Use RDEBUGE() instead of module_failure_msg

Or instead of hand-coded alternatives

diff --git a/src/include/modules.h b/src/include/modules.h
index e37990f..5f6ef13 100644 (file)
--- a/src/include/modules.h
+++ b/src/include/modules.h
@@ -184,8 +184,6 @@ rlm_rcode_t module_send_coa(int type, REQUEST *request);
 #define MODULE_NULL_COA_FUNCS
 #endif
 
-char *module_failure_msg(REQUEST *request, const char *fmt, ...);
-
 rlm_rcode_t indexed_modcall(int comp, int idx, REQUEST *request);
 
 /*

diff --git a/src/include/radiusd.h b/src/include/radiusd.h
index 0e2409f..612dc07 100644 (file)
--- a/src/include/radiusd.h
+++ b/src/include/radiusd.h
@@ -735,6 +735,8 @@ VALUE_PAIR  *radius_paircreate(REQUEST *request, VALUE_PAIR **vps,
 VALUE_PAIR *radius_pairmake(REQUEST *request, VALUE_PAIR **vps,
                            const char *attribute, const char *value,
                            FR_TOKEN op);
+void module_failure_msg(REQUEST *request, const char *fmt, ...);
+
 
 /* xlat.c */
 typedef size_t (*RADIUS_ESCAPE_STRING)(REQUEST *, char *out, size_t outlen, const char *in, void *arg);

diff --git a/src/main/modules.c b/src/main/modules.c
index aaab0fa..ce65742 100644 (file)
--- a/src/main/modules.c
+++ b/src/main/modules.c
@@ -1610,29 +1610,3 @@ rlm_rcode_t module_send_coa(int send_coa_type, REQUEST *request)
        return indexed_modcall(RLM_COMPONENT_SEND_COA, send_coa_type, request);
 }
 #endif
-
-/** Add a module failure message VALUE_PAIR to the request
- */
-char *module_failure_msg(REQUEST *request, const char *fmt, ...)
-{
-       size_t len;
-       va_list ap;
-       VALUE_PAIR *vp;
-
-       va_start(ap, fmt);
-       vp = paircreate(request->packet, PW_MODULE_FAILURE_MESSAGE, 0);
-       if (!vp) {
-               va_end(ap);
-               
-               return NULL;
-       }
-
-       len = snprintf(vp->vp_strvalue, sizeof(vp->vp_strvalue), "%s: ",
-                      request->module);
-       vsnprintf(vp->vp_strvalue + len, sizeof(vp->vp_strvalue) - len, fmt,
-                 ap);
-
-       pairadd(&request->packet->vps, vp);
-       
-       return vp->vp_strvalue + len;
-}

diff --git a/src/main/valuepair.c b/src/main/valuepair.c
index fb142c5..792bd76 100644 (file)
--- a/src/main/valuepair.c
+++ b/src/main/valuepair.c
@@ -1623,3 +1623,25 @@ int radius_get_vp(REQUEST *request, const char *name, VALUE_PAIR **vp_p)
 
        return 0;
 }
+
+/** Add a module failure message VALUE_PAIR to the request
+ */
+void module_failure_msg(REQUEST *request, const char *fmt, ...)
+{
+       size_t len;
+       va_list ap;
+       VALUE_PAIR *vp;
+
+       va_start(ap, fmt);
+       vp = paircreate(request->packet, PW_MODULE_FAILURE_MESSAGE, 0);
+       if (!vp) {
+               va_end(ap);
+               return;
+       }
+
+       len = snprintf(vp->vp_strvalue, sizeof(vp->vp_strvalue), "%s: ",
+                      request->module);
+       vsnprintf(vp->vp_strvalue + len, sizeof(vp->vp_strvalue) - len, fmt,
+                 ap);
+       pairadd(&request->packet->vps, vp);
+}

diff --git a/src/modules/rlm_chap/rlm_chap.c b/src/modules/rlm_chap/rlm_chap.c
index 063b719..e18feab 100644 (file)
--- a/src/modules/rlm_chap/rlm_chap.c
+++ b/src/modules/rlm_chap/rlm_chap.c
@@ -58,8 +58,6 @@ static rlm_rcode_t chap_authenticate(UNUSED void *instance,
 {
        VALUE_PAIR *passwd_item, *chap;
        uint8_t pass_str[MAX_STRING_LEN];
-       VALUE_PAIR *module_fmsg_vp;
-       char module_fmsg[MAX_STRING_LEN];
 
        if (!request->username) {
                radlog_request(L_AUTH, 0, request, "rlm_chap: Attribute \"User-Name\" is required for authentication.\n");
@@ -98,12 +96,8 @@ static rlm_rcode_t chap_authenticate(UNUSED void *instance,
                        RDEBUGE("!!! Authentication will fail because of this.     !!!");
                        RDEBUGE("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
                }
-               RDEBUG("Cleartext-Password is required for authentication");
-               snprintf(module_fmsg, sizeof(module_fmsg),
-                        "rlm_chap: Clear text password not available");
-               module_fmsg_vp = pairmake("Module-Failure-Message",
-                                         module_fmsg, T_OP_EQ);
-               pairadd(&request->packet->vps, module_fmsg_vp);
+
+               RDEBUGE("Clear text password is required for authentication");
                return RLM_MODULE_INVALID;
        }
 
