chap.c revision 96324
178189Sbrian/*- 278189Sbrian * Copyright (c) 1996 - 2001 Brian Somers <brian@Awfulhak.org> 378189Sbrian * based on work by Toshiharu OHNO <tony-o@iij.ad.jp> 478189Sbrian * Internet Initiative Japan, Inc (IIJ) 578189Sbrian * All rights reserved. 66059Samurai * 778189Sbrian * Redistribution and use in source and binary forms, with or without 878189Sbrian * modification, are permitted provided that the following conditions 978189Sbrian * are met: 1078189Sbrian * 1. Redistributions of source code must retain the above copyright 1178189Sbrian * notice, this list of conditions and the following disclaimer. 1278189Sbrian * 2. Redistributions in binary form must reproduce the above copyright 1378189Sbrian * notice, this list of conditions and the following disclaimer in the 1478189Sbrian * documentation and/or other materials provided with the distribution. 156059Samurai * 1678189Sbrian * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 1778189Sbrian * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 1878189Sbrian * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 1978189Sbrian * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 2078189Sbrian * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 2178189Sbrian * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 2278189Sbrian * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 2378189Sbrian * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 2478189Sbrian * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 2578189Sbrian * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 2678189Sbrian * SUCH DAMAGE. 276059Samurai * 2850479Speter * $FreeBSD: head/usr.sbin/ppp/chap.c 96324 2002-05-10 03:11:35Z brian $ 296059Samurai */ 3078189Sbrian 3143313Sbrian#include <sys/param.h> 3230715Sbrian#include <netinet/in.h> 3336285Sbrian#include <netinet/in_systm.h> 3436285Sbrian#include <netinet/ip.h> 3581634Sbrian#include <sys/socket.h> 3636285Sbrian#include <sys/un.h> 3730715Sbrian 3843888Sbrian#include <errno.h> 3943888Sbrian#include <fcntl.h> 4093418Sbrian#ifndef NODES 4136287Sbrian#include <md4.h> 4237192Sbrian#endif 4330715Sbrian#include <md5.h> 4443888Sbrian#include <paths.h> 4543888Sbrian#include <signal.h> 4649976Sbrian#include <stdio.h> 4730715Sbrian#include <stdlib.h> 4844106Sbrian#include <string.h> 4943888Sbrian#include <sys/wait.h> 5036285Sbrian#include <termios.h> 5143888Sbrian#include <unistd.h> 5229840Sbrian 5346686Sbrian#include "layer.h" 5430715Sbrian#include "mbuf.h" 5530715Sbrian#include "log.h" 5630715Sbrian#include "defs.h" 5730715Sbrian#include "timer.h" 586059Samurai#include "fsm.h" 5946686Sbrian#include "proto.h" 6036285Sbrian#include "lqr.h" 616059Samurai#include "hdlc.h" 6263484Sbrian#include "lcp.h" 636735Samurai#include "auth.h" 6436285Sbrian#include "async.h" 6536285Sbrian#include "throughput.h" 6636285Sbrian#include "descriptor.h" 6743888Sbrian#include "chap.h" 6836285Sbrian#include "iplist.h" 6936285Sbrian#include "slcompress.h" 7081634Sbrian#include "ncpaddr.h" 7181634Sbrian#include "ip.h" 7236285Sbrian#include "ipcp.h" 7336285Sbrian#include "filter.h" 7436285Sbrian#include "ccp.h" 7536285Sbrian#include "link.h" 7636285Sbrian#include "physical.h" 7736285Sbrian#include "mp.h" 7843313Sbrian#ifndef NORADIUS 7943313Sbrian#include "radius.h" 8043313Sbrian#endif 8181634Sbrian#include "ipv6cp.h" 8281634Sbrian#include "ncp.h" 8336285Sbrian#include "bundle.h" 8436285Sbrian#include "chat.h" 8538174Sbrian#include "cbcp.h" 8643888Sbrian#include "command.h" 8736285Sbrian#include "datalink.h" 8893418Sbrian#ifndef NODES 8936287Sbrian#include "chap_ms.h" 9067910Sbrian#include "mppe.h" 9137192Sbrian#endif 9255253Sbrian#include "id.h" 936059Samurai 9455146Sbrianstatic const char * const chapcodes[] = { 9519866Sphk "???", "CHALLENGE", "RESPONSE", "SUCCESS", "FAILURE" 966059Samurai}; 9743693Sbrian#define MAXCHAPCODE (sizeof chapcodes / sizeof chapcodes[0] - 1) 986059Samurai 9930715Sbrianstatic void 10036285SbrianChapOutput(struct physical *physical, u_int code, u_int id, 10143693Sbrian const u_char *ptr, int count, const char *text) 1026059Samurai{ 1036059Samurai int plen; 1046059Samurai struct fsmheader lh; 1056059Samurai struct mbuf *bp; 1066059Samurai 10728679Sbrian plen = sizeof(struct fsmheader) + count; 1086059Samurai lh.code = code; 1096059Samurai lh.id = id; 1106059Samurai lh.length = htons(plen); 11154912Sbrian bp = m_get(plen, MB_CHAPOUT); 11230715Sbrian memcpy(MBUF_CTOP(bp), &lh, sizeof(struct fsmheader)); 1136059Samurai if (count) 11430715Sbrian