chap.c revision 48817
16059Samurai/* 26059Samurai * PPP CHAP Module 36059Samurai * 46059Samurai * Written by Toshiharu OHNO (tony-o@iij.ad.jp) 56059Samurai * 66059Samurai * Copyright (C) 1993, Internet Initiative Japan, Inc. All rights reserverd. 76059Samurai * 86059Samurai * Redistribution and use in source and binary forms are permitted 96059Samurai * provided that the above copyright notice and this paragraph are 106059Samurai * duplicated in all such forms and that any documentation, 116059Samurai * advertising materials, and other materials related to such 126059Samurai * distribution and use acknowledge that the software was developed 136059Samurai * by the Internet Initiative Japan, Inc. The name of the 146059Samurai * IIJ may not be used to endorse or promote products derived 156059Samurai * from this software without specific prior written permission. 166059Samurai * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 176059Samurai * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 186059Samurai * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. 198857Srgrimes * 2048817Sbrian * $Id: chap.c,v 1.52 1999/06/09 08:47:29 brian Exp $ 218857Srgrimes * 226059Samurai * TODO: 236059Samurai */ 2443313Sbrian#include <sys/param.h> 2530715Sbrian#include <netinet/in.h> 2636285Sbrian#include <netinet/in_systm.h> 2736285Sbrian#include <netinet/ip.h> 2836285Sbrian#include <sys/un.h> 2930715Sbrian 3043888Sbrian#include <errno.h> 3143888Sbrian#include <fcntl.h> 3237192Sbrian#ifdef HAVE_DES 3336287Sbrian#include <md4.h> 3437192Sbrian#endif 3530715Sbrian#include <md5.h> 3643888Sbrian#include <paths.h> 3743888Sbrian#include <signal.h> 3830715Sbrian#include <stdlib.h> 3944106Sbrian#include <string.h> 4043888Sbrian#include <sys/wait.h> 4136285Sbrian#include <termios.h> 4243888Sbrian#include <unistd.h> 4329840Sbrian 4446686Sbrian#include "layer.h" 4530715Sbrian#include "mbuf.h" 4630715Sbrian#include "log.h" 4730715Sbrian#include "defs.h" 4830715Sbrian#include "timer.h" 496059Samurai#include "fsm.h" 5046686Sbrian#include "proto.h" 516059Samurai#include "lcp.h" 5236285Sbrian#include "lqr.h" 536059Samurai#include "hdlc.h" 546735Samurai#include "auth.h" 5536285Sbrian#include "async.h" 5636285Sbrian#include "throughput.h" 5736285Sbrian#include "descriptor.h" 5843888Sbrian#include "chap.h" 5936285Sbrian#include "iplist.h" 6036285Sbrian#include "slcompress.h" 6136285Sbrian#include "ipcp.h" 6236285Sbrian#include "filter.h" 6336285Sbrian#include "ccp.h" 6436285Sbrian#include "link.h" 6536285Sbrian#include "physical.h" 6636285Sbrian#include "mp.h" 6743313Sbrian#ifndef NORADIUS 6843313Sbrian#include "radius.h" 6943313Sbrian#endif 7036285Sbrian#include "bundle.h" 7136285Sbrian#include "chat.h" 7238174Sbrian#include "cbcp.h" 7343888Sbrian#include "command.h" 7436285Sbrian#include "datalink.h" 7537192Sbrian#ifdef HAVE_DES 7636287Sbrian#include "chap_ms.h" 7737192Sbrian#endif 786059Samurai 7931343Sbrianstatic const char *chapcodes[] = { 8019866Sphk "???", "CHALLENGE", "RESPONSE", "SUCCESS", "FAILURE" 816059Samurai}; 8243693Sbrian#define MAXCHAPCODE (sizeof chapcodes / sizeof chapcodes[0] - 1) 836059Samurai 8430715Sbrianstatic void 8536285SbrianChapOutput(struct physical *physical, u_int code, u_int id, 8643693Sbrian const u_char *ptr, int count, const char *text) 876059Samurai{ 886059Samurai int plen; 896059Samurai struct fsmheader lh; 906059Samurai struct mbuf *bp; 916059Samurai 9228679Sbrian plen = sizeof(struct fsmheader) + count; 936059Samurai lh.code = code; 946059Samurai lh.id = id; 956059Samurai lh.length = htons(plen); 9647695Sbrian bp = mbuf_Alloc(plen, MB_CHAPOUT); 