src/main/auth.c

   1 /*
   2  * auth.c       User authentication.
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2000,2006  The FreeRADIUS server project
  21  * Copyright 2000  Miquel van Smoorenburg <miquels@cistron.nl>
  22  * Copyright 2000  Jeff Carneal <jeff@apex.net>
  23  */
  24
  25 #include <freeradius-devel/ident.h>
  26 RCSID("$Id$")
  27
  28 #include <freeradius-devel/autoconf.h>
  29
  30 #include <stdlib.h>
  31 #include <string.h>
  32 #include <ctype.h>
  33
  34 #ifdef HAVE_NETINET_IN_H
  35 #       include <netinet/in.h>
  36 #endif
  37
  38 #include <freeradius-devel/radiusd.h>
  39 #include <freeradius-devel/modules.h>
  40 #include <freeradius-devel/rad_assert.h>
  41
  42 /*
  43  *      Return a short string showing the terminal server, port
  44  *      and calling station ID.
  45  */
  46 char *auth_name(char *buf, size_t buflen, REQUEST *request, int do_cli) {
  47         VALUE_PAIR      *cli;
  48         VALUE_PAIR      *pair;
  49         int             port = 0;
  50
  51         if ((cli = pairfind(request->packet->vps, PW_CALLING_STATION_ID)) == NULL)
  52                 do_cli = 0;
  53         if ((pair = pairfind(request->packet->vps, PW_NAS_PORT)) != NULL)
  54                 port = pair->lvalue;
  55
  56         snprintf(buf, buflen, "from client %.128s port %u%s%.128s",
  57                         client_name_old(&request->packet->src_ipaddr), port,
  58                         (do_cli ? " cli " : ""), (do_cli ? (char *)cli->vp_strvalue : ""));
  59
  60         return buf;
  61 }
  62
  63
  64
  65 /*
  66  * Make sure user/pass are clean
  67  * and then log them
  68  */
  69 static int rad_authlog(const char *msg, REQUEST *request, int goodpass) {
  70
  71         char clean_password[1024];
  72         char clean_username[1024];
  73         char buf[1024];
  74         VALUE_PAIR *username = NULL;
  75
  76         if (!mainconfig.log_auth) {
  77                 return 0;
  78         }
  79
  80         /*
  81          * Get the correct username based on the configured value
  82          */
  83         if (log_stripped_names == 0) {
  84                 username = pairfind(request->packet->vps, PW_USER_NAME);
  85         } else {
  86                 username = request->username;
  87         }
  88
  89         /*
  90          *      Clean up the username
  91          */
  92         if (username == NULL) {
  93                 strcpy(clean_username, "<no User-Name attribute>");
  94         } else {
  95                 librad_safeprint((char *)username->vp_strvalue,
  96                                 username->length,
  97                                 clean_username, sizeof(clean_username));
  98         }
  99
 100         /*
 101          *      Clean up the password
 102          */
 103         if (mainconfig.log_auth_badpass || mainconfig.log_auth_goodpass) {
 104                 if (!request->password) {
 105                         VALUE_PAIR *auth_type;
 106
 107                         auth_type = pairfind(request->config_items,
 108                                              PW_AUTH_TYPE);
 109                         if (auth_type && (auth_type->vp_strvalue[0] != '\0')) {
 110                                 snprintf(clean_password, sizeof(clean_password),
 111                                          "<via Auth-Type = %s>",
 112                                          auth_type->vp_strvalue);
 113                         } else {
 114                                 strcpy(clean_password, "<no User-Password attribute>");
 115                         }
 116                 } else if (pairfind(request->packet->vps, PW_CHAP_PASSWORD)) {
 117                         strcpy(clean_password, "<CHAP-Password>");
 118                 } else {
 119                         librad_safeprint((char *)request->password->vp_strvalue,
 120                                          request->password->length,
 121                                          clean_password, sizeof(clean_password));
 122                 }
 123         }
 124
 125         if (goodpass) {
 126                 radlog(L_AUTH, "%s: [%s%s%s] (%s)",
 127                                 msg,
 128                                 clean_username,
 129                                 mainconfig.log_auth_goodpass ? "/" : "",
 130                                 mainconfig.log_auth_goodpass ? clean_password : "",
 131                                 auth_name(buf, sizeof(buf), request, 1));
 132         } else {
 133                 radlog(L_AUTH, "%s: [%s%s%s] (%s)",
 134                                 msg,
 135                                 clean_username,
 136                                 mainconfig.log_auth_badpass ? "/" : "",
 137                                 mainconfig.log_auth_badpass ? clean_password : "",
 138                                 auth_name(buf, sizeof(buf), request, 1));
 139         }
 140
 141         return 0;
 142 }
 143
 144 /*
 145  *      Check password.
