adulau/ootp
1
0
Fork 0
mirror of https://github.com/adulau/ootp.git synced 2024-11-24 11:07:07 +00:00
Code Issues Projects Releases Packages Wiki Activity
ootp/urd/urd.c

1191 lines
30 KiB
C
Raw Blame History

/*
* Copyright (c) 2009 Mark Fullmer
* Copyright (c) 2009 Mark Fullmer and the Ohio State University
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* $Id: urd.c 176 2011-05-16 02:17:30Z maf $
*/
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/fcntl.h>
#include <sys/stat.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <ctype.h>
#include <getopt.h>
#include <netdb.h>
#include <errno.h>
#include <inttypes.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#if HAVE_STRINGS_H
#include <strings.h>
#endif
#if HAVE_STRING_H
#include <string.h>
#endif
#ifdef OOTP_ENABLE
#include "otplib.h"
#include "ffdb.h"
#endif /* OOTP_ENABLE */
#include "pw.h"
#include "rad.h"
#include "xerr.h"
/*
* XXX
* copy proxy variables into reply packet per RFC?
* packet stress testing
*/
static void usage(void);
static int server_secret_load(char *fname, char *buf, int buf_len);
static u_long scan_ip(char *s);
static int write_pidfile(char *fname);
#define URDCTX_USER_NAME (allow_n_logins ?\
urdctx->req.user_name_base : urdctx->req.user_name)
int main(int argc, char **argv)
{
extern char *ootp_version;
struct sockaddr_in loc_addr;
struct urd_ctx *urdctx;
struct pass_db_ctx *pdbctx;
#ifdef OOTP_ENABLE
struct otp_ctx *otpctx;
struct otp_user ou;
char *otpdb_fname;
int otp_allow_unknown, otpdb_flags, otp_enable;
#endif /* OOTP_ENABLE */
fd_set rfd;
u_long tmpul;
uint64_t rep_state, rep_otp_count;
uint32_t local_ip;
uint16_t local_port;
uint8_t rep_code;
uint rem_addr_len;
char *au_fname, *pwfile_fname, *server_secret_fname, *endptr, *loc;
char server_secret[URD_SECRET_LEN+1], buf[1024], *pid_fname, *as_name;
char *service;
int rep_enc_flags, rep_cache_flags, debug, daemon_mode, pdb_type;
int drop, drop_mode, req_cache_hit, buf_l, pkt_fd, r, i, otp_window;
int opt_version, otp_display_count, tmp_cache_flags;
int disable_authorized_users, allow_n_logins;
struct option longopts[] = {
{ "authorized-users-db", 1, (void*)0L, 'a'},
{ "disable-authorized-users", 0, (void*)0L, 'A'},
{ "bind-ip-address", 1, (void*)0L, 'b'},
{ "bind-udp-port", 1, (void*)0L, 'B'},
#ifdef OOTP_ENABLE
{ "display-count", 0, (void*)0L, 'c'},
#endif /* OOTP_ENABLE */
{ "debug", 1, (void*)0L, 'd'},
{ "disable-daemon-mode", 0, (void*)0L, 'D'},
{ "help", 0, (void*)0L, 'h'},
{ "help", 0, (void*)0L, '?'},
{ "pam-authentication-enable", 0, (void*)0L, 'm'},
{ "pam-authentication-exclusive", 0, (void*)0L, 'M'},
{ "n-logins-enable", 0, (void*)0L, 'n'},
#ifdef OOTP_ENABLE
{ "otp-db", 1, (void*)0L, 'o'},
{ "otp-disable", 0, (void*)0L, 'O'},
#endif /* OOTP_ENABLE */
{ "password-db", 1, (void*)0L, 'p'},
{ "pidfile", 1, (void*)0L, 'P'},
{ "server-secret", 1, (void*)0L, 's'},
{ "pam-service-name", 1, (void*)0L, 'S'},
