138 |
/* *********************** Radius Protocol Support ************************* */ |
/* *********************** Radius Protocol Support ************************* */ |
139 |
|
|
140 |
int |
int |
141 |
radius_req_decode(struct sockaddr_in *sa, |
radius_auth_req_decode(struct sockaddr_in *sa, |
142 |
void *input, size_t inputsize, void **output) |
void *input, size_t inputsize, void **output) |
143 |
{ |
{ |
144 |
RADIUS_REQ *radreq; |
RADIUS_REQ *radreq; |
145 |
|
|
146 |
|
log_open(L_AUTH); |
147 |
|
|
148 |
|
if (suspend_flag) { |
149 |
|
stat_inc(auth, radreq->ipaddr, num_dropped); |
150 |
|
return 1; |
151 |
|
} |
152 |
|
|
153 |
radreq = rad_decode_pdu(ntohl(sa->sin_addr.s_addr), |
radreq = rad_decode_pdu(ntohl(sa->sin_addr.s_addr), |
154 |
ntohs(sa->sin_port), |
ntohs(sa->sin_port), |
155 |
input, |
input, |
156 |
inputsize); |
inputsize); |
157 |
if (!radreq) |
if (!radreq) |
158 |
return 1; |
return 1; |
159 |
|
|
160 |
|
if (validate_client(radreq)) { |
161 |
|
stat_inc(auth, radreq->ipaddr, num_dropped); |
162 |
|
radreq_free(radreq); |
163 |
|
return 1; |
164 |
|
} |
165 |
|
|
166 |
/* RFC 2865 p. 2.2: |
/* RFC 2865 p. 2.2: |
167 |
The random challenge can either be included in the |
The random challenge can either be included in the |
181 |
return 0; |
return 0; |
182 |
} |
} |
183 |
|
|
184 |
|
int |
185 |
|
radius_acct_req_decode(struct sockaddr_in *sa, |
186 |
|
void *input, size_t inputsize, void **output) |
187 |
|
{ |
188 |
|
RADIUS_REQ *radreq; |
189 |
|
|
190 |
|
log_open(L_ACCT); |
191 |
|
|
192 |
|
if (suspend_flag) { |
193 |
|
stat_inc(acct, radreq->ipaddr, num_dropped); |
194 |
|
return 1; |
195 |
|
} |
196 |
|
|
197 |
|
radreq = rad_decode_pdu(ntohl(sa->sin_addr.s_addr), |
198 |
|
ntohs(sa->sin_port), |
199 |
|
input, |
200 |
|
inputsize); |
201 |
|
if (!radreq) |
202 |
|
return 1; |
203 |
|
|
204 |
|
if (validate_client(radreq)) { |
205 |
|
stat_inc(acct, radreq->ipaddr, num_dropped); |
206 |
|
radreq_free(radreq); |
207 |
|
return 1; |
208 |
|
} |
209 |
|
|
210 |
|
*output = radreq; |
211 |
|
return 0; |
212 |
|
} |
213 |
|
|
214 |
static VALUE_PAIR * |
static VALUE_PAIR * |
215 |
_extract_pairs(RADIUS_REQ *req, int prop) |
_extract_pairs(RADIUS_REQ *req, int prop) |
216 |
{ |
{ |
219 |
VALUE_PAIR *newlist = NULL; |
VALUE_PAIR *newlist = NULL; |
220 |
VALUE_PAIR *pair; |
VALUE_PAIR *pair; |
221 |
char password[AUTH_STRING_LEN+1]; |
char password[AUTH_STRING_LEN+1]; |
222 |
|
int found = 0; |
223 |
for (pair = req->request; pair; pair = pair->next) |
|
224 |
|
for (pair = req->request; !found && pair; pair = pair->next) |
225 |
for (i = 0; i < NITEMS(attrlist); i++) { |
for (i = 0; i < NITEMS(attrlist); i++) { |
226 |
if (pair->attribute == attrlist[i] |
if (pair->attribute == attrlist[i] |
227 |
&& (pair->prop & prop)) |
&& (pair->prop & prop)) { |
228 |
|
found = 1; |
229 |
break; |
break; |
230 |
|
} |
231 |
} |
} |
232 |
|
|
233 |
if (!pair) |
if (!found) |
234 |
return NULL; |
return NULL; |
235 |
|
|
236 |
newlist = avl_dup(req->request); |
newlist = avl_dup(req->request); |
247 |
return newlist; |
return newlist; |
248 |
} |
} |
249 |
|
|
250 |
|
static int |
251 |
|
find_prop(NAS *nas, char *name, int defval) |
252 |
|
{ |
253 |
|
if (!nas) |
254 |
|
return defval; |
255 |
|
return envar_lookup_int(nas->args, name, defval); |
256 |
|
} |
257 |
|
|
258 |
int |
int |
259 |
radius_req_cmp(void *adata, void *bdata) |