9730715Sbrian memcpy(MBUF_CTOP(bp), &lh, sizeof(struct fsmheader)); 986059Samurai if (count) 9930715Sbrian memcpy(MBUF_CTOP(bp) + sizeof(struct fsmheader), ptr, count); 10036285Sbrian log_DumpBp(LogDEBUG, "ChapOutput", bp); 10137926Sbrian if (text == NULL) 10237926Sbrian log_Printf(LogPHASE, "Chap Output: %s\n", chapcodes[code]); 10337926Sbrian else 10437926Sbrian log_Printf(LogPHASE, "Chap Output: %s (%s)\n", chapcodes[code], text); 10546686Sbrian link_PushPacket(&physical->link, bp, physical->dl->bundle, 10646686Sbrian PRI_LINK, PROTO_CHAP); 1076059Samurai} 1086059Samurai 10943693Sbrianstatic char * 11044123Sbrianchap_BuildAnswer(char *name, char *key, u_char id, char *challenge, u_char type 11144123Sbrian#ifdef HAVE_DES 11244123Sbrian , int lanman 11344123Sbrian#endif 11444123Sbrian ) 1156059Samurai{ 11643693Sbrian char *result, *digest; 11743693Sbrian size_t nlen, klen; 11843693Sbrian 11943693Sbrian nlen = strlen(name); 12043693Sbrian klen = strlen(key); 12143693Sbrian 12243693Sbrian#ifdef HAVE_DES 12344106Sbrian if (type == 0x80) { 12443693Sbrian char expkey[AUTHLEN << 2]; 12543693Sbrian MD4_CTX MD4context; 12643693Sbrian int f; 12743693Sbrian 12843693Sbrian if ((result = malloc(1 + nlen + MS_CHAP_RESPONSE_LEN)) == NULL) 12943693Sbrian return result; 13043693Sbrian 13144106Sbrian digest = result; /* the response */ 13244106Sbrian *digest++ = MS_CHAP_RESPONSE_LEN; /* 49 */ 13344106Sbrian memcpy(digest + MS_CHAP_RESPONSE_LEN, name, nlen); 13444106Sbrian if (lanman) { 13544106Sbrian memset(digest + 24, '\0', 25); 13644106Sbrian mschap_LANMan(digest, challenge + 1, key); /* LANMan response */ 13744106Sbrian } else { 13844106Sbrian memset(digest, '\0', 25); 13944106Sbrian digest += 24; 14043693Sbrian 14144106Sbrian for (f = 0; f < klen; f++) { 14244106Sbrian expkey[2*f] = key[f]; 14344106Sbrian expkey[2*f+1] = '\0'; 14444106Sbrian } 14544106Sbrian /* 14644106Sbrian * ----------- 14744106Sbrian * expkey = | k\0e\0y\0 | 14844106Sbrian * ----------- 14944106Sbrian */ 15044106Sbrian MD4Init(&MD4context); 15144106Sbrian MD4Update(&MD4context, expkey, klen << 1); 15244106Sbrian MD4Final(digest, &MD4context); 15344106Sbrian 15444106Sbrian /* 15544106Sbrian * ---- -------- ---------------- ------- ------ 15644106Sbrian * result = | 49 | LANMan | 16 byte digest | 9 * ? | name | 15744106Sbrian * ---- -------- ---------------- ------- ------ 15844106Sbrian */ 15944106Sbrian mschap_NT(digest, challenge + 1); 16043693Sbrian } 16143693Sbrian /* 16244106Sbrian * ---- -------- ------------- ----- ------ 16344106Sbrian * | | struct MS_ChapResponse24 | | 16444106Sbrian * result = | 49 | LANMan | NT digest | 0/1 | name | 16544106Sbrian * ---- -------- ------------- ----- ------ 16644106Sbrian * where only one of LANMan & NT digest are set. 16743693Sbrian */ 16843693Sbrian } else 16943693Sbrian#endif 17043693Sbrian if ((result = malloc(nlen + 17)) != NULL) { 17143693Sbrian /* Normal MD5 stuff */ 17243693Sbrian MD5_CTX MD5context; 17343693Sbrian 17443693Sbrian digest = result; 17543693Sbrian *digest++ = 16; /* value size */ 17643693Sbrian 17743693Sbrian MD5Init(&MD5context); 17843693Sbrian MD5Update(&MD5context, &id, 1); 17943693Sbrian MD5Update(&MD5context, key, klen); 18043693Sbrian MD5Update(&MD5context, challenge + 1, *challenge); 18143693Sbrian MD5Final(digest, &MD5context); 18243693Sbrian 18343693Sbrian memcpy(digest + 16, name, nlen); 18443693Sbrian /* 18543693Sbrian * ---- -------- ------ 18643693Sbrian * result = | 16 | digest | name | 18743693Sbrian * ---- -------- ------ 18843693Sbrian */ 18943693Sbrian } 19043693Sbrian 19143693Sbrian return result; 19243693Sbrian} 