@@ -115,12 +109,7 @@ static rlm_rcode_t chap_authenticate(UNUSED void *instance,
 
        if (rad_digest_cmp(pass_str + 1, chap->vp_octets + 1,
                           CHAP_VALUE_LENGTH) != 0) {
-               RDEBUG("Password check failed");
-               snprintf(module_fmsg, sizeof(module_fmsg),
-                        "rlm_chap: Wrong user password");
-               module_fmsg_vp = pairmake("Module-Failure-Message",
-                                         module_fmsg, T_OP_EQ);
-               pairadd(&request->packet->vps, module_fmsg_vp);
+               RDEBUGE("Password is comparison failed: password is incorrect");
                return RLM_MODULE_REJECT;
        }
 

diff --git a/src/modules/rlm_checkval/rlm_checkval.c b/src/modules/rlm_checkval/rlm_checkval.c
index 7bfe2fb..15e59fa 100644 (file)
--- a/src/modules/rlm_checkval/rlm_checkval.c
+++ b/src/modules/rlm_checkval/rlm_checkval.c
@@ -265,22 +265,9 @@ static rlm_rcode_t do_checkval(void *instance, REQUEST *request)
 
        if (rcode == RLM_MODULE_REJECT) {
                if (!item && inst->notfound_reject){
-                       char module_fmsg[MAX_STRING_LEN];
-                       VALUE_PAIR *module_fmsg_vp;
-
-                       snprintf(module_fmsg,sizeof(module_fmsg),
-                               "rlm_checkval: Could not find item named %s in request", inst->item_name);
-                       module_fmsg_vp = pairmake("Module-Failure-Message", module_fmsg, T_OP_EQ);
-                       pairadd(&request->packet->vps, module_fmsg_vp);
-               }
-               else{
-                       char module_fmsg[MAX_STRING_LEN];
-                       VALUE_PAIR *module_fmsg_vp;
-
-                       snprintf(module_fmsg,sizeof(module_fmsg),
-                               "rlm_checkval: This %s is not allowed for the user", inst->item_name);
-                       module_fmsg_vp = pairmake("Module-Failure-Message", module_fmsg, T_OP_EQ);
-                       pairadd(&request->packet->vps, module_fmsg_vp);
+                       RDEBUGE("Could not find item named %s in request", inst->item_name);
+               } else {
+                       RDEBUGE("This %s is not allowed for the user", inst->item_name);
                }
        }
 

diff --git a/src/modules/rlm_counter/rlm_counter.c b/src/modules/rlm_counter/rlm_counter.c
index 47c128e..97ca48a 100644 (file)
--- a/src/modules/rlm_counter/rlm_counter.c
+++ b/src/modules/rlm_counter/rlm_counter.c
@@ -874,22 +874,17 @@ static rlm_rcode_t counter_authorize(void *instance, REQUEST *request)
                                key_vp->vp_strvalue,check_vp->vp_integer,counter.user_counter);
                DEBUG2("rlm_counter: Sent Reply-Item for user %s, Type=Session-Timeout, value=%d",
                                key_vp->vp_strvalue,res);
-       }
-       else{
-               char module_fmsg[MAX_STRING_LEN];
-               VALUE_PAIR *module_fmsg_vp;
-
+       } else {
                /*
                 * User is denied access, send back a reply message
                */
-               sprintf(msg, "Your maximum %s usage time has been reached", inst->reset);
+               sprintf(msg, "Your maximum %s usage time has been reached",
+                       inst->reset);
                reply_item=pairmake("Reply-Message", msg, T_OP_EQ);
                pairadd(&request->reply->vps, reply_item);
 
-               snprintf(module_fmsg,sizeof(module_fmsg), "rlm_counter: Maximum %s usage time reached", inst->reset);
-               module_fmsg_vp = pairmake("Module-Failure-Message", module_fmsg, T_OP_EQ);
-               pairadd(&request->packet->vps, module_fmsg_vp);
-
+               RDEBUGE("Maximum %s usage time reached",
+                                  inst->reset);
                rcode = RLM_MODULE_REJECT;
 
                DEBUG2("rlm_counter: Rejected user %s, check_item=%d, counter=%d",

diff --git a/src/modules/rlm_expiration/rlm_expiration.c b/src/modules/rlm_expiration/rlm_expiration.c
index 5db9203..960ed43 100644 (file)
--- a/src/modules/rlm_expiration/rlm_expiration.c
+++ b/src/modules/rlm_expiration/rlm_expiration.c
@@ -74,9 +74,6 @@ static rlm_rcode_t expiration_authorize(void *instance, REQUEST *request)
                */
                RDEBUG("Checking Expiration time: '%s'",check_item->vp_strvalue);
                if (((time_t) check_item->vp_date) <= request->timestamp) {
-                       char logstr[MAX_STRING_LEN];
-                       VALUE_PAIR *module_fmsg_vp;
-
                        RDEBUG("Account has expired");
 
