chap.c revision 50867
1121991Sjhb/* 2121991Sjhb * PPP CHAP Module 3121991Sjhb * 4121991Sjhb * Written by Toshiharu OHNO (tony-o@iij.ad.jp) 5121991Sjhb * 6121991Sjhb * Copyright (C) 1993, Internet Initiative Japan, Inc. All rights reserverd. 7121991Sjhb * 8121991Sjhb * Redistribution and use in source and binary forms are permitted 9121991Sjhb * provided that the above copyright notice and this paragraph are 10121991Sjhb * duplicated in all such forms and that any documentation, 11121991Sjhb * advertising materials, and other materials related to such 12121991Sjhb * distribution and use acknowledge that the software was developed 13121991Sjhb * by the Internet Initiative Japan, Inc. The name of the 14121991Sjhb * IIJ may not be used to endorse or promote products derived 15121991Sjhb * from this software without specific prior written permission. 16121991Sjhb * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 17121991Sjhb * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 18121991Sjhb * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. 19121991Sjhb * 20121991Sjhb * $FreeBSD: head/usr.sbin/ppp/chap.c 50867 1999-09-04 00:00:21Z brian $ 21121991Sjhb * 22121991Sjhb * TODO: 23121991Sjhb */ 24121991Sjhb#include <sys/param.h> 25121991Sjhb#include <netinet/in.h> 26121991Sjhb#include <netinet/in_systm.h> 27121991Sjhb#include <netinet/ip.h> 28121991Sjhb#include <sys/un.h> 29121991Sjhb 30121991Sjhb#include <errno.h> 31121991Sjhb#include <fcntl.h> 32121991Sjhb#ifdef HAVE_DES 33121991Sjhb#include <md4.h> 34121991Sjhb#endif 35121991Sjhb#include <md5.h> 36121991Sjhb#include <paths.h> 37121991Sjhb#include <signal.h> 38121991Sjhb#include <stdio.h> 39121991Sjhb#include <stdlib.h> 40121991Sjhb#include <string.h> 41121991Sjhb#include <sys/wait.h> 42121991Sjhb#include <termios.h> 43221393Sjhb#include <unistd.h> 44121991Sjhb 45121991Sjhb#include "layer.h" 46121991Sjhb#include "mbuf.h" 47121991Sjhb#include "log.h" 48215051Sattilio#include "defs.h" 49121991Sjhb#include "timer.h" 50121991Sjhb#include "fsm.h" 51121991Sjhb#include "proto.h" 52121991Sjhb#include "lcp.h" 53121991Sjhb#include "lqr.h" 54121991Sjhb#include "hdlc.h" 55121991Sjhb#include "auth.h" 56121991Sjhb#include "async.h" 57121991Sjhb#include "throughput.h" 58121991Sjhb#include "descriptor.h" 59121991Sjhb#include "chap.h" 60121991Sjhb#include "iplist.h" 61121991Sjhb#include "slcompress.h" 62121991Sjhb#include "ipcp.h" 63121991Sjhb#include "filter.h" 64121991Sjhb#include "ccp.h" 65121991Sjhb#include "link.h" 66121991Sjhb#include "physical.h" 67121991Sjhb#include "mp.h" 68128873Sjhb#ifndef NORADIUS 69128873Sjhb#include "radius.h" 70128873Sjhb#endif 71128873Sjhb#include "bundle.h" 72224069Sjhb#include "chat.h" 73224069Sjhb#include "cbcp.h" 74224069Sjhb#include "command.h" 75128873Sjhb#include "datalink.h" 76128873Sjhb#ifdef HAVE_DES 77128873Sjhb#include "chap_ms.h" 78128873Sjhb#endif 