src/main/auth.c

   1 /*
   2  * auth.c       User authentication.
   3  *
   4  * Version:     $Id$
   5  *
   6  *   This program is free software; you can redistribute it and/or modify
   7  *   it under the terms of the GNU General Public License as published by
   8  *   the Free Software Foundation; either version 2 of the License, or
   9  *   (at your option) any later version.
  10  *
  11  *   This program is distributed in the hope that it will be useful,
  12  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *   GNU General Public License for more details.
  15  *
  16  *   You should have received a copy of the GNU General Public License
  17  *   along with this program; if not, write to the Free Software
  18  *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  19  *
  20  * Copyright 2000,2006  The FreeRADIUS server project
  21  * Copyright 2000  Miquel van Smoorenburg <miquels@cistron.nl>
  22  * Copyright 2000  Jeff Carneal <jeff@apex.net>
  23  */
  24
  25 #include <freeradius-devel/ident.h>
  26 RCSID("$Id$")
  27
  28 #include <freeradius-devel/radiusd.h>
  29 #include <freeradius-devel/modules.h>
  30 #include <freeradius-devel/rad_assert.h>
  31
  32 #include <ctype.h>
  33
  34 /*
  35  *      Return a short string showing the terminal server, port
  36  *      and calling station ID.
  37  */
  38 char *auth_name(char *buf, size_t buflen, REQUEST *request, int do_cli) {
  39         VALUE_PAIR      *cli;
  40         VALUE_PAIR      *pair;
  41         int             port = 0;
  42
  43         if ((cli = pairfind(request->packet->vps, PW_CALLING_STATION_ID)) == NULL)
  44                 do_cli = 0;
  45         if ((pair = pairfind(request->packet->vps, PW_NAS_PORT)) != NULL)
  46                 port = pair->lvalue;
  47
  48         snprintf(buf, buflen, "from client %.128s port %u%s%.128s",
  49                         client_name_old(&request->packet->src_ipaddr), port,
  50                         (do_cli ? " cli " : ""), (do_cli ? (char *)cli->vp_strvalue : ""));
  51
  52         return buf;
  53 }
  54
  55
  56
  57 /*
  58  * Make sure user/pass are clean
  59  * and then log them
  60  */
  61 static int rad_authlog(const char *msg, REQUEST *request, int goodpass) {
  62
  63         char clean_password[1024];
  64         char clean_username[1024];
  65         char buf[1024];
  66         VALUE_PAIR *username = NULL;
  67
  68         if (!mainconfig.log_auth) {
  69                 return 0;
  70         }
  71
  72         /*
  73          * Get the correct username based on the configured value
  74          */
  75         if (log_stripped_names == 0) {
  76                 username = pairfind(request->packet->vps, PW_USER_NAME);
  77         } else {
  78                 username = request->username;
  79         }
  80
  81         /*
  82          *      Clean up the username
  83          */
  84         if (username == NULL) {
  85                 strcpy(clean_username, "<no User-Name attribute>");
  86         } else {
  87                 librad_safeprint((char *)username->vp_strvalue,
  88                                 username->length,
  89                                 clean_username, sizeof(clean_username));
  90         }
  91
  92         /*
  93          *      Clean up the password
  94          */
  95         if (mainconfig.log_auth_badpass || mainconfig.log_auth_goodpass) {
  96                 if (!request->password) {
  97                         VALUE_PAIR *auth_type;
  98
  99                         auth_type = pairfind(request->config_items,
 100                                              PW_AUTH_TYPE);
 101                         if (auth_type && (auth_type->vp_strvalue[0] != '\0')) {
 102                                 snprintf(clean_password, sizeof(clean_password),
 103                                          "<via Auth-Type = %s>",
 104                                          auth_type->vp_strvalue);
 105                         } else {
 106                                 strcpy(clean_password, "<no User-Password attribute>");
 107                         }
 108                 } else if (pairfind(request->packet->vps, PW_CHAP_PASSWORD)) {
 109                         strcpy(clean_password, "<CHAP-Password>");
 110                 } else {
 111                         librad_safeprint((char *)request->password->vp_strvalue,
 112                                          request->password->length,
 113                                          clean_password, sizeof(clean_password));