                        if (data->msg && data->msg[0]){
@@ -89,10 +86,8 @@ static rlm_rcode_t expiration_authorize(void *instance, REQUEST *request)
                                pairfree(&request->reply->vps);
                                request->reply->vps = vp;
                        }
-                       snprintf(logstr, sizeof(logstr), "Account has expired [Expiration %s]",check_item->vp_strvalue);
-                       module_fmsg_vp = pairmake("Module-Failure-Message", logstr, T_OP_EQ);
-                       pairadd(&request->packet->vps, module_fmsg_vp);
 
+                       RDEBUGE("Account has expired [Expiration %s]",check_item->vp_strvalue);
                        return RLM_MODULE_USERLOCK;
                }
                /*

diff --git a/src/modules/rlm_logintime/rlm_logintime.c b/src/modules/rlm_logintime/rlm_logintime.c
index aa77b89..5c0aafe 100644 (file)
--- a/src/modules/rlm_logintime/rlm_logintime.c
+++ b/src/modules/rlm_logintime/rlm_logintime.c
@@ -184,9 +184,6 @@ static rlm_rcode_t logintime_authorize(void *instance, REQUEST *request)
                 */
                        DEBUG("rlm_logintime: timestr returned unlimited");
                } else if (r < data->min_time) {
-                       char logstr[MAX_STRING_LEN];
-                       VALUE_PAIR *module_fmsg_vp;
-
                        /*
                         *      User called outside allowed time interval.
                         */
@@ -205,11 +202,8 @@ static rlm_rcode_t logintime_authorize(void *instance, REQUEST *request)
                                request->reply->vps = tmp;
                        }
 
-                       snprintf(logstr, sizeof(logstr), "Outside allowed timespan (time allowed %s)",
-                       check_item->vp_strvalue);
-                       module_fmsg_vp = pairmake("Module-Failure-Message", logstr, T_OP_EQ);
-                       pairadd(&request->packet->vps, module_fmsg_vp);
-
+                       RDEBUGE("Outside allowed timespan (time allowed %s)",
+                                          check_item->vp_strvalue);
                        return RLM_MODULE_REJECT;
 
                } else if (r > 0) {

diff --git a/src/modules/rlm_mschap/rlm_mschap.c b/src/modules/rlm_mschap/rlm_mschap.c
index 11e4d6c..e599138 100644 (file)
--- a/src/modules/rlm_mschap/rlm_mschap.c
+++ b/src/modules/rlm_mschap/rlm_mschap.c
@@ -1079,7 +1079,6 @@ static int do_mschap(rlm_mschap_t *inst,
                                             NULL, NULL, 1);
                if (result != 0) {
                        char *p;
-                       VALUE_PAIR *vp = NULL;
 
                        /*
                         * look for "Password expired", or "Must
@@ -1092,20 +1091,11 @@ static int do_mschap(rlm_mschap_t *inst,
                        }
 
                        RDEBUG2("External script failed.");
-
-                       vp = pairmake("Module-Failure-Message", "", T_OP_EQ);
-                       if (!vp) {
-                               radlog_request(L_ERR, 0, request, "No memory to allocate Module-Failure-Message");
-                               return RLM_MODULE_FAIL;
-                       }
-
                        p = strchr(buffer, '\n');
                        if (p) *p = '\0';
-                       snprintf(vp->vp_strvalue, sizeof(vp->vp_strvalue),
-                               "%s: External script says %s",
-                                inst->xlat_name, buffer);
-                       vp->length = strlen(vp->vp_strvalue);
-                       pairadd(&request->packet->vps, vp);
+
+                       RDEBUGE("External script says: %s",
+                                              buffer);
                        return -1;
                }
 

diff --git a/src/modules/rlm_opendirectory/rlm_opendirectory.c b/src/modules/rlm_opendirectory/rlm_opendirectory.c
index bb14230..92646bc 100644 (file)
--- a/src/modules/rlm_opendirectory/rlm_opendirectory.c
+++ b/src/modules/rlm_opendirectory/rlm_opendirectory.c
@@ -427,22 +427,20 @@ static rlm_rcode_t od_authorize(UNUSED void *instance, REQUEST *request)
        }
        
        if (uuid_is_null(uuid)) {
-               radius_pairmake(request, &request->packet->vps,
-                               "Module-Failure-Message", "Could not get the user's uuid", T_OP_EQ);
+               RDEBUGE("Could not get the user's uuid",
+                                  T_OP_EQ);
                return RLM_MODULE_NOTFOUND;
        }
        
        if (!uuid_is_null(guid_sacl)) {
                err = mbr_check_service_membership(uuid, kRadiusServiceName, &ismember);
                if (err != 0) {
-                       radius_pairmake(request, &request->packet->vps,
-                                       "Module-Failure-Message", "Failed to check group membership", T_OP_EQ);
+                       RDEBUGE("Failed to check group membership", T_OP_EQ);
                        return RLM_MODULE_FAIL;
                }
                
                if (ismember == 0) {
-                       radius_pairmake(request, &request->packet->vps,
-                                       "Module-Failure-Message", "User is not authorized", T_OP_EQ);
+                       RDEBUGE("User is not authorized", T_OP_EQ);
                        return RLM_MODULE_USERLOCK;
                }
        }
@@ -450,14 +448,12 @@ static rlm_rcode_t od_authorize(UNUSED void *instance, REQUEST *request)
        if (!uuid_is_null(guid_nasgroup)) {
                err = mbr_check_membership_refresh(uuid, guid_nasgroup, &ismember);
                if (err != 0) {
-                       radius_pairmake(request, &request->packet->vps,
-                                       "Module-Failure-Message", "Failed to check group membership", T_OP_EQ);
+                       RDEBUGE("Failed to check group membership", T_OP_EQ);
                        return RLM_MODULE_FAIL;
                }
                
