chap.c revision 64465 
1/*
2 *			PPP CHAP Module
3 *
4 *	    Written by Toshiharu OHNO (tony-o@iij.ad.jp)
5 *
6 *   Copyright (C) 1993, Internet Initiative Japan, Inc. All rights reserverd.
7 *
8 * Redistribution and use in source and binary forms are permitted
9 * provided that the above copyright notice and this paragraph are
10 * duplicated in all such forms and that any documentation,
11 * advertising materials, and other materials related to such
12 * distribution and use acknowledge that the software was developed
13 * by the Internet Initiative Japan, Inc.  The name of the
14 * IIJ may not be used to endorse or promote products derived
15 * from this software without specific prior written permission.
16 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
18 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
19 *
20 * $FreeBSD: head/usr.sbin/ppp/chap.c 64465 2000-08-09 19:29:50Z brian $
21 *
22 *	TODO:
23 */
24#include <sys/param.h>
25#include <netinet/in.h>
26#include <netinet/in_systm.h>
27#include <netinet/ip.h>
28#include <sys/un.h>
29
30#include <errno.h>
31#include <fcntl.h>
32#ifdef HAVE_DES
33#include <md4.h>
34#endif
35#include <md5.h>
36#include <paths.h>
37#include <signal.h>
38#include <stdio.h>
39#include <stdlib.h>
40#include <string.h>
41#include <sys/wait.h>
42#include <termios.h>
43#include <unistd.h>
44
45#include "layer.h"
46#include "mbuf.h"
47#include "log.h"
48#include "defs.h"
49#include "timer.h"
50#include "fsm.h"
51#include "proto.h"
52#include "lqr.h"
53#include "hdlc.h"
54#include "lcp.h"
55#include "auth.h"
56#include "async.h"
57#include "throughput.h"
58#include "descriptor.h"
59#include "chap.h"
60#include "iplist.h"
61#include "slcompress.h"
62#include "ipcp.h"
63#include "filter.h"
64#include "ccp.h"
65#include "link.h"
66#include "physical.h"
67#include "mp.h"
68#ifndef NORADIUS
69#include "radius.h"
70#endif
71#include "bundle.h"
72#include "chat.h"
73#include "cbcp.h"
74#include "command.h"
75#include "datalink.h"
76#ifdef HAVE_DES
77#include "chap_ms.h"
78#endif
79#include "id.h"
80
81static const char * const chapcodes[] = {
82  "???", "CHALLENGE", "RESPONSE", "SUCCESS", "FAILURE"
83};
84#define MAXCHAPCODE (sizeof chapcodes / sizeof chapcodes[0] - 1)
85
86static void
87ChapOutput(struct physical *physical, u_int code, u_int id,
88	   const u_char *ptr, int count, const char *text)
89{
90  int plen;
91  struct fsmheader lh;
92  struct mbuf *bp;
93
94  plen = sizeof(struct fsmheader) + count;
95  lh.code = code;
96  lh.id = id;
97  lh.length = htons(plen);
98  bp = m_get(plen, MB_CHAPOUT);
99  memcpy(MBUF_CTOP(bp), &lh, sizeof(struct fsmheader));
100  if (count)
101    memcpy(MBUF_CTOP(bp) + sizeof(struct fsmheader), ptr, count);
102  log_DumpBp(LogDEBUG, "ChapOutput", bp);
103  if (text == NULL)
104    log_Printf(LogPHASE, "Chap Output: %s\n", chapcodes[code]);
105  else
106    log_Printf(LogPHASE, "Chap Output: %s (%s)\n", chapcodes[code], text);
107  link_PushPacket(&physical->link, bp, physical->dl->bundle,
108                  LINK_QUEUES(&physical->link) - 1, PROTO_CHAP);
109}
110
111static char *
112chap_BuildAnswer(char *name, char *key, u_char id, char *challenge, u_char type
113#ifdef HAVE_DES
114                 , int lanman
115#endif
116                )
117{
118  char *result, *digest;
119  size_t nlen, klen;
120
121  nlen = strlen(name);
122  klen = strlen(key);
123
124#ifdef HAVE_DES
125  if (type == 0x80) {
126    char expkey[AUTHLEN << 2];
127    MD4_CTX MD4context;
128    int f;
