_t const * chap2_response
Definition rlm_mschap.c:161
rlm_mschap
module_rlm_t rlm_mschap
Definition rlm_mschap.c:2489
write_all
static int write_all(int fd, char const *buf, size_t len)
Definition rlm_mschap.c:814
attr_cleartext_password
fr_dict_attr_t const * attr_cleartext_password
Definition rlm_mschap.c:234
mod_authorize
static unlang_action_t mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
Definition rlm_mschap.c:1358
rlm_mschap_dict_attr
fr_dict_attr_autoload_t rlm_mschap_dict_attr[]
Definition rlm_mschap.c:246
mod_authenticate_resume
static unlang_action_t mod_authenticate_resume(rlm_rcode_t *p_result, UNUSED int *priority, request_t *request, void *uctx)
Complete mschap authentication after any tmpls have been expanded.
Definition rlm_mschap.c:1914
magic3
static const uint8_t magic3[84]
Definition rlm_mschap.c:1266
do_mschap_cpw
static int do_mschap_cpw(rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx, uint8_t *new_nt_password, uint8_t *old_nt_hash)
Definition rlm_mschap.c:839
do_mschap
static int do_mschap(rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx, uint8_t const *challenge, uint8_t const *response, uint8_t nthashhash[static NT_DIGEST_LENGTH])
Definition rlm_mschap.c:1051
magic2
static const uint8_t magic2[84]
Definition rlm_mschap.c:1255
ACB_DOMTRUST
#define ACB_DOMTRUST
Interdomain trust account.
Definition rlm_mschap.c:75
ACB_WSTRUST
#define ACB_WSTRUST
Workstation trust account.
Definition rlm_mschap.c:76
mppe_chap2_gen_keys128
static void mppe_chap2_gen_keys128(uint8_t const *nt_hashhash, uint8_t const *response, uint8_t *sendkey, uint8_t *recvkey)
Definition rlm_mschap.c:1334
attr_ms_chap_new_nt_password
fr_dict_attr_t const * attr_ms_chap_new_nt_password
Definition rlm_mschap.c:237
ACB_NORMAL
#define ACB_NORMAL
Normal user account.
Definition rlm_mschap.c:73
mschap_xlat_call_env_t::chap_challenge
tmpl_t const * chap_challenge
Definition rlm_mschap.c:159
ACB_PWNOTREQ
#define ACB_PWNOTREQ
User password not required.
Definition rlm_mschap.c:71
mschap_error
static unlang_action_t mschap_error(rlm_rcode_t *p_result, rlm_mschap_t const *inst, request_t *request, unsigned char ident, int mschap_result, int mschap_version, fr_pair_t *smb_ctrl, mschap_auth_call_env_t *env_data)
Definition rlm_mschap.c:1393
module_config
static const conf_parser_t module_config[]
Definition rlm_mschap.c:103
mschap_process_cpw_request
static unlang_action_t mschap_process_cpw_request(rlm_rcode_t *p_result, rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx)
Definition rlm_mschap.c:1579
mod_authenticate_domain_tmpl_push
static unlang_action_t mod_authenticate_domain_tmpl_push(rlm_rcode_t *p_result, UNUSED int *priority, request_t *request, void *uctx)
When changing passwords using the ntlm_auth helper, evaluate the domain tmpl.
Definition rlm_mschap.c:2061
attr_ms_chap_peer_challenge
fr_dict_attr_t const * attr_ms_chap_peer_challenge
Definition rlm_mschap.c:238
mschap_cpw_prepare
static int mschap_cpw_prepare(request_t *request, mschap_auth_ctx_t *auth_ctx)
Validate data required for change password requests.
Definition rlm_mschap.c:1612
MSCHAP_OPT_CALL_ENV
#define MSCHAP_OPT_CALL_ENV(_opt, _x)
Definition rlm_mschap.c:154
mod_instantiate
static int mod_instantiate(module_inst_ctx_t const *mctx)
Definition rlm_mschap.c:2360
ACB_PWNOEXP
#define ACB_PWNOEXP
User password does not expire.
Definition rlm_mschap.c:78
mschap_identity_find
static fr_pair_t * mschap_identity_find(request_t *request, fr_dict_attr_t const *attr_user_name)
Definition rlm_mschap.c:262
passchange_config
static const conf_parser_t passchange_config[]
Definition rlm_mschap.c:82
mschap_autz_call_env_t::chap_challenge
tmpl_t const * chap_challenge
Definition rlm_mschap.c:209
MSCHAP_COMMON_CALL_ENV
#define MSCHAP_COMMON_CALL_ENV(_x)
Definition rlm_mschap.c:146
ACB_SVRTRUST
#define ACB_SVRTRUST
Server trust account.
