1 /* $OpenBSD: login_radius.c,v 1.5 2003/07/29 18:39:23 deraadt Exp $ */
2
3 /*-
4 * Copyright (c) 1996, 1997 Berkeley Software Design, Inc. All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. All advertising materials mentioning features or use of this software
15 * must display the following acknowledgement:
16 * This product includes software developed by Berkeley Software Design,
17 * Inc.
18 * 4. The name of Berkeley Software Design, Inc. may not be used to endorse
19 * or promote products derived from this software without specific prior
20 * written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY BERKELEY SOFTWARE DESIGN, INC. ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL BERKELEY SOFTWARE DESIGN, INC. BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * SUCH DAMAGE.
33 *
34 * BSDI $From: login_radius.c,v 1.4 1998/04/14 00:39:02 prb Exp $
35 */
36 /*
37 * Copyright(c) 1996 by tfm associates.
38 * All rights reserved.
39 *
40 * tfm associates
41 * P.O. Box 2086
42 * Eugene OR 97402-0031
43 *
44 * Redistribution and use in source and binary forms, with or without
45 * modification, are permitted provided that the following conditions
46 * are met:
47 * 1. Redistributions of source code must retain the above copyright
48 * notice, this list of conditions and the following disclaimer.
49 * 2. Redistributions in binary form must reproduce the above copyright
50 * notice, this list of conditions and the following disclaimer in the
51 * documentation and/or other materials provided with the distribution.
52 * 3. The name of tfm associates may not be used to endorse or promote
53 * products derived from this software without specific prior written
54 * permission.
55 *
56 * THIS SOFTWARE IS PROVIDED BY TFM ASSOC``AS IS'' AND ANY EXPRESS OR
57 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
58 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
59 * IN NO EVENT SHALL TFM ASSOCIATES BE LIABLE FOR ANY DIRECT, INDIRECT,
60 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
61 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
62 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
63 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
64 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
65 * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
66 */
67
68 #include <sys/types.h>
69 #include <netinet/in.h>
70
71 #include <ctype.h>
72 #include <err.h>
73 #include <login_cap.h>
74 #include <pwd.h>
75 #include <stdio.h>
76 #include <stdlib.h>
77 #include <string.h>
78 #include <syslog.h>
79 #include <unistd.h>
80 #include <bsd_auth.h>
81 #include "login_radius.h"
82
83 static int cleanstring(char *);
84
85 int
main(int argc,char ** argv)86 main(int argc, char **argv)
87 {
88 FILE *back;
89 char challenge[1024];
90 char *class, *service, *style, *username, *password, *emsg;
91 int c, n;
92 extern char *__progname;
93
94 back = NULL;
95 password = class = service = NULL;
96
97 /*
98 * Usage: login_xxx [-s service] [-v var] user [class]
99 */
100 while ((c = getopt(argc, argv, "ds:v:")) != -1)
101 switch (c) {
102 case 'd':
103 back = stdout;
104 break;
105 case 'v':
106 break;
107 case 's': /* service */
108 service = optarg;
109 if (strcmp(service, "login") != 0 &&
110 strcmp(service, "challenge") != 0 &&
111 strcmp(service, "response") != 0)
112 errx(1, "%s not supported", service);
113 break;
114 default:
115 syslog(LOG_ERR, "usage error");
116 exit(1);
117 }
118
119 if (service == NULL)
120 service = LOGIN_DEFSERVICE;
121
122 switch (argc - optind) {
123 case 2:
124 class = argv[optind + 1];
125 case 1:
126 username = argv[optind];
127 break;
128 default:
129 syslog(LOG_ERR, "usage error");
130 exit(1);
131 }
132
133 if ((style = strrchr(__progname, '/')))
134 ++style;
135 else
136 style = __progname;
137
138 if (strncmp(style, "login_", 6) == 0)
139 style += 6;
140
141 if (!cleanstring(style))
142 errx(1, "style contains non-printables");
143 if (!cleanstring(username))
144 errx(1, "username contains non-printables");
145 if (service && !cleanstring(service))
146 errx(1, "service contains non-printables");
147 if (class && !cleanstring(class))
148 errx(1, "class contains non-printables");
149
150 /*
151 * Filedes 3 is the back channel, where we send back results.
152 */
153 if (back == NULL && (back = fdopen(3, "a")) == NULL) {
154 syslog(LOG_ERR, "reopening back channel");
155 exit(1);
156 }
157
158 memset(challenge, 0, sizeof(challenge));
159
160 if (strcmp(service, "response") == 0) {
161 c = -1;
162 n = 0;
163 while (++c < sizeof(challenge) &&
164 read(3, &challenge[c], 1) == 1) {
165 if (challenge[c] == '\0' && ++n == 2)
166 break;
167 if (challenge[c] == '\0' && n == 1)
168 password = challenge + c + 1;
169 }
170 if (n < 2) {
171 syslog(LOG_ERR, "protocol error on back channel");
172 exit(1);
173 }
174 }
175
176 emsg = NULL;
177
178 c = raddauth(username, class, style,
179 strcmp(service, "login") ? challenge : NULL, password, &emsg);
180
181 if (c == 0) {
182 if (challenge == NULL || *challenge == '\0')
183 (void)fprintf(back, BI_AUTH "\n");
184 else {
185 (void)fprintf(back, BI_VALUE " challenge %s\n",
186 auth_mkvalue(challenge));
187 (void)fprintf(back, BI_CHALLENGE "\n");
188 }
189 exit(0);
190 }
191 if (emsg && strcmp(service, "login") == 0)
192 (void)fprintf(stderr, "%s\n", emsg);
193 else if (emsg)
194 (void)fprintf(back, "value errormsg %s\n", auth_mkvalue(emsg));
195 if (strcmp(service, "challenge") == 0) {
196 (void)fprintf(back, BI_SILENT "\n");
197 exit(0);
198 }
199 (void)fprintf(back, BI_REJECT "\n");
200 exit(1);
201 }
202
203 static int
cleanstring(char * s)204 cleanstring(char *s)
205 {
206
207 while (*s && isgraph(*s) && *s != '\\')
208 ++s;
209 return(*s == '\0' ? 1 : 0);
210 }
211