X-Git-Url: http://git.ozlabs.org/?p=ppp.git;a=blobdiff_plain;f=pppd%2Fchap.c;h=25427e2d15b133c96ccefd147b4270fe284ea0b2;hp=2fcd3a5ae8301e7963886a4317e63d0641b1a547;hb=c062322f9e8757b85a3c2281a3190d8af14bcd9b;hpb=82560dd131f497476d2ae1eddc5ac5005ffb3e2c

diff --git a/pppd/chap.c b/pppd/chap.c
index 2fcd3a5..25427e2 100644
--- a/pppd/chap.c
+++ b/pppd/chap.c
@@ -1,5 +1,5 @@
 /*
- * chap.c - Challenge Handshake Authentication Protocol.
+ * chap_ms.c - Challenge Handshake Authentication Protocol.
  *
  * Copyright (c) 1993 The Australian National University.
  * All rights reserved.
@@ -33,9 +33,7 @@
  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  */
 
-#ifndef lint
-static char rcsid[] = "$Id: chap.c,v 1.13 1996/07/01 01:12:09 paulus Exp $";
-#endif
+#define RCSID	"$Id: chap.c,v 1.27 2002/03/01 14:39:18 dfs Exp $"
 
 /*
  * TODO:
@@ -45,7 +43,6 @@ static char rcsid[] = "$Id: chap.c,v 1.13 1996/07/01 01:12:09 paulus Exp $";
 #include <string.h>
 #include <sys/types.h>
 #include <sys/time.h>
-#include <syslog.h>
 
 #include "pppd.h"
 #include "chap.h"
@@ -54,6 +51,37 @@ static char rcsid[] = "$Id: chap.c,v 1.13 1996/07/01 01:12:09 paulus Exp $";
 #include "chap_ms.h"
 #endif
 
+/* Hook for a plugin to say if we can possibly authenticate a peer using CHAP */
+int (*chap_check_hook) __P((void)) = NULL;
+
+/* Hook for a plugin to get the CHAP password for authenticating us */
+int (*chap_passwd_hook) __P((char *user, char *passwd)) = NULL;
+
+/* Hook for a plugin to validate CHAP challenge */
+int (*chap_auth_hook) __P((char *user,
+			   u_char *remmd,
+			   int remmd_len,
+			   chap_state *cstate)) = NULL;
+
+static const char rcsid[] = RCSID;
+
+/*
+ * Command-line options.
+ */
+static option_t chap_option_list[] = {
+    { "chap-restart", o_int, &chap[0].timeouttime,
+      "Set timeout for CHAP", OPT_PRIO },
+    { "chap-max-challenge", o_int, &chap[0].max_transmits,
+      "Set max #xmits for challenge", OPT_PRIO },
+    { "chap-interval", o_int, &chap[0].chal_interval,
+      "Set interval for rechallenge", OPT_PRIO },
+#ifdef MSLANMAN
+    { "ms-lanman", o_bool, &ms_lanman,
+      "Use LanMan passwd when using MS-CHAP", 1 },
+#endif
+    { NULL }
+};
+
 /*
  * Protocol entry points.
  */
@@ -79,15 +107,18 @@ struct protent chap_protent = {
     1,
     "CHAP",
     NULL,
+    chap_option_list,
+    NULL,
     NULL,
     NULL
 };
 
 chap_state chap[NUM_PPP];		/* CHAP state; one for each unit */
 
-static void ChapChallengeTimeout __P((caddr_t));
-static void ChapResponseTimeout __P((caddr_t));
+static void ChapChallengeTimeout __P((void *));
+static void ChapResponseTimeout __P((void *));
 static void ChapReceiveChallenge __P((chap_state *, u_char *, int, int));
+static void ChapRechallenge __P((void *));
 static void ChapReceiveResponse __P((chap_state *, u_char *, int, int));
 static void ChapReceiveSuccess __P((chap_state *, u_char *, int, int));
 static void ChapReceiveFailure __P((chap_state *, u_char *, int, int));
@@ -142,7 +173,7 @@ ChapAuthWithPeer(unit, our_name, digest)
 
     /*
      * We get here as a result of LCP coming up.
-     * So even if CHAP was open before, we will 
+     * So even if CHAP was open before, we will
      * have to re-authenticate ourselves.
      */
     cstate->clientstate = CHAPCS_LISTEN;
@@ -159,7 +190,7 @@ ChapAuthPeer(unit, our_name, digest)
     int digest;
 {
     chap_state *cstate = &chap[unit];
-  
+
     cstate->chal_name = our_name;
     cstate->chal_type = digest;
 
