178189Sbrian/*- 278189Sbrian * Copyright (c) 1996 - 2001 Brian Somers <brian@Awfulhak.org> 378189Sbrian * based on work by Toshiharu OHNO <tony-o@iij.ad.jp> 478189Sbrian * Internet Initiative Japan, Inc (IIJ) 578189Sbrian * All rights reserved. 66059Samurai * 778189Sbrian * Redistribution and use in source and binary forms, with or without 878189Sbrian * modification, are permitted provided that the following conditions 978189Sbrian * are met: 1078189Sbrian * 1. Redistributions of source code must retain the above copyright 1178189Sbrian * notice, this list of conditions and the following disclaimer. 1278189Sbrian * 2. Redistributions in binary form must reproduce the above copyright 1378189Sbrian * notice, this list of conditions and the following disclaimer in the 1478189Sbrian * documentation and/or other materials provided with the distribution. 156059Samurai * 1678189Sbrian * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 1778189Sbrian * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 1878189Sbrian * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 1978189Sbrian * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 2078189Sbrian * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 2178189Sbrian * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 2278189Sbrian * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 2378189Sbrian * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 2478189Sbrian * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 2578189Sbrian * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 2678189Sbrian * SUCH DAMAGE. 276059Samurai * 2850479Speter * $FreeBSD$ 296059Samurai */ 3078189Sbrian 3143313Sbrian#include <sys/param.h> 3230715Sbrian#include <netinet/in.h> 3336285Sbrian#include <netinet/in_systm.h> 3436285Sbrian#include <netinet/ip.h> 3581634Sbrian#include <sys/socket.h> 3636285Sbrian#include <sys/un.h> 3730715Sbrian 38134789Sbrian#include <ctype.h> 3943888Sbrian#include <errno.h> 4043888Sbrian#include <fcntl.h> 4193418Sbrian#ifndef NODES 4236287Sbrian#include <md4.h> 4337192Sbrian#endif 4430715Sbrian#include <md5.h> 4543888Sbrian#include <paths.h> 4643888Sbrian#include <signal.h> 4749976Sbrian#include <stdio.h> 4830715Sbrian#include <stdlib.h> 4944106Sbrian#include <string.h> 5043888Sbrian#include <sys/wait.h> 5136285Sbrian#include <termios.h> 5243888Sbrian#include <unistd.h> 5329840Sbrian 5446686Sbrian#include "layer.h" 5530715Sbrian#include "mbuf.h" 5630715Sbrian#include "log.h" 5730715Sbrian#include "defs.h" 5830715Sbrian#include "timer.h" 596059Samurai#include "fsm.h" 6046686Sbrian#include "proto.h" 6136285Sbrian#include "lqr.h" 626059Samurai#include "hdlc.h" 6363484Sbrian#include "lcp.h" 646735Samurai#include "auth.h" 6536285Sbrian#include "async.h" 6636285Sbrian#include "throughput.h" 6736285Sbrian#include "descriptor.h" 6843888Sbrian#include "chap.h" 6936285Sbrian#include "iplist.h" 7036285Sbrian#include "slcompress.h" 7181634Sbrian#include "ncpaddr.h" 7236285Sbrian#include "ipcp.h" 7336285Sbrian#include "filter.h" 7436285Sbrian#include "ccp.h" 7536285Sbrian#include "link.h" 7636285Sbrian#include "physical.h" 7736285Sbrian#include "mp.h" 7843313Sbrian#ifndef NORADIUS 7943313Sbrian#include "radius.h" 8043313Sbrian#endif 8181634Sbrian#include "ipv6cp.h" 8281634Sbrian#include "ncp.h" 8336285Sbrian#include "bundle.h" 8436285Sbrian#include "chat.h" 8538174Sbrian#include "cbcp.h" 8643888Sbrian#include "command.h" 8736285Sbrian#include "datalink.h" 8893418Sbrian#ifndef NODES 8936287Sbrian#include "chap_ms.h" 9067910Sbrian#include "mppe.h" 9137192Sbrian#endif 9255253Sbrian#include "id.h" 936059Samurai 9455146Sbrianstatic const char * const chapcodes[] = { 9519866Sphk "???", "CHALLENGE", "RESPONSE", "SUCCESS", "FAILURE" 966059Samurai}; 9743693Sbrian#define MAXCHAPCODE (sizeof chapcodes / sizeof chapcodes[0] - 1) 986059Samurai 9930715Sbrianstatic void 10036285SbrianChapOutput(struct physical *physical, u_int code, u_int id, 10143693Sbrian const u_char *ptr, int count, const char *text) 1026059Samurai{ 1036059Samurai int plen; 1046059Samurai struct fsmheader lh; 1056059Samurai struct mbuf *bp; 1066059Samurai 10728679Sbrian plen = sizeof(struct fsmheader) + count; 1086059Samurai lh.code = code; 1096059Samurai lh.id = id; 1106059Samurai lh.length = htons(plen); 11154912Sbrian bp = m_get(plen, MB_CHAPOUT); 11230715Sbrian memcpy(MBUF_CTOP(bp), &lh, sizeof(struct fsmheader)); 1136059Samurai if (count) 11430715Sbrian memcpy(MBUF_CTOP(bp) + sizeof(struct fsmheader), ptr, count); 11536285Sbrian log_DumpBp(LogDEBUG, "ChapOutput", bp); 11637926Sbrian if (text == NULL) 11737926Sbrian