summaryrefslogtreecommitdiffstats
path: root/c/src/libnetworking/pppd/auth.c
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--c/src/libnetworking/pppd/auth.c733
1 files changed, 491 insertions, 242 deletions
diff --git a/c/src/libnetworking/pppd/auth.c b/c/src/libnetworking/pppd/auth.c
index f5cff9ac3d..f08a89a0c1 100644
--- a/c/src/libnetworking/pppd/auth.c
+++ b/c/src/libnetworking/pppd/auth.c
@@ -32,21 +32,18 @@
* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
*/
-#ifndef lint
-/* static char rcsid[] = "$Id$"; */
-#endif
+#define RCSID "$Id$"
#include <stdio.h>
#include <stddef.h>
-#include <stdlib.h>
+#include <stdlib.h>
#include <unistd.h>
-#include <syslog.h>
#include <pwd.h>
+#include <grp.h>
#include <string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
-
#include <fcntl.h>
#if defined(_PATH_LASTLOG) && defined(_linux_)
#include <lastlog.h>
@@ -55,7 +52,17 @@
#include <netdb.h>
#include <netinet/in.h>
#include <arpa/inet.h>
-/* #include <stbconfig.h> */
+
+#ifdef USE_PAM
+#include <security/pam_appl.h>
+#endif
+
+#ifdef HAS_SHADOW
+#include <shadow.h>
+#ifndef PW_PPP
+#define PW_PPP PW_LOGIN
+#endif
+#endif
#include "pppd.h"
#include "fsm.h"
@@ -68,20 +75,7 @@
#endif
#include "pathnames.h"
-/* Used for storing a sequence of words. Usually malloced. */
-struct wordlist {
- struct wordlist *next;
- char word[1];
-};
-
-/* Bits in scan_authfile return value */
-#define NONWILD_SERVER 1
-#define NONWILD_CLIENT 2
-
-#define ISWILD(word) (word[0] == '*' && word[1] == 0)
-
-#define FALSE 0
-#define TRUE 1
+static const char rcsid[] = RCSID;
/* The name by which the peer authenticated itself to us. */
char peer_authname[MAXNAMELEN];
@@ -89,14 +83,15 @@ char peer_authname[MAXNAMELEN];
/* Records which authentication operations haven't completed yet. */
static int auth_pending[NUM_PPP];
-/* Set if we have successfully called plogin() */
-static int logged_in;
+/* List of addresses which the peer may use. */
+static struct permitted_ip *addresses[NUM_PPP];
-/* Set if we have run the /etc/ppp/auth-up script. */
-static int did_authup;
+/* Wordlist giving addresses which the peer may use
+ without authenticating itself. */
+static struct wordlist *noauth_addrs;
-/* List of addresses which the peer may use. */
-static struct wordlist *addresses[NUM_PPP];
+/* Extra options to apply, from the secrets file entry for the peer. */
+static struct wordlist *extra_options;
/* Number of network protocols which we have opened. */
static int num_np_open;
@@ -107,6 +102,55 @@ static int num_np_up;
/* Set if we got the contents of passwd[] from the pap-secrets file. */
static int passwd_from_file;
+/* Set if we require authentication only because we have a default route. */
+static bool default_auth;
+
+/* Hook for a link status */
+void (*auth_linkup_hook)__P((void)) = NULL;
+void (*auth_linkdown_hook)__P((void)) = NULL;
+
+/* Hook to enable a plugin to control the idle time limit */
+int (*idle_time_hook) __P((struct ppp_idle *)) = NULL;
+
+/* Hook for a plugin to say whether we can possibly authenticate any peer */
+int (*pap_check_hook) __P((void)) = NULL;
+
+/* Hook for a plugin to check the PAP user and password */
+int (*pap_auth_hook) __P((char *user, char *passwd, char **msgp,
+ struct wordlist **paddrs,
+ struct wordlist **popts)) = NULL;
+
+/* Hook for a plugin to know about the PAP user logout */
+void (*pap_logout_hook) __P((void)) = NULL;
+
+/* Hook for a plugin to get the PAP password for authenticating us */
+int (*pap_passwd_hook) __P((char *user, char *passwd)) = NULL;
+
+/*
+ * This is used to ensure that we don't start an auth-up/down
+ * script while one is already running.
+ */
+enum script_state {
+ s_down,
+ s_up
+};
+
+static enum script_state auth_state = s_down;
+static enum script_state auth_script_state = s_down;
+
+/*
+ * Option variables.