#ifdef OOTP_ENABLE
{ "otp-allow-unknown-user", 0, (void*)0L, 'u'},
{ "service-name", 0, (void*)0L, 'V'},
{ "otp-challenge-window", 1, (void*)0L, 'w'},
#endif /* OOTP_ENABLE */
{ "debug-drop-udp-packets", 0, (void*)0L, 'x'},
{ "version", 0, &opt_version, 1},
{ 0, 0, 0, 0},
};
bzero(&loc_addr, sizeof loc_addr);
bzero(&pkt_fd, sizeof pkt_fd);
bzero(&rfd, sizeof rfd);
allow_n_logins = 0;
opt_version = 0;
debug = 0;
daemon_mode = 1;
au_fname = "/var/urd/authorized_users";
disable_authorized_users = 0;
pwfile_fname = "/var/urd/passwd";
server_secret_fname = "/var/urd/server_secret";
pid_fname = (char*)0L;
local_ip = INADDR_ANY;
local_port = URD_PORT;
drop = 1;
drop_mode = 0;
otp_window = OTP_WINDOW_DEFAULT;
pdb_type = PASS_DB_TYPE_LOCAL;
as_name = "urd";
service = "urd";
#ifdef OOTP_ENABLE
otpctx = (struct otp_ctx*)0L;
otpdb_fname = OTP_DB_FNAME;
otp_allow_unknown = 0;
otpdb_flags = 0;
otp_enable = 1;
otp_display_count = 0;
#endif /* OOTP_ENABLE */
xerr_setid(argv[0]);
#ifdef OOTP_ENABLE
while ((i = getopt_long(argc, argv, "AhduDOx?a:cb:B:mMno:p:s:S:P:V:w:",
longopts, (int*)0L)) != -1) {
#else
while ((i = getopt_long(argc, argv, "AhdDx?a:b:B:mMnp:s:S:P:V:",
longopts, (int*)0L)) != -1) {
#endif /* OOTP_ENABLE */
switch (i) {
case 'a':
au_fname = optarg;
break;
case 'A':
disable_authorized_users = 1;
break;
case 'b':
if (!(local_ip = scan_ip(optarg)))
xerr_errx(1, "scan_ip(%s): fatal", optarg);
break;
case 'B':
tmpul = strtoul(optarg, &endptr, 0);
if (*endptr)
xerr_errx(1, "stroul(%s): failed at %c.", optarg, *endptr);
if (tmpul > 0xFFFF)
xerr_errx(1, "UDP port out of range 0..65535.");
local_port = tmpul;
break;
case 'c':
otp_display_count = 1;
break;
case 'd':
debug ++;
#ifdef OOTP_ENABLE
otpdb_flags |= OTP_DB_VERBOSE;
#endif /* OOTP_ENABLE */
break;
case 'D':
daemon_mode = 0;
break;
case 'h':
case '?':
usage();
exit(0);
break;
case 'm':
pdb_type = PASS_DB_TYPE_PAM;
break;
case 'M': /* xxx only here for compatability */
disable_authorized_users = 1;
break;
case 'n':
allow_n_logins = 1;
break;
#ifdef OOTP_ENABLE
case 'o':
otpdb_fname = optarg;
break;
case 'O':
otp_enable = 0;
break;
#endif /* OOTP_ENABLE */
case 'p':
pwfile_fname = optarg;
break;
case 'P':
pid_fname = optarg;
break;
case 's':
server_secret_fname = optarg;
break;
case 'S':
as_name = optarg;
break;
case 'V':
service = optarg;
break;
#ifdef OOTP_ENABLE
case 'u':
otp_allow_unknown = 1;
break;
case 'w':
tmpul = strtoul(optarg, &endptr, 0);
if (*endptr)
xerr_errx(1, "stroul(%s): failed at %c.", optarg, *endptr);
if (tmpul > OTP_WINDOW_MAX)
xerr_errx(1, "Challenge window %lu > %lu.", tmpul, OTP_WINDOW_MAX);
otp_window = tmpul;
break;
#endif /* OOTP_ENABLE */
case 'x':
drop_mode = 1;
break;
case 0:
if (opt_version) {
printf("%s\n", ootp_version);
exit(0);
}
default:
xerr_errx(1, "getopt_long(): fatal.");
} /* switch */
} /* while getopt_long() */
if (daemon_mode) {
xerr_setsyslog2(1); /* use syslog for output */