log_Printf(LogPHASE, "Chap Output: %s\n", chapcodes[code]); 11837926Sbrian else 11937926Sbrian log_Printf(LogPHASE, "Chap Output: %s (%s)\n", chapcodes[code], text); 12046686Sbrian link_PushPacket(&physical->link, bp, physical->dl->bundle, 12150867Sbrian LINK_QUEUES(&physical->link) - 1, PROTO_CHAP); 1226059Samurai} 1236059Samurai 12443693Sbrianstatic char * 125134789Sbrianchap_BuildAnswer(char *name, char *key, u_char id, char *challenge 12693418Sbrian#ifndef NODES 127134789Sbrian , u_char type, char *peerchallenge, char *authresponse, 128134789Sbrian int lanman 12944123Sbrian#endif 13044123Sbrian ) 1316059Samurai{ 13243693Sbrian char *result, *digest; 13343693Sbrian size_t nlen, klen; 13443693Sbrian 13543693Sbrian nlen = strlen(name); 13643693Sbrian klen = strlen(key); 13743693Sbrian 13893418Sbrian#ifndef NODES 13944106Sbrian if (type == 0x80) { 14043693Sbrian char expkey[AUTHLEN << 2]; 14143693Sbrian MD4_CTX MD4context; 142134789Sbrian size_t f; 14343693Sbrian 14443693Sbrian if ((result = malloc(1 + nlen + MS_CHAP_RESPONSE_LEN)) == NULL) 14543693Sbrian return result; 14643693Sbrian 14744106Sbrian digest = result; /* the response */ 14844106Sbrian *digest++ = MS_CHAP_RESPONSE_LEN; /* 49 */ 14944106Sbrian memcpy(digest + MS_CHAP_RESPONSE_LEN, name, nlen); 15044106Sbrian if (lanman) { 15144106Sbrian memset(digest + 24, '\0', 25); 15244106Sbrian mschap_LANMan(digest, challenge + 1, key); /* LANMan response */ 15344106Sbrian } else { 15444106Sbrian memset(digest, '\0', 25); 15544106Sbrian digest += 24; 15643693Sbrian 15744106Sbrian for (f = 0; f < klen; f++) { 15844106Sbrian expkey[2*f] = key[f]; 15944106Sbrian expkey[2*f+1] = '\0'; 16044106Sbrian } 16144106Sbrian /* 16244106Sbrian * ----------- 16344106Sbrian * expkey = | k\0e\0y\0 | 16444106Sbrian * ----------- 16544106Sbrian */ 16644106Sbrian MD4Init(&MD4context); 16744106Sbrian MD4Update(&MD4context, expkey, klen << 1); 16844106Sbrian MD4Final(digest, &MD4context); 16944106Sbrian 17044106Sbrian /* 17144106Sbrian * ---- -------- ---------------- ------- ------ 17244106Sbrian * result = | 49 | LANMan | 16 byte digest | 9 * ? | name | 17344106Sbrian * ---- -------- ---------------- ------- ------ 17444106Sbrian */ 17544106Sbrian mschap_NT(digest, challenge + 1); 17643693Sbrian } 17743693Sbrian /* 17844106Sbrian * ---- -------- ------------- ----- ------ 17944106Sbrian * | | struct MS_ChapResponse24 | | 18044106Sbrian * result = | 49 | LANMan | NT digest | 0/1 | name | 18144106Sbrian * ---- -------- ------------- ----- ------ 18244106Sbrian * where only one of LANMan & NT digest are set. 18343693Sbrian */ 18467910Sbrian } else if (type == 0x81) { 18567910Sbrian char expkey[AUTHLEN << 2]; 18667910Sbrian char pwdhash[CHAP81_HASH_LEN]; 18767910Sbrian char pwdhashhash[CHAP81_HASH_LEN]; 18867910Sbrian char *ntresponse; 189134789Sbrian size_t f; 19067910Sbrian 19167910Sbrian if ((result = malloc(1 + nlen + CHAP81_RESPONSE_LEN)) == NULL) 19267910Sbrian return result; 19367910Sbrian 19467910Sbrian memset(result, 0, 1 + nlen + CHAP81_RESPONSE_LEN); 19567910Sbrian 19667910Sbrian digest = result; 19767910Sbrian *digest++ = CHAP81_RESPONSE_LEN; /* value size */ 19867910Sbrian 19967910Sbrian /* Copy our challenge */ 20067910Sbrian memcpy(digest, peerchallenge + 1, CHAP81_CHALLENGE_LEN); 20167910Sbrian 20267910Sbrian /* Expand password to Unicode XXX */ 20367910Sbrian for (f = 0; f < klen; f++) { 20467910Sbrian expkey[2*f] = key[f]; 20567910Sbrian expkey[2*f+1] = '\0'; 20667910Sbrian } 20767910Sbrian 20867910Sbrian ntresponse = digest + CHAP81_NTRESPONSE_OFF; 20967910Sbrian 21067910Sbrian /* Get some needed hashes */ 21167910Sbrian NtPasswordHash(expkey, klen * 2, pwdhash); 21267910Sbrian HashNtPasswordHash(pwdhash, pwdhashhash); 21367910Sbrian 21467910Sbrian /* Generate NTRESPONSE to respond on challenge call */ 215134789Sbrian GenerateNTResponse(challenge + 1, peerchallenge + 1, name, 21667910Sbrian expkey, klen * 2, ntresponse); 21767910Sbrian 21867910Sbrian /* Generate MPPE MASTERKEY */ 21968461Sbrian GetMasterKey(pwdhashhash, ntresponse, MPPE_MasterKey); /* XXX Global ! */ 22067910Sbrian 22167910Sbrian /* Generate AUTHRESPONSE to verify on auth success */ 22298243Sbrian GenerateAuthenticatorResponse(expkey, klen * 2, ntresponse, 223134789Sbrian peerchallenge + 1, challenge + 1, name, 22467910Sbrian authresponse); 22567910Sbrian 22667910Sbrian authresponse[CHAP81_AUTHRESPONSE_LEN] = 0; 22767910Sbrian 22867910Sbrian memcpy(digest + CHAP81_RESPONSE_LEN, name, nlen); 22943693Sbrian } else 23043693Sbrian#endif 23143693Sbrian if ((result = malloc(nlen + 17)) != NULL) { 23243693Sbrian /* Normal MD5 