+ */
+bool uselogin = 0; /* Use /etc/passwd for checking PAP */
+bool cryptpap = 0; /* Passwords in pap-secrets are encrypted */
+bool refuse_pap = 0; /* Don't wanna auth. ourselves with PAP */
+bool refuse_chap = 0; /* Don't wanna auth. ourselves with CHAP */
+bool usehostname = 0; /* Use hostname for our_name */
+bool auth_required = 0; /* Always require authentication from peer */
+bool allow_any_ip = 0; /* Allow peer to use any IP address */
+bool explicit_remote = 0; /* User specified explicit remote name */
+char remote_name[MAXNAMELEN]; /* Peer's name for authentication */
+
/* Bits in auth_pending[] */
#define PAP_WITHPEER 1
#define PAP_PEER 2
@@ -120,18 +164,70 @@ extern char *crypt __P((const char *, const char *));
static void network_phase __P((int));
static void check_idle __P((void *));
static void connect_time_expired __P((void *));
-static int plogin __P((char *, char *, char **, int *));
-static void plogout __P((void));
static int null_login __P((int));
static int get_pap_passwd __P((char *));
-static int have_pap_secret __P((void));
-static int have_chap_secret __P((char *, char *, u_int32_t));
-static int ip_addr_check __P((u_int32_t, struct wordlist *));
-static int scan_authfile __P((FILE *, char *, char *, u_int32_t, char *,
- struct wordlist **, char *));
+static int have_pap_secret __P((int *));
+static int have_chap_secret __P((char *, char *, int, int *));
+static int ip_addr_check __P((u_int32_t, struct permitted_ip *));
static void free_wordlist __P((struct wordlist *));
-static void auth_script __P((char *));
-static void set_allowed_addrs __P((int, struct wordlist *));
+static void auth_script __P((enum script_state s));
+static void set_allowed_addrs __P((int, struct wordlist *, struct wordlist *));
+
+
+/*
+ * Authentication-related options.
+ */
+option_t auth_options[] = {
+ { "require-pap", o_bool, &lcp_wantoptions[0].neg_upap,
+ "Require PAP authentication from peer", 1, &auth_required },
+ { "+pap", o_bool, &lcp_wantoptions[0].neg_upap,
+ "Require PAP authentication from peer", 1, &auth_required },
+ { "refuse-pap", o_bool, &refuse_pap,
+ "Don't agree to auth to peer with PAP", 1 },
+ { "-pap", o_bool, &refuse_pap,
+ "Don't allow PAP authentication with peer", 1 },
+ { "require-chap", o_bool, &lcp_wantoptions[0].neg_chap,
+ "Require CHAP authentication from peer", 1, &auth_required },
+ { "+chap", o_bool, &lcp_wantoptions[0].neg_chap,
+ "Require CHAP authentication from peer", 1, &auth_required },
+ { "refuse-chap", o_bool, &refuse_chap,
+ "Don't agree to auth to peer with CHAP", 1 },
+ { "-chap", o_bool, &refuse_chap,
+ "Don't allow CHAP authentication with peer", 1 },
+ { "name", o_string, our_name,
+ "Set local name for authentication",
+ OPT_PRIV|OPT_STATIC, NULL, MAXNAMELEN },
+ { "user", o_string, user,
+ "Set name for auth with peer", OPT_STATIC, NULL, MAXNAMELEN },
+ { "usehostname", o_bool, &usehostname,
+ "Must use hostname for authentication", 1 },
+ { "remotename", o_string, remote_name,
+ "Set remote name for authentication", OPT_STATIC,
+ &explicit_remote, MAXNAMELEN },
+ { "auth", o_bool, &auth_required,
+ "Require authentication from peer", 1 },
+ { "noauth", o_bool, &auth_required,
+ "Don't require peer to authenticate", OPT_PRIV, &allow_any_ip },
+ { "login", o_bool, &uselogin,
+ "Use system password database for PAP", 1 },
+ { "papcrypt", o_bool, &cryptpap,
+ "PAP passwords are encrypted", 1 },
+/* Removed for RTEMS PORT
+ { "+ua", o_special, setupapfile,
+ "Get PAP user and password from file" },
+*/
+ { "password", o_string, passwd,
+ "Password for authenticating us to the peer", OPT_STATIC,
+ NULL, MAXSECRETLEN },
+/* Removed for RTEMS_PORT
+ { "privgroup", o_special, privgroup,
+ "Allow group members to use privileged options", OPT_PRIV },
+ { "allow-ip", o_special, set_noauth_addr,
+ "Set IP address(es) which can be used without authentication",
+ OPT_PRIV },
+*/
+ { NULL }
+};
/*
* An Open on LCP has requested a change from Dead to Establish phase.
