74 |
0 |
0 |
75 |
}; |
}; |
76 |
|
|
77 |
int paircmp(RADIUS_REQ *req, VALUE_PAIR *check); |
int paircmp(RADIUS_REQ *req, VALUE_PAIR *check, char *pusername); |
78 |
int fallthrough(VALUE_PAIR *vp); |
int fallthrough(VALUE_PAIR *vp); |
79 |
/* |
/* |
80 |
* Static declarations |
* Static declarations |
336 |
#ifdef USE_SQL |
#ifdef USE_SQL |
337 |
rad_sql_check_attr_query(req, &check_tmp); |
rad_sql_check_attr_query(req, &check_tmp); |
338 |
#endif |
#endif |
339 |
if (paircmp(req, check_tmp)) { |
if (paircmp(req, check_tmp, NULL)) { |
340 |
avl_free(check_tmp); |
avl_free(check_tmp); |
341 |
continue; |
continue; |
342 |
} |
} |
598 |
MATCHING_RULE *i; |
MATCHING_RULE *i; |
599 |
int matched = 0; |
int matched = 0; |
600 |
|
|
601 |
|
/* Add Proxy-Replied pair if necessary */ |
602 |
|
switch (req->code) { |
603 |
|
case RT_AUTHENTICATION_ACK: |
604 |
|
case RT_AUTHENTICATION_REJECT: |
605 |
|
case RT_ACCOUNTING_RESPONSE: |
606 |
|
case RT_ACCESS_CHALLENGE: |
607 |
|
tmp = avp_create(DA_PROXY_REPLIED, 0, NULL, 1); |
608 |
|
avl_merge(&request_pairs, &tmp); |
609 |
|
avp_free(tmp); |
610 |
|
break; |
611 |
|
} |
612 |
|
|
613 |
if (hints == NULL) |
if (hints == NULL) |
614 |
return 0; |
return 0; |
615 |
|
|
736 |
for (pl = huntgroups; pl; pl = pl->next) { |
for (pl = huntgroups; pl; pl = pl->next) { |
737 |
if (strcmp(pl->name, huntgroup) != 0) |
if (strcmp(pl->name, huntgroup) != 0) |
738 |
continue; |
continue; |
739 |
if (paircmp(req, pl->lhs) == 0) { |
if (paircmp(req, pl->lhs, NULL) == 0) { |
740 |
debug(1, ("matched %s at huntgroups:%d", |
debug(1, ("matched %s at huntgroups:%d", |
741 |
pl->name, pl->lineno)); |
pl->name, pl->lineno)); |
742 |
break; |
break; |
767 |
/* |
/* |
768 |
* See if this entry matches. |
* See if this entry matches. |
769 |
*/ |
*/ |
770 |
if (paircmp(radreq, pl->lhs) != 0) |
if (paircmp(radreq, pl->lhs, NULL) != 0) |
771 |
continue; |
continue; |
772 |
debug(1, ("matched huntgroup at huntgroups:%d", pl->lineno)); |
debug(1, ("matched huntgroup at huntgroups:%d", pl->lineno)); |
773 |
r = paircmp(radreq, pl->rhs) == 0; |
r = paircmp(radreq, pl->rhs, NULL) == 0; |
774 |
break; |
break; |
775 |
} |
} |
776 |
|
|
1212 |
* Return 0 on match. |
* Return 0 on match. |
1213 |
*/ |
*/ |
1214 |
int |
int |
1215 |
paircmp(RADIUS_REQ *request, VALUE_PAIR *check) |
paircmp(RADIUS_REQ *request, VALUE_PAIR *check, char *pusername) |
1216 |
{ |
{ |
1217 |
VALUE_PAIR *check_item = check; |
VALUE_PAIR *check_item = check; |
1218 |
VALUE_PAIR *auth_item; |
VALUE_PAIR *auth_item; |
1221 |
int compare; |
int compare; |
1222 |
char *save; |
char *save; |
1223 |
|
|
1224 |
|
if (!pusername) |
1225 |
|
pusername = username; |
1226 |
|
|
1227 |
while (result == 0 && check_item != NULL) { |
while (result == 0 && check_item != NULL) { |
1228 |
if (server_attr(check_item->attribute)) { |
if (server_attr(check_item->attribute)) { |
1229 |
