1 |
/* This file is part of GNU RADIUS. |
/* This file is part of GNU Radius |
2 |
Copyright (C) 2000,2001, Sergey Poznyakoff |
Copyright (C) 2000,2001,2002,2003 Sergey Poznyakoff |
3 |
|
|
4 |
This program is free software; you can redistribute it and/or modify |
GNU Radius is free software; you can redistribute it and/or modify |
5 |
it under the terms of the GNU General Public License as published by |
it under the terms of the GNU General Public License as published by |
6 |
the Free Software Foundation; either version 2 of the License, or |
the Free Software Foundation; either version 2 of the License, or |
7 |
(at your option) any later version. |
(at your option) any later version. |
8 |
|
|
9 |
This program is distributed in the hope that it will be useful, |
GNU Radius is distributed in the hope that it will be useful, |
10 |
but WITHOUT ANY WARRANTY; without even the implied warranty of |
but WITHOUT ANY WARRANTY; without even the implied warranty of |
11 |
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
12 |
GNU General Public License for more details. |
GNU General Public License for more details. |
13 |
|
|
14 |
You should have received a copy of the GNU General Public License |
You should have received a copy of the GNU General Public License |
15 |
along with this program; if not, write to the Free Software Foundation, |
along with GNU Radius; if not, write to the Free Software Foundation, |
16 |
Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. */ |
Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. */ |
17 |
|
|
18 |
#define RADIUS_MODULE_AUTH_C |
#define RADIUS_MODULE_AUTH_C |
|
#ifndef lint |
|
|
static char rcsid[] = |
|
|
"@(#) $Id$"; |
|
|
#endif |
|
19 |
|
|
20 |
#ifdef HAVE_CONFIG_H |
#ifdef HAVE_CONFIG_H |
21 |
# include <config.h> |
# include <config.h> |
74 |
* otherwise 0 for success and -1 for failure. |
* otherwise 0 for success and -1 for failure. |
75 |
*/ |
*/ |
76 |
static int |
static int |
77 |
pw_expired(exptime) |
pw_expired(UINT4 exptime) |
|
UINT4 exptime; |
|
78 |
{ |
{ |
79 |
struct timeval tp; |
struct timeval tp; |
80 |
struct timezone tzp; |
struct timezone tzp; |
104 |
* array |
* array |
105 |
*/ |
*/ |
106 |
int |
int |
107 |
check_user_name(p) |
check_user_name(char *p) |
|
char *p; |
|
108 |
{ |
{ |
109 |
for (; *p && (isalnum(*p) || strchr(username_valid_chars, *p)); p++) |
for (; *p && (isalnum(*p) || strchr(username_valid_chars, *p)); p++) |
110 |
; |
; |
117 |
* Check the users password against UNIX password database. |
* Check the users password against UNIX password database. |
118 |
*/ |
*/ |
119 |
int |
int |
120 |
unix_pass(name, passwd) |
unix_pass(char *name, char *passwd) |