@@ -153,10 +249,11 @@ link_terminated(unit)
{
if (phase == PHASE_DEAD)
return;
- if (logged_in)
- plogout();
- phase = PHASE_DEAD;
- syslog(LOG_NOTICE, "Connection terminated.");
+ if (pap_logout_hook) {
+ pap_logout_hook();
+ }
+ new_phase(PHASE_DEAD);
+ notice("Connection terminated.");
}
/*
@@ -169,7 +266,11 @@ link_down(unit)
int i;
struct protent *protp;
- did_authup = 0;
+ auth_state = s_down;
+ if (auth_script_state == s_up) {
+ update_link_stats(unit);
+ auth_script(s_down);
+ }
for (i = 0; (protp = protocols[i]) != NULL; ++i) {
if (!protp->enabled_flag)
continue;
@@ -181,7 +282,7 @@ link_down(unit)
num_np_open = 0;
num_np_up = 0;
if (phase != PHASE_DEAD)
- phase = PHASE_TERMINATE;
+ new_phase(PHASE_TERMINATE);
}
/*
@@ -210,16 +311,22 @@ link_established(unit)
if (auth_required && !(go->neg_chap || go->neg_upap)) {
/*
* We wanted the peer to authenticate itself, and it refused:
- * treat it as though it authenticated with PAP using a username
- * of "" and a password of "". If that's not OK, boot it out.
+ * if we have some address(es) it can use without auth, fine,
+ * otherwise treat it as though it authenticated with PAP using
+ * a username * of "" and a password of "". If that's not OK,
+ * boot it out.
*/
- if (!wo->neg_upap || !null_login(unit)) {
+ if (noauth_addrs != NULL) {
+ set_allowed_addrs(unit, noauth_addrs, NULL);
+ } else if (!wo->neg_upap || !null_login(unit)) {
+ warn("peer refused to authenticate: terminating link");
lcp_close(unit, "peer refused to authenticate");
+ status = EXIT_PEER_AUTH_FAILED;
return;
}
}
- phase = PHASE_AUTHENTICATE;
+ new_phase(PHASE_AUTHENTICATE);
auth = 0;
if (go->neg_chap) {
ChapAuthPeer(unit, our_name, go->chap_mdtype);
@@ -234,7 +341,8 @@ link_established(unit)
} else if (ho->neg_upap) {
if (passwd[0] == 0) {
passwd_from_file = 1;
- get_pap_passwd(passwd);
+ if (!get_pap_passwd(passwd))
+ error("No secret found for PAP login");
}
upap_authwithpeer(unit, user, passwd);
auth |= PAP_WITHPEER;
@@ -252,16 +360,14 @@ static void
network_phase(unit)
int unit;
{
- int i;
- struct protent *protp;
+#ifdef CBCP_SUPPORT
lcp_options *go = &lcp_gotoptions[unit];
+#endif
- /*
- * If the peer had to authenticate, run the auth-up script now.
- */
- if ((go->neg_chap || go->neg_upap) && !did_authup) {
- auth_script(_PATH_AUTHUP);
- did_authup = 1;
+ /* always run the auth-up script */
+ auth_state = s_up;
+ if (auth_script_state == s_down) {
+ auth_script(s_up);
}
#ifdef CBCP_SUPPORT
@@ -269,18 +375,34 @@ network_phase(unit)
* If we negotiated callback, do it now.
