src/main/auth.c

   1 /*
   2  * auth.c       User authentication.
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2000,2006  The FreeRADIUS server project
  21  * Copyright 2000  Miquel van Smoorenburg <miquels@cistron.nl>
  22  * Copyright 2000  Jeff Carneal <jeff@apex.net>
  23  */
  24
  25 #include <freeradius-devel/ident.h>
  26 RCSID("$Id$")
  27
  28 #include <freeradius-devel/radiusd.h>
  29 #include <freeradius-devel/modules.h>
  30 #include <freeradius-devel/rad_assert.h>
  31
  32 #include <ctype.h>
  33
  34 /*
  35  *      Return a short string showing the terminal server, port
  36  *      and calling station ID.
  37  */
  38 char *auth_name(char *buf, size_t buflen, REQUEST *request, int do_cli)
  39 {
  40         VALUE_PAIR      *cli;
  41         VALUE_PAIR      *pair;
  42         int             port = 0;
  43
  44         if ((cli = pairfind(request->packet->vps, PW_CALLING_STATION_ID)) == NULL)
  45                 do_cli = 0;
  46         if ((pair = pairfind(request->packet->vps, PW_NAS_PORT)) != NULL)
  47                 port = pair->vp_integer;
  48
  49         snprintf(buf, buflen, "from client %.128s port %u%s%.128s%s",
  50                         request->client->shortname, port,
  51                  (do_cli ? " cli " : ""), (do_cli ? (char *)cli->vp_strvalue : ""),
  52                  (request->packet->dst_port == 0) ? " via TLS tunnel" : "");
  53
  54         return buf;
  55 }
  56
  57
  58
  59 /*
  60  * Make sure user/pass are clean
  61  * and then log them
  62  */
  63 static int rad_authlog(const char *msg, REQUEST *request, int goodpass) {
  64
  65         char clean_password[1024];
  66         char clean_username[1024];
  67         char buf[1024];
  68         VALUE_PAIR *username = NULL;
  69
  70         if (!request->root->log_auth) {
  71                 return 0;
  72         }
  73
  74         /*
  75          * Get the correct username based on the configured value
  76          */
  77         if (log_stripped_names == 0) {
  78                 username = pairfind(request->packet->vps, PW_USER_NAME);
  79         } else {
  80                 username = request->username;
  81         }
  82
  83         /*
  84          *      Clean up the username
  85          */
  86         if (username == NULL) {
  87                 strcpy(clean_username, "<no User-Name attribute>");
  88         } else {
  89                 librad_safeprint((char *)username->vp_strvalue,
  90                                 username->length,
  91                                 clean_username, sizeof(clean_username));
  92         }
  93
  94         /*
  95          *      Clean up the password
  96          */
  97         if (request->root->log_auth_badpass || request->root->log_auth_goodpass) {
  98                 if (!request->password) {
  99                         VALUE_PAIR *auth_type;
 100
 101                         auth_type = pairfind(request->config_items,
 102                                              PW_AUTH_TYPE);
 103                         if (auth_type && (auth_type->vp_strvalue[0] != '\0')) {
 104                                 snprintf(clean_password, sizeof(clean_password),
 105                                          "<via Auth-Type = %s>",
 106                                          auth_type->vp_strvalue);
 107                         } else {
 108                                 strcpy(clean_password, "<no User-Password attribute>");
 109                         }
 110                 } else if (pairfind(request->packet->vps, PW_CHAP_PASSWORD)) {
 111                         strcpy(clean_password, "<CHAP-Password>");
 112                 } else {
 113                         librad_safeprint((char *)request->password->vp_strvalue,
 114                                          request->password->length,
 115                                          clean_password, sizeof(clean_password));
 116                 }
 117         }
 118
 119         if (goodpass) {
 120                 radlog_request(L_AUTH, 0, request, "%s: [%s%s%s] (%s)",
 121                                 msg,
 122                                 clean_username,
 123                                 request->root->log_auth_goodpass ? "/" : "",
 124                                 request->root->log_auth_goodpass ? clean_password : "",
 125                                 auth_name(buf, sizeof(buf), request, 1));
 126         } else {
 127                 radlog_request(L_AUTH, 0, request, "%s: [%s%s%s] (%s)",
 128                                 msg,
 129                                 clean_username,
 130                                 request->root->log_auth_badpass ? "/" : "",
 131                                 request->root->log_auth_badpass ? clean_password : "",
 132                                 auth_name(buf, sizeof(buf), request, 1));
 133         }
 134
 135         return 0;
 136 }
 137
 138 /*
 139  *      Check password.