 114                 }
 115         }
 116
 117         if (goodpass) {
 118                 radlog(L_AUTH, "%s: [%s%s%s] (%s)",
 119                                 msg,
 120                                 clean_username,
 121                                 mainconfig.log_auth_goodpass ? "/" : "",
 122                                 mainconfig.log_auth_goodpass ? clean_password : "",
 123                                 auth_name(buf, sizeof(buf), request, 1));
 124         } else {
 125                 radlog(L_AUTH, "%s: [%s%s%s] (%s)",
 126                                 msg,
 127                                 clean_username,
 128                                 mainconfig.log_auth_badpass ? "/" : "",
 129                                 mainconfig.log_auth_badpass ? clean_password : "",
 130                                 auth_name(buf, sizeof(buf), request, 1));
 131         }
 132
 133         return 0;
 134 }
 135
 136 /*
 137  *      Check password.
 138  *
 139  *      Returns:        0  OK
 140  *                      -1 Password fail
 141  *                      -2 Rejected (Auth-Type = Reject, send Port-Message back)
 142  *                      1  End check & return, don't reply
 143  *
 144  *      NOTE: NOT the same as the RLM_ values !
 145  */
 146 static int rad_check_password(REQUEST *request)
 147 {
 148         VALUE_PAIR *auth_type_pair;
 149         VALUE_PAIR *cur_config_item;
 150         VALUE_PAIR *password_pair;
 151         VALUE_PAIR *auth_item;
 152         char string[MAX_STRING_LEN];
 153         int auth_type = -1;
 154         int result;
 155         int auth_type_count = 0;
 156         result = 0;
 157
 158         /*
 159          *      Look for matching check items. We skip the whole lot
 160          *      if the authentication type is PW_AUTHTYPE_ACCEPT or
 161          *      PW_AUTHTYPE_REJECT.
 162          */
 163         cur_config_item = request->config_items;
 164         while(((auth_type_pair = pairfind(cur_config_item, PW_AUTH_TYPE))) != NULL) {
 165                 auth_type = auth_type_pair->lvalue;
 166                 auth_type_count++;
 167
 168                 DEBUG2("  rad_check_password:  Found Auth-Type %s",
 169                                 auth_type_pair->vp_strvalue);
 170                 cur_config_item = auth_type_pair->next;
 171
 172                 if (auth_type == PW_AUTHTYPE_REJECT) {
 173                         DEBUG2("  rad_check_password: Auth-Type = Reject, rejecting user");
 174                         return -2;
 175                 }
 176         }
 177
 178         if (( auth_type_count > 1) && (debug_flag)) {
 179                 radlog(L_ERR, "Warning:  Found %d auth-types on request for user '%s'",
 180                         auth_type_count, request->username->vp_strvalue);
 181         }
 182
 183         /*
 184          *      This means we have a proxy reply or an accept
 185          *  and it wasn't rejected in the above loop.  So
 186          *  that means it is accepted and we do no further
 187          *  authentication
 188          */
 189         if ((auth_type == PW_AUTHTYPE_ACCEPT) || (request->proxy)) {
 190                 DEBUG2("  rad_check_password: Auth-Type = Accept, accepting the user");
 191                 return 0;
 192         }
 193
 194         password_pair =  pairfind(request->config_items, PW_USER_PASSWORD);
 195         if (password_pair &&
 196             pairfind(request->config_items, PW_CLEARTEXT_PASSWORD)) {
 197                 pairdelete(&request->config_items, PW_USER_PASSWORD);
 198                 password_pair = NULL;
 199         }
 200
 201         if (password_pair) {
 202                 DEBUG("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 203                 DEBUG("!!!    Replacing User-Password in config items with Cleartext-Password.     !!!");
 204                 DEBUG("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 205                 DEBUG("!!! Please update your configuration so that the \"known good\"               !!!");
 206                 DEBUG("!!! clear text password is in Cleartext-Password, and not in User-Password. !!!");
 207                 DEBUG("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!");
 208                 password_pair->attribute = PW_CLEARTEXT_PASSWORD;
 209                 strlcpy(password_pair->name, "Cleatext-Password",
 210                         sizeof(password_pair->name));
 211         }
 212
 213         /*
 214          *      Find the "known good" password.