 146  *
 147  *      Returns:        0  OK
 148  *                      -1 Password fail
 149  *                      -2 Rejected (Auth-Type = Reject, send Port-Message back)
 150  *                      1  End check & return, don't reply
 151  *
 152  *      NOTE: NOT the same as the RLM_ values !
 153  */
 154 static int rad_check_password(REQUEST *request)
 155 {
 156         VALUE_PAIR *auth_type_pair;
 157         VALUE_PAIR *cur_config_item;
 158         VALUE_PAIR *password_pair;
 159         VALUE_PAIR *auth_item;
 160         char string[MAX_STRING_LEN];
 161         int auth_type = -1;
 162         int result;
 163         int auth_type_count = 0;
 164         result = 0;
 165
 166         /*
 167          *      Look for matching check items. We skip the whole lot
 168          *      if the authentication type is PW_AUTHTYPE_ACCEPT or
 169          *      PW_AUTHTYPE_REJECT.
 170          */
 171         cur_config_item = request->config_items;
 172         while(((auth_type_pair = pairfind(cur_config_item, PW_AUTH_TYPE))) != NULL) {
 173                 auth_type = auth_type_pair->lvalue;
 174                 auth_type_count++;
 175
 176                 DEBUG2("  rad_check_password:  Found Auth-Type %s",
 177                                 auth_type_pair->vp_strvalue);
 178                 cur_config_item = auth_type_pair->next;
 179
 180                 if (auth_type == PW_AUTHTYPE_REJECT) {
 181                         DEBUG2("  rad_check_password: Auth-Type = Reject, rejecting user");
 182                         return -2;
 183                 }
 184         }
 185
 186         if (( auth_type_count > 1) && (debug_flag)) {
 187                 radlog(L_ERR, "Warning:  Found %d auth-types on request for user '%s'",
 188                         auth_type_count, request->username->vp_strvalue);
 189         }
 190
 191         /*
 192          *      This means we have a proxy reply or an accept
 193          *  and it wasn't rejected in the above loop.  So
 194          *  that means it is accepted and we do no further
 195          *  authentication
 196          */
 197         if ((auth_type == PW_AUTHTYPE_ACCEPT) || (request->proxy)) {
 198                 DEBUG2("  rad_check_password: Auth-Type = Accept, accepting the user");
 199                 return 0;
 200         }
 201
 202         password_pair =  pairfind(request->config_items, PW_USER_PASSWORD);
 203         if (password_pair &&
 204             pairfind(request->config_items, PW_CLEARTEXT_PASSWORD)) {
 205                 pairdelete(&request->config_items, PW_USER_PASSWORD);
 206                 password_pair = NULL;
 207         }
 208
 209         if (password_pair) {
 210                 DEBUG("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 211                 DEBUG("!!!    Replacing User-Password in config items with Cleartext-Password.     !!!");
 212                 DEBUG("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 213                 DEBUG("!!! Please update your configuration so that the \"known good\"               !!!");
 214                 DEBUG("!!! clear text password is in Cleartext-Password, and not in User-Password. !!!");
 215                 DEBUG("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 216                 password_pair->attribute = PW_CLEARTEXT_PASSWORD;
 217                 strNcpy(password_pair->name, "Cleatext-Password",
 218                         sizeof(password_pair->name));
 219         }
 220
 221         /*
 222          *      Find the "known good" password.
