From 2f1b9304ac4ba89a2dcb6047cb584a5603a33987 Mon Sep 17 00:00:00 2001 From: Joel Sherrill Date: Thu, 16 Aug 2001 20:42:09 +0000 Subject: 2001-08-16 Mike Siers * Update of PPPD to 2.3.11 from 2.3.5 and addition of an example application. Mike's notes on the modifications: - renamed error() function because of namespace problems - removed calls to the exit() funciton - removed extra files from the pppd source directory - defined pppd task constant values in rtemspppd.h - modifyied example code to get actual tick per second value - placed the pppd 2.3.11 man page file (pppd.8) into the pppd directory * pppd/cbcp.c, pppd/cbcp.h, pppd/main.c, pppd/ppp_tty.c, pppd/pppmain.c, pppd/rtems-ppp.c, pppd/rtems-ppp.c: Deleted. * pppd/pppd.8, pppd/rtemsmain.c, pppd/rtemspppd.c, pppd/rtemspppd.h, pppd/sys-rtems.c, pppd/utils.c, pppd/example/Makefile, pppd/example/README, pppd/example/init.c, pppd/example/netconfig.h, pppd/example/ppp.conf, pppd/example/pppdapp.c, pppd/example/system.h: New files. * modem/ppp_tty.c, net/if_ppp.h, pppd/Makefile.am, pppd/README, pppd/STATUS, pppd/auth.c, pppd/ccp.c, pppd/ccp.h, pppd/chap.c, pppd/chap.h, pppd/chap_ms.c, pppd/chap_ms.h, pppd/chat.c, pppd/demand.c, pppd/fsm.c, pppd/fsm.h, pppd/ipcp.c, pppd/ipcp.h, pppd/ipxcp.c, pppd/ipxcp.h, pppd/lcp.c, pppd/lcp.h, pppd/magic.c, pppd/magic.h, pppd/options.c, pppd/patchlevel.h, pppd/pathnames.h, pppd/pppd.h, pppd/upap.c, pppd/upap.h: Modified. --- cpukit/pppd/auth.c | 733 +++++++++++++++++++++++++++++++++++------------------ 1 file changed, 491 insertions(+), 242 deletions(-) (limited to 'cpukit/pppd/auth.c') diff --git a/cpukit/pppd/auth.c b/cpukit/pppd/auth.c index f5cff9ac3d..f08a89a0c1 100644 --- a/cpukit/pppd/auth.c +++ b/cpukit/pppd/auth.c @@ -32,21 +32,18 @@ * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. */ -#ifndef lint -/* static char rcsid[] = "$Id$"; */ -#endif +#define RCSID "$Id$" #include #include -#include +#include #include -#include #include +#include #include #include #include #include - #include #if defined(_PATH_LASTLOG) && defined(_linux_) #include @@ -55,7 +52,17 @@ #include #include #include -/* #include */ + +#ifdef USE_PAM +#include +#endif + +#ifdef HAS_SHADOW +#include +#ifndef PW_PPP +#define PW_PPP PW_LOGIN +#endif +#endif #include "pppd.h" #include "fsm.h" @@ -68,20 +75,7 @@ #endif #include "pathnames.h" -/* Used for storing a sequence of words. Usually malloced. */ -struct wordlist { - struct wordlist *next; - char word[1]; -}; - -/* Bits in scan_authfile return value */ -#define NONWILD_SERVER 1 -#define NONWILD_CLIENT 2 - -#define ISWILD(word) (word[0] == '*' && word[1] == 0) - -#define FALSE 0 -#define TRUE 1 +static const char rcsid[] = RCSID; /* The name by which the peer authenticated itself to us. */ char peer_authname[MAXNAMELEN]; @@ -89,14 +83,15 @@ char peer_authname[MAXNAMELEN]; /* Records which authentication operations haven't completed yet. */ static int auth_pending[NUM_PPP]; -/* Set if we have successfully called plogin() */ -static int logged_in; +/* List of addresses which the peer may use. */ +static struct permitted_ip *addresses[NUM_PPP]; -/* Set if we have run the /etc/ppp/auth-up script. */ -static int did_authup; +/* Wordlist giving addresses which the peer may use + without authenticating itself. */ +static struct wordlist *noauth_addrs; -/* List of addresses which the peer may use. */ -static struct wordlist *addresses[NUM_PPP]; +/* Extra options to apply, from the secrets file entry for the peer. */ +static struct wordlist *extra_options; /* Number of network protocols which we have opened. */ static int num_np_open; @@ -107,6 +102,55 @@ static int num_np_up; /* Set if we got the contents of passwd[] from the pap-secrets file. */ static int passwd_from_file; +/* Set if we require authentication only because we have a default route. */ +static bool default_auth; + +/* Hook for a link status */ +void (*auth_linkup_hook)__P((void)) = NULL; +void (*auth_linkdown_hook)__P((void)) = NULL; + +/* Hook to enable a plugin to control the idle time limit */ +int (*idle_time_hook) __P((struct ppp_idle *)) = NULL; + +/* Hook for a plugin to say whether we can possibly authenticate any peer */ +int (*pap_check_hook) __P((void)) = NULL; + +/* Hook for a plugin to check the PAP user and password */ +int (*pap_auth_hook) __P((char *user, char *passwd, char **msgp, + struct wordlist **paddrs, + struct wordlist **popts)) = NULL; + +/* Hook for a plugin to know about the PAP user logout */ +void (*pap_logout_hook) __P((void)) = NULL; + +/* Hook for a plugin to get the PAP password for authenticating us */ +int (*pap_passwd_hook) __P((char *user, char *passwd)) = NULL; + +/* + * This is used to ensure that we don't start an auth-up/down + * script while one is already running. + */ +enum script_state { + s_down, + s_up +}; + +static enum script_state auth_state = s_down; +static enum script_state auth_script_state = s_down; + +/* + * Option variables. + */ +bool uselogin = 0; /* Use /etc/passwd for checking PAP */ +bool cryptpap = 0; /* Passwords in pap-secrets are encrypted */ +bool refuse_pap = 0; /* Don't wanna auth. ourselves with PAP */ +bool refuse_chap = 0; /* Don't wanna auth. ourselves with CHAP */ +bool usehostname = 0; /* Use hostname for our_name */ +bool auth_required = 0; /* Always require authentication from peer */ +bool allow_any_ip = 0; /* Allow peer to use any IP address */ +bool explicit_remote = 0; /* User specified explicit remote name */ +char remote_name[MAXNAMELEN]; /* Peer's name for authentication */ + /* Bits in auth_pending[] */ #define PAP_WITHPEER 1 #define PAP_PEER 2 @@ -120,18 +164,70 @@ extern char *crypt __P((const char *, const char *)); static void network_phase __P((int)); static void check_idle __P((void *)); static void connect_time_expired __P((void *)); -static int plogin __P((char *, char *, char **, int *)); -static void plogout __P((void)); static int null_login __P((int)); static int get_pap_passwd __P((char *)); -static int have_pap_secret __P((void)); -static int have_chap_secret __P((char *, char *, u_int32_t)); -static int ip_addr_check __P((u_int32_t, struct wordlist *)); -static int scan_authfile __P((FILE *, char *, char *, u_int32_t, char *, - struct wordlist **, char *)); +static int have_pap_secret __P((int *)); +static int have_chap_secret __P((char *, char *, int, int *)); +static int ip_addr_check __P((u_int32_t, struct permitted_ip *)); static void free_wordlist __P((struct wordlist *)); -static void auth_script __P((char *)); -static void set_allowed_addrs __P((int, struct wordlist *)); +static void auth_script __P((enum script_state s)); +static void set_allowed_addrs __P((int, struct wordlist *, struct wordlist *)); + + +/* + * Authentication-related options. + */ +option_t auth_options[] = { + { "require-pap", o_bool, &lcp_wantoptions[0].neg_upap, + "Require PAP authentication from peer", 1, &auth_required }, + { "+pap", o_bool, &lcp_wantoptions[0].neg_upap, + "Require PAP authentication from peer", 1, &auth_required }, + { "refuse-pap", o_bool, &refuse_pap, + "Don't agree to auth to peer with PAP", 1 }, + { "-pap", o_bool, &refuse_pap, + "Don't allow PAP authentication with peer", 1 }, + { "require-chap", o_bool, &lcp_wantoptions[0].neg_chap, + "Require