79169221Sjhb 80165128Sjhbstatic const char *chapcodes[] = { 81165128Sjhb "???", "CHALLENGE", "RESPONSE", "SUCCESS", "FAILURE" 82165128Sjhb}; 83165128Sjhb#define MAXCHAPCODE (sizeof chapcodes / sizeof chapcodes[0] - 1) 84165128Sjhb 85165128Sjhbstatic void 86165128SjhbChapOutput(struct physical *physical, u_int code, u_int id, 87165128Sjhb const u_char *ptr, int count, const char *text) 88165128Sjhb{ 89165128Sjhb int plen; 90165128Sjhb struct fsmheader lh; 91165128Sjhb struct mbuf *bp; 92169221Sjhb 93165128Sjhb plen = sizeof(struct fsmheader) + count; 94165128Sjhb lh.code = code; 95165128Sjhb lh.id = id; 96165128Sjhb lh.length = htons(plen); 97169221Sjhb bp = mbuf_Alloc(plen, MB_CHAPOUT); 98165128Sjhb memcpy(MBUF_CTOP(bp), &lh, sizeof(struct fsmheader)); 99165128Sjhb if (count) 100224069Sjhb memcpy(MBUF_CTOP(bp) + sizeof(struct fsmheader), ptr, count); 101224069Sjhb log_DumpBp(LogDEBUG, "ChapOutput", bp); 102224069Sjhb if (text == NULL) 103224069Sjhb log_Printf(LogPHASE, "Chap Output: %s\n", chapcodes[code]); 104224069Sjhb else 105224069Sjhb log_Printf(LogPHASE, "Chap Output: %s (%s)\n", chapcodes[code], text); 106224069Sjhb link_PushPacket(&physical->link, bp, physical->dl->bundle, 107224069Sjhb LINK_QUEUES(&physical->link) - 1, PROTO_CHAP); 108224069Sjhb} 109224069Sjhb 110224069Sjhbstatic char * 111224069Sjhbchap_BuildAnswer(char *name, char *key, u_char id, char *challenge, u_char type 112224069Sjhb#ifdef HAVE_DES 113224069Sjhb , int lanman 114224069Sjhb#endif 115224069Sjhb ) 116224069Sjhb{ 117224069Sjhb char *result, *digest; 118224069Sjhb size_t nlen, klen; 119224069Sjhb 120224069Sjhb nlen = strlen(name); 121224069Sjhb klen = strlen(key); 122224069Sjhb 123224069Sjhb#ifdef HAVE_DES 124224069Sjhb if (type == 0x80) { 125224069Sjhb char expkey[AUTHLEN << 2]; 126224069Sjhb MD4_CTX MD4context; 127224069Sjhb int f; 128224069Sjhb 129224069Sjhb if ((result = malloc(1 + nlen + MS_CHAP_RESPONSE_LEN)) == NULL) 130224069Sjhb return result; 131224069Sjhb 132224069Sjhb digest = result; /* the response */ 133224069Sjhb *digest++ = MS_CHAP_RESPONSE_LEN; /* 49 */ 134224069Sjhb memcpy(digest + MS_CHAP_RESPONSE_LEN, name, nlen); 135224069Sjhb if (lanman) { 136224069Sjhb memset(digest + 24, '\0', 25); 137224069Sjhb mschap_LANMan(digest, challenge + 1, key); /* LANMan response */ 138224069Sjhb } else { 139224069Sjhb memset(digest, '\0', 25); 140224069Sjhb digest += 24; 141224069Sjhb 142224069Sjhb for (f = 0; f < klen; f++) { 143224069Sjhb expkey[2*f] = key[f]; 144224069Sjhb expkey[2*f+1] = '\0'; 145224069Sjhb } 146224069Sjhb /* 147224069Sjhb * ----------- 148224069Sjhb * expkey = | k\0e\0y\0 | 149224069Sjhb * ----------- 150224069Sjhb */ 151224069Sjhb MD4Init(&MD4context); 152224069Sjhb MD4Update(&MD4context, expkey, klen << 1); 153224069Sjhb MD4Final(digest, &MD4context); 154224069Sjhb 155224069Sjhb /* 156224069Sjhb * ---- -------- ---------------- ------- ------ 157224069Sjhb * result = | 49 | LANMan | 16 byte digest | 9 * ? | name | 158224069Sjhb * ---- -------- ---------------- ------- ------ 159224069Sjhb */ 160224069Sjhb mschap_NT(digest, challenge + 1); 161224069Sjhb } 162224069Sjhb /* 163224069Sjhb * ---- -------- ------------- ----- ------ 164224069Sjhb * | | struct MS_ChapResponse24 | | 165224069Sjhb * result = | 49 | LANMan | NT digest | 0/1 | name | 166224069Sjhb * ---- -------- ------------- ----- ------ 167224069Sjhb * where only one of LANMan & NT digest are set. 168224069Sjhb */ 169224069Sjhb } else 170224069Sjhb#endif 171224069Sjhb if ((result = malloc(nlen + 17)) != NULL) { 172224069Sjhb /* Normal MD5 stuff */ 173224069Sjhb MD5_CTX MD5context; 174121991Sjhb 175121991Sjhb digest = result; 176121991Sjhb *digest++ = 16; /* value size */ 177128873Sjhb 178121991Sjhb MD5Init(&MD5context); 179121991Sjhb MD5Update(&MD5context, &id, 1); 180121991Sjhb MD5Update(&MD5context, key, klen); 181121991Sjhb MD5Update(&MD5context, challenge + 1, *challenge); 182121991Sjhb MD5Final(digest, &MD5context); 183121991Sjhb 184121991Sjhb memcpy(digest + 16, name, nlen); 185224069Sjhb /* 186224069Sjhb * ---- -------- ------ 187224069Sjhb * result = | 16 | digest | name | 188224069Sjhb * ---- -------- ------ 189150264Simp */ 190221324Sjhb } 191224069Sjhb 192121991Sjhb return result; 193121991Sjhb} 194121991Sjhb 195121991Sjhbstatic void 196121991Sjhbchap_StartChild(struct chap *chap, char *prog, const char *name) 197121991Sjhb{ 198121991Sjhb char *argv[MAXARGS], *nargv[MAXARGS]; 199121991Sjhb int argc, fd; 200121991Sjhb int in[2], out[2]; 201121991Sjhb pid_t pid; 202121991Sjhb 203165128Sjhb if (chap->child.fd != -1) { 204164265Sjhb log_Printf(LogWARN, "Chap: %s: Program already running\n", prog); 205165128Sjhb return; 206164265Sjhb } 207234150Sjhb 208121991Sjhb if (pipe(in) == -1) { 209229093Shselasky log_Printf(LogERROR, "Chap: pipe: %s\n", strerror(errno)); 210121991Sjhb return; 211121991Sjhb } 212154079Sjhb 213121991Sjhb if (pipe(out) == -1) { 214224069Sjhb log_Printf(LogERROR, "Chap: pipe: %s\n", strerror(errno)); 215224069Sjhb close(in[0]); 216154079Sjhb close(in[1]); 217121991Sjhb return; 218121991Sjhb } 219121991Sjhb 220121991Sjhb pid = getpid(); 221121991Sjhb switch ((chap->child.pid = fork())) { 222121991Sjhb case -1: 223121991Sjhb log_Printf(LogERROR, "Chap: fork: %s\n", strerror(errno)); 224121991Sjhb close(in[0]); 225121991Sjhb close(in[1]); 226121991Sjhb close(out[0]); 227121991Sjhb close(out[1]); 228121991Sjhb chap->child.pid = 0; 229121991Sjhb return; 230121991Sjhb 231121991Sjhb case 0: 232121991Sjhb timer_TermService(); 233121991Sjhb close(in[1]); 234121991Sjhb close(out[0]); 235121991Sjhb if (out[1] == STDIN_FILENO) 236121991Sjhb out[1] = dup(out[1]); 237121991Sjhb dup2(in[0], STDIN_FILENO); 238121991Sjhb dup2(out[1], STDOUT_FILENO); 239121991Sjhb