Donatien Garnier / lwip_ppp_ethernet

LwIP with PPP & Ethernet integration

Dependents:   NetworkingCoreLib

This is the mbed port of the LwIP stack: http://savannah.nongnu.org/projects/lwip/

It includes contributed content from NXP's port for LPCxxxx devices: http://www.lpcware.com/content/project/lightweight-ip-lwip-networking-stack

Licence

LwIP is licenced under the BSD licence: 

Copyright (c) 2001-2004 Swedish Institute of Computer Science. 
All rights reserved. 
Redistribution and use in source and binary forms, with or without modification, 
are permitted provided that the following conditions are met: 
1. Redistributions of source code must retain the above copyright notice, 
this list of conditions and the following disclaimer. 
2. Redistributions in binary form must reproduce the above copyright notice, 
this list of conditions and the following disclaimer in the documentation 
and/or other materials provided with the distribution. 
3. The name of the author may not be used to endorse or promote products 
derived from this software without specific prior written permission. 
THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED 
WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT 
SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT 
OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 
IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY 
OF SUCH DAMAGE.

src/netif/ppp/auth.c@2:1a87f74b8e3b, 2012-05-25 (annotated)

Committer:
donatien
Date:
Fri May 25 08:56:35 2012 +0000
Revision:
2:1a87f74b8e3b
Parent:
0:8e01dca41002 
Removed compilation of EMAC driver when using PPP

Who changed what in which revision?

UserRevisionLine numberNew contents of line
donatien 0:8e01dca41002 1 /*****************************************************************************
donatien 0:8e01dca41002 2 * auth.c - Network Authentication and Phase Control program file.
donatien 0:8e01dca41002 3 *
donatien 0:8e01dca41002 4 * Copyright (c) 2003 by Marc Boucher, Services Informatiques (MBSI) inc.
donatien 0:8e01dca41002 5 * Copyright (c) 1997 by Global Election Systems Inc. All rights reserved.
donatien 0:8e01dca41002 6 *
donatien 0:8e01dca41002 7 * The authors hereby grant permission to use, copy, modify, distribute,
donatien 0:8e01dca41002 8 * and license this software and its documentation for any purpose, provided
donatien 0:8e01dca41002 9 * that existing copyright notices are retained in all copies and that this
donatien 0:8e01dca41002 10 * notice and the following disclaimer are included verbatim in any
donatien 0:8e01dca41002 11 * distributions. No written agreement, license, or royalty fee is required
donatien 0:8e01dca41002 12 * for any of the authorized uses.
donatien 0:8e01dca41002 13 *
donatien 0:8e01dca41002 14 * THIS SOFTWARE IS PROVIDED BY THE CONTRIBUTORS *AS IS* AND ANY EXPRESS OR
donatien 0:8e01dca41002 15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
donatien 0:8e01dca41002 16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
donatien 0:8e01dca41002 17 * IN NO EVENT SHALL THE CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
donatien 0:8e01dca41002 18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
donatien 0:8e01dca41002 19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
donatien 0:8e01dca41002 20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
donatien 0:8e01dca41002 21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
donatien 0:8e01dca41002 22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
donatien 0:8e01dca41002 23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
donatien 0:8e01dca41002 24 *
donatien 0:8e01dca41002 25 ******************************************************************************
donatien 0:8e01dca41002 26 * REVISION HISTORY
donatien 0:8e01dca41002 27 *
donatien 0:8e01dca41002 28 * 03-01-01 Marc Boucher <marc@mbsi.ca>
donatien 0:8e01dca41002 29 * Ported to lwIP.
donatien 0:8e01dca41002 30 * 97-12-08 Guy Lancaster <lancasterg@acm.org>, Global Election Systems Inc.
donatien 0:8e01dca41002 31 * Ported from public pppd code.
donatien 0:8e01dca41002 32 *****************************************************************************/
donatien 0:8e01dca41002 33 /*
donatien 0:8e01dca41002 34 * auth.c - PPP authentication and phase control.
donatien 0:8e01dca41002 35 *
donatien 0:8e01dca41002 36 * Copyright (c) 1993 The Australian National University.
donatien 0:8e01dca41002 37 * All rights reserved.
donatien 0:8e01dca41002 38 *
donatien 0:8e01dca41002 39 * Redistribution and use in source and binary forms are permitted
donatien 0:8e01dca41002 40 * provided that the above copyright notice and this paragraph are
donatien 0:8e01dca41002 41 * duplicated in all such forms and that any documentation,
donatien 0:8e01dca41002 42 * advertising materials, and other materials related to such
donatien 0:8e01dca41002 43 * distribution and use acknowledge that the software was developed
donatien 0:8e01dca41002 44 * by the Australian National University. The name of the University
donatien 0:8e01dca41002 45 * may not be used to endorse or promote products derived from this
donatien 0:8e01dca41002 46 * software without specific prior written permission.
donatien 0:8e01dca41002 47 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
donatien 0:8e01dca41002 48 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
donatien 0:8e01dca41002 49 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
donatien 0:8e01dca41002 50 *
donatien 0:8e01dca41002 51 * Copyright (c) 1989 Carnegie Mellon University.
donatien 0:8e01dca41002 52 * All rights reserved.
donatien 0:8e01dca41002 53 *
donatien 0:8e01dca41002 54 * Redistribution and use in source and binary forms are permitted
donatien 0:8e01dca41002 55 * provided that the above copyright notice and this paragraph are
donatien 0:8e01dca41002 56 * duplicated in all such forms and that any documentation,
donatien 0:8e01dca41002 57 * advertising materials, and other materials related to such
donatien 0:8e01dca41002 58 * distribution and use acknowledge that the software was developed
donatien 0:8e01dca41002 59 * by Carnegie Mellon University. The name of the
donatien 0:8e01dca41002 60 * University may not be used to endorse or promote products derived
donatien 0:8e01dca41002 61 * from this software without specific prior written permission.
donatien 0:8e01dca41002 62 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
donatien 0:8e01dca41002 63 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
donatien 0:8e01dca41002 64 * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
donatien 0:8e01dca41002 65 */
donatien 0:8e01dca41002 66
donatien 0:8e01dca41002 67 #include "lwip/opt.h"
donatien 0:8e01dca41002 68
donatien 0:8e01dca41002 69 #if PPP_SUPPORT /* don't build if not configured for use in lwipopts.h */
donatien 0:8e01dca41002 70
donatien 0:8e01dca41002 71 #include "ppp.h"
donatien 0:8e01dca41002 72 #include "pppdebug.h"
donatien 0:8e01dca41002 73
donatien 0:8e01dca41002 74 #include "fsm.h"
donatien 0:8e01dca41002 75 #include "lcp.h"
donatien 0:8e01dca41002 76 #include "pap.h"
donatien 0:8e01dca41002 77 #include "chap.h"
donatien 0:8e01dca41002 78 #include "auth.h"
donatien 0:8e01dca41002 79 #include "ipcp.h"
donatien 0:8e01dca41002 80
donatien 0:8e01dca41002 81 #if CBCP_SUPPORT
donatien 0:8e01dca41002 82 #include "cbcp.h"
donatien 0:8e01dca41002 83 #endif /* CBCP_SUPPORT */
donatien 0:8e01dca41002 84
donatien 0:8e01dca41002 85 #include "lwip/inet.h"
donatien 0:8e01dca41002 86
donatien 0:8e01dca41002 87 #include <string.h>
donatien 0:8e01dca41002 88
donatien 0:8e01dca41002 89 #if 0 /* UNUSED */
donatien 0:8e01dca41002 90 /* Bits in scan_authfile return value */
donatien 0:8e01dca41002 91 #define NONWILD_SERVER 1
donatien 0:8e01dca41002 92 #define NONWILD_CLIENT 2
donatien 0:8e01dca41002 93
donatien 0:8e01dca41002 94 #define ISWILD(word) (word[0] == '*' && word[1] == 0)
donatien 0:8e01dca41002 95 #endif /* UNUSED */
donatien 0:8e01dca41002 96
donatien 0:8e01dca41002 97 #if PAP_SUPPORT || CHAP_SUPPORT
donatien 0:8e01dca41002 98 /* The name by which the peer authenticated itself to us. */
donatien 0:8e01dca41002 99 static char peer_authname[MAXNAMELEN];
donatien 0:8e01dca41002 100 #endif /* PAP_SUPPORT || CHAP_SUPPORT */
donatien 0:8e01dca41002 101
donatien 0:8e01dca41002 102 /* Records which authentication operations haven't completed yet. */
donatien 0:8e01dca41002 103 static int auth_pending[NUM_PPP];
donatien 0:8e01dca41002 104
donatien 0:8e01dca41002 105 /* Set if we have successfully called plogin() */
donatien 0:8e01dca41002 106 static int logged_in;
donatien 0:8e01dca41002 107
donatien 0:8e01dca41002 108 /* Set if we have run the /etc/ppp/auth-up script. */
donatien 0:8e01dca41002 109 static int did_authup; /* @todo, we don't need this in lwip*/
donatien 0:8e01dca41002 110
donatien 0:8e01dca41002 111 /* List of addresses which the peer may use. */
donatien 0:8e01dca41002 112 static struct wordlist *addresses[NUM_PPP];
donatien 0:8e01dca41002 113
donatien 0:8e01dca41002 114 #if 0 /* UNUSED */
donatien 0:8e01dca41002 115 /* Wordlist giving addresses which the peer may use
donatien 0:8e01dca41002 116 without authenticating itself. */
donatien 0:8e01dca41002 117 static struct wordlist *noauth_addrs;
donatien 0:8e01dca41002 118
donatien 0:8e01dca41002 119 /* Extra options to apply, from the secrets file entry for the peer. */
donatien 0:8e01dca41002 120 static struct wordlist *extra_options;
donatien 0:8e01dca41002 121 #endif /* UNUSED */
donatien 0:8e01dca41002 122
donatien 0:8e01dca41002 123 /* Number of network protocols which we have opened. */
donatien 0:8e01dca41002 124 static int num_np_open;
donatien 0:8e01dca41002 125
donatien 0:8e01dca41002 126 /* Number of network protocols which have come up. */
donatien 0:8e01dca41002 127 static int num_np_up;
donatien 0:8e01dca41002 128
donatien 0:8e01dca41002 129 #if PAP_SUPPORT || CHAP_SUPPORT
donatien 0:8e01dca41002 130 /* Set if we got the contents of passwd[] from the pap-secrets file. */
donatien 0:8e01dca41002 131 static int passwd_from_file;
donatien 0:8e01dca41002 132 #endif /* PAP_SUPPORT || CHAP_SUPPORT */
donatien 0:8e01dca41002 133
donatien 0:8e01dca41002 134 #if 0 /* UNUSED */
donatien 0:8e01dca41002 135 /* Set if we require authentication only because we have a default route. */
donatien 0:8e01dca41002 136 static bool default_auth;
donatien 0:8e01dca41002 137
donatien 0:8e01dca41002 138 /* Hook to enable a plugin to control the idle time limit */
donatien 0:8e01dca41002 139 int (*idle_time_hook) __P((struct ppp_idle *)) = NULL;
donatien 0:8e01dca41002 140
donatien 0:8e01dca41002 141 /* Hook for a plugin to say whether we can possibly authenticate any peer */
donatien 0:8e01dca41002 142 int (*pap_check_hook) __P((void)) = NULL;
donatien 0:8e01dca41002 143
donatien 0:8e01dca41002 144 /* Hook for a plugin to check the PAP user and password */
donatien 0:8e01dca41002 145 int (*pap_auth_hook) __P((char *user, char *passwd, char **msgp,
donatien 0:8e01dca41002 146 struct wordlist **paddrs,
donatien 0:8e01dca41002 147 struct wordlist **popts)) = NULL;
donatien 0:8e01dca41002 148
donatien 0:8e01dca41002 149 /* Hook for a plugin to know about the PAP user logout */
donatien 0:8e01dca41002 150 void (*pap_logout_hook) __P((void)) = NULL;
donatien 0:8e01dca41002 151
donatien 0:8e01dca41002 152 /* Hook for a plugin to get the PAP password for authenticating us */
donatien 0:8e01dca41002 153 int (*pap_passwd_hook) __P((char *user, char *passwd)) = NULL;
donatien 0:8e01dca41002 154
donatien 0:8e01dca41002 155 /*
donatien 0:8e01dca41002 156 * This is used to ensure that we don't start an auth-up/down
donatien 0:8e01dca41002 157 * script while one is already running.