 223          *
 224          *      FIXME: We should get rid of these hacks, and replace
 225          *      them with a module.
 226          */
 227         if ((password_pair = pairfind(request->config_items, PW_CRYPT_PASSWORD)) != NULL) {
 228                 /*
 229                  *      Re-write Auth-Type, but ONLY if it isn't already
 230                  *      set.
 231                  */
 232                 if (auth_type == -1) auth_type = PW_AUTHTYPE_CRYPT;
 233         } else {
 234                 password_pair = pairfind(request->config_items, PW_CLEARTEXT_PASSWORD);
 235         }
 236
 237         if (auth_type < 0) {
 238                 if (password_pair) {
 239                         auth_type = PW_AUTHTYPE_LOCAL;
 240                 } else {
 241                         /*
 242                         *       The admin hasn't told us how to
 243                         *       authenticate the user, so we reject them!
 244                         *
 245                         *       This is fail-safe.
 246                         */
 247                         DEBUG2("auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user");
 248                         return -2;
 249                 }
 250         }
 251
 252         switch(auth_type) {
 253                 DICT_VALUE *dval;
 254
 255                 case PW_AUTHTYPE_CRYPT:
 256                         /*
 257                          *      Find the password sent by the user. It
 258                          *      SHOULD be there, if it's not
 259                          *      authentication fails.
 260                          */
 261                         auth_item = request->password;
 262                         if (auth_item == NULL) {
 263                                 DEBUG2("auth: No User-Password or CHAP-Password attribute in the request");
 264                                 return -1;
 265                         }
 266
 267                         DEBUG2("auth: type Crypt");
 268                         if (password_pair == NULL) {
 269                                 DEBUG2("No Crypt-Password configured for the user");
 270                                 rad_authlog("Login incorrect "
 271                                         "(No Crypt-Password configured for the user)", request, 0);
 272                                 return -1;
 273                         }
 274
 275                         switch (lrad_crypt_check((char *)auth_item->vp_strvalue,
 276                                                                          (char *)password_pair->vp_strvalue)) {
 277                         case -1:
 278                           rad_authlog("Login incorrect "
 279                                                   "(system failed to supply an encrypted password for comparison)", request, 0);
 280                         case 1:
 281                           return -1;
 282                         }
 283                         break;
 284                 case PW_AUTHTYPE_LOCAL:
 285                         DEBUG2("auth: type Local");
 286
 287                         /*
 288                          *      Find the password sent by the user. It
 289                          *      SHOULD be there, if it's not
 290                          *      authentication fails.
 291                          */
 292                         auth_item = request->password;
 293                         if (!auth_item)
 294                                 auth_item = pairfind(request->packet->vps,
 295                                                      PW_CHAP_PASSWORD);
 296                         if (!auth_item) {
 297                                 DEBUG2("auth: No User-Password or CHAP-Password attribute in the request");
 298                                 return -1;
 299                         }
 300
 301                         /*
 302                          *      Plain text password.
 303                          */
 304                         if (password_pair == NULL) {
 305                                 DEBUG2("auth: No password configured for the user");
 306                                 rad_authlog("Login incorrect "
 307                                         "(No password configured for the user)", request, 0);
 308                                 return -1;
 309                         }
 310
 311                         /*
 312                          *      Local password is just plain text.
