* WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
*/
-#define RCSID "$Id: auth.c,v 1.60 1999/12/23 01:25:13 paulus Exp $"
+#define RCSID "$Id: auth.c,v 1.69 2001/03/12 22:50:01 paulus Exp $"
#include <stdio.h>
#include <stddef.h>
static enum script_state auth_script_state = s_down;
static pid_t auth_script_pid = 0;
+static int used_login; /* peer authenticated against login database */
+
/*
* Option variables.
*/
bool explicit_remote = 0; /* User specified explicit remote name */
char remote_name[MAXNAMELEN]; /* Peer's name for authentication */
+static char *uafname; /* name of most recent +ua file */
+
/* Bits in auth_pending[] */
#define PAP_WITHPEER 1
#define PAP_PEER 2
static int privgroup __P((char **));
static int set_noauth_addr __P((char **));
static void check_access __P((FILE *, char *));
+static int wordlist_count __P((struct wordlist *));
/*
* Authentication-related options.
*/
option_t auth_options[] = {
+ { "auth", o_bool, &auth_required,
+ "Require authentication from peer", OPT_PRIO | 1 },
+ { "noauth", o_bool, &auth_required,
+ "Don't require peer to authenticate", OPT_PRIOSUB | OPT_PRIV,
+ &allow_any_ip },
{ "require-pap", o_bool, &lcp_wantoptions[0].neg_upap,
- "Require PAP authentication from peer", 1, &auth_required },
+ "Require PAP authentication from peer",
+ OPT_PRIOSUB | 1, &auth_required },
{ "+pap", o_bool, &lcp_wantoptions[0].neg_upap,
- "Require PAP authentication from peer", 1, &auth_required },
+ "Require PAP authentication from peer",
+ OPT_ALIAS | OPT_PRIOSUB | 1, &auth_required },
+ { "require-chap", o_bool, &lcp_wantoptions[0].neg_chap,
+ "Require CHAP authentication from peer",
+ OPT_PRIOSUB | 1, &auth_required },
+ { "+chap", o_bool, &lcp_wantoptions[0].neg_chap,
+ "Require CHAP authentication from peer",
+ OPT_ALIAS | OPT_PRIOSUB | 1, &auth_required },
+
{ "refuse-pap", o_bool, &refuse_pap,
"Don't agree to auth to peer with PAP", 1 },
{ "-pap", o_bool, &refuse_pap,
- "Don't allow PAP authentication with peer", 1 },
- { "require-chap", o_bool, &lcp_wantoptions[0].neg_chap,
- "Require CHAP authentication from peer", 1, &auth_required },
- { "+chap", o_bool, &lcp_wantoptions[0].neg_chap,
- "Require CHAP authentication from peer", 1, &auth_required },
+ "Don't allow PAP authentication with peer", OPT_ALIAS | 1 },
+
{ "refuse-chap", o_bool, &refuse_chap,
"Don't agree to auth to peer with CHAP", 1 },
{ "-chap", o_bool, &refuse_chap,
- "Don't allow CHAP authentication with peer", 1 },
+ "Don't allow CHAP authentication with peer", OPT_ALIAS | 1 },
+
{ "name", o_string, our_name,
"Set local name for authentication",
- OPT_PRIV|OPT_STATIC, NULL, MAXNAMELEN },
+ OPT_PRIO | OPT_PRIV | OPT_STATIC, NULL, MAXNAMELEN },
+
+ { "+ua", o_special, (void *)setupapfile,
+ "Get PAP user and password from file",
+ OPT_PRIO | OPT_A2STRVAL, &uafname },
+
{ "user", o_string, user,
- "Set name for auth with peer", OPT_STATIC, NULL, MAXNAMELEN },
+ "Set name for auth with peer", OPT_PRIO | OPT_STATIC, NULL, MAXNAMELEN },
+
+ { "password", o_string, passwd,
+ "Password for authenticating us to the peer",
+ OPT_PRIO | OPT_STATIC | OPT_HIDE, NULL, MAXSECRETLEN },
+
{ "usehostname", o_bool, &usehostname,
"Must use hostname for authentication", 1 },
+
{ "remotename", o_string, remote_name,
- "Set remote name for authentication", OPT_STATIC,
+ "Set remote name for authentication", OPT_PRIO | OPT_STATIC,
&explicit_remote, MAXNAMELEN },
- { "auth", o_bool, &auth_required,
- "Require authentication from peer", 1 },
- { "noauth", o_bool, &auth_required,
- "Don't require peer to authenticate", OPT_PRIV, &allow_any_ip },
- { "login", o_bool, &uselogin,
+
+ { "login", o_bool, &uselogin,
"Use system password database for PAP", 1 },
+
{ "papcrypt", o_bool, &cryptpap,
"PAP passwords are encrypted", 1 },
- { "+ua", o_special, setupapfile,
- "Get PAP user and password from file" },
- { "password", o_string, passwd,
- "Password for authenticating us to the peer", OPT_STATIC,
- NULL, MAXSECRETLEN },
- { "privgroup", o_special, privgroup,
- "Allow group members to use privileged options", OPT_PRIV },