donatien 0:8e01dca41002 158 */
donatien 0:8e01dca41002 159 enum script_state {
donatien 0:8e01dca41002 160 s_down,
donatien 0:8e01dca41002 161 s_up
donatien 0:8e01dca41002 162 };
donatien 0:8e01dca41002 163
donatien 0:8e01dca41002 164 static enum script_state auth_state = s_down;
donatien 0:8e01dca41002 165 static enum script_state auth_script_state = s_down;
donatien 0:8e01dca41002 166 static pid_t auth_script_pid = 0;
donatien 0:8e01dca41002 167
donatien 0:8e01dca41002 168 /*
donatien 0:8e01dca41002 169 * Option variables.
donatien 0:8e01dca41002 170 * lwip: some of these are present in the ppp_settings structure
donatien 0:8e01dca41002 171 */
donatien 0:8e01dca41002 172 bool uselogin = 0; /* Use /etc/passwd for checking PAP */
donatien 0:8e01dca41002 173 bool cryptpap = 0; /* Passwords in pap-secrets are encrypted */
donatien 0:8e01dca41002 174 bool refuse_pap = 0; /* Don't wanna auth. ourselves with PAP */
donatien 0:8e01dca41002 175 bool refuse_chap = 0; /* Don't wanna auth. ourselves with CHAP */
donatien 0:8e01dca41002 176 bool usehostname = 0; /* Use hostname for our_name */
donatien 0:8e01dca41002 177 bool auth_required = 0; /* Always require authentication from peer */
donatien 0:8e01dca41002 178 bool allow_any_ip = 0; /* Allow peer to use any IP address */
donatien 0:8e01dca41002 179 bool explicit_remote = 0; /* User specified explicit remote name */
donatien 0:8e01dca41002 180 char remote_name[MAXNAMELEN]; /* Peer's name for authentication */
donatien 0:8e01dca41002 181
donatien 0:8e01dca41002 182 #endif /* UNUSED */
donatien 0:8e01dca41002 183
donatien 0:8e01dca41002 184 /* Bits in auth_pending[] */
donatien 0:8e01dca41002 185 #define PAP_WITHPEER 1
donatien 0:8e01dca41002 186 #define PAP_PEER 2
donatien 0:8e01dca41002 187 #define CHAP_WITHPEER 4
donatien 0:8e01dca41002 188 #define CHAP_PEER 8
donatien 0:8e01dca41002 189
donatien 0:8e01dca41002 190 /* @todo, move this somewhere */
donatien 0:8e01dca41002 191 /* Used for storing a sequence of words. Usually malloced. */
donatien 0:8e01dca41002 192 struct wordlist {
donatien 0:8e01dca41002 193 struct wordlist *next;
donatien 0:8e01dca41002 194 char word[1];
donatien 0:8e01dca41002 195 };
donatien 0:8e01dca41002 196
donatien 0:8e01dca41002 197
donatien 0:8e01dca41002 198 extern char *crypt (const char *, const char *);
donatien 0:8e01dca41002 199
donatien 0:8e01dca41002 200 /* Prototypes for procedures local to this file. */
donatien 0:8e01dca41002 201
donatien 0:8e01dca41002 202 static void network_phase (int);
donatien 0:8e01dca41002 203 static void check_idle (void *);
donatien 0:8e01dca41002 204 static void connect_time_expired (void *);
donatien 0:8e01dca41002 205 #if 0
donatien 0:8e01dca41002 206 static int plogin (char *, char *, char **, int *);
donatien 0:8e01dca41002 207 #endif
donatien 0:8e01dca41002 208 static void plogout (void);
donatien 0:8e01dca41002 209 static int null_login (int);
donatien 0:8e01dca41002 210 static int get_pap_passwd (int, char *, char *);
donatien 0:8e01dca41002 211 static int have_pap_secret (void);
donatien 0:8e01dca41002 212 static int have_chap_secret (char *, char *, u32_t);
donatien 0:8e01dca41002 213 static int ip_addr_check (u32_t, struct wordlist *);
donatien 0:8e01dca41002 214
donatien 0:8e01dca41002 215 #if 0 /* PAP_SUPPORT || CHAP_SUPPORT */
donatien 0:8e01dca41002 216 static int scan_authfile (FILE *, char *, char *, char *,
donatien 0:8e01dca41002 217 struct wordlist **, struct wordlist **,
donatien 0:8e01dca41002 218 char *);
donatien 0:8e01dca41002 219 static void free_wordlist (struct wordlist *);
donatien 0:8e01dca41002 220 static void auth_script (char *);
donatien 0:8e01dca41002 221 static void auth_script_done (void *);
donatien 0:8e01dca41002 222 static void set_allowed_addrs (int unit, struct wordlist *addrs);
donatien 0:8e01dca41002 223 static int some_ip_ok (struct wordlist *);
donatien 0:8e01dca41002 224 static int setupapfile (char **);
donatien 0:8e01dca41002 225 static int privgroup (char **);
donatien 0:8e01dca41002 226 static int set_noauth_addr (char **);
donatien 0:8e01dca41002 227 static void check_access (FILE *, char *);
donatien 0:8e01dca41002 228 #endif /* 0 */ /* PAP_SUPPORT || CHAP_SUPPORT */
donatien 0:8e01dca41002 229
donatien 0:8e01dca41002 230 #if 0 /* UNUSED */
donatien 0:8e01dca41002 231 /*
donatien 0:8e01dca41002 232 * Authentication-related options.
donatien 0:8e01dca41002 233 */
donatien 0:8e01dca41002 234 option_t auth_options[] = {
donatien 0:8e01dca41002 235 { "require-pap", o_bool, &lcp_wantoptions[0].neg_upap,
donatien 0:8e01dca41002 236 "Require PAP authentication from peer", 1, &auth_required },
donatien 0:8e01dca41002 237 { "+pap", o_bool, &lcp_wantoptions[0].neg_upap,
donatien 0:8e01dca41002 238 "Require PAP authentication from peer", 1, &auth_required },
donatien 0:8e01dca41002 239 { "refuse-pap", o_bool, &refuse_pap,
donatien 0:8e01dca41002 240 "Don't agree to auth to peer with PAP", 1 },
donatien 0:8e01dca41002 241 { "-pap", o_bool, &refuse_pap,
donatien 0:8e01dca41002 242 "Don't allow PAP authentication with peer", 1 },
donatien 0:8e01dca41002 243 { "require-chap", o_bool, &lcp_wantoptions[0].neg_chap,
donatien 0:8e01dca41002 244 "Require CHAP authentication from peer", 1, &auth_required },
donatien 0:8e01dca41002 245 { "+chap", o_bool, &lcp_wantoptions[0].neg_chap,
donatien 0:8e01dca41002 246 "Require CHAP authentication from peer", 1, &auth_required },
donatien 0:8e01dca41002 247 { "refuse-chap", o_bool, &refuse_chap,
donatien 0:8e01dca41002 248 "Don't agree to auth to peer with CHAP", 1 },
donatien 0:8e01dca41002 249 { "-chap", o_bool, &refuse_chap,
donatien 0:8e01dca41002 250 "Don't allow CHAP authentication with peer", 1 },
donatien 0:8e01dca41002 251 { "name", o_string, our_name,
donatien 0:8e01dca41002 252 "Set local name for authentication",
donatien 0:8e01dca41002 253 OPT_PRIV|OPT_STATIC, NULL, MAXNAMELEN },
donatien 0:8e01dca41002 254 { "user", o_string, user,
donatien 0:8e01dca41002 255 "Set name for auth with peer", OPT_STATIC, NULL, MAXNAMELEN },
donatien 0:8e01dca41002 256 { "usehostname", o_bool, &usehostname,
donatien 0:8e01dca41002 257 "Must use hostname for authentication", 1 },
donatien 0:8e01dca41002 258 { "remotename", o_string, remote_name,
donatien 0:8e01dca41002 259 "Set remote name for authentication", OPT_STATIC,
donatien 0:8e01dca41002 260 &explicit_remote, MAXNAMELEN },
donatien 0:8e01dca41002 261 { "auth", o_bool, &auth_required,
donatien 0:8e01dca41002 262 "Require authentication from peer", 1 },
donatien 0:8e01dca41002 263 { "noauth", o_bool, &auth_required,
donatien 0:8e01dca41002 264 "Don't require peer to authenticate", OPT_PRIV, &allow_any_ip },
donatien 0:8e01dca41002 265 { "login", o_bool, &uselogin,
donatien 0:8e01dca41002 266 "Use system password database for PAP", 1 },
donatien 0:8e01dca41002 267 { "papcrypt", o_bool, &cryptpap,
donatien 0:8e01dca41002 268 "PAP passwords are encrypted", 1 },
donatien 0:8e01dca41002 269 { "+ua", o_special, (void *)setupapfile,
donatien 0:8e01dca41002 270 "Get PAP user and password from file" },
donatien 0:8e01dca41002 271 { "password", o_string, passwd,
donatien 0:8e01dca41002 272 "Password for authenticating us to the peer", OPT_STATIC,
donatien 0:8e01dca41002 273 NULL, MAXSECRETLEN },
donatien 0:8e01dca41002 274 { "privgroup", o_special, (void *)privgroup,
donatien 0:8e01dca41002 275 "Allow group members to use privileged options", OPT_PRIV },
donatien 0:8e01dca41002 276 { "allow-ip", o_special, (void *)set_noauth_addr,
donatien 0:8e01dca41002 277 "Set IP address(es) which can be used without authentication",
donatien 0:8e01dca41002 278 OPT_PRIV },
donatien 0:8e01dca41002 279 { NULL }
donatien 0:8e01dca41002 280 };
donatien 0:8e01dca41002 281 #endif /* UNUSED */
donatien 0:8e01dca41002 282 #if 0 /* UNUSED */
donatien 0:8e01dca41002 283 /*
donatien 0:8e01dca41002 284 * setupapfile - specifies UPAP info for authenticating with peer.
