src/main/auth.c

   1 /*
   2  * auth.c       User authentication.
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2000,2006  The FreeRADIUS server project
  21  * Copyright 2000  Miquel van Smoorenburg <miquels@cistron.nl>
  22  * Copyright 2000  Jeff Carneal <jeff@apex.net>
  23  */
  24
  25 #include <freeradius-devel/ident.h>
  26 RCSID("$Id$")
  27
  28 #include <freeradius-devel/radiusd.h>
  29 #include <freeradius-devel/modules.h>
  30 #include <freeradius-devel/rad_assert.h>
  31
  32 #include <ctype.h>
  33
  34 /*
  35  *      Return a short string showing the terminal server, port
  36  *      and calling station ID.
  37  */
  38 char *auth_name(char *buf, size_t buflen, REQUEST *request, int do_cli)
  39 {
  40         VALUE_PAIR      *cli;
  41         VALUE_PAIR      *pair;
  42         int             port = 0;
  43
  44         if ((cli = pairfind(request->packet->vps, PW_CALLING_STATION_ID, 0)) == NULL)
  45                 do_cli = 0;
  46         if ((pair = pairfind(request->packet->vps, PW_NAS_PORT, 0)) != NULL)
  47                 port = pair->vp_integer;
  48
  49         snprintf(buf, buflen, "from client %.128s port %u%s%.128s%s",
  50                         request->client->shortname, port,
  51                  (do_cli ? " cli " : ""), (do_cli ? (char *)cli->vp_strvalue : ""),
  52                  (request->packet->dst_port == 0) ? " via TLS tunnel" : "");
  53
  54         return buf;
  55 }
  56
  57
  58
  59 /*
  60  * Make sure user/pass are clean
  61  * and then log them
  62  */
  63 static int rad_authlog(const char *msg, REQUEST *request, int goodpass)
  64 {
  65         int logit;
  66         const char *extra_msg = NULL;
  67         char clean_password[1024];
  68         char clean_username[1024];
  69         char buf[1024];
  70         char extra[1024];
  71         VALUE_PAIR *username = NULL;
  72
  73         if (!request->root->log_auth) {
  74                 return 0;
  75         }
  76
  77         /*
  78          * Get the correct username based on the configured value
  79          */
  80         if (log_stripped_names == 0) {
  81                 username = pairfind(request->packet->vps, PW_USER_NAME, 0);
  82         } else {
  83                 username = request->username;
  84         }
  85
  86         /*
  87          *      Clean up the username
  88          */
  89         if (username == NULL) {
  90                 strcpy(clean_username, "<no User-Name attribute>");
  91         } else {
  92                 fr_print_string((char *)username->vp_strvalue,
  93                                 username->length,
  94                                 clean_username, sizeof(clean_username));
  95         }
  96
  97         /*
  98          *      Clean up the password
  99          */
 100         if (request->root->log_auth_badpass || request->root->log_auth_goodpass) {
 101                 if (!request->password) {
 102                         VALUE_PAIR *auth_type;
 103
 104                         auth_type = pairfind(request->config_items,
 105                                              PW_AUTH_TYPE, 0);
 106                         if (auth_type && (auth_type->vp_strvalue[0] != '\0')) {
 107                                 snprintf(clean_password, sizeof(clean_password),
 108                                          "<via Auth-Type = %s>",
 109                                          auth_type->vp_strvalue);
 110                         } else {
 111                                 strcpy(clean_password, "<no User-Password attribute>");
 112                         }
 113                 } else if (pairfind(request->packet->vps, PW_CHAP_PASSWORD, 0)) {
 114                         strcpy(clean_password, "<CHAP-Password>");
 115                 } else {
 116                         fr_print_string((char *)request->password->vp_strvalue,
 117                                          request->password->length,
 118                                          clean_password, sizeof(clean_password));
 119                 }
 120         }
 121
 122         if (goodpass) {
 123                 logit = request->root->log_auth_goodpass;
 124                 extra_msg = request->root->auth_goodpass_msg;
 125         } else {
 126                 logit = request->root->log_auth_badpass;
 127                 extra_msg = request->root->auth_badpass_msg;
 128         }
 129
 130         if (extra_msg) {
 131                 extra[0] = ' ';
 132                 radius_xlat(extra + 1, sizeof(extra) - 1, extra_msg, request,
 133                             NULL);
 134         } else {
 135                 *extra = '\0';
 136         }
 137
 138         radlog_request(L_AUTH, 0, request, "%s: [%s%s%s] (%s)%s",
 139                        msg,
 140                        clean_username,
 141                        logit ? "/" : "",
 142                        logit ? clean_password : "",
 143                        auth_name(buf, sizeof(buf), request, 1),
 144                        extra);
 145
 146         return 0;
 147 }
 148
 149 /*
 150  *      Check password.