stuff */ 23343693Sbrian MD5_CTX MD5context; 23443693Sbrian 23543693Sbrian digest = result; 23643693Sbrian *digest++ = 16; /* value size */ 23743693Sbrian 23843693Sbrian MD5Init(&MD5context); 23943693Sbrian MD5Update(&MD5context, &id, 1); 24043693Sbrian MD5Update(&MD5context, key, klen); 24143693Sbrian MD5Update(&MD5context, challenge + 1, *challenge); 24243693Sbrian MD5Final(digest, &MD5context); 24343693Sbrian 24443693Sbrian memcpy(digest + 16, name, nlen); 24543693Sbrian /* 24643693Sbrian * ---- -------- ------ 24743693Sbrian * result = | 16 | digest | name | 24843693Sbrian * ---- -------- ------ 24943693Sbrian */ 25043693Sbrian } 25143693Sbrian 25243693Sbrian return result; 25343693Sbrian} 25443693Sbrian 25543693Sbrianstatic void 25643888Sbrianchap_StartChild(struct chap *chap, char *prog, const char *name) 25743888Sbrian{ 25843888Sbrian char *argv[MAXARGS], *nargv[MAXARGS]; 25943888Sbrian int argc, fd; 26043888Sbrian int in[2], out[2]; 26147849Sbrian pid_t pid; 26243888Sbrian 26343888Sbrian if (chap->child.fd != -1) { 26443888Sbrian log_Printf(LogWARN, "Chap: %s: Program already running\n", prog); 26543888Sbrian return; 26643888Sbrian } 26743888Sbrian 26843888Sbrian if (pipe(in) == -1) { 26943888Sbrian log_Printf(LogERROR, "Chap: pipe: %s\n", strerror(errno)); 27043888Sbrian return; 27143888Sbrian } 27243888Sbrian 27343888Sbrian if (pipe(out) == -1) { 27443888Sbrian log_Printf(LogERROR, "Chap: pipe: %s\n", strerror(errno)); 27543888Sbrian close(in[0]); 27643888Sbrian close(in[1]); 27743888Sbrian return; 27843888Sbrian } 27943888Sbrian 28047849Sbrian pid = getpid(); 28143888Sbrian switch ((chap->child.pid = fork())) { 28243888Sbrian case -1: 28343888Sbrian log_Printf(LogERROR, "Chap: fork: %s\n", strerror(errno)); 28443888Sbrian close(in[0]); 28543888Sbrian close(in[1]); 28643888Sbrian close(out[0]); 28743888Sbrian close(out[1]); 28843888Sbrian chap->child.pid = 0; 28943888Sbrian return; 29043888Sbrian 29143888Sbrian case 0: 29243888Sbrian timer_TermService(); 29354914Sbrian 29454914Sbrian if ((argc = command_Interpret(prog, strlen(prog), argv)) <= 0) { 29554914Sbrian if (argc < 0) { 29654914Sbrian log_Printf(LogWARN, "CHAP: Invalid command syntax\n"); 29754914Sbrian _exit(255); 29854914Sbrian } 29954914Sbrian _exit(0); 30054914Sbrian } 30154914Sbrian 30243888Sbrian close(in[1]); 30343888Sbrian close(out[0]); 30449976Sbrian if (out[1] == STDIN_FILENO) 30549976Sbrian out[1] = dup(out[1]); 30643888Sbrian dup2(in[0], STDIN_FILENO); 30743888Sbrian dup2(out[1], STDOUT_FILENO); 30849976Sbrian close(STDERR_FILENO); 30949976Sbrian if (open(_PATH_DEVNULL, O_RDWR) != STDERR_FILENO) { 31043888Sbrian log_Printf(LogALERT, "Chap: Failed to open %s: %s\n", 31143888Sbrian _PATH_DEVNULL, strerror(errno)); 31243888Sbrian exit(1); 31343888Sbrian } 31449976Sbrian for (fd = getdtablesize(); fd > STDERR_FILENO; fd--) 31549976Sbrian fcntl(fd, F_SETFD, 1); 31664802Sbrian#ifndef NOSUID 31755252Sbrian setuid(ID0realuid()); 31864802Sbrian#endif 31943888Sbrian command_Expand(nargv, argc, (char const *const *)argv, 32047849Sbrian chap->auth.physical->dl->bundle, 0, pid); 32143888Sbrian execvp(nargv[0], nargv); 32249976Sbrian printf("exec() of %s failed: %s\n", nargv[0], strerror(errno)); 32349976Sbrian _exit(255); 32443888Sbrian 32543888Sbrian default: 32643888Sbrian close(in[0]); 32743888Sbrian close(out[1]); 32843888Sbrian chap->child.fd = out[0]; 32943888Sbrian chap->child.buf.len = 0; 33043888Sbrian write(in[1], chap->auth.in.name, strlen(chap->auth.in.name)); 33143888Sbrian write(in[1], "\n", 1); 33245907Sbrian write(in[1], chap->challenge.peer + 1, *chap->challenge.peer); 33343888Sbrian write(in[1], "\n", 1); 33443888Sbrian write(in[1], name, strlen(name)); 33543888Sbrian write(in[1], "\n", 1); 33643888Sbrian close(in[1]); 33743888Sbrian break; 33843888Sbrian } 33943888Sbrian} 34043888Sbrian 34143888Sbrianstatic void 34243888Sbrianchap_Cleanup(struct chap *chap, int sig) 34343888Sbrian{ 34443888Sbrian if (chap->child.pid) { 34543888Sbrian int status; 34643888Sbrian 34743888Sbrian close(chap->child.fd); 34843888Sbrian chap->child.fd = -1; 34943888Sbrian if (sig) 35043888Sbrian kill(chap->child.pid, SIGTERM); 35143888Sbrian chap->child.pid = 0; 35243888Sbrian chap->child.buf.len = 0; 35343888Sbrian 35443888Sbrian if (wait(&status) == -1) 35543888Sbrian log_Printf(LogERROR, "Chap: wait: %s\n", strerror(errno)); 35643888Sbrian else if (WIFSIGNALED(status)) 35743888Sbrian log_Printf(LogWARN, "Chap: Child received signal %d\n", WTERMSIG(status)); 35843888Sbrian else if (WIFEXITED(status) && WEXITSTATUS(status)) 35943888Sbrian log_Printf(LogERROR, "Chap: Child