donatien 0:8e01dca41002 285 */
donatien 0:8e01dca41002 286 static int
donatien 0:8e01dca41002 287 setupapfile(char **argv)
donatien 0:8e01dca41002 288 {
donatien 0:8e01dca41002 289 FILE * ufile;
donatien 0:8e01dca41002 290 int l;
donatien 0:8e01dca41002 291
donatien 0:8e01dca41002 292 lcp_allowoptions[0].neg_upap = 1;
donatien 0:8e01dca41002 293
donatien 0:8e01dca41002 294 /* open user info file */
donatien 0:8e01dca41002 295 seteuid(getuid());
donatien 0:8e01dca41002 296 ufile = fopen(*argv, "r");
donatien 0:8e01dca41002 297 seteuid(0);
donatien 0:8e01dca41002 298 if (ufile == NULL) {
donatien 0:8e01dca41002 299 option_error("unable to open user login data file %s", *argv);
donatien 0:8e01dca41002 300 return 0;
donatien 0:8e01dca41002 301 }
donatien 0:8e01dca41002 302 check_access(ufile, *argv);
donatien 0:8e01dca41002 303
donatien 0:8e01dca41002 304 /* get username */
donatien 0:8e01dca41002 305 if (fgets(user, MAXNAMELEN - 1, ufile) == NULL
donatien 0:8e01dca41002 306 || fgets(passwd, MAXSECRETLEN - 1, ufile) == NULL){
donatien 0:8e01dca41002 307 option_error("unable to read user login data file %s", *argv);
donatien 0:8e01dca41002 308 return 0;
donatien 0:8e01dca41002 309 }
donatien 0:8e01dca41002 310 fclose(ufile);
donatien 0:8e01dca41002 311
donatien 0:8e01dca41002 312 /* get rid of newlines */
donatien 0:8e01dca41002 313 l = strlen(user);
donatien 0:8e01dca41002 314 if (l > 0 && user[l-1] == '\n')
donatien 0:8e01dca41002 315 user[l-1] = 0;
donatien 0:8e01dca41002 316 l = strlen(passwd);
donatien 0:8e01dca41002 317 if (l > 0 && passwd[l-1] == '\n')
donatien 0:8e01dca41002 318 passwd[l-1] = 0;
donatien 0:8e01dca41002 319
donatien 0:8e01dca41002 320 return (1);
donatien 0:8e01dca41002 321 }
donatien 0:8e01dca41002 322 #endif /* UNUSED */
donatien 0:8e01dca41002 323
donatien 0:8e01dca41002 324 #if 0 /* UNUSED */
donatien 0:8e01dca41002 325 /*
donatien 0:8e01dca41002 326 * privgroup - allow members of the group to have privileged access.
donatien 0:8e01dca41002 327 */
donatien 0:8e01dca41002 328 static int
donatien 0:8e01dca41002 329 privgroup(char **argv)
donatien 0:8e01dca41002 330 {
donatien 0:8e01dca41002 331 struct group *g;
donatien 0:8e01dca41002 332 int i;
donatien 0:8e01dca41002 333
donatien 0:8e01dca41002 334 g = getgrnam(*argv);
donatien 0:8e01dca41002 335 if (g == 0) {
donatien 0:8e01dca41002 336 option_error("group %s is unknown", *argv);
donatien 0:8e01dca41002 337 return 0;
donatien 0:8e01dca41002 338 }
donatien 0:8e01dca41002 339 for (i = 0; i < ngroups; ++i) {
donatien 0:8e01dca41002 340 if (groups[i] == g->gr_gid) {
donatien 0:8e01dca41002 341 privileged = 1;
donatien 0:8e01dca41002 342 break;
donatien 0:8e01dca41002 343 }
donatien 0:8e01dca41002 344 }
donatien 0:8e01dca41002 345 return 1;
donatien 0:8e01dca41002 346 }
donatien 0:8e01dca41002 347 #endif
donatien 0:8e01dca41002 348
donatien 0:8e01dca41002 349 #if 0 /* UNUSED */
donatien 0:8e01dca41002 350 /*
donatien 0:8e01dca41002 351 * set_noauth_addr - set address(es) that can be used without authentication.
donatien 0:8e01dca41002 352 * Equivalent to specifying an entry like `"" * "" addr' in pap-secrets.
donatien 0:8e01dca41002 353 */
donatien 0:8e01dca41002 354 static int
donatien 0:8e01dca41002 355 set_noauth_addr(char **argv)
donatien 0:8e01dca41002 356 {
donatien 0:8e01dca41002 357 char *addr = *argv;
donatien 0:8e01dca41002 358 int l = strlen(addr);
donatien 0:8e01dca41002 359 struct wordlist *wp;
donatien 0:8e01dca41002 360
donatien 0:8e01dca41002 361 wp = (struct wordlist *) malloc(sizeof(struct wordlist) + l + 1);
donatien 0:8e01dca41002 362 if (wp == NULL)
donatien 0:8e01dca41002 363 novm("allow-ip argument");
donatien 0:8e01dca41002 364 wp->word = (char *) (wp + 1);
donatien 0:8e01dca41002 365 wp->next = noauth_addrs;
donatien 0:8e01dca41002 366 BCOPY(addr, wp->word, l);
donatien 0:8e01dca41002 367 noauth_addrs = wp;
donatien 0:8e01dca41002 368 return 1;
donatien 0:8e01dca41002 369 }
donatien 0:8e01dca41002 370 #endif /* UNUSED */
donatien 0:8e01dca41002 371
donatien 0:8e01dca41002 372 /*
donatien 0:8e01dca41002 373 * An Open on LCP has requested a change from Dead to Establish phase.
donatien 0:8e01dca41002 374 * Do what's necessary to bring the physical layer up.
donatien 0:8e01dca41002 375 */
donatien 0:8e01dca41002 376 void
donatien 0:8e01dca41002 377 link_required(int unit)
donatien 0:8e01dca41002 378 {
donatien 0:8e01dca41002 379 LWIP_UNUSED_ARG(unit);
donatien 0:8e01dca41002 380
donatien 0:8e01dca41002 381 AUTHDEBUG(LOG_INFO, ("link_required: %d\n", unit));
donatien 0:8e01dca41002 382 }
donatien 0:8e01dca41002 383
donatien 0:8e01dca41002 384 /*
donatien 0:8e01dca41002 385 * LCP has terminated the link; go to the Dead phase and take the
donatien 0:8e01dca41002 386 * physical layer down.
donatien 0:8e01dca41002 387 */
donatien 0:8e01dca41002 388 void
donatien 0:8e01dca41002 389 link_terminated(int unit)
donatien 0:8e01dca41002 390 {
donatien 0:8e01dca41002 391 AUTHDEBUG(LOG_INFO, ("link_terminated: %d\n", unit));
donatien 0:8e01dca41002 392 if (lcp_phase[unit] == PHASE_DEAD) {
donatien 0:8e01dca41002 393 return;
donatien 0:8e01dca41002 394 }
donatien 0:8e01dca41002 395 if (logged_in) {
donatien 0:8e01dca41002 396 plogout();
donatien 0:8e01dca41002 397 }
donatien 0:8e01dca41002 398 lcp_phase[unit] = PHASE_DEAD;
donatien 0:8e01dca41002 399 AUTHDEBUG(LOG_NOTICE, ("Connection terminated.\n"));
donatien 0:8e01dca41002 400 pppLinkTerminated(unit);
donatien 0:8e01dca41002 401 }
donatien 0:8e01dca41002 402
donatien 0:8e01dca41002 403 /*
donatien 0:8e01dca41002 404 * LCP has gone down; it will either die or try to re-establish.
donatien 0:8e01dca41002 405 */
donatien 0:8e01dca41002 406 void
donatien 0:8e01dca41002 407 link_down(int unit)
donatien 0:8e01dca41002 408 {
donatien 0:8e01dca41002 409 int i;
donatien 0:8e01dca41002 410 struct protent *protp;
donatien 0:8e01dca41002 411
donatien 0:8e01dca41002 412 AUTHDEBUG(LOG_INFO, ("link_down: %d\n", unit));
donatien 0:8e01dca41002 413
donatien 0:8e01dca41002 414 if (did_authup) {
donatien 0:8e01dca41002 415 /* XXX Do link down processing. */
donatien 0:8e01dca41002 416 did_authup = 0;
donatien 0:8e01dca41002 417 }
donatien 0:8e01dca41002 418 for (i = 0; (protp = ppp_protocols[i]) != NULL; ++i) {
donatien 0:8e01dca41002 419 if (!protp->enabled_flag) {
donatien 0:8e01dca41002 420 continue;
donatien 0:8e01dca41002 421 }
donatien 0:8e01dca41002 422 if (protp->protocol != PPP_LCP && protp->lowerdown != NULL) {
donatien 0:8e01dca41002 423 (*protp->lowerdown)(unit);
donatien 0:8e01dca41002 424 }
donatien 0:8e01dca41002 425 if (protp->protocol < 0xC000 && protp->close != NULL) {
donatien 0:8e01dca41002 426 (*protp->close)(unit, "LCP down");
donatien 0:8e01dca41002 427 }
donatien 0:8e01dca41002 428 }
donatien 0:8e01dca41002 429 num_np_open = 0; /* number of network protocols we have opened */
donatien 0:8e01dca41002 430 num_np_up = 0; /* Number of network protocols which have come up */
donatien 0:8e01dca41002 431
donatien 0:8e01dca41002 432 if (lcp_phase[unit] != PHASE_DEAD) {
donatien 0:8e01dca41002 433 lcp_phase[unit] = PHASE_TERMINATE;
donatien 0:8e01dca41002 434 }
donatien 0:8e01dca41002 435 pppLinkDown(unit);
donatien 0:8e01dca41002 436 }
donatien 0:8e01dca41002 437
donatien 0:8e01dca41002 438 /*
donatien 0:8e01dca41002 439 * The link is established.
donatien 0:8e01dca41002 440 * Proceed to the Dead, Authenticate or Network phase as appropriate.
donatien 0:8e01dca41002 441 */
donatien 0:8e01dca41002 442 void
donatien 0:8e01dca41002 443 link_established(int unit)
donatien 0:8e01dca41002 444 {
donatien 0:8e01dca41002 445 int auth;
donatien 0:8e01dca41002 446 int i;
donatien 0:8e01dca41002 447 struct protent *protp;
donatien 0:8e01dca41002 448 lcp_options *wo = &lcp_wantoptions[unit];
donatien 0:8e01dca41002 449 lcp_options *go = &lcp_gotoptions[unit];
donatien 0:8e01dca41002 450 #if PAP_SUPPORT || CHAP_SUPPORT
donatien 0:8e01dca41002 451 lcp_options *ho = &lcp_hisoptions[unit];
donatien 0:8e01dca41002 452 #endif /* PAP_SUPPORT || CHAP_SUPPORT */
donatien 0:8e01dca41002 453
donatien 0:8e01dca41002 454 AUTHDEBUG(LOG_INFO, ("link_established: unit %d; Lowering up all protocols...\n", unit));
donatien 0:8e01dca41002 455 /*
donatien 0:8e01dca41002 456 * Tell higher-level protocols that LCP is up.
donatien 0:8e01dca41002 457 */
donatien 0:8e01dca41002 458 for (i = 0; (protp = ppp_protocols[i]) != NULL; ++i) {
donatien 0:8e01dca41002 459 if (protp->protocol != PPP_LCP && protp->enabled_flag && protp->lowerup != NULL) {
donatien 0:8e01dca41002 460 (*protp->lowerup)(unit);
donatien 0:8e01dca41002 461 }
donatien 0:8e01dca41002 462 }
donatien 0:8e01dca41002 463 if (ppp_settings.auth_required && !(go->neg_chap || go->neg_upap)) {
donatien 0:8e01dca41002 464 /*
donatien 0:8e01dca41002 465 * We wanted the peer to authenticate itself, and it refused:
donatien 0:8e01dca41002 466 * treat it as though it authenticated with PAP using a username
donatien 0:8e01dca41002 467 * of "" and a password of "". If that's not OK, boot it out.