                if (ismember == 0) {
-                       radius_pairmake(request, &request->packet->vps,
-                                       "Module-Failure-Message", "User is not authorized", T_OP_EQ);
+                       RDEBUGE("User is not authorized", T_OP_EQ);
                        return RLM_MODULE_USERLOCK;
                }
        }

diff --git a/src/modules/rlm_otp/rlm_otp.c b/src/modules/rlm_otp/rlm_otp.c
index c15fb37..df60421 100644 (file)
--- a/src/modules/rlm_otp/rlm_otp.c
+++ b/src/modules/rlm_otp/rlm_otp.c
@@ -357,12 +357,6 @@ static rlm_rcode_t otp_authenticate(void *instance, REQUEST *request)
                return RLM_MODULE_INVALID;
        }
 
-       /* Add a message to the auth log. */
-       pairadd(&request->packet->vps, pairmake("Module-Failure-Message",
-               "rlm_otp", T_OP_EQ));
-       pairadd(&request->packet->vps, pairmake("Module-Success-Message",
-               "rlm_otp", T_OP_EQ));
-
        /*
         *      Retrieve the challenge (from State attribute).
         */

diff --git a/src/modules/rlm_pap/rlm_pap.c b/src/modules/rlm_pap/rlm_pap.c
index 02fa82f..f708586 100644 (file)
--- a/src/modules/rlm_pap/rlm_pap.c
+++ b/src/modules/rlm_pap/rlm_pap.c
@@ -34,8 +34,6 @@ RCSID("$Id$")
 #include "../../include/md5.h"
 #include "../../include/sha1.h"
 
-#include "rlm_pap.h"
-
 /*
  *      Define a structure for our module configuration.
  *
@@ -378,122 +376,11 @@ static rlm_rcode_t pap_authorize(void *instance, REQUEST *request)
        return RLM_MODULE_UPDATED;
 }
 
-
-/*
- *     Authenticate the user via one of any well-known password.
- */
-static rlm_rcode_t pap_authenticate(void *instance, REQUEST *request)
-{
-       VALUE_PAIR *vp;
-       VALUE_PAIR *module_fmsg_vp;
-       char module_fmsg[MAX_STRING_LEN];
-       rlm_rcode_t rc = RLM_MODULE_INVALID;
-       int (*auth_func)(REQUEST *, VALUE_PAIR *, char *) = NULL;
-
-       /* Shut the compiler up */
-       instance = instance;
-
-       if (!request->password ||
-           (request->password->da->attr != PW_USER_PASSWORD)) {
-               RDEBUGE("You set 'Auth-Type = PAP' for a request that does not contain a User-Password attribute!");
-               return RLM_MODULE_INVALID;
-       }
-
-       /*
-        *      The user MUST supply a non-zero-length password.
-        */
-       if (request->password->length == 0) {
-               snprintf(module_fmsg,sizeof(module_fmsg),"rlm_pap: empty password supplied");
-               module_fmsg_vp = pairmake("Module-Failure-Message", module_fmsg, T_OP_EQ);
-               pairadd(&request->packet->vps, module_fmsg_vp);
-               return RLM_MODULE_INVALID;
-       }
-
-       RDEBUG("login attempt with password \"%s\"", request->password->vp_strvalue);
-
-       /*
-        *      Auto-detect passwords, by attribute in the
-        *      config items, to find out which authentication
-        *      function to call.
-        */
-       for (vp = request->config_items; vp != NULL; vp = vp->next) {
-               if (!vp->da->vendor) switch (vp->da->attr) {
-               case PW_CLEARTEXT_PASSWORD:
-                       auth_func = &pap_auth_clear;
-                       break;
-
-               case PW_CRYPT_PASSWORD:
-                       auth_func = &pap_auth_crypt;
-                       break;
-
-               case PW_MD5_PASSWORD:
-                       auth_func = &pap_auth_md5;
-                       break;
-
-               case PW_SMD5_PASSWORD:
-                       auth_func = &pap_auth_smd5;
-                       break;
-
-               case PW_SHA_PASSWORD:
-                       auth_func = &pap_auth_sha;
-                       break;
-
-               case PW_SSHA_PASSWORD:
-                       auth_func = &pap_auth_ssha;
-                       break;
-
-               case PW_NT_PASSWORD:
-                       auth_func = &pap_auth_nt;
-                       break;
-
-               case PW_LM_PASSWORD:
-                       auth_func = &pap_auth_lm;
-                       break;
-
-               case PW_NS_MTA_MD5_PASSWORD:
-                       auth_func = &pap_auth_ns_mta_md5;
-                       break;
-
-               default:
-                       break;
-               }
-
-               if (auth_func != NULL) break;
-       }
-
-       /*
-        *      No attribute was found that looked like a password to match.
-        */
-       if (auth_func == NULL) {
-               RDEBUG("No password configured for the user.  Cannot do authentication");
-               return RLM_MODULE_FAIL;
-       }
-
-       /*
-        *      Authenticate, and return.
-        */
-       rc = auth_func(request, vp, module_fmsg);
-
-       if (rc == RLM_MODULE_REJECT) {
-               RDEBUG("Passwords don't match");
-               module_fmsg_vp = pairmake("Module-Failure-Message",
-                                         module_fmsg, T_OP_EQ);
-               pairadd(&request->packet->vps, module_fmsg_vp);
-       }
-
-       if (rc == RLM_MODULE_OK) {
-               RDEBUG("User authenticated successfully");
-       }
-
-       return rc;
-}
-
-
 /*
  *     PAP authentication functions
  */
 
