The FreeRADIUS server  $Id: 15bac2a4c627c01d1aa2047687b3418955ac7f00 $
rlm_mschap.c
Go to the documentation of this file.
1 /*
2  * This program is is free software; you can redistribute it and/or modify
3  * it under the terms of the GNU General Public License as published by
4  * the Free Software Foundation; either version 2 of the License, or (at
5  * your option) any later version.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
15  */
16 
17 /**
18  * $Id: 3f479a3ad4037956735aa20bc576064ff7be0c90 $
19  * @file rlm_mschap.c
20  * @brief Implemented mschap authentication.
21  *
22  * @copyright 2000, 2001, 2006 The FreeRADIUS server project
23  */
24 
25 /* MPPE support from Takahiro Wagatsuma <waga@sic.shibaura-it.ac.jp> */
26 
27 RCSID("$Id: 3f479a3ad4037956735aa20bc576064ff7be0c90 $")
28 
29 #define LOG_PREFIX mctx->mi->name
30 
31 #include <freeradius-devel/server/base.h>
32 #include <freeradius-devel/server/exec_legacy.h>
33 #include <freeradius-devel/server/module_rlm.h>
34 #include <freeradius-devel/server/password.h>
35 #include <freeradius-devel/tls/strerror.h>
36 #include <freeradius-devel/util/debug.h>
37 #include <freeradius-devel/radius/defs.h>
38 
39 #include <freeradius-devel/util/base16.h>
40 #include <freeradius-devel/util/md4.h>
41 #include <freeradius-devel/util/md5.h>
42 #include <freeradius-devel/util/misc.h>
43 #include <freeradius-devel/util/sha1.h>
44 
45 #include <freeradius-devel/unlang/function.h>
46 #include <freeradius-devel/unlang/xlat_func.h>
47 
48 #include <sys/wait.h>
49 
50 #include "rlm_mschap.h"
51 #include "mschap.h"
52 #include "smbdes.h"
53 
54 #ifdef WITH_AUTH_WINBIND
55 #include "auth_wbclient.h"
56 #endif
57 
58 #ifdef WITH_TLS
59 USES_APPLE_DEPRECATED_API /* OpenSSL API has been deprecated by Apple */
60 # include <freeradius-devel/tls/openssl_user_macros.h>
61 # include <openssl/rc4.h>
62 #endif
63 
64 #ifdef __APPLE__
65 unlang_action_t od_mschap_auth(rlm_rcode_t *p_result, request_t *request, fr_pair_t *challenge, fr_pair_t *usernamepair,
66  mschap_auth_call_env_t *env_data);
67 #endif
68 
69 /* Allowable account control bits */
70 #define ACB_DISABLED 0x00010000 //!< User account disabled.
71 #define ACB_HOMDIRREQ 0x00020000 //!< Home directory required.
72 #define ACB_PWNOTREQ 0x00040000 //!< User password not required.
73 #define ACB_TEMPDUP 0x00080000 //!< Temporary duplicate account.
74 #define ACB_NORMAL 0x00100000 //!< Normal user account.
75 #define ACB_MNS 0x00200000 //!< MNS logon user account.
76 #define ACB_DOMTRUST 0x00400000 //!< Interdomain trust account.
77 #define ACB_WSTRUST 0x00800000 //!< Workstation trust account.
78 #define ACB_SVRTRUST 0x01000000 //!< Server trust account.
79 #define ACB_PWNOEXP 0x02000000 //!< User password does not expire.
80 #define ACB_AUTOLOCK 0x04000000 //!< Account auto locked.
81 #define ACB_FR_EXPIRED 0x00020000 //!< Password Expired.
82 
83 static const conf_parser_t passchange_config[] = {
84  { FR_CONF_OFFSET_FLAGS("ntlm_auth", CONF_FLAG_XLAT, rlm_mschap_t, ntlm_cpw) },
85  CONF_PARSER_TERMINATOR
86 };
87 
88 static const conf_parser_t winbind_config[] = {
89  { FR_CONF_OFFSET("username", rlm_mschap_t, wb_username) },
90 #ifdef WITH_AUTH_WINBIND
91  { FR_CONF_OFFSET("retry_with_normalised_username", rlm_mschap_t, wb_retry_with_normalised_username), .dflt = "no" },
92 #endif
93  CONF_PARSER_TERMINATOR
94 };
95 
96 static const conf_parser_t module_config[] = {
97  { FR_CONF_OFFSET("normalise", rlm_mschap_t, normify), .dflt = "yes" },
98 
99  /*
100  * Cache the password by default.
101  */
102  { FR_CONF_OFFSET("use_mppe", rlm_mschap_t, use_mppe), .dflt = "yes" },
103  { FR_CONF_OFFSET("require_encryption", rlm_mschap_t, require_encryption), .dflt = "no" },
104  { FR_CONF_OFFSET("require_strong", rlm_mschap_t, require_strong), .dflt = "no" },
105  { FR_CONF_OFFSET("with_ntdomain_hack", rlm_mschap_t, with_ntdomain_hack), .dflt = "yes" },
106  { FR_CONF_OFFSET_FLAGS("ntlm_auth", CONF_FLAG_XLAT, rlm_mschap_t, ntlm_auth) },
107  { FR_CONF_OFFSET("ntlm_auth_timeout", rlm_mschap_t, ntlm_auth_timeout) },
108 
109  { FR_CONF_POINTER("passchange", 0, CONF_FLAG_SUBSECTION, NULL), .subcs = (void const *) passchange_config },
110  { FR_CONF_OFFSET("allow_retry", rlm_mschap_t, allow_retry), .dflt = "yes" },
111  { FR_CONF_OFFSET("retry_msg", rlm_mschap_t, retry_msg) },
112 
113 
114 #ifdef __APPLE__
115  { FR_CONF_OFFSET("use_open_directory", rlm_mschap_t, open_directory), .dflt = "yes" },
116 #endif
117 
118  { FR_CONF_POINTER("winbind", 0, CONF_FLAG_SUBSECTION, NULL), .subcs = (void const *) winbind_config },
119 
120  /*
121  * These are now in a subsection above.
122  */
123  { FR_CONF_DEPRECATED("winbind_username", rlm_mschap_t, wb_username) },
124 #ifdef WITH_AUTH_WINBIND
125  { FR_CONF_DEPRECATED("winbind_retry_with_normalised_username", rlm_mschap_t, wb_retry_with_normalised_username) },
126 #endif
127  CONF_PARSER_TERMINATOR
128 };
129 
130 #define MSCHAP_CALL_ENV(_x) \
131 static const call_env_method_t mschap_ ## _x ## _method_env = { \
132  FR_CALL_ENV_METHOD_OUT(mschap_ ## _x ## _call_env_t), \
133  .env = (call_env_parser_t[]){ \
134  { FR_CALL_ENV_SUBSECTION("attributes", NULL, CALL_ENV_FLAG_REQUIRED, _x ## _call_env) }, \
135  CALL_ENV_TERMINATOR \
136  } \
137 }
138 
139 #define MSCHAP_COMMON_CALL_ENV(_x) \
140 { FR_CALL_ENV_PARSE_ONLY_OFFSET("chap_challenge", FR_TYPE_OCTETS, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_ ## _x ## _call_env_t, chap_challenge), \
141  .pair.dflt = "&Vendor-Specific.Microsoft.CHAP-Challenge", .pair.dflt_quote = T_BARE_WORD }, \
142 { FR_CALL_ENV_PARSE_ONLY_OFFSET("chap_response", FR_TYPE_OCTETS, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_ ## _x ## _call_env_t, chap_response), \
143  .pair.dflt = "&Vendor-Specific.Microsoft.CHAP-Response", .pair.dflt_quote = T_BARE_WORD }, \
144 { FR_CALL_ENV_PARSE_ONLY_OFFSET("chap2_response", FR_TYPE_OCTETS, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_ ## _x ## _call_env_t, chap2_response), \
145  .pair.dflt = "&Vendor-Specific.Microsoft.CHAP2-Response", .pair.dflt_quote = T_BARE_WORD }
146 
147 #define MSCHAP_OPT_CALL_ENV(_opt, _x) \
148 { FR_CALL_ENV_PARSE_ONLY_OFFSET(STRINGIFY(_opt), FR_TYPE_OCTETS, CALL_ENV_FLAG_ATTRIBUTE, mschap_ ## _x ## _call_env_t, _opt) }
149 
150 typedef struct {
151  tmpl_t const *username;
152  tmpl_t const *chap_challenge;
153  tmpl_t const *chap_response;
154  tmpl_t const *chap2_response;
155 } mschap_xlat_call_env_t;
156 
157 static const call_env_parser_t xlat_call_env[] = {
158  { FR_CALL_ENV_PARSE_ONLY_OFFSET("username", FR_TYPE_STRING, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_xlat_call_env_t, username), .pair.dflt = "&User-Name", .pair.dflt_quote = T_BARE_WORD },
159  MSCHAP_COMMON_CALL_ENV(xlat),
160  CALL_ENV_TERMINATOR
161 };
162 
163 MSCHAP_CALL_ENV(xlat);
164 
165 static const call_env_parser_t auth_call_env[] = {
166  { FR_CALL_ENV_PARSE_ONLY_OFFSET("username", FR_TYPE_STRING, CALL_ENV_FLAG_ATTRIBUTE | CALL_ENV_FLAG_REQUIRED, mschap_auth_call_env_t, username), .pair.dflt = "&User-Name", .pair.dflt_quote = T_BARE_WORD },
167  MSCHAP_COMMON_CALL_ENV(auth),
168  MSCHAP_OPT_CALL_ENV(chap2_success, auth),
169  MSCHAP_OPT_CALL_ENV(chap_error, auth),
170  MSCHAP_OPT_CALL_ENV(chap_mppe_keys, auth),
171  MSCHAP_OPT_CALL_ENV(mppe_encryption_policy, auth),
172  MSCHAP_OPT_CALL_ENV(mppe_recv_key, auth),
173  MSCHAP_OPT_CALL_ENV(mppe_send_key, auth),
174  MSCHAP_OPT_CALL_ENV(mppe_encryption_types, auth),
175  MSCHAP_OPT_CALL_ENV(chap2_cpw, auth),
176  MSCHAP_OPT_CALL_ENV(chap_nt_enc_pw, auth),
177  CALL_ENV_TERMINATOR
178 };
179 
180 static const call_env_method_t mschap_auth_method_env = {
181  FR_CALL_ENV_METHOD_OUT(mschap_auth_call_env_t),
182  .env = (call_env_parser_t[]){ \
183  { FR_CALL_ENV_SUBSECTION("attributes", NULL, CALL_ENV_FLAG_REQUIRED, auth_call_env) },
184  { FR_CALL_ENV_SUBSECTION("passchange", NULL, CALL_ENV_FLAG_SUBSECTION,
185  ((call_env_parser_t[]) {
186  { FR_CALL_ENV_PARSE_ONLY_OFFSET("ntlm_auth_username", FR_TYPE_STRING, CALL_ENV_FLAG_NONE, mschap_auth_call_env_t, ntlm_cpw_username) },
187  { FR_CALL_ENV_PARSE_ONLY_OFFSET("ntlm_auth_domain", FR_TYPE_STRING, CALL_ENV_FLAG_NONE, mschap_auth_call_env_t, ntlm_cpw_domain) },
188  { FR_CALL_ENV_PARSE_ONLY_OFFSET("local_cpw", FR_TYPE_STRING, CALL_ENV_FLAG_NONE, mschap_auth_call_env_t, local_cpw) },
189  CALL_ENV_TERMINATOR
190  }))},
191  { FR_CALL_ENV_SUBSECTION("winbind", NULL, CALL_ENV_FLAG_NONE,
192  ((call_env_parser_t[]) {
193  { FR_CALL_ENV_OFFSET("username", FR_TYPE_STRING, CALL_ENV_FLAG_NONE, mschap_auth_call_env_t, wb_username) },
194  { FR_CALL_ENV_OFFSET("domain", FR_TYPE_STRING, CALL_ENV_FLAG_NULLABLE, mschap_auth_call_env_t, wb_domain) },
195  CALL_ENV_TERMINATOR
196  }))},
197  CALL_ENV_TERMINATOR
198  }
199 };
200 
201 typedef struct {
202  tmpl_t const *chap_challenge;
203  tmpl_t const *chap_response;
204  tmpl_t const *chap2_response;
205  tmpl_t const *chap2_cpw;
206 } mschap_autz_call_env_t;
207 
208 static const call_env_parser_t autz_call_env[] = {
209  MSCHAP_COMMON_CALL_ENV(autz),
210  MSCHAP_OPT_CALL_ENV(chap2_cpw, autz),
211  CALL_ENV_TERMINATOR
212 };
213 
214 MSCHAP_CALL_ENV(autz);
215 
216 typedef struct {
217  fr_value_box_list_t cpw_user;
218  fr_value_box_list_t cpw_domain;
219  fr_value_box_list_t local_cpw_result;
220  uint8_t new_nt_encrypted[516];
221  uint8_t old_nt_hash[NT_DIGEST_LENGTH];
222  fr_pair_t *new_hash;
223 } mschap_cpw_ctx_t;
224 
225 typedef struct {
226  char const *name;
227  rlm_mschap_t const *inst;
228  mschap_auth_call_env_t *env_data;
229  MSCHAP_AUTH_METHOD method;
230  fr_pair_t *nt_password;
231  fr_pair_t *smb_ctrl;
232  fr_pair_t *cpw;
233  mschap_cpw_ctx_t *cpw_ctx;
234 } mschap_auth_ctx_t;
235 
236 static fr_dict_t const *dict_freeradius;
237 static fr_dict_t const *dict_radius;
238 
239 extern fr_dict_autoload_t rlm_mschap_dict[];
240 fr_dict_autoload_t rlm_mschap_dict[] = {
241  { .out = &dict_freeradius, .proto = "freeradius" },
242  { .out = &dict_radius, .proto = "radius" },
243  { NULL }
244 };
245 
246 fr_dict_attr_t const *attr_auth_type;
247 fr_dict_attr_t const *attr_cleartext_password;
248 fr_dict_attr_t const *attr_eap_identity;
249 fr_dict_attr_t const *attr_ms_chap_new_cleartext_password;
250 fr_dict_attr_t const *attr_ms_chap_new_nt_password;
251 fr_dict_attr_t const *attr_ms_chap_peer_challenge;
252 fr_dict_attr_t const *attr_ms_chap_use_ntlm_auth;
253 fr_dict_attr_t const *attr_ms_chap_user_name;
254 fr_dict_attr_t const *attr_nt_password;
255 fr_dict_attr_t const *attr_smb_account_ctrl_text;
256 fr_dict_attr_t const *attr_smb_account_ctrl;
257 
258 extern fr_dict_attr_autoload_t rlm_mschap_dict_attr[];
259 fr_dict_attr_autoload_t rlm_mschap_dict_attr[] = {
260  { .out = &attr_auth_type, .name = "Auth-Type", .type = FR_TYPE_UINT32, .dict = &dict_freeradius },
261  { .out = &attr_cleartext_password, .name = "Password.Cleartext", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
262  { .out = &attr_eap_identity, .name = "EAP-Identity", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
263  { .out = &attr_ms_chap_new_cleartext_password, .name = "MS-CHAP-New-Cleartext-Password", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
264  { .out = &attr_ms_chap_new_nt_password, .name = "MS-CHAP-New-NT-Password", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
265  { .out = &attr_ms_chap_peer_challenge, .name = "MS-CHAP-Peer-Challenge", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
266  { .out = &attr_ms_chap_use_ntlm_auth, .name = "MS-CHAP-Use-NTLM-Auth", .type = FR_TYPE_UINT8, .dict = &dict_freeradius },
267  { .out = &attr_ms_chap_user_name, .name = "MS-CHAP-User-Name", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
268  { .out = &attr_nt_password, .name = "Password.NT", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
269  { .out = &attr_smb_account_ctrl_text, .name = "SMB-Account-Ctrl-Text", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
270  { .out = &attr_smb_account_ctrl, .name = "SMB-Account-Ctrl", .type = FR_TYPE_UINT32, .dict = &dict_freeradius },
271 
272  { NULL }
273 };
274 
275 static fr_pair_t *mschap_identity_find(request_t *request, fr_dict_attr_t const *attr_user_name)
276 {
277  fr_pair_t *vp;
278 
279  vp = fr_pair_find_by_da(&request->request_pairs, NULL, attr_user_name);
280  if (vp) return vp;
281 
282  vp = fr_pair_find_by_da(&request->request_pairs, NULL, attr_eap_identity);
283  if (vp) return vp;
284 
285  REDEBUG("No user identity found in current request");
286 
287  return NULL;
288 }
289 
290 static int pdb_decode_acct_ctrl(char const *p)
291 {
292  int acct_ctrl = 0;
293  int done = 0;
294 
295  /*
296  * Check if the account type bits have been encoded after the
297  * NT password (in the form [NDHTUWSLXI]).
298  */
299 
300  if (*p != '[') return 0;
301 
302  for (p++; *p && !done; p++) {
303  switch (*p) {
304  case 'N': /* 'N'o password. */
305  acct_ctrl |= ACB_PWNOTREQ;
306  break;
307 
308  case 'D': /* 'D'isabled. */
309  acct_ctrl |= ACB_DISABLED ;
310  break;
311 
312  case 'H': /* 'H'omedir required. */
313  acct_ctrl |= ACB_HOMDIRREQ;
314  break;
315 
316  case 'T': /* 'T'emp account. */
317  acct_ctrl |= ACB_TEMPDUP;
318  break;
319 
320  case 'U': /* 'U'ser account (normal). */
321  acct_ctrl |= ACB_NORMAL;
322  break;
323 
324  case 'M': /* 'M'NS logon user account. What is this? */
325  acct_ctrl |= ACB_MNS;
326  break;
327 
328  case 'W': /* 'W'orkstation account. */
329  acct_ctrl |= ACB_WSTRUST;
330  break;
331 
332  case 'S': /* 'S'erver account. */
333  acct_ctrl |= ACB_SVRTRUST;
334  break;
335 
336  case 'L': /* 'L'ocked account. */
337  acct_ctrl |= ACB_AUTOLOCK;
338  break;
339 
340  case 'X': /* No 'X'piry on password */
341  acct_ctrl |= ACB_PWNOEXP;
342  break;
343 
344  case 'I': /* 'I'nterdomain trust account. */
345  acct_ctrl |= ACB_DOMTRUST;
346  break;
347 
348  case 'e': /* 'e'xpired, the password has */
349  acct_ctrl |= ACB_FR_EXPIRED;
350  break;
351 
352  case ' ': /* ignore spaces */
353  break;
354 
355  case ':':
356  case '\n':
357  case '\0':
358  case ']':
359  default:
360  done = 1;
361  break;
362  }
363  }
364 
365  return acct_ctrl;
366 }
367 
368 static xlat_arg_parser_t const mschap_xlat_args[] = {
369  { .required = true, .single = true, .type = FR_TYPE_STRING },
370  { .concat = true, .type = FR_TYPE_STRING },
371  XLAT_ARG_PARSER_TERMINATOR
372 };
373 
374 /** Get data from MSCHAP attributes
375  *
376  * Pulls NT-Response, LM-Response, or Challenge from MSCHAP
377  * attributes.