check_item = check_item->next; |
check_item = check_item->next; |
1252 |
if (auth_item->attribute != DA_USER_NAME) |
if (auth_item->attribute != DA_USER_NAME) |
1253 |
continue; |
continue; |
1254 |
/*FALLTHRU*/ |
/*FALLTHRU*/ |
1255 |
|
|
1256 |
case DA_HUNTGROUP_NAME: |
case DA_HUNTGROUP_NAME: |
1257 |
case DA_USER_UID: |
case DA_USER_UID: |
1258 |
break; |
break; |
1259 |
|
|
1260 |
case DA_HINT: |
case DA_HINT: |
1261 |
if (auth_item->attribute != check_item->attribute) |
if (auth_item->attribute != check_item->attribute) |
1262 |
continue; |
continue; |
1264 |
auth_item->avp_strvalue) != 0) |
auth_item->avp_strvalue) != 0) |
1265 |
continue; |
continue; |
1266 |
break; |
break; |
1267 |
|
|
1268 |
default: |
default: |
1269 |
if (auth_item->attribute != |
if (auth_item->attribute != |
1270 |
check_item->attribute) |
check_item->attribute) |
1294 |
switch (check_item->attribute) { |
switch (check_item->attribute) { |
1295 |
case DA_PREFIX: |
case DA_PREFIX: |
1296 |
case DA_SUFFIX: |
case DA_SUFFIX: |
1297 |
strcpy(username, auth_item->avp_strvalue); |
strcpy(pusername, auth_item->avp_strvalue); |
1298 |
compare = presufcmp(check_item, |
compare = presufcmp(check_item, |
1299 |
auth_item->avp_strvalue, |
auth_item->avp_strvalue, |
1300 |
username); |
pusername); |
1301 |
break; |
break; |
1302 |
|
|
1303 |
case DA_NAS_PORT_ID: |
case DA_NAS_PORT_ID: |
1304 |
compare = portcmp(check_item, auth_item); |
compare = portcmp(check_item, auth_item); |
1305 |
break; |
break; |
1306 |
|
|
1307 |
case DA_GROUP_NAME: |
case DA_GROUP_NAME: |
1308 |
case DA_GROUP: |
case DA_GROUP: |
1309 |
strcpy(username, auth_item->avp_strvalue); |
strcpy(username, auth_item->avp_strvalue); |
1311 |
check_item->avp_strvalue, |
check_item->avp_strvalue, |
1312 |
username); |
username); |
1313 |
break; |
break; |
1314 |
|
|
1315 |
case DA_HUNTGROUP_NAME: |
case DA_HUNTGROUP_NAME: |
1316 |
compare = !huntgroup_match(request, |
compare = !huntgroup_match(request, |
1317 |
check_item->avp_strvalue); |
check_item->avp_strvalue); |
1318 |
break; |
break; |
1319 |
|
|
1320 |
default: |
default: |
1321 |
compare = strcmp(auth_item->avp_strvalue, |
compare = strcmp(auth_item->avp_strvalue, |
1322 |
check_item->avp_strvalue); |
check_item->avp_strvalue); |
1330 |
break; |
break; |
1331 |
} |
} |
1332 |
/*FALLTHRU*/ |
/*FALLTHRU*/ |
1333 |
|
|
1334 |
case TYPE_IPADDR: |
case TYPE_IPADDR: |
1335 |
compare = auth_item->avp_lvalue - check_item->avp_lvalue; |
compare = auth_item->avp_lvalue - check_item->avp_lvalue; |
1336 |
break; |
break; |
1350 |
|
|
1351 |
debug(20, ("returning %d", result)); |
debug(20, ("returning %d", result)); |
1352 |
return result; |
return result; |
|
|
|
1353 |
} |
} |
1354 |
|
|
1355 |
/* |
/* |
1373 |
*pl = NULL; |
*pl = NULL; |
1374 |
} |
} |
1375 |
|
|
|
int |
|
|
hints_pairmatch(MATCHING_RULE *pl, RADIUS_REQ *req, char *name, char *ret_name) |
|
|
