Tacacs.h

// This is part of tacppd project (extended tacacs++ daemon)
// (c) Copyright in 2000-2004 by tacppd team and contributors
// see http://tacppd.org for more information
//
// file: Tacacs.h
// description: tacacs+ low-level api

//  This program is free software; you can redistribute it and/or modify
//  it under the terms of the GNU General Public License as published by
//  the Free Software Foundation; either version 2 of the License, or
//  (at your option) any later version.
//
//  This program is distributed in the hope that it will be useful,
//  but WITHOUT ANY WARRANTY; without even the implied warranty of
//  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
//  GNU General Public License for more details.
//
//  You should have received a copy of the GNU General Public License
//  along with this program; if not, write to the Free Software
//  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

/*
This software have parts of code from Cisco's tac_plus daemon
with next copyright notice:

  Copyright (c) 1995-2000 by Cisco systems, Inc.

  Permission to use, copy, modify, and distribute modified and
  unmodified copies of this software for any purpose and without fee is
  hereby granted, provided that (a) this copyright and permission notice
  appear on all copies of the software and supporting documentation, (b)
  the name of Cisco Systems, Inc. not be used in advertising or
  publicity pertaining to distribution of the program without specific
  prior permission, and (c) notice be given in supporting documentation
  that use, modification, copying and distribution is by permission of
  Cisco Systems, Inc.

  Cisco Systems, Inc. makes no representations about the suitability
  of this software for any purpose.  THIS SOFTWARE IS PROVIDED ``AS
  IS'' AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING,
  WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
  FITNESS FOR A PARTICULAR PURPOSE.
*/

// modifications:
//

// all comments which start from /**<CR> this is comment for KDoc */
//  for classes
//    @short [short description of the class]
//    @author [class author]
//    @version [class version]
//    @see [references to other classes or methods]
//  for methods
//    @see [references]
//    @return [sentence describing the return value]
//    @exception [list the exeptions that could be thrown]
//    @param [name id] [description]    - can be multiple

#ifndef __TACACS_H__
#define __TACACS_H__

#include "global.h"

namespace tacpp {


#define TAC_PLUS_MAX_PACKET   512 //256   // we do not handle bigger packets

#define ECHO              0     // echo enable (?)
#define NOECHO            1     // echo disable (?)

#define MSCHAP_DIGEST_LEN     49        // digest length

#define TAC_PLUS_READ_TIMEOUT     256     // seconds
#define TAC_PLUS_WRITE_TIMEOUT    20      // seconds

#define NAS_PORT_MAX_LEN          255     // port name length

// types of authentication
#define TACACS_ENABLE_REQUEST   1     // Enable Requests
#define TACACS_ASCII_LOGIN      2     // Inbound ASCII Login
#define TACACS_PAP_LOGIN        3     // Inbound PAP Login
#define TACACS_CHAP_LOGIN       4     // Inbound CHAP login
#define TACACS_ARAP_LOGIN       5     // Inbound ARAP login
#define TACACS_PAP_OUT          6     // Outbound PAP request
#define TACACS_CHAP_OUT         7     // Outbound CHAP request
#define TACACS_ASCII_ARAP_OUT   8     // Outbound ASCII and ARAP request
#define TACACS_ASCII_CHPASS     9     // ASCII change password request
#define TACACS_PPP_CHPASS       10    // PPP change password request
#define TACACS_ARAP_CHPASS      11    // ARAP change password request
#define TACACS_MSCHAP_LOGIN     12    // MS-CHAP inbound login
#define TACACS_MSCHAP_OUT       13    // MS-CHAP outbound login
#define TACACS_CHAP_PASSWORD    14    // request for CHAP cleartext passwd
#define TACACS_PAP_PASSWORD     15    // request for PAP password

// services
#define TAC_PLUS_AUTHEN_LOGIN       1
#define TAC_PLUS_AUTHEN_CHPASS      2
#define TAC_PLUS_AUTHEN_SENDPASS    3   // deprecated (no support here)
#define TAC_PLUS_AUTHEN_SENDAUTH    4