378  *
379  * @ingroup xlat_functions
380  */
381 static xlat_action_t mschap_xlat(TALLOC_CTX *ctx, fr_dcursor_t *out,
382  xlat_ctx_t const *xctx,
383  request_t *request, fr_value_box_list_t *in)
384 {
385  mschap_xlat_call_env_t *env_data = talloc_get_type_abort(xctx->env_data, mschap_xlat_call_env_t);
386  size_t data_len;
387  uint8_t const *data = NULL;
388  uint8_t buffer[32];
389  fr_pair_t *user_name;
390  fr_pair_t *chap_challenge, *response;
391  rlm_mschap_t const *inst = talloc_get_type_abort(xctx->mctx->mi->data, rlm_mschap_t);
392  fr_value_box_t *arg = fr_value_box_list_head(in);
393  fr_value_box_t *vb;
394  bool tainted = false;
395 
396  response = NULL;
397 
398  /*
399  * Challenge means MS-CHAPv1 challenge, or
400  * hash of MS-CHAPv2 challenge, and peer challenge.
401  */
402  if (strncasecmp(arg->vb_strvalue, "Challenge", 9) == 0) {
403  chap_challenge = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
404  tmpl_attr_tail_da(env_data->chap_challenge));
405  if (!chap_challenge) {
406  REDEBUG("No MS-CHAP-Challenge in the request");
407  return XLAT_ACTION_FAIL;
408  }
409  tainted = chap_challenge->vp_tainted;
410 
411  /*
412  * MS-CHAP-Challenges are 8 octets,
413  * for MS-CHAPv1
414  */
415  if (chap_challenge->vp_length == 8) {
416  RDEBUG2("mschap1: %02x", chap_challenge->vp_octets[0]);
417  data = chap_challenge->vp_octets;
418  data_len = 8;
419 
420  /*
421  * MS-CHAP-Challenges are 16 octets,
422  * for MS-CHAPv2.
423  */
424  } else if (chap_challenge->vp_length == 16) {
425  fr_pair_t *name_vp;
426  fr_pair_t *response_name;
427  char const *username_str;
428  size_t username_len;
429 
430  response = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
431  tmpl_attr_tail_da(env_data->chap2_response));
432  if (!response) {
433  REDEBUG("Vendor-Specific.Microsoft.CHAP2-Response is required to calculate MS-CHAPv1 challenge");
434  return XLAT_ACTION_FAIL;
435  }
436 
437  /*
438  * FIXME: Much of this is copied from
439  * below. We should put it into a
440  * separate function.
441  */
442 
443  /*
444  * Responses are 50 octets.
445  */
446  if (response->vp_length < 50) {
447  REDEBUG("Vendor-Specific.Microsoft.CHAP-Response has the wrong format");
448  return XLAT_ACTION_FAIL;
449  }
450 
451  user_name = mschap_identity_find(request, tmpl_attr_tail_da(env_data->username));
452  if (!user_name) return XLAT_ACTION_FAIL;
453 
454  /*
455  * Check for MS-CHAP-User-Name and if found, use it
456  * to construct the MSCHAPv1 challenge. This is
457  * set by rlm_eap_mschap to the MS-CHAP Response
458  * packet Name field.
459  *
460  * We prefer this to the User-Name in the
461  * packet.
462  */
463  response_name = fr_pair_find_by_da(&request->request_pairs, NULL, attr_ms_chap_user_name);
464  name_vp = response_name ? response_name : user_name;
465 
466  /*
467  * with_ntdomain_hack moved here, too.
468  */
469  username_str = memchr(name_vp->vp_strvalue, '\\', name_vp->vp_length);
470  if (username_str != NULL) {
471  if (inst->with_ntdomain_hack) {
472  username_str++;
473  } else {
474  RWDEBUG2("NT Domain delimiter found, should 'with_ntdomain_hack' be enabled?");
475  username_str = name_vp->vp_strvalue;
476  }
477  } else {
478  username_str = name_vp->vp_strvalue;
479  }
480  username_len = name_vp->vp_length - (username_str - name_vp->vp_strvalue);
481 
482  if (response_name &&
483  ((user_name->vp_length != response_name->vp_length) ||
484  (memcmp(user_name->vp_strvalue, response_name->vp_strvalue, user_name->vp_length) != 0))) {
485  RWDEBUG2("%pP is not the same as %pP from EAP-MSCHAPv2", user_name, response_name);
486  }
487 
488  /*
489  * Get the MS-CHAPv1 challenge
490  * from the MS-CHAPv2 peer challenge,
491  * our challenge, and the user name.
492  */
493  RDEBUG2("Creating challenge with username \"%pV\"",
494  fr_box_strvalue_len(username_str, username_len));
495  mschap_challenge_hash(buffer, response->vp_octets + 2, chap_challenge->vp_octets,
496  username_str, username_len);
497  data = buffer;
498  data_len = 8;
499  } else {
500  REDEBUG("Invalid MS-CHAP challenge length");
501  return XLAT_ACTION_FAIL;
502  }
503 
504  /*
505  * Get the MS-CHAPv1 response, or the MS-CHAPv2
506  * response.
507  */
508  } else if (strncasecmp(arg->vb_strvalue, "NT-Response", 11) == 0) {
509  response = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
510  tmpl_attr_tail_da(env_data->chap_response));
511  if (!response) response = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
512  tmpl_attr_tail_da(env_data->chap2_response));
513  if (!response) {
514  REDEBUG("No MS-CHAP-Response or MS-CHAP2-Response was found in the request");
515  return XLAT_ACTION_FAIL;
516  }
517  tainted = response->vp_tainted;
518 
519  /*
520  * For MS-CHAPv1, the NT-Response exists only
521  * if the second octet says so.
522  */
523  if ((response->da == tmpl_attr_tail_da(env_data->chap_response)) && ((response->vp_octets[1] & 0x01) == 0)) {
524  REDEBUG("No NT-Response in MS-CHAP-Response");
525  return XLAT_ACTION_FAIL;
526  }
527 
528  if (response->vp_length < 50) {
529  REDEBUG("Vendor-Specific.Microsoft.CHAP-Response has the wrong format");
530  return XLAT_ACTION_FAIL;
531  }
532 
533  /*
534  * MS-CHAP-Response and MS-CHAP2-Response have
535  * the NT-Response at the same offset, and are
536  * the same length.
537  */
538  data = response->vp_octets + 26;
539  data_len = 24;
540 
541  /*
542  * LM-Response is deprecated, and exists only
543  * in MS-CHAPv1, and not often there.
544  */
545  } else if (strncasecmp(arg->vb_strvalue, "LM-Response", 11) == 0) {
546  response = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
547  tmpl_attr_tail_da(env_data->chap_response));
548  if (!response) {
549  REDEBUG("No MS-CHAP-Response was found in the request");
550  return XLAT_ACTION_FAIL;
551  }
552  tainted = response->vp_tainted;
553 
554  if (response->vp_length < 50) {
555  REDEBUG("Vendor-Specific.Microsoft.CHAP-Response has the wrong format");
556  return XLAT_ACTION_FAIL;
557  }
558  /*
559  * For MS-CHAPv1, the LM-Response exists only
560  * if the second octet says so.
561  */
562  if ((response->vp_octets[1] & 0x01) != 0) {
563  REDEBUG("No LM-Response in MS-CHAP-Response");
564  return XLAT_ACTION_FAIL;
565  }
566  data = response->vp_octets + 2;
567  data_len = 24;
568 
569  /*
570  * Pull the domain name out of the User-Name, if it exists.
571  *
572  * This is the full domain name, not just the name after host/
573  */
574  } else if (strncasecmp(arg->vb_strvalue, "Domain-Name", 11) == 0) {
575  char *p;
576 
577  MEM(vb = fr_value_box_alloc_null(ctx));
578 
579  user_name = mschap_identity_find(request, tmpl_attr_tail_da(env_data->username));
580  if (!user_name) return XLAT_ACTION_FAIL;
581 
582  /*
583  * First check to see if this is a host/ style User-Name
584  * (a la Kerberos host principal)
585  */
586  if (strncmp(user_name->vp_strvalue, "host/", 5) == 0) {
587  /*
588  * If we're getting a User-Name formatted in this way,
589  * it's likely due to PEAP. The Windows Domain will be
590  * the first domain component following the hostname,
591  * or the machine name itself if only a hostname is supplied
592  */
593  p = strchr(user_name->vp_strvalue, '.');
594  if (!p) {
595  RDEBUG2("setting Domain-Name to same as machine name");
596  fr_value_box_strdup(ctx, vb, NULL, user_name->vp_strvalue + 5, user_name->vp_tainted);
597  } else {
598  p++; /* skip the period */
599 
600  fr_value_box_strdup(ctx, vb, NULL, p, user_name->vp_tainted);
601  }
602  } else {
603  p = strchr(user_name->vp_strvalue, '\\');
604  if (!p) {
605  REDEBUG("No domain name was found in the User-Name");
606  talloc_free(vb);
607  return XLAT_ACTION_FAIL;
608  }
609 
610  /*
611  * Hack. This is simpler than the alternatives.
612  */
613  *p = '\0';
614  fr_value_box_strdup(ctx, vb, NULL, user_name->vp_strvalue, user_name->vp_tainted);
615  *p = '\\';
616  }
617 
618  fr_dcursor_append(out, vb);
619  return XLAT_ACTION_DONE;
620 
621  /*
622  * Pull the NT-Domain out of the User-Name, if it exists.
623  */
624  } else if (strncasecmp(arg->vb_strvalue, "NT-Domain", 9) == 0) {
625  char *p, *q;
626 
627  MEM(vb = fr_value_box_alloc_null(ctx));
628 
629  user_name = mschap_identity_find(request, tmpl_attr_tail_da(env_data->username));
630  if (!user_name) return XLAT_ACTION_FAIL;
631 
632  /*
633  * First check to see if this is a host/ style User-Name
634  * (a la Kerberos host principal)
635  */
636  if (strncmp(user_name->vp_strvalue, "host/", 5) == 0) {
637  /*
638  * If we're getting a User-Name formatted in this way,
639  * it's likely due to PEAP. The Windows Domain will be
640  * the first domain component following the hostname,
641  * or the machine name itself if only a hostname is supplied
642  */
643  p = strchr(user_name->vp_strvalue, '.');
644  if (!p) {
645  RDEBUG2("setting NT-Domain to same as machine name");
646  fr_value_box_strdup(ctx, vb, NULL, user_name->vp_strvalue + 5, user_name->vp_tainted);
647  } else {
648  p++; /* skip the period */
649  q = strchr(p, '.');
650  /*
651  * use the same hack as below
652  * only if another period was found
653  */
654  if (q) *q = '\0';
655  fr_value_box_strdup(ctx, vb, NULL, p, user_name->vp_tainted);
656  if (q) *q = '.';
657  }
658  } else {
659  p = strchr(user_name->vp_strvalue, '\\');
660  if (!p) {
661  REDEBUG("No NT-Domain was found in the User-Name");
662  talloc_free(vb);
663  return XLAT_ACTION_FAIL;
664  }
665 
666  /*
667  * Hack. This is simpler than the alternatives.
668  */
669  *p = '\0';
670  fr_value_box_strdup(ctx, vb, NULL, user_name->vp_strvalue, user_name->vp_tainted);
671  *p = '\\';
672  }
673 
674  fr_dcursor_append(out, vb);
675  return XLAT_ACTION_DONE;
676 
677  /*
678  * Pull the User-Name out of the User-Name...
679  */
680  } else if (strncasecmp(arg->vb_strvalue, "User-Name", 9) == 0) {
681  char const *p, *q;
682 
683  user_name = mschap_identity_find(request, tmpl_attr_tail_da(env_data->username));
684  if (!user_name) return XLAT_ACTION_FAIL;
685 
686  MEM(vb = fr_value_box_alloc_null(ctx));
687 
688  /*
689  * First check to see if this is a host/ style User-Name
690  * (a la Kerberos host principal)
691  */
692  if (strncmp(user_name->vp_strvalue, "host/", 5) == 0) {
693  p = user_name->vp_strvalue + 5;
694  /*
695  * If we're getting a User-Name formatted in this way,
696  * it's likely due to PEAP. When authenticating this against
697  * a Domain, Windows will expect the User-Name to be in the
698  * format of hostname$, the SAM version of the name, so we
699  * have to convert it to that here. We do so by stripping
700  * off the first 5 characters (host/), and copying everything
701  * from that point to the first period into a string and appending
702  * a $ to the end.
703  */
704  q = strchr(p, '.');
705 
706  /*
707  * use the same hack as above
708  * only if a period was found
709  */
710  if (q) {
711  fr_value_box_asprintf(ctx, vb, NULL, true, "%.*s$", (int) (q - p), p);
712  } else {
713  fr_value_box_asprintf(ctx, vb, NULL, true, "%s$", p);
714  }
715  } else {
716  p = strchr(user_name->vp_strvalue, '\\');
717  if (p) {
718  p++; /* skip the backslash */
719  } else {
720  p = user_name->vp_strvalue; /* use the whole User-Name */
721  }
722  fr_value_box_strdup(ctx, vb, NULL, p, user_name->vp_tainted);
723  }
724 
725  fr_dcursor_append(out, vb);
726  return XLAT_ACTION_DONE;
727 
728  /*
729  * Return the NT-Hash of the passed string
730  */
731  } else if (strncasecmp(arg->vb_strvalue, "NT-Hash", 7) == 0) {
732  arg = fr_value_box_list_next(in, arg);
733  if ((!arg) || (arg->vb_length == 0))
734  return XLAT_ACTION_FAIL;
735 
736  if (mschap_nt_password_hash(buffer, arg->vb_strvalue) < 0) {
737  REDEBUG("Failed generating Password.NT");
738  *buffer = '\0';
739  return XLAT_ACTION_FAIL;
740  }
741 
742  MEM(vb = fr_value_box_alloc_null(ctx));
743  fr_value_box_memdup(ctx, vb, NULL, buffer, NT_DIGEST_LENGTH, false);
744  RDEBUG2("NT-Hash of \"known-good\" password: %pV", vb);
745  fr_dcursor_append(out, vb);
746  return XLAT_ACTION_DONE;
747 
748  /*
749  * Return the LM-Hash of the passed string
750  */
751  } else if (strncasecmp(arg->vb_strvalue, "LM-Hash", 7) == 0) {
752  arg = fr_value_box_list_next(in, arg);
753  if ((!arg) || (arg->vb_length == 0))
754  return XLAT_ACTION_FAIL;
755 
756  smbdes_lmpwdhash(arg->vb_strvalue, buffer);
757 
758  MEM(vb = fr_value_box_alloc_null(ctx));
759  fr_value_box_memdup(ctx, vb, NULL, buffer, LM_DIGEST_LENGTH, false);
760  RDEBUG2("LM-Hash of %s = %pV", arg->vb_strvalue, vb);
761  fr_dcursor_append(out, vb);
762  return XLAT_ACTION_DONE;
763  } else {
764  REDEBUG("Unknown expansion string '%pV'", arg);
765  return XLAT_ACTION_FAIL;
766  }
767 
768  /*
769  * Didn't set anything: this is bad.
770  */
771  if (!data) {
772  RWDEBUG2("Failed to do anything intelligent");
773  return XLAT_ACTION_FAIL;
774  }
775 
776  MEM(vb = fr_value_box_alloc_null(ctx));
777  fr_value_box_memdup(ctx, vb, NULL, data, data_len, tainted);
778 
779  fr_dcursor_append(out, vb);
780  return XLAT_ACTION_DONE;
781 }
782 
783 
784 #ifdef WITH_AUTH_WINBIND
785 /*
786  * Free connection pool winbind context
787  */
788 static int _mod_conn_free(struct wbcContext **wb_ctx)
789 {
790  wbcCtxFree(*wb_ctx);
791 
792  return 0;
793 }
794 
795 /*
796  * Create connection pool winbind context
797  */
798 static void *mod_conn_create(TALLOC_CTX *ctx, UNUSED void *instance, UNUSED fr_time_delta_t timeout)
799 {
800  /* Needed by ERROR() */
801  module_inst_ctx_t *mctx = MODULE_INST_CTX(talloc_get_type_abort(instance, module_instance_t));
802  struct wbcContext **wb_ctx;
803 
804  wb_ctx = talloc_zero(ctx, struct wbcContext *);
805  *wb_ctx = wbcCtxCreate();
806 
807  if (*wb_ctx == NULL) {
808  ERROR("failed to create winbind context");
809  talloc_free(wb_ctx);
810  return NULL;
811  }
812 
813  talloc_set_destructor(wb_ctx, _mod_conn_free);
814 
815  return *wb_ctx;
816 }
817 #endif
818 
819 /*
820  * Add MPPE attributes to the reply.
