X-Git-Url: https://git.ozlabs.org/?p=ppp.git;a=blobdiff_plain;f=pppd%2Fplugins%2Fradius%2Fradius.c;h=a36c34311bb0812d840a76753b07c91bfd9c354a;hp=3dc69aeae92b2a2b42d97fed65afcf8e8af2d052;hb=bcfa20820fc9ff3b25bcf62308e3e737c1897dc6;hpb=734747f7ef4d64cc7f92ea953c4ab57581c01f8f

diff --git a/pppd/plugins/radius/radius.c b/pppd/plugins/radius/radius.c
index 3dc69ae..a36c343 100644
--- a/pppd/plugins/radius/radius.c
+++ b/pppd/plugins/radius/radius.c
@@ -2,8 +2,8 @@
 *
 * radius.c
 *
-* RADIUS plugin for pppd.  Performs PAP and CHAP authentication using
-* RADIUS.
+* RADIUS plugin for pppd.  Performs PAP, CHAP, MS-CHAP, MS-CHAPv2
+* authentication using RADIUS.
 *
 * Copyright (C) 2002 Roaring Penguin Software Inc.
 *
@@ -21,10 +21,13 @@
 *
 ***********************************************************************/
 static char const RCSID[] =
-"$Id: radius.c,v 1.2 2002/02/08 17:28:31 dfs Exp $";
+"$Id: radius.c,v 1.6 2002/03/05 15:14:05 dfs Exp $";
 
 #include "pppd.h"
 #include "chap.h"
+#ifdef CHAPMS
+#include "chap_ms.h"
+#endif
 #include "radiusclient.h"
 #include "fsm.h"
 #include "ipcp.h"
@@ -55,15 +58,12 @@ static int radius_chap_auth(char *user,
 static void radius_ip_up(void *opaque, int arg);
 static void radius_ip_down(void *opaque, int arg);
 static void make_username_realm(char *user);
-static int radius_setparams(VALUE_PAIR *vp, char *msg);
+static int radius_setparams(chap_state *cstate, VALUE_PAIR *vp, char *msg);
 static void radius_choose_ip(u_int32_t *addrp);
 static int radius_init(char *msg);
 static int get_client_port(char *ifname);
 static int radius_allowed_address(u_int32_t addr);
 
-void (*radius_attributes_hook)(VALUE_PAIR *) = NULL;
-void (*radius_pre_auth_hook)(char const *user) = NULL;
-
 #ifndef MAXSESSIONID
 #define MAXSESSIONID 32
 #endif
@@ -80,8 +80,18 @@ struct radius_state {
     char config_file[MAXPATHLEN];
     char session_id[MAXSESSIONID + 1];
     time_t start_time;
+    SERVER *authserver;		/* Authentication server to use */
+    SERVER *acctserver;		/* Accounting server to use */
 };
 
+void (*radius_attributes_hook)(VALUE_PAIR *) = NULL;
+
+/* The pre_auth_hook MAY set authserver and acctserver if it wants.
+   In that case, they override the values in the radiusclient.conf file */
+void (*radius_pre_auth_hook)(char const *user,
+			     SERVER **authserver,
+			     SERVER **acctserver) = NULL;
+
 static struct radius_state rstate;
 
 char pppd_version[] = VERSION;
@@ -189,7 +199,9 @@ radius_pap_auth(char *user,
     make_username_realm(user);
 
     if (radius_pre_auth_hook) {
-	radius_pre_auth_hook(rstate.user);
+	radius_pre_auth_hook(rstate.user,
+			     &rstate.authserver,
+			     &rstate.acctserver);
     }
 
     send = NULL;
@@ -212,10 +224,16 @@ radius_pap_auth(char *user,
 		       VENDOR_NONE);
     }
 
