The FreeRADIUS server $Id: 15bac2a4c627c01d1aa2047687b3418955ac7f00 $
Loading...
Searching...
No Matches
rlm_mschap.c
Go to the documentation of this file.
1/*
2 * This program is free software; you can redistribute it and/or modify
3 * it under the terms of the GNU General Public License as published by
4 * the Free Software Foundation; either version 2 of the License, or (at
5 * your option) any later version.
6 *
7 * This program is distributed in the hope that it will be useful,
8 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10 * GNU General Public License for more details.
11 *
12 * You should have received a copy of the GNU General Public License
13 * along with this program; if not, write to the Free Software
14 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
15 */
16
17/**
18 * $Id: 714f7cfa2c87b6ac904276f4dbef184e07ebbcec $
19 * @file rlm_mschap.c
20 * @brief Implemented mschap authentication.
21 *
22 * @copyright 2000, 2001, 2006 The FreeRADIUS server project
23 */
24
25/* MPPE support from Takahiro Wagatsuma <waga@sic.shibaura-it.ac.jp> */
26RCSID("$Id: 714f7cfa2c87b6ac904276f4dbef184e07ebbcec $")
27
28#define LOG_PREFIX mctx->mi->name
29
30#include <freeradius-devel/server/base.h>
31#include <freeradius-devel/server/exec_legacy.h>
32#include <freeradius-devel/server/module_rlm.h>
33#include <freeradius-devel/tls/strerror.h>
34#include <freeradius-devel/util/debug.h>
35#include <freeradius-devel/radius/defs.h>
36
37#include <freeradius-devel/util/base16.h>
38#include <freeradius-devel/util/md4.h>
39#include <freeradius-devel/util/md5.h>
40#include <freeradius-devel/util/misc.h>
41#include <freeradius-devel/util/sha1.h>
42
43#include <freeradius-devel/unlang/function.h>
44#include <freeradius-devel/unlang/xlat_func.h>
45
46#include <sys/wait.h>
47
48#include "rlm_mschap.h"
49#include "smbdes.h"
50
51#ifdef WITH_AUTH_WINBIND
52#include "auth_wbclient.h"
53#endif
54
55#ifdef WITH_TLS
56USES_APPLE_DEPRECATED_API /* OpenSSL API has been deprecated by Apple */
57# include <openssl/rc4.h>
58#endif
59
60#ifdef __APPLE__
61unlang_action_t od_mschap_auth(unlang_result_t *p_result, request_t *request, fr_pair_t *challenge, fr_pair_t *usernamepair,
62 mschap_auth_call_env_t *env_data);
63#endif
64
65/* Allowable account control bits */
66#define ACB_DISABLED 0x00010000 //!< User account disabled.
67#define ACB_HOMDIRREQ 0x00020000 //!< Home directory required.
68#define ACB_PWNOTREQ 0x00040000 //!< User password not required.
69#define ACB_TEMPDUP 0x00080000 //!< Temporary duplicate account.
70#define ACB_NORMAL 0x00100000 //!< Normal user account.
71#define ACB_MNS 0x00200000 //!< MNS logon user account.
72#define ACB_DOMTRUST 0x00400000 //!< Interdomain trust account.
73#define ACB_WSTRUST 0x00800000 //!< Workstation trust account.
74#define ACB_SVRTRUST 0x01000000 //!< Server trust account.
75#define ACB_PWNOEXP 0x02000000 //!< User password does not expire.
76#define ACB_AUTOLOCK 0x04000000 //!< Account auto locked.
77#define ACB_FR_EXPIRED 0x00020000 //!< Password Expired.
78
83
84#ifdef WITH_AUTH_WINBIND
85static conf_parser_t reuse_winbind_config[] = {
86 FR_SLAB_CONFIG_CONF_PARSER
87 CONF_PARSER_TERMINATOR
88};
89#endif
90
91static const conf_parser_t winbind_config[] = {
92 { FR_CONF_OFFSET("username", rlm_mschap_t, wb_username) },
93#ifdef WITH_AUTH_WINBIND
94 { FR_CONF_OFFSET("retry_with_normalised_username", rlm_mschap_t, wb_retry_with_normalised_username), .dflt = "no" },
95 { FR_CONF_OFFSET_SUBSECTION("reuse", 0, rlm_mschap_t, reuse, reuse_winbind_config) },
96#endif
97 CONF_PARSER_TERMINATOR
98};
99
100static const conf_parser_t module_config[] = {
101 { FR_CONF_OFFSET("normalise", rlm_mschap_t, normify), .dflt = "yes" },
102
103 /*
104 * Cache the password by default.
105 */
106 { FR_CONF_OFFSET("use_mppe", rlm_mschap_t, use_mppe), .dflt = "yes" },
107 { FR_CONF_OFFSET("require_encryption", rlm_mschap_t, require_encryption), .dflt = "no" },
108 { FR_CONF_OFFSET("require_strong", rlm_mschap_t, require_strong), .dflt = "no" },
109 { FR_CONF_OFFSET("with_ntdomain_hack", rlm_mschap_t, with_ntdomain_hack), .dflt = "yes" },
110 { FR_CONF_OFFSET_FLAGS("ntlm_auth", CONF_FLAG_XLAT, rlm_mschap_t, ntlm_auth) },
111 { FR_CONF_OFFSET("ntlm_auth_timeout", rlm_mschap_t, ntlm_auth_timeout) },
112
113 { FR_CONF_POINTER("passchange", 0, CONF_FLAG_SUBSECTION, NULL), .subcs = (void const *) passchange_config },
114 { FR_CONF_OFFSET("allow_retry", rlm_mschap_t, allow_retry), .dflt = "yes" },
115 { FR_CONF_OFFSET("retry_msg", rlm_mschap_t, retry_msg) },
116
117
118#ifdef __APPLE__
119 { FR_CONF_OFFSET("use_open_directory", rlm_mschap_t, open_directory), .dflt = "yes" },
120#endif
121
122 { FR_CONF_POINTER("winbind", 0, CONF_FLAG_SUBSECTION, NULL), .subcs = (void const *) winbind_config },
123
124 /*
125 * These are now in a subsection above.
126 */
127 { FR_CONF_DEPRECATED("winbind_username", rlm_mschap_t, wb_username) },
128#ifdef WITH_AUTH_WINBIND
129 { FR_CONF_DEPRECATED("winbind_retry_with_normalised_username", rlm_mschap_t, wb_retry_with_normalised_username) },
130#endif
131 CONF_PARSER_TERMINATOR
132};
133
134#define MSCHAP_CALL_ENV(_x) \
135static const call_env_method_t mschap_ ## _x ## _method_env = { \
136 FR_CALL_ENV_METHOD_OUT(mschap_ ## _x ## _call_env_t), \
137 .env = (call_env_parser_t[]){ \
138 { FR_CALL_ENV_SUBSECTION("attributes", NULL, CALL_ENV_FLAG_REQUIRED, _x ## _call_env) }, \
139 CALL_ENV_TERMINATOR \
140 } \
141}
142
143#define MSCHAP_COMMON_CALL_ENV(_x) \
144{ FR_CALL_ENV_PARSE_ONLY_OFFSET("chap_challenge", FR_TYPE_OCTETS, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_ ## _x ## _call_env_t, chap_challenge), \
145 .pair.dflt = "Vendor-Specific.Microsoft.CHAP-Challenge", .pair.dflt_quote = T_BARE_WORD }, \
146{ FR_CALL_ENV_PARSE_ONLY_OFFSET("chap_response", FR_TYPE_OCTETS, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_ ## _x ## _call_env_t, chap_response), \
147 .pair.dflt = "Vendor-Specific.Microsoft.CHAP-Response", .pair.dflt_quote = T_BARE_WORD }, \
148{ FR_CALL_ENV_PARSE_ONLY_OFFSET("chap2_response", FR_TYPE_OCTETS, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_ ## _x ## _call_env_t, chap2_response), \
149 .pair.dflt = "Vendor-Specific.Microsoft.CHAP2-Response", .pair.dflt_quote = T_BARE_WORD }
150
151#define MSCHAP_OPT_CALL_ENV(_opt, _x) \
152{ FR_CALL_ENV_PARSE_ONLY_OFFSET(STRINGIFY(_opt), FR_TYPE_OCTETS, CALL_ENV_FLAG_ATTRIBUTE, mschap_ ## _x ## _call_env_t, _opt) }
153
160
161static const call_env_parser_t xlat_call_env[] = {
162 { FR_CALL_ENV_PARSE_ONLY_OFFSET("username", FR_TYPE_STRING, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_xlat_call_env_t, username), .pair.dflt = "User-Name", .pair.dflt_quote = T_BARE_WORD },
163 MSCHAP_COMMON_CALL_ENV(xlat),
164 CALL_ENV_TERMINATOR
165};
166
167MSCHAP_CALL_ENV(xlat);
168
169static const call_env_parser_t auth_call_env[] = {
170 { FR_CALL_ENV_PARSE_ONLY_OFFSET("username", FR_TYPE_STRING, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_auth_call_env_t, username), .pair.dflt = "User-Name", .pair.dflt_quote = T_BARE_WORD },
171 MSCHAP_COMMON_CALL_ENV(auth),
172 MSCHAP_OPT_CALL_ENV(chap2_success, auth),
173 MSCHAP_OPT_CALL_ENV(chap_error, auth),
174 MSCHAP_OPT_CALL_ENV(chap_mppe_keys, auth),
175 MSCHAP_OPT_CALL_ENV(mppe_encryption_policy, auth),
176 MSCHAP_OPT_CALL_ENV(mppe_recv_key, auth),
177 MSCHAP_OPT_CALL_ENV(mppe_send_key, auth),
178 MSCHAP_OPT_CALL_ENV(mppe_encryption_types, auth),
179 MSCHAP_OPT_CALL_ENV(chap2_cpw, auth),
180 MSCHAP_OPT_CALL_ENV(chap_nt_enc_pw, auth),
181 CALL_ENV_TERMINATOR
182};
183
204
211
212static const call_env_parser_t autz_call_env[] = {
213 MSCHAP_COMMON_CALL_ENV(autz),
214 MSCHAP_OPT_CALL_ENV(chap2_cpw, autz),
215 CALL_ENV_TERMINATOR
216};
217
218MSCHAP_CALL_ENV(autz);
219
220static fr_dict_t const *dict_freeradius;
221static fr_dict_t const *dict_radius;
222
223extern fr_dict_autoload_t rlm_mschap_dict[];
224fr_dict_autoload_t rlm_mschap_dict[] = {
225 { .out = &dict_freeradius, .proto = "freeradius" },
226 { .out = &dict_radius, .proto = "radius" },
227 DICT_AUTOLOAD_TERMINATOR
228};
229
230fr_dict_attr_t const *attr_auth_type;
231fr_dict_attr_t const *attr_cleartext_password;
232fr_dict_attr_t const *attr_eap_identity;
233fr_dict_attr_t const *attr_ms_chap_new_cleartext_password;
234fr_dict_attr_t const *attr_ms_chap_new_nt_password;
235fr_dict_attr_t const *attr_ms_chap_peer_challenge;
236fr_dict_attr_t const *attr_ms_chap_use_ntlm_auth;
237fr_dict_attr_t const *attr_ms_chap_user_name;
238fr_dict_attr_t const *attr_nt_password;
239fr_dict_attr_t const *attr_smb_account_ctrl_text;
240fr_dict_attr_t const *attr_smb_account_ctrl;
241
242extern fr_dict_attr_autoload_t rlm_mschap_dict_attr[];
243fr_dict_attr_autoload_t rlm_mschap_dict_attr[] = {
244 { .out = &attr_auth_type, .name = "Auth-Type", .type = FR_TYPE_UINT32, .dict = &dict_freeradius },
245 { .out = &attr_cleartext_password, .name = "Password.Cleartext", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
246 { .out = &attr_eap_identity, .name = "EAP-Identity", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
247 { .out = &attr_ms_chap_new_cleartext_password, .name = "MS-CHAP-New-Cleartext-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
248 { .out = &attr_ms_chap_new_nt_password, .name = "MS-CHAP-New-NT-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
249 { .out = &attr_ms_chap_peer_challenge, .name = "MS-CHAP-Peer-Challenge", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
250 { .out = &attr_ms_chap_use_ntlm_auth, .name = "MS-CHAP-Use-NTLM-Auth", .type = FR_TYPE_UINT8, .dict = &dict_freeradius },
251 { .out = &attr_ms_chap_user_name, .name = "MS-CHAP-User-Name", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
252 { .out = &attr_nt_password, .name = "Password.NT", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
253 { .out = &attr_smb_account_ctrl_text, .name = "SMB-Account-Ctrl-Text", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
254 { .out = &attr_smb_account_ctrl, .name = "SMB-Account-Ctrl", .type = FR_TYPE_UINT32, .dict = &dict_freeradius },
255
256 DICT_AUTOLOAD_TERMINATOR
257};
258
259static fr_pair_t *mschap_identity_find(request_t *request, fr_dict_attr_t const *attr_user_name)
260{
261 fr_pair_t *vp;
262
263 vp = fr_pair_find_by_da(&request->request_pairs, NULL, attr_user_name);
264 if (vp) return vp;
265
266 vp = fr_pair_find_by_da(&request->request_pairs, NULL, attr_eap_identity);
267 if (vp) return vp;
268
269 REDEBUG("No user identity found in current request");
270
271 return NULL;
272}
273
274static int pdb_decode_acct_ctrl(char const *p)
275{
276 int acct_ctrl = 0;
277 int done = 0;
278
279 /*
280 * Check if the account type bits have been encoded after the
281 * NT password (in the form [NDHTUWSLXI]).
282 */
283
284 if (*p != '[') return 0;
285
286 for (p++; *p && !done; p++) {
287 switch (*p) {
288 case 'N': /* 'N'o password. */
289 acct_ctrl |= ACB_PWNOTREQ;
290 break;
291
292 case 'D': /* 'D'isabled. */
293 acct_ctrl |= ACB_DISABLED ;
294 break;
295
296 case 'H': /* 'H'omedir required. */
297 acct_ctrl |= ACB_HOMDIRREQ;
298 break;
299
300 case 'T': /* 'T'emp account. */
301 acct_ctrl |= ACB_TEMPDUP;
302 break;
303
304 case 'U': /* 'U'ser account (normal). */
305 acct_ctrl |= ACB_NORMAL;
306 break;
307
308 case 'M': /* 'M'NS logon user account. What is this? */
309 acct_ctrl |= ACB_MNS;
310 break;
311
312 case 'W': /* 'W'orkstation account. */
313 acct_ctrl |= ACB_WSTRUST;
314 break;
315
316 case 'S': /* 'S'erver account. */
317 acct_ctrl |= ACB_SVRTRUST;
318 break;
319
320 case 'L': /* 'L'ocked account. */
321 acct_ctrl |= ACB_AUTOLOCK;
322 break;
323
324 case 'X': /* No 'X'piry on password */
325 acct_ctrl |= ACB_PWNOEXP;
326 break;
327
328 case 'I': /* 'I'nterdomain trust account. */
329 acct_ctrl |= ACB_DOMTRUST;
330 break;
331
332 case 'e': /* 'e'xpired, the password has */
333 acct_ctrl |= ACB_FR_EXPIRED;
334 break;
335
336 case ' ': /* ignore spaces */
337 break;
338
339 case ':':
340 case '\n':
341 case '\0':
342 case ']':
343 default:
344 done = 1;
345 break;
346 }
347 }
348
349 return acct_ctrl;
350}
351
352static xlat_arg_parser_t const mschap_xlat_args[] = {
353 { .required = true, .single = true, .type = FR_TYPE_STRING },
354 { .concat = true, .type = FR_TYPE_STRING },
355 XLAT_ARG_PARSER_TERMINATOR
356};
357
358/** Get data from MSCHAP attributes
359 *
360 * Pulls NT-Response, LM-Response, or Challenge from MSCHAP
361 * attributes.
362 *
363 * @ingroup xlat_functions
364 */
365static xlat_action_t mschap_xlat(TALLOC_CTX *ctx, fr_dcursor_t *out,
366 xlat_ctx_t const *xctx,
367 request_t *request, fr_value_box_list_t *in)
368{
369 mschap_xlat_call_env_t *env_data = talloc_get_type_abort(xctx->env_data, mschap_xlat_call_env_t);
370 size_t data_len;
371 uint8_t const *data = NULL;
372 uint8_t buffer[32];
373 fr_pair_t *user_name;
374 fr_pair_t *chap_challenge, *response;
375 rlm_mschap_t const *inst = talloc_get_type_abort(xctx->mctx->mi->data, rlm_mschap_t);
376 fr_value_box_t *arg = fr_value_box_list_head(in);
377 fr_value_box_t *vb;
378 bool tainted = false;
379
380 response = NULL;
381
382 /*
383 * Challenge means MS-CHAPv1 challenge, or
384 * hash of MS-CHAPv2 challenge, and peer challenge.
385 */
386 if (strncasecmp(arg->vb_strvalue, "Challenge", 9) == 0) {
387 chap_challenge = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
388 tmpl_attr_tail_da(env_data->chap_challenge));
389 if (!chap_challenge) {
390 REDEBUG("No MS-CHAP-Challenge in the request");
391 return XLAT_ACTION_FAIL;
392 }
393 tainted = chap_challenge->vp_tainted;
394
395 /*
396 * MS-CHAP-Challenges are 8 octets,
397 * for MS-CHAPv1
398 */
399 if (chap_challenge->vp_length == 8) {
400 RDEBUG2("mschap1: %02x", chap_challenge->vp_octets[0]);
401 data = chap_challenge->vp_octets;
402 data_len = 8;
403
404 /*
405 * MS-CHAP-Challenges are 16 octets,
406 * for MS-CHAPv2.
407 */
408 } else if (chap_challenge->vp_length == 16) {
409 fr_pair_t *name_vp;
410 fr_pair_t *response_name;
411 char const *username_str;
412 size_t username_len;
413
414 response = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
415 tmpl_attr_tail_da(env_data->chap2_response));
416 if (!response) {
417 REDEBUG("Vendor-Specific.Microsoft.CHAP2-Response is required to calculate MS-CHAPv1 challenge");
418 return XLAT_ACTION_FAIL;
419 }
420
421 /*
422 * FIXME: Much of this is copied from
423 * below. We should put it into a
424 * separate function.