821  */
822 static void mppe_add_reply(UNUSED rlm_mschap_t const *inst,
823  request_t *request, fr_dict_attr_t const *da, uint8_t const *value, size_t len)
824 {
825  fr_pair_t *vp;
826 
827  MEM(pair_update_reply(&vp, da) >= 0);
828  fr_pair_value_memdup(vp, value, len, false);
829  RINDENT();
830  RDEBUG2("&reply.%pP", vp);
831  REXDENT();
832 }
833 
834 /*
835  * Write a string to an fd, followed by "\n"
836  */
837 static int write_all(int fd, char const *buf, size_t len) {
838  ssize_t rv;
839  size_t done=0;
840 
841  while (done < len) {
842  rv = write(fd, buf+done, len-done);
843  if (rv <= 0)
844  break;
845  done += rv;
846  }
847  rv = write(fd, "\n", 1);
848  if (rv <= 0) return -1;
849  return 0;
850 }
851 
852 /*
853  * Perform an MS-CHAP2 password change
854  */
855 
856 static int CC_HINT(nonnull) do_mschap_cpw(rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx,
857  uint8_t *new_nt_password, uint8_t *old_nt_hash)
858 {
859  mschap_cpw_ctx_t *cpw_ctx = auth_ctx->cpw_ctx;
860  fr_value_box_t *vb;
861 
862  if (inst->ntlm_cpw && auth_ctx->method != AUTH_INTERNAL) {
863  /*
864  * we're going to run ntlm_auth in helper-mode
865  * we're expecting to use the ntlm-change-password-1 protocol
866  * which needs the following on stdin:
867  *
868  * username: %mschap(User-Name)
869  * nt-domain: %mschap(NT-Domain)
870  * new-nt-password-blob: bin2hex(new_nt_password) - 1032 bytes encoded
871  * old-nt-hash-blob: bin2hex(old_nt_hash) - 32 bytes encoded
872  * new-lm-password-blob: 00000...0000 - 1032 bytes null
873  * old-lm-hash-blob: 000....000 - 32 bytes null
874  * .\n
875  *
876  * ...and it should then print out
877  *
878  * Password-Change: Yes
879  *
880  * or
881  *
882  * Password-Change: No
883  * Password-Change-Error: blah
884  */
885 
886  size_t size;
887  int status, len, to_child=-1, from_child=-1;
888  pid_t pid, child_pid;
889  char buf[2048];
890  char *pmsg;
891  char const *emsg;
892 
893  RDEBUG2("Doing MS-CHAPv2 password change via ntlm_auth helper");
894 
895  /*
896  * Start up ntlm_auth with a pipe on stdin and stdout
897  */
898 
899  pid = radius_start_program_legacy(&to_child, &from_child, NULL, inst->ntlm_cpw, request, true, NULL, false);
900  if (pid < 0) {
901  REDEBUG("could not exec ntlm_auth cpw command");
902  return -1;
903  }
904 
905  /*
906  * write the stuff to the client
907  */
908 
909  vb = fr_value_box_list_head(&cpw_ctx->cpw_user);
910  if (!vb) goto ntlm_auth_err;
911 
912  if (write_all(to_child, vb->vb_strvalue, vb->vb_length) < 0) {
913  REDEBUG("Failed to write username to child");
914  goto ntlm_auth_err;
915  }
916 
917  if (auth_ctx->env_data->ntlm_cpw_domain) {
918  vb = fr_value_box_list_head(&cpw_ctx->cpw_domain);
919  if (!vb) goto no_domain;
920 
921  if (write_all(to_child, vb->vb_strvalue, vb->vb_length) < 0) {
922  REDEBUG("Failed to write domain to child");
923  goto ntlm_auth_err;
924  }
925  } else {
926  no_domain:
927  RWDEBUG2("No ntlm_auth domain set, username must be full-username to work");
928  }
929 
930  /* now the password blobs */
931  size = snprintf(buf, sizeof(buf), "new-nt-password-blob: ");
932  fr_base16_encode(&FR_SBUFF_OUT(buf + size, sizeof(buf) - size), &FR_DBUFF_TMP(new_nt_password, 516));
933  size = strlen(buf);
934  if (write_all(to_child, buf, size) < 0) {
935  RDEBUG2("failed to write new password blob to child");
936  goto ntlm_auth_err;
937  }
938 
939  size = snprintf(buf, sizeof(buf), "old-nt-hash-blob: ");
940  fr_base16_encode(&FR_SBUFF_OUT(buf + size, sizeof(buf) - size), &FR_DBUFF_TMP(old_nt_hash, NT_DIGEST_LENGTH));
941  size = strlen(buf);
942  if (write_all(to_child, buf, size) < 0) {
943  REDEBUG("Failed to write old hash blob to child");
944  goto ntlm_auth_err;
945  }
946 
947  /*
948  * In current samba versions, failure to supply empty LM password/hash
949  * blobs causes the change to fail.
950  */
951  size = snprintf(buf, sizeof(buf), "new-lm-password-blob: %01032i", 0);
952  if (write_all(to_child, buf, size) < 0) {
953  REDEBUG("Failed to write dummy LM password to child");
954  goto ntlm_auth_err;
955  }
956  size = snprintf(buf, sizeof(buf), "old-lm-hash-blob: %032i", 0);
957  if (write_all(to_child, buf, size) < 0) {
958  REDEBUG("Failed to write dummy LM hash to child");
959  goto ntlm_auth_err;
960  }
961  if (write_all(to_child, ".", 1) < 0) {
962  REDEBUG("Failed to send finish to child");
963  goto ntlm_auth_err;
964  }
965  close(to_child);
966  to_child = -1;
967 
968  /*
969  * Read from the child
970  */
971  len = radius_readfrom_program_legacy(from_child, pid, fr_time_delta_from_sec(10), buf, sizeof(buf));
972  if (len < 0) {
973  /* radius_readfrom_program_legacy will have closed from_child for us */
974  REDEBUG("Failure reading from child");
975  return -1;
976  }
977  close(from_child);
978  from_child = -1;
979 
980  buf[len] = 0;
981  RDEBUG2("ntlm_auth said: %s", buf);
982 
983  child_pid = waitpid(pid, &status, 0);
984  if (child_pid == 0) {
985  REDEBUG("Timeout waiting for child");
986  return -1;
987  }
988  if (child_pid != pid) {
989  REDEBUG("Abnormal exit status: %s", fr_syserror(errno));
990  return -1;
991  }
992 
993  if (strstr(buf, "Password-Change: Yes")) {
994  RDEBUG2("ntlm_auth password change succeeded");
995  return 0;
996  }
997 
998  pmsg = strstr(buf, "Password-Change-Error: ");
999  if (pmsg) {
1000  emsg = strsep(&pmsg, "\n");
1001  } else {
1002  emsg = "could not find error";
1003  }
1004  REDEBUG("ntlm auth password change failed: %s", emsg);
1005 
1006 ntlm_auth_err:
1007  /* safe because these either need closing or are == -1 */
1008  close(to_child);
1009  close(from_child);
1010 
1011  return -1;
1012 
1013  /*
1014  * Decrypt the new password blob, add it as a temporary request
1015  * variable, xlat the local_cpw string, then remove it
1016  *
1017  * this allows is to write e..g
1018  *
1019  * %sql(insert into ...)
1020  *
1021  * ...or...
1022  *
1023  * %exec('/path/to', %mschap(User-Name), %{MS-CHAP-New-Cleartext-Password})"
1024  *
1025  */
1026 #ifdef WITH_TLS
1027  } else if (auth_ctx->env_data->local_cpw) {
1028  RDEBUG2("Doing MS-CHAPv2 password change locally");
1029 
1030  vb = fr_value_box_list_head(&cpw_ctx->local_cpw_result);
1031 
1032  if (!vb){
1033  return -1;
1034  } else if (vb->vb_length == 0) {
1035  REDEBUG("Local MS-CHAPv2 password change - didn't give any result, assuming failure");
1036  return -1;
1037  }
1038 
1039  RDEBUG2("MS-CHAPv2 password change succeeded: %pV", vb);
1040 
1041  /*
1042  * Update the Password.NT attribute with the new hash this lets us
1043  * fall through to the authentication code using the new hash,
1044  * not the old one.
1045  */
1046  fr_pair_value_memdup(auth_ctx->nt_password, auth_ctx->cpw_ctx->new_hash->vp_octets,
1047  auth_ctx->cpw_ctx->new_hash->vp_length, false);
1048 
1049  /*
1050  * Rock on! password change succeeded.
1051  */
1052  return 0;
1053 #endif
1054  } else {
1055  REDEBUG("MS-CHAPv2 password change not configured");
1056  }
1057 
1058  return -1;
1059 }
1060 
1061 /*
1062  * Do the MS-CHAP stuff.
1063  *
1064  * This function is here so that all of the MS-CHAP related
1065  * authentication is in one place, and we can perhaps later replace
1066  * it with code to call winbindd, or something similar.
1067  */
1068 static int CC_HINT(nonnull (1, 2, 4, 5, 6)) do_mschap(rlm_mschap_t const *inst,
1069  request_t *request,
1070  fr_pair_t *password,
1071  uint8_t const *challenge,
1072  uint8_t const *response,
1073  uint8_t nthashhash[static NT_DIGEST_LENGTH],
1074  MSCHAP_AUTH_METHOD method,
1075 #ifdef WITH_AUTH_WINBIND
1076  mschap_auth_call_env_t *env_data)
1077 #else
1078  UNUSED mschap_auth_call_env_t *env_data)
1079 #endif
1080 {
1081  uint8_t calculated[24];
1082 
1083  memset(nthashhash, 0, NT_DIGEST_LENGTH);
1084 
1085  switch (method) {
1086  case AUTH_INTERNAL:
1087  case AUTH_AUTO:
1088  /*
1089  * Do normal authentication.
1090  */
1091  {
1092  /*
1093  * No password: can't do authentication.
1094  */
1095  if (!password) {
1096  if (method == AUTH_AUTO) goto do_ntlm;
1097 
1098  REDEBUG("FAILED: No Password.NT/LM. Cannot perform authentication");
1099  return -1;
1100  }
1101 
1102  smbdes_mschap(password->vp_octets, challenge, calculated);
1103  if (fr_digest_cmp(response, calculated, 24) != 0) {
1104  return -1;
1105  }
1106 
1107  /*
1108  * If the password exists, and is an NT-Password,
1109  * then calculate the hash of the NT hash. Doing this
1110  * here minimizes work for later.
1111  */
1112  if (password->da == attr_nt_password) fr_md4_calc(nthashhash, password->vp_octets, MD4_DIGEST_LENGTH);
1113  break;
1114  }
1115  case AUTH_NTLMAUTH_EXEC:
1116  do_ntlm:
1117  /*
1118  * Run ntlm_auth
1119  */
1120  {
1121  int result;
1122  char buffer[256];
1123  size_t len;
1124 
1125  /*
1126  * Run the program, and expect that we get 16
1127  */
1128  result = radius_exec_program_legacy(buffer, sizeof(buffer), request, inst->ntlm_auth, NULL,
1129  true, true, inst->ntlm_auth_timeout);
1130  if (result != 0) {
1131  char *p;
1132 
1133  /*
1134  * Do checks for numbers, which are
1135  * language neutral. They're also
1136  * faster.
1137  */
1138  p = strcasestr(buffer, "0xC0000");
1139  if (p) {
1140  result = 0;
1141 
1142  p += 7;
1143  if (strcmp(p, "224") == 0) {
1144  result = -648;
1145 
1146  } else if (strcmp(p, "234") == 0) {
1147  result = -647;
1148 
1149  } else if (strcmp(p, "072") == 0) {
1150  result = -691;
1151 
1152  } else if (strcasecmp(p, "05E") == 0) {
1153  result = -2;
1154  }
1155 
1156  if (result != 0) {
1157  REDEBUG2("%s", buffer);
1158  return result;
1159  }
1160 
1161  /*
1162  * Else fall through to more ridiculous checks.
1163  */
1164  }
1165 
1166  /*
1167  * Look for variants of expire password.
1168  */
1169  if (strcasestr(buffer, "0xC0000224") ||
1170  strcasestr(buffer, "Password expired") ||
1171  strcasestr(buffer, "Password has expired") ||
1172  strcasestr(buffer, "Password must be changed") ||
1173  strcasestr(buffer, "Must change password")) {
1174  return -648;
1175  }
1176 
1177  if (strcasestr(buffer, "0xC0000234") ||
1178  strcasestr(buffer, "Account locked out")) {
1179  REDEBUG2("%s", buffer);
1180  return -647;
1181  }
1182 
1183  if (strcasestr(buffer, "0xC0000072") ||
1184  strcasestr(buffer, "Account disabled")) {
1185  REDEBUG2("%s", buffer);
1186  return -691;
1187  }
1188 
1189  if (strcasestr(buffer, "0xC000005E") ||
1190  strcasestr(buffer, "No logon servers")) {
1191  REDEBUG2("%s", buffer);
1192  return -2;
1193  }
1194 
1195  if (strcasestr(buffer, "could not obtain winbind separator") ||
1196  strcasestr(buffer, "Reading winbind reply failed")) {
1197  REDEBUG2("%s", buffer);
1198  return -2;
1199  }
1200 
1201  RDEBUG2("External script failed");
1202  p = strchr(buffer, '\n');
1203  if (p) *p = '\0';
1204 
1205  REDEBUG("External script says: %s", buffer);
1206  return -1;
1207  }
1208 
1209  /*
1210  * Parse the answer as an nthashhash.
1211  *
1212  * ntlm_auth currently returns:
1213  * NT_KEY: 000102030405060708090a0b0c0d0e0f
1214  */
1215  if (memcmp(buffer, "NT_KEY: ", 8) != 0) {
1216  REDEBUG("Invalid output from ntlm_auth: expecting 'NT_KEY: ' prefix");
1217  return -1;
1218  }
1219 
1220  /*
1221  * Check the length. It should be at least 32, with an LF at the end.
1222  */
1223  len = strlen(buffer + 8);
1224  if (len < 32) {
1225  REDEBUG2("Invalid output from ntlm_auth: NT_KEY too short, expected 32 bytes got %zu bytes",
1226  len);
1227 
1228  return -1;
1229  }
1230 
1231  /*
1232  * Update the NT hash hash, from the NT key.
1233  */
1234  if (fr_base16_decode(NULL, &FR_DBUFF_TMP(nthashhash, NT_DIGEST_LENGTH),
1235  &FR_SBUFF_IN(buffer + 8, len), false) != NT_DIGEST_LENGTH) {
1236  REDEBUG("Invalid output from ntlm_auth: NT_KEY has non-hex values");
1237  return -1;
1238  }
1239 
1240  break;
1241  }
1242 #ifdef WITH_AUTH_WINBIND
1243  case AUTH_WBCLIENT:
1244  /*
1245  * Process auth via the wbclient library
1246  */
1247  return do_auth_wbclient(inst, request, challenge, response, nthashhash, env_data);
1248 #endif
1249  default:
1250  /* We should never reach this line */
1251  RERROR("Internal error: Unknown mschap auth method (%d)", method);
1252  return -1;
1253  }
1254 
1255  return 0;
1256 }
1257 
1258 
1259 /*
1260  * Data for the hashes.
1261  */
1262 static const uint8_t SHSpad1[40] =
1263  { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1264  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1265  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1266  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
1267 
1268 static const uint8_t SHSpad2[40] =
1269  { 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
1270  0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
1271  0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2,
1272  0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2, 0xf2 };
1273 
1274 static const uint8_t magic1[27] =
1275  { 0x54, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74,
1276  0x68, 0x65, 0x20, 0x4d, 0x50, 0x50, 0x45, 0x20, 0x4d,
1277  0x61, 0x73, 0x74, 0x65, 0x72, 0x20, 0x4b, 0x65, 0x79 };
1278 
1279 static const uint8_t magic2[84] =
1280  { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69,
1281  0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20,
1282  0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
1283  0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, 0x6b, 0x65, 0x79,
1284  0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x73,
1285  0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, 0x69, 0x64, 0x65,
1286  0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
1287  0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20,
1288  0x6b, 0x65, 0x79, 0x2e };
1289 
1290 static const uint8_t magic3[84] =
1291  { 0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69,
1292  0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20,
1293  0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
1294  0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20,
1295  0x6b, 0x65, 0x79, 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68,
1296  0x65, 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73,
1297  0x69, 0x64, 0x65, 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73,
1298  0x20, 0x74, 0x68, 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20,
1299  0x6b, 0x65, 0x79, 0x2e };
1300 
1301 
1302 static void mppe_GetMasterKey(uint8_t const *nt_hashhash, uint8_t const *nt_response,
1303  uint8_t *masterkey)
1304 {
1305  uint8_t digest[20];
1306  fr_sha1_ctx Context;
1307 
1308  fr_sha1_init(&Context);
1309  fr_sha1_update(&Context, nt_hashhash, NT_DIGEST_LENGTH);
1310  fr_sha1_update(&Context, nt_response, 24);
1311  fr_sha1_update(&Context, magic1, 27);
1312  fr_sha1_final(digest, &Context);
1313 
1314  memcpy(masterkey, digest, 16); //-V512
1315 }
1316 
1317 
1318 static void mppe_GetAsymmetricStartKey(uint8_t *masterkey, uint8_t *sesskey,
1319  int keylen, int issend)
1320 {
1321  uint8_t digest[20];
1322  const uint8_t *s;
1323  fr_sha1_ctx Context;
1324 
1325  memset(digest, 0, 20);
1326 
1327  if(issend) {
1328  s = magic3;
1329  } else {
1330  s = magic2;
1331  }
1332 
1333  fr_sha1_init(&Context);
1334  fr_sha1_update(&Context, masterkey, 16);
1335  fr_sha1_update(&Context, SHSpad1, 40);
1336  fr_sha1_update(&Context, s, 84);
1337  fr_sha1_update(&Context, SHSpad2, 40);
1338  fr_sha1_final(digest, &Context);
1339 
1340  memcpy(sesskey, digest, keylen);
1341 }
1342 
1343 
1344 static void mppe_chap2_get_keys128(uint8_t const *nt_hashhash, uint8_t const *nt_response,
1345  uint8_t *sendkey, uint8_t *recvkey)
1346 {
1347  uint8_t masterkey[16];
1348 
1349  mppe_GetMasterKey(nt_hashhash, nt_response, masterkey);
1350 
1351  mppe_GetAsymmetricStartKey(masterkey, sendkey, 16, 1);
1352  mppe_GetAsymmetricStartKey(masterkey, recvkey, 16, 0);
1353 }
1354 
1355 /*
1356  * Generate MPPE keys.
1357  */
1358 static void mppe_chap2_gen_keys128(uint8_t const *nt_hashhash, uint8_t const *response,
1359  uint8_t *sendkey, uint8_t *recvkey)
1360 {
1361  uint8_t enckey1[16];
1362  uint8_t enckey2[16];
1363 
1364  mppe_chap2_get_keys128(nt_hashhash, response, enckey1, enckey2);
1365 
1366  /*
1367  * dictionary.microsoft defines these attributes as
1368  * 'encrypt=Tunnel-Password'. The functions in src/lib/radius.c will
1369  * take care of encrypting/decrypting them as appropriate,
1370  * so that we don't have to.
1371  */
1372  memcpy (sendkey, enckey1, 16);
1373  memcpy (recvkey, enckey2, 16);
1374 }
1375 
1376 
1377 /*
1378  * mod_authorize() - authorize user if we can authenticate
1379  * it later. Add Auth-Type attribute if present in module
1380  * configuration (usually Auth-Type must be "MS-CHAP")
1381  */
1382 static unlang_action_t CC_HINT(nonnull) mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
1383 {
1384  rlm_mschap_t const *inst = talloc_get_type_abort_const(mctx->mi->data, rlm_mschap_t);
1385  mschap_autz_call_env_t *env_data = talloc_get_type_abort(mctx->env_data, mschap_autz_call_env_t);
1386  fr_pair_t *challenge = NULL;
1387  fr_pair_t *parent;
1388 
1389  challenge = fr_pair_find_by_da_nested(&request->request_pairs, NULL, tmpl_attr_tail_da(env_data->chap_challenge));
1390  if (!challenge) RETURN_MODULE_NOOP;
1391 
1392  /*
1393  * The responses MUST be in the same group as the challenge.