memcpy(MBUF_CTOP(bp) + sizeof(struct fsmheader), ptr, count); 11536285Sbrian log_DumpBp(LogDEBUG, "ChapOutput", bp); 11637926Sbrian if (text == NULL) 11737926Sbrian log_Printf(LogPHASE, "Chap Output: %s\n", chapcodes[code]); 11837926Sbrian else 11937926Sbrian log_Printf(LogPHASE, "Chap Output: %s (%s)\n", chapcodes[code], text); 12046686Sbrian link_PushPacket(&physical->link, bp, physical->dl->bundle, 12150867Sbrian LINK_QUEUES(&physical->link) - 1, PROTO_CHAP); 1226059Samurai} 1236059Samurai 12443693Sbrianstatic char * 12544123Sbrianchap_BuildAnswer(char *name, char *key, u_char id, char *challenge, u_char type 12693418Sbrian#ifndef NODES 12767910Sbrian , char *peerchallenge, char *authresponse, int lanman 12844123Sbrian#endif 12944123Sbrian ) 1306059Samurai{ 13143693Sbrian char *result, *digest; 13243693Sbrian size_t nlen, klen; 13343693Sbrian 13443693Sbrian nlen = strlen(name); 13543693Sbrian klen = strlen(key); 13643693Sbrian 13793418Sbrian#ifndef NODES 13844106Sbrian if (type == 0x80) { 13943693Sbrian char expkey[AUTHLEN << 2]; 14043693Sbrian MD4_CTX MD4context; 14143693Sbrian int f; 14243693Sbrian 14343693Sbrian if ((result = malloc(1 + nlen + MS_CHAP_RESPONSE_LEN)) == NULL) 14443693Sbrian return result; 14543693Sbrian 14644106Sbrian digest = result; /* the response */ 14744106Sbrian *digest++ = MS_CHAP_RESPONSE_LEN; /* 49 */ 14844106Sbrian memcpy(digest + MS_CHAP_RESPONSE_LEN, name, nlen); 14944106Sbrian if (lanman) { 15044106Sbrian memset(digest + 24, '\0', 25); 15144106Sbrian mschap_LANMan(digest, challenge + 1, key); /* LANMan response */ 15244106Sbrian } else { 15344106Sbrian memset(digest, '\0', 25); 15444106Sbrian digest += 24; 15543693Sbrian 15644106Sbrian for (f = 0; f < klen; f++) { 15744106Sbrian expkey[2*f] = key[f]; 15844106Sbrian expkey[2*f+1] = '\0'; 15944106Sbrian } 16044106Sbrian /* 16144106Sbrian * ----------- 16244106Sbrian * expkey = | k\0e\0y\0 | 16344106Sbrian * ----------- 16444106Sbrian */ 16544106Sbrian MD4Init(&MD4context); 16644106Sbrian MD4Update(&MD4context, expkey, klen << 1); 16744106Sbrian MD4Final(digest, &MD4context); 16844106Sbrian 16944106Sbrian /* 17044106Sbrian * ---- -------- ---------------- ------- ------ 17144106Sbrian * result = | 49 | LANMan | 16 byte digest | 9 * ? | name | 17244106Sbrian * ---- -------- ---------------- ------- ------ 17344106Sbrian */ 17444106Sbrian mschap_NT(digest, challenge + 1); 17543693Sbrian } 17643693Sbrian /* 17744106Sbrian * ---- -------- ------------- ----- ------ 17844106Sbrian * | | struct MS_ChapResponse24 | | 17944106Sbrian * result = | 49 | LANMan | NT digest | 0/1 | name | 18044106Sbrian * ---- -------- ------------- ----- ------ 18144106Sbrian * where only one of LANMan & NT digest are set. 18243693Sbrian */ 18367910Sbrian } else if (type == 0x81) { 18467910Sbrian char expkey[AUTHLEN << 2]; 18567910Sbrian char pwdhash[CHAP81_HASH_LEN]; 18667910Sbrian char pwdhashhash[CHAP81_HASH_LEN]; 18767910Sbrian char *ntresponse; 18867910Sbrian int f; 18967910Sbrian 19067910Sbrian if ((result = malloc(1 + nlen + CHAP81_RESPONSE_LEN)) == NULL) 19167910Sbrian return result; 19267910Sbrian 19367910Sbrian memset(result, 0, 1 + nlen + CHAP81_RESPONSE_LEN); 19467910Sbrian 19567910Sbrian digest = result; 19667910Sbrian *digest++ = CHAP81_RESPONSE_LEN; /* value size */ 19767910Sbrian 19867910Sbrian /* Copy our challenge */ 19967910Sbrian memcpy(digest, peerchallenge + 1, CHAP81_CHALLENGE_LEN); 20067910Sbrian 20167910Sbrian /* Expand password to Unicode XXX */ 20267910Sbrian for (f = 0; f < klen; f++) { 20367910Sbrian expkey[2*f] = key[f]; 20467910Sbrian expkey[2*f+1] = '\0'; 20567910Sbrian } 20667910Sbrian 20767910Sbrian ntresponse = digest + CHAP81_NTRESPONSE_OFF; 20867910Sbrian 20967910Sbrian /* Get some needed hashes */ 21067910Sbrian NtPasswordHash(expkey, klen * 2, pwdhash); 21167910Sbrian HashNtPasswordHash(pwdhash, pwdhashhash); 21267910Sbrian 21367910Sbrian /* Generate NTRESPONSE to respond on challenge call */ 21467910Sbrian GenerateNTResponse(challenge + 1, peerchallenge + 1, name, nlen, 21567910Sbrian expkey, klen * 2, ntresponse); 21667910Sbrian 21767910Sbrian /* Generate MPPE MASTERKEY */ 21868461Sbrian GetMasterKey(pwdhashhash, ntresponse, MPPE_MasterKey); /* XXX Global ! */ 21967910Sbrian 22067910Sbrian /* Generate AUTHRESPONSE to verify on auth success */ 22167910Sbrian GenerateAuthenticatorResponse(expkey, klen * 2, ntresponse, 22267910Sbrian peerchallenge + 1, challenge + 1, name, nlen, 22367910Sbrian authresponse); 22467910Sbrian 22567910Sbrian authresponse[CHAP81_AUTHRESPONSE_LEN] = 