// status of reply packet, that client get from server in authen
#define TAC_PLUS_AUTHEN_STATUS_PASS       1
#define TAC_PLUS_AUTHEN_STATUS_FAIL       2
#define TAC_PLUS_AUTHEN_STATUS_GETDATA    3
#define TAC_PLUS_AUTHEN_STATUS_GETUSER    4
#define TAC_PLUS_AUTHEN_STATUS_GETPASS    5
#define TAC_PLUS_AUTHEN_STATUS_RESTART    6
#define TAC_PLUS_AUTHEN_STATUS_ERROR      7
#define TAC_PLUS_AUTHEN_STATUS_FOLLOW     0x21

// methods of authorization
#define TAC_PLUS_AUTHEN_METH_NOT_SET      0     // 0x00
#define TAC_PLUS_AUTHEN_METH_NONE         1     // 0x01
#define TAC_PLUS_AUTHEN_METH_KRB5         2     // 0x03
#define TAC_PLUS_AUTHEN_METH_LINE         3     // 0x03
#define TAC_PLUS_AUTHEN_METH_ENABLE       4     // 0x04
#define TAC_PLUS_AUTHEN_METH_LOCAL        5     // 0x05
#define TAC_PLUS_AUTHEN_METH_TACACSPLUS   6     // 0x06   use this?
#define TAC_PLUS_AUTHEN_METH_GUEST        8     // 0x08
#define TAC_PLUS_AUTHEN_METH_RADIUS       16    // 0x10
#define TAC_PLUS_AUTHEN_METH_KRB4         17    // 0x11
#define TAC_PLUS_AUTHEN_METH_RCMD         32    // 0x20

// priv_levels (don't know why only 4?)
#define TAC_PLUS_PRIV_LVL_MAX             15    // 0x0f
#define TAC_PLUS_PRIV_LVL_ROOT            15    // 0x0f
#define TAC_PLUS_PRIV_LVL_USER            1     // 0x01
#define TAC_PLUS_PRIV_LVL_MIN             0     // 0x00

// authen types
#define TAC_PLUS_AUTHEN_TYPE_ASCII    1   // 0x01      ascii
#define TAC_PLUS_AUTHEN_TYPE_PAP      2   // 0x02      pap
#define TAC_PLUS_AUTHEN_TYPE_CHAP     3   // 0x03      chap
#define TAC_PLUS_AUTHEN_TYPE_ARAP     4   // 0x04      arap
#define TAC_PLUS_AUTHEN_TYPE_MSCHAP   5   // 0x05      mschap

// authen services
#define TAC_PLUS_AUTHEN_SVC_NONE      0   // 0x00
#define TAC_PLUS_AUTHEN_SVC_LOGIN     1   // 0x01
#define TAC_PLUS_AUTHEN_SVC_ENABLE    2   // 0x02
#define TAC_PLUS_AUTHEN_SVC_PPP       3   // 0x03
#define TAC_PLUS_AUTHEN_SVC_ARAP      4   // 0x04
#define TAC_PLUS_AUTHEN_SVC_PT        5   // 0x05
#define TAC_PLUS_AUTHEN_SVC_RCMD      6   // 0x06
#define TAC_PLUS_AUTHEN_SVC_X25       7   // 0x07
#define TAC_PLUS_AUTHEN_SVC_NASI      8   // 0x08
#define TAC_PLUS_AUTHEN_SVC_FWPROXY   9   // 0x09
#define TAC_PLUS_AUTHEN_SVC_H323_VSA  10  // 0x0A

// authorization status
#define TAC_PLUS_AUTHOR_STATUS_PASS_ADD   1     // 0x01
#define TAC_PLUS_AUTHOR_STATUS_PASS_REPL  2     // 0x02
#define TAC_PLUS_AUTHOR_STATUS_FAIL       16    // 0x10
#define TAC_PLUS_AUTHOR_STATUS_ERROR      17    // 0x11
#define TAC_PLUS_AUTHOR_STATUS_FOLLOW     33    // 0x21

// accounting flag
#define TAC_PLUS_ACCT_FLAG_MORE       0x1   // deprecated
#define TAC_PLUS_ACCT_FLAG_START      0x2
#define TAC_PLUS_ACCT_FLAG_STOP       0x4
#define TAC_PLUS_ACCT_FLAG_WATCHDOG   0x8

// accounting status
#define TAC_PLUS_ACCT_STATUS_SUCCESS    1   // 0x01
#define TAC_PLUS_ACCT_STATUS_ERROR      2   // 0x02
#define TAC_PLUS_ACCT_STATUS_FOLLOW     33  // 0x21

