@@ -150,20 +150,20 @@ namespace eap
|
||||
///
|
||||
/// Authentication attempt status
|
||||
///
|
||||
enum status_t {
|
||||
status_success = 0, ///< Authentication succeeded
|
||||
status_auth_failed, ///< Authentication failed
|
||||
status_cred_invalid, ///< Invalid credentials
|
||||
status_cred_expired, ///< Credentials expired
|
||||
status_cred_changing, ///< Credentials are being changed
|
||||
status_account_disabled, ///< Account is disabled
|
||||
status_account_logon_hours, ///< Restricted account logon hours
|
||||
status_account_denied, ///< Account access is denied
|
||||
status_server_compromised, ///< Authentication server might have been compromised (CRL)
|
||||
enum class status_t {
|
||||
success = 0, ///< Authentication succeeded
|
||||
auth_failed, ///< Authentication failed
|
||||
cred_invalid, ///< Invalid credentials
|
||||
cred_expired, ///< Credentials expired
|
||||
cred_changing, ///< Credentials are being changed
|
||||
account_disabled, ///< Account is disabled
|
||||
account_logon_hours, ///< Restricted account logon hours
|
||||
account_denied, ///< Account access is denied
|
||||
server_compromised, ///< Authentication server might have been compromised (CRL)
|
||||
|
||||
// Meta statuses
|
||||
status_cred_begin = status_cred_invalid, ///< First credential related problem
|
||||
status_cred_end = status_cred_changing + 1, ///< First problem, that is not credential related any more
|
||||
cred_begin = cred_invalid, ///< First credential related problem
|
||||
cred_end = cred_changing + 1, ///< First problem, that is not credential related any more
|
||||
};
|
||||
|
||||
public:
|
||||
|
@@ -57,12 +57,12 @@ namespace eap
|
||||
///
|
||||
/// Credential source when combined
|
||||
///
|
||||
enum source_t {
|
||||
source_unknown = -1, ///< Unknown source
|
||||
source_cache = 0, ///< Credentials were obtained from EapHost cache
|
||||
source_config, ///< Credentials were set by method configuration
|
||||
source_storage, ///< Credentials were loaded from Windows Credential Manager
|
||||
source_lower, ///< Credentials were set by lower EAP method
|
||||
enum class source_t {
|
||||
unknown = -1, ///< Unknown source
|
||||
cache = 0, ///< Credentials were obtained from EapHost cache
|
||||
config, ///< Credentials were set by method configuration
|
||||
storage, ///< Credentials were loaded from Windows Credential Manager
|
||||
lower, ///< Credentials were set by lower EAP method
|
||||
};
|
||||
|
||||
|
||||
@@ -210,9 +210,9 @@ namespace eap
|
||||
/// \param[in] pszTargetName The name in Windows Credential Manager to retrieve credentials from (optional, can be \c NULL)
|
||||
///
|
||||
/// \returns
|
||||
/// - \c source_cache Credentials were obtained from EapHost cache
|
||||
/// - \c source_config Credentials were set by method configuration
|
||||
/// - \c source_storage Credentials were loaded from Windows Credential Manager
|
||||
/// - \c source_t::cache Credentials were obtained from EapHost cache
|
||||
/// - \c source_t::config Credentials were set by method configuration
|
||||
/// - \c source_t::storage Credentials were loaded from Windows Credential Manager
|
||||
///
|
||||
virtual source_t combine(
|
||||
_In_ DWORD dwFlags,
|
||||
@@ -305,9 +305,9 @@ namespace eap
|
||||
/// \param[in] pszTargetName The name in Windows Credential Manager to retrieve credentials from (optional, can be \c NULL)
|
||||
///
|
||||
/// \returns
|
||||
/// - \c source_cache Credentials were obtained from EapHost cache