-    result = rc_auth(rstate.client_port, send, &received, radius_msg);
+    if (rstate.authserver) {
+	result = rc_auth_using_server(rstate.authserver,
+				      rstate.client_port, send,
+				      &received, radius_msg);
+    } else {
+	result = rc_auth(rstate.client_port, send, &received, radius_msg);
+    }
 
     if (result == OK_RC) {
-	if (radius_setparams(received, radius_msg) < 0) {
+	if (radius_setparams(NULL, received, radius_msg) < 0) {
 	    result = ERROR_RC;
 	}
     }
@@ -237,7 +255,7 @@ radius_pap_auth(char *user,
 * %RETURNS:
 *  CHAP_SUCCESS if we can authenticate, CHAP_FAILURE if we cannot.
 * %DESCRIPTION:
-* Performs CHAP authentication using RADIUS
+* Performs CHAP, MS-CHAP and MS-CHAPv2 authentication using RADIUS
 ***********************************************************************/
 static int
 radius_chap_auth(char *user,
@@ -249,7 +267,7 @@ radius_chap_auth(char *user,
     UINT4 av_type;
     static char radius_msg[BUF_LEN];
     int result;
-    u_char cpassword[MD5_SIGNATURE_SIZE+1];
+    u_char cpassword[MAX_RESPONSE_LENGTH + 1];
     radius_msg[0] = 0;
 
     if (radius_init(radius_msg) < 0) {
@@ -257,9 +275,14 @@ radius_chap_auth(char *user,
 	return CHAP_FAILURE;
     }
 
-    /* we handle md5 digest at the moment */
-    if (cstate->chal_type != CHAP_DIGEST_MD5) {
-	error("RADIUS: Challenge type not MD5");
+    /* return error for types we can't handle */
+    if ((cstate->chal_type != CHAP_DIGEST_MD5)
+#ifdef CHAPMS
+	&& (cstate->chal_type != CHAP_MICROSOFT)
+	&& (cstate->chal_type != CHAP_MICROSOFT_V2)
+#endif
+	) {
+	error("RADIUS: Challenge type %u unsupported", cstate->chal_type);
 	return CHAP_FAILURE;
     }
 
@@ -268,7 +291,9 @@ radius_chap_auth(char *user,
 	make_username_realm(user);
 	rstate.client_port = get_client_port (ifname);
 	if (radius_pre_auth_hook) {
-	    radius_pre_auth_hook(rstate.user);
+	    radius_pre_auth_hook(rstate.user,
+				 &rstate.authserver,
+				 &rstate.acctserver);
 	}
     }
 
@@ -283,26 +308,83 @@ radius_chap_auth(char *user,
     rc_avpair_add (&send, PW_USER_NAME, rstate.user , 0, VENDOR_NONE);
 
     /*
-     * add the CHAP-Password and CHAP-Challenge fields
+     * add the challenge and response fields
      */
+    switch (cstate->chal_type) {
+    case CHAP_DIGEST_MD5:
+	/* CHAP-Challenge and CHAP-Password */
+	cpassword[0] = cstate->chal_id;
+	memcpy(&cpassword[1], remmd, MD5_SIGNATURE_SIZE);
+
+	rc_avpair_add(&send, PW_CHAP_CHALLENGE,
+		      cstate->challenge, cstate->chal_len, VENDOR_NONE);
+	rc_avpair_add(&send, PW_CHAP_PASSWORD,
+		      cpassword, MD5_SIGNATURE_SIZE + 1, VENDOR_NONE);
+	break;
+
+#ifdef CHAPMS
+    case CHAP_MICROSOFT:
+    {
+	/* MS-CHAP-Challenge and MS-CHAP-Response */
+	MS_ChapResponse *rmd = (MS_ChapResponse *) remmd;
+	u_char *p = cpassword;
+
+	*p++ = cstate->chal_id;
+	/* The idiots use a different field order in RADIUS than PPP */
+	memcpy(p, rmd->UseNT, sizeof(rmd->UseNT));
+	p += sizeof(rmd->UseNT);
+	memcpy(p, rmd->LANManResp, sizeof(rmd->LANManResp));
+	p += sizeof(rmd->LANManResp);
+	memcpy(p, rmd->NTResp, sizeof(rmd->NTResp));
+
+	rc_avpair_add(&send, PW_MS_CHAP_CHALLENGE,
+		      cstate->challenge, cstate->chal_len, VENDOR_MICROSOFT);
+	rc_avpair_add(&send, PW_MS_CHAP_RESPONSE,
+		      cpassword, MS_CHAP_RESPONSE_LEN + 1, VENDOR_MICROSOFT);
+	break;
+    }
 