- { "allow-ip", o_special, set_noauth_addr,
+
+ { "privgroup", o_special, (void *)privgroup,
+ "Allow group members to use privileged options", OPT_PRIV | OPT_A2LIST },
+
+ { "allow-ip", o_special, (void *)set_noauth_addr,
"Set IP address(es) which can be used without authentication",
- OPT_PRIV },
+ OPT_PRIV | OPT_A2LIST },
+
{ NULL }
};
setupapfile(argv)
char **argv;
{
- FILE * ufile;
+ FILE *ufile;
int l;
+ char u[MAXNAMELEN], p[MAXSECRETLEN];
+ char *fname;
lcp_allowoptions[0].neg_upap = 1;
/* open user info file */
+ fname = strdup(*argv);
+ if (fname == NULL)
+ novm("+ua file name");
seteuid(getuid());
- ufile = fopen(*argv, "r");
+ ufile = fopen(fname, "r");
seteuid(0);
if (ufile == NULL) {
- option_error("unable to open user login data file %s", *argv);
+ option_error("unable to open user login data file %s", fname);
return 0;
}
- check_access(ufile, *argv);
+ check_access(ufile, fname);
+ uafname = fname;
/* get username */
- if (fgets(user, MAXNAMELEN - 1, ufile) == NULL
- || fgets(passwd, MAXSECRETLEN - 1, ufile) == NULL){
- option_error("unable to read user login data file %s", *argv);
+ if (fgets(u, MAXNAMELEN - 1, ufile) == NULL
+ || fgets(p, MAXSECRETLEN - 1, ufile) == NULL){
+ option_error("unable to read user login data file %s", fname);
return 0;
}
fclose(ufile);
/* get rid of newlines */
- l = strlen(user);
- if (l > 0 && user[l-1] == '\n')
- user[l-1] = 0;
- l = strlen(passwd);
- if (l > 0 && passwd[l-1] == '\n')
- passwd[l-1] = 0;
+ l = strlen(u);
+ if (l > 0 && u[l-1] == '\n')
+ u[l-1] = 0;
+ l = strlen(p);
+ if (l > 0 && p[l-1] == '\n')
+ p[l-1] = 0;
+
+ if (override_value("user", option_priority, fname))
+ strlcpy(user, u, sizeof(user));
+ if (override_value("passwd", option_priority, fname))
+ strlcpy(passwd, p, sizeof(passwd));
return (1);
}
char **argv;
{
char *addr = *argv;
- int l = strlen(addr);
+ int l = strlen(addr) + 1;
struct wordlist *wp;
- wp = (struct wordlist *) malloc(sizeof(struct wordlist) + l + 1);
+ wp = (struct wordlist *) malloc(sizeof(struct wordlist) + l);
if (wp == NULL)
novm("allow-ip argument");
wp->word = (char *) (wp + 1);
* boot it out.
*/
if (noauth_addrs != NULL) {
- set_allowed_addrs(unit, noauth_addrs, NULL);
- } else if (!wo->neg_upap || !null_login(unit)) {
+ set_allowed_addrs(unit, NULL, NULL);
+ } else if (!wo->neg_upap || uselogin || !null_login(unit)) {
warn("peer refused to authenticate: terminating link");
lcp_close(unit, "peer refused to authenticate");
status = EXIT_PEER_AUTH_FAILED;
}
new_phase(PHASE_AUTHENTICATE);
+ used_login = 0;
auth = 0;
if (go->neg_chap) {
ChapAuthPeer(unit, our_name, go->chap_mdtype);
struct protent *protp;
new_phase(PHASE_NETWORK);
-#if 0
+
+#ifdef HAVE_MULTILINK
+ if (multilink) {
+ if (mp_join_bundle()) {
+ if (updetach && !nodetach)
+ detach();
+ return;
+ }
+ }
+#endif /* HAVE_MULTILINK */
+
+#ifdef PPP_FILTER
if (!demand)
set_filters(&pass_filter, &active_filter);
#endif
namelen = sizeof(peer_authname) - 1;
BCOPY(name, peer_authname, namelen);
peer_authname[namelen] = 0;
- script_setenv("PEERNAME", peer_authname);
+ script_setenv("PEERNAME", peer_authname, 0);
/*
* If there is no more authentication still to be done,
/* If authentication is required, ask peer for CHAP or PAP. */
if (auth_required) {
+ allow_any_ip = 0;
if (!wo->neg_chap && !wo->neg_upap) {
wo->neg_chap = 1;
wo->neg_upap = 1;
check_access(f, filename);
if (scan_authfile(f, user, our_name, secret, &addrs, &opts, filename) < 0) {
warn("no PAP secret found for %s", user);
- } else if (secret[0] != 0) {
- /* password given in pap-secrets - must match */
- if ((!cryptpap && strcmp(passwd, secret) == 0)
- || strcmp(crypt(passwd, secret), secret) == 0)
- ret = UPAP_AUTHACK;
- else
- warn("PAP authentication failure for %s", user);
- } else if (uselogin) {
- /* empty password in pap-secrets and login option */
- ret = plogin(user, passwd, msg);
- if (ret == UPAP_AUTHNAK)
- warn("PAP login failure for %s", user);
} else {
- /* empty password in pap-secrets and login option not used */
+ /*
+ * If the secret is "@login", it means to check
+ * the password against the login database.