 140  *
 141  *      Returns:        0  OK
 142  *                      -1 Password fail
 143  *                      -2 Rejected (Auth-Type = Reject, send Port-Message back)
 144  *                      1  End check & return, don't reply
 145  *
 146  *      NOTE: NOT the same as the RLM_ values !
 147  */
 148 static int rad_check_password(REQUEST *request)
 149 {
 150         VALUE_PAIR *auth_type_pair;
 151         VALUE_PAIR *cur_config_item;
 152         VALUE_PAIR *password_pair;
 153         VALUE_PAIR *auth_item;
 154         uint8_t my_chap[MAX_STRING_LEN];
 155         int auth_type = -1;
 156         int result;
 157         int auth_type_count = 0;
 158         result = 0;
 159
 160         /*
 161          *      Look for matching check items. We skip the whole lot
 162          *      if the authentication type is PW_AUTHTYPE_ACCEPT or
 163          *      PW_AUTHTYPE_REJECT.
 164          */
 165         cur_config_item = request->config_items;
 166         while(((auth_type_pair = pairfind(cur_config_item, PW_AUTH_TYPE))) != NULL) {
 167                 auth_type = auth_type_pair->vp_integer;
 168                 auth_type_count++;
 169                 DICT_VALUE *dv = dict_valbyattr(auth_type_pair->attribute,
 170                                                 auth_type_pair->vp_integer);
 171
 172                 RDEBUG2("Found Auth-Type = %s",
 173                         (dv != NULL) ? dv->name : "?");
 174                 cur_config_item = auth_type_pair->next;
 175
 176                 if (auth_type == PW_AUTHTYPE_REJECT) {
 177                         RDEBUG2("Auth-Type = Reject, rejecting user");
 178                         return -2;
 179                 }
 180         }
 181
 182         if (( auth_type_count > 1) && (debug_flag)) {
 183                 radlog_request(L_ERR, 0, request, "Warning:  Found %d auth-types on request for user '%s'",
 184                         auth_type_count, request->username->vp_strvalue);
 185         }
 186
 187         /*
 188          *      This means we have a proxy reply or an accept
 189          *  and it wasn't rejected in the above loop.  So
 190          *  that means it is accepted and we do no further
 191          *  authentication
 192          */
 193         if ((auth_type == PW_AUTHTYPE_ACCEPT)
 194 #ifdef WITH_PROXY
 195             || (request->proxy)
 196 #endif
 197             ) {
 198                 RDEBUG2("Auth-Type = Accept, accepting the user");
 199                 return 0;
 200         }
 201
 202         password_pair =  pairfind(request->config_items, PW_USER_PASSWORD);
 203         if (password_pair &&
 204             pairfind(request->config_items, PW_CLEARTEXT_PASSWORD)) {
 205                 pairdelete(&request->config_items, PW_USER_PASSWORD);
 206                 password_pair = NULL;
 207         }
 208
 209         if (password_pair) {
 210                 DICT_ATTR *da;
 211
 212                 RDEBUG("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 213                 RDEBUG("!!!    Replacing User-Password in config items with Cleartext-Password.     !!!");
 214                 RDEBUG("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 215                 RDEBUG("!!! Please update your configuration so that the \"known good\"               !!!");
 216                 RDEBUG("!!! clear text password is in Cleartext-Password, and not in User-Password. !!!");
 217                 RDEBUG("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 218                 password_pair->attribute = PW_CLEARTEXT_PASSWORD;
 219                 da = dict_attrbyvalue(PW_CLEARTEXT_PASSWORD);
 220                 if (!da) {
 221                         radlog_request(L_ERR, 0, request, "FATAL: You broke the dictionaries.  Please use the default dictionaries!");
 222                         _exit(1);
 223                 }
 224
 225                 password_pair->name = da->name;
 226         }
 227
 228         /*
 229          *      Find the "known good" password.
 230          *
 231          *      FIXME: We should get rid of these hacks, and replace
 232          *      them with a module.
 233          */
 234         if ((password_pair = pairfind(request->config_items, PW_CRYPT_PASSWORD)) != NULL) {
 235                 /*
 236                  *      Re-write Auth-Type, but ONLY if it isn't already
 237                  *      set.