 151  *
 152  *      Returns:        0  OK
 153  *                      -1 Password fail
 154  *                      -2 Rejected (Auth-Type = Reject, send Port-Message back)
 155  *                      1  End check & return, don't reply
 156  *
 157  *      NOTE: NOT the same as the RLM_ values !
 158  */
 159 static int rad_check_password(REQUEST *request)
 160 {
 161         VALUE_PAIR *auth_type_pair;
 162         VALUE_PAIR *cur_config_item;
 163         VALUE_PAIR *password_pair;
 164         VALUE_PAIR *auth_item;
 165         uint8_t my_chap[MAX_STRING_LEN];
 166         int auth_type = -1;
 167         int result;
 168         int auth_type_count = 0;
 169         result = 0;
 170
 171         /*
 172          *      Look for matching check items. We skip the whole lot
 173          *      if the authentication type is PW_AUTHTYPE_ACCEPT or
 174          *      PW_AUTHTYPE_REJECT.
 175          */
 176         cur_config_item = request->config_items;
 177         while(((auth_type_pair = pairfind(cur_config_item, PW_AUTH_TYPE, 0))) != NULL) {
 178                 DICT_VALUE *dv;
 179                 auth_type = auth_type_pair->vp_integer;
 180                 auth_type_count++;
 181                 dv = dict_valbyattr(auth_type_pair->attribute,
 182                                                 auth_type_pair->vp_integer, 0);
 183
 184                 RDEBUG2("Found Auth-Type = %s",
 185                         (dv != NULL) ? dv->name : "?");
 186                 cur_config_item = auth_type_pair->next;
 187
 188                 if (auth_type == PW_AUTHTYPE_REJECT) {
 189                         RDEBUG2("Auth-Type = Reject, rejecting user");
 190                         return -2;
 191                 }
 192         }
 193
 194         if (( auth_type_count > 1) && (debug_flag)) {
 195                 radlog_request(L_ERR, 0, request, "Warning:  Found %d auth-types on request for user '%s'",
 196                         auth_type_count, request->username->vp_strvalue);
 197         }
 198
 199         /*
 200          *      This means we have a proxy reply or an accept
 201          *  and it wasn't rejected in the above loop.  So
 202          *  that means it is accepted and we do no further
 203          *  authentication
 204          */
 205         if ((auth_type == PW_AUTHTYPE_ACCEPT)
 206 #ifdef WITH_PROXY
 207             || (request->proxy)
 208 #endif
 209             ) {
 210                 RDEBUG2("Auth-Type = Accept, accepting the user");
 211                 return 0;
 212         }
 213
 214         password_pair =  pairfind(request->config_items, PW_USER_PASSWORD, 0);
 215         if (password_pair &&
 216             pairfind(request->config_items, PW_CLEARTEXT_PASSWORD, 0)) {
 217           pairdelete(&request->config_items, PW_USER_PASSWORD, 0);
 218                 password_pair = NULL;
 219         }
 220
 221         if (password_pair) {
 222                 DICT_ATTR *da;
 223
 224                 RDEBUG("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 225                 RDEBUG("!!!    Replacing User-Password in config items with Cleartext-Password.     !!!");
 226                 RDEBUG("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 227                 RDEBUG("!!! Please update your configuration so that the \"known good\"               !!!");
 228                 RDEBUG("!!! clear text password is in Cleartext-Password, and not in User-Password. !!!");
 229                 RDEBUG("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 230                 password_pair->attribute = PW_CLEARTEXT_PASSWORD;
 231                 da = dict_attrbyvalue(PW_CLEARTEXT_PASSWORD, 0);
 232                 if (!da) {
 233                         radlog_request(L_ERR, 0, request, "FATAL: You broke the dictionaries.  Please use the default dictionaries!");
 234                         _exit(1);
 235                 }
 236
 237                 password_pair->name = da->name;
 238         }
 239
 240         /*
 241          *      Find the "known good" password.