 215          *
 216          *      FIXME: We should get rid of these hacks, and replace
 217          *      them with a module.
 218          */
 219         if ((password_pair = pairfind(request->config_items, PW_CRYPT_PASSWORD)) != NULL) {
 220                 /*
 221                  *      Re-write Auth-Type, but ONLY if it isn't already
 222                  *      set.
 223                  */
 224                 if (auth_type == -1) auth_type = PW_AUTHTYPE_CRYPT;
 225         } else {
 226                 password_pair = pairfind(request->config_items, PW_CLEARTEXT_PASSWORD);
 227         }
 228
 229         if (auth_type < 0) {
 230                 if (password_pair) {
 231                         auth_type = PW_AUTHTYPE_LOCAL;
 232                 } else {
 233                         /*
 234                         *       The admin hasn't told us how to
 235                         *       authenticate the user, so we reject them!
 236                         *
 237                         *       This is fail-safe.
 238                         */
 239                         DEBUG2("auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user");
 240                         return -2;
 241                 }
 242         }
 243
 244         switch(auth_type) {
 245                 DICT_VALUE *dval;
 246
 247                 case PW_AUTHTYPE_CRYPT:
 248                         /*
 249                          *      Find the password sent by the user. It
 250                          *      SHOULD be there, if it's not
 251                          *      authentication fails.
 252                          */
 253                         auth_item = request->password;
 254                         if (auth_item == NULL) {
 255                                 DEBUG2("auth: No User-Password or CHAP-Password attribute in the request");
 256                                 return -1;
 257                         }
 258
 259                         DEBUG2("auth: type Crypt");
 260                         if (password_pair == NULL) {
 261                                 DEBUG2("No Crypt-Password configured for the user");
 262                                 rad_authlog("Login incorrect "
 263                                         "(No Crypt-Password configured for the user)", request, 0);
 264                                 return -1;
 265                         }
 266
 267                         switch (lrad_crypt_check((char *)auth_item->vp_strvalue,
 268                                                                          (char *)password_pair->vp_strvalue)) {
 269                         case -1:
 270                           rad_authlog("Login incorrect "
 271                                                   "(system failed to supply an encrypted password for comparison)", request, 0);
 272                         case 1:
 273                           return -1;
 274                         }
 275                         break;
 276                 case PW_AUTHTYPE_LOCAL:
 277                         DEBUG2("auth: type Local");
 278
 279                         /*
 280                          *      Find the password sent by the user. It
 281                          *      SHOULD be there, if it's not
 282                          *      authentication fails.
 283                          */
 284                         auth_item = request->password;
 285                         if (!auth_item)
 286                                 auth_item = pairfind(request->packet->vps,
 287                                                      PW_CHAP_PASSWORD);
 288                         if (!auth_item) {
 289                                 DEBUG2("auth: No User-Password or CHAP-Password attribute in the request");
 290                                 return -1;
 291                         }
 292
 293                         /*
 294                          *      Plain text password.
 295                          */
 296                         if (password_pair == NULL) {
 297                                 DEBUG2("auth: No password configured for the user");
 298                                 rad_authlog("Login incorrect "
 299                                         "(No password configured for the user)", request, 0);
 300                                 return -1;
 301                         }
 302
 303                         /*
 304                          *      Local password is just plain text.