close(STDERR_FILENO); 240121991Sjhb if (open(_PATH_DEVNULL, O_RDWR) != STDERR_FILENO) { 241121991Sjhb log_Printf(LogALERT, "Chap: Failed to open %s: %s\n", 242121991Sjhb _PATH_DEVNULL, strerror(errno)); 243121991Sjhb exit(1); 244121991Sjhb } 245121991Sjhb for (fd = getdtablesize(); fd > STDERR_FILENO; fd--) 246121991Sjhb fcntl(fd, F_SETFD, 1); 247154079Sjhb setuid(geteuid()); 248121991Sjhb argc = command_Interpret(prog, strlen(prog), argv); 249210868Sjhb command_Expand(nargv, argc, (char const *const *)argv, 250210868Sjhb chap->auth.physical->dl->bundle, 0, pid); 251121991Sjhb execvp(nargv[0], nargv); 252 printf("exec() of %s failed: %s\n", nargv[0], strerror(errno)); 253 _exit(255); 254 255 default: 256 close(in[0]); 257 close(out[1]); 258 chap->child.fd = out[0]; 259 chap->child.buf.len = 0; 260 write(in[1], chap->auth.in.name, strlen(chap->auth.in.name)); 261 write(in[1], "\n", 1); 262 write(in[1], chap->challenge.peer + 1, *chap->challenge.peer); 263 write(in[1], "\n", 1); 264 write(in[1], name, strlen(name)); 265 write(in[1], "\n", 1); 266 close(in[1]); 267 break; 268 } 269} 270 271static void 272chap_Cleanup(struct chap *chap, int sig) 273{ 274 if (chap->child.pid) { 275 int status; 276 277 close(chap->child.fd); 278 chap->child.fd = -1; 279 if (sig) 280 kill(chap->child.pid, SIGTERM); 281 chap->child.pid = 0; 282 chap->child.buf.len = 0; 283 284 if (wait(&status) == -1) 285 log_Printf(LogERROR, "Chap: wait: %s\n", strerror(errno)); 286 else if (WIFSIGNALED(status)) 287 log_Printf(LogWARN, "Chap: Child received signal %d\n", WTERMSIG(status)); 288 else if (WIFEXITED(status) && WEXITSTATUS(status)) 289 log_Printf(LogERROR, "Chap: Child exited %d\n", WEXITSTATUS(status)); 290 } 291 *chap->challenge.local = *chap->challenge.peer = '\0'; 292#ifdef HAVE_DES 293 chap->peertries = 0; 294#endif 295} 296 297static void 298chap_Respond(struct chap *chap, char *name, char *key, u_char type 299#ifdef HAVE_DES 300 , int lm 301#endif 302 ) 303{ 304 u_char *ans; 305 306 ans = chap_BuildAnswer(name, key, chap->auth.id, chap->challenge.peer, type 307#ifdef HAVE_DES 308 , lm 309#endif 310 ); 311 312 if (ans) { 313 ChapOutput(chap->auth.physical, CHAP_RESPONSE, chap->auth.id, 314 ans, *ans + 1 + strlen(name), name); 315#ifdef HAVE_DES 316 chap->NTRespSent = !lm; 317#endif 318 free(ans); 319 } else 320 ChapOutput(chap->auth.physical, CHAP_FAILURE, chap->auth.id, 321 "Out of memory!", 14, NULL); 322} 323 324static int 325chap_UpdateSet(struct descriptor *d, fd_set *r, fd_set *w, fd_set *e, int *n) 326{ 327 struct chap *chap = descriptor2chap(d); 328 329 if (r && chap && chap->child.fd != -1) { 330 FD_SET(chap->child.fd, r); 331 if (*n < chap->child.fd + 1) 332 *n = chap->child.fd + 1; 333 log_Printf(LogTIMER, "Chap: fdset(r) %d\n", chap->child.fd); 334 return 1; 335 } 336 337 return 0; 338} 339 340static int 341chap_IsSet(struct