src/main/auth.c

   1 /*
   2  * auth.c       User authentication.
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  *
  20  * Copyright 2000  The FreeRADIUS server project
  21  * Copyright 2000  Miquel van Smoorenburg <miquels@cistron.nl>
  22  * Copyright 2000  Jeff Carneal <jeff@apex.net>
  23  */
  24
  25 static const char rcsid[] = "$Id$";
  26
  27 #include "autoconf.h"
  28 #include "libradius.h"
  29
  30 #include <stdlib.h>
  31 #include <string.h>
  32 #include <ctype.h>
  33
  34 #ifdef HAVE_NETINET_IN_H
  35 #       include <netinet/in.h>
  36 #endif
  37
  38 #include "radiusd.h"
  39 #include "modules.h"
  40
  41 /*
  42  *      Return a short string showing the terminal server, port
  43  *      and calling station ID.
  44  */
  45 char *auth_name(char *buf, size_t buflen, REQUEST *request, int do_cli) {
  46         VALUE_PAIR      *cli;
  47         VALUE_PAIR      *pair;
  48         int             port = 0;
  49
  50         if ((cli = pairfind(request->packet->vps, PW_CALLING_STATION_ID)) == NULL)
  51                 do_cli = 0;
  52         if ((pair = pairfind(request->packet->vps, PW_NAS_PORT)) != NULL)
  53                 port = pair->lvalue;
  54
  55         snprintf(buf, buflen, "from client %.128s port %u%s%.128s",
  56                         client_name(request->packet->src_ipaddr), port,
  57                         (do_cli ? " cli " : ""), (do_cli ? (char *)cli->strvalue : ""));
  58
  59         return buf;
  60 }
  61
  62
  63
  64 /*
  65  * Make sure user/pass are clean
  66  * and then log them
  67  */
  68 static int rad_authlog(const char *msg, REQUEST *request, int goodpass) {
  69
  70         char clean_password[1024];
  71         char clean_username[1024];
  72         char buf[1024];
  73         VALUE_PAIR *username = NULL;
  74
  75         if (!mainconfig.log_auth) {
  76                 return 0;
  77         }
  78
  79         /*
  80          * Get the correct username based on the configured value
  81          */
  82         if (log_stripped_names == 0) {
  83                 username = pairfind(request->packet->vps, PW_USER_NAME);
  84         } else {
  85                 username = request->username;
  86         }
  87
  88         /*
  89          *      Clean up the username
  90          */
  91         if (username == NULL) {
  92                 strcpy(clean_username, "<no User-Name attribute>");
  93         } else {
  94                 librad_safeprint((char *)username->strvalue,
  95                                 username->length,
  96                                 clean_username, sizeof(clean_username));
  97         }
  98
  99         /*
 100          *      Clean up the password
 101          */
 102         if (mainconfig.log_auth_badpass || mainconfig.log_auth_goodpass) {
 103                 if (!request->password) {
 104                         strcpy(clean_password, "<no User-Password attribute>");
 105                 } else if (request->password->attribute == PW_CHAP_PASSWORD) {
 106                         strcpy(clean_password, "<CHAP-Password>");
 107                 } else {
 108                         librad_safeprint((char *)request->password->strvalue,
 109                                          request->password->length,
 110                                          clean_password, sizeof(clean_password));
 111                 }
 112         }
 113
 114         if (goodpass) {
 115                 radlog(L_AUTH, "%s: [%s%s%s] (%s)",
 116                                 msg,
 117                                 clean_username,
 118                                 mainconfig.log_auth_goodpass ? "/" : "",
 119                                 mainconfig.log_auth_goodpass ? clean_password : "",
 120                                 auth_name(buf, sizeof(buf), request, 1));
 121         } else {
 122                 radlog(L_AUTH, "%s: [%s%s%s] (%s)",
 123                                 msg,
 124                                 clean_username,
 125                                 mainconfig.log_auth_badpass ? "/" : "",
 126                                 mainconfig.log_auth_badpass ? clean_password : "",
 127                                 auth_name(buf, sizeof(buf), request, 1));
 128         }
 129
 130         return 0;
 131 }
 132
 133 /*
 134  *      Check password.