|
||||
/// - \c source_config Credentials were set by method configuration
|
||||
/// - \c source_storage Credentials were loaded from Windows Credential Manager
|
||||
/// - \c source_t::cache Credentials were obtained from EapHost cache
|
||||
/// - \c source_t::config Credentials were set by method configuration
|
||||
/// - \c source_t::storage Credentials were loaded from Windows Credential Manager
|
||||
///
|
||||
virtual source_t combine(
|
||||
_In_ DWORD dwFlags,
|
||||
@@ -327,11 +327,11 @@ namespace eap
|
||||
///
|
||||
/// Password encryption method when loaded/saved to profile configuration XML
|
||||
///
|
||||
enum enc_alg_t {
|
||||
enc_alg_unknown = -1, ///< Unknown encryption
|
||||
enc_alg_none = 0, ///< Unencrypted
|
||||
enc_alg_geantlink, ///< GÉANTLink module encryption
|
||||
enc_alg_kph, ///< KPH encryption
|
||||
enum class enc_alg_t {
|
||||
unknown = -1, ///< Unknown encryption
|
||||
none = 0, ///< Unencrypted
|
||||
native, ///< native module encryption
|
||||
kph, ///< KPH encryption
|
||||
};
|
||||
|
||||
public:
|
||||
@@ -417,9 +417,9 @@ namespace eap
|
||||
/// \param[in] pszTargetName The name in Windows Credential Manager to retrieve credentials from (optional, can be \c NULL)
|
||||
///
|
||||
/// \returns
|
||||
/// - \c source_cache Credentials were obtained from EapHost cache
|
||||
/// - \c source_config Credentials were set by method configuration
|
||||
/// - \c source_storage Credentials were loaded from Windows Credential Manager
|
||||
/// - \c source_t::cache Credentials were obtained from EapHost cache
|
||||
/// - \c source_t::config Credentials were set by method configuration
|
||||
/// - \c source_t::storage Credentials were loaded from Windows Credential Manager
|
||||
///
|
||||
virtual source_t combine(
|
||||
_In_ DWORD dwFlags,
|
||||
|
@@ -65,7 +65,7 @@ namespace eap
|
||||
///
|
||||
/// \param[in] eap_method EAP method type ID
|
||||
///
|
||||
module(_In_ winstd::eap_type_t eap_method = winstd::eap_type_undefined);
|
||||
module(_In_ winstd::eap_type_t eap_method = winstd::eap_type_t::undefined);
|
||||
|
||||
///
|
||||
/// Destructs the module
|
||||
|
@@ -87,7 +87,7 @@ const bstr eap::config::namespace_eapmetadata(L"urn:ietf:params:xml:ns:yang:ietf
|
||||
eap::config_method::config_method(_In_ module &mod, _In_ unsigned int level) :
|
||||
m_level (level),
|
||||
m_allow_save (true),
|
||||
m_last_status(status_success),
|
||||
m_last_status(status_t::success),
|
||||
config (mod)
|
||||
{
|
||||
}
|
||||
@@ -179,7 +179,7 @@ void eap::config_method::load(_In_ IXMLDOMNode *pConfigRoot)
|
||||
m_module.log_config((xpath + L"/allow-save").c_str(), m_allow_save);
|
||||
}
|
||||
|
||||
m_last_status = status_success;
|
||||
m_last_status = status_t::success;
|
||||
m_last_msg.clear();
|
||||
}
|
||||
|
||||
|
@@ -308,7 +308,7 @@ eap::credentials::source_t eap::credentials_identity::combine(
|
||||
// Using EAP service cached credentials.
|
||||
*this = *dynamic_cast<const credentials_identity*>(cred_cached);
|
||||
m_module.log_event(&EAPMETHOD_TRACE_EVT_CRED_CACHED2, event_data((unsigned int)cfg.get_method_id()), event_data(credentials_identity::get_name()), event_data(pszTargetName), event_data::blank);
|
||||
return source_cache;
|
||||
return source_t::cache;
|
||||
}
|
||||
|
||||
auto cfg_with_cred = dynamic_cast<const config_method_with_cred*>(&cfg);
|
||||
@@ -316,7 +316,7 @@ eap::credentials::source_t eap::credentials_identity::combine(
|
||||
// Using configured credentials.