19343693Sbrian 19443693Sbrianstatic void 19543888Sbrianchap_StartChild(struct chap *chap, char *prog, const char *name) 19643888Sbrian{ 19743888Sbrian char *argv[MAXARGS], *nargv[MAXARGS]; 19843888Sbrian int argc, fd; 19943888Sbrian int in[2], out[2]; 20047849Sbrian pid_t pid; 20143888Sbrian 20243888Sbrian if (chap->child.fd != -1) { 20343888Sbrian log_Printf(LogWARN, "Chap: %s: Program already running\n", prog); 20443888Sbrian return; 20543888Sbrian } 20643888Sbrian 20743888Sbrian if (pipe(in) == -1) { 20843888Sbrian log_Printf(LogERROR, "Chap: pipe: %s\n", strerror(errno)); 20943888Sbrian return; 21043888Sbrian } 21143888Sbrian 21243888Sbrian if (pipe(out) == -1) { 21343888Sbrian log_Printf(LogERROR, "Chap: pipe: %s\n", strerror(errno)); 21443888Sbrian close(in[0]); 21543888Sbrian close(in[1]); 21643888Sbrian return; 21743888Sbrian } 21843888Sbrian 21947849Sbrian pid = getpid(); 22043888Sbrian switch ((chap->child.pid = fork())) { 22143888Sbrian case -1: 22243888Sbrian log_Printf(LogERROR, "Chap: fork: %s\n", strerror(errno)); 22343888Sbrian close(in[0]); 22443888Sbrian close(in[1]); 22543888Sbrian close(out[0]); 22643888Sbrian close(out[1]); 22743888Sbrian chap->child.pid = 0; 22843888Sbrian return; 22943888Sbrian 23043888Sbrian case 0: 23143888Sbrian timer_TermService(); 23243888Sbrian close(in[1]); 23343888Sbrian close(out[0]); 23443888Sbrian if (out[1] == STDIN_FILENO) { 23543888Sbrian fd = dup(out[1]); 23643888Sbrian close(out[1]); 23743888Sbrian out[1] = fd; 23843888Sbrian } 23943888Sbrian dup2(in[0], STDIN_FILENO); 24043888Sbrian dup2(out[1], STDOUT_FILENO); 24143888Sbrian if ((fd = open(_PATH_DEVNULL, O_RDWR)) == -1) { 24243888Sbrian log_Printf(LogALERT, "Chap: Failed to open %s: %s\n", 24343888Sbrian _PATH_DEVNULL, strerror(errno)); 24443888Sbrian exit(1); 24543888Sbrian } 24643888Sbrian dup2(fd, STDERR_FILENO); 24743888Sbrian fcntl(3, F_SETFD, 1); /* Set close-on-exec flag */ 24843888Sbrian 24943888Sbrian setuid(geteuid()); 25043888Sbrian argc = command_Interpret(prog, strlen(prog), argv); 25143888Sbrian command_Expand(nargv, argc, (char const *const *)argv, 25247849Sbrian chap->auth.physical->dl->bundle, 0, pid); 25343888Sbrian execvp(nargv[0], nargv); 25443888Sbrian 25543888Sbrian log_Printf(LogWARN, "exec() of %s failed: %s\n", 25643888Sbrian nargv[0], strerror(errno)); 25743888Sbrian exit(255); 25843888Sbrian 25943888Sbrian default: 26043888Sbrian close(in[0]); 26143888Sbrian close(out[1]); 26243888Sbrian chap->child.fd = out[0]; 26343888Sbrian chap->child.buf.len = 0; 26443888Sbrian write(in[1], chap->auth.in.name, strlen(chap->auth.in.name)); 26543888Sbrian write(in[1], "\n", 1); 26645907Sbrian write(in[1], chap->challenge.peer + 1, *chap->challenge.peer); 26743888Sbrian write(in[1], "\n", 1); 26843888Sbrian write(in[1], name, strlen(name)); 26943888Sbrian write(in[1], "\n", 1); 27043888Sbrian close(in[1]); 27143888Sbrian break; 27243888Sbrian } 27343888Sbrian} 27443888Sbrian 27543888Sbrianstatic void 27643888Sbrianchap_Cleanup(struct chap *chap, int sig) 27743888Sbrian{ 27843888Sbrian if (chap->child.pid) { 27943888Sbrian int status; 28043888Sbrian 28143888Sbrian close(chap->child.fd); 28243888Sbrian chap->child.fd = -1; 28343888Sbrian if (sig) 28443888Sbrian kill(chap->child.pid, SIGTERM); 28543888Sbrian chap->child.pid = 0; 28643888Sbrian chap->child.buf.len = 0; 28743888Sbrian 28843888Sbrian if (wait(&status) == -1) 28943888Sbrian log_Printf(LogERROR, "Chap: wait: %s\n", strerror(errno)); 29043888Sbrian else if (WIFSIGNALED(status)) 29143888Sbrian log_Printf(LogWARN, "Chap: Child received signal %d\n", WTERMSIG(status)); 29243888Sbrian else