 135  *
 136  *      Returns:        0  OK
 137  *                      -1 Password fail
 138  *                      -2 Rejected (Auth-Type = Reject, send Port-Message back)
 139  *                      1  End check & return, don't reply
 140  *
 141  *      NOTE: NOT the same as the RLM_ values !
 142  */
 143 int rad_check_password(REQUEST *request)
 144 {
 145         VALUE_PAIR *auth_type_pair;
 146         VALUE_PAIR *cur_config_item;
 147         VALUE_PAIR *password_pair;
 148         VALUE_PAIR *auth_item;
 149         char string[MAX_STRING_LEN];
 150         int auth_type = -1;
 151         int result;
 152         int auth_type_count = 0;
 153         result = 0;
 154
 155         /*
 156          *      Look for matching check items. We skip the whole lot
 157          *      if the authentication type is PW_AUTHTYPE_ACCEPT or
 158          *      PW_AUTHTYPE_REJECT.
 159          */
 160         cur_config_item = request->config_items;
 161         while(((auth_type_pair = pairfind(cur_config_item, PW_AUTH_TYPE))) != NULL) {
 162                 auth_type = auth_type_pair->lvalue;
 163                 auth_type_count++;
 164
 165                 DEBUG2("  rad_check_password:  Found Auth-Type %s",
 166                                 auth_type_pair->strvalue);
 167                 cur_config_item = auth_type_pair->next;
 168
 169                 if (auth_type == PW_AUTHTYPE_REJECT) {
 170                         DEBUG2("  rad_check_password: Auth-Type = Reject, rejecting user");
 171                         return -2;
 172                 }
 173         }
 174
 175         if (( auth_type_count > 1) && (debug_flag)) {
 176                 radlog(L_ERR, "Warning:  Found %d auth-types on request for user '%s'",
 177                         auth_type_count, request->username->strvalue);
 178         }
 179
 180         /*
 181          *      This means we have a proxy reply or an accept
 182          *  and it wasn't rejected in the above loop.  So
 183          *  that means it is accepted and we do no further
 184          *  authentication
 185          */
 186         if ((auth_type == PW_AUTHTYPE_ACCEPT) || (request->proxy)) {
 187                 DEBUG2("  rad_check_password: Auth-Type = Accept, accepting the user");
 188                 return 0;
 189         }
 190
 191         /*
 192          *      Find the password from the users file.
 193          */
 194         if ((password_pair = pairfind(request->config_items, PW_CRYPT_PASSWORD)) != NULL) {
 195                 /*
 196                  *      Re-write Auth-Type, but ONLY if it isn't already
 197                  *      set.
 198                  */
 199                 if (auth_type == -1) auth_type = PW_AUTHTYPE_CRYPT;
 200         } else {
 201                 password_pair = pairfind(request->config_items, PW_PASSWORD);
 202         }
 203
 204         if (auth_type < 0) {
 205                 if (password_pair) {
 206                         auth_type = PW_AUTHTYPE_LOCAL;
 207                 } else {
 208                         /*
 209                         *       The admin hasn't told us how to
 210                         *       authenticate the user, so we reject them!
 211                         *
 212                         *       This is fail-safe.
 213                         */
 214                         DEBUG2("auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user");
 215                         return -2;
 216                 }
 217         }
 218
 219         switch(auth_type) {
 220                 case PW_AUTHTYPE_CRYPT:
 221                         /*
 222                          *      Find the password sent by the user. It
 223                          *      SHOULD be there, if it's not
 224                          *      authentication fails.