129
130    if ((result = malloc(1 + nlen + MS_CHAP_RESPONSE_LEN)) == NULL)
131      return result;
132
133    digest = result;					/* the response */
134    *digest++ = MS_CHAP_RESPONSE_LEN;			/* 49 */
135    memcpy(digest + MS_CHAP_RESPONSE_LEN, name, nlen);
136    if (lanman) {
137      memset(digest + 24, '\0', 25);
138      mschap_LANMan(digest, challenge + 1, key);	/* LANMan response */
139    } else {
140      memset(digest, '\0', 25);
141      digest += 24;
142
143      for (f = 0; f < klen; f++) {
144        expkey[2*f] = key[f];
145        expkey[2*f+1] = '\0';
146      }
147      /*
148       *           -----------
149       * expkey = | k\0e\0y\0 |
150       *           -----------
151       */
152      MD4Init(&MD4context);
153      MD4Update(&MD4context, expkey, klen << 1);
154      MD4Final(digest, &MD4context);
155
156      /*
157       *           ---- -------- ---------------- ------- ------
158       * result = | 49 | LANMan | 16 byte digest | 9 * ? | name |
159       *           ---- -------- ---------------- ------- ------
160       */
161      mschap_NT(digest, challenge + 1);
162    }
163    /*
164     *           ---- -------- ------------- ----- ------
165     *          |    |  struct MS_ChapResponse24  |      |
166     * result = | 49 | LANMan  |  NT digest | 0/1 | name |
167     *           ---- -------- ------------- ----- ------
168     * where only one of LANMan & NT digest are set.
169     */
170  } else
171#endif
172  if ((result = malloc(nlen + 17)) != NULL) {
173    /* Normal MD5 stuff */
174    MD5_CTX MD5context;
175
176    digest = result;
177    *digest++ = 16;				/* value size */
178
179    MD5Init(&MD5context);
180    MD5Update(&MD5context, &id, 1);
181    MD5Update(&MD5context, key, klen);
182    MD5Update(&MD5context, challenge + 1, *challenge);
183    MD5Final(digest, &MD5context);
184
185    memcpy(digest + 16, name, nlen);
186    /*
187     *           ---- -------- ------
188     * result = | 16 | digest | name |
189     *           ---- -------- ------
190     */
191  }
192
193  return result;
194}
195
196static void
197chap_StartChild(struct chap *chap, char *prog, const char *name)
198{
199  char *argv[MAXARGS], *nargv[MAXARGS];
200  int argc, fd;
201  int in[2], out[2];
202  pid_t pid;
203
204  if (chap->child.fd != -1) {
205    log_Printf(LogWARN, "Chap: %s: Program already running\n", prog);
206    return;
207  }
208
209  if (pipe(in) == -1) {
210    log_Printf(LogERROR, "Chap: pipe: %s\n", strerror(errno));
211    return;
212  }
213
214  if (pipe(out) == -1) {
215    log_Printf(LogERROR, "Chap: pipe: %s\n", strerror(errno));
216    close(in[0]);
217    close(in[1]);
218    return;
219  }
220
221  pid = getpid();
222  switch ((chap->child.pid = fork())) {
223    case -1:
224      log_Printf(LogERROR, "Chap: fork: %s\n", strerror(errno));
225      close(in[0]);
226      close(in[1]);
227      close(out[0]);
228      close(out[1]);
229      chap->child.pid = 0;
230      return;
231
232    case 0:
233      timer_TermService();
234
235      if ((argc = command_Interpret(prog, strlen(prog), argv)) <= 0) {
236        if (argc < 0) {
237          log_Printf(LogWARN, "CHAP: Invalid command syntax\n");
238          _exit(255);
239        }
240        _exit(0);
241      }
242
243      close(in[1]);
244      close(out[0]);
245      if (out[1] == STDIN_FILENO)
246        out[1] = dup(out[1]);
247      dup2(in[0], STDIN_FILENO);
248      dup2(out[1], STDOUT_FILENO);
249      close(STDERR_FILENO);