donatien 0:8e01dca41002 468 */
donatien 0:8e01dca41002 469 if (!wo->neg_upap || !null_login(unit)) {
donatien 0:8e01dca41002 470 AUTHDEBUG(LOG_WARNING, ("peer refused to authenticate\n"));
donatien 0:8e01dca41002 471 lcp_close(unit, "peer refused to authenticate");
donatien 0:8e01dca41002 472 return;
donatien 0:8e01dca41002 473 }
donatien 0:8e01dca41002 474 }
donatien 0:8e01dca41002 475
donatien 0:8e01dca41002 476 lcp_phase[unit] = PHASE_AUTHENTICATE;
donatien 0:8e01dca41002 477 auth = 0;
donatien 0:8e01dca41002 478 #if CHAP_SUPPORT
donatien 0:8e01dca41002 479 if (go->neg_chap) {
donatien 0:8e01dca41002 480 ChapAuthPeer(unit, ppp_settings.our_name, go->chap_mdtype);
donatien 0:8e01dca41002 481 auth |= CHAP_PEER;
donatien 0:8e01dca41002 482 }
donatien 0:8e01dca41002 483 #endif /* CHAP_SUPPORT */
donatien 0:8e01dca41002 484 #if PAP_SUPPORT && CHAP_SUPPORT
donatien 0:8e01dca41002 485 else
donatien 0:8e01dca41002 486 #endif /* PAP_SUPPORT && CHAP_SUPPORT */
donatien 0:8e01dca41002 487 #if PAP_SUPPORT
donatien 0:8e01dca41002 488 if (go->neg_upap) {
donatien 0:8e01dca41002 489 upap_authpeer(unit);
donatien 0:8e01dca41002 490 auth |= PAP_PEER;
donatien 0:8e01dca41002 491 }
donatien 0:8e01dca41002 492 #endif /* PAP_SUPPORT */
donatien 0:8e01dca41002 493 #if CHAP_SUPPORT
donatien 0:8e01dca41002 494 if (ho->neg_chap) {
donatien 0:8e01dca41002 495 ChapAuthWithPeer(unit, ppp_settings.user, ho->chap_mdtype);
donatien 0:8e01dca41002 496 auth |= CHAP_WITHPEER;
donatien 0:8e01dca41002 497 }
donatien 0:8e01dca41002 498 #endif /* CHAP_SUPPORT */
donatien 0:8e01dca41002 499 #if PAP_SUPPORT && CHAP_SUPPORT
donatien 0:8e01dca41002 500 else
donatien 0:8e01dca41002 501 #endif /* PAP_SUPPORT && CHAP_SUPPORT */
donatien 0:8e01dca41002 502 #if PAP_SUPPORT
donatien 0:8e01dca41002 503 if (ho->neg_upap) {
donatien 0:8e01dca41002 504 if (ppp_settings.passwd[0] == 0) {
donatien 0:8e01dca41002 505 passwd_from_file = 1;
donatien 0:8e01dca41002 506 if (!get_pap_passwd(unit, ppp_settings.user, ppp_settings.passwd)) {
donatien 0:8e01dca41002 507 AUTHDEBUG(LOG_ERR, ("No secret found for PAP login\n"));
donatien 0:8e01dca41002 508 }
donatien 0:8e01dca41002 509 }
donatien 0:8e01dca41002 510 upap_authwithpeer(unit, ppp_settings.user, ppp_settings.passwd);
donatien 0:8e01dca41002 511 auth |= PAP_WITHPEER;
donatien 0:8e01dca41002 512 }
donatien 0:8e01dca41002 513 #endif /* PAP_SUPPORT */
donatien 0:8e01dca41002 514 auth_pending[unit] = auth;
donatien 0:8e01dca41002 515
donatien 0:8e01dca41002 516 if (!auth) {
donatien 0:8e01dca41002 517 network_phase(unit);
donatien 0:8e01dca41002 518 }
donatien 0:8e01dca41002 519 }
donatien 0:8e01dca41002 520
donatien 0:8e01dca41002 521 /*
donatien 0:8e01dca41002 522 * Proceed to the network phase.
donatien 0:8e01dca41002 523 */
donatien 0:8e01dca41002 524 static void
donatien 0:8e01dca41002 525 network_phase(int unit)
donatien 0:8e01dca41002 526 {
donatien 0:8e01dca41002 527 int i;
donatien 0:8e01dca41002 528 struct protent *protp;
donatien 0:8e01dca41002 529 lcp_options *go = &lcp_gotoptions[unit];
donatien 0:8e01dca41002 530
donatien 0:8e01dca41002 531 /*
donatien 0:8e01dca41002 532 * If the peer had to authenticate, run the auth-up script now.
donatien 0:8e01dca41002 533 */
donatien 0:8e01dca41002 534 if ((go->neg_chap || go->neg_upap) && !did_authup) {
donatien 0:8e01dca41002 535 /* XXX Do setup for peer authentication. */
donatien 0:8e01dca41002 536 did_authup = 1;
donatien 0:8e01dca41002 537 }
donatien 0:8e01dca41002 538
donatien 0:8e01dca41002 539 #if CBCP_SUPPORT
donatien 0:8e01dca41002 540 /*
donatien 0:8e01dca41002 541 * If we negotiated callback, do it now.
donatien 0:8e01dca41002 542 */
donatien 0:8e01dca41002 543 if (go->neg_cbcp) {
donatien 0:8e01dca41002 544 lcp_phase[unit] = PHASE_CALLBACK;
donatien 0:8e01dca41002 545 (*cbcp_protent.open)(unit);
donatien 0:8e01dca41002 546 return;
donatien 0:8e01dca41002 547 }
donatien 0:8e01dca41002 548 #endif /* CBCP_SUPPORT */
donatien 0:8e01dca41002 549
donatien 0:8e01dca41002 550 lcp_phase[unit] = PHASE_NETWORK;
donatien 0:8e01dca41002 551 for (i = 0; (protp = ppp_protocols[i]) != NULL; ++i) {
donatien 0:8e01dca41002 552 if (protp->protocol < 0xC000 && protp->enabled_flag && protp->open != NULL) {
donatien 0:8e01dca41002 553 (*protp->open)(unit);
donatien 0:8e01dca41002 554 if (protp->protocol != PPP_CCP) {
donatien 0:8e01dca41002 555 ++num_np_open;
donatien 0:8e01dca41002 556 }
donatien 0:8e01dca41002 557 }
donatien 0:8e01dca41002 558 }
donatien 0:8e01dca41002 559
donatien 0:8e01dca41002 560 if (num_np_open == 0) {
donatien 0:8e01dca41002 561 /* nothing to do */
donatien 0:8e01dca41002 562 lcp_close(0, "No network protocols running");
donatien 0:8e01dca41002 563 }
donatien 0:8e01dca41002 564 }
donatien 0:8e01dca41002 565 /* @todo: add void start_networks(void) here (pppd 2.3.11) */
donatien 0:8e01dca41002 566
donatien 0:8e01dca41002 567 /*
donatien 0:8e01dca41002 568 * The peer has failed to authenticate himself using `protocol'.
donatien 0:8e01dca41002 569 */
donatien 0:8e01dca41002 570 void
donatien 0:8e01dca41002 571 auth_peer_fail(int unit, u16_t protocol)
donatien 0:8e01dca41002 572 {
donatien 0:8e01dca41002 573 LWIP_UNUSED_ARG(protocol);
donatien 0:8e01dca41002 574
donatien 0:8e01dca41002 575 AUTHDEBUG(LOG_INFO, ("auth_peer_fail: %d proto=%X\n", unit, protocol));
donatien 0:8e01dca41002 576 /*
donatien 0:8e01dca41002 577 * Authentication failure: take the link down
donatien 0:8e01dca41002 578 */
donatien 0:8e01dca41002 579 lcp_close(unit, "Authentication failed");
donatien 0:8e01dca41002 580 }
donatien 0:8e01dca41002 581
donatien 0:8e01dca41002 582
donatien 0:8e01dca41002 583 #if PAP_SUPPORT || CHAP_SUPPORT
donatien 0:8e01dca41002 584 /*
donatien 0:8e01dca41002 585 * The peer has been successfully authenticated using `protocol'.
donatien 0:8e01dca41002 586 */
donatien 0:8e01dca41002 587 void
donatien 0:8e01dca41002 588 auth_peer_success(int unit, u16_t protocol, char *name, int namelen)
donatien 0:8e01dca41002 589 {
donatien 0:8e01dca41002 590 int pbit;
donatien 0:8e01dca41002 591
donatien 0:8e01dca41002 592 AUTHDEBUG(LOG_INFO, ("auth_peer_success: %d proto=%X\n", unit, protocol));
donatien 0:8e01dca41002 593 switch (protocol) {
donatien 0:8e01dca41002 594 case PPP_CHAP:
donatien 0:8e01dca41002 595 pbit = CHAP_PEER;
donatien 0:8e01dca41002 596 break;
donatien 0:8e01dca41002 597 case PPP_PAP:
donatien 0:8e01dca41002 598 pbit = PAP_PEER;
donatien 0:8e01dca41002 599 break;
donatien 0:8e01dca41002 600 default:
donatien 0:8e01dca41002 601 AUTHDEBUG(LOG_WARNING, ("auth_peer_success: unknown protocol %x\n", protocol));
donatien 0:8e01dca41002 602 return;
donatien 0:8e01dca41002 603 }
donatien 0:8e01dca41002 604
donatien 0:8e01dca41002 605 /*
donatien 0:8e01dca41002 606 * Save the authenticated name of the peer for later.
donatien 0:8e01dca41002 607 */
donatien 0:8e01dca41002 608 if (namelen > (int)sizeof(peer_authname) - 1) {
donatien 0:8e01dca41002 609 namelen = sizeof(peer_authname) - 1;
donatien 0:8e01dca41002 610 }
donatien 0:8e01dca41002 611 BCOPY(name, peer_authname, namelen);
donatien 0:8e01dca41002 612 peer_authname[namelen] = 0;
donatien 0:8e01dca41002 613
donatien 0:8e01dca41002 614 /*
donatien 0:8e01dca41002 615 * If there is no more authentication still to be done,
donatien 0:8e01dca41002 616 * proceed to the network (or callback) phase.
donatien 0:8e01dca41002 617 */
donatien 0:8e01dca41002 618 if ((auth_pending[unit] &= ~pbit) == 0) {
donatien 0:8e01dca41002 619 network_phase(unit);
donatien 0:8e01dca41002 620 }
donatien 0:8e01dca41002 621 }
donatien 0:8e01dca41002 622
donatien 0:8e01dca41002 623 /*
donatien 0:8e01dca41002 624 * We have failed to authenticate ourselves to the peer using `protocol'.
donatien 0:8e01dca41002 625 */
donatien 0:8e01dca41002 626 void
donatien 0:8e01dca41002 627 auth_withpeer_fail(int unit, u16_t protocol)
donatien 0:8e01dca41002 628 {
donatien 0:8e01dca41002 629 int errCode = PPPERR_AUTHFAIL;
donatien 0:8e01dca41002 630
donatien 0:8e01dca41002 631 LWIP_UNUSED_ARG(protocol);
donatien 0:8e01dca41002 632
donatien 0:8e01dca41002 633 AUTHDEBUG(LOG_INFO, ("auth_withpeer_fail: %d proto=%X\n", unit, protocol));
donatien 0:8e01dca41002 634 if (passwd_from_file) {
donatien 0:8e01dca41002 635 BZERO(ppp_settings.passwd, MAXSECRETLEN);
donatien 0:8e01dca41002 636 }
donatien 0:8e01dca41002 637
donatien 0:8e01dca41002 638 /*
donatien 0:8e01dca41002 639 * We've failed to authenticate ourselves to our peer.
donatien 0:8e01dca41002 640 * He'll probably take the link down, and there's not much
donatien 0:8e01dca41002 641 * we can do except wait for that.