/* run in the background */
if (daemon(0, 0) < 0)
xerr_err(1, "dameon()");
} /* daemon_mode */
buf_l = snprintf(buf, sizeof(buf), "urd start:");
if (debug) {
for (i = 0; i < argc; ++i)
buf_l += snprintf(buf+buf_l, sizeof(buf)-buf_l, " %s", argv[i]);
}
xerr_info(buf);
/* init to recv UDP datagrams */
loc_addr.sin_family = AF_INET;
loc_addr.sin_addr.s_addr = htonl(local_ip);
loc_addr.sin_port = htons(local_port);
/* construct pid file name */
if (!pid_fname) {
if (local_ip || (local_port != URD_PORT)) {
buf_l = snprintf(buf, sizeof(buf),
"/var/urd/pid.%s.%d", inet_ntoa(loc_addr.sin_addr), (int)local_port);
} else {
buf_l = snprintf(buf, sizeof(buf), "/var/urd/pid");
}
pid_fname = (char*)&buf;
}
/* write out pidfile */
if (write_pidfile(pid_fname) < 0)
xerr_errx(1, "write_pidfile(%s): fatal", buf);
/* load shared server secret */
if (server_secret_load(server_secret_fname, server_secret,
URD_SECRET_LEN+1) < 0)
xerr_errx(1, "server_secret_load(%s): fatal", server_secret_fname);
/* location is password file or pam service name */
if (pdb_type == PASS_DB_TYPE_LOCAL)
loc = pwfile_fname;
else if (pdb_type == PASS_DB_TYPE_PAM)
loc = as_name;
else
xerr_errx(1, "loc fatal, pdb_type=%d", pdb_type);
/* disable authorized users? */
if (disable_authorized_users) {
if (pdb_type == PASS_DB_TYPE_LOCAL)
pdb_type = PASS_DB_TYPE_EX_LOCAL;
else if (pdb_type == PASS_DB_TYPE_PAM)
pdb_type = PASS_DB_TYPE_EX_PAM;
else
xerr_errx(1, "au fatal, pdb_type=%d", pdb_type);
}
/* setup password database */
if (!(pdbctx = pass_db_ctx_new(loc, au_fname, pdb_type)))
xerr_errx(1, "pass_db_ctx_new(%s,%s): fatal", pwfile_fname,
au_fname);
pass_db_debug(pdbctx, debug);
/* load password database */
if (pass_db_load(pdbctx) < 0)
xerr_errx(1, "pass_db_load(): fatal");
if (debug)
pass_db_stats(pdbctx);
/* socket to receive URD datagrams */
if ((pkt_fd = socket(AF_INET, SOCK_DGRAM, 0)) < 0)
xerr_err(1, "socket()");
#ifdef OOTP_ENABLE
/* creat OTP context */
if (otp_enable)
if (!(otpctx = otp_db_open(otpdb_fname, otpdb_flags)))
xerr_errx(1, "otp_db_open(%s): failed", otpdb_fname);
#endif /* OOTP_ENABLE */
/* create radius context */
if (!(urdctx = urd_ctx_new(server_secret)))
xerr_errx(1, "urd_ctx_new(): fatal");
urd_debug(urdctx, debug);
/* bind socket to address */
if (bind(pkt_fd, (struct sockaddr*)&loc_addr, sizeof(loc_addr)) < 0)
xerr_err(1, "bind(%s)", inet_ntoa(loc_addr.sin_addr));
while (1) {
/* grab a datagram */
rem_addr_len = sizeof (urdctx->req.rem_addr);
if ((urdctx->req.pkt_len = recvfrom(pkt_fd, &urdctx->req.pkt_buf,
(size_t)URD_MAX_DGRAM_LEN, 0, (struct sockaddr*)&urdctx->req.rem_addr,
&rem_addr_len)) < 0) {
xerr_warn("recvfrom()");
continue;
}
/*
* Handle two types of authentication requests, those with state, and
* those without. Auth requests with state are used to tie the
* OTP phase of a two phase authentication (reusable password, OTP)
* together into a session.