@@ -181,10 +212,10 @@ ChapAuthPeer(unit, our_name, digest)
  */
 static void
 ChapChallengeTimeout(arg)
-    caddr_t arg;
+    void *arg;
 {
     chap_state *cstate = (chap_state *) arg;
-  
+
     /* if we aren't sending challenges, don't worry.  then again we */
     /* probably shouldn't be here either */
     if (cstate->serverstate != CHAPSS_INITIAL_CHAL &&
@@ -193,7 +224,7 @@ ChapChallengeTimeout(arg)
 
     if (cstate->chal_transmits >= cstate->max_transmits) {
 	/* give up on peer */
-	syslog(LOG_ERR, "Peer failed to respond to CHAP challenge");
+	error("Peer failed to respond to CHAP challenge");
 	cstate->serverstate = CHAPSS_BADAUTH;
 	auth_peer_fail(cstate->unit, PPP_CHAP);
 	return;
@@ -208,7 +239,7 @@ ChapChallengeTimeout(arg)
  */
 static void
 ChapResponseTimeout(arg)
-    caddr_t arg;
+    void *arg;
 {
     chap_state *cstate = (chap_state *) arg;
 
@@ -225,7 +256,7 @@ ChapResponseTimeout(arg)
  */
 static void
 ChapRechallenge(arg)
-    caddr_t arg;
+    void *arg;
 {
     chap_state *cstate = (chap_state *) arg;
 
@@ -249,7 +280,7 @@ ChapLowerUp(unit)
     int unit;
 {
     chap_state *cstate = &chap[unit];
-  
+
     if (cstate->clientstate == CHAPCS_INITIAL)
 	cstate->clientstate = CHAPCS_CLOSED;
     else if (cstate->clientstate == CHAPCS_PENDING)
@@ -275,16 +306,16 @@ ChapLowerDown(unit)
     int unit;
 {
     chap_state *cstate = &chap[unit];
-  
+
     /* Timeout(s) pending?  Cancel if so. */
     if (cstate->serverstate == CHAPSS_INITIAL_CHAL ||
 	cstate->serverstate == CHAPSS_RECHALLENGE)
-	UNTIMEOUT(ChapChallengeTimeout, (caddr_t) cstate);
+	UNTIMEOUT(ChapChallengeTimeout, cstate);
     else if (cstate->serverstate == CHAPSS_OPEN
 	     && cstate->chal_interval != 0)
-	UNTIMEOUT(ChapRechallenge, (caddr_t) cstate);
+	UNTIMEOUT(ChapRechallenge, cstate);
     if (cstate->clientstate == CHAPCS_RESPONSE)
-	UNTIMEOUT(ChapResponseTimeout, (caddr_t) cstate);
+	UNTIMEOUT(ChapResponseTimeout, cstate);
 
     cstate->clientstate = CHAPCS_INITIAL;
     cstate->serverstate = CHAPSS_INITIAL;
@@ -323,29 +354,29 @@ ChapInput(unit, inpacket, packet_len)
     u_char *inp;
     u_char code, id;
     int len;
-  
+
     /*
      * Parse header (code, id and length).
      * If packet too short, drop it.
      */
     inp = inpacket;
     if (packet_len < CHAP_HEADERLEN) {
-	CHAPDEBUG((LOG_INFO, "ChapInput: rcvd short header."));
+	CHAPDEBUG(("ChapInput: rcvd short header."));
 	return;
     }
     GETCHAR(code, inp);
     GETCHAR(id, inp);
     GETSHORT(len, inp);
     if (len < CHAP_HEADERLEN) {
-	CHAPDEBUG((LOG_INFO, "ChapInput: rcvd illegal length."));
+	CHAPDEBUG(("ChapInput: rcvd illegal length."));
 	return;
     }
     if (len > packet_len) {
-	CHAPDEBUG((LOG_INFO, "ChapInput: rcvd short packet."));
+	CHAPDEBUG(("ChapInput: rcvd short packet."));
 	return;
     }
     len -= CHAP_HEADERLEN;
-  
+
     /*
      * Action depends on code (as in fact it usually does :-).
      */
@@ -353,11 +384,11 @@ ChapInput(unit, inpacket, packet_len)
     case CHAP_CHALLENGE:
 	ChapReceiveChallenge(cstate, inp, id, len);
 	break;
-    
+
     case CHAP_RESPONSE:
 	ChapReceiveResponse(cstate, inp, id, len);
 	break;
-    
+
     case CHAP_FAILURE:
 	ChapReceiveFailure(cstate, inp, id, len);
 	break;
@@ -367,7 +398,7 @@ ChapInput(unit, inpacket, packet_len)
 	break;
 