 305                          */
 306                         if (auth_item->attribute == PW_USER_PASSWORD) {
 307                                 if (strcmp((char *)password_pair->vp_strvalue,
 308                                            (char *)auth_item->vp_strvalue) != 0) {
 309                                         DEBUG2("auth: user supplied User-Password does NOT match local User-Password");
 310                                         return -1;
 311                                 }
 312                                 DEBUG2("auth: user supplied User-Password matches local User-Password");
 313                                 break;
 314
 315                         } else if (auth_item->attribute != PW_CHAP_PASSWORD) {
 316                                 DEBUG2("The user did not supply a User-Password or a CHAP-Password attribute");
 317                                 rad_authlog("Login incorrect "
 318                                         "(no User-Password or CHAP-Password attribute)", request, 0);
 319                                 return -1;
 320                         }
 321
 322                         rad_chap_encode(request->packet, string,
 323                                         auth_item->vp_strvalue[0], password_pair);
 324
 325                         /*
 326                          *      Compare them
 327                          */
 328                         if (memcmp(string + 1, auth_item->vp_strvalue + 1,
 329                                    CHAP_VALUE_LENGTH) != 0) {
 330                                 DEBUG2("auth: user supplied CHAP-Password does NOT match local User-Password");
 331                                 return -1;
 332                         }
 333                         DEBUG2("auth: user supplied CHAP-Password matches local User-Password");
 334                         break;
 335                 default:
 336                         dval = dict_valbyattr(PW_AUTH_TYPE, auth_type);
 337                         if (dval) {
 338                                 DEBUG2("auth: type \"%s\"", dval->name);
 339                         } else {
 340                                 DEBUG2("auth: type UNKNOWN-%d", auth_type);
 341                         }
 342
 343                         /*
 344                          *      See if there is a module that handles
 345                          *      this type, and turn the RLM_ return
 346                          *      status into the values as defined at
 347                          *      the top of this function.
 348                          */
 349                         result = module_authenticate(auth_type, request);
 350                         switch (result) {
 351                                 /*
 352                                  *      An authentication module FAIL
 353                                  *      return code, or any return code that
 354                                  *      is not expected from authentication,
 355                                  *      is the same as an explicit REJECT!
 356                                  */
 357                                 case RLM_MODULE_FAIL:
 358                                 case RLM_MODULE_INVALID:
 359                                 case RLM_MODULE_NOOP:
 360                                 case RLM_MODULE_NOTFOUND:
 361                                 case RLM_MODULE_REJECT:
 362                                 case RLM_MODULE_UPDATED:
 363                                 case RLM_MODULE_USERLOCK:
 364                                 default:
 365                                         result = -1;
 366                                         break;
 367                                 case RLM_MODULE_OK:
 368                                         result = 0;
 369                                         break;
 370                                 case RLM_MODULE_HANDLED:
 371                                         result = 1;
 372                                         break;
 373                         }
 374                         break;
 375         }
 376
 377         return result;
 378 }
 379
 380 /*
 381  *      Post-authentication step processes the response before it is
 382  *      sent to the NAS. It can receive both Access-Accept and Access-Reject
 383  *      replies.
 384  */
 385 int rad_postauth(REQUEST *request)
 386 {
 387         int     result;
 388         int     postauth_type = 0;
 389         VALUE_PAIR *vp;
 390
 391         /*
 392          *      Do post-authentication calls. ignoring the return code.
 393          */
 394         vp = pairfind(request->config_items, PW_POST_AUTH_TYPE);
 395         if (vp) {
 396                 DEBUG2("  Found Post-Auth-Type %s", vp->vp_strvalue);
 397                 postauth_type = vp->lvalue;
 398         }
 399         result = module_post_auth(postauth_type, request);
 400         switch (result) {
 401                 /*
 402                  *      The module failed, or said to reject the user: Do so.