0; 22667910Sbrian 22767910Sbrian memcpy(digest + CHAP81_RESPONSE_LEN, name, nlen); 22843693Sbrian } else 22943693Sbrian#endif 23043693Sbrian if ((result = malloc(nlen + 17)) != NULL) { 23143693Sbrian /* Normal MD5 stuff */ 23243693Sbrian MD5_CTX MD5context; 23343693Sbrian 23443693Sbrian digest = result; 23543693Sbrian *digest++ = 16; /* value size */ 23643693Sbrian 23743693Sbrian MD5Init(&MD5context); 23843693Sbrian MD5Update(&MD5context, &id, 1); 23943693Sbrian MD5Update(&MD5context, key, klen); 24043693Sbrian MD5Update(&MD5context, challenge + 1, *challenge); 24143693Sbrian MD5Final(digest, &MD5context); 24243693Sbrian 24343693Sbrian memcpy(digest + 16, name, nlen); 24443693Sbrian /* 24543693Sbrian * ---- -------- ------ 24643693Sbrian * result = | 16 | digest | name | 24743693Sbrian * ---- -------- ------ 24843693Sbrian */ 24943693Sbrian } 25043693Sbrian 25143693Sbrian return result; 25243693Sbrian} 25343693Sbrian 25443693Sbrianstatic void 25543888Sbrianchap_StartChild(struct chap *chap, char *prog, const char *name) 25643888Sbrian{ 25743888Sbrian char *argv[MAXARGS], *nargv[MAXARGS]; 25843888Sbrian int argc, fd; 25943888Sbrian int in[2], out[2]; 26047849Sbrian pid_t pid; 26143888Sbrian 26243888Sbrian if (chap->child.fd != -1) { 26343888Sbrian log_Printf(LogWARN, "Chap: %s: Program already running\n", prog); 26443888Sbrian return; 26543888Sbrian } 26643888Sbrian 26743888Sbrian if (pipe(in) == -1) { 26843888Sbrian log_Printf(LogERROR, "Chap: pipe: %s\n", strerror(errno)); 26943888Sbrian return; 27043888Sbrian } 27143888Sbrian 27243888Sbrian if (pipe(out) == -1) { 27343888Sbrian log_Printf(LogERROR, "Chap: pipe: %s\n", strerror(errno)); 27443888Sbrian close(in[0]); 27543888Sbrian close(in[1]); 27643888Sbrian return; 27743888Sbrian } 27843888Sbrian 27947849Sbrian pid = getpid(); 28043888Sbrian switch ((chap->child.pid = fork())) { 28143888Sbrian case -1: 28243888Sbrian log_Printf(LogERROR, "Chap: fork: %s\n", strerror(errno)); 28343888Sbrian close(in[0]); 28443888Sbrian close(in[1]); 28543888Sbrian close(out[0]); 28643888Sbrian close(out[1]); 28743888Sbrian chap->child.pid = 0; 28843888Sbrian return; 28943888Sbrian 29043888Sbrian case 0: 29143888Sbrian timer_TermService(); 29254914Sbrian 29354914Sbrian if ((argc = command_Interpret(prog, strlen(prog), argv)) <= 0) { 29454914Sbrian if (argc < 0) { 29554914Sbrian log_Printf(LogWARN, "CHAP: Invalid command syntax\n"); 29654914Sbrian _exit(255); 29754914Sbrian } 29854914Sbrian _exit(0); 29954914Sbrian } 30054914Sbrian 30143888Sbrian close(in[1]); 30243888Sbrian close(out[0]); 30349976Sbrian if (out[1] == STDIN_FILENO) 30449976Sbrian out[1] = dup(out[1]); 30543888Sbrian dup2(in[0], STDIN_FILENO); 30643888Sbrian dup2(out[1], STDOUT_FILENO); 30749976Sbrian close(STDERR_FILENO); 30849976Sbrian if (open(_PATH_DEVNULL, O_RDWR) != STDERR_FILENO) { 30943888Sbrian log_Printf(LogALERT, "Chap: Failed to open %s: %s\n", 31043888Sbrian _PATH_DEVNULL, strerror(errno)); 31143888Sbrian exit(1); 31243888Sbrian } 31349976Sbrian for (fd = getdtablesize(); fd > STDERR_FILENO; fd--) 31449976Sbrian fcntl(fd, F_SETFD, 1); 31564802Sbrian#ifndef NOSUID 31655252Sbrian setuid(ID0realuid()); 31764802Sbrian#endif 31843888Sbrian command_Expand(nargv, argc, (char const *const *)argv, 31947849Sbrian chap->auth.physical->dl->bundle, 0, pid); 32043888Sbrian execvp(nargv[0], nargv); 32149976Sbrian printf("exec() of %s failed: %s\n", nargv[0], strerror(errno)); 32249976Sbrian _exit(255); 32343888Sbrian 32443888Sbrian default: 32543888Sbrian close(in[0]); 32643888Sbrian close(out[1]); 32743888Sbrian chap->child.fd = out[0]; 32843888Sbrian chap->child.buf.len = 0; 32943888Sbrian write(in[1], chap->auth.in.name, strlen(chap->auth.in.name)); 33043888Sbrian write(in[1], "\n", 1); 33145907Sbrian write(in[1], chap->challenge.peer + 1, *chap->challenge.peer); 33243888Sbrian write(in[1], "\n", 1); 33343888Sbrian write(in[1], name, strlen(name)); 33443888Sbrian write(in[1], "\n", 1); 33543888Sbrian close(in[1]); 33643888Sbrian break; 33743888Sbrian } 33843888Sbrian} 33943888Sbrian 34043888Sbrianstatic void 34143888Sbrianchap_Cleanup(struct chap *chap, int sig) 34243888Sbrian{ 34343888Sbrian if (chap->child.pid) { 34443888Sbrian int status; 34543888Sbrian 34643888Sbrian close(chap->child.fd); 34743888Sbrian chap->child.fd = -1; 34843888Sbrian if (sig) 34943888Sbrian kill(chap->child.pid, SIGTERM); 35043888Sbrian chap->child.pid = 0; 35143888Sbrian chap->child.buf.len = 0; 35243888Sbrian 35343888Sbrian if (wait(&status) == -1) 35443888Sbrian