CHAP authentication from peer", 1, &auth_required }, + { "+chap", o_bool, &lcp_wantoptions[0].neg_chap, + "Require CHAP authentication from peer", 1, &auth_required }, + { "refuse-chap", o_bool, &refuse_chap, + "Don't agree to auth to peer with CHAP", 1 }, + { "-chap", o_bool, &refuse_chap, + "Don't allow CHAP authentication with peer", 1 }, + { "name", o_string, our_name, + "Set local name for authentication", + OPT_PRIV|OPT_STATIC, NULL, MAXNAMELEN }, + { "user", o_string, user, + "Set name for auth with peer", OPT_STATIC, NULL, MAXNAMELEN }, + { "usehostname", o_bool, &usehostname, + "Must use hostname for authentication", 1 }, + { "remotename", o_string, remote_name, + "Set remote name for authentication", OPT_STATIC, + &explicit_remote, MAXNAMELEN }, + { "auth", o_bool, &auth_required, + "Require authentication from peer", 1 }, + { "noauth", o_bool, &auth_required, + "Don't require peer to authenticate", OPT_PRIV, &allow_any_ip }, + { "login", o_bool, &uselogin, + "Use system password database for PAP", 1 }, + { "papcrypt", o_bool, &cryptpap, + "PAP passwords are encrypted", 1 }, +/* Removed for RTEMS PORT + { "+ua", o_special, setupapfile, + "Get PAP user and password from file" }, +*/ + { "password", o_string, passwd, + "Password for authenticating us to the peer", OPT_STATIC, + NULL, MAXSECRETLEN }, +/* Removed for RTEMS_PORT + { "privgroup", o_special, privgroup, + "Allow group members to use privileged options", OPT_PRIV }, + { "allow-ip", o_special, set_noauth_addr, + "Set IP address(es) which can be used without authentication", + OPT_PRIV }, +*/ + { NULL } +}; /* * An Open on LCP has requested a change from Dead to Establish phase. @@ -153,10 +249,11 @@ link_terminated(unit) { if (phase == PHASE_DEAD) return; - if (logged_in) - plogout(); - phase = PHASE_DEAD; - syslog(LOG_NOTICE, "Connection terminated."); + if (pap_logout_hook) { + pap_logout_hook(); + } + new_phase(PHASE_DEAD); + notice("Connection terminated."); } /* @@ -169,7 +266,11 @@ link_down(unit) int i; struct protent *protp; - did_authup = 0; + auth_state = s_down; + if (auth_script_state == s_up) { + update_link_stats(unit); + auth_script(s_down); + } for (i = 0; (protp = protocols[i]) != NULL; ++i) { if (!protp->enabled_flag) continue; @@ -181,7 +282,7 @@ link_down(unit) num_np_open = 0; num_np_up = 0; if (phase != PHASE_DEAD) - phase = PHASE_TERMINATE; + new_phase(PHASE_TERMINATE); } /* @@ -210,16 +311,22 @@ link_established(unit) if (auth_required && !(go->neg_chap || go->neg_upap)) { /* * We wanted the peer to authenticate itself, and it refused: - * treat it as though it authenticated with PAP using a username - * of "" and a password of "". If that's not OK, boot it out. + * if we have some address(es) it can use without auth, fine, + * otherwise treat it as though it authenticated with PAP using + * a username * of "" and a password of "". If that's not OK, + * boot it out. */ - if (!wo->neg_upap || !null_login(unit)) { + if (noauth_addrs != NULL) { + set_allowed_addrs(unit, noauth_addrs, NULL); + } else if (!wo->neg_upap || !null_login(unit)) { + warn("peer refused to authenticate: terminating link"); lcp_close(unit, "peer refused to authenticate"); + status = EXIT_PEER_AUTH_FAILED; return; } } - phase = PHASE_AUTHENTICATE; + new_phase(PHASE_AUTHENTICATE); auth = 0; if (go->neg_chap) { ChapAuthPeer(unit, our_name, go->chap_mdtype); @@ -234,7 +341,8 @@ link_established(unit) } else if (ho->neg_upap) { if (passwd[0] == 0) { passwd_from_file = 1; - get_pap_passwd(passwd); + if (!get_pap_passwd(passwd)) + error("No secret found for PAP login"); } upap_authwithpeer(unit, user, passwd); auth |= PAP_WITHPEER; @@ -252,16 +360,14 @@ static void network_phase(unit) int unit; { - int i; - struct protent *protp; +#ifdef CBCP_SUPPORT lcp_options *go = &lcp_gotoptions[unit]; +#endif - /* - * If the peer had to authenticate, run the auth-up script now. - */ - if ((go->neg_chap || go->neg_upap) && !did_authup) { - auth_script(_PATH_AUTHUP); - did_authup = 1; + /* always run the auth-up script */ + auth_state = s_up; + if (auth_script_state == s_down) { + auth_script(s_up); } #ifdef CBCP_SUPPORT @@ -269,18 +375,34 @@ network_phase(unit) * If we negotiated callback, do it now. */ if (go->neg_cbcp) { - phase = PHASE_CALLBACK; + new_phase(PHASE_CALLBACK); (*cbcp_protent.open)(unit); return; } #endif - phase = PHASE_NETWORK; + /* + * Process extra options from the secrets file + */ + if (extra_options) { + options_from_list(extra_options, 1); + free_wordlist(extra_options); + extra_options = 0; + } + start_networks(); +} + +void +start_networks() +{ + int i; + struct protent *protp; + new_phase(PHASE_NETWORK); for (i = 0; (protp = protocols[i]) != NULL; ++i) if (protp->protocol < 0xC000 && protp->enabled_flag && protp->open != NULL) { - (*protp->open)(unit); + (*protp->open)(0); if (protp->protocol != PPP_CCP) ++num_np_open; } @@ -301,6 +423,7 @@ auth_peer_fail(unit, protocol) * Authentication failure: take the link down */ lcp_close(unit, "Authentication failed"); + status = EXIT_PEER_AUTH_FAILED; } /* @@ -322,8 +445,7 @@ auth_peer_success(unit, protocol, name, namelen) bit = PAP_PEER; break; default: - syslog(LOG_WARNING, "auth_peer_success: unknown protocol %x", - protocol); + warn("auth_peer_success: unknown protocol %x", protocol); return; } @@ -334,6 +456,7 @@ auth_peer_success(unit, protocol, name, namelen) namelen = sizeof(peer_authname) - 1; BCOPY(name, peer_authname, namelen); peer_authname[namelen] = 0; + /* * If there is no more authentication still to be done, * proceed to the network (or callback) phase. @@ -353,9 +476,12 @@ auth_withpeer_fail(unit, protocol) BZERO(passwd, MAXSECRETLEN); /* * We've failed to authenticate ourselves to our peer. - * He'll probably take the link down, and there's not much - * we can do except wait for that. + * Some servers keep sending CHAP challenges, but there + * is no point in persisting without any way to get updated + * authentication secrets. */ + lcp_close(unit, "Failed to authenticate ourselves to peer"); + status = EXIT_AUTH_TOPEER_FAILED; } /* @@ -377,7 +503,7 @@ auth_withpeer_success(unit, protocol) bit = PAP_WITHPEER; break; default: - + warn("auth_withpeer_success: unknown protocol %x", protocol); bit = 0; } @@ -397,14 +523,22 @@ void np_up(unit, proto) int unit, proto; { + int tlim; + if (num_np_up == 0) { /* * At this point we consider that the link has come up successfully. */ - need_holdoff = 0; + status = EXIT_OK; + unsuccess = 0; + new_phase(PHASE_RUNNING); - if (idle_time_limit > 0) - TIMEOUT(check_idle, NULL, idle_time_limit); + if (idle_time_hook != 0) + tlim = (*idle_time_hook)(NULL); + else + tlim = idle_time_limit; + if (tlim > 0) + TIMEOUT(check_idle, NULL, tlim); /* * Set a timeout to close the connection once the maximum @@ -412,12 +546,6 @@ np_up(unit, proto) */ if (maxconnect > 0) TIMEOUT(connect_time_expired, 0, maxconnect); - - /* - * Detach now, if the updetach option was given. - */ - if (nodetach == -1) - detach(); } ++num_np_up; } @@ -429,8 +557,9 @@ void np_down(unit, proto) int unit, proto; { - if (--num_np_up == 0 && idle_time_limit > 0) { + if (--num_np_up == 0) { UNTIMEOUT(check_idle, NULL); + new_phase(PHASE_NETWORK); } } @@ -453,20 +582,28 @@ np_finished(unit, proto) */ static void check_idle(arg) - void *arg; + void *arg; { struct ppp_idle idle; time_t itime; + int tlim; if (!get_idle_time(0, &idle)) return; - itime = MIN(idle.xmit_idle, idle.recv_idle); - if (itime >= idle_time_limit) { + if (idle_time_hook != 0) { + tlim = idle_time_hook(&idle); + } else { + itime = MIN(idle.xmit_idle, idle.recv_idle); + tlim = idle_time_limit - itime; + } + if (tlim <= 0) { /* link is idle: shut it down. */ - syslog(LOG_INFO, "Terminating connection due to lack of activity."); + notice("Terminating connection due to lack of activity."); lcp_close(0, "Link inactive"); + need_holdoff = 0; + status = EXIT_IDLE_TIMEOUT; } else { - TIMEOUT(check_idle, NULL, idle_time_limit - itime); + TIMEOUT(check_idle, NULL, tlim); } } @@ -477,70 +614,82 @@ static void connect_time_expired(arg) void *arg; { - syslog(LOG_INFO, "Connect time expired"); + info("Connect time expired"); lcp_close(0, "Connect time expired"); /* Close connection */ + status = EXIT_CONNECT_TIME; } /* * auth_check_options - called to check authentication options. */ -void +int auth_check_options() { lcp_options *wo = &lcp_wantoptions[0]; + int status = 1; int can_auth; - ipcp_options *ipwo = &ipcp_wantoptions[0]; - u_int32_t remote; + int lacks_ip; /* Default our_name to hostname, and user to our_name */ if (our_name[0] == 0 || usehostname) - strcpy(our_name, hostname); + strlcpy(our_name, hostname, sizeof(our_name)); if (user[0] == 0) - strcpy(user, our_name); + strlcpy(user, our_name, sizeof(user)); + + /* + * If we have a default route, require the peer to authenticate + * unless the noauth option was given or the real user is root. + */ + if (!auth_required && !allow_any_ip && have_route_to(0) && !privileged) { + printf("auth_check_options: turning on\n"); + auth_required = 1; + default_auth = 1; + } /* If authentication is required, ask peer for CHAP or PAP. */ - if (auth_required && !wo->neg_chap && !wo->neg_upap) { - wo->neg_chap = 1; - wo->neg_upap = 1; + if (auth_required) { + if (!wo->neg_chap && !wo->neg_upap) { + wo->neg_chap = 1; + wo->neg_upap = 1; + } + } else { + wo->neg_chap = 0; + wo->neg_upap = 0; } /* * Check whether we have appropriate secrets to use * to authenticate the peer. */ - can_auth = wo->neg_upap && (uselogin || have_pap_secret()); + lacks_ip = 0; + can_auth = wo->neg_upap && (uselogin || have_pap_secret(&lacks_ip)); if (!can_auth && wo->neg_chap) { - remote = ipwo->accept_remote? 0: ipwo->hisaddr; - can_auth = have_chap_secret(remote_name, our_name, remote); + can_auth = have_chap_secret((explicit_remote? remote_name: NULL), + our_name, 1, &lacks_ip); } - if (auth_required && !can_auth) { - option_error("peer authentication required but no suitable secret(s) found\n"); - if (remote_name[0] == 0) - option_error("for authenticating any peer to us (%s)\n", our_name); + if (auth_required && !can_auth && noauth_addrs == NULL) { + if (default_auth) { + option_error( +"By default the remote system is required to authenticate itself"); + option_error( +"(because this system has a default route to the internet)"); + } else if (explicit_remote) + option_error( +"The remote system (%s) is required to authenticate itself", + remote_name); else - option_error("for authenticating peer %s to us (%s)\n", - remote_name, our_name); - exit(1); - } - - /* - * Check whether the user tried to override certain values - * set by root. - */ - if (!auth_required && auth_req_info.priv > 0) { - if (!default_device && devnam_info.priv == 0) { - option_error("can't override device name when noauth option used"); - exit(1); - } - if ((connector != NULL && connector_info.priv == 