*
* A request cache is kept with the code and state used for a reply
* This is required for OTP to work robustly in an environment where
* the client may have lost the reply from the server and retransmits
* (OTP will only work once).
*
* Requests with state which can not be tied to the initial
* request without state (ie the reusable password phase) are
* dropped.
*
* The request cache and state cache are unified with a hash
* table for each. Cache entries are stored in a fixed size
* ring buffer.
*
* request with no state:
* req_cache lookup:
* hit :
* rep_code and state_counter from cache
* miss :
* rep_code based on pw_auth and otp requirements:
* access-reject: (no state, failed password auth)
* access-accept: (no state, user does not need OTP)
* access-challenge: (increment state)
* reply:
* reject: don't encode state or rep_msg
* access-challenge: encode state and rep_msg
* access-accept: don't encode state or rep_msg
*
* request with state:
* req_cache lookup:
* hit :
* rep_code and state_counter from cache
* rep_msg from cache
* miss :
* state_cache lookup :
* hit :
* rep_code based on otp_auth:
* access-reject: encode state, no rep_msg
* access-accept: encode state, no rep_msg
* access-challenge: not permitted here
* miss :
* bogus, no previous state from pw_auth phase, reject, log
*
* reply:
* reject: encode state, no rep_msg
* access-accept: encode state, no rep_msg
* access-challenge: not permitted here
*
*/
/* reply constructed from cache? */
req_cache_hit = 0;
/* decode/sanity check request */
if ((r = urd_req_decode(urdctx)) < 0) {
xerr_warnx("urd_req_decode(): failed");
continue;
}
/* non fatal packet decode xerr_error, ignore it */
if (r > 1)
continue;
if (debug)
urd_req_dump(urdctx);
/* RADIUS ACCESS-REQUEST? */
if (urdctx->req.dgram_header.code == RADIUS_CODE_ACCESS_REQUEST) {
if (debug)
xerr_info("req: ACCESS-REQUEST");
/* check for minimum TLV's in packet */
if ((!urdctx->req.tlv_User_Name) ||
(!urdctx->req.tlv_User_Password) ||
((!urdctx->req.tlv_NAS_IP_Address) &&
(!urdctx->req.tlv_NAS_Identifier))) {
xerr_warnx("req: min required fields missing");
continue;
}
req_cache_hit = 0;
rep_code = RADIUS_CODE_ACCESS_REJECT;
rep_state = 0LL;
rep_enc_flags = 0;
rep_cache_flags = 0;
rep_otp_count = 0;
/* initial no state access request */
if (!urdctx->req.tlv_State) {
if (debug)
xerr_info("req: (no state)");
/* first check the cache for a previously composed reply */
if ((r = urd_req_cache_lookup(urdctx, &rep_code, &rep_state,
&rep_otp_count, &tmp_cache_flags)) < 0)
xerr_errx(1, "urd_req_cache_lookup(): fatal");
/* hit, then skip to response gen */
if (r == URD_REQ_CACHE_HIT) {
req_cache_hit = 1;
if ((rep_code == RADIUS_CODE_ACCESS_REJECT) ||
(rep_code == RADIUS_CODE_ACCESS_ACCEPT)) {
rep_enc_flags = 0x0;
} else if (rep_code == RADIUS_CODE_ACCESS_CHALLENGE) {
rep_enc_flags = URD_ENCODE_FLAG_STATE;
if (tmp_cache_flags & URD_CACHE_FLAG_MSG)
rep_enc_flags |= URD_ENCODE_FLAG_MSG;
}
if (debug)
xerr_info("req: cache hit");
goto access_request_rep;
} else {
if (debug)
xerr_info("req: cache miss");