-static int pap_auth_clear(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
+static int pap_auth_clear(REQUEST *request, VALUE_PAIR *vp)
 {
        RDEBUG("Using clear text password \"%s\"", vp->vp_strvalue);
 
@@ -501,27 +388,25 @@ static int pap_auth_clear(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
            (rad_digest_cmp(vp->vp_octets,
                            request->password->vp_octets,
                            vp->length) != 0)) {
-               snprintf(fmsg, sizeof(char[MAX_STRING_LEN]),
-                       "rlm_pap: CLEAR TEXT password check failed");
+               RDEBUGE("CLEAR TEXT password check failed");
                return RLM_MODULE_REJECT;
        }
        return RLM_MODULE_OK;
 }
 
-static int pap_auth_crypt(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
+static int pap_auth_crypt(REQUEST *request, VALUE_PAIR *vp)
 {
        RDEBUG("Using CRYPT password \"%s\"", vp->vp_strvalue);
 
        if (fr_crypt_check(request->password->vp_strvalue,
                           vp->vp_strvalue) != 0) {
-               snprintf(fmsg, sizeof(char[MAX_STRING_LEN]),
-                       "rlm_pap: CRYPT password check failed");
+               RDEBUGE("CRYPT password check failed");
                return RLM_MODULE_REJECT;
        }
        return RLM_MODULE_OK;
 }
 
-static int pap_auth_md5(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
+static int pap_auth_md5(REQUEST *request, VALUE_PAIR *vp)
 {
        FR_MD5_CTX md5_context;
        uint8_t binbuf[128];
@@ -530,9 +415,7 @@ static int pap_auth_md5(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
 
        normify(request, vp, 16);
        if (vp->length != 16) {
-               RDEBUG("Configured MD5 password has incorrect length");
-               snprintf(fmsg, sizeof(char[MAX_STRING_LEN]),
-                       "rlm_pap: Configured MD5 password has incorrect length");
+               RDEBUGE("Configured MD5 password has incorrect length");
                return RLM_MODULE_REJECT;
        }
 
@@ -542,8 +425,7 @@ static int pap_auth_md5(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
        fr_MD5Final(binbuf, &md5_context);
 
        if (rad_digest_cmp(binbuf, vp->vp_octets, vp->length) != 0) {
-               snprintf(fmsg, sizeof(char[MAX_STRING_LEN]),
-                       "rlm_pap: MD5 password check failed");
+               RDEBUGE("MD5 password check failed");
                return RLM_MODULE_REJECT;
        }
 
@@ -551,7 +433,7 @@ static int pap_auth_md5(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
 }
 
 
-static int pap_auth_smd5(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
+static int pap_auth_smd5(REQUEST *request, VALUE_PAIR *vp)
 {
        FR_MD5_CTX md5_context;
        uint8_t binbuf[128];
@@ -560,9 +442,7 @@ static int pap_auth_smd5(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
 
        normify(request, vp, 16);
        if (vp->length <= 16) {
-               RDEBUG("Configured SMD5 password has incorrect length");
-               snprintf(fmsg, sizeof(char[MAX_STRING_LEN]),
-                       "rlm_pap: Configured SMD5 password has incorrect length");
+               RDEBUGE("Configured SMD5 password has incorrect length");
                return RLM_MODULE_REJECT;
        }
 
@@ -576,15 +456,14 @@ static int pap_auth_smd5(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
         *      Compare only the MD5 hash results, not the salt.
         */
        if (rad_digest_cmp(binbuf, vp->vp_octets, 16) != 0) {
-               snprintf(fmsg, sizeof(char[MAX_STRING_LEN]),
-                       "rlm_pap: SMD5 password check failed");
+               RDEBUGE("SMD5 password check failed");
                return RLM_MODULE_REJECT;
        }
 
        return RLM_MODULE_OK;
 }
 
-static int pap_auth_sha(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
+static int pap_auth_sha(REQUEST *request, VALUE_PAIR *vp)
 {
        fr_SHA1_CTX sha1_context;
        uint8_t binbuf[128];
@@ -593,9 +472,7 @@ static int pap_auth_sha(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
 
        normify(request, vp, 20);
        if (vp->length != 20) {
-               RDEBUG("Configured SHA1 password has incorrect length");
-               snprintf(fmsg, sizeof(char[MAX_STRING_LEN]),
-                       "rlm_pap: Configured SHA1 password has incorrect length");
+               RDEBUGE("SHA1 password has incorrect length");
                return RLM_MODULE_REJECT;
        }
 
