// Get the type of authentication used by the user UINT SamGetUserAuthType(HUB *h, char *username) { UINT authtype; // Validate arguments if (h == NULL || username == NULL) { return INFINITE; } AcLock(h); { USER *u = AcGetUser(h, username); if (u == NULL) { authtype = INFINITE; } else { authtype = u->AuthType; ReleaseUser(u); } } AcUnlock(h); return authtype; }
// Anonymous authentication of user bool SamAuthUserByAnonymous(HUB *h, char *username) { bool b = false; // Validate arguments if (h == NULL || username == NULL) { return false; } AcLock(h); { USER *u = AcGetUser(h, username); if (u) { Lock(u->lock); { if (u->AuthType == AUTHTYPE_ANONYMOUS) { b = true; } } Unlock(u->lock); } ReleaseUser(u); } AcUnlock(h); return b; }
// Get the policy to be applied for the user POLICY *SamGetUserPolicy(HUB *h, char *username) { POLICY *ret = NULL; // Validate arguments if (h == NULL || username == NULL) { return NULL; } AcLock(h); { USER *u; u = AcGetUser(h, username); if (u) { USERGROUP *g = NULL; Lock(u->lock); { if (u->Policy != NULL) { ret = ClonePolicy(u->Policy); } g = u->Group; if (g != NULL) { AddRef(g->ref); } } Unlock(u->lock); ReleaseUser(u); u = NULL; if (ret == NULL) { if (g != NULL) { Lock(g->lock); { ret = ClonePolicy(g->Policy); } Unlock(g->lock); } } if (g != NULL) { ReleaseGroup(g); } } } AcUnlock(h); return ret; }
// Delete the user bool AcDeleteUser(HUB *h, char *name) { USER *u; // Validate arguments if (h == NULL || name == NULL) { return false; } u = AcGetUser(h, name); if (u == NULL) { return false; } if (Delete(h->HubDb->UserList, u)) { ReleaseUser(u); } ReleaseUser(u); return true; }
// Validate user name bool AcIsUser(HUB *h, char *name) { USER *u; // Validate arguments if (h == NULL || name == NULL || NO_ACCOUNT_DB(h)) { return false; } u = AcGetUser(h, name); if (u == NULL) { return false; } ReleaseUser(u); return true; }
// Password authentication of user bool SamAuthUserByPassword(HUB *h, char *username, void *random, void *secure_password, char *mschap_v2_password, UCHAR *mschap_v2_server_response_20, UINT *err) { bool b = false; UCHAR secure_password_check[SHA1_SIZE]; bool is_mschap = false; IPC_MSCHAP_V2_AUTHINFO mschap; UINT dummy = 0; // Validate arguments if (h == NULL || username == NULL || secure_password == NULL) { return false; } if (err == NULL) { err = &dummy; } *err = 0; Zero(&mschap, sizeof(mschap)); is_mschap = ParseAndExtractMsChapV2InfoFromPassword(&mschap, mschap_v2_password); if (StrCmpi(username, ADMINISTRATOR_USERNAME) == 0) { // Administrator mode SecurePassword(secure_password_check, h->SecurePassword, random); if (Cmp(secure_password_check, secure_password, SHA1_SIZE) == 0) { return true; } else { return false; } } AcLock(h); { USER *u; u = AcGetUser(h, username); if (u) { Lock(u->lock); { if (u->AuthType == AUTHTYPE_PASSWORD) { AUTHPASSWORD *auth = (AUTHPASSWORD *)u->AuthData; if (is_mschap == false) { // Normal password authentication SecurePassword(secure_password_check, auth->HashedKey, random); if (Cmp(secure_password_check, secure_password, SHA1_SIZE) == 0) { b = true; } } else { // MS-CHAP v2 authentication via PPP UCHAR challenge8[8]; UCHAR client_response[24]; if (IsZero(auth->NtLmSecureHash, MD5_SIZE)) { // NTLM hash is not registered in the user account *err = ERR_MSCHAP2_PASSWORD_NEED_RESET; } else { UCHAR nt_pw_hash_hash[16]; Zero(challenge8, sizeof(challenge8)); Zero(client_response, sizeof(client_response)); MsChapV2_GenerateChallenge8(challenge8, mschap.MsChapV2_ClientChallenge, mschap.MsChapV2_ServerChallenge, mschap.MsChapV2_PPPUsername); MsChapV2Client_GenerateResponse(client_response, challenge8, auth->NtLmSecureHash); if (Cmp(client_response, mschap.MsChapV2_ClientResponse, 24) == 0) { // Hash matched b = true; // Calculate the response GenerateNtPasswordHashHash(nt_pw_hash_hash, auth->NtLmSecureHash); MsChapV2Server_GenerateResponse(mschap_v2_server_response_20, nt_pw_hash_hash, client_response, challenge8); } } } } } Unlock(u->lock); ReleaseUser(u); } } AcUnlock(h); return b; }