1394  */
1395  parent = fr_pair_parent(challenge);
1396  fr_assert(parent != NULL);
1397 
1398  if (!fr_pair_find_by_da(&parent->vp_group, NULL, tmpl_attr_tail_da(env_data->chap_response)) &&
1399  !fr_pair_find_by_da(&parent->vp_group, NULL, tmpl_attr_tail_da(env_data->chap2_response)) &&
1400  (env_data->chap2_cpw &&
1401  !fr_pair_find_by_da(&parent->vp_group, NULL, tmpl_attr_tail_da(env_data->chap2_cpw)))) {
1402  RDEBUG2("Found MS-CHAP-Challenge, but no MS-CHAP response or Change-Password");
1403  RETURN_MODULE_NOOP;
1404  }
1405 
1406  if (!inst->auth_type) {
1407  WARN("No 'authenticate %s {...}' section or 'Auth-Type = %s' set. Cannot setup MS-CHAP authentication",
1408  mctx->mi->name, mctx->mi->name);
1409  RETURN_MODULE_NOOP;
1410  }
1411 
1412  if (!module_rlm_section_type_set(request, attr_auth_type, inst->auth_type)) RETURN_MODULE_NOOP;
1413 
1414  RETURN_MODULE_OK;
1415 }
1416 
1417 static unlang_action_t mschap_error(rlm_rcode_t *p_result, rlm_mschap_t const *inst, request_t *request,
1418  unsigned char ident, int mschap_result, int mschap_version, fr_pair_t *smb_ctrl,
1419  mschap_auth_call_env_t *env_data)
1420 {
1421  rlm_rcode_t rcode = RLM_MODULE_OK;
1422  int error = 0;
1423  int retry = 0;
1424  char const *message = NULL;
1425 
1426  int i;
1427  char new_challenge[33], buffer[128];
1428  char *p;
1429 
1430  if ((mschap_result == -648) ||
1431  ((mschap_result == 0) &&
1432  (smb_ctrl && ((smb_ctrl->vp_uint32 & ACB_FR_EXPIRED) != 0)))) {
1433  REDEBUG("Password has expired. User should retry authentication");
1434  error = 648;
1435 
1436  /*
1437  * A password change is NOT a retry! We MUST have retry=0 here.
1438  */
1439  retry = 0;
1440  message = "Password expired";
1441  rcode = RLM_MODULE_REJECT;
1442 
1443  /*
1444  * Account is disabled.
1445  *
1446  * They're found, but they don't exist, so we
1447  * return 'not found'.
1448  */
1449  } else if ((mschap_result == -691) ||
1450  (smb_ctrl && (((smb_ctrl->vp_uint32 & ACB_DISABLED) != 0) ||
1451  ((smb_ctrl->vp_uint32 & (ACB_NORMAL|ACB_WSTRUST)) == 0)))) {
1452  REDEBUG("SMB-Account-Ctrl (or ntlm_auth) "
1453  "says that the account is disabled, "
1454  "or is not a normal or workstation trust account");
1455  error = 691;
1456  retry = 0;
1457  message = "Account disabled";
1458  rcode = RLM_MODULE_NOTFOUND;
1459 
1460  /*
1461  * User is locked out.
1462  */
1463  } else if ((mschap_result == -647) ||
1464  (smb_ctrl && ((smb_ctrl->vp_uint32 & ACB_AUTOLOCK) != 0))) {
1465  REDEBUG("SMB-Account-Ctrl (or ntlm_auth) "
1466  "says that the account is locked out");
1467  error = 647;
1468  retry = 0;
1469  message = "Account locked out";
1470  rcode = RLM_MODULE_DISALLOW;
1471 
1472  } else if (mschap_result < 0) {
1473  REDEBUG("%s is incorrect", mschap_version == 1 ? env_data->chap_response->name : env_data->chap2_response->name);
1474  error = 691;
1475  retry = inst->allow_retry;
1476  message = "Authentication failed";
1477  rcode = RLM_MODULE_REJECT;
1478  }
1479 
1480  if (rcode == RLM_MODULE_OK) RETURN_MODULE_OK;
1481 
1482  switch (mschap_version) {
1483  case 1:
1484  for (p = new_challenge, i = 0; i < 2; i++) p += snprintf(p, 9, "%08x", fr_rand());
1485  snprintf(buffer, sizeof(buffer), "E=%i R=%i C=%s V=2",
1486  error, retry, new_challenge);
1487  break;
1488 
1489  case 2:
1490  for (p = new_challenge, i = 0; i < 4; i++) p += snprintf(p, 9, "%08x", fr_rand());
1491  snprintf(buffer, sizeof(buffer), "E=%i R=%i C=%s V=3 M=%s",
1492  error, retry, new_challenge, message);
1493  break;
1494 
1495  default:
1496  RETURN_MODULE_FAIL;
1497  }
1498  if (env_data->chap_error) mschap_add_reply(request, ident, tmpl_attr_tail_da(env_data->chap_error),
1499  buffer, strlen(buffer));
1500 
1501  RETURN_MODULE_RCODE(rcode);
1502 }
1503 
1504 
1505 /** Find a Password.NT value, or create one from a Password.Cleartext, or Password.With-Header attribute
1506  *
1507  * @param[in] ctx to allocate ephemeral passwords in.
1508  * @param[out] out Our new Password.NT.
1509  * @param[in] inst Module configuration.
1510  * @param[in] request The current request.
1511  * @return
1512  * - 0 on success.
1513  * - -1 on failure.
1514  */
1515 static int CC_HINT(nonnull(1, 2, 3)) nt_password_find(TALLOC_CTX *ctx, fr_pair_t **out,
1516  rlm_mschap_t const *inst, request_t *request)
1517 {
1518  fr_pair_t *password;
1519  fr_dict_attr_t const *allowed_passwords[] = { attr_cleartext_password, attr_nt_password };
1520  bool ephemeral;
1521 
1522  *out = NULL; /* Init output pointer */
1523 
1524  password = password_find(&ephemeral, ctx, request,
1525  allowed_passwords, NUM_ELEMENTS(allowed_passwords), inst->normify);
1526  if (!password) {
1527  if (inst->method == AUTH_INTERNAL) {
1528  /*
1529  * Search for passwords in the parent
1530  * FIXME: This is a hack and should be removed
1531  * When EAP-MSCHAPv2 supports sections.
1532  */
1533  if (request->parent) {
1534  password = password_find(&ephemeral, ctx, request->parent,
1535  allowed_passwords,
1536  NUM_ELEMENTS(allowed_passwords), inst->normify);
1537  if (password) goto found_password;
1538  }
1539 
1540  /*
1541  * If we're doing internal auth, then this is an issue
1542  */
1543  RWDEBUG2("No &control.%s or &control.%s found. Cannot create Password.NT",
1544  attr_cleartext_password->name, attr_nt_password->name);
1545  return -1;
1546 
1547  /*
1548  * ..if we're not, then we can call out to external sources.
1549  */
1550  } else {
1551  return 0;
1552  }
1553  }
1554 
1555 found_password:
1556  if (password->da == attr_cleartext_password) {
1557  uint8_t *p;
1558  int ret;
1559  fr_pair_t *nt_password;
1560 
1561  MEM(nt_password = fr_pair_afrom_da(ctx, attr_nt_password));
1562  MEM(fr_pair_value_mem_alloc(nt_password, &p, NT_DIGEST_LENGTH, false) == 0);
1563  ret = mschap_nt_password_hash(p, password->vp_strvalue);
1564 
1565  if (ret < 0) {
1566  RERROR("Failed generating Password.NT");
1567  talloc_free(nt_password);
1568  if (ephemeral) TALLOC_FREE(password);
1569  return -1;
1570  }
1571 
1572  if (RDEBUG_ENABLED3) {
1573  RDEBUG3("Hashed &control.%pP to create %s = %pV",
1574  password, attr_nt_password->name, fr_box_octets(p, NT_DIGEST_LENGTH));
1575  } else {
1576  RDEBUG2("Hashed &control.%s to create %s", attr_nt_password->name, password->da->name);
1577  }
1578 
1579  if (ephemeral) TALLOC_FREE(password);
1580 
1581  *out = nt_password;
1582 
1583  return 0;
1584  }
1585 
1586  fr_assert(password->da == attr_nt_password);
1587 
1588  if (RDEBUG_ENABLED3) {
1589  RDEBUG3("Found &control.%pP", password);
1590  } else {
1591  RDEBUG2("Found &control.%s", attr_nt_password->name);
1592  }
1593  *out = password;
1594 
1595  return 0;
1596 }
1597 
1598 /*
1599  * mschap_cpw_request_process() - do the work to handle an MS-CHAP password
1600  * change request.
1601  */
1602 static unlang_action_t CC_HINT(nonnull) mschap_process_cpw_request(rlm_rcode_t *p_result,
1603  rlm_mschap_t const *inst,
1604  request_t *request,
1605  mschap_auth_ctx_t *auth_ctx)
1606 {
1607  mschap_auth_call_env_t *env_data = auth_ctx->env_data;
1608  mschap_cpw_ctx_t *cpw_ctx = auth_ctx->cpw_ctx;
1609 
1610  /*
1611  * Perform the actual password change
1612  */
1613  if (do_mschap_cpw(inst, request, auth_ctx, cpw_ctx->new_nt_encrypted, cpw_ctx->old_nt_hash) < 0) {
1614  char buffer[128];
1615 
1616  REDEBUG("Password change failed");
1617 
1618  if (env_data->chap_error) {
1619  snprintf(buffer, sizeof(buffer), "E=709 R=0 M=Password change failed");
1620  mschap_add_reply(request, auth_ctx->cpw->vp_octets[1],
1621  tmpl_attr_tail_da(env_data->chap_error), buffer, strlen(buffer));
1622  }
1623 
1624  RETURN_MODULE_REJECT;
1625  }
1626 
1627  RDEBUG2("Password change successful");
1628 
1629  RETURN_MODULE_OK;
1630 }
1631 
1632 /** Validate data required for change password requests.
1633  *
1634  */
1635 static int mschap_cpw_prepare(request_t *request, mschap_auth_ctx_t *auth_ctx)
1636 {
1637  mschap_auth_call_env_t *env_data = auth_ctx->env_data;
1638  mschap_cpw_ctx_t *cpw_ctx;
1639  fr_pair_t *nt_enc = NULL;
1640  int seq, new_nt_enc_len;
1641 
1642  /*
1643  * mschap2 password change request.
1644  *
1645  * We cheat - first decode and execute the passchange.
1646  * Then extract the response, add it into the request
1647  * and then jump into mschap2 auth with the challenge/
1648  * response.
1649  */
1650  RDEBUG2("MS-CHAPv2 password change request received");
1651 
1652  if (auth_ctx->cpw->vp_length != 68) {
1653  REDEBUG("%s has the wrong format: length %zu != 68", env_data->chap2_cpw->name, auth_ctx->cpw->vp_length);
1654  return -1;
1655  }
1656 
1657  if (auth_ctx->cpw->vp_octets[0] != 7) {
1658  REDEBUG("%s has the wrong format: code %d != 7", env_data->chap2_cpw->name, auth_ctx->cpw->vp_octets[0]);
1659  return -1;
1660  }
1661 
1662  MEM(auth_ctx->cpw_ctx = talloc_zero(auth_ctx, mschap_cpw_ctx_t));
1663  cpw_ctx = auth_ctx->cpw_ctx;
1664 
1665  /*
1666  * Look for the new (encrypted) password.
1667  *
1668  * Bah, stupid composite attributes...
1669  * we're expecting 3 attributes with the leading bytes -
1670  * 06:<mschapid>:00:01:<1st chunk>
1671  * 06:<mschapid>:00:02:<2nd chunk>
1672  * 06:<mschapid>:00:03:<3rd chunk>
1673  */
1674  new_nt_enc_len = 0;
1675  for (seq = 1; seq < 4; seq++) {
1676  int found = 0;
1677 
1678  while ((nt_enc = fr_pair_find_by_da_nested(&request->request_pairs, nt_enc,
1679  tmpl_attr_tail_da(env_data->chap_nt_enc_pw)))) {
1680  if (nt_enc->vp_length < 4) {
1681  REDEBUG("%s with invalid format", env_data->chap_nt_enc_pw->name);
1682  return -1;
1683  }
1684 
1685  if (nt_enc->vp_octets[0] != 6) {
1686  REDEBUG("%s with invalid format", env_data->chap_nt_enc_pw->name);
1687  return -1;
1688  }
1689 
1690  if ((nt_enc->vp_octets[2] == 0) && (nt_enc->vp_octets[3] == seq)) {
1691  found = 1;
1692  break;
1693  }
1694  }
1695 
1696  if (!found) {
1697  REDEBUG("Could not find %s with sequence number %d", env_data->chap_nt_enc_pw->name, seq);
1698  return -1;
1699  }
1700 
1701  if ((new_nt_enc_len + nt_enc->vp_length - 4) > sizeof(cpw_ctx->new_nt_encrypted)) {
1702  REDEBUG("Unpacked %s length > 516", env_data->chap_nt_enc_pw->name);
1703  return -1;
1704  }
1705 
1706  memcpy(cpw_ctx->new_nt_encrypted + new_nt_enc_len, nt_enc->vp_octets + 4, nt_enc->vp_length - 4);
1707  new_nt_enc_len += nt_enc->vp_length - 4;
1708  }
1709 
1710  if (new_nt_enc_len != 516) {
1711  REDEBUG("Unpacked %s length is %d - should be 516", env_data->chap_nt_enc_pw->name, new_nt_enc_len);
1712  return -1;
1713  }
1714 
1715  /*
1716  * RFC 2548 is confusing here. It claims:
1717  *
1718  * 1 byte code
1719  * 1 byte ident
1720  * 16 octets - old hash encrypted with new hash
1721  * 24 octets - peer challenge
1722  * this is actually:
1723  * 16 octets - peer challenge
1724  * 8 octets - reserved
1725  * 24 octets - nt response
1726  * 2 octets - flags (ignored)
1727  */
1728 
1729  memcpy(cpw_ctx->old_nt_hash, auth_ctx->cpw->vp_octets + 2, sizeof(cpw_ctx->old_nt_hash));
1730 
1731  RDEBUG2("Password change payload valid");
1732  return 0;
1733 }
1734 
1735 static CC_HINT(nonnull(1,2,3,4,5,8,9)) unlang_action_t mschap_process_response(rlm_rcode_t *p_result,
1736  int *mschap_version,
1737  uint8_t nthashhash[static NT_DIGEST_LENGTH],
1738  rlm_mschap_t const *inst,
1739  request_t *request,
1740  fr_pair_t *smb_ctrl,
1741  fr_pair_t *nt_password,
1742  fr_pair_t *challenge,
1743  fr_pair_t *response,
1744  MSCHAP_AUTH_METHOD method,
1745  mschap_auth_call_env_t *env_data)
1746 {
1747  int offset;
1748  rlm_rcode_t mschap_result;
1749 
1750  *mschap_version = 1;
1751 
1752  RDEBUG2("Processing MS-CHAPv1 response");
1753 
1754  /*
1755  * MS-CHAPv1 challenges are 8 octets.
1756  */
1757  if (challenge->vp_length < 8) {
1758  REDEBUG("%s has the wrong format", env_data->chap_challenge->name);
1759  RETURN_MODULE_INVALID;
1760  }
1761 
1762  /*
1763  * Responses are 50 octets.
1764  */
1765  if (response->vp_length < 50) {
1766  REDEBUG("%s has the wrong format", env_data->chap_response->name);
1767  RETURN_MODULE_INVALID;
1768  }
1769 
1770  /*
1771  * We are doing MS-CHAP. Calculate the MS-CHAP
1772  * response
1773  */
1774  if (!(response->vp_octets[1] & 0x01)) {
1775  REDEBUG2("Client used unsupported method LM-Password");
1776  RETURN_MODULE_FAIL;
1777  }
1778 
1779  offset = 26;
1780 
1781  /*
1782  * Do the MS-CHAP authentication.
1783  */
1784  mschap_result = do_mschap(inst, request, nt_password, challenge->vp_octets,
1785  response->vp_octets + offset, nthashhash, method, env_data);
1786 
1787  /*
1788  * Check for errors, and add MSCHAP-Error if necessary.
1789  */
1790  return mschap_error(p_result, inst, request, *response->vp_octets, mschap_result, *mschap_version, smb_ctrl, env_data);
1791 }
1792 
1793 static unlang_action_t CC_HINT(nonnull(1,2,3,4,5,8,9)) mschap_process_v2_response(rlm_rcode_t *p_result,
1794  int *mschap_version,
1795  uint8_t nthashhash[static NT_DIGEST_LENGTH],
1796  rlm_mschap_t const *inst,
1797  request_t *request,
1798  fr_pair_t *smb_ctrl,
1799  fr_pair_t *nt_password,
1800  fr_pair_t *challenge,
1801  fr_pair_t *response,
1802  MSCHAP_AUTH_METHOD method,
1803  mschap_auth_call_env_t *env_data)
1804 {
1805  uint8_t mschap_challenge[16];
1806  fr_pair_t *user_name, *name_vp, *response_name, *peer_challenge_attr;
1807  uint8_t const *peer_challenge;
1808  char const *username_str;
1809  size_t username_len;
1810  int mschap_result;
1811  rlm_rcode_t rcode;
1812  char msch2resp[42];
1813 
1814  *mschap_version = 2;
1815 
1816  RDEBUG2("Processing MS-CHAPv2 response");
1817 
1818  /*
1819  * MS-CHAPv2 challenges are 16 octets.
1820  */
1821  if (challenge->vp_length < 16) {
1822  REDEBUG("%s has the wrong format", env_data->chap_challenge->name);
1823  RETURN_MODULE_INVALID;
1824  }
1825 
1826  /*
1827  * Responses are 50 octets.
1828  */
1829  if (response->vp_length < 50) {
1830  REDEBUG("%s has the wrong format", env_data->chap2_response->name);
1831  RETURN_MODULE_INVALID;
1832  }
1833 
1834  /*
1835  * We also require a User-Name
1836  */
1837  user_name = mschap_identity_find(request, tmpl_attr_tail_da(env_data->username));
1838  if (!user_name) RETURN_MODULE_FAIL;
1839 
1840  /*
1841  * Check for MS-CHAP-User-Name and if found, use it
1842  * to construct the MSCHAPv1 challenge. This is
1843  * set by rlm_eap_mschap to the MS-CHAP Response
1844  * packet Name field.