 242          *
 243          *      FIXME: We should get rid of these hacks, and replace
 244          *      them with a module.
 245          */
 246         if ((password_pair = pairfind(request->config_items, PW_CRYPT_PASSWORD, 0)) != NULL) {
 247                 /*
 248                  *      Re-write Auth-Type, but ONLY if it isn't already
 249                  *      set.
 250                  */
 251                 if (auth_type == -1) auth_type = PW_AUTHTYPE_CRYPT;
 252         } else {
 253                 password_pair = pairfind(request->config_items, PW_CLEARTEXT_PASSWORD, 0);
 254         }
 255
 256         if (auth_type < 0) {
 257                 if (password_pair) {
 258                         auth_type = PW_AUTHTYPE_LOCAL;
 259                 } else {
 260                         /*
 261                         *       The admin hasn't told us how to
 262                         *       authenticate the user, so we reject them!
 263                         *
 264                         *       This is fail-safe.
 265                         */
 266                         RDEBUG2("ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user");
 267                         return -2;
 268                 }
 269         }
 270
 271         switch(auth_type) {
 272                 case PW_AUTHTYPE_CRYPT:
 273                         RDEBUG2("WARNING: Please update your configuration, and remove 'Auth-Type = Crypt'");
 274                         RDEBUG2("WARNING: Use the PAP module instead.");
 275
 276                         /*
 277                          *      Find the password sent by the user. It
 278                          *      SHOULD be there, if it's not
 279                          *      authentication fails.
 280                          */
 281                         auth_item = request->password;
 282                         if (auth_item == NULL) {
 283                                 RDEBUG2("No User-Password or CHAP-Password attribute in the request");
 284                                 return -1;
 285                         }
 286
 287                         if (password_pair == NULL) {
 288                                 RDEBUG2("No Crypt-Password configured for the user");
 289                                 rad_authlog("Login incorrect "
 290                                         "(No Crypt-Password configured for the user)", request, 0);
 291                                 return -1;
 292                         }
 293
 294                         switch (fr_crypt_check((char *)auth_item->vp_strvalue,
 295                                                                          (char *)password_pair->vp_strvalue)) {
 296                         case -1:
 297                           rad_authlog("Login incorrect "
 298                                                   "(system failed to supply an encrypted password for comparison)", request, 0);
 299                         case 1:
 300                           return -1;
 301                         }
 302                         break;
 303                 case PW_AUTHTYPE_LOCAL:
 304                         RDEBUG2("WARNING: Please update your configuration, and remove 'Auth-Type = Local'");
 305                         RDEBUG2("WARNING: Use the PAP or CHAP modules instead.");
 306
 307                         /*
 308                          *      Find the password sent by the user. It
 309                          *      SHOULD be there, if it's not
 310                          *      authentication fails.
