src/main/auth.c

   1 /*
   2  * auth.c       User authentication.
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2000,2006  The FreeRADIUS server project
  21  * Copyright 2000  Miquel van Smoorenburg <miquels@cistron.nl>
  22  * Copyright 2000  Jeff Carneal <jeff@apex.net>
  23  */
  24
  25 #include <freeradius-devel/ident.h>
  26 RCSID("$Id$")
  27
  28 #include <freeradius-devel/radiusd.h>
  29 #include <freeradius-devel/modules.h>
  30 #include <freeradius-devel/rad_assert.h>
  31
  32 #include <ctype.h>
  33
  34 /*
  35  *      Return a short string showing the terminal server, port
  36  *      and calling station ID.
  37  */
  38 char *auth_name(char *buf, size_t buflen, REQUEST *request, int do_cli)
  39 {
  40         VALUE_PAIR      *cli;
  41         VALUE_PAIR      *pair;
  42         int             port = 0;
  43         const char      *tls = "";
  44
  45         if ((cli = pairfind(request->packet->vps, PW_CALLING_STATION_ID, 0)) == NULL)
  46                 do_cli = 0;
  47         if ((pair = pairfind(request->packet->vps, PW_NAS_PORT, 0)) != NULL)
  48                 port = pair->vp_integer;
  49
  50         if (request->packet->dst_port == 0) {
  51                 if (pairfind(request->packet->vps, PW_FREERADIUS_PROXIED_TO, 0)) {
  52                         tls = " via TLS tunnel";
  53                 } else {
  54                         tls = " via proxy to virtual server";
  55                 }
  56         }
  57
  58         snprintf(buf, buflen, "from client %.128s port %u%s%.128s%s",
  59                         request->client->shortname, port,
  60                  (do_cli ? " cli " : ""), (do_cli ? (char *)cli->vp_strvalue : ""),
  61                  tls);
  62
  63         return buf;
  64 }
  65
  66
  67
  68 /*
  69  * Make sure user/pass are clean
  70  * and then log them
  71  */
  72 static int rad_authlog(const char *msg, REQUEST *request, int goodpass)
  73 {
  74         int logit;
  75         const char *extra_msg = NULL;
  76         char clean_password[1024];
  77         char clean_username[1024];
  78         char buf[1024];
  79         char extra[1024];
  80         VALUE_PAIR *username = NULL;
  81
  82         if (!request->root->log_auth) {
  83                 return 0;
  84         }
  85
  86         /*
  87          * Get the correct username based on the configured value
  88          */
  89         if (log_stripped_names == 0) {
  90                 username = pairfind(request->packet->vps, PW_USER_NAME, 0);
  91         } else {
  92                 username = request->username;
  93         }
  94
  95         /*
  96          *      Clean up the username
  97          */
  98         if (username == NULL) {
  99                 strcpy(clean_username, "<no User-Name attribute>");
 100         } else {
 101                 fr_print_string((char *)username->vp_strvalue,
 102                                 username->length,
 103                                 clean_username, sizeof(clean_username));
 104         }
 105
 106         /*
 107          *      Clean up the password
 108          */
 109         if (request->root->log_auth_badpass || request->root->log_auth_goodpass) {
 110                 if (!request->password) {
 111                         VALUE_PAIR *auth_type;
 112
 113                         auth_type = pairfind(request->config_items,
 114                                              PW_AUTH_TYPE, 0);
 115                         if (auth_type && (auth_type->vp_strvalue[0] != '\0')) {
 116                                 snprintf(clean_password, sizeof(clean_password),
 117                                          "<via Auth-Type = %s>",
 118                                          auth_type->vp_strvalue);
 119                         } else {
 120                                 strcpy(clean_password, "<no User-Password attribute>");
 121                         }
 122                 } else if (pairfind(request->packet->vps, PW_CHAP_PASSWORD, 0)) {
 123                         strcpy(clean_password, "<CHAP-Password>");
 124                 } else {
 125                         fr_print_string((char *)request->password->vp_strvalue,
 126                                          request->password->length,
 127                                          clean_password, sizeof(clean_password));