*/
if (go->neg_cbcp) {
- phase = PHASE_CALLBACK;
+ new_phase(PHASE_CALLBACK);
(*cbcp_protent.open)(unit);
return;
}
#endif
- phase = PHASE_NETWORK;
+ /*
+ * Process extra options from the secrets file
+ */
+ if (extra_options) {
+ options_from_list(extra_options, 1);
+ free_wordlist(extra_options);
+ extra_options = 0;
+ }
+ start_networks();
+}
+
+void
+start_networks()
+{
+ int i;
+ struct protent *protp;
+ new_phase(PHASE_NETWORK);
for (i = 0; (protp = protocols[i]) != NULL; ++i)
if (protp->protocol < 0xC000 && protp->enabled_flag
&& protp->open != NULL) {
- (*protp->open)(unit);
+ (*protp->open)(0);
if (protp->protocol != PPP_CCP)
++num_np_open;
}
@@ -301,6 +423,7 @@ auth_peer_fail(unit, protocol)
* Authentication failure: take the link down
*/
lcp_close(unit, "Authentication failed");
+ status = EXIT_PEER_AUTH_FAILED;
}
/*
@@ -322,8 +445,7 @@ auth_peer_success(unit, protocol, name, namelen)
bit = PAP_PEER;
break;
default:
- syslog(LOG_WARNING, "auth_peer_success: unknown protocol %x",
- protocol);
+ warn("auth_peer_success: unknown protocol %x", protocol);
return;
}
@@ -334,6 +456,7 @@ auth_peer_success(unit, protocol, name, namelen)
namelen = sizeof(peer_authname) - 1;
BCOPY(name, peer_authname, namelen);
peer_authname[namelen] = 0;
+
/*
* If there is no more authentication still to be done,
* proceed to the network (or callback) phase.
@@ -353,9 +476,12 @@ auth_withpeer_fail(unit, protocol)
BZERO(passwd, MAXSECRETLEN);
/*
* We've failed to authenticate ourselves to our peer.
- * He'll probably take the link down, and there's not much
- * we can do except wait for that.
+ * Some servers keep sending CHAP challenges, but there
+ * is no point in persisting without any way to get updated
+ * authentication secrets.
*/
+ lcp_close(unit, "Failed to authenticate ourselves to peer");
+ status = EXIT_AUTH_TOPEER_FAILED;
}
/*
@@ -377,7 +503,7 @@ auth_withpeer_success(unit, protocol)
bit = PAP_WITHPEER;
break;
default:
-
+ warn("auth_withpeer_success: unknown protocol %x", protocol);
bit = 0;
}
@@ -397,14 +523,22 @@ void
np_up(unit, proto)
int unit, proto;
{
+ int tlim;
+
if (num_np_up == 0) {
/*
* At this point we consider that the link has come up successfully.
*/
- need_holdoff = 0;
+ status = EXIT_OK;
+ unsuccess = 0;
+ new_phase(PHASE_RUNNING);
- if (idle_time_limit > 0)
- TIMEOUT(check_idle, NULL, idle_time_limit);
+ if (idle_time_hook != 0)
+ tlim = (*idle_time_hook)(NULL);
+ else
+ tlim = idle_time_limit;
+ if (tlim > 0)
+ TIMEOUT(check_idle, NULL, tlim);
/*
* Set a timeout to close the connection once the maximum
@@ -412,12 +546,6 @@ np_up(unit, proto)
*/
if (maxconnect > 0)
TIMEOUT(connect_time_expired, 0, maxconnect);
-
- /*
- * Detach now, if the updetach option was given.
- */
- if (nodetach == -1)
- detach();
}
++num_np_up;
}
@@ -429,8 +557,9 @@ void
np_down(unit, proto)
int unit, proto;
{
- if (--num_np_up == 0 && idle_time_limit > 0) {
+ if (--num_np_up == 0) {
UNTIMEOUT(check_idle, NULL);
+ new_phase(PHASE_NETWORK);
}
}
@@ -453,20 +582,28 @@ np_finished(unit, proto)
*/
static void
check_idle(arg)
- void *arg;
+ void *arg;
{
struct ppp_idle idle;
time_t itime;
+ int tlim;
if (!get_idle_time(0, &idle))
return;
- itime = MIN(idle.xmit_idle, idle.recv_idle);
- if (itime >= idle_time_limit) {
+ if (idle_time_hook != 0) {
+ tlim = idle_time_hook(&idle);
+ } else {
+ itime = MIN(idle.xmit_idle, idle.recv_idle);
+ tlim = idle_time_limit - itime;
+ }
+ if (tlim <= 0) {
/* link is idle: shut it down. */
- syslog(LOG_INFO, "Terminating connection due to lack of activity.");
+ notice("Terminating connection due to lack of activity.");
lcp_close(0, "Link inactive");
+ need_holdoff = 0;
+ status = EXIT_IDLE_TIMEOUT;
} else {
- TIMEOUT(check_idle, NULL, idle_time_limit - itime);
+ TIMEOUT(check_idle, NULL, tlim);
}
}
@@ -477,70 +614,82 @@ static void
connect_time_expired(arg)
void *arg;
{
- syslog(LOG_INFO, "Connect time expired");
+ info("Connect time expired");
lcp_close(0, "Connect time expired"); /* Close connection */
+ status = EXIT_CONNECT_TIME;
}
/*
* auth_check_options - called to check authentication options.