     default:				/* Need code reject? */
-	syslog(LOG_WARNING, "Unknown CHAP code (%d) received.", code);
+	warn("Unknown CHAP code (%d) received.", code);
 	break;
     }
 }
@@ -389,24 +420,23 @@ ChapReceiveChallenge(cstate, inp, id, len)
     char secret[MAXSECRETLEN];
     char rhostname[256];
     MD5_CTX mdContext;
- 
-    CHAPDEBUG((LOG_INFO, "ChapReceiveChallenge: Rcvd id %d.", id));
+    u_char hash[MD5_SIGNATURE_SIZE];
+
     if (cstate->clientstate == CHAPCS_CLOSED ||
 	cstate->clientstate == CHAPCS_PENDING) {
-	CHAPDEBUG((LOG_INFO, "ChapReceiveChallenge: in state %d",
-		   cstate->clientstate));
+	CHAPDEBUG(("ChapReceiveChallenge: in state %d", cstate->clientstate));
 	return;
     }
 
     if (len < 2) {
-	CHAPDEBUG((LOG_INFO, "ChapReceiveChallenge: rcvd short packet."));
+	CHAPDEBUG(("ChapReceiveChallenge: rcvd short packet."));
 	return;
     }
 
     GETCHAR(rchallenge_len, inp);
     len -= sizeof (u_char) + rchallenge_len;	/* now name field length */
     if (len < 0) {
-	CHAPDEBUG((LOG_INFO, "ChapReceiveChallenge: rcvd short packet."));
+	CHAPDEBUG(("ChapReceiveChallenge: rcvd short packet."));
 	return;
     }
     rchallenge = inp;
@@ -417,13 +447,10 @@ ChapReceiveChallenge(cstate, inp, id, len)
     BCOPY(inp, rhostname, len);
     rhostname[len] = '\000';
 
-    CHAPDEBUG((LOG_INFO, "ChapReceiveChallenge: received name field '%s'",
-	       rhostname));
-
     /* Microsoft doesn't send their name back in the PPP packet */
-    if (rhostname[0] == 0 && cstate->resp_type == CHAP_MICROSOFT) {
-	strcpy(rhostname, remote_name);
-	CHAPDEBUG((LOG_INFO, "ChapReceiveChallenge: using '%s' as remote name",
+    if (explicit_remote || (remote_name[0] != 0 && rhostname[0] == 0)) {
+	strlcpy(rhostname, remote_name, sizeof(rhostname));
+	CHAPDEBUG(("ChapReceiveChallenge: using '%q' as remote name",
 		   rhostname));
     }
 
@@ -431,27 +458,26 @@ ChapReceiveChallenge(cstate, inp, id, len)
     if (!get_secret(cstate->unit, cstate->resp_name, rhostname,
 		    secret, &secret_len, 0)) {
 	secret_len = 0;		/* assume null secret if can't find one */
-	syslog(LOG_WARNING, "No CHAP secret found for authenticating us to %s",
-	       rhostname);
+	warn("No CHAP secret found for authenticating us to %q", rhostname);
     }
 
     /* cancel response send timeout if necessary */
     if (cstate->clientstate == CHAPCS_RESPONSE)
-	UNTIMEOUT(ChapResponseTimeout, (caddr_t) cstate);
+	UNTIMEOUT(ChapResponseTimeout, cstate);
 
     cstate->resp_id = id;
     cstate->resp_transmits = 0;
 
     /*  generate MD based on negotiated type */
-    switch (cstate->resp_type) { 
+    switch (cstate->resp_type) {
 
     case CHAP_DIGEST_MD5:
 	MD5Init(&mdContext);
 	MD5Update(&mdContext, &cstate->resp_id, 1);
 	MD5Update(&mdContext, secret, secret_len);
 	MD5Update(&mdContext, rchallenge, rchallenge_len);
-	MD5Final(&mdContext);
-	BCOPY(mdContext.digest, cstate->response, MD5_SIGNATURE_SIZE);
+	MD5Final(hash, &mdContext);
+	BCOPY(hash, cstate->response, MD5_SIGNATURE_SIZE);
 	cstate->resp_length = MD5_SIGNATURE_SIZE;
 	break;
 