if (WIFEXITED(status) && WEXITSTATUS(status)) 29343888Sbrian log_Printf(LogERROR, "Chap: Child exited %d\n", WEXITSTATUS(status)); 29443888Sbrian } 29545907Sbrian *chap->challenge.local = *chap->challenge.peer = '\0'; 29644123Sbrian#ifdef HAVE_DES 29744106Sbrian chap->peertries = 0; 29844123Sbrian#endif 29943888Sbrian} 30043888Sbrian 30143888Sbrianstatic void 30244123Sbrianchap_Respond(struct chap *chap, char *name, char *key, u_char type 30344123Sbrian#ifdef HAVE_DES 30444123Sbrian , int lm 30544123Sbrian#endif 30644123Sbrian ) 30743888Sbrian{ 30844106Sbrian u_char *ans; 30943888Sbrian 31045907Sbrian ans = chap_BuildAnswer(name, key, chap->auth.id, chap->challenge.peer, type 31144123Sbrian#ifdef HAVE_DES 31244123Sbrian , lm 31344123Sbrian#endif 31444123Sbrian ); 31543888Sbrian 31643888Sbrian if (ans) { 31743888Sbrian ChapOutput(chap->auth.physical, CHAP_RESPONSE, chap->auth.id, 31843888Sbrian ans, *ans + 1 + strlen(name), name); 31944123Sbrian#ifdef HAVE_DES 32044106Sbrian chap->NTRespSent = !lm; 32144123Sbrian#endif 32243888Sbrian free(ans); 32343888Sbrian } else 32443888Sbrian ChapOutput(chap->auth.physical, CHAP_FAILURE, chap->auth.id, 32543888Sbrian "Out of memory!", 14, NULL); 32643888Sbrian} 32743888Sbrian 32843888Sbrianstatic int 32943888Sbrianchap_UpdateSet(struct descriptor *d, fd_set *r, fd_set *w, fd_set *e, int *n) 33043888Sbrian{ 33143888Sbrian struct chap *chap = descriptor2chap(d); 33243888Sbrian 33343888Sbrian if (r && chap && chap->child.fd != -1) { 33443888Sbrian FD_SET(chap->child.fd, r); 33543888Sbrian if (*n < chap->child.fd + 1) 33643888Sbrian *n = chap->child.fd + 1; 33743888Sbrian log_Printf(LogTIMER, "Chap: fdset(r) %d\n", chap->child.fd); 33843888Sbrian return 1; 33943888Sbrian } 34043888Sbrian 34143888Sbrian return 0; 34243888Sbrian} 34343888Sbrian 34443888Sbrianstatic int 34543888Sbrianchap_IsSet(struct descriptor *d, const fd_set *fdset) 34643888Sbrian{ 34743888Sbrian struct chap *chap = descriptor2chap(d); 34843888Sbrian 34943888Sbrian return chap && chap->child.fd != -1 && FD_ISSET(chap->child.fd, fdset); 35043888Sbrian} 35143888Sbrian 35243888Sbrianstatic void 35343888Sbrianchap_Read(struct descriptor *d, struct bundle *bundle, const fd_set *fdset) 35443888Sbrian{ 35543888Sbrian struct chap *chap = descriptor2chap(d); 35643888Sbrian int got; 35743888Sbrian 35843888Sbrian got = read(chap->child.fd, chap->child.buf.ptr + chap->child.buf.len, 35943888Sbrian sizeof chap->child.buf.ptr - chap->child.buf.len - 1); 36043888Sbrian if (got == -1) { 36143888Sbrian log_Printf(LogERROR, "Chap: Read: %s\n", strerror(errno)); 36243888Sbrian chap_Cleanup(chap, SIGTERM); 36343888Sbrian } else if (got == 0) { 36443888Sbrian log_Printf(LogWARN, "Chap: Read: Child terminated connection\n"); 36543888Sbrian chap_Cleanup(chap, SIGTERM); 36643888Sbrian } else { 36743888Sbrian char *name, *key, *end; 36843888Sbrian 36943888Sbrian chap->child.buf.len += got; 37043888Sbrian chap->child.buf.ptr[chap->child.buf.len] = '\0'; 37143888Sbrian name = chap->child.buf.ptr; 37243888Sbrian name += strspn(name, " \t"); 37343888Sbrian if ((key = strchr(name, '\n')) == NULL) 37443888Sbrian end = NULL; 37543888Sbrian else 37643888Sbrian end = strchr(++key, '\n'); 37743888Sbrian 37843888Sbrian if (end == NULL) { 37943888Sbrian if (chap->child.buf.len == sizeof chap->child.buf.ptr - 1) { 38043888Sbrian log_Printf(LogWARN, "Chap: Read: Input buffer overflow\n"); 38143888Sbrian chap_Cleanup(chap, SIGTERM); 38243888Sbrian } 38343888Sbrian } else { 38444123Sbrian#ifdef HAVE_DES 38544106Sbrian int lanman = chap->auth.physical->link.lcp.his_authtype == 0x80 && 38644106Sbrian ((chap->NTRespSent && 38744106Sbrian IsAccepted(chap->auth.physical->link.lcp.cfg.chap80lm)) || 38844106Sbrian !IsAccepted(chap->auth.physical->link.lcp.cfg.chap80nt)); 38944123Sbrian#endif 39044106Sbrian 39143888Sbrian while (end >= name && strchr(" \t\r\n", *end)) 39243888Sbrian *end-- = '\0'; 39343888Sbrian end = key - 1; 39443888Sbrian while (end >= name && strchr(" \t\r\n", *end)) 39543888Sbrian *end-- = '\0'; 39643888Sbrian key += strspn(key, " \t"); 39743888Sbrian 39844123Sbrian chap_Respond(chap, name, key, chap->auth.physical->link.lcp.his_authtype 39944123Sbrian#ifdef HAVE_DES 40044123Sbrian , lanman 40144123Sbrian#endif 40244123Sbrian ); 40343888Sbrian chap_Cleanup(chap, 0); 40443888Sbrian } 40543888Sbrian } 40643888Sbrian} 40743888Sbrian 40843888Sbrianstatic int 40943888Sbrianchap_Write(struct descriptor *d, struct bundle *bundle, const fd_set *fdset) 41043888Sbrian{ 41143888Sbrian /* We never want to write here ! */ 41243888Sbrian log_Printf(LogALERT, "chap_Write: Internal error: Bad call !\n"); 41343888Sbrian return 0; 41443888Sbrian} 41543888Sbrian 41643888Sbrianstatic void 41743693Sbrianchap_Challenge(struct authinfo *authp) 41843693Sbrian{ 41943693Sbrian struct chap *chap = auth2chap(authp); 42013379Sphk int len, i; 4216059Samurai char *cp; 4226059Samurai 42343888Sbrian len = strlen(authp->physical->dl->bundle->cfg.auth.name); 42443401Sbrian 42545907Sbrian if (!*chap->challenge.local) { 42643888Sbrian randinit(); 42745907Sbrian cp = chap->challenge.local; 42843888Sbrian 42943313Sbrian#ifndef NORADIUS 43043888Sbrian if (*authp->physical->dl->bundle->radius.cfg.file) { 43143888Sbrian /* For radius, our challenge is 16 readable NUL terminated bytes :*/ 43243888Sbrian *cp++ = 16; 43343888Sbrian for (i = 0; i < 16; i++) 43443888Sbrian *cp++ = (random() % 10) + '0'; 43543888Sbrian } else 43643313Sbrian#endif 43743888Sbrian { 43844106Sbrian#ifdef HAVE_DES 43944106Sbrian if (authp->physical->link.lcp.want_authtype == 0x80) 44044106Sbrian *cp++ = 8; /* MS does 8 byte callenges :-/ */ 44144106Sbrian else 44244106Sbrian#endif 44344106Sbrian *cp++ = random() % (CHAPCHALLENGELEN-16) + 16; 44445907Sbrian for (i = 0; i < *chap->challenge.local; i++) 44543888Sbrian *cp++ = random() & 0xff; 44643888Sbrian } 44743888Sbrian memcpy(cp, authp->physical->dl->bundle->cfg.auth.name, len); 44843313Sbrian } 44945907Sbrian ChapOutput(authp->physical, CHAP_CHALLENGE, authp->id, chap->challenge.local, 45045907Sbrian 1 + *chap->challenge.local + len, NULL); 4516059Samurai} 4526059Samurai 45330715Sbrianstatic void 45443693Sbrianchap_Success(struct authinfo *authp) 4556059Samurai{ 45643693Sbrian datalink_GotAuthname(authp->physical->dl, authp->in.name); 45743693Sbrian ChapOutput(authp->physical, CHAP_SUCCESS, authp->id, "Welcome!!", 10, NULL); 45843693Sbrian authp->physical->link.lcp.auth_ineed = 0; 45943693Sbrian if (Enabled(authp->physical->dl->bundle, OPT_UTMP)) 46043693Sbrian physical_Login(authp->physical, authp->in.name); 4616059Samurai 46243693Sbrian if (authp->physical->link.lcp.auth_iwait == 0) 46343693Sbrian /* 46443693Sbrian * Either I didn't need to authenticate, or I've already been 46543693Sbrian * told that I got the answer right. 46643693Sbrian */ 46743693Sbrian datalink_AuthOk(authp->physical->dl); 46843693Sbrian} 4696059Samurai 47043693Sbrianstatic void 47143693Sbrianchap_Failure(struct authinfo *authp) 47243693Sbrian{ 47343693Sbrian ChapOutput(authp->physical, CHAP_FAILURE, authp->id, "Invalid!!", 9, NULL); 47443693Sbrian datalink_AuthNotOk(authp->physical->dl); 47543693Sbrian} 47637926Sbrian 47744106Sbrianstatic int 47844123Sbrianchap_Cmp(u_char type, char *myans, int mylen, char *hisans, int hislen 47944123Sbrian#ifdef HAVE_DES 48044123Sbrian , int lm 48144123Sbrian#endif 48244123Sbrian ) 48344106Sbrian{ 48444106Sbrian if (mylen != hislen) 48544106Sbrian return 0; 48644123Sbrian#ifdef HAVE_DES 48744106Sbrian else if (type == 0x80) { 48844106Sbrian int off = lm ? 