 311                          */
 312                         auth_item = request->password;
 313                         if (!auth_item)
 314                                 auth_item = pairfind(request->packet->vps,
 315                                                      PW_CHAP_PASSWORD, 0);
 316                         if (!auth_item) {
 317                                 RDEBUG2("No User-Password or CHAP-Password attribute in the request.");
 318                                 RDEBUG2("Cannot perform authentication.");
 319                                 return -1;
 320                         }
 321
 322                         /*
 323                          *      Plain text password.
 324                          */
 325                         if (password_pair == NULL) {
 326                                 RDEBUG2("No \"known good\" password was configured for the user.");
 327                                 RDEBUG2("As a result, we cannot authenticate the user.");
 328                                 rad_authlog("Login incorrect "
 329                                         "(No password configured for the user)", request, 0);
 330                                 return -1;
 331                         }
 332
 333                         /*
 334                          *      Local password is just plain text.
 335                          */
 336                         if (auth_item->attribute == PW_USER_PASSWORD) {
 337                                 if (strcmp((char *)password_pair->vp_strvalue,
 338                                            (char *)auth_item->vp_strvalue) != 0) {
 339                                         RDEBUG2("User-Password in the request does NOT match \"known good\" password.");
 340                                         return -1;
 341                                 }
 342                                 RDEBUG2("User-Password in the request is correct.");
 343                                 break;
 344
 345                         } else if (auth_item->attribute != PW_CHAP_PASSWORD) {
 346                                 RDEBUG2("The user did not supply a User-Password or a CHAP-Password attribute");
 347                                 rad_authlog("Login incorrect "
 348                                         "(no User-Password or CHAP-Password attribute)", request, 0);
 349                                 return -1;
 350                         }
 351
 352                         rad_chap_encode(request->packet, my_chap,
 353                                         auth_item->vp_octets[0], password_pair);
 354
 355                         /*
 356                          *      Compare them
 357                          */
 358                         if (memcmp(my_chap + 1, auth_item->vp_strvalue + 1,
 359                                    CHAP_VALUE_LENGTH) != 0) {
 360                                 RDEBUG2("CHAP-Password is incorrect.");
 361                                 return -1;
 362                         }
 363                         RDEBUG2("CHAP-Password is correct.");
 364                         break;
 365                 default:
 366                         /*
 367                          *      See if there is a module that handles
 368                          *      this type, and turn the RLM_ return
 369                          *      status into the values as defined at
 370                          *      the top of this function.
 371                          */
 372                         result = module_authenticate(auth_type, request);
 373                         switch (result) {
 374                                 /*
 375                                  *      An authentication module FAIL
 376                                  *      return code, or any return code that
 377                                  *      is not expected from authentication,
 378                                  *      is the same as an explicit REJECT!
 379                                  */
 380                                 case RLM_MODULE_FAIL:
 381                                 case RLM_MODULE_INVALID:
 382                                 case RLM_MODULE_NOOP:
 383                                 case RLM_MODULE_NOTFOUND:
 384                                 case RLM_MODULE_REJECT:
 385                                 case RLM_MODULE_UPDATED:
 386                                 case RLM_MODULE_USERLOCK:
 387                                 default:
 388                                         result = -1;
 389                                         break;
 390                                 case RLM_MODULE_OK:
 391                                         result = 0;
 392                                         break;
 393                                 case RLM_MODULE_HANDLED:
 394                                         result = 1;
 395                                         break;
 396                         }
 397                         break;
 398         }
 399
 400         return result;
 401 }
 402
 403 /*
 404  *      Post-authentication step processes the response before it is
 405  *      sent to the NAS. It can receive both Access-Accept and Access-Reject
 406  *      replies.
 407  */
 408 int rad_postauth(REQUEST *request)
 409 {
 410         int     result;
 411         int     postauth_type = 0;
 412         VALUE_PAIR *vp;
 413
 414         /*
 415          *      Do post-authentication calls. ignoring the return code.