250      if (open(_PATH_DEVNULL, O_RDWR) != STDERR_FILENO) {
251        log_Printf(LogALERT, "Chap: Failed to open %s: %s\n",
252                  _PATH_DEVNULL, strerror(errno));
253        exit(1);
254      }
255      for (fd = getdtablesize(); fd > STDERR_FILENO; fd--)
256        fcntl(fd, F_SETFD, 1);
257      setuid(ID0realuid());
258      command_Expand(nargv, argc, (char const *const *)argv,
259                     chap->auth.physical->dl->bundle, 0, pid);
260      execvp(nargv[0], nargv);
261      printf("exec() of %s failed: %s\n", nargv[0], strerror(errno));
262      _exit(255);
263
264    default:
265      close(in[0]);
266      close(out[1]);
267      chap->child.fd = out[0];
268      chap->child.buf.len = 0;
269      write(in[1], chap->auth.in.name, strlen(chap->auth.in.name));
270      write(in[1], "\n", 1);
271      write(in[1], chap->challenge.peer + 1, *chap->challenge.peer);
272      write(in[1], "\n", 1);
273      write(in[1], name, strlen(name));
274      write(in[1], "\n", 1);
275      close(in[1]);
276      break;
277  }
278}
279
280static void
281chap_Cleanup(struct chap *chap, int sig)
282{
283  if (chap->child.pid) {
284    int status;
285
286    close(chap->child.fd);
287    chap->child.fd = -1;
288    if (sig)
289      kill(chap->child.pid, SIGTERM);
290    chap->child.pid = 0;
291    chap->child.buf.len = 0;
292
293    if (wait(&status) == -1)
294      log_Printf(LogERROR, "Chap: wait: %s\n", strerror(errno));
295    else if (WIFSIGNALED(status))
296      log_Printf(LogWARN, "Chap: Child received signal %d\n", WTERMSIG(status));
297    else if (WIFEXITED(status) && WEXITSTATUS(status))
298      log_Printf(LogERROR, "Chap: Child exited %d\n", WEXITSTATUS(status));
299  }
300  *chap->challenge.local = *chap->challenge.peer = '\0';
301#ifdef HAVE_DES
302  chap->peertries = 0;
303#endif
304}
305
306static void
307chap_Respond(struct chap *chap, char *name, char *key, u_char type
308#ifdef HAVE_DES
309             , int lm
310#endif
311            )
312{
313  u_char *ans;
314
315  ans = chap_BuildAnswer(name, key, chap->auth.id, chap->challenge.peer, type
316#ifdef HAVE_DES
317                         , lm
318#endif
319                        );
320
321  if (ans) {
322    ChapOutput(chap->auth.physical, CHAP_RESPONSE, chap->auth.id,
323               ans, *ans + 1 + strlen(name), name);
324#ifdef HAVE_DES
325    chap->NTRespSent = !lm;
326#endif
327    free(ans);
328  } else
329    ChapOutput(chap->auth.physical, CHAP_FAILURE, chap->auth.id,
330               "Out of memory!", 14, NULL);
331}
332
333static int
334chap_UpdateSet(struct fdescriptor *d, fd_set *r, fd_set *w, fd_set *e, int *n)
335{
336  struct chap *chap = descriptor2chap(d);
337
338  if (r && chap && chap->child.fd != -1) {
339    FD_SET(chap->child.fd, r);
340    if (*n < chap->child.fd + 1)
341      *n = chap->child.fd + 1;
342    log_Printf(LogTIMER, "Chap: fdset(r) %d\n", chap->child.fd);
343    return 1;
344  }
345
346  return 0;
347}
348
349static int
350chap_IsSet(struct fdescriptor *d, const fd_set *fdset)
351{
352  struct chap *chap = descriptor2chap(d);
353
354  return chap && chap->child.fd != -1 && FD_ISSET(chap->child.fd, fdset);
355}
356
357static void
358chap_Read(struct fdescriptor *d, struct bundle *bundle, const fd_set *fdset)
359{
360  struct chap *chap = descriptor2chap(d);
361  int got;
362
363  got = read(chap->child.fd, chap->child.buf.ptr + chap->child.buf.len,
364             sizeof chap->child.buf.ptr - chap->child.buf.len - 1);