0 : 24; 48944106Sbrian 49044106Sbrian if (memcmp(myans + off, hisans + off, 24)) 49144106Sbrian return 0; 49244123Sbrian } 49344123Sbrian#endif 49444123Sbrian else if (memcmp(myans, hisans, mylen)) 49544106Sbrian return 0; 49644106Sbrian 49744106Sbrian return 1; 49844106Sbrian} 49944106Sbrian 50044123Sbrian#ifdef HAVE_DES 50144106Sbrianstatic int 50244106Sbrianchap_HaveAnotherGo(struct chap *chap) 50344106Sbrian{ 50444106Sbrian if (++chap->peertries < 3) { 50544106Sbrian /* Give the peer another shot */ 50645907Sbrian *chap->challenge.local = '\0'; 50744106Sbrian chap_Challenge(&chap->auth); 50844106Sbrian return 1; 50944106Sbrian } 51044106Sbrian 51144106Sbrian return 0; 51244106Sbrian} 51344123Sbrian#endif 51444106Sbrian 51543693Sbrianvoid 51643693Sbrianchap_Init(struct chap *chap, struct physical *p) 51743693Sbrian{ 51843888Sbrian chap->desc.type = CHAP_DESCRIPTOR; 51943888Sbrian chap->desc.UpdateSet = chap_UpdateSet; 52043888Sbrian chap->desc.IsSet = chap_IsSet; 52143888Sbrian chap->desc.Read = chap_Read; 52243888Sbrian chap->desc.Write = chap_Write; 52343888Sbrian chap->child.pid = 0; 52443888Sbrian chap->child.fd = -1; 52543693Sbrian auth_Init(&chap->auth, p, chap_Challenge, chap_Success, chap_Failure); 52645907Sbrian *chap->challenge.local = *chap->challenge.peer = '\0'; 52744123Sbrian#ifdef HAVE_DES 52844106Sbrian chap->NTRespSent = 0; 52944106Sbrian chap->peertries = 0; 53044123Sbrian#endif 53143693Sbrian} 53229840Sbrian 53343693Sbrianvoid 53443888Sbrianchap_ReInit(struct chap *chap) 53543888Sbrian{ 53643888Sbrian chap_Cleanup(chap, SIGTERM); 53743888Sbrian} 53843888Sbrian 53946686Sbrianstruct mbuf * 54046686Sbrianchap_Input(struct bundle *bundle, struct link *l, struct mbuf *bp) 54143693Sbrian{ 54246686Sbrian struct physical *p = link2physical(l); 54343693Sbrian struct chap *chap = &p->dl->chap; 54444106Sbrian char *name, *key, *ans; 54544123Sbrian int len, nlen; 54648817Sbrian u_char alen; 54744123Sbrian#ifdef HAVE_DES 54844123Sbrian int lanman; 54944123Sbrian#endif 55029840Sbrian 55146686Sbrian if (p == NULL) { 55246686Sbrian log_Printf(LogERROR, "chap_Input: Not a physical link - dropped\n"); 55346686Sbrian mbuf_Free(bp); 55446686Sbrian return NULL; 55546686Sbrian } 55646686Sbrian 55746686Sbrian if (bundle_Phase(bundle) != PHASE_NETWORK && 55846686Sbrian bundle_Phase(bundle) != PHASE_AUTHENTICATE) { 55945220Sbrian log_Printf(LogPHASE, "Unexpected chap input - dropped !\n"); 56045220Sbrian mbuf_Free(bp); 56146686Sbrian return NULL; 56245220Sbrian } 56345220Sbrian 56447695Sbrian mbuf_SetType(bp, MB_CHAPIN); 56544159Sbrian if ((bp = auth_ReadHeader(&chap->auth, bp)) == NULL && 56644159Sbrian ntohs(chap->auth.in.hdr.length) == 0) 56744159Sbrian log_Printf(LogWARN, "Chap Input: Truncated header !\n"); 56843693Sbrian else if (chap->auth.in.hdr.code == 0 || chap->auth.in.hdr.code > MAXCHAPCODE) 56943693Sbrian log_Printf(LogPHASE, "Chap Input: %d: Bad CHAP code !