 225                          */
 226                         auth_item = request->password;
 227                         if (auth_item == NULL) {
 228                                 DEBUG2("auth: No User-Password or CHAP-Password attribute in the request");
 229                                 return -1;
 230                         }
 231
 232                         DEBUG2("auth: type Crypt");
 233                         if (password_pair == NULL) {
 234                                 DEBUG2("No Crypt-Password configured for the user");
 235                                 rad_authlog("Login incorrect "
 236                                         "(No Crypt-Password configured for the user)", request, 0);
 237                                 return -1;
 238                         }
 239
 240                         switch (lrad_crypt_check((char *)auth_item->strvalue,
 241                                                                          (char *)password_pair->strvalue)) {
 242                         case -1:
 243                           rad_authlog("Login incorrect "
 244                                                   "(system failed to supply an encrypted password for comparison)", request, 0);
 245                         case 1:
 246                           return -1;
 247                         }
 248                         break;
 249                 case PW_AUTHTYPE_LOCAL:
 250                         DEBUG2("auth: type Local");
 251
 252                         /*
 253                          *      Find the password sent by the user. It
 254                          *      SHOULD be there, if it's not
 255                          *      authentication fails.
 256                          */
 257                         auth_item = request->password;
 258                         if (auth_item == NULL) {
 259                                 DEBUG2("auth: No User-Password or CHAP-Password attribute in the request");
 260                                 return -1;
 261                         }
 262
 263                         /*
 264                          *      Plain text password.
 265                          */
 266                         if (password_pair == NULL) {
 267                                 DEBUG2("auth: No password configured for the user");
 268                                 rad_authlog("Login incorrect "
 269                                         "(No password configured for the user)", request, 0);
 270                                 return -1;
 271                         }
 272
 273                         /*
 274                          *      Local password is just plain text.
 275                          */
 276                         if (auth_item->attribute == PW_PASSWORD) {
 277                                 if (strcmp((char *)password_pair->strvalue,
 278                                            (char *)auth_item->strvalue) != 0) {
 279                                         DEBUG2("auth: user supplied User-Password does NOT match local User-Password");
 280                                         return -1;
 281                                 }
 282                                 DEBUG2("auth: user supplied User-Password matches local User-Password");
 283                                 break;
 284
 285                         } else if (auth_item->attribute != PW_CHAP_PASSWORD) {
 286                                 DEBUG2("The user did not supply a User-Password or a CHAP-Password attribute");
 287                                 rad_authlog("Login incorrect "
 288                                         "(no User-Password or CHAP-Password attribute)", request, 0);
 289                                 return -1;
 290                         }
 291
 292                         rad_chap_encode(request->packet, string,
 293                                         auth_item->strvalue[0], password_pair);
 294
 295                         /*
 296                          *      Compare them
 297                          */
 298                         if (memcmp(string + 1, auth_item->strvalue + 1,
 299                                    CHAP_VALUE_LENGTH) != 0) {
 300                                 DEBUG2("auth: user supplied CHAP-Password does NOT match local User-Password");
 301                                 return -1;
 302                         }
 303                         DEBUG2("auth: user supplied CHAP-Password matches local User-Password");
 304                         break;
 305                 default:
 306                         DEBUG2("auth: type \"%s\"",
 307                                         dict_valbyattr(PW_AUTH_TYPE, auth_type)->name);
 308                         /*
 309                          *      See if there is a module that handles
 310                          *      this type, and turn the RLM_ return
 311                          *      status into the values as defined at
 312                          *      the top of this function.
 313                          */
 314                         result = module_authenticate(auth_type, request);
 315                         switch (result) {
 316                                 /*
 317                                  *      An authentication module FAIL
 318                                  *      return code, or any return code that
 319                                  *      is not expected from authentication,
 320                                  *      is the same as an explicit REJECT!
 321                                  */
 322                                 case RLM_MODULE_FAIL:
 323                                 case RLM_MODULE_REJECT:
 324                                 case RLM_MODULE_USERLOCK:
 325                                 case RLM_MODULE_INVALID:
 326                                 case RLM_MODULE_NOTFOUND:
 327                                 case RLM_MODULE_NOOP:
 328                                 case RLM_MODULE_UPDATED:
 329                                         result = -1;
 330                                         break;
 331                                 case RLM_MODULE_OK:
 332                                         result = 0;
 333                                         break;
 334                                 case RLM_MODULE_HANDLED:
 335                                         result = 1;
 336                                         break;
 337                         }
 338                         break;
 339         }
 340
 341         return result;
 342 }
 343
 344 /*
 345  *      Post-authentication step processes the response before it is
 346  *      sent to the NAS. It can receive both Access-Accept and Access-Reject
 347  *      replies.