@@ -462,7 +488,7 @@ ChapReceiveChallenge(cstate, inp, id, len)
 #endif
 
     default:
-	CHAPDEBUG((LOG_INFO, "unknown digest type %d", cstate->resp_type));
+	CHAPDEBUG(("unknown digest type %d", cstate->resp_type));
 	return;
     }
 
@@ -487,13 +513,11 @@ ChapReceiveResponse(cstate, inp, id, len)
     char rhostname[256];
     MD5_CTX mdContext;
     char secret[MAXSECRETLEN];
-
-    CHAPDEBUG((LOG_INFO, "ChapReceiveResponse: Rcvd id %d.", id));
+    u_char hash[MD5_SIGNATURE_SIZE];
 
     if (cstate->serverstate == CHAPSS_CLOSED ||
 	cstate->serverstate == CHAPSS_PENDING) {
-	CHAPDEBUG((LOG_INFO, "ChapReceiveResponse: in state %d",
-		   cstate->serverstate));
+	CHAPDEBUG(("ChapReceiveResponse: in state %d", cstate->serverstate));
 	return;
     }
 
@@ -515,7 +539,7 @@ ChapReceiveResponse(cstate, inp, id, len)
     }
 
     if (len < 2) {
-	CHAPDEBUG((LOG_INFO, "ChapReceiveResponse: rcvd short packet."));
+	CHAPDEBUG(("ChapReceiveResponse: rcvd short packet."));
 	return;
     }
     GETCHAR(remmd_len, inp);		/* get length of MD */
@@ -524,54 +548,86 @@ ChapReceiveResponse(cstate, inp, id, len)
 
     len -= sizeof (u_char) + remmd_len;
     if (len < 0) {
-	CHAPDEBUG((LOG_INFO, "ChapReceiveResponse: rcvd short packet."));
+	CHAPDEBUG(("ChapReceiveResponse: rcvd short packet."));
 	return;
     }
 
-    UNTIMEOUT(ChapChallengeTimeout, (caddr_t) cstate);
+    UNTIMEOUT(ChapChallengeTimeout, cstate);
 
     if (len >= sizeof(rhostname))
 	len = sizeof(rhostname) - 1;
     BCOPY(inp, rhostname, len);
     rhostname[len] = '\000';
 
-    CHAPDEBUG((LOG_INFO, "ChapReceiveResponse: received name field: %s",
-	       rhostname));
-
     /*
      * Get secret for authenticating them with us,
      * do the hash ourselves, and compare the result.
      */
     code = CHAP_FAILURE;
-    if (!get_secret(cstate->unit, rhostname, cstate->chal_name,
-		   secret, &secret_len, 1)) {
-	syslog(LOG_WARNING, "No CHAP secret found for authenticating %s",
-	       rhostname);
-    } else {
 
-	/*  generate MD based on negotiated type */
-	switch (cstate->chal_type) { 
-
-	case CHAP_DIGEST_MD5:		/* only MD5 is defined for now */
-	    if (remmd_len != MD5_SIGNATURE_SIZE)
-		break;			/* it's not even the right length */
-	    MD5Init(&mdContext);
-	    MD5Update(&mdContext, &cstate->chal_id, 1);
-	    MD5Update(&mdContext, secret, secret_len);
-	    MD5Update(&mdContext, cstate->challenge, cstate->chal_len);
-	    MD5Final(&mdContext); 
-
-	    /* compare local and remote MDs and send the appropriate status */
-	    if (memcmp (mdContext.digest, remmd, MD5_SIGNATURE_SIZE) == 0)
-		code = CHAP_SUCCESS;	/* they are the same! */
-	    break;
+    /* If a plugin will verify the response, let the plugin do it. */
+    if (chap_auth_hook) {
+	code = (*chap_auth_hook) ( (explicit_remote ? remote_name : rhostname),
+				   remmd, (int) remmd_len,
+				   cstate );
+    } else {
+	if (!get_secret(cstate->unit, (explicit_remote? remote_name: rhostname),
+			cstate->chal_name, secret, &secret_len, 1)) {
+	    warn("No CHAP secret found for authenticating %q", rhostname);
+	} else {
+
+	    /*  generate MD based on negotiated type */
+	    switch (cstate->chal_type) {
+
+	    case CHAP_DIGEST_MD5:
+		if (remmd_len != MD5_SIGNATURE_SIZE)
+		    break;			/* not even the right length */
+		MD5Init(&mdContext);
+		MD5Update(&mdContext, &cstate->chal_id, 1);
+		MD5Update(&mdContext, secret, secret_len);
+		MD5Update(&mdContext, cstate->challenge, cstate->chal_len);
+		MD5Final(hash, &mdContext);
+
+		/* compare MDs and send the appropriate status */
+		if (memcmp (hash, remmd, MD5_SIGNATURE_SIZE) == 0)
+		    code = CHAP_SUCCESS;	/* they are the same! */
+		break;
 