 313                          */
 314                         if (auth_item->attribute == PW_USER_PASSWORD) {
 315                                 if (strcmp((char *)password_pair->vp_strvalue,
 316                                            (char *)auth_item->vp_strvalue) != 0) {
 317                                         DEBUG2("auth: user supplied User-Password does NOT match local User-Password");
 318                                         return -1;
 319                                 }
 320                                 DEBUG2("auth: user supplied User-Password matches local User-Password");
 321                                 break;
 322
 323                         } else if (auth_item->attribute != PW_CHAP_PASSWORD) {
 324                                 DEBUG2("The user did not supply a User-Password or a CHAP-Password attribute");
 325                                 rad_authlog("Login incorrect "
 326                                         "(no User-Password or CHAP-Password attribute)", request, 0);
 327                                 return -1;
 328                         }
 329
 330                         rad_chap_encode(request->packet, string,
 331                                         auth_item->vp_strvalue[0], password_pair);
 332
 333                         /*
 334                          *      Compare them
 335                          */
 336                         if (memcmp(string + 1, auth_item->vp_strvalue + 1,
 337                                    CHAP_VALUE_LENGTH) != 0) {
 338                                 DEBUG2("auth: user supplied CHAP-Password does NOT match local User-Password");
 339                                 return -1;
 340                         }
 341                         DEBUG2("auth: user supplied CHAP-Password matches local User-Password");
 342                         break;
 343                 default:
 344                         dval = dict_valbyattr(PW_AUTH_TYPE, auth_type);
 345                         if (dval) {
 346                                 DEBUG2("auth: type \"%s\"", dval->name);
 347                         } else {
 348                                 DEBUG2("auth: type UNKNOWN-%d", auth_type);
 349                         }
 350
 351                         /*
 352                          *      See if there is a module that handles
 353                          *      this type, and turn the RLM_ return
 354                          *      status into the values as defined at
 355                          *      the top of this function.
 356                          */
 357                         result = module_authenticate(auth_type, request);
 358                         switch (result) {
 359                                 /*
 360                                  *      An authentication module FAIL
 361                                  *      return code, or any return code that
 362                                  *      is not expected from authentication,
 363                                  *      is the same as an explicit REJECT!
 364                                  */
 365                                 case RLM_MODULE_FAIL:
 366                                 case RLM_MODULE_INVALID:
 367                                 case RLM_MODULE_NOOP:
 368                                 case RLM_MODULE_NOTFOUND:
 369                                 case RLM_MODULE_REJECT:
 370                                 case RLM_MODULE_UPDATED:
 371                                 case RLM_MODULE_USERLOCK:
 372                                 default:
 373                                         result = -1;
 374                                         break;
 375                                 case RLM_MODULE_OK:
 376                                         result = 0;
 377                                         break;
 378                                 case RLM_MODULE_HANDLED:
 379                                         result = 1;
 380                                         break;
 381                         }
 382                         break;
 383         }
 384
 385         return result;
 386 }
 387
 388 /*
 389  *      Post-authentication step processes the response before it is
 390  *      sent to the NAS. It can receive both Access-Accept and Access-Reject
 391  *      replies.
 392  */
 393 int rad_postauth(REQUEST *request)
 394 {
 395         int     result;
 396         int     postauth_type = 0;
 397         VALUE_PAIR *vp;
 398
 399         /*
 400          *      Do post-authentication calls. ignoring the return code.
 401          */
 402         vp = pairfind(request->config_items, PW_POST_AUTH_TYPE);
 403         if (vp) {
 404                 DEBUG2("  Found Post-Auth-Type %s", vp->vp_strvalue);
 405                 postauth_type = vp->lvalue;
 406         }
 407         result = module_post_auth(postauth_type, request);
 408         switch (result) {
 409                 /*
 410                  *      The module failed, or said to reject the user: Do so.
 411                  */
 412                 case RLM_MODULE_FAIL:
 413                 case RLM_MODULE_INVALID:
 414                 case RLM_MODULE_REJECT:
 415                 case RLM_MODULE_USERLOCK:
 416                 default:
 417                         request->reply->code = PW_AUTHENTICATION_REJECT;
 418                         result = RLM_MODULE_REJECT;
 419                         break;
 420                 /*
 421                  *      The module handled the request, cancel the reply.