 416          */
 417         vp = pairfind(request->config_items, PW_POST_AUTH_TYPE, 0);
 418         if (vp) {
 419                 RDEBUG2("Using Post-Auth-Type %s", vp->vp_strvalue);
 420                 postauth_type = vp->vp_integer;
 421         }
 422         result = module_post_auth(postauth_type, request);
 423         switch (result) {
 424                 /*
 425                  *      The module failed, or said to reject the user: Do so.
 426                  */
 427                 case RLM_MODULE_FAIL:
 428                 case RLM_MODULE_INVALID:
 429                 case RLM_MODULE_REJECT:
 430                 case RLM_MODULE_USERLOCK:
 431                 default:
 432                         request->reply->code = PW_AUTHENTICATION_REJECT;
 433                         result = RLM_MODULE_REJECT;
 434                         break;
 435                 /*
 436                  *      The module handled the request, cancel the reply.
 437                  */
 438                 case RLM_MODULE_HANDLED:
 439                         /* FIXME */
 440                         break;
 441                 /*
 442                  *      The module had a number of OK return codes.
 443                  */
 444                 case RLM_MODULE_NOOP:
 445                 case RLM_MODULE_NOTFOUND:
 446                 case RLM_MODULE_OK:
 447                 case RLM_MODULE_UPDATED:
 448                         result = RLM_MODULE_OK;
 449                         break;
 450         }
 451         return result;
 452 }
 453
 454 /*
 455  *      Process and reply to an authentication request
 456  *
 457  *      The return value of this function isn't actually used right now, so
 458  *      it's not entirely clear if it is returning the right things. --Pac.
 459  */
 460 int rad_authenticate(REQUEST *request)
 461 {
 462         VALUE_PAIR      *namepair;
 463 #ifdef WITH_SESSION_MGMT
 464         VALUE_PAIR      *check_item;
 465 #endif
 466         VALUE_PAIR      *auth_item = NULL;
 467         VALUE_PAIR      *module_msg;
 468         VALUE_PAIR      *tmp = NULL;
 469         int             result;
 470         const char      *password;
 471         char            autz_retry = 0;
 472         int             autz_type = 0;
 473
 474         password = "";
 475
 476 #ifdef WITH_PROXY
 477         /*
 478          *      If this request got proxied to another server, we need
 479          *      to check whether it authenticated the request or not.
 480          */
 481         if (request->proxy_reply) {
 482                 switch (request->proxy_reply->code) {
 483                 /*
 484                  *      Reply of ACCEPT means accept, thus set Auth-Type
 485                  *      accordingly.
 486                  */
 487                 case PW_AUTHENTICATION_ACK:
 488                         tmp = radius_paircreate(request,
 489                                                 &request->config_items,
 490                                                 PW_AUTH_TYPE, 0, PW_TYPE_INTEGER);
 491                         if (tmp) tmp->vp_integer = PW_AUTHTYPE_ACCEPT;
 492                         goto authenticate;
 493
 494                 /*
 495                  *      Challenges are punted back to the NAS without any
 496                  *      further processing.
 497                  */
 498                 case PW_ACCESS_CHALLENGE:
 499                         request->reply->code = PW_ACCESS_CHALLENGE;
 500                         return RLM_MODULE_OK;
 501                 /*
 502                  *      ALL other replies mean reject. (this is fail-safe)
 503                  *
 504                  *      Do NOT do any authorization or authentication. They
 505                  *      are being rejected, so we minimize the amount of work
 506                  *      done by the server, by rejecting them here.
 507                  */
 508                 case PW_AUTHENTICATION_REJECT:
 509                         rad_authlog("Login incorrect (Home Server says so)",
 510                                     request, 0);
 511                         request->reply->code = PW_AUTHENTICATION_REJECT;
 512                         return RLM_MODULE_REJECT;
 513
 514                 default:
 515                         rad_authlog("Login incorrect (Home Server failed to respond)",
 516                                     request, 0);
 517                         return RLM_MODULE_REJECT;
 518                 }
 519         }
 520 #endif
 521
 522         /*
 523          *      Get the username from the request.
