2 * upap.c - User/Password Authentication Protocol.
4 * Copyright (c) 1984-2000 Carnegie Mellon University. All rights reserved.
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in
15 * the documentation and/or other materials provided with the
18 * 3. The name "Carnegie Mellon University" must not be used to
19 * endorse or promote products derived from this software without
20 * prior written permission. For permission or any legal
21 * details, please contact
22 * Office of Technology Transfer
23 * Carnegie Mellon University
25 * Pittsburgh, PA 15213-3890
26 * (412) 268-4387, fax: (412) 268-7395
27 * tech-transfer@andrew.cmu.edu
29 * 4. Redistributions of any form whatsoever must retain the following
31 * "This product includes software developed by Computing Services
32 * at Carnegie Mellon University (http://www.cmu.edu/computing/)."
34 * CARNEGIE MELLON UNIVERSITY DISCLAIMS ALL WARRANTIES WITH REGARD TO
35 * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
36 * AND FITNESS, IN NO EVENT SHALL CARNEGIE MELLON UNIVERSITY BE LIABLE
37 * FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
38 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
39 * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
40 * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
54 #include "pppd-private.h"
59 static bool hide_password = 1;
62 * Command-line options.
64 static struct option pap_option_list[] = {
65 { "hide-password", o_bool, &hide_password,
66 "Don't output passwords to log", OPT_PRIO | 1 },
67 { "show-password", o_bool, &hide_password,
68 "Show password string in debug log messages", OPT_PRIOSUB | 0 },
70 { "pap-restart", o_int, &upap[0].us_timeouttime,
71 "Set retransmit timeout for PAP", OPT_PRIO },
72 { "pap-max-authreq", o_int, &upap[0].us_maxtransmits,
73 "Set max number of transmissions for auth-reqs", OPT_PRIO },
74 { "pap-timeout", o_int, &upap[0].us_reqtimeout,
75 "Set time limit for peer PAP authentication", OPT_PRIO },
81 * Protocol entry points.
83 static void upap_init(int);
84 static void upap_lowerup(int);
85 static void upap_lowerdown(int);
86 static void upap_input(int, u_char *, int);
87 static void upap_protrej(int);
88 static int upap_printpkt(u_char *, int,
89 void (*)(void *, char *, ...), void *);
91 struct protent pap_protent = {
111 upap_state upap[NUM_PPP]; /* UPAP state; one for each unit */
113 static void upap_timeout(void *);
114 static void upap_reqtimeout(void *);
115 static void upap_rauthreq(upap_state *, u_char *, int, int);
116 static void upap_rauthack(upap_state *, u_char *, int, int);
117 static void upap_rauthnak(upap_state *, u_char *, int, int);
118 static void upap_sauthreq(upap_state *);
119 static void upap_sresp(upap_state *, int, int, char *, int);
123 * upap_init - Initialize a UPAP unit.
128 upap_state *u = &upap[unit];
135 u->us_clientstate = UPAPCS_INITIAL;
136 u->us_serverstate = UPAPSS_INITIAL;
138 u->us_timeouttime = UPAP_DEFTIMEOUT;
139 u->us_maxtransmits = 10;
140 u->us_reqtimeout = UPAP_DEFREQTIME;
145 * upap_authwithpeer - Authenticate us with our peer (start client).
147 * Set new state and send authenticate's.
150 upap_authwithpeer(int unit, char *user, char *password)
152 upap_state *u = &upap[unit];
154 /* Save the username and password we're given */
156 u->us_userlen = strlen(user);
157 u->us_passwd = password;
158 u->us_passwdlen = strlen(password);
161 /* Lower layer up yet? */
162 if (u->us_clientstate == UPAPCS_INITIAL ||
163 u->us_clientstate == UPAPCS_PENDING) {
164 u->us_clientstate = UPAPCS_PENDING;
168 upap_sauthreq(u); /* Start protocol */
173 * upap_authpeer - Authenticate our peer (start server).
178 upap_authpeer(int unit)
180 upap_state *u = &upap[unit];
182 /* Lower layer up yet? */
183 if (u->us_serverstate == UPAPSS_INITIAL ||
184 u->us_serverstate == UPAPSS_PENDING) {
185 u->us_serverstate = UPAPSS_PENDING;
189 u->us_serverstate = UPAPSS_LISTEN;
190 if (u->us_reqtimeout > 0)
191 TIMEOUT(upap_reqtimeout, u, u->us_reqtimeout);
196 * upap_timeout - Retransmission timer for sending auth-reqs expired.
199 upap_timeout(void *arg)
201 upap_state *u = (upap_state *) arg;
203 if (u->us_clientstate != UPAPCS_AUTHREQ)
206 if (u->us_transmits >= u->us_maxtransmits) {
207 /* give up in disgust */
208 error("No response to PAP authenticate-requests");
209 u->us_clientstate = UPAPCS_BADAUTH;
210 auth_withpeer_fail(u->us_unit, PPP_PAP);
214 upap_sauthreq(u); /* Send Authenticate-Request */
219 * upap_reqtimeout - Give up waiting for the peer to send an auth-req.