descriptor *d, const fd_set *fdset) 342{ 343 struct chap *chap = descriptor2chap(d); 344 345 return chap && chap->child.fd != -1 && FD_ISSET(chap->child.fd, fdset); 346} 347 348static void 349chap_Read(struct descriptor *d, struct bundle *bundle, const fd_set *fdset) 350{ 351 struct chap *chap = descriptor2chap(d); 352 int got; 353 354 got = read(chap->child.fd, chap->child.buf.ptr + chap->child.buf.len, 355 sizeof chap->child.buf.ptr - chap->child.buf.len - 1); 356 if (got == -1) { 357 log_Printf(LogERROR, "Chap: Read: %s\n", strerror(errno)); 358 chap_Cleanup(chap, SIGTERM); 359 } else if (got == 0) { 360 log_Printf(LogWARN, "Chap: Read: Child terminated connection\n"); 361 chap_Cleanup(chap, SIGTERM); 362 } else { 363 char *name, *key, *end; 364 365 chap->child.buf.len += got; 366 chap->child.buf.ptr[chap->child.buf.len] = '\0'; 367 name = chap->child.buf.ptr; 368 name += strspn(name, " \t"); 369 if ((key = strchr(name, '\n')) == NULL) 370 end = NULL; 371 else 372 end = strchr(++key, '\n'); 373 374 if (end == NULL) { 375 if (chap->child.buf.len == sizeof chap->child.buf.ptr - 1) { 376 log_Printf(LogWARN, "Chap: Read: Input buffer overflow\n"); 377 chap_Cleanup(chap, SIGTERM); 378 } 379 } else { 380#ifdef HAVE_DES 381 int lanman = chap->auth.physical->link.lcp.his_authtype == 0x80 && 382 ((chap->NTRespSent && 383 IsAccepted(chap->auth.physical->link.lcp.cfg.chap80lm)) || 384 !IsAccepted(chap->auth.physical->link.lcp.cfg.chap80nt)); 385#endif 386 387 while (end >= name && strchr(" \t\r\n", *end)) 388 *end-- = '\0'; 389 end = key - 1; 390 while (end >= name && strchr(" \t\r\n", *end)) 391 *end-- = '\0'; 392 key += strspn(key, " \t"); 393 394 chap_Respond(chap, name, key, chap->auth.physical->link.lcp.his_authtype 395#ifdef HAVE_DES 396 , lanman 397#endif 398 ); 399 chap_Cleanup(chap, 0); 400 } 401 } 402} 403 404static int 405chap_Write(struct descriptor *d, struct bundle *bundle, const fd_set *fdset) 406{ 407 /* We never want to write here ! */ 408 log_Printf(LogALERT, "chap_Write: Internal error: Bad call !\n"); 409 return 0; 410} 411 412static void 413chap_Challenge(struct authinfo *authp) 414{ 415 struct chap *chap = auth2chap(authp); 416 int len, i; 417 char *cp; 418 419 len = strlen(authp->physical->dl->bundle->cfg.auth.name); 420 421 if (!*chap->challenge.local) { 422 randinit(); 423 cp = chap->challenge.local; 424 425#ifndef NORADIUS 426 if (*authp->physical->dl->bundle->radius.cfg.file) { 427 /* For radius, our challenge is 16 readable NUL terminated bytes :*/ 428 *cp++ = 16; 429 for (i = 0; i < 16; i++) 430 *cp++ = (random() % 10) + '0'; 431 } else 432#endif 433 { 434#ifdef HAVE_DES 435 if (authp->physical->link.lcp.want_authtype == 0x80) 436 *cp++ = 8; /* MS does 8 byte callenges :-/ */ 437 else 438#endif 439 *cp++ = random() % (CHAPCHALLENGELEN-16) + 16; 440 for (i = 0; i < *chap->challenge.local; i++) 441 *cp++ = random() & 0xff; 442 } 443 memcpy(cp, authp->physical->dl->bundle->cfg.auth.name, len); 444 } 445 ChapOutput(authp->physical, CHAP_CHALLENGE, authp->id, chap->challenge.local, 446 1 + *chap->challenge.local + len, NULL); 447} 448 449static void 450chap_Success(struct authinfo *authp) 451{ 452 datalink_GotAuthname(authp->physical->dl, authp->in.name); 453 ChapOutput(authp->physical, CHAP_SUCCESS, authp->id, "Welcome!!", 10, NULL); 454 authp->physical->link.lcp.auth_ineed = 0; 455 if (Enabled(authp->physical->dl->bundle, OPT_UTMP)) 456 physical_Login(authp->physical, authp->in.name); 457 458 if (authp->physical->link.lcp.auth_iwait == 0) 459 /* 460 * Either I didn't need to authenticate, or I've already been 461 * told that I got the answer right. 462 */ 463 datalink_AuthOk(authp->physical->dl); 464} 465 466static void 467chap_Failure(struct authinfo *authp) 468{ 469 ChapOutput(authp->physical, CHAP_FAILURE, authp->id, "Invalid!!", 9, NULL); 470 datalink_AuthNotOk(authp->physical->dl); 471} 472 473static int 474chap_Cmp(u_char type, char *myans, int mylen, char *hisans, int hislen 475#ifdef HAVE_DES 476 , int lm 477#endif 478 ) 479{ 480 if (mylen != hislen) 481 return 0; 482#ifdef HAVE_DES 483 else if (type == 0x80) { 484 int off = lm ? 0 : 24; 485 486 if (memcmp(myans + off, hisans + off, 24)) 487 return 0; 488 } 489#endif 490 else if (memcmp(myans, hisans, mylen)) 491 return 0; 492 493 return 1; 494} 495 496#ifdef HAVE_DES 497static int 498chap_HaveAnotherGo(struct chap *chap) 499{ 500 if (++chap->peertries < 3) { 501 /* Give the peer another shot */ 502 *chap->challenge.local = '\0'; 503 chap_Challenge(&chap->auth); 504 return 1; 505 } 506 507 return 0; 508} 509#endif 510 511void 512chap_Init(struct chap *chap, struct physical *p) 513{ 514 chap->desc.type = CHAP_DESCRIPTOR; 515 chap->desc.UpdateSet = chap_UpdateSet; 516 chap->desc.IsSet = chap_IsSet; 517 chap->desc.Read = chap_Read; 518 chap->desc.Write = chap_Write; 519 chap->child.pid = 0; 520 chap->child.fd = -1; 521 auth_Init(&chap->auth, p, chap_Challenge, chap_Success, chap_Failure); 522 *chap->challenge.local = *chap->challenge.peer = '\0'; 523#ifdef HAVE_DES 524 chap->NTRespSent = 0; 525 chap->peertries = 0; 526#endif 527} 528 529void 530chap_ReInit(struct chap *chap) 531{ 532 chap_Cleanup(chap, SIGTERM); 533} 534 535struct mbuf * 536chap_Input(struct bundle *bundle, struct link *l, struct mbuf *bp) 537{ 538 struct physical *p = link2physical(l); 539 struct chap *chap = &p->dl->chap; 540 char *name, *key, *ans; 541 int len, nlen; 542 u_char alen; 543#ifdef HAVE_DES 544 int lanman; 545#endif 546 547 if (p == NULL) { 548 log_Printf(LogERROR, "chap_Input: Not a physical link - dropped\n"); 549 mbuf_Free(bp); 550 return NULL; 551 } 552 553 if (bundle_Phase(bundle) != PHASE_NETWORK && 554 bundle_Phase(bundle) != PHASE_AUTHENTICATE) { 555 log_Printf(LogPHASE, "Unexpected chap input - dropped !