X-Git-Url: http://git.ozlabs.org/?p=ppp.git;a=blobdiff_plain;f=pppd%2Fauth.c;h=1532a74762491db5185519515e61eac8cd7c7246;hp=8ab97ab669fb50c16b5519be75c0c59abb27cad4;hb=bb516501a9c0acb4dd8c3fadc81ca9d74e338272;hpb=0e3ef87b18e5b71756b5b78e30775697573aac61 diff --git a/pppd/auth.c b/pppd/auth.c index 8ab97ab..1532a74 100644 --- a/pppd/auth.c +++ b/pppd/auth.c @@ -33,7 +33,7 @@ */ #ifndef lint -static char rcsid[] = "$Id: auth.c,v 1.28 1996/10/08 04:35:02 paulus Exp $"; +static char rcsid[] = "$Id: auth.c,v 1.31 1997/04/30 05:50:16 paulus Exp $"; #endif #include @@ -51,14 +51,6 @@ static char rcsid[] = "$Id: auth.c,v 1.28 1996/10/08 04:35:02 paulus Exp $"; #include #include -#ifdef SVR4 -#include -#else -#if defined(SUNOS4) || defined(ULTRIX) -extern char *crypt(); -#endif -#endif - #ifdef USE_PAM #include #include @@ -66,7 +58,9 @@ extern char *crypt(); #ifdef HAS_SHADOW #include +#ifndef SVR4 #include +#endif #ifndef PW_PPP #define PW_PPP PW_LOGIN #endif @@ -128,10 +122,13 @@ static int passwd_from_file; #define CHAP_WITHPEER 4 #define CHAP_PEER 8 +extern char *crypt __P((const char *, const char *)); + /* Prototypes for procedures local to this file. */ static void network_phase __P((int)); -static void check_idle __P((caddr_t)); +static void check_idle __P((void *)); +static void connect_time_expired __P((void *)); static int login __P((char *, char *, char **, int *)); static void logout __P((void)); static int null_login __P((int)); @@ -143,6 +140,7 @@ static int scan_authfile __P((FILE *, char *, char *, u_int32_t, char *, struct wordlist **, char *)); static void free_wordlist __P((struct wordlist *)); static void auth_script __P((char *)); +static void set_allowed_addrs __P((int, struct wordlist *)); #ifdef CBCP_SUPPORT static void callback_phase __P((int)); #endif @@ -197,7 +195,8 @@ link_down(unit) } num_np_open = 0; num_np_up = 0; - phase = PHASE_TERMINATE; + if (phase != PHASE_DEAD) + phase = PHASE_TERMINATE; } /* @@ -418,6 +417,13 @@ np_up(unit, proto) { if (num_np_up == 0 && idle_time_limit > 0) { TIMEOUT(check_idle, NULL, idle_time_limit); + + /* + * Set a timeout to close the connection once the maximum + * connect time has expired. + */ + if (maxconnect > 0) + TIMEOUT(connect_time_expired, 0, maxconnect); } ++num_np_up; } @@ -453,7 +459,7 @@ np_finished(unit, proto) */ static void check_idle(arg) - caddr_t arg; + void *arg; { struct ppp_idle idle; time_t itime; @@ -471,6 +477,17 @@ check_idle(arg) } } +/* + * connect_time_expired - log a message and close the connection. + */ +static void +connect_time_expired(arg) + void *arg; +{ + syslog(LOG_INFO, "Connect time expired"); + lcp_close(0, "Connect time expired"); /* Close connection */ +} + /* * auth_check_options - called to check authentication options. */ @@ -482,12 +499,6 @@ auth_check_options() ipcp_options *ipwo = &ipcp_wantoptions[0]; u_int32_t remote; - /* Check that we are running as root. */ - if (geteuid() != 0) { - option_error("must be run with root privileges"); - exit(1); - } - /* Default our_name to hostname, and user to our_name */ if (our_name[0] == 0 || usehostname) strcpy(our_name, hostname); @@ -512,6 +523,11 @@ auth_check_options() if (auth_required && !can_auth) { option_error("peer authentication required but no suitable secret(s) found\n"); + if (remote_name[0] == 0) + option_error("for authenticating any peer to us (%s)\n", our_name); + else + option_error("for authenticating peer %s to us (%s)\n", + remote_name, our_name); exit(1); } @@ -524,9 +540,9 @@ auth_check_options() option_error("can't override device name when noauth option used"); exit(1); } - if (connector != NULL && connector_info.priv == 0 - || disconnector != NULL && disconnector_info.priv == 0 - || welcomer != NULL && welcomer_info.priv == 0) { + if ((connector != NULL && connector_info.priv == 0) + || (disconnector != NULL && disconnector_info.priv == 0) + || (welcomer != NULL && welcomer_info.priv == 0)) { option_error("can't override connect, disconnect or welcome"); option_error("option values when noauth option used"); exit(1); @@ -611,10 +627,8 @@ check_passwd(unit, auser, userlen, apasswd, passwdlen, msg, msglen) ret = UPAP_AUTHACK; f = fopen(filename, "r"); if (f == NULL) { - if (!uselogin) { - syslog(LOG_ERR, "Can't open PAP password file %s: %m", filename); - ret = UPAP_AUTHNAK; - } + syslog(LOG_ERR, "Can't open PAP password file %s: %m", filename); + ret = UPAP_AUTHNAK; } else { check_access(f, filename); @@ -660,9 +674,7 @@ check_passwd(unit, auser, userlen, apasswd, passwdlen, msg, msglen) if (*msg == (char *) 0) *msg = "Login ok"; *msglen = strlen(*msg); - if (addresses[unit] != NULL) - free_wordlist(addresses[unit]); - addresses[unit] = addrs; + set_allowed_addrs(unit, addrs); } BZERO(passwd, sizeof(passwd)); @@ -671,68 +683,6 @@ check_passwd(unit, auser, userlen, apasswd, passwdlen, msg, msglen) return ret; } -#ifdef HAS_SHADOW -/************** - * This function was lifted from the shadow-3.3.2 version by John Haugh II. - * It is included because the function was not in the standard libshadow - * library. If it is included in the library then I can remove it from here. - */ - -#define DAY (24L*3600L) -/* - * isexpired - determine if account is expired yet - * - * isexpired calculates the expiration date based on the - * password expiration criteria. - */ - -/*ARGSUSED*/ -int -isexpired (pw, sp) -struct passwd *pw; -struct spwd *sp; -{ - long clock; - - clock = time ((time_t *) 0) / DAY; - - /* - * Quick and easy - there is an expired account field - * along with an inactive account field. Do the expired - * one first since it is worse. - */ - - if (sp->sp_expire > 0 && sp->sp_expire < clock) - return 3; - - if (sp->sp_inact > 0 && sp->sp_lstchg > 0 && sp->sp_max > 0 && - sp->sp_inact + sp->sp_lstchg + sp->sp_max < clock) - return 2; - - /* - * The last and max fields must be present for an account - * to have an expired password. A maximum of >10000 days - * is considered to be infinite. - */ - - if (sp->sp_lstchg == -1 || - sp->sp_max == -1 || sp->sp_max >= 10000L) - return 0; - - /* - * Calculate today's day and the day on which the password - * is going to expire. If that date has already passed, - * the password has expired. - */ - - if (sp->sp_lstchg + sp->sp_max < clock) - return 1; - - return 0; -} -#endif - - /* * This function is needed for PAM. However, it should not be called. * If it is, return the error code. @@ -786,7 +736,7 @@ login(user, passwd, msg, msglen) * Define the fields for the credintial validation */ (void) pam_set_item (pamh, PAM_AUTHTOK, passwd); - (void) pam_set_item (pamh, PAM_TTY, devnam); + (void) pam_set_item (pamh, PAM_TTY, devnam); /* * Validate the user */ @@ -808,55 +758,38 @@ login(user, passwd, msg, msglen) #else /* #ifdef USE_PAM */ struct passwd *pw; - char *epasswd; #ifdef HAS_SHADOW struct spwd *spwd; struct spwd *getspnam(); + extern int isexpired (struct passwd *, struct spwd *); /* in libshadow.a */ #endif - if ((pw = getpwnam(user)) == NULL) { + pw = getpwnam(user); + if (pw == NULL) { return (UPAP_AUTHNAK); } #ifdef HAS_SHADOW - if ((spwd = getspnam(user)) == NULL) { - pw->pw_passwd = ""; - } else { + spwd = getspnam(user); + endspent(); + if (spwd) { + /* check the age of the password entry */ + if (isexpired(pw, spwd)) { + syslog(LOG_WARNING,"Expired password for %s",user); + return (UPAP_AUTHNAK); + } pw->pw_passwd = spwd->sp_pwdp; } #endif /* - * XXX If no passwd, let them login without one. + * If no passwd, don't let them login. */ - if (pw->pw_passwd == '\0') { - return (UPAP_AUTHACK); - } - -#ifdef HAS_SHADOW - if (pw->pw_passwd) { - if (pw->pw_passwd[0] == '@') { - if (pw_auth (pw->pw_passwd+1, pw->pw_name, PW_PPP, NULL)) { - return (UPAP_AUTHNAK); - } - } else { - epasswd = pw_encrypt(passwd, pw->pw_passwd); - if (strcmp(epasswd, pw->pw_passwd)) { - return (UPAP_AUTHNAK); - } - } - /* check the age of the password entry */ - if (spwd && (isexpired (pw, spwd) != 0)) { - return (UPAP_AUTHNAK); - } - } -#else - epasswd = crypt(passwd, pw->pw_passwd); - if (strcmp(epasswd, pw->pw_passwd)) { + if (pw->pw_passwd == NULL || *pw->pw_passwd == '\0' + || strcmp(crypt(passwd, pw->pw_passwd), pw->pw_passwd) != 0) return (UPAP_AUTHNAK); - } -#endif + #endif /* #ifdef USE_PAM */ syslog(LOG_INFO, "user %s logged in", user); @@ -919,11 +852,10 @@ null_login(unit) ret = i >= 0 && (i & NONWILD_CLIENT) != 0 && secret[0] == 0; BZERO(secret, sizeof(secret)); - if (ret) { - if (addresses[unit] != NULL) - free_wordlist(addresses[unit]); - addresses[unit] = addrs; - } + if (ret) + set_allowed_addrs(unit, addrs); + else + free_wordlist(addrs); fclose(f); return ret; @@ -1063,11 +995,8 @@ get_secret(unit, client, server, secret, secret_len, save_addrs) if (ret < 0) return 0; - if (save_addrs) { - if (addresses[unit] != NULL) - free_wordlist(addresses[unit]); - addresses[unit] = addrs; - } + if (save_addrs) + set_allowed_addrs(unit, addrs); len = strlen(secbuf); if (len > MAXSECRETLEN) { @@ -1081,6 +1010,41 @@ get_secret(unit, client, server, secret, secret_len, save_addrs) return 1; } +/* + * set_allowed_addrs() - set the list of allowed addresses. + */ +static void +set_allowed_addrs(unit, addrs) + int unit; + struct wordlist *addrs; +{ + if (addresses[unit] != NULL) + free_wordlist(addresses[unit]); + addresses[unit] = addrs; + + /* + * If there's only one authorized address we might as well + * ask our peer for that one right away + */ + if (addrs != NULL && addrs->next == NULL) { + char *p = addrs->word; + struct ipcp_options *wo = &ipcp_wantoptions[unit]; + u_int32_t a; + struct hostent *hp; + + if (wo->hisaddr == 0 && *p != '!' && *p != '-' + && strchr(p, '/') == NULL) { + hp = gethostbyname(p); + if (hp != NULL && hp->h_addrtype == AF_INET) + a = *(u_int32_t *)hp->h_addr; + else + a = inet_addr(p); + if (a != (u_int32_t) -1) + wo->hisaddr = a; + } + } +} + /* * auth_ip_addr - check whether the peer is authorized to use * a given IP address. Returns 1 if authorized, 0 otherwise. @@ -1109,13 +1073,15 @@ ip_addr_check(addr, addrs) return 0; if (addrs == NULL) - return 1; /* no restriction */ + return !auth_required; /* no addresses authorized */ for (; addrs != NULL; addrs = addrs->next) { - /* "-" means no addresses authorized */ + /* "-" means no addresses authorized, "*" means any address allowed */ ptr_word = addrs->word; if (strcmp(ptr_word, "-") == 0) break; + if (strcmp(ptr_word, "*") == 0) + return 1; accept = 1; if (*ptr_word == '!') { @@ -1141,34 +1107,36 @@ ip_addr_check(addr, addrs) hp = gethostbyname(ptr_word); if (hp != NULL && hp->h_addrtype == AF_INET) { - a = *(u_int32_t *)hp->h_addr; - mask = ~ (u_int32_t) 0; /* are we sure we want this? */ + a = *(u_int32_t *)hp->h_addr; } else { np = getnetbyname (ptr_word); - if (np != NULL && np->n_addrtype == AF_INET) + if (np != NULL && np->n_addrtype == AF_INET) { a = htonl (*(u_int32_t *)np->n_net); - else + if (ptr_mask == NULL) { + /* calculate appropriate mask for net */ + ah = ntohl(a); + if (IN_CLASSA(ah)) + mask = IN_CLASSA_NET; + else if (IN_CLASSB(ah)) + mask = IN_CLASSB_NET; + else if (IN_CLASSC(ah)) + mask = IN_CLASSC_NET; + } + } else { a = inet_addr (ptr_word); - if (ptr_mask == NULL) { - /* calculate appropriate mask for net */ - ah = ntohl(a); - if (IN_CLASSA(ah)) - mask = IN_CLASSA_NET; - else if (IN_CLASSB(ah)) - mask = IN_CLASSB_NET; - else if (IN_CLASSC(ah)) - mask = IN_CLASSC_NET; } } if (ptr_mask != NULL) *ptr_mask = '/'; - if (a == -1L) + if (a == (u_int32_t)-1L) syslog (LOG_WARNING, "unknown host %s in auth. address list", addrs->word); else + /* Here a and addr are in network byte order, + and mask is in host order. */ if (((addr ^ a) & htonl(mask)) == 0) return accept; }