425 */
426
427 /*
428 * Responses are 50 octets.
429 */
430 if (response->vp_length < 50) {
431 REDEBUG("Vendor-Specific.Microsoft.CHAP-Response has the wrong format");
432 return XLAT_ACTION_FAIL;
433 }
434
435 user_name = mschap_identity_find(request, tmpl_attr_tail_da(env_data->username));
436 if (!user_name) return XLAT_ACTION_FAIL;
437
438 /*
439 * Check for MS-CHAP-User-Name and if found, use it
440 * to construct the MSCHAPv1 challenge. This is
441 * set by rlm_eap_mschap to the MS-CHAP Response
442 * packet Name field.
443 *
444 * We prefer this to the User-Name in the
445 * packet.
446 */
447 response_name = fr_pair_find_by_da(&request->request_pairs, NULL, attr_ms_chap_user_name);
448 name_vp = response_name ? response_name : user_name;
449
450 /*
451 * with_ntdomain_hack moved here, too.
452 */
453 username_str = memchr(name_vp->vp_strvalue, '\\', name_vp->vp_length);
454 if (username_str != NULL) {
455 if (inst->with_ntdomain_hack) {
456 username_str++;
457 } else {
458 RWDEBUG2("NT Domain delimiter found, should 'with_ntdomain_hack' be enabled?");
459 username_str = name_vp->vp_strvalue;
460 }
461 } else {
462 username_str = name_vp->vp_strvalue;
463 }
464 username_len = name_vp->vp_length - (username_str - name_vp->vp_strvalue);
465
466 if (response_name &&
467 ((user_name->vp_length != response_name->vp_length) ||
468 (memcmp(user_name->vp_strvalue, response_name->vp_strvalue, user_name->vp_length) != 0))) {
469 RWDEBUG2("%pP is not the same as %pP from EAP-MSCHAPv2", user_name, response_name);
470 }
471
472 /*
473 * Get the MS-CHAPv1 challenge
474 * from the MS-CHAPv2 peer challenge,
475 * our challenge, and the user name.
476 */
477 RDEBUG2("Creating challenge with username \"%pV\"",
478 fr_box_strvalue_len(username_str, username_len));
479 mschap_challenge_hash(buffer, response->vp_octets + 2, chap_challenge->vp_octets,
480 username_str, username_len);
481 data = buffer;
482 data_len = 8;
483 } else {
484 REDEBUG("Invalid MS-CHAP challenge length");
485 return XLAT_ACTION_FAIL;
486 }
487
488 /*
489 * Get the MS-CHAPv1 response, or the MS-CHAPv2
490 * response.
491 */
492 } else if (strncasecmp(arg->vb_strvalue, "NT-Response", 11) == 0) {
493 response = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
494 tmpl_attr_tail_da(env_data->chap_response));
495 if (!response) response = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
496 tmpl_attr_tail_da(env_data->chap2_response));
497 if (!response) {
498 REDEBUG("No MS-CHAP-Response or MS-CHAP2-Response was found in the request");
499 return XLAT_ACTION_FAIL;
500 }
501 tainted = response->vp_tainted;
502
503 /*
504 * For MS-CHAPv1, the NT-Response exists only
505 * if the second octet says so.
506 */
507 if ((response->da == tmpl_attr_tail_da(env_data->chap_response)) && ((response->vp_octets[1] & 0x01) == 0)) {
508 REDEBUG("No NT-Response in MS-CHAP-Response");
509 return XLAT_ACTION_FAIL;
510 }
511
512 if (response->vp_length < 50) {
513 REDEBUG("Vendor-Specific.Microsoft.CHAP-Response has the wrong format");
514 return XLAT_ACTION_FAIL;
515 }
516
517 /*
518 * MS-CHAP-Response and MS-CHAP2-Response have
519 * the NT-Response at the same offset, and are
520 * the same length.
521 */
522 data = response->vp_octets + 26;
523 data_len = 24;
524
525 /*
526 * LM-Response is deprecated, and exists only
527 * in MS-CHAPv1, and not often there.
528 */
529 } else if (strncasecmp(arg->vb_strvalue, "LM-Response", 11) == 0) {
530 response = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
531 tmpl_attr_tail_da(env_data->chap_response));
532 if (!response) {
533 REDEBUG("No MS-CHAP-Response was found in the request");
534 return XLAT_ACTION_FAIL;
535 }
536 tainted = response->vp_tainted;
537
538 if (response->vp_length < 50) {
539 REDEBUG("Vendor-Specific.Microsoft.CHAP-Response has the wrong format");
540 return XLAT_ACTION_FAIL;
541 }
542 /*
543 * For MS-CHAPv1, the LM-Response exists only
544 * if the second octet says so.
545 */
546 if ((response->vp_octets[1] & 0x01) != 0) {
547 REDEBUG("No LM-Response in MS-CHAP-Response");
548 return XLAT_ACTION_FAIL;
549 }
550 data = response->vp_octets + 2;
551 data_len = 24;
552
553 /*
554 * Pull the domain name out of the User-Name, if it exists.
555 *
556 * This is the full domain name, not just the name after host/
557 */
558 } else if (strncasecmp(arg->vb_strvalue, "Domain-Name", 11) == 0) {
559 char const *p;
560
561 MEM(vb = fr_value_box_alloc_null(ctx));
562
563 user_name = mschap_identity_find(request, tmpl_attr_tail_da(env_data->username));
564 if (!user_name) return XLAT_ACTION_FAIL;
565
566 /*
567 * First check to see if this is a host/ style User-Name
568 * (a la Kerberos host principal)
569 */
570 if (strncmp(user_name->vp_strvalue, "host/", 5) == 0) {
571 /*
572 * If we're getting a User-Name formatted in this way,
573 * it's likely due to PEAP. The Windows Domain will be
574 * the first domain component following the hostname,
575 * or the machine name itself if only a hostname is supplied
576 */
577 p = strchr(user_name->vp_strvalue, '.');
578 if (!p) {
579 RDEBUG2("setting Domain-Name to same as machine name");
580 fr_value_box_strdup(ctx, vb, NULL, user_name->vp_strvalue + 5, user_name->vp_tainted);
581 } else {
582 p++; /* skip the period */
583
584 fr_value_box_strdup(ctx, vb, NULL, p, user_name->vp_tainted);
585 }
586 } else {
587 p = strchr(user_name->vp_strvalue, '\\');
588 if (!p) {
589 REDEBUG("No domain name was found in the User-Name");
590 talloc_free(vb);
591 return XLAT_ACTION_FAIL;
592 }
593
594 fr_value_box_bstrndup(ctx, vb, NULL, user_name->vp_strvalue,
595 p - user_name->vp_strvalue, user_name->vp_tainted);
596 }
597
598 fr_dcursor_append(out, vb);
599 return XLAT_ACTION_DONE;
600
601 /*
602 * Pull the NT-Domain out of the User-Name, if it exists.
603 */
604 } else if (strncasecmp(arg->vb_strvalue, "NT-Domain", 9) == 0) {
605 char const *p, *q;
606
607 MEM(vb = fr_value_box_alloc_null(ctx));
608
609 user_name = mschap_identity_find(request, tmpl_attr_tail_da(env_data->username));
610 if (!user_name) return XLAT_ACTION_FAIL;
611
612 /*
613 * First check to see if this is a host/ style User-Name
614 * (a la Kerberos host principal)
615 */
616 if (strncmp(user_name->vp_strvalue, "host/", 5) == 0) {
617 /*
618 * If we're getting a User-Name formatted in this way,
619 * it's likely due to PEAP. The Windows Domain will be
620 * the first domain component following the hostname,
621 * or the machine name itself if only a hostname is supplied
622 */
623 p = strchr(user_name->vp_strvalue, '.');
624 if (!p) {
625 RDEBUG2("setting NT-Domain to same as machine name");
626 fr_value_box_strdup(ctx, vb, NULL, user_name->vp_strvalue + 5, user_name->vp_tainted);
627 } else {
628 p++; /* skip the period */
629 q = strchr(p, '.');
630 if (q) {
631 fr_value_box_bstrndup(ctx, vb, NULL, p, q - p, user_name->vp_tainted);
632 } else {
633 fr_value_box_strdup(ctx, vb, NULL, p, user_name->vp_tainted);
634 }
635 }
636 } else {
637 p = strchr(user_name->vp_strvalue, '\\');
638 if (!p) {
639 REDEBUG("No NT-Domain was found in the User-Name");
640 talloc_free(vb);
641 return XLAT_ACTION_FAIL;
642 }
643
644 fr_value_box_bstrndup(ctx, vb, NULL, user_name->vp_strvalue,
645 p - user_name->vp_strvalue, user_name->vp_tainted);
646 }
647
648 fr_dcursor_append(out, vb);
649 return XLAT_ACTION_DONE;
650
651 /*
652 * Pull the User-Name out of the User-Name...
653 */
654 } else if (strncasecmp(arg->vb_strvalue, "User-Name", 9) == 0) {
655 char const *p, *q;
656
657 user_name = mschap_identity_find(request, tmpl_attr_tail_da(env_data->username));
658 if (!user_name) return XLAT_ACTION_FAIL;
659
660 MEM(vb = fr_value_box_alloc_null(ctx));
661
662 /*
663 * First check to see if this is a host/ style User-Name
664 * (a la Kerberos host principal)
665 */
666 if (strncmp(user_name->vp_strvalue, "host/", 5) == 0) {
667 p = user_name->vp_strvalue + 5;
668 /*
669 * If we're getting a User-Name formatted in this way,
670 * it's likely due to PEAP. When authenticating this against
671 * a Domain, Windows will expect the User-Name to be in the
672 * format of hostname$, the SAM version of the name, so we
673 * have to convert it to that here. We do so by stripping
674 * off the first 5 characters (host/), and copying everything
675 * from that point to the first period into a string and appending
676 * a $ to the end.
677 */
678 q = strchr(p, '.');
679
680 /*
681 * use the same hack as above
682 * only if a period was found
683 */
684 if (q) {
685 fr_value_box_asprintf(ctx, vb, NULL, true, "%.*s$", (int) (q - p), p);
686 } else {
687 fr_value_box_asprintf(ctx, vb, NULL, true, "%s$", p);
688 }
689 } else {
690 p = strchr(user_name->vp_strvalue, '\\');
691 if (p) {
692 p++; /* skip the backslash */
693 } else {
694 p = user_name->vp_strvalue; /* use the whole User-Name */
695 }
696 fr_value_box_strdup(ctx, vb, NULL, p, user_name->vp_tainted);
697 }
698
699 fr_dcursor_append(out, vb);
700 return XLAT_ACTION_DONE;
701
702 /*
703 * Return the NT-Hash of the passed string
704 */
705 } else if (strncasecmp(arg->vb_strvalue, "NT-Hash", 7) == 0) {
706 arg = fr_value_box_list_next(in, arg);
707 if ((!arg) || (arg->vb_length == 0))
708 return XLAT_ACTION_FAIL;
709
710 if (mschap_nt_password_hash(buffer, arg->vb_strvalue) < 0) {
711 REDEBUG("Failed generating Password.NT");
712 *buffer = '\0';
713 return XLAT_ACTION_FAIL;
714 }
715
716 MEM(vb = fr_value_box_alloc_null(ctx));
717 fr_value_box_memdup(ctx, vb, NULL, buffer, NT_DIGEST_LENGTH, false);
718 RDEBUG2("NT-Hash of \"known-good\" password: %pV", vb);
719 fr_dcursor_append(out, vb);
720 return XLAT_ACTION_DONE;
721
722 /*
723 * Return the LM-Hash of the passed string
724 */
725 } else if (strncasecmp(arg->vb_strvalue, "LM-Hash", 7) == 0) {
726 arg = fr_value_box_list_next(in, arg);
727 if ((!arg) || (arg->vb_length == 0))
728 return XLAT_ACTION_FAIL;
729
730 smbdes_lmpwdhash(arg->vb_strvalue, buffer);
731
732 MEM(vb = fr_value_box_alloc_null(ctx));
733 fr_value_box_memdup(ctx, vb, NULL, buffer, LM_DIGEST_LENGTH, false);
734 RDEBUG2("LM-Hash of %s = %pV", arg->vb_strvalue, vb);
735 fr_dcursor_append(out, vb);
736 return XLAT_ACTION_DONE;
737 } else {
738 REDEBUG("Unknown expansion string '%pV'", arg);
739 return XLAT_ACTION_FAIL;
740 }
741
742 /*
743 * Didn't set anything: this is bad.
744 */
745 if (!data) {
746 RWDEBUG2("Failed to do anything intelligent");
747 return XLAT_ACTION_FAIL;
748 }
749
750 MEM(vb = fr_value_box_alloc_null(ctx));
751 fr_value_box_memdup(ctx, vb, NULL, data, data_len, tainted);
752
753 fr_dcursor_append(out, vb);
754 return XLAT_ACTION_DONE;
755}
756
757
758#ifdef WITH_AUTH_WINBIND
759/*
760 * Free winbind context
761 */
762static int _mod_ctx_free(winbind_ctx_t *wbctx)
763{
764 wbcCtxFree(wbctx->ctx);
765 return 0;
766}
767
768/*
769 * Create winbind context
770 */
771static int winbind_ctx_alloc(winbind_ctx_t *wbctx, UNUSED void *uctx)
772{
773 wbctx->ctx = wbcCtxCreate();
774 if (!wbctx->ctx) {
775 fr_strerror_printf("Unable to create winbind context");
776 return -1;
777 }
778 talloc_set_destructor(wbctx, _mod_ctx_free);
779 return 0;
780}
781#endif
782
783/*
784 * Add MPPE attributes to the reply.
785 */
786static void mppe_add_reply(UNUSED rlm_mschap_t const *inst,
787 request_t *request, fr_dict_attr_t const *da, uint8_t const *value, size_t len)
788{
789 fr_pair_t *vp;
790
791 MEM(pair_update_reply(&vp, da) >= 0);
792 fr_pair_value_memdup(vp, value, len, false);
793 RINDENT();
794 RDEBUG2("reply.%pP", vp);
795 REXDENT();
796}
797
798/*
799 * Write a string to an fd, followed by "\n"
800 */
801static int write_all(int fd, char const *buf, size_t len)
802{
803 char const *p = buf;
804 char const *end = buf + len;
805
806 while (p < end) {
807 ssize_t slen;
808
809 slen = write(fd, p, end - p);
810 if (slen <= 0) return -1;
811
812 fr_assert((size_t) slen <= (size_t) (end - p));
813
814 p += slen;
815 }
816
817 if (write(fd, "\n", 1) <= 0) return -1;
818
819 return 0;
820}
821
822/*
823 * Perform an MS-CHAP2 password change
824 */
825
826static int CC_HINT(nonnull) do_mschap_cpw(rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx,
827 uint8_t *new_nt_password, uint8_t *old_nt_hash)
828{
829 mschap_cpw_ctx_t *cpw_ctx = auth_ctx->cpw_ctx;
830 fr_value_box_t *vb;
831
832 if (inst->ntlm_cpw && auth_ctx->method != AUTH_INTERNAL) {
833 /*
834 * we're going to run ntlm_auth in helper-mode
835 * we're expecting to use the ntlm-change-password-1 protocol
836 * which needs the following on stdin:
837 *
838 * username: %mschap(User-Name)
839 * nt-domain: %mschap(NT-Domain)
840 * new-nt-password-blob: bin2hex(new_nt_password) - 1032 bytes encoded
841 * old-nt-hash-blob: bin2hex(old_nt_hash) - 32 bytes encoded
842 * new-lm-password-blob: 00000...0000 - 1032 bytes null
843 * old-lm-hash-blob: 000....000 - 32 bytes null
844 * .\n
845 *
846 * ...and it should then print out
847 *
848 * Password-Change: Yes
849 *
850 * or
851 *
852 * Password-Change: No
853 * Password-Change-Error: blah
854 */
855
856 size_t size;
857 int status, len, to_child=-1, from_child=-1;
858 pid_t pid, child_pid;
859 char buf[2048];
860 char *pmsg;
861 char const *emsg;
862
863 RDEBUG2("Doing MS-CHAPv2 password change via ntlm_auth helper");
864
865 /*
866 * Start up ntlm_auth with a pipe on stdin and stdout
867 */
868
869 pid = radius_start_program_legacy(&to_child, &from_child, NULL, inst->ntlm_cpw, request, true, NULL, false);
870 if (pid < 0) {
871 REDEBUG("could not exec ntlm_auth cpw command");
872 return -1;
873 }
874
875 /*
876 * write the stuff to the client
877 */
878
879 vb = fr_value_box_list_head(&cpw_ctx->cpw_user);
880 if (!vb) goto ntlm_auth_err;
881
882 if (write_all(to_child, vb->vb_strvalue, vb->vb_length) < 0) {
883 REDEBUG("Failed to write username to child");
884 goto ntlm_auth_err;
885 }
886
887 if (auth_ctx->env_data->ntlm_cpw_domain) {
888 vb = fr_value_box_list_head(&cpw_ctx->cpw_domain);
889 if (!vb) goto no_domain;
890
891 if (write_all(to_child, vb->vb_strvalue, vb->vb_length) < 0) {
892 REDEBUG("Failed to write domain to child");
893 goto ntlm_auth_err;
894 }
895 } else {
896 no_domain:
897 RWDEBUG2("No ntlm_auth domain set, username must be full-username to work");
898 }
899
900 /* now the password blobs */
901 size = snprintf(buf, sizeof(buf), "new-nt-password-blob: ");
902 fr_base16_encode(&FR_SBUFF_OUT(buf + size, sizeof(buf) - size), &FR_DBUFF_TMP(new_nt_password, 516));
903 size = strlen(buf);
904 if (write_all(to_child, buf, size) < 0) {
905 RDEBUG2("failed to write new password blob to child");
906 goto ntlm_auth_err;
907 }
908
909 size = snprintf(buf, sizeof(buf), "old-nt-hash-blob: ");
910 fr_base16_encode(&FR_SBUFF_OUT(buf + size, sizeof(buf) - size), &FR_DBUFF_TMP(old_nt_hash, NT_DIGEST_LENGTH));
911 size = strlen(buf);
912 if (write_all(to_child, buf, size) < 0) {
913 REDEBUG("Failed to write old hash blob to child");
914 goto ntlm_auth_err;
915 }
916
917 /*
918 * In current samba versions, failure to supply empty LM password/hash
919 * blobs causes the change to fail.