 238                  */
 239                 if (auth_type == -1) auth_type = PW_AUTHTYPE_CRYPT;
 240         } else {
 241                 password_pair = pairfind(request->config_items, PW_CLEARTEXT_PASSWORD);
 242         }
 243
 244         if (auth_type < 0) {
 245                 if (password_pair) {
 246                         auth_type = PW_AUTHTYPE_LOCAL;
 247                 } else {
 248                         /*
 249                         *       The admin hasn't told us how to
 250                         *       authenticate the user, so we reject them!
 251                         *
 252                         *       This is fail-safe.
 253                         */
 254                         RDEBUG2("No authenticate method (Auth-Type) configuration found for the request: Rejecting the user");
 255                         return -2;
 256                 }
 257         }
 258
 259         switch(auth_type) {
 260                 case PW_AUTHTYPE_CRYPT:
 261                         RDEBUG2("WARNING: Please update your configuration, and remove 'Auth-Type = Crypt'");
 262                         RDEBUG2("WARNING: Use the PAP module instead.");
 263
 264                         /*
 265                          *      Find the password sent by the user. It
 266                          *      SHOULD be there, if it's not
 267                          *      authentication fails.
 268                          */
 269                         auth_item = request->password;
 270                         if (auth_item == NULL) {
 271                                 RDEBUG2("No User-Password or CHAP-Password attribute in the request");
 272                                 return -1;
 273                         }
 274
 275                         if (password_pair == NULL) {
 276                                 RDEBUG2("No Crypt-Password configured for the user");
 277                                 rad_authlog("Login incorrect "
 278                                         "(No Crypt-Password configured for the user)", request, 0);
 279                                 return -1;
 280                         }
 281
 282                         switch (fr_crypt_check((char *)auth_item->vp_strvalue,
 283                                                                          (char *)password_pair->vp_strvalue)) {
 284                         case -1:
 285                           rad_authlog("Login incorrect "
 286                                                   "(system failed to supply an encrypted password for comparison)", request, 0);
 287                         case 1:
 288                           return -1;
 289                         }
 290                         break;
 291                 case PW_AUTHTYPE_LOCAL:
 292                         RDEBUG2("WARNING: Please update your configuration, and remove 'Auth-Type = Local'");
 293                         RDEBUG2("WARNING: Use the PAP or CHAP modules instead.");
 294
 295                         /*
 296                          *      Find the password sent by the user. It
 297                          *      SHOULD be there, if it's not
 298                          *      authentication fails.
 299                          */
 300                         auth_item = request->password;
 301                         if (!auth_item)
 302                                 auth_item = pairfind(request->packet->vps,
 303                                                      PW_CHAP_PASSWORD);
 304                         if (!auth_item) {
 305                                 RDEBUG2("No User-Password or CHAP-Password attribute in the request.");
 306                                 RDEBUG2("Cannot perform authentication.");
 307                                 return -1;
 308                         }
 309
 310                         /*
 311                          *      Plain text password.
 312                          */
 313                         if (password_pair == NULL) {
 314                                 RDEBUG2("No \"known good\" password was configured for the user.");
 315                                 RDEBUG2("As a result, we cannot authenticate the user.");
 316                                 rad_authlog("Login incorrect "
 317                                         "(No password configured for the user)", request, 0);
 318                                 return -1;
 319                         }
 320
 321                         /*
 322                          *      Local password is just plain text.
 323                          */
 324                         if (auth_item->attribute == PW_USER_PASSWORD) {
 325                                 if (strcmp((char *)password_pair->vp_strvalue,
 326                                            (char *)auth_item->vp_strvalue) != 0) {
 327                                         RDEBUG2("User-Password in the request does NOT match \"known good\" password.");
 328                                         return -1;
 329                                 }
 330                                 RDEBUG2("User-Password in the request is correct.");
 331                                 break;
 332
 333                         } else if (auth_item->attribute != PW_CHAP_PASSWORD) {
 334                                 RDEBUG2("The user did not supply a User-Password or a CHAP-Password attribute");
 335                                 rad_authlog("Login incorrect "
 336                                         "(no User-Password or CHAP-Password attribute)", request, 0);
 337                                 return -1;
 338                         }
 339
 340                         rad_chap_encode(request->packet, my_chap,
 341                                         auth_item->vp_octets[0], password_pair);
 342
 343                         /*
 344                          *      Compare them
 345                          */
 346                         if (memcmp(my_chap + 1, auth_item->vp_strvalue + 1,
 347                                    CHAP_VALUE_LENGTH) != 0) {
 348                                 RDEBUG2("CHAP-Password is incorrect.");
 349                                 return -1;
 350                         }
 351                         RDEBUG2("CHAP-Password is correct.");
 352                         break;
 353                 default:
 354                         /*
 355                          *      See if there is a module that handles
 356                          *      this type, and turn the RLM_ return
 357                          *      status into the values as defined at
 358                          *      the top of this function.