1845  *
1846  * We prefer this to the User-Name in the
1847  * packet.
1848  */
1849  response_name = fr_pair_find_by_da(&request->request_pairs, NULL, attr_ms_chap_user_name);
1850  name_vp = response_name ? response_name : user_name;
1851 
1852  /*
1853  * with_ntdomain_hack moved here, too.
1854  */
1855  if ((username_str = strchr(name_vp->vp_strvalue, '\\')) != NULL) {
1856  if (inst->with_ntdomain_hack) {
1857  username_str++;
1858  } else {
1859  RWDEBUG2("NT Domain delimiter found, should 'with_ntdomain_hack' be enabled?");
1860  username_str = name_vp->vp_strvalue;
1861  }
1862  } else {
1863  username_str = name_vp->vp_strvalue;
1864  }
1865  username_len = name_vp->vp_length - (username_str - name_vp->vp_strvalue);
1866 
1867  if (response_name && ((user_name->vp_length != response_name->vp_length) ||
1868  (strncasecmp(user_name->vp_strvalue, response_name->vp_strvalue, user_name->vp_length) != 0))) {
1869  RWDEBUG("%pP is not the same as %pP from EAP-MSCHAPv2", user_name, response_name);
1870  }
1871 
1872 #ifdef __APPLE__
1873  /*
1874  * No "known good" Password.NT attribute. Try to do
1875  * OpenDirectory authentication.
1876  *
1877  * If OD determines the user is an AD user it will return noop, which
1878  * indicates the auth process should continue directly to AD.
1879  * Otherwise OD will determine auth success/fail.
1880  */
1881  if (!nt_password && inst->open_directory) {
1882  RDEBUG2("No Password.NT available. Trying OpenDirectory Authentication");
1883  od_mschap_auth(&rcode, request, challenge, user_name, env_data);
1884  if (rcode != RLM_MODULE_NOOP) RETURN_MODULE_RCODE(rcode);
1885  }
1886 #endif
1887  peer_challenge = response->vp_octets + 2;
1888 
1889  peer_challenge_attr = fr_pair_find_by_da(&request->control_pairs, NULL, attr_ms_chap_peer_challenge);
1890  if (peer_challenge_attr) {
1891  RDEBUG2("Overriding peer challenge");
1892  peer_challenge = peer_challenge_attr->vp_octets;
1893  }
1894 
1895  /*
1896  * The old "mschapv2" function has been moved to
1897  * here.
1898  *
1899  * MS-CHAPv2 takes some additional data to create an
1900  * MS-CHAPv1 challenge, and then does MS-CHAPv1.
1901  */
1902  RDEBUG2("Creating challenge with username \"%pV\"",
1903  fr_box_strvalue_len(username_str, username_len));
1904  mschap_challenge_hash(mschap_challenge, /* resulting challenge */
1905  peer_challenge, /* peer challenge */
1906  challenge->vp_octets, /* our challenge */
1907  username_str, username_len); /* user name */
1908 
1909  mschap_result = do_mschap(inst, request, nt_password, mschap_challenge,
1910  response->vp_octets + 26, nthashhash, method, env_data);
1911 
1912  /*
1913  * Check for errors, and add MSCHAP-Error if necessary.
1914  */
1915  mschap_error(&rcode, inst, request, *response->vp_octets,
1916  mschap_result, *mschap_version, smb_ctrl, env_data);
1917  if (rcode != RLM_MODULE_OK) RETURN_MODULE_RCODE(rcode);
1918 
1919 #ifdef WITH_AUTH_WINBIND
1920  if (inst->wb_retry_with_normalised_username) {
1921  response_name = fr_pair_find_by_da(&request->request_pairs, NULL, attr_ms_chap_user_name);
1922  if (response_name) {
1923  if (strcmp(username_str, response_name->vp_strvalue)) {
1924  RDEBUG2("Normalising username %pV -> %pV",
1925  fr_box_strvalue_len(username_str, username_len),
1926  &response_name->data);
1927  username_str = response_name->vp_strvalue;
1928  }
1929  }
1930  }
1931 #endif
1932 
1933  mschap_auth_response(username_str, /* without the domain */
1934  username_len, /* Length of username str */
1935  nthashhash, /* nt-hash-hash */
1936  response->vp_octets + 26, /* peer response */
1937  peer_challenge, /* peer challenge */
1938  challenge->vp_octets, /* our challenge */
1939  msch2resp); /* calculated MPPE key */
1940  if (env_data->chap2_success) mschap_add_reply(request, *response->vp_octets,
1941  tmpl_attr_tail_da(env_data->chap2_success), msch2resp, 42);
1942 
1943  RETURN_MODULE_OK;
1944 }
1945 
1946 /** Complete mschap authentication after any tmpls have been expanded.
1947  *
1948  */
1949 static unlang_action_t mod_authenticate_resume(rlm_rcode_t *p_result, UNUSED int *priority, request_t *request, void *uctx)
1950 {
1951  mschap_auth_ctx_t *auth_ctx = talloc_get_type_abort(uctx, mschap_auth_ctx_t);
1952  mschap_auth_call_env_t *env_data = talloc_get_type_abort(auth_ctx->env_data, mschap_auth_call_env_t);
1953  rlm_mschap_t const *inst = talloc_get_type_abort_const(auth_ctx->inst, rlm_mschap_t);
1954  fr_pair_t *challenge = NULL;
1955  fr_pair_t *response = NULL;
1956  fr_pair_t *parent;
1957  uint8_t nthashhash[NT_DIGEST_LENGTH];
1958  int mschap_version = 0;
1959  rlm_rcode_t rcode = RLM_MODULE_OK;
1960 
1961  if (auth_ctx->cpw) {
1962  uint8_t *p;
1963 
1964  /*
1965  * Password change does require the NT password
1966  */
1967  if (!auth_ctx->nt_password) {
1968  REDEBUG("Missing Password.NT - required for change password request");
1969  RETURN_MODULE_FAIL;
1970  }
1971  if (!env_data->chap_nt_enc_pw) {
1972  REDEBUG("chap_nt_enc_pw option is not set - required for change password request");
1973  RETURN_MODULE_INVALID;
1974  }
1975 
1976  mschap_process_cpw_request(&rcode, inst, request, auth_ctx);
1977  if (rcode != RLM_MODULE_OK) goto finish;
1978 
1979  /*
1980  * Clear any expiry bit so the user can now login;
1981  * obviously the password change action will need
1982  * to have cleared this bit in the config/SQL/wherever.
1983  */
1984  if (auth_ctx->smb_ctrl && auth_ctx->smb_ctrl->vp_uint32 & ACB_FR_EXPIRED) {
1985  RDEBUG2("Clearing expiry bit in SMB-Acct-Ctrl to allow authentication");
1986  auth_ctx->smb_ctrl->vp_uint32 &= ~ACB_FR_EXPIRED;
1987  }
1988 
1989  /*
1990  * Extract the challenge & response from the end of the
1991  * password change, add them into the request and then
1992  * continue with the authentication.
1993  */
1994  MEM(pair_update_request(&response, tmpl_attr_tail_da(env_data->chap2_response)) >= 0);
1995  MEM(fr_pair_value_mem_alloc(response, &p, 50, auth_ctx->cpw->vp_tainted) == 0);
1996 
1997  /* ident & flags */
1998  p[0] = auth_ctx->cpw->vp_octets[1];
1999  p[1] = 0;
2000  /* peer challenge and client NT response */
2001  memcpy(p + 2, auth_ctx->cpw->vp_octets + 18, 48);
2002  }
2003 
2004  challenge = fr_pair_find_by_da_nested(&request->request_pairs, NULL, tmpl_attr_tail_da(env_data->chap_challenge));
2005  if (!challenge) {
2006  REDEBUG("&control.Auth-Type = %s set for a request that does not contain &%s",
2007  auth_ctx->name, env_data->chap_challenge->name);
2008  rcode = RLM_MODULE_INVALID;
2009  goto finish;
2010  }
2011 
2012  /*
2013  * The responses MUST be in the same group as the challenge.
2014  */
2015  parent = fr_pair_parent(challenge);
2016  fr_assert(parent != NULL);
2017 
2018  /*
2019  * We also require an MS-CHAP-Response.
2020  */
2021  if ((response = fr_pair_find_by_da(&parent->vp_group, NULL, tmpl_attr_tail_da(env_data->chap_response)))) {
2022  mschap_process_response(&rcode,
2023  &mschap_version, nthashhash,
2024  inst, request,
2025  auth_ctx->smb_ctrl, auth_ctx->nt_password,
2026  challenge, response,
2027  auth_ctx->method, auth_ctx->env_data);
2028  if (rcode != RLM_MODULE_OK) goto finish;
2029  } else if ((response = fr_pair_find_by_da_nested(&parent->vp_group, NULL, tmpl_attr_tail_da(env_data->chap2_response)))) {
2030  mschap_process_v2_response(&rcode,
2031  &mschap_version, nthashhash,
2032  inst, request,
2033  auth_ctx->smb_ctrl, auth_ctx->nt_password,
2034  challenge, response,
2035  auth_ctx->method, auth_ctx->env_data);
2036  if (rcode != RLM_MODULE_OK) goto finish;
2037  } else { /* Neither CHAPv1 or CHAPv2 response: die */
2038  REDEBUG("&control.Auth-Type = %s set for a request that does not contain &%s or &%s attributes",
2039  auth_ctx->name, env_data->chap_response->name, env_data->chap2_response->name);
2040  rcode = RLM_MODULE_INVALID;
2041  goto finish;
2042  }
2043 
2044  /* now create MPPE attributes */
2045  if (inst->use_mppe) {
2046  fr_pair_t *vp;
2047  uint8_t mppe_sendkey[34];
2048  uint8_t mppe_recvkey[34];
2049 
2050  switch (mschap_version) {
2051  case 1:
2052  RDEBUG2("Generating MS-CHAPv1 MPPE keys");
2053  memset(mppe_sendkey, 0, 32);
2054 
2055  /*
2056  * According to RFC 2548 we
2057  * should send NT hash. But in
2058  * practice it doesn't work.
2059  * Instead, we should send nthashhash
2060  *
2061  * This is an error in RFC 2548.
2062  */
2063  /*
2064  * do_mschap cares to zero nthashhash if NT hash
2065  * is not available.
2066  */
2067  memcpy(mppe_sendkey + 8, nthashhash, NT_DIGEST_LENGTH);
2068  mppe_add_reply(inst, request, tmpl_attr_tail_da(env_data->chap_mppe_keys), mppe_sendkey, 24); //-V666
2069  break;
2070 
2071  case 2:
2072  RDEBUG2("Generating MS-CHAPv2 MPPE keys");
2073  mppe_chap2_gen_keys128(nthashhash, response->vp_octets + 26, mppe_sendkey, mppe_recvkey);
2074 
2075  mppe_add_reply(inst, request, tmpl_attr_tail_da(env_data->mppe_recv_key), mppe_recvkey, 16);
2076  mppe_add_reply(inst, request, tmpl_attr_tail_da(env_data->mppe_send_key), mppe_sendkey, 16);
2077  break;
2078 
2079  default:
2080  fr_assert(0);
2081  break;
2082  }
2083 
2084  MEM(pair_update_reply(&vp, tmpl_attr_tail_da(env_data->mppe_encryption_policy)) >= 0);
2085  vp->vp_uint32 = inst->require_encryption ? 2 : 1;
2086 
2087  MEM(pair_update_reply(&vp, tmpl_attr_tail_da(env_data->mppe_encryption_types)) >= 0);
2088  vp->vp_uint32 = inst->require_strong ? 4 : 6;
2089  } /* else we weren't asked to use MPPE */
2090 
2091 finish:
2092  RETURN_MODULE_RCODE(rcode);
2093 }
2094 
2095 /** When changing passwords using the ntlm_auth helper, evaluate the domain tmpl
2096  *
2097  */
2098 static unlang_action_t mod_authenticate_domain_tmpl_push(rlm_rcode_t *p_result, UNUSED int *priority,
2099  request_t *request, void *uctx)
2100 {
2101  mschap_auth_ctx_t *auth_ctx = talloc_get_type_abort(uctx, mschap_auth_ctx_t);
2102  mschap_auth_call_env_t *env_data = talloc_get_type_abort(auth_ctx->env_data, mschap_auth_call_env_t);
2103 
2104  fr_value_box_list_init(&auth_ctx->cpw_ctx->cpw_domain);
2105  if (unlang_tmpl_push(auth_ctx, &auth_ctx->cpw_ctx->cpw_domain, request,
2106  env_data->ntlm_cpw_domain, NULL) < 0) RETURN_MODULE_FAIL;
2107 
2108  return UNLANG_ACTION_PUSHED_CHILD;
2109 }
2110 
2111 #ifdef WITH_TLS
2112 /** Decrypt the new cleartext password when handling change password requests
2113  *
2114  */
2115 static int mschap_new_pass_decrypt(request_t *request, mschap_auth_ctx_t *auth_ctx)
2116 {
2117  EVP_CIPHER_CTX *evp_ctx;
2118  uint8_t nt_pass_decrypted[516], old_nt_hash_expected[NT_DIGEST_LENGTH];
2119  int c, ntlen = sizeof(nt_pass_decrypted);
2120  size_t passlen, i = 0, len = 0;
2121  char *x;
2122  uint8_t *p, *q;
2123  fr_pair_t *new_pass;
2124 
2125  MEM(evp_ctx = EVP_CIPHER_CTX_new());
2126 
2127  if (unlikely(EVP_EncryptInit_ex(evp_ctx, EVP_rc4(), NULL, auth_ctx->nt_password->vp_octets, NULL) != 1)) {
2128  fr_tls_strerror_printf(NULL);
2129  RPERROR("Failed initialising RC4 ctx");
2130  return -1;
2131  }
2132 
2133  if (unlikely(EVP_CIPHER_CTX_set_key_length(evp_ctx, auth_ctx->nt_password->vp_length)) != 1) {
2134  fr_tls_strerror_printf(NULL);
2135  RPERROR("Failed setting key length");
2136  return -1;
2137  }
2138 
2139  if (unlikely(EVP_EncryptUpdate(evp_ctx, nt_pass_decrypted, &ntlen, auth_ctx->cpw_ctx->new_nt_encrypted, ntlen) != 1)) {
2140  fr_tls_strerror_printf(NULL);
2141  RPERROR("Failed ingesting new password");
2142  return -1;
2143  }
2144 
2145  EVP_CIPHER_CTX_free(evp_ctx);
2146 
2147  /*
2148  * pwblock is
2149  * 512-N bytes random pad
2150  * N bytes password as utf-16-le
2151  * 4 bytes - N as big-endian int
2152  */
2153  passlen = nt_pass_decrypted[512];
2154  passlen += nt_pass_decrypted[513] << 8;
2155  if ((nt_pass_decrypted[514] != 0) ||
2156  (nt_pass_decrypted[515] != 0)) {
2157  REDEBUG("Decrypted new password blob claims length > 65536, probably an invalid Password.NT");
2158  return -1;
2159  }
2160 
2161  /*
2162  * Sanity check - passlen positive and <= 512 if not, crypto has probably gone wrong
2163  */
2164  if (passlen > 512) {
2165  REDEBUG("Decrypted new password blob claims length %zu > 512, "
2166  "probably an invalid Password.NT", passlen);
2167  return -1;
2168  }
2169 
2170  p = nt_pass_decrypted + 512 - passlen;
2171 
2172  /*
2173  * The new NT hash - this should be preferred over the
2174  * cleartext password as it avoids unicode hassles.
2175  */
2176  MEM(pair_update_request(&auth_ctx->cpw_ctx->new_hash, attr_ms_chap_new_nt_password) >= 0);
2177  MEM(fr_pair_value_mem_alloc(auth_ctx->cpw_ctx->new_hash, &q, NT_DIGEST_LENGTH, false) == 0);
2178  fr_md4_calc(q, p, passlen);
2179 
2180  /*
2181  * Check that nt_password encrypted with new_hash
2182  * matches the old_hash value from the client.
2183  */
2184  smbhash(old_nt_hash_expected, auth_ctx->nt_password->vp_octets, q);
2185  smbhash(old_nt_hash_expected + 8, auth_ctx->nt_password->vp_octets + 8, q + 7);
2186  if (memcmp(old_nt_hash_expected, auth_ctx->cpw_ctx->old_nt_hash, NT_DIGEST_LENGTH)!=0) {
2187  REDEBUG("Old NT hash value from client does not match our value");
2188  RHEXDUMP1(old_nt_hash_expected, NT_DIGEST_LENGTH, "expected");
2189  RHEXDUMP1(auth_ctx->cpw_ctx->old_nt_hash, NT_DIGEST_LENGTH, "got");
2190  return -1;
2191  }
2192 
2193  /*
2194  * The new cleartext password, which is utf-16 do some unpleasant vileness
2195  * to turn it into utf8 without pulling in libraries like iconv.
2196  *
2197  * First pass: get the length of the converted string.
2198  */
2199  MEM(pair_update_request(&new_pass, attr_ms_chap_new_cleartext_password) >= 0);
2200  new_pass->vp_length = 0;
2201 
2202  while (i < passlen) {
2203  c = p[i++];
2204  c += p[i++] << 8;
2205 
2206  /*
2207  * Gah. nasty. maybe we should just pull in iconv?
2208  */
2209  if (c < 0x7f) {
2210  len++;
2211  } else if (c < 0x7ff) {
2212  len += 2;
2213  } else {
2214  len += 3;
2215  }
2216  }
2217 
2218  MEM(fr_pair_value_bstr_alloc(new_pass, &x, len, true) == 0);
2219 
2220  /*
2221  * Second pass: convert the characters from UTF-16 to UTF-8.
2222  */
2223  i = 0;
2224  while (i < passlen) {
2225  c = p[i++];
2226  c += p[i++] << 8;
2227 
2228  /*
2229  * Gah. nasty. maybe we should just pull in iconv?
2230  */
2231  if (c < 0x7f) {
2232  *x++ = c;
2233 
2234  } else if (c < 0x7ff) {
2235  *x++ = 0xc0 + (c >> 6);
2236  *x++ = 0x80 + (c & 0x3f);
2237 
2238  } else {
2239  *x++ = 0xe0 + (c >> 12);
2240  *x++ = 0x80 + ((c>>6) & 0x3f);
2241  *x++ = 0x80 + (c & 0x3f);
2242  }
2243  }
2244 
2245  *x = '\0';
2246  return 0;
2247 }
2248 #endif
2249 
2250 /*
2251  * mod_authenticate() - authenticate user based on given
2252  * attributes and configuration.