920 */
921 size = snprintf(buf, sizeof(buf), "new-lm-password-blob: %01032i", 0);
922 if (write_all(to_child, buf, size) < 0) {
923 REDEBUG("Failed to write dummy LM password to child");
924 goto ntlm_auth_err;
925 }
926 size = snprintf(buf, sizeof(buf), "old-lm-hash-blob: %032i", 0);
927 if (write_all(to_child, buf, size) < 0) {
928 REDEBUG("Failed to write dummy LM hash to child");
929 goto ntlm_auth_err;
930 }
931 if (write_all(to_child, ".", 1) < 0) {
932 REDEBUG("Failed to send finish to child");
933 goto ntlm_auth_err;
934 }
935 close(to_child);
936 to_child = -1;
937
938 /*
939 * Read from the child
940 */
941 len = radius_readfrom_program_legacy(from_child, pid, fr_time_delta_from_sec(10), buf, sizeof(buf) - 1);
942 if (len < 0) {
943 /* radius_readfrom_program_legacy will have closed from_child for us */
944 REDEBUG("Failure reading from child");
945 return -1;
946 }
947 close(from_child);
948 from_child = -1;
949
950 buf[len] = 0;
951 RDEBUG2("ntlm_auth said: %s", buf);
952
953 child_pid = waitpid(pid, &status, 0);
954 if (child_pid == 0) {
955 REDEBUG("Timeout waiting for child");
956 return -1;
957 }
958 if (child_pid != pid) {
959 REDEBUG("Abnormal exit status: %s", fr_syserror(errno));
960 return -1;
961 }
962
963 if (strstr(buf, "Password-Change: Yes")) {
964 RDEBUG2("ntlm_auth password change succeeded");
965 return 0;
966 }
967
968 pmsg = strstr(buf, "Password-Change-Error: ");
969 if (pmsg) {
970 emsg = strsep(&pmsg, "\n");
971 } else {
972 emsg = "could not find error";
973 }
974 REDEBUG("ntlm auth password change failed: %s", emsg);
975
976ntlm_auth_err:
977 /* safe because these either need closing or are == -1 */
978 close(to_child);
979 close(from_child);
980
981 return -1;
982
983 /*
984 * Decrypt the new password blob, add it as a temporary request
985 * variable, xlat the local_cpw string, then remove it
986 *
987 * this allows is to write e..g
988 *
989 * %sql(insert into ...)
990 *
991 * ...or...
992 *
993 * %exec('/path/to', %mschap(User-Name), %{MS-CHAP-New-Cleartext-Password})"
994 *
995 */
996#ifdef WITH_TLS
997 } else if (auth_ctx->env_data->local_cpw) {
998 RDEBUG2("Doing MS-CHAPv2 password change locally");
999
1000 vb = fr_value_box_list_head(&cpw_ctx->local_cpw_result);
1001
1002 if (!vb){
1003 return -1;
1004 } else if (vb->vb_length == 0) {
1005 REDEBUG("Local MS-CHAPv2 password change - didn't give any result, assuming failure");
1006 return -1;
1007 }
1008
1009 RDEBUG2("MS-CHAPv2 password change succeeded: %pV", vb);
1010
1011 /*
1012 * Update the Password.NT attribute with the new hash this lets us
1013 * fall through to the authentication code using the new hash,
1014 * not the old one.
1015 */
1016 fr_pair_value_memdup(auth_ctx->nt_password, auth_ctx->cpw_ctx->new_hash->vp_octets,
1017 auth_ctx->cpw_ctx->new_hash->vp_length, false);
1018
1019 /*
1020 * Rock on! password change succeeded.
1021 */
1022 return 0;
1023#endif
1024 } else {
1025 REDEBUG("MS-CHAPv2 password change not configured");
1026 }
1027
1028 return -1;
1029}
1030
1031/*
1032 * Do the MS-CHAP stuff.
1033 *
1034 * This function is here so that all of the MS-CHAP related
1035 * authentication is in one place, and we can perhaps later replace
1036 * it with code to call winbindd, or something similar.
1037 */
1038static int CC_HINT(nonnull) do_mschap(rlm_mschap_t const *inst, request_t *request,
1039 mschap_auth_ctx_t *auth_ctx,
1040 uint8_t const *challenge, uint8_t const *response,
1041 uint8_t nthashhash[static NT_DIGEST_LENGTH])
1042{
1043 uint8_t calculated[24];
1044 fr_pair_t *password = auth_ctx->nt_password;
1045
1046 memset(nthashhash, 0, NT_DIGEST_LENGTH);
1047
1048 switch (auth_ctx->method) {
1049 case AUTH_INTERNAL:
1050 case AUTH_AUTO:
1051 /*
1052 * Do normal authentication.
1053 */
1054 {
1055 /*
1056 * No password: can't do authentication.
1057 */
1058 if (!password) {
1059 if (auth_ctx->method == AUTH_AUTO) goto do_ntlm;
1060
1061 REDEBUG("FAILED: No Password.NT/LM. Cannot perform authentication");
1062 return -1;
1063 }
1064
1065 smbdes_mschap(password->vp_octets, challenge, calculated);
1066 if (fr_digest_cmp(response, calculated, 24) != 0) {
1067 return -1;
1068 }
1069
1070 /*
1071 * If the password exists, and is an NT-Password,
1072 * then calculate the hash of the NT hash. Doing this
1073 * here minimizes work for later.
1074 */
1075 if (password->da == attr_nt_password) fr_md4_calc(nthashhash, password->vp_octets, MD4_DIGEST_LENGTH);
1076 break;
1077 }
1078 case AUTH_NTLMAUTH_EXEC:
1079 do_ntlm:
1080 /*
1081 * Run ntlm_auth
1082 */
1083 {
1084 int result;
1085 char buffer[256];
1086 size_t len;
1087
1088 /*
1089 * Run the program, and expect that we get 16
1090 */
1091 result = radius_exec_program_legacy(buffer, sizeof(buffer), request, inst->ntlm_auth, NULL,
1092 true, true, inst->ntlm_auth_timeout);
1093 if (result != 0) {
1094 char *p;
1095
1096 /*
1097 * Do checks for numbers, which are
1098 * language neutral. They're also
1099 * faster.
1100 */
1101 p = strcasestr(buffer, "0xC0000");
1102 if (p) {
1103 result = 0;
1104
1105 p += 7;
1106 if (strcmp(p, "224") == 0) {
1107 result = -648;
1108
1109 } else if (strcmp(p, "234") == 0) {
1110 result = -647;
1111
1112 } else if (strcmp(p, "072") == 0) {
1113 result = -691;
1114
1115 } else if (strcasecmp(p, "05E") == 0) {
1116 result = -2;
1117 }
1118
1119 if (result != 0) {
1120 REDEBUG2("%s", buffer);
1121 return result;
1122 }
1123
1124 /*
1125 * Else fall through to more ridiculous checks.
1126 */
1127 }
1128
1129 /*
1130 * Look for variants of expire password.
1131 */
1132 if (strcasestr(buffer, "0xC0000224") ||
1133 strcasestr(buffer, "Password expired") ||
1134 strcasestr(buffer, "Password has expired") ||
1135 strcasestr(buffer, "Password must be changed") ||
1136 strcasestr(buffer, "Must change password")) {
1137 return -648;
1138 }
1139
1140 if (strcasestr(buffer, "0xC0000234") ||
1141 strcasestr(buffer, "Account locked out")) {
1142 REDEBUG2("%s", buffer);
1143 return -647;
1144 }
1145
1146 if (strcasestr(buffer, "0xC0000072") ||
1147 strcasestr(buffer, "Account disabled")) {
1148 REDEBUG2("%s", buffer);
1149 return -691;
1150 }
1151
1152 if (strcasestr(buffer, "0xC000005E") ||
1153 strcasestr(buffer, "No logon servers")) {
1154 REDEBUG2("%s", buffer);
1155 return -2;
1156 }
1157
1158 if (strcasestr(buffer, "could not obtain winbind separator") ||
1159 strcasestr(buffer, "Reading winbind reply failed")) {
1160 REDEBUG2("%s", buffer);
1161 return -2;
1162 }
1163
1164 RDEBUG2("External script failed");
1165 p = strchr(buffer, '\n');
1166 if (p) *p = '\0';
1167
1168 REDEBUG("External script says: %s", buffer);
1169 return -1;
1170 }
1171
1172 /*
1173 * Parse the answer as an nthashhash.
1174 *
1175 * ntlm_auth currently returns:
1176 * NT_KEY: 000102030405060708090a0b0c0d0e0f
1177 */
1178 if (memcmp(buffer, "NT_KEY: ", 8) != 0) {
1179 REDEBUG("Invalid output from ntlm_auth: expecting 'NT_KEY: ' prefix");
1180 return -1;
1181 }
1182
1183 /*
1184 * Check the length. It should be at least 32, with an LF at the end.
1185 */
1186 len = strlen(buffer + 8);
1187 if (len < 32) {
1188 REDEBUG2("Invalid output from ntlm_auth: NT_KEY too short, expected 32 bytes got %zu bytes",
1189 len);
1190
1191 return -1;
1192 }
1193
1194 /*
1195 * Update the NT hash hash, from the NT key.
1196 */
1197 if (fr_base16_decode(NULL, &FR_DBUFF_TMP(nthashhash, NT_DIGEST_LENGTH),
1198 &FR_SBUFF_IN(buffer + 8, len), false) != NT_DIGEST_LENGTH) {
1199 REDEBUG("Invalid output from ntlm_auth: NT_KEY has non-hex values");
1200 return -1;
1201 }
1202
1203 break;
1204 }
1205#ifdef WITH_AUTH_WINBIND
1206 case AUTH_WBCLIENT:
1207 /*
1208 * Process auth via the wbclient library
1209 */
1210 return do_auth_wbclient(inst, request, challenge, response, nthashhash, auth_ctx);
1211#endif
1212 default:
1213 /* We should never reach this line */
1214 RERROR("Internal error: Unknown mschap auth method (%d)", auth_ctx->method);
1215 return -1;
1216 }
1217
1218 return 0;
1219}
1220
1221
1222/*
1223 * Data for the hashes.
1224 */
1225static const uint8_t SHSpad1[40] =
1226 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1227 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1228 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1229 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
1230
1231static const uint8_t SHSpad2[40] =
1232 { 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
1233 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
1234 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
1235 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2 };
1236
1237static const uint8_t magic1[27] =
1238 { 0x54, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74,
1239 0x68, 0x65, 0x20, 0x4d, 0x50, 0x50, 0x45, 0x20, 0x4d,
1240 0x61, 0x73, 0x74, 0x65, 0x72, 0x20, 0x4b, 0x65, 0x79 };
1241
1242static const uint8_t magic2[84] =
1243 { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69,
1244 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20,
1245 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
1246 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, 0x6b, 0x65, 0x79,
1247 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x73,
1248 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, 0x69, 0x64, 0x65,
1249 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
1250 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20,
1251 0x6b, 0x65, 0x79, 0x2e };
1252
1253static const uint8_t magic3[84] =
1254 { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69,
1255 0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20,
1256 0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
1257 0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20,
1258 0x6b, 0x65, 0x79, 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68,
1259 0x65, 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73,
1260 0x69, 0x64, 0x65, 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73,
1261 0x20, 0x74, 0x68, 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20,
1262 0x6b, 0x65, 0x79, 0x2e };
1263
1264
1265static void mppe_GetMasterKey(uint8_t const *nt_hashhash, uint8_t const *nt_response,
1266 uint8_t *masterkey)
1267{
1268 uint8_t digest[20];
1269 fr_sha1_ctx Context;
1270
1271 fr_sha1_init(&Context);
1272 fr_sha1_update(&Context, nt_hashhash, NT_DIGEST_LENGTH);
1273 fr_sha1_update(&Context, nt_response, 24);
1274 fr_sha1_update(&Context, magic1, 27);
1275 fr_sha1_final(digest, &Context);
1276
1277 memcpy(masterkey, digest, 16); //-V512
1278}
1279
1280
1281static void mppe_GetAsymmetricStartKey(uint8_t *masterkey, uint8_t *sesskey,
1282 int keylen, int issend)
1283{
1284 uint8_t digest[20];
1285 const uint8_t *s;
1286 fr_sha1_ctx Context;
1287
1288 memset(digest, 0, 20);
1289
1290 if(issend) {
1291 s = magic3;
1292 } else {
1293 s = magic2;
1294 }
1295
1296 fr_sha1_init(&Context);
1297 fr_sha1_update(&Context, masterkey, 16);
1298 fr_sha1_update(&Context, SHSpad1, 40);
1299 fr_sha1_update(&Context, s, 84);
1300 fr_sha1_update(&Context, SHSpad2, 40);
1301 fr_sha1_final(digest, &Context);
1302
1303 memcpy(sesskey, digest, keylen);
1304}
1305
1306
1307static void mppe_chap2_get_keys128(uint8_t const *nt_hashhash, uint8_t const *nt_response,
1308 uint8_t *sendkey, uint8_t *recvkey)
1309{
1310 uint8_t masterkey[16];
1311
1312 mppe_GetMasterKey(nt_hashhash, nt_response, masterkey);
1313
1314 mppe_GetAsymmetricStartKey(masterkey, sendkey, 16, 1);
1315 mppe_GetAsymmetricStartKey(masterkey, recvkey, 16, 0);
1316}
1317
1318/*
1319 * Generate MPPE keys.
1320 */
1321static void mppe_chap2_gen_keys128(uint8_t const *nt_hashhash, uint8_t const *response,
1322 uint8_t *sendkey, uint8_t *recvkey)
1323{
1324 uint8_t enckey1[16];
1325 uint8_t enckey2[16];
1326
1327 mppe_chap2_get_keys128(nt_hashhash, response, enckey1, enckey2);
1328
1329 /*
1330 * dictionary.microsoft defines these attributes as
1331 * 'encrypt=Tunnel-Password'. The functions in src/lib/radius.c will
1332 * take care of encrypting/decrypting them as appropriate,
1333 * so that we don't have to.
1334 */
1335 memcpy (sendkey, enckey1, 16);
1336 memcpy (recvkey, enckey2, 16);
1337}
1338
1339
1340/*
1341 * mod_authorize() - authorize user if we can authenticate
1342 * it later. Add Auth-Type attribute if present in module
1343 * configuration (usually Auth-Type must be "MS-CHAP")
1344 */
1345static unlang_action_t CC_HINT(nonnull) mod_authorize(unlang_result_t *p_result, module_ctx_t const *mctx, request_t *request)
1346{
1347 rlm_mschap_t const *inst = talloc_get_type_abort_const(mctx->mi->data, rlm_mschap_t);
1348 mschap_autz_call_env_t *env_data = talloc_get_type_abort(mctx->env_data, mschap_autz_call_env_t);
1349 fr_pair_t *challenge = NULL;
1350 fr_pair_t *parent;
1351
1352 challenge = fr_pair_find_by_da_nested(&request->request_pairs, NULL, tmpl_attr_tail_da(env_data->chap_challenge));
1353 if (!challenge) RETURN_UNLANG_NOOP;
1354
1355 /*
1356 * The responses MUST be in the same group as the challenge.
1357 */
1358 parent = fr_pair_parent(challenge);
1359 fr_assert(parent != NULL);
1360
1361 if (!fr_pair_find_by_da(&parent->vp_group, NULL, tmpl_attr_tail_da(env_data->chap_response)) &&
1362 !fr_pair_find_by_da(&parent->vp_group, NULL, tmpl_attr_tail_da(env_data->chap2_response)) &&
1363 (env_data->chap2_cpw &&
1364 !fr_pair_find_by_da(&parent->vp_group, NULL, tmpl_attr_tail_da(env_data->chap2_cpw)))) {
1365 RDEBUG2("Found MS-CHAP-Challenge, but no MS-CHAP response or Change-Password");
1366 RETURN_UNLANG_NOOP;
1367 }
1368
1369 if (!inst->auth_type) {
1370 WARN("No 'authenticate %s {...}' section or 'Auth-Type = %s' set. Cannot setup MS-CHAP authentication",
1371 mctx->mi->name, mctx->mi->name);
1372 RETURN_UNLANG_NOOP;
1373 }
1374
1375 if (!module_rlm_section_type_set(request, attr_auth_type, inst->auth_type)) RETURN_UNLANG_NOOP;
1376
1377 RETURN_UNLANG_OK;
1378}
1379
1380static unlang_action_t mschap_error(unlang_result_t *p_result, rlm_mschap_t const *inst, request_t *request,
1381 unsigned char ident, int mschap_result, int mschap_version, fr_pair_t *smb_ctrl,
1382 mschap_auth_call_env_t *env_data)
1383{
1384 rlm_rcode_t rcode = RLM_MODULE_OK;
1385 int error = 0;
1386 int retry = 0;
1387 char const *message = NULL;
1388
1389 int i;
1390 char new_challenge[33], buffer[128];
1391 char *p;
1392
1393 if ((mschap_result == -648) ||
1394 ((mschap_result == 0) &&
1395 (smb_ctrl && ((smb_ctrl->vp_uint32 & ACB_FR_EXPIRED) != 0)))) {
1396 REDEBUG("Password has expired. User should retry authentication");
1397 error = 648;
1398
1399 /*
1400 * A password change is NOT a retry! We MUST have retry=0 here.
1401 */
1402 retry = 0;
1403 message = "Password expired";
1404 rcode = RLM_MODULE_REJECT;
1405
1406 /*
1407 * Account is disabled.