// versions
#define TAC_PLUS_MAJOR_VER_MASK     0xf0
#define TAC_PLUS_MAJOR_VER          0xc0
#define TAC_PLUS_MINOR_VER_0        0x0
#define TAC_PLUS_VER_0    (TAC_PLUS_MAJOR_VER | TAC_PLUS_MINOR_VER_0)
#define TAC_PLUS_MINOR_VER_1        0x01
#define TAC_PLUS_VER_1    (TAC_PLUS_MAJOR_VER | TAC_PLUS_MINOR_VER_1)

// type of packets
#define TAC_PLUS_AUTHEN         1     // authentication
#define TAC_PLUS_AUTHOR         2     // authorization
#define TAC_PLUS_ACCT           3     // accounting

// crypto flag
#define TAC_PLUS_ENCRYPTED    0x0   // packet is encrypted
#define TAC_PLUS_CLEAR        0x1   // packet is not encrypted

// hash
#define HASH_TAB_SIZE         157   // user and group hash table sizes

// type of request
#define TAC_PLUS_AUTHEN_TYPE_ASCII    1
#define TAC_PLUS_AUTHEN_TYPE_PAP      2
#define TAC_PLUS_AUTHEN_TYPE_CHAP     3
#define TAC_PLUS_AUTHEN_TYPE_ARAP     4
#define TAC_PLUS_AUTHEN_TYPE_MSCHAP   5

// service of request
#define TAC_PLUS_AUTHEN_SVC_LOGIN     1
#define TAC_PLUS_AUTHEN_SVC_ENABLE    2
#define TAC_PLUS_AUTHEN_SVC_PPP       3
#define TAC_PLUS_AUTHEN_SVC_ARAP      4
#define TAC_PLUS_AUTHEN_SVC_PT        5
#define TAC_PLUS_AUTHEN_SVC_RCMD      6
#define TAC_PLUS_AUTHEN_SVC_X25       7
#define TAC_PLUS_AUTHEN_SVC_NASI      8
//
#define TAC_PLUS_AUTHEN_FLAG_NOECHO         0x1
//
#define TAC_PLUS_CONTINUE_FLAG_ABORT        0x1


// working with all tacacs+ packets


#define TAC_PLUS_HDR_SIZE     12
struct tac_plus_pak_hdr {
  unsigned char version;    // 1 byte: version
  unsigned char type;       // 1 byte: type
  unsigned char seq_no;     // 1 byte: packet sequence number
  unsigned char encryption; // 1 byte: packet is encrypted or cleartext
  int session_id;           // 4 bytes: session identifier
  int datalength;           // 4 bytes: length of encrypted data following header
};
typedef struct tac_plus_pak_hdr HDR;

#define TAC_AUTHEN_START_FIXED_FIELDS_SIZE    8
struct authen_start {
  unsigned char action;
  unsigned char priv_lvl;
  unsigned char authen_type;
  unsigned char service;
  unsigned char user_len;
  unsigned char port_len;
  unsigned char rem_addr_len;
  unsigned char data_len;
  // <user_len bytes of char data>
  // <port_len bytes of char data>
  // <rem_addr_len bytes of u_char data>
  // <data_len bytes of u_char data>
};

#define TAC_AUTHEN_REPLY_FIXED_FIELDS_SIZE    6
struct authen_reply {
  unsigned char status;           // 1 byte
  unsigned char flags;            // 1 byte
  unsigned short msg_len;         // 2 bytes
  unsigned short data_len;        // 2 bytes
  // <msg_len bytes of char data>
  // <data_len bytes of u_char data>
};

#define TAC_AUTHEN_CONT_FIXED_FIELDS_SIZE       5
struct authen_cont {
  unsigned short user_msg_len;    // 2 bytes
  unsigned short user_data_len;   // 2 bytes
  unsigned char flags;            // 1 byte
  // <user_msg_len bytes of u_char data>
  // <user_data_len bytes of u_char data>
};

