*/
case PW_EAP_RESPONSE:
if (eap_packet->data[0] == PW_EAP_TLV) {
- RDEBUG2("Received EAP-TLV response.");
+ RDEBUG2("Received EAP-TLV response");
return 1;
}
- RDEBUG2("Got something weird.");
+ RDEBUG2("Got something weird");
break;
#endif
/*
- * Send the EAP data, WITHOUT the header.
+ * Send the EAP data in the first attribute, WITHOUT the
+ * header.
*/
(tls_session->record_plus)(&tls_session->clean_in, vp->vp_octets + EAP_HEADER_LEN, vp->length - EAP_HEADER_LEN);
/*
- * Send the rest of the EAP data.
+ * Send the rest of the EAP data, but skipping the first VP.
*/
- for (this = fr_cursor_init(&cursor, &vp);
+ fr_cursor_init(&cursor, &vp);
+ for (this = fr_cursor_next(&cursor);
this;
this = fr_cursor_next(&cursor)) {
(tls_session->record_plus)(&tls_session->clean_in, this->vp_octets, this->length);
}
if (data[10] == EAP_TLV_FAILURE) {
- RDEBUG2("Client rejected our response. The password is probably incorrect.");
+ RDEBUG2("Client rejected our response. The password is probably incorrect");
return 0;
}
}
/*
* Use a reply packet to determine what to do.
*/
-static int process_reply(eap_handler_t *handler, tls_session_t *tls_session,
- REQUEST *request, RADIUS_PACKET *reply)
+static int CC_HINT(nonnull) process_reply(eap_handler_t *handler, tls_session_t *tls_session,
+ REQUEST *request, RADIUS_PACKET *reply)
{
int rcode = RLM_MODULE_REJECT;
VALUE_PAIR *vp;
}
switch (reply->code) {
- case PW_AUTHENTICATION_ACK:
- RDEBUG2("Tunneled authentication was successful.");
+ case PW_CODE_ACCESS_ACCEPT:
+ RDEBUG2("Tunneled authentication was successful");
t->status = PEAP_STATUS_SENT_TLV_SUCCESS;
eappeap_success(handler, tls_session);
rcode = RLM_MODULE_HANDLED;
pairdelete(&reply->vps, 16, VENDORPEC_MICROSOFT, TAG_ANY);
pairdelete(&reply->vps, 17, VENDORPEC_MICROSOFT, TAG_ANY);
- rad_assert(!t->accept_vps);
+ pairfree(&t->accept_vps); /* for proxying MS-CHAP2 */
pairfilter(t, &t->accept_vps, &reply->vps, 0, 0, TAG_ANY);
rad_assert(!reply->vps);
}
break;
- case PW_AUTHENTICATION_REJECT:
- RDEBUG2("Tunneled authentication was rejected.");
+ case PW_CODE_ACCESS_REJECT:
+ RDEBUG2("Tunneled authentication was rejected");
t->status = PEAP_STATUS_SENT_TLV_FAILURE;
eappeap_failure(handler, tls_session);
rcode = RLM_MODULE_HANDLED;
break;
- case PW_ACCESS_CHALLENGE:
+ case PW_CODE_ACCESS_CHALLENGE:
RDEBUG2("Got tunneled Access-Challenge");
/*
* Get rid of the old State, too.
*/
pairfree(&t->state);
- pairfilter(t, &t->state, &(reply->vps), PW_STATE, 0, TAG_ANY);
+ pairfilter(t, &t->state, &reply->vps, PW_STATE, 0, TAG_ANY);
/*
* PEAP takes only EAP-Message attributes inside
* Access-Challenge is ignored.
*/
vp = NULL;
- pairfilter(t, &vp, &(reply->vps), PW_EAP_MESSAGE, 0, TAG_ANY);
+ pairfilter(t, &vp, &reply->vps, PW_EAP_MESSAGE, 0, TAG_ANY);
/*
* Handle EAP-MSCHAP-V2, where Access-Accept's
- * from the home server may contain MS-CHAP-Success,
+ * from the home server may contain MS-CHAP2-Success,
* which the module turns into challenges, so that
* the client may respond to the challenge with
* an "ack" packet.
pairdelete(&reply->vps, PW_MESSAGE_AUTHENTICATOR, 0, TAG_ANY);
rad_assert(!t->accept_vps);
- pairfilter(t, &t->accept_vps, &reply->vps,
- 0, 0, TAG_ANY);
+ pairfilter(t, &t->accept_vps, &reply->vps, 0, 0, TAG_ANY);
rad_assert(!reply->vps);
}
/*
* Do post-proxy processing,
*/
-static int eappeap_postproxy(eap_handler_t *handler, void *data)
+static int CC_HINT(nonnull) eappeap_postproxy(eap_handler_t *handler, void *data)
{
int rcode;
tls_session_t *tls_session = (tls_session_t *) data;
REQUEST *fake, *request = handler->request;
- rad_assert(request != NULL);
- RDEBUG2("Passing reply from proxy back into the tunnel.");
+ RDEBUG2("Passing reply from proxy back into the tunnel");
/*
* If there was a fake request associated with the proxied
/*
* Do the callback, if it exists, and if it was a success.