\n", 57043693Sbrian chap->auth.in.hdr.code); 57143693Sbrian else { 57243693Sbrian len = mbuf_Length(bp); 57343693Sbrian ans = NULL; 57443693Sbrian 57543693Sbrian if (chap->auth.in.hdr.code != CHAP_CHALLENGE && 57643693Sbrian chap->auth.id != chap->auth.in.hdr.id && 57746686Sbrian Enabled(bundle, OPT_IDCHECK)) { 57843693Sbrian /* Wrong conversation dude ! */ 57943693Sbrian log_Printf(LogPHASE, "Chap Input: %s dropped (got id %d, not %d)\n", 58043693Sbrian chapcodes[chap->auth.in.hdr.code], chap->auth.in.hdr.id, 58143693Sbrian chap->auth.id); 58243693Sbrian mbuf_Free(bp); 58346686Sbrian return NULL; 58425630Sbrian } 58543693Sbrian chap->auth.id = chap->auth.in.hdr.id; /* We respond with this id */ 58629840Sbrian 58744123Sbrian#ifdef HAVE_DES 58844106Sbrian lanman = 0; 58944123Sbrian#endif 59043693Sbrian switch (chap->auth.in.hdr.code) { 59143693Sbrian case CHAP_CHALLENGE: 59244106Sbrian bp = mbuf_Read(bp, &alen, 1); 59344106Sbrian len -= alen + 1; 59443693Sbrian if (len < 0) { 59543693Sbrian log_Printf(LogERROR, "Chap Input: Truncated challenge !\n"); 59643693Sbrian mbuf_Free(bp); 59746686Sbrian return NULL; 59843693Sbrian } 59945907Sbrian *chap->challenge.peer = alen; 60045907Sbrian bp = mbuf_Read(bp, chap->challenge.peer + 1, alen); 60143693Sbrian bp = auth_ReadName(&chap->auth, bp, len); 60244123Sbrian#ifdef HAVE_DES 60344106Sbrian lanman = p->link.lcp.his_authtype == 0x80 && 60444106Sbrian ((chap->NTRespSent && IsAccepted(p->link.lcp.cfg.chap80lm)) || 60544106Sbrian !IsAccepted(p->link.lcp.cfg.chap80nt)); 60644123Sbrian#endif 60743693Sbrian break; 60843313Sbrian 60943693Sbrian case CHAP_RESPONSE: 61043693Sbrian auth_StopTimer(&chap->auth); 61143693Sbrian bp = mbuf_Read(bp, &alen, 1); 61243693Sbrian len -= alen + 1; 61343693Sbrian if (len < 0) { 61443693Sbrian log_Printf(LogERROR, "Chap Input: Truncated response !\n"); 61543693Sbrian mbuf_Free(bp); 61646686Sbrian return NULL; 61743693Sbrian } 61843693Sbrian if ((ans = malloc(alen + 2)) == NULL) { 61943693Sbrian log_Printf(LogERROR, "Chap Input: Out of memory !\n"); 62043693Sbrian mbuf_Free(bp); 62146686Sbrian return NULL; 62243693Sbrian } 62343693Sbrian *ans = chap->auth.id; 62443693Sbrian bp = mbuf_Read(bp, ans + 1, alen); 62543693Sbrian ans[alen+1] = '\0'; 62643693Sbrian bp = auth_ReadName(&chap->auth, bp, len); 62744123Sbrian#ifdef HAVE_DES 62844106Sbrian lanman = alen == 49 && ans[alen] == 0; 62944123Sbrian#endif 63043693Sbrian break; 63143313Sbrian 63243693Sbrian case CHAP_SUCCESS: 63343693Sbrian case CHAP_FAILURE: 63443693Sbrian /* chap->auth.in.name is already set up at CHALLENGE time */ 63543693Sbrian if ((ans = malloc(len + 1)) == NULL) { 63643693Sbrian log_Printf(LogERROR, "Chap Input: Out of memory !\n"); 63743693Sbrian mbuf_Free(bp); 63846686Sbrian return NULL; 63943693Sbrian } 64043693Sbrian bp = mbuf_Read(bp, ans, len); 64143693Sbrian ans[len] = '\0'; 64243693Sbrian break; 64343401Sbrian } 64436285Sbrian 64543693Sbrian switch (chap->auth.in.hdr.code) { 64643693Sbrian case CHAP_CHALLENGE: 64743693Sbrian case CHAP_RESPONSE: 64843693Sbrian if (*chap->auth.in.name) 64944106Sbrian log_Printf(LogPHASE, "Chap Input: %s (%d bytes from %s%s)\n", 65044106Sbrian chapcodes[chap->auth.in.hdr.code], alen, 65144106Sbrian chap->auth.in.name, 65244123Sbrian#ifdef HAVE_DES 65344106Sbrian lanman && chap->auth.in.hdr.code == CHAP_RESPONSE ? 65444123Sbrian " - lanman" : 65544123Sbrian#endif 65644123Sbrian ""); 65743693Sbrian else 65844106Sbrian log_Printf(LogPHASE, "Chap Input: %s (%d bytes%s)\n", 65944106Sbrian chapcodes[chap->auth.in.hdr.code], alen, 66044123Sbrian#ifdef HAVE_DES 66144106Sbrian lanman && chap->auth.in.hdr.code == CHAP_RESPONSE ? 66244123Sbrian " - lanman" : 66344123Sbrian#endif 66444123Sbrian ""); 66543693Sbrian break; 66636285Sbrian 66743693Sbrian case CHAP_SUCCESS: 66843693Sbrian case CHAP_FAILURE: 66943693Sbrian if (*ans) 67043693Sbrian log_Printf(LogPHASE, "Chap Input: %s (%s)\n", 67143693Sbrian chapcodes[chap->auth.in.hdr.code], ans); 67243693Sbrian else 67343693Sbrian log_Printf(LogPHASE, "Chap Input: %s\n", 67443693Sbrian chapcodes[chap->auth.in.hdr.code]); 67543693Sbrian break; 6766059Samurai } 6776059Samurai 67843693Sbrian switch (chap->auth.in.hdr.code) { 67943693Sbrian case CHAP_CHALLENGE: 68046686Sbrian if (*bundle->cfg.auth.key == '!') 