log_Printf(LogERROR, "Chap: wait: %s\n", strerror(errno)); 35543888Sbrian else if (WIFSIGNALED(status)) 35643888Sbrian log_Printf(LogWARN, "Chap: Child received signal %d\n", WTERMSIG(status)); 35743888Sbrian else if (WIFEXITED(status) && WEXITSTATUS(status)) 35843888Sbrian log_Printf(LogERROR, "Chap: Child exited %d\n", WEXITSTATUS(status)); 35943888Sbrian } 36045907Sbrian *chap->challenge.local = *chap->challenge.peer = '\0'; 36193418Sbrian#ifndef NODES 36244106Sbrian chap->peertries = 0; 36344123Sbrian#endif 36443888Sbrian} 36543888Sbrian 36643888Sbrianstatic void 36744123Sbrianchap_Respond(struct chap *chap, char *name, char *key, u_char type 36893418Sbrian#ifndef NODES 36944123Sbrian , int lm 37044123Sbrian#endif 37144123Sbrian ) 37243888Sbrian{ 37344106Sbrian u_char *ans; 37443888Sbrian 37545907Sbrian ans = chap_BuildAnswer(name, key, chap->auth.id, chap->challenge.peer, type 37693418Sbrian#ifndef NODES 37767910Sbrian , chap->challenge.local, chap->authresponse, lm 37844123Sbrian#endif 37944123Sbrian ); 38043888Sbrian 38143888Sbrian if (ans) { 38243888Sbrian ChapOutput(chap->auth.physical, CHAP_RESPONSE, chap->auth.id, 38343888Sbrian ans, *ans + 1 + strlen(name), name); 38493418Sbrian#ifndef NODES 38544106Sbrian chap->NTRespSent = !lm; 38668461Sbrian MPPE_IsServer = 0; /* XXX Global ! */ 38744123Sbrian#endif 38843888Sbrian free(ans); 38943888Sbrian } else 39043888Sbrian ChapOutput(chap->auth.physical, CHAP_FAILURE, chap->auth.id, 39143888Sbrian "Out of memory!", 14, NULL); 39243888Sbrian} 39343888Sbrian 39443888Sbrianstatic int 39558028Sbrianchap_UpdateSet(struct fdescriptor *d, fd_set *r, fd_set *w, fd_set *e, int *n) 39643888Sbrian{ 39743888Sbrian struct chap *chap = descriptor2chap(d); 39843888Sbrian 39943888Sbrian if (r && chap && chap->child.fd != -1) { 40043888Sbrian FD_SET(chap->child.fd, r); 40143888Sbrian if (*n < chap->child.fd + 1) 40243888Sbrian *n = chap->child.fd + 1; 40343888Sbrian log_Printf(LogTIMER, "Chap: fdset(r) %d\n", chap->child.fd); 40443888Sbrian return 1; 40543888Sbrian } 40643888Sbrian 40743888Sbrian return 0; 40843888Sbrian} 40943888Sbrian 41043888Sbrianstatic int 41158028Sbrianchap_IsSet(struct fdescriptor *d, const fd_set *fdset) 41243888Sbrian{ 41343888Sbrian struct chap *chap = descriptor2chap(d); 41443888Sbrian 41543888Sbrian return chap && chap->child.fd != -1 && FD_ISSET(chap->child.fd, fdset); 41643888Sbrian} 41743888Sbrian 41843888Sbrianstatic void 41958028Sbrianchap_Read(struct fdescriptor *d, struct bundle *bundle, const fd_set *fdset) 42043888Sbrian{ 42143888Sbrian struct chap *chap = descriptor2chap(d); 42243888Sbrian int got; 42343888Sbrian 42443888Sbrian got = read(chap->child.fd, chap->child.buf.ptr + chap->child.buf.len, 42543888Sbrian sizeof chap->child.buf.ptr - chap->child.buf.len - 1); 42643888Sbrian if (got == -1) { 42743888Sbrian log_Printf(LogERROR, "Chap: Read: %s\n", strerror(errno)); 42843888Sbrian chap_Cleanup(chap, SIGTERM); 42943888Sbrian } else if (got == 0) { 43043888Sbrian log_Printf(LogWARN, "Chap: Read: Child terminated connection\n"); 43143888Sbrian chap_Cleanup(chap, SIGTERM); 43243888Sbrian } else { 43343888Sbrian char *name, *key, *end; 43443888Sbrian 43543888Sbrian chap->child.buf.len += got; 43643888Sbrian chap->child.buf.ptr[chap->child.buf.len] = '\0'; 43743888Sbrian name = chap->child.buf.ptr; 43843888Sbrian name += strspn(name, " \t"); 43943888Sbrian if ((key = strchr(name, '\n')) == NULL) 44043888Sbrian end = NULL; 44143888Sbrian else 44243888Sbrian end = strchr(++key, '\n'); 44343888Sbrian 44443888Sbrian if (end == NULL) { 44543888Sbrian if (chap->child.buf.len == sizeof chap->child.buf.ptr - 1) { 44643888Sbrian log_Printf(LogWARN, "Chap: Read: Input buffer overflow\n"); 44743888Sbrian chap_Cleanup(chap, SIGTERM); 44843888Sbrian } 44943888Sbrian } else { 45093418Sbrian#ifndef NODES 45144106Sbrian int lanman = chap->auth.physical->link.lcp.his_authtype == 0x80 && 45244106Sbrian ((chap->NTRespSent && 45344106Sbrian IsAccepted(chap->auth.physical->link.lcp.cfg.chap80lm)) || 45444106Sbrian !IsAccepted(chap->auth.physical->link.lcp.cfg.chap80nt)); 45544123Sbrian#endif 45644106Sbrian 45743888Sbrian while (end >= name && strchr(" \t\r\n", *end)) 45843888Sbrian *end-- = '\0'; 45943888Sbrian end = key - 1; 46043888Sbrian while (end >= name && strchr(" \t\r\n", *end)) 46143888Sbrian *end-- = '\0'; 46243888Sbrian key += strspn(key, " \t"); 46343888Sbrian 46444123Sbrian chap_Respond(chap, name, key, chap->auth.physical->link.lcp.his_authtype 46593418Sbrian#ifndef NODES 46644123Sbrian , lanman 46744123Sbrian#endif 46844123Sbrian ); 46943888Sbrian chap_Cleanup(chap, 0); 47043888Sbrian } 47143888Sbrian } 47243888Sbrian} 47343888Sbrian 47443888Sbrianstatic int 47558028Sbrianchap_Write(struct fdescriptor *d, struct bundle *bundle, const fd_set *fdset) 47643888Sbrian{ 47743888Sbrian /* We never want to write here ! */ 47843888Sbrian log_Printf(LogALERT, "chap_Write: Internal error: Bad call !