 359                          */
 360                         result = module_authenticate(auth_type, request);
 361                         switch (result) {
 362                                 /*
 363                                  *      An authentication module FAIL
 364                                  *      return code, or any return code that
 365                                  *      is not expected from authentication,
 366                                  *      is the same as an explicit REJECT!
 367                                  */
 368                                 case RLM_MODULE_FAIL:
 369                                 case RLM_MODULE_INVALID:
 370                                 case RLM_MODULE_NOOP:
 371                                 case RLM_MODULE_NOTFOUND:
 372                                 case RLM_MODULE_REJECT:
 373                                 case RLM_MODULE_UPDATED:
 374                                 case RLM_MODULE_USERLOCK:
 375                                 default:
 376                                         result = -1;
 377                                         break;
 378                                 case RLM_MODULE_OK:
 379                                         result = 0;
 380                                         break;
 381                                 case RLM_MODULE_HANDLED:
 382                                         result = 1;
 383                                         break;
 384                         }
 385                         break;
 386         }
 387
 388         return result;
 389 }
 390
 391 /*
 392  *      Post-authentication step processes the response before it is
 393  *      sent to the NAS. It can receive both Access-Accept and Access-Reject
 394  *      replies.
 395  */
 396 int rad_postauth(REQUEST *request)
 397 {
 398         int     result;
 399         int     postauth_type = 0;
 400         VALUE_PAIR *vp;
 401
 402         /*
 403          *      Do post-authentication calls. ignoring the return code.
 404          */
 405         vp = pairfind(request->config_items, PW_POST_AUTH_TYPE);
 406         if (vp) {
 407                 RDEBUG2("Using Post-Auth-Type %s", vp->vp_strvalue);
 408                 postauth_type = vp->vp_integer;
 409         }
 410         result = module_post_auth(postauth_type, request);
 411         switch (result) {
 412                 /*
 413                  *      The module failed, or said to reject the user: Do so.
 414                  */
 415                 case RLM_MODULE_FAIL:
 416                 case RLM_MODULE_INVALID:
 417                 case RLM_MODULE_REJECT:
 418                 case RLM_MODULE_USERLOCK:
 419                 default:
 420                         request->reply->code = PW_AUTHENTICATION_REJECT;
 421                         result = RLM_MODULE_REJECT;
 422                         break;
 423                 /*
 424                  *      The module handled the request, cancel the reply.
 425                  */
 426                 case RLM_MODULE_HANDLED:
 427                         /* FIXME */
 428                         break;
 429                 /*
 430                  *      The module had a number of OK return codes.
 431                  */
 432                 case RLM_MODULE_NOOP:
 433                 case RLM_MODULE_NOTFOUND:
 434                 case RLM_MODULE_OK:
 435                 case RLM_MODULE_UPDATED:
 436                         result = RLM_MODULE_OK;
 437                         break;
 438         }
 439         return result;
 440 }
 441
 442 /*
 443  *      Process and reply to an authentication request
 444  *
 445  *      The return value of this function isn't actually used right now, so
 446  *      it's not entirely clear if it is returning the right things. --Pac.
 447  */
 448 int rad_authenticate(REQUEST *request)
 449 {
 450         VALUE_PAIR      *namepair;
 451 #ifdef WITH_SESSION_MGMT
 452         VALUE_PAIR      *check_item;
 453 #endif
 454         VALUE_PAIR      *auth_item = NULL;
 455         VALUE_PAIR      *module_msg;
 456         VALUE_PAIR      *tmp = NULL;
 457         int             result;
 458         const char      *password;
 459         char            autz_retry = 0;
 460         int             autz_type = 0;
 461
 462         password = "";
 463
 464 #ifdef WITH_PROXY
 465         /*
 466          *      If this request got proxied to another server, we need
 467          *      to check whether it authenticated the request or not.