68146686Sbrian chap_StartChild(chap, bundle->cfg.auth.key + 1, 68246686Sbrian bundle->cfg.auth.name); 68343888Sbrian else 68446686Sbrian chap_Respond(chap, bundle->cfg.auth.name, 68546686Sbrian bundle->cfg.auth.key, p->link.lcp.his_authtype 68644123Sbrian#ifdef HAVE_DES 68744123Sbrian , lanman 68844123Sbrian#endif 68944123Sbrian ); 69043693Sbrian break; 6916059Samurai 69243693Sbrian case CHAP_RESPONSE: 69343693Sbrian name = chap->auth.in.name; 69443693Sbrian nlen = strlen(name); 69543693Sbrian#ifndef NORADIUS 69646686Sbrian if (*bundle->radius.cfg.file) { 69748817Sbrian u_char end; 69848817Sbrian 69945907Sbrian end = chap->challenge.local[*chap->challenge.local+1]; 70045907Sbrian chap->challenge.local[*chap->challenge.local+1] = '\0'; 70146686Sbrian radius_Authenticate(&bundle->radius, &chap->auth, 70245907Sbrian chap->auth.in.name, ans, 70345907Sbrian chap->challenge.local + 1); 70445907Sbrian chap->challenge.local[*chap->challenge.local+1] = end; 70543693Sbrian } else 70643693Sbrian#endif 70743693Sbrian { 70846686Sbrian key = auth_GetSecret(bundle, name, nlen, p); 70943693Sbrian if (key) { 71044106Sbrian char *myans; 71144123Sbrian#ifdef HAVE_DES 71244106Sbrian if (lanman && !IsEnabled(p->link.lcp.cfg.chap80lm)) { 71344106Sbrian log_Printf(LogPHASE, "Auth failure: LANMan not enabled\n"); 71444106Sbrian if (chap_HaveAnotherGo(chap)) 71544106Sbrian break; 71643693Sbrian key = NULL; 71744122Sbrian } else if (!lanman && !IsEnabled(p->link.lcp.cfg.chap80nt) && 71844122Sbrian p->link.lcp.want_authtype == 0x80) { 71944106Sbrian log_Printf(LogPHASE, "Auth failure: mschap not enabled\n"); 72044106Sbrian if (chap_HaveAnotherGo(chap)) 72144106Sbrian break; 72244106Sbrian key = NULL; 72344123Sbrian } else 72444123Sbrian#endif 72544123Sbrian { 72644106Sbrian myans = chap_BuildAnswer(name, key, chap->auth.id, 72745907Sbrian chap->challenge.local, 72844123Sbrian p->link.lcp.want_authtype 72944123Sbrian#ifdef HAVE_DES 73044123Sbrian , lanman 73144123Sbrian#endif 73244123Sbrian ); 73344106Sbrian if (myans == NULL) 73443693Sbrian key = NULL; 73544106Sbrian else { 73644123Sbrian if (!chap_Cmp(p->link.lcp.want_authtype, myans + 1, *myans, 73744123Sbrian ans + 1, alen 73844123Sbrian#ifdef HAVE_DES 73944123Sbrian , lanman 74044123Sbrian#endif 74144123Sbrian )) 74244106Sbrian key = NULL; 74344106Sbrian free(myans); 74444106Sbrian } 74543693Sbrian } 74643693Sbrian } 7476059Samurai 74843693Sbrian if (key) 74943693Sbrian chap_Success(&chap->auth); 75043693Sbrian else 75143693Sbrian chap_Failure(&chap->auth); 75243693Sbrian } 7536059Samurai 75443693Sbrian break; 7556059Samurai 7566059Samurai case CHAP_SUCCESS: 75743693Sbrian if (p->link.lcp.auth_iwait == PROTO_CHAP) { 75843693Sbrian p->link.lcp.auth_iwait = 0; 75943693Sbrian if (p->link.lcp.auth_ineed == 0) 76043693Sbrian /* 76143693Sbrian * We've succeeded in our ``login'' 76243693Sbrian * If we're not expecting the peer to authenticate (or he already 76343693Sbrian * has), proceed to network phase. 76443693Sbrian */ 76543693Sbrian datalink_AuthOk(p->dl); 76643693Sbrian } 76743693Sbrian break; 76843693Sbrian 7696059Samurai case CHAP_FAILURE: 77043693Sbrian datalink_AuthNotOk(p->dl); 77143693Sbrian break; 7726059Samurai } 77343693Sbrian free(ans); 7746059Samurai } 77543693Sbrian 77636285Sbrian mbuf_Free(bp); 77746686Sbrian return NULL; 7786059Samurai} 779