\n"); 556 mbuf_Free(bp); 557 return NULL; 558 } 559 560 mbuf_SetType(bp, MB_CHAPIN); 561 if ((bp = auth_ReadHeader(&chap->auth, bp)) == NULL && 562 ntohs(chap->auth.in.hdr.length) == 0) 563 log_Printf(LogWARN, "Chap Input: Truncated header !\n"); 564 else if (chap->auth.in.hdr.code == 0 || chap->auth.in.hdr.code > MAXCHAPCODE) 565 log_Printf(LogPHASE, "Chap Input: %d: Bad CHAP code !\n", 566 chap->auth.in.hdr.code); 567 else { 568 len = mbuf_Length(bp); 569 ans = NULL; 570 571 if (chap->auth.in.hdr.code != CHAP_CHALLENGE && 572 chap->auth.id != chap->auth.in.hdr.id && 573 Enabled(bundle, OPT_IDCHECK)) { 574 /* Wrong conversation dude ! */ 575 log_Printf(LogPHASE, "Chap Input: %s dropped (got id %d, not %d)\n", 576 chapcodes[chap->auth.in.hdr.code], chap->auth.in.hdr.id, 577 chap->auth.id); 578 mbuf_Free(bp); 579 return NULL; 580 } 581 chap->auth.id = chap->auth.in.hdr.id; /* We respond with this id */ 582 583#ifdef HAVE_DES 584 lanman = 0; 585#endif 586 switch (chap->auth.in.hdr.code) { 587 case CHAP_CHALLENGE: 588 bp = mbuf_Read(bp, &alen, 1); 589 len -= alen + 1; 590 if (len < 0) { 591 log_Printf(LogERROR, "Chap Input: Truncated challenge !\n"); 592 mbuf_Free(bp); 593 return NULL; 594 } 595 *chap->challenge.peer = alen; 596 bp = mbuf_Read(bp, chap->challenge.peer + 1, alen); 597 bp = auth_ReadName(&chap->auth, bp, len); 598#ifdef HAVE_DES 599 lanman = p->link.lcp.his_authtype == 0x80 && 600 ((chap->NTRespSent && IsAccepted(p->link.lcp.cfg.chap80lm)) || 601 !IsAccepted(p->link.lcp.cfg.chap80nt)); 602#endif 603 break; 604 605 case CHAP_RESPONSE: 606 auth_StopTimer(&chap->auth); 607 bp = mbuf_Read(bp, &alen, 1); 608 len -= alen + 1; 609 if (len < 0) { 610 log_Printf(LogERROR, "Chap Input: Truncated response !\n"); 611 mbuf_Free(bp); 612 return NULL; 613 } 614 if ((ans = malloc(alen + 2)) == NULL) { 615 log_Printf(LogERROR, "Chap Input: Out of memory !\n"); 616 mbuf_Free(bp); 617 return NULL; 618 } 619 *ans = chap->auth.id; 620 bp = mbuf_Read(bp, ans + 1, alen); 621 ans[alen+1] = '\0'; 622 bp = auth_ReadName(&chap->auth, bp, len); 623#ifdef HAVE_DES 624 lanman = alen == 49 && ans[alen] == 0; 625#endif 626 break; 627 628 case CHAP_SUCCESS: 629 case CHAP_FAILURE: 630 /* chap->auth.in.name is already set up at CHALLENGE time */ 631 if ((ans = malloc(len + 1)) == NULL) { 632 log_Printf(LogERROR, "Chap Input: Out of memory !\n"); 633 mbuf_Free(bp); 634 return NULL; 635 } 636 bp = mbuf_Read(bp, ans, len); 637 ans[len] = '\0'; 638 break; 639 } 640 641 switch (chap->auth.in.hdr.code) { 642 case CHAP_CHALLENGE: 643 case CHAP_RESPONSE: 644 if (*chap->auth.in.name) 645 log_Printf(LogPHASE, "Chap Input: %s (%d bytes from %s%s)\n", 646 chapcodes[chap->auth.in.hdr.code], alen, 647 chap->auth.in.name, 648#ifdef HAVE_DES 649 lanman && chap->auth.in.hdr.code == CHAP_RESPONSE ? 