*/
-void
+int
auth_check_options()
{
lcp_options *wo = &lcp_wantoptions[0];
+ int status = 1;
int can_auth;
- ipcp_options *ipwo = &ipcp_wantoptions[0];
- u_int32_t remote;
+ int lacks_ip;
/* Default our_name to hostname, and user to our_name */
if (our_name[0] == 0 || usehostname)
- strcpy(our_name, hostname);
+ strlcpy(our_name, hostname, sizeof(our_name));
if (user[0] == 0)
- strcpy(user, our_name);
+ strlcpy(user, our_name, sizeof(user));
+
+ /*
+ * If we have a default route, require the peer to authenticate
+ * unless the noauth option was given or the real user is root.
+ */
+ if (!auth_required && !allow_any_ip && have_route_to(0) && !privileged) {
+ printf("auth_check_options: turning on\n");
+ auth_required = 1;
+ default_auth = 1;
+ }
/* If authentication is required, ask peer for CHAP or PAP. */
- if (auth_required && !wo->neg_chap && !wo->neg_upap) {
- wo->neg_chap = 1;
- wo->neg_upap = 1;
+ if (auth_required) {
+ if (!wo->neg_chap && !wo->neg_upap) {
+ wo->neg_chap = 1;
+ wo->neg_upap = 1;
+ }
+ } else {
+ wo->neg_chap = 0;
+ wo->neg_upap = 0;
}
/*
* Check whether we have appropriate secrets to use
* to authenticate the peer.
*/
- can_auth = wo->neg_upap && (uselogin || have_pap_secret());
+ lacks_ip = 0;
+ can_auth = wo->neg_upap && (uselogin || have_pap_secret(&lacks_ip));
if (!can_auth && wo->neg_chap) {
- remote = ipwo->accept_remote? 0: ipwo->hisaddr;
- can_auth = have_chap_secret(remote_name, our_name, remote);
+ can_auth = have_chap_secret((explicit_remote? remote_name: NULL),
+ our_name, 1, &lacks_ip);
}
- if (auth_required && !can_auth) {
- option_error("peer authentication required but no suitable secret(s) found\n");
- if (remote_name[0] == 0)
- option_error("for authenticating any peer to us (%s)\n", our_name);
+ if (auth_required && !can_auth && noauth_addrs == NULL) {
+ if (default_auth) {
+ option_error(
+"By default the remote system is required to authenticate itself");
+ option_error(
+"(because this system has a default route to the internet)");
+ } else if (explicit_remote)
+ option_error(
+"The remote system (%s) is required to authenticate itself",
+ remote_name);
else
- option_error("for authenticating peer %s to us (%s)\n",
- remote_name, our_name);
- exit(1);
- }
-
- /*
- * Check whether the user tried to override certain values
- * set by root.
- */
- if (!auth_required && auth_req_info.priv > 0) {
- if (!default_device && devnam_info.priv == 0) {
- option_error("can't override device name when noauth option used");
- exit(1);
- }
- if ((connector != NULL && connector_info.priv == 0)
- || (disconnector != NULL && disconnector_info.priv == 0)
- || (welcomer != NULL && welcomer_info.priv == 0)) {
- option_error("can't override connect, disconnect or welcome");
- option_error("option values when noauth option used");
- exit(1);
- }
+ option_error(
+"The remote system is required to authenticate itself");
+ option_error(
+"but I couldn't find any suitable secret (password) for it to use to do so.");
+ if (lacks_ip)
+ option_error(
+"(None of the available passwords would let it use an IP address.)");
+
+ status = 0;
}
+ return ( status );
}
/*
@@ -554,18 +703,18 @@ auth_reset(unit)
{
lcp_options *go = &lcp_gotoptions[unit];
lcp_options *ao = &lcp_allowoptions[0];
- ipcp_options *ipwo = &ipcp_wantoptions[0];
- u_int32_t remote;
- ao->neg_upap = !refuse_pap /*&& (passwd[0] != 0 || get_pap_passwd(NULL))*/;
+ ao->neg_upap = !refuse_pap && (passwd[0] != 0 || get_pap_passwd(NULL));
ao->neg_chap = !refuse_chap
- && have_chap_secret(user, remote_name, (u_int32_t)0);
+ && (passwd[0] != 0
+ || have_chap_secret(user, (explicit_remote? remote_name: NULL),
+ 0, NULL));
- if (go->neg_upap && !uselogin && !have_pap_secret())
+ if (go->neg_upap && !uselogin && !have_pap_secret(NULL))
go->neg_upap = 0;
if (go->neg_chap) {
- remote = ipwo->accept_remote? 0: ipwo->hisaddr;
- if (!have_chap_secret(remote_name, our_name, remote))
+ if (!have_chap_secret((explicit_remote? remote_name: NULL),
+ our_name, 1, NULL))
go->neg_chap = 0;
}
}
@@ -582,55 +731,24 @@ auth_reset(unit)
* In either case, msg points to an appropriate message.
