pam_radius.c revision 117841 
1/*-
2 * Copyright 1998 Juniper Networks, Inc.
3 * All rights reserved.
4 * Copyright (c) 2001-2003 Networks Associates Technology, Inc.
5 * All rights reserved.
6 *
7 * Portions of this software were developed for the FreeBSD Project by
8 * ThinkSec AS and NAI Labs, the Security Research Division of Network
9 * Associates, Inc.  under DARPA/SPAWAR contract N66001-01-C-8035
10 * ("CBOSS"), as part of the DARPA CHATS research program.
11 *
12 * Redistribution and use in source and binary forms, with or without
13 * modification, are permitted provided that the following conditions
14 * are met:
15 * 1. Redistributions of source code must retain the above copyright
16 *    notice, this list of conditions and the following disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright
18 *    notice, this list of conditions and the following disclaimer in the
19 *    documentation and/or other materials provided with the distribution.
20 * 3. The name of the author may not be used to endorse or promote
21 *    products derived from this software without specific prior written
22 *    permission.
23 *
24 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 * SUCH DAMAGE.
35 */
36
37#include <sys/cdefs.h>
38__FBSDID("$FreeBSD: head/lib/libpam/modules/pam_radius/pam_radius.c 117841 2003-07-21 19:56:28Z des $");
39
40#include <sys/param.h>
41#include <pwd.h>
42#include <radlib.h>
43#include <stdlib.h>
44#include <string.h>
45#include <syslog.h>
46#include <unistd.h>
47
48#define PAM_SM_AUTH
49
50#include <security/pam_appl.h>
51#include <security/pam_modules.h>
52#include <security/pam_mod_misc.h>
53
54#define PAM_OPT_CONF		"conf"
55#define PAM_OPT_TEMPLATE_USER	"template_user"
56#define PAM_OPT_NAS_ID		"nas_id"
57
58#define	MAX_CHALLENGE_MSGS	10
59#define	PASSWORD_PROMPT		"RADIUS Password:"
60
61static int	 build_access_request(struct rad_handle *, const char *,
62		    const char *, const char *, const void *, size_t);
63static int	 do_accept(pam_handle_t *, struct rad_handle *);
64static int	 do_challenge(pam_handle_t *, struct rad_handle *,
65		    const char *);
66
67/*
68 * Construct an access request, but don't send it.  Returns 0 on success,
69 * -1 on failure.
70 */
71static int
72build_access_request(struct rad_handle *radh, const char *user,
73    const char *pass, const char *nas_id, const void *state, size_t state_len)
74{
75	char	 host[MAXHOSTNAMELEN];
76
77	if (rad_create_request(radh, RAD_ACCESS_REQUEST) == -1) {
78		syslog(LOG_CRIT, "rad_create_request: %s", rad_strerror(radh));
79		return (-1);
80	}
81	if (nas_id == NULL && gethostname(host, sizeof host) != -1)
82		nas_id = host;
83	if ((user != NULL &&
84	    rad_put_string(radh, RAD_USER_NAME, user) == -1) ||
85	    (pass != NULL &&
86	    rad_put_string(radh, RAD_USER_PASSWORD, pass) == -1) ||
87	    (nas_id != NULL &&
88	    rad_put_string(radh, RAD_NAS_IDENTIFIER, nas_id) == -1)) {
89		syslog(LOG_CRIT, "rad_put_string: %s", rad_strerror(radh));
90		return (-1);
91	}
92	if (state != NULL && rad_put_attr(radh, RAD_STATE, state,
93	    state_len) == -1) {
94		syslog(LOG_CRIT, "rad_put_attr: %s", rad_strerror(radh));