2253  * We will try to find out password in configuration
2254  * or in configured passwd file.
2255  * If one is found we will check paraneters given by NAS.
2256  *
2257  * If SMB-Account-Ctrl is not set to ACB_PWNOTREQ we must have
2258  * one of:
2259  * PAP: User-Password or
2260  * MS-CHAP: MS-CHAP-Challenge and MS-CHAP-Response or
2261  * MS-CHAP2: MS-CHAP-Challenge and MS-CHAP2-Response
2262  * In case of password mismatch or locked account we MAY return
2263  * MS-CHAP-Error for MS-CHAP or MS-CHAP v2
2264  * If MS-CHAP2 succeeds we MUST return MS-CHAP2-Success
2265  */
2266 static unlang_action_t CC_HINT(nonnull) mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
2267 {
2268  rlm_mschap_t const *inst = talloc_get_type_abort_const(mctx->mi->data, rlm_mschap_t);
2269  mschap_auth_call_env_t *env_data = talloc_get_type_abort(mctx->env_data, mschap_auth_call_env_t);
2270  mschap_auth_ctx_t *auth_ctx;
2271 
2272  MEM(auth_ctx = talloc_zero(unlang_interpret_frame_talloc_ctx(request), mschap_auth_ctx_t));
2273 
2274  /*
2275  * If we have ntlm_auth configured, use it unless told
2276  * otherwise
2277  */
2278  *auth_ctx = (mschap_auth_ctx_t) {
2279  .name = mctx->mi->name,
2280  .inst = inst,
2281  .method = inst->method,
2282  .env_data = env_data,
2283  };
2284 
2285  /*
2286  * If we have an ntlm_auth configuration, then we may
2287  * want to suppress it.
2288  */
2289  if (auth_ctx->method != AUTH_INTERNAL) {
2290  fr_pair_t *vp = fr_pair_find_by_da(&request->control_pairs, NULL, attr_ms_chap_use_ntlm_auth);
2291  if (vp && (vp->vp_uint8 <= AUTH_AUTO)) auth_ctx->method = vp->vp_uint8;
2292  }
2293 
2294  /*
2295  * Find the SMB-Account-Ctrl attribute, or the
2296  * SMB-Account-Ctrl-Text attribute.
2297  */
2298  auth_ctx->smb_ctrl = fr_pair_find_by_da(&request->control_pairs, NULL, attr_smb_account_ctrl);
2299  if (!auth_ctx->smb_ctrl) {
2300  fr_pair_t *smb_account_ctrl_text;
2301 
2302  smb_account_ctrl_text = fr_pair_find_by_da(&request->control_pairs, NULL, attr_smb_account_ctrl_text);
2303  if (smb_account_ctrl_text) {
2304  MEM(pair_append_control(&auth_ctx->smb_ctrl, attr_smb_account_ctrl) >= 0);
2305  auth_ctx->smb_ctrl->vp_uint32 = pdb_decode_acct_ctrl(smb_account_ctrl_text->vp_strvalue);
2306  }
2307  }
2308 
2309  /*
2310  * We're configured to do MS-CHAP authentication.
2311  * and account control information exists. Enforce it.
2312  */
2313  if (auth_ctx->smb_ctrl) {
2314  /*
2315  * Password is not required.
2316  */
2317  if ((auth_ctx->smb_ctrl->vp_uint32 & ACB_PWNOTREQ) != 0) {
2318  RDEBUG2("SMB-Account-Ctrl says no password is required");
2319  RETURN_MODULE_OK;
2320  }
2321  }
2322 
2323  /*
2324  * Look for or create an Password.NT
2325  *
2326  * Password.NT can be NULL here if we didn't find an
2327  * input attribute, and we're calling out to an
2328  * external password store.
2329  */
2330  if (nt_password_find(auth_ctx, &auth_ctx->nt_password, mctx->mi->data, request) < 0) RETURN_MODULE_FAIL;
2331 
2332  /*
2333  * Check to see if this is a change password request, and process
2334  * it accordingly if so.
2335  */
2336  if (env_data->chap2_cpw) auth_ctx->cpw = fr_pair_find_by_da_nested(&request->request_pairs, NULL,
2337  tmpl_attr_tail_da(env_data->chap2_cpw));
2338  if (auth_ctx->cpw) {
2339  /*
2340  * Password change does require the NT password
2341  */
2342  if (!auth_ctx->nt_password) {
2343  REDEBUG("Missing Password.NT - required for change password request");
2344  RETURN_MODULE_FAIL;
2345  }
2346 
2347  if (mschap_cpw_prepare(request, auth_ctx) < 0) RETURN_MODULE_FAIL;
2348 
2349  switch (auth_ctx->method) {
2350  case AUTH_INTERNAL:
2351 #ifdef WITH_TLS
2352  if (mschap_new_pass_decrypt(request, auth_ctx) < 0) RETURN_MODULE_FAIL;
2353  if (unlang_function_push(request, NULL, mod_authenticate_resume, NULL, 0,
2354  UNLANG_SUB_FRAME, auth_ctx) < 0) RETURN_MODULE_FAIL;
2355 
2356  fr_value_box_list_init(&auth_ctx->cpw_ctx->local_cpw_result);
2357  if (unlang_tmpl_push(auth_ctx, &auth_ctx->cpw_ctx->local_cpw_result, request,
2358  env_data->local_cpw, NULL) < 0) RETURN_MODULE_FAIL;
2359  break;
2360 #else
2361  REDEBUG("Local MS-CHAPv2 password changes require OpenSSL support");
2362  RETURN_MODULE_INVALID;
2363 #endif
2364 
2365  default:
2366  if (!env_data->ntlm_cpw_username) {
2367  REDEBUG("No ntlm_auth username set, passchange will definitely fail!");
2368  RETURN_MODULE_FAIL;
2369  }
2370 
2371  if (unlang_function_push(request, env_data->ntlm_cpw_domain ? mod_authenticate_domain_tmpl_push : NULL,
2372  mod_authenticate_resume, NULL, 0,
2373  UNLANG_SUB_FRAME, auth_ctx) < 0) RETURN_MODULE_FAIL;
2374 
2375  fr_value_box_list_init(&auth_ctx->cpw_ctx->cpw_user);
2376  if (unlang_tmpl_push(auth_ctx, &auth_ctx->cpw_ctx->cpw_user, request,
2377  env_data->ntlm_cpw_username, NULL) < 0) RETURN_MODULE_FAIL;
2378  break;
2379  }
2380 
2381  return UNLANG_ACTION_PUSHED_CHILD;
2382  }
2383 
2384  return mod_authenticate_resume(p_result, NULL, request, auth_ctx);
2385 }
2386 
2387 /*
2388  * Create instance for our module. Allocate space for
2389  * instance structure and read configuration parameters
2390  */
2391 static int mod_instantiate(module_inst_ctx_t const *mctx)
2392 {
2393  rlm_mschap_t *inst = talloc_get_type_abort(mctx->mi->data, rlm_mschap_t);
2394  CONF_SECTION *conf = mctx->mi->conf;
2395 
2396  inst->auth_type = fr_dict_enum_by_name(attr_auth_type, mctx->mi->name, -1);
2397  if (!inst->auth_type) {
2398  WARN("Failed to find 'authenticate %s {...}' section. MS-CHAP authentication will likely not work",
2399  mctx->mi->name);
2400  }
2401 
2402  /*
2403  * Set auth method
2404  */
2405  inst->method = AUTH_INTERNAL;
2406 
2407  if (inst->wb_username) {
2408 #ifdef WITH_AUTH_WINBIND
2409  inst->method = AUTH_WBCLIENT;
2410 
2411  inst->wb_pool = module_rlm_connection_pool_init(conf, UNCONST(module_instance_t *, mctx->mi), mod_conn_create, NULL, NULL, NULL, NULL);
2412  if (!inst->wb_pool) {
2413  cf_log_err(conf, "Unable to initialise winbind connection pool");
2414  return -1;
2415  }
2416 #else
2417  cf_log_err(conf, "'winbind' auth not enabled at compiled time");
2418  return -1;
2419 #endif
2420  }
2421 
2422  /* preserve existing behaviour: this option overrides all */
2423  if (inst->ntlm_auth) {
2424  inst->method = AUTH_NTLMAUTH_EXEC;
2425  }
2426 
2427  switch (inst->method) {
2428  case AUTH_INTERNAL:
2429  DEBUG("Using internal authentication");
2430  break;
2431  case AUTH_AUTO:
2432  DEBUG("Using auto password or ntlm_auth");
2433  break;
2434  case AUTH_NTLMAUTH_EXEC:
2435  DEBUG("Authenticating by calling 'ntlm_auth'");
2436  break;
2437 #ifdef WITH_AUTH_WINBIND
2438  case AUTH_WBCLIENT:
2439  DEBUG("Authenticating directly to winbind");
2440  break;
2441 #endif
2442  }
2443 
2444  /*
2445  * Check ntlm_auth_timeout is sane
2446  */
2447  if (!fr_time_delta_ispos(inst->ntlm_auth_timeout)) {
2448  inst->ntlm_auth_timeout = fr_time_delta_from_sec(EXEC_TIMEOUT);
2449  }
2450  if (fr_time_delta_lt(inst->ntlm_auth_timeout, fr_time_delta_from_sec(1))) {
2451  cf_log_err(conf, "ntml_auth_timeout '%pVs' is too small (minimum: 1s)",
2452  fr_box_time_delta(inst->ntlm_auth_timeout));
2453  return -1;
2454  }
2455  if (fr_time_delta_gt(inst->ntlm_auth_timeout, fr_time_delta_from_sec(10))) {
2456  cf_log_err(conf, "ntlm_auth_timeout '%pVs' is too large (maximum: 10s)",
2457  fr_box_time_delta(inst->ntlm_auth_timeout));
2458  return -1;
2459  }
2460 
2461 #define CHECK_OPTION(_option) cp = cf_pair_find(attrs, STRINGIFY(_option)); \
2462 if (!cp) { \
2463  WARN("Missing option \"" STRINGIFY(_option) "\", setting use_mppe to \"no\""); \
2464  inst->use_mppe = false; \
2465  goto done_mppe_check; \
2466 }
2467 
2468  /*
2469  * Check that MPPE attributes are in the module config, if the option is enabled.
2470  * Validity of them will be checked when the module is compiled.
2471  */
2472  if (inst->use_mppe) {
2473  CONF_SECTION *attrs = cf_section_find(conf, "attributes", NULL);
2474  CONF_PAIR *cp;
2475 
2476  if (!attrs) {
2477  cf_log_err(conf, "Missing required \"attributes\" section");
2478  return -1;
2479  }
2480  CHECK_OPTION(chap_mppe_keys)
2481  CHECK_OPTION(mppe_encryption_policy)
2482  CHECK_OPTION(mppe_recv_key)
2483  CHECK_OPTION(mppe_send_key)
2484  CHECK_OPTION(mppe_encryption_types)
2485  }
2486 done_mppe_check:
2487 
2488  return 0;
2489 }
2490 
2491 static int mod_bootstrap(module_inst_ctx_t const *mctx)
2492 {
2493  xlat_t *xlat;
2494 
2495  xlat = module_rlm_xlat_register(mctx->mi->boot, mctx, NULL, mschap_xlat, FR_TYPE_VOID);
2496  xlat_func_args_set(xlat, mschap_xlat_args);
2497  xlat_func_call_env_set(xlat, &mschap_xlat_method_env);
2498 
2499  return 0;
2500 }
2501 
2502 /*
2503  * Tidy up instance
2504  */
2505 static int mod_detach(
2506 #ifndef WITH_AUTH_WINBIND
2507  UNUSED
2508 #endif
2509  module_detach_ctx_t const *mctx)
2510 {
2511 #ifdef WITH_AUTH_WINBIND
2512  rlm_mschap_t *inst = talloc_get_type_abort(mctx->mi->data, rlm_mschap_t);
2513 
2514  fr_pool_free(inst->wb_pool);
2515 #endif
2516 
2517  return 0;
2518 }
2519 
2520 
2521 extern module_rlm_t rlm_mschap;
2522 module_rlm_t rlm_mschap = {
2523  .common = {
2524  .magic = MODULE_MAGIC_INIT,
2525  .name = "mschap",
2526  .inst_size = sizeof(rlm_mschap_t),
2527  .config = module_config,
2528  .bootstrap = mod_bootstrap,
2529  .instantiate = mod_instantiate,
2530  .detach = mod_detach
2531  },
2532  .method_group = {
2533  .bindings = (module_method_binding_t[]){
2534  { .section = SECTION_NAME("authenticate", CF_IDENT_ANY), .method = mod_authenticate, .method_env = &mschap_auth_method_env },
2535  { .section = SECTION_NAME("recv", CF_IDENT_ANY), .method = mod_authorize, .method_env = &mschap_autz_method_env },
2536  MODULE_BINDING_TERMINATOR
2537  }
2538  }
2539 };
unlang_action_t
unlang_action_t
Returned by unlang_op_t calls, determine the next action of the interpreter.
Definition: action.h:35
UNLANG_ACTION_PUSHED_CHILD
@ UNLANG_ACTION_PUSHED_CHILD
unlang_t pushed a new child onto the stack, execute it instead of continuing.
Definition: action.h:39
buffer
static int const char char buffer[256]
Definition: acutest.h:574
do_auth_wbclient
int do_auth_wbclient(rlm_mschap_t const *inst, request_t *request, uint8_t const *challenge, uint8_t const *response, uint8_t nthashhash[NT_DIGEST_LENGTH], mschap_auth_call_env_t *env_data)
Check NTLM authentication direct to winbind via Samba's libwbclient library.
Definition: auth_wbclient.c:93
auth_wbclient.h
fr_base16_encode
#define fr_base16_encode(_out, _in)
Definition: base16.h:57
fr_base16_decode
#define fr_base16_decode(_err, _out, _in, _no_trailing)
Definition: base16.h:95
UNCONST
#define UNCONST(_type, _ptr)
Remove const qualification from a pointer.
Definition: build.h:165
USES_APPLE_DEPRECATED_API
#define USES_APPLE_DEPRECATED_API
Definition: build.h:468
RCSID
#define RCSID(id)
Definition: build.h:481
unlikely
#define unlikely(_x)
Definition: build.h:379
UNUSED
#define UNUSED
Definition: build.h:313
NUM_ELEMENTS
#define NUM_ELEMENTS(_t)
Definition: build.h:335
CALL_ENV_TERMINATOR
#define CALL_ENV_TERMINATOR
Definition: call_env.h:231
FR_CALL_ENV_METHOD_OUT
#define FR_CALL_ENV_METHOD_OUT(_inst)
Helper macro for populating the size/type fields of a call_env_method_t from the output structure typ...
Definition: call_env.h:235
FR_CALL_ENV_SUBSECTION
#define FR_CALL_ENV_SUBSECTION(_name, _name2, _flags, _subcs)
Specify a call_env_parser_t which defines a nested subsection.
Definition: call_env.h:397
CALL_ENV_FLAG_SUBSECTION
@ CALL_ENV_FLAG_SUBSECTION
This is a subsection.
Definition: call_env.h:87
CALL_ENV_FLAG_ATTRIBUTE
@ CALL_ENV_FLAG_ATTRIBUTE
Tmpl must contain an attribute reference.
Definition: call_env.h:86
CALL_ENV_FLAG_NONE
@ CALL_ENV_FLAG_NONE
Definition: call_env.h:74
CALL_ENV_FLAG_REQUIRED
@ CALL_ENV_FLAG_REQUIRED
Associated conf pair or section is required.
Definition: call_env.h:75
CALL_ENV_FLAG_NULLABLE
@ CALL_ENV_FLAG_NULLABLE
Tmpl expansions are allowed to produce no output.
Definition: call_env.h:80
FR_CALL_ENV_OFFSET
#define FR_CALL_ENV_OFFSET(_name, _cast_type, _flags, _struct, _field)
Specify a call_env_parser_t which writes out runtime results to the specified field.
Definition: call_env.h:335
FR_CALL_ENV_PARSE_ONLY_OFFSET
#define FR_CALL_ENV_PARSE_ONLY_OFFSET(_name, _cast_type, _flags, _struct, _parse_field)
Specify a call_env_parser_t which writes out the result of the parsing phase to the field specified.
Definition: call_env.h:384
call_env_method_s
Definition: call_env.h:239
call_env_parser_s
Per method call config.
Definition: call_env.h:175
CONF_PARSER_TERMINATOR
#define CONF_PARSER_TERMINATOR
Definition: cf_parse.h:627
FR_CONF_DEPRECATED
#define FR_CONF_DEPRECATED(_name, _struct, _field)
conf_parser_t entry which raises an error if a matching CONF_PAIR is found
Definition: cf_parse.h:385
FR_CONF_OFFSET
#define FR_CONF_OFFSET(_name, _struct, _field)
conf_parser_t which parses a single CONF_PAIR, writing the result to a field in a struct
Definition: cf_parse.h:268
FR_CONF_POINTER
#define FR_CONF_POINTER(_name, _type, _flags, _res_p)
conf_parser_t which parses a single CONF_PAIR producing a single global result
Definition: cf_parse.h:310
FR_CONF_OFFSET_FLAGS
#define FR_CONF_OFFSET_FLAGS(_name, _flags, _struct, _field)
conf_parser_t which parses a single CONF_PAIR, writing the result to a field in a struct
Definition: cf_parse.h:256
CONF_FLAG_XLAT
@ CONF_FLAG_XLAT
string will be dynamically expanded.
Definition: cf_parse.h:416
CONF_FLAG_SUBSECTION
@ CONF_FLAG_SUBSECTION
Instead of putting the information into a configuration structure, the configuration file routines MA...
Definition: cf_parse.h:399
conf_parser_s
Defines a CONF_PAIR to C data type mapping.
Definition: cf_parse.h:564
cf_pair
Configuration AVP similar to a fr_pair_t.
Definition: cf_priv.h:70
cf_section
A section grouping multiple CONF_PAIR.
Definition: cf_priv.h:101
cf_section_find
CONF_SECTION * cf_section_find(CONF_SECTION const *cs, char const *name1, char const *name2)
Find a CONF_SECTION with name1 and optionally name2.
Definition: cf_util.c:1028
cf_log_err
#define cf_log_err(_cf, _fmt,...)
Definition: cf_util.h:289
CF_IDENT_ANY
#define CF_IDENT_ANY
Definition: cf_util.h:78
FR_DBUFF_TMP
#define FR_DBUFF_TMP(_start, _len_or_end)
Creates a compound literal to pass into functions which accept a dbuff.
Definition: dbuff.h:514
fr_dcursor_append
static int fr_dcursor_append(fr_dcursor_t *cursor, void *v)
Insert a single item at the end of the list.