*/
- if (fake && (handler->request->proxy_reply->code == PW_AUTHENTICATION_ACK)) {
+ if (fake && (handler->request->proxy_reply->code == PW_CODE_ACCESS_ACCEPT)) {
peap_tunnel_t *t = tls_session->opaque;
t->home_access_accept = true;
* Terrible hacks.
*/
rad_assert(!fake->packet);
- fake->packet = request->proxy;
+ fake->packet = talloc_steal(fake, request->proxy);
fake->packet->src_ipaddr = request->packet->src_ipaddr;
request->proxy = NULL;
rad_assert(!fake->reply);
- fake->reply = request->proxy_reply;
+ fake->reply = talloc_steal(fake, request->proxy_reply);
request->proxy_reply = NULL;
if ((debug_flag > 0) && fr_log_fp) {
* Perform a post-auth stage, which will get the EAP
* handler, too...
*/
- fake->options &= ~RAD_REQUEST_OPTION_PROXY_EAP;
+ fake->log.lvl &= ~RAD_REQUEST_OPTION_PROXY_EAP;
RDEBUG2("Passing reply back for EAP-MS-CHAP-V2");
process_post_proxy(0, fake);
/*
* Terrible hacks.
*/
- request->proxy = fake->packet;
+ request->proxy = talloc_steal(request, fake->packet);
fake->packet = NULL;
- request->proxy_reply = fake->reply;
+ request->proxy_reply = talloc_steal(request, fake->reply);
fake->reply = NULL;
/*
switch (rcode) {
case RLM_MODULE_FAIL:
- request_free(&fake);
+ talloc_free(fake);
eaptls_fail(handler, 0);
return 0;
- break;
default: /* Don't Do Anything */
RDEBUG2("Got reply %d", request->proxy_reply->code);
break;
}
}
- request_free(&fake); /* robust if !fake */
+ talloc_free(fake); /* robust if !fake */
/*
* If there was no EAP-Message in the reply packet, then
case RLM_MODULE_HANDLED:
RDEBUG2("Reply was handled");
eaptls_request(handler->eap_ds, tls_session);
+ request->proxy_reply->code = PW_CODE_ACCESS_CHALLENGE;
return 1;
case RLM_MODULE_OK:
return eaptls_success(handler, 0);
default:
- RDEBUG2("Reply was unknown.");
+ RDEBUG2("Reply was unknown");
break;
}
REQUEST *request = handler->request;
EAP_DS *eap_ds = handler->eap_ds;
- rad_assert(request != NULL);
-
/*
* Just look at the buffer directly, without doing
* record_minus. This lets us avoid another data copy.
if ((t->status != PEAP_STATUS_TUNNEL_ESTABLISHED) &&
!eapmessage_verify(request, data, data_len)) {
- RDEBUG2("FAILED processing PEAP: Tunneled data is invalid.");
+ RDEBUG2("FAILED processing PEAP: Tunneled data is invalid");
if (debug_flag > 2) print_tunneled_data(data, data_len);
return RLM_MODULE_REJECT;
}
case PEAP_STATUS_INNER_IDENTITY_REQ_SENT:
/* we're expecting an identity response */
if (data[0] != PW_EAP_IDENTITY) {
- RDEBUG("Expected EAP-Identity, got something else.");
+ RDEBUG("Expected EAP-Identity, got something else");
return RLM_MODULE_REJECT;
}
fake->server = t->soh_virtual_server;
}
RDEBUG("Sending SoH request to server %s", fake->server ? fake->server : "NULL");
- debug_pair_list(fake->packet->vps);
- RDEBUG("server %s {", fake->server);
rad_virtual_server(fake);
- RDEBUG("} # server %s", fake->server);
- RDEBUG("Got SoH reply");
- debug_pair_list(fake->reply->vps);
- if (fake->reply->code != PW_AUTHENTICATION_ACK) {
+ if (fake->reply->code != PW_CODE_ACCESS_ACCEPT) {
RDEBUG2("SoH was rejected");
- request_free(&fake);
+ talloc_free(fake);
t->status = PEAP_STATUS_SENT_TLV_FAILURE;
eappeap_failure(handler, tls_session);
return RLM_MODULE_HANDLED;
rad_assert(!t->soh_reply_vps);
pairfilter(t, &t->soh_reply_vps, &fake->reply->vps, 0, 0, TAG_ANY);
rad_assert(!fake->reply->vps);
- request_free(&fake);
+ talloc_free(fake);
if (t->session_resumption_state == PEAP_RESUMPTION_YES) {
/* we're good, send success TLV */
return RLM_MODULE_HANDLED;
}
- RDEBUG2("We sent a success, but received something weird in return.");
+ RDEBUG2("We sent a success, but the client did not agree");
return RLM_MODULE_REJECT;
/*
* packets after we told them to f*ck off.