@@ -605,15 +482,14 @@ static int pap_auth_sha(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
        fr_SHA1Final(binbuf,&sha1_context);
 
        if (rad_digest_cmp(binbuf, vp->vp_octets, vp->length) != 0) {
-               snprintf(fmsg, sizeof(char[MAX_STRING_LEN]),
-                       "rlm_pap: SHA1 password check failed");
+               RDEBUGE("SHA1 password check failed");
                return RLM_MODULE_REJECT;
        }
 
        return RLM_MODULE_OK;
 }
 
-static int pap_auth_ssha(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
+static int pap_auth_ssha(REQUEST *request, VALUE_PAIR *vp)
 {
        fr_SHA1_CTX sha1_context;
        uint8_t binbuf[128];
@@ -622,9 +498,7 @@ static int pap_auth_ssha(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
 
        normify(request, vp, 20);
        if (vp->length <= 20) {
-               RDEBUG("Configured SSHA password has incorrect length");
-               snprintf(fmsg, sizeof(char[MAX_STRING_LEN]),
-                       "rlm_pap: Configured SHA password has incorrect length");
+               RDEBUGE("SSHA password has incorrect length");
                return RLM_MODULE_REJECT;
        }
 
@@ -635,15 +509,14 @@ static int pap_auth_ssha(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
        fr_SHA1Final(binbuf,&sha1_context);
 
        if (rad_digest_cmp(binbuf, vp->vp_octets, 20) != 0) {
-               snprintf(fmsg, sizeof(char[MAX_STRING_LEN]),
-                       "rlm_pap: SSHA password check failed");
+               RDEBUGE("SSHA password check failed");
                return RLM_MODULE_REJECT;
        }
 
        return RLM_MODULE_OK;
 }
 
-static int pap_auth_nt(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
+static int pap_auth_nt(REQUEST *request, VALUE_PAIR *vp)
 {
        uint8_t binbuf[128];
        char charbuf[128];
@@ -653,24 +526,19 @@ static int pap_auth_nt(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
 
        normify(request, vp, 16);
        if (vp->length != 16) {
-               RDEBUG("Configured NT-Password has incorrect length");
-               snprintf(fmsg, sizeof(char[MAX_STRING_LEN]),
-                       "rlm_pap: Configured NT-Password has incorrect length");
+               RDEBUGE("Configured NT-Password has incorrect length");
                return RLM_MODULE_REJECT;
        }
 
        strlcpy(buff2, "%{mschap:NT-Hash %{User-Password}}", sizeof(buff2));
        if (!radius_xlat(charbuf, sizeof(charbuf),buff2,request,NULL,NULL)){
-               RDEBUG("mschap xlat failed");
-               snprintf(fmsg, sizeof(char[MAX_STRING_LEN]),
-                       "rlm_pap: mschap xlat failed");
+               RDEBUGE("mschap xlat failed");
                return RLM_MODULE_REJECT;
        }
 
        if ((fr_hex2bin(charbuf, binbuf, 16) != vp->length) ||
            (rad_digest_cmp(binbuf, vp->vp_octets, vp->length) != 0)) {
-               snprintf(fmsg, sizeof(char[MAX_STRING_LEN]),
-                       "rlm_pap: NT password check failed");
+               RDEBUGE("NT password check failed");
                return RLM_MODULE_REJECT;
        }
 
@@ -678,7 +546,7 @@ static int pap_auth_nt(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
 }
 
 
-static int pap_auth_lm(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
+static int pap_auth_lm(REQUEST *request, VALUE_PAIR *vp)
 {
        uint8_t binbuf[128];
        char charbuf[128];
@@ -688,31 +556,26 @@ static int pap_auth_lm(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
 
        normify(request, vp, 16);
        if (vp->length != 16) {
-               RDEBUG("Configured LM-Password has incorrect length");
-               snprintf(fmsg, sizeof(char[MAX_STRING_LEN]),
-                       "rlm_pap: Configured LM-Password has incorrect length");
+               RDEBUGE("Configure LM-Password has incorrect length");
                return RLM_MODULE_REJECT;
        }
 
        strlcpy(buff2, "%{mschap:LM-Hash %{User-Password}}", sizeof(buff2));
        if (!radius_xlat(charbuf,sizeof(charbuf),buff2,request,NULL,NULL)){
-               RDEBUG("mschap xlat failed");
-               snprintf(fmsg, sizeof(char[MAX_STRING_LEN]),
-                       "rlm_pap: mschap xlat failed");
+               RDEBUGE("mschap xlat failed");
                return RLM_MODULE_REJECT;
        }
 
        if ((fr_hex2bin(charbuf, binbuf, 16) != vp->length) ||
            (rad_digest_cmp(binbuf, vp->vp_octets, vp->length) != 0)) {
-               snprintf(fmsg, sizeof(char[MAX_STRING_LEN]),
-                       "rlm_pap: LM password check failed");
+               RDEBUGE("LM password check failed");
                return RLM_MODULE_REJECT;
        }
 
        return RLM_MODULE_OK;
 }
 
-static int pap_auth_ns_mta_md5(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
+static int pap_auth_ns_mta_md5(REQUEST *request, VALUE_PAIR *vp)
 {
        FR_MD5_CTX md5_context;
        uint8_t binbuf[128];
@@ -722,9 +585,7 @@ static int pap_auth_ns_mta_md5(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
        RDEBUG("Using NT-MTA-MD5 password");
 
        if (vp->length != 64) {
-               RDEBUG("Configured NS-MTA-MD5-Password has incorrect length");
-               snprintf(fmsg, sizeof(char[MAX_STRING_LEN]),
-                       "rlm_pap: Configured NS-MTA-MD5-Password has incorrect length");
+               RDEBUGE("Configured NS-MTA-MD5-Password has incorrect length");
                return RLM_MODULE_REJECT;
        }
 