 348  */
 349 int rad_postauth(REQUEST *request)
 350 {
 351         int     result;
 352         int     postauth_type = 0;
 353         VALUE_PAIR      *postauth_type_item = NULL;
 354
 355         /*
 356          *      Do post-authentication calls. ignoring the return code.
 357          */
 358         postauth_type_item = pairfind(request->config_items, PW_POST_AUTH_TYPE);
 359         if (postauth_type_item)
 360                 postauth_type = postauth_type_item->lvalue;
 361         result = module_post_auth(postauth_type, request);
 362         switch (result) {
 363         default:
 364           break;
 365
 366           /*
 367            *    The module failed, or said to reject the user: Do so.
 368            */
 369         case RLM_MODULE_FAIL:
 370         case RLM_MODULE_REJECT:
 371         case RLM_MODULE_USERLOCK:
 372         case RLM_MODULE_INVALID:
 373           request->reply->code = PW_AUTHENTICATION_REJECT;
 374           result = RLM_MODULE_REJECT;
 375           break;
 376
 377           /*
 378            *    The module had a number of OK return codes.
 379            */
 380         case RLM_MODULE_NOTFOUND:
 381         case RLM_MODULE_NOOP:
 382         case RLM_MODULE_UPDATED:
 383         case RLM_MODULE_OK:
 384         case RLM_MODULE_HANDLED:
 385           result = RLM_MODULE_OK;
 386           break;
 387         }
 388         return result;
 389 }
 390
 391 /*
 392  *      Process and reply to an authentication request
 393  *
 394  *      The return value of this function isn't actually used right now, so
 395  *      it's not entirely clear if it is returning the right things. --Pac.
 396  */
 397 int rad_authenticate(REQUEST *request)
 398 {
 399         VALUE_PAIR      *namepair;
 400         VALUE_PAIR      *check_item;
 401         VALUE_PAIR      *reply_item;
 402         VALUE_PAIR      *auth_item;
 403         VALUE_PAIR      *module_msg;
 404         VALUE_PAIR      *tmp = NULL;
 405         int             result, r;
 406         char            umsg[MAX_STRING_LEN + 1];
 407         const char      *user_msg = NULL;
 408         const char      *password;
 409         char            *exec_program;
 410         int             exec_wait;
 411         int             seen_callback_id;
 412         char            buf[1024], logstr[1024];
 413         char            autz_retry = 0;
 414         int             autz_type = 0;
 415
 416         password = "";
 417
 418         /*
 419          *      If this request got proxied to another server,
 420          *      AND it was an authentication request, then we need
 421          *      to add an initial Auth-Type: Auth-Accept for success,
 422          *      Auth-Reject for fail. We also need to add the reply
 423          *      pairs from the server to the initial reply.
 424          *
 425          *      Huh?  If the request wasn't an authentication request,
 426          *      WTF are we doing here?
 427          */
 428         if ((request->proxy_reply) &&
 429             (request->packet->code == PW_AUTHENTICATION_REQUEST)) {
 430                 tmp = paircreate(PW_AUTH_TYPE, PW_TYPE_INTEGER);
 431                 if (tmp == NULL) {
 432                         radlog(L_ERR|L_CONS, "no memory");
 433                         exit(1);
 434                 }
 435
 436                 /*
 437                  *      Challenges are punted back to the NAS
 438                  *      without any further processing.
 439                  */
 440                 if (request->proxy_reply->code == PW_ACCESS_CHALLENGE) {
 441                         request->reply->code = PW_ACCESS_CHALLENGE;
 442                         return RLM_MODULE_HANDLED;
 443                 }
 444
 445                 /*
 446                  *      Reply of ACCEPT means accept, ALL other
 447                  *      replies mean reject.  This is fail-safe.
 448                  */
 449                 if (request->proxy_reply->code == PW_AUTHENTICATION_ACK)
 450                         tmp->lvalue = PW_AUTHTYPE_ACCEPT;
 451                 else
 452                         tmp->lvalue = PW_AUTHTYPE_REJECT;
 453                 pairadd(&request->config_items, tmp);
 454
 455                 /*
 456                  *      If it's an Access-Reject, then do NOT do any
 457                  *      authorization or authentication.  They're being
 458                  *      rejected, so we minimize the amount of work
 459                  *      done by the server, by rejecting them here.