650 " - lanman" : 651#endif 652 ""); 653 else 654 log_Printf(LogPHASE, "Chap Input: %s (%d bytes%s)\n", 655 chapcodes[chap->auth.in.hdr.code], alen, 656#ifdef HAVE_DES 657 lanman && chap->auth.in.hdr.code == CHAP_RESPONSE ? 658 " - lanman" : 659#endif 660 ""); 661 break; 662 663 case CHAP_SUCCESS: 664 case CHAP_FAILURE: 665 if (*ans) 666 log_Printf(LogPHASE, "Chap Input: %s (%s)\n", 667 chapcodes[chap->auth.in.hdr.code], ans); 668 else 669 log_Printf(LogPHASE, "Chap Input: %s\n", 670 chapcodes[chap->auth.in.hdr.code]); 671 break; 672 } 673 674 switch (chap->auth.in.hdr.code) { 675 case CHAP_CHALLENGE: 676 if (*bundle->cfg.auth.key == '!') 677 chap_StartChild(chap, bundle->cfg.auth.key + 1, 678 bundle->cfg.auth.name); 679 else 680 chap_Respond(chap, bundle->cfg.auth.name, 681 bundle->cfg.auth.key, p->link.lcp.his_authtype 682#ifdef HAVE_DES 683 , lanman 684#endif 685 ); 686 break; 687 688 case CHAP_RESPONSE: 689 name = chap->auth.in.name; 690 nlen = strlen(name); 691#ifndef NORADIUS 692 if (*bundle->radius.cfg.file) { 693 u_char end; 694 695 end = chap->challenge.local[*chap->challenge.local+1]; 696 chap->challenge.local[*chap->challenge.local+1] = '\0'; 697 radius_Authenticate(&bundle->radius, &chap->auth, 698 chap->auth.in.name, ans, 699 chap->challenge.local + 1); 700 chap->challenge.local[*chap->challenge.local+1] = end; 701 } else 702#endif 703 { 704 key = auth_GetSecret(bundle, name, nlen, p); 705 if (key) { 706 char *myans; 707#ifdef HAVE_DES 708 if (lanman && !IsEnabled(p->link.lcp.cfg.chap80lm)) { 709 log_Printf(LogPHASE, "Auth failure: LANMan not enabled\n"); 710 if (chap_HaveAnotherGo(chap)) 711 break; 712 key = NULL; 713 } else if (!lanman && !IsEnabled(p->link.lcp.cfg.chap80nt) && 714 p->link.lcp.want_authtype == 0x80) { 715 log_Printf(LogPHASE, "Auth failure: mschap not enabled\n"); 716 if (chap_HaveAnotherGo(chap)) 717 break; 718 key = NULL; 719 } else 720#endif 721 { 722 myans = chap_BuildAnswer(name, key, chap->auth.id, 723 chap->challenge.local, 724 p->link.lcp.want_authtype 725#ifdef HAVE_DES 726 , lanman 727#endif 728 ); 729 if (myans == NULL) 730 key = NULL; 731 else { 732 if (!chap_Cmp(p->link.lcp.want_authtype, myans + 1, *myans, 733 ans + 1, alen 734#ifdef HAVE_DES 735 , lanman 736#endif 737 )) 738 key = NULL; 739 free(myans); 740 } 741 } 742 } 743 744 if (key) 745 chap_Success(&chap->auth); 746 else 747 chap_Failure(&chap->auth); 748 } 749 750 break; 751 752 case CHAP_SUCCESS: 753 if (p->link.lcp.auth_iwait == PROTO_CHAP) { 754 p->link.lcp.auth_iwait = 0; 755 if (p->link.lcp.auth_ineed == 0) 756 /* 757 * We've succeeded in our ``login'' 758 * If we're not expecting the peer to authenticate (or he already 759 * has), proceed to network phase. 760 */ 761 datalink_AuthOk(p->dl); 762 } 763 break; 764 765 case CHAP_FAILURE: 766 datalink_AuthNotOk(p->dl); 767 break; 768 } 769 free(ans); 770 } 771 772 mbuf_Free(bp); 773 return NULL; 774} 775