1408 *
1409 * They're found, but they don't exist, so we
1410 * return 'not found'.
1411 */
1412 } else if ((mschap_result == -691) ||
1413 (smb_ctrl && (((smb_ctrl->vp_uint32 & ACB_DISABLED) != 0) ||
1414 ((smb_ctrl->vp_uint32 & (ACB_NORMAL|ACB_WSTRUST)) == 0)))) {
1415 REDEBUG("SMB-Account-Ctrl (or ntlm_auth) "
1416 "says that the account is disabled, "
1417 "or is not a normal or workstation trust account");
1418 error = 691;
1419 retry = 0;
1420 message = "Account disabled";
1421 rcode = RLM_MODULE_NOTFOUND;
1422
1423 /*
1424 * User is locked out.
1425 */
1426 } else if ((mschap_result == -647) ||
1427 (smb_ctrl && ((smb_ctrl->vp_uint32 & ACB_AUTOLOCK) != 0))) {
1428 REDEBUG("SMB-Account-Ctrl (or ntlm_auth) "
1429 "says that the account is locked out");
1430 error = 647;
1431 retry = 0;
1432 message = "Account locked out";
1433 rcode = RLM_MODULE_DISALLOW;
1434
1435 } else if (mschap_result < 0) {
1436 REDEBUG("%s is incorrect", mschap_version == 1 ? env_data->chap_response->name : env_data->chap2_response->name);
1437 error = 691;
1438 retry = inst->allow_retry;
1439 message = "Authentication failed";
1440 rcode = RLM_MODULE_REJECT;
1441 }
1442
1443 if (rcode == RLM_MODULE_OK) RETURN_UNLANG_OK;
1444
1445 switch (mschap_version) {
1446 case 1:
1447 for (p = new_challenge, i = 0; i < 2; i++) p += snprintf(p, 9, "%08x", fr_rand());
1448 snprintf(buffer, sizeof(buffer), "E=%i R=%i C=%s V=2",
1449 error, retry, new_challenge);
1450 break;
1451
1452 case 2:
1453 for (p = new_challenge, i = 0; i < 4; i++) p += snprintf(p, 9, "%08x", fr_rand());
1454 snprintf(buffer, sizeof(buffer), "E=%i R=%i C=%s V=3 M=%s",
1455 error, retry, new_challenge, message);
1456 break;
1457
1458 default:
1459 RETURN_UNLANG_FAIL;
1460 }
1461 if (env_data->chap_error) mschap_add_reply(request, ident, tmpl_attr_tail_da(env_data->chap_error),
1462 buffer, strlen(buffer));
1463
1464 RETURN_UNLANG_RCODE(rcode);
1465}
1466
1467
1468/** Find a Password.NT value, or create one from a Password.Cleartext, or Password.With-Header attribute
1469 *
1470 * @param[in] ctx to allocate ephemeral passwords in.
1471 * @param[out] out Our new Password.NT.
1472 * @param[in] inst Module configuration.
1473 * @param[in] request The current request.
1474 * @return
1475 * - 0 on success.
1476 * - -1 on failure.
1477 */
1478static int CC_HINT(nonnull(1, 2, 3)) nt_password_find(TALLOC_CTX *ctx, fr_pair_t **out,
1479 rlm_mschap_t const *inst, request_t *request)
1480{
1481 fr_pair_t *password;
1482 fr_dict_attr_t const *allowed_passwords[] = { attr_cleartext_password, attr_nt_password };
1483 bool ephemeral;
1484
1485 *out = NULL; /* Init output pointer */
1486
1487 password = password_find(&ephemeral, ctx, request,
1488 allowed_passwords, NUM_ELEMENTS(allowed_passwords), inst->normify);
1489 if (!password) {
1490 if (inst->method == AUTH_INTERNAL) {
1491 /*
1492 * Search for passwords in the parent
1493 * FIXME: This is a hack and should be removed
1494 * When EAP-MSCHAPv2 supports sections.
1495 */
1496 if (request->parent) {
1497 password = password_find(&ephemeral, ctx, request->parent,
1498 allowed_passwords,
1499 NUM_ELEMENTS(allowed_passwords), inst->normify);
1500 if (password) goto found_password;
1501 }
1502
1503 /*
1504 * If we're doing internal auth, then this is an issue
1505 */
1506 REDEBUG2("No control.%s.%s or control.%s.%s found. Cannot create Password.NT",
1507 attr_cleartext_password->parent->name, attr_cleartext_password->name,
1508 attr_nt_password->parent->name, attr_nt_password->name);
1509 return -1;
1510
1511 /*
1512 * ..if we're not, then we can call out to external sources.
1513 */
1514 } else {
1515 return 0;
1516 }
1517 }
1518
1519found_password:
1520 if (password->da == attr_cleartext_password) {
1521 uint8_t *p;
1522 int ret;
1523 fr_pair_t *nt_password;
1524
1525 MEM(nt_password = fr_pair_afrom_da(ctx, attr_nt_password));
1526 MEM(fr_pair_value_mem_alloc(nt_password, &p, NT_DIGEST_LENGTH, false) == 0);
1527 ret = mschap_nt_password_hash(p, password->vp_strvalue);
1528
1529 if (ret < 0) {
1530 RERROR("Failed generating Password.NT");
1531 talloc_free(nt_password);
1532 if (ephemeral) TALLOC_FREE(password);
1533 return -1;
1534 }
1535
1536 if (RDEBUG_ENABLED3) {
1537 RDEBUG3("Hashed control.%pP to create %s = %pV",
1538 password, attr_nt_password->name, fr_box_octets(p, NT_DIGEST_LENGTH));
1539 } else {
1540 RDEBUG2("Hashed control.%s to create %s", attr_nt_password->name, password->da->name);
1541 }
1542
1543 if (ephemeral) TALLOC_FREE(password);
1544
1545 *out = nt_password;
1546
1547 return 0;
1548 }
1549
1550 fr_assert(password->da == attr_nt_password);
1551
1552 if (RDEBUG_ENABLED3) {
1553 RDEBUG3("Found control.%pP", password);
1554 } else {
1555 RDEBUG2("Found control.%s", attr_nt_password->name);
1556 }
1557 *out = password;
1558
1559 return 0;
1560}
1561
1562/*
1563 * mschap_cpw_request_process() - do the work to handle an MS-CHAP password
1564 * change request.
1565 */
1566static unlang_action_t CC_HINT(nonnull) mschap_process_cpw_request(unlang_result_t *p_result,
1567 rlm_mschap_t const *inst,
1568 request_t *request,
1569 mschap_auth_ctx_t *auth_ctx)
1570{
1571 mschap_auth_call_env_t *env_data = auth_ctx->env_data;
1572 mschap_cpw_ctx_t *cpw_ctx = auth_ctx->cpw_ctx;
1573
1574 /*
1575 * Perform the actual password change
1576 */
1577 if (do_mschap_cpw(inst, request, auth_ctx, cpw_ctx->new_nt_encrypted, cpw_ctx->old_nt_hash) < 0) {
1578 char buffer[128];
1579
1580 REDEBUG("Password change failed");
1581
1582 if (env_data->chap_error) {
1583 snprintf(buffer, sizeof(buffer), "E=709 R=0 M=Password change failed");
1584 mschap_add_reply(request, auth_ctx->cpw->vp_octets[1],
1585 tmpl_attr_tail_da(env_data->chap_error), buffer, strlen(buffer));
1586 }
1587
1588 RETURN_UNLANG_REJECT;
1589 }
1590
1591 RDEBUG2("Password change successful");
1592
1593 RETURN_UNLANG_OK;
1594}
1595
1596/** Validate data required for change password requests.
1597 *
1598 */
1599static int mschap_cpw_prepare(request_t *request, mschap_auth_ctx_t *auth_ctx)
1600{
1601 mschap_auth_call_env_t *env_data = auth_ctx->env_data;
1602 mschap_cpw_ctx_t *cpw_ctx;
1603 fr_pair_t *nt_enc = NULL;
1604 int seq, new_nt_enc_len;
1605
1606 /*
1607 * mschap2 password change request.
1608 *
1609 * We cheat - first decode and execute the passchange.
1610 * Then extract the response, add it into the request
1611 * and then jump into mschap2 auth with the challenge/
1612 * response.
1613 */
1614 RDEBUG2("MS-CHAPv2 password change request received");
1615
1616 if (auth_ctx->cpw->vp_length != 68) {
1617 REDEBUG("%s has the wrong format: length %zu != 68", env_data->chap2_cpw->name, auth_ctx->cpw->vp_length);
1618 return -1;
1619 }
1620
1621 if (auth_ctx->cpw->vp_octets[0] != 7) {
1622 REDEBUG("%s has the wrong format: code %d != 7", env_data->chap2_cpw->name, auth_ctx->cpw->vp_octets[0]);
1623 return -1;
1624 }
1625
1626 MEM(auth_ctx->cpw_ctx = talloc_zero(auth_ctx, mschap_cpw_ctx_t));
1627 cpw_ctx = auth_ctx->cpw_ctx;
1628
1629 /*
1630 * Look for the new (encrypted) password.
1631 *
1632 * Bah, stupid composite attributes...
1633 * we're expecting 3 attributes with the leading bytes -
1634 * 06:<mschapid>:00:01:<1st chunk>
1635 * 06:<mschapid>:00:02:<2nd chunk>
1636 * 06:<mschapid>:00:03:<3rd chunk>
1637 */
1638 new_nt_enc_len = 0;
1639 for (seq = 1; seq < 4; seq++) {
1640 int found = 0;
1641
1642 while ((nt_enc = fr_pair_find_by_da_nested(&request->request_pairs, nt_enc,
1643 tmpl_attr_tail_da(env_data->chap_nt_enc_pw)))) {
1644 if (nt_enc->vp_length < 4) {
1645 REDEBUG("%s with invalid format", env_data->chap_nt_enc_pw->name);
1646 return -1;
1647 }
1648
1649 if (nt_enc->vp_octets[0] != 6) {
1650 REDEBUG("%s with invalid format", env_data->chap_nt_enc_pw->name);
1651 return -1;
1652 }
1653
1654 if ((nt_enc->vp_octets[2] == 0) && (nt_enc->vp_octets[3] == seq)) {
1655 found = 1;
1656 break;
1657 }
1658 }
1659
1660 if (!found) {
1661 REDEBUG("Could not find %s with sequence number %d", env_data->chap_nt_enc_pw->name, seq);
1662 return -1;
1663 }
1664
1665 if ((new_nt_enc_len + nt_enc->vp_length - 4) > sizeof(cpw_ctx->new_nt_encrypted)) {
1666 REDEBUG("Unpacked %s length > 516", env_data->chap_nt_enc_pw->name);
1667 return -1;
1668 }
1669
1670 memcpy(cpw_ctx->new_nt_encrypted + new_nt_enc_len, nt_enc->vp_octets + 4, nt_enc->vp_length - 4);
1671 new_nt_enc_len += nt_enc->vp_length - 4;
1672 }
1673
1674 if (new_nt_enc_len != 516) {
1675 REDEBUG("Unpacked %s length is %d - should be 516", env_data->chap_nt_enc_pw->name, new_nt_enc_len);
1676 return -1;
1677 }
1678
1679 /*
1680 * RFC 2548 is confusing here. It claims:
1681 *
1682 * 1 byte code
1683 * 1 byte ident
1684 * 16 octets - old hash encrypted with new hash
1685 * 24 octets - peer challenge
1686 * this is actually:
1687 * 16 octets - peer challenge
1688 * 8 octets - reserved
1689 * 24 octets - nt response
1690 * 2 octets - flags (ignored)
1691 */
1692
1693 memcpy(cpw_ctx->old_nt_hash, auth_ctx->cpw->vp_octets + 2, sizeof(cpw_ctx->old_nt_hash));
1694
1695 RDEBUG2("Password change payload valid");
1696 return 0;
1697}
1698
1699static CC_HINT(nonnull) unlang_action_t mschap_process_response(unlang_result_t *p_result, int *mschap_version,
1700 uint8_t nthashhash[static NT_DIGEST_LENGTH],
1701 rlm_mschap_t const *inst, request_t *request,
1702 mschap_auth_ctx_t *auth_ctx,
1703 fr_pair_t *challenge, fr_pair_t *response)
1704{
1705 int offset;
1706 rlm_rcode_t mschap_result;
1707 mschap_auth_call_env_t *env_data = auth_ctx->env_data;
1708
1709 *mschap_version = 1;
1710
1711 RDEBUG2("Processing MS-CHAPv1 response");
1712
1713 /*
1714 * MS-CHAPv1 challenges are 8 octets.
1715 */
1716 if (challenge->vp_length < 8) {
1717 REDEBUG("%s has the wrong format", env_data->chap_challenge->name);
1718 RETURN_UNLANG_INVALID;
1719 }
1720
1721 /*
1722 * Responses are 50 octets.
1723 */
1724 if (response->vp_length < 50) {
1725 REDEBUG("%s has the wrong format", env_data->chap_response->name);
1726 RETURN_UNLANG_INVALID;
1727 }
1728
1729 /*
1730 * We are doing MS-CHAP. Calculate the MS-CHAP
1731 * response
1732 */
1733 if (!(response->vp_octets[1] & 0x01)) {
1734 REDEBUG2("Client used unsupported method LM-Password");
1735 RETURN_UNLANG_FAIL;
1736 }
1737
1738 offset = 26;
1739
1740 /*
1741 * Do the MS-CHAP authentication.
1742 */
1743 mschap_result = do_mschap(inst, request, auth_ctx, challenge->vp_octets, response->vp_octets + offset, nthashhash);
1744
1745 /*
1746 * Check for errors, and add MSCHAP-Error if necessary.
1747 */
1748 return mschap_error(p_result, inst, request, *response->vp_octets, mschap_result, *mschap_version, auth_ctx->smb_ctrl, env_data);
1749}
1750
1751static unlang_action_t CC_HINT(nonnull) mschap_process_v2_response(unlang_result_t *p_result, int *mschap_version,
1752 uint8_t nthashhash[static NT_DIGEST_LENGTH],
1753 rlm_mschap_t const *inst, request_t *request,
1754 mschap_auth_ctx_t *auth_ctx,
1755 fr_pair_t *challenge, fr_pair_t *response)
1756{
1757 uint8_t mschap_challenge[16];
1758 fr_pair_t *user_name, *name_vp, *response_name, *peer_challenge_attr;
1759 uint8_t const *peer_challenge;
1760 char const *username_str;
1761 size_t username_len;
1762 int mschap_result;
1763 char msch2resp[42];
1764 mschap_auth_call_env_t *env_data = auth_ctx->env_data;
1765
1766 *mschap_version = 2;
1767
1768 RDEBUG2("Processing MS-CHAPv2 response");
1769
1770 /*
1771 * MS-CHAPv2 challenges are 16 octets.
1772 */
1773 if (challenge->vp_length < 16) {
1774 REDEBUG("%s has the wrong format", env_data->chap_challenge->name);
1775 RETURN_UNLANG_INVALID;
1776 }
1777
1778 /*
1779 * Responses are 50 octets.
1780 */
1781 if (response->vp_length < 50) {
1782 REDEBUG("%s has the wrong format", env_data->chap2_response->name);
1783 RETURN_UNLANG_INVALID;
1784 }
1785
1786 /*
1787 * We also require a User-Name
1788 */
1789 user_name = mschap_identity_find(request, tmpl_attr_tail_da(env_data->username));
1790 if (!user_name) RETURN_UNLANG_FAIL;
1791
1792 /*
1793 * Check for MS-CHAP-User-Name and if found, use it
1794 * to construct the MSCHAPv1 challenge. This is
1795 * set by rlm_eap_mschap to the MS-CHAP Response
1796 * packet Name field.
1797 *
1798 * We prefer this to the User-Name in the
1799 * packet.
1800 */
1801 response_name = fr_pair_find_by_da(&request->request_pairs, NULL, attr_ms_chap_user_name);
1802 name_vp = response_name ? response_name : user_name;
1803
1804 /*
1805 * with_ntdomain_hack moved here, too.
1806 */
1807 if ((username_str = strchr(name_vp->vp_strvalue, '\\')) != NULL) {
1808 if (inst->with_ntdomain_hack) {
1809 username_str++;
1810 } else {
1811 RWDEBUG2("NT Domain delimiter found, should 'with_ntdomain_hack' be enabled?");
1812 username_str = name_vp->vp_strvalue;
1813 }
1814 } else {
1815 username_str = name_vp->vp_strvalue;
1816 }
1817 username_len = name_vp->vp_length - (username_str - name_vp->vp_strvalue);
1818
1819 if (response_name && ((user_name->vp_length != response_name->vp_length) ||
1820 (strncasecmp(user_name->vp_strvalue, response_name->vp_strvalue, user_name->vp_length) != 0))) {
1821 RWDEBUG("%pP is not the same as %pP from EAP-MSCHAPv2", user_name, response_name);
1822 }
1823
1824#ifdef __APPLE__
1825 /*
1826 * No "known good" Password.NT attribute. Try to do
1827 * OpenDirectory authentication.
1828 *
1829 * If OD determines the user is an AD user it will return noop, which
1830 * indicates the auth process should continue directly to AD.
1831 * Otherwise OD will determine auth success/fail.
1832 */
1833 if (!auth_ctx->nt_password && inst->open_directory) {
1834 RDEBUG2("No Password.NT available. Trying OpenDirectory Authentication");
1835 od_mschap_auth(p_result, request, challenge, user_name, env_data);
1836 if (p_result->rcode != RLM_MODULE_NOOP) return UNLANG_ACTION_CALCULATE_RESULT;
1837 }
1838#endif
1839 peer_challenge = response->vp_octets + 2;
1840
1841 peer_challenge_attr = fr_pair_find_by_da(&request->control_pairs, NULL, attr_ms_chap_peer_challenge);
1842 if (peer_challenge_attr) {
1843 RDEBUG2("Overriding peer challenge");
1844 peer_challenge = peer_challenge_attr->vp_octets;
1845 }
1846
1847 /*
1848 * The old "mschapv2" function has been moved to
1849 * here.