 460                  */
 461                 if ((request->proxy_reply->code != PW_AUTHENTICATION_ACK) &&
 462                     (request->proxy_reply->code != PW_ACCESS_CHALLENGE)) {
 463                         rad_authlog("Login incorrect (Home Server says so)", request, 0);
 464                         request->reply->code = PW_AUTHENTICATION_REJECT;
 465                         return RLM_MODULE_REJECT;
 466                 }
 467         }
 468
 469         /*
 470          *      Get the username from the request.
 471          *
 472          *      Note that namepair MAY be NULL, in which case there
 473          *      is no User-Name attribute in the request.
 474          */
 475         namepair = request->username;
 476
 477         /*
 478          *      Look for, and cache, passwords.
 479          */
 480         if (!request->password) {
 481                 request->password = pairfind(request->packet->vps,
 482                                              PW_PASSWORD);
 483         }
 484
 485         /*
 486          *      Discover which password we want to use.
 487          */
 488         auth_item = request->password;
 489         if (auth_item) {
 490                 password = (const char *)auth_item->strvalue;
 491
 492         } else {
 493                 /*
 494                  *      Maybe there's a CHAP-Password?
 495                  */
 496                 if ((auth_item = pairfind(request->packet->vps,
 497                                 PW_CHAP_PASSWORD)) != NULL) {
 498                         password = "<CHAP-PASSWORD>";
 499
 500                 } else {
 501                         /*
 502                          *      No password we recognize.
 503                          */
 504                         password = "<NO-PASSWORD>";
 505                 }
 506         }
 507         request->password = auth_item;
 508
 509         /*
 510          *      Get the user's authorization information from the database
 511          */
 512 autz_redo:
 513         r = module_authorize(autz_type, request);
 514         if (r != RLM_MODULE_NOTFOUND &&
 515             r != RLM_MODULE_NOOP &&
 516             r != RLM_MODULE_OK &&
 517             r != RLM_MODULE_UPDATED) {
 518                 if (r != RLM_MODULE_FAIL && r != RLM_MODULE_HANDLED) {
 519                         if ((module_msg = pairfind(request->packet->vps,
 520                                         PW_MODULE_FAILURE_MESSAGE)) != NULL){
 521                                 char msg[MAX_STRING_LEN+16];
 522                                 snprintf(msg, sizeof(msg), "Invalid user (%s)",
 523                                          module_msg->strvalue);
 524                                 rad_authlog(msg,request,0);
 525                         } else {
 526                                 rad_authlog("Invalid user", request, 0);
 527                         }
 528                         request->reply->code = PW_AUTHENTICATION_REJECT;
 529                 }
 530                 return r;
 531         }
 532         if (!autz_retry){
 533                 VALUE_PAIR      *autz_type_item = NULL;
 534                 autz_type_item = pairfind(request->config_items, PW_AUTZ_TYPE);
 535                 if (autz_type_item){
 536                         autz_type = autz_type_item->lvalue;
 537                         autz_retry = 1;
 538                         goto autz_redo;
 539                 }
 540         }
 541
 542         /*
 543          *      If we haven't already proxied the packet, then check
 544          *      to see if we should.  Maybe one of the authorize
 545          *      modules has decided that a proxy should be used. If
 546          *      so, get out of here and send the packet.
 547          */
 548         if ((request->proxy == NULL) &&
 549             ((tmp = pairfind(request->config_items, PW_PROXY_TO_REALM)) != NULL)) {
 550                 REALM *realm;
 551
 552                 /*
 553                  *      Catch users who set Proxy-To-Realm to a LOCAL
 554                  *      realm (sigh).
 555                  */
 556                 realm = realm_find(tmp->strvalue, 0);
 557                 if (realm && (realm->ipaddr == htonl(INADDR_NONE))) {
 558                         DEBUG2("  WARNING: You set Proxy-To-Realm = %s, but it is a LOCAL realm!  Cancelling invalid proxy request.", realm->realm);
 559                 } else {
 560                         /*
 561                          *      Don't authenticate, as the request is
 562                          *      proxied.