365  if (got == -1) {
366    log_Printf(LogERROR, "Chap: Read: %s\n", strerror(errno));
367    chap_Cleanup(chap, SIGTERM);
368  } else if (got == 0) {
369    log_Printf(LogWARN, "Chap: Read: Child terminated connection\n");
370    chap_Cleanup(chap, SIGTERM);
371  } else {
372    char *name, *key, *end;
373
374    chap->child.buf.len += got;
375    chap->child.buf.ptr[chap->child.buf.len] = '\0';
376    name = chap->child.buf.ptr;
377    name += strspn(name, " \t");
378    if ((key = strchr(name, '\n')) == NULL)
379      end = NULL;
380    else
381      end = strchr(++key, '\n');
382
383    if (end == NULL) {
384      if (chap->child.buf.len == sizeof chap->child.buf.ptr - 1) {
385        log_Printf(LogWARN, "Chap: Read: Input buffer overflow\n");
386        chap_Cleanup(chap, SIGTERM);
387      }
388    } else {
389#ifdef HAVE_DES
390      int lanman = chap->auth.physical->link.lcp.his_authtype == 0x80 &&
391                   ((chap->NTRespSent &&
392                     IsAccepted(chap->auth.physical->link.lcp.cfg.chap80lm)) ||
393                    !IsAccepted(chap->auth.physical->link.lcp.cfg.chap80nt));
394#endif
395
396      while (end >= name && strchr(" \t\r\n", *end))
397        *end-- = '\0';
398      end = key - 1;
399      while (end >= name && strchr(" \t\r\n", *end))
400        *end-- = '\0';
401      key += strspn(key, " \t");
402
403      chap_Respond(chap, name, key, chap->auth.physical->link.lcp.his_authtype
404#ifdef HAVE_DES
405                   , lanman
406#endif
407                  );
408      chap_Cleanup(chap, 0);
409    }
410  }
411}
412
413static int
414chap_Write(struct fdescriptor *d, struct bundle *bundle, const fd_set *fdset)
415{
416  /* We never want to write here ! */
417  log_Printf(LogALERT, "chap_Write: Internal error: Bad call !\n");
418  return 0;
419}
420
421static void
422chap_Challenge(struct authinfo *authp)
423{
424  struct chap *chap = auth2chap(authp);
425  int len, i;
426  char *cp;
427
428  len = strlen(authp->physical->dl->bundle->cfg.auth.name);
429
430  if (!*chap->challenge.local) {
431    randinit();
432    cp = chap->challenge.local;
433
434#ifndef NORADIUS
435    if (*authp->physical->dl->bundle->radius.cfg.file) {
436      /* For radius, our challenge is 16 readable NUL terminated bytes :*/
437      *cp++ = 16;
438      for (i = 0; i < 16; i++)
439        *cp++ = (random() % 10) + '0';
440    } else
441#endif
442    {
443#ifdef HAVE_DES
444      if (authp->physical->link.lcp.want_authtype == 0x80)
445        *cp++ = 8;	/* MS does 8 byte callenges :-/ */
446      else
447#endif
448        *cp++ = random() % (CHAPCHALLENGELEN-16) + 16;
449      for (i = 0; i < *chap->challenge.local; i++)
450        *cp++ = random() & 0xff;
451    }
452    memcpy(cp, authp->physical->dl->bundle->cfg.auth.name, len);
453  }
454  ChapOutput(authp->physical, CHAP_CHALLENGE, authp->id, chap->challenge.local,
455	     1 + *chap->challenge.local + len, NULL);
456}
457
458static void
459chap_Success(struct authinfo *authp)
460{
461  datalink_GotAuthname(authp->physical->dl, authp->in.name);
462  ChapOutput(authp->physical, CHAP_SUCCESS, authp->id, "Welcome!!", 10, NULL);
463  authp->physical->link.lcp.auth_ineed = 0;
464  if (Enabled(authp->physical->dl->bundle, OPT_UTMP))
465    physical_Login(authp->physical, authp->in.name);
466
467  if (authp->physical->link.lcp.auth_iwait == 0)
468    /*
469     * Either I didn't need to authenticate, or I've already been
470     * told that I got the answer right.