1850 *
1851 * MS-CHAPv2 takes some additional data to create an
1852 * MS-CHAPv1 challenge, and then does MS-CHAPv1.
1853 */
1854 RDEBUG2("Creating challenge with username \"%pV\"",
1855 fr_box_strvalue_len(username_str, username_len));
1856 mschap_challenge_hash(mschap_challenge, /* resulting challenge */
1857 peer_challenge, /* peer challenge */
1858 challenge->vp_octets, /* our challenge */
1859 username_str, username_len); /* user name */
1860
1861 mschap_result = do_mschap(inst, request, auth_ctx, mschap_challenge, response->vp_octets + 26, nthashhash);
1862
1863 /*
1864 * Check for errors, and add MSCHAP-Error if necessary.
1865 */
1866 mschap_error(p_result, inst, request, *response->vp_octets,
1867 mschap_result, *mschap_version, auth_ctx->smb_ctrl, env_data);
1868 if (p_result->rcode != RLM_MODULE_OK) return UNLANG_ACTION_CALCULATE_RESULT;
1869
1870#ifdef WITH_AUTH_WINBIND
1871 if (inst->wb_retry_with_normalised_username) {
1872 response_name = fr_pair_find_by_da(&request->request_pairs, NULL, attr_ms_chap_user_name);
1873 if (response_name) {
1874 if (strcmp(username_str, response_name->vp_strvalue)) {
1875 RDEBUG2("Normalising username %pV -> %pV",
1876 fr_box_strvalue_len(username_str, username_len),
1877 &response_name->data);
1878 username_str = response_name->vp_strvalue;
1879 }
1880 }
1881 }
1882#endif
1883
1884 mschap_auth_response(username_str, /* without the domain */
1885 username_len, /* Length of username str */
1886 nthashhash, /* nt-hash-hash */
1887 response->vp_octets + 26, /* peer response */
1888 peer_challenge, /* peer challenge */
1889 challenge->vp_octets, /* our challenge */
1890 msch2resp); /* calculated MPPE key */
1891 if (env_data->chap2_success) mschap_add_reply(request, *response->vp_octets,
1892 tmpl_attr_tail_da(env_data->chap2_success), msch2resp, 42);
1893
1894 RETURN_UNLANG_OK;
1895}
1896
1897/** Complete mschap authentication after any tmpls have been expanded.
1898 *
1899 */
1900static unlang_action_t mod_authenticate_resume(unlang_result_t *p_result, module_ctx_t const *mctx, request_t *request)
1901{
1902 mschap_auth_ctx_t *auth_ctx = talloc_get_type_abort(mctx->rctx, mschap_auth_ctx_t);
1903 mschap_auth_call_env_t *env_data = talloc_get_type_abort(auth_ctx->env_data, mschap_auth_call_env_t);
1904 rlm_mschap_t const *inst = talloc_get_type_abort_const(auth_ctx->inst, rlm_mschap_t);
1905 fr_pair_t *challenge = NULL;
1906 fr_pair_t *response = NULL;
1907 fr_pair_t *parent;
1908 uint8_t nthashhash[NT_DIGEST_LENGTH];
1909 int mschap_version = 0;
1910
1911 p_result->rcode = RLM_MODULE_OK;
1912
1913 if (auth_ctx->cpw) {
1914 uint8_t *p;
1915
1916 /*
1917 * Password change does require the NT password
1918 */
1919 if (!auth_ctx->nt_password) {
1920 REDEBUG("Missing Password.NT - required for change password request");
1921 RETURN_UNLANG_FAIL;
1922 }
1923 if (!env_data->chap_nt_enc_pw) {
1924 REDEBUG("chap_nt_enc_pw option is not set - required for change password request");
1925 RETURN_UNLANG_INVALID;
1926 }
1927
1928 mschap_process_cpw_request(p_result, inst, request, auth_ctx);
1929 if (p_result->rcode != RLM_MODULE_OK) goto finish;
1930
1931 /*
1932 * Clear any expiry bit so the user can now login;
1933 * obviously the password change action will need
1934 * to have cleared this bit in the config/SQL/wherever.
1935 */
1936 if (auth_ctx->smb_ctrl && auth_ctx->smb_ctrl->vp_uint32 & ACB_FR_EXPIRED) {
1937 RDEBUG2("Clearing expiry bit in SMB-Acct-Ctrl to allow authentication");
1938 auth_ctx->smb_ctrl->vp_uint32 &= ~ACB_FR_EXPIRED;
1939 }
1940
1941 /*
1942 * Extract the challenge & response from the end of the
1943 * password change, add them into the request and then
1944 * continue with the authentication.
1945 */
1946 MEM(pair_update_request(&response, tmpl_attr_tail_da(env_data->chap2_response)) >= 0);
1947 MEM(fr_pair_value_mem_alloc(response, &p, 50, auth_ctx->cpw->vp_tainted) == 0);
1948
1949 /* ident & flags */
1950 p[0] = auth_ctx->cpw->vp_octets[1];
1951 p[1] = 0;
1952 /* peer challenge and client NT response */
1953 memcpy(p + 2, auth_ctx->cpw->vp_octets + 18, 48);
1954 }
1955
1956 challenge = fr_pair_find_by_da_nested(&request->request_pairs, NULL, tmpl_attr_tail_da(env_data->chap_challenge));
1957 if (!challenge) {
1958 REDEBUG("control.Auth-Type = %s set for a request that does not contain %s",
1959 auth_ctx->name, env_data->chap_challenge->name);
1960 p_result->rcode = RLM_MODULE_INVALID;
1961 goto finish;
1962 }
1963
1964 /*
1965 * The responses MUST be in the same group as the challenge.
1966 */
1967 parent = fr_pair_parent(challenge);
1968 fr_assert(parent != NULL);
1969
1970 /*
1971 * We also require an MS-CHAP-Response.
1972 */
1973 if ((response = fr_pair_find_by_da(&parent->vp_group, NULL, tmpl_attr_tail_da(env_data->chap_response)))) {
1974 mschap_process_response(p_result,
1975 &mschap_version, nthashhash,
1976 inst, request,
1977 auth_ctx,
1978 challenge, response);
1979 if (p_result->rcode != RLM_MODULE_OK) goto finish;
1980 } else if ((response = fr_pair_find_by_da_nested(&parent->vp_group, NULL, tmpl_attr_tail_da(env_data->chap2_response)))) {
1981 mschap_process_v2_response(p_result,
1982 &mschap_version, nthashhash,
1983 inst, request,
1984 auth_ctx,
1985 challenge, response);
1986 if (p_result->rcode != RLM_MODULE_OK) goto finish;
1987 } else { /* Neither CHAPv1 or CHAPv2 response: die */
1988 REDEBUG("control.Auth-Type = %s set for a request that does not contain %s or %s attributes",
1989 auth_ctx->name, env_data->chap_response->name, env_data->chap2_response->name);
1990 p_result->rcode = RLM_MODULE_INVALID;
1991 goto finish;
1992 }
1993
1994 /* now create MPPE attributes */
1995 if (inst->use_mppe) {
1996 fr_pair_t *vp;
1997 uint8_t mppe_sendkey[34];
1998 uint8_t mppe_recvkey[34];
1999
2000 switch (mschap_version) {
2001 case 1:
2002 RDEBUG2("Generating MS-CHAPv1 MPPE keys");
2003 memset(mppe_sendkey, 0, 32);
2004
2005 /*
2006 * According to RFC 2548 we
2007 * should send NT hash. But in
2008 * practice it doesn't work.
2009 * Instead, we should send nthashhash
2010 *
2011 * This is an error in RFC 2548.
2012 */
2013 /*
2014 * do_mschap cares to zero nthashhash if NT hash
2015 * is not available.
2016 */
2017 memcpy(mppe_sendkey + 8, nthashhash, NT_DIGEST_LENGTH);
2018 mppe_add_reply(inst, request, tmpl_attr_tail_da(env_data->chap_mppe_keys), mppe_sendkey, 24); //-V666
2019 break;
2020
2021 case 2:
2022 RDEBUG2("Generating MS-CHAPv2 MPPE keys");
2023 mppe_chap2_gen_keys128(nthashhash, response->vp_octets + 26, mppe_sendkey, mppe_recvkey);
2024
2025 mppe_add_reply(inst, request, tmpl_attr_tail_da(env_data->mppe_recv_key), mppe_recvkey, 16);
2026 mppe_add_reply(inst, request, tmpl_attr_tail_da(env_data->mppe_send_key), mppe_sendkey, 16);
2027 break;
2028
2029 default:
2030 fr_assert(0);
2031 break;
2032 }
2033
2034 MEM(pair_update_reply(&vp, tmpl_attr_tail_da(env_data->mppe_encryption_policy)) >= 0);
2035 vp->vp_uint32 = inst->require_encryption ? 2 : 1;
2036
2037 MEM(pair_update_reply(&vp, tmpl_attr_tail_da(env_data->mppe_encryption_types)) >= 0);
2038 vp->vp_uint32 = inst->require_strong ? 4 : 6;
2039 } /* else we weren't asked to use MPPE */
2040
2041finish:
2042 return UNLANG_ACTION_CALCULATE_RESULT;
2043}
2044
2045#ifdef WITH_TLS
2046/** Decrypt the new cleartext password when handling change password requests
2047 *
2048 */
2049static int mschap_new_pass_decrypt(request_t *request, mschap_auth_ctx_t *auth_ctx)
2050{
2051 EVP_CIPHER_CTX *evp_ctx;
2052 uint8_t nt_pass_decrypted[516], old_nt_hash_expected[NT_DIGEST_LENGTH];
2053 int c, ntlen = sizeof(nt_pass_decrypted);
2054 size_t passlen, i = 0, len = 0;
2055 char *x;
2056 uint8_t *p, *q;
2057 fr_pair_t *new_pass;
2058
2059 MEM(evp_ctx = EVP_CIPHER_CTX_new());
2060
2061 if (unlikely(EVP_EncryptInit_ex(evp_ctx, EVP_rc4(), NULL, auth_ctx->nt_password->vp_octets, NULL) != 1)) {
2062 EVP_CIPHER_CTX_free(evp_ctx);
2063 fr_tls_strerror_printf(NULL);
2064 RPERROR("Failed initialising RC4 ctx");
2065 return -1;
2066 }
2067
2068 if (unlikely(EVP_CIPHER_CTX_set_key_length(evp_ctx, auth_ctx->nt_password->vp_length) != 1)) {
2069 EVP_CIPHER_CTX_free(evp_ctx);
2070 fr_tls_strerror_printf(NULL);
2071 RPERROR("Failed setting key length");
2072 return -1;
2073 }
2074
2075 if (unlikely(EVP_EncryptUpdate(evp_ctx, nt_pass_decrypted, &ntlen, auth_ctx->cpw_ctx->new_nt_encrypted, ntlen) != 1)) {
2076 EVP_CIPHER_CTX_free(evp_ctx);
2077 fr_tls_strerror_printf(NULL);
2078 RPERROR("Failed ingesting new password");
2079 return -1;
2080 }
2081
2082 EVP_CIPHER_CTX_free(evp_ctx);
2083
2084 /*
2085 * pwblock is
2086 * 512-N bytes random pad
2087 * N bytes password as utf-16-le
2088 * 4 bytes - N as big-endian int
2089 */
2090 passlen = nt_pass_decrypted[512];
2091 passlen += nt_pass_decrypted[513] << 8;
2092 if ((nt_pass_decrypted[514] != 0) ||
2093 (nt_pass_decrypted[515] != 0)) {
2094 REDEBUG("Decrypted new password blob claims length > 65536, probably an invalid Password.NT");
2095 return -1;
2096 }
2097
2098 /*
2099 * Sanity check - passlen positive and <= 512 if not, crypto has probably gone wrong
2100 */
2101 if (passlen > 512) {
2102 REDEBUG("Decrypted new password blob claims length %zu > 512, "
2103 "probably an invalid Password.NT", passlen);
2104 return -1;
2105 }
2106
2107 p = nt_pass_decrypted + 512 - passlen;
2108
2109 /*
2110 * The new NT hash - this should be preferred over the
2111 * cleartext password as it avoids unicode hassles.
2112 */
2113 MEM(pair_update_request(&auth_ctx->cpw_ctx->new_hash, attr_ms_chap_new_nt_password) >= 0);
2114 MEM(fr_pair_value_mem_alloc(auth_ctx->cpw_ctx->new_hash, &q, NT_DIGEST_LENGTH, false) == 0);
2115 fr_md4_calc(q, p, passlen);
2116
2117 /*
2118 * Check that nt_password encrypted with new_hash
2119 * matches the old_hash value from the client.
2120 */
2121 smbhash(old_nt_hash_expected, auth_ctx->nt_password->vp_octets, q);
2122 smbhash(old_nt_hash_expected + 8, auth_ctx->nt_password->vp_octets + 8, q + 7);
2123 if (fr_digest_cmp(old_nt_hash_expected, auth_ctx->cpw_ctx->old_nt_hash, NT_DIGEST_LENGTH)!=0) {
2124 REDEBUG("Old NT hash value from client does not match our value");
2125 RHEXDUMP1(old_nt_hash_expected, NT_DIGEST_LENGTH, "expected");
2126 RHEXDUMP1(auth_ctx->cpw_ctx->old_nt_hash, NT_DIGEST_LENGTH, "got");
2127 return -1;
2128 }
2129
2130 /*
2131 * The new cleartext password, which is utf-16 do some unpleasant vileness
2132 * to turn it into utf8 without pulling in libraries like iconv.
2133 *
2134 * First pass: get the length of the converted string.
2135 */
2136 MEM(pair_update_request(&new_pass, attr_ms_chap_new_cleartext_password) >= 0);
2137 new_pass->vp_length = 0;
2138
2139 while (i < passlen) {
2140 c = p[i++];
2141 c += p[i++] << 8;
2142
2143 /*
2144 * Gah. nasty. maybe we should just pull in iconv?
2145 */
2146 if (c <= 0x7f) {
2147 len++;
2148 } else if (c <= 0x7ff) {
2149 len += 2;
2150 } else {
2151 len += 3;
2152 }
2153 }
2154
2155 MEM(fr_pair_value_bstr_alloc(new_pass, &x, len, true) == 0);
2156
2157 /*
2158 * Second pass: convert the characters from UTF-16 to UTF-8.
2159 */
2160 i = 0;
2161 while (i < passlen) {
2162 c = p[i++];
2163 c += p[i++] << 8;
2164
2165 /*
2166 * Gah. nasty. maybe we should just pull in iconv?
2167 */
2168 if (c < 0x7f) {
2169 *x++ = c;
2170
2171 } else if (c < 0x7ff) {
2172 *x++ = 0xc0 + (c >> 6);
2173 *x++ = 0x80 + (c & 0x3f);
2174
2175 } else {
2176 *x++ = 0xe0 + (c >> 12);
2177 *x++ = 0x80 + ((c>>6) & 0x3f);
2178 *x++ = 0x80 + (c & 0x3f);
2179 }
2180 }
2181
2182 *x = '\0';
2183 return 0;
2184}
2185#endif
2186
2187/*
2188 * mod_authenticate() - authenticate user based on given
2189 * attributes and configuration.
2190 * We will try to find out password in configuration
2191 * or in configured passwd file.
2192 * If one is found we will check paraneters given by NAS.
2193 *
2194 * If SMB-Account-Ctrl is not set to ACB_PWNOTREQ we must have
2195 * one of:
2196 * PAP: User-Password or
2197 * MS-CHAP: MS-CHAP-Challenge and MS-CHAP-Response or
2198 * MS-CHAP2: MS-CHAP-Challenge and MS-CHAP2-Response
2199 * In case of password mismatch or locked account we MAY return
2200 * MS-CHAP-Error for MS-CHAP or MS-CHAP v2
2201 * If MS-CHAP2 succeeds we MUST return MS-CHAP2-Success
2202 */
2203static unlang_action_t CC_HINT(nonnull) mod_authenticate(unlang_result_t *p_result, module_ctx_t const *mctx, request_t *request)
2204{
2205 rlm_mschap_t const *inst = talloc_get_type_abort_const(mctx->mi->data, rlm_mschap_t);
2206#ifdef WITH_AUTH_WINBIND
2207 rlm_mschap_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_mschap_thread_t);
2208#endif
2209 mschap_auth_call_env_t *env_data = talloc_get_type_abort(mctx->env_data, mschap_auth_call_env_t);
2210 mschap_auth_ctx_t *auth_ctx;
2211
2212 MEM(auth_ctx = talloc_zero(unlang_interpret_frame_talloc_ctx(request), mschap_auth_ctx_t));
2213
2214 /*
2215 * If we have ntlm_auth configured, use it unless told
2216 * otherwise
2217 */
2218 *auth_ctx = (mschap_auth_ctx_t) {
2219 .name = mctx->mi->name,
2220 .inst = inst,
2221 .method = inst->method,
2222 .env_data = env_data,
2223#ifdef WITH_AUTH_WINBIND
2224 .t = t,
2225#endif
2226 };
2227
2228 /*
2229 * If we have an ntlm_auth configuration, then we may
2230 * want to suppress it.
2231 */
2232 if (auth_ctx->method != AUTH_INTERNAL) {
2233 fr_pair_t *vp = fr_pair_find_by_da(&request->control_pairs, NULL, attr_ms_chap_use_ntlm_auth);
2234 if (vp && (vp->vp_uint8 <= AUTH_AUTO)) auth_ctx->method = vp->vp_uint8;
2235 }
2236
2237 /*
2238 * Find the SMB-Account-Ctrl attribute, or the
2239 * SMB-Account-Ctrl-Text attribute.
2240 */
2241 auth_ctx->smb_ctrl = fr_pair_find_by_da(&request->control_pairs, NULL, attr_smb_account_ctrl);
2242 if (!auth_ctx->smb_ctrl) {
2243 fr_pair_t *smb_account_ctrl_text;
2244
2245 smb_account_ctrl_text = fr_pair_find_by_da(&request->control_pairs, NULL, attr_smb_account_ctrl_text);
2246 if (smb_account_ctrl_text) {
2247 MEM(pair_append_control(&auth_ctx->smb_ctrl, attr_smb_account_ctrl) >= 0);
2248 auth_ctx->smb_ctrl->vp_uint32 = pdb_decode_acct_ctrl(smb_account_ctrl_text->vp_strvalue);
2249 }
2250 }
2251
2252 /*
2253 * We're configured to do MS-CHAP authentication.