*/
int
-check_passwd(unit, auser, userlen, apasswd, passwdlen, msg, msglen)
+check_passwd(unit, auser, userlen, apasswd, passwdlen, msg)
int unit;
char *auser;
int userlen;
char *apasswd;
int passwdlen;
char **msg;
- int *msglen;
{
+ int ret = (int)UPAP_AUTHNAK;
+ if (( userlen == 0 ) && ( passwdlen == 0 )) {
+ ret = (int)UPAP_AUTHACK;
+ }
+ printf("check_passwd: %d\n", ret);
- return UPAP_AUTHNAK;
-}
-
-
-/*
- * plogin - Check the user name and password against the system
- * password database, and login the user if OK.
- *
- * returns:
- * UPAP_AUTHNAK: Login failed.
- * UPAP_AUTHACK: Login succeeded.
- * In either case, msg points to an appropriate message.
- */
-
-static int
-plogin(user, passwd, msg, msglen)
- char *user;
- char *passwd;
- char **msg;
- int *msglen;
-{
- syslog(LOG_INFO, "user %s logged in", user);
- logged_in = TRUE;
-
- return (UPAP_AUTHACK);
-}
-
-/*
- * plogout - Logout the user.
- */
-static void
-plogout()
-{
-
- logged_in = FALSE;
+ return ret;
}
-
/*
* null_login - Check if a username of "" and a password of "" are
* acceptable, and iff so, set the list of acceptable IP addresses
@@ -640,7 +758,7 @@ static int
null_login(unit)
int unit;
{
- return 1;
+ return 0;
}
@@ -648,20 +766,22 @@ null_login(unit)
* get_pap_passwd - get a password for authenticating ourselves with
* our peer using PAP. Returns 1 on success, 0 if no suitable password
* could be found.
+ * Assumes passwd points to MAXSECRETLEN bytes of space (if non-null).
*/
-
static int
get_pap_passwd(passwd)
char *passwd;
{
-#if 0
-/* XXX PPPConfiguration */
- GlobalSystemStatus *stat;
- stat=LockSTBSystemParam();
- strncpy(passwd, stat->PPP_Password, MAXSECRETLEN);
- UnlockSTBSystemParam();
-#endif
- return 1;
+ int ret = (int)0;
+
+ /*
+ * Check whether a plugin wants to supply this.
+ */
+ if (pap_passwd_hook) {
+ ret = (*pap_passwd_hook)(user, passwd);
+ }
+
+ return ( ret );
}
@@ -670,9 +790,18 @@ get_pap_passwd(passwd)
* secrets that we could possibly use for authenticating the peer.
*/
static int
-have_pap_secret()
+have_pap_secret(lacks_ipp)
+ int *lacks_ipp;
{
- return 1;
+ int ret = (int)0;
+
+ /* let the plugin decide, if there is one */
+ printf("have_pap_secret:\n");
+ if (pap_check_hook) {
+ ret = (*pap_check_hook)();
+ }
+
+ return ( ret );
}
@@ -683,13 +812,13 @@ have_pap_secret()
* know the identity yet.
*/
static int
-have_chap_secret(client, server, remote)
+have_chap_secret(client, server, need_ip, lacks_ipp)
char *client;
char *server;
- u_int32_t remote;
+ int need_ip;
+ int *lacks_ipp;
{
-
- return 1;
+ return 0;
}
@@ -699,37 +828,178 @@ have_chap_secret(client, server, remote)
* (We could be either client or server).
