X-Git-Url: http://git.ozlabs.org/?p=ppp.git;a=blobdiff_plain;f=pppd%2Fchap.c;h=e47d52f6ba68c76e610c229210e8f7fd8aaf81ab;hp=a48f69f2158500a8d906d3c79a47e1b39453bde0;hb=cccb82a2e9bbc20f343bf4ef7550f79566f84758;hpb=1aa145faffde86065d6ae1af4041d185c7733342

diff --git a/pppd/chap.c b/pppd/chap.c
index a48f69f..e47d52f 100644
--- a/pppd/chap.c
+++ b/pppd/chap.c
@@ -33,7 +33,7 @@
  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  */
 
-#define RCSID	"$Id: chap.c,v 1.33 2002/09/01 12:00:15 dfs Exp $"
+#define RCSID	"$Id: chap.c,v 1.35 2002/10/12 01:28:05 fcusack Exp $"
 
 /*
  * TODO:
@@ -457,10 +457,8 @@ ChapReceiveChallenge(cstate, inp, id, len)
     rchallenge = inp;
     INCPTR(rchallenge_len, inp);
 
-    if (len >= sizeof(rhostname))
-	len = sizeof(rhostname) - 1;
-    BCOPY(inp, rhostname, len);
-    rhostname[len] = '\000';
+    /* Null terminate and clean remote name. */
+    slprintf(rhostname, sizeof(rhostname), "%.*v", len, inp);
 
     /* Microsoft doesn't send their name back in the PPP packet */
     if (explicit_remote || (remote_name[0] != 0 && rhostname[0] == 0)) {
@@ -599,6 +597,19 @@ ChapReceiveResponse(cstate, inp, id, len)
 	code = (*chap_auth_hook) ( (explicit_remote ? remote_name : rhostname),
 				   remmd, (int) remmd_len,
 				   cstate );
+	/*
+	 * Check remote number authorization.  A plugin may have filled in
+	 * the remote number or added an allowed number, and rather than
+	 * return an authenticate failure, is leaving it for us to verify.
+	 */
+	if (code == CHAP_SUCCESS) {
+	    if (!auth_number()) {
+		/* We do not want to leak info about the chap result. */
+		code = CHAP_FAILURE; /* XXX exit value will be "wrong" */
+		error("calling number %q is not authorized", remote_number);
+	    }
+	}
+
     } else {
 	if (!get_secret(cstate->unit, (explicit_remote? remote_name: rhostname),
 			cstate->chal_name, secret, &secret_len, 1)) {
@@ -700,7 +711,7 @@ ChapReceiveResponse(cstate, inp, id, len)
 	notice("CHAP peer authentication succeeded for %q", rhostname);
 
     } else {
-	error("CHAP peer authentication failed for remote host %q", rhostname);
+	warn("CHAP peer authentication failed for %q", rhostname);
 	cstate->serverstate = CHAPSS_BADAUTH;
 	auth_peer_fail(cstate->unit, PPP_CHAP);
     }
@@ -768,6 +779,7 @@ ChapReceiveSuccess(cstate, inp, id, len)
 
     cstate->clientstate = CHAPCS_OPEN;
 
+    notice("CHAP authentication succeeded");
     auth_withpeer_success(cstate->unit, PPP_CHAP, cstate->resp_type);
 }