2254 * and account control information exists. Enforce it.
2255 */
2256 if (auth_ctx->smb_ctrl) {
2257 /*
2258 * Password is not required.
2259 */
2260 if ((auth_ctx->smb_ctrl->vp_uint32 & ACB_PWNOTREQ) != 0) {
2261 RDEBUG2("SMB-Account-Ctrl says no password is required");
2262 RETURN_UNLANG_OK;
2263 }
2264 }
2265
2266 /*
2267 * Look for or create an Password.NT
2268 *
2269 * Password.NT can be NULL here if we didn't find an
2270 * input attribute, and we're calling out to an
2271 * external password store.
2272 */
2273 if (nt_password_find(auth_ctx, &auth_ctx->nt_password, mctx->mi->data, request) < 0) RETURN_UNLANG_FAIL;
2274
2275 /*
2276 * Check to see if this is a change password request, and process
2277 * it accordingly if so.
2278 */
2279 if (env_data->chap2_cpw) auth_ctx->cpw = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
2280 tmpl_attr_tail_da(env_data->chap2_cpw));
2281 if (auth_ctx->cpw) {
2282 /*
2283 * Password change does require the NT password
2284 */
2285 if (!auth_ctx->nt_password) {
2286 REDEBUG("Missing Password.NT - required for change password request");
2287 RETURN_UNLANG_FAIL;
2288 }
2289
2290 if (mschap_cpw_prepare(request, auth_ctx) < 0) RETURN_UNLANG_FAIL;
2291
2292 switch (auth_ctx->method) {
2293 case AUTH_INTERNAL:
2294#ifdef WITH_TLS
2295 if (mschap_new_pass_decrypt(request, auth_ctx) < 0) RETURN_UNLANG_FAIL;
2296
2297 if (unlang_module_yield(request, mod_authenticate_resume, NULL, 0, auth_ctx) == UNLANG_ACTION_FAIL) {
2298 RETURN_UNLANG_FAIL;
2299 }
2300
2301 fr_value_box_list_init(&auth_ctx->cpw_ctx->local_cpw_result);
2302 if (unlang_tmpl_push(auth_ctx, NULL, &auth_ctx->cpw_ctx->local_cpw_result, request,
2303 env_data->local_cpw, NULL, UNLANG_SUB_FRAME) < 0) RETURN_UNLANG_FAIL;
2304 break;
2305#else
2306 REDEBUG("Local MS-CHAPv2 password changes require OpenSSL support");
2307 RETURN_UNLANG_INVALID;
2308#endif
2309
2310 default:
2311 if (!env_data->ntlm_cpw_username) {
2312 REDEBUG("No ntlm_auth username set, passchange will definitely fail!");
2313 RETURN_UNLANG_FAIL;
2314 }
2315
2316 /*
2317 * Run the resumption function where we're done with:
2318 */
2319 if (unlang_module_yield(request, mod_authenticate_resume, NULL, 0, auth_ctx) == UNLANG_ACTION_FAIL) {
2320 RETURN_UNLANG_FAIL;
2321 };
2322
2323 /*
2324 * a) Expanding the domain, if specified
2325 */
2326 if (env_data->ntlm_cpw_domain) {
2327 fr_value_box_list_init(&auth_ctx->cpw_ctx->cpw_domain);
2328 if (unlang_tmpl_push(auth_ctx, NULL, &auth_ctx->cpw_ctx->cpw_domain, request,
2329 env_data->ntlm_cpw_domain, NULL, UNLANG_SUB_FRAME) < 0) RETURN_UNLANG_FAIL;
2330 }
2331
2332 fr_value_box_list_init(&auth_ctx->cpw_ctx->cpw_user);
2333
2334 /*
2335 * b) Expanding the username
2336 */
2337 if (unlang_tmpl_push(auth_ctx, NULL, &auth_ctx->cpw_ctx->cpw_user, request,
2338 env_data->ntlm_cpw_username, NULL, UNLANG_SUB_FRAME) < 0) RETURN_UNLANG_FAIL;
2339 break;
2340 }
2341
2342 return UNLANG_ACTION_PUSHED_CHILD;
2343 }
2344
2345 /*
2346 * Not doing password change, just jump straight to the resumption function...
2347 */
2348 {
2349 module_ctx_t our_mctx = *mctx;
2350 our_mctx.rctx = auth_ctx;
2351
2352 return mod_authenticate_resume(p_result, &our_mctx, request);
2353 }
2354}
2355
2356/*
2357 * Create instance for our module. Allocate space for
2358 * instance structure and read configuration parameters
2359 */
2360static int mod_instantiate(module_inst_ctx_t const *mctx)
2361{
2362 rlm_mschap_t *inst = talloc_get_type_abort(mctx->mi->data, rlm_mschap_t);
2363 CONF_SECTION *conf = mctx->mi->conf;
2364
2365 inst->auth_type = fr_dict_enum_by_name(attr_auth_type, mctx->mi->name, -1);
2366 if (!inst->auth_type) {
2367 WARN("Failed to find 'authenticate %s {...}' section. MS-CHAP authentication will likely not work",
2368 mctx->mi->name);
2369 }
2370
2371 /*
2372 * Set auth method
2373 */
2374 inst->method = AUTH_INTERNAL;
2375
2376 if (inst->wb_username) {
2377#ifdef WITH_AUTH_WINBIND
2378 inst->method = AUTH_WBCLIENT;
2379#else
2380 cf_log_err(conf, "'winbind' auth not enabled at compiled time");
2381 return -1;
2382#endif
2383 }
2384
2385 /* preserve existing behaviour: this option overrides all */
2386 if (inst->ntlm_auth) {
2387 inst->method = AUTH_NTLMAUTH_EXEC;
2388 }
2389
2390 switch (inst->method) {
2391 case AUTH_INTERNAL:
2392 DEBUG("Using internal authentication");
2393 break;
2394 case AUTH_AUTO:
2395 DEBUG("Using auto password or ntlm_auth");
2396 break;
2397 case AUTH_NTLMAUTH_EXEC:
2398 DEBUG("Authenticating by calling 'ntlm_auth'");
2399 break;
2400#ifdef WITH_AUTH_WINBIND
2401 case AUTH_WBCLIENT:
2402 DEBUG("Authenticating directly to winbind");
2403 break;
2404#endif
2405 }
2406
2407 /*
2408 * Check ntlm_auth_timeout is sane
2409 */
2410 if (!fr_time_delta_ispos(inst->ntlm_auth_timeout)) {
2411 inst->ntlm_auth_timeout = fr_time_delta_from_sec(EXEC_TIMEOUT);
2412 }
2413 if (fr_time_delta_lt(inst->ntlm_auth_timeout, fr_time_delta_from_sec(1))) {
2414 cf_log_err(conf, "ntml_auth_timeout '%pVs' is too small (minimum: 1s)",
2415 fr_box_time_delta(inst->ntlm_auth_timeout));
2416 return -1;
2417 }
2418 if (fr_time_delta_gt(inst->ntlm_auth_timeout, fr_time_delta_from_sec(10))) {
2419 cf_log_err(conf, "ntlm_auth_timeout '%pVs' is too large (maximum: 10s)",
2420 fr_box_time_delta(inst->ntlm_auth_timeout));
2421 return -1;
2422 }
2423
2424#define CHECK_OPTION(_option) cp = cf_pair_find(attrs, STRINGIFY(_option)); \
2425if (!cp) { \
2426 WARN("Missing option \"" STRINGIFY(_option) "\", setting use_mppe to \"no\""); \
2427 inst->use_mppe = false; \
2428 goto done_mppe_check; \
2429}
2430
2431 /*
2432 * Check that MPPE attributes are in the module config, if the option is enabled.
2433 * Validity of them will be checked when the module is compiled.
2434 */
2435 if (inst->use_mppe) {
2436 CONF_SECTION *attrs = cf_section_find(conf, "attributes", NULL);
2437 CONF_PAIR *cp;
2438
2439 if (!attrs) {
2440 cf_log_err(conf, "Missing required \"attributes\" section");
2441 return -1;
2442 }
2443 CHECK_OPTION(chap_mppe_keys)
2444 CHECK_OPTION(mppe_encryption_policy)
2445 CHECK_OPTION(mppe_recv_key)
2446 CHECK_OPTION(mppe_send_key)
2447 CHECK_OPTION(mppe_encryption_types)
2448 }
2449done_mppe_check:
2450
2451 return 0;
2452}
2453
2454static int mod_bootstrap(module_inst_ctx_t const *mctx)
2455{
2456 xlat_t *xlat;
2457
2458 xlat = module_rlm_xlat_register(mctx->mi->boot, mctx, NULL, mschap_xlat, FR_TYPE_VOID);
2459 xlat_func_args_set(xlat, mschap_xlat_args);
2460 xlat_func_call_env_set(xlat, &mschap_xlat_method_env);
2461
2462 return 0;
2463}
2464
2465#ifdef WITH_AUTH_WINBIND
2466static int mod_thread_instantiate(module_thread_inst_ctx_t const *mctx)
2467{
2468 rlm_mschap_t const *inst = talloc_get_type_abort(mctx->mi->data, rlm_mschap_t);
2469 rlm_mschap_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_mschap_thread_t);
2470
2471 t->inst = inst;
2472 if (!(t->slab = mschap_slab_list_alloc(t, mctx->el, &inst->reuse, winbind_ctx_alloc, NULL, NULL, false, false))) {
2473 ERROR("Connection handle pool instantiation failed");
2474 return -1;
2475 }
2476
2477 return 0;
2478}
2479
2480static int mod_thread_detach(module_thread_inst_ctx_t const *mctx)
2481{
2482 rlm_mschap_thread_t *t = talloc_get_type_abort(mctx->thread, rlm_mschap_thread_t);
2483 talloc_free(t->slab);
2484 return 0;
2485}
2486#endif
2487
2488extern module_rlm_t rlm_mschap;
2489module_rlm_t rlm_mschap = {
2490 .common = {
2491 .magic = MODULE_MAGIC_INIT,
2492 .name = "mschap",
2493 .inst_size = sizeof(rlm_mschap_t),
2494 .config = module_config,
2495 .bootstrap = mod_bootstrap,
2496 .instantiate = mod_instantiate,
2497#ifdef WITH_AUTH_WINBIND
2498 .thread_inst_size = sizeof(rlm_mschap_thread_t),
2499 .thread_instantiate = mod_thread_instantiate,
2500 .thread_detach = mod_thread_detach
2501#endif
2502 },
2503 .method_group = {
2504 .bindings = (module_method_binding_t[]){
2505 { .section = SECTION_NAME("authenticate", CF_IDENT_ANY), .method = mod_authenticate, .method_env = &mschap_auth_method_env },
2506 { .section = SECTION_NAME("recv", CF_IDENT_ANY), .method = mod_authorize, .method_env = &mschap_autz_method_env },
2507 MODULE_BINDING_TERMINATOR
2508 }
2509 }
2510};
unlang_action_t
unlang_action_t
Returned by unlang_op_t calls, determine the next action of the interpreter.
Definition action.h:35
UNLANG_ACTION_PUSHED_CHILD
@ UNLANG_ACTION_PUSHED_CHILD
unlang_t pushed a new child onto the stack, execute it instead of continuing.
Definition action.h:39
UNLANG_ACTION_FAIL
@ UNLANG_ACTION_FAIL
Encountered an unexpected error.
Definition action.h:36
UNLANG_ACTION_CALCULATE_RESULT
@ UNLANG_ACTION_CALCULATE_RESULT
Calculate a new section rlm_rcode_t value.
Definition action.h:37
buffer
static int const char char buffer[256]
Definition acutest.h:576
do_auth_wbclient
int do_auth_wbclient(rlm_mschap_t const *inst, request_t *request, uint8_t const *challenge, uint8_t const *response, uint8_t nthashhash[NT_DIGEST_LENGTH], mschap_auth_ctx_t *auth_ctx)
Check NTLM authentication direct to winbind via Samba's libwbclient library.
Definition auth_wbclient.c:93
auth_wbclient.h
fr_base16_encode
#define fr_base16_encode(_out, _in)
Definition base16.h:54
fr_base16_decode
#define fr_base16_decode(_err, _out, _in, _no_trailing)
Definition base16.h:92
USES_APPLE_DEPRECATED_API
#define USES_APPLE_DEPRECATED_API
Definition build.h:499
RCSID
#define RCSID(id)
Definition build.h:512
unlikely
#define unlikely(_x)
Definition build.h:407
UNUSED
#define UNUSED
Definition build.h:336
NUM_ELEMENTS
#define NUM_ELEMENTS(_t)
Definition build.h:358
CALL_ENV_TERMINATOR
#define CALL_ENV_TERMINATOR
Definition call_env.h:236
FR_CALL_ENV_METHOD_OUT
#define FR_CALL_ENV_METHOD_OUT(_inst)
Helper macro for populating the size/type fields of a call_env_method_t from the output structure typ...
Definition call_env.h:240
call_env_method_s::env
call_env_parser_t const * env
Parsing rules for call method env.
Definition call_env.h:247
FR_CALL_ENV_SUBSECTION
#define FR_CALL_ENV_SUBSECTION(_name, _name2, _flags, _subcs)
Specify a call_env_parser_t which defines a nested subsection.
Definition call_env.h:402
CALL_ENV_FLAG_SUBSECTION
@ CALL_ENV_FLAG_SUBSECTION
This is a subsection.
Definition call_env.h:87
CALL_ENV_FLAG_ATTRIBUTE
@ CALL_ENV_FLAG_ATTRIBUTE
Tmpl MUST contain an attribute reference.
Definition call_env.h:86
CALL_ENV_FLAG_NONE
@ CALL_ENV_FLAG_NONE
Definition call_env.h:74
CALL_ENV_FLAG_REQUIRED
@ CALL_ENV_FLAG_REQUIRED
Associated conf pair or section is required.
Definition call_env.h:75
CALL_ENV_FLAG_NULLABLE
@ CALL_ENV_FLAG_NULLABLE
Tmpl expansions are allowed to produce no output.
Definition call_env.h:80
FR_CALL_ENV_OFFSET
#define FR_CALL_ENV_OFFSET(_name, _cast_type, _flags, _struct, _field)
Specify a call_env_parser_t which writes out runtime results to the specified field.
Definition call_env.h:340
FR_CALL_ENV_PARSE_ONLY_OFFSET
#define FR_CALL_ENV_PARSE_ONLY_OFFSET(_name, _cast_type, _flags, _struct, _parse_field)
Specify a call_env_parser_t which writes out the result of the parsing phase to the field specified.
Definition call_env.h:389
call_env_method_s
Definition call_env.h:244
call_env_parser_s
Per method call config.
Definition call_env.h:180
CONF_PARSER_TERMINATOR
#define CONF_PARSER_TERMINATOR
Definition cf_parse.h:669
FR_CONF_DEPRECATED
#define FR_CONF_DEPRECATED(_name, _struct, _field)
conf_parser_t entry which raises an error if a matching CONF_PAIR is found
Definition cf_parse.h:409
FR_CONF_OFFSET
#define FR_CONF_OFFSET(_name, _struct, _field)
conf_parser_t which parses a single CONF_PAIR, writing the result to a field in a struct
Definition cf_parse.h:280
FR_CONF_POINTER
#define FR_CONF_POINTER(_name, _type, _flags, _res_p)
conf_parser_t which parses a single CONF_PAIR producing a single global result
Definition cf_parse.h:334
FR_CONF_OFFSET_FLAGS
#define FR_CONF_OFFSET_FLAGS(_name, _flags, _struct, _field)
conf_parser_t which parses a single CONF_PAIR, writing the result to a field in a struct
Definition cf_parse.h:268
FR_CONF_OFFSET_SUBSECTION
#define FR_CONF_OFFSET_SUBSECTION(_name, _flags, _struct, _field, _subcs)
conf_parser_t which populates a sub-struct using a CONF_SECTION
Definition cf_parse.h:309
CONF_FLAG_XLAT
@ CONF_FLAG_XLAT
string will be dynamically expanded.
Definition cf_parse.h:443
CONF_FLAG_SUBSECTION
@ CONF_FLAG_SUBSECTION
Instead of putting the information into a configuration structure, the configuration file routines MA...
Definition cf_parse.h:423
conf_parser_s
Defines a CONF_PAIR to C data type mapping.
Definition cf_parse.h:606
cf_pair
Configuration AVP similar to a fr_pair_t.
Definition cf_priv.h:77
cf_section
A section grouping multiple CONF_PAIR.
Definition cf_priv.h:106
cf_section_find
CONF_SECTION * cf_section_find(CONF_SECTION const *cs, char const *name1, char const *name2)
Find a CONF_SECTION with name1 and optionally name2.
Definition cf_util.c:1194
cf_log_err
#define cf_log_err(_cf, _fmt,...)
Definition cf_util.h:345
CF_IDENT_ANY
#define CF_IDENT_ANY
Definition cf_util.h:80
FR_DBUFF_TMP
#define FR_DBUFF_TMP(_start, _len_or_end)
Creates a compound literal to pass into functions which accept a dbuff.
Definition dbuff.h:522
fr_dcursor_append
static int fr_dcursor_append(fr_dcursor_t *cursor, void *v)
Insert a single item at the end of the list.
Definition dcursor.h:406
fr_dcursor_s
Definition dcursor.h:91
MEM
#define MEM(x)
Definition debug.h:36
ERROR
#define ERROR(fmt,...)
Definition dhcpclient.c:40
DEBUG
#define DEBUG(fmt,...)
Definition dhcpclient.c:38
fr_dict_attr_autoload_t::out
fr_dict_attr_t const ** out
Where to write a pointer to the resolved fr_dict_attr_t.