 563                          */
 564                         return RLM_MODULE_OK;
 565                 }
 566         }
 567
 568         /*
 569          *      Perhaps there is a Stripped-User-Name now.
 570          */
 571         namepair = request->username;
 572
 573         /*
 574          *      Validate the user
 575          */
 576         do {
 577                 result = rad_check_password(request);
 578                 if (result > 0) {
 579                         /* don't reply! */
 580                         return RLM_MODULE_HANDLED;
 581                 }
 582         } while(0);
 583
 584         /*
 585          *      Failed to validate the user.
 586          *
 587          *      We PRESUME that the code which failed will clean up
 588          *      request->reply->vps, to be ONLY the reply items it
 589          *      wants to send back.
 590          */
 591         if (result < 0) {
 592                 DEBUG2("auth: Failed to validate the user.");
 593                 request->reply->code = PW_AUTHENTICATION_REJECT;
 594
 595                 if ((module_msg = pairfind(request->packet->vps,PW_MODULE_FAILURE_MESSAGE)) != NULL){
 596                         char msg[MAX_STRING_LEN+19];
 597
 598                         snprintf(msg, sizeof(msg), "Login incorrect (%s)",
 599                                  module_msg->strvalue);
 600                         rad_authlog(msg, request, 0);
 601                 } else {
 602                         rad_authlog("Login incorrect", request, 0);
 603                 }
 604
 605                 /* double check: maybe the secret is wrong? */
 606                 if ((debug_flag > 1) && (auth_item != NULL) &&
 607                                 (auth_item->attribute == PW_PASSWORD)) {
 608                         u_char *p;
 609
 610                         p = auth_item->strvalue;
 611                         while (*p != '\0') {
 612                                 if (!isprint((int) *p)) {
 613                                         log_debug("  WARNING: Unprintable characters in the password.\n\t  Double-check the shared secret on the server and the NAS!");
 614                                         break;
 615                                 }
 616                                 p++;
 617                         }
 618                 }
 619         }
 620
 621         if (result >= 0 &&
 622             (check_item = pairfind(request->config_items, PW_SIMULTANEOUS_USE)) != NULL) {
 623                 VALUE_PAIR      *session_type;
 624                 int             sess_type = 0;
 625
 626                 session_type = pairfind(request->config_items, PW_SESSION_TYPE);
 627                 if (session_type)
 628                         sess_type = session_type->lvalue;
 629
 630                 /*
 631                  *      User authenticated O.K. Now we have to check
 632                  *      for the Simultaneous-Use parameter.
 633                  */
 634                 if (namepair &&
 635                     (r = module_checksimul(sess_type,request, check_item->lvalue)) != 0) {
 636                         char mpp_ok = 0;
 637
 638                         if (r == 2){
 639                                 /* Multilink attempt. Check if port-limit > simultaneous-use */
 640                                 VALUE_PAIR *port_limit;
 641
 642                                 if ((port_limit = pairfind(request->reply->vps, PW_PORT_LIMIT)) != NULL &&
 643                                         port_limit->lvalue > check_item->lvalue){
 644                                         DEBUG2("main auth: MPP is OK");
 645                                         mpp_ok = 1;
 646                                 }
 647                         }
 648                         if (!mpp_ok){
 649                                 if (check_item->lvalue > 1) {
 650                                 snprintf(umsg, sizeof(umsg),
 651                                                         "\r\nYou are already logged in %d times  - access denied\r\n\n",
 652                                                         (int)check_item->lvalue);
 653                                         user_msg = umsg;
 654                                 } else {
 655                                         user_msg = "\r\nYou are already logged in - access denied\r\n\n";
 656                                 }
 657
 658                                 request->reply->code = PW_AUTHENTICATION_REJECT;
 659
 660                                 /*
 661                                  *      They're trying to log in too many times.
 662                                  *      Remove ALL reply attributes.