 403                  */
 404                 case RLM_MODULE_FAIL:
 405                 case RLM_MODULE_INVALID:
 406                 case RLM_MODULE_REJECT:
 407                 case RLM_MODULE_USERLOCK:
 408                 default:
 409                         request->reply->code = PW_AUTHENTICATION_REJECT;
 410                         result = RLM_MODULE_REJECT;
 411                         break;
 412                 /*
 413                  *      The module handled the request, cancel the reply.
 414                  */
 415                 case RLM_MODULE_HANDLED:
 416                         /* FIXME */
 417                         break;
 418                 /*
 419                  *      The module had a number of OK return codes.
 420                  */
 421                 case RLM_MODULE_NOOP:
 422                 case RLM_MODULE_NOTFOUND:
 423                 case RLM_MODULE_OK:
 424                 case RLM_MODULE_UPDATED:
 425                         result = RLM_MODULE_OK;
 426                         break;
 427         }
 428         return result;
 429 }
 430
 431 /*
 432  *      Before sending an Access-Reject, call the modules in the
 433  *      Post-Auth-Type REJECT stanza.
 434  */
 435 static int rad_postauth_reject(REQUEST *request)
 436 {
 437         int             result;
 438         VALUE_PAIR      *tmp;
 439         DICT_VALUE      *dval;
 440
 441         dval = dict_valbyname(PW_POST_AUTH_TYPE, "REJECT");
 442         if (dval) {
 443                 /* Overwrite the Post-Auth-Type with the value REJECT */
 444                 pairdelete(&request->config_items, PW_POST_AUTH_TYPE);
 445                 tmp = paircreate(PW_POST_AUTH_TYPE, PW_TYPE_INTEGER);
 446                 tmp->lvalue = dval->value;
 447                 pairadd(&request->config_items, tmp);
 448                 result = rad_postauth(request);
 449         } else {
 450                 /* No REJECT stanza */
 451                 result = RLM_MODULE_OK;
 452         }
 453         return result;
 454 }
 455
 456 /*
 457  *      Process and reply to an authentication request
 458  *
 459  *      The return value of this function isn't actually used right now, so
 460  *      it's not entirely clear if it is returning the right things. --Pac.
 461  */
 462 int rad_authenticate(REQUEST *request)
 463 {
 464         VALUE_PAIR      *namepair;
 465         VALUE_PAIR      *check_item;
 466         VALUE_PAIR      *auth_item;
 467         VALUE_PAIR      *module_msg;
 468         VALUE_PAIR      *tmp = NULL;
 469         int             result;
 470         char            umsg[MAX_STRING_LEN + 1];
 471         const char      *user_msg = NULL;
 472         const char      *password;
 473         char            logstr[1024];
 474         char            autz_retry = 0;
 475         int             autz_type = 0;
 476
 477         password = "";
 478
 479         /*
 480          *      If this request got proxied to another server, we need
 481          *      to check whether it authenticated the request or not.
 482          */
 483         if (request->proxy_reply) {
 484                 switch (request->proxy_reply->code) {
 485                 /*
 486                  *      Reply of ACCEPT means accept, thus set Auth-Type
 487                  *      accordingly.
 488                  */
 489                 case PW_AUTHENTICATION_ACK:
 490                         tmp = paircreate(PW_AUTH_TYPE, PW_TYPE_INTEGER);
 491                         if (tmp == NULL) {
 492                                 radlog(L_ERR|L_CONS, "Not enough memory");
 493                                 exit(1);
 494                         }
 495                         tmp->lvalue = PW_AUTHTYPE_ACCEPT;
 496                         pairadd(&request->config_items, tmp);
 497                         break;
 498                 /*
 499                  *      Challenges are punted back to the NAS without any
 500                  *      further processing.