Definition: dcursor.h:406
uctx
fr_dcursor_eval_t void const * uctx
Definition: dcursor.h:546
fr_dcursor_s
Definition: dcursor.h:93
ERROR
#define ERROR(fmt,...)
Definition: dhcpclient.c:41
DEBUG
#define DEBUG(fmt,...)
Definition: dhcpclient.c:39
timeout
static fr_time_delta_t timeout
Definition: dhcpclient.c:54
fr_dict_attr_autoload_t::out
fr_dict_attr_t const ** out
Where to write a pointer to the resolved fr_dict_attr_t.
Definition: dict.h:267
fr_dict_autoload_t::out
fr_dict_t const ** out
Where to write a pointer to the loaded/resolved fr_dict_t.
Definition: dict.h:280
fr_dict_enum_by_name
fr_dict_enum_value_t * fr_dict_enum_by_name(fr_dict_attr_t const *da, char const *name, ssize_t len)
Definition: dict_util.c:3395
in
static fr_slen_t in
Definition: dict.h:821
fr_dict_attr_autoload_t
Specifies an attribute which must be present for the module to function.
Definition: dict.h:266
fr_dict_autoload_t
Specifies a dictionary which must be loaded/loadable for the module to function.
Definition: dict.h:279
value
Test enumeration values.
Definition: dict_test.h:92
MODULE_MAGIC_INIT
#define MODULE_MAGIC_INIT
Stop people using different module/library/server versions together.
Definition: dl_module.h:63
EXEC_TIMEOUT
#define EXEC_TIMEOUT
Default wait time for exec calls (in seconds).
Definition: exec.h:32
radius_exec_program_legacy
int radius_exec_program_legacy(char *out, size_t outlen, request_t *request, char const *cmd, fr_pair_list_t *input_pairs, bool exec_wait, bool shell_escape, fr_time_delta_t timeout)
Execute a program.
Definition: exec_legacy.c:474
radius_start_program_legacy
pid_t radius_start_program_legacy(int *stdin_fd, int *stdout_fd, int *stderr_fd, char const *cmd, request_t *request, bool exec_wait, fr_pair_list_t *input_pairs, bool shell_escape)
Start a process.
Definition: exec_legacy.c:227
radius_readfrom_program_legacy
int radius_readfrom_program_legacy(int fd, pid_t pid, fr_time_delta_t timeout, char *answer, int left)
Read from the child process.
Definition: exec_legacy.c:357
unlang_function_push
#define unlang_function_push(_request, _func, _repeat, _signal, _sigmask, _top_frame, _uctx)
Push a generic function onto the unlang stack.
Definition: function.h:111
mschap_xlat
static xlat_action_t mschap_xlat(TALLOC_CTX *ctx, fr_dcursor_t *out, xlat_ctx_t const *xctx, request_t *request, fr_value_box_list_t *in)
Get data from MSCHAP attributes.
Definition: rlm_mschap.c:381
unlang_interpret_frame_talloc_ctx
TALLOC_CTX * unlang_interpret_frame_talloc_ctx(request_t *request)
Get a talloc_ctx which is valid only for this frame.
Definition: interpret.c:1403
UNLANG_SUB_FRAME
#define UNLANG_SUB_FRAME
Definition: interpret.h:36
REXDENT
#define REXDENT()
Exdent (unindent) R* messages by one level.
Definition: log.h:443
RHEXDUMP1
#define RHEXDUMP1(_data, _len, _fmt,...)
Definition: log.h:703
RWDEBUG
#define RWDEBUG(fmt,...)
Definition: log.h:361
RDEBUG_ENABLED3
#define RDEBUG_ENABLED3
True if request debug level 1-3 messages are enabled.
Definition: log.h:335
RDEBUG3
#define RDEBUG3(fmt,...)
Definition: log.h:343
RWDEBUG2
#define RWDEBUG2(fmt,...)
Definition: log.h:362
RERROR
#define RERROR(fmt,...)
Definition: log.h:298
RPERROR
#define RPERROR(fmt,...)
Definition: log.h:302
REDEBUG2
#define REDEBUG2(fmt,...)
Definition: log.h:372
RINDENT
#define RINDENT()
Indent R* messages by one level.
Definition: log.h:430
waitpid
waitpid(reap->pid_ev->pid, &status, 0)
talloc_free
talloc_free(reap)
fr_md4_calc
void fr_md4_calc(uint8_t out[static MD4_DIGEST_LENGTH], uint8_t const *in, size_t inlen)
Calculate the MD4 hash of the contents of a buffer.
Definition: md4.c:482
MD4_DIGEST_LENGTH
#define MD4_DIGEST_LENGTH
Definition: md4.h:25
FR_TYPE_STRING
@ FR_TYPE_STRING
String of printable characters.
Definition: merged_model.c:83
FR_TYPE_UINT8
@ FR_TYPE_UINT8
8 Bit unsigned integer.
Definition: merged_model.c:97
FR_TYPE_UINT32
@ FR_TYPE_UINT32
32 Bit unsigned integer.
Definition: merged_model.c:99
FR_TYPE_VOID
@ FR_TYPE_VOID
User data.
Definition: merged_model.c:127
FR_TYPE_OCTETS
@ FR_TYPE_OCTETS
Raw octets.
Definition: merged_model.c:84
ssize_t
long int ssize_t
Definition: merged_model.c:24
uint8_t
unsigned char uint8_t
Definition: merged_model.c:30
fr_dict_attr_t
Definition: merged_model.c:133
fr_dict_t
Definition: merged_model.c:198
fr_value_box_t
Definition: merged_model.c:136
request_t
Definition: merged_model.c:210
tmpl_t
Definition: merged_model.c:225
fr_digest_cmp
int fr_digest_cmp(uint8_t const *a, uint8_t const *b, size_t length)
Do a comparison of two authentication digests by comparing the FULL data.
Definition: misc.c:472
strncasecmp
int strncasecmp(char *s1, char *s2, int n)
Definition: missing.c:36
strcasecmp
int strcasecmp(char *s1, char *s2)
Definition: missing.c:66
strsep
char * strsep(char **stringp, char const *delim)
Definition: missing.c:123
module_ctx_t::env_data
void * env_data
Per call environment data.
Definition: module_ctx.h:44
module_ctx_t::mi
module_instance_t const * mi
Instance of the module being instantiated.
Definition: module_ctx.h:42
MODULE_INST_CTX
#define MODULE_INST_CTX(_mi)
Wrapper to create a module_inst_ctx_t as a compound literal.
Definition: module_ctx.h:158
module_inst_ctx_t::mi
module_instance_t * mi
Instance of the module being instantiated.
Definition: module_ctx.h:51
module_ctx_t
Temporary structure to hold arguments for module calls.
Definition: module_ctx.h:41
module_detach_ctx_t
Temporary structure to hold arguments for detach calls.
Definition: module_ctx.h:56
module_inst_ctx_t
Temporary structure to hold arguments for instantiation calls.
Definition: module_ctx.h:50
module_rlm_section_type_set
bool module_rlm_section_type_set(request_t *request, fr_dict_attr_t const *type_da, fr_dict_enum_value_t const *enumv)
Set the next section type if it's not already set.
Definition: module_rlm.c:427
module_rlm_connection_pool_init
fr_pool_t * module_rlm_connection_pool_init(CONF_SECTION *module, void *opaque, fr_pool_connection_create_t c, fr_pool_connection_alive_t a, char const *log_prefix, char const *trigger_prefix, fr_pair_list_t *trigger_args)
Initialise a module specific connection pool.
Definition: module_rlm.c:308
module_rlm_xlat_register
xlat_t * module_rlm_xlat_register(TALLOC_CTX *ctx, module_inst_ctx_t const *mctx, char const *name, xlat_func_t func, fr_type_t return_type)
Definition: module_rlm.c:257
module_rlm_s::common
module_t common
Common fields presented by all modules.
Definition: module_rlm.h:39
module_rlm_s
Definition: module_rlm.h:38
mschap_nt_password_hash
int mschap_nt_password_hash(uint8_t out[static NT_DIGEST_LENGTH], char const *password)
Converts Unicode password to 16-byte NT hash with MD4.
Definition: mschap.c:52
mschap_add_reply
void mschap_add_reply(request_t *request, uint8_t ident, fr_dict_attr_t const *da, char const *value, size_t len)
Definition: mschap.c:162
mschap_auth_response
void mschap_auth_response(char const *username, size_t username_len, uint8_t const *nt_hash_hash, uint8_t const *ntresponse, uint8_t const *peer_challenge, uint8_t const *auth_challenge, char *response)
Definition: mschap.c:101
mschap_challenge_hash
void mschap_challenge_hash(uint8_t challenge[static MSCHAP_CHALLENGE_LENGTH], uint8_t const peer_challenge[static MSCHAP_PEER_CHALLENGE_LENGTH], uint8_t const auth_challenge[static MSCHAP_PEER_AUTHENTICATOR_CHALLENGE_LENGTH], char const *user_name, size_t user_name_len)
Definition: mschap.c:72
LM_DIGEST_LENGTH
#define LM_DIGEST_LENGTH
Definition: mschap.h:8
NT_DIGEST_LENGTH
#define NT_DIGEST_LENGTH
Definition: mschap.h:7
fr_pair_find_by_da
fr_pair_t * fr_pair_find_by_da(fr_pair_list_t const *list, fr_pair_t const *prev, fr_dict_attr_t const *da)
Find the first pair with a matching da.
Definition: pair.c:693
fr_pair_parent
fr_pair_t * fr_pair_parent(fr_pair_t const *vp)
Return a pointer to the parent pair.
Definition: pair.c:942
fr_pair_afrom_da
fr_pair_t * fr_pair_afrom_da(TALLOC_CTX *ctx, fr_dict_attr_t const *da)
Dynamically allocate a new attribute and assign a fr_dict_attr_t.
Definition: pair.c:283
fr_pair_value_memdup
int fr_pair_value_memdup(fr_pair_t *vp, uint8_t const *src, size_t len, bool tainted)
Copy data into an "octets" data type.
Definition: pair.c:2981
fr_pair_value_bstr_alloc
int fr_pair_value_bstr_alloc(fr_pair_t *vp, char **out, size_t size, bool tainted)
Pre-allocate a memory buffer for a "string" type value pair.
Definition: pair.c:2730
fr_pair_find_by_da_nested
fr_pair_t * fr_pair_find_by_da_nested(fr_pair_list_t const *list, fr_pair_t const *prev, fr_dict_attr_t const *da)
Find a pair with a matching fr_dict_attr_t, by walking the nested fr_dict_attr_t tree.
Definition: pair.c:770
fr_pair_value_mem_alloc
int fr_pair_value_mem_alloc(fr_pair_t *vp, uint8_t **out, size_t size, bool tainted)
Pre-allocate a memory buffer for a "octets" type value pair.
Definition: pair.c:2930
normify
static ssize_t normify(normalise_t *action, uint8_t *buffer, size_t bufflen, char const *known_good, size_t len, size_t min_len)
Definition: password.c:400
password_find
fr_pair_t * password_find(bool *ephemeral, TALLOC_CTX *ctx, request_t *request, fr_dict_attr_t const *allowed_attrs[], size_t allowed_attrs_len, bool normify)
Find a "known good" password in the control list of a request.
Definition: password.c:954
fr_pool_free
void fr_pool_free(fr_pool_t *pool)
Delete a connection pool.
Definition: pool.c:1329
config
static const conf_parser_t config[]
Definition: base.c:183
attr_user_name
static fr_dict_attr_t const * attr_user_name
Definition: radclient-ng.c:128
pair_update_request
#define pair_update_request(_attr, _da)
Definition: radclient-ng.c:60
done
static bool done
Definition: radclient.c:80
REDEBUG
#define REDEBUG(fmt,...)
Definition: radclient.h:52
RDEBUG2
#define RDEBUG2(fmt,...)
Definition: radclient.h:54
WARN
#define WARN(fmt,...)
Definition: radclient.h:47
conf
static rs_t * conf
Definition: radsniff.c:53
fr_rand
uint32_t fr_rand(void)
Return a 32-bit random number.
Definition: rand.c:106
RETURN_MODULE_REJECT
#define RETURN_MODULE_REJECT
Definition: rcode.h:55
RETURN_MODULE_NOOP
#define RETURN_MODULE_NOOP
Definition: rcode.h:62
RETURN_MODULE_RCODE
#define RETURN_MODULE_RCODE(_rcode)
Definition: rcode.h:64
RETURN_MODULE_INVALID
#define RETURN_MODULE_INVALID
Definition: rcode.h:59
RETURN_MODULE_OK
#define RETURN_MODULE_OK
Definition: rcode.h:57
rlm_rcode_t
rlm_rcode_t
Return codes indicating the result of the module call.
Definition: rcode.h:40
RLM_MODULE_INVALID
@ RLM_MODULE_INVALID
The module considers the request invalid.
Definition: rcode.h:45
RLM_MODULE_OK
@ RLM_MODULE_OK
The module is OK, continue.
Definition: rcode.h:43
RLM_MODULE_DISALLOW
@ RLM_MODULE_DISALLOW
Reject the request (user is locked out).
Definition: rcode.h:46
RLM_MODULE_REJECT
@ RLM_MODULE_REJECT
Immediately reject the request.
Definition: rcode.h:41
RLM_MODULE_NOTFOUND
@ RLM_MODULE_NOTFOUND
User not found.
Definition: rcode.h:47
RLM_MODULE_NOOP
@ RLM_MODULE_NOOP
Module succeeded without doing anything.
Definition: rcode.h:48
_mod_conn_free
static int _mod_conn_free(rlm_cache_memcached_handle_t *mandle)
Free a connection handle.
Definition: rlm_cache_memcached.c:55
mod_conn_create
static void * mod_conn_create(TALLOC_CTX *ctx, void *instance, fr_time_delta_t timeout)
Create a new memcached handle.
Definition: rlm_cache_memcached.c:65
SHSpad2
static const uint8_t SHSpad2[40]
Definition: rlm_mschap.c:1268
attr_smb_account_ctrl
fr_dict_attr_t const * attr_smb_account_ctrl
Definition: rlm_mschap.c:256
mschap_cpw_ctx_t::new_nt_encrypted
uint8_t new_nt_encrypted[516]
Definition: rlm_mschap.c:220
mschap_xlat_call_env_t::username
tmpl_t const * username
Definition: rlm_mschap.c:151
CHECK_OPTION
#define CHECK_OPTION(_option)
xlat_call_env
static const call_env_parser_t xlat_call_env[]
Definition: rlm_mschap.c:157
mppe_chap2_get_keys128
static void mppe_chap2_get_keys128(uint8_t const *nt_hashhash, uint8_t const *nt_response, uint8_t *sendkey, uint8_t *recvkey)
Definition: rlm_mschap.c:1344
mppe_add_reply
static void mppe_add_reply(UNUSED rlm_mschap_t const *inst, request_t *request, fr_dict_attr_t const *da, uint8_t const *value, size_t len)
Definition: rlm_mschap.c:822
attr_nt_password
fr_dict_attr_t const * attr_nt_password
Definition: rlm_mschap.c:254
attr_ms_chap_new_cleartext_password
fr_dict_attr_t const * attr_ms_chap_new_cleartext_password
Definition: rlm_mschap.c:249
rlm_mschap_dict
fr_dict_autoload_t rlm_mschap_dict[]
Definition: rlm_mschap.c:240
ACB_MNS
#define ACB_MNS
MNS logon user account.
Definition: rlm_mschap.c:75
auth_call_env
static const call_env_parser_t auth_call_env[]
Definition: rlm_mschap.c:165
mschap_xlat_call_env_t::chap_response
tmpl_t const * chap_response
Definition: rlm_mschap.c:153
mschap_autz_call_env_t::chap2_cpw
tmpl_t const * chap2_cpw
Definition: rlm_mschap.c:205
mschap_auth_ctx_t::method
MSCHAP_AUTH_METHOD method
Definition: rlm_mschap.c:229
attr_eap_identity
fr_dict_attr_t const * attr_eap_identity
Definition: rlm_mschap.c:248
mschap_autz_call_env_t::chap2_response
tmpl_t const * chap2_response
Definition: rlm_mschap.c:204
ACB_AUTOLOCK
#define ACB_AUTOLOCK
Account auto locked.
Definition: rlm_mschap.c:80
MSCHAP_CALL_ENV
#define MSCHAP_CALL_ENV(_x)
Definition: rlm_mschap.c:130
attr_smb_account_ctrl_text
fr_dict_attr_t const * attr_smb_account_ctrl_text
Definition: rlm_mschap.c:255
autz_call_env
static const call_env_parser_t autz_call_env[]
Definition: rlm_mschap.c:208
ACB_TEMPDUP
#define ACB_TEMPDUP
Temporary duplicate account.
Definition: rlm_mschap.c:73
mschap_auth_ctx_t::cpw
fr_pair_t * cpw
Definition: rlm_mschap.c:232
pdb_decode_acct_ctrl
static int pdb_decode_acct_ctrl(char const *p)
Definition: rlm_mschap.c:290
dict_freeradius
static fr_dict_t const * dict_freeradius
Definition: rlm_mschap.c:236
mppe_GetMasterKey
static void mppe_GetMasterKey(uint8_t const *nt_hashhash, uint8_t const *nt_response, uint8_t *masterkey)
Definition: rlm_mschap.c:1302
mschap_auth_method_env
static const call_env_method_t mschap_auth_method_env
Definition: rlm_mschap.c:180
mschap_identity_find
static fr_pair_t * mschap_identity_find(request_t *request, fr_dict_attr_t const *attr_user_name)
Definition: rlm_mschap.c:275
mschap_auth_ctx_t::name
char const * name
Definition: rlm_mschap.c:226
nt_password_find
static int nt_password_find(TALLOC_CTX *ctx, fr_pair_t **out, rlm_mschap_t const *inst, request_t *request)
Find a Password.NT value, or create one from a Password.Cleartext, or Password.With-Header attribute.
Definition: rlm_mschap.c:1515
ACB_FR_EXPIRED
#define ACB_FR_EXPIRED
Password Expired.
Definition: rlm_mschap.c:81
ACB_DISABLED
#define ACB_DISABLED
User account disabled.