471     */
472    datalink_AuthOk(authp->physical->dl);
473}
474
475static void
476chap_Failure(struct authinfo *authp)
477{
478  ChapOutput(authp->physical, CHAP_FAILURE, authp->id, "Invalid!!", 9, NULL);
479  datalink_AuthNotOk(authp->physical->dl);
480}
481
482static int
483chap_Cmp(u_char type, char *myans, int mylen, char *hisans, int hislen
484#ifdef HAVE_DES
485         , int lm
486#endif
487        )
488{
489  if (mylen != hislen)
490    return 0;
491#ifdef HAVE_DES
492  else if (type == 0x80) {
493    int off = lm ? 0 : 24;
494
495    if (memcmp(myans + off, hisans + off, 24))
496      return 0;
497  }
498#endif
499  else if (memcmp(myans, hisans, mylen))
500    return 0;
501
502  return 1;
503}
504
505#ifdef HAVE_DES
506static int
507chap_HaveAnotherGo(struct chap *chap)
508{
509  if (++chap->peertries < 3) {
510    /* Give the peer another shot */
511    *chap->challenge.local = '\0';
512    chap_Challenge(&chap->auth);
513    return 1;
514  }
515
516  return 0;
517}
518#endif
519
520void
521chap_Init(struct chap *chap, struct physical *p)
522{
523  chap->desc.type = CHAP_DESCRIPTOR;
524  chap->desc.UpdateSet = chap_UpdateSet;
525  chap->desc.IsSet = chap_IsSet;
526  chap->desc.Read = chap_Read;
527  chap->desc.Write = chap_Write;
528  chap->child.pid = 0;
529  chap->child.fd = -1;
530  auth_Init(&chap->auth, p, chap_Challenge, chap_Success, chap_Failure);
531  *chap->challenge.local = *chap->challenge.peer = '\0';
532#ifdef HAVE_DES
533  chap->NTRespSent = 0;
534  chap->peertries = 0;
535#endif
536}
537
538void
539chap_ReInit(struct chap *chap)
540{
541  chap_Cleanup(chap, SIGTERM);
542}
543
544struct mbuf *
545chap_Input(struct bundle *bundle, struct link *l, struct mbuf *bp)
546{
547  struct physical *p = link2physical(l);
548  struct chap *chap = &p->dl->chap;
549  char *name, *key, *ans;
550  int len, nlen;
551  u_char alen;
552#ifdef HAVE_DES
553  int lanman;
554#endif
555
556  if (p == NULL) {
557    log_Printf(LogERROR, "chap_Input: Not a physical link - dropped\n");
558    m_freem(bp);
559    return NULL;
560  }
561
562  if (bundle_Phase(bundle) != PHASE_NETWORK &&
563      bundle_Phase(bundle) != PHASE_AUTHENTICATE) {
564    log_Printf(LogPHASE, "Unexpected chap input - dropped !\n");
565    m_freem(bp);
566    return NULL;
567  }
568
569  m_settype(bp, MB_CHAPIN);
570  if ((bp = auth_ReadHeader(&chap->auth, bp)) == NULL &&
571      ntohs(chap->auth.in.hdr.length) == 0)
572    log_Printf(LogWARN, "Chap Input: Truncated header !\n");
573  else if (chap->auth.in.hdr.code == 0 || chap->auth.in.hdr.code > MAXCHAPCODE)
574    log_Printf(LogPHASE, "Chap Input: %d: Bad CHAP code !\n",
575               chap->auth.in.hdr.code);
576  else {
577    len = m_length(bp);
578    ans = NULL;
579
580    if (chap->auth.in.hdr.code != CHAP_CHALLENGE &&
581        chap->auth.id != chap->auth.in.hdr.id &&
582        Enabled(bundle, OPT_IDCHECK)) {
583      /* Wrong conversation dude ! */