\n"); 47943888Sbrian return 0; 48043888Sbrian} 48143888Sbrian 48243888Sbrianstatic void 48367910Sbrianchap_ChallengeInit(struct authinfo *authp) 48443693Sbrian{ 48543693Sbrian struct chap *chap = auth2chap(authp); 48613379Sphk int len, i; 4876059Samurai char *cp; 4886059Samurai 48943888Sbrian len = strlen(authp->physical->dl->bundle->cfg.auth.name); 49043401Sbrian 49145907Sbrian if (!*chap->challenge.local) { 49243888Sbrian randinit(); 49345907Sbrian cp = chap->challenge.local; 49443888Sbrian 49543313Sbrian#ifndef NORADIUS 49643888Sbrian if (*authp->physical->dl->bundle->radius.cfg.file) { 49743888Sbrian /* For radius, our challenge is 16 readable NUL terminated bytes :*/ 49843888Sbrian *cp++ = 16; 49943888Sbrian for (i = 0; i < 16; i++) 50043888Sbrian *cp++ = (random() % 10) + '0'; 50143888Sbrian } else 50243313Sbrian#endif 50343888Sbrian { 50493418Sbrian#ifndef NODES 50544106Sbrian if (authp->physical->link.lcp.want_authtype == 0x80) 50644106Sbrian *cp++ = 8; /* MS does 8 byte callenges :-/ */ 50767910Sbrian else if (authp->physical->link.lcp.want_authtype == 0x81) 50867910Sbrian *cp++ = 16; /* MS-CHAP-V2 does 16 bytes challenges */ 50944106Sbrian else 51044106Sbrian#endif 51144106Sbrian *cp++ = random() % (CHAPCHALLENGELEN-16) + 16; 51245907Sbrian for (i = 0; i < *chap->challenge.local; i++) 51343888Sbrian *cp++ = random() & 0xff; 51443888Sbrian } 51543888Sbrian memcpy(cp, authp->physical->dl->bundle->cfg.auth.name, len); 51643313Sbrian } 5176059Samurai} 5186059Samurai 51930715Sbrianstatic void 52067910Sbrianchap_Challenge(struct authinfo *authp) 52167910Sbrian{ 52267910Sbrian struct chap *chap = auth2chap(authp); 52367910Sbrian int len; 52467910Sbrian 52567912Sbrian log_Printf(LogDEBUG, "CHAP%02X: Challenge\n", 52667912Sbrian authp->physical->link.lcp.want_authtype); 52767910Sbrian 52867910Sbrian len = strlen(authp->physical->dl->bundle->cfg.auth.name); 52967910Sbrian 53067910Sbrian /* Generate new local challenge value */ 53167910Sbrian if (!*chap->challenge.local) 53267910Sbrian chap_ChallengeInit(authp); 53367910Sbrian 53493418Sbrian#ifndef NODES 53567910Sbrian if (authp->physical->link.lcp.want_authtype == 0x81) 53667910Sbrian ChapOutput(authp->physical, CHAP_CHALLENGE, authp->id, 53767910Sbrian chap->challenge.local, 1 + *chap->challenge.local, NULL); 53867910Sbrian else 53967910Sbrian#endif 54067910Sbrian ChapOutput(authp->physical, CHAP_CHALLENGE, authp->id, 54167910Sbrian chap->challenge.local, 1 + *chap->challenge.local + len, NULL); 54267910Sbrian} 54367910Sbrian 54467910Sbrianstatic void 54543693Sbrianchap_Success(struct authinfo *authp) 5466059Samurai{ 54796324Sbrian struct bundle *bundle = authp->physical->dl->bundle; 54867912Sbrian const char *msg; 54996324Sbrian 55043693Sbrian datalink_GotAuthname(authp->physical->dl, authp->in.name); 55193418Sbrian#ifndef NODES 55267910Sbrian if (authp->physical->link.lcp.want_authtype == 0x81) { 55367910Sbrian msg = auth2chap(authp)->authresponse; 55468461Sbrian MPPE_MasterKeyValid = 1; /* XXX Global ! */ 55567910Sbrian } else 55667910Sbrian#endif 55796324Sbrian#ifndef NORADIUS 55896324Sbrian if (*bundle->radius.cfg.file && bundle->radius.repstr) 55996324Sbrian msg = bundle->radius.repstr; 56096324Sbrian else 56196324Sbrian#endif 56267910Sbrian msg = "Welcome!!"; 56367910Sbrian 56480763Sbrian ChapOutput(authp->physical, CHAP_SUCCESS, authp->id, msg, strlen(msg), 56567910Sbrian NULL); 56667910Sbrian 56743693Sbrian authp->physical->link.lcp.auth_ineed = 0; 56896324Sbrian if (Enabled(bundle, OPT_UTMP)) 56943693Sbrian physical_Login(authp->physical, authp->in.name); 5706059Samurai 57143693Sbrian if (authp->physical->link.lcp.auth_iwait == 0) 57243693Sbrian /* 57343693Sbrian * Either I didn't need to authenticate, or I've already been 57443693Sbrian * told that I got the answer right. 