 501                  */
 502                 case PW_ACCESS_CHALLENGE:
 503                         request->reply->code = PW_ACCESS_CHALLENGE;
 504                         return RLM_MODULE_OK;
 505                 /*
 506                  *      ALL other replies mean reject. (this is fail-safe)
 507                  *
 508                  *      Do NOT do any authorization or authentication. They
 509                  *      are being rejected, so we minimize the amount of work
 510                  *      done by the server, by rejecting them here.
 511                  */
 512                 case PW_AUTHENTICATION_REJECT:
 513                 default:
 514                         rad_authlog("Login incorrect (Home Server says so)",
 515                                     request, 0);
 516                         request->reply->code = PW_AUTHENTICATION_REJECT;
 517                         rad_postauth_reject(request);
 518                         return RLM_MODULE_REJECT;
 519                 }
 520         }
 521
 522         /*
 523          *      Get the username from the request.
 524          *
 525          *      Note that namepair MAY be NULL, in which case there
 526          *      is no User-Name attribute in the request.
 527          */
 528         namepair = request->username;
 529
 530         /*
 531          *      Look for, and cache, passwords.
 532          */
 533         if (!request->password) {
 534                 request->password = pairfind(request->packet->vps,
 535                                              PW_USER_PASSWORD);
 536         }
 537
 538         /*
 539          *      Discover which password we want to use.
 540          */
 541         auth_item = request->password;
 542         if (auth_item) {
 543                 password = (const char *)auth_item->vp_strvalue;
 544
 545         } else {
 546                 /*
 547                  *      Maybe there's a CHAP-Password?
 548                  */
 549                 if ((auth_item = pairfind(request->packet->vps,
 550                                           PW_CHAP_PASSWORD)) != NULL) {
 551                         password = "<CHAP-PASSWORD>";
 552
 553                 } else {
 554                         /*
 555                          *      No password we recognize.
 556                          */
 557                         password = "<NO-PASSWORD>";
 558                 }
 559         }
 560         request->password = auth_item;
 561
 562         /*
 563          *      Get the user's authorization information from the database
 564          */
 565 autz_redo:
 566         result = module_authorize(autz_type, request);
 567         switch (result) {
 568                 case RLM_MODULE_NOOP:
 569                 case RLM_MODULE_NOTFOUND:
 570                 case RLM_MODULE_OK:
 571                 case RLM_MODULE_UPDATED:
 572                         break;
 573                 case RLM_MODULE_FAIL:
 574                 case RLM_MODULE_HANDLED:
 575                         return result;
 576                 case RLM_MODULE_INVALID:
 577                 case RLM_MODULE_REJECT:
 578                 case RLM_MODULE_USERLOCK:
 579                 default:
 580                         if ((module_msg = pairfind(request->packet->vps,
 581                                         PW_MODULE_FAILURE_MESSAGE)) != NULL) {
 582                                 char msg[MAX_STRING_LEN + 16];
 583                                 snprintf(msg, sizeof(msg), "Invalid user (%s)",
 584                                          module_msg->vp_strvalue);
 585                                 rad_authlog(msg,request,0);
 586                         } else {
 587                                 rad_authlog("Invalid user", request, 0);
 588                         }
 589                         request->reply->code = PW_AUTHENTICATION_REJECT;
 590                         return result;
 591         }
 592         if (!autz_retry) {
 593                 tmp = pairfind(request->config_items, PW_AUTZ_TYPE);
 594                 if (tmp) {
 595                         DEBUG2("  Found Autz-Type %s", tmp->vp_strvalue);
 596                         autz_type = tmp->lvalue;
 597                         autz_retry = 1;
 598                         goto autz_redo;
 599                 }
 600         }
 601
 602         /*
 603          *      If we haven't already proxied the packet, then check
 604          *      to see if we should.  Maybe one of the authorize
 605          *      modules has decided that a proxy should be used. If
 606          *      so, get out of here and send the packet.