donatien 0:8e01dca41002 642 */
donatien 0:8e01dca41002 643 pppIOCtl(unit, PPPCTLS_ERRCODE, &errCode);
donatien 0:8e01dca41002 644 lcp_close(unit, "Failed to authenticate ourselves to peer");
donatien 0:8e01dca41002 645 }
donatien 0:8e01dca41002 646
donatien 0:8e01dca41002 647 /*
donatien 0:8e01dca41002 648 * We have successfully authenticated ourselves with the peer using `protocol'.
donatien 0:8e01dca41002 649 */
donatien 0:8e01dca41002 650 void
donatien 0:8e01dca41002 651 auth_withpeer_success(int unit, u16_t protocol)
donatien 0:8e01dca41002 652 {
donatien 0:8e01dca41002 653 int pbit;
donatien 0:8e01dca41002 654
donatien 0:8e01dca41002 655 AUTHDEBUG(LOG_INFO, ("auth_withpeer_success: %d proto=%X\n", unit, protocol));
donatien 0:8e01dca41002 656 switch (protocol) {
donatien 0:8e01dca41002 657 case PPP_CHAP:
donatien 0:8e01dca41002 658 pbit = CHAP_WITHPEER;
donatien 0:8e01dca41002 659 break;
donatien 0:8e01dca41002 660 case PPP_PAP:
donatien 0:8e01dca41002 661 if (passwd_from_file) {
donatien 0:8e01dca41002 662 BZERO(ppp_settings.passwd, MAXSECRETLEN);
donatien 0:8e01dca41002 663 }
donatien 0:8e01dca41002 664 pbit = PAP_WITHPEER;
donatien 0:8e01dca41002 665 break;
donatien 0:8e01dca41002 666 default:
donatien 0:8e01dca41002 667 AUTHDEBUG(LOG_WARNING, ("auth_peer_success: unknown protocol %x\n", protocol));
donatien 0:8e01dca41002 668 pbit = 0;
donatien 0:8e01dca41002 669 }
donatien 0:8e01dca41002 670
donatien 0:8e01dca41002 671 /*
donatien 0:8e01dca41002 672 * If there is no more authentication still being done,
donatien 0:8e01dca41002 673 * proceed to the network (or callback) phase.
donatien 0:8e01dca41002 674 */
donatien 0:8e01dca41002 675 if ((auth_pending[unit] &= ~pbit) == 0) {
donatien 0:8e01dca41002 676 network_phase(unit);
donatien 0:8e01dca41002 677 }
donatien 0:8e01dca41002 678 }
donatien 0:8e01dca41002 679 #endif /* PAP_SUPPORT || CHAP_SUPPORT */
donatien 0:8e01dca41002 680
donatien 0:8e01dca41002 681
donatien 0:8e01dca41002 682 /*
donatien 0:8e01dca41002 683 * np_up - a network protocol has come up.
donatien 0:8e01dca41002 684 */
donatien 0:8e01dca41002 685 void
donatien 0:8e01dca41002 686 np_up(int unit, u16_t proto)
donatien 0:8e01dca41002 687 {
donatien 0:8e01dca41002 688 LWIP_UNUSED_ARG(unit);
donatien 0:8e01dca41002 689 LWIP_UNUSED_ARG(proto);
donatien 0:8e01dca41002 690
donatien 0:8e01dca41002 691 AUTHDEBUG(LOG_INFO, ("np_up: %d proto=%X\n", unit, proto));
donatien 0:8e01dca41002 692 if (num_np_up == 0) {
donatien 0:8e01dca41002 693 AUTHDEBUG(LOG_INFO, ("np_up: maxconnect=%d idle_time_limit=%d\n",ppp_settings.maxconnect,ppp_settings.idle_time_limit));
donatien 0:8e01dca41002 694 /*
donatien 0:8e01dca41002 695 * At this point we consider that the link has come up successfully.
donatien 0:8e01dca41002 696 */
donatien 0:8e01dca41002 697 if (ppp_settings.idle_time_limit > 0) {
donatien 0:8e01dca41002 698 TIMEOUT(check_idle, NULL, ppp_settings.idle_time_limit);
donatien 0:8e01dca41002 699 }
donatien 0:8e01dca41002 700
donatien 0:8e01dca41002 701 /*
donatien 0:8e01dca41002 702 * Set a timeout to close the connection once the maximum
donatien 0:8e01dca41002 703 * connect time has expired.
donatien 0:8e01dca41002 704 */
donatien 0:8e01dca41002 705 if (ppp_settings.maxconnect > 0) {
donatien 0:8e01dca41002 706 TIMEOUT(connect_time_expired, 0, ppp_settings.maxconnect);
donatien 0:8e01dca41002 707 }
donatien 0:8e01dca41002 708 }
donatien 0:8e01dca41002 709 ++num_np_up;
donatien 0:8e01dca41002 710 }
donatien 0:8e01dca41002 711
donatien 0:8e01dca41002 712 /*
donatien 0:8e01dca41002 713 * np_down - a network protocol has gone down.
donatien 0:8e01dca41002 714 */
donatien 0:8e01dca41002 715 void
donatien 0:8e01dca41002 716 np_down(int unit, u16_t proto)
donatien 0:8e01dca41002 717 {
donatien 0:8e01dca41002 718 LWIP_UNUSED_ARG(unit);
donatien 0:8e01dca41002 719 LWIP_UNUSED_ARG(proto);
donatien 0:8e01dca41002 720
donatien 0:8e01dca41002 721 AUTHDEBUG(LOG_INFO, ("np_down: %d proto=%X\n", unit, proto));
donatien 0:8e01dca41002 722 if (--num_np_up == 0 && ppp_settings.idle_time_limit > 0) {
donatien 0:8e01dca41002 723 UNTIMEOUT(check_idle, NULL);
donatien 0:8e01dca41002 724 }
donatien 0:8e01dca41002 725 }
donatien 0:8e01dca41002 726
donatien 0:8e01dca41002 727 /*
donatien 0:8e01dca41002 728 * np_finished - a network protocol has finished using the link.
donatien 0:8e01dca41002 729 */
donatien 0:8e01dca41002 730 void
donatien 0:8e01dca41002 731 np_finished(int unit, u16_t proto)
donatien 0:8e01dca41002 732 {
donatien 0:8e01dca41002 733 LWIP_UNUSED_ARG(unit);
donatien 0:8e01dca41002 734 LWIP_UNUSED_ARG(proto);
donatien 0:8e01dca41002 735
donatien 0:8e01dca41002 736 AUTHDEBUG(LOG_INFO, ("np_finished: %d proto=%X\n", unit, proto));
donatien 0:8e01dca41002 737 if (--num_np_open <= 0) {
donatien 0:8e01dca41002 738 /* no further use for the link: shut up shop. */
donatien 0:8e01dca41002 739 lcp_close(0, "No network protocols running");
donatien 0:8e01dca41002 740 }
donatien 0:8e01dca41002 741 }
donatien 0:8e01dca41002 742
donatien 0:8e01dca41002 743 /*
donatien 0:8e01dca41002 744 * check_idle - check whether the link has been idle for long
donatien 0:8e01dca41002 745 * enough that we can shut it down.
donatien 0:8e01dca41002 746 */
donatien 0:8e01dca41002 747 static void
donatien 0:8e01dca41002 748 check_idle(void *arg)
donatien 0:8e01dca41002 749 {
donatien 0:8e01dca41002 750 struct ppp_idle idle;
donatien 0:8e01dca41002 751 u_short itime;
donatien 0:8e01dca41002 752
donatien 0:8e01dca41002 753 LWIP_UNUSED_ARG(arg);
donatien 0:8e01dca41002 754 if (!get_idle_time(0, &idle)) {
donatien 0:8e01dca41002 755 return;
donatien 0:8e01dca41002 756 }
donatien 0:8e01dca41002 757 itime = LWIP_MIN(idle.xmit_idle, idle.recv_idle);
donatien 0:8e01dca41002 758 if (itime >= ppp_settings.idle_time_limit) {
donatien 0:8e01dca41002 759 /* link is idle: shut it down. */
donatien 0:8e01dca41002 760 AUTHDEBUG(LOG_INFO, ("Terminating connection due to lack of activity.\n"));
donatien 0:8e01dca41002 761 lcp_close(0, "Link inactive");
donatien 0:8e01dca41002 762 } else {
donatien 0:8e01dca41002 763 TIMEOUT(check_idle, NULL, ppp_settings.idle_time_limit - itime);
donatien 0:8e01dca41002 764 }
donatien 0:8e01dca41002 765 }
donatien 0:8e01dca41002 766
donatien 0:8e01dca41002 767 /*
donatien 0:8e01dca41002 768 * connect_time_expired - log a message and close the connection.
donatien 0:8e01dca41002 769 */
donatien 0:8e01dca41002 770 static void
donatien 0:8e01dca41002 771 connect_time_expired(void *arg)
donatien 0:8e01dca41002 772 {
donatien 0:8e01dca41002 773 LWIP_UNUSED_ARG(arg);
donatien 0:8e01dca41002 774
donatien 0:8e01dca41002 775 AUTHDEBUG(LOG_INFO, ("Connect time expired\n"));
donatien 0:8e01dca41002 776 lcp_close(0, "Connect time expired"); /* Close connection */
donatien 0:8e01dca41002 777 }
donatien 0:8e01dca41002 778
donatien 0:8e01dca41002 779 #if 0 /* UNUSED */
donatien 0:8e01dca41002 780 /*
donatien 0:8e01dca41002 781 * auth_check_options - called to check authentication options.
donatien 0:8e01dca41002 782 */
donatien 0:8e01dca41002 783 void
donatien 0:8e01dca41002 784 auth_check_options(void)
donatien 0:8e01dca41002 785 {
donatien 0:8e01dca41002 786 lcp_options *wo = &lcp_wantoptions[0];
donatien 0:8e01dca41002 787 int can_auth;
donatien 0:8e01dca41002 788 ipcp_options *ipwo = &ipcp_wantoptions[0];
donatien 0:8e01dca41002 789 u32_t remote;
donatien 0:8e01dca41002 790
donatien 0:8e01dca41002 791 /* Default our_name to hostname, and user to our_name */
donatien 0:8e01dca41002 792 if (ppp_settings.our_name[0] == 0 || ppp_settings.usehostname) {
donatien 0:8e01dca41002 793 strcpy(ppp_settings.our_name, ppp_settings.hostname);
donatien 0:8e01dca41002 794 }
donatien 0:8e01dca41002 795
donatien 0:8e01dca41002 796 if (ppp_settings.user[0] == 0) {
donatien 0:8e01dca41002 797 strcpy(ppp_settings.user, ppp_settings.our_name);
donatien 0:8e01dca41002 798 }
donatien 0:8e01dca41002 799
donatien 0:8e01dca41002 800 /* If authentication is required, ask peer for CHAP or PAP. */
donatien 0:8e01dca41002 801 if (ppp_settings.auth_required && !wo->neg_chap && !wo->neg_upap) {
donatien 0:8e01dca41002 802 wo->neg_chap = 1;
donatien 0:8e01dca41002 803 wo->neg_upap = 1;
donatien 0:8e01dca41002 804 }
donatien 0:8e01dca41002 805
donatien 0:8e01dca41002 806 /*
donatien 0:8e01dca41002 807 * Check whether we have appropriate secrets to use
donatien 0:8e01dca41002 808 * to authenticate the peer.