 128                 }
 129         }
 130
 131         if (goodpass) {
 132                 logit = request->root->log_auth_goodpass;
 133                 extra_msg = request->root->auth_goodpass_msg;
 134         } else {
 135                 logit = request->root->log_auth_badpass;
 136                 extra_msg = request->root->auth_badpass_msg;
 137         }
 138
 139         if (extra_msg) {
 140                 extra[0] = ' ';
 141                 radius_xlat(extra + 1, sizeof(extra) - 1, extra_msg, request,
 142                             NULL);
 143         } else {
 144                 *extra = '\0';
 145         }
 146
 147         radlog_request(L_AUTH, 0, request, "%s: [%s%s%s] (%s)%s",
 148                        msg,
 149                        clean_username,
 150                        logit ? "/" : "",
 151                        logit ? clean_password : "",
 152                        auth_name(buf, sizeof(buf), request, 1),
 153                        extra);
 154
 155         return 0;
 156 }
 157
 158 /*
 159  *      Check password.
 160  *
 161  *      Returns:        0  OK
 162  *                      -1 Password fail
 163  *                      -2 Rejected (Auth-Type = Reject, send Port-Message back)
 164  *                      1  End check & return, don't reply
 165  *
 166  *      NOTE: NOT the same as the RLM_ values !
 167  */
 168 static int rad_check_password(REQUEST *request)
 169 {
 170         VALUE_PAIR *auth_type_pair;
 171         VALUE_PAIR *cur_config_item;
 172         VALUE_PAIR *password_pair;
 173         VALUE_PAIR *auth_item;
 174         uint8_t my_chap[MAX_STRING_LEN];
 175         int auth_type = -1;
 176         int result;
 177         int auth_type_count = 0;
 178         result = 0;
 179
 180         /*
 181          *      Look for matching check items. We skip the whole lot
 182          *      if the authentication type is PW_AUTHTYPE_ACCEPT or
 183          *      PW_AUTHTYPE_REJECT.
 184          */
 185         cur_config_item = request->config_items;
 186         while(((auth_type_pair = pairfind(cur_config_item, PW_AUTH_TYPE, 0))) != NULL) {
 187                 DICT_VALUE *dv;
 188                 auth_type = auth_type_pair->vp_integer;
 189                 auth_type_count++;
 190                 dv = dict_valbyattr(auth_type_pair->attribute,
 191                                                 auth_type_pair->vp_integer, 0);
 192
 193                 RDEBUG2("Found Auth-Type = %s",
 194                         (dv != NULL) ? dv->name : "?");
 195                 cur_config_item = auth_type_pair->next;
 196
 197                 if (auth_type == PW_AUTHTYPE_REJECT) {
 198                         RDEBUG2("Auth-Type = Reject, rejecting user");
 199                         return -2;
 200                 }
 201         }
 202
 203         if (( auth_type_count > 1) && (debug_flag)) {
 204                 radlog_request(L_ERR, 0, request, "Warning:  Found %d auth-types on request for user '%s'",
 205                         auth_type_count, request->username->vp_strvalue);
 206         }
 207
 208         /*
 209          *      This means we have a proxy reply or an accept
 210          *  and it wasn't rejected in the above loop.  So
 211          *  that means it is accepted and we do no further
 212          *  authentication
 213          */
 214         if ((auth_type == PW_AUTHTYPE_ACCEPT)
 215 #ifdef WITH_PROXY
 216             || (request->proxy)
 217 #endif
 218             ) {
 219                 RDEBUG2("Auth-Type = Accept, accepting the user");
 220                 return 0;
 221         }
 222
 223         password_pair =  pairfind(request->config_items, PW_USER_PASSWORD, 0);
 224         if (password_pair &&
 225             pairfind(request->config_items, PW_CLEARTEXT_PASSWORD, 0)) {
 226           pairdelete(&request->config_items, PW_USER_PASSWORD, 0);
 227                 password_pair = NULL;
 228         }
 229
 230         if (password_pair) {
 231                 DICT_ATTR *da;
 232
 233                 RDEBUG("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 234                 RDEBUG("!!!    Replacing User-Password in config items with Cleartext-Password.     !!!");
 235                 RDEBUG("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 236                 RDEBUG("!!! Please update your configuration so that the \"known good\"               !!!");