0) - || (disconnector != NULL && disconnector_info.priv == 0) - || (welcomer != NULL && welcomer_info.priv == 0)) { - option_error("can't override connect, disconnect or welcome"); - option_error("option values when noauth option used"); - exit(1); - } + option_error( +"The remote system is required to authenticate itself"); + option_error( +"but I couldn't find any suitable secret (password) for it to use to do so."); + if (lacks_ip) + option_error( +"(None of the available passwords would let it use an IP address.)"); + + status = 0; } + return ( status ); } /* @@ -554,18 +703,18 @@ auth_reset(unit) { lcp_options *go = &lcp_gotoptions[unit]; lcp_options *ao = &lcp_allowoptions[0]; - ipcp_options *ipwo = &ipcp_wantoptions[0]; - u_int32_t remote; - ao->neg_upap = !refuse_pap /*&& (passwd[0] != 0 || get_pap_passwd(NULL))*/; + ao->neg_upap = !refuse_pap && (passwd[0] != 0 || get_pap_passwd(NULL)); ao->neg_chap = !refuse_chap - && have_chap_secret(user, remote_name, (u_int32_t)0); + && (passwd[0] != 0 + || have_chap_secret(user, (explicit_remote? remote_name: NULL), + 0, NULL)); - if (go->neg_upap && !uselogin && !have_pap_secret()) + if (go->neg_upap && !uselogin && !have_pap_secret(NULL)) go->neg_upap = 0; if (go->neg_chap) { - remote = ipwo->accept_remote? 0: ipwo->hisaddr; - if (!have_chap_secret(remote_name, our_name, remote)) + if (!have_chap_secret((explicit_remote? remote_name: NULL), + our_name, 1, NULL)) go->neg_chap = 0; } } @@ -582,55 +731,24 @@ auth_reset(unit) * In either case, msg points to an appropriate message. */ int -check_passwd(unit, auser, userlen, apasswd, passwdlen, msg, msglen) +check_passwd(unit, auser, userlen, apasswd, passwdlen, msg) int unit; char *auser; int userlen; char *apasswd; int passwdlen; char **msg; - int *msglen; { + int ret = (int)UPAP_AUTHNAK; + if (( userlen == 0 ) && ( passwdlen == 0 )) { + ret = (int)UPAP_AUTHACK; + } + printf("check_passwd: %d\n", ret); - return UPAP_AUTHNAK; -} - - -/* - * plogin - Check the user name and password against the system - * password database, and login the user if OK. - * - * returns: - * UPAP_AUTHNAK: Login failed. - * UPAP_AUTHACK: Login succeeded. - * In either case, msg points to an appropriate message. - */ - -static int -plogin(user, passwd, msg, msglen) - char *user; - char *passwd; - char **msg; - int *msglen; -{ - syslog(LOG_INFO, "user %s logged in", user); - logged_in = TRUE; - - return (UPAP_AUTHACK); -} - -/* - * plogout - Logout the user. - */ -static void -plogout() -{ - - logged_in = FALSE; + return ret; } - /* * null_login - Check if a username of "" and a password of "" are * acceptable, and iff so, set the list of acceptable IP addresses @@ -640,7 +758,7 @@ static int null_login(unit) int unit; { - return 1; + return 0; } @@ -648,20 +766,22 @@ null_login(unit) * get_pap_passwd - get a password for authenticating ourselves with * our peer using PAP. Returns 1 on success, 0 if no suitable password * could be found. + * Assumes passwd points to MAXSECRETLEN bytes of space (if non-null). */ - static int get_pap_passwd(passwd) char *passwd; { -#if 0 -/* XXX PPPConfiguration */ - GlobalSystemStatus *stat; - stat=LockSTBSystemParam(); - strncpy(passwd, stat->PPP_Password, MAXSECRETLEN); - UnlockSTBSystemParam(); -#endif - return 1; + int ret = (int)0; + + /* + * Check whether a plugin wants to supply this. + */ + if (pap_passwd_hook) { + ret = (*pap_passwd_hook)(user, passwd); + } + + return ( ret ); } @@ -670,9 +790,18 @@ get_pap_passwd(passwd) * secrets that we could possibly use for authenticating the peer. */ static int -have_pap_secret() +have_pap_secret(lacks_ipp) + int *lacks_ipp; { - return 1; + int ret = (int)0; + + /* let the plugin decide, if there is one */ + printf("have_pap_secret:\n"); + if (pap_check_hook) { + ret = (*pap_check_hook)(); + } + + return ( ret ); } @@ -683,13 +812,13 @@ have_pap_secret() * know the identity yet. */ static int -have_chap_secret(client, server, remote) +have_chap_secret(client, server, need_ip, lacks_ipp) char *client; char *server; - u_int32_t remote; + int need_ip; + int *lacks_ipp; { - - return 1; + return 0; } @@ -699,37 +828,178 @@ have_chap_secret(client, server, remote) * (We could be either client or server). */ int -get_secret(unit, client, server, secret, secret_len, save_addrs) +get_secret(unit, client, server, secret, secret_len, am_server) int unit; char *client; char *server; char *secret; int *secret_len; - int save_addrs; + int am_server; { -#if 0 -/* XXX PPPConfiguration */ int len; - GlobalSystemStatus *stat; - stat=LockSTBSystemParam(); - len=strlen(stat->PPP_Password); - strcpy( secret,stat->PPP_Password); - UnlockSTBSystemParam(); + char secbuf[MAXWORDLEN]; + + if (!am_server && passwd[0] != 0) { + strlcpy(secbuf, passwd, sizeof(secbuf)); + } else { + return 0; + } + len = strlen(secbuf); + if (len > MAXSECRETLEN) { + error("Secret for %s on %s is too long", client, server); + len = MAXSECRETLEN; + } + BCOPY(secbuf, secret, len); + BZERO(secbuf, sizeof(secbuf)); *secret_len = len; -#endif + return 1; } /* * set_allowed_addrs() - set the list of allowed addresses. + * Also looks for `--' indicating options to apply for this peer + * and leaves the following words in extra_options. */ static void -set_allowed_addrs(unit, addrs) +set_allowed_addrs(unit, addrs, opts) int unit; struct wordlist *addrs; + struct wordlist *opts; { + int n; + struct wordlist *ap, **pap; + struct permitted_ip *ip; + char *ptr_word, *ptr_mask; + struct hostent *hp; + struct netent *np; + u_int32_t a, mask, ah, offset; + struct ipcp_options *wo = &ipcp_wantoptions[unit]; + u_int32_t suggested_ip = 0; + + if (addresses[unit] != NULL) + free(addresses[unit]); + addresses[unit] = NULL; + if (extra_options != NULL) + free_wordlist(extra_options); + extra_options = opts; + + /* + * Count the number of IP addresses given. + */ + for (n = 0, pap = &addrs; (ap = *pap) != NULL; pap = &ap->next) + ++n; + if (n == 0) + return; + ip = (struct permitted_ip *) malloc((n + 1) * sizeof(struct permitted_ip)); + if (ip == 0) + return; + + n = 0; + for (ap = addrs; ap != NULL; ap = ap->next) { + /* "-" means no addresses authorized, "*" means any address allowed */ + ptr_word = ap->word; + if (strcmp(ptr_word, "-") == 0) + break; + if (strcmp(ptr_word, "*") == 0) { + ip[n].permit = 1; + ip[n].base = ip[n].mask = 0; + ++n; + break; + } + + ip[n].permit = 1; + if (*ptr_word == '!') { + ip[n].permit = 0; + ++ptr_word; + } + + mask = ~ (u_int32_t) 0; + offset = 0; + ptr_mask = strchr (ptr_word, '/'); + if (ptr_mask != NULL) { + int bit_count; + char *endp; + + bit_count = (int) strtol (ptr_mask+1, &endp, 10); + if (bit_count <= 0 || bit_count > 32) { + warn("invalid address length %v in auth. address list", + ptr_mask+1); + continue; + } + bit_count = 32 - bit_count; /* # bits in host part */ + if (*endp == '+') { + offset = pppifunit + 1; + ++endp; + } + if (*endp != 0) { + warn("invalid address length syntax: %v", ptr_mask+1); + continue; + } + *ptr_mask = '\0'; + mask <<= bit_count; + } + + hp = gethostbyname(ptr_word); + if (hp != NULL && hp->h_addrtype == AF_INET) { + a = *(u_int32_t *)hp->h_addr; + } else { + np = getnetbyname (ptr_word); + if (np != NULL && np->n_addrtype == AF_INET) { + a = htonl (*(u_int32_t *)np->n_net); + if (ptr_mask == NULL) { + /* calculate appropriate mask for net */ + ah = ntohl(a); + if (IN_CLASSA(ah)) + mask = IN_CLASSA_NET; + else if (IN_CLASSB(ah)) + mask = IN_CLASSB_NET; + else if (IN_CLASSC(ah)) + mask = IN_CLASSC_NET; + } + } else { + a = inet_addr (ptr_word); + } + } + + if (ptr_mask != NULL) + *ptr_mask = '/'; + if (a == (u_int32_t)-1L) { + warn("unknown host %s in auth. address list", ap->word); + continue; + } + if (offset != 0) { + if (offset >= ~mask) { + warn("interface unit %d too large for subnet %v", + pppifunit, ptr_word); + continue; + } + a = htonl((ntohl(a) & mask) + offset); + mask = ~(u_int32_t)0; + } + ip[n].mask = htonl(mask); + ip[n].base = a & ip[n].mask; + ++n; + if (~mask == 0 && suggested_ip == 0) + suggested_ip = a; + } + + ip[n].permit = 0; /* make the last entry forbid all addresses */ + ip[n].base = 0; /* to terminate the list */ + ip[n].mask = 0; + + addresses[unit] = ip; + + /* + * If the address given for the peer isn't authorized, or if + * the user hasn't given one, AND there is an authorized address + * which is a single host, then use that if we find one. + */ + if (suggested_ip != 0 + && (wo->hisaddr == 0 || !auth_ip_addr(unit, wo->hisaddr))) + wo->hisaddr = suggested_ip; } /* @@ -741,30 +1011,30 @@ auth_ip_addr(unit, addr) int unit; u_int32_t addr; { - return ip_addr_check(addr, addresses[unit]); -} - -static int -ip_addr_check(addr, addrs) - u_int32_t addr; - struct wordlist *addrs; -{ -#if 0 - u_int32_t a, mask, ah; - int accept; - char *ptr_word, *ptr_mask; - struct hostent *hp; - struct netent *np; -#endif + int ok; /* don't allow loopback or multicast address */ if (bad_ip_adrs(addr)) return 0; - if (addrs == NULL) - return !auth_required; /* no addresses authorized */ + if (addresses[unit] != NULL) { + ok = ip_addr_check(addr, addresses[unit]); + if (ok >= 0) + return ok; + } + if (auth_required) + return 0; /* no addresses authorized */ + return allow_any_ip || !have_route_to(addr); +} - return 1; +static int +ip_addr_check(addr, addrs) + u_int32_t addr; + struct permitted_ip *addrs; +{ + for (; ; ++addrs) + if ((addr & addrs->mask) == addrs->base) + return addrs->permit; } /* @@ -781,41 +1051,6 @@ bad_ip_adrs(addr) || IN_MULTICAST(addr) || IN_BADCLASS(addr); } -/* - * check_access - complain if a secret file has too-liberal permissions. - */ -void -check_access(f, filename) - FILE *f; - char *filename; -{ - -} - - -/* - * scan_authfile - Scan an authorization file for a secret suitable - * for authenticating `client' on `server'. The return value is -1 - * if no secret is found, otherwise >= 0. The return value has - * NONWILD_CLIENT set if the secret didn't have "*" for the client, and - * NONWILD_SERVER set if the secret didn't have "*" for the server. - * Any following words on the line (i.e. address authorization - * info) are placed in a wordlist and returned in *addrs. - */ -static int -scan_authfile(f, client, server, ipaddr, secret, addrs, filename) - FILE *f; - char *client; - char *server; - u_int32_t ipaddr; - char *secret; - struct wordlist **addrs; - char *filename; -{ - - return -1; -} - /* * free_wordlist - release memory allocated for a wordlist. */ @@ -837,7 +1072,21 @@ free_wordlist(wp) * interface-name peer-name real-user tty speed */ static void -auth_script(script) - char *script; +auth_script(s) + enum script_state s; { + switch (s) { + case s_up: + auth_script_state = s_up; + if ( auth_linkup_hook ) { + (*auth_linkup_hook)(); + } + break; + case s_down: + auth_script_state = s_down; + if ( auth_linkdown_hook ) { + (*auth_linkdown_hook)(); + } + break; + } } -- cgit v1.2.3