-    cpassword[0] = cstate->chal_id;
-
-    memcpy(&cpassword[1], remmd, MD5_SIGNATURE_SIZE);
-
-    rc_avpair_add(&send, PW_CHAP_PASSWORD, cpassword, MD5_SIGNATURE_SIZE + 1, VENDOR_NONE);
+    case CHAP_MICROSOFT_V2:
+    {
+	/* MS-CHAP-Challenge and MS-CHAP2-Response */
+	MS_Chap2Response *rmd = (MS_Chap2Response *) remmd;
+	u_char *p = cpassword;
+
+	*p++ = cstate->chal_id;
+	/* The idiots use a different field order in RADIUS than PPP */
+	memcpy(p, rmd->Flags, sizeof(rmd->Flags));
+	p += sizeof(rmd->Flags);
+	memcpy(p, rmd->PeerChallenge, sizeof(rmd->PeerChallenge));
+	p += sizeof(rmd->PeerChallenge);
+	memcpy(p, rmd->Reserved, sizeof(rmd->Reserved));
+	p += sizeof(rmd->Reserved);
+	memcpy(p, rmd->NTResp, sizeof(rmd->NTResp));
+
+	rc_avpair_add(&send, PW_MS_CHAP_CHALLENGE,
+		      cstate->challenge, cstate->chal_len, VENDOR_MICROSOFT);
+	rc_avpair_add(&send, PW_MS_CHAP2_RESPONSE,
+		      cpassword, MS_CHAP2_RESPONSE_LEN + 1, VENDOR_MICROSOFT);
+	break;
+    }
+#endif
 
-    rc_avpair_add(&send, PW_CHAP_CHALLENGE, cstate->challenge, cstate->chal_len, VENDOR_NONE);
+    }
 
     /*
      * make authentication with RADIUS server
      */
 
-    result = rc_auth (rstate.client_port, send, &received, radius_msg);
+    if (rstate.authserver) {
+	result = rc_auth_using_server(rstate.authserver,
+				      rstate.client_port, send,
+				      &received, radius_msg);
+    } else {
+	result = rc_auth(rstate.client_port, send, &received, radius_msg);
+    }
 
     if (result == OK_RC) {
 	if (!rstate.done_chap_once) {
-	    if (radius_setparams(received, radius_msg) < 0) {
+	    if (radius_setparams(cstate, received, radius_msg) < 0) {
 		error("%s", radius_msg);
 		result = ERROR_RC;
 	    } else {
@@ -350,18 +432,20 @@ make_username_realm(char *user)
 /**********************************************************************
 * %FUNCTION: radius_setparams
 * %ARGUMENTS:
+*  cstate -- pppd's chap_state structure
 *  vp -- received value-pairs
 *  msg -- buffer in which to place error message.  Holds up to BUF_LEN chars
 * %RETURNS:
 *  >= 0 on success; -1 on failure
 * %DESCRIPTION:
 *  Parses attributes sent by RADIUS server and sets them in pppd.  Currently,
-*  used only to set IP address.
+*  used only to set IP address and MS-CHAPv2 Authenticator Response.
 ***********************************************************************/
 static int
-radius_setparams(VALUE_PAIR *vp, char *msg)
+radius_setparams(chap_state *cstate, VALUE_PAIR *vp, char *msg)
 {
     u_int32_t remote;
+    int ms_chap2_success = 0;
 