57543693Sbrian */ 57643693Sbrian datalink_AuthOk(authp->physical->dl); 57743693Sbrian} 5786059Samurai 57943693Sbrianstatic void 58043693Sbrianchap_Failure(struct authinfo *authp) 58143693Sbrian{ 58293418Sbrian#ifndef NODES 58396324Sbrian char buf[1024], *ptr; 58467910Sbrian#endif 58567912Sbrian const char *msg; 58667910Sbrian 58796324Sbrian#ifndef NORADIUS 58896324Sbrian struct bundle *bundle = authp->physical->link.lcp.fsm.bundle; 58996324Sbrian if (*bundle->radius.cfg.file && bundle->radius.errstr) 59096324Sbrian msg = bundle->radius.errstr; 59196324Sbrian else 59296324Sbrian#endif 59393418Sbrian#ifndef NODES 59496324Sbrian if (authp->physical->link.lcp.want_authtype == 0x80) { 59596324Sbrian sprintf(buf, "E=691 R=1 M=Invalid!"); 59696324Sbrian msg = buf; 59796324Sbrian } else if (authp->physical->link.lcp.want_authtype == 0x81) { 59867910Sbrian int i; 59967910Sbrian 60067912Sbrian ptr = buf; 60167912Sbrian ptr += sprintf(buf, "E=691 R=0 C="); 60267910Sbrian for (i=0; i<16; i++) 60367912Sbrian ptr += sprintf(ptr, "%02X", *(auth2chap(authp)->challenge.local+1+i)); 60467910Sbrian 60567912Sbrian sprintf(ptr, " V=3 M=Invalid!"); 60667910Sbrian msg = buf; 60767910Sbrian } else 60867910Sbrian#endif 60967910Sbrian msg = "Invalid!!"; 61067910Sbrian 61167910Sbrian ChapOutput(authp->physical, CHAP_FAILURE, authp->id, msg, strlen(msg) + 1, 61267910Sbrian NULL); 61343693Sbrian datalink_AuthNotOk(authp->physical->dl); 61443693Sbrian} 61537926Sbrian 61644106Sbrianstatic int 61744123Sbrianchap_Cmp(u_char type, char *myans, int mylen, char *hisans, int hislen 61893418Sbrian#ifndef NODES 61944123Sbrian , int lm 62044123Sbrian#endif 62144123Sbrian ) 62244106Sbrian{ 62344106Sbrian if (mylen != hislen) 62444106Sbrian return 0; 62593418Sbrian#ifndef NODES 62644106Sbrian else if (type == 0x80) { 62744106Sbrian int off = lm ? 0 : 24; 62844106Sbrian 62944106Sbrian if (memcmp(myans + off, hisans + off, 24)) 63044106Sbrian return 0; 63144123Sbrian } 63244123Sbrian#endif 63344123Sbrian else if (memcmp(myans, hisans, mylen)) 63444106Sbrian return 0; 63544106Sbrian 63644106Sbrian return 1; 63744106Sbrian} 63844106Sbrian 63993418Sbrian#ifndef NODES 64044106Sbrianstatic int 64144106Sbrianchap_HaveAnotherGo(struct chap *chap) 64244106Sbrian{ 64344106Sbrian if (++chap->peertries < 3) { 64444106Sbrian /* Give the peer another shot */ 64545907Sbrian *chap->challenge.local = '\0'; 64644106Sbrian chap_Challenge(&chap->auth); 64744106Sbrian return 1; 64844106Sbrian } 64944106Sbrian 65044106Sbrian return 0; 65144106Sbrian} 65244123Sbrian#endif 65344106Sbrian 65443693Sbrianvoid 65543693Sbrianchap_Init(struct chap *chap, struct physical *p) 65643693Sbrian{ 65743888Sbrian chap->desc.type = CHAP_DESCRIPTOR; 65843888Sbrian chap->desc.UpdateSet = chap_UpdateSet; 65943888Sbrian chap->desc.IsSet = chap_IsSet; 66043888Sbrian chap->desc.Read = chap_Read; 66143888Sbrian chap->desc.Write = chap_Write; 66243888Sbrian chap->child.pid = 0; 66343888Sbrian chap->child.fd = -1; 66443693Sbrian auth_Init(&chap->auth, p, chap_Challenge, chap_Success, chap_Failure); 66545907Sbrian *chap->challenge.local = *chap->challenge.peer = '\0'; 66693418Sbrian#ifndef NODES 66744106Sbrian chap->NTRespSent = 0; 66844106Sbrian chap->peertries = 0; 66944123Sbrian#endif 67043693Sbrian} 67129840Sbrian 67243693Sbrianvoid 67343888Sbrianchap_ReInit(struct chap *chap) 67443888Sbrian{ 67543888Sbrian chap_Cleanup(chap, SIGTERM); 67643888Sbrian} 67743888Sbrian 67846686Sbrianstruct mbuf * 67946686Sbrianchap_Input(struct bundle *bundle, struct link *l, struct mbuf *bp) 68043693Sbrian{ 68146686Sbrian struct physical *p = link2physical(l); 68243693Sbrian struct chap *chap = &p->dl->chap; 68344106Sbrian char *name, *key, *ans; 68444123Sbrian int len, nlen; 68548817Sbrian u_char alen; 68693418Sbrian#ifndef NODES 68744123Sbrian int lanman; 68844123Sbrian#endif 68929840Sbrian 69046686Sbrian if (p == NULL) { 69146686Sbrian log_Printf(LogERROR, "chap_Input: Not a physical link - dropped\n"); 69254912Sbrian m_freem(bp); 69346686Sbrian return NULL; 69446686Sbrian } 69546686Sbrian 69646686Sbrian if (bundle_Phase(bundle) != PHASE_NETWORK && 69746686Sbrian bundle_Phase(bundle) != PHASE_AUTHENTICATE) { 69845220Sbrian log_Printf(LogPHASE, "Unexpected chap input - dropped !\n"); 69954912Sbrian m_freem(bp); 70046686Sbrian return NULL; 70145220Sbrian } 70245220Sbrian 70354912Sbrian m_settype(bp, MB_CHAPIN); 70444159Sbrian if ((bp = auth_ReadHeader(&chap->auth, bp)) == NULL && 70544159Sbrian ntohs(chap->auth.in.hdr.length) == 0) 70644159Sbrian log_Printf(LogWARN, "Chap Input: Truncated header !\n"); 70743693Sbrian else if (chap->auth.in.hdr.code == 0 || chap->auth.in.hdr.code > MAXCHAPCODE) 70843693Sbrian log_Printf(LogPHASE, "Chap Input: %d: Bad CHAP code !