 237                 RDEBUG("!!! clear text password is in Cleartext-Password, and not in User-Password. !!!");
 238                 RDEBUG("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 239                 password_pair->attribute = PW_CLEARTEXT_PASSWORD;
 240                 da = dict_attrbyvalue(PW_CLEARTEXT_PASSWORD, 0);
 241                 if (!da) {
 242                         radlog_request(L_ERR, 0, request, "FATAL: You broke the dictionaries.  Please use the default dictionaries!");
 243                         _exit(1);
 244                 }
 245
 246                 password_pair->name = da->name;
 247         }
 248
 249         /*
 250          *      Find the "known good" password.
 251          *
 252          *      FIXME: We should get rid of these hacks, and replace
 253          *      them with a module.
 254          */
 255         if ((password_pair = pairfind(request->config_items, PW_CRYPT_PASSWORD, 0)) != NULL) {
 256                 /*
 257                  *      Re-write Auth-Type, but ONLY if it isn't already
 258                  *      set.
 259                  */
 260                 if (auth_type == -1) auth_type = PW_AUTHTYPE_CRYPT;
 261         } else {
 262                 password_pair = pairfind(request->config_items, PW_CLEARTEXT_PASSWORD, 0);
 263         }
 264
 265         if (auth_type < 0) {
 266                 if (password_pair) {
 267                         auth_type = PW_AUTHTYPE_LOCAL;
 268                 } else {
 269                         /*
 270                         *       The admin hasn't told us how to
 271                         *       authenticate the user, so we reject them!
 272                         *
 273                         *       This is fail-safe.
 274                         */
 275                         RDEBUG2("ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user");
 276                         return -2;
 277                 }
 278         }
 279
 280         switch(auth_type) {
 281                 case PW_AUTHTYPE_CRYPT:
 282                         RDEBUG2("WARNING: Please update your configuration, and remove 'Auth-Type = Crypt'");
 283                         RDEBUG2("WARNING: Use the PAP module instead.");
 284
 285                         /*
 286                          *      Find the password sent by the user. It
 287                          *      SHOULD be there, if it's not
 288                          *      authentication fails.
 289                          */
 290                         auth_item = request->password;
 291                         if (auth_item == NULL) {
 292                                 RDEBUG2("No User-Password or CHAP-Password attribute in the request");
 293                                 return -1;
 294                         }
 295
 296                         if (password_pair == NULL) {
 297                                 RDEBUG2("No Crypt-Password configured for the user");
 298                                 rad_authlog("Login incorrect "
 299                                         "(No Crypt-Password configured for the user)", request, 0);
 300                                 return -1;
 301                         }
 302
 303                         switch (fr_crypt_check((char *)auth_item->vp_strvalue,
 304                                                                          (char *)password_pair->vp_strvalue)) {
 305                         case -1:
 306                           rad_authlog("Login incorrect "
 307                                                   "(system failed to supply an encrypted password for comparison)", request, 0);
 308                         case 1:
 309                           return -1;
 310                         }
 311                         break;
 312                 case PW_AUTHTYPE_LOCAL:
 313                         RDEBUG2("WARNING: Please update your configuration, and remove 'Auth-Type = Local'");
 314                         RDEBUG2("WARNING: Use the PAP or CHAP modules instead.");
 315
 316                         /*
 317                          *      Find the password sent by the user. It
 318                          *      SHOULD be there, if it's not
 319                          *      authentication fails.