}
/* cache lookup invalid, default to ACCESS_REJECT */
rep_code = RADIUS_CODE_ACCESS_REJECT;
/* authenticate user */
if ((r = pass_db_auth(pdbctx, URDCTX_USER_NAME,
urdctx->req.user_pass)) < 0)
xerr_errx(1, "pass_db_auth(): fatal");
/* valid password? */
if (r != PASS_DB_AUTH_SUCCESS) {
if (debug)
xerr_info("req: fail auth via pass_db_auth() ");
goto access_request_rep;
} else {
if (debug)
xerr_info("req: pass auth via pass_db_auth() ");
}
/* special urd_stats user? */
if (!strcmp(urdctx->req.user_name, "urd_stats")) {
urd_state_cache_stats(urdctx);
urd_req_cache_stats(urdctx);
goto access_request_rep;
}
/* special urd_debug user? */
if (!strcmp(urdctx->req.user_name, "urd_debug")) {
if (debug) {
debug = 0;
urd_debug(urdctx, 0);
} else {
debug = 1;
urd_debug(urdctx, 1);
}
goto access_request_rep;
}
#ifndef OOTP_ENABLE
/*
* without one time passwords compiled in, no additional auth
* checks are required, reply with ACCEPT
*/
rep_code = RADIUS_CODE_ACCESS_ACCEPT;
rep_enc_flags = 0x0;
if (debug)
xerr_info("req: ACCEPT (nothing more to do).");
goto access_request_rep;
#else /* OOTP_ENABLE */
/*
* if one time passwords are disabled then the password
* check above meets auth requirements. Reply with ACCESS_ACCEPT.
*
*/
if (!otp_enable) {
rep_code = RADIUS_CODE_ACCESS_ACCEPT;
rep_enc_flags = 0x0;
if (debug)
xerr_info("req: ACCEPT with OTP disabled.");
goto access_request_rep;
}
/*
* check OTP
*/
if ((r = otp_user_exists(otpctx, URDCTX_USER_NAME)) < 0)
xerr_errx(1, "otp_user_exists(): fail.");
/*
* if user does not exist and not okay to allow non OTP users
* then authentication request fails with default ACCESS_REJECT.
*/
if ((r == 1) && (otp_allow_unknown == 0)) {
if (debug)
xerr_info("req: fail via otp_user_exists() allow_unknown=0");
/* reply with an REJECT */
rep_code = RADIUS_CODE_ACCESS_REJECT;
rep_enc_flags = 0x0;
goto access_request_rep;
}
/*
* if user does not exist in database and okay to allow non OTP
* users then authentication request is successful without OTP.
* password check was done above, reply with ACCEPT
*/
if ((r == 1) && (otp_allow_unknown == 1)) {
if (debug)
xerr_info("req: pass via otp_user_exists() allow_unknown=1");
/* reply with an ACCEPT, no state, no challenge message */
rep_code = RADIUS_CODE_ACCESS_ACCEPT;
rep_enc_flags = 0x0;
goto access_request_rep;
}
/*
* unknown response from otp_user_exists()
*/
if (r != 0) {
if (debug)
xerr_info("otp_user_exists() unknown response r=%d", r);
/* reply with an REJECT */
rep_code = RADIUS_CODE_ACCESS_REJECT;
rep_enc_flags = 0x0;
goto access_request_rep;
}
if (otp_urec_open(otpctx, URDCTX_USER_NAME, &ou,
O_RDONLY, FFDB_OP_LOCK_EX) < 0)
xerr_errx(1, "otp_urec_open(%s): failed.", URDCTX_USER_NAME);
if (otp_urec_get(otpctx, &ou) < 0)
xerr_errx(1, "otp_urec_get(): failed.");
if (otp_urec_close(otpctx, &ou) < 0)
xerr_errx(1, "otp_urec_close(): failed.");
/* disabled user defaults to ACCESS_REJECT */
if (ou.status == OTP_STATUS_DISABLED) {
if (debug)
xerr_info("req: fail via otp_user_get() (disabled)");
goto access_request_rep;
}