 524          *
 525          *      Note that namepair MAY be NULL, in which case there
 526          *      is no User-Name attribute in the request.
 527          */
 528         namepair = request->username;
 529
 530         /*
 531          *      Look for, and cache, passwords.
 532          */
 533         if (!request->password) {
 534                 request->password = pairfind(request->packet->vps,
 535                                              PW_USER_PASSWORD, 0);
 536         }
 537
 538         /*
 539          *      Discover which password we want to use.
 540          */
 541         auth_item = request->password;
 542         if (auth_item) {
 543                 password = (const char *)auth_item->vp_strvalue;
 544
 545         } else {
 546                 /*
 547                  *      Maybe there's a CHAP-Password?
 548                  */
 549                 if ((auth_item = pairfind(request->packet->vps,
 550                                           PW_CHAP_PASSWORD, 0)) != NULL) {
 551                         password = "<CHAP-PASSWORD>";
 552
 553                 } else {
 554                         /*
 555                          *      No password we recognize.
 556                          */
 557                         password = "<NO-PASSWORD>";
 558                 }
 559         }
 560         request->password = auth_item;
 561
 562         /*
 563          *      Get the user's authorization information from the database
 564          */
 565 autz_redo:
 566         result = module_authorize(autz_type, request);
 567         switch (result) {
 568                 case RLM_MODULE_NOOP:
 569                 case RLM_MODULE_NOTFOUND:
 570                 case RLM_MODULE_OK:
 571                 case RLM_MODULE_UPDATED:
 572                         break;
 573                 case RLM_MODULE_HANDLED:
 574                         return result;
 575                 case RLM_MODULE_FAIL:
 576                 case RLM_MODULE_INVALID:
 577                 case RLM_MODULE_REJECT:
 578                 case RLM_MODULE_USERLOCK:
 579                 default:
 580                         if ((module_msg = pairfind(request->packet->vps,
 581                                                    PW_MODULE_FAILURE_MESSAGE, 0)) != NULL) {
 582                                 char msg[MAX_STRING_LEN + 16];
 583                                 snprintf(msg, sizeof(msg), "Invalid user (%s)",
 584                                          module_msg->vp_strvalue);
 585                                 rad_authlog(msg,request,0);
 586                         } else {
 587                                 rad_authlog("Invalid user", request, 0);
 588                         }
 589                         request->reply->code = PW_AUTHENTICATION_REJECT;
 590                         return result;
 591         }
 592         if (!autz_retry) {
 593                 tmp = pairfind(request->config_items, PW_AUTZ_TYPE, 0);
 594                 if (tmp) {
 595                         RDEBUG2("Using Autz-Type %s", tmp->vp_strvalue);
 596                         autz_type = tmp->vp_integer;
 597                         autz_retry = 1;
 598                         goto autz_redo;
 599                 }
 600         }
 601
 602         /*
 603          *      If we haven't already proxied the packet, then check
 604          *      to see if we should.  Maybe one of the authorize
 605          *      modules has decided that a proxy should be used. If
 606          *      so, get out of here and send the packet.
 607          */
 608         if (
 609 #ifdef WITH_PROXY
 610             (request->proxy == NULL) &&
 611 #endif
 612             ((tmp = pairfind(request->config_items, PW_PROXY_TO_REALM, 0)) != NULL)) {
 613                 REALM *realm;
 614
 615                 realm = realm_find2(tmp->vp_strvalue);
 616
 617                 /*
 618                  *      Don't authenticate, as the request is going to
 619                  *      be proxied.
 620                  */
 621                 if (realm && realm->auth_pool) {
 622                         return RLM_MODULE_OK;
 623                 }
 624
 625                 /*
 626                  *      Catch users who set Proxy-To-Realm to a LOCAL
 627                  *      realm (sigh).  But don't complain if it is
 628                  *      *the* LOCAL realm.