 422                  */
 423                 case RLM_MODULE_HANDLED:
 424                         /* FIXME */
 425                         break;
 426                 /*
 427                  *      The module had a number of OK return codes.
 428                  */
 429                 case RLM_MODULE_NOOP:
 430                 case RLM_MODULE_NOTFOUND:
 431                 case RLM_MODULE_OK:
 432                 case RLM_MODULE_UPDATED:
 433                         result = RLM_MODULE_OK;
 434                         break;
 435         }
 436         return result;
 437 }
 438
 439 /*
 440  *      Before sending an Access-Reject, call the modules in the
 441  *      Post-Auth-Type REJECT stanza.
 442  */
 443 static int rad_postauth_reject(REQUEST *request)
 444 {
 445         int             result;
 446         VALUE_PAIR      *tmp;
 447         DICT_VALUE      *dval;
 448
 449         dval = dict_valbyname(PW_POST_AUTH_TYPE, "REJECT");
 450         if (dval) {
 451                 /* Overwrite the Post-Auth-Type with the value REJECT */
 452                 pairdelete(&request->config_items, PW_POST_AUTH_TYPE);
 453                 tmp = paircreate(PW_POST_AUTH_TYPE, PW_TYPE_INTEGER);
 454                 tmp->lvalue = dval->value;
 455                 pairadd(&request->config_items, tmp);
 456                 result = rad_postauth(request);
 457         } else {
 458                 /* No REJECT stanza */
 459                 result = RLM_MODULE_OK;
 460         }
 461         return result;
 462 }
 463
 464 /*
 465  *      Process and reply to an authentication request
 466  *
 467  *      The return value of this function isn't actually used right now, so
 468  *      it's not entirely clear if it is returning the right things. --Pac.
 469  */
 470 int rad_authenticate(REQUEST *request)
 471 {
 472         VALUE_PAIR      *namepair;
 473         VALUE_PAIR      *check_item;
 474         VALUE_PAIR      *auth_item;
 475         VALUE_PAIR      *module_msg;
 476         VALUE_PAIR      *tmp = NULL;
 477         int             result;
 478         char            umsg[MAX_STRING_LEN + 1];
 479         const char      *user_msg = NULL;
 480         const char      *password;
 481         char            logstr[1024];
 482         char            autz_retry = 0;
 483         int             autz_type = 0;
 484
 485         password = "";
 486
 487         /*
 488          *      If this request got proxied to another server, we need
 489          *      to check whether it authenticated the request or not.
 490          */
 491         if (request->proxy_reply) {
 492                 switch (request->proxy_reply->code) {
 493                 /*
 494                  *      Reply of ACCEPT means accept, thus set Auth-Type
 495                  *      accordingly.
 496                  */
 497                 case PW_AUTHENTICATION_ACK:
 498                         tmp = paircreate(PW_AUTH_TYPE, PW_TYPE_INTEGER);
 499                         if (tmp == NULL) {
 500                                 radlog(L_ERR|L_CONS, "Not enough memory");
 501                                 exit(1);
 502                         }
 503                         tmp->lvalue = PW_AUTHTYPE_ACCEPT;
 504                         pairadd(&request->config_items, tmp);
 505                         break;
 506                 /*
 507                  *      Challenges are punted back to the NAS without any
 508                  *      further processing.
 509                  */
 510                 case PW_ACCESS_CHALLENGE:
 511                         request->reply->code = PW_ACCESS_CHALLENGE;
 512                         return RLM_MODULE_OK;
 513                 /*
 514                  *      ALL other replies mean reject. (this is fail-safe)
 515                  *
 516                  *      Do NOT do any authorization or authentication. They
 517                  *      are being rejected, so we minimize the amount of work
 518                  *      done by the server, by rejecting them here.