Definition rlm_mschap.c:77
winbind_config
static const conf_parser_t winbind_config[]
Definition rlm_mschap.c:94
mschap_autz_call_env_t
Definition rlm_mschap.c:208
mschap_xlat_call_env_t
Definition rlm_mschap.c:157
rlm_mschap.h
mschap_cpw_ctx_t::new_nt_encrypted
uint8_t new_nt_encrypted[516]
Definition rlm_mschap.h:106
mschap_auth_call_env_t::username
tmpl_t const * username
Definition rlm_mschap.h:82
mschap_auth_ctx_t::method
MSCHAP_AUTH_METHOD method
Definition rlm_mschap.h:115
mschap_auth_call_env_t::mppe_encryption_types
tmpl_t const * mppe_encryption_types
Definition rlm_mschap.h:92
mschap_auth_ctx_t::cpw
fr_pair_t * cpw
Definition rlm_mschap.h:118
mschap_auth_ctx_t::name
char const * name
Definition rlm_mschap.h:112
mschap_auth_call_env_t::ntlm_cpw_domain
tmpl_t const * ntlm_cpw_domain
Definition rlm_mschap.h:98
mschap_cpw_ctx_t::new_hash
fr_pair_t * new_hash
Definition rlm_mschap.h:108
mschap_auth_call_env_t::ntlm_cpw_username
tmpl_t const * ntlm_cpw_username
Definition rlm_mschap.h:97
mschap_auth_call_env_t::chap_nt_enc_pw
tmpl_t const * chap_nt_enc_pw
Definition rlm_mschap.h:94
mschap_auth_call_env_t::mppe_send_key
tmpl_t const * mppe_send_key
Definition rlm_mschap.h:91
mschap_auth_ctx_t::inst
rlm_mschap_t const * inst
Definition rlm_mschap.h:113
mschap_cpw_ctx_t::cpw_user
fr_value_box_list_t cpw_user
Definition rlm_mschap.h:103
mschap_auth_call_env_t::chap_response
tmpl_t const * chap_response
Definition rlm_mschap.h:85
mschap_auth_call_env_t::local_cpw
tmpl_t const * local_cpw
Definition rlm_mschap.h:99
mschap_cpw_ctx_t::cpw_domain
fr_value_box_list_t cpw_domain
Definition rlm_mschap.h:104
mschap_auth_ctx_t::smb_ctrl
fr_pair_t * smb_ctrl
Definition rlm_mschap.h:117
mschap_auth_call_env_t::chap_challenge
tmpl_t const * chap_challenge
Definition rlm_mschap.h:84
mschap_auth_call_env_t::chap2_response
tmpl_t const * chap2_response
Definition rlm_mschap.h:86
mschap_cpw_ctx_t::local_cpw_result
fr_value_box_list_t local_cpw_result
Definition rlm_mschap.h:105
mschap_auth_call_env_t::mppe_encryption_policy
tmpl_t const * mppe_encryption_policy
Definition rlm_mschap.h:89
mschap_auth_ctx_t::env_data
mschap_auth_call_env_t * env_data
Definition rlm_mschap.h:114
mschap_auth_call_env_t::mppe_recv_key
tmpl_t const * mppe_recv_key
Definition rlm_mschap.h:90
mschap_auth_call_env_t::chap_error
tmpl_t const * chap_error
Definition rlm_mschap.h:83
mschap_auth_call_env_t::chap2_cpw
tmpl_t const * chap2_cpw
Definition rlm_mschap.h:93
mschap_cpw_ctx_t::old_nt_hash
uint8_t old_nt_hash[NT_DIGEST_LENGTH]
Definition rlm_mschap.h:107
mschap_auth_call_env_t::chap2_success
tmpl_t const * chap2_success
Definition rlm_mschap.h:87
mschap_auth_ctx_t::cpw_ctx
mschap_cpw_ctx_t * cpw_ctx
Definition rlm_mschap.h:119
mschap_auth_ctx_t::nt_password
fr_pair_t * nt_password
Definition rlm_mschap.h:116
AUTH_AUTO
@ AUTH_AUTO
Definition rlm_mschap.h:20
AUTH_INTERNAL
@ AUTH_INTERNAL
Definition rlm_mschap.h:18
AUTH_NTLMAUTH_EXEC
@ AUTH_NTLMAUTH_EXEC
Definition rlm_mschap.h:19
mschap_auth_call_env_t::chap_mppe_keys
tmpl_t const * chap_mppe_keys
Definition rlm_mschap.h:88
mschap_auth_call_env_t
Definition rlm_mschap.h:81