donatien 0:8e01dca41002 809 */
donatien 0:8e01dca41002 810 can_auth = wo->neg_upap && have_pap_secret();
donatien 0:8e01dca41002 811 if (!can_auth && wo->neg_chap) {
donatien 0:8e01dca41002 812 remote = ipwo->accept_remote? 0: ipwo->hisaddr;
donatien 0:8e01dca41002 813 can_auth = have_chap_secret(ppp_settings.remote_name, ppp_settings.our_name, remote);
donatien 0:8e01dca41002 814 }
donatien 0:8e01dca41002 815
donatien 0:8e01dca41002 816 if (ppp_settings.auth_required && !can_auth) {
donatien 0:8e01dca41002 817 ppp_panic("No auth secret");
donatien 0:8e01dca41002 818 }
donatien 0:8e01dca41002 819 }
donatien 0:8e01dca41002 820 #endif /* UNUSED */
donatien 0:8e01dca41002 821
donatien 0:8e01dca41002 822 /*
donatien 0:8e01dca41002 823 * auth_reset - called when LCP is starting negotiations to recheck
donatien 0:8e01dca41002 824 * authentication options, i.e. whether we have appropriate secrets
donatien 0:8e01dca41002 825 * to use for authenticating ourselves and/or the peer.
donatien 0:8e01dca41002 826 */
donatien 0:8e01dca41002 827 void
donatien 0:8e01dca41002 828 auth_reset(int unit)
donatien 0:8e01dca41002 829 {
donatien 0:8e01dca41002 830 lcp_options *go = &lcp_gotoptions[unit];
donatien 0:8e01dca41002 831 lcp_options *ao = &lcp_allowoptions[0];
donatien 0:8e01dca41002 832 ipcp_options *ipwo = &ipcp_wantoptions[0];
donatien 0:8e01dca41002 833 u32_t remote;
donatien 0:8e01dca41002 834
donatien 0:8e01dca41002 835 AUTHDEBUG(LOG_INFO, ("auth_reset: %d\n", unit));
donatien 0:8e01dca41002 836 ao->neg_upap = !ppp_settings.refuse_pap && (ppp_settings.passwd[0] != 0 || get_pap_passwd(unit, NULL, NULL));
donatien 0:8e01dca41002 837 ao->neg_chap = !ppp_settings.refuse_chap && ppp_settings.passwd[0] != 0 /*have_chap_secret(ppp_settings.user, ppp_settings.remote_name, (u32_t)0)*/;
donatien 0:8e01dca41002 838
donatien 0:8e01dca41002 839 if (go->neg_upap && !have_pap_secret()) {
donatien 0:8e01dca41002 840 go->neg_upap = 0;
donatien 0:8e01dca41002 841 }
donatien 0:8e01dca41002 842 if (go->neg_chap) {
donatien 0:8e01dca41002 843 remote = ipwo->accept_remote? 0: ipwo->hisaddr;
donatien 0:8e01dca41002 844 if (!have_chap_secret(ppp_settings.remote_name, ppp_settings.our_name, remote)) {
donatien 0:8e01dca41002 845 go->neg_chap = 0;
donatien 0:8e01dca41002 846 }
donatien 0:8e01dca41002 847 }
donatien 0:8e01dca41002 848 }
donatien 0:8e01dca41002 849
donatien 0:8e01dca41002 850 #if PAP_SUPPORT
donatien 0:8e01dca41002 851 /*
donatien 0:8e01dca41002 852 * check_passwd - Check the user name and passwd against the PAP secrets
donatien 0:8e01dca41002 853 * file. If requested, also check against the system password database,
donatien 0:8e01dca41002 854 * and login the user if OK.
donatien 0:8e01dca41002 855 *
donatien 0:8e01dca41002 856 * returns:
donatien 0:8e01dca41002 857 * UPAP_AUTHNAK: Authentication failed.
donatien 0:8e01dca41002 858 * UPAP_AUTHACK: Authentication succeeded.
donatien 0:8e01dca41002 859 * In either case, msg points to an appropriate message.
donatien 0:8e01dca41002 860 */
donatien 0:8e01dca41002 861 u_char
donatien 0:8e01dca41002 862 check_passwd( int unit, char *auser, int userlen, char *apasswd, int passwdlen, char **msg, int *msglen)
donatien 0:8e01dca41002 863 {
donatien 0:8e01dca41002 864 #if 1 /* XXX Assume all entries OK. */
donatien 0:8e01dca41002 865 LWIP_UNUSED_ARG(unit);
donatien 0:8e01dca41002 866 LWIP_UNUSED_ARG(auser);
donatien 0:8e01dca41002 867 LWIP_UNUSED_ARG(userlen);
donatien 0:8e01dca41002 868 LWIP_UNUSED_ARG(apasswd);
donatien 0:8e01dca41002 869 LWIP_UNUSED_ARG(passwdlen);
donatien 0:8e01dca41002 870 LWIP_UNUSED_ARG(msglen);
donatien 0:8e01dca41002 871 *msg = (char *) 0;
donatien 0:8e01dca41002 872 return UPAP_AUTHACK; /* XXX Assume all entries OK. */
donatien 0:8e01dca41002 873 #else
donatien 0:8e01dca41002 874 u_char ret = 0;
donatien 0:8e01dca41002 875 struct wordlist *addrs = NULL;
donatien 0:8e01dca41002 876 char passwd[256], user[256];
donatien 0:8e01dca41002 877 char secret[MAXWORDLEN];
donatien 0:8e01dca41002 878 static u_short attempts = 0;
donatien 0:8e01dca41002 879
donatien 0:8e01dca41002 880 /*
donatien 0:8e01dca41002 881 * Make copies of apasswd and auser, then null-terminate them.
donatien 0:8e01dca41002 882 */
donatien 0:8e01dca41002 883 BCOPY(apasswd, passwd, passwdlen);
donatien 0:8e01dca41002 884 passwd[passwdlen] = '\0';
donatien 0:8e01dca41002 885 BCOPY(auser, user, userlen);
donatien 0:8e01dca41002 886 user[userlen] = '\0';
donatien 0:8e01dca41002 887 *msg = (char *) 0;
donatien 0:8e01dca41002 888
donatien 0:8e01dca41002 889 /* XXX Validate user name and password. */
donatien 0:8e01dca41002 890 ret = UPAP_AUTHACK; /* XXX Assume all entries OK. */
donatien 0:8e01dca41002 891
donatien 0:8e01dca41002 892 if (ret == UPAP_AUTHNAK) {
donatien 0:8e01dca41002 893 if (*msg == (char *) 0) {
donatien 0:8e01dca41002 894 *msg = "Login incorrect";
donatien 0:8e01dca41002 895 }
donatien 0:8e01dca41002 896 *msglen = strlen(*msg);
donatien 0:8e01dca41002 897 /*
donatien 0:8e01dca41002 898 * Frustrate passwd stealer programs.
donatien 0:8e01dca41002 899 * Allow 10 tries, but start backing off after 3 (stolen from login).
donatien 0:8e01dca41002 900 * On 10'th, drop the connection.
donatien 0:8e01dca41002 901 */
donatien 0:8e01dca41002 902 if (attempts++ >= 10) {
donatien 0:8e01dca41002 903 AUTHDEBUG(LOG_WARNING, ("%d LOGIN FAILURES BY %s\n", attempts, user));
donatien 0:8e01dca41002 904 /*ppp_panic("Excess Bad Logins");*/
donatien 0:8e01dca41002 905 }
donatien 0:8e01dca41002 906 if (attempts > 3) {
donatien 0:8e01dca41002 907 /* @todo: this was sleep(), i.e. seconds, not milliseconds
donatien 0:8e01dca41002 908 * I don't think we really need this in lwIP - we would block tcpip_thread!
donatien 0:8e01dca41002 909 */
donatien 0:8e01dca41002 910 /*sys_msleep((attempts - 3) * 5);*/
donatien 0:8e01dca41002 911 }
donatien 0:8e01dca41002 912 if (addrs != NULL) {
donatien 0:8e01dca41002 913 free_wordlist(addrs);
donatien 0:8e01dca41002 914 }
donatien 0:8e01dca41002 915 } else {
donatien 0:8e01dca41002 916 attempts = 0; /* Reset count */
donatien 0:8e01dca41002 917 if (*msg == (char *) 0) {
donatien 0:8e01dca41002 918 *msg = "Login ok";
donatien 0:8e01dca41002 919 }
donatien 0:8e01dca41002 920 *msglen = strlen(*msg);
donatien 0:8e01dca41002 921 set_allowed_addrs(unit, addrs);
donatien 0:8e01dca41002 922 }
donatien 0:8e01dca41002 923
donatien 0:8e01dca41002 924 BZERO(passwd, sizeof(passwd));
donatien 0:8e01dca41002 925 BZERO(secret, sizeof(secret));
donatien 0:8e01dca41002 926
donatien 0:8e01dca41002 927 return ret;
donatien 0:8e01dca41002 928 #endif
donatien 0:8e01dca41002 929 }
donatien 0:8e01dca41002 930 #endif /* PAP_SUPPORT */
donatien 0:8e01dca41002 931
donatien 0:8e01dca41002 932 #if 0 /* UNUSED */
donatien 0:8e01dca41002 933 /*
donatien 0:8e01dca41002 934 * This function is needed for PAM.
donatien 0:8e01dca41002 935 */
donatien 0:8e01dca41002 936
donatien 0:8e01dca41002 937 #ifdef USE_PAM
donatien 0:8e01dca41002 938
donatien 0:8e01dca41002 939 /* lwip does not support PAM*/
donatien 0:8e01dca41002 940
donatien 0:8e01dca41002 941 #endif /* USE_PAM */
donatien 0:8e01dca41002 942
donatien 0:8e01dca41002 943 #endif /* UNUSED */
donatien 0:8e01dca41002 944
donatien 0:8e01dca41002 945
donatien 0:8e01dca41002 946 #if 0 /* UNUSED */
donatien 0:8e01dca41002 947 /*
donatien 0:8e01dca41002 948 * plogin - Check the user name and password against the system
donatien 0:8e01dca41002 949 * password database, and login the user if OK.
donatien 0:8e01dca41002 950 *
donatien 0:8e01dca41002 951 * returns:
donatien 0:8e01dca41002 952 * UPAP_AUTHNAK: Login failed.
donatien 0:8e01dca41002 953 * UPAP_AUTHACK: Login succeeded.
donatien 0:8e01dca41002 954 * In either case, msg points to an appropriate message.
donatien 0:8e01dca41002 955 */
donatien 0:8e01dca41002 956 static int
donatien 0:8e01dca41002 957 plogin(char *user, char *passwd, char **msg, int *msglen)
donatien 0:8e01dca41002 958 {
donatien 0:8e01dca41002 959
donatien 0:8e01dca41002 960 LWIP_UNUSED_ARG(user);
donatien 0:8e01dca41002 961 LWIP_UNUSED_ARG(passwd);
donatien 0:8e01dca41002 962 LWIP_UNUSED_ARG(msg);
donatien 0:8e01dca41002 963 LWIP_UNUSED_ARG(msglen);
donatien 0:8e01dca41002 964
donatien 0:8e01dca41002 965
donatien 0:8e01dca41002 966 /* The new lines are here align the file when
donatien 0:8e01dca41002 967 * compared against the pppd 2.3.11 code */
donatien 0:8e01dca41002 968
donatien 0:8e01dca41002 969
donatien 0:8e01dca41002 970
donatien 0:8e01dca41002 971
donatien 0:8e01dca41002 972
donatien 0:8e01dca41002 973
donatien 0:8e01dca41002 974
donatien 0:8e01dca41002 975
donatien 0:8e01dca41002 976
donatien 0:8e01dca41002 977
donatien 0:8e01dca41002 978
donatien 0:8e01dca41002 979
donatien 0:8e01dca41002 980
donatien 0:8e01dca41002 981
donatien 0:8e01dca41002 982
donatien 0:8e01dca41002 983
donatien 0:8e01dca41002 984 /* XXX Fail until we decide that we want to support logins. */
donatien 0:8e01dca41002 985 return (UPAP_AUTHNAK);
donatien 0:8e01dca41002 986 }
donatien 0:8e01dca41002 987 #endif
donatien 0:8e01dca41002 988
donatien 0:8e01dca41002 989
donatien 0:8e01dca41002 990
donatien 0:8e01dca41002 991 /*
donatien 0:8e01dca41002 992 * plogout - Logout the user.