95		return (-1);
96	}
97	if (rad_put_int(radh, RAD_SERVICE_TYPE, RAD_AUTHENTICATE_ONLY) == -1) {
98		syslog(LOG_CRIT, "rad_put_int: %s", rad_strerror(radh));
99		return (-1);
100	}
101	return (0);
102}
103
104static int
105do_accept(pam_handle_t *pamh, struct rad_handle *radh)
106{
107	int attrtype;
108	const void *attrval;
109	size_t attrlen;
110	char *s;
111
112	while ((attrtype = rad_get_attr(radh, &attrval, &attrlen)) > 0) {
113		if (attrtype == RAD_USER_NAME) {
114			s = rad_cvt_string(attrval, attrlen);
115			if (s == NULL) {
116				syslog(LOG_CRIT,
117				    "rad_cvt_string: out of memory");
118				return (-1);
119			}
120			pam_set_item(pamh, PAM_USER, s);
121			free(s);
122		}
123	}
124	if (attrtype == -1) {
125		syslog(LOG_CRIT, "rad_get_attr: %s", rad_strerror(radh));
126		return (-1);
127	}
128	return (0);
129}
130
131static int
132do_challenge(pam_handle_t *pamh, struct rad_handle *radh, const char *user)
133{
134	int retval;
135	int attrtype;
136	const void *attrval;
137	size_t attrlen;
138	const void *state;
139	size_t statelen;
140	struct pam_message msgs[MAX_CHALLENGE_MSGS];
141	const struct pam_message *msg_ptrs[MAX_CHALLENGE_MSGS];
142	struct pam_response *resp;
143	int num_msgs;
144	const void *item;
145	const struct pam_conv *conv;
146
147	state = NULL;
148	statelen = 0;
149	num_msgs = 0;
150	while ((attrtype = rad_get_attr(radh, &attrval, &attrlen)) > 0) {
151		switch (attrtype) {
152
153		case RAD_STATE:
154			state = attrval;
155			statelen = attrlen;
156			break;
157
158		case RAD_REPLY_MESSAGE:
159			if (num_msgs >= MAX_CHALLENGE_MSGS) {
160				syslog(LOG_CRIT,
161				    "Too many RADIUS challenge messages");
162				return (PAM_SERVICE_ERR);
163			}
164			msgs[num_msgs].msg = rad_cvt_string(attrval, attrlen);
165			if (msgs[num_msgs].msg == NULL) {
166				syslog(LOG_CRIT,
167				    "rad_cvt_string: out of memory");
168				return (PAM_SERVICE_ERR);
169			}
170			msgs[num_msgs].msg_style = PAM_TEXT_INFO;
171			msg_ptrs[num_msgs] = &msgs[num_msgs];
172			num_msgs++;
173			break;
174		}
175	}
176	if (attrtype == -1) {
177		syslog(LOG_CRIT, "rad_get_attr: %s", rad_strerror(radh));
178		return (PAM_SERVICE_ERR);
179	}
180	if (num_msgs == 0) {
181		msgs[num_msgs].msg = strdup("(null RADIUS challenge): ");
182		if (msgs[num_msgs].msg == NULL) {
183			syslog(LOG_CRIT, "Out of memory");
184			return (PAM_SERVICE_ERR);
185		}
186		msgs[num_msgs].msg_style = PAM_TEXT_INFO;
187		msg_ptrs[num_msgs] = &msgs[num_msgs];
188		num_msgs++;
189	}
190	msgs[num_msgs-1].msg_style = PAM_PROMPT_ECHO_ON;
191	if ((retval = pam_get_item(pamh, PAM_CONV, &item)) != PAM_SUCCESS) {
192		syslog(LOG_CRIT, "do_challenge: cannot get PAM_CONV");
193		return (retval);
194	}
195	conv = (const struct pam_conv *)item;
196	if ((retval = conv->conv(num_msgs, msg_ptrs, &resp,
197	    conv->appdata_ptr)) != PAM_SUCCESS)
198		return (retval);
199	if (build_access_request(radh, user, resp[num_msgs-1].resp, NULL,
200	    state, statelen) == -1)
201		return (PAM_SERVICE_ERR);
202	memset(resp[num_msgs-1].resp, 0, strlen(resp[num_msgs-1].resp));
203	free(resp[num_msgs-1].resp);
204	free(resp);
205	while (num_msgs > 0)
206		free(msgs[--num_msgs].msg);