mschap_auth_ctx_t
Definition rlm_mschap.h:111
mschap_cpw_ctx_t
Definition rlm_mschap.h:102
rlm_mschap_t
Definition rlm_mschap.h:41
instantiate
static int instantiate(module_inst_ctx_t const *mctx)
Definition rlm_rest.c:1313
username
username
Definition rlm_securid.c:420
winbind_ctx_alloc
static int winbind_ctx_alloc(winbind_ctx_t *wbctx, UNUSED void *uctx)
Definition rlm_winbind.c:356
reuse_winbind_config
static conf_parser_t reuse_winbind_config[]
Definition rlm_winbind.c:49
_mod_ctx_free
static int _mod_ctx_free(winbind_ctx_t *wbctx)
Definition rlm_winbind.c:347
winbind_ctx_t::ctx
struct wbcContext * ctx
Definition rlm_winbind.h:21
winbind_ctx_t
Definition rlm_winbind.h:20
FR_SBUFF_IN
#define FR_SBUFF_IN(_start, _len_or_end)
FR_SBUFF_OUT
#define FR_SBUFF_OUT(_start, _len_or_end)
SECTION_NAME
#define SECTION_NAME(_name1, _name2)
Define a section name consisting of a verb and a noun.
Definition section.h:40
module_instance_s::name
char const * name
Instance name e.g. user_database.
Definition module.h:336
module_instance_s::conf
CONF_SECTION * conf
Module's instance configuration.
Definition module.h:330
module_s::inst_size
size_t inst_size
Size of the module's instance data.
Definition module.h:204
module_instance_s::data
void * data
Module's instance data.
Definition module.h:272
module_instance_s::boot
void * boot
Data allocated during the boostrap phase.
Definition module.h:275
MODULE_BINDING_TERMINATOR
#define MODULE_BINDING_TERMINATOR
Terminate a module binding list.
Definition module.h:151
module_method_binding_s
Named methods exported by a module.
Definition module.h:173
pair_append_control
#define pair_append_control(_attr, _da)
Allocate and append a fr_pair_t to the control list.
Definition pair.h:57
pair_update_reply
#define pair_update_reply(_attr, _da)
Return or allocate a fr_pair_t in the reply list.
Definition pair.h:129
tmpl_attr_tail_da
static fr_dict_attr_t const * tmpl_attr_tail_da(tmpl_t const *vpt)
Return the last attribute reference da.
Definition tmpl.h:801
fr_sha1_init
void fr_sha1_init(fr_sha1_ctx *context)
Definition sha1.c:93
fr_sha1_final
void fr_sha1_final(uint8_t digest[static SHA1_DIGEST_LENGTH], fr_sha1_ctx *context)
Definition sha1.c:141
fr_sha1_update
void fr_sha1_update(fr_sha1_ctx *context, uint8_t const *in, size_t len)
Definition sha1.c:105
fr_sha1_ctx
Definition sha1.h:33
FR_SLAB_CONFIG_CONF_PARSER
#define FR_SLAB_CONFIG_CONF_PARSER
conf_parser_t entries to populate user configurable slab values
Definition slab.h:35
smbhash
void smbhash(unsigned char *out, unsigned char const *in, unsigned char *key)
Definition smbdes.c:287
smbdes_mschap
void smbdes_mschap(uint8_t const win_password[16], uint8_t const *challenge, uint8_t *response)
Definition smbdes.c:339
smbdes_lmpwdhash
void smbdes_lmpwdhash(char const *password, uint8_t *lmhash)
Definition smbdes.c:319
snprintf
PUBLIC int snprintf(char *string, size_t length, char *format, va_alist)
Definition snprintf.c:689
inst
eap_aka_sim_process_conf_t * inst
Definition state_machine.c:3620
vp
fr_pair_t * vp
Definition state_machine.c:2262
value_pair_s
Stores an attribute, a value and various bits of other data.