 519                  */
 520                 case PW_AUTHENTICATION_REJECT:
 521                 default:
 522                         rad_authlog("Login incorrect (Home Server says so)",
 523                                     request, 0);
 524                         request->reply->code = PW_AUTHENTICATION_REJECT;
 525                         rad_postauth_reject(request);
 526                         return RLM_MODULE_REJECT;
 527                 }
 528         }
 529
 530         /*
 531          *      Get the username from the request.
 532          *
 533          *      Note that namepair MAY be NULL, in which case there
 534          *      is no User-Name attribute in the request.
 535          */
 536         namepair = request->username;
 537
 538         /*
 539          *      Look for, and cache, passwords.
 540          */
 541         if (!request->password) {
 542                 request->password = pairfind(request->packet->vps,
 543                                              PW_USER_PASSWORD);
 544         }
 545
 546         /*
 547          *      Discover which password we want to use.
 548          */
 549         auth_item = request->password;
 550         if (auth_item) {
 551                 password = (const char *)auth_item->vp_strvalue;
 552
 553         } else {
 554                 /*
 555                  *      Maybe there's a CHAP-Password?
 556                  */
 557                 if ((auth_item = pairfind(request->packet->vps,
 558                                           PW_CHAP_PASSWORD)) != NULL) {
 559                         password = "<CHAP-PASSWORD>";
 560
 561                 } else {
 562                         /*
 563                          *      No password we recognize.
 564                          */
 565                         password = "<NO-PASSWORD>";
 566                 }
 567         }
 568         request->password = auth_item;
 569
 570         /*
 571          *      Get the user's authorization information from the database
 572          */
 573 autz_redo:
 574         result = module_authorize(autz_type, request);
 575         switch (result) {
 576                 case RLM_MODULE_NOOP:
 577                 case RLM_MODULE_NOTFOUND:
 578                 case RLM_MODULE_OK:
 579                 case RLM_MODULE_UPDATED:
 580                         break;
 581                 case RLM_MODULE_FAIL:
 582                 case RLM_MODULE_HANDLED:
 583                         return result;
 584                 case RLM_MODULE_INVALID:
 585                 case RLM_MODULE_REJECT:
 586                 case RLM_MODULE_USERLOCK:
 587                 default:
 588                         if ((module_msg = pairfind(request->packet->vps,
 589                                         PW_MODULE_FAILURE_MESSAGE)) != NULL) {
 590                                 char msg[MAX_STRING_LEN + 16];
 591                                 snprintf(msg, sizeof(msg), "Invalid user (%s)",
 592                                          module_msg->vp_strvalue);
 593                                 rad_authlog(msg,request,0);
 594                         } else {
 595                                 rad_authlog("Invalid user", request, 0);
 596                         }
 597                         request->reply->code = PW_AUTHENTICATION_REJECT;
 598                         return result;
 599         }
 600         if (!autz_retry) {
 601                 tmp = pairfind(request->config_items, PW_AUTZ_TYPE);
 602                 if (tmp) {
 603                         DEBUG2("  Found Autz-Type %s", tmp->vp_strvalue);
 604                         autz_type = tmp->lvalue;
 605                         autz_retry = 1;
 606                         goto autz_redo;
 607                 }
 608         }
 609
 610         /*
 611          *      If we haven't already proxied the packet, then check
 612          *      to see if we should.  Maybe one of the authorize
 613          *      modules has decided that a proxy should be used. If
 614          *      so, get out of here and send the packet.
 615          */
 616         if ((request->proxy == NULL) &&
 617             ((tmp = pairfind(request->config_items, PW_PROXY_TO_REALM)) != NULL)) {
 618                 REALM *realm;
 619
 620                 /*
 621                  *      Catch users who set Proxy-To-Realm to a LOCAL
 622                  *      realm (sigh).