exited %d\n", WEXITSTATUS(status)); 36043888Sbrian } 36145907Sbrian *chap->challenge.local = *chap->challenge.peer = '\0'; 36293418Sbrian#ifndef NODES 36344106Sbrian chap->peertries = 0; 36444123Sbrian#endif 36543888Sbrian} 36643888Sbrian 36743888Sbrianstatic void 368134789Sbrianchap_Respond(struct chap *chap, char *name, char *key 36993418Sbrian#ifndef NODES 370134789Sbrian , u_char type, int lm 37144123Sbrian#endif 37244123Sbrian ) 37343888Sbrian{ 37444106Sbrian u_char *ans; 37543888Sbrian 376134789Sbrian ans = chap_BuildAnswer(name, key, chap->auth.id, chap->challenge.peer 37793418Sbrian#ifndef NODES 378134789Sbrian , type, chap->challenge.local, chap->authresponse, lm 37944123Sbrian#endif 38044123Sbrian ); 38143888Sbrian 38243888Sbrian if (ans) { 38343888Sbrian ChapOutput(chap->auth.physical, CHAP_RESPONSE, chap->auth.id, 38443888Sbrian ans, *ans + 1 + strlen(name), name); 38593418Sbrian#ifndef NODES 38644106Sbrian chap->NTRespSent = !lm; 38768461Sbrian MPPE_IsServer = 0; /* XXX Global ! */ 38844123Sbrian#endif 38943888Sbrian free(ans); 39043888Sbrian } else 39143888Sbrian ChapOutput(chap->auth.physical, CHAP_FAILURE, chap->auth.id, 39243888Sbrian "Out of memory!", 14, NULL); 39343888Sbrian} 39443888Sbrian 39543888Sbrianstatic int 396134789Sbrianchap_UpdateSet(struct fdescriptor *d, fd_set *r, fd_set *w __unused, 397134789Sbrian fd_set *e __unused, int *n) 39843888Sbrian{ 39943888Sbrian struct chap *chap = descriptor2chap(d); 40043888Sbrian 40143888Sbrian if (r && chap && chap->child.fd != -1) { 40243888Sbrian FD_SET(chap->child.fd, r); 40343888Sbrian if (*n < chap->child.fd + 1) 40443888Sbrian *n = chap->child.fd + 1; 40543888Sbrian log_Printf(LogTIMER, "Chap: fdset(r) %d\n", chap->child.fd); 40643888Sbrian return 1; 40743888Sbrian } 40843888Sbrian 40943888Sbrian return 0; 41043888Sbrian} 41143888Sbrian 41243888Sbrianstatic int 41358028Sbrianchap_IsSet(struct fdescriptor *d, const fd_set *fdset) 41443888Sbrian{ 41543888Sbrian struct chap *chap = descriptor2chap(d); 41643888Sbrian 41743888Sbrian return chap && chap->child.fd != -1 && FD_ISSET(chap->child.fd, fdset); 41843888Sbrian} 41943888Sbrian 42043888Sbrianstatic void 421134789Sbrianchap_Read(struct fdescriptor *d, struct bundle *bundle __unused, 422134789Sbrian const fd_set *fdset __unused) 42343888Sbrian{ 42443888Sbrian struct chap *chap = descriptor2chap(d); 42543888Sbrian int got; 42643888Sbrian 42743888Sbrian got = read(chap->child.fd, chap->child.buf.ptr + chap->child.buf.len, 42843888Sbrian sizeof chap->child.buf.ptr - chap->child.buf.len - 1); 42943888Sbrian if (got == -1) { 43043888Sbrian log_Printf(LogERROR, "Chap: Read: %s\n", strerror(errno)); 43143888Sbrian chap_Cleanup(chap, SIGTERM); 43243888Sbrian } else if (got == 0) { 43343888Sbrian log_Printf(LogWARN, "Chap: Read: Child terminated connection\n"); 43443888Sbrian chap_Cleanup(chap, SIGTERM); 43543888Sbrian } else { 43643888Sbrian char *name, *key, *end; 43743888Sbrian 43843888Sbrian chap->child.buf.len += got; 43943888Sbrian chap->child.buf.ptr[chap->child.buf.len] = '\0'; 44043888Sbrian name = chap->child.buf.ptr; 44143888Sbrian name += strspn(name, " \t"); 44243888Sbrian if ((key = strchr(name, '\n')) == NULL) 44343888Sbrian end = NULL; 44443888Sbrian else 44543888Sbrian end = strchr(++key, '\n'); 44643888Sbrian 44743888Sbrian if (end == NULL) { 44843888Sbrian if (chap->child.buf.len == sizeof chap->child.buf.ptr - 1) { 44943888Sbrian log_Printf(LogWARN, "Chap: Read: Input buffer overflow\n"); 45043888Sbrian chap_Cleanup(chap, SIGTERM); 45143888Sbrian } 45243888Sbrian } else { 45393418Sbrian#ifndef NODES 45444106Sbrian int lanman = chap->auth.physical->link.lcp.his_authtype == 0x80 && 45544106Sbrian ((chap->NTRespSent && 45644106Sbrian IsAccepted(chap->auth.physical->link.lcp.cfg.chap80lm)) || 45744106Sbrian !IsAccepted(chap->auth.physical->link.lcp.cfg.chap80nt)); 45844123Sbrian#endif 45944106Sbrian 46043888Sbrian while (end >= name && strchr(" \t\r\n", *end)) 46143888Sbrian *end-- = '\0'; 46243888Sbrian end = key - 1; 46343888Sbrian while (end >= name && strchr(" \t\r\n", *end)) 46443888Sbrian *end-- = '\0'; 46543888Sbrian key += strspn(key, " \t"); 46643888Sbrian 467134789Sbrian chap_Respond(chap, name, key 46893418Sbrian#ifndef NODES 469134789Sbrian , chap->auth.physical->link.lcp.his_authtype, lanman 47044123Sbrian#endif 47144123Sbrian ); 47243888Sbrian chap_Cleanup(chap, 0); 47343888Sbrian } 47443888Sbrian } 47543888Sbrian} 47643888Sbrian 47743888Sbrianstatic int 478134789Sbrianchap_Write(struct fdescriptor *d __unused, struct bundle *bundle __unused, 479134789Sbrian const fd_set *fdset __unused) 48043888Sbrian{ 48143888Sbrian /* We never want to write here ! */ 48243888Sbrian log_Printf(LogALERT, "chap_Write: Internal error: Bad call !