584      log_Printf(LogPHASE, "Chap Input: %s dropped (got id %d, not %d)\n",
585                 chapcodes[chap->auth.in.hdr.code], chap->auth.in.hdr.id,
586                 chap->auth.id);
587      m_freem(bp);
588      return NULL;
589    }
590    chap->auth.id = chap->auth.in.hdr.id;	/* We respond with this id */
591
592#ifdef HAVE_DES
593    lanman = 0;
594#endif
595    switch (chap->auth.in.hdr.code) {
596      case CHAP_CHALLENGE:
597        bp = mbuf_Read(bp, &alen, 1);
598        len -= alen + 1;
599        if (len < 0) {
600          log_Printf(LogERROR, "Chap Input: Truncated challenge !\n");
601          m_freem(bp);
602          return NULL;
603        }
604        *chap->challenge.peer = alen;
605        bp = mbuf_Read(bp, chap->challenge.peer + 1, alen);
606        bp = auth_ReadName(&chap->auth, bp, len);
607#ifdef HAVE_DES
608        lanman = p->link.lcp.his_authtype == 0x80 &&
609                 ((chap->NTRespSent && IsAccepted(p->link.lcp.cfg.chap80lm)) ||
610                  !IsAccepted(p->link.lcp.cfg.chap80nt));
611#endif
612        break;
613
614      case CHAP_RESPONSE:
615        auth_StopTimer(&chap->auth);
616        bp = mbuf_Read(bp, &alen, 1);
617        len -= alen + 1;
618        if (len < 0) {
619          log_Printf(LogERROR, "Chap Input: Truncated response !\n");
620          m_freem(bp);
621          return NULL;
622        }
623        if ((ans = malloc(alen + 2)) == NULL) {
624          log_Printf(LogERROR, "Chap Input: Out of memory !\n");
625          m_freem(bp);
626          return NULL;
627        }
628        *ans = chap->auth.id;
629        bp = mbuf_Read(bp, ans + 1, alen);
630        ans[alen+1] = '\0';
631        bp = auth_ReadName(&chap->auth, bp, len);
632#ifdef HAVE_DES
633        lanman = alen == 49 && ans[alen] == 0;
634#endif
635        break;
636
637      case CHAP_SUCCESS:
638      case CHAP_FAILURE:
639        /* chap->auth.in.name is already set up at CHALLENGE time */
640        if ((ans = malloc(len + 1)) == NULL) {
641          log_Printf(LogERROR, "Chap Input: Out of memory !\n");
642          m_freem(bp);
643          return NULL;
644        }
645        bp = mbuf_Read(bp, ans, len);
646        ans[len] = '\0';
647        break;
648    }
649
650    switch (chap->auth.in.hdr.code) {
651      case CHAP_CHALLENGE:
652      case CHAP_RESPONSE:
653        if (*chap->auth.in.name)
654          log_Printf(LogPHASE, "Chap Input: %s (%d bytes from %s%s)\n",
655                     chapcodes[chap->auth.in.hdr.code], alen,
656                     chap->auth.in.name,
657#ifdef HAVE_DES
658                     lanman && chap->auth.in.hdr.code == CHAP_RESPONSE ?
659                     " - lanman" :
660#endif
661                     "");
662        else
663          log_Printf(LogPHASE, "Chap Input: %s (%d bytes%s)\n",
664                     chapcodes[chap->auth.in.hdr.code], alen,
665#ifdef HAVE_DES
666                     lanman && chap->auth.in.hdr.code == CHAP_RESPONSE ?