 468          */
 469         if (request->proxy_reply) {
 470                 switch (request->proxy_reply->code) {
 471                 /*
 472                  *      Reply of ACCEPT means accept, thus set Auth-Type
 473                  *      accordingly.
 474                  */
 475                 case PW_AUTHENTICATION_ACK:
 476                         tmp = radius_paircreate(request,
 477                                                 &request->config_items,
 478                                                 PW_AUTH_TYPE, PW_TYPE_INTEGER);
 479                         if (tmp) tmp->vp_integer = PW_AUTHTYPE_ACCEPT;
 480                         goto authenticate;
 481
 482                 /*
 483                  *      Challenges are punted back to the NAS without any
 484                  *      further processing.
 485                  */
 486                 case PW_ACCESS_CHALLENGE:
 487                         request->reply->code = PW_ACCESS_CHALLENGE;
 488                         return RLM_MODULE_OK;
 489                 /*
 490                  *      ALL other replies mean reject. (this is fail-safe)
 491                  *
 492                  *      Do NOT do any authorization or authentication. They
 493                  *      are being rejected, so we minimize the amount of work
 494                  *      done by the server, by rejecting them here.
 495                  */
 496                 case PW_AUTHENTICATION_REJECT:
 497                 default:
 498                         rad_authlog("Login incorrect (Home Server says so)",
 499                                     request, 0);
 500                         request->reply->code = PW_AUTHENTICATION_REJECT;
 501                         return RLM_MODULE_REJECT;
 502                 }
 503         }
 504 #endif
 505
 506         /*
 507          *      Get the username from the request.
 508          *
 509          *      Note that namepair MAY be NULL, in which case there
 510          *      is no User-Name attribute in the request.
 511          */
 512         namepair = request->username;
 513
 514         /*
 515          *      Look for, and cache, passwords.
 516          */
 517         if (!request->password) {
 518                 request->password = pairfind(request->packet->vps,
 519                                              PW_USER_PASSWORD);
 520         }
 521
 522         /*
 523          *      Discover which password we want to use.
 524          */
 525         auth_item = request->password;
 526         if (auth_item) {
 527                 password = (const char *)auth_item->vp_strvalue;
 528
 529         } else {
 530                 /*
 531                  *      Maybe there's a CHAP-Password?
 532                  */
 533                 if ((auth_item = pairfind(request->packet->vps,
 534                                           PW_CHAP_PASSWORD)) != NULL) {
 535                         password = "<CHAP-PASSWORD>";
 536
 537                 } else {
 538                         /*
 539                          *      No password we recognize.
 540                          */
 541                         password = "<NO-PASSWORD>";
 542                 }
 543         }
 544         request->password = auth_item;
 545
 546         /*
 547          *      Get the user's authorization information from the database
 548          */
 549 autz_redo:
 550         result = module_authorize(autz_type, request);
 551         switch (result) {
 552                 case RLM_MODULE_NOOP:
 553                 case RLM_MODULE_NOTFOUND:
 554                 case RLM_MODULE_OK:
 555                 case RLM_MODULE_UPDATED:
 556                         break;
 557                 case RLM_MODULE_HANDLED:
 558                         return result;
 559                 case RLM_MODULE_FAIL:
 560                 case RLM_MODULE_INVALID:
 561                 case RLM_MODULE_REJECT:
 562                 case RLM_MODULE_USERLOCK:
 563                 default:
 564                         if ((module_msg = pairfind(request->packet->vps,
 565                                         PW_MODULE_FAILURE_MESSAGE)) != NULL) {
 566                                 char msg[MAX_STRING_LEN + 16];
 567                                 snprintf(msg, sizeof(msg), "Invalid user (%s)",
 568                                          module_msg->vp_strvalue);
 569                                 rad_authlog(msg,request,0);
 570                         } else {
 571                                 rad_authlog("Invalid user", request, 0);
 572                         }
 573                         request->reply->code = PW_AUTHENTICATION_REJECT;
 574                         return result;
 575         }
 576         if (!autz_retry) {
 577                 tmp = pairfind(request->config_items, PW_AUTZ_TYPE);
 578                 if (tmp) {
 579                         RDEBUG2("Using Autz-Type %s", tmp->vp_strvalue);
 580                         autz_type = tmp->vp_integer;
 581                         autz_retry = 1;
 582                         goto autz_redo;
 583                 }
 584         }
 585
 586         /*
 587          *      If we haven't already proxied the packet, then check
 588          *      to see if we should.  Maybe one of the authorize
 589          *      modules has decided that a proxy should be used. If
 590          *      so, get out of here and send the packet.