Definition pair.h:68
value_pair_s::da
fr_dict_attr_t const *_CONST da
Dictionary attribute defines the attribute number, vendor and type of the pair.
Definition pair.h:69
fr_syserror
char const * fr_syserror(int num)
Guaranteed to be thread-safe version of strerror.
Definition syserror.c:243
talloc_get_type_abort_const
#define talloc_get_type_abort_const
Definition talloc.h:287
fr_time_delta_lt
#define fr_time_delta_lt(_a, _b)
Definition time.h:285
fr_time_delta_from_sec
static fr_time_delta_t fr_time_delta_from_sec(int64_t sec)
Definition time.h:590
fr_time_delta_ispos
#define fr_time_delta_ispos(_a)
Definition time.h:290
fr_time_delta_gt
#define fr_time_delta_gt(_a, _b)
Definition time.h:283
unlang_tmpl_push
int unlang_tmpl_push(TALLOC_CTX *ctx, fr_value_box_list_t *out, request_t *request, tmpl_t const *tmpl, unlang_tmpl_args_t *args)
Push a tmpl onto the stack for evaluation.
Definition tmpl.c:260
T_BARE_WORD
@ T_BARE_WORD
Definition token.h:120
close
close(uq->fd)
xlat_arg_parser_t::required
uint8_t required
Argument must be present, and non-empty.
Definition xlat.h:145
XLAT_ARG_PARSER_TERMINATOR
#define XLAT_ARG_PARSER_TERMINATOR
Definition xlat.h:169
xlat_action_t
xlat_action_t
Definition xlat.h:37
XLAT_ACTION_FAIL
@ XLAT_ACTION_FAIL
An xlat function failed.
Definition xlat.h:44
XLAT_ACTION_DONE
@ XLAT_ACTION_DONE
We're done evaluating this level of nesting.
Definition xlat.h:43
xlat_arg_parser_t
Definition for a single argument consumend by an xlat function.
Definition xlat.h:144
parent
static fr_slen_t parent
Definition pair.h:839
fr_strerror_printf
#define fr_strerror_printf(_fmt,...)
Log to thread local error buffer.
Definition strerror.h:64
fr_value_box_asprintf
int fr_value_box_asprintf(TALLOC_CTX *ctx, fr_value_box_t *dst, fr_dict_attr_t const *enumv, bool tainted, char const *fmt,...)
Print a formatted string using our internal printf wrapper and assign it to a value box.
Definition value.c:4245
fr_value_box_strdup
int fr_value_box_strdup(TALLOC_CTX *ctx, fr_value_box_t *dst, fr_dict_attr_t const *enumv, char const *src, bool tainted)
Copy a nul terminated string to a fr_value_box_t.
Definition value.c:4158
fr_value_box_memdup
int fr_value_box_memdup(TALLOC_CTX *ctx, fr_value_box_t *dst, fr_dict_attr_t const *enumv, uint8_t const *src, size_t len, bool tainted)
Copy a buffer to a fr_value_box_t.
Definition value.c:4620
data
static fr_slen_t data
Definition value.h:1288
fr_box_strvalue_len
#define fr_box_strvalue_len(_val, _len)
Definition value.h:305
fr_box_time_delta
#define fr_box_time_delta(_val)
Definition value.h:362
nonnull
int nonnull(2, 5))
fr_value_box_alloc_null
#define fr_value_box_alloc_null(_ctx)
Allocate a value box for later use with a value assignment function.
Definition value.h:651
out
static size_t char ** out
Definition value.h:1020
fr_box_octets
#define fr_box_octets(_val, _len)
Definition value.h:307
xlat_ctx_s::env_data
void * env_data
Expanded call env data.
Definition xlat_ctx.h:53
xlat_ctx_s::mctx
module_ctx_t const * mctx
Synthesised module calling ctx.
Definition xlat_ctx.h:52
xlat_ctx_s
An xlat calling ctx.
Definition xlat_ctx.h:49
xlat_func_args_set
int xlat_func_args_set(xlat_t *x, xlat_arg_parser_t const args[])
Register the arguments of an xlat.
Definition xlat_func.c:363
xlat_func_call_env_set
void xlat_func_call_env_set(xlat_t *x, call_env_method_t const *env_method)
Register call environment of an xlat.
Definition xlat_func.c:389
xlat_s
Definition xlat_priv.h:59
Generated by   doxygen 1.9.8