// Certificate authentication of user bool SamAuthUserByCert(HUB *h, char *username, X *x) { bool b = false; // Validate arguments if (h == NULL || username == NULL || x == NULL) { return false; } if (GetGlobalServerFlag(GSF_DISABLE_CERT_AUTH) != 0) { return false; } // Check expiration date if (CheckXDateNow(x) == false) { return false; } // Check the Certification Revocation List if (IsValidCertInHub(h, x) == false) { // Bad wchar_t tmp[MAX_SIZE * 2]; // Log the contents of the certificate GetAllNameFromX(tmp, sizeof(tmp), x); HLog(h, "LH_AUTH_NG_CERT", username, tmp); return false; } AcLock(h); { USER *u; u = AcGetUser(h, username); if (u) { Lock(u->lock); { if (u->AuthType == AUTHTYPE_USERCERT) { // Check whether to matche with the registered certificate AUTHUSERCERT *auth = (AUTHUSERCERT *)u->AuthData; if (CompareX(auth->UserX, x)) { b = true; } } else if (u->AuthType == AUTHTYPE_ROOTCERT) { // Check whether the certificate has been signed by the root certificate AUTHROOTCERT *auth = (AUTHROOTCERT *)u->AuthData; if (h->HubDb != NULL) { LockList(h->HubDb->RootCertList); { X *root_cert; root_cert = GetIssuerFromList(h->HubDb->RootCertList, x); if (root_cert != NULL) { b = true; if (auth->CommonName != NULL && UniIsEmptyStr(auth->CommonName) == false) { // Compare the CN if (UniStrCmpi(x->subject_name->CommonName, auth->CommonName) != 0) { b = false; } } if (auth->Serial != NULL && auth->Serial->size >= 1) { // Compare the serial number if (CompareXSerial(x->serial, auth->Serial) == false) { b = false; } } } } UnlockList(h->HubDb->RootCertList); } } } Unlock(u->lock); ReleaseUser(u); } } AcUnlock(h); if (b) { wchar_t tmp[MAX_SIZE * 2]; // Log the contents of the certificate GetAllNameFromX(tmp, sizeof(tmp), x); HLog(h, "LH_AUTH_OK_CERT", username, tmp); } return b; }
// Plaintext password authentication of user bool SamAuthUserByPlainPassword(CONNECTION *c, HUB *hub, char *username, char *password, bool ast, UCHAR *mschap_v2_server_response_20, RADIUS_LOGIN_OPTION *opt) { bool b = false; wchar_t *name = NULL; bool auth_by_nt = false; HUB *h; // Validate arguments if (hub == NULL || c == NULL || username == NULL) { return false; } if (GetGlobalServerFlag(GSF_DISABLE_RADIUS_AUTH) != 0) { return false; } h = hub; AddRef(h->ref); // Get the user name on authentication system AcLock(hub); { USER *u; u = AcGetUser(hub, ast == false ? username : "******"); if (u) { Lock(u->lock); { if (u->AuthType == AUTHTYPE_RADIUS) { // Radius authentication AUTHRADIUS *auth = (AUTHRADIUS *)u->AuthData; if (ast || auth->RadiusUsername == NULL || UniStrLen(auth->RadiusUsername) == 0) { name = CopyStrToUni(username); } else { name = CopyUniStr(auth->RadiusUsername); } auth_by_nt = false; } else if (u->AuthType == AUTHTYPE_NT) { // NT authentication AUTHNT *auth = (AUTHNT *)u->AuthData; if (ast || auth->NtUsername == NULL || UniStrLen(auth->NtUsername) == 0) { name = CopyStrToUni(username); } else { name = CopyUniStr(auth->NtUsername); } auth_by_nt = true; } } Unlock(u->lock); ReleaseUser(u); } } AcUnlock(hub); if (name != NULL) { if (auth_by_nt == false) { // Radius authentication char radius_server_addr[MAX_SIZE]; UINT radius_server_port; char radius_secret[MAX_SIZE]; char suffix_filter[MAX_SIZE]; wchar_t suffix_filter_w[MAX_SIZE]; UINT interval; Zero(suffix_filter, sizeof(suffix_filter)); Zero(suffix_filter_w, sizeof(suffix_filter_w)); // Get the Radius server information if (GetRadiusServerEx2(hub, radius_server_addr, sizeof(radius_server_addr), &radius_server_port, radius_secret, sizeof(radius_secret), &interval, suffix_filter, sizeof(suffix_filter))) { Unlock(hub->lock); StrToUni(suffix_filter_w, sizeof(suffix_filter_w), suffix_filter); if (UniIsEmptyStr(suffix_filter_w) || UniEndWith(name, suffix_filter_w)) { // Attempt to login b = RadiusLogin(c, radius_server_addr, radius_server_port, radius_secret, StrLen(radius_secret), name, password, interval, mschap_v2_server_response_20, opt); } Lock(hub->lock); } else { HLog(hub, "LH_NO_RADIUS_SETTING", name); } } else { // NT authentication (Not available for non-Win32) #ifdef OS_WIN32 IPC_MSCHAP_V2_AUTHINFO mschap; Unlock(hub->lock); if (ParseAndExtractMsChapV2InfoFromPassword(&mschap, password) == false) { // Plaintext password authentication b = MsCheckLogon(name, password); } else { UCHAR challenge8[8]; UCHAR nt_pw_hash_hash[16]; char nt_name[MAX_SIZE]; UniToStr(nt_name, sizeof(nt_name), name); // MS-CHAPv2 authentication MsChapV2_GenerateChallenge8(challenge8, mschap.MsChapV2_ClientChallenge, mschap.MsChapV2_ServerChallenge, mschap.MsChapV2_PPPUsername); Debug("MsChapV2_PPPUsername = %s, nt_name = %s\n", mschap.MsChapV2_PPPUsername, nt_name); b = MsPerformMsChapV2AuthByLsa(nt_name, challenge8, mschap.MsChapV2_ClientResponse, nt_pw_hash_hash); if (b) { if (mschap_v2_server_response_20 != NULL) { MsChapV2Server_GenerateResponse(mschap_v2_server_response_20, nt_pw_hash_hash, mschap.MsChapV2_ClientResponse, challenge8); } } } Lock(hub->lock); #else // OS_WIN32 // Nothing to do other than Win32 #endif // OS_WIN32 } // Memory release Free(name); } ReleaseHub(h); return b; }