 607          */
 608         if ((request->proxy == NULL) &&
 609             ((tmp = pairfind(request->config_items, PW_PROXY_TO_REALM)) != NULL)) {
 610                 REALM *realm;
 611
 612                 /*
 613                  *      Catch users who set Proxy-To-Realm to a LOCAL
 614                  *      realm (sigh).
 615                  */
 616                 realm = realm_find(tmp->vp_strvalue);
 617                 if (realm && !realm->auth_pool) {
 618                         DEBUG2("  WARNING: You set Proxy-To-Realm = %s, but it is a LOCAL realm!  Cancelling invalid proxy request.", realm->name);
 619                 } else {
 620                         /*
 621                          *      Don't authenticate, as the request is
 622                          *      proxied.
 623                          */
 624                         return RLM_MODULE_OK;
 625                 }
 626         }
 627
 628         /*
 629          *      Perhaps there is a Stripped-User-Name now.
 630          */
 631         namepair = request->username;
 632
 633         /*
 634          *      Validate the user
 635          */
 636         do {
 637                 result = rad_check_password(request);
 638                 if (result > 0) {
 639                         /* don't reply! */
 640                         return RLM_MODULE_HANDLED;
 641                 }
 642         } while(0);
 643
 644         /*
 645          *      Failed to validate the user.
 646          *
 647          *      We PRESUME that the code which failed will clean up
 648          *      request->reply->vps, to be ONLY the reply items it
 649          *      wants to send back.
 650          */
 651         if (result < 0) {
 652                 DEBUG2("auth: Failed to validate the user.");
 653                 request->reply->code = PW_AUTHENTICATION_REJECT;
 654
 655                 if ((module_msg = pairfind(request->packet->vps,PW_MODULE_FAILURE_MESSAGE)) != NULL){
 656                         char msg[MAX_STRING_LEN+19];
 657
 658                         snprintf(msg, sizeof(msg), "Login incorrect (%s)",
 659                                  module_msg->vp_strvalue);
 660                         rad_authlog(msg, request, 0);
 661                 } else {
 662                         rad_authlog("Login incorrect", request, 0);
 663                 }
 664
 665                 /* double check: maybe the secret is wrong? */
 666                 if ((debug_flag > 1) && (auth_item != NULL) &&
 667                                 (auth_item->attribute == PW_USER_PASSWORD)) {
 668                         u_char *p;
 669
 670                         p = auth_item->vp_strvalue;
 671                         while (*p != '\0') {
 672                                 if (!isprint((int) *p)) {
 673                                         log_debug("  WARNING: Unprintable characters in the password.\n\t  Double-check the shared secret on the server and the NAS!");
 674                                         break;
 675                                 }
 676                                 p++;
 677                         }
 678                 }
 679         }
 680
 681         if (result >= 0 &&
 682             (check_item = pairfind(request->config_items, PW_SIMULTANEOUS_USE)) != NULL) {
 683                 int r, session_type = 0;
 684
 685                 tmp = pairfind(request->config_items, PW_SESSION_TYPE);
 686                 if (tmp) {
 687                         DEBUG2("  Found Session-Type %s", tmp->vp_strvalue);
 688                         session_type = tmp->lvalue;
 689                 }
 690
 691                 /*
 692                  *      User authenticated O.K. Now we have to check
 693                  *      for the Simultaneous-Use parameter.
 694                  */
 695                 if (namepair &&
 696                     (r = module_checksimul(session_type, request, check_item->lvalue)) != 0) {
 697                         char mpp_ok = 0;
 698
 699                         if (r == 2){
 700                                 /* Multilink attempt. Check if port-limit > simultaneous-use */
 701                                 VALUE_PAIR *port_limit;
 702
 703                                 if ((port_limit = pairfind(request->reply->vps, PW_PORT_LIMIT)) != NULL &&
 704                                         port_limit->lvalue > check_item->lvalue){
 705                                         DEBUG2("main auth: MPP is OK");
 706                                         mpp_ok = 1;
 707                                 }
 708                         }
 709                         if (!mpp_ok){
 710                                 if (check_item->lvalue > 1) {
 711                                 snprintf(umsg, sizeof(umsg),
 712                                                         "\r\nYou are already logged in %d times  - access denied\r\n\n",
 713                                                         (int)check_item->lvalue);
 714                                         user_msg = umsg;
 715                                 } else {
 716                                         user_msg = "\r\nYou are already logged in - access denied\r\n\n";
 717                                 }
 718
 719                                 request->reply->code = PW_AUTHENTICATION_REJECT;
 720
 721                                 /*
 722                                  *      They're trying to log in too many times.