     /* Send RADIUS attributes to anyone else who might be interested */
     if (radius_attributes_hook) {
@@ -374,8 +458,8 @@ radius_setparams(VALUE_PAIR *vp, char *msg)
      */
 
     while (vp) {
-	switch (vp->attribute) {
-	case PW_SERVICE_TYPE:
+	if ((vp->attribute == PW_SERVICE_TYPE) &&
+	    (vp->vendorcode == VENDOR_NONE)) {
 	    /* check for service type       */
 	    /* if not FRAMED then exit      */
 	    if (vp->lvalue != PW_FRAMED) {
@@ -383,8 +467,8 @@ radius_setparams(VALUE_PAIR *vp, char *msg)
 			 vp->lvalue, rstate.user);
 		return -1;
 	    }
-	    break;
-	case PW_FRAMED_PROTOCOL:
+	} else if ((vp->attribute == PW_FRAMED_PROTOCOL) &&
+		   (vp->vendorcode == VENDOR_NONE)) {
 	    /* check for framed protocol type       */
 	    /* if not PPP then also exit            */
 	    if (vp->lvalue != PW_PPP) {
@@ -392,9 +476,8 @@ radius_setparams(VALUE_PAIR *vp, char *msg)
 			 vp->lvalue, rstate.user);
 		return -1;
 	    }
-	    break;
-
-	case PW_FRAMED_IP_ADDRESS:
+	} else if ((vp->attribute == PW_FRAMED_IP_ADDRESS) &&
+		   (vp->vendorcode == VENDOR_NONE)) {
 	    /* seting up remote IP addresses */
 	    remote = vp->lvalue;
 	    if (remote == 0xffffffff) {
@@ -411,10 +494,26 @@ radius_setparams(VALUE_PAIR *vp, char *msg)
 		rstate.choose_ip = 1;
 		rstate.ip_addr = remote;
 	    }
-	    break;
+#ifdef CHAPMS
+	} else if ((vp->attribute == PW_MS_CHAP2_SUCCESS) &&
+		   (vp->vendorcode == VENDOR_MICROSOFT)) {
+	    if ((vp->lvalue != 43) || strncmp(vp->strvalue + 1, "S=", 2)) {
+		slprintf(msg, BUF_LEN, "RADIUS: bad MS-CHAP2-Success packet");
+		return -1;
+	    }
+	    memcpy(cstate->saresponse, vp->strvalue + 3,
+		   MS_AUTH_RESPONSE_LENGTH);
+	    cstate->saresponse[MS_AUTH_RESPONSE_LENGTH] = '\0';
+	    ms_chap2_success = 1;
+#endif /* CHAPMS */
 	}
 	vp = vp->next;
     }
+
+    /* Require a valid MS-CHAP2-SUCCESS for MS-CHAPv2 auth */
+    if (cstate && (cstate->chal_type == CHAP_MICROSOFT_V2) && !ms_chap2_success)
+	return -1;
+
     return 0;
 }
 
@@ -474,7 +573,12 @@ radius_acct_start(void)
     av_type = htonl(hisaddr);
     rc_avpair_add(&send, PW_FRAMED_IP_ADDRESS , &av_type , 0, VENDOR_NONE);
 
-    result = rc_acct(rstate.client_port, send);
+    if (rstate.acctserver) {
+	result = rc_acct_using_server(rstate.acctserver,
+				      rstate.client_port, send);
+    } else {
+	result = rc_acct(rstate.client_port, send);
+    }
 
     rc_avpair_free(send);
 
@@ -561,7 +665,13 @@ radius_acct_stop(void)
     av_type = htonl(hisaddr);
     rc_avpair_add(&send, PW_FRAMED_IP_ADDRESS , &av_type , 0, VENDOR_NONE);
 
-    result = rc_acct(rstate.client_port, send);
+    if (rstate.acctserver) {
+	result = rc_acct_using_server(rstate.acctserver,
+				      rstate.client_port, send);
+    } else {
+	result = rc_acct(rstate.client_port, send);
+    }
+
     if (result != OK_RC) {
 	/* RADIUS server could be down so make this a warning */
 	syslog(LOG_WARNING,
@@ -699,4 +809,3 @@ char *radius_logged_in_user(void)
 {
     return rstate.user;
 }
-