|
char *name; |
|
|
char *passwd; |
|
121 |
{ |
{ |
122 |
int rc; |
int rc; |
123 |
struct passwd *pwd; |
struct passwd *pwd; |
217 |
* AUTH_IGNORE Silently ignored |
* AUTH_IGNORE Silently ignored |
218 |
*/ |
*/ |
219 |
int |
int |
220 |
rad_check_password(radreq, check_item, namepair, user_msg, userpass) |
rad_check_password(RADIUS_REQ *radreq, VALUE_PAIR *check_item, |
221 |
RADIUS_REQ *radreq; |
VALUE_PAIR *namepair, char **user_msg, char *userpass) |
|
VALUE_PAIR *check_item; |
|
|
VALUE_PAIR *namepair; |
|
|
char **user_msg; |
|
|
char *userpass; |
|
222 |
{ |
{ |
223 |
char *ptr; |
char *ptr; |
224 |
char *real_password = NULL; |
char *real_password = NULL; |
430 |
* process the hints and huntgroups file. |
* process the hints and huntgroups file. |
431 |
*/ |
*/ |
432 |
int |
int |
433 |
rad_auth_init(radreq, activefd) |
rad_auth_init(RADIUS_REQ *radreq, int activefd) |
|
RADIUS_REQ *radreq; |
|
|
int activefd; |
|
434 |
{ |
{ |
435 |
VALUE_PAIR *namepair; |
VALUE_PAIR *namepair; |
436 |
|
|
616 |
static char *auth_finish_msg(AUTH_MACH *m); |
static char *auth_finish_msg(AUTH_MACH *m); |
617 |
|
|
618 |
void |
void |
619 |
auth_log(m, diag, pass, reason, addstr) |
auth_log(AUTH_MACH *m, char *diag, char *pass, char *reason, char *addstr) |
|
AUTH_MACH *m; |
|
|
char *diag; |
|
|
char *pass; |
|
|
char *reason; |
|
|
char *addstr; |
|
620 |
{ |
{ |
621 |
if (reason) |
if (reason) |
622 |
radlog_req(L_NOTICE, m->req, |
radlog_req(L_NOTICE, m->req, |
639 |
} |
} |
640 |
|
|
641 |
int |
int |
642 |
is_log_mode(m, mask) |
is_log_mode(AUTH_MACH *m, int mask) |
|
AUTH_MACH *m; |
|
|
int mask; |
|
643 |
{ |
{ |
644 |
int mode = log_mode; |
int mode = log_mode; |
645 |
int xmask = 0; |
int xmask = 0; |
659 |
} |
} |
660 |
|
|
661 |
void |
void |
662 |
auth_format_msg(m, msg_id) |
auth_format_msg(AUTH_MACH *m, int msg_id) |
|
AUTH_MACH *m; |
|
|
int msg_id; |
|
663 |
{ |
{ |
664 |
int len = strlen(message_text[msg_id]); |
int len = strlen(message_text[msg_id]); |
665 |
obstack_grow(&m->msg_stack, message_text[msg_id], len); |
obstack_grow(&m->msg_stack, message_text[msg_id], len); |
666 |
} |
} |
667 |
|
|
668 |
char * |
char * |
669 |
auth_finish_msg(m) |
auth_finish_msg(AUTH_MACH *m) |
|
AUTH_MACH *m; |
|
670 |
{ |
{ |
671 |
if (m->user_msg) |
if (m->user_msg) |
672 |
obstack_grow(&m->msg_stack, m->user_msg, strlen(m->user_msg)); |
obstack_grow(&m->msg_stack, m->user_msg, strlen(m->user_msg)); |
680 |
* Check if account has expired, and if user may login now. |
* Check if account has expired, and if user may login now. |
681 |
*/ |
*/ |
682 |
int |
int |
683 |
check_expiration(m) |
check_expiration(AUTH_MACH *m) |
|