/* inactive user does not need OTP */
if (ou.status == OTP_STATUS_INACTIVE) {
/* reply with an ACCEPT, no state, no challenge message */
rep_code = RADIUS_CODE_ACCESS_ACCEPT;
rep_enc_flags = 0x0;
if (debug)
xerr_info("req: pass via otp_user_get() (inactive)");
goto access_request_rep;
}
/* verify count not at ceiling */
if (ou.count >= ou.count_ceil) {
if (debug)
xerr_info("req: fail ou.count >= ou.count_ceil.");
goto access_request_rep;
}
/*
* made it this far then user is in authorized_users database,
* reusable password is valid in password database, and user
* exists in the OTP database in an active state
*/
if (ou.status == OTP_STATUS_ACTIVE) {
/* reply with challenge, challenge message, new state */
rep_code = RADIUS_CODE_ACCESS_CHALLENGE;
rep_enc_flags = URD_ENCODE_FLAG_STATE;
rep_state = ++urdctx->state_counter;
rep_otp_count = ou.count;
rep_cache_flags = URD_CACHE_FLAG_STATE;
if (otp_display_count || ou.flags & OTP_FLAGS_DSPCNT) {
rep_enc_flags |= URD_ENCODE_FLAG_MSG;
rep_cache_flags |= URD_CACHE_FLAG_MSG;
}
if (ou.flags & OTP_FLAGS_SEND_TOKEN) {
if (otp_user_send_token(otpctx, URDCTX_USER_NAME, service) < 0)
xerr_warnx("otp_user_send_token(): failed.");
}
if (debug)
xerr_info("req: pass via otp_user_get() (active)");
goto access_request_rep;
}
#endif /* OOTP_ENABLE */
} else if (urdctx->req.tlv_State) {
#ifndef OOTP_ENABLE
/*
* without one time passwords compiled in, a request with
* state will always return REJECT.
*
*/
/* reply with inbound state */
rep_state = urdctx->req.state_counter;
if (debug)
xerr_info("req: state set, nothing to do, REJECT.");
goto access_request_rep;
#else /* OOTP_ENABLE */
/* request has state, always reply with it */
rep_enc_flags = URD_ENCODE_FLAG_STATE;
if (debug)
xerr_info("req: (state)");
if ((r = urd_req_cache_lookup(urdctx, &rep_code, &rep_state,
&rep_otp_count, &tmp_cache_flags)) < 0)
xerr_errx(1, "urd_req_cache_lookup(): fatal");
/* hit, then skip to response gen */
if (r == URD_REQ_CACHE_HIT) {
req_cache_hit = 1;
if (debug)
xerr_info("req: cache hit");
goto access_request_rep;
} else {
if (debug)
xerr_info("req: cache miss");
}
/* cache lookup invalid, default to ACCESS_REJECT */
rep_code = RADIUS_CODE_ACCESS_REJECT;
/* reply with inbound state */
rep_state = urdctx->req.state_counter;
/*
* state cache lookup -- user must have previously authenticated
* successfully to continue
*/
if ((r = urd_state_cache_lookup(urdctx, &rep_code)) < 0)
xerr_errx(1, "urd_state_cache_lookup(): fatal");
/* if no hit then can not continue */
if (r != URD_REQ_CACHE_HIT) {
if (debug)
xerr_info("state: cache miss (user not validated with passwd)");
/* cache lookup invalid, default to ACCESS_REJECT */
rep_code = RADIUS_CODE_ACCESS_REJECT;
goto access_request_rep;
} else {
if (debug)
xerr_info("state: cache hit");
}
/* double check code */
if (rep_code != RADIUS_CODE_ACCESS_CHALLENGE) {
if (debug)
xerr_warnx("req: fail cache'd state rep_code");
goto access_request_rep;
}
/*
* default to ACCESS_REJECT. State cache lookup will have
* ACCESS_CHALLENGE code as it is shared with the request cache.