donatien 0:8e01dca41002 993 */
donatien 0:8e01dca41002 994 static void
donatien 0:8e01dca41002 995 plogout(void)
donatien 0:8e01dca41002 996 {
donatien 0:8e01dca41002 997 logged_in = 0;
donatien 0:8e01dca41002 998 }
donatien 0:8e01dca41002 999
donatien 0:8e01dca41002 1000 /*
donatien 0:8e01dca41002 1001 * null_login - Check if a username of "" and a password of "" are
donatien 0:8e01dca41002 1002 * acceptable, and iff so, set the list of acceptable IP addresses
donatien 0:8e01dca41002 1003 * and return 1.
donatien 0:8e01dca41002 1004 */
donatien 0:8e01dca41002 1005 static int
donatien 0:8e01dca41002 1006 null_login(int unit)
donatien 0:8e01dca41002 1007 {
donatien 0:8e01dca41002 1008 LWIP_UNUSED_ARG(unit);
donatien 0:8e01dca41002 1009 /* XXX Fail until we decide that we want to support logins. */
donatien 0:8e01dca41002 1010 return 0;
donatien 0:8e01dca41002 1011 }
donatien 0:8e01dca41002 1012
donatien 0:8e01dca41002 1013
donatien 0:8e01dca41002 1014 /*
donatien 0:8e01dca41002 1015 * get_pap_passwd - get a password for authenticating ourselves with
donatien 0:8e01dca41002 1016 * our peer using PAP. Returns 1 on success, 0 if no suitable password
donatien 0:8e01dca41002 1017 * could be found.
donatien 0:8e01dca41002 1018 */
donatien 0:8e01dca41002 1019 static int
donatien 0:8e01dca41002 1020 get_pap_passwd(int unit, char *user, char *passwd)
donatien 0:8e01dca41002 1021 {
donatien 0:8e01dca41002 1022 LWIP_UNUSED_ARG(unit);
donatien 0:8e01dca41002 1023 /* normally we would reject PAP if no password is provided,
donatien 0:8e01dca41002 1024 but this causes problems with some providers (like CHT in Taiwan)
donatien 0:8e01dca41002 1025 who incorrectly request PAP and expect a bogus/empty password, so
donatien 0:8e01dca41002 1026 always provide a default user/passwd of "none"/"none"
donatien 0:8e01dca41002 1027
donatien 0:8e01dca41002 1028 @todo: This should be configured by the user, instead of being hardcoded here!
donatien 0:8e01dca41002 1029 */
donatien 0:8e01dca41002 1030 if(user) {
donatien 0:8e01dca41002 1031 strcpy(user, "none");
donatien 0:8e01dca41002 1032 }
donatien 0:8e01dca41002 1033 if(passwd) {
donatien 0:8e01dca41002 1034 strcpy(passwd, "none");
donatien 0:8e01dca41002 1035 }
donatien 0:8e01dca41002 1036 return 1;
donatien 0:8e01dca41002 1037 }
donatien 0:8e01dca41002 1038
donatien 0:8e01dca41002 1039 /*
donatien 0:8e01dca41002 1040 * have_pap_secret - check whether we have a PAP file with any
donatien 0:8e01dca41002 1041 * secrets that we could possibly use for authenticating the peer.
donatien 0:8e01dca41002 1042 */
donatien 0:8e01dca41002 1043 static int
donatien 0:8e01dca41002 1044 have_pap_secret(void)
donatien 0:8e01dca41002 1045 {
donatien 0:8e01dca41002 1046 /* XXX Fail until we set up our passwords. */
donatien 0:8e01dca41002 1047 return 0;
donatien 0:8e01dca41002 1048 }
donatien 0:8e01dca41002 1049
donatien 0:8e01dca41002 1050 /*
donatien 0:8e01dca41002 1051 * have_chap_secret - check whether we have a CHAP file with a
donatien 0:8e01dca41002 1052 * secret that we could possibly use for authenticating `client'
donatien 0:8e01dca41002 1053 * on `server'. Either can be the null string, meaning we don't
donatien 0:8e01dca41002 1054 * know the identity yet.
donatien 0:8e01dca41002 1055 */
donatien 0:8e01dca41002 1056 static int
donatien 0:8e01dca41002 1057 have_chap_secret(char *client, char *server, u32_t remote)
donatien 0:8e01dca41002 1058 {
donatien 0:8e01dca41002 1059 LWIP_UNUSED_ARG(client);
donatien 0:8e01dca41002 1060 LWIP_UNUSED_ARG(server);
donatien 0:8e01dca41002 1061 LWIP_UNUSED_ARG(remote);
donatien 0:8e01dca41002 1062
donatien 0:8e01dca41002 1063 /* XXX Fail until we set up our passwords. */
donatien 0:8e01dca41002 1064 return 0;
donatien 0:8e01dca41002 1065 }
donatien 0:8e01dca41002 1066 #if CHAP_SUPPORT
donatien 0:8e01dca41002 1067
donatien 0:8e01dca41002 1068 /*
donatien 0:8e01dca41002 1069 * get_secret - open the CHAP secret file and return the secret
donatien 0:8e01dca41002 1070 * for authenticating the given client on the given server.
donatien 0:8e01dca41002 1071 * (We could be either client or server).
donatien 0:8e01dca41002 1072 */
donatien 0:8e01dca41002 1073 int
donatien 0:8e01dca41002 1074 get_secret(int unit, char *client, char *server, char *secret, int *secret_len, int save_addrs)
donatien 0:8e01dca41002 1075 {
donatien 0:8e01dca41002 1076 #if 1
donatien 0:8e01dca41002 1077 int len;
donatien 0:8e01dca41002 1078 struct wordlist *addrs;
donatien 0:8e01dca41002 1079
donatien 0:8e01dca41002 1080 LWIP_UNUSED_ARG(unit);
donatien 0:8e01dca41002 1081 LWIP_UNUSED_ARG(server);
donatien 0:8e01dca41002 1082 LWIP_UNUSED_ARG(save_addrs);
donatien 0:8e01dca41002 1083
donatien 0:8e01dca41002 1084 addrs = NULL;
donatien 0:8e01dca41002 1085
donatien 0:8e01dca41002 1086 if(!client || !client[0] || strcmp(client, ppp_settings.user)) {
donatien 0:8e01dca41002 1087 return 0;
donatien 0:8e01dca41002 1088 }
donatien 0:8e01dca41002 1089
donatien 0:8e01dca41002 1090 len = (int)strlen(ppp_settings.passwd);
donatien 0:8e01dca41002 1091 if (len > MAXSECRETLEN) {
donatien 0:8e01dca41002 1092 AUTHDEBUG(LOG_ERR, ("Secret for %s on %s is too long\n", client, server));
donatien 0:8e01dca41002 1093 len = MAXSECRETLEN;
donatien 0:8e01dca41002 1094 }
donatien 0:8e01dca41002 1095
donatien 0:8e01dca41002 1096 BCOPY(ppp_settings.passwd, secret, len);
donatien 0:8e01dca41002 1097 *secret_len = len;
donatien 0:8e01dca41002 1098
donatien 0:8e01dca41002 1099 return 1;
donatien 0:8e01dca41002 1100 #else
donatien 0:8e01dca41002 1101 int ret = 0, len;
donatien 0:8e01dca41002 1102 struct wordlist *addrs;
donatien 0:8e01dca41002 1103 char secbuf[MAXWORDLEN];
donatien 0:8e01dca41002 1104
donatien 0:8e01dca41002 1105 addrs = NULL;
donatien 0:8e01dca41002 1106 secbuf[0] = 0;
donatien 0:8e01dca41002 1107
donatien 0:8e01dca41002 1108 /* XXX Find secret. */
donatien 0:8e01dca41002 1109 if (ret < 0) {
donatien 0:8e01dca41002 1110 return 0;
donatien 0:8e01dca41002 1111 }
donatien 0:8e01dca41002 1112
donatien 0:8e01dca41002 1113 if (save_addrs) {
donatien 0:8e01dca41002 1114 set_allowed_addrs(unit, addrs);
donatien 0:8e01dca41002 1115 }
donatien 0:8e01dca41002 1116
donatien 0:8e01dca41002 1117 len = strlen(secbuf);
donatien 0:8e01dca41002 1118 if (len > MAXSECRETLEN) {
donatien 0:8e01dca41002 1119 AUTHDEBUG(LOG_ERR, ("Secret for %s on %s is too long\n", client, server));
donatien 0:8e01dca41002 1120 len = MAXSECRETLEN;
donatien 0:8e01dca41002 1121 }
donatien 0:8e01dca41002 1122
donatien 0:8e01dca41002 1123 BCOPY(secbuf, secret, len);
donatien 0:8e01dca41002 1124 BZERO(secbuf, sizeof(secbuf));
donatien 0:8e01dca41002 1125 *secret_len = len;
donatien 0:8e01dca41002 1126
donatien 0:8e01dca41002 1127 return 1;
donatien 0:8e01dca41002 1128 #endif
donatien 0:8e01dca41002 1129 }
donatien 0:8e01dca41002 1130 #endif /* CHAP_SUPPORT */
donatien 0:8e01dca41002 1131
donatien 0:8e01dca41002 1132
donatien 0:8e01dca41002 1133 #if 0 /* PAP_SUPPORT || CHAP_SUPPORT */
donatien 0:8e01dca41002 1134 /*
donatien 0:8e01dca41002 1135 * set_allowed_addrs() - set the list of allowed addresses.
donatien 0:8e01dca41002 1136 */
donatien 0:8e01dca41002 1137 static void
donatien 0:8e01dca41002 1138 set_allowed_addrs(int unit, struct wordlist *addrs)
donatien 0:8e01dca41002 1139 {
donatien 0:8e01dca41002 1140 if (addresses[unit] != NULL) {
donatien 0:8e01dca41002 1141 free_wordlist(addresses[unit]);
donatien 0:8e01dca41002 1142 }
donatien 0:8e01dca41002 1143 addresses[unit] = addrs;
donatien 0:8e01dca41002 1144
donatien 0:8e01dca41002 1145 #if 0
donatien 0:8e01dca41002 1146 /*
donatien 0:8e01dca41002 1147 * If there's only one authorized address we might as well
donatien 0:8e01dca41002 1148 * ask our peer for that one right away
donatien 0:8e01dca41002 1149 */
donatien 0:8e01dca41002 1150 if (addrs != NULL && addrs->next == NULL) {
donatien 0:8e01dca41002 1151 char *p = addrs->word;
donatien 0:8e01dca41002 1152 struct ipcp_options *wo = &ipcp_wantoptions[unit];
donatien 0:8e01dca41002 1153 u32_t a;
donatien 0:8e01dca41002 1154 struct hostent *hp;
donatien 0:8e01dca41002 1155
donatien 0:8e01dca41002 1156 if (wo->hisaddr == 0 && *p != '!' && *p != '-' && strchr(p, '/') == NULL) {
donatien 0:8e01dca41002 1157 hp = gethostbyname(p);
donatien 0:8e01dca41002 1158 if (hp != NULL && hp->h_addrtype == AF_INET) {
donatien 0:8e01dca41002 1159 a = *(u32_t *)hp->h_addr;
donatien 0:8e01dca41002 1160 } else {
donatien 0:8e01dca41002 1161 a = inet_addr(p);
donatien 0:8e01dca41002 1162 }
donatien 0:8e01dca41002 1163 if (a != (u32_t) -1) {
donatien 0:8e01dca41002 1164 wo->hisaddr = a;
donatien 0:8e01dca41002 1165 }
donatien 0:8e01dca41002 1166 }
donatien 0:8e01dca41002 1167 }
donatien 0:8e01dca41002 1168 #endif
donatien 0:8e01dca41002 1169 }
donatien 0:8e01dca41002 1170 #endif /* 0 */ /* PAP_SUPPORT || CHAP_SUPPORT */
donatien 0:8e01dca41002 1171
donatien 0:8e01dca41002 1172 /*
donatien 0:8e01dca41002 1173 * auth_ip_addr - check whether the peer is authorized to use
donatien 0:8e01dca41002 1174 * a given IP address. Returns 1 if authorized, 0 otherwise.
