pppd: add experimental support for PEAP protocol, an extension of EAP

[ppp.git] / pppd / auth.c

diff --git a/pppd/auth.c b/pppd/auth.c
index 0a49f53e9f3711ef481856b6fbdffeae29ba496c..75003523b1a7c47d887c414ec48200306f0f657f 100644 (file)
--- a/pppd/auth.c
+++ b/pppd/auth.c
@@ -70,6 +70,10 @@
 
 #define RCSID  "$Id: auth.c,v 1.117 2008/07/01 12:27:56 paulus Exp $"
 
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
 #include <stdio.h>
 #include <stddef.h>
 #include <stdlib.h>
@@ -93,7 +97,7 @@
 #include <arpa/inet.h>
 
 
-#ifdef HAS_SHADOW
+#ifdef HAVE_SHADOW_H
 #include <shadow.h>
 #ifndef PW_PPP
 #define PW_PPP PW_LOGIN
@@ -101,6 +105,10 @@
 #endif
 #include <time.h>
 
+#ifdef HAVE_CRYPT_H
+#include <crypt.h>
+#endif
+
 #ifdef SYSTEMD
 #include <systemd/sd-daemon.h>
 #endif
@@ -263,11 +271,10 @@ char *tls_verify_method = NULL;
 bool tls_verify_key_usage = 0;
 bool need_peer_eap = 0;                        /* Require peer to authenticate us */
 #endif
+bool tls_verify_cert = 0;      /* Do not verify server's SSL certificate */
 
 static char *uafname;          /* name of most recent +ua file */
 
-extern char *crypt (const char *, const char *);
-
 /* Prototypes for procedures local to this file. */
 
 static void network_phase (int);
@@ -439,6 +446,9 @@ option_t auth_options[] = {
       "Set telephone number(s) which are allowed to connect",
       OPT_PRIV | OPT_A2LIST },
 
+    { "tls-verify-certificate", o_bool, &tls_verify_cert,
+      "Enable server's SSL certificate validation", 1 },
+
 #ifdef USE_EAPTLS
     { "ca", o_string, &cacert_file,   "EAP-TLS CA certificate in PEM format" },
     { "capath", o_string, &ca_path,   "EAP-TLS CA certificate directory" },
@@ -1517,8 +1527,10 @@ check_passwd(int unit,
            if (secret[0] != 0 && !login_secret) {
                /* password given in pap-secrets - must match */
                if (cryptpap || strcmp(passwd, secret) != 0) {
+#ifdef HAVE_CRYPT_H
                    char *cbuf = crypt(passwd, secret);
                    if (!cbuf || strcmp(cbuf, secret) != 0)
+#endif
                        ret = UPAP_AUTHNAK;
                }
            }