 320                          */
 321                         auth_item = request->password;
 322                         if (!auth_item)
 323                                 auth_item = pairfind(request->packet->vps,
 324                                                      PW_CHAP_PASSWORD, 0);
 325                         if (!auth_item) {
 326                                 RDEBUG2("No User-Password or CHAP-Password attribute in the request.");
 327                                 RDEBUG2("Cannot perform authentication.");
 328                                 return -1;
 329                         }
 330
 331                         /*
 332                          *      Plain text password.
 333                          */
 334                         if (password_pair == NULL) {
 335                                 RDEBUG2("No \"known good\" password was configured for the user.");
 336                                 RDEBUG2("As a result, we cannot authenticate the user.");
 337                                 rad_authlog("Login incorrect "
 338                                         "(No password configured for the user)", request, 0);
 339                                 return -1;
 340                         }
 341
 342                         /*
 343                          *      Local password is just plain text.
 344                          */
 345                         if (auth_item->attribute == PW_USER_PASSWORD) {
 346                                 if (strcmp((char *)password_pair->vp_strvalue,
 347                                            (char *)auth_item->vp_strvalue) != 0) {
 348                                         RDEBUG2("User-Password in the request does NOT match \"known good\" password.");
 349                                         return -1;
 350                                 }
 351                                 RDEBUG2("User-Password in the request is correct.");
 352                                 break;
 353
 354                         } else if (auth_item->attribute != PW_CHAP_PASSWORD) {
 355                                 RDEBUG2("The user did not supply a User-Password or a CHAP-Password attribute");
 356                                 rad_authlog("Login incorrect "
 357                                         "(no User-Password or CHAP-Password attribute)", request, 0);
 358                                 return -1;
 359                         }
 360
 361                         rad_chap_encode(request->packet, my_chap,
 362                                         auth_item->vp_octets[0], password_pair);
 363
 364                         /*
 365                          *      Compare them
 366                          */
 367                         if (memcmp(my_chap + 1, auth_item->vp_strvalue + 1,
 368                                    CHAP_VALUE_LENGTH) != 0) {
 369                                 RDEBUG2("CHAP-Password is incorrect.");
 370                                 return -1;
 371                         }
 372                         RDEBUG2("CHAP-Password is correct.");
 373                         break;
 374                 default:
 375                         /*
 376                          *      See if there is a module that handles
 377                          *      this type, and turn the RLM_ return
 378                          *      status into the values as defined at
 379                          *      the top of this function.
 380                          */
 381                         result = module_authenticate(auth_type, request);
 382                         switch (result) {
 383                                 /*
 384                                  *      An authentication module FAIL
 385                                  *      return code, or any return code that
 386                                  *      is not expected from authentication,
 387                                  *      is the same as an explicit REJECT!
 388                                  */
 389                                 case RLM_MODULE_FAIL:
 390                                 case RLM_MODULE_INVALID:
 391                                 case RLM_MODULE_NOOP:
 392                                 case RLM_MODULE_NOTFOUND:
 393                                 case RLM_MODULE_REJECT:
 394                                 case RLM_MODULE_UPDATED:
 395                                 case RLM_MODULE_USERLOCK:
 396                                 default:
 397                                         result = -1;
 398                                         break;
 399                                 case RLM_MODULE_OK:
 400                                         result = 0;
 401                                         break;
 402                                 case RLM_MODULE_HANDLED:
 403                                         result = 1;
 404                                         break;
 405                         }
 406                         break;
 407         }
 408
 409         return result;
 410 }
 411
 412 /*
 413  *      Post-authentication step processes the response before it is
 414  *      sent to the NAS. It can receive both Access-Accept and Access-Reject
 415  *      replies.
 416  */
 417 int rad_postauth(REQUEST *request)
 418 {
 419         int     result;
 420         int     postauth_type = 0;
 421         VALUE_PAIR *vp;
 422
 423         /*
 424          *      Do post-authentication calls. ignoring the return code.