+ */
+ int login_secret = strcmp(secret, "@login") == 0;
ret = UPAP_AUTHACK;
+ if (uselogin || login_secret) {
+ /* login option or secret is @login */
+ ret = plogin(user, passwd, msg);
+ if (ret == UPAP_AUTHNAK)
+ warn("PAP login failure for %s", user);
+ else
+ used_login = 1;
+ }
+ if (secret[0] != 0 && !login_secret) {
+ /* password given in pap-secrets - must match */
+ if ((cryptpap || strcmp(passwd, secret) != 0)
+ && strcmp(crypt(passwd, secret), secret) != 0) {
+ ret = UPAP_AUTHNAK;
+ warn("PAP authentication failure for %s", user);
+ }
+ }
}
fclose(f);
}
struct wordlist *opts;
{
int n;
- struct wordlist *ap, **pap;
+ struct wordlist *ap, **plink;
struct permitted_ip *ip;
char *ptr_word, *ptr_mask;
struct hostent *hp;
/*
* Count the number of IP addresses given.
*/
- for (n = 0, pap = &addrs; (ap = *pap) != NULL; pap = &ap->next)
- ++n;
+ n = wordlist_count(addrs) + wordlist_count(noauth_addrs);
if (n == 0)
return;
ip = (struct permitted_ip *) malloc((n + 1) * sizeof(struct permitted_ip));
if (ip == 0)
return;
+ /* temporarily append the noauth_addrs list to addrs */
+ for (plink = &addrs; *plink != NULL; plink = &(*plink)->next)
+ ;
+ *plink = noauth_addrs;
+
n = 0;
for (ap = addrs; ap != NULL; ap = ap->next) {
/* "-" means no addresses authorized, "*" means any address allowed */
if (~mask == 0 && suggested_ip == 0)
suggested_ip = a;
}
+ *plink = NULL;
ip[n].permit = 0; /* make the last entry forbid all addresses */
ip[n].base = 0; /* to terminate the list */
* which is a single host, then use that if we find one.
*/
if (suggested_ip != 0
- && (wo->hisaddr == 0 || !auth_ip_addr(unit, wo->hisaddr)))
+ && (wo->hisaddr == 0 || !auth_ip_addr(unit, wo->hisaddr))) {
wo->hisaddr = suggested_ip;
+ /*
+ * Do we insist on this address? No, if there are other
+ * addresses authorized than the suggested one.
+ */
+ if (n > 1)
+ wo->accept_remote = 1;
+ }
}
/*
}
if (auth_required)
return 0; /* no addresses authorized */
- return allow_any_ip || !have_route_to(addr);
+ return allow_any_ip || privileged || !have_route_to(addr);
}
static int
if (newline)
continue;
- /*
- * Special syntax: @filename means read secret from file.
- */
- if (word[0] == '@') {
- strlcpy(atfile, word+1, sizeof(atfile));
- if ((sf = fopen(atfile, "r")) == NULL) {
- warn("can't open indirect secret file %s", atfile);
- continue;
- }
- check_access(sf, atfile);
- if (!getword(sf, word, &xxx, atfile)) {
- warn("no secret in indirect secret file %s", atfile);
+ if (secret != NULL) {
+ /*
+ * Special syntax: @/pathname means read secret from file.
+ */
+ if (word[0] == '@' && word[1] == '/') {
+ strlcpy(atfile, word+1, sizeof(atfile));
+ if ((sf = fopen(atfile, "r")) == NULL) {
+ warn("can't open indirect secret file %s", atfile);
+ continue;
+ }
+ check_access(sf, atfile);
+ if (!getword(sf, word, &xxx, atfile)) {
+ warn("no secret in indirect secret file %s", atfile);
+ fclose(sf);
+ continue;
+ }
fclose(sf);
- continue;
}
- fclose(sf);
- }
- if (secret != NULL)
strlcpy(lsecret, word, sizeof(lsecret));
+ }
/*
* Now read address authorization info and make a wordlist.
for (;;) {
if (!getword(f, word, &newline, filename) || newline)
break;
- ap = (struct wordlist *) malloc(sizeof(struct wordlist));
+ ap = (struct wordlist *)
+ malloc(sizeof(struct wordlist) + strlen(word) + 1);
if (ap == NULL)
novm("authorized addresses");
- ap->word = strdup(word);
- if (ap->word == NULL)
- novm("authorized addresses");
+ ap->word = (char *) (ap + 1);
+ strcpy(ap->word, word);
*app = ap;
app = &ap->next;
}
return best_flag;
}
+/*
+ * wordlist_count - return the number of items in a wordlist
+ */
+static int
+wordlist_count(wp)
+ struct wordlist *wp;
+{
+ int n;
+
+ for (n = 0; wp != NULL; wp = wp->next)
+ ++n;
+ return n;
+}
+
/*
* free_wordlist - release memory allocated for a wordlist.
*/