X-Git-Url: http://git.ozlabs.org/?p=ppp.git;a=blobdiff_plain;f=pppd%2Fchap.c;h=a63dde818fa01e0db3fcb14b062541d6180044e1;hp=c295bb360864520b2d98e06d27f21ed2f66ec175;hb=9b5e4bcdc6e25f18d20200af78df94d695e428ac;hpb=7bb8beb860037a6c18dd0b64b8d542a20aa2c8c0

diff --git a/pppd/chap.c b/pppd/chap.c
index c295bb3..a63dde8 100644
--- a/pppd/chap.c
+++ b/pppd/chap.c
@@ -33,7 +33,7 @@
  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  */
 
-#define RCSID	"$Id: chap.c,v 1.32 2002/05/21 17:26:49 dfs Exp $"
+#define RCSID	"$Id: chap.c,v 1.36 2002/10/12 02:30:21 fcusack Exp $"
 
 /*
  * TODO:
@@ -457,10 +457,8 @@ ChapReceiveChallenge(cstate, inp, id, len)
     rchallenge = inp;
     INCPTR(rchallenge_len, inp);
 
-    if (len >= sizeof(rhostname))
-	len = sizeof(rhostname) - 1;
-    BCOPY(inp, rhostname, len);
-    rhostname[len] = '\000';
+    /* Null terminate and clean remote name. */
+    slprintf(rhostname, sizeof(rhostname), "%.*v", len, inp);
 
     /* Microsoft doesn't send their name back in the PPP packet */
     if (explicit_remote || (remote_name[0] != 0 && rhostname[0] == 0)) {
@@ -500,7 +498,6 @@ ChapReceiveChallenge(cstate, inp, id, len)
     case CHAP_MICROSOFT:
 	ChapMS(cstate, rchallenge, secret, secret_len,
 	       (MS_ChapResponse *) cstate->response);
-	cstate->resp_length = MS_CHAP_RESPONSE_LEN;
 	break;
 
     case CHAP_MICROSOFT_V2:
@@ -509,7 +506,6 @@ ChapReceiveChallenge(cstate, inp, id, len)
 		cstate->resp_name, secret, secret_len,
 		(MS_Chap2Response *) cstate->response, cstate->earesponse,
 		 MS_CHAP2_AUTHENTICATEE);
-	cstate->resp_length = MS_CHAP2_RESPONSE_LEN;
 	break;
 #endif /* CHAPMS */
 
@@ -601,6 +597,19 @@ ChapReceiveResponse(cstate, inp, id, len)
 	code = (*chap_auth_hook) ( (explicit_remote ? remote_name : rhostname),
 				   remmd, (int) remmd_len,
 				   cstate );
+	/*
+	 * Check remote number authorization.  A plugin may have filled in
+	 * the remote number or added an allowed number, and rather than
+	 * return an authenticate failure, is leaving it for us to verify.
+	 */
+	if (code == CHAP_SUCCESS) {
+	    if (!auth_number()) {
+		/* We do not want to leak info about the chap result. */
+		code = CHAP_FAILURE; /* XXX exit value will be "wrong" */
+		warn("calling number %q is not authorized", remote_number);
+	    }
+	}
+
     } else {
 	if (!get_secret(cstate->unit, (explicit_remote? remote_name: rhostname),
 			cstate->chal_name, secret, &secret_len, 1)) {
@@ -702,7 +711,7 @@ ChapReceiveResponse(cstate, inp, id, len)
 	notice("CHAP peer authentication succeeded for %q", rhostname);
 
     } else {
-	error("CHAP peer authentication failed for remote host %q", rhostname);
+	warn("CHAP peer authentication failed for %q", rhostname);
 	cstate->serverstate = CHAPSS_BADAUTH;
 	auth_peer_fail(cstate->unit, PPP_CHAP);
     }
@@ -770,6 +779,7 @@ ChapReceiveSuccess(cstate, inp, id, len)
 
     cstate->clientstate = CHAPCS_OPEN;
 
+    notice("CHAP authentication succeeded");
     auth_withpeer_success(cstate->unit, PPP_CHAP, cstate->resp_type);
 }