 723                                  *      Remove ALL reply attributes.
 724                                  */
 725                                 pairfree(&request->reply->vps);
 726                                 tmp = pairmake("Reply-Message", user_msg, T_OP_SET);
 727                                 request->reply->vps = tmp;
 728
 729                                 snprintf(logstr, sizeof(logstr), "Multiple logins (max %d) %s",
 730                                         check_item->lvalue,
 731                                         r == 2 ? "[MPP attempt]" : "");
 732                                 rad_authlog(logstr, request, 1);
 733
 734                                 result = -1;
 735                         }
 736                 }
 737         }
 738
 739         /*
 740          *      Result should be >= 0 here - if not, it means the user
 741          *      is rejected, so we just process post-auth and return.
 742          */
 743         if (result < 0) {
 744                 rad_postauth_reject(request);
 745                 return RLM_MODULE_REJECT;
 746         }
 747
 748         /*
 749          *      We might need this later.  The 'password' string
 750          *      is NOT used anywhere below here, except for logging,
 751          *      so it should be safe...
 752          */
 753         if ((auth_item != NULL) && (auth_item->attribute == PW_CHAP_PASSWORD)) {
 754                 password = "CHAP-Password";
 755         }
 756
 757         /*
 758          *      Add the port number to the Framed-IP-Address if
 759          *      vp->addport is set.
 760          */
 761         if (((tmp = pairfind(request->reply->vps,
 762                              PW_FRAMED_IP_ADDRESS)) != NULL) &&
 763             (tmp->flags.addport != 0)) {
 764                 VALUE_PAIR *vpPortId;
 765
 766                 /*
 767                  *  Find the NAS port ID.
 768                  */
 769                 if ((vpPortId = pairfind(request->packet->vps,
 770                                          PW_NAS_PORT)) != NULL) {
 771                   unsigned long tvalue = ntohl(tmp->lvalue);
 772                   tmp->lvalue = htonl(tvalue + vpPortId->lvalue);
 773                   tmp->flags.addport = 0;
 774                   ip_ntoa(tmp->vp_strvalue, tmp->lvalue);
 775                 } else {
 776                         DEBUG2("WARNING: No NAS-Port attribute in request.  CANNOT return a Framed-IP-Address + NAS-Port.\n");
 777                         pairdelete(&request->reply->vps, PW_FRAMED_IP_ADDRESS);
 778                 }
 779         }
 780
 781         /*
 782          *      Set the reply to Access-Accept, if it hasn't already
 783          *      been set to something.  (i.e. Access-Challenge)
 784          */
 785         if (request->reply->code == 0)
 786           request->reply->code = PW_AUTHENTICATION_ACK;
 787
 788         if ((module_msg = pairfind(request->packet->vps,PW_MODULE_SUCCESS_MESSAGE)) != NULL){
 789                 char msg[MAX_STRING_LEN+12];
 790
 791                 snprintf(msg, sizeof(msg), "Login OK (%s)",
 792                          module_msg->vp_strvalue);
 793                 rad_authlog(msg, request, 1);
 794         } else {
 795                 rad_authlog("Login OK", request, 1);
 796         }
 797
 798         /*
 799          *      Run the modules in the 'post-auth' section.
 800          */
 801         result = rad_postauth(request);
 802
 803         return result;
 804 }