Definition: rlm_mschap.c:70
mschap_cpw_ctx_t::new_hash
fr_pair_t * new_hash
Definition: rlm_mschap.c:222
mschap_process_response
static unlang_action_t mschap_process_response(rlm_rcode_t *p_result, int *mschap_version, uint8_t nthashhash[static NT_DIGEST_LENGTH], rlm_mschap_t const *inst, request_t *request, fr_pair_t *smb_ctrl, fr_pair_t *nt_password, fr_pair_t *challenge, fr_pair_t *response, MSCHAP_AUTH_METHOD method, mschap_auth_call_env_t *env_data)
Definition: rlm_mschap.c:1735
dict_radius
static fr_dict_t const * dict_radius
Definition: rlm_mschap.c:237
magic1
static const uint8_t magic1[27]
Definition: rlm_mschap.c:1274
mod_authenticate
static unlang_action_t mod_authenticate(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
Definition: rlm_mschap.c:2266
mod_bootstrap
static int mod_bootstrap(module_inst_ctx_t const *mctx)
Definition: rlm_mschap.c:2491
SHSpad1
static const uint8_t SHSpad1[40]
Definition: rlm_mschap.c:1262
attr_auth_type
fr_dict_attr_t const * attr_auth_type
Definition: rlm_mschap.c:246
mod_detach
static int mod_detach(UNUSED module_detach_ctx_t const *mctx)
Definition: rlm_mschap.c:2505
attr_ms_chap_user_name
fr_dict_attr_t const * attr_ms_chap_user_name
Definition: rlm_mschap.c:253
mschap_auth_ctx_t::inst
rlm_mschap_t const * inst
Definition: rlm_mschap.c:227
mschap_autz_call_env_t::chap_response
tmpl_t const * chap_response
Definition: rlm_mschap.c:203
mschap_cpw_ctx_t::cpw_user
fr_value_box_list_t cpw_user
Definition: rlm_mschap.c:217
mschap_cpw_ctx_t::cpw_domain
fr_value_box_list_t cpw_domain
Definition: rlm_mschap.c:218
mppe_GetAsymmetricStartKey
static void mppe_GetAsymmetricStartKey(uint8_t *masterkey, uint8_t *sesskey, int keylen, int issend)
Definition: rlm_mschap.c:1318
mschap_xlat_args
static xlat_arg_parser_t const mschap_xlat_args[]
Definition: rlm_mschap.c:368
mschap_auth_ctx_t::smb_ctrl
fr_pair_t * smb_ctrl
Definition: rlm_mschap.c:231
attr_ms_chap_use_ntlm_auth
fr_dict_attr_t const * attr_ms_chap_use_ntlm_auth
Definition: rlm_mschap.c:252
ACB_HOMDIRREQ
#define ACB_HOMDIRREQ
Home directory required.
Definition: rlm_mschap.c:71
mschap_xlat_call_env_t::chap2_response
tmpl_t const * chap2_response
Definition: rlm_mschap.c:154
mschap_cpw_ctx_t::local_cpw_result
fr_value_box_list_t local_cpw_result
Definition: rlm_mschap.c:219
rlm_mschap
module_rlm_t rlm_mschap
Definition: rlm_mschap.c:2522
write_all
static int write_all(int fd, char const *buf, size_t len)
Definition: rlm_mschap.c:837
attr_cleartext_password
fr_dict_attr_t const * attr_cleartext_password
Definition: rlm_mschap.c:247
mod_authorize
static unlang_action_t mod_authorize(rlm_rcode_t *p_result, module_ctx_t const *mctx, request_t *request)
Definition: rlm_mschap.c:1382
rlm_mschap_dict_attr
fr_dict_attr_autoload_t rlm_mschap_dict_attr[]
Definition: rlm_mschap.c:259
mod_authenticate_resume
static unlang_action_t mod_authenticate_resume(rlm_rcode_t *p_result, UNUSED int *priority, request_t *request, void *uctx)
Complete mschap authentication after any tmpls have been expanded.
Definition: rlm_mschap.c:1949
mschap_process_v2_response
static unlang_action_t mschap_process_v2_response(rlm_rcode_t *p_result, int *mschap_version, uint8_t nthashhash[static NT_DIGEST_LENGTH], rlm_mschap_t const *inst, request_t *request, fr_pair_t *smb_ctrl, fr_pair_t *nt_password, fr_pair_t *challenge, fr_pair_t *response, MSCHAP_AUTH_METHOD method, mschap_auth_call_env_t *env_data)
Definition: rlm_mschap.c:1793
mschap_auth_ctx_t::env_data
mschap_auth_call_env_t * env_data
Definition: rlm_mschap.c:228
magic3
static const uint8_t magic3[84]
Definition: rlm_mschap.c:1290
do_mschap_cpw
static int do_mschap_cpw(rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx, uint8_t *new_nt_password, uint8_t *old_nt_hash)
Definition: rlm_mschap.c:856
magic2
static const uint8_t magic2[84]
Definition: rlm_mschap.c:1279
do_mschap
static int do_mschap(rlm_mschap_t const *inst, request_t *request, fr_pair_t *password, uint8_t const *challenge, uint8_t const *response, uint8_t nthashhash[static NT_DIGEST_LENGTH], MSCHAP_AUTH_METHOD method, UNUSED mschap_auth_call_env_t *env_data)
Definition: rlm_mschap.c:1068
ACB_DOMTRUST
#define ACB_DOMTRUST
Interdomain trust account.
Definition: rlm_mschap.c:76
mschap_cpw_ctx_t::old_nt_hash
uint8_t old_nt_hash[NT_DIGEST_LENGTH]
Definition: rlm_mschap.c:221
ACB_WSTRUST
#define ACB_WSTRUST
Workstation trust account.
Definition: rlm_mschap.c:77
mppe_chap2_gen_keys128
static void mppe_chap2_gen_keys128(uint8_t const *nt_hashhash, uint8_t const *response, uint8_t *sendkey, uint8_t *recvkey)
Definition: rlm_mschap.c:1358
attr_ms_chap_new_nt_password
fr_dict_attr_t const * attr_ms_chap_new_nt_password
Definition: rlm_mschap.c:250
ACB_NORMAL
#define ACB_NORMAL
Normal user account.
Definition: rlm_mschap.c:74
mschap_auth_ctx_t::cpw_ctx
mschap_cpw_ctx_t * cpw_ctx
Definition: rlm_mschap.c:233
mschap_xlat_call_env_t::chap_challenge
tmpl_t const * chap_challenge
Definition: rlm_mschap.c:152
ACB_PWNOTREQ
#define ACB_PWNOTREQ
User password not required.
Definition: rlm_mschap.c:72
mschap_error
static unlang_action_t mschap_error(rlm_rcode_t *p_result, rlm_mschap_t const *inst, request_t *request, unsigned char ident, int mschap_result, int mschap_version, fr_pair_t *smb_ctrl, mschap_auth_call_env_t *env_data)
Definition: rlm_mschap.c:1417
module_config
static const conf_parser_t module_config[]
Definition: rlm_mschap.c:96
mschap_process_cpw_request
static unlang_action_t mschap_process_cpw_request(rlm_rcode_t *p_result, rlm_mschap_t const *inst, request_t *request, mschap_auth_ctx_t *auth_ctx)
Definition: rlm_mschap.c:1602
mod_authenticate_domain_tmpl_push
static unlang_action_t mod_authenticate_domain_tmpl_push(rlm_rcode_t *p_result, UNUSED int *priority, request_t *request, void *uctx)
When changing passwords using the ntlm_auth helper, evaluate the domain tmpl.
Definition: rlm_mschap.c:2098
mschap_auth_ctx_t::nt_password
fr_pair_t * nt_password
Definition: rlm_mschap.c:230
attr_ms_chap_peer_challenge
fr_dict_attr_t const * attr_ms_chap_peer_challenge
Definition: rlm_mschap.c:251
mschap_cpw_prepare
static int mschap_cpw_prepare(request_t *request, mschap_auth_ctx_t *auth_ctx)
Validate data required for change password requests.
Definition: rlm_mschap.c:1635
MSCHAP_OPT_CALL_ENV
#define MSCHAP_OPT_CALL_ENV(_opt, _x)
Definition: rlm_mschap.c:147
mod_instantiate
static int mod_instantiate(module_inst_ctx_t const *mctx)
Definition: rlm_mschap.c:2391
ACB_PWNOEXP
#define ACB_PWNOEXP
User password does not expire.
Definition: rlm_mschap.c:79
passchange_config
static const conf_parser_t passchange_config[]
Definition: rlm_mschap.c:83
mschap_autz_call_env_t::chap_challenge
tmpl_t const * chap_challenge
Definition: rlm_mschap.c:202
MSCHAP_COMMON_CALL_ENV
#define MSCHAP_COMMON_CALL_ENV(_x)
Definition: rlm_mschap.c:139
ACB_SVRTRUST
#define ACB_SVRTRUST
Server trust account.
Definition: rlm_mschap.c:78
winbind_config
static const conf_parser_t winbind_config[]
Definition: rlm_mschap.c:88
mschap_auth_ctx_t
Definition: rlm_mschap.c:225
mschap_autz_call_env_t
Definition: rlm_mschap.c:201
mschap_cpw_ctx_t
Definition: rlm_mschap.c:216
mschap_xlat_call_env_t
Definition: rlm_mschap.c:150
rlm_mschap.h
mschap_auth_call_env_t::mppe_encryption_types
tmpl_t const * mppe_encryption_types
Definition: rlm_mschap.h:79
mschap_auth_call_env_t::ntlm_cpw_domain
tmpl_t const * ntlm_cpw_domain
Definition: rlm_mschap.h:85
mschap_auth_call_env_t::ntlm_cpw_username
tmpl_t const * ntlm_cpw_username
Definition: rlm_mschap.h:84
mschap_auth_call_env_t::chap_nt_enc_pw
tmpl_t const * chap_nt_enc_pw
Definition: rlm_mschap.h:81
mschap_auth_call_env_t::mppe_send_key
tmpl_t const * mppe_send_key
Definition: rlm_mschap.h:78
mschap_auth_call_env_t::chap_response
tmpl_t const * chap_response
Definition: rlm_mschap.h:72
mschap_auth_call_env_t::local_cpw
tmpl_t const * local_cpw
Definition: rlm_mschap.h:86
mschap_auth_call_env_t::chap_challenge
tmpl_t const * chap_challenge
Definition: rlm_mschap.h:71
mschap_auth_call_env_t::chap2_response
tmpl_t const * chap2_response
Definition: rlm_mschap.h:73
mschap_auth_call_env_t::mppe_encryption_policy
tmpl_t const * mppe_encryption_policy
Definition: rlm_mschap.h:76
mschap_auth_call_env_t::mppe_recv_key
tmpl_t const * mppe_recv_key
Definition: rlm_mschap.h:77
mschap_auth_call_env_t::chap_error
tmpl_t const * chap_error
Definition: rlm_mschap.h:70
mschap_auth_call_env_t::chap2_cpw
tmpl_t const * chap2_cpw
Definition: rlm_mschap.h:80
MSCHAP_AUTH_METHOD
MSCHAP_AUTH_METHOD
Definition: rlm_mschap.h:17
AUTH_AUTO
@ AUTH_AUTO
Definition: rlm_mschap.h:20
AUTH_INTERNAL
@ AUTH_INTERNAL
Definition: rlm_mschap.h:18
AUTH_NTLMAUTH_EXEC
@ AUTH_NTLMAUTH_EXEC
Definition: rlm_mschap.h:19
mschap_auth_call_env_t::chap_mppe_keys
tmpl_t const * chap_mppe_keys
Definition: rlm_mschap.h:75
mschap_auth_call_env_t
Definition: rlm_mschap.h:68
rlm_mschap_t
Definition: rlm_mschap.h:41
instantiate
static int instantiate(module_inst_ctx_t const *mctx)
Definition: rlm_rest.c:1302
username
username
Definition: rlm_securid.c:420
FR_SBUFF_IN
#define FR_SBUFF_IN(_start, _len_or_end)
FR_SBUFF_OUT
#define FR_SBUFF_OUT(_start, _len_or_end)
SECTION_NAME
#define SECTION_NAME(_name1, _name2)
Define a section name consisting of a verb and a noun.
Definition: section.h:40
module_instance_s::name
char const * name
Instance name e.g. user_database.
Definition: module.h:335
module_instance_s::conf
CONF_SECTION * conf
Module's instance configuration.
Definition: module.h:329
module_instance_s::data
void * data
Module's instance data.
Definition: module.h:271
module_instance_s::boot
void * boot
Data allocated during the boostrap phase.
Definition: module.h:274
MODULE_BINDING_TERMINATOR
#define MODULE_BINDING_TERMINATOR
Terminate a module binding list.
Definition: module.h:151
module_instance_s
Module instance data.
Definition: module.h:265
module_method_binding_s
Named methods exported by a module.
Definition: module.h:173
pair_append_control
#define pair_append_control(_attr, _da)
Allocate and append a fr_pair_t to the control list.
Definition: pair.h:57
pair_update_reply
#define pair_update_reply(_attr, _da)
Return or allocate a fr_pair_t in the reply list.
Definition: pair.h:129
tmpl_attr_tail_da
static fr_dict_attr_t const * tmpl_attr_tail_da(tmpl_t const *vpt)
Return the last attribute reference da.
Definition: tmpl.h:812
fr_sha1_init
void fr_sha1_init(fr_sha1_ctx *context)
Definition: sha1.c:93
fr_sha1_final
void fr_sha1_final(uint8_t digest[static SHA1_DIGEST_LENGTH], fr_sha1_ctx *context)
Definition: sha1.c:141
fr_sha1_update
void fr_sha1_update(fr_sha1_ctx *context, uint8_t const *in, size_t len)
Definition: sha1.c:105
fr_sha1_ctx
Definition: sha1.h:33
smbhash
void smbhash(unsigned char *out, unsigned char const *in, unsigned char *key)
Definition: smbdes.c:287
smbdes_mschap
void smbdes_mschap(uint8_t const win_password[16], uint8_t const *challenge, uint8_t *response)
Definition: smbdes.c:339
smbdes_lmpwdhash
void smbdes_lmpwdhash(char const *password, uint8_t *lmhash)
Definition: smbdes.c:319
snprintf
PUBLIC int snprintf(char *string, size_t length, char *format, va_alist)
Definition: snprintf.c:689
RETURN_MODULE_FAIL
RETURN_MODULE_FAIL
Definition: state_machine.c:1215
fr_assert
fr_assert(0)
MEM
MEM(pair_append_request(&vp, attr_eap_aka_sim_identity) >=0)
inst
eap_aka_sim_process_conf_t * inst
Definition: state_machine.c:3620
vp
fr_pair_t * vp
Definition: state_machine.c:2262
value_pair_s
Stores an attribute, a value and various bits of other data.
Definition: pair.h:68
value_pair_s::da
fr_dict_attr_t const *_CONST da
Dictionary attribute defines the attribute number, vendor and type of the pair.
Definition: pair.h:69
fr_syserror
char const * fr_syserror(int num)
Guaranteed to be thread-safe version of strerror.
Definition: syserror.c:243
talloc_get_type_abort_const
#define talloc_get_type_abort_const
Definition: talloc.h:282
fr_time_delta_lt
#define fr_time_delta_lt(_a, _b)
Definition: time.h:285
fr_time_delta_from_sec
static fr_time_delta_t fr_time_delta_from_sec(int64_t sec)
Definition: time.h:590
fr_time_delta_ispos
#define fr_time_delta_ispos(_a)
Definition: time.h:290
fr_time_delta_gt
#define fr_time_delta_gt(_a, _b)
Definition: time.h:283
fr_time_delta_s
A time delta, a difference in time measured in nanoseconds.
Definition: time.h:80
unlang_tmpl_push
int unlang_tmpl_push(TALLOC_CTX *ctx, fr_value_box_list_t *out, request_t *request, tmpl_t const *tmpl, unlang_tmpl_args_t *args)
Push a tmpl onto the stack for evaluation.
Definition: tmpl.c:259
T_BARE_WORD
@ T_BARE_WORD
Definition: token.h:120
close
close(uq->fd)
xlat_arg_parser_t::required
bool required
Argument must be present, and non-empty.
Definition: xlat.h:146
XLAT_ARG_PARSER_TERMINATOR
#define XLAT_ARG_PARSER_TERMINATOR
Definition: xlat.h:166
xlat_action_t
xlat_action_t
Definition: xlat.h:35
XLAT_ACTION_FAIL
@ XLAT_ACTION_FAIL
An xlat function failed.
Definition: xlat.h:42
XLAT_ACTION_DONE
@ XLAT_ACTION_DONE
We're done evaluating this level of nesting.
Definition: xlat.h:41
xlat_arg_parser_t
Definition for a single argument consumend by an xlat function.
Definition: xlat.h:145
parent
static fr_slen_t parent
Definition: pair.h:851
fr_value_box_asprintf
int fr_value_box_asprintf(TALLOC_CTX *ctx, fr_value_box_t *dst, fr_dict_attr_t const *enumv, bool tainted, char const *fmt,...)
Print a formatted string using our internal printf wrapper and assign it to a value box.
Definition: value.c:4014
fr_value_box_strdup
int fr_value_box_strdup(TALLOC_CTX *ctx, fr_value_box_t *dst, fr_dict_attr_t const *enumv, char const *src, bool tainted)
Copy a nul terminated string to a fr_value_box_t.
Definition: value.c:3927
fr_value_box_memdup
int fr_value_box_memdup(TALLOC_CTX *ctx, fr_value_box_t *dst, fr_dict_attr_t const *enumv, uint8_t const *src, size_t len, bool tainted)
Copy a buffer to a fr_value_box_t.
Definition: value.c:4468
data
static fr_slen_t data
Definition: value.h:1265
fr_box_strvalue_len
#define fr_box_strvalue_len(_val, _len)
Definition: value.h:286
fr_box_time_delta
#define fr_box_time_delta(_val)
Definition: value.h:343
nonnull
int nonnull(2, 5))
fr_value_box_alloc_null
#define fr_value_box_alloc_null(_ctx)
Allocate a value box for later use with a value assignment function.
Definition: value.h:632
out
static size_t char ** out
Definition: value.h:997
fr_box_octets
#define fr_box_octets(_val, _len)
Definition: value.h:288
xlat_ctx_s::env_data
void * env_data
Expanded call env data.
Definition: xlat_ctx.h:53
xlat_ctx_s::mctx
module_ctx_t const * mctx
Synthesised module calling ctx.
Definition: xlat_ctx.h:52
xlat_ctx_s
An xlat calling ctx.
Definition: xlat_ctx.h:49
xlat_func_args_set
int xlat_func_args_set(xlat_t *x, xlat_arg_parser_t const args[])
Register the arguments of an xlat.
Definition: xlat_func.c:365
xlat_func_call_env_set
void xlat_func_call_env_set(xlat_t *x, call_env_method_t const *env_method)
Register call environment of an xlat.
Definition: xlat_func.c:392
xlat_s
Definition: xlat_priv.h:59
Generated by   doxygen 1.9.1