\n", 70943693Sbrian chap->auth.in.hdr.code); 71043693Sbrian else { 71154912Sbrian len = m_length(bp); 71243693Sbrian ans = NULL; 71343693Sbrian 71443693Sbrian if (chap->auth.in.hdr.code != CHAP_CHALLENGE && 71543693Sbrian chap->auth.id != chap->auth.in.hdr.id && 71646686Sbrian Enabled(bundle, OPT_IDCHECK)) { 71743693Sbrian /* Wrong conversation dude ! */ 71843693Sbrian log_Printf(LogPHASE, "Chap Input: %s dropped (got id %d, not %d)\n", 71943693Sbrian chapcodes[chap->auth.in.hdr.code], chap->auth.in.hdr.id, 72043693Sbrian chap->auth.id); 72154912Sbrian m_freem(bp); 72246686Sbrian return NULL; 72325630Sbrian } 72443693Sbrian chap->auth.id = chap->auth.in.hdr.id; /* We respond with this id */ 72529840Sbrian 72693418Sbrian#ifndef NODES 72744106Sbrian lanman = 0; 72844123Sbrian#endif 72943693Sbrian switch (chap->auth.in.hdr.code) { 73043693Sbrian case CHAP_CHALLENGE: 73144106Sbrian bp = mbuf_Read(bp, &alen, 1); 73244106Sbrian len -= alen + 1; 73343693Sbrian if (len < 0) { 73443693Sbrian log_Printf(LogERROR, "Chap Input: Truncated challenge !\n"); 73554912Sbrian m_freem(bp); 73646686Sbrian return NULL; 73743693Sbrian } 73845907Sbrian *chap->challenge.peer = alen; 73945907Sbrian bp = mbuf_Read(bp, chap->challenge.peer + 1, alen); 74043693Sbrian bp = auth_ReadName(&chap->auth, bp, len); 74193418Sbrian#ifndef NODES 74244106Sbrian lanman = p->link.lcp.his_authtype == 0x80 && 74344106Sbrian ((chap->NTRespSent && IsAccepted(p->link.lcp.cfg.chap80lm)) || 74444106Sbrian !IsAccepted(p->link.lcp.cfg.chap80nt)); 74567910Sbrian 74667910Sbrian /* Generate local challenge value */ 74767910Sbrian chap_ChallengeInit(&chap->auth); 74844123Sbrian#endif 74943693Sbrian break; 75043313Sbrian 75143693Sbrian case CHAP_RESPONSE: 75243693Sbrian auth_StopTimer(&chap->auth); 75343693Sbrian bp = mbuf_Read(bp, &alen, 1); 75443693Sbrian len -= alen + 1; 75543693Sbrian if (len < 0) { 75643693Sbrian log_Printf(LogERROR, "Chap Input: Truncated response !\n"); 75754912Sbrian m_freem(bp); 75846686Sbrian return NULL; 75943693Sbrian } 76043693Sbrian if ((ans = malloc(alen + 2)) == NULL) { 76143693Sbrian log_Printf(LogERROR, "Chap Input: Out of memory !\n"); 76254912Sbrian m_freem(bp); 76346686Sbrian return NULL; 76443693Sbrian } 76543693Sbrian *ans = chap->auth.id; 76643693Sbrian bp = mbuf_Read(bp, ans + 1, alen); 76780721Sbrian if (p->link.lcp.want_authtype == 0x81 && ans[alen] != '\0') { 76881066Sbrian log_Printf(LogWARN, "%s: Compensating for corrupt (Win98/WinME?) " 76980721Sbrian "CHAP81 RESPONSE\n", l->name); 77080721Sbrian ans[alen] = '\0'; 77180721Sbrian } 77243693Sbrian ans[alen+1] = '\0'; 77343693Sbrian bp = auth_ReadName(&chap->auth, bp, len); 77493418Sbrian#ifndef NODES 77567910Sbrian lanman = p->link.lcp.want_authtype == 0x80 && 77667910Sbrian alen == 49 && ans[alen] == 0; 77744123Sbrian#endif 77843693Sbrian break; 77943313Sbrian 78043693Sbrian case CHAP_SUCCESS: 78143693Sbrian case CHAP_FAILURE: 78243693Sbrian /* chap->auth.in.name is already set up at CHALLENGE time */ 78343693Sbrian if ((ans = malloc(len + 1)) == NULL) { 78443693Sbrian log_Printf(LogERROR, "Chap Input: Out of memory !\n"); 78554912Sbrian m_freem(bp); 78646686Sbrian return NULL; 78743693Sbrian } 78843693Sbrian bp = mbuf_Read(bp, ans, len); 78943693Sbrian ans[len] = '\0'; 79043693Sbrian break; 79143401Sbrian } 79236285Sbrian 79343693Sbrian switch (chap->auth.in.hdr.code) { 79443693Sbrian case CHAP_CHALLENGE: 79543693Sbrian case CHAP_RESPONSE: 79643693Sbrian if (*chap->auth.in.name) 79744106Sbrian log_Printf(LogPHASE, "Chap Input: %s (%d bytes from %s%s)\n", 79844106Sbrian chapcodes[chap->auth.in.hdr.code], alen, 79944106Sbrian chap->auth.in.name, 80093418Sbrian#ifndef NODES 80144106Sbrian lanman && chap->auth.in.hdr.code == CHAP_RESPONSE ? 80244123Sbrian " - lanman" : 80344123Sbrian#endif 80444123Sbrian ""); 80543693Sbrian else 80644106Sbrian log_Printf(LogPHASE, "Chap Input: %s (%d bytes%s)\n", 80744106Sbrian chapcodes[chap->auth.in.hdr.code], alen, 80893418Sbrian#ifndef NODES 80944106Sbrian lanman && chap->auth.in.hdr.code == CHAP_RESPONSE ? 81044123Sbrian " - lanman" : 81144123Sbrian#endif 81244123Sbrian ""); 81343693Sbrian break; 81436285Sbrian 81543693Sbrian case CHAP_SUCCESS: 81643693Sbrian case CHAP_FAILURE: 81743693Sbrian if (*ans) 81843693Sbrian log_Printf(LogPHASE, "Chap Input: %s (%s)\n", 81943693Sbrian chapcodes[chap->auth.in.hdr.code], ans); 82043693Sbrian else 82143693Sbrian log_Printf(LogPHASE, "Chap Input: %s\n", 82243693Sbrian chapcodes[chap->auth.in.hdr.code]); 82343693Sbrian break; 8246059Samurai } 8256059Samurai 82643693Sbrian switch (chap->auth.in.hdr.code) { 82743693Sbrian case CHAP_CHALLENGE: 82864465Sbrian if (*bundle->cfg.auth.key == '!' && bundle->cfg.auth.key[1] != '!') 