 425          */
 426         vp = pairfind(request->config_items, PW_POST_AUTH_TYPE, 0);
 427         if (vp) {
 428                 RDEBUG2("Using Post-Auth-Type %s", vp->vp_strvalue);
 429                 postauth_type = vp->vp_integer;
 430         }
 431         result = module_post_auth(postauth_type, request);
 432         switch (result) {
 433                 /*
 434                  *      The module failed, or said to reject the user: Do so.
 435                  */
 436                 case RLM_MODULE_FAIL:
 437                 case RLM_MODULE_INVALID:
 438                 case RLM_MODULE_REJECT:
 439                 case RLM_MODULE_USERLOCK:
 440                 default:
 441                         request->reply->code = PW_AUTHENTICATION_REJECT;
 442                         result = RLM_MODULE_REJECT;
 443                         break;
 444                 /*
 445                  *      The module handled the request, cancel the reply.
 446                  */
 447                 case RLM_MODULE_HANDLED:
 448                         /* FIXME */
 449                         break;
 450                 /*
 451                  *      The module had a number of OK return codes.
 452                  */
 453                 case RLM_MODULE_NOOP:
 454                 case RLM_MODULE_NOTFOUND:
 455                 case RLM_MODULE_OK:
 456                 case RLM_MODULE_UPDATED:
 457                         result = RLM_MODULE_OK;
 458                         break;
 459         }
 460         return result;
 461 }
 462
 463 /*
 464  *      Process and reply to an authentication request
 465  *
 466  *      The return value of this function isn't actually used right now, so
 467  *      it's not entirely clear if it is returning the right things. --Pac.
 468  */
 469 int rad_authenticate(REQUEST *request)
 470 {
 471         VALUE_PAIR      *namepair;
 472 #ifdef WITH_SESSION_MGMT
 473         VALUE_PAIR      *check_item;
 474 #endif
 475         VALUE_PAIR      *auth_item = NULL;
 476         VALUE_PAIR      *module_msg;
 477         VALUE_PAIR      *tmp = NULL;
 478         int             result;
 479         const char      *password;
 480         char            autz_retry = 0;
 481         int             autz_type = 0;
 482
 483         password = "";
 484
 485 #ifdef WITH_PROXY
 486         /*
 487          *      If this request got proxied to another server, we need
 488          *      to check whether it authenticated the request or not.
 489          */
 490         if (request->proxy_reply) {
 491                 switch (request->proxy_reply->code) {
 492                 /*
 493                  *      Reply of ACCEPT means accept, thus set Auth-Type
 494                  *      accordingly.
 495                  */
 496                 case PW_AUTHENTICATION_ACK:
 497                         tmp = radius_paircreate(request,
 498                                                 &request->config_items,
 499                                                 PW_AUTH_TYPE, 0, PW_TYPE_INTEGER);
 500                         if (tmp) tmp->vp_integer = PW_AUTHTYPE_ACCEPT;
 501                         goto authenticate;
 502
 503                 /*
 504                  *      Challenges are punted back to the NAS without any
 505                  *      further processing.
 506                  */
 507                 case PW_ACCESS_CHALLENGE:
 508                         request->reply->code = PW_ACCESS_CHALLENGE;
 509                         return RLM_MODULE_OK;
 510                 /*
 511                  *      ALL other replies mean reject. (this is fail-safe)
 512                  *
 513                  *      Do NOT do any authorization or authentication. They
 514                  *      are being rejected, so we minimize the amount of work
 515                  *      done by the server, by rejecting them here.
 516                  */
 517                 case PW_AUTHENTICATION_REJECT:
 518                         rad_authlog("Login incorrect (Home Server says so)",
 519                                     request, 0);
 520                         request->reply->code = PW_AUTHENTICATION_REJECT;
 521                         return RLM_MODULE_REJECT;
 522
 523                 default:
 524                         rad_authlog("Login incorrect (Home Server failed to respond)",
 525                                     request, 0);
 526                         return RLM_MODULE_REJECT;
 527                 }
 528         }
 529 #endif
 530
 531         /*
 532          *      Get the username from the request.
