Don't ask for CHAP if we don't have any digests to use.

[ppp.git] / pppd / auth.c

diff --git a/pppd/auth.c b/pppd/auth.c
index a92d9e93be1869de4a0687c1a0dfd019718414d8..b9115b943757ea13250701a35bdd57fbff8c1c84 100644 (file)
--- a/pppd/auth.c
+++ b/pppd/auth.c
@@ -10,16 +10,11 @@
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. The name(s) of the authors of this software must not be used to
+ * 2. The name(s) of the authors of this software must not be used to
  *    endorse or promote products derived from this software without
  *    prior written permission.
  *
- * 4. Redistributions of any form whatsoever must retain the following
+ * 3. Redistributions of any form whatsoever must retain the following
  *    acknowledgment:
  *    "This product includes software developed by Paul Mackerras
  *     <paulus@samba.org>".
@@ -73,7 +68,7 @@
  * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#define RCSID  "$Id: auth.c,v 1.91 2003/02/16 22:25:49 paulus Exp $"
+#define RCSID  "$Id: auth.c,v 1.100 2004/11/06 05:39:23 paulus Exp $"
 
 #include <stdio.h>
 #include <stddef.h>
@@ -114,7 +109,7 @@
 #include "ecp.h"
 #include "ipcp.h"
 #include "upap.h"
-#include "chap.h"
+#include "chap-new.h"
 #include "eap.h"
 #ifdef CBCP_SUPPORT
 #include "cbcp.h"
@@ -186,6 +181,12 @@ void (*pap_logout_hook) __P((void)) = NULL;
 /* Hook for a plugin to get the PAP password for authenticating us */
 int (*pap_passwd_hook) __P((char *user, char *passwd)) = NULL;
 
+/* Hook for a plugin to say if we can possibly authenticate a peer using CHAP */
+int (*chap_check_hook) __P((void)) = NULL;
+
+/* Hook for a plugin to get the CHAP password for authenticating us */
+int (*chap_passwd_hook) __P((char *user, char *passwd)) = NULL;
+
 /* Hook for a plugin to say whether it is OK if the peer
    refuses to authenticate. */
 int (*null_auth_hook) __P((struct wordlist **paddrs,
@@ -428,7 +429,8 @@ setupapfile(argv)
 
     /* get username */
     if (fgets(u, MAXNAMELEN - 1, ufile) == NULL
-       || fgets(p, MAXSECRETLEN - 1, ufile) == NULL){
+       || fgets(p, MAXSECRETLEN - 1, ufile) == NULL) {
+       fclose(ufile);
        option_error("unable to read user login data file %s", fname);
        return 0;
     }
@@ -606,7 +608,7 @@ link_established(unit)
            (*protp->lowerup)(unit);
 
     if (!auth_required && noauth_addrs != NULL)
-       set_allowed_addrs(unit, NULL, NULL)
+       set_allowed_addrs(unit, NULL, NULL);
 
     if (auth_required && !(go->neg_upap || go->neg_chap || go->neg_eap)) {
        /*
@@ -633,7 +635,7 @@ link_established(unit)
        eap_authpeer(unit, our_name);
        auth |= EAP_PEER;
     } else if (go->neg_chap) {
-       ChapAuthPeer(unit, our_name, CHAP_DIGEST(go->chap_mdtype));
+       chap_auth_peer(unit, our_name, CHAP_DIGEST(go->chap_mdtype));
        auth |= CHAP_PEER;
     } else if (go->neg_upap) {
        upap_authpeer(unit);
@@ -643,7 +645,7 @@ link_established(unit)
        eap_authwithpeer(unit, user);
        auth |= EAP_WITHPEER;
     } else if (ho->neg_chap) {
-       ChapAuthWithPeer(unit, user, CHAP_DIGEST(ho->chap_mdtype));
+       chap_auth_with_peer(unit, user, CHAP_DIGEST(ho->chap_mdtype));
        auth |= CHAP_WITHPEER;
     } else if (ho->neg_upap) {
        if (passwd[0] == 0) {
@@ -799,7 +801,7 @@ auth_peer_success(unit, protocol, prot_flavor, name, namelen)
     case PPP_CHAP:
        bit = CHAP_PEER;
        switch (prot_flavor) {
-       case CHAP_DIGEST_MD5:
+       case CHAP_MD5:
            bit |= CHAP_MD5_PEER;
            break;
 #ifdef CHAPMS
@@ -875,7 +877,7 @@ auth_withpeer_success(unit, protocol, prot_flavor)
     case PPP_CHAP:
        bit = CHAP_WITHPEER;
        switch (prot_flavor) {
-       case CHAP_DIGEST_MD5:
+       case CHAP_MD5:
            bit |= CHAP_MD5_WITHPEER;
            break;
 #ifdef CHAPMS
@@ -1065,8 +1067,8 @@ connect_time_expired(arg)
     void *arg;
 {
     info("Connect time expired");
-    lcp_close(0, "Connect time expired");      /* Close connection */
     status = EXIT_CONNECT_TIME;
+    lcp_close(0, "Connect time expired");      /* Close connection */
 }
 
 /*
@@ -1102,12 +1104,14 @@ auth_check_options()
     if (auth_required) {
        allow_any_ip = 0;
        if (!wo->neg_chap && !wo->neg_upap && !wo->neg_eap) {
-           wo->neg_chap = 1; wo->chap_mdtype = MDTYPE_ALL;
+           wo->neg_chap = chap_mdtype_all != MDTYPE_NONE;
+           wo->chap_mdtype = chap_mdtype_all;
            wo->neg_upap = 1;
            wo->neg_eap = 1;
        }
     } else {
-       wo->neg_chap = 0; wo->chap_mdtype = MDTYPE_NONE;
+       wo->neg_chap = 0;
+       wo->chap_mdtype = MDTYPE_NONE;
        wo->neg_upap = 0;
        wo->neg_eap = 0;
     }
@@ -1149,6 +1153,14 @@ auth_check_options()
 
        exit(1);
     }
+
+    /*
+     * Early check for remote number authorization.
+     */
+    if (!auth_number()) {
+       warn("calling number %q is not authorized", remote_number);
+       exit(EXIT_CNID_AUTH_FAILED);
+    }
 }
 
 /*
@@ -1236,14 +1248,15 @@ check_passwd(unit, auser, userlen, apasswd, passwdlen, msg)
     if (pap_auth_hook) {
        ret = (*pap_auth_hook)(user, passwd, msg, &addrs, &opts);
        if (ret >= 0) {
+           /* note: set_allowed_addrs() saves opts (but not addrs):
+              don't free it! */
            if (ret)
                set_allowed_addrs(unit, addrs, opts);
-           BZERO(passwd, sizeof(passwd));
+           else if (opts != 0)
+               free_wordlist(opts);
            if (addrs != 0)
                free_wordlist(addrs);
-           if (opts != 0) {
-               free_wordlist(opts);
-           }
+           BZERO(passwd, sizeof(passwd));
            return ret? UPAP_AUTHACK: UPAP_AUTHNAK;
        }
     }
@@ -1977,7 +1990,7 @@ set_allowed_addrs(unit, addrs, opts)
        } else {
            np = getnetbyname (ptr_word);
            if (np != NULL && np->n_addrtype == AF_INET) {
-               a = htonl (*(u_int32_t *)np->n_net);
+               a = htonl ((u_int32_t)np->n_net);
                if (ptr_mask == NULL) {
                    /* calculate appropriate mask for net */
                    ah = ntohl(a);