Definition dict.h:292
fr_dict_autoload_t::out
fr_dict_t const ** out
Where to write a pointer to the loaded/resolved fr_dict_t.
Definition dict.h:305
DICT_AUTOLOAD_TERMINATOR
#define DICT_AUTOLOAD_TERMINATOR
Definition dict.h:311
fr_dict_enum_by_name
fr_dict_enum_value_t const * fr_dict_enum_by_name(fr_dict_attr_t const *da, char const *name, ssize_t len)
Definition dict_util.c:3678
in
static fr_slen_t in
Definition dict.h:882
fr_dict_attr_autoload_t
Specifies an attribute which must be present for the module to function.
Definition dict.h:291
fr_dict_autoload_t
Specifies a dictionary which must be loaded/loadable for the module to function.
Definition dict.h:304
value
Test enumeration values.
Definition dict_test.h:92
MODULE_MAGIC_INIT
#define MODULE_MAGIC_INIT
Stop people using different module/library/server versions together.
Definition dl_module.h:63
EXEC_TIMEOUT
#define EXEC_TIMEOUT
Default wait time for exec calls (in seconds).
Definition exec.h:32
radius_exec_program_legacy
int radius_exec_program_legacy(char *out, size_t outlen, request_t *request, char const *cmd, fr_pair_list_t *input_pairs, bool exec_wait, bool shell_escape, fr_time_delta_t timeout)
Execute a program.
Definition exec_legacy.c:474
radius_start_program_legacy
pid_t radius_start_program_legacy(int *stdin_fd, int *stdout_fd, int *stderr_fd, char const *cmd, request_t *request, bool exec_wait, fr_pair_list_t *input_pairs, bool shell_escape)
Start a process.
Definition exec_legacy.c:227
radius_readfrom_program_legacy
int radius_readfrom_program_legacy(int fd, pid_t pid, fr_time_delta_t timeout, char *answer, int left)
Read from the child process.
Definition exec_legacy.c:357
mschap_xlat
static xlat_action_t mschap_xlat(TALLOC_CTX *ctx, fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *in)
Get data from MSCHAP attributes.
Definition rlm_mschap.c:365
talloc_free
talloc_free(hp)
unlang_interpret_frame_talloc_ctx
TALLOC_CTX * unlang_interpret_frame_talloc_ctx(request_t *request)
Get a talloc_ctx which is valid only for this frame.
Definition interpret.c:2035
UNLANG_SUB_FRAME
#define UNLANG_SUB_FRAME
Definition interpret.h:37
unlang_result_t::rcode
rlm_rcode_t rcode
The current rcode, from executing the instruction or merging the result from a frame.
Definition interpret.h:139
unlang_result_t
Definition interpret.h:138
REXDENT
#define REXDENT()
Exdent (unindent) R* messages by one level.
Definition log.h:455
RHEXDUMP1
#define RHEXDUMP1(_data, _len, _fmt,...)
Definition log.h:715
RWDEBUG
#define RWDEBUG(fmt,...)
Definition log.h:373
RDEBUG_ENABLED3
#define RDEBUG_ENABLED3
True if request debug level 1-3 messages are enabled.
Definition log.h:347
RDEBUG3
#define RDEBUG3(fmt,...)
Definition log.h:355
RWDEBUG2
#define RWDEBUG2(fmt,...)
Definition log.h:374
RERROR
#define RERROR(fmt,...)
Definition log.h:310
RPERROR
#define RPERROR(fmt,...)
Definition log.h:314
REDEBUG2
#define REDEBUG2(fmt,...)
Definition log.h:384
RINDENT
#define RINDENT()
Indent R* messages by one level.
Definition log.h:442
fr_md4_calc
void fr_md4_calc(uint8_t out[static MD4_DIGEST_LENGTH], uint8_t const *in, size_t inlen)
Calculate the MD4 hash of the contents of a buffer.
Definition md4.c:473
MD4_DIGEST_LENGTH
#define MD4_DIGEST_LENGTH
Definition md4.h:22
FR_TYPE_STRING
@ FR_TYPE_STRING
String of printable characters.
Definition merged_model.c:83
FR_TYPE_UINT8
@ FR_TYPE_UINT8
8 Bit unsigned integer.
Definition merged_model.c:97
FR_TYPE_UINT32
@ FR_TYPE_UINT32
32 Bit unsigned integer.
Definition merged_model.c:99
FR_TYPE_VOID
@ FR_TYPE_VOID
User data.
Definition merged_model.c:127
FR_TYPE_OCTETS
@ FR_TYPE_OCTETS
Raw octets.
Definition merged_model.c:84
ssize_t
long int ssize_t
Definition merged_model.c:24
uint8_t
unsigned char uint8_t
Definition merged_model.c:30
fr_dict_attr_t
Definition merged_model.c:133
fr_dict_t
Definition merged_model.c:198
fr_value_box_t
Definition merged_model.c:136
request_t
Definition merged_model.c:210
tmpl_t
Definition merged_model.c:225
fr_digest_cmp
int fr_digest_cmp(uint8_t const *a, uint8_t const *b, size_t length)
Do a comparison of two authentication digests by comparing the FULL data.
Definition misc.c:504
strncasecmp
int strncasecmp(char *s1, char *s2, int n)
Definition missing.c:35
strsep
char * strsep(char **stringp, char const *delim)
Definition missing.c:122
strcasecmp
int strcasecmp(char *s1, char *s2)
Definition missing.c:65
module_ctx_t::env_data
void * env_data
Per call environment data.
Definition module_ctx.h:44
module_ctx_t::mi
module_instance_t const * mi
Instance of the module being instantiated.
Definition module_ctx.h:42
module_ctx_t::thread
void * thread
Thread specific instance data.
Definition module_ctx.h:43
module_ctx_t::rctx
void * rctx
Resume ctx that a module previously set.
Definition module_ctx.h:45
module_thread_inst_ctx_t::el
fr_event_list_t * el
Event list to register any IO handlers and timers against.
Definition module_ctx.h:68
module_thread_inst_ctx_t::thread
void * thread
Thread instance data.
Definition module_ctx.h:67
module_thread_inst_ctx_t::mi
module_instance_t const * mi
Instance of the module being instantiated.
Definition module_ctx.h:64
module_inst_ctx_t::mi
module_instance_t * mi
Instance of the module being instantiated.
Definition module_ctx.h:51
module_ctx_t
Temporary structure to hold arguments for module calls.
Definition module_ctx.h:41
module_inst_ctx_t
Temporary structure to hold arguments for instantiation calls.
Definition module_ctx.h:50
module_thread_inst_ctx_t
Temporary structure to hold arguments for thread_instantiation calls.
Definition module_ctx.h:63
module_rlm_xlat_register
xlat_t * module_rlm_xlat_register(TALLOC_CTX *ctx, module_inst_ctx_t const *mctx, char const *name, xlat_func_t func, fr_type_t return_type)
Definition module_rlm.c:232
module_rlm_section_type_set
bool module_rlm_section_type_set(request_t *request, fr_dict_attr_t const *type_da, fr_dict_enum_value_t const *enumv)
Set the next section type if it's not already set.
Definition module_rlm.c:403
module_rlm_s::common
module_t common
Common fields presented by all modules.
Definition module_rlm.h:39
module_rlm_s
Definition module_rlm.h:38
mschap_nt_password_hash
int mschap_nt_password_hash(uint8_t out[static NT_DIGEST_LENGTH], char const *password)
Converts Unicode password to 16-byte NT hash with MD4.
Definition mschap.c:52
mschap_add_reply
void mschap_add_reply(request_t *request, uint8_t ident, fr_dict_attr_t const *da, char const *value, size_t len)
Definition mschap.c:162
mschap_auth_response
void mschap_auth_response(char const *username, size_t username_len, uint8_t const *nt_hash_hash, uint8_t const *ntresponse, uint8_t const *peer_challenge, uint8_t const *auth_challenge, char *response)
Definition mschap.c:101
mschap_challenge_hash
void mschap_challenge_hash(uint8_t challenge[static MSCHAP_CHALLENGE_LENGTH], uint8_t const peer_challenge[static MSCHAP_PEER_CHALLENGE_LENGTH], uint8_t const auth_challenge[static MSCHAP_PEER_AUTHENTICATOR_CHALLENGE_LENGTH], char const *user_name, size_t user_name_len)
Definition mschap.c:72
LM_DIGEST_LENGTH
#define LM_DIGEST_LENGTH
Definition mschap.h:8
NT_DIGEST_LENGTH
#define NT_DIGEST_LENGTH
Definition mschap.h:7
fr_pair_value_memdup
int fr_pair_value_memdup(fr_pair_t *vp, uint8_t const *src, size_t len, bool tainted)
Copy data into an "octets" data type.
Definition pair.c:2962
fr_pair_find_by_da_nested
fr_pair_t * fr_pair_find_by_da_nested(fr_pair_list_t const *list, fr_pair_t const *prev, fr_dict_attr_t const *da)
Find a pair with a matching fr_dict_attr_t, by walking the nested fr_dict_attr_t tree.
Definition pair.c:784
fr_pair_find_by_da
fr_pair_t * fr_pair_find_by_da(fr_pair_list_t const *list, fr_pair_t const *prev, fr_dict_attr_t const *da)
Find the first pair with a matching da.
Definition pair.c:707
fr_pair_parent
fr_pair_t * fr_pair_parent(fr_pair_t const *vp)
Return a pointer to the parent pair.
Definition pair.c:956
fr_pair_afrom_da
fr_pair_t * fr_pair_afrom_da(TALLOC_CTX *ctx, fr_dict_attr_t const *da)
Dynamically allocate a new attribute and assign a fr_dict_attr_t.
Definition pair.c:290
fr_pair_value_bstr_alloc
int fr_pair_value_bstr_alloc(fr_pair_t *vp, char **out, size_t size, bool tainted)
Pre-allocate a memory buffer for a "string" type value pair.
Definition pair.c:2759
fr_pair_value_mem_alloc
int fr_pair_value_mem_alloc(fr_pair_t *vp, uint8_t **out, size_t size, bool tainted)
Pre-allocate a memory buffer for a "octets" type value pair.
Definition pair.c:2911
normify
static ssize_t normify(normalise_t *action, uint8_t *buffer, size_t bufflen, char const *known_good, size_t len, size_t min_len)
Definition password.c:429
password_find
fr_pair_t * password_find(bool *ephemeral, TALLOC_CTX *ctx, request_t *request, fr_dict_attr_t const *allowed_attrs[], size_t allowed_attrs_len, bool normify)
Find a "known good" password in the control list of a request.
Definition password.c:994
config
static const conf_parser_t config[]
Definition base.c:163
fr_assert
#define fr_assert(_expr)
Definition rad_assert.h:37
attr_user_name
static fr_dict_attr_t const * attr_user_name
Definition radclient-ng.c:127
pair_update_request
#define pair_update_request(_attr, _da)
Definition radclient-ng.c:59
REDEBUG
#define REDEBUG(fmt,...)
Definition radclient-ng.h:52
RDEBUG2
#define RDEBUG2(fmt,...)
Definition radclient-ng.h:54
WARN
#define WARN(fmt,...)
Definition radclient-ng.h:47
done
static bool done
Definition radclient.c:80
conf
static rs_t * conf
Definition radsniff.c:52
fr_rand
uint32_t fr_rand(void)
Return a 32-bit random number.
Definition rand.c:104
RETURN_UNLANG_INVALID
#define RETURN_UNLANG_INVALID
Definition rcode.h:66
RETURN_UNLANG_RCODE
#define RETURN_UNLANG_RCODE(_rcode)
Definition rcode.h:61
RETURN_UNLANG_FAIL
#define RETURN_UNLANG_FAIL
Definition rcode.h:63
RETURN_UNLANG_REJECT
#define RETURN_UNLANG_REJECT
Definition rcode.h:62
RETURN_UNLANG_OK
#define RETURN_UNLANG_OK
Definition rcode.h:64
rlm_rcode_t
rlm_rcode_t
Return codes indicating the result of the module call.
Definition rcode.h:44
RLM_MODULE_INVALID
@ RLM_MODULE_INVALID
The module considers the request invalid.
Definition rcode.h:51
RLM_MODULE_OK
@ RLM_MODULE_OK
The module is OK, continue.
Definition rcode.h:49
RLM_MODULE_DISALLOW
@ RLM_MODULE_DISALLOW
Reject the request (user is locked out).
Definition rcode.h:52
RLM_MODULE_REJECT
@ RLM_MODULE_REJECT
Immediately reject the request.
Definition rcode.h:47
RLM_MODULE_NOTFOUND
@ RLM_MODULE_NOTFOUND
User not found.
Definition rcode.h:53
RLM_MODULE_NOOP
@ RLM_MODULE_NOOP
Module succeeded without doing anything.
Definition rcode.h:54
RETURN_UNLANG_NOOP
#define RETURN_UNLANG_NOOP
Definition rcode.h:69
mod_thread_instantiate
static int mod_thread_instantiate(module_thread_inst_ctx_t const *mctx)
Definition rlm_cache_memcached.c:325
mod_thread_detach
static int mod_thread_detach(module_thread_inst_ctx_t const *mctx)
Definition rlm_cache_memcached.c:340
SHSpad2
static const uint8_t SHSpad2[40]
Definition rlm_mschap.c:1231
attr_smb_account_ctrl
fr_dict_attr_t const * attr_smb_account_ctrl
Definition rlm_mschap.c:240
mschap_xlat_call_env_t::username
tmpl_t const * username
Definition rlm_mschap.c:155
CHECK_OPTION
#define CHECK_OPTION(_option)
mschap_process_response
static unlang_action_t mschap_process_response(unlang_result_t *p_result, int *mschap_version, uint8_t nthashhash[static NT_DIGEST_LENGTH], rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx, fr_pair_t *challenge, fr_pair_t *response)
Definition rlm_mschap.c:1699
xlat_call_env
static const call_env_parser_t xlat_call_env[]
Definition rlm_mschap.c:161
mppe_chap2_get_keys128
static void mppe_chap2_get_keys128(uint8_t const *nt_hashhash, uint8_t const *nt_response, uint8_t *sendkey, uint8_t *recvkey)
Definition rlm_mschap.c:1307
mppe_add_reply
static void mppe_add_reply(UNUSED rlm_mschap_t const *inst, request_t *request, fr_dict_attr_t const *da, uint8_t const *value, size_t len)
Definition rlm_mschap.c:786
attr_nt_password
fr_dict_attr_t const * attr_nt_password
Definition rlm_mschap.c:238
attr_ms_chap_new_cleartext_password
fr_dict_attr_t const * attr_ms_chap_new_cleartext_password
Definition rlm_mschap.c:233
rlm_mschap_dict
fr_dict_autoload_t rlm_mschap_dict[]
Definition rlm_mschap.c:224
ACB_MNS
#define ACB_MNS
MNS logon user account.
Definition rlm_mschap.c:71
auth_call_env
static const call_env_parser_t auth_call_env[]
Definition rlm_mschap.c:169
mschap_xlat_call_env_t::chap_response
tmpl_t const * chap_response
Definition rlm_mschap.c:157
mschap_process_v2_response
static unlang_action_t mschap_process_v2_response(unlang_result_t *p_result, int *mschap_version, uint8_t nthashhash[static NT_DIGEST_LENGTH], rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx, fr_pair_t *challenge, fr_pair_t *response)
Definition rlm_mschap.c:1751
mschap_autz_call_env_t::chap2_cpw
tmpl_t const * chap2_cpw
Definition rlm_mschap.c:209
attr_eap_identity
fr_dict_attr_t const * attr_eap_identity
Definition rlm_mschap.c:232
mschap_autz_call_env_t::chap2_response
tmpl_t const * chap2_response
Definition rlm_mschap.c:208
mschap_error
static unlang_action_t mschap_error(unlang_result_t *p_result, rlm_mschap_t const *inst, request_t *request, unsigned char ident, int mschap_result, int mschap_version, fr_pair_t *smb_ctrl, mschap_auth_call_env_t *env_data)
Definition rlm_mschap.c:1380
ACB_AUTOLOCK
#define ACB_AUTOLOCK
Account auto locked.
Definition rlm_mschap.c:76
MSCHAP_CALL_ENV
#define MSCHAP_CALL_ENV(_x)
Definition rlm_mschap.c:134
attr_smb_account_ctrl_text
fr_dict_attr_t const * attr_smb_account_ctrl_text
Definition rlm_mschap.c:239
mod_authenticate_resume
static unlang_action_t mod_authenticate_resume(unlang_result_t *p_result, module_ctx_t const *mctx, request_t *request)
Complete mschap authentication after any tmpls have been expanded.
Definition rlm_mschap.c:1900
autz_call_env
static const call_env_parser_t autz_call_env[]
Definition rlm_mschap.c:212
ACB_TEMPDUP
#define ACB_TEMPDUP
Temporary duplicate account.
Definition rlm_mschap.c:69
pdb_decode_acct_ctrl
static int pdb_decode_acct_ctrl(char const *p)
Definition rlm_mschap.c:274
dict_freeradius
static fr_dict_t const * dict_freeradius
Definition rlm_mschap.c:220
mppe_GetMasterKey
static void mppe_GetMasterKey(uint8_t const *nt_hashhash, uint8_t const *nt_response, uint8_t *masterkey)
Definition rlm_mschap.c:1265
mschap_auth_method_env
static const call_env_method_t mschap_auth_method_env
Definition rlm_mschap.c:184
nt_password_find
static int nt_password_find(TALLOC_CTX *ctx, fr_pair_t **out, rlm_mschap_t const *inst, request_t *request)
Find a Password.NT value, or create one from a Password.Cleartext, or Password.With-Header attribute.
Definition rlm_mschap.c:1478
ACB_FR_EXPIRED
#define ACB_FR_EXPIRED
Password Expired.
Definition rlm_mschap.c:77
ACB_DISABLED
#define ACB_DISABLED
User account disabled.