radius_req_cmp(void *adata, void *bdata) |
260 |
{ |
{ |
265 |
int rc; |
int rc; |
266 |
NAS *nas; |
NAS *nas; |
267 |
|
|
268 |
if (proxy_cmp(a, b) == 0) |
if (proxy_cmp(a, b) == 0) |
269 |
return RCMP_PROXY; |
return RCMP_PROXY; |
270 |
|
|
271 |
if (a->ipaddr != b->ipaddr || a->code != b->code) |
if (a->ipaddr != b->ipaddr || a->code != b->code) |
275 |
&& memcmp(a->vector, b->vector, sizeof(a->vector)) == 0) |
&& memcmp(a->vector, b->vector, sizeof(a->vector)) == 0) |
276 |
return RCMP_EQ; |
return RCMP_EQ; |
277 |
|
|
278 |
if (nas = nas_request_to_nas(a)) |
nas = nas_request_to_nas(a); |
|
prop = envar_lookup_int(nas->args, "compare-atribute-flag", 0); |
|
279 |
|
|
280 |
if (!prop) { |
switch (a->code) { |
281 |
switch (a->code) { |
case RT_AUTHENTICATION_REQUEST: |
282 |
case RT_AUTHENTICATION_REQUEST: |
case RT_AUTHENTICATION_ACK: |
283 |
case RT_AUTHENTICATION_ACK: |
case RT_AUTHENTICATION_REJECT: |
284 |
case RT_AUTHENTICATION_REJECT: |
case RT_ACCESS_CHALLENGE: |
285 |
case RT_ACCESS_CHALLENGE: |
prop = find_prop(nas, "compare-auth-flag", 0); |
286 |
prop = auth_comp_flag; |
if (!prop) |
287 |
break; |
prop = find_prop(nas, "compare-attribute-flag", |
288 |
|
auth_comp_flag); |
289 |
|
break; |
290 |
|
|
291 |
case RT_ACCOUNTING_REQUEST: |
case RT_ACCOUNTING_REQUEST: |
292 |
case RT_ACCOUNTING_RESPONSE: |
case RT_ACCOUNTING_RESPONSE: |
293 |
case RT_ACCOUNTING_STATUS: |
case RT_ACCOUNTING_STATUS: |
294 |
case RT_ACCOUNTING_MESSAGE: |
case RT_ACCOUNTING_MESSAGE: |
295 |
prop = acct_comp_flag; |
prop = find_prop(nas, "compare-acct-flag", 0); |
296 |
break; |
if (!prop) |
297 |
} |
prop = find_prop(nas, "compare-attribute-flag", |
298 |
|
acct_comp_flag); |
299 |
|
break; |
300 |
} |
} |
301 |
|
|
302 |
|
|
303 |
if (prop == 0) |
if (prop == 0) |
304 |
return RCMP_NE; |
return RCMP_NE; |
305 |
|
|
306 |
prop |= AP_REQ_CMP; |
prop = AP_USER_FLAG(prop); |
307 |
alist = _extract_pairs(a, prop); |
alist = _extract_pairs(a, prop); |
308 |
blist = _extract_pairs(b, prop); |
blist = _extract_pairs(b, prop); |
309 |
|
|
314 |
|
|
315 |
avl_free(alist); |
avl_free(alist); |
316 |
avl_free(blist); |
avl_free(blist); |
317 |
|
|
318 |
|
if (rc == 0) { |
319 |
|
/* We need to replace A/V pairs, authenticator and ID |
320 |
|
so that the reply is signed correctly. |
321 |
|
Notice that the raw data will be replaced by |
322 |
|
request_retransmit() */ |
323 |
|
memcpy(a->vector, b->vector, sizeof(a->vector)); |
324 |
|
avl_free(a->request); |
325 |
|
a->request = avl_dup(b->request); |
326 |
|
a->id = b->id; |
327 |
|
} |
328 |
|
|
329 |
return rc == 0 ? RCMP_EQ : RCMP_NE; |
return rc == 0 ? RCMP_EQ : RCMP_NE; |
330 |
} |
} |
331 |
|
|
412 |
int rc; |
int rc; |
413 |
RADIUS_REQ *radreq = req->data; |
RADIUS_REQ *radreq = req->data; |
414 |
|
|
415 |
if (suspend_flag) |
#ifdef USE_SQL |
416 |
return 1; |
radiusd_sql_clear_cache(); |
417 |
|
#endif |
|
if (validate_client(radreq)) { |
|
|
switch (req->type) { |
|
|
case R_AUTH: |
|
|
stat_inc(auth, radreq->ipaddr, num_dropped); |
|
|
break; |
|
|
|
|
|
case R_ACCT: |
|
|
stat_inc(acct, radreq->ipaddr, num_dropped); |
|
|
break; |
|
|
|
|
|
} |
|
|
return -1; |
|
|
} |
|
|
|
|
|
log_open(L_MAIN); |
|
|
|
|
418 |
/* Add any specific attributes for this username. */ |
/* Add any specific attributes for this username. */ |
419 |
hints_setup(radreq); |
hints_setup(radreq); |
420 |
|
|