 591          */
 592         if (
 593 #ifdef WITH_PROXY
 594             (request->proxy == NULL) &&
 595 #endif
 596             ((tmp = pairfind(request->config_items, PW_PROXY_TO_REALM)) != NULL)) {
 597                 REALM *realm;
 598
 599                 realm = realm_find2(tmp->vp_strvalue);
 600
 601                 /*
 602                  *      Don't authenticate, as the request is going to
 603                  *      be proxied.
 604                  */
 605                 if (realm && realm->auth_pool) {
 606                         return RLM_MODULE_OK;
 607                 }
 608
 609                 /*
 610                  *      Catch users who set Proxy-To-Realm to a LOCAL
 611                  *      realm (sigh).  But don't complain if it is
 612                  *      *the* LOCAL realm.
 613                  */
 614                 if (realm &&(strcmp(realm->name, "LOCAL") != 0)) {
 615                         RDEBUG2("WARNING: You set Proxy-To-Realm = %s, but it is a LOCAL realm!  Cancelling proxy request.", realm->name);
 616                 }
 617
 618                 if (!realm) {
 619                         RDEBUG2("WARNING: You set Proxy-To-Realm = %s, but the realm does not exist!  Cancelling invalid proxy request.", tmp->vp_strvalue);
 620                 }
 621         }
 622
 623 #ifdef WITH_PROXY
 624  authenticate:
 625 #endif
 626
 627         /*
 628          *      Perhaps there is a Stripped-User-Name now.
 629          */
 630         namepair = request->username;
 631
 632         /*
 633          *      Validate the user
 634          */
 635         do {
 636                 result = rad_check_password(request);
 637                 if (result > 0) {
 638                         /* don't reply! */
 639                         return RLM_MODULE_HANDLED;
 640                 }
 641         } while(0);
 642
 643         /*
 644          *      Failed to validate the user.
 645          *
 646          *      We PRESUME that the code which failed will clean up
 647          *      request->reply->vps, to be ONLY the reply items it
 648          *      wants to send back.
 649          */
 650         if (result < 0) {
 651                 RDEBUG2("Failed to authenticate the user.");
 652                 request->reply->code = PW_AUTHENTICATION_REJECT;
 653
 654                 if ((module_msg = pairfind(request->packet->vps,PW_MODULE_FAILURE_MESSAGE)) != NULL){
 655                         char msg[MAX_STRING_LEN+19];
 656
 657                         snprintf(msg, sizeof(msg), "Login incorrect (%s)",
 658                                  module_msg->vp_strvalue);
 659                         rad_authlog(msg, request, 0);
 660                 } else {
 661                         rad_authlog("Login incorrect", request, 0);
 662                 }
 663
 664                 /* double check: maybe the secret is wrong? */
 665                 if ((debug_flag > 1) && (auth_item != NULL) &&
 666                                 (auth_item->attribute == PW_USER_PASSWORD)) {
 667                         char *p;
 668
 669                         p = auth_item->vp_strvalue;
 670                         while (*p != '\0') {
 671                                 if (!isprint((int) *p)) {
 672                                         log_debug("  WARNING: Unprintable characters in the password.\n\t  Double-check the shared secret on the server and the NAS!");
 673                                         break;
 674                                 }
 675                                 p++;
 676                         }
 677                 }
 678         }
 679
 680 #ifdef WITH_SESSION_MGMT
 681         if (result >= 0 &&
 682             (check_item = pairfind(request->config_items, PW_SIMULTANEOUS_USE)) != NULL) {
 683                 int r, session_type = 0;
 684                 char            logstr[1024];
 685                 char            umsg[MAX_STRING_LEN + 1];
 686                 const char      *user_msg = NULL;
 687
 688                 tmp = pairfind(request->config_items, PW_SESSION_TYPE);
 689                 if (tmp) {
 690                         RDEBUG2("Using Session-Type %s", tmp->vp_strvalue);
 691                         session_type = tmp->vp_integer;
 692                 }
 693
 694                 /*
 695                  *      User authenticated O.K. Now we have to check
 696                  *      for the Simultaneous-Use parameter.