*/
int
-get_secret(unit, client, server, secret, secret_len, save_addrs)
+get_secret(unit, client, server, secret, secret_len, am_server)
int unit;
char *client;
char *server;
char *secret;
int *secret_len;
- int save_addrs;
+ int am_server;
{
-#if 0
-/* XXX PPPConfiguration */
int len;
- GlobalSystemStatus *stat;
- stat=LockSTBSystemParam();
- len=strlen(stat->PPP_Password);
- strcpy( secret,stat->PPP_Password);
- UnlockSTBSystemParam();
+ char secbuf[MAXWORDLEN];
+
+ if (!am_server && passwd[0] != 0) {
+ strlcpy(secbuf, passwd, sizeof(secbuf));
+ } else {
+ return 0;
+ }
+ len = strlen(secbuf);
+ if (len > MAXSECRETLEN) {
+ error("Secret for %s on %s is too long", client, server);
+ len = MAXSECRETLEN;
+ }
+ BCOPY(secbuf, secret, len);
+ BZERO(secbuf, sizeof(secbuf));
*secret_len = len;
-#endif
+
return 1;
}
/*
* set_allowed_addrs() - set the list of allowed addresses.
+ * Also looks for `--' indicating options to apply for this peer
+ * and leaves the following words in extra_options.
*/
static void
-set_allowed_addrs(unit, addrs)
+set_allowed_addrs(unit, addrs, opts)
int unit;
struct wordlist *addrs;
+ struct wordlist *opts;
{
+ int n;
+ struct wordlist *ap, **pap;
+ struct permitted_ip *ip;
+ char *ptr_word, *ptr_mask;
+ struct hostent *hp;
+ struct netent *np;
+ u_int32_t a, mask, ah, offset;
+ struct ipcp_options *wo = &ipcp_wantoptions[unit];
+ u_int32_t suggested_ip = 0;
+
+ if (addresses[unit] != NULL)
+ free(addresses[unit]);
+ addresses[unit] = NULL;
+ if (extra_options != NULL)
+ free_wordlist(extra_options);
+ extra_options = opts;
+
+ /*
+ * Count the number of IP addresses given.
+ */
+ for (n = 0, pap = &addrs; (ap = *pap) != NULL; pap = &ap->next)
+ ++n;
+ if (n == 0)
+ return;
+ ip = (struct permitted_ip *) malloc((n + 1) * sizeof(struct permitted_ip));
+ if (ip == 0)
+ return;
+
+ n = 0;
+ for (ap = addrs; ap != NULL; ap = ap->next) {
+ /* "-" means no addresses authorized, "*" means any address allowed */
+ ptr_word = ap->word;
+ if (strcmp(ptr_word, "-") == 0)
+ break;
+ if (strcmp(ptr_word, "*") == 0) {
+ ip[n].permit = 1;
+ ip[n].base = ip[n].mask = 0;
+ ++n;
+ break;
+ }
+
+ ip[n].permit = 1;
+ if (*ptr_word == '!') {
+ ip[n].permit = 0;
+ ++ptr_word;
+ }
+
+ mask = ~ (u_int32_t) 0;
+ offset = 0;
+ ptr_mask = strchr (ptr_word, '/');
+ if (ptr_mask != NULL) {
+ int bit_count;
+ char *endp;
+
+ bit_count = (int) strtol (ptr_mask+1, &endp, 10);
+ if (bit_count <= 0 || bit_count > 32) {
+ warn("invalid address length %v in auth. address list",
+ ptr_mask+1);
+ continue;
+ }
+ bit_count = 32 - bit_count; /* # bits in host part */
+ if (*endp == '+') {
+ offset = pppifunit + 1;
+ ++endp;
+ }
+ if (*endp != 0) {
+ warn("invalid address length syntax: %v", ptr_mask+1);
+ continue;
+ }
+ *ptr_mask = '\0';
+ mask <<= bit_count;
+ }
+
+ hp = gethostbyname(ptr_word);
+ if (hp != NULL && hp->h_addrtype == AF_INET) {
+ a = *(u_int32_t *)hp->h_addr;
+ } else {
+ np = getnetbyname (ptr_word);
+ if (np != NULL && np->n_addrtype == AF_INET) {
+ a = htonl (*(u_int32_t *)np->n_net);
+ if (ptr_mask == NULL) {
+ /* calculate appropriate mask for net */
+ ah = ntohl(a);
+ if (IN_CLASSA(ah))
+ mask = IN_CLASSA_NET;
+ else if (IN_CLASSB(ah))
+ mask = IN_CLASSB_NET;
+ else if (IN_CLASSC(ah))
+ mask = IN_CLASSC_NET;
+ }
+ } else {
+ a = inet_addr (ptr_word);
+ }
+ }
+
+ if (ptr_mask != NULL)
+ *ptr_mask = '/';
+ if (a == (u_int32_t)-1L) {
+ warn("unknown host %s in auth. address list", ap->word);
+ continue;
+ }
+ if (offset != 0) {
+ if (offset >= ~mask) {
+ warn("interface unit %d too large for subnet %v",
+ pppifunit, ptr_word);
+ continue;
+ }
+ a = htonl((ntohl(a) & mask) + offset);
+ mask = ~(u_int32_t)0;
+ }
+ ip[n].mask = htonl(mask);
+ ip[n].base = a & ip[n].mask;
+ ++n;
+ if (~mask == 0 && suggested_ip == 0)
+ suggested_ip = a;
+ }
+
+ ip[n].permit = 0; /* make the last entry forbid all addresses */
+ ip[n].base = 0; /* to terminate the list */
+ ip[n].mask = 0;
+
+ addresses[unit] = ip;
+
+ /*
+ * If the address given for the peer isn't authorized, or if
+ * the user hasn't given one, AND there is an authorized address
+ * which is a single host, then use that if we find one.