 533          *
 534          *      Note that namepair MAY be NULL, in which case there
 535          *      is no User-Name attribute in the request.
 536          */
 537         namepair = request->username;
 538
 539         /*
 540          *      Look for, and cache, passwords.
 541          */
 542         if (!request->password) {
 543                 request->password = pairfind(request->packet->vps,
 544                                              PW_USER_PASSWORD, 0);
 545         }
 546
 547         /*
 548          *      Discover which password we want to use.
 549          */
 550         auth_item = request->password;
 551         if (auth_item) {
 552                 password = (const char *)auth_item->vp_strvalue;
 553
 554         } else {
 555                 /*
 556                  *      Maybe there's a CHAP-Password?
 557                  */
 558                 if ((auth_item = pairfind(request->packet->vps,
 559                                           PW_CHAP_PASSWORD, 0)) != NULL) {
 560                         password = "<CHAP-PASSWORD>";
 561
 562                 } else {
 563                         /*
 564                          *      No password we recognize.
 565                          */
 566                         password = "<NO-PASSWORD>";
 567                 }
 568         }
 569         request->password = auth_item;
 570
 571         /*
 572          *      Get the user's authorization information from the database
 573          */
 574 autz_redo:
 575         result = module_authorize(autz_type, request);
 576         switch (result) {
 577                 case RLM_MODULE_NOOP:
 578                 case RLM_MODULE_NOTFOUND:
 579                 case RLM_MODULE_OK:
 580                 case RLM_MODULE_UPDATED:
 581                         break;
 582                 case RLM_MODULE_HANDLED:
 583                         return result;
 584                 case RLM_MODULE_FAIL:
 585                 case RLM_MODULE_INVALID:
 586                 case RLM_MODULE_REJECT:
 587                 case RLM_MODULE_USERLOCK:
 588                 default:
 589                         if ((module_msg = pairfind(request->packet->vps,
 590                                                    PW_MODULE_FAILURE_MESSAGE, 0)) != NULL) {
 591                                 char msg[MAX_STRING_LEN + 16];
 592                                 snprintf(msg, sizeof(msg), "Invalid user (%s)",
 593                                          module_msg->vp_strvalue);
 594                                 rad_authlog(msg,request,0);
 595                         } else {
 596                                 rad_authlog("Invalid user", request, 0);
 597                         }
 598                         request->reply->code = PW_AUTHENTICATION_REJECT;
 599                         return result;
 600         }
 601         if (!autz_retry) {
 602                 tmp = pairfind(request->config_items, PW_AUTZ_TYPE, 0);
 603                 if (tmp) {
 604                         RDEBUG2("Using Autz-Type %s", tmp->vp_strvalue);
 605                         autz_type = tmp->vp_integer;
 606                         autz_retry = 1;
 607                         goto autz_redo;
 608                 }
 609         }
 610
 611         /*
 612          *      If we haven't already proxied the packet, then check
 613          *      to see if we should.  Maybe one of the authorize
 614          *      modules has decided that a proxy should be used. If
 615          *      so, get out of here and send the packet.
 616          */
 617         if (
 618 #ifdef WITH_PROXY
 619             (request->proxy == NULL) &&
 620 #endif
 621             ((tmp = pairfind(request->config_items, PW_PROXY_TO_REALM, 0)) != NULL)) {
 622                 REALM *realm;
 623
 624                 realm = realm_find2(tmp->vp_strvalue);
 625
 626                 /*
 627                  *      Don't authenticate, as the request is going to
 628                  *      be proxied.