 663                                  */
 664                                 pairfree(&request->reply->vps);
 665                                 tmp = pairmake("Reply-Message", user_msg, T_OP_SET);
 666                                 request->reply->vps = tmp;
 667
 668                                 snprintf(logstr, sizeof(logstr), "Multiple logins (max %d) %s",
 669                                         check_item->lvalue,
 670                                         r == 2 ? "[MPP attempt]" : "");
 671                                 rad_authlog(logstr, request, 1);
 672
 673                                 result = -1;
 674                         }
 675                 }
 676         }
 677
 678         /*
 679          *      Result should be >= 0 here - if not, it means the user
 680          *      is rejected, so we overwrite the Post-Auth-Type with
 681          *      the value REJECT and call the post-authentication
 682          *      step.
 683          */
 684         if (result < 0) {
 685                 DICT_VALUE *dval;
 686
 687                 dval = dict_valbyname(PW_POST_AUTH_TYPE, "REJECT");
 688                 if (dval) {
 689                         pairdelete(&request->config_items, PW_POST_AUTH_TYPE);
 690                         tmp = paircreate(PW_POST_AUTH_TYPE, PW_TYPE_INTEGER);
 691                         tmp->lvalue = dval->value;
 692                         pairadd(&request->config_items, tmp);
 693                         rad_postauth(request);
 694                 }
 695                 return RLM_MODULE_OK;
 696         }
 697
 698         /*
 699          *      We might need this later.  The 'password' string
 700          *      is NOT used anywhere below here, except for logging,
 701          *      so it should be safe...
 702          */
 703         if ((auth_item != NULL) && (auth_item->attribute == PW_CHAP_PASSWORD)) {
 704                 password = "CHAP-Password";
 705         }
 706
 707         /*
 708          *      Add the port number to the Framed-IP-Address if
 709          *      vp->addport is set.
 710          */
 711         if (((tmp = pairfind(request->reply->vps,
 712                              PW_FRAMED_IP_ADDRESS)) != NULL) &&
 713             (tmp->flags.addport != 0)) {
 714                 VALUE_PAIR *vpPortId;
 715
 716                 /*
 717                  *  Find the NAS port ID.
 718                  */
 719                 if ((vpPortId = pairfind(request->packet->vps,
 720                                          PW_NAS_PORT)) != NULL) {
 721                   unsigned long tvalue = ntohl(tmp->lvalue);
 722                   tmp->lvalue = htonl(tvalue + vpPortId->lvalue);
 723                   tmp->flags.addport = 0;
 724                   ip_ntoa(tmp->strvalue, tmp->lvalue);
 725                 } else {
 726                         DEBUG2("WARNING: No NAS-Port attribute in request.  CANNOT return a Framed-IP-Address + NAS-Port.\n");
 727                         pairdelete(&request->reply->vps, PW_FRAMED_IP_ADDRESS);
 728                 }
 729         }
 730
 731         /*
 732          *      See if we need to execute a program.
 733          *      FIXME: somehow cache this info, and only execute the
 734          *      program when we receive an Accounting-START packet.
 735          *      Only at that time we know dynamic IP etc.
 736          */
 737         exec_program = NULL;
 738         exec_wait = 0;
 739         if ((auth_item = pairfind(request->reply->vps, PW_EXEC_PROGRAM)) != NULL) {
 740                 exec_wait = 0;
 741                 exec_program = strdup((char *)auth_item->strvalue);
 742                 pairdelete(&request->reply->vps, PW_EXEC_PROGRAM);
 743         }
 744         if ((auth_item = pairfind(request->reply->vps, PW_EXEC_PROGRAM_WAIT)) != NULL) {
 745                 exec_wait = 1;
 746                 exec_program = strdup((char *)auth_item->strvalue);
 747                 pairdelete(&request->reply->vps, PW_EXEC_PROGRAM_WAIT);
 748         }
 749
 750         /*
 751          *      Hack - allow % expansion in certain value strings.
 752          *      This is nice for certain Exec-Program programs.