 629                  */
 630                 if (realm &&(strcmp(realm->name, "LOCAL") != 0)) {
 631                         RDEBUG2("WARNING: You set Proxy-To-Realm = %s, but it is a LOCAL realm!  Cancelling proxy request.", realm->name);
 632                 }
 633
 634                 if (!realm) {
 635                         RDEBUG2("WARNING: You set Proxy-To-Realm = %s, but the realm does not exist!  Cancelling invalid proxy request.", tmp->vp_strvalue);
 636                 }
 637         }
 638
 639 #ifdef WITH_PROXY
 640  authenticate:
 641 #endif
 642
 643         /*
 644          *      Perhaps there is a Stripped-User-Name now.
 645          */
 646         namepair = request->username;
 647
 648         /*
 649          *      Validate the user
 650          */
 651         do {
 652                 result = rad_check_password(request);
 653                 if (result > 0) {
 654                         /* don't reply! */
 655                         return RLM_MODULE_HANDLED;
 656                 }
 657         } while(0);
 658
 659         /*
 660          *      Failed to validate the user.
 661          *
 662          *      We PRESUME that the code which failed will clean up
 663          *      request->reply->vps, to be ONLY the reply items it
 664          *      wants to send back.
 665          */
 666         if (result < 0) {
 667                 RDEBUG2("Failed to authenticate the user.");
 668                 request->reply->code = PW_AUTHENTICATION_REJECT;
 669
 670                 if ((module_msg = pairfind(request->packet->vps,PW_MODULE_FAILURE_MESSAGE, 0)) != NULL){
 671                         char msg[MAX_STRING_LEN+19];
 672
 673                         snprintf(msg, sizeof(msg), "Login incorrect (%s)",
 674                                  module_msg->vp_strvalue);
 675                         rad_authlog(msg, request, 0);
 676                 } else {
 677                         rad_authlog("Login incorrect", request, 0);
 678                 }
 679
 680                 /* double check: maybe the secret is wrong? */
 681                 if ((debug_flag > 1) && (auth_item != NULL) &&
 682                                 (auth_item->attribute == PW_USER_PASSWORD)) {
 683                         char *p;
 684
 685                         p = auth_item->vp_strvalue;
 686                         while (*p != '\0') {
 687                                 if (!isprint((int) *p)) {
 688                                         log_debug("  WARNING: Unprintable characters in the password.\n\t  Double-check the shared secret on the server and the NAS!");
 689                                         break;
 690                                 }
 691                                 p++;
 692                         }
 693                 }
 694         }
 695
 696 #ifdef WITH_SESSION_MGMT
 697         if (result >= 0 &&
 698             (check_item = pairfind(request->config_items, PW_SIMULTANEOUS_USE, 0)) != NULL) {
 699                 int r, session_type = 0;
 700                 char            logstr[1024];
 701                 char            umsg[MAX_STRING_LEN + 1];
 702                 const char      *user_msg = NULL;
 703
 704                 tmp = pairfind(request->config_items, PW_SESSION_TYPE, 0);
 705                 if (tmp) {
 706                         RDEBUG2("Using Session-Type %s", tmp->vp_strvalue);
 707                         session_type = tmp->vp_integer;
 708                 }
 709
 710                 /*
 711                  *      User authenticated O.K. Now we have to check
 712                  *      for the Simultaneous-Use parameter.