*/
case PEAP_STATUS_SENT_TLV_FAILURE:
- RDEBUG(" The users session was previously rejected: returning reject (again.)");
- RDEBUG(" *** This means you need to read the PREVIOUS messages in the debug output");
- RDEBUG(" *** to find out the reason why the user was rejected.");
- RDEBUG(" *** Look for \"reject\" or \"fail\". Those earlier messages will tell you.");
- RDEBUG(" *** what went wrong, and how to fix the problem.");
+ RINDENT();
+ RDEBUG("The users session was previously rejected: returning reject (again.)");
+ RDEBUG("*** This means you need to read the PREVIOUS messages in the debug output");
+ RDEBUG("*** to find out the reason why the user was rejected");
+ RDEBUG("*** Look for \"reject\" or \"fail\". Those earlier messages will tell you");
+ RDEBUG("*** what went wrong, and how to fix the problem");
+ REXDENT();
+
return RLM_MODULE_REJECT;
case PEAP_STATUS_PHASE2_INIT:
pairadd(&fake->packet->vps, vp);
if (t->default_method != 0) {
- RDEBUG2("Setting default EAP type for tunneled EAP session.");
+ RDEBUG2("Setting default EAP type for tunneled EAP session");
vp = pairmake(fake, &fake->config_items, "EAP-Type", "0", T_OP_EQ);
vp->vp_integer = t->default_method;
}
fake->packet->vps = eap2vp(request, fake->packet,
eap_ds, data, data_len);
if (!fake->packet->vps) {
- request_free(&fake);
+ talloc_free(fake);
RDEBUG2("Unable to convert tunneled EAP packet to internal server data structures");
return RLM_MODULE_REJECT;
}
* set it here.
*/
if (t->default_method != 0) {
- DEBUG2(" PEAP: Setting default EAP type for tunneled EAP session.");
+ DEBUG2(" PEAP: Setting default EAP type for tunneled EAP session");
vp = pairmake(fake, &fake->config_items, "EAP-Type", "0", T_OP_EQ);
vp->vp_integer = t->default_method;
}
* done, THEN we proxy it...
*/
if (!t->proxy_tunneled_request_as_eap) {
- fake->options |= RAD_REQUEST_OPTION_PROXY_EAP;
+ fake->log.lvl |= RAD_REQUEST_OPTION_PROXY_EAP;
/*
* Hmm... should we check for
/*
* Run the EAP authentication.
*/
- DEBUG2(" PEAP: Calling authenticate in order to initiate tunneled EAP session.");
+ DEBUG2(" PEAP: Calling authenticate in order to initiate tunneled EAP session");
rcode = process_authenticate(PW_AUTHTYPE_EAP, fake);
if (rcode == RLM_MODULE_OK) {
/*
* Authentication succeeded! Rah!
*/
- fake->reply->code = PW_AUTHENTICATION_ACK;
+ fake->reply->code = PW_CODE_ACCESS_ACCEPT;
goto do_process;
}
* The module decided it wasn't
* done. Handle it like normal.
*/
- if ((fake->options & RAD_REQUEST_OPTION_PROXY_EAP) == 0) {
+ if ((fake->log.lvl & RAD_REQUEST_OPTION_PROXY_EAP) == 0) {
DEBUG2(" PEAP: Cancelling proxy to realm %s until the tunneled EAP session has been established", vp->vp_strvalue);
goto do_process;
}
* Tell the original request that it's going
* to be proxied.
*/
- pairfilter(request, &(request->config_items),
- &(fake->config_items),
+ pairfilter(request, &request->config_items,
+ &fake->config_items,
PW_PROXY_TO_REALM, 0, TAG_ANY);
/*
* tunneled request.
*/
rad_assert(!request->proxy);
- request->proxy = fake->packet;
+ request->proxy = talloc_steal(request, fake->packet);
memset(&request->proxy->src_ipaddr, 0,
sizeof(request->proxy->src_ipaddr));
memset(&request->proxy->dst_ipaddr, 0,
* We're not proxying it as EAP, so we've got
* to do the callback later.
*/
- if ((fake->options & RAD_REQUEST_OPTION_PROXY_EAP) != 0) {
- DEBUG2(" PEAP: Remembering to do EAP-MS-CHAP-V2 post-proxy.");
+ if ((fake->log.lvl & RAD_REQUEST_OPTION_PROXY_EAP) != 0) {
+ DEBUG2(" PEAP: Remembering to do EAP-MS-CHAP-V2 post-proxy");
/*
* rlm_eap.c has taken care of associating
* So we associate the fake request with
* this request.
*/
- talloc_set_destructor(fake, request_opaque_free);
rcode = request_data_add(request, request->proxy,
REQUEST_DATA_EAP_MSCHAP_TUNNEL_CALLBACK,
fake, true);
#ifdef WITH_PROXY
done:
#endif
- request_free(&fake);
+ talloc_free(fake);
return rcode;
}
-static int setup_fake_request(REQUEST *request, REQUEST *fake, peap_tunnel_t *t) {
+static int CC_HINT(nonnull) setup_fake_request(REQUEST *request, REQUEST *fake, peap_tunnel_t *t) {
VALUE_PAIR *vp;
+
/*
* Tell the request that it's a fake one.
*/
case PW_EAP_MESSAGE:
case PW_STATE:
continue;
- break;
/*
* By default, copy it over.
projects / freeradius.git / blobdiff