|
||||
*this = *dynamic_cast<const credentials_identity*>(cfg_with_cred->m_cred.get());
|
||||
m_module.log_event(&EAPMETHOD_TRACE_EVT_CRED_CONFIG2, event_data((unsigned int)cfg.get_method_id()), event_data(credentials_identity::get_name()), event_data(pszTargetName), event_data::blank);
|
||||
return source_config;
|
||||
return source_t::config;
|
||||
}
|
||||
|
||||
if (pszTargetName) {
|
||||
@@ -330,13 +330,13 @@ eap::credentials::source_t eap::credentials_identity::combine(
|
||||
// Using stored credentials.
|
||||
*this = std::move(cred_loaded);
|
||||
m_module.log_event(&EAPMETHOD_TRACE_EVT_CRED_STORED2, event_data((unsigned int)cfg.get_method_id()), event_data(credentials_identity::get_name()), event_data(pszTargetName), event_data::blank);
|
||||
return source_storage;
|
||||
return source_t::storage;
|
||||
} catch (...) {
|
||||
// Not actually an error.
|
||||
}
|
||||
}
|
||||
|
||||
return source_unknown;
|
||||
return source_t::unknown;
|
||||
}
|
||||
|
||||
|
||||
@@ -345,7 +345,7 @@ eap::credentials::source_t eap::credentials_identity::combine(
|
||||
//////////////////////////////////////////////////////////////////////
|
||||
|
||||
eap::credentials_pass::credentials_pass(_In_ module &mod) :
|
||||
m_enc_alg(enc_alg_geantlink),
|
||||
m_enc_alg(enc_alg_t::native),
|
||||
credentials(mod)
|
||||
{
|
||||
}
|
||||
@@ -426,7 +426,7 @@ void eap::credentials_pass::save(_In_ IXMLDOMDocument *pDoc, _In_ IXMLDOMNode *p
|
||||
|
||||
// <Password>
|
||||
switch (m_enc_alg) {
|
||||
case enc_alg_kph: {
|
||||
case enc_alg_t::kph: {
|
||||
sanitizing_string password_utf8;
|
||||
WideCharToMultiByte(CP_UTF8, 0, m_password, password_utf8, NULL, NULL);
|
||||
wstring password_enc(std::move(kph_encrypt<wchar_t, char_traits<wchar_t>, allocator<wchar_t> >(cp, password_utf8.c_str())));
|
||||
@@ -481,18 +481,18 @@ void eap::credentials_pass::load(_In_ IXMLDOMNode *pConfigRoot)
|
||||
throw win_runtime_error(__FUNCTION__ " CryptAcquireContext failed.");
|
||||
|
||||
m_password = m_module.decrypt_str_md5<char_traits<wchar_t>, sanitizing_allocator<wchar_t> >(cp, password_enc.data(), password_enc.size());
|
||||
m_enc_alg = enc_alg_geantlink;
|
||||
m_enc_alg = enc_alg_t::native;
|
||||
} else if (encryption && CompareStringEx(LOCALE_NAME_INVARIANT, NORM_IGNORECASE, encryption, encryption.length(), _L("KPH"), -1, NULL, NULL, 0) == CSTR_EQUAL) {
|
||||
// Decrypt password.
|
||||
sanitizing_string password_utf8(std::move(kph_decrypt<OLECHAR>(password)));
|
||||
MultiByteToWideChar(CP_UTF8, 0, password_utf8, m_password);
|
||||
m_enc_alg = enc_alg_kph;
|
||||
m_enc_alg = enc_alg_t::kph;
|
||||
} else if (encryption && encryption[0]) {
|
||||
// Encryption is defined but unrecognized.
|
||||
throw invalid_argument(string_printf(__FUNCTION__ " Unsupported <Password> encryption method (encryption: %ls).", (BSTR)encryption));
|
||||
} else {
|
||||
m_password = password;
|
||||
m_enc_alg = enc_alg_none;
|
||||
m_enc_alg = enc_alg_t::none;
|
||||
SecureZeroMemory((BSTR)password, sizeof(OLECHAR)*password.length());
|
||||
}
|
||||
|
||||
@@ -614,7 +614,7 @@ eap::credentials::source_t eap::credentials_pass::combine(
|
||||
// Using EAP service cached credentials.