*/
rep_code = RADIUS_CODE_ACCESS_REJECT;
if ((r = otp_user_exists(otpctx, URDCTX_USER_NAME)) < 0)
xerr_errx(1, "otp_user_exists(): fail.");
/* user exist?, if not failure */
/* note, initial access request checked this */
if (r != 0) {
if (debug)
xerr_info("req: fail via otp_user_exists()");
goto access_request_rep;
}
if (otp_urec_open(otpctx, URDCTX_USER_NAME, &ou,
O_RDONLY, FFDB_OP_LOCK_EX) < 0)
xerr_errx(1, "otp_urec_open(%s): failed.", URDCTX_USER_NAME);
if (otp_urec_get(otpctx, &ou) < 0)
xerr_errx(1, "otp_urec_get(): failed.");
if (otp_urec_close(otpctx, &ou) < 0)
xerr_errx(1, "otp_urec_close(): failed.");
/* note, initial access request checked this */
if (ou.status != OTP_STATUS_ACTIVE) {
if (debug)
xerr_info("req: fail via otp_user_get() (not ACTIVE)");
goto access_request_rep;
}
/* verify count not at ceiling */
/* note, initial access request checked this */
if (ou.count >= ou.count_ceil) {
if (debug)
xerr_info("req: fail ou.count >= ou.count_ceil.");
goto access_request_rep;
}
if ((r = otp_user_auth(otpctx, URDCTX_USER_NAME,
urdctx->req.user_pass, otp_window)) < 0)
xerr_errx(1, "otp_user_auth(): failed.");
if (r == OTP_AUTH_PASS) {
rep_code = RADIUS_CODE_ACCESS_ACCEPT;
if (debug)
xerr_info("req: pass via otp_user_auth()");
goto access_request_rep;
} else {
if (debug)
xerr_info("req: fail via otp_user_auth()");
}
/* failed authentication... */
#endif /* OOTP_ENABLE */
} else {
xerr_info("unsupported code=%2.2X",
(int)urdctx->req.dgram_header.code);
} /* type of request */
/* reply to request */
access_request_rep:
if (debug) {
if (rep_code == RADIUS_CODE_ACCESS_ACCEPT)
xerr_info("rep: ACCESS-ACCEPT");
else if (rep_code == RADIUS_CODE_ACCESS_REJECT)
xerr_info("rep: ACCESS-REJECT");
else if (rep_code == RADIUS_CODE_ACCESS_CHALLENGE)
xerr_info("rep: ACCESS-CHALLENGE");
} /* debug */
/*
* construct reply
*/
if (urd_rep_encode(urdctx, rep_code, rep_state, rep_otp_count,
rep_enc_flags) < 0) {
xerr_errx(1, "urd_rep_encode(): fatal");
}
/* update reply cache */
if (urd_req_cache_update(urdctx, rep_code, rep_state, rep_otp_count,
rep_cache_flags) < 0)
xerr_errx(1, "urd_req_cache_update(): fatal");
/* debugging / drop every other packet */
if (drop_mode) {
if (drop) {
drop = 0;
continue; /* skip packet send */
} else {
drop = 1;
}
}
if (sendto(pkt_fd, &urdctx->rep.pkt_buf, urdctx->rep.pkt_len, 0,
(struct sockaddr*) &urdctx->rep.rem_addr,
sizeof(urdctx->rep.rem_addr)) < 0) {
xerr_err(1, "sendto()");
}
} /* ACCESS_REQUEST */
} /* forever */
/* not reached */
/* cleanup */
pass_db_ctx_free(pdbctx);
#ifdef OOTP_ENABLE
otp_db_close(otpctx);
#endif /* OOTP_ENABLE */
} /* main */
/*
* function: scan_ip
*
* IP address in string S is converted to a u_long
* (borrowed from tcpdump)
*
* left shift any partial dotted quads, ie 10 is 0x0a000000 not 0x0a
* so scan_ip_prefix() works for standard prefix notation, ie 10/8
*/
u_long scan_ip(char *s)
{
struct hostent *he;
struct in_addr *ina;
u_long addr = 0;
uint n;
int dns, shift;
char *t;
/* if there is anything ascii in here, this may be a hostname */
for (dns = 0, t = s; *t; ++t) {
if (islower((int)*t) || isupper((int)*t)) {
dns = 1;
break;
}
}
if (dns) {
if (!(he = gethostbyname(s)))
goto numeric;
if (he->h_addrtype != AF_INET)
goto numeric;
if (he->h_length != sizeof (uint32_t))