 629                  */
 630                 if (realm && realm->auth_pool) {
 631                         return RLM_MODULE_OK;
 632                 }
 633
 634                 /*
 635                  *      Catch users who set Proxy-To-Realm to a LOCAL
 636                  *      realm (sigh).  But don't complain if it is
 637                  *      *the* LOCAL realm.
 638                  */
 639                 if (realm &&(strcmp(realm->name, "LOCAL") != 0)) {
 640                         RDEBUG2("WARNING: You set Proxy-To-Realm = %s, but it is a LOCAL realm!  Cancelling proxy request.", realm->name);
 641                 }
 642
 643                 if (!realm) {
 644                         RDEBUG2("WARNING: You set Proxy-To-Realm = %s, but the realm does not exist!  Cancelling invalid proxy request.", tmp->vp_strvalue);
 645                 }
 646         }
 647
 648 #ifdef WITH_PROXY
 649  authenticate:
 650 #endif
 651
 652         /*
 653          *      Perhaps there is a Stripped-User-Name now.
 654          */
 655         namepair = request->username;
 656
 657         /*
 658          *      Validate the user
 659          */
 660         do {
 661                 result = rad_check_password(request);
 662                 if (result > 0) {
 663                         /* don't reply! */
 664                         return RLM_MODULE_HANDLED;
 665                 }
 666         } while(0);
 667
 668         /*
 669          *      Failed to validate the user.
 670          *
 671          *      We PRESUME that the code which failed will clean up
 672          *      request->reply->vps, to be ONLY the reply items it
 673          *      wants to send back.
 674          */
 675         if (result < 0) {
 676                 RDEBUG2("Failed to authenticate the user.");
 677                 request->reply->code = PW_AUTHENTICATION_REJECT;
 678
 679                 if ((module_msg = pairfind(request->packet->vps,PW_MODULE_FAILURE_MESSAGE, 0)) != NULL){
 680                         char msg[MAX_STRING_LEN+19];
 681
 682                         snprintf(msg, sizeof(msg), "Login incorrect (%s)",
 683                                  module_msg->vp_strvalue);
 684                         rad_authlog(msg, request, 0);
 685                 } else {
 686                         rad_authlog("Login incorrect", request, 0);
 687                 }
 688
 689                 /* double check: maybe the secret is wrong? */
 690                 if ((debug_flag > 1) && (auth_item != NULL) &&
 691                                 (auth_item->attribute == PW_USER_PASSWORD)) {
 692                         char *p;
 693
 694                         p = auth_item->vp_strvalue;
 695                         while (*p) {
 696                                 int size;
 697
 698                                 size = fr_utf8_char(p);
 699                                 if (!size) {
 700                                         log_debug("  WARNING: Unprintable characters in the password.  Double-check the shared secret on the server and the NAS!");
 701                                         break;
 702                                 }
 703                                 p += size;
 704                         }
 705                 }
 706         }
 707
 708 #ifdef WITH_SESSION_MGMT
 709         if (result >= 0 &&
 710             (check_item = pairfind(request->config_items, PW_SIMULTANEOUS_USE, 0)) != NULL) {
 711                 int r, session_type = 0;
 712                 char            logstr[1024];
 713                 char            umsg[MAX_STRING_LEN + 1];
 714                 const char      *user_msg = NULL;
 715
 716                 tmp = pairfind(request->config_items, PW_SESSION_TYPE, 0);
 717                 if (tmp) {
 718                         RDEBUG2("Using Session-Type %s", tmp->vp_strvalue);
 719                         session_type = tmp->vp_integer;
 720                 }
 721
 722                 /*
 723                  *      User authenticated O.K. Now we have to check
 724                  *      for the Simultaneous-Use parameter.