\n"); 48343888Sbrian return 0; 48443888Sbrian} 48543888Sbrian 48643888Sbrianstatic void 48767910Sbrianchap_ChallengeInit(struct authinfo *authp) 48843693Sbrian{ 48943693Sbrian struct chap *chap = auth2chap(authp); 49013379Sphk int len, i; 4916059Samurai char *cp; 4926059Samurai 49343888Sbrian len = strlen(authp->physical->dl->bundle->cfg.auth.name); 49443401Sbrian 49545907Sbrian if (!*chap->challenge.local) { 49643888Sbrian randinit(); 49745907Sbrian cp = chap->challenge.local; 49843888Sbrian 49943313Sbrian#ifndef NORADIUS 50043888Sbrian if (*authp->physical->dl->bundle->radius.cfg.file) { 50143888Sbrian /* For radius, our challenge is 16 readable NUL terminated bytes :*/ 50243888Sbrian *cp++ = 16; 50343888Sbrian for (i = 0; i < 16; i++) 50443888Sbrian *cp++ = (random() % 10) + '0'; 50543888Sbrian } else 50643313Sbrian#endif 50743888Sbrian { 50893418Sbrian#ifndef NODES 50944106Sbrian if (authp->physical->link.lcp.want_authtype == 0x80) 51044106Sbrian *cp++ = 8; /* MS does 8 byte callenges :-/ */ 51167910Sbrian else if (authp->physical->link.lcp.want_authtype == 0x81) 51267910Sbrian *cp++ = 16; /* MS-CHAP-V2 does 16 bytes challenges */ 51344106Sbrian else 51444106Sbrian#endif 51544106Sbrian *cp++ = random() % (CHAPCHALLENGELEN-16) + 16; 51645907Sbrian for (i = 0; i < *chap->challenge.local; i++) 51743888Sbrian *cp++ = random() & 0xff; 51843888Sbrian } 51943888Sbrian memcpy(cp, authp->physical->dl->bundle->cfg.auth.name, len); 52043313Sbrian } 5216059Samurai} 5226059Samurai 52330715Sbrianstatic void 52467910Sbrianchap_Challenge(struct authinfo *authp) 52567910Sbrian{ 52667910Sbrian struct chap *chap = auth2chap(authp); 52767910Sbrian int len; 52867910Sbrian 52967912Sbrian log_Printf(LogDEBUG, "CHAP%02X: Challenge\n", 53067912Sbrian authp->physical->link.lcp.want_authtype); 53167910Sbrian 53267910Sbrian len = strlen(authp->physical->dl->bundle->cfg.auth.name); 53367910Sbrian 53467910Sbrian /* Generate new local challenge value */ 53567910Sbrian if (!*chap->challenge.local) 53667910Sbrian chap_ChallengeInit(authp); 53767910Sbrian 53893418Sbrian#ifndef NODES 53967910Sbrian if (authp->physical->link.lcp.want_authtype == 0x81) 54067910Sbrian ChapOutput(authp->physical, CHAP_CHALLENGE, authp->id, 54167910Sbrian chap->challenge.local, 1 + *chap->challenge.local, NULL); 54267910Sbrian else 54367910Sbrian#endif 54467910Sbrian ChapOutput(authp->physical, CHAP_CHALLENGE, authp->id, 54567910Sbrian chap->challenge.local, 1 + *chap->challenge.local + len, NULL); 54667910Sbrian} 54767910Sbrian 54867910Sbrianstatic void 54943693Sbrianchap_Success(struct authinfo *authp) 5506059Samurai{ 55196324Sbrian struct bundle *bundle = authp->physical->dl->bundle; 55267912Sbrian const char *msg; 55396324Sbrian 55443693Sbrian datalink_GotAuthname(authp->physical->dl, authp->in.name); 55593418Sbrian#ifndef NODES 55667910Sbrian if (authp->physical->link.lcp.want_authtype == 0x81) { 55796730Sbrian#ifndef NORADIUS 55896730Sbrian if (*bundle->radius.cfg.file && bundle->radius.msrepstr) 55996730Sbrian msg = bundle->radius.msrepstr; 56096730Sbrian else 56196731Sbrian#endif 56296730Sbrian msg = auth2chap(authp)->authresponse; 56368461Sbrian MPPE_MasterKeyValid = 1; /* XXX Global ! */ 56467910Sbrian } else 56567910Sbrian#endif 56696324Sbrian#ifndef NORADIUS 56796324Sbrian if (*bundle->radius.cfg.file && bundle->radius.repstr) 56896324Sbrian msg = bundle->radius.repstr; 56996324Sbrian else 57096324Sbrian#endif 57167910Sbrian msg = "Welcome!!"; 57267910Sbrian 57380763Sbrian ChapOutput(authp->physical, CHAP_SUCCESS, authp->id, msg, strlen(msg), 57467910Sbrian NULL); 57567910Sbrian 57643693Sbrian authp->physical->link.lcp.auth_ineed = 0; 57796324Sbrian if (Enabled(bundle, OPT_UTMP)) 57843693Sbrian physical_Login(authp->physical, authp->in.name); 5796059Samurai 58043693Sbrian if (authp->physical->link.lcp.auth_iwait == 0) 58143693Sbrian /* 58243693Sbrian * Either I didn't need to authenticate, or I've already been 58343693Sbrian * told that I got the answer right. 