@@ -732,9 +593,7 @@ static int pap_auth_ns_mta_md5(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
         *      Sanity check the value of NS-MTA-MD5-Password
         */
        if (fr_hex2bin(vp->vp_strvalue, binbuf, 32) != 16) {
-               RDEBUG("Configured NS-MTA-MD5-Password has invalid value");
-               snprintf(fmsg, sizeof(char[MAX_STRING_LEN]),
-                       "rlm_pap: Configured NS-MTA-MD5-Password has invalid value");
+               RDEBUGE("Configured NS-MTA-MD5-Password has invalid value");
                return RLM_MODULE_REJECT;
        }
 
@@ -744,9 +603,7 @@ static int pap_auth_ns_mta_md5(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
         *      This really: sizeof(buff) - 2 - 2*32 - strlen(passwd)
         */
        if (strlen(request->password->vp_strvalue) >= (sizeof(buff) - 2 - 2 * 32)) {
-               RDEBUG("Configured password is too long");
-               snprintf(fmsg, sizeof(char[MAX_STRING_LEN]),
-                       "rlm_pap: password is too long");
+               RDEBUGE("Configured password is too long");
                return RLM_MODULE_REJECT;
        }
 
@@ -771,14 +628,117 @@ static int pap_auth_ns_mta_md5(REQUEST *request, VALUE_PAIR *vp, char *fmsg)
        }
 
        if (rad_digest_cmp(binbuf, buff, 16) != 0) {
-               snprintf(fmsg, sizeof(char[MAX_STRING_LEN]),
-                       "rlm_pap: NS-MTA-MD5 password check failed");
+               RDEBUGE("NS-MTA-MD5 password check failed");
                return RLM_MODULE_REJECT;
        }
 
        return RLM_MODULE_OK;
 }
 
+
+/*
+ *     Authenticate the user via one of any well-known password.
+ */
+static rlm_rcode_t pap_authenticate(void *instance, REQUEST *request)
+{
+       VALUE_PAIR *vp;
+       rlm_rcode_t rc = RLM_MODULE_INVALID;
+       int (*auth_func)(REQUEST *, VALUE_PAIR *) = NULL;
+
+       /* Shut the compiler up */
+       instance = instance;
+
+       if (!request->password ||
+           (request->password->da->attr != PW_USER_PASSWORD)) {
+               RDEBUGE("You set 'Auth-Type = PAP' for a request that does not contain a User-Password attribute!");
+               return RLM_MODULE_INVALID;
+       }
+
+       /*
+        *      The user MUST supply a non-zero-length password.
+        */
+       if (request->password->length == 0) {
+               RDEBUGE("Password must not be empty");
+               return RLM_MODULE_INVALID;
+       }
+
+       RDEBUG("login attempt with password \"%s\"", request->password->vp_strvalue);
+
+       /*
+        *      Auto-detect passwords, by attribute in the
+        *      config items, to find out which authentication
+        *      function to call.
+        */
+       for (vp = request->config_items; vp != NULL; vp = vp->next) {
+               if (!vp->da->vendor) switch (vp->da->attr) {
+               case PW_CLEARTEXT_PASSWORD:
+                       auth_func = &pap_auth_clear;
+                       break;
+
+               case PW_CRYPT_PASSWORD:
+                       auth_func = &pap_auth_crypt;
+                       break;
+
+               case PW_MD5_PASSWORD:
+                       auth_func = &pap_auth_md5;
+                       break;
+
+               case PW_SMD5_PASSWORD:
+                       auth_func = &pap_auth_smd5;
+                       break;
+
+               case PW_SHA_PASSWORD:
+                       auth_func = &pap_auth_sha;
+                       break;
+
+               case PW_SSHA_PASSWORD:
+                       auth_func = &pap_auth_ssha;
+                       break;
+
+               case PW_NT_PASSWORD:
+                       auth_func = &pap_auth_nt;
+                       break;
+
+               case PW_LM_PASSWORD:
+                       auth_func = &pap_auth_lm;
+                       break;
+
+               case PW_NS_MTA_MD5_PASSWORD:
+                       auth_func = &pap_auth_ns_mta_md5;
+                       break;
+
+               default:
+                       break;
+               }
+
+               if (auth_func != NULL) break;
+       }
+
+       /*
+        *      No attribute was found that looked like a password to match.
+        */
+       if (auth_func == NULL) {
+               RDEBUG("No password configured for the user.  Cannot do authentication");
+               return RLM_MODULE_FAIL;
+       }
+
+       /*
+        *      Authenticate, and return.
+        */
+       rc = auth_func(request, vp);
+
+       if (rc == RLM_MODULE_REJECT) {
+               RDEBUG("Passwords don't match");
+       }
+
+       if (rc == RLM_MODULE_OK) {
+               RDEBUG("User authenticated successfully");
+       }
+
+       return rc;
+}
+
+
 /*
  *     The module name should be the only globally exported symbol.
  *     That is, everything else should be 'static'.