 725                  */
 726                 if (namepair &&
 727                     (r = module_checksimul(session_type, request, check_item->vp_integer)) != 0) {
 728                         char mpp_ok = 0;
 729
 730                         if (r == 2){
 731                                 /* Multilink attempt. Check if port-limit > simultaneous-use */
 732                                 VALUE_PAIR *port_limit;
 733
 734                                 if ((port_limit = pairfind(request->reply->vps, PW_PORT_LIMIT, 0)) != NULL &&
 735                                         port_limit->vp_integer > check_item->vp_integer){
 736                                         RDEBUG2("MPP is OK");
 737                                         mpp_ok = 1;
 738                                 }
 739                         }
 740                         if (!mpp_ok){
 741                                 if (check_item->vp_integer > 1) {
 742                                 snprintf(umsg, sizeof(umsg),
 743                                                         "\r\nYou are already logged in %d times  - access denied\r\n\n",
 744                                                         (int)check_item->vp_integer);
 745                                         user_msg = umsg;
 746                                 } else {
 747                                         user_msg = "\r\nYou are already logged in - access denied\r\n\n";
 748                                 }
 749
 750                                 request->reply->code = PW_AUTHENTICATION_REJECT;
 751
 752                                 /*
 753                                  *      They're trying to log in too many times.
 754                                  *      Remove ALL reply attributes.
 755                                  */
 756                                 pairfree(&request->reply->vps);
 757                                 radius_pairmake(request, &request->reply->vps,
 758                                                 "Reply-Message",
 759                                                 user_msg, T_OP_SET);
 760
 761                                 snprintf(logstr, sizeof(logstr), "Multiple logins (max %d) %s",
 762                                         check_item->vp_integer,
 763                                         r == 2 ? "[MPP attempt]" : "");
 764                                 rad_authlog(logstr, request, 1);
 765
 766                                 result = -1;
 767                         }
 768                 }
 769         }
 770 #endif
 771
 772         /*
 773          *      Result should be >= 0 here - if not, it means the user
 774          *      is rejected, so we just process post-auth and return.
 775          */
 776         if (result < 0) {
 777                 return RLM_MODULE_REJECT;
 778         }
 779
 780         /*
 781          *      Add the port number to the Framed-IP-Address if
 782          *      vp->addport is set.
 783          */
 784         if (((tmp = pairfind(request->reply->vps,
 785                              PW_FRAMED_IP_ADDRESS, 0)) != NULL) &&
 786             (tmp->flags.addport != 0)) {
 787                 VALUE_PAIR *vpPortId;
 788
 789                 /*
 790                  *  Find the NAS port ID.
 791                  */
 792                 if ((vpPortId = pairfind(request->packet->vps,
 793                                          PW_NAS_PORT, 0)) != NULL) {
 794                   unsigned long tvalue = ntohl(tmp->vp_integer);
 795                   tmp->vp_integer = htonl(tvalue + vpPortId->vp_integer);
 796                   tmp->flags.addport = 0;
 797                   ip_ntoa(tmp->vp_strvalue, tmp->vp_integer);
 798                 } else {
 799                         RDEBUG2("WARNING: No NAS-Port attribute in request.  CANNOT return a Framed-IP-Address + NAS-Port.\n");
 800                         pairdelete(&request->reply->vps, PW_FRAMED_IP_ADDRESS, 0);
 801                 }
 802         }
 803
 804         /*
 805          *      Set the reply to Access-Accept, if it hasn't already
 806          *      been set to something.  (i.e. Access-Challenge)
 807          */
 808         if (request->reply->code == 0)
 809           request->reply->code = PW_AUTHENTICATION_ACK;
 810
 811         if ((module_msg = pairfind(request->packet->vps,PW_MODULE_SUCCESS_MESSAGE, 0)) != NULL){
 812                 char msg[MAX_STRING_LEN+12];
 813
 814                 snprintf(msg, sizeof(msg), "Login OK (%s)",
 815                          module_msg->vp_strvalue);
 816                 rad_authlog(msg, request, 1);
 817         } else {
 818                 rad_authlog("Login OK", request, 1);
 819         }
 820
 821         /*
 822          *      Run the modules in the 'post-auth' section.
 823          */
 824         result = rad_postauth(request);
 825
 826         return result;
 827 }