58443693Sbrian */ 58543693Sbrian datalink_AuthOk(authp->physical->dl); 58643693Sbrian} 5876059Samurai 58843693Sbrianstatic void 58943693Sbrianchap_Failure(struct authinfo *authp) 59043693Sbrian{ 59193418Sbrian#ifndef NODES 59296324Sbrian char buf[1024], *ptr; 59367910Sbrian#endif 59467912Sbrian const char *msg; 59567910Sbrian 59696324Sbrian#ifndef NORADIUS 59796324Sbrian struct bundle *bundle = authp->physical->link.lcp.fsm.bundle; 59896324Sbrian if (*bundle->radius.cfg.file && bundle->radius.errstr) 59996324Sbrian msg = bundle->radius.errstr; 60096324Sbrian else 60196324Sbrian#endif 60293418Sbrian#ifndef NODES 60396324Sbrian if (authp->physical->link.lcp.want_authtype == 0x80) { 60496324Sbrian sprintf(buf, "E=691 R=1 M=Invalid!"); 60596324Sbrian msg = buf; 60696324Sbrian } else if (authp->physical->link.lcp.want_authtype == 0x81) { 60767910Sbrian int i; 60867910Sbrian 60967912Sbrian ptr = buf; 61067912Sbrian ptr += sprintf(buf, "E=691 R=0 C="); 61167910Sbrian for (i=0; i<16; i++) 61267912Sbrian ptr += sprintf(ptr, "%02X", *(auth2chap(authp)->challenge.local+1+i)); 61398243Sbrian 61467912Sbrian sprintf(ptr, " V=3 M=Invalid!"); 61567910Sbrian msg = buf; 61667910Sbrian } else 61767910Sbrian#endif 61867910Sbrian msg = "Invalid!!"; 61967910Sbrian 62067910Sbrian ChapOutput(authp->physical, CHAP_FAILURE, authp->id, msg, strlen(msg) + 1, 62167910Sbrian NULL); 62243693Sbrian datalink_AuthNotOk(authp->physical->dl); 62343693Sbrian} 62437926Sbrian 62544106Sbrianstatic int 626134789Sbrianchap_Cmp(char *myans, int mylen, char *hisans, int hislen 62793418Sbrian#ifndef NODES 628134789Sbrian , u_char type, int lm 62944123Sbrian#endif 63044123Sbrian ) 63144106Sbrian{ 632122440Sbrian int off; 633122440Sbrian 63444106Sbrian if (mylen != hislen) 63544106Sbrian return 0; 636122440Sbrian 637122440Sbrian off = 0; 638122440Sbrian 63993418Sbrian#ifndef NODES 640122440Sbrian if (type == 0x80) { 641122440Sbrian off = lm ? 0 : 24; 642122440Sbrian mylen = 24; 64344123Sbrian } 64444123Sbrian#endif 64544106Sbrian 646122440Sbrian for (; mylen; off++, mylen--) 647122440Sbrian if (toupper(myans[off]) != toupper(hisans[off])) 648122440Sbrian return 0; 649122440Sbrian 65044106Sbrian return 1; 65144106Sbrian} 65244106Sbrian 65393418Sbrian#ifndef NODES 65444106Sbrianstatic int 65544106Sbrianchap_HaveAnotherGo(struct chap *chap) 65644106Sbrian{ 65744106Sbrian if (++chap->peertries < 3) { 65844106Sbrian /* Give the peer another shot */ 65945907Sbrian *chap->challenge.local = '\0'; 66044106Sbrian chap_Challenge(&chap->auth); 66144106Sbrian return 1; 66244106Sbrian } 66344106Sbrian 66444106Sbrian return 0; 66544106Sbrian} 66644123Sbrian#endif 66744106Sbrian 66843693Sbrianvoid 66943693Sbrianchap_Init(struct chap *chap, struct physical *p) 67043693Sbrian{ 67143888Sbrian chap->desc.type = CHAP_DESCRIPTOR; 67243888Sbrian chap->desc.UpdateSet = chap_UpdateSet; 67343888Sbrian chap->desc.IsSet = chap_IsSet; 67443888Sbrian chap->desc.Read = chap_Read; 67543888Sbrian chap->desc.Write = chap_Write; 67643888Sbrian chap->child.pid = 0; 67743888Sbrian chap->child.fd = -1; 67843693Sbrian auth_Init(&chap->auth, p, chap_Challenge, chap_Success, chap_Failure); 67945907Sbrian *chap->challenge.local = *chap->challenge.peer = '\0'; 68093418Sbrian#ifndef NODES 68144106Sbrian chap->NTRespSent = 0; 68244106Sbrian chap->peertries = 0; 68344123Sbrian#endif 68443693Sbrian} 68529840Sbrian 68643693Sbrianvoid 68743888Sbrianchap_ReInit(struct chap *chap) 68843888Sbrian{ 68943888Sbrian chap_Cleanup(chap, SIGTERM); 69043888Sbrian} 69143888Sbrian 69246686Sbrianstruct mbuf * 69346686Sbrianchap_Input(struct bundle *bundle, struct link *l, struct mbuf *bp) 69443693Sbrian{ 69546686Sbrian struct physical *p = link2physical(l); 69643693Sbrian struct chap *chap = &p->dl->chap; 69744106Sbrian char *name, *key, *ans; 698134789Sbrian int len; 699134789Sbrian size_t nlen; 70048817Sbrian u_char alen; 70193418Sbrian#ifndef NODES 70244123Sbrian int lanman; 70344123Sbrian#endif 70429840Sbrian 70546686Sbrian if (p == NULL) { 70646686Sbrian log_Printf(LogERROR, "chap_Input: Not a physical link - dropped\n"); 70754912Sbrian m_freem(bp); 70846686Sbrian return NULL; 70946686Sbrian } 71046686Sbrian 71146686Sbrian if (bundle_Phase(bundle) != PHASE_NETWORK && 71246686Sbrian bundle_Phase(bundle) != PHASE_AUTHENTICATE) { 71345220Sbrian log_Printf(LogPHASE, "Unexpected chap input - dropped !\n"); 71454912Sbrian m_freem(bp); 71546686Sbrian return NULL; 71645220Sbrian } 71745220Sbrian 71854912Sbrian m_settype(bp, MB_CHAPIN); 71944159Sbrian if ((bp = auth_ReadHeader(&chap->auth, bp)) == NULL && 72044159Sbrian ntohs(chap->auth.in.hdr.length) == 0) 72144159Sbrian log_Printf(LogWARN, "Chap Input: Truncated header !\n"); 72243693Sbrian else if (chap->auth.in.hdr.code == 0 || chap->auth.in.hdr.code > MAXCHAPCODE) 72343693Sbrian log_Printf(LogPHASE, "Chap Input: %d: Bad CHAP code !