207	return (PAM_SUCCESS);
208}
209
210PAM_EXTERN int
211pam_sm_authenticate(pam_handle_t *pamh, int flags __unused,
212    int argc __unused, const char *argv[] __unused)
213{
214	struct rad_handle *radh;
215	const char *user, *tmpuser, *pass;
216	const char *conf_file, *template_user, *nas_id;
217	int retval;
218	int e;
219
220	conf_file = openpam_get_option(pamh, PAM_OPT_CONF);
221	template_user = openpam_get_option(pamh, PAM_OPT_TEMPLATE_USER);
222	nas_id = openpam_get_option(pamh, PAM_OPT_NAS_ID);
223
224	retval = pam_get_user(pamh, &user, NULL);
225	if (retval != PAM_SUCCESS)
226		return (retval);
227
228	PAM_LOG("Got user: %s", user);
229
230	retval = pam_get_authtok(pamh, PAM_AUTHTOK, &pass, PASSWORD_PROMPT);
231	if (retval != PAM_SUCCESS)
232		return (retval);
233
234	PAM_LOG("Got password");
235
236	radh = rad_open();
237	if (radh == NULL) {
238		syslog(LOG_CRIT, "rad_open failed");
239		return (PAM_SERVICE_ERR);
240	}
241
242	PAM_LOG("Radius opened");
243
244	if (rad_config(radh, conf_file) == -1) {
245		syslog(LOG_ALERT, "rad_config: %s", rad_strerror(radh));
246		rad_close(radh);
247		return (PAM_SERVICE_ERR);
248	}
249
250	PAM_LOG("Radius config file read");
251
252	if (build_access_request(radh, user, pass, nas_id, NULL, 0) == -1) {
253		rad_close(radh);
254		return (PAM_SERVICE_ERR);
255	}
256
257	PAM_LOG("Radius build access done");
258
259	for (;;) {
260		switch (rad_send_request(radh)) {
261
262		case RAD_ACCESS_ACCEPT:
263			e = do_accept(pamh, radh);
264			rad_close(radh);
265			if (e == -1)
266				return (PAM_SERVICE_ERR);
267			if (template_user != NULL) {
268
269				PAM_LOG("Trying template user: %s",
270				    template_user);
271
272				/*
273				 * If the given user name doesn't exist in
274				 * the local password database, change it
275				 * to the value given in the "template_user"
276				 * option.
277				 */
278				retval = pam_get_item(pamh, PAM_USER,
279				    (const void **)&tmpuser);
280				if (retval != PAM_SUCCESS)
281					return (retval);
282				if (getpwnam(tmpuser) == NULL) {
283					pam_set_item(pamh, PAM_USER,
284					    template_user);
285					PAM_LOG("Using template user");
286				}
287
288			}
289			return (PAM_SUCCESS);
290
291		case RAD_ACCESS_REJECT:
292			rad_close(radh);
293			PAM_VERBOSE_ERROR("Radius rejection");
294			return (PAM_AUTH_ERR);
295
296		case RAD_ACCESS_CHALLENGE:
297			retval = do_challenge(pamh, radh, user);
298			if (retval != PAM_SUCCESS) {
299				rad_close(radh);
300				return (retval);
301			}
302			break;
303
304		case -1:
305			syslog(LOG_CRIT, "rad_send_request: %s",
306			    rad_strerror(radh));
307			rad_close(radh);
308			PAM_VERBOSE_ERROR("Radius failure");
309			return (PAM_AUTHINFO_UNAVAIL);
310
311		default:
312			syslog(LOG_CRIT,
313			    "rad_send_request: unexpected return value");
314			rad_close(radh);
315			PAM_VERBOSE_ERROR("Radius error");
316			return (PAM_SERVICE_ERR);
317		}
318	}
319}
320
321PAM_EXTERN int
322pam_sm_setcred(pam_handle_t *pamh __unused, int flags __unused,
323    int argc __unused, const char *argv[] __unused)
324{
325
326	return (PAM_SUCCESS);
327}
328
329PAM_MODULE_ENTRY("pam_radius");
330