 697                  */
 698                 if (namepair &&
 699                     (r = module_checksimul(session_type, request, check_item->vp_integer)) != 0) {
 700                         char mpp_ok = 0;
 701
 702                         if (r == 2){
 703                                 /* Multilink attempt. Check if port-limit > simultaneous-use */
 704                                 VALUE_PAIR *port_limit;
 705
 706                                 if ((port_limit = pairfind(request->reply->vps, PW_PORT_LIMIT)) != NULL &&
 707                                         port_limit->vp_integer > check_item->vp_integer){
 708                                         RDEBUG2("MPP is OK");
 709                                         mpp_ok = 1;
 710                                 }
 711                         }
 712                         if (!mpp_ok){
 713                                 if (check_item->vp_integer > 1) {
 714                                 snprintf(umsg, sizeof(umsg),
 715                                                         "\r\nYou are already logged in %d times  - access denied\r\n\n",
 716                                                         (int)check_item->vp_integer);
 717                                         user_msg = umsg;
 718                                 } else {
 719                                         user_msg = "\r\nYou are already logged in - access denied\r\n\n";
 720                                 }
 721
 722                                 request->reply->code = PW_AUTHENTICATION_REJECT;
 723
 724                                 /*
 725                                  *      They're trying to log in too many times.
 726                                  *      Remove ALL reply attributes.
 727                                  */
 728                                 pairfree(&request->reply->vps);
 729                                 radius_pairmake(request, &request->reply->vps,
 730                                                 "Reply-Message",
 731                                                 user_msg, T_OP_SET);
 732
 733                                 snprintf(logstr, sizeof(logstr), "Multiple logins (max %d) %s",
 734                                         check_item->vp_integer,
 735                                         r == 2 ? "[MPP attempt]" : "");
 736                                 rad_authlog(logstr, request, 1);
 737
 738                                 result = -1;
 739                         }
 740                 }
 741         }
 742 #endif
 743
 744         /*
 745          *      Result should be >= 0 here - if not, it means the user
 746          *      is rejected, so we just process post-auth and return.
 747          */
 748         if (result < 0) {
 749                 return RLM_MODULE_REJECT;
 750         }
 751
 752         /*
 753          *      Add the port number to the Framed-IP-Address if
 754          *      vp->addport is set.
 755          */
 756         if (((tmp = pairfind(request->reply->vps,
 757                              PW_FRAMED_IP_ADDRESS)) != NULL) &&
 758             (tmp->flags.addport != 0)) {
 759                 VALUE_PAIR *vpPortId;
 760
 761                 /*
 762                  *  Find the NAS port ID.
 763                  */
 764                 if ((vpPortId = pairfind(request->packet->vps,
 765                                          PW_NAS_PORT)) != NULL) {
 766                   unsigned long tvalue = ntohl(tmp->vp_integer);
 767                   tmp->vp_integer = htonl(tvalue + vpPortId->vp_integer);
 768                   tmp->flags.addport = 0;
 769                   ip_ntoa(tmp->vp_strvalue, tmp->vp_integer);
 770                 } else {
 771                         RDEBUG2("WARNING: No NAS-Port attribute in request.  CANNOT return a Framed-IP-Address + NAS-Port.\n");
 772                         pairdelete(&request->reply->vps, PW_FRAMED_IP_ADDRESS);
 773                 }
 774         }
 775
 776         /*
 777          *      Set the reply to Access-Accept, if it hasn't already
 778          *      been set to something.  (i.e. Access-Challenge)
 779          */
 780         if (request->reply->code == 0)
 781           request->reply->code = PW_AUTHENTICATION_ACK;
 782
 783         if ((module_msg = pairfind(request->packet->vps,PW_MODULE_SUCCESS_MESSAGE)) != NULL){
 784                 char msg[MAX_STRING_LEN+12];
 785
 786                 snprintf(msg, sizeof(msg), "Login OK (%s)",
 787                          module_msg->vp_strvalue);
 788                 rad_authlog(msg, request, 1);
 789         } else {
 790                 rad_authlog("Login OK", request, 1);
 791         }
 792
 793         /*
 794          *      Run the modules in the 'post-auth' section.
 795          */
 796         result = rad_postauth(request);
 797
 798         return result;
 799 }