\n", 72443693Sbrian chap->auth.in.hdr.code); 72543693Sbrian else { 72654912Sbrian len = m_length(bp); 72743693Sbrian ans = NULL; 72843693Sbrian 72943693Sbrian if (chap->auth.in.hdr.code != CHAP_CHALLENGE && 73043693Sbrian chap->auth.id != chap->auth.in.hdr.id && 73146686Sbrian Enabled(bundle, OPT_IDCHECK)) { 73243693Sbrian /* Wrong conversation dude ! */ 73343693Sbrian log_Printf(LogPHASE, "Chap Input: %s dropped (got id %d, not %d)\n", 73443693Sbrian chapcodes[chap->auth.in.hdr.code], chap->auth.in.hdr.id, 73543693Sbrian chap->auth.id); 73654912Sbrian m_freem(bp); 73746686Sbrian return NULL; 73825630Sbrian } 73943693Sbrian chap->auth.id = chap->auth.in.hdr.id; /* We respond with this id */ 74029840Sbrian 74193418Sbrian#ifndef NODES 74244106Sbrian lanman = 0; 74344123Sbrian#endif 74443693Sbrian switch (chap->auth.in.hdr.code) { 74543693Sbrian case CHAP_CHALLENGE: 74644106Sbrian bp = mbuf_Read(bp, &alen, 1); 74744106Sbrian len -= alen + 1; 74843693Sbrian if (len < 0) { 74943693Sbrian log_Printf(LogERROR, "Chap Input: Truncated challenge !\n"); 75054912Sbrian m_freem(bp); 75146686Sbrian return NULL; 75243693Sbrian } 75345907Sbrian *chap->challenge.peer = alen; 75445907Sbrian bp = mbuf_Read(bp, chap->challenge.peer + 1, alen); 75543693Sbrian bp = auth_ReadName(&chap->auth, bp, len); 75693418Sbrian#ifndef NODES 75744106Sbrian lanman = p->link.lcp.his_authtype == 0x80 && 75844106Sbrian ((chap->NTRespSent && IsAccepted(p->link.lcp.cfg.chap80lm)) || 75944106Sbrian !IsAccepted(p->link.lcp.cfg.chap80nt)); 76067910Sbrian 76167910Sbrian /* Generate local challenge value */ 76267910Sbrian chap_ChallengeInit(&chap->auth); 76344123Sbrian#endif 76443693Sbrian break; 76543313Sbrian 76643693Sbrian case CHAP_RESPONSE: 76743693Sbrian auth_StopTimer(&chap->auth); 76843693Sbrian bp = mbuf_Read(bp, &alen, 1); 76943693Sbrian len -= alen + 1; 77043693Sbrian if (len < 0) { 77143693Sbrian log_Printf(LogERROR, "Chap Input: Truncated response !\n"); 77254912Sbrian m_freem(bp); 77346686Sbrian return NULL; 77443693Sbrian } 77598311Sbrian if ((ans = malloc(alen + 1)) == NULL) { 77643693Sbrian log_Printf(LogERROR, "Chap Input: Out of memory !\n"); 77754912Sbrian m_freem(bp); 77846686Sbrian return NULL; 77943693Sbrian } 78043693Sbrian *ans = chap->auth.id; 78143693Sbrian bp = mbuf_Read(bp, ans + 1, alen); 78243693Sbrian bp = auth_ReadName(&chap->auth, bp, len); 78393418Sbrian#ifndef NODES 78498243Sbrian lanman = p->link.lcp.want_authtype == 0x80 && 78567910Sbrian alen == 49 && ans[alen] == 0; 78644123Sbrian#endif 78743693Sbrian break; 78843313Sbrian 78943693Sbrian case CHAP_SUCCESS: 79043693Sbrian case CHAP_FAILURE: 79143693Sbrian /* chap->auth.in.name is already set up at CHALLENGE time */ 79243693Sbrian if ((ans = malloc(len + 1)) == NULL) { 79343693Sbrian log_Printf(LogERROR, "Chap Input: Out of memory !\n"); 79454912Sbrian m_freem(bp); 79546686Sbrian return NULL; 79643693Sbrian } 79743693Sbrian bp = mbuf_Read(bp, ans, len); 79843693Sbrian ans[len] = '\0'; 79943693Sbrian break; 80043401Sbrian } 80136285Sbrian 80243693Sbrian switch (chap->auth.in.hdr.code) { 80343693Sbrian case CHAP_CHALLENGE: 80443693Sbrian case CHAP_RESPONSE: 80543693Sbrian if (*chap->auth.in.name) 80644106Sbrian log_Printf(LogPHASE, "Chap Input: %s (%d bytes from %s%s)\n", 80744106Sbrian chapcodes[chap->auth.in.hdr.code], alen, 80844106Sbrian chap->auth.in.name, 80993418Sbrian#ifndef NODES 81044106Sbrian lanman && chap->auth.in.hdr.code == CHAP_RESPONSE ? 81144123Sbrian " - lanman" : 81244123Sbrian#endif 81344123Sbrian ""); 81443693Sbrian else 81544106Sbrian log_Printf(LogPHASE, "Chap Input: %s (%d bytes%s)\n", 81644106Sbrian chapcodes[chap->auth.in.hdr.code], alen, 81793418Sbrian#ifndef NODES 81844106Sbrian lanman && chap->auth.in.hdr.code == CHAP_RESPONSE ? 81944123Sbrian " - lanman" : 82044123Sbrian#endif 82144123Sbrian ""); 82243693Sbrian break; 82336285Sbrian 82443693Sbrian case CHAP_SUCCESS: 82543693Sbrian case CHAP_FAILURE: 82643693Sbrian if (*ans) 82743693Sbrian log_Printf(LogPHASE, "Chap Input: %s (%s)\n", 82843693Sbrian chapcodes[chap->auth.in.hdr.code], ans); 82943693Sbrian else 83043693Sbrian log_Printf(LogPHASE, "Chap Input: %s\n", 83143693Sbrian chapcodes[chap->auth.in.hdr.code]); 83243693Sbrian break; 8336059Samurai } 8346059Samurai 83543693Sbrian switch (chap->auth.in.hdr.code) { 83643693Sbrian case CHAP_CHALLENGE: 83764465Sbrian if (*bundle->cfg.auth.key == '!' && bundle->cfg.auth.key[1] != '!') 83846686Sbrian chap_StartChild(chap, bundle->cfg.auth.key + 1, 83946686Sbrian bundle->cfg.auth.name); 84043888Sbrian else 84164465Sbrian chap_Respond(chap, bundle->cfg.auth.name, bundle->cfg.auth.key + 842134789Sbrian (*bundle->cfg.auth.key == '!' ? 