{ |
|
|
VALUE_PAIR *pair; |
|
|
char username[AUTH_STRING_LEN]; |
|
|
int compare; |
|
|
|
|
|
strcpy(ret_name, name); |
|
|
strncpy(username, name, AUTH_STRING_LEN); |
|
|
|
|
|
compare = 0; |
|
|
for (pair = pl->lhs; compare == 0 && pair; pair = pair->next) { |
|
|
switch (pair->attribute) { |
|
|
case DA_PREFIX: |
|
|
case DA_SUFFIX: |
|
|
compare = presufcmp(pair, username, ret_name); |
|
|
strncpy(username, ret_name, AUTH_STRING_LEN); |
|
|
break; |
|
|
case DA_USER_UID: |
|
|
compare = uidcmp(pair, username); |
|
|
break; |
|
|
case DA_GROUP: |
|
|
compare = groupcmp(req, pair->avp_strvalue, username); |
|
|
break; |
|
|
default: |
|
|
continue; |
|
|
} |
|
|
compare = comp_op(pair->operator, compare); |
|
|
} |
|
|
|
|
|
return compare; |
|
|
} |
|
|
|
|
1376 |
/* *************************************************************************** |
/* *************************************************************************** |
1377 |
* a *very* restricted version of wildmat |
* a *very* restricted version of wildmat |
1378 |
*/ |
*/ |
1503 |
{ |
{ |
1504 |
if (strncmp(pl->name, "DEFAULT", 7) == 0 || |
if (strncmp(pl->name, "DEFAULT", 7) == 0 || |
1505 |
wild_match(pl->name, name, matchpart) == 0) |
wild_match(pl->name, name, matchpart) == 0) |
1506 |
return hints_pairmatch(pl, req, name, matchpart); |
return paircmp(req, pl->lhs, matchpart); |
1507 |
return 1; |
return 1; |
1508 |
} |
} |
1509 |
|
|
1818 |
* Various utils exported to other modules |
* Various utils exported to other modules |
1819 |
*/ |
*/ |
1820 |
|
|
|
/* |
|
|
* Strip a username, based on Prefix/Suffix from the "users" file. |
|
|
* Not 100% safe, since we don't compare attributes. |
|
|
*/ |
|
|
void |
|
|
presuf_setup(VALUE_PAIR *request_pairs) |
|
|
{ |
|
|
User_symbol *sym; |
|
|
USER_LOOKUP lu; |
|
|
VALUE_PAIR *presuf_pair; |
|
|
VALUE_PAIR *name_pair; |
|
|
VALUE_PAIR *tmp; |
|
|
char name[RUT_NAMESIZE+1]; |
|
|
|
|
|
if ((name_pair = avl_find(request_pairs, DA_USER_NAME)) == NULL) |
|
|
return ; |
|
|
|
|
|
for (sym = user_lookup(name_pair->avp_strvalue, &lu); sym; |
|
|
sym = user_next(&lu)) { |
|
|
|
|
|
if ((presuf_pair = avl_find(sym->check, DA_PREFIX)) == NULL && |
|
|
(presuf_pair = avl_find(sym->check, DA_SUFFIX)) == NULL) |
|
|
continue; |
|
|
if (presufcmp(presuf_pair, name_pair->avp_strvalue, name) != 0) |
|
|
continue; |
|
|
/* |
|
|
* See if username must be stripped. |
|
|
*/ |
|
|
if ((tmp = avl_find(sym->check, DA_STRIP_USER_NAME)) != NULL && |
|
|
tmp->avp_lvalue == 0) |
|
|
continue; |
|
|
string_replace(&name_pair->avp_strvalue, name); |
|
|
name_pair->avp_strlength = strlen(name_pair->avp_strvalue); |
|
|
break; |
|
|
} |
|
|
} |
|
|
|
|
1821 |
void |
void |
1822 |
strip_username(int do_strip, char *name, VALUE_PAIR *check_item, |
strip_username(int do_strip, char *name, VALUE_PAIR *check_item, |
1823 |
char *stripped_name) |
char *stripped_name) |