donatien 0:8e01dca41002 1175 */
donatien 0:8e01dca41002 1176 int
donatien 0:8e01dca41002 1177 auth_ip_addr(int unit, u32_t addr)
donatien 0:8e01dca41002 1178 {
donatien 0:8e01dca41002 1179 return ip_addr_check(addr, addresses[unit]);
donatien 0:8e01dca41002 1180 }
donatien 0:8e01dca41002 1181
donatien 0:8e01dca41002 1182 static int /* @todo: integrate this funtion into auth_ip_addr()*/
donatien 0:8e01dca41002 1183 ip_addr_check(u32_t addr, struct wordlist *addrs)
donatien 0:8e01dca41002 1184 {
donatien 0:8e01dca41002 1185 /* don't allow loopback or multicast address */
donatien 0:8e01dca41002 1186 if (bad_ip_adrs(addr)) {
donatien 0:8e01dca41002 1187 return 0;
donatien 0:8e01dca41002 1188 }
donatien 0:8e01dca41002 1189
donatien 0:8e01dca41002 1190 if (addrs == NULL) {
donatien 0:8e01dca41002 1191 return !ppp_settings.auth_required; /* no addresses authorized */
donatien 0:8e01dca41002 1192 }
donatien 0:8e01dca41002 1193
donatien 0:8e01dca41002 1194 /* XXX All other addresses allowed. */
donatien 0:8e01dca41002 1195 return 1;
donatien 0:8e01dca41002 1196 }
donatien 0:8e01dca41002 1197
donatien 0:8e01dca41002 1198 /*
donatien 0:8e01dca41002 1199 * bad_ip_adrs - return 1 if the IP address is one we don't want
donatien 0:8e01dca41002 1200 * to use, such as an address in the loopback net or a multicast address.
donatien 0:8e01dca41002 1201 * addr is in network byte order.
donatien 0:8e01dca41002 1202 */
donatien 0:8e01dca41002 1203 int
donatien 0:8e01dca41002 1204 bad_ip_adrs(u32_t addr)
donatien 0:8e01dca41002 1205 {
donatien 0:8e01dca41002 1206 addr = ntohl(addr);
donatien 0:8e01dca41002 1207 return (addr >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET
donatien 0:8e01dca41002 1208 || IN_MULTICAST(addr) || IN_BADCLASS(addr);
donatien 0:8e01dca41002 1209 }
donatien 0:8e01dca41002 1210
donatien 0:8e01dca41002 1211 #if 0 /* UNUSED */ /* PAP_SUPPORT || CHAP_SUPPORT */
donatien 0:8e01dca41002 1212 /*
donatien 0:8e01dca41002 1213 * some_ip_ok - check a wordlist to see if it authorizes any
donatien 0:8e01dca41002 1214 * IP address(es).
donatien 0:8e01dca41002 1215 */
donatien 0:8e01dca41002 1216 static int
donatien 0:8e01dca41002 1217 some_ip_ok(struct wordlist *addrs)
donatien 0:8e01dca41002 1218 {
donatien 0:8e01dca41002 1219 for (; addrs != 0; addrs = addrs->next) {
donatien 0:8e01dca41002 1220 if (addrs->word[0] == '-')
donatien 0:8e01dca41002 1221 break;
donatien 0:8e01dca41002 1222 if (addrs->word[0] != '!')
donatien 0:8e01dca41002 1223 return 1; /* some IP address is allowed */
donatien 0:8e01dca41002 1224 }
donatien 0:8e01dca41002 1225 return 0;
donatien 0:8e01dca41002 1226 }
donatien 0:8e01dca41002 1227
donatien 0:8e01dca41002 1228 /*
donatien 0:8e01dca41002 1229 * check_access - complain if a secret file has too-liberal permissions.
donatien 0:8e01dca41002 1230 */
donatien 0:8e01dca41002 1231 static void
donatien 0:8e01dca41002 1232 check_access(FILE *f, char *filename)
donatien 0:8e01dca41002 1233 {
donatien 0:8e01dca41002 1234 struct stat sbuf;
donatien 0:8e01dca41002 1235
donatien 0:8e01dca41002 1236 if (fstat(fileno(f), &sbuf) < 0) {
donatien 0:8e01dca41002 1237 warn("cannot stat secret file %s: %m", filename);
donatien 0:8e01dca41002 1238 } else if ((sbuf.st_mode & (S_IRWXG | S_IRWXO)) != 0) {
donatien 0:8e01dca41002 1239 warn("Warning - secret file %s has world and/or group access",
donatien 0:8e01dca41002 1240 filename);
donatien 0:8e01dca41002 1241 }
donatien 0:8e01dca41002 1242 }
donatien 0:8e01dca41002 1243
donatien 0:8e01dca41002 1244
donatien 0:8e01dca41002 1245 /*
donatien 0:8e01dca41002 1246 * scan_authfile - Scan an authorization file for a secret suitable
donatien 0:8e01dca41002 1247 * for authenticating `client' on `server'. The return value is -1
donatien 0:8e01dca41002 1248 * if no secret is found, otherwise >= 0. The return value has
donatien 0:8e01dca41002 1249 * NONWILD_CLIENT set if the secret didn't have "*" for the client, and
donatien 0:8e01dca41002 1250 * NONWILD_SERVER set if the secret didn't have "*" for the server.
donatien 0:8e01dca41002 1251 * Any following words on the line up to a "--" (i.e. address authorization
donatien 0:8e01dca41002 1252 * info) are placed in a wordlist and returned in *addrs. Any
donatien 0:8e01dca41002 1253 * following words (extra options) are placed in a wordlist and
donatien 0:8e01dca41002 1254 * returned in *opts.
donatien 0:8e01dca41002 1255 * We assume secret is NULL or points to MAXWORDLEN bytes of space.
donatien 0:8e01dca41002 1256 */
donatien 0:8e01dca41002 1257 static int
donatien 0:8e01dca41002 1258 scan_authfile(FILE *f, char *client, char *server, char *secret, struct wordlist **addrs, struct wordlist **opts, char *filename)
donatien 0:8e01dca41002 1259 {
donatien 0:8e01dca41002 1260 /* We do not (currently) need this in lwip */
donatien 0:8e01dca41002 1261 return 0; /* dummy */
donatien 0:8e01dca41002 1262 }
donatien 0:8e01dca41002 1263 /*
donatien 0:8e01dca41002 1264 * free_wordlist - release memory allocated for a wordlist.
donatien 0:8e01dca41002 1265 */
donatien 0:8e01dca41002 1266 static void
donatien 0:8e01dca41002 1267 free_wordlist(struct wordlist *wp)
donatien 0:8e01dca41002 1268 {
donatien 0:8e01dca41002 1269 struct wordlist *next;
donatien 0:8e01dca41002 1270
donatien 0:8e01dca41002 1271 while (wp != NULL) {
donatien 0:8e01dca41002 1272 next = wp->next;
donatien 0:8e01dca41002 1273 free(wp);
donatien 0:8e01dca41002 1274 wp = next;
donatien 0:8e01dca41002 1275 }
donatien 0:8e01dca41002 1276 }
donatien 0:8e01dca41002 1277
donatien 0:8e01dca41002 1278 /*
donatien 0:8e01dca41002 1279 * auth_script_done - called when the auth-up or auth-down script
donatien 0:8e01dca41002 1280 * has finished.
donatien 0:8e01dca41002 1281 */
donatien 0:8e01dca41002 1282 static void
donatien 0:8e01dca41002 1283 auth_script_done(void *arg)
donatien 0:8e01dca41002 1284 {
donatien 0:8e01dca41002 1285 auth_script_pid = 0;
donatien 0:8e01dca41002 1286 switch (auth_script_state) {
donatien 0:8e01dca41002 1287 case s_up:
donatien 0:8e01dca41002 1288 if (auth_state == s_down) {
donatien 0:8e01dca41002 1289 auth_script_state = s_down;
donatien 0:8e01dca41002 1290 auth_script(_PATH_AUTHDOWN);
donatien 0:8e01dca41002 1291 }
donatien 0:8e01dca41002 1292 break;
donatien 0:8e01dca41002 1293 case s_down:
donatien 0:8e01dca41002 1294 if (auth_state == s_up) {
donatien 0:8e01dca41002 1295 auth_script_state = s_up;
donatien 0:8e01dca41002 1296 auth_script(_PATH_AUTHUP);
donatien 0:8e01dca41002 1297 }
donatien 0:8e01dca41002 1298 break;
donatien 0:8e01dca41002 1299 }
donatien 0:8e01dca41002 1300 }
donatien 0:8e01dca41002 1301
donatien 0:8e01dca41002 1302 /*
donatien 0:8e01dca41002 1303 * auth_script - execute a script with arguments
donatien 0:8e01dca41002 1304 * interface-name peer-name real-user tty speed
donatien 0:8e01dca41002 1305 */
donatien 0:8e01dca41002 1306 static void
donatien 0:8e01dca41002 1307 auth_script(char *script)
donatien 0:8e01dca41002 1308 {
donatien 0:8e01dca41002 1309 char strspeed[32];
donatien 0:8e01dca41002 1310 struct passwd *pw;
donatien 0:8e01dca41002 1311 char struid[32];
donatien 0:8e01dca41002 1312 char *user_name;
donatien 0:8e01dca41002 1313 char *argv[8];
donatien 0:8e01dca41002 1314
donatien 0:8e01dca41002 1315 if ((pw = getpwuid(getuid())) != NULL && pw->pw_name != NULL)
donatien 0:8e01dca41002 1316 user_name = pw->pw_name;
donatien 0:8e01dca41002 1317 else {
donatien 0:8e01dca41002 1318 slprintf(struid, sizeof(struid), "%d", getuid());
donatien 0:8e01dca41002 1319 user_name = struid;
donatien 0:8e01dca41002 1320 }
donatien 0:8e01dca41002 1321 slprintf(strspeed, sizeof(strspeed), "%d", baud_rate);
donatien 0:8e01dca41002 1322
donatien 0:8e01dca41002 1323 argv[0] = script;
donatien 0:8e01dca41002 1324 argv[1] = ifname;
donatien 0:8e01dca41002 1325 argv[2] = peer_authname;
donatien 0:8e01dca41002 1326 argv[3] = user_name;
donatien 0:8e01dca41002 1327 argv[4] = devnam;
donatien 0:8e01dca41002 1328 argv[5] = strspeed;
donatien 0:8e01dca41002 1329 argv[6] = NULL;
donatien 0:8e01dca41002 1330
donatien 0:8e01dca41002 1331 auth_script_pid = run_program(script, argv, 0, auth_script_done, NULL);
donatien 0:8e01dca41002 1332 }
donatien 0:8e01dca41002 1333 #endif /* 0 */ /* PAP_SUPPORT || CHAP_SUPPORT */
donatien 0:8e01dca41002 1334 #endif /* PPP_SUPPORT */