|
||||
*this = *dynamic_cast<const credentials_pass*>(cred_cached);
|
||||
m_module.log_event(&EAPMETHOD_TRACE_EVT_CRED_CACHED2, event_data((unsigned int)cfg.get_method_id()), event_data(credentials_pass::get_name()), event_data(pszTargetName), event_data::blank);
|
||||
return source_cache;
|
||||
return source_t::cache;
|
||||
}
|
||||
|
||||
auto cfg_with_cred = dynamic_cast<const config_method_with_cred*>(&cfg);
|
||||
@@ -622,7 +622,7 @@ eap::credentials::source_t eap::credentials_pass::combine(
|
||||
// Using configured credentials.
|
||||
*this = *dynamic_cast<const credentials_pass*>(cfg_with_cred->m_cred.get());
|
||||
m_module.log_event(&EAPMETHOD_TRACE_EVT_CRED_CONFIG2, event_data((unsigned int)cfg.get_method_id()), event_data(credentials_pass::get_name()), event_data(pszTargetName), event_data::blank);
|
||||
return source_config;
|
||||
return source_t::config;
|
||||
}
|
||||
|
||||
if (pszTargetName) {
|
||||
@@ -636,13 +636,13 @@ eap::credentials::source_t eap::credentials_pass::combine(
|
||||
// Using stored credentials.
|
||||
*this = std::move(cred_loaded);
|
||||
m_module.log_event(&EAPMETHOD_TRACE_EVT_CRED_STORED2, event_data((unsigned int)cfg.get_method_id()), event_data(credentials_pass::get_name()), event_data(pszTargetName), event_data::blank);
|
||||
return source_storage;
|
||||
return source_t::storage;
|
||||
} catch (...) {
|
||||
// Not actually an error.
|
||||
}
|
||||
}
|
||||
|
||||
return source_unknown;
|
||||
return source_t::unknown;
|
||||
}
|
||||
|
||||
|
||||
|
@@ -299,7 +299,7 @@ EapPeerMethodResponseAction eap::method_eap::process_request_packet(
|
||||
// Save request packet ID to make matching response packet in get_response_packet() later.
|
||||
m_id = hdr->Id;
|
||||
|
||||
if (hdr->Data[0] != m_eap_method) {
|
||||
if ((eap_type_t)hdr->Data[0] != m_eap_method) {
|
||||
// Unsupported EAP method. Respond with Legacy Nak.
|
||||
m_send_nak = true;
|
||||
return EapPeerMethodResponseActionSend;
|
||||
@@ -324,7 +324,7 @@ void eap::method_eap::get_response_packet(
|
||||
hdr.Id = m_id;
|
||||
|
||||
if (!m_send_nak) {
|
||||
hdr.Data[0] = m_eap_method;
|
||||
hdr.Data[0] = (BYTE)m_eap_method;
|
||||
|
||||
packet.reserve(size_max); // To avoid reallocation when inserting EAP packet header later.
|
||||
|
||||
@@ -332,7 +332,7 @@ void eap::method_eap::get_response_packet(
|
||||
method_tunnel::get_response_packet(packet, size_max - sizeof(EapPacket));
|
||||
} else {
|
||||
// Respond with Legacy Nak suggesting our EAP method to continue.
|
||||
hdr.Data[0] = eap_type_nak;
|
||||
hdr.Data[0] = (BYTE)eap_type_t::nak;
|
||||
|
||||
// Check packet size. We will suggest one EAP method alone, so we need one byte for data.
|
||||
size_t size_packet = sizeof(EapPacket) + 1;
|
||||
@@ -341,7 +341,7 @@ void eap::method_eap::get_response_packet(
|
||||
packet.reserve(size_packet); // To avoid reallocation when inserting EAP packet header later.
|
||||
|
||||
// Data of Legacy Nak packet is a list of supported EAP types: our method alone.
|
||||
packet.assign(1, m_eap_method);
|
||||
packet.assign(1, (unsigned char)m_eap_method);
|
||||
}
|
||||
|
||||
size_t size_packet = packet.size() + sizeof(EapPacket);
|
||||
|
Reference in New Issue
Block a user