222 upap_reqtimeout(void *arg)
224 upap_state *u = (upap_state *) arg;
226 if (u->us_serverstate != UPAPSS_LISTEN)
229 auth_peer_fail(u->us_unit, PPP_PAP);
230 u->us_serverstate = UPAPSS_BADAUTH;
235 * upap_lowerup - The lower layer is up.
237 * Start authenticating if pending.
240 upap_lowerup(int unit)
242 upap_state *u = &upap[unit];
244 if (u->us_clientstate == UPAPCS_INITIAL)
245 u->us_clientstate = UPAPCS_CLOSED;
246 else if (u->us_clientstate == UPAPCS_PENDING) {
247 upap_sauthreq(u); /* send an auth-request */
250 if (u->us_serverstate == UPAPSS_INITIAL)
251 u->us_serverstate = UPAPSS_CLOSED;
252 else if (u->us_serverstate == UPAPSS_PENDING) {
253 u->us_serverstate = UPAPSS_LISTEN;
254 if (u->us_reqtimeout > 0)
255 TIMEOUT(upap_reqtimeout, u, u->us_reqtimeout);
261 * upap_lowerdown - The lower layer is down.
263 * Cancel all timeouts.
266 upap_lowerdown(int unit)
268 upap_state *u = &upap[unit];
270 if (u->us_clientstate == UPAPCS_AUTHREQ) /* Timeout pending? */
271 UNTIMEOUT(upap_timeout, u); /* Cancel timeout */
272 if (u->us_serverstate == UPAPSS_LISTEN && u->us_reqtimeout > 0)
273 UNTIMEOUT(upap_reqtimeout, u);
275 u->us_clientstate = UPAPCS_INITIAL;
276 u->us_serverstate = UPAPSS_INITIAL;
281 * upap_protrej - Peer doesn't speak this protocol.
283 * This shouldn't happen. In any case, pretend lower layer went down.
286 upap_protrej(int unit)
288 upap_state *u = &upap[unit];
290 if (u->us_clientstate == UPAPCS_AUTHREQ) {
291 error("PAP authentication failed due to protocol-reject");
292 auth_withpeer_fail(unit, PPP_PAP);
294 if (u->us_serverstate == UPAPSS_LISTEN) {
295 error("PAP authentication of peer failed (protocol-reject)");
296 auth_peer_fail(unit, PPP_PAP);
298 upap_lowerdown(unit);
303 * upap_input - Input UPAP packet.
306 upap_input(int unit, u_char *inpacket, int l)
308 upap_state *u = &upap[unit];
314 * Parse header (code, id and length).
315 * If packet too short, drop it.
318 if (l < UPAP_HEADERLEN) {
319 UPAPDEBUG(("pap_input: rcvd short header."));
325 if (len < UPAP_HEADERLEN) {
326 UPAPDEBUG(("pap_input: rcvd illegal length."));
330 UPAPDEBUG(("pap_input: rcvd short packet."));
333 len -= UPAP_HEADERLEN;
336 * Action depends on code.
340 upap_rauthreq(u, inp, id, len);
344 upap_rauthack(u, inp, id, len);
348 upap_rauthnak(u, inp, id, len);
351 default: /* XXX Need code reject */
358 * upap_rauth - Receive Authenticate.
361 upap_rauthreq(upap_state *u, u_char *inp, int id, int len)
363 u_char ruserlen, rpasswdlen;
364 char *ruser, *rpasswd;
370 if (u->us_serverstate < UPAPSS_LISTEN)
374 * If we receive a duplicate authenticate-request, we are
375 * supposed to return the same status as for the first request.
377 if (u->us_serverstate == UPAPSS_OPEN) {
378 upap_sresp(u, UPAP_AUTHACK, id, "", 0); /* return auth-ack */
381 if (u->us_serverstate == UPAPSS_BADAUTH) {
382 upap_sresp(u, UPAP_AUTHNAK, id, "", 0); /* return auth-nak */
390 UPAPDEBUG(("pap_rauth: rcvd short packet."));
393 GETCHAR(ruserlen, inp);
394 len -= sizeof (u_char) + ruserlen + sizeof (u_char);
396 UPAPDEBUG(("pap_rauth: rcvd short packet."));
399 ruser = (char *) inp;
400 INCPTR(ruserlen, inp);
401 GETCHAR(rpasswdlen, inp);
402 if (len < rpasswdlen) {
403 UPAPDEBUG(("pap_rauth: rcvd short packet."));
406 rpasswd = (char *) inp;
409 * Check the username and password given.
411 retcode = check_passwd(u->us_unit, ruser, ruserlen, rpasswd,
413 BZERO(rpasswd, rpasswdlen);
416 * Check remote number authorization. A plugin may have filled in
417 * the remote number or added an allowed number, and rather than
418 * return an authenticate failure, is leaving it for us to verify.