1 : 0) 843134789Sbrian 84493418Sbrian#ifndef NODES 845134789Sbrian , p->link.lcp.his_authtype, lanman 84644123Sbrian#endif 84744123Sbrian ); 84843693Sbrian break; 8496059Samurai 85043693Sbrian case CHAP_RESPONSE: 85143693Sbrian name = chap->auth.in.name; 85243693Sbrian nlen = strlen(name); 85396730Sbrian#ifndef NODES 85496730Sbrian if (p->link.lcp.want_authtype == 0x81) { 85598311Sbrian struct MSCHAPv2_resp *resp = (struct MSCHAPv2_resp *)(ans + 1); 85698311Sbrian 85798311Sbrian chap->challenge.peer[0] = sizeof resp->PeerChallenge; 85898311Sbrian memcpy(chap->challenge.peer + 1, resp->PeerChallenge, 85998311Sbrian sizeof resp->PeerChallenge); 86096730Sbrian } 86196730Sbrian#endif 86296730Sbrian 86343693Sbrian#ifndef NORADIUS 86496730Sbrian if (*bundle->radius.cfg.file) { 86596730Sbrian if (!radius_Authenticate(&bundle->radius, &chap->auth, 86696730Sbrian chap->auth.in.name, ans, alen + 1, 86796730Sbrian chap->challenge.local + 1, 86898311Sbrian *chap->challenge.local)) 86996730Sbrian chap_Failure(&chap->auth); 87096730Sbrian } else 87143693Sbrian#endif 87243693Sbrian { 87398311Sbrian if (p->link.lcp.want_authtype == 0x81 && ans[alen] != '\0' && 87498311Sbrian alen == sizeof(struct MSCHAPv2_resp)) { 87598311Sbrian struct MSCHAPv2_resp *resp = (struct MSCHAPv2_resp *)(ans + 1); 87698311Sbrian 87798311Sbrian log_Printf(LogWARN, "%s: Compensating for corrupt (Win98/WinME?) " 87898311Sbrian "CHAP81 RESPONSE\n", l->name); 87998311Sbrian resp->Flags = '\0'; /* rfc2759 says it *MUST* be zero */ 88098311Sbrian } 881134789Sbrian key = auth_GetSecret(name, nlen); 88243693Sbrian if (key) { 88393418Sbrian#ifndef NODES 88467910Sbrian if (p->link.lcp.want_authtype == 0x80 && 88567910Sbrian lanman && !IsEnabled(p->link.lcp.cfg.chap80lm)) { 88644106Sbrian log_Printf(LogPHASE, "Auth failure: LANMan not enabled\n"); 88744106Sbrian if (chap_HaveAnotherGo(chap)) 88844106Sbrian break; 88943693Sbrian key = NULL; 89067910Sbrian } else if (p->link.lcp.want_authtype == 0x80 && 89167910Sbrian !lanman && !IsEnabled(p->link.lcp.cfg.chap80nt)) { 89244106Sbrian log_Printf(LogPHASE, "Auth failure: mschap not enabled\n"); 89344106Sbrian if (chap_HaveAnotherGo(chap)) 89444106Sbrian break; 89544106Sbrian key = NULL; 89667910Sbrian } else if (p->link.lcp.want_authtype == 0x81 && 89767910Sbrian !IsEnabled(p->link.lcp.cfg.chap81)) { 89867910Sbrian log_Printf(LogPHASE, "Auth failure: CHAP81 not enabled\n"); 89967910Sbrian key = NULL; 90044123Sbrian } else 90144123Sbrian#endif 90244123Sbrian { 90398311Sbrian char *myans = chap_BuildAnswer(name, key, chap->auth.id, 904134789Sbrian chap->challenge.local 90593418Sbrian#ifndef NODES 906134789Sbrian , p->link.lcp.want_authtype, 907134789Sbrian chap->challenge.peer, 908134789Sbrian chap->authresponse, lanman); 90968461Sbrian MPPE_IsServer = 1; /* XXX Global ! */ 91068461Sbrian#else 91168461Sbrian ); 91244123Sbrian#endif 91344106Sbrian if (myans == NULL) 91443693Sbrian key = NULL; 91544106Sbrian else { 916134789Sbrian if (!chap_Cmp(myans + 1, *myans, ans + 1, alen 91793418Sbrian#ifndef NODES 918134789Sbrian , p->link.lcp.want_authtype, lanman 91944123Sbrian#endif 92044123Sbrian )) 92144106Sbrian key = NULL; 92244106Sbrian free(myans); 92344106Sbrian } 92443693Sbrian } 92543693Sbrian } 9266059Samurai 92743693Sbrian if (key) 92843693Sbrian chap_Success(&chap->auth); 92943693Sbrian else 93043693Sbrian chap_Failure(&chap->auth); 93143693Sbrian } 9326059Samurai 93343693Sbrian break; 9346059Samurai 9356059Samurai case CHAP_SUCCESS: 93643693Sbrian if (p->link.lcp.auth_iwait == PROTO_CHAP) { 93743693Sbrian p->link.lcp.auth_iwait = 0; 93867910Sbrian if (p->link.lcp.auth_ineed == 0) { 93993418Sbrian#ifndef NODES 94067910Sbrian if (p->link.lcp.his_authtype == 0x81) { 941100916Sbrian if (strncasecmp(ans, chap->authresponse, 42)) { 94267910Sbrian datalink_AuthNotOk(p->dl); 94381094Sbrian log_Printf(LogWARN, "CHAP81: AuthenticatorResponse: (%.42s)" 94481094Sbrian " != ans: (%.42s)\n", chap->authresponse, ans); 94598243Sbrian 94667910Sbrian } else { 94767910Sbrian /* Successful login */ 94868461Sbrian MPPE_MasterKeyValid = 1; /* XXX Global ! */ 94967910Sbrian datalink_AuthOk(p->dl); 95067910Sbrian } 95167910Sbrian } else 95267910Sbrian#endif 95343693Sbrian /* 95443693Sbrian * We've succeeded in our ``login'' 95543693Sbrian * If we're not expecting the peer to authenticate (or he already 95643693Sbrian * has), proceed to network phase. 95743693Sbrian */ 95843693Sbrian datalink_AuthOk(p->dl); 95967910Sbrian } 96043693Sbrian } 96143693Sbrian break; 96243693Sbrian 9636059Samurai case CHAP_FAILURE: 96443693Sbrian datalink_AuthNotOk(p->dl); 96543693Sbrian break; 9666059Samurai } 96743693Sbrian free(ans); 9686059Samurai } 96943693Sbrian 97054912Sbrian m_freem(bp); 97146686Sbrian return NULL; 9726059Samurai} 973