 623                  */
 624                 realm = realm_find(tmp->vp_strvalue, 0);
 625                 rad_assert((realm == NULL) || (realm->ipaddr.af == AF_INET));
 626                 if (realm && (realm->ipaddr.ipaddr.ip4addr.s_addr == htonl(INADDR_NONE))) {
 627                         DEBUG2("  WARNING: You set Proxy-To-Realm = %s, but it is a LOCAL realm!  Cancelling invalid proxy request.", realm->realm);
 628                 } else {
 629                         /*
 630                          *      Don't authenticate, as the request is
 631                          *      proxied.
 632                          */
 633                         return RLM_MODULE_OK;
 634                 }
 635         }
 636
 637         /*
 638          *      Perhaps there is a Stripped-User-Name now.
 639          */
 640         namepair = request->username;
 641
 642         /*
 643          *      Validate the user
 644          */
 645         do {
 646                 result = rad_check_password(request);
 647                 if (result > 0) {
 648                         /* don't reply! */
 649                         return RLM_MODULE_HANDLED;
 650                 }
 651         } while(0);
 652
 653         /*
 654          *      Failed to validate the user.
 655          *
 656          *      We PRESUME that the code which failed will clean up
 657          *      request->reply->vps, to be ONLY the reply items it
 658          *      wants to send back.
 659          */
 660         if (result < 0) {
 661                 DEBUG2("auth: Failed to validate the user.");
 662                 request->reply->code = PW_AUTHENTICATION_REJECT;
 663
 664                 if ((module_msg = pairfind(request->packet->vps,PW_MODULE_FAILURE_MESSAGE)) != NULL){
 665                         char msg[MAX_STRING_LEN+19];
 666
 667                         snprintf(msg, sizeof(msg), "Login incorrect (%s)",
 668                                  module_msg->vp_strvalue);
 669                         rad_authlog(msg, request, 0);
 670                 } else {
 671                         rad_authlog("Login incorrect", request, 0);
 672                 }
 673
 674                 /* double check: maybe the secret is wrong? */
 675                 if ((debug_flag > 1) && (auth_item != NULL) &&
 676                                 (auth_item->attribute == PW_USER_PASSWORD)) {
 677                         u_char *p;
 678
 679                         p = auth_item->vp_strvalue;
 680                         while (*p != '\0') {
 681                                 if (!isprint((int) *p)) {
 682                                         log_debug("  WARNING: Unprintable characters in the password.\n\t  Double-check the shared secret on the server and the NAS!");
 683                                         break;
 684                                 }
 685                                 p++;
 686                         }
 687                 }
 688         }
 689
 690         if (result >= 0 &&
 691             (check_item = pairfind(request->config_items, PW_SIMULTANEOUS_USE)) != NULL) {
 692                 int r, session_type = 0;
 693
 694                 tmp = pairfind(request->config_items, PW_SESSION_TYPE);
 695                 if (tmp) {
 696                         DEBUG2("  Found Session-Type %s", tmp->vp_strvalue);
 697                         session_type = tmp->lvalue;
 698                 }
 699
 700                 /*
 701                  *      User authenticated O.K. Now we have to check
 702                  *      for the Simultaneous-Use parameter.
 703                  */
 704                 if (namepair &&
 705                     (r = module_checksimul(session_type, request, check_item->lvalue)) != 0) {
 706                         char mpp_ok = 0;
 707
 708                         if (r == 2){
 709                                 /* Multilink attempt. Check if port-limit > simultaneous-use */
 710                                 VALUE_PAIR *port_limit;
 711
 712                                 if ((port_limit = pairfind(request->reply->vps, PW_PORT_LIMIT)) != NULL &&
 713                                         port_limit->lvalue > check_item->lvalue){
 714                                         DEBUG2("main auth: MPP is OK");
 715                                         mpp_ok = 1;
 716                                 }
 717                         }
 718                         if (!mpp_ok){
 719                                 if (check_item->lvalue > 1) {
 720                                 snprintf(umsg, sizeof(umsg),
 721                                                         "\r\nYou are already logged in %d times  - access denied\r\n\n",
 722                                                         (int)check_item->lvalue);
 723                                         user_msg = umsg;
 724                                 } else {
 725                                         user_msg = "\r\nYou are already logged in - access denied\r\n\n";
 726                                 }
 727
 728                                 request->reply->code = PW_AUTHENTICATION_REJECT;
 729
 730                                 /*
 731                                  *      They're trying to log in too many times.