420 if (retcode == UPAP_AUTHACK) {
421 if (!auth_number()) {
422 /* We do not want to leak info about the pap result. */
423 retcode = UPAP_AUTHNAK; /* XXX exit value will be "wrong" */
424 warn("calling number %q is not authorized", remote_number);
428 msglen = strlen(msg);
431 upap_sresp(u, retcode, id, msg, msglen);
433 /* Null terminate and clean remote name. */
434 slprintf(rhostname, sizeof(rhostname), "%.*v", ruserlen, ruser);
436 if (retcode == UPAP_AUTHACK) {
437 u->us_serverstate = UPAPSS_OPEN;
438 notice("PAP peer authentication succeeded for %q", rhostname);
439 auth_peer_success(u->us_unit, PPP_PAP, 0, ruser, ruserlen);
441 u->us_serverstate = UPAPSS_BADAUTH;
442 warn("PAP peer authentication failed for %q", rhostname);
443 auth_peer_fail(u->us_unit, PPP_PAP);
446 if (u->us_reqtimeout > 0)
447 UNTIMEOUT(upap_reqtimeout, u);
452 * upap_rauthack - Receive Authenticate-Ack.
455 upap_rauthack(upap_state *u, u_char *inp, int id, int len)
460 if (u->us_clientstate != UPAPCS_AUTHREQ) /* XXX */
467 UPAPDEBUG(("pap_rauthack: ignoring missing msg-length."));
469 GETCHAR(msglen, inp);
471 len -= sizeof (u_char);
473 UPAPDEBUG(("pap_rauthack: rcvd short packet."));
477 PRINTMSG(msg, msglen);
481 u->us_clientstate = UPAPCS_OPEN;
483 auth_withpeer_success(u->us_unit, PPP_PAP, 0);
488 * upap_rauthnak - Receive Authenticate-Nak.
491 upap_rauthnak(upap_state *u, u_char *inp, int id, int len)
496 if (u->us_clientstate != UPAPCS_AUTHREQ) /* XXX */
503 UPAPDEBUG(("pap_rauthnak: ignoring missing msg-length."));
505 GETCHAR(msglen, inp);
507 len -= sizeof (u_char);
509 UPAPDEBUG(("pap_rauthnak: rcvd short packet."));
513 PRINTMSG(msg, msglen);
517 u->us_clientstate = UPAPCS_BADAUTH;
519 error("PAP authentication failed");
520 auth_withpeer_fail(u->us_unit, PPP_PAP);
525 * upap_sauthreq - Send an Authenticate-Request.
528 upap_sauthreq(upap_state *u)
533 outlen = UPAP_HEADERLEN + 2 * sizeof (u_char) +
534 u->us_userlen + u->us_passwdlen;
535 outp = outpacket_buf;
537 MAKEHEADER(outp, PPP_PAP);
539 PUTCHAR(UPAP_AUTHREQ, outp);
540 PUTCHAR(++u->us_id, outp);
541 PUTSHORT(outlen, outp);
542 PUTCHAR(u->us_userlen, outp);
543 BCOPY(u->us_user, outp, u->us_userlen);
544 INCPTR(u->us_userlen, outp);
545 PUTCHAR(u->us_passwdlen, outp);
546 BCOPY(u->us_passwd, outp, u->us_passwdlen);
548 output(u->us_unit, outpacket_buf, outlen + PPP_HDRLEN);
550 TIMEOUT(upap_timeout, u, u->us_timeouttime);
552 u->us_clientstate = UPAPCS_AUTHREQ;
557 * upap_sresp - Send a response (ack or nak).
560 upap_sresp(upap_state *u, int code, int id, char *msg, int msglen)
565 outlen = UPAP_HEADERLEN + sizeof (u_char) + msglen;
566 outp = outpacket_buf;
567 MAKEHEADER(outp, PPP_PAP);
571 PUTSHORT(outlen, outp);
572 PUTCHAR(msglen, outp);
573 BCOPY(msg, outp, msglen);
574 output(u->us_unit, outpacket_buf, outlen + PPP_HDRLEN);
578 * upap_printpkt - print the contents of a PAP packet.
580 static char *upap_codenames[] = {
581 "AuthReq", "AuthAck", "AuthNak"
585 upap_printpkt(u_char *p, int plen, void (*printer)(void *, char *, ...), void *arg)
588 int mlen, ulen, wlen;
589 char *user, *pwd, *msg;
592 if (plen < UPAP_HEADERLEN)
598 if (len < UPAP_HEADERLEN || len > plen)
601 if (code >= 1 && code <= sizeof(upap_codenames) / sizeof(char *))
602 printer(arg, " %s", upap_codenames[code-1]);
604 printer(arg, " code=0x%x", code);
605 printer(arg, " id=0x%x", id);
606 len -= UPAP_HEADERLEN;
615 if (len < ulen + wlen + 2)
617 user = (char *) (p + 1);
618 pwd = (char *) (p + ulen + 2);
619 p += ulen + wlen + 2;
620 len -= ulen + wlen + 2;
621 printer(arg, " user=");
622 print_string(user, ulen, printer, arg);
623 printer(arg, " password=");
625 print_string(pwd, wlen, printer, arg);
627 printer(arg, "<hidden>");
636 msg = (char *) (p + 1);
640 print_string(msg, mlen, printer, arg);
644 /* print the rest of the bytes in the packet */
645 for (; len > 0; --len) {
647 printer(arg, " %.2x", code);