+ */
+ if (suggested_ip != 0
+ && (wo->hisaddr == 0 || !auth_ip_addr(unit, wo->hisaddr)))
+ wo->hisaddr = suggested_ip;
}
/*
@@ -741,30 +1011,30 @@ auth_ip_addr(unit, addr)
int unit;
u_int32_t addr;
{
- return ip_addr_check(addr, addresses[unit]);
-}
-
-static int
-ip_addr_check(addr, addrs)
- u_int32_t addr;
- struct wordlist *addrs;
-{
-#if 0
- u_int32_t a, mask, ah;
- int accept;
- char *ptr_word, *ptr_mask;
- struct hostent *hp;
- struct netent *np;
-#endif
+ int ok;
/* don't allow loopback or multicast address */
if (bad_ip_adrs(addr))
return 0;
- if (addrs == NULL)
- return !auth_required; /* no addresses authorized */
+ if (addresses[unit] != NULL) {
+ ok = ip_addr_check(addr, addresses[unit]);
+ if (ok >= 0)
+ return ok;
+ }
+ if (auth_required)
+ return 0; /* no addresses authorized */
+ return allow_any_ip || !have_route_to(addr);
+}
- return 1;
+static int
+ip_addr_check(addr, addrs)
+ u_int32_t addr;
+ struct permitted_ip *addrs;
+{
+ for (; ; ++addrs)
+ if ((addr & addrs->mask) == addrs->base)
+ return addrs->permit;
}
/*
@@ -782,41 +1052,6 @@ bad_ip_adrs(addr)
}
/*
- * check_access - complain if a secret file has too-liberal permissions.
- */
-void
-check_access(f, filename)
- FILE *f;
- char *filename;
-{
-
-}
-
-
-/*
- * scan_authfile - Scan an authorization file for a secret suitable
- * for authenticating `client' on `server'. The return value is -1
- * if no secret is found, otherwise >= 0. The return value has
- * NONWILD_CLIENT set if the secret didn't have "*" for the client, and
- * NONWILD_SERVER set if the secret didn't have "*" for the server.
- * Any following words on the line (i.e. address authorization
- * info) are placed in a wordlist and returned in *addrs.
- */
-static int
-scan_authfile(f, client, server, ipaddr, secret, addrs, filename)
- FILE *f;
- char *client;
- char *server;
- u_int32_t ipaddr;
- char *secret;
- struct wordlist **addrs;
- char *filename;
-{
-
- return -1;
-}
-
-/*
* free_wordlist - release memory allocated for a wordlist.
*/
static void
@@ -837,7 +1072,21 @@ free_wordlist(wp)
* interface-name peer-name real-user tty speed
*/
static void
-auth_script(script)
- char *script;
+auth_script(s)
+ enum script_state s;
{
+ switch (s) {
+ case s_up:
+ auth_script_state = s_up;
+ if ( auth_linkup_hook ) {
+ (*auth_linkup_hook)();
+ }
+ break;
+ case s_down:
+ auth_script_state = s_down;
+ if ( auth_linkdown_hook ) {
+ (*auth_linkdown_hook)();
+ }
+ break;
+ }
}
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-18 04:26:24 +0000