82946686Sbrian chap_StartChild(chap, bundle->cfg.auth.key + 1, 83046686Sbrian bundle->cfg.auth.name); 83143888Sbrian else 83264465Sbrian chap_Respond(chap, bundle->cfg.auth.name, bundle->cfg.auth.key + 83364465Sbrian (*bundle->cfg.auth.key == '!' ? 1 : 0), 83464465Sbrian p->link.lcp.his_authtype 83593418Sbrian#ifndef NODES 83644123Sbrian , lanman 83744123Sbrian#endif 83844123Sbrian ); 83943693Sbrian break; 8406059Samurai 84143693Sbrian case CHAP_RESPONSE: 84243693Sbrian name = chap->auth.in.name; 84343693Sbrian nlen = strlen(name); 84443693Sbrian#ifndef NORADIUS 84575071Sbrian if (*bundle->radius.cfg.file) 84646686Sbrian radius_Authenticate(&bundle->radius, &chap->auth, 84775071Sbrian chap->auth.in.name, ans, alen + 1, 84875071Sbrian chap->challenge.local + 1, 84975071Sbrian *chap->challenge.local); 85075071Sbrian else 85143693Sbrian#endif 85243693Sbrian { 85346686Sbrian key = auth_GetSecret(bundle, name, nlen, p); 85443693Sbrian if (key) { 85544106Sbrian char *myans; 85693418Sbrian#ifndef NODES 85767910Sbrian if (p->link.lcp.want_authtype == 0x80 && 85867910Sbrian lanman && !IsEnabled(p->link.lcp.cfg.chap80lm)) { 85944106Sbrian log_Printf(LogPHASE, "Auth failure: LANMan not enabled\n"); 86044106Sbrian if (chap_HaveAnotherGo(chap)) 86144106Sbrian break; 86243693Sbrian key = NULL; 86367910Sbrian } else if (p->link.lcp.want_authtype == 0x80 && 86467910Sbrian !lanman && !IsEnabled(p->link.lcp.cfg.chap80nt)) { 86544106Sbrian log_Printf(LogPHASE, "Auth failure: mschap not enabled\n"); 86644106Sbrian if (chap_HaveAnotherGo(chap)) 86744106Sbrian break; 86844106Sbrian key = NULL; 86967910Sbrian } else if (p->link.lcp.want_authtype == 0x81 && 87067910Sbrian !IsEnabled(p->link.lcp.cfg.chap81)) { 87167910Sbrian log_Printf(LogPHASE, "Auth failure: CHAP81 not enabled\n"); 87267910Sbrian key = NULL; 87344123Sbrian } else 87444123Sbrian#endif 87544123Sbrian { 87693418Sbrian#ifndef NODES 87767910Sbrian /* Get peer's challenge */ 87867910Sbrian if (p->link.lcp.want_authtype == 0x81) { 87967910Sbrian chap->challenge.peer[0] = CHAP81_CHALLENGE_LEN; 88067910Sbrian memcpy(chap->challenge.peer + 1, ans + 1, CHAP81_CHALLENGE_LEN); 88167910Sbrian } 88267910Sbrian#endif 88367910Sbrian 88444106Sbrian myans = chap_BuildAnswer(name, key, chap->auth.id, 88545907Sbrian chap->challenge.local, 88644123Sbrian p->link.lcp.want_authtype 88793418Sbrian#ifndef NODES 88867910Sbrian , chap->challenge.peer, 88968461Sbrian chap->authresponse, lanman); 89068461Sbrian MPPE_IsServer = 1; /* XXX Global ! */ 89168461Sbrian#else 89268461Sbrian ); 89344123Sbrian#endif 89444106Sbrian if (myans == NULL) 89543693Sbrian key = NULL; 89644106Sbrian else { 89744123Sbrian if (!chap_Cmp(p->link.lcp.want_authtype, myans + 1, *myans, 89844123Sbrian ans + 1, alen 89993418Sbrian#ifndef NODES 90044123Sbrian , lanman 90144123Sbrian#endif 90244123Sbrian )) 90344106Sbrian key = NULL; 90444106Sbrian free(myans); 90544106Sbrian } 90643693Sbrian } 90743693Sbrian } 9086059Samurai 90943693Sbrian if (key) 91043693Sbrian chap_Success(&chap->auth); 91143693Sbrian else 91243693Sbrian chap_Failure(&chap->auth); 91343693Sbrian } 9146059Samurai 91543693Sbrian break; 9166059Samurai 9176059Samurai case CHAP_SUCCESS: 91843693Sbrian if (p->link.lcp.auth_iwait == PROTO_CHAP) { 91943693Sbrian p->link.lcp.auth_iwait = 0; 92067910Sbrian if (p->link.lcp.auth_ineed == 0) { 92193418Sbrian#ifndef NODES 92267910Sbrian if (p->link.lcp.his_authtype == 0x81) { 92367910Sbrian if (strncmp(ans, chap->authresponse, 42)) { 92467910Sbrian datalink_AuthNotOk(p->dl); 92581094Sbrian log_Printf(LogWARN, "CHAP81: AuthenticatorResponse: (%.42s)" 92681094Sbrian " != ans: (%.42s)\n", chap->authresponse, ans); 92767910Sbrian 92867910Sbrian } else { 92967910Sbrian /* Successful login */ 93068461Sbrian MPPE_MasterKeyValid = 1; /* XXX Global ! */ 93167910Sbrian datalink_AuthOk(p->dl); 93267910Sbrian } 93367910Sbrian } else 93467910Sbrian#endif 93543693Sbrian /* 93643693Sbrian * We've succeeded in our ``login'' 93743693Sbrian * If we're not expecting the peer to authenticate (or he already 93843693Sbrian * has), proceed to network phase. 93943693Sbrian */ 94043693Sbrian datalink_AuthOk(p->dl); 94167910Sbrian } 94243693Sbrian } 94343693Sbrian break; 94443693Sbrian 9456059Samurai case CHAP_FAILURE: 94643693Sbrian datalink_AuthNotOk(p->dl); 94743693Sbrian break; 9486059Samurai } 94943693Sbrian free(ans); 9506059Samurai } 95143693Sbrian 95254912Sbrian m_freem(bp); 95346686Sbrian return NULL; 9546059Samurai} 955