diff --git a/src/modules/rlm_pap/rlm_pap.h b/src/modules/rlm_pap/rlm_pap.h
deleted file mode 100644 (file)
index 2b6dd74..0000000
--- a/src/modules/rlm_pap/rlm_pap.h
+++ /dev/null
@@ -1,39 +0,0 @@
-/*
- * rlm_pap.h    Local Header file.
- *
- *   This program is free software; you can redistribute it and/or modify
- *   it under the terms of the GNU General Public License as published by
- *   the Free Software Foundation; either version 2 of the License, or
- *   (at your option) any later version.
- *
- *   This program is distributed in the hope that it will be useful,
- *   but WITHOUT ANY WARRANTY; without even the implied warranty of
- *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *   GNU General Public License for more details.
- *
- *   You should have received a copy of the GNU General Public License
- *   along with this program; if not, write to the Free Software
- *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
- *
- * Copyright 2012  Matthew Newton <matthew@newtoncomputing.co.uk>
- * Copyright 2012  The FreeRADIUS server project
- */
-
-#ifndef _RLM_PAP_H
-#define _RLM_PAP_H
-
-/*
- * PAP auth functions
- */
-
-static int pap_auth_clear(REQUEST *, VALUE_PAIR *, char *);
-static int pap_auth_crypt(REQUEST *, VALUE_PAIR *, char *);
-static int pap_auth_md5(REQUEST *, VALUE_PAIR *, char *);
-static int pap_auth_smd5(REQUEST *, VALUE_PAIR *, char *);
-static int pap_auth_sha(REQUEST *, VALUE_PAIR *, char *);
-static int pap_auth_ssha(REQUEST *, VALUE_PAIR *, char *);
-static int pap_auth_nt(REQUEST *, VALUE_PAIR *, char *);
-static int pap_auth_lm(REQUEST *, VALUE_PAIR *, char *);
-static int pap_auth_ns_mta_md5(REQUEST *, VALUE_PAIR *, char *);
-
-#endif /*_RLM_PAP_H*/

diff --git a/src/modules/rlm_securid/rlm_securid.c b/src/modules/rlm_securid/rlm_securid.c
index 1fb1adf..f353c0d 100644 (file)
--- a/src/modules/rlm_securid/rlm_securid.c
+++ b/src/modules/rlm_securid/rlm_securid.c
@@ -466,11 +466,9 @@ static int securid_authenticate(void *instance, REQUEST *request)
 {
        int rcode;
        rlm_securid_t *inst = instance;
-       VALUE_PAIR *module_fmsg_vp;
        VALUE_PAIR *vp;
        char  buffer[MAX_STRING_LEN]="";
        const char *username=NULL, *password=NULL;
-       char module_fmsg[MAX_STRING_LEN]="";
        
        /*
         *      We can only authenticate user requests which HAVE
@@ -498,9 +496,7 @@ static int securid_authenticate(void *instance, REQUEST *request)
         *      The user MUST supply a non-zero-length password.
         */
        if (request->password->length == 0) {
-               snprintf(module_fmsg,sizeof(module_fmsg),"rlm_securid: empty password supplied");
-               module_fmsg_vp = pairmake("Module-Failure-Message", module_fmsg, T_OP_EQ);
-               pairadd(&request->packet->vps, module_fmsg_vp);
+               RDEBUGE("Password should not be empty");
                return RLM_MODULE_INVALID;
        }
 

diff --git a/src/modules/rlm_sqlcounter/rlm_sqlcounter.c b/src/modules/rlm_sqlcounter/rlm_sqlcounter.c
index 7fc8243..c9cd06e 100644 (file)
--- a/src/modules/rlm_sqlcounter/rlm_sqlcounter.c
+++ b/src/modules/rlm_sqlcounter/rlm_sqlcounter.c
@@ -623,9 +623,6 @@ static rlm_rcode_t sqlcounter_authorize(void *instance, REQUEST *request)
                                key_vp->vp_strvalue,data->reply_name,reply_item->vp_integer);
        }
        else{
-               char module_fmsg[MAX_STRING_LEN];
-               VALUE_PAIR *module_fmsg_vp;
-
                DEBUG2("rlm_sqlcounter: (Check item - counter) is less than zero");
 
                /*
@@ -635,10 +632,8 @@ static rlm_rcode_t sqlcounter_authorize(void *instance, REQUEST *request)
                reply_item=pairmake("Reply-Message", msg, T_OP_EQ);
                pairadd(&request->reply->vps, reply_item);
 
-               snprintf(module_fmsg, sizeof(module_fmsg), "rlm_sqlcounter: Maximum %s usage time reached", data->reset);
-               module_fmsg_vp = pairmake("Module-Failure-Message", module_fmsg, T_OP_EQ);
-               pairadd(&request->packet->vps, module_fmsg_vp);
-
+               RDEBUGE("Maximum %s usage time reached",
+                                  data->reset);
                rcode = RLM_MODULE_REJECT;
 
                DEBUG2("rlm_sqlcounter: Rejected user %s, check_item=%u, counter=%u",