#define TAC_AUTHOR_REQ_FIXED_FIELDS_SIZE      8
struct author {
  unsigned char authen_method;    // 1 byte
  unsigned char priv_lvl;         // 1 byte
  unsigned char authen_type;      // 1 byte
  unsigned char service;          // 1 byte
  unsigned char user_len;         // 1 byte
  unsigned char port_len;         // 1 byte
  unsigned char rem_addr_len;     // 1 byte
  unsigned char arg_cnt;          // 1 byte: the number of args
  // <arg_cnt u_chars containing the lengths of args 1 to arg n>
  // <user_len bytes of char data>
  // <port_len bytes of char data>
  // <rem_addr_len bytes of u_char data>
  // <char data for each arg>
};

const int TAC_AUTHOR_REPLY_FIXED_FIELDS_SIZE = 6;
struct author_reply {
  unsigned char status;         // 1 byte
  unsigned char arg_cnt;        // 1 byte
  unsigned short msg_len;       // 2 bytes
  unsigned short data_len;      // 2 bytes
  // <arg_cnt u_chars containing the lengths of arg 1 to arg n>
  // <msg_len bytes of char data>
  // <data_len bytes of char data>
  // <char data for each arg>
};

#define TAC_ACCT_REQ_FIXED_FIELDS_SIZE        9
struct acct {
  unsigned char flags;            // 1 byte
  unsigned char authen_method;    // 1 byte
  unsigned char priv_lvl;         // 1 byte
  unsigned char authen_type;      // 1 byte
  unsigned char authen_service;   // 1 byte
  unsigned char user_len;         // 1 byte
  unsigned char port_len;         // 1 byte
  unsigned char rem_addr_len;     // 1 byte
  unsigned char arg_cnt;          // 1 byte: the number of cmd args
  // one u_char containing size for each arg
  // <user_len bytes of char data>
  // <port_len bytes of char data>
  // <rem_addr_len bytes of u_char data>
  // char data for args 1 ... n
};

#define TAC_ACCT_REPLY_FIXED_FIELDS_SIZE      5
struct acct_reply {
  unsigned short msg_len;         // 2 bytes
  unsigned short data_len;        // 2 bytes
  unsigned char status;           // 1 byte: status - does server ok
};



class TacacsPacket : public Packet {
//class TacacsPacket : public Packet, public md5 {
  pthread_mutex_t mutex_;
  void lock();
  void unlock();
  unsigned int session_id_;
  int aborted_;
  int seq_no_;
  int sock_;
  time_t last_exch_;
  string key_;
  int keyline_;
  string peer_;
  unsigned char version_;
 public:
  TacacsPacket(const char*,const char*,int,unsigned int);
  ~TacacsPacket();
  int selector(unsigned char*);
  unsigned int getSessionId();
  void setSessionId(unsigned int);
  int getAborted();
  void setAborted(int);
  int getSeqNo();
  void setSeqNo(int);
  int getSock();
  void setSock(int);
  time_t getLastExch();
  void setLastExch(time_t);
  string getKey();
  void setKey(string);
  int getKeyline();
  void setKeyline(int);
  string getPeer();
  void setPeer(string);
  unsigned char getVersion();
  void setVersion(unsigned char);
//  void free_avpairs(char **avp);
  void create_md5_hash(int, unsigned char,
      unsigned char, unsigned char*, unsigned char*);
  bool md5_xor(HDR*, unsigned char*);
  unsigned char *read_packet();
  unsigned char *read_packet(unsigned char*);
  bool write_packet(unsigned char *buf);
};

class TacacsSessionContainer;

class TacacsPacketReader : public Packet {
  pthread_mutex_t mutex_;
  void lock();
  void unlock();
  unsigned char *read_packet_header();
  list<TacacsSessionContainer*> tacacsSessionQueue_;
 public:
  TacacsPacketReader(char*,int);
  ~TacacsPacketReader();
};


// identify several internal authen errors
class TacErrAuthen {};

class TacacsServerAuthentication : public AAA {
  pthread_mutex_t mutex_;
  void lock();
  void unlock();
  string user_;
  string port_;
  string rem_addr_;
  ipaddr cisco_;
  int res_;
  string enable_;
  int request_;
 public:
  string getUser();
  void setUser(string);
  string getPort();
  void setPort(string);
  string getRemAddr();
  void setRemAddr(string);
  char data[DATA_LEN];
  ipaddr getCisco();
  void setCisco(ipaddr);
  int getRes();
  int setRes(int);
  char password[DB_PASSWORD_LEN];
  char pwstring[DATA_LEN];
  string getEnable();
  void setEnable(string);
  bool chap;
  int en_req;
  char *buf_cont;
  int getRequest();
  void setRequest(int);
  int get_start(unsigned char*,unsigned char*,char*);
  bool send_reply(const int,const char*,const char*,int,int);
  int get_cont(unsigned char*,unsigned char*,char*,char*,int);
//  char loginstring[32];
//  char pwdstring[32];
  TacacsPacket *t;
  TacacsServerAuthentication(TacacsPacket*);
  ~TacacsServerAuthentication();
};