goto numeric;
ina = (struct in_addr*)*he->h_addr_list;
return (ntohl(ina->s_addr));
} /* dns */
shift = 0;
numeric:
while (1) {
/* n is the nibble */
n = 0;
/* nibble's are . bounded */
while (*s && (*s != '.') && (*s != ' ') && (*s != '\t'))
n = n * 10 + *s++ - '0';
/* shift in the nibble */
addr <<=8;
addr |= n & 0xff;
++shift;
/* return on end of string */
if ((!*s) || (*s == ' ') || (*s == '\t'))
goto ndone;
/* skip the . */
++s;
} /* forever */
ndone:
for (; shift < 4; ++shift)
addr <<=8;
return addr;
} /* scan_ip */
/*
* function: server_secret_load()
*
* load a one line secret (password) from fname into buf of length buf_len
* secret is assumed to be ASCII and will be null terminated
*
* returns: < 0 : fail
* 0 : success
*/
int server_secret_load(char *fname, char *buf, int buf_len)
{
struct stat sb;
int fd, len, ret, i;
fd = -1;
ret = -1;
/* open secret file */
if ((fd = open(fname, O_RDONLY, 0)) < 0) {
xerr_warn("open(%s)", fname);
goto server_secret_load_out;
}
/* grab size */
if (fstat(fd, &sb) < 0) {
xerr_warn("stat(%s)", fname);
goto server_secret_load_out;
}
if ((sb.st_size+1) >= buf_len) {
xerr_warn("secret buffer too small");
goto server_secret_load_out;
}
if ((len = read(fd, buf, sb.st_size)) < 0) {
xerr_warn("read(%s)", fname);
goto server_secret_load_out;
}
if (len != sb.st_size) {
xerr_warnx("short read(%s)", fname);
goto server_secret_load_out;
}
/* strip \n */
for (i = 0; i < sb.st_size; ++i)
if (buf[i] == '\n')
buf[i] = 0;
/* ensure null termination */
buf[sb.st_size] = 0;
/* success */
ret = 0;
server_secret_load_out:
if (fd != -1)
close(fd);
return ret;
} /* server_secret_load */
/*
* function: write_pidfile()
*
* Store proces ID in ASII to fname.
*
* returns: < 0 : fail
* 0 : success
*/
int write_pidfile(char *fname)
{
int fd, buf_l;
char buf[512];
buf_l = snprintf(buf, sizeof(buf), "%lu\n", (unsigned long)getpid());
if ((fd = open(fname, O_WRONLY|O_CREAT|O_TRUNC, 0644)) < 0 ) {
xerr_warn("open(%s)", fname);
return -1;
}
if (write(fd, buf, buf_l) < 0) {
xerr_warn("write(%s)", fname);
close (fd);
return -1;
}
return (close(fd));
} /* write_pidfile */
/*
* function: usage()
*
*/
void usage(void)
{
#ifdef OOTP_ENABLE
fprintf(stderr,
"urd [-AhcdDmMnOux?] [-a allowed_users_file] [-b local_ip] [-B local_port ]\n");
fprintf(stderr,
" [-o otp_db] [-p passwd_file] [-P pid_file] [-s secret_file]\n");
#else
fprintf(stderr,
"urd [-AdDmMnhx?] [-a allowed_users_file] [-b local_ip] [-B local_port ]\n");
fprintf(stderr,
" [-p passwd_file] [-P pid_file] [-s secret_file]\n");
#endif /* OOTP_ENABLE */
fprintf(stderr, " [-S auth_service_name] [-w otp_window]\n\n");
fprintf(stderr, " -A disable authorized_users file (all users in passwd_file valid)\n");
fprintf(stderr, " -h help\n");
fprintf(stderr, " -d enable debugging\n");
fprintf(stderr, " -D disable daemon mode\n");
fprintf(stderr, " -m use PAM for password authentication\n");
fprintf(stderr, " -M use PAM exclusively for password authentication\n");
#ifdef OOTP_ENABLE
fprintf(stderr, " -O disable one time passwords\n");
fprintf(stderr, " -u allow users which do not exist in OTP database\n");
#endif /* OOTP_ENABLE */
fprintf(stderr, " -x drop alternate replies (debugging)\n");
} /* help */
Reference in a new issue View git blame Copy permalink