 732                                  *      Remove ALL reply attributes.
 733                                  */
 734                                 pairfree(&request->reply->vps);
 735                                 tmp = pairmake("Reply-Message", user_msg, T_OP_SET);
 736                                 request->reply->vps = tmp;
 737
 738                                 snprintf(logstr, sizeof(logstr), "Multiple logins (max %d) %s",
 739                                         check_item->lvalue,
 740                                         r == 2 ? "[MPP attempt]" : "");
 741                                 rad_authlog(logstr, request, 1);
 742
 743                                 result = -1;
 744                         }
 745                 }
 746         }
 747
 748         /*
 749          *      Result should be >= 0 here - if not, it means the user
 750          *      is rejected, so we just process post-auth and return.
 751          */
 752         if (result < 0) {
 753                 rad_postauth_reject(request);
 754                 return RLM_MODULE_REJECT;
 755         }
 756
 757         /*
 758          *      We might need this later.  The 'password' string
 759          *      is NOT used anywhere below here, except for logging,
 760          *      so it should be safe...
 761          */
 762         if ((auth_item != NULL) && (auth_item->attribute == PW_CHAP_PASSWORD)) {
 763                 password = "CHAP-Password";
 764         }
 765
 766         /*
 767          *      Add the port number to the Framed-IP-Address if
 768          *      vp->addport is set.
 769          */
 770         if (((tmp = pairfind(request->reply->vps,
 771                              PW_FRAMED_IP_ADDRESS)) != NULL) &&
 772             (tmp->flags.addport != 0)) {
 773                 VALUE_PAIR *vpPortId;
 774
 775                 /*
 776                  *  Find the NAS port ID.
 777                  */
 778                 if ((vpPortId = pairfind(request->packet->vps,
 779                                          PW_NAS_PORT)) != NULL) {
 780                   unsigned long tvalue = ntohl(tmp->lvalue);
 781                   tmp->lvalue = htonl(tvalue + vpPortId->lvalue);
 782                   tmp->flags.addport = 0;
 783                   ip_ntoa(tmp->vp_strvalue, tmp->lvalue);
 784                 } else {
 785                         DEBUG2("WARNING: No NAS-Port attribute in request.  CANNOT return a Framed-IP-Address + NAS-Port.\n");
 786                         pairdelete(&request->reply->vps, PW_FRAMED_IP_ADDRESS);
 787                 }
 788         }
 789
 790         /*
 791          *      Set the reply to Access-Accept, if it hasn't already
 792          *      been set to something.  (i.e. Access-Challenge)
 793          */
 794         if (request->reply->code == 0)
 795           request->reply->code = PW_AUTHENTICATION_ACK;
 796
 797         if ((module_msg = pairfind(request->packet->vps,PW_MODULE_SUCCESS_MESSAGE)) != NULL){
 798                 char msg[MAX_STRING_LEN+12];
 799
 800                 snprintf(msg, sizeof(msg), "Login OK (%s)",
 801                          module_msg->vp_strvalue);
 802                 rad_authlog(msg, request, 1);
 803         } else {
 804                 rad_authlog("Login OK", request, 1);
 805         }
 806
 807         /*
 808          *      Run the modules in the 'post-auth' section.
 809          */
 810         result = rad_postauth(request);
 811
 812         return result;
 813 }