 753          */
 754         seen_callback_id = 0;
 755         if ((auth_item = pairfind(request->reply->vps, PW_CALLBACK_ID)) != NULL) {
 756                 seen_callback_id = 1;
 757                 radius_xlat(buf, sizeof(auth_item->strvalue),
 758                             (char *)auth_item->strvalue, request, NULL);
 759                 strNcpy((char *)auth_item->strvalue, buf,
 760                         sizeof(auth_item->strvalue));
 761                 auth_item->length = strlen((char *)auth_item->strvalue);
 762         }
 763
 764
 765         /*
 766          *      If we want to exec a program, but wait for it,
 767          *      do it first before sending the reply.
 768          */
 769         if (exec_program && exec_wait) {
 770                 r = radius_exec_program(exec_program, request,
 771                                         exec_wait,
 772                                         umsg, sizeof(umsg),
 773                                         request->packet->vps, &tmp);
 774                 free(exec_program);
 775                 exec_program = NULL;
 776
 777                 /*
 778                  *      Always add the value-pairs to the reply.
 779                  */
 780                 pairmove(&request->reply->vps, &tmp);
 781                 pairfree(&tmp);
 782
 783                 if (r != 0) {
 784                         /*
 785                          *      Error. radius_exec_program() returns -1 on
 786                          *      fork/exec errors, or >0 if the exec'ed program
 787                          *      had a non-zero exit status.
 788                          */
 789                         if (umsg[0] == '\0') {
 790                                 user_msg = "\r\nAccess denied (external check failed).";
 791                         } else {
 792                                 user_msg = &umsg[0];
 793                         }
 794
 795                         request->reply->code = PW_AUTHENTICATION_REJECT;
 796                         tmp = pairmake("Reply-Message", user_msg, T_OP_SET);
 797
 798                         pairadd(&request->reply->vps, tmp);
 799                         rad_authlog("Login incorrect (external check failed)",
 800                                         request, 0);
 801
 802                         return RLM_MODULE_REJECT;
 803                 }
 804         }
 805
 806         /*
 807          *      Delete "normal" A/V pairs when using callback.
 808          *
 809          *      FIXME: This is stupid. The portmaster should accept
 810          *      these settings instead of insisting on using a
 811          *      dialout location.
 812          *
 813          *      FIXME2: Move this into the above exec thingy?
 814          *      (if you knew how I use the exec_wait, you'd understand).
 815          */
 816         if (seen_callback_id) {
 817                 pairdelete(&request->reply->vps, PW_FRAMED_PROTOCOL);
 818                 pairdelete(&request->reply->vps, PW_FRAMED_IP_ADDRESS);
 819                 pairdelete(&request->reply->vps, PW_FRAMED_IP_NETMASK);
 820                 pairdelete(&request->reply->vps, PW_FRAMED_ROUTE);
 821                 pairdelete(&request->reply->vps, PW_FRAMED_MTU);
 822                 pairdelete(&request->reply->vps, PW_FRAMED_COMPRESSION);
 823                 pairdelete(&request->reply->vps, PW_FILTER_ID);
 824                 pairdelete(&request->reply->vps, PW_PORT_LIMIT);
 825                 pairdelete(&request->reply->vps, PW_CALLBACK_NUMBER);
 826         }
 827
 828         /*
 829          *      Set the reply to Access-Accept, if it hasn't already
 830          *      been set to something.  (i.e. Access-Challenge)
 831          */
 832         if (request->reply->code == 0)
 833           request->reply->code = PW_AUTHENTICATION_ACK;
 834
 835         if ((module_msg = pairfind(request->packet->vps,PW_MODULE_SUCCESS_MESSAGE)) != NULL){
 836                 char msg[MAX_STRING_LEN+12];
 837
 838                 snprintf(msg, sizeof(msg), "Login OK (%s)",
 839                          module_msg->strvalue);
 840                 rad_authlog(msg, request, 1);
 841         } else {
 842                 rad_authlog("Login OK", request, 1);
 843         }
 844
 845         if (exec_program && !exec_wait) {
 846                 /*
 847                  *      No need to check the exit status here.
 848                  */
 849                 radius_exec_program(exec_program, request, exec_wait,
 850                                     NULL, 0, request->packet->vps, NULL);
 851         }
 852
 853         if (exec_program)
 854                 free(exec_program);
 855
 856         result = rad_postauth(request);
 857
 858         return result;
 859 }