Definition rlm_mschap.c:66
mschap_process_cpw_request
static unlang_action_t mschap_process_cpw_request(unlang_result_t *p_result, rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx)
Definition rlm_mschap.c:1566
dict_radius
static fr_dict_t const * dict_radius
Definition rlm_mschap.c:221
magic1
static const uint8_t magic1[27]
Definition rlm_mschap.c:1237
mod_bootstrap
static int mod_bootstrap(module_inst_ctx_t const *mctx)
Definition rlm_mschap.c:2454
SHSpad1
static const uint8_t SHSpad1[40]
Definition rlm_mschap.c:1225
attr_auth_type
fr_dict_attr_t const * attr_auth_type
Definition rlm_mschap.c:230
attr_ms_chap_user_name
fr_dict_attr_t const * attr_ms_chap_user_name
Definition rlm_mschap.c:237
mschap_autz_call_env_t::chap_response
tmpl_t const * chap_response
Definition rlm_mschap.c:207
mod_authorize
static unlang_action_t mod_authorize(unlang_result_t *p_result, module_ctx_t const *mctx, request_t *request)
Definition rlm_mschap.c:1345
mppe_GetAsymmetricStartKey
static void mppe_GetAsymmetricStartKey(uint8_t *masterkey, uint8_t *sesskey, int keylen, int issend)
Definition rlm_mschap.c:1281
mschap_xlat_args
static xlat_arg_parser_t const mschap_xlat_args[]
Definition rlm_mschap.c:352
attr_ms_chap_use_ntlm_auth
fr_dict_attr_t const * attr_ms_chap_use_ntlm_auth
Definition rlm_mschap.c:236
ACB_HOMDIRREQ
#define ACB_HOMDIRREQ
Home directory required.
Definition rlm_mschap.c:67
mschap_xlat_call_env_t::chap2_response
tmpl_t const * chap2_response
Definition rlm_mschap.c:158
rlm_mschap
module_rlm_t rlm_mschap
Definition rlm_mschap.c:2489
write_all
static int write_all(int fd, char const *buf, size_t len)
Definition rlm_mschap.c:801
attr_cleartext_password
fr_dict_attr_t const * attr_cleartext_password
Definition rlm_mschap.c:231
rlm_mschap_dict_attr
fr_dict_attr_autoload_t rlm_mschap_dict_attr[]
Definition rlm_mschap.c:243
mod_authenticate
static unlang_action_t mod_authenticate(unlang_result_t *p_result, module_ctx_t const *mctx, request_t *request)
Definition rlm_mschap.c:2203
magic3
static const uint8_t magic3[84]
Definition rlm_mschap.c:1253
do_mschap_cpw
static int do_mschap_cpw(rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx, uint8_t *new_nt_password, uint8_t *old_nt_hash)
Definition rlm_mschap.c:826
do_mschap
static int do_mschap(rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx, uint8_t const *challenge, uint8_t const *response, uint8_t nthashhash[static NT_DIGEST_LENGTH])
Definition rlm_mschap.c:1038
magic2
static const uint8_t magic2[84]
Definition rlm_mschap.c:1242
ACB_DOMTRUST
#define ACB_DOMTRUST
Interdomain trust account.
Definition rlm_mschap.c:72
ACB_WSTRUST
#define ACB_WSTRUST
Workstation trust account.
Definition rlm_mschap.c:73
mppe_chap2_gen_keys128
static void mppe_chap2_gen_keys128(uint8_t const *nt_hashhash, uint8_t const *response, uint8_t *sendkey, uint8_t *recvkey)
Definition rlm_mschap.c:1321
attr_ms_chap_new_nt_password
fr_dict_attr_t const * attr_ms_chap_new_nt_password
Definition rlm_mschap.c:234
ACB_NORMAL
#define ACB_NORMAL
Normal user account.
Definition rlm_mschap.c:70
mschap_xlat_call_env_t::chap_challenge
tmpl_t const * chap_challenge
Definition rlm_mschap.c:156
ACB_PWNOTREQ
#define ACB_PWNOTREQ
User password not required.
Definition rlm_mschap.c:68
module_config
static const conf_parser_t module_config[]
Definition rlm_mschap.c:100
attr_ms_chap_peer_challenge
fr_dict_attr_t const * attr_ms_chap_peer_challenge
Definition rlm_mschap.c:235
mschap_cpw_prepare
static int mschap_cpw_prepare(request_t *request, mschap_auth_ctx_t *auth_ctx)
Validate data required for change password requests.
Definition rlm_mschap.c:1599
MSCHAP_OPT_CALL_ENV
#define MSCHAP_OPT_CALL_ENV(_opt, _x)
Definition rlm_mschap.c:151
mod_instantiate
static int mod_instantiate(module_inst_ctx_t const *mctx)
Definition rlm_mschap.c:2360
ACB_PWNOEXP
#define ACB_PWNOEXP
User password does not expire.
Definition rlm_mschap.c:75
mschap_identity_find
static fr_pair_t * mschap_identity_find(request_t *request, fr_dict_attr_t const *attr_user_name)
Definition rlm_mschap.c:259
passchange_config
static const conf_parser_t passchange_config[]
Definition rlm_mschap.c:79
mschap_autz_call_env_t::chap_challenge
tmpl_t const * chap_challenge
Definition rlm_mschap.c:206
MSCHAP_COMMON_CALL_ENV
#define MSCHAP_COMMON_CALL_ENV(_x)
Definition rlm_mschap.c:143
ACB_SVRTRUST
#define ACB_SVRTRUST
Server trust account.
Definition rlm_mschap.c:74
winbind_config
static const conf_parser_t winbind_config[]
Definition rlm_mschap.c:91
mschap_autz_call_env_t
Definition rlm_mschap.c:205
mschap_xlat_call_env_t
Definition rlm_mschap.c:154
rlm_mschap.h
mschap_cpw_ctx_t::new_nt_encrypted
uint8_t new_nt_encrypted[516]
Definition rlm_mschap.h:106
mschap_auth_call_env_t::username
tmpl_t const * username
Definition rlm_mschap.h:82
mschap_auth_ctx_t::method
MSCHAP_AUTH_METHOD method
Definition rlm_mschap.h:115
mschap_auth_call_env_t::mppe_encryption_types
tmpl_t const * mppe_encryption_types
Definition rlm_mschap.h:92
mschap_auth_ctx_t::cpw
fr_pair_t * cpw
Definition rlm_mschap.h:118
mschap_auth_ctx_t::name
char const * name
Definition rlm_mschap.h:112
mschap_auth_call_env_t::ntlm_cpw_domain
tmpl_t const * ntlm_cpw_domain
Definition rlm_mschap.h:98
mschap_cpw_ctx_t::new_hash
fr_pair_t * new_hash
Definition rlm_mschap.h:108
mschap_auth_call_env_t::ntlm_cpw_username
tmpl_t const * ntlm_cpw_username
Definition rlm_mschap.h:97
mschap_auth_call_env_t::chap_nt_enc_pw
tmpl_t const * chap_nt_enc_pw
Definition rlm_mschap.h:94
mschap_auth_call_env_t::mppe_send_key
tmpl_t const * mppe_send_key
Definition rlm_mschap.h:91
mschap_auth_ctx_t::inst
rlm_mschap_t const * inst
Definition rlm_mschap.h:113
mschap_cpw_ctx_t::cpw_user
fr_value_box_list_t cpw_user
Definition rlm_mschap.h:103
mschap_auth_call_env_t::chap_response
tmpl_t const * chap_response
Definition rlm_mschap.h:85
mschap_auth_call_env_t::local_cpw
tmpl_t const * local_cpw
Definition rlm_mschap.h:99
mschap_cpw_ctx_t::cpw_domain
fr_value_box_list_t cpw_domain
Definition rlm_mschap.h:104
mschap_auth_ctx_t::smb_ctrl
fr_pair_t * smb_ctrl
Definition rlm_mschap.h:117
mschap_auth_call_env_t::chap_challenge
tmpl_t const * chap_challenge
Definition rlm_mschap.h:84
mschap_auth_call_env_t::chap2_response
tmpl_t const * chap2_response
Definition rlm_mschap.h:86
mschap_cpw_ctx_t::local_cpw_result
fr_value_box_list_t local_cpw_result
Definition rlm_mschap.h:105
mschap_auth_call_env_t::mppe_encryption_policy
tmpl_t const * mppe_encryption_policy
Definition rlm_mschap.h:89
mschap_auth_ctx_t::env_data
mschap_auth_call_env_t * env_data
Definition rlm_mschap.h:114
mschap_auth_call_env_t::mppe_recv_key
tmpl_t const * mppe_recv_key
Definition rlm_mschap.h:90
mschap_auth_call_env_t::chap_error
tmpl_t const * chap_error
Definition rlm_mschap.h:83
mschap_auth_call_env_t::chap2_cpw
tmpl_t const * chap2_cpw
Definition rlm_mschap.h:93
mschap_cpw_ctx_t::old_nt_hash
uint8_t old_nt_hash[NT_DIGEST_LENGTH]
Definition rlm_mschap.h:107
mschap_auth_call_env_t::chap2_success
tmpl_t const * chap2_success
Definition rlm_mschap.h:87
mschap_auth_ctx_t::cpw_ctx
mschap_cpw_ctx_t * cpw_ctx
Definition rlm_mschap.h:119
mschap_auth_ctx_t::nt_password
fr_pair_t * nt_password
Definition rlm_mschap.h:116
AUTH_AUTO
@ AUTH_AUTO
Definition rlm_mschap.h:20
AUTH_INTERNAL
@ AUTH_INTERNAL
Definition rlm_mschap.h:18
AUTH_NTLMAUTH_EXEC
@ AUTH_NTLMAUTH_EXEC
Definition rlm_mschap.h:19
mschap_auth_call_env_t::chap_mppe_keys
tmpl_t const * chap_mppe_keys
Definition rlm_mschap.h:88
mschap_auth_call_env_t
Definition rlm_mschap.h:81
mschap_auth_ctx_t
Definition rlm_mschap.h:111
mschap_cpw_ctx_t
Definition rlm_mschap.h:102
rlm_mschap_t
Definition rlm_mschap.h:41
winbind_ctx_alloc
static int winbind_ctx_alloc(winbind_ctx_t *wbctx, UNUSED void *uctx)
Definition rlm_winbind.c:360
reuse_winbind_config
static conf_parser_t reuse_winbind_config[]
Definition rlm_winbind.c:44
_mod_ctx_free
static int _mod_ctx_free(winbind_ctx_t *wbctx)
Definition rlm_winbind.c:351
winbind_ctx_t::ctx
struct wbcContext * ctx
Definition rlm_winbind.h:21
winbind_ctx_t
Definition rlm_winbind.h:20
FR_SBUFF_IN
#define FR_SBUFF_IN(_start, _len_or_end)
FR_SBUFF_OUT
#define FR_SBUFF_OUT(_start, _len_or_end)
SECTION_NAME
#define SECTION_NAME(_name1, _name2)
Define a section name consisting of a verb and a noun.
Definition section.h:39
module_instance_s::name
char const * name
Instance name e.g. user_database.
Definition module.h:357
module_instance_s::conf
CONF_SECTION * conf
Module's instance configuration.
Definition module.h:351
module_s::inst_size
size_t inst_size
Size of the module's instance data.
Definition module.h:212
module_instance_s::data
void * data
Module's instance data.
Definition module.h:293
module_instance_s::boot
void * boot
Data allocated during the boostrap phase.
Definition module.h:296
MODULE_BINDING_TERMINATOR
#define MODULE_BINDING_TERMINATOR
Terminate a module binding list.
Definition module.h:152
module_method_binding_s
Named methods exported by a module.
Definition module.h:174
pair_append_control
#define pair_append_control(_attr, _da)
Allocate and append a fr_pair_t to the control list.
Definition pair.h:57
pair_update_reply
#define pair_update_reply(_attr, _da)
Return or allocate a fr_pair_t in the reply list.
Definition pair.h:129
tmpl_attr_tail_da
static fr_dict_attr_t const * tmpl_attr_tail_da(tmpl_t const *vpt)
Return the last attribute reference da.
Definition tmpl.h:801
fr_sha1_init
void fr_sha1_init(fr_sha1_ctx *context)
Definition sha1.c:93
fr_sha1_final
void fr_sha1_final(uint8_t digest[static SHA1_DIGEST_LENGTH], fr_sha1_ctx *context)
Definition sha1.c:141
fr_sha1_update
void fr_sha1_update(fr_sha1_ctx *context, uint8_t const *in, size_t len)
Definition sha1.c:105
fr_sha1_ctx
Definition sha1.h:33
FR_SLAB_CONFIG_CONF_PARSER
#define FR_SLAB_CONFIG_CONF_PARSER
conf_parser_t entries to populate user configurable slab values
Definition slab.h:35
smbhash
void smbhash(unsigned char *out, unsigned char const *in, unsigned char *key)
Definition smbdes.c:287
smbdes_mschap
void smbdes_mschap(uint8_t const win_password[16], uint8_t const *challenge, uint8_t *response)
Definition smbdes.c:339
smbdes_lmpwdhash
void smbdes_lmpwdhash(char const *password, uint8_t *lmhash)
Definition smbdes.c:319
snprintf
PUBLIC int snprintf(char *string, size_t length, char *format, va_alist)
Definition snprintf.c:689
unlang_module_yield
unlang_action_t unlang_module_yield(request_t *request, module_method_t resume, unlang_module_signal_t signal, fr_signal_t sigmask, void *rctx)
Yield a request back to the interpreter from within a module.
Definition module.c:431
inst
eap_aka_sim_process_conf_t * inst
Definition state_machine.c:3645
vp
fr_pair_t * vp
Definition state_machine.c:2287
value_pair_s
Stores an attribute, a value and various bits of other data.
Definition pair.h:68
value_pair_s::da
fr_dict_attr_t const *_CONST da
Dictionary attribute defines the attribute number, vendor and type of the pair.
Definition pair.h:69
fr_syserror
char const * fr_syserror(int num)
Guaranteed to be thread-safe version of strerror.
Definition syserror.c:243
talloc_get_type_abort_const
#define talloc_get_type_abort_const
Definition talloc.h:117
fr_time_delta_lt
#define fr_time_delta_lt(_a, _b)
Definition time.h:285
fr_time_delta_from_sec
static fr_time_delta_t fr_time_delta_from_sec(int64_t sec)
Definition time.h:590
fr_time_delta_ispos
#define fr_time_delta_ispos(_a)
Definition time.h:290
fr_time_delta_gt
#define fr_time_delta_gt(_a, _b)
Definition time.h:283
unlang_tmpl_push
int unlang_tmpl_push(TALLOC_CTX *ctx, unlang_result_t *p_result, fr_value_box_list_t *out, request_t *request, tmpl_t const *tmpl, unlang_tmpl_args_t *args, bool top_frame)
Push a tmpl onto the stack for evaluation.
Definition tmpl.c:276
T_BARE_WORD
@ T_BARE_WORD
Definition token.h:118
xlat_arg_parser_t::required
unsigned int required
Argument must be present, and non-empty.
Definition xlat.h:146
XLAT_ARG_PARSER_TERMINATOR
#define XLAT_ARG_PARSER_TERMINATOR
Definition xlat.h:170
xlat_action_t
xlat_action_t
Definition xlat.h:37
XLAT_ACTION_FAIL
@ XLAT_ACTION_FAIL
An xlat function failed.
Definition xlat.h:44
XLAT_ACTION_DONE
@ XLAT_ACTION_DONE
We're done evaluating this level of nesting.
Definition xlat.h:43
xlat_arg_parser_t
Definition for a single argument consumed by an xlat function.
Definition xlat.h:145
parent
static fr_slen_t parent
Definition pair.h:858
fr_strerror_printf
#define fr_strerror_printf(_fmt,...)
Log to thread local error buffer.
Definition strerror.h:64
fr_value_box_asprintf
int fr_value_box_asprintf(TALLOC_CTX *ctx, fr_value_box_t *dst, fr_dict_attr_t const *enumv, bool tainted, char const *fmt,...)
Print a formatted string using our internal printf wrapper and assign it to a value box.
Definition value.c:4707
fr_value_box_strdup
int fr_value_box_strdup(TALLOC_CTX *ctx, fr_value_box_t *dst, fr_dict_attr_t const *enumv, char const *src, bool tainted)
Copy a nul terminated string to a fr_value_box_t.
Definition value.c:4619
fr_value_box_bstrndup
int fr_value_box_bstrndup(TALLOC_CTX *ctx, fr_value_box_t *dst, fr_dict_attr_t const *enumv, char const *src, size_t len, bool tainted)
Copy a string to to a fr_value_box_t.
Definition value.c:4838
fr_value_box_memdup
int fr_value_box_memdup(TALLOC_CTX *ctx, fr_value_box_t *dst, fr_dict_attr_t const *enumv, uint8_t const *src, size_t len, bool tainted)
Copy a buffer to a fr_value_box_t.
Definition value.c:5079
data
static fr_slen_t data
Definition value.h:1340
fr_box_strvalue_len
#define fr_box_strvalue_len(_val, _len)
Definition value.h:309
fr_box_time_delta
#define fr_box_time_delta(_val)
Definition value.h:366
nonnull
int nonnull(2, 5))
fr_value_box_alloc_null
#define fr_value_box_alloc_null(_ctx)
Allocate a value box for later use with a value assignment function.
Definition value.h:655
out
static size_t char ** out
Definition value.h:1030
fr_box_octets
#define fr_box_octets(_val, _len)
Definition value.h:311
xlat_ctx_s::env_data
void * env_data
Expanded call env data.
Definition xlat_ctx.h:53
xlat_ctx_s::mctx
module_ctx_t const * mctx
Synthesised module calling ctx.
Definition xlat_ctx.h:52
xlat_ctx_s
An xlat calling ctx.
Definition xlat_ctx.h:49
xlat_func_args_set
int xlat_func_args_set(xlat_t *x, xlat_arg_parser_t const args[])
Register the arguments of an xlat.
Definition xlat_func.c:365
xlat_func_call_env_set
void xlat_func_call_env_set(xlat_t *x, call_env_method_t const *env_method)
Register call environment of an xlat.
Definition xlat_func.c:382
xlat_s
Definition xlat_priv.h:59
Generated by   doxygen 1.9.8