class TacacsServerAuthorization : public AAA {
  pthread_mutex_t mutex_;
  void lock();
  void unlock();
 public:
  int method;
  int priv_lvl;
  int authen_type;
  int authen_service;
  char user[USERNAME_LEN];
  char port[PORT_LEN];
  char rem_addr[REM_ADDR_LEN];
  db_user dbd;
  char *curService;
  char *curProtocol;
  int added;
  int replaced;
  int start_av;
  char *avpair[MAX_AVP];
  char *bavpair[MAX_AVP];
  char *nas_avp;
  regex_t preg;
  size_t nmatch;
  regmatch_t pmatch[2];
  bool flag1;
  bool flag2;
  bool flag3;
  bool flag4;
  int j;
  char *avps[MAX_AVP];
  bool get_request(unsigned char*,unsigned char*,int*,int*,int*,int*,char*,
      char*,char*,char **avpair);
  bool send_response(const int,const char*,const char*,char**);
  bool optional(char*);
  bool mandatory(char*);
  bool match_attr(char*,char*);
  bool match_value(char*,char*);
  char *get_value(char*);
  bool def_author;
  TacacsPacket *t;
  TacacsServerAuthorization(TacacsPacket*, bool);
  ~TacacsServerAuthorization();
};

class TacacsServerAccounting : public AAA {
  pthread_mutex_t mutex_;
  void lock();
  void unlock();
 public:
  list<string> avpair;
  int get_request(unsigned char*,unsigned char*,int*,int*,int*,int*,char*,
     char*,char*,char*);
  bool send_reply(char*,char*,const int);
  TacacsPacket *t;
  TacacsServerAccounting(TacacsPacket*);
  ~TacacsServerAccounting();
};

class TacacsSessionContainer {
  pthread_mutex_t mutex_;
  void lock();
  void unlock();
  pthread_mutex_t mutex2_;
  TacacsServerAuthentication *tac_authen;
  TacacsServerAuthorization *tac_author;
  TacacsServerAccounting *tac_account;
  time_t created_;
  string loginstring_;
  string pwdstring_;
  bool authoriz_;
  string key_;
  int sock_;
  unsigned int session_id_;
  ipaddr peer_;
 public:
  void lock2();
  void unlock2();
  TacacsPacket *tac;
  time_t getCreated();
// /**
//  set created */
//  void setCreated(time_t);
  string getLoginstring();
  void setLoginstring(string);
  string getPwdstring();
  void setPwdstring(string);
  bool getAuthoriz();
  void setAuthoriz(bool);
  string getKey();
  void setKey(string);
  int getSock();
  void setSock(int);
  unsigned int getSessionId();
  void setSessionId(unsigned int);
  ipaddr getPeer();
  void setPeer(ipaddr);
  TacacsSessionContainer(ipaddr,int,int,char*,char*,char*,bool);
  ~TacacsSessionContainer();
  void process(unsigned char*,unsigned char*);
};


class TacacsClient : public TacacsPacket {
 public:
  bool authen_send_start(const char* port,
      const char* username,
      const int type,
      const char* data);
  int authen_get_reply(char* server,
      char* datas);
  bool authen_send_cont(const char* user_msg,
      const char* data);
  bool author_send_request(const int method,
      const int priv_lvl,
      const int authen_type,
      const int authen_service,
      const char *user,
      const char *port,
      char **avpair);
  int author_get_response(char *server_msg,
      char *data,
      char **avpair);
  bool account_send_request(const int flag,
      const int method,
      const int priv_lvl,
      const int authen_type,
      const int authen_service,
      const char *user,
      const char *port,
      char **avpair);
  int account_get_reply(char *server_msg,char *data);
  TacacsClient(char *k,char *p,int f):TacacsPacket(k,p,f,0) {}
};

};

#endif //__TACACS_H__

---