667                     " - lanman" :
668#endif
669                     "");
670        break;
671
672      case CHAP_SUCCESS:
673      case CHAP_FAILURE:
674        if (*ans)
675          log_Printf(LogPHASE, "Chap Input: %s (%s)\n",
676                     chapcodes[chap->auth.in.hdr.code], ans);
677        else
678          log_Printf(LogPHASE, "Chap Input: %s\n",
679                     chapcodes[chap->auth.in.hdr.code]);
680        break;
681    }
682
683    switch (chap->auth.in.hdr.code) {
684      case CHAP_CHALLENGE:
685        if (*bundle->cfg.auth.key == '!' && bundle->cfg.auth.key[1] != '!')
686          chap_StartChild(chap, bundle->cfg.auth.key + 1,
687                          bundle->cfg.auth.name);
688        else
689          chap_Respond(chap, bundle->cfg.auth.name, bundle->cfg.auth.key +
690                       (*bundle->cfg.auth.key == '!' ? 1 : 0),
691                       p->link.lcp.his_authtype
692#ifdef HAVE_DES
693                       , lanman
694#endif
695                      );
696        break;
697
698      case CHAP_RESPONSE:
699        name = chap->auth.in.name;
700        nlen = strlen(name);
701#ifndef NORADIUS
702        if (*bundle->radius.cfg.file) {
703          u_char end;
704
705          end = chap->challenge.local[*chap->challenge.local+1];
706          chap->challenge.local[*chap->challenge.local+1] = '\0';
707          radius_Authenticate(&bundle->radius, &chap->auth,
708                              chap->auth.in.name, ans,
709                              chap->challenge.local + 1);
710          chap->challenge.local[*chap->challenge.local+1] = end;
711        } else
712#endif
713        {
714          key = auth_GetSecret(bundle, name, nlen, p);
715          if (key) {
716            char *myans;
717#ifdef HAVE_DES
718            if (lanman && !IsEnabled(p->link.lcp.cfg.chap80lm)) {
719              log_Printf(LogPHASE, "Auth failure: LANMan not enabled\n");
720              if (chap_HaveAnotherGo(chap))
721                break;
722              key = NULL;
723            } else if (!lanman && !IsEnabled(p->link.lcp.cfg.chap80nt) &&
724                       p->link.lcp.want_authtype == 0x80) {
725              log_Printf(LogPHASE, "Auth failure: mschap not enabled\n");
726              if (chap_HaveAnotherGo(chap))
727                break;
728              key = NULL;
729            } else
730#endif
731            {
732              myans = chap_BuildAnswer(name, key, chap->auth.id,
733                                       chap->challenge.local,
734                                       p->link.lcp.want_authtype
735#ifdef HAVE_DES
736                                       , lanman
737#endif
738                                      );
739              if (myans == NULL)
740                key = NULL;
741              else {
742                if (!chap_Cmp(p->link.lcp.want_authtype, myans + 1, *myans,
743                              ans + 1, alen
744#ifdef HAVE_DES
745                              , lanman
746#endif
747                             ))
748                  key = NULL;
749                free(myans);
750              }
751            }
752          }
753
754          if (key)
755            chap_Success(&chap->auth);
756          else
757            chap_Failure(&chap->auth);
758        }
759
760        break;
761
762      case CHAP_SUCCESS:
763        if (p->link.lcp.auth_iwait == PROTO_CHAP) {
764          p->link.lcp.auth_iwait = 0;
765          if (p->link.lcp.auth_ineed == 0)
766            /*
767             * We've succeeded in our ``login''
768             * If we're not expecting  the peer to authenticate (or he already
769             * has), proceed to network phase.
770             */
771            datalink_AuthOk(p->dl);
772        }
773        break;
774
775      case CHAP_FAILURE:
776        datalink_AuthNotOk(p->dl);
777        break;
778    }
779    free(ans);
780  }
781
782  m_freem(bp);
783  return NULL;
784}
785