-	default:
-	    CHAPDEBUG((LOG_INFO, "unknown digest type %d", cstate->chal_type));
+#ifdef CHAPMS
+	    case CHAP_MICROSOFT:
+	    {
+		int response_offset, response_size;
+
+		if (remmd_len != MS_CHAP_RESPONSE_LEN)
+		    break;			/* not even the right length */
+		ChapMS(cstate, cstate->challenge, cstate->chal_len,
+		       secret, secret_len);
+
+		/* Determine which part of response to verify against */
+		if ((u_char *) (remmd + offsetof(MS_ChapResponse, UseNT))) {
+		    response_offset = offsetof(MS_ChapResponse, NTResp);
+		    response_size = sizeof(((MS_ChapResponse *) remmd)->NTResp);
+		} else {
+		    response_offset = offsetof(MS_ChapResponse, LANManResp);
+		    response_size =
+			sizeof(((MS_ChapResponse *) remmd)->LANManResp);
+		}
+
+		/* compare MDs and send the appropriate status */
+		if (memcmp(cstate->response + response_offset,
+		    remmd + response_offset, response_size) == 0)
+		    code = CHAP_SUCCESS;	/* they are the same! */
+		break;
+	    }
+#endif /* CHAPMS */
+
+	    default:
+		CHAPDEBUG(("unknown digest type %d", cstate->chal_type));
+	    }
 	}
-    }
 
-    BZERO(secret, sizeof(secret));
+	BZERO(secret, sizeof(secret));
+    }
     ChapSendStatus(cstate, code);
 
     if (code == CHAP_SUCCESS) {
@@ -581,10 +637,11 @@ ChapReceiveResponse(cstate, inp, id, len)
 	    auth_peer_success(cstate->unit, PPP_CHAP, rhostname, len);
 	}
 	if (cstate->chal_interval != 0)
-	    TIMEOUT(ChapRechallenge, (caddr_t) cstate, cstate->chal_interval);
+	    TIMEOUT(ChapRechallenge, cstate, cstate->chal_interval);
+	notice("CHAP peer authentication succeeded for %q", rhostname);
 
     } else {
-	syslog(LOG_ERR, "CHAP peer authentication failed");
+	error("CHAP peer authentication failed for remote host %q", rhostname);
 	cstate->serverstate = CHAPSS_BADAUTH;
 	auth_peer_fail(cstate->unit, PPP_CHAP);
     }
@@ -601,20 +658,17 @@ ChapReceiveSuccess(cstate, inp, id, len)
     int len;
 {
 
-    CHAPDEBUG((LOG_INFO, "ChapReceiveSuccess: Rcvd id %d.", id));
-
     if (cstate->clientstate == CHAPCS_OPEN)
 	/* presumably an answer to a duplicate response */
 	return;
 
     if (cstate->clientstate != CHAPCS_RESPONSE) {
 	/* don't know what this is */
-	CHAPDEBUG((LOG_INFO, "ChapReceiveSuccess: in state %d\n",
-		   cstate->clientstate));
+	CHAPDEBUG(("ChapReceiveSuccess: in state %d\n", cstate->clientstate));
 	return;
     }
 
-    UNTIMEOUT(ChapResponseTimeout, (caddr_t) cstate);
+    UNTIMEOUT(ChapResponseTimeout, cstate);
 
     /*
      * Print message.
@@ -638,16 +692,13 @@ ChapReceiveFailure(cstate, inp, id, len)
     u_char id;
     int len;
 {
-    CHAPDEBUG((LOG_INFO, "ChapReceiveFailure: Rcvd id %d.", id));
-
     if (cstate->clientstate != CHAPCS_RESPONSE) {
 	/* don't know what this is */
-	CHAPDEBUG((LOG_INFO, "ChapReceiveFailure: in state %d\n",
-		   cstate->clientstate));
+	CHAPDEBUG(("ChapReceiveFailure: in state %d\n", cstate->clientstate));
 	return;
     }
 
-    UNTIMEOUT(ChapResponseTimeout, (caddr_t) cstate);
+    UNTIMEOUT(ChapResponseTimeout, cstate);
 