 713                  */
 714                 if (namepair &&
 715                     (r = module_checksimul(session_type, request, check_item->vp_integer)) != 0) {
 716                         char mpp_ok = 0;
 717
 718                         if (r == 2){
 719                                 /* Multilink attempt. Check if port-limit > simultaneous-use */
 720                                 VALUE_PAIR *port_limit;
 721
 722                                 if ((port_limit = pairfind(request->reply->vps, PW_PORT_LIMIT, 0)) != NULL &&
 723                                         port_limit->vp_integer > check_item->vp_integer){
 724                                         RDEBUG2("MPP is OK");
 725                                         mpp_ok = 1;
 726                                 }
 727                         }
 728                         if (!mpp_ok){
 729                                 if (check_item->vp_integer > 1) {
 730                                 snprintf(umsg, sizeof(umsg),
 731                                                         "\r\nYou are already logged in %d times  - access denied\r\n\n",
 732                                                         (int)check_item->vp_integer);
 733                                         user_msg = umsg;
 734                                 } else {
 735                                         user_msg = "\r\nYou are already logged in - access denied\r\n\n";
 736                                 }
 737
 738                                 request->reply->code = PW_AUTHENTICATION_REJECT;
 739
 740                                 /*
 741                                  *      They're trying to log in too many times.
 742                                  *      Remove ALL reply attributes.
 743                                  */
 744                                 pairfree(&request->reply->vps);
 745                                 radius_pairmake(request, &request->reply->vps,
 746                                                 "Reply-Message",
 747                                                 user_msg, T_OP_SET);
 748
 749                                 snprintf(logstr, sizeof(logstr), "Multiple logins (max %d) %s",
 750                                         check_item->vp_integer,
 751                                         r == 2 ? "[MPP attempt]" : "");
 752                                 rad_authlog(logstr, request, 1);
 753
 754                                 result = -1;
 755                         }
 756                 }
 757         }
 758 #endif
 759
 760         /*
 761          *      Result should be >= 0 here - if not, it means the user
 762          *      is rejected, so we just process post-auth and return.
 763          */
 764         if (result < 0) {
 765                 return RLM_MODULE_REJECT;
 766         }
 767
 768         /*
 769          *      Add the port number to the Framed-IP-Address if
 770          *      vp->addport is set.
 771          */
 772         if (((tmp = pairfind(request->reply->vps,
 773                              PW_FRAMED_IP_ADDRESS, 0)) != NULL) &&
 774             (tmp->flags.addport != 0)) {
 775                 VALUE_PAIR *vpPortId;
 776
 777                 /*
 778                  *  Find the NAS port ID.
 779                  */
 780                 if ((vpPortId = pairfind(request->packet->vps,
 781                                          PW_NAS_PORT, 0)) != NULL) {
 782                   unsigned long tvalue = ntohl(tmp->vp_integer);
 783                   tmp->vp_integer = htonl(tvalue + vpPortId->vp_integer);
 784                   tmp->flags.addport = 0;
 785                   ip_ntoa(tmp->vp_strvalue, tmp->vp_integer);
 786                 } else {
 787                         RDEBUG2("WARNING: No NAS-Port attribute in request.  CANNOT return a Framed-IP-Address + NAS-Port.\n");
 788                         pairdelete(&request->reply->vps, PW_FRAMED_IP_ADDRESS, 0);
 789                 }
 790         }
 791
 792         /*
 793          *      Set the reply to Access-Accept, if it hasn't already
 794          *      been set to something.  (i.e. Access-Challenge)
 795          */
 796         if (request->reply->code == 0)
 797           request->reply->code = PW_AUTHENTICATION_ACK;
 798
 799         if ((module_msg = pairfind(request->packet->vps,PW_MODULE_SUCCESS_MESSAGE, 0)) != NULL){
 800                 char msg[MAX_STRING_LEN+12];
 801
 802                 snprintf(msg, sizeof(msg), "Login OK (%s)",
 803                          module_msg->vp_strvalue);
 804                 rad_authlog(msg, request, 1);
 805         } else {
 806                 rad_authlog("Login OK", request, 1);
 807         }
 808
 809         /*
 810          *      Run the modules in the 'post-auth' section.
 811          */
 812         result = rad_postauth(request);
 813
 814         return result;
 815 }