AUTH_MACH *m; |
|
684 |
{ |
{ |
685 |
int result, rc; |
int result, rc; |
686 |
VALUE_PAIR *pair; |
VALUE_PAIR *pair; |
705 |
|
|
706 |
|
|
707 |
int |
int |
708 |
rad_authenticate(radreq, activefd) |
rad_authenticate(RADIUS_REQ *radreq, int activefd) |
|
RADIUS_REQ *radreq; |
|
|
int activefd; |
|
709 |
{ |
{ |
710 |
enum auth_state oldstate; |
enum auth_state oldstate; |
711 |
struct auth_state_s *sp; |
struct auth_state_s *sp; |
780 |
|
|
781 |
|
|
782 |
void |
void |
783 |
sfn_init(m) |
sfn_init(AUTH_MACH *m) |
|
AUTH_MACH *m; |
|
784 |
{ |
{ |
785 |
RADIUS_REQ *radreq = m->req; |
RADIUS_REQ *radreq = m->req; |
786 |
VALUE_PAIR *pair_ptr; |
VALUE_PAIR *pair_ptr; |
853 |
} |
} |
854 |
|
|
855 |
void |
void |
856 |
sfn_eval_reply(m) |
sfn_eval_reply(AUTH_MACH *m) |
|
AUTH_MACH *m; |
|
857 |
{ |
{ |
858 |
VALUE_PAIR *p; |
VALUE_PAIR *p; |
859 |
int errcnt = 0; |
int errcnt = 0; |
887 |
} |
} |
888 |
|
|
889 |
void |
void |
890 |
sfn_scheme(m) |
sfn_scheme(AUTH_MACH *m) |
|
AUTH_MACH *m; |
|
891 |
{ |
{ |
892 |
#ifdef USE_SERVER_GUILE |
#ifdef USE_SERVER_GUILE |
893 |
VALUE_PAIR *p; |
VALUE_PAIR *p; |
921 |
} |
} |
922 |
|
|
923 |
void |
void |
924 |
sfn_validate(m) |
sfn_validate(AUTH_MACH *m) |
|
AUTH_MACH *m; |
|
925 |
{ |
{ |
926 |
RADIUS_REQ *radreq = m->req; |
RADIUS_REQ *radreq = m->req; |
927 |
int rc; |
int rc; |
985 |
} |
} |
986 |
|
|
987 |
void |
void |
988 |
sfn_service(m) |
sfn_service(AUTH_MACH *m) |
|
AUTH_MACH *m; |
|
989 |
{ |
{ |
990 |
/* FIXME: Other service types should also be handled, |
/* FIXME: Other service types should also be handled, |
991 |
* I suppose |
* I suppose |
996 |
} |
} |
997 |
|
|
998 |
void |
void |
999 |
sfn_disable(m) |
sfn_disable(AUTH_MACH *m) |
|
AUTH_MACH *m; |
|
1000 |
{ |
{ |
1001 |
if (get_deny(m->namepair->avp_strvalue)) { |
if (get_deny(m->namepair->avp_strvalue)) { |
1002 |
auth_format_msg(m, MSG_ACCOUNT_CLOSED); |
auth_format_msg(m, MSG_ACCOUNT_CLOSED); |
1006 |
} |
} |
1007 |
|
|
1008 |
void |
void |
1009 |
sfn_service_type(m) |
sfn_service_type(AUTH_MACH *m) |
|
AUTH_MACH *m; |
|
1010 |
{ |
{ |
1011 |
if (m->check_pair->avp_lvalue == DV_SERVICE_TYPE_AUTHENTICATE_ONLY) { |
if (m->check_pair->avp_lvalue == DV_SERVICE_TYPE_AUTHENTICATE_ONLY) { |
1012 |
auth_log(m, _("Login rejected"), NULL, |
auth_log(m, _("Login rejected"), NULL, |
1017 |
} |
} |
1018 |
|
|
1019 |
void |
void |
1020 |
sfn_realmuse(m) |
sfn_realmuse(AUTH_MACH *m) |
|
AUTH_MACH *m; |
|
1021 |
{ |
{ |
1022 |
if (!m->req->realm) |
if (!m->req->realm) |
1023 |
return; |
return; |
1031 |
} |
} |
1032 |
|
|
1033 |
void |
void |
1034 |
sfn_simuse(m) |
sfn_simuse(AUTH_MACH *m) |
|
AUTH_MACH *m; |
|
1035 |
{ |
{ |
1036 |