     /*
      * Print message.
@@ -655,7 +706,7 @@ ChapReceiveFailure(cstate, inp, id, len)
     if (len > 0)
 	PRINTMSG(inp, len);
 
-    syslog(LOG_ERR, "CHAP authentication failed");
+    error("CHAP authentication failed");
     auth_withpeer_fail(cstate->unit, PPP_CHAP);
 }
 
@@ -689,10 +740,8 @@ ChapSendChallenge(cstate)
     BCOPY(cstate->chal_name, outp, name_len);	/* append hostname */
 
     output(cstate->unit, outpacket_buf, outlen + PPP_HDRLEN);
-  
-    CHAPDEBUG((LOG_INFO, "ChapSendChallenge: Sent id %d.", cstate->chal_id));
 
-    TIMEOUT(ChapChallengeTimeout, (caddr_t) cstate, cstate->timeouttime);
+    TIMEOUT(ChapChallengeTimeout, cstate, cstate->timeouttime);
     ++cstate->chal_transmits;
 }
 
@@ -710,24 +759,21 @@ ChapSendStatus(cstate, code)
     char msg[256];
 
     if (code == CHAP_SUCCESS)
-	sprintf(msg, "Welcome to %s.", hostname);
+	slprintf(msg, sizeof(msg), "Welcome to %s.", hostname);
     else
-	sprintf(msg, "I don't like you.  Go 'way.");
+	slprintf(msg, sizeof(msg), "I don't like you.  Go 'way.");
     msglen = strlen(msg);
 
     outlen = CHAP_HEADERLEN + msglen;
     outp = outpacket_buf;
 
     MAKEHEADER(outp, PPP_CHAP);	/* paste in a header */
-  
+
     PUTCHAR(code, outp);
     PUTCHAR(cstate->chal_id, outp);
     PUTSHORT(outlen, outp);
     BCOPY(msg, outp, msglen);
     output(cstate->unit, outpacket_buf, outlen + PPP_HDRLEN);
-  
-    CHAPDEBUG((LOG_INFO, "ChapSendStatus: Sent code %d, id %d.", code,
-	       cstate->chal_id));
 }
 
 /*
@@ -741,21 +787,39 @@ static void
 ChapGenChallenge(cstate)
     chap_state *cstate;
 {
-    int chal_len;
+    int chal_len = 0; /* Avoid compiler warning */
     u_char *ptr = cstate->challenge;
-    unsigned int i;
+    int i;
+
+    switch (cstate->chal_type) {
+    case CHAP_DIGEST_MD5:
+	/*
+	 * pick a random challenge length between MIN_CHALLENGE_LENGTH and
+	 * MAX_CHALLENGE_LENGTH
+	 */
+	chal_len = (unsigned) ((drand48() *
+				(MAX_CHALLENGE_LENGTH - MIN_CHALLENGE_LENGTH)) +
+				MIN_CHALLENGE_LENGTH);
+	break;
+
+#ifdef CHAPMS
+    case CHAP_MICROSOFT:
+	/* MS-CHAP is fixed to an 8 octet challenge. */
+	chal_len = 8;
+	break;
+#endif
+    default:
+	fatal("ChapGenChallenge: Unsupported challenge type %d",
+	      (int) cstate->chal_type);
+	break;
+    }
 
-    /* pick a random challenge length between MIN_CHALLENGE_LENGTH and 
-       MAX_CHALLENGE_LENGTH */  
-    chal_len =  (unsigned) ((drand48() *
-			     (MAX_CHALLENGE_LENGTH - MIN_CHALLENGE_LENGTH)) +
-			    MIN_CHALLENGE_LENGTH);
     cstate->chal_len = chal_len;
     cstate->chal_id = ++cstate->id;
     cstate->chal_transmits = 0;
 
     /* generate a random string */
-    for (i = 0; i < chal_len; i++ )
+    for (i = 0; i < chal_len; i++)
 	*ptr++ = (char) (drand48() * 0xff);
 }
 
@@ -792,7 +856,7 @@ ChapSendResponse(cstate)
     output(cstate->unit, outpacket_buf, outlen + PPP_HDRLEN);
 
     cstate->clientstate = CHAPCS_RESPONSE;
-    TIMEOUT(ChapResponseTimeout, (caddr_t) cstate, cstate->timeouttime);
+    TIMEOUT(ChapResponseTimeout, cstate, cstate->timeouttime);
     ++cstate->resp_transmits;
 }