char name[AUTH_STRING_LEN]; |
char name[AUTH_STRING_LEN]; |
1037 |
int rc; |
int rc; |
1060 |
} |
} |
1061 |
|
|
1062 |
VALUE_PAIR * |
VALUE_PAIR * |
1063 |
timeout_pair(m) |
timeout_pair(AUTH_MACH *m) |
|
AUTH_MACH *m; |
|
1064 |
{ |
{ |
1065 |
if (!m->timeout_pair && |
if (!m->timeout_pair && |
1066 |
!(m->timeout_pair = avl_find(m->user_reply, DA_SESSION_TIMEOUT))) { |
!(m->timeout_pair = avl_find(m->user_reply, DA_SESSION_TIMEOUT))) { |
1072 |
} |
} |
1073 |
|
|
1074 |
void |
void |
1075 |
sfn_time(m) |
sfn_time(AUTH_MACH *m) |
|
AUTH_MACH *m; |
|
1076 |
{ |
{ |
1077 |
int rc; |
int rc; |
1078 |
time_t t; |
time_t t; |
1103 |
} |
} |
1104 |
|
|
1105 |
void |
void |
1106 |
sfn_ipaddr(m) |
sfn_ipaddr(AUTH_MACH *m) |
|
AUTH_MACH *m; |
|
1107 |
{ |
{ |
1108 |
VALUE_PAIR *p, *tmp, *pp; |
VALUE_PAIR *p, *tmp, *pp; |
1109 |
|
|
1139 |
} |
} |
1140 |
|
|
1141 |
void |
void |
1142 |
sfn_exec_wait(m) |
sfn_exec_wait(AUTH_MACH *m) |
|
AUTH_MACH *m; |
|
1143 |
{ |
{ |
1144 |
int rc; |
int rc; |
1145 |
VALUE_PAIR *p; |
VALUE_PAIR *p; |
1187 |
} |
} |
1188 |
|
|
1189 |
void |
void |
1190 |
sfn_exec_nowait(m) |
sfn_exec_nowait(AUTH_MACH *m) |
|
AUTH_MACH *m; |
|
1191 |
{ |
{ |
1192 |
VALUE_PAIR *p; |
VALUE_PAIR *p; |
1193 |
|
|
1204 |
} |
} |
1205 |
|
|
1206 |
void |
void |
1207 |
sfn_cleanup_cbkid(m) |
sfn_cleanup_cbkid(AUTH_MACH *m) |
|
AUTH_MACH *m; |
|
1208 |
{ |
{ |
1209 |
static int delete_pairs[] = { |
static int delete_pairs[] = { |
1210 |
DA_FRAMED_PROTOCOL, |
DA_FRAMED_PROTOCOL, |
1225 |
} |
} |
1226 |
|
|
1227 |
void |
void |
1228 |
sfn_menu_challenge(m) |
sfn_menu_challenge(AUTH_MACH *m) |
|
AUTH_MACH *m; |
|
1229 |
{ |
{ |
1230 |
#ifdef USE_LIVINGSTON_MENUS |
#ifdef USE_LIVINGSTON_MENUS |
1231 |
char *msg; |
char *msg; |
1244 |
} |
} |
1245 |
|
|
1246 |
void |
void |
1247 |
sfn_ack(m) |
sfn_ack(AUTH_MACH *m) |
|
AUTH_MACH *m; |
|
1248 |
{ |
{ |
1249 |
debug(1, ("ACK: %s", m->namepair->avp_strvalue)); |
debug(1, ("ACK: %s", m->namepair->avp_strvalue)); |
1250 |
|
|
1270 |
} |
} |
1271 |
|
|
1272 |
void |
void |
1273 |
sfn_reject(m) |
sfn_reject(AUTH_MACH *m) |
|
AUTH_MACH *m; |
|
1274 |
{ |
{ |
1275 |
debug(1, ("REJECT: %s", m->namepair->avp_strvalue)); |
debug(1, ("REJECT: %s", m->namepair->avp_strvalue)); |
1276 |
radius_send_reply(RT_AUTHENTICATION_REJECT, |
radius_send_reply(RT_AUTHENTICATION_REJECT, |
1282 |
} |
} |
1283 |
|
|
1284 |
void |
void |
1285 |
req_decrypt_password(password, req, pair) |
req_decrypt_password(char *password, RADIUS_REQ *req, VALUE_PAIR *pair) |
|
char *password; |
|
|
RADIUS_REQ *req; |
|
|
VALUE_PAIR *pair; /* Password pair */ |
|
1286 |
{ |
{ |
1287 |
NAS *nas; |
NAS *nas; |
1288 |
char *s; |
char *s; |